Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
169s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2023, 18:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.3632fcc22bfb2c2abca1c8dc31fe8440.exe
Resource
win7-20230831-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.3632fcc22bfb2c2abca1c8dc31fe8440.exe
Resource
win10v2004-20230915-en
5 signatures
150 seconds
General
-
Target
NEAS.3632fcc22bfb2c2abca1c8dc31fe8440.exe
-
Size
1.3MB
-
MD5
3632fcc22bfb2c2abca1c8dc31fe8440
-
SHA1
1db71361ada8be90c8af44ba3d3555295aba934a
-
SHA256
ffa9b9f8753cd5a5f3756543cb836676f7928c6f87864a0d72fa4824e3606f81
-
SHA512
626ff9111a31f8a8ee4bb9e7380bf308ee7879b77d47c4dee467b0b6c0001b7575516fae86c246e91909cd166ea63c0da63163334d3f78ad5e684692901dc8ce
-
SSDEEP
24576:7g85yNPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oW:7g85yFbazR0vKLXZ
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Apeagd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ggnenagl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hddbmedc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qekbaf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onekqf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bijncb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ghanoeel.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Poggnnkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kkpbbdil.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jebfgl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ogefqeaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kagbmkch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ikickgnf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Clmcdc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iqmincia.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Noledjel.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Elbhde32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fpggkbfq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iljpbp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lnadkmhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mmfalimb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eoekmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hfajlp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nnfgmjfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Blchmdff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hjedpkne.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kijcanhl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifjohe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Khlaoeoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kkgdhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kgopbj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kqknekjf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldpmlh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lbcedmnl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okcogc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mqbpjmeg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pihmcflg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kbmoodbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mminaikp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gfjfag32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oeopgc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpaacblm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Niqnli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qaabfgpa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kqknekjf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Meljkeed.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjdokb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aealll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gjohnkdd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knfeoobh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Noaeqjpe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmhofbma.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lonnfg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmdach32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpklja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kongmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bbcignbo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idjdqc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pgllki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mllccpfj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmlkpgia.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okpkaqmp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pefhfgoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hgbfai32.exe -
Executes dropped EXE 64 IoCs
