Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 16:59
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
- Size 408KB
- Sample261006-vhn4mabs2t
- SHA256 1254cab80d36ea39d81d6846c7145bbef02b8bc8c884d7b65087b84191f4572c
- MD5 b88fdb8d42e1b985e6768b79057e8f90
- SHA1 67eda2cb50a518afda9f8f56714a5f910439e14d
- SHA512 246591e9f914f4dc48ef3384b554e5e889ad0c5dd31d0453a9e75195ad365dc3420762b15dce77816d69783e23927a78bf8a4eb381c1b84fbc36c582e815075c
- SSDEEP 6144:abWQnTHsHZge65qL4SChTHsHZsz6IZI8ymoBDPhYvTHsHZge65qL4SChTHsHZ:QISe601oIr1XBDJsISe601oI
- TLSH T164945AC990640A8EC61E89F418FFA2377CE13F660FD25F9396C1F252E9A60E61C65271
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://crutop.ru/index.php
-
http://mazafaka.ru/index.php
-
http://color-bank.ru/index.php
-
http://asechka.ru/index.php
-
http://trojan.ru/index.php
-
http://fuck.ru/index.php
-
http://goldensand.ru/index.php
-
http://filesearch.ru/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://lovingod.host.sk/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://mazafaka.ru/index.htm
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
-
http://fethard.biz/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lechfeoi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ealkcm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nifldj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohboeenl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fligjnlo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fiodib32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhfmic32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cppfgnlj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhejij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hjjnkkjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kjeiij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nllekk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aoifoa32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlflog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nadlnoaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qdjgbg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cajqng32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hfmigmgf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhdqhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qqcjnell.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Engjol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phajgf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eidlhj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gpnmka32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmobdm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kgefae32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Klkcmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lhijcohe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nlknqd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qkjgomgb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gibhihko.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijcjgcni.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phajgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hhihnihm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knipik32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfdbknda.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdoiaf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nlnbqjjq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijnqld32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgbjlf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gmfpeoga.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjeiij32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhbelp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oibbjoij.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Flgaodbm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgbhbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Clplff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dkcnnk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppemmg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjpbkc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlooef32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfigib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Anjifbpg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dfdpjj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mplapkoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hjedpkne.