Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:19
Static task
static1
Behavioral task
behavioral1
Sample
6bb510e6112d239d37fc1699804fb460518378e69f49c3b2bb9937e7fd3e6160.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6bb510e6112d239d37fc1699804fb460518378e69f49c3b2bb9937e7fd3e6160.exe
Resource
win10v2004-20240508-en
General
-
Target
6bb510e6112d239d37fc1699804fb460518378e69f49c3b2bb9937e7fd3e6160.exe
-
Size
99KB
-
MD5
2570e3c46b01b498361e49da8b2760d0
-
SHA1
c7618049747dbc8801f5ad73f2d78f8b88b9bcd3
-
SHA256
6bb510e6112d239d37fc1699804fb460518378e69f49c3b2bb9937e7fd3e6160
-
SHA512
382e3b084d655b356b3aff2fffec33040ef3cb295ff0ea714126f3d8f5143e11769e1b665bb15e072d6f62342d2d596988a84a7198c0f75903497e380be48cbb
-
SSDEEP
3072:V7ibI1BtwDKKmrvz6bUTbmgb3a3+X13XRzG:5iDrmSbKbf7aOl3BzG
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Hlpmmpam.exeJpgjgboe.exeInjqmdki.exeQnebjc32.exeMakkcc32.exeGiiglhjb.exeHqnjek32.exeFegjgkla.exeLcncbc32.exeFihfnp32.exeGehiioaj.exeQblfkgqb.exeBefnbd32.exeGjicfk32.exeJkbojpna.exeQaapcj32.exeEdcqjc32.exeKmclmm32.exeLlkbcl32.exeNidmfh32.exeCgfkmgnj.exeHbofmcij.exeBhbkpgbf.exeEeojcmfi.exeDnnkec32.exePclhdl32.exeQdojgmfe.exeJmlddeio.exeLhcafa32.exeKmkihbho.exeCdcjgnbc.exeHkejnl32.exeAjhiei32.exeKadfkhkf.exeLnjldf32.exeGgdekbgb.exeBqlfaj32.exeIgpdnlgd.exePmmeon32.exeGagkjbaf.exePcnfdl32.exeFakglf32.exeLpddgd32.exeNpmphinm.exeLldmleam.exeOeindm32.exeCmfmojcb.exeGkcekfad.exeGncnmane.exeHgiked32.exeIlgjhena.exeDojddmec.exeDbncjf32.exeEmjjfb32.exeFladmn32.exeKffqqm32.exeOllqllod.exeJkchmo32.exeNnjklb32.exeCbajkiof.exeMnifja32.exeKlfjpa32.exePhgannal.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hlpmmpam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jpgjgboe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Injqmdki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qnebjc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Makkcc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Giiglhjb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hqnjek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fegjgkla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lcncbc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fihfnp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gehiioaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qblfkgqb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Befnbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gjicfk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jkbojpna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qaapcj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Edcqjc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmclmm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Llkbcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nidmfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cgfkmgnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hbofmcij.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhbkpgbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eeojcmfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dnnkec32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pclhdl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qdojgmfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jmlddeio.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhcafa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kmkihbho.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdcjgnbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hkejnl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajhiei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kadfkhkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lnjldf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ggdekbgb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bqlfaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Igpdnlgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pmmeon32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gagkjbaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pcnfdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fakglf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lpddgd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Npmphinm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lldmleam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oeindm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmfmojcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gkcekfad.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gncnmane.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hgiked32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilgjhena.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dojddmec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dbncjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Emjjfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fladmn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kffqqm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ollqllod.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkchmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nnjklb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbajkiof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mnifja32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Klfjpa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fegjgkla.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phgannal.exe -
Executes dropped EXE 64 IoCs
Processes:
Nidkmojn.exeNhiholof.exeNoemqe32.exeOionacqo.exeOmmfga32.exeOehklddp.exeOghhfg32.exeOoclji32.exePkjmoj32.exePeoalc32.exePkljdj32.exePgckjk32.exePqkobqhd.exePnopldgn.exePclhdl32.exePqphnp32.exeQfmafg32.exeQfonkfqd.exeQmifhq32.exeAfajafoa.exeAmkbnp32.exeAcekjjmk.exeAbkhkgbb.exeAkcldl32.exeAjhiei32.exeAababceh.exeBadnhbce.exeBfccei32.exeBplhnoej.exeBffpki32.exeBpnddn32.exeBekmle32.exeBleeioil.exeBfkifhib.exeCbajkiof.exeCljodo32.exeCllkin32.exeCedpbd32.exeCkahkk32.exeCfhiplmp.exeDbojdmcd.exeDmdnbecj.exeDbafjlaa.exeDikogf32.exeDpegcq32.exeDgoopkgh.exeDhplhc32.exeDojddmec.exeDiphbfdi.exeDlndnacm.exeDegiggjm.exeElqaca32.exeEnbnkigh.exeEdlfhc32.exeEgjbdo32.exeEpbfmd32.exeFfibkj32.exeFkejcq32.exeFmegncpp.exeFofpoo32.exeFdbhge32.exeGjpqpl32.exeGeeemeif.exeGjbmelgm.exepid process 2872 Nidkmojn.exe 2916 Nhiholof.exe 2436 Noemqe32.exe 2492 Oionacqo.exe 2604 Ommfga32.exe 2856 Oehklddp.exe 1300 Oghhfg32.exe 1732 Ooclji32.exe 2788 Pkjmoj32.exe 3012 Peoalc32.exe 2000 Pkljdj32.exe 1540 Pgckjk32.exe 2628 Pqkobqhd.exe 764 Pnopldgn.exe 2256 Pclhdl32.exe 2960 Pqphnp32.exe 2072 Qfmafg32.exe 1576 Qfonkfqd.exe 676 Qmifhq32.exe 1156 Afajafoa.exe 1444 Amkbnp32.exe 1072 Acekjjmk.exe 1616 Abkhkgbb.exe 704 Akcldl32.exe 1824 Ajhiei32.exe 1736 Aababceh.exe 1936 Badnhbce.exe 2144 Bfccei32.exe 2536 Bplhnoej.exe 2564 Bffpki32.exe 2500 Bpnddn32.exe 2852 Bekmle32.exe 2352 Bleeioil.exe 1364 Bfkifhib.exe 816 Cbajkiof.exe 2932 Cljodo32.exe 1976 Cllkin32.exe 956 Cedpbd32.exe 1600 Ckahkk32.exe 1196 Cfhiplmp.exe 952 Dbojdmcd.exe 584 Dmdnbecj.exe 2272 Dbafjlaa.exe 324 Dikogf32.exe 2084 Dpegcq32.exe 1532 Dgoopkgh.exe 1548 Dhplhc32.exe 888 Dojddmec.exe 2216 Diphbfdi.exe 2056 Dlndnacm.exe 2192 Degiggjm.exe 1624 Elqaca32.exe 1136 Enbnkigh.exe 2152 Edlfhc32.exe 2484 Egjbdo32.exe 2680 Epbfmd32.exe 3052 Ffibkj32.exe 1372 Fkejcq32.exe 1172 Fmegncpp.exe 1888 Fofpoo32.exe 2348 Fdbhge32.exe 1640 Gjpqpl32.exe 2252 Geeemeif.exe 1784 Gjbmelgm.exe -
Loads dropped DLL 64 IoCs
Processes:
6bb510e6112d239d37fc1699804fb460518378e69f49c3b2bb9937e7fd3e6160.exeNidkmojn.exeNhiholof.exeNoemqe32.exeOionacqo.exeOmmfga32.exeOehklddp.exeOghhfg32.exeOoclji32.exePkjmoj32.exePeoalc32.exePkljdj32.exePgckjk32.exePqkobqhd.exePnopldgn.exePclhdl32.exePqphnp32.exeQfmafg32.exeQfonkfqd.exeQmifhq32.exeAfajafoa.exeAmkbnp32.exeAcekjjmk.exeAbkhkgbb.exeAkcldl32.exeAjhiei32.exeAababceh.exeBadnhbce.exeBfccei32.exeBplhnoej.exeBffpki32.exeBpnddn32.exepid process 1692 6bb510e6112d239d37fc1699804fb460518378e69f49c3b2bb9937e7fd3e6160.exe 1692 6bb510e6112d239d37fc1699804fb460518378e69f49c3b2bb9937e7fd3e6160.exe 2872 Nidkmojn.exe 2872 Nidkmojn.exe 2916 Nhiholof.exe 2916 Nhiholof.exe 2436 Noemqe32.exe 2436 Noemqe32.exe 2492 Oionacqo.exe 2492 Oionacqo.exe 2604 Ommfga32.exe 2604 Ommfga32.exe 2856 Oehklddp.exe 2856 Oehklddp.exe 1300 Oghhfg32.exe 1300 Oghhfg32.exe 1732 Ooclji32.exe 1732 Ooclji32.exe 2788 Pkjmoj32.exe 2788 Pkjmoj32.exe 3012 Peoalc32.exe 3012 Peoalc32.exe 2000 Pkljdj32.exe 2000 Pkljdj32.exe 1540 Pgckjk32.exe 1540 Pgckjk32.exe 2628 Pqkobqhd.exe 2628 Pqkobqhd.exe 764 Pnopldgn.exe 764 Pnopldgn.exe 2256 Pclhdl32.exe 2256 Pclhdl32.exe 2960 Pqphnp32.exe 2960 Pqphnp32.exe 2072 Qfmafg32.exe 2072 Qfmafg32.exe 1576 Qfonkfqd.exe 1576 Qfonkfqd.exe 676 Qmifhq32.exe 676 Qmifhq32.exe 1156 Afajafoa.exe 1156 Afajafoa.exe 1444 Amkbnp32.exe 1444 Amkbnp32.exe 1072 Acekjjmk.exe 1072 Acekjjmk.exe 1616 Abkhkgbb.exe 1616 Abkhkgbb.exe 704 Akcldl32.exe 704 Akcldl32.exe 1824 Ajhiei32.exe 1824 Ajhiei32.exe 1736 Aababceh.exe 1736 Aababceh.exe 1936 Badnhbce.exe 1936 Badnhbce.exe 2144 Bfccei32.exe 2144 Bfccei32.exe 2536 Bplhnoej.exe 2536 Bplhnoej.exe 2564 Bffpki32.exe 2564 Bffpki32.exe 2500 Bpnddn32.exe 2500 Bpnddn32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Aiknnf32.exePmpbdm32.exeHdbbnd32.exeNafiej32.exeEejopecj.exeJeafjiop.exeOplelf32.exeBnlgbnbp.exeHnbcaome.exeAhhchk32.exeLblcfnhj.exeFfeldglk.exeGihnkejd.exeLncfcgeb.exePcmoie32.exeJoebccpp.exeFamope32.exeHcjldp32.exeIimfld32.exeKlbdgb32.exeIikkon32.exeLpnopm32.exeGgdekbgb.exeNcpdbohb.exeEomdoj32.exeEgjbdo32.exeKcopdb32.exeLmgalkcf.exeMgjebg32.exeAahimb32.exePnjofo32.exeHnpgloog.exeLfkfkopk.exeNhebhipj.exeBknmok32.exeAkcldl32.exeAjhiei32.exeDbiocd32.exeCcgklc32.exeDahkok32.exeDgoopkgh.exeGbhbdi32.exeFikelhib.exeHechkfkc.exeMhkhgd32.exeDmdnbecj.exeBfdenafn.exeGdhdkn32.exeEmpomd32.exeEmgdmc32.exeDhmhhmlm.exeHalbai32.exeLoefnpnn.exeIjidfpci.exeOoabmbbe.exeOffpbi32.exeGkmbmh32.exeKechdf32.exeNbfnggeo.exeGaplfinb.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Aohgfm32.exe Aiknnf32.exe File created C:\Windows\SysWOW64\Pcljmdmj.exe Pmpbdm32.exe File created C:\Windows\SysWOW64\Jjejnabb.dll Hdbbnd32.exe File created C:\Windows\SysWOW64\Nknnnoph.exe Nafiej32.exe File opened for modification C:\Windows\SysWOW64\Eppcmncq.exe Eejopecj.exe File created C:\Windows\SysWOW64\Nmmnnh32.dll Jeafjiop.exe File created C:\Windows\SysWOW64\Oeindm32.exe Oplelf32.exe File opened for modification C:\Windows\SysWOW64\Bhbkpgbf.exe Bnlgbnbp.exe File created C:\Windows\SysWOW64\Eoeffhea.dll Hnbcaome.exe File opened for modification C:\Windows\SysWOW64\Bobleeef.exe Ahhchk32.exe File created C:\Windows\SysWOW64\Lghlndfa.exe Lblcfnhj.exe File opened for modification C:\Windows\SysWOW64\Fladmn32.exe Ffeldglk.exe File created C:\Windows\SysWOW64\Oijehm32.dll Gihnkejd.exe File created C:\Windows\SysWOW64\Lkggmldl.exe Lncfcgeb.exe File created C:\Windows\SysWOW64\Phohmbjf.dll Pcmoie32.exe File created C:\Windows\SysWOW64\Ffmaalgf.dll Joebccpp.exe File opened for modification C:\Windows\SysWOW64\Fgigil32.exe Famope32.exe File opened for modification C:\Windows\SysWOW64\Hlbpme32.exe Hcjldp32.exe File created C:\Windows\SysWOW64\Iahkpg32.exe Iimfld32.exe File created C:\Windows\SysWOW64\Mbellj32.dll Klbdgb32.exe File created C:\Windows\SysWOW64\Ifolhann.exe Iikkon32.exe File opened for modification C:\Windows\SysWOW64\Lifcib32.exe Lpnopm32.exe File created C:\Windows\SysWOW64\Gibbgmfe.exe Ggdekbgb.exe File created C:\Windows\SysWOW64\Omhhke32.exe Ncpdbohb.exe File created C:\Windows\SysWOW64\Hkclkc32.dll