Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
62s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 07:38
Static task
static1
Behavioral task
behavioral1
Sample
96d01d1cc57ce70694a365bbeaf7b2bbaf3706a00f7ff690169b57620f78129f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
96d01d1cc57ce70694a365bbeaf7b2bbaf3706a00f7ff690169b57620f78129f.exe
Resource
win10v2004-20220901-en
General
-
Target
96d01d1cc57ce70694a365bbeaf7b2bbaf3706a00f7ff690169b57620f78129f.exe
-
Size
101KB
-
MD5
83f489416cc6460d5930176f240e2400
-
SHA1
0ad5248a98036e5b250cc8971a42ab8fc62b565b
-
SHA256
96d01d1cc57ce70694a365bbeaf7b2bbaf3706a00f7ff690169b57620f78129f
-
SHA512
04efc8d2e81f422cbf6b57873b9f89ed9f0feab480ee11730f4a9acbd96a261d56cac630aecf69aaca0399e1a58888d54961863ba8538acdf3bb6d034c6b3fb6
-
SSDEEP
3072:sD4l6PTKR5zB5n8qeraam2TLjVxOCgc0h1o:sD+6PDm2fjqCgc
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Japdbe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dokqlfip.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gpaleq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpjdpkoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ecepiiid.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Inhiei32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldccpn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mnidja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kkiofdjc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ikecnnpf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kadnmeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Benjaceg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idonbmqi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bgfpkgbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dfclcqbo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhgbeg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Emlglo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Idmhgcfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jocekj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pocpgnjp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gonibohe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lnndnc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcbcbeen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dfheop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Facchlpc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmcfcl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmhpokig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hlpfma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Agojjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hdcnfnkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kggekd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdkpfpfd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eaipbmhn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iehkfgao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jamhlfkc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jookpjlp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Opglebkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gcjkppcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iandqa32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emfgfi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fanbcf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fcloob32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmohla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mfhppfme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dmkoea32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ihggbbqc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jkelelad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kddpdjoq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgblpend.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kolagb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipfngn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ipfngn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Imjoqbef.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lkldbbjn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nbjifp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pleckbkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ainffd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bchgei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mnidja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cqajpj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ombjjlhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bnfhmg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Echlniga.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnphha32.exe -
Executes dropped EXE 64 IoCs
pid Process 4156 Lidofb32.exe 3684 Mfhppfme.exe 4796 Mppdhl32.exe 4900 Mboqdh32.exe 1508 Mlgemm32.exe 2316 Mflikf32.exe 3124 Mmfagppm.exe 1412 Mcpjdj32.exe 2836 Mimbla32.exe 3004 Mpgjik32.exe 3540 Mjmofd32.exe 3544 Njoklc32.exe 1480 Nmpdnohb.exe 4052 Nbmmfefj.exe 4452 Nleaok32.exe 2672 Njfamb32.exe 32 Nbafae32.exe 5068 Niknnoia.exe 2332 Ojkkhbqd.exe 3276 Odcoqg32.exe 4484 Olndej32.exe 2160 Oibdnnci.exe 2584 Ompmdl32.exe 4440 Obmfmc32.exe 1456 Ombjjlhm.exe 1148 Pdmbgf32.exe 4352 Pbaohbda.exe 1064 Pgphnajh.exe 732 Pipqplgi.exe 2780 Pciehanj.exe 4504 Pmnifjnp.exe 808 Qkbjooli.exe 5036 Qpobgekq.exe 1564 Qgikdpbn.exe 1468 Qnccaj32.exe 2152 Acpkiq32.exe 4496 Acbhopeo.exe 4420 Ajlpkj32.exe 4536 Apfhhddi.exe 3776 Almime32.exe 1008 Acgajpaj.exe 4028 Aknikm32.exe 392 Anlfgh32.exe 1060 Adfndbil.exe 5108 Akpfqm32.exe 3852 Bckkeo32.exe 1444 