Analysis
-
max time kernel
203s -
max time network
211s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 23:08
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
c2ce329b161eb995269722abc7c736bac520334350298331bd87518f7df1fa75.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
c2ce329b161eb995269722abc7c736bac520334350298331bd87518f7df1fa75.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
c2ce329b161eb995269722abc7c736bac520334350298331bd87518f7df1fa75.exe
-
Size
464KB
-
MD5
be79788aea3c32b00294a9073fec0aab
-
SHA1
a4210ec206f631c9fab9a8d7f5226b2210ea5e3a
-
SHA256
c2ce329b161eb995269722abc7c736bac520334350298331bd87518f7df1fa75
-
SHA512
fe8ae938923be41db447379488a72471319a3818381a5294d5aeb587057cc8ac82b0df3abfa996d98e0e9c09d71f6c76f31b4ab3df805b0556cd20a36bad8da8
-
SSDEEP
6144:5rTo6EVpSdVEOIIIPCn4EOIuIPJEOOcHTETKEOIIIPC:9s6OoEVI2C4EVu2JEVcBEVI2C
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcdmifip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Iciflfcd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lifqbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pcijoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lapeci32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dqgjoenq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gcmpgpkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ohggah32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfabfbnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kccbdf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mpdgbkab.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ceehmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hjieii32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Imdgjlgb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pnonla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mpjleadh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Blbodh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gnoacp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ocpghj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pmdkmnkd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcndlf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mhqngm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Egpnidgk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hegmec32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jklihbol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Laqlclga.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mipchg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ognpoheh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohggah32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aiplff32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjqjbn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogifci32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Laqlclga.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Libggiik.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olfolp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pkpmnh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iojbid32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmmjpjpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kikafjoc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Blqlgdhi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jmmjpjpg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kbceoped.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Libggiik.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhqngm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ligglo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Oqdgan32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Phkaqqoi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ippgqg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mchhamcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pfcmpdjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aiplff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cjpllgme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jcbibeki.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kemhpl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkqahk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Noglik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ibncmchl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nphhfp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gcimfg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Belemd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Glqkefff.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gckcap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hllkqdli.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kdcicipb.exe -
