Analysis
-
max time kernel
105s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
05-05-2021 00:49
Static task
static1
Behavioral task
behavioral1
Sample
279796802c9f540bbc240e6612d19c4bdb5c2c8c8e099877032a653d27f24090.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
279796802c9f540bbc240e6612d19c4bdb5c2c8c8e099877032a653d27f24090.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
279796802c9f540bbc240e6612d19c4bdb5c2c8c8e099877032a653d27f24090.exe
-
Size
2.1MB
-
MD5
b63e4221759c0c6cf70b55ee2d05eaf7
-
SHA1
55772a2e52fb21104d9919ed6cd3e298386a5744
-
SHA256
279796802c9f540bbc240e6612d19c4bdb5c2c8c8e099877032a653d27f24090
-
SHA512
113d73fa4d874abbf8fa9baddc38a5a57b2e6b765df796c6c5547331c1ac5c5909b1ba759112d0f03705ef10a6f1b6a849c148ef8f27de754ee99667a35625e9
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs
-
Executes dropped EXE 64 IoCs
Processes:
Bfkhiflk.exeBngiec32.exeCnifkcfe.exeCnlcqbdb.exeDjijfb32.exeDngblaje.exeDhdppf32.exeEfjmabah.exeFamnpi32.exeGkoeomcd.exeGnpnah32.exeHelomemb.exeIgkhfkgp.exeIodmmh32.exeJgidgi32.exeKkkfig32.exeKedkal32.exeKbhkkq32.exeLebgcj32.exeMplekb32.exeMbmnmn32.exeNokdbnpp.exeNpmnbpep.exeOphmnokb.exePjlabbgf.exeAqbikk32.exeAgqkbd32.exeBmppqkda.exeBikjqkep.exeCgacib32.exeCcjadb32.exeDcojob32.exeDgmcep32.exeDccdjaea.exeDpjdobje.exeDmneifio.exeEjdbhj32.exeEpfdkqph.exeEinidf32.exeEfbimjfb.exeFhbegm32.exeFhdbmmkb.exeFfioni32.exeFdmpgnoc.exeGgniiild.exeGgqeoh32.exeGdgbnl32.exeGkqkjf32.exeGakcgqeb.exeGhdkck32.exeGifhkcbn.exeGampmpcp.exeHhghij32.exeHkedefjp.exeHaolbp32.exeHhidojij.exeHikafb32.exeHpdiclfe.exeHgoapf32.exeHpgfil32.exeHganefko.exeHjojaajc.exeHpicnl32.exeHgckkfim.exepid process 2020 Bfkhiflk.exe 3948 Bngiec32.exe 3920 Cnifkcfe.exe 3908 Cnlcqbdb.exe 2712 Djijfb32.exe 196 Dngblaje.exe 3644 Dhdppf32.exe 3860 Efjmabah.exe 2792 Famnpi32.exe 3776 Gkoeomcd.exe 3876 Gnpnah32.exe 3848 Helomemb.exe 1800 Igkhfkgp.exe 1596 Iodmmh32.exe 188 Jgidgi32.exe 3620 Kkkfig32.exe 3392 Kedkal32.exe 3832 Kbhkkq32.exe 3640 Lebgcj32.exe 3424 Mplekb32.exe 3884 Mbmnmn32.exe 736 Nokdbnpp.exe 4116 Npmnbpep.exe 4156 Ophmnokb.exe 4184 Pjlabbgf.exe 4212 Aqbikk32.exe 4240 Agqkbd32.exe 4268 Bmppqkda.exe 4296 Bikjqkep.exe 4324 Cgacib32.exe 4352 Ccjadb32.exe 4416 Dcojob32.exe 4472 Dgmcep32.exe 4492 Dccdjaea.exe 4512 Dpjdobje.exe 4536 Dmneifio.exe 4556 Ejdbhj32.exe 4576 Epfdkqph.exe 4596 Einidf32.exe 4616 Efbimjfb.exe 4668 Fhbegm32.exe 4688 Fhdbmmkb.exe 4708 Ffioni32.exe 4728 Fdmpgnoc.exe 4748 Ggniiild.exe 4768 Ggqeoh32.exe 4788 Gdgbnl32.exe 4808 Gkqkjf32.exe 4828 Gakcgqeb.exe 4848 Ghdkck32.exe 4868 Gifhkcbn.exe 4888 Gampmpcp.exe 4908 Hhghij32.exe 4928 Hkedefjp.exe 4948 Haolbp32.exe 4968 Hhidojij.exe 4988 Hikafb32.exe 5008 Hpdiclfe.exe 5028 Hgoapf32.exe 5048 Hpgfil32.exe 5068 Hganefko.exe 5088 Hjojaajc.exe 5108 Hpicnl32.exe 4124 Hgckkfim.exe -
Drops file in System32 directory 64 IoCs
Processes:
Mmnkhpkc.exeIiecmd32.exePnkeph32.exeChcobmfn.exeMjfnbm32.exeGbgnjfbp.exePojngj32.exePkfqoe32.exeBcgdmo32.exeBblanknm.exeDfqbapmm.exeMlidfl32.exeMjohan32.exeEeobik32.exeOlljcj32.exeKliqlp32.exeObaidd32.exeDkiaoh32.exeHhkmbl32.exeDaalfeoo.exeMchcdj32.exeHjibda32.exeKkkfig32.exeGifhkcbn.exeJilincgk.exeBfbllpfg.exeHaadfbcc.exeEkafpjph.exeKhpaaqfi.exeLfjijqhe.exeDghehc32.exeMhodme32.exeAjinap32.exeLebgcj32.exeFhdbmmkb.exeNahjdckh.exeCmkhbcfh.exeLhceaf32.exePfdnnk32.exeNjeanajg.exeJooqlb32.exeJeoohhgk.exeEqqbhg32.exedescription ioc process File created C:\Windows\SysWOW64\Mchcdj32.exe Mmnkhpkc.exe File created C:\Windows\SysWOW64\Ipokjndp.exe Iiecmd32.exe File created C:\Windows\SysWOW64\Ppmbgpje.exe Pnkeph32.exe File opened for modification C:\Windows\SysWOW64\Pgfblp32.exe File created C:\Windows\SysWOW64\Oimnki32.dll Chcobmfn.exe File opened for modification C:\Windows\SysWOW64\Mmdjnh32.exe Mjfnbm32.exe File opened for modification C:\Windows\SysWOW64\Giaffq32.exe Gbgnjfbp.exe File created C:\Windows\SysWOW64\Pjobdc32.exe Pojngj32.exe File opened for modification C:\Windows\SysWOW64\Jmgpmdcm.exe File opened for modification C:\Windows\SysWOW64\Papilpgm.exe Pkfqoe32.exe File created C:\Windows\SysWOW64\Obhopj32.dll Bcgdmo32.exe File created C:\Windows\SysWOW64\Blafldnc.exe Bblanknm.exe File opened for modification C:\Windows\SysWOW64\Dhoonlla.exe Dfqbapmm.exe File created C:\Windows\SysWOW64\Gminokmb.dll Mlidfl32.exe File opened for modification C:\Windows\SysWOW64\Mmndmi32.exe Mjohan32.exe File created C:\Windows\SysWOW64\Lnnlndfe.exe File created C:\Windows\SysWOW64\Cikjomce.exe File created C:\Windows\SysWOW64\Ekijeeag.exe Eeobik32.exe File