Analysis
-
max time kernel
119s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
27-07-2024 04:46
Static task
static1
Behavioral task
behavioral1
Sample
df0c18cc61f32a02606fe0fbc6de8959a95f465ad2cb9175e1aa2849134c389b.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
df0c18cc61f32a02606fe0fbc6de8959a95f465ad2cb9175e1aa2849134c389b.exe
Resource
win10v2004-20240709-en
General
-
Target
df0c18cc61f32a02606fe0fbc6de8959a95f465ad2cb9175e1aa2849134c389b.exe
-
Size
92KB
-
MD5
d9abe8ce707fcdbda6c9a0bc9c9912ed
-
SHA1
3d7e19d69128139582c00f3d712733adcae7898f
-
SHA256
df0c18cc61f32a02606fe0fbc6de8959a95f465ad2cb9175e1aa2849134c389b
-
SHA512
c992db76ea36aea3d3650a55f24112015b00670feffc82746a30f378141a40e834a103112b7dbd076e1c56e3fb27e01f6bc6c3020354f8a7f8e533f6d2232ed6
-
SSDEEP
1536:oN1wEzLfR5n7KGoudu29PXyXuJCjXq+66DFUABABOVLefE3:U1wEx9QWp96XwCj6+JB8M3
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Kpdjaecc.exeOnocon32.exeAeepjh32.exeAlofnj32.exeQqfkln32.exeDadbdkld.exeNndemg32.exePlndcmmj.exeJbhcim32.exeFkldgi32.exeFaonom32.exeAcbnggjo.exeHjfnnajl.exeAadobccg.exeDlhaaogd.exeQnpeijla.exeEnbogmnc.exeHgckoofa.exeEhinpnpm.exeGibmep32.exeGqahqd32.exeAinmlomf.exeIjopjhfh.exePccahc32.exeGkebafoa.exeBdaabk32.exeOhmalgeb.exeOmeini32.exeGkalhgfd.exeNbhhdnlh.exeNnoiio32.exeAjjgei32.exeKolhdbjh.exePiemih32.exeBniajoic.exeIphgln32.exePfkimhhi.exeOoemcb32.exeGdkgkcpq.exeOoabmbbe.exeKbcddlnd.exeDbggpfci.exeGpoibp32.exeMlmaad32.exeKlcgpkhh.exeJqbbhg32.exeNkdpmn32.exeCcdmnj32.exeMqbbagjo.exeNgoleb32.exeQoqhncgp.exeEeaepd32.exeOdcimipf.exeEdmilpld.exeDaacecfc.exeMaocekoo.exeAjjinaco.exeCooddbfh.exeCihedpcg.exeOmpefj32.exeJgjmoace.exeDflmpebj.exeDpaqmnap.exeLblcfnhj.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kpdjaecc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Onocon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aeepjh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Alofnj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qqfkln32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dadbdkld.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nndemg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Plndcmmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jbhcim32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkldgi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Faonom32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Acbnggjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hjfnnajl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aadobccg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dlhaaogd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qnpeijla.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Enbogmnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hgckoofa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ehinpnpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gibmep32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gqahqd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ainmlomf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ijopjhfh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pccahc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gkebafoa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bdaabk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ohmalgeb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Omeini32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gkalhgfd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nbhhdnlh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnoiio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ajjgei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kolhdbjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Piemih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bniajoic.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iphgln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pfkimhhi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ooemcb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdkgkcpq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ooabmbbe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kbcddlnd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dbggpfci.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gpoibp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlmaad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Klcgpkhh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jqbbhg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nkdpmn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ccdmnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mqbbagjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ngoleb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qoqhncgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eeaepd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odcimipf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Edmilpld.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Daacecfc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Maocekoo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajjinaco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cooddbfh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cihedpcg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ompefj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgjmoace.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dflmpebj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dpaqmnap.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lblcfnhj.exe -
Executes dropped EXE 64 IoCs
Processes:
Kdhcli32.exeLblcfnhj.exeLnbdko32.exeLgkhdddo.exeLdoimh32.exeLmjnak32.exeLfbbjpgd.exeLqhfhigj.exeMmogmjmn.exeMiehak32.exeMfihkoal.exeMlhnifmq.exeNcfoch32.exeNdhlhg32.exeNfidjbdg.exeNdmecgba.exeNpdfhhhe.exeOhojmjep.exeOoicid32.exeOokpodkj.exeOonldcih.exeOmcifpnp.exePcbncfjd.exePpfomk32.exePnjofo32.exePoklngnf.exePjcmap32.exePckajebj.exeQqfkln32.exeAdcdbl32.exeAdfqgl32.exeAopahjll.exeAqonbm32.exeAijbfo32.exeBbbgod32.exeBimoloog.exeBajqfq32.exeBgffhkoj.exeCjgoje32.exeCmhglq32.exeCcbphk32.exeCcdmnj32.exeCeeieced.exeCmmagpef.exeCnnnnh32.exeCfeepelg.exeClbnhmjo.exeCopjdhib.exeDifnaqih.exeDldkmlhl.exeDaacecfc.exeDdpobo32.exeDoecog32.exeDeollamj.exeDafmqb32.exeDhpemm32.exeDmmmfc32.exeDbifnj32.exeDicnkdnf.exeElajgpmj.exeEclbcj32.exeEiekpd32.exeEgikjh32.exeEacljf32.exepid process 2056 Kdhcli32.exe 2908 Lblcfnhj.exe 2732 Lnbdko32.exe 2696 Lgkhdddo.exe 2704 Ldoimh32.exe 2724 Lmjnak32.exe 2604 Lfbbjpgd.exe 2288 Lqhfhigj.exe 1040 Mmogmjmn.exe 1244 Miehak32.exe 1276 Mfihkoal.exe 2800 Mlhnifmq.exe 2236 Ncfoch32.exe 2256 Ndhlhg32.exe 1000 Nfidjbdg.exe 376 Ndmecgba.exe 1796 Npdfhhhe.exe 1768 Ohojmjep.exe 1784 Ooicid32.exe 1652 Ookpodkj.exe 1952 Oonldcih.exe 900 Omcifpnp.exe 2032 Pcbncfjd.exe 1668 Ppfomk32.exe 2096 Pnjofo32.exe 1588 Poklngnf.exe 1764 Pjcmap32.exe 2284 Pckajebj.exe 2980 Qqfkln32.exe 2304 Adcdbl32.exe 2940 Adfqgl32.exe 2648 Aopahjll.exe 1032 Aqonbm32.exe 3040 Aijbfo32.exe 2484 Bbbgod32.exe 956 Bimoloog.exe 1944 Bajqfq32.exe 2952 Bgffhkoj.exe 2452 Cjgoje32.exe 812 Cmhglq32.exe 2768 Ccbphk32.exe 1640 Ccdmnj32.exe 1872 Ceeieced.exe 1700 Cmmagpef.exe 2252 Cnnnnh32.exe 1964 Cfeepelg.exe 1716 Clbnhmjo.exe 1516 Copjdhib.exe 2964 Difnaqih.exe 1712 Dldkmlhl.exe 2292 Daacecfc.exe 2012 Ddpobo32.exe 2888 Doecog32.exe 2620 Deollamj.exe 2628 Dafmqb32.exe 3044 Dhpemm32.exe 1492 Dmmmfc32.exe 588 Dbifnj32.exe 536 Dicnkdnf.exe 2904 Elajgpmj.exe 1932 Eclbcj32.exe 2672 Eiekpd32.exe 1780 Egikjh32.exe 2988 Eacljf32.exe -
Loads dropped DLL 64 IoCs
Processes:
df0c18cc61f32a02606fe0fbc6de8959a95f465ad2cb9175e1aa2849134c389b.exeKdhcli32.exeLblcfnhj.exeLnbdko32.exeLgkhdddo.exeLdoimh32.exeLmjnak32.exeLfbbjpgd.exeLqhfhigj.exeMmogmjmn.exeMiehak32.exeMfihkoal.exeMlhnifmq.exeNcfoch32.exeNdhlhg32.exeNfidjbdg.exeNdmecgba.exeNpdfhhhe.exeOhojmjep.exeOoicid32.exeOokpodkj.exeOonldcih.exeOmcifpnp.exePcbncfjd.exePpfomk32.exePnjofo32.exePoklngnf.exePjcmap32.exePckajebj.exeQqfkln32.exeAdcdbl32.exeAdfqgl32.exepid process 2976 df0c18cc61f32a02606fe0fbc6de8959a95f465ad2cb9175e1aa2849134c389b.exe 2976 df0c18cc61f32a02606fe0fbc6de8959a95f465ad2cb9175e1aa2849134c389b.exe 2056 Kdhcli32.exe 2056 Kdhcli32.exe 2908 Lblcfnhj.exe 2908 Lblcfnhj.exe 2732 Lnbdko32.exe 2732 Lnbdko32.exe 2696 Lgkhdddo.exe 2696 Lgkhdddo.exe 2704 Ldoimh32.exe 2704 Ldoimh32.exe 2724 Lmjnak32.exe 2724 Lmjnak32.exe 2604 Lfbbjpgd.exe 2604 Lfbbjpgd.exe 2288 Lqhfhigj.exe 2288 Lqhfhigj.exe 1040 Mmogmjmn.exe 1040 Mmogmjmn.exe 1244 Miehak32.exe 1244 Miehak32.exe 1276 Mfihkoal.exe 1276 Mfihkoal.exe 2800 Mlhnifmq.exe 2800 Mlhnifmq.exe 2236 Ncfoch32.exe 2236 Ncfoch32.exe 2256 Ndhlhg32.exe 2256 Ndhlhg32.exe 1000 Nfidjbdg.exe 1000 Nfidjbdg.exe 376 Ndmecgba.exe 376 Ndmecgba.exe 1796 Npdfhhhe.exe 1796 Npdfhhhe.exe 1768 Ohojmjep.exe 1768 Ohojmjep.exe 1784 Ooicid32.exe 1784 Ooicid32.exe 1652 Ookpodkj.exe 1652 Ookpodkj.exe 1952 Oonldcih.exe 1952 Oonldcih.exe 900 Omcifpnp.exe 900 Omcifpnp.exe 2032 Pcbncfjd.exe 2032 Pcbncfjd.exe 1668 Ppfomk32.exe 1668 Ppfomk32.exe 2096 Pnjofo32.exe 2096 Pnjofo32.exe 1588 Poklngnf.exe 1588 Poklngnf.exe 1764 Pjcmap32.exe 1764 Pjcmap32.exe 2284 Pckajebj.exe 2284 Pckajebj.exe 2980 Qqfkln32.exe 2980 Qqfkln32.exe 2304 Adcdbl32.exe 2304 Adcdbl32.exe 2940 Adfqgl32.exe 2940 Adfqgl32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Kdhcli32.exeOokpodkj.exeGdkgkcpq.exeFmdfppkb.exeCeqjla32.exeGanbjb32.exeBgffhkoj.exeKhldkllj.exeFigocipe.exeBbfnchfb.exeHokhbj32.exeGbjpem32.exeAplkah32.exeNpdfhhhe.exeGconbj32.exeNcpdbohb.exeAhpbkd32.exeHlecmkel.exeEegkpo32.exeKablnadm.exeJgmjdaqb.exeNpkfff32.exeOekjjl32.exeOdcimipf.exeGibmep32.exeBefpkmph.exeQigebglj.exeAhedjb32.exeFlhhed32.exeOeaael32.exeHhadgakg.exeOoemcb32.exeOnocon32.exeEjadibmh.exeNipdkieg.exeKpojkp32.exeBkcfjk32.exeAankkqfl.exeOlalpdbc.exeLadebd32.exeDoamhe32.exeKjkehhjf.exeAkmlacdn.exeMdgkjopd.exeJgbmco32.exeAdcdbl32.exeHbnmienj.exeIphgln32.exeGdnfjl32.exeGedbfimc.exeAjjinaco.exeMfihml32.exeNcfoch32.exeBfoeil32.exeBdkhjgeh.exeDmmbge32.exeNdjhpcoe.exeKmkihbho.exeFhglop32.exeNaimepkp.exeJqfhqe32.exeDjicmk32.exeGjemoi32.exedescription ioc process File created C:\Windows\SysWOW64\Lblcfnhj.exe Kdhcli32.exe File created C:\Windows\SysWOW64\Oonldcih.exe Ookpodkj.exe File created C:\Windows\SysWOW64\Gkephn32.exe Gdkgkcpq.exe File created C:\Windows\SysWOW64\Igldicdf.dll Fmdfppkb.exe File opened for modification C:\Windows\SysWOW64\Cpjklo32.exe Ceqjla32.exe File opened for modification C:\Windows\SysWOW64\Glcfgk32.exe Ganbjb32.exe File created C:\Windows\SysWOW64\Cjgoje32.exe Bgffhkoj.exe File opened for modification C:\Windows\SysWOW64\Kpgionie.exe Khldkllj.exe File created C:\Windows\SysWOW64\Flhhed32.exe Figocipe.exe File opened for modification C:\Windows\SysWOW64\Bpjnmlel.exe Bbfnchfb.exe File created C:\Windows\SysWOW64\Chpenm32.dll Hokhbj32.exe File opened for modification C:\Windows\SysWOW64\Glbdnbpk.exe Gbjpem32.exe File created C:\Windows\SysWOW64\Ajapoqmf.exe Aplkah32.exe File created C:\Windows\SysWOW64\Nmldop32.dll Npdfhhhe.exe File opened for modification C:\Windows\SysWOW64\Hofngkga.exe Gconbj32.exe File created C:\Windows\SysWOW64\Ojgidcjn.dll Ncpdbohb.exe File created C:\Windows\SysWOW64\Anljck32.exe Ahpbkd32.exe File created C:\Windows\SysWOW64\Idhcadad.dll Hlecmkel.exe File opened for modification C:\Windows\SysWOW64\Ebklic32.exe Eegkpo32.exe File opened for modification C:\Windows\SysWOW64\Khldkllj.exe Kablnadm.exe File created C:\Windows\SysWOW64\Lqeipj32.dll Jgmjdaqb.exe File created C:\Windows\SysWOW64\Heknhioh.dll Npkfff32.exe File created C:\Windows\SysWOW64\Nbklpemb.dll Oekjjl32.exe File opened for modification C:\Windows\SysWOW64\Ojpaeq32.exe Odcimipf.exe File opened for modification C:\Windows\SysWOW64\Ganbjb32.exe Gibmep32.exe File created C:\Windows\SysWOW64\Cooddbfh.exe Befpkmph.exe File created C:\Windows\SysWOW64\Afqnmm32.dll Qigebglj.exe File created C:\Windows\SysWOW64\Aanibhoh.exe Ahedjb32.exe File created C:\Windows\SysWOW64\Ghoijebj.exe Flhhed32.exe File created C:\Windows\SysWOW64\Ghagcnje.dll Oeaael32.exe File created C:\Windows\SysWOW64\Ideopekg.dll Hhadgakg.exe File opened for modification C:\Windows\SysWOW64\Ohmalgeb.exe Ooemcb32.exe File opened for modification C:\Windows\SysWOW64\Odiklh32.exe Onocon32.exe File opened for modification C:\Windows\SysWOW64\Ecjibgdh.exe Ejadibmh.exe File opened for modification C:\Windows\SysWOW64\Nbhhdnlh.exe Nipdkieg.exe File opened for modification C:\Windows\SysWOW64\Klfjpa32.exe Kpojkp32.exe File created C:\Windows\SysWOW64\Ipoidefp.dll Bkcfjk32.exe File created C:\Windows\SysWOW64\Ndjhjkfi.dll Aankkqfl.exe File created C:\Windows\SysWOW64\Piemih32.exe Olalpdbc.exe File created C:\Windows\SysWOW64\Lnkege32.exe Ladebd32.exe File created C:\Windows\SysWOW64\Dapjdq32.exe Doamhe32.exe File created C:\Windows\SysWOW64\Fdlfii32.dll Kjkehhjf.exe File created