Analysis
- max time kernel
47s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 16:59
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
- Size 102KB
- Sample261006-vhsrtabs2w
- SHA256 ddcfdf422ce89b1026085e35cfebf7ae25aafe57ae76f97fd7e1a252e0e7bcea
- MD5 3df18c4e36a388bbbfbc5ac69451b9df
- SHA1 06a1abfabda33ee62ac40c70846c8c178fea125b
- SHA512 1c412dbd9829618ff578b8bc7086c5239c35ca46d3357f3cb92bf910f7c1f0e96beb7996906eebbe0b8855ec4b607bae7638412b8bfd604f4a401b4fe3066d8b
- SSDEEP 1536:bjg5Oy9vhALGA1TWpdu8Mjp0bE/aam9R/Cdr8okqudPMIMhMCEHu:bjg5Oy2NTYdutjpP/aFDKdhk3pIX
- TLSH T13EA35B95AFF15892CFF31A3B074A962CFD0AD3504FAD81A82C46D77446CC3C6D924AB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://crutop.ru/index.php
-
http://mazafaka.ru/index.php
-
http://color-bank.ru/index.php
-
http://asechka.ru/index.php
-
http://trojan.ru/index.php
-
http://fuck.ru/index.php
-
http://goldensand.ru/index.php
-
http://filesearch.ru/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://lovingod.host.sk/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://mazafaka.ru/index.htm
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
-
http://fethard.biz/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lfqgjh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdlcehhn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Flgaodbm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbbnim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jlclnhho.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jcoapami.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kleajegi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmomga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hdgfmk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kieaqe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eplnijdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qcobjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gfhehlhe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dbmfje32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fofiff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jhkbnbhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nbljaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pcdjic32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Maealn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejjelnfl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejchbmna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ddjmkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jeidan32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lomqmoob.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcjlld32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbigapjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jblmpl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpniaool.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dabhmo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejmild32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Leenanik.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jpooimdc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nhjbjp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmafjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Banabi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Idfaolpb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmbaggce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oaliidon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ebgpkj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fomfpg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhhnipbe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjpbkc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgoboake.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Podcnh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmqdmd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fieacc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iocliecb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hlblmd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghpehjph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hnagkp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pacfdila.