Detects executables built or packed with MPress PE compressor 64 IoCs
resource yara_rule behavioral2/files/0x000700000002323d-6.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002323f-14.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023241-22.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x000b00000002322a-29.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x000300000001e809-38.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x000900000002313f-46.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x000300000001e806-55.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/1868-57-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x000b000000023143-63.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0008000000023243-71.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023245-82.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/3984-89-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023247-90.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0009000000023142-99.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002324b-106.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/228-107-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x000a00000002313d-114.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002324e-123.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023255-131.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023255-133.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0008000000023250-139.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0008000000023250-141.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023259-148.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0008000000023253-156.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002325d-173.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023260-180.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002325b-164.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/3528-186-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/1876-188-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/3848-191-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023262-190.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023264-220.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023266-229.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023269-244.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002326d-255.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023271-271.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x000700000002326f-264.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023273-281.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023275-289.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023277-298.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/4768-303-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/1336-304-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/5052-305-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/220-306-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/1476-311-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/1184-313-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/1140-349-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/1656-357-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2116-364-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/1784-380-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/228-382-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/4848-384-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x0009000000023281-393.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/1036-403-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2536-405-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/4832-411-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/848-413-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/3488-415-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/4888-417-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/1876-419-0x0000000000400000-0x000000000049D000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x00070000000232c4-591.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x00070000000232e5-692.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023348-1018.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x0007000000023378-1535.dat INDICATOR_EXE_Packed_MPress -
