Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
04-05-2021 22:19
Static task
static1
Behavioral task
behavioral1
Sample
bd95455df8c2382480969be28f0413b2a7d28caca5d05465827e48bc13235b0d.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bd95455df8c2382480969be28f0413b2a7d28caca5d05465827e48bc13235b0d.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
bd95455df8c2382480969be28f0413b2a7d28caca5d05465827e48bc13235b0d.exe
-
Size
5.4MB
-
MD5
79a15c3206dcf08d8e26c1db8293de4b
-
SHA1
1ec893f701a9aecadce71afe358b7feb21ac66b6
-
SHA256
bd95455df8c2382480969be28f0413b2a7d28caca5d05465827e48bc13235b0d
-
SHA512
51c5ec852a6803139f1e885433883077f851ffab6ef3e2472ed784663358d196009ede80c816cf22db7fe74194fa252de9feaa0bc18576d06dab1ba7cf1cb99e
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs
-
Executes dropped EXE 64 IoCs
Processes:
Hddhddfm.exeJcjnln32.exeKdppgpnm.exeLnbhfd32.exeMjbkadjm.exeMnbqmbnp.exeNcdbph32.exeOcmefg32.exePhkgcchk.exeAmflmh32.exeDlcdnkjb.exeEmodijpd.exeFifneh32.exeIlofnppm.exeJlmbpn32.exeKcnpmg32.exeKlpglldg.exeMqipnhpp.exeNfahbm32.exeNgcaap32.exeOpabkbdc.exePfdnnk32.exePckkmo32.exePjilehdc.exeEnpjfl32.exeKlhkaf32.exeKhahkg32.exeMljpmcfn.exeMphicbld.exeMhcnhdjp.exeMbnofinn.exePmnoqo32.exeBdfled32.exeCjenmn32.exeCbpbap32.exeDggnnm32.exeDkegdlje.exeDaalfeoo.exeDadhlemm.exeEnjiafca.exeEjajfg32.exeFjofgele.exeHghibfig.exeIjbejp32.exeJlnapa32.exeKbjfbkpm.exeKhgnkbnd.exeKblbhk32.exeKjggmm32.exeKaapigcb.exeKhlhfa32.exeKoepbk32.exeKephoeih.exeKklqglgp.exeKafidf32.exeKllmao32.exeLbfeni32.exeLhbnfp32.exeLbhbdi32.exeLdiolajk.exeLkcghk32.exeLamoee32.exeLlccbn32.exeLbmkohpg.exepid process 3472 Hddhddfm.exe 3140 Jcjnln32.exe 388 Kdppgpnm.exe 3800 Lnbhfd32.exe 2964 Mjbkadjm.exe 4032 Mnbqmbnp.exe 184 Ncdbph32.exe 920 Ocmefg32.exe 1908 Phkgcchk.exe 568 Amflmh32.exe 1504 Dlcdnkjb.exe 4052 Emodijpd.exe 2104 Fifneh32.exe 3848 Ilofnppm.exe 2312 Jlmbpn32.exe 3676 Kcnpmg32.exe 2672 Klpglldg.exe 3400 Mqipnhpp.exe 2288 Nfahbm32.exe 2236 Ngcaap32.exe 1804 Opabkbdc.exe 840 Pfdnnk32.exe 1184 Pckkmo32.exe 2120 Pjilehdc.exe 996 Enpjfl32.exe 2980 Klhkaf32.exe 3952 Khahkg32.exe 3732 Mljpmcfn.exe 2972 Mphicbld.exe 4140 Mhcnhdjp.exe 4168 Mbnofinn.exe 4196 Pmnoqo32.exe 4224 Bdfled32.exe 4240 Cjenmn32.exe 4264 Cbpbap32.exe 4288 Dggnnm32.exe 4308 Dkegdlje.exe 4328 Daalfeoo.exe 4344 Dadhlemm.exe 4364 Enjiafca.exe 4392 Ejajfg32.exe 4412 Fjofgele.exe 4432 Hghibfig.exe 4452 Ijbejp32.exe 4472 Jlnapa32.exe 4492 Kbjfbkpm.exe 4512 Khgnkbnd.exe 4532 Kblbhk32.exe 4552 Kjggmm32.exe 4572 Kaapigcb.exe 4592 Khlhfa32.exe 4612 Koepbk32.exe 4632 Kephoeih.exe 4652 Kklqglgp.exe 4672 Kafidf32.exe 4692 Kllmao32.exe 4712 Lbfeni32.exe 4732 Lhbnfp32.exe 4752 Lbhbdi32.exe 4772 Ldiolajk.exe 4792 Lkcghk32.exe 4812 Lamoee32.exe 4832 Llccbn32.exe 4852 Lbmkohpg.exe -
Drops file in System32 directory 64 IoCs
Processes:
Hckomk32.exeJobiij32.exeOihhbf32.exeKafidf32.exeFciqkd32.exeGqgdkg32.exeAkmnim32.exeGhmhjc32.exeMljpmcfn.exeNkleqkdc.exeMeidlb32.exeBoibpi32.exeHonggm32.exeHegodgjm.exeEjlhcmge.exeJagfhbga.exeDkpeaa32.exeDaalfeoo.exeAiikmf32.exeAgfkcn32.exeMahhfn32.exeJclhdikc.exeMahalggp.exePkgnbddm.exeGdpcffnb.exeIqncbcpk.exeKgfgplkh.exeKfnaghnn.exeBbdklobj.exeCphflmmk.exeDekmjm32.exeAhlnlkjm.exeMpckgedb.exeJcjnln32.exeKjggmm32.exePagmoi32.exeDhgmai32.exeGhoeoc32.exeIcpihjea.exeDnckildd.exeOcmefg32.exeEmodijpd.exeDkegdlje.exeMknpjc32.exeMhbpchbh.exeBcnojo32.exeHhkdka32.exeBqeobl32.exeEnlnokli.exeCfhkbi32.exeBfckmclm.exeEhncahln.exeIlmglohl.exeGibkcamm.exeGppnjhjn.exeJmnfnc32.exeAdekglnn.exeMhcgmnfd.exeOlahjj32.exeMooeea32.exeGigkhg32.exedescription ioc process File created C:\Windows\SysWOW64\Hlddfqpg.exe Hckomk32.exe File created C:\Windows\SysWOW64\Jjhmfbqn.exe Jobiij32.exe File created C:\Windows\SysWOW64\Opbpoqjp.exe Oihhbf32.exe File created C:\Windows\SysWOW64\Hjdhpbce.dll Kafidf32.exe File created C:\Windows\SysWOW64\Pgeedfff.dll Fciqkd32.exe File opened for modification C:\Windows\SysWOW64\Ggqlga32.exe Gqgdkg32.exe File opened for modification C:\Windows\SysWOW64\Abgfegbf.exe Akmnim32.exe File opened for modification C:\Windows\SysWOW64\Gcbmgl32.exe Ghmhjc32.exe File created C:\Windows\SysWOW64\Mphicbld.exe Mljpmcfn.exe File created C:\Windows\SysWOW64\Nafmme32.exe Nkleqkdc.exe File created C:\Windows\SysWOW64\Dhkffe32.dll Meidlb32.exe File created C:\Windows\SysWOW64\Emadii32.dll Boibpi32.exe File opened for modification C:\Windows\SysWOW64\Hegodgjm.exe Honggm32.exe File created C:\Windows\SysWOW64\Hlagqabi.exe Hegodgjm.exe File opened for modification C:\Windows\SysWOW64\Elkempoh.exe Ejlhcmge.exe File created C:\Windows\SysWOW64\Jganel32.exe Jagfhbga.exe File opened for modification C:\Windows\SysWOW64\Dalnjhgm.exe Dkpeaa32.exe File created C:\Windows\SysWOW64\Fhfink32.dll Daalfeoo.exe File created