Analysis
-
max time kernel
139s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06-06-2024 01:25
Static task
static1
Behavioral task
behavioral1
Sample
7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe
Resource
win10v2004-20240508-en
General
-
Target
7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe
-
Size
163KB
-
MD5
18702a566bc159e119421bea2815335f
-
SHA1
de58743dc7eead1dc7134af16a7094b45d1ef839
-
SHA256
7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4
-
SHA512
7c9a323509b403b72cb20febea55b8d5df3e3d6f68e62b547f95c311fed91b64193ffcef71f9b2a92085d52a2f45ae16cac449304953ee72ee3e03bffa97ed41
-
SSDEEP
1536:Pi3sizupgJPnVBehy7R6JJVl+MKf0IzlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNy:dpDygJJVl2fdzltOrWKDBr+yJb
Malware Config
Extracted
gozi
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Fndpmndl.exeLmdnbn32.exeMjnnbk32.exeMhckcgpj.exePbcncibp.exeAdgmoigj.exeMcqjon32.exeHoeieolb.exeIinjhh32.exeMfeeabda.exeNnojho32.exeKcndbp32.exeLgepom32.exeHihibbjo.exeMomcpa32.exeQiiflaoo.exePhaahggp.exeOabhfg32.exeFpimlfke.exeEghkjdoa.exePfccogfc.exeBjhkmbho.exeOjdnid32.exeFijkdmhn.exeQodeajbg.exeFiqjke32.exeOikjkc32.exeDodjjimm.exeEfblbbqd.exeCigkdmel.exeHejqldci.exeOmmceclc.exeHibjli32.exeBgelgi32.exeJcanll32.exeNpepkf32.exeAaldccip.exeQkipkani.exeEmmdom32.exeGoglcahb.exeAmnlme32.exeJlbejloe.exeMlhqcgnk.exeLjobpiql.exeGfhndpol.exeHnbeeiji.exeNcabfkqo.exeDmlkhofd.exePjpfjl32.exeAmfobp32.exeOalipoiq.exeJljbeali.exeMogcihaj.exeIehmmb32.exePiapkbeg.exeBkmeha32.exeBhnikc32.exeFligqhga.exeJgmjmjnb.exePiocecgj.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fndpmndl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lmdnbn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjnnbk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhckcgpj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pbcncibp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Adgmoigj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcqjon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hoeieolb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iinjhh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mfeeabda.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nnojho32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcndbp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgepom32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hihibbjo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Momcpa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qiiflaoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phaahggp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oabhfg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fpimlfke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eghkjdoa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfccogfc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bjhkmbho.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojdnid32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fijkdmhn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qodeajbg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fiqjke32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oikjkc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dodjjimm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efblbbqd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cigkdmel.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eghkjdoa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hejqldci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ommceclc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cigkdmel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hibjli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bgelgi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jcanll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Npepkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aaldccip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fndpmndl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qkipkani.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Emmdom32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Goglcahb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iinjhh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amnlme32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jlbejloe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlhqcgnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ljobpiql.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gfhndpol.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnbeeiji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ncabfkqo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmlkhofd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjpfjl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amfobp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oalipoiq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jljbeali.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mogcihaj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iehmmb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Piapkbeg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bkmeha32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhnikc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fligqhga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jgmjmjnb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Piocecgj.exe -