created C:\Windows\SysWOW64\Bddjpl32.dll File created C:\Windows\SysWOW64\Hqjgeqjj.dll Olljcj32.exe File created C:\Windows\SysWOW64\Cnblnb32.dll File created C:\Windows\SysWOW64\Agahdgng.dll Kliqlp32.exe File opened for modification C:\Windows\SysWOW64\Dpjbam32.exe File created C:\Windows\SysWOW64\Aggnkc32.dll File created C:\Windows\SysWOW64\Gipmhjhb.dll Obaidd32.exe File created C:\Windows\SysWOW64\Lknabg32.dll Dkiaoh32.exe File created C:\Windows\SysWOW64\Hegfinbf.dll Hhkmbl32.exe File created C:\Windows\SysWOW64\Dfdqfe32.dll Daalfeoo.exe File opened for modification C:\Windows\SysWOW64\Mkokfg32.exe Mchcdj32.exe File created C:\Windows\SysWOW64\Cfcdnkoi.dll File opened for modification C:\Windows\SysWOW64\Hacjakmd.exe Hjibda32.exe File created C:\Windows\SysWOW64\Ipnhojga.dll File opened for modification C:\Windows\SysWOW64\Kedkal32.exe Kkkfig32.exe File opened for modification C:\Windows\SysWOW64\Gampmpcp.exe Gifhkcbn.exe File opened for modification C:\Windows\SysWOW64\Jpfakm32.exe Jilincgk.exe File opened for modification C:\Windows\SysWOW64\Biqhhlej.exe Bfbllpfg.exe File opened for modification C:\Windows\SysWOW64\Hhkmbl32.exe Haadfbcc.exe File opened for modification C:\Windows\SysWOW64\Eakomdgd.exe Ekafpjph.exe File created C:\Windows\SysWOW64\Lojink32.exe Khpaaqfi.exe File opened for modification C:\Windows\SysWOW64\Pomjmm32.exe File opened for modification C:\Windows\SysWOW64\Ddjhmk32.exe File opened for modification C:\Windows\SysWOW64\Lldagk32.exe Lfjijqhe.exe File created C:\Windows\SysWOW64\Dnbmenog.exe Dghehc32.exe File created C:\Windows\SysWOW64\Moimio32.exe Mhodme32.exe File opened for modification C:\Windows\SysWOW64\Bmgknk32.exe Ajinap32.exe File created C:\Windows\SysWOW64\Mplekb32.exe Lebgcj32.exe File created C:\Windows\SysWOW64\Ffioni32.exe Fhdbmmkb.exe File created C:\Windows\SysWOW64\Lajeijoj.dll Nahjdckh.exe File opened for modification C:\Windows\SysWOW64\Oakmbkkf.exe File created C:\Windows\SysWOW64\Ablhdb32.dll Cmkhbcfh.exe File created C:\Windows\SysWOW64\Lpjmbd32.exe Lhceaf32.exe File created C:\Windows\SysWOW64\Qcbpoa32.exe File created C:\Windows\SysWOW64\Bbclll32.exe File opened for modification C:\Windows\SysWOW64\Pnkeph32.exe Pfdnnk32.exe File created C:\Windows\SysWOW64\Okbbha32.dll File opened for modification C:\Windows\SysWOW64\Khmnakep.exe File opened for modification C:\Windows\SysWOW64\Ljpche32.exe File opened for modification C:\Windows\SysWOW64\Ndkmnhfj.exe File created C:\Windows\SysWOW64\Mknjjf32.dll Njeanajg.exe File opened for modification C:\Windows\SysWOW64\Jeiiim32.exe Jooqlb32.exe File created C:\Windows\SysWOW64\Ilggkd32.dll Jeoohhgk.exe File opened for modification C:\Windows\SysWOW64\Loqidc32.exe File created C:\Windows\SysWOW64\Pfqijemk.dll Eqqbhg32.exe File created C:\Windows\SysWOW64\Lhfpgi32.exe -
Program crash 1 IoCs
Processes:
pid pid_target process target process 12704 12644 -
Modifies registry class 64 IoCs
Processes:
Jdfiodjp.exeHlkcng32.exeKmnbabie.exeHnmchp32.exeEmgadonh.exeIliooeln.exePiglko32.exeDmafkgkk.exeNhhphm32.exeNhjmnm32.exeNhgkllno.exeHbjkofpn.exeNaoijk32.exeInbmcomd.exeKnhepf32.exeBoahci32.exeJilincgk.exeKglice32.exeKedkal32.exeGpjpbgjd.exeAfgckhcp.exeBgccff32.exeDkqnil32.exeHbidepmb.exeKdplebbe.exeCgacib32.exeKkmeij32.exeNcheaaaa.exeAoeamdnj.exeIapqgp32.exeQcflfa32.exeAkdmpccp.exeOhehmj32.exeMqgchhbc.exeNqeojf32.exeGijpfa32.exeDcejek32.exeHohhol32.exeGghplh32.exeNbcmcffp.exeCplpfj32.exeAcecog32.exeMejldm32.exeJjndfn32.exeNjeanajg.exeIgooceco.exeNcaopbgi.exeLienqi32.exeAjplka32.exeNifhfo32.exeNbmpiene.exeEmbgip32.exeKoijmhgp.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jdfiodjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hlkcng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnenec32.dll" Kmnbabie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nafjeg32.dll" Hnmchp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Emgadonh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bolfabkh.dll" Iliooeln.