Analysis
-
max time kernel
142s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 22:12
Static task
static1
Behavioral task
behavioral1
Sample
55fe0941c570356de13c21233e8e98c87ab1a063ac39be88a9408bebf406fd15.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
55fe0941c570356de13c21233e8e98c87ab1a063ac39be88a9408bebf406fd15.exe
Resource
win10v2004-20240226-en
General
-
Target
55fe0941c570356de13c21233e8e98c87ab1a063ac39be88a9408bebf406fd15.exe
-
Size
406KB
-
MD5
d2bf17a5871224968f431d67fc28dfc6
-
SHA1
fcb99d4056b6b7064b71e131bc808a023a78b7db
-
SHA256
55fe0941c570356de13c21233e8e98c87ab1a063ac39be88a9408bebf406fd15
-
SHA512
0ca3a4791988c7981f781d7936c0ed18c227b50b5d018d7908c7e0631130bd2f78327e9882c18ad8144d3c3ee717e7a154527ee613b3d225b10c77bef4a3d9ef
-
SSDEEP
6144:d7PuLLsNzU5U5Xj1XH5U5Xj83XH5U1XH5U5Xj8s5DXH5U5qXH5XXH5U5oXH:dPwYKMp3Ma3M3MvD3Mq3B3Mo3
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Dfmdho32.exeEkpheb32.exeOfhjopbg.exeApimacnn.exeFbmcbbki.exePhbgcnig.exeAkabgebj.exeElajgpmj.exeHakphqja.exeOqacic32.exeBqgmfkhg.exeLqqpgj32.exeNfidjbdg.exeBjdkjpkb.exeKlehgh32.exeKklkcn32.exeDhmcfkme.exeBfagpiam.exeGbaken32.exeHnbopmnm.exeLfbbjpgd.exeJhngjmlo.exeLmebnb32.exeMdkqqa32.exeGfehan32.exeKbokgpgg.exeMgmahg32.exePcdkif32.exeIgdogl32.exeLmfhil32.exePkcbnanl.exeCbblda32.exeNdjfeo32.exeMdpldi32.exeKdnild32.exeCfkloq32.exeGhajacmo.exeNlqmmd32.exeOplelf32.exeLmdkcl32.exeAeenochi.exeDpmdofno.exeJgncfcaa.exeKhcomhbi.exeNlbgikia.exeJajcdjca.exeObmnna32.exeAojabdlf.exeGdkgkcpq.exeHpgfki32.exeIlncom32.exeMeppiblm.exeApdhjq32.exeJjaimn32.exeLeammn32.exeOqmmpd32.exeNgibaj32.exeLfjcfb32.exeJckgicnp.exeBcmfmlen.exeMcnbhb32.exeKgnnln32.exeJodhdp32.exeOoabmbbe.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dfmdho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ekpheb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ofhjopbg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apimacnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fbmcbbki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phbgcnig.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akabgebj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Elajgpmj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hakphqja.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oqacic32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bqgmfkhg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lqqpgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nfidjbdg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bjdkjpkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Klehgh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kklkcn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhmcfkme.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfagpiam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gbaken32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hnbopmnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lfbbjpgd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jhngjmlo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lmebnb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdkqqa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gfehan32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kbokgpgg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgmahg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pcdkif32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igdogl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lmfhil32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pkcbnanl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbblda32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndjfeo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdpldi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kdnild32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfkloq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghajacmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nlqmmd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oplelf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lmdkcl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aeenochi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpmdofno.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgncfcaa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Khcomhbi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nlbgikia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jajcdjca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Obmnna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aojabdlf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdkgkcpq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpgfki32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilncom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Meppiblm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apdhjq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjaimn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Leammn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oqmmpd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngibaj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lfjcfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jckgicnp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcmfmlen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mcnbhb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgnnln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jodhdp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ooabmbbe.exe -
Executes dropped EXE 64 IoCs
Processes:
Dflkdp32.exeDhmcfkme.exeDmafennb.exeEpaogi32.exeEjgcdb32.exeEnihne32.exeEiaiqn32.exeFehjeo32.exeFpfdalii.exeFlmefm32.exeGelppaof.exeGkihhhnm.exeHlakpp32.exeHlcgeo32.exeIlknfn32.exeIgdogl32.exeIqalka32.exeJjjacf32.exeJiakjb32.exeJbjochdi.exeJicgpb32.exeJbllihbf.exeKgnnln32.exeKmjfdejp.exeKmopod32.exeLckdanld.exeLfjqnjkh.exeLlfifq32.exeLbqabkql.exeLpdbloof.exeLimfed32.exeLbeknj32.exeLdfgebbe.exeLajhofao.exeMkclhl32.exeMdkqqa32.exeMihiih32.exeMbpnanch.exeMmfbogcn.exeMeagci32.exeMoiklogi.exeMlmlecec.exeNefpnhlc.exeNondgn32.exeNehmdhja.exeNncahjgl.exeNhiffc32.exeNaajoinb.exeNjlockkm.exeOklkmnbp.exeOjahnj32.exeOlpdjf32.exeOcimgp32.exeOhfeog32.exeOqmmpd32.exeOclilp32.exeOhibdf32.exeOcnfbo32.exeOfmbnkhg.exeOoeggp32.exeObcccl32.exePklhlael.exePbfpik32.exePgbhabjp.exepid process 2388 Dflkdp32.exe 2988 Dhmcfkme.exe 2644 Dmafennb.exe 2432 Epaogi32.exe 2808 Ejgcdb32.exe 2500 Enihne32.exe 1532 Eiaiqn32.exe 2816 Fehjeo32.exe 2928 Fpfdalii.exe 1272 Flmefm32.exe 1472 Gelppaof.exe 2600 Gkihhhnm.exe 1232 Hlakpp32.exe 2284 Hlcgeo32.exe 2080 Ilknfn32.exe 1492 Igdogl32.exe 1856 Iqalka32.exe 2908 Jjjacf32.exe 1756 Jiakjb32.exe 1860 Jbjochdi.exe 304 Jicgpb32.exe 756 Jbllihbf.exe 2336 Kgnnln32.exe 3056 Kmjfdejp.exe 1748 Kmopod32.exe 2204 Lckdanld.exe 1432 Lfjqnjkh.exe 2760 Llfifq32.exe 2652 Lbqabkql.exe 2580 Lpdbloof.exe 2588 Limfed32.exe 2612 Lbeknj32.exe 2700 Ldfgebbe.exe 1644 Lajhofao.exe 2972 Mkclhl32.exe 496 Mdkqqa32.exe 1696 Mihiih32.exe 2524 Mbpnanch.exe 2976 Mmfbogcn.exe 2984 Meagci32.exe 2100 Moiklogi.exe 1952 Mlmlecec.exe 396 Nefpnhlc.exe 984 Nondgn32.exe 344 Nehmdhja.exe 2040 Nncahjgl.exe 1772 Nhiffc32.exe 2140 Naajoinb.exe 900 Njlockkm.exe 1972 Oklkmnbp.exe 872 Ojahnj32.exe 2876 Olpdjf32.exe 1920 Ocimgp32.exe 2352 Ohfeog32.exe 3012 Oqmmpd32.exe 2184 Oclilp32.exe 2732 Ohibdf32.exe 2488 Ocnfbo32.exe 2996 Ofmbnkhg.exe 2956 Ooeggp32.exe 1504 Obcccl32.exe 624 Pklhlael.exe 2456 Pbfpik32.exe 2444 Pgbhabjp.exe -
Loads dropped DLL 64 IoCs
Processes:
55fe0941c570356de13c21233e8e98c87ab1a063ac39be88a9408bebf406fd15.exeDflkdp32.exeDhmcfkme.exeDmafennb.exeEpaogi32.exeEjgcdb32.exeEnihne32.exeEiaiqn32.exeFehjeo32.exeFpfdalii.exeFlmefm32.exeGelppaof.exeGkihhhnm.exeHlakpp32.exeHlcgeo32.exeIlknfn32.exeIgdogl32.exeIqalka32.exeJjjacf32.exeJiakjb32.exeJbjochdi.exeJicgpb32.exeJbllihbf.exeKgnnln32.exeKmjfdejp.exeKmopod32.exeLckdanld.exeLfjqnjkh.exeLlfifq32.exeLbqabkql.exeLpdbloof.exeLimfed32.exepid process 3000 55fe0941c570356de13c21233e8e98c87ab1a063ac39be88a9408bebf406fd15.exe 3000 55fe0941c570356de13c21233e8e98c87ab1a063ac39be88a9408bebf406fd15.exe 2388 Dflkdp32.exe 2388 Dflkdp32.exe 2988 Dhmcfkme.exe 2988 Dhmcfkme.exe 2644 Dmafennb.exe 2644 Dmafennb.exe 2432 Epaogi32.exe 2432 Epaogi32.exe 2808 Ejgcdb32.exe 2808 Ejgcdb32.exe 2500 Enihne32.exe 2500 Enihne32.exe 1532 Eiaiqn32.exe 1532 Eiaiqn32.exe 2816 Fehjeo32.exe 2816 Fehjeo32.exe 2928 Fpfdalii.exe 2928 Fpfdalii.exe 1272 Flmefm32.exe 1272 Flmefm32.exe 1472 Gelppaof.exe 1472 Gelppaof.exe 2600 Gkihhhnm.exe 2600 Gkihhhnm.exe 1232 Hlakpp32.exe 1232 Hlakpp32.exe 2284 Hlcgeo32.exe 2284 Hlcgeo32.exe 2080 Ilknfn32.exe 2080 Ilknfn32.exe 1492 Igdogl32.exe 1492 Igdogl32.exe 1856 Iqalka32.exe 1856 Iqalka32.exe 2908 Jjjacf32.exe 2908 Jjjacf32.exe 1756 Jiakjb32.exe 1756 Jiakjb32.exe 1860 Jbjochdi.exe 1860 Jbjochdi.exe 304 Jicgpb32.exe 304 Jicgpb32.exe 756 Jbllihbf.exe 756 Jbllihbf.exe 2336 Kgnnln32.exe 2336 Kgnnln32.exe 3056 Kmjfdejp.exe 3056 Kmjfdejp.exe 1748 Kmopod32.exe 1748 Kmopod32.exe 2204 Lckdanld.exe 2204 Lckdanld.exe 1432 Lfjqnjkh.exe 1432 Lfjqnjkh.exe 2760 Llfifq32.exe 2760 Llfifq32.exe 2652 Lbqabkql.exe 2652 Lbqabkql.exe 2580 Lpdbloof.exe 2580 Lpdbloof.exe 2588 Limfed32.exe 2588 Limfed32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Bdbhke32.exeAckkppma.exeGmoqnhla.exeDphjcf32.exeOoclji32.exeKhcomhbi.exeHpbdmo32.exeFcmiod32.exeLifbmn32.exeHfegij32.exeHifpke32.exeKmopod32.exeNefpnhlc.exeGqahqd32.exeAlihaioe.exeCbdiia32.exeAefeijle.exeMdbiji32.exePaknelgk.exeKnpemf32.exePeanbblf.exeFoccjood.exeHlccdboi.exePdbdqh32.exeCmedlk32.exeHijgml32.exeMcnbhb32.exeHnbopmnm.exeEnihne32.exeMeagci32.exeBlbfjg32.exeKbbngf32.exeNianhplq.exeFqlicclo.exeKncaojfb.exeMjcaimgg.exePgbhabjp.exeAkmjfn32.exeKgefefnd.exeFchijone.exeIhmpobck.exeQeppdo32.exeGembhj32.exeMfaefd32.exeDdiibc32.exeKlehgh32.exeMbcoio32.exeIlknfn32.exeBocolb32.exeEccmffjf.exeHakphqja.exeBilmcf32.exeLeammn32.exeCbblda32.exeNjlockkm.exeEbgclm32.exeBbmcibjp.exeJfnnha32.exeNibebfpl.exeOebimf32.exeOpnpimdf.exeFgohna32.exeLldmleam.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Bpiipf32.exe Bdbhke32.exe File created C:\Windows\SysWOW64\Plgifc32.dll Ackkppma.exe File created C:\Windows\SysWOW64\Galopp32.dll Gmoqnhla.exe File opened for modification C:\Windows\SysWOW64\Dgbcpq32.exe Dphjcf32.exe File created C:\Windows\SysWOW64\Oemegc32.exe Ooclji32.exe File opened for modification C:\Windows\SysWOW64\Lnpgeopa.exe Khcomhbi.exe File created C:\Windows\SysWOW64\Dejdjfjb.dll Hpbdmo32.exe File created C:\Windows\SysWOW64\Fqajihle.exe Fcmiod32.exe File created C:\Windows\SysWOW64\Adklhjib.dll Lifbmn32.exe File created C:\Windows\SysWOW64\Aebmjo32.dll Hfegij32.exe File opened for modification C:\Windows\SysWOW64\Hihlqeib.exe Hifpke32.exe File created C:\Windows\SysWOW64\Ocljjp32.dll Kmopod32.exe File opened for modification C:\Windows\SysWOW64\Nondgn32.exe Nefpnhlc.exe File opened for modification C:\Windows\SysWOW64\Gkglnm32.exe Gqahqd32.exe File created C:\Windows\SysWOW64\Aohdmdoh.exe Alihaioe.exe File created C:\Windows\SysWOW64\Hbcfdk32.dll Cbdiia32.exe File created C:\Windows\SysWOW64\Anojbobe.exe Aefeijle.exe File opened for modification C:\Windows\SysWOW64\Mfaefd32.exe Mdbiji32.exe File opened for modification C:\Windows\SysWOW64\Pcljmdmj.exe Paknelgk.exe File opened for modification C:\Windows\SysWOW64\Leimip32.exe Knpemf32.exe File opened for modification C:\Windows\SysWOW64\Pkofjijm.exe Peanbblf.exe File opened for modification C:\Windows\SysWOW64\Ffmkfifa.exe