Analysis
- max time kernel
149s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/08/2026, 14:29
Static task
static1
1 signatures
General
- Target 842baf827fa595398bce1805ea6b8cfb10e7558b5793a888e151fc68303a6407.exe
- Size 8.0MB
- Sample260826-rtpyhs1amh
- SHA256 842baf827fa595398bce1805ea6b8cfb10e7558b5793a888e151fc68303a6407
- MD5 9c4400b88de7f1393833c89e8cf4156c
- SHA1 4d950cad6340cc345b364ca337addae9100c5fe6
- SHA512 fabe0ee2d763e4ec316fd84b896062ea09518f095690eb8a7ae67f18f20c0675dc834f350e0e35f9a56e6ad2500144896c65df68e9f714e277dee9ac8a4607d0
- SSDEEP 49152:8f9zf9w8SPf9zf9sBf9zf9w8SPf9zf9AtMf9zf9w8SPf9zf9zZeIf9zf9w8SPf9W:j8/S8T86kv8V
- TLSH T10E868DA5F0E9DF99CE8440FEDC4BC3355EE190F286242CEE08B5C41B6DABA52111677E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
berbew
C2
-
http://viruslist.com/wcmd.txt
-
http://viruslist.com/ppslog.php
-
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Chokcakp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmfalimb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eijbge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gbgibgpf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Olehai32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pgihppgo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gbcohl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Igkkdigp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgiibnib.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qfkqcb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlflog32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njdlfbgm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ciefpn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mnfnfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nppkkj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mhdbdgjl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lcjchd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pknqhh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lcbfmomc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjneec32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lcbngeqo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgkoolil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Naejcl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmnmqdee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Agjhadmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Efepln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Iiigqdfd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngikpjml.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojfcmc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akpojpic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jpffgp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohfhqd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kkpbbdil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ffnkggld.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Agjhadmh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnaqqj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Plbmhadm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qlggcp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ohggah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Phlqlgmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Engjol32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hfcnicjl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbcfan32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knlbipjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cninnnfe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 842baf827fa595398bce1805ea6b8cfb10e7558b5793a888e151fc68303a6407.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Npbhqj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nanmhf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fnofkdno.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oplkgi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gihgoq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pnfiia32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bgkijp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aaiiffjj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Flgaodbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lcggbd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njaakf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Akiijq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hfmigmgf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lqdakjak.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ekkkip32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmajmaoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Akpojpic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Omjhgoco.exe - Detects Padodor trojan 64 IoCs
