Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
06-06-2024 01:25
Static task
static1
Behavioral task
behavioral1
Sample
7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe
Resource
win10v2004-20240508-en
General
-
Target
7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe
-
Size
163KB
-
MD5
18702a566bc159e119421bea2815335f
-
SHA1
de58743dc7eead1dc7134af16a7094b45d1ef839
-
SHA256
7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4
-
SHA512
7c9a323509b403b72cb20febea55b8d5df3e3d6f68e62b547f95c311fed91b64193ffcef71f9b2a92085d52a2f45ae16cac449304953ee72ee3e03bffa97ed41
-
SSDEEP
1536:Pi3sizupgJPnVBehy7R6JJVl+MKf0IzlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNy:dpDygJJVl2fdzltOrWKDBr+yJb
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Dcknbh32.exeEjbfhfaj.exeHahjpbad.exeHnojdcfi.exeOkfencna.exePpmdbe32.exePhjelg32.exeCfgaiaci.exeCopfbfjj.exeDfgmhd32.exeAljgfioc.exeCljcelan.exeComimg32.exeAlhjai32.exeAhokfj32.exeCgpgce32.exeOenifh32.exeCllpkl32.exeDqelenlc.exeEmeopn32.exeGogangdc.exeHlakpp32.exeMkmfhacp.exeOjficpfn.exeBdooajdc.exeEqonkmdh.exeEbbgid32.exeEpieghdk.exeGelppaof.exePcfcmd32.exeAmejeljk.exeDqhhknjp.exeFeeiob32.exeGaqcoc32.exeInljnfkg.exeQmlgonbe.exeAnkdiqih.exeFpdhklkl.exeDcfdgiid.exeOqqapjnk.exeOgmfbd32.exePndniaop.exeKfaajlfp.exeBhcdaibd.exeAjbdna32.exeBaildokg.exeBjijdadm.exeDmoipopd.exeEnnaieib.exePccfge32.exeAfdlhchf.exeFddmgjpo.exeGbkgnfbd.exeGacpdbej.exeApajlhka.exeCdlnkmha.exeEnihne32.exeApomfh32.exeDjefobmk.exeEbgacddo.exeGopkmhjk.exeGddifnbk.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcknbh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejbfhfaj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hahjpbad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hnojdcfi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okfencna.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppmdbe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phjelg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfgaiaci.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Copfbfjj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dfgmhd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phjelg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aljgfioc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cljcelan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Comimg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Alhjai32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahokfj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgpgce32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oenifh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cllpkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dqelenlc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Emeopn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gogangdc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hlakpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mkmfhacp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojficpfn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdooajdc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eqonkmdh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ebbgid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Epieghdk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gelppaof.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pcfcmd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Amejeljk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dqhhknjp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Feeiob32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gaqcoc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Inljnfkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qmlgonbe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ankdiqih.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fpdhklkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcfdgiid.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oqqapjnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ogmfbd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pndniaop.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kfaajlfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bhcdaibd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajbdna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Baildokg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjijdadm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmoipopd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ennaieib.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogmfbd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pccfge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Afdlhchf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fddmgjpo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gbkgnfbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gacpdbej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Apajlhka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdlnkmha.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Enihne32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apomfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Djefobmk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebgacddo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gopkmhjk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gddifnbk.exe -
Detects executables built or packed with MPress PE compressor 64 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\Kbalnnam.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kljqgc32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Kinaqg32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Knjiin32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Kfaajlfp.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Klnjbbdh.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Kegnkh32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kjcgco32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Keikqhhe.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lhggmchi.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Laplei32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Lodlom32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lpeifeca.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Lmiipi32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Lganiohl.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Lmkfei32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lefkjkmc.