Analysis
-
max time kernel
147s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 02:20
Static task
static1
Behavioral task
behavioral1
Sample
b7fb044482ddbeb7c2a0628a46c8579344705eb66cecdcd4b667ca68e21b9356.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b7fb044482ddbeb7c2a0628a46c8579344705eb66cecdcd4b667ca68e21b9356.exe
Resource
win10v2004-20240426-en
General
-
Target
b7fb044482ddbeb7c2a0628a46c8579344705eb66cecdcd4b667ca68e21b9356.exe
-
Size
439KB
-
MD5
2b288264f7b81c5a469334f795fb8eac
-
SHA1
4c13a736135cf2a82f2086b7dad8af54d38ee8cb
-
SHA256
b7fb044482ddbeb7c2a0628a46c8579344705eb66cecdcd4b667ca68e21b9356
-
SHA512
cc953d31e6b9e26a2e45101ce1cb8232b8925ff48789586271772a73d713513d000c5bda017511fe56f8fb05c858ed72699842347aaf1b37dc90e3c774fbc944
-
SSDEEP
12288:MBOPeKm2OPeKm22Vtp90NtmVtp90NtXONt:fpEkpEY
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Hiqbndpb.exeAjhgmpfg.exeDgmglh32.exeClcflkic.exeCpkbdiqb.exeDjefobmk.exeNkbhgojk.exeDngoibmo.exeEpdkli32.exeMijfnh32.exeBfadgq32.exeAmhpnkch.exeMdqafgnf.exeCpeofk32.exeGhfbqn32.exeGloblmmj.exeIhankokm.exeApimacnn.exeIjgdngmf.exeDhjgal32.exeFnpnndgp.exeGaqcoc32.exeQcbllb32.exeEcejkf32.exeLfjqnjkh.exeMkhmma32.exeNbfjdn32.exeLmcijcbe.exeMlkopcge.exeEjobhppq.exeGddifnbk.exeJkbcln32.exePkndaa32.exePnomcl32.exeDkcofe32.exeBdlblj32.exeCnippoha.exeQnfjna32.exeFhhcgj32.exeAfcenm32.exeDjmicm32.exeDdigjkid.exeFcmgfkeg.exeHhjhkq32.exeOoeggp32.exeBiicik32.exeDqelenlc.exeBmpfojmp.exeCnmehnan.exeEqpgol32.exeGopkmhjk.exeLdidkbpb.exeOlmhdf32.exeDdgjdk32.exeBlmdlhmp.exeEkholjqg.exeJfekcg32.exeNcgdbmmp.exeDggcffhg.exeHlakpp32.exeJcgogk32.exeAaaoij32.exeDhnmij32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hiqbndpb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ajhgmpfg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgmglh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Clcflkic.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpkbdiqb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djefobmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nkbhgojk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dngoibmo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epdkli32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mijfnh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfadgq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Amhpnkch.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdqafgnf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpeofk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ghfbqn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Globlmmj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ihankokm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apimacnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ijgdngmf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhjgal32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fnpnndgp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gaqcoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qcbllb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ecejkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lfjqnjkh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkhmma32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbfjdn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lmcijcbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mlkopcge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ejobhppq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gddifnbk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkbcln32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pkndaa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pnomcl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkcofe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdlblj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cnippoha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhjgal32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qnfjna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fhhcgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Afcenm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djmicm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ddigjkid.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fcmgfkeg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhjhkq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ooeggp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Biicik32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dqelenlc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bmpfojmp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnmehnan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eqpgol32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gopkmhjk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldidkbpb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olmhdf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddgjdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Blmdlhmp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ekholjqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jfekcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ncgdbmmp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dggcffhg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hlakpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jcgogk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aaaoij32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhnmij32.exe -