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Piglko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dmafkgkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nhhphm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nhjmnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjeiho32.dll" Nhgkllno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqndlana.dll" Hbjkofpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Naoijk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppokll32.dll" Inbmcomd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlocfajh.dll" Knhepf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jllekp32.dll" Boahci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhoibm32.dll" Jilincgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kglice32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kedkal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gpjpbgjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Afgckhcp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bgccff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dkqnil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehhlnf32.dll" Hbidepmb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kdplebbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnccbg32.dll" Cgacib32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kkmeij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ncheaaaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aoeamdnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Neikeb32.dll" Iapqgp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggihkbmg.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Faecmjol.dll" Qcflfa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Akdmpccp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Golada32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ohehmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gngecd32.dll" Mqgchhbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nqeojf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhmgkh32.dll" Gijpfa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blfbfodg.dll" Dcejek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hohhol32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gghplh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nbcmcffp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cplpfj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Acecog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cllmli32.dll" Mejldm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clkjni32.dll" Jjndfn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mknjjf32.dll" Njeanajg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Igooceco.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ncaopbgi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lienqi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ajplka32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nifhfo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nbmpiene.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Embgip32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gphcqcic.dll" Koijmhgp.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
pid process 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 12704 -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
description pid process Token: SeRestorePrivilege 12704 Token: SeBackupPrivilege 12704 Token: SeDebugPrivilege 12704 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
279796802c9f540bbc240e6612d19c4bdb5c2c8c8e099877032a653d27f24090.exeBfkhiflk.exeBngiec32.exeCnifkcfe.exeCnlcqbdb.exeDjijfb32.exeDngblaje.exeDhdppf32.exeEfjmabah.exeFamnpi32.exeGkoeomcd.exeGnpnah32.exeHelomemb.exeIgkhfkgp.exeIodmmh32.exeJgidgi32.exeKkkfig32.exeKedkal32.exeKbhkkq32.exeLebgcj32.exeMplekb32.exeMbmnmn32.exedescription pid process target process PID 4024 wrote to memory of 2020 4024 279796802c9f540bbc240e6612d19c4bdb5c2c8c8e099877032a653d27f24090.exe Bfkhiflk.exe PID 4024 wrote to memory of 2020 4024 279796802c9f540bbc240e6612d19c4bdb5c2c8c8e099877032a653d27f24090.exe Bfkhiflk.exe PID 4024 wrote to memory of 2020 4024 279796802c9f540bbc240e6612d19c4bdb5c2c8c8e099877032a653d27f24090.exe Bfkhiflk.exe PID 2020 wrote to memory of 3948 2020 Bfkhiflk.exe Bngiec32.exe PID 2020 wrote to memory of 3948 2020 Bfkhiflk.exe Bngiec32.exe PID 2020 wrote to memory of 3948 2020 Bfkhiflk.exe Bngiec32.exe PID 3948 wrote to memory of 3920 3948 Bngiec32.exe Cnifkcfe.exe PID 3948 wrote to memory of 3920 3948 Bngiec32.exe Cnifkcfe.exe PID 3948 wrote to memory of 3920 3948 Bngiec32.exe Cnifkcfe.exe PID 3920 wrote to memory of 3908 3920 Cnifkcfe.exe Cnlcqbdb.exe PID 3920 wrote to memory of 3908 3920 Cnifkcfe.exe Cnlcqbdb.exe PID 3920 wrote to memory of 3908 3920 Cnifkcfe.exe Cnlcqbdb.exe PID 3908 wrote to memory of 2712 3908 Cnlcqbdb.exe Djijfb32.exe PID 3908 wrote to memory of 2712 3908 Cnlcqbdb.exe Djijfb32.exe PID 3908 wrote to memory of 2712 3908 Cnlcqbdb.exe Djijfb32.exe PID 2712 wrote to memory of 196 2712 Djijfb32.exe Dngblaje.exe