Analysis
-
max time kernel
98s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 00:17
Static task
static1
Behavioral task
behavioral1
Sample
601c5d5a6a4c2ede577d060e88c6fd997584d6372f17fd8fd6cc7fd7e1b2f91c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
601c5d5a6a4c2ede577d060e88c6fd997584d6372f17fd8fd6cc7fd7e1b2f91c.exe
Resource
win10v2004-20240426-en
General
-
Target
601c5d5a6a4c2ede577d060e88c6fd997584d6372f17fd8fd6cc7fd7e1b2f91c.exe
-
Size
384KB
-
MD5
19515360a26cc196a92efaf29e3eac10
-
SHA1
cdbb824f50a67fdb191a88c571fec6b1735503ea
-
SHA256
601c5d5a6a4c2ede577d060e88c6fd997584d6372f17fd8fd6cc7fd7e1b2f91c
-
SHA512
e722f3ee23001afc605111890af60a5e830491afd28db655a1ac9fd01ea310bd88478b510e22469b4657bf18d9d9824061f15bbfbc3a0f713bc6b953bf03a28b
-
SSDEEP
6144:i+zDbpKyevlkZV4U/vlf0DrBqvl8ZV4U/vlfl+9DvlEZV4U/vlf0DrBqvl8F:ieDbofvc6IveDVqvQ6IvYvc6IveDVqvY
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Dknajh32.exeOjpomh32.exeDmecokhm.exeMomfan32.exeOngckp32.exeBfphmi32.exeLhnkffeo.exeLjnqdhga.exeNpbklabl.exeNafknbqk.exeOahdce32.exeGnphfppi.exeJbpfnh32.exeIcabeo32.exeCgobcd32.exeMbbfep32.exeJfieigio.exeHjmlhbbg.exeDocopbaf.exeBbqkeioh.exeDjmiejji.exeFpemhb32.exeOeaqig32.exeObjjnkie.exeCqfbjhgf.exeCmimif32.exeGbdlnf32.exeIdemkp32.exeKcmcoblm.exeNaimepkp.exeAljmbknm.exeOmkjbb32.exeBcoffd32.exeFhjmfnok.exeLoaokjjg.exeObecld32.exePfchqf32.exeDdbmcb32.exeOkojkf32.exeJfofol32.exeQdlggg32.exePijgbl32.exeNdgdpn32.exeCnejim32.exeEkofgnna.exeEiimci32.exeJenpajfb.exeKdnkdmec.exeNdehjnpo.exeMgmoob32.exeDomccejd.exePhaoppja.exeIjfqfj32.exeLomglo32.exeJcciqi32.exePnimpcke.exePibgfjdh.exeOmfnnnhj.exeBacefpbg.exeOhjmlaci.exePaekijkb.exeEmdmjamj.exeHkdemk32.exeNqhepeai.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dknajh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ojpomh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dmecokhm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Momfan32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ongckp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bfphmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lhnkffeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ljnqdhga.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Npbklabl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nafknbqk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oahdce32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gnphfppi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jbpfnh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icabeo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgobcd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbbfep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jfieigio.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjmlhbbg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Docopbaf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bbqkeioh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Djmiejji.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fpemhb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oeaqig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Objjnkie.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cqfbjhgf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cmimif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gbdlnf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Idemkp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcmcoblm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Naimepkp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aljmbknm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Omkjbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bcoffd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhjmfnok.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Loaokjjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Obecld32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfchqf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddbmcb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okojkf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfofol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qdlggg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pijgbl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndgdpn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnejim32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ekofgnna.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eiimci32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jenpajfb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kdnkdmec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ndehjnpo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgmoob32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Domccejd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phaoppja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ijfqfj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lomglo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jcciqi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pnimpcke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pibgfjdh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Omfnnnhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bacefpbg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ohjmlaci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Paekijkb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emdmjamj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hkdemk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nqhepeai.exe -
Executes dropped EXE 64 IoCs
Processes:
Lfjcfb32.exeLnhdqdnd.exeMfjoeeeh.exeMikhgqbi.exeNlpkdkkd.exeNkegeg32.exeOmkjbb32.exeOkojkf32.exeOemegc32.exePafbadcm.exePclhdl32.exePdldnomh.exeAcekjjmk.exeAidphq32.exeBccjdnbi.exeBfccei32.exeBbmapj32.exeCemjae32.exeCdgpnqpo.exeCkahkk32.exeDanmmd32.exeDlgnmb32.exeDcccpl32.exeDpgcip32.exeDchmkkkj.exeEkcaonhe.exeEoajel32.exeEniclh32.exeEnkpahon.exeFjdnlhco.exeFoafdoag.exeFhikme32.exeFbbofjnh.exeFgadda32.exeGgcaiqhj.exeGmpjagfa.exeGaqomeke.exeGpelnb32.exeHmjlhfof.exeHipmmg32.exeHnpbjnpo.exeHeikgh32.exeHapklimq.exeHfmddp32.exeIdadnd32.exeIdcacc32.exeIpjahd32.exeIibfajdc.exeIfffkncm.exeIlcoce32.exeIelclkhe.exeJenpajfb.exeJaeafklf.exeJhoice32.exeJpjngh32.exeJkpbdq32.exeJckgicnp.exeJjdofm32.exeKcmcoblm.exeKlehgh32.exeKjihalag.exeKlhemhpk.exeKbdmeoob.exeKhoebi32.exepid process 2760 Lfjcfb32.exe 2568 Lnhdqdnd.exe 2152 Mfjoeeeh.exe 2512 Mikhgqbi.exe 2428 Nlpkdkkd.exe 2736 Nkegeg32.exe 572 Omkjbb32.exe 1128 Okojkf32.exe 1608 Oemegc32.exe 1276 Pafbadcm.exe 1812 Pclhdl32.exe 2116 Pdldnomh.exe 2364 Acekjjmk.exe 1316 Aidphq32.exe 2464 Bccjdnbi.exe 2164 Bfccei32.exe 1712 Bbmapj32.exe 2172 Cemjae32.exe 1384 Cdgpnqpo.exe 772 Ckahkk32.exe 1500 Danmmd32.exe 1800 Dlgnmb32.exe 712 Dcccpl32.exe 2872 Dpgcip32.exe 2260 Dchmkkkj.exe 876 Ekcaonhe.exe 1736 Eoajel32.exe 2856 Eniclh32.exe 2916 Enkpahon.exe 2728 Fjdnlhco.exe 1284 Foafdoag.exe 2732 Fhikme32.exe 2844 Fbbofjnh.exe 1004 Fgadda32.exe 532 Ggcaiqhj.exe 1388 Gmpjagfa.exe 2492 Gaqomeke.exe 2372 Gpelnb32.exe 2344 Hmjlhfof.exe 1848 Hipmmg32.exe 2008 Hnpbjnpo.exe 2832 Heikgh32.exe 2288 Hapklimq.exe 3024 Hfmddp32.exe 2036 Idadnd32.exe 944 Idcacc32.exe 1032 Ipjahd32.exe 1916 Iibfajdc.exe 2348 Ifffkncm.exe 2276 Ilcoce32.exe 1148 Ielclkhe.exe 2764 Jenpajfb.exe 3020 Jaeafklf.exe 2992 Jhoice32.exe 2688 Jpjngh32.exe 2060 Jkpbdq32.exe 2560 Jckgicnp.exe 2456 Jjdofm32.exe 800 Kcmcoblm.exe 1544 Klehgh32.exe 2264 Kjihalag.exe 1820 Klhemhpk.exe 1268 Kbdmeoob.exe 1040 Khoebi32.exe -
Loads dropped DLL 64 IoCs
Processes:
601c5d5a6a4c2ede577d060e88c6fd997584d6372f17fd8fd6cc7fd7e1b2f91c.exeLfjcfb32.exeLnhdqdnd.exeMfjoeeeh.exeMikhgqbi.exeNlpkdkkd.exeNkegeg32.exeOmkjbb32.exeOkojkf32.exeOemegc32.exePafbadcm.exePclhdl32.exePdldnomh.exeAcekjjmk.exeAidphq32.exeBccjdnbi.exeBfccei32.exeBbmapj32.exeCemjae32.exeCdgpnqpo.exeCkahkk32.exeDanmmd32.exeDlgnmb32.exeDcccpl32.exeDpgcip32.exeDchmkkkj.exeEkcaonhe.exeEpecbd32.exeEniclh32.exeEnkpahon.exeFjdnlhco.exeFoafdoag.exepid process 2020 601c5d5a6a4c2ede577d060e88c6fd997584d6372f17fd8fd6cc7fd7e1b2f91c.exe 2020 601c5d5a6a4c2ede577d060e88c6fd997584d6372f17fd8fd6cc7fd7e1b2f91c.exe 2760 Lfjcfb32.exe 2760 Lfjcfb32.exe 2568 Lnhdqdnd.exe 2568 Lnhdqdnd.exe 2152 Mfjoeeeh.exe 2152 Mfjoeeeh.exe 2512 Mikhgqbi.exe 2512 Mikhgqbi.exe 2428 Nlpkdkkd.exe 2428 Nlpkdkkd.exe 2736 Nkegeg32.exe 2736 Nkegeg32.exe 572 Omkjbb32.exe 572 Omkjbb32.exe 1128 Okojkf32.exe 1128 Okojkf32.exe 1608 Oemegc32.exe 1608 Oemegc32.exe 1276 Pafbadcm.exe 1276 Pafbadcm.exe 1812 Pclhdl32.exe 1812 Pclhdl32.exe 2116 Pdldnomh.exe 2116 Pdldnomh.exe 2364 Acekjjmk.exe 2364 Acekjjmk.exe 1316 Aidphq32.exe 1316 Aidphq32.exe 2464 Bccjdnbi.exe 2464 Bccjdnbi.exe 2164 Bfccei32.exe 2164 Bfccei32.exe 1712 Bbmapj32.exe 1712 Bbmapj32.exe 2172 Cemjae32.exe 2172 Cemjae32.exe 1384 Cdgpnqpo.exe 1384 Cdgpnqpo.exe 772 Ckahkk32.exe 772 Ckahkk32.exe 1500 Danmmd32.exe 1500 Danmmd32.exe 1800 Dlgnmb32.exe 1800 Dlgnmb32.exe 712 Dcccpl32.exe 712 Dcccpl32.exe 2872 Dpgcip32.exe 2872 Dpgcip32.exe 2260 Dchmkkkj.exe 2260 Dchmkkkj.exe 876 Ekcaonhe.exe 876 Ekcaonhe.exe 2748 Epecbd32.exe 2748 Epecbd32.exe 2856 Eniclh32.exe 2856 Eniclh32.exe 2916 Enkpahon.exe 2916 Enkpahon.exe 2728 Fjdnlhco.exe 2728 Fjdnlhco.exe 1284 Foafdoag.exe 1284 Foafdoag.exe -
Drops file in System32 directory 64 IoCs
Processes:
Nobpmb32.exeKhglkqfj.exeDlkqpg32.exeHkmollme.exeIfbaapfk.exeLmeebpkd.exeAlbjnplq.exeGqaafn32.exeMdmkoepk.exeClfhml32.exeLgmeid32.exeOhfqmi32.exeAodkci32.exeCgfkmgnj.exeEhjqif32.exeJenpajfb.exeIihiphln.exeMcfemmna.exeCjdkllec.exeAcjdgf32.exePnfkheap.exeEmkfmioh.exeCkahkk32.exeHkdgecna.exeEkfaij32.exeGngfjicn.exeGkglnm32.exeMmdkfmjc.exeOgekbchg.exeLfilnh32.exeHpnlndkp.exeQamjmh32.exeDobgihgp.exeJmfafgbd.exeKambcbhb.exeFelcbk32.exeMbnljqic.exeLlbqfe32.exeKgkonj32.exeBlkjkflb.exeLhfpdi32.exeManjaldo.exeQlbnja32.exeGgcaiqhj.exeCpfdhl32.exeDfbqgldn.exeGekkpqnp.exeJhoice32.exeCehhdkjf.exeQldjdlgb.exeJfieigio.exeKdnkdmec.exeOpjkpo32.exeObecld32.exeDlgnmb32.exeIpjahd32.exeBigkel32.exeFnibcd32.exeHdbbnd32.exeDjmknb32.exeMchokq32.exeCobjmq32.exeAonjpp32.exeKllnhg32.exedescription ioc process File created C:\Windows\SysWOW64\Olgpff32.exe Nobpmb32.exe File opened for modification C:\Windows\SysWOW64\Kbppdfmk.exe Khglkqfj.exe File opened for modification C:\Windows\SysWOW64\Eeceim32.exe Dlkqpg32.exe File opened for modification C:\Windows\SysWOW64\Hokhbj32.exe Hkmollme.exe File created C:\Windows\SysWOW64\Iokfjf32.exe Ifbaapfk.exe File created C:\Windows\SysWOW64\Lilfgq32.exe Lmeebpkd.exe File created C:\Windows\SysWOW64\Aldfcpjn.exe Albjnplq.exe File created C:\Windows\SysWOW64\Gqcnln32.exe Gqaafn32.exe File opened for modification C:\Windows\SysWOW64\Mdogedmh.exe Mdmkoepk.exe File created C:\Windows\SysWOW64\Ggqbii32.dll Clfhml32.exe File opened for modification C:\Windows\SysWOW64\Mchoid32.exe Lgmeid32.exe File opened for modification C:\Windows\SysWOW64\Omcifpnp.exe Ohfqmi32.exe File created C:\Windows\SysWOW64\Bimoloog.exe Aodkci32.exe File opened for modification C:\Windows\SysWOW64\Danpemej.exe Cgfkmgnj.exe File created C:\Windows\SysWOW64\Okdpmh32.dll Ehjqif32.exe File opened for modification C:\Windows\SysWOW64\Jaeafklf.exe Jenpajfb.exe File created C:\Windows\SysWOW64\Nbdmji32.dll Iihiphln.exe File created C:\Windows\SysWOW64\Momfan32.exe Mcfemmna.exe File opened for modification C:\Windows\SysWOW64\Cmbghgdg.exe Cjdkllec.exe File created C:\Windows\SysWOW64\Odpbmoop.dll Acjdgf32.exe File created C:\Windows\SysWOW64\Chmpbiao.dll Pnfkheap.exe File created C:\Windows\SysWOW64\Edenjc32.exe