Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
05-05-2021 09:08
Static task
static1
Behavioral task
behavioral1
Sample
a1b0c92c_by_Libranalysis.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a1b0c92c_by_Libranalysis.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
a1b0c92c_by_Libranalysis.exe
-
Size
5.4MB
-
MD5
a1b0c92cde3fe7be79a4b7d0bb67e370
-
SHA1
36149b0824136f3bcf422ad5a637cff1e2bbfc93
-
SHA256
b89d7e2df8e9fd758a5c6dc5b44ee263699c84ebd3da11e44d312643f2c06483
-
SHA512
a9dbe6a968971ce542a0c87e3df9ac3b800b3ceb61f5a0bfb5961be7046d575d8a15b5c3a41ca61c0cd1ba023889482ed71801cb466010c51b6efd948672836e
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs
-
Executes dropped EXE 64 IoCs
Processes:
Nekleqmi.exePhjahjnj.exePagoloqe.exeAheqdhdm.exeBkpmlaic.exeBkbiaa32.exeBhfjke32.exeHlhfhg32.exeIlainf32.exeJcedaoah.exeKcemhm32.exeMcjpjj32.exeOacbekmo.exePoeopm32.exeAeijcfoj.exeDkkndgmg.exeEbllaqnl.exeFeaonkgh.exeGplenaee.exeHbmnol32.exeJbbqai32.exeKnhnepab.exeLjfekp32.exeMqgchhbc.exePjbfdijk.exeApmknn32.exeBampooec.exeCpggkjfe.exeChpkbg32.exeCdglghji.exeDdiilh32.exeIibomnkj.exeOfomie32.exePpnhbjeg.exeAfflpbpd.exeAanmcj32.exeAfkfka32.exeAaqjij32.exeAbbfqbac.exeBmgknk32.exeBbdcfb32.exeBinkblgm.exeBbfpla32.exeBmldijmc.exeBdfled32.exeBicenk32.exeBpmmjejd.exeBmqndjin.exeBfibmopo.exeCmcjii32.exeCbpbap32.exeCmegoi32.exeCfnkho32.exeCdblac32.exeCaflkg32.exeCgbecngd.exeCmlmph32.exeCdfelbfn.exeDicndide.exeDdibbbdk.exeDiejji32.exeDkegdlje.exeDpbolbhm.exeDkgcjk32.exepid process 2664 Nekleqmi.exe 3780 Phjahjnj.exe 2744 Pagoloqe.exe 3588 Aheqdhdm.exe 204 Bkpmlaic.exe 4060 Bkbiaa32.exe 2904 Bhfjke32.exe 1252 Hlhfhg32.exe 3356 Ilainf32.exe 1428 Jcedaoah.exe 4048 Kcemhm32.exe 652 Mcjpjj32.exe 3852 Oacbekmo.exe 1820 Poeopm32.exe 2696 Aeijcfoj.exe 3028 Dkkndgmg.exe 1564 Ebllaqnl.exe 3876 Feaonkgh.exe 1244 Gplenaee.exe 2076 Hbmnol32.exe 4044 Jbbqai32.exe 1532 Knhnepab.exe 1920 Ljfekp32.exe 4056 Mqgchhbc.exe 2132 Pjbfdijk.exe 2544 Apmknn32.exe 1748 Bampooec.exe 192 Cpggkjfe.exe 960 Chpkbg32.exe 4120 Cdglghji.exe 4144 Ddiilh32.exe 4184 Iibomnkj.exe 4212 Ofomie32.exe 4232 Ppnhbjeg.exe 4256 Afflpbpd.exe 4276 Aanmcj32.exe 4296 Afkfka32.exe 4316 Aaqjij32.exe 4336 Abbfqbac.exe 4356 Bmgknk32.exe 4376 Bbdcfb32.exe 4396 Binkblgm.exe 4416 Bbfpla32.exe 4436 Bmldijmc.exe 4456 Bdfled32.exe 4476 Bicenk32.exe 4496 Bpmmjejd.exe 4520 Bmqndjin.exe 4540 Bfibmopo.exe 4560 Cmcjii32.exe 4580 Cbpbap32.exe 4600 Cmegoi32.exe 4620 Cfnkho32.exe 4640 Cdblac32.exe 4660 Caflkg32.exe 4680 Cgbecngd.exe 4700 Cmlmph32.exe 4720 Cdfelbfn.exe 4740 Dicndide.exe 4756 Ddibbbdk.exe 4812 Diejji32.exe 4832 Dkegdlje.exe 4852 Dpbolbhm.exe 4872 Dkgcjk32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Egggekel.exeInldeo32.exeLamoee32.exeEgpjjehh.exeIjmdejng.exeCbpbap32.exeEjhpffbm.exeIqlfmdan.exeMfppiojm.exeDlhigm32.exeLanneipj.exePhjahjnj.exeAanmcj32.exeDceecm32.exeJaclmc32.exeOomafplb.exeEnjiafca.exeNdcjin32.exeObegcpfg.exeHdnogd32.exeAhckgqhp.exeKbciijhb.exeDhepki32.exeLfkfnp32.exeBmqndjin.exeNcbnaeno.exeBmgdcenm.exeKnppmf32.exeMhdmhgpe.exeIcclhpgj.exeGoddan32.exeHflhof32.exeIciloi32.exeJdfiodjp.exeKbjfbkpm.exeEejqfa32.exeNadgbl32.exeGcmclmef.exeAfflpbpd.exeKfkdahpp.exeDboncapi.exeMqgchhbc.exeGjkfccbh.exeNkhbpb32.exeKjifmp32.exeIejfmhkp.exeNhacol32.exeGpdgeg32.exeQkhdnnoo.exeNleiol32.exeBebhhg32.exeKejhjp32.exeGplenaee.exeDkegdlje.exeEcnhjl32.exeGcldkjop.exeIchmnffp.exeJmkcnm32.exeFiiogiic.exeGenlnhbg.exeGkkbmfij.exeJbnfgmjj.exeCbahmj32.exedescription ioc process File created C:\Windows\SysWOW64\Qapdnn32.dll Egggekel.exe File created C:\Windows\SysWOW64\Ichmnffp.exe Inldeo32.exe File created C:\Windows\SysWOW64\Ocpjbj32.dll Lamoee32.exe File opened for modification C:\Windows\SysWOW64\Emjbfp32.exe Egpjjehh.exe File created C:\Windows\SysWOW64\Ceilfm32.dll Ijmdejng.exe File opened for modification C:\Windows\SysWOW64\Cmegoi32.exe Cbpbap32.exe File opened for modification C:\Windows\SysWOW64\Ednddo32.exe Ejhpffbm.exe File created C:\Windows\SysWOW64\Mimdck32.dll Iqlfmdan.exe File created C:\Windows\SysWOW64\Mmjhfi32.exe Mfppiojm.exe File created C:\Windows\SysWOW64\Amppmd32.dll Dlhigm32.exe File created C:\Windows\SysWOW64\Lfkfnp32.exe Lanneipj.exe File created C:\Windows\SysWOW64\Flcqko32.dll Phjahjnj.exe File created C:\Windows\SysWOW64\Ihmmopjb.dll Aanmcj32.exe File opened for modification C:\Windows\SysWOW64\Enjiafca.exe Dceecm32.exe File created C:\Windows\SysWOW64\Ombjifmb.dll Jaclmc32.exe File created C:\Windows\SysWOW64\Gpadcm32.dll Oomafplb.exe File created C:\Windows\SysWOW64\Edgncp32.exe Enjiafca.exe File created C:\Windows\SysWOW64\Mmoocopd.dll Ndcjin32.exe File created C:\Windows\SysWOW64\Iocooc32.dll Obegcpfg.exe File opened for modification C:\Windows\SysWOW64\Ifololhp.exe Hdnogd32.exe File opened for modification C:\Windows\SysWOW64\Anpcpgfh.exe Ahckgqhp.exe File opened for modification C:\Windows\SysWOW64\Khpaaqfi.exe Kbciijhb.exe File created C:\Windows\SysWOW64\Oackfiga.dll Dhepki32.exe File created C:\Windows\SysWOW64\Ckjqfpnc.dll Lfkfnp32.exe File created