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lmnbkinf.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mgfgdn32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mpolmdkg.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mcmhiojk.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Migpeiag.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mabejlob.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mhlmgf32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Madapkmp.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mepnpj32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mkmfhacp.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mpjoqhah.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Nnnojlpa.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Nplkfgoe.exe INDICATOR_EXE_Packed_MPress behavioral1/memory/2812-374-0x0000000000250000-0x00000000002A3000-memory.dmp INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Njdpomfe.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Nnplpl32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Nghphaeo.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Njgldmdc.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Nqqdag32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Nhlifi32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ncancbha.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Nbdnoo32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Nmjblg32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Nohnhc32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Nccjhafn.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Okoomd32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Oicpfh32.exe INDICATOR_EXE_Packed_MPress behavioral1/memory/1168-515-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ogfpbeim.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Onphoo32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Oghlgdgk.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ojficpfn.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Onbddoog.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Oqqapjnk.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ogjimd32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Okfencna.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ondajnme.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Oqcnfjli.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Oenifh32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ogmfbd32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ongnonkb.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Pminkk32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Pccfge32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Pgobhcac.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Pjmodopf.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Pipopl32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ppjglfon.exe INDICATOR_EXE_Packed_MPress -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\Kbalnnam.exe UPX C:\Windows\SysWOW64\Kljqgc32.exe UPX \Windows\SysWOW64\Kinaqg32.exe UPX C:\Windows\SysWOW64\Knjiin32.exe UPX \Windows\SysWOW64\Kfaajlfp.exe UPX \Windows\SysWOW64\Klnjbbdh.exe UPX \Windows\SysWOW64\Kegnkh32.exe UPX C:\Windows\SysWOW64\Kjcgco32.exe UPX C:\Windows\SysWOW64\Keikqhhe.exe UPX C:\Windows\SysWOW64\Lhggmchi.exe UPX \Windows\SysWOW64\Laplei32.exe UPX \Windows\SysWOW64\Lodlom32.exe UPX C:\Windows\SysWOW64\Lpeifeca.exe UPX \Windows\SysWOW64\Lmiipi32.exe UPX \Windows\SysWOW64\Lganiohl.exe UPX \Windows\SysWOW64\Lmkfei32.exe UPX C:\Windows\SysWOW64\Lefkjkmc.exe UPX C:\Windows\SysWOW64\Lmnbkinf.exe UPX C:\Windows\SysWOW64\Mgfgdn32.exe UPX C:\Windows\SysWOW64\Mpolmdkg.exe UPX C:\Windows\SysWOW64\Mcmhiojk.exe UPX C:\Windows\SysWOW64\Migpeiag.exe UPX C:\Windows\SysWOW64\Mabejlob.exe UPX C:\Windows\SysWOW64\Mhlmgf32.exe UPX C:\Windows\SysWOW64\Madapkmp.exe UPX C:\Windows\SysWOW64\Mepnpj32.exe UPX C:\Windows\SysWOW64\Mkmfhacp.exe UPX C:\Windows\SysWOW64\Mpjoqhah.exe UPX C:\Windows\SysWOW64\Nnnojlpa.exe UPX C:\Windows\SysWOW64\Nplkfgoe.exe UPX behavioral1/memory/2812-374-0x0000000000250000-0x00000000002A3000-memory.dmp UPX C:\Windows\SysWOW64\Njdpomfe.exe UPX C:\Windows\SysWOW64\Nnplpl32.exe UPX C:\Windows\SysWOW64\Nghphaeo.exe UPX C:\Windows\SysWOW64\Njgldmdc.exe UPX C:\Windows\SysWOW64\Nqqdag32.exe UPX C:\Windows\SysWOW64\Nhlifi32.exe UPX C:\Windows\SysWOW64\Ncancbha.exe UPX C:\Windows\SysWOW64\Nbdnoo32.exe UPX C:\Windows\SysWOW64\Nmjblg32.exe UPX C:\Windows\SysWOW64\Nohnhc32.exe UPX C:\Windows\SysWOW64\Nccjhafn.exe UPX C:\Windows\SysWOW64\Okoomd32.exe UPX C:\Windows\SysWOW64\Oicpfh32.exe UPX behavioral1/memory/2952-504-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral1/memory/1168-515-0x0000000000400000-0x0000000000453000-memory.dmp UPX C:\Windows\SysWOW64\Ogfpbeim.exe UPX C:\Windows\SysWOW64\Onphoo32.exe UPX C:\Windows\SysWOW64\Oghlgdgk.exe UPX C:\Windows\SysWOW64\Ojficpfn.exe UPX C:\Windows\SysWOW64\Onbddoog.exe UPX C:\Windows\SysWOW64\Oqqapjnk.exe UPX C:\Windows\SysWOW64\Ogjimd32.exe UPX C:\Windows\SysWOW64\Okfencna.exe UPX C:\Windows\SysWOW64\Ondajnme.exe UPX C:\Windows\SysWOW64\Oqcnfjli.exe UPX C:\Windows\SysWOW64\Oenifh32.exe UPX C:\Windows\SysWOW64\Ogmfbd32.exe UPX C:\Windows\SysWOW64\Ongnonkb.exe UPX C:\Windows\SysWOW64\Pminkk32.exe UPX C:\Windows\SysWOW64\Pccfge32.exe UPX C:\Windows\SysWOW64\Pgobhcac.exe UPX C:\Windows\SysWOW64\Pjmodopf.exe UPX C:\Windows\SysWOW64\Pipopl32.exe UPX -
Executes dropped EXE 64 IoCs
Processes:
Kbalnnam.exeKljqgc32.exeKinaqg32.exeKnjiin32.exeKfaajlfp.exeKlnjbbdh.exeKegnkh32.exeKjcgco32.exeKeikqhhe.exeLhggmchi.exeLaplei32.exeLodlom32.exeLpeifeca.exeLmiipi32.exeLganiohl.exeLmkfei32.exeLefkjkmc.exeLmnbkinf.exeMgfgdn32.exeMpolmdkg.exeMcmhiojk.exeMigpeiag.exeMabejlob.exeMhlmgf32.exeMadapkmp.exeMepnpj32.exeMkmfhacp.exeMpjoqhah.exeNnnojlpa.exeNplkfgoe.exeNjdpomfe.exeNnplpl32.exeNghphaeo.exeNjgldmdc.exeNqqdag32.exeNhlifi32.exeNcancbha.exeNbdnoo32.exeNmjblg32.exeNohnhc32.exeNccjhafn.exeOkoomd32.exeOicpfh32.exeOgfpbeim.exeOnphoo32.exeOghlgdgk.exeOjficpfn.exeOnbddoog.exeOqqapjnk.exeOgjimd32.exeOkfencna.exeOndajnme.exeOqcnfjli.exeOenifh32.exeOgmfbd32.exeOngnonkb.exePminkk32.exePccfge32.exePgobhcac.exePjmodopf.exePipopl32.exePpjglfon.exePcfcmd32.exePfdpip32.exepid process 2252 Kbalnnam.exe 2088 Kljqgc32.exe 2756 Kinaqg32.exe 2920 Knjiin32.exe 2576 Kfaajlfp.exe 2532 Klnjbbdh.exe 3044 Kegnkh32.exe 2524 Kjcgco32.exe 2892 Keikqhhe.exe 1764 Lhggmchi.exe 1200 Laplei32.exe 2344 Lodlom32.exe 2776 Lpeifeca.exe 1604 Lmiipi32.exe 2060 Lganiohl.exe 2772 Lmkfei32.exe 776 Lefkjkmc.exe 1660 Lmnbkinf.exe 656 Mgfgdn32.exe 844 Mpolmdkg.exe 2960 Mcmhiojk.exe 1872 Migpeiag.exe 1276 Mabejlob.exe 1672 Mhlmgf32.exe 2332 Madapkmp.exe 1616 Mepnpj32.exe 2260 Mkmfhacp.exe 2144 Mpjoqhah.exe 2928 Nnnojlpa.exe 2812 Nplkfgoe.exe 2432 Njdpomfe.exe 2600 Nnplpl32.exe 2828 Nghphaeo.exe 2624 Njgldmdc.exe 2992 Nqqdag32.exe 3016 Nhlifi32.exe 348 Ncancbha.exe 1816 Nbdnoo32.exe 1748 Nmjblg32.exe 1664 Nohnhc32.exe 2100 Nccjhafn.exe 2944 Okoomd32.exe 2952 Oicpfh32.exe 1168 Ogfpbeim.exe 560 Onphoo32.exe 1920 Oghlgdgk.exe 1136 Ojficpfn.exe 3060 Onbddoog.exe 1556 Oqqapjnk.exe 2120 Ogjimd32.exe 2376 Okfencna.exe 1724 Ondajnme.exe 1328 Oqcnfjli.exe 1456 Oenifh32.exe 2716 Ogmfbd32.exe 2544 Ongnonkb.exe 2872 Pminkk32.exe 2648 Pccfge32.exe 2704 Pgobhcac.exe 2368 Pjmodopf.exe 2852 Pipopl32.exe 2896 Ppjglfon.exe 2004 Pcfcmd32.exe 2596 Pfdpip32.exe -
Loads dropped DLL 64 IoCs
Processes:
7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exeKbalnnam.exeKljqgc32.exeKinaqg32.exeKnjiin32.exeKfaajlfp.exeKlnjbbdh.exeKegnkh32.exeKjcgco32.exeKeikqhhe.exeLhggmchi.exeLaplei32.exeLodlom32.exeLpeifeca.exeLmiipi32.exeLganiohl.exeLmkfei32.exeLefkjkmc.exeLmnbkinf.exeMgfgdn32.exeMpolmdkg.exeMcmhiojk.exeMigpeiag.exeMabejlob.exeMhlmgf32.exeMadapkmp.exeMepnpj32.exeMkmfhacp.exeMpjoqhah.exeNnnojlpa.exeNplkfgoe.exeNjdpomfe.exepid process 2288 7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe 2288 7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe 2252 Kbalnnam.exe 2252 Kbalnnam.exe 2088 Kljqgc32.exe 2088 Kljqgc32.exe 2756 Kinaqg32.exe 2756 Kinaqg32.exe 2920 Knjiin32.exe 2920 Knjiin32.exe 2576 Kfaajlfp.exe 2576 Kfaajlfp.exe 2532 Klnjbbdh.exe 2532 Klnjbbdh.exe 3044 Kegnkh32.exe 3044 Kegnkh32.exe 2524 Kjcgco32.exe 2524 Kjcgco32.exe 2892 Keikqhhe.exe 2892 Keikqhhe.exe 1764 Lhggmchi.exe 1764 Lhggmchi.exe 1200 Laplei32.exe 1200 Laplei32.exe 2344 Lodlom32.exe 2344 Lodlom32.exe 2776 Lpeifeca.exe 2776 Lpeifeca.exe 1604 Lmiipi32.exe 1604 Lmiipi32.exe 2060 Lganiohl.exe 2060 Lganiohl.exe 2772 Lmkfei32.exe 2772 Lmkfei32.exe 776 Lefkjkmc.exe 776 Lefkjkmc.exe 1660 Lmnbkinf.exe 1660 Lmnbkinf.exe 656 Mgfgdn32.exe 656 Mgfgdn32.exe 844 Mpolmdkg.exe 844 Mpolmdkg.exe 2960 Mcmhiojk.exe 2960 Mcmhiojk.exe 1872 Migpeiag.exe 1872 Migpeiag.exe 1276 Mabejlob.exe 1276 Mabejlob.exe 1672 Mhlmgf32.exe 1672 Mhlmgf32.exe 2332 Madapkmp.exe 2332 Madapkmp.exe 1616 Mepnpj32.exe 1616 Mepnpj32.exe 2260 Mkmfhacp.exe 2260 Mkmfhacp.exe 2144 Mpjoqhah.exe 2144 Mpjoqhah.exe 2928 Nnnojlpa.exe 2928 Nnnojlpa.exe 2812 Nplkfgoe.exe 2812 Nplkfgoe.exe 2432 Njdpomfe.exe 2432 Njdpomfe.exe -
Drops file in System32 directory 64 IoCs
Processes:
Fhkpmjln.exeCkignd32.exeGphmeo32.exeInljnfkg.exeFjilieka.exeIknnbklc.exeCdlnkmha.exeElmigj32.exeEbgacddo.exeGacpdbej.exeAlhjai32.exeDflkdp32.exeDdagfm32.exeBkaqmeah.exeNjgldmdc.exeCobbhfhg.exeFaokjpfd.exeLganiohl.exePjmodopf.exeEpaogi32.exeHahjpbad.exeNbdnoo32.exeBdooajdc.exePgobhcac.exePijbfj32.exeFddmgjpo.exe7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exeFbdqmghm.exeAhokfj32.exeCopfbfjj.exeDnneja32.exeEiomkn32.exeEajaoq32.exeHknach32.exeNccjhafn.exePiblek32.exeCbnbobin.exeDgdmmgpj.exeKinaqg32.exeGaqcoc32.exeDgodbh32.exeAdjigg32.exeIcbimi32.exeAbpfhcje.exeOgjimd32.exeBokphdld.exeCgpgce32.exeDqelenlc.exeOjficpfn.exeOghlgdgk.exeDcknbh32.exeLefkjkmc.exeFiaeoang.exeMgfgdn32.exeNnnojlpa.exeQagcpljo.exeKlnjbbdh.exedescription ioc process File created C:\Windows\SysWOW64\Kegiig32.dll Fhkpmjln.exe File created C:\Windows\SysWOW64\Ffakeiib.dll Ckignd32.exe File created C:\Windows\SysWOW64\Pfabenjd.dll Gphmeo32.exe File opened for modification C:\Windows\SysWOW64\Iagfoe32.exe Inljnfkg.exe File opened for modification C:\Windows\SysWOW64\Facdeo32.exe Fjilieka.exe File created C:\Windows\SysWOW64\Jdnaob32.dll Iknnbklc.exe File opened for modification C:\Windows\SysWOW64\Chhjkl32.exe Cdlnkmha.exe File opened for modification C:\Windows\SysWOW64\Epieghdk.exe Elmigj32.exe File created C:\Windows\SysWOW64\Efjcibje.dll Ebgacddo.exe File created C:\Windows\SysWOW64\Jondlhmp.dll Gacpdbej.exe File created C:\Windows\SysWOW64\Cibgai32.dll Alhjai32.exe File opened for modification C:\Windows\SysWOW64\Ddokpmfo.exe Dflkdp32.exe File created C:\Windows\SysWOW64\Fncann32.dll Ddagfm32.exe File created C:\Windows\SysWOW64\Bnpmipql.exe Bkaqmeah.exe File opened for modification C:\Windows\SysWOW64\Nqqdag32.exe Njgldmdc.exe File created C:\Windows\SysWOW64\Dflkdp32.exe Cobbhfhg.exe File opened for modification C:\Windows\SysWOW64\Fcmgfkeg.exe Faokjpfd.exe File opened for modification C:\Windows\SysWOW64\Lmkfei32.exe Lganiohl.exe File created C:\Windows\SysWOW64\Bbdoqc32.dll Pjmodopf.exe File opened for modification C:\Windows\SysWOW64\Ebpkce32.exe Epaogi32.exe File opened for modification C:\Windows\SysWOW64\Hpkjko32.exe Hahjpbad.exe File opened for modification C:\Windows\SysWOW64\Nmjblg32.exe Nbdnoo32.exe File opened for modification C:\Windows\SysWOW64\Inljnfkg.exe Iknnbklc.exe File opened for modification C:\Windows\SysWOW64\Ckignd32.exe Bdooajdc.exe File created C:\Windows\SysWOW64\Pjmodopf.exe Pgobhcac.exe File opened for modification C:\Windows\SysWOW64\Qnfjna32.exe Pijbfj32.exe File created C:\Windows\SysWOW64\Fbgmbg32.exe Fddmgjpo.exe File opened for modification C:\Windows\SysWOW64\Kbalnnam.exe 7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe File created C:\Windows\SysWOW64\Dcdooi32.dll Fbdqmghm.exe File opened for modification C:\Windows\SysWOW64\Aljgfioc.exe Ahokfj32.exe File created C:\Windows\SysWOW64\Cbnbobin.exe Copfbfjj.exe File created C:\Windows\SysWOW64\Dmafennb.exe Dnneja32.exe File opened for modification C:\Windows\SysWOW64\Elmigj32.exe Eiomkn32.exe File opened for modification C:\Windows\SysWOW64\Eiaiqn32.exe Eajaoq32.exe File opened for modification C:\Windows\SysWOW64\Hiqbndpb.exe Hknach32.exe File opened for modification C:\Windows\SysWOW64\Okoomd32.exe Nccjhafn.exe File created C:\Windows\SysWOW64\Plahag32.exe Piblek32.exe File created C:\Windows\SysWOW64\Nlbodgap.dll Cbnbobin.exe File opened for modification C:\Windows\SysWOW64\Dfgmhd32.exe Dgdmmgpj.exe File created C:\Windows\SysWOW64\Oihfic32.dll Kinaqg32.exe File opened for modification C:\Windows\SysWOW64\Gelppaof.exe Gaqcoc32.exe File created C:\Windows\SysWOW64\Djnpnc32.exe