Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 21:33
Static task
static1
Behavioral task
behavioral1
Sample
41117b386098078c9729a1eb79ec5b27edd42240b0c60dcaa865d469d62ae068.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
41117b386098078c9729a1eb79ec5b27edd42240b0c60dcaa865d469d62ae068.exe
Resource
win10v2004-20240426-en
General
-
Target
41117b386098078c9729a1eb79ec5b27edd42240b0c60dcaa865d469d62ae068.exe
-
Size
96KB
-
MD5
0063190585a47442c6f6cbf9fe4f8430
-
SHA1
736ace701d0d28fa3f34789a319f16935dae03f4
-
SHA256
41117b386098078c9729a1eb79ec5b27edd42240b0c60dcaa865d469d62ae068
-
SHA512
573b6f097c537e9540b0f0bb805a9ef63837ba233e71ed6544366c411b27ed2bc936a22117c358b2ca827bd77b2da5712e537c1c72f6cb5ef8e322308ec2526d
-
SSDEEP
1536:C5YHnJMjT0iHUhWij/uCp2LR7RZObZUUWaegPYA:CqnOjT0iLGuCiRClUUWae
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Lbagpp32.exeBbgqjdce.exeCceogcfj.exeKbhbai32.exeAejnfe32.exeIcabeo32.exeBeackp32.exePleofj32.exeHmijajbd.exeColdmfkf.exeOghhfg32.exeFnbmoi32.exeHoqjqhjf.exePeeoidik.exeFnipkkdl.exeNbpghl32.exeCdmepgce.exeBlinefnd.exeIkjhki32.exeNjhilimb.exeKjbclamj.exeJjdofm32.exeBgblmk32.exeNabopjmj.exeAeenapck.exeDpodgocb.exeMjnjjbbh.exeOanefo32.exeHmlkfo32.exeIaimipjl.exeMjaddn32.exePicojhcm.exeHbofmcij.exeCohkpj32.exeMchoid32.exeQgmpibam.exeKdmban32.exeBqolji32.exeAfjjed32.exeBgdibkam.exeKcginj32.exeHcblqb32.exeLklikj32.exePeeabm32.exeGfgdij32.exeMhikae32.exeOemhjlha.exeGghmmilh.exeIjaaae32.exeApnfno32.exeMheeif32.exeEcbfmm32.exeAqhhanig.exeBpboinpd.exeQdaglmcb.exeCblfdg32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lbagpp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bbgqjdce.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cceogcfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kbhbai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aejnfe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icabeo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Beackp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pleofj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hmijajbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Coldmfkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oghhfg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fnbmoi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aejnfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hoqjqhjf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Peeoidik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fnipkkdl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbpghl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdmepgce.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Blinefnd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ikjhki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Njhilimb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kjbclamj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjdofm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bgblmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nabopjmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aeenapck.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpodgocb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjnjjbbh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oanefo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmlkfo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iaimipjl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjaddn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Picojhcm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hbofmcij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cohkpj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mchoid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qgmpibam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kdmban32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bqolji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Afjjed32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bgdibkam.