Analysis
-
max time kernel
144s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 23:10
Static task
static1
Behavioral task
behavioral1
Sample
771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f.exe
Resource
win10v2004-20240508-en
General
-
Target
771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f.exe
-
Size
163KB
-
MD5
6fcc1a5f9cfee97bd224a32186a31861
-
SHA1
ad9137a65c7cc452e65cbd1049b291f532c3b6fb
-
SHA256
771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f
-
SHA512
1a1ac6d312ea3c178111641b1ee4475912935eec5bb437c2441654886e2f7774c7f82be60963f9fc959189a57ca75bf57f454219d34e0f13733cf9c3f5498864
-
SSDEEP
1536:PmgMVUboU1xMQ1AC2bMkV3iJ7LrDXlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:uKboU16uMMk4zXltOrWKDBr+yJb
Malware Config
Extracted
gozi
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Kcbakpdo.exeNhkbkc32.exeIgdogl32.exeIdklfpon.exeKbqecg32.exeCghggc32.exeOjahnj32.exeObafnlpn.exeAhlgfdeq.exeOklkmnbp.exeDcenlceh.exeEqgnokip.exeEbjglbml.exeBhfagipa.exeKneicieh.exeLkncmmle.exeCjpqdp32.exeFlabbihl.exeHiekid32.exeCohigamf.exeBkodhe32.exeEbpkce32.exeOgeigofa.exeBpleef32.exeEbodiofk.exeCoklgg32.exeFpdhklkl.exeLflmci32.exeMmceigep.exeNondgn32.exeKeoapb32.exePnjdhmdo.exeHacmcfge.exeIajcde32.exeJcgogk32.exeJnemdecl.exeMgimmm32.exeNehmdhja.exeLahkigca.exeNaajoinb.exeOobjaqaj.exePdaoog32.exeBldcpf32.exeKiccofna.exeNhiffc32.exeMlmlecec.exeBbhela32.exeCnaocmmi.exeEfcfga32.exeHlfdkoin.exeIncpoe32.exeLhmjkaoc.exeDhmcfkme.exeIjgdngmf.exeMhgmapfi.exeOcnfbo32.exeAjejgp32.exeCkccgane.exeDoehqead.exeFmjejphb.exeGoddhg32.exeIdmhkpml.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kcbakpdo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhkbkc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Igdogl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idklfpon.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kbqecg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cghggc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ojahnj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Obafnlpn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahlgfdeq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oklkmnbp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcenlceh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eqgnokip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ebjglbml.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhfagipa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kneicieh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lkncmmle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cjpqdp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Flabbihl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hiekid32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cohigamf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkodhe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ebpkce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ogeigofa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bpleef32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebodiofk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Coklgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fpdhklkl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lflmci32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmceigep.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nondgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kneicieh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Keoapb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pnjdhmdo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hacmcfge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iajcde32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jcgogk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnemdecl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mgimmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nehmdhja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lahkigca.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Naajoinb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oobjaqaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pdaoog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bldcpf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kiccofna.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lkncmmle.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhiffc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlmlecec.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bbhela32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cnaocmmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Efcfga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hlfdkoin.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Incpoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lhmjkaoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhmcfkme.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijgdngmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mhgmapfi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ocnfbo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajejgp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckccgane.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Doehqead.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmjejphb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Goddhg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idmhkpml.exe -
