Analysis
-
max time kernel
155s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 17:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.531d50cc5729cfde57b8cf363c19a4c0.exe
Resource
win7-20230831-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.531d50cc5729cfde57b8cf363c19a4c0.exe
Resource
win10v2004-20230915-en
5 signatures
150 seconds
General
-
Target
NEAS.531d50cc5729cfde57b8cf363c19a4c0.exe
-
Size
378KB
-
MD5
531d50cc5729cfde57b8cf363c19a4c0
-
SHA1
d9ddcc6cc6e161b735ad7b65633c2a102117f670
-
SHA256
7b583f8b2519e1966bf4dfeefb56a3ccfde2b9a568c16fa6003554d7e7fee96b
-
SHA512
98d5c58a4495588d8ae5fa430bde68b65340d2f297af04e9775dba378c8bae6ecb0eb4a194f9bb0682968daf2b86d3392b3aff6e68853db3f26ec0864c9c6827
-
SSDEEP
6144:5R9qdMAeglEUeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GT9:5OMA1WUeYr75lTefkY660fIaDZkY6605
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jabgkpad.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Neppiagi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Agdhln32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nkagndmc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Opbean32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Midfiq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oplfkeob.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nlglpkpi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dabhmo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hboaql32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bqhlpbjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ccpkblqn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eplnijdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ibjibg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pllnbh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lpilcnoo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmipkb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hphglf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oeqagi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knpmcl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfmlok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jmpnppap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nlglpkpi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nqlbqlmm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Khifno32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knbiil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Emoaopnf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjlgnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fagjolao.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jaimko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Olehai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iiffoc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmmifaci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pgaelcgm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ccpkblqn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olehai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pfmlok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jakkplbc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hapancai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lfeaegdi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmcdolbn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohbfeh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpaikm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kgnbol32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Edcqojqh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pgllad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Djhpqdlj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eidbbp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fabqdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jqdoob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ccbhhl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijogfj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bngfli32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idnfal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ppmleagi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kpfonnab.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngjcgdba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jjoeoedo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jkggfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jhocgqjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oiagcg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olgdgibf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Edcqojqh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ohlqcagj.exe -