Detects executables built or packed with MPress PE compressor 64 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\Kggcnoic.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kqphfe32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kcndbp32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kcpahpmd.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kglmio32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kqdaadln.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kgninn32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Knhakh32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Kqfngd32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ljobpiql.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lqikmc32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lknojl32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lnmkfh32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ldgccb32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lgepom32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lmbhgd32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lkchelci.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ljfhqh32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Lgjijmin.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ljhefhha.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mcqjon32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mjkblhfo.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mepfiq32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mgobel32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mmkkmc32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mebcop32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mkmkkjko.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mmnhcb32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Meepdp32.exe INDICATOR_EXE_Packed_MPress behavioral2/memory/4368-228-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mmpdhboj.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Mjdebfnd.exe INDICATOR_EXE_Packed_MPress behavioral2/memory/2324-248-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Manmoq32.exe INDICATOR_EXE_Packed_MPress behavioral2/memory/4680-260-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Nmenca32.exe INDICATOR_EXE_Packed_MPress behavioral2/memory/2280-279-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/4664-289-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/3620-430-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/4084-438-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/1152-444-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/4660-450-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/5148-456-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Plbfdekd.exe INDICATOR_EXE_Packed_MPress behavioral2/memory/4376-613-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/3140-631-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/3220-637-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/5100-649-0x0000000000400000-0x0000000000453000-memory.dmp INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Blielbfi.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bafndi32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bkobmnka.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Clchbqoo.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cdnmfclj.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cleegp32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cbfgkffn.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dooaoj32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dndnpf32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Eecphp32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Eokqkh32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Efgemb32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Felbnn32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Flfkkhid.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Gncchb32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Hoobdp32.exe INDICATOR_EXE_Packed_MPress -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\Kggcnoic.exe UPX C:\Windows\SysWOW64\Kqphfe32.exe UPX C:\Windows\SysWOW64\Kcndbp32.exe UPX C:\Windows\SysWOW64\Kcpahpmd.exe UPX C:\Windows\SysWOW64\Kglmio32.exe UPX behavioral2/memory/4696-41-0x0000000000400000-0x0000000000453000-memory.dmp UPX C:\Windows\SysWOW64\Kqdaadln.exe UPX C:\Windows\SysWOW64\Kgninn32.exe UPX C:\Windows\SysWOW64\Knhakh32.exe UPX C:\Windows\SysWOW64\Kqfngd32.exe UPX C:\Windows\SysWOW64\Ljobpiql.exe UPX C:\Windows\SysWOW64\Lqikmc32.exe UPX C:\Windows\SysWOW64\Lknojl32.exe UPX C:\Windows\SysWOW64\Lnmkfh32.exe UPX C:\Windows\SysWOW64\Ldgccb32.exe UPX C:\Windows\SysWOW64\Lgepom32.exe UPX C:\Windows\SysWOW64\Lmbhgd32.exe UPX C:\Windows\SysWOW64\Lkchelci.exe UPX C:\Windows\SysWOW64\Ljfhqh32.exe UPX C:\Windows\SysWOW64\Lgjijmin.exe UPX C:\Windows\SysWOW64\Ljhefhha.exe UPX C:\Windows\SysWOW64\Mcqjon32.exe UPX C:\Windows\SysWOW64\Mjkblhfo.exe UPX C:\Windows\SysWOW64\Mepfiq32.exe UPX C:\Windows\SysWOW64\Mgobel32.exe UPX C:\Windows\SysWOW64\Mmkkmc32.exe UPX C:\Windows\SysWOW64\Mebcop32.exe UPX C:\Windows\SysWOW64\Mkmkkjko.exe UPX C:\Windows\SysWOW64\Mmnhcb32.exe UPX C:\Windows\SysWOW64\Meepdp32.exe UPX behavioral2/memory/4368-228-0x0000000000400000-0x0000000000453000-memory.dmp UPX C:\Windows\SysWOW64\Mmpdhboj.exe UPX C:\Windows\SysWOW64\Mjdebfnd.exe UPX behavioral2/memory/2324-248-0x0000000000400000-0x0000000000453000-memory.dmp UPX C:\Windows\SysWOW64\Manmoq32.exe UPX behavioral2/memory/4680-260-0x0000000000400000-0x0000000000453000-memory.dmp UPX C:\Windows\SysWOW64\Nmenca32.exe UPX behavioral2/memory/2280-279-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/4664-289-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/3364-291-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/4936-297-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/4352-303-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/1560-309-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/4444-315-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/3776-321-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/3048-327-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/3028-337-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/4472-339-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/2980-345-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/4028-355-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/3252-357-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/2408-367-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/4912-412-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/4864-414-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/3036-420-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/3620-430-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/4084-438-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/1152-444-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/4660-450-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/5148-456-0x0000000000400000-0x0000000000453000-memory.dmp UPX C:\Windows\SysWOW64\Plbfdekd.exe UPX behavioral2/memory/3764-609-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/4376-613-0x0000000000400000-0x0000000000453000-memory.dmp UPX behavioral2/memory/3140-631-0x0000000000400000-0x0000000000453000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