Detects executables built or packed with MPress PE compressor 64 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\Bkodhe32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Beehencq.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Bloqah32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Balijo32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bdjefj32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bkdmcdoe.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bnbjopoi.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Bjijdadm.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Baqbenep.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cgmkmecg.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cjndop32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cfgaiaci.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ckdjbh32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ddokpmfo.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dkkpbgli.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dbehoa32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Djpmccqq.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dgdmmgpj.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dnneja32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dcknbh32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Eihfjo32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Eqonkmdh.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Eijcpoac.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ecpgmhai.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Eilpeooq.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Emhlfmgj.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Enihne32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Eiomkn32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Elmigj32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ebgacddo.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Eloemi32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ealnephf.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Fnpnndgp.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Faokjpfd.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Fhhcgj32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Fjilieka.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Fbdqmghm.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Fmjejphb.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Fddmgjpo.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Feeiob32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Gicbeald.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Gpmjak32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Gangic32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ghhofmql.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Gdopkn32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Gacpdbej.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ggpimica.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Gmjaic32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Gddifnbk.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Hgbebiao.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Hiqbndpb.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Hcifgjgc.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Hicodd32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Hpmgqnfl.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Hckcmjep.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Hiekid32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Hgilchkf.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Hodpgjha.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Hjjddchg.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Hlhaqogk.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Icbimi32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Iknnbklc.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ioijbj32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ifcbodli.exe INDICATOR_EXE_Packed_MPress -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\Bkodhe32.exe UPX C:\Windows\SysWOW64\Beehencq.exe UPX \Windows\SysWOW64\Bloqah32.exe UPX \Windows\SysWOW64\Balijo32.exe UPX C:\Windows\SysWOW64\Bdjefj32.exe UPX C:\Windows\SysWOW64\Bkdmcdoe.exe UPX C:\Windows\SysWOW64\Bnbjopoi.exe UPX \Windows\SysWOW64\Bjijdadm.exe UPX \Windows\SysWOW64\Baqbenep.exe UPX C:\Windows\SysWOW64\Cgmkmecg.exe UPX C:\Windows\SysWOW64\Cjndop32.exe UPX C:\Windows\SysWOW64\Cfgaiaci.exe UPX C:\Windows\SysWOW64\Ckdjbh32.exe UPX C:\Windows\SysWOW64\Ddokpmfo.exe UPX C:\Windows\SysWOW64\Dkkpbgli.exe UPX C:\Windows\SysWOW64\Dbehoa32.exe UPX C:\Windows\SysWOW64\Djpmccqq.exe UPX C:\Windows\SysWOW64\Dgdmmgpj.exe UPX C:\Windows\SysWOW64\Dnneja32.exe UPX C:\Windows\SysWOW64\Dcknbh32.exe UPX C:\Windows\SysWOW64\Eihfjo32.exe UPX C:\Windows\SysWOW64\Eqonkmdh.exe UPX C:\Windows\SysWOW64\Eijcpoac.exe UPX C:\Windows\SysWOW64\Ecpgmhai.exe UPX C:\Windows\SysWOW64\Eilpeooq.exe UPX C:\Windows\SysWOW64\Emhlfmgj.exe UPX C:\Windows\SysWOW64\Enihne32.exe UPX C:\Windows\SysWOW64\Eiomkn32.exe UPX C:\Windows\SysWOW64\Elmigj32.exe UPX C:\Windows\SysWOW64\Ebgacddo.exe UPX C:\Windows\SysWOW64\Eloemi32.exe UPX C:\Windows\SysWOW64\Ealnephf.exe UPX C:\Windows\SysWOW64\Fnpnndgp.exe UPX C:\Windows\SysWOW64\Faokjpfd.exe UPX C:\Windows\SysWOW64\Fhhcgj32.exe UPX C:\Windows\SysWOW64\Fjilieka.exe UPX C:\Windows\SysWOW64\Fbdqmghm.exe UPX C:\Windows\SysWOW64\Fmjejphb.exe UPX C:\Windows\SysWOW64\Fddmgjpo.exe UPX C:\Windows\SysWOW64\Feeiob32.exe UPX C:\Windows\SysWOW64\Gicbeald.exe UPX C:\Windows\SysWOW64\Gpmjak32.exe UPX C:\Windows\SysWOW64\Gangic32.exe UPX C:\Windows\SysWOW64\Ghhofmql.exe UPX C:\Windows\SysWOW64\Gdopkn32.exe UPX C:\Windows\SysWOW64\Gacpdbej.exe UPX C:\Windows\SysWOW64\Ggpimica.exe UPX C:\Windows\SysWOW64\Gmjaic32.exe UPX C:\Windows\SysWOW64\Gddifnbk.exe UPX C:\Windows\SysWOW64\Hgbebiao.exe UPX C:\Windows\SysWOW64\Hiqbndpb.exe UPX C:\Windows\SysWOW64\Hcifgjgc.exe UPX C:\Windows\SysWOW64\Hicodd32.exe UPX C:\Windows\SysWOW64\Hpmgqnfl.exe UPX C:\Windows\SysWOW64\Hckcmjep.exe UPX C:\Windows\SysWOW64\Hiekid32.exe UPX C:\Windows\SysWOW64\Hgilchkf.exe UPX C:\Windows\SysWOW64\Hodpgjha.exe UPX C:\Windows\SysWOW64\Hjjddchg.exe UPX C:\Windows\SysWOW64\Hlhaqogk.exe UPX C:\Windows\SysWOW64\Icbimi32.exe UPX C:\Windows\SysWOW64\Iknnbklc.exe UPX C:\Windows\SysWOW64\Ioijbj32.exe UPX C:\Windows\SysWOW64\Ifcbodli.exe UPX -
Executes dropped EXE 64 IoCs
Processes:
Bkodhe32.exeBaildokg.exeBeehencq.exeBhcdaibd.exeBloqah32.exeBommnc32.exeBalijo32.exeBdjefj32.exeBhfagipa.exeBkdmcdoe.exeBnbjopoi.exeBpafkknm.exeBgknheej.exeBjijdadm.exeBaqbenep.exeCgmkmecg.exeCgpgce32.exeCjndop32.exeCnippoha.exeCllpkl32.exeCoklgg32.exeCcfhhffh.exeCgbdhd32.exeCjpqdp32.exeCpjiajeb.exeCfgaiaci.exeCkdjbh32.exeCfinoq32.exeChhjkl32.exeCkffgg32.exeCndbcc32.exeDdokpmfo.exeDqelenlc.exeDhmcfkme.exeDkkpbgli.exeDbehoa32.exeDqhhknjp.exeDgaqgh32.exeDjpmccqq.exeDmoipopd.exeDdeaalpg.exeDgdmmgpj.exeDfgmhd32.exeDnneja32.exeDqlafm32.exeDcknbh32.exeEihfjo32.exeEqonkmdh.exeEbpkce32.exeEijcpoac.exeEkholjqg.exeEcpgmhai.exeEbbgid32.exeEilpeooq.exeEmhlfmgj.exeEnihne32.exeEecqjpee.exeEiomkn32.exeElmigj32.exeEbgacddo.exeEiaiqn32.exeEloemi32.exeEnnaieib.exeEalnephf.exepid process 2192 Bkodhe32.exe 1088 Baildokg.exe 2956 Beehencq.exe 2804 Bhcdaibd.exe 2660 Bloqah32.exe 2540 Bommnc32.exe 2584 Balijo32.exe 2828 Bdjefj32.exe 2820 Bhfagipa.exe 1440 Bkdmcdoe.exe 1736 Bnbjopoi.exe 796 Bpafkknm.exe 1684 Bgknheej.exe 2056 Bjijdadm.exe 1300 Baqbenep.exe 2064 Cgmkmecg.exe 696 Cgpgce32.exe 836 Cjndop32.exe 2412 Cnippoha.exe 448 Cllpkl32.exe 1360 Coklgg32.exe 948 Ccfhhffh.exe 1060 Cgbdhd32.exe 556 Cjpqdp32.exe 1776 Cpjiajeb.exe 1596 Cfgaiaci.exe 2724 Ckdjbh32.exe 2708 Cfinoq32.exe 2536 Chhjkl32.exe 3064 Ckffgg32.exe 2880 Cndbcc32.exe 2732 Ddokpmfo.exe 1568 Dqelenlc.exe 624 Dhmcfkme.exe 2076 Dkkpbgli.exe 2500 Dbehoa32.exe 2696 Dqhhknjp.exe 772 Dgaqgh32.exe 2288 Djpmccqq.exe 2564 Dmoipopd.exe 2904 Ddeaalpg.exe 1652 Dgdmmgpj.exe 1820 Dfgmhd32.exe 1636 Dnneja32.exe 2128 Dqlafm32.exe 2996 Dcknbh32.exe 2716 Eihfjo32.exe 2364 Eqonkmdh.exe 2688 Ebpkce32.exe 2824 Eijcpoac.exe 2864 Ekholjqg.exe 1332 Ecpgmhai.exe 1516 Ebbgid32.exe 3036 Eilpeooq.exe 1824 Emhlfmgj.exe 700 Enihne32.exe 308 Eecqjpee.exe 1084 Eiomkn32.exe 1932 Elmigj32.exe 2284 Ebgacddo.exe 1156 Eiaiqn32.exe 1612 Eloemi32.exe 2816 Ennaieib.exe 3056 Ealnephf.exe -
Loads dropped DLL 64 IoCs
Processes:
771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f.exeBkodhe32.exeBaildokg.exeBeehencq.exeBhcdaibd.exeBloqah32.exeBommnc32.exeBalijo32.exeBdjefj32.exeBhfagipa.exeBkdmcdoe.exeBnbjopoi.exeBpafkknm.exeBgknheej.exeBjijdadm.exeBaqbenep.exeCgmkmecg.exeCgpgce32.exeCjndop32.exeCnippoha.exeCllpkl32.exeCoklgg32.exeCcfhhffh.exeCgbdhd32.exeCjpqdp32.exeCpjiajeb.exeCfgaiaci.exeCkdjbh32.exeCfinoq32.exeChhjkl32.exeCkffgg32.exeCndbcc32.exepid process 2984 771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f.exe 2984 771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f.exe 2192 Bkodhe32.exe 2192 Bkodhe32.exe 1088 Baildokg.exe 1088 Baildokg.exe 2956 Beehencq.exe 2956 Beehencq.exe 2804 Bhcdaibd.exe 2804 Bhcdaibd.exe 2660 Bloqah32.exe 2660 Bloqah32.exe 2540 Bommnc32.exe 2540 Bommnc32.exe 2584 Balijo32.exe 2584 Balijo32.exe 2828 Bdjefj32.exe 2828 Bdjefj32.exe 2820 Bhfagipa.exe 2820 Bhfagipa.exe 1440 Bkdmcdoe.exe 1440 Bkdmcdoe.exe 1736 Bnbjopoi.exe 1736 Bnbjopoi.exe 796 Bpafkknm.exe 796 Bpafkknm.exe 1684 Bgknheej.exe 1684 Bgknheej.exe 2056 Bjijdadm.exe 2056 Bjijdadm.exe 1300 Baqbenep.exe 1300 Baqbenep.exe 2064 Cgmkmecg.exe 2064 Cgmkmecg.exe 696 Cgpgce32.exe 696 Cgpgce32.exe 836 Cjndop32.exe 836 Cjndop32.exe 2412 Cnippoha.exe 2412 Cnippoha.exe 448 Cllpkl32.exe 448 Cllpkl32.exe 1360 Coklgg32.exe 1360 Coklgg32.exe 948 Ccfhhffh.exe 948 Ccfhhffh.exe 1060 Cgbdhd32.exe 1060 Cgbdhd32.exe 556 Cjpqdp32.exe 556 Cjpqdp32.exe 1776 Cpjiajeb.exe 1776 Cpjiajeb.exe 1596 Cfgaiaci.exe 1596 Cfgaiaci.exe 2724 Ckdjbh32.exe 2724 Ckdjbh32.exe 2708 Cfinoq32.exe 2708 Cfinoq32.exe 2536 Chhjkl32.exe 2536 Chhjkl32.exe 3064 Ckffgg32.exe 3064 Ckffgg32.exe 2880 Cndbcc32.exe 2880 Cndbcc32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Bnbjopoi.exeQedhdjnh.exeEmhlfmgj.exeIggkllpe.exeNncahjgl.exeHodpgjha.exeNlphkb32.exePnajilng.exeHdhbam32.exeNglfapnl.exeCghggc32.exeEjkima32.exeGpmjak32.exePamiog32.exeCldooj32.exeOqkqkdne.exeAaobdjof.exeBbokmqie.exeKgnnln32.exeMeccii32.exePjenhm32.exeDknekeef.exeGfefiemq.exeKcbakpdo.exeBdjefj32.exeLflmci32.exeCadhnmnm.exeGbnccfpb.exeGaqcoc32.exePmanoifd.exeHknach32.exeKmjfdejp.exeBioqclil.exeMlmlecec.exeEgjpkffe.exeDkqbaecc.exeEjhlgaeh.exeLpdbloof.exeOjahnj32.exeAhgnke32.exeOjcecjee.exeDqelenlc.exeElmigj32.exeLpbefoai.exeCgmkmecg.exeEccmffjf.exeLecgje32.exeQpgpkcpp.exeHacmcfge.exeInngcfid.exeNkiogn32.exeFjgoce32.exeJehkodcm.exeNcjqhmkm.exeApimacnn.exeCohigamf.exeEloemi32.exeHggomh32.exeKcfkfo32.exeMmahdggc.exeCklmgb32.exe771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f.exeFmlapp32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Bpafkknm.exe Bnbjopoi.exe File created C:\Windows\SysWOW64\Aelcmdee.dll Qedhdjnh.exe File created C:\Windows\SysWOW64\Enihne32.exe Emhlfmgj.exe File opened for modification C:\Windows\SysWOW64\Ikbgmj32.exe Iggkllpe.exe File opened for modification C:\Windows\SysWOW64\Naoniipe.exe Nncahjgl.exe File created C:\Windows\SysWOW64\Alogkm32.dll Hodpgjha.exe File created C:\Windows\SysWOW64\Nkbhgojk.exe Nlphkb32.exe File created C:\Windows\SysWOW64\Oimpgolj.dll Pnajilng.exe File created C:\Windows\SysWOW64\Hckcmjep.exe Hdhbam32.exe File created C:\Windows\SysWOW64\Feljlnoc.dll Nglfapnl.exe File created C:\Windows\SysWOW64\Dglpkenb.dll Cghggc32.exe File created C:\Windows\SysWOW64\Enfenplo.exe Ejkima32.exe File created C:\Windows\SysWOW64\Gopkmhjk.exe Gpmjak32.exe File created C:\Windows\SysWOW64\Peiepfgg.exe Pamiog32.exe File opened for modification C:\Windows\SysWOW64\Cppkph32.exe Cldooj32.exe File created C:\Windows\SysWOW64\Oonafa32.exe Oqkqkdne.exe File opened for modification C:\Windows\SysWOW64\Aekodi32.exe Aaobdjof.exe File created C:\Windows\SysWOW64\Khjjpi32.dll Bbokmqie.exe File created C:\Windows\SysWOW64\Kkijmm32.exe Kgnnln32.exe File opened for modification C:\Windows\SysWOW64\Miooigfo.exe Meccii32.exe File opened for modification C:\Windows\SysWOW64\Pnajilng.exe Pjenhm32.exe File opened for modification C:\Windows\SysWOW64\Dojald32.exe Dknekeef.exe File opened for modification C:\Windows\SysWOW64\Gicbeald.exe Gfefiemq.exe File created C:\Windows\SysWOW64\Jgdmei32.dll Gpmjak32.exe File created C:\Windows\SysWOW64\Nnplna32.dll Kcbakpdo.exe File created C:\Windows\SysWOW64\Pacebaej.dll Bdjefj32.exe File created C:\Windows\SysWOW64\Leonofpp.exe Lflmci32.exe File created C:\Windows\SysWOW64\Ceodnl32.exe Cadhnmnm.exe File created C:\Windows\SysWOW64\Gaqcoc32.exe Gbnccfpb.exe File created C:\Windows\SysWOW64\Gdopkn32.exe Gaqcoc32.exe File created C:\Windows\SysWOW64\Cbnnqb32.dll Pmanoifd.exe File created C:\Windows\SysWOW64\Hiqbndpb.exe Hknach32.exe File created C:\Windows\SysWOW64\Cfmepigc.dll Kmjfdejp.exe File opened for modification C:\Windows\SysWOW64\Bmkmdk32.exe Bioqclil.exe File opened for modification C:\Windows\SysWOW64\Mpigfa32.exe Mlmlecec.exe File created C:\Windows\SysWOW64\Ekelld32.exe Egjpkffe.exe File created C:\Windows\SysWOW64\Galmmc32.dll Dkqbaecc.exe File opened for modification C:\Windows\SysWOW64\Endhhp32.exe Ejhlgaeh.exe File created C:\Windows\SysWOW64\Logbhl32.exe Lpdbloof.exe File created C:\Windows\SysWOW64\Onmdoioa.exe