PID 2712 wrote to memory of 196 2712 Djijfb32.exe Dngblaje.exe PID 2712 wrote to memory of 196 2712 Djijfb32.exe Dngblaje.exe PID 196 wrote to memory of 3644 196 Dngblaje.exe Dhdppf32.exe PID 196 wrote to memory of 3644 196 Dngblaje.exe Dhdppf32.exe PID 196 wrote to memory of 3644 196 Dngblaje.exe Dhdppf32.exe PID 3644 wrote to memory of 3860 3644 Dhdppf32.exe Efjmabah.exe PID 3644 wrote to memory of 3860 3644 Dhdppf32.exe Efjmabah.exe PID 3644 wrote to memory of 3860 3644 Dhdppf32.exe Efjmabah.exe PID 3860 wrote to memory of 2792 3860 Efjmabah.exe Famnpi32.exe PID 3860 wrote to memory of 2792 3860 Efjmabah.exe Famnpi32.exe PID 3860 wrote to memory of 2792 3860 Efjmabah.exe Famnpi32.exe PID 2792 wrote to memory of 3776 2792 Famnpi32.exe Gkoeomcd.exe PID 2792 wrote to memory of 3776 2792 Famnpi32.exe Gkoeomcd.exe PID 2792 wrote to memory of 3776 2792 Famnpi32.exe Gkoeomcd.exe PID 3776 wrote to memory of 3876 3776 Gkoeomcd.exe Gnpnah32.exe PID 3776 wrote to memory of 3876 3776 Gkoeomcd.exe Gnpnah32.exe PID 3776 wrote to memory of 3876 3776 Gkoeomcd.exe Gnpnah32.exe PID 3876 wrote to memory of 3848 3876 Gnpnah32.exe Helomemb.exe PID 3876 wrote to memory of 3848 3876 Gnpnah32.exe Helomemb.exe PID 3876 wrote to memory of 3848 3876 Gnpnah32.exe Helomemb.exe PID 3848 wrote to memory of 1800 3848 Helomemb.exe Igkhfkgp.exe PID 3848 wrote to memory of 1800 3848 Helomemb.exe Igkhfkgp.exe PID 3848 wrote to memory of 1800 3848 Helomemb.exe Igkhfkgp.exe PID 1800 wrote to memory of 1596 1800 Igkhfkgp.exe Iodmmh32.exe PID 1800 wrote to memory of 1596 1800 Igkhfkgp.exe Iodmmh32.exe PID 1800 wrote to memory of 1596 1800 Igkhfkgp.exe Iodmmh32.exe PID 1596 wrote to memory of 188 1596 Iodmmh32.exe Jgidgi32.exe PID 1596 wrote to memory of 188 1596 Iodmmh32.exe Jgidgi32.exe PID 1596 wrote to memory of 188 1596 Iodmmh32.exe Jgidgi32.exe PID 188 wrote to memory of 3620 188 Jgidgi32.exe Kkkfig32.exe PID 188 wrote to memory of 3620 188 Jgidgi32.exe Kkkfig32.exe PID 188 wrote to memory of 3620 188 Jgidgi32.exe Kkkfig32.exe PID 3620 wrote to memory of 3392 3620 Kkkfig32.exe Kedkal32.exe PID 3620 wrote to memory of 3392 3620 Kkkfig32.exe Kedkal32.exe PID 3620 wrote to memory of 3392 3620 Kkkfig32.exe Kedkal32.exe PID 3392 wrote to memory of 3832 3392 Kedkal32.exe Kbhkkq32.exe PID 3392 wrote to memory of 3832 3392 Kedkal32.exe Kbhkkq32.exe PID 3392 wrote to memory of 3832 3392 Kedkal32.exe Kbhkkq32.exe PID 3832 wrote to memory of 3640 3832 Kbhkkq32.exe Lebgcj32.exe PID 3832 wrote to memory of 3640 3832 Kbhkkq32.exe Lebgcj32.exe PID 3832 wrote to memory of 3640 3832 Kbhkkq32.exe Lebgcj32.exe PID 3640 wrote to memory of 3424 3640 Lebgcj32.exe Mplekb32.exe PID 3640 wrote to memory of 3424 3640 Lebgcj32.exe Mplekb32.exe PID 3640 wrote to memory of 3424 3640 Lebgcj32.exe Mplekb32.exe PID 3424 wrote to memory of 3884 3424 Mplekb32.exe Mbmnmn32.exe PID 3424 wrote to memory of 3884 3424 Mplekb32.exe Mbmnmn32.exe PID 3424 wrote to memory of 3884 3424 Mplekb32.exe Mbmnmn32.exe PID 3884 wrote to memory of 736 3884 Mbmnmn32.exe Nokdbnpp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\279796802c9f540bbc240e6612d19c4bdb5c2c8c8e099877032a653d27f24090.exe"C:\Users\Admin\AppData\Local\Temp\279796802c9f540bbc240e6612d19c4bdb5c2c8c8e099877032a653d27f24090.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bfkhiflk.exeC:\Windows\system32\Bfkhiflk.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bngiec32.exeC:\Windows\system32\Bngiec32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Cnifkcfe.exeC:\Windows\system32\Cnifkcfe.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Cnlcqbdb.exeC:\Windows\system32\Cnlcqbdb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Djijfb32.exeC:\Windows\system32\Djijfb32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Dngblaje.exeC:\Windows\system32\Dngblaje.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Dhdppf32.exeC:\Windows\system32\Dhdppf32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Efjmabah.exeC:\Windows\system32\Efjmabah.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Famnpi32.exeC:\Windows\system32\Famnpi32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Gkoeomcd.exeC:\Windows\system32\Gkoeomcd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Gnpnah32.exeC:\Windows\system32\Gnpnah32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Helomemb.exeC:\Windows\system32\Helomemb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Igkhfkgp.exeC:\Windows\system32\Igkhfkgp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Iodmmh32.exeC:\Windows\system32\Iodmmh32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jgidgi32.exeC:\Windows\system32\Jgidgi32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kkkfig32.exeC:\Windows\system32\Kkkfig32.