C:\Windows\SysWOW64\Bcnojo32.exe Aiikmf32.exe File opened for modification C:\Windows\SysWOW64\Abloqf32.exe Agfkcn32.exe File created C:\Windows\SysWOW64\Mbjfhhdl.dll Ghmhjc32.exe File created C:\Windows\SysWOW64\Mhbpchbh.exe Mahhfn32.exe File created C:\Windows\SysWOW64\Jjfqqc32.exe Jclhdikc.exe File created C:\Windows\SysWOW64\Lpehko32.dll Mahalggp.exe File opened for modification C:\Windows\SysWOW64\Qflbpmdc.exe Pkgnbddm.exe File created C:\Windows\SysWOW64\Gjmlnmli.exe Gdpcffnb.exe File opened for modification C:\Windows\SysWOW64\Jghkon32.exe Iqncbcpk.exe File created C:\Windows\SysWOW64\Cnkfpe32.dll Kgfgplkh.exe File created C:\Windows\SysWOW64\Kmhidb32.exe Kfnaghnn.exe File created C:\Windows\SysWOW64\Bhociijg.exe Bbdklobj.exe File opened for modification C:\Windows\SysWOW64\Cfbnhg32.exe Cphflmmk.exe File created C:\Windows\SysWOW64\Apjene32.dll Dekmjm32.exe File created C:\Windows\SysWOW64\Adboal32.exe Ahlnlkjm.exe File opened for modification C:\Windows\SysWOW64\Mfmcco32.exe Mpckgedb.exe File created C:\Windows\SysWOW64\Alnkpj32.dll Jcjnln32.exe File opened for modification C:\Windows\SysWOW64\Kaapigcb.exe Kjggmm32.exe File opened for modification C:\Windows\SysWOW64\Pgcegp32.exe Pagmoi32.exe File created C:\Windows\SysWOW64\Gbnjlb32.dll Dhgmai32.exe File opened for modification C:\Windows\SysWOW64\Hoimlmge.exe Ghoeoc32.exe File created C:\Windows\SysWOW64\Gpblnffe.dll Icpihjea.exe File created C:\Windows\SysWOW64\Demcefka.exe Dnckildd.exe File opened for modification C:\Windows\SysWOW64\Phkgcchk.exe Ocmefg32.exe File created C:\Windows\SysWOW64\Fifneh32.exe Emodijpd.exe File created C:\Windows\SysWOW64\Ehmhjooi.dll Dkegdlje.exe File created C:\Windows\SysWOW64\Mahhfn32.exe Mknpjc32.exe File opened for modification C:\Windows\SysWOW64\Mmohkoqp.exe Mhbpchbh.exe File opened for modification C:\Windows\SysWOW64\Bmgdcenm.exe Bcnojo32.exe File opened for modification C:\Windows\SysWOW64\Icpihjea.exe Hhkdka32.exe File opened for modification C:\Windows\SysWOW64\Bkkcpd32.exe Bqeobl32.exe File created C:\Windows\SysWOW64\Eiabld32.exe Enlnokli.exe File opened for modification C:\Windows\SysWOW64\Cleckpjj.exe Cfhkbi32.exe File created C:\Windows\SysWOW64\Abgihbmh.dll Bfckmclm.exe File opened for modification C:\Windows\SysWOW64\Eohknbcj.exe Ehncahln.exe File created C:\Windows\SysWOW64\Igckihgb.exe Ilmglohl.exe File created C:\Windows\SysWOW64\Gkcgkj32.exe Gibkcamm.exe File created C:\Windows\SysWOW64\Ogkidpog.dll Mljpmcfn.exe File created C:\Windows\SysWOW64\Dbdfbh32.dll Gppnjhjn.exe File opened for modification C:\Windows\SysWOW64\Kchojm32.exe Jmnfnc32.exe File opened for modification C:\Windows\SysWOW64\Cfmncbdb.exe Bfckmclm.exe File created C:\Windows\SysWOW64\Jlghai32.dll Adekglnn.exe File created C:\Windows\SysWOW64\Opmgcd32.dll Mhcgmnfd.exe File created C:\Windows\SysWOW64\Ejbpjilm.dll Olahjj32.exe File created C:\Windows\SysWOW64\Nehmbl32.exe Mooeea32.exe File opened for modification C:\Windows\SysWOW64\Gcppamcc.exe Gigkhg32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1272 10196 WerFault.exe Gkedpi32.exe -
Modifies registry class 64 IoCs
Processes:
Lddnfl32.exeEheibgfe.exeAgfdigko.exeBipaneao.exeGgqlga32.exeMahhfn32.exePkmdao32.exeLigfdkoh.exeMfmcco32.exeAnplea32.exeDpmogm32.exeGjfenn32.exeJeqeca32.exeMoebocpm.exeLfdpmq32.exeMnbqmbnp.exeAkmnim32.exeOihhbf32.exeFoeqejco.exeDaalfeoo.exeAcjfopkb.exeAiikmf32.exeDgiclb32.exeOhcpdl32.exeBmgdcenm.exeFgnfkc32.exeKjbggglo.exeIjjaed32.exeIfaajebb.exeKfmjmajb.exeHddhddfm.exeMepafc32.exeCpoceodf.exeGdpcffnb.exeKchojm32.exeNkjoebia.exeAdcelbcm.exeEiklke32.exeKklqglgp.exeLlccbn32.exeMkmjoj32.exeAifnggii.exeMhbpchbh.exeNadgbl32.exeCqnahj32.exeGkakejen.exeKblbhk32.exeBbhffk32.exeBeiohfep.exeInmjqhbj.exeKmjfiach.exePdfpek32.exeDadhlemm.exeClifkibi.exeMbnofinn.exeMegggben.exeObqnhqjm.exeDeigoc32.exeKeldop32.exeNemfmkkj.exeEfapeobj.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lddnfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbppaaeg.dll" Eheibgfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obmcnk32.dll" Agfdigko.