Analysis
-
max time kernel
95s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2024 02:36
Static task
static1
Behavioral task
behavioral1
Sample
c2a40adec16657aa9663ab3fc3dc9f6e4862c17c9561e993da10646c996129f8.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c2a40adec16657aa9663ab3fc3dc9f6e4862c17c9561e993da10646c996129f8.exe
Resource
win10v2004-20240426-en
General
-
Target
c2a40adec16657aa9663ab3fc3dc9f6e4862c17c9561e993da10646c996129f8.exe
-
Size
163KB
-
MD5
e04d8d4b317d6f979c60170854799d76
-
SHA1
fe0e3ecf0dbdca71ca45447d2236f95f8570fc1c
-
SHA256
c2a40adec16657aa9663ab3fc3dc9f6e4862c17c9561e993da10646c996129f8
-
SHA512
55872cbb74dd8206eb48722f5bb04ae02e4c3b6e1176477bbe251afd3a9816af7e67001d5769cff59a0612ee8325c5786cd38b4c0d9025516d34587e6fd108bf
-
SSDEEP
1536:PPB1OIJrr8Bmkq7wb/U6u5wmlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:B1OCrbyMKmltOrWKDBr+yJb
Malware Config
Extracted
gozi
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Fdfmlhna.exeHdilnojp.exeLbgalmej.exeOgklelna.exeOjjolnaq.exeOidofh32.exeBdkcmdhp.exeHckjacjg.exeNgedij32.exePjgebf32.exeFkkeclfh.exeLddbqa32.exeLgffic32.exeNafjjf32.exeGcfqfc32.exePmidog32.exeHfklhhcl.exeOcdjpmac.exeBlmacb32.exeEkemhj32.exePhganm32.exeHjmoibog.exeNheble32.exeFcfhof32.exeBjbndobo.exeBeglgani.exeNloiakho.exeKbddfmgl.exeOjjffddl.exeDabhdinj.exeEkbihd32.exeKiggbhda.exeGknkpjfb.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdfmlhna.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hdilnojp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lbgalmej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ogklelna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojjolnaq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oidofh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bdkcmdhp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hckjacjg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngedij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pjgebf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fkkeclfh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lddbqa32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjgebf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgffic32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nafjjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gcfqfc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmidog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hfklhhcl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ocdjpmac.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Blmacb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ekemhj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phganm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjmoibog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nheble32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fcfhof32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjbndobo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Beglgani.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nloiakho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kbddfmgl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ojjffddl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dabhdinj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ekbihd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kiggbhda.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gknkpjfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" -
Detects executables built or packed with MPress PE compressor 64 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\Hfjmgdlf.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Hmfbjnbp.exe INDICATOR_EXE_Packed_MPress behavioral2/memory/2152-65-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Hadkpm32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Haggelfd.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Haidklda.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Iidipnal.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Imbaemhc.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ifjfnb32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Iiibkn32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Idofhfmm.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Iabgaklg.exe INDICATOR_EXE_Packed_MPress behavioral2/memory/4508-353-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kkpnlm32.exe INDICATOR_EXE_Packed_MPress behavioral2/memory/4324-419-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/3684-425-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2672-486-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2156-563-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/1036-607-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mcbahlip.