Bcngjoka.exe 1952 Bqahdcjk.exe 2408 Bnfhmg32.exe 3868 Bgnmfmpe.exe 1928 Bcenkn32.exe 4548 Cgcfal32.exe 812 Cnmonfcm.exe 1700 Cqkkjabq.exe 4500 Cgecgl32.exe 4968 Cnokcfaj.exe 3808 Ccldlm32.exe 4892 Cjflhggo.exe 2444 Cmdhdbfb.exe 4872 Cdkpfpfd.exe 3020 Ckehbj32.exe 2056 Cmfejbdp.exe 1604 Ccqmglkl.exe 1916 Djjecf32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Bgfpkgbb.exe Bibpacch.exe File opened for modification C:\Windows\SysWOW64\Dcbcbeen.exe Dqdgfjfj.exe File created C:\Windows\SysWOW64\Gdheefio.exe Gajiik32.exe File created C:\Windows\SysWOW64\Galfokgi.exe Gonibohe.exe File opened for modification C:\Windows\SysWOW64\Poelmn32.exe Pmdpeebo.exe File created C:\Windows\SysWOW64\Lhhnic32.dll Mihbgkfk.exe File created C:\Windows\SysWOW64\Kddpdjoq.exe Kafchnom.exe File created C:\Windows\SysWOW64\Opmlnplo.dll Adfndbil.exe File created C:\Windows\SysWOW64\Egdkofel.dll Ikgpdn32.exe File created C:\Windows\SysWOW64\Kadnmeek.exe Jkjepk32.exe File created C:\Windows\SysWOW64\Kdiodkmj.dll Hlfcgc32.exe File created C:\Windows\SysWOW64\Dfmjkbbh.dll Poelmn32.exe File created C:\Windows\SysWOW64\Fpcpdcee.exe Fmdchgfa.exe File created C:\Windows\SysWOW64\Cppjoc32.dll Kklbfj32.exe File created C:\Windows\SysWOW64\Glieja32.dll Pbahmlpf.exe File opened for modification C:\Windows\SysWOW64\Ikgiig32.exe Ihhmml32.exe File created C:\Windows\SysWOW64\Ebqgodpa.dll Pipqplgi.exe File opened for modification C:\Windows\SysWOW64\Bgnmfmpe.exe Bnfhmg32.exe File opened for modification C:\Windows\SysWOW64\Gaobdjef.exe Gmcfcl32.exe File created C:\Windows\SysWOW64\Iophdf32.exe Ihfphlmg.exe File created C:\Windows\SysWOW64\Mjmofd32.exe Mpgjik32.exe File created C:\Windows\SysWOW64\Dnkkfiod.dll Ghfnke32.exe File created C:\Windows\SysWOW64\Jojgmdbj.dll Bgfpkgbb.exe File created C:\Windows\SysWOW64\Jhidmccl.dll Bpcnoldm.exe File created C:\Windows\SysWOW64\Imjoqbef.exe Igpfdhnj.exe File opened for modification C:\Windows\SysWOW64\Lkldbbjn.exe Lkgkgb32.exe File created C:\Windows\SysWOW64\Hkgfeh32.dll Bqahdcjk.exe File created C:\Windows\SysWOW64\Nkneogkb.dll Gnipgp32.exe File created C:\Windows\SysWOW64\Klnfkklh.dll Ieanleid.exe File created C:\Windows\SysWOW64\Clbnma32.dll Cjflhggo.exe File opened for modification C:\Windows\SysWOW64\Ccqmglkl.exe Cmfejbdp.exe File created C:\Windows\SysWOW64\Hffcni32.exe Hfdghihg.exe File opened for modification C:\Windows\SysWOW64\Jkgbpele.exe Jhifdimb.exe File created C:\Windows\SysWOW64\Kaqjnlnh.dll Hoglinpj.exe File created C:\Windows\SysWOW64\Lkmkmhmi.exe Lmjkak32.exe File opened for modification C:\Windows\SysWOW64\Hnfeng32.exe Hfpnmj32.exe File created C:\Windows\SysWOW64\Ejmdemoh.exe Egnhibpd.exe File created C:\Windows\SysWOW64\Fidhqnjd.dll Hnblchqd.exe File created C:\Windows\SysWOW64\Mfgefhcg.dll Ihhmml32.exe File created C:\Windows\SysWOW64\Fjdbjjdn.dll Bgnmfmpe.exe File created C:\Windows\SysWOW64\Gldgac32.exe Ghikadmc.exe File opened for modification C:\Windows\SysWOW64\Lmjkak32.exe Ldccpn32.exe File created C:\Windows\SysWOW64\Dcbcbeen.exe Dqdgfjfj.exe File opened for modification C:\Windows\SysWOW64\Hdfklnic.exe Hagnpbjp.exe File created C:\Windows\SysWOW64\Mgebmbmo.exe Mdgeqgnk.exe File created C:\Windows\SysWOW64\Kacokc32.dll Knhkbpif.exe File opened for modification C:\Windows\SysWOW64\Kgpokepg.exe Kpfgnk32.exe File created C:\Windows\SysWOW64\Kkngifmf.dll Lkenac32.exe File created C:\Windows\SysWOW64\Jncfqell.dll Cnokcfaj.exe File created C:\Windows\SysWOW64\Mbnkmlib.dll Oioanh32.exe File created C:\Windows\SysWOW64\Ialaljom.dll Gnponhcg.exe File created C:\Windows\SysWOW64\Npgakcjl.dll Egoodhcp.exe File created C:\Windows\SysWOW64\Pleckbkl.exe Oekknh32.exe File created C:\Windows\SysWOW64\Ddgbpkcj.dll Hnfeng32.exe File created C:\Windows\SysWOW64\Pbaohbda.exe Pdmbgf32.exe File opened for modification C:\Windows\SysWOW64\Qpobgekq.exe Qkbjooli.exe File created C:\Windows\SysWOW64\Lbfnipfn.dll Gdkbkfgl.exe File created C:\Windows\SysWOW64\Ihfphlmg.exe Hffcni32.exe File created C:\Windows\SysWOW64\Jookpjlp.exe Jlpodoml.exe File created C:\Windows\SysWOW64\Lnbhal32.dll Npnjodcj.exe File created C:\Windows\SysWOW64\Dakeiaoh.dll Aofeckjj.exe File created C:\Windows\SysWOW64\Fjihhi32.dll Apeannam.exe File created C:\Windows\SysWOW64\Bcbjkhdq.exe Bpcnoldm.exe File created C:\Windows\SysWOW64\Glpmfdia.exe Gdheefio.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 9904 9832 WerFault.exe 469 -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nbafae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkheelao.dll" Galfokgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ccfcfg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gjaggjlp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdjjfodp.dll" Niknnoia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Idonbmqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nphiic32.dll" Jkeeke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ghohkfen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lichll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nnlqpanj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nehebk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pocpgnjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fmdchgfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jkelelad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ainffd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oifihkab.dll" Dqdgfjfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbqpafdl.dll" Glpmfdia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hdinld32