Kggcnoic.exeKqphfe32.exeKcndbp32.exeKcpahpmd.exeKglmio32.exeKqdaadln.exeKgninn32.exeKnhakh32.exeKqfngd32.exeLjobpiql.exeLqikmc32.exeLknojl32.exeLnmkfh32.exeLdgccb32.exeLgepom32.exeLmbhgd32.exeLkchelci.exeLjfhqh32.exeLgjijmin.exeLjhefhha.exeMcqjon32.exeMjkblhfo.exeMepfiq32.exeMgobel32.exeMmkkmc32.exeMebcop32.exeMkmkkjko.exeMmnhcb32.exeMeepdp32.exeMmpdhboj.exeMjdebfnd.exeManmoq32.exeNghekkmn.exeNmenca32.exeNapjdpcn.exeNcofplba.exeNjinmf32.exeNndjndbh.exeNcabfkqo.exeNhmofj32.exeNnfgcd32.exeNaecop32.exeNccokk32.exeNjmhhefi.exeNmlddqem.exeNeclenfo.exeNlmdbh32.exeNnkpnclp.exeNajmjokc.exeOdhifjkg.exeOloahhki.exeOnnmdcjm.exeOalipoiq.exeOhfami32.exeOjdnid32.exeOnpjichj.exeOanfen32.exeOdmbaj32.exeOldjcg32.exeOmegjomb.exeOhkkhhmh.exeOodcdb32.exeOdalmibl.exeOlicnfco.exepid process 3368 Kggcnoic.exe 2040 Kqphfe32.exe 1556 Kcndbp32.exe 4108 Kcpahpmd.exe 4696 Kglmio32.exe 1468 Kqdaadln.exe 1756 Kgninn32.exe 3688 Knhakh32.exe 376 Kqfngd32.exe 2620 Ljobpiql.exe 3764 Lqikmc32.exe 4376 Lknojl32.exe 2896 Lnmkfh32.exe 4932 Ldgccb32.exe 3140 Lgepom32.exe 3220 Lmbhgd32.exe 2756 Lkchelci.exe 5100 Ljfhqh32.exe 4772 Lgjijmin.exe 5092 Ljhefhha.exe 3284 Mcqjon32.exe 2708 Mjkblhfo.exe 4336 Mepfiq32.exe 3292 Mgobel32.exe 4136 Mmkkmc32.exe 1388 Mebcop32.exe 4124 Mkmkkjko.exe 4368 Mmnhcb32.exe 1428 Meepdp32.exe 3904 Mmpdhboj.exe 2324 Mjdebfnd.exe 4680 Manmoq32.exe 3308 Nghekkmn.exe 3612 Nmenca32.exe 3228 Napjdpcn.exe 2280 Ncofplba.exe 4664 Njinmf32.exe 3364 Nndjndbh.exe 4936 Ncabfkqo.exe 4352 Nhmofj32.exe 1560 Nnfgcd32.exe 4444 Naecop32.exe 3776 Nccokk32.exe 3048 Njmhhefi.exe 3028 Nmlddqem.exe 4472 Neclenfo.exe 2980 Nlmdbh32.exe 4028 Nnkpnclp.exe 3252 Najmjokc.exe 2408 Odhifjkg.exe 1436 Oloahhki.exe 856 Onnmdcjm.exe 1064 Oalipoiq.exe 2176 Ohfami32.exe 5072 Ojdnid32.exe 1236 Onpjichj.exe 1084 Oanfen32.exe 4912 Odmbaj32.exe 4864 Oldjcg32.exe 3036 Omegjomb.exe 3620 Ohkkhhmh.exe 4240 Oodcdb32.exe 4084 Odalmibl.exe 1152 Olicnfco.exe -
Drops file in System32 directory 64 IoCs
Processes:
Fngcmcfe.exeJcoaglhk.exeBmidnm32.exeKcmmhj32.exeLncjlq32.exeCiihjmcj.exeQdaniq32.exeNjgqhicg.exeAdjjeieh.exeNgqagcag.exeAaldccip.exeCdjblf32.exeNoblkqca.exeLdgccb32.exeMcqjon32.exeQkipkani.exeLlqjbhdc.exeOqoefand.exeBdmmeo32.exeEqdpgk32.exeFqppci32.exeBjfogbjb.exePhfcipoo.exeAfpjel32.exeGhojbq32.exeIomoenej.exeJmeede32.exeMlljnf32.exeMmpdhboj.exeDijbno32.exeHibjli32.exeFlfkkhid.exePbekii32.exeIlcldb32.exeLjeafb32.exeJoqafgni.exeNapjdpcn.exeBhbcfbjk.exeIckglm32.exeNblolm32.exeCndeii32.exeHejqldci.exeJhifomdj.exeCajjjk32.exeCgiohbfi.exeNjmhhefi.exeDflfac32.exeMokfja32.exeMeepdp32.exeLlnnmhfe.exeHedafk32.exeEghkjdoa.exeNnfgcd32.exeAhgcjddh.exeGmafajfi.exeFiaael32.exeOfckhj32.exePmlfqh32.exePpgomnai.exeBphqji32.exeDbkqfe32.exeEnbjad32.exeFechomko.exedescription ioc process File created C:\Windows\SysWOW64\Fbbpmb32.exe Fngcmcfe.exe File created C:\Windows\SysWOW64\Jenmcggo.exe Jcoaglhk.exe File created C:\Windows\SysWOW64\Bphqji32.exe Bmidnm32.exe File created C:\Windows\SysWOW64\Bjdbkbbn.dll Kcmmhj32.exe File opened for modification C:\Windows\SysWOW64\Mqafhl32.exe Lncjlq32.exe File created C:\Windows\SysWOW64\Caqpkjcl.exe Ciihjmcj.exe File opened for modification C:\Windows\SysWOW64\Afpjel32.exe Qdaniq32.exe File created C:\Windows\SysWOW64\Nmfmde32.exe Njgqhicg.exe File created C:\Windows\SysWOW64\Afhfaddk.exe Adjjeieh.exe File opened for modification C:\Windows\SysWOW64\Omnjojpo.exe Ngqagcag.exe File created C:\Windows\SysWOW64\Hbobhb32.dll Aaldccip.exe File created C:\Windows\SysWOW64\Cgiohbfi.exe Cdjblf32.exe File created C:\Windows\SysWOW64\Fpenlneh.dll Noblkqca.exe File opened for modification C:\Windows\SysWOW64\Lgepom32.exe Ldgccb32.exe File created C:\Windows\SysWOW64\Bdkohe32.dll Mcqjon32.exe File created C:\Windows\SysWOW64\Qmhlgmmm.exe Qkipkani.exe File opened for modification C:\Windows\SysWOW64\Loofnccf.exe Llqjbhdc.exe File opened for modification C:\Windows\SysWOW64\Ocnabm32.exe Oqoefand.exe File created C:\Windows\SysWOW64\Baannc32.exe Bdmmeo32.exe File opened for modification C:\Windows\SysWOW64\Egaejeej.exe Eqdpgk32.exe File created C:\Windows\SysWOW64\Fgjhpcmo.exe Fqppci32.exe File created C:\Windows\SysWOW64\Elekoe32.dll Bjfogbjb.exe File created C:\Windows\SysWOW64\Idaiki32.dll Phfcipoo.exe File opened for modification C:\Windows\SysWOW64\Amjbbfgo.exe Afpjel32.exe File opened for modification C:\Windows\SysWOW64\Hbenoi32.exe Ghojbq32.exe File opened for modification C:\Windows\SysWOW64\Igdgglfl.exe Iomoenej.exe File created C:\Windows\SysWOW64\Pnjbcghk.dll Jmeede32.exe File opened for modification C:\Windows\SysWOW64\Mokfja32.exe Mlljnf32.exe File created C:\Windows\SysWOW64\Mjdebfnd.exe Mmpdhboj.exe File created C:\Windows\SysWOW64\Dodjjimm.exe Dijbno32.exe File created C:\Windows\SysWOW64\Ddipic32.dll Hibjli32.exe File created C:\Windows\SysWOW64\Cjafgpmo.dll Flfkkhid.exe File created C:\Windows\SysWOW64\Piocecgj.exe Pbekii32.exe File opened for modification C:\Windows\SysWOW64\Joahqn32.exe Ilcldb32.exe File opened for modification C:\Windows\SysWOW64\Lmdnbn32.exe Ljeafb32.exe File created C:\Windows\SysWOW64\Lhkdqh32.dll Joqafgni.exe File opened for modification C:\Windows\SysWOW64\Ncofplba.exe Napjdpcn.exe File created C:\Windows\SysWOW64\Bkaobnio.exe Bhbcfbjk.exe File created C:\Windows\SysWOW64\Ieidhh32.exe Ickglm32.exe File created C:\Windows\SysWOW64\Njbgmjgl.exe Nblolm32.exe File opened for modification C:\Windows\SysWOW64\Cdnmfclj.exe Cndeii32.exe File opened for modification C:\Windows\SysWOW64\Hnbeeiji.exe Hejqldci.exe File opened for modification C:\Windows\SysWOW64\Jaajhb32.exe Jhifomdj.exe File opened for modification C:\Windows\SysWOW64\Cbkfbcpb.exe Cajjjk32.exe File opened for modification C:\Windows\SysWOW64\Cigkdmel.exe Cgiohbfi.exe File created