Analysis
-
max time kernel
145s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:20
Static task
static1
Behavioral task
behavioral1
Sample
6bee0a752fcbab0044af170e33af07fb55b4144aefdeb415f8d96b65aec176db.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6bee0a752fcbab0044af170e33af07fb55b4144aefdeb415f8d96b65aec176db.exe
Resource
win10v2004-20240508-en
General
-
Target
6bee0a752fcbab0044af170e33af07fb55b4144aefdeb415f8d96b65aec176db.exe
-
Size
451KB
-
MD5
06a3775188713fe7636db661be41a4d0
-
SHA1
cdcc186cfd4d6852ecf81492d1bf5bf507e390ef
-
SHA256
6bee0a752fcbab0044af170e33af07fb55b4144aefdeb415f8d96b65aec176db
-
SHA512
b8d78dbd7e37fb16a5d44ff4866787ecdd431aa3615ece755666c29b8170623dfb2d82650a17bb703bf12e2fcd637415ab33d47b2d66831cf8f2b68ffe01d82b
-
SSDEEP
6144:Ws0K+bFTuF/GhGuPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6Y:Uxs/NcZ7/NC64tm6Y
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Akcldl32.exeGjicfk32.exeMeljbqna.exeIhhcbf32.exeMldgbcoe.exeJplkmgol.exeCapdpcge.exeIopeoknn.exeIijfoh32.exeBkmhnjlh.exeMjqmig32.exePaocnkph.exeFqffgapf.exeGjkcod32.exeJidbifmb.exeGjbmelgm.exeChgnneiq.exePnfpjc32.exeDcbnpgkh.exeObcffefa.exeKmnlhg32.exeDpmgao32.exeDcpmijqc.exeJikeeh32.exeEbfqfpop.exeEiilge32.exeBmcnqama.exeMjcaimgg.exeDjdgic32.exePbgjgomc.exeOddphp32.exeLbnpkmfg.exeMjkndb32.exeNpmphinm.exeCjboeenh.exeDphmloih.exeGajjhkgh.exeDnjalhpp.exePaiaplin.exeDooqceid.exeJgbmco32.exeFgjkmijh.exeIekgod32.exeMhfhaoec.exeAopahjll.exeEpkepakn.exeJeoeclek.exeKfkpknkq.exeGcedad32.exeHjddaj32.exeOhpnag32.exeIphecepe.exeOaghki32.exeDeakjjbk.exeLamjph32.exeAfjjed32.exeNfdfmfle.exeNgkaaolf.exeFefqdl32.exeEndklmlq.exeAnhpkg32.exeQpniokan.exeAeenapck.exeElmkmo32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akcldl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjicfk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Meljbqna.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ihhcbf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mldgbcoe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jplkmgol.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Capdpcge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iopeoknn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iijfoh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkmhnjlh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mjqmig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Paocnkph.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fqffgapf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjkcod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jidbifmb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjbmelgm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Chgnneiq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pnfpjc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcbnpgkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Obcffefa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kmnlhg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpmgao32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcpmijqc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jikeeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ebfqfpop.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eiilge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bmcnqama.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjcaimgg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djdgic32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pbgjgomc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oddphp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lbnpkmfg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjkndb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Npmphinm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cjboeenh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dphmloih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gajjhkgh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dnjalhpp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Paiaplin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dooqceid.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgbmco32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fgjkmijh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iekgod32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhfhaoec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aopahjll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Epkepakn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jeoeclek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kfkpknkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gcedad32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjddaj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohpnag32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iphecepe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oaghki32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Deakjjbk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lamjph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Afjjed32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nfdfmfle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ngkaaolf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fefqdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Endklmlq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Anhpkg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qpniokan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aeenapck.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Elmkmo32.exe -
Executes dropped EXE 64 IoCs
Processes:
