Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
264s -
max time network
288s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
21/10/2023, 21:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.f377b1f682915837b1d873885e5bff10.exe
Resource
win7-20231020-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.f377b1f682915837b1d873885e5bff10.exe
Resource
win10v2004-20231020-en
5 signatures
150 seconds
General
-
Target
NEAS.f377b1f682915837b1d873885e5bff10.exe
-
Size
80KB
-
MD5
f377b1f682915837b1d873885e5bff10
-
SHA1
f9707fe675db162b17270e7de91e301d3d67fda6
-
SHA256
c1802d85b5610e997eb7e7bce1ae060577dc33e044f9890899823bf2c2381606
-
SHA512
3e57c800b69bedb97d0bfac200a2ae2bc8a75711dfdc2935efc5c46c0c008367c2e32e7bd861814e5cc096ca62c9f21089ae2cd68617bb4f61807a789bb2205f
-
SSDEEP
1536:Q+OGdiIvZEMlU6R/HLQX71hAwBcRrk0PXo5YMkhohBE8VGh:bOoig/lfR/HLQX71SwuRlf0UAEQGh
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ehhghdgc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jadbnqpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pjomcpnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Knmlgdfb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akhqjpdm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Moefmamm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ocehhbcl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gimmbg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iicoai32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bflghh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkjgpj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pomejndk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgcbhe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhfjid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bpmajb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkadnnlp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nenoafag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bieegcid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dphmiokb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cjebbkbk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ehiojb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lohlek32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njbemg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ndmgkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bomnhe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ibigeojp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bfjjbi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Boekqn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ffkpin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Abnmae32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hqbini32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jlempj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nolmnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hnbhpl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Foljognc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fbnpfnfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iekecpmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oqqeah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nmekdanq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Onhppled.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lfbdbelc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oplimcip.