Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2023, 19:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f674d855e3ea368b34fb11aaadef91e0_exe32.exe
Resource
win7-20230831-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
f674d855e3ea368b34fb11aaadef91e0_exe32.exe
Resource
win10v2004-20230915-en
6 signatures
150 seconds
General
-
Target
f674d855e3ea368b34fb11aaadef91e0_exe32.exe
-
Size
1.9MB
-
MD5
f674d855e3ea368b34fb11aaadef91e0
-
SHA1
1b1b8742a29369484324d6cfe05cdb0c299c4ef6
-
SHA256
0374831b8adfd3f6b397c5e25cac228bd151258ad119897623292da228fad6d2
-
SHA512
bbeba06a7dd0f322f05c101413f980100180658fa86fde815643f11a6adecea9fac5c5739463b93d71bbb165010c1c7bd3b724517a31c5c63c5a1f4c919472be
-
SSDEEP
24576:z8NIVyeNIVy2jUKaNIVyeNIVy2jUtc9uO2NIVyeNIVy2jUKaNIVyeNIVy2jUO:Xyj1yj3uOpyj1yjH
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emhahiep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mflbdibj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnhgidka.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Blhhaigj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gbmaog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nlefebfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lbngfbdo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nfcoekhe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmhphqoe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fqcilgji.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfdjccol.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Chblebll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jliimf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kdpmmf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aikijjon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hfniikha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fdpgen32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhfpjghi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Giofggia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gbqeonfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dkljka32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efhlan32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Odcfdc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iljpgl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkajnh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgeegled.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ainnhdbp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gfeahffl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhkfdcbd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Acnefoac.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qpahghbg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jdgjgh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fefjpp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glpmkm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hoonjjgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dmakgj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmmedi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldiiio32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gafmkp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mpdgbkab.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dobnpm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pagbklae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eqiilp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jpdqlgdc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Olnkfd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Adfnhlfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qhfcbfdl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kfjhdobb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbefmopd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olnkfd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fechhcal.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofjgmdgg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Emoaopnf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qfneamlf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fdnipbbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Egdqkk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ghgbakhb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mflgff32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iafogggl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijcaaibe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hcgjhega.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mmlhpaji.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jpoagb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Meqmmm32.exe -