Oionacqo.exeOgekpg32.exePkljdj32.exePnmcfeia.exePjfpafmb.exeQglmpi32.exeAbhkfg32.exeAollokco.exeAkcldl32.exeBgnfdm32.exeBgqcjlhp.exeBaigca32.exeCljodo32.exeChqoipkk.exeChcloo32.exeDbojdmcd.exeDikogf32.exeDedlag32.exeDomqjm32.exeEheecbia.exeEhgbhbgn.exeEapfagno.exeEdqocbkp.exeEjmhkiig.exeEgahen32.exeEqjmncna.exeFbdlkj32.exeGbfiaj32.exeGjbmelgm.exeGghkdp32.exeGmecmg32.exeGjicfk32.exeHfpdkl32.exeHllmcc32.exeHloiib32.exeHegnahjo.exeHnpbjnpo.exeHelgmg32.exeIabhah32.exeIphecepe.exeImleli32.exeIbhndp32.exeImnbbi32.exeIbkkjp32.exeIhhcbf32.exeIoakoq32.exeJlelhe32.exeJabdql32.exeJlhhndno.exeJaeafklf.exeJgaiobjn.exeJagnlkjd.exeJgdfdbhk.exeJplkmgol.exeJlckbh32.exeKfkpknkq.exeKgkleabc.exeKlhemhpk.exeKbdmeoob.exeKjleflod.exeKohnoc32.exeKdefgj32.exeKbigpn32.exeKgfoie32.exepid process 2632 Oionacqo.exe 2852 Ogekpg32.exe 3064 Pkljdj32.exe 2512 Pnmcfeia.exe 2404 Pjfpafmb.exe 2392 Qglmpi32.exe 1480 Abhkfg32.exe 536 Aollokco.exe 2668 Akcldl32.exe 1960 Bgnfdm32.exe 1080 Bgqcjlhp.exe 2172 Baigca32.exe 540 Cljodo32.exe 924 Chqoipkk.exe 2264 Chcloo32.exe 664 Dbojdmcd.exe 2980 Dikogf32.exe 2928 Dedlag32.exe 1548 Domqjm32.exe 340 Eheecbia.exe 1984 Ehgbhbgn.exe 320 Eapfagno.exe 1520 Edqocbkp.exe 1740 Ejmhkiig.exe 2088 Egahen32.exe 820 Eqjmncna.exe 2428 Fbdlkj32.exe 2856 Gbfiaj32.exe 2580 Gjbmelgm.exe 2484 Gghkdp32.exe 2516 Gmecmg32.exe 2372 Gjicfk32.exe 2804 Hfpdkl32.exe 1108 Hllmcc32.exe 2588 Hloiib32.exe 1608 Hegnahjo.exe 1808 Hnpbjnpo.exe 756 Helgmg32.exe 2040 Iabhah32.exe 804 Iphecepe.exe 880 Imleli32.exe 1556 Ibhndp32.exe 2248 Imnbbi32.exe 2136 Ibkkjp32.exe 2896 Ihhcbf32.exe 1540 Ioakoq32.exe 888 Jlelhe32.exe 940 Jabdql32.exe 860 Jlhhndno.exe 2820 Jaeafklf.exe 1800 Jgaiobjn.exe 2824 Jagnlkjd.exe 2532 Jgdfdbhk.exe 2884 Jplkmgol.exe 2604 Jlckbh32.exe 2056 Kfkpknkq.exe 1236 Kgkleabc.exe 564 Klhemhpk.exe 2780 Kbdmeoob.exe 1228 Kjleflod.exe 1620 Kohnoc32.exe 3020 Kdefgj32.exe 1732 Kbigpn32.exe 2624 Kgfoie32.exe -
Loads dropped DLL 64 IoCs
Processes:
6bee0a752fcbab0044af170e33af07fb55b4144aefdeb415f8d96b65aec176db.exeOionacqo.exeOgekpg32.exePkljdj32.exePnmcfeia.exePjfpafmb.exeQglmpi32.exeAbhkfg32.exeAollokco.exeAkcldl32.exeBgnfdm32.exeBgqcjlhp.exeBaigca32.exeCljodo32.exeChqoipkk.exeChcloo32.exeDbojdmcd.exeDikogf32.exeDedlag32.exeDomqjm32.exeEheecbia.exeEhgbhbgn.exeEapfagno.exeEdqocbkp.exeEjmhkiig.exeEgahen32.exeEqjmncna.exeFbdlkj32.exeGbfiaj32.exeGjbmelgm.exeGghkdp32.exeGmecmg32.exepid process 1664 6bee0a752fcbab0044af170e33af07fb55b4144aefdeb415f8d96b65aec176db.exe 1664 6bee0a752fcbab0044af170e33af07fb55b4144aefdeb415f8d96b65aec176db.exe 2632 Oionacqo.exe 2632 Oionacqo.exe 2852 Ogekpg32.exe 2852 Ogekpg32.exe 3064 Pkljdj32.exe 3064 Pkljdj32.exe 2512 Pnmcfeia.exe 2512 Pnmcfeia.exe 2404 Pjfpafmb.exe 2404 Pjfpafmb.exe 2392 Qglmpi32.exe 2392 Qglmpi32.exe 1480 Abhkfg32.exe 1480 Abhkfg32.exe 536 Aollokco.exe 536 Aollokco.exe 2668 Akcldl32.exe 2668 Akcldl32.exe 1960 Bgnfdm32.exe 1960 Bgnfdm32.exe 1080 Bgqcjlhp.exe 1080 Bgqcjlhp.exe 2172 Baigca32.exe 2172 Baigca32.exe 540 Cljodo32.exe 540 Cljodo32.exe 924 Chqoipkk.exe 924 Chqoipkk.exe 2264 Chcloo32.exe 2264 Chcloo32.exe 664 Dbojdmcd.exe 664 Dbojdmcd.exe 2980 Dikogf32.exe 2980 Dikogf32.exe 2928 Dedlag32.exe 2928 Dedlag32.exe 1548 Domqjm32.exe 1548 Domqjm32.exe 340 Eheecbia.exe 340 Eheecbia.exe 1984 Ehgbhbgn.exe 1984 Ehgbhbgn.exe 320 Eapfagno.exe 320 Eapfagno.exe 1520 Edqocbkp.exe 1520 Edqocbkp.exe 1740 Ejmhkiig.exe 1740 Ejmhkiig.exe 2088 Egahen32.exe 2088 Egahen32.exe 820 Eqjmncna.exe 820 Eqjmncna.exe 2428 Fbdlkj32.exe 2428 Fbdlkj32.exe 2856 Gbfiaj32.exe 2856 Gbfiaj32.exe 2580 Gjbmelgm.exe 2580 Gjbmelgm.exe 2484 Gghkdp32.exe 2484 Gghkdp32.exe 2516 Gmecmg32.exe 2516 Gmecmg32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Iknafhjb.exeCqleifna.exeCjjpag32.exeOfgbkacb.exeQqoaefke.exeCagienkb.exeHonnki32.exeOmiand32.exeGpeoakhc.exeQgmfchei.exeKhghgchk.exeAebmjo32.exeNdfpnl32.exeAmmoel32.exePkljdj32.exeJplkmgol.exeLqejbiim.exeCfcijf32.exeLboiol32.exePaknelgk.exeCchbgi32.exeLdjmidcj.exePkjphcff.exeKdphjm32.exeOchcem32.exeDdkbqfcp.exeNenakoho.exeDmijfmfi.exePjleclph.exeQfikod32.exeFiedfb32.exePkfiaqgk.exeLblcfnhj.exeHkdemk32.exeLmpcca32.exeDiidjpbe.exeKaglcgdc.exeLmfgkh32.exeKnddcg32.exeHcajhi32.exeEannmi32.exeKngekdnf.exePiohgbng.exeMidnqh32.exeEcjibgdh.exe6bee0a752fcbab0044af170e33af07fb55b4144aefdeb415f8d96b65aec176db.exeEndklmlq.exeEaednh32.exeMehpga32.exeNegeln32.exeAlmihjlj.exeNlilqbgp.exeCgidfcdk.exeJflgph32.exeKmdofebo.exeDlhdjh32.exeFlclam32.exeFliook32.exeLpckce32.exeFmlglb32.exeQglmpi32.exeJabdql32.exeMmadbjkk.exeNcnngfna.exedescription ioc process File created C:\Windows\SysWOW64\Jggoqimd.exe Iknafhjb.exe File created C:\Windows\SysWOW64\Dgfmep32.exe Cqleifna.exe File opened for modification C:\Windows\SysWOW64\Cceapl32.exe Cjjpag32.exe File created C:\Windows\SysWOW64\Gllnei32.dll Ofgbkacb.exe File created C:\Windows\SysWOW64\Hoeqmeoo.dll Qqoaefke.exe File created C:\Windows\SysWOW64\Jhogdg32.dll Cagienkb.exe File created C:\Windows\SysWOW64\Qhehaf32.dll Honnki32.exe File opened for modification C:\Windows\SysWOW64\Ochcem32.exe Omiand32.exe File created C:\Windows\SysWOW64\Facahjoh.dll Gpeoakhc.exe File created C:\Windows\SysWOW64\Qngopb32.exe Qgmfchei.exe File opened for modification C:\Windows\SysWOW64\Kglehp32.exe Khghgchk.exe File created C:\Windows\SysWOW64\Aacinhhc.dll Aebmjo32.exe File opened for modification C:\Windows\SysWOW64\Nqmqcmdh.exe Ndfpnl32.exe File created C:\Windows\SysWOW64\Nfhpah32.dll Ammoel32.exe File opened for modification C:\Windows\SysWOW64\Pnmcfeia.exe Pkljdj32.exe File opened for modification C:\Windows\SysWOW64\Jlckbh32.exe Jplkmgol.exe File created C:\Windows\SysWOW64\Lomlhpoi.dll Lqejbiim.exe File created C:\Windows\SysWOW64\Cmmagpef.exe Cfcijf32.exe File created C:\Windows\SysWOW64\Lcofio32.exe Lboiol32.exe File created C:\Windows\SysWOW64\Pifbjn32.exe Paknelgk.exe File opened for modification C:\Windows\SysWOW64\Ccjoli32.exe Cchbgi32.exe File created C:\Windows\SysWOW64\Llebnfpe.exe Ldjmidcj.exe