Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 21:11
Static task
static1
Behavioral task
behavioral1
Sample
35714b0066891fe0268db13d97cd779dbf791c9a38febdc241eaf94b5bab2184.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
35714b0066891fe0268db13d97cd779dbf791c9a38febdc241eaf94b5bab2184.exe
Resource
win10v2004-20240709-en
General
-
Target
35714b0066891fe0268db13d97cd779dbf791c9a38febdc241eaf94b5bab2184.exe
-
Size
95KB
-
MD5
7ad6d10780451979ef202a9348275a47
-
SHA1
b827c3ca662e6d0cfa1e677e4d81b6d161edc86d
-
SHA256
35714b0066891fe0268db13d97cd779dbf791c9a38febdc241eaf94b5bab2184
-
SHA512
c614cc538123640141c9d63b7e334f1dfc0c57d9614b51e909a8ca0ee384227efcc70c37084abe19f4c37a0983deba7244f0e505f8e8286c3571f1c86291735b
-
SSDEEP
1536:5yd3Xv6NKBYL54vR2RYch1fqcEK4M5HCUW0yVbRCzLIpplHf3yMOM6bOLXi8PmC/:5yRiwSN44+ch1fqc/PiUW0y10zMTpPys
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Nigldq32.exeOekmceaf.exeGkpakq32.exeNmhqokcq.exeFllaopcg.exeLhlbbg32.exeNaimepkp.exeNgcanq32.exeBjembh32.exeJnemfa32.exeQdlipplq.exeEelgcg32.exeLpfnckhe.exeMiocmq32.exeAljjjb32.exeLidilk32.exeHilgfe32.exeIjnnao32.exeNfglfdeb.exeBklpjlmc.exeKckjmpko.exeLjeoimeg.exeMmkafhnb.exeOqennbbl.exeBdaabk32.exeEmhnqbjo.exeAoomflpd.exeKmklak32.exeMifkfhpa.exeLolofd32.exeHdbbnd32.exeDfniee32.exeMfmqmgbm.exeHjggap32.exeJdidmf32.exeMghfdcdi.exeMpkjgckc.exeAhchdb32.exeImmjnj32.exeCdkkcp32.exeCojeomee.exeKcajceke.exeCgdciiod.exeHljaigmo.exeJjpgfbom.exeIejkhlip.exeBjngbihn.exeHibgkjee.exeDnhefh32.exePjjkfe32.exeBpjnmlel.exeEgmbnkie.exeMoeeelhn.exeBgddam32.exeClilmbhd.exeIkapdqoc.exeEfmckpko.exeFpokjd32.exeIcfbkded.exeCjoilfek.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nigldq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oekmceaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gkpakq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nmhqokcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fllaopcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lhlbbg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Naimepkp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngcanq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjembh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jnemfa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qdlipplq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eelgcg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lpfnckhe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Miocmq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aljjjb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lidilk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hilgfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ijnnao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nfglfdeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bklpjlmc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kckjmpko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ljeoimeg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmkafhnb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oqennbbl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdaabk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Emhnqbjo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aoomflpd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmklak32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mifkfhpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lolofd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hdbbnd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dfniee32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mfmqmgbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hjggap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jdidmf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mghfdcdi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mpkjgckc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahchdb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Immjnj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdkkcp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cojeomee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kcajceke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cgdciiod.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hljaigmo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijnnao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jjpgfbom.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iejkhlip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kmklak32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjngbihn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hibgkjee.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnhefh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pjjkfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bpjnmlel.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljeoimeg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Egmbnkie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Moeeelhn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bgddam32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Clilmbhd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ikapdqoc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efmckpko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fpokjd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Icfbkded.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ngcanq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cjoilfek.exe -
Executes dropped EXE 64 IoCs
Processes:
Ldbaopdj.exeLafahdcc.exeMdgkjopd.exeMnpobefe.exeMghckj32.exeMpphdpcf.exeMfmqmgbm.exeMoeeelhn.exeMgmmfjip.exeMhninb32.exeNfbjhf32.exeNkobpmlo.exeNmnojp32.exeNomkfk32.exeNghpjn32.exeNnahgh32.exeNigldq32.exeNndemg32.exeOqennbbl.exeOninhgae.exeOcefpnom.exeOmnkicen.exeOffpbi32.exeOielnd32.exeOcjpkm32.exeOekmceaf.exeOleepo32.exePiieicgl.exePepfnd32.exePbdfgilj.exePdecoa32.exePnkglj32.exePjahakgb.exePmpdmfff.exeQmbqcf32.exeQdlipplq.exeAljjjb32.exeAbfoll32.exeAhchdb32.exeAompambg.exeAoomflpd.exeAdleoc32.exeBapfhg32.exeBgmnpn32.exeBngfmhbj.exeBccoeo32.exeBjngbihn.exeBphooc32.exeBgahkngh.exeBpjldc32.exeBgddam32.exeBjbqmi32.exeBplijcle.exeBaneak32.exeBjembh32.exeCkfjjqhd.exeCfknhi32.exeCkhfpp32.exeCfnkmi32.exeChlgid32.exeCofofolh.exeChocodch.exeCnklgkap.exeDkmljcdh.exepid process 3036 Ldbaopdj.exe 2120 Lafahdcc.exe 2704 Mdgkjopd.exe 2772 Mnpobefe.exe 2664 Mghckj32.exe 2540 Mpphdpcf.exe 2984 Mfmqmgbm.exe 568 Moeeelhn.exe 1708 Mgmmfjip.exe 1828 Mhninb32.exe 2740 Nfbjhf32.exe 2216 Nkobpmlo.exe 1204 Nmnojp32.exe 2304 Nomkfk32.exe 1220 Nghpjn32.exe 2068 Nnahgh32.exe 572 Nigldq32.exe 832 Nndemg32.exe 1360 Oqennbbl.exe 732 Oninhgae.exe 2128 Ocefpnom.exe 1032 Omnkicen.exe 2368 Offpbi32.exe 684 Oielnd32.exe 2888 Ocjpkm32.exe 2952 Oekmceaf.exe 1700 Oleepo32.exe 3024 Piieicgl.exe 1804 Pepfnd32.exe 2760 Pbdfgilj.exe 2548 Pdecoa32.exe 2996 Pnkglj32.exe 2720 Pjahakgb.exe 1904 Pmpdmfff.exe 1668 Qmbqcf32.exe 2824 Qdlipplq.exe 808 Aljjjb32.exe 1496 Abfoll32.exe 2588 Ahchdb32.exe 1920 Aompambg.exe 2364 Aoomflpd.exe 1308 Adleoc32.exe 1844 Bapfhg32.exe 1288 Bgmnpn32.exe 796 Bngfmhbj.exe 3060 Bccoeo32.exe 288 Bjngbihn.exe 948 Bphooc32.exe 1732 Bgahkngh.exe 328 Bpjldc32.exe 2700 Bgddam32.exe 2900 Bjbqmi32.exe 2440 Bplijcle.exe 2568 Baneak32.exe 1296 Bjembh32.exe 3048 Ckfjjqhd.exe 2636 Cfknhi32.exe 2676 Ckhfpp32.exe 2512 Cfnkmi32.exe 432 Chlgid32.exe 1960 Cofofolh.exe 2656 Chocodch.exe 932 Cnklgkap.exe 1532 Dkmljcdh.exe -
Loads dropped DLL 64 IoCs
Processes:
35714b0066891fe0268db13d97cd779dbf791c9a38febdc241eaf94b5bab2184.exeLdbaopdj.exeLafahdcc.exeMdgkjopd.exeMnpobefe.exeMghckj32.exeMpphdpcf.exeMfmqmgbm.exeMoeeelhn.exeMgmmfjip.exeMhninb32.exeNfbjhf32.exeNkobpmlo.exeNmnojp32.exeNomkfk32.exeNghpjn32.exeNnahgh32.exeNigldq32.exeNndemg32.exeOqennbbl.exeOninhgae.exeOcefpnom.exeOmnkicen.exeOffpbi32.exeOielnd32.exeOcjpkm32.exeOekmceaf.exeOleepo32.exePiieicgl.exePepfnd32.exePbdfgilj.exePdecoa32.exepid process 2376 35714b0066891fe0268db13d97cd779dbf791c9a38febdc241eaf94b5bab2184.exe 2376 35714b0066891fe0268db13d97cd779dbf791c9a38febdc241eaf94b5bab2184.exe 3036 Ldbaopdj.exe 3036 Ldbaopdj.exe 2120 Lafahdcc.exe 2120 Lafahdcc.exe 2704 Mdgkjopd.exe 2704 Mdgkjopd.exe 2772 Mnpobefe.exe 2772 Mnpobefe.exe 2664 Mghckj32.exe 2664 Mghckj32.exe 2540 Mpphdpcf.exe 2540 Mpphdpcf.exe 2984 Mfmqmgbm.exe 2984 Mfmqmgbm.exe 568 Moeeelhn.exe 568 Moeeelhn.exe 1708 Mgmmfjip.exe 1708 Mgmmfjip.exe 1828 Mhninb32.exe 1828 Mhninb32.exe 2740 Nfbjhf32.exe 2740 Nfbjhf32.exe 2216 Nkobpmlo.exe 2216 Nkobpmlo.exe 1204 Nmnojp32.exe 1204 Nmnojp32.exe 2304 Nomkfk32.exe 2304 Nomkfk32.exe 1220 Nghpjn32.exe 1220 Nghpjn32.exe 2068 Nnahgh32.exe 2068 Nnahgh32.exe 572 Nigldq32.exe 572 Nigldq32.exe 832 Nndemg32.exe 832 Nndemg32.exe 1360 Oqennbbl.exe 1360 Oqennbbl.exe 732 Oninhgae.exe 732 Oninhgae.exe 2128 Ocefpnom.exe 2128 Ocefpnom.exe 1032 Omnkicen.exe 1032 Omnkicen.exe 2368 Offpbi32.exe 2368 Offpbi32.exe 684 Oielnd32.exe 684 Oielnd32.exe 2888 Ocjpkm32.exe 2888 Ocjpkm32.exe 2952 Oekmceaf.exe 2952 Oekmceaf.exe 1700 Oleepo32.exe 1700 Oleepo32.exe 3024 Piieicgl.exe 3024 Piieicgl.exe 1804 Pepfnd32.exe 1804 Pepfnd32.exe 2760 Pbdfgilj.exe 2760 Pbdfgilj.exe 2548 Pdecoa32.exe 2548 Pdecoa32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Lcncbc32.exeNghpjn32.exePjahakgb.exeGhidcceo.exeCenmfbml.exeEjdfqogm.exeNfglfdeb.exeEqkjmcmq.exeKpgdnp32.exeDcbjni32.exeLafahdcc.exeQaablcej.exeNinhamne.exeBpjnmlel.exeKlhbdclg.exeNkdndeon.exeClfhml32.exeOffpbi32.exeImmjnj32.exeJkdcdf32.exePjjkfe32.exeHilgfe32.exeNmhqokcq.exeHpcpdfhj.exeLiblfl32.exeMdlfngcc.exeEmhnqbjo.exeEpkepakn.exeMdepmh32.exeGjljij32.exeBmjekahk.exeEqopfbfn.exeGmlablaa.exeIkagogco.exeCbjnqh32.exeIklfia32.exeNhnemdbf.exePdecoa32.exeIjnnao32.exeHmijajbd.exeEmjjfb32.exeNmnojp32.exeHdjoii32.exeHlmphp32.exeBbfnchfb.exeOqennbbl.exeEphdjeol.exeBhkghqpb.exeEgmbnkie.exeNickoldp.exeFfbmfo32.exeJnemfa32.exeGncgbkki.exeDodahk32.exeAbfoll32.exeBjbqmi32.exeBeadgdli.exeDlpbna32.exeJkfpjf32.exeJpmooind.exedescription ioc process File created C:\Windows\SysWOW64\Olbkimdk.dll Lcncbc32.exe File created C:\Windows\SysWOW64\Ohopde32.dll Nghpjn32.exe File opened for modification C:\Windows\SysWOW64\Pmpdmfff.exe Pjahakgb.exe File created C:\Windows\SysWOW64\Habili32.exe Ghidcceo.exe File opened for modification C:\Windows\SysWOW64\Cofaog32.exe Cenmfbml.exe File opened for modification C:\Windows\SysWOW64\Eannmi32.exe Ejdfqogm.exe File opened for modification C:\Windows\SysWOW64\Nggipg32.exe Nfglfdeb.exe File created C:\Windows\SysWOW64\Eifobe32.exe Eqkjmcmq.exe File opened for modification C:\Windows\SysWOW64\Kecmfg32.exe Kpgdnp32.exe File opened for modification C:\Windows\SysWOW64\Dhobgp32.exe Dcbjni32.exe File created C:\Windows\SysWOW64\Ocpbal32.dll Lafahdcc.exe File opened for modification C:\Windows\SysWOW64\Amhcad32.exe Qaablcej.exe File opened for modification C:\Windows\SysWOW64\Naimepkp.exe Ninhamne.exe File created C:\Windows\SysWOW64\Edalmn32.dll Bpjnmlel.exe File created C:\Windows\SysWOW64\Gjhjgq32.dll Klhbdclg.exe File created C:\Windows\SysWOW64\Diggcodj.dll Nkdndeon.exe File created C:\Windows\SysWOW64\Hlilhb32.dll Clfhml32.exe File opened for modification C:\Windows\SysWOW64\Oielnd32.exe Offpbi32.exe File created C:\Windows\SysWOW64\Icfbkded.exe Immjnj32.exe File created C:\Windows\SysWOW64\Jkfpjf32.exe Jkdcdf32.exe File created C:\Windows\SysWOW64\Kbbinm32.dll Pjjkfe32.exe File created C:\Windows\SysWOW64\Jqkelimm.dll Hilgfe32.exe File opened for modification C:\Windows\SysWOW64\Ndbile32.exe Nmhqokcq.exe File created C:\Windows\SysWOW64\Oebblmoe.dll Hpcpdfhj.exe File created C:\Windows\SysWOW64\Lchqcd32.exe Liblfl32.exe File opened for modification C:\Windows\SysWOW64\Mlgkbi32.exe Mdlfngcc.exe File created C:\Windows\SysWOW64\Egmbnkie.exe Emhnqbjo.exe File opened for modification C:\Windows\SysWOW64\Eegmhhie.exe Epkepakn.exe File created C:\Windows\SysWOW64\Monmegdp.dll