pid Process 452 Gcqjal32.exe 4864 Hqdkkp32.exe 1940 Hkjohi32.exe 2104 Hjdedepg.exe 1716 Hghfnioq.exe 3972 Ielfgmnj.exe 1532 Ibpgqa32.exe 3096 Ijkled32.exe 2956 Iholohii.exe 2712 Jjdokb32.exe 4800 Jejbhk32.exe 728 Jacpcl32.exe 1252 Kongmo32.exe 3048 Kaopoj32.exe 4648 Kkgdhp32.exe 1144 Khkdad32.exe 3936 Lbcedmnl.exe 3620 Ldkhlcnb.exe 5052 Maaekg32.exe 4720 Mllccpfj.exe 1272 Nefdbekh.exe 3904 Namegfql.exe 4532 Noaeqjpe.exe 3056 Odedipge.exe 4260 Okailj32.exe 4164 Ocmjhfjl.exe 3244 Pfncia32.exe 4972 Pecpknke.exe 2884 Piceflpi.exe 4472 Qmanljfo.exe 1600 Qkfkng32.exe 532 Aealll32.exe 4016 Acdioc32.exe 5024 Bifkcioc.exe 2976 Bclppboi.exe 4364 Blgddd32.exe 3828 Bmfqngcg.exe 2132 Bbcignbo.exe 4944 Bpgjpb32.exe 1176 Cffkhl32.exe 2860 Clbdpc32.exe 4340 Cifdjg32.exe 4188 Cfjeckpj.exe 4816 Cdnelpod.exe 4216 Cmgjee32.exe 4796 Debnjgcp.exe 1768 Dpgbgpbe.exe 1276 Dipgpf32.exe 4980 Ddekmo32.exe 2360 Dibdeegc.exe 4540 Deidjf32.exe 3020 Epaemojk.exe 1392 Eiijfd32.exe 2640 Imfdaigj.exe 2228 Mmhofbma.exe 756 Mdagbl32.exe 1036 Moglpedd.exe 2656 Mhppik32.exe 5084 Nmlhaa32.exe 980 Nkbfpeec.exe 4836 Ndkjik32.exe 2696 Nemchn32.exe 556 Ohnljine.exe 5060 Ogefqeaj.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Dlmbgm32.dll Mbmbiqqp.exe File created C:\Windows\SysWOW64\Oeloebcb.exe Oejbpb32.exe File created C:\Windows\SysWOW64\Gbambkif.dll Albikp32.exe File opened for modification C:\Windows\SysWOW64\Lgamhjja.exe Kgopbj32.exe File created C:\Windows\SysWOW64\Mlnpjf32.dll Dihllkal.exe File opened for modification C:\Windows\SysWOW64\Laalnpoi.exe Edaamihh.exe File created C:\Windows\SysWOW64\Gkldjmmq.dll Clmcdc32.exe File opened for modification C:\Windows\SysWOW64\Kgopbj32.exe Kjkpif32.exe File created C:\Windows\SysWOW64\Joioak32.dll Fimonh32.exe File created C:\Windows\SysWOW64\Pddhlnfg.exe Pmjpod32.exe File created C:\Windows\SysWOW64\Hqfqpo32.exe Hjlhcehq.exe File created C:\Windows\SysWOW64\Kmeeafnb.dll Aaldngqg.exe File created C:\Windows\SysWOW64\Ecipeb32.exe Elbhde32.exe File created C:\Windows\SysWOW64\Fpggkbfq.exe Fimonh32.exe File created C:\Windows\SysWOW64\Odljbmgj.dll Kqknekjf.exe File opened for modification C:\Windows\SysWOW64\Khkdad32.exe Kkgdhp32.exe File opened for modification C:\Windows\SysWOW64\Imfdaigj.exe Eiijfd32.exe File created C:\Windows\SysWOW64\Inhion32.exe Ioclnblj.exe File opened for modification C:\Windows\SysWOW64\Oooodcci.exe Nbkojo32.exe File created C:\Windows\SysWOW64\Mcnmccfa.exe Lnadkmhj.exe File opened for modification C:\Windows\SysWOW64\Ohnljine.exe Nemchn32.exe File opened for modification C:\Windows\SysWOW64\Oiagcg32.exe Onkbenbi.exe File created C:\Windows\SysWOW64\Agiegh32.dll Cbeokmbn.exe File created C:\Windows\SysWOW64\Emnhomim.dll Ldkhlcnb.exe File created C:\Windows\SysWOW64\Afinbdon.exe Alqjiohm.exe File created C:\Windows\SysWOW64\Iqmgpnie.exe Idffkm32.exe File created C:\Windows\SysWOW64\Blnhgn32.exe Bojhnjgf.exe File opened for modification C:\Windows\SysWOW64\Dmmblkpm.exe Doiabgqc.exe File opened for modification C:\Windows\SysWOW64\Dflmep32.exe Dihllkal.exe File created C:\Windows\SysWOW64\Kcfeablh.dll Icoodj32.exe File created C:\Windows\SysWOW64\Oenflo32.dll Piceflpi.exe File created C:\Windows\SysWOW64\Moglpedd.exe Mdagbl32.exe File created C:\Windows\SysWOW64\Hfajlp32.exe Hhmmkcko.exe File opened for modification C:\Windows\SysWOW64\Onkbenbi.exe Ogajid32.exe File created C:\Windows\SysWOW64\Inhgja32.dll Jcknpi32.exe File created C:\Windows\SysWOW64\Ddnigkcd.dll Kmdlolmg.exe File opened for modification C:\Windows\SysWOW64\Aepekk32.exe Pnknbc32.exe File created C:\Windows\SysWOW64\Blchmdff.exe Bplhhc32.exe File created C:\Windows\SysWOW64\Hdcbbbbi.dll Bhdilold.exe File created C:\Windows\SysWOW64\Hjqkel32.exe Hddbmedc.exe File created C:\Windows\SysWOW64\Pcepdl32.exe Poggnnkk.exe File opened for modification C:\Windows\SysWOW64\Alqjiohm.exe Aomipkic.exe File opened for modification C:\Windows\SysWOW64\Pgllki32.exe Pnchbdjo.exe File created C:\Windows\SysWOW64\Diopoe32.exe Dhpceb32.exe File created C:\Windows\SysWOW64\Nmlhaa32.exe Mhppik32.exe File created C:\Windows\SysWOW64\Fmnfnl32.dll Cehdib32.exe File opened for modification C:\Windows\SysWOW64\Ponfed32.exe Oimdbnip.exe File created C:\Windows\SysWOW64\Igpkjo32.exe Hjedpkne.exe File opened for modification C:\Windows\SysWOW64\Cccppgcp.exe Clihcm32.exe File created C:\Windows\SysWOW64\Bhaioiic.dll Moniclal.exe File created C:\Windows\SysWOW64\Kanibj32.dll Bpmpickd.exe File opened for modification C:\Windows\SysWOW64\Jgpmffeh.exe Jljiimeb.exe File opened for modification C:\Windows\SysWOW64\Jnjecp32.exe Jgpmffeh.exe File opened for modification C:\Windows\SysWOW64\Dbnbaljc.exe Cejahhki.exe File created C:\Windows\SysWOW64\Lbcedmnl.exe Khkdad32.exe File created C:\Windows\SysWOW64\Gakmni32.dll Mhppik32.exe File opened for modification C:\Windows\SysWOW64\Ffjignde.exe Fppqjcli.exe File opened for modification C:\Windows\SysWOW64\Fmkgdgej.exe Fbecgned.exe File created C:\Windows\SysWOW64\Mmfalimb.exe Mcnmccfa.exe File opened for modification C:\Windows\SysWOW64\Kmijglma.exe Khlaoeoj.exe File created C:\Windows\SysWOW64\Hhgkhlho.dll Ogefjjfg.exe File opened for modification C:\Windows\SysWOW64\Gpgihh32.exe Gjkqpa32.exe File opened for modification C:\Windows\SysWOW64\Idjdqc32.exe Iffcgoka.exe File opened for modification C:\Windows\SysWOW64\Fgpilc32.exe Fkihgb32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpngef32.dll" Cmgjee32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ddekmo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eiijfd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aagpjm32.dll" Obdbqm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Iqmincia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dbikdbnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kmijglma.