Analysis
-
max time kernel
102s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 07:03
Behavioral task
behavioral1
Sample
58966d67b95ed518bfbfeb8b30ac7b89c2dfee39e6bf513809543f0fe1e2c94cN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
58966d67b95ed518bfbfeb8b30ac7b89c2dfee39e6bf513809543f0fe1e2c94cN.exe
Resource
win10v2004-20241007-en
General
-
Target
58966d67b95ed518bfbfeb8b30ac7b89c2dfee39e6bf513809543f0fe1e2c94cN.exe
-
Size
276KB
-
MD5
c017c9525619b947e45e12f245b23290
-
SHA1
2502c0dade7f74f2d9a18dcdafbf1366613b6fdb
-
SHA256
58966d67b95ed518bfbfeb8b30ac7b89c2dfee39e6bf513809543f0fe1e2c94c
-
SHA512
13561662b731f7e5162fac55245dbf641cd44be6da1c0546e50cd5929740b62bed77d91ea73e1a56e5e6a376fa3912ea9b7e3ef57a5db81df30b3f70c07e2b50
-
SSDEEP
6144:/YK78LydiKBb8La4dZMGXF5ahdt3rM8d7TtLa:zGyd9GLzXFWtJ9O
Malware Config
Extracted
berbew
http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Ldpnoj32.exeFabmmejd.exeKabngjla.exeFdlqjf32.exePmbdfolj.exeLofkoamf.exeOacbdg32.exeLjeabf32.exeQkcdigpa.exeEmaijk32.exeDhgccbhp.exeJacjna32.exeEphhmn32.exeHqpahkmj.exeLlomhllh.exeBcpiombe.exeDbgdgm32.exeKaekljjo.exeKnmghb32.exeQefihg32.exeEmncci32.exeEoajgh32.exeBcoffd32.exeHjplao32.exeLgfjggll.exeGminbfoh.exeGngfjicn.exePqplqile.exeImdjlida.exeMmccqbpm.exeKmnlhg32.exeBbfgiabg.exeEbmjihqn.exeEeceim32.exeGghloe32.exeMnpbgbdd.exeDpdfemkm.exePhmiimlf.exeFbniohpl.exeFokofpif.exeHmojfcdk.exeIphgln32.exeEacghhkd.exeHoipnl32.exeDpmjjhmi.exeCgjhkpbj.exeBlipno32.exeGjnigb32.exeJdjioh32.exeNjgpij32.exeNggipg32.exeAfnfcl32.exeEqkjmcmq.exeEdjlgq32.exeFbnkha32.exeBnqcaffa.exeEgljjmkp.exeMliibj32.exeDjlbkcfn.exeGhmnmo32.exeDenknngk.exeOelcho32.exeCiknhb32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldpnoj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fabmmejd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kabngjla.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdlqjf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmbdfolj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lofkoamf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oacbdg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljeabf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qkcdigpa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emaijk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dhgccbhp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jacjna32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ephhmn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hqpahkmj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Llomhllh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcpiombe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dbgdgm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kaekljjo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knmghb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qefihg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emncci32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eoajgh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcoffd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjplao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lgfjggll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gminbfoh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gngfjicn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pqplqile.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Imdjlida.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mmccqbpm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmnlhg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bbfgiabg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ebmjihqn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eeceim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gghloe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mnpbgbdd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpdfemkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Phmiimlf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fbniohpl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fokofpif.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmojfcdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iphgln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eacghhkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hoipnl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpmjjhmi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgjhkpbj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Blipno32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjnigb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdjioh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Njgpij32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nggipg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afnfcl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eqkjmcmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Edjlgq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fbnkha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bnqcaffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hmojfcdk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Egljjmkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mliibj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Djlbkcfn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghmnmo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Denknngk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oelcho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ciknhb32.exe -
