Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
15-05-2021 14:42
Static task
static1
Behavioral task
behavioral1
Sample
9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d.exe
-
Size
1.1MB
-
MD5
0a44ea401960942fb659e2516a47a230
-
SHA1
af730afece5517a2e8e27d873d2241814381feb2
-
SHA256
9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d
-
SHA512
73a110d75540dd3b33d344e3bcf7633d19bc74f703d709de93a6389fd22ee8429267c175c1adafd9816924b421ed9b3dc1a33d4d4f93887b179f33eec5bea31a
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs
-
BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
-
Executes dropped EXE 64 IoCs
pid Process 200 Keikgbch.exe 2296 Kpaljj32.exe 820 Lmemco32.exe 1096 Lbbele32.exe 1200 Linjno32.exe 1664 Lbfnfejg.exe 1960 Ldfkqh32.exe 2364 Lmnoim32.exe 2764 Mmqlom32.exe 3992 Migmdn32.exe 3564 Mlhffi32.exe 4068 Milfomgg.exe 700 Mgpghafp.exe 2232 Nddgbfej.exe 2736 Ncidcbib.exe 3872 Ojcefjbl.exe 1116 Agjkllap.exe 2824 Ajkdng32.exe 3940 Animdedh.exe 1660 Agaamkkh.exe 2104 Amnjeaip.exe 3600 Bjdgde32.exe 1456 Bgkdcicn.exe 4120 Cgajdh32.exe 4148 Cefkmm32.exe 4176 Cckhoi32.exe 4216 Deajikab.exe 4248 Dedgokpo.exe 4292 Ekeiba32.exe 4320 Egqcbakp.exe 4348 Eahdejic.exe 4380 Fgjfhp32.exe 4420 Gaddqh32.exe 4440 Gkmhjmeg.exe 4460 Ggcioo32.exe 4480 Gedilf32.exe 4500 Ghceha32.exe 4520 Gakjagin.exe 4540 Goojkkhh.exe 4560 Geibgeod.exe 4580 Iobpghgb.exe 4600 Iodmmh32.exe 4620 Ibciic32.exe 4640 Igpaaj32.exe 4660 Ifqaobkj.exe 4680 Jnlfcd32.exe 4700 Jiakqm32.exe 4720 Jnncid32.exe 4740 Jgfgbimc.exe 4760 Jonpcgme.exe 4780 Jfhhpaeb.exe 4800 Jkdphhci.exe 4820 Jbnhdb32.exe 4840 Jihqalbc.exe 4860 Jflakp32.exe 4880 Jikmgl32.exe 4900 Kpeecfgm.exe 4920 Kfonpp32.exe 4940 Kimjlk32.exe 4960 Kpgbieej.exe 4980 Kfakfpmg.exe 5000 Kgbgnh32.exe 5020 Knlojbjb.exe 5052 Kibcgkjh.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ReceiveWait.tiff Process not Found -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Mgpghafp.exe Milfomgg.exe File opened for modification C:\Windows\SysWOW64\Jqlhki32.exe Jbiholkp.exe File created C:\Windows\SysWOW64\Bkgbmqck.exe Bjefeh32.exe File created C:\Windows\SysWOW64\Jelqjqlf.dll Bdacjeie.exe File opened for modification C:\Windows\SysWOW64\Joknlj32.exe Jmjadamb.exe File created C:\Windows\SysWOW64\Cagjpcqd.exe Ckmbci32.exe File opened for modification C:\Windows\SysWOW64\Edjinlmp.exe Enqqab32.exe File created C:\Windows\SysWOW64\Pfnpdilj.exe Ppdhho32.exe File created C:\Windows\SysWOW64\Hlpjhi32.dll Hblgeenk.exe File created C:\Windows\SysWOW64\Cgabmiqf.dll Process not Found File created C:\Windows\SysWOW64\Cfhafdpm.dll Ebjplapo.exe File created C:\Windows\SysWOW64\Lgcbbi32.dll Balidhag.exe File opened for modification C:\Windows\SysWOW64\Poampdhi.exe Piddgmib.exe File opened for modification C:\Windows\SysWOW64\Fbmlcdde.exe Fpopgida.exe File created C:\Windows\SysWOW64\Nlhmoa32.exe Nfodbgba.exe File created C:\Windows\SysWOW64\Ecaiai32.exe Eljapl32.exe File created C:\Windows\SysWOW64\Anjgii32.dll Clhebm32.exe File created C:\Windows\SysWOW64\Jkdphhci.exe Jfhhpaeb.exe File opened for modification C:\Windows\SysWOW64\Boaahcdm.exe Bgjigecj.exe File opened for modification C:\Windows\SysWOW64\Goblmlid.exe Gihcpb32.exe