Analysis
-
max time kernel
83s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 05:35
Static task
static1
Behavioral task
behavioral1
Sample
fbff07598c7d0653a9a9f62f85e294b297b1747538d12031aef4fe8a9933fcbe.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
fbff07598c7d0653a9a9f62f85e294b297b1747538d12031aef4fe8a9933fcbe.exe
Resource
win10v2004-20241007-en
General
-
Target
fbff07598c7d0653a9a9f62f85e294b297b1747538d12031aef4fe8a9933fcbe.exe
-
Size
64KB
-
MD5
b0aa7bfb0950a06c6d6f152a73650455
-
SHA1
70ebb9716dbcc0287998cffc720d2e655f0d548f
-
SHA256
fbff07598c7d0653a9a9f62f85e294b297b1747538d12031aef4fe8a9933fcbe
-
SHA512
3c0f2d69c4815c14e1c67aea837704fdd8ffd50e74ded8cab5642881b340033271da85be4fb98b013253cd2bbe573190140b3c24752b6fcabd5f69c1278e75be
-
SSDEEP
768:4BrlEdOJcGa184JpP6dnTgRD9jKK84LiHnR+/1H5EXdnhgOPuM1DPf:+rm0cGaVPfRDFa+AZuYDPf
Malware Config
Extracted
berbew
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Licpki32.exeEligoe32.exeMaplcm32.exeDaqoafkh.exeMjddnjdf.exeClbdobpc.exeAieihpgi.exePciiccbm.exeCpafhpaj.exeOjdlkp32.exeIolohhpc.exeDpaceg32.exeNcpgeh32.exeHfjfpkji.exeIadphghe.exeBqilfp32.exeClheeh32.exeHiccbfoa.exeIionacad.exeKoidficq.exeEjjdmp32.exeHnnkbd32.exeFaljqcmk.exeGiljinne.exeIaipmm32.exeKegebn32.exeCemebcnf.exeGhkbccdn.exeIbeloo32.exeHjkdoh32.exeJpfehq32.exeKfioaaah.exeAagfffbo.exeHoegoqng.exeKffpcilf.exeEcdffe32.exePnhegi32.exeKnmjmodm.exeAkmlacdn.exeAeahjn32.exeGfigkljk.exeJbooen32.exeFkpeojha.exePlkchdiq.exeKmedck32.exeDlomnp32.exeBpnibl32.exeMbpibm32.exeKmeiei32.exePhmkaf32.exeDcnchg32.exeBchmolkm.exeOoeolkff.exeDamhmc32.exePaldmbmq.exeEnliaf32.exeDcojbm32.exeGcapckod.exeAaondi32.exeQlcgmpkp.exeNkphmc32.exeIlaieljl.exeEpnldd32.exePaemac32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Licpki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eligoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Maplcm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Daqoafkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mjddnjdf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Clbdobpc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aieihpgi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pciiccbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cpafhpaj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojdlkp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iolohhpc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dpaceg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ncpgeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hfjfpkji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iadphghe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bqilfp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Clheeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hiccbfoa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iionacad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Koidficq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ejjdmp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnnkbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Faljqcmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Giljinne.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iaipmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kegebn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cemebcnf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ghkbccdn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ibeloo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjkdoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jpfehq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kfioaaah.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aagfffbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hoegoqng.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kffpcilf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ecdffe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pnhegi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Knmjmodm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akmlacdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aeahjn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gfigkljk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jbooen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fkpeojha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Plkchdiq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kmedck32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dlomnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bpnibl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbpibm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmeiei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phmkaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcnchg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bchmolkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ooeolkff.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Damhmc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Paldmbmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Enliaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcojbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gcapckod.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aaondi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qlcgmpkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nkphmc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilaieljl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epnldd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Paemac32.exe -
