Analysis
-
max time kernel
107s -
max time network
115s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-05-2021 12:54
Static task
static1
Behavioral task
behavioral1
Sample
d8422946c0e8cb1ce7d54b1b78834cb6800539ee40f6da25821aaf68a7ae1746.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d8422946c0e8cb1ce7d54b1b78834cb6800539ee40f6da25821aaf68a7ae1746.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
d8422946c0e8cb1ce7d54b1b78834cb6800539ee40f6da25821aaf68a7ae1746.exe
-
Size
7.5MB
-
MD5
af6bc6e9dc026b8fc9a7c5d20233201d
-
SHA1
912fe0951cdb36f9650a57f74239cc8987d6a1ac
-
SHA256
d8422946c0e8cb1ce7d54b1b78834cb6800539ee40f6da25821aaf68a7ae1746
-
SHA512
d027e6786ad29c39569918382d2bdc3f257089600f6ae8e298f4277826a31c268a903172a3b10cbcdc849b8eaec66e0f7e4b06f08eb50076ee7df91c1f8404a1
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs
-
Executes dropped EXE 64 IoCs
Processes:
Jadjbpcn.exeJlqdpg32.exeKigaokib.exeKohcba32.exeKokphaab.exeLloqaepk.exeLenkkj32.exeNlfpib32.exeOjhmddoj.exePqndlmlj.exeCphmfdpg.exeGngbcb32.exeHgcpgg32.exeKdplebbe.exeLekhkdok.exeOfgpnpgk.exeAiphgh32.exeBllqdabe.exeBpjijp32.exeBffnmi32.exeCpapko32.exeFpfkdibi.exeHmggff32.exeJcoldo32.exeLddnfl32.exeCemaio32.exeCpeblg32.exeGenlnhbg.exeIfhhkdlj.exeMjkljn32.exeOhihpnjb.exeQpbifn32.exeAabepa32.exeAnifebhd.exeAjogjc32.exeAqlllm32.exeBjkfeadk.exeDjpigoac.exeDgiclb32.exeFlehcofn.exeGlcdemjn.exeHhhakl32.exeIhjnqk32.exeIennjp32.exeIljcli32.exeIaihjpbh.exeJalepppe.exeJanaeo32.exeJlklcghp.exeKhdinhkb.exeKcinkqkh.exeKhffcg32.exeKcljqp32.exeKihcig32.exeKcngfp32.exeKikpnfej.exeLcpdloep.exeLimldfcg.exeLcbqaocm.exeLipiif32.exeLbhmbkhe.exeLkpbka32.exeLbjjhkfb.exeLmpned32.exepid process 4048 Jadjbpcn.exe 2192 Jlqdpg32.exe 3004 Kigaokib.exe 3732 Kohcba32.exe 3976 Kokphaab.exe 2696 Lloqaepk.exe 632 Lenkkj32.exe 2860 Nlfpib32.exe 3356 Ojhmddoj.exe 2940 Pqndlmlj.exe 784 Cphmfdpg.exe 2708 Gngbcb32.exe 1328 Hgcpgg32.exe 3520 Kdplebbe.exe 2140 Lekhkdok.exe 3380 Ofgpnpgk.exe 2308 Aiphgh32.exe 3864 Bllqdabe.exe 492 Bpjijp32.exe 3996 Bffnmi32.exe 3040 Cpapko32.exe 1148 Fpfkdibi.exe 3800 Hmggff32.exe 3232 Jcoldo32.exe 3884 Lddnfl32.exe 2868 Cemaio32.exe 3768 Cpeblg32.exe 3696 Genlnhbg.exe 2224 Ifhhkdlj.exe 3932 Mjkljn32.exe 1336 Ohihpnjb.exe 2444 Qpbifn32.exe 3940 Aabepa32.exe 3008 Anifebhd.exe 408 Ajogjc32.exe 3960 Aqlllm32.exe 2192 Bjkfeadk.exe 3584 Djpigoac.exe 3036 Dgiclb32.exe 1164 Flehcofn.exe 2872 Glcdemjn.exe 2180 Hhhakl32.exe 1236 Ihjnqk32.exe 196 Iennjp32.exe 204 Iljcli32.exe 4004 Iaihjpbh.exe 964 Jalepppe.exe 4052 Janaeo32.exe 1020 Jlklcghp.exe 1564 Khdinhkb.exe 3692 Kcinkqkh.exe 2860 Khffcg32.exe 3992 Kcljqp32.exe 2200 Kihcig32.exe 3688 Kcngfp32.exe 2304 Kikpnfej.exe 4104 Lcpdloep.exe 4124 Limldfcg.exe 4144 Lcbqaocm.exe 4164 Lipiif32.exe 4184 Lbhmbkhe.exe 4204 Lkpbka32.exe 4224 Lbjjhkfb.exe 4244 Lmpned32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Npochmfi.exeQldiej32.exeJapgph32.exeLnpdbf32.exeOlefiejo.exeBhnogknp.exeLcbqaocm.exeHmafcmqp.exeIlgplcdj.exeNehhpn32.exeDclifgmg.exeAjogjc32.exeIdeafe32.exeJepmlf32.exeAbadbm32.exeIhfcfomj.exed8422946c0e8cb1ce7d54b1b78834cb6800539ee40f6da25821aaf68a7ae1746.exeLodaqjik.exeQbknbngo.exeEmnpek32.exeOgdjcabp.exeBakddb32.exeCphmfdpg.exeBeqief32.exeBpfnco32.exeLhlooj32.exeGbeaoj32.exeAbdahmpd.exeAgemnagc.exeImdbil32.exeMdmidp32.exeOpgpde32.exeBmqkfd32.exeLafpmo32.exeLhcdpi32.exeKdplebbe.exePiofiboe.exeGcenimcn.exeHjkfaepm.exeMpdijdjo.exeOiombenh.exeAnifebhd.exeBdbqndnb.exeJggpcjge.exeIfpbhdja.exeJlqdpg32.exeCodnjjok.exeKpnpmmae.exeLniggqjg.exeQnokgilj.exeHiimbckm.exeIljlbc32.exeOfdkqe32.exeDjdkhh32.exeCejllejm.exeCncabb32.exeLknmlncb.exeMinekd32.exeLmpned32.exeNppicfak.exeEqgpqj32.exeEobcaa32.exedescription ioc process File created C:\Windows\SysWOW64\Nighab32.exe Npochmfi.exe File created C:\Windows\SysWOW64\Jhfdba32.dll Qldiej32.exe File created C:\Windows\SysWOW64\Jochjm32.exe Japgph32.exe File opened for modification C:\Windows\SysWOW64\Mdjlop32.exe Lnpdbf32.exe File created C:\Windows\SysWOW64\Gonfmpic.dll Olefiejo.exe File opened for modification C:\Windows\SysWOW64\Cckiecgn.exe Bhnogknp.exe File created C:\Windows\SysWOW64\Fqgfko32.dll Lcbqaocm.exe File created C:\Windows\SysWOW64\Elddjbja.dll Hmafcmqp.exe File created C:\Windows\SysWOW64\Gkiepbjc.dll Ilgplcdj.exe File created C:\Windows\SysWOW64\Cmolppgn.dll Nehhpn32.exe File created C:\Windows\SysWOW64\Qiiaml32.dll Dclifgmg.exe File opened for modification C:\Windows\SysWOW64\Aqlllm32.exe Ajogjc32.exe File created C:\Windows\SysWOW64\Lblqbacl.dll Ideafe32.exe File opened for modification C:\Windows\SysWOW64\Kkmedm32.exe Jepmlf32.exe File created C:\Windows\SysWOW64\Fgenhd32.dll Lnpdbf32.exe File created C:\Windows\SysWOW64\Amghpf32.exe Abadbm32.exe File created