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Goiiikba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hhmioa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eaacch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jadbnqpe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pheodafc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kdehoo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dechlfkl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdohme32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ffhoam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fmjmml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ddjbbbna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bhkcdd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nmffpipd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pomejndk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cobkja32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Linciami.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mcnfhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cqlgqkbp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppjjpoih.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epgqddoh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oqqeah32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iekecpmd.exe -
Executes dropped EXE 64 IoCs
pid Process 2868 Bbhgbj32.exe 3000 Abnmae32.exe 2596 Bieegcid.exe 3052 Bbnjphpe.exe 2040 Bpajjmon.exe 2848 Bijobb32.exe 1068 Baecgdbj.exe 476 Cdflhppk.exe 1128 Cffejk32.exe 1760 Cignlf32.exe 1612 Ckgkfi32.exe 2996 Cmegbd32.exe 2444 Ceqlff32.exe 900 Doipoldo.exe 2472 Dechlfkl.exe 2488 Dphmiokb.exe 1456 Donijk32.exe 940 Ddjbbbna.exe 1096 Egdnjlcg.exe 3040 Eopbooqb.exe 2256 Ehhghdgc.exe 2136 Fdohme32.exe 828 Fnglekch.exe 2548 Gfigkljk.exe 2540 Gpbkca32.exe 1616 Gpdhiaoi.exe 984 Gimmbg32.exe 2700 Gcbaop32.exe 2716 Hjeojnep.exe 2600 Haoggh32.exe 2844 Hnbhpl32.exe 2648 Hempmfcb.exe 2644 Hfnmdo32.exe 2272 Hnedfljc.exe 1692 Hhmioa32.exe 2252 Hmjagh32.exe 1752 Ilpohecc.exe 664 Ibigeojp.exe 1224 Iicoai32.exe 2172 Ilbknd32.exe 1652 Iblcjohm.exe 1892 Iiflgi32.exe 1248 Gmhkkn32.exe 1572 Obhfhj32.exe 836 Mqcnjnol.exe 1060 Qpilpo32.exe 908 Aonial32.exe 3056 Aehanfgm.exe 588 Albijp32.exe 2188 Aejncedk.exe 2132 Agkjknji.exe 2544 Anebhh32.exe 2824 Akical32.exe 2080 Apflic32.exe 2372 Acdhen32.exe 1724 Bklpglom.exe 2708 Blmlnd32.exe 2628 Bcgdknlh.exe 2240 Bfeqgikk.exe 2088 Bloidc32.exe 3048 Bciaqnje.exe 2840 Bfhnmiii.exe 2032 Bhfjid32.exe 1240 Bpmajb32.exe -
Loads dropped DLL 64 IoCs
pid Process 2744 NEAS.f377b1f682915837b1d873885e5bff10.exe 2744 NEAS.f377b1f682915837b1d873885e5bff10.exe 2868 Bbhgbj32.exe 2868 Bbhgbj32.exe 3000 Abnmae32.exe 3000 Abnmae32.exe 2596 Bieegcid.exe 2596 Bieegcid.exe 3052 Bbnjphpe.exe 3052 Bbnjphpe.exe 2040 Bpajjmon.exe 2040 Bpajjmon.exe 2848 Bijobb32.exe 2848 Bijobb32.exe 1068 Baecgdbj.exe 1068 Baecgdbj.exe 476 Cdflhppk.exe 476 Cdflhppk.exe 1128 Cffejk32.exe 1128 Cffejk32.exe 1760 Cignlf32.exe 1760 Cignlf32.exe 1612 Ckgkfi32.exe 1612 Ckgkfi32.exe 2996 Cmegbd32.exe 2996 Cmegbd32.exe 2444 Ceqlff32.exe 2444 Ceqlff32.exe 900 Doipoldo.exe 900 Doipoldo.exe 2472 Dechlfkl.exe 2472 Dechlfkl.exe 2488 Dphmiokb.exe 2488 Dphmiokb.exe 1456 Donijk32.exe 1456 Donijk32.exe 940 Ddjbbbna.exe 940 Ddjbbbna.exe 1096 Egdnjlcg.exe 1096 Egdnjlcg.exe 3040 Eopbooqb.exe 3040 Eopbooqb.exe 2256 Ehhghdgc.exe 2256 Ehhghdgc.exe 2136 Fdohme32.exe 2136 Fdohme32.exe 828 Fnglekch.exe 828 Fnglekch.exe 2548 Gfigkljk.exe 2548 Gfigkljk.exe 2540 Gpbkca32.exe 2540 Gpbkca32.exe 1616 Gpdhiaoi.exe 1616 Gpdhiaoi.exe 984 Gimmbg32.exe 984 Gimmbg32.exe 2700 Gcbaop32.exe 2700 Gcbaop32.exe 2716 Hjeojnep.exe 2716 Hjeojnep.exe 2600 Haoggh32.exe 2600 Haoggh32.exe 2844 Hnbhpl32.exe 2844 