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bipaneao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lqdoli32.dll" Ggqlga32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mahhfn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pkmdao32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ligfdkoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbfbgcea.dll" Mfmcco32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Anplea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dpmogm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gjfenn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kokmgeea.dll" Jeqeca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Moebocpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljlpdagd.dll" Lfdpmq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mnbqmbnp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Akmnim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbhpcnhb.dll" Oihhbf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Foeqejco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhfink32.dll" Daalfeoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Acjfopkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aiikmf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dgiclb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dajlol32.dll" Ohcpdl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bmgdcenm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fgnfkc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kjbggglo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ijjaed32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcdicaph.dll" Ifaajebb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqcfdcga.dll" Kfmjmajb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hddhddfm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mepafc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cpoceodf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkkqin32.dll" Gdpcffnb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kchojm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cepmcc32.dll" Nkjoebia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Adcelbcm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eiklke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbbaango.dll" Kklqglgp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Llccbn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mkmjoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elkbke32.dll" Aifnggii.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mhbpchbh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nadgbl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cqnahj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obllaa32.dll" Gkakejen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kblbhk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bbhffk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdakbead.dll" Beiohfep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Beiohfep.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Inmjqhbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kmjfiach.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkkmjf32.dll" Pdfpek32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eheibgfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dadhlemm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aifnggii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcaelmpg.dll" Clifkibi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mbnofinn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epkmfeke.dll" Megggben.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhpcldbo.dll" Obqnhqjm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfnpnmoj.dll" Deigoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Keldop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nemfmkkj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Efapeobj.exe -
Suspicious behavior: EnumeratesProcesses 53 IoCs
Processes:
WerFault.exepid process 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 1272 WerFault.exe Token: SeBackupPrivilege 1272 WerFault.exe Token: SeDebugPrivilege 1272 WerFault.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bd95455df8c2382480969be28f0413b2a7d28caca5d05465827e48bc13235b0d.exeHddhddfm.exeJcjnln32.exeKdppgpnm.exeLnbhfd32.exeMjbkadjm.exeMnbqmbnp.exeNcdbph32.exeOcmefg32.exePhkgcchk.exeAmflmh32.exeDlcdnkjb.exeEmodijpd.exeFifneh32.exeIlofnppm.exeJlmbpn32.exeKcnpmg32.exeKlpglldg.exeMqipnhpp.exeNfahbm32.exeNgcaap32.exeOpabkbdc.exedescription pid process target process PID 624 wrote to memory of 3472 624 bd95455df8c2382480969be28f0413b2a7d28caca5d05465827e48bc13235b0d.exe Hddhddfm.exe PID 624 wrote to memory of 3472 624 bd95455df8c2382480969be28f0413b2a7d28caca5d05465827e48bc13235b0d.exe Hddhddfm.exe PID 624 wrote to memory of 3472 624 bd95455df8c2382480969be28f0413b2a7d28caca5d05465827e48bc13235b0d.exe Hddhddfm.exe PID 3472 wrote to memory of 3140 3472 Hddhddfm.exe Jcjnln32.exe PID 3472 wrote to memory of 3140 3472 Hddhddfm.exe Jcjnln32.exe PID 3472 wrote to memory of 3140 3472 Hddhddfm.exe Jcjnln32.exe PID 3140 wrote to memory of 388 3140 Jcjnln32.exe Kdppgpnm.exe PID 3140 wrote to memory of 388 3140 Jcjnln32.exe Kdppgpnm.exe PID 3140 wrote to memory of 388 3140 Jcjnln32.exe Kdppgpnm.exe PID 388 wrote to memory of 3800 388 Kdppgpnm.exe Lnbhfd32.exe PID 388 wrote to memory of 3800 388 Kdppgpnm.exe Lnbhfd32.exe PID 388 wrote