Analysis
-
max time kernel
94s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2024 19:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
137b337323794e608487515f387cb22a247c2cc59d0f9a987e70bbb8899c2bba.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
137b337323794e608487515f387cb22a247c2cc59d0f9a987e70bbb8899c2bba.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
137b337323794e608487515f387cb22a247c2cc59d0f9a987e70bbb8899c2bba.exe
-
Size
88KB
-
MD5
704c05c5d8399fc63fc02a7bb79e1608
-
SHA1
52fc777d50db228c446aae3e5624d208a58df2da
-
SHA256
137b337323794e608487515f387cb22a247c2cc59d0f9a987e70bbb8899c2bba
-
SHA512
f8af9072dbe79960f1defa8646d02ece843db5bbba3f772df514d41443854bf5110ae5047bbb7237ad55aa899af3f31fe7d05d5fcb0da0ac95b5b21f809c744c
-
SSDEEP
1536:UyxRxuv+Cw3kpx0VsdmCGfOqJmROLC+EIdnouy8B:U7v+CfMeH+EIloutB
Score
10/10
Malware Config
Extracted
Family
berbew
C2
http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jnbpkcad.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gnaonh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hgqigmnb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aqhccj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bmkccjik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Djfcdk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbbajgeg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fkgbfo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Amodhkci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ejhpjjah.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lehakj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejmiej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nnbebk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pqhafcoc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Edcgcfja.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fangbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jlmgegjf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oeiche32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Afpbpbpa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnfclm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kindoe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lagedeia.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aqijmq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ifmiqbld.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mojhjnog.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afpbpbpa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bgknfcmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dcedga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Golamlib.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjbkjb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qhjean32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ammgblek.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eagabceo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nhhlilld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mpebch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eonekn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ghklfq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Diopji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Inddje32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghflqk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lnflcjlq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhhlilld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Amkagb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hffbpcbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jinkikkb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcedga32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fejjnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Edngmp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Idfhbhik.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hbmcedhp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jbkpfb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmfjhj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fpeaio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Npcodf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mecqfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kgcapa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kigged32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qdkcgqad.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ekpmepok.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbljklah.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ooagak32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pckpcgge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Efdjjkcf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnfmmc32.exe -