C:\Windows\SysWOW64\Aeepjh32.exe Akmlacdn.exe File created C:\Windows\SysWOW64\Mkacfiga.exe Mdgkjopd.exe File created C:\Windows\SysWOW64\Mbagfo32.dll Jgbmco32.exe File opened for modification C:\Windows\SysWOW64\Adfqgl32.exe Adcdbl32.exe File created C:\Windows\SysWOW64\Glehgdkn.dll Hbnmienj.exe File created C:\Windows\SysWOW64\Iiqldc32.exe Iphgln32.exe File opened for modification C:\Windows\SysWOW64\Gnfkba32.exe Gdnfjl32.exe File created C:\Windows\SysWOW64\Fnknli32.dll Gedbfimc.exe File opened for modification C:\Windows\SysWOW64\Aadakl32.exe Ajjinaco.exe File created C:\Windows\SysWOW64\Nnekggoo.dll Mfihml32.exe File created C:\Windows\SysWOW64\Ldmikj32.dll Ncfoch32.exe File created C:\Windows\SysWOW64\Bkknac32.exe Bfoeil32.exe File created C:\Windows\SysWOW64\Ehfenf32.dll Bdkhjgeh.exe File opened for modification C:\Windows\SysWOW64\Egcfdn32.exe Dmmbge32.exe File created C:\Windows\SysWOW64\Oojfnakl.exe Oeaael32.exe File opened for modification C:\Windows\SysWOW64\Nkdpmn32.exe Ndjhpcoe.exe File created C:\Windows\SysWOW64\Kgcnahoo.exe Kmkihbho.exe File created C:\Windows\SysWOW64\Ncaean32.dll Fhglop32.exe File created C:\Windows\SysWOW64\Fnjkec32.dll Naimepkp.exe File created C:\Windows\SysWOW64\Jjnlikic.exe Jqfhqe32.exe File opened for modification C:\Windows\SysWOW64\Dpfkeb32.exe Djicmk32.exe File opened for modification C:\Windows\SysWOW64\Gpafgp32.exe Gjemoi32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4432 2764 WerFault.exe Bmenijcd.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Mhflcm32.exedf0c18cc61f32a02606fe0fbc6de8959a95f465ad2cb9175e1aa2849134c389b.exeAopahjll.exeNcmglp32.exeDocopbaf.exeNgpcohbm.exeKnoaeimg.exeNdjhpcoe.exeHnkdnqhm.exeHgfooe32.exeEdmilpld.exeDapjdq32.exeMmpcdfem.exeAkphfbbl.exeCgqmpkfg.exePcmoie32.exeGhpkbn32.exeDeeqch32.exeJkioho32.exeJljeeqfn.exeMdgmbhgh.exeOdiklh32.exeFkldgi32.exeMqbbagjo.exePlgolf32.exeLkbmbl32.exePolobd32.exeJimbkh32.exePohhna32.exeGcjmmdbf.exeMldeik32.exeBikfklni.exeGkpakq32.exeGpoibp32.exeNgqeha32.exeKheofahm.exeLomglo32.exeQfimhmlo.exeHpjeknfi.exeFmnopp32.exeMfihkoal.exeBniajoic.exeHnmcli32.exeAhchdb32.exeNpffaq32.exeLnbdko32.exeAaipghcn.exeHagianlf.exeGllnnc32.exeEbdoocdk.exeFgjkmijh.exeAbbhje32.exeInebpgbf.exeEpipql32.exeDjlfma32.exeJaonji32.exeGbheif32.exeHfodmhbk.exeHdgkicek.exeNhebhipj.exeMfihml32.exeOmeini32.exeOdkgec32.exeBfoeil32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhflcm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df0c18cc61f32a02606fe0fbc6de8959a95f465ad2cb9175e1aa2849134c389b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aopahjll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ncmglp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Docopbaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ngpcohbm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knoaeimg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ndjhpcoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hnkdnqhm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hgfooe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edmilpld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dapjdq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmpcdfem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Akphfbbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cgqmpkfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pcmoie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghpkbn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Deeqch32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkioho32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jljeeqfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mdgmbhgh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odiklh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkldgi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mqbbagjo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Plgolf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lkbmbl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Polobd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jimbkh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pohhna32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gcjmmdbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mldeik32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bikfklni.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkpakq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpoibp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ngqeha32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kheofahm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lomglo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qfimhmlo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hpjeknfi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmnopp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mfihkoal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bniajoic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hnmcli32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahchdb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npffaq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnbdko32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aaipghcn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hagianlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gllnnc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebdoocdk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgjkmijh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Abbhje32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Inebpgbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epipql32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djlfma32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jaonji32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbheif32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfodmhbk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdgkicek.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhebhipj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mfihml32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Omeini32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odkgec32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfoeil32.exe -
Modifies registry class 64 IoCs
Processes:
Apefjqob.exeGhddnnfi.exeHeakefnf.exeOoemcb32.exeEblpke32.exeMnmpdlac.exeLhfnkqgk.exeFolhgbid.exeMgcjpkak.exeNoohlkpc.exeBgokfnij.exeGkpakq32.exeGjemoi32.exeQnpeijla.exeCkeqga32.exeDkdmfe32.exeIclbpj32.exeBgddam32.exeHnppaill.exeHoalia32.exeMgmoob32.exeNcloha32.exeCmmagpef.exeAkfkbd32.exeBbbpenco.exeCkbpqe32.exeMlieoqgg.exeNjmfhe32.exeDljngoea.exeHlgimqhf.exeJfgebjnm.exeOighcd32.exeIgkhjdde.exeCpjklo32.exeGbfhcf32.exeGdkgkcpq.exeFiepea32.exeLngpog32.exeLdahkaij.exeMdgkjopd.exePlndcmmj.exeJhfjadim.exeKekiphge.exeDhhhbg32.exeMldeik32.exeOomjng32.exeGindjqnc.exeKjkehhjf.exeAalaoipc.exeEnbogmnc.exeCcdmnj32.exeHjcppidk.exeOlpilg32.exePofkha32.exeJaecod32.exeFmaeho32.exeMlgiiaij.exeBdfahaaa.exeKeiqlihp.exeFpkchm32.exeIndnnfdn.exeBdobdc32.exeBojipjcj.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Apefjqob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cocgje32.dll" Ghddnnfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Heakefnf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ooemcb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eblpke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifhckf32.dll" Mnmpdlac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lhfnkqgk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Folhgbid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mgcjpkak.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Noohlkpc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bgokfnij.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gkpakq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gjemoi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qnpeijla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ckeqga32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dkdmfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgjdnbkd.dll" Iclbpj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bgddam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpgope32.dll" Hnppaill.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hoalia32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjjbkefk.dll" Mgmoob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ooicngen.dll" Ncloha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cmmagpef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpqnnmcd.dll" Akfkbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bbbpenco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcbdnmap.dll" Ckbpqe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmjkjk32.dll" Mlieoqgg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Njmfhe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dljngoea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hlgimqhf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jfgebjnm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oighcd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Igkhjdde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfhenelp.dll" Cpjklo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdkniice.dll" Gbfhcf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bglbcj32.dll" Gdkgkcpq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjpehnpj.dll" Fiepea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lngpog32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ldahkaij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iifmcp32.dll" Mdgkjopd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbiffmpn.dll" Plndcmmj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jhfjadim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kekiphge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igbfkb32.dll" Dhhhbg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddnpnigl.dll" Mldeik32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oomjng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbgmbfej.dll" Gindjqnc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kjkehhjf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aalaoipc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hidgoh32.dll" Enbogmnc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ccdmnj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hjcppidk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Olpilg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pofkha32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jaecod32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fmaeho32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mlgiiaij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akbieg32.dll" Bdfahaaa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Keiqlihp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fpkchm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Indnnfdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hefnockl.dll" Noohlkpc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbaghgop.dll" Bdobdc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgdojnle.dll" Bojipjcj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
df0c18cc61f32a02606fe0fbc6de8959a95f465ad2cb9175e1aa2849134c389b.exeKdhcli32.exeLblcfnhj.exeLnbdko32.exeLgkhdddo.exeLdoimh32.exeLmjnak32.exeLfbbjpgd.exeLqhfhigj.exeMmogmjmn.exeMiehak32.exeMfihkoal.exeMlhnifmq.exeNcfoch32.exeNdhlhg32.exeNfidjbdg.exedescription pid process target process PID 2976 wrote to memory of 2056 2976 df0c18cc61f32a02606fe0fbc6de8959a95f465ad2cb9175e1aa2849134c389b.exe Kdhcli32.exe PID 2976 wrote to memory of 2056 2976 df0c18cc61f32a02606fe0fbc6de8959a95f465ad2cb9175e1aa2849134c389b.exe Kdhcli32.exe PID 2976 wrote to memory of 2056 2976 df0c18cc61f32a02606fe0fbc6de8959a95f465ad2cb9175e1aa2849134c389b.exe Kdhcli32.exe PID 2976 wrote to memory of 2056 2976 df0c18cc61f32a02606fe0fbc6de8959a95f465ad2cb9175e1aa2849134c389b.exe Kdhcli32.exe PID 2056 wrote to memory of 2908 2056 Kdhcli32.exe Lblcfnhj.exe PID 2056 wrote to memory of 2908 2056 Kdhcli32.exe Lblcfnhj.exe PID 2056 wrote to memory of 2908 2056 Kdhcli32.exe Lblcfnhj.exe PID 2056 wrote to memory of 2908 2056 Kdhcli32.exe Lblcfnhj.exe PID 2908 wrote to memory of 2732 2908 Lblcfnhj.exe Lnbdko32.exe PID 2908 wrote to memory of 2732 2908 Lblcfnhj.exe Lnbdko32.exe PID 2908 wrote to memory of 2732 2908 Lblcfnhj.exe Lnbdko32.exe PID 2908 wrote to memory of 2732 2908 Lblcfnhj.exe Lnbdko32.exe PID 2732 wrote to memory of 2696 2732 Lnbdko32.exe Lgkhdddo.exe PID 2732 wrote to memory of 2696 2732 Lnbdko32.exe Lgkhdddo.exe PID 2732 wrote to memory of 2696 2732 Lnbdko32.exe Lgkhdddo.exe PID 2732 wrote to memory of 2696 2732 Lnbdko32.exe Lgkhdddo.exe PID 2696 wrote