Analysis
-
max time kernel
142s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 18:48
Static task
static1
Behavioral task
behavioral1
Sample
1521c65db96107b65b083eab22f7fc52a5b3604491beb36c69393922c11ac90d.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1521c65db96107b65b083eab22f7fc52a5b3604491beb36c69393922c11ac90d.exe
Resource
win10v2004-20240508-en
General
-
Target
1521c65db96107b65b083eab22f7fc52a5b3604491beb36c69393922c11ac90d.exe
-
Size
163KB
-
MD5
ef319813f68a56fb666df2b1cc7d94cb
-
SHA1
18f8d1d55c48c45018c2f81919a4f8ee3143d1ed
-
SHA256
1521c65db96107b65b083eab22f7fc52a5b3604491beb36c69393922c11ac90d
-
SHA512
9cf17c746a23120c50b9163415c55667b79aed5ccd8449f947a659d5749598c7eada6eff3a6da4cefa633bb66002c4704e48affd357d8500fffbad12a169b7fd
-
SSDEEP
1536:PrPha/IUhAB769XNniz2j6VBvqkfBZmebk+r/nwVlProNVU4qNVUrk/9QbfBr+7g:D2Mu9sz223vKenPqltOrWKDBr+yJb
Malware Config
Extracted
gozi
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Bmmiij32.exeCgbfamff.exePfoocjfd.exeBdeeqehb.exeLbiqfied.exeEloemi32.exeDlnbeh32.exePkidlk32.exeOfelmloo.exeOjcecjee.exeLlohjo32.exeNgibaj32.exeNpccpo32.exeAlhmjbhj.exeBilmcf32.exeDkmmhf32.exeGfobbc32.exeMkclhl32.exeHomclekn.exeJhljdm32.exeQkhpkoen.exeFfbicfoc.exeJbnhng32.exePnlqnl32.exeLnbbbffj.exeEbinic32.exeBajomhbl.exeLemaif32.exePkndaa32.exeIokfhi32.exeOonafa32.exeAlpmfdcb.exeBiamilfj.exeBekkcljk.exeJjojofgn.exeIccbqh32.exeEcqqpgli.exeIamimc32.exeJbdonb32.exeKaklpcoc.exeQbbhgi32.exeCkccgane.exeDgfjbgmh.exeOddpfc32.exeJnclnihj.exeHhckpk32.exeBjbcfn32.exeHbfbgd32.exePdaheq32.exeQiladcdh.exeFbgmbg32.exeFhqbkhch.exeKincipnk.exeMholen32.exeCddjebgb.exeFbdqmghm.exeGicbeald.exeNcgdbmmp.exeBehnnm32.exeNmbknddp.exePapfegmk.exeGhhofmql.exeDjklnnaj.exeJmplcp32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bmmiij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cgbfamff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pfoocjfd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bdeeqehb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lbiqfied.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eloemi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dlnbeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pkidlk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofelmloo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ojcecjee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Llohjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ngibaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Npccpo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Alhmjbhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bilmcf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dkmmhf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gfobbc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkclhl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Homclekn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jhljdm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qkhpkoen.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ffbicfoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jbnhng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pnlqnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lnbbbffj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebinic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bajomhbl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lemaif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pkndaa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iokfhi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oonafa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Alpmfdcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Biamilfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bekkcljk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jjojofgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iccbqh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ecqqpgli.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iamimc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jbdonb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kaklpcoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qbbhgi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckccgane.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dgfjbgmh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oddpfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jnclnihj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhckpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bjbcfn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hbfbgd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pdaheq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qiladcdh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fbgmbg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fhqbkhch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kincipnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mholen32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cddjebgb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fbdqmghm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gicbeald.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ncgdbmmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Behnnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nmbknddp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Papfegmk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghhofmql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Djklnnaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jmplcp32.exe -
