Analysis
-
max time kernel
42s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27-07-2024 01:39
Static task
static1
Behavioral task
behavioral1
Sample
7b8f60066c24e46fcee5f5220bf4a020N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7b8f60066c24e46fcee5f5220bf4a020N.exe
Resource
win10v2004-20240709-en
General
-
Target
7b8f60066c24e46fcee5f5220bf4a020N.exe
-
Size
55KB
-
MD5
7b8f60066c24e46fcee5f5220bf4a020
-
SHA1
157b179da4da3f907cdc7c9635b7a7883c913cf6
-
SHA256
f46cf076448466c9071aa7dbf2cd5f85997ed859855a624607e4ab9ac02afcce
-
SHA512
a10e4f174a8033cd3f87d50bafc81fbc0de0e2b147c1a052b85847ca8a50a2a23d3aca7fbcda4d95731fe6f2d44ff74f7d19e064ca1b922dc84f784ec0a0536d
-
SSDEEP
768:LiOx4HUcHVmSWcUCZTpiL23M253apJsgx59uLeoQRhV7sjiyOJZ/1H55Xdnh:LiOx40cMSWcDrxMgqp1haibt
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Hgjdcghp.exePbcahgjd.exeGigjch32.exeNabegpbp.exeNhlndj32.exeDihojnqo.exeBenpik32.exeMajfcb32.exeNaebmppm.exePdjqinld.exeDopfpkng.exeQhdabemb.exeKclmbm32.exeEbkpma32.exeOgnakk32.exeEjqmahdn.exeDphmiokb.exeDhcanahm.exeHjnaehgj.exeQolmip32.exeBlhifemo.exeGpdfph32.exeOhdkop32.exePmeemp32.exeFmabaf32.exeMcpmonea.exeEdafjiqe.exeColgpo32.exeLjdgqc32.exeHhkjpi32.exeKnckbe32.exeCdnicemo.exeOhjmnn32.exeGngdadoj.exeBlklfk32.exeDpkpie32.exeDknehe32.exeLllkaobc.exeKnmjmodm.exeHbfalpab.exePlbaafak.exeBnfodojp.exeKjalch32.exeKbljmd32.exeDhiacg32.exeEcabfpff.exeOfehiocd.exeCldolj32.exeFadmenpg.exeJjgbbc32.exeAifpcfjd.exeNoffadai.exeGiaddm32.exeNkpjfkhf.exeEclejclg.exeAihenoef.exeGoemhfco.exeDdgcdjip.exeDfjegl32.exeNhojjjhj.exeOnejjm32.exeFblpnepn.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hgjdcghp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pbcahgjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gigjch32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nabegpbp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhlndj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dihojnqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Benpik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Majfcb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Naebmppm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pdjqinld.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dopfpkng.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qhdabemb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kclmbm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebkpma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ognakk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejqmahdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dphmiokb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhcanahm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hjnaehgj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qolmip32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Blhifemo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gpdfph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ohdkop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pmeemp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmabaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mcpmonea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Edafjiqe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Colgpo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljdgqc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhkjpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Knckbe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdnicemo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohjmnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gngdadoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Blklfk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knckbe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dpkpie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dknehe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lllkaobc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knmjmodm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hbfalpab.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Plbaafak.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnfodojp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kjalch32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kbljmd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhiacg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ecabfpff.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofehiocd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cldolj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fadmenpg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjgbbc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aifpcfjd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Noffadai.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Giaddm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nkpjfkhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eclejclg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aihenoef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Goemhfco.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kclmbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ddgcdjip.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dfjegl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhojjjhj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onejjm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fblpnepn.exe -
Executes dropped EXE 64 IoCs
Processes:
Dlcfnk32.exeDcojbm32.exeDndoof32.exeDfpcdh32.exeEphhmn32.exeEiplecnc.exeEbhani32.exeEmnelbdi.exeEeijpdbd.exeEoanij32.exeEleobngo.exeFijolbfh.exeFbbcdh32.exeFkmhij32.exeFokaoh32.exeFomndhng.exeFdjfmolo.exeFmbkfd32.exeGkfkoi32.exeGdophn32.exeGngdadoj.exeGgphji32.exeGllabp32.exeGaiijgbi.exeGlongpao.exeGlajmppm.exeHdloab32.exeHobcok32.exeHkidclbb.exeHdailaib.exeHjnaehgj.exeHgbanlfc.exeHqjfgb32.exeIiekkdjo.exeIoochn32.exeIkfdmogp.exeIijdfc32.exeIngmoj32.exeIkkmho32.exeIionacad.exeIjpjik32.exeJgdkbo32.exeJalolemm.exeJnppei32.exeJgidnobg.exeJpdibapb.exeJfnaok32.exeJpfehq32.exeJecnpg32.exeKphbmp32.exeKbgnil32.exeKiafff32.exeKpkocpjj.exeKehgkgha.exeKlapha32.exeKanhph32.exeKhhpmbeb.exeKaaeegkc.exeLhhmle32.exeLcnqin32.exeLhkiae32.exeMcpmonea.exeMhmfgdch.exeMnjnolap.exepid process 2192 Dlcfnk32.exe 1724 Dcojbm32.exe 2324 Dndoof32.exe 3020 Dfpcdh32.exe 2788 Ephhmn32.exe 1660 Eiplecnc.exe 2644 Ebhani32.exe 836 Emnelbdi.exe 1168 Eeijpdbd.exe 1676 Eoanij32.exe 2044 Eleobngo.exe 2980 Fijolbfh.exe 1828 Fbbcdh32.exe 1968 Fkmhij32.exe 888 Fokaoh32.exe 680 Fomndhng.exe 1496 Fdjfmolo.exe 948 Fmbkfd32.exe 1340 Gkfkoi32.exe 624 Gdophn32.exe 912 Gngdadoj.exe 1196 Ggphji32.exe 2292 Gllabp32.exe 2952 Gaiijgbi.exe 2364 Glongpao.exe 2040 Glajmppm.exe 2096 Hdloab32.exe 2860 Hobcok32.exe 2892 Hkidclbb.exe 2716 Hdailaib.exe 2688 Hjnaehgj.exe 2748 Hgbanlfc.exe 2612 Hqjfgb32.exe 2988 Iiekkdjo.exe 1684 Ioochn32.exe 1252 Ikfdmogp.exe 2924 Iijdfc32.exe 1788 Ingmoj32.exe 2936 Ikkmho32.exe 3016 Iionacad.exe 2824 Ijpjik32.exe 2228 Jgdkbo32.exe 1804 Jalolemm.exe 1816 Jnppei32.exe 2180 Jgidnobg.exe 1860 Jpdibapb.exe 1284 Jfnaok32.exe 1508 Jpfehq32.exe 1648 Jecnpg32.exe 1608 Kphbmp32.exe 688 Kbgnil32.exe 2992 Kiafff32.exe 2780 Kpkocpjj.exe 2756 Kehgkgha.exe 2772 Klapha32.exe 2624 Kanhph32.exe 2704 Khhpmbeb.exe 2728 Kaaeegkc.exe 2000 Lhhmle32.exe 2136 Lcnqin32.exe 2556 Lhkiae32.exe 3024 Mcpmonea.exe 1692 Mhmfgdch.exe 236 Mnjnolap.exe -
Loads dropped DLL 64 IoCs
Processes:
7b8f60066c24e46fcee5f5220bf4a020N.exeDlcfnk32.exeDcojbm32.exeDndoof32.exeDfpcdh32.exeEphhmn32.exeEiplecnc.exeEbhani32.exeEmnelbdi.exeEeijpdbd.exeEoanij32.exeEleobngo.exeFijolbfh.exeFbbcdh32.exeFkmhij32.exeFokaoh32.exeFomndhng.exeFdjfmolo.exeFmbkfd32.exeGkfkoi32.exeGdophn32.exeGngdadoj.exeGgphji32.exeGllabp32.exeGaiijgbi.exeGlongpao.exeGlajmppm.exeHdloab32.exeHobcok32.exeHkidclbb.exeHdailaib.exeHjnaehgj.exepid process 2552 7b8f60066c24e46fcee5f5220bf4a020N.exe 2552 7b8f60066c24e46fcee5f5220bf4a020N.exe 2192 Dlcfnk32.exe 2192 Dlcfnk32.exe 1724 Dcojbm32.exe 1724 Dcojbm32.exe 2324 Dndoof32.exe 2324 Dndoof32.exe 3020 Dfpcdh32.exe 3020 Dfpcdh32.exe 2788 Ephhmn32.exe 2788 Ephhmn32.exe 1660 Eiplecnc.exe 1660 Eiplecnc.exe 2644 Ebhani32.exe 2644 Ebhani32.exe 836 Emnelbdi.exe 836 Emnelbdi.exe 1168 Eeijpdbd.exe 1168 Eeijpdbd.exe 1676 Eoanij32.exe 1676 Eoanij32.exe 2044 Eleobngo.exe 2044 Eleobngo.exe 2980 Fijolbfh.exe 2980 Fijolbfh.exe 1828 Fbbcdh32.exe 1828 Fbbcdh32.exe 1968 Fkmhij32.exe 1968 Fkmhij32.exe 888 Fokaoh32.exe 888 Fokaoh32.exe 680 Fomndhng.exe 680 Fomndhng.exe 1496 Fdjfmolo.exe 1496 Fdjfmolo.exe 948 Fmbkfd32.exe 948 Fmbkfd32.exe 1340 Gkfkoi32.exe 1340 Gkfkoi32.exe 624 Gdophn32.exe 624 Gdophn32.exe 912 Gngdadoj.exe 912 Gngdadoj.exe 1196 Ggphji32.exe 1196 Ggphji32.exe 2292 Gllabp32.exe 2292 Gllabp32.exe 2952 Gaiijgbi.exe 2952 Gaiijgbi.exe 2364 Glongpao.exe 2364 Glongpao.exe 2040 Glajmppm.exe 2040 Glajmppm.exe 2096 Hdloab32.exe 2096 Hdloab32.exe 2860 Hobcok32.exe 2860 Hobcok32.exe 2892 Hkidclbb.exe 2892 Hkidclbb.exe 2716 Hdailaib.exe 2716 Hdailaib.exe 2688 Hjnaehgj.exe 2688 Hjnaehgj.exe -
Drops file in System32 directory 64 IoCs
Processes:
Ebkpma32.exeOdmhjp32.exeCkdnpicb.exeMhmfgdch.exeLfbibfmi.exeLmgaikep.exeFdjfmolo.exeMdfejn32.exeBpdnjb32.exeBilkhbcl.exeGfnnmboa.exeGabohk32.exeDejnme32.exeQmlief32.exeNabegpbp.exeOpohil32.exeJkjbml32.exeFmnccn32.exeNhhdiknb.exeDjnbdlla.exeBaoopndk.exeBikemiik.exeLhnckp32.exeMajfcb32.exeAihmhe32.exeDgehfodh.exeIijdfc32.exeJbgdcapi.exeEdafjiqe.exeEcklgdag.exeCidhcg32.exeDcdlpklh.exeOjjqbg32.exeGjmpfp32.exeFodljn32.exeDopkai32.exeJkgfgl32.exeCkdlgq32.exeOjojmfed.exeEfjklh32.exeLmdnjf32.exeAmledj32.exeEmcqpjhh.exeGokpgd32.exeLmjdia32.exeMpmpeiqg.exeDhcanahm.exeKlapha32.exeNhlndj32.exeNcnoaj32.exeFpliec32.exeHhnnpolk.exeIcnealbb.exeBbkmki32.exeKpkocpjj.exeBjclfmfe.exeDgkkdnkb.exeAnjnllbd.exeAmjkgbhe.exeFiomhc32.exeNodnmb32.exeMahgejhf.exeDcijmhdj.exedescription ioc process File created C:\Windows\SysWOW64\Lnnocigg.dll Ebkpma32.exe File created C:\Windows\SysWOW64\Ojjqbg32.exe Odmhjp32.exe File created C:\Windows\SysWOW64\Cdmbiojc.exe Ckdnpicb.exe File created C:\Windows\SysWOW64\Mnjnolap.exe Mhmfgdch.exe File created C:\Windows\SysWOW64\Liaenblm.exe Lfbibfmi.exe File created C:\Windows\SysWOW64\Lnhmqc32.exe Lmgaikep.exe File opened for modification C:\Windows\SysWOW64\Fmbkfd32.exe Fdjfmolo.exe File opened for modification C:\Windows\SysWOW64\Mkqnghfk.exe Mdfejn32.exe File created C:\Windows\SysWOW64\Nhpoda32.dll Bpdnjb32.exe File created C:\Windows\SysWOW64\Lapcee32.dll Bilkhbcl.exe File created C:\Windows\SysWOW64\Gmhfjm32.exe Gfnnmboa.exe File created C:\Windows\SysWOW64\Cebfcj32.dll Gabohk32.exe File created C:\Windows\SysWOW64\Fnfilb32.dll Dejnme32.exe File created C:\Windows\SysWOW64\Naohim32.dll Qmlief32.exe File opened for modification C:\Windows\SysWOW64\Nhlndj32.exe Nabegpbp.exe File created C:\Windows\SysWOW64\Oekaab32.exe Opohil32.exe File created C:\Windows\SysWOW64\Kagkebpb.exe Jkjbml32.exe File created C:\Windows\SysWOW64\Mnnimkif.dll Fmnccn32.exe File opened for modification C:\Windows\SysWOW64\Nbmhfdnh.exe Nhhdiknb.exe File created C:\Windows\SysWOW64\Lbqhmkhq.dll Djnbdlla.exe File created C:\Windows\SysWOW64\Bglghdbc.exe Baoopndk.exe File created C:\Windows\SysWOW64\Eifeam32.dll Bikemiik.exe File created C:\Windows\SysWOW64\Kfbcpo32.dll Lhnckp32.exe File created C:\Windows\SysWOW64\Gdjopf32.dll Majfcb32.exe File created C:\Windows\SysWOW64\Aeommfnf.exe Aihmhe32.exe File opened for modification C:\Windows\SysWOW64\Dnoqbi32.exe Dgehfodh.exe File created C:\Windows\SysWOW64\Ingmoj32.exe Iijdfc32.exe File created C:\Windows\SysWOW64\Jciaki32.exe Jbgdcapi.exe File created C:\Windows\SysWOW64\Efbbba32.exe Edafjiqe.exe File created C:\Windows\SysWOW64\Eelinm32.exe Ecklgdag.exe File created C:\Windows\SysWOW64\Clbdobpc.exe Cidhcg32.exe File created C:\Windows\SysWOW64\Dindme32.exe Dcdlpklh.exe File created C:\Windows\SysWOW64\Eedcdcoc.dll Ojjqbg32.exe File created C:\Windows\SysWOW64\Gpihog32.exe Gjmpfp32.exe File created C:\Windows\SysWOW64\Lfoiil32.dll Fodljn32.exe File created C:\Windows\SysWOW64\Mojgie32.dll Dopkai32.exe File opened for modification C:\Windows\SysWOW64\Jbandfkj.exe Jkgfgl32.exe File opened for modification C:\Windows\SysWOW64\Clehoiam.exe Ckdlgq32.exe File created C:\Windows\SysWOW64\Anapcg32.dll Ojojmfed.exe File opened for modification C:\Windows\SysWOW64\Fmcchb32.exe Efjklh32.exe File created C:\Windows\SysWOW64\Ljaplc32.dll Lmdnjf32.exe File created C:\Windows\SysWOW64\Adenqd32.exe Amledj32.exe File created C:\Windows\SysWOW64\Pbofngho.dll Emcqpjhh.exe File created C:\Windows\SysWOW64\Camepc32.dll Gokpgd32.exe File opened for modification C:\Windows\SysWOW64\Lfbibfmi.exe Lmjdia32.exe File created C:\Windows\SysWOW64\Cdldmn32.dll Mpmpeiqg.exe File created C:\Windows\SysWOW64\Dciekjhc.exe Dhcanahm.exe File opened for modification