Analysis
-
max time kernel
89s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-11-2024 01:02
Behavioral task
behavioral1
Sample
2e259f43ebb4ccc359bec2748e0bb24fe352ea403879db4486e9fa8d261f9f18.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
120 seconds
General
-
Target
2e259f43ebb4ccc359bec2748e0bb24fe352ea403879db4486e9fa8d261f9f18.exe
-
Size
93KB
-
MD5
949e9979952a18c1f18ad250b9a124c6
-
SHA1
226b172145aaea25f8f558d38cdbcd264ef15447
-
SHA256
2e259f43ebb4ccc359bec2748e0bb24fe352ea403879db4486e9fa8d261f9f18
-
SHA512
0db7ab8cbc0a6bdea24d0e4eab29aebf758f64eac380457579bd5f39761780be7d07dc04181bef344f5bf594933deec28218526988ffb355a2057f1f65c0de3a
-
SSDEEP
1536:dPQfrAj8xitD9SuiLZ1cadOfMJks1DaYfMZRWuLsV+1T:1QfO8siN1cadO9sgYfc0DV+1T
Malware Config
Extracted
Family
berbew
C2
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Eddgaj32.exeHnlqemal.exeCjdmee32.exeEpjdbn32.exeBkmegaaf.exeJobnej32.exeCpjimk32.exeFgqcel32.exeKabbehjb.exeKhfdcgmp.exeGoohckob.exeFdcncg32.exeKplfmfmf.exeAhlnmjkf.exeIanambhc.exePfjdmggb.exeAbejlj32.exeHgbdge32.exeNikflm32.exeBjfkde32.exeKlqmaebl.exeDmhfpmee.exeJmmmbg32.exeDqiakm32.exeMcafbm32.exeDkakad32.exeHnnoempk.exeOlablfbm.exeJemkai32.exeJnncoini.exeIojoalda.exeCgdflb32.exeMlifie32.exeIjodiedi.exeEidchjbi.exeEcklgdag.exeOaaghp32.exeAogpmcmb.exeNqlikc32.exeFmicnhob.exeBihdfkoe.exeFpncbjqj.exeCdejpg32.exeAlnoepam.exeCpccnp32.exeJflikm32.exeEaoadb32.exeOkbgkk32.exeEpcomc32.exeAkjhcimg.exeAbfmecba.exeDeanooeb.exeHnbhpl32.exeMjgfol32.exeIfloeo32.exeHkidclbb.exeJbmdig32.exeKgqcam32.exeKidlodkj.exeMiphjf32.exeQokjcc32.exeCajokmfi.exeFnplgl32.exeLafgdfbm.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eddgaj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnlqemal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cjdmee32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epjdbn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkmegaaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jobnej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cpjimk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fgqcel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kabbehjb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Khfdcgmp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Goohckob.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdcncg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kplfmfmf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahlnmjkf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ianambhc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pfjdmggb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Abejlj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hgbdge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nikflm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjfkde32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Klqmaebl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmhfpmee.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmmmbg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dqiakm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mcafbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dkakad32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnnoempk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Olablfbm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jemkai32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnncoini.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iojoalda.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgdflb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlifie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ijodiedi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eidchjbi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ecklgdag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oaaghp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aogpmcmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nqlikc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmicnhob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bihdfkoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fpncbjqj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdejpg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Alnoepam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cpccnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jflikm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eaoadb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okbgkk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epcomc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akjhcimg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abfmecba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Deanooeb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnbhpl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mjgfol32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifloeo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hkidclbb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jbmdig32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgqcam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kidlodkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Miphjf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qokjcc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cajokmfi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fnplgl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lafgdfbm.exe -