Berbew family
-
Executes dropped EXE 64 IoCs
Processes:
Afffenbp.exeAlqnah32.exeAoagccfn.exeBjbndpmd.exeCfkloq32.exeCkmnbg32.exeCjakccop.exeDpcmgi32.exeDpeiligo.exeEegkpo32.exeEopphehb.exeEcfnmh32.exeFpjofl32.exeFleifl32.exeFdqnkoep.exeGhofam32.exeGcmamj32.exeGhlfjq32.exeHfpfdeon.exeHfepod32.exeHkahgk32.exeHkdemk32.exeIndnnfdn.exeIphgln32.exeIejiodbl.exeJndjmifj.exeJlhkgm32.exeJjpdmi32.exeJhdegn32.exeKalipcmb.exeKlfjpa32.exeKijkje32.exeKpfplo32.exeKhadpa32.exeLkbmbl32.exeLopfhk32.exeLjigih32.exeLgpdglhn.exeMphiqbon.exeMomfan32.exeMlafkb32.exeMmccqbpm.exeMdogedmh.exeMdadjd32.exeNcfalqpm.exeNqjaeeog.exeNmabjfek.exeNmcopebh.exeNjgpij32.exeNmflee32.exeOfnpnkgf.exeOecmogln.exeOefjdgjk.exeOehgjfhi.exeOmckoi32.exeOflpgnld.exePdppqbkn.exePfpibn32.exePpinkcnp.exePeefcjlg.exePbigmn32.exePhfoee32.exeQejpoi32.exeQemldifo.exepid process 1116 Afffenbp.exe 2440 Alqnah32.exe 2768 Aoagccfn.exe 2192 Bjbndpmd.exe 3012 Cfkloq32.exe 2640 Ckmnbg32.exe 2576 Cjakccop.exe 2844 Dpcmgi32.exe 832 Dpeiligo.exe 740 Eegkpo32.exe 1464 Eopphehb.exe 1752 Ecfnmh32.exe 940 Fpjofl32.exe 2028 Fleifl32.exe 1520 Fdqnkoep.exe 1800 Ghofam32.exe 968 Gcmamj32.exe 2856 Ghlfjq32.exe 1688 Hfpfdeon.exe 1512 Hfepod32.exe 1660 Hkahgk32.exe 2428 Hkdemk32.exe 568 Indnnfdn.exe 1340 Iphgln32.exe 2548 Iejiodbl.exe 2388 Jndjmifj.exe 2728 Jlhkgm32.exe 2940 Jjpdmi32.exe 1192 Jhdegn32.exe 2920 Kalipcmb.exe 2896 Klfjpa32.exe 2104 Kijkje32.exe 2688 Kpfplo32.exe 2836 Khadpa32.exe 2972 Lkbmbl32.exe 1152 Lopfhk32.exe 1892 Ljigih32.exe 2024 Lgpdglhn.exe 2084 Mphiqbon.exe 1172 Momfan32.exe 1268 Mlafkb32.exe 972 Mmccqbpm.exe 1716 Mdogedmh.exe 828 Mdadjd32.exe 1816 Ncfalqpm.exe 2264 Nqjaeeog.exe 2596 Nmabjfek.exe 1408 Nmcopebh.exe 1592 Njgpij32.exe 2532 Nmflee32.exe 868 Ofnpnkgf.exe 2468 Oecmogln.exe 2756 Oefjdgjk.exe 2464 Oehgjfhi.exe 2828 Omckoi32.exe 2840 Oflpgnld.exe 2516 Pdppqbkn.exe 1888 Pfpibn32.exe 2396 Ppinkcnp.exe 2564 Peefcjlg.exe 2096 Pbigmn32.exe 1480 Phfoee32.exe 2864 Qejpoi32.exe 1056 Qemldifo.exe -
Loads dropped DLL 64 IoCs
Processes:
58966d67b95ed518bfbfeb8b30ac7b89c2dfee39e6bf513809543f0fe1e2c94cN.exeAfffenbp.exeAlqnah32.exeAoagccfn.exeBjbndpmd.exeCfkloq32.exeCkmnbg32.exeCjakccop.exeDpcmgi32.exeDpeiligo.exeEegkpo32.exeEopphehb.exeEcfnmh32.exeFpjofl32.exeFleifl32.exeFdqnkoep.exeGhofam32.exeGcmamj32.exeGhlfjq32.exeHfpfdeon.exeHfepod32.exeHkahgk32.exeHkdemk32.exeIndnnfdn.exeIphgln32.exeIejiodbl.exeJndjmifj.exeJlhkgm32.exeJjpdmi32.exeJhdegn32.exeKalipcmb.exeKlfjpa32.exepid process 2108 58966d67b95ed518bfbfeb8b30ac7b89c2dfee39e6bf513809543f0fe1e2c94cN.exe 2108 58966d67b95ed518bfbfeb8b30ac7b89c2dfee39e6bf513809543f0fe1e2c94cN.exe 1116 Afffenbp.exe 1116 Afffenbp.exe 2440 Alqnah32.exe 2440 Alqnah32.exe 2768 Aoagccfn.exe 2768 Aoagccfn.exe 2192 Bjbndpmd.exe 2192 Bjbndpmd.exe 3012 Cfkloq32.exe 3012 Cfkloq32.exe 2640 Ckmnbg32.exe 2640 Ckmnbg32.exe 2576 Cjakccop.exe 2576 Cjakccop.exe 2844 Dpcmgi32.exe 2844 Dpcmgi32.exe 832 Dpeiligo.exe 832 Dpeiligo.exe 740 Eegkpo32.exe 740 Eegkpo32.exe 1464 Eopphehb.exe 1464 Eopphehb.exe 1752 Ecfnmh32.exe 1752 Ecfnmh32.exe 940 Fpjofl32.exe 940 Fpjofl32.exe 2028 Fleifl32.exe 2028 Fleifl32.exe 1520 Fdqnkoep.exe 1520 Fdqnkoep.exe 1800 Ghofam32.exe 1800 Ghofam32.exe 968 Gcmamj32.exe 968 Gcmamj32.exe 2856 Ghlfjq32.exe 2856 Ghlfjq32.exe 1688 Hfpfdeon.exe 1688 Hfpfdeon.exe 1512 Hfepod32.exe 1512 Hfepod32.exe 1660 Hkahgk32.exe 1660 Hkahgk32.exe 2428 Hkdemk32.exe 2428 Hkdemk32.exe 568 Indnnfdn.exe 568 Indnnfdn.exe 1340 Iphgln32.exe 1340 Iphgln32.exe 2548 Iejiodbl.exe 2548 Iejiodbl.exe 2388 Jndjmifj.exe 2388 Jndjmifj.exe 2728 Jlhkgm32.exe 2728 Jlhkgm32.exe 2940 Jjpdmi32.exe 2940 Jjpdmi32.exe 1192 Jhdegn32.exe 1192 Jhdegn32.exe 2920 Kalipcmb.exe 2920 Kalipcmb.exe 2896 Klfjpa32.exe 2896 Klfjpa32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Eblelb32.exeLgbibb32.exeLmqgec32.exeKdgoelnk.exeJljgni32.exeFefpfi32.exeJdmfdgbj.exeEpbamc32.exePdjpmi32.exeIndnnfdn.exeFcichb32.exeDiencmcj.exeHehhqk32.exeOgjhnp32.exeHadhjaaa.exeQqoaefke.exeHcndag32.exeKhjkiikl.exeAkbgdkgm.exeBqopmbed.exeAdnegldo.exeHlhddh32.exeHaemloni.exeJgbjjf32.exeKaekljjo.exeBepjjn32.exePdllci32.exeFhfbmn32.exeHkahgk32.exeKnikfnih.exeOoemcb32.exeDlkqpg32.exeNbaomf32.exeObamebfc.exePkhdnh32.exeJopbnn32.exeCdfief32.exeDabicikf.exeGpfggeai.exeJiaaaicm.exeGbkaneao.exeDbneekan.exeJjpdmi32.exeHcgmfgfd.exeEcnpdnho.exeLbmnea32.exePaghojip.exeDpmjjhmi.exeNgpcohbm.exeNladco32.exeDhgccbhp.exeHmfmkjdf.exeCbajme32.exeEeeanm32.exeHjbhgolp.exeJmejmm32.exeQckcdj32.exeHgbhibio.exeHojqjp32.exeMkelcenm.exeAoagccfn.exeDgfmep32.exeLlomhllh.