Executes dropped EXE 64 IoCs
pid Process 2636 Eiijfd32.exe 2320 Fcddkggf.exe 1212 Gdkffi32.exe 3784 Hcgjhega.exe 224 Jglaepim.exe 4492 Mehafq32.exe 2512 Mdddhlbl.exe 1800 Oolnabal.exe 4524 Pbapom32.exe 568 Qnpgdmjd.exe 2820 Ainnhdbp.exe 3300 Bkadoo32.exe 3548 Cgagjo32.exe 1992 Cnnllhpa.exe 4628 Cnebmgjj.exe 3884 Elilmi32.exe 2768 Eojeodga.exe 2404 Ghgljg32.exe 3856 Gjghdj32.exe 2440 Hfniikha.exe 1708 Hqjcgbbo.exe 4816 Ifihdi32.exe 2132 Liifnp32.exe 3984 Libido32.exe 3108 Mmdlflki.exe 3192 Nmbhgjoi.exe 3652 Odcfdc32.exe 1488 Opjgidfa.exe 2144 Oalpigkb.exe 4212 Pdmikb32.exe 3944 Cjfclcpg.exe 3768 Deejpjgc.exe 4392 Dicbfhni.exe 4696 Enbhdojn.exe 5104 Ejnbdp32.exe 4852 Fkbkoo32.exe 1428 Fkehdnee.exe 2260 Fkgejncb.exe 3200 Iabodcnj.exe 3120 Icakofel.exe 3104 Iljpgl32.exe 4324 Jcfejfag.exe 2380 Jkajnh32.exe 3924 Jcmkjeko.exe 3728 Jkhpogij.exe 2384 Kmhlijpm.exe 3632 Kfpqap32.exe 1812 Kmmedi32.exe 4120 Kicfijal.exe 4192 Kblkap32.exe 1132 Kkdoje32.exe 1632 Ljephmgl.exe 4172 Lbqdmodg.exe 2024 Mmahff32.exe 4340 Nfcoekhe.exe 2264 Nbmmoklg.exe 4984 Pmbjcb32.exe 1388 Ajggjq32.exe 3384 Ccgjjc32.exe 4736 Cmblhh32.exe 1532 Ckclfp32.exe 2680 Ddkpoelb.exe 2576 Dncehk32.exe 3332 Dnhncjom.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Egdqkk32.exe Emjomf32.exe File opened for modification C:\Windows\SysWOW64\Fdpgen32.exe Ehifpm32.exe File opened for modification C:\Windows\SysWOW64\Fgldoi32.exe Fbplgbbb.exe File created C:\Windows\SysWOW64\Cpmmcncm.dll Ajhdmplk.exe File opened for modification C:\Windows\SysWOW64\Acnefoac.exe Ajeami32.exe File opened for modification C:\Windows\SysWOW64\Nccqbeec.exe Nhnlelfm.exe File opened for modification C:\Windows\SysWOW64\Ohkbldfa.exe Oaomij32.exe File opened for modification C:\Windows\SysWOW64\Adfnhlfa.exe Aojepe32.exe File created C:\Windows\SysWOW64\Olgdgibf.exe Ogklob32.exe File created C:\Windows\SysWOW64\Bgnkamef.exe Bmhfddeq.exe File created C:\Windows\SysWOW64\Iomgjk32.dll Kbkdgj32.exe File opened for modification C:\Windows\SysWOW64\Gffkpa32.exe Gmnfglcd.exe File created C:\Windows\SysWOW64\Ejompeel.dll Hfonfp32.exe File created C:\Windows\SysWOW64\Gbphlg32.dll Icakofel.exe File created C:\Windows\SysWOW64\Icpnjl32.dll Mhenpk32.exe File created C:\Windows\SysWOW64\Lbekjipe.exe Keakqeal.exe File opened for modification C:\Windows\SysWOW64\Nemcca32.exe Nekgna32.exe File created C:\Windows\SysWOW64\Bciebm32.exe Bidqddgp.exe File created C:\Windows\SysWOW64\Jdkadb32.exe Ikcmklih.exe File created C:\Windows\SysWOW64\Liqoco32.dll Pchljlpo.exe File created C:\Windows\SysWOW64\Fnbjkj32.exe Ffgegh32.exe File created C:\Windows\SysWOW64\Jcmkjeko.exe Jkajnh32.exe File created C:\Windows\SysWOW64\Bodano32.exe Bjgifhep.exe File opened for modification C:\Windows\SysWOW64\Cgbppknb.exe Cnjkgf32.exe File created C:\Windows\SysWOW64\Fhljpcfk.exe Ekhjgoga.exe File created C:\Windows\SysWOW64\Fpdckm32.exe Feoomd32.exe File created C:\Windows\SysWOW64\Agglld32.exe Pnakaa32.exe File opened for modification C:\Windows\SysWOW64\Emhahiep.exe Elienf32.exe File created C:\Windows\SysWOW64\Pmlkne32.dll Bidqddgp.exe File opened for modification C:\Windows\SysWOW64\Fdiohnek.exe Fomfpg32.exe File created C:\Windows\SysWOW64\Cjfclcpg.exe Pdmikb32.exe File opened for modification C:\Windows\SysWOW64\Lbddpclj.exe Kepdfo32.exe File opened for modification C:\Windows\SysWOW64\Aamkgpbi.exe Ahdgnj32.exe File created C:\Windows\SysWOW64\Deejpjgc.exe Cjfclcpg.exe File opened for modification C:\Windows\SysWOW64\Bijnnf32.exe Acnefoac.exe File created C:\Windows\SysWOW64\Ineilini.dll Qpahghbg.exe File opened for modification C:\Windows\SysWOW64\Eqiilp32.exe Eohmdhki.exe File created C:\Windows\SysWOW64\Agbkfood.exe Afboll32.exe File opened for modification C:\Windows\SysWOW64\Hagnihom.exe Hdcnpd32.exe File created C:\Windows\SysWOW64\Pogmdm32.dll Nloikqnl.exe File created C:\Windows\SysWOW64\Nekgna32.exe Mhgfdmle.exe File opened for modification C:\Windows\SysWOW64\Ngaihcli.exe Nllekk32.exe File opened for modification C:\Windows\SysWOW64\Ainnhdbp.exe Qnpgdmjd.exe File created C:\Windows\SysWOW64\Epofikbn.dll Gbmaog32.exe File created C:\Windows\SysWOW64\Ihbcjk32.dll Chblebll.exe File opened for modification