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hlefgphj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kggcgeop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Anmfkane.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phcgmffo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hmpclnof.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpbfbo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lejngd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fdopkhfk.exe - Executes dropped EXE 64 IoCs
pid Process 4164 Hhihnihm.exe 4440 Hocqkc32.exe 5792 Hfmigmgf.exe 5292 Igoeoe32.exe 5932 Ifbbbl32.exe 904 Igcojdhp.exe 4132 Iiehjgnp.exe 2268 Jkfakb32.exe 1520 Jijaef32.exe 1960 Jgonfcnb.exe 4868 Jecoog32.exe 4788 Jeekeg32.exe 1560 Jpkpbpko.exe 4400 Knpmcl32.exe 1400 Kieaqe32.exe 2880 Kihnfdmj.exe 3352 Kpbfbo32.exe 3916 Kbpboj32.exe 2760 Kijjldkh.exe 1476 Kngcdkjo.exe 1192 Kfnkeh32.exe 5872 Klkcmo32.exe 2272 Knipik32.exe 4112 Lechfeoi.exe 4632 Lhbdbpnm.exe 1292 Lnlloj32.exe 4804 Lfcdph32.exe 3244 Lhdqhp32.exe 3104 Lpkiim32.exe 4900 Lfeaegdi.exe 5544 Licmbccm.exe 4120 Llbinnbq.exe 3276 Loqejjad.exe 3892 Lejngd32.exe 4244 Lhijcohe.exe 5164 Lppbdmig.exe 1896 Lfjjqg32.exe 560 Lhkghofb.exe 2040 Lpbojlfd.exe 4828 Mflgff32.exe 4264 Mhncnodp.exe 4660 Moglkikl.exe 4160 Meadgc32.exe 5400 Mhppcn32.exe 3036 Mojhphij.exe 4984 Medqmb32.exe 2988 Mhbmin32.exe 3392 Mbhafgpp.exe 236 Miaica32.exe 2484 Mplapkoj.exe 2832 Mbjnlfnn.exe 4796 Midfiq32.exe 4304 Noaoagca.exe 5888 Nfhfbedd.exe 4952 Nhicjm32.exe 4108 Nockfgao.exe 3452 Ngjcgdba.exe 5276 Nhlpom32.exe 5960 Noehlgol.exe 5416 Neppiagi.exe 3772 Nlihek32.exe 2564 Nccqbeec.exe 6104 Nebmnqdf.exe 2876 Nllekk32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Npbelfjm.dll Aoifoa32.exe File opened for modification C:\Windows\SysWOW64\Ffnkggld.exe Fligjnlo.exe File opened for modification C:\Windows\SysWOW64\Cncnhh32.exe Cdkipb32.exe File created C:\Windows\SysWOW64\Hfggoh32.dll Peokkbao.exe File created C:\Windows\SysWOW64\Eoamlk32.dll Fieacc32.exe File opened for modification C:\Windows\SysWOW64\Gemkobia.exe Goccbhae.exe File created C:\Windows\SysWOW64\Danlilhh.dll Nbnpmp32.exe File created C:\Windows\SysWOW64\Laheqjdd.dll Qhigbl32.exe File created C:\Windows\SysWOW64\Jjohhbeb.dll Anjifbpg.exe File created C:\Windows\SysWOW64\Qjglkmmh.dll Clplff32.exe File created C:\Windows\SysWOW64\Plbmhadm.exe Pamikh32.exe File opened for modification C:\Windows\SysWOW64\Bncllqhm.exe Blbodh32.exe File created C:\Windows\SysWOW64\Gfjcmfbn.dll Pcmeek32.exe File opened for modification C:\Windows\SysWOW64\Dnondf32.exe Dhbelp32.exe File opened for modification C:\Windows\SysWOW64\Mojhphij.exe Mhppcn32.exe File created C:\Windows\SysWOW64\Fgpilc32.exe Fpeapilo.exe File created C:\Windows\SysWOW64\Fmnkdm32.exe Fdffkgpc.exe File created C:\Windows\SysWOW64\Mjpbkc32.exe Mecjbl32.exe File created C:\Windows\SysWOW64\Baadbo32.exe Bldljh32.exe File created C:\Windows\SysWOW64\Gnlmai32.exe Fiodib32.exe File opened for modification C:\Windows\SysWOW64\Bjpjoa32.exe Bcfabgel.exe File created C:\Windows\SysWOW64\Lckegmne.dll Cioifm32.exe File created C:\Windows\SysWOW64\Hingefqa.exe Gbcohl32.exe File created C:\Windows\SysWOW64\Kaabkj32.dll Hknkiokp.exe File opened for modification C:\Windows\SysWOW64\Plpqba32.exe Pakleh32.exe File created C:\Windows\SysWOW64\Ajpqhdkl.exe Acfhkj32.exe File opened for modification C:\Windows\SysWOW64\Pjehflie.exe Pjbkal32.exe File created C:\Windows\SysWOW64\Cfdgcmqd.exe Bojogb32.exe File created C:\Windows\SysWOW64\Dkcnnk32.exe Ddifaqcn.exe File created C:\Windows\SysWOW64\Gibhihko.exe Fbhplnca.exe File created C:\Windows\SysWOW64\Epoqal32.dll Gideogil.exe File opened for modification C:\Windows\SysWOW64\Nhokeolc.exe Naecieef.exe File created C:\Windows\SysWOW64\Bbhppf32.dll Glbjpmdd.exe File opened for modification C:\Windows\SysWOW64\Hpdlajfe.exe Gmfpeoga.exe File opened for modification