Analysis
-
max time kernel
76s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 08:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ea37860e58733cd8108dafd3e20b7aebad7f9b9dc80385e6891392552298bf3fN.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
ea37860e58733cd8108dafd3e20b7aebad7f9b9dc80385e6891392552298bf3fN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
ea37860e58733cd8108dafd3e20b7aebad7f9b9dc80385e6891392552298bf3fN.exe
-
Size
322KB
-
MD5
e8298fac0d9484c3abb2ac5ecb3bc3e0
-
SHA1
47559b5ef13f5cfdeb4d3aae5672475b6a5bf31d
-
SHA256
ea37860e58733cd8108dafd3e20b7aebad7f9b9dc80385e6891392552298bf3f
-
SHA512
e8e32a8b69802723f9dbf19fc07ff2e15d29ec12476f53aac5b7dfd4a00d9bbac8d0891f5071b989a615845aa4b9cabeed2c6d0bc8511f957bcae3672cc2c05f
-
SSDEEP
1536:o0UkFZzAh0ioBSQ2z/1GVXy8+RQsTmDhdF+PhJFTq1dlCsTx4LB:o0TFZzAhc2zsM8+esSVGZ3Odl
Score
10/10
Malware Config
Extracted
Family
berbew
C2
http://viruslist.com/wcmd.txt
http://viruslist.com/ppslog.php
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Pmpcoabe.exeJhebij32.exeOpaeok32.exeFgbmdphe.exeJkbhjo32.exeBokfaflj.exeDllnphkd.exeAbcppcdc.exeAhhhgh32.exeJcpglhpo.exeNnfgnibb.exeLbncbgoh.exeNdhooaog.exeMlacdj32.exeHjeojnep.exePnhhpaio.exeAbnpjnem.exeHnecjgch.exeEphkak32.exeAhpdficc.exeBmfamg32.exeEcibjn32.exeQlmnfh32.exeCbfhjfdk.exeLhiodnob.exeAbfmecba.exeLobehpok.exeHioefjfb.exeIlfeidmk.exeObbpio32.exeHfdbji32.exeFqeagpop.exeBpdihedp.exeEklbid32.exeMlqakaqi.exeJgbpfhpc.exeJfdigocb.exeNabegpbp.exeGledgkfn.exeOcbbbd32.exeBfdlehlc.exeHhipcbdi.exeDaoeeo32.exeKldlmqml.exeLkcehkeh.exeHkgjge32.exeEhhghdgc.exeGqomqm32.exeApjpglfn.exeHnmcne32.exeOdhhdk32.exePpcplg32.exeHekhid32.exeLojhmjag.exeDheljhof.exeMkihfi32.exeDdbbod32.exeJpgaohej.exeBclbhkdj.exeKidjfl32.exeMmgmhngk.exeNdoenlcf.exeKkeqobld.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pmpcoabe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jhebij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Opaeok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fgbmdphe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkbhjo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bokfaflj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dllnphkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Abcppcdc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ahhhgh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jcpglhpo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnfgnibb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lbncbgoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ndhooaog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mlacdj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjeojnep.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pnhhpaio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Abnpjnem.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnecjgch.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ephkak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ahpdficc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmfamg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ecibjn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qlmnfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cbfhjfdk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhiodnob.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abfmecba.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lobehpok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hioefjfb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilfeidmk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Obbpio32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hfdbji32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fqeagpop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bpdihedp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eklbid32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlqakaqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jgbpfhpc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfdigocb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nabegpbp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gledgkfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ocbbbd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfdlehlc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hhipcbdi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Daoeeo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kldlmqml.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lkcehkeh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hkgjge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ehhghdgc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gqomqm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apjpglfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hnmcne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Odhhdk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppcplg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hekhid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lojhmjag.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dheljhof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mkihfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ddbbod32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jpgaohej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nabegpbp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bclbhkdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kidjfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mmgmhngk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndoenlcf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kkeqobld.exe -