Eomdoj32.exe File created C:\Windows\SysWOW64\Mfjgooni.dll Egjbdo32.exe File created C:\Windows\SysWOW64\Klhemhpk.exe Kcopdb32.exe File created C:\Windows\SysWOW64\Mkgpnd32.dll Lmgalkcf.exe File created C:\Windows\SysWOW64\Macilmnk.exe Mgjebg32.exe File created C:\Windows\SysWOW64\Kaompi32.exe Klbdgb32.exe File opened for modification C:\Windows\SysWOW64\Abjeejep.exe Aahimb32.exe File opened for modification C:\Windows\SysWOW64\Piqpkpml.exe Pnjofo32.exe File created C:\Windows\SysWOW64\Nlobbi32.dll Hnpgloog.exe File created C:\Windows\SysWOW64\Llhocfnb.exe Lfkfkopk.exe File opened for modification C:\Windows\SysWOW64\Nnbjpqoa.exe Nhebhipj.exe File created C:\Windows\SysWOW64\Icplje32.exe Hnbcaome.exe File created C:\Windows\SysWOW64\Bahelebm.exe Bknmok32.exe File created C:\Windows\SysWOW64\Oedkmfka.dll Akcldl32.exe File opened for modification C:\Windows\SysWOW64\Aababceh.exe Ajhiei32.exe File created C:\Windows\SysWOW64\Hnpdlk32.dll Dbiocd32.exe File opened for modification C:\Windows\SysWOW64\Omhhke32.exe Ncpdbohb.exe File created C:\Windows\SysWOW64\Cidddj32.exe Ccgklc32.exe File opened for modification C:\Windows\SysWOW64\Efedga32.exe Dahkok32.exe File opened for modification C:\Windows\SysWOW64\Dhplhc32.exe Dgoopkgh.exe File opened for modification C:\Windows\SysWOW64\Golbnm32.exe Gbhbdi32.exe File opened for modification C:\Windows\SysWOW64\Gbcien32.exe Fikelhib.exe File created C:\Windows\SysWOW64\Emdpcf32.dll Hechkfkc.exe File created C:\Windows\SysWOW64\Noepdo32.exe Mhkhgd32.exe File opened for modification C:\Windows\SysWOW64\Dbafjlaa.exe Dmdnbecj.exe File created C:\Windows\SysWOW64\Dhplhc32.exe Dgoopkgh.exe File created C:\Windows\SysWOW64\Godonkii.dll Bfdenafn.exe File created C:\Windows\SysWOW64\Gbccnjjb.dll Gdhdkn32.exe File created C:\Windows\SysWOW64\Gnngnk32.dll Empomd32.exe File created C:\Windows\SysWOW64\Jhpgpkho.dll Emgdmc32.exe File created C:\Windows\SysWOW64\Pqgono32.dll Dhmhhmlm.exe File created C:\Windows\SysWOW64\Jhfpdl32.dll Halbai32.exe File created C:\Windows\SysWOW64\Ollopmbl.dll Loefnpnn.exe File created C:\Windows\SysWOW64\Calonebc.dll Ijidfpci.exe File created C:\Windows\SysWOW64\Oococb32.exe Ooabmbbe.exe File opened for modification C:\Windows\SysWOW64\Ocjpkm32.exe Offpbi32.exe File created C:\Windows\SysWOW64\Bjoaognb.dll Gkmbmh32.exe File opened for modification C:\Windows\SysWOW64\Kokmmkcm.exe Kechdf32.exe File opened for modification C:\Windows\SysWOW64\Nojnql32.exe Nbfnggeo.exe File created C:\Windows\SysWOW64\Gkhaooec.exe Gaplfinb.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2852 892 WerFault.exe Opblgehg.exe -
Modifies registry class 64 IoCs
Processes:
Mccbmh32.exeFgigil32.exeHnbcaome.exeFijnabef.exeHlpmmpam.exeBpnddn32.exeJdhgnf32.exeAmcbankf.exeOkhefl32.exeQlggjlep.exeEmjjfb32.exeGibkmgcj.exeGbnenk32.exeAdnpkjde.exeIcifjk32.exeJpgmpk32.exeLpnopm32.exeKbbakc32.exeBimphc32.exeCbiiog32.exePmjaohol.exeGmlablaa.exeIejkhlip.exeGaplfinb.exeGihnkejd.exeKndbko32.exeKioiffcn.exeGjicfk32.exeGbhbdi32.exeGmhbkohm.exePpipdl32.exeAadobccg.exeFhbbcail.exeMmkafhnb.exeOiahnnji.exeIdfnicfl.exeFhbnbpjc.exeLbfook32.exeKenoifpb.exeInjqmdki.exeLkelpd32.exeKmkihbho.exeEmgdmc32.exeQfonkfqd.exeHjlbdc32.exePnfnajed.exeAblbjj32.exeDjjeedhp.exeKolhdbjh.exeMlhnifmq.exeEjcmmp32.exeMgcjpkak.exeBlgcio32.exeCppobaeb.exeHibgkjee.exeHnpbjnpo.exeBehilopf.exeIahkpg32.exeGjgiidkl.exeIfpcchai.exeNhqhmj32.exeEhfhgogp.exeKhabghdl.exeNjbdea32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkfklboi.dll" Mccbmh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fgigil32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hnbcaome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fijnabef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hlpmmpam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bpnddn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efhjijha.dll" Jdhgnf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Amcbankf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Okhefl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qlggjlep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbpkaopd.dll" Emjjfb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gibkmgcj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gbnenk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Adnpkjde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Icifjk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jpgmpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lpnopm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kbbakc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdajpkkj.dll" Bimphc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cbiiog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pmjaohol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gmlablaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iejkhlip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gaplfinb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gihnkejd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lalieb32.dll" Kndbko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kioiffcn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gjicfk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfnpea32.dll" Gbhbdi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gmhbkohm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfbaik32.dll" Ppipdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aadobccg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhfljfho.dll" Fhbbcail.