Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 16:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe
- Size 204KB
- Sample261006-vhxe1abs21
- SHA256 a38f4a599cc1c4c3279da387decffd4c2b98a1de0afdc1aca33166d523c9e344
- MD5 471359712b54b6aecde24e84fe8d2b73
- SHA1 ff3b1e2b587bdf29463aafdbcad2c3e56bf880a0
- SHA512 98d678b05427300e2843310b5dd5e2705d3ee9b256df039c1e1547a66ad3177d6e17fb3e1b567196feb4f500fef70a67c4f592f04e5e024dfde0022bbee73787
- SSDEEP 6144:zMtIwzwR2vCcIuTHsHZ2e4yXD6NTHsHZ:zMtIJR2acLIIbWoI
- TLSH T1E51415C111240D8DD31EB9F535ABF663ADF38E7702126E786E938102EE6B2E74CA1355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://crutop.ru/index.php
-
http://mazafaka.ru/index.php
-
http://color-bank.ru/index.php
-
http://asechka.ru/index.php
-
http://trojan.ru/index.php
-
http://fuck.ru/index.php
-
http://goldensand.ru/index.php
-
http://filesearch.ru/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://lovingod.host.sk/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://mazafaka.ru/index.htm
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
-
http://fethard.biz/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okpkaqmp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pibdff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pcjioknl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emfebjgb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mqafbaap.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cjejdglp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkpoha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hhfenc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dblgja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fjhaml32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmbmefob.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lnmkpm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bgkijp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Miomnaip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aadokg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bddcocff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Emldhb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lgpocm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ogeklh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akmbepke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lmbhqj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jqbbicel.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bncllqhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kfgpblda.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojfcmc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Agiagn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gpmgph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gbmigm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kdigkjpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bncllqhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qfkqcb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jkejalge.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Domdcpib.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glgckl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Coldbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dnmaog32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gkbkna32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knofif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dmcabd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Llabchoe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aadokg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cjecjahd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ffobbmpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mminaikp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpdlajfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hiomppkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dkcnnk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gmcdolbn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ojbamj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phombg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bgbdml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nliakd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oajcnkdl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Objphn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pojccmii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gdaomobj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icdhojka.