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oioanh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fmdchgfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hfdghihg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhmndama.dll" Pgphnajh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fegihlnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Honbim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nmjdhi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glieja32.dll" Pbahmlpf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fcqhjakk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oidkcklm.dll" Ccldlm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffddankd.dll" Djmbif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diigchld.dll" Ikecnnpf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eogphdob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jkgbpele.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pifkmo32.dll" Mimbla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqfgbp32.dll" Hlipmbag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahdjiaag.dll" Ieoagflg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hngphphp.dll" Ldependj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjcamj32.dll" Ldqfjn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dcdpgeck.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Emdjaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndcbqghq.dll" Nmpdnohb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cobnfgaj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eaipbmhn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pemhdhal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jhifdimb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ojkkhbqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Acgajpaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lldncljo.dll" Aokook32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bjlbhbkn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gcjkppcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmihdafi.dll" Mjmofd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epfkki32.dll" Nleaok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jdkmnkfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbljhn32.dll" Kafchnom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdgken32.dll" Olndej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pipqplgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ccqmglkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pepdihoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dndbhkoq.dll" Iddgml32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jpkhbmbg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibogmacl.dll" Hdodko32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kkiofdjc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ecepiiid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Flaaef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fmjcmm32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4780 wrote to memory of 4156 4780 96d01d1cc57ce70694a365bbeaf7b2bbaf3706a00f7ff690169b57620f78129f.exe 82 PID 4780 wrote to memory of 4156 4780 96d01d1cc57ce70694a365bbeaf7b2bbaf3706a00f7ff690169b57620f78129f.exe 82 PID 4780 wrote to memory of 4156 4780 96d01d1cc57ce70694a365bbeaf7b2bbaf3706a00f7ff690169b57620f78129f.exe 82 PID 4156 wrote to memory of 3684 4156 Lidofb32.exe 83 PID 4156 wrote to memory of 3684 4156 Lidofb32.exe 83 PID 4156 wrote to memory of 3684 4156 Lidofb32.exe 83 PID 3684 wrote to memory of 4796 3684 Mfhppfme.exe 84 PID 3684 wrote to memory of 4796 3684 Mfhppfme.exe 84 PID 3684 wrote to memory of 4796 3684 Mfhppfme.exe 84 PID 4796 wrote to memory of 4900 4796 Mppdhl32.exe 85 PID 4796 wrote to memory of 4900 4796 Mppdhl32.exe 85 PID 4796 wrote to memory of 4900 4796 Mppdhl32.exe 85 PID 4900 wrote to memory of 1508 4900 Mboqdh32.exe 86 PID 4900 wrote to memory of 1508 4900 Mboqdh32.exe 86 PID 4900 wrote to memory of 1508 4900 Mboqdh32.exe 86 PID 1508 wrote to memory of 2316 1508 Mlgemm32.exe 88 PID 1508 wrote to memory of 2316 1508 Mlgemm32.exe 88 PID 1508 wrote to memory of 2316 1508 Mlgemm32.exe 88 PID 2316 wrote to memory of 3124 2316 Mflikf32.exe 89 PID 2316 wrote to memory of 3124 2316 Mflikf32.exe 89 PID 2316 wrote to memory of 3124 2316 Mflikf32.exe 89 PID 3124 wrote to memory of 1412 3124 Mmfagppm.exe 90 PID 3124 wrote to memory of 1412 3124 Mmfagppm.exe 90 PID 3124 wrote to memory of 1412 3124 Mmfagppm.exe 90 PID 1412 wrote to memory of 2836 1412 Mcpjdj32.exe 91 PID 1412 wrote to memory of 2836 1412 Mcpjdj32.exe 91 PID 1412 wrote to memory of 2836 1412 Mcpjdj32.exe 91 PID 2836 wrote to memory of 3004 2836 Mimbla32.exe 92 PID 2836 wrote to memory of 3004 2836 Mimbla32.exe 92 PID 2836 wrote to memory of 3004 2836 Mimbla32.exe 92 PID 3004 wrote to memory of 3540 3004 Mpgjik32.exe 93 PID 3004 wrote to memory of 3540 3004 Mpgjik32.exe 93 PID 3004 wrote to memory of 3540 3004 Mpgjik32.exe 93 PID 3540 wrote to memory of 3544 3540 Mjmofd32.exe 94 PID 3540 wrote to memory of 3544 3540 Mjmofd32.exe 94 PID 3540 wrote to memory of 3544 3540 Mjmofd32.exe 94 PID 3544 wrote to memory of 1480 3544 Njoklc32.exe 95 PID 3544 wrote to memory of 1480 3544 Njoklc32.exe 95 PID 3544 wrote to memory of 1480 3544 Njoklc32.exe 95 PID 1480 wrote to memory of 4052 1480 Nmpdnohb.exe 96 PID 1480 wrote to memory of 4052 1480 Nmpdnohb.exe 96 PID 1480 wrote to memory of 4052 1480 Nmpdnohb.exe 96 PID 4052 wrote to memory of 4452 4052 Nbmmfefj.exe 97 PID 4052 wrote to memory of 4452 