Mdepmh32.exe File opened for modification C:\Windows\SysWOW64\Gaebfdba.exe Gjljij32.exe File created C:\Windows\SysWOW64\Flffpf32.dll Bmjekahk.exe File created C:\Windows\SysWOW64\Mqobfajn.dll Eqopfbfn.exe File opened for modification C:\Windows\SysWOW64\Ghaeoe32.exe Gmlablaa.exe File created C:\Windows\SysWOW64\Fnejdq32.dll Ikagogco.exe File created C:\Windows\SysWOW64\Dlpbna32.exe Cbjnqh32.exe File opened for modification C:\Windows\SysWOW64\Ifbkgj32.exe Iklfia32.exe File created C:\Windows\SysWOW64\Dfpnca32.dll Nhnemdbf.exe File created C:\Windows\SysWOW64\Ldknflmi.dll Pdecoa32.exe File opened for modification C:\Windows\SysWOW64\Immjnj32.exe Ijnnao32.exe File created C:\Windows\SysWOW64\Hdbbnd32.exe Hmijajbd.exe File opened for modification C:\Windows\SysWOW64\Fiakkcma.exe Emjjfb32.exe File opened for modification C:\Windows\SysWOW64\Nomkfk32.exe Nmnojp32.exe File created C:\Windows\SysWOW64\Aaknah32.dll Hdjoii32.exe File opened for modification C:\Windows\SysWOW64\Hdhdlbpk.exe Hlmphp32.exe File created C:\Windows\SysWOW64\Bpjnmlel.exe Bbfnchfb.exe File created C:\Windows\SysWOW64\Bqfbdfga.dll Oqennbbl.exe File created C:\Windows\SysWOW64\Ficfbkij.dll Ejdfqogm.exe File opened for modification C:\Windows\SysWOW64\Ffbmfo32.exe Ephdjeol.exe File created C:\Windows\SysWOW64\Bbqkeioh.exe Bhkghqpb.exe File opened for modification C:\Windows\SysWOW64\Nhhominh.exe Nkdndeon.exe File created C:\Windows\SysWOW64\Pnhmjpmg.dll Egmbnkie.exe File created C:\Windows\SysWOW64\Nlbgkgcc.exe Nickoldp.exe File created C:\Windows\SysWOW64\Mdgkjopd.exe Lafahdcc.exe File opened for modification C:\Windows\SysWOW64\Nnahgh32.exe Nghpjn32.exe File created C:\Windows\SysWOW64\Fiqibj32.exe Ffbmfo32.exe File created C:\Windows\SysWOW64\Jijacjnc.exe Jnemfa32.exe File created C:\Windows\SysWOW64\Gcppkbia.exe Gncgbkki.exe File created C:\Windows\SysWOW64\Dfniee32.exe Dodahk32.exe File created C:\Windows\SysWOW64\Pcdbhb32.dll Abfoll32.exe File created C:\Windows\SysWOW64\Bplijcle.exe Bjbqmi32.exe File created C:\Windows\SysWOW64\Bknmok32.exe Beadgdli.exe File opened for modification C:\Windows\SysWOW64\Dbmkfh32.exe Dlpbna32.exe File opened for modification C:\Windows\SysWOW64\Jnemfa32.exe Jkfpjf32.exe File created C:\Windows\SysWOW64\Mnbdeb32.dll Jpmooind.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2584 4372 WerFault.exe Opblgehg.exe -
Modifies registry class 64 IoCs
Processes:
Nhhominh.exeMfmqmgbm.exeEelgcg32.exeCdkkcp32.exeBpjldc32.exeBklpjlmc.exeHhcndhap.exeIcdeee32.exeHbpbck32.exeOgdhik32.exeHhlaiccm.exeIeeqpi32.exeKpgdnp32.exeNhnemdbf.exeBngfmhbj.exeIgmepdbc.exeIcfbkded.exeEegmhhie.exePehebbbh.exeMlgkbi32.exePcdldknm.exeOqepgk32.exeDnqhkcdo.exeDpmgao32.exeEcoihm32.exeJhfjadim.exeKflcok32.exeMifkfhpa.exeNfglfdeb.exeJjmcfl32.exeNinhamne.exeIhpgce32.exeJkopndcb.exeEannmi32.exeBlniinac.exeGdcfoq32.exePiieicgl.exeBccoeo32.exeBgahkngh.exeFpmpnmck.exeGmamfddp.exePnkglj32.exeJecnnk32.exeKcajceke.exeDflmpebj.exeIcdhnn32.exeOggeokoq.exeGoapjnoo.exeLchqcd32.exeEphdjeol.exeJkdcdf32.exeJijacjnc.exeCgdciiod.exeFpbihl32.exeOffpbi32.exeAompambg.exeEjdfqogm.exeKecmfg32.exeLljkif32.exeNchipb32.exeBdaabk32.exeDckcnj32.exeLmeebpkd.exeDlpbna32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nhhominh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mfmqmgbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Eelgcg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cdkkcp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bpjldc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bklpjlmc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hhcndhap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Icdeee32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hbpbck32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ogdhik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckobac32.dll" Hhlaiccm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eljgid32.dll" Ieeqpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kpgdnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nhnemdbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bngfmhbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbgclj32.dll" Igmepdbc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Icfbkded.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eegmhhie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pehebbbh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mlgkbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pcdldknm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oqepgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmddhe32.dll" Dnqhkcdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dpmgao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ecoihm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlgfkmph.dll" Jhfjadim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdfipdll.dll" Kflcok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mifkfhpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nfglfdeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oonmbkfe.dll" Jjmcfl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ninhamne.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Melmmmif.dll" Ihpgce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jkopndcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Eannmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmmlmc32.dll" Blniinac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chobmj32.dll" Gdcfoq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Piieicgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bccoeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iokhldhb.dll" Bgahkngh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fpmpnmck.