C:\Windows\SysWOW64\Oaomij32.exe Olbdacbp.exe File created C:\Windows\SysWOW64\Dkokma32.exe Dnkkcmdb.exe File opened for modification C:\Windows\SysWOW64\Bkkofn32.exe Bhkfdcbd.exe File opened for modification C:\Windows\SysWOW64\Moobkh32.exe Mefmbbod.exe File created C:\Windows\SysWOW64\Gpimflqb.exe Fechhcal.exe File created C:\Windows\SysWOW64\Cjjcof32.exe Cmfcfb32.exe File opened for modification C:\Windows\SysWOW64\Laiaqp32.exe Lkmihi32.exe File created C:\Windows\SysWOW64\Naodbm32.exe Nhfpjghi.exe File created C:\Windows\SysWOW64\Afoqbkld.dll Fppqjcli.exe File opened for modification C:\Windows\SysWOW64\Gdclcmba.exe Gngckfdj.exe File opened for modification C:\Windows\SysWOW64\Iblfgc32.exe Iehfno32.exe File opened for modification C:\Windows\SysWOW64\Gonnhf32.exe Fefjpp32.exe File opened for modification C:\Windows\SysWOW64\Bmhfddeq.exe Bgknlmgi.exe File opened for modification C:\Windows\SysWOW64\Opjnai32.exe Ngaihcli.exe File opened for modification C:\Windows\SysWOW64\Ibhlmgdj.exe Iafogggl.exe File created C:\Windows\SysWOW64\Mflbjejb.exe Mbnjcg32.exe File opened for modification C:\Windows\SysWOW64\Bdcmfkde.exe Blhhaigj.exe File opened for modification C:\Windows\SysWOW64\Hcgjhega.exe Gdkffi32.exe File created C:\Windows\SysWOW64\Joioak32.dll Fdqffaql.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3936 2204 WerFault.exe 650 -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ccnnmmbp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fjdajhbi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ajdbmf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pagbklae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ddjecalo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dodbkiho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blcmakcp.dll" Ehifpm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ghgljg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Miohmgcg.dll" Ippgqg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aogije32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilmeeglh.dll" Fdegkdim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oldijd32.dll" Jgjekc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehpkhelp.dll" Bciebm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mjodff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Edplapnf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Edgbbo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fnhlndqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbjkbj32.dll" Jjmcghjj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pmlmdd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dgeegled.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcldjicn.dll" Cnebmgjj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jngjmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fldabbgk.dll" Eojijg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dncehk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eglbhnkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ekefgi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iejgelej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Claenb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ojopki32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dnhncjom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Imofip32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jnoopm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opiecn32.dll" Dnhncjom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ajhdmplk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mhafoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eoeeekec.dll" Jpoagb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lbekjipe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pamikh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jkajnh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jmnheggo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfmdohbb.dll" Ajbegg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 f674d855e3ea368b34fb11aaadef91e0_exe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlibnkcm.dll" Kkdoje32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ldnjndpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egpofhkf.dll" Aikijjon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hifijmqd.dll" Nbmmoklg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qjmllgjd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Plokgh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cfiiggpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Chjaha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qfneamlf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hcgjhega.