Hnbhpl32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Fnglekch.exe Fdohme32.exe File opened for modification C:\Windows\SysWOW64\Ckpeqn32.exe Cqkace32.exe File created C:\Windows\SysWOW64\Fbnpfnfa.exe Fppcjcfn.exe File created C:\Windows\SysWOW64\Linciami.exe Kqlhcpef.exe File created C:\Windows\SysWOW64\Eibbai32.dll Ngeemc32.exe File created C:\Windows\SysWOW64\Ddjbbbna.exe Donijk32.exe File created C:\Windows\SysWOW64\Fcmbpo32.dll Gogipbln.exe File created C:\Windows\SysWOW64\Kbaoeeoh.dll Lpjhkkbc.exe File created C:\Windows\SysWOW64\Ilpohecc.exe Hmjagh32.exe File created C:\Windows\SysWOW64\Fliaecjo.exe Facmhk32.exe File created C:\Windows\SysWOW64\Ediaia32.dll Bhkcdd32.exe File opened for modification C:\Windows\SysWOW64\Khinoo32.exe Jadbnqpe.exe File created C:\Windows\SysWOW64\Mhamllfc.dll Cjqigkfp.exe File created C:\Windows\SysWOW64\Khbjhk32.dll Emhdhipd.exe File created C:\Windows\SysWOW64\Bgomncni.exe Bdqpagoe.exe File created C:\Windows\SysWOW64\Bfjjbi32.exe Bclnfm32.exe File created C:\Windows\SysWOW64\Ljnhbijg.dll Bfeqgikk.exe File opened for modification C:\Windows\SysWOW64\Bflghh32.exe Bkgbkp32.exe File opened for modification C:\Windows\SysWOW64\Ooidai32.exe Opfdfmka.exe File opened for modification C:\Windows\SysWOW64\Oiniobab.exe Ooidai32.exe File created C:\Windows\SysWOW64\Bogmfb32.dll Phcbobhe.exe File created C:\Windows\SysWOW64\Abhfpdgl.dll Hfbeaiaj.exe File created C:\Windows\SysWOW64\Anebhh32.exe Agkjknji.exe File created C:\Windows\SysWOW64\Lcfdlj32.exe Lpjhkkbc.exe File created C:\Windows\SysWOW64\Akhqjpdm.exe Pheodafc.exe File created C:\Windows\SysWOW64\Bcnjhhib.dll Mlgjafni.exe File created C:\Windows\SysWOW64\Hempmfcb.exe Hnbhpl32.exe File created C:\Windows\SysWOW64\Ahhqda32.dll Iiflgi32.exe File created C:\Windows\SysWOW64\Dodpgnop.dll Akical32.exe File created C:\Windows\SysWOW64\Pdejnfjd.dll Nqpfkh32.exe File created C:\Windows\SysWOW64\Cofancqg.exe Chliai32.exe File created C:\Windows\SysWOW64\Abnmae32.exe Bbhgbj32.exe File created C:\Windows\SysWOW64\Iafpmb32.dll Iblcjohm.exe File opened for modification C:\Windows\SysWOW64\Obhfhj32.exe Gmhkkn32.exe File created C:\Windows\SysWOW64\Ojgckb32.dll Aejncedk.exe File opened for modification C:\Windows\SysWOW64\Nfifbhhf.exe Njbemg32.exe File created C:\Windows\SysWOW64\Hpnjkfei.dll Cignlf32.exe File created C:\Windows\SysWOW64\Kkjgpj32.exe Khljdn32.exe File opened for modification C:\Windows\SysWOW64\Nfmpmg32.exe Npcgpmmd.exe File created C:\Windows\SysWOW64\Dcmpbf32.exe Dmbgelhd.exe File opened for modification C:\Windows\SysWOW64\Cdflhppk.exe Baecgdbj.exe File created C:\Windows\SysWOW64\Gcbaop32.exe Gimmbg32.exe File created C:\Windows\SysWOW64\Lhefnd32.dll Bfhnmiii.exe File created C:\Windows\SysWOW64\Cbbpdpbm.exe Ckhhhe32.exe File opened for modification C:\Windows\SysWOW64\Bpajjmon.exe Bbnjphpe.exe File created C:\Windows\SysWOW64\Jiaccj32.dll Hgjdecca.exe File created C:\Windows\SysWOW64\Oloelaao.dll Hnclbn32.exe File opened for modification C:\Windows\SysWOW64\Oqqeah32.exe Icjhpc32.exe File created C:\Windows\SysWOW64\Lohlek32.exe Lmjoip32.exe File opened for modification C:\Windows\SysWOW64\Fhbnpdnq.exe Fahfcjfd.exe File created C:\Windows\SysWOW64\Gknjecab.exe Geaamlck.exe File created C:\Windows\SysWOW64\Ocdcefcb.dll Mmnidoam.exe File created C:\Windows\SysWOW64\Ppgeio32.dll Nojphq32.exe File created C:\Windows\SysWOW64\Jldokm32.dll Plgcmdko.exe File opened for modification C:\Windows\SysWOW64\Coagcd32.exe Bomnhe32.exe File created C:\Windows\SysWOW64\Embmoh32.dll Dgfomejm.exe File opened for modification C:\Windows\SysWOW64\Cjebbkbk.exe Cggffocg.exe File created C:\Windows\SysWOW64\Mimjpp32.dll Gcbaop32.exe File opened for modification C:\Windows\SysWOW64\Geaamlck.exe Gogipbln.exe File created C:\Windows\SysWOW64\Fojdmg32.dll Nfifbhhf.exe File opened for modification C:\Windows\SysWOW64\Cffejk32.exe Cdflhppk.exe File created C:\Windows\SysWOW64\Eopbooqb.exe Egdnjlcg.exe File opened for modification C:\Windows\SysWOW64\Anebhh32.exe Agkjknji.exe File opened for modification C:\Windows\SysWOW64\Blmlnd32.exe Bklpglom.