Detects executables packed with ConfuserEx Mod 64 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\Kphimanc.exe INDICATOR_EXE_Packed_ConfuserEx \Windows\SysWOW64\Khcnad32.exe INDICATOR_EXE_Packed_ConfuserEx \Windows\SysWOW64\Kjcgco32.exe INDICATOR_EXE_Packed_ConfuserEx \Windows\SysWOW64\Keikqhhe.exe INDICATOR_EXE_Packed_ConfuserEx \Windows\SysWOW64\Lfmdnp32.exe INDICATOR_EXE_Packed_ConfuserEx \Windows\SysWOW64\Lpeifeca.exe INDICATOR_EXE_Packed_ConfuserEx \Windows\SysWOW64\Ldcamcih.exe INDICATOR_EXE_Packed_ConfuserEx \Windows\SysWOW64\Lganiohl.exe INDICATOR_EXE_Packed_ConfuserEx \Windows\SysWOW64\Lmnbkinf.exe INDICATOR_EXE_Packed_ConfuserEx behavioral1/memory/1636-128-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Lplogdmj.exe INDICATOR_EXE_Packed_ConfuserEx \Windows\SysWOW64\Mkhmma32.exe INDICATOR_EXE_Packed_ConfuserEx behavioral1/memory/2264-145-0x0000000000250000-0x00000000002EA000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx behavioral1/memory/2292-158-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Mdqafgnf.exe INDICATOR_EXE_Packed_ConfuserEx \Windows\SysWOW64\Mdcnlglc.exe INDICATOR_EXE_Packed_ConfuserEx \Windows\SysWOW64\Mdejaf32.exe INDICATOR_EXE_Packed_ConfuserEx \Windows\SysWOW64\Npnhlg32.exe INDICATOR_EXE_Packed_ConfuserEx behavioral1/memory/692-206-0x0000000000250000-0x00000000002EA000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx \Windows\SysWOW64\Njgldmdc.exe INDICATOR_EXE_Packed_ConfuserEx behavioral1/memory/2780-220-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Nleiqhcg.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Nqcagfim.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Ncancbha.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Nbfjdn32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Oicpfh32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Oqndkj32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Oghlgdgk.exe INDICATOR_EXE_Packed_ConfuserEx behavioral1/memory/1036-309-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Ogjimd32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Ojieip32.exe INDICATOR_EXE_Packed_ConfuserEx behavioral1/memory/1672-331-0x0000000000400000-0x000000000049A000-memory.dmp INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Ojkboo32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Ppjglfon.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Pmnhfjmg.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Plahag32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Peiljl32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Pmqdkj32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Plfamfpm.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Qjknnbed.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Qnfjna32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Qbbfopeg.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Qhooggdn.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Ahchbf32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Affhncfc.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Ampqjm32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Abmibdlh.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Ajdadamj.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Alenki32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Admemg32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Afkbib32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Amejeljk.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Alhjai32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Abbbnchb.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Aepojo32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Ahokfj32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Bpfcgg32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Boiccdnf.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Bingpmnl.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Blmdlhmp.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Bokphdld.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Beehencq.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Bdhhqk32.exe INDICATOR_EXE_Packed_ConfuserEx C:\Windows\SysWOW64\Bloqah32.exe INDICATOR_EXE_Packed_ConfuserEx -
Executes dropped EXE 64 IoCs
Processes:
Kphimanc.exeKhcnad32.exeKjcgco32.exeKeikqhhe.exeLfmdnp32.exeLpeifeca.exeLdcamcih.exeLganiohl.exeLmnbkinf.exeLplogdmj.exeMkhmma32.exeMdqafgnf.exeMdcnlglc.exeMdejaf32.exeNpnhlg32.exeNjgldmdc.exeNleiqhcg.exeNqcagfim.exeNcancbha.exeNbfjdn32.exeOicpfh32.exeOqndkj32.exeOghlgdgk.exeOgjimd32.exeOjieip32.exeOjkboo32.exePpjglfon.exePmnhfjmg.exePlahag32.exePeiljl32.exePmqdkj32.exePlfamfpm.exeQjknnbed.exeQnfjna32.exeQbbfopeg.exeQhooggdn.exeAhchbf32.exeAffhncfc.exeAmpqjm32.exeAbmibdlh.exeAjdadamj.exeAlenki32.exeAdmemg32.exeAfkbib32.exeAmejeljk.exeAlhjai32.exeAbbbnchb.exeAepojo32.exeAhokfj32.exeBpfcgg32.exeBoiccdnf.exeBingpmnl.exeBlmdlhmp.exeBokphdld.exeBeehencq.exeBdhhqk32.exeBloqah32.exeBnpmipql.exeBegeknan.exeBdjefj32.exeBghabf32.exeBkdmcdoe.exeBnbjopoi.exeBdlblj32.exepid process 2956 Kphimanc.exe 2560 Khcnad32.exe 2800 Kjcgco32.exe 2412 Keikqhhe.exe 2492 Lfmdnp32.exe 2456 Lpeifeca.exe 784 Ldcamcih.exe 2724 Lganiohl.exe 1636 Lmnbkinf.exe 2264 Lplogdmj.exe 2292 Mkhmma32.exe 2272 Mdqafgnf.exe 2580 Mdcnlglc.exe 692 Mdejaf32.exe 2780 Npnhlg32.exe 1228 Njgldmdc.exe 972 Nleiqhcg.exe 3016 Nqcagfim.exe 1560 Ncancbha.exe 928 Nbfjdn32.exe 1928 Oicpfh32.exe 3040 Oqndkj32.exe 1036 Oghlgdgk.exe 2460 Ogjimd32.exe 1672 Ojieip32.exe 1664 Ojkboo32.exe 2812 Ppjglfon.exe 2632 Pmnhfjmg.exe 1280 Plahag32.exe 2960 Peiljl32.exe 2884 Pmqdkj32.exe 2668 Plfamfpm.exe 2728 Qjknnbed.exe 2744 Qnfjna32.exe 1620 Qbbfopeg.exe 1884 Qhooggdn.exe 284 Ahchbf32.exe 2172 Affhncfc.exe 1536 Ampqjm32.exe 2192 Abmibdlh.exe 924 Ajdadamj.exe 2944 Alenki32.exe 3028 Admemg32.exe 2992 Afkbib32.exe 1524 Amejeljk.exe 240 Alhjai32.exe 804 Abbbnchb.exe 2332 Aepojo32.exe 1160 Ahokfj32.exe 1844 Bpfcgg32.exe 2144 Boiccdnf.exe 2320 Bingpmnl.exe 2532 Blmdlhmp.exe 2868 Bokphdld.exe 2548 Beehencq.exe 2876 Bdhhqk32.exe 2364 Bloqah32.exe 2708 Bnpmipql.exe 1580 Begeknan.exe 1212 Bdjefj32.exe 1584 Bghabf32.exe 1528 Bkdmcdoe.exe 2448 Bnbjopoi.exe 1464 Bdlblj32.exe -
Loads dropped DLL 64 IoCs
Processes:
b7fb044482ddbeb7c2a0628a46c8579344705eb66cecdcd4b667ca68e21b9356.exeKphimanc.exeKhcnad32.exeKjcgco32.exeKeikqhhe.exeLfmdnp32.exeLpeifeca.exeLdcamcih.exeLganiohl.exeLmnbkinf.exeLplogdmj.exeMkhmma32.exeMdqafgnf.exeMdcnlglc.exeMdejaf32.exeNpnhlg32.exeNjgldmdc.exeNleiqhcg.exeNqcagfim.exeNcancbha.exeNbfjdn32.exeOicpfh32.exeOqndkj32.exeOghlgdgk.exeOgjimd32.exeOjieip32.exeOjkboo32.exePpjglfon.exePmnhfjmg.exePlahag32.exePeiljl32.exePmqdkj32.exepid process 2276 b7fb044482ddbeb7c2a0628a46c8579344705eb66cecdcd4b667ca68e21b9356.exe 2276 b7fb044482ddbeb7c2a0628a46c8579344705eb66cecdcd4b667ca68e21b9356.exe 2956 Kphimanc.exe 2956 Kphimanc.exe 2560 Khcnad32.exe 2560 Khcnad32.exe 2800 Kjcgco32.exe 2800 Kjcgco32.exe 2412 Keikqhhe.exe 2412 Keikqhhe.exe 2492 Lfmdnp32.exe 2492 Lfmdnp32.exe 2456 Lpeifeca.exe 2456 Lpeifeca.exe 784 Ldcamcih.exe 784 Ldcamcih.exe 2724 Lganiohl.exe 2724 Lganiohl.exe 1636 Lmnbkinf.exe 1636 Lmnbkinf.exe 2264 Lplogdmj.exe 2264 Lplogdmj.exe 2292 Mkhmma32.exe 2292 Mkhmma32.exe 2272 Mdqafgnf.exe 2272 Mdqafgnf.exe 2580 Mdcnlglc.exe 2580 Mdcnlglc.exe 692 Mdejaf32.exe 692 Mdejaf32.exe 2780 Npnhlg32.exe 2780 Npnhlg32.exe 1228 Njgldmdc.exe 1228 Njgldmdc.exe 972 Nleiqhcg.exe 972 Nleiqhcg.exe 3016 Nqcagfim.exe 3016 Nqcagfim.exe 1560 Ncancbha.exe 1560 Ncancbha.exe 928 Nbfjdn32.exe 928 Nbfjdn32.exe 1928 Oicpfh32.exe 1928 Oicpfh32.exe 3040 Oqndkj32.exe 3040 Oqndkj32.exe 1036 Oghlgdgk.exe 1036 Oghlgdgk.exe 2460 Ogjimd32.exe 2460 Ogjimd32.exe 1672 Ojieip32.exe 1672 Ojieip32.exe 1664 Ojkboo32.exe 1664 Ojkboo32.exe 2812 Ppjglfon.exe 2812 Ppjglfon.exe 2632 Pmnhfjmg.exe 2632 Pmnhfjmg.exe 1280 Plahag32.exe 1280 Plahag32.exe 2960 Peiljl32.exe 2960 Peiljl32.exe 2884 Pmqdkj32.exe 2884 Pmqdkj32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Hcplhi32.exeQbcpbo32.exeAamfnkai.exeCdlgpgef.exeDdigjkid.exeDhjgal32.exeEfncicpm.exeEilpeooq.exeKjqccigf.exeAmhpnkch.exeEfppoc32.exePiphee32.exeDnilobkm.exeJkpgfn32.exeJfekcg32.exeKahojc32.exeLldlqakb.exeMeccii32.exeOopnlacm.exeBbhela32.exeNqcagfim.exeEbedndfa.exeIeqeidnl.exeIkpjgkjq.exeInqcif32.exeJgidao32.exeCddaphkn.exeCcngld32.exeEajaoq32.exeHhjhkq32.exeNnhkcj32.exeAaobdjof.exeOicpfh32.exeCndbcc32.exeFckjalhj.exeIfnechbj.exeMmfbogcn.exePimkpfeh.exeEhgppi32.exeMhbped32.exeBmpfojmp.exeDggcffhg.exeDjefobmk.exeEmcbkn32.exeAaaoij32.exeEcmkghcl.exePqkmjh32.exeAhlgfdeq.exeAepojo32.exeBpfcgg32.exeEkklaj32.exeGacpdbej.exeHahjpbad.exeMgimmm32.exeNpdjje32.exeBocolb32.exeEpdkli32.exeJicgpb32.exeMaoajf32.exeOnhgbmfb.exeEqgnokip.exeb7fb044482ddbeb7c2a0628a46c8579344705eb66cecdcd4b667ca68e21b9356.exedescription ioc process File created C:\Windows\SysWOW64\Henidd32.exe Hcplhi32.exe File opened for modification C:\Windows\SysWOW64\Qcbllb32.exe Qbcpbo32.exe File created C:\Windows\SysWOW64\Ifjeknjd.dll Aamfnkai.exe File created C:\Windows\SysWOW64\Akigbbni.dll Cdlgpgef.exe File created C:\Windows\SysWOW64\Dggcffhg.exe Ddigjkid.exe File created C:\Windows\SysWOW64\Dgmglh32.exe Dhjgal32.exe File created C:\Windows\SysWOW64\Dnoillim.dll Efncicpm.exe File created C:\Windows\SysWOW64\Maphhihi.dll Eilpeooq.exe File created C:\Windows\SysWOW64\Nhlhki32.dll Kjqccigf.exe File created C:\Windows\SysWOW64\Aadloj32.exe Amhpnkch.exe File opened for modification C:\Windows\SysWOW64\Epieghdk.exe Efppoc32.exe File created C:\Windows\SysWOW64\Kndcpj32.dll Piphee32.exe File created C:\Windows\SysWOW64\Lkcmiimi.dll Dnilobkm.exe File created C:\Windows\SysWOW64\Jcgogk32.exe Jkpgfn32.exe File opened for modification C:\Windows\SysWOW64\Jicgpb32.exe Jfekcg32.exe File created C:\Windows\SysWOW64\Kpkofpgq.exe Kahojc32.exe File created C:\Windows\SysWOW64\Ocljjp32.dll Lldlqakb.exe File opened for modification C:\Windows\SysWOW64\Miooigfo.exe Meccii32.exe File created C:\Windows\SysWOW64\Oclilp32.exe Oopnlacm.exe File created C:\Windows\SysWOW64\Biamilfj.exe Bbhela32.exe File created C:\Windows\SysWOW64\Jhcbom32.dll Nqcagfim.exe File created C:\Windows\SysWOW64\Efppoc32.exe Ebedndfa.exe File opened for modification C:\Windows\SysWOW64\Ihoafpmp.exe Ieqeidnl.exe File created C:\Windows\SysWOW64\Ehllae32.dll Ikpjgkjq.exe File created C:\Windows\SysWOW64\Idklfpon.exe Inqcif32.exe File opened for modification C:\Windows\SysWOW64\Jcgogk32.exe Jkpgfn32.exe File created C:\Windows\SysWOW64\Dmpknpme.dll Jgidao32.exe File created C:\Windows\SysWOW64\Ckoilb32.exe Cddaphkn.exe File created C:\Windows\SysWOW64\Gjpmgg32.dll Ccngld32.exe File opened for modification C:\Windows\SysWOW64\Eiaiqn32.exe Eajaoq32.exe File created C:\Windows\SysWOW64\Glqllcbf.dll Hhjhkq32.exe File opened for modification C:\Windows\SysWOW64\Nacgdhlp.exe Nnhkcj32.exe File created C:\Windows\SysWOW64\Aekodi32.exe Aaobdjof.exe File opened for modification C:\Windows\SysWOW64\Oqndkj32.exe Oicpfh32.exe File opened for modification C:\Windows\SysWOW64\Dbpodagk.exe Cndbcc32.exe File created C:\Windows\SysWOW64\Dchfknpg.dll Fckjalhj.exe File opened for modification C:\Windows\SysWOW64\Jnemdecl.exe Ifnechbj.exe File created C:\Windows\SysWOW64\Mpdnkb32.exe Mmfbogcn.exe File created C:\Windows\SysWOW64\Pklhlael.exe Pimkpfeh.exe File created C:\Windows\SysWOW64\Ekelld32.exe Ehgppi32.exe File created C:\Windows\SysWOW64\Ncgdbmmp.exe Mhbped32.exe File created C:\Windows\SysWOW64\Bpnbkeld.exe Bmpfojmp.exe File created C:\Windows\SysWOW64\Dkcofe32.exe Dggcffhg.exe File created C:\Windows\SysWOW64\Mmqgncdn.dll Djefobmk.exe File created C:\Windows\SysWOW64\Ecmkghcl.exe Emcbkn32.exe File opened for modification C:\Windows\SysWOW64\Aemkjiem.exe Aaaoij32.exe File opened for modification C:\Windows\SysWOW64\Ebpkce32.exe Ecmkghcl.exe File created C:\Windows\SysWOW64\Amammd32.dll Ieqeidnl.exe File opened for modification C:\Windows\SysWOW64\Pefijfii.exe Pqkmjh32.exe File created C:\Windows\SysWOW64\Hnhijl32.dll Ahlgfdeq.exe File created C:\Windows\SysWOW64\Ahokfj32.exe Aepojo32.exe File created C:\Windows\SysWOW64\Gfhemi32.dll Bpfcgg32.exe File created C:\Windows\SysWOW64\Hkabadei.dll Ekklaj32.exe File opened for modification C:\Windows\SysWOW64\Geolea32.exe Gacpdbej.exe File opened for modification C:\Windows\SysWOW64\Hdfflm32.exe Hahjpbad.exe File created C:\Windows\SysWOW64\Mihiih32.exe Mgimmm32.exe File created C:\Windows\SysWOW64\Ckmkcoqd.dll Npdjje32.exe File created C:\Windows\SysWOW64\Bbokmqie.exe Bocolb32.exe File created C:\Windows\SysWOW64\Efncicpm.exe Epdkli32.exe File created C:\Windows\SysWOW64\Jkbcln32.exe Jicgpb32.exe File created C:\Windows\SysWOW64\Gdchio32.dll Maoajf32.exe File created C:\Windows\SysWOW64\Amkoie32.dll Onhgbmfb.exe File created C:\Windows\SysWOW64\Bdacap32.dll Eqgnokip.exe File created C:\Windows\SysWOW64\Kphimanc.exe b7fb044482ddbeb7c2a0628a46c8579344705eb66cecdcd4b667ca68e21b9356.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5288 5264 WerFault.exe Fkckeh32.exe -