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcginj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hcblqb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lklikj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Peeabm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gfgdij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mhikae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oemhjlha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gghmmilh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ijaaae32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apnfno32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mheeif32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ecbfmm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aqhhanig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bpboinpd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qdaglmcb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cblfdg32.exe -
Executes dropped EXE 64 IoCs
Processes:
Ledibnco.exeMclcijfd.exeMfllkece.exeMpgmijgc.exeNoljjglk.exeNoogpfjh.exeNlbgikia.exeNmfqgbmm.exeNkjapglg.exeOaffbqaa.exeOdgodl32.exeOghhfg32.exeOpplolac.exePadeldeo.exePohfehdi.exePojbkh32.exePhbgcnig.exePdihiook.exePnalad32.exeQfmafg32.exeQoeeolig.exeQogbdl32.exeAkncimmh.exeAibcba32.exeAbkhkgbb.exeAigmnqgm.exeAjjfkh32.exeBccjdnbi.exeBpjkiogm.exeBcgdom32.exeBlchcpko.exeCemjae32.exeCohkpj32.exeCaidaeak.exeComdkipe.exeDdliip32.exeDljkcb32.exeDinklffl.exeDiphbfdi.exeDegiggjm.exeEgjbdo32.exeEdnbncmb.exeEjkkfjkj.exeEkjgpm32.exeEfdhpjok.exeEqjmncna.exeFheabelm.exeFjdnlhco.exeFoafdoag.exeFmegncpp.exeFnfcel32.exeFdpkbf32.exeFnipkkdl.exeGnkmqkbi.exeGgcaiqhj.exeGmpjagfa.exeGgfnopfg.exeGqnbhf32.exeGfkkpmko.exeGpcoib32.exeGjicfk32.exeGpelnb32.exeHllmcc32.exeHeealhla.exepid process 2276 Ledibnco.exe 1132 Mclcijfd.exe 2508 Mfllkece.exe 2516 Mpgmijgc.exe 2528 Noljjglk.exe 2384 Noogpfjh.exe 2204 Nlbgikia.exe 1384 Nmfqgbmm.exe 756 Nkjapglg.exe 2572 Oaffbqaa.exe 1668 Odgodl32.exe 2184 Oghhfg32.exe 636 Opplolac.exe 1588 Padeldeo.exe 3012 Pohfehdi.exe 580 Pojbkh32.exe 1992 Phbgcnig.exe 1032 Pdihiook.exe 1244 Pnalad32.exe 1508 Qfmafg32.exe 800 Qoeeolig.exe 1964 Qogbdl32.exe 900 Akncimmh.exe 2220 Aibcba32.exe 2604 Abkhkgbb.exe 288 Aigmnqgm.exe 2748 Ajjfkh32.exe 1604 Bccjdnbi.exe 1536 Bpjkiogm.exe 2464 Bcgdom32.exe 2612 Blchcpko.exe 2388 Cemjae32.exe 2376 Cohkpj32.exe 2432 Caidaeak.exe 1160 Comdkipe.exe 456 Ddliip32.exe 2400 Dljkcb32.exe 1532 Dinklffl.exe 1620 Diphbfdi.exe 2256 Degiggjm.exe 2180 Egjbdo32.exe 2324 Ednbncmb.exe 1112 Ejkkfjkj.exe 2452 Ekjgpm32.exe 572 Efdhpjok.exe 2164 Eqjmncna.exe 3004 Fheabelm.exe 1708 Fjdnlhco.exe 672 Foafdoag.exe 1952 Fmegncpp.exe 2176 Fnfcel32.exe 2868 Fdpkbf32.exe 3056 Fnipkkdl.exe 1892 Gnkmqkbi.exe 1404 Ggcaiqhj.exe 2496 Gmpjagfa.exe 2648 Ggfnopfg.exe 2608 Gqnbhf32.exe 2348 Gfkkpmko.exe 2404 Gpcoib32.exe 696 Gjicfk32.exe 2592 Gpelnb32.exe 1904 Hllmcc32.exe 1104 Heealhla.exe -
Loads dropped DLL 64 IoCs
Processes:
41117b386098078c9729a1eb79ec5b27edd42240b0c60dcaa865d469d62ae068.exeLedibnco.exeMclcijfd.exeMfllkece.exeMpgmijgc.exeNoljjglk.exeNoogpfjh.exeNlbgikia.exeNmfqgbmm.exeNkjapglg.exeOaffbqaa.exeOdgodl32.exeOghhfg32.exeOpplolac.exePadeldeo.exePohfehdi.exePojbkh32.exePhbgcnig.exePdihiook.exePnalad32.exeQfmafg32.exeQoeeolig.exeQogbdl32.exeAkncimmh.exeAibcba32.exeAbkhkgbb.exeAigmnqgm.exeAjjfkh32.exeBccjdnbi.exeBpjkiogm.exeBcgdom32.exeBlchcpko.exepid process 2696 41117b386098078c9729a1eb79ec5b27edd42240b0c60dcaa865d469d62ae068.exe 2696 41117b386098078c9729a1eb79ec5b27edd42240b0c60dcaa865d469d62ae068.exe 2276 Ledibnco.exe 2276 Ledibnco.exe 1132 Mclcijfd.exe 1132 Mclcijfd.exe 2508 Mfllkece.exe 2508 Mfllkece.exe 2516 Mpgmijgc.exe 2516 Mpgmijgc.exe 2528 Noljjglk.exe 2528 Noljjglk.exe 2384 Noogpfjh.exe 2384 Noogpfjh.exe 2204 Nlbgikia.exe 2204 Nlbgikia.exe 1384 Nmfqgbmm.exe 1384 Nmfqgbmm.exe 756 Nkjapglg.exe 756 Nkjapglg.exe 2572 Oaffbqaa.exe 2572 Oaffbqaa.exe 1668 Odgodl32.exe 1668 Odgodl32.exe 2184 Oghhfg32.exe 2184 Oghhfg32.exe 636 Opplolac.exe 636 Opplolac.exe 1588 Padeldeo.exe 1588 Padeldeo.exe 3012 Pohfehdi.exe 3012 Pohfehdi.exe 580 Pojbkh32.exe 580 Pojbkh32.exe 1992 Phbgcnig.exe 1992 Phbgcnig.exe 1032 Pdihiook.exe 1032 Pdihiook.exe 1244 Pnalad32.exe 1244 Pnalad32.exe 1508 Qfmafg32.exe 1508 Qfmafg32.exe 800 Qoeeolig.exe 800 Qoeeolig.exe 1964 Qogbdl32.exe 1964 Qogbdl32.exe 900 Akncimmh.exe 900 Akncimmh.exe 2220 Aibcba32.exe 2220 Aibcba32.exe 2604 Abkhkgbb.exe 2604 Abkhkgbb.exe 288 Aigmnqgm.exe 288 Aigmnqgm.exe 2748 Ajjfkh32.exe 2748 Ajjfkh32.exe 1604 Bccjdnbi.exe 1604 Bccjdnbi.exe 1536 Bpjkiogm.exe 1536 Bpjkiogm.exe 2464 Bcgdom32.exe 2464 Bcgdom32.exe 2612 Blchcpko.exe 2612 Blchcpko.exe -