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dbgnobpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kqphpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lqfnqjpi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qmepkb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Chiipg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cmdmki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hdfobe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eiobmjkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Clgbfe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Domdcpib.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mokmnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bpcnceab.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnjkbi32.exe - Executes dropped EXE 64 IoCs
pid Process 5972 Adbiojfo.exe 4304 Acicefid.exe 5292 Anogbohj.exe 6036 Agglld32.exe 4336 Aekleind.exe 3332 Amfqikko.exe 5916 Bnfmcn32.exe 124 Badipiae.exe 1280 Bnhjinpo.exe 4436 Bfcompnj.exe 2424 Bchogd32.exe 2212 Bnmcdm32.exe 5496 Bcjlld32.exe 1308 Bjddinbn.exe 1824 Chhdbb32.exe 4648 Cmdmki32.exe 4460 Chjaha32.exe 1804 Cabfagee.exe 5504 Chmnnamb.exe 4568 Cmiffhkj.exe 2716 Ceckleii.exe 2320 Cfdhdn32.exe 2644 Dajlafon.exe 3480 Dmpmfg32.exe 5464 Dhfacp32.exe 696 Dmcilgco.exe 928 Dhhnipbe.exe 4676 Dkgjekai.exe 2960 Dkifkkpf.exe 1500 Dacohegc.exe 5396 Ddakdqff.exe 3508 Eogoaifl.exe 3860 Ehocjo32.exe 4700 Eoilfidj.exe 3684 Ehappnjj.exe 4232 Ekpmljin.exe 4496 Eeeaibid.exe 1036 Ekbiaigk.exe 4192 Edknjonl.exe 2260 Eopbghnb.exe 2200 Eejjdb32.exe 2072 Fkgbli32.exe 1412 Fdpgen32.exe 1872 Fnhlndqg.exe 4944 Fkllghoq.exe 2308 Fddqpn32.exe 5692 Fojenfeg.exe 2976 Fdfmfmdo.exe 3164 Fajnoabh.exe 4828 Gnaodbhl.exe 5312 Ghgbakhb.exe 1772 Gaogja32.exe 2864 Gochceml.exe 3040 Gdppllld.exe 612 Gkjhif32.exe 6076 Ggqingie.exe 1428 Gnkajapa.exe 4548 Ghpehjph.exe 5616 Hojndd32.exe 1320 Hdgfmk32.exe 2220 Hbkgfode.exe 4408 Hggonfbm.exe 400 Hnagkp32.exe 3640 Hfioln32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Dnjdigpf.exe Dklhmlac.exe File created C:\Windows\SysWOW64\Glpblg32.dll Hlblmd32.exe File opened for modification C:\Windows\SysWOW64\Jhficc32.exe Jehmgg32.exe File created C:\Windows\SysWOW64\Nojfamdo.dll Dkifkkpf.exe File created C:\Windows\SysWOW64\Kkbhkj32.dll Aflabj32.exe File opened for modification C:\Windows\SysWOW64\Ijadljdg.exe Iddlccfp.exe File opened for modification C:\Windows\SysWOW64\Gpcffalc.exe Gmdjjemp.exe File created C:\Windows\SysWOW64\Pggcdm32.dll Kknfmdko.exe File created C:\Windows\SysWOW64\Hjpmabce.dll Nabfcegi.exe File created C:\Windows\SysWOW64\Gejoib32.exe Gnnjgh32.exe File created C:\Windows\SysWOW64\Ofimck32.dll Bjddinbn.exe File created C:\Windows\SysWOW64\Okacel32.dll Ngombd32.exe File created C:\Windows\SysWOW64\Gageoman.dll Gibhihko.exe File opened for modification C:\Windows\SysWOW64\Ahacndjo.exe Aagkaj32.exe File created C:\Windows\SysWOW64\Fkhafjhn.dll Gkofpf32.exe File created C:\Windows\SysWOW64\Ciolccoc.dll Bfqkmj32.exe File created C:\Windows\SysWOW64\Cipppc32.exe Cgndikgd.exe File opened for modification C:\Windows\SysWOW64\Iloimopp.exe Iknmfg32.exe File created C:\Windows\SysWOW64\Kdhpccdg.dll Jebfgl32.exe File created C:\Windows\SysWOW64\Jinjgohg.dll Bgimepmd.exe File created C:\Windows\SysWOW64\Fdfmfmdo.exe Fojenfeg.exe File created C:\Windows\SysWOW64\Mbedag32.exe Mlkldmjf.exe File created C:\Windows\SysWOW64\Pllggbje.exe Peaokh32.exe File created C:\Windows\SysWOW64\Fkcimclb.dll Jjeflc32.exe File created C:\Windows\SysWOW64\Boplmekj.dll Gnnjgh32.exe File opened for modification C:\Windows\SysWOW64\Jiiiml32.exe Jcoapami.exe File opened for modification C:\Windows\SysWOW64\Foocegea.exe Fiekhm32.exe File created C:\Windows\SysWOW64\Fmapgp32.dll Geenclkn.exe File opened for modification C:\Windows\SysWOW64\Qgkeep32.exe Qqamieno.exe File opened for modification C:\Windows\SysWOW64\Ikkppgld.exe Ipflcnln.exe File opened for modification C:\Windows\SysWOW64\Kafcmglb.exe Jpegeo32.exe File created C:\Windows\SysWOW64\Hiaqbf32.dll Jjhjli32.exe File created