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bciaqnje.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Phejbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iiflgi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mocikj32.dll" Cqkace32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cdhjjddc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Goiiikba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfbifmbj.dll" Bflghh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jepjgc32.dll" Mefhpcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jomfbjom.dll" Paiepj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmdqgp32.dll" Donijk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqempice.dll" Obhfhj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qiffjlpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahhlnohm.dll" Egdnjlcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cmabhfca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ndmgkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iblcjohm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkpmnk32.dll" Phejbd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gmhkkn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mefhpcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jadbnqpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jldokm32.dll" Plgcmdko.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pomejndk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nfifbhhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ddjbbbna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egjdphbc.dll" Ilbknd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oglgfk32.dll" Ehnieaoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pljpbc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdbbjaga.dll" Cbbpdpbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cgcbhe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkegbc32.dll" Hnedfljc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ehnieaoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Piajea32.dll" Gknjecab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kljcjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mfmbdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcofqebd.dll" Cdflhppk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcdman32.dll" Gpdhiaoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hdkhihdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pknmblej.dll" Mbmnbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iicoai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ignilb32.dll" Dmbgelhd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dphmiokb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khjgbi32.dll" Kdehoo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mdglad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnionc32.dll" Nfkcgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejojfn32.dll" Pljpbc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Flgdod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fmjmml32