Berbew family
-
Executes dropped EXE 64 IoCs
Processes:
Mjddnjdf.exeMbpibm32.exeNpffaq32.exeNbfobllj.exeNkbcgnie.exeNeghdg32.exeNlapaapg.exeOdoakckp.exeOpebpdad.exeOcdnloph.exeOeegnj32.exeOegdcj32.exePiemih32.exePlffkc32.exePgogla32.exePqjhjf32.exeQoaaqb32.exeAfnfcl32.exeAeccdila.exeAkmlacdn.exeAeepjh32.exeAkphfbbl.exeAalaoipc.exeAaondi32.exeBkdbab32.exeBnbnnm32.exeBfncbp32.exeBcdpacgl.exeBlodefdg.exeBfeibo32.exeCejfckie.exeCbnfmo32.exeCelbik32.exeChkoef32.exeChohqebq.exeCkndmaad.exeCmlqimph.exeCdfief32.exeDiencmcj.exeDpofpg32.exeDpaceg32.exeDpflqfeo.exeEagiho32.exeEeeanm32.exeEonfgbhc.exeEdkopifk.exeEncchoml.exeEpaodjlo.exeEjjdmp32.exeEaalom32.exeEkipgb32.exeFlkmokoa.exeFfcahq32.exeFlmidkmn.exeFfenmp32.exeFmofjj32.exeFcingdbh.exeFjcfco32.exeFopole32.exeFdmgdl32.exeGfldno32.exeGodhgedg.exeGjnigb32.exeGednek32.exepid process 1740 Mjddnjdf.exe 276 Mbpibm32.exe 2852 Npffaq32.exe 2756 Nbfobllj.exe 2792 Nkbcgnie.exe 2904 Neghdg32.exe 1376 Nlapaapg.exe 984 Odoakckp.exe 2972 Opebpdad.exe 564 Ocdnloph.exe 1692 Oeegnj32.exe 1988 Oegdcj32.exe 1444 Piemih32.exe 1964 Plffkc32.exe 2368 Pgogla32.exe 2088 Pqjhjf32.exe 912 Qoaaqb32.exe 2516 Afnfcl32.exe 1564 Aeccdila.exe 1768 Akmlacdn.exe 2472 Aeepjh32.exe 604 Akphfbbl.exe 2584 Aalaoipc.exe 1704 Aaondi32.exe 2532 Bkdbab32.exe 2556 Bnbnnm32.exe 1608 Bfncbp32.exe 2548 Bcdpacgl.exe 2508 Blodefdg.exe 2884 Bfeibo32.exe 2764 Cejfckie.exe 2680 Cbnfmo32.exe 2992 Celbik32.exe 1348 Chkoef32.exe 2956 Chohqebq.exe 2824 Ckndmaad.exe 1732 Cmlqimph.exe 1096 Cdfief32.exe 2732 Diencmcj.exe 1968 Dpofpg32.exe 1936 Dpaceg32.exe 3052 Dpflqfeo.exe 2580 Eagiho32.exe 1736 Eeeanm32.exe 608 Eonfgbhc.exe 956 Edkopifk.exe 2512 Encchoml.exe 1960 Epaodjlo.exe 2604 Ejjdmp32.exe 2444 Eaalom32.exe 1596 Ekipgb32.exe 928 Flkmokoa.exe 1040 Ffcahq32.exe 2900 Flmidkmn.exe 2892 Ffenmp32.exe 2116 Fmofjj32.exe 2820 Fcingdbh.exe 2864 Fjcfco32.exe 3000 Fopole32.exe 2964 Fdmgdl32.exe 2240 Gfldno32.exe 1884 Godhgedg.exe 2808 Gjnigb32.exe 432 Gednek32.exe -
Loads dropped DLL 64 IoCs
Processes:
fbff07598c7d0653a9a9f62f85e294b297b1747538d12031aef4fe8a9933fcbe.exeMjddnjdf.exeMbpibm32.exeNpffaq32.exeNbfobllj.exeNkbcgnie.exeNeghdg32.exeNlapaapg.exeOdoakckp.exeOpebpdad.exeOcdnloph.exeOeegnj32.exeOegdcj32.exePiemih32.exePlffkc32.exePgogla32.exePqjhjf32.exeQoaaqb32.exeAfnfcl32.exeAeccdila.exeAkmlacdn.exeAeepjh32.exeAkphfbbl.exeAalaoipc.exeAaondi32.exeBkdbab32.exeBnbnnm32.exeBfncbp32.exeBcdpacgl.exeBlodefdg.exeBfeibo32.exeCejfckie.exepid process 2220 fbff07598c7d0653a9a9f62f85e294b297b1747538d12031aef4fe8a9933fcbe.exe 2220 fbff07598c7d0653a9a9f62f85e294b297b1747538d12031aef4fe8a9933fcbe.exe 1740 Mjddnjdf.exe 1740 Mjddnjdf.exe 276 Mbpibm32.exe 276 Mbpibm32.exe 2852 Npffaq32.exe 2852 Npffaq32.exe 2756 Nbfobllj.exe 2756 Nbfobllj.exe 2792 Nkbcgnie.exe 2792 Nkbcgnie.exe 2904 Neghdg32.exe 2904 Neghdg32.exe 1376 Nlapaapg.exe 1376 Nlapaapg.exe 984 Odoakckp.exe 984 Odoakckp.exe 2972 Opebpdad.exe 2972 Opebpdad.exe 564 Ocdnloph.exe 564 Ocdnloph.exe 1692 Oeegnj32.exe 1692 Oeegnj32.exe 1988 Oegdcj32.exe 1988 Oegdcj32.exe 1444 Piemih32.exe 1444 Piemih32.exe 1964 Plffkc32.exe 1964 Plffkc32.exe 2368 Pgogla32.exe 2368 Pgogla32.exe 2088 Pqjhjf32.exe 2088 Pqjhjf32.exe 912 Qoaaqb32.exe 912 Qoaaqb32.exe 2516 Afnfcl32.exe 2516 Afnfcl32.exe 1564 Aeccdila.exe 1564 Aeccdila.exe 1768 Akmlacdn.exe 1768 Akmlacdn.exe 2472 Aeepjh32.exe 2472 Aeepjh32.exe 604 Akphfbbl.exe 604 Akphfbbl.exe 2584 Aalaoipc.exe 2584 Aalaoipc.exe 1704 Aaondi32.exe 1704 Aaondi32.exe 2532 Bkdbab32.exe 2532 Bkdbab32.exe 2556 Bnbnnm32.exe 2556 Bnbnnm32.exe 1608 Bfncbp32.exe 1608 Bfncbp32.exe 2548 Bcdpacgl.exe 2548 Bcdpacgl.exe 2508 Blodefdg.exe 2508 Blodefdg.exe 2884 Bfeibo32.exe 2884 Bfeibo32.exe 2764 Cejfckie.exe 2764 Cejfckie.exe -
Drops file in System32 directory 64 IoCs
Processes:
Aagfffbo.exeIfndph32.exeClheeh32.exeLpmjplag.exeNbljfdoh.exeMhopcl32.exeMjeffc32.exeGdbeqmag.exePegaje32.exeAhjcqcdm.exeGcikfhed.exeAdncoc32.exeDmljnfll.exeClkfjman.exeDjcpqidc.exeLhpmhgbf.exeCkopch32.exeBnjipn32.exeIadnon32.exeIapghlbe.exeMaplcm32.exeOdhhdk32.exeQbidffao.exeCmnqae32.exeIjeinphf.exeLpodmb32.exeDnjeoa32.exeDppiddie.exeNdaaclac.exeKapbmo32.exeKaillp32.exeCmocha32.exeLmjbphod.exePjiffd32.exeBfkobj32.exeEmncci32.exeJbooen32.exeAamhdckg.exeIoonfaed.exeKoejqi32.exePmlngdhk.exeCeanmc32.exeFpihnbmk.exeGhkbccdn.exeCcinnd32.exeFpgpjdnf.exeGamkol32.exeMabihm32.exeDhlapc32.exeMfhcknpf.exeFmfpnb32.exeOpebpdad.exeHfdpaqej.exeBmmgbbeq.exeDgemgm32.exeOceaql32.exeFcingdbh.exeLlkgpmck.exeAdeiobgc.exeHajdniep.exeAjqoqm32.exeFbhhlo32.exeBhmonoli.