Emkfmioh.exe File opened for modification C:\Windows\SysWOW64\Danmmd32.exe Ckahkk32.exe File opened for modification C:\Windows\SysWOW64\Icplje32.exe Hkdgecna.exe File created C:\Windows\SysWOW64\Fljkodkb.dll Ekfaij32.exe File created C:\Windows\SysWOW64\Glkgcmbg.exe Gngfjicn.exe File opened for modification C:\Windows\SysWOW64\Gqdefddb.exe Gkglnm32.exe File created C:\Windows\SysWOW64\Mgmoob32.exe Mmdkfmjc.exe File opened for modification C:\Windows\SysWOW64\Oggghc32.exe Ogekbchg.exe File created C:\Windows\SysWOW64\Lgmekpmn.exe Lfilnh32.exe File created C:\Windows\SysWOW64\Ijfqfj32.exe Hpnlndkp.exe File created C:\Windows\SysWOW64\Qlbnja32.exe Qamjmh32.exe File created C:\Windows\SysWOW64\Hlmdnf32.dll Dobgihgp.exe File created C:\Windows\SysWOW64\Hlmgamof.dll Jmfafgbd.exe File opened for modification C:\Windows\SysWOW64\Kjeglh32.exe Kambcbhb.exe File created C:\Windows\SysWOW64\Fenphjei.exe Felcbk32.exe File opened for modification C:\Windows\SysWOW64\Mlfacfpc.exe Mbnljqic.exe File created C:\Windows\SysWOW64\Lhiakf32.exe Llbqfe32.exe File created C:\Windows\SysWOW64\Kbbobkol.exe Kgkonj32.exe File opened for modification C:\Windows\SysWOW64\Bkpglbaj.exe Blkjkflb.exe File created C:\Windows\SysWOW64\Ibmkap32.dll Lhfpdi32.exe File created C:\Windows\SysWOW64\Neikpfdc.dll Manjaldo.exe File opened for modification C:\Windows\SysWOW64\Aoakfl32.exe Qlbnja32.exe File created C:\Windows\SysWOW64\Ngfpmcbo.dll Ggcaiqhj.exe File created C:\Windows\SysWOW64\Jhpondph.dll Cpfdhl32.exe File created C:\Windows\SysWOW64\Pmapcghh.dll Dfbqgldn.exe File opened for modification C:\Windows\SysWOW64\Hmgodc32.exe Gekkpqnp.exe File created C:\Windows\SysWOW64\Jpjngh32.exe Jhoice32.exe File created C:\Windows\SysWOW64\Difqji32.exe Cehhdkjf.exe File created C:\Windows\SysWOW64\Qdpohodn.exe Qldjdlgb.exe File opened for modification C:\Windows\SysWOW64\Jbpfnh32.exe Jfieigio.exe File opened for modification C:\Windows\SysWOW64\Kenhopmf.exe Kdnkdmec.exe File opened for modification C:\Windows\SysWOW64\Ojpomh32.exe Opjkpo32.exe File created C:\Windows\SysWOW64\Ajcdki32.dll Obecld32.exe File opened for modification C:\Windows\SysWOW64\Dcccpl32.exe Dlgnmb32.exe File created C:\Windows\SysWOW64\Hkppcjdc.dll Ipjahd32.exe File created C:\Windows\SysWOW64\Aaddfb32.dll Bigkel32.exe File opened for modification C:\Windows\SysWOW64\Gcmamj32.exe Fnibcd32.exe File opened for modification C:\Windows\SysWOW64\Hafbghhj.exe Hdbbnd32.exe File created C:\Windows\SysWOW64\Elndpnnn.exe Djmknb32.exe File created C:\Windows\SysWOW64\Mnncii32.exe Mchokq32.exe File opened for modification C:\Windows\SysWOW64\Codgbqmc.exe Cobjmq32.exe File opened for modification C:\Windows\SysWOW64\Afhbljko.exe Aonjpp32.exe File created C:\Windows\SysWOW64\Kbigpn32.exe Kllnhg32.exe -
Program crash 1 IoCs
Processes:
pid pid_target process target process 5684 5656 -
Modifies registry class 64 IoCs
Processes:
Kdnkdmec.exeFjhdpk32.exeDpjfjalp.exeGnbelong.exeIdkpganf.exeOalhqohl.exeJlkglm32.exeKccgheib.exeKnpkhhhg.exeKbdmeoob.exeFjlmpfhg.exeOfcqcp32.exeFdkmeiei.exeMiaaki32.exePolobd32.exeHbhagiem.exeJaopcbga.exeGmpjagfa.exeDpcmgi32.exePdjljpnc.exeFhhbif32.exeApclnj32.exeGlfjgaih.exeEdmkei32.exeBfphmi32.exeKnmdeioh.exeCjhdgk32.exeImokehhl.exeHiclkp32.exeMopbgn32.exeKmficl32.exeNljhhi32.exeAofklbnj.exeFhqfie32.exeNmnclmoj.exeHfmddp32.exeCqaiph32.exeJcciqi32.exeEpfhde32.exeQldjdlgb.exeHahljg32.exeLnhdqdnd.exePdfdkehc.exeHgjieedg.exeEchlmh32.exeNpnclf32.exeFplknh32.exeFdjddf32.exeLolofd32.exeAiaqle32.exeBgdfjfmi.exeBiiiempl.exeQjeihl32.exeNmmlccfp.exeAdncoc32.exeBjanfl32.exeCmmcpi32.exeGkmefaan.exeKiecgo32.exeAdgein32.exeApkbnibq.exeCgbfcjag.exeHipmoc32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kdnkdmec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajgpacpe.dll" Fjhdpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dpjfjalp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gnbelong.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Idkpganf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oalhqohl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jlkglm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kccgheib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njbnon32.dll" Knpkhhhg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Homdlljo.dll" Kbdmeoob.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fjlmpfhg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ofcqcp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fdkmeiei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Miaaki32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Polobd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oqagbp32.dll" Hbhagiem.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jaopcbga.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gmpjagfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elnpioai.dll" Dpcmgi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdbcmcno.dll" Pdjljpnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fhhbif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmdkki32.dll" Apclnj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Glfjgaih.