Executes dropped EXE 64 IoCs
pid Process 2568 Gcimfg32.exe 3944 Gnoacp32.exe 1476 Gjebiq32.exe 4956 Gcngafol.exe 3260 Kallod32.exe 4044 Oafacn32.exe 1868 Belemd32.exe 3416 Ginenk32.exe 3120 Ggdbmoho.exe 3984 Glqkefff.exe 1784 Gckcap32.exe 228 Gcmpgpkp.exe 4848 Gjghdj32.exe 2536 Hjieii32.exe 2132 Hllkqdli.exe 4436 Nkdlkope.exe 4832 Niihlkdm.exe 848 Opfnne32.exe 3488 Ogbbqo32.exe 4888 Pgkegn32.exe 1876 Pjjaci32.exe 3528 Phkaqqoi.exe 3848 Pnhjig32.exe 2276 Qdflaa32.exe 3988 Agkgceeh.exe 220 Dqgjoenq.exe 4768 Ihkpgg32.exe 1336 Jklihbol.exe 5052 Jeanfkob.exe 3332 Jknfnbmi.exe 3544 Jdgjgh32.exe 4860 Jolodqcp.exe 1184 Jkcpia32.exe 3964 Mpdgbkab.exe 920 Blqlgdhi.exe 1140 Boohcpgm.exe 4104 Bnphag32.exe 1656 Bekmei32.exe 2116 Benjkijd.exe 1036 Cjpllgme.exe 3928 Nildajdg.exe 1720 Alioloje.exe 1856 Dhjknljl.exe 4884 Jjoeoedo.exe 3660 Jmnakqcc.exe 4560 Jplmglbf.exe 3416 Jbkjcgaj.exe 1068 Jkaadebl.exe 1468 Jmpnppap.exe 3076 Jdjfmjhm.exe 2916 Kkdnjd32.exe 1636 Kmbkfp32.exe 1196 Kdlcbjfj.exe 8 Kkfkod32.exe 3056 Kapclned.exe 4184 Kgmlde32.exe 4200 Kmgdaokh.exe 3528 Kcdmifip.exe 4652 Kinefp32.exe 3280 Kdcicipb.exe 1476 Kkmapc32.exe 1780 Kagimmol.exe 4068 Lgdbedmc.exe 4600 Libnapmg.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Alpboida.exe Pkpmnh32.exe File opened for modification C:\Windows\SysWOW64\Mhqngm32.exe Moofhiid.exe File created C:\Windows\SysWOW64\Ignaamgc.dll Lfpkapgb.exe File created C:\Windows\SysWOW64\Conpjg32.dll Ggdbmoho.exe File created C:\Windows\SysWOW64\Cjpllgme.exe Benjkijd.exe File created C:\Windows\SysWOW64\Eiijfg32.dll Lcmopeae.exe File created C:\Windows\SysWOW64\Jcdian32.dll Lbhojo32.exe File created C:\Windows\SysWOW64\Coddlo32.dll Odaphl32.exe File created C:\Windows\SysWOW64\Anaofa32.exe Alpboida.exe File created C:\Windows\SysWOW64\Cjhjal32.dll Lkgdfb32.exe File created C:\Windows\SysWOW64\Hcblakmh.dll Ilbnkiba.exe File created C:\Windows\SysWOW64\Didjlnjc.dll Ippgqg32.exe File opened for modification C:\Windows\SysWOW64\Kagimmol.exe Kkmapc32.exe File created C:\Windows\SysWOW64\Ilbnkiba.exe Njljnl32.exe File created C:\Windows\SysWOW64\Kbebdpca.exe Klljhe32.exe File created C:\Windows\SysWOW64\Llngmeja.exe Kedoqkbe.exe File created C:\Windows\SysWOW64\Lemagjjj.exe Lpqioclc.exe File created C:\Windows\SysWOW64\Pnhjig32.exe Phkaqqoi.exe File created C:\Windows\SysWOW64\Dqgjoenq.exe Agkgceeh.exe File opened for modification C:\Windows\SysWOW64\Kcdmifip.exe Kmgdaokh.exe File opened for modification C:\Windows\SysWOW64\Pmdkmnkd.exe Pjeoablq.exe File created C:\Windows\SysWOW64\Noopof32.exe Mhqngm32.exe File opened for modification C:\Windows\SysWOW64\Hdbmpnhf.exe Cifdcm32.exe File created C:\Windows\SysWOW64\Midmcgif.exe Mgfqgkib.exe File created C:\Windows\SysWOW64\Mbbibomd.dll Qiebea32.exe File created C:\Windows\SysWOW64\Ceehmh32.exe Nhppbq32.exe File opened for modification C:\Windows\SysWOW64\Gckcap32.exe Glqkefff.exe File created C:\Windows\SysWOW64\Oodnao32.dll Jcnpgf32.exe File opened for modification C:\Windows\SysWOW64\Lbhojo32.exe Llngmeja.exe File created C:\Windows\SysWOW64\Cehlkk32.dll Ldhbnhlm.exe File created C:\Windows\SysWOW64\Hpgico32.dll Kemhpl32.exe File opened for modification C:\Windows\SysWOW64\Glqkefff.exe Ggdbmoho.exe File opened for modification C:\Windows\SysWOW64\Mnjjmmkc.exe Mkkmaalo.exe File opened for modification C:\Windows\SysWOW64\Pjaefc32.exe Pcgmiiii.exe File created C:\Windows\SysWOW64\Lpocciba.exe Lgfojd32.exe File created C:\Windows\SysWOW64\Bhfnch32.dll Mdaedgdb.exe File created C:\Windows\SysWOW64\Cnlpjn32.dll Libggiik.exe File created C:\Windows\SysWOW64\Pjaefc32.exe Pcgmiiii.exe File created C:\Windows\SysWOW64\Cihhpm32.dll Aehghn32.exe File created C:\Windows\SysWOW64\Fjmaii32.dll Gcmpgpkp.exe File created C:\Windows\SysWOW64\Nkdlkope.exe Hllkqdli.exe File created C:\Windows\SysWOW64\Agkgceeh.exe Qdflaa32.exe File opened for modification C:\Windows\SysWOW64\Jmpnppap.exe Jkaadebl.exe File created C:\Windows\SysWOW64\Egeabl32.dll Mgimmkgp.exe File opened for modification C:\Windows\SysWOW64\Iojbid32.exe Glbjpmdd.exe File created C:\Windows\SysWOW64\Lbhojo32.exe Llngmeja.exe File opened for modification C:\Windows\SysWOW64\Ognpoheh.exe Oqdgan32.exe File created C:\Windows\SysWOW64\Belemd32.exe