File created C:\Windows\SysWOW64\Dladfnql.dll Ojkiidmh.exe File opened for modification C:\Windows\SysWOW64\Nbqlli32.exe Mobopnmg.exe File created C:\Windows\SysWOW64\Cnfljblk.dll Mhiokn32.exe File created C:\Windows\SysWOW64\Aoklhpii.dll Hlmpcgfk.exe File opened for modification C:\Windows\SysWOW64\Fpnilc32.exe Fidapiii.exe File opened for modification C:\Windows\SysWOW64\Ilcoip32.exe Ieigmeej.exe File created C:\Windows\SysWOW64\Iigpcd32.exe Ibmgfjcd.exe File opened for modification C:\Windows\SysWOW64\Nqeojf32.exe Njkgml32.exe File created C:\Windows\SysWOW64\Icajcbgk.dll Bddfjk32.exe File created C:\Windows\SysWOW64\Kaapigcb.exe Process not Found File opened for modification C:\Windows\SysWOW64\Fbpihdab.exe Flealj32.exe File created C:\Windows\SysWOW64\Hfbgke32.dll Kcqdmmgj.exe File created C:\Windows\SysWOW64\Kllmao32.exe Process not Found File created C:\Windows\SysWOW64\Jgocid32.dll Jonpcgme.exe File created C:\Windows\SysWOW64\Bloifdpe.exe Bajeilpp.exe File created C:\Windows\SysWOW64\Occbon32.dll Kpaljj32.exe File created C:\Windows\SysWOW64\Llhjligm.dll Mgdfpood.exe File opened for modification C:\Windows\SysWOW64\Dambkf32.exe Dkcjollh.exe File opened for modification C:\Windows\SysWOW64\Epplnq32.exe Ejfcafdp.exe File created C:\Windows\SysWOW64\Bndhnfnc.exe Blckgnhd.exe File created C:\Windows\SysWOW64\Iighnbdm.dll Fqjene32.exe File opened for modification C:\Windows\SysWOW64\Eijoigkn.exe Ehhbao32.exe File opened for modification C:\Windows\SysWOW64\Ffefcjdo.exe Fmlajd32.exe File created C:\Windows\SysWOW64\Mghajhfn.dll Oafokjkl.exe File created C:\Windows\SysWOW64\Khjdnakb.dll Pmhiaccg.exe File created C:\Windows\SysWOW64\Mhnemmbb.dll Foiigmao.exe File created C:\Windows\SysWOW64\Ciacdgml.dll Biddpl32.exe File created C:\Windows\SysWOW64\Odifabml.dll Bfmndpfm.exe File created C:\Windows\SysWOW64\Hadakaap.exe Hpbedi32.exe File opened for modification C:\Windows\SysWOW64\Fgcgqiko.exe Fafnhbmg.exe File opened for modification C:\Windows\SysWOW64\Inppmpog.exe Igehqe32.exe File created C:\Windows\SysWOW64\Apfndm32.exe Aoeamdnj.exe File opened for modification C:\Windows\SysWOW64\Lhimngln.exe Kfhqfo32.exe File created C:\Windows\SysWOW64\Kifofl32.dll Lbanao32.exe File opened for modification C:\Windows\SysWOW64\Pdkahedh.exe Pmaikk32.exe File created C:\Windows\SysWOW64\Dombijgk.dll Process not Found File opened for modification C:\Windows\SysWOW64\Ajlcoj32.exe Aofoaaea.exe File opened for modification C:\Windows\SysWOW64\Gdoebgie.exe Glhnajhc.exe File created C:\Windows\SysWOW64\Hfghfi32.dll Gbbndqcj.exe File created C:\Windows\SysWOW64\Fgeleg32.dll Jafghoqk.exe File opened for modification C:\Windows\SysWOW64\Afjhhb32.exe Aoppkh32.exe File created C:\Windows\SysWOW64\Nebgbq32.exe Process not Found File created C:\Windows\SysWOW64\Nhlidl32.dll Kpnhjdob.exe File created C:\Windows\SysWOW64\Ajdefpfj.exe Acjmjfon.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\infpub.dat Process not Found File created C:\Windows\cscc.dat Process not Found File created C:\Windows\dispci.exe Process not Found File opened for modification C:\Windows\FD0.tmp Process not Found -
Program crash 1 IoCs
