Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 09:45
Static task
static1
Behavioral task
behavioral1
Sample
ebf02636dda463a1adc403a6445dc5f769885d4e1cc4121fed3b45cc8fd4f525.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ebf02636dda463a1adc403a6445dc5f769885d4e1cc4121fed3b45cc8fd4f525.exe
Resource
win10v2004-20240508-en
General
-
Target
ebf02636dda463a1adc403a6445dc5f769885d4e1cc4121fed3b45cc8fd4f525.exe
-
Size
64KB
-
MD5
1b9eaab7e2dac2e1a9b52e9e0863e31e
-
SHA1
4f44871554876eeb4cda5ad8adcf59bfa09b2662
-
SHA256
ebf02636dda463a1adc403a6445dc5f769885d4e1cc4121fed3b45cc8fd4f525
-
SHA512
6dee2380caf1c026446d0eee051fd40478f664899e7b46ccb89535e8454e30052d6c31544b30a2d2c556f7f1dc41e285a64fb89eca23f5605061addf3b93fdee
-
SSDEEP
768:pqRjLYEO8GfcW3orFu9bFI/jEUMY8tx/daIPhwB0yuJxf96A35K0HqMqf/1H58X4:UPHJ/AY1gXfhE0Kvlsly5VP
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Kpoejbhe.exeIajemnia.exeAcqnnndl.exeDbafjlaa.exeOlmela32.exeBgdkkc32.exeJoblkegc.exeLhiakf32.exeBapfhg32.exeQnpcpa32.exeNpdfhhhe.exePafdjmkq.exeLaqojfli.exeAnljck32.exeOdflmp32.exeAicmadmm.exeJnnnalph.exeFijbco32.exeKbaglpee.exeNenkqi32.exeCcmpce32.exeEpeoaffo.exeFgldnkkf.exeNdggib32.exeOekehomj.exeFhbbcail.exeMchoid32.exeHidcef32.exeQaapcj32.exeNcfjajma.exeBpfebmia.exeLnbdko32.exeMgjnhaco.exeBkhhhd32.exeAphjjf32.exeIgceej32.exeGenlgnhd.exeGjlgfaco.exeCiohqa32.exeDiidjpbe.exeHgnokgcc.exeBeogaenl.exeChocodch.exePjlgle32.exeNfdkoc32.exeBjpaop32.exeCnimiblo.exeMgbaml32.exeGhgfekpn.exePafbadcm.exeBagkmb32.exeCmhglq32.exeOejcpf32.exeDoabjbci.exeOaghki32.exeBbchkime.exeJblnaq32.exeMbcmpfhi.exeEfljhq32.exeAqjdgmgd.exeHeliepmn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kpoejbhe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iajemnia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Acqnnndl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dbafjlaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Olmela32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bgdkkc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Joblkegc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lhiakf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bapfhg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qnpcpa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Npdfhhhe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pafdjmkq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Laqojfli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Anljck32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Odflmp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aicmadmm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jnnnalph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fijbco32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kbaglpee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nenkqi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ccmpce32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epeoaffo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fgldnkkf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndggib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oekehomj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhbbcail.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mchoid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hidcef32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qaapcj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ncfjajma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bpfebmia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lnbdko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mgjnhaco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bkhhhd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aphjjf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igceej32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Genlgnhd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjlgfaco.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ciohqa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Diidjpbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hgnokgcc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Beogaenl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Chocodch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pjlgle32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nfdkoc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hidcef32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjpaop32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnimiblo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgbaml32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghgfekpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qnpcpa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pafbadcm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bagkmb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmhglq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oejcpf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Doabjbci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oaghki32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bbchkime.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jblnaq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mbcmpfhi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efljhq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aqjdgmgd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Heliepmn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bgdkkc32.exe -
Executes dropped EXE 64 IoCs
Processes:
Ffqofohj.exeFfcllo32.exeGcglec32.exeGlbqje32.exeGejebk32.exeGbnflo32.exeGnefapmj.exeGjlgfaco.exeHhpgpebh.exeHahlhkhi.exeHicqmmfc.exeHfgafadm.exeHmaick32.exeHelngnie.exeIimcclni.exeIoilkblq.exeIlnmdgkj.exeIajemnia.exeInafbooe.exeIgijkd32.exeIihfgp32.exeJglgpdcc.exeJliohkak.exeJgncfcaa.exeJoihjfnl.exeJfcqgpfi.exeJolepe32.exeJlpeij32.exeJblnaq32.exeJkebjf32.exeKbokgpgg.exeKkgopf32.exeKbaglpee.exeKkileele.exeKqfdnljm.exeKgpmjf32.exeKmmebm32.exeKgbipf32.exeKmobhmnn.exeLopkjhko.exeLjfogake.exeLkgkoiqc.exeLmfhil32.exeLnhdqdnd.exeLklejh32.exeLedibnco.exeLjabkeaf.exeMeffhnal.exeMlpneh32.exeMnojacgm.exeMclcijfd.exeMjekfd32.exeMmdgbp32.exeMikhgqbi.exeMpdqdkie.exeMbcmpfhi.exeMimemp32.exeMdbiji32.exeMedeaaej.exeNpijoj32.exeNkjapglg.exeOgqaehak.exeOionacqo.exeOdebolpe.exepid process 1716 Ffqofohj.exe 1068 Ffcllo32.exe 2200 Gcglec32.exe 2596 Glbqje32.exe 2704 Gejebk32.exe 2400 Gbnflo32.exe 2376 Gnefapmj.exe 2792 Gjlgfaco.exe 2356 Hhpgpebh.exe 572 Hahlhkhi.exe 484 Hicqmmfc.exe 1924 Hfgafadm.exe 2120 Hmaick32.exe 2444 Helngnie.exe 2968 Iimcclni.exe 2988 Ioilkblq.exe 2164 Ilnmdgkj.exe 1684 Iajemnia.exe 1564 Inafbooe.exe 1676 Igijkd32.exe 1604 Iihfgp32.exe 960 Jglgpdcc.exe 2944 Jliohkak.exe 2680 Jgncfcaa.exe 2752 Joihjfnl.exe 1156 Jfcqgpfi.exe 1588 Jolepe32.exe 1100 Jlpeij32.exe 2656 Jblnaq32.exe 2588 Jkebjf32.exe 2384 Kbokgpgg.exe 2632 Kkgopf32.exe 2488 Kbaglpee.exe 2496 Kkileele.exe 268 Kqfdnljm.exe 1348 Kgpmjf32.exe 1372 Kmmebm32.exe 1780 Kgbipf32.exe 1900 Kmobhmnn.exe 1612 Lopkjhko.exe 2240 Ljfogake.exe 2252 Lkgkoiqc.exe 2904 Lmfhil32.exe 1264 Lnhdqdnd.exe 1472 Lklejh32.exe 2964 Ledibnco.exe 3052 Ljabkeaf.exe 1532 Meffhnal.exe 2864 Mlpneh32.exe 2324 Mnojacgm.exe 1904 Mclcijfd.exe 2196 Mjekfd32.exe 2592 Mmdgbp32.exe 2520 Mikhgqbi.exe 2156 Mpdqdkie.exe 2372 Mbcmpfhi.exe 2960 Mimemp32.exe 2684 Mdbiji32.exe 2128 Medeaaej.exe 1952 Npijoj32.exe 2388 Nkjapglg.exe 2364 Ogqaehak.exe 1936 Oionacqo.exe 2528 Odebolpe.exe -
Loads dropped DLL 64 IoCs
Processes:
ebf02636dda463a1adc403a6445dc5f769885d4e1cc4121fed3b45cc8fd4f525.exeFfqofohj.exeFfcllo32.exeGcglec32.exeGlbqje32.exeGejebk32.exeGbnflo32.exeGnefapmj.exeGjlgfaco.exeHhpgpebh.exeHahlhkhi.exeHicqmmfc.exeHfgafadm.exeHmaick32.exeHelngnie.exeIimcclni.exeIoilkblq.exeIlnmdgkj.exeIajemnia.exeInafbooe.exeIgijkd32.exeIihfgp32.exeJglgpdcc.exeJliohkak.exeJgncfcaa.exeJoihjfnl.exeJfcqgpfi.exeJolepe32.exeJlpeij32.exeJblnaq32.exeJkebjf32.exeKbokgpgg.exepid process 2032 ebf02636dda463a1adc403a6445dc5f769885d4e1cc4121fed3b45cc8fd4f525.exe 2032 ebf02636dda463a1adc403a6445dc5f769885d4e1cc4121fed3b45cc8fd4f525.exe 1716 Ffqofohj.exe 1716 Ffqofohj.exe 1068 Ffcllo32.exe 1068 Ffcllo32.exe 2200 Gcglec32.exe 2200 Gcglec32.exe 2596 Glbqje32.exe 2596 Glbqje32.exe 2704 Gejebk32.exe 2704 Gejebk32.exe 2400 Gbnflo32.exe 2400 Gbnflo32.exe 2376 Gnefapmj.exe 2376 Gnefapmj.exe 2792 Gjlgfaco.exe 2792 Gjlgfaco.exe 2356 Hhpgpebh.exe 2356 Hhpgpebh.exe 572 Hahlhkhi.exe 572 Hahlhkhi.exe 484 Hicqmmfc.exe 484 Hicqmmfc.exe 1924 Hfgafadm.exe 1924 Hfgafadm.exe 2120 Hmaick32.exe 2120 Hmaick32.exe 2444 Helngnie.exe 2444 Helngnie.exe 2968 Iimcclni.exe 2968 Iimcclni.exe 2988 Ioilkblq.exe 2988 Ioilkblq.exe 2164 Ilnmdgkj.exe 2164 Ilnmdgkj.exe 1684 Iajemnia.exe 1684 Iajemnia.exe 1564 Inafbooe.exe 1564 Inafbooe.exe 1676 Igijkd32.exe 1676 Igijkd32.exe 1604 Iihfgp32.exe 1604 Iihfgp32.exe 960 Jglgpdcc.exe 960 Jglgpdcc.exe 2944 Jliohkak.exe 2944 Jliohkak.exe 2680 Jgncfcaa.exe 2680 Jgncfcaa.exe 2752 Joihjfnl.exe 2752 Joihjfnl.exe 1156 Jfcqgpfi.exe 1156 Jfcqgpfi.exe 1588 Jolepe32.exe 1588 Jolepe32.exe 1100 Jlpeij32.exe 1100 Jlpeij32.exe 2656 Jblnaq32.exe 2656 Jblnaq32.exe 2588 Jkebjf32.exe 2588 Jkebjf32.exe 2384 Kbokgpgg.exe 2384 Kbokgpgg.exe -