C:\Windows\SysWOW64\Kanhph32.exe Klapha32.exe File opened for modification C:\Windows\SysWOW64\Noffadai.exe Nhlndj32.exe File opened for modification C:\Windows\SysWOW64\Nelkme32.exe Ncnoaj32.exe File created C:\Windows\SysWOW64\Nehipedn.dll Fpliec32.exe File created C:\Windows\SysWOW64\Nogeln32.dll Hhnnpolk.exe File created C:\Windows\SysWOW64\Maieqidm.dll Icnealbb.exe File opened for modification C:\Windows\SysWOW64\Bbpffhnb.exe Bbkmki32.exe File created C:\Windows\SysWOW64\Jcagbppl.dll Kpkocpjj.exe File opened for modification C:\Windows\SysWOW64\Jciaki32.exe Jbgdcapi.exe File opened for modification C:\Windows\SysWOW64\Behpcefk.exe Bjclfmfe.exe File created C:\Windows\SysWOW64\Akbdil32.dll Dgkkdnkb.exe File created C:\Windows\SysWOW64\Aedghf32.exe Anjnllbd.exe File opened for modification C:\Windows\SysWOW64\Aeachphg.exe Amjkgbhe.exe File opened for modification C:\Windows\SysWOW64\Fjpipkgi.exe Fiomhc32.exe File created C:\Windows\SysWOW64\Ffemlf32.dll Nodnmb32.exe File opened for modification C:\Windows\SysWOW64\Mhaobd32.exe Mahgejhf.exe File created C:\Windows\SysWOW64\Dmaoem32.exe Dcijmhdj.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4500 4320 WerFault.exe Lfnkejeg.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Kaaeegkc.exeBehnkm32.exeBkjpncii.exeDcgmgh32.exeJjgbbc32.exeLobgah32.exeEcnbpcje.exeNkhmkf32.exeAndnff32.exeAeachphg.exeJfnaok32.exeBgijbede.exeHfdkoc32.exeDkookd32.exeMgbeqjpd.exeAhpfoa32.exeMjialchg.exeEoanij32.exeQolmip32.exeKmnljc32.exeOoncljom.exeAihmhe32.exeMpcmojia.exeDmhcgd32.exeIngmoj32.exeAbpohb32.exeIdnako32.exeMogqlgbi.exeQnjbmh32.exeNoighakn.exeDnbdbomn.exeLaifbnho.exeFdjfmolo.exeHadece32.exeInopce32.exeDghlfe32.exeGabohk32.exeGlgcec32.exeHfmcapna.exeKbdmboqk.exeDndoof32.exeJgdkbo32.exeKcgdgnmc.exeGjmpfp32.exePgfpoimj.exeEhfjbd32.exeGgphji32.exeJccjln32.exeApeakonl.exeFibqhibd.exeHdjnje32.exeKoogdg32.exeMfpaqdnk.exeFlnnfllf.exeEqjceidf.exeHgknffcp.exeNbmhfdnh.exeDlcfnk32.exeJennjblp.exeMojdlm32.exeKfnpgg32.exeCefpmiji.exeGpihog32.exeJbbpmo32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kaaeegkc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Behnkm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bkjpncii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dcgmgh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjgbbc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lobgah32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ecnbpcje.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nkhmkf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Andnff32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aeachphg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jfnaok32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgijbede.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfdkoc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dkookd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mgbeqjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahpfoa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjialchg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eoanij32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qolmip32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmnljc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ooncljom.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aihmhe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mpcmojia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmhcgd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ingmoj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Abpohb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Idnako32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mogqlgbi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qnjbmh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Noighakn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dnbdbomn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Laifbnho.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdjfmolo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hadece32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Inopce32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dghlfe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gabohk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Glgcec32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfmcapna.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbdmboqk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dndoof32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgdkbo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kcgdgnmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gjmpfp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pgfpoimj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ehfjbd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggphji32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jccjln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Apeakonl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fibqhibd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdjnje32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Koogdg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mfpaqdnk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Flnnfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eqjceidf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hgknffcp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nbmhfdnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dlcfnk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jennjblp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mojdlm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kfnpgg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cefpmiji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpihog32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbbpmo32.exe -
Modifies registry class 64 IoCs
Processes:
Aijgemok.exeHgjdcghp.exeJmcbio32.exeLobgah32.exeBilkhbcl.exeOnejjm32.exeAioppl32.exeBnfodojp.exeKcgdgnmc.exeMiekhd32.exeHlliof32.exeFefboabg.exeBehpcefk.exeMnjnolap.exeFijadk32.exeLhnlqjha.exeLmgaikep.exeBgaljk32.exeDcdlpklh.exeOqibjq32.exeHfmcapna.exeKbdmboqk.exeFbeeliin.exePbqbioeb.exeQfbahldf.exeKjeblf32.exeMlfgkleh.exeFplgljbm.exeOgnakk32.exePnphlc32.exeBpokkdim.exeOgigpllh.exeMlogojjp.exeKnldaf32.exeQnjbmh32.exeMhjdpgic.exeGaffja32.exeBcbabodk.exeCnnohmog.exeJknlfg32.exeMmijmn32.exeBajqcqli.exeFhjcmcep.exeIkfdmogp.exeDmaoem32.exePbcahgjd.exeNbmhfdnh.exeQnmfmoaa.exeKjdkap32.exeOnkoadhm.exeEhphdf32.exeFffabman.exeCldolj32.exeCljajh32.exeHilghaqq.exeOmkidb32.exeDdjbbbna.exeFcckjb32.exeAefaemqj.exeIdihponj.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nghjkn32.dll" Aijgemok.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hgjdcghp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jmcbio32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lobgah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lapcee32.dll" Bilkhbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Onejjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebacfi32.dll" Aioppl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmllmn32.dll" Bnfodojp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kcgdgnmc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Miekhd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hlliof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Andgadch.dll" Fefboabg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Behpcefk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mnjnolap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chmmbpjh.dll" Fijadk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lhnlqjha.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lmgaikep.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bgaljk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibihnm32.dll" Dcdlpklh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmhdamkj.dll" Oqibjq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dommib32.dll" Hfmcapna.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kbdmboqk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fbeeliin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pbqbioeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epqfkj32.dll" Qfbahldf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kjeblf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mlfgkleh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fplgljbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ognakk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pnphlc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nibgpjfq.dll" Bpokkdim.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ogigpllh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hfmcapna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mlogojjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Knldaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oqibjq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlimimpg.dll" Qnjbmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mhjdpgic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gaffja32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bcbabodk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lngpidkn.dll" Cnnohmog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jknlfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mmijmn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bajqcqli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhhgja32.dll" Fhjcmcep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcpolmao.dll" Ikfdmogp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dmaoem32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pbcahgjd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nbmhfdnh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qnmfmoaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjogpk32.dll" Kjdkap32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Onkoadhm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ehphdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iceohloo.dll" Fffabman.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Febgnn32.dll" Bgaljk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cldolj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljeeom32.dll" Cljajh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgmeqpmo.dll" Hilghaqq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Omkidb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ddjbbbna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fcckjb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fffabman.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bepdfd32.dll" Aefaemqj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Idihponj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7b8f60066c24e46fcee5f5220bf4a020N.exeDlcfnk32.exeDcojbm32.exeDndoof32.exeDfpcdh32.exeEphhmn32.exeEiplecnc.exeEbhani32.exeEmnelbdi.exeEeijpdbd.exeEoanij32.exeEleobngo.exeFijolbfh.exeFbbcdh32.exeFkmhij32.exeFokaoh32.exedescription pid process target process PID 2552 wrote to memory of 2192 2552 7b8f60066c24e46fcee5f5220bf4a020N.exe Dlcfnk32.exe PID 2552 wrote to memory of 2192 2552 7b8f60066c24e46fcee5f5220bf4a020N.exe Dlcfnk32.exe PID 2552 wrote to memory of 2192 2552 7b8f60066c24e46fcee5f5220bf4a020N.exe Dlcfnk32.exe PID 2552 wrote to memory of 2192 2552 7b8f60066c24e46fcee5f5220bf4a020N.exe Dlcfnk32.exe PID 2192 wrote to memory of 1724 2192 Dlcfnk32.exe Dcojbm32.exe PID 2192 wrote to memory of 1724 2192 Dlcfnk32.exe Dcojbm32.exe PID 2192 wrote to memory of 1724 2192 Dlcfnk32.exe Dcojbm32.exe PID 2192 wrote to memory of 1724 2192 Dlcfnk32.exe Dcojbm32.exe PID 1724 wrote to memory of 2324 1724 Dcojbm32.exe Dndoof32.exe PID 1724 wrote to memory of 2324 1724 Dcojbm32.exe Dndoof32.exe PID 1724 wrote to memory of 2324 1724 Dcojbm32.exe Dndoof32.exe PID 1724 wrote to memory of 2324 1724 Dcojbm32.exe Dndoof32.exe PID 2324 wrote to memory of 3020 2324 Dndoof32.exe Dfpcdh32.exe PID 2324 wrote to memory of 3020 2324 Dndoof32.exe Dfpcdh32.exe PID 2324 wrote to memory of 3020 2324 Dndoof32.exe Dfpcdh32.exe PID 2324 wrote to memory of 3020 2324 Dndoof32.exe Dfpcdh32.exe PID 3020 wrote to memory of 2788 3020 Dfpcdh32.exe Ephhmn32.exe PID 3020 wrote to memory of 2788 3020 Dfpcdh32.exe Ephhmn32.exe PID 3020 wrote to memory of 2788 3020 Dfpcdh32.exe Ephhmn32.exe PID 3020 wrote to memory of 2788 3020 Dfpcdh32.exe Ephhmn32.exe PID 2788 wrote to memory of 1660 2788 Ephhmn32.exe Eiplecnc.exe PID 2788 wrote to memory of 1660 2788 Ephhmn32.exe Eiplecnc.exe PID 2788 wrote to memory of 1660 2788 Ephhmn32.exe Eiplecnc.exe PID 2788 wrote to memory of 1660 2788 Ephhmn32.exe Eiplecnc.exe PID 1660 wrote to memory of 2644 1660 Eiplecnc.exe Ebhani32.exe PID 1660 wrote to memory of 2644 1660 Eiplecnc.exe