C:\Windows\SysWOW64\Nmlddqem.exe Njmhhefi.exe File created C:\Windows\SysWOW64\Ebmenh32.dll Dflfac32.exe File created C:\Windows\SysWOW64\Mbibfm32.exe Mokfja32.exe File created C:\Windows\SysWOW64\Mmpdhboj.exe Meepdp32.exe File opened for modification C:\Windows\SysWOW64\Lomjicei.exe Llnnmhfe.exe File opened for modification C:\Windows\SysWOW64\Hmkigh32.exe Hedafk32.exe File created C:\Windows\SysWOW64\Jpcapp32.exe Jmeede32.exe File opened for modification C:\Windows\SysWOW64\Fqppci32.exe Eghkjdoa.exe File created C:\Windows\SysWOW64\Kodoah32.dll Nnfgcd32.exe File created C:\Windows\SysWOW64\Ackekpfe.dll Ahgcjddh.exe File opened for modification C:\Windows\SysWOW64\Gncchb32.exe Gmafajfi.exe File opened for modification C:\Windows\SysWOW64\Fmmmfj32.exe Fiaael32.exe File created C:\Windows\SysWOW64\Ojnfihmo.exe Ofckhj32.exe File created C:\Windows\SysWOW64\Pagbaglh.exe Pmlfqh32.exe File opened for modification C:\Windows\SysWOW64\Pbekii32.exe Ppgomnai.exe File opened for modification C:\Windows\SysWOW64\Bbfmgd32.exe Bphqji32.exe File created C:\Windows\SysWOW64\Dfglfdkb.exe Dbkqfe32.exe File created C:\Windows\SysWOW64\Ebnfbcbc.exe Enbjad32.exe File created C:\Windows\SysWOW64\Fmkqpkla.exe Fechomko.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 14668 14524 WerFault.exe Diqnjl32.exe -
Modifies registry class 64 IoCs
Processes:
Nnkpnclp.exeIbaeen32.exeGpelhd32.exeIinjhh32.exeEgaejeej.exeBmidnm32.exeBdpaeehj.exeGlkmmefl.exePagbaglh.exeIeccbbkn.exeAibibp32.exeDgbanq32.exeLgdidgjg.exeHhfpbpdo.exeMepfiq32.exeBllbaa32.exeCkclhn32.exeDflfac32.exeGmfplibd.exeOcgbld32.exeLancko32.exeKggcnoic.exeNmenca32.exeAekddhcb.exeDbkqfe32.exeEpmmqheb.exeHffken32.exeEkkkoj32.exeJoahqn32.exeLcnfohmi.exeDndnpf32.exeGeaepk32.exeLmdnbn32.exeJoqafgni.exeBdocph32.exeAhgcjddh.exeBnhenj32.exeCnahdi32.exeNnafno32.exeKpnjah32.exeAlkijdci.exeDheibpje.exeKpjgaoqm.exeChnbbqpn.exePdenmbkk.exeQdoacabq.exeMjodla32.exeIimcma32.exeBhbcfbjk.exeAoioli32.exeNmfmde32.exeNqcejcha.exeEiloco32.exeLlqjbhdc.exeOblhcj32.exePmaffnce.exeQfkqjmdg.exeNjgqhicg.exeOmmceclc.exeCcblbb32.exeNndjndbh.exeBlgifbil.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nnkpnclp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfgllk32.dll" Ibaeen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfdaia32.dll" Gpelhd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iinjhh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Egaejeej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjaofnii.dll" Bmidnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bdpaeehj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Glkmmefl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pagbaglh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ieccbbkn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aibibp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qahlom32.dll" Dgbanq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lgdidgjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hhfpbpdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmafqb32.dll" Mepfiq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odjjif32.dll" Bllbaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ckclhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dflfac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dibkjmof.dll" Gmfplibd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofmfi32.dll" Ocgbld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lancko32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kggcnoic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqglioac.dll" Nmenca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejoaandc.dll" Aekddhcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dbkqfe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Epmmqheb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aijqqd32.dll" Hffken32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjqlnnkp.dll" Ekkkoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kghfphob.dll" Joahqn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efmnhl32.dll" Lcnfohmi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dndnpf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Geaepk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lmdnbn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhkdqh32.dll" Joqafgni.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bdocph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nmenca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ahgcjddh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bnhenj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cnahdi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nnafno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjohgj32.dll" Kpnjah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Alkijdci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dheibpje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kpjgaoqm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Chnbbqpn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pdenmbkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Godcje32.dll" Qdoacabq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Chnbbqpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mjodla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idknpoad.dll" Iimcma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bhbcfbjk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aoioli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ildolk32.dll" Nmfmde32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nqcejcha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eiloco32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdohflaf.dll" Llqjbhdc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oblhcj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdpmoppk.dll" Pmaffnce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qfkqjmdg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Njgqhicg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ommceclc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ccblbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nndjndbh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Blgifbil.