Analysis
-
max time kernel
189s -
max time network
230s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:46
Static task
static1
Behavioral task
behavioral1
Sample
ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea.exe
Resource
win10v2004-20220812-en
General
-
Target
ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea.exe
-
Size
43KB
-
MD5
73cb1fe83ef1db409a7eb16b87bd81fa
-
SHA1
1f8c16c109b245da9c551ba8b524ba24d1e57648
-
SHA256
ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea
-
SHA512
fc45d94c0c536dd9968ca27d74385bf8372c64f81dcf51b78196519d77c5a00228c379eafcdd5f5b527e8375e571626879c4ba6905497717ca0b00b3c3609d3a
-
SSDEEP
768:3PJadenAqtYQnaXH96rV2kllriFqR7Atmqfvfj7sMC72ZWzFwKF/KpplA:3PnAClrVLTrEqNAxvXsf7rzV/KpXA
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exepid process 936 123nguoidu.exe 684 123nguoidu.exe 1084 123nguoidu.exe 600 123nguoidu.exe 1756 123nguoidu.exe 1636 123nguoidu.exe 1052 123nguoidu.exe 1912 123nguoidu.exe 1420 123nguoidu.exe 852 123nguoidu.exe 1736 123nguoidu.exe 1380 123nguoidu.exe 960 123nguoidu.exe 1612 123nguoidu.exe 1532 123nguoidu.exe 1216 123nguoidu.exe 1720 123nguoidu.exe 1672 123nguoidu.exe 1600 123nguoidu.exe 1620 123nguoidu.exe 924 123nguoidu.exe 1752 123nguoidu.exe 1928 123nguoidu.exe 1844 123nguoidu.exe 968 123nguoidu.exe 2024 123nguoidu.exe 1864 123nguoidu.exe 840 123nguoidu.exe 1980 123nguoidu.exe 1744 123nguoidu.exe 1984 123nguoidu.exe 1008 123nguoidu.exe 1504 123nguoidu.exe 1208 123nguoidu.exe 1568 123nguoidu.exe 1888 123nguoidu.exe 1592 123nguoidu.exe 760 123nguoidu.exe 1860 123nguoidu.exe 1300 123nguoidu.exe 1284 123nguoidu.exe 1652 123nguoidu.exe 1872 123nguoidu.exe 1996 123nguoidu.exe 1220 123nguoidu.exe 1376 123nguoidu.exe 536 123nguoidu.exe 1168 123nguoidu.exe 1164 123nguoidu.exe 896 123nguoidu.exe 468 123nguoidu.exe 2056 123nguoidu.exe 2076 123nguoidu.exe 2096 123nguoidu.exe 2116 123nguoidu.exe 2136 123nguoidu.exe 2156 123nguoidu.exe 2176 123nguoidu.exe 2220 123nguoidu.exe 2252 123nguoidu.exe 2272 123nguoidu.exe 2292 123nguoidu.exe 2312 123nguoidu.exe 2332 123nguoidu.exe -
Loads dropped DLL 64 IoCs
Processes:
ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exepid process 952 ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea.exe 952 ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea.exe 936 123nguoidu.exe 936 123nguoidu.exe 684 123nguoidu.exe 684 123nguoidu.exe 1084 123nguoidu.exe 1084 123nguoidu.exe 600 123nguoidu.exe 600 123nguoidu.exe 1756 123nguoidu.exe 1756 123nguoidu.exe 1636 123nguoidu.exe 1636 123nguoidu.exe 1052 123nguoidu.exe 1052 123nguoidu.exe 1912 123nguoidu.exe 1912 123nguoidu.exe 1420 123nguoidu.exe 1420 123nguoidu.exe 852 123nguoidu.exe 852 123nguoidu.exe 1736 123nguoidu.exe 1736 123nguoidu.exe 1380 123nguoidu.exe 1380 123nguoidu.exe 960 123nguoidu.exe 960 123nguoidu.exe 1612 123nguoidu.exe 1612 123nguoidu.exe 1532 123nguoidu.exe 1532 123nguoidu.exe 1216 123nguoidu.exe 1216 123nguoidu.exe 1720 123nguoidu.exe 1720 123nguoidu.exe 1672 123nguoidu.exe 1672 123nguoidu.exe 1600 123nguoidu.exe 1600 123nguoidu.exe 1620 123nguoidu.exe 1620 123nguoidu.exe 924 123nguoidu.exe 924 123nguoidu.exe 1752 123nguoidu.exe 1752 123nguoidu.exe 1928 123nguoidu.exe 1928 123nguoidu.exe 1844 123nguoidu.exe 1844 123nguoidu.exe 968 123nguoidu.exe 968 123nguoidu.exe 2024 123nguoidu.exe 2024 123nguoidu.exe 1864 123nguoidu.exe 1864 123nguoidu.exe 840 123nguoidu.exe 840 123nguoidu.exe 1980 123nguoidu.exe 1980 123nguoidu.exe 1744 123nguoidu.exe 1744 123nguoidu.exe 1984 123nguoidu.exe 1984 123nguoidu.exe -
Adds Run key to start application 2 TTPs 64 IoCs
Processes:
123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\123nguoidu = "C:\\Windows\\system32\\123nguoidu.exe" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 123nguoidu.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies WinLogon 2 TTPs 64 IoCs
Processes:
123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Shutdown = "WLEShutdown" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Logoff = "WLELogoff" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Lock = "WLELock" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Unlock = "WLEUnlock" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Logon = "WLELogon" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\StartScreenSaver = "WLEStartScreenSaver" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\DllName = "123nguoidu.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Shutdown = "WLEShutdown" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Logoff = "WLELogoff" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\StopScreenSaver = "WLEStopScreenSaver" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Lock = "WLELock" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Lock = "WLELock" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Asynchronous = "0" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Logon = "WLELogon" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Shutdown = "WLEShutdown" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Unlock = "WLEUnlock" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Logoff = "WLELogoff" 123nguoidu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Asynchronous = "0" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Unlock = "WLEUnlock" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Shutdown = "WLEShutdown" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\DllName = "123nguoidu.dll" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Shutdown = "WLEShutdown" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Startup = "WLEStartup" 123nguoidu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Asynchronous = "0" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Shutdown = "WLEShutdown" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\StopScreenSaver = "WLEStopScreenSaver" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Shutdown = "WLEShutdown" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Logon = "WLELogon" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Logoff = "WLELogoff" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Lock = "WLELock" 123nguoidu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Asynchronous = "0" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Logon = "WLELogon" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Logoff = "WLELogoff" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Lock = "WLELock" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Shutdown = "WLEShutdown" 123nguoidu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Asynchronous = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Asynchronous = "0" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\StartScreenSaver = "WLEStartScreenSaver" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\StartScreenSaver = "WLEStartScreenSaver" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Startup = "WLEStartup" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Unlock = "WLEUnlock" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\StopScreenSaver = "WLEStopScreenSaver" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\StopScreenSaver = "WLEStopScreenSaver" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Shutdown = "WLEShutdown" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Startup = "WLEStartup" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Logon = "WLELogon" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Lock = "WLELock" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\DllName = "123nguoidu.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Startup = "WLEStartup" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Lock = "WLELock" 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Lock = "WLELock" 123nguoidu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Impersonate = "0" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\DllName = "123nguoidu.dll" 123nguoidu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu 123nguoidu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\123nguoidu\Lock = "WLELock" 123nguoidu.exe -
Drops file in System32 directory 64 IoCs
Processes:
123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exedescription ioc process File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe 123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe File created C:\Windows\SysWOW64\123nguoidu.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exe123nguoidu.exedescription pid process target process PID 952 wrote to memory of 936 952 ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea.exe 123nguoidu.exe PID 952 wrote to memory of 936 952 ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea.exe 123nguoidu.exe PID 952 wrote to memory of 936 952 ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea.exe 123nguoidu.exe PID 952 wrote to memory of 936 952 ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea.exe 123nguoidu.exe PID 936 wrote to memory of 684 936 123nguoidu.exe 123nguoidu.exe PID 936 wrote to memory of 684 936 123nguoidu.exe 123nguoidu.exe PID 936 wrote to memory of 684 936 123nguoidu.exe 123nguoidu.exe PID 936 wrote to memory of 684 936 123nguoidu.exe 123nguoidu.exe PID 684 wrote to memory of 1084 684 123nguoidu.exe 123nguoidu.exe PID 684 wrote to memory of 1084 684 123nguoidu.exe 123nguoidu.exe PID 684 wrote to memory of 1084 684 123nguoidu.exe 123nguoidu.exe PID 684 wrote to memory of 1084 684 123nguoidu.exe 123nguoidu.exe PID 1084 wrote to memory of 600 1084 123nguoidu.exe 123nguoidu.exe PID 1084 wrote to memory of 600 1084 123nguoidu.exe 123nguoidu.exe PID 1084 wrote to memory of 600 1084 123nguoidu.exe 123nguoidu.exe PID 1084 wrote to memory of 600 1084 123nguoidu.exe 123nguoidu.exe PID 600 wrote to memory of 1756 600 123nguoidu.exe 123nguoidu.exe PID 600 wrote to memory of 1756 600 123nguoidu.exe 123nguoidu.exe PID 600 wrote to memory of 1756 600 123nguoidu.exe 123nguoidu.exe PID 600 wrote to memory of 1756 600 123nguoidu.exe 123nguoidu.exe PID 1756 wrote to memory of 1636 1756 123nguoidu.exe 123nguoidu.exe PID 1756 wrote to memory of 1636 1756 123nguoidu.exe 123nguoidu.exe PID 1756 wrote to memory of 1636 1756 123nguoidu.exe 123nguoidu.exe PID 1756 wrote to memory of 1636 1756 123nguoidu.exe 123nguoidu.exe PID 1636 wrote to memory of 1052 1636 123nguoidu.exe 123nguoidu.exe PID 1636 wrote to memory of 1052 1636 123nguoidu.exe 123nguoidu.exe PID 1636 wrote to memory of 1052 1636 123nguoidu.exe 123nguoidu.exe PID 1636 wrote to memory of 1052 1636 123nguoidu.exe 123nguoidu.exe PID 1052 wrote to memory of 1912 1052 123nguoidu.exe 123nguoidu.exe PID 1052 wrote to memory of 1912 1052 123nguoidu.exe 123nguoidu.exe PID 1052 wrote to memory of 1912 1052 123nguoidu.exe 123nguoidu.exe PID 1052 wrote to memory of 1912 1052 123nguoidu.exe 123nguoidu.exe PID 1912 wrote to memory of 1420 1912 123nguoidu.exe 123nguoidu.exe PID 1912 wrote to memory of 1420 1912 123nguoidu.exe 123nguoidu.exe PID 1912 wrote to memory of 1420 1912 123nguoidu.exe 123nguoidu.exe PID 1912 wrote to memory of 1420 1912 123nguoidu.exe 123nguoidu.exe PID 1420 wrote to memory of 852 1420 123nguoidu.exe 123nguoidu.exe PID 1420 wrote to memory of 852 1420 123nguoidu.exe 123nguoidu.exe PID 1420 wrote to memory of 852 1420 123nguoidu.exe 123nguoidu.exe PID 1420 wrote to memory of 852 1420 123nguoidu.exe 123nguoidu.exe PID 852 wrote to memory of 1736 852 123nguoidu.exe 123nguoidu.exe PID 852 wrote to memory of 1736 852 123nguoidu.exe 123nguoidu.exe PID 852 wrote to memory of 1736 852 123nguoidu.exe 123nguoidu.exe PID 852 wrote to memory of 1736 852 123nguoidu.exe 123nguoidu.exe PID 1736 wrote to memory of 1380 1736 123nguoidu.exe 123nguoidu.exe PID 1736 wrote to memory of 1380 1736 123nguoidu.exe 123nguoidu.exe PID 1736 wrote to memory of 1380 1736 123nguoidu.exe 123nguoidu.exe PID 1736 wrote to memory of 1380 1736 123nguoidu.exe 123nguoidu.exe PID 1380 wrote to memory of 960 1380 123nguoidu.exe 123nguoidu.exe PID 1380 wrote to memory of 960 1380 123nguoidu.exe 123nguoidu.exe PID 1380 wrote to memory of 960 1380 123nguoidu.exe 123nguoidu.exe PID 1380 wrote to memory of 960 1380 123nguoidu.exe 123nguoidu.exe PID 960 wrote to memory of 1612 960 123nguoidu.exe 123nguoidu.exe PID 960 wrote to memory of 1612 960 123nguoidu.exe 123nguoidu.exe PID 960 wrote to memory of 1612 960 123nguoidu.exe 123nguoidu.exe PID 960 wrote to memory of 1612 960 123nguoidu.exe 123nguoidu.exe PID 1612 wrote to memory of 1532 1612 123nguoidu.exe 123nguoidu.exe PID 1612 wrote to memory of 1532 1612 123nguoidu.exe 123nguoidu.exe PID 1612 wrote to memory of 1532 1612 123nguoidu.exe 123nguoidu.exe PID 1612 wrote to memory of 1532 1612 123nguoidu.exe 123nguoidu.exe PID 1532 wrote to memory of 1216 1532 123nguoidu.exe 123nguoidu.exe PID 1532 wrote to memory of 1216 1532 123nguoidu.exe 123nguoidu.exe PID 1532 wrote to memory of 1216 1532 123nguoidu.exe 123nguoidu.exe PID 1532 wrote to memory of 1216 1532 123nguoidu.exe 123nguoidu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea.exe"C:\Users\Admin\AppData\Local\Temp\ef4a8006b395b71c81f48b62e403007cefe4e71efcd95d25d8b485066412c9ea.