Modifies registry class 64 IoCs
Processes:
Gieojq32.exeJfekcg32.exePgeefbhm.exeFjdbnf32.exePkpagq32.exeFejgko32.exeJbgbni32.exeOfmbnkhg.exeAfcenm32.exeCdbdjhmp.exeCdikkg32.exeCfeddafl.exeCfgaiaci.exeFddmgjpo.exePmanoifd.exeCeodnl32.exeQnfjna32.exeAffhncfc.exeMhbped32.exeOfelmloo.exeQcbllb32.exeb7fb044482ddbeb7c2a0628a46c8579344705eb66cecdcd4b667ca68e21b9356.exeEqbddk32.exeBloqah32.exeBpfcgg32.exeChcqpmep.exeKiccofna.exeLoeebl32.exeNondgn32.exeAaobdjof.exeAhlgfdeq.exeQjknnbed.exeLfjqnjkh.exeNoqamn32.exeEnakbp32.exeEchfaf32.exeHgdbhi32.exeAmejeljk.exeCbnbobin.exeDqlafm32.exeFilldb32.exeMdpjlajk.exeNdmjedoi.exePikkiijf.exeEcejkf32.exeAjhgmpfg.exeKahojc32.exeBhndldcn.exeBiamilfj.exeDlnbeh32.exeFphafl32.exeNqcagfim.exeAhchbf32.exeIhankokm.exeMhgmapfi.exeCdlgpgef.exeNleiqhcg.exeClcflkic.exeIggkllpe.exeLfmdnp32.exeDcknbh32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnnclg32.dll" Gieojq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlmfmihf.dll" Jfekcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pgeefbhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fjdbnf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Milokblc.dll" Pkpagq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fejgko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jbgbni32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpajdp32.dll" Ofmbnkhg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Afcenm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cdbdjhmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cdikkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cfeddafl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cfgaiaci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipjchc32.dll" Fddmgjpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pmanoifd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbkafj32.dll" Ceodnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhnaid32.dll" Qnfjna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hokefmej.dll" Affhncfc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mhbped32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onmjak32.dll" Ofelmloo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qcbllb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 b7fb044482ddbeb7c2a0628a46c8579344705eb66cecdcd4b667ca68e21b9356.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnghjbjl.dll" Cdikkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpbbfi32.dll" Eqbddk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkjecnop.dll" Bloqah32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bpfcgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdmaibnf.dll" Chcqpmep.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kiccofna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhhognbb.dll" Loeebl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nondgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fikjha32.dll" Aaobdjof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnhijl32.dll" Ahlgfdeq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qjknnbed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdklej32.dll" Lfjqnjkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Noqamn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Enakbp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hoogfn32.dll" Echfaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pffgja32.dll" Hgdbhi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Amejeljk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cbnbobin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dqlafm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Filldb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emmcaafi.dll" Mdpjlajk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ndmjedoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amaipodm.dll" Pikkiijf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qjknnbed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekgednng.dll" Ecejkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oglegn32.dll" Ajhgmpfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kahojc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bhndldcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Biamilfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dlnbeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fphafl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nqcagfim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ahchbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ihankokm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mhgmapfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akigbbni.dll" Cdlgpgef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nleiqhcg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Clcflkic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nolcnd32.dll" Iggkllpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ceodnl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lfmdnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dcknbh32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b7fb044482ddbeb7c2a0628a46c8579344705eb66cecdcd4b667ca68e21b9356.exeKphimanc.exeKhcnad32.exeKjcgco32.exeKeikqhhe.exeLfmdnp32.exeLpeifeca.exeLdcamcih.exeLganiohl.exeLmnbkinf.exeLplogdmj.exeMkhmma32.exeMdqafgnf.exeMdcnlglc.exeMdejaf32.exeNpnhlg32.exedescription pid process target process PID 2276 wrote to memory of 2956 2276 b7fb044482ddbeb7c2a0628a46c8579344705eb66cecdcd4b667ca68e21b9356.exe Kphimanc.exe PID 2276 wrote to memory of 2956 2276 b7fb044482ddbeb7c2a0628a46c8579344705eb66cecdcd4b667ca68e21b9356.exe Kphimanc.exe PID 2276 wrote to memory of 2956 2276 b7fb044482ddbeb7c2a0628a46c8579344705eb66cecdcd4b667ca68e21b9356.exe Kphimanc.exe PID 2276 wrote to memory of 2956 2276 b7fb044482ddbeb7c2a0628a46c8579344705eb66cecdcd4b667ca68e21b9356.exe Kphimanc.exe PID 2956 wrote to memory of 2560 2956 Kphimanc.exe Khcnad32.exe PID 2956 wrote to memory of 2560 2956 Kphimanc.exe Khcnad32.exe PID 2956 wrote