Analysis
-
max time kernel
109s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 18:40
Static task
static1
Behavioral task
behavioral1
Sample
c6dd389fc6513c83b80976fa6d9b53397874488241965313e7dfc5e5cfbdb06dN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
c6dd389fc6513c83b80976fa6d9b53397874488241965313e7dfc5e5cfbdb06dN.exe
Resource
win10v2004-20241007-en
General
-
Target
c6dd389fc6513c83b80976fa6d9b53397874488241965313e7dfc5e5cfbdb06dN.exe
-
Size
72KB
-
MD5
d7bb6ad9585cb6a187ab06b4abb2ac10
-
SHA1
bc5eb096e6d6623b434346a784efa0f897f07f76
-
SHA256
c6dd389fc6513c83b80976fa6d9b53397874488241965313e7dfc5e5cfbdb06d
-
SHA512
bf3cb9621474bb31fee923c46731f312da0742ce0152453eeab6aa070d8db905aa1e264739d476881ce2ae6c840a3200b59f2ae16db937ac56b80e9d4419aed8
-
SSDEEP
1536:AR7cgUrfEOPNJngt6beiwQwLAkj85UYSI9C2lzwmmyFZXxxNbJ:A+VrjjngUbHw7mmy9xlJ
Malware Config
Extracted
berbew
http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Cpadpg32.exeEqmbca32.exeJaflocqd.exeQadfiiil.exeOcfppm32.exeDgkike32.exeOgldfl32.exeNapibq32.exeHjlekm32.exeKknkncbl.exeAnjjjn32.exeGeckno32.exeIlfbpk32.exePonokmah.exeOiepmajb.exeQbboakna.exeKmfbckfa.exeJkhhpeka.exeFjpbeecn.exeCkciqdol.exeGdnojkck.exeLkkefi32.exeIkqcgj32.exeIkcpmieg.exeOhfgeo32.exeQcigjolm.exeNdlanf32.exeGbeakllj.exeFmbninke.exeGaqefh32.exeJilcghfm.exePhcpdm32.exeEgnjbfqc.exeQeeadi32.exeBlkgdmbp.exeLmppmi32.exeBenpik32.exeBggohi32.exeNblpbeob.exeMegkgpaq.exeFjqlid32.exeIfchhf32.exeJahieboa.exePqcncnpe.exeJcnloa32.exeCbfidfem.exeMpacmghc.exeOdknmi32.exeLgfmmaem.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpadpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eqmbca32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jaflocqd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qadfiiil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ocfppm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dgkike32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogldfl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Napibq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjlekm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kknkncbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Anjjjn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Geckno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ilfbpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ponokmah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oiepmajb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qbboakna.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmfbckfa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jkhhpeka.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjpbeecn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckciqdol.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdnojkck.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lkkefi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ikqcgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ikcpmieg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohfgeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qcigjolm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ndlanf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gbeakllj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fmbninke.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gaqefh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jilcghfm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Phcpdm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Egnjbfqc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qeeadi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Blkgdmbp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lmppmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Benpik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bggohi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nblpbeob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Megkgpaq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fjqlid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ifchhf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jahieboa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pqcncnpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jcnloa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbfidfem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mpacmghc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Odknmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lgfmmaem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" -
Berbew family
-
Executes dropped EXE 64 IoCs
Processes:
Efolib32.exeElnagijk.exeEamgeo32.exeEapcjo32.exeFpdqlkhe.exeFdbibjok.exeFefboabg.exeFbjchfaq.exeFoacmg32.exeGbolce32.exeGmhmdc32.exeGmkjjbhg.exeGiakoc32.exeGcjogidl.exeHnapja32.exeHeoadcmh.exeHddoep32.exeHojbbiae.exeIkqcgj32.exeIkcpmieg.exeIqbekpal.exeImifpagp.exeIccnmk32.exeImkbeqem.exeJbhkngcd.exeJbmdig32.exeJboanfmm.exeJkgfgl32.exeJkjbml32.exeKagkebpb.exeKjopnh32.exeKffpcilf.exeKmdbkbpn.exeLepfoe32.exeLinoeccp.exeLedpjdid.exeLgjfmlkm.exeMpcjfa32.exeMkhocj32.exeMgoohk32.exeMedligko.exeMefiog32.exeMdlfpcnd.exeNapfihmn.exeNkhkbmco.exeNhlkkabh.exeNjmhcj32.exeNcellpog.exeNffenj32.exeNqlikc32.exeOcjfgo32.exeOqnfqcjk.exeObpbhk32.exeOmeged32.exeOfmknifp.exeOkjdfq32.exeOindpd32.exeOkmqlp32.exeOqiidg32.exePbienj32.exePnpfckmc.exePclolakk.exePaqoef32.exePfmgmm32.exepid process 2136 Efolib32.exe 2480 Elnagijk.exe 2916 Eamgeo32.exe 2956 Eapcjo32.exe 2908 Fpdqlkhe.exe 2804 Fdbibjok.exe 1800 Fefboabg.exe 2444 Fbjchfaq.exe 2976 Foacmg32.exe 1852 Gbolce32.exe 1708 Gmhmdc32.exe 2952 Gmkjjbhg.exe 1232 Giakoc32.exe 2512 Gcjogidl.exe 2244 Hnapja32.exe 2492 Heoadcmh.exe 2460 Hddoep32.exe 2268 Hojbbiae.exe 1216 Ikqcgj32.exe 1720 Ikcpmieg.exe 1616 Iqbekpal.exe 1952 Imifpagp.exe 1944 Iccnmk32.exe 2308 Imkbeqem.exe 1928 Jbhkngcd.exe 1788 Jbmdig32.exe 1504 Jboanfmm.exe 2904 Jkgfgl32.exe 2812 Jkjbml32.exe 2880 Kagkebpb.exe 2924 Kjopnh32.exe 2728 Kffpcilf.exe 2184 Kmdbkbpn.exe 308 Lepfoe32.exe 1560 Linoeccp.exe 2560 Ledpjdid.exe 2968 Lgjfmlkm.exe 2476 Mpcjfa32.exe 2388 Mkhocj32.exe 1380 Mgoohk32.exe 940 Medligko.exe 2220 Mefiog32.exe 2316 Mdlfpcnd.exe 1072 Napfihmn.exe 2252 Nkhkbmco.exe 2468 Nhlkkabh.exe 964 Njmhcj32.exe 1964 Ncellpog.exe 844 Nffenj32.exe 1364 Nqlikc32.exe 2112 Ocjfgo32.exe 2484 Oqnfqcjk.exe 3032 Obpbhk32.exe 2704 Omeged32.exe 336 Ofmknifp.exe 672 Okjdfq32.exe 980 Oindpd32.exe 2084 Okmqlp32.exe 2996 Oqiidg32.exe 2116 Pbienj32.exe 1792 Pnpfckmc.exe 3040 Pclolakk.exe 2280 Paqoef32.exe 1508 Pfmgmm32.exe -
Loads dropped DLL 64 IoCs
Processes:
c6dd389fc6513c83b80976fa6d9b53397874488241965313e7dfc5e5cfbdb06dN.exeEfolib32.exeElnagijk.exeEamgeo32.exeEapcjo32.exeFpdqlkhe.exeFdbibjok.exeFefboabg.exeFbjchfaq.exeFoacmg32.exeGbolce32.exeGmhmdc32.exeGmkjjbhg.exeGiakoc32.exeGcjogidl.exeHnapja32.exeHeoadcmh.exeHddoep32.exeHojbbiae.exeIkqcgj32.exeIkcpmieg.exeIqbekpal.exeImifpagp.exeIccnmk32.exeImkbeqem.exeJbhkngcd.exeJbmdig32.exeJboanfmm.exeJkgfgl32.exeJkjbml32.exeKagkebpb.exeKjopnh32.exepid process 2060 c6dd389fc6513c83b80976fa6d9b53397874488241965313e7dfc5e5cfbdb06dN.exe 2060 c6dd389fc6513c83b80976fa6d9b53397874488241965313e7dfc5e5cfbdb06dN.exe 2136 Efolib32.exe 2136 Efolib32.exe 2480 Elnagijk.exe 2480 Elnagijk.exe 2916 Eamgeo32.exe 2916 Eamgeo32.exe 2956 Eapcjo32.exe 2956 Eapcjo32.exe 2908 Fpdqlkhe.exe 2908 Fpdqlkhe.exe 2804 Fdbibjok.exe 2804 Fdbibjok.exe 1800 Fefboabg.exe 1800 Fefboabg.exe 2444 Fbjchfaq.exe 2444 Fbjchfaq.exe 2976 Foacmg32.exe 2976 Foacmg32.exe 1852 Gbolce32.exe 1852 Gbolce32.exe 1708 Gmhmdc32.exe 1708 Gmhmdc32.exe 2952 Gmkjjbhg.exe 2952 Gmkjjbhg.exe 1232 Giakoc32.exe 1232 Giakoc32.exe 2512 Gcjogidl.exe 2512 Gcjogidl.exe 2244 Hnapja32.exe 2244 Hnapja32.exe 2492 Heoadcmh.exe 2492 Heoadcmh.exe 2460 Hddoep32.exe 2460 Hddoep32.exe 2268 Hojbbiae.exe 2268 Hojbbiae.exe 1216 Ikqcgj32.exe 1216 Ikqcgj32.exe 1720 Ikcpmieg.exe 1720 Ikcpmieg.exe 1616 Iqbekpal.exe 1616 Iqbekpal.exe 1952 Imifpagp.exe 1952 Imifpagp.exe 1944 Iccnmk32.exe 1944 Iccnmk32.exe 2308 Imkbeqem.exe 2308 Imkbeqem.exe 1928 Jbhkngcd.exe 1928 Jbhkngcd.exe 1788 Jbmdig32.exe 1788 Jbmdig32.exe 1504 Jboanfmm.exe 1504 Jboanfmm.exe 2904 Jkgfgl32.exe 2904 Jkgfgl32.exe 2812 Jkjbml32.exe 2812 Jkjbml32.exe 2880 Kagkebpb.exe 2880 Kagkebpb.exe 2924 Kjopnh32.exe 2924 Kjopnh32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Odhjmc32.exeGglimm32.exeDmhfpmee.exeMnjaci32.exeDanblfmk.exeGmhibenb.exeBijakkmc.exePaoedc32.exeEfolib32.exePnpfckmc.exeIdlgohcl.exeAbacjd32.exeDadkdj32.exeAhomlb32.exeKiebljpm.exeJhjnmb32.exeFeljja32.exeOdknmi32.exeEpnkfq32.exeKojihjbi.exePqaanoah.exeKodhbe32.exeNeabophn.exeDgoejm32.exeNdaaclac.exeOkmena32.exeCkciqdol.exeKbikah32.exeNhinhn32.exeOdcmagip.exeLkkefi32.exePdflopoa.exeMoanpe32.exeGodfplje.exeJdhmel32.exeInmdjjok.exeIekdhkfi.exeEamgeo32.exeLagjhc32.exeMgoojgai.exeCokqfhpa.exeLmppmi32.exeCdhgegfd.exeOkkfoikl.exeHgfqen32.exeMdbmkc32.exeEfkfbp32.exeHajogm32.exeLlojpghe.exedescription ioc process File created C:\Windows\SysWOW64\Ehkflp32.dll Odhjmc32.exe File created C:\Windows\SysWOW64\Gqenfc32.exe Gglimm32.exe File opened for modification C:\Windows\SysWOW64\Deckeo32.exe Dmhfpmee.exe File created C:\Windows\SysWOW64\Mgcflnfp.exe Mnjaci32.exe File created C:\Windows\SysWOW64\Amkbmlci.exe File