4052 Nbmmfefj.exe 97 PID 4052 wrote to memory of 4452 4052 Nbmmfefj.exe 97 PID 4452 wrote to memory of 2672 4452 Nleaok32.exe 98 PID 4452 wrote to memory of 2672 4452 Nleaok32.exe 98 PID 4452 wrote to memory of 2672 4452 Nleaok32.exe 98 PID 2672 wrote to memory of 32 2672 Njfamb32.exe 99 PID 2672 wrote to memory of 32 2672 Njfamb32.exe 99 PID 2672 wrote to memory of 32 2672 Njfamb32.exe 99 PID 32 wrote to memory of 5068 32 Nbafae32.exe 100 PID 32 wrote to memory of 5068 32 Nbafae32.exe 100 PID 32 wrote to memory of 5068 32 Nbafae32.exe 100 PID 5068 wrote to memory of 2332 5068 Niknnoia.exe 101 PID 5068 wrote to memory of 2332 5068 Niknnoia.exe 101 PID 5068 wrote to memory of 2332 5068 Niknnoia.exe 101 PID 2332 wrote to memory of 3276 2332 Ojkkhbqd.exe 102 PID 2332 wrote to memory of 3276 2332 Ojkkhbqd.exe 102 PID 2332 wrote to memory of 3276 2332 Ojkkhbqd.exe 102 PID 3276 wrote to memory of 4484 3276 Odcoqg32.exe 103 PID 3276 wrote to memory of 4484 3276 Odcoqg32.exe 103 PID 3276 wrote to memory of 4484 3276 Odcoqg32.exe 103 PID 4484 wrote to memory of 2160 4484 Olndej32.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\96d01d1cc57ce70694a365bbeaf7b2bbaf3706a00f7ff690169b57620f78129f.exe"C:\Users\Admin\AppData\Local\Temp\96d01d1cc57ce70694a365bbeaf7b2bbaf3706a00f7ff690169b57620f78129f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\Lidofb32.exeC:\Windows\system32\Lidofb32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\Mfhppfme.exeC:\Windows\system32\Mfhppfme.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\Mppdhl32.exeC:\Windows\system32\Mppdhl32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\Mboqdh32.exeC:\Windows\system32\Mboqdh32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\Mlgemm32.exeC:\Windows\system32\Mlgemm32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\Mflikf32.exeC:\Windows\system32\Mflikf32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\Mmfagppm.exeC:\Windows\system32\Mmfagppm.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\Mcpjdj32.exeC:\Windows\system32\Mcpjdj32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\Mimbla32.exeC:\Windows\system32\Mimbla32.exe10⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\Mpgjik32.exeC:\Windows\system32\Mpgjik32.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\Mjmofd32.exeC:\Windows\system32\Mjmofd32.exe12⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\Njoklc32.exeC:\Windows\system32\Njoklc32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\Nmpdnohb.exeC:\Windows\system32\Nmpdnohb.exe14⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\Nbmmfefj.exeC:\Windows\system32\Nbmmfefj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\Nleaok32.exeC:\Windows\system32\Nleaok32.exe16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\Njfamb32.exeC:\Windows\system32\Njfamb32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\Nbafae32.exeC:\Windows\system32\Nbafae32.exe18⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Windows\SysWOW64\Niknnoia.exeC:\Windows\system32\Niknnoia.exe19⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\Ojkkhbqd.exeC:\Windows\system32\Ojkkhbqd.exe20⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\Odcoqg32.exeC:\Windows\system32\Odcoqg32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\Olndej32.exeC:\Windows\system32\Olndej32.exe22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\Oibdnnci.exeC:\Windows\system32\Oibdnnci.exe23⤵
- Executes dropped EXE
PID:2160 -
C:\Windows\SysWOW64\Ompmdl32.exeC:\Windows\system32\Ompmdl32.exe24⤵
- Executes dropped EXE
PID:2584 -
C:\Windows\SysWOW64\Obmfmc32.exeC:\Windows\system32\Obmfmc32.exe25⤵
- Executes dropped EXE
PID:4440 -
C:\Windows\SysWOW64\Ombjjlhm.exeC:\Windows\system32\Ombjjlhm.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1456 -
C:\Windows\SysWOW64\Pdmbgf32.exeC:\Windows\system32\Pdmbgf32.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1148 -
C:\Windows\SysWOW64\Pbaohbda.exeC:\Windows\system32\Pbaohbda.exe28⤵
- Executes dropped EXE
PID:4352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Pgphnajh.exeC:\Windows\system32\Pgphnajh.exe1⤵
- Executes dropped EXE
- Modifies registry class
PID:1064 -
C:\Windows\SysWOW64\Pipqplgi.exeC:\Windows\system32\Pipqplgi.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:732 -
C:\Windows\SysWOW64\Pciehanj.exeC:\Windows\system32\Pciehanj.exe3⤵
- Executes dropped EXE
PID:2780 -
C:\Windows\SysWOW64\Pmnifjnp.exeC:\Windows\system32\Pmnifjnp.exe4⤵
- Executes dropped EXE
PID:4504 -
C:\Windows\SysWOW64\Qkbjooli.exeC:\Windows\system32\Qkbjooli.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:808 -
C:\Windows\SysWOW64\Qpobgekq.exeC:\Windows\system32\Qpobgekq.exe6⤵
- Executes dropped EXE
PID:5036 -
C:\Windows\SysWOW64\Qgikdpbn.exeC:\Windows\system32\Qgikdpbn.exe7⤵
- Executes dropped EXE
PID:1564 -
C:\Windows\SysWOW64\Qnccaj32.exeC:\Windows\system32\Qnccaj32.exe8⤵
- Executes dropped EXE
PID:1468 -
C:\Windows\SysWOW64\Acpkiq32.exeC:\Windows\system32\Acpkiq32.exe9⤵
- Executes dropped EXE
PID:2152 -
C:\Windows\SysWOW64\Acbhopeo.exeC:\Windows\system32\Acbhopeo.exe10⤵
- Executes dropped EXE
PID:4496 -
C:\Windows\SysWOW64\Ajlpkj32.exeC:\Windows\system32\Ajlpkj32.exe11⤵
- Executes dropped EXE
PID:4420 -
C:\Windows\SysWOW64\Apfhhddi.exeC:\Windows\system32\Apfhhddi.exe12⤵
- Executes dropped EXE
PID:4536 -
C:\Windows\SysWOW64\Almime32.exeC:\Windows\system32\Almime32.exe13⤵
- Executes dropped EXE
PID:3776 -
C:\Windows\SysWOW64\Acgajpaj.exeC:\Windows\system32\Acgajpaj.exe14⤵
- Executes dropped EXE
- Modifies registry class
