Analysis
-
max time kernel
108s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21-04-2024 04:49
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
f8e305ab42df6b1f4117ae51f2ebaa4f9c70976e4ea0ce8de7257642276f9438.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
f8e305ab42df6b1f4117ae51f2ebaa4f9c70976e4ea0ce8de7257642276f9438.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
f8e305ab42df6b1f4117ae51f2ebaa4f9c70976e4ea0ce8de7257642276f9438.exe
-
Size
439KB
-
MD5
cb6b999aaf1f292ab0e2bd50691b2e39
-
SHA1
5e839694db9fb4f24c9c3ef5242200d638feee04
-
SHA256
f8e305ab42df6b1f4117ae51f2ebaa4f9c70976e4ea0ce8de7257642276f9438
-
SHA512
54961a6fc5e5e3b3f9bbb81cdfcfa5db45168da6571c288be38102fcf3531ba8778dc77002b227041dbb19e9bb0d4dcd16b3087ddb669d91ac0bf7e137cf7c26
-
SSDEEP
12288:vWfWK1HPeKm2OPeKm22Vtp90NtmVtp90NtXONt:v1YpEkpEY
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ialhdh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pbpall32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jqpfccgo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icqmncof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kaaaak32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkfnlmkl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pekkhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pldcdhpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jefbomoe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odmgmmhf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhicjm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qipjokik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kknhjj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hcnnjoam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lkdgqbag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bejoqm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gdjpff32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpepmkjl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apfhajjf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idmafc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oigdmh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hfacai32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipldpo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hcfqoici.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkpoha32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dbdano32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bqokhi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nfgbec32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bagmpoco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Giqlbqcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kaqejcep.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdmfcn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmabnnhg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phfhfa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eljknl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fhalcm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hfmqapcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ganppk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfkhfmdm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cicqja32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amblpikl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gaadpqmp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnjaonij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bedpjdoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gfaikoad.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Npgalidl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gceaofmc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Daaiml32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Llbinnbq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phbhlcpi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icbbimih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cckmklac.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhlhcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dphipidf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gcdkdpih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kpjjhj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fgjpfqpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mhjpceko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nicalpak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gablgk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lppjnpem.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hcpcehko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mlkldmjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Imnjbhaa.exe -