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ocqnij32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Pcjapi32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bejogg32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bldgdago.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bemlmgnp.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dkljak32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Fcckif32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Fhcpgmjf.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Faihkbci.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Fcmnpe32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Fkmchi32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Fdnjgmle.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ehedfo32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dlncan32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dceohhja.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dafbne32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dboigi32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ckedalaj.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cdkldb32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ckcgkldl.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Colffknh.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cliaoq32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cdainc32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cbqlfkmi.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bopgjmhe.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bdkcmdhp.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bdfibe32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Aealah32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Alhhhcal.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Andgoobc.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Acocaf32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Alabgd32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Qloebdig.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Pengdk32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Pndohaqe.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Pjffbc32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Pnpemb32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Oqihnn32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Oqgkhnjf.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Obdkma32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Okjbpglo.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ojjffddl.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ojhiqefo.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ndkahnhh.exe INDICATOR_EXE_Packed_MPress -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\Hfjmgdlf.exe UPX C:\Windows\SysWOW64\Hmfbjnbp.exe UPX behavioral2/memory/2152-65-0x0000000000400000-0x0000000000453000-memory.dmp UPX C:\Windows\SysWOW64\Hadkpm32.exe UPX C:\Windows\SysWOW64\Haggelfd.exe UPX C:\Windows\SysWOW64\Haidklda.exe UPX C:\Windows\SysWOW64\Iidipnal.exe UPX behavioral2/memory/1536-144-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/2368-152-0x0000000000400000-0x0000000000453000-memory.dmp UPX C:\Windows\SysWOW64\Icljbg32.exe UPX C:\Windows\SysWOW64\Imbaemhc.exe UPX C:\Windows\SysWOW64\Ifjfnb32.exe UPX C:\Windows\SysWOW64\Iiibkn32.exe UPX C:\Windows\SysWOW64\Idofhfmm.exe UPX behavioral2/memory/3600-200-0x0000000000400000-0x0000000000453000-memory.dmp UPX C:\Windows\SysWOW64\Iabgaklg.exe UPX behavioral2/memory/3704-216-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/864-224-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/3000-236-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/1616-248-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/2720-256-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/908-297-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/4508-353-0x0000000000400000-0x0000000000453000-memory.dmp UPX C:\Windows\SysWOW64\Kkpnlm32.exe UPX behavioral2/memory/4324-419-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/3684-425-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/2672-486-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/2156-563-0x0000000000400000-0x0000000000453000-memory.dmp