to memory of 2704 2696 Lgkhdddo.exe Ldoimh32.exe PID 2696 wrote to memory of 2704 2696 Lgkhdddo.exe Ldoimh32.exe PID 2696 wrote to memory of 2704 2696 Lgkhdddo.exe Ldoimh32.exe PID 2696 wrote to memory of 2704 2696 Lgkhdddo.exe Ldoimh32.exe PID 2704 wrote to memory of 2724 2704 Ldoimh32.exe Lmjnak32.exe PID 2704 wrote to memory of 2724 2704 Ldoimh32.exe Lmjnak32.exe PID 2704 wrote to memory of 2724 2704 Ldoimh32.exe Lmjnak32.exe PID 2704 wrote to memory of 2724 2704 Ldoimh32.exe Lmjnak32.exe PID 2724 wrote to memory of 2604 2724 Lmjnak32.exe Lfbbjpgd.exe PID 2724 wrote to memory of 2604 2724 Lmjnak32.exe Lfbbjpgd.exe PID 2724 wrote to memory of 2604 2724 Lmjnak32.exe Lfbbjpgd.exe PID 2724 wrote to memory of 2604 2724 Lmjnak32.exe Lfbbjpgd.exe PID 2604 wrote to memory of 2288 2604 Lfbbjpgd.exe Lqhfhigj.exe PID 2604 wrote to memory of 2288 2604 Lfbbjpgd.exe Lqhfhigj.exe PID 2604 wrote to memory of 2288 2604 Lfbbjpgd.exe Lqhfhigj.exe PID 2604 wrote to memory of 2288 2604 Lfbbjpgd.exe Lqhfhigj.exe PID 2288 wrote to memory of 1040 2288 Lqhfhigj.exe Mmogmjmn.exe PID 2288 wrote to memory of 1040 2288 Lqhfhigj.exe Mmogmjmn.exe PID 2288 wrote to memory of 1040 2288 Lqhfhigj.exe Mmogmjmn.exe PID 2288 wrote to memory of 1040 2288 Lqhfhigj.exe Mmogmjmn.exe PID 1040 wrote to memory of 1244 1040 Mmogmjmn.exe Miehak32.exe PID 1040 wrote to memory of 1244 1040 Mmogmjmn.exe Miehak32.exe PID 1040 wrote to memory of 1244 1040 Mmogmjmn.exe Miehak32.exe PID 1040 wrote to memory of 1244 1040 Mmogmjmn.exe Miehak32.exe PID 1244 wrote to memory of 1276 1244 Miehak32.exe Mfihkoal.exe PID 1244 wrote to memory of 1276 1244 Miehak32.exe Mfihkoal.exe PID 1244 wrote to memory of 1276 1244 Miehak32.exe Mfihkoal.exe PID 1244 wrote to memory of 1276 1244 Miehak32.exe Mfihkoal.exe PID 1276 wrote to memory of 2800 1276 Mfihkoal.exe Mlhnifmq.exe PID 1276 wrote to memory of 2800 1276 Mfihkoal.exe Mlhnifmq.exe PID 1276 wrote to memory of 2800 1276 Mfihkoal.exe Mlhnifmq.exe PID 1276 wrote to memory of 2800 1276 Mfihkoal.exe Mlhnifmq.exe PID 2800 wrote to memory of 2236 2800 Mlhnifmq.exe Ncfoch32.exe PID 2800 wrote to memory of 2236 2800 Mlhnifmq.exe Ncfoch32.exe PID 2800 wrote to memory of 2236 2800 Mlhnifmq.exe Ncfoch32.exe PID 2800 wrote to memory of 2236 2800 Mlhnifmq.exe Ncfoch32.exe PID 2236 wrote to memory of 2256 2236 Ncfoch32.exe Ndhlhg32.exe PID 2236 wrote to memory of 2256 2236 Ncfoch32.exe Ndhlhg32.exe PID 2236 wrote to memory of 2256 2236 Ncfoch32.exe Ndhlhg32.exe PID 2236 wrote to memory of 2256 2236 Ncfoch32.exe Ndhlhg32.exe PID 2256 wrote to memory of 1000 2256 Ndhlhg32.exe Nfidjbdg.exe PID 2256 wrote to memory of 1000 2256 Ndhlhg32.exe Nfidjbdg.exe PID 2256 wrote to memory of 1000 2256 Ndhlhg32.exe Nfidjbdg.exe PID 2256 wrote to memory of 1000 2256 Ndhlhg32.exe Nfidjbdg.exe PID 1000 wrote to memory of 376 1000 Nfidjbdg.exe Ndmecgba.exe PID 1000 wrote to memory of 376 1000 Nfidjbdg.exe Ndmecgba.exe PID 1000 wrote to memory of 376 1000 Nfidjbdg.exe Ndmecgba.exe PID 1000 wrote to memory of 376 1000 Nfidjbdg.exe Ndmecgba.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df0c18cc61f32a02606fe0fbc6de8959a95f465ad2cb9175e1aa2849134c389b.exe"C:\Users\Admin\AppData\Local\Temp\df0c18cc61f32a02606fe0fbc6de8959a95f465ad2cb9175e1aa2849134c389b.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\Kdhcli32.exeC:\Windows\system32\Kdhcli32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\Lblcfnhj.exeC:\Windows\system32\Lblcfnhj.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\Lnbdko32.exeC:\Windows\system32\Lnbdko32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\Lgkhdddo.exeC:\Windows\system32\Lgkhdddo.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\Ldoimh32.exeC:\Windows\system32\Ldoimh32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\Lmjnak32.exeC:\Windows\system32\Lmjnak32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\Lfbbjpgd.exeC:\Windows\system32\Lfbbjpgd.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\Lqhfhigj.exeC:\Windows\system32\Lqhfhigj.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\Mmogmjmn.exeC:\Windows\system32\Mmogmjmn.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\SysWOW64\Miehak32.exeC:\Windows\system32\Miehak32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\Mfihkoal.exeC:\Windows\system32\Mfihkoal.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\Mlhnifmq.exeC:\Windows\system32\Mlhnifmq.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\Ncfoch32.exeC:\Windows\system32\Ncfoch32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\Ndhlhg32.exeC:\Windows\system32\Ndhlhg32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\Nfidjbdg.exeC:\Windows\system32\Nfidjbdg.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\Ndmecgba.exeC:\Windows\system32\Ndmecgba.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:376 -
C:\Windows\SysWOW64\Npdfhhhe.exeC:\Windows\system32\Npdfhhhe.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1796 -
C:\Windows\SysWOW64\Ohojmjep.exeC:\Windows\system32\Ohojmjep.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Windows\SysWOW64\Ooicid32.exeC:\Windows\system32\Ooicid32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Windows\SysWOW64\Ookpodkj.exeC:\Windows\system32\Ookpodkj.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1652 -
C:\Windows\SysWOW64\Oonldcih.exeC:\Windows\system32\Oonldcih.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Windows\SysWOW64\Omcifpnp.exeC:\Windows\system32\Omcifpnp.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Windows\SysWOW64\Pcbncfjd.exeC:\Windows\system32\Pcbncfjd.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Windows\SysWOW64\Ppfomk32.exeC:\Windows\system32\Ppfomk32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Windows\SysWOW64\Pnjofo32.exeC:\Windows\system32\Pnjofo32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Windows\SysWOW64\Poklngnf.exeC:\Windows\system32\Poklngnf.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Windows\SysWOW64\Pjcmap32.exeC:\Windows\system32\Pjcmap32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Windows\SysWOW64\Pckajebj.exeC:\Windows\system32\Pckajebj.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Windows\SysWOW64\Qqfkln32.exeC:\Windows\system32\Qqfkln32.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Windows\SysWOW64\Adcdbl32.exeC:\Windows\system32\Adcdbl32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2304 -