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe33⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe34⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe35⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe36⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe37⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe38⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe39⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe40⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe41⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe42⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe43⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe44⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe45⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe46⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe47⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe48⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe49⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe50⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe51⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe52⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe53⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe54⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe55⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe56⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe58⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe59⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe60⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe61⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe62⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe63⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe64⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe66⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe67⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe68⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe69⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe70⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe71⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe72⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe73⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe74⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe75⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe76⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe77⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe78⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe79⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe80⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe81⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe82⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe83⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe84⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe85⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe86⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe87⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe88⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe89⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe90⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe91⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe92⤵
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe93⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe94⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe95⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe96⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe97⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe98⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe99⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe100⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe101⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe102⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe103⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe104⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe105⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe106⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe107⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe108⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe109⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe110⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe111⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe112⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe113⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe114⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe115⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe116⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe117⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe118⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe119⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe120⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe121⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe122⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe123⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe124⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe125⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe126⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe127⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe128⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe129⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe130⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe131⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe132⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe133⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe134⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe135⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe136⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe137⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe138⤵
- Modifies WinLogon
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe139⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe140⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe141⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe142⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe143⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe144⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe145⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe146⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe147⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe148⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe149⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe150⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe151⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe152⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe153⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe154⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe155⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe156⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe157⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe158⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe159⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe160⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe161⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe162⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe163⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe164⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe165⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe166⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe167⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe168⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe169⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe170⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe171⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe172⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe173⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe174⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe175⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe176⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe177⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe178⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe179⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe180⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe181⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe182⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe183⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe184⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe185⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe186⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe187⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe188⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe189⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe190⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe191⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe192⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe193⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe194⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe195⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe196⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe197⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe198⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe199⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe200⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe201⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe202⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe203⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe204⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe205⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe206⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe207⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe208⤵
- Modifies WinLogon
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe209⤵
- Modifies WinLogon
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe210⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe211⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe212⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe213⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe214⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe215⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe216⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe217⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe218⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe219⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe220⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe221⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe222⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe223⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe224⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe225⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe226⤵
- Modifies WinLogon
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe227⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe228⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe229⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe230⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe231⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe232⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe233⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe234⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe235⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe236⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe237⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe238⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe239⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe240⤵
-
C:\Windows\SysWOW64\123nguoidu.exeC:\Windows\system32\123nguoidu.exe241⤵