created C:\Windows\SysWOW64\Fnfilb32.dll Danblfmk.exe File created C:\Windows\SysWOW64\Eahalfcl.dll Gmhibenb.exe File created C:\Windows\SysWOW64\Bbbedqcc.exe Bijakkmc.exe File created C:\Windows\SysWOW64\Hjiijqhk.dll Paoedc32.exe File opened for modification C:\Windows\SysWOW64\Anlodd32.exe File created C:\Windows\SysWOW64\Diipha32.dll File created C:\Windows\SysWOW64\Elnagijk.exe Efolib32.exe File opened for modification C:\Windows\SysWOW64\Pclolakk.exe Pnpfckmc.exe File created C:\Windows\SysWOW64\Infhmmhi.exe Idlgohcl.exe File opened for modification C:\Windows\SysWOW64\Amgggm32.exe Abacjd32.exe File created C:\Windows\SysWOW64\Dljoac32.exe Dadkdj32.exe File created C:\Windows\SysWOW64\Lpnpll32.dll Ahomlb32.exe File created C:\Windows\SysWOW64\Ldkficpc.exe Kiebljpm.exe File created C:\Windows\SysWOW64\Inlfcmip.dll File created C:\Windows\SysWOW64\Jkhjin32.exe Jhjnmb32.exe File opened for modification C:\Windows\SysWOW64\Facjobce.exe Feljja32.exe File opened for modification C:\Windows\SysWOW64\Binkqk32.exe File created C:\Windows\SysWOW64\Iqddmmfp.dll Odknmi32.exe File created C:\Windows\SysWOW64\Eqacmd32.dll Epnkfq32.exe File created C:\Windows\SysWOW64\Iopeni32.dll Kojihjbi.exe File created C:\Windows\SysWOW64\Dpepfl32.exe File created C:\Windows\SysWOW64\Gealfddm.dll Pqaanoah.exe File created C:\Windows\SysWOW64\Kldaqhdq.dll Kodhbe32.exe File opened for modification C:\Windows\SysWOW64\Ocfppm32.exe Neabophn.exe File created C:\Windows\SysWOW64\Qaakki32.dll File opened for modification C:\Windows\SysWOW64\Dgabomfl.exe Dgoejm32.exe File created C:\Windows\SysWOW64\Fnpbob32.exe File created C:\Windows\SysWOW64\Ibofgebi.dll Ndaaclac.exe File opened for modification C:\Windows\SysWOW64\Pagmjlhj.exe Okmena32.exe File created C:\Windows\SysWOW64\Ndmgck32.dll Ckciqdol.exe File created C:\Windows\SysWOW64\Klaojm32.exe Kbikah32.exe File opened for modification C:\Windows\SysWOW64\Njikba32.exe Nhinhn32.exe File created C:\Windows\SysWOW64\Lgbgfofa.exe File created C:\Windows\SysWOW64\Okmena32.exe Odcmagip.exe File created C:\Windows\SysWOW64\Lhofpm32.exe Lkkefi32.exe File created C:\Windows\SysWOW64\Pmophe32.exe Pdflopoa.exe File opened for modification C:\Windows\SysWOW64\Mdnfhldh.exe Moanpe32.exe File opened for modification C:\Windows\SysWOW64\Gacblhii.exe Godfplje.exe File created C:\Windows\SysWOW64\Jnqanbcj.exe Jdhmel32.exe File opened for modification C:\Windows\SysWOW64\Idjlbqmb.exe Inmdjjok.exe File created C:\Windows\SysWOW64\Inciaamj.exe Iekdhkfi.exe File opened for modification C:\Windows\SysWOW64\Jbjccf32.exe File opened for modification C:\Windows\SysWOW64\Eapcjo32.exe Eamgeo32.exe File created C:\Windows\SysWOW64\Okfbadbn.dll Lagjhc32.exe File opened for modification C:\Windows\SysWOW64\Mhnkdjhl.exe Mgoojgai.exe File created C:\Windows\SysWOW64\Jjdoeibg.exe File opened for modification C:\Windows\SysWOW64\Ffpqndmi.exe File created C:\Windows\SysWOW64\Ckbakiee.exe Cokqfhpa.exe File created C:\Windows\SysWOW64\Dbgcen32.dll Lmppmi32.exe File created C:\Windows\SysWOW64\Fkhpogmi.dll Cdhgegfd.exe File created C:\Windows\SysWOW64\Ocbnqfln.exe Okkfoikl.exe File opened for modification C:\Windows\SysWOW64\Hobeipoc.exe Hgfqen32.exe File created C:\Windows\SysWOW64\Ofjgpp32.exe File opened for modification C:\Windows\SysWOW64\Mnjaci32.exe Mdbmkc32.exe File created C:\Windows\SysWOW64\Mhpgeh32.dll Efkfbp32.exe File opened for modification C:\Windows\SysWOW64\Hhdgdg32.exe Hajogm32.exe File created C:\Windows\SysWOW64\Cciincqi.exe File opened for modification C:\Windows\SysWOW64\Nobpjbcn.exe File created C:\Windows\SysWOW64\Leiabnbn.dll Llojpghe.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Ponokmah.exeOglgji32.exeGiakoc32.exeJjgbbc32.exeFjpipkgi.exeIpefba32.exeCmclem32.exeDmhfpmee.exeKagkebpb.exeAjkmbo32.exeHaqbcoce.exeKbgqbdbd.exeEklbid32.exeIonlpdha.exeNqlikc32.exeGhndjd32.exePjlbld32.exeHglobj32.exeLdkficpc.exeHincna32.exePgdcjjom.exePjdeaohb.exeBfgkdp32.exeKdkkkqlk.exeBnkbcmaj.exeGjgpqjqa.exeIeokjbkp.exeCkpeqn32.exeLinoeccp.exeLjnebe32.exePocmhnlk.exeJikjcikm.exeQjaejbmq.exeEilodk32.exeGkcnleom.exeKlgeih32.exeAabhiikm.exeHhfqejoh.exeMjlgdaad.exeGclopbjo.exeGnfoao32.exeMnefpq32.exeDgkike32.exeLfkhed32.exeGlpbiaqg.exeFcacfd32.exeCmdonf32.exeDehfig32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ponokmah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oglgji32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Giakoc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjgbbc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjpipkgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ipefba32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmclem32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmhfpmee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kagkebpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajkmbo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Haqbcoce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbgqbdbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eklbid32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ionlpdha.