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oplimcip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lpjhkkbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Acdhen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hfbeaiaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Plgcmdko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffkkeiee.dll" Ehhghdgc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Honpqaff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Njfnnncc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cofancqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgmdmjga.dll" Oqqeah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qdlkgepp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkgcnepe.dll" NEAS.f377b1f682915837b1d873885e5bff10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmfpja32.dll" Nfdhekpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lleidomb.dll" Qdlkgepp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bieegcid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Holcka32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ppjjpoih.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2744 wrote to memory of 2868 2744 NEAS.f377b1f682915837b1d873885e5bff10.exe 26 PID 2744 wrote to memory of 2868 2744 NEAS.f377b1f682915837b1d873885e5bff10.exe 26 PID 2744 wrote to memory of 2868 2744 NEAS.f377b1f682915837b1d873885e5bff10.exe 26 PID 2744 wrote to memory of 2868 2744 NEAS.f377b1f682915837b1d873885e5bff10.exe 26 PID 2868 wrote to memory of 3000 2868 Bbhgbj32.exe 27 PID 2868 wrote to memory of 3000 2868 Bbhgbj32.exe 27 PID 2868 wrote to memory of 3000 2868 Bbhgbj32.exe 27 PID 2868 wrote to memory of 3000 2868 Bbhgbj32.exe 27 PID 3000 wrote to memory of 2596 3000 Abnmae32.exe 28 PID 3000 wrote to memory of 2596 3000 Abnmae32.exe 28 PID 3000 wrote to memory of 2596 3000 Abnmae32.exe 28 PID 3000 wrote to memory of 2596 3000 Abnmae32.exe 28 PID 2596 wrote to memory of 3052 2596 Bieegcid.exe 29 PID 2596 wrote to memory of 3052 2596 Bieegcid.exe 29 PID 2596 wrote to memory of 3052 2596 Bieegcid.exe 29 PID 2596 wrote to memory of 3052 2596 Bieegcid.exe 29 PID 3052 wrote to memory of 2040 3052 Bbnjphpe.exe 30 PID 3052 wrote to memory of 2040 3052 Bbnjphpe.exe 30 PID 3052 wrote to memory of 2040 3052 Bbnjphpe.exe 30 PID 3052 wrote to memory of 2040 3052 Bbnjphpe.exe 30 PID 2040 wrote to memory of 2848 2040 Bpajjmon.exe 31 PID 2040 wrote to memory of 2848 2040 Bpajjmon.exe 31 PID 2040 wrote to memory of 2848 2040 Bpajjmon.exe 31 PID 2040 wrote to memory of 2848 2040 Bpajjmon.exe 31 PID 2848 wrote to memory of 1068 2848 Bijobb32.exe 32 PID 2848 wrote to memory of 1068 2848 Bijobb32.exe 32 PID 2848 wrote to memory of 1068 2848 Bijobb32.exe 32 PID 2848 wrote to memory of 1068 2848 Bijobb32.exe 32 PID 1068 wrote to memory of 476 1068 Baecgdbj.exe 33 PID 1068 wrote to memory of 476 1068 Baecgdbj.exe 33 PID 1068 wrote to memory of 476 1068 Baecgdbj.exe 33 PID 1068 wrote to memory of 476 1068 Baecgdbj.exe 33 PID 476 wrote to memory of 1128 476 Cdflhppk.exe 34 PID 476 wrote to memory of 1128 476 Cdflhppk.exe 34 PID 476 wrote to memory of 1128 476 Cdflhppk.exe 34 PID 476 wrote to memory of 1128 476 Cdflhppk.exe 34 PID 1128 wrote to memory of 1760 1128 Cffejk32.exe 35 PID 1128 wrote to memory of 1760 1128 Cffejk32.exe 35 PID 1128 wrote to memory of 1760 1128 Cffejk32.exe 35 PID 1128 wrote to memory of 1760 1128 Cffejk32.exe 35 PID 1760 wrote to memory of 1612 1760 Cignlf32.exe 36 PID 1760 wrote to memory of 1612 1760 Cignlf32.exe 36 PID 1760 wrote to memory of 1612 1760 Cignlf32.exe 