Executes dropped EXE 64 IoCs
pid Process 2952 Nfcabp32.exe 4800 Oplfkeob.exe 392 Ojdgnn32.exe 4012 Opqofe32.exe 2092 Omgmeigd.exe 2444 Ohlqcagj.exe 4208 Ppgegd32.exe 2560 Qdaniq32.exe 4544 Mfenglqf.exe 416 Nciopppp.exe 2744 Noppeaed.exe 3576 Nhhdnf32.exe 380 Nijqcf32.exe 548 Njjmni32.exe 4048 Ofjqihnn.exe 1932 Opbean32.exe 4752 Omfekbdh.exe 3216 Pjjfdfbb.exe 2948 Ppgomnai.exe 3192 Pbhgoh32.exe 3724 Paihlpfi.exe 3196 Adgmoigj.exe 1728 Ampaho32.exe 4976 Bmbnnn32.exe 1504 Biiobo32.exe 2760 Cpljehpo.exe 1540 Cgfbbb32.exe 4864 Cpogkhnl.exe 2056 Ccppmc32.exe 2644 Caqpkjcl.exe 3808 Ddcebe32.exe 3744 Dalofi32.exe 3356 Enemaimp.exe 4044 Eaceghcg.exe 2292 Enjfli32.exe 2404 Iqpclh32.exe 3988 Iedbcebd.exe 2736 Jfkhfmdm.exe 996 Jmijnfgd.exe 4592 Khonkogj.exe 1012 Kaioidkh.exe 2588 Keghocao.exe 3728 Kejeebpl.exe 836 Lfmnbjcg.exe 4032 Lhogamih.exe 4128 Lmlpjdgo.exe 3272 Lokldg32.exe 4868 Mehafq32.exe 2408 Mopeofjl.exe 2696 Mgkjch32.exe 860 Mhkgnkoj.exe 5028 Moeoje32.exe 3460 Mdddhlbl.exe 4380 Nahdapae.exe 3448 Ndinck32.exe 4088 Oeamcmmo.exe 244 Oojalb32.exe 1300 Ohbfeh32.exe 4104 Oeffnl32.exe 4580 Okcogc32.exe 4204 Poagma32.exe 1312 Pgllad32.exe 1164 Pfmlok32.exe 904 Poeahaib.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Mgceqh32.exe Mqimdomb.exe File created C:\Windows\SysWOW64\Pmboib32.dll Pijiif32.exe File created C:\Windows\SysWOW64\Clfofd32.dll Hidpbf32.exe File opened for modification C:\Windows\SysWOW64\Idnfal32.exe Ijfbhflj.exe File created C:\Windows\SysWOW64\Lafmjb32.dll Nohdaf32.exe File created C:\Windows\SysWOW64\Oojalb32.exe Oeamcmmo.exe File created C:\Windows\SysWOW64\Pfmlok32.exe Pgllad32.exe File created C:\Windows\SysWOW64\Kpkqbq32.exe Kddpnpdn.exe File opened for modification C:\Windows\SysWOW64\Olehai32.exe Oekpdoll.exe File created C:\Windows\SysWOW64\Cfhani32.exe Bciebm32.exe File opened for modification C:\Windows\SysWOW64\Emkeho32.exe Efamkepl.exe File opened for modification C:\Windows\SysWOW64\Mcgbfcij.exe Mjnnmn32.exe File created C:\Windows\SysWOW64\Dpekndfg.dll Kpbfbo32.exe File created C:\Windows\SysWOW64\Olqofjhn.exe Oeffip32.exe File created C:\Windows\SysWOW64\Oehpnnpl.dll Jhapmphg.exe File created C:\Windows\SysWOW64\Jdjfmjhm.exe Jmpnppap.exe File opened for modification C:\Windows\SysWOW64\Kpjjhj32.exe Kanffogf.exe File created C:\Windows\SysWOW64\Ckpghq32.dll Ifglmlol.exe File created C:\Windows\SysWOW64\Ojmmch32.dll Llpmhodc.exe File created C:\Windows\SysWOW64\Akbleaaf.dll Licfgmpa.exe File opened for modification C:\Windows\SysWOW64\Mehafq32.exe Lokldg32.exe File created C:\Windows\SysWOW64\Adlodhhl.dll Jmkdeaee.exe File created C:\Windows\SysWOW64\Mcgbfcij.exe Mjnnmn32.exe File created C:\Windows\SysWOW64\Kfehoj32.exe Jpkpbpko.exe File created C:\Windows\SysWOW64\Kelcga32.dll Aihaifam.exe File created C:\Windows\SysWOW64\Eplnijdj.exe Efdjqeni.exe File created C:\Windows\SysWOW64\Pdhpfleg.dll Gmcdolbn.exe File created C:\Windows\SysWOW64\Dfbjkg32.dll Ampaho32.exe File created C:\Windows\SysWOW64\Bpfcelml.exe Beaohcmf.exe File created C:\Windows\SysWOW64\Eflhiolf.exe Dphipidf.exe File created C:\Windows\SysWOW64\Gielinlg.exe Ghdoae32.exe File opened for modification C:\Windows\SysWOW64\Idieob32.exe Ibjibg32.exe File created C:\Windows\SysWOW64\Hiaqbf32.dll Jbobnf32.exe File opened for modification C:\Windows\SysWOW64\Kndodehf.exe Kgjggkqi.exe File created C:\Windows\SysWOW64\Kaioidkh.exe Khonkogj.exe File created C:\Windows\SysWOW64\Jldpnbmh.dll Pfmlok32.exe File created C:\Windows\SysWOW64\Hldlmc32.dll Dgliapic.exe File created C:\Windows\SysWOW64\Bihnci32.dll Oekpdoll.exe File created C:\Windows\SysWOW64\Jfnnap32.dll Ijadljdg.exe File created C:\Windows\SysWOW64\Jondojna.exe Jhapmphg.exe File created C:\Windows\SysWOW64\Jbhmnhcm.exe Jmkdeaee.exe File created C:\Windows\SysWOW64\Jfbkijdo.exe Jnkchmdl.exe File opened for modification C:\Windows\SysWOW64\Pgihppgo.exe Ppopcf32.exe File opened for modification C:\Windows\SysWOW64\Cfhani32.exe Bciebm32.exe File created C:\Windows\SysWOW64\Geifpj32.dll Jkggfl32.exe File opened for modification C:\Windows\SysWOW64\Jgqdal32.exe Jqgldb32.exe File opened for modification C:\Windows\SysWOW64\Lhogamih.exe Lfmnbjcg.exe File created C:\Windows\SysWOW64\Nieggill.exe Nkagndmc.exe File created C:\Windows\SysWOW64\Bafgdfim.exe Ahnclp32.exe File opened for modification C:\Windows\SysWOW64\Oiagcg32.exe Opfedb32.exe File created C:\Windows\SysWOW64\Nkhkmnca.dll Mjqjbn32.exe File created C:\Windows\SysWOW64\Enjfli32.exe Eaceghcg.exe File created C:\Windows\SysWOW64\Bpicmhfo.dll Moeoje32.exe File created C:\Windows\SysWOW64\Jcifjf32.dll Bpfcelml.exe File opened for modification C:\Windows\SysWOW64\Jiageecb.exe Jfbkijdo.exe File created C:\Windows\SysWOW64\Hiobif32.dll Cfjnch32.exe File created C:\Windows\SysWOW64\Kmecqhcl.dll Dpckclld.exe File opened for modification C:\Windows\SysWOW64\Dabhmo32.exe Djhpqdlj.exe File opened for modification C:\Windows\SysWOW64\Nciopppp.exe Mfenglqf.exe File created C:\Windows\SysWOW64\Khonkogj.exe Jmijnfgd.exe File opened for modification C:\Windows\SysWOW64\Mgebfhcl.exe Mgceqh32.exe File created C:\Windows\SysWOW64\Kdehpnep.dll Ccednl32.exe File created C:\Windows\SysWOW64\Hphglf32.exe Gjnnoldm.exe File created C:\Windows\SysWOW64\Kaabkj32.dll Hnlgekkc.