Foccjood.exe File created C:\Windows\SysWOW64\Hnbopmnm.exe Hlccdboi.exe File opened for modification C:\Windows\SysWOW64\Pljlbf32.exe Pdbdqh32.exe File created C:\Windows\SysWOW64\Ajaclncd.dll Cmedlk32.exe File opened for modification C:\Windows\SysWOW64\Ipdojfgh.exe Hijgml32.exe File created C:\Windows\SysWOW64\Mjhjdm32.exe Mcnbhb32.exe File opened for modification C:\Windows\SysWOW64\Hhjcic32.exe Hnbopmnm.exe File created C:\Windows\SysWOW64\Eiaiqn32.exe Enihne32.exe File created C:\Windows\SysWOW64\Moiklogi.exe Meagci32.exe File opened for modification C:\Windows\SysWOW64\Bifgdk32.exe Blbfjg32.exe File created C:\Windows\SysWOW64\Pbefefec.dll Kbbngf32.exe File opened for modification C:\Windows\SysWOW64\Nplfdj32.exe Nianhplq.exe File created C:\Windows\SysWOW64\Cmnmmikh.dll Ooclji32.exe File created C:\Windows\SysWOW64\Fjdnlhco.exe Fqlicclo.exe File opened for modification C:\Windows\SysWOW64\Kdnild32.exe Kncaojfb.exe File created C:\Windows\SysWOW64\Mnomjl32.exe Mjcaimgg.exe File created C:\Windows\SysWOW64\Pqkmjh32.exe Pgbhabjp.exe File created C:\Windows\SysWOW64\Aeenochi.exe Akmjfn32.exe File created C:\Windows\SysWOW64\Lifbmn32.exe Kgefefnd.exe File opened for modification C:\Windows\SysWOW64\Fqlicclo.exe Fchijone.exe File opened for modification C:\Windows\SysWOW64\Ijklknbn.exe Ihmpobck.exe File created C:\Windows\SysWOW64\Olbkdn32.dll Qeppdo32.exe File created C:\Windows\SysWOW64\Gnefapmj.exe Gembhj32.exe File opened for modification C:\Windows\SysWOW64\Mioabp32.exe Mfaefd32.exe File created C:\Windows\SysWOW64\Qmcjfmgj.dll Ddiibc32.exe File created C:\Windows\SysWOW64\Kcopdb32.exe Klehgh32.exe File opened for modification C:\Windows\SysWOW64\Mklcadfn.exe Mbcoio32.exe File opened for modification C:\Windows\SysWOW64\Igdogl32.exe Ilknfn32.exe File created C:\Windows\SysWOW64\Iefmgahq.dll Bocolb32.exe File created C:\Windows\SysWOW64\Ampehe32.dll Eccmffjf.exe File created C:\Windows\SysWOW64\Qpehocqo.dll Hakphqja.exe File created C:\Windows\SysWOW64\Bnielm32.exe Bilmcf32.exe File created C:\Windows\SysWOW64\Cdljhf32.dll Leammn32.exe File opened for modification C:\Windows\SysWOW64\Cfmhdpnc.exe Cbblda32.exe File created C:\Windows\SysWOW64\Ocindg32.dll Njlockkm.exe File opened for modification C:\Windows\SysWOW64\Ekpheb32.exe Ebgclm32.exe File created C:\Windows\SysWOW64\Lbmnig32.dll Bbmcibjp.exe File opened for modification C:\Windows\SysWOW64\Jgojpjem.exe Jfnnha32.exe File opened for modification C:\Windows\SysWOW64\Ngfflj32.exe Nibebfpl.exe File opened for modification C:\Windows\SysWOW64\Okoafmkm.exe Oebimf32.exe File opened for modification C:\Windows\SysWOW64\Oghhfg32.exe Opnpimdf.exe File opened for modification C:\Windows\SysWOW64\Fbdlkj32.exe Fgohna32.exe File created C:\Windows\SysWOW64\Djmlem32.dll Lldmleam.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3480 4080 WerFault.exe Dpapaj32.exe -
Modifies registry class 64 IoCs
Processes:
Faigdn32.exeNiikceid.exeBbjmpcab.exeChfbgn32.exeHphidanj.exeClmdmm32.exeGoiehm32.exeAkabgebj.exeCbgjqo32.exeEbgclm32.exeNoacef32.exeFfkoai32.exeCjdfmo32.exeJfknbe32.exeGjlgfaco.exeHqfaldbo.exeJajcdjca.exeAemkjiem.exePokieo32.exeBdmddc32.exeCegcbjkn.exeJbllihbf.exeDfmdho32.exeEccpoo32.exeOiljam32.exeLpdbloof.exeBeejng32.exeEdfbaabj.exeLdbofgme.exeCbblda32.exeIgdogl32.exeNgibaj32.exePpcbgkka.exePcdkif32.exePhcilf32.exeKbbngf32.exeEfjlgmlf.exeJkmeoa32.exeDaofpchf.exeCcpcckck.exeBdcifi32.exeHpkldg32.exeMimemp32.exePggdejno.exeEjpdai32.exeDhmcfkme.exeIlqpdm32.exeJdkjnl32.exeLnpgeopa.exeAficjnpm.exeEjobhppq.exeMfaefd32.exeBigimdjh.exeDhpemm32.exeGbadjg32.exeMjcaimgg.exeCkjamgmk.exeNhiffc32.exeOeeecekc.exeLfbbjpgd.exeMpopnejo.exeFlmefm32.exeGfjhgdck.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Faigdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Niikceid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bbjmpcab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inoaljog.dll" Chfbgn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hphidanj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpnidcen.dll" Clmdmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Liihgqil.dll" Goiehm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmmgmc32.dll" Akabgebj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cbgjqo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ebgclm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcojdjpd.dll" Noacef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ffkoai32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cjdfmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enlejpga.dll" Jfknbe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gjlgfaco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpqhdl32.dll" Hqfaldbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jajcdjca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aemkjiem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pokieo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bdmddc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cegcbjkn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnplna32.dll" Jbllihbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dfmdho32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eccpoo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oiljam32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lpdbloof.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Beejng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Edfbaabj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojcqog32.dll" Ldbofgme.