Analysis
-
max time kernel
139s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 22:09
Behavioral task
behavioral1
Sample
48733e7e178831ab131d4175218946e906c54d87703db470b4e328373955372f.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
48733e7e178831ab131d4175218946e906c54d87703db470b4e328373955372f.exe
Resource
win10v2004-20240508-en
General
-
Target
48733e7e178831ab131d4175218946e906c54d87703db470b4e328373955372f.exe
-
Size
300KB
-
MD5
1feee4797ef4b44b6a9c1e20af7a1700
-
SHA1
b374e7ff28233b6e1dc38ac72fdbed18e43e4142
-
SHA256
48733e7e178831ab131d4175218946e906c54d87703db470b4e328373955372f
-
SHA512
acd32bff8f0d6a3ef0d21adf6f60486efef72b843d927837e0149f39cd9c4174472840cd290109d14900f8e3899fb5ffdcc25f67db35c04c4eb61d707b0a51da
-
SSDEEP
6144:leXrElNCqufhcmoZjwszeXmr8SeNpgdyuH1l+/Wd:UM4ymCjb87g4/c
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Ogblbo32.exeOhfqmi32.exeGegfdb32.exeIgkdgk32.exeNljddpfe.exeHllmcc32.exeNoffdd32.exePgpgjepk.exeGddifnbk.exeHellne32.exeEkcaonhe.exeEcnmpa32.exeGfmgelil.exeOopnlacm.exeMapjmehi.exeModkfi32.exeJhamckel.exeGfkkpmko.exeHnbopmnm.exeFdmhbplb.exeOkanklik.exeCilibi32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ogblbo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ohfqmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gegfdb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igkdgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nljddpfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hllmcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Noffdd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pgpgjepk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gddifnbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hellne32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ekcaonhe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ecnmpa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gfmgelil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oopnlacm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mapjmehi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Modkfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jhamckel.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gfkkpmko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hnbopmnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fdmhbplb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Okanklik.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cilibi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \Windows\SysWOW64\Dcknbh32.exe family_berbew C:\Windows\SysWOW64\Djefobmk.exe family_berbew \Windows\SysWOW64\Ecpgmhai.exe family_berbew C:\Windows\SysWOW64\Eeqdep32.exe family_berbew \Windows\SysWOW64\Egamfkdh.exe family_berbew C:\Windows\SysWOW64\Ebgacddo.exe family_berbew \Windows\SysWOW64\Ebinic32.exe family_berbew \Windows\SysWOW64\Flabbihl.exe family_berbew \Windows\SysWOW64\Fjgoce32.exe family_berbew \Windows\SysWOW64\Fhkpmjln.exe family_berbew \Windows\SysWOW64\Ffpmnf32.exe family_berbew C:\Windows\SysWOW64\Fphafl32.exe family_berbew \Windows\SysWOW64\Globlmmj.exe family_berbew \Windows\SysWOW64\Gegfdb32.exe family_berbew \Windows\SysWOW64\Gbkgnfbd.exe family_berbew C:\Windows\SysWOW64\Gelppaof.exe family_berbew C:\Windows\SysWOW64\Gdamqndn.exe family_berbew C:\Windows\SysWOW64\Gogangdc.exe family_berbew C:\Windows\SysWOW64\Gddifnbk.exe family_berbew C:\Windows\SysWOW64\Hknach32.exe family_berbew C:\Windows\SysWOW64\Hcifgjgc.exe family_berbew C:\Windows\SysWOW64\Hkpnhgge.exe family_berbew C:\Windows\SysWOW64\Hlakpp32.exe family_berbew C:\Windows\SysWOW64\Hiekid32.exe family_berbew C:\Windows\SysWOW64\Hellne32.exe family_berbew C:\Windows\SysWOW64\Hpapln32.exe family_berbew C:\Windows\SysWOW64\Hlhaqogk.exe family_berbew C:\Windows\SysWOW64\Ihoafpmp.exe family_berbew C:\Windows\SysWOW64\Inljnfkg.exe family_berbew C:\Windows\SysWOW64\Iokfhi32.exe family_berbew C:\Windows\SysWOW64\Iqmcpahh.exe family_berbew C:\Windows\SysWOW64\Inqcif32.exe family_berbew C:\Windows\SysWOW64\Ikddbj32.exe family_berbew C:\Windows\SysWOW64\Incpoe32.exe family_berbew C:\Windows\SysWOW64\Igkdgk32.exe family_berbew C:\Windows\SysWOW64\Jofiln32.exe family_berbew behavioral1/memory/3032-433-0x00000000005E0000-0x0000000000622000-memory.dmp family_berbew C:\Windows\SysWOW64\Jjlnif32.exe family_berbew C:\Windows\SysWOW64\Jqfffqpm.exe family_berbew C:\Windows\SysWOW64\Jkpgfn32.exe family_berbew C:\Windows\SysWOW64\Jehkodcm.exe family_berbew C:\Windows\SysWOW64\Jkbcln32.exe family_berbew C:\Windows\SysWOW64\Jfghif32.exe family_berbew C:\Windows\SysWOW64\Jgidao32.exe family_berbew C:\Windows\SysWOW64\Joplbl32.exe family_berbew C:\Windows\SysWOW64\Kemejc32.exe family_berbew C:\Windows\SysWOW64\Kgkafo32.exe family_berbew C:\Windows\SysWOW64\Kbqecg32.exe family_berbew C:\Windows\SysWOW64\Keoapb32.exe family_berbew C:\Windows\SysWOW64\Kgnnln32.exe family_berbew C:\Windows\SysWOW64\Kjljhjkl.exe family_berbew C:\Windows\SysWOW64\Kmjfdejp.exe family_berbew C:\Windows\SysWOW64\Kjnfniii.exe family_berbew C:\Windows\SysWOW64\Knjbnh32.exe family_berbew C:\Windows\SysWOW64\Kahojc32.exe family_berbew C:\Windows\SysWOW64\Kgbggnhc.exe family_berbew C:\Windows\SysWOW64\Kjqccigf.exe family_berbew C:\Windows\SysWOW64\Kaklpcoc.exe family_berbew C:\Windows\SysWOW64\Kcihlong.exe family_berbew C:\Windows\SysWOW64\Kfgdhjmk.exe family_berbew C:\Windows\SysWOW64\Lpphap32.exe family_berbew C:\Windows\SysWOW64\Lemaif32.exe family_berbew C:\Windows\SysWOW64\Llfifq32.exe family_berbew C:\Windows\SysWOW64\Lbqabkql.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
