Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 07:46
Static task
static1
Behavioral task
behavioral1
Sample
05d32837b99cdfd59bad0155a66adc3d1bc6307d415084d6b222c624343aeceb.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
05d32837b99cdfd59bad0155a66adc3d1bc6307d415084d6b222c624343aeceb.exe
Resource
win10v2004-20241007-en
General
-
Target
05d32837b99cdfd59bad0155a66adc3d1bc6307d415084d6b222c624343aeceb.exe
-
Size
92KB
-
MD5
33f0571f0692e3f9f825af33e7a31910
-
SHA1
d2e735788b6e904c7f0514f3792c045b4e5c1400
-
SHA256
05d32837b99cdfd59bad0155a66adc3d1bc6307d415084d6b222c624343aeceb
-
SHA512
7d17ef47cd70481dfefa5d2fad670436ded744bfa5b8681c5f031d36c68e3ab8679ced298a89d2d6256c9d763a6315a4963896b8ca06151c747b9a6093d96c33
-
SSDEEP
1536:i8K/kw6d8JM4lFplblzFw/wr2dG+eo1xC0GZFXUmSC2e3l+:i8kkXWptw/wr24ho1mtye3l+
Malware Config
Extracted
berbew
http://tat-neftbank.ru/kkq.php
http://tat-neftbank.ru/wcmd.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Eiheok32.exeJihgdd32.exeFeeilbhg.exeMahgejhf.exeGmkjjbhg.exeQfdnnlbc.exeQpjchicb.exeJdklcebk.exeBqffna32.exeHobcok32.exeAqapek32.exeCdbqflae.exeLdgpea32.exeFnifbaja.exeGiolpo32.exeDabicikf.exeAhpdficc.exeIaknmm32.exeQbggqfca.exeBgjknijp.exeGnahoh32.exeJncenh32.exeMcghcgfb.exeHmbdlc32.exeNhookh32.exeNkhkbmco.exeDjhnmj32.exeAcdcdm32.exeAodqok32.exeHgpeimhf.exeBjlpjp32.exeIglngj32.exeMajfcb32.exeNogmkk32.exeGqkqbe32.exeNqamaeii.exeMakhlkel.exeGcpfbhof.exePolbemck.exeIccqedfa.exeBigbmb32.exeHbjjfl32.exeMkelcenm.exeLllkaobc.exeAiegpg32.exeMddidnqa.exeGepgni32.exeHojeka32.exeMpmpeiqg.exeBbbckh32.exeLiddljan.exeAcbieing.exeOkgnna32.exeEjbhno32.exeNanlla32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eiheok32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jihgdd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Feeilbhg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mahgejhf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmkjjbhg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qfdnnlbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qpjchicb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdklcebk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bqffna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hobcok32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aqapek32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdbqflae.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldgpea32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fnifbaja.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Giolpo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dabicikf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ahpdficc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iaknmm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qbggqfca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bgjknijp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gnahoh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jncenh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mcghcgfb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmbdlc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nhookh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nkhkbmco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Djhnmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Acdcdm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aodqok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hgpeimhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bjlpjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iglngj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Majfcb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nogmkk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gqkqbe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nqamaeii.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Makhlkel.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gcpfbhof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Polbemck.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iccqedfa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bigbmb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hbjjfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkelcenm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lllkaobc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aiegpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mddidnqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gepgni32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hojeka32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mpmpeiqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bbbckh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Liddljan.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Acbieing.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Okgnna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ejbhno32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nanlla32.exe -