to memory of 3800 388 Kdppgpnm.exe Lnbhfd32.exe PID 3800 wrote to memory of 2964 3800 Lnbhfd32.exe Mjbkadjm.exe PID 3800 wrote to memory of 2964 3800 Lnbhfd32.exe Mjbkadjm.exe PID 3800 wrote to memory of 2964 3800 Lnbhfd32.exe Mjbkadjm.exe PID 2964 wrote to memory of 4032 2964 Mjbkadjm.exe Mnbqmbnp.exe PID 2964 wrote to memory of 4032 2964 Mjbkadjm.exe Mnbqmbnp.exe PID 2964 wrote to memory of 4032 2964 Mjbkadjm.exe Mnbqmbnp.exe PID 4032 wrote to memory of 184 4032 Mnbqmbnp.exe Ncdbph32.exe PID 4032 wrote to memory of 184 4032 Mnbqmbnp.exe Ncdbph32.exe PID 4032 wrote to memory of 184 4032 Mnbqmbnp.exe Ncdbph32.exe PID 184 wrote to memory of 920 184 Ncdbph32.exe Ocmefg32.exe PID 184 wrote to memory of 920 184 Ncdbph32.exe Ocmefg32.exe PID 184 wrote to memory of 920 184 Ncdbph32.exe Ocmefg32.exe PID 920 wrote to memory of 1908 920 Ocmefg32.exe Phkgcchk.exe PID 920 wrote to memory of 1908 920 Ocmefg32.exe Phkgcchk.exe PID 920 wrote to memory of 1908 920 Ocmefg32.exe Phkgcchk.exe PID 1908 wrote to memory of 568 1908 Phkgcchk.exe Amflmh32.exe PID 1908 wrote to memory of 568 1908 Phkgcchk.exe Amflmh32.exe PID 1908 wrote to memory of 568 1908 Phkgcchk.exe Amflmh32.exe PID 568 wrote to memory of 1504 568 Amflmh32.exe Dlcdnkjb.exe PID 568 wrote to memory of 1504 568 Amflmh32.exe Dlcdnkjb.exe PID 568 wrote to memory of 1504 568 Amflmh32.exe Dlcdnkjb.exe PID 1504 wrote to memory of 4052 1504 Dlcdnkjb.exe Emodijpd.exe PID 1504 wrote to memory of 4052 1504 Dlcdnkjb.exe Emodijpd.exe PID 1504 wrote to memory of 4052 1504 Dlcdnkjb.exe Emodijpd.exe PID 4052 wrote to memory of 2104 4052 Emodijpd.exe Fifneh32.exe PID 4052 wrote to memory of 2104 4052 Emodijpd.exe Fifneh32.exe PID 4052 wrote to memory of 2104 4052 Emodijpd.exe Fifneh32.exe PID 2104 wrote to memory of 3848 2104 Fifneh32.exe Ilofnppm.exe PID 2104 wrote to memory of 3848 2104 Fifneh32.exe Ilofnppm.exe PID 2104 wrote to memory of 3848 2104 Fifneh32.exe Ilofnppm.exe PID 3848 wrote to memory of 2312 3848 Ilofnppm.exe Jlmbpn32.exe PID 3848 wrote to memory of 2312 3848 Ilofnppm.exe Jlmbpn32.exe PID 3848 wrote to memory of 2312 3848 Ilofnppm.exe Jlmbpn32.exe PID 2312 wrote to memory of 3676 2312 Jlmbpn32.exe Kcnpmg32.exe PID 2312 wrote to memory of 3676 2312 Jlmbpn32.exe Kcnpmg32.exe PID 2312 wrote to memory of 3676 2312 Jlmbpn32.exe Kcnpmg32.exe PID 3676 wrote to memory of 2672 3676 Kcnpmg32.exe Klpglldg.exe PID 3676 wrote to memory of 2672 3676 Kcnpmg32.exe Klpglldg.exe PID 3676 wrote to memory of 2672 3676 Kcnpmg32.exe Klpglldg.exe PID 2672 wrote to memory of 3400 2672 Klpglldg.exe Mqipnhpp.exe PID 2672 wrote to memory of 3400 2672 Klpglldg.exe Mqipnhpp.exe PID 2672 wrote to memory of 3400 2672 Klpglldg.exe Mqipnhpp.exe PID 3400 wrote to memory of 2288 3400 Mqipnhpp.exe Nfahbm32.exe PID 3400 wrote to memory of 2288 3400 Mqipnhpp.exe Nfahbm32.exe PID 3400 wrote to memory of 2288 3400 Mqipnhpp.exe Nfahbm32.exe PID 2288 wrote to memory of 2236 2288 Nfahbm32.exe Ngcaap32.exe PID 2288 wrote to memory of 2236 2288 Nfahbm32.exe Ngcaap32.exe PID 2288 wrote to memory of 2236 2288 Nfahbm32.exe Ngcaap32.exe PID 2236 wrote to memory of 1804 2236 Ngcaap32.exe Opabkbdc.exe PID 2236 wrote to memory of 1804 2236 Ngcaap32.exe Opabkbdc.exe PID 2236 wrote to memory of 1804 2236 Ngcaap32.exe Opabkbdc.exe PID 1804 wrote to memory of 840 1804 Opabkbdc.exe Pfdnnk32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd95455df8c2382480969be28f0413b2a7d28caca5d05465827e48bc13235b0d.exe"C:\Users\Admin\AppData\Local\Temp\bd95455df8c2382480969be28f0413b2a7d28caca5d05465827e48bc13235b0d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Hddhddfm.exeC:\Windows\system32\Hddhddfm.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jcjnln32.exeC:\Windows\system32\Jcjnln32.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kdppgpnm.exeC:\Windows\system32\Kdppgpnm.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lnbhfd32.exeC:\Windows\system32\Lnbhfd32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mjbkadjm.exeC:\Windows\system32\Mjbkadjm.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mnbqmbnp.exeC:\Windows\system32\Mnbqmbnp.exe7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ncdbph32.exeC:\Windows\system32\Ncdbph32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ocmefg32.exeC:\Windows\system32\Ocmefg32.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Phkgcchk.exeC:\Windows\system32\Phkgcchk.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Amflmh32.exeC:\Windows\system32\Amflmh32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Dlcdnkjb.exeC:\Windows\system32\Dlcdnkjb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Emodijpd.exeC:\Windows\system32\Emodijpd.