File created C:\Windows\SysWOW64\Pkmlmbcd.exe Pkjphcff.exe File created C:\Windows\SysWOW64\Bodilc32.dll Kdphjm32.exe File opened for modification C:\Windows\SysWOW64\Oielnd32.exe Ochcem32.exe File created C:\Windows\SysWOW64\Dkekmp32.exe Ddkbqfcp.exe File created C:\Windows\SysWOW64\Jinafidh.dll Nenakoho.exe File created C:\Windows\SysWOW64\Epmadeed.dll Dmijfmfi.exe File created C:\Windows\SysWOW64\Kfkigdmm.dll Pjleclph.exe File created C:\Windows\SysWOW64\Oellihpf.dll Qfikod32.exe File opened for modification C:\Windows\SysWOW64\Fhkagonc.exe Fiedfb32.exe File created C:\Windows\SysWOW64\Phjjkefd.exe Pkfiaqgk.exe File created C:\Windows\SysWOW64\Kjnmgq32.dll Lblcfnhj.exe File created C:\Windows\SysWOW64\Hcojam32.exe Hkdemk32.exe File opened for modification C:\Windows\SysWOW64\Lifcib32.exe Lmpcca32.exe File opened for modification C:\Windows\SysWOW64\Dbaice32.exe Diidjpbe.exe File opened for modification C:\Windows\SysWOW64\Kokmmkcm.exe Kaglcgdc.exe File created C:\Windows\SysWOW64\Lfnlcnih.exe Lmfgkh32.exe File created C:\Windows\SysWOW64\Ffeejokj.dll Knddcg32.exe File opened for modification C:\Windows\SysWOW64\Hbggif32.exe Hcajhi32.exe File opened for modification C:\Windows\SysWOW64\Endklmlq.exe Eannmi32.exe File created C:\Windows\SysWOW64\Kbenacdm.exe Kngekdnf.exe File opened for modification C:\Windows\SysWOW64\Pmmqmpdm.exe Piohgbng.exe File created C:\Windows\SysWOW64\Bgbjkg32.dll Midnqh32.exe File created C:\Windows\SysWOW64\Fpnqhfkm.dll Ecjibgdh.exe File opened for modification C:\Windows\SysWOW64\Oionacqo.exe 6bee0a752fcbab0044af170e33af07fb55b4144aefdeb415f8d96b65aec176db.exe File created C:\Windows\SysWOW64\Ecadddjh.exe Endklmlq.exe File created C:\Windows\SysWOW64\Ebfqfpop.exe Eaednh32.exe File opened for modification C:\Windows\SysWOW64\Maoalb32.exe Mehpga32.exe File created C:\Windows\SysWOW64\Hmhonm32.dll Negeln32.exe File created C:\Windows\SysWOW64\Aeenapck.exe Almihjlj.exe File created C:\Windows\SysWOW64\Dggajf32.dll Nlilqbgp.exe File created C:\Windows\SysWOW64\Cglalbbi.exe Cgidfcdk.exe File opened for modification C:\Windows\SysWOW64\Jhkclc32.exe Jflgph32.exe File opened for modification C:\Windows\SysWOW64\Kcngcp32.exe Kmdofebo.exe File created C:\Windows\SysWOW64\Mpbgcj32.dll Dlhdjh32.exe File created C:\Windows\SysWOW64\Fcmdnfad.exe Flclam32.exe File opened for modification C:\Windows\SysWOW64\Gcedad32.exe Fliook32.exe File created C:\Windows\SysWOW64\Djdbeobe.dll Lpckce32.exe File created C:\Windows\SysWOW64\Lclgbcdk.dll Fmlglb32.exe File opened for modification C:\Windows\SysWOW64\Abhkfg32.exe Qglmpi32.exe File created C:\Windows\SysWOW64\Acapig32.dll Jabdql32.exe File opened for modification C:\Windows\SysWOW64\Mihdgkpp.exe Mmadbjkk.exe File created C:\Windows\SysWOW64\Ieocod32.dll Ncnngfna.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1996 4776 WerFault.exe Eceimadb.exe -
Modifies registry class 64 IoCs
Processes:
Hmneebeb.exeGdjcjf32.exeGenlgnhd.exeIlgjhena.exeJihdnk32.exeHnnhngjf.exeOdmckcmq.exePjoklkie.exePnfnajed.exeBgkbfcck.exeJlqjkk32.exeGbmoceol.exeDdkbqfcp.exeLblcfnhj.exeIefcfe32.exeBlkjkflb.exeNeohqicc.exeDhodpidl.exeBgnfdm32.exeQhmcmk32.exeLhlqjone.exeBoemlbpk.exeDemaoj32.exeNhepoaif.exeNqmqcmdh.exeDpmgao32.exeKadfkhkf.exeGfnjne32.exeLlmmpcfe.exeDcpmijqc.exeOcqhcqgk.exeEfmoib32.exeMhfhaoec.exeMihdgkpp.exeJelfdc32.exeKmdofebo.exeHdkaabnh.exeFgjkmijh.exeNcnjeh32.exeKaekljjo.exeMnpobefe.exeQboikm32.exeFbngfo32.exeBebfpm32.exeLbnpkmfg.exeCopjdhib.exeLlpfjomf.exeIfpcchai.exeBbfnchfb.exeEjgeogmn.exeDedlag32.exeQkffng32.exeDobgihgp.exeDlofgj32.exeEjaphpnp.exeAiknnf32.exeKbdmeoob.exeMeabakda.exeDemofaol.exePncjad32.exeLdjmidcj.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hmneebeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gdjcjf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Genlgnhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ilgjhena.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jihdnk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hnnhngjf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Odmckcmq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pjoklkie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aknpmobg.dll" Pnfnajed.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bgkbfcck.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jlqjkk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gbmoceol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjgmammj.dll" Ddkbqfcp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lblcfnhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iefcfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egldgl32.dll" Blkjkflb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Neohqicc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfkfbm32.dll" Dhodpidl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bgnfdm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qhmcmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lhlqjone.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Boemlbpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjfkgcdc.dll" Demaoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hefnockl.dll" Nhepoaif.