Berbew family
-
Executes dropped EXE 64 IoCs
pid Process 1720 Lmmcqn32.exe 2168 Ldgkmhno.exe 1380 Leihep32.exe 4492 Lpnlbi32.exe 1976 Lghdockp.exe 4520 Llemgj32.exe 928 Mboeddad.exe 4352 Mmdiamqj.exe 4216 Mdnang32.exe 984 Mikjfn32.exe 4744 Mpebch32.exe 4564 Mgokpbeh.exe 940 Mllchico.exe 4104 Mipcambi.exe 444 Megdfnhm.exe 2012 Mlqlch32.exe 244 Nlciih32.exe 1816 Nghmfqmm.exe 712 Nnbebk32.exe 2452 Nconka32.exe 3092 Nnebhj32.exe 1404 Npcodf32.exe 1176 Njlcmk32.exe 2140 Ndagjd32.exe 2192 Njnpck32.exe 4116 Ophhpene.exe 2736 Ojplhkdf.exe 4692 Opjeee32.exe 2696 Ofgmml32.exe 2460 Opmakd32.exe 1912 Ogfjgo32.exe 5112 Olcbpe32.exe 1232 Ocmjlpfa.exe 1000 Ojgbij32.exe 3892 Odmgfb32.exe 336 Ofncnkcb.exe 2440 Omhlkeko.exe 5084 Pjlldiji.exe 4880 Pqfdac32.exe 3856 Pdapabjo.exe 3392 Pjnijihf.exe 1536 Pqhafcoc.exe 2304 Pcgmbnnf.exe 1036 Pnlapgnl.exe 3532 Pdfjla32.exe 2540 Pgdfim32.exe 2772 Pmanaccd.exe 4828 Pckfnn32.exe 2236 Pjeojhbn.exe 4280 Qmdkfcaa.exe 4580 Qdkcgqad.exe 3976 Qflpoi32.exe 4128 Qncgqf32.exe 4980 Qdmpmp32.exe 2160 Qgllil32.exe 116 Qfolehep.exe 2800 Qjjheg32.exe 2164 Aqdqbaee.exe 3076 Agniok32.exe 2016 Ajlekg32.exe 2320 Amkagb32.exe 908 Aebihpkl.exe 3960 Afcfph32.exe 1512 Aqijmq32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Igikac32.dll Mllchico.exe File created C:\Windows\SysWOW64\Oaaale32.dll Pjeojhbn.exe File created C:\Windows\SysWOW64\Aqdqbaee.exe Qjjheg32.exe File opened for modification C:\Windows\SysWOW64\Ekpmepok.exe Edfdhego.exe File created C:\Windows\SysWOW64\Ofebgdpd.dll Eeeqbhoa.exe File created C:\Windows\SysWOW64\Kkaflc32.dll Fkdfpokf.exe File created C:\Windows\SysWOW64\Epopmd32.dll Jbkpfb32.exe File opened for modification C:\Windows\SysWOW64\Mflgpl32.exe Mbqkomke.exe File opened for modification C:\Windows\SysWOW64\Ajqglpde.exe Agbkpdea.exe File opened for modification C:\Windows\SysWOW64\Emihleoi.exe Ehlpcopa.exe File created C:\Windows\SysWOW64\Hpomfkko.exe Hnaqjplk.exe File created C:\Windows\SysWOW64\Gejbmi32.dll Nlciih32.exe File opened for modification C:\Windows\SysWOW64\Jelihn32.exe Jfihmabf.exe File opened for modification C:\Windows\SysWOW64\Lhdqaeag.exe Leedejbd.exe File created C:\Windows\SysWOW64\Gmefidkh.dll Npbhjp32.exe File opened for modification C:\Windows\SysWOW64\Pjbkjb32.exe Pgdonf32.exe File opened for modification C:\Windows\SysWOW64\Agbkpdea.exe Aqhccj32.exe File opened for modification C:\Windows\SysWOW64\Ggdbah32.exe Gdffem32.exe File opened for modification C:\Windows\SysWOW64\Qdkcgqad.exe Qmdkfcaa.exe File created C:\Windows\SysWOW64\Bnfmmc32.exe Bglepipb.exe File created C:\Windows\SysWOW64\Cdabfhjf.exe Cjhmnc32.exe File created C:\Windows\SysWOW64\Eokhfn32.exe Ekpmepok.exe File opened for modification C:\Windows\SysWOW64\Eonekn32.exe Ehdmodne.exe File created C:\Windows\SysWOW64\Hmeegobg.dll Lhdqaeag.exe File opened for modification C:\Windows\SysWOW64\Mlklnbpc.exe Mimpagqp.exe File created C:\Windows\SysWOW64\Ooijfe32.exe Olknjj32.exe File created C:\Windows\SysWOW64\Eeeqbhoa.exe Eokhfn32.exe File opened for modification C:\Windows\SysWOW64\Mecqfh32.exe Mojhjnog.exe File created C:\Windows\SysWOW64\Pcaphnlb.dll Fhpmjbch.exe File opened for modification C:\Windows\SysWOW64\Llmpld32.exe Liocpi32.exe File created C:\Windows\SysWOW64\Mihffh32.exe Mbnnjnmh.exe File opened for modification C:\Windows\SysWOW64\Plgdpo32.exe Pjihdc32.exe File created C:\Windows\SysWOW64\Jhijpcli.dll Epgehq32.exe File created C:\Windows\SysWOW64\Hgnegg32.exe Ghhhfjha.exe File opened for modification C:\Windows\SysWOW64\Jqmigi32.exe Jnomkn32.exe File opened for modification C:\Windows\SysWOW64\Lnihhjin.exe Lgoplp32.exe File created C:\Windows\SysWOW64\Kodfol32.dll Mhjpgn32.exe File opened for modification C:\Windows\SysWOW64\Ojgbij32.exe Ocmjlpfa.exe File opened for modification C:\Windows\SysWOW64\Kpbfld32.exe Kelaokko.exe File created C:\Windows\SysWOW64\Fpnkhpgd.exe Fmpoldhq.exe File created