Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
05-05-2021 11:07
Static task
static1
Behavioral task
behavioral1
Sample
d5c6035d_by_Libranalysis.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d5c6035d_by_Libranalysis.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
d5c6035d_by_Libranalysis.exe
-
Size
5.4MB
-
MD5
d5c6035da222e6767cb460f00f553bcb
-
SHA1
9f397a56d942b3042260abde4eb18b08d85ca318
-
SHA256
c70eb54f6a5538d36c8c40866c1ab479e444b3d1851b8c1eedfd3f0a15800a54
-
SHA512
9d354c61352e87d8dddf4ff005dae0b0da1c3984238ee96591565e36fbade55aed0538050dff44837e62a4c49ef97d1dd7f15c170bafa9f5ff5189ff00dd80aa
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs
-
Executes dropped EXE 64 IoCs
Processes:
Gflfgkqn.exeIembdfkh.exeIkiggpqb.exeIcclmmob.exeJmnmlbdp.exeJpqccm32.exeKibjbamd.exeKffkke32.exeKelhmaae.exeLmemco32.exeLmjfnnkp.exeLpjopiha.exeLlapejne.exeMlclkjlb.exeNcidcbib.exeAqpcpa32.exeBanpapnc.exeCecnhm32.exeCjepkchd.exeCemanl32.exeGkmhjmeg.exeGkoeomcd.exeHgdbel32.exeIblchd32.exeIgkhfkgp.exeIngmhelj.exeIgbngj32.exeAlfmjlll.exeHjaggahp.exeLnjdajjg.exeLlnekn32.exeMnnnli32.exeMekcoc32.exeMlidfl32.exePoffkc32.exeCmpbmb32.exeCkeono32.exeDobgdmma.exeDbcqfh32.exeDfailfpi.exeDkqnjm32.exeFchobhom.exeHdmade32.exeHdbkod32.exeHmjphj32.exeHiapmked.exeIgeafocn.exeIlainf32.exeIldfdf32.exeIgijao32.exeIpbojd32.exeIijccjmj.exeIdpgpblp.exeJpfhecbd.exeJlmijd32.exeJcgagooe.exeJnmedgok.exeJdgnaafh.exeJjcfihdo.exeJcljbn32.exeJldokcap.exeJcnggnim.exeKccqbm32.exeKlkekblh.exepid process 1288 Gflfgkqn.exe 2032 Iembdfkh.exe 800 Ikiggpqb.exe 1032 Icclmmob.exe 1216 Jmnmlbdp.exe 1776 Jpqccm32.exe 1720 Kibjbamd.exe 2472 Kffkke32.exe 2812 Kelhmaae.exe 1992 Lmemco32.exe 3116 Lmjfnnkp.exe 1316 Lpjopiha.exe 3952 Llapejne.exe 3180 Mlclkjlb.exe 684 Ncidcbib.exe 3120 Aqpcpa32.exe 1772 Banpapnc.exe 2800 Cecnhm32.exe 3744 Cjepkchd.exe 2764 Cemanl32.exe 1580 Gkmhjmeg.exe 4108 Gkoeomcd.exe 4136 Hgdbel32.exe 4172 Iblchd32.exe 4260 Igkhfkgp.exe 4288 Ingmhelj.exe 4316 Igbngj32.exe 4348 Alfmjlll.exe 4376 Hjaggahp.exe 4404 Lnjdajjg.exe 4436 Llnekn32.exe 4464 Mnnnli32.exe 4524 Mekcoc32.exe 4544 Mlidfl32.exe 4564 Poffkc32.exe 4584 Cmpbmb32.exe 4604 Ckeono32.exe 4624 Dobgdmma.exe 4644 Dbcqfh32.exe 4664 Dfailfpi.exe 4684 Dkqnjm32.exe 4712 Fchobhom.exe 4740 Hdmade32.exe 4760 Hdbkod32.exe 4780 Hmjphj32.exe 4800 Hiapmked.exe 4820 Igeafocn.exe 4840 Ilainf32.exe 4860 Ildfdf32.exe 4880 Igijao32.exe 4900 Ipbojd32.exe 4920 Iijccjmj.exe 4944 Idpgpblp.exe 4964 Jpfhecbd.exe 4984 Jlmijd32.exe 5004 Jcgagooe.exe 5024 Jnmedgok.exe 5044 Jdgnaafh.exe 5064 Jjcfihdo.exe 5084 Jcljbn32.exe 5104 Jldokcap.exe 4116 Jcnggnim.exe 4296 Kccqbm32.exe 900 Klkekblh.exe -
Drops file in System32 directory 64 IoCs
Processes:
Ggacbg32.exeKmcpibip.exePfdedggo.exeCgnjkj32.exeJbhpgafk.exePmplfnec.exeEgggekel.exeEgbgoe32.exeInmjqhbj.exeNffammpe.exeOoplal32.exeOmdljppa.exePcljnb32.exeIcclmmob.exeBgpnilfp.exeMlidfl32.exeLqbqhp32.exeMooeea32.exeAfpepf32.exeDobgdmma.exeKlhakm32.exeLpjopiha.exeFdhndd32.exeJjkafhbg.exeLlapejne.exeKdgfho32.exeHilpge32.exeKemkjf32.exePoffkc32.exePoafendn.exeKgfgplkh.exeKjjdbm32.exeEfjehodb.exeFfakhn32.exeGemnjimj.exeApoaig32.exeKephoeih.exeJaeicbic.exeNgooagak.exePdkahedh.exeEdhlhlpb.exeHidclp32.exeJpqccm32.exeAaggbk32.exeDqgpbhgc.exeOhllpd32.exeMhdmhgpe.exeFchobhom.exeOphila32.exeLlhchdha.exeBeplbgmk.exeIejfmhkp.exeNhacol32.exeGmipff32.exeMqniig32.exeBokabj32.exeLnodfnkj.exeNqkopolo.exeIcjbioqb.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Gbggop32.exe Ggacbg32.exe File created C:\Windows\SysWOW64\Jeeele32.dll Kmcpibip.exe File opened for modification C:\Windows\SysWOW64\Pgfblp32.exe Pfdedggo.exe File created C:\Windows\SysWOW64\Ilnfph32.dll Cgnjkj32.exe File created C:\Windows\SysWOW64\Jlqdpg32.exe Jbhpgafk.exe File created C:\Windows\SysWOW64\Jloifbkm.dll Pmplfnec.exe File created C:\Windows\SysWOW64\Enapae32.exe Egggekel.exe File opened for modification C:\Windows\SysWOW64\Epkkhklf.exe Egbgoe32.exe File opened for modification C:\Windows\SysWOW64\Icjbioqb.exe Inmjqhbj.exe File opened for modification C:\Windows\SysWOW64\Nqlejepk.exe Nffammpe.exe File created C:\Windows\SysWOW64\Phjafn32.dll Ooplal32.exe File created C:\Windows\SysWOW64\Aokooh32.dll Omdljppa.exe File opened for modification C:\Windows\SysWOW64\Pihbfiei.exe Pcljnb32.exe File created C:\Windows\SysWOW64\Gehbip32.dll Icclmmob.exe File created C:\Windows\SysWOW64\Bbebfe32.exe Bgpnilfp.exe File created C:\Windows\SysWOW64\Poffkc32.exe Mlidfl32.exe File opened for modification C:\Windows\SysWOW64\Ljkeqe32.exe Lqbqhp32.exe File created C:\Windows\SysWOW64\Ndkmnhfj.exe Mooeea32.exe File opened for modification