Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 16:30
Static task
static1
Behavioral task
behavioral1
Sample
5cb80b84540636a34e81a42eccd301646d5ab0a9ead4bfc09e203734aa9980dd.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5cb80b84540636a34e81a42eccd301646d5ab0a9ead4bfc09e203734aa9980dd.exe
Resource
win10v2004-20220901-en
General
-
Target
5cb80b84540636a34e81a42eccd301646d5ab0a9ead4bfc09e203734aa9980dd.exe
-
Size
50KB
-
MD5
a02d184f73dbd4b7f044777bab15b3c0
-
SHA1
7f347252c26c321066d6b95bdd01ea54e7c8b705
-
SHA256
5cb80b84540636a34e81a42eccd301646d5ab0a9ead4bfc09e203734aa9980dd
-
SHA512
a5d7b2ac8c8594928dc10414f568086f3fe849c9b52464a6fc041e5736a9b0066a784f968462e43f0570ffe89ef148e6dba6ed16c78ea4d288291db0898eec95
-
SSDEEP
768:2e/rZKsmqqgkqVlSBqSaxpSu8bCyTtlwpNEOAr+RbRKS/1H5:2edKlnqVlSLZDSNE9aRbd
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkjepk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knkobf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nejbgkaa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bngnhq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Facjcbco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mlgemm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Degpanlg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cciplgni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hafpopcj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdkgob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pemhdhal.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kklbfj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apceho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcgmme32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bldond32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cggplkgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gmecikkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ombjjlhm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pgmkha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bckkeo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bibpacch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dgkbmdpj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lijlpdff.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljjijf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mpigok32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkjbnijl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgabbjpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hdahke32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olndej32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akippnfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bklflk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bgkifg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dciibd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bckkeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Knhblf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mflbpp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glbjlcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lhjeem32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfcjojbg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dbgnjicb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cgligk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fdaodgog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ikjcdcom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cjhinfdl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emndao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eiobhano.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gahcna32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kobhgnof.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Blflcd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcmqphhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cjqlca32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkmipa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mflikf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mcpjdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pgmkha32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pikqjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qlcplq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hliggieb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hcflib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jjlmiiii.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dclmbjao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hklpho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Imcpji32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kfgpnbgl.exe -
Executes dropped EXE 64 IoCs