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ajbegg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mflbdibj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Caebfg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbdcekfc.dll" Ljbfiegb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fpggkbfq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kojkeogp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmoihc32.dll" Peobeh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ckhlgilp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Blhhaigj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bdcmfkde.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jagqfp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ckealm32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4380 wrote to memory of 2636 4380 f674d855e3ea368b34fb11aaadef91e0_exe32.exe 83 PID 4380 wrote to memory of 2636 4380 f674d855e3ea368b34fb11aaadef91e0_exe32.exe 83 PID 4380 wrote to memory of 2636 4380 f674d855e3ea368b34fb11aaadef91e0_exe32.exe 83 PID 2636 wrote to memory of 2320 2636 Eiijfd32.exe 84 PID 2636 wrote to memory of 2320 2636 Eiijfd32.exe 84 PID 2636 wrote to memory of 2320 2636 Eiijfd32.exe 84 PID 2320 wrote to memory of 1212 2320 Fcddkggf.exe 85 PID 2320 wrote to memory of 1212 2320 Fcddkggf.exe 85 PID 2320 wrote to memory of 1212 2320 Fcddkggf.exe 85 PID 1212 wrote to memory of 3784 1212 Gdkffi32.exe 86 PID 1212 wrote to memory of 3784 1212 Gdkffi32.exe 86 PID 1212 wrote to memory of 3784 1212 Gdkffi32.exe 86 PID 3784 wrote to memory of 224 3784 Hcgjhega.exe 87 PID 3784 wrote to memory of 224 3784 Hcgjhega.exe 87 PID 3784 wrote to memory of 224 3784 Hcgjhega.exe 87 PID 224 wrote to memory of 4492 224 Jglaepim.exe 88 PID 224 wrote to memory of 4492 224 Jglaepim.exe 88 PID 224 wrote to memory of 4492 224 Jglaepim.exe 88 PID 4492 wrote to memory of 2512 4492 Mehafq32.exe 89 PID 4492 wrote to memory of 2512 4492 Mehafq32.exe 89 PID 4492 wrote to memory of 2512 4492 Mehafq32.exe 89 PID 2512 wrote to memory of 1800 2512 Mdddhlbl.exe 90 PID 2512 wrote to memory of 1800 2512 Mdddhlbl.exe 90 PID 2512 wrote to memory of 1800 2512 Mdddhlbl.exe 90 PID 1800 wrote to memory of 4524 1800 Oolnabal.exe 91 PID 1800 wrote to memory of 4524 1800 Oolnabal.exe 91 PID 1800 wrote to memory of 4524 1800 Oolnabal.exe 91 PID 4524 wrote to memory of 568 4524 Pbapom32.exe 93 PID 4524 wrote to memory of 568 4524 Pbapom32.exe 93 PID 4524 wrote to memory of 568 4524 Pbapom32.exe 93 PID 568 wrote to memory of 2820 568 Qnpgdmjd.exe 92 PID 568 wrote to memory of 2820 568 Qnpgdmjd.exe 92 PID 568 wrote to memory of 2820 568 Qnpgdmjd.exe 92 PID 2820 wrote to memory of 3300 2820 Ainnhdbp.exe 94 PID 2820 wrote to memory of 3300 2820 Ainnhdbp.exe 94 PID 2820 wrote to memory of 3300 2820 Ainnhdbp.exe 94 PID 3300 wrote to memory of 3548 3300 Bkadoo32.exe 95 PID 3300 wrote to memory of 3548 3300 Bkadoo32.exe 95 PID 3300 wrote to memory of 3548 3300 Bkadoo32.exe 95 PID 3548 wrote to memory of 1992 3548 Cgagjo32.exe 96 PID 3548 wrote to memory of 1992 3548 Cgagjo32.exe 96 PID 3548 wrote to memory of 1992 3548 Cgagjo32.exe 96 PID 1992 wrote to memory of 4628 1992 Cnnllhpa.exe 97 PID 1992 wrote to memory of 4628 1992 Cnnllhpa.exe 97 PID 1992 wrote to memory of 4628 1992 Cnnllhpa.exe 97 PID 4628 wrote to memory of 3884 4628 Cnebmgjj.exe 98 PID 4628 wrote to memory of 3884 4628 Cnebmgjj.exe 98 PID 4628 wrote to memory of 3884 4628 Cnebmgjj.exe 98 PID 3884 wrote to memory of 2768 3884 Elilmi32.exe 99 PID 3884 wrote to memory of 2768 3884 Elilmi32.exe 99 PID 3884 wrote to memory of 2768 3884 Elilmi32.exe 99 PID 2768 wrote to memory of 2404 2768 Eojeodga.exe 101 PID 2768 wrote to memory of 2404 2768 Eojeodga.exe 101 PID 2768 wrote to memory of 2404 2768 Eojeodga.exe 101 PID 2404 wrote to memory of 3856 2404 Ghgljg32.exe 100 PID 2404 wrote to memory of 3856 2404 Ghgljg32.exe 100 PID 2404 wrote to memory of 3856 2404 Ghgljg32.exe 100 PID 3856 wrote to memory of 2440 3856 Gjghdj32.exe 102 PID 3856 wrote to memory of 2440 3856 Gjghdj32.exe 102 PID 3856 wrote to memory of 2440 3856 Gjghdj32.exe 102 PID 2440 wrote to memory of 1708 2440 Hfniikha.exe 103 PID 2440 wrote to memory of 1708 2440 Hfniikha.exe 103 PID 2440 wrote to memory of 1708 2440 Hfniikha.exe 103 PID 1708 wrote to memory of 4816 1708 Hqjcgbbo.