C:\Windows\SysWOW64\Adfqgl32.exeC:\Windows\system32\Adfqgl32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Windows\SysWOW64\Aopahjll.exeC:\Windows\system32\Aopahjll.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2648 -
C:\Windows\SysWOW64\Aqonbm32.exeC:\Windows\system32\Aqonbm32.exe34⤵
- Executes dropped EXE
PID:1032 -
C:\Windows\SysWOW64\Aijbfo32.exeC:\Windows\system32\Aijbfo32.exe35⤵
- Executes dropped EXE
PID:3040 -
C:\Windows\SysWOW64\Bbbgod32.exeC:\Windows\system32\Bbbgod32.exe36⤵
- Executes dropped EXE
PID:2484 -
C:\Windows\SysWOW64\Bimoloog.exeC:\Windows\system32\Bimoloog.exe37⤵
- Executes dropped EXE
PID:956 -
C:\Windows\SysWOW64\Bajqfq32.exeC:\Windows\system32\Bajqfq32.exe38⤵
- Executes dropped EXE
PID:1944 -
C:\Windows\SysWOW64\Bgffhkoj.exeC:\Windows\system32\Bgffhkoj.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2952 -
C:\Windows\SysWOW64\Cjgoje32.exeC:\Windows\system32\Cjgoje32.exe40⤵
- Executes dropped EXE
PID:2452 -
C:\Windows\SysWOW64\Cmhglq32.exeC:\Windows\system32\Cmhglq32.exe41⤵
- Executes dropped EXE
PID:812 -
C:\Windows\SysWOW64\Ccbphk32.exeC:\Windows\system32\Ccbphk32.exe42⤵
- Executes dropped EXE
PID:2768 -
C:\Windows\SysWOW64\Ccdmnj32.exeC:\Windows\system32\Ccdmnj32.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1640 -
C:\Windows\SysWOW64\Ceeieced.exeC:\Windows\system32\Ceeieced.exe44⤵
- Executes dropped EXE
PID:1872 -
C:\Windows\SysWOW64\Cmmagpef.exeC:\Windows\system32\Cmmagpef.exe45⤵
- Executes dropped EXE
- Modifies registry class
PID:1700 -
C:\Windows\SysWOW64\Cnnnnh32.exeC:\Windows\system32\Cnnnnh32.exe46⤵
- Executes dropped EXE
PID:2252 -
C:\Windows\SysWOW64\Cfeepelg.exeC:\Windows\system32\Cfeepelg.exe47⤵
- Executes dropped EXE
PID:1964 -
C:\Windows\SysWOW64\Clbnhmjo.exeC:\Windows\system32\Clbnhmjo.exe48⤵
- Executes dropped EXE
PID:1716 -
C:\Windows\SysWOW64\Copjdhib.exeC:\Windows\system32\Copjdhib.exe49⤵
- Executes dropped EXE
PID:1516 -
C:\Windows\SysWOW64\Difnaqih.exeC:\Windows\system32\Difnaqih.exe50⤵
- Executes dropped EXE
PID:2964 -
C:\Windows\SysWOW64\Dldkmlhl.exeC:\Windows\system32\Dldkmlhl.exe51⤵
- Executes dropped EXE
PID:1712 -
C:\Windows\SysWOW64\Daacecfc.exeC:\Windows\system32\Daacecfc.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2292 -
C:\Windows\SysWOW64\Ddpobo32.exeC:\Windows\system32\Ddpobo32.exe53⤵
- Executes dropped EXE
PID:2012 -
C:\Windows\SysWOW64\Doecog32.exeC:\Windows\system32\Doecog32.exe54⤵
- Executes dropped EXE
PID:2888 -
C:\Windows\SysWOW64\Deollamj.exeC:\Windows\system32\Deollamj.exe55⤵
- Executes dropped EXE
PID:2620 -
C:\Windows\SysWOW64\Dafmqb32.exeC:\Windows\system32\Dafmqb32.exe56⤵
- Executes dropped EXE
PID:2628 -
C:\Windows\SysWOW64\Dhpemm32.exeC:\Windows\system32\Dhpemm32.exe57⤵
- Executes dropped EXE
PID:3044 -
C:\Windows\SysWOW64\Dmmmfc32.exeC:\Windows\system32\Dmmmfc32.exe58⤵
- Executes dropped EXE
PID:1492 -
C:\Windows\SysWOW64\Dbifnj32.exeC:\Windows\system32\Dbifnj32.exe59⤵
- Executes dropped EXE
PID:588 -
C:\Windows\SysWOW64\Dicnkdnf.exeC:\Windows\system32\Dicnkdnf.exe60⤵
- Executes dropped EXE
PID:536 -
C:\Windows\SysWOW64\Elajgpmj.exeC:\Windows\system32\Elajgpmj.exe61⤵
- Executes dropped EXE
PID:2904 -
C:\Windows\SysWOW64\Eclbcj32.exeC:\Windows\system32\Eclbcj32.exe62⤵
- Executes dropped EXE
PID:1932 -
C:\Windows\SysWOW64\Eiekpd32.exeC:\Windows\system32\Eiekpd32.exe63⤵
- Executes dropped EXE
PID:2672 -
C:\Windows\SysWOW64\Egikjh32.exeC:\Windows\system32\Egikjh32.exe64⤵
- Executes dropped EXE
PID:1780 -
C:\Windows\SysWOW64\Eacljf32.exeC:\Windows\system32\Eacljf32.exe65⤵
- Executes dropped EXE
PID:2988 -
C:\Windows\SysWOW64\Elipgofb.exeC:\Windows\system32\Elipgofb.exe66⤵PID:1020
-
C:\Windows\SysWOW64\Eeaepd32.exeC:\Windows\system32\Eeaepd32.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1720 -
C:\Windows\SysWOW64\Eecafd32.exeC:\Windows\system32\Eecafd32.exe68⤵PID:968
-
C:\Windows\SysWOW64\Folfoj32.exeC:\Windows\system32\Folfoj32.exe69⤵PID:1948
-
C:\Windows\SysWOW64\Fhdjgoha.exeC:\Windows\system32\Fhdjgoha.exe70⤵PID:2392
-
C:\Windows\SysWOW64\Fcnkhmdp.exeC:\Windows\system32\Fcnkhmdp.exe71⤵PID:628
-
C:\Windows\SysWOW64\Fdmhbplb.exeC:\Windows\system32\Fdmhbplb.exe72⤵PID:2788
-
C:\Windows\SysWOW64\Fogibnha.exeC:\Windows\system32\Fogibnha.exe73⤵PID:2948
-
C:\Windows\SysWOW64\Gbhbdi32.exeC:\Windows\system32\Gbhbdi32.exe74⤵PID:2760
-
C:\Windows\SysWOW64\Golbnm32.exeC:\Windows\system32\Golbnm32.exe75⤵PID:2016
-
C:\Windows\SysWOW64\Gfejjgli.exeC:\Windows\system32\Gfejjgli.exe76⤵PID:856
-
C:\Windows\SysWOW64\Gmpcgace.exeC:\Windows\system32\Gmpcgace.exe77⤵PID:1988
-
C:\Windows\SysWOW64\Gdkgkcpq.exeC:\Windows\system32\Gdkgkcpq.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:1432 -
C:\Windows\SysWOW64\Gkephn32.exeC:\Windows\system32\Gkephn32.exe79⤵PID:2084
-
C:\Windows\SysWOW64\Gqahqd32.exeC:\Windows\system32\Gqahqd32.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2992 -
C:\Windows\SysWOW64\Gbadjg32.exeC:\Windows\system32\Gbadjg32.exe81⤵PID:1624
-
C:\Windows\SysWOW64\Hjlioj32.exeC:\Windows\system32\Hjlioj32.exe82⤵PID:2324
-
C:\Windows\SysWOW64\Hebnlb32.exeC:\Windows\system32\Hebnlb32.exe83⤵PID:708
-
C:\Windows\SysWOW64\Hnjbeh32.exeC:\Windows\system32\Hnjbeh32.exe84⤵PID:2508
-
C:\Windows\SysWOW64\Hcgjmo32.exeC:\Windows\system32\Hcgjmo32.exe85⤵PID:1200
-
C:\Windows\SysWOW64\Hcigco32.exeC:\Windows\system32\Hcigco32.exe86⤵PID:2728
-
C:\Windows\SysWOW64\Hjcppidk.exeC:\Windows\system32\Hjcppidk.exe87⤵
- Modifies registry class
PID:2440 -
C:\Windows\SysWOW64\Hldlga32.exeC:\Windows\system32\Hldlga32.exe88⤵PID:2900
-
C:\Windows\SysWOW64\Hlgimqhf.exeC:\Windows\system32\Hlgimqhf.exe89⤵
- Modifies registry class
PID:2572 -
C:\Windows\SysWOW64\Iliebpfc.exeC:\Windows\system32\Iliebpfc.exe90⤵PID:2228
-
C:\Windows\SysWOW64\Ieajkfmd.exeC:\Windows\system32\Ieajkfmd.exe91⤵PID:572
-
C:\Windows\SysWOW64\Ihpfgalh.exeC:\Windows\system32\Ihpfgalh.exe92⤵PID:2368
-
C:\Windows\SysWOW64\Ihbcmaje.exeC:\Windows\system32\Ihbcmaje.exe93⤵PID:1484
-
C:\Windows\SysWOW64\Iakgefqe.exeC:\Windows\system32\Iakgefqe.exe94⤵PID:2996
-
C:\Windows\SysWOW64\Imahkg32.exeC:\Windows\system32\Imahkg32.exe95⤵PID:1508
-
C:\Windows\SysWOW64\Jaoqqflp.exeC:\Windows\system32\Jaoqqflp.exe96⤵PID:556
-
C:\Windows\SysWOW64\Jimbkh32.exeC:\Windows\system32\Jimbkh32.exe97⤵
- System Location Discovery: System Language Discovery
PID:2436 -
C:\Windows\SysWOW64\Jbhcim32.exeC:\Windows\system32\Jbhcim32.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1708 -