C:\Windows\SysWOW64\Imclnfkb.exe Ihfcfomj.exe File created C:\Windows\SysWOW64\Ggbfcp32.dll d8422946c0e8cb1ce7d54b1b78834cb6800539ee40f6da25821aaf68a7ae1746.exe File created C:\Windows\SysWOW64\Jiggbbaq.dll Lodaqjik.exe File created C:\Windows\SysWOW64\Hkjcnj32.dll Qbknbngo.exe File created C:\Windows\SysWOW64\Egcdcd32.exe Emnpek32.exe File created C:\Windows\SysWOW64\Gbghlc32.dll Ogdjcabp.exe File opened for modification C:\Windows\SysWOW64\Bpldbj32.exe Bakddb32.exe File opened for modification C:\Windows\SysWOW64\Gngbcb32.exe Cphmfdpg.exe File opened for modification C:\Windows\SysWOW64\Bpfnco32.exe Beqief32.exe File opened for modification C:\Windows\SysWOW64\Becfkf32.exe Bpfnco32.exe File created C:\Windows\SysWOW64\Oiinej32.dll Lhlooj32.exe File opened for modification C:\Windows\SysWOW64\Gmkflc32.exe Gbeaoj32.exe File created C:\Windows\SysWOW64\Amjeeeoj.exe Abdahmpd.exe File created C:\Windows\SysWOW64\Obfdacgd.dll Agemnagc.exe File created C:\Windows\SysWOW64\Idnkeffj.exe Imdbil32.exe File opened for modification C:\Windows\SysWOW64\Mobmbh32.exe Mdmidp32.exe File opened for modification C:\Windows\SysWOW64\Oedhllij.exe Opgpde32.exe File created C:\Windows\SysWOW64\Fmfdil32.dll Bmqkfd32.exe File created C:\Windows\SysWOW64\Lkodfd32.exe Lafpmo32.exe File created C:\Windows\SysWOW64\Mnpmhp32.exe Lhcdpi32.exe File created C:\Windows\SysWOW64\Afkmgc32.dll Kdplebbe.exe File opened for modification C:\Windows\SysWOW64\Pnloainm.exe Piofiboe.exe File opened for modification C:\Windows\SysWOW64\Gmmbbbin.exe Gcenimcn.exe File opened for modification C:\Windows\SysWOW64\Hpgnjlnd.exe Hjkfaepm.exe File created C:\Windows\SysWOW64\Ahmojh32.dll Mpdijdjo.exe File created C:\Windows\SysWOW64\Obgakjdh.exe Oiombenh.exe File created C:\Windows\SysWOW64\Jfpjmm32.dll Anifebhd.exe File opened for modification C:\Windows\SysWOW64\Bjoifklj.exe Bdbqndnb.exe File created C:\Windows\SysWOW64\Jpdngojp.exe Jggpcjge.exe File created C:\Windows\SysWOW64\Iaegemig.exe Ifpbhdja.exe File opened for modification C:\Windows\SysWOW64\Kigaokib.exe Jlqdpg32.exe File created C:\Windows\SysWOW64\Jechiopm.dll Codnjjok.exe File created C:\Windows\SysWOW64\Kkcdjfak.exe Kpnpmmae.exe File opened for modification C:\Windows\SysWOW64\Lgakpf32.exe Lniggqjg.exe File created C:\Windows\SysWOW64\Fmecib32.dll Qnokgilj.exe File created C:\Windows\SysWOW64\Ioldoe32.dll Hiimbckm.exe File created C:\Windows\SysWOW64\Alljaikg.dll Iljlbc32.exe File created C:\Windows\SysWOW64\Mklbnb32.dll Ofdkqe32.exe File created C:\Windows\SysWOW64\Ddjpeq32.exe Djdkhh32.exe File created C:\Windows\SysWOW64\Fkefkmie.dll Cejllejm.exe File created C:\Windows\SysWOW64\Codnjjok.exe Cncabb32.exe File opened for modification C:\Windows\SysWOW64\Lpkfdeaj.exe Lknmlncb.exe File created C:\Windows\SysWOW64\Cenegl32.dll Minekd32.exe File created C:\Windows\SysWOW64\Lbmgmk32.exe Lmpned32.exe File created C:\Windows\SysWOW64\Hjajgj32.dll Nppicfak.exe File created C:\Windows\SysWOW64\Emnpek32.exe Eqgpqj32.exe File opened for modification C:\Windows\SysWOW64\Lniggqjg.exe Lhlooj32.exe File created C:\Windows\SysWOW64\Menefeib.dll Eobcaa32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4312 4432 WerFault.exe Nghcmm32.exe -
Modifies registry class 64 IoCs
Processes:
Bffnmi32.exePmgfcnck.exeJgnfci32.exeOkipcaaa.exeIfhhkdlj.exeMjonjf32.exeFaeclomd.exeJkqoniaa.exeQpnhalcm.exeLklqfoee.exeGenlnhbg.exeIhjnqk32.exeEjpkdf32.exeGnnmabhh.exeHnnomi32.exeLdnfikfi.exeLdpldepk.exeKigaokib.exeOfgpnpgk.exeBdbqndnb.exeDgehafgb.exeDnoqnp32.exeMheaeh32.exeAbamhg32.exeGifplcmp.exeJlklcghp.exeEeniqpfb.exeMdmidp32.exeNonmngcn.exeFqbolhkk.exeLihkal32.exeNqaoph32.exeDabclojc.exeCpapko32.exePfkkgn32.exeAmnoqe32.exeCodnjjok.exeLkodfd32.exeFgeahc32.exeJpdngojp.exeOgdjcabp.exeLekhkdok.exeJeigkg32.exeLfeonc32.exeBmqkfd32.exeDgqofg32.exeGbeaoj32.exeJjmkncph.exePbhaln32.exeGlcdemjn.exeMbfjci32.exeQlffkiph.exeCjhllido.exeJkcbno32.exeIjibcc32.exeNnkfih32.exeDjpigoac.exeKihcig32.exeOffhfeaf.exeIdbmfoni.exeGidcgc32.exeCdlcdbfh.exeMfleobdh.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bffnmi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pmgfcnck.