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\f674d855e3ea368b34fb11aaadef91e0_exe32.exe"C:\Users\Admin\AppData\Local\Temp\f674d855e3ea368b34fb11aaadef91e0_exe32.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\Eiijfd32.exeC:\Windows\system32\Eiijfd32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\Fcddkggf.exeC:\Windows\system32\Fcddkggf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\Gdkffi32.exeC:\Windows\system32\Gdkffi32.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\Hcgjhega.exeC:\Windows\system32\Hcgjhega.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\Jglaepim.exeC:\Windows\system32\Jglaepim.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\Mehafq32.exeC:\Windows\system32\Mehafq32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\Mdddhlbl.exeC:\Windows\system32\Mdddhlbl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\Oolnabal.exeC:\Windows\system32\Oolnabal.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\Pbapom32.exeC:\Windows\system32\Pbapom32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\Qnpgdmjd.exeC:\Windows\system32\Qnpgdmjd.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:568
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Ainnhdbp.exeC:\Windows\system32\Ainnhdbp.exe1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\Bkadoo32.exeC:\Windows\system32\Bkadoo32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\Cgagjo32.exeC:\Windows\system32\Cgagjo32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\Cnnllhpa.exeC:\Windows\system32\Cnnllhpa.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\Cnebmgjj.exeC:\Windows\system32\Cnebmgjj.exe5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\Elilmi32.exeC:\Windows\system32\Elilmi32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\Eojeodga.exeC:\Windows\system32\Eojeodga.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\Ghgljg32.exeC:\Windows\system32\Ghgljg32.exe8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2404
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Gjghdj32.exeC:\Windows\system32\Gjghdj32.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\Hfniikha.exeC:\Windows\system32\Hfniikha.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\Hqjcgbbo.exeC:\Windows\system32\Hqjcgbbo.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\Ifihdi32.exeC:\Windows\system32\Ifihdi32.exe4⤵
- Executes dropped EXE
PID:4816 -
C:\Windows\SysWOW64\Liifnp32.exeC:\Windows\system32\Liifnp32.exe5⤵
- Executes dropped EXE
PID:2132 -
C:\Windows\SysWOW64\Libido32.exeC:\Windows\system32\Libido32.exe6⤵
- Executes dropped EXE
PID:3984 -
C:\Windows\SysWOW64\Mmdlflki.exeC:\Windows\system32\Mmdlflki.exe7⤵
- Executes dropped EXE
PID:3108 -
C:\Windows\SysWOW64\Nmbhgjoi.exeC:\Windows\system32\Nmbhgjoi.exe8⤵
- Executes dropped EXE
PID:3192 -
C:\Windows\SysWOW64\Odcfdc32.exeC:\Windows\system32\Odcfdc32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3652 -
C:\Windows\SysWOW64\Opjgidfa.exeC:\Windows\system32\Opjgidfa.exe10⤵
- Executes dropped EXE
PID:1488 -
C:\Windows\SysWOW64\Oalpigkb.exeC:\Windows\system32\Oalpigkb.exe11⤵
- Executes dropped EXE
PID:2144 -
C:\Windows\SysWOW64\Pdmikb32.exeC:\Windows\system32\Pdmikb32.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4212 -
C:\Windows\SysWOW64\Cjfclcpg.exeC:\Windows\system32\Cjfclcpg.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3944 -
C:\Windows\SysWOW64\Deejpjgc.exeC:\Windows\system32\Deejpjgc.exe14⤵
- Executes dropped EXE
PID:3768 -
C:\Windows\SysWOW64\Dicbfhni.exeC:\Windows\system32\Dicbfhni.exe15⤵
- Executes dropped EXE
PID:4392 -
C:\Windows\SysWOW64\Enbhdojn.exeC:\Windows\system32\Enbhdojn.exe16⤵
- Executes dropped EXE
PID:4696 -
C:\Windows\SysWOW64\Ejnbdp32.exeC:\Windows\system32\Ejnbdp32.exe17⤵
- Executes dropped EXE
PID:5104 -
C:\Windows\SysWOW64\Fkbkoo32.exeC:\Windows\system32\Fkbkoo32.exe18⤵
- Executes dropped EXE
PID:4852 -
C:\Windows\SysWOW64\Fkehdnee.exeC:\Windows\system32\Fkehdnee.exe19⤵
- Executes dropped EXE
PID:1428 -
C:\Windows\SysWOW64\Fkgejncb.exeC:\Windows\system32\Fkgejncb.exe20⤵
- Executes dropped EXE
PID:2260 -
C:\Windows\SysWOW64\Iabodcnj.exeC:\Windows\system32\Iabodcnj.exe21⤵
- Executes dropped EXE
PID:3200 -
