Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
211s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/10/2023, 12:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.f29b1e7c5a0bbb08445f71935f1921cc_JC.exe
Resource
win7-20230831-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.f29b1e7c5a0bbb08445f71935f1921cc_JC.exe
Resource
win10v2004-20230915-en
6 signatures
150 seconds
General
-
Target
NEAS.f29b1e7c5a0bbb08445f71935f1921cc_JC.exe
-
Size
55KB
-
MD5
f29b1e7c5a0bbb08445f71935f1921cc
-
SHA1
b8b5d7511242ae313a7aacc6341775a818bd60b6
-
SHA256
1d6d4188b791c83d448f685474f8c7ef99c2d098d710802d7dc996fec610a523
-
SHA512
ce97d0723688903ced434dbb90e6e8d3932a44e23250e60f35d894bd9072a0371f4705caaef036f7576e391ca710b66094df0a2a5d135ec7ed013d0243452752
-
SSDEEP
1536:CtqCYfvza0YecSA4dQuFBd0NOeV6ZS0wBQy14vlEJ:Co7fra0YecSA2/Fkq80BY4vlo
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bbkfpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Omacgjhh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Adfbbabc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pockoeeg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eiipfbgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dgfkoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Najfeo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogejocjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iilalc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Chfffk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjcnoe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eeffpn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hlijan32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhbcaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qpdenh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Elgmbnfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nobpjbcn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfoakokc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pmcllm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aekplnlo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bppqhjnp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Coenifch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dbjledoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Heoadcmh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abacjd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nopcdbep.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mildlmma.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hlgmkn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Abfmecba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Enpoje32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbmoeeod.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Piojmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gkclcm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aocifaog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cgbochop.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjlqpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pcljjd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cceenilo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Abacjd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Anlodd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pkkicfik.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qlkebi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Chdjpl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qdbpml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eedjfchi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pdnfalea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nlojcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qdbpml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ppbhhi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djmkkb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eomoohoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Coenifch.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ccnici32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nalbkn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eeicenni.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aqpgblqh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajfanjqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bejlkaoj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cklnog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hcohbh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afolpb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Naalfnba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Clecnk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hpodbo32.exe -
Executes dropped EXE 64 IoCs