pid pid_target Process procid_target 10900 10808 Process not Found 1208 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 11068 Process not Found 11216 Process not Found -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Plhqin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknocn32.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gekhbo32.dll" Amijpl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gogehk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjgjnl32.dll" Ecgbimah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fceblhap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Amdoghme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcppcc32.dll" Afflpbpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdnhck32.dll" Nnigna32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mgeepbej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnfnep32.dll" Lpmihcfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bboiphoi.dll" Hklclo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ihepik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eakomdgd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Liffhd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nlhmoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Heojkbba.dll" Piiiqoie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lippii32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nfffoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npnfbfkg.dll" Ajinap32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hkljfe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dbpmfbhi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pboade32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Neflpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hkljfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Begafabj.dll" Cfapei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cnnkdd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ccieho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbpgqa32.dll" Emqbnf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ahhmjgbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgefalmc.dll" Fffecmje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mfhjmlhm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nhhbfbbk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bologgeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mecefimo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kfakfpmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dpnmlipn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hofljm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpmkqc32.dll" Lccbod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjpbepji.dll" Hfknpq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Amdoghme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddccjdpg.dll" Njkgml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dedgokpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igmepc32.dll" Acnhag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqgpac32.dll" Adbqoapm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kekfol32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mhcnhdjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ebkegjkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgecgfbi.dll" Fgigfo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajpeinhk.dll" Mjeoaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mmdjnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epkjee32.dll" Lanfol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iapeincj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ijmgcp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jbiholkp.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 10936 Process not Found 10936 Process not Found 10936 Process not Found 10936 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found 10900 Process not Found -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 10900 Process not Found Token: SeBackupPrivilege 10900 Process not Found Token: SeShutdownPrivilege 10936 Process not Found Token: SeDebugPrivilege 10936 Process not Found Token: SeTcbPrivilege 10936 Process not Found Token: SeDebugPrivilege 10900 Process not Found Token: SeDebugPrivilege 10944 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3560 wrote to memory of 200 3560 9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d.exe 73 PID 3560 wrote to memory of 200 3560 9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d.exe 73 PID 3560 wrote to memory of 200 3560 9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d.exe 73 PID 200 wrote to memory of 2296 200 Keikgbch.exe 74 PID 200 wrote to memory of 2296 200 Keikgbch.exe 74 PID 200 wrote to memory of 2296 200 Keikgbch.exe 74 PID 2296 wrote to memory of 820 2296 Kpaljj32.exe 76 PID 2296 wrote to memory of 820 2296 Kpaljj32.exe 76 PID 2296 wrote to memory of 820 2296 Kpaljj32.exe 76 PID 820 wrote to memory of 1096 820 Lmemco32.exe 77 PID 820 wrote to memory of 1096 820 Lmemco32.exe 77 PID 820 wrote to memory of 1096 820 Lmemco32.exe 77 PID 1096 wrote to memory of 1200 1096 Lbbele32.exe 79 PID 1096 wrote to memory of 1200 1096 Lbbele32.exe 79 PID 1096 wrote to memory of 1200 1096 Lbbele32.exe 79 PID 1200 wrote to memory of 1664 1200 Linjno32.exe 80 PID 1200 wrote to memory of 1664 1200 Linjno32.exe 80 PID 1200 wrote to memory of 1664 1200 Linjno32.exe 80 PID 1664 wrote to memory of 1960 1664 Lbfnfejg.exe 81 PID 1664 wrote to memory of 1960 1664 Lbfnfejg.exe 81 PID 1664 wrote to memory of 1960 1664 Lbfnfejg.exe 81 PID 1960 wrote to memory of 2364 1960 Ldfkqh32.exe 82 PID 1960 wrote to memory of 2364 1960 Ldfkqh32.exe 82 PID 1960 wrote to memory of 2364 1960 Ldfkqh32.exe 82 PID 2364 wrote to memory of 2764 2364 Lmnoim32.exe 83 PID 2364 wrote to memory of 2764 2364 Lmnoim32.exe 83 PID 2364 wrote to memory of 2764 2364 Lmnoim32.exe 83 PID 2764 wrote to memory of 3992 2764 Mmqlom32.exe 84 PID 2764 wrote to memory of 3992 2764 Mmqlom32.exe 84 PID 2764 wrote to memory of 3992 2764 Mmqlom32.exe 84 PID 3992 wrote to memory of 3564 3992 Migmdn32.exe 85 PID 3992 wrote to memory of 3564 3992 Migmdn32.exe 85 PID 3992 wrote to memory of 3564 3992 Migmdn32.exe 85 PID 3564 wrote to memory of 4068 3564 Mlhffi32.exe 86 PID 3564 wrote to memory of 4068 3564 Mlhffi32.exe 86 PID 3564 wrote to memory of 4068 3564 Mlhffi32.exe 86 PID 4068 wrote