Oafacn32.exe File created C:\Windows\SysWOW64\Gckcap32.exe Glqkefff.exe File created C:\Windows\SysWOW64\Gaaccjhd.dll Jpijgf32.exe File created C:\Windows\SysWOW64\Dbgpfl32.dll Ldmlih32.exe File opened for modification C:\Windows\SysWOW64\Mjqjbn32.exe Mcgbfcij.exe File created C:\Windows\SysWOW64\Aehghn32.exe Anaofa32.exe File created C:\Windows\SysWOW64\Icjdpd32.dll Ledeicdf.exe File opened for modification C:\Windows\SysWOW64\Gjghdj32.exe Gcmpgpkp.exe File created C:\Windows\SysWOW64\Ihkpgg32.exe Dqgjoenq.exe File opened for modification C:\Windows\SysWOW64\Jeanfkob.exe Jklihbol.exe File created C:\Windows\SysWOW64\Lhdjmlfb.dll Clbdjh32.exe File created C:\Windows\SysWOW64\Kinefp32.exe Kcdmifip.exe File created C:\Windows\SysWOW64\Olklneck.dll Jmpgfjmd.exe File opened for modification C:\Windows\SysWOW64\Pdifhkni.exe Pnonla32.exe File created C:\Windows\SysWOW64\Kdlcbjfj.exe Kmbkfp32.exe File opened for modification C:\Windows\SysWOW64\Lemagjjj.exe Lpqioclc.exe File created C:\Windows\SysWOW64\Coeapbio.dll Qppambnl.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpklpbip.dll" Lapeci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lpqioclc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbjdnm32.dll" Mchhamcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plfdocib.dll" Kibmqond.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Blbodh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Iacnpjmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ceehmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" c2ce329b161eb995269722abc7c736bac520334350298331bd87518f7df1fa75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Digcnb32.dll" Bnphag32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jdjfmjhm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ldhbnhlm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfhdch32.dll" Ohggah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnfgdc32.dll" Jolodqcp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jplmglbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogoibgad.dll" Kmgdaokh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ilbnkiba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Klimbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bijdddfp.dll" Ofckao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Blqlgdhi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fldailbk.dll" Bekmei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cjpllgme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjagmjpi.dll" Lgfojd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ligglo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbjcmpdk.dll" Oafacn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbnanfnm.dll" Hjieii32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Benjkijd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kapclned.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mpoepa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eciahbno.dll" Jbcmhb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djfjodkf.dll" Jmmjpjpg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dpfmem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pnhjig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kmgdaokh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lgfojd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igdmbh32.dll" Ljlagndl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mahbck32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emabga32.dll" Gcngafol.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pgkegn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghlpioak.dll" Lemagjjj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Npjelo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jlmenl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcapgfnb.dll" Leabincm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cfabfbnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ljlagndl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Alpboida.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bdpanj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdmdhheh.dll" Jlbecadc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeepld32.dll" Hegmec32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fndcdafh.dll" Pdifhkni.