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cbblda32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Igdogl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ngibaj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ppcbgkka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pcdkif32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Phcilf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbefefec.dll" Kbbngf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kedime32.dll" Efjlgmlf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jkmeoa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Daofpchf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ccpcckck.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akkggpci.dll" Bdcifi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hpkldg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mimemp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pggdejno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ejpdai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dhmcfkme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnhqpo32.dll" Ilqpdm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akainj32.dll" Jdkjnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bihmcd32.dll" Lnpgeopa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aficjnpm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ejobhppq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mfaefd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jaidoiaj.dll" Mfaefd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bigimdjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dhpemm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gbadjg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mjcaimgg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pobghn32.dll" Ckjamgmk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nhiffc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oeeecekc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lfbbjpgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mpopnejo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Flmefm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gfjhgdck.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
55fe0941c570356de13c21233e8e98c87ab1a063ac39be88a9408bebf406fd15.exeDflkdp32.exeDhmcfkme.exeDmafennb.exeEpaogi32.exeEjgcdb32.exeEnihne32.exeEiaiqn32.exeFehjeo32.exeFpfdalii.exeFlmefm32.exeGelppaof.exeGkihhhnm.exeHlakpp32.exeHlcgeo32.exeIlknfn32.exedescription pid process target process PID 3000 wrote to memory of 2388 3000 55fe0941c570356de13c21233e8e98c87ab1a063ac39be88a9408bebf406fd15.exe Dflkdp32.exe PID 3000 wrote to memory of 2388 3000 55fe0941c570356de13c21233e8e98c87ab1a063ac39be88a9408bebf406fd15.exe Dflkdp32.exe PID 3000 wrote to memory of 2388 3000 55fe0941c570356de13c21233e8e98c87ab1a063ac39be88a9408bebf406fd15.exe Dflkdp32.exe PID 3000 wrote to memory of 2388 3000 55fe0941c570356de13c21233e8e98c87ab1a063ac39be88a9408bebf406fd15.exe Dflkdp32.exe PID 2388 wrote to memory of 2988 2388 Dflkdp32.exe Dhmcfkme.exe PID 2388 wrote to memory of 2988 2388 Dflkdp32.exe Dhmcfkme.exe PID 2388 wrote to memory of 2988 2388 Dflkdp32.exe Dhmcfkme.exe PID 2388 wrote to memory of 2988 2388 Dflkdp32.exe Dhmcfkme.exe PID 2988 wrote to memory of 2644 2988 Dhmcfkme.exe Dmafennb.exe PID 2988 wrote to memory of 2644 2988 Dhmcfkme.exe Dmafennb.exe PID 2988 wrote to memory of 2644 2988 Dhmcfkme.exe Dmafennb.exe PID 2988 wrote to memory of 2644 2988 Dhmcfkme.exe Dmafennb.exe PID 2644 wrote to memory of 2432 2644 Dmafennb.exe Epaogi32.exe PID 2644 wrote to memory of 2432 2644 Dmafennb.exe Epaogi32.exe PID 2644 wrote to memory of 2432 2644 Dmafennb.exe Epaogi32.exe PID 2644 wrote to memory of 2432 2644 Dmafennb.exe Epaogi32.exe PID 2432 wrote to memory of 2808 2432 Epaogi32.exe Ejgcdb32.exe PID 2432 wrote to memory of 2808 2432 Epaogi32.exe Ejgcdb32.exe PID 2432 wrote to memory of 2808 2432 Epaogi32.exe Ejgcdb32.exe PID 2432 wrote to memory of 2808 2432 Epaogi32.exe Ejgcdb32.exe PID 2808 wrote to memory of 2500 2808 Ejgcdb32.exe Enihne32.exe PID 2808 wrote to memory of 2500 2808 Ejgcdb32.exe Enihne32.exe PID 2808 wrote to memory of 2500 2808 Ejgcdb32.exe Enihne32.exe PID 2808 wrote to memory of 2500 2808 Ejgcdb32.exe Enihne32.exe PID 2500 wrote to memory of 1532 2500 Enihne32.exe Eiaiqn32.exe PID 2500 wrote to memory of 1532 2500 Enihne32.exe Eiaiqn32.exe PID 2500 wrote to memory of 1532 2500 Enihne32.exe Eiaiqn32.exe PID 2500 wrote to memory of 1532 2500 Enihne32.exe Eiaiqn32.exe PID 1532 wrote to memory of 2816 1532 Eiaiqn32.exe Fehjeo32.exe PID 1532 wrote to memory of 2816 1532 Eiaiqn32.exe Fehjeo32.exe PID 1532 wrote to memory of 2816 1532 Eiaiqn32.exe Fehjeo32.exe PID 1532 wrote to memory of 2816 1532 Eiaiqn32.exe Fehjeo32.exe PID 2816 wrote to memory of 2928 2816 Fehjeo32.exe Fpfdalii.exe PID 2816 wrote to memory of 2928 2816 Fehjeo32.exe Fpfdalii.exe PID 2816 wrote to memory of 2928 2816 Fehjeo32.exe Fpfdalii.exe PID 2816 wrote to memory of 2928 2816 Fehjeo32.exe Fpfdalii.exe PID 2928 wrote to memory of 1272 2928 Fpfdalii.exe Flmefm32.exe PID 2928 wrote to memory of 1272 2928 Fpfdalii.exe Flmefm32.exe PID 2928 wrote to memory of 1272 2928 Fpfdalii.exe Flmefm32.exe PID 2928 wrote to memory of 1272 2928 Fpfdalii.exe Flmefm32.exe PID 1272 wrote to memory of 1472 1272 Flmefm32.exe Gelppaof.exe PID 1272 wrote to memory of 1472 1272 Flmefm32.exe Gelppaof.exe PID 1272 wrote to memory of 1472 1272 Flmefm32.exe Gelppaof.exe PID 1272 wrote to memory of 1472 1272 Flmefm32.exe Gelppaof.exe PID 1472 wrote to memory of 2600 1472 Gelppaof.exe Gkihhhnm.exe PID 1472 wrote to memory of 2600 1472 Gelppaof.exe Gkihhhnm.exe PID 1472 wrote to memory of 2600 1472 Gelppaof.exe Gkihhhnm.exe PID 1472 wrote to memory of 2600 1472 Gelppaof.exe Gkihhhnm.exe PID 2600 wrote to memory of 1232 2600 Gkihhhnm.exe Hlakpp32.exe PID 2600 wrote to memory of 1232 2600 Gkihhhnm.exe Hlakpp32.exe PID 2600 