C:\Windows\SysWOW64\Ipdfheal.exe Hjjnkkjp.exe File created C:\Windows\SysWOW64\Hocqkc32.exe Hhihnihm.exe File created C:\Windows\SysWOW64\Ogmidbal.exe Oofacdaj.exe File created C:\Windows\SysWOW64\Eehmnind.dll Ebjckppa.exe File created C:\Windows\SysWOW64\Qodmdb32.exe Pgihppgo.exe File created C:\Windows\SysWOW64\Jcknpi32.exe Ijcjgcni.exe File created C:\Windows\SysWOW64\Nackep32.dll Qobhepjf.exe File created C:\Windows\SysWOW64\Jhggmjhg.dll Pphjbgfj.exe File opened for modification C:\Windows\SysWOW64\Cpglgmfa.exe Cimckcoe.exe File created C:\Windows\SysWOW64\Pceihj32.dll Opqopj32.exe File created C:\Windows\SysWOW64\Qfpcgaqk.dll Mbhafgpp.exe File created C:\Windows\SysWOW64\Fgbfbc32.exe Fphneijl.exe File created C:\Windows\SysWOW64\Fdffkgpc.exe Fmlnomif.exe File opened for modification C:\Windows\SysWOW64\Gpodfh32.exe Gielinlg.exe File opened for modification C:\Windows\SysWOW64\Hckeikcl.exe Hmnmqdee.exe File created C:\Windows\SysWOW64\Alkidi32.exe Anjifbpg.exe File created C:\Windows\SysWOW64\Ncofjaho.exe Nnbnaj32.exe File created C:\Windows\SysWOW64\Bhkmoifp.exe Baadbo32.exe File created C:\Windows\SysWOW64\Pbliablc.dll Hfmigmgf.exe File created C:\Windows\SysWOW64\Ggpbcaei.exe Gngnjk32.exe File opened for modification C:\Windows\SysWOW64\Palbpb32.exe Pkbjchio.exe File created C:\Windows\SysWOW64\Nfeekgjo.exe Mgphjk32.exe File created C:\Windows\SysWOW64\Pbbmgj32.dll Knpmcl32.exe File opened for modification C:\Windows\SysWOW64\Nlihek32.exe Neppiagi.exe File created C:\Windows\SysWOW64\Fphneijl.exe Fineho32.exe File created C:\Windows\SysWOW64\Gdhcagnp.exe Fmnkdm32.exe File created C:\Windows\SysWOW64\Amkkai32.dll Hgdlnp32.exe File opened for modification C:\Windows\SysWOW64\Gifadggi.exe Gpnmka32.exe File opened for modification C:\Windows\SysWOW64\Knoonphp.exe Kgefae32.exe File opened for modification C:\Windows\SysWOW64\Lmmoekem.exe Lklbnb32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 13548 1336 WerFault.exe 739 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlooef32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aeodapcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Miaica32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fphneijl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jnjecp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Njkklk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oplfekdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lechfeoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhbmin32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ohnelj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddngdj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ipdfheal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gideogil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Alimnj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Goccbhae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oplkgi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edcqojqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fclmkb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgccccec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojmqgd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pamikh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flgaodbm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Akqfef32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Clplff32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aodejohd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oghpib32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aoifoa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ccpkblqn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oiakpheo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epndddnk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Naecieef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qdldgg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Loqejjad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjkpif32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bnhegp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpkiklop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nqpccp