Ebhani32.exe PID 1660 wrote to memory of 2644 1660 Eiplecnc.exe Ebhani32.exe PID 1660 wrote to memory of 2644 1660 Eiplecnc.exe Ebhani32.exe PID 2644 wrote to memory of 836 2644 Ebhani32.exe Emnelbdi.exe PID 2644 wrote to memory of 836 2644 Ebhani32.exe Emnelbdi.exe PID 2644 wrote to memory of 836 2644 Ebhani32.exe Emnelbdi.exe PID 2644 wrote to memory of 836 2644 Ebhani32.exe Emnelbdi.exe PID 836 wrote to memory of 1168 836 Emnelbdi.exe Ljakkd32.exe PID 836 wrote to memory of 1168 836 Emnelbdi.exe Ljakkd32.exe PID 836 wrote to memory of 1168 836 Emnelbdi.exe Ljakkd32.exe PID 836 wrote to memory of 1168 836 Emnelbdi.exe Ljakkd32.exe PID 1168 wrote to memory of 1676 1168 Eeijpdbd.exe Hfmcapna.exe PID 1168 wrote to memory of 1676 1168 Eeijpdbd.exe Hfmcapna.exe PID 1168 wrote to memory of 1676 1168 Eeijpdbd.exe Hfmcapna.exe PID 1168 wrote to memory of 1676 1168 Eeijpdbd.exe Hfmcapna.exe PID 1676 wrote to memory of 2044 1676 Eoanij32.exe Eleobngo.exe PID 1676 wrote to memory of 2044 1676 Eoanij32.exe Eleobngo.exe PID 1676 wrote to memory of 2044 1676 Eoanij32.exe Eleobngo.exe PID 1676 wrote to memory of 2044 1676 Eoanij32.exe Eleobngo.exe PID 2044 wrote to memory of 2980 2044 Eleobngo.exe Nhojjjhj.exe PID 2044 wrote to memory of 2980 2044 Eleobngo.exe Nhojjjhj.exe PID 2044 wrote to memory of 2980 2044 Eleobngo.exe Nhojjjhj.exe PID 2044 wrote to memory of 2980 2044 Eleobngo.exe Nhojjjhj.exe PID 2980 wrote to memory of 1828 2980 Fijolbfh.exe Fbbcdh32.exe PID 2980 wrote to memory of 1828 2980 Fijolbfh.exe Fbbcdh32.exe PID 2980 wrote to memory of 1828 2980 Fijolbfh.exe Fbbcdh32.exe PID 2980 wrote to memory of 1828 2980 Fijolbfh.exe Fbbcdh32.exe PID 1828 wrote to memory of 1968 1828 Fbbcdh32.exe Kkjeedio.exe PID 1828 wrote to memory of 1968 1828 Fbbcdh32.exe Kkjeedio.exe PID 1828 wrote to memory of 1968 1828 Fbbcdh32.exe Kkjeedio.exe PID 1828 wrote to memory of 1968 1828 Fbbcdh32.exe Kkjeedio.exe PID 1968 wrote to memory of 888 1968 Fkmhij32.exe Knkngp32.exe PID 1968 wrote to memory of 888 1968 Fkmhij32.exe Knkngp32.exe PID 1968 wrote to memory of 888 1968 Fkmhij32.exe Knkngp32.exe PID 1968 wrote to memory of 888 1968 Fkmhij32.exe Knkngp32.exe PID 888 wrote to memory of 680 888 Fokaoh32.exe Hdlkpd32.exe PID 888 wrote to memory of 680 888 Fokaoh32.exe Hdlkpd32.exe PID 888 wrote to memory of 680 888 Fokaoh32.exe Hdlkpd32.exe PID 888 wrote to memory of 680 888 Fokaoh32.exe Hdlkpd32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b8f60066c24e46fcee5f5220bf4a020N.exe"C:\Users\Admin\AppData\Local\Temp\7b8f60066c24e46fcee5f5220bf4a020N.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\Dlcfnk32.exeC:\Windows\system32\Dlcfnk32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\Dcojbm32.exeC:\Windows\system32\Dcojbm32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\Dndoof32.exeC:\Windows\system32\Dndoof32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\Dfpcdh32.exeC:\Windows\system32\Dfpcdh32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\Ephhmn32.exeC:\Windows\system32\Ephhmn32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\Eiplecnc.exeC:\Windows\system32\Eiplecnc.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\Ebhani32.exeC:\Windows\system32\Ebhani32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\Emnelbdi.exeC:\Windows\system32\Emnelbdi.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\Eeijpdbd.exeC:\Windows\system32\Eeijpdbd.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\Eoanij32.exeC:\Windows\system32\Eoanij32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\Eleobngo.exeC:\Windows\system32\Eleobngo.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\Fijolbfh.exeC:\Windows\system32\Fijolbfh.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\Fbbcdh32.exeC:\Windows\system32\Fbbcdh32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\Fkmhij32.exeC:\Windows\system32\Fkmhij32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\Fokaoh32.exeC:\Windows\system32\Fokaoh32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\Fomndhng.exeC:\Windows\system32\Fomndhng.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Windows\SysWOW64\Fdjfmolo.exeC:\Windows\system32\Fdjfmolo.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1496 -
C:\Windows\SysWOW64\Fmbkfd32.exeC:\Windows\system32\Fmbkfd32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Windows\SysWOW64\Gkfkoi32.exeC:\Windows\system32\Gkfkoi32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Windows\SysWOW64\Gdophn32.exeC:\Windows\system32\Gdophn32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Windows\SysWOW64\Gngdadoj.exeC:\Windows\system32\Gngdadoj.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Windows\SysWOW64\Ggphji32.exeC:\Windows\system32\Ggphji32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1196 -
C:\Windows\SysWOW64\Gllabp32.exeC:\Windows\system32\Gllabp32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Windows\SysWOW64\Gaiijgbi.exeC:\Windows\system32\Gaiijgbi.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Windows\SysWOW64\Glongpao.exeC:\Windows\system32\Glongpao.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Windows\SysWOW64\Glajmppm.exeC:\Windows\system32\Glajmppm.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Windows\SysWOW64\Hdloab32.exeC:\Windows\system32\Hdloab32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Windows\SysWOW64\Hobcok32.exeC:\Windows\system32\Hobcok32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Windows\SysWOW64\Hkidclbb.exeC:\Windows\system32\Hkidclbb.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Windows\SysWOW64\Hdailaib.exeC:\Windows\system32\Hdailaib.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Windows\SysWOW64\Hjnaehgj.exeC:\Windows\system32\Hjnaehgj.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Windows\SysWOW64\Hgbanlfc.exeC:\Windows\system32\Hgbanlfc.exe33⤵
- Executes dropped EXE
PID:2748 -
C:\Windows\SysWOW64\Hqjfgb32.exeC:\Windows\system32\Hqjfgb32.exe34⤵
- Executes dropped EXE
PID:2612 -
C:\Windows\SysWOW64\Iiekkdjo.exeC:\Windows\system32\Iiekkdjo.exe35⤵
- Executes dropped EXE
PID:2988 -
C:\Windows\SysWOW64\Ioochn32.exeC:\Windows\system32\Ioochn32.exe36⤵
- Executes dropped EXE
PID:1684 -
C:\Windows\SysWOW64\Ikfdmogp.exeC:\Windows\system32\Ikfdmogp.exe37⤵
- Executes dropped EXE
- Modifies registry class
PID:1252 -
C:\Windows\SysWOW64\Iijdfc32.exeC:\Windows\system32\Iijdfc32.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2924 -