C:\Windows\SysWOW64\Agaahnbp.exe Afpepf32.exe File created C:\Windows\SysWOW64\Dbcqfh32.exe Dobgdmma.exe File created C:\Windows\SysWOW64\Gbkokpfc.dll Klhakm32.exe File created C:\Windows\SysWOW64\Llapejne.exe Lpjopiha.exe File created C:\Windows\SysWOW64\Fnpbmidd.exe Fdhndd32.exe File created C:\Windows\SysWOW64\Jaeicbic.exe Jjkafhbg.exe File created C:\Windows\SysWOW64\Mlclkjlb.exe Llapejne.exe File created C:\Windows\SysWOW64\Dbffoa32.dll Kdgfho32.exe File opened for modification C:\Windows\SysWOW64\Hpehdpmk.exe Hilpge32.exe File created C:\Windows\SysWOW64\Kjjdbm32.exe Kemkjf32.exe File created C:\Windows\SysWOW64\Ppjken32.dll Poffkc32.exe File created C:\Windows\SysWOW64\Phijnc32.exe Poafendn.exe File opened for modification C:\Windows\SysWOW64\Kmcpibip.exe Kgfgplkh.exe File created C:\Windows\SysWOW64\Omdljppa.exe Ooplal32.exe File created C:\Windows\SysWOW64\Kephoeih.exe Kjjdbm32.exe File created C:\Windows\SysWOW64\Gqnqdjbl.dll Efjehodb.exe File created C:\Windows\SysWOW64\Fpipacek.exe Ffakhn32.exe File created C:\Windows\SysWOW64\Dfpqbj32.dll Gemnjimj.exe File created C:\Windows\SysWOW64\Egbdfe32.dll Hilpge32.exe File created C:\Windows\SysWOW64\Aaqjij32.exe Apoaig32.exe File created C:\Windows\SysWOW64\Gnagji32.dll Egggekel.exe File created C:\Windows\SysWOW64\Kklqglgp.exe Kephoeih.exe File created C:\Windows\SysWOW64\Kokmgeea.dll Jaeicbic.exe File created C:\Windows\SysWOW64\Ipmckl32.dll Ngooagak.exe File created C:\Windows\SysWOW64\Poafendn.exe Pdkahedh.exe File created C:\Windows\SysWOW64\Ofdhiofe.dll Edhlhlpb.exe File created C:\Windows\SysWOW64\Dkhejk32.dll Hidclp32.exe File created C:\Windows\SysWOW64\Kibjbamd.exe Jpqccm32.exe File created C:\Windows\SysWOW64\Chbcnm32.dll Aaggbk32.exe File opened for modification C:\Windows\SysWOW64\Ekgnpfcj.exe Efjehodb.exe File opened for modification C:\Windows\SysWOW64\Dohppp32.exe Dqgpbhgc.exe File created C:\Windows\SysWOW64\Pkmdao32.exe Ohllpd32.exe File created C:\Windows\SysWOW64\Eifmmc32.dll Mhdmhgpe.exe File created C:\Windows\SysWOW64\Ihpqdakl.dll Mooeea32.exe File opened for modification C:\Windows\SysWOW64\Hdmade32.exe Fchobhom.exe File created C:\Windows\SysWOW64\Ojnmij32.exe Ophila32.exe File created C:\Windows\SysWOW64\Kllgemip.dll Llhchdha.exe File opened for modification C:\Windows\SysWOW64\Bpepopma.exe Beplbgmk.exe File created C:\Windows\SysWOW64\Ijgneojh.exe Iejfmhkp.exe File created C:\Windows\SysWOW64\Ncfgle32.exe Nhacol32.exe File created C:\Windows\SysWOW64\Jpfeleea.dll Gmipff32.exe File created C:\Windows\SysWOW64\Icccob32.dll Mqniig32.exe File opened for modification C:\Windows\SysWOW64\Bdgjja32.exe Bokabj32.exe File created C:\Windows\SysWOW64\Lclmneia.exe Lnodfnkj.exe File opened for modification C:\Windows\SysWOW64\Ofhghfjg.exe Nqkopolo.exe File created C:\Windows\SysWOW64\Jfmhpj32.exe Icjbioqb.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 6632 6720 WerFault.exe Dpqagfqe.exe -
Modifies registry class 64 IoCs
Processes:
Mocfjd32.exeBfpofqhi.exeIajqajgm.exeNoaakafp.exeOndkmlnh.exeBbebfe32.exeIgeafocn.exeJenhnado.exeLlnekn32.exePoafendn.exeIkiggpqb.exeKokgbgen.exeDmclfqem.exeBknfpjmg.exeLmjfnnkp.exeDcbhnn32.exeHbcnedhc.exeAbbfqbac.exeDaooaf32.exeJjikkohe.exeNaenlb32.exeNljbjk32.exeKjljmfdd.exeLmbkla32.exeJpfhecbd.exeOaclkd32.exeGdlqem32.exeMcfneghm.exeBeplbgmk.exeIgooceco.exeNcpakfpb.exeQabnglhd.exeMaqminnd.exeMmpqcied.exeFkapggae.exeEljfmmhb.exeKkobojad.exeGnoehmmm.exeCpafee32.exeDfidif32.exeIahkfa32.exeJlmijd32.exeMgkefh32.exeAlglkobb.exePapabljg.exeMlclkjlb.exeMjegggop.exeBbceaehi.exeMnngbb32.exeCafcemmh.exeGbcdog32.exeGefjfbad.exeKabfcmfn.exeKebeeege.exeKgdkklmk.exeKnblbepb.exeQhpqob32.exeAkndcc32.exeGpibnk32.exeCfbnhg32.exeDmncka32.exeFecclppp.exeAgdnnnqn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mocfjd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbbcnnhi.dll" Bfpofqhi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iajqajgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Noaakafp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ondkmlnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alibnd32.dll" Bbebfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpllha32.dll" Igeafocn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdjjgbpm.dll" Jenhnado.