Analysis
-
max time kernel
53s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
27-07-2024 01:48
Static task
static1
Behavioral task
behavioral1
Sample
7cdf8455aa49774aa8a4c28f2a4e9d50N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7cdf8455aa49774aa8a4c28f2a4e9d50N.exe
Resource
win10v2004-20240709-en
General
-
Target
7cdf8455aa49774aa8a4c28f2a4e9d50N.exe
-
Size
479KB
-
MD5
7cdf8455aa49774aa8a4c28f2a4e9d50
-
SHA1
016f0c19c4be8b722b940b633c54ce96dd12032b
-
SHA256
a575ab38fc1c37a9307452e7d974d649a403977e69f611e2490790b4183ea569
-
SHA512
5bdf05454237ad9ce6b9db98810b32e713531a7abe3bd33956bf3f36c61f313f3df843878dc8b189da7b361a6e8c0b2731106458cb9e9c8c03be067d3216dc54
-
SSDEEP
6144:6phK3POwXYrMdlvkGr0f+uPOwXYrMdl2MPnhd8+ZDI:SlwIaJwISfPI
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Pkfghh32.exeBfmqigba.exeAkdafn32.exeFigocipe.exeIickckcl.exeJojloc32.exeCpiaipmh.exeNhcebj32.exeNknimnap.exeIoeclg32.exeAedlhg32.exeHnbaif32.exeIjcngenj.exeEgkehllh.exeNgcanq32.exeKhldkllj.exeKaholp32.exePehebbbh.exeBeadgdli.exe7cdf8455aa49774aa8a4c28f2a4e9d50N.exeOnqkclni.exePaaddgkj.exeAcicla32.exeGeilah32.exeIcoepohq.exeOckbdebl.exeQmepanje.exeHjggap32.exeNlbgkgcc.exeLimhpihl.exeDmijfmfi.exeKambcbhb.exeLhfpdi32.exeHiockd32.exeLhfnkqgk.exeJbcelp32.exeAjjgei32.exeBmjekahk.exeNifgekbm.exeAklabp32.exeJoblkegc.exePpipdl32.exeEfoifiep.exeMbopon32.exeHgeelf32.exeOplgeoea.exeCnipak32.exeCkkenikc.exeIgbqdlea.exeLdbjdj32.exeDnckki32.exeJndflk32.exeHkpnjd32.exeMeemgk32.exeHbpbck32.exeEhjqgjmp.exeEmdeok32.exeBjbqmi32.exeBfiabjjm.exeDncibp32.exeDafoikjb.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pkfghh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bfmqigba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Akdafn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Figocipe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iickckcl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jojloc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cpiaipmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nhcebj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nknimnap.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ioeclg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aedlhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Figocipe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnbaif32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijcngenj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Egkehllh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngcanq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Khldkllj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kaholp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pehebbbh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Beadgdli.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 7cdf8455aa49774aa8a4c28f2a4e9d50N.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onqkclni.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Paaddgkj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Acicla32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Geilah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Icoepohq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ockbdebl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qmepanje.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjggap32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nlbgkgcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nlbgkgcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Limhpihl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dmijfmfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kambcbhb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lhfpdi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hiockd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lhfnkqgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jbcelp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajjgei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bmjekahk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nifgekbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aklabp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Joblkegc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ppipdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Efoifiep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mbopon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hgeelf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oplgeoea.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnipak32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckkenikc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Igbqdlea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ldbjdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ajjgei32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnckki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jndflk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hkpnjd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Meemgk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hbpbck32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ehjqgjmp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emdeok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bjbqmi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfiabjjm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dncibp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dafoikjb.exe -
Executes dropped EXE 64 IoCs
Processes:
Kekiphge.exeKdpfadlm.exeKnkgpi32.exeLhpglecl.exeMobfgdcl.exeNmkplgnq.exeNjfjnpgp.exePhlclgfc.exePljlbf32.exeAhpifj32.exeAdnpkjde.exeBjpaop32.exeCjonncab.exeCnmfdb32.exeDfkhndca.exeDmijfmfi.exeEbklic32.exeEhjqgjmp.exeFlocfmnl.exeFeggob32.exeFplllkdc.exeFpohakbp.exeFdqnkoep.exeGkmbmh32.exeGlchpp32.exeGjgiidkl.exeGqcnln32.exeHegpjaac.exeHomdhjai.exeHnbaif32.exeIkfbbjdj.exeIjnkifgp.exeIlcalnii.exeJlhkgm32.exeJieaofmp.exeKdkelolf.exeKbpbmkan.exeKpfplo32.exeLhfnkqgk.exeLdmopa32.exeLjldnhid.exeLnjldf32.exeModlbmmn.exeNjnmbk32.exeNknimnap.exeNckkgp32.exeNpbklabl.exeOeaqig32.exeOnlahm32.exeOalkih32.exeOnqkclni.exePaaddgkj.exePmhejhao.exePlmbkd32.exePpkjac32.exePopgboae.exeQbnphngk.exeQoeamo32.exeAklabp32.exeAcicla32.exeAjhddk32.exeBacihmoo.exeBdfooh32.exeBnochnpm.exepid process 2552 Kekiphge.exe 2240 Kdpfadlm.exe 2808 Knkgpi32.exe 3068 Lhpglecl.exe 1976 Mobfgdcl.exe 2984 Nmkplgnq.exe 2012 Njfjnpgp.exe 1752 Phlclgfc.exe 1644 Pljlbf32.exe 1480 Ahpifj32.exe 2548 Adnpkjde.exe 1988 Bjpaop32.exe 1404 Cjonncab.exe 1412 Cnmfdb32.exe 3052 Dfkhndca.exe 928 Dmijfmfi.exe 784 Ebklic32.exe 1272 Ehjqgjmp.exe 592 Flocfmnl.exe 1068 Feggob32.exe 2964 Fplllkdc.exe 2080 Fpohakbp.exe 1844 Fdqnkoep.exe 2432 Gkmbmh32.exe 2072 Glchpp32.exe 2116 Gjgiidkl.exe 2888 Gqcnln32.exe 2800 Hegpjaac.exe 2716 Homdhjai.exe 2712 Hnbaif32.exe 2648 Ikfbbjdj.exe 2664 Ijnkifgp.exe 2428 Ilcalnii.exe 2508 Jlhkgm32.exe 1724 Jieaofmp.exe 2436 Kdkelolf.exe 2356 Kbpbmkan.exe 1884 Kpfplo32.exe 2640 Lhfnkqgk.exe 1744 Ldmopa32.exe 980 Ljldnhid.exe 1484 Lnjldf32.exe 1444 Modlbmmn.exe 1452 Njnmbk32.exe 112 Nknimnap.exe 2520 Nckkgp32.exe 1656 Npbklabl.exe 2496 Oeaqig32.exe 2036 Onlahm32.exe 2260 Oalkih32.exe 2268 Onqkclni.exe 2828 Paaddgkj.exe 568 Pmhejhao.exe 1448 Plmbkd32.exe 2084 Ppkjac32.exe 1640 Popgboae.exe 1828 Qbnphngk.exe 2028 Qoeamo32.exe 2840 Aklabp32.exe 2944 Acicla32.exe 2968 Ajhddk32.exe 1572 Bacihmoo.exe 3048 Bdfooh32.exe 2124 Bnochnpm.exe -