Berbew family
-
Executes dropped EXE 64 IoCs
Processes:
Iclfccmq.exeImidgh32.exeIpimic32.exeJbooen32.exeJjlqpp32.exeKidjfl32.exeLklmoccl.exeLllihf32.exeLlgllj32.exeMcendc32.exeMfhcknpf.exeNdpmbjbk.exeNplkhh32.exeOjdlkp32.exeOpcaiggo.exeOmpgqonl.exePfhlie32.exePbcfie32.exePfaopc32.exeQlqdmj32.exeAkfaof32.exeAdnegldo.exeApeflmjc.exeApjpglfn.exeAefhpc32.exeBfieec32.exeBhjngnod.exeBhljlnma.exeBohoogbk.exeCgfqii32.exeCmbiap32.exeCmgblphf.exeCbfhjfdk.exeDkolblkk.exeDanaqbgp.exeDnbbjf32.exeDlfbck32.exeEpjdbn32.exeEmnelbdi.exeEhjbaooe.exeEabgjeef.exeFkmhij32.exeFdemap32.exeFokaoh32.exeFkbadifn.exeFkdoii32.exeGgkoojip.exeGdophn32.exeGngdadoj.exeGebiefle.exeGaiijgbi.exeGcifdj32.exeHopgikop.exeHdloab32.exeHnecjgch.exeHjkdoh32.exeHgpeimhf.exeHfdbji32.exeHomfboco.exeIijdfc32.exeIilalc32.exeIionacad.exeIjpjik32.exeJchobqnc.exepid Process 2552 Iclfccmq.exe 2868 Imidgh32.exe 2844 Ipimic32.exe 2736 Jbooen32.exe 2824 Jjlqpp32.exe 2196 Kidjfl32.exe 2252 Lklmoccl.exe 1916 Lllihf32.exe 3040 Llgllj32.exe 2300 Mcendc32.exe 1296 Mfhcknpf.exe 1812 Ndpmbjbk.exe 1768 Nplkhh32.exe 592 Ojdlkp32.exe 2428 Opcaiggo.exe 2216 Ompgqonl.exe 1076 Pfhlie32.exe 2128 Pbcfie32.exe 456 Pfaopc32.exe 1556 Qlqdmj32.exe 1624 Akfaof32.exe 1772 Adnegldo.exe 2392 Apeflmjc.exe 1472 Apjpglfn.exe 1748 Aefhpc32.exe 3008 Bfieec32.exe 236 Bhjngnod.exe 2852 Bhljlnma.exe 2948 Bohoogbk.exe 3024 Cgfqii32.exe 2776 Cmbiap32.exe 2608 Cmgblphf.exe 2304 Cbfhjfdk.exe 2068 Dkolblkk.exe 1100 Danaqbgp.exe 2888 Dnbbjf32.exe 2700 Dlfbck32.exe 2568 Epjdbn32.exe 1148 Emnelbdi.exe 2908 Ehjbaooe.exe 2512 Eabgjeef.exe 976 Fkmhij32.exe 1848 Fdemap32.exe 2580 Fokaoh32.exe 1000 Fkbadifn.exe 2164 Fkdoii32.exe 1988 Ggkoojip.exe 2132 Gdophn32.exe 1632 Gngdadoj.exe 1740 Gebiefle.exe 2144 Gaiijgbi.exe 2816 Gcifdj32.exe 2916 Hopgikop.exe 2876 Hdloab32.exe 2924 Hnecjgch.exe 2416 Hjkdoh32.exe 1688 Hgpeimhf.exe 3052 Hfdbji32.exe 2952 Homfboco.exe 1448 Iijdfc32.exe 2504 Iilalc32.exe 1160 Iionacad.exe 2576 Ijpjik32.exe 1552 Jchobqnc.exe -
Loads dropped DLL 64 IoCs
Processes:
ea37860e58733cd8108dafd3e20b7aebad7f9b9dc80385e6891392552298bf3fN.exeIclfccmq.exeImidgh32.exeIpimic32.exeJbooen32.exeJjlqpp32.exeKidjfl32.exeLklmoccl.exeLllihf32.exeLlgllj32.exeMcendc32.exeMfhcknpf.exeNdpmbjbk.exeNplkhh32.exeOjdlkp32.exeOpcaiggo.exeOmpgqonl.exePfhlie32.exePbcfie32.exePfaopc32.exeQlqdmj32.exeAkfaof32.exeAdnegldo.exeApeflmjc.exeApjpglfn.exeAefhpc32.exeBfieec32.exeBhjngnod.exeBhljlnma.exeBohoogbk.exeCgfqii32.exeCmbiap32.exepid Process 2792 ea37860e58733cd8108dafd3e20b7aebad7f9b9dc80385e6891392552298bf3fN.exe 2792 ea37860e58733cd8108dafd3e20b7aebad7f9b9dc80385e6891392552298bf3fN.exe 2552 Iclfccmq.exe 2552 Iclfccmq.exe 2868 Imidgh32.exe 2868 Imidgh32.exe 2844 Ipimic32.exe 2844 Ipimic32.exe 2736 Jbooen32.exe 2736 Jbooen32.exe 2824 Jjlqpp32.exe 2824 Jjlqpp32.exe 2196 Kidjfl32.exe 2196 Kidjfl32.exe 2252 Lklmoccl.exe 2252 Lklmoccl.exe 1916 Lllihf32.exe 1916 Lllihf32.exe 3040 Llgllj32.exe 3040 Llgllj32.exe 2300 Mcendc32.exe 2300 Mcendc32.exe 1296 Mfhcknpf.exe 1296 Mfhcknpf.exe 1812 Ndpmbjbk.exe 1812 Ndpmbjbk.exe 1768 Nplkhh32.exe 1768 Nplkhh32.exe 592 Ojdlkp32.exe 592 Ojdlkp32.exe 2428 Opcaiggo.exe 2428 Opcaiggo.exe 2216 Ompgqonl.exe 2216 Ompgqonl.exe 1076 Pfhlie32.exe 1076 Pfhlie32.exe 2128 Pbcfie32.exe 2128 Pbcfie32.exe 456 Pfaopc32.exe 456 Pfaopc32.exe 1556 Qlqdmj32.exe 1556 Qlqdmj32.exe 1624 Akfaof32.exe 1624 Akfaof32.exe 1772 Adnegldo.exe 1772 Adnegldo.exe 2392 Apeflmjc.exe 2392 Apeflmjc.exe 1472 Apjpglfn.exe 1472 Apjpglfn.exe 1748 Aefhpc32.exe 1748 Aefhpc32.exe 3008 Bfieec32.exe 3008 Bfieec32.exe 236 Bhjngnod.exe 236 Bhjngnod.exe 2852 Bhljlnma.exe 2852 Bhljlnma.exe 2948 Bohoogbk.exe 2948 Bohoogbk.exe 3024 Cgfqii32.exe 3024 Cgfqii32.exe 2776 Cmbiap32.exe 2776 Cmbiap32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Nokdnail.exeIbehna32.exeAbfmecba.exePcppbc32.exeJjlqpp32.exeDnbbjf32.exeFdemap32.exeNecandjo.exeGfkagc32.exeJhchlcjj.exeMfngdmgb.exeLielphqc.exeMcfpmlll.exeLicbca32.exeAggbif32.exeDnonjqdq.exeQpjeaa32.exeJgdmkhnp.exeFndfmljk.exePconjjql.exeLqdfmihh.exeCbebjpaa.exeFeofpqkn.exeDgbiggof.exeGledgkfn.exeQnlobhne.exeJbfpcl32.exeLklmoccl.exeOcdohdfc.exeIkembicd.exeCfpinnfj.exeGcjogidl.exeLokpcekn.exeCpkaai32.exeAkdedkfl.exePobhfl32.exePefmkpbl.exeEikmkbeg.exeBpfhfjgq.exeDlokegib.exeGnocdb32.exeAihmhe32.exeImifpagp.exeBpdihedp.exePecikj32.exeFbchfi32.exeMppiod32.exeGnaffpoi.exeDibjec32.exeIilalc32.exeHkgjge32.exeCocnanmd.exeHoflpbmo.exePhknlfem.exeAhjcqcdm.exePfekbg32.exeOiolfo32.exeOmmdqi32.exeDjfooa32.exeObpccped.exeQjnajl32.exeNoffadai.exedescription