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kpjjhj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Meadgc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oidopn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Djomjfde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlqidj32.dll" Bnppkj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Anncek32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lflpmn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pbdmdlie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Paihlpfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jahadh32.dll" Qomghp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojmmch32.dll" Llpmhodc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nleojlbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cfhani32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ibjibg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Omfekbdh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejohcl32.dll" Mpdkol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkloef32.dll" Iffmmihf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkmghc32.dll" Hapancai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Opnglhnd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eplnijdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fchpnh32.dll" Effffd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiaqbf32.dll" Jbobnf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdphod32.dll" Jqdoob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hojmqm32.dll" Kghjakbl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aoenbkll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nohdaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbokheno.dll" Idljll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iineacpp.dll" Qbekgknb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kpjjhj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibhjkk32.dll" Jnklnfpq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blqhpg32.dll" Nfcabp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lqdcio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmboib32.dll" Pijiif32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pgihppgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdhpfleg.dll" Gmcdolbn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ppgomnai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gmcdolbn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeogjckh.dll" Dnjdncio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gpioca32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gcggjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Knefnkla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qomghp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Qbekgknb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjiqiemm.dll" Kaioidkh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kacgld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ccednl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jmjojh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Poagma32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dnjdncio.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Edcqojqh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fagjolao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oeamcmmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paenokbf.dll" Paihlpfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oehpnnpl.dll" Jhapmphg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Iippne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oheofn32.dll" Jbhmnhcm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jiageecb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nifcnpch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oenljoji.