wrote to memory of 1232 2600 Gkihhhnm.exe Hlakpp32.exe PID 2600 wrote to memory of 1232 2600 Gkihhhnm.exe Hlakpp32.exe PID 1232 wrote to memory of 2284 1232 Hlakpp32.exe Hlcgeo32.exe PID 1232 wrote to memory of 2284 1232 Hlakpp32.exe Hlcgeo32.exe PID 1232 wrote to memory of 2284 1232 Hlakpp32.exe Hlcgeo32.exe PID 1232 wrote to memory of 2284 1232 Hlakpp32.exe Hlcgeo32.exe PID 2284 wrote to memory of 2080 2284 Hlcgeo32.exe Ilknfn32.exe PID 2284 wrote to memory of 2080 2284 Hlcgeo32.exe Ilknfn32.exe PID 2284 wrote to memory of 2080 2284 Hlcgeo32.exe Ilknfn32.exe PID 2284 wrote to memory of 2080 2284 Hlcgeo32.exe Ilknfn32.exe PID 2080 wrote to memory of 1492 2080 Ilknfn32.exe Igdogl32.exe PID 2080 wrote to memory of 1492 2080 Ilknfn32.exe Igdogl32.exe PID 2080 wrote to memory of 1492 2080 Ilknfn32.exe Igdogl32.exe PID 2080 wrote to memory of 1492 2080 Ilknfn32.exe Igdogl32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\55fe0941c570356de13c21233e8e98c87ab1a063ac39be88a9408bebf406fd15.exe"C:\Users\Admin\AppData\Local\Temp\55fe0941c570356de13c21233e8e98c87ab1a063ac39be88a9408bebf406fd15.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\Dflkdp32.exeC:\Windows\system32\Dflkdp32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\Dhmcfkme.exeC:\Windows\system32\Dhmcfkme.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\Dmafennb.exeC:\Windows\system32\Dmafennb.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\Epaogi32.exeC:\Windows\system32\Epaogi32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\Ejgcdb32.exeC:\Windows\system32\Ejgcdb32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\Enihne32.exeC:\Windows\system32\Enihne32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\Eiaiqn32.exeC:\Windows\system32\Eiaiqn32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\Fehjeo32.exeC:\Windows\system32\Fehjeo32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\Fpfdalii.exeC:\Windows\system32\Fpfdalii.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\Flmefm32.exeC:\Windows\system32\Flmefm32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\Gelppaof.exeC:\Windows\system32\Gelppaof.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\Gkihhhnm.exeC:\Windows\system32\Gkihhhnm.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\Hlakpp32.exeC:\Windows\system32\Hlakpp32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\Hlcgeo32.exeC:\Windows\system32\Hlcgeo32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\Ilknfn32.exeC:\Windows\system32\Ilknfn32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\Igdogl32.exeC:\Windows\system32\Igdogl32.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1492 -
C:\Windows\SysWOW64\Iqalka32.exeC:\Windows\system32\Iqalka32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Windows\SysWOW64\Jjjacf32.exeC:\Windows\system32\Jjjacf32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Windows\SysWOW64\Jiakjb32.exeC:\Windows\system32\Jiakjb32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Windows\SysWOW64\Jbjochdi.exeC:\Windows\system32\Jbjochdi.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Windows\SysWOW64\Jicgpb32.exeC:\Windows\system32\Jicgpb32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:304 -
C:\Windows\SysWOW64\Jbllihbf.exeC:\Windows\system32\Jbllihbf.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:756 -
C:\Windows\SysWOW64\Kgnnln32.exeC:\Windows\system32\Kgnnln32.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Windows\SysWOW64\Kmjfdejp.exeC:\Windows\system32\Kmjfdejp.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Windows\SysWOW64\Kmopod32.exeC:\Windows\system32\Kmopod32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1748 -
C:\Windows\SysWOW64\Lckdanld.exeC:\Windows\system32\Lckdanld.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Windows\SysWOW64\Lfjqnjkh.exeC:\Windows\system32\Lfjqnjkh.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Windows\SysWOW64\Llfifq32.exeC:\Windows\system32\Llfifq32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Windows\SysWOW64\Lbqabkql.exeC:\Windows\system32\Lbqabkql.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Windows\SysWOW64\Lpdbloof.exeC:\Windows\system32\Lpdbloof.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2580 -
C:\Windows\SysWOW64\Limfed32.exeC:\Windows\system32\Limfed32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Windows\SysWOW64\Lbeknj32.exeC:\Windows\system32\Lbeknj32.exe33⤵
- Executes dropped EXE
PID:2612 -
C:\Windows\SysWOW64\Ldfgebbe.exeC:\Windows\system32\Ldfgebbe.exe34⤵
- Executes dropped EXE
PID:2700 -
C:\Windows\SysWOW64\Lajhofao.exeC:\Windows\system32\Lajhofao.exe35⤵
- Executes dropped EXE
PID:1644 -
C:\Windows\SysWOW64\Mkclhl32.exeC:\Windows\system32\Mkclhl32.exe36⤵
- Executes dropped EXE
PID:2972 -
C:\Windows\SysWOW64\Mdkqqa32.exeC:\Windows\system32\Mdkqqa32.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:496 -
C:\Windows\SysWOW64\Mihiih32.exeC:\Windows\system32\Mihiih32.exe38⤵
- Executes dropped EXE
PID:1696 -
C:\Windows\SysWOW64\Mbpnanch.exeC:\Windows\system32\Mbpnanch.exe39⤵
- Executes dropped EXE
PID:2524 -
C:\Windows\SysWOW64\Mmfbogcn.exeC:\Windows\system32\Mmfbogcn.exe40⤵
- Executes dropped EXE
PID:2976 -
C:\Windows\SysWOW64\Meagci32.exeC:\Windows\system32\Meagci32.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2984 -
C:\Windows\SysWOW64\Moiklogi.exeC:\Windows\system32\Moiklogi.exe42⤵
- Executes dropped EXE
PID:2100 -
C:\Windows\SysWOW64\Mlmlecec.exeC:\Windows\system32\Mlmlecec.exe43⤵
- Executes dropped EXE
PID:1952 -
C:\Windows\SysWOW64\Nefpnhlc.exeC:\Windows\system32\Nefpnhlc.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:396 -
C:\Windows\SysWOW64\Nondgn32.exeC:\Windows\system32\Nondgn32.exe45⤵
- Executes dropped EXE
PID:984 -