Loads dropped DLL 64 IoCs
Processes:
7cdf8455aa49774aa8a4c28f2a4e9d50N.exeKekiphge.exeKdpfadlm.exeKnkgpi32.exeLhpglecl.exeMobfgdcl.exeNmkplgnq.exeNjfjnpgp.exePhlclgfc.exePljlbf32.exeAhpifj32.exeAdnpkjde.exeBjpaop32.exeCjonncab.exeCnmfdb32.exeDfkhndca.exeDmijfmfi.exeEbklic32.exeEhjqgjmp.exeFlocfmnl.exeFeggob32.exeFplllkdc.exeFpohakbp.exeFdqnkoep.exeGkmbmh32.exeGlchpp32.exeGjgiidkl.exeGqcnln32.exeHegpjaac.exeHomdhjai.exeHnbaif32.exeIkfbbjdj.exepid process 2196 7cdf8455aa49774aa8a4c28f2a4e9d50N.exe 2196 7cdf8455aa49774aa8a4c28f2a4e9d50N.exe 2552 Kekiphge.exe 2552 Kekiphge.exe 2240 Kdpfadlm.exe 2240 Kdpfadlm.exe 2808 Knkgpi32.exe 2808 Knkgpi32.exe 3068 Lhpglecl.exe 3068 Lhpglecl.exe 1976 Mobfgdcl.exe 1976 Mobfgdcl.exe 2984 Nmkplgnq.exe 2984 Nmkplgnq.exe 2012 Njfjnpgp.exe 2012 Njfjnpgp.exe 1752 Phlclgfc.exe 1752 Phlclgfc.exe 1644 Pljlbf32.exe 1644 Pljlbf32.exe 1480 Ahpifj32.exe 1480 Ahpifj32.exe 2548 Adnpkjde.exe 2548 Adnpkjde.exe 1988 Bjpaop32.exe 1988 Bjpaop32.exe 1404 Cjonncab.exe 1404 Cjonncab.exe 1412 Cnmfdb32.exe 1412 Cnmfdb32.exe 3052 Dfkhndca.exe 3052 Dfkhndca.exe 928 Dmijfmfi.exe 928 Dmijfmfi.exe 784 Ebklic32.exe 784 Ebklic32.exe 1272 Ehjqgjmp.exe 1272 Ehjqgjmp.exe 592 Flocfmnl.exe 592 Flocfmnl.exe 1068 Feggob32.exe 1068 Feggob32.exe 2964 Fplllkdc.exe 2964 Fplllkdc.exe 2080 Fpohakbp.exe 2080 Fpohakbp.exe 1844 Fdqnkoep.exe 1844 Fdqnkoep.exe 2432 Gkmbmh32.exe 2432 Gkmbmh32.exe 2072 Glchpp32.exe 2072 Glchpp32.exe 2116 Gjgiidkl.exe 2116 Gjgiidkl.exe 2888 Gqcnln32.exe 2888 Gqcnln32.exe 2800 Hegpjaac.exe 2800 Hegpjaac.exe 2716 Homdhjai.exe 2716 Homdhjai.exe 2712 Hnbaif32.exe 2712 Hnbaif32.exe 2648 Ikfbbjdj.exe 2648 Ikfbbjdj.exe -
Drops file in System32 directory 64 IoCs
Processes:
Lhfpdi32.exeNobndj32.exeBeadgdli.exeBedamd32.exeOabplobe.exeBfmqigba.exeHlpmmpam.exeLjeoimeg.exeNqbaic32.exeOekmceaf.exeNlbgkgcc.exeBnochnpm.exeLoclai32.exeDgfmep32.exeCgqmpkfg.exeEgebjmdn.exeJdidmf32.exeMpnngi32.exe7cdf8455aa49774aa8a4c28f2a4e9d50N.exeDmcfngde.exeGbcien32.exeGajjhkgh.exeGjljij32.exeGlklejoo.exeEiciig32.exeEphdjeol.exeAjjgei32.exeDcjjkkji.exeMdgkjopd.exeDckcnj32.exeDleelp32.exeKqmnadlk.exeLimhpihl.exeMeecaa32.exeIgpdnlgd.exePljlbf32.exeKambcbhb.exeFacdgl32.exePadccpal.exeLefikg32.exeGhaeoe32.exeOehicoom.exeCmmcpi32.exeMlolnllf.exeNohddd32.exeEbnmpemq.exeJobocn32.exeIjnkifgp.exeKlfmijae.exeChabmm32.exeHnbaif32.exeCjhabndo.exeMojbaham.exeKamlhl32.exeOdacbpee.exeNhnemdbf.exeFihfnp32.exeMpqjmh32.exeNgjoif32.exeCmkfji32.exeDfhdnn32.exedescription ioc process File created C:\Windows\SysWOW64\Cfleblle.dll Lhfpdi32.exe File opened for modification C:\Windows\SysWOW64\Odacbpee.exe Nobndj32.exe File created C:\Windows\SysWOW64\Bedamd32.exe Beadgdli.exe File created C:\Windows\SysWOW64\Akbieg32.dll Bedamd32.exe File created C:\Windows\SysWOW64\Hnbbaj32.dll Oabplobe.exe File created C:\Windows\SysWOW64\Aohiimmp.dll Bfmqigba.exe File created C:\Windows\SysWOW64\Hkejnl32.exe Hlpmmpam.exe File opened for modification C:\Windows\SysWOW64\Lmfgkh32.exe Ljeoimeg.exe File opened for modification C:\Windows\SysWOW64\Oninhgae.exe Nqbaic32.exe File created C:\Windows\SysWOW64\Ppcmfn32.exe Oekmceaf.exe File created C:\Windows\SysWOW64\Nifgekbm.exe Nlbgkgcc.exe File created C:\Windows\SysWOW64\Jefndikl.dll Bnochnpm.exe File opened for modification C:\Windows\SysWOW64\Lkjmfjmi.exe Loclai32.exe File created C:\Windows\SysWOW64\Dmcfngde.exe Dgfmep32.exe File created C:\Windows\SysWOW64\Hclmphpn.dll Cgqmpkfg.exe File created C:\Windows\SysWOW64\Efjpkj32.exe Egebjmdn.exe File created C:\Windows\SysWOW64\Jnbifl32.exe Jdidmf32.exe File created C:\Windows\SysWOW64\Mpqjmh32.exe Mpnngi32.exe File opened for modification C:\Windows\SysWOW64\Mpqjmh32.exe Mpnngi32.exe File created C:\Windows\SysWOW64\Dljdnm32.dll 7cdf8455aa49774aa8a4c28f2a4e9d50N.exe File opened for modification C:\Windows\SysWOW64\Djgfgkbo.exe Dmcfngde.exe File opened for modification C:\Windows\SysWOW64\Gjjafkpe.exe Gbcien32.exe File created C:\Windows\SysWOW64\Mpcmlh32.dll Gajjhkgh.exe File created C:\Windows\SysWOW64\Ghpkbn32.exe Gjljij32.exe File created C:\Windows\SysWOW64\Jjbpqjma.dll Glklejoo.exe File created C:\Windows\SysWOW64\Hipfaokh.dll Eiciig32.exe File created C:\Windows\SysWOW64\Ibdlbppo.dll Ephdjeol.exe File created C:\Windows\SysWOW64\Eaflfbko.dll Ajjgei32.exe File created C:\Windows\SysWOW64\Gmaonc32.dll Dcjjkkji.exe File created C:\Windows\SysWOW64\Makkcc32.exe Mdgkjopd.exe File created C:\Windows\SysWOW64\Hdcjdq32.dll Dckcnj32.exe File created C:\Windows\SysWOW64\Hpedjd32.dll Dleelp32.exe File created C:\Windows\SysWOW64\Caolfcmm.dll Kqmnadlk.exe File opened for modification C:\Windows\SysWOW64\Mfqiingf.exe Limhpihl.exe File opened for modification C:\Windows\SysWOW64\Mlolnllf.exe Meecaa32.exe File created C:\Windows\SysWOW64\Pcbiqgln.dll Igpdnlgd.exe File created C:\Windows\SysWOW64\Nmlfpfpl.dll Pljlbf32.exe File created C:\Windows\SysWOW64\Ijjnkj32.dll Kambcbhb.exe File opened for modification C:\Windows\SysWOW64\Ghaeoe32.exe Facdgl32.exe File created C:\Windows\SysWOW64\Ppipdl32.exe Padccpal.exe File created C:\Windows\SysWOW64\Ljeoimeg.exe Lefikg32.exe File opened for modification C:\Windows\SysWOW64\Enbogmnc.exe Eiciig32.exe File opened for modification C:\Windows\SysWOW64\Gajjhkgh.exe Ghaeoe32.exe File opened for modification C:\Windows\SysWOW64\Pgibdjln.exe Oehicoom.exe File opened for modification C:\Windows\SysWOW64\Cfehhn32.exe Cmmcpi32.exe File created C:\Windows\SysWOW64\Mlglpa32.dll Mlolnllf.exe File opened for modification C:\Windows\SysWOW64\Ncfmjc32.exe Nohddd32.exe File opened for modification C:\Windows\SysWOW64\Egkehllh.exe Ebnmpemq.exe File opened for modification C:\Windows\SysWOW64\Jgnchplb.exe Jobocn32.exe File opened for modification C:\Windows\SysWOW64\Ilcalnii.exe Ijnkifgp.exe File created C:\Windows\SysWOW64\Fjkjgclg.dll Klfmijae.exe File opened for modification C:\Windows\SysWOW64\Dckcnj32.exe Chabmm32.exe File opened for modification C:\Windows\SysWOW64\Ikfbbjdj.exe Hnbaif32.exe File created C:\Windows\SysWOW64\Cfoaho32.exe Cjhabndo.exe File opened for modification C:\Windows\SysWOW64\Mdgkjopd.exe Mojbaham.exe File created C:\Windows\SysWOW64\Dofohkkf.dll Kamlhl32.exe File opened for modification C:\Windows\SysWOW64\Ooidei32.exe Odacbpee.exe File created C:\Windows\SysWOW64\Dfpnca32.dll Nhnemdbf.exe File opened for modification C:\Windows\SysWOW64\Fmfocnjg.exe Fihfnp32.exe File opened for modification C:\Windows\SysWOW64\Nohddd32.exe Mpqjmh32.exe File created C:\Windows\SysWOW64\Ncfmjc32.exe Nohddd32.exe File created C:\Windows\SysWOW64\Oabplobe.exe Ngjoif32.exe File opened for modification C:\Windows\SysWOW64\Cmmcpi32.exe Cmkfji32.exe File opened for modification C:\Windows\SysWOW64\Dncibp32.exe Dfhdnn32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1300 2396 WerFault.exe Ohnemidj.