C:\Windows\SysWOW64\Gbofmmmj.exe Gmbmefob.exe File created C:\Windows\SysWOW64\Ljmfdp32.exe Lcbngeqo.exe File created C:\Windows\SysWOW64\Nfenmdkp.dll Nmbaggce.exe File created C:\Windows\SysWOW64\Chbcphph.exe Bnmobopb.exe File created C:\Windows\SysWOW64\Kleajegi.exe Kflink32.exe File opened for modification C:\Windows\SysWOW64\Ljqhdhpk.exe Lgblhmag.exe File created C:\Windows\SysWOW64\Bmaoao32.dll Mogccnfg.exe File opened for modification C:\Windows\SysWOW64\Cabfagee.exe Chjaha32.exe File opened for modification C:\Windows\SysWOW64\Joamlacj.exe Jigdoglm.exe File opened for modification C:\Windows\SysWOW64\Pjnbfmom.exe Pcdjic32.exe File created C:\Windows\SysWOW64\Phcogice.exe Pgaboa32.exe File created C:\Windows\SysWOW64\Gffhbljh.exe Gplpfb32.exe File opened for modification C:\Windows\SysWOW64\Mlohjpoi.exe Maicmgoc.exe File created C:\Windows\SysWOW64\Foocegea.exe Fiekhm32.exe File opened for modification C:\Windows\SysWOW64\Iifmfh32.exe Hnphio32.exe File opened for modification C:\Windows\SysWOW64\Qcobjk32.exe Qhinmb32.exe File opened for modification C:\Windows\SysWOW64\Djnfppqi.exe Dbgnobpg.exe File opened for modification C:\Windows\SysWOW64\Dpknhfoq.exe Djnfppqi.exe File created C:\Windows\SysWOW64\Fihecici.exe Fclmkb32.exe File created C:\Windows\SysWOW64\Hckgenae.dll Kmfhelke.exe File created C:\Windows\SysWOW64\Emhngp32.dll Igmqpbab.exe File created C:\Windows\SysWOW64\Qqhegnhh.dll Kgkfhngo.exe File created C:\Windows\SysWOW64\Cofplf32.dll Dqipeboj.exe File opened for modification C:\Windows\SysWOW64\Eogoaifl.exe Ddakdqff.exe File created C:\Windows\SysWOW64\Dmenne32.dll Npedfjfo.exe File created C:\Windows\SysWOW64\Pphjbgfj.exe Pjnbfmom.exe File created C:\Windows\SysWOW64\Bpbnelgn.dll Elkbcf32.exe File created C:\Windows\SysWOW64\Fajogllp.dll Lqndahiq.exe File opened for modification C:\Windows\SysWOW64\Bnfiapfj.exe Bldljh32.exe File created C:\Windows\SysWOW64\Ankfplap.dll Gikdep32.exe File created C:\Windows\SysWOW64\Kpbjfeil.dll Jcoapami.exe File created C:\Windows\SysWOW64\Mlaahojd.dll Mimphakb.exe - Program crash 1 IoCs
pid pid_target Process procid_target 13860 13840 Process not Found 1298 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Akniofoa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ielmki32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kpdbhn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ehaieh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qmepkb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhphfppl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpnmka32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgigfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Omnqcfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bpodhf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fqpomo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Henajkcc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chhdbb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhpijldj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Okjnhpee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aohpek32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ingpgcmj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hoobnf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Imkbglei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekbiaigk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jqfejl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hhdcfe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dohkhq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Joekkl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Poodicio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjeflc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mepfbflb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjodff32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aflabj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cilmpmki.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihdaoajd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dckdddcd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojpdgjid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Moiphnde.