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mmkafhnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oiahnnji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ganigoib.dll" Idfnicfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihkcje32.dll" Fhbnbpjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jeoggjip.dll" Lbfook32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kenoifpb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Injqmdki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lkelpd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipbkjl32.dll" Kmkihbho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhpgpkho.dll" Emgdmc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Qfonkfqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hjlbdc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pnfnajed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ablbjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Djjeedhp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kolhdbjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mlhnifmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iodcmd32.dll" Ejcmmp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mgcjpkak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Blgcio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cppobaeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekdmib32.dll" Hibgkjee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dllbljej.dll" Hnpbjnpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kncinl32.dll" Behilopf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knnpkl32.dll" Iahkpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gjgiidkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ifpcchai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nhqhmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ehfhgogp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Khabghdl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Njbdea32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6bb510e6112d239d37fc1699804fb460518378e69f49c3b2bb9937e7fd3e6160.exeNidkmojn.exeNhiholof.exeNoemqe32.exeOionacqo.exeOmmfga32.exeOehklddp.exeOghhfg32.exeOoclji32.exePkjmoj32.exePeoalc32.exePkljdj32.exePgckjk32.exePqkobqhd.exePnopldgn.exePclhdl32.exedescription pid process target process PID 1692 wrote to memory of 2872 1692 6bb510e6112d239d37fc1699804fb460518378e69f49c3b2bb9937e7fd3e6160.exe Nidkmojn.exe PID 1692 wrote to memory of 2872 1692 6bb510e6112d239d37fc1699804fb460518378e69f49c3b2bb9937e7fd3e6160.exe Nidkmojn.exe PID 1692 wrote to memory of 2872 1692 6bb510e6112d239d37fc1699804fb460518378e69f49c3b2bb9937e7fd3e6160.exe Nidkmojn.exe PID 1692 wrote to memory of 2872 1692 6bb510e6112d239d37fc1699804fb460518378e69f49c3b2bb9937e7fd3e6160.exe Nidkmojn.exe PID 2872 wrote to memory of 2916 2872 Nidkmojn.exe Nhiholof.exe PID 2872 wrote to memory of 2916 2872 Nidkmojn.exe Nhiholof.exe PID 2872 wrote to memory of 2916 2872 Nidkmojn.exe Nhiholof.exe PID 2872 wrote to memory of 2916 2872 Nidkmojn.exe Nhiholof.exe PID 2916 wrote to memory of 2436 2916 Nhiholof.exe Noemqe32.exe PID 2916 wrote to memory of 2436 2916 Nhiholof.exe Noemqe32.exe PID 2916 wrote to memory of 2436 2916 Nhiholof.exe Noemqe32.exe PID 2916 wrote to memory of 2436 2916 Nhiholof.exe Noemqe32.exe PID 2436 wrote to memory of 2492 2436 Noemqe32.exe Oionacqo.exe PID 2436 wrote to memory of 2492 2436 Noemqe32.exe Oionacqo.exe PID 2436 wrote to memory of 2492 2436 Noemqe32.exe Oionacqo.exe PID 2436 wrote to memory of 2492 2436 Noemqe32.exe Oionacqo.exe PID 2492 wrote to memory of 2604 2492 Oionacqo.exe Ommfga32.exe PID 2492 wrote to memory of 2604 2492 Oionacqo.exe Ommfga32.exe PID 2492 wrote to memory of 2604 2492 Oionacqo.exe Ommfga32.exe PID 2492 wrote to memory of 2604 2492 Oionacqo.exe Ommfga32.exe PID 2604 wrote to memory of 2856 2604 Ommfga32.exe Oehklddp.exe PID 2604 wrote to memory of 2856 2604 Ommfga32.exe Oehklddp.exe PID 2604 wrote to memory of 2856 2604 Ommfga32.exe Oehklddp.exe PID 2604 wrote to memory of 2856 2604 Ommfga32.exe Oehklddp.exe PID 2856 wrote to memory of 1300 2856 Oehklddp.exe Oghhfg32.exe PID 2856 wrote to memory of 1300 2856 Oehklddp.exe Oghhfg32.exe PID 2856 wrote to memory of 1300 2856 Oehklddp.exe Oghhfg32.exe PID 2856 wrote to memory of 1300 2856 Oehklddp.exe Oghhfg32.exe PID 1300 wrote to memory of 1732 1300 Oghhfg32.exe Ooclji32.exe PID 1300 wrote to memory of 1732 1300 Oghhfg32.exe Ooclji32.exe PID 1300 wrote to memory of 1732 1300 Oghhfg32.exe Ooclji32.exe PID 1300 wrote to memory of 1732 1300 Oghhfg32.exe Ooclji32.exe PID 1732 wrote to memory of 2788 1732 Ooclji32.exe Pkjmoj32.exe PID 1732 wrote to memory of 2788 1732 Ooclji32.exe Pkjmoj32.exe PID 1732 wrote to memory of 2788 1732 Ooclji32.exe Pkjmoj32.exe PID 1732 wrote to memory of 2788 1732 Ooclji32.exe Pkjmoj32.exe PID 2788 wrote to memory of 3012 2788 Pkjmoj32.exe Peoalc32.exe PID 2788 wrote to memory of 3012 2788 Pkjmoj32.exe Peoalc32.exe PID 2788 wrote to memory of 3012 2788 Pkjmoj32.exe Peoalc32.exe PID 2788 wrote to memory of 3012 2788 Pkjmoj32.exe Peoalc32.exe PID 3012 wrote to memory of 2000 3012 Peoalc32.exe Pkljdj32.exe PID 3012 wrote to memory of 2000 3012 Peoalc32.exe Pkljdj32.exe PID 3012 wrote to memory of 2000 3012 Peoalc32.exe Pkljdj32.exe PID 3012 wrote to memory of 2000 3012 Peoalc32.exe Pkljdj32.exe PID 2000 wrote to memory of 1540 2000 Pkljdj32.exe Pgckjk32.exe PID 2000 wrote to memory of 1540 2000 Pkljdj32.exe Pgckjk32.exe PID 2000 wrote to memory of 1540 2000 Pkljdj32.exe Pgckjk32.exe PID 2000 wrote to memory of 1540 2000 Pkljdj32.exe Pgckjk32.exe PID 1540 wrote to memory of 2628 1540 Pgckjk32.exe Pqkobqhd.exe PID 1540 wrote to memory of 2628 1540 Pgckjk32.exe Pqkobqhd.exe PID 1540 wrote to memory of 2628 1540 Pgckjk32.exe Pqkobqhd.exe PID 1540 wrote to memory of 2628 1540 Pgckjk32.exe Pqkobqhd.exe PID 2628 wrote to memory of 764 2628 Pqkobqhd.exe Pnopldgn.exe PID 2628 wrote to memory of 764 2628 