ioc Process File opened for modification C:\Windows\SysWOW64\Nkbdbbop.exe Nokdnail.exe File created C:\Windows\SysWOW64\Folmgc32.dll Ibehna32.exe File created C:\Windows\SysWOW64\Hkahhl32.dll Abfmecba.exe File opened for modification C:\Windows\SysWOW64\Ppcplg32.exe Pcppbc32.exe File created C:\Windows\SysWOW64\Glfboi32.dll Jjlqpp32.exe File opened for modification C:\Windows\SysWOW64\Dlfbck32.exe Dnbbjf32.exe File created C:\Windows\SysWOW64\Khhcfo32.dll Fdemap32.exe File opened for modification C:\Windows\SysWOW64\Ndhooaog.exe Necandjo.exe File opened for modification C:\Windows\SysWOW64\Glhjpjok.exe Gfkagc32.exe File created C:\Windows\SysWOW64\Jaklei32.exe Jhchlcjj.exe File created C:\Windows\SysWOW64\Ocfjnb32.dll Mfngdmgb.exe File opened for modification C:\Windows\SysWOW64\Lobehpok.exe Lielphqc.exe File created C:\Windows\SysWOW64\Makmnh32.exe Mcfpmlll.exe File created C:\Windows\SysWOW64\Belecp32.dll Licbca32.exe File opened for modification C:\Windows\SysWOW64\Aocgnh32.exe Aggbif32.exe File opened for modification C:\Windows\SysWOW64\Djfooa32.exe Dnonjqdq.exe File opened for modification C:\Windows\SysWOW64\Qpmbgaid.exe Qpjeaa32.exe File created C:\Windows\SysWOW64\Jqmadn32.exe Jgdmkhnp.exe File created C:\Windows\SysWOW64\Fglkeaqk.exe Fndfmljk.exe File opened for modification C:\Windows\SysWOW64\Pfpflenm.exe Pconjjql.exe File opened for modification C:\Windows\SysWOW64\Lgpkobnb.exe Lqdfmihh.exe File created C:\Windows\SysWOW64\Cjpgnbol.exe Cbebjpaa.exe File opened for modification C:\Windows\SysWOW64\Fddcqm32.exe Feofpqkn.exe File created C:\Windows\SysWOW64\Dmobpn32.exe Dgbiggof.exe File created C:\Windows\SysWOW64\Opebop32.dll Gledgkfn.exe File created C:\Windows\SysWOW64\Glhjpjok.exe Gfkagc32.exe File created C:\Windows\SysWOW64\Ifbalb32.dll Qnlobhne.exe File created C:\Windows\SysWOW64\Jhchlcjj.exe Jbfpcl32.exe File created C:\Windows\SysWOW64\Mofeco32.dll Lklmoccl.exe File created C:\Windows\SysWOW64\Ommdqi32.exe Ocdohdfc.exe File created C:\Windows\SysWOW64\Iqbekpal.exe Ikembicd.exe File created C:\Windows\SysWOW64\Dpenkgfq.exe Cfpinnfj.exe File created C:\Windows\SysWOW64\Glgqlkdl.exe Gledgkfn.exe File created C:\Windows\SysWOW64\Gnocdb32.exe Gcjogidl.exe File opened for modification C:\Windows\SysWOW64\Lkbphfab.exe Lokpcekn.exe File opened for modification C:\Windows\SysWOW64\Chfffk32.exe Cpkaai32.exe File created C:\Windows\SysWOW64\Dfmcdb32.dll Akdedkfl.exe File created C:\Windows\SysWOW64\Pqodpj32.dll Pobhfl32.exe File created C:\Windows\SysWOW64\Fgdfmhfo.dll Pefmkpbl.exe File opened for modification C:\Windows\SysWOW64\Eafapd32.exe Eikmkbeg.exe File opened for modification C:\Windows\SysWOW64\Bgqqcd32.exe Bpfhfjgq.exe File opened for modification C:\Windows\SysWOW64\Dheljhof.exe Dlokegib.exe File created C:\Windows\SysWOW64\Hekhid32.exe Gnocdb32.exe File created C:\Windows\SysWOW64\Aikine32.exe Aihmhe32.exe File created C:\Windows\SysWOW64\Igojmjgf.exe Imifpagp.exe File opened for modification C:\Windows\SysWOW64\Bimnqk32.exe Bpdihedp.exe File created C:\Windows\SysWOW64\Obiaedmf.dll Pecikj32.exe File opened for modification C:\Windows\SysWOW64\Fbeeliin.exe Fbchfi32.exe File created C:\Windows\SysWOW64\Mihngj32.exe Mppiod32.exe File created C:\Windows\SysWOW64\Biiajp32.dll Gnaffpoi.exe File created C:\Windows\SysWOW64\Ddgnbl32.exe Dibjec32.exe File created C:\Windows\SysWOW64\Oambdf32.dll Iilalc32.exe File opened for modification C:\Windows\SysWOW64\Hkifld32.exe Hkgjge32.exe File opened for modification C:\Windows\SysWOW64\Cgnbepjp.exe Cocnanmd.exe File opened for modification C:\Windows\SysWOW64\Hhnpih32.exe Hoflpbmo.exe File opened for modification C:\Windows\SysWOW64\Pligbekc.exe Phknlfem.exe File opened for modification C:\Windows\SysWOW64\Afoqbpid.exe Ahjcqcdm.exe File created C:\Windows\SysWOW64\Epgklj32.dll Pfekbg32.exe File created C:\Windows\SysWOW64\Ppaimb32.dll Oiolfo32.exe File opened for modification C:\Windows\SysWOW64\Obilip32.exe Ommdqi32.exe File created C:\Windows\SysWOW64\Dbadcdgp.exe Djfooa32.exe File created C:\Windows\SysWOW64\Ekjgao32.dll Obpccped.exe File created C:\Windows\SysWOW64\Eoiddi32.dll Qjnajl32.exe File created C:\Windows\SysWOW64\Mofmeffb.dll Noffadai.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 3260 4064 WerFault.exe 703 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Eklbid32.exeIbjing32.exeBhljlnma.exeBohoogbk.exeJmhile32.exeMikooghn.exeJdklcebk.exeQmpafnld.exeBfieec32.exeJpdibapb.exeAhpdficc.exeChfffk32.exeKbajci32.exeEmcqpjhh.exeFlfbfken.exeDlfbck32.exeHohfmi32.exeDdbbod32.exeMlogojjp.exePkebig32.exeNaqkki32.exeObilip32.exeFmfdppia.exeChiedc32.exeKqncnjan.exeHnecjgch.exeFehodaqd.exeMlqakaqi.exeCbmoeeod.exeKldlmqml.exeNlnlcg32.exeCeioka32.exeOiebej32.exeCcikghel.exeHnmcne32.exeBmfamg32.exeIoonfaed.exeEnomam32.exeJlnadiko.exeKbdmboqk.exeBckidl32.exeEeecibci.exeAamekk32.exeQfbahldf.exeCcmcfc32.exeGodjaj32.exeNkbdbbop.exeNqjmec32.exeAfebpmal.exeKidjfl32.exeGaiijgbi.exeLhkiae32.exeBaakem32.exeKbonmjph.exeKefmnp32.exeMphhbblp.exeIgeggkoq.exeNlpmjdce.exeMmepboin.exeNabegpbp.exeIfecen32.exeHfmfjh32.exeHnedfljc.exeEcidbfbb.