Drops file in System32 directory 64 IoCs
Processes:
Ahgofi32.exePiliii32.exeIcncgf32.exeEaednh32.exeMkgeehnl.exeMeljbqna.exeDjghpd32.exeIhglhp32.exeApefjqob.exeMimpkcdn.exeJepmgj32.exeJndflk32.exePnmdbi32.exeMejmmqpd.exeJnlepioj.exeKmfklepl.exeKbbobkol.exePadccpal.exeJmdgipkk.exeLlepen32.exePbemboof.exeAomnhd32.exeAdifpk32.exeOniebmda.exeHokjkbkp.exeOiokholk.exeNdlbmk32.exeKklkcn32.exeDbgdgm32.exeKfacdqhf.exeEfpbih32.exeFmegncpp.exeLdpnoj32.exeAadobccg.exeEpqgopbi.exeMheeif32.exeOapcfo32.exeDfhdnn32.exeKilgoe32.exeFdpkbf32.exeDboeco32.exeGigkbm32.exeKkeecogo.exeNckmpicl.exeNnahgh32.exeLonlkcho.exeLpnmgdli.exePhcpgm32.exeHgciff32.exeHoniikpa.exePqbifhjb.exeLmjnak32.exeKfjfik32.exeDbdehdfc.exeAfliclij.exeLklikj32.exeNknkeg32.exeAplkah32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Aoagccfn.exe Ahgofi32.exe File created C:\Windows\SysWOW64\Qaacem32.dll Piliii32.exe File created C:\Windows\SysWOW64\Ieponofk.exe Icncgf32.exe File opened for modification C:\Windows\SysWOW64\Fjnignob.exe Eaednh32.exe File opened for modification C:\Windows\SysWOW64\Meljbqna.exe Mkgeehnl.exe File opened for modification C:\Windows\SysWOW64\Mnhnfckm.exe Meljbqna.exe File opened for modification C:\Windows\SysWOW64\Dodahk32.exe Djghpd32.exe File opened for modification C:\Windows\SysWOW64\Jmdepg32.exe Ihglhp32.exe File created C:\Windows\SysWOW64\Kicqkb32.dll File created C:\Windows\SysWOW64\Ahqkocmm.exe Apefjqob.exe File created C:\Windows\SysWOW64\Nbeedh32.exe Mimpkcdn.exe File created C:\Windows\SysWOW64\Jkmeoa32.exe Jepmgj32.exe File created C:\Windows\SysWOW64\Jfojpn32.exe Jndflk32.exe File created C:\Windows\SysWOW64\Allapi32.dll Pnmdbi32.exe File created C:\Windows\SysWOW64\Mkgeehnl.exe Mejmmqpd.exe File created C:\Windows\SysWOW64\Kcimhpma.exe Jnlepioj.exe File created C:\Windows\SysWOW64\Kcpcho32.exe Kmfklepl.exe File opened for modification C:\Windows\SysWOW64\Kilgoe32.exe Kbbobkol.exe File created C:\Windows\SysWOW64\Piohgbng.exe Padccpal.exe File created C:\Windows\SysWOW64\Iioloaac.dll File created C:\Windows\SysWOW64\Jcnoejch.exe Jmdgipkk.exe File created C:\Windows\SysWOW64\Lioglifg.dll Llepen32.exe File created C:\Windows\SysWOW64\Bbjjjgna.dll Pbemboof.exe File created C:\Windows\SysWOW64\Egfokakc.dll Aomnhd32.exe File opened for modification C:\Windows\SysWOW64\Anbkipok.exe Adifpk32.exe File created C:\Windows\SysWOW64\Oecmogln.exe Oniebmda.exe File opened for modification C:\Windows\SysWOW64\Hgfooe32.exe Hokjkbkp.exe File created C:\Windows\SysWOW64\Obhpad32.exe Oiokholk.exe File created C:\Windows\SysWOW64\Oapcfo32.exe Ndlbmk32.exe File created C:\Windows\SysWOW64\Kgclio32.exe Kklkcn32.exe File created C:\Windows\SysWOW64\Bkmmeecf.dll Dbgdgm32.exe File opened for modification C:\Windows\SysWOW64\Kpjhnfof.exe Kfacdqhf.exe File created C:\Windows\SysWOW64\Fqffgapf.exe Efpbih32.exe File opened for modification C:\Windows\SysWOW64\Fnfcel32.exe Fmegncpp.exe File created C:\Windows\SysWOW64\Nmcmif32.dll Ldpnoj32.exe File created C:\Windows\SysWOW64\Mkcmnk32.dll Aadobccg.exe File created C:\Windows\SysWOW64\Ogadek32.dll Epqgopbi.exe File created C:\Windows\SysWOW64\Dpmodqio.dll Mheeif32.exe File created C:\Windows\SysWOW64\Dclcqbcj.dll Oapcfo32.exe File opened for modification C:\Windows\SysWOW64\Pdfdkehc.exe File created C:\Windows\SysWOW64\Dgiaefgg.exe Dfhdnn32.exe File created C:\Windows\SysWOW64\Kqmidcdi.dll Kilgoe32.exe File opened for modification C:\Windows\SysWOW64\Ebabicfn.exe File created C:\Windows\SysWOW64\Ildnklen.dll Fdpkbf32.exe File created C:\Windows\SysWOW64\Alelkg32.dll Dboeco32.exe File created C:\Windows\SysWOW64\Gpacogjm.exe Gigkbm32.exe File created C:\Windows\SysWOW64\Fffjig32.dll Kkeecogo.exe File created C:\Windows\SysWOW64\Nqpmimbe.exe Nckmpicl.exe File created C:\Windows\SysWOW64\Nigldq32.exe Nnahgh32.exe File created C:\Windows\SysWOW64\Nphmpc32.dll Lonlkcho.exe File opened for modification C:\Windows\SysWOW64\Gnmihgkh.exe File opened for modification C:\Windows\SysWOW64\Lfkeokjp.exe Lpnmgdli.exe File created C:\Windows\SysWOW64\Ipnlibhd.dll Phcpgm32.exe File created C:\Windows\SysWOW64\Hnmacpfj.exe Hgciff32.exe File opened for modification C:\Windows\SysWOW64\Hdkaabnh.exe Honiikpa.exe File created C:\Windows\SysWOW64\Ekpcei32.dll Pqbifhjb.exe File created C:\Windows\SysWOW64\Lgoboc32.exe Lmjnak32.exe File opened for modification C:\Windows\SysWOW64\Kqokgd32.exe Kfjfik32.exe File opened for modification C:\Windows\SysWOW64\Dinneo32.exe Dbdehdfc.exe File opened for modification C:\Windows\SysWOW64\Bpbmqe32.exe Afliclij.exe File created C:\Windows\SysWOW64\Alcfgo32.dll Lklikj32.exe File opened for modification C:\Windows\SysWOW64\Ndfpnl32.exe Nknkeg32.exe File created C:\Windows\SysWOW64\Gifjbd32.dll Aplkah32.exe File opened for modification C:\Windows\SysWOW64\Nhfdqb32.exe -