Detects executables packed with ConfuserEx Mod 64 IoCs
resource yara_rule behavioral2/files/0x0008000000023288-9.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/1284-8-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x000800000002328c-15.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x000700000002328e-24.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x0007000000023290-32.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x0007000000023292-40.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x0007000000023294-47.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x0007000000023296-56.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x0007000000023298-64.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x000700000002329a-71.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/3168-72-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x000700000002329c-79.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x000700000002329e-88.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/4736-90-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232a0-96.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2724-106-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232a4-112.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/4024-114-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232a2-105.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232a6-121.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232a8-129.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/1232-130-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/3764-138-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232aa-137.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232ac-139.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232ae-152.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/4904-154-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232b0-160.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/4440-162-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232b2-169.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2392-170-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232b4-176.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/808-181-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232b6-185.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/1688-187-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232b8-194.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232ba-201.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2800-203-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232bc-209.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2320-210-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232be-218.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/1492-219-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232c0-226.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/3524-227-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232c2-233.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/5040-235-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232c4-241.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/3528-243-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232c7-251.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/4140-250-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232c9-257.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/960-259-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/4920-265-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/4720-271-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/4380-277-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/4568-283-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/5012-289-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/3548-295-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2336-301-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2008-311-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/380-313-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/5044-325-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral2/files/0x00070000000232e1-326.dat INDICATOR_EXE_Packed_ConfuserEx behavioral2/memory/2004-343-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx -
Executes dropped EXE 64 IoCs
pid Process 1284 Ecidpiad.exe 1636 Fncbha32.exe 748 Fcpkph32.exe 1092 Fneoma32.exe 2428 Gfgjbb32.exe 728 Gqmnpk32.exe 4948 Gqokekph.exe 3288 Gmfkjl32.exe 3168 Hnjaonij.exe 4748 Hcifmdeo.exe 4736 Ijfkpnji.exe 3872 Icqmncof.exe 2724 Ifcben32.exe 4024 Imnjbhaa.exe 3044 Jakchf32.exe 1232 Jfkhfmdm.exe 3764 Jfmekm32.exe 416 Jnfjbj32.exe 4904 Kfdklllb.exe 4440 Kmncif32.exe 2392 Kmbmdeoj.exe 808 Kaqejcep.exe 1688 Lmjcdd32.exe 4332 Ldfhgn32.exe 2800 Lokldg32.exe 2320 Loniiflo.exe 1492 Mopeofjl.exe 3524 Mdagbl32.exe 5040 Nhbmnj32.exe 3528 Nhffijdm.exe 4140 Nglcjfie.exe 960 Ogqmee32.exe 4920 Pfkpiled.exe 4720 Pfmlok32.exe 4380 Qhekaejj.exe 4568 Akhaipei.exe 5012 Agobna32.exe 3548 Aecbge32.exe 2336 Ankgpk32.exe 2008 Aokcjngj.exe 380 Bomppneg.exe 4892 Bihancje.exe 5044 Beobcdoi.exe 1948 Bbbblhnc.exe 620 Bbeobhlp.exe 2004 Cicqja32.exe 1840 Cnpibh32.exe 2804 Cnbfgh32.exe 1460 Deokja32.exe 4520 Dlicflic.exe 1704 Dfngcdhi.exe 2256 Decdeama.exe 4300 Dpihbjmg.exe 3160 Defajqko.exe 4364 Donecfao.exe 4084 Ebokodfc.exe 1672 Eflceb32.exe 3308 Eohhie32.exe 2148 Ehpmbj32.exe 4980 Ehbihj32.exe 4972 Fefjanml.exe 4184 Fekclnif.exe 4328 Flekihpc.exe 1560 Fgjpfqpi.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Dogfkpih.exe Ddbbngjb.exe File opened for modification C:\Windows\SysWOW64\Hddejjdo.exe Hmhphqoe.exe File created C:\Windows\SysWOW64\Pjdbmobi.dll Jhbfgflc.exe File created C:\Windows\SysWOW64\Fefcgh32.exe Ebejem32.exe File opened for modification C:\Windows\SysWOW64\Ecpomiok.exe Encgdbqd.exe File created C:\Windows\SysWOW64\Hmjeggme.dll Iophnl32.exe File created C:\Windows\SysWOW64\Eajehd32.exe Eddhipdd.exe File created C:\Windows\SysWOW64\Caccgepo.dll Dlicflic.exe File created C:\Windows\SysWOW64\Dkclkqdm.dll Mpqklh32.exe File created C:\Windows\SysWOW64\Jpcgoa32.dll Pcmeek32.exe File created C:\Windows\SysWOW64\Alanch32.dll Pfjgbapo.exe File created C:\Windows\SysWOW64\Qjlqklfj.dll Hkhdjdgq.exe File created C:\Windows\SysWOW64\Fchjfl32.dll Dpihbjmg.exe File opened for modification C:\Windows\SysWOW64\Hkaedk32.exe Hfemkdbm.exe File created C:\Windows\SysWOW64\Bjbgge32.dll Ghkebd32.exe File created C:\Windows\SysWOW64\Lfkich32.exe Lkfeeo32.exe File created C:\Windows\SysWOW64\Ljnqoldc.dll Pihmcflg.exe File created C:\Windows\SysWOW64\Qkjgomgb.exe Qcobjk32.exe File opened for modification C:\Windows\SysWOW64\Flekihpc.exe Fekclnif.exe File created C:\Windows\SysWOW64\Knagdd32.dll Npqmipjq.exe File opened for modification C:\Windows\SysWOW64\Nkagndmc.exe Nnmfdpni.exe File created C:\Windows\SysWOW64\Ghkebd32.exe Gaqmej32.exe File created C:\Windows\SysWOW64\Mkfnlmkl.exe Mbnjcg32.exe File opened for modification C:\Windows\SysWOW64\Jmqekg32.exe Jdhpba32.exe File opened for modification C:\Windows\SysWOW64\Peobeh32.exe Oifekg32.exe File created C:\Windows\SysWOW64\Gcmpgpkp.exe Ghgljg32.exe File opened for modification C:\Windows\SysWOW64\Dfphmp32.exe Dhlhcl32.exe File created C:\Windows\SysWOW64\Agbgom32.dll Mdckpqod.exe File created C:\Windows\SysWOW64\Bepdmhnd.dll Lokldg32.exe File created C:\Windows\SysWOW64\Ponndj32.dll Bbeobhlp.exe File created C:\Windows\SysWOW64\Cgbppknb.exe Cpfkna32.exe File created C:\Windows\SysWOW64\Jknocljn.exe Jddggb32.exe File created C:\Windows\SysWOW64\Cchikf32.exe Cipebqij.exe File opened for modification C:\Windows\SysWOW64\Ikmepj32.exe Heapmp32.exe File created C:\Windows\SysWOW64\Qofjjb32.exe Pgihppgo.exe File created C:\Windows\SysWOW64\Kelpjn32.dll Gqmnpk32.exe File created C:\Windows\SysWOW64\Foijeajf.dll Ldlmieaa.exe File created C:\Windows\SysWOW64\Gnbhjhfh.dll Niqnli32.exe File created C:\Windows\SysWOW64\Jbmfig32.exe Jidbpa32.exe File opened for modification C:\Windows\SysWOW64\Jjemle32.exe Icdoolge.exe File opened for modification C:\Windows\SysWOW64\Iiffoc32.exe