Analysis
-
max time kernel
71s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 04:52
Behavioral task
behavioral1
Sample
3d66b3778c1f378d034b16f69121221bf3fa1f56d27cf5a5da808dce6ea9f002N.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
3d66b3778c1f378d034b16f69121221bf3fa1f56d27cf5a5da808dce6ea9f002N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
3d66b3778c1f378d034b16f69121221bf3fa1f56d27cf5a5da808dce6ea9f002N.exe
-
Size
194KB
-
MD5
b582af128b4b36525c075cb763d5ca40
-
SHA1
efcfc86ba93fe8a13da689f08b56b3ac22023be9
-
SHA256
3d66b3778c1f378d034b16f69121221bf3fa1f56d27cf5a5da808dce6ea9f002
-
SHA512
b24e08faaa36a488dda3710cb3d03d76781e5c04d999e6ce3074a39c8b02e43a3c36befade6eb39daeb35ba08f35540388cd6bfe9534536df1a5d9e490f184b2
-
SSDEEP
1536:8fDGJUmuxfkwEGsA1AUsLSH+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm+mmDmmo:Ymuawfsq5mn8mMIM/kEmMIGumMIc/1GV
Score
10/10
Malware Config
Extracted
Family
berbew
C2
http://tat-neftbank.ru/kkq.php
http://tat-neftbank.ru/wcmd.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Mbkkepio.exeGmklbk32.exeApjdin32.exePhdiglap.exeGoadik32.exeJfoookfn.exePjndca32.exeNhjofbdk.exeAamhdckg.exeBpbadcbj.exeIomaaa32.exeGaokhdja.exeNfljpa32.exeIjkjde32.exeLiibigjq.exeObdjjb32.exeBlcokf32.exeDpfpco32.exeIfkecl32.exeQeglqpaj.exeAgkfil32.exeCidklp32.exeMjicdl32.exeAjbdpblo.exeCaligc32.exeIkinjj32.exeOnggom32.exeBbkkbpjc.exeDechlfkl.exeJbbenlof.exeFabppo32.exeNdclpb32.exeEjpkho32.exeEkjjebed.exeEdbonh32.exeLlooad32.exeHpfoekhm.exeFpgpjdnf.exeIdlgohcl.exeHldldq32.exeFkphcg32.exeIblfcg32.exeKalkjh32.exeDjfagjai.exeDcgiejje.exeNpbbcgga.exeInkgdjqn.exeCajokmfi.exeFagqed32.exeMdajff32.exeFhgkqmph.exePkebig32.exeJgfghodj.exeChoejien.exeDhnoocab.exeAgoodkgk.exeJoomnm32.exeFlfbfken.exeGckmgi32.exeOkecak32.exeMnbbpkjg.exeGkkkgkla.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbkkepio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gmklbk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apjdin32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phdiglap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Goadik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jfoookfn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjndca32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhjofbdk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aamhdckg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpbadcbj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iomaaa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gaokhdja.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nfljpa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijkjde32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Liibigjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Obdjjb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Blcokf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpfpco32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ifkecl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qeglqpaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Agkfil32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cidklp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjicdl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajbdpblo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Caligc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ikinjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Onggom32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bbkkbpjc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dechlfkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jbbenlof.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fabppo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ndclpb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejpkho32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ekjjebed.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Edbonh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phdiglap.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Llooad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hpfoekhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fpgpjdnf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Idlgohcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hldldq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fkphcg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iblfcg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kalkjh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djfagjai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcgiejje.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Npbbcgga.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Inkgdjqn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cajokmfi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkphcg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fagqed32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdajff32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhgkqmph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pkebig32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgfghodj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Choejien.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhnoocab.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Agoodkgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Joomnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Flfbfken.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gckmgi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Okecak32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mnbbpkjg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gkkkgkla.exe -