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Edmkei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpkihl32.dll" Bfphmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihnijmcj.dll" Knmdeioh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cjhdgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdgibphb.dll" Imokehhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Benmkbnn.dll" Hiclkp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acfenf32.dll" Mopbgn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kmficl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nljhhi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khilfg32.dll" Aofklbnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fhqfie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nmnclmoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hfmddp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djihcnji.dll" Cqaiph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jcciqi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pdjljpnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Epfhde32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qldjdlgb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opfeoj32.dll" Hahljg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lnhdqdnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pdfdkehc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hgjieedg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Echlmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Npnclf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egcaic32.dll" Fplknh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fdjddf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lolofd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpajjg32.dll" Aiaqle32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bgdfjfmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdokmeph.dll" Biiiempl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qjeihl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klbdig32.dll" Nmmlccfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idcfam32.dll" Adncoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jokjjgme.dll" Bjanfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pofhpf32.dll" Cmmcpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiqaih32.dll" Gkmefaan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pomebdea.dll" Kiecgo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Adgein32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Apkbnibq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cgbfcjag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hipmoc32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
601c5d5a6a4c2ede577d060e88c6fd997584d6372f17fd8fd6cc7fd7e1b2f91c.exeLfjcfb32.exeLnhdqdnd.exeMfjoeeeh.exeMikhgqbi.exeNlpkdkkd.exeNkegeg32.exeOmkjbb32.exeOkojkf32.exeOemegc32.exePafbadcm.exePclhdl32.exePdldnomh.exeAcekjjmk.exeAidphq32.exeBccjdnbi.exedescription pid process target process PID 2020 wrote to memory of 2760 2020 601c5d5a6a4c2ede577d060e88c6fd997584d6372f17fd8fd6cc7fd7e1b2f91c.exe Lfjcfb32.exe PID 2020 wrote to memory of 2760 2020 601c5d5a6a4c2ede577d060e88c6fd997584d6372f17fd8fd6cc7fd7e1b2f91c.exe Lfjcfb32.exe PID 2020 wrote to memory of 2760 2020 601c5d5a6a4c2ede577d060e88c6fd997584d6372f17fd8fd6cc7fd7e1b2f91c.exe Lfjcfb32.exe PID 2020 wrote to memory of 2760 2020 601c5d5a6a4c2ede577d060e88c6fd997584d6372f17fd8fd6cc7fd7e1b2f91c.exe Lfjcfb32.exe PID 2760 wrote to memory of 2568 2760 Lfjcfb32.exe Lnhdqdnd.exe PID 2760 wrote to memory of 2568 2760 Lfjcfb32.exe Lnhdqdnd.exe PID 2760 wrote to memory of 2568 2760 Lfjcfb32.exe Lnhdqdnd.exe PID 2760 wrote to memory of 2568 2760 Lfjcfb32.exe Lnhdqdnd.exe PID 2568 wrote to memory of 2152 2568 Lnhdqdnd.exe Mfjoeeeh.exe PID 2568 wrote to memory of 2152 2568 Lnhdqdnd.exe Mfjoeeeh.exe PID 2568 wrote to memory of 2152 2568 Lnhdqdnd.exe Mfjoeeeh.exe PID 2568 wrote to memory of 2152 2568 Lnhdqdnd.exe Mfjoeeeh.exe PID 2152 wrote to memory of 2512 2152 Mfjoeeeh.exe Mikhgqbi.exe PID 2152 wrote to memory of 2512 2152 Mfjoeeeh.exe Mikhgqbi.exe PID 2152 wrote to memory of 2512 2152 Mfjoeeeh.exe Mikhgqbi.exe PID 2152 wrote to memory of 2512 2152 Mfjoeeeh.exe Mikhgqbi.exe PID 2512 wrote to memory of 2428 2512 Mikhgqbi.exe Nlpkdkkd.exe PID 2512 wrote to memory of 2428 2512 Mikhgqbi.exe Nlpkdkkd.exe PID 2512 wrote to memory of 2428 2512 Mikhgqbi.exe Nlpkdkkd.exe PID 2512 wrote to memory of 2428 2512 Mikhgqbi.exe Nlpkdkkd.exe PID 2428 wrote to memory of 2736 2428 Nlpkdkkd.exe Nkegeg32.exe PID 2428 wrote to memory of 2736 2428 Nlpkdkkd.exe Nkegeg32.exe PID 2428 wrote to memory of 2736 2428 Nlpkdkkd.exe Nkegeg32.exe PID 2428 wrote to memory of 2736 2428 Nlpkdkkd.exe Nkegeg32.exe PID 2736 wrote to memory of 572 2736 Nkegeg32.exe Omkjbb32.exe PID 2736 wrote to memory of 572 2736 Nkegeg32.exe Omkjbb32.exe PID 2736 wrote to memory of 572 2736 Nkegeg32.exe Omkjbb32.exe PID 2736 wrote to memory of 572 2736 Nkegeg32.exe Omkjbb32.exe PID 572 wrote to memory of 1128 572 Omkjbb32.exe Okojkf32.exe PID 572 wrote to memory of 1128 572 Omkjbb32.exe Okojkf32.exe PID 572 wrote to memory of 1128 572 Omkjbb32.exe Okojkf32.exe PID 572 wrote to memory of 1128 572 Omkjbb32.exe Okojkf32.exe PID 1128 wrote to memory of 1608 1128 Okojkf32.exe Oemegc32.exe PID 1128 wrote to memory of 1608 1128 Okojkf32.exe Oemegc32.exe PID 1128 wrote to memory of 1608 1128 Okojkf32.exe Oemegc32.exe PID 1128 wrote to memory of 1608 1128 Okojkf32.exe Oemegc32.exe PID 1608 wrote to memory of 1276 1608 Oemegc32.exe Pafbadcm.exe PID 1608 wrote to memory of 1276 1608 Oemegc32.exe Pafbadcm.exe PID 1608 wrote to memory of 1276 1608 Oemegc32.exe Pafbadcm.exe PID 1608 wrote to memory of 1276 1608 Oemegc32.exe Pafbadcm.exe PID 1276 wrote to memory of 1812 1276 Pafbadcm.exe Pclhdl32.exe PID 1276 wrote to memory of 1812 1276 Pafbadcm.exe Pclhdl32.exe PID 1276 wrote to memory of 1812 1276 Pafbadcm.exe Pclhdl32.exe PID 1276 wrote to memory of 1812 1276 Pafbadcm.exe Pclhdl32.exe PID 1812 wrote to memory of 2116 1812 Pclhdl32.exe Pdldnomh.exe PID 1812 wrote to memory of 2116 1812 Pclhdl32.exe Pdldnomh.exe PID 1812 wrote to memory of 2116 1812 Pclhdl32.exe Pdldnomh.exe PID 1812 wrote to memory of 2116 1812 Pclhdl32.exe Pdldnomh.exe PID 2116 wrote to memory of 2364 2116 Pdldnomh.exe Acekjjmk.exe PID 2116 wrote to memory of 2364 2116 