Dcknbh32.exeDjefobmk.exeEcpgmhai.exeEeqdep32.exeEgamfkdh.exeEbgacddo.exeEbinic32.exeFlabbihl.exeFjgoce32.exeFhkpmjln.exeFfpmnf32.exeFphafl32.exeGloblmmj.exeGegfdb32.exeGbkgnfbd.exeGelppaof.exeGdamqndn.exeGogangdc.exeGddifnbk.exeHknach32.exeHcifgjgc.exeHkpnhgge.exeHlakpp32.exeHiekid32.exeHellne32.exeHpapln32.exeHlhaqogk.exeIhoafpmp.exeInljnfkg.exeIokfhi32.exeIqmcpahh.exeInqcif32.exeIkddbj32.exeIncpoe32.exeIgkdgk32.exeJofiln32.exeJjlnif32.exeJqfffqpm.exeJkpgfn32.exeJehkodcm.exeJkbcln32.exeJfghif32.exeJgidao32.exeJoplbl32.exeKemejc32.exeKgkafo32.exeKbqecg32.exeKeoapb32.exeKgnnln32.exeKjljhjkl.exeKmjfdejp.exeKjnfniii.exeKnjbnh32.exeKahojc32.exeKgbggnhc.exeKjqccigf.exeKaklpcoc.exeKcihlong.exeKfgdhjmk.exeLpphap32.exeLemaif32.exeLlfifq32.exeLbqabkql.exeLliflp32.exepid process 896 Dcknbh32.exe 2340 Djefobmk.exe 2756 Ecpgmhai.exe 2780 Eeqdep32.exe 2892 Egamfkdh.exe 2528 Ebgacddo.exe 1704 Ebinic32.exe 2824 Flabbihl.exe 3000 Fjgoce32.exe 1936 Fhkpmjln.exe 1680 Ffpmnf32.exe 2604 Fphafl32.exe 3052 Globlmmj.exe 2516 Gegfdb32.exe 712 Gbkgnfbd.exe 1492 Gelppaof.exe 1668 Gdamqndn.exe 1000 Gogangdc.exe 1908 Gddifnbk.exe 1568 Hknach32.exe 1880 Hcifgjgc.exe 1544 Hkpnhgge.exe 2264 Hlakpp32.exe 284 Hiekid32.exe 892 Hellne32.exe 672 Hpapln32.exe 2136 Hlhaqogk.exe 1768 Ihoafpmp.exe 2916 Inljnfkg.exe 2660 Iokfhi32.exe 2204 Iqmcpahh.exe 2648 Inqcif32.exe 3056 Ikddbj32.exe 2720 Incpoe32.exe 3032 Igkdgk32.exe 1744 Jofiln32.exe 1800 Jjlnif32.exe 1316 Jqfffqpm.exe 1296 Jkpgfn32.exe 2408 Jehkodcm.exe 2852 Jkbcln32.exe 624 Jfghif32.exe 852 Jgidao32.exe 848 Joplbl32.exe 1140 Kemejc32.exe 2028 Kgkafo32.exe 1996 Kbqecg32.exe 640 Keoapb32.exe 1664 Kgnnln32.exe 1440 Kjljhjkl.exe 1696 Kmjfdejp.exe 2428 Kjnfniii.exe 2628 Knjbnh32.exe 2664 Kahojc32.exe 2696 Kgbggnhc.exe 2588 Kjqccigf.exe 3012 Kaklpcoc.exe 2096 Kcihlong.exe 2856 Kfgdhjmk.exe 1040 Lpphap32.exe 1028 Lemaif32.exe 1860 Llfifq32.exe 1304 Lbqabkql.exe 2288 Lliflp32.exe -
Loads dropped DLL 64 IoCs
Processes:
48733e7e178831ab131d4175218946e906c54d87703db470b4e328373955372f.exeDcknbh32.exeDjefobmk.exeEcpgmhai.exeEeqdep32.exeEgamfkdh.exeEbgacddo.exeEbinic32.exeFlabbihl.exeFjgoce32.exeFhkpmjln.exeFfpmnf32.exeFphafl32.exeGloblmmj.exeGegfdb32.exeGbkgnfbd.exeGelppaof.exeGdamqndn.exeGogangdc.exeGddifnbk.exeHknach32.exeHcifgjgc.exeHkpnhgge.exeHlakpp32.exeHiekid32.exeHellne32.exeHenidd32.exeHlhaqogk.exeIhoafpmp.exeInljnfkg.exeIokfhi32.exeIqmcpahh.exepid process 2972 48733e7e178831ab131d4175218946e906c54d87703db470b4e328373955372f.exe 2972 48733e7e178831ab131d4175218946e906c54d87703db470b4e328373955372f.exe 896 Dcknbh32.exe 896 Dcknbh32.exe 2340 Djefobmk.exe 2340 Djefobmk.exe 2756 Ecpgmhai.exe 2756 Ecpgmhai.exe 2780 Eeqdep32.exe 2780 Eeqdep32.exe 2892 Egamfkdh.exe 2892 Egamfkdh.exe 2528 Ebgacddo.exe 2528 Ebgacddo.exe 1704 Ebinic32.exe 1704 Ebinic32.exe 2824 Flabbihl.exe 2824 Flabbihl.exe 3000 Fjgoce32.exe 3000 Fjgoce32.exe 1936 Fhkpmjln.exe 1936 Fhkpmjln.exe 1680 Ffpmnf32.exe 1680 Ffpmnf32.exe 2604 Fphafl32.exe 2604 Fphafl32.exe 3052 Globlmmj.exe 3052 Globlmmj.exe 2516 Gegfdb32.exe 2516 Gegfdb32.exe 712 Gbkgnfbd.exe 712 Gbkgnfbd.exe 1492 Gelppaof.exe 1492 Gelppaof.exe 1668 Gdamqndn.exe 1668 Gdamqndn.exe 1000 Gogangdc.exe 1000 Gogangdc.exe 1908 Gddifnbk.exe 1908 Gddifnbk.exe 1568 Hknach32.exe 1568 Hknach32.exe 1880 Hcifgjgc.exe 1880 Hcifgjgc.exe 1544 Hkpnhgge.exe 1544 Hkpnhgge.exe 2264 Hlakpp32.exe 2264 Hlakpp32.exe 284 Hiekid32.exe 284 Hiekid32.exe 892 Hellne32.exe 892 Hellne32.exe 1616 Henidd32.exe 1616 Henidd32.exe 2136 Hlhaqogk.exe 2136 Hlhaqogk.exe 1768 Ihoafpmp.exe 1768 Ihoafpmp.exe 2916 Inljnfkg.exe 2916 Inljnfkg.exe 2660 Iokfhi32.exe 2660 Iokfhi32.exe 2204 Iqmcpahh.exe 2204 Iqmcpahh.exe -
Drops file in System32 directory 64 IoCs
Processes:
Qbelgood.exeMoidahcn.exeEdccch32.exeBecpap32.exeBlmfea32.exeBpjkiogm.exeEknkpbdf.exeIihfgp32.exeMdcpdp32.exeOdoloalf.exeIkpmpc32.exeKfgdhjmk.exeNcbplk32.exeLkdhoc32.exeHbknkl32.exeGoiehm32.exeJmbiipml.exeAfiglkle.exeEhjehh32.exeKnmamp32.exeGbfiaj32.exeQndigd32.exeCbajkiof.exeMfglep32.exeGelppaof.exeGdllkhdg.exeLmljgj32.exeCffljlpc.exedescription ioc process File created C:\Windows\SysWOW64\Kkgklabn.dll Qbelgood.exe File created C:\Windows\SysWOW64\Magqncba.exe Moidahcn.exe File created C:\Windows\SysWOW64\Ehoocgeb.exe Edccch32.exe File created C:\Windows\SysWOW64\Hckmla32.dll Becpap32.exe File created C:\Windows\SysWOW64\Kbbobkol.exe File created C:\Windows\SysWOW64\Oqelhkhc.dll File created C:\Windows\SysWOW64\Bnkbam32.exe Blmfea32.exe File opened for modification C:\Windows\SysWOW64\Bcegin32.exe Bpjkiogm.exe File opened for modification C:\Windows\SysWOW64\Dcbnpgkh.exe File created C:\Windows\SysWOW64\Albjnplq.exe File created C:\Windows\SysWOW64\Lglbcaph.dll File created C:\Windows\SysWOW64\Enlglnci.exe Eknkpbdf.exe File opened for modification C:\Windows\SysWOW64\Iaonhm32.exe Iihfgp32.exe File created C:\Windows\SysWOW64\Keoabo32.exe File created C:\Windows\SysWOW64\Fgpock32.exe File created C:\Windows\SysWOW64\Ajhddk32.exe File created C:\Windows\SysWOW64\Mjkacaml.dll