Analysis
-
max time kernel
146s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 07:19
Static task
static1
Behavioral task
behavioral1
Sample
c84ef4e5479c7b011ae1cd5cc122cf77053fa28243535f253344ab6862014694.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c84ef4e5479c7b011ae1cd5cc122cf77053fa28243535f253344ab6862014694.exe
Resource
win10v2004-20240508-en
General
-
Target
c84ef4e5479c7b011ae1cd5cc122cf77053fa28243535f253344ab6862014694.exe
-
Size
163KB
-
MD5
7b0f09a3d5c2ec7207fb503f6c818db8
-
SHA1
1eacca35a7f770e1ac31a89e6a83acf041fbb3a9
-
SHA256
c84ef4e5479c7b011ae1cd5cc122cf77053fa28243535f253344ab6862014694
-
SHA512
5b9596b39d4d5c46fd2cad120cdcfd49acbe6d99f04e75b88729c17d2cb200453c9a8b113f27b50e31ec2a1e44dd3dcb4de47e4a39f6f904b3b25994d43f500a
-
SSDEEP
1536:P5t1nCHpqsMb8/VzviP5sb7KBpU9sJslProNVU4qNVUrk/9QbfBr+7GwKrPAsqNy:VUqr2z2sb7KBpU9sJsltOrWKDBr+yJb
Malware Config
Extracted
gozi
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Phjelg32.exeApajlhka.exeFmekoalh.exeHnojdcfi.exeNehmdhja.exeNaoniipe.exeAadloj32.exeMoanaiie.exeNhlifi32.exeDjnpnc32.exeIhoafpmp.exeAbhimnma.exeBoplllob.exePcfcmd32.exeFacdeo32.exeJjojofgn.exeQbcpbo32.exeFbdjbaea.exePmjqcc32.exePckoam32.exeKmimafop.exeLpjbad32.exeAlnqqd32.exeFekpnn32.exeKnklagmb.exeMapjmehi.exeNplmop32.exeOkfgfl32.exeLhggmchi.exeBjijdadm.exeIcbimi32.exeLdidkbpb.exeGbomfe32.exeLbqabkql.exeOdjbdb32.exeApdhjq32.exeAhakmf32.exeHlqdei32.exeHeihnoph.exeLlohjo32.exeChnqkg32.exeHabfipdj.exeNlblkhei.exeOkfencna.exeJgagfi32.exeJegble32.exeAmejeljk.exeHbfbgd32.exeJqgoiokm.exeOgfpbeim.exeIcmlam32.exeBioqclil.exeJdgdempa.exeJakfkfpc.exeGmjaic32.exeKgpjanje.exeBifgdk32.exeBemgilhh.exeNhaikn32.exeHlljjjnm.exeMdmmfa32.exeDccagcgk.exeFbamma32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phjelg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Apajlhka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fmekoalh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnojdcfi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nehmdhja.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Naoniipe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aadloj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Moanaiie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nhlifi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Djnpnc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ihoafpmp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abhimnma.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Boplllob.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pcfcmd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Facdeo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjojofgn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qbcpbo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbdjbaea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pmjqcc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pckoam32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmimafop.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lpjbad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Alnqqd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fekpnn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knklagmb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mapjmehi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nplmop32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okfgfl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhggmchi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjijdadm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Icbimi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldidkbpb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gbomfe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lbqabkql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Odjbdb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apdhjq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahakmf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hlqdei32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Heihnoph.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Llohjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Chnqkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Habfipdj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nlblkhei.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okfencna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jgagfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jegble32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Amejeljk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hbfbgd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jqgoiokm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogfpbeim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Icmlam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bioqclil.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdgdempa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jakfkfpc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gmjaic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kgpjanje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bifgdk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bemgilhh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nhaikn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hlljjjnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdmmfa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dccagcgk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbamma32.exe -