C:\Windows\SysWOW64\Nehmdhja.exeC:\Windows\system32\Nehmdhja.exe46⤵
- Executes dropped EXE
PID:344 -
C:\Windows\SysWOW64\Nncahjgl.exeC:\Windows\system32\Nncahjgl.exe47⤵
- Executes dropped EXE
PID:2040 -
C:\Windows\SysWOW64\Nhiffc32.exeC:\Windows\system32\Nhiffc32.exe48⤵
- Executes dropped EXE
- Modifies registry class
PID:1772 -
C:\Windows\SysWOW64\Naajoinb.exeC:\Windows\system32\Naajoinb.exe49⤵
- Executes dropped EXE
PID:2140 -
C:\Windows\SysWOW64\Njlockkm.exeC:\Windows\system32\Njlockkm.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:900 -
C:\Windows\SysWOW64\Oklkmnbp.exeC:\Windows\system32\Oklkmnbp.exe51⤵
- Executes dropped EXE
PID:1972 -
C:\Windows\SysWOW64\Ojahnj32.exeC:\Windows\system32\Ojahnj32.exe52⤵
- Executes dropped EXE
PID:872 -
C:\Windows\SysWOW64\Olpdjf32.exeC:\Windows\system32\Olpdjf32.exe53⤵
- Executes dropped EXE
PID:2876 -
C:\Windows\SysWOW64\Ocimgp32.exeC:\Windows\system32\Ocimgp32.exe54⤵
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\Ohfeog32.exeC:\Windows\system32\Ohfeog32.exe55⤵
- Executes dropped EXE
PID:2352 -
C:\Windows\SysWOW64\Oqmmpd32.exeC:\Windows\system32\Oqmmpd32.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3012 -
C:\Windows\SysWOW64\Oclilp32.exeC:\Windows\system32\Oclilp32.exe57⤵
- Executes dropped EXE
PID:2184 -
C:\Windows\SysWOW64\Ohibdf32.exeC:\Windows\system32\Ohibdf32.exe58⤵
- Executes dropped EXE
PID:2732 -
C:\Windows\SysWOW64\Ocnfbo32.exeC:\Windows\system32\Ocnfbo32.exe59⤵
- Executes dropped EXE
PID:2488 -
C:\Windows\SysWOW64\Ofmbnkhg.exeC:\Windows\system32\Ofmbnkhg.exe60⤵
- Executes dropped EXE
PID:2996 -
C:\Windows\SysWOW64\Ooeggp32.exeC:\Windows\system32\Ooeggp32.exe61⤵
- Executes dropped EXE
PID:2956 -
C:\Windows\SysWOW64\Obcccl32.exeC:\Windows\system32\Obcccl32.exe62⤵
- Executes dropped EXE
PID:1504 -
C:\Windows\SysWOW64\Pklhlael.exeC:\Windows\system32\Pklhlael.exe63⤵
- Executes dropped EXE
PID:624 -
C:\Windows\SysWOW64\Pbfpik32.exeC:\Windows\system32\Pbfpik32.exe64⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\SysWOW64\Pgbhabjp.exeC:\Windows\system32\Pgbhabjp.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2444 -
C:\Windows\SysWOW64\Pqkmjh32.exeC:\Windows\system32\Pqkmjh32.exe66⤵PID:2436
-
C:\Windows\SysWOW64\Pciifc32.exeC:\Windows\system32\Pciifc32.exe67⤵PID:1760
-
C:\Windows\SysWOW64\Pggbla32.exeC:\Windows\system32\Pggbla32.exe68⤵PID:2688
-
C:\Windows\SysWOW64\Pnajilng.exeC:\Windows\system32\Pnajilng.exe69⤵PID:2864
-
C:\Windows\SysWOW64\Pcnbablo.exeC:\Windows\system32\Pcnbablo.exe70⤵PID:1960
-
C:\Windows\SysWOW64\Pikkiijf.exeC:\Windows\system32\Pikkiijf.exe71⤵PID:3040
-
C:\Windows\SysWOW64\Qcpofbjl.exeC:\Windows\system32\Qcpofbjl.exe72⤵PID:840
-
C:\Windows\SysWOW64\Qimhoi32.exeC:\Windows\system32\Qimhoi32.exe73⤵PID:2788
-
C:\Windows\SysWOW64\Qedhdjnh.exeC:\Windows\system32\Qedhdjnh.exe74⤵PID:1768
-
C:\Windows\SysWOW64\Apimacnn.exeC:\Windows\system32\Apimacnn.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1940 -
C:\Windows\SysWOW64\Aefeijle.exeC:\Windows\system32\Aefeijle.exe76⤵
- Drops file in System32 directory
PID:1288 -
C:\Windows\SysWOW64\Anojbobe.exeC:\Windows\system32\Anojbobe.exe77⤵PID:1536
-
C:\Windows\SysWOW64\Anafhopc.exeC:\Windows\system32\Anafhopc.exe78⤵PID:2340
-
C:\Windows\SysWOW64\Ahikqd32.exeC:\Windows\system32\Ahikqd32.exe79⤵PID:2132
-
C:\Windows\SysWOW64\Aemkjiem.exeC:\Windows\system32\Aemkjiem.exe80⤵
- Modifies registry class
PID:2332 -
C:\Windows\SysWOW64\Ahlgfdeq.exeC:\Windows\system32\Ahlgfdeq.exe81⤵PID:2348
-
C:\Windows\SysWOW64\Aadloj32.exeC:\Windows\system32\Aadloj32.exe82⤵PID:1668
-
C:\Windows\SysWOW64\Bdbhke32.exeC:\Windows\system32\Bdbhke32.exe83⤵
- Drops file in System32 directory
PID:1844 -
C:\Windows\SysWOW64\Bpiipf32.exeC:\Windows\system32\Bpiipf32.exe84⤵PID:2628
-
C:\Windows\SysWOW64\Bfcampgf.exeC:\Windows\system32\Bfcampgf.exe85⤵PID:2636
-
C:\Windows\SysWOW64\Bdgafdfp.exeC:\Windows\system32\Bdgafdfp.exe86⤵PID:3016
-
C:\Windows\SysWOW64\Blbfjg32.exeC:\Windows\system32\Blbfjg32.exe87⤵
- Drops file in System32 directory
PID:1152 -
C:\Windows\SysWOW64\Bifgdk32.exeC:\Windows\system32\Bifgdk32.exe88⤵PID:2800
-
C:\Windows\SysWOW64\Bocolb32.exeC:\Windows\system32\Bocolb32.exe89⤵
- Drops file in System32 directory
PID:1044 -
C:\Windows\SysWOW64\Biicik32.exeC:\Windows\system32\Biicik32.exe90⤵PID:1568
-
C:\Windows\SysWOW64\Ckjpacfp.exeC:\Windows\system32\Ckjpacfp.exe91⤵PID:2620
-
C:\Windows\SysWOW64\Ceodnl32.exeC:\Windows\system32\Ceodnl32.exe92⤵PID:1300
-
C:\Windows\SysWOW64\Cdbdjhmp.exeC:\Windows\system32\Cdbdjhmp.exe93⤵PID:684
-
C:\Windows\SysWOW64\Cnkicn32.exeC:\Windows\system32\Cnkicn32.exe94⤵PID:484
-
C:\Windows\SysWOW64\Ceaadk32.exeC:\Windows\system32\Ceaadk32.exe95⤵PID:2860
-
C:\Windows\SysWOW64\Cojema32.exeC:\Windows\system32\Cojema32.exe96⤵PID:1476
-
C:\Windows\SysWOW64\Cdgneh32.exeC:\Windows\system32\Cdgneh32.exe97⤵PID:3064
-
C:\Windows\SysWOW64\Cjdfmo32.exeC:\Windows\system32\Cjdfmo32.exe98⤵
- Modifies registry class
PID:632 -
C:\Windows\SysWOW64\Caknol32.exeC:\Windows\system32\Caknol32.exe99⤵PID:1028
-
C:\Windows\SysWOW64\Cclkfdnc.exeC:\Windows\system32\Cclkfdnc.exe100⤵PID:908
-
C:\Windows\SysWOW64\Cjfccn32.exeC:\Windows\system32\Cjfccn32.exe101⤵PID:760
-
C:\Windows\SysWOW64\Dfmdho32.exeC:\Windows\system32\Dfmdho32.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1256 -
C:\Windows\SysWOW64\Dlgldibq.exeC:\Windows\system32\Dlgldibq.exe103⤵PID:1948
-
C:\Windows\SysWOW64\Dfoqmo32.exeC:\Windows\system32\Dfoqmo32.exe104⤵PID:884
-
C:\Windows\SysWOW64\Dhnmij32.exeC:\Windows\system32\Dhnmij32.exe105⤵PID:1580
-
C:\Windows\SysWOW64\Dbfabp32.exeC:\Windows\system32\Dbfabp32.exe106⤵PID:1652
-
C:\Windows\SysWOW64\Dfamcogo.exeC:\Windows\system32\Dfamcogo.exe107⤵PID:2656
-
C:\Windows\SysWOW64\Dojald32.exeC:\Windows\system32\Dojald32.exe108⤵PID:2752