to memory of 2560 2956 Kphimanc.exe Khcnad32.exe PID 2956 wrote to memory of 2560 2956 Kphimanc.exe Khcnad32.exe PID 2560 wrote to memory of 2800 2560 Khcnad32.exe Kjcgco32.exe PID 2560 wrote to memory of 2800 2560 Khcnad32.exe Kjcgco32.exe PID 2560 wrote to memory of 2800 2560 Khcnad32.exe Kjcgco32.exe PID 2560 wrote to memory of 2800 2560 Khcnad32.exe Kjcgco32.exe PID 2800 wrote to memory of 2412 2800 Kjcgco32.exe Keikqhhe.exe PID 2800 wrote to memory of 2412 2800 Kjcgco32.exe Keikqhhe.exe PID 2800 wrote to memory of 2412 2800 Kjcgco32.exe Keikqhhe.exe PID 2800 wrote to memory of 2412 2800 Kjcgco32.exe Keikqhhe.exe PID 2412 wrote to memory of 2492 2412 Keikqhhe.exe Lfmdnp32.exe PID 2412 wrote to memory of 2492 2412 Keikqhhe.exe Lfmdnp32.exe PID 2412 wrote to memory of 2492 2412 Keikqhhe.exe Lfmdnp32.exe PID 2412 wrote to memory of 2492 2412 Keikqhhe.exe Lfmdnp32.exe PID 2492 wrote to memory of 2456 2492 Lfmdnp32.exe Lpeifeca.exe PID 2492 wrote to memory of 2456 2492 Lfmdnp32.exe Lpeifeca.exe PID 2492 wrote to memory of 2456 2492 Lfmdnp32.exe Lpeifeca.exe PID 2492 wrote to memory of 2456 2492 Lfmdnp32.exe Lpeifeca.exe PID 2456 wrote to memory of 784 2456 Lpeifeca.exe Ldcamcih.exe PID 2456 wrote to memory of 784 2456 Lpeifeca.exe Ldcamcih.exe PID 2456 wrote to memory of 784 2456 Lpeifeca.exe Ldcamcih.exe PID 2456 wrote to memory of 784 2456 Lpeifeca.exe Ldcamcih.exe PID 784 wrote to memory of 2724 784 Ldcamcih.exe Lganiohl.exe PID 784 wrote to memory of 2724 784 Ldcamcih.exe Lganiohl.exe PID 784 wrote to memory of 2724 784 Ldcamcih.exe Lganiohl.exe PID 784 wrote to memory of 2724 784 Ldcamcih.exe Lganiohl.exe PID 2724 wrote to memory of 1636 2724 Lganiohl.exe Lmnbkinf.exe PID 2724 wrote to memory of 1636 2724 Lganiohl.exe Lmnbkinf.exe PID 2724 wrote to memory of 1636 2724 Lganiohl.exe Lmnbkinf.exe PID 2724 wrote to memory of 1636 2724 Lganiohl.exe Lmnbkinf.exe PID 1636 wrote to memory of 2264 1636 Lmnbkinf.exe Lplogdmj.exe PID 1636 wrote to memory of 2264 1636 Lmnbkinf.exe Lplogdmj.exe PID 1636 wrote to memory of 2264 1636 Lmnbkinf.exe Lplogdmj.exe PID 1636 wrote to memory of 2264 1636 Lmnbkinf.exe Lplogdmj.exe PID 2264 wrote to memory of 2292 2264 Lplogdmj.exe Mkhmma32.exe PID 2264 wrote to memory of 2292 2264 Lplogdmj.exe Mkhmma32.exe PID 2264 wrote to memory of 2292 2264 Lplogdmj.exe Mkhmma32.exe PID 2264 wrote to memory of 2292 2264 Lplogdmj.exe Mkhmma32.exe PID 2292 wrote to memory of 2272 2292 Mkhmma32.exe Mdqafgnf.exe PID 2292 wrote to memory of 2272 2292 Mkhmma32.exe Mdqafgnf.exe PID 2292 wrote to memory of 2272 2292 Mkhmma32.exe Mdqafgnf.exe PID 2292 wrote to memory of 2272 2292 Mkhmma32.exe Mdqafgnf.exe PID 2272 wrote to memory of 2580 2272 Mdqafgnf.exe Mdcnlglc.exe PID 2272 wrote to memory of 2580 2272 Mdqafgnf.exe Mdcnlglc.exe PID 2272 wrote to memory of 2580 2272 Mdqafgnf.exe Mdcnlglc.exe PID 2272 wrote to memory of 2580 2272 Mdqafgnf.exe Mdcnlglc.exe PID 2580 wrote to memory of 692 2580 Mdcnlglc.exe Mdejaf32.exe PID 2580 wrote to memory of 692 2580 Mdcnlglc.exe Mdejaf32.exe PID 2580 wrote to memory of 692 2580 Mdcnlglc.exe Mdejaf32.exe PID 2580 wrote to memory of 692 2580 Mdcnlglc.exe Mdejaf32.exe PID 692 wrote to memory of 2780 692 Mdejaf32.exe Npnhlg32.exe PID 692 wrote to memory of 2780 692 Mdejaf32.exe Npnhlg32.exe PID 692 wrote to memory of 2780 692 Mdejaf32.exe Npnhlg32.exe PID 692 wrote to memory of 2780 692 Mdejaf32.exe Npnhlg32.exe PID 2780 wrote to memory of 1228 2780 Npnhlg32.exe Njgldmdc.exe PID 2780 wrote to memory of 1228 2780 Npnhlg32.exe Njgldmdc.exe PID 2780 wrote to memory of 1228 2780 Npnhlg32.exe Njgldmdc.exe PID 2780 wrote to memory of 1228 2780 Npnhlg32.exe Njgldmdc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7fb044482ddbeb7c2a0628a46c8579344705eb66cecdcd4b667ca68e21b9356.exe"C:\Users\Admin\AppData\Local\Temp\b7fb044482ddbeb7c2a0628a46c8579344705eb66cecdcd4b667ca68e21b9356.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kphimanc.exeC:\Windows\system32\Kphimanc.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Khcnad32.exeC:\Windows\system32\Khcnad32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kjcgco32.exeC:\Windows\system32\Kjcgco32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Keikqhhe.exeC:\Windows\system32\Keikqhhe.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lfmdnp32.exeC:\Windows\system32\Lfmdnp32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lpeifeca.exeC:\Windows\system32\Lpeifeca.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ldcamcih.exeC:\Windows\system32\Ldcamcih.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lganiohl.exeC:\Windows\system32\Lganiohl.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lmnbkinf.exeC:\Windows\system32\Lmnbkinf.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lplogdmj.exeC:\Windows\system32\Lplogdmj.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mkhmma32.exeC:\Windows\system32\Mkhmma32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mdqafgnf.exeC:\Windows\system32\Mdqafgnf.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mdcnlglc.exeC:\Windows\system32\Mdcnlglc.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mdejaf32.exeC:\Windows\system32\Mdejaf32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Npnhlg32.exeC:\Windows\system32\Npnhlg32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Njgldmdc.exeC:\Windows\system32\Njgldmdc.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Nleiqhcg.exeC:\Windows\system32\Nleiqhcg.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\Nqcagfim.exeC:\Windows\system32\Nqcagfim.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Ncancbha.exeC:\Windows\system32\Ncancbha.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Nbfjdn32.exeC:\Windows\system32\Nbfjdn32.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Oicpfh32.exeC:\Windows\system32\Oicpfh32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Oqndkj32.exeC:\Windows\system32\Oqndkj32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Oghlgdgk.exeC:\Windows\system32\Oghlgdgk.