Pdldnomh.exe Acekjjmk.exe PID 2116 wrote to memory of 2364 2116 Pdldnomh.exe Acekjjmk.exe PID 2116 wrote to memory of 2364 2116 Pdldnomh.exe Acekjjmk.exe PID 2364 wrote to memory of 1316 2364 Acekjjmk.exe Aidphq32.exe PID 2364 wrote to memory of 1316 2364 Acekjjmk.exe Aidphq32.exe PID 2364 wrote to memory of 1316 2364 Acekjjmk.exe Aidphq32.exe PID 2364 wrote to memory of 1316 2364 Acekjjmk.exe Aidphq32.exe PID 1316 wrote to memory of 2464 1316 Aidphq32.exe Bccjdnbi.exe PID 1316 wrote to memory of 2464 1316 Aidphq32.exe Bccjdnbi.exe PID 1316 wrote to memory of 2464 1316 Aidphq32.exe Bccjdnbi.exe PID 1316 wrote to memory of 2464 1316 Aidphq32.exe Bccjdnbi.exe PID 2464 wrote to memory of 2164 2464 Bccjdnbi.exe Bfccei32.exe PID 2464 wrote to memory of 2164 2464 Bccjdnbi.exe Bfccei32.exe PID 2464 wrote to memory of 2164 2464 Bccjdnbi.exe Bfccei32.exe PID 2464 wrote to memory of 2164 2464 Bccjdnbi.exe Bfccei32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\601c5d5a6a4c2ede577d060e88c6fd997584d6372f17fd8fd6cc7fd7e1b2f91c.exe"C:\Users\Admin\AppData\Local\Temp\601c5d5a6a4c2ede577d060e88c6fd997584d6372f17fd8fd6cc7fd7e1b2f91c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\Lfjcfb32.exeC:\Windows\system32\Lfjcfb32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\Lnhdqdnd.exeC:\Windows\system32\Lnhdqdnd.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\Mfjoeeeh.exeC:\Windows\system32\Mfjoeeeh.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\Mikhgqbi.exeC:\Windows\system32\Mikhgqbi.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\Nlpkdkkd.exeC:\Windows\system32\Nlpkdkkd.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\Nkegeg32.exeC:\Windows\system32\Nkegeg32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\Omkjbb32.exeC:\Windows\system32\Omkjbb32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\Okojkf32.exeC:\Windows\system32\Okojkf32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\Oemegc32.exeC:\Windows\system32\Oemegc32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\Pafbadcm.exeC:\Windows\system32\Pafbadcm.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\Pclhdl32.exeC:\Windows\system32\Pclhdl32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\Pdldnomh.exeC:\Windows\system32\Pdldnomh.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\Acekjjmk.exeC:\Windows\system32\Acekjjmk.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\Aidphq32.exeC:\Windows\system32\Aidphq32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\Bccjdnbi.exeC:\Windows\system32\Bccjdnbi.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\Bfccei32.exeC:\Windows\system32\Bfccei32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Windows\SysWOW64\Bbmapj32.exeC:\Windows\system32\Bbmapj32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Windows\SysWOW64\Cemjae32.exeC:\Windows\system32\Cemjae32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Windows\SysWOW64\Cdgpnqpo.exeC:\Windows\system32\Cdgpnqpo.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1384 -
C:\Windows\SysWOW64\Ckahkk32.exeC:\Windows\system32\Ckahkk32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:772 -
C:\Windows\SysWOW64\Danmmd32.exeC:\Windows\system32\Danmmd32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Windows\SysWOW64\Dlgnmb32.exeC:\Windows\system32\Dlgnmb32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1800 -
C:\Windows\SysWOW64\Dcccpl32.exeC:\Windows\system32\Dcccpl32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:712 -
C:\Windows\SysWOW64\Dpgcip32.exeC:\Windows\system32\Dpgcip32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Windows\SysWOW64\Dchmkkkj.exeC:\Windows\system32\Dchmkkkj.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Windows\SysWOW64\Ekcaonhe.exeC:\Windows\system32\Ekcaonhe.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Windows\SysWOW64\Eoajel32.exeC:\Windows\system32\Eoajel32.exe28⤵
- Executes dropped EXE
PID:1736 -
C:\Windows\SysWOW64\Epecbd32.exeC:\Windows\system32\Epecbd32.exe29⤵
- Loads dropped DLL
PID:2748 -
C:\Windows\SysWOW64\Eniclh32.exeC:\Windows\system32\Eniclh32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Windows\SysWOW64\Enkpahon.exeC:\Windows\system32\Enkpahon.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Windows\SysWOW64\Fjdnlhco.exeC:\Windows\system32\Fjdnlhco.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Windows\SysWOW64\Foafdoag.exeC:\Windows\system32\Foafdoag.exe33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Windows\SysWOW64\Fhikme32.exeC:\Windows\system32\Fhikme32.exe34⤵
- Executes dropped EXE
PID:2732 -
C:\Windows\SysWOW64\Fbbofjnh.exeC:\Windows\system32\Fbbofjnh.exe35⤵
- Executes dropped EXE
PID:2844 -
C:\Windows\SysWOW64\Fgadda32.exeC:\Windows\system32\Fgadda32.exe36⤵
- Executes dropped EXE
PID:1004 -
C:\Windows\SysWOW64\Ggcaiqhj.exeC:\Windows\system32\Ggcaiqhj.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:532 -
C:\Windows\SysWOW64\Gmpjagfa.exeC:\Windows\system32\Gmpjagfa.exe38⤵
- Executes dropped EXE
- Modifies registry class
PID:1388 -
C:\Windows\SysWOW64\Gaqomeke.exeC:\Windows\system32\Gaqomeke.exe39⤵
- Executes dropped EXE
PID:2492 -
C:\Windows\SysWOW64\Gpelnb32.exeC:\Windows\system32\Gpelnb32.exe40⤵
- Executes dropped EXE
PID:2372 -
C:\Windows\SysWOW64\Hmjlhfof.exeC:\Windows\system32\Hmjlhfof.exe41⤵
- Executes dropped EXE
PID:2344 -
C:\Windows\SysWOW64\Hipmmg32.exeC:\Windows\system32\Hipmmg32.exe42⤵
- Executes dropped EXE
PID:1848 -
C:\Windows\SysWOW64\Hnpbjnpo.exeC:\Windows\system32\Hnpbjnpo.exe43⤵
- Executes dropped EXE
PID:2008 -
C:\Windows\SysWOW64\Heikgh32.exeC:\Windows\system32\Heikgh32.exe44⤵
- Executes dropped EXE
PID:2832 -
C:\Windows\SysWOW64\Hapklimq.exeC:\Windows\system32\Hapklimq.exe45⤵
- Executes dropped EXE
PID:2288 -