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kdfjej32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ackiqpce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mijlhl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmliem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Palbpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cbpacmbc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfmijkhj.exe - Executes dropped EXE 64 IoCs
pid Process 4084 Ikokkc32.exe 6004 Ikcdfbmc.exe 3124 Joamlacj.exe 3576 Jijaef32.exe 5088 Jfnbnk32.exe 3420 Jgonfcnb.exe 4808 Jbgoik32.exe 3656 Jlocaabf.exe 980 Jbilnkjc.exe 4232 Kblidkhp.exe 1872 Knbiil32.exe 3812 Knefnkla.exe 2456 Keonke32.exe 5520 Kimgad32.exe 3092 Knipik32.exe 2864 Lechfeoi.exe 2548 Lfcdph32.exe 5180 Lpkiim32.exe 5564 Lpneom32.exe 5636 Lfgnkgbf.exe 2496 Lbnnphhk.exe 1116 Lihfmb32.exe 3060 Mikcbb32.exe 2804 Mpdkol32.exe 2904 Mimphakb.exe 1480 Miomnaip.exe 4352 Mpiejkql.exe 5148 Mfcmge32.exe 2504 Mhdjonng.exe 1268 Moobkh32.exe 1796 Mehjhbma.exe 6076 Nemcca32.exe 5360 Nbadmege.exe 2612 Nhnlelfm.exe 1568 Ngombd32.exe 2500 Nhpijldj.exe 2380 Ncfmhecp.exe 1064 Nipedokm.exe 5744 Ochjmd32.exe 712 Ohebek32.exe 940 Ocjgcd32.exe 296 Ohgokknb.exe 1084 Ocmchdmh.exe 1448 Oiglen32.exe 5288 Ocopncke.exe 3264 Ohlifj32.exe 3236 Ocamcc32.exe 5364 Ppemmg32.exe 4748 Pgoejapi.exe 3320 Pokjnd32.exe 5036 Phcogice.exe 2772 Pgdodq32.exe 5396 Plagmh32.exe 4820 Pjehflie.exe 5536 Poaqocgl.exe 908 Pflikm32.exe 4508 Qgkeep32.exe 1416 Qqcjnell.exe 5724 Qgmbkp32.exe 2932 Acdbpq32.exe 3800 Ammgifpn.exe 2228 Agbkfood.exe 2376 Amodnenk.exe 4412 Afghgkdl.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Ggmock32.exe Glgjfb32.exe File created C:\Windows\SysWOW64\Oflkln32.dll Akipdg32.exe File opened for modification C:\Windows\SysWOW64\Eodjdocj.exe Efkfkilj.exe File created C:\Windows\SysWOW64\Olpjfn32.dll Fpbfem32.exe File created C:\Windows\SysWOW64\Ocjgcd32.exe Ohebek32.exe File created C:\Windows\SysWOW64\Pibdff32.exe Pkqdhnom.exe File created C:\Windows\SysWOW64\Alnfiifd.exe Anmfkane.exe File created C:\Windows\SysWOW64\Fohkkdoe.dll Igmqpbab.exe File created C:\Windows\SysWOW64\Mhafak32.dll Imkbglei.exe File created C:\Windows\SysWOW64\Mnhjgphd.dll Oafido32.exe File created C:\Windows\SysWOW64\Mpdkol32.exe Mikcbb32.exe File opened for modification C:\Windows\SysWOW64\Dibmfb32.exe Cmklaaek.exe File created C:\Windows\SysWOW64\Gmcdolbn.exe Ggilbb32.exe File created C:\Windows\SysWOW64\Mjhepnno.exe Mekmgg32.exe File created C:\Windows\SysWOW64\Pqghbd32.dll Hpiemj32.exe File created C:\Windows\SysWOW64\Idhdieal.dll Ogndki32.exe File created C:\Windows\SysWOW64\Ahmjce32.exe Aodejohd.exe File created C:\Windows\SysWOW64\Gpkdbfef.dll Acdbpq32.exe File opened for modification C:\Windows\SysWOW64\Bimkde32.exe Bgknlmgi.exe File created C:\Windows\SysWOW64\Mogpol32.dll Djcfee32.exe File created C:\Windows\SysWOW64\Mngepb32.exe Mijlhl32.exe File created C:\Windows\SysWOW64\Plkpmlfi.exe Paelpcgc.exe File opened for modification C:\Windows\SysWOW64\Feoomd32.exe Fpbfem32.exe File created C:\Windows\SysWOW64\Conkhh32.dll Cggifn32.exe File opened for modification C:\Windows\SysWOW64\Mhdjonng.exe Mfcmge32.exe File created C:\Windows\SysWOW64\Ochjmd32.exe Nipedokm.exe File created C:\Windows\SysWOW64\Pjehflie.exe Plagmh32.exe File created C:\Windows\SysWOW64\Amodnenk.exe Agbkfood.exe File opened for modification C:\Windows\SysWOW64\Ihbdja32.exe Ibhlmgdj.exe File opened for modification C:\Windows\SysWOW64\Qifnaecf.exe Pcmeek32.exe File created C:\Windows\SysWOW64\Cooolhin.exe Ciefpn32.exe File opened for modification C:\Windows\SysWOW64\Ikickgnf.exe Ipcomo32.exe File created C:\Windows\SysWOW64\Ipmbcm32.exe Ikpjkf32.exe File created C:\Windows\SysWOW64\Dagcdnhn.dll Ldbjah32.exe File created C:\Windows\SysWOW64\Lcmcpl32.dll