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pjjfdfbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gielinlg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ibhlmgdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fpagdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Idnfal32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4888 wrote to memory of 2952 4888 NEAS.531d50cc5729cfde57b8cf363c19a4c0.exe 87 PID 4888 wrote to memory of 2952 4888 NEAS.531d50cc5729cfde57b8cf363c19a4c0.exe 87 PID 4888 wrote to memory of 2952 4888 NEAS.531d50cc5729cfde57b8cf363c19a4c0.exe 87 PID 2952 wrote to memory of 4800 2952 Nfcabp32.exe 88 PID 2952 wrote to memory of 4800 2952 Nfcabp32.exe 88 PID 2952 wrote to memory of 4800 2952 Nfcabp32.exe 88 PID 4800 wrote to memory of 392 4800 Oplfkeob.exe 90 PID 4800 wrote to memory of 392 4800 Oplfkeob.exe 90 PID 4800 wrote to memory of 392 4800 Oplfkeob.exe 90 PID 392 wrote to memory of 4012 392 Ojdgnn32.exe 91 PID 392 wrote to memory of 4012 392 Ojdgnn32.exe 91 PID 392 wrote to memory of 4012 392 Ojdgnn32.exe 91 PID 4012 wrote to memory of 2092 4012 Opqofe32.exe 92 PID 4012 wrote to memory of 2092 4012 Opqofe32.exe 92 PID 4012 wrote to memory of 2092 4012 Opqofe32.exe 92 PID 2092 wrote to memory of 2444 2092 Omgmeigd.exe 93 PID 2092 wrote to memory of 2444 2092 Omgmeigd.exe 93 PID 2092 wrote to memory of 2444 2092 Omgmeigd.exe 93 PID 2444 wrote to memory of 4208 2444 Ohlqcagj.exe 94 PID 2444 wrote to memory of 4208 2444 Ohlqcagj.exe 94 PID 2444 wrote to memory of 4208 2444 Ohlqcagj.exe 94 PID 4208 wrote to memory of 2560 4208 Ppgegd32.exe 95 PID 4208 wrote to memory of 2560 4208 Ppgegd32.exe 95 PID 4208 wrote to memory of 2560 4208 Ppgegd32.exe 95 PID 2560 wrote to memory of 4544 2560 Qdaniq32.exe 96 PID 2560 wrote to memory of 4544 2560 Qdaniq32.exe 96 PID 2560 wrote to memory of 4544 2560 Qdaniq32.exe 96 PID 4544 wrote to memory of 416 4544 Mfenglqf.exe 100 PID 4544 wrote to memory of 416 4544 Mfenglqf.exe 100 PID 4544 wrote to memory of 416 4544 Mfenglqf.exe 100 PID 416 wrote to memory of 2744 416 Nciopppp.exe 98 PID 416 wrote to memory of 2744 416 Nciopppp.exe 98 PID 416 wrote to memory of 2744 416 Nciopppp.exe 98 PID 2744 wrote to memory of 3576 2744 Noppeaed.exe 97 PID 2744 wrote to memory of 3576 2744 Noppeaed.exe 97 PID 2744 wrote to memory of 3576 2744 Noppeaed.exe 97 PID 3576 wrote to memory of 380 3576 Nhhdnf32.exe 99 PID 3576 wrote to memory of 380 3576 Nhhdnf32.exe 99 PID 3576 wrote to memory of 380 3576 Nhhdnf32.exe 99 PID 380 wrote to memory of 548 380 Nijqcf32.exe 101 PID 380 wrote to memory of 548 380 Nijqcf32.exe 101 PID 380 wrote to memory of 548 380 Nijqcf32.exe 101 PID 548 wrote to memory of 4048 548 Njjmni32.exe 102 PID 548 wrote to memory of 4048 548 Njjmni32.exe 102 PID 548 wrote to memory of 4048 548 Njjmni32.exe 102 PID 4048 wrote to memory of 1932 4048 Ofjqihnn.exe 103 PID 4048 wrote to memory of 1932 4048 Ofjqihnn.exe 103 PID 4048 wrote to memory of 1932 4048 Ofjqihnn.exe 103 PID 1932 wrote to memory of 4752 1932 Opbean32.exe 104 PID 1932 wrote to memory of 4752 1932 Opbean32.exe 104 PID 1932 wrote to memory of 4752 1932 Opbean32.exe 104 PID 4752 wrote to memory of 3216 4752 Omfekbdh.exe 107 PID 4752 wrote to memory of 3216 4752 Omfekbdh.exe 107 PID 4752 wrote to memory of 3216 4752 Omfekbdh.exe 107 PID 3216 wrote to memory of 2948 3216 Pjjfdfbb.exe 105 PID 3216 wrote to memory of 2948 3216 Pjjfdfbb.exe 105 PID 3216 wrote to memory of 2948 3216 Pjjfdfbb.exe 105 PID 2948 wrote to memory of 3192 2948 Ppgomnai.exe 106 PID 2948 wrote to memory of 3192 2948 Ppgomnai.exe 106 PID 2948 wrote to memory of 3192 2948 Ppgomnai.exe 106 PID 3192 wrote to memory of 3724 3192 Pbhgoh32.exe 108 PID 3192 wrote to memory of 3724 3192 Pbhgoh32.exe 108 PID 3192 wrote to memory of 3724 3192 Pbhgoh32.exe 108 PID 3724 wrote to memory of 3196 3724 Paihlpfi.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.531d50cc5729cfde57b8cf363c19a4c0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.531d50cc5729cfde57b8cf363c19a4c0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\Nfcabp32.exeC:\Windows\system32\Nfcabp32.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\Oplfkeob.exeC:\Windows\system32\Oplfkeob.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\Ojdgnn32.exeC:\Windows\system32\Ojdgnn32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\SysWOW64\Opqofe32.exeC:\Windows\system32\Opqofe32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\SysWOW64\Omgmeigd.exeC:\Windows\system32\Omgmeigd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\Ohlqcagj.exeC:\Windows\system32\Ohlqcagj.