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Emaijk32.exe Eblelb32.exe File created C:\Windows\SysWOW64\Bbbmhm32.dll Lgbibb32.exe File created C:\Windows\SysWOW64\Lfilnh32.exe Lmqgec32.exe File created C:\Windows\SysWOW64\Klbdiokf.exe Kdgoelnk.exe File created C:\Windows\SysWOW64\Jeblgodb.exe Jljgni32.exe File created C:\Windows\SysWOW64\Dcelpdef.dll Fefpfi32.exe File opened for modification C:\Windows\SysWOW64\Jmejmm32.exe Jdmfdgbj.exe File created C:\Windows\SysWOW64\Hjcnol32.dll Epbamc32.exe File created C:\Windows\SysWOW64\Pmbdfolj.exe Pdjpmi32.exe File created C:\Windows\SysWOW64\Ehnjfg32.dll Indnnfdn.exe File created C:\Windows\SysWOW64\Dnqnoqah.dll Fcichb32.exe File created C:\Windows\SysWOW64\Dihkimag.exe Diencmcj.exe File created C:\Windows\SysWOW64\Jjlgai32.dll Hehhqk32.exe File created C:\Windows\SysWOW64\Bdmhhh32.dll Ogjhnp32.exe File created C:\Windows\SysWOW64\Folqfbjh.dll Hadhjaaa.exe File opened for modification C:\Windows\SysWOW64\Ajgfnk32.exe Qqoaefke.exe File opened for modification C:\Windows\SysWOW64\Hmfhjmho.exe Hcndag32.exe File created C:\Windows\SysWOW64\Hqckgi32.dll Khjkiikl.exe File opened for modification C:\Windows\SysWOW64\Bnqcaffa.exe Akbgdkgm.exe File opened for modification C:\Windows\SysWOW64\Bcpiombe.exe Bqopmbed.exe File opened for modification C:\Windows\SysWOW64\Aodjdede.exe Adnegldo.exe File created C:\Windows\SysWOW64\Algllb32.dll Hlhddh32.exe File created C:\Windows\SysWOW64\Hoimecmb.exe Haemloni.exe File opened for modification C:\Windows\SysWOW64\Jpmooind.exe Jgbjjf32.exe File created C:\Windows\SysWOW64\Gjhjgq32.dll Kaekljjo.exe File created C:\Windows\SysWOW64\Bbfgiabg.exe Bepjjn32.exe File opened for modification C:\Windows\SysWOW64\Piiekp32.exe Pdllci32.exe File created C:\Windows\SysWOW64\Gpagbp32.exe Fhfbmn32.exe File created C:\Windows\SysWOW64\Hkdemk32.exe Hkahgk32.exe File opened for modification C:\Windows\SysWOW64\Kpjhnfof.exe Knikfnih.exe File opened for modification C:\Windows\SysWOW64\Oikapk32.exe Ooemcb32.exe File created C:\Windows\SysWOW64\Nlcgea32.dll Dlkqpg32.exe File opened for modification C:\Windows\SysWOW64\Nljcflbd.exe Nbaomf32.exe File created C:\Windows\SysWOW64\Oljanhmc.exe Obamebfc.exe File opened for modification C:\Windows\SysWOW64\Pfnhkq32.exe Pkhdnh32.exe File opened for modification C:\Windows\SysWOW64\Jdogldmo.exe Jopbnn32.exe File created C:\Windows\SysWOW64\Dpmjjhmi.exe Cdfief32.exe File created C:\Windows\SysWOW64\Bbifhddh.dll Dabicikf.exe File created C:\Windows\SysWOW64\Ejjglk32.dll Gpfggeai.exe File created C:\Windows\SysWOW64\Jbjejojn.exe Jiaaaicm.exe File created C:\Windows\SysWOW64\Inlmnebq.dll Gbkaneao.exe File created C:\Windows\SysWOW64\Eneehhmp.dll Dbneekan.exe File opened for modification C:\Windows\SysWOW64\Jhdegn32.exe Jjpdmi32.exe File opened for modification C:\Windows\SysWOW64\Hmpaom32.exe Hcgmfgfd.exe File created C:\Windows\SysWOW64\Bocjgfch.dll Ecnpdnho.exe File created C:\Windows\SysWOW64\Lmbabj32.exe Lbmnea32.exe File opened for modification C:\Windows\SysWOW64\Qdhqpe32.exe Paghojip.exe File created C:\Windows\SysWOW64\Fniiae32.dll Dpmjjhmi.exe File created C:\Windows\SysWOW64\Bcpiombe.exe Bqopmbed.exe File created C:\Windows\SysWOW64\Nddcimag.exe Ngpcohbm.exe File opened for modification C:\Windows\SysWOW64\Nggipg32.exe Nladco32.exe File created C:\Windows\SysWOW64\Dnckki32.exe Dhgccbhp.exe File created C:\Windows\SysWOW64\Hhlaiccm.exe Hmfmkjdf.exe File created C:\Windows\SysWOW64\Cgobcd32.exe Cbajme32.exe File created C:\Windows\SysWOW64\Kkeacf32.dll Eeeanm32.exe File opened for modification C:\Windows\SysWOW64\Iigehk32.exe Hjbhgolp.exe File created C:\Windows\SysWOW64\Jepoao32.exe Jmejmm32.exe File opened for modification C:\Windows\SysWOW64\Qnagbc32.exe Qckcdj32.exe File opened for modification C:\Windows\SysWOW64\Hojqjp32.exe Hgbhibio.exe File opened for modification C:\Windows\SysWOW64\Hkpaoape.exe Hojqjp32.exe File opened for modification C:\Windows\SysWOW64\Nqbdllld.exe Mkelcenm.exe File opened for modification C:\Windows\SysWOW64\Bjbndpmd.exe Aoagccfn.exe File opened for modification C:\Windows\SysWOW64\Dghjkpck.exe Dgfmep32.exe File created C:\Windows\SysWOW64\Qieklfmg.dll Llomhllh.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4128 2124 WerFault.exe Iqmcmaja.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Iipejmko.exeDgqion32.exeLmnhgjmp.exeOelcho32.exeCkbccnji.exeIbgglfdl.exeJekoljgo.exeHqnjek32.exeOmphocck.exeGminbfoh.exePfnhkq32.exeHijjpeha.exeHkdemk32.exeIikkon32.exeLamjph32.exeLcppgbjd.exeDbidof32.exeEphhmn32.exeCofaog32.exeHehconob.exeGomhkb32.exeLgphke32.exeMnlilb32.exeFbniohpl.exeMpoppadq.exeEpnldd32.exeEleliepj.exeLmmfnb32.exeOgmkne32.exeKmhhae32.exeLgbibb32.exeBbdmljln.exeHbofmcij.exeKlmbjh32.exeFcilnl32.exeBbgplq32.exeKfjfik32.exeJeblgodb.exeFloeof32.exeEgkgad32.exeFlmecm32.exeAppbcn32.exeBhkghqpb.exeChbihc32.exeMaocekoo.exeDhekodik.exeGmegkd32.exeEldbkbop.exeDpaqmnap.exeFmaqgaae.exeNjipabhe.exeEpgoio32.exeBfabnl32.exeLmbabj32.exeHfalaj32.exeKghkppbp.exeDmljnfll.exeHojqjp32.exeFaedpdcc.exeHoipnl32.exeLckflc32.exePapkcd32.exeIagchmjn.exeEbmjihqn.