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gmamfddp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pnkglj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jecnnk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jqnocncd.dll" Kcajceke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgdiqn32.dll" Dflmpebj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpclfokl.dll" Icdhnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oggeokoq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Goapjnoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njldiiel.dll" Lchqcd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ephdjeol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnhjppcf.dll" Jkdcdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amoaeb32.dll" Jijacjnc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cgdciiod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpfbjp32.dll" Fpbihl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aaaqjc32.dll" Offpbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aompambg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ficfbkij.dll" Ejdfqogm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kecmfg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lljkif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nchipb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bdaabk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkfapl32.dll" Dckcnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njdfnb32.dll" Lmeebpkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnbppmob.dll" Dlpbna32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
35714b0066891fe0268db13d97cd779dbf791c9a38febdc241eaf94b5bab2184.exeLdbaopdj.exeLafahdcc.exeMdgkjopd.exeMnpobefe.exeMghckj32.exeMpphdpcf.exeMfmqmgbm.exeMoeeelhn.exeMgmmfjip.exeMhninb32.exeNfbjhf32.exeNkobpmlo.exeNmnojp32.exeNomkfk32.exeNghpjn32.exedescription pid process target process PID 2376 wrote to memory of 3036 2376 35714b0066891fe0268db13d97cd779dbf791c9a38febdc241eaf94b5bab2184.exe Ldbaopdj.exe PID 2376 wrote to memory of 3036 2376 35714b0066891fe0268db13d97cd779dbf791c9a38febdc241eaf94b5bab2184.exe Ldbaopdj.exe PID 2376 wrote to memory of 3036 2376 35714b0066891fe0268db13d97cd779dbf791c9a38febdc241eaf94b5bab2184.exe Ldbaopdj.exe PID 2376 wrote to memory of 3036 2376 35714b0066891fe0268db13d97cd779dbf791c9a38febdc241eaf94b5bab2184.exe Ldbaopdj.exe PID 3036 wrote to memory of 2120 3036 Ldbaopdj.exe Lafahdcc.exe PID 3036 wrote to memory of 2120 3036 Ldbaopdj.exe Lafahdcc.exe PID 3036 wrote to memory of 2120 3036 Ldbaopdj.exe Lafahdcc.exe PID 3036 wrote to memory of 2120 3036 Ldbaopdj.exe Lafahdcc.exe PID 2120 wrote to memory of 2704 2120 Lafahdcc.exe Mdgkjopd.exe PID 2120 wrote to memory of 2704 2120 Lafahdcc.exe Mdgkjopd.exe PID 2120 wrote to memory of 2704 2120 Lafahdcc.exe Mdgkjopd.exe PID 2120 wrote to memory of 2704 2120 Lafahdcc.exe Mdgkjopd.exe PID 2704 wrote to memory of 2772 2704 Mdgkjopd.exe Mnpobefe.exe PID 2704 wrote to memory of 2772 2704 Mdgkjopd.exe Mnpobefe.exe PID 2704 wrote to memory of 2772 2704 Mdgkjopd.exe Mnpobefe.exe PID 2704 wrote to memory of 2772 2704 Mdgkjopd.exe Mnpobefe.exe PID 2772 wrote to memory of 2664 2772 Mnpobefe.exe Mghckj32.exe PID 2772 wrote to memory of 2664 2772 Mnpobefe.exe Mghckj32.exe PID 2772 wrote to memory of 2664 2772 Mnpobefe.exe Mghckj32.exe PID 2772 wrote to memory of 2664 2772 Mnpobefe.exe Mghckj32.exe PID 2664 wrote to memory of 2540 2664 Mghckj32.exe Mpphdpcf.exe PID 2664 wrote to memory of 2540 2664 Mghckj32.exe Mpphdpcf.exe PID 2664 wrote to memory of 2540 2664 Mghckj32.exe Mpphdpcf.exe PID 2664 wrote to memory of 2540 2664 Mghckj32.exe Mpphdpcf.exe PID 2540 wrote to memory of 2984 2540 Mpphdpcf.exe Mfmqmgbm.exe PID 2540 wrote to memory of 2984 2540 Mpphdpcf.exe Mfmqmgbm.exe PID 2540 wrote to memory of 2984 2540 Mpphdpcf.exe Mfmqmgbm.exe PID 2540 wrote to memory of 2984 2540 Mpphdpcf.exe Mfmqmgbm.exe PID 2984 wrote to memory of 568 2984 Mfmqmgbm.exe Moeeelhn.exe PID 2984 wrote to memory of 568 2984 Mfmqmgbm.exe Moeeelhn.exe PID 2984 wrote to memory of 568 2984 Mfmqmgbm.exe Moeeelhn.exe PID 2984 wrote to memory of 568 2984 Mfmqmgbm.exe Moeeelhn.exe PID 568 wrote to memory of 1708 568 Moeeelhn.exe Mgmmfjip.exe PID 568 wrote to memory of 1708 568 Moeeelhn.exe Mgmmfjip.exe PID 568 wrote to memory of 1708 568 Moeeelhn.exe Mgmmfjip.exe PID 568 wrote to memory of 1708 568 Moeeelhn.exe Mgmmfjip.exe PID 1708 wrote to memory of 1828 1708 Mgmmfjip.exe Mhninb32.exe PID 1708 wrote to memory of 1828 1708 Mgmmfjip.exe Mhninb32.exe PID 1708 wrote to memory of 1828 1708 Mgmmfjip.exe Mhninb32.exe PID 1708 wrote to memory of 1828 1708 Mgmmfjip.exe Mhninb32.exe PID 1828 wrote to memory of 2740 1828 Mhninb32.exe Nfbjhf32.exe PID 1828 wrote to memory of 2740 1828 Mhninb32.exe Nfbjhf32.exe PID 1828 wrote to memory of 2740 1828 Mhninb32.exe Nfbjhf32.exe PID 1828 wrote to memory of 2740 1828 Mhninb32.exe Nfbjhf32.exe PID 2740 wrote to memory of 2216 2740 Nfbjhf32.exe Nkobpmlo.exe PID 2740 wrote to memory of 2216 2740 Nfbjhf32.exe Nkobpmlo.exe PID 2740 wrote to memory of 2216 2740 Nfbjhf32.exe Nkobpmlo.exe PID 2740 wrote to memory of 2216 2740 Nfbjhf32.exe Nkobpmlo.exe PID 2216 wrote to memory of 1204 2216 Nkobpmlo.exe Nmnojp32.exe PID 2216 wrote to memory of 1204 2216 Nkobpmlo.exe Nmnojp32.exe PID 2216 wrote to memory of 1204 2216 Nkobpmlo.exe Nmnojp32.exe PID 2216 wrote to memory of 1204 2216 Nkobpmlo.exe Nmnojp32.exe PID 1204 wrote to memory of 2304 1204 Nmnojp32.exe Nomkfk32.exe PID 1204 wrote to memory of 2304 1204 Nmnojp32.exe Nomkfk32.exe PID 1204 wrote to memory of 2304 1204 Nmnojp32.exe Nomkfk32.exe PID 1204 wrote to memory of 2304 1204 Nmnojp32.exe Nomkfk32.exe PID 2304 wrote to memory of 1220 2304 Nomkfk32.exe Nghpjn32.exe PID 2304 wrote to memory of 1220 2304 Nomkfk32.exe Nghpjn32.exe PID 2304 wrote to memory of 1220 2304 Nomkfk32.exe Nghpjn32.exe PID 2304 wrote to memory of 1220 2304 Nomkfk32.exe Nghpjn32.exe PID 1220 wrote to memory of 2068 1220 Nghpjn32.exe Nnahgh32.exe PID 1220 wrote to memory of 2068 1220 Nghpjn32.exe Nnahgh32.exe PID 1220 wrote to memory of 2068 1220 Nghpjn32.exe Nnahgh32.exe PID 1220 wrote to memory of 2068 1220 Nghpjn32.exe Nnahgh32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35714b0066891fe0268db13d97cd779dbf791c9a38febdc241eaf94b5bab2184.exe"C:\Users\Admin\AppData\Local\Temp\35714b0066891fe0268db13d97cd779dbf791c9a38febdc241eaf94b5bab2184.