Berbew family
-
Njrat family
-
Executes dropped EXE 64 IoCs
Processes:
Cjkamk32.exeDlnjjc32.exeDanohi32.exeDaplmimi.exeDmgmbj32.exeDkkmln32.exeEgdjfo32.exeEidchjbi.exeEigpmjqg.exeFofekp32.exeFdcncg32.exeFokofpif.exeFnplgl32.exeFcmdpcle.exeFnbhmlkk.exeGofajcog.exeGjkfglom.exeGjnbmlmj.exeGojkecka.exeGdgcnj32.exeGicpnhbb.exeGdjpcj32.exeGoodpb32.exeHjieapck.exeHminbkql.exeHmlkhk32.exeHmnhnk32.exeHjbhgolp.exeIlceog32.exeIbbffq32.exeIljkofkg.exeIhaldgak.exeIeelnkpd.exeJjbdfbnl.exeJanihlcf.exeJdobjgqg.exeJmggcmgg.exeJgpklb32.exeKbflqccl.exeKpeonkig.exeLdchdjom.exeLlomhllh.exeLoofjg32.exeLlcfck32.exeLhjghlng.exeMdahnmck.exeMbehgabe.exeMgaqohql.exeMbgela32.exeMgdmeh32.exeMnneabff.exeMcmkoi32.exeNijcgp32.exeNqakim32.exeNfncad32.exeNlklik32.exeNbddfe32.exeNmjicn32.exeNpieoi32.exeNfbmlckg.exeNalnmahf.exeNicfnn32.exeOldooi32.exeOaaghp32.exepid Process 2216 Cjkamk32.exe 2996 Dlnjjc32.exe 1380 Danohi32.exe 2896 Daplmimi.exe 2720 Dmgmbj32.exe 1616 Dkkmln32.exe 432 Egdjfo32.exe 2316 Eidchjbi.exe 2920 Eigpmjqg.exe 2280 Fofekp32.exe 1952 Fdcncg32.exe 1636 Fokofpif.exe 2208 Fnplgl32.exe 2128 Fcmdpcle.exe 904 Fnbhmlkk.exe 2364 Gofajcog.exe 2612 Gjkfglom.exe 2168 Gjnbmlmj.exe 1728 Gojkecka.exe 1548 Gdgcnj32.exe 964 Gicpnhbb.exe 1008 Gdjpcj32.exe 956 Goodpb32.exe 2388 Hjieapck.exe 688 Hminbkql.exe 868 Hmlkhk32.exe 2344 Hmnhnk32.exe 2864 Hjbhgolp.exe 2116 Ilceog32.exe 3028 Ibbffq32.exe 2756 Iljkofkg.exe 2572 Ihaldgak.exe 3048 Ieelnkpd.exe 700 Jjbdfbnl.exe 2312 Janihlcf.exe 2784 Jdobjgqg.exe 2176 Jmggcmgg.exe 2300 Jgpklb32.exe 1788 Kbflqccl.exe 1920 Kpeonkig.exe 2140 Ldchdjom.exe 2520 Llomhllh.exe 2684 Loofjg32.exe 808 Llcfck32.exe 996 Lhjghlng.exe 2540 Mdahnmck.exe 1512 Mbehgabe.exe 1776 Mgaqohql.exe 1676 Mbgela32.exe 2796 Mgdmeh32.exe 1968 Mnneabff.exe 1568 Mcmkoi32.exe 2872 Nijcgp32.exe 2072 Nqakim32.exe 2828 Nfncad32.exe 2936 Nlklik32.exe 2248 Nbddfe32.exe 2500 Nmjicn32.exe 3052 Npieoi32.exe 2320 Nfbmlckg.exe 2628 Nalnmahf.exe 1824 Nicfnn32.exe 2108 Oldooi32.exe 2668 Oaaghp32.exe -
Loads dropped DLL 64 IoCs
Processes:
2e259f43ebb4ccc359bec2748e0bb24fe352ea403879db4486e9fa8d261f9f18.exeCjkamk32.exeDlnjjc32.exeDanohi32.exeDaplmimi.exeDmgmbj32.exeDkkmln32.exeEgdjfo32.exeEidchjbi.exeEigpmjqg.exeFofekp32.exeFdcncg32.exeFokofpif.exeFnplgl32.exeFcmdpcle.exeFnbhmlkk.exeGofajcog.exeGjkfglom.exeGjnbmlmj.exeGojkecka.exeGdgcnj32.exeGicpnhbb.exeGdjpcj32.exeGoodpb32.exeHjieapck.exeHminbkql.exeHmlkhk32.exeHchpjddc.exeHjbhgolp.exeIlceog32.exeIbbffq32.exeIljkofkg.exepid Process 2608 2e259f43ebb4ccc359bec2748e0bb24fe352ea403879db4486e9fa8d261f9f18.exe 2608 2e259f43ebb4ccc359bec2748e0bb24fe352ea403879db4486e9fa8d261f9f18.exe 2216 Cjkamk32.exe 2216 Cjkamk32.exe 2996 Dlnjjc32.exe 2996 Dlnjjc32.exe 1380 Danohi32.exe 1380 Danohi32.exe 2896 Daplmimi.exe 2896 Daplmimi.exe 2720 Dmgmbj32.exe 2720 Dmgmbj32.exe 1616 Dkkmln32.exe 1616 Dkkmln32.exe 432 Egdjfo32.exe 432 Egdjfo32.exe 2316 Eidchjbi.exe 2316 Eidchjbi.exe 2920 Eigpmjqg.exe 2920 Eigpmjqg.exe 2280 Fofekp32.exe 2280 Fofekp32.exe 1952 Fdcncg32.exe 1952 Fdcncg32.exe 1636 Fokofpif.exe 1636 Fokofpif.exe 2208 Fnplgl32.exe 2208 Fnplgl32.exe 2128 Fcmdpcle.exe 2128 Fcmdpcle.exe 904 Fnbhmlkk.exe 904 Fnbhmlkk.exe 2364 Gofajcog.exe 2364 Gofajcog.exe 2612 Gjkfglom.exe 2612 Gjkfglom.exe 2168 Gjnbmlmj.exe 2168 Gjnbmlmj.exe 1728 Gojkecka.exe 1728 Gojkecka.exe 1548 Gdgcnj32.exe 1548 Gdgcnj32.exe 964 Gicpnhbb.exe 964 Gicpnhbb.exe 1008 Gdjpcj32.exe 1008 Gdjpcj32.exe 956 Goodpb32.exe 956 Goodpb32.exe 2388 Hjieapck.exe 2388 Hjieapck.exe 688 Hminbkql.exe 688 Hminbkql.exe 868 Hmlkhk32.exe 868 Hmlkhk32.exe 2172 Hchpjddc.exe 2172 Hchpjddc.exe 2864 Hjbhgolp.exe 2864 Hjbhgolp.exe 2116 Ilceog32.exe 2116 Ilceog32.exe 3028 Ibbffq32.exe 3028 Ibbffq32.exe 2756 Iljkofkg.exe 2756 Iljkofkg.exe -
Drops file in System32 directory 64 IoCs
Processes:
Ckdpinhf.exeHenipenb.exeNadpdg32.exeDndahokk.exeEogckqkk.exeAlcqcjgd.exeAogpmcmb.exeGpkckneh.exeHnbhpl32.exeBgnaekil.exeFgqcel32.exeMjmiknng.exeDbgknc32.exeFdcncg32.exeBkmegaaf.exeLhodgebh.exePiaiko32.exeNlklik32.exePlfjme32.exeLiohhbno.exeGmcmomjc.exeJfdigocb.exeBohoogbk.exeNjjbjk32.exeFefboabg.exeDmdkkm32.exeQhoeqide.exeMbgela32.exeIijdfc32.exeKejdqffo.exeEcnpgj32.exeDdjpjj32.exeAjnnipnc.exeIapfmg32.exeNkphmc32.exeBnfodojp.exeAeachphg.exeChkbjc32.exeIbbffq32.exeLgdcom32.exeCpogjh32.exeEiehilaa.exeEfoobkej.exeQpmgho32.exeEgimdmmc.exeEmlkoknp.exeBeoekl32.exeJnncoini.exeMdlfpcnd.exeJeiekgfq.exeChmlfj32.exeEgchocif.exePconjjql.exeLkolmk32.exeMinldf32.exeClnkdc32.exeKmnnblmj.exeGbeakllj.exeFofekp32.exeAhbqliap.exeGepeep32.exeOgncddpg.exeFfomjgoj.exedescription ioc Process File opened for modification C:\Windows\SysWOW64\Cfjdfg32.exe Ckdpinhf.exe File created C:\Windows\SysWOW64\Pmnfmdnb.dll Henipenb.exe File created C:\Windows\SysWOW64\Nkmdmm32.exe Nadpdg32.exe File created C:\Windows\SysWOW64\Onloqmmk.dll Dndahokk.exe File created C:\Windows\SysWOW64\Knjfogkd.dll Eogckqkk.exe File opened for modification C:\Windows\SysWOW64\Ahlnmjkf.exe Alcqcjgd.exe File created C:\Windows\SysWOW64\Apglgfde.exe Aogpmcmb.exe File created C:\Windows\SysWOW64\Glbcpokl.exe Gpkckneh.exe File created C:\Windows\SysWOW64\Djlmoilf.dll Hnbhpl32.exe File opened for modification C:\Windows\SysWOW64\Bnhjae32.exe Bgnaekil.exe File created C:\Windows\SysWOW64\Jjlacoca.dll Fgqcel32.exe File created C:\Windows\SysWOW64\Mbhnpplb.exe Mjmiknng.exe File opened for modification C:\Windows\SysWOW64\Dlppgihj.exe Dbgknc32.exe File opened for modification C:\Windows\SysWOW64\Fokofpif.exe Fdcncg32.exe File created C:\Windows\SysWOW64\Gnjmmlfg.dll Bkmegaaf.exe File created C:\Windows\SysWOW64\Bfmkmidp.dll Lhodgebh.exe File created C:\Windows\SysWOW64\Pcjmdd32.exe Piaiko32.exe File opened for modification C:\Windows\SysWOW64\Nbddfe32.exe Nlklik32.exe File created C:\Windows\SysWOW64\Qajiek32.exe Plfjme32.exe File opened for modification C:\Windows\SysWOW64\Lfbibfmi.exe Liohhbno.exe File opened for modification C:\Windows\SysWOW64\Nkmdmm32.exe Nadpdg32.exe File created C:\Windows\SysWOW64\Gdmekg32.exe Gmcmomjc.exe File created C:\Windows\SysWOW64\Naagdj32.dll Jfdigocb.exe File created C:\Windows\SysWOW64\Jnenmnck.dll Bohoogbk.exe File opened for modification C:\Windows\SysWOW64\Nqdjge32.exe Njjbjk32.exe File created C:\Windows\SysWOW64\Jadfnabd.dll Fefboabg.exe File created C:\Windows\SysWOW64\Dflpdb32.exe Dmdkkm32.exe File created C:\Windows\SysWOW64\Qagiio32.exe Qhoeqide.exe File opened for modification C:\Windows\SysWOW64\Mgdmeh32.exe Mbgela32.exe File opened for modification C:\Windows\SysWOW64\Ibbioilj.exe Iijdfc32.exe File created C:\Windows\SysWOW64\Kkglim32.exe Kejdqffo.exe File created C:\Windows\SysWOW64\Klliop32.dll Ecnpgj32.exe File created C:\Windows\SysWOW64\Bibkoabk.dll Ddjpjj32.exe File opened for modification C:\Windows\SysWOW64\Bqhffj32.exe Ajnnipnc.exe File created C:\Windows\SysWOW64\Koiohb32.dll Iapfmg32.exe File opened for modification C:\Windows\SysWOW64\Nbjpjm32.exe Nkphmc32.exe File opened for modification C:\Windows\SysWOW64\Bdpgai32.exe Bnfodojp.exe File opened for modification C:\Windows\SysWOW64\Anigaeoh.exe Aeachphg.exe File created C:\Windows\SysWOW64\Ddbbod32.exe Chkbjc32.exe File created C:\Windows\SysWOW64\Iljkofkg.exe Ibbffq32.exe File opened for modification C:\Windows\SysWOW64\Lmolkg32.exe Lgdcom32.exe File opened for modification C:\Windows\SysWOW64\Cjglcmbi.exe Cpogjh32.exe File created C:\Windows\SysWOW64\Ecklgdag.exe Eiehilaa.exe File created C:\Windows\SysWOW64\Eogckqkk.exe Efoobkej.exe File opened for modification C:\Windows\SysWOW64\Qggoeilh.exe Qpmgho32.exe File created C:\Windows\SysWOW64\Fgnfpm32.exe Egimdmmc.exe File created C:\Windows\SysWOW64\Gjoflo32.dll Emlkoknp.exe File created C:\Windows\SysWOW64\Oehgnffj.dll Beoekl32.exe File opened for modification C:\Windows\SysWOW64\Jgfghodj.exe Jnncoini.exe File opened for modification C:\Windows\SysWOW64\Nekbjf32.exe Mdlfpcnd.exe File created C:\Windows\SysWOW64\Joajdmma.exe Jeiekgfq.exe File created C:\Windows\SysWOW64\Dqiakm32.exe Chmlfj32.exe File created C:\Windows\SysWOW64\Eqklhh32.exe Egchocif.exe File created C:\Windows\SysWOW64\Pnebgcqb.exe Pconjjql.exe File created C:\Windows\SysWOW64\Hbdmij32.dll Lkolmk32.exe File created C:\Windows\SysWOW64\Gdmnphna.dll Minldf32.exe File created C:\Windows\SysWOW64\Eeebfj32.dll Clnkdc32.exe File created C:\Windows\SysWOW64\Ihnfpjjj.dll Kmnnblmj.exe File opened for modification C:\Windows\SysWOW64\Gmjehe32.exe Gbeakllj.exe File created C:\Windows\SysWOW64\Fdcncg32.exe Fofekp32.exe File created C:\Windows\SysWOW64\Bklifdmh.dll Ahbqliap.exe File created C:\Windows\SysWOW64\Gmkjjbhg.exe Gepeep32.exe File created C:\Windows\SysWOW64\Gpcghm32.dll Ogncddpg.exe File created C:\Windows\SysWOW64\Fccncknc.exe Ffomjgoj.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 3772 2008 WerFault.exe 1014 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Imaglc32.exeLckdcn32.exeAhcoli32.exeIhhehoci.exeBgkeol32.exeJbjejojn.exeMchjjc32.exeDechlfkl.exeDmkipb32.exeMfngdmgb.exeBciohe32.exeBpfhfjgq.exeEeicenni.exeFlhnqf32.exeKbllfmfc.exeOddmokoo.exeNeohbe32.exeLalchnfl.exeOmmdqi32.exeFimedaoe.exeIdncdgai.exeNikflm32.exeNqjmec32.exeChldbl32.exeJkklpk32.exeOoaiehhj.exeOepjmbka.exePaihgboc.exeDqknqleg.exeEheblj32.exeNacgpi32.exeGebflaga.exeKlqmaebl.exeBfgkdp32.exeNkhhie32.exePdqfnhpa.exeKmkodd32.exeJakjlpif.exeGojkecka.exeFpncbjqj.exeDjokgk32.exeDonijk32.exeDaoeeo32.exeHcbogk32.exeOmgckcmm.exeBqhffj32.exeNgcebnen.exeFcfojhhh.exeDgjdjghf.exeFccncknc.exeFeppqc32.exePegaje32.exeNbckeb32.exeNijcgp32.exeOjilqf32.exeJjjohbgl.exeGlkinb32.exePieobaiq.exeGbeakllj.exeHjlekm32.exeEiipfbgj.exeFnplgl32.exeBhgaan32.exeGqmmhdka.