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Akpkok32.exe Aagfffbo.exe File created C:\Windows\SysWOW64\Oambdf32.dll Ifndph32.exe File created C:\Windows\SysWOW64\Genifa32.dll Clheeh32.exe File created C:\Windows\SysWOW64\Lldkem32.exe Lpmjplag.exe File created C:\Windows\SysWOW64\Ojgokflc.exe Nbljfdoh.exe File opened for modification C:\Windows\SysWOW64\Mjpmkdpp.exe Mhopcl32.exe File created C:\Windows\SysWOW64\Mpaoojjb.exe Mjeffc32.exe File created C:\Windows\SysWOW64\Gddbfm32.exe Gdbeqmag.exe File opened for modification C:\Windows\SysWOW64\Pmbfoh32.exe Pegaje32.exe File created C:\Windows\SysWOW64\Ajipmocp.exe Ahjcqcdm.exe File created C:\Windows\SysWOW64\Npflpk32.dll Gcikfhed.exe File opened for modification C:\Windows\SysWOW64\Aocgll32.exe Adncoc32.exe File created C:\Windows\SysWOW64\Dhekodik.exe Dmljnfll.exe File created C:\Windows\SysWOW64\Dcfknooi.exe Clkfjman.exe File opened for modification C:\Windows\SysWOW64\Damhmc32.exe Djcpqidc.exe File opened for modification C:\Windows\SysWOW64\Lojeda32.exe Lhpmhgbf.exe File created C:\Windows\SysWOW64\Qmhfaj32.dll Ckopch32.exe File created C:\Windows\SysWOW64\Mbomgjkh.dll Bnjipn32.exe File opened for modification C:\Windows\SysWOW64\Ibejfffo.exe Iadnon32.exe File opened for modification C:\Windows\SysWOW64\Ijklmn32.exe Iapghlbe.exe File opened for modification C:\Windows\SysWOW64\Mcoioi32.exe Maplcm32.exe File created C:\Windows\SysWOW64\Ogfdpfjo.exe Odhhdk32.exe File created C:\Windows\SysWOW64\Fhopbf32.dll Qbidffao.exe File created C:\Windows\SysWOW64\Cajmbd32.exe Cmnqae32.exe File opened for modification C:\Windows\SysWOW64\Iaqnbb32.exe Ijeinphf.exe File created C:\Windows\SysWOW64\Kgmobc32.dll Lpodmb32.exe File opened for modification C:\Windows\SysWOW64\Dknehe32.exe Dnjeoa32.exe File created C:\Windows\SysWOW64\Dhknigfq.exe Dppiddie.exe File opened for modification C:\Windows\SysWOW64\Naebmppm.exe Ndaaclac.exe File created C:\Windows\SysWOW64\Hqckgi32.dll Kapbmo32.exe File opened for modification C:\Windows\SysWOW64\Kegebn32.exe Kaillp32.exe File opened for modification C:\Windows\SysWOW64\Cmapna32.exe Cmocha32.exe File opened for modification C:\Windows\SysWOW64\Lbgkhoml.exe Lmjbphod.exe File created C:\Windows\SysWOW64\Pdlahl32.dll Pjiffd32.exe File created C:\Windows\SysWOW64\Mclepefg.dll Bfkobj32.exe File created C:\Windows\SysWOW64\Kppmhmhh.dll Emncci32.exe File created C:\Windows\SysWOW64\Fnnnoaop.dll Jbooen32.exe File created C:\Windows\SysWOW64\Paifem32.dll Aamhdckg.exe File created C:\Windows\SysWOW64\Ippkni32.exe Ioonfaed.exe File opened for modification C:\Windows\SysWOW64\Khmnio32.exe Koejqi32.exe File opened for modification C:\Windows\SysWOW64\Qkpnph32.exe Pmlngdhk.exe File opened for modification C:\Windows\SysWOW64\Clkfjman.exe Ceanmc32.exe File opened for modification C:\Windows\SysWOW64\Fpkdca32.exe Fpihnbmk.exe File created C:\Windows\SysWOW64\Gnhkkjbf.exe Ghkbccdn.exe File opened for modification C:\Windows\SysWOW64\Clbbfj32.exe Ccinnd32.exe File created C:\Windows\SysWOW64\Eccanfla.dll Ijeinphf.exe File created C:\Windows\SysWOW64\Fmkpchmp.exe Fpgpjdnf.exe File created C:\Windows\SysWOW64\Gcgklh32.dll Gamkol32.exe File created C:\Windows\SysWOW64\Khgenplk.dll Mabihm32.exe File opened for modification C:\Windows\SysWOW64\Dpgedepn.exe Dhlapc32.exe File created C:\Windows\SysWOW64\Mceodfan.dll Mfhcknpf.exe File created C:\Windows\SysWOW64\Lfoiil32.dll Fmfpnb32.exe File opened for modification C:\Windows\SysWOW64\Ocdnloph.exe Opebpdad.exe File created C:\Windows\SysWOW64\Beekdc32.dll Hfdpaqej.exe File created C:\Windows\SysWOW64\Ffofoi32.dll Bmmgbbeq.exe File opened for modification C:\Windows\SysWOW64\Danaqbgp.exe Dgemgm32.exe File opened for modification C:\Windows\SysWOW64\Ohajic32.exe Oceaql32.exe File created C:\Windows\SysWOW64\Fjcfco32.exe Fcingdbh.exe File created C:\Windows\SysWOW64\Lbhphdab.exe Llkgpmck.exe File created C:\Windows\SysWOW64\Agcekn32.exe Adeiobgc.exe File created C:\Windows\SysWOW64\Ijinin32.dll Hajdniep.exe File opened for modification C:\Windows\SysWOW64\Befcne32.exe Ajqoqm32.exe File created C:\Windows\SysWOW64\Cpnkmh32.dll Fbhhlo32.exe File opened for modification C:\Windows\SysWOW64\Bpdgolml.exe Bhmonoli.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1632 1064 WerFault.exe Hblgkkfa.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Fpdqlkhe.exeFlkjffkm.exeBnbnnm32.exeHoegoqng.exeDndoof32.exeNhookh32.exeEeeanm32.exeMicnbe32.exeDpnmoe32.exeOdckho32.exeNnnmoh32.exeJobnej32.exeMlhbgc32.exeJkcllmhb.exeHjeojnep.exeCelbik32.exeOdjikh32.exeHjhaob32.exeGpknjp32.exeDaplmimi.exeBkjfhile.exeApjbpemb.exeOnacgf32.exePnhegi32.exeIjklmn32.exeNjjfli32.exeOcpfmd32.exeOcdohdfc.exeJkgfgl32.exeFopole32.exeNpecjdaf.exeJijbnppi.exeCdpfiekl.exeHfmcapna.exeLnopmegg.exeNdgdpn32.exeBpokkdim.exeHacoio32.exeNcpgeh32.exeKpnbcfkc.exeGcikfhed.exeMgomoboc.exeNdhlfh32.exeDdgljced.exePjiffd32.exeAnmnhhmd.exeFaonqiod.exeOedclm32.exeFjjeid32.exePmabmf32.exeCnbfkccn.exeJehklc32.exeEedijo32.exeJhgonj32.exeCejfckie.exeOfmgmhgh.exeMhopcl32.exeIjenpn32.exeCkdnpicb.exeQkeofnfk.exeGghloe32.exeOcoobngl.exeJblpge32.exeMjodhe32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpdqlkhe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flkjffkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