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exeKggcnoic.exeKqphfe32.exeKcndbp32.exeKcpahpmd.exeKglmio32.exeKqdaadln.exeKgninn32.exeKnhakh32.exeKqfngd32.exeLjobpiql.exeLqikmc32.exeLknojl32.exeLnmkfh32.exeLdgccb32.exeLgepom32.exeLmbhgd32.exeLkchelci.exeLjfhqh32.exeLgjijmin.exeLjhefhha.exeMcqjon32.exedescription pid process target process PID 4036 wrote to memory of 3368 4036 7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe Kggcnoic.exe PID 4036 wrote to memory of 3368 4036 7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe Kggcnoic.exe PID 4036 wrote to memory of 3368 4036 7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe Kggcnoic.exe PID 3368 wrote to memory of 2040 3368 Kggcnoic.exe Kqphfe32.exe PID 3368 wrote to memory of 2040 3368 Kggcnoic.exe Kqphfe32.exe PID 3368 wrote to memory of 2040 3368 Kggcnoic.exe Kqphfe32.exe PID 2040 wrote to memory of 1556 2040 Kqphfe32.exe Kcndbp32.exe PID 2040 wrote to memory of 1556 2040 Kqphfe32.exe Kcndbp32.exe PID 2040 wrote to memory of 1556 2040 Kqphfe32.exe Kcndbp32.exe PID 1556 wrote to memory of 4108 1556 Kcndbp32.exe Kcpahpmd.exe PID 1556 wrote to memory of 4108 1556 Kcndbp32.exe Kcpahpmd.exe PID 1556 wrote to memory of 4108 1556 Kcndbp32.exe Kcpahpmd.exe PID 4108 wrote to memory of 4696 4108 Kcpahpmd.exe Kglmio32.exe PID 4108 wrote to memory of 4696 4108 Kcpahpmd.exe Kglmio32.exe PID 4108 wrote to memory of 4696 4108 Kcpahpmd.exe Kglmio32.exe PID 4696 wrote to memory of 1468 4696 Kglmio32.exe Kqdaadln.exe PID 4696 wrote to memory of 1468 4696 Kglmio32.exe Kqdaadln.exe PID 4696 wrote to memory of 1468 4696 Kglmio32.exe Kqdaadln.exe PID 1468 wrote to memory of 1756 1468 Kqdaadln.exe Kgninn32.exe PID 1468 wrote to memory of 1756 1468 Kqdaadln.exe Kgninn32.exe PID 1468 wrote to memory of 1756 1468 Kqdaadln.exe Kgninn32.exe PID 1756 wrote to memory of 3688 1756 Kgninn32.exe Knhakh32.exe PID 1756 wrote to memory of 3688 1756 Kgninn32.exe Knhakh32.exe PID 1756 wrote to memory of 3688 1756 Kgninn32.exe Knhakh32.exe PID 3688 wrote to memory of 376 3688 Knhakh32.exe Kqfngd32.exe PID 3688 wrote to memory of 376 3688 Knhakh32.exe Kqfngd32.exe PID 3688 wrote to memory of 376 3688 Knhakh32.exe Kqfngd32.exe PID 376 wrote to memory of 2620 376 Kqfngd32.exe Ljobpiql.exe PID 376 wrote to memory of 2620 376 Kqfngd32.exe Ljobpiql.exe PID 376 wrote to memory of 2620 376 Kqfngd32.exe Ljobpiql.exe PID 2620 wrote to memory of 3764 2620 Ljobpiql.exe Lqikmc32.exe PID 2620 wrote to memory of 3764 2620 Ljobpiql.exe Lqikmc32.exe PID 2620 wrote to memory of 3764 2620 Ljobpiql.exe Lqikmc32.exe PID 3764 wrote to memory of 4376 3764 Lqikmc32.exe Lknojl32.exe PID 3764 wrote to memory of 4376 3764 Lqikmc32.exe Lknojl32.exe PID 3764 wrote to memory of 4376 3764 Lqikmc32.exe Lknojl32.exe PID 4376 wrote to memory of 2896 4376 Lknojl32.exe Lnmkfh32.exe PID 4376 wrote to memory of 2896 4376 Lknojl32.exe Lnmkfh32.exe PID 4376 wrote to memory of 2896 4376 Lknojl32.exe Lnmkfh32.exe PID 2896 wrote to memory of 4932 2896 Lnmkfh32.exe Ldgccb32.exe PID 2896 wrote to memory of 4932 2896 Lnmkfh32.exe Ldgccb32.exe PID 2896 wrote to memory of 4932 2896 Lnmkfh32.exe Ldgccb32.exe PID 4932 wrote to memory of 3140 4932 Ldgccb32.exe Lgepom32.exe PID 4932 wrote to memory of 3140 4932 Ldgccb32.exe Lgepom32.exe PID 4932 wrote to memory of 3140 4932 Ldgccb32.exe Lgepom32.exe PID 3140 wrote to memory of 3220 3140 Lgepom32.exe Lmbhgd32.exe PID 3140 wrote to memory of 3220 3140 Lgepom32.exe Lmbhgd32.exe PID 3140 wrote to memory of 3220 3140 Lgepom32.exe Lmbhgd32.exe PID 3220 wrote to memory of 2756 3220 Lmbhgd32.exe Lkchelci.exe PID 3220 wrote to memory of 2756 3220 Lmbhgd32.exe Lkchelci.exe PID 3220 wrote to memory of 2756 3220 Lmbhgd32.exe Lkchelci.exe PID 2756 wrote to memory of 5100 2756 Lkchelci.exe Ljfhqh32.exe PID 2756 wrote to memory of 5100 2756 Lkchelci.exe Ljfhqh32.exe PID 2756 wrote to memory of 5100 2756 Lkchelci.exe Ljfhqh32.exe PID 5100 wrote to memory of 4772 5100 Ljfhqh32.exe Lgjijmin.exe PID 5100 wrote to memory of 4772 5100 Ljfhqh32.exe Lgjijmin.exe PID 5100 wrote to memory of 4772 5100 Ljfhqh32.exe Lgjijmin.exe PID 4772 wrote to memory of 5092 4772 Lgjijmin.exe Ljhefhha.exe PID 4772 wrote to memory of 5092 4772 Lgjijmin.exe Ljhefhha.exe PID 4772 wrote to memory of 5092 4772 Lgjijmin.exe Ljhefhha.exe PID 5092 wrote to memory of 3284 5092 Ljhefhha.exe Mcqjon32.exe PID 5092 wrote to memory of 3284 5092 Ljhefhha.exe Mcqjon32.exe PID 5092 wrote to memory of 3284 5092 Ljhefhha.exe Mcqjon32.exe PID 3284 wrote to memory of 2708 3284 Mcqjon32.exe Mjkblhfo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe"C:\Users\Admin\AppData\Local\Temp\7d222eeb323ce3d45ad8ac3f12c0b2fb4fc4125f09874883cc4bf1d8dc18f4e4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kggcnoic.exeC:\Windows\system32\Kggcnoic.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kqphfe32.exeC:\Windows\system32\Kqphfe32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kcndbp32.exeC:\Windows\system32\Kcndbp32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kcpahpmd.exeC:\Windows\system32\Kcpahpmd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kglmio32.exeC:\Windows\system32\Kglmio32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kqdaadln.exeC:\Windows\system32\Kqdaadln.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kgninn32.exeC:\Windows\system32\Kgninn32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Knhakh32.exeC:\Windows\system32\Knhakh32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kqfngd32.exeC:\Windows\system32\Kqfngd32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ljobpiql.exeC:\Windows\system32\Ljobpiql.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lqikmc32.exeC:\Windows\system32\Lqikmc32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lknojl32.exeC:\Windows\system32\Lknojl32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lnmkfh32.exeC:\Windows\system32\Lnmkfh32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ldgccb32.exeC:\Windows\system32\Ldgccb32.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lgepom32.exeC:\Windows\system32\Lgepom32.