Drops file in System32 directory 64 IoCs
Processes:
Peeabm32.exeJnnnalph.exePkjphcff.exeGcjmmdbf.exePpgcol32.exeNjalacon.exeEcgjdong.exePfkkeq32.exeBjoofhgc.exeMqnifg32.exeMmicfh32.exeIocgfhhc.exeJkkjeeke.exeQfonkfqd.exeKnkgpi32.exeCgcnghpl.exeAnbmbi32.exeKkgopf32.exeOgqaehak.exeIeomef32.exeIihiphln.exeEfjmbaba.exeHgciff32.exeMbdcepcm.exeMdogedmh.exePdjljpnc.exeFfcllo32.exeBbgqjdce.exeOoabmbbe.exeCaifjn32.exeBcflko32.exeHoimecmb.exeDjafaf32.exeBkegah32.exeDlboca32.exeGejebk32.exeBfagpiam.exeCafgle32.exeGhdgfbkl.exeFmdbnnlj.exeIgkhjdde.exeFmkilb32.exeGkalhgfd.exeGqcnln32.exeMcidkf32.exeOehicoom.exeBcgdom32.exeHllmcc32.exeGncnmane.exeGajjhkgh.exeMedeaaej.exeJbjpom32.exePkjqcg32.exeCkiiiine.exeHqgddm32.exeFbpclofe.exeLbgkfbbj.exeNlcibc32.exeObhdcanc.exeMbnljqic.exeMbpipp32.exedescription ioc process File created C:\Windows\SysWOW64\Pkojoghl.exe Peeabm32.exe File opened for modification C:\Windows\SysWOW64\Jkbojpna.exe Jnnnalph.exe File opened for modification C:\Windows\SysWOW64\Pepcelel.exe Pkjphcff.exe File created C:\Windows\SysWOW64\Ghgfekpn.exe Gcjmmdbf.exe File opened for modification C:\Windows\SysWOW64\Pjlgle32.exe Ppgcol32.exe File opened for modification C:\Windows\SysWOW64\Nfglfdeb.exe Njalacon.exe File created C:\Windows\SysWOW64\Pnenhc32.dll Ecgjdong.exe File created C:\Windows\SysWOW64\Pkjqcg32.exe Pfkkeq32.exe File created C:\Windows\SysWOW64\Oniefifl.dll Bjoofhgc.exe File created C:\Windows\SysWOW64\Klcdfdcb.dll Mqnifg32.exe File created C:\Windows\SysWOW64\Qlfgce32.dll Mmicfh32.exe File created C:\Windows\SysWOW64\Ikjhki32.exe Iocgfhhc.exe File created C:\Windows\SysWOW64\Jmlfmn32.exe Jkkjeeke.exe File opened for modification C:\Windows\SysWOW64\Qmifhq32.exe Qfonkfqd.exe File opened for modification C:\Windows\SysWOW64\Kffldlne.exe Knkgpi32.exe File created C:\Windows\SysWOW64\Cmpgpond.exe Cgcnghpl.exe File opened for modification C:\Windows\SysWOW64\Bapfhg32.exe Anbmbi32.exe File created C:\Windows\SysWOW64\Chlikc32.dll Kkgopf32.exe File created C:\Windows\SysWOW64\Oionacqo.exe Ogqaehak.exe File created C:\Windows\SysWOW64\Imahkg32.exe Ieomef32.exe File created C:\Windows\SysWOW64\Iofjqboi.dll Iihiphln.exe File created C:\Windows\SysWOW64\Iampng32.dll Efjmbaba.exe File created C:\Windows\SysWOW64\Hqkmplen.exe Hgciff32.exe File created C:\Windows\SysWOW64\Jagmhnkn.dll Mbdcepcm.exe File created C:\Windows\SysWOW64\Fmdpgmhn.dll Mdogedmh.exe File created C:\Windows\SysWOW64\Qanmcdlm.exe Pdjljpnc.exe File created C:\Windows\SysWOW64\Hnkdiq32.dll Ffcllo32.exe File created C:\Windows\SysWOW64\Apmhbiaf.dll Bbgqjdce.exe File created C:\Windows\SysWOW64\Olebgfao.exe Ooabmbbe.exe File created C:\Windows\SysWOW64\Omakjj32.dll Caifjn32.exe File created C:\Windows\SysWOW64\Dlmfbm32.dll Bcflko32.exe File created C:\Windows\SysWOW64\Faeihnam.dll Hoimecmb.exe File opened for modification C:\Windows\SysWOW64\Donojm32.exe Djafaf32.exe File opened for modification C:\Windows\SysWOW64\Ccmpce32.exe Bkegah32.exe File created C:\Windows\SysWOW64\Jlpfci32.dll Dlboca32.exe File created C:\Windows\SysWOW64\Gbnflo32.exe Gejebk32.exe File opened for modification C:\Windows\SysWOW64\Bnhoag32.exe Bfagpiam.exe File opened for modification C:\Windows\SysWOW64\Cdecha32.exe Cafgle32.exe File opened for modification C:\Windows\SysWOW64\Gdkgkcpq.exe Ghdgfbkl.exe File opened for modification C:\Windows\SysWOW64\Fpbnjjkm.exe Fmdbnnlj.exe File created C:\Windows\SysWOW64\Aaggak32.dll Igkhjdde.exe File created C:\Windows\SysWOW64\Ghajacmo.exe Fmkilb32.exe File created C:\Windows\SysWOW64\Glchpp32.exe Gkalhgfd.exe File created C:\Windows\SysWOW64\Hkgioloi.dll Gqcnln32.exe File opened for modification C:\Windows\SysWOW64\Modlbmmn.exe Mdogedmh.exe File created C:\Windows\SysWOW64\Apenjhfe.dll Mcidkf32.exe File opened for modification C:\Windows\SysWOW64\Ojeakfnd.exe Oehicoom.exe File created C:\Windows\SysWOW64\Bjallg32.exe Bcgdom32.exe File created C:\Windows\SysWOW64\Mcqkfc32.dll Hllmcc32.exe File created C:\Windows\SysWOW64\Mdmckc32.dll Gncnmane.exe File opened for modification C:\Windows\SysWOW64\Ggfbpaeo.exe Gajjhkgh.exe File created C:\Windows\SysWOW64\Nkepldda.dll