Analysis
-
max time kernel
96s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 01:10
Static task
static1
Behavioral task
behavioral1
Sample
735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe
Resource
win10v2004-20240508-en
General
-
Target
735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe
-
Size
1020KB
-
MD5
546f0a90fbdbe284d4a604b8cab5c0ce
-
SHA1
439eb5242a8f0a256b8f55cce436de7fdfacaf71
-
SHA256
735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d
-
SHA512
50a99ce76d3f452d1cb59884bfbac4f70ed00b9cf6efb07d518e47735585bb87b5eb2c3d6c562587c54abff940fece1ea925ab92c19b69995bc62d72173ee090
-
SSDEEP
24576:UnfyvzecrHPh2kkkkK4kXkkkkkkkkhLX3a20R0i:UnfyvKcrXbazR0i
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Kmdofebo.exeBfppgohb.exeKpbiempj.exeMblbnj32.exeNflchkii.exeHbpbck32.exePdonhj32.exeBedcembk.exeLjjjmeie.exeKohnoc32.exePeefcjlg.exeGhenamai.exeQcjoci32.exeFnmmidhm.exeCmfmojcb.exeEpkepakn.exeIbibfa32.exeCafgle32.exeJioopgef.exeJqnhmgmk.exeEndjaief.exeMkdioh32.exeMeeopdhb.exeIopeoknn.exeHbjgbbpn.exePgpgjepk.exeMbchni32.exeOgdaod32.exeEcjibgdh.exeGkkilfjk.exeHbcabc32.exeEcfnmh32.exeHbggif32.exeOfnpnkgf.exeGmlablaa.exeHadfah32.exeHlecmkel.exeAialjgbh.exeKcginj32.exeJbhebfck.exeGlijnmdj.exeEfkbdbai.exeDicnkdnf.exePgibdjln.exePodpoffm.exeGlckihcg.exeImogcj32.exeOjceef32.exeCffjagko.exeIhpgce32.exeJdpgjhbm.exeKofcbl32.exeKhjgel32.exeDgnhhq32.exeIigcobid.exeAbiqcm32.exeCdfief32.exeAjnpecbj.exeBnapnm32.exeFpbqcb32.exeInhoegqc.exeJclnnmic.exeNcfoch32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kmdofebo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bfppgohb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpbiempj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mblbnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nflchkii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hbpbck32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pdonhj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bedcembk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ljjjmeie.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kohnoc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Peefcjlg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ghenamai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qcjoci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fnmmidhm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmfmojcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Epkepakn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ibibfa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cafgle32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jioopgef.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jqnhmgmk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Endjaief.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mkdioh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Meeopdhb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iopeoknn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hbjgbbpn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pgpgjepk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbchni32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ogdaod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ecjibgdh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gkkilfjk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hbcabc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ecfnmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hbggif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ofnpnkgf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmlablaa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hadfah32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hlecmkel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aialjgbh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcginj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mbchni32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jbhebfck.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glijnmdj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efkbdbai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dicnkdnf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pgibdjln.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Podpoffm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Glckihcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Imogcj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojceef32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cffjagko.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ihpgce32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdpgjhbm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kofcbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Khjgel32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgnhhq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iigcobid.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abiqcm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdfief32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajnpecbj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnapnm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fpbqcb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Inhoegqc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jclnnmic.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ncfoch32.exe -
Executes dropped EXE 64 IoCs
Processes:
Ihpdoh32.exeJdpgjhbm.exeJpiedieo.exeKonndhmb.exeLeammn32.exeMbcmpfhi.exeNianhplq.exeNkjapglg.exeOklnff32.exeQndigd32.exeAccnekon.exeBaigca32.exeBigimdjh.exeCafgle32.exeCojhejbh.exeEamilh32.exeEndjaief.exeEnfgfh32.exeEccpoo32.exeFfibkj32.exeFhikme32.exeFnfcel32.exeFnipkkdl.exeFdbhge32.exeGqiimfam.exeGkomjo32.exeGegabegc.exeGjdjklek.exeGfkkpmko.exeHfbaql32.exeHloiib32.exeHanogipc.exeHfmddp32.exeIjklknbn.exeIlabmedg.exeIoakoq32.exeJlelhe32.exeJhlmmfef.exeJdcmbgkj.exeJnkakl32.exeJhafhe32.exeJnnnalph.exeKcmcoblm.exeKnbhlkkc.exeKgkleabc.exeKlhemhpk.exeKhoebi32.exeKohnoc32.exeKkoncdcp.exeLbnpkmfg.exeLkfddc32.exeLcdfnehp.exeLmljgj32.exeLcfbdd32.exeMbkpeake.exeMnbpjb32.exeMihdgkpp.exeMbpipp32.exeMeoell32.exeMlkjne32.exeNcfoch32.exeNpmphinm.exeNiedqnen.exeNbniid32.exepid process 1072 Ihpdoh32.exe 2896 Jdpgjhbm.exe 2508 Jpiedieo.exe 2516 Konndhmb.exe 2528 Leammn32.exe 2408 Mbcmpfhi.exe 768 Nianhplq.exe 456 Nkjapglg.exe 2340 Oklnff32.exe 1488 Qndigd32.exe 1164 Accnekon.exe 1640 Baigca32.exe 2716 Bigimdjh.exe 1112 Cafgle32.exe 592 Cojhejbh.exe 2936 Eamilh32.exe 3008 Endjaief.exe 1508 Enfgfh32.exe 1476 Eccpoo32.exe 1956 Ffibkj32.exe 1548 Fhikme32.exe 1652 Fnfcel32.exe 2268 Fnipkkdl.exe 1704 Fdbhge32.exe 1604 Gqiimfam.exe 2136 Gkomjo32.exe 2484 Gegabegc.exe 2760 Gjdjklek.exe 2680 Gfkkpmko.exe 2548 Hfbaql32.exe 2364 Hloiib32.exe 1972 Hanogipc.exe 292 Hfmddp32.exe 888 Ijklknbn.exe 2028 Ilabmedg.exe 852 Ioakoq32.exe 1668 Jlelhe32.exe 1920 Jhlmmfef.exe 1252 Jdcmbgkj.exe 2720 Jnkakl32.exe 1748 Jhafhe32.exe 1592 Jnnnalph.exe 936 Kcmcoblm.exe 1168 Knbhlkkc.exe 1968 Kgkleabc.exe 1200 Klhemhpk.exe 1944 Khoebi32.exe 1264 Kohnoc32.exe 2792 Kkoncdcp.exe 1196 Lbnpkmfg.exe 2988 Lkfddc32.exe 1892 Lcdfnehp.exe 2676 Lmljgj32.exe 576 Lcfbdd32.exe 1288 Mbkpeake.exe 2248 Mnbpjb32.exe 2372 Mihdgkpp.exe 1672 Mbpipp32.exe 2400 Meoell32.exe 908 Mlkjne32.exe 2592 Ncfoch32.exe 1532 Npmphinm.exe 1924 Niedqnen.exe 1148 Nbniid32.exe -
Loads dropped DLL 64 IoCs
Processes:
735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exeIhpdoh32.exeJdpgjhbm.exeJpiedieo.exeKonndhmb.exeLeammn32.exeMbcmpfhi.exeNianhplq.exeNkjapglg.exeOklnff32.exeQndigd32.exeAccnekon.exeBaigca32.exeBigimdjh.exeCafgle32.exeCojhejbh.exeEamilh32.exeEndjaief.exeEnfgfh32.exeEccpoo32.exeFfibkj32.exeFhikme32.exeFnfcel32.exeFnipkkdl.exeFdbhge32.exeGqiimfam.exeGkomjo32.exeGegabegc.exeGjdjklek.exeGfkkpmko.exeHfbaql32.exeHloiib32.exepid process 2292 735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe 2292 735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe 1072 Ihpdoh32.exe 1072 Ihpdoh32.exe 2896 Jdpgjhbm.exe 2896 Jdpgjhbm.exe 2508 Jpiedieo.exe 2508 Jpiedieo.exe 2516 Konndhmb.exe 2516 Konndhmb.exe 2528 Leammn32.exe 2528 Leammn32.exe 2408 Mbcmpfhi.exe 2408 Mbcmpfhi.exe 768 Nianhplq.exe 768 Nianhplq.exe 456 Nkjapglg.exe 456 Nkjapglg.exe 2340 Oklnff32.exe 2340 Oklnff32.exe 1488 Qndigd32.exe 1488 Qndigd32.exe 1164 Accnekon.exe 1164 Accnekon.exe 1640 Baigca32.exe 1640 Baigca32.exe 2716 Bigimdjh.exe 2716 Bigimdjh.exe 1112 Cafgle32.exe 1112 Cafgle32.exe 592 Cojhejbh.exe 592 Cojhejbh.exe 2936 Eamilh32.exe 2936 Eamilh32.exe 3008 Endjaief.exe 3008 Endjaief.exe 1508 Enfgfh32.exe 1508 Enfgfh32.exe 1476 Eccpoo32.exe 1476 Eccpoo32.exe 1956 Ffibkj32.exe 1956 Ffibkj32.exe 1548 Fhikme32.exe 1548 Fhikme32.exe 1652 Fnfcel32.exe 1652 Fnfcel32.exe 2268 Fnipkkdl.exe 2268 Fnipkkdl.exe 1704 Fdbhge32.exe 1704 Fdbhge32.exe 1604 Gqiimfam.exe 1604 Gqiimfam.exe 2136 Gkomjo32.exe 2136 Gkomjo32.exe 2484 Gegabegc.exe 2484 Gegabegc.exe 2760 Gjdjklek.exe 2760 Gjdjklek.exe 2680 Gfkkpmko.exe 2680 Gfkkpmko.exe 2548 Hfbaql32.exe 2548 Hfbaql32.exe 2364 Hloiib32.exe 2364 Hloiib32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Ndmeecmb.exeGjgiidkl.exeLmhbgpia.exeEgihcl32.exeJkllnn32.exeBefpkmph.exeDljmlj32.exeEfkbdbai.exeKlhemhpk.exeIjnbcmkk.exePaaddgkj.exeMobaef32.exeCdfgmnpa.exeKecmfg32.exeNeekogkm.exeIencdc32.exeKkaolm32.exeKalipcmb.exeMbnocipg.exeQhilkege.exeEifmimch.exeFnmmidhm.exePgcnnh32.exeElndpnnn.exeMokkegmm.exeJfagemej.exeMeoell32.exeOiljam32.exeCjakccop.exeIfbphh32.exeFaonom32.exeOoicid32.exeHjacjifm.exeHehafe32.exeLqbfdp32.exeAaklmhak.exeMmbnam32.exePdndggcl.exePoibmdmh.exeDgnhhq32.exeKpbiempj.exeGfkkpmko.exeQhmcmk32.exePplaki32.exeJeaahk32.exeEfhcej32.exeBhjlli32.exeKfggkc32.exeLbbnjgik.exeEnfgfh32.exeFennoa32.exeImogcj32.exeNcjbba32.exeCppakj32.exeMbcmpfhi.exeMbcoio32.exeDnhefh32.exeOckinl32.exePqgilnji.exePilfpqaa.exeDiaaeepi.exeAnbkipok.exeGqodqodl.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Oobiclmh.exe Ndmeecmb.exe File created C:\Windows\SysWOW64\Apidjmhc.dll Gjgiidkl.exe File opened for modification C:\Windows\SysWOW64\Mokkegmm.exe Lmhbgpia.exe File created C:\Windows\SysWOW64\Ecoihm32.exe Egihcl32.exe File created C:\Windows\SysWOW64\Geiabo32.dll Jkllnn32.exe File opened for modification C:\Windows\SysWOW64\Cppakj32.exe Befpkmph.exe File opened for modification C:\Windows\SysWOW64\Epeekmjk.exe Dljmlj32.exe File opened for modification C:\Windows\SysWOW64\Ebabicfn.exe Efkbdbai.exe File opened for modification C:\Windows\SysWOW64\Khoebi32.exe Klhemhpk.exe File created C:\Windows\SysWOW64\Hgiekfhg.dll Ijnbcmkk.exe File created C:\Windows\SysWOW64\Bnkpfm32.dll Paaddgkj.exe File created C:\Windows\SysWOW64\Ompjookk.dll Mobaef32.exe File opened for modification C:\Windows\SysWOW64\Dgfpni32.exe Cdfgmnpa.exe File created C:\Windows\SysWOW64\Ahqfladk.dll Kecmfg32.exe File created C:\Windows\SysWOW64\Nhfdqb32.exe Neekogkm.exe File created C:\Windows\SysWOW64\Imkeneja.exe Iencdc32.exe File opened for modification C:\Windows\SysWOW64\Kdjceb32.exe Kkaolm32.exe File created C:\Windows\SysWOW64\Iglhhc32.dll Kalipcmb.exe File opened for modification C:\Windows\SysWOW64\Mbqkiind.exe Mbnocipg.exe File created C:\Windows\SysWOW64\Bgefgpha.dll Qhilkege.exe File created C:\Windows\SysWOW64\Fhohnoea.dll Eifmimch.exe File created C:\Windows\SysWOW64\Fkambhgf.exe Fnmmidhm.exe File created C:\Windows\SysWOW64\Bchmahjj.dll Pgcnnh32.exe File opened for modification C:\Windows\SysWOW64\Egchmfnd.exe Elndpnnn.exe File opened for modification C:\Windows\SysWOW64\Miapbpmb.exe Mokkegmm.exe File created C:\Windows\SysWOW64\Jibpghbk.exe Jfagemej.exe File created C:\Windows\SysWOW64\Mlkjne32.exe Meoell32.exe File created C:\Windows\SysWOW64\Qaipli32.dll Oiljam32.exe File created C:\Windows\SysWOW64\Dcllbhdn.exe Cjakccop.exe File created C:\Windows\SysWOW64\Jlnaae32.dll Ifbphh32.exe File created C:\Windows\SysWOW64\Ebfkilbo.dll Faonom32.exe File opened for modification C:\Windows\SysWOW64\Obgkpb32.exe Ooicid32.exe File created C:\Windows\SysWOW64\Ajcbch32.dll Hjacjifm.exe File created C:\Windows\SysWOW64\Iopeoknn.exe Hehafe32.exe File opened for modification C:\Windows\SysWOW64\Ljjjmeie.exe Lqbfdp32.exe File opened for modification C:\Windows\SysWOW64\Aeiecfga.exe Aaklmhak.exe File created C:\Windows\SysWOW64\Nokalbod.dll Mmbnam32.exe File created C:\Windows\SysWOW64\Aodkcd32.dll Pdndggcl.exe File opened for modification