pid Process 2456 Ckcbgp32.exe 2324 Celgpfjp.exe 628 Cbphjj32.exe 2408 Cgmpba32.exe 3076 Cnghokon.exe 4420 Dgomgq32.exe 932 Dniedk32.exe 4736 Dgajmpcl.exe 1680 Dbgnjicb.exe 4948 Dgdfbpai.exe 4996 Ebbmfgid.exe 1588 Eimecapa.exe 4472 Eninkhni.exe 3948 Eiobhano.exe 3108 Eolkqhlf.exe 2992 Eefcmbdc.exe 3400 Elpkjl32.exe 4216 Ficlcq32.exe 2256 Foqdlg32.exe 2932 Fhiidm32.exe 1456 Fbnmbf32.exe 2072 Fhkejm32.exe 380 Facjcbco.exe 2424 Fbcfmejb.exe 4608 Gahcna32.exe 4320 Gakpcamg.exe 720 Gehijp32.exe 204 Gkeabf32.exe 4204 Glenli32.exe 908 Hadcjpel.exe 4024 Hliggieb.exe 2284 Hafpopcj.exe 3456 Hlldmhcp.exe 3168 Hcflib32.exe 4316 Hipdfm32.exe 1540 Hkaqnegg.exe 3372 Ioccobji.exe 3356 Ijiglk32.exe 1484 Ikjcdcom.exe 4520 Iohljb32.exe 2236 Illmcfdm.exe 1084 Jhcmhg32.exe 2132 Jbkbamqa.exe 3064 Jbnogl32.exe 1132 Jlccde32.exe 772 Jbpkll32.exe 3024 Jkhpeacm.exe 2452 Jbbhblkj.exe 1248 Jhlpof32.exe 1040 Jcbdlo32.exe 1728 Jjlmiiii.exe 2488 Kkmipa32.exe 1596 Kfbmnjon.exe 4192 Kiajjena.exe 2416 Kcfngnng.exe 2628 Kicfoelo.exe 2924 Komolo32.exe 1148 Kfggii32.exe 4356 Kopkaoai.exe 1848 Kbngnjql.exe 3768 Kjepogao.exe 1428 Kobhgnof.exe 4644 Lijlpdff.exe 476 Ljjijf32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Nplddj32.exe Nmmgho32.exe File opened for modification C:\Windows\SysWOW64\Honbim32.exe Hlpfma32.exe File created C:\Windows\SysWOW64\Nejbgkaa.exe Nicabjln.exe File created C:\Windows\SysWOW64\Jkhpeacm.exe Jbpkll32.exe File created C:\Windows\SysWOW64\Jbbhblkj.exe Jkhpeacm.exe File created C:\Windows\SysWOW64\Ddafob32.dll Odcoqg32.exe File created C:\Windows\SysWOW64\Alkoacpm.dll Klceqlmg.exe File created C:\Windows\SysWOW64\Jhijbojk.dll Qmnbkdjd.exe File created C:\Windows\SysWOW64\Jpgdcg32.dll Gahcna32.exe File created C:\Windows\SysWOW64\Ikammpod.dll Cmpoic32.exe File created C:\Windows\SysWOW64\Mflbpp32.exe Mnbnibfe.exe File opened for modification C:\Windows\SysWOW64\Olkqedcf.exe Oimdihdc.exe File opened for modification C:\Windows\SysWOW64\Bkbcflng.exe Bckkeo32.exe File created C:\Windows\SysWOW64\Jeicmdcl.exe Jnallg32.exe File opened for modification C:\Windows\SysWOW64\Cmdhdbfb.exe Cjflhggo.exe File opened for modification C:\Windows\SysWOW64\Fndglqqp.exe Flfjpeal.exe File opened for modification C:\Windows\SysWOW64\Knbdbe32.exe Kkchfi32.exe File opened for modification C:\Windows\SysWOW64\Bgmflflj.exe Bofnji32.exe File created C:\Windows\SysWOW64\Ikbipljn.dll Anhlliee.exe File opened for modification C:\Windows\SysWOW64\Cknbbkdi.exe Cddjeq32.exe File created C:\Windows\SysWOW64\Ghcemk32.dll Dnhnjdip.exe File opened for modification C:\Windows\SysWOW64\Faepnlnq.exe Fjkgaa32.exe File created C:\Windows\SysWOW64\Ibcmnhlb.dll Iliicp32.exe File created C:\Windows\SysWOW64\Ajlqejom.dll Bpoddm32.exe File created C:\Windows\SysWOW64\Gdnedg32.dll Illmcfdm.exe File created C:\Windows\SysWOW64\Oibdnnci.exe Ofdhbb32.exe File opened for modification C:\Windows\SysWOW64\Dniedk32.exe Dgomgq32.exe File opened for modification C:\Windows\SysWOW64\Mfofpe32.exe Mcpjdj32.exe File created C:\Windows\SysWOW64\Peehib32.dll Holfdm32.exe File created C:\Windows\SysWOW64\Nmbhem32.dll Khnfjo32.exe File opened for modification C:\Windows\SysWOW64\Glenli32.exe Gkeabf32.exe File created C:\Windows\SysWOW64\Fndglqqp.exe Flfjpeal.exe File opened for modification C:\Windows\SysWOW64\Bjhpgi32.exe Bgickm32.exe File opened for modification C:\Windows\SysWOW64\Ejfeod32.exe Dclmbjao.exe File opened for modification C:\Windows\SysWOW64\Illmcfdm.exe Iohljb32.exe File created C:\Windows\SysWOW64\Cgeinhee.dll Nmmgho32.exe File created C:\Windows\SysWOW64\Cgpcafjg.exe Boikpiie.exe File created C:\Windows\SysWOW64\Mgmbeg32.dll Komhah32.exe File created C:\Windows\SysWOW64\Hkmmbg32.dll Pfcjojbg.exe File opened for modification C:\Windows\SysWOW64\Iekglg32.exe Imcpji32.exe File opened for modification C:\Windows\SysWOW64\Nicabjln.exe Nbjifp32.exe File created C:\Windows\SysWOW64\Aohbik32.exe Aikiadip.exe File created C:\Windows\SysWOW64\Bibpacch.exe Bchgei32.exe File opened for modification C:\Windows\SysWOW64\Cnqaoo32.exe Cckmaflf.exe File created C:\Windows\SysWOW64\Nbmmfefj.exe Nlbdik32.exe File created C:\Windows\SysWOW64\Gmlpcmce.exe Ghohkfen.exe File opened for modification C:\Windows\SysWOW64\Hdahke32.exe Hacloj32.exe File opened for modification C:\Windows\SysWOW64\Idbabc32.exe Iadefg32.exe File opened for modification C:\Windows\SysWOW64\Cjqlca32.exe Cgbpgf32.exe File created C:\Windows\SysWOW64\Fjdbjjdn.dll Bqfaob32.exe File opened for modification C:\Windows\SysWOW64\Jabage32.exe Jdnqna32.exe File opened for modification C:\Windows\SysWOW64\Obkigc32.exe Oplmkh32.exe File opened for modification C:\Windows\SysWOW64\Aigpfe32.exe Afhdji32.exe File created C:\Windows\SysWOW64\Anhlliee.exe Akippnfa.exe File created C:\Windows\SysWOW64\Nbabemmg.dll Qlcplq32.exe File created C:\Windows\SysWOW64\Qabkohpn.dll Bibpacch.exe File created C:\Windows\SysWOW64\Foqdlg32.exe Ficlcq32.exe File created C:\Windows\SysWOW64\Gpmpde32.dll Omigdmph.exe File opened for modification C:\Windows\SysWOW64\Iddnhb32.exe Iafalg32.exe File created C:\Windows\SysWOW64\Pikibd32.dll Fdaodgog.exe File opened for modification C:\Windows\SysWOW64\Hojinnnh.exe Hhpaac32.exe File opened for modification C:\Windows\SysWOW64\Iliicp32.exe Idbabc32.exe File created C:\Windows\SysWOW64\Gpeocl32.dll Kcfngnng.exe File opened for modification C:\Windows\SysWOW64\Mllnhm32.exe