Medeaaej.exe File created C:\Windows\SysWOW64\Gcighi32.dll Jbjpom32.exe File opened for modification C:\Windows\SysWOW64\Pgaahh32.exe Pkjqcg32.exe File opened for modification C:\Windows\SysWOW64\Cenmfbml.exe Ckiiiine.exe File created C:\Windows\SysWOW64\Hqiqjlga.exe Hqgddm32.exe File created C:\Windows\SysWOW64\Flhhed32.exe Fbpclofe.exe File opened for modification C:\Windows\SysWOW64\Lhdcojaa.exe Lbgkfbbj.exe File created C:\Windows\SysWOW64\Nbmaon32.exe Nlcibc32.exe File created C:\Windows\SysWOW64\Odgamdef.exe Obhdcanc.exe File opened for modification C:\Windows\SysWOW64\Bnlphh32.exe Bcflko32.exe File created C:\Windows\SysWOW64\Donojm32.exe Djafaf32.exe File created C:\Windows\SysWOW64\Ikmnfdoq.dll Mbnljqic.exe File opened for modification C:\Windows\SysWOW64\Mbbfep32.exe Mbpipp32.exe -
Modifies registry class 64 IoCs
Processes:
Mbpipp32.exeNgdjaofc.exeObeacl32.exeDcdkef32.exeNhhominh.exeKkileele.exeDaofpchf.exeAnljck32.exeKlcgpkhh.exeLlbconkd.exeCaokmd32.exeGjlgfaco.exeHllmcc32.exeCcmpce32.exeDcllbhdn.exeFabaocfl.exeFbegbacp.exeKkjpggkn.exeOodjjign.exePnopldgn.exeEaeipfei.exePehebbbh.exeGbjpem32.exeGdnibdmf.exeGbnflo32.exeIcfbkded.exeAqjdgmgd.exeOmmfga32.exePafbadcm.exeBmhkmm32.exeImahkg32.exeHohkmj32.exeLcedne32.exeKbaglpee.exeObhdcanc.exeDomqjm32.exeHlgimqhf.exeGenlgnhd.exeAcqnnndl.exeOefjdgjk.exeOhdfqbio.exeFbngfo32.exeDhplhc32.exeMgbaml32.exeBjjaikoa.exePfkkeq32.exeBpnddn32.exeMgjnhaco.exeFepjea32.exeLgpdglhn.exeBaneak32.exeCbepdhgc.exeCehfkb32.exeGmidlmcd.exeCpohhk32.exeIoakoq32.exeDbadagln.exeDkigoimd.exeDnjoco32.exeNnleiipc.exeBjedmo32.exeNqeapo32.exeAmgjnepn.exeLmnhgjmp.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ioiepeog.dll" Mbpipp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ngdjaofc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Obeacl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dcdkef32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nhhominh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kkileele.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Daofpchf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Anljck32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Klcgpkhh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkeeihpg.dll" Llbconkd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Caokmd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkefga32.dll" Gjlgfaco.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hllmcc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ccmpce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igbfkb32.dll" Dcllbhdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fabaocfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fbegbacp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kkjpggkn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oodjjign.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pnopldgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckcdknaf.dll" Eaeipfei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pehebbbh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gbjpem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gdnibdmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gbnflo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idfejc32.dll" Icfbkded.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aqjdgmgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifmnalja.dll" Ommfga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pafbadcm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bmhkmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Imahkg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hohkmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lcedne32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kbaglpee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Obhdcanc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Domqjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hlgimqhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Genlgnhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieeeljdp.dll" Acqnnndl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oefjdgjk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ohdfqbio.