C:\Windows\SysWOW64\Icakofel.exeC:\Windows\system32\Icakofel.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3120 -
C:\Windows\SysWOW64\Iljpgl32.exeC:\Windows\system32\Iljpgl32.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3104 -
C:\Windows\SysWOW64\Jcfejfag.exeC:\Windows\system32\Jcfejfag.exe24⤵
- Executes dropped EXE
PID:4324 -
C:\Windows\SysWOW64\Jkajnh32.exeC:\Windows\system32\Jkajnh32.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2380 -
C:\Windows\SysWOW64\Jcmkjeko.exeC:\Windows\system32\Jcmkjeko.exe26⤵
- Executes dropped EXE
PID:3924 -
C:\Windows\SysWOW64\Jkhpogij.exeC:\Windows\system32\Jkhpogij.exe27⤵
- Executes dropped EXE
PID:3728 -
C:\Windows\SysWOW64\Kmhlijpm.exeC:\Windows\system32\Kmhlijpm.exe28⤵
- Executes dropped EXE
PID:2384 -
C:\Windows\SysWOW64\Kfpqap32.exeC:\Windows\system32\Kfpqap32.exe29⤵
- Executes dropped EXE
PID:3632 -
C:\Windows\SysWOW64\Kmmedi32.exeC:\Windows\system32\Kmmedi32.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1812 -
C:\Windows\SysWOW64\Kicfijal.exeC:\Windows\system32\Kicfijal.exe31⤵
- Executes dropped EXE
PID:4120 -
C:\Windows\SysWOW64\Kblkap32.exeC:\Windows\system32\Kblkap32.exe32⤵
- Executes dropped EXE
PID:4192 -
C:\Windows\SysWOW64\Kkdoje32.exeC:\Windows\system32\Kkdoje32.exe33⤵
- Executes dropped EXE
- Modifies registry class
PID:1132
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Ljephmgl.exeC:\Windows\system32\Ljephmgl.exe1⤵
- Executes dropped EXE
PID:1632 -
C:\Windows\SysWOW64\Lbqdmodg.exeC:\Windows\system32\Lbqdmodg.exe2⤵
- Executes dropped EXE
PID:4172 -
C:\Windows\SysWOW64\Mmahff32.exeC:\Windows\system32\Mmahff32.exe3⤵
- Executes dropped EXE
PID:2024 -
C:\Windows\SysWOW64\Nfcoekhe.exeC:\Windows\system32\Nfcoekhe.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4340 -
C:\Windows\SysWOW64\Nbmmoklg.exeC:\Windows\system32\Nbmmoklg.exe5⤵
- Executes dropped EXE
- Modifies registry class
PID:2264 -
C:\Windows\SysWOW64\Pmbjcb32.exeC:\Windows\system32\Pmbjcb32.exe6⤵
- Executes dropped EXE
PID:4984 -
C:\Windows\SysWOW64\Ajggjq32.exeC:\Windows\system32\Ajggjq32.exe7⤵
- Executes dropped EXE
PID:1388 -
C:\Windows\SysWOW64\Ccgjjc32.exeC:\Windows\system32\Ccgjjc32.exe8⤵
- Executes dropped EXE
PID:3384 -
C:\Windows\SysWOW64\Cmblhh32.exeC:\Windows\system32\Cmblhh32.exe9⤵
- Executes dropped EXE
PID:4736
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Ckclfp32.exeC:\Windows\system32\Ckclfp32.exe1⤵
- Executes dropped EXE
PID:1532 -
C:\Windows\SysWOW64\Ddkpoelb.exeC:\Windows\system32\Ddkpoelb.exe2⤵
- Executes dropped EXE
PID:2680 -
C:\Windows\SysWOW64\Dncehk32.exeC:\Windows\system32\Dncehk32.exe3⤵
- Executes dropped EXE
- Modifies registry class
PID:2576 -
C:\Windows\SysWOW64\Dnhncjom.exeC:\Windows\system32\Dnhncjom.exe4⤵
- Executes dropped EXE
- Modifies registry class
PID:3332 -
C:\Windows\SysWOW64\Eglbhnkp.exeC:\Windows\system32\Eglbhnkp.exe5⤵
- Modifies registry class
PID:1188 -
C:\Windows\SysWOW64\Eepbabjj.exeC:\Windows\system32\Eepbabjj.exe6⤵PID:4112
-
C:\Windows\SysWOW64\Fjbddh32.exeC:\Windows\system32\Fjbddh32.exe7⤵PID:948
-
C:\Windows\SysWOW64\Fjdajhbi.exeC:\Windows\system32\Fjdajhbi.exe8⤵
- Modifies registry class
PID:2008 -
C:\Windows\SysWOW64\Fdmfcn32.exeC:\Windows\system32\Fdmfcn32.exe9⤵PID:884
-
C:\Windows\SysWOW64\Felbmqpl.exeC:\Windows\system32\Felbmqpl.exe10⤵PID:1528
-
C:\Windows\SysWOW64\Gngckfdj.exeC:\Windows\system32\Gngckfdj.exe11⤵
- Drops file in System32 directory
PID:2580 -
C:\Windows\SysWOW64\Gdclcmba.exeC:\Windows\system32\Gdclcmba.exe12⤵PID:2040
-
C:\Windows\SysWOW64\Gmlplbib.exeC:\Windows\system32\Gmlplbib.exe13⤵PID:532
-
C:\Windows\SysWOW64\Gokmfe32.exeC:\Windows\system32\Gokmfe32.exe14⤵PID:660
-
C:\Windows\SysWOW64\Haobnpkc.exeC:\Windows\system32\Haobnpkc.exe15⤵PID:2364
-
C:\Windows\SysWOW64\Hobcgdjm.exeC:\Windows\system32\Hobcgdjm.exe16⤵PID:3876
-
C:\Windows\SysWOW64\Hmhphqoe.exeC:\Windows\system32\Hmhphqoe.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:552 -
C:\Windows\SysWOW64\Headon32.exeC:\Windows\system32\Headon32.exe18⤵PID:860
-
C:\Windows\SysWOW64\Hecadm32.exeC:\Windows\system32\Hecadm32.exe19⤵PID:3644
-
C:\Windows\SysWOW64\Imofip32.exeC:\Windows\system32\Imofip32.exe20⤵
- Modifies registry class
PID:4376 -
C:\Windows\SysWOW64\Ionbcb32.exeC:\Windows\system32\Ionbcb32.exe21⤵PID:2660
-
C:\Windows\SysWOW64\Ihfglhfp.exeC:\Windows\system32\Ihfglhfp.exe22⤵PID:3036
-
C:\Windows\SysWOW64\Iejgelej.exeC:\Windows\system32\Iejgelej.exe23⤵
- Modifies registry class
PID:1152 -