Mdcpdp32.exe File created C:\Windows\SysWOW64\Faflglmh.dll Odoloalf.exe File created C:\Windows\SysWOW64\Pgnlcdfj.dll Ikpmpc32.exe File opened for modification C:\Windows\SysWOW64\Jajmjcoe.exe File opened for modification C:\Windows\SysWOW64\Baqhapdj.exe File opened for modification C:\Windows\SysWOW64\Ehfhgogp.exe File created C:\Windows\SysWOW64\Lpphap32.exe Kfgdhjmk.exe File created C:\Windows\SysWOW64\Eokgij32.exe File opened for modification C:\Windows\SysWOW64\Neplhf32.exe Ncbplk32.exe File opened for modification C:\Windows\SysWOW64\Lbnpkmfg.exe Lkdhoc32.exe File created C:\Windows\SysWOW64\Bgefgpha.dll File created C:\Windows\SysWOW64\Elkofg32.exe File created C:\Windows\SysWOW64\Hhmhcigh.exe File created C:\Windows\SysWOW64\Miapbpmb.exe File created C:\Windows\SysWOW64\Mmblckok.dll Hbknkl32.exe File created C:\Windows\SysWOW64\Hedbmpnc.dll Goiehm32.exe File opened for modification C:\Windows\SysWOW64\Jagpdd32.exe File opened for modification C:\Windows\SysWOW64\Oingii32.exe File created C:\Windows\SysWOW64\Aioodg32.exe File opened for modification C:\Windows\SysWOW64\Qlggjlep.exe File created C:\Windows\SysWOW64\Ffcnqe32.dll File created C:\Windows\SysWOW64\Pnbogaqb.dll File created C:\Windows\SysWOW64\Epecke32.dll Jmbiipml.exe File created C:\Windows\SysWOW64\Hpggbq32.dll Afiglkle.exe File created C:\Windows\SysWOW64\Ibkhak32.dll Ehjehh32.exe File created C:\Windows\SysWOW64\Adhffc32.dll Knmamp32.exe File opened for modification C:\Windows\SysWOW64\Qobdgo32.exe File opened for modification C:\Windows\SysWOW64\Pbajbi32.exe File created C:\Windows\SysWOW64\Dihoofcd.dll File created C:\Windows\SysWOW64\Jmgfgham.exe File created C:\Windows\SysWOW64\Ggcaiqhj.exe Gbfiaj32.exe File created C:\Windows\SysWOW64\Gbnenk32.exe File created C:\Windows\SysWOW64\Bpecpkfk.dll File opened for modification C:\Windows\SysWOW64\Qcqaok32.exe Qndigd32.exe File opened for modification C:\Windows\SysWOW64\Cikbhc32.exe Cbajkiof.exe File opened for modification C:\Windows\SysWOW64\Mpopnejo.exe Mfglep32.exe File opened for modification C:\Windows\SysWOW64\Ldgnklmi.exe File created C:\Windows\SysWOW64\Gdamqndn.exe Gelppaof.exe File created C:\Windows\SysWOW64\Dcibhnqq.dll File opened for modification C:\Windows\SysWOW64\Phgannal.exe File opened for modification C:\Windows\SysWOW64\Ipqicdim.exe File created C:\Windows\SysWOW64\Gfjhgdck.exe Gdllkhdg.exe File opened for modification C:\Windows\SysWOW64\Lokgcf32.exe Lmljgj32.exe File opened for modification C:\Windows\SysWOW64\Jfohgepi.exe File created C:\Windows\SysWOW64\Oomlfpdi.exe File opened for modification C:\Windows\SysWOW64\Cmpdgf32.exe Cffljlpc.exe File created C:\Windows\SysWOW64\Hailie32.dll File opened for modification C:\Windows\SysWOW64\Baneak32.exe -
Program crash 1 IoCs
Processes:
pid pid_target process target process 5116 3544 -
Modifies registry class 64 IoCs
Processes:
Bgffhkoj.exePbfpik32.exeHiekid32.exeQbbhgi32.exeJkpbdq32.exeHkpnhgge.exeIipiljgf.exeEkcaonhe.exeCpfdhl32.exeMjpkqonj.exeGbjlaplk.exeMcegmm32.exeEklqcl32.exeHlhaqogk.exeMcnpojca.exeIhoafpmp.exeCdlgpgef.exeIhjnom32.exeKemejc32.exeGdkgkcpq.exePkjmoj32.exeGbnflo32.exeFphafl32.exeGbfiaj32.exeFfmkfifa.exeBaigca32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbfflo32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bgffhkoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojmklbll.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlkaaf32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kaplbi32.dll" Pbfpik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pahokg32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pljpdpao.dll" Hiekid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qbbhgi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jkpbdq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdakoaln.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hkpnhgge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnjghm32.dll" Iipiljgf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ekcaonhe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajflifmi.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmfejo32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eccjnnqk.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iddpheep.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cpfdhl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mjpkqonj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmlfpfpl.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gbjlaplk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mcegmm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eklqcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gonakpgj.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amammd32.dll" Hlhaqogk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnklgh32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mcnpojca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nalmek32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdnaob32.dll" Ihoafpmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbgpffch.dll" Cdlgpgef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mecjiaic.dll" Ihjnom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdibkoon.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okhjcncb.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kemejc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfhakqek.dll" Gdkgkcpq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpdhdajp.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pkjmoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgilllcm.dll" Gbnflo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkfhfpel.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpqpdnop.dll" Fphafl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nabkgh32.dll" Gbfiaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ffmkfifa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kneino32.dll" Baigca32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