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmkfjn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bmeagjbo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Meadgc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nfhfbedd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Idieob32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljcejhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjeaph32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lfjjqg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kggcgeop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbfgdllk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knioij32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cpkddd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jeekeg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hbjonepq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbiede32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kilpgnfi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aoofej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkmdoi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Akccje32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dnpdom32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aajggjap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpbojlfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikcmklih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkbmjhdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgnfpp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljbfiegb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llabchoe.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Knpmcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nppakcok.dll" Hpkcafjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjkagnii.dll" Nlknqd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qkjgomgb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lgccccec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojbdmk32.dll" Pmoijcje.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hckeikcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iciaji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emihdakh.dll" Agbkfood.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nladpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiphfa32.dll" Dnondf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfckia32.dll" Jgonfcnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdcodl32.dll" Ncfmhecp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmioon32.dll" Jgpmffeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgmejc32.dll" Knnhdied.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fammoofd.dll" Dgbhbm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Igcojdhp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lhbdbpnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pceihj32.dll" Opqopj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbkigk32.dll" Mjpbkc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkahhe32.dll" Fblifijc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nfeekgjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ommjipel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dogdnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Igcojdhp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cgdlqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eoagdi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hpkcafjg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mjhepnno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Phfjmlhh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfnpdfgc.dll" Hiomppkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgkgfgde.dll" Cneknh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oblmnmjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hckgenae.dll" Kjhlipla.