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nqmqcmdh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dpmgao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kadfkhkf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gfnjne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmmjqf32.dll" Llmmpcfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dcpmijqc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ocqhcqgk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Efmoib32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ocqhcqgk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mhfhaoec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mihdgkpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jelfdc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kmdofebo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qnogkqfo.dll" Hdkaabnh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fgjkmijh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Demaoj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ncnjeh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kaekljjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mnpobefe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qboikm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fbngfo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bebfpm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lbnpkmfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Copjdhib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Llpfjomf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ifpcchai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojeffiih.dll" Bbfnchfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ejgeogmn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dedlag32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qkffng32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dobgihgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dlofgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfenefej.dll" Ejaphpnp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knohabdl.dll" Aiknnf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbknmg32.dll" Kbdmeoob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gplaplgi.dll" Meabakda.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Demofaol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pncjad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Miepgfmf.dll" Ldjmidcj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dhodpidl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6bee0a752fcbab0044af170e33af07fb55b4144aefdeb415f8d96b65aec176db.exeOionacqo.exeOgekpg32.exePkljdj32.exePnmcfeia.exePjfpafmb.exeQglmpi32.exeAbhkfg32.exeAollokco.exeAkcldl32.exeBgnfdm32.exeBgqcjlhp.exeBaigca32.exeCljodo32.exeChqoipkk.exeChcloo32.exedescription pid process target process PID 1664 wrote to memory of 2632 1664 6bee0a752fcbab0044af170e33af07fb55b4144aefdeb415f8d96b65aec176db.exe Oionacqo.exe PID 1664 wrote to memory of 2632 1664 6bee0a752fcbab0044af170e33af07fb55b4144aefdeb415f8d96b65aec176db.exe Oionacqo.exe PID 1664 wrote to memory of 2632 1664 6bee0a752fcbab0044af170e33af07fb55b4144aefdeb415f8d96b65aec176db.exe Oionacqo.exe PID 1664 wrote to memory of 2632 1664 6bee0a752fcbab0044af170e33af07fb55b4144aefdeb415f8d96b65aec176db.exe Oionacqo.exe PID 2632 wrote to memory of 2852 2632 Oionacqo.exe Ogekpg32.exe PID 2632 wrote to memory of 2852 2632 Oionacqo.exe Ogekpg32.exe PID 2632 wrote to memory of 2852 2632 Oionacqo.exe Ogekpg32.exe PID 2632 wrote to memory of 2852 2632 Oionacqo.exe Ogekpg32.exe PID 2852 wrote to memory of 3064 2852 Ogekpg32.exe Pkljdj32.exe PID 2852 wrote to memory of 3064 2852 Ogekpg32.exe Pkljdj32.exe PID 2852 wrote to memory of 3064 2852 Ogekpg32.exe Pkljdj32.exe PID 2852 wrote to memory of 3064 2852 Ogekpg32.exe Pkljdj32.exe PID 3064 wrote to memory of 2512 3064 Pkljdj32.exe Pnmcfeia.exe PID 3064 wrote to memory of 2512 3064 Pkljdj32.exe Pnmcfeia.exe PID 3064 wrote to memory of 2512 3064 Pkljdj32.exe Pnmcfeia.exe PID 3064 wrote to memory of 2512 3064 Pkljdj32.exe Pnmcfeia.exe PID 2512 wrote to memory of 2404 2512 Pnmcfeia.exe Pjfpafmb.exe PID 2512 wrote to memory of 2404 2512 Pnmcfeia.exe Pjfpafmb.exe PID 2512 wrote to memory of 2404 2512 Pnmcfeia.exe Pjfpafmb.exe PID 2512 wrote to memory of 2404 2512 Pnmcfeia.exe Pjfpafmb.exe PID 2404 wrote to memory of 2392 2404 Pjfpafmb.exe Qglmpi32.exe PID 2404 wrote to memory of 2392 2404 Pjfpafmb.exe Qglmpi32.exe PID 2404 wrote to memory of 2392 2404 Pjfpafmb.exe Qglmpi32.exe PID 2404 wrote to memory of 2392 2404 Pjfpafmb.exe Qglmpi32.exe PID 2392 wrote to memory of 1480 2392 Qglmpi32.exe Abhkfg32.exe PID 2392 wrote to memory of 1480 2392 Qglmpi32.exe Abhkfg32.exe PID 2392 wrote to memory of 1480 2392 Qglmpi32.exe Abhkfg32.exe PID 2392 wrote to memory of 1480 2392 Qglmpi32.exe Abhkfg32.exe PID 1480 wrote to memory of 536 1480 Abhkfg32.exe Aollokco.exe PID 1480 wrote to memory of 536 1480 Abhkfg32.exe Aollokco.exe PID 1480 wrote to memory of 536 1480 Abhkfg32.exe Aollokco.exe PID 1480 wrote to memory of 536 1480 Abhkfg32.exe Aollokco.exe PID 536 wrote to memory of 2668 536 Aollokco.exe Akcldl32.exe PID 536 wrote to memory of 2668 536 Aollokco.exe Akcldl32.exe PID 536 wrote to memory of 2668 536 Aollokco.exe Akcldl32.exe PID 536 wrote to memory of 2668 536 Aollokco.exe Akcldl32.exe PID 2668 wrote to memory of 1960 2668 Akcldl32.exe Bgnfdm32.exe PID 2668 wrote to memory of 1960 2668 Akcldl32.exe Bgnfdm32.exe PID 2668 wrote to memory of 1960 2668 Akcldl32.exe Bgnfdm32.exe PID 2668 wrote to memory of 1960 2668 Akcldl32.exe Bgnfdm32.exe PID 1960 wrote to memory of 1080 1960 Bgnfdm32.exe Bgqcjlhp.exe PID 1960 wrote to memory of 1080 1960 Bgnfdm32.exe Bgqcjlhp.exe PID 1960 wrote to memory of 1080 1960 Bgnfdm32.exe Bgqcjlhp.exe PID 1960 wrote to memory of 1080 1960 Bgnfdm32.exe Bgqcjlhp.exe PID 1080 wrote to memory of 2172 1080 Bgqcjlhp.exe Baigca32.exe PID 1080 wrote to memory of 2172 1080 Bgqcjlhp.exe Baigca32.exe PID 1080 wrote to memory of 2172 1080 Bgqcjlhp.exe Baigca32.exe PID 1080 wrote to memory of 2172 1080 Bgqcjlhp.exe Baigca32.exe PID 2172 wrote to memory of 540 2172 Baigca32.exe Cljodo32.exe PID 2172 wrote to memory of 540 2172 Baigca32.exe Cljodo32.exe PID 2172 wrote to memory of 540 2172 Baigca32.exe Cljodo32.exe PID 2172 wrote to memory of 540 2172 Baigca32.exe Cljodo32.exe