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Imaglc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lckdcn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahcoli32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihhehoci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgkeol32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbjejojn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mchjjc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dechlfkl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmkipb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mfngdmgb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bciohe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bpfhfjgq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eeicenni.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flhnqf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbllfmfc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oddmokoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Neohbe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lalchnfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ommdqi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fimedaoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Idncdgai.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nikflm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nqjmec32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chldbl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkklpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ooaiehhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oepjmbka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Paihgboc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dqknqleg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eheblj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nacgpi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gebflaga.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klqmaebl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfgkdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nkhhie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pdqfnhpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmkodd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jakjlpif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gojkecka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpncbjqj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djokgk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Donijk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Daoeeo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hcbogk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Omgckcmm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bqhffj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ngcebnen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fcfojhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dgjdjghf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fccncknc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Feppqc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pegaje32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nbckeb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nijcgp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojilqf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjjohbgl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Glkinb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pieobaiq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbeakllj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hjlekm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eiipfbgj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnplgl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhgaan32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gqmmhdka.exe -
Modifies registry class 64 IoCs
Processes:
Gqidme32.exeNgcebnen.exeIhhehoci.exeEcnbpcje.exeFmicnhob.exeHqpjndio.exeDjffihmp.exeLmolkg32.exeEheblj32.exeLedpjdid.exeDldndf32.exeBfdlehlc.exeBohoogbk.exeMphhbblp.exeBimnqk32.exeHafdbmjp.exeJpppbf32.exeOaeqeljm.exeQpmgho32.exePpgfciee.exeAhlnmjkf.exeBgfdjfkh.exeBocfch32.exeMakmnh32.exeDgemgm32.exeCpogjh32.exeJmggcmgg.exeGhlell32.exeMpegka32.exeKfiajj32.exeQfdnnlbc.exeCjiiim32.exeFgelbhmg.exeOjlife32.exeGpfggeai.exeLbijgg32.exeMclbkjcf.exeBakgmgpe.exeClnkdc32.exeMjappa32.exeIlceog32.exeNqamaeii.exePbnfdpge.exeLkolmk32.exeNkhkbmco.exeEclejclg.exeEcnpgj32.exeFblpnepn.exeFlkjffkm.exeEnpoje32.exeLkomhp32.exeMfngdmgb.exeKdincdcl.exeFbpihafp.exeMbdhinmf.exeGmkgqncd.exeBlkgdmbp.exeOglfodai.exePahjgb32.exeFondonbc.exeCjdmee32.exeHfanjcke.exeEfbbba32.exePnebgcqb.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmkapcaf.dll" Gqidme32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ngcebnen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ihhehoci.