Analysis
-
max time kernel
154s -
max time network
35s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
04-05-2021 23:41
Static task
static1
Behavioral task
behavioral1
Sample
aad3a6b6ece07b85cd0f4e8245f4075bbf437fb79dfc4a0755551d6972a296dd.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
aad3a6b6ece07b85cd0f4e8245f4075bbf437fb79dfc4a0755551d6972a296dd.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
aad3a6b6ece07b85cd0f4e8245f4075bbf437fb79dfc4a0755551d6972a296dd.exe
-
Size
13.3MB
-
MD5
fca7c2d766e3406563d178369359f8c1
-
SHA1
fcefdd75304e5f05bba1e95648943eaf1e8b7ce5
-
SHA256
aad3a6b6ece07b85cd0f4e8245f4075bbf437fb79dfc4a0755551d6972a296dd
-
SHA512
2c67588fdd2f5127e998cd09f9417785df85f358da83e7fad3971259781afccaaf06212e11c269faf812d4ad9adce610441141caaa1b36c408cde4b8f11ba4a1
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs
-
Executes dropped EXE 64 IoCs
Processes:
Cnpeef32.exeDeiiqccf.exeEiphef32.exeFpoflb32.exeOngcoolh.exeAgncnc32.exeElnnfk32.exeIpgnkojq.exeJnaehj32.exeNfkniiid.exeNqlejepk.exeHaqnca32.exeIimodn32.exeLehbbefn.exeMahene32.exeDfheanoo.exeElqmecci.exeHekfao32.exeIdlcnj32.exeJibbbm32.exeJildik32.exeMpjookgf.exeOiobhp32.exeEnglfi32.exeEjcffj32.exeFnghem32.exeHhfomdji.exeLlblhheo.exeMafkqnmn.exeCkjmnj32.exeEliegp32.exeMjkljn32.exeMbkjiokk.exeNkikca32.exeOmqjek32.exeOljaag32.exeBhojlj32.exeLifojekm.exeOkjnmn32.exeAqpejgli.exeBibpph32.exeCodnba32.exeDmndnm32.exeEmekol32.exeEcdpmcgi.exeEedinndj.exeFjikmaef.exeFcfiafgb.exeGndcmcpk.exeGgaaqhbf.exeHpaopi32.exeHlmipjmk.exeIankcp32.exeJlmeompf.exeJejccbba.exeJlfhelgl.exeLlhajo32.exeLnpdbf32.exeMnemmede.exeMmjjoahm.exeNladenkb.exeNldqkmip.exeNhpkkn32.exeOmamndea.exepid process 2024 Cnpeef32.exe 2040 Deiiqccf.exe 1988 Eiphef32.exe 1968 Fpoflb32.exe 1692 Ongcoolh.exe 1496 Agncnc32.exe 1444 Elnnfk32.exe 328 Ipgnkojq.exe 748 Jnaehj32.exe 1484 Nfkniiid.exe 1132 Nqlejepk.exe 1360 Haqnca32.exe 1744 Iimodn32.exe 1000 Lehbbefn.exe 1884 Mahene32.exe 1608 Dfheanoo.exe 2016 Elqmecci.exe 944 Hekfao32.exe 948 Idlcnj32.exe 900 Jibbbm32.exe 540 Jildik32.exe 1916 Mpjookgf.exe 1568 Oiobhp32.exe 1684 Englfi32.exe 1700 Ejcffj32.exe 1256 Fnghem32.exe 920 Hhfomdji.exe 1052 Llblhheo.exe 2000 Mafkqnmn.exe 1376 Ckjmnj32.exe 1644 Eliegp32.exe 1976 Mjkljn32.exe 2044 Mbkjiokk.exe 2024 Nkikca32.exe 1888 Omqjek32.exe 1248 Oljaag32.exe 1948 Bhojlj32.exe 1812 Lifojekm.exe 1844 Okjnmn32.exe 1824 Aqpejgli.exe 1496 Bibpph32.exe 1288 Codnba32.exe 472 Dmndnm32.exe 1892 Emekol32.exe 1320 Ecdpmcgi.exe 768 Eedinndj.exe 928 Fjikmaef.exe 1028 Fcfiafgb.exe 1744 Gndcmcpk.exe 1500 Ggaaqhbf.exe 1852 Hpaopi32.exe 1328 Hlmipjmk.exe 868 Iankcp32.exe 624 Jlmeompf.exe 944 Jejccbba.exe 532 Jlfhelgl.exe 2032 Llhajo32.exe 1056 Lnpdbf32.exe 1600 Mnemmede.exe 1000 Mmjjoahm.exe 1388 Nladenkb.exe 1752 Nldqkmip.exe 864 Nhpkkn32.exe 1808 Omamndea.exe -
Loads dropped DLL 64 IoCs
Processes:
aad3a6b6ece07b85cd0f4e8245f4075bbf437fb79dfc4a0755551d6972a296dd.exeCnpeef32.exeDeiiqccf.exeEiphef32.exeFpoflb32.exeOngcoolh.exeAgncnc32.exeElnnfk32.exeIpgnkojq.exeJnaehj32.exeNfkniiid.exeNqlejepk.exeHaqnca32.exeIimodn32.exeLehbbefn.exeMahene32.exeDfheanoo.exeElqmecci.exeHekfao32.exeIdlcnj32.exeJibbbm32.exeJildik32.exeMpjookgf.exeOiobhp32.exeEnglfi32.exeEjcffj32.exeFnghem32.exeHhfomdji.exeLlblhheo.exeMafkqnmn.exeCkjmnj32.exeEliegp32.exepid process 1028 aad3a6b6ece07b85cd0f4e8245f4075bbf437fb79dfc4a0755551d6972a296dd.exe 1028 aad3a6b6ece07b85cd0f4e8245f4075bbf437fb79dfc4a0755551d6972a296dd.exe 2024 Cnpeef32.exe 2024 Cnpeef32.exe 2040 Deiiqccf.exe 2040 Deiiqccf.exe 1988 Eiphef32.exe 1988 Eiphef32.exe 1968 Fpoflb32.exe 1968 Fpoflb32.exe 1692 Ongcoolh.exe 1692 Ongcoolh.exe 1496 Agncnc32.exe 1496 Agncnc32.exe 1444 Elnnfk32.exe 1444 Elnnfk32.exe 328 Ipgnkojq.exe 328 Ipgnkojq.exe 748 Jnaehj32.exe 748 Jnaehj32.exe 1484 Nfkniiid.exe 1484 Nfkniiid.exe 1132 Nqlejepk.exe 1132 Nqlejepk.exe 1360 Haqnca32.exe 1360 Haqnca32.exe 1744 Iimodn32.exe 1744 Iimodn32.exe 1000 Lehbbefn.exe 1000 Lehbbefn.exe 1884 Mahene32.exe 1884 Mahene32.exe 1608 Dfheanoo.exe 1608 Dfheanoo.exe 2016 Elqmecci.exe 2016 Elqmecci.exe 944 Hekfao32.exe 944 Hekfao32.exe 948 Idlcnj32.exe 948 Idlcnj32.exe 900 Jibbbm32.exe 900 Jibbbm32.exe 540 Jildik32.exe 540 Jildik32.exe 1916 Mpjookgf.exe 1916 Mpjookgf.exe 1568 Oiobhp32.exe 1568 Oiobhp32.exe 1684 Englfi32.exe 1684 Englfi32.exe 1700 Ejcffj32.exe 1700 Ejcffj32.exe 1256 Fnghem32.exe 1256 Fnghem32.exe 920 Hhfomdji.exe 920 Hhfomdji.exe 1052 Llblhheo.exe 1052 Llblhheo.exe 2000 Mafkqnmn.exe 2000 Mafkqnmn.exe 1376 Ckjmnj32.exe 1376 Ckjmnj32.exe 1644 Eliegp32.exe 1644 Eliegp32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Gbkgnfbd.exeMfdopp32.exeLfmdnp32.exeFaokjpfd.exeNonboekp.exeNeplhf32.exeLneaqn32.exeMbkjiokk.exeHdigckjm.exeLhmjkaoc.exeOghopm32.exeNdpicm32.exeHbknkl32.exeIbgdfmll.exeHcifgjgc.exeAamfnkai.exeCklmgb32.exeNgkchg32.exeJgidao32.exeMbjbealf.exePfoocjfd.exeCpmhpbkc.exeBplhnoej.exeJildik32.exeFcqhlp32.exeDhnmij32.exeHkaglf32.exeLngnfnji.exeCnpeef32.exeOcimgp32.exeFojhoica.exeFcmiod32.exeGbaken32.exeHipmmg32.exeKnnkpobc.exeJnaehj32.exeMpjookgf.exeGhoegl32.exeEnhacojl.exeMmihhelk.exeBmbemb32.exeEliegp32.exeHlmipjmk.exeBpgljfbl.exePhbgcnig.exeDfheanoo.exeFenmdm32.exeNgdifkpi.exePcaepg32.exeIppdef32.exeCoelaaoi.exeEmemgebh.exeDdeaalpg.exeFacdeo32.exeMkclhl32.exeMfaefd32.exeHhfomdji.exeMjkljn32.exeHhgdkjol.exeKmefooki.exeDldhdc32.exeMmjjoahm.