UPX C:\Windows\SysWOW64\Mcbahlip.exe UPX C:\Windows\SysWOW64\Ocqnij32.exe UPX C:\Windows\SysWOW64\Pcjapi32.exe UPX C:\Windows\SysWOW64\Bejogg32.exe UPX C:\Windows\SysWOW64\Bldgdago.exe UPX C:\Windows\SysWOW64\Bemlmgnp.exe UPX C:\Windows\SysWOW64\Dkljak32.exe UPX C:\Windows\SysWOW64\Fcckif32.exe UPX C:\Windows\SysWOW64\Fhcpgmjf.exe UPX C:\Windows\SysWOW64\Faihkbci.exe UPX C:\Windows\SysWOW64\Fcmnpe32.exe UPX C:\Windows\SysWOW64\Fkmchi32.exe UPX C:\Windows\SysWOW64\Fdnjgmle.exe UPX C:\Windows\SysWOW64\Ehedfo32.exe UPX C:\Windows\SysWOW64\Dlncan32.exe UPX C:\Windows\SysWOW64\Dceohhja.exe UPX C:\Windows\SysWOW64\Dafbne32.exe UPX C:\Windows\SysWOW64\Dboigi32.exe UPX C:\Windows\SysWOW64\Ckedalaj.exe UPX C:\Windows\SysWOW64\Cdkldb32.exe UPX C:\Windows\SysWOW64\Ckcgkldl.exe UPX C:\Windows\SysWOW64\Colffknh.exe UPX C:\Windows\SysWOW64\Cliaoq32.exe UPX C:\Windows\SysWOW64\Cdainc32.exe UPX C:\Windows\SysWOW64\Cbqlfkmi.exe UPX C:\Windows\SysWOW64\Bopgjmhe.exe UPX C:\Windows\SysWOW64\Bdkcmdhp.exe UPX C:\Windows\SysWOW64\Bdfibe32.exe UPX C:\Windows\SysWOW64\Aealah32.exe UPX C:\Windows\SysWOW64\Alhhhcal.exe UPX C:\Windows\SysWOW64\Andgoobc.exe UPX C:\Windows\SysWOW64\Acocaf32.exe UPX C:\Windows\SysWOW64\Alabgd32.exe UPX C:\Windows\SysWOW64\Qloebdig.exe UPX C:\Windows\SysWOW64\Pengdk32.exe UPX C:\Windows\SysWOW64\Pndohaqe.exe UPX -
Executes dropped EXE 64 IoCs
Processes:
Hfjmgdlf.exeHmdedo32.exeHpbaqj32.exeHbanme32.exeHfljmdjc.exeHjhfnccl.exeHmfbjnbp.exeHimcoo32.exeHadkpm32.exeHjmoibog.exeHaggelfd.exeHcedaheh.exeHjolnb32.exeHaidklda.exeIbjqcd32.exeIidipnal.exeIpnalhii.exeIfhiib32.exeImbaemhc.exeIcljbg32.exeIfjfnb32.exeIiibkn32.exeIpckgh32.exeIdofhfmm.exeIjhodq32.exeIabgaklg.exeIbccic32.exeIinlemia.exeJaedgjjd.exeJbfpobpb.exeJiphkm32.exeJdemhe32.exeJbhmdbnp.exeJmnaakne.exeJplmmfmi.exeJfffjqdf.exeJidbflcj.exeJmpngk32.exeJdjfcecp.exeJbmfoa32.exeJkdnpo32.exeJmbklj32.exeJpaghf32.exeJbocea32.exeJiikak32.exeKaqcbi32.exeKdopod32.exeKbapjafe.exeKgmlkp32.exeKilhgk32.exeKacphh32.exeKkkdan32.exeKmjqmi32.exeKdcijcke.exeKbfiep32.exeKknafn32.exeKagichjo.exeKdffocib.exeKkpnlm32.exeKmnjhioc.exeKajfig32.exeLmqgnhmp.exeLpocjdld.exeLcmofolg.exepid process 4164 Hfjmgdlf.exe 4988 Hmdedo32.exe 2108 Hpbaqj32.exe 2892 Hbanme32.exe 2936 Hfljmdjc.exe 1076 Hjhfnccl.exe 2616 Hmfbjnbp.exe 2152 Himcoo32.exe 4804 Hadkpm32.exe 2264 Hjmoibog.exe 5000 Haggelfd.exe 1036 Hcedaheh.exe 4092 Hjolnb32.exe 4480 Haidklda.exe 4524 Ibjqcd32.exe 3952 Iidipnal.exe 4544 Ipnalhii.exe 1536 Ifhiib32.exe 2368 Imbaemhc.exe 2308 Icljbg32.exe 1448 Ifjfnb32.exe 2164 Iiibkn32.exe 1456 Ipckgh32.exe 2256 Idofhfmm.exe 3600 Ijhodq32.exe 3588 Iabgaklg.exe 3704 Ibccic32.exe 864 Iinlemia.exe 3000 Jaedgjjd.exe 1720 Jbfpobpb.exe 1616 Jiphkm32.exe 2720 Jdemhe32.exe 4528 Jbhmdbnp.exe 3440 Jmnaakne.exe 2160 Jplmmfmi.exe 3096 Jfffjqdf.exe 4964 Jidbflcj.exe 1320 Jmpngk32.exe 908 Jdjfcecp.exe 4212 Jbmfoa32.exe 2236 Jkdnpo32.exe 2208 Jmbklj32.exe 368 Jpaghf32.exe 4368 Jbocea32.exe 1904 Jiikak32.exe 3712 Kaqcbi32.exe 1416 Kdopod32.exe 4508 Kbapjafe.exe 3348 Kgmlkp32.exe 5056 Kilhgk32.exe 2804 Kacphh32.exe 1260 Kkkdan32.exe 3872 Kmjqmi32.exe 4916 Kdcijcke.exe 2724 Kbfiep32.exe 4344 Kknafn32.exe 4284 Kagichjo.exe 408 Kdffocib.exe 3628 Kkpnlm32.exe 4324 Kmnjhioc.exe 3684 Kajfig32.exe 712 Lmqgnhmp.exe 1872 Lpocjdld.exe 4168 Lcmofolg.exe -
Drops file in System32 directory 64 IoCs
Processes:
Qnkdhpjn.exeEabbjc32.exeEadopc32.exePjgebf32.exeQfbobf32.exeBcinna32.exeJdemhe32.exeGaadfkgc.exeCgndoeag.exeHnodaecc.exeMaeachag.exeDahode32.exeFdbdah32.exeEpagkd32.exeGgpbjkpl.exeFhemmlhc.exeOpogbbig.exeAbemjmgg.exeFafdkmap.exeBqfoamfj.exeIgedlh32.exeGdcdbl32.exeGfdfgiid.exePlhnda32.exeQoifflkg.exeAfjeceml.exeDdcqedkk.exeMdehlk32.exeAlcfei32.exeCqpbglno.exePjkombfj.exeHpfcdojl.exeJgogbgei.exeAfgacokc.exedescription ioc process File created C:\Windows\SysWOW64\Ldjcfk32.dll File created C:\Windows\SysWOW64\Ehpadhll.exe File created C:\Windows\SysWOW64\Ibihdfhm.dll Qnkdhpjn.exe File created C:\Windows\SysWOW64\Dcjfkm32.dll Eabbjc32.exe File opened for modification C:\Windows\SysWOW64\Eepjpb32.exe Eadopc32.exe File opened for modification C:\Windows\SysWOW64\Pleaoa32.exe Pjgebf32.exe File created C:\Windows\SysWOW64\Ipcmii32.dll Qfbobf32.exe File created C:\Windows\SysWOW64\Bcpcam32.dll Bcinna32.exe File created C:\Windows\SysWOW64\Qglobbdg.dll File created C:\Windows\SysWOW64\Jjdejk32.dll File created C:\Windows\SysWOW64\Baadiiif.exe File opened for modification C:\Windows\SysWOW64\Jbhmdbnp.exe