C:\Windows\SysWOW64\Bfibmopo.exe Bmqndjin.exe File created C:\Windows\SysWOW64\Ndcjin32.exe Ncbnaeno.exe File created C:\Windows\SysWOW64\Bebhhg32.exe Bmgdcenm.exe File created C:\Windows\SysWOW64\Kejhjp32.exe Knppmf32.exe File opened for modification C:\Windows\SysWOW64\Mmaeanom.exe Mhdmhgpe.exe File opened for modification C:\Windows\SysWOW64\Ijmdejng.exe Icclhpgj.exe File opened for modification C:\Windows\SysWOW64\Genlnhbg.exe Goddan32.exe File created C:\Windows\SysWOW64\Igleii32.exe Hflhof32.exe File created C:\Windows\SysWOW64\Jhnpodqg.dll Iciloi32.exe File opened for modification C:\Windows\SysWOW64\Jjqalnam.exe Jdfiodjp.exe File created C:\Windows\SysWOW64\Klelcnli.dll Kbjfbkpm.exe File opened for modification C:\Windows\SysWOW64\Eldickph.exe Eejqfa32.exe File opened for modification C:\Windows\SysWOW64\Ngapjc32.exe Nadgbl32.exe File created C:\Windows\SysWOW64\Ndlbflnj.dll Gcmclmef.exe File opened for modification C:\Windows\SysWOW64\Aanmcj32.exe Afflpbpd.exe File created C:\Windows\SysWOW64\Kmemnb32.exe Kfkdahpp.exe File created C:\Windows\SysWOW64\Bcenpe32.dll Dboncapi.exe File created C:\Windows\SysWOW64\Pjbfdijk.exe Mqgchhbc.exe File opened for modification C:\Windows\SysWOW64\Edgncp32.exe Enjiafca.exe File opened for modification C:\Windows\SysWOW64\Gqenpm32.exe Gjkfccbh.exe File created C:\Windows\SysWOW64\Gcckcmda.dll Nkhbpb32.exe File opened for modification C:\Windows\SysWOW64\Kabnjjjh.exe Kjifmp32.exe File created C:\Windows\SysWOW64\Hnfchkjd.dll Iejfmhkp.exe File opened for modification C:\Windows\SysWOW64\Ncfgle32.exe Nhacol32.exe File created C:\Windows\SysWOW64\Lpajja32.dll Gpdgeg32.exe File created C:\Windows\SysWOW64\Qbbljg32.exe Qkhdnnoo.exe File opened for modification C:\Windows\SysWOW64\Nabagb32.exe Nleiol32.exe File created C:\Windows\SysWOW64\Fioilepc.dll Bebhhg32.exe File opened for modification C:\Windows\SysWOW64\Kfkdahpp.exe Kejhjp32.exe File created C:\Windows\SysWOW64\Hbmnol32.exe Gplenaee.exe File created C:\Windows\SysWOW64\Cginkdpl.dll Dkegdlje.exe File created C:\Windows\SysWOW64\Ffijjlch.dll Ecnhjl32.exe File created C:\Windows\SysWOW64\Gcoaqimn.exe Gcldkjop.exe File opened for modification C:\Windows\SysWOW64\Ijbejp32.exe Ichmnffp.exe File created C:\Windows\SysWOW64\Aomild32.dll Jmkcnm32.exe File created C:\Windows\SysWOW64\Ldhibe32.dll Fiiogiic.exe File opened for modification C:\Windows\SysWOW64\Glhdjbjd.exe Genlnhbg.exe File created C:\Windows\SysWOW64\Ehplknpf.dll Gkkbmfij.exe File created C:\Windows\SysWOW64\Jcpcoe32.exe Jbnfgmjj.exe File created C:\Windows\SysWOW64\Cilqic32.exe Cbahmj32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 10396 10344 WerFault.exe Mholca32.exe -
Modifies registry class 64 IoCs
Processes:
Bbdcfb32.exeMkmjoj32.exeOkcblqag.exeOhjojdnn.exeKidphnon.exeDiejji32.exeEakomdgd.exeGjfenn32.exeGenlnhbg.exeJccneh32.exeKhlhfa32.exeCfpach32.exeJmbpgo32.exeHjdiibjm.exeAfcipl32.exeFecclppp.exeAoijikcb.exeDpnebf32.exeKjljmfdd.exeNadgbl32.exeOfomie32.exeFjmiae32.exeHchcghdc.exeGfmfbohe.exeImnngekh.exeJfdnaifh.exeCfhdhb32.exeDhepki32.exeMlapcllj.exeFciqkd32.exePoeopm32.exeBmqndjin.exeDdibbbdk.exeDadhlemm.exeJcpcoe32.exeJdfiodjp.exeIjmdejng.exeMhdmhgpe.exeBkimdk32.exeMmeokjeo.exeIcclhpgj.exeCbcnhc32.exeKcemhm32.exeDgndolmg.exeGkkbmfij.exeAbjiem32.exeClhppphh.exeEicpap32.exeEfdmjo32.exeHhcnjblc.exea1b0c92c_by_Libranalysis.exeFqgbnp32.exePofdmnch.exeIlkjgp32.exeAeijcfoj.exeBfaeajbk.exeHmdkqgcb.exeMpfhlebp.exeAbibkfpc.exeAifgmpfn.exeHkfbidom.exeNapeacho.exeNkmbehkj.exeNagkbbbg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bbdcfb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mkmjoj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Okcblqag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ohjojdnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kidphnon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Diejji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdekln32.dll" Eakomdgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkfnip32.dll" Gjfenn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhgnop32.dll" Genlnhbg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jccneh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fokldpcd.dll" Khlhfa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cfpach32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jmbpgo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hjdiibjm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Afcipl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fecclppp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aoijikcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fobaic32.dll" Dpnebf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmjoif32.dll" Kjljmfdd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnjobj32.dll" Nadgbl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ofomie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgcgofbq.dll" Fjmiae32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hchcghdc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