PID 540 wrote to memory of 924 540 Cljodo32.exe Chqoipkk.exe PID 540 wrote to memory of 924 540 Cljodo32.exe Chqoipkk.exe PID 540 wrote to memory of 924 540 Cljodo32.exe Chqoipkk.exe PID 540 wrote to memory of 924 540 Cljodo32.exe Chqoipkk.exe PID 924 wrote to memory of 2264 924 Chqoipkk.exe Chcloo32.exe PID 924 wrote to memory of 2264 924 Chqoipkk.exe Chcloo32.exe PID 924 wrote to memory of 2264 924 Chqoipkk.exe Chcloo32.exe PID 924 wrote to memory of 2264 924 Chqoipkk.exe Chcloo32.exe PID 2264 wrote to memory of 664 2264 Chcloo32.exe Dbojdmcd.exe PID 2264 wrote to memory of 664 2264 Chcloo32.exe Dbojdmcd.exe PID 2264 wrote to memory of 664 2264 Chcloo32.exe Dbojdmcd.exe PID 2264 wrote to memory of 664 2264 Chcloo32.exe Dbojdmcd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bee0a752fcbab0044af170e33af07fb55b4144aefdeb415f8d96b65aec176db.exe"C:\Users\Admin\AppData\Local\Temp\6bee0a752fcbab0044af170e33af07fb55b4144aefdeb415f8d96b65aec176db.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\Oionacqo.exeC:\Windows\system32\Oionacqo.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\Ogekpg32.exeC:\Windows\system32\Ogekpg32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\Pkljdj32.exeC:\Windows\system32\Pkljdj32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\Pnmcfeia.exeC:\Windows\system32\Pnmcfeia.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\Pjfpafmb.exeC:\Windows\system32\Pjfpafmb.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\Qglmpi32.exeC:\Windows\system32\Qglmpi32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\Abhkfg32.exeC:\Windows\system32\Abhkfg32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\Aollokco.exeC:\Windows\system32\Aollokco.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\Akcldl32.exeC:\Windows\system32\Akcldl32.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\Bgnfdm32.exeC:\Windows\system32\Bgnfdm32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\Bgqcjlhp.exeC:\Windows\system32\Bgqcjlhp.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\Baigca32.exeC:\Windows\system32\Baigca32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\Cljodo32.exeC:\Windows\system32\Cljodo32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\Chqoipkk.exeC:\Windows\system32\Chqoipkk.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\Chcloo32.exeC:\Windows\system32\Chcloo32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\Dbojdmcd.exeC:\Windows\system32\Dbojdmcd.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:664 -
C:\Windows\SysWOW64\Dikogf32.exeC:\Windows\system32\Dikogf32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Windows\SysWOW64\Dedlag32.exeC:\Windows\system32\Dedlag32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2928 -
C:\Windows\SysWOW64\Domqjm32.exeC:\Windows\system32\Domqjm32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Windows\SysWOW64\Eheecbia.exeC:\Windows\system32\Eheecbia.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Windows\SysWOW64\Ehgbhbgn.exeC:\Windows\system32\Ehgbhbgn.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Windows\SysWOW64\Eapfagno.exeC:\Windows\system32\Eapfagno.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Windows\SysWOW64\Edqocbkp.exeC:\Windows\system32\Edqocbkp.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Windows\SysWOW64\Ejmhkiig.exeC:\Windows\system32\Ejmhkiig.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Windows\SysWOW64\Egahen32.exeC:\Windows\system32\Egahen32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Windows\SysWOW64\Eqjmncna.exeC:\Windows\system32\Eqjmncna.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:820 -
C:\Windows\SysWOW64\Fbdlkj32.exeC:\Windows\system32\Fbdlkj32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Windows\SysWOW64\Gbfiaj32.exeC:\Windows\system32\Gbfiaj32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Windows\SysWOW64\Gjbmelgm.exeC:\Windows\system32\Gjbmelgm.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Windows\SysWOW64\Gghkdp32.exeC:\Windows\system32\Gghkdp32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Windows\SysWOW64\Gmecmg32.exeC:\Windows\system32\Gmecmg32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Windows\SysWOW64\Gjicfk32.exeC:\Windows\system32\Gjicfk32.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2372 -
C:\Windows\SysWOW64\Hfpdkl32.exeC:\Windows\system32\Hfpdkl32.exe34⤵
- Executes dropped EXE
PID:2804 -
C:\Windows\SysWOW64\Hllmcc32.exeC:\Windows\system32\Hllmcc32.exe35⤵
- Executes dropped EXE
PID:1108 -
C:\Windows\SysWOW64\Hloiib32.exeC:\Windows\system32\Hloiib32.exe36⤵
- Executes dropped EXE
PID:2588 -
C:\Windows\SysWOW64\Hegnahjo.exeC:\Windows\system32\Hegnahjo.exe37⤵
- Executes dropped EXE
PID:1608 -
C:\Windows\SysWOW64\Hnpbjnpo.exeC:\Windows\system32\Hnpbjnpo.exe38⤵
- Executes dropped EXE
PID:1808 -
C:\Windows\SysWOW64\Helgmg32.exeC:\Windows\system32\Helgmg32.exe39⤵
- Executes dropped EXE
PID:756 -
C:\Windows\SysWOW64\Iabhah32.exeC:\Windows\system32\Iabhah32.exe40⤵
- Executes dropped EXE
PID:2040 -
C:\Windows\SysWOW64\Iphecepe.exeC:\Windows\system32\Iphecepe.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:804 -
C:\Windows\SysWOW64\Imleli32.exeC:\Windows\system32\Imleli32.exe42⤵
- Executes dropped EXE
PID:880 -
C:\Windows\SysWOW64\Ibhndp32.exeC:\Windows\system32\Ibhndp32.exe43⤵
- Executes dropped EXE
PID:1556 -
C:\Windows\SysWOW64\Imnbbi32.exeC:\Windows\system32\Imnbbi32.exe44⤵
- Executes dropped EXE
PID:2248 -
C:\Windows\SysWOW64\Ibkkjp32.exeC:\Windows\system32\Ibkkjp32.exe45⤵
- Executes dropped EXE
PID:2136 -
C:\Windows\SysWOW64\Ihhcbf32.exeC:\Windows\system32\Ihhcbf32.exe46⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2896 -
C:\Windows\SysWOW64\Ioakoq32.exeC:\Windows\system32\Ioakoq32.exe47⤵
- Executes dropped EXE