36 PID 1760 wrote to memory of 1612 1760 Cignlf32.exe 36 PID 1612 wrote to memory of 2996 1612 Ckgkfi32.exe 42 PID 1612 wrote to memory of 2996 1612 Ckgkfi32.exe 42 PID 1612 wrote to memory of 2996 1612 Ckgkfi32.exe 42 PID 1612 wrote to memory of 2996 1612 Ckgkfi32.exe 42 PID 2996 wrote to memory of 2444 2996 Cmegbd32.exe 37 PID 2996 wrote to memory of 2444 2996 Cmegbd32.exe 37 PID 2996 wrote to memory of 2444 2996 Cmegbd32.exe 37 PID 2996 wrote to memory of 2444 2996 Cmegbd32.exe 37 PID 2444 wrote to memory of 900 2444 Ceqlff32.exe 41 PID 2444 wrote to memory of 900 2444 Ceqlff32.exe 41 PID 2444 wrote to memory of 900 2444 Ceqlff32.exe 41 PID 2444 wrote to memory of 900 2444 Ceqlff32.exe 41 PID 900 wrote to memory of 2472 900 Doipoldo.exe 40 PID 900 wrote to memory of 2472 900 Doipoldo.exe 40 PID 900 wrote to memory of 2472 900 Doipoldo.exe 40 PID 900 wrote to memory of 2472 900 Doipoldo.exe 40 PID 2472 wrote to memory of 2488 2472 Dechlfkl.exe 38 PID 2472 wrote to memory of 2488 2472 Dechlfkl.exe 38 PID 2472 wrote to memory of 2488 2472 Dechlfkl.exe 38 PID 2472 wrote to memory of 2488 2472 Dechlfkl.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.f377b1f682915837b1d873885e5bff10.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.f377b1f682915837b1d873885e5bff10.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\Bbhgbj32.exeC:\Windows\system32\Bbhgbj32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\Abnmae32.exeC:\Windows\system32\Abnmae32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\Bieegcid.exeC:\Windows\system32\Bieegcid.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\Bbnjphpe.exeC:\Windows\system32\Bbnjphpe.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\Bpajjmon.exeC:\Windows\system32\Bpajjmon.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\Bijobb32.exeC:\Windows\system32\Bijobb32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\Baecgdbj.exeC:\Windows\system32\Baecgdbj.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\Cdflhppk.exeC:\Windows\system32\Cdflhppk.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Windows\SysWOW64\Cffejk32.exeC:\Windows\system32\Cffejk32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\Cignlf32.exeC:\Windows\system32\Cignlf32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\Ckgkfi32.exeC:\Windows\system32\Ckgkfi32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\Cmegbd32.exeC:\Windows\system32\Cmegbd32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Ceqlff32.exeC:\Windows\system32\Ceqlff32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\Doipoldo.exeC:\Windows\system32\Doipoldo.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:900
-
-
C:\Windows\SysWOW64\Dphmiokb.exeC:\Windows\system32\Dphmiokb.exe1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2488 -
C:\Windows\SysWOW64\Donijk32.exeC:\Windows\system32\Donijk32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1456 -
C:\Windows\SysWOW64\Ddjbbbna.exeC:\Windows\system32\Ddjbbbna.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:940 -
C:\Windows\SysWOW64\Egdnjlcg.exeC:\Windows\system32\Egdnjlcg.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1096 -
C:\Windows\SysWOW64\Eopbooqb.exeC:\Windows\system32\Eopbooqb.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Windows\SysWOW64\Ehhghdgc.exeC:\Windows\system32\Ehhghdgc.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2256 -
C:\Windows\SysWOW64\Fdohme32.exeC:\Windows\system32\Fdohme32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2136 -