C:\Windows\SysWOW64\Hfmddp32.exeC:\Windows\system32\Hfmddp32.exe46⤵
- Executes dropped EXE
- Modifies registry class
PID:3024 -
C:\Windows\SysWOW64\Idadnd32.exeC:\Windows\system32\Idadnd32.exe47⤵
- Executes dropped EXE
PID:2036 -
C:\Windows\SysWOW64\Idcacc32.exeC:\Windows\system32\Idcacc32.exe48⤵
- Executes dropped EXE
PID:944 -
C:\Windows\SysWOW64\Ipjahd32.exeC:\Windows\system32\Ipjahd32.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1032 -
C:\Windows\SysWOW64\Iibfajdc.exeC:\Windows\system32\Iibfajdc.exe50⤵
- Executes dropped EXE
PID:1916 -
C:\Windows\SysWOW64\Ifffkncm.exeC:\Windows\system32\Ifffkncm.exe51⤵
- Executes dropped EXE
PID:2348 -
C:\Windows\SysWOW64\Ilcoce32.exeC:\Windows\system32\Ilcoce32.exe52⤵
- Executes dropped EXE
PID:2276 -
C:\Windows\SysWOW64\Ielclkhe.exeC:\Windows\system32\Ielclkhe.exe53⤵
- Executes dropped EXE
PID:1148 -
C:\Windows\SysWOW64\Jenpajfb.exeC:\Windows\system32\Jenpajfb.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2764 -
C:\Windows\SysWOW64\Jaeafklf.exeC:\Windows\system32\Jaeafklf.exe55⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\Jhoice32.exeC:\Windows\system32\Jhoice32.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2992 -
C:\Windows\SysWOW64\Jpjngh32.exeC:\Windows\system32\Jpjngh32.exe57⤵
- Executes dropped EXE
PID:2688 -
C:\Windows\SysWOW64\Jkpbdq32.exeC:\Windows\system32\Jkpbdq32.exe58⤵
- Executes dropped EXE
PID:2060 -
C:\Windows\SysWOW64\Jckgicnp.exeC:\Windows\system32\Jckgicnp.exe59⤵
- Executes dropped EXE
PID:2560 -
C:\Windows\SysWOW64\Jjdofm32.exeC:\Windows\system32\Jjdofm32.exe60⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\SysWOW64\Kcmcoblm.exeC:\Windows\system32\Kcmcoblm.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:800 -
C:\Windows\SysWOW64\Klehgh32.exeC:\Windows\system32\Klehgh32.exe62⤵
- Executes dropped EXE
PID:1544 -
C:\Windows\SysWOW64\Kjihalag.exeC:\Windows\system32\Kjihalag.exe63⤵
- Executes dropped EXE
PID:2264 -
C:\Windows\SysWOW64\Klhemhpk.exeC:\Windows\system32\Klhemhpk.exe64⤵
- Executes dropped EXE
PID:1820 -
C:\Windows\SysWOW64\Kbdmeoob.exeC:\Windows\system32\Kbdmeoob.exe65⤵
- Executes dropped EXE
- Modifies registry class
PID:1268 -
C:\Windows\SysWOW64\Khoebi32.exeC:\Windows\system32\Khoebi32.exe66⤵
- Executes dropped EXE
PID:1040 -
C:\Windows\SysWOW64\Kbgjkn32.exeC:\Windows\system32\Kbgjkn32.exe67⤵PID:608
-
C:\Windows\SysWOW64\Kllnhg32.exeC:\Windows\system32\Kllnhg32.exe68⤵
- Drops file in System32 directory
PID:2800 -
C:\Windows\SysWOW64\Kbigpn32.exeC:\Windows\system32\Kbigpn32.exe69⤵PID:528
-
C:\Windows\SysWOW64\Lgmeid32.exeC:\Windows\system32\Lgmeid32.exe70⤵
- Drops file in System32 directory
PID:1696 -
C:\Windows\SysWOW64\Mchoid32.exeC:\Windows\system32\Mchoid32.exe71⤵PID:1772
-
C:\Windows\SysWOW64\Mejlalji.exeC:\Windows\system32\Mejlalji.exe72⤵PID:948
-
C:\Windows\SysWOW64\Mbnljqic.exeC:\Windows\system32\Mbnljqic.exe73⤵
- Drops file in System32 directory
PID:2056 -
C:\Windows\SysWOW64\Mlfacfpc.exeC:\Windows\system32\Mlfacfpc.exe74⤵PID:2296
-
C:\Windows\SysWOW64\Mgmahg32.exeC:\Windows\system32\Mgmahg32.exe75⤵PID:1760
-
C:\Windows\SysWOW64\Mbbfep32.exeC:\Windows\system32\Mbbfep32.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2696 -
C:\Windows\SysWOW64\Mlkjne32.exeC:\Windows\system32\Mlkjne32.exe77⤵PID:2524
-
C:\Windows\SysWOW64\Nmnclmoj.exeC:\Windows\system32\Nmnclmoj.exe78⤵
- Modifies registry class
PID:2432 -
C:\Windows\SysWOW64\Njbdea32.exeC:\Windows\system32\Njbdea32.exe79⤵PID:2436
-
C:\Windows\SysWOW64\Npolmh32.exeC:\Windows\system32\Npolmh32.exe80⤵PID:2352
-
C:\Windows\SysWOW64\Nbpeoc32.exeC:\Windows\system32\Nbpeoc32.exe81⤵PID:588
-
C:\Windows\SysWOW64\Npdfhhhe.exeC:\Windows\system32\Npdfhhhe.exe82⤵PID:2648
-
C:\Windows\SysWOW64\Nfnneb32.exeC:\Windows\system32\Nfnneb32.exe83⤵PID:2640
-
C:\Windows\SysWOW64\Olkfmi32.exeC:\Windows\system32\Olkfmi32.exe84⤵PID:2104
-
C:\Windows\SysWOW64\Oagoep32.exeC:\Windows\system32\Oagoep32.exe85⤵PID:1104
-
C:\Windows\SysWOW64\Obgkpb32.exeC:\Windows\system32\Obgkpb32.exe86⤵PID:2520
-
C:\Windows\SysWOW64\Oalhqohl.exeC:\Windows\system32\Oalhqohl.exe87⤵
- Modifies registry class
PID:2952 -
C:\Windows\SysWOW64\Ohfqmi32.exeC:\Windows\system32\Ohfqmi32.exe88⤵
- Drops file in System32 directory
PID:2072 -
C:\Windows\SysWOW64\Omcifpnp.exeC:\Windows\system32\Omcifpnp.exe89⤵PID:2400
-
C:\Windows\SysWOW64\Odmabj32.exeC:\Windows\system32\Odmabj32.exe90⤵PID:1304
-
C:\Windows\SysWOW64\Omefkplm.exeC:\Windows\system32\Omefkplm.exe91⤵PID:1648
-
C:\Windows\SysWOW64\Pmgbao32.exeC:\Windows\system32\Pmgbao32.exe92⤵PID:2128
-
C:\Windows\SysWOW64\Pcdkif32.exeC:\Windows\system32\Pcdkif32.exe93⤵PID:2908
-
C:\Windows\SysWOW64\Poklngnf.exeC:\Windows\system32\Poklngnf.exe94⤵PID:2244
-
C:\Windows\SysWOW64\Plolgk32.exeC:\Windows\system32\Plolgk32.exe95⤵PID:2676
-
C:\Windows\SysWOW64\Pegqpacp.exeC:\Windows\system32\Pegqpacp.exe96⤵PID:2700
-
C:\Windows\SysWOW64\Pckajebj.exeC:\Windows\system32\Pckajebj.exe97⤵PID:2848
-
C:\Windows\SysWOW64\Qnebjc32.exeC:\Windows\system32\Qnebjc32.exe98⤵PID:1732
-
C:\Windows\SysWOW64\Qhjfgl32.exeC:\Windows\system32\Qhjfgl32.exe99⤵PID:932
-
C:\Windows\SysWOW64\Qkibcg32.exeC:\Windows\system32\Qkibcg32.exe100⤵PID:1036
-
C:\Windows\SysWOW64\Agpcihcf.exeC:\Windows\system32\Agpcihcf.exe101⤵PID:840
-
C:\Windows\SysWOW64\Adcdbl32.exeC:\Windows\system32\Adcdbl32.exe102⤵PID:2356
-
C:\Windows\SysWOW64\Aqjdgmgd.exeC:\Windows\system32\Aqjdgmgd.exe103⤵PID:2980
-
C:\Windows\SysWOW64\Ajcipc32.exeC:\Windows\system32\Ajcipc32.exe104⤵PID:1156
-
C:\Windows\SysWOW64\Afjjed32.exeC:\Windows\system32\Afjjed32.exe105⤵PID:1376
-
C:\Windows\SysWOW64\Aqonbm32.exeC:\Windows\system32\Aqonbm32.exe106⤵PID:616
-
C:\Windows\SysWOW64\Ajgbkbjp.exeC:\Windows\system32\Ajgbkbjp.exe107⤵PID:2108
-
C:\Windows\SysWOW64\Aodkci32.exeC:\Windows\system32\Aodkci32.exe108⤵