C:\Windows\SysWOW64\Pkpcbecl.exe Poibmdmh.exe File created C:\Windows\SysWOW64\Elmmegkb.exe Dgnhhq32.exe File opened for modification C:\Windows\SysWOW64\Klijjnen.exe Kpbiempj.exe File created C:\Windows\SysWOW64\Hfbaql32.exe Gfkkpmko.exe File created C:\Windows\SysWOW64\Nhndalhm.dll Qhmcmk32.exe File created C:\Windows\SysWOW64\Pifbjn32.exe Pplaki32.exe File created C:\Windows\SysWOW64\Jfekec32.exe Jeaahk32.exe File created C:\Windows\SysWOW64\Oomjld32.dll Efhcej32.exe File created C:\Windows\SysWOW64\Khoebi32.exe Klhemhpk.exe File opened for modification C:\Windows\SysWOW64\Bccmmf32.exe Bhjlli32.exe File created C:\Windows\SysWOW64\Ohlhijgh.dll Kfggkc32.exe File created C:\Windows\SysWOW64\Lmhbgpia.exe Lbbnjgik.exe File opened for modification C:\Windows\SysWOW64\Eccpoo32.exe Enfgfh32.exe File created C:\Windows\SysWOW64\Fofbhgde.exe Fennoa32.exe File created C:\Windows\SysWOW64\Mbiajn32.dll Imogcj32.exe File created C:\Windows\SysWOW64\Nlbgkgcc.exe Ncjbba32.exe File created C:\Windows\SysWOW64\Agngpn32.dll Cppakj32.exe File created C:\Windows\SysWOW64\Nianhplq.exe Mbcmpfhi.exe File created C:\Windows\SysWOW64\Oeeikk32.dll Mbcoio32.exe File created C:\Windows\SysWOW64\Hclemh32.dll Dnhefh32.exe File opened for modification C:\Windows\SysWOW64\Pgibdjln.exe Ockinl32.exe File created C:\Windows\SysWOW64\Nckopjfk.dll Pqgilnji.exe File created C:\Windows\SysWOW64\Fkfgkgmk.dll Pilfpqaa.exe File created C:\Windows\SysWOW64\Gafalh32.dll Diaaeepi.exe File opened for modification C:\Windows\SysWOW64\Bhjlli32.exe Anbkipok.exe File created C:\Windows\SysWOW64\Gjgiidkl.exe Gqodqodl.exe -
Processes:
resource yara_rule behavioral1/memory/2896-31-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/2292-54-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/1072-82-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/456-116-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/1488-146-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/2340-144-0x0000000000220000-0x000000000025C000-memory.dmp dropper_html behavioral1/memory/2508-140-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/2528-158-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/2516-155-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/2408-170-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/1112-211-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/2340-222-0x0000000000220000-0x000000000025C000-memory.dmp dropper_html behavioral1/memory/1488-224-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/2340-219-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/592-276-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/1112-274-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/1508-268-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/1640-264-0x00000000001B0000-0x00000000001EC000-memory.dmp dropper_html behavioral1/memory/2716-266-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/1640-250-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/1164-239-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/2484-360-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/1704-384-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/2268-383-0x0000000000220000-0x000000000025C000-memory.dmp dropper_html behavioral1/memory/2268-382-0x0000000000220000-0x000000000025C000-memory.dmp dropper_html behavioral1/memory/2268-381-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/2364-410-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/2484-406-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/1604-391-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/1652-371-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/1548-370-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/1956-369-0x00000000002C0000-0x00000000002FC000-memory.dmp dropper_html behavioral1/memory/1956-359-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/2136-354-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/1604-348-0x0000000000220000-0x000000000025C000-memory.dmp dropper_html behavioral1/memory/1476-344-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/2268-327-0x0000000000220000-0x000000000025C000-memory.dmp dropper_html behavioral1/memory/2268-326-0x0000000000220000-0x000000000025C000-memory.dmp dropper_html behavioral1/memory/2268-317-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/3008-307-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/1548-297-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/1956-296-0x00000000002C0000-0x00000000002FC000-memory.dmp dropper_html behavioral1/memory/2936-286-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/1640-191-0x00000000001B0000-0x00000000001EC000-memory.dmp dropper_html behavioral1/memory/456-190-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/1640-177-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/768-175-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral1/memory/2872-4914-0x0000000077A10000-0x0000000077B2F000-memory.dmp dropper_html -
Modifies registry class 64 IoCs
Processes:
Igpaec32.exeDjlbkcfn.exeHkppcmjk.exeHehafe32.exeNhfdqb32.exeOlophhjd.exeDphhka32.exeEdlafebn.exeEmgkhj32.exeOkqgcb32.exeAnjojphb.exeIgmepdbc.exeHkmjjn32.exeCngcll32.exeCdfief32.exeNnjlhg32.exePlneoace.exeIhpdoh32.exeJnkakl32.exeFhjoof32.exeQcjoci32.exeEcoihm32.exeJnnnalph.exeNflchkii.exeLgfjggll.exeKhagijcd.exeNddcimag.exeFmlglb32.exeGmlmpo32.exeCafgle32.exeBgcbhd32.exeHbjgbbpn.exeCcdmnj32.exeJcfjhj32.exeClfhml32.exeMihdgkpp.exeDafmqb32.exeBpbabf32.exeKdbbgdjj.exeLofkoamf.exeClciod32.exeAbeghmmn.exeImkeneja.exeOoicid32.exePlolgk32.exeKndbko32.exeBgdfjfmi.exeMpoppadq.exeBacgohjk.exeIoakoq32.exeGkpakq32.exeCepipm32.exeOckinl32.exeHlecmkel.exeLeammn32.exeFfibkj32.exeAbiqcm32.exePeefcjlg.exeLigfakaa.exeLhnmoo32.exeOekmceaf.exeGaeqmk32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Landhm32.dll" Igpaec32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Djlbkcfn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hkppcmjk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hehafe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fchpmeni.dll" Nhfdqb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oigemnhm.dll" Olophhjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dphhka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajokhp32.dll" Edlafebn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Emgkhj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Okqgcb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Anjojphb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfhbig32.dll" Igmepdbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdnbmp32.dll" Hkmjjn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkcbkhnk.dll" Cngcll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecagpdpe.dll" Cdfief32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nnjlhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Plneoace.