to memory of 700 4068 Milfomgg.exe 88 PID 4068 wrote to memory of 700 4068 Milfomgg.exe 88 PID 4068 wrote to memory of 700 4068 Milfomgg.exe 88 PID 700 wrote to memory of 2232 700 Mgpghafp.exe 89 PID 700 wrote to memory of 2232 700 Mgpghafp.exe 89 PID 700 wrote to memory of 2232 700 Mgpghafp.exe 89 PID 2232 wrote to memory of 2736 2232 Nddgbfej.exe 90 PID 2232 wrote to memory of 2736 2232 Nddgbfej.exe 90 PID 2232 wrote to memory of 2736 2232 Nddgbfej.exe 90 PID 2736 wrote to memory of 3872 2736 Ncidcbib.exe 91 PID 2736 wrote to memory of 3872 2736 Ncidcbib.exe 91 PID 2736 wrote to memory of 3872 2736 Ncidcbib.exe 91 PID 3872 wrote to memory of 1116 3872 Ojcefjbl.exe 92 PID 3872 wrote to memory of 1116 3872 Ojcefjbl.exe 92 PID 3872 wrote to memory of 1116 3872 Ojcefjbl.exe 92 PID 1116 wrote to memory of 2824 1116 Agjkllap.exe 93 PID 1116 wrote to memory of 2824 1116 Agjkllap.exe 93 PID 1116 wrote to memory of 2824 1116 Agjkllap.exe 93 PID 2824 wrote to memory of 3940 2824 Ajkdng32.exe 94 PID 2824 wrote to memory of 3940 2824 Ajkdng32.exe 94 PID 2824 wrote to memory of 3940 2824 Ajkdng32.exe 94 PID 3940 wrote to memory of 1660 3940 Animdedh.exe 95 PID 3940 wrote to memory of 1660 3940 Animdedh.exe 95 PID 3940 wrote to memory of 1660 3940 Animdedh.exe 95 PID 1660 wrote to memory of 2104 1660 Agaamkkh.exe 96 PID 1660 wrote to memory of 2104 1660 Agaamkkh.exe 96 PID 1660 wrote to memory of 2104 1660 Agaamkkh.exe 96 PID 2104 wrote to memory of 3600 2104 Amnjeaip.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d.exe"C:\Users\Admin\AppData\Local\Temp\9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\Keikgbch.exeC:\Windows\system32\Keikgbch.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Windows\SysWOW64\Kpaljj32.exeC:\Windows\system32\Kpaljj32.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\Lmemco32.exeC:\Windows\system32\Lmemco32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\Lbbele32.exeC:\Windows\system32\Lbbele32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\Linjno32.exeC:\Windows\system32\Linjno32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\Lbfnfejg.exeC:\Windows\system32\Lbfnfejg.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\Ldfkqh32.exeC:\Windows\system32\Ldfkqh32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\Lmnoim32.exeC:\Windows\system32\Lmnoim32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\Mmqlom32.exeC:\Windows\system32\Mmqlom32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\Migmdn32.exeC:\Windows\system32\Migmdn32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\Mlhffi32.exeC:\Windows\system32\Mlhffi32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\Milfomgg.exeC:\Windows\system32\Milfomgg.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\Mgpghafp.exeC:\Windows\system32\Mgpghafp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Windows\SysWOW64\Nddgbfej.exeC:\Windows\system32\Nddgbfej.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\Ncidcbib.exeC:\Windows\system32\Ncidcbib.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\Ojcefjbl.exeC:\Windows\system32\Ojcefjbl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\Agjkllap.exeC:\Windows\system32\Agjkllap.