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Gobgcg32.exe Gbkgnfbd.exe File created C:\Windows\SysWOW64\Mbkpeake.exe Mfdopp32.exe File created C:\Windows\SysWOW64\Acjgoa32.dll Lfmdnp32.exe File created C:\Windows\SysWOW64\Fmekoalh.exe Faokjpfd.exe File created C:\Windows\SysWOW64\Nncopa32.exe Nonboekp.exe File created C:\Windows\SysWOW64\Dfglke32.dll Neplhf32.exe File created C:\Windows\SysWOW64\Lngnfnji.exe Lneaqn32.exe File opened for modification C:\Windows\SysWOW64\Nkikca32.exe Mbkjiokk.exe File created C:\Windows\SysWOW64\Chgnpi32.dll Hdigckjm.exe File created C:\Windows\SysWOW64\Leajdfnm.exe Lhmjkaoc.exe File created C:\Windows\SysWOW64\Ohhkjp32.exe Oghopm32.exe File opened for modification C:\Windows\SysWOW64\Npgihn32.exe Ndpicm32.exe File created C:\Windows\SysWOW64\Ibebjn32.dll Hbknkl32.exe File opened for modification C:\Windows\SysWOW64\Imhkgibb.exe Ibgdfmll.exe File created C:\Windows\SysWOW64\Ikbgmj32.exe Hcifgjgc.exe File created C:\Windows\SysWOW64\Fikjha32.dll Aamfnkai.exe File created C:\Windows\SysWOW64\Qfjnod32.dll Cklmgb32.exe File created C:\Windows\SysWOW64\Ngnqng32.exe Ngkchg32.exe File created C:\Windows\SysWOW64\Hdnaeh32.dll Jgidao32.exe File opened for modification C:\Windows\SysWOW64\Nonboekp.exe Mbjbealf.exe File opened for modification C:\Windows\SysWOW64\Pbfpik32.exe Pfoocjfd.exe File created C:\Windows\SysWOW64\Aoadmo32.dll Cpmhpbkc.exe File opened for modification C:\Windows\SysWOW64\Bpnddn32.exe Bplhnoej.exe File opened for modification C:\Windows\SysWOW64\Mpjookgf.exe Jildik32.exe File opened for modification C:\Windows\SysWOW64\Fhbjofbn.exe Fcqhlp32.exe File created C:\Windows\SysWOW64\Djmicm32.exe Dhnmij32.exe File created C:\Windows\SysWOW64\Obojmk32.dll Hkaglf32.exe File opened for modification C:\Windows\SysWOW64\Ljnnko32.exe Lngnfnji.exe File opened for modification C:\Windows\SysWOW64\Deiiqccf.exe Cnpeef32.exe File opened for modification C:\Windows\SysWOW64\Oqmmpd32.exe Ocimgp32.exe File created C:\Windows\SysWOW64\Gkaidjhe.exe Fojhoica.exe File created C:\Windows\SysWOW64\Femeig32.exe Fcmiod32.exe File opened for modification C:\Windows\SysWOW64\Gpelnb32.exe Gbaken32.exe File opened for modification C:\Windows\SysWOW64\Hegnahjo.exe Hipmmg32.exe File created C:\Windows\SysWOW64\Jppgpfpi.dll Knnkpobc.exe File opened for modification C:\Windows\SysWOW64\Nfkniiid.exe Jnaehj32.exe File created C:\Windows\SysWOW64\Cjobbd32.dll Mpjookgf.exe File created C:\Windows\SysWOW64\Hcifgjgc.exe Ghoegl32.exe File created C:\Windows\SysWOW64\Fdilpjih.dll Enhacojl.exe File created C:\Windows\SysWOW64\Mkmhaj32.exe Mmihhelk.exe File created C:\Windows\SysWOW64\Enfgfh32.exe Bmbemb32.exe File opened for modification C:\Windows\SysWOW64\Mjkljn32.exe Eliegp32.exe File opened for modification C:\Windows\SysWOW64\Iankcp32.exe Hlmipjmk.exe File created C:\Windows\SysWOW64\Ieegebch.dll Ngkchg32.exe File created C:\Windows\SysWOW64\Fnnkng32.dll Bpgljfbl.exe File opened for modification C:\Windows\SysWOW64\Pqnlhpfb.exe Phbgcnig.exe File created C:\Windows\SysWOW64\Ehnnlg32.dll Jnaehj32.exe File opened for modification C:\Windows\SysWOW64\Elqmecci.exe Dfheanoo.exe File created C:\Windows\SysWOW64\Fbamma32.exe Fenmdm32.exe File created C:\Windows\SysWOW64\Ndhipoob.exe Ngdifkpi.exe File opened for modification C:\Windows\SysWOW64\Pkljdj32.exe Pcaepg32.exe File created C:\Windows\SysWOW64\Pndopa32.dll Ippdef32.exe File created C:\Windows\SysWOW64\Cklmgb32.exe Coelaaoi.exe File opened for modification C:\Windows\SysWOW64\Eilnmf32.exe Ememgebh.exe File created C:\Windows\SysWOW64\Cillgpen.dll Ddeaalpg.exe File created C:\Windows\SysWOW64\Fioija32.exe Facdeo32.exe File created C:\Windows\SysWOW64\Gfadgaio.dll Mkclhl32.exe File created C:\Windows\SysWOW64\Nbhfke32.exe Mfaefd32.exe File created C:\Windows\SysWOW64\Enfepddf.dll Hhfomdji.exe File created C:\Windows\SysWOW64\Mbkjiokk.exe Mjkljn32.exe File created C:\Windows\SysWOW64\Mkcggqfg.dll Hhgdkjol.exe File created C:\Windows\SysWOW64\Qjfhfnim.dll Kmefooki.exe File created C:\Windows\SysWOW64\Delmmigh.exe Dldhdc32.exe File created C:\Windows\SysWOW64\Njeeja32.dll Mmjjoahm.exe -
Modifies registry class 64 IoCs
Processes:
Hlmipjmk.exeJjpcbe32.exeJnkakl32.exeElqmecci.exeMhinhm32.exeKkolkk32.exeElnnfk32.exeLehbbefn.exeOkjnmn32.exeFacdeo32.exeHlqdei32.exeInifnq32.exeBplhnoej.exeOmamndea.exeMnkplc32.exeEokcjmda.exeCpnojioo.exePnimnfpc.exeOiakgcnl.exeJejccbba.exeFmekoalh.exeLeajdfnm.exeLbfdaigg.exeGjngmmnp.exeEnhacojl.exeNqlejepk.exeEmekol32.exeNncopa32.exeFiaeoang.exeGegfdb32.exeQpecfc32.exeCjfccn32.exeCgpjlnhh.exeKnnkpobc.exeOiobhp32.exeNldqkmip.exeKaklpcoc.exeEedinndj.exeJnmjok32.exeIgchlf32.exeIoaifhid.exeHbknkl32.exeLijgflqe.exeLollckbk.exeCklmgb32.exeMhhfdo32.exeNlekia32.exeHppfog32.exePgckjk32.exePfoocjfd.exeGjijqa32.exeGpelnb32.exeAljenp32.exeKfbhdbil.exeKljqgc32.exeKpkofpgq.exeCoelaaoi.exePkljdj32.exeGfmdao32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dibian32.dll" Hlmipjmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nafmbhpm.dll" Jjpcbe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jnkakl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Elqmecci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmkonj32.dll" Mhinhm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kkolkk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Elnnfk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lehbbefn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Okjnmn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Facdeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjapln32.dll" Hlqdei32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Inifnq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bplhnoej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Omamndea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mhinhm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahheab32.dll" Mnkplc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eokcjmda.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fahgfoih.dll" Cpnojioo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pnimnfpc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oifckj32.dll" Oiakgcnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jejccbba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fmekoalh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Minceo32.dll" Leajdfnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkcfcoqm.dll" Lbfdaigg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gjngmmnp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Enhacojl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pckhpcei.dll" Nqlejepk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbaandla.dll" Emekol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enooko32.dll" Nncopa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fiaeoang.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gegfdb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmfmjjgm.dll" Qpecfc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cjfccn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cgpjlnhh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Knnkpobc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oiobhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhclpcec.dll" Nldqkmip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kaklpcoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gjngmmnp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nqlejepk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beodkf32.dll" Eedinndj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gajlmdcf.dll" Jnmjok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Igchlf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ioaifhid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibebjn32.dll" Hbknkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lijgflqe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgeegb32.dll" Lollckbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfjnod32.dll" Cklmgb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mhhfdo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhhiii32.dll" Nlekia32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hppfog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppdghpph.dll" Pgckjk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hlmipjmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qahefm32.dll" Gegfdb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pfoocjfd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gjijqa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gpelnb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aljenp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kfbhdbil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kljqgc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kpkofpgq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Coelaaoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apofpf32.dll" Pkljdj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gfmdao32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
aad3a6b6ece07b85cd0f4e8245f4075bbf437fb79dfc4a0755551d6972a296dd.exeCnpeef32.exeDeiiqccf.exeEiphef32.exeFpoflb32.exeOngcoolh.exeAgncnc32.exeElnnfk32.exeIpgnkojq.exeJnaehj32.exeNfkniiid.exeNqlejepk.exeHaqnca32.exeIimodn32.exeLehbbefn.exeMahene32.exedescription pid process target process PID 1028 wrote to memory of 2024 1028 aad3a6b6ece07b85cd0f4e8245f4075bbf437fb79dfc4a0755551d6972a296dd.exe Cnpeef32.exe PID 1028 wrote to memory of 2024 1028 aad3a6b6ece07b85cd0f4e8245f4075bbf437fb79dfc4a0755551d6972a296dd.exe Cnpeef32.exe PID 1028 wrote to memory of 2024 1028 aad3a6b6ece07b85cd0f4e8245f4075bbf437fb79dfc4a0755551d6972a296dd.exe Cnpeef32.exe PID 1028 wrote to memory of 2024 1028 aad3a6b6ece07b85cd0f4e8245f4075bbf437fb79dfc4a0755551d6972a296dd.exe Cnpeef32.exe PID 2024 wrote to memory of 2040 2024 Cnpeef32.exe Deiiqccf.exe PID 2024 wrote to memory of 2040 2024 Cnpeef32.exe Deiiqccf.exe PID 2024 wrote to memory of 2040 2024 Cnpeef32.exe Deiiqccf.exe PID 2024 wrote to memory of 2040 2024 Cnpeef32.exe Deiiqccf.exe PID 2040 wrote to memory of 1988 2040 Deiiqccf.exe Eiphef32.exe PID 2040 wrote to memory of 1988 2040 Deiiqccf.exe Eiphef32.exe PID 2040 wrote to memory of 1988 2040 Deiiqccf.exe