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eklbid32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibjing32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhljlnma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bohoogbk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jmhile32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mikooghn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdklcebk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qmpafnld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfieec32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jpdibapb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahpdficc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chfffk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbajci32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emcqpjhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flfbfken.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dlfbck32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hohfmi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddbbod32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlogojjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pkebig32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Naqkki32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Obilip32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmfdppia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chiedc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kqncnjan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hnecjgch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fehodaqd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlqakaqi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cbmoeeod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kldlmqml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlnlcg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ceioka32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oiebej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ccikghel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hnmcne32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bmfamg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ioonfaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Enomam32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jlnadiko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbdmboqk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bckidl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eeecibci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aamekk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qfbahldf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ccmcfc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Godjaj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nkbdbbop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nqjmec32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Afebpmal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kidjfl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaiijgbi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhkiae32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Baakem32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbonmjph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kefmnp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mphhbblp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Igeggkoq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlpmjdce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmepboin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nabegpbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ifecen32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfmfjh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hnedfljc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ecidbfbb.exe -
Modifies registry class 64 IoCs
Processes:
Mnqdpj32.exeQpjeaa32.exeKniaap32.exeOfkoijhc.exeHddgkj32.exeHhnpih32.exeLiqnclia.exePnphlc32.exeNaqkki32.exeNmglpjak.exeCmbiap32.exeKldlmqml.exeGlhjpjok.exeEhnknfdn.exeFglkeaqk.exeDfhial32.exePeqidn32.exeKacakgip.exeCkilmfke.exeEhhghdgc.exeDdgnbl32.exePmecdgbk.exeMlogojjp.exePpkahi32.exeGlaejokn.exeMognco32.exeBoadlk32.exeIgmppcpm.exeNojljcjf.exeFqeagpop.exeEpjdbn32.exeIionacad.exeBgqqcd32.exeLgcqhagp.exeLcjamb32.exeDkolblkk.exeDnjeoa32.exeOhfgeo32.exeEkndpa32.exeJhebij32.exeGoohckob.exeKgfannba.exeMmojcceo.exeAihmhe32.exeJficbn32.exeKgcbpemp.exeGadidabc.exeDegage32.exeMcendc32.exeEklgjbca.exeGfclic32.exeKgqcam32.exeCocnanmd.exeFbeeliin.exeKbefen32.exePecikj32.exeBaakem32.exeKiolio32.exeHnhjok32.exeBbhikcpn.exeCfcajekc.exeHjjknfin.