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nqlikc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghndjd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjlbld32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hglobj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ldkficpc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hincna32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pgdcjjom.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjdeaohb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfgkdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kdkkkqlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bnkbcmaj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gjgpqjqa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ieokjbkp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckpeqn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Linoeccp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljnebe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pocmhnlk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jikjcikm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qjaejbmq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eilodk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkcnleom.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klgeih32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aabhiikm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hhfqejoh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjlgdaad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gclopbjo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnfoao32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnefpq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dgkike32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lfkhed32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Glpbiaqg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fcacfd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmdonf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dehfig32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Modifies registry class 64 IoCs
Processes:
Ehklpbam.exeAljinncb.exeHmheai32.exeNbnmhe32.exeCnlegj32.exeEfgnfi32.exePlecdk32.exeKnabngen.exeCkpeqn32.exeIackhb32.exeGcqika32.exeBbmggp32.exeKgkbnc32.exeNfafci32.exeMjlgdaad.exeBfmlif32.exeFgjpijjb.exeFjkije32.exeJdlefd32.exeIekdhkfi.exeIkcbfb32.exePhcpdm32.exeEcnbpcje.exeFknnfp32.exeEpnkfq32.exeOnacgf32.exeMfjaknoe.exeLnpejklj.exeLicbca32.exeGmhkkn32.exeFlldei32.exeEfeaqi32.exeNkmffegm.exeLofono32.exeHjdfgojp.exeAjkokgia.exeJcekdg32.exeIqbekpal.exeNbckeb32.exeMmlilfkj.exeGmkgqncd.exeAncfbhdh.exeBbdakh32.exeKmeknakn.exeKgkokjjd.exeMmgoqg32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ehklpbam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jigijb32.dll" Aljinncb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poifhgla.dll" Hmheai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdcjba32.dll" Nbnmhe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cnlegj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Efgnfi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Plecdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfldhhnk.dll" Knabngen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gobdjc32.dll" Ckpeqn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmgkqq32.dll" Iackhb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gcqika32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpmijbcp.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmomfklj.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpolcg32.dll" Bbmggp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kgkbnc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppmink32.dll" Nfafci32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mjlgdaad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egqjgpom.dll" Bfmlif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fgjpijjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fjkije32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epcdai32.dll" Jdlefd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Iekdhkfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ikcbfb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfqgld32.dll" Phcpdm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ecnbpcje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgkbcjjo.dll" Fknnfp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqacmd32.dll" Epnkfq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Onacgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mfjaknoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfnoed32.dll" Lnpejklj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkndpg32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Licbca32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Annhoa32.dll" Gmhkkn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Flldei32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Efeaqi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amgjgl32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nkmffegm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lofono32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgccll32.dll" Hjdfgojp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igknokje.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ajkokgia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jcekdg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pghodm32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elhhkb32.dll" Iqbekpal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Happcacp.dll" Nbckeb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mmlilfkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jplkmd32.dll" Gmkgqncd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ancfbhdh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpinhgdo.dll" Bbdakh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlmkdf32.dll" Kmeknakn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kgkokjjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mmgoqg32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c6dd389fc6513c83b80976fa6d9b53397874488241965313e7dfc5e5cfbdb06dN.exeEfolib32.exeElnagijk.exeEamgeo32.exeEapcjo32.exeFpdqlkhe.exeFdbibjok.exeFefboabg.exeFbjchfaq.exeFoacmg32.exeGbolce32.exeGmhmdc32.exeGmkjjbhg.exeGiakoc32.exeGcjogidl.exeHnapja32.exedescription pid process target process PID 2060 wrote to memory of 2136 2060 c6dd389fc6513c83b80976fa6d9b53397874488241965313e7dfc5e5cfbdb06dN.exe Efolib32.exe PID 2060 wrote to memory of 2136 2060 c6dd389fc6513c83b80976fa6d9b53397874488241965313e7dfc5e5cfbdb06dN.exe Efolib32.exe PID 2060 wrote to memory of 2136 2060 c6dd389fc6513c83b80976fa6d9b53397874488241965313e7dfc5e5cfbdb06dN.exe Efolib32.exe PID 2060 wrote to memory of 2136 2060 c6dd389fc6513c83b80976fa6d9b53397874488241965313e7dfc5e5cfbdb06dN.exe Efolib32.exe PID 2136 wrote to memory of 2480 2136 Efolib32.exe Elnagijk.exe PID 2136 wrote to memory of 2480 2136 Efolib32.exe Elnagijk.exe PID 2136 wrote to memory of 2480 2136 Efolib32.exe Elnagijk.exe PID 2136 wrote to memory of 2480 2136 Efolib32.exe Elnagijk.exe PID 2480 wrote to memory of 2916 2480 Elnagijk.exe Eamgeo32.exe PID 2480 wrote to memory of 2916 2480 Elnagijk.exe Eamgeo32.exe PID 2480 wrote to memory of 2916 2480 Elnagijk.exe Eamgeo32.exe PID 2480 wrote to memory of 2916 2480 Elnagijk.exe Eamgeo32.exe PID 2916 wrote to memory of 2956 2916 Eamgeo32.exe Eapcjo32.exe PID 2916 wrote to memory of 2956 2916 Eamgeo32.exe Eapcjo32.exe PID 2916 wrote to memory of 2956 2916 Eamgeo32.exe Eapcjo32.exe PID 2916 wrote to memory of 2956 2916 Eamgeo32.exe Eapcjo32.exe PID 2956 wrote to memory of 2908 2956 Eapcjo32.exe Fpdqlkhe.exe PID 2956 wrote to memory of 2908 2956 Eapcjo32.exe Fpdqlkhe.exe PID 2956 wrote to memory of 2908 2956 Eapcjo32.exe Fpdqlkhe.exe PID 2956 wrote to memory of 2908 2956 Eapcjo32.exe Fpdqlkhe.exe PID 2908 wrote to memory of 2804 2908 Fpdqlkhe.exe Fdbibjok.exe PID 2908 wrote to memory of 2804 2908 Fpdqlkhe.exe Fdbibjok.exe PID 2908 wrote to memory of 2804 2908 Fpdqlkhe.exe Fdbibjok.exe PID 2908 wrote to memory of 2804 2908 Fpdqlkhe.exe Fdbibjok.exe PID 2804 wrote to memory of 1800 2804 Fdbibjok.exe Fefboabg.exe PID 2804 wrote to memory of 1800 2804 Fdbibjok.exe Fefboabg.exe PID 2804 wrote to memory of 1800 2804 Fdbibjok.exe Fefboabg.exe PID 2804 wrote to memory of 1800 2804 Fdbibjok.exe Fefboabg.exe PID 1800 wrote to memory of 2444 1800 Fefboabg.exe Fbjchfaq.exe PID 1800 wrote to memory of 2444 1800 Fefboabg.exe Fbjchfaq.exe PID 1800 wrote to memory of 2444 1800 Fefboabg.exe Fbjchfaq.exe PID 1800 wrote to memory of 2444 1800 Fefboabg.exe Fbjchfaq.exe PID 2444 wrote to memory of 2976 2444 