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hbkgfode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Niipdpae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cpeobn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cofemg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmakgj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjoibadl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fechhcal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmafjp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhfmmp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Idfaolpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qaoofaoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjgneg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oanodnip.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pnifoaba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jhficc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kieaqe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Effffd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbgehd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddfikaeq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahpdnaci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flgaodbm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nfhbpghl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pdqelh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Anogbohj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knfliefc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lkjlciem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jljbogaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Piphaf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iknmfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bopefnnf.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjppfp32.dll" Ekbiaigk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ccnnmmbp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Empococc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Podcnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ddjmkg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jikfbkbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mohipehf.dll" Pcdjic32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qaoofaoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dkokma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkqokn32.dll" Fnipliip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hfaaddlo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkkheak.dll" Mjeaph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gganjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qglplfpi.dll" Cihcen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcgmmogb.dll" Ejchbmna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lgblhmag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Njjdae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bdagidhi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hajkjkdb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cipppc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hddbmedc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Njdeklca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhpkja32.dll" Flfjdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lglekg32.dll" Joekkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkkbpc32.dll" Cpihmmdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pllggbje.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Boflfiai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jeidan32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lfpcijlg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mjgneg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfhkbdoe.dll" Njjdae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjjfnk32.dll" Ppopcf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aihaifam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocpdpf32.dll" Dbgnobpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epoqal32.dll" Gffhbljh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bklfqd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmdcnq32.dll" Chiipg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfnpdfgc.dll" Hfaaddlo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gckoleae.dll" Bnfmcn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dmcilgco.