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgeajlgp.dll" Ihpdoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jnkakl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gedhkkno.dll" Fhjoof32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qcjoci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocdqlmmg.dll" Ecoihm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpomfdnk.dll" Jnnnalph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lndglp32.dll" Nflchkii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Edlafebn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lgfjggll.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Khagijcd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nddcimag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmhmmnpq.dll" Fmlglb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gmlmpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cafgle32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bgcbhd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldfmbane.dll" Hbjgbbpn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ccdmnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jcfjhj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Clfhml32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mihdgkpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dafmqb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bpbabf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kdbbgdjj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lofkoamf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Clciod32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Abeghmmn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ondomh32.dll" Imkeneja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndmcdl32.dll" Ooicid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Plolgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kndbko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Madcho32.dll" Bgdfjfmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mpoppadq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhedee32.dll" Bacgohjk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ioakoq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gkpakq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cepipm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ockinl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afnmbcbg.dll" Hlecmkel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khlajd32.dll" Leammn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnndbd32.dll" Ffibkj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ecoihm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnofaf32.dll" Abiqcm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Peefcjlg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ligfakaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcfgo32.dll" Lhnmoo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oekmceaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oepbmk32.dll" Gaeqmk32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exeIhpdoh32.exeJdpgjhbm.exeJpiedieo.exeKonndhmb.exeLeammn32.exeMbcmpfhi.exeNianhplq.exeNkjapglg.exeOklnff32.exeQndigd32.exeAccnekon.exeBaigca32.exeBigimdjh.exeCafgle32.exeCojhejbh.exedescription pid process target process PID 2292 wrote to memory of 1072 2292 735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe Ihpdoh32.exe PID 2292 wrote to memory of 1072 2292 735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe Ihpdoh32.exe PID 2292 wrote to memory of 1072 2292 735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe Ihpdoh32.exe PID 2292 wrote to memory of 1072 2292 735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe Ihpdoh32.exe PID 1072 wrote to memory of 2896 1072 Ihpdoh32.exe Jdpgjhbm.exe PID 1072 wrote to memory of 2896 1072 Ihpdoh32.exe Jdpgjhbm.exe PID 1072 wrote to memory of 2896 1072 Ihpdoh32.exe Jdpgjhbm.exe PID 1072 wrote to memory of 2896 1072 Ihpdoh32.exe Jdpgjhbm.exe PID 2896 wrote to memory of 2508 2896 Jdpgjhbm.exe Jpiedieo.exe PID 2896 wrote to memory of 2508 2896 Jdpgjhbm.exe Jpiedieo.exe PID 2896 wrote to memory of 2508 2896 Jdpgjhbm.exe Jpiedieo.exe PID 2896 wrote to memory of 2508 2896 Jdpgjhbm.exe Jpiedieo.exe PID 2508 wrote to memory of 2516 2508 Jpiedieo.exe Konndhmb.exe PID 2508 wrote to memory of 2516 2508 Jpiedieo.exe Konndhmb.exe PID 2508 wrote to memory of 2516 2508 Jpiedieo.exe Konndhmb.exe PID 2508 wrote to memory of 2516 2508 Jpiedieo.exe Konndhmb.exe PID 2516 wrote to memory of 2528 2516 Konndhmb.exe Leammn32.exe PID 2516 wrote to memory of 2528 2516 Konndhmb.exe Leammn32.exe PID 2516 wrote to memory of 2528 2516 Konndhmb.exe Leammn32.exe PID 2516 wrote to memory of 2528 2516 Konndhmb.exe Leammn32.exe PID 2528 wrote to memory of 2408 2528 Leammn32.exe Mbcmpfhi.exe PID 2528 wrote to memory of 2408 2528 Leammn32.exe Mbcmpfhi.exe PID 2528 wrote to memory of 2408 2528 Leammn32.exe Mbcmpfhi.exe PID 2528 wrote to memory of 2408 2528 Leammn32.exe Mbcmpfhi.exe PID 2408 wrote to memory of 768 2408 Mbcmpfhi.exe Nianhplq.exe PID 2408 wrote to memory of 768 2408 Mbcmpfhi.exe Nianhplq.exe PID 2408 wrote to memory of 768 2408 Mbcmpfhi.exe Nianhplq.exe PID 2408 wrote to memory of 768 2408 Mbcmpfhi.exe Nianhplq.exe PID 768 wrote to memory of 456 768 Nianhplq.exe Nkjapglg.exe PID 768 wrote to memory of 456 768 Nianhplq.exe Nkjapglg.exe PID 768 wrote to memory of 456 