C:\Windows\SysWOW64\Iemdkl32.exeC:\Windows\system32\Iemdkl32.exe24⤵PID:4200
-
C:\Windows\SysWOW64\Iacepmik.exeC:\Windows\system32\Iacepmik.exe25⤵PID:3736
-
C:\Windows\SysWOW64\Jliimf32.exeC:\Windows\system32\Jliimf32.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3908 -
C:\Windows\SysWOW64\Jeanfkob.exeC:\Windows\system32\Jeanfkob.exe27⤵PID:3004
-
C:\Windows\SysWOW64\Jojboa32.exeC:\Windows\system32\Jojboa32.exe28⤵PID:2504
-
C:\Windows\SysWOW64\Jdgjgh32.exeC:\Windows\system32\Jdgjgh32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1920 -
C:\Windows\SysWOW64\Jnoopm32.exeC:\Windows\system32\Jnoopm32.exe30⤵
- Modifies registry class
PID:1224 -
C:\Windows\SysWOW64\Jhdcmf32.exeC:\Windows\system32\Jhdcmf32.exe31⤵PID:4988
-
C:\Windows\SysWOW64\Jhgpbf32.exeC:\Windows\system32\Jhgpbf32.exe32⤵PID:1652
-
C:\Windows\SysWOW64\Kdpmmf32.exeC:\Windows\system32\Kdpmmf32.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4388 -
C:\Windows\SysWOW64\Knhbflbp.exeC:\Windows\system32\Knhbflbp.exe34⤵PID:2640
-
C:\Windows\SysWOW64\Kohnpoib.exeC:\Windows\system32\Kohnpoib.exe35⤵PID:3976
-
C:\Windows\SysWOW64\Kojkeogp.exeC:\Windows\system32\Kojkeogp.exe36⤵
- Modifies registry class
PID:4204 -
C:\Windows\SysWOW64\Khbpndnp.exeC:\Windows\system32\Khbpndnp.exe37⤵PID:3916
-
C:\Windows\SysWOW64\Kbkdgj32.exeC:\Windows\system32\Kbkdgj32.exe38⤵
- Drops file in System32 directory
PID:996 -
C:\Windows\SysWOW64\Ldnjndpo.exeC:\Windows\system32\Ldnjndpo.exe39⤵
- Modifies registry class
PID:560 -
C:\Windows\SysWOW64\Lfnfhg32.exeC:\Windows\system32\Lfnfhg32.exe40⤵PID:2240
-
C:\Windows\SysWOW64\Lnikmjdm.exeC:\Windows\system32\Lnikmjdm.exe41⤵PID:416
-
C:\Windows\SysWOW64\Mmlhpaji.exeC:\Windows\system32\Mmlhpaji.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1336 -
C:\Windows\SysWOW64\Mkadam32.exeC:\Windows\system32\Mkadam32.exe43⤵PID:3936
-
C:\Windows\SysWOW64\Mbnjcg32.exeC:\Windows\system32\Mbnjcg32.exe44⤵
- Drops file in System32 directory
PID:1200 -
C:\Windows\SysWOW64\Mflbjejb.exeC:\Windows\system32\Mflbjejb.exe45⤵PID:4676
-
C:\Windows\SysWOW64\Mpdgbkab.exeC:\Windows\system32\Mpdgbkab.exe46⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5212 -
C:\Windows\SysWOW64\Qolbgbgb.exeC:\Windows\system32\Qolbgbgb.exe47⤵PID:5268
-
C:\Windows\SysWOW64\Abjkmqni.exeC:\Windows\system32\Abjkmqni.exe48⤵PID:5320
-
C:\Windows\SysWOW64\Apnkfelb.exeC:\Windows\system32\Apnkfelb.exe49⤵PID:5384
-
C:\Windows\SysWOW64\Aifpoj32.exeC:\Windows\system32\Aifpoj32.exe50⤵PID:5424
-
C:\Windows\SysWOW64\Agkqiobl.exeC:\Windows\system32\Agkqiobl.exe51⤵PID:5488
-
C:\Windows\SysWOW64\Apcead32.exeC:\Windows\system32\Apcead32.exe52⤵PID:5564
-
C:\Windows\SysWOW64\Aikijjon.exeC:\Windows\system32\Aikijjon.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5608 -
C:\Windows\SysWOW64\Agojdnng.exeC:\Windows\system32\Agojdnng.exe54⤵PID:5660
-
C:\Windows\SysWOW64\Bllble32.exeC:\Windows\system32\Bllble32.exe55⤵PID:5700
-
C:\Windows\SysWOW64\Bipcei32.exeC:\Windows\system32\Bipcei32.exe56⤵PID:5732
-
C:\Windows\SysWOW64\Boohcpgm.exeC:\Windows\system32\Boohcpgm.exe57⤵PID:5800
-
C:\Windows\SysWOW64\Bpodmb32.exeC:\Windows\system32\Bpodmb32.exe58⤵PID:5848
-
C:\Windows\SysWOW64\Bjgifhep.exeC:\Windows\system32\Bjgifhep.exe59⤵
- Drops file in System32 directory
PID:5892 -
C:\Windows\SysWOW64\Bodano32.exeC:\Windows\system32\Bodano32.exe60⤵PID:5928
-
C:\Windows\SysWOW64\Cnealfkf.exeC:\Windows\system32\Cnealfkf.exe61⤵PID:5972
-
C:\Windows\SysWOW64\Cgmfel32.exeC:\Windows\system32\Cgmfel32.exe62⤵PID:6024
-
C:\Windows\SysWOW64\Cohkinob.exeC:\Windows\system32\Cohkinob.exe63⤵PID:6068
-
C:\Windows\SysWOW64\Cnjkgf32.exeC:\Windows\system32\Cnjkgf32.exe64⤵
- Drops file in System32 directory
PID:6116 -
C:\Windows\SysWOW64\Cgbppknb.exeC:\Windows\system32\Cgbppknb.exe65⤵PID:2168
-
C:\Windows\SysWOW64\Clohhbli.exeC:\Windows\system32\Clohhbli.exe66⤵PID:2224
-
C:\Windows\SysWOW64\Claenb32.exeC:\Windows\system32\Claenb32.exe67⤵
- Modifies registry class
PID:4492 -
C:\Windows\SysWOW64\Cfiiggpg.exeC:\Windows\system32\Cfiiggpg.exe68⤵
- Modifies registry class
PID:5252 -
C:\Windows\SysWOW64\Dobnpm32.exeC:\Windows\system32\Dobnpm32.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5344 -
C:\Windows\SysWOW64\Dncnnd32.exeC:\Windows\system32\Dncnnd32.exe70⤵PID:5400
-
C:\Windows\SysWOW64\Dfnbbg32.exeC:\Windows\system32\Dfnbbg32.exe71⤵PID:5476
-
C:\Windows\SysWOW64\Dofgklcb.exeC:\Windows\system32\Dofgklcb.exe72⤵PID:5572
-