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Feggob32.exeGjgiidkl.exeAcicla32.exeCjhabndo.exeOckbdebl.exeJgnchplb.exeJjnlikic.exeCfoaho32.exeDhpgfeao.exeAkdafn32.exeIfpelq32.exeLajkbp32.exeJobocn32.exeDcageqgm.exeOoidei32.exeFipbhd32.exeKcpcho32.exeGkmbmh32.exeLjldnhid.exeJjjdhc32.exeGmqkml32.exeNlbgkgcc.exeGhaeoe32.exeDckcnj32.exeFmaqgaae.exeNhnemdbf.exeLnjldf32.exeMeecaa32.exePofldf32.exeGdkebolm.exeNifgekbm.exeMacjgadf.exePhlclgfc.exeJieaofmp.exeKbpbmkan.exeFhbpkh32.exeGkcekfad.exePljnkodm.exeAedlhg32.exeLhapocoi.exeEdeclabl.exeDfkhndca.exeOnqkclni.exeHcepqh32.exeNqbaic32.exeHkejnl32.exeNjfjnpgp.exeBnochnpm.exeEmdeok32.exeEeagimdf.exeMojbaham.exeGpjfcali.exeKigibh32.exeAmglgn32.exe7cdf8455aa49774aa8a4c28f2a4e9d50N.exeKambcbhb.exeQdlipplq.exeNhcebj32.exeHiockd32.exePopgboae.exeCfanmogq.exeJefbnacn.exeFmnahilc.exeLhimji32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Feggob32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gjgiidkl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Acicla32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cjhabndo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ockbdebl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgnchplb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjnlikic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfoaho32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhpgfeao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Akdafn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ifpelq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lajkbp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jobocn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dcageqgm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ooidei32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fipbhd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kcpcho32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkmbmh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljldnhid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjjdhc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gmqkml32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlbgkgcc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghaeoe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dckcnj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmaqgaae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhnemdbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnjldf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Meecaa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pofldf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdkebolm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nifgekbm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Macjgadf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phlclgfc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jieaofmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbpbmkan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fhbpkh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkcekfad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pljnkodm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aedlhg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhapocoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edeclabl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfkhndca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onqkclni.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hcepqh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nqbaic32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkejnl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Njfjnpgp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bnochnpm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emdeok32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eeagimdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mojbaham.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpjfcali.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kigibh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Amglgn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7cdf8455aa49774aa8a4c28f2a4e9d50N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kambcbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qdlipplq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhcebj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hiockd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Popgboae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfanmogq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jefbnacn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmnahilc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhimji32.exe -
Modifies registry class 64 IoCs
Processes:
Chabmm32.exeLnjldf32.exeMlieoqgg.exeGlbdnbpk.exeJohoic32.exeIickckcl.exePehebbbh.exePofldf32.exeOnqkclni.exePmhejhao.exeFhbpkh32.exeBfiabjjm.exeIgbqdlea.exeCmppehkh.exeNhpfdaml.exeFnadkjlc.exeHlpmmpam.exePgibdjln.exeLadgkmlj.exeQmepanje.exeAbinjdad.exeAjdcofop.exeCjonncab.exeJnagmc32.exeHememgdi.exeEdeclabl.exeIoeclg32.exeMebnic32.exeBkcfjk32.exeMojbaham.exeDmcfngde.exeKmficl32.exeIhijhpdo.exeKdpfadlm.exeDmijfmfi.exeEbklic32.exeKbhbai32.exeLmfgkh32.exeHdbbnd32.exeCkkenikc.exeEhclbpic.exeAhpifj32.exeNomkfk32.exeJnifaajh.exeOoidei32.exeHnbaif32.exeDgfmep32.exeBjbqmi32.exeCnklgkap.exeMebpakbq.exeKdkelolf.exePpcmfn32.exePkfghh32.exePaaddgkj.exeEikimeff.exeGfcopl32.exeLkmldbcj.exeBihgmdih.exeDgnminke.exeQoeamo32.exePalpneop.