Ibmmbj32.exe File created C:\Windows\SysWOW64\Kfedpccg.dll Eejjdb32.exe File created C:\Windows\SysWOW64\Ipehob32.dll Gkglcfec.exe File created C:\Windows\SysWOW64\Gmfkjl32.exe Gqokekph.exe File opened for modification C:\Windows\SysWOW64\Fepmgm32.exe Fofdkcmd.exe File created C:\Windows\SysWOW64\Bfdcaj32.dll Olhlaoea.exe File created C:\Windows\SysWOW64\Deenhilj.dll Elaobdmm.exe File opened for modification C:\Windows\SysWOW64\Agkgceeh.exe Pcdlghgl.exe File opened for modification C:\Windows\SysWOW64\Mnpami32.exe Mfdlif32.exe File created C:\Windows\SysWOW64\Ndagao32.exe Nngoddkg.exe File created C:\Windows\SysWOW64\Ogqmee32.exe Nglcjfie.exe File opened for modification C:\Windows\SysWOW64\Icdoolge.exe Imjgbb32.exe File opened for modification C:\Windows\SysWOW64\Benjkijd.exe Bcmqin32.exe File opened for modification C:\Windows\SysWOW64\Giqlbqcc.exe Gbgdef32.exe File created C:\Windows\SysWOW64\Qhobpp32.dll Kbaiip32.exe File created C:\Windows\SysWOW64\Pcmeek32.exe Phgagb32.exe File created C:\Windows\SysWOW64\Cpdcmkpj.dll Nbjpjl32.exe File opened for modification C:\Windows\SysWOW64\Jpijgf32.exe Jlkaahjg.exe File opened for modification C:\Windows\SysWOW64\Ldjodh32.exe Liekgo32.exe File created C:\Windows\SysWOW64\Aekecn32.dll Oqmhlego.exe File created C:\Windows\SysWOW64\Blkdgheg.exe Bngdndfn.exe File opened for modification C:\Windows\SysWOW64\Lifjgb32.exe Llbinnbq.exe File created C:\Windows\SysWOW64\Egfghn32.dll Jpdbjleo.exe File created C:\Windows\SysWOW64\Gajibq32.exe Fdmfcn32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 5724 2088 WerFault.exe 1003 -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eflceb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Neljcnfo.dll" Ceihffad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Opjponbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjaadjcc.dll" Bcdlgnkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mbgjlq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poknopjk.dll" Ioppho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbpjik32.dll" Abmhbplf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hfemkdbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qofjjb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ioppho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqkiog32.dll" Hhhdpd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jknocljn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lmnjan32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ckladcoa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Acilkp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aclhkdmp.dll" Neoink32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgfdeo32.dll" Niblafgi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jphcmp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID f8e305ab42df6b1f4117ae51f2ebaa4f9c70976e4ea0ce8de7257642276f9438.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fboioldm.dll" Fpbpmhjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipbaobme.dll" Ojjfpjjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hakdcjep.dll" Pchljlpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pldljbmn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qajhigcj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghohac.dll" Hikfbeod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gfpcpefb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gkcbhgii.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mglhgg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bhppap32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Njploeoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nhbmnj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Opefdo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jjoeoedo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dadbgmaf.dll" Dgieajgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdelid32.dll" Nnimia32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ahgjnpna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjneikmp.dll" Pcaoahio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibhfgm32.dll" Bkepeaaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mbchkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aqilaplo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmnklgqn.dll" Emdaee32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oigdmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pphjbgfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hnjaonij.