Jdemhe32.exe File opened for modification C:\Windows\SysWOW64\Ghklce32.exe Gaadfkgc.exe File created C:\Windows\SysWOW64\Cfadkb32.exe Cgndoeag.exe File created C:\Windows\SysWOW64\Hdilnojp.exe Hnodaecc.exe File created C:\Windows\SysWOW64\Abcgjd32.dll Maeachag.exe File created C:\Windows\SysWOW64\Ghqomgid.dll File opened for modification C:\Windows\SysWOW64\Ojhpimhp.exe File created C:\Windows\SysWOW64\Aggpfkjj.exe File created C:\Windows\SysWOW64\Mioaanec.dll File created C:\Windows\SysWOW64\Higchddh.dll Dahode32.exe File created C:\Windows\SysWOW64\Odpich32.dll Fdbdah32.exe File opened for modification C:\Windows\SysWOW64\Ehhpla32.exe Epagkd32.exe File opened for modification C:\Windows\SysWOW64\Gnjjfegi.exe Ggpbjkpl.exe File created C:\Windows\SysWOW64\Ncnofeof.exe File created C:\Windows\SysWOW64\Ocjoadei.exe File created C:\Windows\SysWOW64\Defbaa32.dll File created C:\Windows\SysWOW64\Flqimk32.exe Fhemmlhc.exe File created C:\Windows\SysWOW64\Ocmconhk.exe Opogbbig.exe File created C:\Windows\SysWOW64\Iinqbn32.exe File created C:\Windows\SysWOW64\Ajdggc32.dll File created C:\Windows\SysWOW64\Fbohan32.dll Abemjmgg.exe File created C:\Windows\SysWOW64\Fjnnje32.dll Fafdkmap.exe File opened for modification C:\Windows\SysWOW64\Bcelmhen.exe Bqfoamfj.exe File created C:\Windows\SysWOW64\Kamojc32.dll Igedlh32.exe File created C:\Windows\SysWOW64\Ijqmhnko.exe File created C:\Windows\SysWOW64\Fniihmpf.exe File created C:\Windows\SysWOW64\Lcjcnoej.exe File created C:\Windows\SysWOW64\Ekppjn32.dll File created C:\Windows\SysWOW64\Dhbebj32.exe File created C:\Windows\SysWOW64\Geldkfpi.exe File opened for modification C:\Windows\SysWOW64\Eqdpgk32.exe File opened for modification C:\Windows\SysWOW64\Gmjlcj32.exe Gdcdbl32.exe File opened for modification C:\Windows\SysWOW64\Ggeboaob.exe Gfdfgiid.exe File created C:\Windows\SysWOW64\Elcenjob.dll Plhnda32.exe File created C:\Windows\SysWOW64\Pnjbcghk.dll File opened for modification C:\Windows\SysWOW64\Kpjgaoqm.exe File opened for modification C:\Windows\SysWOW64\Ojajin32.exe File created C:\Windows\SysWOW64\Qgpogili.exe Qoifflkg.exe File opened for modification C:\Windows\SysWOW64\Aihaoqlp.exe Afjeceml.exe File created C:\Windows\SysWOW64\Dfamapjo.exe Ddcqedkk.exe File created C:\Windows\SysWOW64\Klahfp32.exe File opened for modification C:\Windows\SysWOW64\Oghghb32.exe File opened for modification C:\Windows\SysWOW64\Megdccmb.exe Mdehlk32.exe File opened for modification C:\Windows\SysWOW64\Aoabad32.exe Alcfei32.exe File created C:\Windows\SysWOW64\Dblgpl32.exe File created C:\Windows\SysWOW64\Ccnncgmc.exe Cqpbglno.exe File created C:\Windows\SysWOW64\Mmmqhl32.exe File created C:\Windows\SysWOW64\Pbbgnpgl.exe Pjkombfj.exe File created C:\Windows\SysWOW64\Bcjppk32.dll Hpfcdojl.exe File created C:\Windows\SysWOW64\Fclbolkk.dll Jgogbgei.exe File created C:\Windows\SysWOW64\Jimehgni.dll Afgacokc.exe File created C:\Windows\SysWOW64\Jekeodnf.dll File opened for modification C:\Windows\SysWOW64\Mmmqhl32.exe -
Program crash 1 IoCs
Processes:
pid pid_target process target process 4764 18580 -
Modifies registry class 64 IoCs
Processes:
Mglack32.exeOdgqdlnj.exeAodfajaj.exeHfjmgdlf.exeBjdkjo32.exeHgjljpkm.exeHhihdcbp.exeOgmijllo.exeAmhfkopc.exeDhkapp32.exePeimil32.exeGcojed32.exeMmnldp32.exeFpmggb32.exeBbdhiojo.exeAcmflf32.exeMhdckaeo.exeObdkma32.exeGcddpdpo.exeNjnpppkn.exeCagobalc.exeJmbklj32.exeOgjmdigk.exeObidhaog.exeDhpjkojk.exeBciehh32.exeIhphkl32.exeLghcocol.exeFooeif32.exeNeppokal.exeHjjnae32.exeCacmah32.exeDldpkoil.exeFcfhof32.exeFhgbhfbe.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mglack32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekiapn32.dll" Odgqdlnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dahkpm32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aodfajaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lielhgaa.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iankcfdg.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjpdme32.dll" Hfjmgdlf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bjdkjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hgjljpkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hhihdcbp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ogmijllo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Amhfkopc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jejechjg.