Dgodbh32.exe File created C:\Windows\SysWOW64\Iklefg32.dll Adjigg32.exe File opened for modification C:\Windows\SysWOW64\Gdamqndn.exe Gacpdbej.exe File opened for modification C:\Windows\SysWOW64\Iaeiieeb.exe Icbimi32.exe File opened for modification C:\Windows\SysWOW64\Aenbdoii.exe Abpfhcje.exe File opened for modification C:\Windows\SysWOW64\Okfencna.exe Ogjimd32.exe File created C:\Windows\SysWOW64\Dgdfmnkb.dll Bokphdld.exe File created C:\Windows\SysWOW64\Pglbacld.dll Cgpgce32.exe File created C:\Windows\SysWOW64\Aoffmd32.exe Alhjai32.exe File created C:\Windows\SysWOW64\Ddagfm32.exe Dqelenlc.exe File created C:\Windows\SysWOW64\Onbddoog.exe Ojficpfn.exe File created C:\Windows\SysWOW64\Pmdoik32.dll Epaogi32.exe File created C:\Windows\SysWOW64\Ojiich32.dll Oghlgdgk.exe File created C:\Windows\SysWOW64\Djefobmk.exe Dcknbh32.exe File opened for modification C:\Windows\SysWOW64\Lmnbkinf.exe Lefkjkmc.exe File created C:\Windows\SysWOW64\Damgbk32.dll Njgldmdc.exe File created C:\Windows\SysWOW64\Ipdljffa.dll Dflkdp32.exe File created C:\Windows\SysWOW64\Globlmmj.exe Fiaeoang.exe File created C:\Windows\SysWOW64\Hkfeblka.dll Mgfgdn32.exe File created C:\Windows\SysWOW64\Pmihgeia.dll Nnnojlpa.exe File opened for modification C:\Windows\SysWOW64\Adeplhib.exe Qagcpljo.exe File created C:\Windows\SysWOW64\Dfgmhd32.exe Dgdmmgpj.exe File created C:\Windows\SysWOW64\Ojjljknn.dll Klnjbbdh.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3704 3612 WerFault.exe Iagfoe32.exe -
Modifies registry class 64 IoCs
Processes:
Apajlhka.exeFjgoce32.exeHnojdcfi.exeHobcak32.exeKlnjbbdh.exeNqqdag32.exeHpocfncj.exePpmdbe32.exeGobgcg32.exeKjcgco32.exeCobbhfhg.exeDgdmmgpj.exeGacpdbej.exeHenidd32.exeKnjiin32.exeGbkgnfbd.exeGddifnbk.exeGogangdc.exeKinaqg32.exeChemfl32.exeBjijdadm.exeEpaogi32.exeGoddhg32.exeOnbddoog.exeQdccfh32.exeFhkpmjln.exeKfaajlfp.exeCdlnkmha.exeEnnaieib.exeIhoafpmp.exeAnkdiqih.exeEnihne32.exeAdhlaggp.exeCgpgce32.exeBkdmcdoe.exeBpcbqk32.exeHcplhi32.exeLodlom32.exeNplkfgoe.exeNjdpomfe.exeQmlgonbe.exeGhkllmoi.exeGkkemh32.exeLpeifeca.exeMpolmdkg.exeBhhnli32.exeFbdqmghm.exeAbpfhcje.exeBegeknan.exeHpmgqnfl.exeKbalnnam.exePfflopdh.exeQnfjna32.exeApomfh32.exeHejoiedd.exePhjelg32.exeBhcdaibd.exeFacdeo32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Apajlhka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ongbcmlc.dll" Fjgoce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anllbdkl.dll" Hnojdcfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hobcak32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Klnjbbdh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odifpn32.dll" Nqqdag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hpocfncj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ppmdbe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gobgcg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kjcgco32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccdcec32.dll" Cobbhfhg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfedefbi.dll" Dgdmmgpj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gacpdbej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Henidd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Knjiin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Klnjbbdh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gbkgnfbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpajnpao.dll" Gddifnbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmmjdk32.dll" Gogangdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kinaqg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oockje32.dll" Chemfl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bjijdadm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Epaogi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Goddhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ompoljfn.dll" Onbddoog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qdccfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fhkpmjln.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kfaajlfp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cdlnkmha.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ennaieib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqpofkjo.dll" Ihoafpmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndejjf32.dll" Ankdiqih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lopekk32.dll" Enihne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiojgnpb.dll" Adhlaggp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cgpgce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bkdmcdoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpefbknb.dll" Bpcbqk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fjgoce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hcplhi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lodlom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nplkfgoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Njdpomfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qmlgonbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahcocb32.dll" Ghkllmoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gkkemh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lpeifeca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mpolmdkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alihbgdo.dll" Bhhnli32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fbdqmghm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Abpfhcje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Begeknan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pglbacld.dll" Cgpgce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gddifnbk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hpmgqnfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kbalnnam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pfflopdh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gogangdc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hpmgqnfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qnfjna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jngohf32.dll" Apomfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enlbgc32.dll" Hejoiedd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jadhjcfk.dll" Phjelg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bhcdaibd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohbepi32.dll" Facdeo32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exeKbalnnam.exeKljqgc32.exeKinaqg32.exeKnjiin32.exeKfaajlfp.exeKlnjbbdh.exeKegnkh32.exeKjcgco32.exeKeikqhhe.exeLhggmchi.exeLaplei32.exeLodlom32.exeLpeifeca.exeLmiipi32.exeLganiohl.exedescription