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fbngfo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dhplhc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mgbaml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glgcpc32.dll" Bjjaikoa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbmmbaal.dll" Pfkkeq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bpnddn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mgjnhaco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Padqpaec.dll" Fepjea32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lgpdglhn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Baneak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdaemiaj.dll" Cbepdhgc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhlchh32.dll" Cehfkb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gmidlmcd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cpohhk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ioakoq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okobem32.dll" Dbadagln.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dkigoimd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dnjoco32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nnleiipc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bjedmo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nqeapo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikkkijnk.dll" Amgjnepn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lakfjp32.dll" Lmnhgjmp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ebf02636dda463a1adc403a6445dc5f769885d4e1cc4121fed3b45cc8fd4f525.exeFfqofohj.exeFfcllo32.exeGcglec32.exeGlbqje32.exeGejebk32.exeGbnflo32.exeGnefapmj.exeGjlgfaco.exeHhpgpebh.exeHahlhkhi.exeHicqmmfc.exeHfgafadm.exeHmaick32.exeHelngnie.exeIimcclni.exedescription pid process target process PID 2032 wrote to memory of 1716 2032 ebf02636dda463a1adc403a6445dc5f769885d4e1cc4121fed3b45cc8fd4f525.exe Ffqofohj.exe PID 2032 wrote to memory of 1716 2032 ebf02636dda463a1adc403a6445dc5f769885d4e1cc4121fed3b45cc8fd4f525.exe Ffqofohj.exe PID 2032 wrote to memory of 1716 2032 ebf02636dda463a1adc403a6445dc5f769885d4e1cc4121fed3b45cc8fd4f525.exe Ffqofohj.exe PID 2032 wrote to memory of 1716 2032 ebf02636dda463a1adc403a6445dc5f769885d4e1cc4121fed3b45cc8fd4f525.exe Ffqofohj.exe PID 1716 wrote to memory of 1068 1716 Ffqofohj.exe Ffcllo32.exe PID 1716 wrote to memory of 1068 1716 Ffqofohj.exe Ffcllo32.exe PID 1716 wrote to memory of 1068 1716 Ffqofohj.exe Ffcllo32.exe PID 1716 wrote to memory of 1068 1716 Ffqofohj.exe Ffcllo32.exe PID 1068 wrote to memory of 2200 1068 Ffcllo32.exe Gcglec32.exe PID 1068 wrote to memory of 2200 1068 Ffcllo32.exe Gcglec32.exe PID 1068 wrote to memory of 2200 1068 Ffcllo32.exe Gcglec32.exe PID 1068 wrote to memory of 2200 1068 Ffcllo32.exe Gcglec32.exe PID 2200 wrote to memory of 2596 2200 Gcglec32.exe Glbqje32.exe PID 2200 wrote to memory of 2596 2200 Gcglec32.exe Glbqje32.exe PID 2200 wrote to memory of 2596 2200 Gcglec32.exe Glbqje32.exe PID 2200 wrote to memory of 2596 2200 Gcglec32.exe Glbqje32.exe PID 2596 wrote to memory of 2704 2596 Glbqje32.exe Gejebk32.exe PID 2596 wrote to memory of 2704 2596 Glbqje32.exe Gejebk32.exe PID 2596 wrote to memory of 2704 2596 Glbqje32.exe Gejebk32.exe PID 2596 wrote to memory of 2704 2596 Glbqje32.exe Gejebk32.exe PID 2704 wrote to memory of 2400 2704 Gejebk32.exe Gbnflo32.exe PID 2704 wrote to memory of 2400 2704 Gejebk32.exe Gbnflo32.exe PID 2704 wrote to memory of 2400 2704 Gejebk32.exe Gbnflo32.exe PID 2704 wrote to memory of 2400 2704 Gejebk32.exe Gbnflo32.exe PID 2400 wrote to memory of 2376 2400 Gbnflo32.exe Gnefapmj.exe PID 2400 wrote to memory of 2376 2400 Gbnflo32.exe Gnefapmj.exe PID 2400 wrote to memory of 2376 2400 Gbnflo32.exe Gnefapmj.exe PID 2400 wrote to memory of 2376 2400 Gbnflo32.exe Gnefapmj.exe PID 2376 wrote to memory of 2792 2376 Gnefapmj.exe Gjlgfaco.exe PID 2376 wrote to memory of 2792 2376 Gnefapmj.exe Gjlgfaco.exe PID 2376 wrote to memory of 2792 2376 Gnefapmj.exe Gjlgfaco.exe PID 2376 wrote to memory of 2792 2376 Gnefapmj.exe Gjlgfaco.exe PID 2792 wrote to memory of 2356 2792 Gjlgfaco.exe Hhpgpebh.exe PID 2792 wrote to memory of 2356 2792 Gjlgfaco.exe Hhpgpebh.exe PID 2792 wrote to memory of 2356 2792 Gjlgfaco.exe Hhpgpebh.exe PID 2792 wrote to memory of 2356 2792 Gjlgfaco.exe Hhpgpebh.exe PID 2356 wrote to memory of 572 2356 Hhpgpebh.exe Hahlhkhi.exe PID 2356 wrote to memory of 572 2356 Hhpgpebh.exe Hahlhkhi.exe PID 2356 wrote to memory of 572 2356 Hhpgpebh.exe Hahlhkhi.exe PID 2356 wrote to memory of 572 2356 Hhpgpebh.exe Hahlhkhi.exe PID 572 wrote to memory of 484 572 Hahlhkhi.exe