resource yara_rule behavioral1/memory/576-0-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/4556-7-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/4876-16-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/3356-24-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/4368-36-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/15344-5733-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/16892-5732-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/17516-5731-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/18452-5730-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/18512-5729-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/18572-5728-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/18644-5727-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/18708-5726-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/18776-5725-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/18836-5724-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/18896-5723-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/18964-5722-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19032-5721-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19100-5720-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19172-5719-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19232-5718-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19292-5717-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19356-5716-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19424-5715-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/17780-5714-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/18020-5713-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/18196-5712-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/18416-5711-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/16508-5710-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/17548-5709-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/18500-5708-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/18596-5707-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/18764-5706-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/18872-5705-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/18980-5704-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19492-5703-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19528-5702-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19564-5701-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19600-5700-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19636-5699-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19672-5698-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19708-5697-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19744-5696-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19780-5695-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19816-5694-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19852-5693-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19888-5692-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19924-5691-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19960-5690-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19996-5689-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/20032-5688-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/20068-5687-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/20104-5686-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/20140-5685-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/20176-5684-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/20212-5683-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/20248-5682-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/20284-5681-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/20320-5680-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/20356-5679-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/20392-5678-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/20428-5677-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/20464-5676-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor behavioral1/memory/19072-5675-0x0000000000400000-0x0000000000433000-memory.dmp family_padodor - Executes dropped EXE 64 IoCs