pid process target process PID 2288 wrote to memory of 2252 2288 7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe Kbalnnam.exe PID 2288 wrote to memory of 2252 2288 7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe Kbalnnam.exe PID 2288 wrote to memory of 2252 2288 7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe Kbalnnam.exe PID 2288 wrote to memory of 2252 2288 7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe Kbalnnam.exe PID 2252 wrote to memory of 2088 2252 Kbalnnam.exe Kljqgc32.exe PID 2252 wrote to memory of 2088 2252 Kbalnnam.exe Kljqgc32.exe PID 2252 wrote to memory of 2088 2252 Kbalnnam.exe Kljqgc32.exe PID 2252 wrote to memory of 2088 2252 Kbalnnam.exe Kljqgc32.exe PID 2088 wrote to memory of 2756 2088 Kljqgc32.exe Kinaqg32.exe PID 2088 wrote to memory of 2756 2088 Kljqgc32.exe Kinaqg32.exe PID 2088 wrote to memory of 2756 2088 Kljqgc32.exe Kinaqg32.exe PID 2088 wrote to memory of 2756 2088 Kljqgc32.exe Kinaqg32.exe PID 2756 wrote to memory of 2920 2756 Kinaqg32.exe Knjiin32.exe PID 2756 wrote to memory of 2920 2756 Kinaqg32.exe Knjiin32.exe PID 2756 wrote to memory of 2920 2756 Kinaqg32.exe Knjiin32.exe PID 2756 wrote to memory of 2920 2756 Kinaqg32.exe Knjiin32.exe PID 2920 wrote to memory of 2576 2920 Knjiin32.exe Kfaajlfp.exe PID 2920 wrote to memory of 2576 2920 Knjiin32.exe Kfaajlfp.exe PID 2920 wrote to memory of 2576 2920 Knjiin32.exe Kfaajlfp.exe PID 2920 wrote to memory of 2576 2920 Knjiin32.exe Kfaajlfp.exe PID 2576 wrote to memory of 2532 2576 Kfaajlfp.exe Klnjbbdh.exe PID 2576 wrote to memory of 2532 2576 Kfaajlfp.exe Klnjbbdh.exe PID 2576 wrote to memory of 2532 2576 Kfaajlfp.exe Klnjbbdh.exe PID 2576 wrote to memory of 2532 2576 Kfaajlfp.exe Klnjbbdh.exe PID 2532 wrote to memory of 3044 2532 Klnjbbdh.exe Kegnkh32.exe PID 2532 wrote to memory of 3044 2532 Klnjbbdh.exe Kegnkh32.exe PID 2532 wrote to memory of 3044 2532 Klnjbbdh.exe Kegnkh32.exe PID 2532 wrote to memory of 3044 2532 Klnjbbdh.exe Kegnkh32.exe PID 3044 wrote to memory of 2524 3044 Kegnkh32.exe Kjcgco32.exe PID 3044 wrote to memory of 2524 3044 Kegnkh32.exe Kjcgco32.exe PID 3044 wrote to memory of 2524 3044 Kegnkh32.exe Kjcgco32.exe PID 3044 wrote to memory of 2524 3044 Kegnkh32.exe Kjcgco32.exe PID 2524 wrote to memory of 2892 2524 Kjcgco32.exe Keikqhhe.exe PID 2524 wrote to memory of 2892 2524 Kjcgco32.exe Keikqhhe.exe PID 2524 wrote to memory of 2892 2524 Kjcgco32.exe Keikqhhe.exe PID 2524 wrote to memory of 2892 2524 Kjcgco32.exe Keikqhhe.exe PID 2892 wrote to memory of 1764 2892 Keikqhhe.exe Lhggmchi.exe PID 2892 wrote to memory of 1764 2892 Keikqhhe.exe Lhggmchi.exe PID 2892 wrote to memory of 1764 2892 Keikqhhe.exe Lhggmchi.exe PID 2892 wrote to memory of 1764 2892 Keikqhhe.exe Lhggmchi.exe PID 1764 wrote to memory of 1200 1764 Lhggmchi.exe Laplei32.exe PID 1764 wrote to memory of 1200 1764 Lhggmchi.exe Laplei32.exe PID 1764 wrote to memory of 1200 1764 Lhggmchi.exe Laplei32.exe PID 1764 wrote to memory of 1200 1764 Lhggmchi.exe Laplei32.exe PID 1200 wrote to memory of 2344 1200 Laplei32.exe Lodlom32.exe PID 1200 wrote to memory of 2344 1200 Laplei32.exe Lodlom32.exe PID 1200 wrote to memory of 2344 1200 Laplei32.exe Lodlom32.exe PID 1200 wrote to memory of 2344 1200 Laplei32.exe Lodlom32.exe PID 2344 wrote to memory of 2776 2344 Lodlom32.exe Lpeifeca.exe PID 2344 wrote to memory of 2776 2344 Lodlom32.exe Lpeifeca.exe PID 2344 wrote to memory of 2776 2344 Lodlom32.exe Lpeifeca.exe PID 2344 wrote to memory of 2776 2344 Lodlom32.exe Lpeifeca.exe PID 2776 wrote to memory of 1604 2776 Lpeifeca.exe Lmiipi32.exe PID 2776 wrote to memory of 1604 2776 Lpeifeca.exe Lmiipi32.exe PID 2776 wrote to memory of 1604 2776 Lpeifeca.exe Lmiipi32.exe PID 2776 wrote to memory of 1604 2776 Lpeifeca.exe Lmiipi32.exe PID 1604 wrote to memory of 2060 1604 Lmiipi32.exe Lganiohl.exe PID 1604 wrote to memory of 2060 1604 Lmiipi32.exe Lganiohl.exe PID 1604 wrote to memory of 2060 1604 Lmiipi32.exe Lganiohl.exe PID 1604 wrote to memory of 2060 1604 Lmiipi32.exe Lganiohl.exe PID 2060 wrote to memory of 2772 2060 Lganiohl.exe Lmkfei32.exe PID 2060 wrote to memory of 2772 2060 Lganiohl.exe Lmkfei32.exe PID 2060 wrote to memory of 2772 2060 Lganiohl.exe Lmkfei32.exe PID 2060 wrote to memory of 2772 2060 Lganiohl.exe Lmkfei32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe"C:\Users\Admin\AppData\Local\Temp\7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kbalnnam.exeC:\Windows\system32\Kbalnnam.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kljqgc32.exeC:\Windows\system32\Kljqgc32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kinaqg32.exeC:\Windows\system32\Kinaqg32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Knjiin32.exeC:\Windows\system32\Knjiin32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kfaajlfp.exeC:\Windows\system32\Kfaajlfp.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Klnjbbdh.exeC:\Windows\system32\Klnjbbdh.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kegnkh32.exeC:\Windows\system32\Kegnkh32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kjcgco32.exeC:\Windows\system32\Kjcgco32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Keikqhhe.exeC:\Windows\system32\Keikqhhe.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lhggmchi.exeC:\Windows\system32\Lhggmchi.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Laplei32.exeC:\Windows\system32\Laplei32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lodlom32.exeC:\Windows\system32\Lodlom32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lpeifeca.exeC:\Windows\system32\Lpeifeca.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lmiipi32.exeC:\Windows\system32\Lmiipi32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lganiohl.exeC:\Windows\system32\Lganiohl.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lmkfei32.exeC:\Windows\system32\Lmkfei32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Lefkjkmc.exeC:\Windows\system32\Lefkjkmc.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Lmnbkinf.exeC:\Windows\system32\Lmnbkinf.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Mgfgdn32.exeC:\Windows\system32\Mgfgdn32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Mpolmdkg.exeC:\Windows\system32\Mpolmdkg.