Detects executables built or packed with MPress PE compressor 64 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\Inkakhpg.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Iolmbpfe.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Iffeoj32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Iidbke32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Ioojhpdb.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Ifhbdj32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Ikekmq32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Iiikfehq.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Ioccco32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ifmlpigj.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Jkjdhpea.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Jagmpg32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Jgqemakf.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Jnkmjk32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Jedefejo.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Jjanolhg.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Jegble32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Jakfkfpc.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Jfhocmnk.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Jjdkdl32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Jmbgpg32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Jpqclb32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Jfkkimlh.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Jmdcfg32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kpcpbb32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kbalnnam.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kfoedl32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kllmmc32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kipnfged.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Komfnnck.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kakbjibo.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kjcgco32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lhggmchi.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lfmdnp32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lodlom32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lgoacojo.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lmiipi32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lpgele32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lkmjin32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lchnnp32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lgdjnofi.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Libgjj32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lplogdmj.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Loooca32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Llqcfe32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mcjkcplm.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Midcpj32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mlcple32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mpolmdkg.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Moalhq32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Maphdl32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mekdekin.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mhjpaf32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mkhmma32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mochnppo.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mcodno32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Menakj32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lefkjkmc.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lpjbad32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Llnfaffc.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mhlmgf32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lmkfei32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lganiohl.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lbfahp32.exe INDICATOR_EXE_Packed_MPress -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\Inkakhpg.exe UPX \Windows\SysWOW64\Iolmbpfe.exe UPX \Windows\SysWOW64\Iffeoj32.exe UPX \Windows\SysWOW64\Iidbke32.exe UPX \Windows\SysWOW64\Ioojhpdb.exe UPX \Windows\SysWOW64\Ifhbdj32.exe UPX \Windows\SysWOW64\Ikekmq32.exe UPX \Windows\SysWOW64\Iiikfehq.exe UPX \Windows\SysWOW64\Ioccco32.exe UPX C:\Windows\SysWOW64\Ifmlpigj.exe UPX \Windows\SysWOW64\Jkjdhpea.exe UPX C:\Windows\SysWOW64\Jagmpg32.exe UPX \Windows\SysWOW64\Jgqemakf.exe UPX \Windows\SysWOW64\Jnkmjk32.exe UPX \Windows\SysWOW64\Jedefejo.exe UPX C:\Windows\SysWOW64\Jjanolhg.exe UPX C:\Windows\SysWOW64\Jegble32.exe UPX C:\Windows\SysWOW64\Jakfkfpc.exe UPX C:\Windows\SysWOW64\Jfhocmnk.exe UPX C:\Windows\SysWOW64\Jjdkdl32.exe UPX C:\Windows\SysWOW64\Jmbgpg32.exe UPX C:\Windows\SysWOW64\Jpqclb32.exe UPX C:\Windows\SysWOW64\Jfkkimlh.exe UPX C:\Windows\SysWOW64\Jmdcfg32.exe UPX C:\Windows\SysWOW64\Kpcpbb32.exe UPX C:\Windows\SysWOW64\Kbalnnam.exe UPX C:\Windows\SysWOW64\Kfoedl32.exe UPX C:\Windows\SysWOW64\Kllmmc32.exe UPX C:\Windows\SysWOW64\Kipnfged.exe UPX C:\Windows\SysWOW64\Komfnnck.exe UPX C:\Windows\SysWOW64\Kakbjibo.exe UPX C:\Windows\SysWOW64\Kjcgco32.exe UPX C:\Windows\SysWOW64\Lhggmchi.exe UPX C:\Windows\SysWOW64\Lfmdnp32.exe UPX C:\Windows\SysWOW64\Lodlom32.exe UPX C:\Windows\SysWOW64\Lgoacojo.exe UPX C:\Windows\SysWOW64\Lmiipi32.exe UPX C:\Windows\SysWOW64\Lpgele32.exe UPX C:\Windows\SysWOW64\Lkmjin32.exe UPX C:\Windows\SysWOW64\Lchnnp32.exe UPX C:\Windows\SysWOW64\Lgdjnofi.exe UPX C:\Windows\SysWOW64\Libgjj32.exe UPX C:\Windows\SysWOW64\Lplogdmj.exe UPX C:\Windows\SysWOW64\Loooca32.exe UPX C:\Windows\SysWOW64\Llqcfe32.exe UPX C:\Windows\SysWOW64\Mcjkcplm.exe UPX C:\Windows\SysWOW64\Midcpj32.exe UPX C:\Windows\SysWOW64\Mlcple32.exe UPX C:\Windows\SysWOW64\Mpolmdkg.exe UPX C:\Windows\SysWOW64\Moalhq32.exe UPX C:\Windows\SysWOW64\Maphdl32.exe UPX C:\Windows\SysWOW64\Mekdekin.exe UPX C:\Windows\SysWOW64\Mhjpaf32.exe UPX C:\Windows\SysWOW64\Mkhmma32.exe UPX C:\Windows\SysWOW64\Mochnppo.exe UPX C:\Windows\SysWOW64\Mcodno32.exe UPX C:\Windows\SysWOW64\Menakj32.exe UPX C:\Windows\SysWOW64\Lefkjkmc.exe UPX C:\Windows\SysWOW64\Lpjbad32.exe UPX C:\Windows\SysWOW64\Llnfaffc.exe UPX C:\Windows\SysWOW64\Mhlmgf32.exe UPX C:\Windows\SysWOW64\Lmkfei32.exe UPX C:\Windows\SysWOW64\Lganiohl.exe UPX C:\Windows\SysWOW64\Lbfahp32.exe UPX -
Executes dropped EXE 64 IoCs
Processes:
Inkakhpg.exeIolmbpfe.exeIffeoj32.exeIidbke32.exeIoojhpdb.exeIfhbdj32.exeIkekmq32.exeIiikfehq.exeIoccco32.exeIfmlpigj.exeJkjdhpea.exeJagmpg32.exeJgqemakf.exeJnkmjk32.exeJedefejo.exeJjanolhg.exeJakfkfpc.exeJegble32.exeJfhocmnk.exeJjdkdl32.exeJmbgpg32.exeJpqclb32.exeJfkkimlh.exeJmdcfg32.exeKpcpbb32.exeKbalnnam.exeKikdkh32.exeKpemgbqf.exeKcahhq32.exeKfoedl32.exeKinaqg32.exeKmimafop.exeKllmmc32.exeKfaajlfp.exeKipnfged.exeKlnjbbdh.exeKomfnnck.exeKakbjibo.exeKegnkh32.exeKjcgco32.exeKbkodl32.exeKanopipl.exeLhggmchi.exeLoapim32.exeLdnhad32.exeLhjdbcef.exeLfmdnp32.exeLodlom32.exeLabhkh32.exeLpeifeca.exeLhlqhb32.exeLgoacojo.exeLkkmdn32.exeLmiipi32.exeLadeqhjd.exeLpgele32.exeLbfahp32.exeLganiohl.exeLkmjin32.exeLmkfei32.exeLlnfaffc.exeLpjbad32.exeLchnnp32.exeLgdjnofi.exepid process 2308 Inkakhpg.exe 2636 Iolmbpfe.exe 2644 Iffeoj32.exe 2600 Iidbke32.exe 2668 Ioojhpdb.exe 2568 Ifhbdj32.exe 2528 Ikekmq32.exe 1316 Iiikfehq.exe 2768 Ioccco32.exe 3004 Ifmlpigj.exe 2000 Jkjdhpea.exe 2016 Jagmpg32.exe 2544 Jgqemakf.exe 1620 Jnkmjk32.exe 1328 Jedefejo.exe 2828 Jjanolhg.exe 2188 Jakfkfpc.exe 1116 Jegble32.exe 1912 Jfhocmnk.exe 2552 Jjdkdl32.exe 3012 Jmbgpg32.exe 2036 Jpqclb32.exe 1652 Jfkkimlh.exe 3040 Jmdcfg32.exe 1688 Kpcpbb32.exe 2792 Kbalnnam.exe 2604 Kikdkh32.exe 2956 Kpemgbqf.exe 2680 Kcahhq32.exe 2696 Kfoedl32.exe 2764 Kinaqg32.exe 2516 Kmimafop.exe 1892 Kllmmc32.exe 2492 Kfaajlfp.exe 2744 Kipnfged.exe 344 Klnjbbdh.exe 1980 Komfnnck.exe 664 Kakbjibo.exe 1764 Kegnkh32.exe 2288 Kjcgco32.exe 2292 Kbkodl32.exe 2044 Kanopipl.exe 2240 Lhggmchi.exe 1480 Loapim32.exe 3008 Ldnhad32.exe 1772 Lhjdbcef.exe 1336 Lfmdnp32.exe 1692 Lodlom32.exe 560 Labhkh32.exe 2372 Lpeifeca.exe 2816 Lhlqhb32.exe 1976 Lgoacojo.exe 2400 Lkkmdn32.exe 2484 Lmiipi32.exe 2504 Ladeqhjd.exe 2932 Lpgele32.exe 1816 Lbfahp32.exe 356 Lganiohl.exe 1704 Lkmjin32.exe 1576 Lmkfei32.exe 2248 Llnfaffc.exe 2832 Lpjbad32.exe 2624 Lchnnp32.exe 2184 Lgdjnofi.exe -
Loads dropped DLL 64 IoCs
Processes:
c84ef4e5479c7b011ae1cd5cc122cf77053fa28243535f253344ab6862014694.exeInkakhpg.exeIolmbpfe.exeIffeoj32.exeIidbke32.exeIoojhpdb.exeIfhbdj32.exeIkekmq32.exeIiikfehq.exeIoccco32.exeIfmlpigj.exeJkjdhpea.exeJagmpg32.exeJgqemakf.exeJnkmjk32.exeJedefejo.exeJjanolhg.exeJakfkfpc.exeJegble32.exeJfhocmnk.exeJjdkdl32.exeJmbgpg32.exeJpqclb32.exeJfkkimlh.exeJmdcfg32.exeKpcpbb32.exeKbalnnam.exeKikdkh32.exeKpemgbqf.exeKcahhq32.exeKfoedl32.exeKinaqg32.exepid process 2868 c84ef4e5479c7b011ae1cd5cc122cf77053fa28243535f253344ab6862014694.exe 2868 c84ef4e5479c7b011ae1cd5cc122cf77053fa28243535f253344ab6862014694.exe 2308 Inkakhpg.exe 2308 Inkakhpg.exe 2636 Iolmbpfe.exe 2636 Iolmbpfe.exe 2644 Iffeoj32.exe 2644 Iffeoj32.exe 2600 Iidbke32.exe 2600 Iidbke32.exe 2668 Ioojhpdb.exe 2668 Ioojhpdb.exe 2568 Ifhbdj32.exe 2568 Ifhbdj32.exe 2528 Ikekmq32.exe 2528 Ikekmq32.exe 1316 Iiikfehq.exe 1316 Iiikfehq.exe 2768 Ioccco32.exe 2768 Ioccco32.exe 3004 Ifmlpigj.exe 3004 Ifmlpigj.exe 2000 Jkjdhpea.exe 2000 Jkjdhpea.exe 2016 Jagmpg32.exe 2016 Jagmpg32.exe 2544 Jgqemakf.exe 2544 Jgqemakf.exe 1620 Jnkmjk32.exe 1620 Jnkmjk32.exe 1328 Jedefejo.exe 1328 Jedefejo.exe 2828 Jjanolhg.exe 2828 Jjanolhg.exe 2188 Jakfkfpc.exe 2188 Jakfkfpc.exe 1116 Jegble32.exe 1116 Jegble32.exe 1912 Jfhocmnk.exe 1912 Jfhocmnk.exe 2552 Jjdkdl32.exe 2552 Jjdkdl32.exe 3012 Jmbgpg32.exe 3012 Jmbgpg32.exe 2036 Jpqclb32.exe 2036 Jpqclb32.exe 1652 Jfkkimlh.exe 1652 Jfkkimlh.exe 3040 Jmdcfg32.exe 3040 Jmdcfg32.exe 1688 Kpcpbb32.exe 1688 Kpcpbb32.exe 2792 Kbalnnam.exe 2792 Kbalnnam.exe 2604 Kikdkh32.exe 2604 Kikdkh32.exe 2956 Kpemgbqf.exe 2956 Kpemgbqf.exe 2680 Kcahhq32.exe 2680 Kcahhq32.exe 2696 Kfoedl32.exe 2696 Kfoedl32.exe 2764 Kinaqg32.exe 2764 Kinaqg32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Mmfbogcn.exeGelppaof.exeGmgninie.exeKfpgmdog.exeGpmjak32.exeHahjpbad.exeApcfahio.exeNplmop32.exeIhankokm.exeMhbped32.exeCngcjo32.exeDdagfm32.exeCckace32.exeNeplhf32.exeApomfh32.exeFmmkcoap.exeJkoplhip.exeNjbcim32.exeNlblkhei.exeKihqkagp.exeBbokmqie.exeFaigdn32.exeMlfojn32.exeCdakgibq.exeMmhodf32.exeJchhkjhn.exeAmejeljk.exePmjqcc32.exeBejdiffp.exeOgmhkmki.exeEilpeooq.exeHojgfemq.exeNcancbha.exeKohkfj32.exeFbdjbaea.exeGiieco32.exeIgdogl32.exeNialog32.exeDbhnhp32.exeFlehkhai.exeMnkbdlbd.exeNgfcca32.exeIfnechbj.exeJcgogk32.exeJfghif32.exeCahail32.exeNhohda32.exeHnagjbdf.exeQcpofbjl.exeEbodiofk.exeLpdbloof.exeEiaiqn32.exeFioija32.exeOllajp32.exeNghphaeo.exeAdeplhib.exeOohqqlei.exeOancnfoe.exeAchojp32.exeEqgnokip.exePfgngh32.exedescription ioc process File created C:\Windows\SysWOW64\Delpclld.dll Mmfbogcn.exe File opened for modification C:\Windows\SysWOW64\Gdopkn32.exe Gelppaof.exe File created C:\Windows\SysWOW64\Hnpcnhmk.dll Gmgninie.exe File created C:\Windows\SysWOW64\Kebgia32.exe Kfpgmdog.exe File created C:\Windows\SysWOW64\Gbkgnfbd.exe Gpmjak32.exe File created C:\Windows\SysWOW64\Hpkjko32.exe Hahjpbad.exe File created C:\Windows\SysWOW64\Abbbnchb.exe Apcfahio.exe File opened for modification C:\Windows\SysWOW64\Ndhipoob.exe Nplmop32.exe File created C:\Windows\SysWOW64\Pacmbbii.dll Ihankokm.exe File opened for modification C:\Windows\SysWOW64\Mlmlecec.exe Mhbped32.exe File created C:\Windows\SysWOW64\Cljcelan.exe Cngcjo32.exe File created C:\Windows\SysWOW64\Dgodbh32.exe Ddagfm32.exe File opened for modification C:\Windows\SysWOW64\Cbnbobin.exe Cckace32.exe File opened for modification C:\Windows\SysWOW64\Nhohda32.exe Neplhf32.exe File opened for modification C:\Windows\SysWOW64\Abmibdlh.exe Apomfh32.exe File created C:\Windows\SysWOW64\Faigdn32.exe Fmmkcoap.exe File opened for modification C:\Windows\SysWOW64\Jjbpgd32.exe Jkoplhip.exe File created C:\Windows\SysWOW64\Mfcngp32.dll Njbcim32.exe File created C:\Windows\SysWOW64\Ndjdlffl.exe Nlblkhei.exe File created C:\Windows\SysWOW64\Kkgmgmfd.exe Kihqkagp.exe File opened for modification C:\Windows\SysWOW64\Baakhm32.exe Bbokmqie.exe File opened for modification C:\Windows\SysWOW64\Gdgcpi32.exe Faigdn32.exe File created C:\Windows\SysWOW64\Iggbhk32.dll Mlfojn32.exe File created C:\Windows\SysWOW64\Ccdlbf32.exe Cdakgibq.exe File created C:\Windows\SysWOW64\Mpfkqb32.exe Mmhodf32.exe File created C:\Windows\SysWOW64\Jnfqpega.dll Jchhkjhn.exe File created C:\Windows\SysWOW64\Aofqfokm.dll Amejeljk.exe File created C:\Windows\SysWOW64\Plfmnipm.dll Pmjqcc32.exe File created C:\Windows\SysWOW64\Bhhpeafc.exe Bejdiffp.exe File opened for modification C:\Windows\SysWOW64\Modkfi32.exe Mlfojn32.exe File opened for modification C:\Windows\SysWOW64\Pkidlk32.exe Ogmhkmki.exe File created C:\Windows\SysWOW64\Kgcampld.dll Eilpeooq.exe File created C:\Windows\SysWOW64\Jmamaoln.dll Hojgfemq.exe File opened for modification C:\Windows\SysWOW64\Nfpjomgd.exe Ncancbha.exe File created C:\Windows\SysWOW64\Knklagmb.exe Kohkfj32.exe File opened for modification C:\Windows\SysWOW64\Fagjnn32.exe Fbdjbaea.exe File created C:\Windows\SysWOW64\Glgaok32.exe Giieco32.exe File