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kedkal32.exeC:\Windows\system32\Kedkal32.exe18⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kbhkkq32.exeC:\Windows\system32\Kbhkkq32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lebgcj32.exeC:\Windows\system32\Lebgcj32.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mplekb32.exeC:\Windows\system32\Mplekb32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mbmnmn32.exeC:\Windows\system32\Mbmnmn32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Nokdbnpp.exeC:\Windows\system32\Nokdbnpp.exe23⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Npmnbpep.exeC:\Windows\system32\Npmnbpep.exe24⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ophmnokb.exeC:\Windows\system32\Ophmnokb.exe25⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pjlabbgf.exeC:\Windows\system32\Pjlabbgf.exe26⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Aqbikk32.exeC:\Windows\system32\Aqbikk32.exe27⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Agqkbd32.exeC:\Windows\system32\Agqkbd32.exe28⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bmppqkda.exeC:\Windows\system32\Bmppqkda.exe29⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bikjqkep.exeC:\Windows\system32\Bikjqkep.exe30⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cgacib32.exeC:\Windows\system32\Cgacib32.exe31⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Ccjadb32.exeC:\Windows\system32\Ccjadb32.exe32⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dcojob32.exeC:\Windows\system32\Dcojob32.exe33⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dgmcep32.exeC:\Windows\system32\Dgmcep32.exe34⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dccdjaea.exeC:\Windows\system32\Dccdjaea.exe35⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dpjdobje.exeC:\Windows\system32\Dpjdobje.exe36⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dmneifio.exeC:\Windows\system32\Dmneifio.exe37⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ejdbhj32.exeC:\Windows\system32\Ejdbhj32.exe38⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Epfdkqph.exeC:\Windows\system32\Epfdkqph.exe39⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Einidf32.exeC:\Windows\system32\Einidf32.exe40⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Efbimjfb.exeC:\Windows\system32\Efbimjfb.exe41⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fhbegm32.exeC:\Windows\system32\Fhbegm32.exe42⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fhdbmmkb.exeC:\Windows\system32\Fhdbmmkb.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ffioni32.exeC:\Windows\system32\Ffioni32.exe44⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fdmpgnoc.exeC:\Windows\system32\Fdmpgnoc.exe45⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ggniiild.exeC:\Windows\system32\Ggniiild.exe46⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ggqeoh32.exeC:\Windows\system32\Ggqeoh32.exe47⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Gdgbnl32.exeC:\Windows\system32\Gdgbnl32.exe48⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Gkqkjf32.exeC:\Windows\system32\Gkqkjf32.exe49⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Gakcgqeb.exeC:\Windows\system32\Gakcgqeb.exe50⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ghdkck32.exeC:\Windows\system32\Ghdkck32.exe51⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Gifhkcbn.exeC:\Windows\system32\Gifhkcbn.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Gampmpcp.exeC:\Windows\system32\Gampmpcp.exe53⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hhghij32.exeC:\Windows\system32\Hhghij32.exe54⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hkedefjp.exeC:\Windows\system32\Hkedefjp.exe55⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Haolbp32.exeC:\Windows\system32\Haolbp32.exe56⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hhidojij.exeC:\Windows\system32\Hhidojij.exe57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hikafb32.exeC:\Windows\system32\Hikafb32.exe58⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hpdiclfe.exeC:\Windows\system32\Hpdiclfe.exe59⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hgoapf32.exeC:\Windows\system32\Hgoapf32.exe60⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hpgfil32.exeC:\Windows\system32\Hpgfil32.exe61⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hganefko.exeC:\Windows\system32\Hganefko.exe62⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hjojaajc.exeC:\Windows\system32\Hjojaajc.exe63⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hpicnl32.exeC:\Windows\system32\Hpicnl32.exe64⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hgckkfim.exeC:\Windows\system32\Hgckkfim.exe65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hnmchp32.exeC:\Windows\system32\Hnmchp32.exe66⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Hdgkdj32.exeC:\Windows\system32\Hdgkdj32.exe67⤵