bnbnnm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hoegoqng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dndoof32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhookh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eeeanm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Micnbe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dpnmoe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odckho32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnnmoh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jobnej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlhbgc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkcllmhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hjeojnep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Celbik32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odjikh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hjhaob32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpknjp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Daplmimi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bkjfhile.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Apjbpemb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onacgf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pnhegi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ijklmn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Njjfli32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocpfmd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocdohdfc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkgfgl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fopole32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npecjdaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jijbnppi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdpfiekl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfmcapna.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnopmegg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ndgdpn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bpokkdim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hacoio32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ncpgeh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kpnbcfkc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gcikfhed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mgomoboc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ndhlfh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddgljced.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjiffd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Anmnhhmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Faonqiod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oedclm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjjeid32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmabmf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnbfkccn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jehklc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eedijo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jhgonj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cejfckie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ofmgmhgh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhopcl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ijenpn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckdnpicb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qkeofnfk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gghloe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocoobngl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jblpge32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjodhe32.exe -
Modifies registry class 64 IoCs
Processes:
Dmgmbj32.exeHgjieedg.exeMkkpjg32.exeMgglcqdk.exeOmmdqi32.exeJmhkdnfp.exeBholco32.exeEcibjn32.exeHgbanlfc.exeLicpki32.exeLiibigjq.exePmbfoh32.exeGpfbfh32.exeHamgno32.exeFbbcdh32.exeGcapckod.exePmgpjgph.exeNolffjap.exeBkhjcing.exeIkafpbon.exeEonfgbhc.exeHliieioi.exeCfoellgb.exeEhlmnfeo.exeMfhcknpf.exeLcbppk32.exeNbfobllj.exeIbejfffo.exeNpneeocq.exeBineidcj.exeElnagijk.exeGabohk32.exeDjcbib32.exeOceaql32.exePnhegi32.exefbff07598c7d0653a9a9f62f85e294b297b1747538d12031aef4fe8a9933fcbe.exeLbhphdab.exeAdppdckh.exeHajdniep.exeLhpmhgbf.exeJndgfqlh.exeFjcfco32.exeDhlapc32.exeKidjfl32.exeDafchi32.exeAncdgcab.exeDfpcdh32.exeJbandfkj.exeFpgpjdnf.exeFbhhlo32.exeLodoefed.exeDggcbf32.exeEfeaqi32.exeGaiehjfb.exeAjibeg32.exeMjddnjdf.exeHnnkbd32.exeOemjbe32.exeOnkjocjd.exeCnbfkccn.exeOdckho32.exeEocieq32.exeBfkakbpp.