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjnkfmdc.dll" Jgnfci32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Okipcaaa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ifhhkdlj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mjonjf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Faeclomd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jkqoniaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qpnhalcm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lklqfoee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Genlnhbg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kndbfi32.dll" Ihjnqk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ejpkdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gnnmabhh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hnnomi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ldnfikfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ldpldepk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bclenhik.dll" Kigaokib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ofgpnpgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmpjefoi.dll" Bdbqndnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpqhbc32.dll" Dgehafgb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dnoqnp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mheaeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Abamhg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gifplcmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhdjhpki.dll" Jlklcghp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Objpgjil.dll" Eeniqpfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epqedl32.dll" Mdmidp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nonmngcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fqbolhkk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lihkal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hblcmq32.dll" Nqaoph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dabclojc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cpapko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pfkkgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Amnoqe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Codnjjok.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lkodfd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fgeahc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jpdngojp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbghlc32.dll" Ogdjcabp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhoiiibe.dll" Lekhkdok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbfdhbbh.dll" Jeigkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Finmhjcg.dll" Lfeonc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bmqkfd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggonkoad.dll" Dgqofg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgmjdh32.dll" Gbeaoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jjmkncph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pbhaln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egafcjag.dll" Glcdemjn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfhfio32.dll" Mbfjci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qlffkiph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cjhllido.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jkcbno32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ijibcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpoabedb.dll" Nnkfih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Djpigoac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aidcnh32.dll" Kihcig32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Offhfeaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Idbmfoni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfmcni32.dll" Gifplcmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gidcgc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cdlcdbfh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mfleobdh.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
WerFault.exepid process 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe 4312 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 4312 WerFault.exe Token: SeBackupPrivilege 4312 WerFault.exe Token: SeDebugPrivilege 4312 WerFault.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d8422946c0e8cb1ce7d54b1b78834cb6800539ee40f6da25821aaf68a7ae1746.exeJadjbpcn.exeJlqdpg32.exeKigaokib.exeKohcba32.exeKokphaab.exeLloqaepk.exeLenkkj32.exeNlfpib32.exeOjhmddoj.exePqndlmlj.exeCphmfdpg.exeGngbcb32.exeHgcpgg32.exeKdplebbe.exeLekhkdok.exeOfgpnpgk.exeAiphgh32.exeBllqdabe.exeBpjijp32.exeBffnmi32.exeCpapko32.exedescription pid process target process PID 796 wrote to memory of 4048 796 d8422946c0e8cb1ce7d54b1b78834cb6800539ee40f6da25821aaf68a7ae1746.exe Jadjbpcn.exe PID 796 wrote to memory of 4048 796 d8422946c0e8cb1ce7d54b1b78834cb6800539ee40f6da25821aaf68a7ae1746.exe Jadjbpcn.exe PID 796 wrote to memory of 4048 796 d8422946c0e8cb1ce7d54b1b78834cb6800539ee40f6da25821aaf68a7ae1746.exe Jadjbpcn.exe PID 4048 wrote to memory of 2192 4048 Jadjbpcn.exe Jlqdpg32.exe PID 4048 wrote to memory of 2192 4048 Jadjbpcn.exe Jlqdpg32.exe PID 4048 wrote to memory of 2192 4048 Jadjbpcn.exe Jlqdpg32.exe PID 2192 wrote to memory of 3004 2192 Jlqdpg32.exe Kigaokib.exe PID 2192 wrote to memory of 3004 2192 Jlqdpg32.exe