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjqehkaf.dll" Dhkapp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dikngm32.dll" Peimil32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gcojed32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mmnldp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fpmggb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bbdhiojo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nggdeh32.dll" Acmflf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mhdckaeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pabcflhd.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmfgdeof.dll" Obdkma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkomqm32.dll" Gcddpdpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Njnpppkn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjngmo32.dll" Cagobalc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Piiqdm32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibodeh32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jmbklj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ogjmdigk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Obidhaog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Genaegmo.dll" Dhpjkojk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bciehh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dckhejil.dll" Ihphkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olojcl32.dll" Lghcocol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcjfln32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ophfae32.dll" Fooeif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Neppokal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hjjnae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npmknd32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ienanm32.dll" Cacmah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dldpkoil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kldggoeb.dll" Fcfhof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efqidp32.dll" Fhgbhfbe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c2a40adec16657aa9663ab3fc3dc9f6e4862c17c9561e993da10646c996129f8.exeHfjmgdlf.exeHmdedo32.exeHpbaqj32.exeHbanme32.exeHfljmdjc.exeHjhfnccl.exeHmfbjnbp.exeHimcoo32.exeHadkpm32.exeHjmoibog.exeHaggelfd.exeHcedaheh.exeHjolnb32.exeHaidklda.exeIbjqcd32.exeIidipnal.exeIpnalhii.exeIfhiib32.exeImbaemhc.exeIcljbg32.exeIfjfnb32.exedescription pid process target process PID 756 wrote to memory of 4164 756 c2a40adec16657aa9663ab3fc3dc9f6e4862c17c9561e993da10646c996129f8.exe Hfjmgdlf.exe PID 756 wrote to memory of 4164 756 c2a40adec16657aa9663ab3fc3dc9f6e4862c17c9561e993da10646c996129f8.exe Hfjmgdlf.exe PID 756 wrote to memory of 4164 756 c2a40adec16657aa9663ab3fc3dc9f6e4862c17c9561e993da10646c996129f8.exe Hfjmgdlf.exe PID 4164 wrote to memory of 4988 4164 Hfjmgdlf.exe Hmdedo32.exe PID 4164 wrote to memory of 4988 4164 Hfjmgdlf.exe Hmdedo32.exe PID 4164 wrote to memory of 4988 4164 Hfjmgdlf.exe Hmdedo32.exe PID 4988 wrote to memory of 2108 4988 Hmdedo32.exe Hpbaqj32.exe PID 4988 wrote to memory of 2108 4988 Hmdedo32.exe Hpbaqj32.exe PID 4988 wrote to memory of 2108 4988 Hmdedo32.exe Hpbaqj32.exe PID 2108 wrote to memory of 2892 2108 Hpbaqj32.exe Hbanme32.exe PID 2108 wrote to memory of 2892 2108 Hpbaqj32.exe Hbanme32.exe PID 2108 wrote to memory of 2892 2108 Hpbaqj32.exe Hbanme32.exe PID 2892 wrote to memory of 2936 2892 Hbanme32.exe Hfljmdjc.exe PID 2892 wrote to memory of 2936 2892 Hbanme32.exe Hfljmdjc.exe PID 2892 wrote to memory of 2936 2892 Hbanme32.exe Hfljmdjc.exe PID 2936 wrote to memory of 1076 2936 Hfljmdjc.exe Hjhfnccl.exe PID 2936 wrote to memory of 1076 2936 Hfljmdjc.exe Hjhfnccl.exe PID 2936 wrote to memory of 1076 2936 Hfljmdjc.exe Hjhfnccl.exe PID 1076 wrote to memory of 2616 1076 Hjhfnccl.exe Hmfbjnbp.exe PID 1076 wrote to memory of 2616 1076 Hjhfnccl.exe Hmfbjnbp.exe PID 1076 wrote to memory of 2616 1076 Hjhfnccl.exe Hmfbjnbp.exe PID 2616 wrote to memory of 2152 2616 Hmfbjnbp.exe Himcoo32.exe PID 2616 wrote to memory of 2152 2616 Hmfbjnbp.exe Himcoo32.exe PID 2616 wrote to memory of 2152 2616 Hmfbjnbp.exe Himcoo32.exe PID 2152 wrote to memory of 4804 2152 Himcoo32.exe Hadkpm32.exe PID 2152 wrote to memory of 4804 2152 Himcoo32.exe Hadkpm32.exe PID 2152 wrote to memory of 4804 2152 Himcoo32.exe Hadkpm32.exe PID 4804 wrote to memory of 2264 4804 Hadkpm32.exe Hjmoibog.exe PID 4804 wrote to memory of 2264 4804 Hadkpm32.exe Hjmoibog.exe PID 4804 wrote to memory of 2264 4804 Hadkpm32.exe Hjmoibog.exe PID 2264 wrote to memory of 5000 2264 Hjmoibog.exe Haggelfd.exe PID 2264 wrote to memory of 5000 2264 