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\Ppgegd32.exeC:\Windows\system32\Ppgegd32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\Qdaniq32.exeC:\Windows\system32\Qdaniq32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\Mfenglqf.exeC:\Windows\system32\Mfenglqf.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\Nciopppp.exeC:\Windows\system32\Nciopppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Nhhdnf32.exeC:\Windows\system32\Nhhdnf32.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\Nijqcf32.exeC:\Windows\system32\Nijqcf32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\SysWOW64\Njjmni32.exeC:\Windows\system32\Njjmni32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\Ofjqihnn.exeC:\Windows\system32\Ofjqihnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\Opbean32.exeC:\Windows\system32\Opbean32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\Omfekbdh.exeC:\Windows\system32\Omfekbdh.exe6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\Pjjfdfbb.exeC:\Windows\system32\Pjjfdfbb.exe7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3216
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Noppeaed.exeC:\Windows\system32\Noppeaed.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744
-
C:\Windows\SysWOW64\Ppgomnai.exeC:\Windows\system32\Ppgomnai.exe1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\Pbhgoh32.exeC:\Windows\system32\Pbhgoh32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\Paihlpfi.exeC:\Windows\system32\Paihlpfi.exe3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\Adgmoigj.exeC:\Windows\system32\Adgmoigj.exe4⤵
- Executes dropped EXE
PID:3196 -
C:\Windows\SysWOW64\Ampaho32.exeC:\Windows\system32\Ampaho32.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1728 -
C:\Windows\SysWOW64\Bmbnnn32.exeC:\Windows\system32\Bmbnnn32.exe6⤵
- Executes dropped EXE
PID:4976 -
C:\Windows\SysWOW64\Biiobo32.exeC:\Windows\system32\Biiobo32.exe7⤵
- Executes dropped EXE
PID:1504 -
C:\Windows\SysWOW64\Cpljehpo.exeC:\Windows\system32\Cpljehpo.exe8⤵
- Executes dropped EXE
PID:2760
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Cgfbbb32.exeC:\Windows\system32\Cgfbbb32.exe1⤵
- Executes dropped EXE
PID:1540 -
C:\Windows\SysWOW64\Cpogkhnl.exeC:\Windows\system32\Cpogkhnl.exe2⤵
- Executes dropped EXE
PID:4864 -
C:\Windows\SysWOW64\Ccppmc32.exeC:\Windows\system32\Ccppmc32.exe3⤵
- Executes dropped EXE
PID:2056 -
C:\Windows\SysWOW64\Caqpkjcl.exeC:\Windows\system32\Caqpkjcl.exe4⤵
- Executes dropped EXE
PID:2644 -
C:\Windows\SysWOW64\Ddcebe32.exeC:\Windows\system32\Ddcebe32.exe5⤵
- Executes dropped EXE
PID:3808 -
C:\Windows\SysWOW64\Dalofi32.exeC:\Windows\system32\Dalofi32.exe6⤵
- Executes dropped EXE
PID:3744 -
C:\Windows\SysWOW64\Enemaimp.exeC:\Windows\system32\Enemaimp.exe7⤵
- Executes dropped EXE
PID:3356 -
C:\Windows\SysWOW64\Eaceghcg.exeC:\Windows\system32\Eaceghcg.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4044 -
C:\Windows\SysWOW64\Enjfli32.exeC:\Windows\system32\Enjfli32.exe9⤵
- Executes dropped EXE
PID:2292 -
C:\Windows\SysWOW64\Iqpclh32.exeC:\Windows\system32\Iqpclh32.exe10⤵
- Executes dropped EXE
PID:2404 -
C:\Windows\SysWOW64\Iedbcebd.exeC:\Windows\system32\Iedbcebd.exe11⤵
- Executes dropped EXE
PID:3988 -
C:\Windows\SysWOW64\Jfkhfmdm.exeC:\Windows\system32\Jfkhfmdm.exe12⤵
- Executes dropped EXE
PID:2736 -
C:\Windows\SysWOW64\Jmijnfgd.exeC:\Windows\system32\Jmijnfgd.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:996 -
C:\Windows\SysWOW64\Khonkogj.exeC:\Windows\system32\Khonkogj.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4592 -
C:\Windows\SysWOW64\Kaioidkh.exeC:\Windows\system32\Kaioidkh.exe15⤵
- Executes dropped EXE
- Modifies registry class
PID:1012 -
C:\Windows\SysWOW64\Khcgfo32.exeC:\Windows\system32\Khcgfo32.exe16⤵PID:2160
-
C:\Windows\SysWOW64\Keghocao.exeC:\Windows\system32\Keghocao.exe17⤵
- Executes dropped EXE
PID:2588 -
C:\Windows\SysWOW64\Kejeebpl.exeC:\Windows\system32\Kejeebpl.exe18⤵
- Executes dropped EXE
PID:3728 -
C:\Windows\SysWOW64\Lfmnbjcg.exeC:\Windows\system32\Lfmnbjcg.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:836 -
C:\Windows\SysWOW64\Lhogamih.exeC:\Windows\system32\Lhogamih.exe20⤵
- Executes dropped EXE
PID:4032 -
C:\Windows\SysWOW64\Lmlpjdgo.exeC:\Windows\system32\Lmlpjdgo.exe21⤵
- Executes dropped EXE
PID:4128 -
C:\Windows\SysWOW64\Lokldg32.exeC:\Windows\system32\Lokldg32.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3272 -
C:\Windows\SysWOW64\Mehafq32.exeC:\Windows\system32\Mehafq32.exe23⤵
- Executes dropped EXE
PID:4868 -
C:\Windows\SysWOW64\Mopeofjl.exeC:\Windows\system32\Mopeofjl.exe24⤵
- Executes dropped EXE
PID:2408 -
C:\Windows\SysWOW64\Mgkjch32.exeC:\Windows\system32\Mgkjch32.exe25⤵
- Executes dropped EXE
PID:2696 -