created C:\Windows\SysWOW64\Codpklfq.dll Hahjpbad.exe File opened for modification C:\Windows\SysWOW64\Iokfhi32.exe Igdogl32.exe File created C:\Windows\SysWOW64\Nlphkb32.exe Nialog32.exe File opened for modification C:\Windows\SysWOW64\Dfdjhndl.exe Dbhnhp32.exe File created C:\Windows\SysWOW64\Lhefhd32.dll Flehkhai.exe File created C:\Windows\SysWOW64\Mpjoqhah.exe Mnkbdlbd.exe File opened for modification C:\Windows\SysWOW64\Nnplpl32.exe Ngfcca32.exe File created C:\Windows\SysWOW64\Jnemdecl.exe Ifnechbj.exe File opened for modification C:\Windows\SysWOW64\Jfekcg32.exe Jcgogk32.exe File created C:\Windows\SysWOW64\Dcmfoi32.dll Jfghif32.exe File created C:\Windows\SysWOW64\Gdidec32.dll Cahail32.exe File opened for modification C:\Windows\SysWOW64\Nljddpfe.exe Nhohda32.exe File opened for modification C:\Windows\SysWOW64\Hpocfncj.exe Hnagjbdf.exe File created C:\Windows\SysWOW64\Qbcpbo32.exe Qcpofbjl.exe File opened for modification C:\Windows\SysWOW64\Eqbddk32.exe Ebodiofk.exe File created C:\Windows\SysWOW64\Gqncakcq.dll Lpdbloof.exe File created C:\Windows\SysWOW64\Eloemi32.exe Eiaiqn32.exe File created C:\Windows\SysWOW64\Jnmgmhmc.dll Fioija32.exe File created C:\Windows\SysWOW64\Mfbnoibb.dll Ollajp32.exe File opened for modification C:\Windows\SysWOW64\Njgldmdc.exe Nghphaeo.exe File created C:\Windows\SysWOW64\Ahakmf32.exe Adeplhib.exe File opened for modification C:\Windows\SysWOW64\Ocdmaj32.exe Oohqqlei.exe File created C:\Windows\SysWOW64\Ghkekdhl.dll Oancnfoe.exe File created C:\Windows\SysWOW64\Agdjkogm.exe Achojp32.exe File created C:\Windows\SysWOW64\Bdacap32.dll Eqgnokip.exe File created C:\Windows\SysWOW64\Pjbjhgde.exe Pfgngh32.exe File created C:\Windows\SysWOW64\Jbfpbmji.dll Apcfahio.exe -
Program crash 1 IoCs
Processes:
pid pid_target process target process 9996 9944 -
Modifies registry class 64 IoCs
Processes:
Dknekeef.exeBopicc32.exeNhkbkc32.exeOgeigofa.exeCfinoq32.exeEflgccbp.exeEnnaieib.exeGpknlk32.exeBaakhm32.exeNkiogn32.exeAlpmfdcb.exeMmihhelk.exeIfmlpigj.exeKinaqg32.exeEecqjpee.exeMgqcmlgl.exeDlgldibq.exeIjdqna32.exeNbfjdn32.exeHodpgjha.exeEfncicpm.exeBldcpf32.exeDkkpbgli.exeKkgmgmfd.exeNajdnj32.exeAijpnfif.exeEqdajkkb.exeMoidahcn.exeLhlqhb32.exeNhlifi32.exeHknach32.exeAmnfnfgg.exeLjmlbfhi.exeKcahhq32.exeAigaon32.exeBhndldcn.exeKjfjbdle.exeLcojjmea.exeFjongcbl.exeJjdkdl32.exeIfnechbj.exeNaajoinb.exeDndlim32.exeBagpopmj.exeCnobnmpl.exeJjdmmdnh.exec84ef4e5479c7b011ae1cd5cc122cf77053fa28243535f253344ab6862014694.exePfbccp32.exeKjqccigf.exeNialog32.exeAjbggjfq.exeLlohjo32.exeMdcnlglc.exeOojknblb.exeCckace32.exeIaeiieeb.exeFadminnn.exeLbiqfied.exePnjdhmdo.exeHlljjjnm.exeCllpkl32.exeDngoibmo.exeJdehon32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lqelfddi.dll" Dknekeef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mocaac32.dll" Bopicc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nhkbkc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ogeigofa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cfinoq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njqaac32.dll" Eflgccbp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ennaieib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gpknlk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Baakhm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nkiogn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jifnmmhq.dll" Alpmfdcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mmihhelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjghmm32.dll" Ifmlpigj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiikjj32.dll" Kinaqg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eecqjpee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijlhmj32.dll" Mgqcmlgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dlgldibq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ijdqna32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nbfjdn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hodpgjha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnoillim.dll" Efncicpm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bldcpf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dkkpbgli.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kkgmgmfd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Najdnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebjnie32.dll" Aijpnfif.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eqdajkkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elonamqm.dll" Moidahcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcehqcli.dll" Lhlqhb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njgpdbgm.dll" Nhlifi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hknach32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Amnfnfgg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ljmlbfhi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Limigk32.dll" Kcahhq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aigaon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oegjkb32.dll" Bhndldcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kjfjbdle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lcojjmea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iieipa32.dll" Fjongcbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Machcjcf.dll" Jjdkdl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ifnechbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Naajoinb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dndlim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmddhkao.dll" Bagpopmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opfdll32.dll" Cnobnmpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jjdmmdnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" c84ef4e5479c7b011ae1cd5cc122cf77053fa28243535f253344ab6862014694.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pfbccp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqgmkdbj.dll" Kjqccigf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nialog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbdipkfe.dll" Ajbggjfq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Llohjo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mdcnlglc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oojknblb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cckace32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amammd32.dll" Iaeiieeb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fadminnn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lbiqfied.