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iipejmko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dgqion32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lmnhgjmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oelcho32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckbccnji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibgglfdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jekoljgo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hqnjek32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Omphocck.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gminbfoh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pfnhkq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hijjpeha.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkdemk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iikkon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lamjph32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lcppgbjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbidof32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ephhmn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cofaog32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hehconob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gomhkb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgphke32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnlilb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbniohpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mpoppadq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epnldd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eleliepj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lmmfnb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ogmkne32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmhhae32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgbibb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbdmljln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hbofmcij.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klmbjh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fcilnl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbgplq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kfjfik32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jeblgodb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Floeof32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Egkgad32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flmecm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Appbcn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhkghqpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chbihc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Maocekoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhekodik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmegkd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eldbkbop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dpaqmnap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmaqgaae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Njipabhe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epgoio32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfabnl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lmbabj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfalaj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kghkppbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmljnfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hojqjp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Faedpdcc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hoipnl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lckflc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Papkcd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iagchmjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebmjihqn.exe -
Modifies registry class 64 IoCs
Processes:
Koflgf32.exeNaionh32.exeHnnkbd32.exeJhfljm32.exeKlbdiokf.exeEagbnh32.exeOhqbbi32.exeDjocbqpb.exeFnmmidhm.exeHhlcal32.exeKgjgepqm.exeOefjdgjk.exeFcichb32.exeKmnlhg32.exeCpgglifo.exeHminbkql.exeIejkhlip.exeLmeebpkd.exeOfpmegpe.exePmjaadjm.exeEepmlf32.exeAlofnj32.exeJfhmehji.exeIhlpqonl.exeHadcipbi.exeAadobccg.exeKaekljjo.exeCdamao32.exeGmipko32.exeCdfief32.exeHccfoehi.exeKalipcmb.exeNqpdcc32.exeCncolfcl.exeAnhdmh32.exeGnmdfi32.exePdppqbkn.exeBfabnl32.exeAppbcn32.exeIhcfan32.exeBggjjlnb.exePmabmf32.exeFdlqjf32.exeGajqbakc.exeEbnmpemq.exeMfceom32.exeOgbgbn32.exeAoagccfn.exeAgpeaa32.exeCmdaeo32.exeEeceim32.exeNljcflbd.exeAqddcdbo.exeCpgieb32.exeIagchmjn.exeJeblgodb.exeGllabp32.exeHkdemk32.exeJkllnn32.exeJbjcaf32.exeJgpbfh32.exeLncjhd32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Koflgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Naionh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcbbjffh.dll" Hnnkbd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jhfljm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aopdeh32.dll" Klbdiokf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Eagbnh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ohqbbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhcool32.dll" Djocbqpb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fnmmidhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gobecg32.dll" Hhlcal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kgjgepqm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oefjdgjk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fcichb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kmnlhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipghcl32.dll" Cpgglifo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hminbkql.