Mimbla32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 9672 9592 WerFault.exe 458 -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Emndao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gkggmplf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ofenmlog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apjcbnac.dll" Lbjgihfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jidefoha.dll" Cmmbdc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lbjgihfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnpbmmke.dll" Egalih32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qbjkckhk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Elpkjl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmmbkgkk.dll" Hadcjpel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kkmipa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nbmmfefj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aenqkf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Apceho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bielgcae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bgmflflj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kjepogao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fndglqqp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejoadd32.dll" Jeicmdcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jbpkll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gigmhf32.dll" Cmdhdbfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nejbgkaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clbcnomi.dll" Omkmogji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chcbenqo.dll" Qeigpfgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mimbla32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Inflpi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eecoml32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hajbpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Komhah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icfhdmhp.dll" Lichll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghcemk32.dll" Dnhnjdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Japqjf32.dll" Dqgjfphc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Addanc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgpekqg.dll" Cmblob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Khnfjo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aenqkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oenkpdce.dll" Cnghokon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nplddj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eimdkq32.dll" Opaffggq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hahejimk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jhlpof32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Niknnoia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jibecgfn.dll" Apqhbo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cgbpgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hipdfm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fanimm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Imcpji32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nbjifp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bgickm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cmdhdbfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehoebbjf.dll" Aohbik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpmpde32.dll" Omigdmph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfjkbogg.dll" Gmcfcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bffpac32.dll" Bjlibhoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Loaamhlj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Onjmao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ijiglk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kopkaoai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlkjfcen.dll" Gdmopfdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbabemmg.dll" Qlcplq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ooqcanlb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bpoddm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Belmldgj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cddjeq32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3080 wrote to memory of 2456 3080 5cb80b84540636a34e81a42eccd301646d5ab0a9ead4bfc09e203734aa9980dd.exe 77 PID 3080 wrote to memory of 2456 3080 5cb80b84540636a34e81a42eccd301646d5ab0a9ead4bfc09e203734aa9980dd.exe 77 PID 3080 wrote to memory of 2456 3080 5cb80b84540636a34e81a42eccd301646d5ab0a9ead4bfc09e203734aa9980dd.exe 77 PID 2456 wrote to memory of 2324 2456 Ckcbgp32.exe 78 PID 2456 wrote to memory of 2324 2456 Ckcbgp32.exe 78 PID 2456 wrote to memory of 2324 2456 Ckcbgp32.exe 78 PID 2324 wrote to memory of 628 2324 Celgpfjp.exe 79 PID 2324 wrote to memory of 628 2324 Celgpfjp.exe 79 PID 2324 wrote to memory of 628 2324 Celgpfjp.exe 79 PID 628 wrote to memory of 2408 628 Cbphjj32.exe 80 PID 628 wrote to memory of 2408 628 Cbphjj32.exe 80 PID 