Program crash 1 IoCs
Processes:
pid pid_target process target process 1248 2556 -
Modifies registry class 64 IoCs
Processes:
Pleofj32.exeQgmpibam.exeEcbfmm32.exeHechkfkc.exeNgcanq32.exePjhpin32.exeMmicfh32.exeMhcfjnhm.exeAocbokia.exeBogljj32.exeJfojpn32.exeFnbmoi32.exeJfjolf32.exeDcohghbk.exeOlophhjd.exeIahkpg32.exeCfhkhd32.exeKilgoe32.exeNmnojp32.exeOkhefl32.exeBccjdnbi.exeElgfkhpi.exePiliii32.exeHklhae32.exeNjhilimb.exeKlkfdi32.exeOcfiif32.exeKdmban32.exeLgkkmm32.exeAfliclij.exeKlcgpkhh.exeQdlipplq.exeEebibf32.exeQdaglmcb.exeGigkbm32.exeHlhddh32.exeGmkjgfmf.exeBpjkiogm.exeQoeamo32.exeHmoofdea.exeMjaddn32.exeKklkcn32.exeFcbecl32.exeBgblmk32.exeAomnhd32.exeGgapbcne.exeJlqjkk32.exeAompambg.exePiohgbng.exeHlbpme32.exeJepmgj32.exeNabopjmj.exeFogdap32.exeKopnma32.exeMchoid32.exeNkqjdo32.exeIegjqk32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pleofj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qgmpibam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fljkodkb.dll" Ecbfmm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hechkfkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ngcanq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gonfjjge.dll" Pjhpin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hifhgh32.dll" Mmicfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mhcfjnhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aocbokia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bogljj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdcbqe32.dll" Jfojpn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fnbmoi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afloik32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jfjolf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dcohghbk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Olophhjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knnpkl32.dll" Iahkpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cfhkhd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kilgoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Feembf32.dll" Nmnojp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pppgjnfc.dll" Okhefl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bccjdnbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Elgfkhpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Piliii32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmichb32.dll" Hklhae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Njhilimb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Klkfdi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ocfiif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llbncmgg.dll" Kdmban32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lgkkmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Boddiidc.dll" Afliclij.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Klcgpkhh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llhmmh32.dll" Qdlipplq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eebibf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qdaglmcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mamipckp.dll" Gigkbm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hlhddh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gmkjgfmf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bpjkiogm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qoeamo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Degjpgmg.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hmoofdea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mjaddn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kklkcn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffdokdko.dll" Klkfdi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fcbecl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bgblmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egfokakc.dll" Aomnhd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ggapbcne.