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Iejkhlip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lmeebpkd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ofpmegpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geeqlobc.dll" Pmjaadjm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fakmpf32.dll" Eepmlf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipippm32.dll" Alofnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jfhmehji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eoldfbid.dll" Ihlpqonl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hadcipbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aadobccg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjhjgq32.dll" Kaekljjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elnlcjph.dll" Cdamao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbgmbfej.dll" Gmipko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kalgdehn.dll" Cdfief32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hccfoehi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffinab32.dll" Ofpmegpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idneibad.dll" Kalipcmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpgpfmbb.dll" Nqpdcc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cncolfcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kmnlhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Anhdmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gnmdfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkkiehdc.dll" Pdppqbkn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bfabnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnpgnoqb.dll" Appbcn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ihcfan32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bggjjlnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgimkf32.dll" Pmabmf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fdlqjf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gajqbakc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ebnmpemq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mfceom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lncacf32.dll" Ogbgbn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfikmo32.dll" Aoagccfn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Agpeaa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cmdaeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Eeceim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nljcflbd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aqddcdbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldpllj32.dll" Cpgieb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Iagchmjn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egcpbc32.dll" Jeblgodb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfbgen32.dll" Gllabp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hkdemk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jkllnn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jbjcaf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jgpbfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbocnbmi.dll" Lncjhd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
58966d67b95ed518bfbfeb8b30ac7b89c2dfee39e6bf513809543f0fe1e2c94cN.exeAfffenbp.exeAlqnah32.exeAoagccfn.exeBjbndpmd.exeCfkloq32.exeCkmnbg32.exeCjakccop.exeDpcmgi32.exeDpeiligo.exeEegkpo32.exeEopphehb.exeEcfnmh32.exeFpjofl32.exeFleifl32.exeFdqnkoep.exedescription pid process target process PID 2108 wrote to memory of 1116 2108 58966d67b95ed518bfbfeb8b30ac7b89c2dfee39e6bf513809543f0fe1e2c94cN.exe Afffenbp.exe PID 2108 wrote to memory of 1116 2108 58966d67b95ed518bfbfeb8b30ac7b89c2dfee39e6bf513809543f0fe1e2c94cN.exe Afffenbp.exe PID 2108 wrote to memory of 1116 2108 58966d67b95ed518bfbfeb8b30ac7b89c2dfee39e6bf513809543f0fe1e2c94cN.exe Afffenbp.exe PID 2108 wrote to memory of 1116 2108 58966d67b95ed518bfbfeb8b30ac7b89c2dfee39e6bf513809543f0fe1e2c94cN.exe Afffenbp.exe PID 1116 wrote to memory of 2440 1116 Afffenbp.exe Alqnah32.exe PID 1116 wrote to memory of 2440 1116 Afffenbp.exe Alqnah32.exe PID 1116 wrote to memory of 2440 1116 Afffenbp.exe Alqnah32.exe PID 1116 wrote to memory of 2440 1116 Afffenbp.exe Alqnah32.exe PID 2440 wrote to memory of 2768 2440 Alqnah32.exe Aoagccfn.exe PID 2440 wrote to memory of 2768 2440 Alqnah32.exe Aoagccfn.exe PID 2440 wrote to memory of 2768 2440 Alqnah32.exe Aoagccfn.exe PID 2440 wrote to memory of 2768 2440 Alqnah32.exe Aoagccfn.exe PID 2768 