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dmgmbj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pheghenj.dll" Hgjieedg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhbodpkg.dll" Mkkpjg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mgglcqdk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ommdqi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jmhkdnfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bholco32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ecibjn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hgbanlfc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blbfiq32.dll" Licpki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hialpf32.dll" Liibigjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pmbfoh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gpfbfh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hamgno32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fbbcdh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gcapckod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pmgpjgph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nolffjap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bkhjcing.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ikafpbon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgpdcm32.dll" Eonfgbhc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Appcjgmk.dll" Hliieioi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cfoellgb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ehlmnfeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mfhcknpf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lcbppk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nbfobllj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ibejfffo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nekdie32.dll" Npneeocq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bineidcj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Elnagijk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hghlgo32.dll" Ehlmnfeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cebfcj32.dll" Gabohk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcegdl32.dll" Djcbib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfcfocfd.dll" Oceaql32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahinlpqk.dll" Pnhegi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 fbff07598c7d0653a9a9f62f85e294b297b1747538d12031aef4fe8a9933fcbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciohilci.dll" Lbhphdab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Adppdckh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijinin32.dll" Hajdniep.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lhpmhgbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aiacqhfi.dll" Jndgfqlh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qokdamgl.dll" Fjcfco32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqjiji32.dll" Dhlapc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kidjfl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dafchi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfqgmn32.dll" Ancdgcab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dfpcdh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jbandfkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fpgpjdnf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpnkmh32.dll" Fbhhlo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lodoefed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnpopj32.dll" Dggcbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Makhce32.dll" Efeaqi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gaiehjfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgkmkdcp.dll" Ajibeg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mjddnjdf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njnjicba.dll" Hnnkbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oemjbe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Onkjocjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cnbfkccn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aipohogh.dll" Odckho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aeqfhb32.dll" Eocieq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idkkjpdd.dll" Bfkakbpp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fbff07598c7d0653a9a9f62f85e294b297b1747538d12031aef4fe8a9933fcbe.exeMjddnjdf.exeMbpibm32.exeNpffaq32.exeNbfobllj.exeNkbcgnie.exeNeghdg32.exeNlapaapg.exeOdoakckp.exeOpebpdad.exeOcdnloph.exeOeegnj32.exeOegdcj32.exePiemih32.exePlffkc32.exePgogla32.exedescription pid process target process PID 2220 wrote to memory of 1740 2220 fbff07598c7d0653a9a9f62f85e294b297b1747538d12031aef4fe8a9933fcbe.exe Mjddnjdf.exe PID 2220 wrote to memory of 1740 2220 fbff07598c7d0653a9a9f62f85e294b297b1747538d12031aef4fe8a9933fcbe.exe Mjddnjdf.exe PID 2220 wrote to memory of 1740 2220 fbff07598c7d0653a9a9f62f85e294b297b1747538d12031aef4fe8a9933fcbe.exe Mjddnjdf.exe PID 2220 wrote to memory of 1740 2220 fbff07598c7d0653a9a9f62f85e294b297b1747538d12031aef4fe8a9933fcbe.exe Mjddnjdf.exe PID 1740 wrote to memory of 276 1740 Mjddnjdf.exe Mbpibm32.exe PID 1740 wrote to memory of 276 1740 Mjddnjdf.exe Mbpibm32.exe PID 1740 wrote to memory of 276 1740 Mjddnjdf.exe Mbpibm32.exe PID 1740 wrote to memory of 276 1740 Mjddnjdf.exe Mbpibm32.exe PID 276 wrote to memory of 2852 276 Mbpibm32.exe Npffaq32.exe PID 276 wrote to memory of 2852 276 Mbpibm32.exe Npffaq32.exe PID 276 wrote to memory of 2852 276 Mbpibm32.exe Npffaq32.exe PID 276 wrote to memory of 2852 276 Mbpibm32.exe Npffaq32.exe PID 2852 wrote to memory of 2756 2852 Npffaq32.exe Nbfobllj.exe PID 2852 wrote