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mbnjcg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fgqehgco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mgidgakk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hhhdpd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hmlicp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lfkich32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkkbp32.dll" Dplebmbl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hcipcnac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jqpiiffa.dll" Ghfnej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcgpbknd.dll" Picchg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nkncno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okjnpija.dll" Ekngqqol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Annbli32.dll" Lpnlicne.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gaqmej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nhfoocaa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Niblafgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bkbcpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ldlmieaa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kigoeagd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kbaiip32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 828 wrote to memory of 1284 828 f8e305ab42df6b1f4117ae51f2ebaa4f9c70976e4ea0ce8de7257642276f9438.exe 91 PID 828 wrote to memory of 1284 828 f8e305ab42df6b1f4117ae51f2ebaa4f9c70976e4ea0ce8de7257642276f9438.exe 91 PID 828 wrote to memory of 1284 828 f8e305ab42df6b1f4117ae51f2ebaa4f9c70976e4ea0ce8de7257642276f9438.exe 91 PID 1284 wrote to memory of 1636 1284 Ecidpiad.exe 92 PID 1284 wrote to memory of 1636 1284 Ecidpiad.exe 92 PID 1284 wrote to memory of 1636 1284 Ecidpiad.exe 92 PID 1636 wrote to memory of 748 1636 Fncbha32.exe 93 PID 1636 wrote to memory of 748 1636 Fncbha32.exe 93 PID 1636 wrote to memory of 748 1636 Fncbha32.exe 93 PID 748 wrote to memory of 1092 748 Fcpkph32.exe 94 PID 748 wrote to memory of 1092 748 Fcpkph32.exe 94 PID 748 wrote to memory of 1092 748 Fcpkph32.exe 94 PID 1092 wrote to memory of 2428 1092 Fneoma32.exe 95 PID 1092 wrote to memory of 2428 1092 Fneoma32.exe 95 PID 1092 wrote to memory of 2428 1092 Fneoma32.exe 95 PID 2428 wrote to memory of 728 2428 Gfgjbb32.exe 96 PID 2428 wrote to memory of 728 2428 Gfgjbb32.exe 96 PID 2428 wrote to memory of 728 2428 Gfgjbb32.exe 96 PID 728 wrote to memory of 4948 728 Gqmnpk32.exe 97 PID 728 wrote to memory of 4948 728 Gqmnpk32.exe 97 PID 728 wrote to memory of 4948 728 Gqmnpk32.exe 97 PID 4948 wrote to memory of 3288 4948 Gqokekph.exe 98 PID 4948 wrote to memory of 3288 4948 Gqokekph.exe 98 PID 4948 wrote to memory of 3288 4948 Gqokekph.exe 98 PID 3288 wrote to memory of 3168 3288 Gmfkjl32.exe 99 PID 3288 wrote to memory of 3168 3288 Gmfkjl32.exe 99 PID 3288 wrote to memory of 3168 3288 Gmfkjl32.exe 99 PID 3168 wrote to memory of 4748 3168 Hnjaonij.exe 100 PID 3168 wrote to memory of 4748 3168 Hnjaonij.exe 100 PID 3168 wrote to memory of 4748 3168 Hnjaonij.exe 100 PID 4748 wrote to memory of 4736 4748 Hcifmdeo.exe 101 PID 4748 wrote to memory of 4736 4748 Hcifmdeo.exe 101 PID 4748 wrote to memory of 4736 4748 Hcifmdeo.exe 101 PID 4736 wrote to memory of 3872 4736 Ijfkpnji.exe 102 PID 4736 wrote to memory of 3872 4736 Ijfkpnji.exe 102 PID 4736 wrote to memory of 3872 4736 Ijfkpnji.exe 102 PID 3872 wrote to memory of 2724 3872 Icqmncof.exe 103 PID 3872 wrote to memory of 2724 3872 Icqmncof.exe 103 PID 3872 wrote to memory of 2724 3872 Icqmncof.exe 103 PID 2724 wrote to memory of 4024 2724 Ifcben32.exe 104 PID 2724 wrote to memory of 4024 2724 Ifcben32.exe 104 PID 2724 wrote to memory of 4024 2724 Ifcben32.exe 104 PID 4024 wrote to memory of 3044 4024 Imnjbhaa.exe 105 PID 4024 wrote to memory of 3044 4024 Imnjbhaa.exe 105 PID 4024 wrote to memory of 3044 4024 Imnjbhaa.exe 105 PID 3044 wrote to memory of 1232 3044 Jakchf32.exe 106 PID 3044 wrote to memory