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pnjdhmdo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hlljjjnm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cllpkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkjapnke.dll" Dngoibmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqdgapkm.dll" Jdehon32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c84ef4e5479c7b011ae1cd5cc122cf77053fa28243535f253344ab6862014694.exeInkakhpg.exeIolmbpfe.exeIffeoj32.exeIidbke32.exeIoojhpdb.exeIfhbdj32.exeIkekmq32.exeIiikfehq.exeIoccco32.exeIfmlpigj.exeJkjdhpea.exeJagmpg32.exeJgqemakf.exeJnkmjk32.exeJedefejo.exedescription pid process target process PID 2868 wrote to memory of 2308 2868 c84ef4e5479c7b011ae1cd5cc122cf77053fa28243535f253344ab6862014694.exe Inkakhpg.exe PID 2868 wrote to memory of 2308 2868 c84ef4e5479c7b011ae1cd5cc122cf77053fa28243535f253344ab6862014694.exe Inkakhpg.exe PID 2868 wrote to memory of 2308 2868 c84ef4e5479c7b011ae1cd5cc122cf77053fa28243535f253344ab6862014694.exe Inkakhpg.exe PID 2868 wrote to memory of 2308 2868 c84ef4e5479c7b011ae1cd5cc122cf77053fa28243535f253344ab6862014694.exe Inkakhpg.exe PID 2308 wrote to memory of 2636 2308 Inkakhpg.exe Iolmbpfe.exe PID 2308 wrote to memory of 2636 2308 Inkakhpg.exe Iolmbpfe.exe PID 2308 wrote to memory of 2636 2308 Inkakhpg.exe Iolmbpfe.exe PID 2308 wrote to memory of 2636 2308 Inkakhpg.exe Iolmbpfe.exe PID 2636 wrote to memory of 2644 2636 Iolmbpfe.exe Iffeoj32.exe PID 2636 wrote to memory of 2644 2636 Iolmbpfe.exe Iffeoj32.exe PID 2636 wrote to memory of 2644 2636 Iolmbpfe.exe Iffeoj32.exe PID 2636 wrote to memory of 2644 2636 Iolmbpfe.exe Iffeoj32.exe PID 2644 wrote to memory of 2600 2644 Iffeoj32.exe Iidbke32.exe PID 2644 wrote to memory of 2600 2644 Iffeoj32.exe Iidbke32.exe PID 2644 wrote to memory of 2600 2644 Iffeoj32.exe Iidbke32.exe PID 2644 wrote to memory of 2600 2644 Iffeoj32.exe Iidbke32.exe PID 2600 wrote to memory of 2668 2600 Iidbke32.exe Ioojhpdb.exe PID 2600 wrote to memory of 2668 2600 Iidbke32.exe Ioojhpdb.exe PID 2600 wrote to memory of 2668 2600 Iidbke32.exe Ioojhpdb.exe PID 2600 wrote to memory of 2668 2600 Iidbke32.exe Ioojhpdb.exe PID 2668 wrote to memory of 2568 2668 Ioojhpdb.exe Ifhbdj32.exe PID 2668 wrote to memory of 2568 2668 Ioojhpdb.exe Ifhbdj32.exe PID 2668 wrote to memory of 2568 2668 Ioojhpdb.exe Ifhbdj32.exe PID 2668 wrote to memory of 2568 2668 Ioojhpdb.exe Ifhbdj32.exe PID 2568 wrote to memory of 2528 2568 Ifhbdj32.exe Ikekmq32.exe PID 2568 wrote to memory of 2528 2568 Ifhbdj32.exe Ikekmq32.exe PID 2568 wrote to memory of 2528 2568 Ifhbdj32.exe Ikekmq32.exe PID 2568 wrote to memory of 2528 2568 Ifhbdj32.exe Ikekmq32.exe PID 2528 wrote to memory of 1316 2528 Ikekmq32.exe Iiikfehq.exe PID 2528 wrote to memory of 1316 2528 Ikekmq32.exe Iiikfehq.exe PID 2528 wrote to memory of 1316 2528 Ikekmq32.exe Iiikfehq.exe PID 2528 wrote to memory of 1316 2528 Ikekmq32.exe Iiikfehq.exe PID 1316 wrote to memory of 2768 1316 Iiikfehq.exe Ioccco32.exe PID 1316 wrote to memory of 2768 1316 Iiikfehq.exe Ioccco32.exe PID 1316 wrote to memory of 2768 1316 Iiikfehq.exe Ioccco32.exe PID 1316 wrote to memory of 2768 1316 Iiikfehq.exe Ioccco32.exe PID 2768 wrote to memory of 3004 2768 Ioccco32.exe Ifmlpigj.exe PID 2768 wrote to memory of 3004 2768 Ioccco32.exe Ifmlpigj.exe PID 2768 wrote to memory of 3004 2768 Ioccco32.exe Ifmlpigj.exe PID 2768 wrote to memory of 3004 2768 Ioccco32.exe Ifmlpigj.exe PID 3004 wrote to memory of 2000 3004 Ifmlpigj.exe Jkjdhpea.exe PID 3004 wrote to memory of 2000 3004 Ifmlpigj.exe Jkjdhpea.exe PID 3004 wrote to memory of 2000 3004 Ifmlpigj.exe Jkjdhpea.exe PID 3004 wrote to memory of 2000 3004 Ifmlpigj.exe Jkjdhpea.exe PID 2000 wrote to memory of 2016 2000 Jkjdhpea.exe Jagmpg32.exe PID 2000 wrote to memory of 2016 2000 Jkjdhpea.exe Jagmpg32.exe PID 2000 wrote to memory of 2016 2000 Jkjdhpea.exe Jagmpg32.exe PID 2000 wrote to memory of 2016 2000 Jkjdhpea.exe Jagmpg32.exe PID 2016 wrote to memory of 2544 2016 Jagmpg32.exe Jgqemakf.exe PID 2016 wrote to memory of 2544 2016 Jagmpg32.exe Jgqemakf.exe PID 2016 wrote to memory of 2544 2016 Jagmpg32.exe Jgqemakf.exe PID 2016 wrote to memory of 2544 2016 Jagmpg32.exe Jgqemakf.exe PID 2544 wrote to memory of 1620 2544 Jgqemakf.exe Jnkmjk32.exe PID 2544 wrote to memory of 1620 2544 Jgqemakf.exe Jnkmjk32.exe PID 2544 wrote to memory of 1620 2544 Jgqemakf.exe Jnkmjk32.exe PID 2544 wrote to memory of 1620 2544 Jgqemakf.exe Jnkmjk32.exe PID 1620 wrote to memory of 1328 1620 Jnkmjk32.exe Jedefejo.exe PID 1620 wrote to memory of 1328 1620 Jnkmjk32.exe Jedefejo.exe PID 1620 wrote to memory of 1328 1620 Jnkmjk32.exe Jedefejo.exe PID 1620 wrote to memory of 1328 1620 Jnkmjk32.exe Jedefejo.exe PID 1328 wrote to memory of 2828 1328 Jedefejo.exe Jjanolhg.exe PID 1328 wrote to memory of 2828 1328 Jedefejo.exe Jjanolhg.exe PID 1328 wrote to memory of 2828 1328 Jedefejo.exe Jjanolhg.exe PID 1328 wrote to memory of 2828 1328 Jedefejo.exe Jjanolhg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c84ef4e5479c7b011ae1cd5cc122cf77053fa28243535f253344ab6862014694.exe"C:\Users\Admin\AppData\Local\Temp\c84ef4e5479c7b011ae1cd5cc122cf77053fa28243535f253344ab6862014694.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Inkakhpg.exeC:\Windows\system32\Inkakhpg.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Iolmbpfe.exeC:\Windows\system32\Iolmbpfe.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Iffeoj32.exeC:\Windows\system32\Iffeoj32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Iidbke32.exeC:\Windows\system32\Iidbke32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ioojhpdb.exeC:\Windows\system32\Ioojhpdb.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ifhbdj32.exeC:\Windows\system32\Ifhbdj32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ikekmq32.exeC:\Windows\system32\Ikekmq32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Iiikfehq.exeC:\Windows\system32\Iiikfehq.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ioccco32.exeC:\Windows\system32\Ioccco32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ifmlpigj.exeC:\Windows\system32\Ifmlpigj.