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aiomcb32.dll" Jlqjkk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdnnln32.dll" Aompambg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Piohgbng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbpfll32.dll" Hlbpme32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkepinpk.dll" Jepmgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khdecggq.dll" Nabopjmj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fogdap32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kopnma32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mchoid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijpfnpij.dll" Nkqjdo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iegjqk32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
41117b386098078c9729a1eb79ec5b27edd42240b0c60dcaa865d469d62ae068.exeLedibnco.exeMclcijfd.exeMfllkece.exeMpgmijgc.exeNoljjglk.exeNoogpfjh.exeNlbgikia.exeNmfqgbmm.exeNkjapglg.exeOaffbqaa.exeOdgodl32.exeOghhfg32.exeOpplolac.exePadeldeo.exePohfehdi.exedescription pid process target process PID 2696 wrote to memory of 2276 2696 41117b386098078c9729a1eb79ec5b27edd42240b0c60dcaa865d469d62ae068.exe Ledibnco.exe PID 2696 wrote to memory of 2276 2696 41117b386098078c9729a1eb79ec5b27edd42240b0c60dcaa865d469d62ae068.exe Ledibnco.exe PID 2696 wrote to memory of 2276 2696 41117b386098078c9729a1eb79ec5b27edd42240b0c60dcaa865d469d62ae068.exe Ledibnco.exe PID 2696 wrote to memory of 2276 2696 41117b386098078c9729a1eb79ec5b27edd42240b0c60dcaa865d469d62ae068.exe Ledibnco.exe PID 2276 wrote to memory of 1132 2276 Ledibnco.exe Mclcijfd.exe PID 2276 wrote to memory of 1132 2276 Ledibnco.exe Mclcijfd.exe PID 2276 wrote to memory of 1132 2276 Ledibnco.exe Mclcijfd.exe PID 2276 wrote to memory of 1132 2276 Ledibnco.exe Mclcijfd.exe PID 1132 wrote to memory of 2508 1132 Mclcijfd.exe Mfllkece.exe PID 1132 wrote to memory of 2508 1132 Mclcijfd.exe Mfllkece.exe PID 1132 wrote to memory of 2508 1132 Mclcijfd.exe Mfllkece.exe PID 1132 wrote to memory of 2508 1132 Mclcijfd.exe Mfllkece.exe PID 2508 wrote to memory of 2516 2508 Mfllkece.exe Mpgmijgc.exe PID 2508 wrote to memory of 2516 2508 Mfllkece.exe Mpgmijgc.exe PID 2508 wrote to memory of 2516 2508 Mfllkece.exe Mpgmijgc.exe PID 2508 wrote to memory of 2516 2508 Mfllkece.exe Mpgmijgc.exe PID 2516 wrote to memory of 2528 2516 Mpgmijgc.exe Noljjglk.exe PID 2516 wrote to memory of 2528 2516 Mpgmijgc.exe Noljjglk.exe PID 2516 wrote to memory of 2528 2516 Mpgmijgc.exe Noljjglk.exe PID 2516 wrote to memory of 2528 2516 Mpgmijgc.exe Noljjglk.exe PID 2528 wrote to memory of 2384 2528 Noljjglk.exe Noogpfjh.exe PID 2528 wrote to memory of 2384 2528 Noljjglk.exe Noogpfjh.exe PID 2528 wrote to memory of 2384 2528 Noljjglk.exe Noogpfjh.exe PID 2528 wrote to memory of 2384 2528 Noljjglk.exe Noogpfjh.exe PID 2384 wrote to memory of 2204 2384 Noogpfjh.exe Nlbgikia.exe PID 2384 wrote to memory of 2204 2384 Noogpfjh.exe Nlbgikia.exe PID 2384 wrote to memory of 2204 2384 Noogpfjh.exe Nlbgikia.exe PID 2384 wrote to memory of 2204 2384 Noogpfjh.exe Nlbgikia.exe PID 2204 wrote to memory of 1384 2204 Nlbgikia.exe Nmfqgbmm.exe PID 2204 wrote to memory of 1384 2204 Nlbgikia.exe Nmfqgbmm.exe PID 2204 wrote to memory of 1384 2204 Nlbgikia.exe Nmfqgbmm.exe PID 2204 wrote to memory of 1384 2204 Nlbgikia.exe Nmfqgbmm.exe PID 1384 wrote to memory of 756 1384 Nmfqgbmm.exe Nkjapglg.exe PID 1384 wrote to memory of 756 1384 Nmfqgbmm.exe Nkjapglg.exe PID 1384 wrote to memory of 756 1384 Nmfqgbmm.exe Nkjapglg.exe PID 1384 wrote to memory of 756 1384 Nmfqgbmm.exe Nkjapglg.exe PID 756 wrote to memory of 2572 756 Nkjapglg.exe Oaffbqaa.exe PID 756 wrote to memory of 2572 756 Nkjapglg.exe Oaffbqaa.exe PID 756 wrote to memory of 2572 756 Nkjapglg.exe Oaffbqaa.exe PID 756 wrote to memory of 2572 756 Nkjapglg.exe Oaffbqaa.exe PID 2572 wrote to memory of 1668 2572 Oaffbqaa.exe Odgodl32.exe PID 2572 wrote to memory of 1668 2572 Oaffbqaa.exe Odgodl32.exe PID 2572 wrote to memory of 1668 2572 Oaffbqaa.exe Odgodl32.exe PID 2572 wrote to memory of 1668 2572 Oaffbqaa.exe Odgodl32.exe PID 1668 wrote to memory of 2184 