48733e7e178831ab131d4175218946e906c54d87703db470b4e328373955372f.exeDcknbh32.exeDjefobmk.exeEcpgmhai.exeEeqdep32.exeEgamfkdh.exeEbgacddo.exeEbinic32.exeFlabbihl.exeFjgoce32.exeFhkpmjln.exeFfpmnf32.exeFphafl32.exeGloblmmj.exeGegfdb32.exeGbkgnfbd.exedescription pid process target process PID 2972 wrote to memory of 896 2972 48733e7e178831ab131d4175218946e906c54d87703db470b4e328373955372f.exe Dcknbh32.exe PID 2972 wrote to memory of 896 2972 48733e7e178831ab131d4175218946e906c54d87703db470b4e328373955372f.exe Dcknbh32.exe PID 2972 wrote to memory of 896 2972 48733e7e178831ab131d4175218946e906c54d87703db470b4e328373955372f.exe Dcknbh32.exe PID 2972 wrote to memory of 896 2972 48733e7e178831ab131d4175218946e906c54d87703db470b4e328373955372f.exe Dcknbh32.exe PID 896 wrote to memory of 2340 896 Dcknbh32.exe Djefobmk.exe PID 896 wrote to memory of 2340 896 Dcknbh32.exe Djefobmk.exe PID 896 wrote to memory of 2340 896 Dcknbh32.exe Djefobmk.exe PID 896 wrote to memory of 2340 896 Dcknbh32.exe Djefobmk.exe PID 2340 wrote to memory of 2756 2340 Djefobmk.exe Ecpgmhai.exe PID 2340 wrote to memory of 2756 2340 Djefobmk.exe Ecpgmhai.exe PID 2340 wrote to memory of 2756 2340 Djefobmk.exe Ecpgmhai.exe PID 2340 wrote to memory of 2756 2340 Djefobmk.exe Ecpgmhai.exe PID 2756 wrote to memory of 2780 2756 Ecpgmhai.exe Eeqdep32.exe PID 2756 wrote to memory of 2780 2756 Ecpgmhai.exe Eeqdep32.exe PID 2756 wrote to memory of 2780 2756 Ecpgmhai.exe Eeqdep32.exe PID 2756 wrote to memory of 2780 2756 Ecpgmhai.exe Eeqdep32.exe PID 2780 wrote to memory of 2892 2780 Eeqdep32.exe Egamfkdh.exe PID 2780 wrote to memory of 2892 2780 Eeqdep32.exe Egamfkdh.exe PID 2780 wrote to memory of 2892 2780 Eeqdep32.exe Egamfkdh.exe PID 2780 wrote to memory of 2892 2780 Eeqdep32.exe Egamfkdh.exe PID 2892 wrote to memory of 2528 2892 Egamfkdh.exe Ebgacddo.exe PID 2892 wrote to memory of 2528 2892 Egamfkdh.exe Ebgacddo.exe PID 2892 wrote to memory of 2528 2892 Egamfkdh.exe Ebgacddo.exe PID 2892 wrote to memory of 2528 2892 Egamfkdh.exe Ebgacddo.exe PID 2528 wrote to memory of 1704 2528 Ebgacddo.exe Ebinic32.exe PID 2528 wrote to memory of 1704 2528 Ebgacddo.exe Ebinic32.exe PID 2528 wrote to memory of 1704 2528 Ebgacddo.exe Ebinic32.exe PID 2528 wrote to memory of 1704 2528 Ebgacddo.exe Ebinic32.exe PID 1704 wrote to memory of 2824 1704 Ebinic32.exe Flabbihl.exe PID 1704 wrote to memory of 2824 1704 Ebinic32.exe Flabbihl.exe PID 1704 wrote to memory of 2824 1704 Ebinic32.exe Flabbihl.exe PID 1704 wrote to memory of 2824 1704 Ebinic32.exe Flabbihl.exe PID 2824 wrote to memory of 3000 2824 Flabbihl.exe Fjgoce32.exe PID 2824 wrote to memory of 3000 2824 Flabbihl.exe Fjgoce32.exe PID 2824 wrote to memory of 3000 2824 Flabbihl.exe Fjgoce32.exe PID 2824 wrote to memory of 3000 2824 Flabbihl.exe Fjgoce32.exe PID 3000 wrote to memory of 1936 3000 Fjgoce32.exe Fhkpmjln.exe PID 3000 wrote to memory of 1936 3000 Fjgoce32.exe Fhkpmjln.exe PID 3000 wrote to memory of 1936 3000 Fjgoce32.exe Fhkpmjln.exe PID 3000 wrote to memory of 1936 3000 Fjgoce32.exe Fhkpmjln.exe PID 1936 wrote to memory of 1680 1936 Fhkpmjln.exe Ffpmnf32.exe PID 1936 wrote to memory of 1680 1936 Fhkpmjln.exe Ffpmnf32.exe PID 1936 wrote to memory of 1680 1936 Fhkpmjln.exe Ffpmnf32.exe PID 1936 wrote to memory of 1680 1936 Fhkpmjln.exe Ffpmnf32.exe PID 1680 wrote to memory of 2604 1680 Ffpmnf32.exe Fphafl32.exe PID 1680 wrote to memory of 2604 1680 Ffpmnf32.exe Fphafl32.exe PID 1680 wrote to memory of 2604 1680 Ffpmnf32.exe Fphafl32.exe PID 1680 wrote to memory of 2604 1680 Ffpmnf32.exe Fphafl32.exe PID 2604 wrote to memory of 3052 2604 Fphafl32.exe Globlmmj.exe PID 2604 wrote to memory of 3052 2604 Fphafl32.exe Globlmmj.exe PID 2604 wrote to memory of 3052 2604 Fphafl32.exe Globlmmj.exe PID 2604 wrote to memory of 3052 2604 Fphafl32.exe Globlmmj.exe PID 3052 wrote to memory of 2516 3052 Globlmmj.exe Gegfdb32.exe PID 3052 wrote to memory of 2516 3052 Globlmmj.exe Gegfdb32.exe PID 3052 wrote to memory of 2516 3052 Globlmmj.exe Gegfdb32.exe PID 3052 wrote to memory of 2516 3052 Globlmmj.exe Gegfdb32.exe PID 2516 wrote to memory of 712 2516 Gegfdb32.exe Gbkgnfbd.exe PID 2516 wrote to memory of 712 2516 Gegfdb32.exe Gbkgnfbd.exe PID 2516 wrote to memory of 712 2516 Gegfdb32.exe Gbkgnfbd.exe PID 2516 wrote to memory of 712 2516 Gegfdb32.exe Gbkgnfbd.exe PID 712 wrote to memory of 1492 712 Gbkgnfbd.exe Gelppaof.exe PID 712 wrote to memory of 1492 712 Gbkgnfbd.exe Gelppaof.exe PID 712 wrote to memory of 1492 712 Gbkgnfbd.exe Gelppaof.exe PID 712 wrote to memory of 1492 712 Gbkgnfbd.exe Gelppaof.