Eiphef32.exe PID 2040 wrote to memory of 1988 2040 Deiiqccf.exe Eiphef32.exe PID 1988 wrote to memory of 1968 1988 Eiphef32.exe Fpoflb32.exe PID 1988 wrote to memory of 1968 1988 Eiphef32.exe Fpoflb32.exe PID 1988 wrote to memory of 1968 1988 Eiphef32.exe Fpoflb32.exe PID 1988 wrote to memory of 1968 1988 Eiphef32.exe Fpoflb32.exe PID 1968 wrote to memory of 1692 1968 Fpoflb32.exe Ongcoolh.exe PID 1968 wrote to memory of 1692 1968 Fpoflb32.exe Ongcoolh.exe PID 1968 wrote to memory of 1692 1968 Fpoflb32.exe Ongcoolh.exe PID 1968 wrote to memory of 1692 1968 Fpoflb32.exe Ongcoolh.exe PID 1692 wrote to memory of 1496 1692 Ongcoolh.exe Agncnc32.exe PID 1692 wrote to memory of 1496 1692 Ongcoolh.exe Agncnc32.exe PID 1692 wrote to memory of 1496 1692 Ongcoolh.exe Agncnc32.exe PID 1692 wrote to memory of 1496 1692 Ongcoolh.exe Agncnc32.exe PID 1496 wrote to memory of 1444 1496 Agncnc32.exe Elnnfk32.exe PID 1496 wrote to memory of 1444 1496 Agncnc32.exe Elnnfk32.exe PID 1496 wrote to memory of 1444 1496 Agncnc32.exe Elnnfk32.exe PID 1496 wrote to memory of 1444 1496 Agncnc32.exe Elnnfk32.exe PID 1444 wrote to memory of 328 1444 Elnnfk32.exe Ipgnkojq.exe PID 1444 wrote to memory of 328 1444 Elnnfk32.exe Ipgnkojq.exe PID 1444 wrote to memory of 328 1444 Elnnfk32.exe Ipgnkojq.exe PID 1444 wrote to memory of 328 1444 Elnnfk32.exe Ipgnkojq.exe PID 328 wrote to memory of 748 328 Ipgnkojq.exe Jnaehj32.exe PID 328 wrote to memory of 748 328 Ipgnkojq.exe Jnaehj32.exe PID 328 wrote to memory of 748 328 Ipgnkojq.exe Jnaehj32.exe PID 328 wrote to memory of 748 328 Ipgnkojq.exe Jnaehj32.exe PID 748 wrote to memory of 1484 748 Jnaehj32.exe Nfkniiid.exe PID 748 wrote to memory of 1484 748 Jnaehj32.exe Nfkniiid.exe PID 748 wrote to memory of 1484 748 Jnaehj32.exe Nfkniiid.exe PID 748 wrote to memory of 1484 748 Jnaehj32.exe Nfkniiid.exe PID 1484 wrote to memory of 1132 1484 Nfkniiid.exe Nqlejepk.exe PID 1484 wrote to memory of 1132 1484 Nfkniiid.exe Nqlejepk.exe PID 1484 wrote to memory of 1132 1484 Nfkniiid.exe Nqlejepk.exe PID 1484 wrote to memory of 1132 1484 Nfkniiid.exe Nqlejepk.exe PID 1132 wrote to memory of 1360 1132 Nqlejepk.exe Haqnca32.exe PID 1132 wrote to memory of 1360 1132 Nqlejepk.exe Haqnca32.exe PID 1132 wrote to memory of 1360 1132 Nqlejepk.exe Haqnca32.exe PID 1132 wrote to memory of 1360 1132 Nqlejepk.exe Haqnca32.exe PID 1360 wrote to memory of 1744 1360 Haqnca32.exe Iimodn32.exe PID 1360 wrote to memory of 1744 1360 Haqnca32.exe Iimodn32.exe PID 1360 wrote to memory of 1744 1360 Haqnca32.exe Iimodn32.exe PID 1360 wrote to memory of 1744 1360 Haqnca32.exe Iimodn32.exe PID 1744 wrote to memory of 1000 1744 Iimodn32.exe Lehbbefn.exe PID 1744 wrote to memory of 1000 1744 Iimodn32.exe Lehbbefn.exe PID 1744 wrote to memory of 1000 1744 Iimodn32.exe Lehbbefn.exe PID 1744 wrote to memory of 1000 1744 Iimodn32.exe Lehbbefn.exe PID 1000 wrote to memory of 1884 1000 Lehbbefn.exe Mahene32.exe PID 1000 wrote to memory of 1884 1000 Lehbbefn.exe Mahene32.exe PID 1000 wrote to memory of 1884 1000 Lehbbefn.exe Mahene32.exe PID 1000 wrote to memory of 1884 1000 Lehbbefn.exe Mahene32.exe PID 1884 wrote to memory of 1608 1884 Mahene32.exe Dfheanoo.exe PID 1884 wrote to memory of 1608 1884 Mahene32.exe Dfheanoo.exe PID 1884 wrote to memory of 1608 1884 Mahene32.exe Dfheanoo.exe PID 1884 wrote to memory of 1608 1884 Mahene32.exe Dfheanoo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aad3a6b6ece07b85cd0f4e8245f4075bbf437fb79dfc4a0755551d6972a296dd.exe"C:\Users\Admin\AppData\Local\Temp\aad3a6b6ece07b85cd0f4e8245f4075bbf437fb79dfc4a0755551d6972a296dd.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\Cnpeef32.exeC:\Windows\system32\Cnpeef32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\Deiiqccf.exeC:\Windows\system32\Deiiqccf.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\Eiphef32.exeC:\Windows\system32\Eiphef32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\Fpoflb32.exeC:\Windows\system32\Fpoflb32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\Ongcoolh.exeC:\Windows\system32\Ongcoolh.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\Agncnc32.exeC:\Windows\system32\Agncnc32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\Elnnfk32.exeC:\Windows\system32\Elnnfk32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\Ipgnkojq.exeC:\Windows\system32\Ipgnkojq.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Windows\SysWOW64\Jnaehj32.exeC:\Windows\system32\Jnaehj32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\Nfkniiid.exeC:\Windows\system32\Nfkniiid.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\Nqlejepk.exeC:\Windows\system32\Nqlejepk.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\Haqnca32.exeC:\Windows\system32\Haqnca32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\Iimodn32.exeC:\Windows\system32\Iimodn32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\Lehbbefn.exeC:\Windows\system32\Lehbbefn.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\Mahene32.exeC:\Windows\system32\Mahene32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\Dfheanoo.exeC:\Windows\system32\Dfheanoo.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1608 -