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Fifneh32.exeC:\Windows\system32\Fifneh32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ilofnppm.exeC:\Windows\system32\Ilofnppm.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jlmbpn32.exeC:\Windows\system32\Jlmbpn32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kcnpmg32.exeC:\Windows\system32\Kcnpmg32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Klpglldg.exeC:\Windows\system32\Klpglldg.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mqipnhpp.exeC:\Windows\system32\Mqipnhpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Nfahbm32.exeC:\Windows\system32\Nfahbm32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ngcaap32.exeC:\Windows\system32\Ngcaap32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Opabkbdc.exeC:\Windows\system32\Opabkbdc.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Pfdnnk32.exeC:\Windows\system32\Pfdnnk32.exe23⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pckkmo32.exeC:\Windows\system32\Pckkmo32.exe24⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pjilehdc.exeC:\Windows\system32\Pjilehdc.exe25⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Enpjfl32.exeC:\Windows\system32\Enpjfl32.exe26⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Klhkaf32.exeC:\Windows\system32\Klhkaf32.exe27⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Khahkg32.exeC:\Windows\system32\Khahkg32.exe28⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mljpmcfn.exeC:\Windows\system32\Mljpmcfn.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Mphicbld.exeC:\Windows\system32\Mphicbld.exe30⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mhcnhdjp.exeC:\Windows\system32\Mhcnhdjp.exe31⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mbnofinn.exeC:\Windows\system32\Mbnofinn.exe32⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Pmnoqo32.exeC:\Windows\system32\Pmnoqo32.exe33⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bdfled32.exeC:\Windows\system32\Bdfled32.exe34⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cjenmn32.exeC:\Windows\system32\Cjenmn32.exe35⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cbpbap32.exeC:\Windows\system32\Cbpbap32.exe36⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dggnnm32.exeC:\Windows\system32\Dggnnm32.exe37⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dkegdlje.exeC:\Windows\system32\Dkegdlje.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Daalfeoo.exeC:\Windows\system32\Daalfeoo.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Dadhlemm.exeC:\Windows\system32\Dadhlemm.exe40⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Enjiafca.exeC:\Windows\system32\Enjiafca.exe41⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ejajfg32.exeC:\Windows\system32\Ejajfg32.exe42⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fjofgele.exeC:\Windows\system32\Fjofgele.exe43⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hghibfig.exeC:\Windows\system32\Hghibfig.exe44⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ijbejp32.exeC:\Windows\system32\Ijbejp32.exe45⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Jlnapa32.exeC:\Windows\system32\Jlnapa32.exe46⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Kbjfbkpm.exeC:\Windows\system32\Kbjfbkpm.exe47⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Khgnkbnd.exeC:\Windows\system32\Khgnkbnd.exe48⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Kblbhk32.exeC:\Windows\system32\Kblbhk32.exe49⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Kjggmm32.exeC:\Windows\system32\Kjggmm32.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kaapigcb.exeC:\Windows\system32\Kaapigcb.exe51⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Khlhfa32.exeC:\Windows\system32\Khlhfa32.exe52⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Koepbk32.exeC:\Windows\system32\Koepbk32.exe53⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Kephoeih.exeC:\Windows\system32\Kephoeih.exe54⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Kklqglgp.exeC:\Windows\system32\Kklqglgp.exe55⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Kafidf32.exeC:\Windows\system32\Kafidf32.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kllmao32.exeC:\Windows\system32\Kllmao32.exe57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lbfeni32.exeC:\Windows\system32\Lbfeni32.exe58⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lhbnfp32.exeC:\Windows\system32\Lhbnfp32.exe59⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lbhbdi32.exeC:\Windows\system32\Lbhbdi32.exe60⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ldiolajk.exeC:\Windows\system32\Ldiolajk.exe61⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lkcghk32.exeC:\Windows\system32\Lkcghk32.exe62⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lamoee32.exeC:\Windows\system32\Lamoee32.exe63⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Llccbn32.exeC:\Windows\system32\Llccbn32.exe64⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Lbmkohpg.exeC:\Windows\system32\Lbmkohpg.exe65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ldnhgq32.exeC:\Windows\system32\Ldnhgq32.exe66⤵