C:\Windows\SysWOW64\Ingmoj32.exeC:\Windows\system32\Ingmoj32.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1788 -
C:\Windows\SysWOW64\Ikkmho32.exeC:\Windows\system32\Ikkmho32.exe40⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\SysWOW64\Iionacad.exeC:\Windows\system32\Iionacad.exe41⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\SysWOW64\Ijpjik32.exeC:\Windows\system32\Ijpjik32.exe42⤵
- Executes dropped EXE
PID:2824 -
C:\Windows\SysWOW64\Jgdkbo32.exeC:\Windows\system32\Jgdkbo32.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Windows\SysWOW64\Jalolemm.exeC:\Windows\system32\Jalolemm.exe44⤵
- Executes dropped EXE
PID:1804 -
C:\Windows\SysWOW64\Jnppei32.exeC:\Windows\system32\Jnppei32.exe45⤵
- Executes dropped EXE
PID:1816 -
C:\Windows\SysWOW64\Jgidnobg.exeC:\Windows\system32\Jgidnobg.exe46⤵
- Executes dropped EXE
PID:2180 -
C:\Windows\SysWOW64\Jpdibapb.exeC:\Windows\system32\Jpdibapb.exe47⤵
- Executes dropped EXE
PID:1860 -
C:\Windows\SysWOW64\Jfnaok32.exeC:\Windows\system32\Jfnaok32.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1284 -
C:\Windows\SysWOW64\Jpfehq32.exeC:\Windows\system32\Jpfehq32.exe49⤵
- Executes dropped EXE
PID:1508 -
C:\Windows\SysWOW64\Jecnpg32.exeC:\Windows\system32\Jecnpg32.exe50⤵
- Executes dropped EXE
PID:1648 -
C:\Windows\SysWOW64\Kphbmp32.exeC:\Windows\system32\Kphbmp32.exe51⤵
- Executes dropped EXE
PID:1608 -
C:\Windows\SysWOW64\Kbgnil32.exeC:\Windows\system32\Kbgnil32.exe52⤵
- Executes dropped EXE
PID:688 -
C:\Windows\SysWOW64\Kiafff32.exeC:\Windows\system32\Kiafff32.exe53⤵
- Executes dropped EXE
PID:2992 -
C:\Windows\SysWOW64\Kpkocpjj.exeC:\Windows\system32\Kpkocpjj.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2780 -
C:\Windows\SysWOW64\Kehgkgha.exeC:\Windows\system32\Kehgkgha.exe55⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\SysWOW64\Klapha32.exeC:\Windows\system32\Klapha32.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2772 -
C:\Windows\SysWOW64\Kanhph32.exeC:\Windows\system32\Kanhph32.exe57⤵
- Executes dropped EXE
PID:2624 -
C:\Windows\SysWOW64\Khhpmbeb.exeC:\Windows\system32\Khhpmbeb.exe58⤵
- Executes dropped EXE
PID:2704 -
C:\Windows\SysWOW64\Kaaeegkc.exeC:\Windows\system32\Kaaeegkc.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2728 -
C:\Windows\SysWOW64\Lhhmle32.exeC:\Windows\system32\Lhhmle32.exe60⤵
- Executes dropped EXE
PID:2000 -
C:\Windows\SysWOW64\Lcnqin32.exeC:\Windows\system32\Lcnqin32.exe61⤵
- Executes dropped EXE
PID:2136 -
C:\Windows\SysWOW64\Lhkiae32.exeC:\Windows\system32\Lhkiae32.exe62⤵
- Executes dropped EXE
PID:2556 -
C:\Windows\SysWOW64\Mcpmonea.exeC:\Windows\system32\Mcpmonea.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3024 -
C:\Windows\SysWOW64\Mhmfgdch.exeC:\Windows\system32\Mhmfgdch.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1692 -
C:\Windows\SysWOW64\Mnjnolap.exeC:\Windows\system32\Mnjnolap.exe65⤵
- Executes dropped EXE
- Modifies registry class
PID:236 -
C:\Windows\SysWOW64\Mhobldaf.exeC:\Windows\system32\Mhobldaf.exe66⤵PID:1964
-
C:\Windows\SysWOW64\Mahgejhf.exeC:\Windows\system32\Mahgejhf.exe67⤵
- Drops file in System32 directory
PID:272 -
C:\Windows\SysWOW64\Mhaobd32.exeC:\Windows\system32\Mhaobd32.exe68⤵PID:2280
-
C:\Windows\SysWOW64\Majdkifd.exeC:\Windows\system32\Majdkifd.exe69⤵PID:3032
-
C:\Windows\SysWOW64\Mkbhco32.exeC:\Windows\system32\Mkbhco32.exe70⤵PID:1600
-
C:\Windows\SysWOW64\Mdkmld32.exeC:\Windows\system32\Mdkmld32.exe71⤵PID:3052
-
C:\Windows\SysWOW64\Nncaejie.exeC:\Windows\system32\Nncaejie.exe72⤵PID:3068
-
C:\Windows\SysWOW64\Nodnmb32.exeC:\Windows\system32\Nodnmb32.exe73⤵
- Drops file in System32 directory
PID:2148 -
C:\Windows\SysWOW64\Nfnfjmgp.exeC:\Windows\system32\Nfnfjmgp.exe74⤵PID:2848
-
C:\Windows\SysWOW64\Nogjbbma.exeC:\Windows\system32\Nogjbbma.exe75⤵PID:2632
-
C:\Windows\SysWOW64\Nfqbol32.exeC:\Windows\system32\Nfqbol32.exe76⤵PID:1808
-
C:\Windows\SysWOW64\Noighakn.exeC:\Windows\system32\Noighakn.exe77⤵
- System Location Discovery: System Language Discovery
PID:1344 -
C:\Windows\SysWOW64\Nfcoel32.exeC:\Windows\system32\Nfcoel32.exe78⤵PID:856
-
C:\Windows\SysWOW64\Nokdnail.exeC:\Windows\system32\Nokdnail.exe79⤵PID:2424
-
C:\Windows\SysWOW64\Nfeljlqh.exeC:\Windows\system32\Nfeljlqh.exe80⤵PID:2260
-
C:\Windows\SysWOW64\Nkbdbbop.exeC:\Windows\system32\Nkbdbbop.exe81⤵PID:2600
-
C:\Windows\SysWOW64\Oqomkimg.exeC:\Windows\system32\Oqomkimg.exe82⤵PID:820
-
C:\Windows\SysWOW64\Okdahbmm.exeC:\Windows\system32\Okdahbmm.exe83⤵PID:1944
-
C:\Windows\SysWOW64\Oqajqi32.exeC:\Windows\system32\Oqajqi32.exe84⤵PID:2484
-
C:\Windows\SysWOW64\Okgnna32.exeC:\Windows\system32\Okgnna32.exe85⤵PID:2560
-
C:\Windows\SysWOW64\Onejjm32.exeC:\Windows\system32\Onejjm32.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2332 -
C:\Windows\SysWOW64\Ocbbbd32.exeC:\Windows\system32\Ocbbbd32.exe87⤵PID:1492
-
C:\Windows\SysWOW64\Onggom32.exeC:\Windows\system32\Onggom32.exe88⤵PID:2144
-
C:\Windows\SysWOW64\Ocdohdfc.exeC:\Windows\system32\Ocdohdfc.exe89⤵PID:2792
-
C:\Windows\SysWOW64\Oiahpkdj.exeC:\Windows\system32\Oiahpkdj.exe90⤵PID:3008
-
C:\Windows\SysWOW64\Opkpme32.exeC:\Windows\system32\Opkpme32.exe91⤵PID:2796
-
C:\Windows\SysWOW64\Ofehiocd.exeC:\Windows\system32\Ofehiocd.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:552 -
C:\Windows\SysWOW64\Plbaafak.exeC:\Windows\system32\Plbaafak.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2984 -
C:\Windows\SysWOW64\Pblinp32.exeC:\Windows\system32\Pblinp32.exe94⤵PID:2112
-
C:\Windows\SysWOW64\Pmamliin.exeC:\Windows\system32\Pmamliin.exe95⤵PID:1716
-
C:\Windows\SysWOW64\Pnbjca32.exeC:\Windows\system32\Pnbjca32.exe96⤵PID:1792
-
C:\Windows\SysWOW64\Pihnqj32.exeC:\Windows\system32\Pihnqj32.exe97⤵PID:860
-
C:\Windows\SysWOW64\Pbqbioeb.exeC:\Windows\system32\Pbqbioeb.exe98⤵
- Modifies registry class
PID:2900 -
C:\Windows\SysWOW64\Phmkaf32.exeC:\Windows\system32\Phmkaf32.exe99⤵PID:3056
-
C:\Windows\SysWOW64\Pngcnpkg.exeC:\Windows\system32\Pngcnpkg.exe100⤵PID:2536
-
C:\Windows\SysWOW64\Phphgf32.exeC:\Windows\system32\Phphgf32.exe101⤵PID:3040
-
C:\Windows\SysWOW64\Pmmppm32.exeC:\Windows\system32\Pmmppm32.exe102⤵PID:2212
-
C:\Windows\SysWOW64\Qhbdmeoe.exeC:\Windows\system32\Qhbdmeoe.exe103⤵PID:2852
-
C:\Windows\SysWOW64\Qolmip32.exeC:\Windows\system32\Qolmip32.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2592 -