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ecnbpcje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fmicnhob.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hqpjndio.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Djffihmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Joceen32.dll" Lmolkg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eheblj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ledpjdid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dldndf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bfdlehlc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bohoogbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjicnk32.dll" Mphhbblp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bimnqk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmpepjid.dll" Hafdbmjp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jpppbf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oaeqeljm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogdbjhgb.dll" Qpmgho32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ppgfciee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ahlnmjkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eghenfkp.dll" Bgfdjfkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bocfch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Makmnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbdlphnb.dll" Dgemgm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmooblli.dll" Cpogjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jmggcmgg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ghlell32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mpegka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kfiajj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qfdnnlbc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cjiiim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npcmhi32.dll" Fgelbhmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikejpa32.dll" Ojlife32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bqnknp32.dll" Gpfggeai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lbijgg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mclbkjcf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bakgmgpe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Clnkdc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mjappa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjnhce32.dll" Ilceog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nqamaeii.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pbnfdpge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbdmij32.dll" Lkolmk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nkhkbmco.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eclejclg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ecnpgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbchlkgc.dll" Fblpnepn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Flkjffkm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Enpoje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lkomhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mfngdmgb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kdincdcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gobhbe32.dll" Fbpihafp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mbdhinmf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gmkgqncd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Blkgdmbp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oglfodai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pahjgb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fondonbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cedhac32.dll" Cjdmee32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hfanjcke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfodod32.dll" Efbbba32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpjpgo32.dll" Pnebgcqb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2e259f43ebb4ccc359bec2748e0bb24fe352ea403879db4486e9fa8d261f9f18.exeCjkamk32.exeDlnjjc32.exeDanohi32.exeDaplmimi.exeDmgmbj32.exeDkkmln32.exeEgdjfo32.exeEidchjbi.exeEigpmjqg.exeFofekp32.exeFdcncg32.exeFokofpif.exeFnplgl32.exeFcmdpcle.exeFnbhmlkk.exedescription pid Process procid_target PID 2608 wrote to memory of 2216 2608 2e259f43ebb4ccc359bec2748e0bb24fe352ea403879db4486e9fa8d261f9f18.exe 29 PID 2608 wrote to memory of 2216 2608 2e259f43ebb4ccc359bec2748e0bb24fe352ea403879db4486e9fa8d261f9f18.exe 29 PID 2608 wrote to memory of 2216 2608 2e259f43ebb4ccc359bec2748e0bb24fe352ea403879db4486e9fa8d261f9f18.exe 29 PID 2608 wrote to memory of 2216 2608 2e259f43ebb4ccc359bec2748e0bb24fe352ea403879db4486e9fa8d261f9f18.exe 29 PID 2216 wrote to memory of 2996 2216 Cjkamk32.exe 30 PID 2216 wrote to memory of 2996 2216 Cjkamk32.exe 30 PID 2216 wrote to memory of 2996 2216 Cjkamk32.exe 30 PID 2216 wrote to memory of 2996 2216 Cjkamk32.exe 30 PID 