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Laachfbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Moofhiid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bkgleegf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gcmpgpkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bekmei32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cjpllgme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnjnnclb.dll" Kkdnjd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjkadiif.dll" Alpboida.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Njljnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmebfllk.dll" Jfllca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ohggah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkeaohdo.dll" Jlmenl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oqdgan32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pcijoh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pfgfkd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1036 wrote to memory of 2568 1036 c2ce329b161eb995269722abc7c736bac520334350298331bd87518f7df1fa75.exe 91 PID 1036 wrote to memory of 2568 1036 c2ce329b161eb995269722abc7c736bac520334350298331bd87518f7df1fa75.exe 91 PID 1036 wrote to memory of 2568 1036 c2ce329b161eb995269722abc7c736bac520334350298331bd87518f7df1fa75.exe 91 PID 2568 wrote to memory of 3944 2568 Gcimfg32.exe 92 PID 2568 wrote to memory of 3944 2568 Gcimfg32.exe 92 PID 2568 wrote to memory of 3944 2568 Gcimfg32.exe 92 PID 3944 wrote to memory of 1476 3944 Gnoacp32.exe 93 PID 3944 wrote to memory of 1476 3944 Gnoacp32.exe 93 PID 3944 wrote to memory of 1476 3944 Gnoacp32.exe 93 PID 1476 wrote to memory of 4956 1476 Gjebiq32.exe 94 PID 1476 wrote to memory of 4956 1476 Gjebiq32.exe 94 PID 1476 wrote to memory of 4956 1476 Gjebiq32.exe 94 PID 4956 wrote to memory of 3260 4956 Gcngafol.exe 95 PID 4956 wrote to memory of 3260 4956 Gcngafol.exe 95 PID 4956 wrote to memory of 3260 4956 Gcngafol.exe 95 PID 3260 wrote to memory of 4044 3260 Kallod32.exe 96 PID 3260 wrote to memory of 4044 3260 Kallod32.exe 96 PID 3260 wrote to memory of 4044 3260 Kallod32.exe 96 PID 4044 wrote to memory of 1868 4044 Oafacn32.exe 97 PID 4044 wrote to memory of 1868 4044 Oafacn32.exe 97 PID 4044 wrote to memory of 1868 4044 Oafacn32.exe 97 PID 1868 wrote to memory of 3416 1868 Belemd32.exe 98 PID 1868 wrote to memory of 3416 1868 Belemd32.exe 98 PID 1868 wrote to memory of 3416 1868 Belemd32.exe 98 PID 3416 wrote to memory of 3120 3416 Ginenk32.exe 99 PID 3416 wrote to memory of 3120 3416 Ginenk32.exe 99 PID 3416 wrote to memory of 3120 3416 Ginenk32.exe 99 PID 3120 wrote to memory of 3984 3120 Ggdbmoho.exe 100 PID 3120 wrote to memory of 3984 3120 Ggdbmoho.exe 100 PID 3120 wrote to memory of 3984 3120 Ggdbmoho.exe 100 PID 3984 wrote to memory of 1784 3984 Glqkefff.exe 101 PID 3984 wrote to memory of 1784 3984 Glqkefff.exe 101 PID 3984 wrote to memory of 1784 3984 Glqkefff.exe 101 PID 1784 wrote to memory of 228 1784 Gckcap32.exe 102 PID 1784 wrote to memory of 228 1784 Gckcap32.exe 102 PID 1784 wrote to memory of 228 1784 Gckcap32.exe 102 PID 228 wrote to memory of 4848 228 Gcmpgpkp.exe 103 PID 228 wrote to memory of 4848 228 Gcmpgpkp.exe 103 PID 228 wrote to memory of 4848 228 Gcmpgpkp.exe 103 PID 4848 wrote to memory of 2536 4848 Gjghdj32.exe 104 PID 4848 wrote to memory of 2536 4848 Gjghdj32.exe 104 PID 4848 wrote to memory of 2536 4848 Gjghdj32.exe 104 PID 2536 wrote to memory of 2132 2536 Hjieii32.exe 105 PID 2536 wrote to memory of 2132 2536 Hjieii32.exe 105 PID 2536 wrote to memory of 2132 2536 Hjieii32.exe 105 PID 2132 wrote to memory of 4436 2132 Hllkqdli.exe 106 PID 2132 wrote to memory of 4436 2132 Hllkqdli.exe 106 PID 2132 wrote to memory of 4436 2132 Hllkqdli.exe 106 PID 4436 wrote to memory of 4832 4436 Nkdlkope.exe 107 PID 4436 wrote to memory of 4832 4436 Nkdlkope.exe 107 PID 4436 wrote to memory of 4832 4436 Nkdlkope.exe 107 PID 4832 wrote to memory of 848 4832 Niihlkdm.exe 108 PID 4832 wrote to memory of 848 4832 Niihlkdm.exe 108 PID 4832 wrote to memory of 848 4832 Niihlkdm.exe 108 PID 848 wrote to memory of 3488 848 Opfnne32.exe 109 PID 848 wrote to memory of 3488 848 Opfnne32.exe 109 PID 848 wrote to memory of 3488 848 Opfnne32.exe 109 PID 3488 wrote to memory of 4888 3488 Ogbbqo32.exe 110 PID 3488 wrote to memory of 4888 3488 Ogbbqo32.exe 110 PID 3488 wrote to memory of 4888 3488 Ogbbqo32.exe 110 PID 4888 wrote to memory of 1876 4888 Pgkegn32.exe 111 PID 4888 wrote to memory of 1876 4888 Pgkegn32.exe 111 PID 4888 wrote to memory of 1876 4888 Pgkegn32.exe 111 PID 1876 wrote to memory of 3528 1876 Pjjaci32.