C:\Windows\SysWOW64\Mhkgnkoj.exeC:\Windows\system32\Mhkgnkoj.exe26⤵
- Executes dropped EXE
PID:860 -
C:\Windows\SysWOW64\Moeoje32.exeC:\Windows\system32\Moeoje32.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5028 -
C:\Windows\SysWOW64\Mdddhlbl.exeC:\Windows\system32\Mdddhlbl.exe28⤵
- Executes dropped EXE
PID:3460 -
C:\Windows\SysWOW64\Nahdapae.exeC:\Windows\system32\Nahdapae.exe29⤵
- Executes dropped EXE
PID:4380 -
C:\Windows\SysWOW64\Ndinck32.exeC:\Windows\system32\Ndinck32.exe30⤵
- Executes dropped EXE
PID:3448 -
C:\Windows\SysWOW64\Oeamcmmo.exeC:\Windows\system32\Oeamcmmo.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4088 -
C:\Windows\SysWOW64\Oojalb32.exeC:\Windows\system32\Oojalb32.exe32⤵
- Executes dropped EXE
PID:244 -
C:\Windows\SysWOW64\Ohbfeh32.exeC:\Windows\system32\Ohbfeh32.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1300 -
C:\Windows\SysWOW64\Oeffnl32.exeC:\Windows\system32\Oeffnl32.exe34⤵
- Executes dropped EXE
PID:4104 -
C:\Windows\SysWOW64\Okcogc32.exeC:\Windows\system32\Okcogc32.exe35⤵
- Executes dropped EXE
PID:4580 -
C:\Windows\SysWOW64\Poagma32.exeC:\Windows\system32\Poagma32.exe36⤵
- Executes dropped EXE
- Modifies registry class
PID:4204 -
C:\Windows\SysWOW64\Pgllad32.exeC:\Windows\system32\Pgllad32.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1312 -
C:\Windows\SysWOW64\Pfmlok32.exeC:\Windows\system32\Pfmlok32.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1164 -
C:\Windows\SysWOW64\Poeahaib.exeC:\Windows\system32\Poeahaib.exe39⤵
- Executes dropped EXE
PID:904 -
C:\Windows\SysWOW64\Pbdmdlie.exeC:\Windows\system32\Pbdmdlie.exe40⤵
- Modifies registry class
PID:3824 -
C:\Windows\SysWOW64\Pgaelcgm.exeC:\Windows\system32\Pgaelcgm.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1228 -
C:\Windows\SysWOW64\Pbfjjlgc.exeC:\Windows\system32\Pbfjjlgc.exe42⤵PID:2888
-
C:\Windows\SysWOW64\Pnmjomlg.exeC:\Windows\system32\Pnmjomlg.exe43⤵PID:3796
-
C:\Windows\SysWOW64\Qomghp32.exeC:\Windows\system32\Qomghp32.exe44⤵
- Modifies registry class
PID:4800 -
C:\Windows\SysWOW64\Qghlmbae.exeC:\Windows\system32\Qghlmbae.exe45⤵PID:3396
-
C:\Windows\SysWOW64\Ankgpk32.exeC:\Windows\system32\Ankgpk32.exe46⤵PID:4392
-
C:\Windows\SysWOW64\Agckiqgg.exeC:\Windows\system32\Agckiqgg.exe47⤵PID:1488
-
C:\Windows\SysWOW64\Anncek32.exeC:\Windows\system32\Anncek32.exe48⤵
- Modifies registry class
PID:2952 -
C:\Windows\SysWOW64\Bkadoo32.exeC:\Windows\system32\Bkadoo32.exe49⤵PID:2908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Bnppkj32.exeC:\Windows\system32\Bnppkj32.exe1⤵
- Modifies registry class
PID:4536 -
C:\Windows\SysWOW64\Bfghlhmd.exeC:\Windows\system32\Bfghlhmd.exe2⤵PID:2808
-
C:\Windows\SysWOW64\Bpomem32.exeC:\Windows\system32\Bpomem32.exe3⤵PID:960
-
C:\Windows\SysWOW64\Bihancje.exeC:\Windows\system32\Bihancje.exe4⤵PID:392
-
C:\Windows\SysWOW64\Bpaikm32.exeC:\Windows\system32\Bpaikm32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2688 -
C:\Windows\SysWOW64\Bgmnooom.exeC:\Windows\system32\Bgmnooom.exe6⤵PID:4260
-
C:\Windows\SysWOW64\Bngfli32.exeC:\Windows\system32\Bngfli32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1472 -
C:\Windows\SysWOW64\Beaohcmf.exeC:\Windows\system32\Beaohcmf.exe8⤵
- Drops file in System32 directory
PID:3240 -
C:\Windows\SysWOW64\Bpfcelml.exeC:\Windows\system32\Bpfcelml.exe9⤵
- Drops file in System32 directory
PID:3404 -
C:\Windows\SysWOW64\Bfpkbfdi.exeC:\Windows\system32\Bfpkbfdi.exe10⤵PID:3384
-
C:\Windows\SysWOW64\Cgagjo32.exeC:\Windows\system32\Cgagjo32.exe11⤵PID:5168
-
C:\Windows\SysWOW64\Capkim32.exeC:\Windows\system32\Capkim32.exe12⤵PID:5340
-
C:\Windows\SysWOW64\Lflpmn32.exeC:\Windows\system32\Lflpmn32.exe13⤵
- Modifies registry class
PID:5396 -
C:\Windows\SysWOW64\Dgliapic.exeC:\Windows\system32\Dgliapic.exe14⤵
- Drops file in System32 directory
PID:5496 -
C:\Windows\SysWOW64\Jakkplbc.exeC:\Windows\system32\Jakkplbc.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5652 -
C:\Windows\SysWOW64\Olidijjf.exeC:\Windows\system32\Olidijjf.exe16⤵PID:5820
-
C:\Windows\SysWOW64\Dnjdncio.exeC:\Windows\system32\Dnjdncio.exe17⤵
- Modifies registry class
PID:5860 -
C:\Windows\SysWOW64\Dqhpjohb.exeC:\Windows\system32\Dqhpjohb.exe18⤵PID:5908
-
C:\Windows\SysWOW64\Dcglfjgf.exeC:\Windows\system32\Dcglfjgf.exe19⤵PID:5988
-
C:\Windows\SysWOW64\Emoaopnf.exeC:\Windows\system32\Emoaopnf.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6072 -
C:\Windows\SysWOW64\Iandjg32.exeC:\Windows\system32\Iandjg32.exe21⤵PID:6120
-
C:\Windows\SysWOW64\Jmjojh32.exeC:\Windows\system32\Jmjojh32.exe22⤵
- Modifies registry class
PID:2964 -
C:\Windows\SysWOW64\Jhocgqjj.exeC:\Windows\system32\Jhocgqjj.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5012 -