Ojahnj32.exe File opened for modification C:\Windows\SysWOW64\Albjlcao.exe Ahgnke32.exe File created C:\Windows\SysWOW64\Ohfeog32.exe Ojcecjee.exe File created C:\Windows\SysWOW64\Dhmcfkme.exe Dqelenlc.exe File created C:\Windows\SysWOW64\Clnlnhop.dll Elmigj32.exe File created C:\Windows\SysWOW64\Idhqkpcf.dll Lpbefoai.exe File opened for modification C:\Windows\SysWOW64\Cgpgce32.exe Cgmkmecg.exe File opened for modification C:\Windows\SysWOW64\Egoife32.exe Eccmffjf.exe File created C:\Windows\SysWOW64\Cfnlkbne.dll Lecgje32.exe File opened for modification C:\Windows\SysWOW64\Qcbllb32.exe Qpgpkcpp.exe File created C:\Windows\SysWOW64\Henidd32.exe Hacmcfge.exe File opened for modification C:\Windows\SysWOW64\Iajcde32.exe Inngcfid.exe File created C:\Windows\SysWOW64\Oceaboqg.dll Nkiogn32.exe File opened for modification C:\Windows\SysWOW64\Fmekoalh.exe Fjgoce32.exe File created C:\Windows\SysWOW64\Qjdijm32.dll Jehkodcm.exe File opened for modification C:\Windows\SysWOW64\Nehmdhja.exe Ncjqhmkm.exe File created C:\Windows\SysWOW64\Anlmmp32.exe Apimacnn.exe File opened for modification C:\Windows\SysWOW64\Cnkicn32.exe Cohigamf.exe File created C:\Windows\SysWOW64\Ennaieib.exe Eloemi32.exe File created C:\Windows\SysWOW64\Hepmggig.dll Hggomh32.exe File opened for modification C:\Windows\SysWOW64\Kgbggnhc.exe Kcfkfo32.exe File created C:\Windows\SysWOW64\Mamddf32.exe Mmahdggc.exe File opened for modification C:\Windows\SysWOW64\Cohigamf.exe Cklmgb32.exe File created C:\Windows\SysWOW64\Kjqipbka.dll 771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f.exe File created C:\Windows\SysWOW64\Gfoihbdp.dll Fmlapp32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process 6864 5208 WerFault.exe -
Modifies registry class 64 IoCs
Processes:
Bkdmcdoe.exeFnpnndgp.exeGopkmhjk.exeObcccl32.exeNhdlkdkg.exeNdkmpe32.exeOfelmloo.exeBnbjopoi.exeHgilchkf.exeHpapln32.exeIqopea32.exeMhbped32.exeHdfflm32.exeAnojbobe.exeBkommo32.exeEqgnokip.exeEkholjqg.exeGpknlk32.exeJjojofgn.exeKblhgk32.exeCojema32.exeBiicik32.exeDhmcfkme.exeMpigfa32.exeNkeelohh.exeNdbcpd32.exeAlegac32.exeIlknfn32.exeAidnohbk.exeNcgdbmmp.exeNaoniipe.exeNejiih32.exeNhiffc32.exeOhfeog32.exeAnccmo32.exeEmnndlod.exeBhcdaibd.exeBommnc32.exeHdhbam32.exeIkddbj32.exeKaaijdgn.exeKaklpcoc.exeIqmcpahh.exeLflmci32.exeNncahjgl.exeCdgneh32.exeIkpjgkjq.exeOfelmloo.exeEibbcm32.exeIcmlam32.exeDfdjhndl.exeGphmeo32.exeOgeigofa.exeBafidiio.exePpbfpd32.exeEihfjo32.exePklhlael.exeQedhdjnh.exeDlkepi32.exeFidoim32.exeCndbcc32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mocaac32.dll" Bkdmcdoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqmnhocj.dll" Fnpnndgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mncnkh32.dll" Gopkmhjk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amkoie32.dll" Obcccl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nhdlkdkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oghmhi32.dll" Ndkmpe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ofelmloo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdecfpj.dll" Bnbjopoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hgilchkf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hpapln32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iqopea32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mhbped32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hdfflm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fddcahee.dll" Ofelmloo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Anojbobe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bkommo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkmkpl32.dll" Eqgnokip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dekpaqgc.dll" Ekholjqg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ofelmloo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnnhje32.dll" Gpknlk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jjojofgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kblhgk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cojema32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Biicik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dhmcfkme.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mpigfa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nkeelohh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ndbcpd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Alegac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqpofkjo.dll" Ilknfn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aidnohbk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ncgdbmmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeopgmbf.dll" Naoniipe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gokfbfnk.dll" Nejiih32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nhiffc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgefik32.dll" Ohfeog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oglegn32.dll" Anccmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klmkof32.dll" Emnndlod.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bhcdaibd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bommnc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cabknqko.dll" Hdhbam32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ikddbj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kaaijdgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfcijc32.dll" Kaklpcoc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iqmcpahh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhhognbb.dll" Lflmci32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nncahjgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgjcijfp.dll" Cdgneh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ikpjgkjq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ofelmloo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eibbcm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Icmlam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oakomajq.dll" Dfdjhndl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gphmeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lflmci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fioeja32.dll" Ogeigofa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bafidiio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ppbfpd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eihfjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbqpqcoj.dll" Pklhlael.