Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
195s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2023, 20:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.d0e1098c260f6262978992c0b7e05a90.exe
Resource
win7-20230831-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.d0e1098c260f6262978992c0b7e05a90.exe
Resource
win10v2004-20230915-en
5 signatures
150 seconds
General
-
Target
NEAS.d0e1098c260f6262978992c0b7e05a90.exe
-
Size
181KB
-
MD5
d0e1098c260f6262978992c0b7e05a90
-
SHA1
714dcff87f863c2d7b880ebbc00a382567ee5d92
-
SHA256
2e85ef855827e3284766493330337db695ce61330fbb3d71d744a61ab0175a26
-
SHA512
d7484539ad91485e99f6a305d10632bf7131e3af402fc332fce0dbce828972492bc1166f3e3c987889c34c2647fa378eda3cc5bdf4d111aaa8c21a34eed3cec3
-
SSDEEP
3072:uaP6euhIGb90fqCDrFDHZtOg04UxSl4uO0JGDrFDHZtOg:uaye3GbmfqK5tTh7G0JW5tT
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Adpogp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Flfjdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" NEAS.d0e1098c260f6262978992c0b7e05a90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kagbdenk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ainfpi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Galonj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oeloebcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bdndik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eilomd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ekaaio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pohdamqh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dipgik32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eleiffho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Onnmmipj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iomood32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igcgpalj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gdkbdllj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bplhhc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njkklk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fldnoo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gfcebf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cmkjcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcjhhq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldfoad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pekkhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fmdcamko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aolbedeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Clplff32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfnccg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Menimfnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cfipol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gmmmoppl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmbhhkoa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Moalil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fjikeg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghohdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Blchmdff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hplbbipm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jlgeig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kkbkmqed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cgbppknb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hebcjdkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mijofaje.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfbcfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jnnnfalp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kajfdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Akenij32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gaglma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Melfpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Comddn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Galonj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gifjjacn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkbkmqed.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Piaiqlak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cokgonmp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nclida32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hlnjlkjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kdffjgpj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcabej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nifnao32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahbjij32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfoeqb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dllfpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aqfolqna.exe -