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Namegfql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nmlhaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pinhcb32.dll" Mmcfdi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jhocgqjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbofckhp.dll" Mqbpjmeg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohkjah32.dll" Appaangd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lhhakddm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aaldngqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kndodehf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihdhon32.dll" Cihcen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mklkepal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldjbla32.dll" Pknqhh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ciljbh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emnhomim.dll" Ldkhlcnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hijjpjqc.dll" Agjhbbob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iejecf32.dll" Clpppmqn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pacahhib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aaflag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnjdgp32.dll" Edaamihh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmpine32.dll" Khondelh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ohpiinbp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Acdioc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khfchg32.dll" Fgpilc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qoamab32.dll" Kkpbbdil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ldpmlh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ljaooodf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kanibj32.dll" Bpmpickd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nefdbekh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Igkmbn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ckaffjbg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifjngf32.dll" Fmkgdgej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ohcmid32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kjdqapec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdldqa32.dll" Ohicho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Holhmcgf.dll" Gcqjal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cfjeckpj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdhiigok.dll" Peajngoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Blnhgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iiopnhkp.dll" Ffjignde.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eoekmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fbajlo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ignaamgc.dll" Mkdihm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Demnngif.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Clpppmqn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gkkndp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Keinepch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbhkgb32.dll" Dmakgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Niiffk32.dll" Khlaoeoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ddekmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cncnbean.dll" Ponfed32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogaboiq.dll" Pnknbc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Obidljll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oldeekcp.dll" Mgkjmnme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Okneeiac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iholohii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cifdjg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idmjoidf.dll" Pgbdmfnc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2204 wrote to memory of 452 2204 NEAS.3632fcc22bfb2c2abca1c8dc31fe8440.exe 81 PID 2204 wrote to memory of 452 2204 NEAS.3632fcc22bfb2c2abca1c8dc31fe8440.exe 81 PID 2204 wrote to memory of 452 2204 NEAS.3632fcc22bfb2c2abca1c8dc31fe8440.exe 81 PID 452 wrote to memory of 4864 452 Gcqjal32.exe 82 PID 452 wrote to memory of 4864 452 Gcqjal32.exe 82 PID 452 wrote to memory of 4864 452 Gcqjal32.exe 82 PID 4864 wrote to memory of 1940 4864 Hqdkkp32.exe 84 PID 4864 wrote to memory of 1940 4864 Hqdkkp32.exe 84 PID 4864 wrote to memory of 1940 4864 Hqdkkp32.exe 84 PID 1940 wrote to memory of 2104 1940 Hkjohi32.exe 85 PID 1940 wrote to memory of 2104 1940 Hkjohi32.exe 85 PID 1940 wrote to memory of 2104 1940 Hkjohi32.exe 85 PID 2104 wrote to