C:\Windows\SysWOW64\Fkdofhgj.exe Fpnkhpgd.exe File opened for modification C:\Windows\SysWOW64\Fkdofhgj.exe Fpnkhpgd.exe File created C:\Windows\SysWOW64\Jnqjmild.dll Lglcfp32.exe File created C:\Windows\SysWOW64\Nbigkfpo.exe Nloonlhb.exe File created C:\Windows\SysWOW64\Ccmmaq32.dll Lpnlbi32.exe File created C:\Windows\SysWOW64\Mboeddad.exe Llemgj32.exe File opened for modification C:\Windows\SysWOW64\Aebihpkl.exe Amkagb32.exe File opened for modification C:\Windows\SysWOW64\Dgknnb32.exe Dejafj32.exe File opened for modification C:\Windows\SysWOW64\Amaqmkaf.exe Ajcdapbb.exe File created C:\Windows\SysWOW64\Jdmnpg32.dll Hnaqjplk.exe File created C:\Windows\SysWOW64\Ncnpja32.dll Jhgnnfno.exe File created C:\Windows\SysWOW64\Jpkiemom.dll Nloonlhb.exe File created C:\Windows\SysWOW64\Bpjfhemc.dll Nnbebk32.exe File opened for modification C:\Windows\SysWOW64\Golamlib.exe Ghbipb32.exe File created C:\Windows\SysWOW64\Nbljklah.exe Npnnopbd.exe File created C:\Windows\SysWOW64\Pofalj32.exe Plgdpo32.exe File created C:\Windows\SysWOW64\Bejdjm32.dll Eagabceo.exe File opened for modification C:\Windows\SysWOW64\Fikildjp.exe Fgmmpikl.exe File created C:\Windows\SysWOW64\Mnebokld.dll Jbdlbkpj.exe File created C:\Windows\SysWOW64\Agbbjkhm.exe Aqijmq32.exe File created C:\Windows\SysWOW64\Jnblbdep.dll Fkgbfo32.exe File created C:\Windows\SysWOW64\Cfgaaedo.dll Lehakj32.exe File created C:\Windows\SysWOW64\Qckcnglk.dll Ggfofhca.exe File created C:\Windows\SysWOW64\Dilabblf.dll Hngndadf.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 6616 12160 WerFault.exe 612 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nemcmg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggdbah32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edfdhego.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kindoe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Maqhkdqg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nihhcocf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mojhjnog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bihablgj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bmkccjik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llabmndb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llemgj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ogfjgo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hgebbl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hajpeo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pnlapgnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qncgqf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pcammi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pfpiid32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dffdcccb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dejafj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihihgo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aohfig32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kibmjdca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pdapabjo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iojgegoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phcopoib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emihleoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gglpln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mbnnjnmh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lglcfp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnbebk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjnijihf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnopcb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fncblj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ejhpjjah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ijogpp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mbkkjh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdijecgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Joamef32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ccghfcne.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dcgama32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mdnang32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpeaio32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dakafeol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgpifi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ealagi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jfihmabf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ohpidaig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bopmif32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oognqfok.