Fbjchfaq.exe Foacmg32.exe PID 2444 wrote to memory of 2976 2444 Fbjchfaq.exe Foacmg32.exe PID 2444 wrote to memory of 2976 2444 Fbjchfaq.exe Foacmg32.exe PID 2444 wrote to memory of 2976 2444 Fbjchfaq.exe Foacmg32.exe PID 2976 wrote to memory of 1852 2976 Foacmg32.exe Gbolce32.exe PID 2976 wrote to memory of 1852 2976 Foacmg32.exe Gbolce32.exe PID 2976 wrote to memory of 1852 2976 Foacmg32.exe Gbolce32.exe PID 2976 wrote to memory of 1852 2976 Foacmg32.exe Gbolce32.exe PID 1852 wrote to memory of 1708 1852 Gbolce32.exe Gmhmdc32.exe PID 1852 wrote to memory of 1708 1852 Gbolce32.exe Gmhmdc32.exe PID 1852 wrote to memory of 1708 1852 Gbolce32.exe Gmhmdc32.exe PID 1852 wrote to memory of 1708 1852 Gbolce32.exe Gmhmdc32.exe PID 1708 wrote to memory of 2952 1708 Gmhmdc32.exe Gmkjjbhg.exe PID 1708 wrote to memory of 2952 1708 Gmhmdc32.exe Gmkjjbhg.exe PID 1708 wrote to memory of 2952 1708 Gmhmdc32.exe Gmkjjbhg.exe PID 1708 wrote to memory of 2952 1708 Gmhmdc32.exe Gmkjjbhg.exe PID 2952 wrote to memory of 1232 2952 Gmkjjbhg.exe Giakoc32.exe PID 2952 wrote to memory of 1232 2952 Gmkjjbhg.exe Giakoc32.exe PID 2952 wrote to memory of 1232 2952 Gmkjjbhg.exe Giakoc32.exe PID 2952 wrote to memory of 1232 2952 Gmkjjbhg.exe Giakoc32.exe PID 1232 wrote to memory of 2512 1232 Giakoc32.exe Gcjogidl.exe PID 1232 wrote to memory of 2512 1232 Giakoc32.exe Gcjogidl.exe PID 1232 wrote to memory of 2512 1232 Giakoc32.exe Gcjogidl.exe PID 1232 wrote to memory of 2512 1232 Giakoc32.exe Gcjogidl.exe PID 2512 wrote to memory of 2244 2512 Gcjogidl.exe Hnapja32.exe PID 2512 wrote to memory of 2244 2512 Gcjogidl.exe Hnapja32.exe PID 2512 wrote to memory of 2244 2512 Gcjogidl.exe Hnapja32.exe PID 2512 wrote to memory of 2244 2512 Gcjogidl.exe Hnapja32.exe PID 2244 wrote to memory of 2492 2244 Hnapja32.exe Heoadcmh.exe PID 2244 wrote to memory of 2492 2244 Hnapja32.exe Heoadcmh.exe PID 2244 wrote to memory of 2492 2244 Hnapja32.exe Heoadcmh.exe PID 2244 wrote to memory of 2492 2244 Hnapja32.exe Heoadcmh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6dd389fc6513c83b80976fa6d9b53397874488241965313e7dfc5e5cfbdb06dN.exe"C:\Users\Admin\AppData\Local\Temp\c6dd389fc6513c83b80976fa6d9b53397874488241965313e7dfc5e5cfbdb06dN.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\Efolib32.exeC:\Windows\system32\Efolib32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\Elnagijk.exeC:\Windows\system32\Elnagijk.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\Eamgeo32.exeC:\Windows\system32\Eamgeo32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\Eapcjo32.exeC:\Windows\system32\Eapcjo32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\Fpdqlkhe.exeC:\Windows\system32\Fpdqlkhe.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\Fdbibjok.exeC:\Windows\system32\Fdbibjok.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\Fefboabg.exeC:\Windows\system32\Fefboabg.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\Fbjchfaq.exeC:\Windows\system32\Fbjchfaq.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\Foacmg32.exeC:\Windows\system32\Foacmg32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\Gbolce32.exeC:\Windows\system32\Gbolce32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\Gmhmdc32.exeC:\Windows\system32\Gmhmdc32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\Gmkjjbhg.exeC:\Windows\system32\Gmkjjbhg.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\Giakoc32.exeC:\Windows\system32\Giakoc32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\Gcjogidl.exeC:\Windows\system32\Gcjogidl.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\Hnapja32.exeC:\Windows\system32\Hnapja32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\Heoadcmh.exeC:\Windows\system32\Heoadcmh.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Windows\SysWOW64\Hddoep32.exeC:\Windows\system32\Hddoep32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Windows\SysWOW64\Hojbbiae.exeC:\Windows\system32\Hojbbiae.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Windows\SysWOW64\Ikqcgj32.exeC:\Windows\system32\Ikqcgj32.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Windows\SysWOW64\Ikcpmieg.exeC:\Windows\system32\Ikcpmieg.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Windows\SysWOW64\Iqbekpal.exeC:\Windows\system32\Iqbekpal.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1616 -