memory of 1716 2104 Hjdedepg.exe 86 PID 2104 wrote to memory of 1716 2104 Hjdedepg.exe 86 PID 2104 wrote to memory of 1716 2104 Hjdedepg.exe 86 PID 1716 wrote to memory of 3972 1716 Hghfnioq.exe 89 PID 1716 wrote to memory of 3972 1716 Hghfnioq.exe 89 PID 1716 wrote to memory of 3972 1716 Hghfnioq.exe 89 PID 3972 wrote to memory of 1532 3972 Ielfgmnj.exe 88 PID 3972 wrote to memory of 1532 3972 Ielfgmnj.exe 88 PID 3972 wrote to memory of 1532 3972 Ielfgmnj.exe 88 PID 1532 wrote to memory of 3096 1532 Ibpgqa32.exe 87 PID 1532 wrote to memory of 3096 1532 Ibpgqa32.exe 87 PID 1532 wrote to memory of 3096 1532 Ibpgqa32.exe 87 PID 3096 wrote to memory of 2956 3096 Ijkled32.exe 90 PID 3096 wrote to memory of 2956 3096 Ijkled32.exe 90 PID 3096 wrote to memory of 2956 3096 Ijkled32.exe 90 PID 2956 wrote to memory of 2712 2956 Iholohii.exe 92 PID 2956 wrote to memory of 2712 2956 Iholohii.exe 92 PID 2956 wrote to memory of 2712 2956 Iholohii.exe 92 PID 2712 wrote to memory of 4800 2712 Jjdokb32.exe 91 PID 2712 wrote to memory of 4800 2712 Jjdokb32.exe 91 PID 2712 wrote to memory of 4800 2712 Jjdokb32.exe 91 PID 4800 wrote to memory of 728 4800 Jejbhk32.exe 93 PID 4800 wrote to memory of 728 4800 Jejbhk32.exe 93 PID 4800 wrote to memory of 728 4800 Jejbhk32.exe 93 PID 728 wrote to memory of 1252 728 Jacpcl32.exe 94 PID 728 wrote to memory of 1252 728 Jacpcl32.exe 94 PID 728 wrote to memory of 1252 728 Jacpcl32.exe 94 PID 1252 wrote to memory of 3048 1252 Kongmo32.exe 95 PID 1252 wrote to memory of 3048 1252 Kongmo32.exe 95 PID 1252 wrote to memory of 3048 1252 Kongmo32.exe 95 PID 3048 wrote to memory of 4648 3048 Kaopoj32.exe 96 PID 3048 wrote to memory of 4648 3048 Kaopoj32.exe 96 PID 3048 wrote to memory of 4648 3048 Kaopoj32.exe 96 PID 4648 wrote to memory of 1144 4648 Kkgdhp32.exe 97 PID 4648 wrote to memory of 1144 4648 Kkgdhp32.exe 97 PID 4648 wrote to memory of 1144 4648 Kkgdhp32.exe 97 PID 1144 wrote to memory of 3936 1144 Khkdad32.exe 98 PID 1144 wrote to memory of 3936 1144 Khkdad32.exe 98 PID 1144 wrote to memory of 3936 1144 Khkdad32.exe 98 PID 3936 wrote to memory of 3620 3936 Lbcedmnl.exe 99 PID 3936 wrote to memory of 3620 3936 Lbcedmnl.exe 99 PID 3936 wrote to memory of 3620 3936 Lbcedmnl.exe 99 PID 3620 wrote to memory of 5052 3620 Ldkhlcnb.exe 100 PID 3620 wrote to memory of 5052 3620 Ldkhlcnb.exe 100 PID 3620 wrote to memory of 5052 3620 Ldkhlcnb.exe 100 PID 5052 wrote to memory of 4720 5052 Maaekg32.exe 101 PID 5052 wrote to memory of 4720 5052 Maaekg32.exe 101 PID 5052 wrote to memory of 4720 5052 Maaekg32.exe 101 PID 4720 wrote to memory of 1272 4720 Mllccpfj.exe 102 PID 4720 wrote to memory of 1272 4720 Mllccpfj.exe 102 PID 4720 wrote to memory of 1272 4720 Mllccpfj.exe 102 PID 1272 wrote to memory of 3904 1272 Nefdbekh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.3632fcc22bfb2c2abca1c8dc31fe8440.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.3632fcc22bfb2c2abca1c8dc31fe8440.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\Gcqjal32.exeC:\Windows\system32\Gcqjal32.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\SysWOW64\Hqdkkp32.exeC:\Windows\system32\Hqdkkp32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\Hkjohi32.exeC:\Windows\system32\Hkjohi32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\Hjdedepg.exeC:\Windows\system32\Hjdedepg.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\Hghfnioq.exeC:\Windows\system32\Hghfnioq.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\Ielfgmnj.exeC:\Windows\system32\Ielfgmnj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Ijkled32.exeC:\Windows\system32\Ijkled32.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\Iholohii.exeC:\Windows\system32\Iholohii.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\Jjdokb32.exeC:\Windows\system32\Jjdokb32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712
-
-
-
C:\Windows\SysWOW64\Ibpgqa32.exeC:\Windows\system32\Ibpgqa32.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532
-
C:\Windows\SysWOW64\Jejbhk32.exeC:\Windows\system32\Jejbhk32.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\Jacpcl32.exeC:\Windows\system32\Jacpcl32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\SysWOW64\Kongmo32.exeC:\Windows\system32\Kongmo32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\Kaopoj32.exeC:\Windows\system32\Kaopoj32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\Kkgdhp32.exeC:\Windows\system32\Kkgdhp32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\Khkdad32.exeC:\Windows\system32\Khkdad32.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\Lbcedmnl.exeC:\Windows\system32\Lbcedmnl.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SysWOW64\Ldkhlcnb.exeC:\Windows\system32\Ldkhlcnb.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\Maaekg32.exeC:\Windows\system32\Maaekg32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\Mllccpfj.exeC:\Windows\system32\Mllccpfj.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\Nefdbekh.exeC:\Windows\system32\Nefdbekh.exe11⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\Namegfql.exeC:\Windows\system32\Namegfql.exe12⤵