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jkjdhpea.exeC:\Windows\system32\Jkjdhpea.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jagmpg32.exeC:\Windows\system32\Jagmpg32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jgqemakf.exeC:\Windows\system32\Jgqemakf.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jnkmjk32.exeC:\Windows\system32\Jnkmjk32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jedefejo.exeC:\Windows\system32\Jedefejo.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Jjanolhg.exeC:\Windows\system32\Jjanolhg.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Jakfkfpc.exeC:\Windows\system32\Jakfkfpc.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Jegble32.exeC:\Windows\system32\Jegble32.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Jfhocmnk.exeC:\Windows\system32\Jfhocmnk.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Jjdkdl32.exeC:\Windows\system32\Jjdkdl32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\Jmbgpg32.exeC:\Windows\system32\Jmbgpg32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Jpqclb32.exeC:\Windows\system32\Jpqclb32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Jfkkimlh.exeC:\Windows\system32\Jfkkimlh.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Jmdcfg32.exeC:\Windows\system32\Jmdcfg32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Kpcpbb32.exeC:\Windows\system32\Kpcpbb32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Kbalnnam.exeC:\Windows\system32\Kbalnnam.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Kikdkh32.exeC:\Windows\system32\Kikdkh32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Kpemgbqf.exeC:\Windows\system32\Kpemgbqf.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Kcahhq32.exeC:\Windows\system32\Kcahhq32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\Kfoedl32.exeC:\Windows\system32\Kfoedl32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Kinaqg32.exeC:\Windows\system32\Kinaqg32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\Kmimafop.exeC:\Windows\system32\Kmimafop.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Kllmmc32.exeC:\Windows\system32\Kllmmc32.exe34⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Kfaajlfp.exeC:\Windows\system32\Kfaajlfp.exe35⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Kipnfged.exeC:\Windows\system32\Kipnfged.exe36⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Klnjbbdh.exeC:\Windows\system32\Klnjbbdh.exe37⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Komfnnck.exeC:\Windows\system32\Komfnnck.exe38⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Kakbjibo.exeC:\Windows\system32\Kakbjibo.exe39⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Kegnkh32.exeC:\Windows\system32\Kegnkh32.exe40⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Kjcgco32.exeC:\Windows\system32\Kjcgco32.exe41⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Kbkodl32.exeC:\Windows\system32\Kbkodl32.exe42⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Kanopipl.exeC:\Windows\system32\Kanopipl.exe43⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lhggmchi.exeC:\Windows\system32\Lhggmchi.exe44⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Loapim32.exeC:\Windows\system32\Loapim32.exe45⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ldnhad32.exeC:\Windows\system32\Ldnhad32.exe46⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lhjdbcef.exeC:\Windows\system32\Lhjdbcef.exe47⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lfmdnp32.exeC:\Windows\system32\Lfmdnp32.exe48⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lodlom32.exeC:\Windows\system32\Lodlom32.exe49⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Labhkh32.exeC:\Windows\system32\Labhkh32.exe50⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lpeifeca.exeC:\Windows\system32\Lpeifeca.exe51⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lhlqhb32.exeC:\Windows\system32\Lhlqhb32.exe52⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Lgoacojo.exeC:\Windows\system32\Lgoacojo.exe53⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lkkmdn32.exeC:\Windows\system32\Lkkmdn32.exe54⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lmiipi32.exeC:\Windows\system32\Lmiipi32.exe55⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ladeqhjd.exeC:\Windows\system32\Ladeqhjd.exe56⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lpgele32.exeC:\Windows\system32\Lpgele32.exe57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lbfahp32.exeC:\Windows\system32\Lbfahp32.exe58⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lganiohl.exeC:\Windows\system32\Lganiohl.exe59⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lkmjin32.exeC:\Windows\system32\Lkmjin32.exe60⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lmkfei32.exeC:\Windows\system32\Lmkfei32.exe61⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Llnfaffc.exeC:\Windows\system32\Llnfaffc.exe62⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lpjbad32.exeC:\Windows\system32\Lpjbad32.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lchnnp32.exeC:\Windows\system32\Lchnnp32.exe64⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lgdjnofi.exeC:\Windows\system32\Lgdjnofi.exe65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Lefkjkmc.exeC:\Windows\system32\Lefkjkmc.exe66⤵
-
C:\Windows\SysWOW64\Libgjj32.exeC:\Windows\system32\Libgjj32.exe67⤵
-
C:\Windows\SysWOW64\Llqcfe32.exeC:\Windows\system32\Llqcfe32.exe68⤵
-
C:\Windows\SysWOW64\Lplogdmj.exeC:\Windows\system32\Lplogdmj.exe69⤵
-
C:\Windows\SysWOW64\Loooca32.exeC:\Windows\system32\Loooca32.exe70⤵
-
C:\Windows\SysWOW64\Mcjkcplm.exeC:\Windows\system32\Mcjkcplm.exe71⤵
-
C:\Windows\SysWOW64\Midcpj32.exeC:\Windows\system32\Midcpj32.exe72⤵
-
C:\Windows\SysWOW64\Mlcple32.exeC:\Windows\system32\Mlcple32.exe73⤵
-
C:\Windows\SysWOW64\Mpolmdkg.exeC:\Windows\system32\Mpolmdkg.exe74⤵
-
C:\Windows\SysWOW64\Moalhq32.exeC:\Windows\system32\Moalhq32.exe75⤵
-
C:\Windows\SysWOW64\Maphdl32.exeC:\Windows\system32\Maphdl32.exe76⤵
-
C:\Windows\SysWOW64\Mekdekin.exeC:\Windows\system32\Mekdekin.exe77⤵
-
C:\Windows\SysWOW64\Mhjpaf32.exeC:\Windows\system32\Mhjpaf32.exe78⤵