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bekdmnio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bekdmnio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gdoiaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kiggln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfefikjj.dll" Mlooef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lddekd32.dll" Engjol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgcmkeoi.dll" Ogndki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnohfi32.dll" Baldmiom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmcbofdh.dll" Daccdf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Djcfee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dmooak32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hlkmfkli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agncocnp.dll" Mjeaph32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mfqlph32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mnhdae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpqmcoei.dll" Knabne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Keinepch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Knabne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Peaokh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dcdnce32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Emhahiep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hmpclnof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Apeabg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbfkdhnj.dll" Cdkipb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ffmelmbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bkkofn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgkmhn32.dll" Jpkpbpko.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ebjckppa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hingefqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ipflcnln.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3648 wrote to memory of 4164 3648 jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe 91 PID 4164 wrote to memory of 4440 4164 Hhihnihm.exe 92 PID 4440 wrote to memory of 5792 4440 Hocqkc32.exe 93 PID 5792 wrote to memory of 5292 5792 Hfmigmgf.exe 94 PID 5292 wrote to memory of 5932 5292 Igoeoe32.exe 95 PID 5932 wrote to memory of 904 5932 Ifbbbl32.exe 96 PID 904 wrote to memory of 4132 904 Igcojdhp.exe 97 PID 4132 wrote to memory of 2268 4132 Iiehjgnp.exe 98 PID 2268 wrote to memory of 1520 2268 Jkfakb32.exe 99 PID 1520 wrote to memory of 1960 1520 Jijaef32.exe 100 PID 1960 wrote to memory of 4868 1960 Jgonfcnb.exe 101 PID 4868 wrote to memory of 4788 4868 Jecoog32.exe 102 PID 4788 wrote to memory of 1560 4788 Jeekeg32.exe 103 PID 1560 wrote to memory of 4400 1560 Jpkpbpko.exe 104 PID 4400 wrote to memory of 1400 4400 Knpmcl32.exe 105 PID 1400 wrote to memory of 2880 1400 Kieaqe32.exe 106 PID 2880 wrote to memory of 3352 2880 Kihnfdmj.exe 107 PID 3352 wrote to memory of 3916 3352 Kpbfbo32.exe 108 PID 3916 wrote to memory of 2760 3916 Kbpboj32.exe 109 PID 2760 wrote to memory of 1476 2760 Kijjldkh.exe 110 PID 1476 wrote to memory of 1192 1476 Kngcdkjo.exe 111 PID 1192 wrote to memory of 5872 1192 Kfnkeh32.exe 112 PID 5872 wrote to memory of 2272 5872 Klkcmo32.exe 113 PID 2272 wrote to memory of 4112 2272 Knipik32.exe 114 PID 4112 wrote to memory of 4632 4112 Lechfeoi.exe 115 PID 4632 wrote to memory of 1292 4632 Lhbdbpnm.exe 116 PID 1292 wrote to memory of 4804 1292 Lnlloj32.exe 117 PID 4804 wrote to memory of 3244 4804 Lfcdph32.exe 118 PID 3244 wrote to memory of 3104 3244 Lhdqhp32.exe 119 PID 3104 wrote to memory of 4900 3104 Lpkiim32.exe 120 PID 4900 wrote to memory of 5544 4900 Lfeaegdi.exe 121 PID 5544 wrote to memory of 4120 5544 Licmbccm.exe 122 PID 4120 wrote to memory of 3276 4120 Llbinnbq.exe 123 PID 3276 wrote to memory of 3892 3276 Loqejjad.exe 124 PID 3892 wrote to memory of 4244 3892 Lejngd32.exe 125 PID 4244 wrote to memory of 5164 4244 Lhijcohe.exe 126 PID 5164 wrote to memory of 1896 5164 Lppbdmig.exe 127 PID 1896 wrote to memory of 560 1896 Lfjjqg32.exe 128 PID 560 wrote to memory of 2040 560 Lhkghofb.exe 129 PID 2040 wrote to memory of 4828 2040 Lpbojlfd.exe 130 PID 4828 wrote to memory of 4264 4828 Mflgff32.exe 131 PID 4264 wrote to memory of 4660 4264 Mhncnodp.exe 132 PID 4660 wrote to memory of 4160 4660 Moglkikl.exe 133 PID 4160 wrote to memory of 5400 4160 Meadgc32.exe 134 PID 5400 wrote to memory of 3036 5400 Mhppcn32.exe 135 PID 3036 wrote to memory of 4984 3036 Mojhphij.exe 136 PID 4984 wrote to memory of 