- Executes dropped EXE
- Modifies registry class
PID:3904 -
C:\Windows\SysWOW64\Noaeqjpe.exeC:\Windows\system32\Noaeqjpe.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4532 -
C:\Windows\SysWOW64\Odedipge.exeC:\Windows\system32\Odedipge.exe14⤵
- Executes dropped EXE
PID:3056 -
C:\Windows\SysWOW64\Okailj32.exeC:\Windows\system32\Okailj32.exe15⤵
- Executes dropped EXE
PID:4260 -
C:\Windows\SysWOW64\Ocmjhfjl.exeC:\Windows\system32\Ocmjhfjl.exe16⤵
- Executes dropped EXE
PID:4164 -
C:\Windows\SysWOW64\Pfncia32.exeC:\Windows\system32\Pfncia32.exe17⤵
- Executes dropped EXE
PID:3244 -
C:\Windows\SysWOW64\Pecpknke.exeC:\Windows\system32\Pecpknke.exe18⤵
- Executes dropped EXE
PID:4972 -
C:\Windows\SysWOW64\Piceflpi.exeC:\Windows\system32\Piceflpi.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2884 -
C:\Windows\SysWOW64\Qmanljfo.exeC:\Windows\system32\Qmanljfo.exe20⤵
- Executes dropped EXE
PID:4472 -
C:\Windows\SysWOW64\Qkfkng32.exeC:\Windows\system32\Qkfkng32.exe21⤵
- Executes dropped EXE
PID:1600 -
C:\Windows\SysWOW64\Aealll32.exeC:\Windows\system32\Aealll32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:532 -
C:\Windows\SysWOW64\Acdioc32.exeC:\Windows\system32\Acdioc32.exe23⤵
- Executes dropped EXE
- Modifies registry class
PID:4016 -
C:\Windows\SysWOW64\Bifkcioc.exeC:\Windows\system32\Bifkcioc.exe24⤵
- Executes dropped EXE
PID:5024 -
C:\Windows\SysWOW64\Bclppboi.exeC:\Windows\system32\Bclppboi.exe25⤵
- Executes dropped EXE
PID:2976 -
C:\Windows\SysWOW64\Blgddd32.exeC:\Windows\system32\Blgddd32.exe26⤵
- Executes dropped EXE
PID:4364 -
C:\Windows\SysWOW64\Bmfqngcg.exeC:\Windows\system32\Bmfqngcg.exe27⤵
- Executes dropped EXE
PID:3828 -
C:\Windows\SysWOW64\Bbcignbo.exeC:\Windows\system32\Bbcignbo.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2132 -
C:\Windows\SysWOW64\Bpgjpb32.exeC:\Windows\system32\Bpgjpb32.exe29⤵
- Executes dropped EXE
PID:4944 -
C:\Windows\SysWOW64\Cffkhl32.exeC:\Windows\system32\Cffkhl32.exe30⤵
- Executes dropped EXE
PID:1176 -
C:\Windows\SysWOW64\Clbdpc32.exeC:\Windows\system32\Clbdpc32.exe31⤵
- Executes dropped EXE
PID:2860 -
C:\Windows\SysWOW64\Cifdjg32.exeC:\Windows\system32\Cifdjg32.exe32⤵
- Executes dropped EXE
- Modifies registry class
PID:4340 -
C:\Windows\SysWOW64\Cfjeckpj.exeC:\Windows\system32\Cfjeckpj.exe33⤵
- Executes dropped EXE
- Modifies registry class
PID:4188 -
C:\Windows\SysWOW64\Cdnelpod.exeC:\Windows\system32\Cdnelpod.exe34⤵
- Executes dropped EXE
PID:4816 -
C:\Windows\SysWOW64\Cmgjee32.exeC:\Windows\system32\Cmgjee32.exe35⤵
- Executes dropped EXE
- Modifies registry class
PID:4216 -
C:\Windows\SysWOW64\Debnjgcp.exeC:\Windows\system32\Debnjgcp.exe36⤵
- Executes dropped EXE
PID:4796 -
C:\Windows\SysWOW64\Dpgbgpbe.exeC:\Windows\system32\Dpgbgpbe.exe37⤵
- Executes dropped EXE
PID:1768 -
C:\Windows\SysWOW64\Dipgpf32.exeC:\Windows\system32\Dipgpf32.exe38⤵
- Executes dropped EXE
PID:1276 -
C:\Windows\SysWOW64\Ddekmo32.exeC:\Windows\system32\Ddekmo32.exe39⤵
- Executes dropped EXE
- Modifies registry class
PID:4980 -
C:\Windows\SysWOW64\Dibdeegc.exeC:\Windows\system32\Dibdeegc.exe40⤵
- Executes dropped EXE
PID:2360 -
C:\Windows\SysWOW64\Deidjf32.exeC:\Windows\system32\Deidjf32.exe41⤵
- Executes dropped EXE
PID:4540 -
C:\Windows\SysWOW64\Epaemojk.exeC:\Windows\system32\Epaemojk.exe42⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\Eiijfd32.exeC:\Windows\system32\Eiijfd32.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1392 -
C:\Windows\SysWOW64\Imfdaigj.exeC:\Windows\system32\Imfdaigj.exe44⤵
- Executes dropped EXE
PID:2640 -
C:\Windows\SysWOW64\Mmhofbma.exeC:\Windows\system32\Mmhofbma.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2228 -
C:\Windows\SysWOW64\Mdagbl32.exeC:\Windows\system32\Mdagbl32.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:756 -
C:\Windows\SysWOW64\Moglpedd.exeC:\Windows\system32\Moglpedd.exe47⤵
- Executes dropped EXE
PID:1036 -
C:\Windows\SysWOW64\Mhppik32.exeC:\Windows\system32\Mhppik32.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2656 -
C:\Windows\SysWOW64\Nmlhaa32.exeC:\Windows\system32\Nmlhaa32.exe49⤵
- Executes dropped EXE
- Modifies registry class
PID:5084 -
C:\Windows\SysWOW64\Nkbfpeec.exeC:\Windows\system32\Nkbfpeec.exe50⤵
- Executes dropped EXE
PID:980 -
C:\Windows\SysWOW64\Ndkjik32.exeC:\Windows\system32\Ndkjik32.exe51⤵
- Executes dropped EXE
PID:4836 -
C:\Windows\SysWOW64\Nemchn32.exeC:\Windows\system32\Nemchn32.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2696 -
C:\Windows\SysWOW64\Ohnljine.exeC:\Windows\system32\Ohnljine.exe53⤵
- Executes dropped EXE
PID:556 -
C:\Windows\SysWOW64\Ogefqeaj.exeC:\Windows\system32\Ogefqeaj.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:5060 -
C:\Windows\SysWOW64\Oakjnnap.exeC:\Windows\system32\Oakjnnap.exe55⤵PID:1304
-
C:\Windows\SysWOW64\Okcogc32.exeC:\Windows\system32\Okcogc32.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:876 -
C:\Windows\SysWOW64\Poeahaib.exeC:\Windows\system32\Poeahaib.exe57⤵PID:4384