C:\Windows\SysWOW64\Jampjian.exeC:\Windows\system32\Jampjian.exe99⤵PID:2676
-
C:\Windows\SysWOW64\Kekiphge.exeC:\Windows\system32\Kekiphge.exe100⤵
- Modifies registry class
PID:2612 -
C:\Windows\SysWOW64\Kpdjaecc.exeC:\Windows\system32\Kpdjaecc.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2932 -
C:\Windows\SysWOW64\Kjmnjkjd.exeC:\Windows\system32\Kjmnjkjd.exe102⤵PID:2708
-
C:\Windows\SysWOW64\Kcgphp32.exeC:\Windows\system32\Kcgphp32.exe103⤵PID:1868
-
C:\Windows\SysWOW64\Klpdaf32.exeC:\Windows\system32\Klpdaf32.exe104⤵PID:2044
-
C:\Windows\SysWOW64\Ljddjj32.exeC:\Windows\system32\Ljddjj32.exe105⤵PID:2060
-
C:\Windows\SysWOW64\Lldmleam.exeC:\Windows\system32\Lldmleam.exe106⤵PID:2492
-
C:\Windows\SysWOW64\Lfoojj32.exeC:\Windows\system32\Lfoojj32.exe107⤵PID:696
-
C:\Windows\SysWOW64\Lgqkbb32.exeC:\Windows\system32\Lgqkbb32.exe108⤵PID:2172
-
C:\Windows\SysWOW64\Lddlkg32.exeC:\Windows\system32\Lddlkg32.exe109⤵PID:1612
-
C:\Windows\SysWOW64\Mnmpdlac.exeC:\Windows\system32\Mnmpdlac.exe110⤵
- Modifies registry class
PID:2540 -
C:\Windows\SysWOW64\Mnomjl32.exeC:\Windows\system32\Mnomjl32.exe111⤵PID:3060
-
C:\Windows\SysWOW64\Mfjann32.exeC:\Windows\system32\Mfjann32.exe112⤵PID:2740
-
C:\Windows\SysWOW64\Mqbbagjo.exeC:\Windows\system32\Mqbbagjo.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2608 -
C:\Windows\SysWOW64\Mpgobc32.exeC:\Windows\system32\Mpgobc32.exe114⤵PID:2656
-
C:\Windows\SysWOW64\Nipdkieg.exeC:\Windows\system32\Nipdkieg.exe115⤵
- Drops file in System32 directory
PID:2496 -
C:\Windows\SysWOW64\Nbhhdnlh.exeC:\Windows\system32\Nbhhdnlh.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2680 -
C:\Windows\SysWOW64\Nnoiio32.exeC:\Windows\system32\Nnoiio32.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1092 -
C:\Windows\SysWOW64\Nlcibc32.exeC:\Windows\system32\Nlcibc32.exe118⤵PID:2480
-
C:\Windows\SysWOW64\Nhjjgd32.exeC:\Windows\system32\Nhjjgd32.exe119⤵PID:2464
-
C:\Windows\SysWOW64\Nabopjmj.exeC:\Windows\system32\Nabopjmj.exe120⤵PID:2460
-
C:\Windows\SysWOW64\Onfoin32.exeC:\Windows\system32\Onfoin32.exe121⤵PID:1748
-
C:\Windows\SysWOW64\Ojmpooah.exeC:\Windows\system32\Ojmpooah.exe122⤵PID:2972
-
C:\Windows\SysWOW64\Odedge32.exeC:\Windows\system32\Odedge32.exe123⤵PID:2640
-
C:\Windows\SysWOW64\Olpilg32.exeC:\Windows\system32\Olpilg32.exe124⤵
- Modifies registry class
PID:1256 -
C:\Windows\SysWOW64\Ompefj32.exeC:\Windows\system32\Ompefj32.exe125⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2808 -
C:\Windows\SysWOW64\Ooabmbbe.exeC:\Windows\system32\Ooabmbbe.exe126⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1236 -
C:\Windows\SysWOW64\Oekjjl32.exeC:\Windows\system32\Oekjjl32.exe127⤵
- Drops file in System32 directory
PID:2472 -
C:\Windows\SysWOW64\Olebgfao.exeC:\Windows\system32\Olebgfao.exe128⤵PID:1936
-
C:\Windows\SysWOW64\Oabkom32.exeC:\Windows\system32\Oabkom32.exe129⤵PID:2776
-
C:\Windows\SysWOW64\Plgolf32.exeC:\Windows\system32\Plgolf32.exe130⤵
- System Location Discovery: System Language Discovery
PID:2868 -
C:\Windows\SysWOW64\Pofkha32.exeC:\Windows\system32\Pofkha32.exe131⤵
- Modifies registry class
PID:540 -
C:\Windows\SysWOW64\Pdbdqh32.exeC:\Windows\system32\Pdbdqh32.exe132⤵PID:2268
-
C:\Windows\SysWOW64\Pohhna32.exeC:\Windows\system32\Pohhna32.exe133⤵
- System Location Discovery: System Language Discovery
PID:2008 -
C:\Windows\SysWOW64\Phqmgg32.exeC:\Windows\system32\Phqmgg32.exe134⤵PID:1324
-
C:\Windows\SysWOW64\Paiaplin.exeC:\Windows\system32\Paiaplin.exe135⤵PID:3008
-
C:\Windows\SysWOW64\Pgfjhcge.exeC:\Windows\system32\Pgfjhcge.exe136⤵PID:1620
-
C:\Windows\SysWOW64\Qdlggg32.exeC:\Windows\system32\Qdlggg32.exe137⤵PID:1660
-
C:\Windows\SysWOW64\Qdncmgbj.exeC:\Windows\system32\Qdncmgbj.exe138⤵PID:2796
-
C:\Windows\SysWOW64\Alihaioe.exeC:\Windows\system32\Alihaioe.exe139⤵PID:2100
-
C:\Windows\SysWOW64\Agolnbok.exeC:\Windows\system32\Agolnbok.exe140⤵PID:1392
-
C:\Windows\SysWOW64\Ahpifj32.exeC:\Windows\system32\Ahpifj32.exe141⤵PID:2280
-
C:\Windows\SysWOW64\Alnalh32.exeC:\Windows\system32\Alnalh32.exe142⤵PID:2316
-
C:\Windows\SysWOW64\Aakjdo32.exeC:\Windows\system32\Aakjdo32.exe143⤵PID:1380
-
C:\Windows\SysWOW64\Aoojnc32.exeC:\Windows\system32\Aoojnc32.exe144⤵PID:2400
-
C:\Windows\SysWOW64\Akfkbd32.exeC:\Windows\system32\Akfkbd32.exe145⤵
- Modifies registry class
PID:2116 -
C:\Windows\SysWOW64\Bhjlli32.exeC:\Windows\system32\Bhjlli32.exe146⤵PID:2748
-
C:\Windows\SysWOW64\Bbbpenco.exeC:\Windows\system32\Bbbpenco.exe147⤵
- Modifies registry class
PID:2580 -
C:\Windows\SysWOW64\Bniajoic.exeC:\Windows\system32\Bniajoic.exe148⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:1496 -
C:\Windows\SysWOW64\Bfdenafn.exeC:\Windows\system32\Bfdenafn.exe149⤵PID:1704
-
C:\Windows\SysWOW64\Bgcbhd32.exeC:\Windows\system32\Bgcbhd32.exe150⤵PID:336
-
C:\Windows\SysWOW64\Bcjcme32.exeC:\Windows\system32\Bcjcme32.exe151⤵PID:2140
-
C:\Windows\SysWOW64\Ciihklpj.exeC:\Windows\system32\Ciihklpj.exe152⤵PID:1960
-
C:\Windows\SysWOW64\Cepipm32.exeC:\Windows\system32\Cepipm32.exe153⤵PID:2700
-
C:\Windows\SysWOW64\Cpfmmf32.exeC:\Windows\system32\Cpfmmf32.exe154⤵PID:2036
-
C:\Windows\SysWOW64\Cinafkkd.exeC:\Windows\system32\Cinafkkd.exe155⤵PID:2200
-
C:\Windows\SysWOW64\Cgcnghpl.exeC:\Windows\system32\Cgcnghpl.exe156⤵PID:600
-
C:\Windows\SysWOW64\Dnpciaef.exeC:\Windows\system32\Dnpciaef.exe157⤵PID:2524
-
C:\Windows\SysWOW64\Dhhhbg32.exeC:\Windows\system32\Dhhhbg32.exe158⤵
- Modifies registry class
PID:996 -
C:\Windows\SysWOW64\Diidjpbe.exeC:\Windows\system32\Diidjpbe.exe159⤵PID:1736
-
C:\Windows\SysWOW64\Dcohghbk.exeC:\Windows\system32\Dcohghbk.exe160⤵PID:1060
-
C:\Windows\SysWOW64\Dpeiligo.exeC:\Windows\system32\Dpeiligo.exe161⤵PID:2592
-
C:\Windows\SysWOW64\Debadpeg.exeC:\Windows\system32\Debadpeg.exe162⤵PID:2216
-
C:\Windows\SysWOW64\Dlljaj32.exeC:\Windows\system32\Dlljaj32.exe163⤵PID:1800
-
C:\Windows\SysWOW64\Dipjkn32.exeC:\Windows\system32\Dipjkn32.exe164⤵PID:2928
-
C:\Windows\SysWOW64\Domccejd.exeC:\Windows\system32\Domccejd.exe165⤵PID:1100
-
C:\Windows\SysWOW64\Eegkpo32.exeC:\Windows\system32\Eegkpo32.exe166⤵
- Drops file in System32 directory
PID:1456 -
C:\Windows\SysWOW64\Ebklic32.exeC:\Windows\system32\Ebklic32.exe167⤵PID:2756
-
C:\Windows\SysWOW64\Ekfpmf32.exeC:\Windows\system32\Ekfpmf32.exe168⤵PID:2512
-
C:\Windows\SysWOW64\Eeldkonl.exeC:\Windows\system32\Eeldkonl.exe169⤵PID:2568
-
C:\Windows\SysWOW64\Eabepp32.exeC:\Windows\system32\Eabepp32.exe170⤵PID:2744