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gkjhif32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Naejcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnmnpe32.dll" Qoecol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ahgjnpna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qckcoi32.dll" Bdpanj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pnkbdqpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hkpgooim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afdkme32.dll" Mniafbfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dndnjllg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jcanfakf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efgofpbf.dll" Npbcollj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Loqejjad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofpfmaai.dll" Lnjnjn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Phodlm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Plmmbkdf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bncllqhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Chbcphph.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gbqlhfgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gbqlhfgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kikgkn32.dll" Hdfobe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Depglkhi.dll" Lljked32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbjpohpp.dll" Pnifoaba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqqjfe32.dll" Ielmki32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jhdlncnl.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5976 wrote to memory of 5972 5976 jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe 89 PID 5972 wrote to memory of 4304 5972 Adbiojfo.exe 90 PID 4304 wrote to memory of 5292 4304 Acicefid.exe 91 PID 5292 wrote to memory of 6036 5292 Anogbohj.exe 92 PID 6036 wrote to memory of 4336 6036 Agglld32.exe 93 PID 4336 wrote to memory of 3332 4336 Aekleind.exe 94 PID 3332 wrote to memory of 5916 3332 Amfqikko.exe 95 PID 5916 wrote to memory of 124 5916 Bnfmcn32.exe 96 PID 124 wrote to memory of 1280 124 Badipiae.exe 97 PID 1280 wrote to memory of 4436 1280 Bnhjinpo.exe 98 PID 4436 wrote to memory of 2424 4436 Bfcompnj.exe 99 PID 2424 wrote to memory of 2212 2424 Bchogd32.exe 100 PID 2212 wrote to memory of 5496 2212 Bnmcdm32.exe 101 PID 5496 wrote to memory of 1308 5496 Bcjlld32.exe 102 PID 1308 wrote to memory of 1824 1308 Bjddinbn.exe 103 PID 1824 wrote to memory of 4648 1824 Chhdbb32.exe 104 PID 4648 wrote to memory of 4460 4648 Cmdmki32.exe 105 PID 4460 wrote to memory of 1804 4460 Chjaha32.exe 106 PID 1804 wrote to memory of 5504 1804 Cabfagee.exe 107 PID 5504 wrote to memory of 4568 5504 Chmnnamb.exe 108 PID 4568 wrote to memory of 2716 4568 Cmiffhkj.exe 109 PID 2716 wrote to memory of 2320 2716 Ceckleii.exe 110 PID 2320 wrote to memory of 2644 2320 Cfdhdn32.exe 111 PID 2644 wrote to memory of 3480 2644 Dajlafon.exe 112 PID 3480 wrote to memory of 5464 3480 Dmpmfg32.exe 113 PID 5464 wrote to memory of 696 5464 Dhfacp32.exe 114 PID 696 wrote to memory of 928 696 Dmcilgco.exe 115 PID 928 wrote to memory of 4676 928 Dhhnipbe.exe 116 PID 4676 wrote to memory of 2960 4676 Dkgjekai.exe 117 PID 2960 wrote to memory of 1500 2960 Dkifkkpf.exe 118 PID 1500 wrote to memory of 5396 1500 Dacohegc.exe 119 PID 5396 wrote to memory of 3508 5396 Ddakdqff.exe 120 PID 3508 wrote to memory of 3860 3508 Eogoaifl.exe 121 PID 3860 wrote to memory of 4700 3860 Ehocjo32.exe 122 PID 4700 wrote to memory of 3684 4700 Eoilfidj.exe 123 PID 3684 wrote to memory of 4232 3684 Ehappnjj.exe 124 PID 4232 wrote to memory of 4496 4232 Ekpmljin.exe 125 PID 4496 wrote to memory of 1036 4496 Eeeaibid.exe 126 PID 1036 wrote to memory of 4192 1036 Ekbiaigk.exe 127 PID 