-
C:\Windows\SysWOW64\Lhlqmo32.exeC:\Windows\system32\Lhlqmo32.exe67⤵
-
C:\Windows\SysWOW64\Mofiiici.exeC:\Windows\system32\Mofiiici.exe68⤵
-
C:\Windows\SysWOW64\Mepafc32.exeC:\Windows\system32\Mepafc32.exe69⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Mkmjoj32.exeC:\Windows\system32\Mkmjoj32.exe70⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Magbkdqj.exeC:\Windows\system32\Magbkdqj.exe71⤵
-
C:\Windows\SysWOW64\Mllfhm32.exeC:\Windows\system32\Mllfhm32.exe72⤵
-
C:\Windows\SysWOW64\Mcfneghm.exeC:\Windows\system32\Mcfneghm.exe73⤵
-
C:\Windows\SysWOW64\Mhcgmnfd.exeC:\Windows\system32\Mhcgmnfd.exe74⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Momojh32.exeC:\Windows\system32\Momojh32.exe75⤵
-
C:\Windows\SysWOW64\Megggben.exeC:\Windows\system32\Megggben.exe76⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Mkcpoi32.exeC:\Windows\system32\Mkcpoi32.exe77⤵
-
C:\Windows\SysWOW64\Meidlb32.exeC:\Windows\system32\Meidlb32.exe78⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nkfldi32.exeC:\Windows\system32\Nkfldi32.exe79⤵
-
C:\Windows\SysWOW64\Napeacho.exeC:\Windows\system32\Napeacho.exe80⤵
-
C:\Windows\SysWOW64\Nhjmnm32.exeC:\Windows\system32\Nhjmnm32.exe81⤵
-
C:\Windows\SysWOW64\Nodekg32.exeC:\Windows\system32\Nodekg32.exe82⤵
-
C:\Windows\SysWOW64\Nkkfphmm.exeC:\Windows\system32\Nkkfphmm.exe83⤵
-
C:\Windows\SysWOW64\Nepjmamc.exeC:\Windows\system32\Nepjmamc.exe84⤵
-
C:\Windows\SysWOW64\Nljbjk32.exeC:\Windows\system32\Nljbjk32.exe85⤵
-
C:\Windows\SysWOW64\Nagkbbbg.exeC:\Windows\system32\Nagkbbbg.exe86⤵
-
C:\Windows\SysWOW64\Nkookg32.exeC:\Windows\system32\Nkookg32.exe87⤵
-
C:\Windows\SysWOW64\Ncfgle32.exeC:\Windows\system32\Ncfgle32.exe88⤵
-
C:\Windows\SysWOW64\Ohcpdl32.exeC:\Windows\system32\Ohcpdl32.exe89⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Oomhafon.exeC:\Windows\system32\Oomhafon.exe90⤵
-
C:\Windows\SysWOW64\Ofgpnpgk.exeC:\Windows\system32\Ofgpnpgk.exe91⤵
-
C:\Windows\SysWOW64\Olahjj32.exeC:\Windows\system32\Olahjj32.exe92⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Obnaba32.exeC:\Windows\system32\Obnaba32.exe93⤵
-
C:\Windows\SysWOW64\Olcepj32.exeC:\Windows\system32\Olcepj32.exe94⤵
-
C:\Windows\SysWOW64\Obqnhqjm.exeC:\Windows\system32\Obqnhqjm.exe95⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Okibaf32.exeC:\Windows\system32\Okibaf32.exe96⤵
-
C:\Windows\SysWOW64\Ofnfno32.exeC:\Windows\system32\Ofnfno32.exe97⤵
-
C:\Windows\SysWOW64\Olhokihp.exeC:\Windows\system32\Olhokihp.exe98⤵
-
C:\Windows\SysWOW64\Phoopjnd.exeC:\Windows\system32\Phoopjnd.exe99⤵
-
C:\Windows\SysWOW64\Poigmd32.exeC:\Windows\system32\Poigmd32.exe100⤵
-
C:\Windows\SysWOW64\Pdfpek32.exeC:\Windows\system32\Pdfpek32.exe101⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Pkphaeke.exeC:\Windows\system32\Pkphaeke.exe102⤵
-
C:\Windows\SysWOW64\Pkbege32.exeC:\Windows\system32\Pkbege32.exe103⤵
-
C:\Windows\SysWOW64\Pfhidn32.exeC:\Windows\system32\Pfhidn32.exe104⤵
-
C:\Windows\SysWOW64\Pkdamd32.exeC:\Windows\system32\Pkdamd32.exe105⤵
-
C:\Windows\SysWOW64\Pfjfjm32.exeC:\Windows\system32\Pfjfjm32.exe106⤵
-
C:\Windows\SysWOW64\Pkgnbddm.exeC:\Windows\system32\Pkgnbddm.exe107⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Qflbpmdc.exeC:\Windows\system32\Qflbpmdc.exe108⤵
-
C:\Windows\SysWOW64\Qoeghb32.exeC:\Windows\system32\Qoeghb32.exe109⤵
-
C:\Windows\SysWOW64\Qimlahad.exeC:\Windows\system32\Qimlahad.exe110⤵
-
C:\Windows\SysWOW64\Qcbpoa32.exeC:\Windows\system32\Qcbpoa32.exe111⤵
-
C:\Windows\SysWOW64\Amkdgfhj.exeC:\Windows\system32\Amkdgfhj.exe112⤵
-
C:\Windows\SysWOW64\Abhmpmfb.exeC:\Windows\system32\Abhmpmfb.exe113⤵
-
C:\Windows\SysWOW64\Ammamffh.exeC:\Windows\system32\Ammamffh.exe114⤵
-
C:\Windows\SysWOW64\Aehfah32.exeC:\Windows\system32\Aehfah32.exe115⤵
-
C:\Windows\SysWOW64\Acjfopkb.exeC:\Windows\system32\Acjfopkb.exe116⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Aifnggii.exeC:\Windows\system32\Aifnggii.exe117⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Aclbep32.exeC:\Windows\system32\Aclbep32.exe118⤵
-
C:\Windows\SysWOW64\Aiikmf32.exeC:\Windows\system32\Aiikmf32.exe119⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Bcnojo32.exeC:\Windows\system32\Bcnojo32.exe120⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Bmgdcenm.exeC:\Windows\system32\Bmgdcenm.exe121⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Bbclll32.exeC:\Windows\system32\Bbclll32.exe122⤵