-
C:\Windows\SysWOW64\Eaebeoan.exeC:\Windows\system32\Eaebeoan.exe171⤵PID:2856
-
C:\Windows\SysWOW64\Eipgjaoi.exeC:\Windows\system32\Eipgjaoi.exe172⤵PID:1064
-
C:\Windows\SysWOW64\Fdekgjno.exeC:\Windows\system32\Fdekgjno.exe173⤵PID:2076
-
C:\Windows\SysWOW64\Fmnopp32.exeC:\Windows\system32\Fmnopp32.exe174⤵
- System Location Discovery: System Language Discovery
PID:2820 -
C:\Windows\SysWOW64\Foolgh32.exeC:\Windows\system32\Foolgh32.exe175⤵PID:320
-
C:\Windows\SysWOW64\Fiepea32.exeC:\Windows\system32\Fiepea32.exe176⤵
- Modifies registry class
PID:3080 -
C:\Windows\SysWOW64\Felajbpg.exeC:\Windows\system32\Felajbpg.exe177⤵PID:3124
-
C:\Windows\SysWOW64\Fodebh32.exeC:\Windows\system32\Fodebh32.exe178⤵PID:3164
-
C:\Windows\SysWOW64\Flhflleb.exeC:\Windows\system32\Flhflleb.exe179⤵PID:3204
-
C:\Windows\SysWOW64\Gnkoid32.exeC:\Windows\system32\Gnkoid32.exe180⤵PID:3244
-
C:\Windows\SysWOW64\Gaihob32.exeC:\Windows\system32\Gaihob32.exe181⤵PID:3284
-
C:\Windows\SysWOW64\Gkalhgfd.exeC:\Windows\system32\Gkalhgfd.exe182⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3324 -
C:\Windows\SysWOW64\Gghmmilh.exeC:\Windows\system32\Gghmmilh.exe183⤵PID:3364
-
C:\Windows\SysWOW64\Gnbejb32.exeC:\Windows\system32\Gnbejb32.exe184⤵PID:3404
-
C:\Windows\SysWOW64\Gconbj32.exeC:\Windows\system32\Gconbj32.exe185⤵
- Drops file in System32 directory
PID:3444 -
C:\Windows\SysWOW64\Hofngkga.exeC:\Windows\system32\Hofngkga.exe186⤵PID:3484
-
C:\Windows\SysWOW64\Hjlbdc32.exeC:\Windows\system32\Hjlbdc32.exe187⤵PID:3524
-
C:\Windows\SysWOW64\Hcdgmimg.exeC:\Windows\system32\Hcdgmimg.exe188⤵PID:3564
-
C:\Windows\SysWOW64\Hokhbj32.exeC:\Windows\system32\Hokhbj32.exe189⤵
- Drops file in System32 directory
PID:3604 -
C:\Windows\SysWOW64\Hgflflqg.exeC:\Windows\system32\Hgflflqg.exe190⤵PID:3652
-
C:\Windows\SysWOW64\Hqnapb32.exeC:\Windows\system32\Hqnapb32.exe191⤵PID:3692
-
C:\Windows\SysWOW64\Hbnmienj.exeC:\Windows\system32\Hbnmienj.exe192⤵
- Drops file in System32 directory
PID:3732 -
C:\Windows\SysWOW64\Indnnfdn.exeC:\Windows\system32\Indnnfdn.exe193⤵
- Modifies registry class
PID:3772 -
C:\Windows\SysWOW64\Iphgln32.exeC:\Windows\system32\Iphgln32.exe194⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3812 -
C:\Windows\SysWOW64\Iiqldc32.exeC:\Windows\system32\Iiqldc32.exe195⤵PID:3852
-
C:\Windows\SysWOW64\Ijphofem.exeC:\Windows\system32\Ijphofem.exe196⤵PID:3892
-
C:\Windows\SysWOW64\Ifgicg32.exeC:\Windows\system32\Ifgicg32.exe197⤵PID:3932
-
C:\Windows\SysWOW64\Ipomlm32.exeC:\Windows\system32\Ipomlm32.exe198⤵PID:3972
-
C:\Windows\SysWOW64\Jelfdc32.exeC:\Windows\system32\Jelfdc32.exe199⤵PID:4012
-
C:\Windows\SysWOW64\Jaecod32.exeC:\Windows\system32\Jaecod32.exe200⤵
- Modifies registry class
PID:4052 -
C:\Windows\SysWOW64\Jmlddeio.exeC:\Windows\system32\Jmlddeio.exe201⤵PID:2112
-
C:\Windows\SysWOW64\Jajmjcoe.exeC:\Windows\system32\Jajmjcoe.exe202⤵PID:3112
-
C:\Windows\SysWOW64\Jfgebjnm.exeC:\Windows\system32\Jfgebjnm.exe203⤵
- Modifies registry class
PID:3172 -
C:\Windows\SysWOW64\Kpojkp32.exeC:\Windows\system32\Kpojkp32.exe204⤵
- Drops file in System32 directory
PID:3216 -
C:\Windows\SysWOW64\Klfjpa32.exeC:\Windows\system32\Klfjpa32.exe205⤵PID:3268
-
C:\Windows\SysWOW64\Kgkonj32.exeC:\Windows\system32\Kgkonj32.exe206⤵PID:3320
-
C:\Windows\SysWOW64\Kbbobkol.exeC:\Windows\system32\Kbbobkol.exe207⤵PID:3372
-
C:\Windows\SysWOW64\Kcdlhj32.exeC:\Windows\system32\Kcdlhj32.exe208⤵PID:3424
-
C:\Windows\SysWOW64\Kcginj32.exeC:\Windows\system32\Kcginj32.exe209⤵PID:3472
-
C:\Windows\SysWOW64\Lkbmbl32.exeC:\Windows\system32\Lkbmbl32.exe210⤵
- System Location Discovery: System Language Discovery
PID:3508 -
C:\Windows\SysWOW64\Lhfnkqgk.exeC:\Windows\system32\Lhfnkqgk.exe211⤵
- Modifies registry class
PID:3560 -
C:\Windows\SysWOW64\Lpabpcdf.exeC:\Windows\system32\Lpabpcdf.exe212⤵PID:3624
-
C:\Windows\SysWOW64\Ldokfakl.exeC:\Windows\system32\Ldokfakl.exe213⤵PID:3664
-
C:\Windows\SysWOW64\Lngpog32.exeC:\Windows\system32\Lngpog32.exe214⤵
- Modifies registry class
PID:3720 -
C:\Windows\SysWOW64\Ldahkaij.exeC:\Windows\system32\Ldahkaij.exe215⤵
- Modifies registry class
PID:3768 -
C:\Windows\SysWOW64\Lfbdci32.exeC:\Windows\system32\Lfbdci32.exe216⤵PID:3828
-
C:\Windows\SysWOW64\Mcfemmna.exeC:\Windows\system32\Mcfemmna.exe217⤵PID:3880
-
C:\Windows\SysWOW64\Mfgnnhkc.exeC:\Windows\system32\Mfgnnhkc.exe218⤵PID:3928
-
C:\Windows\SysWOW64\Mmccqbpm.exeC:\Windows\system32\Mmccqbpm.exe219⤵PID:3956
-
C:\Windows\SysWOW64\Mdogedmh.exeC:\Windows\system32\Mdogedmh.exe220⤵PID:4032
-
C:\Windows\SysWOW64\Mbchni32.exeC:\Windows\system32\Mbchni32.exe221⤵PID:4068
-
C:\Windows\SysWOW64\Nbeedh32.exeC:\Windows\system32\Nbeedh32.exe222⤵PID:3096
-
C:\Windows\SysWOW64\Ngbmlo32.exeC:\Windows\system32\Ngbmlo32.exe223⤵PID:3152
-
C:\Windows\SysWOW64\Ndfnecgp.exeC:\Windows\system32\Ndfnecgp.exe224⤵PID:3220
-
C:\Windows\SysWOW64\Nmabjfek.exeC:\Windows\system32\Nmabjfek.exe225⤵PID:3304
-
C:\Windows\SysWOW64\Nggggoda.exeC:\Windows\system32\Nggggoda.exe226⤵PID:3348
-
C:\Windows\SysWOW64\Ncmglp32.exeC:\Windows\system32\Ncmglp32.exe227⤵
- System Location Discovery: System Language Discovery
PID:3396 -
C:\Windows\SysWOW64\Ncpdbohb.exeC:\Windows\system32\Ncpdbohb.exe228⤵
- Drops file in System32 directory
PID:3480 -
C:\Windows\SysWOW64\Opfegp32.exeC:\Windows\system32\Opfegp32.exe229⤵PID:3540
-
C:\Windows\SysWOW64\Ohbikbkb.exeC:\Windows\system32\Ohbikbkb.exe230⤵PID:3600
-
C:\Windows\SysWOW64\Obgnhkkh.exeC:\Windows\system32\Obgnhkkh.exe231⤵PID:3644
-
C:\Windows\SysWOW64\Onnnml32.exeC:\Windows\system32\Onnnml32.exe232⤵PID:3728
-
C:\Windows\SysWOW64\Odkgec32.exeC:\Windows\system32\Odkgec32.exe233⤵
- System Location Discovery: System Language Discovery
PID:3796 -
C:\Windows\SysWOW64\Onqkclni.exeC:\Windows\system32\Onqkclni.exe234⤵PID:3876
-
C:\Windows\SysWOW64\Ohipla32.exeC:\Windows\system32\Ohipla32.exe235⤵PID:1584
-
C:\Windows\SysWOW64\Pmehdh32.exeC:\Windows\system32\Pmehdh32.exe236⤵PID:3968
-
C:\Windows\SysWOW64\Pfnmmn32.exeC:\Windows\system32\Pfnmmn32.exe237⤵PID:4008
-
C:\Windows\SysWOW64\Pdbmfb32.exeC:\Windows\system32\Pdbmfb32.exe238⤵PID:4088
-
C:\Windows\SysWOW64\Pmjaohol.exeC:\Windows\system32\Pmjaohol.exe239⤵PID:3132
-
C:\Windows\SysWOW64\Ppkjac32.exeC:\Windows\system32\Ppkjac32.exe240⤵PID:3192
-
C:\Windows\SysWOW64\Paocnkph.exeC:\Windows\system32\Paocnkph.exe241⤵PID:3292
-
C:\Windows\SysWOW64\Qldhkc32.exeC:\Windows\system32\Qldhkc32.exe242⤵PID:3384