PID:1540 -
C:\Windows\SysWOW64\Jlelhe32.exeC:\Windows\system32\Jlelhe32.exe48⤵
- Executes dropped EXE
PID:888 -
C:\Windows\SysWOW64\Jabdql32.exeC:\Windows\system32\Jabdql32.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:940 -
C:\Windows\SysWOW64\Jlhhndno.exeC:\Windows\system32\Jlhhndno.exe50⤵
- Executes dropped EXE
PID:860 -
C:\Windows\SysWOW64\Jaeafklf.exeC:\Windows\system32\Jaeafklf.exe51⤵
- Executes dropped EXE
PID:2820 -
C:\Windows\SysWOW64\Jgaiobjn.exeC:\Windows\system32\Jgaiobjn.exe52⤵
- Executes dropped EXE
PID:1800 -
C:\Windows\SysWOW64\Jagnlkjd.exeC:\Windows\system32\Jagnlkjd.exe53⤵
- Executes dropped EXE
PID:2824 -
C:\Windows\SysWOW64\Jgdfdbhk.exeC:\Windows\system32\Jgdfdbhk.exe54⤵
- Executes dropped EXE
PID:2532 -
C:\Windows\SysWOW64\Jplkmgol.exeC:\Windows\system32\Jplkmgol.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2884 -
C:\Windows\SysWOW64\Jlckbh32.exeC:\Windows\system32\Jlckbh32.exe56⤵
- Executes dropped EXE
PID:2604 -
C:\Windows\SysWOW64\Kfkpknkq.exeC:\Windows\system32\Kfkpknkq.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2056 -
C:\Windows\SysWOW64\Kgkleabc.exeC:\Windows\system32\Kgkleabc.exe58⤵
- Executes dropped EXE
PID:1236 -
C:\Windows\SysWOW64\Klhemhpk.exeC:\Windows\system32\Klhemhpk.exe59⤵
- Executes dropped EXE
PID:564 -
C:\Windows\SysWOW64\Kbdmeoob.exeC:\Windows\system32\Kbdmeoob.exe60⤵
- Executes dropped EXE
- Modifies registry class
PID:2780 -
C:\Windows\SysWOW64\Kjleflod.exeC:\Windows\system32\Kjleflod.exe61⤵
- Executes dropped EXE
PID:1228 -
C:\Windows\SysWOW64\Kohnoc32.exeC:\Windows\system32\Kohnoc32.exe62⤵
- Executes dropped EXE
PID:1620 -
C:\Windows\SysWOW64\Kdefgj32.exeC:\Windows\system32\Kdefgj32.exe63⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\Kbigpn32.exeC:\Windows\system32\Kbigpn32.exe64⤵
- Executes dropped EXE
PID:1732 -
C:\Windows\SysWOW64\Kgfoie32.exeC:\Windows\system32\Kgfoie32.exe65⤵
- Executes dropped EXE
PID:2624 -
C:\Windows\SysWOW64\Lblcfnhj.exeC:\Windows\system32\Lblcfnhj.exe66⤵
- Drops file in System32 directory
- Modifies registry class
PID:2208 -
C:\Windows\SysWOW64\Lbnpkmfg.exeC:\Windows\system32\Lbnpkmfg.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2844 -
C:\Windows\SysWOW64\Lcomce32.exeC:\Windows\system32\Lcomce32.exe68⤵PID:1868
-
C:\Windows\SysWOW64\Lmgalkcf.exeC:\Windows\system32\Lmgalkcf.exe69⤵PID:3040
-
C:\Windows\SysWOW64\Ldoimh32.exeC:\Windows\system32\Ldoimh32.exe70⤵PID:1484
-
C:\Windows\SysWOW64\Lfpeeqig.exeC:\Windows\system32\Lfpeeqig.exe71⤵PID:1720
-
C:\Windows\SysWOW64\Lqejbiim.exeC:\Windows\system32\Lqejbiim.exe72⤵
- Drops file in System32 directory
PID:2772 -
C:\Windows\SysWOW64\Ljnnko32.exeC:\Windows\system32\Ljnnko32.exe73⤵PID:600
-
C:\Windows\SysWOW64\Lbicoamh.exeC:\Windows\system32\Lbicoamh.exe74⤵PID:2508
-
C:\Windows\SysWOW64\Mmogmjmn.exeC:\Windows\system32\Mmogmjmn.exe75⤵PID:2520
-
C:\Windows\SysWOW64\Mfglep32.exeC:\Windows\system32\Mfglep32.exe76⤵PID:2952
-
C:\Windows\SysWOW64\Mmadbjkk.exeC:\Windows\system32\Mmadbjkk.exe77⤵
- Drops file in System32 directory
PID:2692 -
C:\Windows\SysWOW64\Mihdgkpp.exeC:\Windows\system32\Mihdgkpp.exe78⤵
- Modifies registry class
PID:2384 -
C:\Windows\SysWOW64\Mbpipp32.exeC:\Windows\system32\Mbpipp32.exe79⤵PID:2396
-
C:\Windows\SysWOW64\Mjkndb32.exeC:\Windows\system32\Mjkndb32.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1084 -
C:\Windows\SysWOW64\Meabakda.exeC:\Windows\system32\Meabakda.exe81⤵
- Modifies registry class
PID:1824 -
C:\Windows\SysWOW64\Mjnjjbbh.exeC:\Windows\system32\Mjnjjbbh.exe82⤵PID:1764
-
C:\Windows\SysWOW64\Ncfoch32.exeC:\Windows\system32\Ncfoch32.exe83⤵PID:1048
-
C:\Windows\SysWOW64\Nmnclmoj.exeC:\Windows\system32\Nmnclmoj.exe84⤵PID:936
-
C:\Windows\SysWOW64\Npmphinm.exeC:\Windows\system32\Npmphinm.exe85⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:744 -
C:\Windows\SysWOW64\Njbdea32.exeC:\Windows\system32\Njbdea32.exe86⤵PID:3012
-
C:\Windows\SysWOW64\Ndkhngdd.exeC:\Windows\system32\Ndkhngdd.exe87⤵PID:2164
-
C:\Windows\SysWOW64\Nenakoho.exeC:\Windows\system32\Nenakoho.exe88⤵
- Drops file in System32 directory
PID:1916 -
C:\Windows\SysWOW64\Neqnqofm.exeC:\Windows\system32\Neqnqofm.exe89⤵PID:2104
-
C:\Windows\SysWOW64\Ohojmjep.exeC:\Windows\system32\Ohojmjep.exe90⤵PID:2304
-
C:\Windows\SysWOW64\Ohagbj32.exeC:\Windows\system32\Ohagbj32.exe91⤵PID:2200
-
C:\Windows\SysWOW64\Ookpodkj.exeC:\Windows\system32\Ookpodkj.exe92⤵PID:2568
-
C:\Windows\SysWOW64\Odhhgkib.exeC:\Windows\system32\Odhhgkib.exe93⤵PID:2448
-
C:\Windows\SysWOW64\Oalhqohl.exeC:\Windows\system32\Oalhqohl.exe94⤵PID:1304
-
C:\Windows\SysWOW64\Okdmjdol.exeC:\Windows\system32\Okdmjdol.exe95⤵PID:2328
-
C:\Windows\SysWOW64\Pcghof32.exeC:\Windows\system32\Pcghof32.exe96⤵PID:1348
-
C:\Windows\SysWOW64\Ppkhhjei.exeC:\Windows\system32\Ppkhhjei.exe97⤵PID:816
-
C:\Windows\SysWOW64\Pegqpacp.exeC:\Windows\system32\Pegqpacp.exe98⤵PID:2888
-
C:\Windows\SysWOW64\Popeif32.exeC:\Windows\system32\Popeif32.exe99⤵PID:1344
-
C:\Windows\SysWOW64\Pdmnam32.exeC:\Windows\system32\Pdmnam32.exe100⤵PID:1256
-
C:\Windows\SysWOW64\Qkffng32.exeC:\Windows\system32\Qkffng32.exe101⤵
- Modifies registry class
PID:1660 -
C:\Windows\SysWOW64\Qaqnkafa.exeC:\Windows\system32\Qaqnkafa.exe102⤵PID:2968
-
C:\Windows\SysWOW64\Qgmfchei.exeC:\Windows\system32\Qgmfchei.exe103⤵
- Drops file in System32 directory
PID:1792 -
C:\Windows\SysWOW64\Qngopb32.exeC:\Windows\system32\Qngopb32.exe104⤵PID:1352
-
C:\Windows\SysWOW64\Qhmcmk32.exeC:\Windows\system32\Qhmcmk32.exe105⤵
- Modifies registry class
PID:2556 -
C:\Windows\SysWOW64\Agbpnh32.exeC:\Windows\system32\Agbpnh32.exe106⤵PID:2468
-
C:\Windows\SysWOW64\Aqjdgmgd.exeC:\Windows\system32\Aqjdgmgd.exe107⤵PID:1452
-
C:\Windows\SysWOW64\Ajcipc32.exeC:\Windows\system32\Ajcipc32.exe108⤵PID:1412
-