C:\Windows\SysWOW64\Qhdabemb.exeC:\Windows\system32\Qhdabemb.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1584 -
C:\Windows\SysWOW64\Amaiklki.exeC:\Windows\system32\Amaiklki.exe106⤵PID:2700
-
C:\Windows\SysWOW64\Abnbccia.exeC:\Windows\system32\Abnbccia.exe107⤵PID:2680
-
C:\Windows\SysWOW64\Aihjpman.exeC:\Windows\system32\Aihjpman.exe108⤵PID:588
-
C:\Windows\SysWOW64\Abpohb32.exeC:\Windows\system32\Abpohb32.exe109⤵
- System Location Discovery: System Language Discovery
PID:1632 -
C:\Windows\SysWOW64\Aijgemok.exeC:\Windows\system32\Aijgemok.exe110⤵
- Modifies registry class
PID:2528 -
C:\Windows\SysWOW64\Abbknb32.exeC:\Windows\system32\Abbknb32.exe111⤵PID:2296
-
C:\Windows\SysWOW64\Ahpdficc.exeC:\Windows\system32\Ahpdficc.exe112⤵PID:2452
-
C:\Windows\SysWOW64\Abehcbci.exeC:\Windows\system32\Abehcbci.exe113⤵PID:2116
-
C:\Windows\SysWOW64\Aioppl32.exeC:\Windows\system32\Aioppl32.exe114⤵
- Modifies registry class
PID:2920 -
C:\Windows\SysWOW64\Aolihc32.exeC:\Windows\system32\Aolihc32.exe115⤵PID:2864
-
C:\Windows\SysWOW64\Aefaemqj.exeC:\Windows\system32\Aefaemqj.exe116⤵
- Modifies registry class
PID:1364 -
C:\Windows\SysWOW64\Bkbjmd32.exeC:\Windows\system32\Bkbjmd32.exe117⤵PID:2596
-
C:\Windows\SysWOW64\Behnkm32.exeC:\Windows\system32\Behnkm32.exe118⤵
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Windows\SysWOW64\Bgijbede.exeC:\Windows\system32\Bgijbede.exe119⤵
- System Location Discovery: System Language Discovery
PID:1096 -
C:\Windows\SysWOW64\Baoopndk.exeC:\Windows\system32\Baoopndk.exe120⤵
- Drops file in System32 directory
PID:1680 -
C:\Windows\SysWOW64\Bglghdbc.exeC:\Windows\system32\Bglghdbc.exe121⤵PID:2224
-
C:\Windows\SysWOW64\Bnfodojp.exeC:\Windows\system32\Bnfodojp.exe122⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1304 -
C:\Windows\SysWOW64\Bkjpncii.exeC:\Windows\system32\Bkjpncii.exe123⤵
- System Location Discovery: System Language Discovery
PID:2856 -
C:\Windows\SysWOW64\Blklfk32.exeC:\Windows\system32\Blklfk32.exe124⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1228 -
C:\Windows\SysWOW64\Bfcqoqeh.exeC:\Windows\system32\Bfcqoqeh.exe125⤵PID:576
-
C:\Windows\SysWOW64\Blmikkle.exeC:\Windows\system32\Blmikkle.exe126⤵PID:2696
-
C:\Windows\SysWOW64\Cgcmiclk.exeC:\Windows\system32\Cgcmiclk.exe127⤵PID:632
-
C:\Windows\SysWOW64\Clpeajjb.exeC:\Windows\system32\Clpeajjb.exe128⤵PID:824
-
C:\Windows\SysWOW64\Cblniaii.exeC:\Windows\system32\Cblniaii.exe129⤵PID:2088
-
C:\Windows\SysWOW64\Chfffk32.exeC:\Windows\system32\Chfffk32.exe130⤵PID:2468
-
C:\Windows\SysWOW64\Cclkcdpl.exeC:\Windows\system32\Cclkcdpl.exe131⤵PID:2832
-
C:\Windows\SysWOW64\Cldolj32.exeC:\Windows\system32\Cldolj32.exe132⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2636 -
C:\Windows\SysWOW64\Cbagdq32.exeC:\Windows\system32\Cbagdq32.exe133⤵PID:2684
-
C:\Windows\SysWOW64\Chkpakla.exeC:\Windows\system32\Chkpakla.exe134⤵PID:2960
-
C:\Windows\SysWOW64\Coehnecn.exeC:\Windows\system32\Coehnecn.exe135⤵PID:2328
-
C:\Windows\SysWOW64\Cqfdem32.exeC:\Windows\system32\Cqfdem32.exe136⤵PID:2196
-
C:\Windows\SysWOW64\Dklibf32.exeC:\Windows\system32\Dklibf32.exe137⤵PID:2532
-
C:\Windows\SysWOW64\Dbfaopqo.exeC:\Windows\system32\Dbfaopqo.exe138⤵PID:1848
-
C:\Windows\SysWOW64\Dcgmgh32.exeC:\Windows\system32\Dcgmgh32.exe139⤵
- System Location Discovery: System Language Discovery
PID:2360 -
C:\Windows\SysWOW64\Dknehe32.exeC:\Windows\system32\Dknehe32.exe140⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2628 -
C:\Windows\SysWOW64\Dqknqleg.exeC:\Windows\system32\Dqknqleg.exe141⤵PID:2888
-
C:\Windows\SysWOW64\Dcijmhdj.exeC:\Windows\system32\Dcijmhdj.exe142⤵
- Drops file in System32 directory
PID:532 -
C:\Windows\SysWOW64\Dmaoem32.exeC:\Windows\system32\Dmaoem32.exe143⤵
- Modifies registry class
PID:2396 -
C:\Windows\SysWOW64\Dopkai32.exeC:\Windows\system32\Dopkai32.exe144⤵
- Drops file in System32 directory
PID:1844 -
C:\Windows\SysWOW64\Dihojnqo.exeC:\Windows\system32\Dihojnqo.exe145⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1976 -
C:\Windows\SysWOW64\Eapcjo32.exeC:\Windows\system32\Eapcjo32.exe146⤵PID:764
-
C:\Windows\SysWOW64\Fhlhmi32.exeC:\Windows\system32\Fhlhmi32.exe147⤵PID:1960
-
C:\Windows\SysWOW64\Fadmenpg.exeC:\Windows\system32\Fadmenpg.exe148⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2140 -
C:\Windows\SysWOW64\Flnnfllf.exeC:\Windows\system32\Flnnfllf.exe149⤵
- System Location Discovery: System Language Discovery
PID:976 -
C:\Windows\SysWOW64\Fefboabg.exeC:\Windows\system32\Fefboabg.exe150⤵
- Modifies registry class
PID:988 -
C:\Windows\SysWOW64\Fplgljbm.exeC:\Windows\system32\Fplgljbm.exe151⤵
- Modifies registry class
PID:1652 -
C:\Windows\SysWOW64\Fehodaqd.exeC:\Windows\system32\Fehodaqd.exe152⤵PID:692
-
C:\Windows\SysWOW64\Flbgak32.exeC:\Windows\system32\Flbgak32.exe153⤵PID:1728
-
C:\Windows\SysWOW64\Fblpnepn.exeC:\Windows\system32\Fblpnepn.exe154⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1544 -
C:\Windows\SysWOW64\Gledgkfn.exeC:\Windows\system32\Gledgkfn.exe155⤵PID:968
-
C:\Windows\SysWOW64\Gbolce32.exeC:\Windows\system32\Gbolce32.exe156⤵PID:2540
-
C:\Windows\SysWOW64\Glgqlkdl.exeC:\Windows\system32\Glgqlkdl.exe157⤵PID:3044
-
C:\Windows\SysWOW64\Goemhfco.exeC:\Windows\system32\Goemhfco.exe158⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2440 -
C:\Windows\SysWOW64\Gdbeqmag.exeC:\Windows\system32\Gdbeqmag.exe159⤵PID:2776
-
C:\Windows\SysWOW64\Ggqamh32.exeC:\Windows\system32\Ggqamh32.exe160⤵PID:2964
-
C:\Windows\SysWOW64\Gaffja32.exeC:\Windows\system32\Gaffja32.exe161⤵
- Modifies registry class
PID:2732 -
C:\Windows\SysWOW64\Gddbfm32.exeC:\Windows\system32\Gddbfm32.exe162⤵PID:1744
-
C:\Windows\SysWOW64\Gkojcgga.exeC:\Windows\system32\Gkojcgga.exe163⤵PID:2288
-
C:\Windows\SysWOW64\Gaibpa32.exeC:\Windows\system32\Gaibpa32.exe164⤵PID:1736
-
C:\Windows\SysWOW64\Gcjogidl.exeC:\Windows\system32\Gcjogidl.exe165⤵PID:2352
-
C:\Windows\SysWOW64\Gidgdcli.exeC:\Windows\system32\Gidgdcli.exe166⤵PID:3116
-
C:\Windows\SysWOW64\Hdilalko.exeC:\Windows\system32\Hdilalko.exe167⤵PID:3180
-
C:\Windows\SysWOW64\Hekhid32.exeC:\Windows\system32\Hekhid32.exe168⤵PID:3236
-
C:\Windows\SysWOW64\Hpplfm32.exeC:\Windows\system32\Hpplfm32.exe169⤵PID:3308
-
C:\Windows\SysWOW64\Hgjdcghp.exeC:\Windows\system32\Hgjdcghp.exe170⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3360 -
C:\Windows\SysWOW64\Hlgmkn32.exeC:\Windows\system32\Hlgmkn32.exe171⤵PID:3420
-
C:\Windows\SysWOW64\Hadece32.exeC:\Windows\system32\Hadece32.exe172⤵