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48733e7e178831ab131d4175218946e906c54d87703db470b4e328373955372f.exe"C:\Users\Admin\AppData\Local\Temp\48733e7e178831ab131d4175218946e906c54d87703db470b4e328373955372f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\Dcknbh32.exeC:\Windows\system32\Dcknbh32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\Djefobmk.exeC:\Windows\system32\Djefobmk.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\Ecpgmhai.exeC:\Windows\system32\Ecpgmhai.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\Eeqdep32.exeC:\Windows\system32\Eeqdep32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\Egamfkdh.exeC:\Windows\system32\Egamfkdh.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\Ebgacddo.exeC:\Windows\system32\Ebgacddo.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\Ebinic32.exeC:\Windows\system32\Ebinic32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\Flabbihl.exeC:\Windows\system32\Flabbihl.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\Fjgoce32.exeC:\Windows\system32\Fjgoce32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\Fhkpmjln.exeC:\Windows\system32\Fhkpmjln.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\Ffpmnf32.exeC:\Windows\system32\Ffpmnf32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\Fphafl32.exeC:\Windows\system32\Fphafl32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\Globlmmj.exeC:\Windows\system32\Globlmmj.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\Gegfdb32.exeC:\Windows\system32\Gegfdb32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\Gbkgnfbd.exeC:\Windows\system32\Gbkgnfbd.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\Gelppaof.exeC:\Windows\system32\Gelppaof.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1492 -
C:\Windows\SysWOW64\Gdamqndn.exeC:\Windows\system32\Gdamqndn.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Windows\SysWOW64\Gogangdc.exeC:\Windows\system32\Gogangdc.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1000 -
C:\Windows\SysWOW64\Gddifnbk.exeC:\Windows\system32\Gddifnbk.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Windows\SysWOW64\Hknach32.exeC:\Windows\system32\Hknach32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Windows\SysWOW64\Hcifgjgc.exeC:\Windows\system32\Hcifgjgc.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Windows\SysWOW64\Hkpnhgge.exeC:\Windows\system32\Hkpnhgge.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1544 -
C:\Windows\SysWOW64\Hlakpp32.exeC:\Windows\system32\Hlakpp32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Windows\SysWOW64\Hiekid32.exeC:\Windows\system32\Hiekid32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:284 -
C:\Windows\SysWOW64\Hellne32.exeC:\Windows\system32\Hellne32.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Windows\SysWOW64\Hpapln32.exeC:\Windows\system32\Hpapln32.exe27⤵
- Executes dropped EXE
PID:672 -
C:\Windows\SysWOW64\Henidd32.exeC:\Windows\system32\Henidd32.exe28⤵
- Loads dropped DLL
PID:1616 -
C:\Windows\SysWOW64\Hlhaqogk.exeC:\Windows\system32\Hlhaqogk.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2136 -
C:\Windows\SysWOW64\Ihoafpmp.exeC:\Windows\system32\Ihoafpmp.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1768 -
C:\Windows\SysWOW64\Inljnfkg.exeC:\Windows\system32\Inljnfkg.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Windows\SysWOW64\Iokfhi32.exeC:\Windows\system32\Iokfhi32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Windows\SysWOW64\Iqmcpahh.exeC:\Windows\system32\Iqmcpahh.exe33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Windows\SysWOW64\Inqcif32.exeC:\Windows\system32\Inqcif32.exe34⤵
- Executes dropped EXE
PID:2648 -
C:\Windows\SysWOW64\Ikddbj32.exeC:\Windows\system32\Ikddbj32.exe35⤵
- Executes dropped EXE
PID:3056 -
C:\Windows\SysWOW64\Incpoe32.exeC:\Windows\system32\Incpoe32.exe36⤵
- Executes dropped EXE
PID:2720 -
C:\Windows\SysWOW64\Igkdgk32.exeC:\Windows\system32\Igkdgk32.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3032 -
C:\Windows\SysWOW64\Jofiln32.exeC:\Windows\system32\Jofiln32.exe38⤵
- Executes dropped EXE
PID:1744 -
C:\Windows\SysWOW64\Jjlnif32.exeC:\Windows\system32\Jjlnif32.exe39⤵
- Executes dropped EXE
PID:1800 -
C:\Windows\SysWOW64\Jqfffqpm.exeC:\Windows\system32\Jqfffqpm.exe40⤵
- Executes dropped EXE
PID:1316 -
C:\Windows\SysWOW64\Jkpgfn32.exeC:\Windows\system32\Jkpgfn32.exe41⤵
- Executes dropped EXE
PID:1296 -
C:\Windows\SysWOW64\Jehkodcm.exeC:\Windows\system32\Jehkodcm.exe42⤵
- Executes dropped EXE
PID:2408 -
C:\Windows\SysWOW64\Jkbcln32.exeC:\Windows\system32\Jkbcln32.exe43⤵
- Executes dropped EXE
PID:2852 -
C:\Windows\SysWOW64\Jfghif32.exeC:\Windows\system32\Jfghif32.exe44⤵
- Executes dropped EXE
PID:624 -
C:\Windows\SysWOW64\Jgidao32.exeC:\Windows\system32\Jgidao32.exe45⤵
- Executes dropped EXE
PID:852 -
C:\Windows\SysWOW64\Joplbl32.exeC:\Windows\system32\Joplbl32.exe46⤵
- Executes dropped EXE
PID:848 -
C:\Windows\SysWOW64\Kemejc32.exeC:\Windows\system32\Kemejc32.exe47⤵
- Executes dropped EXE
- Modifies registry class
PID:1140 -
C:\Windows\SysWOW64\Kgkafo32.exeC:\Windows\system32\Kgkafo32.exe48⤵
- Executes dropped EXE
PID:2028 -
C:\Windows\SysWOW64\Kbqecg32.exeC:\Windows\system32\Kbqecg32.exe49⤵
- Executes dropped EXE
PID:1996 -