-
C:\Windows\SysWOW64\Dfdjhndl.exeC:\Windows\system32\Dfdjhndl.exe109⤵PID:2992
-
C:\Windows\SysWOW64\Dolnad32.exeC:\Windows\system32\Dolnad32.exe110⤵PID:2592
-
C:\Windows\SysWOW64\Dnoomqbg.exeC:\Windows\system32\Dnoomqbg.exe111⤵PID:2632
-
C:\Windows\SysWOW64\Dkcofe32.exeC:\Windows\system32\Dkcofe32.exe112⤵PID:1512
-
C:\Windows\SysWOW64\Enakbp32.exeC:\Windows\system32\Enakbp32.exe113⤵PID:2692
-
C:\Windows\SysWOW64\Ekelld32.exeC:\Windows\system32\Ekelld32.exe114⤵PID:1304
-
C:\Windows\SysWOW64\Ejhlgaeh.exeC:\Windows\system32\Ejhlgaeh.exe115⤵PID:2364
-
C:\Windows\SysWOW64\Egllae32.exeC:\Windows\system32\Egllae32.exe116⤵PID:2792
-
C:\Windows\SysWOW64\Ejkima32.exeC:\Windows\system32\Ejkima32.exe117⤵PID:1788
-
C:\Windows\SysWOW64\Eccmffjf.exeC:\Windows\system32\Eccmffjf.exe118⤵
- Drops file in System32 directory
PID:2916 -
C:\Windows\SysWOW64\Enhacojl.exeC:\Windows\system32\Enhacojl.exe119⤵PID:2068
-
C:\Windows\SysWOW64\Ecejkf32.exeC:\Windows\system32\Ecejkf32.exe120⤵PID:320
-
C:\Windows\SysWOW64\Ejobhppq.exeC:\Windows\system32\Ejobhppq.exe121⤵
- Modifies registry class
PID:2396 -
C:\Windows\SysWOW64\Eplkpgnh.exeC:\Windows\system32\Eplkpgnh.exe122⤵PID:2968
-
C:\Windows\SysWOW64\Fjaonpnn.exeC:\Windows\system32\Fjaonpnn.exe123⤵PID:2776
-
C:\Windows\SysWOW64\Fpngfgle.exeC:\Windows\system32\Fpngfgle.exe124⤵PID:2032
-
C:\Windows\SysWOW64\Fbmcbbki.exeC:\Windows\system32\Fbmcbbki.exe125⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2532 -
C:\Windows\SysWOW64\Fmbhok32.exeC:\Windows\system32\Fmbhok32.exe126⤵PID:2552
-
C:\Windows\SysWOW64\Fncdgcqm.exeC:\Windows\system32\Fncdgcqm.exe127⤵PID:2468
-
C:\Windows\SysWOW64\Fiihdlpc.exeC:\Windows\system32\Fiihdlpc.exe128⤵PID:1508
-
C:\Windows\SysWOW64\Flgeqgog.exeC:\Windows\system32\Flgeqgog.exe129⤵PID:2548
-
C:\Windows\SysWOW64\Fadminnn.exeC:\Windows\system32\Fadminnn.exe130⤵PID:1440
-
C:\Windows\SysWOW64\Fhneehek.exeC:\Windows\system32\Fhneehek.exe131⤵PID:288
-
C:\Windows\SysWOW64\Fbdjbaea.exeC:\Windows\system32\Fbdjbaea.exe132⤵PID:2296
-
C:\Windows\SysWOW64\Febfomdd.exeC:\Windows\system32\Febfomdd.exe133⤵PID:2920
-
C:\Windows\SysWOW64\Fnkjhb32.exeC:\Windows\system32\Fnkjhb32.exe134⤵PID:2764
-
C:\Windows\SysWOW64\Faigdn32.exeC:\Windows\system32\Faigdn32.exe135⤵
- Modifies registry class
PID:1956 -
C:\Windows\SysWOW64\Gjakmc32.exeC:\Windows\system32\Gjakmc32.exe136⤵PID:1392
-
C:\Windows\SysWOW64\Gmpgio32.exeC:\Windows\system32\Gmpgio32.exe137⤵PID:880
-
C:\Windows\SysWOW64\Ghelfg32.exeC:\Windows\system32\Ghelfg32.exe138⤵PID:1976
-
C:\Windows\SysWOW64\Gifhnpea.exeC:\Windows\system32\Gifhnpea.exe139⤵PID:2836
-
C:\Windows\SysWOW64\Gfjhgdck.exeC:\Windows\system32\Gfjhgdck.exe140⤵
- Modifies registry class
PID:1980 -
C:\Windows\SysWOW64\Giieco32.exeC:\Windows\system32\Giieco32.exe141⤵PID:2624
-
C:\Windows\SysWOW64\Gdniqh32.exeC:\Windows\system32\Gdniqh32.exe142⤵PID:1812
-
C:\Windows\SysWOW64\Gfmemc32.exeC:\Windows\system32\Gfmemc32.exe143⤵PID:1808
-
C:\Windows\SysWOW64\Gljnej32.exeC:\Windows\system32\Gljnej32.exe144⤵PID:1308
-
C:\Windows\SysWOW64\Gfobbc32.exeC:\Windows\system32\Gfobbc32.exe145⤵PID:584
-
C:\Windows\SysWOW64\Hlljjjnm.exeC:\Windows\system32\Hlljjjnm.exe146⤵PID:1724
-
C:\Windows\SysWOW64\Hpgfki32.exeC:\Windows\system32\Hpgfki32.exe147⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1444 -
C:\Windows\SysWOW64\Hedocp32.exeC:\Windows\system32\Hedocp32.exe148⤵PID:620
-
C:\Windows\SysWOW64\Hlngpjlj.exeC:\Windows\system32\Hlngpjlj.exe149⤵PID:832
-
C:\Windows\SysWOW64\Hakphqja.exeC:\Windows\system32\Hakphqja.exe150⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2328 -
C:\Windows\SysWOW64\Hdildlie.exeC:\Windows\system32\Hdildlie.exe151⤵PID:1340
-
C:\Windows\SysWOW64\Hmbpmapf.exeC:\Windows\system32\Hmbpmapf.exe152⤵PID:2564
-
C:\Windows\SysWOW64\Hanlnp32.exeC:\Windows\system32\Hanlnp32.exe153⤵PID:2820
-
C:\Windows\SysWOW64\Hoamgd32.exeC:\Windows\system32\Hoamgd32.exe154⤵PID:2236
-
C:\Windows\SysWOW64\Hdnepk32.exeC:\Windows\system32\Hdnepk32.exe155⤵PID:2120
-
C:\Windows\SysWOW64\Hiknhbcg.exeC:\Windows\system32\Hiknhbcg.exe156⤵PID:2868
-
C:\Windows\SysWOW64\Habfipdj.exeC:\Windows\system32\Habfipdj.exe157⤵PID:1632
-
C:\Windows\SysWOW64\Igonafba.exeC:\Windows\system32\Igonafba.exe158⤵PID:1656
-
C:\Windows\SysWOW64\Ikkjbe32.exeC:\Windows\system32\Ikkjbe32.exe159⤵PID:2116
-
C:\Windows\SysWOW64\Icfofg32.exeC:\Windows\system32\Icfofg32.exe160⤵PID:1716
-
C:\Windows\SysWOW64\Igakgfpn.exeC:\Windows\system32\Igakgfpn.exe161⤵PID:1048
-
C:\Windows\SysWOW64\Ilncom32.exeC:\Windows\system32\Ilncom32.exe162⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2696 -
C:\Windows\SysWOW64\Iompkh32.exeC:\Windows\system32\Iompkh32.exe163⤵PID:2424
-
C:\Windows\SysWOW64\Iheddndj.exeC:\Windows\system32\Iheddndj.exe164⤵PID:1284
-
C:\Windows\SysWOW64\Ilqpdm32.exeC:\Windows\system32\Ilqpdm32.exe165⤵
- Modifies registry class
PID:1624 -
C:\Windows\SysWOW64\Ihgainbg.exeC:\Windows\system32\Ihgainbg.exe166⤵PID:2484
-
C:\Windows\SysWOW64\Ilcmjl32.exeC:\Windows\system32\Ilcmjl32.exe167⤵PID:764
-
C:\Windows\SysWOW64\Ioaifhid.exeC:\Windows\system32\Ioaifhid.exe168⤵PID:1924
-
C:\Windows\SysWOW64\Ihjnom32.exeC:\Windows\system32\Ihjnom32.exe169⤵PID:3068
-
C:\Windows\SysWOW64\Jocflgga.exeC:\Windows\system32\Jocflgga.exe170⤵PID:2420
-
C:\Windows\SysWOW64\Jfnnha32.exeC:\Windows\system32\Jfnnha32.exe171⤵
- Drops file in System32 directory
PID:2452 -
C:\Windows\SysWOW64\Jgojpjem.exeC:\Windows\system32\Jgojpjem.exe172⤵PID:2664
-
C:\Windows\SysWOW64\Jnicmdli.exeC:\Windows\system32\Jnicmdli.exe173⤵PID:2372
-
C:\Windows\SysWOW64\Jhngjmlo.exeC:\Windows\system32\Jhngjmlo.exe174⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2268 -
C:\Windows\SysWOW64\Jkmcfhkc.exeC:\Windows\system32\Jkmcfhkc.exe175⤵PID:808
-