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mnqdpj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Qpjeaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aeegdc32.dll" Kniaap32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ofkoijhc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hddgkj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hhnpih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aafhafjm.dll" Liqnclia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pnphlc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Naqkki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nmglpjak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cmbiap32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kldlmqml.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Glhjpjok.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ehnknfdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fglkeaqk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbeaaiga.dll" Dfhial32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kodqcnja.dll" Peqidn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Peqidn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kacakgip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfkldo32.dll" Ckilmfke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ondciqan.dll" Ehhghdgc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ddgnbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgepob32.dll" Pmecdgbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mlogojjp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ppkahi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Glaejokn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpmfdi32.dll" Mognco32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Boadlk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcddlail.dll" Igmppcpm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nojljcjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fqeagpop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngllhqkp.dll" Epjdbn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acblea32.dll" Iionacad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pidggp32.dll" Bgqqcd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lgcqhagp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lcjamb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppedfk32.dll" Dkolblkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dnjeoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpjfcp32.dll" Ohfgeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ekndpa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paficbda.dll" Jhebij32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Goohckob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdiekq32.dll" Kgfannba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mmojcceo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Aihmhe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkfbibki.dll" Aihmhe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jficbn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kgcbpemp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkiiie32.dll" Gadidabc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Degage32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mcendc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agnopk32.dll" Eklgjbca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gfclic32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kgqcam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hoccdhpn.dll" Cocnanmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fbeeliin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kbefen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pecikj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmllmn32.dll" Baakem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kiolio32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hnhjok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bbhikcpn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cfcajekc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bicbeq32.dll" Hjjknfin.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ea37860e58733cd8108dafd3e20b7aebad7f9b9dc80385e6891392552298bf3fN.exeIclfccmq.exeImidgh32.exeIpimic32.exeJbooen32.exeJjlqpp32.exeKidjfl32.exeLklmoccl.exeLllihf32.exeLlgllj32.exeMcendc32.exeMfhcknpf.exeNdpmbjbk.exeNplkhh32.exeOjdlkp32.exeOpcaiggo.exedescription pid Process procid_target PID 2792 wrote to memory of 2552 2792 ea37860e58733cd8108dafd3e20b7aebad7f9b9dc80385e6891392552298bf3fN.exe 29 PID 2792 wrote to memory of 2552 2792 ea37860e58733cd8108dafd3e20b7aebad7f9b9dc80385e6891392552298bf3fN.exe 29 PID 2792 wrote to memory of 2552 2792 ea37860e58733cd8108dafd3e20b7aebad7f9b9dc80385e6891392552298bf3fN.exe 29 PID 2792 wrote to memory of 2552 2792 ea37860e58733cd8108dafd3e20b7aebad7f9b9dc80385e6891392552298bf3fN.exe 29 PID 2552 wrote to memory of 2868 2552 Iclfccmq.exe 30 PID 2552 wrote to memory of 2868 2552 Iclfccmq.exe 30 PID 2552 wrote to memory of 2868 2552 Iclfccmq.exe 30 PID 2552 wrote to memory of 2868 2552 Iclfccmq.exe 30 PID 2868 wrote to memory of 2844 2868 Imidgh32.exe 31 PID 2868 wrote to memory of 2844 2868 Imidgh32.exe 31 PID 2868 wrote to memory of 2844 2868 Imidgh32.exe 31 PID 2868 wrote to memory of 2844 2868 Imidgh32.exe 31 PID 2844 wrote to memory