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Igoehk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nekgggpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjihdc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emnbgd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddhhggdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jnbpkcad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opgaeojj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnbkoiac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkjjpg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Capbjg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbdlbkpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nicohp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ehmgne32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekpmepok.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 8208 Acping32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pckpcgge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agonkn32.dll" Ijogpp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lnihhjin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldeoce32.dll" Mbkkjh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pdapabjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ekifdqec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mfcmqknf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fikildjp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bnfmmc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ajqglpde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fkdofhgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofekhjki.dll" Hajpeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiiqik32.dll" Mjneoicb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mhafhm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fdogodpd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jpdikffd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Acbfdfqn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pjihdc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bopmif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Eagabceo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Labkif32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eknppp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mehfbi32.dll" Fejjnh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kflninba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfcnnabf.dll" Kbnecplk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cgbdfb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Qdkcgqad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hddiqaml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocmdbd32.dll" Kbkimpnn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lpnehb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eialkf32.dll" Mhkgbdlp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Niaimf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gmqgcb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ocmjlpfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ghfbkanp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jinkikkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kkcflp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Naaqabbd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 137b337323794e608487515f387cb22a247c2cc59d0f9a987e70bbb8899c2bba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbpchile.dll" Ojplhkdf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nhgfncab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Emlllk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ibicacnc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pgabig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dffmim32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fpeaio32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ocmjlpfa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Djmgiboq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hccbkfjj.dll" Dfiaibap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nicohp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpkiemom.dll" Nloonlhb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Njnpck32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kddajffm.dll" Ifmiqbld.