lohimloh.dll" Gfmfbohe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Imnngekh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpnbhlip.dll" Jfdnaifh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cfhdhb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oackfiga.dll" Dhepki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oaomel32.dll" Mlapcllj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fciqkd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Poeopm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bmqndjin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ddibbbdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Piddmd32.dll" Dadhlemm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifjffkah.dll" Jcpcoe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jdfiodjp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ijmdejng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mhdmhgpe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bkimdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mmeokjeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgbkgc32.dll" Icclhpgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igadhkoc.dll" Cbcnhc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kcemhm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dgndolmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gkkbmfij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhhedc32.dll" Abjiem32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Clhppphh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eicpap32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Efdmjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Almmfcfa.dll" Hhcnjblc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 a1b0c92c_by_Libranalysis.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fqgbnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pofdmnch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Injnim32.dll" Ilkjgp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhmebo32.dll" Aeijcfoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bfaeajbk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hmdkqgcb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mpfhlebp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnjkkf32.dll" Abibkfpc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipelaogl.dll" Aifgmpfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hkfbidom.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Napeacho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfkkajbl.dll" Nkmbehkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiggmbhp.dll" Nagkbbbg.exe -
Suspicious behavior: EnumeratesProcesses 61 IoCs
Processes:
WerFault.exepid process 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe 10396 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 10396 WerFault.exe Token: SeBackupPrivilege 10396 WerFault.exe Token: SeDebugPrivilege 10396 WerFault.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a1b0c92c_by_Libranalysis.exeNekleqmi.exePhjahjnj.exePagoloqe.exeAheqdhdm.exeBkpmlaic.exeBkbiaa32.exeBhfjke32.exeHlhfhg32.exeIlainf32.exeJcedaoah.exeKcemhm32.exeMcjpjj32.exeOacbekmo.exePoeopm32.exeAeijcfoj.exeDkkndgmg.exeEbllaqnl.exeFeaonkgh.exeGplenaee.exeHbmnol32.exeJbbqai32.exedescription pid process target process PID 644 wrote to memory of 2664 644 a1b0c92c_by_Libranalysis.exe Nekleqmi.exe PID 644 wrote to memory of 2664 644 a1b0c92c_by_Libranalysis.exe Nekleqmi.exe PID 644 wrote to memory of 2664 644 a1b0c92c_by_Libranalysis.exe Nekleqmi.exe PID 2664 wrote to memory of 3780 2664 Nekleqmi.exe Phjahjnj.exe PID 2664 wrote to memory of 3780 2664 Nekleqmi.exe Phjahjnj.exe PID 2664 wrote to memory of 3780 2664 Nekleqmi.exe Phjahjnj.exe PID 3780 wrote to memory of 2744 3780 Phjahjnj.exe Pagoloqe.exe PID 3780 wrote to memory of 2744 3780 Phjahjnj.exe Pagoloqe.exe PID 3780 wrote to memory of 2744 3780 Phjahjnj.exe Pagoloqe.exe PID 2744 wrote to memory of 3588 2744 Pagoloqe.exe Aheqdhdm.exe PID 2744 wrote to memory of 3588 2744 Pagoloqe.exe Aheqdhdm.exe PID 2744 wrote to memory of 3588 2744 Pagoloqe.exe Aheqdhdm.exe PID 3588 wrote to memory of 204 3588 Aheqdhdm.exe Bkpmlaic.exe PID 3588 wrote to memory of 204 3588 Aheqdhdm.exe Bkpmlaic.exe PID 3588 wrote to memory of 204 3588 Aheqdhdm.exe Bkpmlaic.exe PID 204 wrote to memory of 4060 204 Bkpmlaic.exe Bkbiaa32.exe PID 204 wrote to memory of 4060 204 Bkpmlaic.exe Bkbiaa32.exe PID 204 wrote to memory of 4060 204 Bkpmlaic.exe Bkbiaa32.exe PID 4060 wrote to memory of 2904 4060 Bkbiaa32.exe Bhfjke32.exe PID 4060 wrote to memory of 2904 4060 Bkbiaa32.exe Bhfjke32.exe PID 4060 wrote to memory of 2904 4060 Bkbiaa32.exe Bhfjke32.exe PID 2904 wrote to memory of 1252 2904 Bhfjke32.exe Hlhfhg32.exe PID 2904 wrote to memory of 1252 2904 Bhfjke32.exe Hlhfhg32.exe PID 2904 wrote to memory of 1252 2904 Bhfjke32.exe Hlhfhg32.exe PID 1252 wrote to memory of 3356 1252 Hlhfhg32.exe Ilainf32.exe PID 1252 wrote to memory of 