PID:1008 -
C:\Windows\SysWOW64\Aknikm32.exeC:\Windows\system32\Aknikm32.exe15⤵
- Executes dropped EXE
PID:4028 -
C:\Windows\SysWOW64\Anlfgh32.exeC:\Windows\system32\Anlfgh32.exe16⤵
- Executes dropped EXE
PID:392 -
C:\Windows\SysWOW64\Adfndbil.exeC:\Windows\system32\Adfndbil.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1060 -
C:\Windows\SysWOW64\Akpfqm32.exeC:\Windows\system32\Akpfqm32.exe18⤵
- Executes dropped EXE
PID:5108 -
C:\Windows\SysWOW64\Bckkeo32.exeC:\Windows\system32\Bckkeo32.exe19⤵
- Executes dropped EXE
PID:3852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Bcngjoka.exeC:\Windows\system32\Bcngjoka.exe1⤵
- Executes dropped EXE
PID:1444 -
C:\Windows\SysWOW64\Bqahdcjk.exeC:\Windows\system32\Bqahdcjk.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1952 -
C:\Windows\SysWOW64\Bnfhmg32.exeC:\Windows\system32\Bnfhmg32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2408 -
C:\Windows\SysWOW64\Bgnmfmpe.exeC:\Windows\system32\Bgnmfmpe.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3868 -
C:\Windows\SysWOW64\Bcenkn32.exeC:\Windows\system32\Bcenkn32.exe5⤵
- Executes dropped EXE
PID:1928 -
C:\Windows\SysWOW64\Cgcfal32.exeC:\Windows\system32\Cgcfal32.exe6⤵
- Executes dropped EXE
PID:4548 -
C:\Windows\SysWOW64\Cnmonfcm.exeC:\Windows\system32\Cnmonfcm.exe7⤵
- Executes dropped EXE
PID:812 -
C:\Windows\SysWOW64\Cqkkjabq.exeC:\Windows\system32\Cqkkjabq.exe8⤵
- Executes dropped EXE
PID:1700 -
C:\Windows\SysWOW64\Cgecgl32.exeC:\Windows\system32\Cgecgl32.exe9⤵
- Executes dropped EXE
PID:4500 -
C:\Windows\SysWOW64\Cnokcfaj.exeC:\Windows\system32\Cnokcfaj.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4968 -
C:\Windows\SysWOW64\Ccldlm32.exeC:\Windows\system32\Ccldlm32.exe11⤵
- Executes dropped EXE
- Modifies registry class
PID:3808 -
C:\Windows\SysWOW64\Cjflhggo.exeC:\Windows\system32\Cjflhggo.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4892 -
C:\Windows\SysWOW64\Cmdhdbfb.exeC:\Windows\system32\Cmdhdbfb.exe13⤵
- Executes dropped EXE
PID:2444 -
C:\Windows\SysWOW64\Cdkpfpfd.exeC:\Windows\system32\Cdkpfpfd.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4872 -
C:\Windows\SysWOW64\Ckehbj32.exeC:\Windows\system32\Ckehbj32.exe15⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\Cmfejbdp.exeC:\Windows\system32\Cmfejbdp.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2056 -
C:\Windows\SysWOW64\Ccqmglkl.exeC:\Windows\system32\Ccqmglkl.exe17⤵
- Executes dropped EXE
- Modifies registry class
PID:1604 -
C:\Windows\SysWOW64\Djjecf32.exeC:\Windows\system32\Djjecf32.exe18⤵
- Executes dropped EXE
PID:1916 -
C:\Windows\SysWOW64\Dmiapa32.exeC:\Windows\system32\Dmiapa32.exe19⤵PID:3320
-
C:\Windows\SysWOW64\Dccjllij.exeC:\Windows\system32\Dccjllij.exe20⤵PID:3964
-
C:\Windows\SysWOW64\Djmbif32.exeC:\Windows\system32\Djmbif32.exe21⤵
- Modifies registry class
PID:4232 -
C:\Windows\SysWOW64\Dmkoea32.exeC:\Windows\system32\Dmkoea32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:344 -
C:\Windows\SysWOW64\Dcegbk32.exeC:\Windows\system32\Dcegbk32.exe23⤵PID:4436
-
C:\Windows\SysWOW64\Egmbnhec.exeC:\Windows\system32\Egmbnhec.exe24⤵PID:1964
-
C:\Windows\SysWOW64\Emikfocj.exeC:\Windows\system32\Emikfocj.exe25⤵PID:1740
-
C:\Windows\SysWOW64\Eeqbhmdl.exeC:\Windows\system32\Eeqbhmdl.exe26⤵PID:4656
-
C:\Windows\SysWOW64\Egoodhcp.exeC:\Windows\system32\Egoodhcp.exe27⤵
- Drops file in System32 directory
PID:2300 -
C:\Windows\SysWOW64\Ejmkpcbd.exeC:\Windows\system32\Ejmkpcbd.exe28⤵PID:4520
-
C:\Windows\SysWOW64\Emlglo32.exeC:\Windows\system32\Emlglo32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:640 -
C:\Windows\SysWOW64\Ecepiiid.exeC:\Windows\system32\Ecepiiid.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2052 -
C:\Windows\SysWOW64\Elmhjfig.exeC:\Windows\system32\Elmhjfig.exe31⤵PID:2800
-
C:\Windows\SysWOW64\Eaipbmhn.exeC:\Windows\system32\Eaipbmhn.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3712 -
C:\Windows\SysWOW64\Echlniga.exeC:\Windows\system32\Echlniga.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4508 -
C:\Windows\SysWOW64\Flodpfgd.exeC:\Windows\system32\Flodpfgd.exe34⤵PID:4276
-
C:\Windows\SysWOW64\Fnnqla32.exeC:\Windows\system32\Fnnqla32.exe35⤵PID:4996
-
C:\Windows\SysWOW64\Fegihlnd.exeC:\Windows\system32\Fegihlnd.exe36⤵
- Modifies registry class
PID:1904 -
C:\Windows\SysWOW64\Flaaef32.exeC:\Windows\system32\Flaaef32.exe37⤵
- Modifies registry class
PID:608 -
C:\Windows\SysWOW64\Fmbnmnkp.exeC:\Windows\system32\Fmbnmnkp.exe38⤵PID:5112
-
C:\Windows\SysWOW64\Fhhbjgke.exeC:\Windows\system32\Fhhbjgke.exe39⤵PID:1784
-
C:\Windows\SysWOW64\Fjfnfbji.exeC:\Windows\system32\Fjfnfbji.exe40⤵PID:2308
-
C:\Windows\SysWOW64\Faqfclaf.exeC:\Windows\system32\Faqfclaf.exe41⤵PID:4304
-
C:\Windows\SysWOW64\Flfjpeal.exeC:\Windows\system32\Flfjpeal.exe42⤵PID:2104
-
C:\Windows\SysWOW64\Fndglqqp.exeC:\Windows\system32\Fndglqqp.exe43⤵PID:5044
-
C:\Windows\SysWOW64\Facchlpc.exeC:\Windows\system32\Facchlpc.exe44⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3692 -
C:\Windows\SysWOW64\Fhmkef32.exeC:\Windows\system32\Fhmkef32.exe45⤵PID:2352
-
C:\Windows\SysWOW64\Fjkgaa32.exeC:\Windows\system32\Fjkgaa32.exe46⤵PID:1900
-
C:\Windows\SysWOW64\Fmjcmm32.exeC:\Windows\system32\Fmjcmm32.exe47⤵
- Modifies registry class
PID:3996 -
C:\Windows\SysWOW64\Fealojfj.exeC:\Windows\system32\Fealojfj.exe48⤵PID:3264
-
C:\Windows\SysWOW64\Ghohkfen.exeC:\Windows\system32\Ghohkfen.exe49⤵
- Modifies registry class
PID:332 -
C:\Windows\SysWOW64\Gnipgp32.exeC:\Windows\system32\Gnipgp32.exe50⤵
- Drops file in System32 directory
PID:4464 -