C:\Windows\SysWOW64\Jhapmphg.exeC:\Windows\system32\Jhapmphg.exe24⤵
- Drops file in System32 directory
- Modifies registry class
PID:4848 -
C:\Windows\SysWOW64\Jondojna.exeC:\Windows\system32\Jondojna.exe25⤵PID:380
-
C:\Windows\SysWOW64\Jalakeme.exeC:\Windows\system32\Jalakeme.exe26⤵PID:2256
-
C:\Windows\SysWOW64\Jgiiclkl.exeC:\Windows\system32\Jgiiclkl.exe27⤵PID:1600
-
C:\Windows\SysWOW64\Jncapf32.exeC:\Windows\system32\Jncapf32.exe28⤵PID:4780
-
C:\Windows\SysWOW64\Khifno32.exeC:\Windows\system32\Khifno32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:988 -
C:\Windows\SysWOW64\Kpdjbapj.exeC:\Windows\system32\Kpdjbapj.exe30⤵PID:5008
-
C:\Windows\SysWOW64\Kgnbol32.exeC:\Windows\system32\Kgnbol32.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4884 -
C:\Windows\SysWOW64\Kacgld32.exeC:\Windows\system32\Kacgld32.exe32⤵
- Modifies registry class
PID:5176 -
C:\Windows\SysWOW64\Kgpodk32.exeC:\Windows\system32\Kgpodk32.exe33⤵PID:3912
-
C:\Windows\SysWOW64\Knjhae32.exeC:\Windows\system32\Knjhae32.exe34⤵PID:5196
-
C:\Windows\SysWOW64\Kddpnpdn.exeC:\Windows\system32\Kddpnpdn.exe35⤵
- Drops file in System32 directory
PID:4008 -
C:\Windows\SysWOW64\Kpkqbq32.exeC:\Windows\system32\Kpkqbq32.exe36⤵PID:5388
-
C:\Windows\SysWOW64\Kolaqh32.exeC:\Windows\system32\Kolaqh32.exe37⤵PID:5420
-
C:\Windows\SysWOW64\Lhgbomfo.exeC:\Windows\system32\Lhgbomfo.exe38⤵PID:4528
-
C:\Windows\SysWOW64\Lglopjkg.exeC:\Windows\system32\Lglopjkg.exe39⤵PID:5504
-
C:\Windows\SysWOW64\Lqdcio32.exeC:\Windows\system32\Lqdcio32.exe40⤵
- Modifies registry class
PID:4084 -
C:\Windows\SysWOW64\Lgnleiid.exeC:\Windows\system32\Lgnleiid.exe41⤵PID:1440
-
C:\Windows\SysWOW64\Ladpcb32.exeC:\Windows\system32\Ladpcb32.exe42⤵PID:4592
-
C:\Windows\SysWOW64\Mqimdomb.exeC:\Windows\system32\Mqimdomb.exe43⤵
- Drops file in System32 directory
PID:5112 -
C:\Windows\SysWOW64\Mgceqh32.exeC:\Windows\system32\Mgceqh32.exe44⤵
- Drops file in System32 directory
PID:3776 -
C:\Windows\SysWOW64\Mgebfhcl.exeC:\Windows\system32\Mgebfhcl.exe45⤵PID:3080
-
C:\Windows\SysWOW64\Mbkfcabb.exeC:\Windows\system32\Mbkfcabb.exe46⤵PID:5624
-
C:\Windows\SysWOW64\Mgjkag32.exeC:\Windows\system32\Mgjkag32.exe47⤵PID:5632
-
C:\Windows\SysWOW64\Nnimia32.exeC:\Windows\system32\Nnimia32.exe48⤵PID:5080
-
C:\Windows\SysWOW64\Nqlbqlmm.exeC:\Windows\system32\Nqlbqlmm.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2524 -
C:\Windows\SysWOW64\Nkagndmc.exeC:\Windows\system32\Nkagndmc.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5696 -
C:\Windows\SysWOW64\Nieggill.exeC:\Windows\system32\Nieggill.exe51⤵PID:2872
-
C:\Windows\SysWOW64\Okhmnc32.exeC:\Windows\system32\Okhmnc32.exe52⤵PID:5728
-
C:\Windows\SysWOW64\Oeqagi32.exeC:\Windows\system32\Oeqagi32.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4648 -
C:\Windows\SysWOW64\Opfedb32.exeC:\Windows\system32\Opfedb32.exe54⤵
- Drops file in System32 directory
PID:904 -
C:\Windows\SysWOW64\Oiagcg32.exeC:\Windows\system32\Oiagcg32.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2888 -
C:\Windows\SysWOW64\Ppkopail.exeC:\Windows\system32\Ppkopail.exe56⤵PID:3876
-
C:\Windows\SysWOW64\Pehghhgc.exeC:\Windows\system32\Pehghhgc.exe57⤵PID:4500
-
C:\Windows\SysWOW64\Ppmleagi.exeC:\Windows\system32\Ppmleagi.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1488 -
C:\Windows\SysWOW64\Plfipakk.exeC:\Windows\system32\Plfipakk.exe59⤵PID:4732
-
C:\Windows\SysWOW64\Pijiif32.exeC:\Windows\system32\Pijiif32.exe60⤵
- Drops file in System32 directory
- Modifies registry class
PID:5780 -
C:\Windows\SysWOW64\Qbekgknb.exeC:\Windows\system32\Qbekgknb.exe61⤵
- Modifies registry class
PID:4260 -
C:\Windows\SysWOW64\Qlmopqdc.exeC:\Windows\system32\Qlmopqdc.exe62⤵PID:5828
-
C:\Windows\SysWOW64\Aaldngqg.exeC:\Windows\system32\Aaldngqg.exe63⤵PID:5880
-
C:\Windows\SysWOW64\Aldeap32.exeC:\Windows\system32\Aldeap32.exe64⤵PID:6068
-
C:\Windows\SysWOW64\Aemjjeek.exeC:\Windows\system32\Aemjjeek.exe65⤵PID:6128
-
C:\Windows\SysWOW64\Aoenbkll.exeC:\Windows\system32\Aoenbkll.exe66⤵
- Modifies registry class
PID:4208 -
C:\Windows\SysWOW64\Ahnclp32.exeC:\Windows\system32\Ahnclp32.exe67⤵
- Drops file in System32 directory
PID:1708 -
C:\Windows\SysWOW64\Bafgdfim.exeC:\Windows\system32\Bafgdfim.exe68⤵PID:4664
-
C:\Windows\SysWOW64\Bpggbm32.exeC:\Windows\system32\Bpggbm32.exe69⤵PID:1036
-
C:\Windows\SysWOW64\Booaii32.exeC:\Windows\system32\Booaii32.exe70⤵PID:4992
-
C:\Windows\SysWOW64\Chlomnfl.exeC:\Windows\system32\Chlomnfl.exe71⤵PID:1504
-
C:\Windows\SysWOW64\Cpedckdl.exeC:\Windows\system32\Cpedckdl.exe72⤵PID:5360
-
C:\Windows\SysWOW64\Chbenm32.exeC:\Windows\system32\Chbenm32.exe73⤵PID:5536