768 Nianhplq.exe Nkjapglg.exe PID 768 wrote to memory of 456 768 Nianhplq.exe Nkjapglg.exe PID 456 wrote to memory of 2340 456 Nkjapglg.exe Oklnff32.exe PID 456 wrote to memory of 2340 456 Nkjapglg.exe Oklnff32.exe PID 456 wrote to memory of 2340 456 Nkjapglg.exe Oklnff32.exe PID 456 wrote to memory of 2340 456 Nkjapglg.exe Oklnff32.exe PID 2340 wrote to memory of 1488 2340 Oklnff32.exe Qndigd32.exe PID 2340 wrote to memory of 1488 2340 Oklnff32.exe Qndigd32.exe PID 2340 wrote to memory of 1488 2340 Oklnff32.exe Qndigd32.exe PID 2340 wrote to memory of 1488 2340 Oklnff32.exe Qndigd32.exe PID 1488 wrote to memory of 1164 1488 Qndigd32.exe Accnekon.exe PID 1488 wrote to memory of 1164 1488 Qndigd32.exe Accnekon.exe PID 1488 wrote to memory of 1164 1488 Qndigd32.exe Accnekon.exe PID 1488 wrote to memory of 1164 1488 Qndigd32.exe Accnekon.exe PID 1164 wrote to memory of 1640 1164 Accnekon.exe Baigca32.exe PID 1164 wrote to memory of 1640 1164 Accnekon.exe Baigca32.exe PID 1164 wrote to memory of 1640 1164 Accnekon.exe Baigca32.exe PID 1164 wrote to memory of 1640 1164 Accnekon.exe Baigca32.exe PID 1640 wrote to memory of 2716 1640 Baigca32.exe Bigimdjh.exe PID 1640 wrote to memory of 2716 1640 Baigca32.exe Bigimdjh.exe PID 1640 wrote to memory of 2716 1640 Baigca32.exe Bigimdjh.exe PID 1640 wrote to memory of 2716 1640 Baigca32.exe Bigimdjh.exe PID 2716 wrote to memory of 1112 2716 Bigimdjh.exe Cafgle32.exe PID 2716 wrote to memory of 1112 2716 Bigimdjh.exe Cafgle32.exe PID 2716 wrote to memory of 1112 2716 Bigimdjh.exe Cafgle32.exe PID 2716 wrote to memory of 1112 2716 Bigimdjh.exe Cafgle32.exe PID 1112 wrote to memory of 592 1112 Cafgle32.exe Cojhejbh.exe PID 1112 wrote to memory of 592 1112 Cafgle32.exe Cojhejbh.exe PID 1112 wrote to memory of 592 1112 Cafgle32.exe Cojhejbh.exe PID 1112 wrote to memory of 592 1112 Cafgle32.exe Cojhejbh.exe PID 592 wrote to memory of 2936 592 Cojhejbh.exe Eamilh32.exe PID 592 wrote to memory of 2936 592 Cojhejbh.exe Eamilh32.exe PID 592 wrote to memory of 2936 592 Cojhejbh.exe Eamilh32.exe PID 592 wrote to memory of 2936 592 Cojhejbh.exe Eamilh32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe"C:\Users\Admin\AppData\Local\Temp\735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\Ihpdoh32.exeC:\Windows\system32\Ihpdoh32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\Jdpgjhbm.exeC:\Windows\system32\Jdpgjhbm.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\Jpiedieo.exeC:\Windows\system32\Jpiedieo.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\Konndhmb.exeC:\Windows\system32\Konndhmb.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\Leammn32.exeC:\Windows\system32\Leammn32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\Mbcmpfhi.exeC:\Windows\system32\Mbcmpfhi.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\Nianhplq.exeC:\Windows\system32\Nianhplq.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\Nkjapglg.exeC:\Windows\system32\Nkjapglg.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\SysWOW64\Oklnff32.exeC:\Windows\system32\Oklnff32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\Qndigd32.exeC:\Windows\system32\Qndigd32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\Accnekon.exeC:\Windows\system32\Accnekon.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\Baigca32.exeC:\Windows\system32\Baigca32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\Bigimdjh.exeC:\Windows\system32\Bigimdjh.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\Cafgle32.exeC:\Windows\system32\Cafgle32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\Cojhejbh.exeC:\Windows\system32\Cojhejbh.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\SysWOW64\Eamilh32.exeC:\Windows\system32\Eamilh32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Windows\SysWOW64\Endjaief.exeC:\Windows\system32\Endjaief.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Windows\SysWOW64\Enfgfh32.exeC:\Windows\system32\Enfgfh32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1508 -
C:\Windows\SysWOW64\Eccpoo32.exeC:\Windows\system32\Eccpoo32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Windows\SysWOW64\Ffibkj32.exeC:\Windows\system32\Ffibkj32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1956 -
C:\Windows\SysWOW64\Fhikme32.exeC:\Windows\system32\Fhikme32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Windows\SysWOW64\Fnfcel32.exeC:\Windows\system32\Fnfcel32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Windows\SysWOW64\Fnipkkdl.exeC:\Windows\system32\Fnipkkdl.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Windows\SysWOW64\Fdbhge32.exeC:\Windows\system32\Fdbhge32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Windows\SysWOW64\Gqiimfam.exeC:\Windows\system32\Gqiimfam.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Windows\SysWOW64\Gkomjo32.exeC:\Windows\system32\Gkomjo32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Windows\SysWOW64\Gegabegc.exeC:\Windows\system32\Gegabegc.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Windows\SysWOW64\Gjdjklek.exeC:\Windows\system32\Gjdjklek.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Windows\SysWOW64\Gfkkpmko.exeC:\Windows\system32\Gfkkpmko.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2680 -
C:\Windows\SysWOW64\Hfbaql32.exeC:\Windows\system32\Hfbaql32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Windows\SysWOW64\Hloiib32.exeC:\Windows\system32\Hloiib32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Windows\SysWOW64\Hanogipc.exeC:\Windows\system32\Hanogipc.exe33⤵
- Executes dropped EXE
PID:1972 -
C:\Windows\SysWOW64\Hfmddp32.exeC:\Windows\system32\Hfmddp32.exe34⤵
- Executes dropped EXE
PID:292 -
C:\Windows\SysWOW64\Ijklknbn.exeC:\Windows\system32\Ijklknbn.exe35⤵
- Executes dropped EXE
PID:888 -
C:\Windows\SysWOW64\Ilabmedg.exeC:\Windows\system32\Ilabmedg.exe36⤵
- Executes dropped EXE
PID:2028 -
C:\Windows\SysWOW64\Ioakoq32.exeC:\Windows\system32\Ioakoq32.exe37⤵
- Executes dropped EXE
- Modifies registry class
PID:852 -
C:\Windows\SysWOW64\Jlelhe32.exeC:\Windows\system32\Jlelhe32.exe38⤵
- Executes dropped EXE
PID:1668 -
C:\Windows\SysWOW64\Jhlmmfef.exeC:\Windows\system32\Jhlmmfef.exe39⤵