- System Location Discovery: System Language Discovery
PID:3460 -
C:\Windows\SysWOW64\Hhnnpolk.exeC:\Windows\system32\Hhnnpolk.exe173⤵
- Drops file in System32 directory
PID:3500 -
C:\Windows\SysWOW64\Hohfmi32.exeC:\Windows\system32\Hohfmi32.exe174⤵PID:3540
-
C:\Windows\SysWOW64\Hfanjcke.exeC:\Windows\system32\Hfanjcke.exe175⤵PID:3580
-
C:\Windows\SysWOW64\Hllffmbb.exeC:\Windows\system32\Hllffmbb.exe176⤵PID:3620
-
C:\Windows\SysWOW64\Hojbbiae.exeC:\Windows\system32\Hojbbiae.exe177⤵PID:3660
-
C:\Windows\SysWOW64\Hfdkoc32.exeC:\Windows\system32\Hfdkoc32.exe178⤵
- System Location Discovery: System Language Discovery
PID:3700 -
C:\Windows\SysWOW64\Igeggkoq.exeC:\Windows\system32\Igeggkoq.exe179⤵PID:3740
-
C:\Windows\SysWOW64\Inopce32.exeC:\Windows\system32\Inopce32.exe180⤵
- System Location Discovery: System Language Discovery
PID:3780 -
C:\Windows\SysWOW64\Idihponj.exeC:\Windows\system32\Idihponj.exe181⤵
- Modifies registry class
PID:3820 -
C:\Windows\SysWOW64\Ikcpmieg.exeC:\Windows\system32\Ikcpmieg.exe182⤵PID:3860
-
C:\Windows\SysWOW64\Ibmhjc32.exeC:\Windows\system32\Ibmhjc32.exe183⤵PID:3900
-
C:\Windows\SysWOW64\Icnealbb.exeC:\Windows\system32\Icnealbb.exe184⤵
- Drops file in System32 directory
PID:3944 -
C:\Windows\SysWOW64\Indiodbh.exeC:\Windows\system32\Indiodbh.exe185⤵PID:3984
-
C:\Windows\SysWOW64\Idnako32.exeC:\Windows\system32\Idnako32.exe186⤵
- System Location Discovery: System Language Discovery
PID:4024 -
C:\Windows\SysWOW64\Iccnmk32.exeC:\Windows\system32\Iccnmk32.exe187⤵PID:4064
-
C:\Windows\SysWOW64\Ijmfiefj.exeC:\Windows\system32\Ijmfiefj.exe188⤵PID:2052
-
C:\Windows\SysWOW64\Iqgofo32.exeC:\Windows\system32\Iqgofo32.exe189⤵PID:1616
-
C:\Windows\SysWOW64\Jfdgnf32.exeC:\Windows\system32\Jfdgnf32.exe190⤵PID:872
-
C:\Windows\SysWOW64\Jibcja32.exeC:\Windows\system32\Jibcja32.exe191⤵PID:2940
-
C:\Windows\SysWOW64\Jchhhjjg.exeC:\Windows\system32\Jchhhjjg.exe192⤵PID:3124
-
C:\Windows\SysWOW64\Jeidob32.exeC:\Windows\system32\Jeidob32.exe193⤵PID:3176
-
C:\Windows\SysWOW64\Jkcllmhb.exeC:\Windows\system32\Jkcllmhb.exe194⤵PID:3280
-
C:\Windows\SysWOW64\Jbmdig32.exeC:\Windows\system32\Jbmdig32.exe195⤵PID:3232
-
C:\Windows\SysWOW64\Jigmeagl.exeC:\Windows\system32\Jigmeagl.exe196⤵PID:3300
-
C:\Windows\SysWOW64\Jncenh32.exeC:\Windows\system32\Jncenh32.exe197⤵PID:3340
-
C:\Windows\SysWOW64\Jennjblp.exeC:\Windows\system32\Jennjblp.exe198⤵
- System Location Discovery: System Language Discovery
PID:3388 -
C:\Windows\SysWOW64\Jkgfgl32.exeC:\Windows\system32\Jkgfgl32.exe199⤵
- Drops file in System32 directory
PID:3432 -
C:\Windows\SysWOW64\Jbandfkj.exeC:\Windows\system32\Jbandfkj.exe200⤵PID:3484
-
C:\Windows\SysWOW64\Jccjln32.exeC:\Windows\system32\Jccjln32.exe201⤵
- System Location Discovery: System Language Discovery
PID:3532 -
C:\Windows\SysWOW64\Jkjbml32.exeC:\Windows\system32\Jkjbml32.exe202⤵
- Drops file in System32 directory
PID:3588 -
C:\Windows\SysWOW64\Kagkebpb.exeC:\Windows\system32\Kagkebpb.exe203⤵PID:3636
-
C:\Windows\SysWOW64\Kfccmini.exeC:\Windows\system32\Kfccmini.exe204⤵PID:3684
-
C:\Windows\SysWOW64\Kmnljc32.exeC:\Windows\system32\Kmnljc32.exe205⤵
- System Location Discovery: System Language Discovery
PID:3724 -
C:\Windows\SysWOW64\Kcgdgnmc.exeC:\Windows\system32\Kcgdgnmc.exe206⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3776 -
C:\Windows\SysWOW64\Kjalch32.exeC:\Windows\system32\Kjalch32.exe207⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3832 -
C:\Windows\SysWOW64\Kakdpb32.exeC:\Windows\system32\Kakdpb32.exe208⤵PID:3836
-
C:\Windows\SysWOW64\Kcjqlm32.exeC:\Windows\system32\Kcjqlm32.exe209⤵PID:3936
-
C:\Windows\SysWOW64\Kjdiigbm.exeC:\Windows\system32\Kjdiigbm.exe210⤵PID:3976
-
C:\Windows\SysWOW64\Kmbeecaq.exeC:\Windows\system32\Kmbeecaq.exe211⤵PID:4040
-
C:\Windows\SysWOW64\Kclmbm32.exeC:\Windows\system32\Kclmbm32.exe212⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4088 -
C:\Windows\SysWOW64\Kemjieol.exeC:\Windows\system32\Kemjieol.exe213⤵PID:1396
-
C:\Windows\SysWOW64\Kmdbkbpn.exeC:\Windows\system32\Kmdbkbpn.exe214⤵PID:2840
-
C:\Windows\SysWOW64\Kbajci32.exeC:\Windows\system32\Kbajci32.exe215⤵PID:2392
-
C:\Windows\SysWOW64\Lhnckp32.exeC:\Windows\system32\Lhnckp32.exe216⤵
- Drops file in System32 directory
PID:3156 -
C:\Windows\SysWOW64\Lohkhjcj.exeC:\Windows\system32\Lohkhjcj.exe217⤵PID:3140
-
C:\Windows\SysWOW64\Lebcdd32.exeC:\Windows\system32\Lebcdd32.exe218⤵PID:1784
-
C:\Windows\SysWOW64\Lllkaobc.exeC:\Windows\system32\Lllkaobc.exe219⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3352 -
C:\Windows\SysWOW64\Laidie32.exeC:\Windows\system32\Laidie32.exe220⤵PID:3396
-
C:\Windows\SysWOW64\Ldgpea32.exeC:\Windows\system32\Ldgpea32.exe221⤵PID:3456
-
C:\Windows\SysWOW64\Lkahbkgk.exeC:\Windows\system32\Lkahbkgk.exe222⤵PID:3528
-
C:\Windows\SysWOW64\Lakqoe32.exeC:\Windows\system32\Lakqoe32.exe223⤵PID:3568
-
C:\Windows\SysWOW64\Ldjmkq32.exeC:\Windows\system32\Ldjmkq32.exe224⤵PID:3516
-
C:\Windows\SysWOW64\Lkcehkeh.exeC:\Windows\system32\Lkcehkeh.exe225⤵PID:3560
-
C:\Windows\SysWOW64\Lmbadfdl.exeC:\Windows\system32\Lmbadfdl.exe226⤵PID:3764
-
C:\Windows\SysWOW64\Lhgeao32.exeC:\Windows\system32\Lhgeao32.exe227⤵PID:3816
-
C:\Windows\SysWOW64\Lmdnjf32.exeC:\Windows\system32\Lmdnjf32.exe228⤵
- Drops file in System32 directory
PID:3800 -
C:\Windows\SysWOW64\Mdnffpif.exeC:\Windows\system32\Mdnffpif.exe229⤵PID:3952
-
C:\Windows\SysWOW64\Mkhocj32.exeC:\Windows\system32\Mkhocj32.exe230⤵PID:3960
-
C:\Windows\SysWOW64\Mlikkbga.exeC:\Windows\system32\Mlikkbga.exe231⤵PID:4060
-
C:\Windows\SysWOW64\Mgoohk32.exeC:\Windows\system32\Mgoohk32.exe232⤵PID:768
-
C:\Windows\SysWOW64\Mmigdend.exeC:\Windows\system32\Mmigdend.exe233⤵PID:4084
-
C:\Windows\SysWOW64\Mojdlm32.exeC:\Windows\system32\Mojdlm32.exe234⤵
- System Location Discovery: System Language Discovery
PID:1672 -
C:\Windows\SysWOW64\Medligko.exeC:\Windows\system32\Medligko.exe235⤵PID:2272
-
C:\Windows\SysWOW64\Mlndfa32.exeC:\Windows\system32\Mlndfa32.exe236⤵PID:3248
-
C:\Windows\SysWOW64\Makmnh32.exeC:\Windows\system32\Makmnh32.exe237⤵PID:3336
-
C:\Windows\SysWOW64\Mheekb32.exeC:\Windows\system32\Mheekb32.exe238⤵PID:3400
-
C:\Windows\SysWOW64\Moomgmpm.exeC:\Windows\system32\Moomgmpm.exe239⤵PID:3468
-
C:\Windows\SysWOW64\Meiedg32.exeC:\Windows\system32\Meiedg32.exe240⤵PID:3552
-
C:\Windows\SysWOW64\Mhgbpb32.exeC:\Windows\system32\Mhgbpb32.exe241⤵PID:3628
-
C:\Windows\SysWOW64\Nndjhi32.exeC:\Windows\system32\Nndjhi32.exe242⤵PID:3600