628 wrote to memory of 2408 628 Cbphjj32.exe 80 PID 2408 wrote to memory of 3076 2408 Cgmpba32.exe 81 PID 2408 wrote to memory of 3076 2408 Cgmpba32.exe 81 PID 2408 wrote to memory of 3076 2408 Cgmpba32.exe 81 PID 3076 wrote to memory of 4420 3076 Cnghokon.exe 83 PID 3076 wrote to memory of 4420 3076 Cnghokon.exe 83 PID 3076 wrote to memory of 4420 3076 Cnghokon.exe 83 PID 4420 wrote to memory of 932 4420 Dgomgq32.exe 84 PID 4420 wrote to memory of 932 4420 Dgomgq32.exe 84 PID 4420 wrote to memory of 932 4420 Dgomgq32.exe 84 PID 932 wrote to memory of 4736 932 Dniedk32.exe 85 PID 932 wrote to memory of 4736 932 Dniedk32.exe 85 PID 932 wrote to memory of 4736 932 Dniedk32.exe 85 PID 4736 wrote to memory of 1680 4736 Dgajmpcl.exe 86 PID 4736 wrote to memory of 1680 4736 Dgajmpcl.exe 86 PID 4736 wrote to memory of 1680 4736 Dgajmpcl.exe 86 PID 1680 wrote to memory of 4948 1680 Dbgnjicb.exe 87 PID 1680 wrote to memory of 4948 1680 Dbgnjicb.exe 87 PID 1680 wrote to memory of 4948 1680 Dbgnjicb.exe 87 PID 4948 wrote to memory of 4996 4948 Dgdfbpai.exe 88 PID 4948 wrote to memory of 4996 4948 Dgdfbpai.exe 88 PID 4948 wrote to memory of 4996 4948 Dgdfbpai.exe 88 PID 4996 wrote to memory of 1588 4996 Ebbmfgid.exe 89 PID 4996 wrote to memory of 1588 4996 Ebbmfgid.exe 89 PID 4996 wrote to memory of 1588 4996 Ebbmfgid.exe 89 PID 1588 wrote to memory of 4472 1588 Eimecapa.exe 90 PID 1588 wrote to memory of 4472 1588 Eimecapa.exe 90 PID 1588 wrote to memory of 4472 1588 Eimecapa.exe 90 PID 4472 wrote to memory of 3948 4472 Eninkhni.exe 91 PID 4472 wrote to memory of 3948 4472 Eninkhni.exe 91 PID 4472 wrote to memory of 3948 4472 Eninkhni.exe 91 PID 3948 wrote to memory of 3108 3948 Eiobhano.exe 92 PID 3948 wrote to memory of 3108 3948 Eiobhano.exe 92 PID 3948 wrote to memory of 3108 3948 Eiobhano.exe 92 PID 3108 wrote to memory of 2992 3108 Eolkqhlf.exe 93 PID 3108 wrote to memory of 2992 3108 Eolkqhlf.exe 93 PID 3108 wrote to memory of 2992 3108 Eolkqhlf.exe 93 PID 2992 wrote to memory of 3400 2992 Eefcmbdc.exe 94 PID 2992 wrote to memory of 3400 2992 Eefcmbdc.exe 94 PID 2992 wrote to memory of 3400 2992 Eefcmbdc.exe 94 PID 3400 wrote to memory of 4216 3400 Elpkjl32.exe 95 PID 3400 wrote to memory of 4216 3400 Elpkjl32.exe 95 PID 3400 wrote to memory of 4216 3400 Elpkjl32.exe 95 PID 4216 wrote to memory of 2256 4216 Ficlcq32.exe 96 PID 4216 wrote to memory of 2256 4216 Ficlcq32.exe 96 PID 4216 wrote to memory of 2256 4216 Ficlcq32.exe 96 PID 2256 wrote to memory of 2932 2256 Foqdlg32.exe 97 PID 2256 wrote to memory of 2932 2256 Foqdlg32.exe 97 PID 2256 wrote to memory of 2932 2256 Foqdlg32.exe 97 PID 2932 wrote to memory of 1456 2932 Fhiidm32.exe 98 PID 2932 wrote to memory of 1456 2932 Fhiidm32.exe 98 PID 2932 wrote to memory of 1456 2932 Fhiidm32.exe 98 PID 1456 wrote to memory of 2072 1456 Fbnmbf32.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cb80b84540636a34e81a42eccd301646d5ab0a9ead4bfc09e203734aa9980dd.exe"C:\Users\Admin\AppData\Local\Temp\5cb80b84540636a34e81a42eccd301646d5ab0a9ead4bfc09e203734aa9980dd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\SysWOW64\Ckcbgp32.exeC:\Windows\system32\Ckcbgp32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\Celgpfjp.exeC:\Windows\system32\Celgpfjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\Cbphjj32.exeC:\Windows\system32\Cbphjj32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\Cgmpba32.exeC:\Windows\system32\Cgmpba32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\Cnghokon.exeC:\Windows\system32\Cnghokon.exe6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\Dgomgq32.exeC:\Windows\system32\Dgomgq32.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\Dniedk32.exeC:\Windows\system32\Dniedk32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\Dgajmpcl.exeC:\Windows\system32\Dgajmpcl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\Dbgnjicb.exeC:\Windows\system32\Dbgnjicb.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\Dgdfbpai.exeC:\Windows\system32\Dgdfbpai.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\Ebbmfgid.exeC:\Windows\system32\Ebbmfgid.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\Eimecapa.exeC:\Windows\system32\Eimecapa.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\Eninkhni.exeC:\Windows\system32\Eninkhni.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\Eiobhano.exeC:\Windows\system32\Eiobhano.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\Eolkqhlf.exeC:\Windows\system32\Eolkqhlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\Eefcmbdc.exeC:\Windows\system32\Eefcmbdc.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\Elpkjl32.exeC:\Windows\system32\Elpkjl32.exe18⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\Ficlcq32.exeC:\Windows\system32\Ficlcq32.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\Foqdlg32.exeC:\Windows\system32\Foqdlg32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\Fhiidm32.exeC:\Windows\system32\Fhiidm32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\Fbnmbf32.exeC:\Windows\system32\Fbnmbf32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\Fhkejm32.exeC:\Windows\system32\Fhkejm32.exe23⤵