-
C:\Windows\SysWOW64\Ikacadpc.exeC:\Windows\system32\Ikacadpc.exe68⤵
-
C:\Windows\SysWOW64\Ipnliknj.exeC:\Windows\system32\Ipnliknj.exe69⤵
-
C:\Windows\SysWOW64\Ighdfe32.exeC:\Windows\system32\Ighdfe32.exe70⤵
-
C:\Windows\SysWOW64\Inbmcomd.exeC:\Windows\system32\Inbmcomd.exe71⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Idlepida.exeC:\Windows\system32\Idlepida.exe72⤵
-
C:\Windows\SysWOW64\Igjalecd.exeC:\Windows\system32\Igjalecd.exe73⤵
-
C:\Windows\SysWOW64\Indiho32.exeC:\Windows\system32\Indiho32.exe74⤵
-
C:\Windows\SysWOW64\Ipbedj32.exeC:\Windows\system32\Ipbedj32.exe75⤵
-
C:\Windows\SysWOW64\Igmnadab.exeC:\Windows\system32\Igmnadab.exe76⤵
-
C:\Windows\SysWOW64\Ijkjmppe.exeC:\Windows\system32\Ijkjmppe.exe77⤵
-
C:\Windows\SysWOW64\Iqebjj32.exeC:\Windows\system32\Iqebjj32.exe78⤵
-
C:\Windows\SysWOW64\Igojgd32.exeC:\Windows\system32\Igojgd32.exe79⤵
-
C:\Windows\SysWOW64\Ijmgcp32.exeC:\Windows\system32\Ijmgcp32.exe80⤵
-
C:\Windows\SysWOW64\Iqgopjfp.exeC:\Windows\system32\Iqgopjfp.exe81⤵
-
C:\Windows\SysWOW64\Jgagld32.exeC:\Windows\system32\Jgagld32.exe82⤵
-
C:\Windows\SysWOW64\Jnkpindi.exeC:\Windows\system32\Jnkpindi.exe83⤵
-
C:\Windows\SysWOW64\Jqjleicm.exeC:\Windows\system32\Jqjleicm.exe84⤵
-
C:\Windows\SysWOW64\Jgcdbckj.exeC:\Windows\system32\Jgcdbckj.exe85⤵
-
C:\Windows\SysWOW64\Jjbpnojn.exeC:\Windows\system32\Jjbpnojn.exe86⤵
-
C:\Windows\SysWOW64\Jqlhki32.exeC:\Windows\system32\Jqlhki32.exe87⤵
-
C:\Windows\SysWOW64\Jgfqgcig.exeC:\Windows\system32\Jgfqgcig.exe88⤵
-
C:\Windows\SysWOW64\Jnpidm32.exeC:\Windows\system32\Jnpidm32.exe89⤵
-
C:\Windows\SysWOW64\Jdjaagha.exeC:\Windows\system32\Jdjaagha.exe90⤵
-
C:\Windows\SysWOW64\Jghmmc32.exeC:\Windows\system32\Jghmmc32.exe91⤵
-
C:\Windows\SysWOW64\Jnbejmoa.exeC:\Windows\system32\Jnbejmoa.exe92⤵
-
C:\Windows\SysWOW64\Jdlnfg32.exeC:\Windows\system32\Jdlnfg32.exe93⤵
-
C:\Windows\SysWOW64\Jkffcamk.exeC:\Windows\system32\Jkffcamk.exe94⤵
-
C:\Windows\SysWOW64\Jndbomlo.exeC:\Windows\system32\Jndbomlo.exe95⤵
-
C:\Windows\SysWOW64\Kdojlg32.exeC:\Windows\system32\Kdojlg32.exe96⤵
-
C:\Windows\SysWOW64\Kgmghb32.exeC:\Windows\system32\Kgmghb32.exe97⤵
-
C:\Windows\SysWOW64\Kngoel32.exeC:\Windows\system32\Kngoel32.exe98⤵
-
C:\Windows\SysWOW64\Kdagafbi.exeC:\Windows\system32\Kdagafbi.exe99⤵
-
C:\Windows\SysWOW64\Kkkpnq32.exeC:\Windows\system32\Kkkpnq32.exe100⤵
-
C:\Windows\SysWOW64\Kbehkkqb.exeC:\Windows\system32\Kbehkkqb.exe101⤵
-
C:\Windows\SysWOW64\Kiopge32.exeC:\Windows\system32\Kiopge32.exe102⤵
-
C:\Windows\SysWOW64\Kjplomnn.exeC:\Windows\system32\Kjplomnn.exe103⤵
-
C:\Windows\SysWOW64\Kqjdlgej.exeC:\Windows\system32\Kqjdlgej.exe104⤵
-
C:\Windows\SysWOW64\Kgdmia32.exeC:\Windows\system32\Kgdmia32.exe105⤵
-
C:\Windows\SysWOW64\Knneekdd.exeC:\Windows\system32\Knneekdd.exe106⤵
-
C:\Windows\SysWOW64\Kqlaagch.exeC:\Windows\system32\Kqlaagch.exe107⤵
-
C:\Windows\SysWOW64\Knpbkkba.exeC:\Windows\system32\Knpbkkba.exe108⤵
-
C:\Windows\SysWOW64\Lqongf32.exeC:\Windows\system32\Lqongf32.exe109⤵
-
C:\Windows\SysWOW64\Lgifdqib.exeC:\Windows\system32\Lgifdqib.exe110⤵
-
C:\Windows\SysWOW64\Ljgbplhe.exeC:\Windows\system32\Ljgbplhe.exe111⤵
-
C:\Windows\SysWOW64\Lemgmehk.exeC:\Windows\system32\Lemgmehk.exe112⤵
-
C:\Windows\SysWOW64\Lkfojo32.exeC:\Windows\system32\Lkfojo32.exe113⤵
-
C:\Windows\SysWOW64\Lbqgfi32.exeC:\Windows\system32\Lbqgfi32.exe114⤵
-
C:\Windows\SysWOW64\Leoccd32.exeC:\Windows\system32\Leoccd32.exe115⤵
-
C:\Windows\SysWOW64\Lkilpome.exeC:\Windows\system32\Lkilpome.exe116⤵
-
C:\Windows\SysWOW64\Lnghljli.exeC:\Windows\system32\Lnghljli.exe117⤵
-
C:\Windows\SysWOW64\Lnjdajjg.exeC:\Windows\system32\Lnjdajjg.exe118⤵
-
C:\Windows\SysWOW64\Lahameij.exeC:\Windows\system32\Lahameij.exe119⤵
-
C:\Windows\SysWOW64\Lgbijoqg.exeC:\Windows\system32\Lgbijoqg.exe120⤵
-
C:\Windows\SysWOW64\Mnlagi32.exeC:\Windows\system32\Mnlagi32.exe121⤵
-