Kigaokib.exe PID 2192 wrote to memory of 3004 2192 Jlqdpg32.exe Kigaokib.exe PID 3004 wrote to memory of 3732 3004 Kigaokib.exe Kohcba32.exe PID 3004 wrote to memory of 3732 3004 Kigaokib.exe Kohcba32.exe PID 3004 wrote to memory of 3732 3004 Kigaokib.exe Kohcba32.exe PID 3732 wrote to memory of 3976 3732 Kohcba32.exe Kokphaab.exe PID 3732 wrote to memory of 3976 3732 Kohcba32.exe Kokphaab.exe PID 3732 wrote to memory of 3976 3732 Kohcba32.exe Kokphaab.exe PID 3976 wrote to memory of 2696 3976 Kokphaab.exe Lloqaepk.exe PID 3976 wrote to memory of 2696 3976 Kokphaab.exe Lloqaepk.exe PID 3976 wrote to memory of 2696 3976 Kokphaab.exe Lloqaepk.exe PID 2696 wrote to memory of 632 2696 Lloqaepk.exe Lenkkj32.exe PID 2696 wrote to memory of 632 2696 Lloqaepk.exe Lenkkj32.exe PID 2696 wrote to memory of 632 2696 Lloqaepk.exe Lenkkj32.exe PID 632 wrote to memory of 2860 632 Lenkkj32.exe Nlfpib32.exe PID 632 wrote to memory of 2860 632 Lenkkj32.exe Nlfpib32.exe PID 632 wrote to memory of 2860 632 Lenkkj32.exe Nlfpib32.exe PID 2860 wrote to memory of 3356 2860 Nlfpib32.exe Ojhmddoj.exe PID 2860 wrote to memory of 3356 2860 Nlfpib32.exe Ojhmddoj.exe PID 2860 wrote to memory of 3356 2860 Nlfpib32.exe Ojhmddoj.exe PID 3356 wrote to memory of 2940 3356 Ojhmddoj.exe Pqndlmlj.exe PID 3356 wrote to memory of 2940 3356 Ojhmddoj.exe Pqndlmlj.exe PID 3356 wrote to memory of 2940 3356 Ojhmddoj.exe Pqndlmlj.exe PID 2940 wrote to memory of 784 2940 Pqndlmlj.exe Cphmfdpg.exe PID 2940 wrote to memory of 784 2940 Pqndlmlj.exe Cphmfdpg.exe PID 2940 wrote to memory of 784 2940 Pqndlmlj.exe Cphmfdpg.exe PID 784 wrote to memory of 2708 784 Cphmfdpg.exe Gngbcb32.exe PID 784 wrote to memory of 2708 784 Cphmfdpg.exe Gngbcb32.exe PID 784 wrote to memory of 2708 784 Cphmfdpg.exe Gngbcb32.exe PID 2708 wrote to memory of 1328 2708 Gngbcb32.exe Hgcpgg32.exe PID 2708 wrote to memory of 1328 2708 Gngbcb32.exe Hgcpgg32.exe PID 2708 wrote to memory of 1328 2708 Gngbcb32.exe Hgcpgg32.exe PID 1328 wrote to memory of 3520 1328 Hgcpgg32.exe Kdplebbe.exe PID 1328 wrote to memory of 3520 1328 Hgcpgg32.exe Kdplebbe.exe PID 1328 wrote to memory of 3520 1328 Hgcpgg32.exe Kdplebbe.exe PID 3520 wrote to memory of 2140 3520 Kdplebbe.exe Lekhkdok.exe PID 3520 wrote to memory of 2140 3520 Kdplebbe.exe Lekhkdok.exe PID 3520 wrote to memory of 2140 3520 Kdplebbe.exe Lekhkdok.exe PID 2140 wrote to memory of 3380 2140 Lekhkdok.exe Ofgpnpgk.exe PID 2140 wrote to memory of 3380 2140 Lekhkdok.exe Ofgpnpgk.exe PID 2140 wrote to memory of 3380 2140 Lekhkdok.exe Ofgpnpgk.exe PID 3380 wrote to memory of 2308 3380 Ofgpnpgk.exe Aiphgh32.exe PID 3380 wrote to memory of 2308 3380 Ofgpnpgk.exe Aiphgh32.exe PID 3380 wrote to memory of 2308 3380 Ofgpnpgk.exe Aiphgh32.exe PID 2308 wrote to memory of 3864 2308 Aiphgh32.exe Bllqdabe.exe PID 2308 wrote to memory of 3864 2308 Aiphgh32.exe Bllqdabe.exe PID 2308 wrote to memory of 3864 2308 Aiphgh32.exe Bllqdabe.exe PID 3864 wrote to memory of 492 3864 Bllqdabe.exe Bpjijp32.exe PID 3864 wrote to memory of 492 3864 Bllqdabe.exe Bpjijp32.exe PID 3864 wrote to memory of 492 3864 Bllqdabe.exe Bpjijp32.exe PID 492 wrote to memory of 3996 492 Bpjijp32.exe Bffnmi32.exe PID 492 wrote to memory of 3996 492 Bpjijp32.exe Bffnmi32.exe PID 492 wrote to memory of 3996 492 Bpjijp32.exe Bffnmi32.exe PID 3996 wrote to memory of 3040 3996 Bffnmi32.exe Cpapko32.exe PID 3996 wrote to memory of 3040 3996 Bffnmi32.exe Cpapko32.exe PID 3996 wrote to memory of 3040 3996 Bffnmi32.exe Cpapko32.exe PID 3040 wrote to memory of 1148 3040 Cpapko32.exe Fpfkdibi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8422946c0e8cb1ce7d54b1b78834cb6800539ee40f6da25821aaf68a7ae1746.exe"C:\Users\Admin\AppData\Local\Temp\d8422946c0e8cb1ce7d54b1b78834cb6800539ee40f6da25821aaf68a7ae1746.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jadjbpcn.exeC:\Windows\system32\Jadjbpcn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jlqdpg32.exeC:\Windows\system32\Jlqdpg32.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kigaokib.exeC:\Windows\system32\Kigaokib.exe4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kohcba32.exeC:\Windows\system32\Kohcba32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kokphaab.exeC:\Windows\system32\Kokphaab.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lloqaepk.exeC:\Windows\system32\Lloqaepk.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lenkkj32.exeC:\Windows\system32\Lenkkj32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Nlfpib32.exeC:\Windows\system32\Nlfpib32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ojhmddoj.exeC:\Windows\system32\Ojhmddoj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Pqndlmlj.exeC:\Windows\system32\Pqndlmlj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Cphmfdpg.exeC:\Windows\system32\Cphmfdpg.