2988 4984 Medqmb32.exe 137 PID 2988 wrote to memory of 3392 2988 Mhbmin32.exe 138 PID 3392 wrote to memory of 236 3392 Mbhafgpp.exe 139 PID 236 wrote to memory of 2484 236 Miaica32.exe 140 PID 2484 wrote to memory of 2832 2484 Mplapkoj.exe 141 PID 2832 wrote to memory of 4796 2832 Mbjnlfnn.exe 142 PID 4796 wrote to memory of 4304 4796 Midfiq32.exe 143 PID 4304 wrote to memory of 5888 4304 Noaoagca.exe 144 PID 5888 wrote to memory of 4952 5888 Nfhfbedd.exe 145 PID 4952 wrote to memory of 4108 4952 Nhicjm32.exe 146 PID 4108 wrote to memory of 3452 4108 Nockfgao.exe 147 PID 3452 wrote to memory of 5276 3452 Ngjcgdba.exe 148 PID 5276 wrote to memory of 5960 5276 Nhlpom32.exe 149 PID 5960 wrote to memory of 5416 5960 Noehlgol.exe 150 PID 5416 wrote to memory of 3772 5416 Neppiagi.exe 151 PID 3772 wrote to memory of 2564 3772 Nlihek32.exe 152 PID 2564 wrote to memory of 6104 2564 Nccqbeec.exe 153 PID 6104 wrote to memory of 2876 6104 Nebmnqdf.exe 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\Hhihnihm.exeC:\Windows\system32\Hhihnihm.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\Hocqkc32.exeC:\Windows\system32\Hocqkc32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\Hfmigmgf.exeC:\Windows\system32\Hfmigmgf.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\Igoeoe32.exeC:\Windows\system32\Igoeoe32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Windows\SysWOW64\Ifbbbl32.exeC:\Windows\system32\Ifbbbl32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\Igcojdhp.exeC:\Windows\system32\Igcojdhp.exe7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\Iiehjgnp.exeC:\Windows\system32\Iiehjgnp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\Jkfakb32.exeC:\Windows\system32\Jkfakb32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\Jijaef32.exeC:\Windows\system32\Jijaef32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\Jgonfcnb.exeC:\Windows\system32\Jgonfcnb.exe11⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\Jecoog32.exeC:\Windows\system32\Jecoog32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\Jeekeg32.exeC:\Windows\system32\Jeekeg32.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\Jpkpbpko.exeC:\Windows\system32\Jpkpbpko.exe14⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\Knpmcl32.exeC:\Windows\system32\Knpmcl32.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\Kieaqe32.exeC:\Windows\system32\Kieaqe32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\Kihnfdmj.exeC:\Windows\system32\Kihnfdmj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\Kpbfbo32.exeC:\Windows\system32\Kpbfbo32.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\Kbpboj32.exeC:\Windows\system32\Kbpboj32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\Kijjldkh.exeC:\Windows\system32\Kijjldkh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\Kngcdkjo.exeC:\Windows\system32\Kngcdkjo.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\Kfnkeh32.exeC:\Windows\system32\Kfnkeh32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\Klkcmo32.exeC:\Windows\system32\Klkcmo32.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\Knipik32.exeC:\Windows\system32\Knipik32.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\Lechfeoi.exeC:\Windows\system32\Lechfeoi.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\Lhbdbpnm.exeC:\Windows\system32\Lhbdbpnm.exe26⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\Lnlloj32.exeC:\Windows\system32\Lnlloj32.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\Lfcdph32.exeC:\Windows\system32\Lfcdph32.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\Lhdqhp32.exeC:\Windows\system32\Lhdqhp32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\Lpkiim32.exeC:\Windows\system32\Lpkiim32.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\Lfeaegdi.exeC:\Windows\system32\Lfeaegdi.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\Licmbccm.exeC:\Windows\system32\Licmbccm.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Windows\SysWOW64\Llbinnbq.exeC:\Windows\system32\Llbinnbq.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\Loqejjad.exeC:\Windows\system32\Loqejjad.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\Lejngd32.exeC:\Windows\system32\Lejngd32.