Ljobiofi.exe File created C:\Windows\SysWOW64\Clbhqcam.dll Fbbpgh32.exe File created C:\Windows\SysWOW64\Llmhkd32.exe Lgpocm32.exe File opened for modification C:\Windows\SysWOW64\Nadlnoaj.exe Nglhei32.exe File opened for modification C:\Windows\SysWOW64\Ogndki32.exe Nadlnoaj.exe File created C:\Windows\SysWOW64\Ikpgdhfi.dll Akblpo32.exe File opened for modification C:\Windows\SysWOW64\Knefnkla.exe Knbiil32.exe File created C:\Windows\SysWOW64\Oiglen32.exe Ocmchdmh.exe File opened for modification C:\Windows\SysWOW64\Djfckenm.exe Dannbogl.exe File opened for modification C:\Windows\SysWOW64\Edemdine.exe Emkeho32.exe File opened for modification C:\Windows\SysWOW64\Gdoiaf32.exe Gkgeipah.exe File created C:\Windows\SysWOW64\Apaagf32.dll Malgmm32.exe File created C:\Windows\SysWOW64\Hmkpdlhe.dll Nknolaob.exe File created C:\Windows\SysWOW64\Okpkaqmp.exe Oeccijoh.exe File opened for modification C:\Windows\SysWOW64\Gdmmlf32.exe Gmcdolbn.exe File created C:\Windows\SysWOW64\Jnabic32.dll Nbcjhobg.exe File created C:\Windows\SysWOW64\Hnbaba32.dll Cjecjahd.exe File created C:\Windows\SysWOW64\Epndddnk.exe Ecgcpc32.exe File opened for modification C:\Windows\SysWOW64\Pkigmiai.exe Oeloebcb.exe File created C:\Windows\SysWOW64\Dehcjghn.dll Cfmijkhj.exe File created C:\Windows\SysWOW64\Glpmkm32.exe Gbgibgpf.exe File created C:\Windows\SysWOW64\Hfodnd32.exe Hpdlajfe.exe File opened for modification C:\Windows\SysWOW64\Afghgkdl.exe Amodnenk.exe File created C:\Windows\SysWOW64\Liickdeg.dll Lgcjmjho.exe File created C:\Windows\SysWOW64\Aepkej32.dll Cjgpoq32.exe File created C:\Windows\SysWOW64\Hpiemj32.exe Hiomppkc.exe File created C:\Windows\SysWOW64\Fkamfl32.dll Lnendhol.exe File created C:\Windows\SysWOW64\Qjdpoacp.exe Qdjgbg32.exe File opened for modification C:\Windows\SysWOW64\Eoccii32.exe Ehikmohb.exe File created C:\Windows\SysWOW64\Egjbabja.dll Nhpijldj.exe - Program crash 1 IoCs
pid pid_target Process procid_target 12572 12440 WerFault.exe 679 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onmfcb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lqikfi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llmhkd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mqojlbcb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgkijp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbmfje32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Okgabpgg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jcmkehcg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mqfpma32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pdqelh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bnjkbi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nknolaob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ejlban32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmbmefob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hmpjfdcb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikpjkf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kiejfo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlfeeelm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Elpknehe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nabfcegi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhpfjh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ennqpkcm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Imkbglei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nfjofg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bqhlpbjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hblkddmn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbndoa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hmnmqdee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmenmgab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bimkde32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Objphn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdjbcnjo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikickgnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mekmgg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jmplbk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mikcbb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdmmlf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pkqdhnom.