Analysis
-
max time kernel
97s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 12:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
51bcddbb83eac089b21e9696116c34e2d0b0a020d87eafadf16b31b95c0e45b4.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
51bcddbb83eac089b21e9696116c34e2d0b0a020d87eafadf16b31b95c0e45b4.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
51bcddbb83eac089b21e9696116c34e2d0b0a020d87eafadf16b31b95c0e45b4.exe
-
Size
250KB
-
MD5
ee75bb92f5f781f165f8db400c31cc72
-
SHA1
ab3a1b8a56df097529339554a5e019b074fdcb02
-
SHA256
51bcddbb83eac089b21e9696116c34e2d0b0a020d87eafadf16b31b95c0e45b4
-
SHA512
139f7eaa4e5b935c3d28b807f64a205276a8bd9bf2626a3b3d286a1a32675db4f8a290aabbd6588e620c7e6e7be3d030e460305dac0dbeca650616b01805b52e
-
SSDEEP
6144:G6iAb2ydPvCvfmZ7KRRRGBCvfmZ7KFpNlJTBCvfmZ79:G6j2yQ
Score
10/10
Malware Config
Extracted
Family
berbew
C2
http://tat-neftbank.ru/kkq.php
http://tat-neftbank.ru/wcmd.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Jflfbdqe.exeOigokj32.exeAjnnipnc.exePelpgb32.exeJjjfbikh.exeCioohh32.exeFimpcc32.exePonadfim.exePgkqeo32.exePaagkq32.exeLpjiik32.exeMdidhfdp.exeOmdbdb32.exeDbadcdgp.exeHfiloiik.exeBnemnbmm.exeCplkehnk.exeAjnlqgfo.exeDedkbb32.exeGklkdn32.exeHfjfpkji.exePhckglbq.exeJdfqomom.exeEhnmgo32.exeMmlfcn32.exeDnlolhoo.exeJfadoaih.exeIanmke32.exeGcpfbhof.exeBnhqll32.exeAqimoc32.exePpejmj32.exePofnok32.exeBbhikcpn.exeKiifjd32.exeHpincd32.exePkjkdfjk.exeQklhifhi.exeAcnpjj32.exeDanaqbgp.exeHhpjfoji.exeAkpfmnmh.exeNdaaclac.exeDehdpnok.exeGnaadb32.exeCghmni32.exeMeojkide.exeNmccnc32.exeFbkgjgqi.exeMjgclcjh.exeModano32.exeLpnlid32.exeNhhfbd32.exeFpihnbmk.exeGkiooocb.exeIbplji32.exeEedijo32.exeMpgdaqmh.exeHddgkj32.exeDlblmh32.exeKnbjgq32.exeLdfgbb32.exeAlkpgh32.exePbdhbnnp.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jflfbdqe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oigokj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ajnnipnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pelpgb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jjjfbikh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cioohh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fimpcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ponadfim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pgkqeo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Paagkq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lpjiik32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdidhfdp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Omdbdb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dbadcdgp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hfiloiik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bnemnbmm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cplkehnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ajnlqgfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dedkbb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gklkdn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hfjfpkji.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phckglbq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdfqomom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ehnmgo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mmlfcn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnlolhoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jfadoaih.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ianmke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gcpfbhof.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnhqll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aqimoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ppejmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pofnok32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bbhikcpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kiifjd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hpincd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pkjkdfjk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qklhifhi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Acnpjj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Danaqbgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hhpjfoji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Akpfmnmh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndaaclac.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dehdpnok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gnaadb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cghmni32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Meojkide.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nmccnc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbkgjgqi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjgclcjh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Modano32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lpnlid32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhhfbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fpihnbmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gkiooocb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ibplji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eedijo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mpgdaqmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hddgkj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dlblmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Knbjgq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldfgbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Alkpgh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pbdhbnnp.exe -