pid Process 2720 Lhbhdnio.exe 2516 Jbbbed32.exe 1564 Jilkbn32.exe 2844 Adfbbabc.exe 1620 Jjlqpp32.exe 2156 Oedclm32.exe 1988 Iilalc32.exe 2808 Baoopndk.exe 804 Bglghdbc.exe 1420 Baakem32.exe 272 Blklfk32.exe 2116 Bfcqoqeh.exe 1628 Bpieli32.exe 1992 Chdjpl32.exe 2260 Chfffk32.exe 300 Cfjgopop.exe 1600 Cldolj32.exe 1972 Cfmceomm.exe 2976 Cgnpmg32.exe 1884 Cnhhia32.exe 1916 Chmlfj32.exe 2188 Djoinbpm.exe 2104 Dknehe32.exe 2040 Dqknqleg.exe 3068 Dgefmf32.exe 2628 Dclgbgbh.exe 2388 Eimien32.exe 2688 Ebemnc32.exe 1888 Egbffj32.exe 2480 Enlncdio.exe 2484 Eeffpn32.exe 1616 Ejcohe32.exe 2796 Eeicenni.exe 2756 Ejeknelp.exe 2152 Flpkll32.exe 2128 Fidkep32.exe 1760 Flbgak32.exe 2264 Gifhkpgk.exe 288 Gkgdbh32.exe 2036 Gbolce32.exe 1068 Hifdjcif.exe 2108 Hcohbh32.exe 1280 Hhkakonn.exe 1504 Hlgmkn32.exe 2432 Heoadcmh.exe 2008 Hlijan32.exe 1096 Hohfmi32.exe 1948 Hafbid32.exe 1768 Hddoep32.exe 2376 Hllffmbb.exe 1568 Joohmk32.exe 2416 Cffejk32.exe 908 Gmjehe32.exe 2492 Pkebig32.exe 2816 Pcljjd32.exe 2944 Pdnfalea.exe 2528 Pldobjec.exe 2932 Pockoeeg.exe 2572 Pnfkjb32.exe 2208 Phkohkkh.exe 2360 Pkjkdfjk.exe 2540 Padcqp32.exe 2648 Qdbpml32.exe 556 Qgqlig32.exe -
Loads dropped DLL 64 IoCs
pid Process 2728 NEAS.f29b1e7c5a0bbb08445f71935f1921cc_JC.exe 2728 NEAS.f29b1e7c5a0bbb08445f71935f1921cc_JC.exe 2720 Lhbhdnio.exe 2720 Lhbhdnio.exe 2516 Jbbbed32.exe 2516 Jbbbed32.exe 1564 Jilkbn32.exe 1564 Jilkbn32.exe 2844 Adfbbabc.exe 2844 Adfbbabc.exe 1620 Jjlqpp32.exe 1620 Jjlqpp32.exe 2156 Oedclm32.exe 2156 Oedclm32.exe 1988 Iilalc32.exe 1988 Iilalc32.exe 2808 Baoopndk.exe 2808 Baoopndk.exe 804 Bglghdbc.exe 804 Bglghdbc.exe 1420 Baakem32.exe 1420 Baakem32.exe 272 Blklfk32.exe 272 Blklfk32.exe 2116 Bfcqoqeh.exe 2116 Bfcqoqeh.exe 1628 Bpieli32.exe 1628 Bpieli32.exe 1992 Chdjpl32.exe 1992 Chdjpl32.exe 2260 Chfffk32.exe 2260 Chfffk32.exe 300 Cfjgopop.exe 300 Cfjgopop.exe 1600 Cldolj32.exe 1600 Cldolj32.exe 1972 Cfmceomm.exe 1972 Cfmceomm.exe 2976 Cgnpmg32.exe 2976 Cgnpmg32.exe 1884 Cnhhia32.exe 1884 Cnhhia32.exe 1916 Chmlfj32.exe 1916 Chmlfj32.exe 2188 Djoinbpm.exe 2188 Djoinbpm.exe 2104 Dknehe32.exe 2104 Dknehe32.exe 2040 Dqknqleg.exe 2040 Dqknqleg.exe 3068 Dgefmf32.exe 3068 Dgefmf32.exe 2628 Dclgbgbh.exe 2628 Dclgbgbh.exe 2388 Eimien32.exe 2388 Eimien32.exe 2688 Ebemnc32.exe 2688 Ebemnc32.exe 1888 Egbffj32.exe 1888 Egbffj32.exe 2480 Enlncdio.exe 2480 Enlncdio.exe 2484 Eeffpn32.exe 2484 Eeffpn32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Mmldbk32.dll Dpnogmbl.exe File created C:\Windows\SysWOW64\Mildlmma.exe Mcblob32.exe File opened for modification C:\Windows\SysWOW64\Mhaami32.exe Mioaalkn.exe File created C:\Windows\SysWOW64\Afcfebii.exe Anlodd32.exe File opened for modification C:\Windows\SysWOW64\Cgnpmg32.exe Cfmceomm.exe File created C:\Windows\SysWOW64\Ebgefbed.dll Djoinbpm.exe File created C:\Windows\SysWOW64\Cjmfag32.dll Ejcohe32.exe File created C:\Windows\SysWOW64\Qeokhe32.dll Cmnjgo32.exe File created C:\Windows\SysWOW64\Dhbhloho.exe Dbhppd32.exe File opened for modification C:\Windows\SysWOW64\Hlgmkn32.exe Hhkakonn.exe File opened for modification C:\Windows\SysWOW64\Cceenilo.exe Cmkmao32.exe File opened for modification C:\Windows\SysWOW64\Pijmanoe.exe Pflpecpa.exe File created C:\Windows\SysWOW64\Nnhmkohe.exe Njlqkpol.exe File created C:\Windows\SysWOW64\Gigqbf32.dll Pefjbknh.exe File created C:\Windows\SysWOW64\Fgqkchah.dll Bemiqamg.exe File created C:\Windows\SysWOW64\Dfobed32.exe Dcqfih32.exe File created C:\Windows\SysWOW64\Nemoffml.dll Enlncdio.exe File opened for modification C:\Windows\SysWOW64\Hllffmbb.exe Hddoep32.exe File created C:\Windows\SysWOW64\Goadik32.exe Gigllafc.exe File opened for modification C:\Windows\SysWOW64\Ngkhiebk.exe Nhhgmh32.exe File created C:\Windows\SysWOW64\Gbolce32.exe Gkgdbh32.exe File opened for modification C:\Windows\SysWOW64\Eadejede.exe Eoeiniea.exe File created C:\Windows\SysWOW64\Omacgjhh.exe Ojcgkoid.exe File created C:\Windows\SysWOW64\Ahdcmj32.exe Afcfebii.exe File opened for modification C:\Windows\SysWOW64\Pfjcocad.exe Pefjbknh.exe File created C:\Windows\SysWOW64\Dnbdblmp.dll Chdjpl32.exe File opened for modification C:\Windows\SysWOW64\Bbkfpb32.exe Bjcnoe32.exe File created C:\Windows\SysWOW64\Fdicfbpl.exe Fbkgjgqi.exe File created C:\Windows\SysWOW64\Hifejlha.dll Nnhmkohe.exe File opened for modification C:\Windows\SysWOW64\Bpieli32.exe Bfcqoqeh.exe File created C:\Windows\SysWOW64\Gknlbd32.dll Dgjdjghf.exe File opened for modification C:\Windows\SysWOW64\Ahgpbj32.exe Aehcfn32.exe File created C:\Windows\SysWOW64\Gpagikgi.dll Dbhppd32.exe File created C:\Windows\SysWOW64\Nalbkn32.exe Nonfoc32.exe File created C:\Windows\SysWOW64\Oaannpbb.dll Oonbnfio.exe File created C:\Windows\SysWOW64\Ajeloe32.exe Ahgpbj32.exe File created C:\Windows\SysWOW64\Liqkincl.dll Eljihn32.exe File created C:\Windows\SysWOW64\Enmbeehg.exe Ekofijic.exe File created C:\Windows\SysWOW64\Boknmnja.dll Gndedhdj.exe File opened for modification C:\Windows\SysWOW64\Mcblob32.exe Odgennoi.exe File opened for modification C:\Windows\SysWOW64\Gnahoh32.exe Gkclcm32.exe File opened