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lmbhgd32.exeC:\Windows\system32\Lmbhgd32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lkchelci.exeC:\Windows\system32\Lkchelci.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ljfhqh32.exeC:\Windows\system32\Ljfhqh32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Lgjijmin.exeC:\Windows\system32\Lgjijmin.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ljhefhha.exeC:\Windows\system32\Ljhefhha.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mcqjon32.exeC:\Windows\system32\Mcqjon32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Mjkblhfo.exeC:\Windows\system32\Mjkblhfo.exe23⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mepfiq32.exeC:\Windows\system32\Mepfiq32.exe24⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Mgobel32.exeC:\Windows\system32\Mgobel32.exe25⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mmkkmc32.exeC:\Windows\system32\Mmkkmc32.exe26⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mebcop32.exeC:\Windows\system32\Mebcop32.exe27⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mkmkkjko.exeC:\Windows\system32\Mkmkkjko.exe28⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Mmnhcb32.exeC:\Windows\system32\Mmnhcb32.exe29⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Meepdp32.exeC:\Windows\system32\Meepdp32.exe30⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Mmpdhboj.exeC:\Windows\system32\Mmpdhboj.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Mjdebfnd.exeC:\Windows\system32\Mjdebfnd.exe32⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Manmoq32.exeC:\Windows\system32\Manmoq32.exe33⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Nghekkmn.exeC:\Windows\system32\Nghekkmn.exe34⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Nmenca32.exeC:\Windows\system32\Nmenca32.exe35⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Napjdpcn.exeC:\Windows\system32\Napjdpcn.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ncofplba.exeC:\Windows\system32\Ncofplba.exe37⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Njinmf32.exeC:\Windows\system32\Njinmf32.exe38⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Nndjndbh.exeC:\Windows\system32\Nndjndbh.exe39⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Ncabfkqo.exeC:\Windows\system32\Ncabfkqo.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Nhmofj32.exeC:\Windows\system32\Nhmofj32.exe41⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Nnfgcd32.exeC:\Windows\system32\Nnfgcd32.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Naecop32.exeC:\Windows\system32\Naecop32.exe43⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Nccokk32.exeC:\Windows\system32\Nccokk32.exe44⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Njmhhefi.exeC:\Windows\system32\Njmhhefi.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Nmlddqem.exeC:\Windows\system32\Nmlddqem.exe46⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Neclenfo.exeC:\Windows\system32\Neclenfo.exe47⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Nlmdbh32.exeC:\Windows\system32\Nlmdbh32.exe48⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Nnkpnclp.exeC:\Windows\system32\Nnkpnclp.exe49⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Najmjokc.exeC:\Windows\system32\Najmjokc.exe50⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Odhifjkg.exeC:\Windows\system32\Odhifjkg.exe51⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Oloahhki.exeC:\Windows\system32\Oloahhki.exe52⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Onnmdcjm.exeC:\Windows\system32\Onnmdcjm.exe53⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Oalipoiq.exeC:\Windows\system32\Oalipoiq.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ohfami32.exeC:\Windows\system32\Ohfami32.exe55⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ojdnid32.exeC:\Windows\system32\Ojdnid32.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Onpjichj.exeC:\Windows\system32\Onpjichj.exe57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Oanfen32.exeC:\Windows\system32\Oanfen32.exe58⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Odmbaj32.exeC:\Windows\system32\Odmbaj32.exe59⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Oldjcg32.exeC:\Windows\system32\Oldjcg32.exe60⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Omegjomb.exeC:\Windows\system32\Omegjomb.exe61⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ohkkhhmh.exeC:\Windows\system32\Ohkkhhmh.exe62⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Oodcdb32.exeC:\Windows\system32\Oodcdb32.exe63⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Odalmibl.exeC:\Windows\system32\Odalmibl.exe64⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Olicnfco.exeC:\Windows\system32\Olicnfco.exe65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Omjpeo32.exeC:\Windows\system32\Omjpeo32.exe66⤵
-
C:\Windows\SysWOW64\Pddhbipj.exeC:\Windows\system32\Pddhbipj.exe67⤵
-
C:\Windows\SysWOW64\Pknqoc32.exeC:\Windows\system32\Pknqoc32.exe68⤵
-
C:\Windows\SysWOW64\Poimpapp.exeC:\Windows\system32\Poimpapp.exe69⤵
-
C:\Windows\SysWOW64\Pecellgl.exeC:\Windows\system32\Pecellgl.exe70⤵
-
C:\Windows\SysWOW64\Phaahggp.exeC:\Windows\system32\Phaahggp.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Poliea32.exeC:\Windows\system32\Poliea32.exe72⤵
-
C:\Windows\SysWOW64\Pajeam32.exeC:\Windows\system32\Pajeam32.exe73⤵
-
C:\Windows\SysWOW64\Pdhbmh32.exeC:\Windows\system32\Pdhbmh32.exe74⤵
-
C:\Windows\SysWOW64\Pkbjjbda.exeC:\Windows\system32\Pkbjjbda.exe75⤵
-
C:\Windows\SysWOW64\Pmaffnce.exeC:\Windows\system32\Pmaffnce.exe76⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Palbgl32.exeC:\Windows\system32\Palbgl32.exe77⤵
-
C:\Windows\SysWOW64\Plbfdekd.exeC:\Windows\system32\Plbfdekd.exe78⤵
-
C:\Windows\SysWOW64\Pmcclm32.exeC:\Windows\system32\Pmcclm32.exe79⤵
-
C:\Windows\SysWOW64\Phigif32.exeC:\Windows\system32\Phigif32.exe80⤵
-
C:\Windows\SysWOW64\Pocpfphe.exeC:\Windows\system32\Pocpfphe.exe81⤵
-
C:\Windows\SysWOW64\Qmepam32.exeC:\Windows\system32\Qmepam32.exe82⤵
-
C:\Windows\SysWOW64\Qemhbj32.exeC:\Windows\system32\Qemhbj32.exe83⤵
-
C:\Windows\SysWOW64\Qkipkani.exeC:\Windows\system32\Qkipkani.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Qmhlgmmm.exeC:\Windows\system32\Qmhlgmmm.exe85⤵