of 2736 2844 Ipimic32.exe 32 PID 2844 wrote to memory of 2736 2844 Ipimic32.exe 32 PID 2844 wrote to memory of 2736 2844 Ipimic32.exe 32 PID 2844 wrote to memory of 2736 2844 Ipimic32.exe 32 PID 2736 wrote to memory of 2824 2736 Jbooen32.exe 33 PID 2736 wrote to memory of 2824 2736 Jbooen32.exe 33 PID 2736 wrote to memory of 2824 2736 Jbooen32.exe 33 PID 2736 wrote to memory of 2824 2736 Jbooen32.exe 33 PID 2824 wrote to memory of 2196 2824 Jjlqpp32.exe 34 PID 2824 wrote to memory of 2196 2824 Jjlqpp32.exe 34 PID 2824 wrote to memory of 2196 2824 Jjlqpp32.exe 34 PID 2824 wrote to memory of 2196 2824 Jjlqpp32.exe 34 PID 2196 wrote to memory of 2252 2196 Kidjfl32.exe 35 PID 2196 wrote to memory of 2252 2196 Kidjfl32.exe 35 PID 2196 wrote to memory of 2252 2196 Kidjfl32.exe 35 PID 2196 wrote to memory of 2252 2196 Kidjfl32.exe 35 PID 2252 wrote to memory of 1916 2252 Lklmoccl.exe 36 PID 2252 wrote to memory of 1916 2252 Lklmoccl.exe 36 PID 2252 wrote to memory of 1916 2252 Lklmoccl.exe 36 PID 2252 wrote to memory of 1916 2252 Lklmoccl.exe 36 PID 1916 wrote to memory of 3040 1916 Lllihf32.exe 37 PID 1916 wrote to memory of 3040 1916 Lllihf32.exe 37 PID 1916 wrote to memory of 3040 1916 Lllihf32.exe 37 PID 1916 wrote to memory of 3040 1916 Lllihf32.exe 37 PID 3040 wrote to memory of 2300 3040 Llgllj32.exe 38 PID 3040 wrote to memory of 2300 3040 Llgllj32.exe 38 PID 3040 wrote to memory of 2300 3040 Llgllj32.exe 38 PID 3040 wrote to memory of 2300 3040 Llgllj32.exe 38 PID 2300 wrote to memory of 1296 2300 Mcendc32.exe 39 PID 2300 wrote to memory of 1296 2300 Mcendc32.exe 39 PID 2300 wrote to memory of 1296 2300 Mcendc32.exe 39 PID 2300 wrote to memory of 1296 2300 Mcendc32.exe 39 PID 1296 wrote to memory of 1812 1296 Mfhcknpf.exe 40 PID 1296 wrote to memory of 1812 1296 Mfhcknpf.exe 40 PID 1296 wrote to memory of 1812 1296 Mfhcknpf.exe 40 PID 1296 wrote to memory of 1812 1296 Mfhcknpf.exe 40 PID 1812 wrote to memory of 1768 1812 Ndpmbjbk.exe 41 PID 1812 wrote to memory of 1768 1812 Ndpmbjbk.exe 41 PID 1812 wrote to memory of 1768 1812 Ndpmbjbk.exe 41 PID 1812 wrote to memory of 1768 1812 Ndpmbjbk.exe 41 PID 1768 wrote to memory of 592 1768 Nplkhh32.exe 42 PID 1768 wrote to memory of 592 1768 Nplkhh32.exe 42 PID 1768 wrote to memory of 592 1768 Nplkhh32.exe 42 PID 1768 wrote to memory of 592 1768 Nplkhh32.exe 42 PID 592 wrote to memory of 2428 592 Ojdlkp32.exe 43 PID 592 wrote to memory of 2428 592 Ojdlkp32.exe 43 PID 592 wrote to memory of 2428 592 Ojdlkp32.exe 43 PID 592 wrote to memory of 2428 592 Ojdlkp32.exe 43 PID 2428 wrote to memory of 2216 2428 Opcaiggo.exe 44 PID 2428 wrote to memory of 2216 2428 Opcaiggo.exe 44 PID 2428 wrote to memory of 2216 2428 Opcaiggo.exe 44 PID 2428 wrote to memory of 2216 2428 Opcaiggo.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea37860e58733cd8108dafd3e20b7aebad7f9b9dc80385e6891392552298bf3fN.exe"C:\Users\Admin\AppData\Local\Temp\ea37860e58733cd8108dafd3e20b7aebad7f9b9dc80385e6891392552298bf3fN.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\Iclfccmq.exeC:\Windows\system32\Iclfccmq.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\Imidgh32.exeC:\Windows\system32\Imidgh32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\Ipimic32.exeC:\Windows\system32\Ipimic32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\Jbooen32.exeC:\Windows\system32\Jbooen32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\Jjlqpp32.exeC:\Windows\system32\Jjlqpp32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\Kidjfl32.exeC:\Windows\system32\Kidjfl32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\Lklmoccl.exeC:\Windows\system32\Lklmoccl.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\Lllihf32.exeC:\Windows\system32\Lllihf32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\Llgllj32.exeC:\Windows\system32\Llgllj32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\Mcendc32.exeC:\Windows\system32\Mcendc32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\Mfhcknpf.exeC:\Windows\system32\Mfhcknpf.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\Ndpmbjbk.exeC:\Windows\system32\Ndpmbjbk.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\Nplkhh32.exeC:\Windows\system32\Nplkhh32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\Ojdlkp32.exeC:\Windows\system32\Ojdlkp32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\SysWOW64\Opcaiggo.exeC:\Windows\system32\Opcaiggo.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\Ompgqonl.exeC:\Windows\system32\Ompgqonl.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Windows\SysWOW64\Pfhlie32.exeC:\Windows\system32\Pfhlie32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Windows\SysWOW64\Pbcfie32.exeC:\Windows\system32\Pbcfie32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Windows\SysWOW64\Pfaopc32.exeC:\Windows\system32\Pfaopc32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:456 -