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Chabmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lnjldf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mlieoqgg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Glbdnbpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Johoic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iickckcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pehebbbh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pofldf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Onqkclni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlfqea32.dll" Pmhejhao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fhbpkh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bfiabjjm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Igbqdlea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clgmpqdg.dll" Cmppehkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phcgcahd.dll" Nhpfdaml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fnadkjlc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhalab32.dll" Hlpmmpam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Godgdfic.dll" Pgibdjln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ladgkmlj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qmepanje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfbejp32.dll" Abinjdad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ajdcofop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cjonncab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jnagmc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hememgdi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Edeclabl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmdpgmhn.dll" Lnjldf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ioeclg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mebnic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cljamifd.dll" Bkcfjk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mojbaham.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dmcfngde.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kmficl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ihijhpdo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kdpfadlm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dmijfmfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ebklic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfopbgif.dll" Kbhbai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lmfgkh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hdbbnd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ckkenikc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ehclbpic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ahpifj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nomkfk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jnifaajh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ooidei32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hnbaif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njfaognh.dll" Fhbpkh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dgfmep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmmgbn32.dll" Bjbqmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkaegg32.dll" Cnklgkap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mebpakbq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kdkelolf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igmaaacj.dll" Ppcmfn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pkfghh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Paaddgkj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eikimeff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnahibcg.dll" Gfcopl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmnpoagb.dll" Lkmldbcj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bihgmdih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dgnminke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qoeamo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Palpneop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bjbqmi32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7cdf8455aa49774aa8a4c28f2a4e9d50N.exeKekiphge.exeKdpfadlm.exeKnkgpi32.exeLhpglecl.exeMobfgdcl.exeNmkplgnq.exeNjfjnpgp.exePhlclgfc.exePljlbf32.exeAhpifj32.exeAdnpkjde.exeBjpaop32.exeCjonncab.exeCnmfdb32.exeDfkhndca.exedescription pid process target process PID 2196 wrote to memory of 2552 2196 7cdf8455aa49774aa8a4c28f2a4e9d50N.exe Kekiphge.exe PID 2196 wrote to memory of 2552 2196 7cdf8455aa49774aa8a4c28f2a4e9d50N.exe Kekiphge.exe PID 2196 wrote to memory of 2552 2196 7cdf8455aa49774aa8a4c28f2a4e9d50N.exe Kekiphge.exe PID 2196 wrote to memory of 2552 2196 7cdf8455aa49774aa8a4c28f2a4e9d50N.exe Kekiphge.exe PID 2552 wrote to memory of 2240 2552 Kekiphge.exe Kdpfadlm.exe PID 2552 wrote to memory of 2240 2552 Kekiphge.exe Kdpfadlm.exe PID 2552 wrote to memory of 2240 2552 Kekiphge.exe Kdpfadlm.exe PID 2552 wrote to memory of 2240 2552 Kekiphge.exe Kdpfadlm.exe PID 2240 wrote to memory of 2808 2240 Kdpfadlm.exe Knkgpi32.exe PID 2240 wrote to memory of 2808 2240 Kdpfadlm.exe Knkgpi32.exe PID 2240 wrote to memory of 2808 2240 Kdpfadlm.exe Knkgpi32.exe PID 2240 wrote to memory of 2808 2240 Kdpfadlm.exe Knkgpi32.exe PID 2808 wrote to memory of 3068 2808 Knkgpi32.exe Lhpglecl.exe PID 2808 wrote to memory of 3068 2808 Knkgpi32.exe Lhpglecl.exe PID 2808 wrote to memory of 3068 2808 Knkgpi32.exe Lhpglecl.exe PID 2808 wrote to memory of 3068 2808 Knkgpi32.exe Lhpglecl.exe PID 3068 wrote to memory of 1976 3068 Lhpglecl.exe Mobfgdcl.exe PID 3068 wrote to memory of 1976 3068 Lhpglecl.exe Mobfgdcl.exe PID 3068 wrote to memory of 1976 3068 Lhpglecl.exe Mobfgdcl.exe PID 3068 wrote to memory of 1976 3068 Lhpglecl.exe Mobfgdcl.exe PID 1976 wrote to memory of 2984 1976 Mobfgdcl.exe Nmkplgnq.exe PID 1976 wrote to memory of 2984 1976 Mobfgdcl.exe Nmkplgnq.exe PID 1976 wrote to memory of 2984 1976 Mobfgdcl.exe Nmkplgnq.exe PID 1976 wrote to memory of 2984 1976 Mobfgdcl.exe Nmkplgnq.exe PID 2984 wrote to memory of 2012 2984 Nmkplgnq.exe Njfjnpgp.exe PID 2984 wrote to memory of 2012 2984 Nmkplgnq.exe Njfjnpgp.exe PID 2984 wrote to memory of 2012 2984 Nmkplgnq.exe Njfjnpgp.exe PID 2984 wrote to memory of 2012 2984 Nmkplgnq.exe Njfjnpgp.exe PID 2012 wrote to memory of 1752 2012 Njfjnpgp.exe Phlclgfc.exe PID 2012 wrote to memory of 1752 2012 Njfjnpgp.exe Phlclgfc.exe PID 2012 wrote to memory of 1752 2012 Njfjnpgp.exe Phlclgfc.exe PID 2012 wrote to memory of 1752 2012 Njfjnpgp.exe Phlclgfc.exe PID 1752 wrote to memory of 1644 1752 Phlclgfc.exe Pljlbf32.exe PID 1752 wrote to memory of 1644 1752 Phlclgfc.exe Pljlbf32.exe PID 1752 wrote to memory of 1644 1752 Phlclgfc.exe Pljlbf32.exe PID 1752 wrote to memory of 1644 1752 Phlclgfc.exe Pljlbf32.exe PID 1644 wrote to memory of 1480 1644 Pljlbf32.exe Ahpifj32.exe PID 1644 wrote to memory of 1480 1644 Pljlbf32.exe Ahpifj32.exe PID 1644 wrote to memory of 1480 1644 Pljlbf32.exe Ahpifj32.exe PID 1644 wrote to memory of 1480 1644 Pljlbf32.exe Ahpifj32.exe PID 1480 wrote to memory of 2548 1480 Ahpifj32.exe Adnpkjde.exe PID 1480 wrote to memory of 2548 1480 Ahpifj32.exe Adnpkjde.exe PID 