of 1232 3044 Jakchf32.exe 106 PID 3044 wrote to memory of 1232 3044 Jakchf32.exe 106 PID 1232 wrote to memory of 3764 1232 Jfkhfmdm.exe 107 PID 1232 wrote to memory of 3764 1232 Jfkhfmdm.exe 107 PID 1232 wrote to memory of 3764 1232 Jfkhfmdm.exe 107 PID 3764 wrote to memory of 416 3764 Jfmekm32.exe 108 PID 3764 wrote to memory of 416 3764 Jfmekm32.exe 108 PID 3764 wrote to memory of 416 3764 Jfmekm32.exe 108 PID 416 wrote to memory of 4904 416 Jnfjbj32.exe 109 PID 416 wrote to memory of 4904 416 Jnfjbj32.exe 109 PID 416 wrote to memory of 4904 416 Jnfjbj32.exe 109 PID 4904 wrote to memory of 4440 4904 Kfdklllb.exe 110 PID 4904 wrote to memory of 4440 4904 Kfdklllb.exe 110 PID 4904 wrote to memory of 4440 4904 Kfdklllb.exe 110 PID 4440 wrote to memory of 2392 4440 Kmncif32.exe 111 PID 4440 wrote to memory of 2392 4440 Kmncif32.exe 111 PID 4440 wrote to memory of 2392 4440 Kmncif32.exe 111 PID 2392 wrote to memory of 808 2392 Kmbmdeoj.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8e305ab42df6b1f4117ae51f2ebaa4f9c70976e4ea0ce8de7257642276f9438.exe"C:\Users\Admin\AppData\Local\Temp\f8e305ab42df6b1f4117ae51f2ebaa4f9c70976e4ea0ce8de7257642276f9438.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\Ecidpiad.exeC:\Windows\system32\Ecidpiad.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\Fncbha32.exeC:\Windows\system32\Fncbha32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\Fcpkph32.exeC:\Windows\system32\Fcpkph32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\Fneoma32.exeC:\Windows\system32\Fneoma32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\Gfgjbb32.exeC:\Windows\system32\Gfgjbb32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\Gqmnpk32.exeC:\Windows\system32\Gqmnpk32.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\SysWOW64\Gqokekph.exeC:\Windows\system32\Gqokekph.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\Gmfkjl32.exeC:\Windows\system32\Gmfkjl32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\Hnjaonij.exeC:\Windows\system32\Hnjaonij.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\Hcifmdeo.exeC:\Windows\system32\Hcifmdeo.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\Ijfkpnji.exeC:\Windows\system32\Ijfkpnji.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\Icqmncof.exeC:\Windows\system32\Icqmncof.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\Ifcben32.exeC:\Windows\system32\Ifcben32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\Imnjbhaa.exeC:\Windows\system32\Imnjbhaa.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\Jakchf32.exeC:\Windows\system32\Jakchf32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\Jfkhfmdm.exeC:\Windows\system32\Jfkhfmdm.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\Jfmekm32.exeC:\Windows\system32\Jfmekm32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\Jnfjbj32.exeC:\Windows\system32\Jnfjbj32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\SysWOW64\Kfdklllb.exeC:\Windows\system32\Kfdklllb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\Kmncif32.exeC:\Windows\system32\Kmncif32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\Kmbmdeoj.exeC:\Windows\system32\Kmbmdeoj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\Kaqejcep.exeC:\Windows\system32\Kaqejcep.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:808 -
C:\Windows\SysWOW64\Lmjcdd32.exeC:\Windows\system32\Lmjcdd32.exe24⤵
- Executes dropped EXE
PID:1688 -
C:\Windows\SysWOW64\Ldfhgn32.exeC:\Windows\system32\Ldfhgn32.exe25⤵
- Executes dropped EXE
PID:4332 -
C:\Windows\SysWOW64\Lokldg32.exeC:\Windows\system32\Lokldg32.exe26⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2800 -
C:\Windows\SysWOW64\Loniiflo.exeC:\Windows\system32\Loniiflo.exe27⤵
- Executes dropped EXE
PID:2320 -
C:\Windows\SysWOW64\Mopeofjl.exeC:\Windows\system32\Mopeofjl.exe28⤵
- Executes dropped EXE
PID:1492 -
C:\Windows\SysWOW64\Mdagbl32.exeC:\Windows\system32\Mdagbl32.exe29⤵
- Executes dropped EXE
PID:3524 -
C:\Windows\SysWOW64\Nhbmnj32.exeC:\Windows\system32\Nhbmnj32.exe30⤵
- Executes dropped EXE
- Modifies registry class
PID:5040 -
C:\Windows\SysWOW64\Nhffijdm.exeC:\Windows\system32\Nhffijdm.exe31⤵
- Executes dropped EXE
PID:3528 -