C:\Windows\SysWOW64\Gaglck32.exeC:\Windows\system32\Gaglck32.exe51⤵PID:3764
-
C:\Windows\SysWOW64\Gdfipg32.exeC:\Windows\system32\Gdfipg32.exe52⤵PID:5124
-
C:\Windows\SysWOW64\Glmqad32.exeC:\Windows\system32\Glmqad32.exe53⤵PID:5140
-
C:\Windows\SysWOW64\Golmmp32.exeC:\Windows\system32\Golmmp32.exe54⤵PID:5164
-
C:\Windows\SysWOW64\Gajiik32.exeC:\Windows\system32\Gajiik32.exe55⤵
- Drops file in System32 directory
PID:5184 -
C:\Windows\SysWOW64\Gdheefio.exeC:\Windows\system32\Gdheefio.exe56⤵
- Drops file in System32 directory
PID:5208 -
C:\Windows\SysWOW64\Glpmfdia.exeC:\Windows\system32\Glpmfdia.exe57⤵
- Modifies registry class
PID:5244 -
C:\Windows\SysWOW64\Gonibohe.exeC:\Windows\system32\Gonibohe.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5264 -
C:\Windows\SysWOW64\Galfokgi.exeC:\Windows\system32\Galfokgi.exe59⤵
- Modifies registry class
PID:5284 -
C:\Windows\SysWOW64\Gdkbkfgl.exeC:\Windows\system32\Gdkbkfgl.exe60⤵
- Drops file in System32 directory
PID:5312 -
C:\Windows\SysWOW64\Ghfnke32.exeC:\Windows\system32\Ghfnke32.exe61⤵
- Drops file in System32 directory
PID:5336 -
C:\Windows\SysWOW64\Gjdjgp32.exeC:\Windows\system32\Gjdjgp32.exe62⤵PID:5352
-
C:\Windows\SysWOW64\Gmcfcl32.exeC:\Windows\system32\Gmcfcl32.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5380 -
C:\Windows\SysWOW64\Gaobdjef.exeC:\Windows\system32\Gaobdjef.exe64⤵PID:5400
-
C:\Windows\SysWOW64\Ghikadmc.exeC:\Windows\system32\Ghikadmc.exe65⤵
- Drops file in System32 directory
PID:5420 -
C:\Windows\SysWOW64\Gldgac32.exeC:\Windows\system32\Gldgac32.exe66⤵PID:5436
-
C:\Windows\SysWOW64\Gobcno32.exeC:\Windows\system32\Gobcno32.exe67⤵PID:5456
-
C:\Windows\SysWOW64\Hlfcgc32.exeC:\Windows\system32\Hlfcgc32.exe68⤵
- Drops file in System32 directory
PID:5472 -
C:\Windows\SysWOW64\Hmhpokig.exeC:\Windows\system32\Hmhpokig.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5488 -
C:\Windows\SysWOW64\Hdahke32.exeC:\Windows\system32\Hdahke32.exe70⤵PID:5504
-
C:\Windows\SysWOW64\Hlipmbag.exeC:\Windows\system32\Hlipmbag.exe71⤵
- Modifies registry class
PID:5520 -
C:\Windows\SysWOW64\Hoglinpj.exeC:\Windows\system32\Hoglinpj.exe72⤵
- Drops file in System32 directory
PID:5536 -
C:\Windows\SysWOW64\Hafieion.exeC:\Windows\system32\Hafieion.exe73⤵PID:5552
-
C:\Windows\SysWOW64\Hddeaeoa.exeC:\Windows\system32\Hddeaeoa.exe74⤵PID:5568
-
C:\Windows\SysWOW64\Hlkmbbod.exeC:\Windows\system32\Hlkmbbod.exe75⤵PID:5600
-
C:\Windows\SysWOW64\Hmlijj32.exeC:\Windows\system32\Hmlijj32.exe76⤵PID:5636
-
C:\Windows\SysWOW64\Hhbngc32.exeC:\Windows\system32\Hhbngc32.exe77⤵PID:5652
-
C:\Windows\SysWOW64\Holfdm32.exeC:\Windows\system32\Holfdm32.exe78⤵PID:5668
-
C:\Windows\SysWOW64\Hajbpi32.exeC:\Windows\system32\Hajbpi32.exe79⤵PID:5684
-
C:\Windows\SysWOW64\Hdinld32.exeC:\Windows\system32\Hdinld32.exe80⤵
- Modifies registry class
PID:5700 -
C:\Windows\SysWOW64\Hlpfma32.exeC:\Windows\system32\Hlpfma32.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5716 -
C:\Windows\SysWOW64\Honbim32.exeC:\Windows\system32\Honbim32.exe82⤵
- Modifies registry class
PID:5732 -
C:\Windows\SysWOW64\Iehkfgao.exeC:\Windows\system32\Iehkfgao.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5748 -
C:\Windows\SysWOW64\Ihggbbqc.exeC:\Windows\system32\Ihggbbqc.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5764 -
C:\Windows\SysWOW64\Ikecnnpf.exeC:\Windows\system32\Ikecnnpf.exe85⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5780 -
C:\Windows\SysWOW64\Iaokkhgc.exeC:\Windows\system32\Iaokkhgc.exe86⤵PID:5796
-
C:\Windows\SysWOW64\Idmhgcfg.exeC:\Windows\system32\Idmhgcfg.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5812 -
C:\Windows\SysWOW64\Ikgpdn32.exeC:\Windows\system32\Ikgpdn32.exe88⤵
- Drops file in System32 directory
PID:5828 -
C:\Windows\SysWOW64\Iaahqheq.exeC:\Windows\system32\Iaahqheq.exe89⤵PID:5844
-
C:\Windows\SysWOW64\Ihkpma32.exeC:\Windows\system32\Ihkpma32.exe90⤵PID:5860
-
C:\Windows\SysWOW64\Ikjmim32.exeC:\Windows\system32\Ikjmim32.exe91⤵PID:5876
-
C:\Windows\SysWOW64\Inhiei32.exeC:\Windows\system32\Inhiei32.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5892 -
C:\Windows\SysWOW64\Ieoagflg.exeC:\Windows\system32\Ieoagflg.exe93⤵
- Modifies registry class
PID:5912 -
C:\Windows\SysWOW64\Ihnmcakk.exeC:\Windows\system32\Ihnmcakk.exe94⤵PID:5944
-
C:\Windows\SysWOW64\Ikliomjo.exeC:\Windows\system32\Ikliomjo.exe95⤵PID:5964
-
C:\Windows\SysWOW64\Injekhib.exeC:\Windows\system32\Injekhib.exe96⤵PID:5988
-
C:\Windows\SysWOW64\Ieanleid.exeC:\Windows\system32\Ieanleid.exe97⤵
- Drops file in System32 directory
PID:6012 -
C:\Windows\SysWOW64\Ihpjhaih.exeC:\Windows\system32\Ihpjhaih.exe98⤵PID:6036
-
C:\Windows\SysWOW64\Iknfdmhl.exeC:\Windows\system32\Iknfdmhl.exe99⤵PID:6052
-
C:\Windows\SysWOW64\Inmbqhgp.exeC:\Windows\system32\Inmbqhgp.exe100⤵PID:6080
-
C:\Windows\SysWOW64\Jedjbe32.exeC:\Windows\system32\Jedjbe32.exe101⤵PID:6116
-
C:\Windows\SysWOW64\Jhbfnq32.exeC:\Windows\system32\Jhbfnq32.exe102⤵PID:6136
-
C:\Windows\SysWOW64\Jkacjl32.exeC:\Windows\system32\Jkacjl32.exe103⤵PID:5176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Jnoofh32.exeC:\Windows\system32\Jnoofh32.exe1⤵PID:5232
-
C:\Windows\SysWOW64\Jakkgfmf.exeC:\Windows\system32\Jakkgfmf.exe2⤵PID:5304
-
C:\Windows\SysWOW64\Jheccq32.exeC:\Windows\system32\Jheccq32.exe3⤵PID:5388
-
C:\Windows\SysWOW64\Jlpodoml.exeC:\Windows\system32\Jlpodoml.exe4⤵
- Drops file in System32 directory
PID:5904 -
C:\Windows\SysWOW64\Jookpjlp.exeC:\Windows\system32\Jookpjlp.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5952 -
C:\Windows\SysWOW64\Jamhlfkc.exeC:\Windows\system32\Jamhlfkc.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6020 -