C:\Windows\SysWOW64\Aopahjll.exeC:\Windows\system32\Aopahjll.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2500 -
C:\Windows\SysWOW64\Afjjed32.exeC:\Windows\system32\Afjjed32.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2476 -
C:\Windows\SysWOW64\Acnjnh32.exeC:\Windows\system32\Acnjnh32.exe111⤵PID:2864
-
C:\Windows\SysWOW64\Akiobk32.exeC:\Windows\system32\Akiobk32.exe112⤵PID:2728
-
C:\Windows\SysWOW64\Beackp32.exeC:\Windows\system32\Beackp32.exe113⤵PID:3004
-
C:\Windows\SysWOW64\Bnihdemo.exeC:\Windows\system32\Bnihdemo.exe114⤵PID:2592
-
C:\Windows\SysWOW64\Bkmhnjlh.exeC:\Windows\system32\Bkmhnjlh.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2548 -
C:\Windows\SysWOW64\Bnldjekl.exeC:\Windows\system32\Bnldjekl.exe116⤵PID:1588
-
C:\Windows\SysWOW64\Bgdibkam.exeC:\Windows\system32\Bgdibkam.exe117⤵PID:2028
-
C:\Windows\SysWOW64\Bammlq32.exeC:\Windows\system32\Bammlq32.exe118⤵PID:2380
-
C:\Windows\SysWOW64\Bkbaii32.exeC:\Windows\system32\Bkbaii32.exe119⤵PID:2112
-
C:\Windows\SysWOW64\Bmcnqama.exeC:\Windows\system32\Bmcnqama.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2064 -
C:\Windows\SysWOW64\Bcmfmlen.exeC:\Windows\system32\Bcmfmlen.exe121⤵PID:2792
-
C:\Windows\SysWOW64\Cmfkfa32.exeC:\Windows\system32\Cmfkfa32.exe122⤵PID:1192
-
C:\Windows\SysWOW64\Ccpcckck.exeC:\Windows\system32\Ccpcckck.exe123⤵PID:324
-
C:\Windows\SysWOW64\Ccbphk32.exeC:\Windows\system32\Ccbphk32.exe124⤵PID:1500
-
C:\Windows\SysWOW64\Ccdmnj32.exeC:\Windows\system32\Ccdmnj32.exe125⤵PID:2168
-
C:\Windows\SysWOW64\Cfcijf32.exeC:\Windows\system32\Cfcijf32.exe126⤵
- Drops file in System32 directory
PID:1144 -
C:\Windows\SysWOW64\Cmmagpef.exeC:\Windows\system32\Cmmagpef.exe127⤵PID:2024
-
C:\Windows\SysWOW64\Cehfkb32.exeC:\Windows\system32\Cehfkb32.exe128⤵PID:2108
-
C:\Windows\SysWOW64\Copjdhib.exeC:\Windows\system32\Copjdhib.exe129⤵
- Modifies registry class
PID:2084 -
C:\Windows\SysWOW64\Dhiomn32.exeC:\Windows\system32\Dhiomn32.exe130⤵PID:2708
-
C:\Windows\SysWOW64\Dobgihgp.exeC:\Windows\system32\Dobgihgp.exe131⤵
- Modifies registry class
PID:1604 -
C:\Windows\SysWOW64\Demofaol.exeC:\Windows\system32\Demofaol.exe132⤵
- Modifies registry class
PID:1428 -
C:\Windows\SysWOW64\Dmhdkdlg.exeC:\Windows\system32\Dmhdkdlg.exe133⤵PID:1704
-
C:\Windows\SysWOW64\Deollamj.exeC:\Windows\system32\Deollamj.exe134⤵PID:2812
-
C:\Windows\SysWOW64\Dfphcj32.exeC:\Windows\system32\Dfphcj32.exe135⤵PID:2720
-
C:\Windows\SysWOW64\Dphmloih.exeC:\Windows\system32\Dphmloih.exe136⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2144 -
C:\Windows\SysWOW64\Dkqnoh32.exeC:\Windows\system32\Dkqnoh32.exe137⤵PID:2740
-
C:\Windows\SysWOW64\Epmfgo32.exeC:\Windows\system32\Epmfgo32.exe138⤵PID:1816
-
C:\Windows\SysWOW64\Eejopecj.exeC:\Windows\system32\Eejopecj.exe139⤵PID:2348
-
C:\Windows\SysWOW64\Emagacdm.exeC:\Windows\system32\Emagacdm.exe140⤵PID:1968
-
C:\Windows\SysWOW64\Eobchk32.exeC:\Windows\system32\Eobchk32.exe141⤵PID:1124
-
C:\Windows\SysWOW64\Eoepnk32.exeC:\Windows\system32\Eoepnk32.exe142⤵PID:2784
-
C:\Windows\SysWOW64\Elipgofb.exeC:\Windows\system32\Elipgofb.exe143⤵PID:436
-
C:\Windows\SysWOW64\Eaeipfei.exeC:\Windows\system32\Eaeipfei.exe144⤵PID:1324
-
C:\Windows\SysWOW64\Ehpalp32.exeC:\Windows\system32\Ehpalp32.exe145⤵PID:2216
-
C:\Windows\SysWOW64\Fgdnnl32.exeC:\Windows\system32\Fgdnnl32.exe146⤵PID:2940
-
C:\Windows\SysWOW64\Fajbke32.exeC:\Windows\system32\Fajbke32.exe147⤵PID:2280
-
C:\Windows\SysWOW64\Fhdjgoha.exeC:\Windows\system32\Fhdjgoha.exe148⤵PID:368
-
C:\Windows\SysWOW64\Fjegog32.exeC:\Windows\system32\Fjegog32.exe149⤵PID:2420
-
C:\Windows\SysWOW64\Fqalaa32.exeC:\Windows\system32\Fqalaa32.exe150⤵PID:2052
-
C:\Windows\SysWOW64\Fnflke32.exeC:\Windows\system32\Fnflke32.exe151⤵PID:2480
-
C:\Windows\SysWOW64\Ffaaoh32.exeC:\Windows\system32\Ffaaoh32.exe152⤵PID:2284
-
C:\Windows\SysWOW64\Gbhbdi32.exeC:\Windows\system32\Gbhbdi32.exe153⤵PID:1672
-
C:\Windows\SysWOW64\Ghajacmo.exeC:\Windows\system32\Ghajacmo.exe154⤵PID:2020
-
C:\Windows\SysWOW64\Gcgnnlle.exeC:\Windows\system32\Gcgnnlle.exe155⤵PID:2996
-
C:\Windows\SysWOW64\Gkbcbn32.exeC:\Windows\system32\Gkbcbn32.exe156⤵PID:928
-
C:\Windows\SysWOW64\Goplilpf.exeC:\Windows\system32\Goplilpf.exe157⤵PID:572
-
C:\Windows\SysWOW64\Gneijien.exeC:\Windows\system32\Gneijien.exe158⤵PID:2776
-
C:\Windows\SysWOW64\Hjlioj32.exeC:\Windows\system32\Hjlioj32.exe159⤵PID:1924
-
C:\Windows\SysWOW64\Hcdnhoac.exeC:\Windows\system32\Hcdnhoac.exe160⤵PID:2132
-
C:\Windows\SysWOW64\Hpkompgg.exeC:\Windows\system32\Hpkompgg.exe161⤵PID:1940
-
C:\Windows\SysWOW64\Iefcfe32.exeC:\Windows\system32\Iefcfe32.exe162⤵
- Modifies registry class
PID:2504 -
C:\Windows\SysWOW64\Ioohokoo.exeC:\Windows\system32\Ioohokoo.exe163⤵PID:960
-
C:\Windows\SysWOW64\Idkpganf.exeC:\Windows\system32\Idkpganf.exe164⤵PID:2848
-
C:\Windows\SysWOW64\Jpbalb32.exeC:\Windows\system32\Jpbalb32.exe165⤵PID:2640
-
C:\Windows\SysWOW64\Jikeeh32.exeC:\Windows\system32\Jikeeh32.exe166⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1308 -
C:\Windows\SysWOW64\Jimbkh32.exeC:\Windows\system32\Jimbkh32.exe167⤵PID:2552
-
C:\Windows\SysWOW64\Jbhcim32.exeC:\Windows\system32\Jbhcim32.exe168⤵PID:1652
-
C:\Windows\SysWOW64\Jlphbbbg.exeC:\Windows\system32\Jlphbbbg.exe169⤵PID:2316
-
C:\Windows\SysWOW64\Khghgchk.exeC:\Windows\system32\Khghgchk.exe170⤵
- Drops file in System32 directory
PID:1752 -
C:\Windows\SysWOW64\Kglehp32.exeC:\Windows\system32\Kglehp32.exe171⤵PID:2912
-
C:\Windows\SysWOW64\Kadfkhkf.exeC:\Windows\system32\Kadfkhkf.exe172⤵
- Modifies registry class
PID:2536 -
C:\Windows\SysWOW64\Kklkcn32.exeC:\Windows\system32\Kklkcn32.exe173⤵PID:2440
-
C:\Windows\SysWOW64\Knmdeioh.exeC:\Windows\system32\Knmdeioh.exe174⤵PID:2128
-
C:\Windows\SysWOW64\Lgehno32.exeC:\Windows\system32\Lgehno32.exe175⤵PID:2368
-
C:\Windows\SysWOW64\Lboiol32.exeC:\Windows\system32\Lboiol32.exe176⤵