Berbew family
-
Executes dropped EXE 64 IoCs
Processes:
Kgjelg32.exeKoejqi32.exeKfobmc32.exeKccbgh32.exeLmfjcajl.exeMogcelgm.exeMcghajkq.exeNiijdq32.exeNadoiccn.exeNakeib32.exeNmbenc32.exeOmdbdb32.exeOheieo32.exePdljjplb.exePimlmf32.exeAgloko32.exeAhllda32.exeAqimoc32.exeAfhbljko.exeBbocak32.exeBnhqll32.exeCmbghgdg.exeCgjhkpbj.exeCinahhff.exeDomffn32.exeDodlfmlb.exeDabicikf.exeEhonebqq.exeEplood32.exeEoalpaaa.exeFadagl32.exeFebjmj32.exeFjdpgnee.exeFghppa32.exeFcoaebjc.exeGfpjgn32.exeGcfgfack.exeGfgpgmql.exeHminbkql.exeHmlkhk32.exeHbkpfa32.exeHiehbl32.exeIlfadg32.exeIlhnjfmi.exeIagchmjn.exeImndmnob.exeJmpqbnmp.exeJfiekc32.exeJdmfdgbj.exeJlhjijpe.exeJilkbn32.exeJoicje32.exeKaillp32.exeKhcdijac.exeKaliaphd.exeKlamohhj.exeKnbjgq32.exeKgknpfdi.exeLllpclnk.exeLpjiik32.exeLoofjg32.exeLlcfck32.exeLflklaoc.exeMdahnmck.exepid Process 2284 Kgjelg32.exe 2836 Koejqi32.exe 2864 Kfobmc32.exe 2920 Kccbgh32.exe 2576 Lmfjcajl.exe 2716 Mogcelgm.exe 2448 Mcghajkq.exe 2092 Niijdq32.exe 2552 Nadoiccn.exe 2364 Nakeib32.exe 1732 Nmbenc32.exe 1528 Omdbdb32.exe 2276 Oheieo32.exe 2660 Pdljjplb.exe 2240 Pimlmf32.exe 1256 Agloko32.exe 1584 Ahllda32.exe 2812 Aqimoc32.exe 1664 Afhbljko.exe 1856 Bbocak32.exe 2224 Bnhqll32.exe 1636 Cmbghgdg.exe 900 Cgjhkpbj.exe 868 Cinahhff.exe 2164 Domffn32.exe 2052 Dodlfmlb.exe 3052 Dabicikf.exe 2880 Ehonebqq.exe 1740 Eplood32.exe 2748 Eoalpaaa.exe 2728 Fadagl32.exe 2188 Febjmj32.exe 2828 Fjdpgnee.exe 1468 Fghppa32.exe 1772 Fcoaebjc.exe 1520 Gfpjgn32.exe 2924 Gcfgfack.exe 2136 Gfgpgmql.exe 1056 Hminbkql.exe 892 Hmlkhk32.exe 2296 Hbkpfa32.exe 816 Hiehbl32.exe 756 Ilfadg32.exe 3048 Ilhnjfmi.exe 2600 Iagchmjn.exe 1516 Imndmnob.exe 864 Jmpqbnmp.exe 2332 Jfiekc32.exe 596 Jdmfdgbj.exe 2384 Jlhjijpe.exe 1596 Jilkbn32.exe 2892 Joicje32.exe 2900 Kaillp32.exe 2784 Khcdijac.exe 2796 Kaliaphd.exe 2372 Klamohhj.exe 3020 Knbjgq32.exe 1500 Kgknpfdi.exe 2908 Lllpclnk.exe 1752 Lpjiik32.exe 2208 Loofjg32.exe 1644 Llcfck32.exe 616 Lflklaoc.exe 2708 Mdahnmck.exe -
Loads dropped DLL 64 IoCs
Processes:
51bcddbb83eac089b21e9696116c34e2d0b0a020d87eafadf16b31b95c0e45b4.exeKgjelg32.exeKoejqi32.exeKfobmc32.exeKccbgh32.exeLmfjcajl.exeMogcelgm.exeMcghajkq.exeNiijdq32.exeNadoiccn.exeNakeib32.exeNmbenc32.exeOmdbdb32.exeOheieo32.exePdljjplb.exePimlmf32.exeAgloko32.exeAhllda32.exeAqimoc32.exeAfhbljko.exeBbocak32.exeBnhqll32.exeCmbghgdg.exeCgjhkpbj.exeCinahhff.exeDomffn32.exeDodlfmlb.exeDabicikf.exeEhonebqq.exeEplood32.exeEoalpaaa.exeFadagl32.exepid Process 2476 51bcddbb83eac089b21e9696116c34e2d0b0a020d87eafadf16b31b95c0e45b4.exe 2476 51bcddbb83eac089b21e9696116c34e2d0b0a020d87eafadf16b31b95c0e45b4.exe 2284 Kgjelg32.exe 2284 Kgjelg32.exe 2836 Koejqi32.exe 2836 Koejqi32.exe 2864 Kfobmc32.exe 2864 Kfobmc32.exe 2920 Kccbgh32.exe 2920 Kccbgh32.exe 2576 Lmfjcajl.exe 2576 Lmfjcajl.exe 2716 Mogcelgm.exe 2716 Mogcelgm.exe 2448 Mcghajkq.exe 2448 Mcghajkq.exe 2092 Niijdq32.exe 2092 Niijdq32.exe 2552 Nadoiccn.exe 2552 Nadoiccn.exe 2364 Nakeib32.exe 2364 Nakeib32.exe 1732 Nmbenc32.exe 1732 Nmbenc32.exe 1528 Omdbdb32.exe 1528 Omdbdb32.exe 2276 Oheieo32.exe 2276 Oheieo32.exe 2660 Pdljjplb.exe 2660 Pdljjplb.exe 2240 Pimlmf32.exe 2240 Pimlmf32.exe 1256 Agloko32.exe 1256 Agloko32.exe 1584 Ahllda32.exe 1584 Ahllda32.exe 2812 Aqimoc32.exe 2812 Aqimoc32.exe 1664 Afhbljko.exe 1664 Afhbljko.exe 1856 Bbocak32.exe 1856 Bbocak32.exe 2224 Bnhqll32.exe 2224 Bnhqll32.exe 1636 Cmbghgdg.exe 1636 Cmbghgdg.exe 900 Cgjhkpbj.exe 900 Cgjhkpbj.exe 868 Cinahhff.exe 868 Cinahhff.exe 2164 Domffn32.exe 2164 Domffn32.exe 2052 Dodlfmlb.exe 2052 Dodlfmlb.exe 3052 Dabicikf.exe 3052 Dabicikf.exe 2880 Ehonebqq.exe 2880 Ehonebqq.exe 1740 Eplood32.exe 1740 Eplood32.exe 2748 Eoalpaaa.exe 2748 Eoalpaaa.exe 2728 Fadagl32.exe 2728 Fadagl32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Kkkgnmqb.exeOmdbdb32.exeHfiofefm.exeLkhfhaea.exeDlblmh32.exeKoejqi32.exeIngmoj32.exeMoomgmpm.exeNocgbl32.exeFjnkac32.exeAimfcedl.exeFimgmj32.exeIpedihgm.exeOedclm32.exeHkiknb32.exeHnmcne32.exePgkqeo32.exeGnlbpman.exeFcegdnna.exeBhdmahpn.exePjafbfca.exePonadfim.exePieodn32.exeEacnpoqi.exeFldeakgp.exeGflfidpl.exeGdophn32.exeAndlmnki.exeNolhoc32.exeDpjhcj32.exeGddpndhp.exeOfaaghom.exeCocnanmd.exeNpgknf32.exePmlngdhk.exeDfjegl32.exeKknkncbl.exeMbiadm32.exeHafppp32.exeGomjckqc.exeCkboba32.exeLjakkd32.exeJfkdik32.exeNhdjdk32.exeIadphghe.exeJffakm32.exePpcmhj32.exeKiojqfdp.exePpnmbd32.exeKiifjd32.exeJilkbn32.exePfhghgie.exeBmcnmapk.exeFdafkm32.exeQfbahldf.exeEhonebqq.exeEmailhfb.exeDlcfnk32.exeQjcmoqlf.exeGnaadb32.exe51bcddbb83eac089b21e9696116c34e2d0b0a020d87eafadf16b31b95c0e45b4.exeJoicje32.exeOqomkimg.exePligbekc.exedescription