Pqkobqhd.exe Pnopldgn.exe PID 2628 wrote to memory of 764 2628 Pqkobqhd.exe Pnopldgn.exe PID 2628 wrote to memory of 764 2628 Pqkobqhd.exe Pnopldgn.exe PID 764 wrote to memory of 2256 764 Pnopldgn.exe Pclhdl32.exe PID 764 wrote to memory of 2256 764 Pnopldgn.exe Pclhdl32.exe PID 764 wrote to memory of 2256 764 Pnopldgn.exe Pclhdl32.exe PID 764 wrote to memory of 2256 764 Pnopldgn.exe Pclhdl32.exe PID 2256 wrote to memory of 2960 2256 Pclhdl32.exe Pqphnp32.exe PID 2256 wrote to memory of 2960 2256 Pclhdl32.exe Pqphnp32.exe PID 2256 wrote to memory of 2960 2256 Pclhdl32.exe Pqphnp32.exe PID 2256 wrote to memory of 2960 2256 Pclhdl32.exe Pqphnp32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bb510e6112d239d37fc1699804fb460518378e69f49c3b2bb9937e7fd3e6160.exe"C:\Users\Admin\AppData\Local\Temp\6bb510e6112d239d37fc1699804fb460518378e69f49c3b2bb9937e7fd3e6160.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\Nidkmojn.exeC:\Windows\system32\Nidkmojn.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\Nhiholof.exeC:\Windows\system32\Nhiholof.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\Noemqe32.exeC:\Windows\system32\Noemqe32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\Oionacqo.exeC:\Windows\system32\Oionacqo.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\Ommfga32.exeC:\Windows\system32\Ommfga32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\Oehklddp.exeC:\Windows\system32\Oehklddp.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\Oghhfg32.exeC:\Windows\system32\Oghhfg32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\Ooclji32.exeC:\Windows\system32\Ooclji32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\Pkjmoj32.exeC:\Windows\system32\Pkjmoj32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\Peoalc32.exeC:\Windows\system32\Peoalc32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\Pkljdj32.exeC:\Windows\system32\Pkljdj32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\Pgckjk32.exeC:\Windows\system32\Pgckjk32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\Pqkobqhd.exeC:\Windows\system32\Pqkobqhd.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\Pnopldgn.exeC:\Windows\system32\Pnopldgn.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\Pclhdl32.exeC:\Windows\system32\Pclhdl32.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\Pqphnp32.exeC:\Windows\system32\Pqphnp32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Windows\SysWOW64\Qfmafg32.exeC:\Windows\system32\Qfmafg32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Windows\SysWOW64\Qfonkfqd.exeC:\Windows\system32\Qfonkfqd.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1576 -
C:\Windows\SysWOW64\Qmifhq32.exeC:\Windows\system32\Qmifhq32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Windows\SysWOW64\Afajafoa.exeC:\Windows\system32\Afajafoa.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Windows\SysWOW64\Amkbnp32.exeC:\Windows\system32\Amkbnp32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Windows\SysWOW64\Acekjjmk.exeC:\Windows\system32\Acekjjmk.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Windows\SysWOW64\Abkhkgbb.exeC:\Windows\system32\Abkhkgbb.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Windows\SysWOW64\Akcldl32.exeC:\Windows\system32\Akcldl32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:704 -
C:\Windows\SysWOW64\Ajhiei32.exeC:\Windows\system32\Ajhiei32.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1824 -
C:\Windows\SysWOW64\Aababceh.exeC:\Windows\system32\Aababceh.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Windows\SysWOW64\Badnhbce.exeC:\Windows\system32\Badnhbce.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Windows\SysWOW64\Bfccei32.exeC:\Windows\system32\Bfccei32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Windows\SysWOW64\Bplhnoej.exeC:\Windows\system32\Bplhnoej.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Windows\SysWOW64\Bffpki32.exeC:\Windows\system32\Bffpki32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Windows\SysWOW64\Bpnddn32.exeC:\Windows\system32\Bpnddn32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2500 -
C:\Windows\SysWOW64\Bekmle32.exeC:\Windows\system32\Bekmle32.exe33⤵
- Executes dropped EXE
PID:2852 -
C:\Windows\SysWOW64\Bleeioil.exeC:\Windows\system32\Bleeioil.exe34⤵
- Executes dropped EXE
PID:2352 -
C:\Windows\SysWOW64\Bfkifhib.exeC:\Windows\system32\Bfkifhib.exe35⤵
- Executes dropped EXE
PID:1364 -
C:\Windows\SysWOW64\Cbajkiof.exeC:\Windows\system32\Cbajkiof.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:816 -
C:\Windows\SysWOW64\Cljodo32.exeC:\Windows\system32\Cljodo32.exe37⤵
- Executes dropped EXE
PID:2932 -
C:\Windows\SysWOW64\Cllkin32.exeC:\Windows\system32\Cllkin32.exe38⤵
- Executes dropped EXE
PID:1976 -
C:\Windows\SysWOW64\Cedpbd32.exeC:\Windows\system32\Cedpbd32.exe39⤵
- Executes dropped EXE
PID:956 -
C:\Windows\SysWOW64\Ckahkk32.exeC:\Windows\system32\Ckahkk32.exe40⤵
- Executes dropped EXE
PID:1600 -
C:\Windows\SysWOW64\Cfhiplmp.exeC:\Windows\system32\Cfhiplmp.exe41⤵
- Executes dropped EXE
PID:1196 -
C:\Windows\SysWOW64\Dbojdmcd.exeC:\Windows\system32\Dbojdmcd.exe42⤵
- Executes dropped EXE
PID:952 -
C:\Windows\SysWOW64\Dmdnbecj.exeC:\Windows\system32\Dmdnbecj.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:584 -
C:\Windows\SysWOW64\Dbafjlaa.exeC:\Windows\system32\Dbafjlaa.exe44⤵
- Executes dropped EXE
PID:2272 -
C:\Windows\SysWOW64\Dikogf32.exeC:\Windows\system32\Dikogf32.exe45⤵
- Executes dropped EXE
PID:324 -
C:\Windows\SysWOW64\Dpegcq32.exeC:\Windows\system32\Dpegcq32.exe46⤵
- Executes dropped EXE
PID:2084 -
C:\Windows\SysWOW64\Dgoopkgh.exeC:\Windows\system32\Dgoopkgh.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1532 -
C:\Windows\SysWOW64\Dhplhc32.exeC:\Windows\system32\Dhplhc32.exe48⤵