Detects executables built or packed with MPress PE compressor 64 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\Piblek32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Peiljl32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Ppoqge32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Pfiidobe.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Ppamme32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Pabjem32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Qlhnbf32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Qnfjna32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Qaefjm32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Qjmkcbcb.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Qecoqk32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Afdlhchf.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Aplpai32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Affhncfc.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Apomfh32.exe INDICATOR_EXE_Packed_MPress \Windows\SysWOW64\Abmibdlh.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Apajlhka.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Abpfhcje.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Amejeljk.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Apcfahio.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Aepojo32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ahokfj32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bagpopmj.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bhahlj32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bbflib32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bommnc32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Begeknan.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bkdmcdoe.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bnbjopoi.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bkfjhd32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bjijdadm.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Baqbenep.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Bcaomf32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ckignd32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cljcelan.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ccdlbf32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cnippoha.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ccfhhffh.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cfeddafl.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Chcqpmep.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cpjiajeb.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cfgaiaci.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Claifkkf.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cckace32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ckffgg32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cobbhfhg.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Chhjkl32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Cfinoq32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dbpodagk.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dgmglh32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ddokpmfo.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dkhcmgnl.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dngoibmo.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ddagfm32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dbbkja32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dgodbh32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dkkpbgli.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dnilobkm.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dqhhknjp.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dkmmhf32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dnlidb32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Ddeaalpg.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dchali32.exe INDICATOR_EXE_Packed_MPress C:\Windows\SysWOW64\Dfgmhd32.exe INDICATOR_EXE_Packed_MPress -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\Piblek32.exe UPX \Windows\SysWOW64\Peiljl32.exe UPX \Windows\SysWOW64\Ppoqge32.exe UPX C:\Windows\SysWOW64\Pfiidobe.exe UPX \Windows\SysWOW64\Ppamme32.exe UPX \Windows\SysWOW64\Pabjem32.exe UPX \Windows\SysWOW64\Qlhnbf32.exe UPX C:\Windows\SysWOW64\Qnfjna32.exe UPX \Windows\SysWOW64\Qaefjm32.exe UPX \Windows\SysWOW64\Qjmkcbcb.exe UPX \Windows\SysWOW64\Qecoqk32.exe UPX \Windows\SysWOW64\Afdlhchf.exe UPX \Windows\SysWOW64\Aplpai32.exe UPX \Windows\SysWOW64\Affhncfc.exe UPX \Windows\SysWOW64\Apomfh32.exe UPX \Windows\SysWOW64\Abmibdlh.exe UPX C:\Windows\SysWOW64\Apajlhka.exe UPX C:\Windows\SysWOW64\Abpfhcje.exe UPX C:\Windows\SysWOW64\Amejeljk.exe UPX C:\Windows\SysWOW64\Apcfahio.exe UPX C:\Windows\SysWOW64\Aepojo32.exe UPX C:\Windows\SysWOW64\Ahokfj32.exe UPX C:\Windows\SysWOW64\Bagpopmj.exe UPX C:\Windows\SysWOW64\Bhahlj32.exe UPX C:\Windows\SysWOW64\Bbflib32.exe UPX C:\Windows\SysWOW64\Bommnc32.exe UPX C:\Windows\SysWOW64\Begeknan.exe UPX C:\Windows\SysWOW64\Bkdmcdoe.exe UPX C:\Windows\SysWOW64\Bnbjopoi.exe UPX C:\Windows\SysWOW64\Bkfjhd32.exe UPX C:\Windows\SysWOW64\Bjijdadm.exe UPX C:\Windows\SysWOW64\Baqbenep.exe UPX C:\Windows\SysWOW64\Bcaomf32.exe UPX C:\Windows\SysWOW64\Ckignd32.exe UPX C:\Windows\SysWOW64\Cljcelan.exe UPX behavioral1/memory/112-415-0x0000000000400000-0x0000000000453000-memory.dmp UPX C:\Windows\SysWOW64\Ccdlbf32.exe UPX C:\Windows\SysWOW64\Cnippoha.exe UPX C:\Windows\SysWOW64\Ccfhhffh.exe UPX C:\Windows\SysWOW64\Cfeddafl.exe UPX C:\Windows\SysWOW64\Chcqpmep.exe UPX C:\Windows\SysWOW64\Cpjiajeb.exe UPX C:\Windows\SysWOW64\Cfgaiaci.exe UPX C:\Windows\SysWOW64\Claifkkf.exe UPX C:\Windows\SysWOW64\Cckace32.exe UPX C:\Windows\SysWOW64\Ckffgg32.exe UPX C:\Windows\SysWOW64\Cobbhfhg.exe UPX C:\Windows\SysWOW64\Chhjkl32.exe UPX C:\Windows\SysWOW64\Cfinoq32.exe UPX C:\Windows\SysWOW64\Dbpodagk.exe UPX C:\Windows\SysWOW64\Dgmglh32.exe UPX C:\Windows\SysWOW64\Ddokpmfo.exe UPX C:\Windows\SysWOW64\Dkhcmgnl.exe UPX C:\Windows\SysWOW64\Dngoibmo.exe UPX C:\Windows\SysWOW64\Ddagfm32.exe UPX C:\Windows\SysWOW64\Dbbkja32.exe UPX C:\Windows\SysWOW64\Dgodbh32.exe UPX C:\Windows\SysWOW64\Dkkpbgli.exe UPX C:\Windows\SysWOW64\Dnilobkm.exe UPX C:\Windows\SysWOW64\Dqhhknjp.exe UPX C:\Windows\SysWOW64\Dkmmhf32.exe UPX C:\Windows\SysWOW64\Dnlidb32.exe UPX C:\Windows\SysWOW64\Ddeaalpg.exe UPX C:\Windows\SysWOW64\Dchali32.exe UPX -
Executes dropped EXE 64 IoCs
Processes:
Piblek32.exePeiljl32.exePpoqge32.exePfiidobe.exePpamme32.exePabjem32.exeQlhnbf32.exeQnfjna32.exeQaefjm32.exeQjmkcbcb.exeQecoqk32.exeAfdlhchf.exeAplpai32.exeAffhncfc.exeApomfh32.exeAbmibdlh.exeApajlhka.exeAbpfhcje.exeAmejeljk.exeApcfahio.exeAepojo32.exeAhokfj32.exeBagpopmj.exeBhahlj32.exeBbflib32.exeBommnc32.exeBegeknan.exeBkdmcdoe.exeBnbjopoi.exeBkfjhd32.exeBjijdadm.exeBaqbenep.exeBcaomf32.exeCkignd32.exeCljcelan.exeCcdlbf32.exeCnippoha.exeCcfhhffh.exeCfeddafl.exeChcqpmep.exeCpjiajeb.exeCfgaiaci.exeClaifkkf.exeCckace32.exeCfinoq32.exeChhjkl32.exeCkffgg32.exeCobbhfhg.exeDbpodagk.exeDdokpmfo.exeDgmglh32.exeDkhcmgnl.exeDngoibmo.exeDbbkja32.exeDdagfm32.exeDgodbh32.exeDkkpbgli.exeDnilobkm.exeDqhhknjp.exeDkmmhf32.exeDnlidb32.exeDdeaalpg.exeDchali32.exeDfgmhd32.exepid process 2728 Piblek32.exe 1948 Peiljl32.exe 2628 Ppoqge32.exe 2288 Pfiidobe.exe 2476 Ppamme32.exe 2612 Pabjem32.exe 2520 Qlhnbf32.exe 2240 Qnfjna32.exe 2532 Qaefjm32.exe 2336 Qjmkcbcb.exe 1264 Qecoqk32.exe 2732 Afdlhchf.exe 2028 Aplpai32.exe 2788 Affhncfc.exe 2244 Apomfh32.exe 484 Abmibdlh.exe 1392 Apajlhka.exe 1724 Abpfhcje.exe 2104 Amejeljk.exe 2088 Apcfahio.exe 1688 Aepojo32.exe 1300 Ahokfj32.exe 2540 Bagpopmj.exe 968 Bhahlj32.exe 1868 Bbflib32.exe 1524 Bommnc32.exe 1712 Begeknan.exe 3060 Bkdmcdoe.exe 2596 Bnbjopoi.exe 2560 Bkfjhd32.exe 2804 Bjijdadm.exe 2464 Baqbenep.exe 2680 Bcaomf32.exe 2924 Ckignd32.exe 112 Cljcelan.exe 1556 Ccdlbf32.exe 1536 Cnippoha.exe 1252 Ccfhhffh.exe 2032 Cfeddafl.exe 1680 Chcqpmep.exe 2932 Cpjiajeb.exe 1864 Cfgaiaci.exe 656 Claifkkf.exe 1976 Cckace32.exe 1428 Cfinoq32.exe 2324 Chhjkl32.exe 2424 Ckffgg32.exe 316 Cobbhfhg.exe 736 Dbpodagk.exe 840 Ddokpmfo.exe 1456 Dgmglh32.exe 1132 Dkhcmgnl.exe 1696 Dngoibmo.exe 1628 Dbbkja32.exe 2588 Ddagfm32.exe 2700 Dgodbh32.exe 2580 Dkkpbgli.exe 2376 Dnilobkm.exe 2460 Dqhhknjp.exe 852 Dkmmhf32.exe 1532 Dnlidb32.exe 1304 Ddeaalpg.exe 2624 Dchali32.exe 2884 Dfgmhd32.exe -
Loads dropped DLL 64 IoCs
Processes:
1521c65db96107b65b083eab22f7fc52a5b3604491beb36c69393922c11ac90d.exePiblek32.exePeiljl32.exePpoqge32.exePfiidobe.exePpamme32.exePabjem32.exeQlhnbf32.exeQnfjna32.exeQaefjm32.exeQjmkcbcb.exeQecoqk32.exeAfdlhchf.exeAplpai32.exeAffhncfc.exeApomfh32.exeAbmibdlh.exeApajlhka.exeAbpfhcje.exeAmejeljk.exeApcfahio.exeAepojo32.exeAhokfj32.exeBagpopmj.exeBhahlj32.exeBbflib32.exeBommnc32.exeBegeknan.exeBkdmcdoe.exeBnbjopoi.exeBkfjhd32.exeBjijdadm.exepid process 2968 1521c65db96107b65b083eab22f7fc52a5b3604491beb36c69393922c11ac90d.exe 2968 1521c65db96107b65b083eab22f7fc52a5b3604491beb36c69393922c11ac90d.exe 2728 Piblek32.exe 2728 Piblek32.exe 1948 Peiljl32.exe 1948 Peiljl32.exe 2628 Ppoqge32.exe 2628 Ppoqge32.exe 2288 Pfiidobe.exe 2288 Pfiidobe.exe 2476 Ppamme32.exe 2476 Ppamme32.exe 2612 Pabjem32.exe 2612 Pabjem32.exe 2520 Qlhnbf32.exe 2520 Qlhnbf32.exe 2240 Qnfjna32.exe 2240 Qnfjna32.exe 2532 Qaefjm32.exe 2532 Qaefjm32.exe 2336 Qjmkcbcb.exe 2336 Qjmkcbcb.exe 1264 Qecoqk32.exe 1264 Qecoqk32.exe 2732 Afdlhchf.exe 2732 Afdlhchf.exe 2028 Aplpai32.exe 2028 Aplpai32.exe 2788 Affhncfc.exe 2788 Affhncfc.exe 2244 Apomfh32.exe 2244 Apomfh32.exe 484 Abmibdlh.exe 484 Abmibdlh.exe 1392 Apajlhka.exe 1392 Apajlhka.exe 1724 Abpfhcje.exe 1724 Abpfhcje.exe 2104 Amejeljk.exe 2104 Amejeljk.exe 2088 Apcfahio.exe 2088 Apcfahio.exe 1688 Aepojo32.exe 1688 Aepojo32.exe 1300 Ahokfj32.exe 1300 Ahokfj32.exe 2540 Bagpopmj.exe 2540 Bagpopmj.exe 968 Bhahlj32.exe 968 Bhahlj32.exe 1868 Bbflib32.exe 1868 Bbflib32.exe 1524 Bommnc32.exe 1524 Bommnc32.exe 1712 Begeknan.exe 1712 Begeknan.exe 3060 Bkdmcdoe.exe 3060 Bkdmcdoe.exe 2596 Bnbjopoi.exe 2596 Bnbjopoi.exe 2560 Bkfjhd32.exe 2560 Bkfjhd32.exe 2804 Bjijdadm.exe 2804 Bjijdadm.exe -
Drops file in System32 directory 64 IoCs
Processes:
Jjdmmdnh.exeAganeoip.exeNaajoinb.exeJhngjmlo.exeAipddi32.exeCdikkg32.exeKiqpop32.exeOdoloalf.exeAaolidlk.exeLpphap32.exePgpeal32.exeNcmfqkdj.exeCkjpacfp.exeJbdonb32.exeOkoafmkm.exeMeagci32.exeQcpofbjl.exeEmnndlod.exeGljnej32.exeJcgogk32.exeMmneda32.exeMieeibkn.exeNgfflj32.exeLcojjmea.exeKmmcjehm.exeBpiipf32.exeCkafbbph.exeLmikibio.exeDkhcmgnl.exeApimacnn.exeNondgn32.exeOklkmnbp.exeAfcenm32.exeIchllgfb.exeBlkioa32.exeLbeknj32.exeIompkh32.exeBhahlj32.exeChcqpmep.exeJifdebic.exeKgbggnhc.exeLbqabkql.exeCdlgpgef.exePiblek32.exeLcfqkl32.exeFagjnn32.exeQbcpbo32.exeGlgaok32.exeGbcfadgl.exeHakphqja.exeIdnaoohk.exePngphgbf.exeLpdbloof.exeOopnlacm.exePmccjbaf.exeCckace32.exeEjbfhfaj.exeFacdeo32.exeGbomfe32.exeChhjkl32.exeJcdbbloa.exedescription ioc process File created C:\Windows\SysWOW64\Jmbiipml.exe Jjdmmdnh.exe File opened for modification C:\Windows\SysWOW64\Akmjfn32.exe Aganeoip.exe File opened for modification C:\Windows\SysWOW64\Npdjje32.exe Naajoinb.exe File created C:\Windows\SysWOW64\Dgalgjnb.dll Jhngjmlo.exe File created C:\Windows\SysWOW64\Amkpegnj.exe Aipddi32.exe File created C:\Windows\SysWOW64\Iigpciig.dll Naajoinb.exe File created C:\Windows\SysWOW64\Cghggc32.exe Cdikkg32.exe File created C:\Windows\SysWOW64\Kkolkk32.exe Kiqpop32.exe File opened for modification C:\Windows\SysWOW64\Pkidlk32.exe Odoloalf.exe File opened for modification C:\Windows\SysWOW64\Acmhepko.exe Aaolidlk.exe File opened for modification C:\Windows\SysWOW64\Lbnemk32.exe Lpphap32.exe File opened for modification C:\Windows\SysWOW64\Pjnamh32.exe Pgpeal32.exe File created C:\Windows\SysWOW64\Ngibaj32.exe Ncmfqkdj.exe File created C:\Windows\SysWOW64\Coelaaoi.exe Ckjpacfp.exe File created C:\Windows\SysWOW64\Jhngjmlo.exe Jbdonb32.exe File created C:\Windows\SysWOW64\Oaiibg32.exe Okoafmkm.exe File created C:\Windows\SysWOW64\Oincig32.dll Meagci32.exe File created C:\Windows\SysWOW64\Qbcpbo32.exe Qcpofbjl.exe File created C:\Windows\SysWOW64\Ahoanjcc.dll Emnndlod.exe File created C:\Windows\SysWOW64\Gpejeihi.exe Gljnej32.exe File created C:\Windows\SysWOW64\Phoccb32.dll Jcgogk32.exe File opened for modification C:\Windows\SysWOW64\Mpmapm32.exe Mmneda32.exe File created C:\Windows\SysWOW64\Ombhbhel.dll Mieeibkn.exe File created C:\Windows\SysWOW64\Niebhf32.exe Ngfflj32.exe File opened for modification C:\Windows\SysWOW64\Lgjfkk32.exe Lcojjmea.exe File created C:\Windows\SysWOW64\Hoamnbaf.dll Kmmcjehm.exe File created C:\Windows\SysWOW64\Ligkin32.dll Bpiipf32.exe File created C:\Windows\SysWOW64\Cnobnmpl.exe Ckafbbph.exe File created C:\Windows\SysWOW64\Lphhenhc.exe Lmikibio.exe File opened for modification C:\Windows\SysWOW64\Dngoibmo.exe Dkhcmgnl.exe File opened for modification C:\Windows\SysWOW64\Anlmmp32.exe Apimacnn.exe File opened for modification C:\Windows\SysWOW64\Ncjqhmkm.exe Nondgn32.exe File opened for modification C:\Windows\SysWOW64\Ojolhk32.exe Oklkmnbp.exe File created C:\Windows\SysWOW64\Aibajhdn.exe Afcenm32.exe File opened for modification C:\Windows\SysWOW64\Iefhhbef.exe Ichllgfb.exe File opened for modification C:\Windows\SysWOW64\Bpfeppop.exe Blkioa32.exe File created C:\Windows\SysWOW64\Minceo32.dll