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Qhghkn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pofalj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ikeacd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnqjmild.dll" Lglcfp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egckpjdo.dll" Cdabfhjf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Deckfkof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Eeeqbhoa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ggfofhca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ghhhfjha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igbmja32.dll" Omhlkeko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhobfi32.dll" Agniok32.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\1 igH34qf?<:bV*{f#r!-fV(nUd4:7853-f>lD1)5"-fv u3L1y `.}1x$` Vig:8p gi}H2-`f!9dvL1vcWFs?:5#y 7"pH5#yfs?H9!y8(:?*:5!pH34qfs?H;(:?*\s|&V(nUd4:.(C1V=Z Y*hp5K{L1)`2?!q #8<D.d=DziaOmL1)x Oahgba32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1728 wrote to memory of 1720 1728 137b337323794e608487515f387cb22a247c2cc59d0f9a987e70bbb8899c2bba.exe 81 PID 1728 wrote to memory of 1720 1728 137b337323794e608487515f387cb22a247c2cc59d0f9a987e70bbb8899c2bba.exe 81 PID 1728 wrote to memory of 1720 1728 137b337323794e608487515f387cb22a247c2cc59d0f9a987e70bbb8899c2bba.exe 81 PID 1720 wrote to memory of 2168 1720 Lmmcqn32.exe 82 PID 1720 wrote to memory of 2168 1720 Lmmcqn32.exe 82 PID 1720 wrote to memory of 2168 1720 Lmmcqn32.exe 82 PID 2168 wrote to memory of 1380 2168 Ldgkmhno.exe 83 PID 2168 wrote to memory of 1380 2168 Ldgkmhno.exe 83 PID 2168 wrote to memory of 1380 2168 Ldgkmhno.exe 83 PID 1380 wrote to memory of 4492 1380 Leihep32.exe 84 PID 1380 wrote to memory of 4492 1380 Leihep32.exe 84 PID 1380 wrote to memory of 4492 1380 Leihep32.exe 84 PID 4492 wrote to memory of 1976 4492 Lpnlbi32.exe 85 PID 4492 wrote to memory of 1976 4492 Lpnlbi32.exe 85 PID 4492 wrote to memory of 1976 4492 Lpnlbi32.exe 85 PID 1976 wrote to memory of 4520 1976 Lghdockp.exe 86 PID 1976 wrote to memory of 4520 1976 Lghdockp.exe 86 PID 1976 wrote to memory of 4520 1976 Lghdockp.exe 86 PID 4520 wrote to memory of 928 4520 Llemgj32.exe 87 PID 4520 wrote to memory of 928 4520 Llemgj32.exe 87 PID 4520 wrote to memory of 928 4520 Llemgj32.exe 87 PID 928 wrote to memory of 4352 928 Mboeddad.exe 88 PID 928 wrote to memory of 4352 928 Mboeddad.exe 88 PID 928 wrote to memory of 4352 928 Mboeddad.exe 88 PID 4352 wrote to memory of 4216 4352 Mmdiamqj.exe 89 PID 4352 wrote to memory of 4216 4352 Mmdiamqj.exe 89 PID 4352 wrote to memory of 4216 4352 Mmdiamqj.exe 89 PID 4216 wrote to memory of 984 4216 Mdnang32.exe 90 PID 4216 wrote to memory of 984 4216 Mdnang32.exe 90 PID 4216 wrote to memory of 984 4216 Mdnang32.exe 90 PID 984 wrote to memory of 4744 984 Mikjfn32.exe 91 PID 984 wrote to memory of 4744 984 Mikjfn32.exe 91 PID 984 wrote to memory of 4744 984 Mikjfn32.exe 91 PID 4744 wrote to memory of 4564 4744 Mpebch32.exe 92 PID 4744 wrote to memory of 4564 4744 Mpebch32.exe 92 PID 4744 wrote to memory of 4564 4744 Mpebch32.exe 92 PID 4564 wrote to memory of 940 4564 Mgokpbeh.exe 93 PID 4564 wrote to memory of 940 4564 Mgokpbeh.exe 93 PID 4564 wrote to memory of 940 4564 Mgokpbeh.exe 93 PID 940 wrote to memory of 4104 940 Mllchico.exe 94 PID 940 wrote to memory of 4104 940 Mllchico.exe 94 PID 940 wrote to memory of 4104 940 Mllchico.exe 94 PID 4104 wrote to memory of 444 4104 Mipcambi.exe 95 PID 4104 wrote to memory of 444 4104 Mipcambi.exe 95 PID 4104 wrote to memory of 444 4104 Mipcambi.exe 95 PID 444 wrote to memory of 2012 444 Megdfnhm.exe 96 PID 444 wrote to memory of 2012 444 Megdfnhm.exe 96 PID 444 wrote to memory of 2012 444 Megdfnhm.exe 96 PID 2012 wrote to memory of 244 2012 Mlqlch32.exe 97 PID 2012 wrote to memory of 244 2012 Mlqlch32.exe 97 PID 2012 wrote to memory of 244 2012 Mlqlch32.exe 97 PID 244 wrote to memory of 1816 244 Nlciih32.exe 98 PID 244 wrote to memory of 1816 244 Nlciih32.exe 98 PID 244 wrote to memory of 1816 244 Nlciih32.exe 98 PID 1816 wrote to memory of 712 1816 Nghmfqmm.exe 99 PID 1816 wrote to memory of 712 1816 Nghmfqmm.exe 99 PID 1816 wrote to memory of 712 1816 Nghmfqmm.exe 99 PID 712 wrote to memory of 2452 712 Nnbebk32.exe 100 PID 712 wrote to memory of 2452 712 Nnbebk32.exe 100 PID 712 wrote to memory of 2452 712 Nnbebk32.exe 100 PID 2452 wrote to memory of 3092 2452 Nconka32.exe 101 PID 2452 wrote to memory of 3092 2452 Nconka32.exe 101 PID 2452 wrote to memory of 3092 2452 Nconka32.exe 101 PID 3092 wrote to memory of 1404 3092 Nnebhj32.