4192 wrote to memory of 2260 4192 Edknjonl.exe 128 PID 2260 wrote to memory of 2200 2260 Eopbghnb.exe 129 PID 2200 wrote to memory of 2072 2200 Eejjdb32.exe 130 PID 2072 wrote to memory of 1412 2072 Fkgbli32.exe 131 PID 1412 wrote to memory of 1872 1412 Fdpgen32.exe 132 PID 1872 wrote to memory of 4944 1872 Fnhlndqg.exe 133 PID 4944 wrote to memory of 2308 4944 Fkllghoq.exe 134 PID 2308 wrote to memory of 5692 2308 Fddqpn32.exe 135 PID 5692 wrote to memory of 2976 5692 Fojenfeg.exe 136 PID 2976 wrote to memory of 3164 2976 Fdfmfmdo.exe 137 PID 3164 wrote to memory of 4828 3164 Fajnoabh.exe 138 PID 4828 wrote to memory of 5312 4828 Gnaodbhl.exe 139 PID 5312 wrote to memory of 1772 5312 Ghgbakhb.exe 140 PID 1772 wrote to memory of 2864 1772 Gaogja32.exe 141 PID 2864 wrote to memory of 3040 2864 Gochceml.exe 142 PID 3040 wrote to memory of 612 3040 Gdppllld.exe 143 PID 612 wrote to memory of 6076 612 Gkjhif32.exe 144 PID 6076 wrote to memory of 1428 6076 Ggqingie.exe 145 PID 1428 wrote to memory of 4548 1428 Gnkajapa.exe 146 PID 4548 wrote to memory of 5616 4548 Ghpehjph.exe 147 PID 5616 wrote to memory of 1320 5616 Hojndd32.exe 148 PID 1320 wrote to memory of 2220 1320 Hdgfmk32.exe 149 PID 2220 wrote to memory of 4408 2220 Hbkgfode.exe 150 PID 4408 wrote to memory of 400 4408 Hggonfbm.exe 151 PID 400 wrote to memory of 3640 400 Hnagkp32.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\SysWOW64\Adbiojfo.exeC:\Windows\system32\Adbiojfo.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\Acicefid.exeC:\Windows\system32\Acicefid.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\Anogbohj.exeC:\Windows\system32\Anogbohj.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Windows\SysWOW64\Agglld32.exeC:\Windows\system32\Agglld32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\Aekleind.exeC:\Windows\system32\Aekleind.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\Amfqikko.exeC:\Windows\system32\Amfqikko.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\Bnfmcn32.exeC:\Windows\system32\Bnfmcn32.exe8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Windows\SysWOW64\Badipiae.exeC:\Windows\system32\Badipiae.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Windows\SysWOW64\Bnhjinpo.exeC:\Windows\system32\Bnhjinpo.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\Bfcompnj.exeC:\Windows\system32\Bfcompnj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\Bchogd32.exeC:\Windows\system32\Bchogd32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\Bnmcdm32.exeC:\Windows\system32\Bnmcdm32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\Bcjlld32.exeC:\Windows\system32\Bcjlld32.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Windows\SysWOW64\Bjddinbn.exeC:\Windows\system32\Bjddinbn.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\Chhdbb32.exeC:\Windows\system32\Chhdbb32.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\Cmdmki32.exeC:\Windows\system32\Cmdmki32.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\Chjaha32.exeC:\Windows\system32\Chjaha32.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\Cabfagee.exeC:\Windows\system32\Cabfagee.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\Chmnnamb.exeC:\Windows\system32\Chmnnamb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Windows\SysWOW64\Cmiffhkj.exeC:\Windows\system32\Cmiffhkj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\Ceckleii.exeC:\Windows\system32\Ceckleii.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\Cfdhdn32.exeC:\Windows\system32\Cfdhdn32.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\Dajlafon.exeC:\Windows\system32\Dajlafon.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\Dmpmfg32.exeC:\Windows\system32\Dmpmfg32.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\Dhfacp32.exeC:\Windows\system32\Dhfacp32.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\Dmcilgco.exeC:\Windows\system32\Dmcilgco.exe27⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\Dhhnipbe.exeC:\Windows\system32\Dhhnipbe.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\Dkgjekai.exeC:\Windows\system32\Dkgjekai.