Executes dropped EXE 64 IoCs
pid Process 3712 Nbphglbe.exe 3600 Nodiqp32.exe 3836 Nofefp32.exe 5084 Haidfpki.exe 1020 Iapjgo32.exe 1612 Iecmhlhb.exe 1156 Jnnnfalp.exe 4624 Jaqcnl32.exe 3324 Jjihfbno.exe 2840 Jbbmmo32.exe 4520 Jlkafdco.exe 2976 Kdffjgpj.exe 4804 Kajfdk32.exe 2068 Kkbkmqed.exe 3456 Klbgfc32.exe 3228 Kejloi32.exe 2204 Kdpiqehp.exe 2240 Ldbefe32.exe 4232 Logicn32.exe 3832 Lknjhokg.exe 3892 Ldfoad32.exe 216 Lefkkg32.exe 4472 Lehhqg32.exe 4912 Moalil32.exe 2692 Mekdffee.exe 2828 Mhknhabf.exe 880 Mcabej32.exe 2236 Mlifnphl.exe 5104 Mebkge32.exe 2792 Mojopk32.exe 2192 Nlnpio32.exe 4432 Ndidna32.exe 1396 Namegfql.exe 1052 Ncmaai32.exe 3808 Nconfh32.exe 5088 Odljjo32.exe 4640 Pdngpo32.exe 2876 Pmjhlklg.exe 2212 Piaiqlak.exe 4420 Pfeijqqe.exe 4504 Qkdohg32.exe 2712 Qkfkng32.exe 668 Aijlgkjq.exe 3976 Afqifo32.exe 4980 Beaecjab.exe 4368 Clbdpc32.exe 2832 Cdjlap32.exe 1372 Kagbdenk.exe 2704 Bbbblhnc.exe 3956 Lpghfi32.exe 2460 Qnamofdf.exe 1424 Akenij32.exe 2364 Ancjef32.exe 2664 Ahinbo32.exe 1440 Akgjnj32.exe 4596 Adpogp32.exe 1028 Ajmgof32.exe 3044 Aqfolqna.exe 1432 Aklciimh.exe 2088 Kmaooihb.exe 4276 Lopkkdgf.exe 884 Ljephmgl.exe 5048 Lkflpe32.exe 4600 Fagcfc32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Fldnoo32.exe Fejebdig.exe File created C:\Windows\SysWOW64\Micheb32.exe Mokdllim.exe File created C:\Windows\SysWOW64\Apeagd32.exe Agmmnnpj.exe File opened for modification C:\Windows\SysWOW64\Omcjne32.exe Oegejc32.exe File created C:\Windows\SysWOW64\Lidqbadl.dll Jpqedfne.exe File opened for modification C:\Windows\SysWOW64\Pohdamqh.exe Pmjheaad.exe File created C:\Windows\SysWOW64\Ncmoej32.dll Lnfngj32.exe File created C:\Windows\SysWOW64\Aggempll.dll Beippj32.exe File opened for modification C:\Windows\SysWOW64\Aachaa32.exe Akipdg32.exe File opened for modification C:\Windows\SysWOW64\Gfeahffl.exe Gmmmoppl.exe File opened for modification C:\Windows\SysWOW64\Hmhmko32.exe Headjael.exe File created C:\Windows\SysWOW64\Mbdpdane.dll Lefkkg32.exe File created C:\Windows\SysWOW64\Fiodib32.exe Fbellhbi.exe File opened for modification C:\Windows\SysWOW64\Iomood32.exe Iipfgm32.exe File created C:\Windows\SysWOW64\Cnjambdq.dll Pekkhn32.exe File created C:\Windows\SysWOW64\Ocmchdmh.exe Kdllhdco.exe File created C:\Windows\SysWOW64\Bkeppeii.exe Anaofa32.exe File opened for modification C:\Windows\SysWOW64\Dkahba32.exe Dnkkcmdb.exe File created C:\Windows\SysWOW64\Iapjgo32.exe Haidfpki.exe File created C:\Windows\SysWOW64\Odljjo32.exe Nconfh32.exe File created C:\Windows\SysWOW64\Klnkoc32.exe Khlinedh.exe File created C:\Windows\SysWOW64\Appcqpob.dll Kedcml32.exe File opened for modification C:\Windows\SysWOW64\Jjihfbno.exe Jaqcnl32.exe File created C:\Windows\SysWOW64\Ngllodpm.dll Beaecjab.exe File opened for modification C:\Windows\SysWOW64\Bjgifhep.exe Blchmdff.exe File created C:\Windows\SysWOW64\Addabl32.exe Aogije32.exe File created C:\Windows\SysWOW64\Jaqcnl32.exe Jnnnfalp.exe File created C:\Windows\SysWOW64\Gdfmgqph.dll Afqifo32.exe File opened for modification C:\Windows\SysWOW64\Mabnlh32.exe Mqpqghgn.exe File created C:\Windows\SysWOW64\Oajmdd32.exe Onkphi32.exe File opened for modification C:\Windows\SysWOW64\Clnopg32.exe Bohbackj.exe File opened for modification C:\Windows\SysWOW64\Cffcilob.exe Cnokhonp.exe File created C:\Windows\SysWOW64\Mjjnen32.dll Gifjjacn.exe File created C:\Windows\SysWOW64\Efdlca32.dll Aapnfe32.exe File opened for modification C:\Windows\SysWOW64\Ghdaokfe.exe Gmnmbbgp.exe File created C:\Windows\SysWOW64\Aplgij32.dll Gmnmbbgp.exe File created C:\Windows\SysWOW64\Cdhcea32.dll Dnekcd32.exe File created C:\Windows\SysWOW64\Bpbpoi32.exe Bihhbocn.exe File created C:\Windows\SysWOW64\Kdllhdco.exe Majoikof.exe File created C:\Windows\SysWOW64\Pkacebhg.dll Omcjne32.exe File created C:\Windows\SysWOW64\Pmjheaad.exe Pecpddab.exe File created C:\Windows\SysWOW64\Gaepgacn.exe Gngckfdj.exe File created C:\Windows\SysWOW64\Lnbdlkje.exe Llqhdb32.exe File opened for modification C:\Windows\SysWOW64\Nclida32.exe Nladpo32.exe File opened for modification C:\Windows\SysWOW64\Kedcml32.exe