to memory of 2756 2852 Npffaq32.exe Nbfobllj.exe PID 2852 wrote to memory of 2756 2852 Npffaq32.exe Nbfobllj.exe PID 2852 wrote to memory of 2756 2852 Npffaq32.exe Nbfobllj.exe PID 2756 wrote to memory of 2792 2756 Nbfobllj.exe Nkbcgnie.exe PID 2756 wrote to memory of 2792 2756 Nbfobllj.exe Nkbcgnie.exe PID 2756 wrote to memory of 2792 2756 Nbfobllj.exe Nkbcgnie.exe PID 2756 wrote to memory of 2792 2756 Nbfobllj.exe Nkbcgnie.exe PID 2792 wrote to memory of 2904 2792 Nkbcgnie.exe Neghdg32.exe PID 2792 wrote to memory of 2904 2792 Nkbcgnie.exe Neghdg32.exe PID 2792 wrote to memory of 2904 2792 Nkbcgnie.exe Neghdg32.exe PID 2792 wrote to memory of 2904 2792 Nkbcgnie.exe Neghdg32.exe PID 2904 wrote to memory of 1376 2904 Neghdg32.exe Nlapaapg.exe PID 2904 wrote to memory of 1376 2904 Neghdg32.exe Nlapaapg.exe PID 2904 wrote to memory of 1376 2904 Neghdg32.exe Nlapaapg.exe PID 2904 wrote to memory of 1376 2904 Neghdg32.exe Nlapaapg.exe PID 1376 wrote to memory of 984 1376 Nlapaapg.exe Odoakckp.exe PID 1376 wrote to memory of 984 1376 Nlapaapg.exe Odoakckp.exe PID 1376 wrote to memory of 984 1376 Nlapaapg.exe Odoakckp.exe PID 1376 wrote to memory of 984 1376 Nlapaapg.exe Odoakckp.exe PID 984 wrote to memory of 2972 984 Odoakckp.exe Opebpdad.exe PID 984 wrote to memory of 2972 984 Odoakckp.exe Opebpdad.exe PID 984 wrote to memory of 2972 984 Odoakckp.exe Opebpdad.exe PID 984 wrote to memory of 2972 984 Odoakckp.exe Opebpdad.exe PID 2972 wrote to memory of 564 2972 Opebpdad.exe Ocdnloph.exe PID 2972 wrote to memory of 564 2972 Opebpdad.exe Ocdnloph.exe PID 2972 wrote to memory of 564 2972 Opebpdad.exe Ocdnloph.exe PID 2972 wrote to memory of 564 2972 Opebpdad.exe Ocdnloph.exe PID 564 wrote to memory of 1692 564 Ocdnloph.exe Oeegnj32.exe PID 564 wrote to memory of 1692 564 Ocdnloph.exe Oeegnj32.exe PID 564 wrote to memory of 1692 564 Ocdnloph.exe Oeegnj32.exe PID 564 wrote to memory of 1692 564 Ocdnloph.exe Oeegnj32.exe PID 1692 wrote to memory of 1988 1692 Oeegnj32.exe Oegdcj32.exe PID 1692 wrote to memory of 1988 1692 Oeegnj32.exe Oegdcj32.exe PID 1692 wrote to memory of 1988 1692 Oeegnj32.exe Oegdcj32.exe PID 1692 wrote to memory of 1988 1692 Oeegnj32.exe Oegdcj32.exe PID 1988 wrote to memory of 1444 1988 Oegdcj32.exe Piemih32.exe PID 1988 wrote to memory of 1444 1988 Oegdcj32.exe Piemih32.exe PID 1988 wrote to memory of 1444 1988 Oegdcj32.exe Piemih32.exe PID 1988 wrote to memory of 1444 1988 Oegdcj32.exe Piemih32.exe PID 1444 wrote to memory of 1964 1444 Piemih32.exe Plffkc32.exe PID 1444 wrote to memory of 1964 1444 Piemih32.exe Plffkc32.exe PID 1444 wrote to memory of 1964 1444 Piemih32.exe Plffkc32.exe PID 1444 wrote to memory of 1964 1444 Piemih32.exe Plffkc32.exe PID 1964 wrote to memory of 2368 1964 Plffkc32.exe Pgogla32.exe PID 1964 wrote to memory of 2368 1964 Plffkc32.exe Pgogla32.exe PID 1964 wrote to memory of 2368 1964 Plffkc32.exe Pgogla32.exe PID 1964 wrote to memory of 2368 1964 Plffkc32.exe Pgogla32.exe PID 2368 wrote to memory of 2088 2368 Pgogla32.exe Pqjhjf32.exe PID 2368 wrote to memory of 2088 2368 Pgogla32.exe Pqjhjf32.exe PID 2368 wrote to memory of 2088 2368 Pgogla32.exe Pqjhjf32.exe PID 2368 wrote to memory of 2088 2368 Pgogla32.exe Pqjhjf32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbff07598c7d0653a9a9f62f85e294b297b1747538d12031aef4fe8a9933fcbe.exe"C:\Users\Admin\AppData\Local\Temp\fbff07598c7d0653a9a9f62f85e294b297b1747538d12031aef4fe8a9933fcbe.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\Mjddnjdf.exeC:\Windows\system32\Mjddnjdf.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\Mbpibm32.exeC:\Windows\system32\Mbpibm32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Windows\SysWOW64\Npffaq32.exeC:\Windows\system32\Npffaq32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\Nbfobllj.exeC:\Windows\system32\Nbfobllj.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\Nkbcgnie.exeC:\Windows\system32\Nkbcgnie.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\Neghdg32.exeC:\Windows\system32\Neghdg32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\Nlapaapg.exeC:\Windows\system32\Nlapaapg.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\Odoakckp.exeC:\Windows\system32\Odoakckp.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\Opebpdad.exeC:\Windows\system32\Opebpdad.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\Ocdnloph.exeC:\Windows\system32\Ocdnloph.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\Oeegnj32.exeC:\Windows\system32\Oeegnj32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\Oegdcj32.exeC:\Windows\system32\Oegdcj32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\Piemih32.exeC:\Windows\system32\Piemih32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\Plffkc32.exeC:\Windows\system32\Plffkc32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\Pgogla32.exeC:\Windows\system32\Pgogla32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\Pqjhjf32.exeC:\Windows\system32\Pqjhjf32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Windows\SysWOW64\Qoaaqb32.exeC:\Windows\system32\Qoaaqb32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Windows\SysWOW64\Afnfcl32.exeC:\Windows\system32\Afnfcl32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Windows\SysWOW64\Aeccdila.exeC:\Windows\system32\Aeccdila.