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\Mcmhiojk.exeC:\Windows\system32\Mcmhiojk.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Migpeiag.exeC:\Windows\system32\Migpeiag.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Mabejlob.exeC:\Windows\system32\Mabejlob.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Mhlmgf32.exeC:\Windows\system32\Mhlmgf32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Madapkmp.exeC:\Windows\system32\Madapkmp.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Mepnpj32.exeC:\Windows\system32\Mepnpj32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Mkmfhacp.exeC:\Windows\system32\Mkmfhacp.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Mpjoqhah.exeC:\Windows\system32\Mpjoqhah.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Nnnojlpa.exeC:\Windows\system32\Nnnojlpa.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nplkfgoe.exeC:\Windows\system32\Nplkfgoe.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\Njdpomfe.exeC:\Windows\system32\Njdpomfe.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\Nnplpl32.exeC:\Windows\system32\Nnplpl32.exe33⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Nghphaeo.exeC:\Windows\system32\Nghphaeo.exe34⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Njgldmdc.exeC:\Windows\system32\Njgldmdc.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nqqdag32.exeC:\Windows\system32\Nqqdag32.exe36⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Nhlifi32.exeC:\Windows\system32\Nhlifi32.exe37⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ncancbha.exeC:\Windows\system32\Ncancbha.exe38⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Nbdnoo32.exeC:\Windows\system32\Nbdnoo32.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nmjblg32.exeC:\Windows\system32\Nmjblg32.exe40⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Nohnhc32.exeC:\Windows\system32\Nohnhc32.exe41⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Nccjhafn.exeC:\Windows\system32\Nccjhafn.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Okoomd32.exeC:\Windows\system32\Okoomd32.exe43⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Oicpfh32.exeC:\Windows\system32\Oicpfh32.exe44⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ogfpbeim.exeC:\Windows\system32\Ogfpbeim.exe45⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Onphoo32.exeC:\Windows\system32\Onphoo32.exe46⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Oghlgdgk.exeC:\Windows\system32\Oghlgdgk.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ojficpfn.exeC:\Windows\system32\Ojficpfn.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Onbddoog.exeC:\Windows\system32\Onbddoog.exe49⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Oqqapjnk.exeC:\Windows\system32\Oqqapjnk.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ogjimd32.exeC:\Windows\system32\Ogjimd32.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Okfencna.exeC:\Windows\system32\Okfencna.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ondajnme.exeC:\Windows\system32\Ondajnme.exe53⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Oqcnfjli.exeC:\Windows\system32\Oqcnfjli.exe54⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Oenifh32.exeC:\Windows\system32\Oenifh32.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ogmfbd32.exeC:\Windows\system32\Ogmfbd32.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ongnonkb.exeC:\Windows\system32\Ongnonkb.exe57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pminkk32.exeC:\Windows\system32\Pminkk32.exe58⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pccfge32.exeC:\Windows\system32\Pccfge32.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pgobhcac.exeC:\Windows\system32\Pgobhcac.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Pjmodopf.exeC:\Windows\system32\Pjmodopf.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Pipopl32.exeC:\Windows\system32\Pipopl32.exe62⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ppjglfon.exeC:\Windows\system32\Ppjglfon.exe63⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pcfcmd32.exeC:\Windows\system32\Pcfcmd32.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Pfdpip32.exeC:\Windows\system32\Pfdpip32.exe65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Piblek32.exeC:\Windows\system32\Piblek32.exe66⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Plahag32.exeC:\Windows\system32\Plahag32.exe67⤵
-
C:\Windows\SysWOW64\Ppmdbe32.exeC:\Windows\system32\Ppmdbe32.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Pfflopdh.exeC:\Windows\system32\Pfflopdh.exe69⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Peiljl32.exeC:\Windows\system32\Peiljl32.exe70⤵
-
C:\Windows\SysWOW64\Plcdgfbo.exeC:\Windows\system32\Plcdgfbo.exe71⤵
-
C:\Windows\SysWOW64\Ppoqge32.exeC:\Windows\system32\Ppoqge32.exe72⤵
-
C:\Windows\SysWOW64\Pfiidobe.exeC:\Windows\system32\Pfiidobe.exe73⤵
-
C:\Windows\SysWOW64\Phjelg32.exeC:\Windows\system32\Phjelg32.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Ppamme32.exeC:\Windows\system32\Ppamme32.exe75⤵
-
C:\Windows\SysWOW64\Pndniaop.exeC:\Windows\system32\Pndniaop.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Penfelgm.exeC:\Windows\system32\Penfelgm.exe77⤵
-
C:\Windows\SysWOW64\Pijbfj32.exeC:\Windows\system32\Pijbfj32.exe78⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Qnfjna32.exeC:\Windows\system32\Qnfjna32.exe79⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Qaefjm32.exeC:\Windows\system32\Qaefjm32.exe80⤵
-
C:\Windows\SysWOW64\Qdccfh32.exeC:\Windows\system32\Qdccfh32.exe81⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Qljkhe32.exeC:\Windows\system32\Qljkhe32.exe82⤵
-
C:\Windows\SysWOW64\Qjmkcbcb.exeC:\Windows\system32\Qjmkcbcb.exe83⤵
-
C:\Windows\SysWOW64\Qmlgonbe.exeC:\Windows\system32\Qmlgonbe.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Qagcpljo.exeC:\Windows\system32\Qagcpljo.exe85⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Adeplhib.exeC:\Windows\system32\Adeplhib.exe86⤵
-
C:\Windows\SysWOW64\Afdlhchf.exeC:\Windows\system32\Afdlhchf.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ankdiqih.exeC:\Windows\system32\Ankdiqih.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Aplpai32.exeC:\Windows\system32\Aplpai32.exe89⤵
-
C:\Windows\SysWOW64\Adhlaggp.exeC:\Windows\system32\Adhlaggp.exe90⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ajbdna32.exeC:\Windows\system32\Ajbdna32.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Aiedjneg.exeC:\Windows\system32\Aiedjneg.exe92⤵