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\Jdcmbgkj.exeC:\Windows\system32\Jdcmbgkj.exe40⤵
- Executes dropped EXE
PID:1252 -
C:\Windows\SysWOW64\Jnkakl32.exeC:\Windows\system32\Jnkakl32.exe41⤵
- Executes dropped EXE
- Modifies registry class
PID:2720 -
C:\Windows\SysWOW64\Jhafhe32.exeC:\Windows\system32\Jhafhe32.exe42⤵
- Executes dropped EXE
PID:1748 -
C:\Windows\SysWOW64\Jnnnalph.exeC:\Windows\system32\Jnnnalph.exe43⤵
- Executes dropped EXE
- Modifies registry class
PID:1592 -
C:\Windows\SysWOW64\Kcmcoblm.exeC:\Windows\system32\Kcmcoblm.exe44⤵
- Executes dropped EXE
PID:936 -
C:\Windows\SysWOW64\Knbhlkkc.exeC:\Windows\system32\Knbhlkkc.exe45⤵
- Executes dropped EXE
PID:1168 -
C:\Windows\SysWOW64\Kgkleabc.exeC:\Windows\system32\Kgkleabc.exe46⤵
- Executes dropped EXE
PID:1968 -
C:\Windows\SysWOW64\Klhemhpk.exeC:\Windows\system32\Klhemhpk.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1200 -
C:\Windows\SysWOW64\Khoebi32.exeC:\Windows\system32\Khoebi32.exe48⤵
- Executes dropped EXE
PID:1944 -
C:\Windows\SysWOW64\Kohnoc32.exeC:\Windows\system32\Kohnoc32.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1264 -
C:\Windows\SysWOW64\Kkoncdcp.exeC:\Windows\system32\Kkoncdcp.exe50⤵
- Executes dropped EXE
PID:2792 -
C:\Windows\SysWOW64\Lbnpkmfg.exeC:\Windows\system32\Lbnpkmfg.exe51⤵
- Executes dropped EXE
PID:1196 -
C:\Windows\SysWOW64\Lkfddc32.exeC:\Windows\system32\Lkfddc32.exe52⤵
- Executes dropped EXE
PID:2988 -
C:\Windows\SysWOW64\Lcdfnehp.exeC:\Windows\system32\Lcdfnehp.exe53⤵
- Executes dropped EXE
PID:1892 -
C:\Windows\SysWOW64\Lmljgj32.exeC:\Windows\system32\Lmljgj32.exe54⤵
- Executes dropped EXE
PID:2676 -
C:\Windows\SysWOW64\Lcfbdd32.exeC:\Windows\system32\Lcfbdd32.exe55⤵
- Executes dropped EXE
PID:576 -
C:\Windows\SysWOW64\Mbkpeake.exeC:\Windows\system32\Mbkpeake.exe56⤵
- Executes dropped EXE
PID:1288 -
C:\Windows\SysWOW64\Mnbpjb32.exeC:\Windows\system32\Mnbpjb32.exe57⤵
- Executes dropped EXE
PID:2248 -
C:\Windows\SysWOW64\Mihdgkpp.exeC:\Windows\system32\Mihdgkpp.exe58⤵
- Executes dropped EXE
- Modifies registry class
PID:2372 -
C:\Windows\SysWOW64\Mbpipp32.exeC:\Windows\system32\Mbpipp32.exe59⤵
- Executes dropped EXE
PID:1672 -
C:\Windows\SysWOW64\Meoell32.exeC:\Windows\system32\Meoell32.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2400 -
C:\Windows\SysWOW64\Mlkjne32.exeC:\Windows\system32\Mlkjne32.exe61⤵
- Executes dropped EXE
PID:908 -
C:\Windows\SysWOW64\Ncfoch32.exeC:\Windows\system32\Ncfoch32.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2592 -
C:\Windows\SysWOW64\Npmphinm.exeC:\Windows\system32\Npmphinm.exe63⤵
- Executes dropped EXE
PID:1532 -
C:\Windows\SysWOW64\Niedqnen.exeC:\Windows\system32\Niedqnen.exe64⤵
- Executes dropped EXE
PID:1924 -
C:\Windows\SysWOW64\Nbniid32.exeC:\Windows\system32\Nbniid32.exe65⤵
- Executes dropped EXE
PID:1148 -
C:\Windows\SysWOW64\Nlfmbibo.exeC:\Windows\system32\Nlfmbibo.exe66⤵PID:1172
-
C:\Windows\SysWOW64\Noffdd32.exeC:\Windows\system32\Noffdd32.exe67⤵PID:1784
-
C:\Windows\SysWOW64\Oiljam32.exeC:\Windows\system32\Oiljam32.exe68⤵
- Drops file in System32 directory
PID:772 -
C:\Windows\SysWOW64\Ooicid32.exeC:\Windows\system32\Ooicid32.exe69⤵
- Drops file in System32 directory
- Modifies registry class
PID:2164 -
C:\Windows\SysWOW64\Obgkpb32.exeC:\Windows\system32\Obgkpb32.exe70⤵PID:1060
-
C:\Windows\SysWOW64\Olophhjd.exeC:\Windows\system32\Olophhjd.exe71⤵
- Modifies registry class
PID:2768 -
C:\Windows\SysWOW64\Okgjodmi.exeC:\Windows\system32\Okgjodmi.exe72⤵PID:1936
-
C:\Windows\SysWOW64\Pdonhj32.exeC:\Windows\system32\Pdonhj32.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3004 -
C:\Windows\SysWOW64\Pilfpqaa.exeC:\Windows\system32\Pilfpqaa.exe74⤵
- Drops file in System32 directory
PID:2876 -
C:\Windows\SysWOW64\Pgpgjepk.exeC:\Windows\system32\Pgpgjepk.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2096 -
C:\Windows\SysWOW64\Plmpblnb.exeC:\Windows\system32\Plmpblnb.exe76⤵PID:2324
-
C:\Windows\SysWOW64\Pcghof32.exeC:\Windows\system32\Pcghof32.exe77⤵PID:2124
-
C:\Windows\SysWOW64\Plolgk32.exeC:\Windows\system32\Plolgk32.exe78⤵
- Modifies registry class
PID:2444 -
C:\Windows\SysWOW64\Pciddedl.exeC:\Windows\system32\Pciddedl.exe79⤵PID:2900
-
C:\Windows\SysWOW64\Qobbofgn.exeC:\Windows\system32\Qobbofgn.exe80⤵PID:2756
-
C:\Windows\SysWOW64\Qdojgmfe.exeC:\Windows\system32\Qdojgmfe.exe81⤵PID:1384
-
C:\Windows\SysWOW64\Qackpado.exeC:\Windows\system32\Qackpado.exe82⤵PID:1160
-
C:\Windows\SysWOW64\Qhmcmk32.exeC:\Windows\system32\Qhmcmk32.exe83⤵
- Drops file in System32 directory
PID:2588 -
C:\Windows\SysWOW64\Ajnpecbj.exeC:\Windows\system32\Ajnpecbj.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2016 -
C:\Windows\SysWOW64\Adcdbl32.exeC:\Windows\system32\Adcdbl32.exe85⤵PID:1524
-
C:\Windows\SysWOW64\Aknlofim.exeC:\Windows\system32\Aknlofim.exe86⤵PID:2180
-
C:\Windows\SysWOW64\Aihfap32.exeC:\Windows\system32\Aihfap32.exe87⤵PID:1628
-
C:\Windows\SysWOW64\Amfognic.exeC:\Windows\system32\Amfognic.exe88⤵PID:932
-
C:\Windows\SysWOW64\Cillkbac.exeC:\Windows\system32\Cillkbac.exe89⤵PID:2044
-
C:\Windows\SysWOW64\Cbepdhgc.exeC:\Windows\system32\Cbepdhgc.exe90⤵PID:1304
-
C:\Windows\SysWOW64\Cmjdaqgi.exeC:\Windows\system32\Cmjdaqgi.exe91⤵PID:2796
-
C:\Windows\SysWOW64\Ccdmnj32.exeC:\Windows\system32\Ccdmnj32.exe92⤵
- Modifies registry class
PID:2476 -
C:\Windows\SysWOW64\Djgkii32.exeC:\Windows\system32\Djgkii32.exe93⤵PID:2700
-
C:\Windows\SysWOW64\Dkigoimd.exeC:\Windows\system32\Dkigoimd.exe94⤵PID:3056
-
C:\Windows\SysWOW64\Dafmqb32.exeC:\Windows\system32\Dafmqb32.exe95⤵
- Modifies registry class
PID:2284 -
C:\Windows\SysWOW64\Diaaeepi.exeC:\Windows\system32\Diaaeepi.exe96⤵
- Drops file in System32 directory
PID:1680 -
C:\Windows\SysWOW64\Dicnkdnf.exeC:\Windows\system32\Dicnkdnf.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:608 -
C:\Windows\SysWOW64\Eelkeeah.exeC:\Windows\system32\Eelkeeah.exe98⤵PID:1464
-
C:\Windows\SysWOW64\Elipgofb.exeC:\Windows\system32\Elipgofb.exe99⤵PID:2204
-
C:\Windows\SysWOW64\Eaeipfei.exeC:\Windows\system32\Eaeipfei.exe100⤵PID:3060
-
C:\Windows\SysWOW64\Fgdnnl32.exeC:\Windows\system32\Fgdnnl32.exe101⤵PID:2584
-