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\137b337323794e608487515f387cb22a247c2cc59d0f9a987e70bbb8899c2bba.exe"C:\Users\Admin\AppData\Local\Temp\137b337323794e608487515f387cb22a247c2cc59d0f9a987e70bbb8899c2bba.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\Lmmcqn32.exeC:\Windows\system32\Lmmcqn32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\Ldgkmhno.exeC:\Windows\system32\Ldgkmhno.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\Leihep32.exeC:\Windows\system32\Leihep32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\Lpnlbi32.exeC:\Windows\system32\Lpnlbi32.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\Lghdockp.exeC:\Windows\system32\Lghdockp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\Llemgj32.exeC:\Windows\system32\Llemgj32.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\Mboeddad.exeC:\Windows\system32\Mboeddad.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\Mmdiamqj.exeC:\Windows\system32\Mmdiamqj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\Mdnang32.exeC:\Windows\system32\Mdnang32.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\Mikjfn32.exeC:\Windows\system32\Mikjfn32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\Mpebch32.exeC:\Windows\system32\Mpebch32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\Mgokpbeh.exeC:\Windows\system32\Mgokpbeh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\Mllchico.exeC:\Windows\system32\Mllchico.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\Mipcambi.exeC:\Windows\system32\Mipcambi.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\Megdfnhm.exeC:\Windows\system32\Megdfnhm.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Windows\SysWOW64\Mlqlch32.exeC:\Windows\system32\Mlqlch32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\Nlciih32.exeC:\Windows\system32\Nlciih32.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\SysWOW64\Nghmfqmm.exeC:\Windows\system32\Nghmfqmm.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\Nnbebk32.exeC:\Windows\system32\Nnbebk32.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\Nconka32.exeC:\Windows\system32\Nconka32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\Nnebhj32.exeC:\Windows\system32\Nnebhj32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\Npcodf32.exeC:\Windows\system32\Npcodf32.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1404 -
C:\Windows\SysWOW64\Njlcmk32.exeC:\Windows\system32\Njlcmk32.exe24⤵
- Executes dropped EXE
PID:1176 -
C:\Windows\SysWOW64\Ndagjd32.exeC:\Windows\system32\Ndagjd32.exe25⤵
- Executes dropped EXE
PID:2140 -
C:\Windows\SysWOW64\Njnpck32.exeC:\Windows\system32\Njnpck32.exe26⤵
- Executes dropped EXE
- Modifies registry class
PID:2192 -
C:\Windows\SysWOW64\Ophhpene.exeC:\Windows\system32\Ophhpene.exe27⤵
- Executes dropped EXE
PID:4116 -
C:\Windows\SysWOW64\Ojplhkdf.exeC:\Windows\system32\Ojplhkdf.exe28⤵
- Executes dropped EXE
- Modifies registry class
PID:2736 -
C:\Windows\SysWOW64\Opjeee32.exeC:\Windows\system32\Opjeee32.exe29⤵
- Executes dropped EXE
PID:4692 -
C:\Windows\SysWOW64\Ofgmml32.exeC:\Windows\system32\Ofgmml32.exe30⤵
- Executes dropped EXE
PID:2696 -
C:\Windows\SysWOW64\Opmakd32.exeC:\Windows\system32\Opmakd32.exe31⤵
- Executes dropped EXE
PID:2460 -
C:\Windows\SysWOW64\Ogfjgo32.exeC:\Windows\system32\Ogfjgo32.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1912 -
C:\Windows\SysWOW64\Olcbpe32.exeC:\Windows\system32\Olcbpe32.exe33⤵
- Executes dropped EXE
PID:5112 -
C:\Windows\SysWOW64\Ocmjlpfa.exeC:\Windows\system32\Ocmjlpfa.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1232 -
C:\Windows\SysWOW64\Ojgbij32.exeC:\Windows\system32\Ojgbij32.exe35⤵
- Executes dropped EXE
PID:1000 -
C:\Windows\SysWOW64\Odmgfb32.exeC:\Windows\system32\Odmgfb32.exe36⤵
- Executes dropped EXE
PID:3892 -