for modification C:\Windows\SysWOW64\Aocifaog.exe Ajfanjqo.exe File created C:\Windows\SysWOW64\Phkohkkh.exe Pnfkjb32.exe File created C:\Windows\SysWOW64\Amgggm32.exe Abacjd32.exe File opened for modification C:\Windows\SysWOW64\Cefbfa32.exe Cbhejf32.exe File created C:\Windows\SysWOW64\Lmphlhmc.dll Ffdgef32.exe File created C:\Windows\SysWOW64\Kkmenq32.dll Baoopndk.exe File created C:\Windows\SysWOW64\Ghfnjchn.dll Eohedi32.exe File created C:\Windows\SysWOW64\Pdgjlojh.dll Dojcci32.exe File created C:\Windows\SysWOW64\Omemciec.dll Dekgpdqc.exe File created C:\Windows\SysWOW64\Pghodm32.dll Piojmj32.exe File opened for modification C:\Windows\SysWOW64\Oedclm32.exe Jjlqpp32.exe File created C:\Windows\SysWOW64\Fmjgnb32.dll Cldolj32.exe File created C:\Windows\SysWOW64\Pockoeeg.exe Pldobjec.exe File created C:\Windows\SysWOW64\Ahamfm32.dll Cbhejf32.exe File created C:\Windows\SysWOW64\Pbhnfpoe.exe Pjqfebnb.exe File opened for modification C:\Windows\SysWOW64\Bfcqoqeh.exe Blklfk32.exe File created C:\Windows\SysWOW64\Bbeheeho.dll Hohfmi32.exe File created C:\Windows\SysWOW64\Dlbcgo32.exe Didgkc32.exe File created C:\Windows\SysWOW64\Jemoll32.dll Pqhblm32.exe File created C:\Windows\SysWOW64\Digipn32.dll Enmbeehg.exe File created C:\Windows\SysWOW64\Gkclcm32.exe Gmqlgppo.exe File created C:\Windows\SysWOW64\Qcbndg32.exe Qlkebi32.exe File created C:\Windows\SysWOW64\Hhkakonn.exe Hcohbh32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Enmbeehg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jbbbed32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emgkqnci.dll" Dclgbgbh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pkjkdfjk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pbhnfpoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pocbne32.dll" Pnalqqbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Alponiga.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aekplnlo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oekbje32.dll" Amidmldj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qeokhe32.dll" Cmnjgo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cenhfqle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpagikgi.dll" Dbhppd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnnaoldi.dll" Hcohbh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nlojcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gigqbf32.dll" Pefjbknh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmbahk32.dll" Bfcqoqeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jibfqd32.dll" Ddgnbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dcqfih32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Enlncdio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fbkgjgqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nopcdbep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hafbid32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Elgmbnfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pjqfebnb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dfobed32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Miglkjli.dll" Jbbbed32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hpodbo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nejkam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhnggo32.dll" Dgcnihnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gfippego.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdpjkeid.dll" Cgbochop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gigllafc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oqhemjef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eeicenni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Flbgak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgcgncml.dll" Qcbndg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajphqb32.dll" Coenifch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dbhppd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gggadc32.dll" Adfbbabc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eimien32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pockoeeg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nklmdcfo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pqhblm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifhgoghp.dll" Hhkakonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pnfkjb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Enmbeehg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fhbcaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Achclf32.dll" Pnjepahn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hcohbh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehemnf32.dll" Elgmbnfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dobmdbeg.dll" Enpoje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nlaghg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dffhfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoppqo32.dll" Dlijbn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Odgennoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggdhlh32.dll" Ofeneqcn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bgbemjqh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cidklp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdpaan32.dll" Cbmoeeod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dgcnihnn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dlbcgo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pflpecpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cddcgmom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpnikb32.dll" Iilalc32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2720 