3356 1252 Hlhfhg32.exe Ilainf32.exe PID 1252 wrote to memory of 3356 1252 Hlhfhg32.exe Ilainf32.exe PID 3356 wrote to memory of 1428 3356 Ilainf32.exe Jcedaoah.exe PID 3356 wrote to memory of 1428 3356 Ilainf32.exe Jcedaoah.exe PID 3356 wrote to memory of 1428 3356 Ilainf32.exe Jcedaoah.exe PID 1428 wrote to memory of 4048 1428 Jcedaoah.exe Kcemhm32.exe PID 1428 wrote to memory of 4048 1428 Jcedaoah.exe Kcemhm32.exe PID 1428 wrote to memory of 4048 1428 Jcedaoah.exe Kcemhm32.exe PID 4048 wrote to memory of 652 4048 Kcemhm32.exe Mcjpjj32.exe PID 4048 wrote to memory of 652 4048 Kcemhm32.exe Mcjpjj32.exe PID 4048 wrote to memory of 652 4048 Kcemhm32.exe Mcjpjj32.exe PID 652 wrote to memory of 3852 652 Mcjpjj32.exe Oacbekmo.exe PID 652 wrote to memory of 3852 652 Mcjpjj32.exe Oacbekmo.exe PID 652 wrote to memory of 3852 652 Mcjpjj32.exe Oacbekmo.exe PID 3852 wrote to memory of 1820 3852 Oacbekmo.exe Poeopm32.exe PID 3852 wrote to memory of 1820 3852 Oacbekmo.exe Poeopm32.exe PID 3852 wrote to memory of 1820 3852 Oacbekmo.exe Poeopm32.exe PID 1820 wrote to memory of 2696 1820 Poeopm32.exe Aeijcfoj.exe PID 1820 wrote to memory of 2696 1820 Poeopm32.exe Aeijcfoj.exe PID 1820 wrote to memory of 2696 1820 Poeopm32.exe Aeijcfoj.exe PID 2696 wrote to memory of 3028 2696 Aeijcfoj.exe Dkkndgmg.exe PID 2696 wrote to memory of 3028 2696 Aeijcfoj.exe Dkkndgmg.exe PID 2696 wrote to memory of 3028 2696 Aeijcfoj.exe Dkkndgmg.exe PID 3028 wrote to memory of 1564 3028 Dkkndgmg.exe Ebllaqnl.exe PID 3028 wrote to memory of 1564 3028 Dkkndgmg.exe Ebllaqnl.exe PID 3028 wrote to memory of 1564 3028 Dkkndgmg.exe Ebllaqnl.exe PID 1564 wrote to memory of 3876 1564 Ebllaqnl.exe Feaonkgh.exe PID 1564 wrote to memory of 3876 1564 Ebllaqnl.exe Feaonkgh.exe PID 1564 wrote to memory of 3876 1564 Ebllaqnl.exe Feaonkgh.exe PID 3876 wrote to memory of 1244 3876 Feaonkgh.exe Gplenaee.exe PID 3876 wrote to memory of 1244 3876 Feaonkgh.exe Gplenaee.exe PID 3876 wrote to memory of 1244 3876 Feaonkgh.exe Gplenaee.exe PID 1244 wrote to memory of 2076 1244 Gplenaee.exe Hbmnol32.exe PID 1244 wrote to memory of 2076 1244 Gplenaee.exe Hbmnol32.exe PID 1244 wrote to memory of 2076 1244 Gplenaee.exe Hbmnol32.exe PID 2076 wrote to memory of 4044 2076 Hbmnol32.exe Jbbqai32.exe PID 2076 wrote to memory of 4044 2076 Hbmnol32.exe Jbbqai32.exe PID 2076 wrote to memory of 4044 2076 Hbmnol32.exe Jbbqai32.exe PID 4044 wrote to memory of 1532 4044 Jbbqai32.exe Knhnepab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1b0c92c_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\a1b0c92c_by_Libranalysis.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Nekleqmi.exeC:\Windows\system32\Nekleqmi.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Phjahjnj.exeC:\Windows\system32\Phjahjnj.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Pagoloqe.exeC:\Windows\system32\Pagoloqe.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Aheqdhdm.exeC:\Windows\system32\Aheqdhdm.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bkpmlaic.exeC:\Windows\system32\Bkpmlaic.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bkbiaa32.exeC:\Windows\system32\Bkbiaa32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bhfjke32.exeC:\Windows\system32\Bhfjke32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Hlhfhg32.exeC:\Windows\system32\Hlhfhg32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ilainf32.exeC:\Windows\system32\Ilainf32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jcedaoah.exeC:\Windows\system32\Jcedaoah.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kcemhm32.exeC:\Windows\system32\Kcemhm32.exe12⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mcjpjj32.exeC:\Windows\system32\Mcjpjj32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Oacbekmo.exeC:\Windows\system32\Oacbekmo.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Poeopm32.exeC:\Windows\system32\Poeopm32.exe15⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Aeijcfoj.exeC:\Windows\system32\Aeijcfoj.exe16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Dkkndgmg.exeC:\Windows\system32\Dkkndgmg.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ebllaqnl.exeC:\Windows\system32\Ebllaqnl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Feaonkgh.exeC:\Windows\system32\Feaonkgh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Gplenaee.exeC:\Windows\system32\Gplenaee.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Hbmnol32.exeC:\Windows\system32\Hbmnol32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jbbqai32.exeC:\Windows\system32\Jbbqai32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Knhnepab.exeC:\Windows\system32\Knhnepab.exe23⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ljfekp32.exeC:\Windows\system32\Ljfekp32.exe24⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mqgchhbc.exeC:\Windows\system32\Mqgchhbc.