Hjmoibog.exe Haggelfd.exe PID 2264 wrote to memory of 5000 2264 Hjmoibog.exe Haggelfd.exe PID 5000 wrote to memory of 1036 5000 Haggelfd.exe Hcedaheh.exe PID 5000 wrote to memory of 1036 5000 Haggelfd.exe Hcedaheh.exe PID 5000 wrote to memory of 1036 5000 Haggelfd.exe Hcedaheh.exe PID 1036 wrote to memory of 4092 1036 Hcedaheh.exe Hjolnb32.exe PID 1036 wrote to memory of 4092 1036 Hcedaheh.exe Hjolnb32.exe PID 1036 wrote to memory of 4092 1036 Hcedaheh.exe Hjolnb32.exe PID 4092 wrote to memory of 4480 4092 Hjolnb32.exe Haidklda.exe PID 4092 wrote to memory of 4480 4092 Hjolnb32.exe Haidklda.exe PID 4092 wrote to memory of 4480 4092 Hjolnb32.exe Haidklda.exe PID 4480 wrote to memory of 4524 4480 Haidklda.exe Ibjqcd32.exe PID 4480 wrote to memory of 4524 4480 Haidklda.exe Ibjqcd32.exe PID 4480 wrote to memory of 4524 4480 Haidklda.exe Ibjqcd32.exe PID 4524 wrote to memory of 3952 4524 Ibjqcd32.exe Iidipnal.exe PID 4524 wrote to memory of 3952 4524 Ibjqcd32.exe Iidipnal.exe PID 4524 wrote to memory of 3952 4524 Ibjqcd32.exe Iidipnal.exe PID 3952 wrote to memory of 4544 3952 Iidipnal.exe Ipnalhii.exe PID 3952 wrote to memory of 4544 3952 Iidipnal.exe Ipnalhii.exe PID 3952 wrote to memory of 4544 3952 Iidipnal.exe Ipnalhii.exe PID 4544 wrote to memory of 1536 4544 Ipnalhii.exe Ifhiib32.exe PID 4544 wrote to memory of 1536 4544 Ipnalhii.exe Ifhiib32.exe PID 4544 wrote to memory of 1536 4544 Ipnalhii.exe Ifhiib32.exe PID 1536 wrote to memory of 2368 1536 Ifhiib32.exe Imbaemhc.exe PID 1536 wrote to memory of 2368 1536 Ifhiib32.exe Imbaemhc.exe PID 1536 wrote to memory of 2368 1536 Ifhiib32.exe Imbaemhc.exe PID 2368 wrote to memory of 2308 2368 Imbaemhc.exe Icljbg32.exe PID 2368 wrote to memory of 2308 2368 Imbaemhc.exe Icljbg32.exe PID 2368 wrote to memory of 2308 2368 Imbaemhc.exe Icljbg32.exe PID 2308 wrote to memory of 1448 2308 Icljbg32.exe Ifjfnb32.exe PID 2308 wrote to memory of 1448 2308 Icljbg32.exe Ifjfnb32.exe PID 2308 wrote to memory of 1448 2308 Icljbg32.exe Ifjfnb32.exe PID 1448 wrote to memory of 2164 1448 Ifjfnb32.exe Iiibkn32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\572178285\zmstage.exeC:\Users\Admin\AppData\Local\Temp\572178285\zmstage.exe1⤵PID:4528
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\c2a40adec16657aa9663ab3fc3dc9f6e4862c17c9561e993da10646c996129f8.exe"C:\Users\Admin\AppData\Local\Temp\c2a40adec16657aa9663ab3fc3dc9f6e4862c17c9561e993da10646c996129f8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\Hfjmgdlf.exeC:\Windows\system32\Hfjmgdlf.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\Hmdedo32.exeC:\Windows\system32\Hmdedo32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\Hpbaqj32.exeC:\Windows\system32\Hpbaqj32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\Hbanme32.exeC:\Windows\system32\Hbanme32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\Hfljmdjc.exeC:\Windows\system32\Hfljmdjc.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\Hjhfnccl.exeC:\Windows\system32\Hjhfnccl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\Hmfbjnbp.exeC:\Windows\system32\Hmfbjnbp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\Himcoo32.exeC:\Windows\system32\Himcoo32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\Hadkpm32.exeC:\Windows\system32\Hadkpm32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\Hjmoibog.exeC:\Windows\system32\Hjmoibog.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\Haggelfd.exeC:\Windows\system32\Haggelfd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\Hcedaheh.exeC:\Windows\system32\Hcedaheh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\Hjolnb32.exeC:\Windows\system32\Hjolnb32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\Haidklda.exeC:\Windows\system32\Haidklda.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\Ibjqcd32.exeC:\Windows\system32\Ibjqcd32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\Iidipnal.exeC:\Windows\system32\Iidipnal.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\Ipnalhii.exeC:\Windows\system32\Ipnalhii.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\Ifhiib32.exeC:\Windows\system32\Ifhiib32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\Imbaemhc.exeC:\Windows\system32\Imbaemhc.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\Icljbg32.exeC:\Windows\system32\Icljbg32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\Ifjfnb32.exeC:\Windows\system32\Ifjfnb32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\Iiibkn32.exeC:\Windows\system32\Iiibkn32.exe23⤵