Jgoflpal.exe File created C:\Windows\SysWOW64\Aklciimh.exe Aqfolqna.exe File opened for modification C:\Windows\SysWOW64\Llqhdb32.exe Kffphhmj.exe File created C:\Windows\SysWOW64\Clgbfe32.exe Cfipol32.exe File opened for modification C:\Windows\SysWOW64\Klnkoc32.exe Khlinedh.exe File created C:\Windows\SysWOW64\Gdphod32.dll Gpcmagpo.exe File created C:\Windows\SysWOW64\Mogjpn32.dll Mqpqghgn.exe File created C:\Windows\SysWOW64\Glbjpmdd.exe Gicndaep.exe File created C:\Windows\SysWOW64\Ldbefe32.exe Kdpiqehp.exe File opened for modification C:\Windows\SysWOW64\Namegfql.exe Ndidna32.exe File created C:\Windows\SysWOW64\Aochpj32.dll Aklciimh.exe File opened for modification C:\Windows\SysWOW64\Nodiqp32.exe Nbphglbe.exe File created C:\Windows\SysWOW64\Bnmpgabd.dll Hmbpbk32.exe File created C:\Windows\SysWOW64\Pahiebeq.exe Peahpa32.exe File opened for modification C:\Windows\SysWOW64\Ldnjndpo.exe Lhgiic32.exe File created C:\Windows\SysWOW64\Heefek32.dll Pbokab32.exe File created C:\Windows\SysWOW64\Pfoamp32.exe Plimpg32.exe File opened for modification C:\Windows\SysWOW64\Comddn32.exe Cgbppknb.exe File created C:\Windows\SysWOW64\Iigkkjhk.dll Kdllhdco.exe File created C:\Windows\SysWOW64\Palbpb32.exe Plmmbkdf.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cancdkkg.dll" Oeahap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kedcml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kkbkmqed.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bleebc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbolbl32.dll" Ohcmid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pahiebeq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfjehfda.dll" Ebgpkj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Joeeddmj.dll" Piaijbgi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fiiadhok.dll" Dgakmp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mlifnphl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pmiijjcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gpcmagpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lhgiic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jflhqe32.dll" Fmdcamko.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gfeahffl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qfgfifdp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kongimkh.dll" Jnnnfalp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qkdohg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inmkdhfn.dll" Akenij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qogqapmf.dll" Iipfgm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofemogmh.dll" Dlnceg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjakkgha.dll" Apqhldjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mokbiohj.dll" Bplhhc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Clhbhc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mmkkgh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pbddhhbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pfeijqqe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Einnfgmg.dll" Gmqjga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iomgjk32.dll" Lhgiic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oegejc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gmmmoppl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jnnnfalp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fagcfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfenmdkp.dll" Nladpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdfmgqph.dll" Afqifo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Plimpg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hidgko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pohdamqh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gaepgacn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Palbpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fejebdig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Akniofoa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pfnccg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pkklkn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gniali32.dll" Beoigphb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jnnnfalp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bojohp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjqgggni.dll" Dgkbfjeg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ebgpkj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dipgik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Klnkoc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Majoikof.