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klceeejl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Peokkbao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nbqmbo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pojccmii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knipik32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phgagb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjmkhkff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbofmmmj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iimjan32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keonke32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ignndo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aebhaede.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gljgkb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ipflcnln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chfepa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hgghdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibhlmgdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bnmobopb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jljbogaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebocpd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocamcc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgbdml32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oajcnkdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kgflmo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cglgck32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggilbb32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hkdjph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Giialc32.dll" Cffcilob.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hpiemj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cplhdn32.dll" Mmhggbgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofbmbgnj.dll" Nqmfnp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ahacndjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apjmealg.dll" Eainnn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hahcfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdlijc32.dll" Hpmpgfhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmcnkmhc.dll" Lbkkpb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nliakd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofkkpagl.dll" Kjccna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Feflikdo.dll" Alnfiifd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dopkkhlp.dll" Ipplmh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ajdjcc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fifhmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ohhnln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dnkkcmdb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jmplbk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Llmhkd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mqfpma32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nqmfnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omqghjnh.dll" Nbadmege.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pgoejapi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ibhlmgdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ipmbcm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lnmkpm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mmdefi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nakgck32.dll" Hifcqo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Opqopj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfgfmp32.dll" jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ocmchdmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Efopeeao.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lbkkpb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jgfcfajg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qfkqcb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cnaachha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hjjnkkjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jgcafl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lijoklol.dll" Ajpqhdkl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dcdnce32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jlfpnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idhdieal.dll" Ogndki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ineilini.dll" Qfkqcb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpbdjgcj.dll" Amnlfk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngaiilfq.dll" Bjodch32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fhofffjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Limdkpgg.dll" Jjopmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bjicnbba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgdjha32.dll" Boflfiai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qpahghbg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jlocaabf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mehjhbma.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Agiagn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnggoe32.dll" Kbiede32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pcmeek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hhfenc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmbdbcgk.dll" Knabne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aojljkkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fifhmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iloimopp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Icfnjcec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aobefj32.dll" Ncnook32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ogndki32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4936 wrote to memory of 4084 4936 jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe 88 PID 4084 wrote to memory of 6004 4084 Ikokkc32.exe 89 PID 6004 wrote to memory of 3124 6004 Ikcdfbmc.exe 90 PID 3124 wrote to memory of 3576 3124 Joamlacj.exe 91 PID 3576 wrote to memory of 5088 3576 Jijaef32.exe 92 PID 5088 wrote to memory of 3420 5088 Jfnbnk32.exe 93 PID 3420 wrote to memory of 4808 3420 Jgonfcnb.exe 94 PID 4808 wrote to memory of 3656 4808 Jbgoik32.exe 95 PID 3656 wrote to memory of 980 3656 Jlocaabf.exe 96 PID 980 wrote to memory of 4232 980 Jbilnkjc.exe 97 PID 4232 wrote to memory of 1872 4232 Kblidkhp.exe 98 PID 1872 wrote to memory of 3812 1872 Knbiil32.exe 99 PID 3812 wrote to memory of 2456 3812 Knefnkla.exe 100 PID 2456 wrote to memory of 5520 2456 Keonke32.exe 101 PID 5520 wrote to memory of 3092 5520 Kimgad32.exe 102 PID 3092 wrote to memory of 2864 3092 Knipik32.exe 103 PID 2864 wrote to memory of 2548 2864 Lechfeoi.exe 104 PID 2548 wrote to memory of 5180 2548 Lfcdph32.exe 105 PID 5180 wrote to memory of 5564 5180 Lpkiim32.exe 106 PID 5564 wrote to memory of 5636 5564 Lpneom32.exe 107 PID 5636 wrote to memory of 2496 5636 Lfgnkgbf.exe 108 PID 2496 wrote to memory of 1116 2496 Lbnnphhk.exe 109 PID 1116 wrote to memory of 3060 1116 Lihfmb32.exe 110 PID 3060 wrote to memory of 2804 3060 Mikcbb32.exe 111 PID 2804 wrote to memory of 2904 2804 Mpdkol32.exe 112 PID 2904 wrote to memory of 1480 2904 Mimphakb.exe 113 PID 1480 wrote to memory of 4352 1480 Miomnaip.exe 114 PID 4352 wrote to memory of 5148 4352 Mpiejkql.exe 115 PID 5148 wrote to memory of 2504 5148 Mfcmge32.exe 116 PID 2504 wrote to memory of 1268 2504 Mhdjonng.exe 117 PID 1268 wrote to memory of 1796 1268 Moobkh32.exe 118 PID 1796 wrote to memory of 6076 1796 Mehjhbma.exe 119 PID 6076 wrote to memory of 5360 6076 Nemcca32.exe 120 PID 5360 wrote to memory of 2612 5360 Nbadmege.exe 121 PID 2612 wrote to memory of 1568 2612 Nhnlelfm.exe 122 PID 1568 wrote to memory of 2500 1568 Ngombd32.exe 123 PID 2500 wrote to memory of 2380 2500 Nhpijldj.exe 124 PID 2380 wrote to memory of 1064 2380 Ncfmhecp.exe 125 PID 1064 wrote to memory of 5744 1064 Nipedokm.exe 126 PID 5744 wrote to memory of 712 5744 Ochjmd32.exe 127 PID 712 wrote to memory of 940 712 Ohebek32.exe 128 PID 940 wrote to memory of 296 940 Ocjgcd32.exe 129 PID 296 wrote to memory of 1084 296 Ohgokknb.exe 130 PID 1084 wrote to memory of 1448 1084 Ocmchdmh.exe 131 PID 1448 wrote to memory of 5288 1448 Oiglen32.exe 132 PID 5288 