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Gngbcb32.exeC:\Windows\system32\Gngbcb32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Hgcpgg32.exeC:\Windows\system32\Hgcpgg32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kdplebbe.exeC:\Windows\system32\Kdplebbe.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lekhkdok.exeC:\Windows\system32\Lekhkdok.exe16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ofgpnpgk.exeC:\Windows\system32\Ofgpnpgk.exe17⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Aiphgh32.exeC:\Windows\system32\Aiphgh32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bllqdabe.exeC:\Windows\system32\Bllqdabe.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bpjijp32.exeC:\Windows\system32\Bpjijp32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bffnmi32.exeC:\Windows\system32\Bffnmi32.exe21⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Cpapko32.exeC:\Windows\system32\Cpapko32.exe22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Fpfkdibi.exeC:\Windows\system32\Fpfkdibi.exe23⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Hmggff32.exeC:\Windows\system32\Hmggff32.exe24⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Jcoldo32.exeC:\Windows\system32\Jcoldo32.exe25⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lddnfl32.exeC:\Windows\system32\Lddnfl32.exe26⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cemaio32.exeC:\Windows\system32\Cemaio32.exe27⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cpeblg32.exeC:\Windows\system32\Cpeblg32.exe28⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Genlnhbg.exeC:\Windows\system32\Genlnhbg.exe29⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Ifhhkdlj.exeC:\Windows\system32\Ifhhkdlj.exe30⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Mjkljn32.exeC:\Windows\system32\Mjkljn32.exe31⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ohihpnjb.exeC:\Windows\system32\Ohihpnjb.exe32⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Qpbifn32.exeC:\Windows\system32\Qpbifn32.exe33⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Aabepa32.exeC:\Windows\system32\Aabepa32.exe34⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Anifebhd.exeC:\Windows\system32\Anifebhd.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ajogjc32.exeC:\Windows\system32\Ajogjc32.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Aqlllm32.exeC:\Windows\system32\Aqlllm32.exe37⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bjkfeadk.exeC:\Windows\system32\Bjkfeadk.exe38⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Djpigoac.exeC:\Windows\system32\Djpigoac.exe39⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Dgiclb32.exeC:\Windows\system32\Dgiclb32.exe40⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Flehcofn.exeC:\Windows\system32\Flehcofn.exe41⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Glcdemjn.exeC:\Windows\system32\Glcdemjn.exe42⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Hhhakl32.exeC:\Windows\system32\Hhhakl32.exe43⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ihjnqk32.exeC:\Windows\system32\Ihjnqk32.exe44⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Iennjp32.exeC:\Windows\system32\Iennjp32.exe45⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Iljcli32.exeC:\Windows\system32\Iljcli32.exe46⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Iaihjpbh.exeC:\Windows\system32\Iaihjpbh.exe47⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Jalepppe.exeC:\Windows\system32\Jalepppe.exe48⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Janaeo32.exeC:\Windows\system32\Janaeo32.exe49⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Jlklcghp.exeC:\Windows\system32\Jlklcghp.exe50⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Khdinhkb.exeC:\Windows\system32\Khdinhkb.exe51⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Kcinkqkh.exeC:\Windows\system32\Kcinkqkh.exe52⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Khffcg32.exeC:\Windows\system32\Khffcg32.exe53⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Kcljqp32.exeC:\Windows\system32\Kcljqp32.exe54⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Kihcig32.exeC:\Windows\system32\Kihcig32.exe55⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Kcngfp32.exeC:\Windows\system32\Kcngfp32.exe56⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Kikpnfej.exeC:\Windows\system32\Kikpnfej.exe57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lcpdloep.exeC:\Windows\system32\Lcpdloep.exe58⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Limldfcg.exeC:\Windows\system32\Limldfcg.exe59⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lcbqaocm.exeC:\Windows\system32\Lcbqaocm.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Lipiif32.exeC:\Windows\system32\Lipiif32.exe61⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lbhmbkhe.exeC:\Windows\system32\Lbhmbkhe.exe62⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lkpbka32.exeC:\Windows\system32\Lkpbka32.exe63⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lbjjhkfb.exeC:\Windows\system32\Lbjjhkfb.exe64⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lmpned32.exeC:\Windows\system32\Lmpned32.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Lbmgmk32.exeC:\Windows\system32\Lbmgmk32.exe66⤵