1668 Odgodl32.exe Oghhfg32.exe PID 1668 wrote to memory of 2184 1668 Odgodl32.exe Oghhfg32.exe PID 1668 wrote to memory of 2184 1668 Odgodl32.exe Oghhfg32.exe PID 1668 wrote to memory of 2184 1668 Odgodl32.exe Oghhfg32.exe PID 2184 wrote to memory of 636 2184 Oghhfg32.exe Opplolac.exe PID 2184 wrote to memory of 636 2184 Oghhfg32.exe Opplolac.exe PID 2184 wrote to memory of 636 2184 Oghhfg32.exe Opplolac.exe PID 2184 wrote to memory of 636 2184 Oghhfg32.exe Opplolac.exe PID 636 wrote to memory of 1588 636 Opplolac.exe Padeldeo.exe PID 636 wrote to memory of 1588 636 Opplolac.exe Padeldeo.exe PID 636 wrote to memory of 1588 636 Opplolac.exe Padeldeo.exe PID 636 wrote to memory of 1588 636 Opplolac.exe Padeldeo.exe PID 1588 wrote to memory of 3012 1588 Padeldeo.exe Pohfehdi.exe PID 1588 wrote to memory of 3012 1588 Padeldeo.exe Pohfehdi.exe PID 1588 wrote to memory of 3012 1588 Padeldeo.exe Pohfehdi.exe PID 1588 wrote to memory of 3012 1588 Padeldeo.exe Pohfehdi.exe PID 3012 wrote to memory of 580 3012 Pohfehdi.exe Pojbkh32.exe PID 3012 wrote to memory of 580 3012 Pohfehdi.exe Pojbkh32.exe PID 3012 wrote to memory of 580 3012 Pohfehdi.exe Pojbkh32.exe PID 3012 wrote to memory of 580 3012 Pohfehdi.exe Pojbkh32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41117b386098078c9729a1eb79ec5b27edd42240b0c60dcaa865d469d62ae068.exe"C:\Users\Admin\AppData\Local\Temp\41117b386098078c9729a1eb79ec5b27edd42240b0c60dcaa865d469d62ae068.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\Ledibnco.exeC:\Windows\system32\Ledibnco.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\Mclcijfd.exeC:\Windows\system32\Mclcijfd.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\Mfllkece.exeC:\Windows\system32\Mfllkece.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\Mpgmijgc.exeC:\Windows\system32\Mpgmijgc.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\Noljjglk.exeC:\Windows\system32\Noljjglk.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\Noogpfjh.exeC:\Windows\system32\Noogpfjh.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\Nlbgikia.exeC:\Windows\system32\Nlbgikia.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\Nmfqgbmm.exeC:\Windows\system32\Nmfqgbmm.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\Nkjapglg.exeC:\Windows\system32\Nkjapglg.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\Oaffbqaa.exeC:\Windows\system32\Oaffbqaa.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\Odgodl32.exeC:\Windows\system32\Odgodl32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\Oghhfg32.exeC:\Windows\system32\Oghhfg32.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\Opplolac.exeC:\Windows\system32\Opplolac.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\Padeldeo.exeC:\Windows\system32\Padeldeo.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\Pohfehdi.exeC:\Windows\system32\Pohfehdi.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\Pojbkh32.exeC:\Windows\system32\Pojbkh32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Windows\SysWOW64\Phbgcnig.exeC:\Windows\system32\Phbgcnig.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Windows\SysWOW64\Pdihiook.exeC:\Windows\system32\Pdihiook.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Windows\SysWOW64\Pnalad32.exeC:\Windows\system32\Pnalad32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Windows\SysWOW64\Qfmafg32.exeC:\Windows\system32\Qfmafg32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Windows\SysWOW64\Qoeeolig.exeC:\Windows\system32\Qoeeolig.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Windows\SysWOW64\Qogbdl32.exeC:\Windows\system32\Qogbdl32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Windows\SysWOW64\Akncimmh.exeC:\Windows\system32\Akncimmh.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Windows\SysWOW64\Aibcba32.exeC:\Windows\system32\Aibcba32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Windows\SysWOW64\Abkhkgbb.exeC:\Windows\system32\Abkhkgbb.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Windows\SysWOW64\Aigmnqgm.exeC:\Windows\system32\Aigmnqgm.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Windows\SysWOW64\Ajjfkh32.exeC:\Windows\system32\Ajjfkh32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Windows\SysWOW64\Bccjdnbi.exeC:\Windows\system32\Bccjdnbi.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1604 -