C:\Windows\SysWOW64\Elqmecci.exeC:\Windows\system32\Elqmecci.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2016 -
C:\Windows\SysWOW64\Hekfao32.exeC:\Windows\system32\Hekfao32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Windows\SysWOW64\Idlcnj32.exeC:\Windows\system32\Idlcnj32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Windows\SysWOW64\Jibbbm32.exeC:\Windows\system32\Jibbbm32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Windows\SysWOW64\Jildik32.exeC:\Windows\system32\Jildik32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:540 -
C:\Windows\SysWOW64\Mpjookgf.exeC:\Windows\system32\Mpjookgf.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1916 -
C:\Windows\SysWOW64\Oiobhp32.exeC:\Windows\system32\Oiobhp32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1568 -
C:\Windows\SysWOW64\Englfi32.exeC:\Windows\system32\Englfi32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Windows\SysWOW64\Ejcffj32.exeC:\Windows\system32\Ejcffj32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Windows\SysWOW64\Fnghem32.exeC:\Windows\system32\Fnghem32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Windows\SysWOW64\Hhfomdji.exeC:\Windows\system32\Hhfomdji.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:920 -
C:\Windows\SysWOW64\Llblhheo.exeC:\Windows\system32\Llblhheo.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Windows\SysWOW64\Mafkqnmn.exeC:\Windows\system32\Mafkqnmn.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Windows\SysWOW64\Ckjmnj32.exeC:\Windows\system32\Ckjmnj32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Windows\SysWOW64\Eliegp32.exeC:\Windows\system32\Eliegp32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1644 -
C:\Windows\SysWOW64\Mjkljn32.exeC:\Windows\system32\Mjkljn32.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1976 -
C:\Windows\SysWOW64\Mbkjiokk.exeC:\Windows\system32\Mbkjiokk.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2044 -
C:\Windows\SysWOW64\Nkikca32.exeC:\Windows\system32\Nkikca32.exe35⤵
- Executes dropped EXE
PID:2024 -
C:\Windows\SysWOW64\Omqjek32.exeC:\Windows\system32\Omqjek32.exe36⤵
- Executes dropped EXE
PID:1888 -
C:\Windows\SysWOW64\Oljaag32.exeC:\Windows\system32\Oljaag32.exe37⤵
- Executes dropped EXE
PID:1248 -
C:\Windows\SysWOW64\Bhojlj32.exeC:\Windows\system32\Bhojlj32.exe38⤵
- Executes dropped EXE
PID:1948 -
C:\Windows\SysWOW64\Lifojekm.exeC:\Windows\system32\Lifojekm.exe39⤵
- Executes dropped EXE
PID:1812 -
C:\Windows\SysWOW64\Okjnmn32.exeC:\Windows\system32\Okjnmn32.exe40⤵
- Executes dropped EXE
- Modifies registry class
PID:1844 -
C:\Windows\SysWOW64\Aqpejgli.exeC:\Windows\system32\Aqpejgli.exe41⤵
- Executes dropped EXE
PID:1824 -
C:\Windows\SysWOW64\Bibpph32.exeC:\Windows\system32\Bibpph32.exe42⤵
- Executes dropped EXE
PID:1496 -
C:\Windows\SysWOW64\Codnba32.exeC:\Windows\system32\Codnba32.exe43⤵
- Executes dropped EXE
PID:1288 -
C:\Windows\SysWOW64\Dmndnm32.exeC:\Windows\system32\Dmndnm32.exe44⤵
- Executes dropped EXE
PID:472 -
C:\Windows\SysWOW64\Emekol32.exeC:\Windows\system32\Emekol32.exe45⤵
- Executes dropped EXE
- Modifies registry class
PID:1892 -
C:\Windows\SysWOW64\Ecdpmcgi.exeC:\Windows\system32\Ecdpmcgi.exe46⤵
- Executes dropped EXE
PID:1320 -
C:\Windows\SysWOW64\Eedinndj.exeC:\Windows\system32\Eedinndj.exe47⤵
- Executes dropped EXE
- Modifies registry class
PID:768 -
C:\Windows\SysWOW64\Fjikmaef.exeC:\Windows\system32\Fjikmaef.exe48⤵
- Executes dropped EXE
PID:928 -
C:\Windows\SysWOW64\Fcfiafgb.exeC:\Windows\system32\Fcfiafgb.exe49⤵
- Executes dropped EXE
PID:1028 -
C:\Windows\SysWOW64\Gndcmcpk.exeC:\Windows\system32\Gndcmcpk.exe50⤵
- Executes dropped EXE
PID:1744 -
C:\Windows\SysWOW64\Ggaaqhbf.exeC:\Windows\system32\Ggaaqhbf.exe51⤵
- Executes dropped EXE
PID:1500 -
C:\Windows\SysWOW64\Hpaopi32.exeC:\Windows\system32\Hpaopi32.exe52⤵
- Executes dropped EXE
PID:1852 -
C:\Windows\SysWOW64\Hlmipjmk.exeC:\Windows\system32\Hlmipjmk.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1328 -
C:\Windows\SysWOW64\Iankcp32.exeC:\Windows\system32\Iankcp32.exe54⤵
- Executes dropped EXE
PID:868 -
C:\Windows\SysWOW64\Jlmeompf.exeC:\Windows\system32\Jlmeompf.exe55⤵
- Executes dropped EXE
PID:624 -
C:\Windows\SysWOW64\Jejccbba.exeC:\Windows\system32\Jejccbba.exe56⤵
- Executes dropped EXE
- Modifies registry class
PID:944 -
C:\Windows\SysWOW64\Jlfhelgl.exeC:\Windows\system32\Jlfhelgl.exe57⤵
- Executes dropped EXE
PID:532 -
C:\Windows\SysWOW64\Llhajo32.exeC:\Windows\system32\Llhajo32.exe58⤵
- Executes dropped EXE
PID:2032 -
C:\Windows\SysWOW64\Lnpdbf32.exeC:\Windows\system32\Lnpdbf32.exe59⤵
- Executes dropped EXE
PID:1056 -
C:\Windows\SysWOW64\Mnemmede.exeC:\Windows\system32\Mnemmede.exe60⤵
- Executes dropped EXE
PID:1600 -
C:\Windows\SysWOW64\Mmjjoahm.exeC:\Windows\system32\Mmjjoahm.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1000 -
C:\Windows\SysWOW64\Nladenkb.exeC:\Windows\system32\Nladenkb.exe62⤵
- Executes dropped EXE
PID:1388 -
C:\Windows\SysWOW64\Nldqkmip.exeC:\Windows\system32\Nldqkmip.exe63⤵
- Executes dropped EXE
- Modifies registry class
PID:1752 -
C:\Windows\SysWOW64\Nhpkkn32.exeC:\Windows\system32\Nhpkkn32.exe64⤵
- Executes dropped EXE
PID:864 -
C:\Windows\SysWOW64\Omamndea.exeC:\Windows\system32\Omamndea.exe65⤵