- Drops file in System32 directory
PID:2312 -
C:\Windows\SysWOW64\Bimoloog.exeC:\Windows\system32\Bimoloog.exe109⤵PID:2528
-
C:\Windows\SysWOW64\Bajqfq32.exeC:\Windows\system32\Bajqfq32.exe110⤵PID:2452
-
C:\Windows\SysWOW64\Bnnaoe32.exeC:\Windows\system32\Bnnaoe32.exe111⤵PID:2480
-
C:\Windows\SysWOW64\Bkbaii32.exeC:\Windows\system32\Bkbaii32.exe112⤵PID:680
-
C:\Windows\SysWOW64\Bflbigdb.exeC:\Windows\system32\Bflbigdb.exe113⤵PID:2656
-
C:\Windows\SysWOW64\Cgkocj32.exeC:\Windows\system32\Cgkocj32.exe114⤵PID:2384
-
C:\Windows\SysWOW64\Cpfdhl32.exeC:\Windows\system32\Cpfdhl32.exe115⤵
- Drops file in System32 directory
PID:2660 -
C:\Windows\SysWOW64\Cjlheehe.exeC:\Windows\system32\Cjlheehe.exe116⤵PID:2988
-
C:\Windows\SysWOW64\Ccdmnj32.exeC:\Windows\system32\Ccdmnj32.exe117⤵PID:752
-
C:\Windows\SysWOW64\Clpabm32.exeC:\Windows\system32\Clpabm32.exe118⤵PID:620
-
C:\Windows\SysWOW64\Chfbgn32.exeC:\Windows\system32\Chfbgn32.exe119⤵PID:1332
-
C:\Windows\SysWOW64\Dobgihgp.exeC:\Windows\system32\Dobgihgp.exe120⤵
- Drops file in System32 directory
PID:1664 -
C:\Windows\SysWOW64\Dhkkbmnp.exeC:\Windows\system32\Dhkkbmnp.exe121⤵PID:2256
-
C:\Windows\SysWOW64\Deollamj.exeC:\Windows\system32\Deollamj.exe122⤵PID:2880
-
C:\Windows\SysWOW64\Dmjqpdje.exeC:\Windows\system32\Dmjqpdje.exe123⤵PID:112
-
C:\Windows\SysWOW64\Dknajh32.exeC:\Windows\system32\Dknajh32.exe124⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1400 -
C:\Windows\SysWOW64\Dahifbpk.exeC:\Windows\system32\Dahifbpk.exe125⤵PID:2704
-
C:\Windows\SysWOW64\Dgeaoinb.exeC:\Windows\system32\Dgeaoinb.exe126⤵PID:1684
-
C:\Windows\SysWOW64\Fgdnnl32.exeC:\Windows\system32\Fgdnnl32.exe127⤵PID:920
-
C:\Windows\SysWOW64\Fnofjfhk.exeC:\Windows\system32\Fnofjfhk.exe128⤵PID:2132
-
C:\Windows\SysWOW64\Fjegog32.exeC:\Windows\system32\Fjegog32.exe129⤵PID:2960
-
C:\Windows\SysWOW64\Fcnkhmdp.exeC:\Windows\system32\Fcnkhmdp.exe130⤵PID:936
-
C:\Windows\SysWOW64\Fncpef32.exeC:\Windows\system32\Fncpef32.exe131⤵PID:2232
-
C:\Windows\SysWOW64\Fcphnm32.exeC:\Windows\system32\Fcphnm32.exe132⤵PID:1324
-
C:\Windows\SysWOW64\Fogibnha.exeC:\Windows\system32\Fogibnha.exe133⤵PID:1940
-
C:\Windows\SysWOW64\Fjlmpfhg.exeC:\Windows\system32\Fjlmpfhg.exe134⤵
- Modifies registry class
PID:2668 -
C:\Windows\SysWOW64\Gjojef32.exeC:\Windows\system32\Gjojef32.exe135⤵PID:2556
-
C:\Windows\SysWOW64\Gfejjgli.exeC:\Windows\system32\Gfejjgli.exe136⤵PID:1796
-
C:\Windows\SysWOW64\Gonocmbi.exeC:\Windows\system32\Gonocmbi.exe137⤵PID:2624
-
C:\Windows\SysWOW64\Gbohehoj.exeC:\Windows\system32\Gbohehoj.exe138⤵PID:2068
-
C:\Windows\SysWOW64\Gkglnm32.exeC:\Windows\system32\Gkglnm32.exe139⤵
- Drops file in System32 directory
PID:1792 -
C:\Windows\SysWOW64\Gqdefddb.exeC:\Windows\system32\Gqdefddb.exe140⤵PID:3028
-
C:\Windows\SysWOW64\Hmkeke32.exeC:\Windows\system32\Hmkeke32.exe141⤵PID:1656
-
C:\Windows\SysWOW64\Hnjbeh32.exeC:\Windows\system32\Hnjbeh32.exe142⤵PID:1700
-
C:\Windows\SysWOW64\Hgbfnngi.exeC:\Windows\system32\Hgbfnngi.exe143⤵PID:1592
-
C:\Windows\SysWOW64\Hmoofdea.exeC:\Windows\system32\Hmoofdea.exe144⤵PID:2716
-
C:\Windows\SysWOW64\Hjcppidk.exeC:\Windows\system32\Hjcppidk.exe145⤵PID:2440
-
C:\Windows\SysWOW64\Hpphhp32.exeC:\Windows\system32\Hpphhp32.exe146⤵PID:2408
-
C:\Windows\SysWOW64\Hmdhad32.exeC:\Windows\system32\Hmdhad32.exe147⤵PID:1808
-
C:\Windows\SysWOW64\Ihniaa32.exeC:\Windows\system32\Ihniaa32.exe148⤵PID:2220
-
C:\Windows\SysWOW64\Ihpfgalh.exeC:\Windows\system32\Ihpfgalh.exe149⤵PID:780
-
C:\Windows\SysWOW64\Iedfqeka.exeC:\Windows\system32\Iedfqeka.exe150⤵PID:1344
-
C:\Windows\SysWOW64\Ijqoilii.exeC:\Windows\system32\Ijqoilii.exe151⤵PID:2240
-
C:\Windows\SysWOW64\Imokehhl.exeC:\Windows\system32\Imokehhl.exe152⤵
- Modifies registry class
PID:2272 -
C:\Windows\SysWOW64\Imahkg32.exeC:\Windows\system32\Imahkg32.exe153⤵PID:2984
-
C:\Windows\SysWOW64\Idkpganf.exeC:\Windows\system32\Idkpganf.exe154⤵
- Modifies registry class
PID:2476 -
C:\Windows\SysWOW64\Iihiphln.exeC:\Windows\system32\Iihiphln.exe155⤵
- Drops file in System32 directory
PID:1992 -
C:\Windows\SysWOW64\Jmfafgbd.exeC:\Windows\system32\Jmfafgbd.exe156⤵
- Drops file in System32 directory
PID:924 -
C:\Windows\SysWOW64\Jfofol32.exeC:\Windows\system32\Jfofol32.exe157⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1640 -
C:\Windows\SysWOW64\Jlkngc32.exeC:\Windows\system32\Jlkngc32.exe158⤵PID:2804
-
C:\Windows\SysWOW64\Jioopgef.exeC:\Windows\system32\Jioopgef.exe159⤵PID:400
-
C:\Windows\SysWOW64\Jajcdjca.exeC:\Windows\system32\Jajcdjca.exe160⤵PID:1164
-
C:\Windows\SysWOW64\Jlphbbbg.exeC:\Windows\system32\Jlphbbbg.exe161⤵PID:2504
-
C:\Windows\SysWOW64\Khghgchk.exeC:\Windows\system32\Khghgchk.exe162⤵PID:2516
-
C:\Windows\SysWOW64\Kdnild32.exeC:\Windows\system32\Kdnild32.exe163⤵PID:1552
-
C:\Windows\SysWOW64\Kocmim32.exeC:\Windows\system32\Kocmim32.exe164⤵PID:2472
-
C:\Windows\SysWOW64\Kpdjaecc.exeC:\Windows\system32\Kpdjaecc.exe165⤵PID:372
-
C:\Windows\SysWOW64\Kjmnjkjd.exeC:\Windows\system32\Kjmnjkjd.exe166⤵PID:1620
-
C:\Windows\SysWOW64\Kklkcn32.exeC:\Windows\system32\Kklkcn32.exe167⤵PID:1688
-
C:\Windows\SysWOW64\Klngkfge.exeC:\Windows\system32\Klngkfge.exe168⤵PID:1964
-
C:\Windows\SysWOW64\Knmdeioh.exeC:\Windows\system32\Knmdeioh.exe169⤵
- Modifies registry class
PID:2864 -
C:\Windows\SysWOW64\Lgehno32.exeC:\Windows\system32\Lgehno32.exe170⤵PID:2788
-
C:\Windows\SysWOW64\Llbqfe32.exeC:\Windows\system32\Llbqfe32.exe171⤵
- Drops file in System32 directory
PID:1348 -
C:\Windows\SysWOW64\Lhiakf32.exeC:\Windows\system32\Lhiakf32.exe172⤵PID:1988
-
C:\Windows\SysWOW64\Lhnkffeo.exeC:\Windows\system32\Lhnkffeo.exe173⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2080 -
C:\Windows\SysWOW64\Mkndhabp.exeC:\Windows\system32\Mkndhabp.exe174⤵PID:1580
-