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\Dkifkkpf.exeC:\Windows\system32\Dkifkkpf.exe30⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\Dacohegc.exeC:\Windows\system32\Dacohegc.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\Ddakdqff.exeC:\Windows\system32\Ddakdqff.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Windows\SysWOW64\Eogoaifl.exeC:\Windows\system32\Eogoaifl.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\Ehocjo32.exeC:\Windows\system32\Ehocjo32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\Eoilfidj.exeC:\Windows\system32\Eoilfidj.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\Ehappnjj.exeC:\Windows\system32\Ehappnjj.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\Ekpmljin.exeC:\Windows\system32\Ekpmljin.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\Eeeaibid.exeC:\Windows\system32\Eeeaibid.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\Ekbiaigk.exeC:\Windows\system32\Ekbiaigk.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\Edknjonl.exeC:\Windows\system32\Edknjonl.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\Eopbghnb.exeC:\Windows\system32\Eopbghnb.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\Eejjdb32.exeC:\Windows\system32\Eejjdb32.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\Fkgbli32.exeC:\Windows\system32\Fkgbli32.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\Fdpgen32.exeC:\Windows\system32\Fdpgen32.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\Fnhlndqg.exeC:\Windows\system32\Fnhlndqg.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\Fkllghoq.exeC:\Windows\system32\Fkllghoq.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\Fddqpn32.exeC:\Windows\system32\Fddqpn32.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\Fojenfeg.exeC:\Windows\system32\Fojenfeg.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Windows\SysWOW64\Fdfmfmdo.exeC:\Windows\system32\Fdfmfmdo.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\Fajnoabh.exeC:\Windows\system32\Fajnoabh.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\Gnaodbhl.exeC:\Windows\system32\Gnaodbhl.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\Ghgbakhb.exeC:\Windows\system32\Ghgbakhb.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\Gaogja32.exeC:\Windows\system32\Gaogja32.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\Gochceml.exeC:\Windows\system32\Gochceml.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\Gdppllld.exeC:\Windows\system32\Gdppllld.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\Gkjhif32.exeC:\Windows\system32\Gkjhif32.exe56⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\Ggqingie.exeC:\Windows\system32\Ggqingie.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\Gnkajapa.exeC:\Windows\system32\Gnkajapa.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\Ghpehjph.exeC:\Windows\system32\Ghpehjph.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\Hojndd32.exeC:\Windows\system32\Hojndd32.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\SysWOW64\Hdgfmk32.exeC:\Windows\system32\Hdgfmk32.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\Hbkgfode.exeC:\Windows\system32\Hbkgfode.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\Hggonfbm.exeC:\Windows\system32\Hggonfbm.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\Hnagkp32.exeC:\Windows\system32\Hnagkp32.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\Hfioln32.exeC:\Windows\system32\Hfioln32.exe65⤵
- Executes dropped EXE
PID:3640 -
C:\Windows\SysWOW64\Hkehdd32.exeC:\Windows\system32\Hkehdd32.exe66⤵PID:3624
-
C:\Windows\SysWOW64\Hfklamii.exeC:\Windows\system32\Hfklamii.exe67⤵PID:784
-
C:\Windows\SysWOW64\Hkhdjdgq.exeC:\Windows\system32\Hkhdjdgq.exe68⤵PID:4900
-
C:\Windows\SysWOW64\Ihlechfj.exeC:\Windows\system32\Ihlechfj.exe69⤵PID:5984
-
C:\Windows\SysWOW64\Ininloda.exeC:\Windows\system32\Ininloda.exe70⤵PID:2408
-
C:\Windows\SysWOW64\Ifpemmdd.exeC:\Windows\system32\Ifpemmdd.exe71⤵PID:4560
-
C:\Windows\SysWOW64\Ikmnec32.exeC:\Windows\system32\Ikmnec32.exe72⤵PID:5232
-
C:\Windows\SysWOW64\Ifbbbl32.exeC:\Windows\system32\Ifbbbl32.exe73⤵PID:792
-