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\Ldbaopdj.exeC:\Windows\system32\Ldbaopdj.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\Lafahdcc.exeC:\Windows\system32\Lafahdcc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\Mdgkjopd.exeC:\Windows\system32\Mdgkjopd.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\Mnpobefe.exeC:\Windows\system32\Mnpobefe.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\Mghckj32.exeC:\Windows\system32\Mghckj32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\Mpphdpcf.exeC:\Windows\system32\Mpphdpcf.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\Mfmqmgbm.exeC:\Windows\system32\Mfmqmgbm.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\Moeeelhn.exeC:\Windows\system32\Moeeelhn.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\Mgmmfjip.exeC:\Windows\system32\Mgmmfjip.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\Mhninb32.exeC:\Windows\system32\Mhninb32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\Nfbjhf32.exeC:\Windows\system32\Nfbjhf32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\Nkobpmlo.exeC:\Windows\system32\Nkobpmlo.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\Nmnojp32.exeC:\Windows\system32\Nmnojp32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\Nomkfk32.exeC:\Windows\system32\Nomkfk32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\Nghpjn32.exeC:\Windows\system32\Nghpjn32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\Nnahgh32.exeC:\Windows\system32\Nnahgh32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Windows\SysWOW64\Nigldq32.exeC:\Windows\system32\Nigldq32.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Windows\SysWOW64\Nndemg32.exeC:\Windows\system32\Nndemg32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Windows\SysWOW64\Oqennbbl.exeC:\Windows\system32\Oqennbbl.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1360 -
C:\Windows\SysWOW64\Oninhgae.exeC:\Windows\system32\Oninhgae.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:732 -
C:\Windows\SysWOW64\Ocefpnom.exeC:\Windows\system32\Ocefpnom.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Windows\SysWOW64\Omnkicen.exeC:\Windows\system32\Omnkicen.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Windows\SysWOW64\Offpbi32.exeC:\Windows\system32\Offpbi32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2368 -
C:\Windows\SysWOW64\Oielnd32.exeC:\Windows\system32\Oielnd32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Windows\SysWOW64\Ocjpkm32.exeC:\Windows\system32\Ocjpkm32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Windows\SysWOW64\Oekmceaf.exeC:\Windows\system32\Oekmceaf.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Windows\SysWOW64\Oleepo32.exeC:\Windows\system32\Oleepo32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Windows\SysWOW64\Piieicgl.exeC:\Windows\system32\Piieicgl.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3024 -
C:\Windows\SysWOW64\Pepfnd32.exeC:\Windows\system32\Pepfnd32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Windows\SysWOW64\Pbdfgilj.exeC:\Windows\system32\Pbdfgilj.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Windows\SysWOW64\Pdecoa32.exeC:\Windows\system32\Pdecoa32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2548 -
C:\Windows\SysWOW64\Pnkglj32.exeC:\Windows\system32\Pnkglj32.exe33⤵
- Executes dropped EXE
- Modifies registry class
PID:2996 -
C:\Windows\SysWOW64\Pjahakgb.exeC:\Windows\system32\Pjahakgb.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2720 -
C:\Windows\SysWOW64\Pmpdmfff.exeC:\Windows\system32\Pmpdmfff.exe35⤵
- Executes dropped EXE
PID:1904 -
C:\Windows\SysWOW64\Qmbqcf32.exeC:\Windows\system32\Qmbqcf32.exe36⤵
- Executes dropped EXE
PID:1668 -
C:\Windows\SysWOW64\Qdlipplq.exeC:\Windows\system32\Qdlipplq.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2824 -
C:\Windows\SysWOW64\Aljjjb32.exeC:\Windows\system32\Aljjjb32.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:808 -
C:\Windows\SysWOW64\Abfoll32.exeC:\Windows\system32\Abfoll32.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1496 -
C:\Windows\SysWOW64\Ahchdb32.exeC:\Windows\system32\Ahchdb32.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2588 -
C:\Windows\SysWOW64\Aompambg.exeC:\Windows\system32\Aompambg.exe41⤵
- Executes dropped EXE
- Modifies registry class
PID:1920 -
C:\Windows\SysWOW64\Aoomflpd.exeC:\Windows\system32\Aoomflpd.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2364 -
C:\Windows\SysWOW64\Adleoc32.exeC:\Windows\system32\Adleoc32.exe43⤵
- Executes dropped EXE
PID:1308 -
C:\Windows\SysWOW64\Bapfhg32.exeC:\Windows\system32\Bapfhg32.exe44⤵
- Executes dropped EXE
PID:1844 -
C:\Windows\SysWOW64\Bgmnpn32.exeC:\Windows\system32\Bgmnpn32.exe45⤵
- Executes dropped EXE
PID:1288 -
C:\Windows\SysWOW64\Bngfmhbj.exeC:\Windows\system32\Bngfmhbj.exe46⤵
- Executes dropped EXE
- Modifies registry class
PID:796 -
C:\Windows\SysWOW64\Bccoeo32.exeC:\Windows\system32\Bccoeo32.exe47⤵
- Executes dropped EXE
- Modifies registry class
PID:3060 -
C:\Windows\SysWOW64\Bjngbihn.exeC:\Windows\system32\Bjngbihn.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:288 -
C:\Windows\SysWOW64\Bphooc32.exeC:\Windows\system32\Bphooc32.exe49⤵
- Executes dropped EXE
PID:948 -
C:\Windows\SysWOW64\Bgahkngh.exeC:\Windows\system32\Bgahkngh.exe50⤵
- Executes dropped EXE
- Modifies registry class
PID:1732 -
C:\Windows\SysWOW64\Bpjldc32.exeC:\Windows\system32\Bpjldc32.exe51⤵
- Executes dropped EXE
- Modifies registry class
PID:328 -
C:\Windows\SysWOW64\Bgddam32.exeC:\Windows\system32\Bgddam32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2700 -