-
C:\Windows\SysWOW64\Apomfh32.exeC:\Windows\system32\Apomfh32.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Adjigg32.exeC:\Windows\system32\Adjigg32.exe94⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ajdadamj.exeC:\Windows\system32\Ajdadamj.exe95⤵
-
C:\Windows\SysWOW64\Aigaon32.exeC:\Windows\system32\Aigaon32.exe96⤵
-
C:\Windows\SysWOW64\Ambmpmln.exeC:\Windows\system32\Ambmpmln.exe97⤵
-
C:\Windows\SysWOW64\Apajlhka.exeC:\Windows\system32\Apajlhka.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Abpfhcje.exeC:\Windows\system32\Abpfhcje.exe99⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Aenbdoii.exeC:\Windows\system32\Aenbdoii.exe100⤵
-
C:\Windows\SysWOW64\Amejeljk.exeC:\Windows\system32\Amejeljk.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Alhjai32.exeC:\Windows\system32\Alhjai32.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Aoffmd32.exeC:\Windows\system32\Aoffmd32.exe103⤵
-
C:\Windows\SysWOW64\Abbbnchb.exeC:\Windows\system32\Abbbnchb.exe104⤵
-
C:\Windows\SysWOW64\Ahokfj32.exeC:\Windows\system32\Ahokfj32.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Aljgfioc.exeC:\Windows\system32\Aljgfioc.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Bbdocc32.exeC:\Windows\system32\Bbdocc32.exe107⤵
-
C:\Windows\SysWOW64\Bebkpn32.exeC:\Windows\system32\Bebkpn32.exe108⤵
-
C:\Windows\SysWOW64\Bhahlj32.exeC:\Windows\system32\Bhahlj32.exe109⤵
-
C:\Windows\SysWOW64\Bkodhe32.exeC:\Windows\system32\Bkodhe32.exe110⤵
-
C:\Windows\SysWOW64\Bokphdld.exeC:\Windows\system32\Bokphdld.exe111⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Baildokg.exeC:\Windows\system32\Baildokg.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Bdhhqk32.exeC:\Windows\system32\Bdhhqk32.exe113⤵
-
C:\Windows\SysWOW64\Bhcdaibd.exeC:\Windows\system32\Bhcdaibd.exe114⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Bkaqmeah.exeC:\Windows\system32\Bkaqmeah.exe115⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Bnpmipql.exeC:\Windows\system32\Bnpmipql.exe116⤵
-
C:\Windows\SysWOW64\Begeknan.exeC:\Windows\system32\Begeknan.exe117⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Bhfagipa.exeC:\Windows\system32\Bhfagipa.exe118⤵
-
C:\Windows\SysWOW64\Bkdmcdoe.exeC:\Windows\system32\Bkdmcdoe.exe119⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Bnbjopoi.exeC:\Windows\system32\Bnbjopoi.exe120⤵
-
C:\Windows\SysWOW64\Bpafkknm.exeC:\Windows\system32\Bpafkknm.exe121⤵
-
C:\Windows\SysWOW64\Bhhnli32.exeC:\Windows\system32\Bhhnli32.exe122⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Bjijdadm.exeC:\Windows\system32\Bjijdadm.exe123⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Bpcbqk32.exeC:\Windows\system32\Bpcbqk32.exe124⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Bdooajdc.exeC:\Windows\system32\Bdooajdc.exe125⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ckignd32.exeC:\Windows\system32\Ckignd32.exe126⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Cjlgiqbk.exeC:\Windows\system32\Cjlgiqbk.exe127⤵
-
C:\Windows\SysWOW64\Cljcelan.exeC:\Windows\system32\Cljcelan.exe128⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Cpeofk32.exeC:\Windows\system32\Cpeofk32.exe129⤵
-
C:\Windows\SysWOW64\Ccdlbf32.exeC:\Windows\system32\Ccdlbf32.exe130⤵
-
C:\Windows\SysWOW64\Cgpgce32.exeC:\Windows\system32\Cgpgce32.exe131⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Cjndop32.exeC:\Windows\system32\Cjndop32.exe132⤵
-
C:\Windows\SysWOW64\Cllpkl32.exeC:\Windows\system32\Cllpkl32.exe133⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Coklgg32.exeC:\Windows\system32\Coklgg32.exe134⤵
-
C:\Windows\SysWOW64\Ccfhhffh.exeC:\Windows\system32\Ccfhhffh.exe135⤵
-
C:\Windows\SysWOW64\Cfeddafl.exeC:\Windows\system32\Cfeddafl.exe136⤵
-
C:\Windows\SysWOW64\Cjpqdp32.exeC:\Windows\system32\Cjpqdp32.exe137⤵
-
C:\Windows\SysWOW64\Cpjiajeb.exeC:\Windows\system32\Cpjiajeb.exe138⤵
-
C:\Windows\SysWOW64\Comimg32.exeC:\Windows\system32\Comimg32.exe139⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Cbkeib32.exeC:\Windows\system32\Cbkeib32.exe140⤵
-
C:\Windows\SysWOW64\Cfgaiaci.exeC:\Windows\system32\Cfgaiaci.exe141⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Chemfl32.exeC:\Windows\system32\Chemfl32.exe142⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Claifkkf.exeC:\Windows\system32\Claifkkf.exe143⤵
-
C:\Windows\SysWOW64\Copfbfjj.exeC:\Windows\system32\Copfbfjj.exe144⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Cbnbobin.exeC:\Windows\system32\Cbnbobin.exe145⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Cdlnkmha.exeC:\Windows\system32\Cdlnkmha.exe146⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Chhjkl32.exeC:\Windows\system32\Chhjkl32.exe147⤵
-
C:\Windows\SysWOW64\Ckffgg32.exeC:\Windows\system32\Ckffgg32.exe148⤵
-
C:\Windows\SysWOW64\Cobbhfhg.exeC:\Windows\system32\Cobbhfhg.exe149⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Dflkdp32.exeC:\Windows\system32\Dflkdp32.exe150⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ddokpmfo.exeC:\Windows\system32\Ddokpmfo.exe151⤵
-
C:\Windows\SysWOW64\Dgmglh32.exeC:\Windows\system32\Dgmglh32.exe152⤵
-
C:\Windows\SysWOW64\Dkhcmgnl.exeC:\Windows\system32\Dkhcmgnl.exe153⤵
-
C:\Windows\SysWOW64\Dngoibmo.exeC:\Windows\system32\Dngoibmo.exe154⤵
-
C:\Windows\SysWOW64\Dqelenlc.exeC:\Windows\system32\Dqelenlc.exe155⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ddagfm32.exeC:\Windows\system32\Ddagfm32.exe156⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dgodbh32.exeC:\Windows\system32\Dgodbh32.exe157⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Djnpnc32.exeC:\Windows\system32\Djnpnc32.exe158⤵
-
C:\Windows\SysWOW64\Dbehoa32.exeC:\Windows\system32\Dbehoa32.exe159⤵
-
C:\Windows\SysWOW64\Dqhhknjp.exeC:\Windows\system32\Dqhhknjp.exe160⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Dcfdgiid.exeC:\Windows\system32\Dcfdgiid.exe161⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Dkmmhf32.exeC:\Windows\system32\Dkmmhf32.exe162⤵
-
C:\Windows\SysWOW64\Djpmccqq.exeC:\Windows\system32\Djpmccqq.exe163⤵
-
C:\Windows\SysWOW64\Dmoipopd.exeC:\Windows\system32\Dmoipopd.exe164⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Dqjepm32.exeC:\Windows\system32\Dqjepm32.exe165⤵
-