2728 NEAS.f29b1e7c5a0bbb08445f71935f1921cc_JC.exe 29 PID 2728 wrote to memory of 2720 2728 NEAS.f29b1e7c5a0bbb08445f71935f1921cc_JC.exe 29 PID 2728 wrote to memory of 2720 2728 NEAS.f29b1e7c5a0bbb08445f71935f1921cc_JC.exe 29 PID 2728 wrote to memory of 2720 2728 NEAS.f29b1e7c5a0bbb08445f71935f1921cc_JC.exe 29 PID 2720 wrote to memory of 2516 2720 Lhbhdnio.exe 30 PID 2720 wrote to memory of 2516 2720 Lhbhdnio.exe 30 PID 2720 wrote to memory of 2516 2720 Lhbhdnio.exe 30 PID 2720 wrote to memory of 2516 2720 Lhbhdnio.exe 30 PID 2516 wrote to memory of 1564 2516 Jbbbed32.exe 31 PID 2516 wrote to memory of 1564 2516 Jbbbed32.exe 31 PID 2516 wrote to memory of 1564 2516 Jbbbed32.exe 31 PID 2516 wrote to memory of 1564 2516 Jbbbed32.exe 31 PID 1564 wrote to memory of 2844 1564 Jilkbn32.exe 32 PID 1564 wrote to memory of 2844 1564 Jilkbn32.exe 32 PID 1564 wrote to memory of 2844 1564 Jilkbn32.exe 32 PID 1564 wrote to memory of 2844 1564 Jilkbn32.exe 32 PID 2844 wrote to memory of 1620 2844 Adfbbabc.exe 33 PID 2844 wrote to memory of 1620 2844 Adfbbabc.exe 33 PID 2844 wrote to memory of 1620 2844 Adfbbabc.exe 33 PID 2844 wrote to memory of 1620 2844 Adfbbabc.exe 33 PID 1620 wrote to memory of 2156 1620 Jjlqpp32.exe 34 PID 1620 wrote to memory of 2156 1620 Jjlqpp32.exe 34 PID 1620 wrote to memory of 2156 1620 Jjlqpp32.exe 34 PID 1620 wrote to memory of 2156 1620 Jjlqpp32.exe 34 PID 2156 wrote to memory of 1988 2156 Oedclm32.exe 35 PID 2156 wrote to memory of 1988 2156 Oedclm32.exe 35 PID 2156 wrote to memory of 1988 2156 Oedclm32.exe 35 PID 2156 wrote to memory of 1988 2156 Oedclm32.exe 35 PID 1988 wrote to memory of 2808 1988 Iilalc32.exe 36 PID 1988 wrote to memory of 2808 1988 Iilalc32.exe 36 PID 1988 wrote to memory of 2808 1988 Iilalc32.exe 36 PID 1988 wrote to memory of 2808 1988 Iilalc32.exe 36 PID 2808 wrote to memory of 804 2808 Baoopndk.exe 37 PID 2808 wrote to memory of 804 2808 Baoopndk.exe 37 PID 2808 wrote to memory of 804 2808 Baoopndk.exe 37 PID 2808 wrote to memory of 804 2808 Baoopndk.exe 37 PID 804 wrote to memory of 1420 804 Bglghdbc.exe 38 PID 804 wrote to memory of 1420 804 Bglghdbc.exe 38 PID 804 wrote to memory of 1420 804 Bglghdbc.exe 38 PID 804 wrote to memory of 1420 804 Bglghdbc.exe 38 PID 1420 wrote to memory of 272 1420 Baakem32.exe 39 PID 1420 wrote to memory of 272 1420 Baakem32.exe 39 PID 1420 wrote to memory of 272 1420 Baakem32.exe 39 PID 1420 wrote to memory of 272 1420 Baakem32.exe 39 PID 272 wrote to memory of 2116 272 Blklfk32.exe 40 PID 272 wrote to memory of 2116 272 Blklfk32.exe 40 PID 272 wrote to memory of 2116 272 Blklfk32.exe 40 PID 272 wrote to memory of 2116 272 Blklfk32.exe 40 PID 2116 wrote to memory of 1628 2116 Bfcqoqeh.exe 41 PID 2116 wrote to memory of 1628 2116 Bfcqoqeh.exe 41 PID 2116 wrote to memory of 1628 2116 Bfcqoqeh.exe 41 PID 2116 wrote to memory of 1628 2116 Bfcqoqeh.exe 41 PID 1628 wrote to memory of 1992 1628 Bpieli32.exe 42 PID 1628 wrote to memory of 1992 1628 Bpieli32.exe 42 PID 1628 wrote to memory of 1992 1628 Bpieli32.exe 42 PID 1628 wrote to memory of 1992 1628 Bpieli32.exe 42 PID 1992 wrote to memory of 2260 1992 Chdjpl32.exe 43 PID 1992 wrote to memory of 2260 1992 Chdjpl32.exe 43 PID 1992 wrote to memory of 2260 1992 Chdjpl32.exe 43 PID 1992 wrote to memory of 2260 1992 Chdjpl32.exe 43 PID 2260 wrote to memory of 300 2260 Chfffk32.exe 44 PID 2260 wrote to memory of 300 2260 Chfffk32.exe 44 PID 2260 wrote to memory of 300 2260 Chfffk32.exe 44 PID 2260 wrote to memory of 300 2260 Chfffk32.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.f29b1e7c5a0bbb08445f71935f1921cc_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.f29b1e7c5a0bbb08445f71935f1921cc_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\Lhbhdnio.exeC:\Windows\system32\Lhbhdnio.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\Jbbbed32.exeC:\Windows\system32\Jbbbed32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\Jilkbn32.exeC:\Windows\system32\Jilkbn32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\Adfbbabc.exeC:\Windows\system32\Adfbbabc.