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aelcmdee.dll" Qedhdjnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dlkepi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fidoim32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cndbcc32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f.exeBkodhe32.exeBaildokg.exeBeehencq.exeBhcdaibd.exeBloqah32.exeBommnc32.exeBalijo32.exeBdjefj32.exeBhfagipa.exeBkdmcdoe.exeBnbjopoi.exeBpafkknm.exeBgknheej.exeBjijdadm.exeBaqbenep.exedescription pid process target process PID 2984 wrote to memory of 2192 2984 771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f.exe Bkodhe32.exe PID 2984 wrote to memory of 2192 2984 771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f.exe Bkodhe32.exe PID 2984 wrote to memory of 2192 2984 771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f.exe Bkodhe32.exe PID 2984 wrote to memory of 2192 2984 771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f.exe Bkodhe32.exe PID 2192 wrote to memory of 1088 2192 Bkodhe32.exe Baildokg.exe PID 2192 wrote to memory of 1088 2192 Bkodhe32.exe Baildokg.exe PID 2192 wrote to memory of 1088 2192 Bkodhe32.exe Baildokg.exe PID 2192 wrote to memory of 1088 2192 Bkodhe32.exe Baildokg.exe PID 1088 wrote to memory of 2956 1088 Baildokg.exe Beehencq.exe PID 1088 wrote to memory of 2956 1088 Baildokg.exe Beehencq.exe PID 1088 wrote to memory of 2956 1088 Baildokg.exe Beehencq.exe PID 1088 wrote to memory of 2956 1088 Baildokg.exe Beehencq.exe PID 2956 wrote to memory of 2804 2956 Beehencq.exe Bhcdaibd.exe PID 2956 wrote to memory of 2804 2956 Beehencq.exe Bhcdaibd.exe PID 2956 wrote to memory of 2804 2956 Beehencq.exe Bhcdaibd.exe PID 2956 wrote to memory of 2804 2956 Beehencq.exe Bhcdaibd.exe PID 2804 wrote to memory of 2660 2804 Bhcdaibd.exe Bloqah32.exe PID 2804 wrote to memory of 2660 2804 Bhcdaibd.exe Bloqah32.exe PID 2804 wrote to memory of 2660 2804 Bhcdaibd.exe Bloqah32.exe PID 2804 wrote to memory of 2660 2804 Bhcdaibd.exe Bloqah32.exe PID 2660 wrote to memory of 2540 2660 Bloqah32.exe Bommnc32.exe PID 2660 wrote to memory of 2540 2660 Bloqah32.exe Bommnc32.exe PID 2660 wrote to memory of 2540 2660 Bloqah32.exe Bommnc32.exe PID 2660 wrote to memory of 2540 2660 Bloqah32.exe Bommnc32.exe PID 2540 wrote to memory of 2584 2540 Bommnc32.exe Balijo32.exe PID 2540 wrote to memory of 2584 2540 Bommnc32.exe Balijo32.exe PID 2540 wrote to memory of 2584 2540 Bommnc32.exe Balijo32.exe PID 2540 wrote to memory of 2584 2540 Bommnc32.exe Balijo32.exe PID 2584 wrote to memory of 2828 2584 Balijo32.exe Bdjefj32.exe PID 2584 wrote to memory of 2828 2584 Balijo32.exe Bdjefj32.exe PID 2584 wrote to memory of 2828 2584 Balijo32.exe Bdjefj32.exe PID 2584 wrote to memory of 2828 2584 Balijo32.exe Bdjefj32.exe PID 2828 wrote to memory of 2820 2828 Bdjefj32.exe Bhfagipa.exe PID 2828 wrote to memory of 2820 2828 Bdjefj32.exe Bhfagipa.exe PID 2828 wrote to memory of 2820 2828 Bdjefj32.exe Bhfagipa.exe PID 2828 wrote to memory of 2820 2828 Bdjefj32.exe Bhfagipa.exe PID 2820 wrote to memory of 1440 2820 Bhfagipa.exe Bkdmcdoe.exe PID 2820 wrote to memory of 1440 2820 Bhfagipa.exe Bkdmcdoe.exe PID 2820 wrote to memory of 1440 2820 Bhfagipa.exe Bkdmcdoe.exe PID 2820 wrote to memory of 1440 2820 Bhfagipa.exe Bkdmcdoe.exe PID 1440 wrote to memory of 1736 1440 Bkdmcdoe.exe Bnbjopoi.exe PID 1440 wrote to memory of 1736 1440 Bkdmcdoe.exe Bnbjopoi.exe PID 1440 wrote to memory of 1736 1440 Bkdmcdoe.exe Bnbjopoi.exe PID 1440 wrote to memory of 1736 1440 Bkdmcdoe.exe Bnbjopoi.exe PID 1736 wrote to memory of 796 1736 Bnbjopoi.exe Bpafkknm.exe PID 1736 wrote to memory of 796 1736 Bnbjopoi.exe Bpafkknm.exe PID 1736 wrote to memory of 796 1736 Bnbjopoi.exe Bpafkknm.exe PID 1736 wrote to memory of 796 1736 Bnbjopoi.exe Bpafkknm.exe PID 796 wrote to memory of 1684 796 Bpafkknm.exe Bgknheej.exe PID 796 wrote to memory of 1684 796 Bpafkknm.exe Bgknheej.exe PID 796 wrote to memory of 1684 796 Bpafkknm.exe Bgknheej.exe PID 796 wrote to memory of 1684 796 Bpafkknm.exe Bgknheej.exe PID 1684 wrote to memory of 2056 1684 Bgknheej.exe Bjijdadm.exe PID 1684 wrote to memory of 2056 1684 Bgknheej.exe Bjijdadm.exe PID 1684 wrote to memory of 2056 1684 Bgknheej.exe Bjijdadm.exe PID 1684 wrote to memory of 2056 1684 Bgknheej.exe Bjijdadm.exe PID 2056 wrote to memory of 1300 2056 Bjijdadm.exe Baqbenep.exe PID 2056 wrote to memory of 1300 2056 Bjijdadm.exe Baqbenep.exe PID 2056 wrote to memory of 1300 2056 Bjijdadm.exe Baqbenep.exe PID 2056 wrote to memory of 1300 2056 Bjijdadm.exe Baqbenep.exe PID 1300 wrote to memory of 2064 1300 Baqbenep.exe Cgmkmecg.exe PID 1300 wrote to memory of 2064 1300 Baqbenep.exe Cgmkmecg.exe PID 1300 wrote to memory of 2064 1300 Baqbenep.exe Cgmkmecg.exe PID 1300 wrote to memory of 2064 1300 Baqbenep.exe Cgmkmecg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f.exe"C:\Users\Admin\AppData\Local\Temp\771370fbee8cbd8f5de79670e2e3e2529389bfc869c80f2524ae9b3a74c2e88f.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bkodhe32.exeC:\Windows\system32\Bkodhe32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Baildokg.exeC:\Windows\system32\Baildokg.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Beehencq.exeC:\Windows\system32\Beehencq.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bhcdaibd.exeC:\Windows\system32\Bhcdaibd.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bloqah32.exeC:\Windows\system32\Bloqah32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bommnc32.exeC:\Windows\system32\Bommnc32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Balijo32.exeC:\Windows\system32\Balijo32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bdjefj32.exeC:\Windows\system32\Bdjefj32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bhfagipa.exeC:\Windows\system32\Bhfagipa.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bkdmcdoe.exeC:\Windows\system32\Bkdmcdoe.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bnbjopoi.exeC:\Windows\system32\Bnbjopoi.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bpafkknm.exeC:\Windows\system32\Bpafkknm.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bgknheej.exeC:\Windows\system32\Bgknheej.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Bjijdadm.exeC:\Windows\system32\Bjijdadm.