Berbew family
-
Executes dropped EXE 64 IoCs
Processes:
Ooeolkff.exeOepghe32.exeOlioeoeo.exeOebdndlp.exeOllljo32.exePamnnemo.exePpbkoabf.exePpegdapd.exePgamgken.exePolakmbi.exeQamjmh32.exeAoakfl32.exeAbachg32.exeAdbmjbif.exeAchikonn.exeAonjpp32.exeBclcfnih.exeBmegodpi.exeBnhqll32.exeBgqeea32.exeBbfibj32.exeBjanfl32.exeCakfcfoc.exeCjdkllec.exeCancif32.exeCpcpjbah.exeCabldeik.exeCjkamk32.exeCbfeam32.exeDegobhjg.exeDlcceboa.exeDekhnh32.exeDabicikf.exeDdcadd32.exeEgdjfo32.exeEcjkkp32.exeEoalpaaa.exeEhjqif32.exeEabeal32.exeEkjikadb.exeFkmfpabp.exeFdlqjf32.exeGcankb32.exeGfbfln32.exeGbigao32.exeGnphfppi.exeGghloe32.exeHelmiiec.exeHndaao32.exeHenjnica.exeHngngo32.exeHgobpd32.exeHaggijgb.exeHfdpaqej.exeHiblmldn.exeHiehbl32.exeIpoqofjh.exeIeligmho.exeIpameehe.exeIijbnkne.exeIpcjje32.exeIaegbmlq.exeIniglajj.exeIhaldgak.exepid process 2488 Ooeolkff.exe 2956 Oepghe32.exe 2940 Olioeoeo.exe 2440 Oebdndlp.exe 2728 Ollljo32.exe 2608 Pamnnemo.exe 2672 Ppbkoabf.exe 2348 Ppegdapd.exe 2240 Pgamgken.exe 2192 Polakmbi.exe 2416 Qamjmh32.exe 3028 Aoakfl32.exe 1756 Abachg32.exe 2064 Adbmjbif.exe 2180 Achikonn.exe 516 Aonjpp32.exe 2680 Bclcfnih.exe 948 Bmegodpi.exe 2700 Bnhqll32.exe 756 Bgqeea32.exe 2024 Bbfibj32.exe 1248 Bjanfl32.exe 320 Cakfcfoc.exe 944 Cjdkllec.exe 2564 Cancif32.exe 2012 Cpcpjbah.exe 2504 Cabldeik.exe 2880 Cjkamk32.exe 1708 Cbfeam32.exe 2900 Degobhjg.exe 2760 Dlcceboa.exe 2756 Dekhnh32.exe 2592 Dabicikf.exe 1724 Ddcadd32.exe 1748 Egdjfo32.exe 2172 Ecjkkp32.exe 2160 Eoalpaaa.exe 2500 Ehjqif32.exe 2664 Eabeal32.exe 1848 Ekjikadb.exe 2352 Fkmfpabp.exe 2120 Fdlqjf32.exe 2076 Gcankb32.exe 1796 Gfbfln32.exe 1980 Gbigao32.exe 2324 Gnphfppi.exe 2196 Gghloe32.exe 1656 Helmiiec.exe 1480 Hndaao32.exe 1924 Henjnica.exe 872 Hngngo32.exe 2916 Hgobpd32.exe 2992 Haggijgb.exe 2616 Hfdpaqej.exe 2876 Hiblmldn.exe 2780 Hiehbl32.exe 288 Ipoqofjh.exe 1332 Ieligmho.exe 2552 Ipameehe.exe 2604 Iijbnkne.exe 2648 Ipcjje32.exe 1616 Iaegbmlq.exe 2676 Iniglajj.exe 2108 Ihaldgak.exe -
Loads dropped DLL 64 IoCs
Processes:
05d32837b99cdfd59bad0155a66adc3d1bc6307d415084d6b222c624343aeceb.exeOoeolkff.exeOepghe32.exeOlioeoeo.exeOebdndlp.exeOllljo32.exePamnnemo.exePpbkoabf.exePpegdapd.exePgamgken.exePolakmbi.exeQamjmh32.exeAoakfl32.exeAbachg32.exeAdbmjbif.exeAchikonn.exeAonjpp32.exeBclcfnih.exeBmegodpi.exeBnhqll32.exeBgqeea32.exeBbfibj32.exeBjanfl32.exeCakfcfoc.exeCjdkllec.exeCancif32.exeCpcpjbah.exeCabldeik.exeCjkamk32.exeCbfeam32.exeDegobhjg.exeDlcceboa.exepid process 1820 05d32837b99cdfd59bad0155a66adc3d1bc6307d415084d6b222c624343aeceb.exe 1820 05d32837b99cdfd59bad0155a66adc3d1bc6307d415084d6b222c624343aeceb.exe 2488 Ooeolkff.exe 2488 Ooeolkff.exe 2956 Oepghe32.exe 2956 Oepghe32.exe 2940 Olioeoeo.exe 2940 Olioeoeo.exe 2440 Oebdndlp.exe 2440 Oebdndlp.exe 2728 Ollljo32.exe 2728 Ollljo32.exe 2608 Pamnnemo.exe 2608 Pamnnemo.exe 2672 Ppbkoabf.exe 2672 Ppbkoabf.exe 2348 Ppegdapd.exe 2348 Ppegdapd.exe 2240 Pgamgken.exe 2240 Pgamgken.exe 2192 Polakmbi.exe 2192 Polakmbi.exe 2416 Qamjmh32.exe 2416 Qamjmh32.exe 3028 Aoakfl32.exe 3028 Aoakfl32.exe 1756 Abachg32.exe 1756 Abachg32.exe 2064 Adbmjbif.exe 2064 Adbmjbif.exe 2180 Achikonn.exe 2180 Achikonn.exe 516 Aonjpp32.exe 516 Aonjpp32.exe 2680 Bclcfnih.exe 2680 Bclcfnih.exe 948 Bmegodpi.exe 948 Bmegodpi.exe 2700 Bnhqll32.exe 2700 Bnhqll32.exe 756 Bgqeea32.exe 756 Bgqeea32.exe 2024 Bbfibj32.exe 2024 Bbfibj32.exe 1248 Bjanfl32.exe 1248 Bjanfl32.exe 320 Cakfcfoc.exe 320 Cakfcfoc.exe 944 Cjdkllec.exe 944 Cjdkllec.exe 2564 Cancif32.exe 2564 Cancif32.exe 2012 Cpcpjbah.exe 2012 Cpcpjbah.exe 2504 Cabldeik.exe 2504 Cabldeik.exe 2880 Cjkamk32.exe 2880 Cjkamk32.exe 1708 Cbfeam32.exe 1708 Cbfeam32.exe 2900 Degobhjg.exe 2900 Degobhjg.exe 2760 Dlcceboa.exe 2760 Dlcceboa.exe -
Drops file in System32 directory 64 IoCs
Processes:
Iekbmfdc.exeMjofanld.exeOkgnna32.exeNapibq32.exeBdoeipjh.exeGeqnho32.exeMlkegimk.exeBcedbefd.exeNmdfglhm.exeGebiefle.exeJbbpmo32.exeGflcplhh.exeQddmbkoi.exeDlcceboa.exeIeligmho.exeKpjlldmg.exeLqdfmihh.exeNagakhfn.exeKlkmkoce.exeCmbiap32.exeCdflhppk.exeCgdggg32.exeGcjogidl.exeCekihh32.exeDnjeoa32.exeQbggqfca.exeFcipaien.exePpbkoabf.exeJdbhcfjd.exeJjocoedg.exeFhfbmn32.exeFmjkbfnh.exeNnndin32.exeJnaihhgf.exeOaonfncb.exeIfkecl32.exeNkkjpf32.exeAkdedkfl.exeGlbcpokl.exeAmdhidqk.exeHiblmldn.exeMnqdpj32.exeDopkai32.exeOoaflp32.exeNnofbg32.exeEbkndibq.exePadcqp32.exeIpbcbkmh.exeBmhncg32.exeBgaljk32.exeGkgbioee.exeGkjahg32.exeHenjnica.exedescription ioc process File created C:\Windows\SysWOW64\Imfgahao.exe Iekbmfdc.exe File created C:\Windows\SysWOW64\Mchjjc32.exe Mjofanld.exe File created C:\Windows\SysWOW64\Ocbbbd32.exe Okgnna32.exe File created C:\Windows\SysWOW64\Nhjaok32.exe Napibq32.exe File opened for modification C:\Windows\SysWOW64\Bfqaph32.exe Bdoeipjh.exe File created C:\Windows\SysWOW64\Poabochn.dll Geqnho32.exe File opened for modification C:\Windows\SysWOW64\Mbadih32.exe File opened for modification C:\Windows\SysWOW64\Nfbogh32.exe File created C:\Windows\SysWOW64\Jiaccj32.dll File created C:\Windows\SysWOW64\Jimcoh32.dll Mlkegimk.exe File created C:\Windows\SysWOW64\Ccgahe32.exe Bcedbefd.exe File created C:\Windows\SysWOW64\Ppanehoa.dll Nmdfglhm.exe File created C:\Windows\SysWOW64\Ccbpjqqq.dll Gebiefle.exe File opened for modification C:\Windows\SysWOW64\Jdpmij32.exe Jbbpmo32.exe File opened for modification C:\Windows\SysWOW64\Gbbdemnl.exe Gflcplhh.exe File created C:\Windows\SysWOW64\Qjaejbmq.exe Qddmbkoi.exe File created C:\Windows\SysWOW64\Fmidimen.exe File created C:\Windows\SysWOW64\Lhmijn32.exe File created C:\Windows\SysWOW64\Ajolkncp.dll Dlcceboa.exe File created C:\Windows\SysWOW64\Megohpba.dll Ieligmho.exe File created C:\Windows\SysWOW64\Kjbqei32.exe Kpjlldmg.exe File opened for modification C:\Windows\SysWOW64\Ljljenoi.exe Lqdfmihh.exe File opened for modification C:\Windows\SysWOW64\Ndnncf32.exe Nmdfglhm.exe File created C:\Windows\SysWOW64\Omnapi32.exe Nagakhfn.exe File opened for modification C:\Windows\SysWOW64\Kahedf32.exe Klkmkoce.exe File created C:\Windows\SysWOW64\Cghmni32.exe Cmbiap32.exe File opened for modification C:\Windows\SysWOW64\Clmdjmpm.exe Cdflhppk.exe File opened for modification C:\Windows\SysWOW64\Cpolli32.exe Cgdggg32.exe File created C:\Windows\SysWOW64\Pgnijemg.dll File created C:\Windows\SysWOW64\Glbcpokl.exe Gcjogidl.exe File created C:\Windows\SysWOW64\Cocnanmd.exe Cekihh32.exe File created C:\Windows\SysWOW64\Nibmdpam.dll Dnjeoa32.exe File created C:\Windows\SysWOW64\Qmlknocg.exe Qbggqfca.exe File opened for modification C:\Windows\SysWOW64\Fjchnclk.exe Fcipaien.exe File created C:\Windows\SysWOW64\Ppegdapd.exe Ppbkoabf.exe File opened for modification C:\Windows\SysWOW64\Jfadoaih.exe Jdbhcfjd.exe File opened for modification C:\Windows\SysWOW64\Jidppaio.exe Jjocoedg.exe File created C:\Windows\SysWOW64\Hcomjk32.dll File opened for modification C:\Windows\SysWOW64\Gkfkoi32.exe Fhfbmn32.exe File opened for modification C:\Windows\SysWOW64\Fgcpkldh.exe Fmjkbfnh.exe File opened for modification C:\Windows\SysWOW64\Nkbdbbop.exe Nnndin32.exe File created C:\Windows\SysWOW64\Facfgahm.dll Jnaihhgf.exe File opened for modification C:\Windows\SysWOW64\Okhboc32.exe Oaonfncb.exe File created C:\Windows\SysWOW64\Idofmp32.exe Ifkecl32.exe File created C:\Windows\SysWOW64\Ndcnik32.exe Nkkjpf32.exe File opened for modification C:\Windows\SysWOW64\Abnmae32.exe Akdedkfl.exe File created C:\Windows\SysWOW64\Fejomjgg.exe File created C:\Windows\SysWOW64\Pfjhlh32.dll Glbcpokl.exe File created C:\Windows\SysWOW64\Aflmbj32.exe Amdhidqk.exe File opened for modification C:\Windows\SysWOW64\Hiehbl32.exe Hiblmldn.exe File created C:\Windows\SysWOW64\Njgeel32.exe Mnqdpj32.exe File opened for modification C:\Windows\SysWOW64\Dfjcncak.exe Dopkai32.exe File created C:\Windows\SysWOW64\Cdodbj32.dll Ooaflp32.exe File created C:\Windows\SysWOW64\Olioiabj.dll Nnofbg32.exe File created C:\Windows\SysWOW64\Elcbmn32.exe Ebkndibq.exe File created C:\Windows\SysWOW64\Mofmeffb.dll Nkkjpf32.exe File opened for modification C:\Windows\SysWOW64\Qddmbkoi.exe Padcqp32.exe File created C:\Windows\SysWOW64\Cpbfbf32.dll Ipbcbkmh.exe File created C:\Windows\SysWOW64\Cmkkhfmn.exe Bmhncg32.exe File created C:\Windows\SysWOW64\Mofpoa32.dll Bgaljk32.exe File opened for modification C:\Windows\SysWOW64\Akgfll32.exe File created C:\Windows\SysWOW64\Gnenfjdh.exe Gkgbioee.exe File created C:\Windows\SysWOW64\Jgmclcjo.dll Gkjahg32.exe File created C:\Windows\SysWOW64\Hngngo32.exe Henjnica.exe -
Program crash 1 IoCs
Processes:
pid pid_target process target process 3796 1160 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Nfcfob32.exeOpfdim32.exeCaijik32.exeLpiqel32.exeJhpbcdqm.exeJgleep32.exeIikgkq32.exeAmidmldj.exeEhjqif32.exeEecgafkj.exeGncblo32.exeJppbkoaf.exeConbmfif.exeGalhhp32.exeEdahca32.exeNdlanf32.exeGhqqpd32.exeAchikonn.exeJnncoini.exeAlicahno.exeBffgbo32.exeOjojmfed.exeKdmehh32.exeAcjjch32.exeOmnapi32.exeHglobj32.exeGghloe32.exeLmolkg32.exeLnejqmie.exeJkqmnh32.exeEpbamc32.exeQiekadkl.exePpbfmdfo.exeQipmdhcj.exeDhfnca32.exeNqamaeii.exeFnkchahn.exeJcmjfiab.exeMggoli32.exeOlhfdl32.exeHljnbo32.exeHiblmldn.exeIniglajj.exeMognco32.exeBcedbefd.exeFhfdffll.exeJfiekc32.exeQgbfen32.exeOafclh32.exeOkbgkk32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nfcfob32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opfdim32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Caijik32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpiqel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jhpbcdqm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgleep32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iikgkq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Amidmldj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ehjqif32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eecgafkj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gncblo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jppbkoaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Conbmfif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Galhhp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edahca32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ndlanf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghqqpd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Achikonn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jnncoini.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Alicahno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bffgbo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojojmfed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kdmehh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Acjjch32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Omnapi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hglobj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gghloe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lmolkg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnejqmie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkqmnh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epbamc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qiekadkl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ppbfmdfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qipmdhcj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhfnca32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nqamaeii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnkchahn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jcmjfiab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mggoli32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Olhfdl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hljnbo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hiblmldn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iniglajj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mognco32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bcedbefd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fhfdffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jfiekc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qgbfen32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oafclh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Okbgkk32.exe -
Modifies registry class 64 IoCs
Processes:
Pddinn32.exeJjjohbgl.exeDaqoafkh.exeBoblbe32.exeJlmddi32.exeDfnjqifb.exeLmolkg32.exeJdklcebk.exeNmdfglhm.exeMognco32.exeEedijo32.exeHafbid32.exeCjlenm32.exeIjcmipjh.exeDafeaapg.exeKahedf32.exeBigbmb32.exeLbdljk32.exeNbgakd32.exeAgchdfmk.exeJcmjfiab.exeOiglfm32.exeKnnagehi.exeIaknmm32.exeIkfokb32.exeAgakog32.exeLldhldpg.exePjgiad32.exeNkbdbbop.exeEhilgikj.exeNogmkk32.exeHnegod32.exeCakfcfoc.exeGhpngkhm.exeJoicje32.exeJifkmh32.exeJnncoini.exeOgcaaahi.exeCpogjh32.exeJjocoedg.exeColgpo32.exeKdmehh32.exeJppbkoaf.exePcjmdd32.exeQjaejbmq.exeKjbqei32.exeIbeeeijg.exePncllifp.exeLkmpcpak.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekaeoj32.dll" Pddinn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Holgpe32.dll" Jjjohbgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Daqoafkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Boblbe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flapqp32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jlmddi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dfnjqifb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lmolkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jdklcebk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nmdfglhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mognco32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eedijo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfnkia32.dll" Hafbid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Faamni32.dll" Cjlenm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Moifmnie.dll" Ijcmipjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofpeil32.dll" Dafeaapg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kahedf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkggdfqa.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bigbmb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lbdljk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nbgakd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajabpehm.dll" Agchdfmk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jcmjfiab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oiglfm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Knnagehi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iaknmm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ikfokb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Agakog32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lldhldpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pjgiad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nkbdbbop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ehilgikj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epgecnoc.dll" Nogmkk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlcipnga.dll" Hnegod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cakfcfoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ghpngkhm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Joicje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpmggm32.dll" Jifkmh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jnncoini.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anklmjnm.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ogcaaahi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmgbmq32.dll" Cpogjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emnpgaai.dll" Jjocoedg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Colgpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknglbbm.dll" Kdmehh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jppbkoaf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pcjmdd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qjaejbmq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kjbqei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gomico32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ibeeeijg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pncllifp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lkmpcpak.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
05d32837b99cdfd59bad0155a66adc3d1bc6307d415084d6b222c624343aeceb.exeOoeolkff.exeOepghe32.exeOlioeoeo.exeOebdndlp.exeOllljo32.exePamnnemo.exePpbkoabf.exePpegdapd.exePgamgken.exePolakmbi.exeQamjmh32.exeAoakfl32.exeAbachg32.exeAdbmjbif.exeAchikonn.exedescription pid process target process PID 1820 wrote to memory of 2488 1820 05d32837b99cdfd59bad0155a66adc3d1bc6307d415084d6b222c624343aeceb.exe Ooeolkff.exe PID 1820 wrote to memory of 2488 1820 05d32837b99cdfd59bad0155a66adc3d1bc6307d415084d6b222c624343aeceb.exe Ooeolkff.exe PID 1820 wrote to memory of 2488 1820 05d32837b99cdfd59bad0155a66adc3d1bc6307d415084d6b222c624343aeceb.exe Ooeolkff.exe PID 1820 wrote to memory of 2488 1820 05d32837b99cdfd59bad0155a66adc3d1bc6307d415084d6b222c624343aeceb.exe Ooeolkff.exe PID 2488 wrote to memory of 2956 2488 Ooeolkff.exe Oepghe32.exe PID 2488 wrote to memory of 2956 2488 Ooeolkff.exe Oepghe32.exe PID 2488 wrote to memory of 2956 2488 Ooeolkff.exe Oepghe32.exe PID 2488 wrote to memory of 2956 2488 Ooeolkff.exe Oepghe32.exe PID 2956 wrote to memory of 2940 2956 Oepghe32.exe Olioeoeo.exe PID 2956 wrote to memory of 2940 2956 Oepghe32.exe Olioeoeo.exe PID 2956 wrote to memory of 2940 2956 Oepghe32.exe Olioeoeo.exe PID 2956 wrote to memory of 2940 2956 Oepghe32.exe Olioeoeo.exe PID 2940 wrote to memory of 2440 2940 Olioeoeo.exe Oebdndlp.exe PID 2940 wrote to memory of 2440 2940 Olioeoeo.exe Oebdndlp.exe PID 2940 wrote to memory of 2440 2940 Olioeoeo.exe Oebdndlp.exe PID 2940 wrote to memory of 2440 2940 Olioeoeo.exe Oebdndlp.exe PID 2440 wrote to memory of 2728 2440 Oebdndlp.exe Ollljo32.exe PID 2440 wrote to memory of 2728 2440 Oebdndlp.exe Ollljo32.exe PID 2440 wrote to memory of 2728 2440 Oebdndlp.exe Ollljo32.exe PID 2440 wrote to memory of 2728 2440 Oebdndlp.exe Ollljo32.exe PID 2728 wrote to memory of 2608 2728 Ollljo32.exe Pamnnemo.exe PID 2728 wrote to memory of 2608 2728 Ollljo32.exe Pamnnemo.exe PID 2728 wrote to memory of 2608 2728 Ollljo32.exe Pamnnemo.exe PID 2728 wrote to memory of 2608 2728 Ollljo32.exe Pamnnemo.exe PID 2608 wrote to memory of 2672 2608 Pamnnemo.exe Ppbkoabf.exe PID 2608 wrote to memory of 2672 2608 Pamnnemo.exe Ppbkoabf.exe PID 2608 wrote to memory of 2672 2608 Pamnnemo.exe Ppbkoabf.exe PID 2608 wrote