C:\Windows\SysWOW64\Jdkdha32.exeC:\Windows\system32\Jdkdha32.exe7⤵PID:6108
-
C:\Windows\SysWOW64\Jkelelad.exeC:\Windows\system32\Jkelelad.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5296 -
C:\Windows\SysWOW64\Japdbe32.exeC:\Windows\system32\Japdbe32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6004 -
C:\Windows\SysWOW64\Jleion32.exeC:\Windows\system32\Jleion32.exe10⤵PID:5148
-
C:\Windows\SysWOW64\Jocekj32.exeC:\Windows\system32\Jocekj32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6160 -
C:\Windows\SysWOW64\Jdpmcq32.exeC:\Windows\system32\Jdpmcq32.exe12⤵PID:6176
-
C:\Windows\SysWOW64\Jkjepk32.exeC:\Windows\system32\Jkjepk32.exe13⤵
- Drops file in System32 directory
PID:6192 -
C:\Windows\SysWOW64\Kadnmeek.exeC:\Windows\system32\Kadnmeek.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6208 -
C:\Windows\SysWOW64\Kklbfj32.exeC:\Windows\system32\Kklbfj32.exe15⤵
- Drops file in System32 directory
PID:6224 -
C:\Windows\SysWOW64\Knkobf32.exeC:\Windows\system32\Knkobf32.exe16⤵PID:6240
-
C:\Windows\SysWOW64\Kfbfcc32.exeC:\Windows\system32\Kfbfcc32.exe17⤵PID:6260
-
C:\Windows\SysWOW64\Lhjeem32.exeC:\Windows\system32\Lhjeem32.exe18⤵PID:6276
-
C:\Windows\SysWOW64\Ldqfjn32.exeC:\Windows\system32\Ldqfjn32.exe19⤵
- Modifies registry class
PID:6292 -
C:\Windows\SysWOW64\Lmhnll32.exeC:\Windows\system32\Lmhnll32.exe20⤵PID:6308
-
C:\Windows\SysWOW64\Lbdgdb32.exeC:\Windows\system32\Lbdgdb32.exe21⤵PID:6332
-
C:\Windows\SysWOW64\Ldccpn32.exeC:\Windows\system32\Ldccpn32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:6352 -
C:\Windows\SysWOW64\Lmjkak32.exeC:\Windows\system32\Lmjkak32.exe23⤵
- Drops file in System32 directory
PID:6376 -
C:\Windows\SysWOW64\Lkmkmhmi.exeC:\Windows\system32\Lkmkmhmi.exe24⤵PID:6416
-
C:\Windows\SysWOW64\Lfbpja32.exeC:\Windows\system32\Lfbpja32.exe25⤵PID:6436
-
C:\Windows\SysWOW64\Ldependj.exeC:\Windows\system32\Ldependj.exe26⤵
- Modifies registry class
PID:6452 -
C:\Windows\SysWOW64\Lmlhgkdl.exeC:\Windows\system32\Lmlhgkdl.exe27⤵PID:6488
-
C:\Windows\SysWOW64\Lnndnc32.exeC:\Windows\system32\Lnndnc32.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6504 -
C:\Windows\SysWOW64\Ldglkmbg.exeC:\Windows\system32\Ldglkmbg.exe29⤵PID:6528
-
C:\Windows\SysWOW64\Lichll32.exeC:\Windows\system32\Lichll32.exe30⤵
- Modifies registry class
PID:6556 -
C:\Windows\SysWOW64\Mkadhg32.exeC:\Windows\system32\Mkadhg32.exe31⤵PID:6576
-
C:\Windows\SysWOW64\Mnpadc32.exeC:\Windows\system32\Mnpadc32.exe32⤵PID:6616
-
C:\Windows\SysWOW64\Mejiqm32.exeC:\Windows\system32\Mejiqm32.exe33⤵PID:6632
-
C:\Windows\SysWOW64\Mmaabj32.exeC:\Windows\system32\Mmaabj32.exe34⤵PID:6652
-
C:\Windows\SysWOW64\Mopmnf32.exeC:\Windows\system32\Mopmnf32.exe35⤵PID:6676
-
C:\Windows\SysWOW64\Mihbgkfk.exeC:\Windows\system32\Mihbgkfk.exe36⤵
- Drops file in System32 directory
PID:6700 -
C:\Windows\SysWOW64\Mnidja32.exeC:\Windows\system32\Mnidja32.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6728 -
C:\Windows\SysWOW64\Meclglhj.exeC:\Windows\system32\Meclglhj.exe38⤵PID:6760
-
C:\Windows\SysWOW64\Nmjdhi32.exeC:\Windows\system32\Nmjdhi32.exe39⤵
- Modifies registry class
PID:6804 -
C:\Windows\SysWOW64\Nnlqpanj.exeC:\Windows\system32\Nnlqpanj.exe40⤵
- Modifies registry class
PID:6836 -
C:\Windows\SysWOW64\Nmmqni32.exeC:\Windows\system32\Nmmqni32.exe41⤵PID:6872
-
C:\Windows\SysWOW64\Nlpaiemd.exeC:\Windows\system32\Nlpaiemd.exe42⤵PID:6888
-
C:\Windows\SysWOW64\Nbjifp32.exeC:\Windows\system32\Nbjifp32.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6912 -
C:\Windows\SysWOW64\Nehebk32.exeC:\Windows\system32\Nehebk32.exe44⤵
- Modifies registry class
PID:6936 -
C:\Windows\SysWOW64\Nmomchdg.exeC:\Windows\system32\Nmomchdg.exe45⤵PID:6948
-
C:\Windows\SysWOW64\Npnjodcj.exeC:\Windows\system32\Npnjodcj.exe46⤵
- Drops file in System32 directory
PID:6968 -
C:\Windows\SysWOW64\Nmajihbd.exeC:\Windows\system32\Nmajihbd.exe47⤵PID:6988
-
C:\Windows\SysWOW64\Nppfecah.exeC:\Windows\system32\Nppfecah.exe48⤵PID:7008
-
C:\Windows\SysWOW64\Nbnbaoqk.exeC:\Windows\system32\Nbnbaoqk.exe49⤵PID:7024
-
C:\Windows\SysWOW64\Nihkni32.exeC:\Windows\system32\Nihkni32.exe50⤵PID:7040
-
C:\Windows\SysWOW64\Npbcjc32.exeC:\Windows\system32\Npbcjc32.exe51⤵PID:7056
-
C:\Windows\SysWOW64\Nbqofo32.exeC:\Windows\system32\Nbqofo32.exe52⤵PID:7076
-
C:\Windows\SysWOW64\Neokbj32.exeC:\Windows\system32\Neokbj32.exe53⤵PID:6148
-
C:\Windows\SysWOW64\Oeahhj32.exeC:\Windows\system32\Oeahhj32.exe54⤵PID:3800
-
C:\Windows\SysWOW64\Omhpig32.exeC:\Windows\system32\Omhpig32.exe55⤵PID:2044
-
C:\Windows\SysWOW64\Opglebkp.exeC:\Windows\system32\Opglebkp.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4808 -
C:\Windows\SysWOW64\Onjmao32.exeC:\Windows\system32\Onjmao32.exe57⤵PID:6364
-
C:\Windows\SysWOW64\Ofaebm32.exeC:\Windows\system32\Ofaebm32.exe58⤵PID:6408
-
C:\Windows\SysWOW64\Oioanh32.exeC:\Windows\system32\Oioanh32.exe59⤵
- Drops file in System32 directory
- Modifies registry class
PID:6468 -
C:\Windows\SysWOW64\Olnmjc32.exeC:\Windows\system32\Olnmjc32.exe60⤵PID:6520
-
C:\Windows\SysWOW64\Obhegnhq.exeC:\Windows\system32\Obhegnhq.exe61⤵PID:6604
-
C:\Windows\SysWOW64\Ommjdfhg.exeC:\Windows\system32\Ommjdfhg.exe62⤵PID:6664
-
C:\Windows\SysWOW64\Oplfqbgj.exeC:\Windows\system32\Oplfqbgj.exe63⤵PID:7092
-
C:\Windows\SysWOW64\Oehnii32.exeC:\Windows\system32\Oehnii32.exe64⤵PID:7112
-
C:\Windows\SysWOW64\Oidjignk.exeC:\Windows\system32\Oidjignk.exe65⤵PID:7128
-
C:\Windows\SysWOW64\Opnbfa32.exeC:\Windows\system32\Opnbfa32.exe66⤵PID:7144
-
C:\Windows\SysWOW64\Ooqcanlb.exeC:\Windows\system32\Ooqcanlb.exe67⤵PID:7164