- Executes dropped EXE
PID:2072 -
C:\Windows\SysWOW64\Facjcbco.exeC:\Windows\system32\Facjcbco.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:380 -
C:\Windows\SysWOW64\Fbcfmejb.exeC:\Windows\system32\Fbcfmejb.exe25⤵
- Executes dropped EXE
PID:2424 -
C:\Windows\SysWOW64\Gahcna32.exeC:\Windows\system32\Gahcna32.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:4608 -
C:\Windows\SysWOW64\Gakpcamg.exeC:\Windows\system32\Gakpcamg.exe27⤵
- Executes dropped EXE
PID:4320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Gehijp32.exeC:\Windows\system32\Gehijp32.exe1⤵
- Executes dropped EXE
PID:720 -
C:\Windows\SysWOW64\Gkeabf32.exeC:\Windows\system32\Gkeabf32.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:204 -
C:\Windows\SysWOW64\Glenli32.exeC:\Windows\system32\Glenli32.exe3⤵
- Executes dropped EXE
PID:4204 -
C:\Windows\SysWOW64\Hadcjpel.exeC:\Windows\system32\Hadcjpel.exe4⤵
- Executes dropped EXE
- Modifies registry class
PID:908 -
C:\Windows\SysWOW64\Hliggieb.exeC:\Windows\system32\Hliggieb.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4024 -
C:\Windows\SysWOW64\Hafpopcj.exeC:\Windows\system32\Hafpopcj.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2284 -
C:\Windows\SysWOW64\Hlldmhcp.exeC:\Windows\system32\Hlldmhcp.exe7⤵
- Executes dropped EXE
PID:3456 -
C:\Windows\SysWOW64\Hcflib32.exeC:\Windows\system32\Hcflib32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3168 -
C:\Windows\SysWOW64\Hipdfm32.exeC:\Windows\system32\Hipdfm32.exe9⤵
- Executes dropped EXE
- Modifies registry class
PID:4316 -
C:\Windows\SysWOW64\Hkaqnegg.exeC:\Windows\system32\Hkaqnegg.exe10⤵
- Executes dropped EXE
PID:1540 -
C:\Windows\SysWOW64\Ioccobji.exeC:\Windows\system32\Ioccobji.exe11⤵
- Executes dropped EXE
PID:3372 -
C:\Windows\SysWOW64\Ijiglk32.exeC:\Windows\system32\Ijiglk32.exe12⤵
- Executes dropped EXE
- Modifies registry class
PID:3356 -
C:\Windows\SysWOW64\Ikjcdcom.exeC:\Windows\system32\Ikjcdcom.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1484 -
C:\Windows\SysWOW64\Iohljb32.exeC:\Windows\system32\Iohljb32.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4520 -
C:\Windows\SysWOW64\Illmcfdm.exeC:\Windows\system32\Illmcfdm.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2236 -
C:\Windows\SysWOW64\Jhcmhg32.exeC:\Windows\system32\Jhcmhg32.exe16⤵
- Executes dropped EXE
PID:1084 -
C:\Windows\SysWOW64\Jbkbamqa.exeC:\Windows\system32\Jbkbamqa.exe17⤵
- Executes dropped EXE
PID:2132 -
C:\Windows\SysWOW64\Jbnogl32.exeC:\Windows\system32\Jbnogl32.exe18⤵
- Executes dropped EXE
PID:3064 -
C:\Windows\SysWOW64\Jlccde32.exeC:\Windows\system32\Jlccde32.exe19⤵
- Executes dropped EXE
PID:1132 -
C:\Windows\SysWOW64\Jbpkll32.exeC:\Windows\system32\Jbpkll32.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:772 -
C:\Windows\SysWOW64\Jkhpeacm.exeC:\Windows\system32\Jkhpeacm.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3024 -
C:\Windows\SysWOW64\Jbbhblkj.exeC:\Windows\system32\Jbbhblkj.exe22⤵
- Executes dropped EXE
PID:2452 -
C:\Windows\SysWOW64\Jhlpof32.exeC:\Windows\system32\Jhlpof32.exe23⤵
- Executes dropped EXE
- Modifies registry class
PID:1248 -
C:\Windows\SysWOW64\Jcbdlo32.exeC:\Windows\system32\Jcbdlo32.exe24⤵
- Executes dropped EXE
PID:1040 -
C:\Windows\SysWOW64\Jjlmiiii.exeC:\Windows\system32\Jjlmiiii.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1728 -
C:\Windows\SysWOW64\Kkmipa32.exeC:\Windows\system32\Kkmipa32.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2488 -
C:\Windows\SysWOW64\Kfbmnjon.exeC:\Windows\system32\Kfbmnjon.exe27⤵
- Executes dropped EXE
PID:1596 -
C:\Windows\SysWOW64\Kiajjena.exeC:\Windows\system32\Kiajjena.exe28⤵
- Executes dropped EXE
PID:4192 -
C:\Windows\SysWOW64\Kcfngnng.exeC:\Windows\system32\Kcfngnng.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2416 -
C:\Windows\SysWOW64\Kicfoelo.exeC:\Windows\system32\Kicfoelo.exe30⤵
- Executes dropped EXE
PID:2628 -
C:\Windows\SysWOW64\Komolo32.exeC:\Windows\system32\Komolo32.exe31⤵
- Executes dropped EXE
PID:2924 -
C:\Windows\SysWOW64\Kfggii32.exeC:\Windows\system32\Kfggii32.exe32⤵
- Executes dropped EXE
PID:1148 -
C:\Windows\SysWOW64\Kopkaoai.exeC:\Windows\system32\Kopkaoai.exe33⤵
- Executes dropped EXE
- Modifies registry class
PID:4356 -
C:\Windows\SysWOW64\Kbngnjql.exeC:\Windows\system32\Kbngnjql.exe34⤵
- Executes dropped EXE
PID:1848 -
C:\Windows\SysWOW64\Kjepogao.exeC:\Windows\system32\Kjepogao.exe35⤵
- Executes dropped EXE
- Modifies registry class
PID:3768 -
C:\Windows\SysWOW64\Kobhgnof.exeC:\Windows\system32\Kobhgnof.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1428 -
C:\Windows\SysWOW64\Lijlpdff.exeC:\Windows\system32\Lijlpdff.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4644 -
C:\Windows\SysWOW64\Ljjijf32.exeC:\Windows\system32\Ljjijf32.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:476 -
C:\Windows\SysWOW64\Ljlepfkg.exeC:\Windows\system32\Ljlepfkg.exe39⤵PID:5080