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\Lhijcohe.exeC:\Windows\system32\Lhijcohe.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\Lppbdmig.exeC:\Windows\system32\Lppbdmig.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Windows\SysWOW64\Lfjjqg32.exeC:\Windows\system32\Lfjjqg32.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\Lhkghofb.exeC:\Windows\system32\Lhkghofb.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\Lpbojlfd.exeC:\Windows\system32\Lpbojlfd.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\Mflgff32.exeC:\Windows\system32\Mflgff32.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\Mhncnodp.exeC:\Windows\system32\Mhncnodp.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\Moglkikl.exeC:\Windows\system32\Moglkikl.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\Meadgc32.exeC:\Windows\system32\Meadgc32.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\Mhppcn32.exeC:\Windows\system32\Mhppcn32.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Windows\SysWOW64\Mojhphij.exeC:\Windows\system32\Mojhphij.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\Medqmb32.exeC:\Windows\system32\Medqmb32.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\Mhbmin32.exeC:\Windows\system32\Mhbmin32.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\Mbhafgpp.exeC:\Windows\system32\Mbhafgpp.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\Miaica32.exeC:\Windows\system32\Miaica32.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Windows\SysWOW64\Mplapkoj.exeC:\Windows\system32\Mplapkoj.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\Mbjnlfnn.exeC:\Windows\system32\Mbjnlfnn.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\Midfiq32.exeC:\Windows\system32\Midfiq32.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\Noaoagca.exeC:\Windows\system32\Noaoagca.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\Nfhfbedd.exeC:\Windows\system32\Nfhfbedd.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\Nhicjm32.exeC:\Windows\system32\Nhicjm32.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\Nockfgao.exeC:\Windows\system32\Nockfgao.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\Ngjcgdba.exeC:\Windows\system32\Ngjcgdba.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\Nhlpom32.exeC:\Windows\system32\Nhlpom32.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Windows\SysWOW64\Noehlgol.exeC:\Windows\system32\Noehlgol.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\SysWOW64\Neppiagi.exeC:\Windows\system32\Neppiagi.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\Nlihek32.exeC:\Windows\system32\Nlihek32.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\Nccqbeec.exeC:\Windows\system32\Nccqbeec.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\Nebmnqdf.exeC:\Windows\system32\Nebmnqdf.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Windows\SysWOW64\Nllekk32.exeC:\Windows\system32\Nllekk32.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2876 -
C:\Windows\SysWOW64\Ncfmhecp.exeC:\Windows\system32\Ncfmhecp.exe66⤵
- Modifies registry class
PID:1212 -
C:\Windows\SysWOW64\Nipedokm.exeC:\Windows\system32\Nipedokm.exe67⤵PID:2708
-
C:\Windows\SysWOW64\Nlnbqjjq.exeC:\Windows\system32\Nlnbqjjq.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5016 -
C:\Windows\SysWOW64\Ochjmd32.exeC:\Windows\system32\Ochjmd32.exe69⤵PID:1716
-
C:\Windows\SysWOW64\Oibbjoij.exeC:\Windows\system32\Oibbjoij.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5340 -
C:\Windows\SysWOW64\Oplkgi32.exeC:\Windows\system32\Oplkgi32.exe71⤵
- System Location Discovery: System Language Discovery
PID:4588 -
C:\Windows\SysWOW64\Ogfccchd.exeC:\Windows\system32\Ogfccchd.exe72⤵PID:712
-
C:\Windows\SysWOW64\Ohgokknb.exeC:\Windows\system32\Ohgokknb.exe73⤵PID:4736
-
C:\Windows\SysWOW64\Ooaghe32.exeC:\Windows\system32\Ooaghe32.exe74⤵PID:896
-
C:\Windows\SysWOW64\Oghpib32.exeC:\Windows\system32\Oghpib32.exe75⤵
- System Location Discovery: System Language Discovery
PID:1664 -
C:\Windows\SysWOW64\Ohjlqklp.exeC:\Windows\system32\Ohjlqklp.exe76⤵PID:2104
-
C:\Windows\SysWOW64\Oocdme32.exeC:\Windows\system32\Oocdme32.exe77⤵PID:4224
-