C:\Windows\SysWOW64\Bjbqmi32.exeC:\Windows\system32\Bjbqmi32.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2900 -
C:\Windows\SysWOW64\Bplijcle.exeC:\Windows\system32\Bplijcle.exe54⤵
- Executes dropped EXE
PID:2440 -
C:\Windows\SysWOW64\Baneak32.exeC:\Windows\system32\Baneak32.exe55⤵
- Executes dropped EXE
PID:2568 -
C:\Windows\SysWOW64\Bjembh32.exeC:\Windows\system32\Bjembh32.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1296 -
C:\Windows\SysWOW64\Ckfjjqhd.exeC:\Windows\system32\Ckfjjqhd.exe57⤵
- Executes dropped EXE
PID:3048 -
C:\Windows\SysWOW64\Cfknhi32.exeC:\Windows\system32\Cfknhi32.exe58⤵
- Executes dropped EXE
PID:2636 -
C:\Windows\SysWOW64\Ckhfpp32.exeC:\Windows\system32\Ckhfpp32.exe59⤵
- Executes dropped EXE
PID:2676 -
C:\Windows\SysWOW64\Cfnkmi32.exeC:\Windows\system32\Cfnkmi32.exe60⤵
- Executes dropped EXE
PID:2512 -
C:\Windows\SysWOW64\Chlgid32.exeC:\Windows\system32\Chlgid32.exe61⤵
- Executes dropped EXE
PID:432 -
C:\Windows\SysWOW64\Cofofolh.exeC:\Windows\system32\Cofofolh.exe62⤵
- Executes dropped EXE
PID:1960 -
C:\Windows\SysWOW64\Chocodch.exeC:\Windows\system32\Chocodch.exe63⤵
- Executes dropped EXE
PID:2656 -
C:\Windows\SysWOW64\Cnklgkap.exeC:\Windows\system32\Cnklgkap.exe64⤵
- Executes dropped EXE
PID:932 -
C:\Windows\SysWOW64\Dkmljcdh.exeC:\Windows\system32\Dkmljcdh.exe65⤵
- Executes dropped EXE
PID:1532 -
C:\Windows\SysWOW64\Diqmcgca.exeC:\Windows\system32\Diqmcgca.exe66⤵PID:672
-
C:\Windows\SysWOW64\Epkepakn.exeC:\Windows\system32\Epkepakn.exe67⤵
- Drops file in System32 directory
PID:2100 -
C:\Windows\SysWOW64\Eegmhhie.exeC:\Windows\system32\Eegmhhie.exe68⤵
- Modifies registry class
PID:1476 -
C:\Windows\SysWOW64\Ejdfqogm.exeC:\Windows\system32\Ejdfqogm.exe69⤵
- Drops file in System32 directory
- Modifies registry class
PID:2348 -
C:\Windows\SysWOW64\Eannmi32.exeC:\Windows\system32\Eannmi32.exe70⤵
- Modifies registry class
PID:2264 -
C:\Windows\SysWOW64\Ehhfjcff.exeC:\Windows\system32\Ehhfjcff.exe71⤵PID:1540
-
C:\Windows\SysWOW64\Ejfbfo32.exeC:\Windows\system32\Ejfbfo32.exe72⤵PID:2516
-
C:\Windows\SysWOW64\Eelgcg32.exeC:\Windows\system32\Eelgcg32.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2164 -
C:\Windows\SysWOW64\Efmckpko.exeC:\Windows\system32\Efmckpko.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3044 -
C:\Windows\SysWOW64\Eacghhkd.exeC:\Windows\system32\Eacghhkd.exe75⤵PID:2976
-
C:\Windows\SysWOW64\Ehmpeb32.exeC:\Windows\system32\Ehmpeb32.exe76⤵PID:2252
-
C:\Windows\SysWOW64\Einlmkhp.exeC:\Windows\system32\Einlmkhp.exe77⤵PID:1736
-
C:\Windows\SysWOW64\Ephdjeol.exeC:\Windows\system32\Ephdjeol.exe78⤵
- Drops file in System32 directory
- Modifies registry class
PID:996 -
C:\Windows\SysWOW64\Ffbmfo32.exeC:\Windows\system32\Ffbmfo32.exe79⤵
- Drops file in System32 directory
PID:2912 -
C:\Windows\SysWOW64\Fiqibj32.exeC:\Windows\system32\Fiqibj32.exe80⤵PID:2932
-
C:\Windows\SysWOW64\Fdfmpc32.exeC:\Windows\system32\Fdfmpc32.exe81⤵PID:340
-
C:\Windows\SysWOW64\Fegjgkla.exeC:\Windows\system32\Fegjgkla.exe82⤵PID:1840
-
C:\Windows\SysWOW64\Fpmned32.exeC:\Windows\system32\Fpmned32.exe83⤵PID:1328
-
C:\Windows\SysWOW64\Ffgfancd.exeC:\Windows\system32\Ffgfancd.exe84⤵PID:2116
-
C:\Windows\SysWOW64\Fiebnjbg.exeC:\Windows\system32\Fiebnjbg.exe85⤵PID:2344
-
C:\Windows\SysWOW64\Fpokjd32.exeC:\Windows\system32\Fpokjd32.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2908 -
C:\Windows\SysWOW64\Fbngfo32.exeC:\Windows\system32\Fbngfo32.exe87⤵PID:2232
-
C:\Windows\SysWOW64\Figocipe.exeC:\Windows\system32\Figocipe.exe88⤵PID:860
-
C:\Windows\SysWOW64\Fodgkp32.exeC:\Windows\system32\Fodgkp32.exe89⤵PID:2904
-
C:\Windows\SysWOW64\Fbpclofe.exeC:\Windows\system32\Fbpclofe.exe90⤵PID:648
-
C:\Windows\SysWOW64\Fhmldfdm.exeC:\Windows\system32\Fhmldfdm.exe91⤵PID:1812
-
C:\Windows\SysWOW64\Fkkhpadq.exeC:\Windows\system32\Fkkhpadq.exe92⤵PID:1304
-
C:\Windows\SysWOW64\Gaeqmk32.exeC:\Windows\system32\Gaeqmk32.exe93⤵PID:2308
-
C:\Windows\SysWOW64\Ggbieb32.exeC:\Windows\system32\Ggbieb32.exe94⤵PID:2812
-
C:\Windows\SysWOW64\Gmlablaa.exeC:\Windows\system32\Gmlablaa.exe95⤵
- Drops file in System32 directory
PID:2296 -
C:\Windows\SysWOW64\Ghaeoe32.exeC:\Windows\system32\Ghaeoe32.exe96⤵PID:1788
-
C:\Windows\SysWOW64\Gkpakq32.exeC:\Windows\system32\Gkpakq32.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:936 -
C:\Windows\SysWOW64\Gajjhkgh.exeC:\Windows\system32\Gajjhkgh.exe98⤵PID:2360
-
C:\Windows\SysWOW64\Gckfpc32.exeC:\Windows\system32\Gckfpc32.exe99⤵PID:2076
-
C:\Windows\SysWOW64\Gkbnap32.exeC:\Windows\system32\Gkbnap32.exe100⤵PID:2404
-
C:\Windows\SysWOW64\Gpogiglp.exeC:\Windows\system32\Gpogiglp.exe101⤵PID:2956
-
C:\Windows\SysWOW64\Gcmcebkc.exeC:\Windows\system32\Gcmcebkc.exe102⤵PID:2680
-
C:\Windows\SysWOW64\Gncgbkki.exeC:\Windows\system32\Gncgbkki.exe103⤵
- Drops file in System32 directory
PID:1964 -
C:\Windows\SysWOW64\Gcppkbia.exeC:\Windows\system32\Gcppkbia.exe104⤵PID:2652
-
C:\Windows\SysWOW64\Genlgnhd.exeC:\Windows\system32\Genlgnhd.exe105⤵PID:2528
-
C:\Windows\SysWOW64\Hpcpdfhj.exeC:\Windows\system32\Hpcpdfhj.exe106⤵
- Drops file in System32 directory
PID:3052 -
C:\Windows\SysWOW64\Heqimm32.exeC:\Windows\system32\Heqimm32.exe107⤵PID:2832
-
C:\Windows\SysWOW64\Hljaigmo.exeC:\Windows\system32\Hljaigmo.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2880 -
C:\Windows\SysWOW64\Hoimecmb.exeC:\Windows\system32\Hoimecmb.exe109⤵PID:2288
-
C:\Windows\SysWOW64\Hhaanh32.exeC:\Windows\system32\Hhaanh32.exe110⤵PID:612
-
C:\Windows\SysWOW64\Hnnjfo32.exeC:\Windows\system32\Hnnjfo32.exe111⤵PID:1424
-
C:\Windows\SysWOW64\Hhcndhap.exeC:\Windows\system32\Hhcndhap.exe112⤵
- Modifies registry class
PID:1652 -
C:\Windows\SysWOW64\Honfqb32.exeC:\Windows\system32\Honfqb32.exe113⤵PID:1780
-
C:\Windows\SysWOW64\Hdjoii32.exeC:\Windows\system32\Hdjoii32.exe114⤵
- Drops file in System32 directory
PID:1216 -
C:\Windows\SysWOW64\Hjggap32.exeC:\Windows\system32\Hjggap32.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1144 -