C:\Windows\SysWOW64\Nglcjfie.exeC:\Windows\system32\Nglcjfie.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4140 -
C:\Windows\SysWOW64\Ogqmee32.exeC:\Windows\system32\Ogqmee32.exe33⤵
- Executes dropped EXE
PID:960 -
C:\Windows\SysWOW64\Pfkpiled.exeC:\Windows\system32\Pfkpiled.exe34⤵
- Executes dropped EXE
PID:4920 -
C:\Windows\SysWOW64\Pfmlok32.exeC:\Windows\system32\Pfmlok32.exe35⤵
- Executes dropped EXE
PID:4720 -
C:\Windows\SysWOW64\Qhekaejj.exeC:\Windows\system32\Qhekaejj.exe36⤵
- Executes dropped EXE
PID:4380 -
C:\Windows\SysWOW64\Akhaipei.exeC:\Windows\system32\Akhaipei.exe37⤵
- Executes dropped EXE
PID:4568 -
C:\Windows\SysWOW64\Agobna32.exeC:\Windows\system32\Agobna32.exe38⤵
- Executes dropped EXE
PID:5012 -
C:\Windows\SysWOW64\Aecbge32.exeC:\Windows\system32\Aecbge32.exe39⤵
- Executes dropped EXE
PID:3548 -
C:\Windows\SysWOW64\Ankgpk32.exeC:\Windows\system32\Ankgpk32.exe40⤵
- Executes dropped EXE
PID:2336 -
C:\Windows\SysWOW64\Aokcjngj.exeC:\Windows\system32\Aokcjngj.exe41⤵
- Executes dropped EXE
PID:2008 -
C:\Windows\SysWOW64\Bomppneg.exeC:\Windows\system32\Bomppneg.exe42⤵
- Executes dropped EXE
PID:380 -
C:\Windows\SysWOW64\Bihancje.exeC:\Windows\system32\Bihancje.exe43⤵
- Executes dropped EXE
PID:4892 -
C:\Windows\SysWOW64\Beobcdoi.exeC:\Windows\system32\Beobcdoi.exe44⤵
- Executes dropped EXE
PID:5044 -
C:\Windows\SysWOW64\Bbbblhnc.exeC:\Windows\system32\Bbbblhnc.exe45⤵
- Executes dropped EXE
PID:1948 -
C:\Windows\SysWOW64\Bbeobhlp.exeC:\Windows\system32\Bbeobhlp.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:620 -
C:\Windows\SysWOW64\Cicqja32.exeC:\Windows\system32\Cicqja32.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2004 -
C:\Windows\SysWOW64\Cnpibh32.exeC:\Windows\system32\Cnpibh32.exe48⤵
- Executes dropped EXE
PID:1840 -
C:\Windows\SysWOW64\Cnbfgh32.exeC:\Windows\system32\Cnbfgh32.exe49⤵
- Executes dropped EXE
PID:2804 -
C:\Windows\SysWOW64\Deokja32.exeC:\Windows\system32\Deokja32.exe50⤵
- Executes dropped EXE
PID:1460 -
C:\Windows\SysWOW64\Dlicflic.exeC:\Windows\system32\Dlicflic.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4520 -
C:\Windows\SysWOW64\Dfngcdhi.exeC:\Windows\system32\Dfngcdhi.exe52⤵
- Executes dropped EXE
PID:1704 -
C:\Windows\SysWOW64\Decdeama.exeC:\Windows\system32\Decdeama.exe53⤵
- Executes dropped EXE
PID:2256 -
C:\Windows\SysWOW64\Dpihbjmg.exeC:\Windows\system32\Dpihbjmg.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4300 -
C:\Windows\SysWOW64\Defajqko.exeC:\Windows\system32\Defajqko.exe55⤵
- Executes dropped EXE
PID:3160 -
C:\Windows\SysWOW64\Donecfao.exeC:\Windows\system32\Donecfao.exe56⤵
- Executes dropped EXE
PID:4364 -
C:\Windows\SysWOW64\Ebokodfc.exeC:\Windows\system32\Ebokodfc.exe57⤵
- Executes dropped EXE
PID:4084 -
C:\Windows\SysWOW64\Eflceb32.exeC:\Windows\system32\Eflceb32.exe58⤵
- Executes dropped EXE
- Modifies registry class
PID:1672 -
C:\Windows\SysWOW64\Eohhie32.exeC:\Windows\system32\Eohhie32.exe59⤵
- Executes dropped EXE
PID:3308 -
C:\Windows\SysWOW64\Ehpmbj32.exeC:\Windows\system32\Ehpmbj32.exe60⤵
- Executes dropped EXE
PID:2148 -
C:\Windows\SysWOW64\Ehbihj32.exeC:\Windows\system32\Ehbihj32.exe61⤵
- Executes dropped EXE
PID:4980 -
C:\Windows\SysWOW64\Fefjanml.exeC:\Windows\system32\Fefjanml.exe62⤵
- Executes dropped EXE
PID:4972 -
C:\Windows\SysWOW64\Fekclnif.exeC:\Windows\system32\Fekclnif.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4184 -
C:\Windows\SysWOW64\Flekihpc.exeC:\Windows\system32\Flekihpc.exe64⤵
- Executes dropped EXE
PID:4328 -
C:\Windows\SysWOW64\Fgjpfqpi.exeC:\Windows\system32\Fgjpfqpi.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1560 -
C:\Windows\SysWOW64\Fofdkcmd.exeC:\Windows\system32\Fofdkcmd.exe66⤵
- Drops file in System32 directory
PID:1732 -
C:\Windows\SysWOW64\Fepmgm32.exeC:\Windows\system32\Fepmgm32.exe67⤵PID:3364
-
C:\Windows\SysWOW64\Fljedg32.exeC:\Windows\system32\Fljedg32.exe68⤵PID:4080
-
C:\Windows\SysWOW64\Gheodg32.exeC:\Windows\system32\Gheodg32.exe69⤵PID:4108
-
C:\Windows\SysWOW64\Googaaej.exeC:\Windows\system32\Googaaej.exe70⤵PID:4384
-
C:\Windows\SysWOW64\Ghgljg32.exeC:\Windows\system32\Ghgljg32.exe71⤵
- Drops file in System32 directory
PID:2352 -
C:\Windows\SysWOW64\Gcmpgpkp.exeC:\Windows\system32\Gcmpgpkp.exe72⤵PID:3708
-
C:\Windows\SysWOW64\Hfniikha.exeC:\Windows\system32\Hfniikha.exe73⤵PID:4508