-
C:\Windows\SysWOW64\Lkekfqjp.exeC:\Windows\system32\Lkekfqjp.exe67⤵
-
C:\Windows\SysWOW64\Mfjpcijf.exeC:\Windows\system32\Mfjpcijf.exe68⤵
-
C:\Windows\SysWOW64\Mmdhpc32.exeC:\Windows\system32\Mmdhpc32.exe69⤵
-
C:\Windows\SysWOW64\Mbaphjpj.exeC:\Windows\system32\Mbaphjpj.exe70⤵
-
C:\Windows\SysWOW64\Mmgdfcpp.exeC:\Windows\system32\Mmgdfcpp.exe71⤵
-
C:\Windows\SysWOW64\Mbcmnjnh.exeC:\Windows\system32\Mbcmnjnh.exe72⤵
-
C:\Windows\SysWOW64\Minekd32.exeC:\Windows\system32\Minekd32.exe73⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Mbfjci32.exeC:\Windows\system32\Mbfjci32.exe74⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Mmknab32.exeC:\Windows\system32\Mmknab32.exe75⤵
-
C:\Windows\SysWOW64\Mcefnlch.exeC:\Windows\system32\Mcefnlch.exe76⤵
-
C:\Windows\SysWOW64\Mjonjf32.exeC:\Windows\system32\Mjonjf32.exe77⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Nplgbm32.exeC:\Windows\system32\Nplgbm32.exe78⤵
-
C:\Windows\SysWOW64\Njakpfhb.exeC:\Windows\system32\Njakpfhb.exe79⤵
-
C:\Windows\SysWOW64\Npochmfi.exeC:\Windows\system32\Npochmfi.exe80⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nighab32.exeC:\Windows\system32\Nighab32.exe81⤵
-
C:\Windows\SysWOW64\Npapnmdg.exeC:\Windows\system32\Npapnmdg.exe82⤵
-
C:\Windows\SysWOW64\Njfdke32.exeC:\Windows\system32\Njfdke32.exe83⤵
-
C:\Windows\SysWOW64\Nbaioh32.exeC:\Windows\system32\Nbaioh32.exe84⤵
-
C:\Windows\SysWOW64\Oipkga32.exeC:\Windows\system32\Oipkga32.exe85⤵
-
C:\Windows\SysWOW64\Ofdkqe32.exeC:\Windows\system32\Ofdkqe32.exe86⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Oladilbp.exeC:\Windows\system32\Oladilbp.exe87⤵
-
C:\Windows\SysWOW64\Offhfeaf.exeC:\Windows\system32\Offhfeaf.exe88⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Olcqnlpn.exeC:\Windows\system32\Olcqnlpn.exe89⤵
-
C:\Windows\SysWOW64\Ojdqlc32.exeC:\Windows\system32\Ojdqlc32.exe90⤵
-
C:\Windows\SysWOW64\Odmeei32.exeC:\Windows\system32\Odmeei32.exe91⤵
-
C:\Windows\SysWOW64\Pijnmp32.exeC:\Windows\system32\Pijnmp32.exe92⤵
-
C:\Windows\SysWOW64\Pbbbfece.exeC:\Windows\system32\Pbbbfece.exe93⤵
-
C:\Windows\SysWOW64\Pmgfcnck.exeC:\Windows\system32\Pmgfcnck.exe94⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Pfpkldjk.exeC:\Windows\system32\Pfpkldjk.exe95⤵
-
C:\Windows\SysWOW64\Pmjcin32.exeC:\Windows\system32\Pmjcin32.exe96⤵
-
C:\Windows\SysWOW64\Pbglae32.exeC:\Windows\system32\Pbglae32.exe97⤵
-
C:\Windows\SysWOW64\Pmlpon32.exeC:\Windows\system32\Pmlpon32.exe98⤵
-
C:\Windows\SysWOW64\Pbihgdmm.exeC:\Windows\system32\Pbihgdmm.exe99⤵
-
C:\Windows\SysWOW64\Pmomdmmc.exeC:\Windows\system32\Pmomdmmc.exe100⤵
-
C:\Windows\SysWOW64\Pbkeldkj.exeC:\Windows\system32\Pbkeldkj.exe101⤵
-
C:\Windows\SysWOW64\Qldiej32.exeC:\Windows\system32\Qldiej32.exe102⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Qginbbaa.exeC:\Windows\system32\Qginbbaa.exe103⤵
-
C:\Windows\SysWOW64\Qlffkiph.exeC:\Windows\system32\Qlffkiph.exe104⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Qgljhbpn.exeC:\Windows\system32\Qgljhbpn.exe105⤵
-
C:\Windows\SysWOW64\Amebel32.exeC:\Windows\system32\Amebel32.exe106⤵
-
C:\Windows\SysWOW64\Acbkmc32.exeC:\Windows\system32\Acbkmc32.exe107⤵
-
C:\Windows\SysWOW64\Anmiek32.exeC:\Windows\system32\Anmiek32.exe108⤵
-
C:\Windows\SysWOW64\Agemnagc.exeC:\Windows\system32\Agemnagc.exe109⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Albffhek.exeC:\Windows\system32\Albffhek.exe110⤵
-
C:\Windows\SysWOW64\Bggjdqea.exeC:\Windows\system32\Bggjdqea.exe111⤵
-
C:\Windows\SysWOW64\Bdkjme32.exeC:\Windows\system32\Bdkjme32.exe112⤵
-
C:\Windows\SysWOW64\Bjhcel32.exeC:\Windows\system32\Bjhcel32.exe113⤵
-
C:\Windows\SysWOW64\Bcqgnaib.exeC:\Windows\system32\Bcqgnaib.exe114⤵
-
C:\Windows\SysWOW64\Bnfllj32.exeC:\Windows\system32\Bnfllj32.exe115⤵
-
C:\Windows\SysWOW64\Bdpdhdpe.exeC:\Windows\system32\Bdpdhdpe.exe116⤵
-
C:\Windows\SysWOW64\Bjmlqknm.exeC:\Windows\system32\Bjmlqknm.exe117⤵
-
C:\Windows\SysWOW64\Bdbqndnb.exeC:\Windows\system32\Bdbqndnb.exe118⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Bjoifklj.exeC:\Windows\system32\Bjoifklj.exe119⤵