pid Process 4556 Meknhh32.exe 4876 Ndmnfofi.exe 3356 Ognpoheh.exe 4368 Omjhgoco.exe 4040 Ocdqcikl.exe 1816 Agjhadmh.exe 3836 Cnbmolhd.exe 3928 Celelf32.exe 2724 Chjaha32.exe 4720 Cndidlfb.exe 4472 Cabfagee.exe 1372 Chmnnamb.exe 692 Cnffjl32.exe 1864 Caebfg32.exe 4288 Chokcakp.exe 2172 Cnicpk32.exe 3844 Ceckleii.exe 3028 Chagiqhm.exe 3156 Cokpekpj.exe 880 Deehbe32.exe 4164 Dffdjmme.exe 5068 Dmpmfg32.exe 4932 Ddjecalo.exe 1604 Dkdmpl32.exe 2392 Dejamdca.exe 3052 Dfknem32.exe 1232 Dmefafql.exe 1216 Ddonnq32.exe 4728 Dfmjjl32.exe 2308 Dmgbgf32.exe 216 Ddakdqff.exe 3856 Dkkcqj32.exe 4156 Eeagnc32.exe 2896 Eknpfj32.exe 2216 Eahhcd32.exe 4652 Egdqkk32.exe 2272 Eajehd32.exe 4304 Eggmqk32.exe 4172 Ealanc32.exe 3736 Egijfjmp.exe 3332 Emcbcd32.exe 2696 Ehifpm32.exe 308 Fneohd32.exe 4912 Fhkcfmbp.exe 4888 Foekbg32.exe 3932 Fdbdkn32.exe 1148 Foghhg32.exe 4700 Feapdaof.exe 1084 Fknimh32.exe 4100 Fecmjq32.exe 644 Fkqebg32.exe 4180 Fefjpp32.exe 2928 Gkcbhgii.exe 984 Gehfepio.exe 544 Goqkne32.exe 4612 Gdncfl32.exe 4992 Gkglcfec.exe 4256 Gempqo32.exe 1728 Gkjhif32.exe 4028 Gfomfo32.exe 3296 Gklenf32.exe 3600 Gfaikoad.exe 3728 Hgcfcg32.exe 3308 Hbhjqp32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Bedcpnmi.dll Aabafkgh.exe File opened for modification C:\Windows\SysWOW64\Dqmjqb32.exe Dolmijef.exe File opened for modification C:\Windows\SysWOW64\Ihpgda32.exe Iafogggl.exe File created C:\Windows\SysWOW64\Mjankb32.dll Hkbmjhdo.exe File opened for modification C:\Windows\SysWOW64\Ohkkanbe.exe Oeloebcb.exe File opened for modification C:\Windows\SysWOW64\Jekqgnno.exe Ioeineap.exe File created C:\Windows\SysWOW64\Jenmlmll.exe Jcoapami.exe File created C:\Windows\SysWOW64\Nhppknhe.dll Jgmjfpco.exe File created C:\Windows\SysWOW64\Lcbfmomc.exe Lqcjqcnp.exe File created C:\Windows\SysWOW64\Mfndopfh.dll Mncjffbl.exe File created C:\Windows\SysWOW64\Ndfgdmpi.dll Hbhjqp32.exe File created C:\Windows\SysWOW64\Majjgmco.exe Mjpbkc32.exe File opened for modification C:\Windows\SysWOW64\Ahbacq32.exe Aaiiffjj.exe File created C:\Windows\SysWOW64\Cooolhin.exe Ciefpn32.exe File created C:\Windows\SysWOW64\Lklbnb32.exe Lcejmeol.exe File opened for modification C:\Windows\SysWOW64\Nglhei32.exe Nabpiocm.exe File created C:\Windows\SysWOW64\Fpbdopdp.dll Apjkmgjm.exe File opened for modification C:\Windows\SysWOW64\Dfmjjl32.exe Ddonnq32.exe File created C:\Windows\SysWOW64\Fengfmaj.dll Jqihjbod.exe File opened for modification C:\Windows\SysWOW64\Dihllkal.exe Dfjpppbh.exe File created C:\Windows\SysWOW64\Hmnmqdee.exe Hkpqdifa.exe File created C:\Windows\SysWOW64\Igbaeh32.exe Iphihnjk.exe File opened for modification C:\Windows\SysWOW64\Mgaoda32.exe Mmkkgh32.exe File created C:\Windows\SysWOW64\Mccqgk32.dll Plmmbkdf.exe File created C:\Windows\SysWOW64\Ldbgealc.dll Dndnjllg.exe File created C:\Windows\SysWOW64\Cojgafon.dll Ocdqcikl.exe File created C:\Windows\SysWOW64\Efepln32.exe Ecgcpc32.exe File opened for modification C:\Windows\SysWOW64\Nmenmgab.exe Nclida32.exe File created C:\Windows\SysWOW64\Lhjadp32.dll Nclida32.exe File created C:\Windows\SysWOW64\Cnokhonp.exe Ckaolcol.exe File created C:\Windows\SysWOW64\Iblacf32.dll Dfbcek32.exe File created C:\Windows\SysWOW64\Eogegdjd.dll Hfodnd32.exe File opened for modification C:\Windows\SysWOW64\Imbpam32.exe Hekgppma.exe File created C:\Windows\SysWOW64\Mjpbkc32.exe Mhafoh32.exe File created C:\Windows\SysWOW64\Njghkb32.exe Nifldj32.exe File created C:\Windows\SysWOW64\Fbcfan32.exe Flinddpj.exe File created C:\Windows\SysWOW64\Knoonphp.exe Kkpbbdil.exe File created C:\Windows\SysWOW64\Pmhjhh32.dll Aahblp32.exe File created C:\Windows\SysWOW64\Qfneamlf.exe Qqamieno.exe File created C:\Windows\SysWOW64\Mpoknjfd.dll Qekbaf32.exe File created C:\Windows\SysWOW64\Gdobgp32.exe Glgjfb32.exe File opened for modification C:\Windows\SysWOW64\Mgkoolil.exe Modgnn32.exe File created C:\Windows\SysWOW64\Kpmdiamf.dll Bkkofn32.exe File created C:\Windows\SysWOW64\Dbgnpaib.dll Eohmdhki.exe File created C:\Windows\SysWOW64\Dpbdiehi.exe Dihllkal.exe File opened for modification C:\Windows\SysWOW64\Gmmmoppl.exe Gefencoj.exe File created C:\Windows\SysWOW64\Dpkgof32.dll Nabpiocm.exe File created C:\Windows\SysWOW64\Npgmjl32.exe Nmipnp32.exe File created C:\Windows\SysWOW64\Bfedhihl.exe Bpkllo32.exe File opened for modification C:\Windows\SysWOW64\Bkjikd32.exe Bhkmoifp.exe File created C:\Windows\SysWOW64\Jcoapami.exe Jleicg32.exe File created C:\Windows\SysWOW64\Iddkqo32.dll Fdlcehhn.exe File opened for modification C:\Windows\SysWOW64\Fmgecn32.exe Fkihgb32.exe File created C:\Windows\SysWOW64\Fafjdb32.dll Gfhehlhe.exe File created C:\Windows\SysWOW64\Kgkfhngo.exe Kodnfqgm.exe File created C:\Windows\SysWOW64\Ceckleii.exe Cnicpk32.exe File created C:\Windows\SysWOW64\Ddjecalo.exe Dmpmfg32.exe File opened for modification C:\Windows\SysWOW64\Knofif32.exe Kgenlldo.exe File opened for modification C:\Windows\SysWOW64\Kilpgnfi.exe Kbbhjc32.exe File created C:\Windows\SysWOW64\Hhkkdenm.dll Efccfojn.exe File opened for modification C:\Windows\SysWOW64\Epndddnk.exe Emphhhoh.exe File created C:\Windows\SysWOW64\Djgbgjdl.dll Onnmmipj.exe File created C:\Windows\SysWOW64\Bkjikd32.exe Bhkmoifp.exe File opened for modification C:\Windows\SysWOW64\Qoecol32.exe Qlggcp32.exe - Program crash 1 IoCs