ioc Process File created C:\Windows\SysWOW64\Pabhlikn.dll Kkkgnmqb.exe File opened for modification C:\Windows\SysWOW64\Oheieo32.exe Omdbdb32.exe File opened for modification C:\Windows\SysWOW64\Hnecjgch.exe Hfiofefm.exe File created C:\Windows\SysWOW64\Mijmfogh.dll Lkhfhaea.exe File opened for modification C:\Windows\SysWOW64\Ddmaak32.exe Dlblmh32.exe File opened for modification C:\Windows\SysWOW64\Kfobmc32.exe Koejqi32.exe File created C:\Windows\SysWOW64\Igoagpja.exe Ingmoj32.exe File opened for modification C:\Windows\SysWOW64\Nkfnln32.exe Moomgmpm.exe File opened for modification C:\Windows\SysWOW64\Ngolgn32.exe Nocgbl32.exe File opened for modification C:\Windows\SysWOW64\Fecool32.exe Fjnkac32.exe File created C:\Windows\SysWOW64\Bbhgbj32.exe Aimfcedl.exe File opened for modification C:\Windows\SysWOW64\Fpgpjdnf.exe Fimgmj32.exe File created C:\Windows\SysWOW64\Nlngdfab.dll Ipedihgm.exe File opened for modification C:\Windows\SysWOW64\Ohcohh32.exe Oedclm32.exe File opened for modification C:\Windows\SysWOW64\Hfookk32.exe Hkiknb32.exe File created C:\Windows\SysWOW64\Gffppc32.dll Hnmcne32.exe File created C:\Windows\SysWOW64\Cmfdmc32.dll Pgkqeo32.exe File opened for modification C:\Windows\SysWOW64\Glpbiaqg.exe Gnlbpman.exe File opened for modification C:\Windows\SysWOW64\Fpihnbmk.exe Fcegdnna.exe File created C:\Windows\SysWOW64\Jqiipm32.dll Bhdmahpn.exe File created C:\Windows\SysWOW64\Bdlhjkpi.dll Pjafbfca.exe File created C:\Windows\SysWOW64\Qpojak32.dll Ponadfim.exe File opened for modification C:\Windows\SysWOW64\Pcmcmcjc.exe Pieodn32.exe File created C:\Windows\SysWOW64\Ecdkgg32.exe Eacnpoqi.exe File created C:\Windows\SysWOW64\Fcnmne32.exe Fldeakgp.exe File opened for modification C:\Windows\SysWOW64\Gcpfbhof.exe Gflfidpl.exe File opened for modification C:\Windows\SysWOW64\Gljdlq32.exe Gdophn32.exe File created C:\Windows\SysWOW64\Aaeeoihj.exe Andlmnki.exe File created C:\Windows\SysWOW64\Iijjpgeh.dll Nolhoc32.exe File created C:\Windows\SysWOW64\Dgemgm32.exe Dpjhcj32.exe File opened for modification C:\Windows\SysWOW64\Gnmdfi32.exe Gddpndhp.exe File created C:\Windows\SysWOW64\Oceaql32.exe Ofaaghom.exe File opened for modification C:\Windows\SysWOW64\Cgnbepjp.exe Cocnanmd.exe File created C:\Windows\SysWOW64\Nolhoc32.exe Npgknf32.exe File created C:\Windows\SysWOW64\Bmmcnf32.dll Pmlngdhk.exe File created C:\Windows\SysWOW64\Bjeecj32.dll Dfjegl32.exe File created C:\Windows\SysWOW64\Ibmlepmp.dll Kknkncbl.exe File created C:\Windows\SysWOW64\Fojkij32.dll Mbiadm32.exe File opened for modification C:\Windows\SysWOW64\Icdllk32.exe Hafppp32.exe File opened for modification C:\Windows\SysWOW64\Gheola32.exe Gomjckqc.exe File created C:\Windows\SysWOW64\Jjamhe32.dll Ckboba32.exe File created C:\Windows\SysWOW64\Legohm32.exe Ljakkd32.exe File created C:\Windows\SysWOW64\Jfnaok32.exe Jfkdik32.exe File opened for modification C:\Windows\SysWOW64\Nehjmppo.exe Nhdjdk32.exe File created C:\Windows\SysWOW64\Pqpbhhnh.dll Iadphghe.exe File created C:\Windows\SysWOW64\Jaoblk32.exe Jffakm32.exe File opened for modification C:\Windows\SysWOW64\Ppejmj32.exe Ppcmhj32.exe File created C:\Windows\SysWOW64\Lgmcjjhp.dll Kiojqfdp.exe File opened for modification C:\Windows\SysWOW64\Pblinp32.exe Ppnmbd32.exe File created C:\Windows\SysWOW64\Dopnodpc.dll Kiifjd32.exe File opened for modification C:\Windows\SysWOW64\Joicje32.exe Jilkbn32.exe File opened for modification C:\Windows\SysWOW64\Poplqm32.exe Pfhghgie.exe File created C:\Windows\SysWOW64\Blhkon32.exe Bmcnmapk.exe File created C:\Windows\SysWOW64\Lkmhbpqc.dll Fdafkm32.exe File opened for modification C:\Windows\SysWOW64\Qfdnnlbc.exe Qfbahldf.exe File created C:\Windows\SysWOW64\Eplood32.exe Ehonebqq.exe File opened for modification C:\Windows\SysWOW64\Egimdmmc.exe Emailhfb.exe File opened for modification C:\Windows\SysWOW64\Dlfbck32.exe Dlcfnk32.exe File opened for modification C:\Windows\SysWOW64\Alfflhpa.exe Qjcmoqlf.exe File opened for modification C:\Windows\SysWOW64\Gflfidpl.exe Gnaadb32.exe File created C:\Windows\SysWOW64\Ednoomga.dll 51bcddbb83eac089b21e9696116c34e2d0b0a020d87eafadf16b31b95c0e45b4.exe File opened for modification C:\Windows\SysWOW64\Kaillp32.exe Joicje32.exe File created C:\Windows\SysWOW64\Ojgado32.exe Oqomkimg.exe File opened for modification C:\Windows\SysWOW64\Pngcnpkg.exe Pligbekc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 1612 1724 WerFault.exe 911 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Oedclm32.exeIkmjnnah.exeIogbllfc.exePclolakk.exeAjibeg32.exeAgmbolin.exeKcbfjaeq.exeHnfnik32.exePhckglbq.exeGaffja32.exePoplqm32.exeFhjcmcep.exeFjchnclk.exeFjdpgnee.exeBdknfiea.exeBoakgapg.exeJgbkdkdk.exeGiolpo32.exeGklkdn32.exeJgbpfhpc.exeAflmbj32.exeDocjpa32.exeFnnbfjmp.exeIfeenfjm.exeFecool32.exeKoejqi32.exeCnekcblk.exeCioohh32.exeLgnnicpe.exeLddagi32.exeJmcpqfba.exeAnbohn32.exeMjpmkdpp.exeMeojkide.exeMlhbgc32.exeFcnmne32.exeDohnfc32.exeBnojpdfb.exeHpaaho32.exeEpkhfkco.exeKkomepon.exeMacpcccp.exeBngicb32.exeFadagl32.exeKcahjqfa.exeChdlidjm.exeEmeejpjc.exeEdpnfjap.exeCfjdfg32.exeKceganoe.exeHjkdoh32.exeEgobfdpi.exeDnkggjpj.exeEacnpoqi.exeLpqnpacp.exeGnlbpman.exeOiebej32.exeHqpjndio.exeEbkndibq.exeBkgchckl.exeBhlmef32.exeHlamfh32.exeOcbnqfln.exeJinkkgeb.