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Llnekn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Poafendn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ikiggpqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kokgbgen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dmclfqem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bknfpjmg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lmjfnnkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dcbhnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amfqmc32.dll" Hbcnedhc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Abbfqbac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Daooaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jjikkohe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okekjc32.dll" Naenlb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nljbjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kjljmfdd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lmbkla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jpfhecbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llqgpf32.dll" Oaclkd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cajljmgd.dll" Gdlqem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mcfneghm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmidin32.dll" Beplbgmk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Igeafocn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Igooceco.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ncpakfpb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qabnglhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Maqminnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obbboabp.dll" Mmpqcied.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Noakpg32.dll" Fkapggae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eljfmmhb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kkobojad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gnoehmmm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cpafee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dfidif32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iahkfa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmhiik32.dll" Jlmijd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mgkefh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlegjp32.dll" Alglkobb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Papabljg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqpijj32.dll" Mlclkjlb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnhdlh32.dll" Mjegggop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bbceaehi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mnngbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iphdag32.dll" Cafcemmh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gbcdog32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gefjfbad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kabfcmfn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kebeeege.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kgdkklmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Knblbepb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qhpqob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Akndcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apicli32.dll" Gpibnk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cfbnhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mogmdphk.dll" Dmncka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fecclppp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eegkblqe.dll" Agdnnnqn.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
WerFault.exepid process 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe 6632 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 6632 WerFault.exe Token: SeBackupPrivilege 6632 WerFault.exe Token: SeDebugPrivilege 6632 WerFault.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d5c6035d_by_Libranalysis.exeGflfgkqn.exeIembdfkh.exeIkiggpqb.exeIcclmmob.exeJmnmlbdp.exeJpqccm32.exeKibjbamd.exeKffkke32.exeKelhmaae.exeLmemco32.exeLmjfnnkp.exeLpjopiha.exeLlapejne.exeMlclkjlb.exeNcidcbib.exeAqpcpa32.exeBanpapnc.exeCecnhm32.exeCjepkchd.exeCemanl32.exeGkmhjmeg.exedescription pid process target process PID 2184 wrote to memory of 1288 2184 d5c6035d_by_Libranalysis.exe Gflfgkqn.exe PID 2184 wrote to memory of 1288 2184 d5c6035d_by_Libranalysis.exe Gflfgkqn.exe PID 2184 wrote to memory of 1288 2184 d5c6035d_by_Libranalysis.exe Gflfgkqn.exe PID 1288 wrote to memory of 2032 1288 Gflfgkqn.exe Iembdfkh.exe PID 1288 wrote to memory of 2032 1288 Gflfgkqn.exe Iembdfkh.exe PID 1288 wrote to memory of 2032 1288 Gflfgkqn.exe Iembdfkh.exe PID 2032 wrote to memory of 800 2032 Iembdfkh.exe Ikiggpqb.exe PID 2032 wrote to memory of 800 2032 Iembdfkh.exe Ikiggpqb.exe PID 2032 wrote to memory of 800 2032 Iembdfkh.exe Ikiggpqb.exe PID 800 wrote to memory of 1032 800 Ikiggpqb.exe Icclmmob.exe PID 800 wrote to memory of 1032 800 Ikiggpqb.exe Icclmmob.exe PID 800 