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Windows\SysWOW64\Akmlacdn.exeC:\Windows\system32\Akmlacdn.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Windows\SysWOW64\Aeepjh32.exeC:\Windows\system32\Aeepjh32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Windows\SysWOW64\Akphfbbl.exeC:\Windows\system32\Akphfbbl.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Windows\SysWOW64\Aalaoipc.exeC:\Windows\system32\Aalaoipc.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Windows\SysWOW64\Aaondi32.exeC:\Windows\system32\Aaondi32.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Windows\SysWOW64\Bkdbab32.exeC:\Windows\system32\Bkdbab32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Windows\SysWOW64\Bnbnnm32.exeC:\Windows\system32\Bnbnnm32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2556 -
C:\Windows\SysWOW64\Bfncbp32.exeC:\Windows\system32\Bfncbp32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Windows\SysWOW64\Bcdpacgl.exeC:\Windows\system32\Bcdpacgl.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Windows\SysWOW64\Blodefdg.exeC:\Windows\system32\Blodefdg.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Windows\SysWOW64\Bfeibo32.exeC:\Windows\system32\Bfeibo32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Windows\SysWOW64\Cejfckie.exeC:\Windows\system32\Cejfckie.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Windows\SysWOW64\Cbnfmo32.exeC:\Windows\system32\Cbnfmo32.exe33⤵
- Executes dropped EXE
PID:2680 -
C:\Windows\SysWOW64\Celbik32.exeC:\Windows\system32\Celbik32.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2992 -
C:\Windows\SysWOW64\Chkoef32.exeC:\Windows\system32\Chkoef32.exe35⤵
- Executes dropped EXE
PID:1348 -
C:\Windows\SysWOW64\Chohqebq.exeC:\Windows\system32\Chohqebq.exe36⤵
- Executes dropped EXE
PID:2956 -
C:\Windows\SysWOW64\Ckndmaad.exeC:\Windows\system32\Ckndmaad.exe37⤵
- Executes dropped EXE
PID:2824 -
C:\Windows\SysWOW64\Cmlqimph.exeC:\Windows\system32\Cmlqimph.exe38⤵
- Executes dropped EXE
PID:1732 -
C:\Windows\SysWOW64\Cdfief32.exeC:\Windows\system32\Cdfief32.exe39⤵
- Executes dropped EXE
PID:1096 -
C:\Windows\SysWOW64\Diencmcj.exeC:\Windows\system32\Diencmcj.exe40⤵
- Executes dropped EXE
PID:2732 -
C:\Windows\SysWOW64\Dpofpg32.exeC:\Windows\system32\Dpofpg32.exe41⤵
- Executes dropped EXE
PID:1968 -
C:\Windows\SysWOW64\Dpaceg32.exeC:\Windows\system32\Dpaceg32.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1936 -
C:\Windows\SysWOW64\Dpflqfeo.exeC:\Windows\system32\Dpflqfeo.exe43⤵
- Executes dropped EXE
PID:3052 -
C:\Windows\SysWOW64\Eagiho32.exeC:\Windows\system32\Eagiho32.exe44⤵
- Executes dropped EXE
PID:2580 -
C:\Windows\SysWOW64\Eeeanm32.exeC:\Windows\system32\Eeeanm32.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1736 -
C:\Windows\SysWOW64\Eonfgbhc.exeC:\Windows\system32\Eonfgbhc.exe46⤵
- Executes dropped EXE
- Modifies registry class
PID:608 -
C:\Windows\SysWOW64\Edkopifk.exeC:\Windows\system32\Edkopifk.exe47⤵
- Executes dropped EXE
PID:956 -
C:\Windows\SysWOW64\Encchoml.exeC:\Windows\system32\Encchoml.exe48⤵
- Executes dropped EXE
PID:2512 -
C:\Windows\SysWOW64\Epaodjlo.exeC:\Windows\system32\Epaodjlo.exe49⤵
- Executes dropped EXE
PID:1960 -
C:\Windows\SysWOW64\Ejjdmp32.exeC:\Windows\system32\Ejjdmp32.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2604 -
C:\Windows\SysWOW64\Eaalom32.exeC:\Windows\system32\Eaalom32.exe51⤵
- Executes dropped EXE
PID:2444 -
C:\Windows\SysWOW64\Ekipgb32.exeC:\Windows\system32\Ekipgb32.exe52⤵
- Executes dropped EXE
PID:1596 -
C:\Windows\SysWOW64\Flkmokoa.exeC:\Windows\system32\Flkmokoa.exe53⤵
- Executes dropped EXE
PID:928 -
C:\Windows\SysWOW64\Ffcahq32.exeC:\Windows\system32\Ffcahq32.exe54⤵
- Executes dropped EXE
PID:1040 -
C:\Windows\SysWOW64\Flmidkmn.exeC:\Windows\system32\Flmidkmn.exe55⤵
- Executes dropped EXE
PID:2900 -
C:\Windows\SysWOW64\Ffenmp32.exeC:\Windows\system32\Ffenmp32.exe56⤵
- Executes dropped EXE
PID:2892 -
C:\Windows\SysWOW64\Fmofjj32.exeC:\Windows\system32\Fmofjj32.exe57⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\SysWOW64\Fcingdbh.exeC:\Windows\system32\Fcingdbh.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2820 -
C:\Windows\SysWOW64\Fjcfco32.exeC:\Windows\system32\Fjcfco32.exe59⤵
- Executes dropped EXE
- Modifies registry class
PID:2864 -
C:\Windows\SysWOW64\Fopole32.exeC:\Windows\system32\Fopole32.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3000 -
C:\Windows\SysWOW64\Fdmgdl32.exeC:\Windows\system32\Fdmgdl32.exe61⤵
- Executes dropped EXE
PID:2964 -
C:\Windows\SysWOW64\Gfldno32.exeC:\Windows\system32\Gfldno32.exe62⤵
- Executes dropped EXE
PID:2240 -
C:\Windows\SysWOW64\Godhgedg.exeC:\Windows\system32\Godhgedg.exe63⤵
- Executes dropped EXE
PID:1884 -
C:\Windows\SysWOW64\Gjnigb32.exeC:\Windows\system32\Gjnigb32.exe64⤵
- Executes dropped EXE
PID:2808 -
C:\Windows\SysWOW64\Gednek32.exeC:\Windows\system32\Gednek32.exe65⤵
- Executes dropped EXE