C:\Windows\SysWOW64\Bpjkiogm.exeC:\Windows\system32\Bpjkiogm.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1536 -
C:\Windows\SysWOW64\Bcgdom32.exeC:\Windows\system32\Bcgdom32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Windows\SysWOW64\Blchcpko.exeC:\Windows\system32\Blchcpko.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Windows\SysWOW64\Cemjae32.exeC:\Windows\system32\Cemjae32.exe33⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\Cohkpj32.exeC:\Windows\system32\Cohkpj32.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2376 -
C:\Windows\SysWOW64\Caidaeak.exeC:\Windows\system32\Caidaeak.exe35⤵
- Executes dropped EXE
PID:2432 -
C:\Windows\SysWOW64\Comdkipe.exeC:\Windows\system32\Comdkipe.exe36⤵
- Executes dropped EXE
PID:1160 -
C:\Windows\SysWOW64\Ddliip32.exeC:\Windows\system32\Ddliip32.exe37⤵
- Executes dropped EXE
PID:456 -
C:\Windows\SysWOW64\Dljkcb32.exeC:\Windows\system32\Dljkcb32.exe38⤵
- Executes dropped EXE
PID:2400 -
C:\Windows\SysWOW64\Dinklffl.exeC:\Windows\system32\Dinklffl.exe39⤵
- Executes dropped EXE
PID:1532 -
C:\Windows\SysWOW64\Diphbfdi.exeC:\Windows\system32\Diphbfdi.exe40⤵
- Executes dropped EXE
PID:1620 -
C:\Windows\SysWOW64\Degiggjm.exeC:\Windows\system32\Degiggjm.exe41⤵
- Executes dropped EXE
PID:2256 -
C:\Windows\SysWOW64\Egjbdo32.exeC:\Windows\system32\Egjbdo32.exe42⤵
- Executes dropped EXE
PID:2180 -
C:\Windows\SysWOW64\Ednbncmb.exeC:\Windows\system32\Ednbncmb.exe43⤵
- Executes dropped EXE
PID:2324 -
C:\Windows\SysWOW64\Ejkkfjkj.exeC:\Windows\system32\Ejkkfjkj.exe44⤵
- Executes dropped EXE
PID:1112 -
C:\Windows\SysWOW64\Ekjgpm32.exeC:\Windows\system32\Ekjgpm32.exe45⤵
- Executes dropped EXE
PID:2452 -
C:\Windows\SysWOW64\Efdhpjok.exeC:\Windows\system32\Efdhpjok.exe46⤵
- Executes dropped EXE
PID:572 -
C:\Windows\SysWOW64\Eqjmncna.exeC:\Windows\system32\Eqjmncna.exe47⤵
- Executes dropped EXE
PID:2164 -
C:\Windows\SysWOW64\Fheabelm.exeC:\Windows\system32\Fheabelm.exe48⤵
- Executes dropped EXE
PID:3004 -
C:\Windows\SysWOW64\Fjdnlhco.exeC:\Windows\system32\Fjdnlhco.exe49⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\SysWOW64\Foafdoag.exeC:\Windows\system32\Foafdoag.exe50⤵
- Executes dropped EXE
PID:672 -
C:\Windows\SysWOW64\Fmegncpp.exeC:\Windows\system32\Fmegncpp.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1952 -
C:\Windows\SysWOW64\Fnfcel32.exeC:\Windows\system32\Fnfcel32.exe52⤵
- Executes dropped EXE
PID:2176 -
C:\Windows\SysWOW64\Fdpkbf32.exeC:\Windows\system32\Fdpkbf32.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2868 -
C:\Windows\SysWOW64\Fnipkkdl.exeC:\Windows\system32\Fnipkkdl.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3056 -
C:\Windows\SysWOW64\Gnkmqkbi.exeC:\Windows\system32\Gnkmqkbi.exe55⤵
- Executes dropped EXE
PID:1892 -
C:\Windows\SysWOW64\Ggcaiqhj.exeC:\Windows\system32\Ggcaiqhj.exe56⤵
- Executes dropped EXE
PID:1404 -
C:\Windows\SysWOW64\Gmpjagfa.exeC:\Windows\system32\Gmpjagfa.exe57⤵
- Executes dropped EXE
PID:2496 -
C:\Windows\SysWOW64\Ggfnopfg.exeC:\Windows\system32\Ggfnopfg.exe58⤵
- Executes dropped EXE
PID:2648 -
C:\Windows\SysWOW64\Gqnbhf32.exeC:\Windows\system32\Gqnbhf32.exe59⤵
- Executes dropped EXE
PID:2608 -
C:\Windows\SysWOW64\Gfkkpmko.exeC:\Windows\system32\Gfkkpmko.exe60⤵
- Executes dropped EXE
PID:2348 -
C:\Windows\SysWOW64\Gpcoib32.exeC:\Windows\system32\Gpcoib32.exe61⤵
- Executes dropped EXE
PID:2404 -
C:\Windows\SysWOW64\Gjicfk32.exeC:\Windows\system32\Gjicfk32.exe62⤵
- Executes dropped EXE
PID:696 -
C:\Windows\SysWOW64\Gpelnb32.exeC:\Windows\system32\Gpelnb32.exe63⤵
- Executes dropped EXE
PID:2592 -
C:\Windows\SysWOW64\Hllmcc32.exeC:\Windows\system32\Hllmcc32.exe64⤵
- Executes dropped EXE
PID:1904 -
C:\Windows\SysWOW64\Heealhla.exeC:\Windows\system32\Heealhla.exe65⤵
- Executes dropped EXE
PID:1104 -
C:\Windows\SysWOW64\Hpjeialg.exeC:\Windows\system32\Hpjeialg.exe66⤵PID:1728
-
C:\Windows\SysWOW64\Hibjbgbh.exeC:\Windows\system32\Hibjbgbh.exe67⤵PID:752
-
C:\Windows\SysWOW64\Hnpbjnpo.exeC:\Windows\system32\Hnpbjnpo.exe68⤵PID:1168
-
C:\Windows\SysWOW64\Hdlkcdog.exeC:\Windows\system32\Hdlkcdog.exe69⤵PID:1832
-
C:\Windows\SysWOW64\Hjfcpo32.exeC:\Windows\system32\Hjfcpo32.exe70⤵PID:1152
-
C:\Windows\SysWOW64\Helgmg32.exeC:\Windows\system32\Helgmg32.exe71⤵PID:980