C:\Windows\SysWOW64\Mjcaimgg.exeC:\Windows\system32\Mjcaimgg.exe175⤵PID:2780
-
C:\Windows\SysWOW64\Mdiefffn.exeC:\Windows\system32\Mdiefffn.exe176⤵PID:2368
-
C:\Windows\SysWOW64\Mqpflg32.exeC:\Windows\system32\Mqpflg32.exe177⤵PID:2484
-
C:\Windows\SysWOW64\Mqbbagjo.exeC:\Windows\system32\Mqbbagjo.exe178⤵PID:3052
-
C:\Windows\SysWOW64\Mbcoio32.exeC:\Windows\system32\Mbcoio32.exe179⤵PID:2816
-
C:\Windows\SysWOW64\Mklcadfn.exeC:\Windows\system32\Mklcadfn.exe180⤵PID:2708
-
C:\Windows\SysWOW64\Nedhjj32.exeC:\Windows\system32\Nedhjj32.exe181⤵PID:2580
-
C:\Windows\SysWOW64\Nmkplgnq.exeC:\Windows\system32\Nmkplgnq.exe182⤵PID:2632
-
C:\Windows\SysWOW64\Odchbe32.exeC:\Windows\system32\Odchbe32.exe183⤵PID:2628
-
C:\Windows\SysWOW64\Omklkkpl.exeC:\Windows\system32\Omklkkpl.exe184⤵PID:1676
-
C:\Windows\SysWOW64\Ofcqcp32.exeC:\Windows\system32\Ofcqcp32.exe185⤵
- Modifies registry class
PID:2292 -
C:\Windows\SysWOW64\Objaha32.exeC:\Windows\system32\Objaha32.exe186⤵PID:2488
-
C:\Windows\SysWOW64\Opnbbe32.exeC:\Windows\system32\Opnbbe32.exe187⤵PID:1624
-
C:\Windows\SysWOW64\Oococb32.exeC:\Windows\system32\Oococb32.exe188⤵PID:2532
-
C:\Windows\SysWOW64\Phlclgfc.exeC:\Windows\system32\Phlclgfc.exe189⤵PID:2500
-
C:\Windows\SysWOW64\Pofkha32.exeC:\Windows\system32\Pofkha32.exe190⤵PID:2168
-
C:\Windows\SysWOW64\Pmkhjncg.exeC:\Windows\system32\Pmkhjncg.exe191⤵PID:1852
-
C:\Windows\SysWOW64\Pmmeon32.exeC:\Windows\system32\Pmmeon32.exe192⤵PID:2948
-
C:\Windows\SysWOW64\Pdjjag32.exeC:\Windows\system32\Pdjjag32.exe193⤵PID:1828
-
C:\Windows\SysWOW64\Qdlggg32.exeC:\Windows\system32\Qdlggg32.exe194⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1936 -
C:\Windows\SysWOW64\Qndkpmkm.exeC:\Windows\system32\Qndkpmkm.exe195⤵PID:1480
-
C:\Windows\SysWOW64\Qjklenpa.exeC:\Windows\system32\Qjklenpa.exe196⤵PID:1136
-
C:\Windows\SysWOW64\Ahpifj32.exeC:\Windows\system32\Ahpifj32.exe197⤵PID:2404
-
C:\Windows\SysWOW64\Aaimopli.exeC:\Windows\system32\Aaimopli.exe198⤵PID:644
-
C:\Windows\SysWOW64\Achjibcl.exeC:\Windows\system32\Achjibcl.exe199⤵PID:880
-
C:\Windows\SysWOW64\Aoojnc32.exeC:\Windows\system32\Aoojnc32.exe200⤵PID:2968
-
C:\Windows\SysWOW64\Agjobffl.exeC:\Windows\system32\Agjobffl.exe201⤵PID:1680
-
C:\Windows\SysWOW64\Aqbdkk32.exeC:\Windows\system32\Aqbdkk32.exe202⤵PID:2460
-
C:\Windows\SysWOW64\Bjkhdacm.exeC:\Windows\system32\Bjkhdacm.exe203⤵PID:3084
-
C:\Windows\SysWOW64\Bqgmfkhg.exeC:\Windows\system32\Bqgmfkhg.exe204⤵PID:3124
-
C:\Windows\SysWOW64\Bnknoogp.exeC:\Windows\system32\Bnknoogp.exe205⤵PID:3164
-
C:\Windows\SysWOW64\Bgcbhd32.exeC:\Windows\system32\Bgcbhd32.exe206⤵PID:3208
-
C:\Windows\SysWOW64\Boogmgkl.exeC:\Windows\system32\Boogmgkl.exe207⤵PID:3248
-
C:\Windows\SysWOW64\Bigkel32.exeC:\Windows\system32\Bigkel32.exe208⤵
- Drops file in System32 directory
PID:3288 -
C:\Windows\SysWOW64\Cenljmgq.exeC:\Windows\system32\Cenljmgq.exe209⤵PID:3328
-
C:\Windows\SysWOW64\Cepipm32.exeC:\Windows\system32\Cepipm32.exe210⤵PID:3368
-
C:\Windows\SysWOW64\Cinafkkd.exeC:\Windows\system32\Cinafkkd.exe211⤵PID:3408
-
C:\Windows\SysWOW64\Cchbgi32.exeC:\Windows\system32\Cchbgi32.exe212⤵PID:3496
-
C:\Windows\SysWOW64\Clojhf32.exeC:\Windows\system32\Clojhf32.exe213⤵PID:3552
-
C:\Windows\SysWOW64\Cgfkmgnj.exeC:\Windows\system32\Cgfkmgnj.exe214⤵
- Drops file in System32 directory
PID:3616 -
C:\Windows\SysWOW64\Danpemej.exeC:\Windows\system32\Danpemej.exe215⤵PID:3664
-
C:\Windows\SysWOW64\Djfdob32.exeC:\Windows\system32\Djfdob32.exe216⤵PID:3728
-
C:\Windows\SysWOW64\Dpcmgi32.exeC:\Windows\system32\Dpcmgi32.exe217⤵
- Modifies registry class
PID:3768 -
C:\Windows\SysWOW64\Dmgmpnhl.exeC:\Windows\system32\Dmgmpnhl.exe218⤵PID:3812
-
C:\Windows\SysWOW64\Dpeiligo.exeC:\Windows\system32\Dpeiligo.exe219⤵PID:3852
-
C:\Windows\SysWOW64\Debadpeg.exeC:\Windows\system32\Debadpeg.exe220⤵PID:3892
-
C:\Windows\SysWOW64\Dokfme32.exeC:\Windows\system32\Dokfme32.exe221⤵PID:3936
-
C:\Windows\SysWOW64\Deenjpcd.exeC:\Windows\system32\Deenjpcd.exe222⤵PID:3976
-
C:\Windows\SysWOW64\Domccejd.exeC:\Windows\system32\Domccejd.exe223⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4016 -
C:\Windows\SysWOW64\Eopphehb.exeC:\Windows\system32\Eopphehb.exe224⤵PID:4056
-
C:\Windows\SysWOW64\Eeiheo32.exeC:\Windows\system32\Eeiheo32.exe225⤵PID:792
-
C:\Windows\SysWOW64\Ekfpmf32.exeC:\Windows\system32\Ekfpmf32.exe226⤵PID:3104
-
C:\Windows\SysWOW64\Emdmjamj.exeC:\Windows\system32\Emdmjamj.exe227⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3152 -
C:\Windows\SysWOW64\Ekhmcelc.exeC:\Windows\system32\Ekhmcelc.exe228⤵PID:3200
-
C:\Windows\SysWOW64\Edaalk32.exeC:\Windows\system32\Edaalk32.exe229⤵PID:3264
-
C:\Windows\SysWOW64\Ephbal32.exeC:\Windows\system32\Ephbal32.exe230⤵PID:3304
-
C:\Windows\SysWOW64\Fdekgjno.exeC:\Windows\system32\Fdekgjno.exe231⤵PID:3340
-
C:\Windows\SysWOW64\Fibcoalf.exeC:\Windows\system32\Fibcoalf.exe232⤵PID:3400
-
C:\Windows\SysWOW64\Fckhhgcf.exeC:\Windows\system32\Fckhhgcf.exe233⤵PID:3480
-
C:\Windows\SysWOW64\Fhgppnan.exeC:\Windows\system32\Fhgppnan.exe234⤵PID:3536
-
C:\Windows\SysWOW64\Fhjmfnok.exeC:\Windows\system32\Fhjmfnok.exe235⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3592 -
C:\Windows\SysWOW64\Fennoa32.exeC:\Windows\system32\Fennoa32.exe236⤵PID:3648
-
C:\Windows\SysWOW64\Fnibcd32.exeC:\Windows\system32\Fnibcd32.exe237⤵
- Drops file in System32 directory
PID:3716 -
C:\Windows\SysWOW64\Gcmamj32.exeC:\Windows\system32\Gcmamj32.exe238⤵PID:3760
-
C:\Windows\SysWOW64\Gqaafn32.exeC:\Windows\system32\Gqaafn32.exe239⤵
- Drops file in System32 directory
PID:3884 -
C:\Windows\SysWOW64\Gqcnln32.exeC:\Windows\system32\Gqcnln32.exe240⤵PID:3944
-
C:\Windows\SysWOW64\Hkmollme.exeC:\Windows\system32\Hkmollme.exe241⤵
- Drops file in System32 directory
PID:3996 -
C:\Windows\SysWOW64\Hokhbj32.exeC:\Windows\system32\Hokhbj32.exe242⤵PID:4040