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\Jjlqpp32.exeC:\Windows\system32\Jjlqpp32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\Oedclm32.exeC:\Windows\system32\Oedclm32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\Iilalc32.exeC:\Windows\system32\Iilalc32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\Baoopndk.exeC:\Windows\system32\Baoopndk.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\Bglghdbc.exeC:\Windows\system32\Bglghdbc.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\Baakem32.exeC:\Windows\system32\Baakem32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\Blklfk32.exeC:\Windows\system32\Blklfk32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Windows\SysWOW64\Bfcqoqeh.exeC:\Windows\system32\Bfcqoqeh.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\Bpieli32.exeC:\Windows\system32\Bpieli32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\Chdjpl32.exeC:\Windows\system32\Chdjpl32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\Chfffk32.exeC:\Windows\system32\Chfffk32.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\Cfjgopop.exeC:\Windows\system32\Cfjgopop.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:300 -
C:\Windows\SysWOW64\Cldolj32.exeC:\Windows\system32\Cldolj32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1600 -
C:\Windows\SysWOW64\Cfmceomm.exeC:\Windows\system32\Cfmceomm.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1972 -
C:\Windows\SysWOW64\Cgnpmg32.exeC:\Windows\system32\Cgnpmg32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Windows\SysWOW64\Cnhhia32.exeC:\Windows\system32\Cnhhia32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Windows\SysWOW64\Chmlfj32.exeC:\Windows\system32\Chmlfj32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Windows\SysWOW64\Djoinbpm.exeC:\Windows\system32\Djoinbpm.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2188 -
C:\Windows\SysWOW64\Dknehe32.exeC:\Windows\system32\Dknehe32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Windows\SysWOW64\Dqknqleg.exeC:\Windows\system32\Dqknqleg.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Windows\SysWOW64\Dgefmf32.exeC:\Windows\system32\Dgefmf32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Windows\SysWOW64\Dclgbgbh.exeC:\Windows\system32\Dclgbgbh.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2628 -
C:\Windows\SysWOW64\Eimien32.exeC:\Windows\system32\Eimien32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2388 -
C:\Windows\SysWOW64\Ebemnc32.exeC:\Windows\system32\Ebemnc32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Windows\SysWOW64\Egbffj32.exeC:\Windows\system32\Egbffj32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Windows\SysWOW64\Enlncdio.exeC:\Windows\system32\Enlncdio.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2480 -
C:\Windows\SysWOW64\Eeffpn32.exeC:\Windows\system32\Eeffpn32.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Windows\SysWOW64\Ejcohe32.exeC:\Windows\system32\Ejcohe32.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1616 -
C:\Windows\SysWOW64\Eeicenni.exeC:\Windows\system32\Eeicenni.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2796 -
C:\Windows\SysWOW64\Ejeknelp.exeC:\Windows\system32\Ejeknelp.exe35⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\SysWOW64\Flpkll32.exeC:\Windows\system32\Flpkll32.exe36⤵
- Executes dropped EXE
PID:2152 -
C:\Windows\SysWOW64\Fidkep32.exeC:\Windows\system32\Fidkep32.exe37⤵
- Executes dropped EXE
PID:2128 -
C:\Windows\SysWOW64\Flbgak32.exeC:\Windows\system32\Flbgak32.exe38⤵
- Executes dropped EXE
- Modifies registry class
PID:1760 -
C:\Windows\SysWOW64\Gifhkpgk.exeC:\Windows\system32\Gifhkpgk.exe39⤵
- Executes dropped EXE
PID:2264 -
C:\Windows\SysWOW64\Gkgdbh32.exeC:\Windows\system32\Gkgdbh32.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:288 -
C:\Windows\SysWOW64\Gbolce32.exeC:\Windows\system32\Gbolce32.exe41⤵
- Executes dropped EXE
PID:2036 -
C:\Windows\SysWOW64\Hifdjcif.exeC:\Windows\system32\Hifdjcif.exe42⤵
- Executes dropped EXE
PID:1068 -
C:\Windows\SysWOW64\Hcohbh32.exeC:\Windows\system32\Hcohbh32.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2108 -
C:\Windows\SysWOW64\Hhkakonn.exeC:\Windows\system32\Hhkakonn.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1280 -
C:\Windows\SysWOW64\Hlgmkn32.exeC:\Windows\system32\Hlgmkn32.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1504 -
C:\Windows\SysWOW64\Heoadcmh.exeC:\Windows\system32\Heoadcmh.exe46⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2432 -
C:\Windows\SysWOW64\Hlijan32.exeC:\Windows\system32\Hlijan32.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2008 -
C:\Windows\SysWOW64\Hohfmi32.exeC:\Windows\system32\Hohfmi32.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1096 -
C:\Windows\SysWOW64\Hafbid32.exeC:\Windows\system32\Hafbid32.exe49⤵
- Executes dropped EXE
- Modifies registry class
PID:1948 -
C:\Windows\SysWOW64\Hddoep32.exeC:\Windows\system32\Hddoep32.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1768 -