1480 wrote to memory of 2548 1480 Ahpifj32.exe Adnpkjde.exe PID 1480 wrote to memory of 2548 1480 Ahpifj32.exe Adnpkjde.exe PID 2548 wrote to memory of 1988 2548 Adnpkjde.exe Bjpaop32.exe PID 2548 wrote to memory of 1988 2548 Adnpkjde.exe Bjpaop32.exe PID 2548 wrote to memory of 1988 2548 Adnpkjde.exe Bjpaop32.exe PID 2548 wrote to memory of 1988 2548 Adnpkjde.exe Bjpaop32.exe PID 1988 wrote to memory of 1404 1988 Bjpaop32.exe Cjonncab.exe PID 1988 wrote to memory of 1404 1988 Bjpaop32.exe Cjonncab.exe PID 1988 wrote to memory of 1404 1988 Bjpaop32.exe Cjonncab.exe PID 1988 wrote to memory of 1404 1988 Bjpaop32.exe Cjonncab.exe PID 1404 wrote to memory of 1412 1404 Cjonncab.exe Cnmfdb32.exe PID 1404 wrote to memory of 1412 1404 Cjonncab.exe Cnmfdb32.exe PID 1404 wrote to memory of 1412 1404 Cjonncab.exe Cnmfdb32.exe PID 1404 wrote to memory of 1412 1404 Cjonncab.exe Cnmfdb32.exe PID 1412 wrote to memory of 3052 1412 Cnmfdb32.exe Dfkhndca.exe PID 1412 wrote to memory of 3052 1412 Cnmfdb32.exe Dfkhndca.exe PID 1412 wrote to memory of 3052 1412 Cnmfdb32.exe Dfkhndca.exe PID 1412 wrote to memory of 3052 1412 Cnmfdb32.exe Dfkhndca.exe PID 3052 wrote to memory of 928 3052 Dfkhndca.exe Dmijfmfi.exe PID 3052 wrote to memory of 928 3052 Dfkhndca.exe Dmijfmfi.exe PID 3052 wrote to memory of 928 3052 Dfkhndca.exe Dmijfmfi.exe PID 3052 wrote to memory of 928 3052 Dfkhndca.exe Dmijfmfi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cdf8455aa49774aa8a4c28f2a4e9d50N.exe"C:\Users\Admin\AppData\Local\Temp\7cdf8455aa49774aa8a4c28f2a4e9d50N.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\Kekiphge.exeC:\Windows\system32\Kekiphge.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\Kdpfadlm.exeC:\Windows\system32\Kdpfadlm.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\Knkgpi32.exeC:\Windows\system32\Knkgpi32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\Lhpglecl.exeC:\Windows\system32\Lhpglecl.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\Mobfgdcl.exeC:\Windows\system32\Mobfgdcl.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\Nmkplgnq.exeC:\Windows\system32\Nmkplgnq.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\Njfjnpgp.exeC:\Windows\system32\Njfjnpgp.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\Phlclgfc.exeC:\Windows\system32\Phlclgfc.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\Pljlbf32.exeC:\Windows\system32\Pljlbf32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\Ahpifj32.exeC:\Windows\system32\Ahpifj32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\Adnpkjde.exeC:\Windows\system32\Adnpkjde.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\Bjpaop32.exeC:\Windows\system32\Bjpaop32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\Cjonncab.exeC:\Windows\system32\Cjonncab.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\Cnmfdb32.exeC:\Windows\system32\Cnmfdb32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\Dfkhndca.exeC:\Windows\system32\Dfkhndca.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\Dmijfmfi.exeC:\Windows\system32\Dmijfmfi.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:928 -
C:\Windows\SysWOW64\Ebklic32.exeC:\Windows\system32\Ebklic32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:784 -
C:\Windows\SysWOW64\Ehjqgjmp.exeC:\Windows\system32\Ehjqgjmp.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Windows\SysWOW64\Flocfmnl.exeC:\Windows\system32\Flocfmnl.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Windows\SysWOW64\Feggob32.exeC:\Windows\system32\Feggob32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1068 -
C:\Windows\SysWOW64\Fplllkdc.exeC:\Windows\system32\Fplllkdc.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Windows\SysWOW64\Fpohakbp.exeC:\Windows\system32\Fpohakbp.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Windows\SysWOW64\Fdqnkoep.exeC:\Windows\system32\Fdqnkoep.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Windows\SysWOW64\Gkmbmh32.exeC:\Windows\system32\Gkmbmh32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2432 -
C:\Windows\SysWOW64\Glchpp32.exeC:\Windows\system32\Glchpp32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Windows\SysWOW64\Gjgiidkl.exeC:\Windows\system32\Gjgiidkl.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2116 -
C:\Windows\SysWOW64\Gqcnln32.exeC:\Windows\system32\Gqcnln32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Windows\SysWOW64\Hegpjaac.exeC:\Windows\system32\Hegpjaac.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Windows\SysWOW64\Homdhjai.exeC:\Windows\system32\Homdhjai.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Windows\SysWOW64\Hnbaif32.exeC:\Windows\system32\Hnbaif32.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2712 -
C:\Windows\SysWOW64\Ikfbbjdj.exeC:\Windows\system32\Ikfbbjdj.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Windows\SysWOW64\Ijnkifgp.exeC:\Windows\system32\Ijnkifgp.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2664 -
C:\Windows\SysWOW64\Ilcalnii.exeC:\Windows\system32\Ilcalnii.exe34⤵
- Executes dropped EXE
PID:2428 -
C:\Windows\SysWOW64\Jlhkgm32.exeC:\Windows\system32\Jlhkgm32.exe35⤵
- Executes dropped EXE
PID:2508 -
C:\Windows\SysWOW64\Jieaofmp.exeC:\Windows\system32\Jieaofmp.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1724 -
C:\Windows\SysWOW64\Kdkelolf.exeC:\Windows\system32\Kdkelolf.exe37⤵
- Executes dropped EXE
- Modifies registry class
PID:2436 -
C:\Windows\SysWOW64\Kbpbmkan.exeC:\Windows\system32\Kbpbmkan.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2356 -
C:\Windows\SysWOW64\Kpfplo32.exeC:\Windows\system32\Kpfplo32.exe39⤵
- Executes dropped EXE
PID:1884 -
C:\Windows\SysWOW64\Lhfnkqgk.exeC:\Windows\system32\Lhfnkqgk.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2640 -
C:\Windows\SysWOW64\Ldmopa32.exeC:\Windows\system32\Ldmopa32.exe41⤵
- Executes dropped EXE
PID:1744 -
C:\Windows\SysWOW64\Ljldnhid.exeC:\Windows\system32\Ljldnhid.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:980 -
C:\Windows\SysWOW64\Lnjldf32.exeC:\Windows\system32\Lnjldf32.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1484 -
C:\Windows\SysWOW64\Modlbmmn.exeC:\Windows\system32\Modlbmmn.exe44⤵
- Executes dropped EXE
PID:1444 -
C:\Windows\SysWOW64\Njnmbk32.exeC:\Windows\system32\Njnmbk32.exe45⤵
- Executes dropped EXE
PID:1452 -
C:\Windows\SysWOW64\Nknimnap.exeC:\Windows\system32\Nknimnap.exe46⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:112 -
C:\Windows\SysWOW64\Nckkgp32.exeC:\Windows\system32\Nckkgp32.exe47⤵
- Executes dropped EXE
PID:2520 -
C:\Windows\SysWOW64\Npbklabl.exeC:\Windows\system32\Npbklabl.exe48⤵
- Executes dropped EXE
PID:1656 -
C:\Windows\SysWOW64\Oeaqig32.exeC:\Windows\system32\Oeaqig32.exe49⤵