C:\Windows\SysWOW64\Igkhjdde.exeC:\Windows\system32\Igkhjdde.exe116⤵PID:2732
-
C:\Windows\SysWOW64\Inepgn32.exeC:\Windows\system32\Inepgn32.exe117⤵PID:2536
-
C:\Windows\SysWOW64\Igmepdbc.exeC:\Windows\system32\Igmepdbc.exe118⤵
- Modifies registry class
PID:1724 -
C:\Windows\SysWOW64\Ingmmn32.exeC:\Windows\system32\Ingmmn32.exe119⤵PID:1028
-
C:\Windows\SysWOW64\Icdeee32.exeC:\Windows\system32\Icdeee32.exe120⤵
- Modifies registry class
PID:2456 -
C:\Windows\SysWOW64\Ijnnao32.exeC:\Windows\system32\Ijnnao32.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2804 -
C:\Windows\SysWOW64\Immjnj32.exeC:\Windows\system32\Immjnj32.exe122⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1664 -
C:\Windows\SysWOW64\Icfbkded.exeC:\Windows\system32\Icfbkded.exe123⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1640 -
C:\Windows\SysWOW64\Ijqjgo32.exeC:\Windows\system32\Ijqjgo32.exe124⤵PID:1796
-
C:\Windows\SysWOW64\Ikagogco.exeC:\Windows\system32\Ikagogco.exe125⤵
- Drops file in System32 directory
PID:1044 -
C:\Windows\SysWOW64\Iejkhlip.exeC:\Windows\system32\Iejkhlip.exe126⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1336 -
C:\Windows\SysWOW64\Jkdcdf32.exeC:\Windows\system32\Jkdcdf32.exe127⤵
- Drops file in System32 directory
- Modifies registry class
PID:2108 -
C:\Windows\SysWOW64\Jkfpjf32.exeC:\Windows\system32\Jkfpjf32.exe128⤵
- Drops file in System32 directory
PID:2400 -
C:\Windows\SysWOW64\Jnemfa32.exeC:\Windows\system32\Jnemfa32.exe129⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1656 -
C:\Windows\SysWOW64\Jijacjnc.exeC:\Windows\system32\Jijacjnc.exe130⤵
- Modifies registry class
PID:1608 -
C:\Windows\SysWOW64\Jngilalk.exeC:\Windows\system32\Jngilalk.exe131⤵PID:2496
-
C:\Windows\SysWOW64\Jjnjqb32.exeC:\Windows\system32\Jjnjqb32.exe132⤵PID:688
-
C:\Windows\SysWOW64\Jecnnk32.exeC:\Windows\system32\Jecnnk32.exe133⤵
- Modifies registry class
PID:1244 -
C:\Windows\SysWOW64\Jjpgfbom.exeC:\Windows\system32\Jjpgfbom.exe134⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2612 -
C:\Windows\SysWOW64\Jpmooind.exeC:\Windows\system32\Jpmooind.exe135⤵
- Drops file in System32 directory
PID:1564 -
C:\Windows\SysWOW64\Kiecgo32.exeC:\Windows\system32\Kiecgo32.exe136⤵PID:316
-
C:\Windows\SysWOW64\Kfidqb32.exeC:\Windows\system32\Kfidqb32.exe137⤵PID:3032
-
C:\Windows\SysWOW64\Klfmijae.exeC:\Windows\system32\Klfmijae.exe138⤵PID:2300
-
C:\Windows\SysWOW64\Keoabo32.exeC:\Windows\system32\Keoabo32.exe139⤵PID:1148
-
C:\Windows\SysWOW64\Kngekdnf.exeC:\Windows\system32\Kngekdnf.exe140⤵PID:2204
-
C:\Windows\SysWOW64\Kpfbegei.exeC:\Windows\system32\Kpfbegei.exe141⤵PID:1416
-
C:\Windows\SysWOW64\Kiofnm32.exeC:\Windows\system32\Kiofnm32.exe142⤵PID:2724
-
C:\Windows\SysWOW64\Lolofd32.exeC:\Windows\system32\Lolofd32.exe143⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2600 -
C:\Windows\SysWOW64\Leegbnan.exeC:\Windows\system32\Leegbnan.exe144⤵PID:2628
-
C:\Windows\SysWOW64\Ldkdckff.exeC:\Windows\system32\Ldkdckff.exe145⤵PID:3000
-
C:\Windows\SysWOW64\Laodmoep.exeC:\Windows\system32\Laodmoep.exe146⤵PID:2592
-
C:\Windows\SysWOW64\Lmeebpkd.exeC:\Windows\system32\Lmeebpkd.exe147⤵
- Modifies registry class
PID:1084 -
C:\Windows\SysWOW64\Lilfgq32.exeC:\Windows\system32\Lilfgq32.exe148⤵PID:1620
-
C:\Windows\SysWOW64\Lpfnckhe.exeC:\Windows\system32\Lpfnckhe.exe149⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2088 -
C:\Windows\SysWOW64\Miocmq32.exeC:\Windows\system32\Miocmq32.exe150⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1748 -
C:\Windows\SysWOW64\Mpikik32.exeC:\Windows\system32\Mpikik32.exe151⤵PID:2408
-
C:\Windows\SysWOW64\Meecaa32.exeC:\Windows\system32\Meecaa32.exe152⤵PID:2464
-
C:\Windows\SysWOW64\Mhkfnlme.exeC:\Windows\system32\Mhkfnlme.exe153⤵PID:2420
-
C:\Windows\SysWOW64\Nklopg32.exeC:\Windows\system32\Nklopg32.exe154⤵PID:2856
-
C:\Windows\SysWOW64\Nlohmonb.exeC:\Windows\system32\Nlohmonb.exe155⤵PID:2580
-
C:\Windows\SysWOW64\Nfglfdeb.exeC:\Windows\system32\Nfglfdeb.exe156⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2184 -
C:\Windows\SysWOW64\Nggipg32.exeC:\Windows\system32\Nggipg32.exe157⤵PID:396
-
C:\Windows\SysWOW64\Nhhehpbc.exeC:\Windows\system32\Nhhehpbc.exe158⤵PID:2096
-
C:\Windows\SysWOW64\Nbqjqehd.exeC:\Windows\system32\Nbqjqehd.exe159⤵PID:2796
-
C:\Windows\SysWOW64\Nhkbmo32.exeC:\Windows\system32\Nhkbmo32.exe160⤵PID:2060
-
C:\Windows\SysWOW64\Obcffefa.exeC:\Windows\system32\Obcffefa.exe161⤵PID:1628
-
C:\Windows\SysWOW64\Omhkcnfg.exeC:\Windows\system32\Omhkcnfg.exe162⤵PID:2688
-
C:\Windows\SysWOW64\Oddphp32.exeC:\Windows\system32\Oddphp32.exe163⤵PID:2412
-
C:\Windows\SysWOW64\Oknhdjko.exeC:\Windows\system32\Oknhdjko.exe164⤵PID:2172
-
C:\Windows\SysWOW64\Ogdhik32.exeC:\Windows\system32\Ogdhik32.exe165⤵
- Modifies registry class
PID:2776 -
C:\Windows\SysWOW64\Objmgd32.exeC:\Windows\system32\Objmgd32.exe166⤵PID:2544
-
C:\Windows\SysWOW64\Oggeokoq.exeC:\Windows\system32\Oggeokoq.exe167⤵
- Modifies registry class
PID:1632 -
C:\Windows\SysWOW64\Oqojhp32.exeC:\Windows\system32\Oqojhp32.exe168⤵PID:1676
-
C:\Windows\SysWOW64\Pcnfdl32.exeC:\Windows\system32\Pcnfdl32.exe169⤵PID:2944
-
C:\Windows\SysWOW64\Paafmp32.exeC:\Windows\system32\Paafmp32.exe170⤵PID:2744
-
C:\Windows\SysWOW64\Pjjkfe32.exeC:\Windows\system32\Pjjkfe32.exe171⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1572 -
C:\Windows\SysWOW64\Pcbookpp.exeC:\Windows\system32\Pcbookpp.exe172⤵PID:1644
-
C:\Windows\SysWOW64\Pmkdhq32.exeC:\Windows\system32\Pmkdhq32.exe173⤵PID:2436
-
C:\Windows\SysWOW64\Pcdldknm.exeC:\Windows\system32\Pcdldknm.exe174⤵
- Modifies registry class
PID:2696 -
C:\Windows\SysWOW64\Ppkmjlca.exeC:\Windows\system32\Ppkmjlca.exe175⤵PID:1464
-
C:\Windows\SysWOW64\Pehebbbh.exeC:\Windows\system32\Pehebbbh.exe176⤵
- Modifies registry class
PID:636 -
C:\Windows\SysWOW64\Qekbgbpf.exeC:\Windows\system32\Qekbgbpf.exe177⤵PID:3016
-
C:\Windows\SysWOW64\Qjgjpi32.exeC:\Windows\system32\Qjgjpi32.exe178⤵PID:2916