C:\Windows\SysWOW64\Qlqdmj32.exeC:\Windows\system32\Qlqdmj32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Windows\SysWOW64\Akfaof32.exeC:\Windows\system32\Akfaof32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Windows\SysWOW64\Adnegldo.exeC:\Windows\system32\Adnegldo.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Windows\SysWOW64\Apeflmjc.exeC:\Windows\system32\Apeflmjc.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Windows\SysWOW64\Apjpglfn.exeC:\Windows\system32\Apjpglfn.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Windows\SysWOW64\Aefhpc32.exeC:\Windows\system32\Aefhpc32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Windows\SysWOW64\Bfieec32.exeC:\Windows\system32\Bfieec32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3008 -
C:\Windows\SysWOW64\Bhjngnod.exeC:\Windows\system32\Bhjngnod.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:236 -
C:\Windows\SysWOW64\Bhljlnma.exeC:\Windows\system32\Bhljlnma.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2852 -
C:\Windows\SysWOW64\Bohoogbk.exeC:\Windows\system32\Bohoogbk.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Windows\SysWOW64\Cgfqii32.exeC:\Windows\system32\Cgfqii32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Windows\SysWOW64\Cmbiap32.exeC:\Windows\system32\Cmbiap32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2776 -
C:\Windows\SysWOW64\Cmgblphf.exeC:\Windows\system32\Cmgblphf.exe33⤵
- Executes dropped EXE
PID:2608 -
C:\Windows\SysWOW64\Cbfhjfdk.exeC:\Windows\system32\Cbfhjfdk.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2304 -
C:\Windows\SysWOW64\Dkolblkk.exeC:\Windows\system32\Dkolblkk.exe35⤵
- Executes dropped EXE
- Modifies registry class
PID:2068 -
C:\Windows\SysWOW64\Danaqbgp.exeC:\Windows\system32\Danaqbgp.exe36⤵
- Executes dropped EXE
PID:1100 -
C:\Windows\SysWOW64\Dnbbjf32.exeC:\Windows\system32\Dnbbjf32.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2888 -
C:\Windows\SysWOW64\Dlfbck32.exeC:\Windows\system32\Dlfbck32.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2700 -
C:\Windows\SysWOW64\Epjdbn32.exeC:\Windows\system32\Epjdbn32.exe39⤵
- Executes dropped EXE
- Modifies registry class
PID:2568 -
C:\Windows\SysWOW64\Emnelbdi.exeC:\Windows\system32\Emnelbdi.exe40⤵
- Executes dropped EXE
PID:1148 -
C:\Windows\SysWOW64\Ehjbaooe.exeC:\Windows\system32\Ehjbaooe.exe41⤵
- Executes dropped EXE
PID:2908 -
C:\Windows\SysWOW64\Eabgjeef.exeC:\Windows\system32\Eabgjeef.exe42⤵
- Executes dropped EXE
PID:2512 -
C:\Windows\SysWOW64\Fkmhij32.exeC:\Windows\system32\Fkmhij32.exe43⤵
- Executes dropped EXE
PID:976 -
C:\Windows\SysWOW64\Fdemap32.exeC:\Windows\system32\Fdemap32.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1848 -
C:\Windows\SysWOW64\Fokaoh32.exeC:\Windows\system32\Fokaoh32.exe45⤵
- Executes dropped EXE
PID:2580 -
C:\Windows\SysWOW64\Fkbadifn.exeC:\Windows\system32\Fkbadifn.exe46⤵
- Executes dropped EXE
PID:1000 -
C:\Windows\SysWOW64\Fkdoii32.exeC:\Windows\system32\Fkdoii32.exe47⤵
- Executes dropped EXE
PID:2164 -
C:\Windows\SysWOW64\Ggkoojip.exeC:\Windows\system32\Ggkoojip.exe48⤵
- Executes dropped EXE
PID:1988 -
C:\Windows\SysWOW64\Gdophn32.exeC:\Windows\system32\Gdophn32.exe49⤵
- Executes dropped EXE
PID:2132 -
C:\Windows\SysWOW64\Gngdadoj.exeC:\Windows\system32\Gngdadoj.exe50⤵
- Executes dropped EXE
PID:1632 -
C:\Windows\SysWOW64\Gebiefle.exeC:\Windows\system32\Gebiefle.exe51⤵
- Executes dropped EXE
PID:1740 -
C:\Windows\SysWOW64\Gaiijgbi.exeC:\Windows\system32\Gaiijgbi.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2144 -
C:\Windows\SysWOW64\Gcifdj32.exeC:\Windows\system32\Gcifdj32.exe53⤵
- Executes dropped EXE
PID:2816 -
C:\Windows\SysWOW64\Hopgikop.exeC:\Windows\system32\Hopgikop.exe54⤵
- Executes dropped EXE
PID:2916 -
C:\Windows\SysWOW64\Hdloab32.exeC:\Windows\system32\Hdloab32.exe55⤵
- Executes dropped EXE
PID:2876 -
C:\Windows\SysWOW64\Hnecjgch.exeC:\Windows\system32\Hnecjgch.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2924 -
C:\Windows\SysWOW64\Hjkdoh32.exeC:\Windows\system32\Hjkdoh32.exe57⤵
- Executes dropped EXE
PID:2416 -
C:\Windows\SysWOW64\Hgpeimhf.exeC:\Windows\system32\Hgpeimhf.exe58⤵
- Executes dropped EXE
PID:1688 -
C:\Windows\SysWOW64\Hfdbji32.exeC:\Windows\system32\Hfdbji32.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3052 -
C:\Windows\SysWOW64\Homfboco.exeC:\Windows\system32\Homfboco.exe60⤵
- Executes dropped EXE
PID:2952 -
C:\Windows\SysWOW64\Iijdfc32.exeC:\Windows\system32\Iijdfc32.exe61⤵
- Executes dropped EXE
PID:1448 -
C:\Windows\SysWOW64\Iilalc32.exeC:\Windows\system32\Iilalc32.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2504 -
C:\Windows\SysWOW64\Iionacad.exeC:\Windows\system32\Iionacad.exe63⤵
- Executes dropped EXE
- Modifies registry class
PID:1160 -
C:\Windows\SysWOW64\Ijpjik32.exeC:\Windows\system32\Ijpjik32.exe64⤵
- Executes dropped EXE
PID:2576 -
C:\Windows\SysWOW64\Jchobqnc.exeC:\Windows\system32\Jchobqnc.exe65⤵
- Executes dropped EXE
PID:1552 -
C:\Windows\SysWOW64\Jgfghodj.exeC:\Windows\system32\Jgfghodj.exe66⤵PID:288
-
C:\Windows\SysWOW64\Jfkdik32.exeC:\Windows\system32\Jfkdik32.exe67⤵PID:1816
-
C:\Windows\SysWOW64\Jpdibapb.exeC:\Windows\system32\Jpdibapb.exe68⤵
- System Location Discovery: System Language Discovery