- Executes dropped EXE
PID:2496 -
C:\Windows\SysWOW64\Onlahm32.exeC:\Windows\system32\Onlahm32.exe50⤵
- Executes dropped EXE
PID:2036 -
C:\Windows\SysWOW64\Oalkih32.exeC:\Windows\system32\Oalkih32.exe51⤵
- Executes dropped EXE
PID:2260 -
C:\Windows\SysWOW64\Onqkclni.exeC:\Windows\system32\Onqkclni.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2268 -
C:\Windows\SysWOW64\Paaddgkj.exeC:\Windows\system32\Paaddgkj.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2828 -
C:\Windows\SysWOW64\Pmhejhao.exeC:\Windows\system32\Pmhejhao.exe54⤵
- Executes dropped EXE
- Modifies registry class
PID:568 -
C:\Windows\SysWOW64\Plmbkd32.exeC:\Windows\system32\Plmbkd32.exe55⤵
- Executes dropped EXE
PID:1448 -
C:\Windows\SysWOW64\Ppkjac32.exeC:\Windows\system32\Ppkjac32.exe56⤵
- Executes dropped EXE
PID:2084 -
C:\Windows\SysWOW64\Popgboae.exeC:\Windows\system32\Popgboae.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1640 -
C:\Windows\SysWOW64\Qbnphngk.exeC:\Windows\system32\Qbnphngk.exe58⤵
- Executes dropped EXE
PID:1828 -
C:\Windows\SysWOW64\Qoeamo32.exeC:\Windows\system32\Qoeamo32.exe59⤵
- Executes dropped EXE
- Modifies registry class
PID:2028 -
C:\Windows\SysWOW64\Aklabp32.exeC:\Windows\system32\Aklabp32.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2840 -
C:\Windows\SysWOW64\Acicla32.exeC:\Windows\system32\Acicla32.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2944 -
C:\Windows\SysWOW64\Ajhddk32.exeC:\Windows\system32\Ajhddk32.exe62⤵
- Executes dropped EXE
PID:2968 -
C:\Windows\SysWOW64\Bacihmoo.exeC:\Windows\system32\Bacihmoo.exe63⤵
- Executes dropped EXE
PID:1572 -
C:\Windows\SysWOW64\Bdfooh32.exeC:\Windows\system32\Bdfooh32.exe64⤵
- Executes dropped EXE
PID:3048 -
C:\Windows\SysWOW64\Bnochnpm.exeC:\Windows\system32\Bnochnpm.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2124 -
C:\Windows\SysWOW64\Cjhabndo.exeC:\Windows\system32\Cjhabndo.exe66⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2668 -
C:\Windows\SysWOW64\Cfoaho32.exeC:\Windows\system32\Cfoaho32.exe67⤵
- System Location Discovery: System Language Discovery
PID:2492 -
C:\Windows\SysWOW64\Cfanmogq.exeC:\Windows\system32\Cfanmogq.exe68⤵
- System Location Discovery: System Language Discovery
PID:1652 -
C:\Windows\SysWOW64\Cmkfji32.exeC:\Windows\system32\Cmkfji32.exe69⤵
- Drops file in System32 directory
PID:1476 -
C:\Windows\SysWOW64\Cmmcpi32.exeC:\Windows\system32\Cmmcpi32.exe70⤵
- Drops file in System32 directory
PID:3004 -
C:\Windows\SysWOW64\Cfehhn32.exeC:\Windows\system32\Cfehhn32.exe71⤵PID:2644
-
C:\Windows\SysWOW64\Cmppehkh.exeC:\Windows\system32\Cmppehkh.exe72⤵
- Modifies registry class
PID:2484 -
C:\Windows\SysWOW64\Dfhdnn32.exeC:\Windows\system32\Dfhdnn32.exe73⤵
- Drops file in System32 directory
PID:760 -
C:\Windows\SysWOW64\Dncibp32.exeC:\Windows\system32\Dncibp32.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1632 -
C:\Windows\SysWOW64\Dadbdkld.exeC:\Windows\system32\Dadbdkld.exe75⤵PID:1556
-
C:\Windows\SysWOW64\Dafoikjb.exeC:\Windows\system32\Dafoikjb.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1720 -
C:\Windows\SysWOW64\Dhpgfeao.exeC:\Windows\system32\Dhpgfeao.exe77⤵
- System Location Discovery: System Language Discovery
PID:2456 -
C:\Windows\SysWOW64\Dcghkf32.exeC:\Windows\system32\Dcghkf32.exe78⤵PID:580
-
C:\Windows\SysWOW64\Edidqf32.exeC:\Windows\system32\Edidqf32.exe79⤵PID:2264
-
C:\Windows\SysWOW64\Emdeok32.exeC:\Windows\system32\Emdeok32.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2932 -
C:\Windows\SysWOW64\Eeagimdf.exeC:\Windows\system32\Eeagimdf.exe81⤵
- System Location Discovery: System Language Discovery
PID:1948 -
C:\Windows\SysWOW64\Fhbpkh32.exeC:\Windows\system32\Fhbpkh32.exe82⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2504 -
C:\Windows\SysWOW64\Famaimfe.exeC:\Windows\system32\Famaimfe.exe83⤵PID:2924
-
C:\Windows\SysWOW64\Fihfnp32.exeC:\Windows\system32\Fihfnp32.exe84⤵
- Drops file in System32 directory
PID:2292 -
C:\Windows\SysWOW64\Fmfocnjg.exeC:\Windows\system32\Fmfocnjg.exe85⤵PID:2608
-
C:\Windows\SysWOW64\Glklejoo.exeC:\Windows\system32\Glklejoo.exe86⤵
- Drops file in System32 directory
PID:2868 -
C:\Windows\SysWOW64\Gkcekfad.exeC:\Windows\system32\Gkcekfad.exe87⤵
- System Location Discovery: System Language Discovery
PID:2600 -
C:\Windows\SysWOW64\Gkebafoa.exeC:\Windows\system32\Gkebafoa.exe88⤵PID:1548
-
C:\Windows\SysWOW64\Gaagcpdl.exeC:\Windows\system32\Gaagcpdl.exe89⤵PID:1248
-
C:\Windows\SysWOW64\Hcepqh32.exeC:\Windows\system32\Hcepqh32.exe90⤵
- System Location Discovery: System Language Discovery
PID:1852 -
C:\Windows\SysWOW64\Hgeelf32.exeC:\Windows\system32\Hgeelf32.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2448 -
C:\Windows\SysWOW64\Hiioin32.exeC:\Windows\system32\Hiioin32.exe92⤵PID:3064
-
C:\Windows\SysWOW64\Ioeclg32.exeC:\Windows\system32\Ioeclg32.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:836 -
C:\Windows\SysWOW64\Iipejmko.exeC:\Windows\system32\Iipejmko.exe94⤵PID:2756
-
C:\Windows\SysWOW64\Ijcngenj.exeC:\Windows\system32\Ijcngenj.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:348 -
C:\Windows\SysWOW64\Jnagmc32.exeC:\Windows\system32\Jnagmc32.exe96⤵
- Modifies registry class
PID:880 -
C:\Windows\SysWOW64\Jjhgbd32.exeC:\Windows\system32\Jjhgbd32.exe97⤵PID:1968
-
C:\Windows\SysWOW64\Jjjdhc32.exeC:\Windows\system32\Jjjdhc32.exe98⤵
- System Location Discovery: System Language Discovery
PID:2748 -
C:\Windows\SysWOW64\Jipaip32.exeC:\Windows\system32\Jipaip32.exe99⤵PID:2620
-
C:\Windows\SysWOW64\Jefbnacn.exeC:\Windows\system32\Jefbnacn.exe100⤵
- System Location Discovery: System Language Discovery
PID:2744 -
C:\Windows\SysWOW64\Kambcbhb.exeC:\Windows\system32\Kambcbhb.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2148 -
C:\Windows\SysWOW64\Khjgel32.exeC:\Windows\system32\Khjgel32.exe102⤵PID:1952
-
C:\Windows\SysWOW64\Khldkllj.exeC:\Windows\system32\Khldkllj.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:848 -
C:\Windows\SysWOW64\Kdbepm32.exeC:\Windows\system32\Kdbepm32.exe104⤵PID:1584
-
C:\Windows\SysWOW64\Kbhbai32.exeC:\Windows\system32\Kbhbai32.exe105⤵
- Modifies registry class
PID:2172 -
C:\Windows\SysWOW64\Lgfjggll.exeC:\Windows\system32\Lgfjggll.exe106⤵PID:984
-
C:\Windows\SysWOW64\Loclai32.exeC:\Windows\system32\Loclai32.exe107⤵
- Drops file in System32 directory
PID:2524 -
C:\Windows\SysWOW64\Lkjmfjmi.exeC:\Windows\system32\Lkjmfjmi.exe108⤵PID:2948
-
C:\Windows\SysWOW64\Lhnmoo32.exeC:\Windows\system32\Lhnmoo32.exe109⤵PID:2192
-
C:\Windows\SysWOW64\Lnkege32.exeC:\Windows\system32\Lnkege32.exe110⤵PID:2752
-
C:\Windows\SysWOW64\Mebnic32.exeC:\Windows\system32\Mebnic32.exe111⤵
- Modifies registry class
PID:2184 -
C:\Windows\SysWOW64\Mojbaham.exeC:\Windows\system32\Mojbaham.exe112⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2848 -