- Executes dropped EXE
PID:1548 -
C:\Windows\SysWOW64\Dojddmec.exeC:\Windows\system32\Dojddmec.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:888 -
C:\Windows\SysWOW64\Diphbfdi.exeC:\Windows\system32\Diphbfdi.exe50⤵
- Executes dropped EXE
PID:2216 -
C:\Windows\SysWOW64\Dlndnacm.exeC:\Windows\system32\Dlndnacm.exe51⤵
- Executes dropped EXE
PID:2056 -
C:\Windows\SysWOW64\Degiggjm.exeC:\Windows\system32\Degiggjm.exe52⤵
- Executes dropped EXE
PID:2192 -
C:\Windows\SysWOW64\Elqaca32.exeC:\Windows\system32\Elqaca32.exe53⤵
- Executes dropped EXE
PID:1624 -
C:\Windows\SysWOW64\Enbnkigh.exeC:\Windows\system32\Enbnkigh.exe54⤵
- Executes dropped EXE
PID:1136 -
C:\Windows\SysWOW64\Edlfhc32.exeC:\Windows\system32\Edlfhc32.exe55⤵
- Executes dropped EXE
PID:2152 -
C:\Windows\SysWOW64\Egjbdo32.exeC:\Windows\system32\Egjbdo32.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2484 -
C:\Windows\SysWOW64\Epbfmd32.exeC:\Windows\system32\Epbfmd32.exe57⤵
- Executes dropped EXE
PID:2680 -
C:\Windows\SysWOW64\Ffibkj32.exeC:\Windows\system32\Ffibkj32.exe58⤵
- Executes dropped EXE
PID:3052 -
C:\Windows\SysWOW64\Fkejcq32.exeC:\Windows\system32\Fkejcq32.exe59⤵
- Executes dropped EXE
PID:1372 -
C:\Windows\SysWOW64\Fmegncpp.exeC:\Windows\system32\Fmegncpp.exe60⤵
- Executes dropped EXE
PID:1172 -
C:\Windows\SysWOW64\Fofpoo32.exeC:\Windows\system32\Fofpoo32.exe61⤵
- Executes dropped EXE
PID:1888 -
C:\Windows\SysWOW64\Fdbhge32.exeC:\Windows\system32\Fdbhge32.exe62⤵
- Executes dropped EXE
PID:2348 -
C:\Windows\SysWOW64\Gjpqpl32.exeC:\Windows\system32\Gjpqpl32.exe63⤵
- Executes dropped EXE
PID:1640 -
C:\Windows\SysWOW64\Geeemeif.exeC:\Windows\system32\Geeemeif.exe64⤵
- Executes dropped EXE
PID:2252 -
C:\Windows\SysWOW64\Gjbmelgm.exeC:\Windows\system32\Gjbmelgm.exe65⤵
- Executes dropped EXE
PID:1784 -
C:\Windows\SysWOW64\Gcjbna32.exeC:\Windows\system32\Gcjbna32.exe66⤵PID:3008
-
C:\Windows\SysWOW64\Gmbfggdo.exeC:\Windows\system32\Gmbfggdo.exe67⤵PID:3068
-
C:\Windows\SysWOW64\Gghkdp32.exeC:\Windows\system32\Gghkdp32.exe68⤵PID:1316
-
C:\Windows\SysWOW64\Giiglhjb.exeC:\Windows\system32\Giiglhjb.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1656 -
C:\Windows\SysWOW64\Gcokiaji.exeC:\Windows\system32\Gcokiaji.exe70⤵PID:1048
-
C:\Windows\SysWOW64\Gjicfk32.exeC:\Windows\system32\Gjicfk32.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2108 -
C:\Windows\SysWOW64\Gpelnb32.exeC:\Windows\system32\Gpelnb32.exe72⤵PID:1204
-
C:\Windows\SysWOW64\Hmjlhfof.exeC:\Windows\system32\Hmjlhfof.exe73⤵PID:1832
-
C:\Windows\SysWOW64\Hfbaql32.exeC:\Windows\system32\Hfbaql32.exe74⤵PID:2968
-
C:\Windows\SysWOW64\Hloiib32.exeC:\Windows\system32\Hloiib32.exe75⤵PID:2172
-
C:\Windows\SysWOW64\Halbai32.exeC:\Windows\system32\Halbai32.exe76⤵
- Drops file in System32 directory
PID:1120 -
C:\Windows\SysWOW64\Hnpbjnpo.exeC:\Windows\system32\Hnpbjnpo.exe77⤵
- Modifies registry class
PID:1708 -
C:\Windows\SysWOW64\Hdlkcdog.exeC:\Windows\system32\Hdlkcdog.exe78⤵PID:2404
-
C:\Windows\SysWOW64\Hnbopmnm.exeC:\Windows\system32\Hnbopmnm.exe79⤵PID:2532
-
C:\Windows\SysWOW64\Hfmddp32.exeC:\Windows\system32\Hfmddp32.exe80⤵PID:636
-
C:\Windows\SysWOW64\Hmglajcd.exeC:\Windows\system32\Hmglajcd.exe81⤵PID:2592
-
C:\Windows\SysWOW64\Ijklknbn.exeC:\Windows\system32\Ijklknbn.exe82⤵PID:2832
-
C:\Windows\SysWOW64\Iphecepe.exeC:\Windows\system32\Iphecepe.exe83⤵PID:2636
-
C:\Windows\SysWOW64\Iipiljgf.exeC:\Windows\system32\Iipiljgf.exe84⤵PID:2124
-
C:\Windows\SysWOW64\Idfnicfl.exeC:\Windows\system32\Idfnicfl.exe85⤵
- Modifies registry class
PID:1080 -
C:\Windows\SysWOW64\Imnbbi32.exeC:\Windows\system32\Imnbbi32.exe86⤵PID:2288
-
C:\Windows\SysWOW64\Ioooiack.exeC:\Windows\system32\Ioooiack.exe87⤵PID:2204
-
C:\Windows\SysWOW64\Ihhcbf32.exeC:\Windows\system32\Ihhcbf32.exe88⤵PID:2160
-
C:\Windows\SysWOW64\Ioakoq32.exeC:\Windows\system32\Ioakoq32.exe89⤵PID:2952
-
C:\Windows\SysWOW64\Jkhldafl.exeC:\Windows\system32\Jkhldafl.exe90⤵PID:2644
-
C:\Windows\SysWOW64\Jabdql32.exeC:\Windows\system32\Jabdql32.exe91⤵PID:2660
-
C:\Windows\SysWOW64\Jofejpmc.exeC:\Windows\system32\Jofejpmc.exe92⤵PID:1596
-
C:\Windows\SysWOW64\Jaeafklf.exeC:\Windows\system32\Jaeafklf.exe93⤵PID:2460
-
C:\Windows\SysWOW64\Jgaiobjn.exeC:\Windows\system32\Jgaiobjn.exe94⤵PID:2096
-
C:\Windows\SysWOW64\Jagnlkjd.exeC:\Windows\system32\Jagnlkjd.exe95⤵PID:1524
-
C:\Windows\SysWOW64\Jkpbdq32.exeC:\Windows\system32\Jkpbdq32.exe96⤵PID:2796
-
C:\Windows\SysWOW64\Jdhgnf32.exeC:\Windows\system32\Jdhgnf32.exe97⤵
- Modifies registry class
PID:2480 -
C:\Windows\SysWOW64\Jkbojpna.exeC:\Windows\system32\Jkbojpna.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2572 -
C:\Windows\SysWOW64\Jpogbgmi.exeC:\Windows\system32\Jpogbgmi.exe99⤵PID:1948
-
C:\Windows\SysWOW64\Kjglkm32.exeC:\Windows\system32\Kjglkm32.exe100⤵PID:1912
-
C:\Windows\SysWOW64\Kcopdb32.exeC:\Windows\system32\Kcopdb32.exe101⤵
- Drops file in System32 directory
PID:1144 -
C:\Windows\SysWOW64\Klhemhpk.exeC:\Windows\system32\Klhemhpk.exe102⤵PID:2268
-
C:\Windows\SysWOW64\Kcamjb32.exeC:\Windows\system32\Kcamjb32.exe103⤵PID:1404
-
C:\Windows\SysWOW64\Kkmand32.exeC:\Windows\system32\Kkmand32.exe104⤵PID:1092
-
C:\Windows\SysWOW64\Khabghdl.exeC:\Windows\system32\Khabghdl.exe105⤵
- Modifies registry class
PID:460 -
C:\Windows\SysWOW64\Knnkpobc.exeC:\Windows\system32\Knnkpobc.exe106⤵PID:980
-
C:\Windows\SysWOW64\Khcomhbi.exeC:\Windows\system32\Khcomhbi.exe107⤵PID:2944
-
C:\Windows\SysWOW64\Lblcfnhj.exeC:\Windows\system32\Lblcfnhj.exe108⤵
- Drops file in System32 directory
PID:2868 -
C:\Windows\SysWOW64\Lghlndfa.exeC:\Windows\system32\Lghlndfa.exe109⤵PID:1564
-
C:\Windows\SysWOW64\Lnbdko32.exeC:\Windows\system32\Lnbdko32.exe110⤵PID:1940
-
C:\Windows\SysWOW64\Lgkhdddo.exeC:\Windows\system32\Lgkhdddo.exe111⤵PID:1916