C:\Windows\SysWOW64\Hllffmbb.exeC:\Windows\system32\Hllffmbb.exe51⤵
- Executes dropped EXE
PID:2376 -
C:\Windows\SysWOW64\Joohmk32.exeC:\Windows\system32\Joohmk32.exe52⤵
- Executes dropped EXE
PID:1568 -
C:\Windows\SysWOW64\Cffejk32.exeC:\Windows\system32\Cffejk32.exe53⤵
- Executes dropped EXE
PID:2416 -
C:\Windows\SysWOW64\Gmjehe32.exeC:\Windows\system32\Gmjehe32.exe54⤵
- Executes dropped EXE
PID:908 -
C:\Windows\SysWOW64\Pkebig32.exeC:\Windows\system32\Pkebig32.exe55⤵
- Executes dropped EXE
PID:2492 -
C:\Windows\SysWOW64\Pcljjd32.exeC:\Windows\system32\Pcljjd32.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2816 -
C:\Windows\SysWOW64\Pdnfalea.exeC:\Windows\system32\Pdnfalea.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2944 -
C:\Windows\SysWOW64\Pldobjec.exeC:\Windows\system32\Pldobjec.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2528 -
C:\Windows\SysWOW64\Pockoeeg.exeC:\Windows\system32\Pockoeeg.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2932 -
C:\Windows\SysWOW64\Pnfkjb32.exeC:\Windows\system32\Pnfkjb32.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2572 -
C:\Windows\SysWOW64\Phkohkkh.exeC:\Windows\system32\Phkohkkh.exe61⤵
- Executes dropped EXE
PID:2208 -
C:\Windows\SysWOW64\Pkjkdfjk.exeC:\Windows\system32\Pkjkdfjk.exe62⤵
- Executes dropped EXE
- Modifies registry class
PID:2360 -
C:\Windows\SysWOW64\Padcqp32.exeC:\Windows\system32\Padcqp32.exe63⤵
- Executes dropped EXE
PID:2540 -
C:\Windows\SysWOW64\Qdbpml32.exeC:\Windows\system32\Qdbpml32.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2648 -
C:\Windows\SysWOW64\Qgqlig32.exeC:\Windows\system32\Qgqlig32.exe65⤵
- Executes dropped EXE
PID:556 -
C:\Windows\SysWOW64\Aqpgblqh.exeC:\Windows\system32\Aqpgblqh.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2568 -
C:\Windows\SysWOW64\Acncngpl.exeC:\Windows\system32\Acncngpl.exe67⤵PID:2268
-
C:\Windows\SysWOW64\Abacjd32.exeC:\Windows\system32\Abacjd32.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1364 -
C:\Windows\SysWOW64\Amgggm32.exeC:\Windows\system32\Amgggm32.exe69⤵PID:2096
-
C:\Windows\SysWOW64\Aoedch32.exeC:\Windows\system32\Aoedch32.exe70⤵PID:1460
-
C:\Windows\SysWOW64\Afolpb32.exeC:\Windows\system32\Afolpb32.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:588 -
C:\Windows\SysWOW64\Amidmldj.exeC:\Windows\system32\Amidmldj.exe72⤵
- Modifies registry class
PID:2224 -
C:\Windows\SysWOW64\Aogqihcm.exeC:\Windows\system32\Aogqihcm.exe73⤵PID:1144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Abfmecba.exeC:\Windows\system32\Abfmecba.exe1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1968 -
C:\Windows\SysWOW64\Aipebm32.exeC:\Windows\system32\Aipebm32.exe2⤵PID:892
-
C:\Windows\SysWOW64\Bgbemjqh.exeC:\Windows\system32\Bgbemjqh.exe3⤵
- Modifies registry class
PID:1536 -
C:\Windows\SysWOW64\Bknani32.exeC:\Windows\system32\Bknani32.exe4⤵PID:3044
-
C:\Windows\SysWOW64\Bbhikcpn.exeC:\Windows\system32\Bbhikcpn.exe5⤵PID:1564
-
C:\Windows\SysWOW64\Begegn32.exeC:\Windows\system32\Begegn32.exe6⤵PID:2844
-
C:\Windows\SysWOW64\Bkqnchgo.exeC:\Windows\system32\Bkqnchgo.exe7⤵PID:528
-
C:\Windows\SysWOW64\Bjcnoe32.exeC:\Windows\system32\Bjcnoe32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1732 -
C:\Windows\SysWOW64\Bbkfpb32.exeC:\Windows\system32\Bbkfpb32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3032 -
C:\Windows\SysWOW64\Cmkmao32.exeC:\Windows\system32\Cmkmao32.exe10⤵
- Drops file in System32 directory
PID:2260 -
C:\Windows\SysWOW64\Cceenilo.exeC:\Windows\system32\Cceenilo.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1200 -
C:\Windows\SysWOW64\Cbhejf32.exeC:\Windows\system32\Cbhejf32.exe12⤵
- Drops file in System32 directory
PID:1980 -
C:\Windows\SysWOW64\Cefbfa32.exeC:\Windows\system32\Cefbfa32.exe13⤵PID:3068
-
C:\Windows\SysWOW64\Cmnjgo32.exeC:\Windows\system32\Cmnjgo32.exe14⤵
- Drops file in System32 directory
- Modifies registry class
PID:3052 -
C:\Windows\SysWOW64\Cplfcj32.exeC:\Windows\system32\Cplfcj32.exe15⤵PID:2484
-
C:\Windows\SysWOW64\Cffnpdip.exeC:\Windows\system32\Cffnpdip.exe16⤵PID:1704
-
C:\Windows\SysWOW64\Cidklp32.exeC:\Windows\system32\Cidklp32.exe17⤵
- Modifies registry class
PID:2380 -
C:\Windows\SysWOW64\Clcghk32.exeC:\Windows\system32\Clcghk32.exe18⤵PID:1592
-
C:\Windows\SysWOW64\Cpnchjpa.exeC:\Windows\system32\Cpnchjpa.exe19⤵PID:2596
-
C:\Windows\SysWOW64\Cbmoeeod.exeC:\Windows\system32\Cbmoeeod.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2056 -
C:\Windows\SysWOW64\Ciggap32.exeC:\Windows\system32\Ciggap32.exe21⤵PID:2008
-
C:\Windows\SysWOW64\Clecnk32.exeC:\Windows\system32\Clecnk32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2740 -
C:\Windows\SysWOW64\Cocpjf32.exeC:\Windows\system32\Cocpjf32.exe23⤵PID:2476
-
C:\Windows\SysWOW64\Cboljemb.exeC:\Windows\system32\Cboljemb.exe24⤵PID:1908
-
C:\Windows\SysWOW64\Cenhfqle.exeC:\Windows\system32\Cenhfqle.exe25⤵
- Modifies registry class