pid pid_target Process 18548 18304 WerFault.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bnhegp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnanpfdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfedhihl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dpehikja.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikijenab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lqcjqcnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhmbjb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dqipeboj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Egijfjmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggilbb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aojljkkf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Plcdbghi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkpoha32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lbddpclj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgffci32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fngcfikb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ioeineap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Daccdf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ehecpgbi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phddbbnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dpbdiehi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Higjkehf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Koaaaaip.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nggnjjoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkhpmigp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Alqjiohm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fclmkb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Akipdg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pnfiia32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bijnnf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kqbdej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kodnfqgm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Innfgb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fligjnlo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahacndjo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhqoaf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fpfppl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Alcfoo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmdogpmq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lebalokn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgglnb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmlmdd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Coigllel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jpffgp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkajoiok.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfcqjg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hhbkccji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjpbkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Olphlcdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bmofkm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odfljp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efnbqi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fenhcnaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlpeol32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efopeeao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgmjfpco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfmjjl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edcqojqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iaaflh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbellhbi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gjnnoldm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emphhhoh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikpjkf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkihgb32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kacpncqg.dll" Gkjhif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Noljjg32.dll" Oaajoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cinbhb32.dll" Gbjlbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odljbmgj.dll" Kcikagij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbhppf32.dll" Gpnfak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lcdcbokq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ncgiolkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idhdieal.dll" Onhmhc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dfjpppbh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Knfeoobh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Boffej32.dll" Lqkgli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jgcafl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dmpmfg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jeqbjgoo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hjqkel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Llcoihmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qanlna32.dll" Foekbg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bfqkmj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Idieob32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pklkmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ecgcpc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfblbm32.dll" Phodlm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Aojepe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Akccje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofpfmaai.dll" Lcggbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Naodbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdgfd32.dll" Pkbjchio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fbnflihq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kjnbhkqp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mnegkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bmeagjbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ebfiqcjm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eikcmf32.dll" Pgfljqia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omecechf.dll" Jgdhab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fihfgc32.dll" Oaomij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cninnnfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gefencoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqhopg32.dll" Llmhkd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lqmmgb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjejiiif.dll" Nnccmddi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acafdoho.dll" Fneohd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lbnnphhk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fmehnn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fmiaimki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Iafogggl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Aahblp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gbgibgpf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlmfhd32.dll" Cdkipb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kqknekjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmogpi32.dll" Mbchkg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cfjnch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lekbmmcq.dll" Dcgackke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhobfffa.dll" Cnicpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Deehbe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lnhadnpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehonkbcm.dll" Podcnh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Efkfkilj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Picfjl32.dll" Eeelge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hlkmfkli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgohgkgm.dll" Agfpoqog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lgcjmjho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kldepj32.dll" Bcddlhgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Igkkdigp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dddmmc32.dll" Mmnglh32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 576 wrote to memory of 4556 576 842baf827fa595398bce1805ea6b8cfb10e7558b5793a888e151fc68303a6407.exe 84 PID 4556 wrote to memory of 4876 4556 Meknhh32.exe 85 PID 4876 wrote to memory of 3356 4876 Ndmnfofi.exe 86 PID 3356 wrote to memory of 4368 3356 Ognpoheh.exe 87 PID 4368 wrote to memory of 4040 4368 Omjhgoco.exe 88 PID 4040 wrote to memory of 1816 4040 Ocdqcikl.exe 90 PID 1816 wrote to memory of 3836 1816 Agjhadmh.exe 91 PID 3836 wrote to memory of 3928 3836 Cnbmolhd.exe 92 PID 3928 wrote to memory of 2724 3928 Celelf32.exe 93 PID 2724 wrote to memory of 4720 2724 Chjaha32.exe 94 PID 4720 wrote to memory of 4472 4720 Cndidlfb.exe 95 PID 4472 wrote to memory of 1372 4472 Cabfagee.exe 96 PID 1372 wrote to memory of 692 1372 Chmnnamb.exe 