-
C:\Windows\SysWOW64\Mkhmma32.exeC:\Windows\system32\Mkhmma32.exe79⤵
-
C:\Windows\SysWOW64\Mochnppo.exeC:\Windows\system32\Mochnppo.exe80⤵
-
C:\Windows\SysWOW64\Mcodno32.exeC:\Windows\system32\Mcodno32.exe81⤵
-
C:\Windows\SysWOW64\Menakj32.exeC:\Windows\system32\Menakj32.exe82⤵
-
C:\Windows\SysWOW64\Mhlmgf32.exeC:\Windows\system32\Mhlmgf32.exe83⤵
-
C:\Windows\SysWOW64\Mkjica32.exeC:\Windows\system32\Mkjica32.exe84⤵
-
C:\Windows\SysWOW64\Madapkmp.exeC:\Windows\system32\Madapkmp.exe85⤵
-
C:\Windows\SysWOW64\Mdcnlglc.exeC:\Windows\system32\Mdcnlglc.exe86⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Mgajhbkg.exeC:\Windows\system32\Mgajhbkg.exe87⤵
-
C:\Windows\SysWOW64\Mnkbdlbd.exeC:\Windows\system32\Mnkbdlbd.exe88⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Mpjoqhah.exeC:\Windows\system32\Mpjoqhah.exe89⤵
-
C:\Windows\SysWOW64\Mhqfbebj.exeC:\Windows\system32\Mhqfbebj.exe90⤵
-
C:\Windows\SysWOW64\Mgcgmb32.exeC:\Windows\system32\Mgcgmb32.exe91⤵
-
C:\Windows\SysWOW64\Njbcim32.exeC:\Windows\system32\Njbcim32.exe92⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ndgggf32.exeC:\Windows\system32\Ndgggf32.exe93⤵
-
C:\Windows\SysWOW64\Ngfcca32.exeC:\Windows\system32\Ngfcca32.exe94⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nnplpl32.exeC:\Windows\system32\Nnplpl32.exe95⤵
-
C:\Windows\SysWOW64\Nlblkhei.exeC:\Windows\system32\Nlblkhei.exe96⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ndjdlffl.exeC:\Windows\system32\Ndjdlffl.exe97⤵
-
C:\Windows\SysWOW64\Nghphaeo.exeC:\Windows\system32\Nghphaeo.exe98⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Njgldmdc.exeC:\Windows\system32\Njgldmdc.exe99⤵
-
C:\Windows\SysWOW64\Nleiqhcg.exeC:\Windows\system32\Nleiqhcg.exe100⤵
-
C:\Windows\SysWOW64\Ncoamb32.exeC:\Windows\system32\Ncoamb32.exe101⤵
-
C:\Windows\SysWOW64\Ngkmnacm.exeC:\Windows\system32\Ngkmnacm.exe102⤵
-
C:\Windows\SysWOW64\Nhlifi32.exeC:\Windows\system32\Nhlifi32.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Nlgefh32.exeC:\Windows\system32\Nlgefh32.exe104⤵
-
C:\Windows\SysWOW64\Ncancbha.exeC:\Windows\system32\Ncancbha.exe105⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nfpjomgd.exeC:\Windows\system32\Nfpjomgd.exe106⤵
-
C:\Windows\SysWOW64\Njkfpl32.exeC:\Windows\system32\Njkfpl32.exe107⤵
-
C:\Windows\SysWOW64\Nkmbgdfl.exeC:\Windows\system32\Nkmbgdfl.exe108⤵
-
C:\Windows\SysWOW64\Nohnhc32.exeC:\Windows\system32\Nohnhc32.exe109⤵
-
C:\Windows\SysWOW64\Nbfjdn32.exeC:\Windows\system32\Nbfjdn32.exe110⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Odegpj32.exeC:\Windows\system32\Odegpj32.exe111⤵
-
C:\Windows\SysWOW64\Oojknblb.exeC:\Windows\system32\Oojknblb.exe112⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Obigjnkf.exeC:\Windows\system32\Obigjnkf.exe113⤵
-
C:\Windows\SysWOW64\Oicpfh32.exeC:\Windows\system32\Oicpfh32.exe114⤵
-
C:\Windows\SysWOW64\Ogfpbeim.exeC:\Windows\system32\Ogfpbeim.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Onphoo32.exeC:\Windows\system32\Onphoo32.exe116⤵
-
C:\Windows\SysWOW64\Oqndkj32.exeC:\Windows\system32\Oqndkj32.exe117⤵
-
C:\Windows\SysWOW64\Oghlgdgk.exeC:\Windows\system32\Oghlgdgk.exe118⤵
-
C:\Windows\SysWOW64\Onbddoog.exeC:\Windows\system32\Onbddoog.exe119⤵
-
C:\Windows\SysWOW64\Oqqapjnk.exeC:\Windows\system32\Oqqapjnk.exe120⤵
-
C:\Windows\SysWOW64\Oelmai32.exeC:\Windows\system32\Oelmai32.exe121⤵
-
C:\Windows\SysWOW64\Ogjimd32.exeC:\Windows\system32\Ogjimd32.exe122⤵
-
C:\Windows\SysWOW64\Okfencna.exeC:\Windows\system32\Okfencna.exe123⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Omgaek32.exeC:\Windows\system32\Omgaek32.exe124⤵
-
C:\Windows\SysWOW64\Ogmfbd32.exeC:\Windows\system32\Ogmfbd32.exe125⤵
-
C:\Windows\SysWOW64\Ongnonkb.exeC:\Windows\system32\Ongnonkb.exe126⤵
-
C:\Windows\SysWOW64\Pphjgfqq.exeC:\Windows\system32\Pphjgfqq.exe127⤵
-
C:\Windows\SysWOW64\Pfbccp32.exeC:\Windows\system32\Pfbccp32.exe128⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Pipopl32.exeC:\Windows\system32\Pipopl32.exe129⤵
-
C:\Windows\SysWOW64\Pcfcmd32.exeC:\Windows\system32\Pcfcmd32.exe130⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Pfdpip32.exeC:\Windows\system32\Pfdpip32.exe131⤵
-
C:\Windows\SysWOW64\Piblek32.exeC:\Windows\system32\Piblek32.exe132⤵
-
C:\Windows\SysWOW64\Ppmdbe32.exeC:\Windows\system32\Ppmdbe32.exe133⤵
-
C:\Windows\SysWOW64\Pchpbded.exeC:\Windows\system32\Pchpbded.exe134⤵
-
C:\Windows\SysWOW64\Peiljl32.exeC:\Windows\system32\Peiljl32.exe135⤵
-
C:\Windows\SysWOW64\Pmqdkj32.exeC:\Windows\system32\Pmqdkj32.exe136⤵
-
C:\Windows\SysWOW64\Ppoqge32.exeC:\Windows\system32\Ppoqge32.exe137⤵
-
C:\Windows\SysWOW64\Pbmmcq32.exeC:\Windows\system32\Pbmmcq32.exe138⤵
-
C:\Windows\SysWOW64\Pfiidobe.exeC:\Windows\system32\Pfiidobe.exe139⤵
-
C:\Windows\SysWOW64\Phjelg32.exeC:\Windows\system32\Phjelg32.exe140⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ppamme32.exeC:\Windows\system32\Ppamme32.exe141⤵
-
C:\Windows\SysWOW64\Pabjem32.exeC:\Windows\system32\Pabjem32.exe142⤵
-
C:\Windows\SysWOW64\Penfelgm.exeC:\Windows\system32\Penfelgm.exe143⤵
-
C:\Windows\SysWOW64\Qlhnbf32.exeC:\Windows\system32\Qlhnbf32.exe144⤵
-
C:\Windows\SysWOW64\Qbbfopeg.exeC:\Windows\system32\Qbbfopeg.exe145⤵
-
C:\Windows\SysWOW64\Qdccfh32.exeC:\Windows\system32\Qdccfh32.exe146⤵
-
C:\Windows\SysWOW64\Qjmkcbcb.exeC:\Windows\system32\Qjmkcbcb.exe147⤵
-
C:\Windows\SysWOW64\Qmlgonbe.exeC:\Windows\system32\Qmlgonbe.exe148⤵
-
C:\Windows\SysWOW64\Adeplhib.exeC:\Windows\system32\Adeplhib.exe149⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ahakmf32.exeC:\Windows\system32\Ahakmf32.exe150⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ajphib32.exeC:\Windows\system32\Ajphib32.exe151⤵
-
C:\Windows\SysWOW64\Amndem32.exeC:\Windows\system32\Amndem32.exe152⤵
-
C:\Windows\SysWOW64\Aajpelhl.exeC:\Windows\system32\Aajpelhl.exe153⤵
-
C:\Windows\SysWOW64\Adhlaggp.exeC:\Windows\system32\Adhlaggp.exe154⤵
-
C:\Windows\SysWOW64\Ahchbf32.exeC:\Windows\system32\Ahchbf32.exe155⤵
-
C:\Windows\SysWOW64\Ajbdna32.exeC:\Windows\system32\Ajbdna32.exe156⤵
-
C:\Windows\SysWOW64\Aiedjneg.exeC:\Windows\system32\Aiedjneg.exe157⤵
-
C:\Windows\SysWOW64\Ampqjm32.exeC:\Windows\system32\Ampqjm32.exe158⤵
-
C:\Windows\SysWOW64\Apomfh32.exeC:\Windows\system32\Apomfh32.exe159⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Abmibdlh.exeC:\Windows\system32\Abmibdlh.exe160⤵