C:\Windows\SysWOW64\Mefjccpa.exeC:\Windows\system32\Mefjccpa.exe122⤵
-
C:\Windows\SysWOW64\Mlpbpn32.exeC:\Windows\system32\Mlpbpn32.exe123⤵
-
C:\Windows\SysWOW64\Mbjjmhnj.exeC:\Windows\system32\Mbjjmhnj.exe124⤵
-
C:\Windows\SysWOW64\Mggbeo32.exeC:\Windows\system32\Mggbeo32.exe125⤵
-
C:\Windows\SysWOW64\Mnqkbido.exeC:\Windows\system32\Mnqkbido.exe126⤵
-
C:\Windows\SysWOW64\Mifooadd.exeC:\Windows\system32\Mifooadd.exe127⤵
-
C:\Windows\SysWOW64\Mldkkmch.exeC:\Windows\system32\Mldkkmch.exe128⤵
-
C:\Windows\SysWOW64\Mbochg32.exeC:\Windows\system32\Mbochg32.exe129⤵
-
C:\Windows\SysWOW64\Mihldabb.exeC:\Windows\system32\Mihldabb.exe130⤵
-
C:\Windows\SysWOW64\Mnedmh32.exeC:\Windows\system32\Mnedmh32.exe131⤵
-
C:\Windows\SysWOW64\Meoljbgf.exeC:\Windows\system32\Meoljbgf.exe132⤵
-
C:\Windows\SysWOW64\Mlidfl32.exeC:\Windows\system32\Mlidfl32.exe133⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nbcmcffp.exeC:\Windows\system32\Nbcmcffp.exe134⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Nimepq32.exeC:\Windows\system32\Nimepq32.exe135⤵
-
C:\Windows\SysWOW64\Njoagi32.exeC:\Windows\system32\Njoagi32.exe136⤵
-
C:\Windows\SysWOW64\Nahjdckh.exeC:\Windows\system32\Nahjdckh.exe137⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nlnnalkn.exeC:\Windows\system32\Nlnnalkn.exe138⤵
-
C:\Windows\SysWOW64\Nbhfnf32.exeC:\Windows\system32\Nbhfnf32.exe139⤵
-
C:\Windows\SysWOW64\Nibokpjg.exeC:\Windows\system32\Nibokpjg.exe140⤵
-
C:\Windows\SysWOW64\Nlpkgkik.exeC:\Windows\system32\Nlpkgkik.exe141⤵
-
C:\Windows\SysWOW64\Nbjcceph.exeC:\Windows\system32\Nbjcceph.exe142⤵
-
C:\Windows\SysWOW64\Nhgkllno.exeC:\Windows\system32\Nhgkllno.exe143⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Nbmpiene.exeC:\Windows\system32\Nbmpiene.exe144⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Nifhfo32.exeC:\Windows\system32\Nifhfo32.exe145⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Nledbk32.exeC:\Windows\system32\Nledbk32.exe146⤵
-
C:\Windows\SysWOW64\Oabmjacm.exeC:\Windows\system32\Oabmjacm.exe147⤵
-
C:\Windows\SysWOW64\Oiiekoco.exeC:\Windows\system32\Oiiekoco.exe148⤵
-
C:\Windows\SysWOW64\Okjacg32.exeC:\Windows\system32\Okjacg32.exe149⤵
-
C:\Windows\SysWOW64\Obaidd32.exeC:\Windows\system32\Obaidd32.exe150⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Oikaaoam.exeC:\Windows\system32\Oikaaoam.exe151⤵
-
C:\Windows\SysWOW64\Okmnig32.exeC:\Windows\system32\Okmnig32.exe152⤵
-
C:\Windows\SysWOW64\Obcfjdhm.exeC:\Windows\system32\Obcfjdhm.exe153⤵
-
C:\Windows\SysWOW64\Oinnfn32.exeC:\Windows\system32\Oinnfn32.exe154⤵
-
C:\Windows\SysWOW64\Olljcj32.exeC:\Windows\system32\Olljcj32.exe155⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Oaickq32.exeC:\Windows\system32\Oaickq32.exe156⤵
-
C:\Windows\SysWOW64\Ohckhkdb.exeC:\Windows\system32\Ohckhkdb.exe157⤵
-
C:\Windows\SysWOW64\Oomcde32.exeC:\Windows\system32\Oomcde32.exe158⤵
-
C:\Windows\SysWOW64\Oakpqp32.exeC:\Windows\system32\Oakpqp32.exe159⤵
-
C:\Windows\SysWOW64\Ohehmj32.exeC:\Windows\system32\Ohehmj32.exe160⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Pkcdif32.exeC:\Windows\system32\Pkcdif32.exe161⤵
-
C:\Windows\SysWOW64\Panlfpip.exeC:\Windows\system32\Panlfpip.exe162⤵
-
C:\Windows\SysWOW64\Piddgmib.exeC:\Windows\system32\Piddgmib.exe163⤵
-
C:\Windows\SysWOW64\Pkfqoe32.exeC:\Windows\system32\Pkfqoe32.exe164⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Papilpgm.exeC:\Windows\system32\Papilpgm.exe165⤵
-
C:\Windows\SysWOW64\Pigamm32.exeC:\Windows\system32\Pigamm32.exe166⤵
-
C:\Windows\SysWOW64\Pkhmdemn.exeC:\Windows\system32\Pkhmdemn.exe167⤵
-
C:\Windows\SysWOW64\Pabeao32.exeC:\Windows\system32\Pabeao32.exe168⤵
-
C:\Windows\SysWOW64\Piinbm32.exeC:\Windows\system32\Piinbm32.exe169⤵
-
C:\Windows\SysWOW64\Pkkjjekk.exeC:\Windows\system32\Pkkjjekk.exe170⤵
-
C:\Windows\SysWOW64\Padbgo32.exeC:\Windows\system32\Padbgo32.exe171⤵
-
C:\Windows\SysWOW64\Piljhl32.exeC:\Windows\system32\Piljhl32.exe172⤵
-
C:\Windows\SysWOW64\Pkmgpd32.exeC:\Windows\system32\Pkmgpd32.exe173⤵
-
C:\Windows\SysWOW64\Pagoloqe.exeC:\Windows\system32\Pagoloqe.exe174⤵
-
C:\Windows\SysWOW64\Pingnlag.exeC:\Windows\system32\Pingnlag.exe175⤵
-
C:\Windows\SysWOW64\Qkoced32.exeC:\Windows\system32\Qkoced32.exe176⤵
-
C:\Windows\SysWOW64\Qcflfa32.exeC:\Windows\system32\Qcflfa32.exe177⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Qipdckod.exeC:\Windows\system32\Qipdckod.exe178⤵
-
C:\Windows\SysWOW64\Qkapkdec.exeC:\Windows\system32\Qkapkdec.exe179⤵
-
C:\Windows\SysWOW64\Qalhgn32.exeC:\Windows\system32\Qalhgn32.exe180⤵
-