Hicqmmfc.exe PID 572 wrote to memory of 484 572 Hahlhkhi.exe Hicqmmfc.exe PID 572 wrote to memory of 484 572 Hahlhkhi.exe Hicqmmfc.exe PID 572 wrote to memory of 484 572 Hahlhkhi.exe Hicqmmfc.exe PID 484 wrote to memory of 1924 484 Hicqmmfc.exe Hfgafadm.exe PID 484 wrote to memory of 1924 484 Hicqmmfc.exe Hfgafadm.exe PID 484 wrote to memory of 1924 484 Hicqmmfc.exe Hfgafadm.exe PID 484 wrote to memory of 1924 484 Hicqmmfc.exe Hfgafadm.exe PID 1924 wrote to memory of 2120 1924 Hfgafadm.exe Hmaick32.exe PID 1924 wrote to memory of 2120 1924 Hfgafadm.exe Hmaick32.exe PID 1924 wrote to memory of 2120 1924 Hfgafadm.exe Hmaick32.exe PID 1924 wrote to memory of 2120 1924 Hfgafadm.exe Hmaick32.exe PID 2120 wrote to memory of 2444 2120 Hmaick32.exe Helngnie.exe PID 2120 wrote to memory of 2444 2120 Hmaick32.exe Helngnie.exe PID 2120 wrote to memory of 2444 2120 Hmaick32.exe Helngnie.exe PID 2120 wrote to memory of 2444 2120 Hmaick32.exe Helngnie.exe PID 2444 wrote to memory of 2968 2444 Helngnie.exe Iimcclni.exe PID 2444 wrote to memory of 2968 2444 Helngnie.exe Iimcclni.exe PID 2444 wrote to memory of 2968 2444 Helngnie.exe Iimcclni.exe PID 2444 wrote to memory of 2968 2444 Helngnie.exe Iimcclni.exe PID 2968 wrote to memory of 2988 2968 Iimcclni.exe Ioilkblq.exe PID 2968 wrote to memory of 2988 2968 Iimcclni.exe Ioilkblq.exe PID 2968 wrote to memory of 2988 2968 Iimcclni.exe Ioilkblq.exe PID 2968 wrote to memory of 2988 2968 Iimcclni.exe Ioilkblq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebf02636dda463a1adc403a6445dc5f769885d4e1cc4121fed3b45cc8fd4f525.exe"C:\Users\Admin\AppData\Local\Temp\ebf02636dda463a1adc403a6445dc5f769885d4e1cc4121fed3b45cc8fd4f525.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\Ffqofohj.exeC:\Windows\system32\Ffqofohj.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\Ffcllo32.exeC:\Windows\system32\Ffcllo32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\Gcglec32.exeC:\Windows\system32\Gcglec32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\Glbqje32.exeC:\Windows\system32\Glbqje32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\Gejebk32.exeC:\Windows\system32\Gejebk32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\Gbnflo32.exeC:\Windows\system32\Gbnflo32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\Gnefapmj.exeC:\Windows\system32\Gnefapmj.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\Gjlgfaco.exeC:\Windows\system32\Gjlgfaco.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\Hhpgpebh.exeC:\Windows\system32\Hhpgpebh.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\Hahlhkhi.exeC:\Windows\system32\Hahlhkhi.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\Hicqmmfc.exeC:\Windows\system32\Hicqmmfc.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\SysWOW64\Hfgafadm.exeC:\Windows\system32\Hfgafadm.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\Hmaick32.exeC:\Windows\system32\Hmaick32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\Helngnie.exeC:\Windows\system32\Helngnie.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\Iimcclni.exeC:\Windows\system32\Iimcclni.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\Ioilkblq.exeC:\Windows\system32\Ioilkblq.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Windows\SysWOW64\Ilnmdgkj.exeC:\Windows\system32\Ilnmdgkj.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Windows\SysWOW64\Iajemnia.exeC:\Windows\system32\Iajemnia.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Windows\SysWOW64\Inafbooe.exeC:\Windows\system32\Inafbooe.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Windows\SysWOW64\Igijkd32.exeC:\Windows\system32\Igijkd32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Windows\SysWOW64\Iihfgp32.exeC:\Windows\system32\Iihfgp32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Windows\SysWOW64\Jglgpdcc.exeC:\Windows\system32\Jglgpdcc.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Windows\SysWOW64\Jliohkak.exeC:\Windows\system32\Jliohkak.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Windows\SysWOW64\Jgncfcaa.exeC:\Windows\system32\Jgncfcaa.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Windows\SysWOW64\Joihjfnl.exeC:\Windows\system32\Joihjfnl.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Windows\SysWOW64\Jfcqgpfi.exeC:\Windows\system32\Jfcqgpfi.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Windows\SysWOW64\Jolepe32.exeC:\Windows\system32\Jolepe32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Windows\SysWOW64\Jlpeij32.exeC:\Windows\system32\Jlpeij32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Windows\SysWOW64\Jblnaq32.exeC:\Windows\system32\Jblnaq32.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Windows\SysWOW64\Jkebjf32.exeC:\Windows\system32\Jkebjf32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Windows\SysWOW64\Kbokgpgg.exeC:\Windows\system32\Kbokgpgg.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Windows\SysWOW64\Kkgopf32.exeC:\Windows\system32\Kkgopf32.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2632 -