C:\Windows\SysWOW64\Ofncnkcb.exeC:\Windows\system32\Ofncnkcb.exe37⤵
- Executes dropped EXE
PID:336 -
C:\Windows\SysWOW64\Omhlkeko.exeC:\Windows\system32\Omhlkeko.exe38⤵
- Executes dropped EXE
- Modifies registry class
PID:2440 -
C:\Windows\SysWOW64\Pjlldiji.exeC:\Windows\system32\Pjlldiji.exe39⤵
- Executes dropped EXE
PID:5084 -
C:\Windows\SysWOW64\Pqfdac32.exeC:\Windows\system32\Pqfdac32.exe40⤵
- Executes dropped EXE
PID:4880 -
C:\Windows\SysWOW64\Pdapabjo.exeC:\Windows\system32\Pdapabjo.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3856 -
C:\Windows\SysWOW64\Pjnijihf.exeC:\Windows\system32\Pjnijihf.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3392 -
C:\Windows\SysWOW64\Pqhafcoc.exeC:\Windows\system32\Pqhafcoc.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1536 -
C:\Windows\SysWOW64\Pcgmbnnf.exeC:\Windows\system32\Pcgmbnnf.exe44⤵
- Executes dropped EXE
PID:2304 -
C:\Windows\SysWOW64\Pnlapgnl.exeC:\Windows\system32\Pnlapgnl.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1036 -
C:\Windows\SysWOW64\Pdfjla32.exeC:\Windows\system32\Pdfjla32.exe46⤵
- Executes dropped EXE
PID:3532 -
C:\Windows\SysWOW64\Pgdfim32.exeC:\Windows\system32\Pgdfim32.exe47⤵
- Executes dropped EXE
PID:2540 -
C:\Windows\SysWOW64\Pmanaccd.exeC:\Windows\system32\Pmanaccd.exe48⤵
- Executes dropped EXE
PID:2772 -
C:\Windows\SysWOW64\Pckfnn32.exeC:\Windows\system32\Pckfnn32.exe49⤵
- Executes dropped EXE
PID:4828 -
C:\Windows\SysWOW64\Pjeojhbn.exeC:\Windows\system32\Pjeojhbn.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2236 -
C:\Windows\SysWOW64\Qmdkfcaa.exeC:\Windows\system32\Qmdkfcaa.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4280 -
C:\Windows\SysWOW64\Qdkcgqad.exeC:\Windows\system32\Qdkcgqad.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:4580 -
C:\Windows\SysWOW64\Qflpoi32.exeC:\Windows\system32\Qflpoi32.exe53⤵
- Executes dropped EXE
PID:3976 -
C:\Windows\SysWOW64\Qncgqf32.exeC:\Windows\system32\Qncgqf32.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4128 -
C:\Windows\SysWOW64\Qdmpmp32.exeC:\Windows\system32\Qdmpmp32.exe55⤵
- Executes dropped EXE
PID:4980 -
C:\Windows\SysWOW64\Qgllil32.exeC:\Windows\system32\Qgllil32.exe56⤵
- Executes dropped EXE
PID:2160 -
C:\Windows\SysWOW64\Qfolehep.exeC:\Windows\system32\Qfolehep.exe57⤵
- Executes dropped EXE
PID:116 -
C:\Windows\SysWOW64\Qjjheg32.exeC:\Windows\system32\Qjjheg32.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2800 -
C:\Windows\SysWOW64\Aqdqbaee.exeC:\Windows\system32\Aqdqbaee.exe59⤵
- Executes dropped EXE
PID:2164 -
C:\Windows\SysWOW64\Agniok32.exeC:\Windows\system32\Agniok32.exe60⤵
- Executes dropped EXE
- Modifies registry class
PID:3076 -
C:\Windows\SysWOW64\Ajlekg32.exeC:\Windows\system32\Ajlekg32.exe61⤵
- Executes dropped EXE
PID:2016 -
C:\Windows\SysWOW64\Amkagb32.exeC:\Windows\system32\Amkagb32.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2320 -
C:\Windows\SysWOW64\Aebihpkl.exeC:\Windows\system32\Aebihpkl.exe63⤵
- Executes dropped EXE
PID:908 -
C:\Windows\SysWOW64\Afcfph32.exeC:\Windows\system32\Afcfph32.exe64⤵
- Executes dropped EXE
PID:3960 -
C:\Windows\SysWOW64\Aqijmq32.exeC:\Windows\system32\Aqijmq32.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1512 -
C:\Windows\SysWOW64\Agbbjkhm.exeC:\Windows\system32\Agbbjkhm.exe66⤵PID:820
-
C:\Windows\SysWOW64\Afhokgme.exeC:\Windows\system32\Afhokgme.exe67⤵PID:3500
-
C:\Windows\SysWOW64\Aclpdklo.exeC:\Windows\system32\Aclpdklo.exe68⤵PID:3872
-
C:\Windows\SysWOW64\Bnadadld.exeC:\Windows\system32\Bnadadld.exe69⤵PID:3936
-
C:\Windows\SysWOW64\Bmddma32.exeC:\Windows\system32\Bmddma32.exe70⤵PID:1988
-
C:\Windows\SysWOW64\Beklnn32.exeC:\Windows\system32\Beklnn32.exe71⤵PID:2076
-
C:\Windows\SysWOW64\Bncqgd32.exeC:\Windows\system32\Bncqgd32.exe72⤵PID:4072
-
C:\Windows\SysWOW64\Bglepipb.exeC:\Windows\system32\Bglepipb.exe73⤵
- Drops file in System32 directory
PID:1332 -
C:\Windows\SysWOW64\Bnfmmc32.exeC:\Windows\system32\Bnfmmc32.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2852 -
C:\Windows\SysWOW64\Badiio32.exeC:\Windows\system32\Badiio32.exe75⤵PID:1268
-
C:\Windows\SysWOW64\Bfabaf32.exeC:\Windows\system32\Bfabaf32.exe76⤵PID:972
-
C:\Windows\SysWOW64\Bmkjnp32.exeC:\Windows\system32\Bmkjnp32.exe77⤵PID:4264
-
C:\Windows\SysWOW64\Bhqnki32.exeC:\Windows\system32\Bhqnki32.exe78⤵PID:868
-