-
C:\Windows\SysWOW64\Lmgalkcf.exeC:\Windows\system32\Lmgalkcf.exe112⤵
- Drops file in System32 directory
PID:840 -
C:\Windows\SysWOW64\Lcaiiejc.exeC:\Windows\system32\Lcaiiejc.exe113⤵PID:1644
-
C:\Windows\SysWOW64\Lohjnf32.exeC:\Windows\system32\Lohjnf32.exe114⤵PID:2816
-
C:\Windows\SysWOW64\Lfbbjpgd.exeC:\Windows\system32\Lfbbjpgd.exe115⤵PID:1992
-
C:\Windows\SysWOW64\Lokgcf32.exeC:\Windows\system32\Lokgcf32.exe116⤵PID:1984
-
C:\Windows\SysWOW64\Mjpkqonj.exeC:\Windows\system32\Mjpkqonj.exe117⤵PID:2248
-
C:\Windows\SysWOW64\Mpmcielb.exeC:\Windows\system32\Mpmcielb.exe118⤵PID:2708
-
C:\Windows\SysWOW64\Mejlalji.exeC:\Windows\system32\Mejlalji.exe119⤵PID:2880
-
C:\Windows\SysWOW64\Melifl32.exeC:\Windows\system32\Melifl32.exe120⤵PID:1112
-
C:\Windows\SysWOW64\Mgjebg32.exeC:\Windows\system32\Mgjebg32.exe121⤵
- Drops file in System32 directory
PID:1752 -
C:\Windows\SysWOW64\Macilmnk.exeC:\Windows\system32\Macilmnk.exe122⤵PID:1684
-
C:\Windows\SysWOW64\Mlhnifmq.exeC:\Windows\system32\Mlhnifmq.exe123⤵
- Modifies registry class
PID:1012 -
C:\Windows\SysWOW64\Mngjeamd.exeC:\Windows\system32\Mngjeamd.exe124⤵PID:2372
-
C:\Windows\SysWOW64\Mccbmh32.exeC:\Windows\system32\Mccbmh32.exe125⤵
- Modifies registry class
PID:2656 -
C:\Windows\SysWOW64\Mnifja32.exeC:\Windows\system32\Mnifja32.exe126⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1720 -
C:\Windows\SysWOW64\Necogkbo.exeC:\Windows\system32\Necogkbo.exe127⤵PID:2744
-
C:\Windows\SysWOW64\Nfdkoc32.exeC:\Windows\system32\Nfdkoc32.exe128⤵PID:1488
-
C:\Windows\SysWOW64\Npmphinm.exeC:\Windows\system32\Npmphinm.exe129⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2284 -
C:\Windows\SysWOW64\Njbdea32.exeC:\Windows\system32\Njbdea32.exe130⤵
- Modifies registry class
PID:2100 -
C:\Windows\SysWOW64\Nmqpam32.exeC:\Windows\system32\Nmqpam32.exe131⤵PID:628
-
C:\Windows\SysWOW64\Nbniid32.exeC:\Windows\system32\Nbniid32.exe132⤵PID:2956
-
C:\Windows\SysWOW64\Ndmecgba.exeC:\Windows\system32\Ndmecgba.exe133⤵PID:2364
-
C:\Windows\SysWOW64\Nmejllia.exeC:\Windows\system32\Nmejllia.exe134⤵PID:2388
-
C:\Windows\SysWOW64\Nbbbdcgi.exeC:\Windows\system32\Nbbbdcgi.exe135⤵PID:2200
-
C:\Windows\SysWOW64\Okgjodmi.exeC:\Windows\system32\Okgjodmi.exe136⤵PID:1236
-
C:\Windows\SysWOW64\Pilfpqaa.exeC:\Windows\system32\Pilfpqaa.exe137⤵PID:2312
-
C:\Windows\SysWOW64\Pdakniag.exeC:\Windows\system32\Pdakniag.exe138⤵PID:1896
-
C:\Windows\SysWOW64\Pnjofo32.exeC:\Windows\system32\Pnjofo32.exe139⤵
- Drops file in System32 directory
PID:1164 -
C:\Windows\SysWOW64\Piqpkpml.exeC:\Windows\system32\Piqpkpml.exe140⤵PID:1192
-
C:\Windows\SysWOW64\Pomhcg32.exeC:\Windows\system32\Pomhcg32.exe141⤵PID:672
-
C:\Windows\SysWOW64\Pegqpacp.exeC:\Windows\system32\Pegqpacp.exe142⤵PID:2308
-
C:\Windows\SysWOW64\Popeif32.exeC:\Windows\system32\Popeif32.exe143⤵PID:308
-
C:\Windows\SysWOW64\Qnebjc32.exeC:\Windows\system32\Qnebjc32.exe144⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:240 -
C:\Windows\SysWOW64\Qdojgmfe.exeC:\Windows\system32\Qdojgmfe.exe145⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1584 -
C:\Windows\SysWOW64\Qkibcg32.exeC:\Windows\system32\Qkibcg32.exe146⤵PID:2716
-
C:\Windows\SysWOW64\Qhmcmk32.exeC:\Windows\system32\Qhmcmk32.exe147⤵PID:2504
-
C:\Windows\SysWOW64\Aqhhanig.exeC:\Windows\system32\Aqhhanig.exe148⤵PID:2012
-
C:\Windows\SysWOW64\Ajqljc32.exeC:\Windows\system32\Ajqljc32.exe149⤵PID:1928
-
C:\Windows\SysWOW64\Aqjdgmgd.exeC:\Windows\system32\Aqjdgmgd.exe150⤵PID:2668
-
C:\Windows\SysWOW64\Anneqafn.exeC:\Windows\system32\Anneqafn.exe151⤵PID:524
-
C:\Windows\SysWOW64\Aopahjll.exeC:\Windows\system32\Aopahjll.exe152⤵PID:2052
-
C:\Windows\SysWOW64\Amcbankf.exeC:\Windows\system32\Amcbankf.exe153⤵
- Modifies registry class
PID:2732 -
C:\Windows\SysWOW64\Abpjjeim.exeC:\Windows\system32\Abpjjeim.exe154⤵PID:1464
-
C:\Windows\SysWOW64\Akiobk32.exeC:\Windows\system32\Akiobk32.exe155⤵PID:3040
-
C:\Windows\SysWOW64\Beackp32.exeC:\Windows\system32\Beackp32.exe156⤵PID:2620
-
C:\Windows\SysWOW64\Bkklhjnk.exeC:\Windows\system32\Bkklhjnk.exe157⤵PID:2112
-
C:\Windows\SysWOW64\Becpap32.exeC:\Windows\system32\Becpap32.exe158⤵PID:1328
-
C:\Windows\SysWOW64\Bgblmk32.exeC:\Windows\system32\Bgblmk32.exe159⤵PID:2512
-
C:\Windows\SysWOW64\Boidnh32.exeC:\Windows\system32\Boidnh32.exe160⤵PID:2692
-
C:\Windows\SysWOW64\Bnnaoe32.exeC:\Windows\system32\Bnnaoe32.exe161⤵PID:2280
-
C:\Windows\SysWOW64\Behilopf.exeC:\Windows\system32\Behilopf.exe162⤵
- Modifies registry class
PID:2804 -
C:\Windows\SysWOW64\Bmcnqama.exeC:\Windows\system32\Bmcnqama.exe163⤵PID:608
-
C:\Windows\SysWOW64\Bgibnj32.exeC:\Windows\system32\Bgibnj32.exe164⤵PID:2060
-
C:\Windows\SysWOW64\Ccpcckck.exeC:\Windows\system32\Ccpcckck.exe165⤵PID:2116
-
C:\Windows\SysWOW64\Cillkbac.exeC:\Windows\system32\Cillkbac.exe166⤵PID:2756
-
C:\Windows\SysWOW64\Ciohqa32.exeC:\Windows\system32\Ciohqa32.exe167⤵PID:2548
-
C:\Windows\SysWOW64\Cbgmigeq.exeC:\Windows\system32\Cbgmigeq.exe168⤵PID:1340
-
C:\Windows\SysWOW64\Cmmagpef.exeC:\Windows\system32\Cmmagpef.exe169⤵PID:2236
-
C:\Windows\SysWOW64\Cbiiog32.exeC:\Windows\system32\Cbiiog32.exe170⤵
- Modifies registry class
PID:2508 -
C:\Windows\SysWOW64\Cpmjhk32.exeC:\Windows\system32\Cpmjhk32.exe171⤵PID:1384
-
C:\Windows\SysWOW64\Difnaqih.exeC:\Windows\system32\Difnaqih.exe172⤵PID:1776
-
C:\Windows\SysWOW64\Dbncjf32.exeC:\Windows\system32\Dbncjf32.exe173⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2608 -
C:\Windows\SysWOW64\Demofaol.exeC:\Windows\system32\Demofaol.exe174⤵PID:2376
-
C:\Windows\SysWOW64\Dmhdkdlg.exeC:\Windows\system32\Dmhdkdlg.exe175⤵PID:2988
-
C:\Windows\SysWOW64\Dhmhhmlm.exeC:\Windows\system32\Dhmhhmlm.exe176⤵
- Drops file in System32 directory
PID:2740 -
C:\Windows\SysWOW64\Dmjqpdje.exeC:\Windows\system32\Dmjqpdje.exe177⤵PID:1064