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Pjbfdijk.exeC:\Windows\system32\Pjbfdijk.exe26⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Apmknn32.exeC:\Windows\system32\Apmknn32.exe27⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bampooec.exeC:\Windows\system32\Bampooec.exe28⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cpggkjfe.exeC:\Windows\system32\Cpggkjfe.exe29⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Chpkbg32.exeC:\Windows\system32\Chpkbg32.exe30⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cdglghji.exeC:\Windows\system32\Cdglghji.exe31⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ddiilh32.exeC:\Windows\system32\Ddiilh32.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Iibomnkj.exeC:\Windows\system32\Iibomnkj.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ofomie32.exeC:\Windows\system32\Ofomie32.exe3⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Ppnhbjeg.exeC:\Windows\system32\Ppnhbjeg.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Afflpbpd.exeC:\Windows\system32\Afflpbpd.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Aanmcj32.exeC:\Windows\system32\Aanmcj32.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Afkfka32.exeC:\Windows\system32\Afkfka32.exe7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Aaqjij32.exeC:\Windows\system32\Aaqjij32.exe8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Abbfqbac.exeC:\Windows\system32\Abbfqbac.exe9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bmgknk32.exeC:\Windows\system32\Bmgknk32.exe10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bbdcfb32.exeC:\Windows\system32\Bbdcfb32.exe11⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Binkblgm.exeC:\Windows\system32\Binkblgm.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bbfpla32.exeC:\Windows\system32\Bbfpla32.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bmldijmc.exeC:\Windows\system32\Bmldijmc.exe14⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bdfled32.exeC:\Windows\system32\Bdfled32.exe15⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bicenk32.exeC:\Windows\system32\Bicenk32.exe16⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bpmmjejd.exeC:\Windows\system32\Bpmmjejd.exe17⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bmqndjin.exeC:\Windows\system32\Bmqndjin.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Bfibmopo.exeC:\Windows\system32\Bfibmopo.exe19⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cmcjii32.exeC:\Windows\system32\Cmcjii32.exe20⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cbpbap32.exeC:\Windows\system32\Cbpbap32.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Cmegoi32.exeC:\Windows\system32\Cmegoi32.exe22⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cfnkho32.exeC:\Windows\system32\Cfnkho32.exe23⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cdblac32.exeC:\Windows\system32\Cdblac32.exe24⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Caflkg32.exeC:\Windows\system32\Caflkg32.exe25⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cgbecngd.exeC:\Windows\system32\Cgbecngd.exe26⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cmlmph32.exeC:\Windows\system32\Cmlmph32.exe27⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cdfelbfn.exeC:\Windows\system32\Cdfelbfn.exe28⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dicndide.exeC:\Windows\system32\Dicndide.exe29⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ddibbbdk.exeC:\Windows\system32\Ddibbbdk.exe30⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Diejji32.exeC:\Windows\system32\Diejji32.exe31⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Dkegdlje.exeC:\Windows\system32\Dkegdlje.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dpbolbhm.exeC:\Windows\system32\Dpbolbhm.exe33⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dkgcjk32.exeC:\Windows\system32\Dkgcjk32.exe34⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Daalfeoo.exeC:\Windows\system32\Daalfeoo.exe35⤵
-
C:\Windows\SysWOW64\Dgndolmg.exeC:\Windows\system32\Dgndolmg.exe36⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Dadhlemm.exeC:\Windows\system32\Dadhlemm.exe37⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Dceecm32.exeC:\Windows\system32\Dceecm32.exe38⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Enjiafca.exeC:\Windows\system32\Enjiafca.exe39⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Edgncp32.exeC:\Windows\system32\Edgncp32.exe40⤵
-
C:\Windows\SysWOW64\Ekafpjph.exeC:\Windows\system32\Ekafpjph.exe41⤵
-
C:\Windows\SysWOW64\Eakomdgd.exeC:\Windows\system32\Eakomdgd.exe42⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Egggekel.exeC:\Windows\system32\Egggekel.exe43⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Eamkbceb.exeC:\Windows\system32\Eamkbceb.exe44⤵
-
C:\Windows\SysWOW64\Ecnhjl32.exeC:\Windows\system32\Ecnhjl32.exe45⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ejhpffbm.exeC:\Windows\system32\Ejhpffbm.exe46⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ednddo32.exeC:\Windows\system32\Ednddo32.exe47⤵
-
C:\Windows\SysWOW64\Fkhmqiip.exeC:\Windows\system32\Fkhmqiip.exe48⤵