-
C:\Windows\SysWOW64\Hndlem32.exeC:\Windows\system32\Hndlem32.exe72⤵PID:1940
-
C:\Windows\SysWOW64\Iabhah32.exeC:\Windows\system32\Iabhah32.exe73⤵PID:2904
-
C:\Windows\SysWOW64\Imiigiab.exeC:\Windows\system32\Imiigiab.exe74⤵PID:2800
-
C:\Windows\SysWOW64\Iphecepe.exeC:\Windows\system32\Iphecepe.exe75⤵PID:2872
-
C:\Windows\SysWOW64\Iipiljgf.exeC:\Windows\system32\Iipiljgf.exe76⤵PID:1312
-
C:\Windows\SysWOW64\Idfnicfl.exeC:\Windows\system32\Idfnicfl.exe77⤵PID:2900
-
C:\Windows\SysWOW64\Iegjqk32.exeC:\Windows\system32\Iegjqk32.exe78⤵
- Modifies registry class
PID:2532 -
C:\Windows\SysWOW64\Iplnnd32.exeC:\Windows\system32\Iplnnd32.exe79⤵PID:2392
-
C:\Windows\SysWOW64\Ieigfk32.exeC:\Windows\system32\Ieigfk32.exe80⤵PID:2364
-
C:\Windows\SysWOW64\Ihhcbf32.exeC:\Windows\system32\Ihhcbf32.exe81⤵PID:2332
-
C:\Windows\SysWOW64\Ioakoq32.exeC:\Windows\system32\Ioakoq32.exe82⤵PID:1300
-
C:\Windows\SysWOW64\Jhjphfgi.exeC:\Windows\system32\Jhjphfgi.exe83⤵PID:564
-
C:\Windows\SysWOW64\Jenpajfb.exeC:\Windows\system32\Jenpajfb.exe84⤵PID:2568
-
C:\Windows\SysWOW64\Jlhhndno.exeC:\Windows\system32\Jlhhndno.exe85⤵PID:1920
-
C:\Windows\SysWOW64\Jepmgj32.exeC:\Windows\system32\Jepmgj32.exe86⤵
- Drops file in System32 directory
- Modifies registry class
PID:1288 -
C:\Windows\SysWOW64\Jkmeoa32.exeC:\Windows\system32\Jkmeoa32.exe87⤵PID:812
-
C:\Windows\SysWOW64\Jpjngh32.exeC:\Windows\system32\Jpjngh32.exe88⤵PID:1644
-
C:\Windows\SysWOW64\Jgdfdbhk.exeC:\Windows\system32\Jgdfdbhk.exe89⤵PID:2780
-
C:\Windows\SysWOW64\Jplkmgol.exeC:\Windows\system32\Jplkmgol.exe90⤵PID:2936
-
C:\Windows\SysWOW64\Jjdofm32.exeC:\Windows\system32\Jjdofm32.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1060 -
C:\Windows\SysWOW64\Kdjccf32.exeC:\Windows\system32\Kdjccf32.exe92⤵PID:3000
-
C:\Windows\SysWOW64\Kfkpknkq.exeC:\Windows\system32\Kfkpknkq.exe93⤵PID:2268
-
C:\Windows\SysWOW64\Kcopdb32.exeC:\Windows\system32\Kcopdb32.exe94⤵PID:892
-
C:\Windows\SysWOW64\Kjihalag.exeC:\Windows\system32\Kjihalag.exe95⤵PID:1500
-
C:\Windows\SysWOW64\Kpcqnf32.exeC:\Windows\system32\Kpcqnf32.exe96⤵PID:2540
-
C:\Windows\SysWOW64\Kljabgnh.exeC:\Windows\system32\Kljabgnh.exe97⤵PID:1760
-
C:\Windows\SysWOW64\Lomgjb32.exeC:\Windows\system32\Lomgjb32.exe98⤵PID:2372
-
C:\Windows\SysWOW64\Lkdhoc32.exeC:\Windows\system32\Lkdhoc32.exe99⤵PID:2420
-
C:\Windows\SysWOW64\Ldllgiek.exeC:\Windows\system32\Ldllgiek.exe100⤵PID:2328
-
C:\Windows\SysWOW64\Lkfddc32.exeC:\Windows\system32\Lkfddc32.exe101⤵PID:2020
-
C:\Windows\SysWOW64\Lqcmmjko.exeC:\Windows\system32\Lqcmmjko.exe102⤵PID:1524
-
C:\Windows\SysWOW64\Lfpeeqig.exeC:\Windows\system32\Lfpeeqig.exe103⤵PID:2040
-
C:\Windows\SysWOW64\Lmjnak32.exeC:\Windows\system32\Lmjnak32.exe104⤵
- Drops file in System32 directory
PID:2736 -
C:\Windows\SysWOW64\Lgoboc32.exeC:\Windows\system32\Lgoboc32.exe105⤵PID:3016
-
C:\Windows\SysWOW64\Liqoflfh.exeC:\Windows\system32\Liqoflfh.exe106⤵PID:1732
-
C:\Windows\SysWOW64\Lokgcf32.exeC:\Windows\system32\Lokgcf32.exe107⤵PID:240
-
C:\Windows\SysWOW64\Mfdopp32.exeC:\Windows\system32\Mfdopp32.exe108⤵PID:608
-
C:\Windows\SysWOW64\Mmogmjmn.exeC:\Windows\system32\Mmogmjmn.exe109⤵PID:2024
-
C:\Windows\SysWOW64\Mchoid32.exeC:\Windows\system32\Mchoid32.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2500 -
C:\Windows\SysWOW64\Mmadbjkk.exeC:\Windows\system32\Mmadbjkk.exe111⤵PID:2660
-
C:\Windows\SysWOW64\Mfihkoal.exeC:\Windows\system32\Mfihkoal.exe112⤵PID:2912
-
C:\Windows\SysWOW64\Mgjebg32.exeC:\Windows\system32\Mgjebg32.exe113⤵PID:3024
-
C:\Windows\SysWOW64\Mijamjnm.exeC:\Windows\system32\Mijamjnm.exe114⤵PID:1056
-
C:\Windows\SysWOW64\Mbbfep32.exeC:\Windows\system32\Mbbfep32.exe115⤵PID:2600
-
C:\Windows\SysWOW64\Mjnjjbbh.exeC:\Windows\system32\Mjnjjbbh.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1252 -
C:\Windows\SysWOW64\Nmlgfnal.exeC:\Windows\system32\Nmlgfnal.exe117⤵PID:1148
-
C:\Windows\SysWOW64\Ncfoch32.exeC:\Windows\system32\Ncfoch32.exe118⤵PID:1596
-
C:\Windows\SysWOW64\Njpgpbpf.exeC:\Windows\system32\Njpgpbpf.exe119⤵PID:2156
-
C:\Windows\SysWOW64\Najpll32.exeC:\Windows\system32\Najpll32.exe120⤵PID:436
-
C:\Windows\SysWOW64\Nhdhif32.exeC:\Windows\system32\Nhdhif32.exe121⤵PID:2808
-
C:\Windows\SysWOW64\Nmqpam32.exeC:\Windows\system32\Nmqpam32.exe122⤵PID:1752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-