PID:948 -
C:\Windows\SysWOW64\Jmhile32.exeC:\Windows\system32\Jmhile32.exe69⤵
- System Location Discovery: System Language Discovery
PID:1920 -
C:\Windows\SysWOW64\Jcaahofh.exeC:\Windows\system32\Jcaahofh.exe70⤵PID:1540
-
C:\Windows\SysWOW64\Klmfmacc.exeC:\Windows\system32\Klmfmacc.exe71⤵PID:2468
-
C:\Windows\SysWOW64\Klocba32.exeC:\Windows\system32\Klocba32.exe72⤵PID:2920
-
C:\Windows\SysWOW64\Kjdpcnfi.exeC:\Windows\system32\Kjdpcnfi.exe73⤵PID:2740
-
C:\Windows\SysWOW64\Kldlmqml.exeC:\Windows\system32\Kldlmqml.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2940 -
C:\Windows\SysWOW64\Kdoaackf.exeC:\Windows\system32\Kdoaackf.exe75⤵PID:2028
-
C:\Windows\SysWOW64\Kacakgip.exeC:\Windows\system32\Kacakgip.exe76⤵
- Modifies registry class
PID:2812 -
C:\Windows\SysWOW64\Lgpjcnhh.exeC:\Windows\system32\Lgpjcnhh.exe77⤵PID:2500
-
C:\Windows\SysWOW64\Lbgkhoml.exeC:\Windows\system32\Lbgkhoml.exe78⤵PID:2004
-
C:\Windows\SysWOW64\Lpkkbcle.exeC:\Windows\system32\Lpkkbcle.exe79⤵PID:2248
-
C:\Windows\SysWOW64\Lmolkg32.exeC:\Windows\system32\Lmolkg32.exe80⤵PID:1536
-
C:\Windows\SysWOW64\Lielphqc.exeC:\Windows\system32\Lielphqc.exe81⤵
- Drops file in System32 directory
PID:2480 -
C:\Windows\SysWOW64\Lobehpok.exeC:\Windows\system32\Lobehpok.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2220 -
C:\Windows\SysWOW64\Lhkiae32.exeC:\Windows\system32\Lhkiae32.exe83⤵
- System Location Discovery: System Language Discovery
PID:2156 -
C:\Windows\SysWOW64\Macnjk32.exeC:\Windows\system32\Macnjk32.exe84⤵PID:696
-
C:\Windows\SysWOW64\Mognco32.exeC:\Windows\system32\Mognco32.exe85⤵
- Modifies registry class
PID:1456 -
C:\Windows\SysWOW64\Mnlkdk32.exeC:\Windows\system32\Mnlkdk32.exe86⤵PID:524
-
C:\Windows\SysWOW64\Mgdpnqfn.exeC:\Windows\system32\Mgdpnqfn.exe87⤵PID:2280
-
C:\Windows\SysWOW64\Mdhpgeeg.exeC:\Windows\system32\Mdhpgeeg.exe88⤵PID:2096
-
C:\Windows\SysWOW64\Mnqdpj32.exeC:\Windows\system32\Mnqdpj32.exe89⤵
- Modifies registry class
PID:2840 -
C:\Windows\SysWOW64\Ncnmhajo.exeC:\Windows\system32\Ncnmhajo.exe90⤵PID:3000
-
C:\Windows\SysWOW64\Nodnmb32.exeC:\Windows\system32\Nodnmb32.exe91⤵PID:2708
-
C:\Windows\SysWOW64\Nogjbbma.exeC:\Windows\system32\Nogjbbma.exe92⤵PID:832
-
C:\Windows\SysWOW64\Nmkklflj.exeC:\Windows\system32\Nmkklflj.exe93⤵PID:2956
-
C:\Windows\SysWOW64\Nfcoel32.exeC:\Windows\system32\Nfcoel32.exe94⤵PID:2152
-
C:\Windows\SysWOW64\Nokdnail.exeC:\Windows\system32\Nokdnail.exe95⤵
- Drops file in System32 directory
PID:584 -
C:\Windows\SysWOW64\Nkbdbbop.exeC:\Windows\system32\Nkbdbbop.exe96⤵
- System Location Discovery: System Language Discovery
PID:1728 -
C:\Windows\SysWOW64\Oifelfni.exeC:\Windows\system32\Oifelfni.exe97⤵PID:2012
-
C:\Windows\SysWOW64\Ocpfmd32.exeC:\Windows\system32\Ocpfmd32.exe98⤵PID:1712
-
C:\Windows\SysWOW64\Ojjnioae.exeC:\Windows\system32\Ojjnioae.exe99⤵PID:1640
-
C:\Windows\SysWOW64\Ocbbbd32.exeC:\Windows\system32\Ocbbbd32.exe100⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2680 -
C:\Windows\SysWOW64\Ocdohdfc.exeC:\Windows\system32\Ocdohdfc.exe101⤵
- Drops file in System32 directory
PID:1356 -
C:\Windows\SysWOW64\Ommdqi32.exeC:\Windows\system32\Ommdqi32.exe102⤵
- Drops file in System32 directory
PID:1596 -
C:\Windows\SysWOW64\Obilip32.exeC:\Windows\system32\Obilip32.exe103⤵
- System Location Discovery: System Language Discovery
PID:2928 -
C:\Windows\SysWOW64\Plbaafak.exeC:\Windows\system32\Plbaafak.exe104⤵PID:2596
-
C:\Windows\SysWOW64\Pppihdha.exeC:\Windows\system32\Pppihdha.exe105⤵PID:1660
-
C:\Windows\SysWOW64\Phknlfem.exeC:\Windows\system32\Phknlfem.exe106⤵
- Drops file in System32 directory
PID:1168 -
C:\Windows\SysWOW64\Pligbekc.exeC:\Windows\system32\Pligbekc.exe107⤵PID:2764
-
C:\Windows\SysWOW64\Pafpjljk.exeC:\Windows\system32\Pafpjljk.exe108⤵PID:2172
-
C:\Windows\SysWOW64\Pjndca32.exeC:\Windows\system32\Pjndca32.exe109⤵PID:2232
-
C:\Windows\SysWOW64\Qfedhb32.exeC:\Windows\system32\Qfedhb32.exe110⤵PID:1996
-
C:\Windows\SysWOW64\Qdieaf32.exeC:\Windows\system32\Qdieaf32.exe111⤵PID:1124
-
C:\Windows\SysWOW64\Aamekk32.exeC:\Windows\system32\Aamekk32.exe112⤵
- System Location Discovery: System Language Discovery
PID:1052 -
C:\Windows\SysWOW64\Amcfpl32.exeC:\Windows\system32\Amcfpl32.exe113⤵PID:1992
-
C:\Windows\SysWOW64\Adnomfqc.exeC:\Windows\system32\Adnomfqc.exe114⤵PID:332
-
C:\Windows\SysWOW64\Apdobg32.exeC:\Windows\system32\Apdobg32.exe115⤵PID:2804
-
C:\Windows\SysWOW64\Ahpdficc.exeC:\Windows\system32\Ahpdficc.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2980 -
C:\Windows\SysWOW64\Bhiglh32.exeC:\Windows\system32\Bhiglh32.exe117⤵PID:2716
-
C:\Windows\SysWOW64\Baakem32.exeC:\Windows\system32\Baakem32.exe118⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2772 -
C:\Windows\SysWOW64\Bkjpncii.exeC:\Windows\system32\Bkjpncii.exe119⤵PID:580
-
C:\Windows\SysWOW64\Bpfhfjgq.exeC:\Windows\system32\Bpfhfjgq.exe120⤵
- Drops file in System32 directory
PID:3028 -
C:\Windows\SysWOW64\Bgqqcd32.exeC:\Windows\system32\Bgqqcd32.exe121⤵
- Modifies registry class
PID:2212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-