97 PID 692 wrote to memory of 1864 692 Cnffjl32.exe 98 PID 1864 wrote to memory of 4288 1864 Caebfg32.exe 99 PID 4288 wrote to memory of 2172 4288 Chokcakp.exe 100 PID 2172 wrote to memory of 3844 2172 Cnicpk32.exe 101 PID 3844 wrote to memory of 3028 3844 Ceckleii.exe 102 PID 3028 wrote to memory of 3156 3028 Chagiqhm.exe 103 PID 3156 wrote to memory of 880 3156 Cokpekpj.exe 104 PID 880 wrote to memory of 4164 880 Deehbe32.exe 105 PID 4164 wrote to memory of 5068 4164 Dffdjmme.exe 106 PID 5068 wrote to memory of 4932 5068 Dmpmfg32.exe 107 PID 4932 wrote to memory of 1604 4932 Ddjecalo.exe 108 PID 1604 wrote to memory of 2392 1604 Dkdmpl32.exe 109 PID 2392 wrote to memory of 3052 2392 Dejamdca.exe 110 PID 3052 wrote to memory of 1232 3052 Dfknem32.exe 111 PID 1232 wrote to memory of 1216 1232 Dmefafql.exe 112 PID 1216 wrote to memory of 4728 1216 Ddonnq32.exe 113 PID 4728 wrote to memory of 2308 4728 Dfmjjl32.exe 114 PID 2308 wrote to memory of 216 2308 Dmgbgf32.exe 115 PID 216 wrote to memory of 3856 216 Ddakdqff.exe 116 PID 3856 wrote to memory of 4156 3856 Dkkcqj32.exe 117 PID 4156 wrote to memory of 2896 4156 Eeagnc32.exe 118 PID 2896 wrote to memory of 2216 2896 Eknpfj32.exe 119 PID 2216 wrote to memory of 4652 2216 Eahhcd32.exe 120 PID 4652 wrote to memory of 2272 4652 Egdqkk32.exe 121 PID 2272 wrote to memory of 4304 2272 Eajehd32.exe 122 PID 4304 wrote to memory of 4172 4304 Eggmqk32.exe 123 PID 4172 wrote to memory of 3736 4172 Ealanc32.exe 124 PID 3736 wrote to memory of 3332 3736 Egijfjmp.exe 125 PID 3332 wrote to memory of 2696 3332 Emcbcd32.exe 126 PID 2696 wrote to memory of 308 2696 Ehifpm32.exe 127 PID 308 wrote to memory of 4912 308 Fneohd32.exe 128 PID 4912 wrote to memory of 4888 4912 Fhkcfmbp.exe 129 PID 4888 wrote to memory of 3932 4888 Foekbg32.exe 130 PID 3932 wrote to memory of 1148 3932 Fdbdkn32.exe 131 PID 1148 wrote to memory of 4700 1148 Foghhg32.exe 132 PID 4700 wrote to memory of 1084 4700 Feapdaof.exe 133 PID 1084 wrote to memory of 4100 1084 Fknimh32.exe 134 PID 4100 wrote to memory of 644 4100 Fecmjq32.exe 135 PID 644 wrote to memory of 4180 644 Fkqebg32.exe 136 PID 4180 wrote to memory of 2928 4180 Fefjpp32.exe 137 PID 2928 wrote to memory of 984 2928 Gkcbhgii.exe 138 PID 984 wrote to memory of 544 984 Gehfepio.exe 139 PID 544 wrote to memory of 4612 544 Goqkne32.exe 140 PID 4612 wrote to memory of 4992 4612 Gdncfl32.exe 141 PID 4992 wrote to memory of 4256 4992 Gkglcfec.exe 142 PID 4256 wrote to memory of 1728 4256 Gempqo32.exe 143 PID 1728 wrote to memory of 4028 1728 Gkjhif32.exe 144 PID 4028 wrote to memory of 3296 4028 Gfomfo32.exe 145 PID 3296 wrote to memory of 3600 3296 Gklenf32.exe 146 PID 3600 wrote to memory of 3728 3600 Gfaikoad.exe 147 PID 3728 wrote to memory of 3308 3728 Hgcfcg32.exe 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\842baf827fa595398bce1805ea6b8cfb10e7558b5793a888e151fc68303a6407.exe"C:\Users\Admin\AppData\Local\Temp\842baf827fa595398bce1805ea6b8cfb10e7558b5793a888e151fc68303a6407.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\SysWOW64\Meknhh32.exeC:\Windows\system32\Meknhh32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\Ndmnfofi.exeC:\Windows\system32\Ndmnfofi.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\Ognpoheh.exeC:\Windows\system32\Ognpoheh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\Omjhgoco.exeC:\Windows\system32\Omjhgoco.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\Ocdqcikl.exeC:\Windows\system32\Ocdqcikl.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\Agjhadmh.exeC:\Windows\system32\Agjhadmh.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\Cnbmolhd.exeC:\Windows\system32\Cnbmolhd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\Celelf32.exeC:\Windows\system32\Celelf32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\Chjaha32.exeC:\Windows\system32\Chjaha32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\Cndidlfb.exeC:\Windows\system32\Cndidlfb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\Cabfagee.exeC:\Windows\system32\Cabfagee.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\Chmnnamb.exeC:\Windows\system32\Chmnnamb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\Cnffjl32.exeC:\Windows\system32\Cnffjl32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\Caebfg32.exeC:\Windows\system32\Caebfg32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\Chokcakp.exeC:\Windows\system32\Chokcakp.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\Cnicpk32.exeC:\Windows\system32\Cnicpk32.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\Ceckleii.exeC:\Windows\system32\Ceckleii.