to memory of 2672 2608 Pamnnemo.exe Ppbkoabf.exe PID 2672 wrote to memory of 2348 2672 Ppbkoabf.exe Ppegdapd.exe PID 2672 wrote to memory of 2348 2672 Ppbkoabf.exe Ppegdapd.exe PID 2672 wrote to memory of 2348 2672 Ppbkoabf.exe Ppegdapd.exe PID 2672 wrote to memory of 2348 2672 Ppbkoabf.exe Ppegdapd.exe PID 2348 wrote to memory of 2240 2348 Ppegdapd.exe Pgamgken.exe PID 2348 wrote to memory of 2240 2348 Ppegdapd.exe Pgamgken.exe PID 2348 wrote to memory of 2240 2348 Ppegdapd.exe Pgamgken.exe PID 2348 wrote to memory of 2240 2348 Ppegdapd.exe Pgamgken.exe PID 2240 wrote to memory of 2192 2240 Pgamgken.exe Polakmbi.exe PID 2240 wrote to memory of 2192 2240 Pgamgken.exe Polakmbi.exe PID 2240 wrote to memory of 2192 2240 Pgamgken.exe Polakmbi.exe PID 2240 wrote to memory of 2192 2240 Pgamgken.exe Polakmbi.exe PID 2192 wrote to memory of 2416 2192 Polakmbi.exe Qamjmh32.exe PID 2192 wrote to memory of 2416 2192 Polakmbi.exe Qamjmh32.exe PID 2192 wrote to memory of 2416 2192 Polakmbi.exe Qamjmh32.exe PID 2192 wrote to memory of 2416 2192 Polakmbi.exe Qamjmh32.exe PID 2416 wrote to memory of 3028 2416 Qamjmh32.exe Aoakfl32.exe PID 2416 wrote to memory of 3028 2416 Qamjmh32.exe Aoakfl32.exe PID 2416 wrote to memory of 3028 2416 Qamjmh32.exe Aoakfl32.exe PID 2416 wrote to memory of 3028 2416 Qamjmh32.exe Aoakfl32.exe PID 3028 wrote to memory of 1756 3028 Aoakfl32.exe Abachg32.exe PID 3028 wrote to memory of 1756 3028 Aoakfl32.exe Abachg32.exe PID 3028 wrote to memory of 1756 3028 Aoakfl32.exe Abachg32.exe PID 3028 wrote to memory of 1756 3028 Aoakfl32.exe Abachg32.exe PID 1756 wrote to memory of 2064 1756 Abachg32.exe Adbmjbif.exe PID 1756 wrote to memory of 2064 1756 Abachg32.exe Adbmjbif.exe PID 1756 wrote to memory of 2064 1756 Abachg32.exe Adbmjbif.exe PID 1756 wrote to memory of 2064 1756 Abachg32.exe Adbmjbif.exe PID 2064 wrote to memory of 2180 2064 Adbmjbif.exe Achikonn.exe PID 2064 wrote to memory of 2180 2064 Adbmjbif.exe Achikonn.exe PID 2064 wrote to memory of 2180 2064 Adbmjbif.exe Achikonn.exe PID 2064 wrote to memory of 2180 2064 Adbmjbif.exe Achikonn.exe PID 2180 wrote to memory of 516 2180 Achikonn.exe Aonjpp32.exe PID 2180 wrote to memory of 516 2180 Achikonn.exe Aonjpp32.exe PID 2180 wrote to memory of 516 2180 Achikonn.exe Aonjpp32.exe PID 2180 wrote to memory of 516 2180 Achikonn.exe Aonjpp32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05d32837b99cdfd59bad0155a66adc3d1bc6307d415084d6b222c624343aeceb.exe"C:\Users\Admin\AppData\Local\Temp\05d32837b99cdfd59bad0155a66adc3d1bc6307d415084d6b222c624343aeceb.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\Ooeolkff.exeC:\Windows\system32\Ooeolkff.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\Oepghe32.exeC:\Windows\system32\Oepghe32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\Olioeoeo.exeC:\Windows\system32\Olioeoeo.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\Oebdndlp.exeC:\Windows\system32\Oebdndlp.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\Ollljo32.exeC:\Windows\system32\Ollljo32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\Pamnnemo.exeC:\Windows\system32\Pamnnemo.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\Ppbkoabf.exeC:\Windows\system32\Ppbkoabf.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\Ppegdapd.exeC:\Windows\system32\Ppegdapd.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\Pgamgken.exeC:\Windows\system32\Pgamgken.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\Polakmbi.exeC:\Windows\system32\Polakmbi.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\Qamjmh32.exeC:\Windows\system32\Qamjmh32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\Aoakfl32.exeC:\Windows\system32\Aoakfl32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\Abachg32.exeC:\Windows\system32\Abachg32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\Adbmjbif.exeC:\Windows\system32\Adbmjbif.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\Achikonn.exeC:\Windows\system32\Achikonn.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\Aonjpp32.exeC:\Windows\system32\Aonjpp32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:516 -
C:\Windows\SysWOW64\Bclcfnih.exeC:\Windows\system32\Bclcfnih.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Windows\SysWOW64\Bmegodpi.exeC:\Windows\system32\Bmegodpi.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Windows\SysWOW64\Bnhqll32.exeC:\Windows\system32\Bnhqll32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Windows\SysWOW64\Bgqeea32.exeC:\Windows\system32\Bgqeea32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Windows\SysWOW64\Bbfibj32.exeC:\Windows\system32\Bbfibj32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Windows\SysWOW64\Bjanfl32.exeC:\Windows\system32\Bjanfl32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Windows\SysWOW64\Cakfcfoc.exeC:\Windows\system32\Cakfcfoc.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:320 -