Lbeknj32.exe File opened for modification C:\Windows\SysWOW64\Coelaaoi.exe Ckjpacfp.exe File created C:\Windows\SysWOW64\Ichllgfb.exe Iompkh32.exe File created C:\Windows\SysWOW64\Acmhepko.exe Aaolidlk.exe File opened for modification C:\Windows\SysWOW64\Bbflib32.exe Bhahlj32.exe File created C:\Windows\SysWOW64\Cpjiajeb.exe Chcqpmep.exe File opened for modification C:\Windows\SysWOW64\Jkdpanhg.exe Jifdebic.exe File created C:\Windows\SysWOW64\Kjqccigf.exe Kgbggnhc.exe File created C:\Windows\SysWOW64\Leonofpp.exe Lbqabkql.exe File created C:\Windows\SysWOW64\Qbgpffch.dll Cdlgpgef.exe File created C:\Windows\SysWOW64\Kjcidhml.dll Piblek32.exe File opened for modification C:\Windows\SysWOW64\Lbiqfied.exe Lcfqkl32.exe File opened for modification C:\Windows\SysWOW64\Febfomdd.exe Fagjnn32.exe File created C:\Windows\SysWOW64\Qfokbnip.exe Qbcpbo32.exe File created C:\Windows\SysWOW64\Mncfoa32.dll Glgaok32.exe File created C:\Windows\SysWOW64\Nhhbld32.dll Gbcfadgl.exe File opened for modification C:\Windows\SysWOW64\Hdildlie.exe Hakphqja.exe File created C:\Windows\SysWOW64\Qdkghm32.dll Idnaoohk.exe File created C:\Windows\SysWOW64\Pdaheq32.exe Pngphgbf.exe File created C:\Windows\SysWOW64\Gqncakcq.dll Lpdbloof.exe File opened for modification C:\Windows\SysWOW64\Oclilp32.exe Oopnlacm.exe File created C:\Windows\SysWOW64\Poapfn32.exe Pmccjbaf.exe File created C:\Windows\SysWOW64\Cfinoq32.exe Cckace32.exe File created C:\Windows\SysWOW64\Pinfim32.dll Ejbfhfaj.exe File created C:\Windows\SysWOW64\Fdapak32.exe Facdeo32.exe File opened for modification C:\Windows\SysWOW64\Gfjhgdck.exe Gbomfe32.exe File created C:\Windows\SysWOW64\Ckffgg32.exe Chhjkl32.exe File created C:\Windows\SysWOW64\Jbgbni32.exe Jcdbbloa.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 7656 7608 WerFault.exe Ceegmj32.exe -
Modifies registry class 64 IoCs
Processes:
Kpjhkjde.exeLbcnhjnj.exeChbjffad.exeEmkaol32.exeAhokfj32.exeBkfjhd32.exeChcqpmep.exeEmcbkn32.exeKeoapb32.exeJnicmdli.exeJghmfhmb.exeFbgmbg32.exeKaaijdgn.exeGlgaok32.exeEpdkli32.exeGoddhg32.exeBpnbkeld.exeEchfaf32.exeIlqpdm32.exeAckkppma.exeEihfjo32.exeNdbcpd32.exeGmbdnn32.exeIleiplhn.exeLjibgg32.exeIeqeidnl.exePkndaa32.exeHkaglf32.exeLjkomfjl.exeFmekoalh.exeGbnccfpb.exeKcbakpdo.exeOjcecjee.exeAehboi32.exeNgfflj32.exeBejdiffp.exeHodpgjha.exeJnqphi32.exeLpphap32.exeCahail32.exeModkfi32.exeAepojo32.exeLeajdfnm.exeQmicohqm.exeEfaibbij.exeAganeoip.exeEpfhbign.exeKgkafo32.exeObafnlpn.exeHpgfki32.exeCkafbbph.exePjbjhgde.exeAnafhopc.exeBfenbpec.exeDcadac32.exeGdamqndn.exeIhankokm.exeNolhan32.exeNncahjgl.exeNdmjedoi.exeGpejeihi.exeNpojdpef.exeNodgel32.exePjldghjm.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pelggd32.dll" Kpjhkjde.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lbcnhjnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Chbjffad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jaqddb32.dll" Emkaol32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ahokfj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bkfjhd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Chcqpmep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Emcbkn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dglhipbb.dll" Keoapb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jnicmdli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jghmfhmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fbgmbg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdnaeh32.dll" Kaaijdgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mncfoa32.dll" Glgaok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dekpaqgc.dll" Epdkli32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Goddhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aafminbq.dll" Bpnbkeld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Echfaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ilqpdm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ackkppma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eihfjo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ndbcpd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfdnjb32.dll" Gmbdnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ileiplhn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ljibgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ieqeidnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pkndaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hkaglf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ljkomfjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fmekoalh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fndldonj.dll" Gbnccfpb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kcbakpdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inkaippf.dll" Ojcecjee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aehboi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ngfflj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bejdiffp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hodpgjha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jnqphi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lpphap32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cahail32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Modkfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aepojo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bibkki32.dll" Leajdfnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qmicohqm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Efaibbij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elmnchif.dll" Aganeoip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Epfhbign.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldlimbcf.dll" Kgkafo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Obafnlpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hpgfki32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ckafbbph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pjbjhgde.