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\Ajkdng32.exeC:\Windows\system32\Ajkdng32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\Animdedh.exeC:\Windows\system32\Animdedh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\Agaamkkh.exeC:\Windows\system32\Agaamkkh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\Amnjeaip.exeC:\Windows\system32\Amnjeaip.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\Bjdgde32.exeC:\Windows\system32\Bjdgde32.exe23⤵
- Executes dropped EXE
PID:3600 -
C:\Windows\SysWOW64\Bgkdcicn.exeC:\Windows\system32\Bgkdcicn.exe24⤵
- Executes dropped EXE
PID:1456 -
C:\Windows\SysWOW64\Cgajdh32.exeC:\Windows\system32\Cgajdh32.exe25⤵
- Executes dropped EXE
PID:4120 -
C:\Windows\SysWOW64\Cefkmm32.exeC:\Windows\system32\Cefkmm32.exe26⤵
- Executes dropped EXE
PID:4148 -
C:\Windows\SysWOW64\Cckhoi32.exeC:\Windows\system32\Cckhoi32.exe27⤵
- Executes dropped EXE
PID:4176 -
C:\Windows\SysWOW64\Deajikab.exeC:\Windows\system32\Deajikab.exe28⤵
- Executes dropped EXE
PID:4216 -
C:\Windows\SysWOW64\Dedgokpo.exeC:\Windows\system32\Dedgokpo.exe29⤵
- Executes dropped EXE
- Modifies registry class
PID:4248 -
C:\Windows\SysWOW64\Ekeiba32.exeC:\Windows\system32\Ekeiba32.exe30⤵
- Executes dropped EXE
PID:4292 -
C:\Windows\SysWOW64\Egqcbakp.exeC:\Windows\system32\Egqcbakp.exe31⤵
- Executes dropped EXE
PID:4320 -
C:\Windows\SysWOW64\Eahdejic.exeC:\Windows\system32\Eahdejic.exe32⤵
- Executes dropped EXE
PID:4348 -
C:\Windows\SysWOW64\Fgjfhp32.exeC:\Windows\system32\Fgjfhp32.exe33⤵
- Executes dropped EXE
PID:4380 -
C:\Windows\SysWOW64\Gaddqh32.exeC:\Windows\system32\Gaddqh32.exe34⤵
- Executes dropped EXE
PID:4420 -
C:\Windows\SysWOW64\Gkmhjmeg.exeC:\Windows\system32\Gkmhjmeg.exe35⤵
- Executes dropped EXE
PID:4440 -
C:\Windows\SysWOW64\Ggcioo32.exeC:\Windows\system32\Ggcioo32.exe36⤵
- Executes dropped EXE
PID:4460 -
C:\Windows\SysWOW64\Gedilf32.exeC:\Windows\system32\Gedilf32.exe37⤵
- Executes dropped EXE
PID:4480 -
C:\Windows\SysWOW64\Ghceha32.exeC:\Windows\system32\Ghceha32.exe38⤵
- Executes dropped EXE
PID:4500 -
C:\Windows\SysWOW64\Gakjagin.exeC:\Windows\system32\Gakjagin.exe39⤵
- Executes dropped EXE
PID:4520 -
C:\Windows\SysWOW64\Goojkkhh.exeC:\Windows\system32\Goojkkhh.exe40⤵
- Executes dropped EXE
PID:4540 -
C:\Windows\SysWOW64\Geibgeod.exeC:\Windows\system32\Geibgeod.exe41⤵
- Executes dropped EXE
PID:4560 -
C:\Windows\SysWOW64\Iobpghgb.exeC:\Windows\system32\Iobpghgb.exe42⤵
- Executes dropped EXE
PID:4580 -
C:\Windows\SysWOW64\Iodmmh32.exeC:\Windows\system32\Iodmmh32.exe43⤵
- Executes dropped EXE
PID:4600 -
C:\Windows\SysWOW64\Ibciic32.exeC:\Windows\system32\Ibciic32.exe44⤵
- Executes dropped EXE
PID:4620 -
C:\Windows\SysWOW64\Igpaaj32.exeC:\Windows\system32\Igpaaj32.exe45⤵
- Executes dropped EXE
PID:4640 -
C:\Windows\SysWOW64\Ifqaobkj.exeC:\Windows\system32\Ifqaobkj.exe46⤵
- Executes dropped EXE
PID:4660 -
C:\Windows\SysWOW64\Jnlfcd32.exeC:\Windows\system32\Jnlfcd32.exe47⤵
- Executes dropped EXE
PID:4680 -
C:\Windows\SysWOW64\Jiakqm32.exeC:\Windows\system32\Jiakqm32.exe48⤵
- Executes dropped EXE
PID:4700 -
C:\Windows\SysWOW64\Jnncid32.exeC:\Windows\system32\Jnncid32.exe49⤵