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Ogjimd32.exeC:\Windows\system32\Ogjimd32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Ojieip32.exeC:\Windows\system32\Ojieip32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Ojkboo32.exeC:\Windows\system32\Ojkboo32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Ppjglfon.exeC:\Windows\system32\Ppjglfon.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Pmnhfjmg.exeC:\Windows\system32\Pmnhfjmg.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Plahag32.exeC:\Windows\system32\Plahag32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Peiljl32.exeC:\Windows\system32\Peiljl32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Pmqdkj32.exeC:\Windows\system32\Pmqdkj32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Plfamfpm.exeC:\Windows\system32\Plfamfpm.exe33⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Qjknnbed.exeC:\Windows\system32\Qjknnbed.exe34⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Qnfjna32.exeC:\Windows\system32\Qnfjna32.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Qbbfopeg.exeC:\Windows\system32\Qbbfopeg.exe36⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Qhooggdn.exeC:\Windows\system32\Qhooggdn.exe37⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ahchbf32.exeC:\Windows\system32\Ahchbf32.exe38⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Affhncfc.exeC:\Windows\system32\Affhncfc.exe39⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Ampqjm32.exeC:\Windows\system32\Ampqjm32.exe40⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Abmibdlh.exeC:\Windows\system32\Abmibdlh.exe41⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ajdadamj.exeC:\Windows\system32\Ajdadamj.exe42⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Alenki32.exeC:\Windows\system32\Alenki32.exe43⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Admemg32.exeC:\Windows\system32\Admemg32.exe44⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Afkbib32.exeC:\Windows\system32\Afkbib32.exe45⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Amejeljk.exeC:\Windows\system32\Amejeljk.exe46⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Alhjai32.exeC:\Windows\system32\Alhjai32.exe47⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Abbbnchb.exeC:\Windows\system32\Abbbnchb.exe48⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Aepojo32.exeC:\Windows\system32\Aepojo32.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ahokfj32.exeC:\Windows\system32\Ahokfj32.exe50⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bpfcgg32.exeC:\Windows\system32\Bpfcgg32.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Boiccdnf.exeC:\Windows\system32\Boiccdnf.exe52⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bingpmnl.exeC:\Windows\system32\Bingpmnl.exe53⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Blmdlhmp.exeC:\Windows\system32\Blmdlhmp.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bokphdld.exeC:\Windows\system32\Bokphdld.exe55⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Beehencq.exeC:\Windows\system32\Beehencq.exe56⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bdhhqk32.exeC:\Windows\system32\Bdhhqk32.exe57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bloqah32.exeC:\Windows\system32\Bloqah32.exe58⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Bnpmipql.exeC:\Windows\system32\Bnpmipql.exe59⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Begeknan.exeC:\Windows\system32\Begeknan.exe60⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bdjefj32.exeC:\Windows\system32\Bdjefj32.exe61⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bghabf32.exeC:\Windows\system32\Bghabf32.exe62⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bkdmcdoe.exeC:\Windows\system32\Bkdmcdoe.exe63⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bnbjopoi.exeC:\Windows\system32\Bnbjopoi.exe64⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bdlblj32.exeC:\Windows\system32\Bdlblj32.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bkfjhd32.exeC:\Windows\system32\Bkfjhd32.exe66⤵
-
C:\Windows\SysWOW64\Bjijdadm.exeC:\Windows\system32\Bjijdadm.exe67⤵
-
C:\Windows\SysWOW64\Bpcbqk32.exeC:\Windows\system32\Bpcbqk32.exe68⤵
-
C:\Windows\SysWOW64\Bdooajdc.exeC:\Windows\system32\Bdooajdc.exe69⤵
-
C:\Windows\SysWOW64\Cgmkmecg.exeC:\Windows\system32\Cgmkmecg.exe70⤵
-
C:\Windows\SysWOW64\Cjlgiqbk.exeC:\Windows\system32\Cjlgiqbk.exe71⤵
-
C:\Windows\SysWOW64\Cpeofk32.exeC:\Windows\system32\Cpeofk32.exe72⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ccdlbf32.exeC:\Windows\system32\Ccdlbf32.exe73⤵
-
C:\Windows\SysWOW64\Cnippoha.exeC:\Windows\system32\Cnippoha.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Cllpkl32.exeC:\Windows\system32\Cllpkl32.exe75⤵
-
C:\Windows\SysWOW64\Ccfhhffh.exeC:\Windows\system32\Ccfhhffh.exe76⤵
-
C:\Windows\SysWOW64\Cfeddafl.exeC:\Windows\system32\Cfeddafl.exe77⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Chcqpmep.exeC:\Windows\system32\Chcqpmep.exe78⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Cpjiajeb.exeC:\Windows\system32\Cpjiajeb.exe79⤵
-
C:\Windows\SysWOW64\Cciemedf.exeC:\Windows\system32\Cciemedf.exe80⤵
-
C:\Windows\SysWOW64\Cfgaiaci.exeC:\Windows\system32\Cfgaiaci.exe81⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Chemfl32.exeC:\Windows\system32\Chemfl32.exe82⤵
-
C:\Windows\SysWOW64\Ckdjbh32.exeC:\Windows\system32\Ckdjbh32.exe83⤵
-
C:\Windows\SysWOW64\Cckace32.exeC:\Windows\system32\Cckace32.exe84⤵
-
C:\Windows\SysWOW64\Cbnbobin.exeC:\Windows\system32\Cbnbobin.exe85⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Chhjkl32.exeC:\Windows\system32\Chhjkl32.exe86⤵
-
C:\Windows\SysWOW64\Clcflkic.exeC:\Windows\system32\Clcflkic.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Cndbcc32.exeC:\Windows\system32\Cndbcc32.exe88⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dbpodagk.exeC:\Windows\system32\Dbpodagk.exe89⤵
-
C:\Windows\SysWOW64\Dhjgal32.exeC:\Windows\system32\Dhjgal32.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dgmglh32.exeC:\Windows\system32\Dgmglh32.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Dngoibmo.exeC:\Windows\system32\Dngoibmo.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Dqelenlc.exeC:\Windows\system32\Dqelenlc.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Dhmcfkme.exeC:\Windows\system32\Dhmcfkme.exe94⤵