wrote to memory of 2192 2768 Aoagccfn.exe Bjbndpmd.exe PID 2768 wrote to memory of 2192 2768 Aoagccfn.exe Bjbndpmd.exe PID 2768 wrote to memory of 2192 2768 Aoagccfn.exe Bjbndpmd.exe PID 2768 wrote to memory of 2192 2768 Aoagccfn.exe Bjbndpmd.exe PID 2192 wrote to memory of 3012 2192 Bjbndpmd.exe Cfkloq32.exe PID 2192 wrote to memory of 3012 2192 Bjbndpmd.exe Cfkloq32.exe PID 2192 wrote to memory of 3012 2192 Bjbndpmd.exe Cfkloq32.exe PID 2192 wrote to memory of 3012 2192 Bjbndpmd.exe Cfkloq32.exe PID 3012 wrote to memory of 2640 3012 Cfkloq32.exe Ckmnbg32.exe PID 3012 wrote to memory of 2640 3012 Cfkloq32.exe Ckmnbg32.exe PID 3012 wrote to memory of 2640 3012 Cfkloq32.exe Ckmnbg32.exe PID 3012 wrote to memory of 2640 3012 Cfkloq32.exe Ckmnbg32.exe PID 2640 wrote to memory of 2576 2640 Ckmnbg32.exe Cjakccop.exe PID 2640 wrote to memory of 2576 2640 Ckmnbg32.exe Cjakccop.exe PID 2640 wrote to memory of 2576 2640 Ckmnbg32.exe Cjakccop.exe PID 2640 wrote to memory of 2576 2640 Ckmnbg32.exe Cjakccop.exe PID 2576 wrote to memory of 2844 2576 Cjakccop.exe Dpcmgi32.exe PID 2576 wrote to memory of 2844 2576 Cjakccop.exe Dpcmgi32.exe PID 2576 wrote to memory of 2844 2576 Cjakccop.exe Dpcmgi32.exe PID 2576 wrote to memory of 2844 2576 Cjakccop.exe Dpcmgi32.exe PID 2844 wrote to memory of 832 2844 Dpcmgi32.exe Dpeiligo.exe PID 2844 wrote to memory of 832 2844 Dpcmgi32.exe Dpeiligo.exe PID 2844 wrote to memory of 832 2844 Dpcmgi32.exe Dpeiligo.exe PID 2844 wrote to memory of 832 2844 Dpcmgi32.exe Dpeiligo.exe PID 832 wrote to memory of 740 832 Dpeiligo.exe Eegkpo32.exe PID 832 wrote to memory of 740 832 Dpeiligo.exe Eegkpo32.exe PID 832 wrote to memory of 740 832 Dpeiligo.exe Eegkpo32.exe PID 832 wrote to memory of 740 832 Dpeiligo.exe Eegkpo32.exe PID 740 wrote to memory of 1464 740 Eegkpo32.exe Eopphehb.exe PID 740 wrote to memory of 1464 740 Eegkpo32.exe Eopphehb.exe PID 740 wrote to memory of 1464 740 Eegkpo32.exe Eopphehb.exe PID 740 wrote to memory of 1464 740 Eegkpo32.exe Eopphehb.exe PID 1464 wrote to memory of 1752 1464 Eopphehb.exe Ecfnmh32.exe PID 1464 wrote to memory of 1752 1464 Eopphehb.exe Ecfnmh32.exe PID 1464 wrote to memory of 1752 1464 Eopphehb.exe Ecfnmh32.exe PID 1464 wrote to memory of 1752 1464 Eopphehb.exe Ecfnmh32.exe PID 1752 wrote to memory of 940 1752 Ecfnmh32.exe Fpjofl32.exe PID 1752 wrote to memory of 940 1752 Ecfnmh32.exe Fpjofl32.exe PID 1752 wrote to memory of 940 1752 Ecfnmh32.exe Fpjofl32.exe PID 1752 wrote to memory of 940 1752 Ecfnmh32.exe Fpjofl32.exe PID 940 wrote to memory of 2028 940 Fpjofl32.exe Fleifl32.exe PID 940 wrote to memory of 2028 940 Fpjofl32.exe Fleifl32.exe PID 940 wrote to memory of 2028 940 Fpjofl32.exe Fleifl32.exe PID 940 wrote to memory of 2028 940 Fpjofl32.exe Fleifl32.exe PID 2028 wrote to memory of 1520 2028 Fleifl32.exe Fdqnkoep.exe PID 2028 wrote to memory of 1520 2028 Fleifl32.exe Fdqnkoep.exe PID 2028 wrote to memory of 1520 2028 Fleifl32.exe Fdqnkoep.exe PID 2028 wrote to memory of 1520 2028 Fleifl32.exe Fdqnkoep.exe PID 1520 wrote to memory of 1800 1520 Fdqnkoep.exe Ghofam32.exe PID 1520 wrote to memory of 1800 1520 Fdqnkoep.exe Ghofam32.exe PID 1520 wrote to memory of 1800 1520 Fdqnkoep.exe Ghofam32.exe PID 1520 wrote to memory of 1800 1520 Fdqnkoep.exe Ghofam32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58966d67b95ed518bfbfeb8b30ac7b89c2dfee39e6bf513809543f0fe1e2c94cN.exe"C:\Users\Admin\AppData\Local\Temp\58966d67b95ed518bfbfeb8b30ac7b89c2dfee39e6bf513809543f0fe1e2c94cN.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\Afffenbp.exeC:\Windows\system32\Afffenbp.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\Alqnah32.exeC:\Windows\system32\Alqnah32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\Aoagccfn.exeC:\Windows\system32\Aoagccfn.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\Bjbndpmd.exeC:\Windows\system32\Bjbndpmd.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\Cfkloq32.exeC:\Windows\system32\Cfkloq32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\Ckmnbg32.exeC:\Windows\system32\Ckmnbg32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\Cjakccop.exeC:\Windows\system32\Cjakccop.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\Dpcmgi32.exeC:\Windows\system32\Dpcmgi32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\Dpeiligo.exeC:\Windows\system32\Dpeiligo.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\Eegkpo32.exeC:\Windows\system32\Eegkpo32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\Eopphehb.exeC:\Windows\system32\Eopphehb.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\Ecfnmh32.exeC:\Windows\system32\Ecfnmh32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\Fpjofl32.exeC:\Windows\system32\Fpjofl32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\Fleifl32.exeC:\Windows\system32\Fleifl32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\Fdqnkoep.exeC:\Windows\system32\Fdqnkoep.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\Ghofam32.exeC:\Windows\system32\Ghofam32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Windows\SysWOW64\Gcmamj32.exeC:\Windows\system32\Gcmamj32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:968 -