- Executes dropped EXE
- Modifies registry class
PID:1808 -
C:\Windows\SysWOW64\Ohogja32.exeC:\Windows\system32\Ohogja32.exe66⤵PID:292
-
C:\Windows\SysWOW64\Palenf32.exeC:\Windows\system32\Palenf32.exe67⤵PID:540
-
C:\Windows\SysWOW64\Ahfiic32.exeC:\Windows\system32\Ahfiic32.exe68⤵PID:596
-
C:\Windows\SysWOW64\Bjcemjeo.exeC:\Windows\system32\Bjcemjeo.exe69⤵PID:1336
-
C:\Windows\SysWOW64\Cajmch32.exeC:\Windows\system32\Cajmch32.exe70⤵PID:1580
-
C:\Windows\SysWOW64\Cnajbloq.exeC:\Windows\system32\Cnajbloq.exe71⤵PID:1984
-
C:\Windows\SysWOW64\Cmfgchch.exeC:\Windows\system32\Cmfgchch.exe72⤵PID:1640
-
C:\Windows\SysWOW64\Dhikjdgm.exeC:\Windows\system32\Dhikjdgm.exe73⤵PID:1788
-
C:\Windows\SysWOW64\Ecjbkanc.exeC:\Windows\system32\Ecjbkanc.exe74⤵PID:1828
-
C:\Windows\SysWOW64\Faalamqi.exeC:\Windows\system32\Faalamqi.exe75⤵PID:896
-
C:\Windows\SysWOW64\Fcqhlp32.exeC:\Windows\system32\Fcqhlp32.exe76⤵
- Drops file in System32 directory
PID:964 -
C:\Windows\SysWOW64\Fhbjofbn.exeC:\Windows\system32\Fhbjofbn.exe77⤵PID:1952
-
C:\Windows\SysWOW64\Gfmdao32.exeC:\Windows\system32\Gfmdao32.exe78⤵
- Modifies registry class
PID:1832 -
C:\Windows\SysWOW64\Ghpjhjfl.exeC:\Windows\system32\Ghpjhjfl.exe79⤵PID:1572
-
C:\Windows\SysWOW64\Hdigckjm.exeC:\Windows\system32\Hdigckjm.exe80⤵
- Drops file in System32 directory
PID:1612 -
C:\Windows\SysWOW64\Hemqnj32.exeC:\Windows\system32\Hemqnj32.exe81⤵PID:1760
-
C:\Windows\SysWOW64\Ijobappj.exeC:\Windows\system32\Ijobappj.exe82⤵PID:1816
-
C:\Windows\SysWOW64\Ippdef32.exeC:\Windows\system32\Ippdef32.exe83⤵
- Drops file in System32 directory
PID:1008 -
C:\Windows\SysWOW64\Jmmklo32.exeC:\Windows\system32\Jmmklo32.exe84⤵PID:1864
-
C:\Windows\SysWOW64\Lnkcmphd.exeC:\Windows\system32\Lnkcmphd.exe85⤵PID:572
-
C:\Windows\SysWOW64\Mhinhm32.exeC:\Windows\system32\Mhinhm32.exe86⤵
- Modifies registry class
PID:1300 -
C:\Windows\SysWOW64\Mnkplc32.exeC:\Windows\system32\Mnkplc32.exe87⤵
- Modifies registry class
PID:1568 -
C:\Windows\SysWOW64\Nqpbhndl.exeC:\Windows\system32\Nqpbhndl.exe88⤵PID:1704
-
C:\Windows\SysWOW64\Ngcqcldl.exeC:\Windows\system32\Ngcqcldl.exe89⤵PID:1664
-
C:\Windows\SysWOW64\Oibmnoko.exeC:\Windows\system32\Oibmnoko.exe90⤵PID:848
-
C:\Windows\SysWOW64\Oapoga32.exeC:\Windows\system32\Oapoga32.exe91⤵PID:1700
-
C:\Windows\SysWOW64\Pbfdji32.exeC:\Windows\system32\Pbfdji32.exe92⤵PID:432
-
C:\Windows\SysWOW64\Poaoji32.exeC:\Windows\system32\Poaoji32.exe93⤵PID:948
-
C:\Windows\SysWOW64\Plhlimgf.exeC:\Windows\system32\Plhlimgf.exe94⤵PID:2016
-
C:\Windows\SysWOW64\Acjjdkgf.exeC:\Windows\system32\Acjjdkgf.exe95⤵PID:672
-
C:\Windows\SysWOW64\Aljenp32.exeC:\Windows\system32\Aljenp32.exe96⤵
- Modifies registry class
PID:1668 -
C:\Windows\SysWOW64\Bnddlgeb.exeC:\Windows\system32\Bnddlgeb.exe97⤵PID:1800
-
C:\Windows\SysWOW64\Cfdbkh32.exeC:\Windows\system32\Cfdbkh32.exe98⤵PID:1756
-
C:\Windows\SysWOW64\Cellbd32.exeC:\Windows\system32\Cellbd32.exe99⤵PID:384
-
C:\Windows\SysWOW64\Decbbcke.exeC:\Windows\system32\Decbbcke.exe100⤵PID:1972
-
C:\Windows\SysWOW64\Dajcgdqi.exeC:\Windows\system32\Dajcgdqi.exe101⤵PID:1784
-
C:\Windows\SysWOW64\Dcjlipnj.exeC:\Windows\system32\Dcjlipnj.exe102⤵PID:1284
-
C:\Windows\SysWOW64\Epalnqco.exeC:\Windows\system32\Epalnqco.exe103⤵PID:1020
-
C:\Windows\SysWOW64\Ememgebh.exeC:\Windows\system32\Ememgebh.exe104⤵
- Drops file in System32 directory
PID:576 -
C:\Windows\SysWOW64\Eilnmf32.exeC:\Windows\system32\Eilnmf32.exe105⤵PID:2000
-
C:\Windows\SysWOW64\Eokcjmda.exeC:\Windows\system32\Eokcjmda.exe106⤵
- Modifies registry class
PID:1564 -
C:\Windows\SysWOW64\Eompplbo.exeC:\Windows\system32\Eompplbo.exe107⤵PID:1408
-
C:\Windows\SysWOW64\Fdmdnc32.exeC:\Windows\system32\Fdmdnc32.exe108⤵PID:1036
-
C:\Windows\SysWOW64\Fhccbemm.exeC:\Windows\system32\Fhccbemm.exe109⤵PID:1764
-
C:\Windows\SysWOW64\Gdajhe32.exeC:\Windows\system32\Gdajhe32.exe110⤵PID:2040
-
C:\Windows\SysWOW64\Hbpnenbd.exeC:\Windows\system32\Hbpnenbd.exe111⤵PID:1944
-
C:\Windows\SysWOW64\Ibgdfmll.exeC:\Windows\system32\Ibgdfmll.exe112⤵
- Drops file in System32 directory
PID:912 -
C:\Windows\SysWOW64\Imhkgibb.exeC:\Windows\system32\Imhkgibb.exe113⤵PID:344
-
C:\Windows\SysWOW64\Jpmmcd32.exeC:\Windows\system32\Jpmmcd32.exe114⤵PID:1632
-
C:\Windows\SysWOW64\Kfbhdbil.exeC:\Windows\system32\Kfbhdbil.exe115⤵
- Modifies registry class
PID:2056 -
C:\Windows\SysWOW64\Lijgflqe.exeC:\Windows\system32\Lijgflqe.exe116⤵
- Modifies registry class
PID:2064 -
C:\Windows\SysWOW64\Mlfclkdg.exeC:\Windows\system32\Mlfclkdg.exe117⤵PID:2072
-
C:\Windows\SysWOW64\Mjjceocq.exeC:\Windows\system32\Mjjceocq.exe118⤵PID:2080
-
C:\Windows\SysWOW64\Mgndoc32.exeC:\Windows\system32\Mgndoc32.exe119⤵PID:2088
-
C:\Windows\SysWOW64\Mfcappfb.exeC:\Windows\system32\Mfcappfb.exe120⤵PID:2096
-
C:\Windows\SysWOW64\Mbjbealf.exeC:\Windows\system32\Mbjbealf.exe121⤵
- Drops file in System32 directory
PID:2104 -
C:\Windows\SysWOW64\Nonboekp.exeC:\Windows\system32\Nonboekp.exe122⤵
- Drops file in System32 directory
PID:2112 -
C:\Windows\SysWOW64\Nncopa32.exeC:\Windows\system32\Nncopa32.exe123⤵
- Modifies registry class
PID:2120 -
C:\Windows\SysWOW64\Ngkchg32.exeC:\Windows\system32\Ngkchg32.exe124⤵
- Drops file in System32 directory
PID:2128 -