wrote to memory of 3264 5288 Ocopncke.exe 133 PID 3264 wrote to memory of 3236 3264 Ohlifj32.exe 134 PID 3236 wrote to memory of 5364 3236 Ocamcc32.exe 135 PID 5364 wrote to memory of 4748 5364 Ppemmg32.exe 136 PID 4748 wrote to memory of 3320 4748 Pgoejapi.exe 137 PID 3320 wrote to memory of 5036 3320 Pokjnd32.exe 138 PID 5036 wrote to memory of 2772 5036 Phcogice.exe 139 PID 2772 wrote to memory of 5396 2772 Pgdodq32.exe 140 PID 5396 wrote to memory of 4820 5396 Plagmh32.exe 141 PID 4820 wrote to memory of 5536 4820 Pjehflie.exe 142 PID 5536 wrote to memory of 908 5536 Poaqocgl.exe 143 PID 908 wrote to memory of 4508 908 Pflikm32.exe 144 PID 4508 wrote to memory of 1416 4508 Qgkeep32.exe 145 PID 1416 wrote to memory of 5724 1416 Qqcjnell.exe 146 PID 5724 wrote to memory of 2932 5724 Qgmbkp32.exe 147 PID 2932 wrote to memory of 3800 2932 Acdbpq32.exe 148 PID 3800 wrote to memory of 2228 3800 Ammgifpn.exe 149 PID 2228 wrote to memory of 2376 2228 Agbkfood.exe 150 PID 2376 wrote to memory of 4412 2376 Amodnenk.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Proxy.Win32.Qukart.gen.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\Ikokkc32.exeC:\Windows\system32\Ikokkc32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\Ikcdfbmc.exeC:\Windows\system32\Ikcdfbmc.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Windows\SysWOW64\Joamlacj.exeC:\Windows\system32\Joamlacj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\Jijaef32.exeC:\Windows\system32\Jijaef32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\Jfnbnk32.exeC:\Windows\system32\Jfnbnk32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\Jgonfcnb.exeC:\Windows\system32\Jgonfcnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\Jbgoik32.exeC:\Windows\system32\Jbgoik32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\Jlocaabf.exeC:\Windows\system32\Jlocaabf.exe9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\Jbilnkjc.exeC:\Windows\system32\Jbilnkjc.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\Kblidkhp.exeC:\Windows\system32\Kblidkhp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\Knbiil32.exeC:\Windows\system32\Knbiil32.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\Knefnkla.exeC:\Windows\system32\Knefnkla.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\Keonke32.exeC:\Windows\system32\Keonke32.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\Kimgad32.exeC:\Windows\system32\Kimgad32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Windows\SysWOW64\Knipik32.exeC:\Windows\system32\Knipik32.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\Lechfeoi.exeC:\Windows\system32\Lechfeoi.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\Lfcdph32.exeC:\Windows\system32\Lfcdph32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\Lpkiim32.exeC:\Windows\system32\Lpkiim32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Windows\SysWOW64\Lpneom32.exeC:\Windows\system32\Lpneom32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\Lfgnkgbf.exeC:\Windows\system32\Lfgnkgbf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Windows\SysWOW64\Lbnnphhk.exeC:\Windows\system32\Lbnnphhk.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\Lihfmb32.exeC:\Windows\system32\Lihfmb32.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\Mikcbb32.exeC:\Windows\system32\Mikcbb32.exe24⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\Mpdkol32.exeC:\Windows\system32\Mpdkol32.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\Mimphakb.exeC:\Windows\system32\Mimphakb.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\Miomnaip.exeC:\Windows\system32\Miomnaip.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\Mpiejkql.exeC:\Windows\system32\Mpiejkql.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\Mfcmge32.exeC:\Windows\system32\Mfcmge32.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Windows\SysWOW64\Mhdjonng.exeC:\Windows\system32\Mhdjonng.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\Moobkh32.exeC:\Windows\system32\Moobkh32.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\Mehjhbma.exeC:\Windows\system32\Mehjhbma.exe32⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\Nemcca32.exeC:\Windows\system32\Nemcca32.