Berbew family
-
Executes dropped EXE 64 IoCs
Processes:
Mnfhfmhc.exeMfamko32.exeMbkkepio.exeNglmifca.exeNgafdepl.exeNqijmkfm.exeOlgehh32.exeObdjjb32.exeOllncgjq.exeOedclm32.exePnodjb32.exePiiekp32.exePdqfnhpa.exeQeglqpaj.exeQbkljd32.exeAlcqcjgd.exeAniffaim.exeAkmgoehg.exeAjbdpblo.exeBfieec32.exeBabbpc32.exeBnicddki.exeCjbpoeoj.exeCnpieceq.exeCfmjoe32.exeCjkcedgp.exeCccgni32.exeEfifjg32.exeFagqed32.exeFmpnpe32.exeFangfcki.exeGeplpfnh.exeGebiefle.exeHopgikop.exeHdloab32.exeHdolga32.exeHjkdoh32.exeHdcebagp.exeHnljkf32.exeIjbjpg32.exeImccab32.exeIbplji32.exeIngmoj32.exeIionacad.exeJeenfd32.exeJgfghodj.exeJijqeg32.exeJbbenlof.exeKmjfae32.exeKhdgabih.exeKalkjh32.exeKanhph32.exeKhhpmbeb.exeKmeiei32.exeKacakgip.exeLgpjcnhh.exeLaenqg32.exeLgbfin32.exeLlooad32.exeLicpki32.exeLckdcn32.exeLpodmb32.exeLaqadknn.exeLhkiae32.exepid Process 3012 Mnfhfmhc.exe 2820 Mfamko32.exe 2316 Mbkkepio.exe 3024 Nglmifca.exe 2768 Ngafdepl.exe 900 Nqijmkfm.exe 2100 Olgehh32.exe 1916 Obdjjb32.exe 2800 Ollncgjq.exe 2200 Oedclm32.exe 1260 Pnodjb32.exe 2896 Piiekp32.exe 1272 Pdqfnhpa.exe 2908 Qeglqpaj.exe 2072 Qbkljd32.exe 1968 Alcqcjgd.exe 2012 Aniffaim.exe 1636 Akmgoehg.exe 680 Ajbdpblo.exe 1668 Bfieec32.exe 2476 Babbpc32.exe 964 Bnicddki.exe 1528 Cjbpoeoj.exe 2360 Cnpieceq.exe 876 Cfmjoe32.exe 2892 Cjkcedgp.exe 2184 Cccgni32.exe 2980 Efifjg32.exe 2844 Fagqed32.exe 2752 Fmpnpe32.exe 2880 Fangfcki.exe 2616 Geplpfnh.exe 2084 Gebiefle.exe 2108 Hopgikop.exe 1584 Hdloab32.exe 540 Hdolga32.exe 1984 Hjkdoh32.exe 2972 Hdcebagp.exe 1312 Hnljkf32.exe 1616 Ijbjpg32.exe 1728 Imccab32.exe 2492 Ibplji32.exe 2684 Ingmoj32.exe 660 Iionacad.exe 2584 Jeenfd32.exe 1932 Jgfghodj.exe 388 Jijqeg32.exe 2688 Jbbenlof.exe 1560 Kmjfae32.exe 1780 Khdgabih.exe 2276 Kalkjh32.exe 3008 Kanhph32.exe 2840 Khhpmbeb.exe 2828 Kmeiei32.exe 2976 Kacakgip.exe 2264 Lgpjcnhh.exe 2612 Laenqg32.exe 1580 Lgbfin32.exe 3040 Llooad32.exe 1144 Licpki32.exe 1744 Lckdcn32.exe 2228 Lpodmb32.exe 1172 Laqadknn.exe 848 Lhkiae32.exe -
Loads dropped DLL 64 IoCs
Processes:
3d66b3778c1f378d034b16f69121221bf3fa1f56d27cf5a5da808dce6ea9f002N.exeMnfhfmhc.exeMfamko32.exeMbkkepio.exeNglmifca.exeNgafdepl.exeNqijmkfm.exeOlgehh32.exeObdjjb32.exeOllncgjq.exeOedclm32.exePnodjb32.exePiiekp32.exePdqfnhpa.exeQeglqpaj.exeQbkljd32.exeAlcqcjgd.exeAniffaim.exeAkmgoehg.exeAjbdpblo.exeBfieec32.exeBabbpc32.exeBnicddki.exeCjbpoeoj.exeCnpieceq.exeCfmjoe32.exeCjkcedgp.exeCccgni32.exeEfifjg32.exeFagqed32.exeFmpnpe32.exeFangfcki.exepid Process 2792 3d66b3778c1f378d034b16f69121221bf3fa1f56d27cf5a5da808dce6ea9f002N.exe 2792 3d66b3778c1f378d034b16f69121221bf3fa1f56d27cf5a5da808dce6ea9f002N.exe 3012 Mnfhfmhc.exe 3012 Mnfhfmhc.exe 2820 Mfamko32.exe 2820 Mfamko32.exe 2316 Mbkkepio.exe 2316 Mbkkepio.exe 3024 Nglmifca.exe 3024 Nglmifca.exe 2768 Ngafdepl.exe 2768 Ngafdepl.exe 900 Nqijmkfm.exe 900 Nqijmkfm.exe 2100 Olgehh32.exe 2100 Olgehh32.exe 1916 Obdjjb32.exe 1916 Obdjjb32.exe 2800 Ollncgjq.exe 2800 Ollncgjq.exe 2200 Oedclm32.exe 2200 Oedclm32.exe 1260 Pnodjb32.exe 1260 Pnodjb32.exe 2896 Piiekp32.exe 2896 Piiekp32.exe 1272 Pdqfnhpa.exe 1272 Pdqfnhpa.exe 2908 Qeglqpaj.exe 2908 Qeglqpaj.exe 2072 Qbkljd32.exe 2072 Qbkljd32.exe 1968 Alcqcjgd.exe 1968 Alcqcjgd.exe 2012 Aniffaim.exe 2012 Aniffaim.exe 1636 Akmgoehg.exe 1636 Akmgoehg.exe 680 Ajbdpblo.exe 680 Ajbdpblo.exe 1668 Bfieec32.exe 1668 Bfieec32.exe 2476 Babbpc32.exe 2476 Babbpc32.exe 964 Bnicddki.exe 964 Bnicddki.exe 1528 Cjbpoeoj.exe 1528 Cjbpoeoj.exe 2360 Cnpieceq.exe 2360 Cnpieceq.exe 876 Cfmjoe32.exe 876 Cfmjoe32.exe 2892 Cjkcedgp.exe 2892 Cjkcedgp.exe 2184 Cccgni32.exe 2184 Cccgni32.exe 2980 Efifjg32.exe 2980 Efifjg32.exe 2844 Fagqed32.exe 2844 Fagqed32.exe 2752 Fmpnpe32.exe 2752 Fmpnpe32.exe 2880 Fangfcki.exe 2880 Fangfcki.exe -
Drops file in System32 directory 64 IoCs
Processes:
Odhhdk32.exeDiofenki.exeDcaiqfib.exeEghcckld.exeFjqlid32.exeKigidd32.exeMgmbbkij.exeIkibkhla.exeGgabhmge.exeCcamabgg.exeMlidplcf.exePmhbbp32.exeBijobb32.exeHhfcnb32.exeKanhph32.exeBlpibghg.exeOcjfgo32.exeLjlhme32.exeNoffadai.exeCceenilo.exeLdgpea32.exeFffabman.exeOimpppoj.exeJfoookfn.exeMinldf32.exeGpfbfh32.exeEgegnk32.exeHpodbo32.exeJdoblckh.exeBfieec32.exeDbaflm32.exeAkhopj32.exeHbgjoo32.exeOijlpjma.exeNlibhhme.exeMdjnge32.exeEdbjljpm.exeBgqqcd32.exeKqgmnk32.exeEdiggoma.exeIiaddb32.exeChdeonfa.exePofqhdnd.exeIcidlf32.exeKjgjpiob.exeLhlgaedj.exeLlooad32.exeBnfodojp.exeJkgfgl32.exeNeaehelb.exeFpecddpi.exeBccihj32.exeQnlobhne.exeCpdeghgk.exeFdfpfm32.exePobhfl32.exeQgcingnm.exeMjkpjkni.exeFmnoapba.exeCnifia32.exeEfifjg32.exeOkhgaqfj.exeEjnqkh32.exedescription ioc Process File created C:\Windows\SysWOW64\Oiepmajb.exe Odhhdk32.exe File created C:\Windows\SysWOW64\Nnniik32.dll Diofenki.exe File opened for modification C:\Windows\SysWOW64\Eqejjj32.exe Dcaiqfib.exe File created C:\Windows\SysWOW64\Oapemdml.dll Eghcckld.exe File opened for modification C:\Windows\SysWOW64\Fdfpfm32.exe Fjqlid32.exe File opened for modification C:\Windows\SysWOW64\Kemjieol.exe Kigidd32.exe File created C:\Windows\SysWOW64\Mmgkoe32.exe Mgmbbkij.exe File created C:\Windows\SysWOW64\Ikkoagjo.exe Ikibkhla.exe File created C:\Windows\SysWOW64\Memghn32.dll Ggabhmge.exe File opened for modification C:\Windows\SysWOW64\Choejien.exe Ccamabgg.exe File created C:\Windows\SysWOW64\Mpbgqo32.dll Mlidplcf.exe File created C:\Windows\SysWOW64\Oeglfneh.dll Pmhbbp32.exe File opened for modification C:\Windows\SysWOW64\Boggkicf.exe Bijobb32.exe File created C:\Windows\SysWOW64\Ojjaac32.dll Hhfcnb32.exe File opened for modification C:\Windows\SysWOW64\Khhpmbeb.exe Kanhph32.exe File opened for modification C:\Windows\SysWOW64\Behnkm32.exe Blpibghg.exe File created C:\Windows\SysWOW64\Fadcae32.dll Ocjfgo32.exe File created C:\Windows\SysWOW64\Camelgdc.dll Dcaiqfib.exe File created C:\Windows\SysWOW64\Pidnhdck.dll Ljlhme32.exe File created C:\Windows\SysWOW64\Mmmodpob.dll Noffadai.exe File created C:\Windows\SysWOW64\Kjfifc32.dll Cceenilo.exe File opened for modification C:\Windows\SysWOW64\Legmpdga.exe Ldgpea32.exe File opened for modification C:\Windows\SysWOW64\Flcjjdpe.exe Fffabman.exe File created C:\Windows\SysWOW64\Odbcnh32.exe Oimpppoj.exe File created C:\Windows\SysWOW64\Jllggbde.exe Jfoookfn.exe File opened for modification C:\Windows\SysWOW64\Mojdlm32.exe Minldf32.exe File opened for modification C:\Windows\SysWOW64\Giogonlb.exe Gpfbfh32.exe File created C:\Windows\SysWOW64\Ahmbdm32.dll Egegnk32.exe File created C:\Windows\SysWOW64\Odeiddnh.dll Hpodbo32.exe File created C:\Windows\SysWOW64\Pabhlikn.dll Jdoblckh.exe File opened for modification C:\Windows\SysWOW64\Babbpc32.exe Bfieec32.exe File created C:\Windows\SysWOW64\Dmkdanef.dll Dbaflm32.exe File created C:\Windows\SysWOW64\Fhmcllgo.dll Akhopj32.exe File created C:\Windows\SysWOW64\Kqijcg32.dll Hbgjoo32.exe File created C:\Windows\SysWOW64\Okkhhb32.exe Oijlpjma.exe File created C:\Windows\SysWOW64\Jknojcec.dll Nlibhhme.exe File opened for modification C:\Windows\SysWOW64\Mnbbpkjg.exe Mdjnge32.exe File opened for modification C:\Windows\SysWOW64\Eiocdand.exe Edbjljpm.exe File created C:\Windows\SysWOW64\Colegflh.exe Bgqqcd32.exe File opened for modification C:\Windows\SysWOW64\Kjpafanf.exe Kqgmnk32.exe File opened for modification C:\Windows\SysWOW64\Eghcckld.exe Ediggoma.exe File created C:\Windows\SysWOW64\Ilpaqmkg.exe Iiaddb32.exe File opened for modification C:\Windows\SysWOW64\Caligc32.exe Chdeonfa.exe File created C:\Windows\SysWOW64\Qljaah32.exe Pofqhdnd.exe File created C:\Windows\SysWOW64\Ilaieljl.exe Icidlf32.exe File created C:\Windows\SysWOW64\Lhlgaedj.exe Kjgjpiob.exe File created C:\Windows\SysWOW64\Aenkmf32.dll Lhlgaedj.exe File opened for modification C:\Windows\SysWOW64\Licpki32.exe Llooad32.exe File created C:\Windows\SysWOW64\Egedlo32.dll Bnfodojp.exe File opened for modification C:\Windows\SysWOW64\Jgnflmia.exe Jkgfgl32.exe File opened for modification C:\Windows\SysWOW64\Noiiaj32.exe Neaehelb.exe File opened for modification C:\Windows\SysWOW64\Fjkgampo.exe Fpecddpi.exe File created C:\Windows\SysWOW64\Nopdke32.dll Bccihj32.exe File opened for modification C:\Windows\SysWOW64\Qcigjolm.exe Qnlobhne.exe File created C:\Windows\SysWOW64\Icgphnbc.dll Cpdeghgk.exe File created C:\Windows\SysWOW64\Fkphcg32.exe Fdfpfm32.exe File opened for modification C:\Windows\SysWOW64\Peoanckj.exe Pobhfl32.exe File created C:\Windows\SysWOW64\Anqeihcn.dll Qgcingnm.exe File created C:\Windows\SysWOW64\Icmnkn32.dll Mjkpjkni.exe File opened for modification C:\Windows\SysWOW64\Fchgnj32.exe Fmnoapba.exe File opened for modification C:\Windows\SysWOW64\Cecnflpd.exe Cnifia32.exe File created C:\Windows\SysWOW64\Fagqed32.exe Efifjg32.exe File opened for modification C:\Windows\SysWOW64\Odpljf32.exe Okhgaqfj.exe File created C:\Windows\SysWOW64\Halhkamm.dll Ejnqkh32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 1484 3356 WerFault.exe 737 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Pmhbbp32.exeOllncgjq.exeKalkjh32.exeDqiakm32.exePjdjbl32.exeChoejien.exeFjkgampo.exeFpjlpclc.exeKgoief32.exeBfieec32.exeQajiek32.exeKnkkngol.exeCgfcabeh.exeAamhdckg.exeOdknmi32.exeMipjbokm.exeNlcpjj32.exeNkmffegm.exeOdhhdk32.exeAgoodkgk.exeMheekb32.exeBlcokf32.exeJjbbmmih.exeQiqpmp32.exeHpodbo32.exeFagqed32.exeLkolmk32.exeMmojcceo.exeJookedhp.exeDcgiejje.exeAkmgoehg.exeFbhfcf32.exeCcamabgg.exeGncblo32.exeNoffadai.exePjndca32.exeBieegcid.exeGmqlgppo.exeIqgofo32.exeMfjaknoe.exeFeofpqkn.exeBncboo32.exeFffabman.exeMpeidjfo.exeQljaah32.exeDiofenki.exeJbbenlof.exeKhhpmbeb.exePhmkaf32.exeMhkkjnmo.exeHiohob32.exeBglhcihn.exeIfkecl32.exeIiaddb32.exeNgafdepl.exeEqejjj32.exeGabohk32.exeHoflpbmo.exeJdlcnkfg.exeDcgppana.exeLpnlid32.exeInmdjjok.exeObdjjb32.exeGoemhfco.