-
C:\Windows\SysWOW64\Lcdjhl32.exeC:\Windows\system32\Lcdjhl32.exe40⤵PID:3116
-
C:\Windows\SysWOW64\Liabqc32.exeC:\Windows\system32\Liabqc32.exe41⤵PID:3096
-
C:\Windows\SysWOW64\Lbjgihfo.exeC:\Windows\system32\Lbjgihfo.exe42⤵
- Modifies registry class
PID:3412 -
C:\Windows\SysWOW64\Ljaokega.exeC:\Windows\system32\Ljaokega.exe43⤵PID:2400
-
C:\Windows\SysWOW64\Llblbnmp.exeC:\Windows\system32\Llblbnmp.exe44⤵PID:3360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Mfhppfme.exeC:\Windows\system32\Mfhppfme.exe1⤵PID:3536
-
C:\Windows\SysWOW64\Mldhhnkm.exeC:\Windows\system32\Mldhhnkm.exe2⤵PID:1536
-
C:\Windows\SysWOW64\Mboqdh32.exeC:\Windows\system32\Mboqdh32.exe3⤵PID:2588
-
C:\Windows\SysWOW64\Mlgemm32.exeC:\Windows\system32\Mlgemm32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4924 -
C:\Windows\SysWOW64\Mflikf32.exeC:\Windows\system32\Mflikf32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2988 -
C:\Windows\SysWOW64\Mikega32.exeC:\Windows\system32\Mikega32.exe6⤵PID:4892
-
C:\Windows\SysWOW64\Mcpjdj32.exeC:\Windows\system32\Mcpjdj32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3916 -
C:\Windows\SysWOW64\Mfofpe32.exeC:\Windows\system32\Mfofpe32.exe8⤵PID:3528
-
C:\Windows\SysWOW64\Mimbla32.exeC:\Windows\system32\Mimbla32.exe9⤵
- Drops file in System32 directory
- Modifies registry class
PID:3292 -
C:\Windows\SysWOW64\Mllnhm32.exeC:\Windows\system32\Mllnhm32.exe10⤵PID:4796
-
C:\Windows\SysWOW64\Mmkkbo32.exeC:\Windows\system32\Mmkkbo32.exe11⤵PID:3692
-
C:\Windows\SysWOW64\Mpigok32.exeC:\Windows\system32\Mpigok32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2064 -
C:\Windows\SysWOW64\Nbhckf32.exeC:\Windows\system32\Nbhckf32.exe13⤵PID:1344
-
C:\Windows\SysWOW64\Niblgqal.exeC:\Windows\system32\Niblgqal.exe14⤵PID:176
-
C:\Windows\SysWOW64\Nmmgho32.exeC:\Windows\system32\Nmmgho32.exe15⤵
- Drops file in System32 directory
PID:484 -
C:\Windows\SysWOW64\Nplddj32.exeC:\Windows\system32\Nplddj32.exe16⤵
- Modifies registry class
PID:624 -
C:\Windows\SysWOW64\Nfflad32.exeC:\Windows\system32\Nfflad32.exe17⤵PID:4048
-
C:\Windows\SysWOW64\Nlbdik32.exeC:\Windows\system32\Nlbdik32.exe18⤵
- Drops file in System32 directory
PID:2700 -
C:\Windows\SysWOW64\Nbmmfefj.exeC:\Windows\system32\Nbmmfefj.exe19⤵
- Modifies registry class
PID:1312 -
C:\Windows\SysWOW64\Nifebp32.exeC:\Windows\system32\Nifebp32.exe20⤵PID:3220
-
C:\Windows\SysWOW64\Njfamb32.exeC:\Windows\system32\Njfamb32.exe21⤵PID:4168
-
C:\Windows\SysWOW64\Nlgndkkg.exeC:\Windows\system32\Nlgndkkg.exe22⤵PID:4768
-
C:\Windows\SysWOW64\Npcjei32.exeC:\Windows\system32\Npcjei32.exe23⤵PID:1668
-
C:\Windows\SysWOW64\Nfmbacjn.exeC:\Windows\system32\Nfmbacjn.exe24⤵PID:4620
-
C:\Windows\SysWOW64\Niknnoia.exeC:\Windows\system32\Niknnoia.exe25⤵
- Modifies registry class
PID:4916 -
C:\Windows\SysWOW64\Odabkhig.exeC:\Windows\system32\Odabkhig.exe26⤵PID:3860
-
C:\Windows\SysWOW64\Omigdmph.exeC:\Windows\system32\Omigdmph.exe27⤵
- Drops file in System32 directory
- Modifies registry class
PID:480 -
C:\Windows\SysWOW64\Odcoqg32.exeC:\Windows\system32\Odcoqg32.exe28⤵
- Drops file in System32 directory
PID:4968 -
C:\Windows\SysWOW64\Ofalmc32.exeC:\Windows\system32\Ofalmc32.exe29⤵PID:3524
-
C:\Windows\SysWOW64\Oiphin32.exeC:\Windows\system32\Oiphin32.exe30⤵PID:4092
-
C:\Windows\SysWOW64\Olndej32.exeC:\Windows\system32\Olndej32.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2352 -
C:\Windows\SysWOW64\Odelfg32.exeC:\Windows\system32\Odelfg32.exe32⤵PID:3180
-
C:\Windows\SysWOW64\Ofdhbb32.exeC:\Windows\system32\Ofdhbb32.exe33⤵
- Drops file in System32 directory
PID:3928 -
C:\Windows\SysWOW64\Oibdnnci.exeC:\Windows\system32\Oibdnnci.exe34⤵PID:5128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Omnqom32.exeC:\Windows\system32\Omnqom32.exe1⤵PID:5148
-
C:\Windows\SysWOW64\Oplmkh32.exeC:\Windows\system32\Oplmkh32.exe2⤵
- Drops file in System32 directory
PID:5172 -
C:\Windows\SysWOW64\Obkigc32.exeC:\Windows\system32\Obkigc32.exe3⤵PID:5200
-
C:\Windows\SysWOW64\Oidadnaf.exeC:\Windows\system32\Oidadnaf.exe4⤵PID:5216
-
C:\Windows\SysWOW64\Opoiqh32.exeC:\Windows\system32\Opoiqh32.exe5⤵PID:5240
-
C:\Windows\SysWOW64\Obmfmc32.exeC:\Windows\system32\Obmfmc32.exe6⤵PID:5272
-
C:\Windows\SysWOW64\Okdnnq32.exeC:\Windows\system32\Okdnnq32.exe7⤵PID:5292
-
C:\Windows\SysWOW64\Ombjjlhm.exeC:\Windows\system32\Ombjjlhm.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5308 -
C:\Windows\SysWOW64\Opaffggq.exeC:\Windows\system32\Opaffggq.exe9⤵
- Modifies registry class
PID:5332 -
C:\Windows\SysWOW64\Pbobbcfd.exeC:\Windows\system32\Pbobbcfd.exe10⤵PID:5368
-
C:\Windows\SysWOW64\Pmefplej.exeC:\Windows\system32\Pmefplej.exe11⤵PID:5384
-
C:\Windows\SysWOW64\Pdoolf32.exeC:\Windows\system32\Pdoolf32.exe12⤵PID:5404
-
C:\Windows\SysWOW64\Pgmkha32.exeC:\Windows\system32\Pgmkha32.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5420 -
C:\Windows\SysWOW64\Pilgdm32.exeC:\Windows\system32\Pilgdm32.exe14⤵PID:5436
-
C:\Windows\SysWOW64\Ppepag32.exeC:\Windows\system32\Ppepag32.exe15⤵PID:5452
-