- Executes dropped EXE
PID:2164 -
C:\Windows\SysWOW64\Ipckgh32.exeC:\Windows\system32\Ipckgh32.exe24⤵
- Executes dropped EXE
PID:1456 -
C:\Windows\SysWOW64\Idofhfmm.exeC:\Windows\system32\Idofhfmm.exe25⤵
- Executes dropped EXE
PID:2256 -
C:\Windows\SysWOW64\Ijhodq32.exeC:\Windows\system32\Ijhodq32.exe26⤵
- Executes dropped EXE
PID:3600 -
C:\Windows\SysWOW64\Iabgaklg.exeC:\Windows\system32\Iabgaklg.exe27⤵
- Executes dropped EXE
PID:3588 -
C:\Windows\SysWOW64\Ibccic32.exeC:\Windows\system32\Ibccic32.exe28⤵
- Executes dropped EXE
PID:3704 -
C:\Windows\SysWOW64\Iinlemia.exeC:\Windows\system32\Iinlemia.exe29⤵
- Executes dropped EXE
PID:864 -
C:\Windows\SysWOW64\Jaedgjjd.exeC:\Windows\system32\Jaedgjjd.exe30⤵
- Executes dropped EXE
PID:3000 -
C:\Windows\SysWOW64\Jbfpobpb.exeC:\Windows\system32\Jbfpobpb.exe31⤵
- Executes dropped EXE
PID:1720 -
C:\Windows\SysWOW64\Jiphkm32.exeC:\Windows\system32\Jiphkm32.exe32⤵
- Executes dropped EXE
PID:1616 -
C:\Windows\SysWOW64\Jdemhe32.exeC:\Windows\system32\Jdemhe32.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2720 -
C:\Windows\SysWOW64\Jbhmdbnp.exeC:\Windows\system32\Jbhmdbnp.exe34⤵
- Executes dropped EXE
PID:4528 -
C:\Windows\SysWOW64\Jibeql32.exeC:\Windows\system32\Jibeql32.exe35⤵PID:4180
-
C:\Windows\SysWOW64\Jmnaakne.exeC:\Windows\system32\Jmnaakne.exe36⤵
- Executes dropped EXE
PID:3440 -
C:\Windows\SysWOW64\Jplmmfmi.exeC:\Windows\system32\Jplmmfmi.exe37⤵
- Executes dropped EXE
PID:2160 -
C:\Windows\SysWOW64\Jfffjqdf.exeC:\Windows\system32\Jfffjqdf.exe38⤵
- Executes dropped EXE
PID:3096 -
C:\Windows\SysWOW64\Jidbflcj.exeC:\Windows\system32\Jidbflcj.exe39⤵
- Executes dropped EXE
PID:4964 -
C:\Windows\SysWOW64\Jmpngk32.exeC:\Windows\system32\Jmpngk32.exe40⤵
- Executes dropped EXE
PID:1320 -
C:\Windows\SysWOW64\Jdjfcecp.exeC:\Windows\system32\Jdjfcecp.exe41⤵
- Executes dropped EXE
PID:908 -
C:\Windows\SysWOW64\Jbmfoa32.exeC:\Windows\system32\Jbmfoa32.exe42⤵
- Executes dropped EXE
PID:4212 -
C:\Windows\SysWOW64\Jkdnpo32.exeC:\Windows\system32\Jkdnpo32.exe43⤵
- Executes dropped EXE
PID:2236 -
C:\Windows\SysWOW64\Jmbklj32.exeC:\Windows\system32\Jmbklj32.exe44⤵
- Executes dropped EXE
- Modifies registry class
PID:2208 -
C:\Windows\SysWOW64\Jpaghf32.exeC:\Windows\system32\Jpaghf32.exe45⤵
- Executes dropped EXE
PID:368 -
C:\Windows\SysWOW64\Jbocea32.exeC:\Windows\system32\Jbocea32.exe46⤵
- Executes dropped EXE
PID:4368 -
C:\Windows\SysWOW64\Jiikak32.exeC:\Windows\system32\Jiikak32.exe47⤵
- Executes dropped EXE
PID:1904 -
C:\Windows\SysWOW64\Kaqcbi32.exeC:\Windows\system32\Kaqcbi32.exe48⤵
- Executes dropped EXE
PID:3712 -
C:\Windows\SysWOW64\Kdopod32.exeC:\Windows\system32\Kdopod32.exe49⤵
- Executes dropped EXE
PID:1416 -
C:\Windows\SysWOW64\Kbapjafe.exeC:\Windows\system32\Kbapjafe.exe50⤵
- Executes dropped EXE
PID:4508 -
C:\Windows\SysWOW64\Kgmlkp32.exeC:\Windows\system32\Kgmlkp32.exe51⤵
- Executes dropped EXE
PID:3348 -
C:\Windows\SysWOW64\Kilhgk32.exeC:\Windows\system32\Kilhgk32.exe52⤵
- Executes dropped EXE
PID:5056 -
C:\Windows\SysWOW64\Kacphh32.exeC:\Windows\system32\Kacphh32.exe53⤵
- Executes dropped EXE
PID:2804 -
C:\Windows\SysWOW64\Kkkdan32.exeC:\Windows\system32\Kkkdan32.exe54⤵
- Executes dropped EXE
PID:1260 -
C:\Windows\SysWOW64\Kmjqmi32.exeC:\Windows\system32\Kmjqmi32.exe55⤵
- Executes dropped EXE
PID:3872 -
C:\Windows\SysWOW64\Kdcijcke.exeC:\Windows\system32\Kdcijcke.exe56⤵
- Executes dropped EXE
PID:4916 -
C:\Windows\SysWOW64\Kbfiep32.exeC:\Windows\system32\Kbfiep32.exe57⤵
- Executes dropped EXE
PID:2724 -
C:\Windows\SysWOW64\Kknafn32.exeC:\Windows\system32\Kknafn32.exe58⤵
- Executes dropped EXE
PID:4344 -
C:\Windows\SysWOW64\Kagichjo.exeC:\Windows\system32\Kagichjo.exe59⤵
- Executes dropped EXE
PID:4284 -
C:\Windows\SysWOW64\Kdffocib.exeC:\Windows\system32\Kdffocib.exe60⤵
- Executes dropped EXE
PID:408 -
C:\Windows\SysWOW64\Kkpnlm32.exeC:\Windows\system32\Kkpnlm32.exe61⤵
- Executes dropped EXE
PID:3628 -
C:\Windows\SysWOW64\Kmnjhioc.exeC:\Windows\system32\Kmnjhioc.exe62⤵
- Executes dropped EXE
PID:4324 -
C:\Windows\SysWOW64\Kajfig32.exeC:\Windows\system32\Kajfig32.exe63⤵
- Executes dropped EXE
PID:3684 -
C:\Windows\SysWOW64\Lmqgnhmp.exeC:\Windows\system32\Lmqgnhmp.exe64⤵
- Executes dropped EXE
PID:712 -
C:\Windows\SysWOW64\Lpocjdld.exeC:\Windows\system32\Lpocjdld.exe65⤵
- Executes dropped EXE
PID:1872 -
C:\Windows\SysWOW64\Lcmofolg.exeC:\Windows\system32\Lcmofolg.exe66⤵
- Executes dropped EXE
PID:4168 -
C:\Windows\SysWOW64\Liggbi32.exeC:\Windows\system32\Liggbi32.exe67⤵PID:2632