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nclida32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kajfdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojicgi32.dll" Lpghfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Khlinedh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbpjik32.dll" Ampojimo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Adiknkco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Apimhjbe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ddekfd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Debaqh32.dll" Odljjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dgkbfjeg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jqllaedc.dll" Iomood32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qldccjno.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4256 wrote to memory of 3712 4256 NEAS.d0e1098c260f6262978992c0b7e05a90.exe 82 PID 4256 wrote to memory of 3712 4256 NEAS.d0e1098c260f6262978992c0b7e05a90.exe 82 PID 4256 wrote to memory of 3712 4256 NEAS.d0e1098c260f6262978992c0b7e05a90.exe 82 PID 3712 wrote to memory of 3600 3712 Nbphglbe.exe 83 PID 3712 wrote to memory of 3600 3712 Nbphglbe.exe 83 PID 3712 wrote to memory of 3600 3712 Nbphglbe.exe 83 PID 3600 wrote to memory of 3836 3600 Nodiqp32.exe 84 PID 3600 wrote to memory of 3836 3600 Nodiqp32.exe 84 PID 3600 wrote to memory of 3836 3600 Nodiqp32.exe 84 PID 3836 wrote to memory of 5084 3836 Nofefp32.exe 85 PID 3836 wrote to memory of 5084 3836 Nofefp32.exe 85 PID 3836 wrote to memory of 5084 3836 Nofefp32.exe 85 PID 5084 wrote to memory of 1020 5084 Haidfpki.exe 86 PID 5084 wrote to memory of 1020 5084 Haidfpki.exe 86 PID 5084 wrote to memory of 1020 5084 Haidfpki.exe 86 PID 1020 wrote to memory of 1612 1020 Iapjgo32.exe 87 PID 1020 wrote to memory of 1612 1020 Iapjgo32.exe 87 PID 1020 wrote to memory of 1612 1020 Iapjgo32.exe 87 PID 1612 wrote to memory of 1156 1612 Iecmhlhb.exe 88 PID 1612 wrote to memory of 1156 1612 Iecmhlhb.exe 88 PID 1612 wrote to memory of 1156 1612 Iecmhlhb.exe 88 PID 1156 wrote to memory of 4624 1156 Jnnnfalp.exe 89 PID 1156 wrote to memory of 4624 1156 Jnnnfalp.exe 89 PID 1156 wrote to memory of 4624 1156 Jnnnfalp.exe 89 PID 4624 wrote to memory of 3324 4624 Jaqcnl32.exe 90 PID 4624 wrote to memory of 3324 4624 Jaqcnl32.exe 90 PID 4624 wrote to memory of 3324 4624 Jaqcnl32.exe 90 PID 3324 wrote to memory of 2840 3324 Jjihfbno.exe 91 PID 3324 wrote to memory of 2840 3324 Jjihfbno.exe 91 PID 3324 wrote to memory of 2840 3324 Jjihfbno.exe 91 PID 2840 wrote to memory of 4520 2840 Jbbmmo32.exe 92 PID 2840 wrote to memory of 4520 2840 Jbbmmo32.exe 92 PID 2840 wrote to memory of 4520 2840 Jbbmmo32.exe 92 PID 4520 wrote to memory of 2976 4520 Jlkafdco.exe 93 PID 4520 wrote to memory of 2976 4520 Jlkafdco.exe 93 PID 4520 wrote to memory of 2976 4520 Jlkafdco.exe 93 PID 2976 wrote to memory of 4804 2976 Kdffjgpj.exe 94 PID 2976 wrote to memory of 4804 2976 Kdffjgpj.exe 94 PID 2976 wrote to memory of 4804 2976 Kdffjgpj.exe 94 PID 4804 wrote to memory of 2068 4804 Kajfdk32.exe 95 PID 4804 wrote to memory of 2068 4804 Kajfdk32.exe 95 PID 4804 wrote to memory of 2068 4804 Kajfdk32.exe 95 PID 2068 wrote to memory of 3456 2068 Kkbkmqed.exe 96 PID 2068 wrote to memory of 3456 2068 Kkbkmqed.exe 96 PID 2068 wrote to memory of 3456 2068 Kkbkmqed.exe 96 PID 3456 wrote to memory of 3228 3456 Klbgfc32.exe 97 PID 3456 wrote to memory of 3228 3456 Klbgfc32.exe 97 PID 3456 wrote to memory of 3228 3456 Klbgfc32.exe 97 PID 3228 wrote to memory of 2204 3228 Kejloi32.exe 98 PID 3228 wrote to memory of 2204 3228 Kejloi32.exe 98 PID 3228 wrote to memory of 2204 3228 Kejloi32.exe 98 PID 2204 wrote to memory of 2240 2204 Kdpiqehp.exe 99 PID 2204 wrote to memory of 2240 2204 Kdpiqehp.exe 99 PID 2204 wrote to memory of 2240 2204 Kdpiqehp.exe 99 PID 2240 wrote to memory of 4232 2240 Ldbefe32.exe 100 PID 2240 wrote to memory of 4232 2240 Ldbefe32.exe 100 PID 2240 wrote to memory of 4232 2240 Ldbefe32.exe 100 PID 4232 wrote to memory of 3832 4232 Logicn32.exe 101 PID 4232 wrote to memory of 3832 4232 Logicn32.exe 101 PID 4232 wrote to memory of 3832 4232 Logicn32.exe 101 PID 3832 wrote to memory of 3892 3832 Lknjhokg.exe 102 PID 3832 wrote to memory of 3892 3832 Lknjhokg.exe 102 PID 3832 wrote to memory of 3892 3832 Lknjhokg.exe 102 PID 3892 wrote to memory of 216 3892 Ldfoad32.