wrote to memory of 1032 800 Ikiggpqb.exe Icclmmob.exe PID 1032 wrote to memory of 1216 1032 Icclmmob.exe Jmnmlbdp.exe PID 1032 wrote to memory of 1216 1032 Icclmmob.exe Jmnmlbdp.exe PID 1032 wrote to memory of 1216 1032 Icclmmob.exe Jmnmlbdp.exe PID 1216 wrote to memory of 1776 1216 Jmnmlbdp.exe Jpqccm32.exe PID 1216 wrote to memory of 1776 1216 Jmnmlbdp.exe Jpqccm32.exe PID 1216 wrote to memory of 1776 1216 Jmnmlbdp.exe Jpqccm32.exe PID 1776 wrote to memory of 1720 1776 Jpqccm32.exe Kibjbamd.exe PID 1776 wrote to memory of 1720 1776 Jpqccm32.exe Kibjbamd.exe PID 1776 wrote to memory of 1720 1776 Jpqccm32.exe Kibjbamd.exe PID 1720 wrote to memory of 2472 1720 Kibjbamd.exe Kffkke32.exe PID 1720 wrote to memory of 2472 1720 Kibjbamd.exe Kffkke32.exe PID 1720 wrote to memory of 2472 1720 Kibjbamd.exe Kffkke32.exe PID 2472 wrote to memory of 2812 2472 Kffkke32.exe Kelhmaae.exe PID 2472 wrote to memory of 2812 2472 Kffkke32.exe Kelhmaae.exe PID 2472 wrote to memory of 2812 2472 Kffkke32.exe Kelhmaae.exe PID 2812 wrote to memory of 1992 2812 Kelhmaae.exe Lmemco32.exe PID 2812 wrote to memory of 1992 2812 Kelhmaae.exe Lmemco32.exe PID 2812 wrote to memory of 1992 2812 Kelhmaae.exe Lmemco32.exe PID 1992 wrote to memory of 3116 1992 Lmemco32.exe Lmjfnnkp.exe PID 1992 wrote to memory of 3116 1992 Lmemco32.exe Lmjfnnkp.exe PID 1992 wrote to memory of 3116 1992 Lmemco32.exe Lmjfnnkp.exe PID 3116 wrote to memory of 1316 3116 Lmjfnnkp.exe Lpjopiha.exe PID 3116 wrote to memory of 1316 3116 Lmjfnnkp.exe Lpjopiha.exe PID 3116 wrote to memory of 1316 3116 Lmjfnnkp.exe Lpjopiha.exe PID 1316 wrote to memory of 3952 1316 Lpjopiha.exe Llapejne.exe PID 1316 wrote to memory of 3952 1316 Lpjopiha.exe Llapejne.exe PID 1316 wrote to memory of 3952 1316 Lpjopiha.exe Llapejne.exe PID 3952 wrote to memory of 3180 3952 Llapejne.exe Mlclkjlb.exe PID 3952 wrote to memory of 3180 3952 Llapejne.exe Mlclkjlb.exe PID 3952 wrote to memory of 3180 3952 Llapejne.exe Mlclkjlb.exe PID 3180 wrote to memory of 684 3180 Mlclkjlb.exe Ncidcbib.exe PID 3180 wrote to memory of 684 3180 Mlclkjlb.exe Ncidcbib.exe PID 3180 wrote to memory of 684 3180 Mlclkjlb.exe Ncidcbib.exe PID 684 wrote to memory of 3120 684 Ncidcbib.exe Aqpcpa32.exe PID 684 wrote to memory of 3120 684 Ncidcbib.exe Aqpcpa32.exe PID 684 wrote to memory of 3120 684 Ncidcbib.exe Aqpcpa32.exe PID 3120 wrote to memory of 1772 3120 Aqpcpa32.exe Banpapnc.exe PID 3120 wrote to memory of 1772 3120 Aqpcpa32.exe Banpapnc.exe PID 3120 wrote to memory of 1772 3120 Aqpcpa32.exe Banpapnc.exe PID 1772 wrote to memory of 2800 1772 Banpapnc.exe Cecnhm32.exe PID 1772 wrote to memory of 2800 1772 Banpapnc.exe Cecnhm32.exe PID 1772 wrote to memory of 2800 1772 Banpapnc.exe Cecnhm32.exe PID 2800 wrote to memory of 3744 2800 Cecnhm32.exe Cjepkchd.exe PID 2800 wrote to memory of 3744 2800 Cecnhm32.exe Cjepkchd.exe PID 2800 wrote to memory of 3744 2800 Cecnhm32.exe Cjepkchd.exe PID 3744 wrote to memory of 2764 3744 Cjepkchd.exe Cemanl32.exe PID 3744 wrote to memory of 2764 3744 Cjepkchd.exe Cemanl32.exe PID 3744 wrote to memory of 2764 3744 Cjepkchd.exe Cemanl32.exe PID 2764 wrote to memory of 1580 2764 Cemanl32.exe Gkmhjmeg.exe PID 2764 wrote to memory of 1580 2764 Cemanl32.exe Gkmhjmeg.exe PID 2764 wrote to memory of 1580 2764 Cemanl32.exe Gkmhjmeg.exe PID 1580 wrote to memory of 4108 1580 Gkmhjmeg.exe Gkoeomcd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5c6035d_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\d5c6035d_by_Libranalysis.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Gflfgkqn.exeC:\Windows\system32\Gflfgkqn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Iembdfkh.exeC:\Windows\system32\Iembdfkh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ikiggpqb.exeC:\Windows\system32\Ikiggpqb.exe4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Icclmmob.exeC:\Windows\system32\Icclmmob.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jmnmlbdp.exeC:\Windows\system32\Jmnmlbdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jpqccm32.exeC:\Windows\system32\Jpqccm32.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kibjbamd.exeC:\Windows\system32\Kibjbamd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kffkke32.exeC:\Windows\system32\Kffkke32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kelhmaae.exeC:\Windows\system32\Kelhmaae.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lmemco32.exeC:\Windows\system32\Lmemco32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lmjfnnkp.exeC:\Windows\system32\Lmjfnnkp.exe12⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lpjopiha.exeC:\Windows\system32\Lpjopiha.