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmhbbp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ollncgjq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kalkjh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dqiakm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjdjbl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Choejien.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjkgampo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpjlpclc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kgoief32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfieec32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qajiek32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knkkngol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cgfcabeh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aamhdckg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odknmi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mipjbokm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlcpjj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nkmffegm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odhhdk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Agoodkgk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mheekb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blcokf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjbbmmih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qiqpmp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpodbo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fagqed32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lkolmk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmojcceo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jookedhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dcgiejje.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Akmgoehg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbhfcf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ccamabgg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gncblo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Noffadai.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjndca32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bieegcid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmqlgppo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iqgofo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mfjaknoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Feofpqkn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bncboo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fffabman.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mpeidjfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qljaah32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Diofenki.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbbenlof.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Khhpmbeb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phmkaf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhkkjnmo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hiohob32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bglhcihn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ifkecl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iiaddb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ngafdepl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eqejjj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gabohk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hoflpbmo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdlcnkfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dcgppana.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpnlid32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Inmdjjok.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Obdjjb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Goemhfco.exe -
Modifies registry class 64 IoCs
Processes:
Mnbbpkjg.exePclolakk.exeMpeidjfo.exeNlcpjj32.exeBfifqg32.exeIkinjj32.exeDbgknc32.exeLicpki32.exeMmgkoe32.exeMhkkjnmo.exePinchq32.exeKgfannba.exeBfgkdp32.exeEgobfdpi.exeGjomlp32.exeLmhjlj32.exeInmdjjok.exeAdoili32.exeOgpnakfp.exeEkcmkamj.exePjiffd32.exeJlodma32.exePkboiamh.exeHnljkf32.exeLaenqg32.exeJbmdig32.exePjndca32.exeColegflh.exeKaojiqej.exeNflidmic.exeOcpakg32.exeMjkpjkni.exeNnboonmb.exeFkphcg32.exeEmieflec.exePbienj32.exeHmjagh32.exeCceenilo.exeIhclmp32.exeAamhdckg.exeInbobn32.exeGlkinb32.exeDcgppana.exeFjkgampo.exeAbkqle32.exeCeclmc32.exeJkfncn32.exeMnqdpj32.exeJojaje32.exeEklicjkf.exeHfkidh32.exeBieegcid.exeFeofpqkn.exeMgkghp32.exeCajokmfi.exeMnfhfmhc.exeGpfbfh32.exeIdlgohcl.exeKqlgikcq.exeKjmnfk32.