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oedclm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikmjnnah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iogbllfc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pclolakk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajibeg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Agmbolin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kcbfjaeq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hnfnik32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phckglbq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaffja32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Poplqm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fhjcmcep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjchnclk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjdpgnee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bdknfiea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Boakgapg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgbkdkdk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Giolpo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gklkdn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgbpfhpc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aflmbj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Docjpa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnnbfjmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ifeenfjm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fecool32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Koejqi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnekcblk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cioohh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgnnicpe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lddagi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jmcpqfba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Anbohn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjpmkdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Meojkide.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlhbgc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fcnmne32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dohnfc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bnojpdfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpaaho32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epkhfkco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkomepon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Macpcccp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bngicb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fadagl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kcahjqfa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chdlidjm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emeejpjc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edpnfjap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfjdfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kceganoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hjkdoh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Egobfdpi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dnkggjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eacnpoqi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpqnpacp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnlbpman.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oiebej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hqpjndio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebkndibq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bkgchckl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhlmef32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hlamfh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocbnqfln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jinkkgeb.exe -
Modifies registry class 64 IoCs
Processes:
Jilkbn32.exeLdlghhde.exeMpgdaqmh.exeDddodd32.exeChfadndo.exeJngfei32.exeBqhbcqmj.exeJfadoaih.exeEeameodq.exeNhjofbdk.exeOjjqbg32.exeGjomlp32.exeLbffga32.exeHacabgig.exeGcbchhmc.exeLjakkd32.exeGqgjlb32.exeGfclic32.exeKoejqi32.exeNnfeep32.exeHqpjndio.exeHfalaj32.exeCghmni32.exeGaffja32.exeOmdbfo32.exeOelcho32.exePbnfdpge.exeGflfidpl.exeAfhbljko.exeCmbghgdg.exeBpdkajic.exeEgobfdpi.exeQmoone32.exeMeojkide.exeGdpikmci.exeAgmbolin.exeGklkdn32.exeLkahbkgk.exeDohnfc32.exePcdnpp32.exeEnajgllm.exeEmeejpjc.exeDlcfnk32.exeFdemap32.exeHnapja32.exeCgnbepjp.exeLebemmbk.exeEcdkgg32.exeEgepce32.exeIogbllfc.exeNaqkki32.exeNjiocobg.exeNhombc32.exeEgimdmmc.exeKcahjqfa.exeHhpjfoji.exeDcdlpklh.exeJjjaak32.exePkjkdfjk.exeNnkekfkd.exeMgebfi32.exeGcpdip32.