-
C:\Windows\SysWOW64\Qlimed32.exeC:\Windows\system32\Qlimed32.exe86⤵
-
C:\Windows\SysWOW64\Qklmpalf.exeC:\Windows\system32\Qklmpalf.exe87⤵
-
C:\Windows\SysWOW64\Aafemk32.exeC:\Windows\system32\Aafemk32.exe88⤵
-
C:\Windows\SysWOW64\Addaif32.exeC:\Windows\system32\Addaif32.exe89⤵
-
C:\Windows\SysWOW64\Alkijdci.exeC:\Windows\system32\Alkijdci.exe90⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Anmfbl32.exeC:\Windows\system32\Anmfbl32.exe91⤵
-
C:\Windows\SysWOW64\Alnfpcag.exeC:\Windows\system32\Alnfpcag.exe92⤵
-
C:\Windows\SysWOW64\Aolblopj.exeC:\Windows\system32\Aolblopj.exe93⤵
-
C:\Windows\SysWOW64\Aajohjon.exeC:\Windows\system32\Aajohjon.exe94⤵
-
C:\Windows\SysWOW64\Adikdfna.exeC:\Windows\system32\Adikdfna.exe95⤵
-
C:\Windows\SysWOW64\Alpbecod.exeC:\Windows\system32\Alpbecod.exe96⤵
-
C:\Windows\SysWOW64\Anaomkdb.exeC:\Windows\system32\Anaomkdb.exe97⤵
-
C:\Windows\SysWOW64\Aehgnied.exeC:\Windows\system32\Aehgnied.exe98⤵
-
C:\Windows\SysWOW64\Ahgcjddh.exeC:\Windows\system32\Ahgcjddh.exe99⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Akepfpcl.exeC:\Windows\system32\Akepfpcl.exe100⤵
-
C:\Windows\SysWOW64\Anclbkbp.exeC:\Windows\system32\Anclbkbp.exe101⤵
-
C:\Windows\SysWOW64\Aekddhcb.exeC:\Windows\system32\Aekddhcb.exe102⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ahippdbe.exeC:\Windows\system32\Ahippdbe.exe103⤵
-
C:\Windows\SysWOW64\Akglloai.exeC:\Windows\system32\Akglloai.exe104⤵
-
C:\Windows\SysWOW64\Bnfihkqm.exeC:\Windows\system32\Bnfihkqm.exe105⤵
-
C:\Windows\SysWOW64\Baadiiif.exeC:\Windows\system32\Baadiiif.exe106⤵
-
C:\Windows\SysWOW64\Bdpaeehj.exeC:\Windows\system32\Bdpaeehj.exe107⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Blgifbil.exeC:\Windows\system32\Blgifbil.exe108⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Boeebnhp.exeC:\Windows\system32\Boeebnhp.exe109⤵
-
C:\Windows\SysWOW64\Bnhenj32.exeC:\Windows\system32\Bnhenj32.exe110⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Bhnikc32.exeC:\Windows\system32\Bhnikc32.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Blielbfi.exeC:\Windows\system32\Blielbfi.exe112⤵
-
C:\Windows\SysWOW64\Bohbhmfm.exeC:\Windows\system32\Bohbhmfm.exe113⤵
-
C:\Windows\SysWOW64\Bafndi32.exeC:\Windows\system32\Bafndi32.exe114⤵
-
C:\Windows\SysWOW64\Bllbaa32.exeC:\Windows\system32\Bllbaa32.exe115⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Bkobmnka.exeC:\Windows\system32\Bkobmnka.exe116⤵
-
C:\Windows\SysWOW64\Bahkih32.exeC:\Windows\system32\Bahkih32.exe117⤵
-
C:\Windows\SysWOW64\Bhbcfbjk.exeC:\Windows\system32\Bhbcfbjk.exe118⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Bkaobnio.exeC:\Windows\system32\Bkaobnio.exe119⤵
-
C:\Windows\SysWOW64\Bnoknihb.exeC:\Windows\system32\Bnoknihb.exe120⤵
-
C:\Windows\SysWOW64\Bffcpg32.exeC:\Windows\system32\Bffcpg32.exe121⤵
-
C:\Windows\SysWOW64\Bheplb32.exeC:\Windows\system32\Bheplb32.exe122⤵
-
C:\Windows\SysWOW64\Ckclhn32.exeC:\Windows\system32\Ckclhn32.exe123⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Cnahdi32.exeC:\Windows\system32\Cnahdi32.exe124⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Cfipef32.exeC:\Windows\system32\Cfipef32.exe125⤵
-
C:\Windows\SysWOW64\Chglab32.exeC:\Windows\system32\Chglab32.exe126⤵
-
C:\Windows\SysWOW64\Clchbqoo.exeC:\Windows\system32\Clchbqoo.exe127⤵
-
C:\Windows\SysWOW64\Cndeii32.exeC:\Windows\system32\Cndeii32.exe128⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Cdnmfclj.exeC:\Windows\system32\Cdnmfclj.exe129⤵
-
C:\Windows\SysWOW64\Cleegp32.exeC:\Windows\system32\Cleegp32.exe130⤵
-
C:\Windows\SysWOW64\Cnfaohbj.exeC:\Windows\system32\Cnfaohbj.exe131⤵
-
C:\Windows\SysWOW64\Cfnjpfcl.exeC:\Windows\system32\Cfnjpfcl.exe132⤵
-
C:\Windows\SysWOW64\Cdpjlb32.exeC:\Windows\system32\Cdpjlb32.exe133⤵
-
C:\Windows\SysWOW64\Chlflabp.exeC:\Windows\system32\Chlflabp.exe134⤵
-
C:\Windows\SysWOW64\Ckjbhmad.exeC:\Windows\system32\Ckjbhmad.exe135⤵
-
C:\Windows\SysWOW64\Cnindhpg.exeC:\Windows\system32\Cnindhpg.exe136⤵
-
C:\Windows\SysWOW64\Cfpffeaj.exeC:\Windows\system32\Cfpffeaj.exe137⤵
-
C:\Windows\SysWOW64\Chnbbqpn.exeC:\Windows\system32\Chnbbqpn.exe138⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Cljobphg.exeC:\Windows\system32\Cljobphg.exe139⤵
-
C:\Windows\SysWOW64\Cohkokgj.exeC:\Windows\system32\Cohkokgj.exe140⤵
-
C:\Windows\SysWOW64\Cbfgkffn.exeC:\Windows\system32\Cbfgkffn.exe141⤵
-
C:\Windows\SysWOW64\Cdecgbfa.exeC:\Windows\system32\Cdecgbfa.exe142⤵
-
C:\Windows\SysWOW64\Dmlkhofd.exeC:\Windows\system32\Dmlkhofd.exe143⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Dokgdkeh.exeC:\Windows\system32\Dokgdkeh.exe144⤵
-
C:\Windows\SysWOW64\Dnmhpg32.exeC:\Windows\system32\Dnmhpg32.exe145⤵
-
C:\Windows\SysWOW64\Dfdpad32.exeC:\Windows\system32\Dfdpad32.exe146⤵
-
C:\Windows\SysWOW64\Ddgplado.exeC:\Windows\system32\Ddgplado.exe147⤵
-
C:\Windows\SysWOW64\Dmohno32.exeC:\Windows\system32\Dmohno32.exe148⤵
-
C:\Windows\SysWOW64\Domdjj32.exeC:\Windows\system32\Domdjj32.exe149⤵
-
C:\Windows\SysWOW64\Dbkqfe32.exeC:\Windows\system32\Dbkqfe32.exe150⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Dfglfdkb.exeC:\Windows\system32\Dfglfdkb.exe151⤵
-
C:\Windows\SysWOW64\Dheibpje.exeC:\Windows\system32\Dheibpje.exe152⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Dooaoj32.exeC:\Windows\system32\Dooaoj32.exe153⤵
-
C:\Windows\SysWOW64\Dfiildio.exeC:\Windows\system32\Dfiildio.exe154⤵
-
C:\Windows\SysWOW64\Digehphc.exeC:\Windows\system32\Digehphc.exe155⤵
-
C:\Windows\SysWOW64\Dkfadkgf.exeC:\Windows\system32\Dkfadkgf.exe156⤵
-
C:\Windows\SysWOW64\Dndnpf32.exeC:\Windows\system32\Dndnpf32.exe157⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Dflfac32.exeC:\Windows\system32\Dflfac32.exe158⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Dijbno32.exeC:\Windows\system32\Dijbno32.exe159⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dodjjimm.exeC:\Windows\system32\Dodjjimm.exe160⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Dbbffdlq.exeC:\Windows\system32\Dbbffdlq.exe161⤵
-
C:\Windows\SysWOW64\Deqcbpld.exeC:\Windows\system32\Deqcbpld.exe162⤵
-