- Drops file in System32 directory
PID:2764 -
C:\Windows\SysWOW64\Lcofio32.exeC:\Windows\system32\Lcofio32.exe177⤵PID:2800
-
C:\Windows\SysWOW64\Loefnpnn.exeC:\Windows\system32\Loefnpnn.exe178⤵PID:2332
-
C:\Windows\SysWOW64\Lhnkffeo.exeC:\Windows\system32\Lhnkffeo.exe179⤵PID:1776
-
C:\Windows\SysWOW64\Lddlkg32.exeC:\Windows\system32\Lddlkg32.exe180⤵PID:1128
-
C:\Windows\SysWOW64\Mnmpdlac.exeC:\Windows\system32\Mnmpdlac.exe181⤵PID:2364
-
C:\Windows\SysWOW64\Mjcaimgg.exeC:\Windows\system32\Mjcaimgg.exe182⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2760 -
C:\Windows\SysWOW64\Mdiefffn.exeC:\Windows\system32\Mdiefffn.exe183⤵PID:1504
-
C:\Windows\SysWOW64\Mcnbhb32.exeC:\Windows\system32\Mcnbhb32.exe184⤵PID:772
-
C:\Windows\SysWOW64\Mmgfqh32.exeC:\Windows\system32\Mmgfqh32.exe185⤵PID:1560
-
C:\Windows\SysWOW64\Mpgobc32.exeC:\Windows\system32\Mpgobc32.exe186⤵PID:3016
-
C:\Windows\SysWOW64\Nfahomfd.exeC:\Windows\system32\Nfahomfd.exe187⤵PID:1760
-
C:\Windows\SysWOW64\Nfdddm32.exeC:\Windows\system32\Nfdddm32.exe188⤵PID:2100
-
C:\Windows\SysWOW64\Nplimbka.exeC:\Windows\system32\Nplimbka.exe189⤵PID:1552
-
C:\Windows\SysWOW64\Nhgnaehm.exeC:\Windows\system32\Nhgnaehm.exe190⤵PID:2296
-
C:\Windows\SysWOW64\Nbmaon32.exeC:\Windows\system32\Nbmaon32.exe191⤵PID:1132
-
C:\Windows\SysWOW64\Ncnngfna.exeC:\Windows\system32\Ncnngfna.exe192⤵
- Drops file in System32 directory
PID:1164 -
C:\Windows\SysWOW64\Nmfbpk32.exeC:\Windows\system32\Nmfbpk32.exe193⤵PID:2156
-
C:\Windows\SysWOW64\Nfoghakb.exeC:\Windows\system32\Nfoghakb.exe194⤵PID:1972
-
C:\Windows\SysWOW64\Oadkej32.exeC:\Windows\system32\Oadkej32.exe195⤵PID:280
-
C:\Windows\SysWOW64\Oaghki32.exeC:\Windows\system32\Oaghki32.exe196⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1680 -
C:\Windows\SysWOW64\Ojomdoof.exeC:\Windows\system32\Ojomdoof.exe197⤵PID:1956
-
C:\Windows\SysWOW64\Odgamdef.exeC:\Windows\system32\Odgamdef.exe198⤵PID:1572
-
C:\Windows\SysWOW64\Ompefj32.exeC:\Windows\system32\Ompefj32.exe199⤵PID:2816
-
C:\Windows\SysWOW64\Obmnna32.exeC:\Windows\system32\Obmnna32.exe200⤵PID:3100
-
C:\Windows\SysWOW64\Olebgfao.exeC:\Windows\system32\Olebgfao.exe201⤵PID:3144
-
C:\Windows\SysWOW64\Piicpk32.exeC:\Windows\system32\Piicpk32.exe202⤵PID:3184
-
C:\Windows\SysWOW64\Pkjphcff.exeC:\Windows\system32\Pkjphcff.exe203⤵
- Drops file in System32 directory
PID:3224 -
C:\Windows\SysWOW64\Pkmlmbcd.exeC:\Windows\system32\Pkmlmbcd.exe204⤵PID:3264
-
C:\Windows\SysWOW64\Pmkhjncg.exeC:\Windows\system32\Pmkhjncg.exe205⤵PID:3304
-
C:\Windows\SysWOW64\Pgcmbcih.exeC:\Windows\system32\Pgcmbcih.exe206⤵PID:3344
-
C:\Windows\SysWOW64\Paiaplin.exeC:\Windows\system32\Paiaplin.exe207⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3384 -
C:\Windows\SysWOW64\Paknelgk.exeC:\Windows\system32\Paknelgk.exe208⤵
- Drops file in System32 directory
PID:3424 -
C:\Windows\SysWOW64\Pifbjn32.exeC:\Windows\system32\Pifbjn32.exe209⤵PID:3464
-
C:\Windows\SysWOW64\Qgjccb32.exeC:\Windows\system32\Qgjccb32.exe210⤵PID:3504
-
C:\Windows\SysWOW64\Qdncmgbj.exeC:\Windows\system32\Qdncmgbj.exe211⤵PID:3544
-
C:\Windows\SysWOW64\Qjklenpa.exeC:\Windows\system32\Qjklenpa.exe212⤵PID:3584
-
C:\Windows\SysWOW64\Aebmjo32.exeC:\Windows\system32\Aebmjo32.exe213⤵
- Drops file in System32 directory
PID:3624 -
C:\Windows\SysWOW64\Acfmcc32.exeC:\Windows\system32\Acfmcc32.exe214⤵PID:3716
-
C:\Windows\SysWOW64\Bffbdadk.exeC:\Windows\system32\Bffbdadk.exe215⤵PID:3756
-
C:\Windows\SysWOW64\Boogmgkl.exeC:\Windows\system32\Boogmgkl.exe216⤵PID:3796
-
C:\Windows\SysWOW64\Coacbfii.exeC:\Windows\system32\Coacbfii.exe217⤵PID:3836
-
C:\Windows\SysWOW64\Cmedlk32.exeC:\Windows\system32\Cmedlk32.exe218⤵PID:3876
-
C:\Windows\SysWOW64\Cocphf32.exeC:\Windows\system32\Cocphf32.exe219⤵PID:3916
-
C:\Windows\SysWOW64\Cfmhdpnc.exeC:\Windows\system32\Cfmhdpnc.exe220⤵PID:3956
-
C:\Windows\SysWOW64\Cagienkb.exeC:\Windows\system32\Cagienkb.exe221⤵
- Drops file in System32 directory
PID:4000 -
C:\Windows\SysWOW64\Ckmnbg32.exeC:\Windows\system32\Ckmnbg32.exe222⤵PID:4040
-
C:\Windows\SysWOW64\Cbffoabe.exeC:\Windows\system32\Cbffoabe.exe223⤵PID:4080
-
C:\Windows\SysWOW64\Cchbgi32.exeC:\Windows\system32\Cchbgi32.exe224⤵
- Drops file in System32 directory
PID:3088 -
C:\Windows\SysWOW64\Ccjoli32.exeC:\Windows\system32\Ccjoli32.exe225⤵PID:3168
-
C:\Windows\SysWOW64\Djdgic32.exeC:\Windows\system32\Djdgic32.exe226⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3220 -
C:\Windows\SysWOW64\Dhhhbg32.exeC:\Windows\system32\Dhhhbg32.exe227⤵PID:3300
-
C:\Windows\SysWOW64\Diidjpbe.exeC:\Windows\system32\Diidjpbe.exe228⤵
- Drops file in System32 directory
PID:3372 -
C:\Windows\SysWOW64\Dbaice32.exeC:\Windows\system32\Dbaice32.exe229⤵PID:3396
-
C:\Windows\SysWOW64\Dbdehdfc.exeC:\Windows\system32\Dbdehdfc.exe230⤵PID:3480
-
C:\Windows\SysWOW64\Dmijfmfi.exeC:\Windows\system32\Dmijfmfi.exe231⤵
- Drops file in System32 directory
PID:3528 -
C:\Windows\SysWOW64\Dlofgj32.exeC:\Windows\system32\Dlofgj32.exe232⤵
- Modifies registry class
PID:3576 -
C:\Windows\SysWOW64\Eakooqih.exeC:\Windows\system32\Eakooqih.exe233⤵PID:3632
-
C:\Windows\SysWOW64\Elacliin.exeC:\Windows\system32\Elacliin.exe234⤵PID:3672
-
C:\Windows\SysWOW64\Edlhqlfi.exeC:\Windows\system32\Edlhqlfi.exe235⤵PID:3712
-
C:\Windows\SysWOW64\Ekfpmf32.exeC:\Windows\system32\Ekfpmf32.exe236⤵PID:3764
-
C:\Windows\SysWOW64\Eeldkonl.exeC:\Windows\system32\Eeldkonl.exe237⤵PID:3660
-
C:\Windows\SysWOW64\Egmabg32.exeC:\Windows\system32\Egmabg32.exe238⤵PID:3872
-
C:\Windows\SysWOW64\Eabepp32.exeC:\Windows\system32\Eabepp32.exe239⤵PID:3924
-
C:\Windows\SysWOW64\Edcnakpa.exeC:\Windows\system32\Edcnakpa.exe240⤵PID:3928
-
C:\Windows\SysWOW64\Eipgjaoi.exeC:\Windows\system32\Eipgjaoi.exe241⤵PID:4036
-
C:\Windows\SysWOW64\Fchkbg32.exeC:\Windows\system32\Fchkbg32.exe242⤵PID:4092