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jilkbn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ldlghhde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mpgdaqmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqgocpbb.dll" Dddodd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnmaofkf.dll" Chfadndo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jngfei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffofoi32.dll" Bqhbcqmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jfadoaih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epjlaj32.dll" Eeameodq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nhjofbdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djocmfki.dll" Ojjqbg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gjomlp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obaqpg32.dll" Lbffga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfoahl32.dll" Hacabgig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gcbchhmc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ljakkd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gqgjlb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gfclic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpofcajk.dll" Koejqi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnhfacfn.dll" Nnfeep32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hqpjndio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hfalaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cghmni32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gaffja32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Omdbfo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjopen32.dll" Oelcho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pbnfdpge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhplce32.dll" Gflfidpl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Afhbljko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cmbghgdg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Palkjk32.dll" Bpdkajic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjoflo32.dll" Egobfdpi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qmoone32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knijji32.dll" Meojkide.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gdpikmci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkkeeb32.dll" Agmbolin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gklkdn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lkahbkgk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dohnfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahinlpqk.dll" Pcdnpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmoehh32.dll" Enajgllm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Emeejpjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogeckf32.dll" Dlcfnk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khhcfo32.dll" Fdemap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifhgoghp.dll" Hnapja32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cgnbepjp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lebemmbk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ecdkgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cignli32.dll" Egepce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qajkao32.dll" Gklkdn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iogbllfc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Felpcf32.dll" Jngfei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Naqkki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Njiocobg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjmbjd32.dll" Nhombc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndhfppje.dll" Egimdmmc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kcahjqfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hhpjfoji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adioke32.dll" Dcdlpklh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jjjaak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Genhid32.dll" Pkjkdfjk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lenapcbd.dll" Nnkekfkd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mgebfi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gcpdip32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
51bcddbb83eac089b21e9696116c34e2d0b0a020d87eafadf16b31b95c0e45b4.exeKgjelg32.exeKoejqi32.exeKfobmc32.exeKccbgh32.exeLmfjcajl.exeMogcelgm.exeMcghajkq.exeNiijdq32.exeNadoiccn.exeNakeib32.exeNmbenc32.exeOmdbdb32.exeOheieo32.exePdljjplb.exePimlmf32.exedescription pid Process procid_target PID 2476 wrote to memory of 2284 2476 51bcddbb83eac089b21e9696116c34e2d0b0a020d87eafadf16b31b95c0e45b4.exe 30 PID 2476 wrote to memory of 2284 2476 51bcddbb83eac089b21e9696116c34e2d0b0a020d87eafadf16b31b95c0e45b4.exe 30 PID 2476 wrote to memory of 2284 2476 51bcddbb83eac089b21e9696116c34e2d0b0a020d87eafadf16b31b95c0e45b4.exe 30 PID 2476 wrote to memory of 2284 2476 51bcddbb83eac089b21e9696116c34e2d0b0a020d87eafadf16b31b95c0e45b4.exe 30 PID 2284 wrote to memory of 2836 2284 Kgjelg32.exe 31 PID 2284 wrote to memory of 2836 2284 