-
C:\Windows\SysWOW64\Dapcab32.exeC:\Windows\system32\Dapcab32.exe74⤵PID:1360
-
C:\Windows\SysWOW64\Dphipidf.exeC:\Windows\system32\Dphipidf.exe75⤵
- Drops file in System32 directory
PID:2848 -
C:\Windows\SysWOW64\Eflhiolf.exeC:\Windows\system32\Eflhiolf.exe76⤵PID:5592
-
C:\Windows\SysWOW64\Emhmkh32.exeC:\Windows\system32\Emhmkh32.exe77⤵PID:1568
-
C:\Windows\SysWOW64\Fmjjqhpn.exeC:\Windows\system32\Fmjjqhpn.exe78⤵PID:4240
-
C:\Windows\SysWOW64\Fcdbmb32.exeC:\Windows\system32\Fcdbmb32.exe79⤵PID:5060
-
C:\Windows\SysWOW64\Ficgkico.exeC:\Windows\system32\Ficgkico.exe80⤵PID:1520
-
C:\Windows\SysWOW64\Fomohc32.exeC:\Windows\system32\Fomohc32.exe81⤵PID:5688
-
C:\Windows\SysWOW64\Gjlfkj32.exeC:\Windows\system32\Gjlfkj32.exe82⤵PID:2632
-
C:\Windows\SysWOW64\Gpioca32.exeC:\Windows\system32\Gpioca32.exe83⤵
- Modifies registry class
PID:3812 -
C:\Windows\SysWOW64\Gcggjp32.exeC:\Windows\system32\Gcggjp32.exe84⤵
- Modifies registry class
PID:1860 -
C:\Windows\SysWOW64\Hidpbf32.exeC:\Windows\system32\Hidpbf32.exe85⤵
- Drops file in System32 directory
PID:3696 -
C:\Windows\SysWOW64\Hbldkllm.exeC:\Windows\system32\Hbldkllm.exe86⤵PID:1228
-
C:\Windows\SysWOW64\Hboaql32.exeC:\Windows\system32\Hboaql32.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1856 -
C:\Windows\SysWOW64\Hapancai.exeC:\Windows\system32\Hapancai.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5768 -
C:\Windows\SysWOW64\Hikfbeod.exeC:\Windows\system32\Hikfbeod.exe89⤵PID:2184
-
C:\Windows\SysWOW64\Hpenpp32.exeC:\Windows\system32\Hpenpp32.exe90⤵PID:5252
-
C:\Windows\SysWOW64\Hjjbmhfg.exeC:\Windows\system32\Hjjbmhfg.exe91⤵PID:5940
-
C:\Windows\SysWOW64\Hmioicek.exeC:\Windows\system32\Hmioicek.exe92⤵PID:6104
-
C:\Windows\SysWOW64\Hbegakcb.exeC:\Windows\system32\Hbegakcb.exe93⤵PID:1388
-
C:\Windows\SysWOW64\Iippne32.exeC:\Windows\system32\Iippne32.exe94⤵
- Modifies registry class
PID:3100 -
C:\Windows\SysWOW64\Ipihkobl.exeC:\Windows\system32\Ipihkobl.exe95⤵PID:1836
-
C:\Windows\SysWOW64\Ifcpgiji.exeC:\Windows\system32\Ifcpgiji.exe96⤵PID:1828
-
C:\Windows\SysWOW64\Ipldpo32.exeC:\Windows\system32\Ipldpo32.exe97⤵PID:832
-
C:\Windows\SysWOW64\Iffmmihf.exeC:\Windows\system32\Iffmmihf.exe98⤵
- Modifies registry class
PID:5312 -
C:\Windows\SysWOW64\Impeib32.exeC:\Windows\system32\Impeib32.exe99⤵PID:5464
-
C:\Windows\SysWOW64\Ibmmbj32.exeC:\Windows\system32\Ibmmbj32.exe100⤵PID:2700
-
C:\Windows\SysWOW64\Iiffoc32.exeC:\Windows\system32\Iiffoc32.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5380 -
C:\Windows\SysWOW64\Idljll32.exeC:\Windows\system32\Idljll32.exe102⤵
- Modifies registry class
PID:3380 -
C:\Windows\SysWOW64\Ijfbhflj.exeC:\Windows\system32\Ijfbhflj.exe103⤵
- Drops file in System32 directory
PID:2716 -
C:\Windows\SysWOW64\Idnfal32.exeC:\Windows\system32\Idnfal32.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3052 -
C:\Windows\SysWOW64\Ifmcmg32.exeC:\Windows\system32\Ifmcmg32.exe105⤵PID:376
-
C:\Windows\SysWOW64\Jabgkpad.exeC:\Windows\system32\Jabgkpad.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5736 -
C:\Windows\SysWOW64\Jdqcglqh.exeC:\Windows\system32\Jdqcglqh.exe107⤵PID:1868
-
C:\Windows\SysWOW64\Jinloboo.exeC:\Windows\system32\Jinloboo.exe108⤵PID:4800
-
C:\Windows\SysWOW64\Jbfphh32.exeC:\Windows\system32\Jbfphh32.exe109⤵PID:5772
-
C:\Windows\SysWOW64\Jmkdeaee.exeC:\Windows\system32\Jmkdeaee.exe110⤵
- Drops file in System32 directory
PID:5904 -
C:\Windows\SysWOW64\Jbhmnhcm.exeC:\Windows\system32\Jbhmnhcm.exe111⤵
- Modifies registry class
PID:4340 -
C:\Windows\SysWOW64\Jjoeoedo.exeC:\Windows\system32\Jjoeoedo.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2140 -
C:\Windows\SysWOW64\Jaimko32.exeC:\Windows\system32\Jaimko32.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2796 -
C:\Windows\SysWOW64\Jfffcf32.exeC:\Windows\system32\Jfffcf32.exe114⤵PID:5304
-
C:\Windows\SysWOW64\Jmpnppap.exeC:\Windows\system32\Jmpnppap.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3560 -
C:\Windows\SysWOW64\Jdjfmjhm.exeC:\Windows\system32\Jdjfmjhm.exe116⤵PID:3508
-
C:\Windows\SysWOW64\Kkdnjd32.exeC:\Windows\system32\Kkdnjd32.exe117⤵PID:1012
-
C:\Windows\SysWOW64\Kanffogf.exeC:\Windows\system32\Kanffogf.exe118⤵
- Drops file in System32 directory
PID:5620 -
C:\Windows\SysWOW64\Kpjjhj32.exeC:\Windows\system32\Kpjjhj32.exe119⤵
- Modifies registry class
PID:3024 -
C:\Windows\SysWOW64\Libnapmg.exeC:\Windows\system32\Libnapmg.exe120⤵PID:1396
-
C:\Windows\SysWOW64\Lpmfnj32.exeC:\Windows\system32\Lpmfnj32.exe121⤵PID:5056
-
C:\Windows\SysWOW64\Lckbje32.exeC:\Windows\system32\Lckbje32.exe122⤵PID:4264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-