C:\Windows\SysWOW64\Ngnqng32.exeC:\Windows\system32\Ngnqng32.exe125⤵PID:2136
-
C:\Windows\SysWOW64\Ngpmcfbc.exeC:\Windows\system32\Ngpmcfbc.exe126⤵PID:2144
-
C:\Windows\SysWOW64\Oflpebac.exeC:\Windows\system32\Oflpebac.exe127⤵PID:2152
-
C:\Windows\SysWOW64\Qpijhj32.exeC:\Windows\system32\Qpijhj32.exe128⤵PID:2160
-
C:\Windows\SysWOW64\Apfjan32.exeC:\Windows\system32\Apfjan32.exe129⤵PID:2168
-
C:\Windows\SysWOW64\Bpkcmmfb.exeC:\Windows\system32\Bpkcmmfb.exe130⤵PID:2176
-
C:\Windows\SysWOW64\Blfmmmha.exeC:\Windows\system32\Blfmmmha.exe131⤵PID:2184
-
C:\Windows\SysWOW64\Cmdmfamo.exeC:\Windows\system32\Cmdmfamo.exe132⤵PID:2192
-
C:\Windows\SysWOW64\Daoefcgd.exeC:\Windows\system32\Daoefcgd.exe133⤵PID:2200
-
C:\Windows\SysWOW64\Ecehbm32.exeC:\Windows\system32\Ecehbm32.exe134⤵PID:2208
-
C:\Windows\SysWOW64\Eplhgn32.exeC:\Windows\system32\Eplhgn32.exe135⤵PID:2216
-
C:\Windows\SysWOW64\Empiab32.exeC:\Windows\system32\Empiab32.exe136⤵PID:2224
-
C:\Windows\SysWOW64\Fbakdiop.exeC:\Windows\system32\Fbakdiop.exe137⤵PID:2232
-
C:\Windows\SysWOW64\Fbcgjh32.exeC:\Windows\system32\Fbcgjh32.exe138⤵PID:2240
-
C:\Windows\SysWOW64\Fojhoica.exeC:\Windows\system32\Fojhoica.exe139⤵
- Drops file in System32 directory
PID:2248 -
C:\Windows\SysWOW64\Gkaidjhe.exeC:\Windows\system32\Gkaidjhe.exe140⤵PID:2256
-
C:\Windows\SysWOW64\Hlnega32.exeC:\Windows\system32\Hlnega32.exe141⤵PID:2264
-
C:\Windows\SysWOW64\Igainn32.exeC:\Windows\system32\Igainn32.exe142⤵PID:2272
-
C:\Windows\SysWOW64\Jeplkf32.exeC:\Windows\system32\Jeplkf32.exe143⤵PID:2280
-
C:\Windows\SysWOW64\Jnmjok32.exeC:\Windows\system32\Jnmjok32.exe144⤵
- Modifies registry class
PID:2288 -
C:\Windows\SysWOW64\Kljqgc32.exeC:\Windows\system32\Kljqgc32.exe145⤵
- Modifies registry class
PID:2296 -
C:\Windows\SysWOW64\Lfmdnp32.exeC:\Windows\system32\Lfmdnp32.exe146⤵
- Drops file in System32 directory
PID:2304 -
C:\Windows\SysWOW64\Limmokib.exeC:\Windows\system32\Limmokib.exe147⤵PID:2312
-
C:\Windows\SysWOW64\Lkmjin32.exeC:\Windows\system32\Lkmjin32.exe148⤵PID:2320
-
C:\Windows\SysWOW64\Lgdjnofi.exeC:\Windows\system32\Lgdjnofi.exe149⤵PID:2336
-
C:\Windows\SysWOW64\Pbkpna32.exeC:\Windows\system32\Pbkpna32.exe150⤵PID:2344
-
C:\Windows\SysWOW64\Aplpai32.exeC:\Windows\system32\Aplpai32.exe151⤵PID:2352
-
C:\Windows\SysWOW64\Alhjai32.exeC:\Windows\system32\Alhjai32.exe152⤵PID:2360
-
C:\Windows\SysWOW64\Bloqah32.exeC:\Windows\system32\Bloqah32.exe153⤵PID:2368
-
C:\Windows\SysWOW64\Bdlblj32.exeC:\Windows\system32\Bdlblj32.exe154⤵PID:2376
-
C:\Windows\SysWOW64\Bpcbqk32.exeC:\Windows\system32\Bpcbqk32.exe155⤵PID:2384
-
C:\Windows\SysWOW64\Cpeofk32.exeC:\Windows\system32\Cpeofk32.exe156⤵PID:2392
-
C:\Windows\SysWOW64\Clcflkic.exeC:\Windows\system32\Clcflkic.exe157⤵PID:2400
-
C:\Windows\SysWOW64\Dhmcfkme.exeC:\Windows\system32\Dhmcfkme.exe158⤵PID:2408
-
C:\Windows\SysWOW64\Ddcdkl32.exeC:\Windows\system32\Ddcdkl32.exe159⤵PID:2416
-
C:\Windows\SysWOW64\Ddeaalpg.exeC:\Windows\system32\Ddeaalpg.exe160⤵
- Drops file in System32 directory
PID:2424 -
C:\Windows\SysWOW64\Doobajme.exeC:\Windows\system32\Doobajme.exe161⤵PID:2432
-
C:\Windows\SysWOW64\Emcbkn32.exeC:\Windows\system32\Emcbkn32.exe162⤵PID:2440
-
C:\Windows\SysWOW64\Ejgcdb32.exeC:\Windows\system32\Ejgcdb32.exe163⤵PID:2448
-
C:\Windows\SysWOW64\Fehjeo32.exeC:\Windows\system32\Fehjeo32.exe164⤵PID:2456
-
C:\Windows\SysWOW64\Faokjpfd.exeC:\Windows\system32\Faokjpfd.exe165⤵
- Drops file in System32 directory
PID:2464 -
C:\Windows\SysWOW64\Fmekoalh.exeC:\Windows\system32\Fmekoalh.exe166⤵
- Modifies registry class
PID:2472 -
C:\Windows\SysWOW64\Facdeo32.exeC:\Windows\system32\Facdeo32.exe167⤵
- Drops file in System32 directory
- Modifies registry class
PID:2480 -
C:\Windows\SysWOW64\Fioija32.exeC:\Windows\system32\Fioija32.exe168⤵PID:2488
-
C:\Windows\SysWOW64\Fiaeoang.exeC:\Windows\system32\Fiaeoang.exe169⤵
- Modifies registry class
PID:2496 -
C:\Windows\SysWOW64\Gegfdb32.exeC:\Windows\system32\Gegfdb32.exe170⤵
- Modifies registry class
PID:2504 -
C:\Windows\SysWOW64\Gbkgnfbd.exeC:\Windows\system32\Gbkgnfbd.exe171⤵
- Drops file in System32 directory
PID:2512 -
C:\Windows\SysWOW64\Gobgcg32.exeC:\Windows\system32\Gobgcg32.exe172⤵PID:2520
-
C:\Windows\SysWOW64\Gkihhhnm.exeC:\Windows\system32\Gkihhhnm.exe173⤵PID:2528
-
C:\Windows\SysWOW64\Ghmiam32.exeC:\Windows\system32\Ghmiam32.exe174⤵PID:2536
-
C:\Windows\SysWOW64\Ghoegl32.exeC:\Windows\system32\Ghoegl32.exe175⤵
- Drops file in System32 directory
PID:2544 -
C:\Windows\SysWOW64\Hcifgjgc.exeC:\Windows\system32\Hcifgjgc.exe176⤵
- Drops file in System32 directory
PID:2552 -
C:\Windows\SysWOW64\Ikbgmj32.exeC:\Windows\system32\Ikbgmj32.exe177⤵PID:2560
-
C:\Windows\SysWOW64\Jjjacf32.exeC:\Windows\system32\Jjjacf32.exe178⤵PID:2568
-
C:\Windows\SysWOW64\Jbgbni32.exeC:\Windows\system32\Jbgbni32.exe179⤵PID:2576
-
C:\Windows\SysWOW64\Jonplmcb.exeC:\Windows\system32\Jonplmcb.exe180⤵PID:2584
-
C:\Windows\SysWOW64\Jgidao32.exeC:\Windows\system32\Jgidao32.exe181⤵
- Drops file in System32 directory
PID:2592 -
C:\Windows\SysWOW64\Kihqkagp.exeC:\Windows\system32\Kihqkagp.exe182⤵PID:2600
-
C:\Windows\SysWOW64\Kpkofpgq.exeC:\Windows\system32\Kpkofpgq.exe183⤵
- Modifies registry class
PID:2608 -
C:\Windows\SysWOW64\Kaklpcoc.exeC:\Windows\system32\Kaklpcoc.exe184⤵