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Anafhopc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bfenbpec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dcadac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gdamqndn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ihankokm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkeemhpn.dll" Nolhan32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nncahjgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gonahjjd.dll" Ndmjedoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkdjlion.dll" Gpejeihi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Npojdpef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kklcab32.dll" Nodgel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifbgfk32.dll" Pjldghjm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1521c65db96107b65b083eab22f7fc52a5b3604491beb36c69393922c11ac90d.exePiblek32.exePeiljl32.exePpoqge32.exePfiidobe.exePpamme32.exePabjem32.exeQlhnbf32.exeQnfjna32.exeQaefjm32.exeQjmkcbcb.exeQecoqk32.exeAfdlhchf.exeAplpai32.exeAffhncfc.exeApomfh32.exedescription pid process target process PID 2968 wrote to memory of 2728 2968 1521c65db96107b65b083eab22f7fc52a5b3604491beb36c69393922c11ac90d.exe Piblek32.exe PID 2968 wrote to memory of 2728 2968 1521c65db96107b65b083eab22f7fc52a5b3604491beb36c69393922c11ac90d.exe Piblek32.exe PID 2968 wrote to memory of 2728 2968 1521c65db96107b65b083eab22f7fc52a5b3604491beb36c69393922c11ac90d.exe Piblek32.exe PID 2968 wrote to memory of 2728 2968 1521c65db96107b65b083eab22f7fc52a5b3604491beb36c69393922c11ac90d.exe Piblek32.exe PID 2728 wrote to memory of 1948 2728 Piblek32.exe Peiljl32.exe PID 2728 wrote to memory of 1948 2728 Piblek32.exe Peiljl32.exe PID 2728 wrote to memory of 1948 2728 Piblek32.exe Peiljl32.exe PID 2728 wrote to memory of 1948 2728 Piblek32.exe Peiljl32.exe PID 1948 wrote to memory of 2628 1948 Peiljl32.exe Ppoqge32.exe PID 1948 wrote to memory of 2628 1948 Peiljl32.exe Ppoqge32.exe PID 1948 wrote to memory of 2628 1948 Peiljl32.exe Ppoqge32.exe PID 1948 wrote to memory of 2628 1948 Peiljl32.exe Ppoqge32.exe PID 2628 wrote to memory of 2288 2628 Ppoqge32.exe Pfiidobe.exe PID 2628 wrote to memory of 2288 2628 Ppoqge32.exe Pfiidobe.exe PID 2628 wrote to memory of 2288 2628 Ppoqge32.exe Pfiidobe.exe PID 2628 wrote to memory of 2288 2628 Ppoqge32.exe Pfiidobe.exe PID 2288 wrote to memory of 2476 2288 Pfiidobe.exe Ppamme32.exe PID 2288 wrote to memory of 2476 2288 Pfiidobe.exe Ppamme32.exe PID 2288 wrote to memory of 2476 2288 Pfiidobe.exe Ppamme32.exe PID 2288 wrote to memory of 2476 2288 Pfiidobe.exe Ppamme32.exe PID 2476 wrote to memory of 2612 2476 Ppamme32.exe Pabjem32.exe PID 2476 wrote to memory of 2612 2476 Ppamme32.exe Pabjem32.exe PID 2476 wrote to memory of 2612 2476 Ppamme32.exe Pabjem32.exe PID 2476 wrote to memory of 2612 2476 Ppamme32.exe Pabjem32.exe PID 2612 wrote to memory of 2520 2612 Pabjem32.exe Qlhnbf32.exe PID 2612 wrote to memory of 2520 2612 Pabjem32.exe Qlhnbf32.exe PID 2612 wrote to memory of 2520 2612 Pabjem32.exe Qlhnbf32.exe PID 2612 wrote to memory of 2520 2612 Pabjem32.exe Qlhnbf32.exe PID 2520 wrote to memory of 2240 2520 Qlhnbf32.exe Qnfjna32.exe PID 2520 wrote to memory of 2240 2520 Qlhnbf32.exe Qnfjna32.exe PID 2520 wrote to memory of 2240 2520 Qlhnbf32.exe Qnfjna32.exe PID 2520 wrote to memory of 2240 2520 Qlhnbf32.exe Qnfjna32.exe PID 2240 wrote to memory of 2532 2240 Qnfjna32.exe Qaefjm32.exe PID 2240 wrote to memory of 2532 2240 Qnfjna32.exe Qaefjm32.exe PID 2240 wrote to memory of 2532 2240 Qnfjna32.exe Qaefjm32.exe PID 2240 wrote to memory of 2532 2240 Qnfjna32.exe Qaefjm32.exe PID 2532 wrote to memory of 2336 2532 Qaefjm32.exe Qjmkcbcb.exe PID 2532 wrote to memory of 2336 2532 Qaefjm32.exe Qjmkcbcb.exe PID 2532 wrote to memory of 2336 2532 Qaefjm32.exe Qjmkcbcb.exe PID 2532 wrote to memory of 2336 2532 Qaefjm32.exe Qjmkcbcb.exe PID 2336 wrote to memory of 1264 2336 Qjmkcbcb.exe Qecoqk32.exe PID 2336 wrote to memory of 1264 2336 Qjmkcbcb.exe Qecoqk32.exe PID 2336 wrote to memory of 1264 2336 Qjmkcbcb.exe Qecoqk32.exe PID 2336 wrote to memory of 1264 2336 Qjmkcbcb.exe Qecoqk32.exe PID 1264 wrote to memory of 2732 1264 Qecoqk32.exe Afdlhchf.exe PID 1264 wrote to memory of 2732 1264 Qecoqk32.exe Afdlhchf.exe PID 1264 wrote to memory of 2732 1264 Qecoqk32.exe Afdlhchf.exe PID 1264 wrote to memory of 2732 1264 Qecoqk32.exe Afdlhchf.exe PID 2732 wrote to memory of 2028 2732 Afdlhchf.exe Aplpai32.exe PID 2732 wrote to memory of 2028 2732 Afdlhchf.exe Aplpai32.exe PID 2732 wrote to memory of 2028 2732 Afdlhchf.exe Aplpai32.exe PID 2732 wrote to memory of 2028 2732 Afdlhchf.exe Aplpai32.exe PID 2028 wrote to memory of 2788 2028 Aplpai32.exe Affhncfc.exe PID 2028 wrote to memory of 2788 2028 Aplpai32.exe Affhncfc.exe PID 2028 wrote to memory of 2788 2028 Aplpai32.exe Affhncfc.exe PID 2028 wrote to memory of 2788 2028 Aplpai32.exe Affhncfc.exe PID 2788 wrote to memory of 2244 2788 Affhncfc.exe Apomfh32.exe PID 2788 wrote to memory of 2244 2788 Affhncfc.exe Apomfh32.exe PID 2788 wrote to memory of 2244 2788 Affhncfc.exe Apomfh32.exe PID 2788 wrote to memory of 2244 2788 Affhncfc.exe Apomfh32.exe PID 2244 wrote to memory of 484 2244 Apomfh32.exe Abmibdlh.exe PID 2244 wrote to memory of 484 2244 Apomfh32.exe Abmibdlh.exe PID 2244 wrote to memory of 484 2244 Apomfh32.exe Abmibdlh.exe PID 2244 wrote to memory of 484 2244 Apomfh32.exe Abmibdlh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1521c65db96107b65b083eab22f7fc52a5b3604491beb36c69393922c11ac90d.exe"C:\Users\Admin\AppData\Local\Temp\1521c65db96107b65b083eab22f7fc52a5b3604491beb36c69393922c11ac90d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Piblek32.exeC:\Windows\system32\Piblek32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Peiljl32.exeC:\Windows\system32\Peiljl32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ppoqge32.exeC:\Windows\system32\Ppoqge32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Pfiidobe.exeC:\Windows\system32\Pfiidobe.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ppamme32.exeC:\Windows\system32\Ppamme32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Pabjem32.exeC:\Windows\system32\Pabjem32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Qlhnbf32.exeC:\Windows\system32\Qlhnbf32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Qnfjna32.exeC:\Windows\system32\Qnfjna32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Qaefjm32.exeC:\Windows\system32\Qaefjm32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Qjmkcbcb.exeC:\Windows\system32\Qjmkcbcb.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Qecoqk32.exeC:\Windows\system32\Qecoqk32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Afdlhchf.exeC:\Windows\system32\Afdlhchf.