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Llapejne.exeC:\Windows\system32\Llapejne.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mlclkjlb.exeC:\Windows\system32\Mlclkjlb.exe15⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ncidcbib.exeC:\Windows\system32\Ncidcbib.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Aqpcpa32.exeC:\Windows\system32\Aqpcpa32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Banpapnc.exeC:\Windows\system32\Banpapnc.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Cecnhm32.exeC:\Windows\system32\Cecnhm32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Cjepkchd.exeC:\Windows\system32\Cjepkchd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Cemanl32.exeC:\Windows\system32\Cemanl32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Gkmhjmeg.exeC:\Windows\system32\Gkmhjmeg.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Gkoeomcd.exeC:\Windows\system32\Gkoeomcd.exe23⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hgdbel32.exeC:\Windows\system32\Hgdbel32.exe24⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Iblchd32.exeC:\Windows\system32\Iblchd32.exe25⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Igkhfkgp.exeC:\Windows\system32\Igkhfkgp.exe26⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ingmhelj.exeC:\Windows\system32\Ingmhelj.exe27⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Igbngj32.exeC:\Windows\system32\Igbngj32.exe28⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Alfmjlll.exeC:\Windows\system32\Alfmjlll.exe29⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hjaggahp.exeC:\Windows\system32\Hjaggahp.exe30⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lnjdajjg.exeC:\Windows\system32\Lnjdajjg.exe31⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Llnekn32.exeC:\Windows\system32\Llnekn32.exe32⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Mnnnli32.exeC:\Windows\system32\Mnnnli32.exe33⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mekcoc32.exeC:\Windows\system32\Mekcoc32.exe34⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mlidfl32.exeC:\Windows\system32\Mlidfl32.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Poffkc32.exeC:\Windows\system32\Poffkc32.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Cmpbmb32.exeC:\Windows\system32\Cmpbmb32.exe37⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ckeono32.exeC:\Windows\system32\Ckeono32.exe38⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dobgdmma.exeC:\Windows\system32\Dobgdmma.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dbcqfh32.exeC:\Windows\system32\Dbcqfh32.exe40⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dfailfpi.exeC:\Windows\system32\Dfailfpi.exe41⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dkqnjm32.exeC:\Windows\system32\Dkqnjm32.exe42⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fchobhom.exeC:\Windows\system32\Fchobhom.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hdmade32.exeC:\Windows\system32\Hdmade32.exe44⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hdbkod32.exeC:\Windows\system32\Hdbkod32.exe45⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hmjphj32.exeC:\Windows\system32\Hmjphj32.exe46⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hiapmked.exeC:\Windows\system32\Hiapmked.exe47⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Igeafocn.exeC:\Windows\system32\Igeafocn.exe48⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Ilainf32.exeC:\Windows\system32\Ilainf32.exe49⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ildfdf32.exeC:\Windows\system32\Ildfdf32.exe50⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Igijao32.exeC:\Windows\system32\Igijao32.exe51⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ipbojd32.exeC:\Windows\system32\Ipbojd32.exe52⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Iijccjmj.exeC:\Windows\system32\Iijccjmj.exe53⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Idpgpblp.exeC:\Windows\system32\Idpgpblp.exe54⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Jpfhecbd.exeC:\Windows\system32\Jpfhecbd.exe55⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Jlmijd32.exeC:\Windows\system32\Jlmijd32.exe56⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Jcgagooe.exeC:\Windows\system32\Jcgagooe.exe57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Jnmedgok.exeC:\Windows\system32\Jnmedgok.exe58⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Jdgnaafh.exeC:\Windows\system32\Jdgnaafh.exe59⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Jjcfihdo.exeC:\Windows\system32\Jjcfihdo.exe60⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Jcljbn32.exeC:\Windows\system32\Jcljbn32.exe61⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Jldokcap.exeC:\Windows\system32\Jldokcap.exe62⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Jcnggnim.exeC:\Windows\system32\Jcnggnim.exe63⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Kccqbm32.exeC:\Windows\system32\Kccqbm32.exe64⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Klkekblh.exeC:\Windows\system32\Klkekblh.exe65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Kgaiikkn.exeC:\Windows\system32\Kgaiikkn.exe66⤵