C:\Windows\SysWOW64\Fnglekch.exeC:\Windows\system32\Fnglekch.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Windows\SysWOW64\Gfigkljk.exeC:\Windows\system32\Gfigkljk.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Windows\SysWOW64\Gpbkca32.exeC:\Windows\system32\Gpbkca32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Windows\SysWOW64\Gpdhiaoi.exeC:\Windows\system32\Gpdhiaoi.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1616 -
C:\Windows\SysWOW64\Gimmbg32.exeC:\Windows\system32\Gimmbg32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:984 -
C:\Windows\SysWOW64\Gcbaop32.exeC:\Windows\system32\Gcbaop32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2700 -
C:\Windows\SysWOW64\Hjeojnep.exeC:\Windows\system32\Hjeojnep.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Windows\SysWOW64\Haoggh32.exeC:\Windows\system32\Haoggh32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Windows\SysWOW64\Hnbhpl32.exeC:\Windows\system32\Hnbhpl32.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2844 -
C:\Windows\SysWOW64\Hempmfcb.exeC:\Windows\system32\Hempmfcb.exe17⤵
- Executes dropped EXE
PID:2648 -
C:\Windows\SysWOW64\Hfnmdo32.exeC:\Windows\system32\Hfnmdo32.exe18⤵
- Executes dropped EXE
PID:2644 -
C:\Windows\SysWOW64\Hnedfljc.exeC:\Windows\system32\Hnedfljc.exe19⤵
- Executes dropped EXE
- Modifies registry class
PID:2272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Dechlfkl.exeC:\Windows\system32\Dechlfkl.exe1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472
-
C:\Windows\SysWOW64\Hhmioa32.exeC:\Windows\system32\Hhmioa32.exe1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1692 -
C:\Windows\SysWOW64\Hmjagh32.exeC:\Windows\system32\Hmjagh32.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2252 -
C:\Windows\SysWOW64\Ilpohecc.exeC:\Windows\system32\Ilpohecc.exe3⤵
- Executes dropped EXE
PID:1752 -
C:\Windows\SysWOW64\Ibigeojp.exeC:\Windows\system32\Ibigeojp.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:664 -
C:\Windows\SysWOW64\Iicoai32.exeC:\Windows\system32\Iicoai32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1224 -
C:\Windows\SysWOW64\Ilbknd32.exeC:\Windows\system32\Ilbknd32.exe6⤵
- Executes dropped EXE
- Modifies registry class
PID:2172 -
C:\Windows\SysWOW64\Iblcjohm.exeC:\Windows\system32\Iblcjohm.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1652 -
C:\Windows\SysWOW64\Iiflgi32.exeC:\Windows\system32\Iiflgi32.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1892 -
C:\Windows\SysWOW64\Gmhkkn32.exeC:\Windows\system32\Gmhkkn32.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1248 -
C:\Windows\SysWOW64\Obhfhj32.exeC:\Windows\system32\Obhfhj32.exe10⤵
- Executes dropped EXE
- Modifies registry class
PID:1572 -
C:\Windows\SysWOW64\Mqcnjnol.exeC:\Windows\system32\Mqcnjnol.exe11⤵
- Executes dropped EXE
PID:836 -
C:\Windows\SysWOW64\Qpilpo32.exeC:\Windows\system32\Qpilpo32.exe12⤵
- Executes dropped EXE
PID:1060 -
C:\Windows\SysWOW64\Aonial32.exeC:\Windows\system32\Aonial32.exe13⤵
- Executes dropped EXE
PID:908 -
C:\Windows\SysWOW64\Aehanfgm.exeC:\Windows\system32\Aehanfgm.exe14⤵
- Executes dropped EXE
PID:3056 -
C:\Windows\SysWOW64\Albijp32.exeC:\Windows\system32\Albijp32.exe15⤵
- Executes dropped EXE
PID:588 -
C:\Windows\SysWOW64\Aejncedk.exeC:\Windows\system32\Aejncedk.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2188 -
C:\Windows\SysWOW64\Agkjknji.exeC:\Windows\system32\Agkjknji.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2132 -
C:\Windows\SysWOW64\Anebhh32.exeC:\Windows\system32\Anebhh32.exe18⤵
- Executes dropped EXE
PID:2544 -