-
C:\Windows\SysWOW64\Laopdgcg.exeC:\Windows\system32\Laopdgcg.exe68⤵PID:444
-
C:\Windows\SysWOW64\Ldmlpbbj.exeC:\Windows\system32\Ldmlpbbj.exe69⤵PID:4680
-
C:\Windows\SysWOW64\Lgkhlnbn.exeC:\Windows\system32\Lgkhlnbn.exe70⤵PID:4256
-
C:\Windows\SysWOW64\Lijdhiaa.exeC:\Windows\system32\Lijdhiaa.exe71⤵PID:2968
-
C:\Windows\SysWOW64\Laalifad.exeC:\Windows\system32\Laalifad.exe72⤵PID:2020
-
C:\Windows\SysWOW64\Lpcmec32.exeC:\Windows\system32\Lpcmec32.exe73⤵PID:2672
-
C:\Windows\SysWOW64\Ldohebqh.exeC:\Windows\system32\Ldohebqh.exe74⤵PID:1564
-
C:\Windows\SysWOW64\Lgneampk.exeC:\Windows\system32\Lgneampk.exe75⤵PID:4832
-
C:\Windows\SysWOW64\Lilanioo.exeC:\Windows\system32\Lilanioo.exe76⤵PID:4796
-
C:\Windows\SysWOW64\Lpfijcfl.exeC:\Windows\system32\Lpfijcfl.exe77⤵PID:2148
-
C:\Windows\SysWOW64\Lcdegnep.exeC:\Windows\system32\Lcdegnep.exe78⤵PID:1048
-
C:\Windows\SysWOW64\Lklnhlfb.exeC:\Windows\system32\Lklnhlfb.exe79⤵PID:4352
-
C:\Windows\SysWOW64\Lnjjdgee.exeC:\Windows\system32\Lnjjdgee.exe80⤵PID:1144
-
C:\Windows\SysWOW64\Laefdf32.exeC:\Windows\system32\Laefdf32.exe81⤵PID:4700
-
C:\Windows\SysWOW64\Lddbqa32.exeC:\Windows\system32\Lddbqa32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1956 -
C:\Windows\SysWOW64\Lknjmkdo.exeC:\Windows\system32\Lknjmkdo.exe83⤵PID:3792
-
C:\Windows\SysWOW64\Mjqjih32.exeC:\Windows\system32\Mjqjih32.exe84⤵PID:4884
-
C:\Windows\SysWOW64\Mahbje32.exeC:\Windows\system32\Mahbje32.exe85⤵PID:3320
-
C:\Windows\SysWOW64\Mdfofakp.exeC:\Windows\system32\Mdfofakp.exe86⤵PID:2156
-
C:\Windows\SysWOW64\Mkpgck32.exeC:\Windows\system32\Mkpgck32.exe87⤵PID:1992
-
C:\Windows\SysWOW64\Mnocof32.exeC:\Windows\system32\Mnocof32.exe88⤵PID:2544
-
C:\Windows\SysWOW64\Majopeii.exeC:\Windows\system32\Majopeii.exe89⤵PID:4768
-
C:\Windows\SysWOW64\Mcklgm32.exeC:\Windows\system32\Mcklgm32.exe90⤵PID:4576
-
C:\Windows\SysWOW64\Mkbchk32.exeC:\Windows\system32\Mkbchk32.exe91⤵PID:3616
-
C:\Windows\SysWOW64\Mjeddggd.exeC:\Windows\system32\Mjeddggd.exe92⤵PID:3528
-
C:\Windows\SysWOW64\Mnapdf32.exeC:\Windows\system32\Mnapdf32.exe93⤵PID:5116
-
C:\Windows\SysWOW64\Mpolqa32.exeC:\Windows\system32\Mpolqa32.exe94⤵PID:3296
-
C:\Windows\SysWOW64\Mkepnjng.exeC:\Windows\system32\Mkepnjng.exe95⤵PID:3564
-
C:\Windows\SysWOW64\Mjhqjg32.exeC:\Windows\system32\Mjhqjg32.exe96⤵PID:4296
-
C:\Windows\SysWOW64\Mpaifalo.exeC:\Windows\system32\Mpaifalo.exe97⤵PID:4252
-
C:\Windows\SysWOW64\Mcpebmkb.exeC:\Windows\system32\Mcpebmkb.exe98⤵PID:3888
-
C:\Windows\SysWOW64\Mglack32.exeC:\Windows\system32\Mglack32.exe99⤵
- Modifies registry class
PID:3584 -
C:\Windows\SysWOW64\Mjjmog32.exeC:\Windows\system32\Mjjmog32.exe100⤵PID:5156
-
C:\Windows\SysWOW64\Mnfipekh.exeC:\Windows\system32\Mnfipekh.exe101⤵PID:5200
-
C:\Windows\SysWOW64\Maaepd32.exeC:\Windows\system32\Maaepd32.exe102⤵PID:5244
-
C:\Windows\SysWOW64\Mdpalp32.exeC:\Windows\system32\Mdpalp32.exe103⤵PID:5284
-
C:\Windows\SysWOW64\Mcbahlip.exeC:\Windows\system32\Mcbahlip.exe104⤵PID:5328
-
C:\Windows\SysWOW64\Nkjjij32.exeC:\Windows\system32\Nkjjij32.exe105⤵PID:5368
-
C:\Windows\SysWOW64\Ngpjnkpf.exeC:\Windows\system32\Ngpjnkpf.exe106⤵PID:5412
-
C:\Windows\SysWOW64\Nklfoi32.exeC:\Windows\system32\Nklfoi32.exe107⤵PID:5452
-
C:\Windows\SysWOW64\Nnjbke32.exeC:\Windows\system32\Nnjbke32.exe108⤵PID:5492
-
C:\Windows\SysWOW64\Nafokcol.exeC:\Windows\system32\Nafokcol.exe109⤵PID:5536
-
C:\Windows\SysWOW64\Nddkgonp.exeC:\Windows\system32\Nddkgonp.exe110⤵PID:5572
-
C:\Windows\SysWOW64\Ngcgcjnc.exeC:\Windows\system32\Ngcgcjnc.exe111⤵PID:5620
-
C:\Windows\SysWOW64\Nkncdifl.exeC:\Windows\system32\Nkncdifl.exe112⤵PID:5656
-
C:\Windows\SysWOW64\Nnmopdep.exeC:\Windows\system32\Nnmopdep.exe113⤵PID:5696
-
C:\Windows\SysWOW64\Nqklmpdd.exeC:\Windows\system32\Nqklmpdd.exe114⤵PID:5736
-
C:\Windows\SysWOW64\Ncihikcg.exeC:\Windows\system32\Ncihikcg.exe115⤵PID:5780
-
C:\Windows\SysWOW64\Ngedij32.exeC:\Windows\system32\Ngedij32.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5820 -
C:\Windows\SysWOW64\Nkqpjidj.exeC:\Windows\system32\Nkqpjidj.exe117⤵PID:5864
-
C:\Windows\SysWOW64\Nnolfdcn.exeC:\Windows\system32\Nnolfdcn.exe118⤵PID:5900
-
C:\Windows\SysWOW64\Nbkhfc32.exeC:\Windows\system32\Nbkhfc32.exe119⤵PID:5948
-
C:\Windows\SysWOW64\Ndidbn32.exeC:\Windows\system32\Ndidbn32.exe120⤵PID:5992
-
C:\Windows\SysWOW64\Ncldnkae.exeC:\Windows\system32\Ncldnkae.exe121⤵PID:6032
-
C:\Windows\SysWOW64\Nggqoj32.exeC:\Windows\system32\Nggqoj32.exe122⤵PID:6068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-