C:\Windows\SysWOW64\Iiqooh32.exeC:\Windows\system32\Iiqooh32.exe74⤵PID:3032
-
C:\Windows\SysWOW64\Ibicgmhe.exeC:\Windows\system32\Ibicgmhe.exe75⤵PID:5732
-
C:\Windows\SysWOW64\Idgocigi.exeC:\Windows\system32\Idgocigi.exe76⤵PID:1488
-
C:\Windows\SysWOW64\Inpclnnj.exeC:\Windows\system32\Inpclnnj.exe77⤵PID:1864
-
C:\Windows\SysWOW64\Iejlih32.exeC:\Windows\system32\Iejlih32.exe78⤵PID:4524
-
C:\Windows\SysWOW64\Ighhed32.exeC:\Windows\system32\Ighhed32.exe79⤵PID:3132
-
C:\Windows\SysWOW64\Ibnlbm32.exeC:\Windows\system32\Ibnlbm32.exe80⤵PID:5260
-
C:\Windows\SysWOW64\Jigdoglm.exeC:\Windows\system32\Jigdoglm.exe81⤵
- Drops file in System32 directory
PID:6040 -
C:\Windows\SysWOW64\Joamlacj.exeC:\Windows\system32\Joamlacj.exe82⤵PID:5904
-
C:\Windows\SysWOW64\Jfkehk32.exeC:\Windows\system32\Jfkehk32.exe83⤵PID:1416
-
C:\Windows\SysWOW64\Jbbfnlpk.exeC:\Windows\system32\Jbbfnlpk.exe84⤵PID:1452
-
C:\Windows\SysWOW64\Jkkjfa32.exeC:\Windows\system32\Jkkjfa32.exe85⤵PID:5812
-
C:\Windows\SysWOW64\Jnifbmfo.exeC:\Windows\system32\Jnifbmfo.exe86⤵PID:1260
-
C:\Windows\SysWOW64\Jgakkb32.exeC:\Windows\system32\Jgakkb32.exe87⤵PID:3308
-
C:\Windows\SysWOW64\Jeekeg32.exeC:\Windows\system32\Jeekeg32.exe88⤵PID:1656
-
C:\Windows\SysWOW64\Jlocaabf.exeC:\Windows\system32\Jlocaabf.exe89⤵PID:1776
-
C:\Windows\SysWOW64\Kfehoj32.exeC:\Windows\system32\Kfehoj32.exe90⤵PID:4384
-
C:\Windows\SysWOW64\Kgfdfbhj.exeC:\Windows\system32\Kgfdfbhj.exe91⤵PID:4488
-
C:\Windows\SysWOW64\Knpmcl32.exeC:\Windows\system32\Knpmcl32.exe92⤵PID:5084
-
C:\Windows\SysWOW64\Kieaqe32.exeC:\Windows\system32\Kieaqe32.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:1844 -
C:\Windows\SysWOW64\Kppimogj.exeC:\Windows\system32\Kppimogj.exe94⤵PID:1212
-
C:\Windows\SysWOW64\Kfiajinf.exeC:\Windows\system32\Kfiajinf.exe95⤵PID:2376
-
C:\Windows\SysWOW64\Klfjbpmn.exeC:\Windows\system32\Klfjbpmn.exe96⤵PID:4528
-
C:\Windows\SysWOW64\Kbpboj32.exeC:\Windows\system32\Kbpboj32.exe97⤵PID:4084
-
C:\Windows\SysWOW64\Kijjldkh.exeC:\Windows\system32\Kijjldkh.exe98⤵PID:3324
-
C:\Windows\SysWOW64\Kpdbhn32.exeC:\Windows\system32\Kpdbhn32.exe99⤵
- System Location Discovery: System Language Discovery
PID:4520 -
C:\Windows\SysWOW64\Kfnkeh32.exeC:\Windows\system32\Kfnkeh32.exe100⤵PID:4896
-
C:\Windows\SysWOW64\Khpgmqpp.exeC:\Windows\system32\Khpgmqpp.exe101⤵PID:1568
-
C:\Windows\SysWOW64\Knipik32.exeC:\Windows\system32\Knipik32.exe102⤵PID:3064
-
C:\Windows\SysWOW64\Lfqgjh32.exeC:\Windows\system32\Lfqgjh32.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4780 -
C:\Windows\SysWOW64\Lhbdbpnm.exeC:\Windows\system32\Lhbdbpnm.exe104⤵PID:3968
-
C:\Windows\SysWOW64\Lbghpinc.exeC:\Windows\system32\Lbghpinc.exe105⤵PID:3220
-
C:\Windows\SysWOW64\Lefdld32.exeC:\Windows\system32\Lefdld32.exe106⤵PID:4664
-
C:\Windows\SysWOW64\Llpmhodc.exeC:\Windows\system32\Llpmhodc.exe107⤵PID:4160
-
C:\Windows\SysWOW64\Lbjeei32.exeC:\Windows\system32\Lbjeei32.exe108⤵PID:1088
-
C:\Windows\SysWOW64\Lhfmmp32.exeC:\Windows\system32\Lhfmmp32.exe109⤵
- System Location Discovery: System Language Discovery
PID:5068 -
C:\Windows\SysWOW64\Loqejjad.exeC:\Windows\system32\Loqejjad.exe110⤵
- Modifies registry class
PID:2672 -
C:\Windows\SysWOW64\Lejngd32.exeC:\Windows\system32\Lejngd32.exe111⤵PID:1760
-
C:\Windows\SysWOW64\Lppbdmig.exeC:\Windows\system32\Lppbdmig.exe112⤵PID:1524
-
C:\Windows\SysWOW64\Lfjjqg32.exeC:\Windows\system32\Lfjjqg32.exe113⤵PID:2216
-
C:\Windows\SysWOW64\Llgcin32.exeC:\Windows\system32\Llgcin32.exe114⤵PID:2040
-
C:\Windows\SysWOW64\Mbqkfhfh.exeC:\Windows\system32\Mbqkfhfh.exe115⤵PID:3736
-
C:\Windows\SysWOW64\Meogbcel.exeC:\Windows\system32\Meogbcel.exe116⤵PID:5612
-
C:\Windows\SysWOW64\Moglkikl.exeC:\Windows\system32\Moglkikl.exe117⤵PID:1068
-
C:\Windows\SysWOW64\Mimphakb.exeC:\Windows\system32\Mimphakb.exe118⤵
- Drops file in System32 directory
PID:6004 -
C:\Windows\SysWOW64\Mlkldmjf.exeC:\Windows\system32\Mlkldmjf.exe119⤵
- Drops file in System32 directory
PID:1808 -
C:\Windows\SysWOW64\Mbedag32.exeC:\Windows\system32\Mbedag32.exe120⤵PID:4924
-
C:\Windows\SysWOW64\Mhbmin32.exeC:\Windows\system32\Mhbmin32.exe121⤵PID:2020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-