C:\Windows\SysWOW64\Cjdkllec.exeC:\Windows\system32\Cjdkllec.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Windows\SysWOW64\Cancif32.exeC:\Windows\system32\Cancif32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Windows\SysWOW64\Cpcpjbah.exeC:\Windows\system32\Cpcpjbah.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Windows\SysWOW64\Cabldeik.exeC:\Windows\system32\Cabldeik.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Windows\SysWOW64\Cjkamk32.exeC:\Windows\system32\Cjkamk32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Windows\SysWOW64\Cbfeam32.exeC:\Windows\system32\Cbfeam32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Windows\SysWOW64\Degobhjg.exeC:\Windows\system32\Degobhjg.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Windows\SysWOW64\Dlcceboa.exeC:\Windows\system32\Dlcceboa.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2760 -
C:\Windows\SysWOW64\Dekhnh32.exeC:\Windows\system32\Dekhnh32.exe33⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\SysWOW64\Dabicikf.exeC:\Windows\system32\Dabicikf.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2592 -
C:\Windows\SysWOW64\Ddcadd32.exeC:\Windows\system32\Ddcadd32.exe35⤵
- Executes dropped EXE
PID:1724 -
C:\Windows\SysWOW64\Egdjfo32.exeC:\Windows\system32\Egdjfo32.exe36⤵
- Executes dropped EXE
PID:1748 -
C:\Windows\SysWOW64\Ecjkkp32.exeC:\Windows\system32\Ecjkkp32.exe37⤵
- Executes dropped EXE
PID:2172 -
C:\Windows\SysWOW64\Eoalpaaa.exeC:\Windows\system32\Eoalpaaa.exe38⤵
- Executes dropped EXE
PID:2160 -
C:\Windows\SysWOW64\Ehjqif32.exeC:\Windows\system32\Ehjqif32.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2500 -
C:\Windows\SysWOW64\Eabeal32.exeC:\Windows\system32\Eabeal32.exe40⤵
- Executes dropped EXE
PID:2664 -
C:\Windows\SysWOW64\Ekjikadb.exeC:\Windows\system32\Ekjikadb.exe41⤵
- Executes dropped EXE
PID:1848 -
C:\Windows\SysWOW64\Fkmfpabp.exeC:\Windows\system32\Fkmfpabp.exe42⤵
- Executes dropped EXE
PID:2352 -
C:\Windows\SysWOW64\Fdlqjf32.exeC:\Windows\system32\Fdlqjf32.exe43⤵
- Executes dropped EXE
PID:2120 -
C:\Windows\SysWOW64\Gcankb32.exeC:\Windows\system32\Gcankb32.exe44⤵
- Executes dropped EXE
PID:2076 -
C:\Windows\SysWOW64\Gfbfln32.exeC:\Windows\system32\Gfbfln32.exe45⤵
- Executes dropped EXE
PID:1796 -
C:\Windows\SysWOW64\Gbigao32.exeC:\Windows\system32\Gbigao32.exe46⤵
- Executes dropped EXE
PID:1980 -
C:\Windows\SysWOW64\Gnphfppi.exeC:\Windows\system32\Gnphfppi.exe47⤵
- Executes dropped EXE
PID:2324 -
C:\Windows\SysWOW64\Gghloe32.exeC:\Windows\system32\Gghloe32.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2196 -
C:\Windows\SysWOW64\Helmiiec.exeC:\Windows\system32\Helmiiec.exe49⤵
- Executes dropped EXE
PID:1656 -
C:\Windows\SysWOW64\Hndaao32.exeC:\Windows\system32\Hndaao32.exe50⤵
- Executes dropped EXE
PID:1480 -
C:\Windows\SysWOW64\Henjnica.exeC:\Windows\system32\Henjnica.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1924 -
C:\Windows\SysWOW64\Hngngo32.exeC:\Windows\system32\Hngngo32.exe52⤵
- Executes dropped EXE
PID:872 -
C:\Windows\SysWOW64\Hgobpd32.exeC:\Windows\system32\Hgobpd32.exe53⤵
- Executes dropped EXE
PID:2916 -
C:\Windows\SysWOW64\Haggijgb.exeC:\Windows\system32\Haggijgb.exe54⤵
- Executes dropped EXE
PID:2992 -
C:\Windows\SysWOW64\Hfdpaqej.exeC:\Windows\system32\Hfdpaqej.exe55⤵
- Executes dropped EXE
PID:2616 -
C:\Windows\SysWOW64\Hiblmldn.exeC:\Windows\system32\Hiblmldn.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2876 -
C:\Windows\SysWOW64\Hiehbl32.exeC:\Windows\system32\Hiehbl32.exe57⤵
- Executes dropped EXE
PID:2780 -
C:\Windows\SysWOW64\Ipoqofjh.exeC:\Windows\system32\Ipoqofjh.exe58⤵
- Executes dropped EXE
PID:288 -
C:\Windows\SysWOW64\Ieligmho.exeC:\Windows\system32\Ieligmho.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1332 -
C:\Windows\SysWOW64\Ipameehe.exeC:\Windows\system32\Ipameehe.exe60⤵
- Executes dropped EXE
PID:2552 -
C:\Windows\SysWOW64\Iijbnkne.exeC:\Windows\system32\Iijbnkne.exe61⤵
- Executes dropped EXE
PID:2604 -
C:\Windows\SysWOW64\Ipcjje32.exeC:\Windows\system32\Ipcjje32.exe62⤵
- Executes dropped EXE
PID:2648 -
C:\Windows\SysWOW64\Iaegbmlq.exeC:\Windows\system32\Iaegbmlq.exe63⤵
- Executes dropped EXE
PID:1616 -
C:\Windows\SysWOW64\Iniglajj.exeC:\Windows\system32\Iniglajj.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2676 -
C:\Windows\SysWOW64\Ihaldgak.exeC:\Windows\system32\Ihaldgak.exe65⤵
- Executes dropped EXE
PID:2108 -
C:\Windows\SysWOW64\Imndmnob.exeC:\Windows\system32\Imndmnob.exe66⤵PID:316