-
C:\Windows\SysWOW64\Pdbiphhi.exeC:\Windows\system32\Pdbiphhi.exe58⤵PID:4568
-
C:\Windows\SysWOW64\Pfbfjk32.exeC:\Windows\system32\Pfbfjk32.exe59⤵PID:1740
-
C:\Windows\SysWOW64\Qbkcek32.exeC:\Windows\system32\Qbkcek32.exe60⤵PID:1512
-
C:\Windows\SysWOW64\Qkchna32.exeC:\Windows\system32\Qkchna32.exe61⤵PID:4536
-
C:\Windows\SysWOW64\Qbmpjkqk.exeC:\Windows\system32\Qbmpjkqk.exe62⤵PID:5108
-
C:\Windows\SysWOW64\Agjhbbob.exeC:\Windows\system32\Agjhbbob.exe63⤵
- Modifies registry class
PID:4524 -
C:\Windows\SysWOW64\Aijeme32.exeC:\Windows\system32\Aijeme32.exe64⤵PID:1652
-
C:\Windows\SysWOW64\Aocmio32.exeC:\Windows\system32\Aocmio32.exe65⤵PID:3348
-
C:\Windows\SysWOW64\Adqeaf32.exeC:\Windows\system32\Adqeaf32.exe66⤵PID:2068
-
C:\Windows\SysWOW64\Aofjoo32.exeC:\Windows\system32\Aofjoo32.exe67⤵PID:2296
-
C:\Windows\SysWOW64\Afpbkicl.exeC:\Windows\system32\Afpbkicl.exe68⤵PID:1464
-
C:\Windows\SysWOW64\Ankgpk32.exeC:\Windows\system32\Ankgpk32.exe69⤵PID:4356
-
C:\Windows\SysWOW64\Anncek32.exeC:\Windows\system32\Anncek32.exe70⤵PID:4712
-
C:\Windows\SysWOW64\Bichcc32.exeC:\Windows\system32\Bichcc32.exe71⤵PID:1456
-
C:\Windows\SysWOW64\Bkdqdokk.exeC:\Windows\system32\Bkdqdokk.exe72⤵PID:4668
-
C:\Windows\SysWOW64\Bfieagka.exeC:\Windows\system32\Bfieagka.exe73⤵PID:2796
-
C:\Windows\SysWOW64\Bgkaip32.exeC:\Windows\system32\Bgkaip32.exe74⤵PID:2684
-
C:\Windows\SysWOW64\Bbpeghpe.exeC:\Windows\system32\Bbpeghpe.exe75⤵PID:4520
-
C:\Windows\SysWOW64\Bijncb32.exeC:\Windows\system32\Bijncb32.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:208 -
C:\Windows\SysWOW64\Bpdfpmoo.exeC:\Windows\system32\Bpdfpmoo.exe77⤵PID:3176
-
C:\Windows\SysWOW64\Bfnnmg32.exeC:\Windows\system32\Bfnnmg32.exe78⤵PID:5128
-
C:\Windows\SysWOW64\Bpfcelml.exeC:\Windows\system32\Bpfcelml.exe79⤵PID:5160
-
C:\Windows\SysWOW64\Becknc32.exeC:\Windows\system32\Becknc32.exe80⤵PID:5208
-
C:\Windows\SysWOW64\Cpipkl32.exeC:\Windows\system32\Cpipkl32.exe81⤵PID:5256
-
C:\Windows\SysWOW64\Cfbhhfbg.exeC:\Windows\system32\Cfbhhfbg.exe82⤵PID:5296
-
C:\Windows\SysWOW64\Clpppmqn.exeC:\Windows\system32\Clpppmqn.exe83⤵
- Modifies registry class
PID:5336 -
C:\Windows\SysWOW64\Cehdib32.exeC:\Windows\system32\Cehdib32.exe84⤵
- Drops file in System32 directory
PID:5544 -
C:\Windows\SysWOW64\Ojmgggdo.exeC:\Windows\system32\Ojmgggdo.exe85⤵PID:5612
-
C:\Windows\SysWOW64\Pilgnb32.exeC:\Windows\system32\Pilgnb32.exe86⤵PID:5740
-
C:\Windows\SysWOW64\Pmipdq32.exeC:\Windows\system32\Pmipdq32.exe87⤵PID:5784
-
C:\Windows\SysWOW64\Pphlpl32.exeC:\Windows\system32\Pphlpl32.exe88⤵PID:5824
-
C:\Windows\SysWOW64\Pgbdmfnc.exeC:\Windows\system32\Pgbdmfnc.exe89⤵
- Modifies registry class
PID:5868 -
C:\Windows\SysWOW64\Qipqibmf.exeC:\Windows\system32\Qipqibmf.exe90⤵PID:5920
-
C:\Windows\SysWOW64\Qlomemlj.exeC:\Windows\system32\Qlomemlj.exe91⤵PID:4108
-
C:\Windows\SysWOW64\Ihdjfhhc.exeC:\Windows\system32\Ihdjfhhc.exe92⤵PID:4276
-
C:\Windows\SysWOW64\Ihicah32.exeC:\Windows\system32\Ihicah32.exe93⤵PID:3968
-
C:\Windows\SysWOW64\Ioclnblj.exeC:\Windows\system32\Ioclnblj.exe94⤵
- Drops file in System32 directory
PID:5600 -
C:\Windows\SysWOW64\Inhion32.exeC:\Windows\system32\Inhion32.exe95⤵PID:408
-
C:\Windows\SysWOW64\Oimdbnip.exeC:\Windows\system32\Oimdbnip.exe96⤵
- Drops file in System32 directory
PID:5708 -
C:\Windows\SysWOW64\Ponfed32.exeC:\Windows\system32\Ponfed32.exe97⤵
- Modifies registry class
PID:5760 -
C:\Windows\SysWOW64\Pldcdhpi.exeC:\Windows\system32\Pldcdhpi.exe98⤵PID:5908
-
C:\Windows\SysWOW64\Pmiijjcf.exeC:\Windows\system32\Pmiijjcf.exe99⤵PID:5984
-
C:\Windows\SysWOW64\Qibfdkgh.exeC:\Windows\system32\Qibfdkgh.exe100⤵PID:6032
-
C:\Windows\SysWOW64\Apqhldjp.exeC:\Windows\system32\Apqhldjp.exe101⤵PID:6060
-
C:\Windows\SysWOW64\Amdiei32.exeC:\Windows\system32\Amdiei32.exe102⤵PID:6112
-
C:\Windows\SysWOW64\Apeagd32.exeC:\Windows\system32\Apeagd32.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5216 -
C:\Windows\SysWOW64\Bplhhc32.exeC:\Windows\system32\Bplhhc32.exe104⤵
- Drops file in System32 directory
PID:5288 -
C:\Windows\SysWOW64\Blchmdff.exeC:\Windows\system32\Blchmdff.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3588 -
C:\Windows\SysWOW64\Bpaacblm.exeC:\Windows\system32\Bpaacblm.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5360 -
C:\Windows\SysWOW64\Cnealfkf.exeC:\Windows\system32\Cnealfkf.exe107⤵PID:892
-
C:\Windows\SysWOW64\Cnjkgf32.exeC:\Windows\system32\Cnjkgf32.exe108⤵PID:5388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Cfeplh32.exeC:\Windows\system32\Cfeplh32.exe1⤵PID:5452
-
C:\Windows\SysWOW64\Cgdlfk32.exeC:\Windows\system32\Cgdlfk32.exe2⤵PID:3488
-
C:\Windows\SysWOW64\Dobnpm32.exeC:\Windows\system32\Dobnpm32.exe3⤵PID:5508
-
C:\Windows\SysWOW64\Dnekcd32.exeC:\Windows\system32\Dnekcd32.exe4⤵PID:4220
-
C:\Windows\SysWOW64\Dofgklcb.exeC:\Windows\system32\Dofgklcb.exe5⤵PID:4452
-
C:\Windows\SysWOW64\Djnhne32.exeC:\Windows\system32\Djnhne32.exe6⤵PID:4116
-
C:\Windows\SysWOW64\Dqhpjohb.exeC:\Windows\system32\Dqhpjohb.exe7⤵PID:4768
-