Kgjelg32.exe 31 PID 2284 wrote to memory of 2836 2284 Kgjelg32.exe 31 PID 2284 wrote to memory of 2836 2284 Kgjelg32.exe 31 PID 2836 wrote to memory of 2864 2836 Koejqi32.exe 32 PID 2836 wrote to memory of 2864 2836 Koejqi32.exe 32 PID 2836 wrote to memory of 2864 2836 Koejqi32.exe 32 PID 2836 wrote to memory of 2864 2836 Koejqi32.exe 32 PID 2864 wrote to memory of 2920 2864 Kfobmc32.exe 33 PID 2864 wrote to memory of 2920 2864 Kfobmc32.exe 33 PID 2864 wrote to memory of 2920 2864 Kfobmc32.exe 33 PID 2864 wrote to memory of 2920 2864 Kfobmc32.exe 33 PID 2920 wrote to memory of 2576 2920 Kccbgh32.exe 34 PID 2920 wrote to memory of 2576 2920 Kccbgh32.exe 34 PID 2920 wrote to memory of 2576 2920 Kccbgh32.exe 34 PID 2920 wrote to memory of 2576 2920 Kccbgh32.exe 34 PID 2576 wrote to memory of 2716 2576 Lmfjcajl.exe 35 PID 2576 wrote to memory of 2716 2576 Lmfjcajl.exe 35 PID 2576 wrote to memory of 2716 2576 Lmfjcajl.exe 35 PID 2576 wrote to memory of 2716 2576 Lmfjcajl.exe 35 PID 2716 wrote to memory of 2448 2716 Mogcelgm.exe 36 PID 2716 wrote to memory of 2448 2716 Mogcelgm.exe 36 PID 2716 wrote to memory of 2448 2716 Mogcelgm.exe 36 PID 2716 wrote to memory of 2448 2716 Mogcelgm.exe 36 PID 2448 wrote to memory of 2092 2448 Mcghajkq.exe 37 PID 2448 wrote to memory of 2092 2448 Mcghajkq.exe 37 PID 2448 wrote to memory of 2092 2448 Mcghajkq.exe 37 PID 2448 wrote to memory of 2092 2448 Mcghajkq.exe 37 PID 2092 wrote to memory of 2552 2092 Niijdq32.exe 38 PID 2092 wrote to memory of 2552 2092 Niijdq32.exe 38 PID 2092 wrote to memory of 2552 2092 Niijdq32.exe 38 PID 2092 wrote to memory of 2552 2092 Niijdq32.exe 38 PID 2552 wrote to memory of 2364 2552 Nadoiccn.exe 39 PID 2552 wrote to memory of 2364 2552 Nadoiccn.exe 39 PID 2552 wrote to memory of 2364 2552 Nadoiccn.exe 39 PID 2552 wrote to memory of 2364 2552 Nadoiccn.exe 39 PID 2364 wrote to memory of 1732 2364 Nakeib32.exe 40 PID 2364 wrote to memory of 1732 2364 Nakeib32.exe 40 PID 2364 wrote to memory of 1732 2364 Nakeib32.exe 40 PID 2364 wrote to memory of 1732 2364 Nakeib32.exe 40 PID 1732 wrote to memory of 1528 1732 Nmbenc32.exe 41 PID 1732 wrote to memory of 1528 1732 Nmbenc32.exe 41 PID 1732 wrote to memory of 1528 1732 Nmbenc32.exe 41 PID 1732 wrote to memory of 1528 1732 Nmbenc32.exe 41 PID 1528 wrote to memory of 2276 1528 Omdbdb32.exe 42 PID 1528 wrote to memory of 2276 1528 Omdbdb32.exe 42 PID 1528 wrote to memory of 2276 1528 Omdbdb32.exe 42 PID 1528 wrote to memory of 2276 1528 Omdbdb32.exe 42 PID 2276 wrote to memory of 2660 2276 Oheieo32.exe 43 PID 2276 wrote to memory of 2660 2276 Oheieo32.exe 43 PID 2276 wrote to memory of 2660 2276 Oheieo32.exe 43 PID 2276 wrote to memory of 2660 2276 Oheieo32.exe 43 PID 2660 wrote to memory of 2240 2660 Pdljjplb.exe 44 PID 2660 wrote to memory of 2240 2660 Pdljjplb.exe 44 PID 2660 wrote to memory of 2240 2660 Pdljjplb.exe 44 PID 2660 wrote to memory of 2240 2660 Pdljjplb.exe 44 PID 2240 wrote to memory of 1256 2240 Pimlmf32.exe 45 PID 2240 wrote to memory of 1256 2240 Pimlmf32.exe 45 PID 2240 wrote to memory of 1256 2240 Pimlmf32.exe 45 PID 2240 wrote to memory of 1256 2240 Pimlmf32.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\51bcddbb83eac089b21e9696116c34e2d0b0a020d87eafadf16b31b95c0e45b4.exe"C:\Users\Admin\AppData\Local\Temp\51bcddbb83eac089b21e9696116c34e2d0b0a020d87eafadf16b31b95c0e45b4.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\Kgjelg32.exeC:\Windows\system32\Kgjelg32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\Koejqi32.exeC:\Windows\system32\Koejqi32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\Kfobmc32.exeC:\Windows\system32\Kfobmc32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\Kccbgh32.exeC:\Windows\system32\Kccbgh32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\Lmfjcajl.exeC:\Windows\system32\Lmfjcajl.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\Mogcelgm.exeC:\Windows\system32\Mogcelgm.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\Mcghajkq.exeC:\Windows\system32\Mcghajkq.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\Niijdq32.exeC:\Windows\system32\Niijdq32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\Nadoiccn.exeC:\Windows\system32\Nadoiccn.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\Nakeib32.exeC:\Windows\system32\Nakeib32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\Nmbenc32.exeC:\Windows\system32\Nmbenc32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\Omdbdb32.exeC:\Windows\system32\Omdbdb32.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\Oheieo32.exeC:\Windows\system32\Oheieo32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\Pdljjplb.exeC:\Windows\system32\Pdljjplb.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\Pimlmf32.exeC:\Windows\system32\Pimlmf32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\Agloko32.exeC:\Windows\system32\Agloko32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Windows\SysWOW64\Ahllda32.exeC:\Windows\system32\Ahllda32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Windows\SysWOW64\Aqimoc32.exeC:\Windows\system32\Aqimoc32.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Windows\SysWOW64\Afhbljko.exeC:\Windows\system32\Afhbljko.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1664 -