C:\Windows\SysWOW64\Keoapb32.exeC:\Windows\system32\Keoapb32.exe50⤵
- Executes dropped EXE
PID:640 -
C:\Windows\SysWOW64\Kgnnln32.exeC:\Windows\system32\Kgnnln32.exe51⤵
- Executes dropped EXE
PID:1664 -
C:\Windows\SysWOW64\Kjljhjkl.exeC:\Windows\system32\Kjljhjkl.exe52⤵
- Executes dropped EXE
PID:1440 -
C:\Windows\SysWOW64\Kmjfdejp.exeC:\Windows\system32\Kmjfdejp.exe53⤵
- Executes dropped EXE
PID:1696 -
C:\Windows\SysWOW64\Kjnfniii.exeC:\Windows\system32\Kjnfniii.exe54⤵
- Executes dropped EXE
PID:2428 -
C:\Windows\SysWOW64\Knjbnh32.exeC:\Windows\system32\Knjbnh32.exe55⤵
- Executes dropped EXE
PID:2628 -
C:\Windows\SysWOW64\Kahojc32.exeC:\Windows\system32\Kahojc32.exe56⤵
- Executes dropped EXE
PID:2664 -
C:\Windows\SysWOW64\Kgbggnhc.exeC:\Windows\system32\Kgbggnhc.exe57⤵
- Executes dropped EXE
PID:2696 -
C:\Windows\SysWOW64\Kjqccigf.exeC:\Windows\system32\Kjqccigf.exe58⤵
- Executes dropped EXE
PID:2588 -
C:\Windows\SysWOW64\Kaklpcoc.exeC:\Windows\system32\Kaklpcoc.exe59⤵
- Executes dropped EXE
PID:3012 -
C:\Windows\SysWOW64\Kcihlong.exeC:\Windows\system32\Kcihlong.exe60⤵
- Executes dropped EXE
PID:2096 -
C:\Windows\SysWOW64\Kfgdhjmk.exeC:\Windows\system32\Kfgdhjmk.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2856 -
C:\Windows\SysWOW64\Lpphap32.exeC:\Windows\system32\Lpphap32.exe62⤵
- Executes dropped EXE
PID:1040 -
C:\Windows\SysWOW64\Lemaif32.exeC:\Windows\system32\Lemaif32.exe63⤵
- Executes dropped EXE
PID:1028 -
C:\Windows\SysWOW64\Llfifq32.exeC:\Windows\system32\Llfifq32.exe64⤵
- Executes dropped EXE
PID:1860 -
C:\Windows\SysWOW64\Lbqabkql.exeC:\Windows\system32\Lbqabkql.exe65⤵
- Executes dropped EXE
PID:1304 -
C:\Windows\SysWOW64\Lliflp32.exeC:\Windows\system32\Lliflp32.exe66⤵
- Executes dropped EXE
PID:2288 -
C:\Windows\SysWOW64\Lbcnhjnj.exeC:\Windows\system32\Lbcnhjnj.exe67⤵PID:1928
-
C:\Windows\SysWOW64\Leajdfnm.exeC:\Windows\system32\Leajdfnm.exe68⤵PID:1144
-
C:\Windows\SysWOW64\Lkncmmle.exeC:\Windows\system32\Lkncmmle.exe69⤵PID:2016
-
C:\Windows\SysWOW64\Lahkigca.exeC:\Windows\system32\Lahkigca.exe70⤵PID:1044
-
C:\Windows\SysWOW64\Ldfgebbe.exeC:\Windows\system32\Ldfgebbe.exe71⤵PID:1644
-
C:\Windows\SysWOW64\Lkppbl32.exeC:\Windows\system32\Lkppbl32.exe72⤵PID:2448
-
C:\Windows\SysWOW64\Lajhofao.exeC:\Windows\system32\Lajhofao.exe73⤵PID:2044
-
C:\Windows\SysWOW64\Mkclhl32.exeC:\Windows\system32\Mkclhl32.exe74⤵PID:1736
-
C:\Windows\SysWOW64\Mhgmapfi.exeC:\Windows\system32\Mhgmapfi.exe75⤵PID:2284
-
C:\Windows\SysWOW64\Mkeimlfm.exeC:\Windows\system32\Mkeimlfm.exe76⤵PID:2192
-
C:\Windows\SysWOW64\Mmceigep.exeC:\Windows\system32\Mmceigep.exe77⤵PID:2596
-
C:\Windows\SysWOW64\Mpbaebdd.exeC:\Windows\system32\Mpbaebdd.exe78⤵PID:1572
-
C:\Windows\SysWOW64\Mgljbm32.exeC:\Windows\system32\Mgljbm32.exe79⤵PID:3048
-
C:\Windows\SysWOW64\Mmfbogcn.exeC:\Windows\system32\Mmfbogcn.exe80⤵PID:2412
-
C:\Windows\SysWOW64\Mdpjlajk.exeC:\Windows\system32\Mdpjlajk.exe81⤵PID:2836
-
C:\Windows\SysWOW64\Meagci32.exeC:\Windows\system32\Meagci32.exe82⤵PID:1560
-
C:\Windows\SysWOW64\Mlkopcge.exeC:\Windows\system32\Mlkopcge.exe83⤵PID:1268
-
C:\Windows\SysWOW64\Mcegmm32.exeC:\Windows\system32\Mcegmm32.exe84⤵
- Modifies registry class
PID:2988 -
C:\Windows\SysWOW64\Miooigfo.exeC:\Windows\system32\Miooigfo.exe85⤵PID:1356
-
C:\Windows\SysWOW64\Mpigfa32.exeC:\Windows\system32\Mpigfa32.exe86⤵PID:912
-
C:\Windows\SysWOW64\Ncgdbmmp.exeC:\Windows\system32\Ncgdbmmp.exe87⤵PID:1988
-
C:\Windows\SysWOW64\Nefpnhlc.exeC:\Windows\system32\Nefpnhlc.exe88⤵PID:2984
-
C:\Windows\SysWOW64\Nhdlkdkg.exeC:\Windows\system32\Nhdlkdkg.exe89⤵PID:1592
-
C:\Windows\SysWOW64\Nkbhgojk.exeC:\Windows\system32\Nkbhgojk.exe90⤵PID:2752
-
C:\Windows\SysWOW64\Nondgn32.exeC:\Windows\system32\Nondgn32.exe91⤵PID:2760
-
C:\Windows\SysWOW64\Namqci32.exeC:\Windows\system32\Namqci32.exe92⤵PID:2568
-
C:\Windows\SysWOW64\Ndkmpe32.exeC:\Windows\system32\Ndkmpe32.exe93⤵PID:2472
-
C:\Windows\SysWOW64\Noqamn32.exeC:\Windows\system32\Noqamn32.exe94⤵PID:2868
-
C:\Windows\SysWOW64\Naoniipe.exeC:\Windows\system32\Naoniipe.exe95⤵PID:3004
-
C:\Windows\SysWOW64\Nejiih32.exeC:\Windows\system32\Nejiih32.exe96⤵PID:1836
-
C:\Windows\SysWOW64\Nglfapnl.exeC:\Windows\system32\Nglfapnl.exe97⤵PID:1636
-
C:\Windows\SysWOW64\Nocnbmoo.exeC:\Windows\system32\Nocnbmoo.exe98⤵PID:2932
-
C:\Windows\SysWOW64\Naajoinb.exeC:\Windows\system32\Naajoinb.exe99⤵PID:348
-
C:\Windows\SysWOW64\Npdjje32.exeC:\Windows\system32\Npdjje32.exe100⤵PID:2368
-
C:\Windows\SysWOW64\Nhkbkc32.exeC:\Windows\system32\Nhkbkc32.exe101⤵PID:1788
-
C:\Windows\SysWOW64\Nkiogn32.exeC:\Windows\system32\Nkiogn32.exe102⤵PID:964
-
C:\Windows\SysWOW64\Nacgdhlp.exeC:\Windows\system32\Nacgdhlp.exe103⤵PID:568
-
C:\Windows\SysWOW64\Ndbcpd32.exeC:\Windows\system32\Ndbcpd32.exe104⤵PID:2348
-
C:\Windows\SysWOW64\Oklkmnbp.exeC:\Windows\system32\Oklkmnbp.exe105⤵PID:1604
-
C:\Windows\SysWOW64\Oqideepg.exeC:\Windows\system32\Oqideepg.exe106⤵PID:2668
-
C:\Windows\SysWOW64\Ogblbo32.exeC:\Windows\system32\Ogblbo32.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1200 -
C:\Windows\SysWOW64\Onmdoioa.exeC:\Windows\system32\Onmdoioa.exe108⤵PID:3016
-
C:\Windows\SysWOW64\Oonafa32.exeC:\Windows\system32\Oonafa32.exe109⤵PID:2848
-
C:\Windows\SysWOW64\Ofhick32.exeC:\Windows\system32\Ofhick32.exe110⤵PID:1828
-