C:\Windows\SysWOW64\Ghlfjq32.exeC:\Windows\system32\Ghlfjq32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Windows\SysWOW64\Hfpfdeon.exeC:\Windows\system32\Hfpfdeon.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Windows\SysWOW64\Hfepod32.exeC:\Windows\system32\Hfepod32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Windows\SysWOW64\Hkahgk32.exeC:\Windows\system32\Hkahgk32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1660 -
C:\Windows\SysWOW64\Hkdemk32.exeC:\Windows\system32\Hkdemk32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2428 -
C:\Windows\SysWOW64\Indnnfdn.exeC:\Windows\system32\Indnnfdn.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:568 -
C:\Windows\SysWOW64\Iphgln32.exeC:\Windows\system32\Iphgln32.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Windows\SysWOW64\Iejiodbl.exeC:\Windows\system32\Iejiodbl.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Windows\SysWOW64\Jndjmifj.exeC:\Windows\system32\Jndjmifj.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Windows\SysWOW64\Jlhkgm32.exeC:\Windows\system32\Jlhkgm32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Windows\SysWOW64\Jjpdmi32.exeC:\Windows\system32\Jjpdmi32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2940 -
C:\Windows\SysWOW64\Jhdegn32.exeC:\Windows\system32\Jhdegn32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1192 -
C:\Windows\SysWOW64\Kalipcmb.exeC:\Windows\system32\Kalipcmb.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2920 -
C:\Windows\SysWOW64\Klfjpa32.exeC:\Windows\system32\Klfjpa32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Windows\SysWOW64\Kijkje32.exeC:\Windows\system32\Kijkje32.exe33⤵
- Executes dropped EXE
PID:2104 -
C:\Windows\SysWOW64\Kpfplo32.exeC:\Windows\system32\Kpfplo32.exe34⤵
- Executes dropped EXE
PID:2688 -
C:\Windows\SysWOW64\Khadpa32.exeC:\Windows\system32\Khadpa32.exe35⤵
- Executes dropped EXE
PID:2836 -
C:\Windows\SysWOW64\Lkbmbl32.exeC:\Windows\system32\Lkbmbl32.exe36⤵
- Executes dropped EXE
PID:2972 -
C:\Windows\SysWOW64\Lopfhk32.exeC:\Windows\system32\Lopfhk32.exe37⤵
- Executes dropped EXE
PID:1152 -
C:\Windows\SysWOW64\Ljigih32.exeC:\Windows\system32\Ljigih32.exe38⤵
- Executes dropped EXE
PID:1892 -
C:\Windows\SysWOW64\Lgpdglhn.exeC:\Windows\system32\Lgpdglhn.exe39⤵
- Executes dropped EXE
PID:2024 -
C:\Windows\SysWOW64\Mphiqbon.exeC:\Windows\system32\Mphiqbon.exe40⤵
- Executes dropped EXE
PID:2084 -
C:\Windows\SysWOW64\Momfan32.exeC:\Windows\system32\Momfan32.exe41⤵
- Executes dropped EXE
PID:1172 -
C:\Windows\SysWOW64\Mlafkb32.exeC:\Windows\system32\Mlafkb32.exe42⤵
- Executes dropped EXE
PID:1268 -
C:\Windows\SysWOW64\Mmccqbpm.exeC:\Windows\system32\Mmccqbpm.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:972 -
C:\Windows\SysWOW64\Mdogedmh.exeC:\Windows\system32\Mdogedmh.exe44⤵
- Executes dropped EXE
PID:1716 -
C:\Windows\SysWOW64\Mdadjd32.exeC:\Windows\system32\Mdadjd32.exe45⤵
- Executes dropped EXE
PID:828 -
C:\Windows\SysWOW64\Ncfalqpm.exeC:\Windows\system32\Ncfalqpm.exe46⤵
- Executes dropped EXE
PID:1816 -
C:\Windows\SysWOW64\Nqjaeeog.exeC:\Windows\system32\Nqjaeeog.exe47⤵
- Executes dropped EXE
PID:2264 -
C:\Windows\SysWOW64\Nmabjfek.exeC:\Windows\system32\Nmabjfek.exe48⤵
- Executes dropped EXE
PID:2596 -
C:\Windows\SysWOW64\Nmcopebh.exeC:\Windows\system32\Nmcopebh.exe49⤵
- Executes dropped EXE
PID:1408 -
C:\Windows\SysWOW64\Njgpij32.exeC:\Windows\system32\Njgpij32.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1592 -
C:\Windows\SysWOW64\Nmflee32.exeC:\Windows\system32\Nmflee32.exe51⤵
- Executes dropped EXE
PID:2532 -
C:\Windows\SysWOW64\Ofnpnkgf.exeC:\Windows\system32\Ofnpnkgf.exe52⤵
- Executes dropped EXE
PID:868 -
C:\Windows\SysWOW64\Oecmogln.exeC:\Windows\system32\Oecmogln.exe53⤵
- Executes dropped EXE
PID:2468 -
C:\Windows\SysWOW64\Oefjdgjk.exeC:\Windows\system32\Oefjdgjk.exe54⤵
- Executes dropped EXE
- Modifies registry class
PID:2756 -
C:\Windows\SysWOW64\Oehgjfhi.exeC:\Windows\system32\Oehgjfhi.exe55⤵
- Executes dropped EXE
PID:2464 -
C:\Windows\SysWOW64\Omckoi32.exeC:\Windows\system32\Omckoi32.exe56⤵
- Executes dropped EXE
PID:2828 -
C:\Windows\SysWOW64\Oflpgnld.exeC:\Windows\system32\Oflpgnld.exe57⤵
- Executes dropped EXE
PID:2840 -
C:\Windows\SysWOW64\Pdppqbkn.exeC:\Windows\system32\Pdppqbkn.exe58⤵
- Executes dropped EXE
- Modifies registry class
PID:2516 -
C:\Windows\SysWOW64\Pfpibn32.exeC:\Windows\system32\Pfpibn32.exe59⤵
- Executes dropped EXE
PID:1888 -
C:\Windows\SysWOW64\Ppinkcnp.exeC:\Windows\system32\Ppinkcnp.exe60⤵
- Executes dropped EXE
PID:2396 -
C:\Windows\SysWOW64\Peefcjlg.exeC:\Windows\system32\Peefcjlg.exe61⤵
- Executes dropped EXE
PID:2564 -
C:\Windows\SysWOW64\Pbigmn32.exeC:\Windows\system32\Pbigmn32.exe62⤵
- Executes dropped EXE
PID:2096 -
C:\Windows\SysWOW64\Phfoee32.exeC:\Windows\system32\Phfoee32.exe63⤵
- Executes dropped EXE
PID:1480 -
C:\Windows\SysWOW64\Qejpoi32.exeC:\Windows\system32\Qejpoi32.exe64⤵