C:\Windows\SysWOW64\Mdgkjopd.exeC:\Windows\system32\Mdgkjopd.exe113⤵
- Drops file in System32 directory
PID:2604 -
C:\Windows\SysWOW64\Makkcc32.exeC:\Windows\system32\Makkcc32.exe114⤵PID:756
-
C:\Windows\SysWOW64\Mcodqkbi.exeC:\Windows\system32\Mcodqkbi.exe115⤵PID:1304
-
C:\Windows\SysWOW64\Mlgiiaij.exeC:\Windows\system32\Mlgiiaij.exe116⤵PID:1196
-
C:\Windows\SysWOW64\Mlieoqgg.exeC:\Windows\system32\Mlieoqgg.exe117⤵
- Modifies registry class
PID:1764 -
C:\Windows\SysWOW64\Nhpfdaml.exeC:\Windows\system32\Nhpfdaml.exe118⤵
- Modifies registry class
PID:1156 -
C:\Windows\SysWOW64\Nomkfk32.exeC:\Windows\system32\Nomkfk32.exe119⤵
- Modifies registry class
PID:2280 -
C:\Windows\SysWOW64\Nbmdhfog.exeC:\Windows\system32\Nbmdhfog.exe120⤵PID:2472
-
C:\Windows\SysWOW64\Nqbaic32.exeC:\Windows\system32\Nqbaic32.exe121⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3060 -
C:\Windows\SysWOW64\Oninhgae.exeC:\Windows\system32\Oninhgae.exe122⤵PID:2636
-
C:\Windows\SysWOW64\Oplgeoea.exeC:\Windows\system32\Oplgeoea.exe123⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2880 -
C:\Windows\SysWOW64\Oekmceaf.exeC:\Windows\system32\Oekmceaf.exe124⤵
- Drops file in System32 directory
PID:660 -
C:\Windows\SysWOW64\Ppcmfn32.exeC:\Windows\system32\Ppcmfn32.exe125⤵
- Modifies registry class
PID:2988 -
C:\Windows\SysWOW64\Pljnkodm.exeC:\Windows\system32\Pljnkodm.exe126⤵
- System Location Discovery: System Language Discovery
PID:392 -
C:\Windows\SysWOW64\Paiche32.exeC:\Windows\system32\Paiche32.exe127⤵PID:1840
-
C:\Windows\SysWOW64\Palpneop.exeC:\Windows\system32\Palpneop.exe128⤵
- Modifies registry class
PID:2480 -
C:\Windows\SysWOW64\Qdlipplq.exeC:\Windows\system32\Qdlipplq.exe129⤵
- System Location Discovery: System Language Discovery
PID:3028 -
C:\Windows\SysWOW64\Qiiahgjh.exeC:\Windows\system32\Qiiahgjh.exe130⤵PID:2100
-
C:\Windows\SysWOW64\Qbafalph.exeC:\Windows\system32\Qbafalph.exe131⤵PID:2616
-
C:\Windows\SysWOW64\Aiknnf32.exeC:\Windows\system32\Aiknnf32.exe132⤵PID:1636
-
C:\Windows\SysWOW64\Abdbflnf.exeC:\Windows\system32\Abdbflnf.exe133⤵PID:1692
-
C:\Windows\SysWOW64\Aedlhg32.exeC:\Windows\system32\Aedlhg32.exe134⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:988 -
C:\Windows\SysWOW64\Akdafn32.exeC:\Windows\system32\Akdafn32.exe135⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Windows\SysWOW64\Bhjneadb.exeC:\Windows\system32\Bhjneadb.exe136⤵PID:1728
-
C:\Windows\SysWOW64\Bllcnega.exeC:\Windows\system32\Bllcnega.exe137⤵PID:2676
-
C:\Windows\SysWOW64\Bjbqmi32.exeC:\Windows\system32\Bjbqmi32.exe138⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2532 -
C:\Windows\SysWOW64\Bfiabjjm.exeC:\Windows\system32\Bfiabjjm.exe139⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1856 -
C:\Windows\SysWOW64\Cfknhi32.exeC:\Windows\system32\Cfknhi32.exe140⤵PID:696
-
C:\Windows\SysWOW64\Cngcll32.exeC:\Windows\system32\Cngcll32.exe141⤵PID:2224
-
C:\Windows\SysWOW64\Cnipak32.exeC:\Windows\system32\Cnipak32.exe142⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1608 -
C:\Windows\SysWOW64\Cnklgkap.exeC:\Windows\system32\Cnklgkap.exe143⤵
- Modifies registry class
PID:840 -
C:\Windows\SysWOW64\Cjbmll32.exeC:\Windows\system32\Cjbmll32.exe144⤵PID:1048
-
C:\Windows\SysWOW64\Dgfmep32.exeC:\Windows\system32\Dgfmep32.exe145⤵
- Drops file in System32 directory
- Modifies registry class
PID:1424 -
C:\Windows\SysWOW64\Dmcfngde.exeC:\Windows\system32\Dmcfngde.exe146⤵
- Drops file in System32 directory
- Modifies registry class
PID:1244 -
C:\Windows\SysWOW64\Djgfgkbo.exeC:\Windows\system32\Djgfgkbo.exe147⤵PID:2784
-
C:\Windows\SysWOW64\Djicmk32.exeC:\Windows\system32\Djicmk32.exe148⤵PID:1908
-
C:\Windows\SysWOW64\Dcageqgm.exeC:\Windows\system32\Dcageqgm.exe149⤵
- System Location Discovery: System Language Discovery
PID:1084 -
C:\Windows\SysWOW64\Diqmcgca.exeC:\Windows\system32\Diqmcgca.exe150⤵PID:1612
-
C:\Windows\SysWOW64\Eiciig32.exeC:\Windows\system32\Eiciig32.exe151⤵
- Drops file in System32 directory
PID:1296 -
C:\Windows\SysWOW64\Enbogmnc.exeC:\Windows\system32\Enbogmnc.exe152⤵PID:1912
-
C:\Windows\SysWOW64\Eacghhkd.exeC:\Windows\system32\Eacghhkd.exe153⤵PID:2920
-
C:\Windows\SysWOW64\Ephdjeol.exeC:\Windows\system32\Ephdjeol.exe154⤵
- Drops file in System32 directory
PID:868 -
C:\Windows\SysWOW64\Fiqibj32.exeC:\Windows\system32\Fiqibj32.exe155⤵PID:488
-
C:\Windows\SysWOW64\Ffdilo32.exeC:\Windows\system32\Ffdilo32.exe156⤵PID:1568
-
C:\Windows\SysWOW64\Fmnahilc.exeC:\Windows\system32\Fmnahilc.exe157⤵
- System Location Discovery: System Language Discovery
PID:884 -
C:\Windows\SysWOW64\Ffgfancd.exeC:\Windows\system32\Ffgfancd.exe158⤵PID:1472
-
C:\Windows\SysWOW64\Fpokjd32.exeC:\Windows\system32\Fpokjd32.exe159⤵PID:2404
-
C:\Windows\SysWOW64\Figocipe.exeC:\Windows\system32\Figocipe.exe160⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2452 -
C:\Windows\SysWOW64\Facdgl32.exeC:\Windows\system32\Facdgl32.exe161⤵
- Drops file in System32 directory
PID:688 -
C:\Windows\SysWOW64\Ghaeoe32.exeC:\Windows\system32\Ghaeoe32.exe162⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1880 -
C:\Windows\SysWOW64\Gajjhkgh.exeC:\Windows\system32\Gajjhkgh.exe163⤵
- Drops file in System32 directory
PID:2040 -
C:\Windows\SysWOW64\Gmqkml32.exeC:\Windows\system32\Gmqkml32.exe164⤵
- System Location Discovery: System Language Discovery
PID:2412 -
C:\Windows\SysWOW64\Gcmcebkc.exeC:\Windows\system32\Gcmcebkc.exe165⤵PID:2372
-
C:\Windows\SysWOW64\Ggklka32.exeC:\Windows\system32\Ggklka32.exe166⤵PID:2344
-
C:\Windows\SysWOW64\Hhoeii32.exeC:\Windows\system32\Hhoeii32.exe167⤵PID:2788
-
C:\Windows\SysWOW64\Hkpnjd32.exeC:\Windows\system32\Hkpnjd32.exe168⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1576 -
C:\Windows\SysWOW64\Hjggap32.exeC:\Windows\system32\Hjggap32.exe169⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1616 -
C:\Windows\SysWOW64\Igkhjdde.exeC:\Windows\system32\Igkhjdde.exe170⤵PID:1176
-
C:\Windows\SysWOW64\Ifpelq32.exeC:\Windows\system32\Ifpelq32.exe171⤵
- System Location Discovery: System Language Discovery
PID:2352 -
C:\Windows\SysWOW64\Immjnj32.exeC:\Windows\system32\Immjnj32.exe172⤵PID:2584
-
C:\Windows\SysWOW64\Iickckcl.exeC:\Windows\system32\Iickckcl.exe173⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1620 -
C:\Windows\SysWOW64\Jfjhbo32.exeC:\Windows\system32\Jfjhbo32.exe174⤵PID:876
-
C:\Windows\SysWOW64\Joblkegc.exeC:\Windows\system32\Joblkegc.exe175⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1064 -
C:\Windows\SysWOW64\Jbcelp32.exeC:\Windows\system32\Jbcelp32.exe176⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2612 -
C:\Windows\SysWOW64\Jnifaajh.exeC:\Windows\system32\Jnifaajh.exe177⤵
- Modifies registry class