-
C:\Windows\SysWOW64\Qaablcej.exeC:\Windows\system32\Qaablcej.exe179⤵
- Drops file in System32 directory
PID:2072 -
C:\Windows\SysWOW64\Amhcad32.exeC:\Windows\system32\Amhcad32.exe180⤵PID:1508
-
C:\Windows\SysWOW64\Afqhjj32.exeC:\Windows\system32\Afqhjj32.exe181⤵PID:2620
-
C:\Windows\SysWOW64\Apilcoho.exeC:\Windows\system32\Apilcoho.exe182⤵PID:1688
-
C:\Windows\SysWOW64\Ahpddmia.exeC:\Windows\system32\Ahpddmia.exe183⤵PID:2468
-
C:\Windows\SysWOW64\Ammmlcgi.exeC:\Windows\system32\Ammmlcgi.exe184⤵PID:1036
-
C:\Windows\SysWOW64\Afeaei32.exeC:\Windows\system32\Afeaei32.exe185⤵PID:2112
-
C:\Windows\SysWOW64\Amoibc32.exeC:\Windows\system32\Amoibc32.exe186⤵PID:1980
-
C:\Windows\SysWOW64\Aejnfe32.exeC:\Windows\system32\Aejnfe32.exe187⤵PID:3112
-
C:\Windows\SysWOW64\Appbcn32.exeC:\Windows\system32\Appbcn32.exe188⤵PID:3152
-
C:\Windows\SysWOW64\Bhkghqpb.exeC:\Windows\system32\Bhkghqpb.exe189⤵
- Drops file in System32 directory
PID:3192 -
C:\Windows\SysWOW64\Bbqkeioh.exeC:\Windows\system32\Bbqkeioh.exe190⤵PID:3232
-
C:\Windows\SysWOW64\Bklpjlmc.exeC:\Windows\system32\Bklpjlmc.exe191⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3272 -
C:\Windows\SysWOW64\Beadgdli.exeC:\Windows\system32\Beadgdli.exe192⤵
- Drops file in System32 directory
PID:3312 -
C:\Windows\SysWOW64\Bknmok32.exeC:\Windows\system32\Bknmok32.exe193⤵PID:3352
-
C:\Windows\SysWOW64\Bedamd32.exeC:\Windows\system32\Bedamd32.exe194⤵PID:3396
-
C:\Windows\SysWOW64\Blniinac.exeC:\Windows\system32\Blniinac.exe195⤵
- Modifies registry class
PID:3436 -
C:\Windows\SysWOW64\Bnofaf32.exeC:\Windows\system32\Bnofaf32.exe196⤵PID:3476
-
C:\Windows\SysWOW64\Bkcfjk32.exeC:\Windows\system32\Bkcfjk32.exe197⤵PID:3516
-
C:\Windows\SysWOW64\Cdkkcp32.exeC:\Windows\system32\Cdkkcp32.exe198⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3556 -
C:\Windows\SysWOW64\Caokmd32.exeC:\Windows\system32\Caokmd32.exe199⤵PID:3596
-
C:\Windows\SysWOW64\Cglcek32.exeC:\Windows\system32\Cglcek32.exe200⤵PID:3636
-
C:\Windows\SysWOW64\Clilmbhd.exeC:\Windows\system32\Clilmbhd.exe201⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3680 -
C:\Windows\SysWOW64\Cfaqfh32.exeC:\Windows\system32\Cfaqfh32.exe202⤵PID:3720
-
C:\Windows\SysWOW64\Cojeomee.exeC:\Windows\system32\Cojeomee.exe203⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3760 -
C:\Windows\SysWOW64\Cjoilfek.exeC:\Windows\system32\Cjoilfek.exe204⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3800 -
C:\Windows\SysWOW64\Cbjnqh32.exeC:\Windows\system32\Cbjnqh32.exe205⤵
- Drops file in System32 directory
PID:3840 -
C:\Windows\SysWOW64\Dlpbna32.exeC:\Windows\system32\Dlpbna32.exe206⤵
- Drops file in System32 directory
- Modifies registry class
PID:3880 -
C:\Windows\SysWOW64\Dbmkfh32.exeC:\Windows\system32\Dbmkfh32.exe207⤵PID:3920
-
C:\Windows\SysWOW64\Dlboca32.exeC:\Windows\system32\Dlboca32.exe208⤵PID:3960
-
C:\Windows\SysWOW64\Dboglhna.exeC:\Windows\system32\Dboglhna.exe209⤵PID:4000
-
C:\Windows\SysWOW64\Dglpdomh.exeC:\Windows\system32\Dglpdomh.exe210⤵PID:4040
-
C:\Windows\SysWOW64\Dqddmd32.exeC:\Windows\system32\Dqddmd32.exe211⤵PID:4080
-
C:\Windows\SysWOW64\Dnhefh32.exeC:\Windows\system32\Dnhefh32.exe212⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2424 -
C:\Windows\SysWOW64\Ddbmcb32.exeC:\Windows\system32\Ddbmcb32.exe213⤵PID:3148
-
C:\Windows\SysWOW64\Djoeki32.exeC:\Windows\system32\Djoeki32.exe214⤵PID:3180
-
C:\Windows\SysWOW64\Dqinhcoc.exeC:\Windows\system32\Dqinhcoc.exe215⤵PID:3240
-
C:\Windows\SysWOW64\Efffpjmk.exeC:\Windows\system32\Efffpjmk.exe216⤵PID:3288
-
C:\Windows\SysWOW64\Eqkjmcmq.exeC:\Windows\system32\Eqkjmcmq.exe217⤵
- Drops file in System32 directory
PID:3324 -
C:\Windows\SysWOW64\Eifobe32.exeC:\Windows\system32\Eifobe32.exe218⤵PID:3380
-
C:\Windows\SysWOW64\Emdhhdqb.exeC:\Windows\system32\Emdhhdqb.exe219⤵PID:3424
-
C:\Windows\SysWOW64\Ebappk32.exeC:\Windows\system32\Ebappk32.exe220⤵PID:3496
-
C:\Windows\SysWOW64\Elieipej.exeC:\Windows\system32\Elieipej.exe221⤵PID:3536
-
C:\Windows\SysWOW64\Efoifiep.exeC:\Windows\system32\Efoifiep.exe222⤵PID:3580
-
C:\Windows\SysWOW64\Fllaopcg.exeC:\Windows\system32\Fllaopcg.exe223⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3656 -
C:\Windows\SysWOW64\Gjjafkpe.exeC:\Windows\system32\Gjjafkpe.exe224⤵PID:3704
-
C:\Windows\SysWOW64\Gdcfoq32.exeC:\Windows\system32\Gdcfoq32.exe225⤵
- Modifies registry class
PID:3748 -
C:\Windows\SysWOW64\Gmkjgfmf.exeC:\Windows\system32\Gmkjgfmf.exe226⤵PID:3788
-
C:\Windows\SysWOW64\Gfcopl32.exeC:\Windows\system32\Gfcopl32.exe227⤵PID:3856
-
C:\Windows\SysWOW64\Gplcia32.exeC:\Windows\system32\Gplcia32.exe228⤵PID:3908
-
C:\Windows\SysWOW64\Goapjnoo.exeC:\Windows\system32\Goapjnoo.exe229⤵
- Modifies registry class
PID:3956 -
C:\Windows\SysWOW64\Ghidcceo.exeC:\Windows\system32\Ghidcceo.exe230⤵
- Drops file in System32 directory
PID:4008 -
C:\Windows\SysWOW64\Habili32.exeC:\Windows\system32\Habili32.exe231⤵PID:4060
-
C:\Windows\SysWOW64\Hhlaiccm.exeC:\Windows\system32\Hhlaiccm.exe232⤵
- Modifies registry class
PID:3080 -
C:\Windows\SysWOW64\Hmijajbd.exeC:\Windows\system32\Hmijajbd.exe233⤵
- Drops file in System32 directory
PID:3100 -
C:\Windows\SysWOW64\Hdbbnd32.exeC:\Windows\system32\Hdbbnd32.exe234⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3660 -
C:\Windows\SysWOW64\Hpicbe32.exeC:\Windows\system32\Hpicbe32.exe235⤵PID:3244
-
C:\Windows\SysWOW64\Hibgkjee.exeC:\Windows\system32\Hibgkjee.exe236⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3284 -
C:\Windows\SysWOW64\Hplphd32.exeC:\Windows\system32\Hplphd32.exe237⤵PID:3376
-
C:\Windows\SysWOW64\Hnppaill.exeC:\Windows\system32\Hnppaill.exe238⤵PID:3420
-
C:\Windows\SysWOW64\Hclhjpjc.exeC:\Windows\system32\Hclhjpjc.exe239⤵PID:3488
-
C:\Windows\SysWOW64\Ijfqfj32.exeC:\Windows\system32\Ijfqfj32.exe240⤵PID:3568
-
C:\Windows\SysWOW64\Iocioq32.exeC:\Windows\system32\Iocioq32.exe241⤵PID:3620
-
C:\Windows\SysWOW64\Ihlnhffh.exeC:\Windows\system32\Ihlnhffh.exe242⤵PID:3676