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.d0e1098c260f6262978992c0b7e05a90.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.d0e1098c260f6262978992c0b7e05a90.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\Nbphglbe.exeC:\Windows\system32\Nbphglbe.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\Nodiqp32.exeC:\Windows\system32\Nodiqp32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\Nofefp32.exeC:\Windows\system32\Nofefp32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\Haidfpki.exeC:\Windows\system32\Haidfpki.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\Iapjgo32.exeC:\Windows\system32\Iapjgo32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\Iecmhlhb.exeC:\Windows\system32\Iecmhlhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\Jnnnfalp.exeC:\Windows\system32\Jnnnfalp.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\Jaqcnl32.exeC:\Windows\system32\Jaqcnl32.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\Jjihfbno.exeC:\Windows\system32\Jjihfbno.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\Jbbmmo32.exeC:\Windows\system32\Jbbmmo32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\Jlkafdco.exeC:\Windows\system32\Jlkafdco.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\Kdffjgpj.exeC:\Windows\system32\Kdffjgpj.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\Kajfdk32.exeC:\Windows\system32\Kajfdk32.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\Kkbkmqed.exeC:\Windows\system32\Kkbkmqed.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\Klbgfc32.exeC:\Windows\system32\Klbgfc32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\Kejloi32.exeC:\Windows\system32\Kejloi32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\Kdpiqehp.exeC:\Windows\system32\Kdpiqehp.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\Ldbefe32.exeC:\Windows\system32\Ldbefe32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\Logicn32.exeC:\Windows\system32\Logicn32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\Lknjhokg.exeC:\Windows\system32\Lknjhokg.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\SysWOW64\Ldfoad32.exeC:\Windows\system32\Ldfoad32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\Lefkkg32.exeC:\Windows\system32\Lefkkg32.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:216 -
C:\Windows\SysWOW64\Lehhqg32.exeC:\Windows\system32\Lehhqg32.exe24⤵
- Executes dropped EXE
PID:4472 -
C:\Windows\SysWOW64\Moalil32.exeC:\Windows\system32\Moalil32.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4912 -
C:\Windows\SysWOW64\Mekdffee.exeC:\Windows\system32\Mekdffee.exe26⤵
- Executes dropped EXE
PID:2692 -
C:\Windows\SysWOW64\Mhknhabf.exeC:\Windows\system32\Mhknhabf.exe27⤵
- Executes dropped EXE
PID:2828 -
C:\Windows\SysWOW64\Mcabej32.exeC:\Windows\system32\Mcabej32.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:880 -
C:\Windows\SysWOW64\Mlifnphl.exeC:\Windows\system32\Mlifnphl.exe29⤵
- Executes dropped EXE
- Modifies registry class
PID:2236 -
C:\Windows\SysWOW64\Mebkge32.exeC:\Windows\system32\Mebkge32.exe30⤵
- Executes dropped EXE
PID:5104 -
C:\Windows\SysWOW64\Mojopk32.exeC:\Windows\system32\Mojopk32.exe31⤵
- Executes dropped EXE
PID:2792 -
C:\Windows\SysWOW64\Nlnpio32.exeC:\Windows\system32\Nlnpio32.exe32⤵
- Executes dropped EXE
PID:2192 -
C:\Windows\SysWOW64\Ndidna32.exeC:\Windows\system32\Ndidna32.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4432 -
C:\Windows\SysWOW64\Namegfql.exeC:\Windows\system32\Namegfql.exe34⤵
- Executes dropped EXE
PID:1396 -
C:\Windows\SysWOW64\Ncmaai32.exeC:\Windows\system32\Ncmaai32.exe35⤵
- Executes dropped EXE
PID:1052 -
C:\Windows\SysWOW64\Nconfh32.exeC:\Windows\system32\Nconfh32.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3808 -
C:\Windows\SysWOW64\Odljjo32.exeC:\Windows\system32\Odljjo32.exe37⤵
- Executes dropped EXE
- Modifies registry class
PID:5088 -
C:\Windows\SysWOW64\Pdngpo32.exeC:\Windows\system32\Pdngpo32.exe38⤵
- Executes dropped EXE
PID:4640 -
C:\Windows\SysWOW64\Pmjhlklg.exeC:\Windows\system32\Pmjhlklg.exe39⤵
- Executes dropped EXE
PID:2876 -
C:\Windows\SysWOW64\Piaiqlak.exeC:\Windows\system32\Piaiqlak.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2212 -