C:\Windows\SysWOW64\Ohfeog32.exeC:\Windows\system32\Ohfeog32.exe111⤵PID:1036
-
C:\Windows\SysWOW64\Oopnlacm.exeC:\Windows\system32\Oopnlacm.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2228 -
C:\Windows\SysWOW64\Ofjfhk32.exeC:\Windows\system32\Ofjfhk32.exe113⤵PID:2036
-
C:\Windows\SysWOW64\Okgnab32.exeC:\Windows\system32\Okgnab32.exe114⤵PID:1692
-
C:\Windows\SysWOW64\Ofmbnkhg.exeC:\Windows\system32\Ofmbnkhg.exe115⤵PID:2296
-
C:\Windows\SysWOW64\Oikojfgk.exeC:\Windows\system32\Oikojfgk.exe116⤵PID:1328
-
C:\Windows\SysWOW64\Onhgbmfb.exeC:\Windows\system32\Onhgbmfb.exe117⤵PID:2748
-
C:\Windows\SysWOW64\Pfoocjfd.exeC:\Windows\system32\Pfoocjfd.exe118⤵PID:2804
-
C:\Windows\SysWOW64\Pgplkb32.exeC:\Windows\system32\Pgplkb32.exe119⤵PID:2672
-
C:\Windows\SysWOW64\Pogclp32.exeC:\Windows\system32\Pogclp32.exe120⤵PID:2832
-
C:\Windows\SysWOW64\Pbfpik32.exeC:\Windows\system32\Pbfpik32.exe121⤵
- Modifies registry class
PID:1052 -
C:\Windows\SysWOW64\Pedleg32.exeC:\Windows\system32\Pedleg32.exe122⤵PID:2256
-
C:\Windows\SysWOW64\Pgbhabjp.exeC:\Windows\system32\Pgbhabjp.exe123⤵PID:784
-
C:\Windows\SysWOW64\Pjadmnic.exeC:\Windows\system32\Pjadmnic.exe124⤵PID:2336
-
C:\Windows\SysWOW64\Pnlqnl32.exeC:\Windows\system32\Pnlqnl32.exe125⤵PID:2000
-
C:\Windows\SysWOW64\Pqkmjh32.exeC:\Windows\system32\Pqkmjh32.exe126⤵PID:2372
-
C:\Windows\SysWOW64\Pciifc32.exeC:\Windows\system32\Pciifc32.exe127⤵PID:2480
-
C:\Windows\SysWOW64\Pnomcl32.exeC:\Windows\system32\Pnomcl32.exe128⤵PID:2908
-
C:\Windows\SysWOW64\Pamiog32.exeC:\Windows\system32\Pamiog32.exe129⤵PID:2564
-
C:\Windows\SysWOW64\Pclfkc32.exeC:\Windows\system32\Pclfkc32.exe130⤵PID:2416
-
C:\Windows\SysWOW64\Pfjbgnme.exeC:\Windows\system32\Pfjbgnme.exe131⤵PID:1060
-
C:\Windows\SysWOW64\Pmdjdh32.exeC:\Windows\system32\Pmdjdh32.exe132⤵PID:2088
-
C:\Windows\SysWOW64\Papfegmk.exeC:\Windows\system32\Papfegmk.exe133⤵PID:2996
-
C:\Windows\SysWOW64\Pgioaa32.exeC:\Windows\system32\Pgioaa32.exe134⤵PID:1552
-
C:\Windows\SysWOW64\Qpecfc32.exeC:\Windows\system32\Qpecfc32.exe135⤵PID:2616
-
C:\Windows\SysWOW64\Qbcpbo32.exeC:\Windows\system32\Qbcpbo32.exe136⤵PID:2004
-
C:\Windows\SysWOW64\Qimhoi32.exeC:\Windows\system32\Qimhoi32.exe137⤵PID:1352
-
C:\Windows\SysWOW64\Qbelgood.exeC:\Windows\system32\Qbelgood.exe138⤵
- Drops file in System32 directory
PID:2184 -
C:\Windows\SysWOW64\Qedhdjnh.exeC:\Windows\system32\Qedhdjnh.exe139⤵PID:2236
-
C:\Windows\SysWOW64\Alnqqd32.exeC:\Windows\system32\Alnqqd32.exe140⤵PID:2864
-
C:\Windows\SysWOW64\Abhimnma.exeC:\Windows\system32\Abhimnma.exe141⤵PID:3020
-
C:\Windows\SysWOW64\Ahdaee32.exeC:\Windows\system32\Ahdaee32.exe142⤵PID:2828
-
C:\Windows\SysWOW64\Alpmfdcb.exeC:\Windows\system32\Alpmfdcb.exe143⤵PID:376
-
C:\Windows\SysWOW64\Abjebn32.exeC:\Windows\system32\Abjebn32.exe144⤵PID:2120
-
C:\Windows\SysWOW64\Aehboi32.exeC:\Windows\system32\Aehboi32.exe145⤵PID:2168
-
C:\Windows\SysWOW64\Abmbhn32.exeC:\Windows\system32\Abmbhn32.exe146⤵PID:1804
-
C:\Windows\SysWOW64\Adnopfoj.exeC:\Windows\system32\Adnopfoj.exe147⤵PID:1640
-
C:\Windows\SysWOW64\Alegac32.exeC:\Windows\system32\Alegac32.exe148⤵PID:960
-
C:\Windows\SysWOW64\Anccmo32.exeC:\Windows\system32\Anccmo32.exe149⤵PID:2432
-
C:\Windows\SysWOW64\Adpkee32.exeC:\Windows\system32\Adpkee32.exe150⤵PID:2736
-
C:\Windows\SysWOW64\Afohaa32.exeC:\Windows\system32\Afohaa32.exe151⤵PID:2548
-
C:\Windows\SysWOW64\Bpgljfbl.exeC:\Windows\system32\Bpgljfbl.exe152⤵PID:1980
-
C:\Windows\SysWOW64\Bfadgq32.exeC:\Windows\system32\Bfadgq32.exe153⤵PID:1832
-
C:\Windows\SysWOW64\Bpiipf32.exeC:\Windows\system32\Bpiipf32.exe154⤵PID:2032
-
C:\Windows\SysWOW64\Bkommo32.exeC:\Windows\system32\Bkommo32.exe155⤵PID:556
-
C:\Windows\SysWOW64\Blpjegfm.exeC:\Windows\system32\Blpjegfm.exe156⤵PID:1464
-
C:\Windows\SysWOW64\Bbjbaa32.exeC:\Windows\system32\Bbjbaa32.exe157⤵PID:1400
-
C:\Windows\SysWOW64\Bidjnkdg.exeC:\Windows\system32\Bidjnkdg.exe158⤵PID:2488
-
C:\Windows\SysWOW64\Boqbfb32.exeC:\Windows\system32\Boqbfb32.exe159⤵PID:2600
-
C:\Windows\SysWOW64\Bghjhp32.exeC:\Windows\system32\Bghjhp32.exe160⤵PID:2712
-
C:\Windows\SysWOW64\Bekkcljk.exeC:\Windows\system32\Bekkcljk.exe161⤵PID:1932
-
C:\Windows\SysWOW64\Bldcpf32.exeC:\Windows\system32\Bldcpf32.exe162⤵PID:316
-
C:\Windows\SysWOW64\Bocolb32.exeC:\Windows\system32\Bocolb32.exe163⤵PID:816
-
C:\Windows\SysWOW64\Bemgilhh.exeC:\Windows\system32\Bemgilhh.exe164⤵PID:1072
-
C:\Windows\SysWOW64\Bhkdeggl.exeC:\Windows\system32\Bhkdeggl.exe165⤵PID:2196
-
C:\Windows\SysWOW64\Coelaaoi.exeC:\Windows\system32\Coelaaoi.exe166⤵PID:2692
-
C:\Windows\SysWOW64\Cadhnmnm.exeC:\Windows\system32\Cadhnmnm.exe167⤵PID:2612
-
C:\Windows\SysWOW64\Chnqkg32.exeC:\Windows\system32\Chnqkg32.exe168⤵PID:1256
-
C:\Windows\SysWOW64\Cohigamf.exeC:\Windows\system32\Cohigamf.exe169⤵PID:1376
-
C:\Windows\SysWOW64\Ceaadk32.exeC:\Windows\system32\Ceaadk32.exe170⤵PID:2272
-
C:\Windows\SysWOW64\Chpmpg32.exeC:\Windows\system32\Chpmpg32.exe171⤵PID:1608
-
C:\Windows\SysWOW64\Ckoilb32.exeC:\Windows\system32\Ckoilb32.exe172⤵PID:2020
-
C:\Windows\SysWOW64\Cnmehnan.exeC:\Windows\system32\Cnmehnan.exe173⤵PID:1276
-
C:\Windows\SysWOW64\Cpkbdiqb.exeC:\Windows\system32\Cpkbdiqb.exe174⤵PID:1812
-
C:\Windows\SysWOW64\Cgejac32.exeC:\Windows\system32\Cgejac32.exe175⤵PID:2444
-
C:\Windows\SysWOW64\Caknol32.exeC:\Windows\system32\Caknol32.exe176⤵PID:2680