C:\Windows\SysWOW64\Dnhgidka.exeC:\Windows\system32\Dnhgidka.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5676 -
C:\Windows\SysWOW64\Dfclmfhl.exeC:\Windows\system32\Dfclmfhl.exe74⤵PID:5752
-
C:\Windows\SysWOW64\Dcglfjgf.exeC:\Windows\system32\Dcglfjgf.exe75⤵PID:5840
-
C:\Windows\SysWOW64\Emoaopnf.exeC:\Windows\system32\Emoaopnf.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5960 -
C:\Windows\SysWOW64\Gmnfglcd.exeC:\Windows\system32\Gmnfglcd.exe77⤵
- Drops file in System32 directory
PID:6036 -
C:\Windows\SysWOW64\Gffkpa32.exeC:\Windows\system32\Gffkpa32.exe78⤵PID:6096
-
C:\Windows\SysWOW64\Gpnoigpe.exeC:\Windows\system32\Gpnoigpe.exe79⤵PID:4400
-
C:\Windows\SysWOW64\Hmbpbk32.exeC:\Windows\system32\Hmbpbk32.exe80⤵PID:2184
-
C:\Windows\SysWOW64\Hhhdpd32.exeC:\Windows\system32\Hhhdpd32.exe81⤵PID:1436
-
C:\Windows\SysWOW64\Hpchdf32.exeC:\Windows\system32\Hpchdf32.exe82⤵PID:5332
-
C:\Windows\SysWOW64\Hjimaole.exeC:\Windows\system32\Hjimaole.exe83⤵PID:5420
-
C:\Windows\SysWOW64\Hfonfp32.exeC:\Windows\system32\Hfonfp32.exe84⤵
- Drops file in System32 directory
PID:5600 -
C:\Windows\SysWOW64\Hdcnpd32.exeC:\Windows\system32\Hdcnpd32.exe85⤵
- Drops file in System32 directory
PID:5588 -
C:\Windows\SysWOW64\Hagnihom.exeC:\Windows\system32\Hagnihom.exe86⤵PID:5812
-
C:\Windows\SysWOW64\Jmnheggo.exeC:\Windows\system32\Jmnheggo.exe87⤵
- Modifies registry class
PID:5056 -
C:\Windows\SysWOW64\Jkbhok32.exeC:\Windows\system32\Jkbhok32.exe88⤵PID:5916
-
C:\Windows\SysWOW64\Jpoagb32.exeC:\Windows\system32\Jpoagb32.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6076 -
C:\Windows\SysWOW64\Kdfmcobk.exeC:\Windows\system32\Kdfmcobk.exe90⤵PID:3256
-
C:\Windows\SysWOW64\Kolaqh32.exeC:\Windows\system32\Kolaqh32.exe91⤵PID:2820
-
C:\Windows\SysWOW64\Ldiiio32.exeC:\Windows\system32\Ldiiio32.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5416 -
C:\Windows\SysWOW64\Mhenpk32.exeC:\Windows\system32\Mhenpk32.exe93⤵
- Drops file in System32 directory
PID:5472 -
C:\Windows\SysWOW64\Nnimia32.exeC:\Windows\system32\Nnimia32.exe94⤵PID:2836
-
C:\Windows\SysWOW64\Pnbifmla.exeC:\Windows\system32\Pnbifmla.exe95⤵PID:3080
-
C:\Windows\SysWOW64\Aiapjecl.exeC:\Windows\system32\Aiapjecl.exe96⤵PID:5872
-
C:\Windows\SysWOW64\Blnhgn32.exeC:\Windows\system32\Blnhgn32.exe97⤵PID:5968
-
C:\Windows\SysWOW64\Biaiqb32.exeC:\Windows\system32\Biaiqb32.exe98⤵PID:6136
-
C:\Windows\SysWOW64\Bbjmih32.exeC:\Windows\system32\Bbjmih32.exe99⤵PID:5220
-
C:\Windows\SysWOW64\Bhgeao32.exeC:\Windows\system32\Bhgeao32.exe100⤵PID:3860
-
C:\Windows\SysWOW64\Bbljoh32.exeC:\Windows\system32\Bbljoh32.exe101⤵PID:5456
-
C:\Windows\SysWOW64\Blenhmph.exeC:\Windows\system32\Blenhmph.exe102⤵PID:5604
-
C:\Windows\SysWOW64\Ccfmef32.exeC:\Windows\system32\Ccfmef32.exe103⤵PID:5740
-
C:\Windows\SysWOW64\Dekobaki.exeC:\Windows\system32\Dekobaki.exe104⤵PID:5776
-
C:\Windows\SysWOW64\Dpemjifi.exeC:\Windows\system32\Dpemjifi.exe105⤵PID:3948
-
C:\Windows\SysWOW64\Ehekjk32.exeC:\Windows\system32\Ehekjk32.exe106⤵PID:5944
-
C:\Windows\SysWOW64\Ehhgpj32.exeC:\Windows\system32\Ehhgpj32.exe107⤵PID:5644
-
C:\Windows\SysWOW64\Eqalfgll.exeC:\Windows\system32\Eqalfgll.exe108⤵PID:3024
-
C:\Windows\SysWOW64\Fqcilgji.exeC:\Windows\system32\Fqcilgji.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1800 -
C:\Windows\SysWOW64\Fifdqhal.exeC:\Windows\system32\Fifdqhal.exe110⤵PID:4496
-
C:\Windows\SysWOW64\Fbnhjn32.exeC:\Windows\system32\Fbnhjn32.exe111⤵PID:4692
-
C:\Windows\SysWOW64\Gbqeonfj.exeC:\Windows\system32\Gbqeonfj.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4832 -
C:\Windows\SysWOW64\Gbcaemdg.exeC:\Windows\system32\Gbcaemdg.exe113⤵PID:5876
-
C:\Windows\SysWOW64\Giofggia.exeC:\Windows\system32\Giofggia.exe114⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3944 -
C:\Windows\SysWOW64\Gcggjp32.exeC:\Windows\system32\Gcggjp32.exe115⤵PID:5144
-
C:\Windows\SysWOW64\Hpgkeodo.exeC:\Windows\system32\Hpgkeodo.exe116⤵PID:4220
-
C:\Windows\SysWOW64\Ibmmbj32.exeC:\Windows\system32\Ibmmbj32.exe117⤵PID:2404
-
C:\Windows\SysWOW64\Jagqfp32.exeC:\Windows\system32\Jagqfp32.exe118⤵
- Modifies registry class
PID:1264 -
C:\Windows\SysWOW64\Kiikkada.exeC:\Windows\system32\Kiikkada.exe119⤵PID:6004
-
C:\Windows\SysWOW64\Ldhbnhlm.exeC:\Windows\system32\Ldhbnhlm.exe120⤵PID:1716
-
C:\Windows\SysWOW64\Mnapnl32.exeC:\Windows\system32\Mnapnl32.exe121⤵PID:3108
-
C:\Windows\SysWOW64\Nglala32.exeC:\Windows\system32\Nglala32.exe122⤵PID:1760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-