-
C:\Windows\SysWOW64\Bllqdabe.exeC:\Windows\system32\Bllqdabe.exe123⤵
-
C:\Windows\SysWOW64\Bipaneao.exeC:\Windows\system32\Bipaneao.exe124⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Bbhffk32.exeC:\Windows\system32\Bbhffk32.exe125⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Blqjpq32.exeC:\Windows\system32\Blqjpq32.exe126⤵
-
C:\Windows\SysWOW64\Beiohfep.exeC:\Windows\system32\Beiohfep.exe127⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Cpoceodf.exeC:\Windows\system32\Cpoceodf.exe128⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Cfhkbi32.exeC:\Windows\system32\Cfhkbi32.exe129⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Cleckpjj.exeC:\Windows\system32\Cleckpjj.exe130⤵
-
C:\Windows\SysWOW64\Cbolgj32.exeC:\Windows\system32\Cbolgj32.exe131⤵
-
C:\Windows\SysWOW64\Cmepdb32.exeC:\Windows\system32\Cmepdb32.exe132⤵
-
C:\Windows\SysWOW64\Cdohamij.exeC:\Windows\system32\Cdohamij.exe133⤵
-
C:\Windows\SysWOW64\Cepeie32.exeC:\Windows\system32\Cepeie32.exe134⤵
-
C:\Windows\SysWOW64\Cpeifnon.exeC:\Windows\system32\Cpeifnon.exe135⤵
-
C:\Windows\SysWOW64\Cfpach32.exeC:\Windows\system32\Cfpach32.exe136⤵
-
C:\Windows\SysWOW64\Cphflmmk.exeC:\Windows\system32\Cphflmmk.exe137⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Cfbnhg32.exeC:\Windows\system32\Cfbnhg32.exe138⤵
-
C:\Windows\SysWOW64\Cmlfea32.exeC:\Windows\system32\Cmlfea32.exe139⤵
-
C:\Windows\SysWOW64\Dbionh32.exeC:\Windows\system32\Dbionh32.exe140⤵
-
C:\Windows\SysWOW64\Dibgjbai.exeC:\Windows\system32\Dibgjbai.exe141⤵
-
C:\Windows\SysWOW64\Dpmogm32.exeC:\Windows\system32\Dpmogm32.exe142⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Deigoc32.exeC:\Windows\system32\Deigoc32.exe143⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Dpolllfc.exeC:\Windows\system32\Dpolllfc.exe144⤵
-
C:\Windows\SysWOW64\Deldecdk.exeC:\Windows\system32\Deldecdk.exe145⤵
-
C:\Windows\SysWOW64\Epfbmk32.exeC:\Windows\system32\Epfbmk32.exe146⤵
-
C:\Windows\SysWOW64\Eecjeb32.exeC:\Windows\system32\Eecjeb32.exe147⤵
-
C:\Windows\SysWOW64\Elmbblfp.exeC:\Windows\system32\Elmbblfp.exe148⤵
-
C:\Windows\SysWOW64\Egbgoe32.exeC:\Windows\system32\Egbgoe32.exe149⤵
-
C:\Windows\SysWOW64\Emlolomb.exeC:\Windows\system32\Emlolomb.exe150⤵
-
C:\Windows\SysWOW64\Edfgii32.exeC:\Windows\system32\Edfgii32.exe151⤵
-
C:\Windows\SysWOW64\Eegdqajn.exeC:\Windows\system32\Eegdqajn.exe152⤵
-
C:\Windows\SysWOW64\Epmhnjjc.exeC:\Windows\system32\Epmhnjjc.exe153⤵
-
C:\Windows\SysWOW64\Eldickph.exeC:\Windows\system32\Eldickph.exe154⤵
-
C:\Windows\SysWOW64\Egimpdpn.exeC:\Windows\system32\Egimpdpn.exe155⤵
-
C:\Windows\SysWOW64\Fmcemn32.exeC:\Windows\system32\Fmcemn32.exe156⤵
-
C:\Windows\SysWOW64\Fdmnihog.exeC:\Windows\system32\Fdmnihog.exe157⤵
-
C:\Windows\SysWOW64\Fijfao32.exeC:\Windows\system32\Fijfao32.exe158⤵
-
C:\Windows\SysWOW64\Fpdnnidk.exeC:\Windows\system32\Fpdnnidk.exe159⤵
-
C:\Windows\SysWOW64\Fgnfkc32.exeC:\Windows\system32\Fgnfkc32.exe160⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Fnhohnce.exeC:\Windows\system32\Fnhohnce.exe161⤵
-
C:\Windows\SysWOW64\Fdbgdh32.exeC:\Windows\system32\Fdbgdh32.exe162⤵
-
C:\Windows\SysWOW64\Fecclppp.exeC:\Windows\system32\Fecclppp.exe163⤵
-
C:\Windows\SysWOW64\Flmlijhm.exeC:\Windows\system32\Flmlijhm.exe164⤵
-
C:\Windows\SysWOW64\Feepbp32.exeC:\Windows\system32\Feepbp32.exe165⤵
-
C:\Windows\SysWOW64\Flphojfj.exeC:\Windows\system32\Flphojfj.exe166⤵
-
C:\Windows\SysWOW64\Fciqkd32.exeC:\Windows\system32\Fciqkd32.exe167⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Gjcihndd.exeC:\Windows\system32\Gjcihndd.exe168⤵
-
C:\Windows\SysWOW64\Gdimeg32.exeC:\Windows\system32\Gdimeg32.exe169⤵
-
C:\Windows\SysWOW64\Gjfenn32.exeC:\Windows\system32\Gjfenn32.exe170⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gppnjhjn.exeC:\Windows\system32\Gppnjhjn.exe171⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ggjfgb32.exeC:\Windows\system32\Ggjfgb32.exe172⤵
-
C:\Windows\SysWOW64\Glfooi32.exeC:\Windows\system32\Glfooi32.exe173⤵
-
C:\Windows\SysWOW64\Gcqglc32.exeC:\Windows\system32\Gcqglc32.exe174⤵
-
C:\Windows\SysWOW64\Gnfkil32.exeC:\Windows\system32\Gnfkil32.exe175⤵
-
C:\Windows\SysWOW64\Gdpcffnb.exeC:\Windows\system32\Gdpcffnb.exe176⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Gjmlnmli.exeC:\Windows\system32\Gjmlnmli.exe177⤵
-
C:\Windows\SysWOW64\Gqgdkg32.exeC:\Windows\system32\Gqgdkg32.exe178⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ggqlga32.exeC:\Windows\system32\Ggqlga32.exe179⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Hnkddkcp.exeC:\Windows\system32\Hnkddkcp.exe180⤵
-
C:\Windows\SysWOW64\Hcgmmbag.exeC:\Windows\system32\Hcgmmbag.exe181⤵
-
C:\Windows\SysWOW64\Hjaeil32.exeC:\Windows\system32\Hjaeil32.exe182⤵
-