C:\Windows\SysWOW64\Dgdmmgpj.exeC:\Windows\system32\Dgdmmgpj.exe166⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Dfgmhd32.exeC:\Windows\system32\Dfgmhd32.exe167⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Dnneja32.exeC:\Windows\system32\Dnneja32.exe168⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dmafennb.exeC:\Windows\system32\Dmafennb.exe169⤵
-
C:\Windows\SysWOW64\Doobajme.exeC:\Windows\system32\Doobajme.exe170⤵
-
C:\Windows\SysWOW64\Dcknbh32.exeC:\Windows\system32\Dcknbh32.exe171⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Djefobmk.exeC:\Windows\system32\Djefobmk.exe172⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Eihfjo32.exeC:\Windows\system32\Eihfjo32.exe173⤵
-
C:\Windows\SysWOW64\Eqonkmdh.exeC:\Windows\system32\Eqonkmdh.exe174⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Epaogi32.exeC:\Windows\system32\Epaogi32.exe175⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Ebpkce32.exeC:\Windows\system32\Ebpkce32.exe176⤵
-
C:\Windows\SysWOW64\Eflgccbp.exeC:\Windows\system32\Eflgccbp.exe177⤵
-
C:\Windows\SysWOW64\Emeopn32.exeC:\Windows\system32\Emeopn32.exe178⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ekholjqg.exeC:\Windows\system32\Ekholjqg.exe179⤵
-
C:\Windows\SysWOW64\Ecpgmhai.exeC:\Windows\system32\Ecpgmhai.exe180⤵
-
C:\Windows\SysWOW64\Ebbgid32.exeC:\Windows\system32\Ebbgid32.exe181⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Eeqdep32.exeC:\Windows\system32\Eeqdep32.exe182⤵
-
C:\Windows\SysWOW64\Emhlfmgj.exeC:\Windows\system32\Emhlfmgj.exe183⤵
-
C:\Windows\SysWOW64\Epfhbign.exeC:\Windows\system32\Epfhbign.exe184⤵
-
C:\Windows\SysWOW64\Enihne32.exeC:\Windows\system32\Enihne32.exe185⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Eecqjpee.exeC:\Windows\system32\Eecqjpee.exe186⤵
-
C:\Windows\SysWOW64\Eiomkn32.exeC:\Windows\system32\Eiomkn32.exe187⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Elmigj32.exeC:\Windows\system32\Elmigj32.exe188⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Epieghdk.exeC:\Windows\system32\Epieghdk.exe189⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ebgacddo.exeC:\Windows\system32\Ebgacddo.exe190⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Eajaoq32.exeC:\Windows\system32\Eajaoq32.exe191⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Eiaiqn32.exeC:\Windows\system32\Eiaiqn32.exe192⤵
-
C:\Windows\SysWOW64\Egdilkbf.exeC:\Windows\system32\Egdilkbf.exe193⤵
-
C:\Windows\SysWOW64\Ejbfhfaj.exeC:\Windows\system32\Ejbfhfaj.exe194⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ennaieib.exeC:\Windows\system32\Ennaieib.exe195⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Fehjeo32.exeC:\Windows\system32\Fehjeo32.exe196⤵
-
C:\Windows\SysWOW64\Fhffaj32.exeC:\Windows\system32\Fhffaj32.exe197⤵
-
C:\Windows\SysWOW64\Flabbihl.exeC:\Windows\system32\Flabbihl.exe198⤵
-
C:\Windows\SysWOW64\Fjdbnf32.exeC:\Windows\system32\Fjdbnf32.exe199⤵
-
C:\Windows\SysWOW64\Fmcoja32.exeC:\Windows\system32\Fmcoja32.exe200⤵
-
C:\Windows\SysWOW64\Faokjpfd.exeC:\Windows\system32\Faokjpfd.exe201⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fcmgfkeg.exeC:\Windows\system32\Fcmgfkeg.exe202⤵
-
C:\Windows\SysWOW64\Fhhcgj32.exeC:\Windows\system32\Fhhcgj32.exe203⤵
-
C:\Windows\SysWOW64\Fjgoce32.exeC:\Windows\system32\Fjgoce32.exe204⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Fmekoalh.exeC:\Windows\system32\Fmekoalh.exe205⤵
-
C:\Windows\SysWOW64\Fpdhklkl.exeC:\Windows\system32\Fpdhklkl.exe206⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Fhkpmjln.exeC:\Windows\system32\Fhkpmjln.exe207⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Ffnphf32.exeC:\Windows\system32\Ffnphf32.exe208⤵
-
C:\Windows\SysWOW64\Fjilieka.exeC:\Windows\system32\Fjilieka.exe209⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Facdeo32.exeC:\Windows\system32\Facdeo32.exe210⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Fpfdalii.exeC:\Windows\system32\Fpfdalii.exe211⤵
-
C:\Windows\SysWOW64\Fbdqmghm.exeC:\Windows\system32\Fbdqmghm.exe212⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Ffpmnf32.exeC:\Windows\system32\Ffpmnf32.exe213⤵
-
C:\Windows\SysWOW64\Fioija32.exeC:\Windows\system32\Fioija32.exe214⤵
-
C:\Windows\SysWOW64\Flmefm32.exeC:\Windows\system32\Flmefm32.exe215⤵
-
C:\Windows\SysWOW64\Fddmgjpo.exeC:\Windows\system32\Fddmgjpo.exe216⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fbgmbg32.exeC:\Windows\system32\Fbgmbg32.exe217⤵
-
C:\Windows\SysWOW64\Feeiob32.exeC:\Windows\system32\Feeiob32.exe218⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Fiaeoang.exeC:\Windows\system32\Fiaeoang.exe219⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Globlmmj.exeC:\Windows\system32\Globlmmj.exe220⤵
-
C:\Windows\SysWOW64\Gonnhhln.exeC:\Windows\system32\Gonnhhln.exe221⤵
-
C:\Windows\SysWOW64\Gfefiemq.exeC:\Windows\system32\Gfefiemq.exe222⤵
-
C:\Windows\SysWOW64\Glaoalkh.exeC:\Windows\system32\Glaoalkh.exe223⤵
-
C:\Windows\SysWOW64\Gopkmhjk.exeC:\Windows\system32\Gopkmhjk.exe224⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Gbkgnfbd.exeC:\Windows\system32\Gbkgnfbd.exe225⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Gieojq32.exeC:\Windows\system32\Gieojq32.exe226⤵
-
C:\Windows\SysWOW64\Ghhofmql.exeC:\Windows\system32\Ghhofmql.exe227⤵
-
C:\Windows\SysWOW64\Gkgkbipp.exeC:\Windows\system32\Gkgkbipp.exe228⤵
-
C:\Windows\SysWOW64\Gobgcg32.exeC:\Windows\system32\Gobgcg32.exe229⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gaqcoc32.exeC:\Windows\system32\Gaqcoc32.exe230⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Gelppaof.exeC:\Windows\system32\Gelppaof.exe231⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ghkllmoi.exeC:\Windows\system32\Ghkllmoi.exe232⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gkihhhnm.exeC:\Windows\system32\Gkihhhnm.exe233⤵
-
C:\Windows\SysWOW64\Goddhg32.exeC:\Windows\system32\Goddhg32.exe234⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gacpdbej.exeC:\Windows\system32\Gacpdbej.exe235⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Gdamqndn.exeC:\Windows\system32\Gdamqndn.exe236⤵
-
C:\Windows\SysWOW64\Ghmiam32.exeC:\Windows\system32\Ghmiam32.exe237⤵
-
C:\Windows\SysWOW64\Gkkemh32.exeC:\Windows\system32\Gkkemh32.exe238⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gogangdc.exeC:\Windows\system32\Gogangdc.exe239⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Gphmeo32.exeC:\Windows\system32\Gphmeo32.exe240⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Gddifnbk.exeC:\Windows\system32\Gddifnbk.exe241⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class