-
C:\Windows\SysWOW64\Fpdeiphg.exeC:\Windows\system32\Fpdeiphg.exe49⤵
-
C:\Windows\SysWOW64\Fjmiae32.exeC:\Windows\system32\Fjmiae32.exe50⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Fqgbnp32.exeC:\Windows\system32\Fqgbnp32.exe51⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Fkmflh32.exeC:\Windows\system32\Fkmflh32.exe52⤵
-
C:\Windows\SysWOW64\Fqiodo32.exeC:\Windows\system32\Fqiodo32.exe53⤵
-
C:\Windows\SysWOW64\Fkobah32.exeC:\Windows\system32\Fkobah32.exe54⤵
-
C:\Windows\SysWOW64\Faiknbkd.exeC:\Windows\system32\Faiknbkd.exe55⤵
-
C:\Windows\SysWOW64\Fgecfi32.exeC:\Windows\system32\Fgecfi32.exe56⤵
-
C:\Windows\SysWOW64\Fbkhca32.exeC:\Windows\system32\Fbkhca32.exe57⤵
-
C:\Windows\SysWOW64\Gcldkjop.exeC:\Windows\system32\Gcldkjop.exe58⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Gcoaqimn.exeC:\Windows\system32\Gcoaqimn.exe59⤵
-
C:\Windows\SysWOW64\Gndenb32.exeC:\Windows\system32\Gndenb32.exe60⤵
-
C:\Windows\SysWOW64\Gcanfi32.exeC:\Windows\system32\Gcanfi32.exe61⤵
-
C:\Windows\SysWOW64\Gjkfccbh.exeC:\Windows\system32\Gjkfccbh.exe62⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Gqenpm32.exeC:\Windows\system32\Gqenpm32.exe63⤵
-
C:\Windows\SysWOW64\Gkkbmfij.exeC:\Windows\system32\Gkkbmfij.exe64⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Gqgkemgb.exeC:\Windows\system32\Gqgkemgb.exe65⤵
-
C:\Windows\SysWOW64\Ggacbg32.exeC:\Windows\system32\Ggacbg32.exe66⤵
-
C:\Windows\SysWOW64\Gbggop32.exeC:\Windows\system32\Gbggop32.exe67⤵
-
C:\Windows\SysWOW64\Hchcghdc.exeC:\Windows\system32\Hchcghdc.exe68⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Hnnhda32.exeC:\Windows\system32\Hnnhda32.exe69⤵
-
C:\Windows\SysWOW64\Hdhpakle.exeC:\Windows\system32\Hdhpakle.exe70⤵
-
C:\Windows\SysWOW64\Hjdiibjm.exeC:\Windows\system32\Hjdiibjm.exe71⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Hqnafl32.exeC:\Windows\system32\Hqnafl32.exe72⤵
-
C:\Windows\SysWOW64\Hkdece32.exeC:\Windows\system32\Hkdece32.exe73⤵
-
C:\Windows\SysWOW64\Hbnmpo32.exeC:\Windows\system32\Hbnmpo32.exe74⤵
-
C:\Windows\SysWOW64\Hkfbidom.exeC:\Windows\system32\Hkfbidom.exe75⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Hacjakmd.exeC:\Windows\system32\Hacjakmd.exe76⤵
-
C:\Windows\SysWOW64\Hgmbne32.exeC:\Windows\system32\Hgmbne32.exe77⤵
-
C:\Windows\SysWOW64\Ibbgkndg.exeC:\Windows\system32\Ibbgkndg.exe78⤵
-
C:\Windows\SysWOW64\Inldeo32.exeC:\Windows\system32\Inldeo32.exe79⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ichmnffp.exeC:\Windows\system32\Ichmnffp.exe80⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ijbejp32.exeC:\Windows\system32\Ijbejp32.exe81⤵
-
C:\Windows\SysWOW64\Iehihi32.exeC:\Windows\system32\Iehihi32.exe82⤵
-
C:\Windows\SysWOW64\Ijeapp32.exeC:\Windows\system32\Ijeapp32.exe83⤵
-
C:\Windows\SysWOW64\Iejfmhkp.exeC:\Windows\system32\Iejfmhkp.exe84⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Igibidkd.exeC:\Windows\system32\Igibidkd.exe85⤵
-
C:\Windows\SysWOW64\Jbnfgmjj.exeC:\Windows\system32\Jbnfgmjj.exe86⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Jcpcoe32.exeC:\Windows\system32\Jcpcoe32.exe87⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Jjikkohe.exeC:\Windows\system32\Jjikkohe.exe88⤵
-
C:\Windows\SysWOW64\Jeoohhgk.exeC:\Windows\system32\Jeoohhgk.exe89⤵
-
C:\Windows\SysWOW64\Jjlhqo32.exeC:\Windows\system32\Jjlhqo32.exe90⤵
-
C:\Windows\SysWOW64\Jafpmimo.exeC:\Windows\system32\Jafpmimo.exe91⤵
-
C:\Windows\SysWOW64\Jhphjc32.exeC:\Windows\system32\Jhphjc32.exe92⤵
-
C:\Windows\SysWOW64\Jbelgl32.exeC:\Windows\system32\Jbelgl32.exe93⤵
-
C:\Windows\SysWOW64\Jdfiodjp.exeC:\Windows\system32\Jdfiodjp.exe94⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Jjqalnam.exeC:\Windows\system32\Jjqalnam.exe95⤵
-
C:\Windows\SysWOW64\Jefeigac.exeC:\Windows\system32\Jefeigac.exe96⤵
-
C:\Windows\SysWOW64\Jlpnfa32.exeC:\Windows\system32\Jlpnfa32.exe97⤵
-
C:\Windows\SysWOW64\Kbjfbkpm.exeC:\Windows\system32\Kbjfbkpm.exe98⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kdkbjc32.exeC:\Windows\system32\Kdkbjc32.exe99⤵
-
C:\Windows\SysWOW64\Kjekgm32.exeC:\Windows\system32\Kjekgm32.exe100⤵
-
C:\Windows\SysWOW64\Kekodf32.exeC:\Windows\system32\Kekodf32.exe101⤵
-
C:\Windows\SysWOW64\Klegapej.exeC:\Windows\system32\Klegapej.exe102⤵
-
C:\Windows\SysWOW64\Kaapigcb.exeC:\Windows\system32\Kaapigcb.exe103⤵
-
C:\Windows\SysWOW64\Khlhfa32.exeC:\Windows\system32\Khlhfa32.exe104⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kbalcjjd.exeC:\Windows\system32\Kbalcjjd.exe105⤵
-
C:\Windows\SysWOW64\Kliqlp32.exeC:\Windows\system32\Kliqlp32.exe106⤵
-
C:\Windows\SysWOW64\Kbciijhb.exeC:\Windows\system32\Kbciijhb.exe107⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Khpaaqfi.exeC:\Windows\system32\Khpaaqfi.exe108⤵
-
C:\Windows\SysWOW64\Lojink32.exeC:\Windows\system32\Lojink32.exe109⤵
-
C:\Windows\SysWOW64\Ldgbfaln.exeC:\Windows\system32\Ldgbfaln.exe110⤵
-
C:\Windows\SysWOW64\Lkajbl32.exeC:\Windows\system32\Lkajbl32.exe111⤵
-
C:\Windows\SysWOW64\Lakbofkg.exeC:\Windows\system32\Lakbofkg.exe112⤵