C:\Windows\SysWOW64\Pfeijqqe.exeC:\Windows\system32\Pfeijqqe.exe41⤵
- Executes dropped EXE
- Modifies registry class
PID:4420 -
C:\Windows\SysWOW64\Qkdohg32.exeC:\Windows\system32\Qkdohg32.exe42⤵
- Executes dropped EXE
- Modifies registry class
PID:4504 -
C:\Windows\SysWOW64\Qkfkng32.exeC:\Windows\system32\Qkfkng32.exe43⤵
- Executes dropped EXE
PID:2712 -
C:\Windows\SysWOW64\Aijlgkjq.exeC:\Windows\system32\Aijlgkjq.exe44⤵
- Executes dropped EXE
PID:668 -
C:\Windows\SysWOW64\Afqifo32.exeC:\Windows\system32\Afqifo32.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3976 -
C:\Windows\SysWOW64\Beaecjab.exeC:\Windows\system32\Beaecjab.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4980 -
C:\Windows\SysWOW64\Clbdpc32.exeC:\Windows\system32\Clbdpc32.exe47⤵
- Executes dropped EXE
PID:4368 -
C:\Windows\SysWOW64\Cdjlap32.exeC:\Windows\system32\Cdjlap32.exe48⤵
- Executes dropped EXE
PID:2832 -
C:\Windows\SysWOW64\Kagbdenk.exeC:\Windows\system32\Kagbdenk.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1372 -
C:\Windows\SysWOW64\Bbbblhnc.exeC:\Windows\system32\Bbbblhnc.exe50⤵
- Executes dropped EXE
PID:2704 -
C:\Windows\SysWOW64\Lpghfi32.exeC:\Windows\system32\Lpghfi32.exe51⤵
- Executes dropped EXE
- Modifies registry class
PID:3956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Akenij32.exeC:\Windows\system32\Akenij32.exe1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1424 -
C:\Windows\SysWOW64\Ancjef32.exeC:\Windows\system32\Ancjef32.exe2⤵
- Executes dropped EXE
PID:2364 -
C:\Windows\SysWOW64\Ahinbo32.exeC:\Windows\system32\Ahinbo32.exe3⤵
- Executes dropped EXE
PID:2664 -
C:\Windows\SysWOW64\Akgjnj32.exeC:\Windows\system32\Akgjnj32.exe4⤵
- Executes dropped EXE
PID:1440 -
C:\Windows\SysWOW64\Adpogp32.exeC:\Windows\system32\Adpogp32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4596 -
C:\Windows\SysWOW64\Ajmgof32.exeC:\Windows\system32\Ajmgof32.exe6⤵
- Executes dropped EXE
PID:1028 -
C:\Windows\SysWOW64\Aqfolqna.exeC:\Windows\system32\Aqfolqna.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:3044 -
C:\Windows\SysWOW64\Aklciimh.exeC:\Windows\system32\Aklciimh.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1432 -
C:\Windows\SysWOW64\Kmaooihb.exeC:\Windows\system32\Kmaooihb.exe9⤵
- Executes dropped EXE
PID:2088 -
C:\Windows\SysWOW64\Lopkkdgf.exeC:\Windows\system32\Lopkkdgf.exe10⤵
- Executes dropped EXE
PID:4276 -
C:\Windows\SysWOW64\Ljephmgl.exeC:\Windows\system32\Ljephmgl.exe11⤵
- Executes dropped EXE
PID:884 -
C:\Windows\SysWOW64\Lkflpe32.exeC:\Windows\system32\Lkflpe32.exe12⤵
- Executes dropped EXE
PID:5048 -
C:\Windows\SysWOW64\Fagcfc32.exeC:\Windows\system32\Fagcfc32.exe13⤵
- Executes dropped EXE
- Modifies registry class
PID:4600 -
C:\Windows\SysWOW64\Fhjoilop.exeC:\Windows\system32\Fhjoilop.exe14⤵PID:4936
-
C:\Windows\SysWOW64\Fjikeg32.exeC:\Windows\system32\Fjikeg32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:768 -
C:\Windows\SysWOW64\Gmggac32.exeC:\Windows\system32\Gmggac32.exe16⤵PID:4736
-
C:\Windows\SysWOW64\Ghmkol32.exeC:\Windows\system32\Ghmkol32.exe17⤵PID:5056
-
C:\Windows\SysWOW64\Gngckfdj.exeC:\Windows\system32\Gngckfdj.exe18⤵
- Drops file in System32 directory
PID:1872 -
C:\Windows\SysWOW64\Gaepgacn.exeC:\Windows\system32\Gaepgacn.exe19⤵
- Modifies registry class
PID:4472 -
C:\Windows\SysWOW64\Ghohdk32.exeC:\Windows\system32\Ghohdk32.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3060 -
C:\Windows\SysWOW64\Goipae32.exeC:\Windows\system32\Goipae32.exe21⤵PID:1576
-
C:\Windows\SysWOW64\Gaglma32.exeC:\Windows\system32\Gaglma32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2828 -
C:\Windows\SysWOW64\Glmqjj32.exeC:\Windows\system32\Glmqjj32.exe23⤵PID:4192
-
C:\Windows\SysWOW64\Gmnmbbgp.exeC:\Windows\system32\Gmnmbbgp.exe24⤵
- Drops file in System32 directory
PID:3028 -
C:\Windows\SysWOW64\Ghdaokfe.exeC:\Windows\system32\Ghdaokfe.exe25⤵PID:2120
-
C:\Windows\SysWOW64\Gmqjga32.exeC:\Windows\system32\Gmqjga32.exe26⤵
- Modifies registry class
PID:2700 -
C:\Windows\SysWOW64\Gdkbdllj.exeC:\Windows\system32\Gdkbdllj.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1580 -
C:\Windows\SysWOW64\Ghfnej32.exeC:\Windows\system32\Ghfnej32.exe28⤵PID:2092
-
C:\Windows\SysWOW64\Gkdjaf32.exeC:\Windows\system32\Gkdjaf32.exe29⤵PID:3368
-
C:\Windows\SysWOW64\Knfepldb.exeC:\Windows\system32\Knfepldb.exe30⤵PID:4420
-
C:\Windows\SysWOW64\Khlinedh.exeC:\Windows\system32\Khlinedh.exe31⤵