-
C:\Windows\SysWOW64\Dkkpbgli.exeC:\Windows\system32\Dkkpbgli.exe95⤵
-
C:\Windows\SysWOW64\Dnilobkm.exeC:\Windows\system32\Dnilobkm.exe96⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dbehoa32.exeC:\Windows\system32\Dbehoa32.exe97⤵
-
C:\Windows\SysWOW64\Dcfdgiid.exeC:\Windows\system32\Dcfdgiid.exe98⤵
-
C:\Windows\SysWOW64\Dgaqgh32.exeC:\Windows\system32\Dgaqgh32.exe99⤵
-
C:\Windows\SysWOW64\Djpmccqq.exeC:\Windows\system32\Djpmccqq.exe100⤵
-
C:\Windows\SysWOW64\Dmoipopd.exeC:\Windows\system32\Dmoipopd.exe101⤵
-
C:\Windows\SysWOW64\Dmoipopd.exeC:\Windows\system32\Dmoipopd.exe102⤵
-
C:\Windows\SysWOW64\Dqjepm32.exeC:\Windows\system32\Dqjepm32.exe103⤵
-
C:\Windows\SysWOW64\Dgdmmgpj.exeC:\Windows\system32\Dgdmmgpj.exe104⤵
-
C:\Windows\SysWOW64\Dfgmhd32.exeC:\Windows\system32\Dfgmhd32.exe105⤵
-
C:\Windows\SysWOW64\Dmafennb.exeC:\Windows\system32\Dmafennb.exe106⤵
-
C:\Windows\SysWOW64\Dqlafm32.exeC:\Windows\system32\Dqlafm32.exe107⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Dcknbh32.exeC:\Windows\system32\Dcknbh32.exe108⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Dgfjbgmh.exeC:\Windows\system32\Dgfjbgmh.exe109⤵
-
C:\Windows\SysWOW64\Djefobmk.exeC:\Windows\system32\Djefobmk.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Emcbkn32.exeC:\Windows\system32\Emcbkn32.exe111⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ecmkghcl.exeC:\Windows\system32\Ecmkghcl.exe112⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ebpkce32.exeC:\Windows\system32\Ebpkce32.exe113⤵
-
C:\Windows\SysWOW64\Eijcpoac.exeC:\Windows\system32\Eijcpoac.exe114⤵
-
C:\Windows\SysWOW64\Ekholjqg.exeC:\Windows\system32\Ekholjqg.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Epdkli32.exeC:\Windows\system32\Epdkli32.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Efncicpm.exeC:\Windows\system32\Efncicpm.exe117⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Eilpeooq.exeC:\Windows\system32\Eilpeooq.exe118⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ekklaj32.exeC:\Windows\system32\Ekklaj32.exe119⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ebedndfa.exeC:\Windows\system32\Ebedndfa.exe120⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Efppoc32.exeC:\Windows\system32\Efppoc32.exe121⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Epieghdk.exeC:\Windows\system32\Epieghdk.exe122⤵
-
C:\Windows\SysWOW64\Enkece32.exeC:\Windows\system32\Enkece32.exe123⤵
-
C:\Windows\SysWOW64\Eajaoq32.exeC:\Windows\system32\Eajaoq32.exe124⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Eiaiqn32.exeC:\Windows\system32\Eiaiqn32.exe125⤵
-
C:\Windows\SysWOW64\Eloemi32.exeC:\Windows\system32\Eloemi32.exe126⤵
-
C:\Windows\SysWOW64\Ennaieib.exeC:\Windows\system32\Ennaieib.exe127⤵
-
C:\Windows\SysWOW64\Fehjeo32.exeC:\Windows\system32\Fehjeo32.exe128⤵
-
C:\Windows\SysWOW64\Fckjalhj.exeC:\Windows\system32\Fckjalhj.exe129⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fjdbnf32.exeC:\Windows\system32\Fjdbnf32.exe130⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Fnpnndgp.exeC:\Windows\system32\Fnpnndgp.exe131⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Fejgko32.exeC:\Windows\system32\Fejgko32.exe132⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Fcmgfkeg.exeC:\Windows\system32\Fcmgfkeg.exe133⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Fhhcgj32.exeC:\Windows\system32\Fhhcgj32.exe134⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Fjgoce32.exeC:\Windows\system32\Fjgoce32.exe135⤵
-
C:\Windows\SysWOW64\Fmekoalh.exeC:\Windows\system32\Fmekoalh.exe136⤵
-
C:\Windows\SysWOW64\Faagpp32.exeC:\Windows\system32\Faagpp32.exe137⤵
-
C:\Windows\SysWOW64\Fjilieka.exeC:\Windows\system32\Fjilieka.exe138⤵
-
C:\Windows\SysWOW64\Filldb32.exeC:\Windows\system32\Filldb32.exe139⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Facdeo32.exeC:\Windows\system32\Facdeo32.exe140⤵
-
C:\Windows\SysWOW64\Fdapak32.exeC:\Windows\system32\Fdapak32.exe141⤵
-
C:\Windows\SysWOW64\Fjlhneio.exeC:\Windows\system32\Fjlhneio.exe142⤵
-
C:\Windows\SysWOW64\Fioija32.exeC:\Windows\system32\Fioija32.exe143⤵
-
C:\Windows\SysWOW64\Fphafl32.exeC:\Windows\system32\Fphafl32.exe144⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Fddmgjpo.exeC:\Windows\system32\Fddmgjpo.exe145⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ffbicfoc.exeC:\Windows\system32\Ffbicfoc.exe146⤵
-
C:\Windows\SysWOW64\Fiaeoang.exeC:\Windows\system32\Fiaeoang.exe147⤵
-
C:\Windows\SysWOW64\Globlmmj.exeC:\Windows\system32\Globlmmj.exe148⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Gonnhhln.exeC:\Windows\system32\Gonnhhln.exe149⤵
-
C:\Windows\SysWOW64\Gfefiemq.exeC:\Windows\system32\Gfefiemq.exe150⤵
-
C:\Windows\SysWOW64\Ghfbqn32.exeC:\Windows\system32\Ghfbqn32.exe151⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Gopkmhjk.exeC:\Windows\system32\Gopkmhjk.exe152⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Gbkgnfbd.exeC:\Windows\system32\Gbkgnfbd.exe153⤵
-
C:\Windows\SysWOW64\Gieojq32.exeC:\Windows\system32\Gieojq32.exe154⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gldkfl32.exeC:\Windows\system32\Gldkfl32.exe155⤵
-
C:\Windows\SysWOW64\Gbnccfpb.exeC:\Windows\system32\Gbnccfpb.exe156⤵
-
C:\Windows\SysWOW64\Gaqcoc32.exeC:\Windows\system32\Gaqcoc32.exe157⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Glfhll32.exeC:\Windows\system32\Glfhll32.exe158⤵
-
C:\Windows\SysWOW64\Gkihhhnm.exeC:\Windows\system32\Gkihhhnm.exe159⤵
-
C:\Windows\SysWOW64\Gacpdbej.exeC:\Windows\system32\Gacpdbej.exe160⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Geolea32.exeC:\Windows\system32\Geolea32.exe161⤵
-
C:\Windows\SysWOW64\Ggpimica.exeC:\Windows\system32\Ggpimica.exe162⤵
-
C:\Windows\SysWOW64\Gogangdc.exeC:\Windows\system32\Gogangdc.exe163⤵
-
C:\Windows\SysWOW64\Gphmeo32.exeC:\Windows\system32\Gphmeo32.exe164⤵
-
C:\Windows\SysWOW64\Gddifnbk.exeC:\Windows\system32\Gddifnbk.exe165⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ghoegl32.exeC:\Windows\system32\Ghoegl32.exe166⤵