PID:432 -
C:\Windows\SysWOW64\Gmobin32.exeC:\Windows\system32\Gmobin32.exe66⤵PID:2328
-
C:\Windows\SysWOW64\Gcikfhed.exeC:\Windows\system32\Gcikfhed.exe67⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1536 -
C:\Windows\SysWOW64\Gamkol32.exeC:\Windows\system32\Gamkol32.exe68⤵
- Drops file in System32 directory
PID:1292 -
C:\Windows\SysWOW64\Gckgkg32.exeC:\Windows\system32\Gckgkg32.exe69⤵PID:2168
-
C:\Windows\SysWOW64\Gihpcn32.exeC:\Windows\system32\Gihpcn32.exe70⤵PID:860
-
C:\Windows\SysWOW64\Hpbhphie.exeC:\Windows\system32\Hpbhphie.exe71⤵PID:1640
-
C:\Windows\SysWOW64\Hbqdldhi.exeC:\Windows\system32\Hbqdldhi.exe72⤵PID:3016
-
C:\Windows\SysWOW64\Hliieioi.exeC:\Windows\system32\Hliieioi.exe73⤵
- Modifies registry class
PID:2552 -
C:\Windows\SysWOW64\Hfnmbbnp.exeC:\Windows\system32\Hfnmbbnp.exe74⤵PID:2468
-
C:\Windows\SysWOW64\Hlkekilg.exeC:\Windows\system32\Hlkekilg.exe75⤵PID:2760
-
C:\Windows\SysWOW64\Hbengc32.exeC:\Windows\system32\Hbengc32.exe76⤵PID:2812
-
C:\Windows\SysWOW64\Hiofdmkq.exeC:\Windows\system32\Hiofdmkq.exe77⤵PID:2216
-
C:\Windows\SysWOW64\Hlnbqijd.exeC:\Windows\system32\Hlnbqijd.exe78⤵PID:1712
-
C:\Windows\SysWOW64\Hajkip32.exeC:\Windows\system32\Hajkip32.exe79⤵PID:2024
-
C:\Windows\SysWOW64\Hnnkbd32.exeC:\Windows\system32\Hnnkbd32.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1996 -
C:\Windows\SysWOW64\Hamgno32.exeC:\Windows\system32\Hamgno32.exe81⤵
- Modifies registry class
PID:2684 -
C:\Windows\SysWOW64\Iekpdn32.exeC:\Windows\system32\Iekpdn32.exe82⤵PID:1624
-
C:\Windows\SysWOW64\Iflmlfcn.exeC:\Windows\system32\Iflmlfcn.exe83⤵PID:2452
-
C:\Windows\SysWOW64\Imfeip32.exeC:\Windows\system32\Imfeip32.exe84⤵PID:3056
-
C:\Windows\SysWOW64\Idpmejag.exeC:\Windows\system32\Idpmejag.exe85⤵PID:2400
-
C:\Windows\SysWOW64\Iadnon32.exeC:\Windows\system32\Iadnon32.exe86⤵
- Drops file in System32 directory
PID:2524 -
C:\Windows\SysWOW64\Ibejfffo.exeC:\Windows\system32\Ibejfffo.exe87⤵
- Modifies registry class
PID:1252 -
C:\Windows\SysWOW64\Iiobcq32.exeC:\Windows\system32\Iiobcq32.exe88⤵PID:2276
-
C:\Windows\SysWOW64\Ipijpkei.exeC:\Windows\system32\Ipijpkei.exe89⤵PID:876
-
C:\Windows\SysWOW64\Immkiodb.exeC:\Windows\system32\Immkiodb.exe90⤵PID:2592
-
C:\Windows\SysWOW64\Jbjcaf32.exeC:\Windows\system32\Jbjcaf32.exe91⤵PID:2640
-
C:\Windows\SysWOW64\Jhfljm32.exeC:\Windows\system32\Jhfljm32.exe92⤵PID:2976
-
C:\Windows\SysWOW64\Jblpge32.exeC:\Windows\system32\Jblpge32.exe93⤵
- System Location Discovery: System Language Discovery
PID:2748 -
C:\Windows\SysWOW64\Jaamhb32.exeC:\Windows\system32\Jaamhb32.exe94⤵PID:1616
-
C:\Windows\SysWOW64\Jdpidm32.exeC:\Windows\system32\Jdpidm32.exe95⤵PID:2952
-
C:\Windows\SysWOW64\Jhnbklji.exeC:\Windows\system32\Jhnbklji.exe96⤵PID:3004
-
C:\Windows\SysWOW64\Jgpbfh32.exeC:\Windows\system32\Jgpbfh32.exe97⤵PID:2620
-
C:\Windows\SysWOW64\Jhpopk32.exeC:\Windows\system32\Jhpopk32.exe98⤵PID:2192
-
C:\Windows\SysWOW64\Kpkcdn32.exeC:\Windows\system32\Kpkcdn32.exe99⤵PID:900
-
C:\Windows\SysWOW64\Knodnb32.exeC:\Windows\system32\Knodnb32.exe100⤵PID:832
-
C:\Windows\SysWOW64\Kpmpjm32.exeC:\Windows\system32\Kpmpjm32.exe101⤵PID:1548
-
C:\Windows\SysWOW64\Knaqcabh.exeC:\Windows\system32\Knaqcabh.exe102⤵PID:2448
-
C:\Windows\SysWOW64\Kgjelg32.exeC:\Windows\system32\Kgjelg32.exe103⤵PID:2164
-
C:\Windows\SysWOW64\Koejqi32.exeC:\Windows\system32\Koejqi32.exe104⤵
- Drops file in System32 directory
PID:1508 -
C:\Windows\SysWOW64\Khmnio32.exeC:\Windows\system32\Khmnio32.exe105⤵PID:1484
-
C:\Windows\SysWOW64\Lbfcbdce.exeC:\Windows\system32\Lbfcbdce.exe106⤵PID:2724
-
C:\Windows\SysWOW64\Llkgpmck.exeC:\Windows\system32\Llkgpmck.exe107⤵
- Drops file in System32 directory
PID:2776 -
C:\Windows\SysWOW64\Lbhphdab.exeC:\Windows\system32\Lbhphdab.exe108⤵
- Modifies registry class
PID:2708 -
C:\Windows\SysWOW64\Lhbhdnio.exeC:\Windows\system32\Lhbhdnio.exe109⤵PID:1152
-
C:\Windows\SysWOW64\Lnopmegg.exeC:\Windows\system32\Lnopmegg.exe110⤵
- System Location Discovery: System Language Discovery
PID:1748 -
C:\Windows\SysWOW64\Ldihjo32.exeC:\Windows\system32\Ldihjo32.exe111⤵PID:2420
-
C:\Windows\SysWOW64\Lnambeed.exeC:\Windows\system32\Lnambeed.exe112⤵PID:1916
-
C:\Windows\SysWOW64\Ldkeoo32.exeC:\Windows\system32\Ldkeoo32.exe113⤵PID:1556
-
C:\Windows\SysWOW64\Lncjhd32.exeC:\Windows\system32\Lncjhd32.exe114⤵PID:940
-
C:\Windows\SysWOW64\Ldnbeokn.exeC:\Windows\system32\Ldnbeokn.exe115⤵PID:2272
-
C:\Windows\SysWOW64\Mnffnd32.exeC:\Windows\system32\Mnffnd32.exe116⤵PID:1600
-
C:\Windows\SysWOW64\Mogcelgm.exeC:\Windows\system32\Mogcelgm.exe117⤵PID:2100
-
C:\Windows\SysWOW64\Mjmgbe32.exeC:\Windows\system32\Mjmgbe32.exe118⤵PID:2632
-
C:\Windows\SysWOW64\Mqfooonp.exeC:\Windows\system32\Mqfooonp.exe119⤵PID:2676
-
C:\Windows\SysWOW64\Mjodhe32.exeC:\Windows\system32\Mjodhe32.exe120⤵
- System Location Discovery: System Language Discovery
PID:1476 -
C:\Windows\SysWOW64\Mpqekkob.exeC:\Windows\system32\Mpqekkob.exe121⤵PID:2844
-
C:\Windows\SysWOW64\Njjfli32.exeC:\Windows\system32\Njjfli32.exe122⤵
- System Location Discovery: System Language Discovery
PID:1756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-