PID:2968 -
C:\Windows\SysWOW64\Dafeaapg.exeC:\Windows\system32\Dafeaapg.exe26⤵PID:1224
-
C:\Windows\SysWOW64\Ddeammok.exeC:\Windows\system32\Ddeammok.exe27⤵PID:2316
-
C:\Windows\SysWOW64\Dgcnihnn.exeC:\Windows\system32\Dgcnihnn.exe28⤵
- Modifies registry class
PID:2760 -
C:\Windows\SysWOW64\Dibjec32.exeC:\Windows\system32\Dibjec32.exe29⤵PID:1976
-
C:\Windows\SysWOW64\Daibfa32.exeC:\Windows\system32\Daibfa32.exe30⤵PID:740
-
C:\Windows\SysWOW64\Ddgnbl32.exeC:\Windows\system32\Ddgnbl32.exe31⤵
- Modifies registry class
PID:1744 -
C:\Windows\SysWOW64\Dgfkoh32.exeC:\Windows\system32\Dgfkoh32.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1680 -
C:\Windows\SysWOW64\Didgkc32.exeC:\Windows\system32\Didgkc32.exe33⤵
- Drops file in System32 directory
PID:1852 -
C:\Windows\SysWOW64\Dlbcgo32.exeC:\Windows\system32\Dlbcgo32.exe34⤵
- Modifies registry class
PID:2148 -
C:\Windows\SysWOW64\Dpnogmbl.exeC:\Windows\system32\Dpnogmbl.exe35⤵
- Drops file in System32 directory
PID:2444 -
C:\Windows\SysWOW64\Dcmkciap.exeC:\Windows\system32\Dcmkciap.exe36⤵PID:2344
-
C:\Windows\SysWOW64\Dekgpdqc.exeC:\Windows\system32\Dekgpdqc.exe37⤵
- Drops file in System32 directory
PID:1172 -
C:\Windows\SysWOW64\Difcpc32.exeC:\Windows\system32\Difcpc32.exe38⤵PID:1792
-
C:\Windows\SysWOW64\Dpqlmm32.exeC:\Windows\system32\Dpqlmm32.exe39⤵PID:1804
-
C:\Windows\SysWOW64\Dgjdjghf.exeC:\Windows\system32\Dgjdjghf.exe40⤵
- Drops file in System32 directory
PID:2396 -
C:\Windows\SysWOW64\Eiipfbgj.exeC:\Windows\system32\Eiipfbgj.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1612 -
C:\Windows\SysWOW64\Elgmbnfn.exeC:\Windows\system32\Elgmbnfn.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2920 -
C:\Windows\SysWOW64\Eoeiniea.exeC:\Windows\system32\Eoeiniea.exe43⤵
- Drops file in System32 directory
PID:2156 -
C:\Windows\SysWOW64\Eadejede.exeC:\Windows\system32\Eadejede.exe44⤵PID:2768
-
C:\Windows\SysWOW64\Eikmkbeg.exeC:\Windows\system32\Eikmkbeg.exe45⤵PID:1628
-
C:\Windows\SysWOW64\Eljihn32.exeC:\Windows\system32\Eljihn32.exe46⤵
- Drops file in System32 directory
PID:984 -
C:\Windows\SysWOW64\Eohedi32.exeC:\Windows\system32\Eohedi32.exe47⤵
- Drops file in System32 directory
PID:2188 -
C:\Windows\SysWOW64\Eebnqcjl.exeC:\Windows\system32\Eebnqcjl.exe48⤵PID:3028
-
C:\Windows\SysWOW64\Ekofijic.exeC:\Windows\system32\Ekofijic.exe49⤵
- Drops file in System32 directory
PID:2500 -
C:\Windows\SysWOW64\Enmbeehg.exeC:\Windows\system32\Enmbeehg.exe50⤵
- Drops file in System32 directory
- Modifies registry class
PID:2220 -
C:\Windows\SysWOW64\Eedjfchi.exeC:\Windows\system32\Eedjfchi.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1684 -
C:\Windows\SysWOW64\Egegnk32.exeC:\Windows\system32\Egegnk32.exe52⤵PID:1068
-
C:\Windows\SysWOW64\Eomoohoi.exeC:\Windows\system32\Eomoohoi.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:912 -
C:\Windows\SysWOW64\Enpoje32.exeC:\Windows\system32\Enpoje32.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1768 -
C:\Windows\SysWOW64\Epnkfq32.exeC:\Windows\system32\Epnkfq32.exe55⤵PID:1380
-
C:\Windows\SysWOW64\Ehechn32.exeC:\Windows\system32\Ehechn32.exe56⤵PID:1864
-
C:\Windows\SysWOW64\Fcfjik32.exeC:\Windows\system32\Fcfjik32.exe57⤵PID:2308
-
C:\Windows\SysWOW64\Ffdgef32.exeC:\Windows\system32\Ffdgef32.exe58⤵
- Drops file in System32 directory
PID:2824 -
C:\Windows\SysWOW64\Fhbcaa32.exeC:\Windows\system32\Fhbcaa32.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1880 -
C:\Windows\SysWOW64\Fkaomm32.exeC:\Windows\system32\Fkaomm32.exe60⤵PID:1072
-
C:\Windows\SysWOW64\Fbkgjgqi.exeC:\Windows\system32\Fbkgjgqi.exe61⤵
- Drops file in System32 directory
- Modifies registry class
PID:2752 -
C:\Windows\SysWOW64\Fdicfbpl.exeC:\Windows\system32\Fdicfbpl.exe62⤵PID:1496
-
C:\Windows\SysWOW64\Gmqlgppo.exeC:\Windows\system32\Gmqlgppo.exe63⤵
- Drops file in System32 directory
PID:776 -
C:\Windows\SysWOW64\Gkclcm32.exeC:\Windows\system32\Gkclcm32.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2884 -
C:\Windows\SysWOW64\Gnahoh32.exeC:\Windows\system32\Gnahoh32.exe65⤵PID:996
-
C:\Windows\SysWOW64\Gfippego.exeC:\Windows\system32\Gfippego.exe66⤵
- Modifies registry class
PID:664 -
C:\Windows\SysWOW64\Gigllafc.exeC:\Windows\system32\Gigllafc.exe67⤵
- Drops file in System32 directory
- Modifies registry class
PID:2424 -
C:\Windows\SysWOW64\Goadik32.exeC:\Windows\system32\Goadik32.exe68⤵PID:1232
-
C:\Windows\SysWOW64\Gndedhdj.exeC:\Windows\system32\Gndedhdj.exe69⤵
- Drops file in System32 directory
PID:2168 -
C:\Windows\SysWOW64\Giiibqdp.exeC:\Windows\system32\Giiibqdp.exe70⤵PID:1620
-
C:\Windows\SysWOW64\Hpodbo32.exeC:\Windows\system32\Hpodbo32.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2248 -
C:\Windows\SysWOW64\Adjhfcbh.exeC:\Windows\system32\Adjhfcbh.exe72⤵PID:2192
-
C:\Windows\SysWOW64\Ajfanjqo.exeC:\Windows\system32\Ajfanjqo.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2160 -