C:\Windows\SysWOW64\Bbocak32.exeC:\Windows\system32\Bbocak32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Windows\SysWOW64\Bnhqll32.exeC:\Windows\system32\Bnhqll32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Windows\SysWOW64\Cmbghgdg.exeC:\Windows\system32\Cmbghgdg.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1636 -
C:\Windows\SysWOW64\Cgjhkpbj.exeC:\Windows\system32\Cgjhkpbj.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Windows\SysWOW64\Cinahhff.exeC:\Windows\system32\Cinahhff.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Windows\SysWOW64\Domffn32.exeC:\Windows\system32\Domffn32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Windows\SysWOW64\Dodlfmlb.exeC:\Windows\system32\Dodlfmlb.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Windows\SysWOW64\Dabicikf.exeC:\Windows\system32\Dabicikf.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Windows\SysWOW64\Ehonebqq.exeC:\Windows\system32\Ehonebqq.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2880 -
C:\Windows\SysWOW64\Eplood32.exeC:\Windows\system32\Eplood32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Windows\SysWOW64\Eoalpaaa.exeC:\Windows\system32\Eoalpaaa.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Windows\SysWOW64\Fadagl32.exeC:\Windows\system32\Fadagl32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2728 -
C:\Windows\SysWOW64\Febjmj32.exeC:\Windows\system32\Febjmj32.exe33⤵
- Executes dropped EXE
PID:2188 -
C:\Windows\SysWOW64\Fjdpgnee.exeC:\Windows\system32\Fjdpgnee.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2828 -
C:\Windows\SysWOW64\Fghppa32.exeC:\Windows\system32\Fghppa32.exe35⤵
- Executes dropped EXE
PID:1468 -
C:\Windows\SysWOW64\Fcoaebjc.exeC:\Windows\system32\Fcoaebjc.exe36⤵
- Executes dropped EXE
PID:1772 -
C:\Windows\SysWOW64\Gfpjgn32.exeC:\Windows\system32\Gfpjgn32.exe37⤵
- Executes dropped EXE
PID:1520 -
C:\Windows\SysWOW64\Gcfgfack.exeC:\Windows\system32\Gcfgfack.exe38⤵
- Executes dropped EXE
PID:2924 -
C:\Windows\SysWOW64\Gfgpgmql.exeC:\Windows\system32\Gfgpgmql.exe39⤵
- Executes dropped EXE
PID:2136 -
C:\Windows\SysWOW64\Hminbkql.exeC:\Windows\system32\Hminbkql.exe40⤵
- Executes dropped EXE
PID:1056 -
C:\Windows\SysWOW64\Hmlkhk32.exeC:\Windows\system32\Hmlkhk32.exe41⤵
- Executes dropped EXE
PID:892 -
C:\Windows\SysWOW64\Hbkpfa32.exeC:\Windows\system32\Hbkpfa32.exe42⤵
- Executes dropped EXE
PID:2296 -
C:\Windows\SysWOW64\Hiehbl32.exeC:\Windows\system32\Hiehbl32.exe43⤵
- Executes dropped EXE
PID:816 -
C:\Windows\SysWOW64\Ilfadg32.exeC:\Windows\system32\Ilfadg32.exe44⤵
- Executes dropped EXE
PID:756 -
C:\Windows\SysWOW64\Ilhnjfmi.exeC:\Windows\system32\Ilhnjfmi.exe45⤵
- Executes dropped EXE
PID:3048 -
C:\Windows\SysWOW64\Iagchmjn.exeC:\Windows\system32\Iagchmjn.exe46⤵
- Executes dropped EXE
PID:2600 -
C:\Windows\SysWOW64\Imndmnob.exeC:\Windows\system32\Imndmnob.exe47⤵
- Executes dropped EXE
PID:1516 -
C:\Windows\SysWOW64\Jmpqbnmp.exeC:\Windows\system32\Jmpqbnmp.exe48⤵
- Executes dropped EXE
PID:864 -
C:\Windows\SysWOW64\Jfiekc32.exeC:\Windows\system32\Jfiekc32.exe49⤵
- Executes dropped EXE
PID:2332 -
C:\Windows\SysWOW64\Jdmfdgbj.exeC:\Windows\system32\Jdmfdgbj.exe50⤵
- Executes dropped EXE
PID:596 -
C:\Windows\SysWOW64\Jlhjijpe.exeC:\Windows\system32\Jlhjijpe.exe51⤵
- Executes dropped EXE
PID:2384 -
C:\Windows\SysWOW64\Jilkbn32.exeC:\Windows\system32\Jilkbn32.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1596 -
C:\Windows\SysWOW64\Joicje32.exeC:\Windows\system32\Joicje32.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2892 -
C:\Windows\SysWOW64\Kaillp32.exeC:\Windows\system32\Kaillp32.exe54⤵
- Executes dropped EXE
PID:2900 -
C:\Windows\SysWOW64\Khcdijac.exeC:\Windows\system32\Khcdijac.exe55⤵
- Executes dropped EXE
PID:2784 -
C:\Windows\SysWOW64\Kaliaphd.exeC:\Windows\system32\Kaliaphd.exe56⤵
- Executes dropped EXE
PID:2796 -
C:\Windows\SysWOW64\Klamohhj.exeC:\Windows\system32\Klamohhj.exe57⤵
- Executes dropped EXE
PID:2372 -
C:\Windows\SysWOW64\Knbjgq32.exeC:\Windows\system32\Knbjgq32.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\Kgknpfdi.exeC:\Windows\system32\Kgknpfdi.exe59⤵
- Executes dropped EXE
PID:1500 -
C:\Windows\SysWOW64\Lllpclnk.exeC:\Windows\system32\Lllpclnk.exe60⤵
- Executes dropped EXE
PID:2908 -
C:\Windows\SysWOW64\Lpjiik32.exeC:\Windows\system32\Lpjiik32.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1752 -
C:\Windows\SysWOW64\Loofjg32.exeC:\Windows\system32\Loofjg32.exe62⤵
- Executes dropped EXE
PID:2208 -
C:\Windows\SysWOW64\Llcfck32.exeC:\Windows\system32\Llcfck32.exe63⤵
- Executes dropped EXE
PID:1644 -
C:\Windows\SysWOW64\Lflklaoc.exeC:\Windows\system32\Lflklaoc.exe64⤵
- Executes dropped EXE
PID:616 -
C:\Windows\SysWOW64\Mdahnmck.exeC:\Windows\system32\Mdahnmck.exe65⤵
- Executes dropped EXE
PID:2708 -