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\Nbadmege.exeC:\Windows\system32\Nbadmege.exe34⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Windows\SysWOW64\Nhnlelfm.exeC:\Windows\system32\Nhnlelfm.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\Ngombd32.exeC:\Windows\system32\Ngombd32.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\Nhpijldj.exeC:\Windows\system32\Nhpijldj.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\Ncfmhecp.exeC:\Windows\system32\Ncfmhecp.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\Nipedokm.exeC:\Windows\system32\Nipedokm.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\Ochjmd32.exeC:\Windows\system32\Ochjmd32.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\Ohebek32.exeC:\Windows\system32\Ohebek32.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\Ocjgcd32.exeC:\Windows\system32\Ocjgcd32.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\Ohgokknb.exeC:\Windows\system32\Ohgokknb.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\Ocmchdmh.exeC:\Windows\system32\Ocmchdmh.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\Oiglen32.exeC:\Windows\system32\Oiglen32.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\Ocopncke.exeC:\Windows\system32\Ocopncke.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Windows\SysWOW64\Ohlifj32.exeC:\Windows\system32\Ohlifj32.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\Ocamcc32.exeC:\Windows\system32\Ocamcc32.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\Ppemmg32.exeC:\Windows\system32\Ppemmg32.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Windows\SysWOW64\Pgoejapi.exeC:\Windows\system32\Pgoejapi.exe50⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\Pokjnd32.exeC:\Windows\system32\Pokjnd32.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\Phcogice.exeC:\Windows\system32\Phcogice.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\Pgdodq32.exeC:\Windows\system32\Pgdodq32.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\Plagmh32.exeC:\Windows\system32\Plagmh32.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Windows\SysWOW64\Pjehflie.exeC:\Windows\system32\Pjehflie.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\Poaqocgl.exeC:\Windows\system32\Poaqocgl.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\SysWOW64\Pflikm32.exeC:\Windows\system32\Pflikm32.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\Qgkeep32.exeC:\Windows\system32\Qgkeep32.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\Qqcjnell.exeC:\Windows\system32\Qqcjnell.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\Qgmbkp32.exeC:\Windows\system32\Qgmbkp32.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\Acdbpq32.exeC:\Windows\system32\Acdbpq32.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\Ammgifpn.exeC:\Windows\system32\Ammgifpn.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\Agbkfood.exeC:\Windows\system32\Agbkfood.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\Amodnenk.exeC:\Windows\system32\Amodnenk.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\Afghgkdl.exeC:\Windows\system32\Afghgkdl.exe65⤵
- Executes dropped EXE
PID:4412 -
C:\Windows\SysWOW64\Aifdcgcp.exeC:\Windows\system32\Aifdcgcp.exe66⤵PID:2656
-
C:\Windows\SysWOW64\Ackiqpce.exeC:\Windows\system32\Ackiqpce.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4416 -
C:\Windows\SysWOW64\Amcmie32.exeC:\Windows\system32\Amcmie32.exe68⤵PID:2464
-
C:\Windows\SysWOW64\Agiagn32.exeC:\Windows\system32\Agiagn32.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1336 -
C:\Windows\SysWOW64\Bijnnf32.exeC:\Windows\system32\Bijnnf32.exe70⤵PID:4844
-
C:\Windows\SysWOW64\Bgknlmgi.exeC:\Windows\system32\Bgknlmgi.exe71⤵
- Drops file in System32 directory
PID:4568 -
C:\Windows\SysWOW64\Bimkde32.exeC:\Windows\system32\Bimkde32.exe72⤵
- System Location Discovery: System Language Discovery
PID:3824 -
C:\Windows\SysWOW64\Bgnkamef.exeC:\Windows\system32\Bgnkamef.exe73⤵PID:2520
-
C:\Windows\SysWOW64\Bqfokblg.exeC:\Windows\system32\Bqfokblg.exe74⤵PID:4464
-
C:\Windows\SysWOW64\Bcdlgnkk.exeC:\Windows\system32\Bcdlgnkk.exe75⤵PID:6100