-
C:\Windows\SysWOW64\Lamoee32.exeC:\Windows\system32\Lamoee32.exe113⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Lhggappa.exeC:\Windows\system32\Lhggappa.exe114⤵
-
C:\Windows\SysWOW64\Loapnj32.exeC:\Windows\system32\Loapnj32.exe115⤵
-
C:\Windows\SysWOW64\Ldnhgq32.exeC:\Windows\system32\Ldnhgq32.exe116⤵
-
C:\Windows\SysWOW64\Lkhpckmb.exeC:\Windows\system32\Lkhpckmb.exe117⤵
-
C:\Windows\SysWOW64\Labhpe32.exeC:\Windows\system32\Labhpe32.exe118⤵
-
C:\Windows\SysWOW64\Mlgmmnde.exeC:\Windows\system32\Mlgmmnde.exe119⤵
-
C:\Windows\SysWOW64\Mbaejh32.exeC:\Windows\system32\Mbaejh32.exe120⤵
-
C:\Windows\SysWOW64\Mdbabpbp.exeC:\Windows\system32\Mdbabpbp.exe121⤵
-
C:\Windows\SysWOW64\Mkmjoj32.exeC:\Windows\system32\Mkmjoj32.exe122⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Magbkdqj.exeC:\Windows\system32\Magbkdqj.exe123⤵
-
C:\Windows\SysWOW64\Mhqjhnhg.exeC:\Windows\system32\Mhqjhnhg.exe124⤵
-
C:\Windows\SysWOW64\Mcfneghm.exeC:\Windows\system32\Mcfneghm.exe125⤵
-
C:\Windows\SysWOW64\Mdgkmo32.exeC:\Windows\system32\Mdgkmo32.exe126⤵
-
C:\Windows\SysWOW64\Mkacjieh.exeC:\Windows\system32\Mkacjieh.exe127⤵
-
C:\Windows\SysWOW64\Megggben.exeC:\Windows\system32\Megggben.exe128⤵
-
C:\Windows\SysWOW64\Mlapcllj.exeC:\Windows\system32\Mlapcllj.exe129⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Meidlb32.exeC:\Windows\system32\Meidlb32.exe130⤵
-
C:\Windows\SysWOW64\Nkfldi32.exeC:\Windows\system32\Nkfldi32.exe131⤵
-
C:\Windows\SysWOW64\Napeacho.exeC:\Windows\system32\Napeacho.exe132⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Nleiol32.exeC:\Windows\system32\Nleiol32.exe133⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nabagb32.exeC:\Windows\system32\Nabagb32.exe134⤵
-
C:\Windows\SysWOW64\Nhljcmni.exeC:\Windows\system32\Nhljcmni.exe135⤵
-
C:\Windows\SysWOW64\Ncbnaeno.exeC:\Windows\system32\Ncbnaeno.exe136⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ndcjin32.exeC:\Windows\system32\Ndcjin32.exe137⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nkmbehkj.exeC:\Windows\system32\Nkmbehkj.exe138⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Nagkbbbg.exeC:\Windows\system32\Nagkbbbg.exe139⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Nhacol32.exeC:\Windows\system32\Nhacol32.exe140⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ncfgle32.exeC:\Windows\system32\Ncfgle32.exe141⤵
-
C:\Windows\SysWOW64\Ndhddmph.exeC:\Windows\system32\Ndhddmph.exe142⤵
-
C:\Windows\SysWOW64\Okblqg32.exeC:\Windows\system32\Okblqg32.exe143⤵
-
C:\Windows\SysWOW64\Ofgpnpgk.exeC:\Windows\system32\Ofgpnpgk.exe144⤵
-
C:\Windows\SysWOW64\Olahjj32.exeC:\Windows\system32\Olahjj32.exe145⤵
-
C:\Windows\SysWOW64\Ockqgded.exeC:\Windows\system32\Ockqgded.exe146⤵
-
C:\Windows\SysWOW64\Ohhiokdl.exeC:\Windows\system32\Ohhiokdl.exe147⤵
-
C:\Windows\SysWOW64\Obqnhqjm.exeC:\Windows\system32\Obqnhqjm.exe148⤵
-
C:\Windows\SysWOW64\Ohjfek32.exeC:\Windows\system32\Ohjfek32.exe149⤵
-
C:\Windows\SysWOW64\Oodnaeif.exeC:\Windows\system32\Oodnaeif.exe150⤵
-
C:\Windows\SysWOW64\Ofnfno32.exeC:\Windows\system32\Ofnfno32.exe151⤵
-
C:\Windows\SysWOW64\Olhokihp.exeC:\Windows\system32\Olhokihp.exe152⤵
-
C:\Windows\SysWOW64\Obegcpfg.exeC:\Windows\system32\Obegcpfg.exe153⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Phoopjnd.exeC:\Windows\system32\Phoopjnd.exe154⤵
-
C:\Windows\SysWOW64\Poigmd32.exeC:\Windows\system32\Poigmd32.exe155⤵
-
C:\Windows\SysWOW64\Qbccdn32.exeC:\Windows\system32\Qbccdn32.exe156⤵
-
C:\Windows\SysWOW64\Qimlahad.exeC:\Windows\system32\Qimlahad.exe157⤵
-
C:\Windows\SysWOW64\Qogdnbia.exeC:\Windows\system32\Qogdnbia.exe158⤵
-
C:\Windows\SysWOW64\Afalkl32.exeC:\Windows\system32\Afalkl32.exe159⤵
-
C:\Windows\SysWOW64\Akndcc32.exeC:\Windows\system32\Akndcc32.exe160⤵
-
C:\Windows\SysWOW64\Afcipl32.exeC:\Windows\system32\Afcipl32.exe161⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ammamffh.exeC:\Windows\system32\Ammamffh.exe162⤵
-
C:\Windows\SysWOW64\Abjiem32.exeC:\Windows\system32\Abjiem32.exe163⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Aidabgkl.exeC:\Windows\system32\Aidabgkl.exe164⤵
-
C:\Windows\SysWOW64\Acjfopkb.exeC:\Windows\system32\Acjfopkb.exe165⤵
-
C:\Windows\SysWOW64\Aifnggii.exeC:\Windows\system32\Aifnggii.exe166⤵
-
C:\Windows\SysWOW64\Apqfda32.exeC:\Windows\system32\Apqfda32.exe167⤵
-
C:\Windows\SysWOW64\Afjoak32.exeC:\Windows\system32\Afjoak32.exe168⤵
-
C:\Windows\SysWOW64\Alggib32.exeC:\Windows\system32\Alggib32.exe169⤵
-
C:\Windows\SysWOW64\Bbapflng.exeC:\Windows\system32\Bbapflng.exe170⤵
-
C:\Windows\SysWOW64\Bmgdcenm.exeC:\Windows\system32\Bmgdcenm.exe171⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Bebhhg32.exeC:\Windows\system32\Bebhhg32.exe172⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Bpgmep32.exeC:\Windows\system32\Bpgmep32.exe173⤵
-
C:\Windows\SysWOW64\Bfaeajbk.exeC:\Windows\system32\Bfaeajbk.exe174⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Blnmjapb.exeC:\Windows\system32\Blnmjapb.exe175⤵
-
C:\Windows\SysWOW64\Bbhffk32.exeC:\Windows\system32\Bbhffk32.exe176⤵