C:\Windows\SysWOW64\Baicdncn.exeC:\Windows\system32\Baicdncn.exe79⤵PID:1420
-
C:\Windows\SysWOW64\Cffkleae.exeC:\Windows\system32\Cffkleae.exe80⤵PID:2660
-
C:\Windows\SysWOW64\Cjagmd32.exeC:\Windows\system32\Cjagmd32.exe81⤵PID:4964
-
C:\Windows\SysWOW64\Cakpjn32.exeC:\Windows\system32\Cakpjn32.exe82⤵PID:1984
-
C:\Windows\SysWOW64\Cnopcb32.exeC:\Windows\system32\Cnopcb32.exe83⤵
- System Location Discovery: System Language Discovery
PID:3240 -
C:\Windows\SysWOW64\Cdlhki32.exeC:\Windows\system32\Cdlhki32.exe84⤵PID:384
-
C:\Windows\SysWOW64\Cnamib32.exeC:\Windows\system32\Cnamib32.exe85⤵PID:4892
-
C:\Windows\SysWOW64\Capiemme.exeC:\Windows\system32\Capiemme.exe86⤵PID:1340
-
C:\Windows\SysWOW64\Cjhmnc32.exeC:\Windows\system32\Cjhmnc32.exe87⤵
- Drops file in System32 directory
PID:3124 -
C:\Windows\SysWOW64\Cdabfhjf.exeC:\Windows\system32\Cdabfhjf.exe88⤵
- Modifies registry class
PID:2956 -
C:\Windows\SysWOW64\Cfonbdij.exeC:\Windows\system32\Cfonbdij.exe89⤵PID:4572
-
C:\Windows\SysWOW64\Cepnqkai.exeC:\Windows\system32\Cepnqkai.exe90⤵PID:2596
-
C:\Windows\SysWOW64\Dhokmgpm.exeC:\Windows\system32\Dhokmgpm.exe91⤵PID:3676
-
C:\Windows\SysWOW64\Djmgiboq.exeC:\Windows\system32\Djmgiboq.exe92⤵
- Modifies registry class
PID:3428 -
C:\Windows\SysWOW64\Deckfkof.exeC:\Windows\system32\Deckfkof.exe93⤵
- Modifies registry class
PID:3508 -
C:\Windows\SysWOW64\Dhagbfnj.exeC:\Windows\system32\Dhagbfnj.exe94⤵PID:3260
-
C:\Windows\SysWOW64\Dokpoq32.exeC:\Windows\system32\Dokpoq32.exe95⤵PID:876
-
C:\Windows\SysWOW64\Ddhhggdo.exeC:\Windows\system32\Ddhhggdo.exe96⤵
- System Location Discovery: System Language Discovery
PID:3316 -
C:\Windows\SysWOW64\Dffdcccb.exeC:\Windows\system32\Dffdcccb.exe97⤵
- System Location Discovery: System Language Discovery
PID:3916 -
C:\Windows\SysWOW64\Domldpcd.exeC:\Windows\system32\Domldpcd.exe98⤵PID:4608
-
C:\Windows\SysWOW64\Degdaj32.exeC:\Windows\system32\Degdaj32.exe99⤵PID:2892
-
C:\Windows\SysWOW64\Dfiaibap.exeC:\Windows\system32\Dfiaibap.exe100⤵
- Modifies registry class
PID:5004 -
C:\Windows\SysWOW64\Dopijpab.exeC:\Windows\system32\Dopijpab.exe101⤵PID:2212
-
C:\Windows\SysWOW64\Dejafj32.exeC:\Windows\system32\Dejafj32.exe102⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1648 -
C:\Windows\SysWOW64\Dgknnb32.exeC:\Windows\system32\Dgknnb32.exe103⤵PID:4444
-
C:\Windows\SysWOW64\Dmefklfj.exeC:\Windows\system32\Dmefklfj.exe104⤵PID:1656
-
C:\Windows\SysWOW64\Ddonhf32.exeC:\Windows\system32\Ddonhf32.exe105⤵PID:4412
-
C:\Windows\SysWOW64\Ekifdqec.exeC:\Windows\system32\Ekifdqec.exe106⤵
- Modifies registry class
PID:1524 -
C:\Windows\SysWOW64\Eacoak32.exeC:\Windows\system32\Eacoak32.exe107⤵PID:5072
-
C:\Windows\SysWOW64\Ehmgne32.exeC:\Windows\system32\Ehmgne32.exe108⤵
- System Location Discovery: System Language Discovery
PID:4328 -
C:\Windows\SysWOW64\Ekkcjp32.exeC:\Windows\system32\Ekkcjp32.exe109⤵PID:2928
-
C:\Windows\SysWOW64\Edcgcfja.exeC:\Windows\system32\Edcgcfja.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:228 -
C:\Windows\SysWOW64\Eknppp32.exeC:\Windows\system32\Eknppp32.exe111⤵
- Modifies registry class
PID:2724 -
C:\Windows\SysWOW64\Emlllk32.exeC:\Windows\system32\Emlllk32.exe112⤵
- Modifies registry class
PID:3524 -
C:\Windows\SysWOW64\Edfdhego.exeC:\Windows\system32\Edfdhego.exe113⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4000 -
C:\Windows\SysWOW64\Ekpmepok.exeC:\Windows\system32\Ekpmepok.exe114⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:404 -
C:\Windows\SysWOW64\Eokhfn32.exeC:\Windows\system32\Eokhfn32.exe115⤵
- Drops file in System32 directory
PID:844 -
C:\Windows\SysWOW64\Eeeqbhoa.exeC:\Windows\system32\Eeeqbhoa.exe116⤵
- Drops file in System32 directory
- Modifies registry class
PID:4432 -
C:\Windows\SysWOW64\Ehdmodne.exeC:\Windows\system32\Ehdmodne.exe117⤵
- Drops file in System32 directory
PID:2708 -
C:\Windows\SysWOW64\Eonekn32.exeC:\Windows\system32\Eonekn32.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1764 -
C:\Windows\SysWOW64\Ealagi32.exeC:\Windows\system32\Ealagi32.exe119⤵
- System Location Discovery: System Language Discovery
PID:5128 -
C:\Windows\SysWOW64\Fgijpp32.exeC:\Windows\system32\Fgijpp32.exe120⤵PID:5172
-
C:\Windows\SysWOW64\Fkdfpokf.exeC:\Windows\system32\Fkdfpokf.exe121⤵
- Drops file in System32 directory
PID:5216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-