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2ce329b161eb995269722abc7c736bac520334350298331bd87518f7df1fa75.exe"C:\Users\Admin\AppData\Local\Temp\c2ce329b161eb995269722abc7c736bac520334350298331bd87518f7df1fa75.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\Gcimfg32.exeC:\Windows\system32\Gcimfg32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\Gnoacp32.exeC:\Windows\system32\Gnoacp32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\Gjebiq32.exeC:\Windows\system32\Gjebiq32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\Gcngafol.exeC:\Windows\system32\Gcngafol.exe5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\Kallod32.exeC:\Windows\system32\Kallod32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\Oafacn32.exeC:\Windows\system32\Oafacn32.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\Belemd32.exeC:\Windows\system32\Belemd32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\Ginenk32.exeC:\Windows\system32\Ginenk32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\Ggdbmoho.exeC:\Windows\system32\Ggdbmoho.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\Glqkefff.exeC:\Windows\system32\Glqkefff.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\Gckcap32.exeC:\Windows\system32\Gckcap32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\Gcmpgpkp.exeC:\Windows\system32\Gcmpgpkp.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\Gjghdj32.exeC:\Windows\system32\Gjghdj32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\Hjieii32.exeC:\Windows\system32\Hjieii32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\Hllkqdli.exeC:\Windows\system32\Hllkqdli.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\Nkdlkope.exeC:\Windows\system32\Nkdlkope.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\Niihlkdm.exeC:\Windows\system32\Niihlkdm.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\Opfnne32.exeC:\Windows\system32\Opfnne32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\Ogbbqo32.exeC:\Windows\system32\Ogbbqo32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\Pgkegn32.exeC:\Windows\system32\Pgkegn32.exe21⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\Pjjaci32.exeC:\Windows\system32\Pjjaci32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\Phkaqqoi.exeC:\Windows\system32\Phkaqqoi.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:3528 -
C:\Windows\SysWOW64\Pnhjig32.exeC:\Windows\system32\Pnhjig32.exe24⤵
- Executes dropped EXE
- Modifies registry class
PID:3848 -
C:\Windows\SysWOW64\Qdflaa32.exeC:\Windows\system32\Qdflaa32.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2276 -
C:\Windows\SysWOW64\Agkgceeh.exeC:\Windows\system32\Agkgceeh.exe26⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3988 -
C:\Windows\SysWOW64\Dqgjoenq.exeC:\Windows\system32\Dqgjoenq.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:220 -
C:\Windows\SysWOW64\Ihkpgg32.exeC:\Windows\system32\Ihkpgg32.exe28⤵
- Executes dropped EXE
PID:4768 -
C:\Windows\SysWOW64\Jklihbol.exeC:\Windows\system32\Jklihbol.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1336 -
C:\Windows\SysWOW64\Jeanfkob.exeC:\Windows\system32\Jeanfkob.exe30⤵
- Executes dropped EXE
PID:5052 -
C:\Windows\SysWOW64\Jknfnbmi.exeC:\Windows\system32\Jknfnbmi.exe31⤵
- Executes dropped EXE
PID:3332 -
C:\Windows\SysWOW64\Jdgjgh32.exeC:\Windows\system32\Jdgjgh32.exe32⤵
- Executes dropped EXE
PID:3544 -
C:\Windows\SysWOW64\Jolodqcp.exeC:\Windows\system32\Jolodqcp.exe33⤵
- Executes dropped EXE
- Modifies registry class
PID:4860 -
C:\Windows\SysWOW64\Jkcpia32.exeC:\Windows\system32\Jkcpia32.exe34⤵
- Executes dropped EXE
PID:1184 -
C:\Windows\SysWOW64\Mpdgbkab.exeC:\Windows\system32\Mpdgbkab.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3964 -
C:\Windows\SysWOW64\Blqlgdhi.exeC:\Windows\system32\Blqlgdhi.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:920 -
C:\Windows\SysWOW64\Boohcpgm.exeC:\Windows\system32\Boohcpgm.exe37⤵
- Executes dropped EXE
PID:1140 -
C:\Windows\SysWOW64\Bnphag32.exeC:\Windows\system32\Bnphag32.exe38⤵
- Executes dropped EXE
- Modifies registry class
PID:4104 -
C:\Windows\SysWOW64\Bekmei32.exeC:\Windows\system32\Bekmei32.exe39⤵
- Executes dropped EXE
- Modifies registry class
PID:1656 -
C:\Windows\SysWOW64\Benjkijd.exeC:\Windows\system32\Benjkijd.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2116 -