- Executes dropped EXE
PID:4720 -
C:\Windows\SysWOW64\Jgfgbimc.exeC:\Windows\system32\Jgfgbimc.exe50⤵
- Executes dropped EXE
PID:4740 -
C:\Windows\SysWOW64\Jonpcgme.exeC:\Windows\system32\Jonpcgme.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4760 -
C:\Windows\SysWOW64\Jfhhpaeb.exeC:\Windows\system32\Jfhhpaeb.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4780 -
C:\Windows\SysWOW64\Jkdphhci.exeC:\Windows\system32\Jkdphhci.exe53⤵
- Executes dropped EXE
PID:4800 -
C:\Windows\SysWOW64\Jbnhdb32.exeC:\Windows\system32\Jbnhdb32.exe54⤵
- Executes dropped EXE
PID:4820 -
C:\Windows\SysWOW64\Jihqalbc.exeC:\Windows\system32\Jihqalbc.exe55⤵
- Executes dropped EXE
PID:4840 -
C:\Windows\SysWOW64\Jflakp32.exeC:\Windows\system32\Jflakp32.exe56⤵
- Executes dropped EXE
PID:4860 -
C:\Windows\SysWOW64\Jikmgl32.exeC:\Windows\system32\Jikmgl32.exe57⤵
- Executes dropped EXE
PID:4880 -
C:\Windows\SysWOW64\Kpeecfgm.exeC:\Windows\system32\Kpeecfgm.exe58⤵
- Executes dropped EXE
PID:4900 -
C:\Windows\SysWOW64\Kfonpp32.exeC:\Windows\system32\Kfonpp32.exe59⤵
- Executes dropped EXE
PID:4920 -
C:\Windows\SysWOW64\Kimjlk32.exeC:\Windows\system32\Kimjlk32.exe60⤵
- Executes dropped EXE
PID:4940 -
C:\Windows\SysWOW64\Kpgbieej.exeC:\Windows\system32\Kpgbieej.exe61⤵
- Executes dropped EXE
PID:4960 -
C:\Windows\SysWOW64\Kfakfpmg.exeC:\Windows\system32\Kfakfpmg.exe62⤵
- Executes dropped EXE
- Modifies registry class
PID:4980 -
C:\Windows\SysWOW64\Kgbgnh32.exeC:\Windows\system32\Kgbgnh32.exe63⤵
- Executes dropped EXE
PID:5000 -
C:\Windows\SysWOW64\Knlojbjb.exeC:\Windows\system32\Knlojbjb.exe64⤵
- Executes dropped EXE
PID:5020 -
C:\Windows\SysWOW64\Kibcgkjh.exeC:\Windows\system32\Kibcgkjh.exe65⤵
- Executes dropped EXE
PID:5052 -
C:\Windows\SysWOW64\Klppdfil.exeC:\Windows\system32\Klppdfil.exe66⤵PID:5072
-
C:\Windows\SysWOW64\Kffdaohb.exeC:\Windows\system32\Kffdaohb.exe67⤵PID:5088
-
C:\Windows\SysWOW64\Kggqigop.exeC:\Windows\system32\Kggqigop.exe68⤵PID:5104
-
C:\Windows\SysWOW64\Kpnhjdob.exeC:\Windows\system32\Kpnhjdob.exe69⤵
- Drops file in System32 directory
PID:4080 -
C:\Windows\SysWOW64\Kfhqfo32.exeC:\Windows\system32\Kfhqfo32.exe70⤵
- Drops file in System32 directory
PID:4128 -
C:\Windows\SysWOW64\Lhimngln.exeC:\Windows\system32\Lhimngln.exe71⤵PID:4092
-
C:\Windows\SysWOW64\Lpqeodmp.exeC:\Windows\system32\Lpqeodmp.exe72⤵PID:396
-
C:\Windows\SysWOW64\Lboalplc.exeC:\Windows\system32\Lboalplc.exe73⤵PID:2552
-
C:\Windows\SysWOW64\Liijhjcp.exeC:\Windows\system32\Liijhjcp.exe74⤵PID:4100
-
C:\Windows\SysWOW64\Llgfdecd.exeC:\Windows\system32\Llgfdecd.exe75⤵PID:4264
-
C:\Windows\SysWOW64\Lbanao32.exeC:\Windows\system32\Lbanao32.exe76⤵
- Drops file in System32 directory
PID:4228 -
C:\Windows\SysWOW64\Likfnian.exeC:\Windows\system32\Likfnian.exe77⤵PID:4136
-
C:\Windows\SysWOW64\Lnhofppe.exeC:\Windows\system32\Lnhofppe.exe78⤵PID:4188
-
C:\Windows\SysWOW64\Lfoggnqg.exeC:\Windows\system32\Lfoggnqg.exe79⤵PID:4272
-
C:\Windows\SysWOW64\Lllopd32.exeC:\Windows\system32\Lllopd32.exe80⤵PID:4356
-
C:\Windows\SysWOW64\Lfacmm32.exeC:\Windows\system32\Lfacmm32.exe81⤵PID:2496
-
C:\Windows\SysWOW64\Lippii32.exeC:\Windows\system32\Lippii32.exe82⤵
- Modifies registry class
PID:4392 -