-
C:\Windows\SysWOW64\Kmnbabie.exeC:\Windows\system32\Kmnbabie.exe67⤵
-
C:\Windows\SysWOW64\Kkobojad.exeC:\Windows\system32\Kkobojad.exe68⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kdgfho32.exeC:\Windows\system32\Kdgfho32.exe69⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Lmbkla32.exeC:\Windows\system32\Lmbkla32.exe70⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Lghpij32.exeC:\Windows\system32\Lghpij32.exe71⤵
-
C:\Windows\SysWOW64\Lqpdbp32.exeC:\Windows\system32\Lqpdbp32.exe72⤵
-
C:\Windows\SysWOW64\Lkfhpi32.exeC:\Windows\system32\Lkfhpi32.exe73⤵
-
C:\Windows\SysWOW64\Lqbqhp32.exeC:\Windows\system32\Lqbqhp32.exe74⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ljkeqe32.exeC:\Windows\system32\Ljkeqe32.exe75⤵
-
C:\Windows\SysWOW64\Ldqinn32.exeC:\Windows\system32\Ldqinn32.exe76⤵
-
C:\Windows\SysWOW64\Ljmbfe32.exeC:\Windows\system32\Ljmbfe32.exe77⤵
-
C:\Windows\SysWOW64\Ldcfcn32.exeC:\Windows\system32\Ldcfcn32.exe78⤵
-
C:\Windows\SysWOW64\Mjpold32.exeC:\Windows\system32\Mjpold32.exe79⤵
-
C:\Windows\SysWOW64\Mchcdj32.exeC:\Windows\system32\Mchcdj32.exe80⤵
-
C:\Windows\SysWOW64\Mnngbb32.exeC:\Windows\system32\Mnngbb32.exe81⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Mehpomjb.exeC:\Windows\system32\Mehpomjb.exe82⤵
-
C:\Windows\SysWOW64\Maqminnd.exeC:\Windows\system32\Maqminnd.exe83⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Mgkefh32.exeC:\Windows\system32\Mgkefh32.exe84⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Mmgnno32.exeC:\Windows\system32\Mmgnno32.exe85⤵
-
C:\Windows\SysWOW64\Nkinlf32.exeC:\Windows\system32\Nkinlf32.exe86⤵
-
C:\Windows\SysWOW64\Nmjjcnae.exeC:\Windows\system32\Nmjjcnae.exe87⤵
-
C:\Windows\SysWOW64\Ngooagak.exeC:\Windows\system32\Ngooagak.exe88⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nmlginoc.exeC:\Windows\system32\Nmlginoc.exe89⤵
-
C:\Windows\SysWOW64\Ngakff32.exeC:\Windows\system32\Ngakff32.exe90⤵
-
C:\Windows\SysWOW64\Nmocon32.exeC:\Windows\system32\Nmocon32.exe91⤵
-
C:\Windows\SysWOW64\Ngdhlf32.exeC:\Windows\system32\Ngdhlf32.exe92⤵
-
C:\Windows\SysWOW64\Nallelcg.exeC:\Windows\system32\Nallelcg.exe93⤵
-
C:\Windows\SysWOW64\Ngfdafkc.exeC:\Windows\system32\Ngfdafkc.exe94⤵
-
C:\Windows\SysWOW64\Naoijk32.exeC:\Windows\system32\Naoijk32.exe95⤵
-
C:\Windows\SysWOW64\Ojgncahd.exeC:\Windows\system32\Ojgncahd.exe96⤵
-
C:\Windows\SysWOW64\Ocpblf32.exeC:\Windows\system32\Ocpblf32.exe97⤵
-
C:\Windows\SysWOW64\Omhfel32.exeC:\Windows\system32\Omhfel32.exe98⤵
-
C:\Windows\SysWOW64\Odfhme32.exeC:\Windows\system32\Odfhme32.exe99⤵
-
C:\Windows\SysWOW64\Onlljn32.exeC:\Windows\system32\Onlljn32.exe100⤵
-
C:\Windows\SysWOW64\Phdacdoc.exeC:\Windows\system32\Phdacdoc.exe101⤵
-
C:\Windows\SysWOW64\Pooipnfp.exeC:\Windows\system32\Pooipnfp.exe102⤵
-
C:\Windows\SysWOW64\Pdkahedh.exeC:\Windows\system32\Pdkahedh.exe103⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Poafendn.exeC:\Windows\system32\Poafendn.exe104⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Phijnc32.exeC:\Windows\system32\Phijnc32.exe105⤵
-
C:\Windows\SysWOW64\Pmfcfj32.exeC:\Windows\system32\Pmfcfj32.exe106⤵
-
C:\Windows\SysWOW64\Pdpkcd32.exeC:\Windows\system32\Pdpkcd32.exe107⤵
-
C:\Windows\SysWOW64\Pmhpljgc.exeC:\Windows\system32\Pmhpljgc.exe108⤵
-
C:\Windows\SysWOW64\Pdbhhd32.exeC:\Windows\system32\Pdbhhd32.exe109⤵
-
C:\Windows\SysWOW64\Qmklaiep.exeC:\Windows\system32\Qmklaiep.exe110⤵
-
C:\Windows\SysWOW64\Qhpqob32.exeC:\Windows\system32\Qhpqob32.exe111⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Qdgaccjj.exeC:\Windows\system32\Qdgaccjj.exe112⤵
-
C:\Windows\SysWOW64\Aomealjp.exeC:\Windows\system32\Aomealjp.exe113⤵
-
C:\Windows\SysWOW64\Aoaolk32.exeC:\Windows\system32\Aoaolk32.exe114⤵
-
C:\Windows\SysWOW64\Adngdb32.exeC:\Windows\system32\Adngdb32.exe115⤵
-
C:\Windows\SysWOW64\Amflmh32.exeC:\Windows\system32\Amflmh32.exe116⤵
-
C:\Windows\SysWOW64\Alglkobb.exeC:\Windows\system32\Alglkobb.exe117⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Aaddcfai.exeC:\Windows\system32\Aaddcfai.exe118⤵