-
C:\Windows\SysWOW64\Bpiacecg.exeC:\Windows\system32\Bpiacecg.exe120⤵
-
C:\Windows\SysWOW64\Cgcipo32.exeC:\Windows\system32\Cgcipo32.exe121⤵
-
C:\Windows\SysWOW64\Clpbhf32.exeC:\Windows\system32\Clpbhf32.exe122⤵
-
C:\Windows\SysWOW64\Ccjjdpah.exeC:\Windows\system32\Ccjjdpah.exe123⤵
-
C:\Windows\SysWOW64\Cnoobiqn.exeC:\Windows\system32\Cnoobiqn.exe124⤵
-
C:\Windows\SysWOW64\Cdigochj.exeC:\Windows\system32\Cdigochj.exe125⤵
-
C:\Windows\SysWOW64\Cnakgh32.exeC:\Windows\system32\Cnakgh32.exe126⤵
-
C:\Windows\SysWOW64\Cdlcdbfh.exeC:\Windows\system32\Cdlcdbfh.exe127⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Cjhllido.exeC:\Windows\system32\Cjhllido.exe128⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Cdnpjb32.exeC:\Windows\system32\Cdnpjb32.exe129⤵
-
C:\Windows\SysWOW64\Djmegi32.exeC:\Windows\system32\Djmegi32.exe130⤵
-
C:\Windows\SysWOW64\Ddbiea32.exeC:\Windows\system32\Ddbiea32.exe131⤵
-
C:\Windows\SysWOW64\Djpbmhng.exeC:\Windows\system32\Djpbmhng.exe132⤵
-
C:\Windows\SysWOW64\Ddefjanm.exeC:\Windows\system32\Ddefjanm.exe133⤵
-
C:\Windows\SysWOW64\Dkoogk32.exeC:\Windows\system32\Dkoogk32.exe134⤵
-
C:\Windows\SysWOW64\Dqlgob32.exeC:\Windows\system32\Dqlgob32.exe135⤵
-
C:\Windows\SysWOW64\Djdkhh32.exeC:\Windows\system32\Djdkhh32.exe136⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ddjpeq32.exeC:\Windows\system32\Ddjpeq32.exe137⤵
-
C:\Windows\SysWOW64\Dkchbkad.exeC:\Windows\system32\Dkchbkad.exe138⤵
-
C:\Windows\SysWOW64\Edllkp32.exeC:\Windows\system32\Edllkp32.exe139⤵
-
C:\Windows\SysWOW64\Ejiecgfm.exeC:\Windows\system32\Ejiecgfm.exe140⤵
-
C:\Windows\SysWOW64\Eeniqpfb.exeC:\Windows\system32\Eeniqpfb.exe141⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ejkaigdj.exeC:\Windows\system32\Ejkaigdj.exe142⤵
-
C:\Windows\SysWOW64\Eeqffpcp.exeC:\Windows\system32\Eeqffpcp.exe143⤵
-
C:\Windows\SysWOW64\Ejnnnfbg.exeC:\Windows\system32\Ejnnnfbg.exe144⤵
-
C:\Windows\SysWOW64\Ecfcglhh.exeC:\Windows\system32\Ecfcglhh.exe145⤵
-
C:\Windows\SysWOW64\Ejpkdf32.exeC:\Windows\system32\Ejpkdf32.exe146⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Eeeoao32.exeC:\Windows\system32\Eeeoao32.exe147⤵
-
C:\Windows\SysWOW64\Ejbhif32.exeC:\Windows\system32\Ejbhif32.exe148⤵
-
C:\Windows\SysWOW64\Falpfp32.exeC:\Windows\system32\Falpfp32.exe149⤵
-
C:\Windows\SysWOW64\Fnpppd32.exeC:\Windows\system32\Fnpppd32.exe150⤵
-
C:\Windows\SysWOW64\Fcmihk32.exeC:\Windows\system32\Fcmihk32.exe151⤵
-
C:\Windows\SysWOW64\Fjgadejm.exeC:\Windows\system32\Fjgadejm.exe152⤵
-
C:\Windows\SysWOW64\Faaiaoai.exeC:\Windows\system32\Faaiaoai.exe153⤵
-
C:\Windows\SysWOW64\Fjinje32.exeC:\Windows\system32\Fjinje32.exe154⤵
-
C:\Windows\SysWOW64\Facfgoog.exeC:\Windows\system32\Facfgoog.exe155⤵
-
C:\Windows\SysWOW64\Fjljpd32.exeC:\Windows\system32\Fjljpd32.exe156⤵
-
C:\Windows\SysWOW64\Faeclomd.exeC:\Windows\system32\Faeclomd.exe157⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gmlcapch.exeC:\Windows\system32\Gmlcapch.exe158⤵
-
C:\Windows\SysWOW64\Gdflnj32.exeC:\Windows\system32\Gdflnj32.exe159⤵
-
C:\Windows\SysWOW64\Gmopgoqe.exeC:\Windows\system32\Gmopgoqe.exe160⤵
-
C:\Windows\SysWOW64\Gdihci32.exeC:\Windows\system32\Gdihci32.exe161⤵
-
C:\Windows\SysWOW64\Gnnmabhh.exeC:\Windows\system32\Gnnmabhh.exe162⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gdkeiifp.exeC:\Windows\system32\Gdkeiifp.exe163⤵
-
C:\Windows\SysWOW64\Gnqifafe.exeC:\Windows\system32\Gnqifafe.exe164⤵
-
C:\Windows\SysWOW64\Gejacl32.exeC:\Windows\system32\Gejacl32.exe165⤵
-
C:\Windows\SysWOW64\Gldjpf32.exeC:\Windows\system32\Gldjpf32.exe166⤵
-
C:\Windows\SysWOW64\Gaabhm32.exeC:\Windows\system32\Gaabhm32.exe167⤵
-
C:\Windows\SysWOW64\Glgfee32.exeC:\Windows\system32\Glgfee32.exe168⤵
-
C:\Windows\SysWOW64\Haconm32.exeC:\Windows\system32\Haconm32.exe169⤵
-
C:\Windows\SysWOW64\Hhngjgha.exeC:\Windows\system32\Hhngjgha.exe170⤵
-
C:\Windows\SysWOW64\Hmjpbn32.exeC:\Windows\system32\Hmjpbn32.exe171⤵
-
C:\Windows\SysWOW64\Hllpqeog.exeC:\Windows\system32\Hllpqeog.exe172⤵
-
C:\Windows\SysWOW64\Hahhilmo.exeC:\Windows\system32\Hahhilmo.exe173⤵
-
C:\Windows\SysWOW64\Hlnmfdmd.exeC:\Windows\system32\Hlnmfdmd.exe174⤵
-
C:\Windows\SysWOW64\Hakenl32.exeC:\Windows\system32\Hakenl32.exe175⤵
-
C:\Windows\SysWOW64\Hhdmkebi.exeC:\Windows\system32\Hhdmkebi.exe176⤵
-
C:\Windows\SysWOW64\Hmafcmqp.exeC:\Windows\system32\Hmafcmqp.exe177⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hhgjqepf.exeC:\Windows\system32\Hhgjqepf.exe178⤵
-
C:\Windows\SysWOW64\Imdbil32.exeC:\Windows\system32\Imdbil32.exe179⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Idnkeffj.exeC:\Windows\system32\Idnkeffj.exe180⤵
-
C:\Windows\SysWOW64\Iaakojed.exeC:\Windows\system32\Iaakojed.exe181⤵
-