C:\Windows\SysWOW64\Kbaglpee.exeC:\Windows\system32\Kbaglpee.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2488 -
C:\Windows\SysWOW64\Kkileele.exeC:\Windows\system32\Kkileele.exe35⤵
- Executes dropped EXE
- Modifies registry class
PID:2496 -
C:\Windows\SysWOW64\Kqfdnljm.exeC:\Windows\system32\Kqfdnljm.exe36⤵
- Executes dropped EXE
PID:268 -
C:\Windows\SysWOW64\Kgpmjf32.exeC:\Windows\system32\Kgpmjf32.exe37⤵
- Executes dropped EXE
PID:1348 -
C:\Windows\SysWOW64\Kmmebm32.exeC:\Windows\system32\Kmmebm32.exe38⤵
- Executes dropped EXE
PID:1372 -
C:\Windows\SysWOW64\Kgbipf32.exeC:\Windows\system32\Kgbipf32.exe39⤵
- Executes dropped EXE
PID:1780 -
C:\Windows\SysWOW64\Kmobhmnn.exeC:\Windows\system32\Kmobhmnn.exe40⤵
- Executes dropped EXE
PID:1900 -
C:\Windows\SysWOW64\Lopkjhko.exeC:\Windows\system32\Lopkjhko.exe41⤵
- Executes dropped EXE
PID:1612 -
C:\Windows\SysWOW64\Ljfogake.exeC:\Windows\system32\Ljfogake.exe42⤵
- Executes dropped EXE
PID:2240 -
C:\Windows\SysWOW64\Lkgkoiqc.exeC:\Windows\system32\Lkgkoiqc.exe43⤵
- Executes dropped EXE
PID:2252 -
C:\Windows\SysWOW64\Lmfhil32.exeC:\Windows\system32\Lmfhil32.exe44⤵
- Executes dropped EXE
PID:2904 -
C:\Windows\SysWOW64\Lnhdqdnd.exeC:\Windows\system32\Lnhdqdnd.exe45⤵
- Executes dropped EXE
PID:1264 -
C:\Windows\SysWOW64\Lklejh32.exeC:\Windows\system32\Lklejh32.exe46⤵
- Executes dropped EXE
PID:1472 -
C:\Windows\SysWOW64\Ledibnco.exeC:\Windows\system32\Ledibnco.exe47⤵
- Executes dropped EXE
PID:2964 -
C:\Windows\SysWOW64\Ljabkeaf.exeC:\Windows\system32\Ljabkeaf.exe48⤵
- Executes dropped EXE
PID:3052 -
C:\Windows\SysWOW64\Meffhnal.exeC:\Windows\system32\Meffhnal.exe49⤵
- Executes dropped EXE
PID:1532 -
C:\Windows\SysWOW64\Mlpneh32.exeC:\Windows\system32\Mlpneh32.exe50⤵
- Executes dropped EXE
PID:2864 -
C:\Windows\SysWOW64\Mnojacgm.exeC:\Windows\system32\Mnojacgm.exe51⤵
- Executes dropped EXE
PID:2324 -
C:\Windows\SysWOW64\Mclcijfd.exeC:\Windows\system32\Mclcijfd.exe52⤵
- Executes dropped EXE
PID:1904 -
C:\Windows\SysWOW64\Mjekfd32.exeC:\Windows\system32\Mjekfd32.exe53⤵
- Executes dropped EXE
PID:2196 -
C:\Windows\SysWOW64\Mmdgbp32.exeC:\Windows\system32\Mmdgbp32.exe54⤵
- Executes dropped EXE
PID:2592 -
C:\Windows\SysWOW64\Mikhgqbi.exeC:\Windows\system32\Mikhgqbi.exe55⤵
- Executes dropped EXE
PID:2520 -
C:\Windows\SysWOW64\Mpdqdkie.exeC:\Windows\system32\Mpdqdkie.exe56⤵
- Executes dropped EXE
PID:2156 -
C:\Windows\SysWOW64\Mbcmpfhi.exeC:\Windows\system32\Mbcmpfhi.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2372 -
C:\Windows\SysWOW64\Mimemp32.exeC:\Windows\system32\Mimemp32.exe58⤵
- Executes dropped EXE
PID:2960 -
C:\Windows\SysWOW64\Mdbiji32.exeC:\Windows\system32\Mdbiji32.exe59⤵
- Executes dropped EXE
PID:2684 -
C:\Windows\SysWOW64\Medeaaej.exeC:\Windows\system32\Medeaaej.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2128 -
C:\Windows\SysWOW64\Npijoj32.exeC:\Windows\system32\Npijoj32.exe61⤵
- Executes dropped EXE
PID:1952 -
C:\Windows\SysWOW64\Nkjapglg.exeC:\Windows\system32\Nkjapglg.exe62⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\Ogqaehak.exeC:\Windows\system32\Ogqaehak.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2364 -
C:\Windows\SysWOW64\Oionacqo.exeC:\Windows\system32\Oionacqo.exe64⤵
- Executes dropped EXE
PID:1936 -
C:\Windows\SysWOW64\Odebolpe.exeC:\Windows\system32\Odebolpe.exe65⤵
- Executes dropped EXE
PID:2528 -
C:\Windows\SysWOW64\Okojkf32.exeC:\Windows\system32\Okojkf32.exe66⤵PID:2620
-
C:\Windows\SysWOW64\Ommfga32.exeC:\Windows\system32\Ommfga32.exe67⤵
- Modifies registry class
PID:3036 -
C:\Windows\SysWOW64\Opkccm32.exeC:\Windows\system32\Opkccm32.exe68⤵PID:592
-
C:\Windows\SysWOW64\Oidglb32.exeC:\Windows\system32\Oidglb32.exe69⤵PID:1608
-
C:\Windows\SysWOW64\Opnpimdf.exeC:\Windows\system32\Opnpimdf.exe70⤵PID:1596
-
C:\Windows\SysWOW64\Oghhfg32.exeC:\Windows\system32\Oghhfg32.exe71⤵PID:1584