-
C:\Windows\SysWOW64\Dhpemm32.exeC:\Windows\system32\Dhpemm32.exe178⤵PID:2728
-
C:\Windows\SysWOW64\Dpkibo32.exeC:\Windows\system32\Dpkibo32.exe179⤵PID:1632
-
C:\Windows\SysWOW64\Epmfgo32.exeC:\Windows\system32\Epmfgo32.exe180⤵PID:2812
-
C:\Windows\SysWOW64\Eejopecj.exeC:\Windows\system32\Eejopecj.exe181⤵
- Drops file in System32 directory
PID:3000 -
C:\Windows\SysWOW64\Eppcmncq.exeC:\Windows\system32\Eppcmncq.exe182⤵PID:2684
-
C:\Windows\SysWOW64\Eelkeeah.exeC:\Windows\system32\Eelkeeah.exe183⤵PID:2444
-
C:\Windows\SysWOW64\Elfcbo32.exeC:\Windows\system32\Elfcbo32.exe184⤵PID:2020
-
C:\Windows\SysWOW64\Ehmdgp32.exeC:\Windows\system32\Ehmdgp32.exe185⤵PID:3064
-
C:\Windows\SysWOW64\Eddeladm.exeC:\Windows\system32\Eddeladm.exe186⤵PID:960
-
C:\Windows\SysWOW64\Enlidg32.exeC:\Windows\system32\Enlidg32.exe187⤵PID:2432
-
C:\Windows\SysWOW64\Fhbnbpjc.exeC:\Windows\system32\Fhbnbpjc.exe188⤵
- Modifies registry class
PID:1680 -
C:\Windows\SysWOW64\Fpmbfbgo.exeC:\Windows\system32\Fpmbfbgo.exe189⤵PID:2496
-
C:\Windows\SysWOW64\Fkbgckgd.exeC:\Windows\system32\Fkbgckgd.exe190⤵PID:2828
-
C:\Windows\SysWOW64\Famope32.exeC:\Windows\system32\Famope32.exe191⤵
- Drops file in System32 directory
PID:1892 -
C:\Windows\SysWOW64\Fgigil32.exeC:\Windows\system32\Fgigil32.exe192⤵
- Modifies registry class
PID:2848 -
C:\Windows\SysWOW64\Fcphnm32.exeC:\Windows\system32\Fcphnm32.exe193⤵PID:1208
-
C:\Windows\SysWOW64\Fnflke32.exeC:\Windows\system32\Fnflke32.exe194⤵PID:768
-
C:\Windows\SysWOW64\Ffaaoh32.exeC:\Windows\system32\Ffaaoh32.exe195⤵PID:1568
-
C:\Windows\SysWOW64\Gbhbdi32.exeC:\Windows\system32\Gbhbdi32.exe196⤵
- Drops file in System32 directory
- Modifies registry class
PID:2672 -
C:\Windows\SysWOW64\Golbnm32.exeC:\Windows\system32\Golbnm32.exe197⤵PID:372
-
C:\Windows\SysWOW64\Gfejjgli.exeC:\Windows\system32\Gfejjgli.exe198⤵PID:1996
-
C:\Windows\SysWOW64\Gnaooi32.exeC:\Windows\system32\Gnaooi32.exe199⤵PID:1960
-
C:\Windows\SysWOW64\Ggicgopd.exeC:\Windows\system32\Ggicgopd.exe200⤵PID:3096
-
C:\Windows\SysWOW64\Gqahqd32.exeC:\Windows\system32\Gqahqd32.exe201⤵PID:3136
-
C:\Windows\SysWOW64\Hlgimqhf.exeC:\Windows\system32\Hlgimqhf.exe202⤵PID:3180
-
C:\Windows\SysWOW64\Hbaaik32.exeC:\Windows\system32\Hbaaik32.exe203⤵PID:3220
-
C:\Windows\SysWOW64\Ihniaa32.exeC:\Windows\system32\Ihniaa32.exe204⤵PID:3260
-
C:\Windows\SysWOW64\Iafnjg32.exeC:\Windows\system32\Iafnjg32.exe205⤵PID:3300
-
C:\Windows\SysWOW64\Iimfld32.exeC:\Windows\system32\Iimfld32.exe206⤵
- Drops file in System32 directory
PID:3340 -
C:\Windows\SysWOW64\Iahkpg32.exeC:\Windows\system32\Iahkpg32.exe207⤵
- Modifies registry class
PID:3380 -
C:\Windows\SysWOW64\Ijqoilii.exeC:\Windows\system32\Ijqoilii.exe208⤵PID:3420
-
C:\Windows\SysWOW64\Ihdpbq32.exeC:\Windows\system32\Ihdpbq32.exe209⤵PID:3460
-
C:\Windows\SysWOW64\Iamdkfnc.exeC:\Windows\system32\Iamdkfnc.exe210⤵PID:3500
-
C:\Windows\SysWOW64\Iihiphln.exeC:\Windows\system32\Iihiphln.exe211⤵PID:3540
-
C:\Windows\SysWOW64\Jpbalb32.exeC:\Windows\system32\Jpbalb32.exe212⤵PID:3580
-
C:\Windows\SysWOW64\Jliaac32.exeC:\Windows\system32\Jliaac32.exe213⤵PID:3620
-
C:\Windows\SysWOW64\Jeafjiop.exeC:\Windows\system32\Jeafjiop.exe214⤵
- Drops file in System32 directory
PID:3664 -
C:\Windows\SysWOW64\Jpgjgboe.exeC:\Windows\system32\Jpgjgboe.exe215⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3704 -
C:\Windows\SysWOW64\Jedcpi32.exeC:\Windows\system32\Jedcpi32.exe216⤵PID:3744
-
C:\Windows\SysWOW64\Jpigma32.exeC:\Windows\system32\Jpigma32.exe217⤵PID:3784
-
C:\Windows\SysWOW64\Jefpeh32.exeC:\Windows\system32\Jefpeh32.exe218⤵PID:3824
-
C:\Windows\SysWOW64\Jkchmo32.exeC:\Windows\system32\Jkchmo32.exe219⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3864 -
C:\Windows\SysWOW64\Jampjian.exeC:\Windows\system32\Jampjian.exe220⤵PID:3908
-
C:\Windows\SysWOW64\Klbdgb32.exeC:\Windows\system32\Klbdgb32.exe221⤵
- Drops file in System32 directory
PID:3948 -
C:\Windows\SysWOW64\Kaompi32.exeC:\Windows\system32\Kaompi32.exe222⤵PID:3988
-
C:\Windows\SysWOW64\Kocmim32.exeC:\Windows\system32\Kocmim32.exe223⤵PID:4028
-
C:\Windows\SysWOW64\Khkbbc32.exeC:\Windows\system32\Khkbbc32.exe224⤵PID:4068
-
C:\Windows\SysWOW64\Kadfkhkf.exeC:\Windows\system32\Kadfkhkf.exe225⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2276 -
C:\Windows\SysWOW64\Kcecbq32.exeC:\Windows\system32\Kcecbq32.exe226⤵PID:3124
-
C:\Windows\SysWOW64\Knkgpi32.exeC:\Windows\system32\Knkgpi32.exe227⤵PID:3188
-
C:\Windows\SysWOW64\Kcgphp32.exeC:\Windows\system32\Kcgphp32.exe228⤵PID:3208
-
C:\Windows\SysWOW64\Knmdeioh.exeC:\Windows\system32\Knmdeioh.exe229⤵PID:3276
-
C:\Windows\SysWOW64\Lfhhjklc.exeC:\Windows\system32\Lfhhjklc.exe230⤵PID:3324
-
C:\Windows\SysWOW64\Loqmba32.exeC:\Windows\system32\Loqmba32.exe231⤵PID:3368
-
C:\Windows\SysWOW64\Lldmleam.exeC:\Windows\system32\Lldmleam.exe232⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3428 -
C:\Windows\SysWOW64\Ldpbpgoh.exeC:\Windows\system32\Ldpbpgoh.exe233⤵PID:3472
-
C:\Windows\SysWOW64\Loefnpnn.exeC:\Windows\system32\Loefnpnn.exe234⤵
- Drops file in System32 directory
PID:3528 -
C:\Windows\SysWOW64\Lgqkbb32.exeC:\Windows\system32\Lgqkbb32.exe235⤵PID:3568
-
C:\Windows\SysWOW64\Lbfook32.exeC:\Windows\system32\Lbfook32.exe236⤵
- Modifies registry class
PID:3628 -
C:\Windows\SysWOW64\Mkndhabp.exeC:\Windows\system32\Mkndhabp.exe237⤵PID:3684
-
C:\Windows\SysWOW64\Mnmpdlac.exeC:\Windows\system32\Mnmpdlac.exe238⤵PID:3728
-
C:\Windows\SysWOW64\Mcjhmcok.exeC:\Windows\system32\Mcjhmcok.exe239⤵PID:3772
-
C:\Windows\SysWOW64\Mqnifg32.exeC:\Windows\system32\Mqnifg32.exe240⤵PID:3796
-
C:\Windows\SysWOW64\Mnaiol32.exeC:\Windows\system32\Mnaiol32.exe241⤵PID:3880
-
C:\Windows\SysWOW64\Mmgfqh32.exeC:\Windows\system32\Mmgfqh32.exe242⤵PID:3932