-
C:\Windows\SysWOW64\Akmillgj.exeC:\Windows\system32\Akmillgj.exe119⤵
-
C:\Windows\SysWOW64\Bdemea32.exeC:\Windows\system32\Bdemea32.exe120⤵
-
C:\Windows\SysWOW64\Bokabj32.exeC:\Windows\system32\Bokabj32.exe121⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Bdgjja32.exeC:\Windows\system32\Bdgjja32.exe122⤵
-
C:\Windows\SysWOW64\Bomnhjln.exeC:\Windows\system32\Bomnhjln.exe123⤵
-
C:\Windows\SysWOW64\Bdjgpqje.exeC:\Windows\system32\Bdjgpqje.exe124⤵
-
C:\Windows\SysWOW64\Bookmijk.exeC:\Windows\system32\Bookmijk.exe125⤵
-
C:\Windows\SysWOW64\Bhhpfo32.exeC:\Windows\system32\Bhhpfo32.exe126⤵
-
C:\Windows\SysWOW64\Bndhnfnc.exeC:\Windows\system32\Bndhnfnc.exe127⤵
-
C:\Windows\SysWOW64\Bhjlloni.exeC:\Windows\system32\Bhjlloni.exe128⤵
-
C:\Windows\SysWOW64\Cabqdd32.exeC:\Windows\system32\Cabqdd32.exe129⤵
-
C:\Windows\SysWOW64\Clhebm32.exeC:\Windows\system32\Clhebm32.exe130⤵
-
C:\Windows\SysWOW64\Cepikb32.exeC:\Windows\system32\Cepikb32.exe131⤵
-
C:\Windows\SysWOW64\Ckmbci32.exeC:\Windows\system32\Ckmbci32.exe132⤵
-
C:\Windows\SysWOW64\Cfgpkaeh.exeC:\Windows\system32\Cfgpkaeh.exe133⤵
-
C:\Windows\SysWOW64\Dkdhchco.exeC:\Windows\system32\Dkdhchco.exe134⤵
-
C:\Windows\SysWOW64\Dfjlaa32.exeC:\Windows\system32\Dfjlaa32.exe135⤵
-
C:\Windows\SysWOW64\Dobqjgie.exeC:\Windows\system32\Dobqjgie.exe136⤵
-
C:\Windows\SysWOW64\Dflifa32.exeC:\Windows\system32\Dflifa32.exe137⤵
-
C:\Windows\SysWOW64\Dkiaoh32.exeC:\Windows\system32\Dkiaoh32.exe138⤵
-
C:\Windows\SysWOW64\Dfnelq32.exeC:\Windows\system32\Dfnelq32.exe139⤵
-
C:\Windows\SysWOW64\Dogjef32.exeC:\Windows\system32\Dogjef32.exe140⤵
-
C:\Windows\SysWOW64\Dhoonlla.exeC:\Windows\system32\Dhoonlla.exe141⤵
-
C:\Windows\SysWOW64\Dnlgfbjh.exeC:\Windows\system32\Dnlgfbjh.exe142⤵
-
C:\Windows\SysWOW64\Ekpgog32.exeC:\Windows\system32\Ekpgog32.exe143⤵
-
C:\Windows\SysWOW64\Edhlhlpb.exeC:\Windows\system32\Edhlhlpb.exe144⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Eonpeeoh.exeC:\Windows\system32\Eonpeeoh.exe145⤵
-
C:\Windows\SysWOW64\Eifenk32.exeC:\Windows\system32\Eifenk32.exe146⤵
-
C:\Windows\SysWOW64\Eopmke32.exeC:\Windows\system32\Eopmke32.exe147⤵
-
C:\Windows\SysWOW64\Efjehodb.exeC:\Windows\system32\Efjehodb.exe148⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ekgnpfcj.exeC:\Windows\system32\Ekgnpfcj.exe149⤵
-
C:\Windows\SysWOW64\Eflbmobp.exeC:\Windows\system32\Eflbmobp.exe150⤵
-
C:\Windows\SysWOW64\Ekijeeag.exeC:\Windows\system32\Ekijeeag.exe151⤵
-
C:\Windows\SysWOW64\Efoocn32.exeC:\Windows\system32\Efoocn32.exe152⤵
-
C:\Windows\SysWOW64\Fkkgke32.exeC:\Windows\system32\Fkkgke32.exe153⤵
-
C:\Windows\SysWOW64\Ffakhn32.exeC:\Windows\system32\Ffakhn32.exe154⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fpipacek.exeC:\Windows\system32\Fpipacek.exe155⤵
-
C:\Windows\SysWOW64\Fpqfbboc.exeC:\Windows\system32\Fpqfbboc.exe156⤵
-
C:\Windows\SysWOW64\Gemnjimj.exeC:\Windows\system32\Gemnjimj.exe157⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Gpcbgbmp.exeC:\Windows\system32\Gpcbgbmp.exe158⤵
-
C:\Windows\SysWOW64\Gikgphca.exeC:\Windows\system32\Gikgphca.exe159⤵
-
C:\Windows\SysWOW64\Gnhphoah.exeC:\Windows\system32\Gnhphoah.exe160⤵
-
C:\Windows\SysWOW64\Gmipff32.exeC:\Windows\system32\Gmipff32.exe161⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Gbfhom32.exeC:\Windows\system32\Gbfhom32.exe162⤵
-
C:\Windows\SysWOW64\Gipqkg32.exeC:\Windows\system32\Gipqkg32.exe163⤵
-
C:\Windows\SysWOW64\Gbhedmfl.exeC:\Windows\system32\Gbhedmfl.exe164⤵
-
C:\Windows\SysWOW64\Glqimb32.exeC:\Windows\system32\Glqimb32.exe165⤵
-
C:\Windows\SysWOW64\Hffnjk32.exeC:\Windows\system32\Hffnjk32.exe166⤵
-
C:\Windows\SysWOW64\Hlcfbbjj.exeC:\Windows\system32\Hlcfbbjj.exe167⤵
-
C:\Windows\SysWOW64\Hfhjpkjp.exeC:\Windows\system32\Hfhjpkjp.exe168⤵
-
C:\Windows\SysWOW64\Hpaoip32.exeC:\Windows\system32\Hpaoip32.exe169⤵
-
C:\Windows\SysWOW64\Hengag32.exeC:\Windows\system32\Hengag32.exe170⤵
-
C:\Windows\SysWOW64\Hpclnpon.exeC:\Windows\system32\Hpclnpon.exe171⤵
-
C:\Windows\SysWOW64\Hilpge32.exeC:\Windows\system32\Hilpge32.exe172⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hpehdpmk.exeC:\Windows\system32\Hpehdpmk.exe173⤵
-
C:\Windows\SysWOW64\Hebqlfkb.exeC:\Windows\system32\Hebqlfkb.exe174⤵
-
C:\Windows\SysWOW64\Hokeelac.exeC:\Windows\system32\Hokeelac.exe175⤵
-
C:\Windows\SysWOW64\Iedmaf32.exeC:\Windows\system32\Iedmaf32.exe176⤵
-
C:\Windows\SysWOW64\Ipjaoo32.exeC:\Windows\system32\Ipjaoo32.exe177⤵
-
C:\Windows\SysWOW64\Iegjgf32.exeC:\Windows\system32\Iegjgf32.exe178⤵
-
C:\Windows\SysWOW64\Ipmndo32.exeC:\Windows\system32\Ipmndo32.exe179⤵
-
C:\Windows\SysWOW64\Ieigmeej.exeC:\Windows\system32\Ieigmeej.exe180⤵