-
C:\Windows\SysWOW64\Oifdbb32.exeC:\Windows\system32\Oifdbb32.exe72⤵PID:2468
-
C:\Windows\SysWOW64\Ooclji32.exeC:\Windows\system32\Ooclji32.exe73⤵PID:1740
-
C:\Windows\SysWOW64\Oemegc32.exeC:\Windows\system32\Oemegc32.exe74⤵PID:2512
-
C:\Windows\SysWOW64\Poeipifl.exeC:\Windows\system32\Poeipifl.exe75⤵PID:2500
-
C:\Windows\SysWOW64\Phnnho32.exeC:\Windows\system32\Phnnho32.exe76⤵PID:1640
-
C:\Windows\SysWOW64\Pafbadcm.exeC:\Windows\system32\Pafbadcm.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:368 -
C:\Windows\SysWOW64\Pddnnp32.exeC:\Windows\system32\Pddnnp32.exe78⤵PID:2948
-
C:\Windows\SysWOW64\Pkofjijm.exeC:\Windows\system32\Pkofjijm.exe79⤵PID:1140
-
C:\Windows\SysWOW64\Pnopldgn.exeC:\Windows\system32\Pnopldgn.exe80⤵
- Modifies registry class
PID:2932 -
C:\Windows\SysWOW64\Pqnlhpfb.exeC:\Windows\system32\Pqnlhpfb.exe81⤵PID:2236
-
C:\Windows\SysWOW64\Pggdejno.exeC:\Windows\system32\Pggdejno.exe82⤵PID:860
-
C:\Windows\SysWOW64\Pcnejk32.exeC:\Windows\system32\Pcnejk32.exe83⤵PID:1028
-
C:\Windows\SysWOW64\Qqbecp32.exeC:\Windows\system32\Qqbecp32.exe84⤵PID:880
-
C:\Windows\SysWOW64\Qfonkfqd.exeC:\Windows\system32\Qfonkfqd.exe85⤵
- Drops file in System32 directory
PID:2464 -
C:\Windows\SysWOW64\Qmifhq32.exeC:\Windows\system32\Qmifhq32.exe86⤵PID:2276
-
C:\Windows\SysWOW64\Accnekon.exeC:\Windows\system32\Accnekon.exe87⤵PID:1940
-
C:\Windows\SysWOW64\Ajmfad32.exeC:\Windows\system32\Ajmfad32.exe88⤵PID:2456
-
C:\Windows\SysWOW64\Afdgfelo.exeC:\Windows\system32\Afdgfelo.exe89⤵PID:2572
-
C:\Windows\SysWOW64\Amnocpdk.exeC:\Windows\system32\Amnocpdk.exe90⤵PID:2484
-
C:\Windows\SysWOW64\Aollokco.exeC:\Windows\system32\Aollokco.exe91⤵PID:2412
-
C:\Windows\SysWOW64\Affdle32.exeC:\Windows\system32\Affdle32.exe92⤵PID:2404
-
C:\Windows\SysWOW64\Aggpdnpj.exeC:\Windows\system32\Aggpdnpj.exe93⤵PID:888
-
C:\Windows\SysWOW64\Aoohekal.exeC:\Windows\system32\Aoohekal.exe94⤵PID:1124
-
C:\Windows\SysWOW64\Aapemc32.exeC:\Windows\system32\Aapemc32.exe95⤵PID:312
-
C:\Windows\SysWOW64\Agjmim32.exeC:\Windows\system32\Agjmim32.exe96⤵PID:1508
-
C:\Windows\SysWOW64\Aababceh.exeC:\Windows\system32\Aababceh.exe97⤵PID:2688
-
C:\Windows\SysWOW64\Acqnnndl.exeC:\Windows\system32\Acqnnndl.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2732 -
C:\Windows\SysWOW64\Ajjfkh32.exeC:\Windows\system32\Ajjfkh32.exe99⤵PID:1172
-
C:\Windows\SysWOW64\Bccjdnbi.exeC:\Windows\system32\Bccjdnbi.exe100⤵PID:1656
-
C:\Windows\SysWOW64\Bfagpiam.exeC:\Windows\system32\Bfagpiam.exe101⤵
- Drops file in System32 directory
PID:788 -
C:\Windows\SysWOW64\Bnhoag32.exeC:\Windows\system32\Bnhoag32.exe102⤵PID:852
-
C:\Windows\SysWOW64\Bagkmb32.exeC:\Windows\system32\Bagkmb32.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1116 -
C:\Windows\SysWOW64\Bgqcjlhp.exeC:\Windows\system32\Bgqcjlhp.exe104⤵PID:2564
-
C:\Windows\SysWOW64\Bjoofhgc.exeC:\Windows\system32\Bjoofhgc.exe105⤵
- Drops file in System32 directory
PID:2080 -
C:\Windows\SysWOW64\Bmnlbcfg.exeC:\Windows\system32\Bmnlbcfg.exe106⤵PID:2868
-
C:\Windows\SysWOW64\Bcgdom32.exeC:\Windows\system32\Bcgdom32.exe107⤵
- Drops file in System32 directory
PID:692 -
C:\Windows\SysWOW64\Bjallg32.exeC:\Windows\system32\Bjallg32.exe108⤵PID:2228
-
C:\Windows\SysWOW64\Bidlgdlk.exeC:\Windows\system32\Bidlgdlk.exe109⤵PID:1700
-
C:\Windows\SysWOW64\Bpnddn32.exeC:\Windows\system32\Bpnddn32.exe110⤵
- Modifies registry class
PID:2668 -
C:\Windows\SysWOW64\Bekmle32.exeC:\Windows\system32\Bekmle32.exe111⤵PID:2720
-
C:\Windows\SysWOW64\Bmbemb32.exeC:\Windows\system32\Bmbemb32.exe112⤵PID:1148
-
C:\Windows\SysWOW64\Bncaekhp.exeC:\Windows\system32\Bncaekhp.exe113⤵PID:3060
-
C:\Windows\SysWOW64\Bfkifhib.exeC:\Windows\system32\Bfkifhib.exe114⤵PID:528
-
C:\Windows\SysWOW64\Chlfnp32.exeC:\Windows\system32\Chlfnp32.exe115⤵PID:1592
-
C:\Windows\SysWOW64\Cbajkiof.exeC:\Windows\system32\Cbajkiof.exe116⤵PID:2328
-
C:\Windows\SysWOW64\Chnbcpmn.exeC:\Windows\system32\Chnbcpmn.exe117⤵PID:2708
-
C:\Windows\SysWOW64\Cjmopkla.exeC:\Windows\system32\Cjmopkla.exe118⤵PID:2880
-
C:\Windows\SysWOW64\Cafgle32.exeC:\Windows\system32\Cafgle32.exe119⤵
- Drops file in System32 directory
PID:1964 -
C:\Windows\SysWOW64\Cdecha32.exeC:\Windows\system32\Cdecha32.exe120⤵PID:1568
-
C:\Windows\SysWOW64\Ckolek32.exeC:\Windows\system32\Ckolek32.exe121⤵PID:1620
-
C:\Windows\SysWOW64\Cmmhaf32.exeC:\Windows\system32\Cmmhaf32.exe122⤵PID:2912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-