-
C:\Windows\SysWOW64\Hiqbndpb.exeC:\Windows\system32\Hiqbndpb.exe167⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Hahjpbad.exeC:\Windows\system32\Hahjpbad.exe168⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hdfflm32.exeC:\Windows\system32\Hdfflm32.exe169⤵
-
C:\Windows\SysWOW64\Hgdbhi32.exeC:\Windows\system32\Hgdbhi32.exe170⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Hkpnhgge.exeC:\Windows\system32\Hkpnhgge.exe171⤵
-
C:\Windows\SysWOW64\Hlakpp32.exeC:\Windows\system32\Hlakpp32.exe172⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Hpmgqnfl.exeC:\Windows\system32\Hpmgqnfl.exe173⤵
-
C:\Windows\SysWOW64\Hckcmjep.exeC:\Windows\system32\Hckcmjep.exe174⤵
-
C:\Windows\SysWOW64\Hejoiedd.exeC:\Windows\system32\Hejoiedd.exe175⤵
-
C:\Windows\SysWOW64\Hiekid32.exeC:\Windows\system32\Hiekid32.exe176⤵
-
C:\Windows\SysWOW64\Hlcgeo32.exeC:\Windows\system32\Hlcgeo32.exe177⤵
-
C:\Windows\SysWOW64\Hcnpbi32.exeC:\Windows\system32\Hcnpbi32.exe178⤵
-
C:\Windows\SysWOW64\Hellne32.exeC:\Windows\system32\Hellne32.exe179⤵
-
C:\Windows\SysWOW64\Hhjhkq32.exeC:\Windows\system32\Hhjhkq32.exe180⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hpapln32.exeC:\Windows\system32\Hpapln32.exe181⤵
-
C:\Windows\SysWOW64\Hcplhi32.exeC:\Windows\system32\Hcplhi32.exe182⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Henidd32.exeC:\Windows\system32\Henidd32.exe183⤵
-
C:\Windows\SysWOW64\Hjjddchg.exeC:\Windows\system32\Hjjddchg.exe184⤵
-
C:\Windows\SysWOW64\Hlhaqogk.exeC:\Windows\system32\Hlhaqogk.exe185⤵
-
C:\Windows\SysWOW64\Icbimi32.exeC:\Windows\system32\Icbimi32.exe186⤵
-
C:\Windows\SysWOW64\Ieqeidnl.exeC:\Windows\system32\Ieqeidnl.exe187⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ihoafpmp.exeC:\Windows\system32\Ihoafpmp.exe188⤵
-
C:\Windows\SysWOW64\Ilknfn32.exeC:\Windows\system32\Ilknfn32.exe189⤵
-
C:\Windows\SysWOW64\Inljnfkg.exeC:\Windows\system32\Inljnfkg.exe190⤵
-
C:\Windows\SysWOW64\Ifcbodli.exeC:\Windows\system32\Ifcbodli.exe191⤵
-
C:\Windows\SysWOW64\Ihankokm.exeC:\Windows\system32\Ihankokm.exe192⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Ikpjgkjq.exeC:\Windows\system32\Ikpjgkjq.exe193⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Iajcde32.exeC:\Windows\system32\Iajcde32.exe194⤵
-
C:\Windows\SysWOW64\Iqmcpahh.exeC:\Windows\system32\Iqmcpahh.exe195⤵
-
C:\Windows\SysWOW64\Iggkllpe.exeC:\Windows\system32\Iggkllpe.exe196⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ikbgmj32.exeC:\Windows\system32\Ikbgmj32.exe197⤵
-
C:\Windows\SysWOW64\Inqcif32.exeC:\Windows\system32\Inqcif32.exe198⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Idklfpon.exeC:\Windows\system32\Idklfpon.exe199⤵
-
C:\Windows\SysWOW64\Ikddbj32.exeC:\Windows\system32\Ikddbj32.exe200⤵
-
C:\Windows\SysWOW64\Ijgdngmf.exeC:\Windows\system32\Ijgdngmf.exe201⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Iqalka32.exeC:\Windows\system32\Iqalka32.exe202⤵
-
C:\Windows\SysWOW64\Idmhkpml.exeC:\Windows\system32\Idmhkpml.exe203⤵
-
C:\Windows\SysWOW64\Ifnechbj.exeC:\Windows\system32\Ifnechbj.exe204⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Jnemdecl.exeC:\Windows\system32\Jnemdecl.exe205⤵
-
C:\Windows\SysWOW64\Jqdipqbp.exeC:\Windows\system32\Jqdipqbp.exe206⤵
-
C:\Windows\SysWOW64\Jcbellac.exeC:\Windows\system32\Jcbellac.exe207⤵
-
C:\Windows\SysWOW64\Jgnamk32.exeC:\Windows\system32\Jgnamk32.exe208⤵
-
C:\Windows\SysWOW64\Jmjjea32.exeC:\Windows\system32\Jmjjea32.exe209⤵
-
C:\Windows\SysWOW64\Jqfffqpm.exeC:\Windows\system32\Jqfffqpm.exe210⤵
-
C:\Windows\SysWOW64\Jbgbni32.exeC:\Windows\system32\Jbgbni32.exe211⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Jfcnngnd.exeC:\Windows\system32\Jfcnngnd.exe212⤵
-
C:\Windows\SysWOW64\Jkpgfn32.exeC:\Windows\system32\Jkpgfn32.exe213⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Jcgogk32.exeC:\Windows\system32\Jcgogk32.exe214⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Jfekcg32.exeC:\Windows\system32\Jfekcg32.exe215⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Jicgpb32.exeC:\Windows\system32\Jicgpb32.exe216⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Jkbcln32.exeC:\Windows\system32\Jkbcln32.exe217⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Jnqphi32.exeC:\Windows\system32\Jnqphi32.exe218⤵
-
C:\Windows\SysWOW64\Jfghif32.exeC:\Windows\system32\Jfghif32.exe219⤵
-
C:\Windows\SysWOW64\Jgidao32.exeC:\Windows\system32\Jgidao32.exe220⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Joplbl32.exeC:\Windows\system32\Joplbl32.exe221⤵
-
C:\Windows\SysWOW64\Kaaijdgn.exeC:\Windows\system32\Kaaijdgn.exe222⤵
-
C:\Windows\SysWOW64\Kemejc32.exeC:\Windows\system32\Kemejc32.exe223⤵
-
C:\Windows\SysWOW64\Kkgmgmfd.exeC:\Windows\system32\Kkgmgmfd.exe224⤵
-
C:\Windows\SysWOW64\Kneicieh.exeC:\Windows\system32\Kneicieh.exe225⤵
-
C:\Windows\SysWOW64\Kaceodek.exeC:\Windows\system32\Kaceodek.exe226⤵
-
C:\Windows\SysWOW64\Kjljhjkl.exeC:\Windows\system32\Kjljhjkl.exe227⤵
-
C:\Windows\SysWOW64\Keanebkb.exeC:\Windows\system32\Keanebkb.exe228⤵
-
C:\Windows\SysWOW64\Kcdnao32.exeC:\Windows\system32\Kcdnao32.exe229⤵
-
C:\Windows\SysWOW64\Kjnfniii.exeC:\Windows\system32\Kjnfniii.exe230⤵
-
C:\Windows\SysWOW64\Knjbnh32.exeC:\Windows\system32\Knjbnh32.exe231⤵
-
C:\Windows\SysWOW64\Kahojc32.exeC:\Windows\system32\Kahojc32.exe232⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Kpkofpgq.exeC:\Windows\system32\Kpkofpgq.exe233⤵
-
C:\Windows\SysWOW64\Kfegbj32.exeC:\Windows\system32\Kfegbj32.exe234⤵
-
C:\Windows\SysWOW64\Kjqccigf.exeC:\Windows\system32\Kjqccigf.exe235⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kiccofna.exeC:\Windows\system32\Kiccofna.exe236⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kaklpcoc.exeC:\Windows\system32\Kaklpcoc.exe237⤵
-
C:\Windows\SysWOW64\Kblhgk32.exeC:\Windows\system32\Kblhgk32.exe238⤵
-
C:\Windows\SysWOW64\Kjcpii32.exeC:\Windows\system32\Kjcpii32.exe239⤵
-
C:\Windows\SysWOW64\Lldlqakb.exeC:\Windows\system32\Lldlqakb.exe240⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Lckdanld.exeC:\Windows\system32\Lckdanld.exe241⤵