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mnbbpkjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pclolakk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mpeidjfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nlcpjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Demljd32.dll" Bfifqg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnoagg32.dll" Ikinjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dbgknc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Licpki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahdocnod.dll" Mmgkoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mhkkjnmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhmibjdp.dll" Pinchq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kgfannba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eknmgkpa.dll" Bfgkdp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Egobfdpi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gjomlp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lmhjlj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Inmdjjok.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Adoili32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkneko32.dll" Ogpnakfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imcafcpf.dll" Ekcmkamj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpnooe32.dll" Pjiffd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jlodma32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pkboiamh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpjlpa32.dll" Hnljkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Laenqg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jbmdig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npphimpc.dll" Gjomlp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pjndca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbkmhded.dll" Colegflh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdnpkd32.dll" Kaojiqej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbqlface.dll" Nflidmic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ocpakg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mjkpjkni.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nnboonmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npcmhi32.dll" Fkphcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfnefp32.dll" Emieflec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mndgpjek.dll" Pbienj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hmjagh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cceenilo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhpbfk32.dll" Ihclmp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkeabg32.dll" Aamhdckg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Inbobn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldhhfdpd.dll" Glkinb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibfkoeao.dll" Dcgppana.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fjkgampo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiilfa32.dll" Abkqle32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ceclmc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jkfncn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mnqdpj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jojaje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Glkinb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eklicjkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hfkidh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opoonh32.dll" Bieegcid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjfifc32.dll" Cceenilo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chlifcag.dll" Feofpqkn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mgkghp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adggon32.dll" Cajokmfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqgcbo32.dll" Mnfhfmhc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdnonb32.dll" Gpfbfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbankjel.dll" Idlgohcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kqlgikcq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kjmnfk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pjndca32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3d66b3778c1f378d034b16f69121221bf3fa1f56d27cf5a5da808dce6ea9f002N.exeMnfhfmhc.exeMfamko32.exeMbkkepio.exeNglmifca.exeNgafdepl.exeNqijmkfm.exeOlgehh32.exeObdjjb32.exeOllncgjq.exeOedclm32.exePnodjb32.exePiiekp32.exePdqfnhpa.exeQeglqpaj.exeQbkljd32.exedescription pid Process procid_target PID 2792 wrote to memory of 3012 2792 3d66b3778c1f378d034b16f69121221bf3fa1f56d27cf5a5da808dce6ea9f002N.exe 29 PID 2792 wrote to memory of 3012 2792 3d66b3778c1f378d034b16f69121221bf3fa1f56d27cf5a5da808dce6ea9f002N.exe 29 PID 2792 wrote to memory of 3012 2792 3d66b3778c1f378d034b16f69121221bf3fa1f56d27cf5a5da808dce6ea9f002N.exe 29 PID 2792 wrote to memory of 3012 2792 3d66b3778c1f378d034b16f69121221bf3fa1f56d27cf5a5da808dce6ea9f002N.exe 29 PID 3012 wrote to memory of 2820 3012 Mnfhfmhc.exe 30 PID 3012 wrote to memory of 2820 3012 Mnfhfmhc.exe 30 PID 3012 wrote to memory of 2820 3012 Mnfhfmhc.exe 30 PID 3012 wrote to memory of 2820 