C:\Windows\SysWOW64\Ilgplcdj.exeC:\Windows\system32\Ilgplcdj.exe182⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Iadhdj32.exeC:\Windows\system32\Iadhdj32.exe183⤵
-
C:\Windows\SysWOW64\Iljlbc32.exeC:\Windows\system32\Iljlbc32.exe184⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Imkiikhe.exeC:\Windows\system32\Imkiikhe.exe185⤵
-
C:\Windows\SysWOW64\Ideafe32.exeC:\Windows\system32\Ideafe32.exe186⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Iojecn32.exeC:\Windows\system32\Iojecn32.exe187⤵
-
C:\Windows\SysWOW64\Idgnlenp.exeC:\Windows\system32\Idgnlenp.exe188⤵
-
C:\Windows\SysWOW64\Jombinne.exeC:\Windows\system32\Jombinne.exe189⤵
-
C:\Windows\SysWOW64\Jegjfh32.exeC:\Windows\system32\Jegjfh32.exe190⤵
-
C:\Windows\SysWOW64\Jkcbno32.exeC:\Windows\system32\Jkcbno32.exe191⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Jeigkg32.exeC:\Windows\system32\Jeigkg32.exe192⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Jlcoha32.exeC:\Windows\system32\Jlcoha32.exe193⤵
-
C:\Windows\SysWOW64\Japgph32.exeC:\Windows\system32\Japgph32.exe194⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Jochjm32.exeC:\Windows\system32\Jochjm32.exe195⤵
-
C:\Windows\SysWOW64\Jdqqbc32.exeC:\Windows\system32\Jdqqbc32.exe196⤵
-
C:\Windows\SysWOW64\Jofdolek.exeC:\Windows\system32\Jofdolek.exe197⤵
-
C:\Windows\SysWOW64\Jepmlf32.exeC:\Windows\system32\Jepmlf32.exe198⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kkmedm32.exeC:\Windows\system32\Kkmedm32.exe199⤵
-
C:\Windows\SysWOW64\Kebjaf32.exeC:\Windows\system32\Kebjaf32.exe200⤵
-
C:\Windows\SysWOW64\Kkobjmim.exeC:\Windows\system32\Kkobjmim.exe201⤵
-
C:\Windows\SysWOW64\Knbhah32.exeC:\Windows\system32\Knbhah32.exe202⤵
-
C:\Windows\SysWOW64\Khhlnq32.exeC:\Windows\system32\Khhlnq32.exe203⤵
-
C:\Windows\SysWOW64\Koadkkkn.exeC:\Windows\system32\Koadkkkn.exe204⤵
-
C:\Windows\SysWOW64\Kdomcaie.exeC:\Windows\system32\Kdomcaie.exe205⤵
-
C:\Windows\SysWOW64\Lodaqjik.exeC:\Windows\system32\Lodaqjik.exe206⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Lhleippk.exeC:\Windows\system32\Lhleippk.exe207⤵
-
C:\Windows\SysWOW64\Lofnfj32.exeC:\Windows\system32\Lofnfj32.exe208⤵
-
C:\Windows\SysWOW64\Ldcfna32.exeC:\Windows\system32\Ldcfna32.exe209⤵
-
C:\Windows\SysWOW64\Loijlj32.exeC:\Windows\system32\Loijlj32.exe210⤵
-
C:\Windows\SysWOW64\Ldecdqcm.exeC:\Windows\system32\Ldecdqcm.exe211⤵
-
C:\Windows\SysWOW64\Lokgaicc.exeC:\Windows\system32\Lokgaicc.exe212⤵
-
C:\Windows\SysWOW64\Lfeonc32.exeC:\Windows\system32\Lfeonc32.exe213⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Lnpdbf32.exeC:\Windows\system32\Lnpdbf32.exe214⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Mdjlop32.exeC:\Windows\system32\Mdjlop32.exe215⤵
-
C:\Windows\SysWOW64\Mopqli32.exeC:\Windows\system32\Mopqli32.exe216⤵
-
C:\Windows\SysWOW64\Mdmidp32.exeC:\Windows\system32\Mdmidp32.exe217⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Mobmbh32.exeC:\Windows\system32\Mobmbh32.exe218⤵
-
C:\Windows\SysWOW64\Mfleobdh.exeC:\Windows\system32\Mfleobdh.exe219⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Mkingi32.exeC:\Windows\system32\Mkingi32.exe220⤵
-
C:\Windows\SysWOW64\Mbcfccjl.exeC:\Windows\system32\Mbcfccjl.exe221⤵
-
C:\Windows\SysWOW64\Mkkkli32.exeC:\Windows\system32\Mkkkli32.exe222⤵
-
C:\Windows\SysWOW64\Mfaojb32.exeC:\Windows\system32\Mfaojb32.exe223⤵
-
C:\Windows\SysWOW64\Mnlcndnn.exeC:\Windows\system32\Mnlcndnn.exe224⤵
-
C:\Windows\SysWOW64\Neflkn32.exeC:\Windows\system32\Neflkn32.exe225⤵
-
C:\Windows\SysWOW64\Nokphg32.exeC:\Windows\system32\Nokphg32.exe226⤵
-
C:\Windows\SysWOW64\Nehhpn32.exeC:\Windows\system32\Nehhpn32.exe227⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nonmngcn.exeC:\Windows\system32\Nonmngcn.exe228⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Nekefnae.exeC:\Windows\system32\Nekefnae.exe229⤵
-
C:\Windows\SysWOW64\Nppicfak.exeC:\Windows\system32\Nppicfak.exe230⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nembkmob.exeC:\Windows\system32\Nembkmob.exe231⤵
-
C:\Windows\SysWOW64\Npbfif32.exeC:\Windows\system32\Npbfif32.exe232⤵
-
C:\Windows\SysWOW64\Neooam32.exeC:\Windows\system32\Neooam32.exe233⤵
-
C:\Windows\SysWOW64\Npecnf32.exeC:\Windows\system32\Npecnf32.exe234⤵
-
C:\Windows\SysWOW64\Oeakfm32.exeC:\Windows\system32\Oeakfm32.exe235⤵
-
C:\Windows\SysWOW64\Opgpde32.exeC:\Windows\system32\Opgpde32.exe236⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Oedhllij.exeC:\Windows\system32\Oedhllij.exe237⤵
-
C:\Windows\SysWOW64\Opjlieip.exeC:\Windows\system32\Opjlieip.exe238⤵
-
C:\Windows\SysWOW64\Oefealgh.exeC:\Windows\system32\Oefealgh.exe239⤵
-
C:\Windows\SysWOW64\Oplioegn.exeC:\Windows\system32\Oplioegn.exe240⤵
-
C:\Windows\SysWOW64\Offalonj.exeC:\Windows\system32\Offalonj.exe241⤵