C:\Windows\SysWOW64\Mqhhbn32.exeC:\Windows\system32\Mqhhbn32.exe66⤵PID:1828
-
C:\Windows\SysWOW64\Mjpmkdpp.exeC:\Windows\system32\Mjpmkdpp.exe67⤵
- System Location Discovery: System Language Discovery
PID:836 -
C:\Windows\SysWOW64\Mjbiac32.exeC:\Windows\system32\Mjbiac32.exe68⤵PID:3044
-
C:\Windows\SysWOW64\Mgfjjh32.exeC:\Windows\system32\Mgfjjh32.exe69⤵PID:1760
-
C:\Windows\SysWOW64\Mpaoojjb.exeC:\Windows\system32\Mpaoojjb.exe70⤵PID:2944
-
C:\Windows\SysWOW64\Mjgclcjh.exeC:\Windows\system32\Mjgclcjh.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2456 -
C:\Windows\SysWOW64\Nbbhpegc.exeC:\Windows\system32\Nbbhpegc.exe72⤵PID:916
-
C:\Windows\SysWOW64\Nfppfcmj.exeC:\Windows\system32\Nfppfcmj.exe73⤵PID:2744
-
C:\Windows\SysWOW64\Nnkekfkd.exeC:\Windows\system32\Nnkekfkd.exe74⤵
- Modifies registry class
PID:1392 -
C:\Windows\SysWOW64\Nhdjdk32.exeC:\Windows\system32\Nhdjdk32.exe75⤵
- Drops file in System32 directory
PID:1248 -
C:\Windows\SysWOW64\Nehjmppo.exeC:\Windows\system32\Nehjmppo.exe76⤵PID:1744
-
C:\Windows\SysWOW64\Naokbq32.exeC:\Windows\system32\Naokbq32.exe77⤵PID:1128
-
C:\Windows\SysWOW64\Ojgokflc.exeC:\Windows\system32\Ojgokflc.exe78⤵PID:1044
-
C:\Windows\SysWOW64\Oelcho32.exeC:\Windows\system32\Oelcho32.exe79⤵
- Modifies registry class
PID:2192 -
C:\Windows\SysWOW64\Onehadbj.exeC:\Windows\system32\Onehadbj.exe80⤵PID:2624
-
C:\Windows\SysWOW64\Opfdim32.exeC:\Windows\system32\Opfdim32.exe81⤵PID:2504
-
C:\Windows\SysWOW64\Omjeba32.exeC:\Windows\system32\Omjeba32.exe82⤵PID:2272
-
C:\Windows\SysWOW64\Oiqegb32.exeC:\Windows\system32\Oiqegb32.exe83⤵PID:2516
-
C:\Windows\SysWOW64\Oegflcbj.exeC:\Windows\system32\Oegflcbj.exe84⤵PID:1904
-
C:\Windows\SysWOW64\Pejcab32.exeC:\Windows\system32\Pejcab32.exe85⤵PID:1296
-
C:\Windows\SysWOW64\Pelpgb32.exeC:\Windows\system32\Pelpgb32.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2352 -
C:\Windows\SysWOW64\Pdamhocm.exeC:\Windows\system32\Pdamhocm.exe87⤵PID:2344
-
C:\Windows\SysWOW64\Paemac32.exeC:\Windows\system32\Paemac32.exe88⤵PID:2884
-
C:\Windows\SysWOW64\Pmlngdhk.exeC:\Windows\system32\Pmlngdhk.exe89⤵
- Drops file in System32 directory
PID:2132 -
C:\Windows\SysWOW64\Phabdmgq.exeC:\Windows\system32\Phabdmgq.exe90⤵PID:1708
-
C:\Windows\SysWOW64\Qggoeilh.exeC:\Windows\system32\Qggoeilh.exe91⤵PID:2988
-
C:\Windows\SysWOW64\Acnpjj32.exeC:\Windows\system32\Acnpjj32.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2776 -
C:\Windows\SysWOW64\Aenileon.exeC:\Windows\system32\Aenileon.exe93⤵PID:964
-
C:\Windows\SysWOW64\Aogmdk32.exeC:\Windows\system32\Aogmdk32.exe94⤵PID:2184
-
C:\Windows\SysWOW64\Aknnil32.exeC:\Windows\system32\Aknnil32.exe95⤵PID:2792
-
C:\Windows\SysWOW64\Adfbbabc.exeC:\Windows\system32\Adfbbabc.exe96⤵PID:1880
-
C:\Windows\SysWOW64\Adhohapp.exeC:\Windows\system32\Adhohapp.exe97⤵PID:2592
-
C:\Windows\SysWOW64\Bnqcaffa.exeC:\Windows\system32\Bnqcaffa.exe98⤵PID:944
-
C:\Windows\SysWOW64\Bbolge32.exeC:\Windows\system32\Bbolge32.exe99⤵PID:2288
-
C:\Windows\SysWOW64\Bjjakg32.exeC:\Windows\system32\Bjjakg32.exe100⤵PID:2252
-
C:\Windows\SysWOW64\Bgnaekil.exeC:\Windows\system32\Bgnaekil.exe101⤵PID:3060
-
C:\Windows\SysWOW64\Bcdbjl32.exeC:\Windows\system32\Bcdbjl32.exe102⤵PID:2684
-
C:\Windows\SysWOW64\Bqhbcqmj.exeC:\Windows\system32\Bqhbcqmj.exe103⤵
- Modifies registry class
PID:2480 -
C:\Windows\SysWOW64\Cmocha32.exeC:\Windows\system32\Cmocha32.exe104⤵PID:2380
-
C:\Windows\SysWOW64\Cifdmbib.exeC:\Windows\system32\Cifdmbib.exe105⤵PID:844
-
C:\Windows\SysWOW64\Cfjdfg32.exeC:\Windows\system32\Cfjdfg32.exe106⤵
- System Location Discovery: System Language Discovery
PID:2212 -
C:\Windows\SysWOW64\Ciknhb32.exeC:\Windows\system32\Ciknhb32.exe107⤵PID:2532
-
C:\Windows\SysWOW64\Cafbmdbh.exeC:\Windows\system32\Cafbmdbh.exe108⤵PID:2140
-
C:\Windows\SysWOW64\Dedkbb32.exeC:\Windows\system32\Dedkbb32.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1384 -
C:\Windows\SysWOW64\Dnlolhoo.exeC:\Windows\system32\Dnlolhoo.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2964 -
C:\Windows\SysWOW64\Dpphipbk.exeC:\Windows\system32\Dpphipbk.exe111⤵PID:1612
-
C:\Windows\SysWOW64\Elnonp32.exeC:\Windows\system32\Elnonp32.exe112⤵PID:2440
-
C:\Windows\SysWOW64\Emailhfb.exeC:\Windows\system32\Emailhfb.exe113⤵
- Drops file in System32 directory
PID:1816 -
C:\Windows\SysWOW64\Egimdmmc.exeC:\Windows\system32\Egimdmmc.exe114⤵
- Modifies registry class
PID:784 -
C:\Windows\SysWOW64\Ekgfkl32.exeC:\Windows\system32\Ekgfkl32.exe115⤵PID:2856
-
C:\Windows\SysWOW64\Fdpjcaij.exeC:\Windows\system32\Fdpjcaij.exe116⤵PID:2596
-
C:\Windows\SysWOW64\Fcegdnna.exeC:\Windows\system32\Fcegdnna.exe117⤵
- Drops file in System32 directory
PID:1736 -
C:\Windows\SysWOW64\Fpihnbmk.exeC:\Windows\system32\Fpihnbmk.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2392 -
C:\Windows\SysWOW64\Fondonbc.exeC:\Windows\system32\Fondonbc.exe119⤵PID:1812
-
C:\Windows\SysWOW64\Flbehbqm.exeC:\Windows\system32\Flbehbqm.exe120⤵PID:1280
-
C:\Windows\SysWOW64\Fldbnb32.exeC:\Windows\system32\Fldbnb32.exe121⤵PID:2632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-