2996 wrote to memory of 1380 2996 Dlnjjc32.exe 31 PID 2996 wrote to memory of 1380 2996 Dlnjjc32.exe 31 PID 2996 wrote to memory of 1380 2996 Dlnjjc32.exe 31 PID 2996 wrote to memory of 1380 2996 Dlnjjc32.exe 31 PID 1380 wrote to memory of 2896 1380 Danohi32.exe 32 PID 1380 wrote to memory of 2896 1380 Danohi32.exe 32 PID 1380 wrote to memory of 2896 1380 Danohi32.exe 32 PID 1380 wrote to memory of 2896 1380 Danohi32.exe 32 PID 2896 wrote to memory of 2720 2896 Daplmimi.exe 33 PID 2896 wrote to memory of 2720 2896 Daplmimi.exe 33 PID 2896 wrote to memory of 2720 2896 Daplmimi.exe 33 PID 2896 wrote to memory of 2720 2896 Daplmimi.exe 33 PID 2720 wrote to memory of 1616 2720 Dmgmbj32.exe 34 PID 2720 wrote to memory of 1616 2720 Dmgmbj32.exe 34 PID 2720 wrote to memory of 1616 2720 Dmgmbj32.exe 34 PID 2720 wrote to memory of 1616 2720 Dmgmbj32.exe 34 PID 1616 wrote to memory of 432 1616 Dkkmln32.exe 35 PID 1616 wrote to memory of 432 1616 Dkkmln32.exe 35 PID 1616 wrote to memory of 432 1616 Dkkmln32.exe 35 PID 1616 wrote to memory of 432 1616 Dkkmln32.exe 35 PID 432 wrote to memory of 2316 432 Egdjfo32.exe 36 PID 432 wrote to memory of 2316 432 Egdjfo32.exe 36 PID 432 wrote to memory of 2316 432 Egdjfo32.exe 36 PID 432 wrote to memory of 2316 432 Egdjfo32.exe 36 PID 2316 wrote to memory of 2920 2316 Eidchjbi.exe 37 PID 2316 wrote to memory of 2920 2316 Eidchjbi.exe 37 PID 2316 wrote to memory of 2920 2316 Eidchjbi.exe 37 PID 2316 wrote to memory of 2920 2316 Eidchjbi.exe 37 PID 2920 wrote to memory of 2280 2920 Eigpmjqg.exe 38 PID 2920 wrote to memory of 2280 2920 Eigpmjqg.exe 38 PID 2920 wrote to memory of 2280 2920 Eigpmjqg.exe 38 PID 2920 wrote to memory of 2280 2920 Eigpmjqg.exe 38 PID 2280 wrote to memory of 1952 2280 Fofekp32.exe 39 PID 2280 wrote to memory of 1952 2280 Fofekp32.exe 39 PID 2280 wrote to memory of 1952 2280 Fofekp32.exe 39 PID 2280 wrote to memory of 1952 2280 Fofekp32.exe 39 PID 1952 wrote to memory of 1636 1952 Fdcncg32.exe 40 PID 1952 wrote to memory of 1636 1952 Fdcncg32.exe 40 PID 1952 wrote to memory of 1636 1952 Fdcncg32.exe 40 PID 1952 wrote to memory of 1636 1952 Fdcncg32.exe 40 PID 1636 wrote to memory of 2208 1636 Fokofpif.exe 41 PID 1636 wrote to memory of 2208 1636 Fokofpif.exe 41 PID 1636 wrote to memory of 2208 1636 Fokofpif.exe 41 PID 1636 wrote to memory of 2208 1636 Fokofpif.exe 41 PID 2208 wrote to memory of 2128 2208 Fnplgl32.exe 42 PID 2208 wrote to memory of 2128 2208 Fnplgl32.exe 42 PID 2208 wrote to memory of 2128 2208 Fnplgl32.exe 42 PID 2208 wrote to memory of 2128 2208 Fnplgl32.exe 42 PID 2128 wrote to memory of 904 2128 Fcmdpcle.exe 43 PID 2128 wrote to memory of 904 2128 Fcmdpcle.exe 43 PID 2128 wrote to memory of 904 2128 Fcmdpcle.exe 43 PID 2128 wrote to memory of 904 2128 Fcmdpcle.exe 43 PID 904 wrote to memory of 2364 904 Fnbhmlkk.exe 44 PID 904 wrote to memory of 2364 904 Fnbhmlkk.exe 44 PID 904 wrote to memory of 2364 904 Fnbhmlkk.exe 44 PID 904 wrote to memory of 2364 904 Fnbhmlkk.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e259f43ebb4ccc359bec2748e0bb24fe352ea403879db4486e9fa8d261f9f18.exe"C:\Users\Admin\AppData\Local\Temp\2e259f43ebb4ccc359bec2748e0bb24fe352ea403879db4486e9fa8d261f9f18.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\Cjkamk32.exeC:\Windows\system32\Cjkamk32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\Dlnjjc32.exeC:\Windows\system32\Dlnjjc32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\Danohi32.exeC:\Windows\system32\Danohi32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\Daplmimi.exeC:\Windows\system32\Daplmimi.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\Dmgmbj32.exeC:\Windows\system32\Dmgmbj32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\Dkkmln32.exeC:\Windows\system32\Dkkmln32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\Egdjfo32.exeC:\Windows\system32\Egdjfo32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\Eidchjbi.exeC:\Windows\system32\Eidchjbi.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\Eigpmjqg.exeC:\Windows\system32\Eigpmjqg.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\Fofekp32.exeC:\Windows\system32\Fofekp32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\Fdcncg32.exeC:\Windows\system32\Fdcncg32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\Fokofpif.exeC:\Windows\system32\Fokofpif.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\Fnplgl32.exeC:\Windows\system32\Fnplgl32.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\Fcmdpcle.exeC:\Windows\system32\Fcmdpcle.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\Fnbhmlkk.exeC:\Windows\system32\Fnbhmlkk.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\Gofajcog.exeC:\Windows\system32\Gofajcog.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Windows\SysWOW64\Gjkfglom.exeC:\Windows\system32\Gjkfglom.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Windows\SysWOW64\Gjnbmlmj.exeC:\Windows\system32\Gjnbmlmj.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Windows\SysWOW64\Gojkecka.exeC:\Windows\system32\Gojkecka.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1728 -