C:\Windows\SysWOW64\Oenljoji.exeC:\Windows\system32\Oenljoji.exe78⤵PID:2572
-
C:\Windows\SysWOW64\Ohlifj32.exeC:\Windows\system32\Ohlifj32.exe79⤵PID:5572
-
C:\Windows\SysWOW64\Oofacdaj.exeC:\Windows\system32\Oofacdaj.exe80⤵
- Drops file in System32 directory
PID:2384 -
C:\Windows\SysWOW64\Ogmidbal.exeC:\Windows\system32\Ogmidbal.exe81⤵PID:4248
-
C:\Windows\SysWOW64\Ohnelj32.exeC:\Windows\system32\Ohnelj32.exe82⤵
- System Location Discovery: System Language Discovery
PID:5252 -
C:\Windows\SysWOW64\Ppemmg32.exeC:\Windows\system32\Ppemmg32.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:704 -
C:\Windows\SysWOW64\Pgoejapi.exeC:\Windows\system32\Pgoejapi.exe84⤵PID:3132
-
C:\Windows\SysWOW64\Pjnbfmom.exeC:\Windows\system32\Pjnbfmom.exe85⤵PID:3524
-
C:\Windows\SysWOW64\Pphjbgfj.exeC:\Windows\system32\Pphjbgfj.exe86⤵
- Drops file in System32 directory
PID:4644 -
C:\Windows\SysWOW64\Pcffoben.exeC:\Windows\system32\Pcffoben.exe87⤵PID:2216
-
C:\Windows\SysWOW64\Pfdbknda.exeC:\Windows\system32\Pfdbknda.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1244 -
C:\Windows\SysWOW64\Plokgh32.exeC:\Windows\system32\Plokgh32.exe89⤵PID:4956
-
C:\Windows\SysWOW64\Pchcdbck.exeC:\Windows\system32\Pchcdbck.exe90⤵PID:5940
-
C:\Windows\SysWOW64\Pjbkal32.exeC:\Windows\system32\Pjbkal32.exe91⤵
- Drops file in System32 directory
PID:1388 -
C:\Windows\SysWOW64\Pjehflie.exeC:\Windows\system32\Pjehflie.exe92⤵PID:3900
-
C:\Windows\SysWOW64\Pgihppgo.exeC:\Windows\system32\Pgihppgo.exe93⤵
- Drops file in System32 directory
PID:1060 -
C:\Windows\SysWOW64\Qodmdb32.exeC:\Windows\system32\Qodmdb32.exe94⤵PID:2716
-
C:\Windows\SysWOW64\Qqcjnell.exeC:\Windows\system32\Qqcjnell.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2660 -
C:\Windows\SysWOW64\Aoifoa32.exeC:\Windows\system32\Aoifoa32.exe96⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1940 -
C:\Windows\SysWOW64\Agbkfood.exeC:\Windows\system32\Agbkfood.exe97⤵
- Modifies registry class
PID:4172 -
C:\Windows\SysWOW64\Afghgkdl.exeC:\Windows\system32\Afghgkdl.exe98⤵PID:4284
-
C:\Windows\SysWOW64\Amcmie32.exeC:\Windows\system32\Amcmie32.exe99⤵PID:5100
-
C:\Windows\SysWOW64\Bgknlmgi.exeC:\Windows\system32\Bgknlmgi.exe100⤵PID:3012
-
C:\Windows\SysWOW64\Bgpggm32.exeC:\Windows\system32\Bgpggm32.exe101⤵PID:2640
-
C:\Windows\SysWOW64\Cppfgnlj.exeC:\Windows\system32\Cppfgnlj.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3380 -
C:\Windows\SysWOW64\Cjejdglp.exeC:\Windows\system32\Cjejdglp.exe103⤵PID:1808
-
C:\Windows\SysWOW64\Cjhfjg32.exeC:\Windows\system32\Cjhfjg32.exe104⤵PID:4924
-
C:\Windows\SysWOW64\Ccpkblqn.exeC:\Windows\system32\Ccpkblqn.exe105⤵
- System Location Discovery: System Language Discovery
PID:5344 -
C:\Windows\SysWOW64\Cimckcoe.exeC:\Windows\system32\Cimckcoe.exe106⤵
- Drops file in System32 directory
PID:5200 -
C:\Windows\SysWOW64\Cpglgmfa.exeC:\Windows\system32\Cpglgmfa.exe107⤵PID:3168
-
C:\Windows\SysWOW64\Cjmpeffh.exeC:\Windows\system32\Cjmpeffh.exe108⤵PID:4584
-
C:\Windows\SysWOW64\Cafhap32.exeC:\Windows\system32\Cafhap32.exe109⤵PID:1688
-
C:\Windows\SysWOW64\Dibmfb32.exeC:\Windows\system32\Dibmfb32.exe110⤵PID:3884
-
C:\Windows\SysWOW64\Dplebmbl.exeC:\Windows\system32\Dplebmbl.exe111⤵PID:4180
-
C:\Windows\SysWOW64\Dhejij32.exeC:\Windows\system32\Dhejij32.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:912 -
C:\Windows\SysWOW64\Djcfee32.exeC:\Windows\system32\Djcfee32.exe113⤵
- Modifies registry class
PID:3468 -
C:\Windows\SysWOW64\Dclknkfp.exeC:\Windows\system32\Dclknkfp.exe114⤵PID:3448
-
C:\Windows\SysWOW64\Dmdogpmq.exeC:\Windows\system32\Dmdogpmq.exe115⤵PID:3696
-
C:\Windows\SysWOW64\Ddngdj32.exeC:\Windows\system32\Ddngdj32.exe116⤵
- System Location Discovery: System Language Discovery
PID:2296 -
C:\Windows\SysWOW64\Dpehikja.exeC:\Windows\system32\Dpehikja.exe117⤵PID:5828
-
C:\Windows\SysWOW64\Einmaaqb.exeC:\Windows\system32\Einmaaqb.exe118⤵PID:1272
-
C:\Windows\SysWOW64\Edcqojqh.exeC:\Windows\system32\Edcqojqh.exe119⤵
- System Location Discovery: System Language Discovery
PID:5208 -
C:\Windows\SysWOW64\Ejmild32.exeC:\Windows\system32\Ejmild32.exe120⤵PID:6112
-
C:\Windows\SysWOW64\Edemdine.exeC:\Windows\system32\Edemdine.exe121⤵PID:4416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-