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\Chagiqhm.exeC:\Windows\system32\Chagiqhm.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\Cokpekpj.exeC:\Windows\system32\Cokpekpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\Deehbe32.exeC:\Windows\system32\Deehbe32.exe21⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SysWOW64\Dffdjmme.exeC:\Windows\system32\Dffdjmme.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\Dmpmfg32.exeC:\Windows\system32\Dmpmfg32.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\Ddjecalo.exeC:\Windows\system32\Ddjecalo.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\Dkdmpl32.exeC:\Windows\system32\Dkdmpl32.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\Dejamdca.exeC:\Windows\system32\Dejamdca.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\Dfknem32.exeC:\Windows\system32\Dfknem32.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\Dmefafql.exeC:\Windows\system32\Dmefafql.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\Ddonnq32.exeC:\Windows\system32\Ddonnq32.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\Dfmjjl32.exeC:\Windows\system32\Dfmjjl32.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\Dmgbgf32.exeC:\Windows\system32\Dmgbgf32.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\Ddakdqff.exeC:\Windows\system32\Ddakdqff.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\Dkkcqj32.exeC:\Windows\system32\Dkkcqj32.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\Eeagnc32.exeC:\Windows\system32\Eeagnc32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\Eknpfj32.exeC:\Windows\system32\Eknpfj32.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\Eahhcd32.exeC:\Windows\system32\Eahhcd32.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\Egdqkk32.exeC:\Windows\system32\Egdqkk32.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\Eajehd32.exeC:\Windows\system32\Eajehd32.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\Eggmqk32.exeC:\Windows\system32\Eggmqk32.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\Ealanc32.exeC:\Windows\system32\Ealanc32.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\Egijfjmp.exeC:\Windows\system32\Egijfjmp.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\Emcbcd32.exeC:\Windows\system32\Emcbcd32.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\Ehifpm32.exeC:\Windows\system32\Ehifpm32.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\Fneohd32.exeC:\Windows\system32\Fneohd32.exe44⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Windows\SysWOW64\Fhkcfmbp.exeC:\Windows\system32\Fhkcfmbp.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\Foekbg32.exeC:\Windows\system32\Foekbg32.exe46⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\Fdbdkn32.exeC:\Windows\system32\Fdbdkn32.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\Foghhg32.exeC:\Windows\system32\Foghhg32.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\Feapdaof.exeC:\Windows\system32\Feapdaof.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\Fknimh32.exeC:\Windows\system32\Fknimh32.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\Fecmjq32.exeC:\Windows\system32\Fecmjq32.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\Fkqebg32.exeC:\Windows\system32\Fkqebg32.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SysWOW64\Fefjpp32.exeC:\Windows\system32\Fefjpp32.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\Gkcbhgii.exeC:\Windows\system32\Gkcbhgii.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\Gehfepio.exeC:\Windows\system32\Gehfepio.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\Goqkne32.exeC:\Windows\system32\Goqkne32.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\Gdncfl32.exeC:\Windows\system32\Gdncfl32.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\Gkglcfec.exeC:\Windows\system32\Gkglcfec.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\Gempqo32.exeC:\Windows\system32\Gempqo32.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\Gkjhif32.exeC:\Windows\system32\Gkjhif32.exe60⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\Gfomfo32.exeC:\Windows\system32\Gfomfo32.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\Gklenf32.exeC:\Windows\system32\Gklenf32.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\Gfaikoad.exeC:\Windows\system32\Gfaikoad.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\Hgcfcg32.exeC:\Windows\system32\Hgcfcg32.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\Hbhjqp32.exeC:\Windows\system32\Hbhjqp32.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3308 -
C:\Windows\SysWOW64\Hhbbmjne.exeC:\Windows\system32\Hhbbmjne.exe66⤵PID:1880