C:\Windows\SysWOW64\Pgphnajh.exeC:\Windows\system32\Pgphnajh.exe16⤵PID:5468
-
C:\Windows\SysWOW64\Pindjlil.exeC:\Windows\system32\Pindjlil.exe17⤵PID:5484
-
C:\Windows\SysWOW64\Pphlgf32.exeC:\Windows\system32\Pphlgf32.exe18⤵PID:5500
-
C:\Windows\SysWOW64\Pcfhcb32.exeC:\Windows\system32\Pcfhcb32.exe19⤵PID:5520
-
C:\Windows\SysWOW64\Aijcfkoo.exeC:\Windows\system32\Aijcfkoo.exe20⤵PID:5536
-
C:\Windows\SysWOW64\Adohccod.exeC:\Windows\system32\Adohccod.exe21⤵PID:5552
-
C:\Windows\SysWOW64\Akippnfa.exeC:\Windows\system32\Akippnfa.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5572 -
C:\Windows\SysWOW64\Anhlliee.exeC:\Windows\system32\Anhlliee.exe23⤵
- Drops file in System32 directory
PID:5704 -
C:\Windows\SysWOW64\Addanc32.exeC:\Windows\system32\Addanc32.exe24⤵
- Modifies registry class
PID:5720 -
C:\Windows\SysWOW64\Aknikm32.exeC:\Windows\system32\Aknikm32.exe25⤵PID:5736
-
C:\Windows\SysWOW64\Alofbehj.exeC:\Windows\system32\Alofbehj.exe26⤵PID:5752
-
C:\Windows\SysWOW64\Adfndbil.exeC:\Windows\system32\Adfndbil.exe27⤵PID:5768
-
C:\Windows\SysWOW64\Akpfqm32.exeC:\Windows\system32\Akpfqm32.exe28⤵PID:5784
-
C:\Windows\SysWOW64\Bpmoic32.exeC:\Windows\system32\Bpmoic32.exe29⤵PID:5800
-
C:\Windows\SysWOW64\Bckkeo32.exeC:\Windows\system32\Bckkeo32.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5836 -
C:\Windows\SysWOW64\Bkbcflng.exeC:\Windows\system32\Bkbcflng.exe31⤵PID:5852
-
C:\Windows\SysWOW64\Bldond32.exeC:\Windows\system32\Bldond32.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5884 -
C:\Windows\SysWOW64\Bdkgob32.exeC:\Windows\system32\Bdkgob32.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5900 -
C:\Windows\SysWOW64\Bgickm32.exeC:\Windows\system32\Bgickm32.exe34⤵
- Drops file in System32 directory
- Modifies registry class
PID:5916 -
C:\Windows\SysWOW64\Bjhpgi32.exeC:\Windows\system32\Bjhpgi32.exe35⤵PID:5932
-
C:\Windows\SysWOW64\Blflcd32.exeC:\Windows\system32\Blflcd32.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5948 -
C:\Windows\SysWOW64\Bcpdpnio.exeC:\Windows\system32\Bcpdpnio.exe37⤵PID:5964
-
C:\Windows\SysWOW64\Bglpqm32.exeC:\Windows\system32\Bglpqm32.exe38⤵PID:5980
-
C:\Windows\SysWOW64\Bnfhmg32.exeC:\Windows\system32\Bnfhmg32.exe39⤵PID:5996
-
C:\Windows\SysWOW64\Bqdeib32.exeC:\Windows\system32\Bqdeib32.exe40⤵PID:6012
-
C:\Windows\SysWOW64\Bcbaen32.exeC:\Windows\system32\Bcbaen32.exe41⤵PID:6028
-
C:\Windows\SysWOW64\Bjlibhoi.exeC:\Windows\system32\Bjlibhoi.exe42⤵
- Modifies registry class
PID:6044 -
C:\Windows\SysWOW64\Bqfaob32.exeC:\Windows\system32\Bqfaob32.exe43⤵
- Drops file in System32 directory
PID:6060 -
C:\Windows\SysWOW64\Bcenkn32.exeC:\Windows\system32\Bcenkn32.exe44⤵PID:6076
-
C:\Windows\SysWOW64\Bklflk32.exeC:\Windows\system32\Bklflk32.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6092 -
C:\Windows\SysWOW64\Cmmbdc32.exeC:\Windows\system32\Cmmbdc32.exe46⤵
- Modifies registry class
PID:6108 -
C:\Windows\SysWOW64\Cddjeq32.exeC:\Windows\system32\Cddjeq32.exe47⤵
- Drops file in System32 directory
- Modifies registry class
PID:6124 -
C:\Windows\SysWOW64\Cknbbkdi.exeC:\Windows\system32\Cknbbkdi.exe48⤵PID:5136
-
C:\Windows\SysWOW64\Cmpoic32.exeC:\Windows\system32\Cmpoic32.exe49⤵
- Drops file in System32 directory
PID:5224 -
C:\Windows\SysWOW64\Cdggkp32.exeC:\Windows\system32\Cdggkp32.exe50⤵PID:5300
-
C:\Windows\SysWOW64\Cgecgl32.exeC:\Windows\system32\Cgecgl32.exe51⤵PID:5356
-
C:\Windows\SysWOW64\Cjcocg32.exeC:\Windows\system32\Cjcocg32.exe52⤵PID:5580
-
C:\Windows\SysWOW64\Cmblob32.exeC:\Windows\system32\Cmblob32.exe53⤵
- Modifies registry class
PID:5612 -
C:\Windows\SysWOW64\Cdicpphg.exeC:\Windows\system32\Cdicpphg.exe54⤵PID:5640
-
C:\Windows\SysWOW64\Cggplkgk.exeC:\Windows\system32\Cggplkgk.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5664 -
C:\Windows\SysWOW64\Cjflhggo.exeC:\Windows\system32\Cjflhggo.exe56⤵
- Drops file in System32 directory
PID:5684 -
C:\Windows\SysWOW64\Cmdhdbfb.exeC:\Windows\system32\Cmdhdbfb.exe57⤵
- Modifies registry class
PID:5700 -
C:\Windows\SysWOW64\Cqpdea32.exeC:\Windows\system32\Cqpdea32.exe58⤵PID:5268
-
C:\Windows\SysWOW64\Ccnqal32.exeC:\Windows\system32\Ccnqal32.exe59⤵PID:5636
-
C:\Windows\SysWOW64\Cjhinfdl.exeC:\Windows\system32\Cjhinfdl.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6136 -
C:\Windows\SysWOW64\Cmfejbdp.exeC:\Windows\system32\Cmfejbdp.exe61⤵PID:6156
-
C:\Windows\SysWOW64\Cdnmko32.exeC:\Windows\system32\Cdnmko32.exe62⤵PID:6176
-
C:\Windows\SysWOW64\Cgligk32.exeC:\Windows\system32\Cgligk32.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6204 -
C:\Windows\SysWOW64\Djjecf32.exeC:\Windows\system32\Djjecf32.exe64⤵PID:6228
-
C:\Windows\SysWOW64\Dqdnppjf.exeC:\Windows\system32\Dqdnppjf.exe65⤵PID:6244
-
C:\Windows\SysWOW64\Dkjbnijl.exeC:\Windows\system32\Dkjbnijl.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6260 -
C:\Windows\SysWOW64\Dnhnjdip.exeC:\Windows\system32\Dnhnjdip.exe67⤵
- Drops file in System32 directory
- Modifies registry class
PID:6276 -
C:\Windows\SysWOW64\Dqgjfphc.exeC:\Windows\system32\Dqgjfphc.exe68⤵
- Modifies registry class
PID:6296 -