C:\Windows\SysWOW64\Hqkmffpa.exeC:\Windows\system32\Hqkmffpa.exe183⤵
-
C:\Windows\SysWOW64\Hfhfnm32.exeC:\Windows\system32\Hfhfnm32.exe184⤵
-
C:\Windows\SysWOW64\Hqnjkf32.exeC:\Windows\system32\Hqnjkf32.exe185⤵
-
C:\Windows\SysWOW64\Hghbhpek.exeC:\Windows\system32\Hghbhpek.exe186⤵
-
C:\Windows\SysWOW64\Ijpakjld.exeC:\Windows\system32\Ijpakjld.exe187⤵
-
C:\Windows\SysWOW64\Ideehclj.exeC:\Windows\system32\Ideehclj.exe188⤵
-
C:\Windows\SysWOW64\Inmjqhbj.exeC:\Windows\system32\Inmjqhbj.exe189⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Icjbioqb.exeC:\Windows\system32\Icjbioqb.exe190⤵
-
C:\Windows\SysWOW64\Ijdkei32.exeC:\Windows\system32\Ijdkei32.exe191⤵
-
C:\Windows\SysWOW64\Iqncbcpk.exeC:\Windows\system32\Iqncbcpk.exe192⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Jghkon32.exeC:\Windows\system32\Jghkon32.exe193⤵
-
C:\Windows\SysWOW64\Jnbclh32.exeC:\Windows\system32\Jnbclh32.exe194⤵
-
C:\Windows\SysWOW64\Jcoldo32.exeC:\Windows\system32\Jcoldo32.exe195⤵
-
C:\Windows\SysWOW64\Jjidqidi.exeC:\Windows\system32\Jjidqidi.exe196⤵
-
C:\Windows\SysWOW64\Jaclmc32.exeC:\Windows\system32\Jaclmc32.exe197⤵
-
C:\Windows\SysWOW64\Jjkafhbg.exeC:\Windows\system32\Jjkafhbg.exe198⤵
-
C:\Windows\SysWOW64\Jeqeca32.exeC:\Windows\system32\Jeqeca32.exe199⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Jfbakihk.exeC:\Windows\system32\Jfbakihk.exe200⤵
-
C:\Windows\SysWOW64\Jagfhbga.exeC:\Windows\system32\Jagfhbga.exe201⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Jganel32.exeC:\Windows\system32\Jganel32.exe202⤵
-
C:\Windows\SysWOW64\Jmnfnc32.exeC:\Windows\system32\Jmnfnc32.exe203⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kchojm32.exeC:\Windows\system32\Kchojm32.exe204⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kjbggglo.exeC:\Windows\system32\Kjbggglo.exe205⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kaloca32.exeC:\Windows\system32\Kaloca32.exe206⤵
-
C:\Windows\SysWOW64\Kgfgplkh.exeC:\Windows\system32\Kgfgplkh.exe207⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kmcpibip.exeC:\Windows\system32\Kmcpibip.exe208⤵
-
C:\Windows\SysWOW64\Kcmhemqm.exeC:\Windows\system32\Kcmhemqm.exe209⤵
-
C:\Windows\SysWOW64\Kjgpbg32.exeC:\Windows\system32\Kjgpbg32.exe210⤵
-
C:\Windows\SysWOW64\Keldop32.exeC:\Windows\system32\Keldop32.exe211⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kfnaghnn.exeC:\Windows\system32\Kfnaghnn.exe212⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kmhidb32.exeC:\Windows\system32\Kmhidb32.exe213⤵
-
C:\Windows\SysWOW64\Kcaaqllg.exeC:\Windows\system32\Kcaaqllg.exe214⤵
-
C:\Windows\SysWOW64\Kmjfiach.exeC:\Windows\system32\Kmjfiach.exe215⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Lddnfl32.exeC:\Windows\system32\Lddnfl32.exe216⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Lnibcd32.exeC:\Windows\system32\Lnibcd32.exe217⤵
-
C:\Windows\SysWOW64\Ljemceli.exeC:\Windows\system32\Ljemceli.exe218⤵
-
C:\Windows\SysWOW64\Lejaqnko.exeC:\Windows\system32\Lejaqnko.exe219⤵
-
C:\Windows\SysWOW64\Lflmhf32.exeC:\Windows\system32\Lflmhf32.exe220⤵
-
C:\Windows\SysWOW64\Lmfeepij.exeC:\Windows\system32\Lmfeepij.exe221⤵
-
C:\Windows\SysWOW64\Mhkjbihp.exeC:\Windows\system32\Mhkjbihp.exe222⤵
-
C:\Windows\SysWOW64\Moebocpm.exeC:\Windows\system32\Moebocpm.exe223⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Mdbjgjnd.exeC:\Windows\system32\Mdbjgjnd.exe224⤵
-
C:\Windows\SysWOW64\Mogodbnj.exeC:\Windows\system32\Mogodbnj.exe225⤵
-
C:\Windows\SysWOW64\Meagam32.exeC:\Windows\system32\Meagam32.exe226⤵
-
C:\Windows\SysWOW64\Mknpjc32.exeC:\Windows\system32\Mknpjc32.exe227⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Mahhfn32.exeC:\Windows\system32\Mahhfn32.exe228⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Mhbpchbh.exeC:\Windows\system32\Mhbpchbh.exe229⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Mmohkoqp.exeC:\Windows\system32\Mmohkoqp.exe230⤵
-
C:\Windows\SysWOW64\Mhdmhgpe.exeC:\Windows\system32\Mhdmhgpe.exe231⤵
-
C:\Windows\SysWOW64\Mooeea32.exeC:\Windows\system32\Mooeea32.exe232⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nehmbl32.exeC:\Windows\system32\Nehmbl32.exe233⤵
-
C:\Windows\SysWOW64\Nkeejb32.exeC:\Windows\system32\Nkeejb32.exe234⤵
-
C:\Windows\SysWOW64\Nhifcg32.exeC:\Windows\system32\Nhifcg32.exe235⤵
-
C:\Windows\SysWOW64\Nemfmkkj.exeC:\Windows\system32\Nemfmkkj.exe236⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Nkjoebia.exeC:\Windows\system32\Nkjoebia.exe237⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Nadgbl32.exeC:\Windows\system32\Nadgbl32.exe238⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ngapjc32.exeC:\Windows\system32\Ngapjc32.exe239⤵
-
C:\Windows\SysWOW64\Okhkgp32.exeC:\Windows\system32\Okhkgp32.exe240⤵
-
C:\Windows\SysWOW64\Ohllpd32.exeC:\Windows\system32\Ohllpd32.exe241⤵