C:\Windows\SysWOW64\Fnofjfhk.exeC:\Windows\system32\Fnofjfhk.exe102⤵PID:2540
-
C:\Windows\SysWOW64\Fkecij32.exeC:\Windows\system32\Fkecij32.exe103⤵PID:1540
-
C:\Windows\SysWOW64\Flfpabkp.exeC:\Windows\system32\Flfpabkp.exe104⤵PID:948
-
C:\Windows\SysWOW64\Fogibnha.exeC:\Windows\system32\Fogibnha.exe105⤵PID:2536
-
C:\Windows\SysWOW64\Fmkilb32.exeC:\Windows\system32\Fmkilb32.exe106⤵PID:808
-
C:\Windows\SysWOW64\Gdhkfd32.exeC:\Windows\system32\Gdhkfd32.exe107⤵PID:2684
-
C:\Windows\SysWOW64\Gkbcbn32.exeC:\Windows\system32\Gkbcbn32.exe108⤵PID:2084
-
C:\Windows\SysWOW64\Gdkgkcpq.exeC:\Windows\system32\Gdkgkcpq.exe109⤵PID:1048
-
C:\Windows\SysWOW64\Gqahqd32.exeC:\Windows\system32\Gqahqd32.exe110⤵PID:1696
-
C:\Windows\SysWOW64\Gcbabpcf.exeC:\Windows\system32\Gcbabpcf.exe111⤵PID:1636
-
C:\Windows\SysWOW64\Hmkeke32.exeC:\Windows\system32\Hmkeke32.exe112⤵PID:2056
-
C:\Windows\SysWOW64\Hmmbqegc.exeC:\Windows\system32\Hmmbqegc.exe113⤵PID:2148
-
C:\Windows\SysWOW64\Hjacjifm.exeC:\Windows\system32\Hjacjifm.exe114⤵
- Drops file in System32 directory
PID:2656 -
C:\Windows\SysWOW64\Hfhcoj32.exeC:\Windows\system32\Hfhcoj32.exe115⤵PID:2800
-
C:\Windows\SysWOW64\Hemqpf32.exeC:\Windows\system32\Hemqpf32.exe116⤵PID:3024
-
C:\Windows\SysWOW64\Iliebpfc.exeC:\Windows\system32\Iliebpfc.exe117⤵PID:3064
-
C:\Windows\SysWOW64\Ibcnojnp.exeC:\Windows\system32\Ibcnojnp.exe118⤵PID:1664
-
C:\Windows\SysWOW64\Ijnbcmkk.exeC:\Windows\system32\Ijnbcmkk.exe119⤵
- Drops file in System32 directory
PID:2104 -
C:\Windows\SysWOW64\Inlkik32.exeC:\Windows\system32\Inlkik32.exe120⤵PID:472
-
C:\Windows\SysWOW64\Idkpganf.exeC:\Windows\system32\Idkpganf.exe121⤵PID:2212
-
C:\Windows\SysWOW64\Jmdepg32.exeC:\Windows\system32\Jmdepg32.exe122⤵PID:1836
-
C:\Windows\SysWOW64\Jmhnkfpa.exeC:\Windows\system32\Jmhnkfpa.exe123⤵PID:800
-
C:\Windows\SysWOW64\Jojkco32.exeC:\Windows\system32\Jojkco32.exe124⤵PID:1964
-
C:\Windows\SysWOW64\Jioopgef.exeC:\Windows\system32\Jioopgef.exe125⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1104 -
C:\Windows\SysWOW64\Jefpeh32.exeC:\Windows\system32\Jefpeh32.exe126⤵PID:1728
-
C:\Windows\SysWOW64\Kncaojfb.exeC:\Windows\system32\Kncaojfb.exe127⤵PID:2612
-
C:\Windows\SysWOW64\Khielcfh.exeC:\Windows\system32\Khielcfh.exe128⤵PID:2644
-
C:\Windows\SysWOW64\Kdbbgdjj.exeC:\Windows\system32\Kdbbgdjj.exe129⤵
- Modifies registry class
PID:2376 -
C:\Windows\SysWOW64\Lkjjma32.exeC:\Windows\system32\Lkjjma32.exe130⤵PID:1480
-
C:\Windows\SysWOW64\Ldbofgme.exeC:\Windows\system32\Ldbofgme.exe131⤵PID:1840
-
C:\Windows\SysWOW64\Mbhlek32.exeC:\Windows\system32\Mbhlek32.exe132⤵PID:2744
-
C:\Windows\SysWOW64\Mdiefffn.exeC:\Windows\system32\Mdiefffn.exe133⤵PID:2868
-
C:\Windows\SysWOW64\Mnaiol32.exeC:\Windows\system32\Mnaiol32.exe134⤵PID:2520
-
C:\Windows\SysWOW64\Mbcoio32.exeC:\Windows\system32\Mbcoio32.exe135⤵
- Drops file in System32 directory
PID:1244 -
C:\Windows\SysWOW64\Mcckcbgp.exeC:\Windows\system32\Mcckcbgp.exe136⤵PID:1580
-
C:\Windows\SysWOW64\Nfdddm32.exeC:\Windows\system32\Nfdddm32.exe137⤵PID:2232
-
C:\Windows\SysWOW64\Nplimbka.exeC:\Windows\system32\Nplimbka.exe138⤵PID:1500
-
C:\Windows\SysWOW64\Napbjjom.exeC:\Windows\system32\Napbjjom.exe139⤵PID:2628
-
C:\Windows\SysWOW64\Nncbdomg.exeC:\Windows\system32\Nncbdomg.exe140⤵PID:2348
-
C:\Windows\SysWOW64\Ofadnq32.exeC:\Windows\system32\Ofadnq32.exe141⤵PID:1300
-
C:\Windows\SysWOW64\Opihgfop.exeC:\Windows\system32\Opihgfop.exe142⤵PID:2208
-
C:\Windows\SysWOW64\Objaha32.exeC:\Windows\system32\Objaha32.exe143⤵PID:2184
-
C:\Windows\SysWOW64\Opnbbe32.exeC:\Windows\system32\Opnbbe32.exe144⤵PID:1120
-
C:\Windows\SysWOW64\Oabkom32.exeC:\Windows\system32\Oabkom32.exe145⤵PID:2728
-
C:\Windows\SysWOW64\Pbagipfi.exeC:\Windows\system32\Pbagipfi.exe146⤵PID:1068
-
C:\Windows\SysWOW64\Pgcmbcih.exeC:\Windows\system32\Pgcmbcih.exe147⤵PID:2704
-
C:\Windows\SysWOW64\Pplaki32.exeC:\Windows\system32\Pplaki32.exe148⤵
- Drops file in System32 directory
PID:2296 -
C:\Windows\SysWOW64\Pifbjn32.exeC:\Windows\system32\Pifbjn32.exe149⤵PID:1484
-
C:\Windows\SysWOW64\Qndkpmkm.exeC:\Windows\system32\Qndkpmkm.exe150⤵PID:2952
-
C:\Windows\SysWOW64\Aohdmdoh.exeC:\Windows\system32\Aohdmdoh.exe151⤵PID:2724
-
C:\Windows\SysWOW64\Ahpifj32.exeC:\Windows\system32\Ahpifj32.exe152⤵PID:2712
-
C:\Windows\SysWOW64\Afffenbp.exeC:\Windows\system32\Afffenbp.exe153⤵PID:2856
-
C:\Windows\SysWOW64\Anbkipok.exeC:\Windows\system32\Anbkipok.exe154⤵
- Drops file in System32 directory
PID:268 -
C:\Windows\SysWOW64\Bhjlli32.exeC:\Windows\system32\Bhjlli32.exe155⤵
- Drops file in System32 directory
PID:752 -
C:\Windows\SysWOW64\Bccmmf32.exeC:\Windows\system32\Bccmmf32.exe156⤵PID:2992
-
C:\Windows\SysWOW64\Bfdenafn.exeC:\Windows\system32\Bfdenafn.exe157⤵PID:1136
-
C:\Windows\SysWOW64\Bgcbhd32.exeC:\Windows\system32\Bgcbhd32.exe158⤵
- Modifies registry class
PID:636 -
C:\Windows\SysWOW64\Bieopm32.exeC:\Windows\system32\Bieopm32.exe159⤵PID:2036
-
C:\Windows\SysWOW64\Coacbfii.exeC:\Windows\system32\Coacbfii.exe160⤵PID:1988
-
C:\Windows\SysWOW64\Cepipm32.exeC:\Windows\system32\Cepipm32.exe161⤵
- Modifies registry class
PID:2996 -
C:\Windows\SysWOW64\Cpfmmf32.exeC:\Windows\system32\Cpfmmf32.exe162⤵PID:2176
-
C:\Windows\SysWOW64\Cbffoabe.exeC:\Windows\system32\Cbffoabe.exe163⤵PID:2404
-
C:\Windows\SysWOW64\Cjakccop.exeC:\Windows\system32\Cjakccop.exe164⤵
- Drops file in System32 directory
PID:1904 -
C:\Windows\SysWOW64\Dcllbhdn.exeC:\Windows\system32\Dcllbhdn.exe165⤵PID:2836
-
C:\Windows\SysWOW64\Dljmlj32.exeC:\Windows\system32\Dljmlj32.exe166⤵
- Drops file in System32 directory
PID:1564 -
C:\Windows\SysWOW64\Epeekmjk.exeC:\Windows\system32\Epeekmjk.exe167⤵PID:1764
-
C:\Windows\SysWOW64\Emifeqid.exeC:\Windows\system32\Emifeqid.exe168⤵PID:2388
-
C:\Windows\SysWOW64\Ecfnmh32.exeC:\Windows\system32\Ecfnmh32.exe169⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2580 -
C:\Windows\SysWOW64\Fdekgjno.exeC:\Windows\system32\Fdekgjno.exe170⤵PID:1620
-
C:\Windows\SysWOW64\Fiepea32.exeC:\Windows\system32\Fiepea32.exe171⤵PID:2708
-
C:\Windows\SysWOW64\Flclam32.exeC:\Windows\system32\Flclam32.exe172⤵PID:2216
-
C:\Windows\SysWOW64\Fennoa32.exeC:\Windows\system32\Fennoa32.exe173⤵
- Drops file in System32 directory
PID:2980 -