-
C:\Windows\SysWOW64\Bjodch32.exeC:\Windows\system32\Bjodch32.exe76⤵
- Modifies registry class
PID:5844 -
C:\Windows\SysWOW64\Bqhlpbjd.exeC:\Windows\system32\Bqhlpbjd.exe77⤵
- System Location Discovery: System Language Discovery
PID:3328 -
C:\Windows\SysWOW64\Bgbdml32.exeC:\Windows\system32\Bgbdml32.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:1624 -
C:\Windows\SysWOW64\Bciebm32.exeC:\Windows\system32\Bciebm32.exe79⤵PID:5580
-
C:\Windows\SysWOW64\Cjcmognb.exeC:\Windows\system32\Cjcmognb.exe80⤵PID:2908
-
C:\Windows\SysWOW64\Cclagm32.exeC:\Windows\system32\Cclagm32.exe81⤵PID:4952
-
C:\Windows\SysWOW64\Cjejdglp.exeC:\Windows\system32\Cjejdglp.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4516 -
C:\Windows\SysWOW64\Cgijnk32.exeC:\Windows\system32\Cgijnk32.exe83⤵PID:5300
-
C:\Windows\SysWOW64\Cabofaaj.exeC:\Windows\system32\Cabofaaj.exe84⤵PID:5508
-
C:\Windows\SysWOW64\Cglgck32.exeC:\Windows\system32\Cglgck32.exe85⤵
- System Location Discovery: System Language Discovery
PID:5584 -
C:\Windows\SysWOW64\Cadllq32.exeC:\Windows\system32\Cadllq32.exe86⤵PID:5456
-
C:\Windows\SysWOW64\Cfaddg32.exeC:\Windows\system32\Cfaddg32.exe87⤵PID:4268
-
C:\Windows\SysWOW64\Cmklaaek.exeC:\Windows\system32\Cmklaaek.exe88⤵
- Drops file in System32 directory
PID:1612 -
C:\Windows\SysWOW64\Dibmfb32.exeC:\Windows\system32\Dibmfb32.exe89⤵PID:5144
-
C:\Windows\SysWOW64\Dcgackke.exeC:\Windows\system32\Dcgackke.exe90⤵PID:5904
-
C:\Windows\SysWOW64\Dmpfla32.exeC:\Windows\system32\Dmpfla32.exe91⤵PID:5032
-
C:\Windows\SysWOW64\Dhejij32.exeC:\Windows\system32\Dhejij32.exe92⤵PID:1484
-
C:\Windows\SysWOW64\Djcfee32.exeC:\Windows\system32\Djcfee32.exe93⤵
- Drops file in System32 directory
PID:4864 -
C:\Windows\SysWOW64\Dannbogl.exeC:\Windows\system32\Dannbogl.exe94⤵
- Drops file in System32 directory
PID:2324 -
C:\Windows\SysWOW64\Djfckenm.exeC:\Windows\system32\Djfckenm.exe95⤵PID:3156
-
C:\Windows\SysWOW64\Dpckclld.exeC:\Windows\system32\Dpckclld.exe96⤵PID:3436
-
C:\Windows\SysWOW64\Dikpla32.exeC:\Windows\system32\Dikpla32.exe97⤵PID:5524
-
C:\Windows\SysWOW64\Dpehikja.exeC:\Windows\system32\Dpehikja.exe98⤵PID:6080
-
C:\Windows\SysWOW64\Efopeeao.exeC:\Windows\system32\Efopeeao.exe99⤵
- Modifies registry class
PID:3176 -
C:\Windows\SysWOW64\Epgenk32.exeC:\Windows\system32\Epgenk32.exe100⤵PID:4796
-
C:\Windows\SysWOW64\Efamkepl.exeC:\Windows\system32\Efamkepl.exe101⤵PID:1588
-
C:\Windows\SysWOW64\Emkeho32.exeC:\Windows\system32\Emkeho32.exe102⤵
- Drops file in System32 directory
PID:4176 -
C:\Windows\SysWOW64\Edemdine.exeC:\Windows\system32\Edemdine.exe103⤵PID:5324
-
C:\Windows\SysWOW64\Efdjqeni.exeC:\Windows\system32\Efdjqeni.exe104⤵PID:5916
-
C:\Windows\SysWOW64\Eainnn32.exeC:\Windows\system32\Eainnn32.exe105⤵
- Modifies registry class
PID:4264 -
C:\Windows\SysWOW64\Effffd32.exeC:\Windows\system32\Effffd32.exe106⤵PID:5644
-
C:\Windows\SysWOW64\Empococc.exeC:\Windows\system32\Empococc.exe107⤵PID:3108
-
C:\Windows\SysWOW64\Edjgpi32.exeC:\Windows\system32\Edjgpi32.exe108⤵PID:2152
-
C:\Windows\SysWOW64\Embkhn32.exeC:\Windows\system32\Embkhn32.exe109⤵PID:3284
-
C:\Windows\SysWOW64\Fdlcehhn.exeC:\Windows\system32\Fdlcehhn.exe110⤵PID:3248
-
C:\Windows\SysWOW64\Fkflbb32.exeC:\Windows\system32\Fkflbb32.exe111⤵PID:2732
-
C:\Windows\SysWOW64\Fpcdji32.exeC:\Windows\system32\Fpcdji32.exe112⤵PID:5796
-
C:\Windows\SysWOW64\Ffmmgceo.exeC:\Windows\system32\Ffmmgceo.exe113⤵PID:5788
-
C:\Windows\SysWOW64\Fmgecn32.exeC:\Windows\system32\Fmgecn32.exe114⤵PID:3512
-
C:\Windows\SysWOW64\Fhmiqfma.exeC:\Windows\system32\Fhmiqfma.exe115⤵PID:4732
-
C:\Windows\SysWOW64\Fmiaimki.exeC:\Windows\system32\Fmiaimki.exe116⤵PID:3380
-
C:\Windows\SysWOW64\Fhofffjo.exeC:\Windows\system32\Fhofffjo.exe117⤵
- Modifies registry class
PID:3636 -
C:\Windows\SysWOW64\Fipbnn32.exeC:\Windows\system32\Fipbnn32.exe118⤵PID:6048
-
C:\Windows\SysWOW64\Fdffkgpc.exeC:\Windows\system32\Fdffkgpc.exe119⤵PID:3796
-
C:\Windows\SysWOW64\Fkpoha32.exeC:\Windows\system32\Fkpoha32.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4572 -
C:\Windows\SysWOW64\Gpmgph32.exeC:\Windows\system32\Gpmgph32.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-