C:\Windows\SysWOW64\Cjpllgme.exeC:\Windows\system32\Cjpllgme.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1036 -
C:\Windows\SysWOW64\Nildajdg.exeC:\Windows\system32\Nildajdg.exe42⤵
- Executes dropped EXE
PID:3928 -
C:\Windows\SysWOW64\Alioloje.exeC:\Windows\system32\Alioloje.exe43⤵
- Executes dropped EXE
PID:1720 -
C:\Windows\SysWOW64\Dhjknljl.exeC:\Windows\system32\Dhjknljl.exe44⤵
- Executes dropped EXE
PID:1856 -
C:\Windows\SysWOW64\Jjoeoedo.exeC:\Windows\system32\Jjoeoedo.exe45⤵
- Executes dropped EXE
PID:4884 -
C:\Windows\SysWOW64\Jmnakqcc.exeC:\Windows\system32\Jmnakqcc.exe46⤵
- Executes dropped EXE
PID:3660 -
C:\Windows\SysWOW64\Jplmglbf.exeC:\Windows\system32\Jplmglbf.exe47⤵
- Executes dropped EXE
- Modifies registry class
PID:4560 -
C:\Windows\SysWOW64\Jbkjcgaj.exeC:\Windows\system32\Jbkjcgaj.exe48⤵
- Executes dropped EXE
PID:3416 -
C:\Windows\SysWOW64\Jkaadebl.exeC:\Windows\system32\Jkaadebl.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1068 -
C:\Windows\SysWOW64\Jmpnppap.exeC:\Windows\system32\Jmpnppap.exe50⤵
- Executes dropped EXE
PID:1468 -
C:\Windows\SysWOW64\Jdjfmjhm.exeC:\Windows\system32\Jdjfmjhm.exe51⤵
- Executes dropped EXE
- Modifies registry class
PID:3076 -
C:\Windows\SysWOW64\Kkdnjd32.exeC:\Windows\system32\Kkdnjd32.exe52⤵
- Executes dropped EXE
- Modifies registry class
PID:2916 -
C:\Windows\SysWOW64\Kmbkfp32.exeC:\Windows\system32\Kmbkfp32.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1636 -
C:\Windows\SysWOW64\Kdlcbjfj.exeC:\Windows\system32\Kdlcbjfj.exe54⤵
- Executes dropped EXE
PID:1196 -
C:\Windows\SysWOW64\Kkfkod32.exeC:\Windows\system32\Kkfkod32.exe55⤵
- Executes dropped EXE
PID:8 -
C:\Windows\SysWOW64\Kapclned.exeC:\Windows\system32\Kapclned.exe56⤵
- Executes dropped EXE
- Modifies registry class
PID:3056 -
C:\Windows\SysWOW64\Kgmlde32.exeC:\Windows\system32\Kgmlde32.exe57⤵
- Executes dropped EXE
PID:4184 -
C:\Windows\SysWOW64\Kmgdaokh.exeC:\Windows\system32\Kmgdaokh.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4200 -
C:\Windows\SysWOW64\Kcdmifip.exeC:\Windows\system32\Kcdmifip.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:3528 -
C:\Windows\SysWOW64\Kinefp32.exeC:\Windows\system32\Kinefp32.exe60⤵
- Executes dropped EXE
PID:4652 -
C:\Windows\SysWOW64\Kdcicipb.exeC:\Windows\system32\Kdcicipb.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3280 -
C:\Windows\SysWOW64\Kkmapc32.exeC:\Windows\system32\Kkmapc32.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1476 -
C:\Windows\SysWOW64\Kagimmol.exeC:\Windows\system32\Kagimmol.exe63⤵
- Executes dropped EXE
PID:1780 -
C:\Windows\SysWOW64\Lgdbedmc.exeC:\Windows\system32\Lgdbedmc.exe64⤵
- Executes dropped EXE
PID:4068 -
C:\Windows\SysWOW64\Libnapmg.exeC:\Windows\system32\Libnapmg.exe65⤵
- Executes dropped EXE
PID:4600 -
C:\Windows\SysWOW64\Ldhbnhlm.exeC:\Windows\system32\Ldhbnhlm.exe66⤵
- Drops file in System32 directory
- Modifies registry class
PID:1624 -
C:\Windows\SysWOW64\Lgfojd32.exeC:\Windows\system32\Lgfojd32.exe67⤵
- Drops file in System32 directory
- Modifies registry class
PID:3312 -
C:\Windows\SysWOW64\Lpocciba.exeC:\Windows\system32\Lpocciba.exe68⤵PID:456
-
C:\Windows\SysWOW64\Lcmopeae.exeC:\Windows\system32\Lcmopeae.exe69⤵
- Drops file in System32 directory
PID:4968 -
C:\Windows\SysWOW64\Ligglo32.exeC:\Windows\system32\Ligglo32.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:4436 -
C:\Windows\SysWOW64\Ldmlih32.exeC:\Windows\system32\Ldmlih32.exe71⤵
- Drops file in System32 directory
PID:4248 -
C:\Windows\SysWOW64\Lkgdfb32.exeC:\Windows\system32\Lkgdfb32.exe72⤵
- Drops file in System32 directory
PID:3636 -
C:\Windows\SysWOW64\Laqlclga.exeC:\Windows\system32\Laqlclga.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4900 -
C:\Windows\SysWOW64\Lcbikd32.exeC:\Windows\system32\Lcbikd32.exe74⤵PID:1100
-
C:\Windows\SysWOW64\Ljlagndl.exeC:\Windows\system32\Ljlagndl.exe75⤵
- Modifies registry class
PID:3040 -
C:\Windows\SysWOW64\Mdaedgdb.exeC:\Windows\system32\Mdaedgdb.exe76⤵
- Drops file in System32 directory
PID:1128 -
C:\Windows\SysWOW64\Mkkmaalo.exeC:\Windows\system32\Mkkmaalo.exe77⤵
- Drops file in System32 directory
PID:508 -
C:\Windows\SysWOW64\Mnjjmmkc.exeC:\Windows\system32\Mnjjmmkc.exe78⤵PID:796
-
C:\Windows\SysWOW64\Mcgbfcij.exeC:\Windows\system32\Mcgbfcij.exe79⤵
- Drops file in System32 directory
PID:4996 -
C:\Windows\SysWOW64\Mjqjbn32.exeC:\Windows\system32\Mjqjbn32.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2692 -