C:\Windows\SysWOW64\Enlqdc32.exeC:\Windows\system32\Enlqdc32.exe8⤵PID:880
-
C:\Windows\SysWOW64\Eopjakkg.exeC:\Windows\system32\Eopjakkg.exe9⤵PID:4516
-
C:\Windows\SysWOW64\Egiohh32.exeC:\Windows\system32\Egiohh32.exe10⤵PID:1244
-
C:\Windows\SysWOW64\Eqdpfm32.exeC:\Windows\system32\Eqdpfm32.exe11⤵PID:4552
-
C:\Windows\SysWOW64\Fjldocde.exeC:\Windows\system32\Fjldocde.exe12⤵PID:1764
-
C:\Windows\SysWOW64\Fplimi32.exeC:\Windows\system32\Fplimi32.exe13⤵PID:5624
-
C:\Windows\SysWOW64\Fakfglhm.exeC:\Windows\system32\Fakfglhm.exe14⤵PID:4840
-
C:\Windows\SysWOW64\Fclohg32.exeC:\Windows\system32\Fclohg32.exe15⤵PID:1272
-
C:\Windows\SysWOW64\Fcnlng32.exeC:\Windows\system32\Fcnlng32.exe16⤵PID:3572
-
C:\Windows\SysWOW64\Gndpkp32.exeC:\Windows\system32\Gndpkp32.exe17⤵PID:1036
-
C:\Windows\SysWOW64\Gcqhcgqi.exeC:\Windows\system32\Gcqhcgqi.exe18⤵PID:4912
-
C:\Windows\SysWOW64\Gjkqpa32.exeC:\Windows\system32\Gjkqpa32.exe19⤵
- Drops file in System32 directory
PID:2016 -
C:\Windows\SysWOW64\Gpgihh32.exeC:\Windows\system32\Gpgihh32.exe20⤵PID:5644
-
C:\Windows\SysWOW64\Gmkibl32.exeC:\Windows\system32\Gmkibl32.exe21⤵PID:4764
-
C:\Windows\SysWOW64\Ghanoeel.exeC:\Windows\system32\Ghanoeel.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4836 -
C:\Windows\SysWOW64\Gaibhj32.exeC:\Windows\system32\Gaibhj32.exe23⤵PID:1240
-
C:\Windows\SysWOW64\Gnmbao32.exeC:\Windows\system32\Gnmbao32.exe24⤵PID:2364
-
C:\Windows\SysWOW64\Hhmmkcko.exeC:\Windows\system32\Hhmmkcko.exe25⤵
- Drops file in System32 directory
PID:5876 -
C:\Windows\SysWOW64\Hfajlp32.exeC:\Windows\system32\Hfajlp32.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5092 -
C:\Windows\SysWOW64\Hmlbij32.exeC:\Windows\system32\Hmlbij32.exe27⤵PID:5976
-
C:\Windows\SysWOW64\Iokocmnf.exeC:\Windows\system32\Iokocmnf.exe28⤵PID:1644
-
C:\Windows\SysWOW64\Iplkje32.exeC:\Windows\system32\Iplkje32.exe29⤵PID:4620
-
C:\Windows\SysWOW64\Iffcgoka.exeC:\Windows\system32\Iffcgoka.exe30⤵
- Drops file in System32 directory
PID:6024 -
C:\Windows\SysWOW64\Idjdqc32.exeC:\Windows\system32\Idjdqc32.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5064 -
C:\Windows\SysWOW64\Igkmbn32.exeC:\Windows\system32\Igkmbn32.exe32⤵
- Modifies registry class
PID:6080 -
C:\Windows\SysWOW64\Idonlbff.exeC:\Windows\system32\Idonlbff.exe33⤵PID:2424
-
C:\Windows\SysWOW64\Jognokdi.exeC:\Windows\system32\Jognokdi.exe34⤵PID:6136
-
C:\Windows\SysWOW64\Jhocgqjj.exeC:\Windows\system32\Jhocgqjj.exe35⤵
- Modifies registry class
PID:4732 -
C:\Windows\SysWOW64\Jmlkpgia.exeC:\Windows\system32\Jmlkpgia.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4892 -
C:\Windows\SysWOW64\Jhapmphg.exeC:\Windows\system32\Jhapmphg.exe37⤵PID:5172
-
C:\Windows\SysWOW64\Jmnheggo.exeC:\Windows\system32\Jmnheggo.exe38⤵PID:4500
-
C:\Windows\SysWOW64\Jkbhok32.exeC:\Windows\system32\Jkbhok32.exe39⤵PID:4664
-
C:\Windows\SysWOW64\Jopaejlo.exeC:\Windows\system32\Jopaejlo.exe40⤵PID:552
-
C:\Windows\SysWOW64\Khifno32.exeC:\Windows\system32\Khifno32.exe41⤵PID:440
-
C:\Windows\SysWOW64\Kaajfe32.exeC:\Windows\system32\Kaajfe32.exe42⤵PID:4904
-
C:\Windows\SysWOW64\Koekpi32.exeC:\Windows\system32\Koekpi32.exe43⤵PID:5356
-
C:\Windows\SysWOW64\Knjhae32.exeC:\Windows\system32\Knjhae32.exe44⤵PID:1456
-
C:\Windows\SysWOW64\Khplnn32.exeC:\Windows\system32\Khplnn32.exe45⤵PID:3828
-
C:\Windows\SysWOW64\Kahpgcch.exeC:\Windows\system32\Kahpgcch.exe46⤵PID:112
-
C:\Windows\SysWOW64\Kgeiokao.exeC:\Windows\system32\Kgeiokao.exe47⤵PID:5096
-
C:\Windows\SysWOW64\Lonnfg32.exeC:\Windows\system32\Lonnfg32.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5488 -
C:\Windows\SysWOW64\Ldkfno32.exeC:\Windows\system32\Ldkfno32.exe49⤵PID:5180
-
C:\Windows\SysWOW64\Lncjgddf.exeC:\Windows\system32\Lncjgddf.exe50⤵PID:5300
-
C:\Windows\SysWOW64\Lhiodm32.exeC:\Windows\system32\Lhiodm32.exe51⤵PID:1208
-
C:\Windows\SysWOW64\Lqdcio32.exeC:\Windows\system32\Lqdcio32.exe52⤵PID:2116
-
C:\Windows\SysWOW64\Lgnleiid.exeC:\Windows\system32\Lgnleiid.exe53⤵PID:3952
-
C:\Windows\SysWOW64\Lqfpoope.exeC:\Windows\system32\Lqfpoope.exe54⤵PID:4216
-
C:\Windows\SysWOW64\Mqimdomb.exeC:\Windows\system32\Mqimdomb.exe55⤵PID:5568
-
C:\Windows\SysWOW64\Mgceqh32.exeC:\Windows\system32\Mgceqh32.exe56⤵PID:2360
-
C:\Windows\SysWOW64\Mdgejmdi.exeC:\Windows\system32\Mdgejmdi.exe57⤵PID:2008
-
C:\Windows\SysWOW64\Mdibplaf.exeC:\Windows\system32\Mdibplaf.exe58⤵PID:4848
-
C:\Windows\SysWOW64\Mkcjlf32.exeC:\Windows\system32\Mkcjlf32.exe59⤵PID:2648
-
C:\Windows\SysWOW64\Mbmbiqqp.exeC:\Windows\system32\Mbmbiqqp.exe60⤵
- Drops file in System32 directory
PID:2972 -
C:\Windows\SysWOW64\Mqbpjmeg.exeC:\Windows\system32\Mqbpjmeg.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1092 -
C:\Windows\SysWOW64\Nnfpcada.exeC:\Windows\system32\Nnfpcada.exe62⤵PID:3020
-
C:\Windows\SysWOW64\Nkjqme32.exeC:\Windows\system32\Nkjqme32.exe63⤵PID:2288
-
C:\Windows\SysWOW64\Nqgiel32.exeC:\Windows\system32\Nqgiel32.exe64⤵PID:1144
-
C:\Windows\SysWOW64\Nkmmbe32.exeC:\Windows\system32\Nkmmbe32.exe65⤵PID:4588
-
C:\Windows\SysWOW64\Niqnli32.exeC:\Windows\system32\Niqnli32.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4196 -