-
C:\Windows\SysWOW64\Afiecb32.exeC:\Windows\system32\Afiecb32.exe161⤵
-
C:\Windows\SysWOW64\Ajdadamj.exeC:\Windows\system32\Ajdadamj.exe162⤵
-
C:\Windows\SysWOW64\Aigaon32.exeC:\Windows\system32\Aigaon32.exe163⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Alenki32.exeC:\Windows\system32\Alenki32.exe164⤵
-
C:\Windows\SysWOW64\Apajlhka.exeC:\Windows\system32\Apajlhka.exe165⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Abpfhcje.exeC:\Windows\system32\Abpfhcje.exe166⤵
-
C:\Windows\SysWOW64\Afkbib32.exeC:\Windows\system32\Afkbib32.exe167⤵
-
C:\Windows\SysWOW64\Aiinen32.exeC:\Windows\system32\Aiinen32.exe168⤵
-
C:\Windows\SysWOW64\Amejeljk.exeC:\Windows\system32\Amejeljk.exe169⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Apcfahio.exeC:\Windows\system32\Apcfahio.exe170⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Abbbnchb.exeC:\Windows\system32\Abbbnchb.exe171⤵
-
C:\Windows\SysWOW64\Afmonbqk.exeC:\Windows\system32\Afmonbqk.exe172⤵
-
C:\Windows\SysWOW64\Aepojo32.exeC:\Windows\system32\Aepojo32.exe173⤵
-
C:\Windows\SysWOW64\Ahokfj32.exeC:\Windows\system32\Ahokfj32.exe174⤵
-
C:\Windows\SysWOW64\Aljgfioc.exeC:\Windows\system32\Aljgfioc.exe175⤵
-
C:\Windows\SysWOW64\Bpfcgg32.exeC:\Windows\system32\Bpfcgg32.exe176⤵
-
C:\Windows\SysWOW64\Bbdocc32.exeC:\Windows\system32\Bbdocc32.exe177⤵
-
C:\Windows\SysWOW64\Bagpopmj.exeC:\Windows\system32\Bagpopmj.exe178⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Bingpmnl.exeC:\Windows\system32\Bingpmnl.exe179⤵
-
C:\Windows\SysWOW64\Blmdlhmp.exeC:\Windows\system32\Blmdlhmp.exe180⤵
-
C:\Windows\SysWOW64\Bkodhe32.exeC:\Windows\system32\Bkodhe32.exe181⤵
-
C:\Windows\SysWOW64\Bbflib32.exeC:\Windows\system32\Bbflib32.exe182⤵
-
C:\Windows\SysWOW64\Baildokg.exeC:\Windows\system32\Baildokg.exe183⤵
-
C:\Windows\SysWOW64\Bdhhqk32.exeC:\Windows\system32\Bdhhqk32.exe184⤵
-
C:\Windows\SysWOW64\Bhcdaibd.exeC:\Windows\system32\Bhcdaibd.exe185⤵
-
C:\Windows\SysWOW64\Bkaqmeah.exeC:\Windows\system32\Bkaqmeah.exe186⤵
-
C:\Windows\SysWOW64\Bommnc32.exeC:\Windows\system32\Bommnc32.exe187⤵
-
C:\Windows\SysWOW64\Balijo32.exeC:\Windows\system32\Balijo32.exe188⤵
-
C:\Windows\SysWOW64\Begeknan.exeC:\Windows\system32\Begeknan.exe189⤵
-
C:\Windows\SysWOW64\Bhfagipa.exeC:\Windows\system32\Bhfagipa.exe190⤵
-
C:\Windows\SysWOW64\Bghabf32.exeC:\Windows\system32\Bghabf32.exe191⤵
-
C:\Windows\SysWOW64\Bopicc32.exeC:\Windows\system32\Bopicc32.exe192⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Bnbjopoi.exeC:\Windows\system32\Bnbjopoi.exe193⤵
-
C:\Windows\SysWOW64\Banepo32.exeC:\Windows\system32\Banepo32.exe194⤵
-
C:\Windows\SysWOW64\Bdlblj32.exeC:\Windows\system32\Bdlblj32.exe195⤵
-
C:\Windows\SysWOW64\Bhhnli32.exeC:\Windows\system32\Bhhnli32.exe196⤵
-
C:\Windows\SysWOW64\Bgknheej.exeC:\Windows\system32\Bgknheej.exe197⤵
-
C:\Windows\SysWOW64\Bjijdadm.exeC:\Windows\system32\Bjijdadm.exe198⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Bnefdp32.exeC:\Windows\system32\Bnefdp32.exe199⤵
-
C:\Windows\SysWOW64\Bpcbqk32.exeC:\Windows\system32\Bpcbqk32.exe200⤵
-
C:\Windows\SysWOW64\Bdooajdc.exeC:\Windows\system32\Bdooajdc.exe201⤵
-
C:\Windows\SysWOW64\Cgmkmecg.exeC:\Windows\system32\Cgmkmecg.exe202⤵
-
C:\Windows\SysWOW64\Ckignd32.exeC:\Windows\system32\Ckignd32.exe203⤵
-
C:\Windows\SysWOW64\Cngcjo32.exeC:\Windows\system32\Cngcjo32.exe204⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Cljcelan.exeC:\Windows\system32\Cljcelan.exe205⤵
-
C:\Windows\SysWOW64\Cdakgibq.exeC:\Windows\system32\Cdakgibq.exe206⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ccdlbf32.exeC:\Windows\system32\Ccdlbf32.exe207⤵
-
C:\Windows\SysWOW64\Cfbhnaho.exeC:\Windows\system32\Cfbhnaho.exe208⤵
-
C:\Windows\SysWOW64\Cjndop32.exeC:\Windows\system32\Cjndop32.exe209⤵
-
C:\Windows\SysWOW64\Cnippoha.exeC:\Windows\system32\Cnippoha.exe210⤵
-
C:\Windows\SysWOW64\Cllpkl32.exeC:\Windows\system32\Cllpkl32.exe211⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Coklgg32.exeC:\Windows\system32\Coklgg32.exe212⤵
-
C:\Windows\SysWOW64\Cgbdhd32.exeC:\Windows\system32\Cgbdhd32.exe213⤵
-
C:\Windows\SysWOW64\Cjpqdp32.exeC:\Windows\system32\Cjpqdp32.exe214⤵
-
C:\Windows\SysWOW64\Chcqpmep.exeC:\Windows\system32\Chcqpmep.exe215⤵
-
C:\Windows\SysWOW64\Clomqk32.exeC:\Windows\system32\Clomqk32.exe216⤵
-
C:\Windows\SysWOW64\Cpjiajeb.exeC:\Windows\system32\Cpjiajeb.exe217⤵
-
C:\Windows\SysWOW64\Cciemedf.exeC:\Windows\system32\Cciemedf.exe218⤵
-
C:\Windows\SysWOW64\Cbkeib32.exeC:\Windows\system32\Cbkeib32.exe219⤵
-
C:\Windows\SysWOW64\Cjbmjplb.exeC:\Windows\system32\Cjbmjplb.exe220⤵
-
C:\Windows\SysWOW64\Chemfl32.exeC:\Windows\system32\Chemfl32.exe221⤵
-
C:\Windows\SysWOW64\Ckdjbh32.exeC:\Windows\system32\Ckdjbh32.exe222⤵
-
C:\Windows\SysWOW64\Cckace32.exeC:\Windows\system32\Cckace32.exe223⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Cbnbobin.exeC:\Windows\system32\Cbnbobin.exe224⤵
-
C:\Windows\SysWOW64\Cfinoq32.exeC:\Windows\system32\Cfinoq32.exe225⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Chhjkl32.exeC:\Windows\system32\Chhjkl32.exe226⤵
-
C:\Windows\SysWOW64\Clcflkic.exeC:\Windows\system32\Clcflkic.exe227⤵
-
C:\Windows\SysWOW64\Cobbhfhg.exeC:\Windows\system32\Cobbhfhg.exe228⤵
-
C:\Windows\SysWOW64\Cndbcc32.exeC:\Windows\system32\Cndbcc32.exe229⤵
-
C:\Windows\SysWOW64\Dflkdp32.exeC:\Windows\system32\Dflkdp32.exe230⤵
-
C:\Windows\SysWOW64\Ddokpmfo.exeC:\Windows\system32\Ddokpmfo.exe231⤵
-
C:\Windows\SysWOW64\Dgmglh32.exeC:\Windows\system32\Dgmglh32.exe232⤵
-
C:\Windows\SysWOW64\Dkhcmgnl.exeC:\Windows\system32\Dkhcmgnl.exe233⤵
-
C:\Windows\SysWOW64\Dngoibmo.exeC:\Windows\system32\Dngoibmo.exe234⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Dbbkja32.exeC:\Windows\system32\Dbbkja32.exe235⤵
-
C:\Windows\SysWOW64\Ddagfm32.exeC:\Windows\system32\Ddagfm32.exe236⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dgodbh32.exeC:\Windows\system32\Dgodbh32.exe237⤵
-
C:\Windows\SysWOW64\Dkkpbgli.exeC:\Windows\system32\Dkkpbgli.exe238⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Djnpnc32.exeC:\Windows\system32\Djnpnc32.exe239⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Dbehoa32.exeC:\Windows\system32\Dbehoa32.exe240⤵
-
C:\Windows\SysWOW64\Dqhhknjp.exeC:\Windows\system32\Dqhhknjp.exe241⤵