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Baqbenep.exeC:\Windows\system32\Baqbenep.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Cgmkmecg.exeC:\Windows\system32\Cgmkmecg.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Cgpgce32.exeC:\Windows\system32\Cgpgce32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Cjndop32.exeC:\Windows\system32\Cjndop32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Cnippoha.exeC:\Windows\system32\Cnippoha.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Cllpkl32.exeC:\Windows\system32\Cllpkl32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Coklgg32.exeC:\Windows\system32\Coklgg32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Ccfhhffh.exeC:\Windows\system32\Ccfhhffh.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Cgbdhd32.exeC:\Windows\system32\Cgbdhd32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Cjpqdp32.exeC:\Windows\system32\Cjpqdp32.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Cpjiajeb.exeC:\Windows\system32\Cpjiajeb.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Cfgaiaci.exeC:\Windows\system32\Cfgaiaci.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Ckdjbh32.exeC:\Windows\system32\Ckdjbh32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Cfinoq32.exeC:\Windows\system32\Cfinoq32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Chhjkl32.exeC:\Windows\system32\Chhjkl32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Ckffgg32.exeC:\Windows\system32\Ckffgg32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Cndbcc32.exeC:\Windows\system32\Cndbcc32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\Ddokpmfo.exeC:\Windows\system32\Ddokpmfo.exe33⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dqelenlc.exeC:\Windows\system32\Dqelenlc.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dhmcfkme.exeC:\Windows\system32\Dhmcfkme.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Dkkpbgli.exeC:\Windows\system32\Dkkpbgli.exe36⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dbehoa32.exeC:\Windows\system32\Dbehoa32.exe37⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dqhhknjp.exeC:\Windows\system32\Dqhhknjp.exe38⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dgaqgh32.exeC:\Windows\system32\Dgaqgh32.exe39⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Djpmccqq.exeC:\Windows\system32\Djpmccqq.exe40⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dmoipopd.exeC:\Windows\system32\Dmoipopd.exe41⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ddeaalpg.exeC:\Windows\system32\Ddeaalpg.exe42⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dgdmmgpj.exeC:\Windows\system32\Dgdmmgpj.exe43⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dfgmhd32.exeC:\Windows\system32\Dfgmhd32.exe44⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dnneja32.exeC:\Windows\system32\Dnneja32.exe45⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dqlafm32.exeC:\Windows\system32\Dqlafm32.exe46⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dcknbh32.exeC:\Windows\system32\Dcknbh32.exe47⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Eihfjo32.exeC:\Windows\system32\Eihfjo32.exe48⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Eqonkmdh.exeC:\Windows\system32\Eqonkmdh.exe49⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ebpkce32.exeC:\Windows\system32\Ebpkce32.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Eijcpoac.exeC:\Windows\system32\Eijcpoac.exe51⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ekholjqg.exeC:\Windows\system32\Ekholjqg.exe52⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\Ecpgmhai.exeC:\Windows\system32\Ecpgmhai.exe53⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ebbgid32.exeC:\Windows\system32\Ebbgid32.exe54⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Eilpeooq.exeC:\Windows\system32\Eilpeooq.exe55⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Emhlfmgj.exeC:\Windows\system32\Emhlfmgj.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Enihne32.exeC:\Windows\system32\Enihne32.exe57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Eecqjpee.exeC:\Windows\system32\Eecqjpee.exe58⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Eiomkn32.exeC:\Windows\system32\Eiomkn32.exe59⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Elmigj32.exeC:\Windows\system32\Elmigj32.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ebgacddo.exeC:\Windows\system32\Ebgacddo.exe61⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Eiaiqn32.exeC:\Windows\system32\Eiaiqn32.exe62⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Eloemi32.exeC:\Windows\system32\Eloemi32.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ennaieib.exeC:\Windows\system32\Ennaieib.exe64⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ealnephf.exeC:\Windows\system32\Ealnephf.exe65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Fhffaj32.exeC:\Windows\system32\Fhffaj32.exe66⤵
-
C:\Windows\SysWOW64\Flabbihl.exeC:\Windows\system32\Flabbihl.exe67⤵
-
C:\Windows\SysWOW64\Flabbihl.exeC:\Windows\system32\Flabbihl.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Fnpnndgp.exeC:\Windows\system32\Fnpnndgp.exe69⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Faokjpfd.exeC:\Windows\system32\Faokjpfd.exe70⤵
-
C:\Windows\SysWOW64\Fejgko32.exeC:\Windows\system32\Fejgko32.exe71⤵
-
C:\Windows\SysWOW64\Fhhcgj32.exeC:\Windows\system32\Fhhcgj32.exe72⤵
-
C:\Windows\SysWOW64\Fjgoce32.exeC:\Windows\system32\Fjgoce32.exe73⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fmekoalh.exeC:\Windows\system32\Fmekoalh.exe74⤵
-
C:\Windows\SysWOW64\Fpdhklkl.exeC:\Windows\system32\Fpdhklkl.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Fdoclk32.exeC:\Windows\system32\Fdoclk32.exe76⤵
-
C:\Windows\SysWOW64\Ffnphf32.exeC:\Windows\system32\Ffnphf32.exe77⤵
-
C:\Windows\SysWOW64\Fjilieka.exeC:\Windows\system32\Fjilieka.exe78⤵
-
C:\Windows\SysWOW64\Fmhheqje.exeC:\Windows\system32\Fmhheqje.exe79⤵
-
C:\Windows\SysWOW64\Facdeo32.exeC:\Windows\system32\Facdeo32.exe80⤵
-
C:\Windows\SysWOW64\Fpfdalii.exeC:\Windows\system32\Fpfdalii.exe81⤵
-
C:\Windows\SysWOW64\Fbdqmghm.exeC:\Windows\system32\Fbdqmghm.exe82⤵
-
C:\Windows\SysWOW64\Fjlhneio.exeC:\Windows\system32\Fjlhneio.exe83⤵
-