- Executes dropped EXE
PID:2864 -
C:\Windows\SysWOW64\Qemldifo.exeC:\Windows\system32\Qemldifo.exe65⤵
- Executes dropped EXE
PID:1056 -
C:\Windows\SysWOW64\Qoeamo32.exeC:\Windows\system32\Qoeamo32.exe66⤵PID:1828
-
C:\Windows\SysWOW64\Agpeaa32.exeC:\Windows\system32\Agpeaa32.exe67⤵
- Modifies registry class
PID:1528 -
C:\Windows\SysWOW64\Aphjjf32.exeC:\Windows\system32\Aphjjf32.exe68⤵PID:1668
-
C:\Windows\SysWOW64\Adfbpega.exeC:\Windows\system32\Adfbpega.exe69⤵PID:1600
-
C:\Windows\SysWOW64\Akpkmo32.exeC:\Windows\system32\Akpkmo32.exe70⤵PID:3032
-
C:\Windows\SysWOW64\Adipfd32.exeC:\Windows\system32\Adipfd32.exe71⤵PID:2936
-
C:\Windows\SysWOW64\Agglbp32.exeC:\Windows\system32\Agglbp32.exe72⤵PID:3040
-
C:\Windows\SysWOW64\Ajehnk32.exeC:\Windows\system32\Ajehnk32.exe73⤵PID:2908
-
C:\Windows\SysWOW64\Bfabnl32.exeC:\Windows\system32\Bfabnl32.exe74⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2664 -
C:\Windows\SysWOW64\Bkpglbaj.exeC:\Windows\system32\Bkpglbaj.exe75⤵PID:1692
-
C:\Windows\SysWOW64\Bkbdabog.exeC:\Windows\system32\Bkbdabog.exe76⤵PID:2992
-
C:\Windows\SysWOW64\Bbllnlfd.exeC:\Windows\system32\Bbllnlfd.exe77⤵PID:2820
-
C:\Windows\SysWOW64\Cjhabndo.exeC:\Windows\system32\Cjhabndo.exe78⤵PID:2660
-
C:\Windows\SysWOW64\Cglalbbi.exeC:\Windows\system32\Cglalbbi.exe79⤵PID:1504
-
C:\Windows\SysWOW64\Cqdfehii.exeC:\Windows\system32\Cqdfehii.exe80⤵PID:3052
-
C:\Windows\SysWOW64\Cfanmogq.exeC:\Windows\system32\Cfanmogq.exe81⤵PID:1812
-
C:\Windows\SysWOW64\Coicfd32.exeC:\Windows\system32\Coicfd32.exe82⤵PID:2424
-
C:\Windows\SysWOW64\Cmmcpi32.exeC:\Windows\system32\Cmmcpi32.exe83⤵PID:1724
-
C:\Windows\SysWOW64\Cbjlhpkb.exeC:\Windows\system32\Cbjlhpkb.exe84⤵PID:1412
-
C:\Windows\SysWOW64\Dpnladjl.exeC:\Windows\system32\Dpnladjl.exe85⤵PID:880
-
C:\Windows\SysWOW64\Difqji32.exeC:\Windows\system32\Difqji32.exe86⤵PID:1620
-
C:\Windows\SysWOW64\Dncibp32.exeC:\Windows\system32\Dncibp32.exe87⤵PID:2724
-
C:\Windows\SysWOW64\Dlgjldnm.exeC:\Windows\system32\Dlgjldnm.exe88⤵PID:3024
-
C:\Windows\SysWOW64\Dcbnpgkh.exeC:\Windows\system32\Dcbnpgkh.exe89⤵PID:2692
-
C:\Windows\SysWOW64\Dcdkef32.exeC:\Windows\system32\Dcdkef32.exe90⤵PID:1616
-
C:\Windows\SysWOW64\Djocbqpb.exeC:\Windows\system32\Djocbqpb.exe91⤵
- Modifies registry class
PID:1936 -
C:\Windows\SysWOW64\Dcghkf32.exeC:\Windows\system32\Dcghkf32.exe92⤵PID:1932
-
C:\Windows\SysWOW64\Emoldlmc.exeC:\Windows\system32\Emoldlmc.exe93⤵PID:2168
-
C:\Windows\SysWOW64\Eblelb32.exeC:\Windows\system32\Eblelb32.exe94⤵
- Drops file in System32 directory
PID:2392 -
C:\Windows\SysWOW64\Emaijk32.exeC:\Windows\system32\Emaijk32.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3060 -
C:\Windows\SysWOW64\Eihjolae.exeC:\Windows\system32\Eihjolae.exe96⤵PID:2592
-
C:\Windows\SysWOW64\Ebqngb32.exeC:\Windows\system32\Ebqngb32.exe97⤵PID:572
-
C:\Windows\SysWOW64\Epeoaffo.exeC:\Windows\system32\Epeoaffo.exe98⤵PID:2372
-
C:\Windows\SysWOW64\Eknpadcn.exeC:\Windows\system32\Eknpadcn.exe99⤵PID:2336
-
C:\Windows\SysWOW64\Feddombd.exeC:\Windows\system32\Feddombd.exe100⤵PID:1720
-
C:\Windows\SysWOW64\Folhgbid.exeC:\Windows\system32\Folhgbid.exe101⤵PID:2900
-
C:\Windows\SysWOW64\Fefqdl32.exeC:\Windows\system32\Fefqdl32.exe102⤵PID:2140
-
C:\Windows\SysWOW64\Fdkmeiei.exeC:\Windows\system32\Fdkmeiei.exe103⤵PID:320
-
C:\Windows\SysWOW64\Fpbnjjkm.exeC:\Windows\system32\Fpbnjjkm.exe104⤵PID:2804
-
C:\Windows\SysWOW64\Fliook32.exeC:\Windows\system32\Fliook32.exe105⤵PID:800
-
C:\Windows\SysWOW64\Fimoiopk.exeC:\Windows\system32\Fimoiopk.exe106⤵PID:2884
-
C:\Windows\SysWOW64\Gpggei32.exeC:\Windows\system32\Gpggei32.exe107⤵PID:1332
-
C:\Windows\SysWOW64\Ggapbcne.exeC:\Windows\system32\Ggapbcne.exe108⤵PID:1164
-
C:\Windows\SysWOW64\Gajqbakc.exeC:\Windows\system32\Gajqbakc.exe109⤵
- Modifies registry class
PID:1148 -
C:\Windows\SysWOW64\Ghdiokbq.exeC:\Windows\system32\Ghdiokbq.exe110⤵PID:2704
-
C:\Windows\SysWOW64\Gonale32.exeC:\Windows\system32\Gonale32.exe111⤵PID:2500
-
C:\Windows\SysWOW64\Gehiioaj.exeC:\Windows\system32\Gehiioaj.exe112⤵PID:2456
-
C:\Windows\SysWOW64\Gekfnoog.exeC:\Windows\system32\Gekfnoog.exe113⤵PID:2812
-
C:\Windows\SysWOW64\Gkgoff32.exeC:\Windows\system32\Gkgoff32.exe114⤵PID:2912
-
C:\Windows\SysWOW64\Hhkopj32.exeC:\Windows\system32\Hhkopj32.exe115⤵PID:3016
-
C:\Windows\SysWOW64\Hadcipbi.exeC:\Windows\system32\Hadcipbi.exe116⤵
- Modifies registry class
PID:1984 -
C:\Windows\SysWOW64\Hgqlafap.exeC:\Windows\system32\Hgqlafap.exe117⤵PID:1288
-
C:\Windows\SysWOW64\Hcgmfgfd.exeC:\Windows\system32\Hcgmfgfd.exe118⤵
- Drops file in System32 directory
PID:3004 -
C:\Windows\SysWOW64\Hmpaom32.exeC:\Windows\system32\Hmpaom32.exe119⤵PID:2420
-
C:\Windows\SysWOW64\Hjcaha32.exeC:\Windows\system32\Hjcaha32.exe120⤵PID:2092
-
C:\Windows\SysWOW64\Hqnjek32.exeC:\Windows\system32\Hqnjek32.exe121⤵
- System Location Discovery: System Language Discovery
PID:2180 -
C:\Windows\SysWOW64\Hbofmcij.exeC:\Windows\system32\Hbofmcij.exe122⤵
- System Location Discovery: System Language Discovery
PID:1708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-