- Drops file in System32 directory
- Modifies registry class
PID:4928 -
C:\Windows\SysWOW64\Klnkoc32.exeC:\Windows\system32\Klnkoc32.exe32⤵
- Modifies registry class
PID:1164 -
C:\Windows\SysWOW64\Kffphhmj.exeC:\Windows\system32\Kffphhmj.exe33⤵
- Drops file in System32 directory
PID:4892 -
C:\Windows\SysWOW64\Llqhdb32.exeC:\Windows\system32\Llqhdb32.exe34⤵
- Drops file in System32 directory
PID:3008 -
C:\Windows\SysWOW64\Lnbdlkje.exeC:\Windows\system32\Lnbdlkje.exe35⤵PID:2688
-
C:\Windows\SysWOW64\Lfimmhkg.exeC:\Windows\system32\Lfimmhkg.exe36⤵PID:3064
-
C:\Windows\SysWOW64\Lhgiic32.exeC:\Windows\system32\Lhgiic32.exe37⤵
- Drops file in System32 directory
- Modifies registry class
PID:4264 -
C:\Windows\SysWOW64\Ldnjndpo.exeC:\Windows\system32\Ldnjndpo.exe38⤵PID:2428
-
C:\Windows\SysWOW64\Lnfngj32.exeC:\Windows\system32\Lnfngj32.exe39⤵
- Drops file in System32 directory
PID:4868 -
C:\Windows\SysWOW64\Lnikmjdm.exeC:\Windows\system32\Lnikmjdm.exe40⤵PID:2660
-
C:\Windows\SysWOW64\Lmjkka32.exeC:\Windows\system32\Lmjkka32.exe41⤵PID:3292
-
C:\Windows\SysWOW64\Lfbpcgbl.exeC:\Windows\system32\Lfbpcgbl.exe42⤵PID:1396
-
C:\Windows\SysWOW64\Mokdllim.exeC:\Windows\system32\Mokdllim.exe43⤵
- Drops file in System32 directory
PID:1308 -
C:\Windows\SysWOW64\Micheb32.exeC:\Windows\system32\Micheb32.exe44⤵PID:332
-
C:\Windows\SysWOW64\Momqblgj.exeC:\Windows\system32\Momqblgj.exe45⤵PID:4800
-
C:\Windows\SysWOW64\Mmaakpfd.exeC:\Windows\system32\Mmaakpfd.exe46⤵PID:2220
-
C:\Windows\SysWOW64\Melfpb32.exeC:\Windows\system32\Melfpb32.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4092 -
C:\Windows\SysWOW64\Mijofaje.exeC:\Windows\system32\Mijofaje.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3476 -
C:\Windows\SysWOW64\Mpdgbkab.exeC:\Windows\system32\Mpdgbkab.exe49⤵PID:4132
-
C:\Windows\SysWOW64\Nmhglopl.exeC:\Windows\system32\Nmhglopl.exe50⤵PID:2084
-
C:\Windows\SysWOW64\Nblfee32.exeC:\Windows\system32\Nblfee32.exe51⤵PID:1964
-
C:\Windows\SysWOW64\Nejbaqgo.exeC:\Windows\system32\Nejbaqgo.exe52⤵PID:2980
-
C:\Windows\SysWOW64\Nifnao32.exeC:\Windows\system32\Nifnao32.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2320 -
C:\Windows\SysWOW64\Nnbfjf32.exeC:\Windows\system32\Nnbfjf32.exe54⤵PID:4720
-
C:\Windows\SysWOW64\Opdpih32.exeC:\Windows\system32\Opdpih32.exe55⤵PID:3464
-
C:\Windows\SysWOW64\Oeahap32.exeC:\Windows\system32\Oeahap32.exe56⤵
- Modifies registry class
PID:5016 -
C:\Windows\SysWOW64\Poqckdap.exeC:\Windows\system32\Poqckdap.exe57⤵PID:1004
-
C:\Windows\SysWOW64\Pekkhn32.exeC:\Windows\system32\Pekkhn32.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1892 -
C:\Windows\SysWOW64\Pbokab32.exeC:\Windows\system32\Pbokab32.exe59⤵
- Drops file in System32 directory
PID:4432 -
C:\Windows\SysWOW64\Pbahgbfc.exeC:\Windows\system32\Pbahgbfc.exe60⤵PID:3356
-
C:\Windows\SysWOW64\Pikqcl32.exeC:\Windows\system32\Pikqcl32.exe61⤵PID:4716
-
C:\Windows\SysWOW64\Plimpg32.exeC:\Windows\system32\Plimpg32.exe62⤵
- Drops file in System32 directory
- Modifies registry class
PID:2240 -
C:\Windows\SysWOW64\Pfoamp32.exeC:\Windows\system32\Pfoamp32.exe63⤵PID:5088
-
C:\Windows\SysWOW64\Pmiijjcf.exeC:\Windows\system32\Pmiijjcf.exe64⤵
- Modifies registry class
PID:4052 -
C:\Windows\SysWOW64\Qbeaba32.exeC:\Windows\system32\Qbeaba32.exe65⤵PID:408
-
C:\Windows\SysWOW64\Qfcjhphd.exeC:\Windows\system32\Qfcjhphd.exe66⤵PID:5140
-
C:\Windows\SysWOW64\Aploae32.exeC:\Windows\system32\Aploae32.exe67⤵PID:5188
-
C:\Windows\SysWOW64\Abjkmqni.exeC:\Windows\system32\Abjkmqni.exe68⤵PID:5252
-
C:\Windows\SysWOW64\Ampojimo.exeC:\Windows\system32\Ampojimo.exe69⤵
- Modifies registry class
PID:5308 -
C:\Windows\SysWOW64\Amblpikl.exeC:\Windows\system32\Amblpikl.exe70⤵PID:5348
-
C:\Windows\SysWOW64\Apqhldjp.exeC:\Windows\system32\Apqhldjp.exe71⤵
- Modifies registry class
PID:5400 -
C:\Windows\SysWOW64\Abodhpic.exeC:\Windows\system32\Abodhpic.exe72⤵PID:5456
-
C:\Windows\SysWOW64\Apcead32.exeC:\Windows\system32\Apcead32.exe73⤵PID:5500
-
C:\Windows\SysWOW64\Agmmnnpj.exeC:\Windows\system32\Agmmnnpj.exe74⤵
- Drops file in System32 directory
PID:5572 -
C:\Windows\SysWOW64\Apeagd32.exeC:\Windows\system32\Apeagd32.exe75⤵PID:5616
-
C:\Windows\SysWOW64\Accnco32.exeC:\Windows\system32\Accnco32.exe76⤵PID:5664
-
C:\Windows\SysWOW64\Ainfpi32.exeC:\Windows\system32\Ainfpi32.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5700 -