C:\Windows\SysWOW64\Gdgcnj32.exeC:\Windows\system32\Gdgcnj32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Windows\SysWOW64\Gicpnhbb.exeC:\Windows\system32\Gicpnhbb.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Windows\SysWOW64\Gdjpcj32.exeC:\Windows\system32\Gdjpcj32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Windows\SysWOW64\Goodpb32.exeC:\Windows\system32\Goodpb32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Windows\SysWOW64\Hjieapck.exeC:\Windows\system32\Hjieapck.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Windows\SysWOW64\Hminbkql.exeC:\Windows\system32\Hminbkql.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:688 -
C:\Windows\SysWOW64\Hmlkhk32.exeC:\Windows\system32\Hmlkhk32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Windows\SysWOW64\Hmnhnk32.exeC:\Windows\system32\Hmnhnk32.exe28⤵
- Executes dropped EXE
PID:2344 -
C:\Windows\SysWOW64\Hchpjddc.exeC:\Windows\system32\Hchpjddc.exe29⤵
- Loads dropped DLL
PID:2172 -
C:\Windows\SysWOW64\Hjbhgolp.exeC:\Windows\system32\Hjbhgolp.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Windows\SysWOW64\Ilceog32.exeC:\Windows\system32\Ilceog32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2116 -
C:\Windows\SysWOW64\Ibbffq32.exeC:\Windows\system32\Ibbffq32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:3028 -
C:\Windows\SysWOW64\Iljkofkg.exeC:\Windows\system32\Iljkofkg.exe33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Windows\SysWOW64\Ihaldgak.exeC:\Windows\system32\Ihaldgak.exe34⤵
- Executes dropped EXE
PID:2572 -
C:\Windows\SysWOW64\Ieelnkpd.exeC:\Windows\system32\Ieelnkpd.exe35⤵
- Executes dropped EXE
PID:3048 -
C:\Windows\SysWOW64\Jjbdfbnl.exeC:\Windows\system32\Jjbdfbnl.exe36⤵
- Executes dropped EXE
PID:700 -
C:\Windows\SysWOW64\Janihlcf.exeC:\Windows\system32\Janihlcf.exe37⤵
- Executes dropped EXE
PID:2312 -
C:\Windows\SysWOW64\Jdobjgqg.exeC:\Windows\system32\Jdobjgqg.exe38⤵
- Executes dropped EXE
PID:2784 -
C:\Windows\SysWOW64\Jmggcmgg.exeC:\Windows\system32\Jmggcmgg.exe39⤵
- Executes dropped EXE
- Modifies registry class
PID:2176 -
C:\Windows\SysWOW64\Jgpklb32.exeC:\Windows\system32\Jgpklb32.exe40⤵
- Executes dropped EXE
PID:2300 -
C:\Windows\SysWOW64\Kbflqccl.exeC:\Windows\system32\Kbflqccl.exe41⤵
- Executes dropped EXE
PID:1788 -
C:\Windows\SysWOW64\Kpeonkig.exeC:\Windows\system32\Kpeonkig.exe42⤵
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\Ldchdjom.exeC:\Windows\system32\Ldchdjom.exe43⤵
- Executes dropped EXE
PID:2140 -
C:\Windows\SysWOW64\Llomhllh.exeC:\Windows\system32\Llomhllh.exe44⤵
- Executes dropped EXE
PID:2520 -
C:\Windows\SysWOW64\Loofjg32.exeC:\Windows\system32\Loofjg32.exe45⤵
- Executes dropped EXE
PID:2684 -
C:\Windows\SysWOW64\Llcfck32.exeC:\Windows\system32\Llcfck32.exe46⤵
- Executes dropped EXE
PID:808 -
C:\Windows\SysWOW64\Lhjghlng.exeC:\Windows\system32\Lhjghlng.exe47⤵
- Executes dropped EXE
PID:996 -
C:\Windows\SysWOW64\Mdahnmck.exeC:\Windows\system32\Mdahnmck.exe48⤵
- Executes dropped EXE
PID:2540 -
C:\Windows\SysWOW64\Mbehgabe.exeC:\Windows\system32\Mbehgabe.exe49⤵
- Executes dropped EXE
PID:1512 -
C:\Windows\SysWOW64\Mgaqohql.exeC:\Windows\system32\Mgaqohql.exe50⤵
- Executes dropped EXE
PID:1776 -
C:\Windows\SysWOW64\Mbgela32.exeC:\Windows\system32\Mbgela32.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1676 -
C:\Windows\SysWOW64\Mgdmeh32.exeC:\Windows\system32\Mgdmeh32.exe52⤵
- Executes dropped EXE
PID:2796 -
C:\Windows\SysWOW64\Mnneabff.exeC:\Windows\system32\Mnneabff.exe53⤵
- Executes dropped EXE
PID:1968 -
C:\Windows\SysWOW64\Mcmkoi32.exeC:\Windows\system32\Mcmkoi32.exe54⤵
- Executes dropped EXE
PID:1568 -
C:\Windows\SysWOW64\Nijcgp32.exeC:\Windows\system32\Nijcgp32.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2872 -
C:\Windows\SysWOW64\Nqakim32.exeC:\Windows\system32\Nqakim32.exe56⤵
- Executes dropped EXE
PID:2072 -
C:\Windows\SysWOW64\Nfncad32.exeC:\Windows\system32\Nfncad32.exe57⤵
- Executes dropped EXE
PID:2828 -
C:\Windows\SysWOW64\Nlklik32.exeC:\Windows\system32\Nlklik32.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2936 -
C:\Windows\SysWOW64\Nbddfe32.exeC:\Windows\system32\Nbddfe32.exe59⤵
- Executes dropped EXE
PID:2248 -
C:\Windows\SysWOW64\Nmjicn32.exeC:\Windows\system32\Nmjicn32.exe60⤵
- Executes dropped EXE
PID:2500 -
C:\Windows\SysWOW64\Npieoi32.exeC:\Windows\system32\Npieoi32.exe61⤵
- Executes dropped EXE
PID:3052 -
C:\Windows\SysWOW64\Nfbmlckg.exeC:\Windows\system32\Nfbmlckg.exe62⤵
- Executes dropped EXE
PID:2320 -
C:\Windows\SysWOW64\Nalnmahf.exeC:\Windows\system32\Nalnmahf.exe63⤵
- Executes dropped EXE
PID:2628 -
C:\Windows\SysWOW64\Nicfnn32.exeC:\Windows\system32\Nicfnn32.exe64⤵
- Executes dropped EXE
PID:1824 -
C:\Windows\SysWOW64\Oldooi32.exeC:\Windows\system32\Oldooi32.exe65⤵
- Executes dropped EXE