C:\Windows\SysWOW64\Fmjejphb.exeC:\Windows\system32\Fmjejphb.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Fphafl32.exeC:\Windows\system32\Fphafl32.exe85⤵
-
C:\Windows\SysWOW64\Fddmgjpo.exeC:\Windows\system32\Fddmgjpo.exe86⤵
-
C:\Windows\SysWOW64\Feeiob32.exeC:\Windows\system32\Feeiob32.exe87⤵
-
C:\Windows\SysWOW64\Fmlapp32.exeC:\Windows\system32\Fmlapp32.exe88⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Gpknlk32.exeC:\Windows\system32\Gpknlk32.exe89⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gbijhg32.exeC:\Windows\system32\Gbijhg32.exe90⤵
-
C:\Windows\SysWOW64\Gfefiemq.exeC:\Windows\system32\Gfefiemq.exe91⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Gicbeald.exeC:\Windows\system32\Gicbeald.exe92⤵
-
C:\Windows\SysWOW64\Gpmjak32.exeC:\Windows\system32\Gpmjak32.exe93⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Gopkmhjk.exeC:\Windows\system32\Gopkmhjk.exe94⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gangic32.exeC:\Windows\system32\Gangic32.exe95⤵
-
C:\Windows\SysWOW64\Gieojq32.exeC:\Windows\system32\Gieojq32.exe96⤵
-
C:\Windows\SysWOW64\Ghhofmql.exeC:\Windows\system32\Ghhofmql.exe97⤵
-
C:\Windows\SysWOW64\Gkgkbipp.exeC:\Windows\system32\Gkgkbipp.exe98⤵
-
C:\Windows\SysWOW64\Gbnccfpb.exeC:\Windows\system32\Gbnccfpb.exe99⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Gaqcoc32.exeC:\Windows\system32\Gaqcoc32.exe100⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Gdopkn32.exeC:\Windows\system32\Gdopkn32.exe101⤵
-
C:\Windows\SysWOW64\Glfhll32.exeC:\Windows\system32\Glfhll32.exe102⤵
-
C:\Windows\SysWOW64\Gkihhhnm.exeC:\Windows\system32\Gkihhhnm.exe103⤵
-
C:\Windows\SysWOW64\Goddhg32.exeC:\Windows\system32\Goddhg32.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Gacpdbej.exeC:\Windows\system32\Gacpdbej.exe105⤵
-
C:\Windows\SysWOW64\Gdamqndn.exeC:\Windows\system32\Gdamqndn.exe106⤵
-
C:\Windows\SysWOW64\Ghmiam32.exeC:\Windows\system32\Ghmiam32.exe107⤵
-
C:\Windows\SysWOW64\Ggpimica.exeC:\Windows\system32\Ggpimica.exe108⤵
-
C:\Windows\SysWOW64\Gkkemh32.exeC:\Windows\system32\Gkkemh32.exe109⤵
-
C:\Windows\SysWOW64\Gmjaic32.exeC:\Windows\system32\Gmjaic32.exe110⤵
-
C:\Windows\SysWOW64\Gaemjbcg.exeC:\Windows\system32\Gaemjbcg.exe111⤵
-
C:\Windows\SysWOW64\Gphmeo32.exeC:\Windows\system32\Gphmeo32.exe112⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gddifnbk.exeC:\Windows\system32\Gddifnbk.exe113⤵
-
C:\Windows\SysWOW64\Gddifnbk.exeC:\Windows\system32\Gddifnbk.exe114⤵
-
C:\Windows\SysWOW64\Ghoegl32.exeC:\Windows\system32\Ghoegl32.exe115⤵
-
C:\Windows\SysWOW64\Hgbebiao.exeC:\Windows\system32\Hgbebiao.exe116⤵
-
C:\Windows\SysWOW64\Hknach32.exeC:\Windows\system32\Hknach32.exe117⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hiqbndpb.exeC:\Windows\system32\Hiqbndpb.exe118⤵
-
C:\Windows\SysWOW64\Hahjpbad.exeC:\Windows\system32\Hahjpbad.exe119⤵
-
C:\Windows\SysWOW64\Hdfflm32.exeC:\Windows\system32\Hdfflm32.exe120⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Hcifgjgc.exeC:\Windows\system32\Hcifgjgc.exe121⤵
-
C:\Windows\SysWOW64\Hgdbhi32.exeC:\Windows\system32\Hgdbhi32.exe122⤵
-
C:\Windows\SysWOW64\Hkpnhgge.exeC:\Windows\system32\Hkpnhgge.exe123⤵
-
C:\Windows\SysWOW64\Hicodd32.exeC:\Windows\system32\Hicodd32.exe124⤵
-
C:\Windows\SysWOW64\Hnojdcfi.exeC:\Windows\system32\Hnojdcfi.exe125⤵
-
C:\Windows\SysWOW64\Hlakpp32.exeC:\Windows\system32\Hlakpp32.exe126⤵
-
C:\Windows\SysWOW64\Hpmgqnfl.exeC:\Windows\system32\Hpmgqnfl.exe127⤵
-
C:\Windows\SysWOW64\Hdhbam32.exeC:\Windows\system32\Hdhbam32.exe128⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Hckcmjep.exeC:\Windows\system32\Hckcmjep.exe129⤵
-
C:\Windows\SysWOW64\Hggomh32.exeC:\Windows\system32\Hggomh32.exe130⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hejoiedd.exeC:\Windows\system32\Hejoiedd.exe131⤵
-
C:\Windows\SysWOW64\Hiekid32.exeC:\Windows\system32\Hiekid32.exe132⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Hnagjbdf.exeC:\Windows\system32\Hnagjbdf.exe133⤵
-
C:\Windows\SysWOW64\Hpocfncj.exeC:\Windows\system32\Hpocfncj.exe134⤵
-
C:\Windows\SysWOW64\Hobcak32.exeC:\Windows\system32\Hobcak32.exe135⤵
-
C:\Windows\SysWOW64\Hcnpbi32.exeC:\Windows\system32\Hcnpbi32.exe136⤵
-
C:\Windows\SysWOW64\Hgilchkf.exeC:\Windows\system32\Hgilchkf.exe137⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Hellne32.exeC:\Windows\system32\Hellne32.exe138⤵
-
C:\Windows\SysWOW64\Hhjhkq32.exeC:\Windows\system32\Hhjhkq32.exe139⤵
-
C:\Windows\SysWOW64\Hlfdkoin.exeC:\Windows\system32\Hlfdkoin.exe140⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Hpapln32.exeC:\Windows\system32\Hpapln32.exe141⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Hodpgjha.exeC:\Windows\system32\Hodpgjha.exe142⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Hacmcfge.exeC:\Windows\system32\Hacmcfge.exe143⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Henidd32.exeC:\Windows\system32\Henidd32.exe144⤵
-
C:\Windows\SysWOW64\Hjjddchg.exeC:\Windows\system32\Hjjddchg.exe145⤵
-
C:\Windows\SysWOW64\Hhmepp32.exeC:\Windows\system32\Hhmepp32.exe146⤵
-
C:\Windows\SysWOW64\Hlhaqogk.exeC:\Windows\system32\Hlhaqogk.exe147⤵
-
C:\Windows\SysWOW64\Hkkalk32.exeC:\Windows\system32\Hkkalk32.exe148⤵
-
C:\Windows\SysWOW64\Hogmmjfo.exeC:\Windows\system32\Hogmmjfo.exe149⤵
-
C:\Windows\SysWOW64\Icbimi32.exeC:\Windows\system32\Icbimi32.exe150⤵
-
C:\Windows\SysWOW64\Iaeiieeb.exeC:\Windows\system32\Iaeiieeb.exe151⤵
-
C:\Windows\SysWOW64\Idceea32.exeC:\Windows\system32\Idceea32.exe152⤵
-
C:\Windows\SysWOW64\Ihoafpmp.exeC:\Windows\system32\Ihoafpmp.exe153⤵
-
C:\Windows\SysWOW64\Ilknfn32.exeC:\Windows\system32\Ilknfn32.exe154⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Iknnbklc.exeC:\Windows\system32\Iknnbklc.exe155⤵
-
C:\Windows\SysWOW64\Ioijbj32.exeC:\Windows\system32\Ioijbj32.exe156⤵
-
C:\Windows\SysWOW64\Inljnfkg.exeC:\Windows\system32\Inljnfkg.exe157⤵
-
C:\Windows\SysWOW64\Ifcbodli.exeC:\Windows\system32\Ifcbodli.exe158⤵
-
C:\Windows\SysWOW64\Idfbkq32.exeC:\Windows\system32\Idfbkq32.exe159⤵
-
C:\Windows\SysWOW64\Ihankokm.exeC:\Windows\system32\Ihankokm.exe160⤵
-
C:\Windows\SysWOW64\Igdogl32.exeC:\Windows\system32\Igdogl32.exe161⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ikpjgkjq.exeC:\Windows\system32\Ikpjgkjq.exe162⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Iokfhi32.exeC:\Windows\system32\Iokfhi32.exe163⤵