3012 Mnfhfmhc.exe 30 PID 2820 wrote to memory of 2316 2820 Mfamko32.exe 31 PID 2820 wrote to memory of 2316 2820 Mfamko32.exe 31 PID 2820 wrote to memory of 2316 2820 Mfamko32.exe 31 PID 2820 wrote to memory of 2316 2820 Mfamko32.exe 31 PID 2316 wrote to memory of 3024 2316 Mbkkepio.exe 32 PID 2316 wrote to memory of 3024 2316 Mbkkepio.exe 32 PID 2316 wrote to memory of 3024 2316 Mbkkepio.exe 32 PID 2316 wrote to memory of 3024 2316 Mbkkepio.exe 32 PID 3024 wrote to memory of 2768 3024 Nglmifca.exe 33 PID 3024 wrote to memory of 2768 3024 Nglmifca.exe 33 PID 3024 wrote to memory of 2768 3024 Nglmifca.exe 33 PID 3024 wrote to memory of 2768 3024 Nglmifca.exe 33 PID 2768 wrote to memory of 900 2768 Ngafdepl.exe 34 PID 2768 wrote to memory of 900 2768 Ngafdepl.exe 34 PID 2768 wrote to memory of 900 2768 Ngafdepl.exe 34 PID 2768 wrote to memory of 900 2768 Ngafdepl.exe 34 PID 900 wrote to memory of 2100 900 Nqijmkfm.exe 35 PID 900 wrote to memory of 2100 900 Nqijmkfm.exe 35 PID 900 wrote to memory of 2100 900 Nqijmkfm.exe 35 PID 900 wrote to memory of 2100 900 Nqijmkfm.exe 35 PID 2100 wrote to memory of 1916 2100 Olgehh32.exe 36 PID 2100 wrote to memory of 1916 2100 Olgehh32.exe 36 PID 2100 wrote to memory of 1916 2100 Olgehh32.exe 36 PID 2100 wrote to memory of 1916 2100 Olgehh32.exe 36 PID 1916 wrote to memory of 2800 1916 Obdjjb32.exe 37 PID 1916 wrote to memory of 2800 1916 Obdjjb32.exe 37 PID 1916 wrote to memory of 2800 1916 Obdjjb32.exe 37 PID 1916 wrote to memory of 2800 1916 Obdjjb32.exe 37 PID 2800 wrote to memory of 2200 2800 Ollncgjq.exe 38 PID 2800 wrote to memory of 2200 2800 Ollncgjq.exe 38 PID 2800 wrote to memory of 2200 2800 Ollncgjq.exe 38 PID 2800 wrote to memory of 2200 2800 Ollncgjq.exe 38 PID 2200 wrote to memory of 1260 2200 Oedclm32.exe 39 PID 2200 wrote to memory of 1260 2200 Oedclm32.exe 39 PID 2200 wrote to memory of 1260 2200 Oedclm32.exe 39 PID 2200 wrote to memory of 1260 2200 Oedclm32.exe 39 PID 1260 wrote to memory of 2896 1260 Pnodjb32.exe 40 PID 1260 wrote to memory of 2896 1260 Pnodjb32.exe 40 PID 1260 wrote to memory of 2896 1260 Pnodjb32.exe 40 PID 1260 wrote to memory of 2896 1260 Pnodjb32.exe 40 PID 2896 wrote to memory of 1272 2896 Piiekp32.exe 41 PID 2896 wrote to memory of 1272 2896 Piiekp32.exe 41 PID 2896 wrote to memory of 1272 2896 Piiekp32.exe 41 PID 2896 wrote to memory of 1272 2896 Piiekp32.exe 41 PID 1272 wrote to memory of 2908 1272 Pdqfnhpa.exe 42 PID 1272 wrote to memory of 2908 1272 Pdqfnhpa.exe 42 PID 1272 wrote to memory of 2908 1272 Pdqfnhpa.exe 42 PID 1272 wrote to memory of 2908 1272 Pdqfnhpa.exe 42 PID 2908 wrote to memory of 2072 2908 Qeglqpaj.exe 43 PID 2908 wrote to memory of 2072 2908 Qeglqpaj.exe 43 PID 2908 wrote to memory of 2072 2908 Qeglqpaj.exe 43 PID 2908 wrote to memory of 2072 2908 Qeglqpaj.exe 43 PID 2072 wrote to memory of 1968 2072 Qbkljd32.exe 44 PID 2072 wrote to memory of 1968 2072 Qbkljd32.exe 44 PID 2072 wrote to memory of 1968 2072 Qbkljd32.exe 44 PID 2072 wrote to memory of 1968 2072 Qbkljd32.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d66b3778c1f378d034b16f69121221bf3fa1f56d27cf5a5da808dce6ea9f002N.exe"C:\Users\Admin\AppData\Local\Temp\3d66b3778c1f378d034b16f69121221bf3fa1f56d27cf5a5da808dce6ea9f002N.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\Mnfhfmhc.exeC:\Windows\system32\Mnfhfmhc.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\Mfamko32.exeC:\Windows\system32\Mfamko32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\Mbkkepio.exeC:\Windows\system32\Mbkkepio.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\Nglmifca.exeC:\Windows\system32\Nglmifca.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\Ngafdepl.exeC:\Windows\system32\Ngafdepl.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\Nqijmkfm.exeC:\Windows\system32\Nqijmkfm.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\Olgehh32.exeC:\Windows\system32\Olgehh32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\Obdjjb32.exeC:\Windows\system32\Obdjjb32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\Ollncgjq.exeC:\Windows\system32\Ollncgjq.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\Oedclm32.exeC:\Windows\system32\Oedclm32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\Pnodjb32.exeC:\Windows\system32\Pnodjb32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\Piiekp32.exeC:\Windows\system32\Piiekp32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\Pdqfnhpa.exeC:\Windows\system32\Pdqfnhpa.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\Qeglqpaj.exeC:\Windows\system32\Qeglqpaj.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\Qbkljd32.exeC:\Windows\system32\Qbkljd32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\Alcqcjgd.exeC:\Windows\system32\Alcqcjgd.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Windows\SysWOW64\Aniffaim.exeC:\Windows\system32\Aniffaim.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Windows\SysWOW64\Akmgoehg.exeC:\Windows\system32\Akmgoehg.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1636 -