C:\Windows\SysWOW64\Aocifaog.exeC:\Windows\system32\Aocifaog.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2384 -
C:\Windows\SysWOW64\Odgennoi.exeC:\Windows\system32\Odgennoi.exe75⤵
- Drops file in System32 directory
- Modifies registry class
PID:1316 -
C:\Windows\SysWOW64\Mcblob32.exeC:\Windows\system32\Mcblob32.exe76⤵
- Drops file in System32 directory
PID:272 -
C:\Windows\SysWOW64\Mildlmma.exeC:\Windows\system32\Mildlmma.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:300 -
C:\Windows\SysWOW64\Mlkqhhld.exeC:\Windows\system32\Mlkqhhld.exe78⤵PID:2972
-
C:\Windows\SysWOW64\Moimdckh.exeC:\Windows\system32\Moimdckh.exe79⤵PID:2816
-
C:\Windows\SysWOW64\Mgpeealk.exeC:\Windows\system32\Mgpeealk.exe80⤵PID:2552
-
C:\Windows\SysWOW64\Mioaalkn.exeC:\Windows\system32\Mioaalkn.exe81⤵
- Drops file in System32 directory
PID:2388 -
C:\Windows\SysWOW64\Mhaami32.exeC:\Windows\system32\Mhaami32.exe82⤵PID:2540
-
C:\Windows\SysWOW64\Mpiinfbk.exeC:\Windows\system32\Mpiinfbk.exe83⤵PID:2648
-
C:\Windows\SysWOW64\Najfeo32.exeC:\Windows\system32\Najfeo32.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1364 -
C:\Windows\SysWOW64\Nhdnbipf.exeC:\Windows\system32\Nhdnbipf.exe85⤵PID:2224
-
C:\Windows\SysWOW64\Nlojcg32.exeC:\Windows\system32\Nlojcg32.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1580 -
C:\Windows\SysWOW64\Nonfoc32.exeC:\Windows\system32\Nonfoc32.exe87⤵
- Drops file in System32 directory
PID:668 -
C:\Windows\SysWOW64\Nalbkn32.exeC:\Windows\system32\Nalbkn32.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1932 -
C:\Windows\SysWOW64\Nlaghg32.exeC:\Windows\system32\Nlaghg32.exe89⤵
- Modifies registry class
PID:1096 -
C:\Windows\SysWOW64\Nopcdbep.exeC:\Windows\system32\Nopcdbep.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1200 -
C:\Windows\SysWOW64\Nejkam32.exeC:\Windows\system32\Nejkam32.exe91⤵
- Modifies registry class
PID:2380 -
C:\Windows\SysWOW64\Nhhgmh32.exeC:\Windows\system32\Nhhgmh32.exe92⤵
- Drops file in System32 directory
PID:904 -
C:\Windows\SysWOW64\Ngkhiebk.exeC:\Windows\system32\Ngkhiebk.exe93⤵PID:3052
-
C:\Windows\SysWOW64\Nobpjbcn.exeC:\Windows\system32\Nobpjbcn.exe94⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2548 -
C:\Windows\SysWOW64\Naalfnba.exeC:\Windows\system32\Naalfnba.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1896 -
C:\Windows\SysWOW64\Npdlbj32.exeC:\Windows\system32\Npdlbj32.exe96⤵PID:2452
-
C:\Windows\SysWOW64\Nhkdch32.exeC:\Windows\system32\Nhkdch32.exe97⤵PID:2456
-
C:\Windows\SysWOW64\Njlqkpol.exeC:\Windows\system32\Njlqkpol.exe98⤵
- Drops file in System32 directory
PID:2828 -
C:\Windows\SysWOW64\Nnhmkohe.exeC:\Windows\system32\Nnhmkohe.exe99⤵
- Drops file in System32 directory
PID:1244 -
C:\Windows\SysWOW64\Ndaehi32.exeC:\Windows\system32\Ndaehi32.exe100⤵PID:1720
-
C:\Windows\SysWOW64\Ngpadd32.exeC:\Windows\system32\Ngpadd32.exe101⤵PID:2820
-
C:\Windows\SysWOW64\Nklmdcfo.exeC:\Windows\system32\Nklmdcfo.exe102⤵
- Modifies registry class
PID:2068 -
C:\Windows\SysWOW64\Onjianec.exeC:\Windows\system32\Onjianec.exe103⤵PID:772
-
C:\Windows\SysWOW64\Oqhemjef.exeC:\Windows\system32\Oqhemjef.exe104⤵
- Modifies registry class
PID:1796 -
C:\Windows\SysWOW64\Oddanh32.exeC:\Windows\system32\Oddanh32.exe105⤵PID:924
-
C:\Windows\SysWOW64\Ogbnjd32.exeC:\Windows\system32\Ogbnjd32.exe106⤵PID:820
-
C:\Windows\SysWOW64\Ofeneqcn.exeC:\Windows\system32\Ofeneqcn.exe107⤵
- Modifies registry class
PID:1216 -
C:\Windows\SysWOW64\Onlffncp.exeC:\Windows\system32\Onlffncp.exe108⤵PID:1436
-
C:\Windows\SysWOW64\Oqkbbi32.exeC:\Windows\system32\Oqkbbi32.exe109⤵PID:2004
-
C:\Windows\SysWOW64\Oonbnfio.exeC:\Windows\system32\Oonbnfio.exe110⤵
- Drops file in System32 directory
PID:1956 -
C:\Windows\SysWOW64\Ogejocjq.exeC:\Windows\system32\Ogejocjq.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:548 -
C:\Windows\SysWOW64\Ojcgkoid.exeC:\Windows\system32\Ojcgkoid.exe112⤵
- Drops file in System32 directory
PID:276 -
C:\Windows\SysWOW64\Omacgjhh.exeC:\Windows\system32\Omacgjhh.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2044 -
C:\Windows\SysWOW64\Oopocfgl.exeC:\Windows\system32\Oopocfgl.exe114⤵PID:2436
-
C:\Windows\SysWOW64\Obnkpafp.exeC:\Windows\system32\Obnkpafp.exe115⤵PID:2020
-
C:\Windows\SysWOW64\Ofjgpp32.exeC:\Windows\system32\Ofjgpp32.exe116⤵PID:2864
-
C:\Windows\SysWOW64\Omdpmjfe.exeC:\Windows\system32\Omdpmjfe.exe117⤵PID:1464
-
C:\Windows\SysWOW64\Obcekq32.exeC:\Windows\system32\Obcekq32.exe118⤵PID:2832
-
C:\Windows\SysWOW64\Pfoakokc.exeC:\Windows\system32\Pfoakokc.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2944 -
C:\Windows\SysWOW64\Pimmgkjg.exeC:\Windows\system32\Pimmgkjg.exe120⤵PID:2292
-
C:\Windows\SysWOW64\Pkkicfik.exeC:\Windows\system32\Pkkicfik.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2688 -
C:\Windows\SysWOW64\Pnjepahn.exeC:\Windows\system32\Pnjepahn.exe122⤵
- Modifies registry class
PID:1616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-