-
C:\Windows\SysWOW64\Inngcfid.exeC:\Windows\system32\Inngcfid.exe164⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Iajcde32.exeC:\Windows\system32\Iajcde32.exe165⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Iqmcpahh.exeC:\Windows\system32\Iqmcpahh.exe166⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Idhopq32.exeC:\Windows\system32\Idhopq32.exe167⤵
-
C:\Windows\SysWOW64\Iggkllpe.exeC:\Windows\system32\Iggkllpe.exe168⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ikbgmj32.exeC:\Windows\system32\Ikbgmj32.exe169⤵
-
C:\Windows\SysWOW64\Ijeghgoh.exeC:\Windows\system32\Ijeghgoh.exe170⤵
-
C:\Windows\SysWOW64\Inqcif32.exeC:\Windows\system32\Inqcif32.exe171⤵
-
C:\Windows\SysWOW64\Iblpjdpk.exeC:\Windows\system32\Iblpjdpk.exe172⤵
-
C:\Windows\SysWOW64\Iqopea32.exeC:\Windows\system32\Iqopea32.exe173⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Idklfpon.exeC:\Windows\system32\Idklfpon.exe174⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Icmlam32.exeC:\Windows\system32\Icmlam32.exe175⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Igihbknb.exeC:\Windows\system32\Igihbknb.exe176⤵
-
C:\Windows\SysWOW64\Ikddbj32.exeC:\Windows\system32\Ikddbj32.exe177⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ijgdngmf.exeC:\Windows\system32\Ijgdngmf.exe178⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Incpoe32.exeC:\Windows\system32\Incpoe32.exe179⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Imfqjbli.exeC:\Windows\system32\Imfqjbli.exe180⤵
-
C:\Windows\SysWOW64\Iqalka32.exeC:\Windows\system32\Iqalka32.exe181⤵
-
C:\Windows\SysWOW64\Idmhkpml.exeC:\Windows\system32\Idmhkpml.exe182⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Icpigm32.exeC:\Windows\system32\Icpigm32.exe183⤵
-
C:\Windows\SysWOW64\Jnemdecl.exeC:\Windows\system32\Jnemdecl.exe184⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Jqdipqbp.exeC:\Windows\system32\Jqdipqbp.exe185⤵
-
C:\Windows\SysWOW64\Jcbellac.exeC:\Windows\system32\Jcbellac.exe186⤵
-
C:\Windows\SysWOW64\Jfqahgpg.exeC:\Windows\system32\Jfqahgpg.exe187⤵
-
C:\Windows\SysWOW64\Jmjjea32.exeC:\Windows\system32\Jmjjea32.exe188⤵
-
C:\Windows\SysWOW64\Joifam32.exeC:\Windows\system32\Joifam32.exe189⤵
-
C:\Windows\SysWOW64\Jbgbni32.exeC:\Windows\system32\Jbgbni32.exe190⤵
-
C:\Windows\SysWOW64\Jjojofgn.exeC:\Windows\system32\Jjojofgn.exe191⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Jiakjb32.exeC:\Windows\system32\Jiakjb32.exe192⤵
-
C:\Windows\SysWOW64\Jmmfkafa.exeC:\Windows\system32\Jmmfkafa.exe193⤵
-
C:\Windows\SysWOW64\Jcgogk32.exeC:\Windows\system32\Jcgogk32.exe194⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Jbjochdi.exeC:\Windows\system32\Jbjochdi.exe195⤵
-
C:\Windows\SysWOW64\Jehkodcm.exeC:\Windows\system32\Jehkodcm.exe196⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Jmocpado.exeC:\Windows\system32\Jmocpado.exe197⤵
-
C:\Windows\SysWOW64\Jkbcln32.exeC:\Windows\system32\Jkbcln32.exe198⤵
-
C:\Windows\SysWOW64\Jifdebic.exeC:\Windows\system32\Jifdebic.exe199⤵
-
C:\Windows\SysWOW64\Jgidao32.exeC:\Windows\system32\Jgidao32.exe200⤵
-
C:\Windows\SysWOW64\Jkdpanhg.exeC:\Windows\system32\Jkdpanhg.exe201⤵
-
C:\Windows\SysWOW64\Joplbl32.exeC:\Windows\system32\Joplbl32.exe202⤵
-
C:\Windows\SysWOW64\Jnclnihj.exeC:\Windows\system32\Jnclnihj.exe203⤵
-
C:\Windows\SysWOW64\Kaaijdgn.exeC:\Windows\system32\Kaaijdgn.exe204⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kemejc32.exeC:\Windows\system32\Kemejc32.exe205⤵
-
C:\Windows\SysWOW64\Kihqkagp.exeC:\Windows\system32\Kihqkagp.exe206⤵
-
C:\Windows\SysWOW64\Kgkafo32.exeC:\Windows\system32\Kgkafo32.exe207⤵
-
C:\Windows\SysWOW64\Kjjmbj32.exeC:\Windows\system32\Kjjmbj32.exe208⤵
-
C:\Windows\SysWOW64\Kneicieh.exeC:\Windows\system32\Kneicieh.exe209⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Kbqecg32.exeC:\Windows\system32\Kbqecg32.exe210⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Kaceodek.exeC:\Windows\system32\Kaceodek.exe211⤵
-
C:\Windows\SysWOW64\Keoapb32.exeC:\Windows\system32\Keoapb32.exe212⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Kcbakpdo.exeC:\Windows\system32\Kcbakpdo.exe213⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kgnnln32.exeC:\Windows\system32\Kgnnln32.exe214⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kkijmm32.exeC:\Windows\system32\Kkijmm32.exe215⤵
-
C:\Windows\SysWOW64\Kngfih32.exeC:\Windows\system32\Kngfih32.exe216⤵
-
C:\Windows\SysWOW64\Kmjfdejp.exeC:\Windows\system32\Kmjfdejp.exe217⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kafbec32.exeC:\Windows\system32\Kafbec32.exe218⤵
-
C:\Windows\SysWOW64\Keanebkb.exeC:\Windows\system32\Keanebkb.exe219⤵
-
C:\Windows\SysWOW64\Kcdnao32.exeC:\Windows\system32\Kcdnao32.exe220⤵
-
C:\Windows\SysWOW64\Kgpjanje.exeC:\Windows\system32\Kgpjanje.exe221⤵
-
C:\Windows\SysWOW64\Kfbkmk32.exeC:\Windows\system32\Kfbkmk32.exe222⤵
-
C:\Windows\SysWOW64\Kjnfniii.exeC:\Windows\system32\Kjnfniii.exe223⤵
-
C:\Windows\SysWOW64\Kmmcjehm.exeC:\Windows\system32\Kmmcjehm.exe224⤵
-
C:\Windows\SysWOW64\Kahojc32.exeC:\Windows\system32\Kahojc32.exe225⤵
-
C:\Windows\SysWOW64\Kpkofpgq.exeC:\Windows\system32\Kpkofpgq.exe226⤵
-
C:\Windows\SysWOW64\Kcfkfo32.exeC:\Windows\system32\Kcfkfo32.exe227⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kgbggnhc.exeC:\Windows\system32\Kgbggnhc.exe228⤵
-
C:\Windows\SysWOW64\Kfegbj32.exeC:\Windows\system32\Kfegbj32.exe229⤵
-
C:\Windows\SysWOW64\Kjqccigf.exeC:\Windows\system32\Kjqccigf.exe230⤵
-
C:\Windows\SysWOW64\Kiccofna.exeC:\Windows\system32\Kiccofna.exe231⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Kmopod32.exeC:\Windows\system32\Kmopod32.exe232⤵
-
C:\Windows\SysWOW64\Kaklpcoc.exeC:\Windows\system32\Kaklpcoc.exe233⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kpmlkp32.exeC:\Windows\system32\Kpmlkp32.exe234⤵
-
C:\Windows\SysWOW64\Kblhgk32.exeC:\Windows\system32\Kblhgk32.exe235⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kfgdhjmk.exeC:\Windows\system32\Kfgdhjmk.exe236⤵
-
C:\Windows\SysWOW64\Kfgdhjmk.exeC:\Windows\system32\Kfgdhjmk.exe237⤵
-
C:\Windows\SysWOW64\Kjcpii32.exeC:\Windows\system32\Kjcpii32.exe238⤵
-
C:\Windows\SysWOW64\Kmaled32.exeC:\Windows\system32\Kmaled32.exe239⤵
-
C:\Windows\SysWOW64\Lldlqakb.exeC:\Windows\system32\Lldlqakb.exe240⤵
-
C:\Windows\SysWOW64\Lldlqakb.exeC:\Windows\system32\Lldlqakb.exe241⤵