C:\Windows\SysWOW64\Dgabbjpp.exeC:\Windows\system32\Dgabbjpp.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6316 -
C:\Windows\SysWOW64\Dmnkkang.exeC:\Windows\system32\Dmnkkang.exe70⤵PID:6332
-
C:\Windows\SysWOW64\Dgcohjmn.exeC:\Windows\system32\Dgcohjmn.exe71⤵PID:6348
-
C:\Windows\SysWOW64\Dnmhed32.exeC:\Windows\system32\Dnmhed32.exe72⤵PID:6364
-
C:\Windows\SysWOW64\Degpanlg.exeC:\Windows\system32\Degpanlg.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6380 -
C:\Windows\SysWOW64\Dclmbjao.exeC:\Windows\system32\Dclmbjao.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:6396 -
C:\Windows\SysWOW64\Ejfeod32.exeC:\Windows\system32\Ejfeod32.exe75⤵PID:6412
-
C:\Windows\SysWOW64\Emdakp32.exeC:\Windows\system32\Emdakp32.exe76⤵PID:6428
-
C:\Windows\SysWOW64\Eelimm32.exeC:\Windows\system32\Eelimm32.exe77⤵PID:6444
-
C:\Windows\SysWOW64\Ekfaig32.exeC:\Windows\system32\Ekfaig32.exe78⤵PID:6460
-
C:\Windows\SysWOW64\Endnec32.exeC:\Windows\system32\Endnec32.exe79⤵PID:6476
-
C:\Windows\SysWOW64\Egmbnhec.exeC:\Windows\system32\Egmbnhec.exe80⤵PID:6492
-
C:\Windows\SysWOW64\Eaeggn32.exeC:\Windows\system32\Eaeggn32.exe81⤵PID:6508
-
C:\Windows\SysWOW64\Ekjkdg32.exeC:\Windows\system32\Ekjkdg32.exe82⤵PID:6524
-
C:\Windows\SysWOW64\Enigqbkm.exeC:\Windows\system32\Enigqbkm.exe83⤵PID:6540
-
C:\Windows\SysWOW64\Eecoml32.exeC:\Windows\system32\Eecoml32.exe84⤵
- Modifies registry class
PID:6560 -
C:\Windows\SysWOW64\Egalih32.exeC:\Windows\system32\Egalih32.exe85⤵
- Modifies registry class
PID:6576 -
C:\Windows\SysWOW64\Ejphec32.exeC:\Windows\system32\Ejphec32.exe86⤵PID:6600
-
C:\Windows\SysWOW64\Emndao32.exeC:\Windows\system32\Emndao32.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6624 -
C:\Windows\SysWOW64\Fgchog32.exeC:\Windows\system32\Fgchog32.exe88⤵PID:6644
-
C:\Windows\SysWOW64\Fjbdkc32.exeC:\Windows\system32\Fjbdkc32.exe89⤵PID:6672
-
C:\Windows\SysWOW64\Fmpagnmb.exeC:\Windows\system32\Fmpagnmb.exe90⤵PID:6708
-
C:\Windows\SysWOW64\Fegihlnd.exeC:\Windows\system32\Fegihlnd.exe91⤵PID:6728
-
C:\Windows\SysWOW64\Fjdaqbll.exeC:\Windows\system32\Fjdaqbll.exe92⤵PID:6760
-
C:\Windows\SysWOW64\Fanimm32.exeC:\Windows\system32\Fanimm32.exe93⤵
- Modifies registry class
PID:6780 -
C:\Windows\SysWOW64\Fcmfih32.exeC:\Windows\system32\Fcmfih32.exe94⤵PID:6796
-
C:\Windows\SysWOW64\Fldnke32.exeC:\Windows\system32\Fldnke32.exe95⤵PID:6824
-
C:\Windows\SysWOW64\Faqfclaf.exeC:\Windows\system32\Faqfclaf.exe96⤵PID:6860
-
C:\Windows\SysWOW64\Fdobohaj.exeC:\Windows\system32\Fdobohaj.exe97⤵PID:6884
-
C:\Windows\SysWOW64\Flfjpeal.exeC:\Windows\system32\Flfjpeal.exe98⤵
- Drops file in System32 directory
PID:6908 -
C:\Windows\SysWOW64\Fndglqqp.exeC:\Windows\system32\Fndglqqp.exe99⤵
- Modifies registry class
PID:6928 -
C:\Windows\SysWOW64\Facchlpc.exeC:\Windows\system32\Facchlpc.exe100⤵PID:6948
-
C:\Windows\SysWOW64\Fdaodgog.exeC:\Windows\system32\Fdaodgog.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:6968 -
C:\Windows\SysWOW64\Fjkgaa32.exeC:\Windows\system32\Fjkgaa32.exe102⤵
- Drops file in System32 directory
PID:6984 -
C:\Windows\SysWOW64\Faepnlnq.exeC:\Windows\system32\Faepnlnq.exe103⤵PID:7000
-
C:\Windows\SysWOW64\Ghohkfen.exeC:\Windows\system32\Ghohkfen.exe104⤵
- Drops file in System32 directory
PID:7024 -
C:\Windows\SysWOW64\Gmlpcmce.exeC:\Windows\system32\Gmlpcmce.exe105⤵PID:7052
-
C:\Windows\SysWOW64\Gdfipg32.exeC:\Windows\system32\Gdfipg32.exe106⤵PID:7080
-
C:\Windows\SysWOW64\Gdkbkfgl.exeC:\Windows\system32\Gdkbkfgl.exe107⤵PID:7112
-
C:\Windows\SysWOW64\Glbjlcgo.exeC:\Windows\system32\Glbjlcgo.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7152 -
C:\Windows\SysWOW64\Gmcfcl32.exeC:\Windows\system32\Gmcfcl32.exe109⤵
- Modifies registry class
PID:5624 -
C:\Windows\SysWOW64\Gdmopfdj.exeC:\Windows\system32\Gdmopfdj.exe110⤵
- Modifies registry class
PID:6612 -
C:\Windows\SysWOW64\Gkggmplf.exeC:\Windows\system32\Gkggmplf.exe111⤵
- Modifies registry class
PID:6668 -
C:\Windows\SysWOW64\Gmecikkj.exeC:\Windows\system32\Gmecikkj.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6716 -
C:\Windows\SysWOW64\Hemkjill.exeC:\Windows\system32\Hemkjill.exe113⤵PID:6768
-
C:\Windows\SysWOW64\Hhkgfdkp.exeC:\Windows\system32\Hhkgfdkp.exe114⤵PID:6848
-
C:\Windows\SysWOW64\Hoepcn32.exeC:\Windows\system32\Hoepcn32.exe115⤵PID:6856
-
C:\Windows\SysWOW64\Hacloj32.exeC:\Windows\system32\Hacloj32.exe116⤵
- Drops file in System32 directory
PID:6904 -
C:\Windows\SysWOW64\Hdahke32.exeC:\Windows\system32\Hdahke32.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7048 -
C:\Windows\SysWOW64\Hlipmbag.exeC:\Windows\system32\Hlipmbag.exe118⤵PID:7184
-
C:\Windows\SysWOW64\Hklpho32.exeC:\Windows\system32\Hklpho32.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7208 -
C:\Windows\SysWOW64\Hddeaeoa.exeC:\Windows\system32\Hddeaeoa.exe120⤵PID:7224
-
C:\Windows\SysWOW64\Hhpaac32.exeC:\Windows\system32\Hhpaac32.exe121⤵
- Drops file in System32 directory
PID:7236 -
C:\Windows\SysWOW64\Hojinnnh.exeC:\Windows\system32\Hojinnnh.exe122⤵PID:7256
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-