-
C:\Windows\SysWOW64\Hfpenj32.exeC:\Windows\system32\Hfpenj32.exe74⤵PID:4936
-
C:\Windows\SysWOW64\Hljnkdnk.exeC:\Windows\system32\Hljnkdnk.exe75⤵PID:5140
-
C:\Windows\SysWOW64\Hcipcnac.exeC:\Windows\system32\Hcipcnac.exe76⤵
- Modifies registry class
PID:5180 -
C:\Windows\SysWOW64\Hjbhph32.exeC:\Windows\system32\Hjbhph32.exe77⤵PID:5224
-
C:\Windows\SysWOW64\Ioppho32.exeC:\Windows\system32\Ioppho32.exe78⤵
- Modifies registry class
PID:5276 -
C:\Windows\SysWOW64\Icbbimih.exeC:\Windows\system32\Icbbimih.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5320 -
C:\Windows\SysWOW64\Imjgbb32.exeC:\Windows\system32\Imjgbb32.exe80⤵
- Drops file in System32 directory
PID:5356 -
C:\Windows\SysWOW64\Icdoolge.exeC:\Windows\system32\Icdoolge.exe81⤵
- Drops file in System32 directory
PID:5404 -
C:\Windows\SysWOW64\Jjemle32.exeC:\Windows\system32\Jjemle32.exe82⤵PID:5448
-
C:\Windows\SysWOW64\Jqofippg.exeC:\Windows\system32\Jqofippg.exe83⤵PID:5496
-
C:\Windows\SysWOW64\Jginej32.exeC:\Windows\system32\Jginej32.exe84⤵PID:5536
-
C:\Windows\SysWOW64\Jikjmbmb.exeC:\Windows\system32\Jikjmbmb.exe85⤵PID:5580
-
C:\Windows\SysWOW64\Jpdbjleo.exeC:\Windows\system32\Jpdbjleo.exe86⤵
- Drops file in System32 directory
PID:5632 -
C:\Windows\SysWOW64\Lfmghdpl.exeC:\Windows\system32\Lfmghdpl.exe87⤵PID:5676
-
C:\Windows\SysWOW64\Lmfodn32.exeC:\Windows\system32\Lmfodn32.exe88⤵PID:5736
-
C:\Windows\SysWOW64\Mffjnc32.exeC:\Windows\system32\Mffjnc32.exe89⤵PID:5784
-
C:\Windows\SysWOW64\Malnklgg.exeC:\Windows\system32\Malnklgg.exe90⤵PID:5832
-
C:\Windows\SysWOW64\Mhefhf32.exeC:\Windows\system32\Mhefhf32.exe91⤵PID:5872
-
C:\Windows\SysWOW64\Migcpneb.exeC:\Windows\system32\Migcpneb.exe92⤵PID:5916
-
C:\Windows\SysWOW64\Mpqklh32.exeC:\Windows\system32\Mpqklh32.exe93⤵
- Drops file in System32 directory
PID:5956 -
C:\Windows\SysWOW64\Mapgfk32.exeC:\Windows\system32\Mapgfk32.exe94⤵PID:5996
-
C:\Windows\SysWOW64\Mhjpceko.exeC:\Windows\system32\Mhjpceko.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6044 -
C:\Windows\SysWOW64\Minipm32.exeC:\Windows\system32\Minipm32.exe96⤵PID:6132
-
C:\Windows\SysWOW64\Nkpbpp32.exeC:\Windows\system32\Nkpbpp32.exe97⤵PID:220
-
C:\Windows\SysWOW64\Nmpkakak.exeC:\Windows\system32\Nmpkakak.exe98⤵PID:5220
-
C:\Windows\SysWOW64\Nhfoocaa.exeC:\Windows\system32\Nhfoocaa.exe99⤵
- Modifies registry class
PID:5260 -
C:\Windows\SysWOW64\Ndmpddfe.exeC:\Windows\system32\Ndmpddfe.exe100⤵PID:5316
-
C:\Windows\SysWOW64\Niihlkdm.exeC:\Windows\system32\Niihlkdm.exe101⤵PID:5400
-
C:\Windows\SysWOW64\Oileakbj.exeC:\Windows\system32\Oileakbj.exe102⤵PID:5460
-
C:\Windows\SysWOW64\Ogpfko32.exeC:\Windows\system32\Ogpfko32.exe103⤵PID:5524
-
C:\Windows\SysWOW64\Oaejhh32.exeC:\Windows\system32\Oaejhh32.exe104⤵PID:5588
-
C:\Windows\SysWOW64\Oknnanhj.exeC:\Windows\system32\Oknnanhj.exe105⤵PID:5656
-
C:\Windows\SysWOW64\Onqdhh32.exeC:\Windows\system32\Onqdhh32.exe106⤵PID:5724
-
C:\Windows\SysWOW64\Phfhfa32.exeC:\Windows\system32\Phfhfa32.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5704 -
C:\Windows\SysWOW64\Qhbhapha.exeC:\Windows\system32\Qhbhapha.exe108⤵PID:5828
-
C:\Windows\SysWOW64\Qkcackeb.exeC:\Windows\system32\Qkcackeb.exe109⤵PID:5904
-
C:\Windows\SysWOW64\Ahgamo32.exeC:\Windows\system32\Ahgamo32.exe110⤵PID:5948
-
C:\Windows\SysWOW64\Ancjef32.exeC:\Windows\system32\Ancjef32.exe111⤵PID:6060
-
C:\Windows\SysWOW64\Aqilaplo.exeC:\Windows\system32\Aqilaplo.exe112⤵
- Modifies registry class
PID:324 -
C:\Windows\SysWOW64\Bqpbboeg.exeC:\Windows\system32\Bqpbboeg.exe113⤵PID:5212
-
C:\Windows\SysWOW64\Bndblcdq.exeC:\Windows\system32\Bndblcdq.exe114⤵PID:5304
-
C:\Windows\SysWOW64\Bdphnmjk.exeC:\Windows\system32\Bdphnmjk.exe115⤵PID:5412
-
C:\Windows\SysWOW64\Ckmmpg32.exeC:\Windows\system32\Ckmmpg32.exe116⤵PID:5504
-
C:\Windows\SysWOW64\Dndlba32.exeC:\Windows\system32\Dndlba32.exe117⤵PID:608
-
C:\Windows\SysWOW64\Dilmeida.exeC:\Windows\system32\Dilmeida.exe118⤵PID:4944
-
C:\Windows\SysWOW64\Dbdano32.exeC:\Windows\system32\Dbdano32.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5776 -
C:\Windows\SysWOW64\Dlmegd32.exeC:\Windows\system32\Dlmegd32.exe120⤵PID:5976
-
C:\Windows\SysWOW64\Dbgndoho.exeC:\Windows\system32\Dbgndoho.exe121⤵PID:6084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-