-
C:\Windows\SysWOW64\Hnokeqll.exeC:\Windows\system32\Hnokeqll.exe67⤵PID:4980
-
C:\Windows\SysWOW64\Hheoci32.exeC:\Windows\system32\Hheoci32.exe68⤵PID:1748
-
C:\Windows\SysWOW64\Hoogpcco.exeC:\Windows\system32\Hoogpcco.exe69⤵PID:5136
-
C:\Windows\SysWOW64\Hdlphjaf.exeC:\Windows\system32\Hdlphjaf.exe70⤵PID:5176
-
C:\Windows\SysWOW64\Hoadecal.exeC:\Windows\system32\Hoadecal.exe71⤵PID:5216
-
C:\Windows\SysWOW64\Hfklamii.exeC:\Windows\system32\Hfklamii.exe72⤵PID:5256
-
C:\Windows\SysWOW64\Hkhdjdgq.exeC:\Windows\system32\Hkhdjdgq.exe73⤵PID:5296
-
C:\Windows\SysWOW64\Hfmigmgf.exeC:\Windows\system32\Hfmigmgf.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5336 -
C:\Windows\SysWOW64\Igoeoe32.exeC:\Windows\system32\Igoeoe32.exe75⤵PID:5376
-
C:\Windows\SysWOW64\Ibdiln32.exeC:\Windows\system32\Ibdiln32.exe76⤵PID:5424
-
C:\Windows\SysWOW64\Igabdekb.exeC:\Windows\system32\Igabdekb.exe77⤵PID:5456
-
C:\Windows\SysWOW64\Ibffbnjh.exeC:\Windows\system32\Ibffbnjh.exe78⤵PID:5496
-
C:\Windows\SysWOW64\Igcojdhp.exeC:\Windows\system32\Igcojdhp.exe79⤵PID:5536
-
C:\Windows\SysWOW64\Ibicgmhe.exeC:\Windows\system32\Ibicgmhe.exe80⤵PID:5576
-
C:\Windows\SysWOW64\Igfkpd32.exeC:\Windows\system32\Igfkpd32.exe81⤵PID:5620
-
C:\Windows\SysWOW64\Inpclnnj.exeC:\Windows\system32\Inpclnnj.exe82⤵PID:5676
-
C:\Windows\SysWOW64\Ighhed32.exeC:\Windows\system32\Ighhed32.exe83⤵PID:5708
-
C:\Windows\SysWOW64\Inbpbnlg.exeC:\Windows\system32\Inbpbnlg.exe84⤵PID:5748
-
C:\Windows\SysWOW64\Jigdoglm.exeC:\Windows\system32\Jigdoglm.exe85⤵PID:5792
-
C:\Windows\SysWOW64\Jndmgn32.exeC:\Windows\system32\Jndmgn32.exe86⤵PID:5840
-
C:\Windows\SysWOW64\Jijaef32.exeC:\Windows\system32\Jijaef32.exe87⤵PID:5872
-
C:\Windows\SysWOW64\Jngjmm32.exeC:\Windows\system32\Jngjmm32.exe88⤵PID:5912
-
C:\Windows\SysWOW64\Jeqbjgoo.exeC:\Windows\system32\Jeqbjgoo.exe89⤵
- Modifies registry class
PID:5956 -
C:\Windows\SysWOW64\Jpffgp32.exeC:\Windows\system32\Jpffgp32.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:5996 -
C:\Windows\SysWOW64\Jiokpfee.exeC:\Windows\system32\Jiokpfee.exe91⤵PID:6036
-
C:\Windows\SysWOW64\Jbgoik32.exeC:\Windows\system32\Jbgoik32.exe92⤵PID:6076
-
C:\Windows\SysWOW64\Jgdhab32.exeC:\Windows\system32\Jgdhab32.exe93⤵
- Modifies registry class
PID:6116 -
C:\Windows\SysWOW64\Kfehoj32.exeC:\Windows\system32\Kfehoj32.exe94⤵PID:3372
-
C:\Windows\SysWOW64\Klapgq32.exeC:\Windows\system32\Klapgq32.exe95⤵PID:4796
-
C:\Windows\SysWOW64\Kejepfgd.exeC:\Windows\system32\Kejepfgd.exe96⤵PID:1800
-
C:\Windows\SysWOW64\Knbiil32.exeC:\Windows\system32\Knbiil32.exe97⤵PID:1080
-
C:\Windows\SysWOW64\Khknaa32.exeC:\Windows\system32\Khknaa32.exe98⤵PID:2012
-
C:\Windows\SysWOW64\Kbpboj32.exeC:\Windows\system32\Kbpboj32.exe99⤵PID:4372
-
C:\Windows\SysWOW64\Khmjga32.exeC:\Windows\system32\Khmjga32.exe100⤵PID:468
-
C:\Windows\SysWOW64\Kbbodj32.exeC:\Windows\system32\Kbbodj32.exe101⤵PID:4828
-
C:\Windows\SysWOW64\Khpgmqpp.exeC:\Windows\system32\Khpgmqpp.exe102⤵PID:5168
-
C:\Windows\SysWOW64\Lbekjipe.exeC:\Windows\system32\Lbekjipe.exe103⤵PID:5244
-
C:\Windows\SysWOW64\Liocgc32.exeC:\Windows\system32\Liocgc32.exe104⤵PID:5304
-
C:\Windows\SysWOW64\Lnlloj32.exeC:\Windows\system32\Lnlloj32.exe105⤵PID:5384
-
C:\Windows\SysWOW64\Liaqlcep.exeC:\Windows\system32\Liaqlcep.exe106⤵PID:5452
-
C:\Windows\SysWOW64\Lbjeei32.exeC:\Windows\system32\Lbjeei32.exe107⤵PID:1500
-
C:\Windows\SysWOW64\Lhfmmp32.exeC:\Windows\system32\Lhfmmp32.exe108⤵PID:5572
-
C:\Windows\SysWOW64\Lblakh32.exeC:\Windows\system32\Lblakh32.exe109⤵PID:5652
-
C:\Windows\SysWOW64\Lifjgb32.exeC:\Windows\system32\Lifjgb32.exe110⤵PID:5736
-
C:\Windows\SysWOW64\Lbnnphhk.exeC:\Windows\system32\Lbnnphhk.exe111⤵
- Modifies registry class
PID:5812 -
C:\Windows\SysWOW64\Lhkghofb.exeC:\Windows\system32\Lhkghofb.exe112⤵PID:5880
-
C:\Windows\SysWOW64\Mflgff32.exeC:\Windows\system32\Mflgff32.exe113⤵PID:5952
-
C:\Windows\SysWOW64\Mlipomli.exeC:\Windows\system32\Mlipomli.exe114⤵PID:6032
-
C:\Windows\SysWOW64\Mbchkg32.exeC:\Windows\system32\Mbchkg32.exe115⤵
- Modifies registry class
PID:6112 -
C:\Windows\SysWOW64\Mhppcn32.exeC:\Windows\system32\Mhppcn32.exe116⤵PID:2944
-
C:\Windows\SysWOW64\Mfaqafjl.exeC:\Windows\system32\Mfaqafjl.exe117⤵PID:3360
-
C:\Windows\SysWOW64\Mlnijmhc.exeC:\Windows\system32\Mlnijmhc.exe118⤵PID:3352
-
C:\Windows\SysWOW64\Mfcmge32.exeC:\Windows\system32\Mfcmge32.exe119⤵PID:3368
-
C:\Windows\SysWOW64\Mlpeol32.exeC:\Windows\system32\Mlpeol32.exe120⤵
- System Location Discovery: System Language Discovery
PID:2412 -
C:\Windows\SysWOW64\Mfejme32.exeC:\Windows\system32\Mfejme32.exe121⤵PID:5164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-