C:\Windows\SysWOW64\Aheqdhdm.exeC:\Windows\system32\Aheqdhdm.exe181⤵
-
C:\Windows\SysWOW64\Akdmpccp.exeC:\Windows\system32\Akdmpccp.exe182⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Aodblagd.exeC:\Windows\system32\Aodblagd.exe183⤵
-
C:\Windows\SysWOW64\Alhceefn.exeC:\Windows\system32\Alhceefn.exe184⤵
-
C:\Windows\SysWOW64\Ajlcoj32.exeC:\Windows\system32\Ajlcoj32.exe185⤵
-
C:\Windows\SysWOW64\Aoilgq32.exeC:\Windows\system32\Aoilgq32.exe186⤵
-
C:\Windows\SysWOW64\Blmlqe32.exeC:\Windows\system32\Blmlqe32.exe187⤵
-
C:\Windows\SysWOW64\Bcgdmo32.exeC:\Windows\system32\Bcgdmo32.exe188⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Bloifdpe.exeC:\Windows\system32\Bloifdpe.exe189⤵
-
C:\Windows\SysWOW64\Bblanknm.exeC:\Windows\system32\Bblanknm.exe190⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Blafldnc.exeC:\Windows\system32\Blafldnc.exe191⤵
-
C:\Windows\SysWOW64\Bfjjdjdc.exeC:\Windows\system32\Bfjjdjdc.exe192⤵
-
C:\Windows\SysWOW64\Bldbad32.exeC:\Windows\system32\Bldbad32.exe193⤵
-
C:\Windows\SysWOW64\Bobomo32.exeC:\Windows\system32\Bobomo32.exe194⤵
-
C:\Windows\SysWOW64\Bflgjiba.exeC:\Windows\system32\Bflgjiba.exe195⤵
-
C:\Windows\SysWOW64\Bhkcfead.exeC:\Windows\system32\Bhkcfead.exe196⤵
-
C:\Windows\SysWOW64\Bodkco32.exeC:\Windows\system32\Bodkco32.exe197⤵
-
C:\Windows\SysWOW64\Bbcgoj32.exeC:\Windows\system32\Bbcgoj32.exe198⤵
-
C:\Windows\SysWOW64\Chmpld32.exeC:\Windows\system32\Chmpld32.exe199⤵
-
C:\Windows\SysWOW64\Coghhogo.exeC:\Windows\system32\Coghhogo.exe200⤵
-
C:\Windows\SysWOW64\Cfapei32.exeC:\Windows\system32\Cfapei32.exe201⤵
-
C:\Windows\SysWOW64\Cmkhbcfh.exeC:\Windows\system32\Cmkhbcfh.exe202⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Cceqom32.exeC:\Windows\system32\Cceqom32.exe203⤵
-
C:\Windows\SysWOW64\Cjoikgeb.exeC:\Windows\system32\Cjoikgeb.exe204⤵
-
C:\Windows\SysWOW64\Cmmegb32.exeC:\Windows\system32\Cmmegb32.exe205⤵
-
C:\Windows\SysWOW64\Ccgmdmkb.exeC:\Windows\system32\Ccgmdmkb.exe206⤵
-
C:\Windows\SysWOW64\Cjafqg32.exeC:\Windows\system32\Cjafqg32.exe207⤵
-
C:\Windows\SysWOW64\Ckbbhoin.exeC:\Windows\system32\Ckbbhoin.exe208⤵
-
C:\Windows\SysWOW64\Ccijjlip.exeC:\Windows\system32\Ccijjlip.exe209⤵
-
C:\Windows\SysWOW64\Ckeono32.exeC:\Windows\system32\Ckeono32.exe210⤵
-
C:\Windows\SysWOW64\Dbogkinh.exeC:\Windows\system32\Dbogkinh.exe211⤵
-
C:\Windows\SysWOW64\Diiogc32.exeC:\Windows\system32\Diiogc32.exe212⤵
-
C:\Windows\SysWOW64\Dcncel32.exeC:\Windows\system32\Dcncel32.exe213⤵
-
C:\Windows\SysWOW64\Dfmpag32.exeC:\Windows\system32\Dfmpag32.exe214⤵
-
C:\Windows\SysWOW64\Dmfhnalk.exeC:\Windows\system32\Dmfhnalk.exe215⤵
-
C:\Windows\SysWOW64\Doedjm32.exeC:\Windows\system32\Doedjm32.exe216⤵
-
C:\Windows\SysWOW64\Dfomfgbk.exeC:\Windows\system32\Dfomfgbk.exe217⤵
-
C:\Windows\SysWOW64\Dmieca32.exeC:\Windows\system32\Dmieca32.exe218⤵
-
C:\Windows\SysWOW64\Dogaol32.exeC:\Windows\system32\Dogaol32.exe219⤵
-
C:\Windows\SysWOW64\Dfailfpi.exeC:\Windows\system32\Dfailfpi.exe220⤵
-
C:\Windows\SysWOW64\Dipehbpm.exeC:\Windows\system32\Dipehbpm.exe221⤵
-
C:\Windows\SysWOW64\Dcejek32.exeC:\Windows\system32\Dcejek32.exe222⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Djobbefo.exeC:\Windows\system32\Djobbefo.exe223⤵
-
C:\Windows\SysWOW64\Dmnnnpfc.exeC:\Windows\system32\Dmnnnpfc.exe224⤵
-
C:\Windows\SysWOW64\Ecgfkj32.exeC:\Windows\system32\Ecgfkj32.exe225⤵
-
C:\Windows\SysWOW64\Effbgf32.exeC:\Windows\system32\Effbgf32.exe226⤵
-
C:\Windows\SysWOW64\Empkdpdp.exeC:\Windows\system32\Empkdpdp.exe227⤵
-
C:\Windows\SysWOW64\Ecjcqjkm.exeC:\Windows\system32\Ecjcqjkm.exe228⤵
-
C:\Windows\SysWOW64\Efhomeja.exeC:\Windows\system32\Efhomeja.exe229⤵
-
C:\Windows\SysWOW64\Embgip32.exeC:\Windows\system32\Embgip32.exe230⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Eclpfjij.exeC:\Windows\system32\Eclpfjij.exe231⤵
-
C:\Windows\SysWOW64\Efklbehn.exeC:\Windows\system32\Efklbehn.exe232⤵
-
C:\Windows\SysWOW64\Emddoo32.exeC:\Windows\system32\Emddoo32.exe233⤵
-
C:\Windows\SysWOW64\Epcqkk32.exeC:\Windows\system32\Epcqkk32.exe234⤵
-
C:\Windows\SysWOW64\Efmihe32.exeC:\Windows\system32\Efmihe32.exe235⤵
-
C:\Windows\SysWOW64\Emgadonh.exeC:\Windows\system32\Emgadonh.exe236⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ecaiai32.exeC:\Windows\system32\Ecaiai32.exe237⤵
-
C:\Windows\SysWOW64\Efoemd32.exeC:\Windows\system32\Efoemd32.exe238⤵
-
C:\Windows\SysWOW64\Fphjfjki.exeC:\Windows\system32\Fphjfjki.exe239⤵
-
C:\Windows\SysWOW64\Fbffbejm.exeC:\Windows\system32\Fbffbejm.exe240⤵
-
C:\Windows\SysWOW64\Fipnopaj.exeC:\Windows\system32\Fipnopaj.exe241⤵