C:\Windows\SysWOW64\Jdehon32.exeC:\Windows\system32\Jdehon32.exe176⤵PID:868
-
C:\Windows\SysWOW64\Jchhkjhn.exeC:\Windows\system32\Jchhkjhn.exe177⤵PID:1292
-
C:\Windows\SysWOW64\Jmplcp32.exeC:\Windows\system32\Jmplcp32.exe178⤵PID:776
-
C:\Windows\SysWOW64\Jdgdempa.exeC:\Windows\system32\Jdgdempa.exe179⤵PID:2220
-
C:\Windows\SysWOW64\Jjdmmdnh.exeC:\Windows\system32\Jjdmmdnh.exe180⤵PID:1640
-
C:\Windows\SysWOW64\Jmbiipml.exeC:\Windows\system32\Jmbiipml.exe181⤵PID:2852
-
C:\Windows\SysWOW64\Jfknbe32.exeC:\Windows\system32\Jfknbe32.exe182⤵
- Modifies registry class
PID:2936 -
C:\Windows\SysWOW64\Kjfjbdle.exeC:\Windows\system32\Kjfjbdle.exe183⤵PID:1996
-
C:\Windows\SysWOW64\Kocbkk32.exeC:\Windows\system32\Kocbkk32.exe184⤵PID:1328
-
C:\Windows\SysWOW64\Kbbngf32.exeC:\Windows\system32\Kbbngf32.exe185⤵
- Drops file in System32 directory
- Modifies registry class
PID:1320 -
C:\Windows\SysWOW64\Kkjcplpa.exeC:\Windows\system32\Kkjcplpa.exe186⤵PID:2064
-
C:\Windows\SysWOW64\Kcakaipc.exeC:\Windows\system32\Kcakaipc.exe187⤵PID:1916
-
C:\Windows\SysWOW64\Kmjojo32.exeC:\Windows\system32\Kmjojo32.exe188⤵PID:2768
-
C:\Windows\SysWOW64\Kohkfj32.exeC:\Windows\system32\Kohkfj32.exe189⤵PID:2660
-
C:\Windows\SysWOW64\Kfbcbd32.exeC:\Windows\system32\Kfbcbd32.exe190⤵PID:2200
-
C:\Windows\SysWOW64\Kkolkk32.exeC:\Windows\system32\Kkolkk32.exe191⤵PID:1108
-
C:\Windows\SysWOW64\Knmhgf32.exeC:\Windows\system32\Knmhgf32.exe192⤵PID:1932
-
C:\Windows\SysWOW64\Kegqdqbl.exeC:\Windows\system32\Kegqdqbl.exe193⤵PID:2736
-
C:\Windows\SysWOW64\Knpemf32.exeC:\Windows\system32\Knpemf32.exe194⤵
- Drops file in System32 directory
PID:2088 -
C:\Windows\SysWOW64\Leimip32.exeC:\Windows\system32\Leimip32.exe195⤵PID:2324
-
C:\Windows\SysWOW64\Lnbbbffj.exeC:\Windows\system32\Lnbbbffj.exe196⤵PID:2892
-
C:\Windows\SysWOW64\Lmebnb32.exeC:\Windows\system32\Lmebnb32.exe197⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1800 -
C:\Windows\SysWOW64\Lgjfkk32.exeC:\Windows\system32\Lgjfkk32.exe198⤵PID:672
-
C:\Windows\SysWOW64\Ljibgg32.exeC:\Windows\system32\Ljibgg32.exe199⤵PID:1944
-
C:\Windows\SysWOW64\Lpekon32.exeC:\Windows\system32\Lpekon32.exe200⤵PID:2412
-
C:\Windows\SysWOW64\Lgmcqkkh.exeC:\Windows\system32\Lgmcqkkh.exe201⤵PID:3084
-
C:\Windows\SysWOW64\Linphc32.exeC:\Windows\system32\Linphc32.exe202⤵PID:3124
-
C:\Windows\SysWOW64\Lmikibio.exeC:\Windows\system32\Lmikibio.exe203⤵PID:3164
-
C:\Windows\SysWOW64\Lbfdaigg.exeC:\Windows\system32\Lbfdaigg.exe204⤵PID:3204
-
C:\Windows\SysWOW64\Liplnc32.exeC:\Windows\system32\Liplnc32.exe205⤵PID:3244
-
C:\Windows\SysWOW64\Lcfqkl32.exeC:\Windows\system32\Lcfqkl32.exe206⤵PID:3284
-
C:\Windows\SysWOW64\Libicbma.exeC:\Windows\system32\Libicbma.exe207⤵PID:3324
-
C:\Windows\SysWOW64\Mooaljkh.exeC:\Windows\system32\Mooaljkh.exe208⤵PID:3364
-
C:\Windows\SysWOW64\Mffimglk.exeC:\Windows\system32\Mffimglk.exe209⤵PID:3404
-
C:\Windows\SysWOW64\Mlcbenjb.exeC:\Windows\system32\Mlcbenjb.exe210⤵PID:3444
-
C:\Windows\SysWOW64\Moanaiie.exeC:\Windows\system32\Moanaiie.exe211⤵PID:3484
-
C:\Windows\SysWOW64\Mlfojn32.exeC:\Windows\system32\Mlfojn32.exe212⤵PID:3524
-
C:\Windows\SysWOW64\Mkhofjoj.exeC:\Windows\system32\Mkhofjoj.exe213⤵PID:3564
-
C:\Windows\SysWOW64\Mhloponc.exeC:\Windows\system32\Mhloponc.exe214⤵PID:3608
-
C:\Windows\SysWOW64\Mkklljmg.exeC:\Windows\system32\Mkklljmg.exe215⤵PID:3648
-
C:\Windows\SysWOW64\Meppiblm.exeC:\Windows\system32\Meppiblm.exe216⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3688 -
C:\Windows\SysWOW64\Mholen32.exeC:\Windows\system32\Mholen32.exe217⤵PID:3728
-
C:\Windows\SysWOW64\Mmldme32.exeC:\Windows\system32\Mmldme32.exe218⤵PID:3768
-
C:\Windows\SysWOW64\Mpjqiq32.exeC:\Windows\system32\Mpjqiq32.exe219⤵PID:3808
-
C:\Windows\SysWOW64\Ndemjoae.exeC:\Windows\system32\Ndemjoae.exe220⤵PID:3848
-
C:\Windows\SysWOW64\Nibebfpl.exeC:\Windows\system32\Nibebfpl.exe221⤵
- Drops file in System32 directory
PID:3888 -
C:\Windows\SysWOW64\Ngfflj32.exeC:\Windows\system32\Ngfflj32.exe222⤵PID:3928
-
C:\Windows\SysWOW64\Nkbalifo.exeC:\Windows\system32\Nkbalifo.exe223⤵PID:3968
-
C:\Windows\SysWOW64\Ndjfeo32.exeC:\Windows\system32\Ndjfeo32.exe224⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4008 -
C:\Windows\SysWOW64\Ngibaj32.exeC:\Windows\system32\Ngibaj32.exe225⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:4048 -
C:\Windows\SysWOW64\Nmbknddp.exeC:\Windows\system32\Nmbknddp.exe226⤵PID:4088
-
C:\Windows\SysWOW64\Ncpcfkbg.exeC:\Windows\system32\Ncpcfkbg.exe227⤵PID:3120
-
C:\Windows\SysWOW64\Niikceid.exeC:\Windows\system32\Niikceid.exe228⤵
- Modifies registry class
PID:3152 -
C:\Windows\SysWOW64\Nofdklgl.exeC:\Windows\system32\Nofdklgl.exe229⤵PID:3176
-
C:\Windows\SysWOW64\Nilhhdga.exeC:\Windows\system32\Nilhhdga.exe230⤵PID:3264
-
C:\Windows\SysWOW64\Nkmdpm32.exeC:\Windows\system32\Nkmdpm32.exe231⤵PID:3348
-
C:\Windows\SysWOW64\Oebimf32.exeC:\Windows\system32\Oebimf32.exe232⤵
- Drops file in System32 directory
PID:3400 -
C:\Windows\SysWOW64\Okoafmkm.exeC:\Windows\system32\Okoafmkm.exe233⤵PID:3452
-
C:\Windows\SysWOW64\Oeeecekc.exeC:\Windows\system32\Oeeecekc.exe234⤵
- Modifies registry class
PID:3464 -
C:\Windows\SysWOW64\Ohcaoajg.exeC:\Windows\system32\Ohcaoajg.exe235⤵PID:3552
-
C:\Windows\SysWOW64\Oomjlk32.exeC:\Windows\system32\Oomjlk32.exe236⤵PID:3600
-
C:\Windows\SysWOW64\Oalfhf32.exeC:\Windows\system32\Oalfhf32.exe237⤵PID:3664
-
C:\Windows\SysWOW64\Okdkal32.exeC:\Windows\system32\Okdkal32.exe238⤵PID:3712
-
C:\Windows\SysWOW64\Oqacic32.exeC:\Windows\system32\Oqacic32.exe239⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3756 -
C:\Windows\SysWOW64\Ohhkjp32.exeC:\Windows\system32\Ohhkjp32.exe240⤵PID:3816
-
C:\Windows\SysWOW64\Ojigbhlp.exeC:\Windows\system32\Ojigbhlp.exe241⤵PID:3860
-
C:\Windows\SysWOW64\Oqcpob32.exeC:\Windows\system32\Oqcpob32.exe242⤵PID:3900