C:\Windows\SysWOW64\Eiloco32.exeC:\Windows\system32\Eiloco32.exe163⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ekkkoj32.exeC:\Windows\system32\Ekkkoj32.exe164⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Eofgpikj.exeC:\Windows\system32\Eofgpikj.exe165⤵
-
C:\Windows\SysWOW64\Ebdcld32.exeC:\Windows\system32\Ebdcld32.exe166⤵
-
C:\Windows\SysWOW64\Eecphp32.exeC:\Windows\system32\Eecphp32.exe167⤵
-
C:\Windows\SysWOW64\Ekmhejao.exeC:\Windows\system32\Ekmhejao.exe168⤵
-
C:\Windows\SysWOW64\Enkdaepb.exeC:\Windows\system32\Enkdaepb.exe169⤵
-
C:\Windows\SysWOW64\Efblbbqd.exeC:\Windows\system32\Efblbbqd.exe170⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Eeelnp32.exeC:\Windows\system32\Eeelnp32.exe171⤵
-
C:\Windows\SysWOW64\Emmdom32.exeC:\Windows\system32\Emmdom32.exe172⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Eokqkh32.exeC:\Windows\system32\Eokqkh32.exe173⤵
-
C:\Windows\SysWOW64\Ebimgcfi.exeC:\Windows\system32\Ebimgcfi.exe174⤵
-
C:\Windows\SysWOW64\Eehicoel.exeC:\Windows\system32\Eehicoel.exe175⤵
-
C:\Windows\SysWOW64\Emoadlfo.exeC:\Windows\system32\Emoadlfo.exe176⤵
-
C:\Windows\SysWOW64\Epmmqheb.exeC:\Windows\system32\Epmmqheb.exe177⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Enpmld32.exeC:\Windows\system32\Enpmld32.exe178⤵
-
C:\Windows\SysWOW64\Efgemb32.exeC:\Windows\system32\Efgemb32.exe179⤵
-
C:\Windows\SysWOW64\Eifaim32.exeC:\Windows\system32\Eifaim32.exe180⤵
-
C:\Windows\SysWOW64\Emanjldl.exeC:\Windows\system32\Emanjldl.exe181⤵
-
C:\Windows\SysWOW64\Enbjad32.exeC:\Windows\system32\Enbjad32.exe182⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ebnfbcbc.exeC:\Windows\system32\Ebnfbcbc.exe183⤵
-
C:\Windows\SysWOW64\Felbnn32.exeC:\Windows\system32\Felbnn32.exe184⤵
-
C:\Windows\SysWOW64\Fmcjpl32.exeC:\Windows\system32\Fmcjpl32.exe185⤵
-
C:\Windows\SysWOW64\Flfkkhid.exeC:\Windows\system32\Flfkkhid.exe186⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fneggdhg.exeC:\Windows\system32\Fneggdhg.exe187⤵
-
C:\Windows\SysWOW64\Fflohaij.exeC:\Windows\system32\Fflohaij.exe188⤵
-
C:\Windows\SysWOW64\Fijkdmhn.exeC:\Windows\system32\Fijkdmhn.exe189⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Fligqhga.exeC:\Windows\system32\Fligqhga.exe190⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Fngcmcfe.exeC:\Windows\system32\Fngcmcfe.exe191⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fbbpmb32.exeC:\Windows\system32\Fbbpmb32.exe192⤵
-
C:\Windows\SysWOW64\Fealin32.exeC:\Windows\system32\Fealin32.exe193⤵
-
C:\Windows\SysWOW64\Fmhdkknd.exeC:\Windows\system32\Fmhdkknd.exe194⤵
-
C:\Windows\SysWOW64\Fpgpgfmh.exeC:\Windows\system32\Fpgpgfmh.exe195⤵
-
C:\Windows\SysWOW64\Fnipbc32.exeC:\Windows\system32\Fnipbc32.exe196⤵
-
C:\Windows\SysWOW64\Ffqhcq32.exeC:\Windows\system32\Ffqhcq32.exe197⤵
-
C:\Windows\SysWOW64\Fechomko.exeC:\Windows\system32\Fechomko.exe198⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fmkqpkla.exeC:\Windows\system32\Fmkqpkla.exe199⤵
-
C:\Windows\SysWOW64\Fpimlfke.exeC:\Windows\system32\Fpimlfke.exe200⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Fnlmhc32.exeC:\Windows\system32\Fnlmhc32.exe201⤵
-
C:\Windows\SysWOW64\Ffceip32.exeC:\Windows\system32\Ffceip32.exe202⤵
-
C:\Windows\SysWOW64\Fiaael32.exeC:\Windows\system32\Fiaael32.exe203⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fmmmfj32.exeC:\Windows\system32\Fmmmfj32.exe204⤵
-
C:\Windows\SysWOW64\Fpkibf32.exeC:\Windows\system32\Fpkibf32.exe205⤵
-
C:\Windows\SysWOW64\Fnnjmbpm.exeC:\Windows\system32\Fnnjmbpm.exe206⤵
-
C:\Windows\SysWOW64\Gfeaopqo.exeC:\Windows\system32\Gfeaopqo.exe207⤵
-
C:\Windows\SysWOW64\Gehbjm32.exeC:\Windows\system32\Gehbjm32.exe208⤵
-
C:\Windows\SysWOW64\Gpnfge32.exeC:\Windows\system32\Gpnfge32.exe209⤵
-
C:\Windows\SysWOW64\Gnqfcbnj.exeC:\Windows\system32\Gnqfcbnj.exe210⤵
-
C:\Windows\SysWOW64\Gfhndpol.exeC:\Windows\system32\Gfhndpol.exe211⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Gifkpknp.exeC:\Windows\system32\Gifkpknp.exe212⤵
-
C:\Windows\SysWOW64\Gmafajfi.exeC:\Windows\system32\Gmafajfi.exe213⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Gncchb32.exeC:\Windows\system32\Gncchb32.exe214⤵
-
C:\Windows\SysWOW64\Gbnoiqdq.exeC:\Windows\system32\Gbnoiqdq.exe215⤵
-
C:\Windows\SysWOW64\Gemkelcd.exeC:\Windows\system32\Gemkelcd.exe216⤵
-
C:\Windows\SysWOW64\Gihgfk32.exeC:\Windows\system32\Gihgfk32.exe217⤵
-
C:\Windows\SysWOW64\Gmdcfidg.exeC:\Windows\system32\Gmdcfidg.exe218⤵
-
C:\Windows\SysWOW64\Gpbpbecj.exeC:\Windows\system32\Gpbpbecj.exe219⤵
-
C:\Windows\SysWOW64\Gnepna32.exeC:\Windows\system32\Gnepna32.exe220⤵
-
C:\Windows\SysWOW64\Gflhoo32.exeC:\Windows\system32\Gflhoo32.exe221⤵
-
C:\Windows\SysWOW64\Gikdkj32.exeC:\Windows\system32\Gikdkj32.exe222⤵
-
C:\Windows\SysWOW64\Gmfplibd.exeC:\Windows\system32\Gmfplibd.exe223⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gpelhd32.exeC:\Windows\system32\Gpelhd32.exe224⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Goglcahb.exeC:\Windows\system32\Goglcahb.exe225⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Gfodeohd.exeC:\Windows\system32\Gfodeohd.exe226⤵
-
C:\Windows\SysWOW64\Geaepk32.exeC:\Windows\system32\Geaepk32.exe227⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gmimai32.exeC:\Windows\system32\Gmimai32.exe228⤵
-
C:\Windows\SysWOW64\Glkmmefl.exeC:\Windows\system32\Glkmmefl.exe229⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gojiiafp.exeC:\Windows\system32\Gojiiafp.exe230⤵
-
C:\Windows\SysWOW64\Gbeejp32.exeC:\Windows\system32\Gbeejp32.exe231⤵
-
C:\Windows\SysWOW64\Hedafk32.exeC:\Windows\system32\Hedafk32.exe232⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hmkigh32.exeC:\Windows\system32\Hmkigh32.exe233⤵
-
C:\Windows\SysWOW64\Hpiecd32.exeC:\Windows\system32\Hpiecd32.exe234⤵
-
C:\Windows\SysWOW64\Hbhboolf.exeC:\Windows\system32\Hbhboolf.exe235⤵
-
C:\Windows\SysWOW64\Hefnkkkj.exeC:\Windows\system32\Hefnkkkj.exe236⤵
-
C:\Windows\SysWOW64\Hibjli32.exeC:\Windows\system32\Hibjli32.exe237⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hlpfhe32.exeC:\Windows\system32\Hlpfhe32.exe238⤵
-
C:\Windows\SysWOW64\Hoobdp32.exeC:\Windows\system32\Hoobdp32.exe239⤵
-
C:\Windows\SysWOW64\Hffken32.exeC:\Windows\system32\Hffken32.exe240⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Hehkajig.exeC:\Windows\system32\Hehkajig.exe241⤵