-
C:\Windows\SysWOW64\Cdikkg32.exeC:\Windows\system32\Cdikkg32.exe177⤵PID:588
-
C:\Windows\SysWOW64\Ckccgane.exeC:\Windows\system32\Ckccgane.exe178⤵PID:2424
-
C:\Windows\SysWOW64\Cnaocmmi.exeC:\Windows\system32\Cnaocmmi.exe179⤵PID:2060
-
C:\Windows\SysWOW64\Cdlgpgef.exeC:\Windows\system32\Cdlgpgef.exe180⤵
- Modifies registry class
PID:2536 -
C:\Windows\SysWOW64\Dgjclbdi.exeC:\Windows\system32\Dgjclbdi.exe181⤵PID:1868
-
C:\Windows\SysWOW64\Dlgldibq.exeC:\Windows\system32\Dlgldibq.exe182⤵PID:1700
-
C:\Windows\SysWOW64\Dcadac32.exeC:\Windows\system32\Dcadac32.exe183⤵PID:2684
-
C:\Windows\SysWOW64\Dfoqmo32.exeC:\Windows\system32\Dfoqmo32.exe184⤵PID:2140
-
C:\Windows\SysWOW64\Dbfabp32.exeC:\Windows\system32\Dbfabp32.exe185⤵PID:1264
-
C:\Windows\SysWOW64\Dhpiojfb.exeC:\Windows\system32\Dhpiojfb.exe186⤵PID:2900
-
C:\Windows\SysWOW64\Dojald32.exeC:\Windows\system32\Dojald32.exe187⤵PID:1516
-
C:\Windows\SysWOW64\Dfdjhndl.exeC:\Windows\system32\Dfdjhndl.exe188⤵PID:1948
-
C:\Windows\SysWOW64\Dhbfdjdp.exeC:\Windows\system32\Dhbfdjdp.exe189⤵PID:1876
-
C:\Windows\SysWOW64\Dolnad32.exeC:\Windows\system32\Dolnad32.exe190⤵PID:2888
-
C:\Windows\SysWOW64\Dbkknojp.exeC:\Windows\system32\Dbkknojp.exe191⤵PID:2392
-
C:\Windows\SysWOW64\Dhdcji32.exeC:\Windows\system32\Dhdcji32.exe192⤵PID:3096
-
C:\Windows\SysWOW64\Dkcofe32.exeC:\Windows\system32\Dkcofe32.exe193⤵PID:3136
-
C:\Windows\SysWOW64\Enakbp32.exeC:\Windows\system32\Enakbp32.exe194⤵PID:3176
-
C:\Windows\SysWOW64\Eqpgol32.exeC:\Windows\system32\Eqpgol32.exe195⤵PID:3216
-
C:\Windows\SysWOW64\Ehgppi32.exeC:\Windows\system32\Ehgppi32.exe196⤵PID:3256
-
C:\Windows\SysWOW64\Endhhp32.exeC:\Windows\system32\Endhhp32.exe197⤵PID:3296
-
C:\Windows\SysWOW64\Eqbddk32.exeC:\Windows\system32\Eqbddk32.exe198⤵PID:3336
-
C:\Windows\SysWOW64\Egllae32.exeC:\Windows\system32\Egllae32.exe199⤵PID:3376
-
C:\Windows\SysWOW64\Ejkima32.exeC:\Windows\system32\Ejkima32.exe200⤵PID:3416
-
C:\Windows\SysWOW64\Emieil32.exeC:\Windows\system32\Emieil32.exe201⤵PID:3456
-
C:\Windows\SysWOW64\Egoife32.exeC:\Windows\system32\Egoife32.exe202⤵PID:3496
-
C:\Windows\SysWOW64\Ejmebq32.exeC:\Windows\system32\Ejmebq32.exe203⤵PID:3536
-
C:\Windows\SysWOW64\Eqgnokip.exeC:\Windows\system32\Eqgnokip.exe204⤵PID:3576
-
C:\Windows\SysWOW64\Ecejkf32.exeC:\Windows\system32\Ecejkf32.exe205⤵PID:3616
-
C:\Windows\SysWOW64\Eibbcm32.exeC:\Windows\system32\Eibbcm32.exe206⤵PID:3656
-
C:\Windows\SysWOW64\Eqijej32.exeC:\Windows\system32\Eqijej32.exe207⤵PID:3696
-
C:\Windows\SysWOW64\Echfaf32.exeC:\Windows\system32\Echfaf32.exe208⤵PID:3736
-
C:\Windows\SysWOW64\Effcma32.exeC:\Windows\system32\Effcma32.exe209⤵PID:3776
-
C:\Windows\SysWOW64\Fidoim32.exeC:\Windows\system32\Fidoim32.exe210⤵PID:3816
-
C:\Windows\SysWOW64\Fpngfgle.exeC:\Windows\system32\Fpngfgle.exe211⤵PID:3856
-
C:\Windows\SysWOW64\Fbmcbbki.exeC:\Windows\system32\Fbmcbbki.exe212⤵PID:3900
-
C:\Windows\SysWOW64\Fekpnn32.exeC:\Windows\system32\Fekpnn32.exe213⤵PID:3940
-
C:\Windows\SysWOW64\Fpqdkf32.exeC:\Windows\system32\Fpqdkf32.exe214⤵PID:3980
-
C:\Windows\SysWOW64\Fncdgcqm.exeC:\Windows\system32\Fncdgcqm.exe215⤵PID:4020
-
C:\Windows\SysWOW64\Fenmdm32.exeC:\Windows\system32\Fenmdm32.exe216⤵PID:4060
-
C:\Windows\SysWOW64\Fglipi32.exeC:\Windows\system32\Fglipi32.exe217⤵PID:2328
-
C:\Windows\SysWOW64\Fpcqaf32.exeC:\Windows\system32\Fpcqaf32.exe218⤵PID:3116
-
C:\Windows\SysWOW64\Fnfamcoj.exeC:\Windows\system32\Fnfamcoj.exe219⤵PID:3160
-
C:\Windows\SysWOW64\Fepiimfg.exeC:\Windows\system32\Fepiimfg.exe220⤵PID:3208
-
C:\Windows\SysWOW64\Fhneehek.exeC:\Windows\system32\Fhneehek.exe221⤵PID:3264
-
C:\Windows\SysWOW64\Fbdjbaea.exeC:\Windows\system32\Fbdjbaea.exe222⤵PID:3316
-
C:\Windows\SysWOW64\Febfomdd.exeC:\Windows\system32\Febfomdd.exe223⤵PID:3360
-
C:\Windows\SysWOW64\Fllnlg32.exeC:\Windows\system32\Fllnlg32.exe224⤵PID:3408
-
C:\Windows\SysWOW64\Fjongcbl.exeC:\Windows\system32\Fjongcbl.exe225⤵PID:3464
-
C:\Windows\SysWOW64\Fmmkcoap.exeC:\Windows\system32\Fmmkcoap.exe226⤵PID:3512
-
C:\Windows\SysWOW64\Gedbdlbb.exeC:\Windows\system32\Gedbdlbb.exe227⤵PID:3548
-
C:\Windows\SysWOW64\Gffoldhp.exeC:\Windows\system32\Gffoldhp.exe228⤵PID:3604
-
C:\Windows\SysWOW64\Gmpgio32.exeC:\Windows\system32\Gmpgio32.exe229⤵PID:3648
-
C:\Windows\SysWOW64\Gpncej32.exeC:\Windows\system32\Gpncej32.exe230⤵PID:3708
-
C:\Windows\SysWOW64\Ghelfg32.exeC:\Windows\system32\Ghelfg32.exe231⤵PID:3748
-
C:\Windows\SysWOW64\Gifhnpea.exeC:\Windows\system32\Gifhnpea.exe232⤵PID:3804
-
C:\Windows\SysWOW64\Gmbdnn32.exeC:\Windows\system32\Gmbdnn32.exe233⤵PID:3840
-
C:\Windows\SysWOW64\Gdllkhdg.exeC:\Windows\system32\Gdllkhdg.exe234⤵
- Drops file in System32 directory
PID:3912 -
C:\Windows\SysWOW64\Gfjhgdck.exeC:\Windows\system32\Gfjhgdck.exe235⤵PID:3952
-
C:\Windows\SysWOW64\Gmdadnkh.exeC:\Windows\system32\Gmdadnkh.exe236⤵PID:4012
-
C:\Windows\SysWOW64\Gpcmpijk.exeC:\Windows\system32\Gpcmpijk.exe237⤵PID:4044
-
C:\Windows\SysWOW64\Gbaileio.exeC:\Windows\system32\Gbaileio.exe238⤵PID:3080
-
C:\Windows\SysWOW64\Gepehphc.exeC:\Windows\system32\Gepehphc.exe239⤵PID:3144
-
C:\Windows\SysWOW64\Gpejeihi.exeC:\Windows\system32\Gpejeihi.exe240⤵PID:3188
-
C:\Windows\SysWOW64\Gohjaf32.exeC:\Windows\system32\Gohjaf32.exe241⤵PID:3276
-
C:\Windows\SysWOW64\Gebbnpfp.exeC:\Windows\system32\Gebbnpfp.exe242⤵PID:3324