- Modifies registry class
PID:2616 -
C:\Windows\SysWOW64\Kmaled32.exeC:\Windows\system32\Kmaled32.exe185⤵PID:2624
-
C:\Windows\SysWOW64\Llfifq32.exeC:\Windows\system32\Llfifq32.exe186⤵PID:2632
-
C:\Windows\SysWOW64\Lhmjkaoc.exeC:\Windows\system32\Lhmjkaoc.exe187⤵
- Drops file in System32 directory
PID:2640 -
C:\Windows\SysWOW64\Leajdfnm.exeC:\Windows\system32\Leajdfnm.exe188⤵
- Modifies registry class
PID:2648 -
C:\Windows\SysWOW64\Lecgje32.exeC:\Windows\system32\Lecgje32.exe189⤵PID:2656
-
C:\Windows\SysWOW64\Lollckbk.exeC:\Windows\system32\Lollckbk.exe190⤵
- Modifies registry class
PID:2664 -
C:\Windows\SysWOW64\Mkclhl32.exeC:\Windows\system32\Mkclhl32.exe191⤵
- Drops file in System32 directory
PID:2672 -
C:\Windows\SysWOW64\Mkeimlfm.exeC:\Windows\system32\Mkeimlfm.exe192⤵PID:2680
-
C:\Windows\SysWOW64\Mbpnanch.exeC:\Windows\system32\Mbpnanch.exe193⤵PID:2688
-
C:\Windows\SysWOW64\Mdpjlajk.exeC:\Windows\system32\Mdpjlajk.exe194⤵PID:2696
-
C:\Windows\SysWOW64\Mlkopcge.exeC:\Windows\system32\Mlkopcge.exe195⤵PID:2704
-
C:\Windows\SysWOW64\Mhbped32.exeC:\Windows\system32\Mhbped32.exe196⤵PID:2712
-
C:\Windows\SysWOW64\Oklkmnbp.exeC:\Windows\system32\Oklkmnbp.exe197⤵PID:2720
-
C:\Windows\SysWOW64\Ogblbo32.exeC:\Windows\system32\Ogblbo32.exe198⤵PID:2728
-
C:\Windows\SysWOW64\Ocimgp32.exeC:\Windows\system32\Ocimgp32.exe199⤵
- Drops file in System32 directory
PID:2736 -
C:\Windows\SysWOW64\Oqmmpd32.exeC:\Windows\system32\Oqmmpd32.exe200⤵PID:2744
-
C:\Windows\SysWOW64\Omdneebf.exeC:\Windows\system32\Omdneebf.exe201⤵PID:2752
-
C:\Windows\SysWOW64\Odobjg32.exeC:\Windows\system32\Odobjg32.exe202⤵PID:2760
-
C:\Windows\SysWOW64\Pfoocjfd.exeC:\Windows\system32\Pfoocjfd.exe203⤵
- Drops file in System32 directory
- Modifies registry class
PID:2768 -
C:\Windows\SysWOW64\Pbfpik32.exeC:\Windows\system32\Pbfpik32.exe204⤵PID:2776
-
C:\Windows\SysWOW64\Pnlqnl32.exeC:\Windows\system32\Pnlqnl32.exe205⤵PID:2784
-
C:\Windows\SysWOW64\Pjcabmga.exeC:\Windows\system32\Pjcabmga.exe206⤵PID:2792
-
C:\Windows\SysWOW64\Pggbla32.exeC:\Windows\system32\Pggbla32.exe207⤵PID:2800
-
C:\Windows\SysWOW64\Pcnbablo.exeC:\Windows\system32\Pcnbablo.exe208⤵PID:2808
-
C:\Windows\SysWOW64\Qpecfc32.exeC:\Windows\system32\Qpecfc32.exe209⤵
- Modifies registry class
PID:2816 -
C:\Windows\SysWOW64\Aamfnkai.exeC:\Windows\system32\Aamfnkai.exe210⤵
- Drops file in System32 directory
PID:2824 -
C:\Windows\SysWOW64\Aekodi32.exeC:\Windows\system32\Aekodi32.exe211⤵PID:2832
-
C:\Windows\SysWOW64\Bpgljfbl.exeC:\Windows\system32\Bpgljfbl.exe212⤵
- Drops file in System32 directory
PID:2840 -
C:\Windows\SysWOW64\Bmmiij32.exeC:\Windows\system32\Bmmiij32.exe213⤵PID:2848
-
C:\Windows\SysWOW64\Bekkcljk.exeC:\Windows\system32\Bekkcljk.exe214⤵PID:2856
-
C:\Windows\SysWOW64\Baakhm32.exeC:\Windows\system32\Baakhm32.exe215⤵PID:2864
-
C:\Windows\SysWOW64\Coelaaoi.exeC:\Windows\system32\Coelaaoi.exe216⤵
- Drops file in System32 directory
- Modifies registry class
PID:2872 -
C:\Windows\SysWOW64\Cklmgb32.exeC:\Windows\system32\Cklmgb32.exe217⤵
- Drops file in System32 directory
- Modifies registry class
PID:2880 -
C:\Windows\SysWOW64\Cgcmlcja.exeC:\Windows\system32\Cgcmlcja.exe218⤵PID:2888
-
C:\Windows\SysWOW64\Cdgneh32.exeC:\Windows\system32\Cdgneh32.exe219⤵PID:2896
-
C:\Windows\SysWOW64\Cpnojioo.exeC:\Windows\system32\Cpnojioo.exe220⤵
- Modifies registry class
PID:2904 -
C:\Windows\SysWOW64\Cjfccn32.exeC:\Windows\system32\Cjfccn32.exe221⤵
- Modifies registry class
PID:2912 -
C:\Windows\SysWOW64\Dgjclbdi.exeC:\Windows\system32\Dgjclbdi.exe222⤵PID:2920
-
C:\Windows\SysWOW64\Doehqead.exeC:\Windows\system32\Doehqead.exe223⤵PID:2928
-
C:\Windows\SysWOW64\Dhnmij32.exeC:\Windows\system32\Dhnmij32.exe224⤵
- Drops file in System32 directory
PID:2936 -
C:\Windows\SysWOW64\Djmicm32.exeC:\Windows\system32\Djmicm32.exe225⤵PID:2944
-
C:\Windows\SysWOW64\Dcenlceh.exeC:\Windows\system32\Dcenlceh.exe226⤵PID:2952
-
C:\Windows\SysWOW64\Dolnad32.exeC:\Windows\system32\Dolnad32.exe227⤵PID:2964
-
C:\Windows\SysWOW64\Dookgcij.exeC:\Windows\system32\Dookgcij.exe228⤵PID:2972
-
C:\Windows\SysWOW64\Egjpkffe.exeC:\Windows\system32\Egjpkffe.exe229⤵PID:2980
-
C:\Windows\SysWOW64\Ednpej32.exeC:\Windows\system32\Ednpej32.exe230⤵PID:2988
-
C:\Windows\SysWOW64\Eqdajkkb.exeC:\Windows\system32\Eqdajkkb.exe231⤵PID:2996
-
C:\Windows\SysWOW64\Enhacojl.exeC:\Windows\system32\Enhacojl.exe232⤵
- Drops file in System32 directory
- Modifies registry class
PID:3004 -
C:\Windows\SysWOW64\Efcfga32.exeC:\Windows\system32\Efcfga32.exe233⤵PID:3012
-
C:\Windows\SysWOW64\Echfaf32.exeC:\Windows\system32\Echfaf32.exe234⤵PID:3020
-
C:\Windows\SysWOW64\Fpngfgle.exeC:\Windows\system32\Fpngfgle.exe235⤵PID:3028
-
C:\Windows\SysWOW64\Fmbhok32.exeC:\Windows\system32\Fmbhok32.exe236⤵PID:3036
-
C:\Windows\SysWOW64\Fenmdm32.exeC:\Windows\system32\Fenmdm32.exe237⤵
- Drops file in System32 directory
PID:3044 -
C:\Windows\SysWOW64\Fbamma32.exeC:\Windows\system32\Fbamma32.exe238⤵PID:3052
-
C:\Windows\SysWOW64\Fnhnbb32.exeC:\Windows\system32\Fnhnbb32.exe239⤵PID:3060
-
C:\Windows\SysWOW64\Fjongcbl.exeC:\Windows\system32\Fjongcbl.exe240⤵PID:3068
-
C:\Windows\SysWOW64\Gfobbc32.exeC:\Windows\system32\Gfobbc32.exe241⤵PID:1248
-