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Aplpai32.exeC:\Windows\system32\Aplpai32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Affhncfc.exeC:\Windows\system32\Affhncfc.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Apomfh32.exeC:\Windows\system32\Apomfh32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Abmibdlh.exeC:\Windows\system32\Abmibdlh.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Apajlhka.exeC:\Windows\system32\Apajlhka.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Abpfhcje.exeC:\Windows\system32\Abpfhcje.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Amejeljk.exeC:\Windows\system32\Amejeljk.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Apcfahio.exeC:\Windows\system32\Apcfahio.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Aepojo32.exeC:\Windows\system32\Aepojo32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\Ahokfj32.exeC:\Windows\system32\Ahokfj32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\Bagpopmj.exeC:\Windows\system32\Bagpopmj.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Bhahlj32.exeC:\Windows\system32\Bhahlj32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Bbflib32.exeC:\Windows\system32\Bbflib32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Bommnc32.exeC:\Windows\system32\Bommnc32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Begeknan.exeC:\Windows\system32\Begeknan.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Bkdmcdoe.exeC:\Windows\system32\Bkdmcdoe.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Bnbjopoi.exeC:\Windows\system32\Bnbjopoi.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Bkfjhd32.exeC:\Windows\system32\Bkfjhd32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\Bjijdadm.exeC:\Windows\system32\Bjijdadm.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\Baqbenep.exeC:\Windows\system32\Baqbenep.exe33⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Bcaomf32.exeC:\Windows\system32\Bcaomf32.exe34⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ckignd32.exeC:\Windows\system32\Ckignd32.exe35⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cljcelan.exeC:\Windows\system32\Cljcelan.exe36⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ccdlbf32.exeC:\Windows\system32\Ccdlbf32.exe37⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cnippoha.exeC:\Windows\system32\Cnippoha.exe38⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ccfhhffh.exeC:\Windows\system32\Ccfhhffh.exe39⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cfeddafl.exeC:\Windows\system32\Cfeddafl.exe40⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Chcqpmep.exeC:\Windows\system32\Chcqpmep.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Cpjiajeb.exeC:\Windows\system32\Cpjiajeb.exe42⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cfgaiaci.exeC:\Windows\system32\Cfgaiaci.exe43⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Claifkkf.exeC:\Windows\system32\Claifkkf.exe44⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cckace32.exeC:\Windows\system32\Cckace32.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Cfinoq32.exeC:\Windows\system32\Cfinoq32.exe46⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Chhjkl32.exeC:\Windows\system32\Chhjkl32.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ckffgg32.exeC:\Windows\system32\Ckffgg32.exe48⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Cobbhfhg.exeC:\Windows\system32\Cobbhfhg.exe49⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dbpodagk.exeC:\Windows\system32\Dbpodagk.exe50⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ddokpmfo.exeC:\Windows\system32\Ddokpmfo.exe51⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dgmglh32.exeC:\Windows\system32\Dgmglh32.exe52⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dkhcmgnl.exeC:\Windows\system32\Dkhcmgnl.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Dngoibmo.exeC:\Windows\system32\Dngoibmo.exe54⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dbbkja32.exeC:\Windows\system32\Dbbkja32.exe55⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ddagfm32.exeC:\Windows\system32\Ddagfm32.exe56⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dgodbh32.exeC:\Windows\system32\Dgodbh32.exe57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dkkpbgli.exeC:\Windows\system32\Dkkpbgli.exe58⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dnilobkm.exeC:\Windows\system32\Dnilobkm.exe59⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dqhhknjp.exeC:\Windows\system32\Dqhhknjp.exe60⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dkmmhf32.exeC:\Windows\system32\Dkmmhf32.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dnlidb32.exeC:\Windows\system32\Dnlidb32.exe62⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Ddeaalpg.exeC:\Windows\system32\Ddeaalpg.exe63⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dchali32.exeC:\Windows\system32\Dchali32.exe64⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dfgmhd32.exeC:\Windows\system32\Dfgmhd32.exe65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dnneja32.exeC:\Windows\system32\Dnneja32.exe66⤵
-
C:\Windows\SysWOW64\Dmafennb.exeC:\Windows\system32\Dmafennb.exe67⤵
-
C:\Windows\SysWOW64\Dqlafm32.exeC:\Windows\system32\Dqlafm32.exe68⤵
-
C:\Windows\SysWOW64\Dgfjbgmh.exeC:\Windows\system32\Dgfjbgmh.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Dfijnd32.exeC:\Windows\system32\Dfijnd32.exe70⤵
-
C:\Windows\SysWOW64\Eihfjo32.exeC:\Windows\system32\Eihfjo32.exe71⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Emcbkn32.exeC:\Windows\system32\Emcbkn32.exe72⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Epaogi32.exeC:\Windows\system32\Epaogi32.exe73⤵
-
C:\Windows\SysWOW64\Ecmkghcl.exeC:\Windows\system32\Ecmkghcl.exe74⤵
-
C:\Windows\SysWOW64\Ejgcdb32.exeC:\Windows\system32\Ejgcdb32.exe75⤵
-
C:\Windows\SysWOW64\Eijcpoac.exeC:\Windows\system32\Eijcpoac.exe76⤵
-
C:\Windows\SysWOW64\Ekholjqg.exeC:\Windows\system32\Ekholjqg.exe77⤵
-
C:\Windows\SysWOW64\Epdkli32.exeC:\Windows\system32\Epdkli32.exe78⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ecpgmhai.exeC:\Windows\system32\Ecpgmhai.exe79⤵
-
C:\Windows\SysWOW64\Ebbgid32.exeC:\Windows\system32\Ebbgid32.exe80⤵