-
C:\Windows\SysWOW64\Jffhec32.exeC:\Windows\system32\Jffhec32.exe67⤵PID:1004
-
C:\Windows\SysWOW64\Jalmcl32.exeC:\Windows\system32\Jalmcl32.exe68⤵PID:896
-
C:\Windows\SysWOW64\Jfiekc32.exeC:\Windows\system32\Jfiekc32.exe69⤵
- System Location Discovery: System Language Discovery
PID:2008 -
C:\Windows\SysWOW64\Jmbnhm32.exeC:\Windows\system32\Jmbnhm32.exe70⤵PID:912
-
C:\Windows\SysWOW64\Jbpfpd32.exeC:\Windows\system32\Jbpfpd32.exe71⤵PID:804
-
C:\Windows\SysWOW64\Jmejmm32.exeC:\Windows\system32\Jmejmm32.exe72⤵PID:924
-
C:\Windows\SysWOW64\Jepoao32.exeC:\Windows\system32\Jepoao32.exe73⤵PID:548
-
C:\Windows\SysWOW64\Joicje32.exeC:\Windows\system32\Joicje32.exe74⤵
- Modifies registry class
PID:2056 -
C:\Windows\SysWOW64\Jlmddi32.exeC:\Windows\system32\Jlmddi32.exe75⤵
- Modifies registry class
PID:2752 -
C:\Windows\SysWOW64\Kaillp32.exeC:\Windows\system32\Kaillp32.exe76⤵PID:2768
-
C:\Windows\SysWOW64\Kommediq.exeC:\Windows\system32\Kommediq.exe77⤵PID:2776
-
C:\Windows\SysWOW64\Kopikdgn.exeC:\Windows\system32\Kopikdgn.exe78⤵PID:2824
-
C:\Windows\SysWOW64\Kkfjpemb.exeC:\Windows\system32\Kkfjpemb.exe79⤵PID:1384
-
C:\Windows\SysWOW64\Kapbmo32.exeC:\Windows\system32\Kapbmo32.exe80⤵PID:2084
-
C:\Windows\SysWOW64\Kkigfdjo.exeC:\Windows\system32\Kkigfdjo.exe81⤵PID:3016
-
C:\Windows\SysWOW64\Kdakoj32.exeC:\Windows\system32\Kdakoj32.exe82⤵PID:2184
-
C:\Windows\SysWOW64\Lcfhpf32.exeC:\Windows\system32\Lcfhpf32.exe83⤵PID:2088
-
C:\Windows\SysWOW64\Lnlmmo32.exeC:\Windows\system32\Lnlmmo32.exe84⤵PID:900
-
C:\Windows\SysWOW64\Lcieef32.exeC:\Windows\system32\Lcieef32.exe85⤵PID:1792
-
C:\Windows\SysWOW64\Ljbmbpkb.exeC:\Windows\system32\Ljbmbpkb.exe86⤵PID:1556
-
C:\Windows\SysWOW64\Loofjg32.exeC:\Windows\system32\Loofjg32.exe87⤵PID:1252
-
C:\Windows\SysWOW64\Lfingaaf.exeC:\Windows\system32\Lfingaaf.exe88⤵PID:2148
-
C:\Windows\SysWOW64\Llcfck32.exeC:\Windows\system32\Llcfck32.exe89⤵PID:2696
-
C:\Windows\SysWOW64\Lbpolb32.exeC:\Windows\system32\Lbpolb32.exe90⤵PID:2948
-
C:\Windows\SysWOW64\Llfcik32.exeC:\Windows\system32\Llfcik32.exe91⤵PID:2748
-
C:\Windows\SysWOW64\Lngpac32.exeC:\Windows\system32\Lngpac32.exe92⤵PID:1084
-
C:\Windows\SysWOW64\Mfngbq32.exeC:\Windows\system32\Mfngbq32.exe93⤵PID:2544
-
C:\Windows\SysWOW64\Mgodjico.exeC:\Windows\system32\Mgodjico.exe94⤵PID:1988
-
C:\Windows\SysWOW64\Mqhhbn32.exeC:\Windows\system32\Mqhhbn32.exe95⤵PID:1352
-
C:\Windows\SysWOW64\Mjpmkdpp.exeC:\Windows\system32\Mjpmkdpp.exe96⤵PID:632
-
C:\Windows\SysWOW64\Mkpieggc.exeC:\Windows\system32\Mkpieggc.exe97⤵PID:2392
-
C:\Windows\SysWOW64\Mqlbnnej.exeC:\Windows\system32\Mqlbnnej.exe98⤵PID:2644
-
C:\Windows\SysWOW64\Mjeffc32.exeC:\Windows\system32\Mjeffc32.exe99⤵PID:2272
-
C:\Windows\SysWOW64\Mpaoojjb.exeC:\Windows\system32\Mpaoojjb.exe100⤵PID:1804
-
C:\Windows\SysWOW64\Nijcgp32.exeC:\Windows\system32\Nijcgp32.exe101⤵PID:1304
-
C:\Windows\SysWOW64\Ncpgeh32.exeC:\Windows\system32\Ncpgeh32.exe102⤵PID:1776
-
C:\Windows\SysWOW64\Nilpmo32.exeC:\Windows\system32\Nilpmo32.exe103⤵PID:432
-
C:\Windows\SysWOW64\Ncbdjhnf.exeC:\Windows\system32\Ncbdjhnf.exe104⤵PID:2140
-
C:\Windows\SysWOW64\Nmjicn32.exeC:\Windows\system32\Nmjicn32.exe105⤵PID:1380
-
C:\Windows\SysWOW64\Nbgakd32.exeC:\Windows\system32\Nbgakd32.exe106⤵
- Modifies registry class
PID:2884 -
C:\Windows\SysWOW64\Nhdjdk32.exeC:\Windows\system32\Nhdjdk32.exe107⤵PID:2936
-
C:\Windows\SysWOW64\Nnnbqeib.exeC:\Windows\system32\Nnnbqeib.exe108⤵PID:2792
-
C:\Windows\SysWOW64\Nnpofe32.exeC:\Windows\system32\Nnpofe32.exe109⤵PID:3060
-
C:\Windows\SysWOW64\Odmgnl32.exeC:\Windows\system32\Odmgnl32.exe110⤵PID:2300
-
C:\Windows\SysWOW64\Oaaghp32.exeC:\Windows\system32\Oaaghp32.exe111⤵PID:1280
-
C:\Windows\SysWOW64\Ofnppgbh.exeC:\Windows\system32\Ofnppgbh.exe112⤵PID:2164
-
C:\Windows\SysWOW64\Opfdim32.exeC:\Windows\system32\Opfdim32.exe113⤵
- System Location Discovery: System Language Discovery
PID:1868 -
C:\Windows\SysWOW64\Ohmljj32.exeC:\Windows\system32\Ohmljj32.exe114⤵PID:1360
-
C:\Windows\SysWOW64\Oiniaboi.exeC:\Windows\system32\Oiniaboi.exe115⤵PID:1744
-
C:\Windows\SysWOW64\Pejcab32.exeC:\Windows\system32\Pejcab32.exe116⤵PID:1040
-
C:\Windows\SysWOW64\Paqdgcfl.exeC:\Windows\system32\Paqdgcfl.exe117⤵PID:3000
-
C:\Windows\SysWOW64\Pkihpi32.exeC:\Windows\system32\Pkihpi32.exe118⤵PID:2804
-
C:\Windows\SysWOW64\Peolmb32.exeC:\Windows\system32\Peolmb32.exe119⤵PID:884
-
C:\Windows\SysWOW64\Pkkeeikj.exeC:\Windows\system32\Pkkeeikj.exe120⤵PID:3052
-
C:\Windows\SysWOW64\Pddinn32.exeC:\Windows\system32\Pddinn32.exe121⤵
- Modifies registry class
PID:3064 -
C:\Windows\SysWOW64\Ppjjcogn.exeC:\Windows\system32\Ppjjcogn.exe122⤵PID:2364
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-