-
C:\Windows\SysWOW64\Bmnjdcge.exeC:\Windows\system32\Bmnjdcge.exe177⤵
-
C:\Windows\SysWOW64\Bchbqn32.exeC:\Windows\system32\Bchbqn32.exe178⤵
-
C:\Windows\SysWOW64\Beiohfep.exeC:\Windows\system32\Beiohfep.exe179⤵
-
C:\Windows\SysWOW64\Blcgep32.exeC:\Windows\system32\Blcgep32.exe180⤵
-
C:\Windows\SysWOW64\Cmbcoc32.exeC:\Windows\system32\Cmbcoc32.exe181⤵
-
C:\Windows\SysWOW64\Cclllmkm.exeC:\Windows\system32\Cclllmkm.exe182⤵
-
C:\Windows\SysWOW64\Cenhce32.exeC:\Windows\system32\Cenhce32.exe183⤵
-
C:\Windows\SysWOW64\Clhppphh.exeC:\Windows\system32\Clhppphh.exe184⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Cbahmj32.exeC:\Windows\system32\Cbahmj32.exe185⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Cilqic32.exeC:\Windows\system32\Cilqic32.exe186⤵
-
C:\Windows\SysWOW64\Cfpach32.exeC:\Windows\system32\Cfpach32.exe187⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Clljko32.exeC:\Windows\system32\Clljko32.exe188⤵
-
C:\Windows\SysWOW64\Cbfbhilo.exeC:\Windows\system32\Cbfbhilo.exe189⤵
-
C:\Windows\SysWOW64\Cmlfea32.exeC:\Windows\system32\Cmlfea32.exe190⤵
-
C:\Windows\SysWOW64\Ddfnblcb.exeC:\Windows\system32\Ddfnblcb.exe191⤵
-
C:\Windows\SysWOW64\Dibgjbai.exeC:\Windows\system32\Dibgjbai.exe192⤵
-
C:\Windows\SysWOW64\Dpmogm32.exeC:\Windows\system32\Dpmogm32.exe193⤵
-
C:\Windows\SysWOW64\Dffgcgpc.exeC:\Windows\system32\Dffgcgpc.exe194⤵
-
C:\Windows\SysWOW64\Dlcplnnj.exeC:\Windows\system32\Dlcplnnj.exe195⤵
-
C:\Windows\SysWOW64\Deldecdk.exeC:\Windows\system32\Deldecdk.exe196⤵
-
C:\Windows\SysWOW64\Dlfmam32.exeC:\Windows\system32\Dlfmam32.exe197⤵
-
C:\Windows\SysWOW64\Dfkqof32.exeC:\Windows\system32\Dfkqof32.exe198⤵
-
C:\Windows\SysWOW64\Dlhigm32.exeC:\Windows\system32\Dlhigm32.exe199⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dfnndfjk.exeC:\Windows\system32\Dfnndfjk.exe200⤵
-
C:\Windows\SysWOW64\Eljfmmhb.exeC:\Windows\system32\Eljfmmhb.exe201⤵
-
C:\Windows\SysWOW64\Egpjjehh.exeC:\Windows\system32\Egpjjehh.exe202⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Emjbfp32.exeC:\Windows\system32\Emjbfp32.exe203⤵
-
C:\Windows\SysWOW64\Ebgkofmm.exeC:\Windows\system32\Ebgkofmm.exe204⤵
-
C:\Windows\SysWOW64\Emlolomb.exeC:\Windows\system32\Emlolomb.exe205⤵
-
C:\Windows\SysWOW64\Ecigdfkj.exeC:\Windows\system32\Ecigdfkj.exe206⤵
-
C:\Windows\SysWOW64\Eicpap32.exeC:\Windows\system32\Eicpap32.exe207⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Edhdni32.exeC:\Windows\system32\Edhdni32.exe208⤵
-
C:\Windows\SysWOW64\Eejqfa32.exeC:\Windows\system32\Eejqfa32.exe209⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Eldickph.exeC:\Windows\system32\Eldickph.exe210⤵
-
C:\Windows\SysWOW64\Ecnape32.exeC:\Windows\system32\Ecnape32.exe211⤵
-
C:\Windows\SysWOW64\Fmcemn32.exeC:\Windows\system32\Fmcemn32.exe212⤵
-
C:\Windows\SysWOW64\Fcpnee32.exeC:\Windows\system32\Fcpnee32.exe213⤵
-
C:\Windows\SysWOW64\Flhbnk32.exeC:\Windows\system32\Flhbnk32.exe214⤵
-
C:\Windows\SysWOW64\Fgnfkc32.exeC:\Windows\system32\Fgnfkc32.exe215⤵
-
C:\Windows\SysWOW64\Fnhohnce.exeC:\Windows\system32\Fnhohnce.exe216⤵
-
C:\Windows\SysWOW64\Fdbgdh32.exeC:\Windows\system32\Fdbgdh32.exe217⤵
-
C:\Windows\SysWOW64\Fecclppp.exeC:\Windows\system32\Fecclppp.exe218⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Fcgdfd32.exeC:\Windows\system32\Fcgdfd32.exe219⤵
-
C:\Windows\SysWOW64\Fnmhcm32.exeC:\Windows\system32\Fnmhcm32.exe220⤵
-
C:\Windows\SysWOW64\Fciqkd32.exeC:\Windows\system32\Fciqkd32.exe221⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gnoehmmm.exeC:\Windows\system32\Gnoehmmm.exe222⤵
-
C:\Windows\SysWOW64\Gclmqckd.exeC:\Windows\system32\Gclmqckd.exe223⤵
-
C:\Windows\SysWOW64\Gjfenn32.exeC:\Windows\system32\Gjfenn32.exe224⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gppnjhjn.exeC:\Windows\system32\Gppnjhjn.exe225⤵
-
C:\Windows\SysWOW64\Gfmfbohe.exeC:\Windows\system32\Gfmfbohe.exe226⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gdnfpfpd.exeC:\Windows\system32\Gdnfpfpd.exe227⤵
-
C:\Windows\SysWOW64\Gfochn32.exeC:\Windows\system32\Gfochn32.exe228⤵
-
C:\Windows\SysWOW64\Gpdgeg32.exeC:\Windows\system32\Gpdgeg32.exe229⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ggnobame.exeC:\Windows\system32\Ggnobame.exe230⤵
-
C:\Windows\SysWOW64\Glkhjhlm.exeC:\Windows\system32\Glkhjhlm.exe231⤵
-
C:\Windows\SysWOW64\Gcepgbcj.exeC:\Windows\system32\Gcepgbcj.exe232⤵
-
C:\Windows\SysWOW64\Hjohcl32.exeC:\Windows\system32\Hjohcl32.exe233⤵
-
C:\Windows\SysWOW64\Hqiqpfbc.exeC:\Windows\system32\Hqiqpfbc.exe234⤵
-
C:\Windows\SysWOW64\Hffiimpk.exeC:\Windows\system32\Hffiimpk.exe235⤵
-
C:\Windows\SysWOW64\Hmpaeg32.exeC:\Windows\system32\Hmpaeg32.exe236⤵
-
C:\Windows\SysWOW64\Hcjiba32.exeC:\Windows\system32\Hcjiba32.exe237⤵
-
C:\Windows\SysWOW64\Hnonoj32.exeC:\Windows\system32\Hnonoj32.exe238⤵
-
C:\Windows\SysWOW64\Hghbhpek.exeC:\Windows\system32\Hghbhpek.exe239⤵
-
C:\Windows\SysWOW64\Hmdkqgcb.exeC:\Windows\system32\Hmdkqgcb.exe240⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Hcocma32.exeC:\Windows\system32\Hcocma32.exe241⤵