-
C:\Windows\SysWOW64\Eeqdep32.exeC:\Windows\system32\Eeqdep32.exe81⤵
-
C:\Windows\SysWOW64\Emhlfmgj.exeC:\Windows\system32\Emhlfmgj.exe82⤵
-
C:\Windows\SysWOW64\Epfhbign.exeC:\Windows\system32\Epfhbign.exe83⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Enihne32.exeC:\Windows\system32\Enihne32.exe84⤵
-
C:\Windows\SysWOW64\Egamfkdh.exeC:\Windows\system32\Egamfkdh.exe85⤵
-
C:\Windows\SysWOW64\Elmigj32.exeC:\Windows\system32\Elmigj32.exe86⤵
-
C:\Windows\SysWOW64\Enkece32.exeC:\Windows\system32\Enkece32.exe87⤵
-
C:\Windows\SysWOW64\Ebgacddo.exeC:\Windows\system32\Ebgacddo.exe88⤵
-
C:\Windows\SysWOW64\Eeempocb.exeC:\Windows\system32\Eeempocb.exe89⤵
-
C:\Windows\SysWOW64\Eiaiqn32.exeC:\Windows\system32\Eiaiqn32.exe90⤵
-
C:\Windows\SysWOW64\Eloemi32.exeC:\Windows\system32\Eloemi32.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ejbfhfaj.exeC:\Windows\system32\Ejbfhfaj.exe92⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Ebinic32.exeC:\Windows\system32\Ebinic32.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ealnephf.exeC:\Windows\system32\Ealnephf.exe94⤵
-
C:\Windows\SysWOW64\Fhffaj32.exeC:\Windows\system32\Fhffaj32.exe95⤵
-
C:\Windows\SysWOW64\Fhffaj32.exeC:\Windows\system32\Fhffaj32.exe96⤵
-
C:\Windows\SysWOW64\Fjdbnf32.exeC:\Windows\system32\Fjdbnf32.exe97⤵
-
C:\Windows\SysWOW64\Fnpnndgp.exeC:\Windows\system32\Fnpnndgp.exe98⤵
-
C:\Windows\SysWOW64\Fmcoja32.exeC:\Windows\system32\Fmcoja32.exe99⤵
-
C:\Windows\SysWOW64\Fcmgfkeg.exeC:\Windows\system32\Fcmgfkeg.exe100⤵
-
C:\Windows\SysWOW64\Ffkcbgek.exeC:\Windows\system32\Ffkcbgek.exe101⤵
-
C:\Windows\SysWOW64\Fjgoce32.exeC:\Windows\system32\Fjgoce32.exe102⤵
-
C:\Windows\SysWOW64\Fnbkddem.exeC:\Windows\system32\Fnbkddem.exe103⤵
-
C:\Windows\SysWOW64\Fmekoalh.exeC:\Windows\system32\Fmekoalh.exe104⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Fpdhklkl.exeC:\Windows\system32\Fpdhklkl.exe105⤵
-
C:\Windows\SysWOW64\Fdoclk32.exeC:\Windows\system32\Fdoclk32.exe106⤵
-
C:\Windows\SysWOW64\Ffnphf32.exeC:\Windows\system32\Ffnphf32.exe107⤵
-
C:\Windows\SysWOW64\Facdeo32.exeC:\Windows\system32\Facdeo32.exe108⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Fdapak32.exeC:\Windows\system32\Fdapak32.exe109⤵
-
C:\Windows\SysWOW64\Fbdqmghm.exeC:\Windows\system32\Fbdqmghm.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Fjlhneio.exeC:\Windows\system32\Fjlhneio.exe111⤵
-
C:\Windows\SysWOW64\Fmjejphb.exeC:\Windows\system32\Fmjejphb.exe112⤵
-
C:\Windows\SysWOW64\Fddmgjpo.exeC:\Windows\system32\Fddmgjpo.exe113⤵
-
C:\Windows\SysWOW64\Fbgmbg32.exeC:\Windows\system32\Fbgmbg32.exe114⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
-
C:\Windows\SysWOW64\Ffbicfoc.exeC:\Windows\system32\Ffbicfoc.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Fmlapp32.exeC:\Windows\system32\Fmlapp32.exe116⤵
-
C:\Windows\SysWOW64\Gonnhhln.exeC:\Windows\system32\Gonnhhln.exe117⤵
-
C:\Windows\SysWOW64\Gfefiemq.exeC:\Windows\system32\Gfefiemq.exe118⤵
-
C:\Windows\SysWOW64\Gicbeald.exeC:\Windows\system32\Gicbeald.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Ghfbqn32.exeC:\Windows\system32\Ghfbqn32.exe120⤵
-
C:\Windows\SysWOW64\Gpmjak32.exeC:\Windows\system32\Gpmjak32.exe121⤵
-
C:\Windows\SysWOW64\Gopkmhjk.exeC:\Windows\system32\Gopkmhjk.exe122⤵
-
C:\Windows\SysWOW64\Gangic32.exeC:\Windows\system32\Gangic32.exe123⤵
-
C:\Windows\SysWOW64\Ghhofmql.exeC:\Windows\system32\Ghhofmql.exe124⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Gldkfl32.exeC:\Windows\system32\Gldkfl32.exe125⤵
-
C:\Windows\SysWOW64\Gbnccfpb.exeC:\Windows\system32\Gbnccfpb.exe126⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gaqcoc32.exeC:\Windows\system32\Gaqcoc32.exe127⤵
-
C:\Windows\SysWOW64\Ghkllmoi.exeC:\Windows\system32\Ghkllmoi.exe128⤵
-
C:\Windows\SysWOW64\Gkihhhnm.exeC:\Windows\system32\Gkihhhnm.exe129⤵
-
C:\Windows\SysWOW64\Goddhg32.exeC:\Windows\system32\Goddhg32.exe130⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Geolea32.exeC:\Windows\system32\Geolea32.exe131⤵
-
C:\Windows\SysWOW64\Gdamqndn.exeC:\Windows\system32\Gdamqndn.exe132⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Gkkemh32.exeC:\Windows\system32\Gkkemh32.exe133⤵
-
C:\Windows\SysWOW64\Gaemjbcg.exeC:\Windows\system32\Gaemjbcg.exe134⤵
-
C:\Windows\SysWOW64\Gddifnbk.exeC:\Windows\system32\Gddifnbk.exe135⤵
-
C:\Windows\SysWOW64\Hknach32.exeC:\Windows\system32\Hknach32.exe136⤵
-
C:\Windows\SysWOW64\Hmlnoc32.exeC:\Windows\system32\Hmlnoc32.exe137⤵
-
C:\Windows\SysWOW64\Hgdbhi32.exeC:\Windows\system32\Hgdbhi32.exe138⤵
-
C:\Windows\SysWOW64\Hkpnhgge.exeC:\Windows\system32\Hkpnhgge.exe139⤵
-
C:\Windows\SysWOW64\Hnojdcfi.exeC:\Windows\system32\Hnojdcfi.exe140⤵
-
C:\Windows\SysWOW64\Hpmgqnfl.exeC:\Windows\system32\Hpmgqnfl.exe141⤵
-
C:\Windows\SysWOW64\Hggomh32.exeC:\Windows\system32\Hggomh32.exe142⤵
-
C:\Windows\SysWOW64\Hlcgeo32.exeC:\Windows\system32\Hlcgeo32.exe143⤵
-
C:\Windows\SysWOW64\Hobcak32.exeC:\Windows\system32\Hobcak32.exe144⤵
-
C:\Windows\SysWOW64\Hcnpbi32.exeC:\Windows\system32\Hcnpbi32.exe145⤵
-
C:\Windows\SysWOW64\Hjhhocjj.exeC:\Windows\system32\Hjhhocjj.exe146⤵
-
C:\Windows\SysWOW64\Hodpgjha.exeC:\Windows\system32\Hodpgjha.exe147⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Hacmcfge.exeC:\Windows\system32\Hacmcfge.exe148⤵
-
C:\Windows\SysWOW64\Henidd32.exeC:\Windows\system32\Henidd32.exe149⤵
-
C:\Windows\SysWOW64\Hlhaqogk.exeC:\Windows\system32\Hlhaqogk.exe150⤵
-
C:\Windows\SysWOW64\Icbimi32.exeC:\Windows\system32\Icbimi32.exe151⤵
-
C:\Windows\SysWOW64\Ieqeidnl.exeC:\Windows\system32\Ieqeidnl.exe152⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Ilknfn32.exeC:\Windows\system32\Ilknfn32.exe153⤵
-
C:\Windows\SysWOW64\Ioijbj32.exeC:\Windows\system32\Ioijbj32.exe154⤵
-
C:\Windows\SysWOW64\Ifcbodli.exeC:\Windows\system32\Ifcbodli.exe155⤵
-
C:\Windows\SysWOW64\Ihankokm.exeC:\Windows\system32\Ihankokm.exe156⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Igdogl32.exeC:\Windows\system32\Igdogl32.exe157⤵
-
C:\Windows\SysWOW64\Iokfhi32.exeC:\Windows\system32\Iokfhi32.exe158⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Iajcde32.exeC:\Windows\system32\Iajcde32.exe159⤵
-
C:\Windows\SysWOW64\Iqmcpahh.exeC:\Windows\system32\Iqmcpahh.exe160⤵
-
C:\Windows\SysWOW64\Idhopq32.exeC:\Windows\system32\Idhopq32.exe161⤵
-