C:\Windows\SysWOW64\Imifpagp.exeC:\Windows\system32\Imifpagp.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Windows\SysWOW64\Iccnmk32.exeC:\Windows\system32\Iccnmk32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Windows\SysWOW64\Imkbeqem.exeC:\Windows\system32\Imkbeqem.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Windows\SysWOW64\Jbhkngcd.exeC:\Windows\system32\Jbhkngcd.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Windows\SysWOW64\Jbmdig32.exeC:\Windows\system32\Jbmdig32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Windows\SysWOW64\Jboanfmm.exeC:\Windows\system32\Jboanfmm.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Windows\SysWOW64\Jkgfgl32.exeC:\Windows\system32\Jkgfgl32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Windows\SysWOW64\Jkjbml32.exeC:\Windows\system32\Jkjbml32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Windows\SysWOW64\Kagkebpb.exeC:\Windows\system32\Kagkebpb.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Windows\SysWOW64\Kjopnh32.exeC:\Windows\system32\Kjopnh32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Windows\SysWOW64\Kffpcilf.exeC:\Windows\system32\Kffpcilf.exe33⤵
- Executes dropped EXE
PID:2728 -
C:\Windows\SysWOW64\Kmdbkbpn.exeC:\Windows\system32\Kmdbkbpn.exe34⤵
- Executes dropped EXE
PID:2184 -
C:\Windows\SysWOW64\Lepfoe32.exeC:\Windows\system32\Lepfoe32.exe35⤵
- Executes dropped EXE
PID:308 -
C:\Windows\SysWOW64\Linoeccp.exeC:\Windows\system32\Linoeccp.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1560 -
C:\Windows\SysWOW64\Ledpjdid.exeC:\Windows\system32\Ledpjdid.exe37⤵
- Executes dropped EXE
PID:2560 -
C:\Windows\SysWOW64\Lgjfmlkm.exeC:\Windows\system32\Lgjfmlkm.exe38⤵
- Executes dropped EXE
PID:2968 -
C:\Windows\SysWOW64\Mpcjfa32.exeC:\Windows\system32\Mpcjfa32.exe39⤵
- Executes dropped EXE
PID:2476 -
C:\Windows\SysWOW64\Mkhocj32.exeC:\Windows\system32\Mkhocj32.exe40⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\Mgoohk32.exeC:\Windows\system32\Mgoohk32.exe41⤵
- Executes dropped EXE
PID:1380 -
C:\Windows\SysWOW64\Medligko.exeC:\Windows\system32\Medligko.exe42⤵
- Executes dropped EXE
PID:940 -
C:\Windows\SysWOW64\Mefiog32.exeC:\Windows\system32\Mefiog32.exe43⤵
- Executes dropped EXE
PID:2220 -
C:\Windows\SysWOW64\Mdlfpcnd.exeC:\Windows\system32\Mdlfpcnd.exe44⤵
- Executes dropped EXE
PID:2316 -
C:\Windows\SysWOW64\Napfihmn.exeC:\Windows\system32\Napfihmn.exe45⤵
- Executes dropped EXE
PID:1072 -
C:\Windows\SysWOW64\Nkhkbmco.exeC:\Windows\system32\Nkhkbmco.exe46⤵
- Executes dropped EXE
PID:2252 -
C:\Windows\SysWOW64\Nhlkkabh.exeC:\Windows\system32\Nhlkkabh.exe47⤵
- Executes dropped EXE
PID:2468 -
C:\Windows\SysWOW64\Njmhcj32.exeC:\Windows\system32\Njmhcj32.exe48⤵
- Executes dropped EXE
PID:964 -
C:\Windows\SysWOW64\Ncellpog.exeC:\Windows\system32\Ncellpog.exe49⤵
- Executes dropped EXE
PID:1964 -
C:\Windows\SysWOW64\Nffenj32.exeC:\Windows\system32\Nffenj32.exe50⤵
- Executes dropped EXE
PID:844 -
C:\Windows\SysWOW64\Nqlikc32.exeC:\Windows\system32\Nqlikc32.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1364 -
C:\Windows\SysWOW64\Ocjfgo32.exeC:\Windows\system32\Ocjfgo32.exe52⤵
- Executes dropped EXE
PID:2112 -
C:\Windows\SysWOW64\Ojdndi32.exeC:\Windows\system32\Ojdndi32.exe53⤵PID:1600
-
C:\Windows\SysWOW64\Oqnfqcjk.exeC:\Windows\system32\Oqnfqcjk.exe54⤵
- Executes dropped EXE
PID:2484 -
C:\Windows\SysWOW64\Obpbhk32.exeC:\Windows\system32\Obpbhk32.exe55⤵
- Executes dropped EXE
PID:3032 -
C:\Windows\SysWOW64\Omeged32.exeC:\Windows\system32\Omeged32.exe56⤵
- Executes dropped EXE
PID:2704 -
C:\Windows\SysWOW64\Ofmknifp.exeC:\Windows\system32\Ofmknifp.exe57⤵
- Executes dropped EXE
PID:336 -
C:\Windows\SysWOW64\Okjdfq32.exeC:\Windows\system32\Okjdfq32.exe58⤵
- Executes dropped EXE
PID:672 -
C:\Windows\SysWOW64\Oindpd32.exeC:\Windows\system32\Oindpd32.exe59⤵
- Executes dropped EXE
PID:980 -
C:\Windows\SysWOW64\Okmqlp32.exeC:\Windows\system32\Okmqlp32.exe60⤵
- Executes dropped EXE
PID:2084 -
C:\Windows\SysWOW64\Oqiidg32.exeC:\Windows\system32\Oqiidg32.exe61⤵
- Executes dropped EXE
PID:2996 -
C:\Windows\SysWOW64\Pbienj32.exeC:\Windows\system32\Pbienj32.exe62⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\SysWOW64\Pnpfckmc.exeC:\Windows\system32\Pnpfckmc.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1792 -
C:\Windows\SysWOW64\Pclolakk.exeC:\Windows\system32\Pclolakk.exe64⤵
- Executes dropped EXE
PID:3040 -
C:\Windows\SysWOW64\Paqoef32.exeC:\Windows\system32\Paqoef32.exe65⤵
- Executes dropped EXE
PID:2280 -
C:\Windows\SysWOW64\Pfmgmm32.exeC:\Windows\system32\Pfmgmm32.exe66⤵
- Executes dropped EXE
PID:1508 -
C:\Windows\SysWOW64\Ppelfbol.exeC:\Windows\system32\Ppelfbol.exe67⤵PID:2620
-
C:\Windows\SysWOW64\Pjkpckob.exeC:\Windows\system32\Pjkpckob.exe68⤵PID:1988
-
C:\Windows\SysWOW64\Qeeadi32.exeC:\Windows\system32\Qeeadi32.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1328 -