C:\Windows\SysWOW64\Mahbck32.exeC:\Windows\system32\Mahbck32.exe81⤵
- Modifies registry class
PID:2788 -
C:\Windows\SysWOW64\Mciokcgg.exeC:\Windows\system32\Mciokcgg.exe82⤵PID:2704
-
C:\Windows\SysWOW64\Njljnl32.exeC:\Windows\system32\Njljnl32.exe83⤵
- Drops file in System32 directory
- Modifies registry class
PID:4556 -
C:\Windows\SysWOW64\Ilbnkiba.exeC:\Windows\system32\Ilbnkiba.exe84⤵
- Drops file in System32 directory
- Modifies registry class
PID:3580 -
C:\Windows\SysWOW64\Iciflfcd.exeC:\Windows\system32\Iciflfcd.exe85⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1280 -
C:\Windows\SysWOW64\Iifodmak.exeC:\Windows\system32\Iifodmak.exe86⤵PID:1328
-
C:\Windows\SysWOW64\Ippgqg32.exeC:\Windows\system32\Ippgqg32.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:4060 -
C:\Windows\SysWOW64\Ibncmchl.exeC:\Windows\system32\Ibncmchl.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2540 -
C:\Windows\SysWOW64\Imdgjlgb.exeC:\Windows\system32\Imdgjlgb.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4892 -
C:\Windows\SysWOW64\Jcnpgf32.exeC:\Windows\system32\Jcnpgf32.exe90⤵
- Drops file in System32 directory
PID:1788 -
C:\Windows\SysWOW64\Jfllca32.exeC:\Windows\system32\Jfllca32.exe91⤵
- Modifies registry class
PID:5160 -
C:\Windows\SysWOW64\Jlidkh32.exeC:\Windows\system32\Jlidkh32.exe92⤵PID:5200
-
C:\Windows\SysWOW64\Jbcmhb32.exeC:\Windows\system32\Jbcmhb32.exe93⤵
- Modifies registry class
PID:5248 -
C:\Windows\SysWOW64\Jimeelkc.exeC:\Windows\system32\Jimeelkc.exe94⤵PID:5296
-
C:\Windows\SysWOW64\Jcbibeki.exeC:\Windows\system32\Jcbibeki.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5356 -
C:\Windows\SysWOW64\Jpijgf32.exeC:\Windows\system32\Jpijgf32.exe96⤵
- Drops file in System32 directory
PID:5404 -
C:\Windows\SysWOW64\Jfcbcp32.exeC:\Windows\system32\Jfcbcp32.exe97⤵PID:5440
-
C:\Windows\SysWOW64\Jmmjpjpg.exeC:\Windows\system32\Jmmjpjpg.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5488 -
C:\Windows\SysWOW64\Jbjciano.exeC:\Windows\system32\Jbjciano.exe99⤵PID:5544
-
C:\Windows\SysWOW64\Jmpgfjmd.exeC:\Windows\system32\Jmpgfjmd.exe100⤵
- Drops file in System32 directory
PID:5584 -
C:\Windows\SysWOW64\Kblpnall.exeC:\Windows\system32\Kblpnall.exe101⤵PID:5628
-
C:\Windows\SysWOW64\Kemhpl32.exeC:\Windows\system32\Kemhpl32.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5688 -
C:\Windows\SysWOW64\Kikafjoc.exeC:\Windows\system32\Kikafjoc.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5748 -
C:\Windows\SysWOW64\Klimbf32.exeC:\Windows\system32\Klimbf32.exe104⤵
- Modifies registry class
PID:5796 -
C:\Windows\SysWOW64\Kbceoped.exeC:\Windows\system32\Kbceoped.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5844 -
C:\Windows\SysWOW64\Kimnlj32.exeC:\Windows\system32\Kimnlj32.exe106⤵PID:5888
-
C:\Windows\SysWOW64\Klljhe32.exeC:\Windows\system32\Klljhe32.exe107⤵
- Drops file in System32 directory
PID:5932 -
C:\Windows\SysWOW64\Kbebdpca.exeC:\Windows\system32\Kbebdpca.exe108⤵PID:5972
-
C:\Windows\SysWOW64\Kedoqkbe.exeC:\Windows\system32\Kedoqkbe.exe109⤵
- Drops file in System32 directory
PID:6016 -
C:\Windows\SysWOW64\Llngmeja.exeC:\Windows\system32\Llngmeja.exe110⤵
- Drops file in System32 directory
PID:6060 -
C:\Windows\SysWOW64\Lbhojo32.exeC:\Windows\system32\Lbhojo32.exe111⤵
- Drops file in System32 directory
PID:6108 -
C:\Windows\SysWOW64\Libggiik.exeC:\Windows\system32\Libggiik.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:4712 -
C:\Windows\SysWOW64\Ldgkdbia.exeC:\Windows\system32\Ldgkdbia.exe113⤵PID:5188
-
C:\Windows\SysWOW64\Leihlj32.exeC:\Windows\system32\Leihlj32.exe114⤵PID:5244
-
C:\Windows\SysWOW64\Lifqbi32.exeC:\Windows\system32\Lifqbi32.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5304 -
C:\Windows\SysWOW64\Lpqioclc.exeC:\Windows\system32\Lpqioclc.exe116⤵
- Drops file in System32 directory
- Modifies registry class
PID:5340 -
C:\Windows\SysWOW64\Lemagjjj.exeC:\Windows\system32\Lemagjjj.exe117⤵
- Modifies registry class
PID:5392 -
C:\Windows\SysWOW64\Mipchg32.exeC:\Windows\system32\Mipchg32.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5452 -
C:\Windows\SysWOW64\Mpjleadh.exeC:\Windows\system32\Mpjleadh.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4516 -
C:\Windows\SysWOW64\Mchhamcl.exeC:\Windows\system32\Mchhamcl.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5528 -
C:\Windows\SysWOW64\Mplhjabe.exeC:\Windows\system32\Mplhjabe.exe121⤵PID:5616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-