C:\Windows\SysWOW64\Iggkllpe.exeC:\Windows\system32\Iggkllpe.exe162⤵
-
C:\Windows\SysWOW64\Ikbgmj32.exeC:\Windows\system32\Ikbgmj32.exe163⤵
-
C:\Windows\SysWOW64\Inqcif32.exeC:\Windows\system32\Inqcif32.exe164⤵
-
C:\Windows\SysWOW64\Iblpjdpk.exeC:\Windows\system32\Iblpjdpk.exe165⤵
-
C:\Windows\SysWOW64\Idklfpon.exeC:\Windows\system32\Idklfpon.exe166⤵
-
C:\Windows\SysWOW64\Igihbknb.exeC:\Windows\system32\Igihbknb.exe167⤵
-
C:\Windows\SysWOW64\Ijgdngmf.exeC:\Windows\system32\Ijgdngmf.exe168⤵
-
C:\Windows\SysWOW64\Incpoe32.exeC:\Windows\system32\Incpoe32.exe169⤵
-
C:\Windows\SysWOW64\Iqalka32.exeC:\Windows\system32\Iqalka32.exe170⤵
-
C:\Windows\SysWOW64\Idmhkpml.exeC:\Windows\system32\Idmhkpml.exe171⤵
-
C:\Windows\SysWOW64\Igkdgk32.exeC:\Windows\system32\Igkdgk32.exe172⤵
-
C:\Windows\SysWOW64\Ifnechbj.exeC:\Windows\system32\Ifnechbj.exe173⤵
-
C:\Windows\SysWOW64\Jnemdecl.exeC:\Windows\system32\Jnemdecl.exe174⤵
-
C:\Windows\SysWOW64\Jmhmpb32.exeC:\Windows\system32\Jmhmpb32.exe175⤵
-
C:\Windows\SysWOW64\Jofiln32.exeC:\Windows\system32\Jofiln32.exe176⤵
-
C:\Windows\SysWOW64\Jcbellac.exeC:\Windows\system32\Jcbellac.exe177⤵
-
C:\Windows\SysWOW64\Jfqahgpg.exeC:\Windows\system32\Jfqahgpg.exe178⤵
-
C:\Windows\SysWOW64\Jjlnif32.exeC:\Windows\system32\Jjlnif32.exe179⤵
-
C:\Windows\SysWOW64\Jmjjea32.exeC:\Windows\system32\Jmjjea32.exe180⤵
-
C:\Windows\SysWOW64\Joifam32.exeC:\Windows\system32\Joifam32.exe181⤵
-
C:\Windows\SysWOW64\Jcdbbloa.exeC:\Windows\system32\Jcdbbloa.exe182⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Jbgbni32.exeC:\Windows\system32\Jbgbni32.exe183⤵
-
C:\Windows\SysWOW64\Jjojofgn.exeC:\Windows\system32\Jjojofgn.exe184⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Jiakjb32.exeC:\Windows\system32\Jiakjb32.exe185⤵
-
C:\Windows\SysWOW64\Jkpgfn32.exeC:\Windows\system32\Jkpgfn32.exe186⤵
-
C:\Windows\SysWOW64\Jcgogk32.exeC:\Windows\system32\Jcgogk32.exe187⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Jfekcg32.exeC:\Windows\system32\Jfekcg32.exe188⤵
-
C:\Windows\SysWOW64\Jehkodcm.exeC:\Windows\system32\Jehkodcm.exe189⤵
-
C:\Windows\SysWOW64\Jmocpado.exeC:\Windows\system32\Jmocpado.exe190⤵
-
C:\Windows\SysWOW64\Jkbcln32.exeC:\Windows\system32\Jkbcln32.exe191⤵
-
C:\Windows\SysWOW64\Jnqphi32.exeC:\Windows\system32\Jnqphi32.exe192⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Jbllihbf.exeC:\Windows\system32\Jbllihbf.exe193⤵
-
C:\Windows\SysWOW64\Jejhecaj.exeC:\Windows\system32\Jejhecaj.exe194⤵
-
C:\Windows\SysWOW64\Jifdebic.exeC:\Windows\system32\Jifdebic.exe195⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Jkdpanhg.exeC:\Windows\system32\Jkdpanhg.exe196⤵
-
C:\Windows\SysWOW64\Jnclnihj.exeC:\Windows\system32\Jnclnihj.exe197⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Jbnhng32.exeC:\Windows\system32\Jbnhng32.exe198⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Kaaijdgn.exeC:\Windows\system32\Kaaijdgn.exe199⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kihqkagp.exeC:\Windows\system32\Kihqkagp.exe200⤵
-
C:\Windows\SysWOW64\Kgkafo32.exeC:\Windows\system32\Kgkafo32.exe201⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kaceodek.exeC:\Windows\system32\Kaceodek.exe202⤵
-
C:\Windows\SysWOW64\Keoapb32.exeC:\Windows\system32\Keoapb32.exe203⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kcbakpdo.exeC:\Windows\system32\Kcbakpdo.exe204⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Kgnnln32.exeC:\Windows\system32\Kgnnln32.exe205⤵
-
C:\Windows\SysWOW64\Kjljhjkl.exeC:\Windows\system32\Kjljhjkl.exe206⤵
-
C:\Windows\SysWOW64\Kmjfdejp.exeC:\Windows\system32\Kmjfdejp.exe207⤵
-
C:\Windows\SysWOW64\Keanebkb.exeC:\Windows\system32\Keanebkb.exe208⤵
-
C:\Windows\SysWOW64\Kcdnao32.exeC:\Windows\system32\Kcdnao32.exe209⤵
-
C:\Windows\SysWOW64\Kgpjanje.exeC:\Windows\system32\Kgpjanje.exe210⤵
-
C:\Windows\SysWOW64\Kjnfniii.exeC:\Windows\system32\Kjnfniii.exe211⤵
-
C:\Windows\SysWOW64\Kmmcjehm.exeC:\Windows\system32\Kmmcjehm.exe212⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kpkofpgq.exeC:\Windows\system32\Kpkofpgq.exe213⤵
-
C:\Windows\SysWOW64\Kcfkfo32.exeC:\Windows\system32\Kcfkfo32.exe214⤵
-
C:\Windows\SysWOW64\Kgbggnhc.exeC:\Windows\system32\Kgbggnhc.exe215⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Kjqccigf.exeC:\Windows\system32\Kjqccigf.exe216⤵
-
C:\Windows\SysWOW64\Kmopod32.exeC:\Windows\system32\Kmopod32.exe217⤵
-
C:\Windows\SysWOW64\Kaklpcoc.exeC:\Windows\system32\Kaklpcoc.exe218⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Kcihlong.exeC:\Windows\system32\Kcihlong.exe219⤵
-
C:\Windows\SysWOW64\Kfgdhjmk.exeC:\Windows\system32\Kfgdhjmk.exe220⤵
-
C:\Windows\SysWOW64\Kjcpii32.exeC:\Windows\system32\Kjcpii32.exe221⤵
-
C:\Windows\SysWOW64\Lldlqakb.exeC:\Windows\system32\Lldlqakb.exe222⤵
-
C:\Windows\SysWOW64\Lpphap32.exeC:\Windows\system32\Lpphap32.exe223⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\Lbnemk32.exeC:\Windows\system32\Lbnemk32.exe224⤵
-
C:\Windows\SysWOW64\Lemaif32.exeC:\Windows\system32\Lemaif32.exe225⤵
- Adds autorun key to be loaded by Explorer.exe on startup
-
C:\Windows\SysWOW64\Lmcijcbe.exeC:\Windows\system32\Lmcijcbe.exe226⤵
-
C:\Windows\SysWOW64\Llfifq32.exeC:\Windows\system32\Llfifq32.exe227⤵
-
C:\Windows\SysWOW64\Lpbefoai.exeC:\Windows\system32\Lpbefoai.exe228⤵
-
C:\Windows\SysWOW64\Lbqabkql.exeC:\Windows\system32\Lbqabkql.exe229⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Leonofpp.exeC:\Windows\system32\Leonofpp.exe230⤵
-
C:\Windows\SysWOW64\Lhmjkaoc.exeC:\Windows\system32\Lhmjkaoc.exe231⤵
-
C:\Windows\SysWOW64\Lpdbloof.exeC:\Windows\system32\Lpdbloof.exe232⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Lbcnhjnj.exeC:\Windows\system32\Lbcnhjnj.exe233⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Leajdfnm.exeC:\Windows\system32\Leajdfnm.exe234⤵
- Modifies registry class
-
C:\Windows\SysWOW64\Lhpfqama.exeC:\Windows\system32\Lhpfqama.exe235⤵
-
C:\Windows\SysWOW64\Lkncmmle.exeC:\Windows\system32\Lkncmmle.exe236⤵
-
C:\Windows\SysWOW64\Lbeknj32.exeC:\Windows\system32\Lbeknj32.exe237⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Lecgje32.exeC:\Windows\system32\Lecgje32.exe238⤵
-
C:\Windows\SysWOW64\Ldfgebbe.exeC:\Windows\system32\Ldfgebbe.exe239⤵
-
C:\Windows\SysWOW64\Llnofpcg.exeC:\Windows\system32\Llnofpcg.exe240⤵
-
C:\Windows\SysWOW64\Lkppbl32.exeC:\Windows\system32\Lkppbl32.exe241⤵