C:\Windows\SysWOW64\Fofbhgde.exeC:\Windows\system32\Fofbhgde.exe174⤵PID:1804
-
C:\Windows\SysWOW64\Fepjea32.exeC:\Windows\system32\Fepjea32.exe175⤵PID:1560
-
C:\Windows\SysWOW64\Gagkjbaf.exeC:\Windows\system32\Gagkjbaf.exe176⤵PID:2288
-
C:\Windows\SysWOW64\Gkalhgfd.exeC:\Windows\system32\Gkalhgfd.exe177⤵PID:1012
-
C:\Windows\SysWOW64\Gqodqodl.exeC:\Windows\system32\Gqodqodl.exe178⤵
- Drops file in System32 directory
PID:1544 -
C:\Windows\SysWOW64\Gjgiidkl.exeC:\Windows\system32\Gjgiidkl.exe179⤵
- Drops file in System32 directory
PID:2320 -
C:\Windows\SysWOW64\Godaakic.exeC:\Windows\system32\Godaakic.exe180⤵PID:1692
-
C:\Windows\SysWOW64\Hinbppna.exeC:\Windows\system32\Hinbppna.exe181⤵PID:2272
-
C:\Windows\SysWOW64\Hbggif32.exeC:\Windows\system32\Hbggif32.exe182⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2788 -
C:\Windows\SysWOW64\Hokhbj32.exeC:\Windows\system32\Hokhbj32.exe183⤵PID:1772
-
C:\Windows\SysWOW64\Hbidne32.exeC:\Windows\system32\Hbidne32.exe184⤵PID:1132
-
C:\Windows\SysWOW64\Hbnmienj.exeC:\Windows\system32\Hbnmienj.exe185⤵PID:556
-
C:\Windows\SysWOW64\Imgnjb32.exeC:\Windows\system32\Imgnjb32.exe186⤵PID:2960
-
C:\Windows\SysWOW64\Igmbgk32.exeC:\Windows\system32\Igmbgk32.exe187⤵PID:2956
-
C:\Windows\SysWOW64\Ifbphh32.exeC:\Windows\system32\Ifbphh32.exe188⤵
- Drops file in System32 directory
PID:2468 -
C:\Windows\SysWOW64\Iichjc32.exeC:\Windows\system32\Iichjc32.exe189⤵PID:1688
-
C:\Windows\SysWOW64\Ibkmchbh.exeC:\Windows\system32\Ibkmchbh.exe190⤵PID:1724
-
C:\Windows\SysWOW64\Jlfnangf.exeC:\Windows\system32\Jlfnangf.exe191⤵PID:3112
-
C:\Windows\SysWOW64\Jenbjc32.exeC:\Windows\system32\Jenbjc32.exe192⤵PID:3152
-
C:\Windows\SysWOW64\Jeqopcld.exeC:\Windows\system32\Jeqopcld.exe193⤵PID:3192
-
C:\Windows\SysWOW64\Jjpdmi32.exeC:\Windows\system32\Jjpdmi32.exe194⤵PID:3232
-
C:\Windows\SysWOW64\Kalipcmb.exeC:\Windows\system32\Kalipcmb.exe195⤵
- Drops file in System32 directory
PID:3272 -
C:\Windows\SysWOW64\Kfibhjlj.exeC:\Windows\system32\Kfibhjlj.exe196⤵PID:3312
-
C:\Windows\SysWOW64\Kpafapbk.exeC:\Windows\system32\Kpafapbk.exe197⤵PID:3352
-
C:\Windows\SysWOW64\Kofcbl32.exeC:\Windows\system32\Kofcbl32.exe198⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3392 -
C:\Windows\SysWOW64\Kcginj32.exeC:\Windows\system32\Kcginj32.exe199⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3436 -
C:\Windows\SysWOW64\Lkbmbl32.exeC:\Windows\system32\Lkbmbl32.exe200⤵PID:3476
-
C:\Windows\SysWOW64\Lncfcgeb.exeC:\Windows\system32\Lncfcgeb.exe201⤵PID:3516
-
C:\Windows\SysWOW64\Lgkkmm32.exeC:\Windows\system32\Lgkkmm32.exe202⤵PID:3556
-
C:\Windows\SysWOW64\Lnecigcp.exeC:\Windows\system32\Lnecigcp.exe203⤵PID:3596
-
C:\Windows\SysWOW64\Lkicbk32.exeC:\Windows\system32\Lkicbk32.exe204⤵PID:3636
-
C:\Windows\SysWOW64\Mhcmedli.exeC:\Windows\system32\Mhcmedli.exe205⤵PID:3676
-
C:\Windows\SysWOW64\Mblbnj32.exeC:\Windows\system32\Mblbnj32.exe206⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3716 -
C:\Windows\SysWOW64\Mbnocipg.exeC:\Windows\system32\Mbnocipg.exe207⤵
- Drops file in System32 directory
PID:3756 -
C:\Windows\SysWOW64\Mbqkiind.exeC:\Windows\system32\Mbqkiind.exe208⤵PID:3796
-
C:\Windows\SysWOW64\Mbchni32.exeC:\Windows\system32\Mbchni32.exe209⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3840 -
C:\Windows\SysWOW64\Nmabjfek.exeC:\Windows\system32\Nmabjfek.exe210⤵PID:3880
-
C:\Windows\SysWOW64\Nflchkii.exeC:\Windows\system32\Nflchkii.exe211⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3920 -
C:\Windows\SysWOW64\Ofnpnkgf.exeC:\Windows\system32\Ofnpnkgf.exe212⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3960 -
C:\Windows\SysWOW64\Olkifaen.exeC:\Windows\system32\Olkifaen.exe213⤵PID:4000
-
C:\Windows\SysWOW64\Opialpld.exeC:\Windows\system32\Opialpld.exe214⤵PID:4040
-
C:\Windows\SysWOW64\Objjnkie.exeC:\Windows\system32\Objjnkie.exe215⤵PID:4080
-
C:\Windows\SysWOW64\Omckoi32.exeC:\Windows\system32\Omckoi32.exe216⤵PID:3084
-
C:\Windows\SysWOW64\Paaddgkj.exeC:\Windows\system32\Paaddgkj.exe217⤵
- Drops file in System32 directory
PID:3128 -
C:\Windows\SysWOW64\Pfnmmn32.exeC:\Windows\system32\Pfnmmn32.exe218⤵PID:3132
-
C:\Windows\SysWOW64\Plmbkd32.exeC:\Windows\system32\Plmbkd32.exe219⤵PID:3220
-
C:\Windows\SysWOW64\Peefcjlg.exeC:\Windows\system32\Peefcjlg.exe220⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3264 -
C:\Windows\SysWOW64\Paocnkph.exeC:\Windows\system32\Paocnkph.exe221⤵PID:1072
-
C:\Windows\SysWOW64\Qhilkege.exeC:\Windows\system32\Qhilkege.exe222⤵
- Drops file in System32 directory
PID:3092 -
C:\Windows\SysWOW64\Aacmij32.exeC:\Windows\system32\Aacmij32.exe223⤵PID:3364
-
C:\Windows\SysWOW64\Aognbnkm.exeC:\Windows\system32\Aognbnkm.exe224⤵PID:3452
-
C:\Windows\SysWOW64\Adfbpega.exeC:\Windows\system32\Adfbpega.exe225⤵PID:3504
-
C:\Windows\SysWOW64\Apmcefmf.exeC:\Windows\system32\Apmcefmf.exe226⤵PID:3564
-
C:\Windows\SysWOW64\Bhkeohhn.exeC:\Windows\system32\Bhkeohhn.exe227⤵PID:3536
-
C:\Windows\SysWOW64\Blinefnd.exeC:\Windows\system32\Blinefnd.exe228⤵PID:2508
-
C:\Windows\SysWOW64\Blkjkflb.exeC:\Windows\system32\Blkjkflb.exe229⤵PID:3712
-
C:\Windows\SysWOW64\Bgdkkc32.exeC:\Windows\system32\Bgdkkc32.exe230⤵PID:3740
-
C:\Windows\SysWOW64\Bdhleh32.exeC:\Windows\system32\Bdhleh32.exe231⤵PID:3784
-
C:\Windows\SysWOW64\Bnapnm32.exeC:\Windows\system32\Bnapnm32.exe232⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3828 -
C:\Windows\SysWOW64\Cmfmojcb.exeC:\Windows\system32\Cmfmojcb.exe233⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3896 -
C:\Windows\SysWOW64\Cjjnhnbl.exeC:\Windows\system32\Cjjnhnbl.exe234⤵PID:3928
-
C:\Windows\SysWOW64\Cqfbjhgf.exeC:\Windows\system32\Cqfbjhgf.exe235⤵PID:3932
-
C:\Windows\SysWOW64\Cjogcm32.exeC:\Windows\system32\Cjogcm32.exe236⤵PID:4028
-
C:\Windows\SysWOW64\Cidddj32.exeC:\Windows\system32\Cidddj32.exe237⤵PID:4068
-
C:\Windows\SysWOW64\Dekdikhc.exeC:\Windows\system32\Dekdikhc.exe238⤵PID:3076
-
C:\Windows\SysWOW64\Dlgjldnm.exeC:\Windows\system32\Dlgjldnm.exe239⤵PID:3124
-
C:\Windows\SysWOW64\Deondj32.exeC:\Windows\system32\Deondj32.exe240⤵PID:3164
-
C:\Windows\SysWOW64\Dfcgbb32.exeC:\Windows\system32\Dfcgbb32.exe241⤵PID:3252
-
C:\Windows\SysWOW64\Dhbdleol.exeC:\Windows\system32\Dhbdleol.exe242⤵PID:3332