-
C:\Windows\SysWOW64\Oekknh32.exeC:\Windows\system32\Oekknh32.exe68⤵
- Drops file in System32 directory
PID:1484 -
C:\Windows\SysWOW64\Pleckbkl.exeC:\Windows\system32\Pleckbkl.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6444 -
C:\Windows\SysWOW64\Pocpgnjp.exeC:\Windows\system32\Pocpgnjp.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6612 -
C:\Windows\SysWOW64\Pemhdhal.exeC:\Windows\system32\Pemhdhal.exe71⤵
- Modifies registry class
PID:7184 -
C:\Windows\SysWOW64\Pmdpeebo.exeC:\Windows\system32\Pmdpeebo.exe72⤵
- Drops file in System32 directory
PID:7200 -
C:\Windows\SysWOW64\Poelmn32.exeC:\Windows\system32\Poelmn32.exe73⤵
- Drops file in System32 directory
PID:7216 -
C:\Windows\SysWOW64\Pbahmlpf.exeC:\Windows\system32\Pbahmlpf.exe74⤵
- Drops file in System32 directory
- Modifies registry class
PID:7228 -
C:\Windows\SysWOW64\Pepdihoj.exeC:\Windows\system32\Pepdihoj.exe75⤵
- Modifies registry class
PID:7248 -
C:\Windows\SysWOW64\Ppeigqop.exeC:\Windows\system32\Ppeigqop.exe76⤵PID:7264
-
C:\Windows\SysWOW64\Pbceclnc.exeC:\Windows\system32\Pbceclnc.exe77⤵PID:7384
-
C:\Windows\SysWOW64\Aofeckjj.exeC:\Windows\system32\Aofeckjj.exe78⤵
- Drops file in System32 directory
PID:7404 -
C:\Windows\SysWOW64\Aikiadip.exeC:\Windows\system32\Aikiadip.exe79⤵PID:7420
-
C:\Windows\SysWOW64\Apeannam.exeC:\Windows\system32\Apeannam.exe80⤵
- Drops file in System32 directory
PID:7436 -
C:\Windows\SysWOW64\Agojjh32.exeC:\Windows\system32\Agojjh32.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7456 -
C:\Windows\SysWOW64\Ainffd32.exeC:\Windows\system32\Ainffd32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:7484 -
C:\Windows\SysWOW64\Aphncnoj.exeC:\Windows\system32\Aphncnoj.exe83⤵PID:7504
-
C:\Windows\SysWOW64\Aokook32.exeC:\Windows\system32\Aokook32.exe84⤵
- Modifies registry class
PID:7520 -
C:\Windows\SysWOW64\Aedgkema.exeC:\Windows\system32\Aedgkema.exe85⤵PID:7536
-
C:\Windows\SysWOW64\Amlombnd.exeC:\Windows\system32\Amlombnd.exe86⤵PID:7552
-
C:\Windows\SysWOW64\Bchgei32.exeC:\Windows\system32\Bchgei32.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7568 -
C:\Windows\SysWOW64\Bibpacch.exeC:\Windows\system32\Bibpacch.exe88⤵
- Drops file in System32 directory
PID:7584 -
C:\Windows\SysWOW64\Bgfpkgbb.exeC:\Windows\system32\Bgfpkgbb.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:7600 -
C:\Windows\SysWOW64\Bnphha32.exeC:\Windows\system32\Bnphha32.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7616 -
C:\Windows\SysWOW64\Bcmqphhf.exeC:\Windows\system32\Bcmqphhf.exe91⤵PID:7632
-
C:\Windows\SysWOW64\Belmldgj.exeC:\Windows\system32\Belmldgj.exe92⤵PID:7648
-
C:\Windows\SysWOW64\Benjaceg.exeC:\Windows\system32\Benjaceg.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7664 -
C:\Windows\SysWOW64\Bpcnoldm.exeC:\Windows\system32\Bpcnoldm.exe94⤵
- Drops file in System32 directory
PID:7680 -
C:\Windows\SysWOW64\Bcbjkhdq.exeC:\Windows\system32\Bcbjkhdq.exe95⤵PID:7728
-
C:\Windows\SysWOW64\Bjlbhbkn.exeC:\Windows\system32\Bjlbhbkn.exe96⤵
- Modifies registry class
PID:7748 -
C:\Windows\SysWOW64\Bljodmja.exeC:\Windows\system32\Bljodmja.exe97⤵PID:7768
-
C:\Windows\SysWOW64\Ccdgqg32.exeC:\Windows\system32\Ccdgqg32.exe98⤵PID:7788
-
C:\Windows\SysWOW64\Cebcmc32.exeC:\Windows\system32\Cebcmc32.exe99⤵PID:7808
-
C:\Windows\SysWOW64\Cnjknp32.exeC:\Windows\system32\Cnjknp32.exe100⤵PID:7828
-
C:\Windows\SysWOW64\Ccfcfg32.exeC:\Windows\system32\Ccfcfg32.exe101⤵
- Modifies registry class
PID:7852 -
C:\Windows\SysWOW64\Cpjdpkoe.exeC:\Windows\system32\Cpjdpkoe.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7872 -
C:\Windows\SysWOW64\Cfgmhbml.exeC:\Windows\system32\Cfgmhbml.exe103⤵PID:7892
-
C:\Windows\SysWOW64\Cpmqekmb.exeC:\Windows\system32\Cpmqekmb.exe104⤵PID:7916
-
C:\Windows\SysWOW64\Cobnfgaj.exeC:\Windows\system32\Cobnfgaj.exe105⤵
- Modifies registry class
PID:7936 -
C:\Windows\SysWOW64\Cflfca32.exeC:\Windows\system32\Cflfca32.exe106⤵PID:7952
-
C:\Windows\SysWOW64\Cncndo32.exeC:\Windows\system32\Cncndo32.exe107⤵PID:7972
-
C:\Windows\SysWOW64\Cqajpj32.exeC:\Windows\system32\Cqajpj32.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7988 -
C:\Windows\SysWOW64\Dqdgfjfj.exeC:\Windows\system32\Dqdgfjfj.exe109⤵
- Drops file in System32 directory
- Modifies registry class
PID:8004 -
C:\Windows\SysWOW64\Dcbcbeen.exeC:\Windows\system32\Dcbcbeen.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8020 -
C:\Windows\SysWOW64\Dnhgoned.exeC:\Windows\system32\Dnhgoned.exe111⤵PID:8036
-
C:\Windows\SysWOW64\Dcdpgeck.exeC:\Windows\system32\Dcdpgeck.exe112⤵
- Modifies registry class
PID:8060 -
C:\Windows\SysWOW64\Dfclcqbo.exeC:\Windows\system32\Dfclcqbo.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8076 -
C:\Windows\SysWOW64\Dnjdenca.exeC:\Windows\system32\Dnjdenca.exe114⤵PID:8092
-
C:\Windows\SysWOW64\Dokqlfip.exeC:\Windows\system32\Dokqlfip.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8108 -
C:\Windows\SysWOW64\Donmbfgm.exeC:\Windows\system32\Donmbfgm.exe116⤵PID:8124
-
C:\Windows\SysWOW64\Dfheop32.exeC:\Windows\system32\Dfheop32.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8140 -
C:\Windows\SysWOW64\Eopjge32.exeC:\Windows\system32\Eopjge32.exe118⤵PID:8156
-
C:\Windows\SysWOW64\Efjbdpmg.exeC:\Windows\system32\Efjbdpmg.exe119⤵PID:8172
-
C:\Windows\SysWOW64\Enajemmi.exeC:\Windows\system32\Enajemmi.exe120⤵PID:8184
-
C:\Windows\SysWOW64\Emdjaj32.exeC:\Windows\system32\Emdjaj32.exe121⤵
- Modifies registry class
PID:7292 -
C:\Windows\SysWOW64\Eobgme32.exeC:\Windows\system32\Eobgme32.exe122⤵PID:7316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-