C:\Windows\SysWOW64\Ajbdpblo.exeC:\Windows\system32\Ajbdpblo.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Windows\SysWOW64\Bfieec32.exeC:\Windows\system32\Bfieec32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1668 -
C:\Windows\SysWOW64\Babbpc32.exeC:\Windows\system32\Babbpc32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Windows\SysWOW64\Bnicddki.exeC:\Windows\system32\Bnicddki.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Windows\SysWOW64\Cjbpoeoj.exeC:\Windows\system32\Cjbpoeoj.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Windows\SysWOW64\Cnpieceq.exeC:\Windows\system32\Cnpieceq.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Windows\SysWOW64\Cfmjoe32.exeC:\Windows\system32\Cfmjoe32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Windows\SysWOW64\Cjkcedgp.exeC:\Windows\system32\Cjkcedgp.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Windows\SysWOW64\Cccgni32.exeC:\Windows\system32\Cccgni32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Windows\SysWOW64\Efifjg32.exeC:\Windows\system32\Efifjg32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2980 -
C:\Windows\SysWOW64\Fagqed32.exeC:\Windows\system32\Fagqed32.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2844 -
C:\Windows\SysWOW64\Fmpnpe32.exeC:\Windows\system32\Fmpnpe32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Windows\SysWOW64\Fangfcki.exeC:\Windows\system32\Fangfcki.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Windows\SysWOW64\Geplpfnh.exeC:\Windows\system32\Geplpfnh.exe33⤵
- Executes dropped EXE
PID:2616 -
C:\Windows\SysWOW64\Gebiefle.exeC:\Windows\system32\Gebiefle.exe34⤵
- Executes dropped EXE
PID:2084 -
C:\Windows\SysWOW64\Hopgikop.exeC:\Windows\system32\Hopgikop.exe35⤵
- Executes dropped EXE
PID:2108 -
C:\Windows\SysWOW64\Hdloab32.exeC:\Windows\system32\Hdloab32.exe36⤵
- Executes dropped EXE
PID:1584 -
C:\Windows\SysWOW64\Hdolga32.exeC:\Windows\system32\Hdolga32.exe37⤵
- Executes dropped EXE
PID:540 -
C:\Windows\SysWOW64\Hjkdoh32.exeC:\Windows\system32\Hjkdoh32.exe38⤵
- Executes dropped EXE
PID:1984 -
C:\Windows\SysWOW64\Hdcebagp.exeC:\Windows\system32\Hdcebagp.exe39⤵
- Executes dropped EXE
PID:2972 -
C:\Windows\SysWOW64\Hnljkf32.exeC:\Windows\system32\Hnljkf32.exe40⤵
- Executes dropped EXE
- Modifies registry class
PID:1312 -
C:\Windows\SysWOW64\Ijbjpg32.exeC:\Windows\system32\Ijbjpg32.exe41⤵
- Executes dropped EXE
PID:1616 -
C:\Windows\SysWOW64\Imccab32.exeC:\Windows\system32\Imccab32.exe42⤵
- Executes dropped EXE
PID:1728 -
C:\Windows\SysWOW64\Ibplji32.exeC:\Windows\system32\Ibplji32.exe43⤵
- Executes dropped EXE
PID:2492 -
C:\Windows\SysWOW64\Ingmoj32.exeC:\Windows\system32\Ingmoj32.exe44⤵
- Executes dropped EXE
PID:2684 -
C:\Windows\SysWOW64\Iionacad.exeC:\Windows\system32\Iionacad.exe45⤵
- Executes dropped EXE
PID:660 -
C:\Windows\SysWOW64\Jeenfd32.exeC:\Windows\system32\Jeenfd32.exe46⤵
- Executes dropped EXE
PID:2584 -
C:\Windows\SysWOW64\Jgfghodj.exeC:\Windows\system32\Jgfghodj.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1932 -
C:\Windows\SysWOW64\Jijqeg32.exeC:\Windows\system32\Jijqeg32.exe48⤵
- Executes dropped EXE
PID:388 -
C:\Windows\SysWOW64\Jbbenlof.exeC:\Windows\system32\Jbbenlof.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2688 -
C:\Windows\SysWOW64\Kmjfae32.exeC:\Windows\system32\Kmjfae32.exe50⤵
- Executes dropped EXE
PID:1560 -
C:\Windows\SysWOW64\Khdgabih.exeC:\Windows\system32\Khdgabih.exe51⤵
- Executes dropped EXE
PID:1780 -
C:\Windows\SysWOW64\Kalkjh32.exeC:\Windows\system32\Kalkjh32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2276 -
C:\Windows\SysWOW64\Kanhph32.exeC:\Windows\system32\Kanhph32.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3008 -
C:\Windows\SysWOW64\Khhpmbeb.exeC:\Windows\system32\Khhpmbeb.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Windows\SysWOW64\Kmeiei32.exeC:\Windows\system32\Kmeiei32.exe55⤵
- Executes dropped EXE
PID:2828 -
C:\Windows\SysWOW64\Kacakgip.exeC:\Windows\system32\Kacakgip.exe56⤵
- Executes dropped EXE
PID:2976 -
C:\Windows\SysWOW64\Lgpjcnhh.exeC:\Windows\system32\Lgpjcnhh.exe57⤵
- Executes dropped EXE
PID:2264 -
C:\Windows\SysWOW64\Laenqg32.exeC:\Windows\system32\Laenqg32.exe58⤵
- Executes dropped EXE
- Modifies registry class
PID:2612 -
C:\Windows\SysWOW64\Lgbfin32.exeC:\Windows\system32\Lgbfin32.exe59⤵
- Executes dropped EXE
PID:1580 -
C:\Windows\SysWOW64\Llooad32.exeC:\Windows\system32\Llooad32.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:3040 -
C:\Windows\SysWOW64\Licpki32.exeC:\Windows\system32\Licpki32.exe61⤵
- Executes dropped EXE
- Modifies registry class
PID:1144 -
C:\Windows\SysWOW64\Lckdcn32.exeC:\Windows\system32\Lckdcn32.exe62⤵
- Executes dropped EXE
PID:1744 -
C:\Windows\SysWOW64\Lpodmb32.exeC:\Windows\system32\Lpodmb32.exe63⤵
- Executes dropped EXE
PID:2228 -
C:\Windows\SysWOW64\Laqadknn.exeC:\Windows\system32\Laqadknn.exe64⤵
- Executes dropped EXE
PID:1172 -
C:\Windows\SysWOW64\Lhkiae32.exeC:\Windows\system32\Lhkiae32.exe65⤵
- Executes dropped EXE