C:\Windows\SysWOW64\Ngekmf32.exeC:\Windows\system32\Ngekmf32.exe67⤵PID:4444
-
C:\Windows\SysWOW64\Nbkojo32.exeC:\Windows\system32\Nbkojo32.exe68⤵
- Drops file in System32 directory
PID:4788 -
C:\Windows\SysWOW64\Oooodcci.exeC:\Windows\system32\Oooodcci.exe69⤵PID:1608
-
C:\Windows\SysWOW64\Oelhljaq.exeC:\Windows\system32\Oelhljaq.exe70⤵PID:5864
-
C:\Windows\SysWOW64\Oendaipn.exeC:\Windows\system32\Oendaipn.exe71⤵PID:4488
-
C:\Windows\SysWOW64\Ongijo32.exeC:\Windows\system32\Ongijo32.exe72⤵PID:3004
-
C:\Windows\SysWOW64\Oilmhhfd.exeC:\Windows\system32\Oilmhhfd.exe73⤵PID:4308
-
C:\Windows\SysWOW64\Obdbqm32.exeC:\Windows\system32\Obdbqm32.exe74⤵
- Modifies registry class
PID:2148 -
C:\Windows\SysWOW64\Ogajid32.exeC:\Windows\system32\Ogajid32.exe75⤵
- Drops file in System32 directory
PID:4056 -
C:\Windows\SysWOW64\Onkbenbi.exeC:\Windows\system32\Onkbenbi.exe76⤵
- Drops file in System32 directory
PID:3208 -
C:\Windows\SysWOW64\Oiagcg32.exeC:\Windows\system32\Oiagcg32.exe77⤵PID:2004
-
C:\Windows\SysWOW64\Palkgi32.exeC:\Windows\system32\Palkgi32.exe78⤵PID:5312
-
C:\Windows\SysWOW64\Piepnfnj.exeC:\Windows\system32\Piepnfnj.exe79⤵PID:1780
-
C:\Windows\SysWOW64\Pbndgl32.exeC:\Windows\system32\Pbndgl32.exe80⤵PID:4368
-
C:\Windows\SysWOW64\Pihmcflg.exeC:\Windows\system32\Pihmcflg.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4364 -
C:\Windows\SysWOW64\Ppbepp32.exeC:\Windows\system32\Ppbepp32.exe82⤵PID:5404
-
C:\Windows\SysWOW64\Pacahhib.exeC:\Windows\system32\Pacahhib.exe83⤵
- Modifies registry class
PID:5484 -
C:\Windows\SysWOW64\Phmjdbpo.exeC:\Windows\system32\Phmjdbpo.exe84⤵PID:5256
-
C:\Windows\SysWOW64\Pngbam32.exeC:\Windows\system32\Pngbam32.exe85⤵PID:3384
-
C:\Windows\SysWOW64\Peajngoi.exeC:\Windows\system32\Peajngoi.exe86⤵
- Modifies registry class
PID:3980 -
C:\Windows\SysWOW64\Qniogl32.exeC:\Windows\system32\Qniogl32.exe87⤵PID:2204
-
C:\Windows\SysWOW64\Qlmopqdc.exeC:\Windows\system32\Qlmopqdc.exe88⤵PID:640
-
C:\Windows\SysWOW64\Apkhfo32.exeC:\Windows\system32\Apkhfo32.exe89⤵PID:1948
-
C:\Windows\SysWOW64\Aaldngqg.exeC:\Windows\system32\Aaldngqg.exe90⤵
- Drops file in System32 directory
- Modifies registry class
PID:4968 -
C:\Windows\SysWOW64\Albikp32.exeC:\Windows\system32\Albikp32.exe91⤵
- Drops file in System32 directory
PID:4744 -
C:\Windows\SysWOW64\Ablahjhj.exeC:\Windows\system32\Ablahjhj.exe92⤵PID:4976
-
C:\Windows\SysWOW64\Aified32.exeC:\Windows\system32\Aified32.exe93⤵PID:1856
-
C:\Windows\SysWOW64\Appaangd.exeC:\Windows\system32\Appaangd.exe94⤵
- Modifies registry class
PID:2036 -
C:\Windows\SysWOW64\Aaanif32.exeC:\Windows\system32\Aaanif32.exe95⤵PID:5856
-
C:\Windows\SysWOW64\Ahkffqdo.exeC:\Windows\system32\Ahkffqdo.exe96⤵PID:4260
-
C:\Windows\SysWOW64\Aacjofkp.exeC:\Windows\system32\Aacjofkp.exe97⤵PID:6004
-
C:\Windows\SysWOW64\Ahnclp32.exeC:\Windows\system32\Ahnclp32.exe98⤵PID:6072
-
C:\Windows\SysWOW64\Aogkhjii.exeC:\Windows\system32\Aogkhjii.exe99⤵PID:4536
-
C:\Windows\SysWOW64\Bhppap32.exeC:\Windows\system32\Bhppap32.exe100⤵PID:5272
-
C:\Windows\SysWOW64\Bojhnjgf.exeC:\Windows\system32\Bojhnjgf.exe101⤵
- Drops file in System32 directory
PID:5348 -
C:\Windows\SysWOW64\Blnhgn32.exeC:\Windows\system32\Blnhgn32.exe102⤵
- Modifies registry class
PID:3644 -
C:\Windows\SysWOW64\Bajqpe32.exeC:\Windows\system32\Bajqpe32.exe103⤵PID:3012
-
C:\Windows\SysWOW64\Bhdilold.exeC:\Windows\system32\Bhdilold.exe104⤵
- Drops file in System32 directory
PID:2876 -
C:\Windows\SysWOW64\Booaii32.exeC:\Windows\system32\Booaii32.exe105⤵PID:5940
-
C:\Windows\SysWOW64\Bidefbcg.exeC:\Windows\system32\Bidefbcg.exe106⤵PID:5584
-
C:\Windows\SysWOW64\Bocjdiol.exeC:\Windows\system32\Bocjdiol.exe107⤵PID:456
-
C:\Windows\SysWOW64\Cemcqcgi.exeC:\Windows\system32\Cemcqcgi.exe108⤵PID:4740
-
C:\Windows\SysWOW64\Clgkmm32.exeC:\Windows\system32\Clgkmm32.exe109⤵PID:5660
-
C:\Windows\SysWOW64\Ccacjgfb.exeC:\Windows\system32\Ccacjgfb.exe110⤵PID:5676
-
C:\Windows\SysWOW64\Cikkga32.exeC:\Windows\system32\Cikkga32.exe111⤵PID:5776
-
C:\Windows\SysWOW64\Clihcm32.exeC:\Windows\system32\Clihcm32.exe112⤵
- Drops file in System32 directory
PID:1304 -
C:\Windows\SysWOW64\Cccppgcp.exeC:\Windows\system32\Cccppgcp.exe113⤵PID:6096
-
C:\Windows\SysWOW64\Cediab32.exeC:\Windows\system32\Cediab32.exe114⤵PID:1036
-
C:\Windows\SysWOW64\Qjiaak32.exeC:\Windows\system32\Qjiaak32.exe115⤵PID:1744
-
C:\Windows\SysWOW64\Fdlcehhn.exeC:\Windows\system32\Fdlcehhn.exe116⤵PID:5236
-
C:\Windows\SysWOW64\Fmehnn32.exeC:\Windows\system32\Fmehnn32.exe117⤵PID:6092
-
C:\Windows\SysWOW64\Fkihgb32.exeC:\Windows\system32\Fkihgb32.exe118⤵
- Drops file in System32 directory
PID:940 -
C:\Windows\SysWOW64\Fgpilc32.exeC:\Windows\system32\Fgpilc32.exe119⤵
- Modifies registry class
PID:5204 -
C:\Windows\SysWOW64\Fdcjfg32.exeC:\Windows\system32\Fdcjfg32.exe120⤵PID:4472
-
C:\Windows\SysWOW64\Fgdbgbof.exeC:\Windows\system32\Fgdbgbof.exe121⤵PID:552
-
C:\Windows\SysWOW64\Ggnenagl.exeC:\Windows\system32\Ggnenagl.exe122⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-