C:\Windows\SysWOW64\Bojohp32.exeC:\Windows\system32\Bojohp32.exe78⤵
- Modifies registry class
PID:5744 -
C:\Windows\SysWOW64\Bedgejbo.exeC:\Windows\system32\Bedgejbo.exe79⤵PID:5812
-
C:\Windows\SysWOW64\Bomknp32.exeC:\Windows\system32\Bomknp32.exe80⤵PID:5848
-
C:\Windows\SysWOW64\Bchgnoai.exeC:\Windows\system32\Bchgnoai.exe81⤵PID:5892
-
C:\Windows\SysWOW64\Bplhhc32.exeC:\Windows\system32\Bplhhc32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5932 -
C:\Windows\SysWOW64\Beippj32.exeC:\Windows\system32\Beippj32.exe83⤵
- Drops file in System32 directory
PID:5976 -
C:\Windows\SysWOW64\Blchmdff.exeC:\Windows\system32\Blchmdff.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:6016 -
C:\Windows\SysWOW64\Bjgifhep.exeC:\Windows\system32\Bjgifhep.exe85⤵PID:6056
-
C:\Windows\SysWOW64\Bleebc32.exeC:\Windows\system32\Bleebc32.exe86⤵
- Modifies registry class
PID:6096 -
C:\Windows\SysWOW64\Bgkipl32.exeC:\Windows\system32\Bgkipl32.exe87⤵PID:6136
-
C:\Windows\SysWOW64\Clhbhc32.exeC:\Windows\system32\Clhbhc32.exe88⤵
- Modifies registry class
PID:2524 -
C:\Windows\SysWOW64\Cfpfqiha.exeC:\Windows\system32\Cfpfqiha.exe89⤵PID:5216
-
C:\Windows\SysWOW64\Cfbcfh32.exeC:\Windows\system32\Cfbcfh32.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5284 -
C:\Windows\SysWOW64\Cokgonmp.exeC:\Windows\system32\Cokgonmp.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5388 -
C:\Windows\SysWOW64\Cgbppknb.exeC:\Windows\system32\Cgbppknb.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5508 -
C:\Windows\SysWOW64\Comddn32.exeC:\Windows\system32\Comddn32.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5712 -
C:\Windows\SysWOW64\Copajm32.exeC:\Windows\system32\Copajm32.exe94⤵PID:5780
-
C:\Windows\SysWOW64\Dgkbfjeg.exeC:\Windows\system32\Dgkbfjeg.exe95⤵
- Modifies registry class
PID:5872 -
C:\Windows\SysWOW64\Dnekcd32.exeC:\Windows\system32\Dnekcd32.exe96⤵
- Drops file in System32 directory
PID:5924 -
C:\Windows\SysWOW64\Dofgklcb.exeC:\Windows\system32\Dofgklcb.exe97⤵PID:6004
-
C:\Windows\SysWOW64\Dcbckk32.exeC:\Windows\system32\Dcbckk32.exe98⤵PID:5128
-
C:\Windows\SysWOW64\Fmdcamko.exeC:\Windows\system32\Fmdcamko.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5292 -
C:\Windows\SysWOW64\Galonj32.exeC:\Windows\system32\Galonj32.exe100⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5652 -
C:\Windows\SysWOW64\Hmbpbk32.exeC:\Windows\system32\Hmbpbk32.exe101⤵
- Drops file in System32 directory
PID:5832 -
C:\Windows\SysWOW64\Hoibmmpi.exeC:\Windows\system32\Hoibmmpi.exe102⤵PID:2824
-
C:\Windows\SysWOW64\Jhdlbp32.exeC:\Windows\system32\Jhdlbp32.exe103⤵PID:456
-
C:\Windows\SysWOW64\Kahpgcch.exeC:\Windows\system32\Kahpgcch.exe104⤵PID:2952
-
C:\Windows\SysWOW64\Bimoecio.exeC:\Windows\system32\Bimoecio.exe105⤵PID:5636
-
C:\Windows\SysWOW64\Caagpdop.exeC:\Windows\system32\Caagpdop.exe106⤵PID:5920
-
C:\Windows\SysWOW64\Kdcicipb.exeC:\Windows\system32\Kdcicipb.exe107⤵PID:3848
-
C:\Windows\SysWOW64\Majoikof.exeC:\Windows\system32\Majoikof.exe108⤵
- Drops file in System32 directory
- Modifies registry class
PID:5160 -
C:\Windows\SysWOW64\Kdllhdco.exeC:\Windows\system32\Kdllhdco.exe109⤵
- Drops file in System32 directory
PID:4272 -
C:\Windows\SysWOW64\Ocmchdmh.exeC:\Windows\system32\Ocmchdmh.exe110⤵PID:1648
-
C:\Windows\SysWOW64\Cifmjd32.exeC:\Windows\system32\Cifmjd32.exe111⤵PID:4504
-
C:\Windows\SysWOW64\Gpcmagpo.exeC:\Windows\system32\Gpcmagpo.exe112⤵
- Drops file in System32 directory
- Modifies registry class
PID:2980 -
C:\Windows\SysWOW64\Jgngkmkf.exeC:\Windows\system32\Jgngkmkf.exe113⤵PID:5096
-
C:\Windows\SysWOW64\Lkchoaif.exeC:\Windows\system32\Lkchoaif.exe114⤵PID:1632
-
C:\Windows\SysWOW64\Mqpqghgn.exeC:\Windows\system32\Mqpqghgn.exe115⤵
- Drops file in System32 directory
PID:5224 -
C:\Windows\SysWOW64\Mabnlh32.exeC:\Windows\system32\Mabnlh32.exe116⤵PID:2828
-
C:\Windows\SysWOW64\Menimfnd.exeC:\Windows\system32\Menimfnd.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4260 -
C:\Windows\SysWOW64\Mmkkgh32.exeC:\Windows\system32\Mmkkgh32.exe118⤵
- Modifies registry class
PID:2656 -
C:\Windows\SysWOW64\Mgaoda32.exeC:\Windows\system32\Mgaoda32.exe119⤵PID:5880
-
C:\Windows\SysWOW64\Mjokpm32.exeC:\Windows\system32\Mjokpm32.exe120⤵PID:4832
-
C:\Windows\SysWOW64\Mlohjpoi.exeC:\Windows\system32\Mlohjpoi.exe121⤵PID:4520
-
C:\Windows\SysWOW64\Nalpbf32.exeC:\Windows\system32\Nalpbf32.exe122⤵PID:5772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-