PID:848 -
C:\Windows\SysWOW64\Mdajff32.exeC:\Windows\system32\Mdajff32.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2216 -
C:\Windows\SysWOW64\Mognco32.exeC:\Windows\system32\Mognco32.exe67⤵PID:2128
-
C:\Windows\SysWOW64\Mhobldaf.exeC:\Windows\system32\Mhobldaf.exe68⤵PID:1724
-
C:\Windows\SysWOW64\Moikinib.exeC:\Windows\system32\Moikinib.exe69⤵PID:524
-
C:\Windows\SysWOW64\Mdfcaegj.exeC:\Windows\system32\Mdfcaegj.exe70⤵PID:1512
-
C:\Windows\SysWOW64\Mkplnp32.exeC:\Windows\system32\Mkplnp32.exe71⤵PID:1596
-
C:\Windows\SysWOW64\Mgglcqdk.exeC:\Windows\system32\Mgglcqdk.exe72⤵PID:2256
-
C:\Windows\SysWOW64\Mnqdpj32.exeC:\Windows\system32\Mnqdpj32.exe73⤵
- Modifies registry class
PID:2872 -
C:\Windows\SysWOW64\Mdkmld32.exeC:\Windows\system32\Mdkmld32.exe74⤵PID:2876
-
C:\Windows\SysWOW64\Nflidmic.exeC:\Windows\system32\Nflidmic.exe75⤵
- Modifies registry class
PID:2196 -
C:\Windows\SysWOW64\Nlfaag32.exeC:\Windows\system32\Nlfaag32.exe76⤵PID:2692
-
C:\Windows\SysWOW64\Nfnfjmgp.exeC:\Windows\system32\Nfnfjmgp.exe77⤵PID:1020
-
C:\Windows\SysWOW64\Nbegonmd.exeC:\Windows\system32\Nbegonmd.exe78⤵PID:1168
-
C:\Windows\SysWOW64\Noighakn.exeC:\Windows\system32\Noighakn.exe79⤵PID:3068
-
C:\Windows\SysWOW64\Nkphmc32.exeC:\Windows\system32\Nkphmc32.exe80⤵PID:2968
-
C:\Windows\SysWOW64\Nfeljlqh.exeC:\Windows\system32\Nfeljlqh.exe81⤵PID:2212
-
C:\Windows\SysWOW64\Onggom32.exeC:\Windows\system32\Onggom32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:368 -
C:\Windows\SysWOW64\Oahpahel.exeC:\Windows\system32\Oahpahel.exe83⤵PID:2620
-
C:\Windows\SysWOW64\Pmoqfi32.exeC:\Windows\system32\Pmoqfi32.exe84⤵PID:1052
-
C:\Windows\SysWOW64\Phmkaf32.exeC:\Windows\system32\Phmkaf32.exe85⤵
- System Location Discovery: System Language Discovery
PID:2436 -
C:\Windows\SysWOW64\Pafpjljk.exeC:\Windows\system32\Pafpjljk.exe86⤵PID:1396
-
C:\Windows\SysWOW64\Pjndca32.exeC:\Windows\system32\Pjndca32.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2656 -
C:\Windows\SysWOW64\Qfedhb32.exeC:\Windows\system32\Qfedhb32.exe88⤵PID:1940
-
C:\Windows\SysWOW64\Qajiek32.exeC:\Windows\system32\Qajiek32.exe89⤵
- System Location Discovery: System Language Discovery
PID:884 -
C:\Windows\SysWOW64\Qifnjm32.exeC:\Windows\system32\Qifnjm32.exe90⤵PID:2720
-
C:\Windows\SysWOW64\Afjncabj.exeC:\Windows\system32\Afjncabj.exe91⤵PID:2936
-
C:\Windows\SysWOW64\Abpohb32.exeC:\Windows\system32\Abpohb32.exe92⤵PID:2928
-
C:\Windows\SysWOW64\Alicahno.exeC:\Windows\system32\Alicahno.exe93⤵PID:2808
-
C:\Windows\SysWOW64\Ahpdficc.exeC:\Windows\system32\Ahpdficc.exe94⤵PID:1100
-
C:\Windows\SysWOW64\Abehcbci.exeC:\Windows\system32\Abehcbci.exe95⤵PID:2568
-
C:\Windows\SysWOW64\Aolihc32.exeC:\Windows\system32\Aolihc32.exe96⤵PID:2328
-
C:\Windows\SysWOW64\Blpibghg.exeC:\Windows\system32\Blpibghg.exe97⤵
- Drops file in System32 directory
PID:2480 -
C:\Windows\SysWOW64\Behnkm32.exeC:\Windows\system32\Behnkm32.exe98⤵PID:2244
-
C:\Windows\SysWOW64\Bncboo32.exeC:\Windows\system32\Bncboo32.exe99⤵
- System Location Discovery: System Language Discovery
PID:972 -
C:\Windows\SysWOW64\Bnfodojp.exeC:\Windows\system32\Bnfodojp.exe100⤵
- Drops file in System32 directory
PID:1640 -
C:\Windows\SysWOW64\Bgndnd32.exeC:\Windows\system32\Bgndnd32.exe101⤵PID:1656
-
C:\Windows\SysWOW64\Bgqqcd32.exeC:\Windows\system32\Bgqqcd32.exe102⤵
- Drops file in System32 directory
PID:2292 -
C:\Windows\SysWOW64\Colegflh.exeC:\Windows\system32\Colegflh.exe103⤵
- Modifies registry class
PID:932 -
C:\Windows\SysWOW64\Cjaieoko.exeC:\Windows\system32\Cjaieoko.exe104⤵PID:1600
-
C:\Windows\SysWOW64\Copobe32.exeC:\Windows\system32\Copobe32.exe105⤵PID:780
-
C:\Windows\SysWOW64\Cdmgkl32.exeC:\Windows\system32\Cdmgkl32.exe106⤵PID:2312
-
C:\Windows\SysWOW64\Cgnpmg32.exeC:\Windows\system32\Cgnpmg32.exe107⤵PID:1720
-
C:\Windows\SysWOW64\Chmlfj32.exeC:\Windows\system32\Chmlfj32.exe108⤵PID:2416
-
C:\Windows\SysWOW64\Dqiakm32.exeC:\Windows\system32\Dqiakm32.exe109⤵
- System Location Discovery: System Language Discovery
PID:2352 -
C:\Windows\SysWOW64\Dnmada32.exeC:\Windows\system32\Dnmada32.exe110⤵PID:1400
-
C:\Windows\SysWOW64\Djcbib32.exeC:\Windows\system32\Djcbib32.exe111⤵PID:1296
-
C:\Windows\SysWOW64\Dopkai32.exeC:\Windows\system32\Dopkai32.exe112⤵PID:2080
-
C:\Windows\SysWOW64\Dqpgll32.exeC:\Windows\system32\Dqpgll32.exe113⤵PID:1516
-
C:\Windows\SysWOW64\Dmfhqmge.exeC:\Windows\system32\Dmfhqmge.exe114⤵PID:1352
-
C:\Windows\SysWOW64\Emieflec.exeC:\Windows\system32\Emieflec.exe115⤵
- Modifies registry class
PID:612 -
C:\Windows\SysWOW64\Efaiobkc.exeC:\Windows\system32\Efaiobkc.exe116⤵PID:2564
-
C:\Windows\SysWOW64\Egbffj32.exeC:\Windows\system32\Egbffj32.exe117⤵PID:1672
-
C:\Windows\SysWOW64\Eeffpn32.exeC:\Windows\system32\Eeffpn32.exe118⤵PID:572
-
C:\Windows\SysWOW64\Ebjfiboe.exeC:\Windows\system32\Ebjfiboe.exe119⤵PID:2324
-
C:\Windows\SysWOW64\Ehgoaiml.exeC:\Windows\system32\Ehgoaiml.exe120⤵PID:2124
-
C:\Windows\SysWOW64\Ejhhcdjm.exeC:\Windows\system32\Ejhhcdjm.exe121⤵PID:2912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-