C:\Windows\SysWOW64\Qpjeaa32.exeC:\Windows\system32\Qpjeaa32.exe70⤵PID:1844
-
C:\Windows\SysWOW64\Qegnii32.exeC:\Windows\system32\Qegnii32.exe71⤵PID:1976
-
C:\Windows\SysWOW64\Qpmbgaid.exeC:\Windows\system32\Qpmbgaid.exe72⤵PID:876
-
C:\Windows\SysWOW64\Ahhgkdfo.exeC:\Windows\system32\Ahhgkdfo.exe73⤵PID:2236
-
C:\Windows\SysWOW64\Aapkdi32.exeC:\Windows\system32\Aapkdi32.exe74⤵PID:2792
-
C:\Windows\SysWOW64\Ajipmocp.exeC:\Windows\system32\Ajipmocp.exe75⤵PID:2920
-
C:\Windows\SysWOW64\Aabhiikm.exeC:\Windows\system32\Aabhiikm.exe76⤵
- System Location Discovery: System Language Discovery
PID:2820 -
C:\Windows\SysWOW64\Ajkmbo32.exeC:\Windows\system32\Ajkmbo32.exe77⤵
- System Location Discovery: System Language Discovery
PID:2284 -
C:\Windows\SysWOW64\Amiioj32.exeC:\Windows\system32\Amiioj32.exe78⤵PID:2072
-
C:\Windows\SysWOW64\Ahomlb32.exeC:\Windows\system32\Ahomlb32.exe79⤵
- Drops file in System32 directory
PID:1332 -
C:\Windows\SysWOW64\Aagadh32.exeC:\Windows\system32\Aagadh32.exe80⤵PID:2032
-
C:\Windows\SysWOW64\Afdjmo32.exeC:\Windows\system32\Afdjmo32.exe81⤵PID:2016
-
C:\Windows\SysWOW64\Bmnbjill.exeC:\Windows\system32\Bmnbjill.exe82⤵PID:1064
-
C:\Windows\SysWOW64\Bffgbo32.exeC:\Windows\system32\Bffgbo32.exe83⤵PID:2204
-
C:\Windows\SysWOW64\Bbmggp32.exeC:\Windows\system32\Bbmggp32.exe84⤵
- Modifies registry class
PID:2636 -
C:\Windows\SysWOW64\Blelpeoa.exeC:\Windows\system32\Blelpeoa.exe85⤵PID:1236
-
C:\Windows\SysWOW64\Benpik32.exeC:\Windows\system32\Benpik32.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1672 -
C:\Windows\SysWOW64\Bofebqlb.exeC:\Windows\system32\Bofebqlb.exe87⤵PID:1956
-
C:\Windows\SysWOW64\Bepmokco.exeC:\Windows\system32\Bepmokco.exe88⤵PID:932
-
C:\Windows\SysWOW64\Bnkbcmaj.exeC:\Windows\system32\Bnkbcmaj.exe89⤵
- System Location Discovery: System Language Discovery
PID:1496 -
C:\Windows\SysWOW64\Chafpfqp.exeC:\Windows\system32\Chafpfqp.exe90⤵PID:2056
-
C:\Windows\SysWOW64\Caijik32.exeC:\Windows\system32\Caijik32.exe91⤵PID:2368
-
C:\Windows\SysWOW64\Cdhgegfd.exeC:\Windows\system32\Cdhgegfd.exe92⤵
- Drops file in System32 directory
PID:2732 -
C:\Windows\SysWOW64\Cnpknl32.exeC:\Windows\system32\Cnpknl32.exe93⤵PID:1876
-
C:\Windows\SysWOW64\Cghpgbce.exeC:\Windows\system32\Cghpgbce.exe94⤵PID:2000
-
C:\Windows\SysWOW64\Cpadpg32.exeC:\Windows\system32\Cpadpg32.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1732 -
C:\Windows\SysWOW64\Cgklma32.exeC:\Windows\system32\Cgklma32.exe96⤵PID:1996
-
C:\Windows\SysWOW64\Clheeh32.exeC:\Windows\system32\Clheeh32.exe97⤵PID:3044
-
C:\Windows\SysWOW64\Cjlenm32.exeC:\Windows\system32\Cjlenm32.exe98⤵PID:1432
-
C:\Windows\SysWOW64\Dcdjgbed.exeC:\Windows\system32\Dcdjgbed.exe99⤵PID:2408
-
C:\Windows\SysWOW64\Dfbfcn32.exeC:\Windows\system32\Dfbfcn32.exe100⤵PID:236
-
C:\Windows\SysWOW64\Dokjlcjh.exeC:\Windows\system32\Dokjlcjh.exe101⤵PID:3024
-
C:\Windows\SysWOW64\Ddgcdjip.exeC:\Windows\system32\Ddgcdjip.exe102⤵PID:524
-
C:\Windows\SysWOW64\Domgache.exeC:\Windows\system32\Domgache.exe103⤵PID:1644
-
C:\Windows\SysWOW64\Ddjpjj32.exeC:\Windows\system32\Ddjpjj32.exe104⤵PID:1716
-
C:\Windows\SysWOW64\Dgkike32.exeC:\Windows\system32\Dgkike32.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2892 -
C:\Windows\SysWOW64\Ecdffe32.exeC:\Windows\system32\Ecdffe32.exe106⤵PID:2980
-
C:\Windows\SysWOW64\Ecfcle32.exeC:\Windows\system32\Ecfcle32.exe107⤵PID:2004
-
C:\Windows\SysWOW64\Echpaecj.exeC:\Windows\system32\Echpaecj.exe108⤵PID:2036
-
C:\Windows\SysWOW64\Ejbhno32.exeC:\Windows\system32\Ejbhno32.exe109⤵PID:1140
-
C:\Windows\SysWOW64\Emadjj32.exeC:\Windows\system32\Emadjj32.exe110⤵PID:928
-
C:\Windows\SysWOW64\Eiheok32.exeC:\Windows\system32\Eiheok32.exe111⤵PID:2260
-
C:\Windows\SysWOW64\Epamlegl.exeC:\Windows\system32\Epamlegl.exe112⤵PID:2196
-
C:\Windows\SysWOW64\Fenedlec.exeC:\Windows\system32\Fenedlec.exe113⤵PID:1860
-
C:\Windows\SysWOW64\Fpdjaeei.exeC:\Windows\system32\Fpdjaeei.exe114⤵PID:2628
-
C:\Windows\SysWOW64\Flkjffkm.exeC:\Windows\system32\Flkjffkm.exe115⤵PID:2760
-
C:\Windows\SysWOW64\Flmglfhk.exeC:\Windows\system32\Flmglfhk.exe116⤵PID:2188
-
C:\Windows\SysWOW64\Fdhlphff.exeC:\Windows\system32\Fdhlphff.exe117⤵PID:2688
-
C:\Windows\SysWOW64\Fjbdmbmb.exeC:\Windows\system32\Fjbdmbmb.exe118⤵PID:2456
-
C:\Windows\SysWOW64\Fpoleilj.exeC:\Windows\system32\Fpoleilj.exe119⤵PID:912
-
C:\Windows\SysWOW64\Fjdqbbkp.exeC:\Windows\system32\Fjdqbbkp.exe120⤵PID:1724
-
C:\Windows\SysWOW64\Gaoiol32.exeC:\Windows\system32\Gaoiol32.exe121⤵PID:764
-
C:\Windows\SysWOW64\Gijncn32.exeC:\Windows\system32\Gijncn32.exe122⤵PID:1056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-