PID:2312 -
C:\Windows\SysWOW64\Jpmooind.exeC:\Windows\system32\Jpmooind.exe178⤵PID:1660
-
C:\Windows\SysWOW64\Kamlhl32.exeC:\Windows\system32\Kamlhl32.exe179⤵
- Drops file in System32 directory
PID:2572 -
C:\Windows\SysWOW64\Klfmijae.exeC:\Windows\system32\Klfmijae.exe180⤵
- Drops file in System32 directory
PID:2540 -
C:\Windows\SysWOW64\Kmficl32.exeC:\Windows\system32\Kmficl32.exe181⤵
- Modifies registry class
PID:3088 -
C:\Windows\SysWOW64\Kaholp32.exeC:\Windows\system32\Kaholp32.exe182⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3128 -
C:\Windows\SysWOW64\Lajkbp32.exeC:\Windows\system32\Lajkbp32.exe183⤵
- System Location Discovery: System Language Discovery
PID:3176 -
C:\Windows\SysWOW64\Lhfpdi32.exeC:\Windows\system32\Lhfpdi32.exe184⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3220 -
C:\Windows\SysWOW64\Lhimji32.exeC:\Windows\system32\Lhimji32.exe185⤵
- System Location Discovery: System Language Discovery
PID:3260 -
C:\Windows\SysWOW64\Lgnjke32.exeC:\Windows\system32\Lgnjke32.exe186⤵PID:3300
-
C:\Windows\SysWOW64\Ldbjdj32.exeC:\Windows\system32\Ldbjdj32.exe187⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3340 -
C:\Windows\SysWOW64\Meecaa32.exeC:\Windows\system32\Meecaa32.exe188⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3380 -
C:\Windows\SysWOW64\Mlolnllf.exeC:\Windows\system32\Mlolnllf.exe189⤵
- Drops file in System32 directory
PID:3424 -
C:\Windows\SysWOW64\Mhflcm32.exeC:\Windows\system32\Mhflcm32.exe190⤵PID:3464
-
C:\Windows\SysWOW64\Mkgeehnl.exeC:\Windows\system32\Mkgeehnl.exe191⤵PID:3512
-
C:\Windows\SysWOW64\Macjgadf.exeC:\Windows\system32\Macjgadf.exe192⤵
- System Location Discovery: System Language Discovery
PID:3596 -
C:\Windows\SysWOW64\Nnjklb32.exeC:\Windows\system32\Nnjklb32.exe193⤵PID:3636
-
C:\Windows\SysWOW64\Ngbpehpj.exeC:\Windows\system32\Ngbpehpj.exe194⤵PID:3676
-
C:\Windows\SysWOW64\Nfglfdeb.exeC:\Windows\system32\Nfglfdeb.exe195⤵PID:3716
-
C:\Windows\SysWOW64\Njeelc32.exeC:\Windows\system32\Njeelc32.exe196⤵PID:3760
-
C:\Windows\SysWOW64\Nobndj32.exeC:\Windows\system32\Nobndj32.exe197⤵
- Drops file in System32 directory
PID:3800 -
C:\Windows\SysWOW64\Odacbpee.exeC:\Windows\system32\Odacbpee.exe198⤵
- Drops file in System32 directory
PID:3844 -
C:\Windows\SysWOW64\Ooidei32.exeC:\Windows\system32\Ooidei32.exe199⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3884 -
C:\Windows\SysWOW64\Oiahnnji.exeC:\Windows\system32\Oiahnnji.exe200⤵PID:3924
-
C:\Windows\SysWOW64\Oehicoom.exeC:\Windows\system32\Oehicoom.exe201⤵
- Drops file in System32 directory
PID:3968 -
C:\Windows\SysWOW64\Pgibdjln.exeC:\Windows\system32\Pgibdjln.exe202⤵
- Modifies registry class
PID:4012 -
C:\Windows\SysWOW64\Padccpal.exeC:\Windows\system32\Padccpal.exe203⤵
- Drops file in System32 directory
PID:4052 -
C:\Windows\SysWOW64\Ppipdl32.exeC:\Windows\system32\Ppipdl32.exe204⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4092 -
C:\Windows\SysWOW64\Pehebbbh.exeC:\Windows\system32\Pehebbbh.exe205⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3104 -
C:\Windows\SysWOW64\Qjgjpi32.exeC:\Windows\system32\Qjgjpi32.exe206⤵PID:3144
-
C:\Windows\SysWOW64\Ajjgei32.exeC:\Windows\system32\Ajjgei32.exe207⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3192 -
C:\Windows\SysWOW64\Aaflgb32.exeC:\Windows\system32\Aaflgb32.exe208⤵PID:3240
-
C:\Windows\SysWOW64\Afeaei32.exeC:\Windows\system32\Afeaei32.exe209⤵PID:3284
-
C:\Windows\SysWOW64\Bihgmdih.exeC:\Windows\system32\Bihgmdih.exe210⤵
- Modifies registry class
PID:3312 -
C:\Windows\SysWOW64\Beadgdli.exeC:\Windows\system32\Beadgdli.exe211⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3444 -
C:\Windows\SysWOW64\Bedamd32.exeC:\Windows\system32\Bedamd32.exe212⤵
- Drops file in System32 directory
PID:3156 -
C:\Windows\SysWOW64\Befnbd32.exeC:\Windows\system32\Befnbd32.exe213⤵PID:3604
-
C:\Windows\SysWOW64\Bkcfjk32.exeC:\Windows\system32\Bkcfjk32.exe214⤵
- Modifies registry class
PID:3576 -
C:\Windows\SysWOW64\Cccdjl32.exeC:\Windows\system32\Cccdjl32.exe215⤵PID:3628
-
C:\Windows\SysWOW64\Cgqmpkfg.exeC:\Windows\system32\Cgqmpkfg.exe216⤵
- Drops file in System32 directory
PID:3692 -
C:\Windows\SysWOW64\Cpiaipmh.exeC:\Windows\system32\Cpiaipmh.exe217⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3068 -
C:\Windows\SysWOW64\Dcjjkkji.exeC:\Windows\system32\Dcjjkkji.exe218⤵
- Drops file in System32 directory
PID:3784 -
C:\Windows\SysWOW64\Dnckki32.exeC:\Windows\system32\Dnckki32.exe219⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3840 -
C:\Windows\SysWOW64\Dnfhqi32.exeC:\Windows\system32\Dnfhqi32.exe220⤵PID:3868
-
C:\Windows\SysWOW64\Dgnminke.exeC:\Windows\system32\Dgnminke.exe221⤵
- Modifies registry class
PID:3944 -
C:\Windows\SysWOW64\Dklepmal.exeC:\Windows\system32\Dklepmal.exe222⤵PID:3988
-
C:\Windows\SysWOW64\Dnjalhpp.exeC:\Windows\system32\Dnjalhpp.exe223⤵PID:4020
-
C:\Windows\SysWOW64\Ecgjdong.exeC:\Windows\system32\Ecgjdong.exe224⤵PID:4064
-
C:\Windows\SysWOW64\Egebjmdn.exeC:\Windows\system32\Egebjmdn.exe225⤵
- Drops file in System32 directory
PID:1104 -
C:\Windows\SysWOW64\Efjpkj32.exeC:\Windows\system32\Efjpkj32.exe226⤵PID:2196
-
C:\Windows\SysWOW64\Eikimeff.exeC:\Windows\system32\Eikimeff.exe227⤵
- Modifies registry class
PID:2552 -
C:\Windows\SysWOW64\Efoifiep.exeC:\Windows\system32\Efoifiep.exe228⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3256 -
C:\Windows\SysWOW64\Fipbhd32.exeC:\Windows\system32\Fipbhd32.exe229⤵
- System Location Discovery: System Language Discovery
PID:3316 -
C:\Windows\SysWOW64\Fcichb32.exeC:\Windows\system32\Fcichb32.exe230⤵PID:336
-
C:\Windows\SysWOW64\Fmbgageq.exeC:\Windows\system32\Fmbgageq.exe231⤵PID:3408
-
C:\Windows\SysWOW64\Fnadkjlc.exeC:\Windows\system32\Fnadkjlc.exe232⤵
- Modifies registry class
PID:3472 -
C:\Windows\SysWOW64\Ffmipmjn.exeC:\Windows\system32\Ffmipmjn.exe233⤵PID:3528
-
C:\Windows\SysWOW64\Gbcien32.exeC:\Windows\system32\Gbcien32.exe234⤵
- Drops file in System32 directory
PID:3544 -
C:\Windows\SysWOW64\Gjjafkpe.exeC:\Windows\system32\Gjjafkpe.exe235⤵PID:3608
-
C:\Windows\SysWOW64\Gpgjnbnl.exeC:\Windows\system32\Gpgjnbnl.exe236⤵PID:3648
-
C:\Windows\SysWOW64\Gipngg32.exeC:\Windows\system32\Gipngg32.exe237⤵PID:3864
-
C:\Windows\SysWOW64\Gpjfcali.exeC:\Windows\system32\Gpjfcali.exe238⤵
- System Location Discovery: System Language Discovery
PID:3956 -
C:\Windows\SysWOW64\Gfcopl32.exeC:\Windows\system32\Gfcopl32.exe239⤵
- Modifies registry class
PID:3984 -
C:\Windows\SysWOW64\Glpgibbn.exeC:\Windows\system32\Glpgibbn.exe240⤵PID:4040
-
C:\Windows\SysWOW64\Gplcia32.exeC:\Windows\system32\Gplcia32.exe241⤵PID:2568
-
C:\Windows\SysWOW64\Geilah32.exeC:\Windows\system32\Geilah32.exe242⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4088