-
C:\Windows\SysWOW64\Ioakek32.exeC:\Windows\system32\Ioakek32.exe181⤵
-
C:\Windows\SysWOW64\Ilfloo32.exeC:\Windows\system32\Ilfloo32.exe182⤵
-
C:\Windows\SysWOW64\Ifkplhjj.exeC:\Windows\system32\Ifkplhjj.exe183⤵
-
C:\Windows\SysWOW64\Jofeqjge.exeC:\Windows\system32\Jofeqjge.exe184⤵
-
C:\Windows\SysWOW64\Jilincgk.exeC:\Windows\system32\Jilincgk.exe185⤵
-
C:\Windows\SysWOW64\Jpfakm32.exeC:\Windows\system32\Jpfakm32.exe186⤵
-
C:\Windows\SysWOW64\Jecjcdmp.exeC:\Windows\system32\Jecjcdmp.exe187⤵
-
C:\Windows\SysWOW64\Kobdlimh.exeC:\Windows\system32\Kobdlimh.exe188⤵
-
C:\Windows\SysWOW64\Kihhjamn.exeC:\Windows\system32\Kihhjamn.exe189⤵
-
C:\Windows\SysWOW64\Kglice32.exeC:\Windows\system32\Kglice32.exe190⤵
-
C:\Windows\SysWOW64\Klhakm32.exeC:\Windows\system32\Klhakm32.exe191⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Keafdbqp.exeC:\Windows\system32\Keafdbqp.exe192⤵
-
C:\Windows\SysWOW64\Kpfjak32.exeC:\Windows\system32\Kpfjak32.exe193⤵
-
C:\Windows\SysWOW64\Kjoojqgf.exeC:\Windows\system32\Kjoojqgf.exe194⤵
-
C:\Windows\SysWOW64\Kokgbgen.exeC:\Windows\system32\Kokgbgen.exe195⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Knmgqo32.exeC:\Windows\system32\Knmgqo32.exe196⤵
-
C:\Windows\SysWOW64\Lcipiekd.exeC:\Windows\system32\Lcipiekd.exe197⤵
-
C:\Windows\SysWOW64\Lnodfnkj.exeC:\Windows\system32\Lnodfnkj.exe198⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Lclmneia.exeC:\Windows\system32\Lclmneia.exe199⤵
-
C:\Windows\SysWOW64\Lnaalnig.exeC:\Windows\system32\Lnaalnig.exe200⤵
-
C:\Windows\SysWOW64\Mcgljcod.exeC:\Windows\system32\Mcgljcod.exe201⤵
-
C:\Windows\SysWOW64\Mmpqcied.exeC:\Windows\system32\Mmpqcied.exe202⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Mgeepbej.exeC:\Windows\system32\Mgeepbej.exe203⤵
-
C:\Windows\SysWOW64\Mqniig32.exeC:\Windows\system32\Mqniig32.exe204⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Mocfjd32.exeC:\Windows\system32\Mocfjd32.exe205⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Nndfhkib.exeC:\Windows\system32\Nndfhkib.exe206⤵
-
C:\Windows\SysWOW64\Ncaopbgi.exeC:\Windows\system32\Ncaopbgi.exe207⤵
-
C:\Windows\SysWOW64\Nnfcnk32.exeC:\Windows\system32\Nnfcnk32.exe208⤵
-
C:\Windows\SysWOW64\Ncclfb32.exeC:\Windows\system32\Ncclfb32.exe209⤵
-
C:\Windows\SysWOW64\Nmlpogkg.exeC:\Windows\system32\Nmlpogkg.exe210⤵
-
C:\Windows\SysWOW64\Nfddgm32.exeC:\Windows\system32\Nfddgm32.exe211⤵
-
C:\Windows\SysWOW64\Nqiiefbn.exeC:\Windows\system32\Nqiiefbn.exe212⤵
-
C:\Windows\SysWOW64\Nffammpe.exeC:\Windows\system32\Nffammpe.exe213⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nqlejepk.exeC:\Windows\system32\Nqlejepk.exe214⤵
-
C:\Windows\SysWOW64\Nfinblnb.exeC:\Windows\system32\Nfinblnb.exe215⤵
-
C:\Windows\SysWOW64\Oqnbpe32.exeC:\Windows\system32\Oqnbpe32.exe216⤵
-
C:\Windows\SysWOW64\Ofkkhl32.exeC:\Windows\system32\Ofkkhl32.exe217⤵
-
C:\Windows\SysWOW64\Oaqoee32.exeC:\Windows\system32\Oaqoee32.exe218⤵
-
C:\Windows\SysWOW64\Ofmgnl32.exeC:\Windows\system32\Ofmgnl32.exe219⤵
-
C:\Windows\SysWOW64\Oaclkd32.exeC:\Windows\system32\Oaclkd32.exe220⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ojkpdj32.exeC:\Windows\system32\Ojkpdj32.exe221⤵
-
C:\Windows\SysWOW64\Ophila32.exeC:\Windows\system32\Ophila32.exe222⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ojnmij32.exeC:\Windows\system32\Ojnmij32.exe223⤵
-
C:\Windows\SysWOW64\Ocfaboea.exeC:\Windows\system32\Ocfaboea.exe224⤵
-
C:\Windows\SysWOW64\Pjpioiln.exeC:\Windows\system32\Pjpioiln.exe225⤵
-
C:\Windows\SysWOW64\Pchnho32.exeC:\Windows\system32\Pchnho32.exe226⤵
-
C:\Windows\SysWOW64\Pnnbeh32.exeC:\Windows\system32\Pnnbeh32.exe227⤵
-
C:\Windows\SysWOW64\Pckkmo32.exeC:\Windows\system32\Pckkmo32.exe228⤵
-
C:\Windows\SysWOW64\Pnpokgpb.exeC:\Windows\system32\Pnpokgpb.exe229⤵
-
C:\Windows\SysWOW64\Pcmgcnoi.exeC:\Windows\system32\Pcmgcnoi.exe230⤵
-
C:\Windows\SysWOW64\Pmelld32.exeC:\Windows\system32\Pmelld32.exe231⤵
-
C:\Windows\SysWOW64\Pfnpdilj.exeC:\Windows\system32\Pfnpdilj.exe232⤵
-
C:\Windows\SysWOW64\Ppfemobk.exeC:\Windows\system32\Ppfemobk.exe233⤵
-
C:\Windows\SysWOW64\Qngekf32.exeC:\Windows\system32\Qngekf32.exe234⤵
-
C:\Windows\SysWOW64\Qddncm32.exeC:\Windows\system32\Qddncm32.exe235⤵
-
C:\Windows\SysWOW64\Qnibafhg.exeC:\Windows\system32\Qnibafhg.exe236⤵
-
C:\Windows\SysWOW64\Qdfjimfo.exeC:\Windows\system32\Qdfjimfo.exe237⤵
-
C:\Windows\SysWOW64\Anlofffd.exeC:\Windows\system32\Anlofffd.exe238⤵
-
C:\Windows\SysWOW64\Adigomdl.exeC:\Windows\system32\Adigomdl.exe239⤵
-
C:\Windows\SysWOW64\Aonkledb.exeC:\Windows\system32\Aonkledb.exe240⤵
-
C:\Windows\SysWOW64\Apphcnjp.exeC:\Windows\system32\Apphcnjp.exe241⤵