C:\Windows\SysWOW64\Lpjhecee.exeC:\Windows\system32\Lpjhecee.exe83⤵PID:4396
-
C:\Windows\SysWOW64\Lbhdandi.exeC:\Windows\system32\Lbhdandi.exe84⤵PID:4568
-
C:\Windows\SysWOW64\Lefqnjcm.exeC:\Windows\system32\Lefqnjcm.exe85⤵PID:4648
-
C:\Windows\SysWOW64\Mplekb32.exeC:\Windows\system32\Mplekb32.exe86⤵PID:4728
-
C:\Windows\SysWOW64\Mffmhmjo.exeC:\Windows\system32\Mffmhmjo.exe87⤵PID:4808
-
C:\Windows\SysWOW64\Mididhic.exeC:\Windows\system32\Mididhic.exe88⤵PID:4888
-
C:\Windows\SysWOW64\Mpoaqb32.exeC:\Windows\system32\Mpoaqb32.exe89⤵PID:4968
-
C:\Windows\SysWOW64\Mfhjmlhm.exeC:\Windows\system32\Mfhjmlhm.exe90⤵
- Modifies registry class
PID:1228 -
C:\Windows\SysWOW64\Mhjfed32.exeC:\Windows\system32\Mhjfed32.exe91⤵PID:3976
-
C:\Windows\SysWOW64\Mpanfb32.exeC:\Windows\system32\Mpanfb32.exe92⤵PID:5144
-
C:\Windows\SysWOW64\Mbojbmna.exeC:\Windows\system32\Mbojbmna.exe93⤵PID:5184
-
C:\Windows\SysWOW64\Mepcdhkb.exeC:\Windows\system32\Mepcdhkb.exe94⤵PID:5200
-
C:\Windows\SysWOW64\Mhnppdje.exeC:\Windows\system32\Mhnppdje.exe95⤵PID:5216
-
C:\Windows\SysWOW64\Mbddnm32.exeC:\Windows\system32\Mbddnm32.exe96⤵PID:5236
-
C:\Windows\SysWOW64\Nhqlfc32.exeC:\Windows\system32\Nhqlfc32.exe97⤵PID:5252
-
C:\Windows\SysWOW64\Nokdbnpp.exeC:\Windows\system32\Nokdbnpp.exe98⤵PID:5272
-
C:\Windows\SysWOW64\Nfbmckpb.exeC:\Windows\system32\Nfbmckpb.exe99⤵PID:5288
-
C:\Windows\SysWOW64\Nhcikc32.exeC:\Windows\system32\Nhcikc32.exe100⤵PID:5304
-
C:\Windows\SysWOW64\Nbimil32.exeC:\Windows\system32\Nbimil32.exe101⤵PID:5320
-
C:\Windows\SysWOW64\Nhefacdn.exeC:\Windows\system32\Nhefacdn.exe102⤵PID:5336
-
C:\Windows\SysWOW64\Npmnbpep.exeC:\Windows\system32\Npmnbpep.exe103⤵PID:5352
-
C:\Windows\SysWOW64\Nfffoj32.exeC:\Windows\system32\Nfffoj32.exe104⤵
- Modifies registry class
PID:5368 -
C:\Windows\SysWOW64\Nhhbfbbk.exeC:\Windows\system32\Nhhbfbbk.exe105⤵
- Modifies registry class
PID:5384 -
C:\Windows\SysWOW64\Noakcm32.exeC:\Windows\system32\Noakcm32.exe106⤵PID:5400
-
C:\Windows\SysWOW64\Nigoqein.exeC:\Windows\system32\Nigoqein.exe107⤵PID:5416
-
C:\Windows\SysWOW64\Npagmp32.exeC:\Windows\system32\Npagmp32.exe108⤵PID:5432
-
C:\Windows\SysWOW64\Ngkojjhg.exeC:\Windows\system32\Ngkojjhg.exe109⤵PID:5448
-
C:\Windows\SysWOW64\Ohllab32.exeC:\Windows\system32\Ohllab32.exe110⤵PID:5464
-
C:\Windows\SysWOW64\Ocbpok32.exeC:\Windows\system32\Ocbpok32.exe111⤵PID:5480
-
C:\Windows\SysWOW64\Oeplkf32.exeC:\Windows\system32\Oeplkf32.exe112⤵PID:5496
-
C:\Windows\SysWOW64\Opfqhome.exeC:\Windows\system32\Opfqhome.exe113⤵PID:5512
-
C:\Windows\SysWOW64\Ogpiei32.exeC:\Windows\system32\Ogpiei32.exe114⤵PID:5528
-
C:\Windows\SysWOW64\Ohaemajp.exeC:\Windows\system32\Ohaemajp.exe115⤵PID:5544
-
C:\Windows\SysWOW64\Ookmik32.exeC:\Windows\system32\Ookmik32.exe116⤵PID:5560
-
C:\Windows\SysWOW64\Oeeffeij.exeC:\Windows\system32\Oeeffeij.exe117⤵PID:5576
-
C:\Windows\SysWOW64\Oloncppg.exeC:\Windows\system32\Oloncppg.exe118⤵PID:5592
-
C:\Windows\SysWOW64\Ogdbphpm.exeC:\Windows\system32\Ogdbphpm.exe119⤵PID:5612
-
C:\Windows\SysWOW64\Olakhond.exeC:\Windows\system32\Olakhond.exe120⤵PID:5628
-
C:\Windows\SysWOW64\Oopgdkmh.exeC:\Windows\system32\Oopgdkmh.exe121⤵PID:5644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-