PID:2108 -
C:\Windows\SysWOW64\Oaaghp32.exeC:\Windows\system32\Oaaghp32.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2668 -
C:\Windows\SysWOW64\Ododdlcd.exeC:\Windows\system32\Ododdlcd.exe67⤵PID:1036
-
C:\Windows\SysWOW64\Ojilqf32.exeC:\Windows\system32\Ojilqf32.exe68⤵
- System Location Discovery: System Language Discovery
PID:1596 -
C:\Windows\SysWOW64\Odaqikaa.exeC:\Windows\system32\Odaqikaa.exe69⤵PID:1516
-
C:\Windows\SysWOW64\Ojlife32.exeC:\Windows\system32\Ojlife32.exe70⤵
- Modifies registry class
PID:1656 -
C:\Windows\SysWOW64\Oddmokoo.exeC:\Windows\system32\Oddmokoo.exe71⤵
- System Location Discovery: System Language Discovery
PID:1680 -
C:\Windows\SysWOW64\Ojnelefl.exeC:\Windows\system32\Ojnelefl.exe72⤵PID:1476
-
C:\Windows\SysWOW64\Odfjdk32.exeC:\Windows\system32\Odfjdk32.exe73⤵PID:2044
-
C:\Windows\SysWOW64\Ofefqf32.exeC:\Windows\system32\Ofefqf32.exe74⤵PID:2984
-
C:\Windows\SysWOW64\Pbkgegad.exeC:\Windows\system32\Pbkgegad.exe75⤵PID:2968
-
C:\Windows\SysWOW64\Pieobaiq.exeC:\Windows\system32\Pieobaiq.exe76⤵
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Windows\SysWOW64\Pbnckg32.exeC:\Windows\system32\Pbnckg32.exe77⤵PID:2736
-
C:\Windows\SysWOW64\Pihlhagn.exeC:\Windows\system32\Pihlhagn.exe78⤵PID:2088
-
C:\Windows\SysWOW64\Pkkeeikj.exeC:\Windows\system32\Pkkeeikj.exe79⤵PID:2532
-
C:\Windows\SysWOW64\Paemac32.exeC:\Windows\system32\Paemac32.exe80⤵PID:2308
-
C:\Windows\SysWOW64\Pahjgb32.exeC:\Windows\system32\Pahjgb32.exe81⤵
- Modifies registry class
PID:2940 -
C:\Windows\SysWOW64\Qkpnph32.exeC:\Windows\system32\Qkpnph32.exe82⤵PID:1248
-
C:\Windows\SysWOW64\Qpmgho32.exeC:\Windows\system32\Qpmgho32.exe83⤵
- Drops file in System32 directory
- Modifies registry class
PID:468 -
C:\Windows\SysWOW64\Qggoeilh.exeC:\Windows\system32\Qggoeilh.exe84⤵PID:2060
-
C:\Windows\SysWOW64\Qpocno32.exeC:\Windows\system32\Qpocno32.exe85⤵PID:580
-
C:\Windows\SysWOW64\Acnpjj32.exeC:\Windows\system32\Acnpjj32.exe86⤵PID:976
-
C:\Windows\SysWOW64\Apapcnaf.exeC:\Windows\system32\Apapcnaf.exe87⤵PID:2384
-
C:\Windows\SysWOW64\Aglhph32.exeC:\Windows\system32\Aglhph32.exe88⤵PID:796
-
C:\Windows\SysWOW64\Ajjeld32.exeC:\Windows\system32\Ajjeld32.exe89⤵PID:2164
-
C:\Windows\SysWOW64\Ajlabc32.exeC:\Windows\system32\Ajlabc32.exe90⤵PID:2652
-
C:\Windows\SysWOW64\Aoijjjcl.exeC:\Windows\system32\Aoijjjcl.exe91⤵PID:2020
-
C:\Windows\SysWOW64\Adfbbabc.exeC:\Windows\system32\Adfbbabc.exe92⤵PID:2808
-
C:\Windows\SysWOW64\Aokfpjai.exeC:\Windows\system32\Aokfpjai.exe93⤵PID:2744
-
C:\Windows\SysWOW64\Afeold32.exeC:\Windows\system32\Afeold32.exe94⤵PID:3016
-
C:\Windows\SysWOW64\Bnqcaffa.exeC:\Windows\system32\Bnqcaffa.exe95⤵PID:568
-
C:\Windows\SysWOW64\Bhfhnofg.exeC:\Windows\system32\Bhfhnofg.exe96⤵PID:2704
-
C:\Windows\SysWOW64\Bbolge32.exeC:\Windows\system32\Bbolge32.exe97⤵PID:2292
-
C:\Windows\SysWOW64\Bgkeol32.exeC:\Windows\system32\Bgkeol32.exe98⤵
- System Location Discovery: System Language Discovery
PID:632 -
C:\Windows\SysWOW64\Bqciha32.exeC:\Windows\system32\Bqciha32.exe99⤵PID:2464
-
C:\Windows\SysWOW64\Bgnaekil.exeC:\Windows\system32\Bgnaekil.exe100⤵
- Drops file in System32 directory
PID:572 -
C:\Windows\SysWOW64\Bnhjae32.exeC:\Windows\system32\Bnhjae32.exe101⤵PID:824
-
C:\Windows\SysWOW64\Boifinfg.exeC:\Windows\system32\Boifinfg.exe102⤵PID:748
-
C:\Windows\SysWOW64\Bqhbcqmj.exeC:\Windows\system32\Bqhbcqmj.exe103⤵PID:2648
-
C:\Windows\SysWOW64\Bbjoki32.exeC:\Windows\system32\Bbjoki32.exe104⤵PID:2340
-
C:\Windows\SysWOW64\Ccileljk.exeC:\Windows\system32\Ccileljk.exe105⤵PID:520
-
C:\Windows\SysWOW64\Cifdmbib.exeC:\Windows\system32\Cifdmbib.exe106⤵PID:3020
-
C:\Windows\SysWOW64\Ckdpinhf.exeC:\Windows\system32\Ckdpinhf.exe107⤵
- Drops file in System32 directory
PID:2752 -
C:\Windows\SysWOW64\Cfjdfg32.exeC:\Windows\system32\Cfjdfg32.exe108⤵PID:2676
-
C:\Windows\SysWOW64\Cgkanomj.exeC:\Windows\system32\Cgkanomj.exe109⤵PID:872
-
C:\Windows\SysWOW64\Cpbiolnl.exeC:\Windows\system32\Cpbiolnl.exe110⤵PID:3040
-
C:\Windows\SysWOW64\Cgmndokg.exeC:\Windows\system32\Cgmndokg.exe111⤵PID:2508
-
C:\Windows\SysWOW64\Cjljpjjk.exeC:\Windows\system32\Cjljpjjk.exe112⤵PID:2192
-
C:\Windows\SysWOW64\Clkfjman.exeC:\Windows\system32\Clkfjman.exe113⤵PID:2336
-
C:\Windows\SysWOW64\Dbcnpk32.exeC:\Windows\system32\Dbcnpk32.exe114⤵PID:1428
-
C:\Windows\SysWOW64\Egimdmmc.exeC:\Windows\system32\Egimdmmc.exe115⤵
- Drops file in System32 directory
PID:1848 -
C:\Windows\SysWOW64\Fgnfpm32.exeC:\Windows\system32\Fgnfpm32.exe116⤵PID:2012
-
C:\Windows\SysWOW64\Fmholgpj.exeC:\Windows\system32\Fmholgpj.exe117⤵PID:2824
-
C:\Windows\SysWOW64\Fdbgia32.exeC:\Windows\system32\Fdbgia32.exe118⤵PID:1528
-
C:\Windows\SysWOW64\Fgqcel32.exeC:\Windows\system32\Fgqcel32.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2804 -
C:\Windows\SysWOW64\Fmjkbfnh.exeC:\Windows\system32\Fmjkbfnh.exe120⤵PID:2100
-
C:\Windows\SysWOW64\Fgcpkldh.exeC:\Windows\system32\Fgcpkldh.exe121⤵PID:1740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-