C:\Windows\SysWOW64\Akical32.exeC:\Windows\system32\Akical32.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2824 -
C:\Windows\SysWOW64\Apflic32.exeC:\Windows\system32\Apflic32.exe20⤵
- Executes dropped EXE
PID:2080 -
C:\Windows\SysWOW64\Acdhen32.exeC:\Windows\system32\Acdhen32.exe21⤵
- Executes dropped EXE
- Modifies registry class
PID:2372 -
C:\Windows\SysWOW64\Bklpglom.exeC:\Windows\system32\Bklpglom.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1724 -
C:\Windows\SysWOW64\Blmlnd32.exeC:\Windows\system32\Blmlnd32.exe23⤵
- Executes dropped EXE
PID:2708 -
C:\Windows\SysWOW64\Bcgdknlh.exeC:\Windows\system32\Bcgdknlh.exe24⤵
- Executes dropped EXE
PID:2628 -
C:\Windows\SysWOW64\Bfeqgikk.exeC:\Windows\system32\Bfeqgikk.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2240 -
C:\Windows\SysWOW64\Bloidc32.exeC:\Windows\system32\Bloidc32.exe26⤵
- Executes dropped EXE
PID:2088 -
C:\Windows\SysWOW64\Bciaqnje.exeC:\Windows\system32\Bciaqnje.exe27⤵
- Executes dropped EXE
- Modifies registry class
PID:3048 -
C:\Windows\SysWOW64\Bfhnmiii.exeC:\Windows\system32\Bfhnmiii.exe28⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2840 -
C:\Windows\SysWOW64\Bhfjid32.exeC:\Windows\system32\Bhfjid32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2032 -
C:\Windows\SysWOW64\Bpmajb32.exeC:\Windows\system32\Bpmajb32.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1240 -
C:\Windows\SysWOW64\Bclnfm32.exeC:\Windows\system32\Bclnfm32.exe31⤵
- Drops file in System32 directory
PID:1252 -
C:\Windows\SysWOW64\Bfjjbi32.exeC:\Windows\system32\Bfjjbi32.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1748 -
C:\Windows\SysWOW64\Bhhfnd32.exeC:\Windows\system32\Bhhfnd32.exe33⤵PID:2320
-
C:\Windows\SysWOW64\Bkgbkp32.exeC:\Windows\system32\Bkgbkp32.exe34⤵
- Drops file in System32 directory
PID:2344 -
C:\Windows\SysWOW64\Bflghh32.exeC:\Windows\system32\Bflghh32.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2688 -
C:\Windows\SysWOW64\Bhkcdd32.exeC:\Windows\system32\Bhkcdd32.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2956 -
C:\Windows\SysWOW64\Boekqn32.exeC:\Windows\system32\Boekqn32.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2620 -
C:\Windows\SysWOW64\Cbcgmi32.exeC:\Windows\system32\Cbcgmi32.exe38⤵PID:1128
-
C:\Windows\SysWOW64\Cqhdnfpp.exeC:\Windows\system32\Cqhdnfpp.exe39⤵PID:2848
-
C:\Windows\SysWOW64\Cgbmkp32.exeC:\Windows\system32\Cgbmkp32.exe40⤵PID:2368
-
C:\Windows\SysWOW64\Cjqigkfp.exeC:\Windows\system32\Cjqigkfp.exe41⤵
- Drops file in System32 directory
PID:2272 -
C:\Windows\SysWOW64\Cqkace32.exeC:\Windows\system32\Cqkace32.exe42⤵
- Drops file in System32 directory
- Modifies registry class
PID:1616 -
C:\Windows\SysWOW64\Ckpeqn32.exeC:\Windows\system32\Ckpeqn32.exe43⤵PID:1692
-
C:\Windows\SysWOW64\Cmabhfca.exeC:\Windows\system32\Cmabhfca.exe44⤵
- Modifies registry class
PID:2436 -
C:\Windows\SysWOW64\Cdhjjddc.exeC:\Windows\system32\Cdhjjddc.exe45⤵
- Modifies registry class
PID:1800 -
C:\Windows\SysWOW64\Cggffocg.exeC:\Windows\system32\Cggffocg.exe46⤵
- Drops file in System32 directory
PID:1948 -
C:\Windows\SysWOW64\Cjebbkbk.exeC:\Windows\system32\Cjebbkbk.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2988 -
C:\Windows\SysWOW64\Cobkja32.exeC:\Windows\system32\Cobkja32.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2500 -
C:\Windows\SysWOW64\Cflcglho.exeC:\Windows\system32\Cflcglho.exe49⤵PID:3024
-
C:\Windows\SysWOW64\Dekcng32.exeC:\Windows\system32\Dekcng32.exe50⤵PID:1516
-
C:\Windows\SysWOW64\Ehiojb32.exeC:\Windows\system32\Ehiojb32.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2192 -
C:\Windows\SysWOW64\Eaacch32.exeC:\Windows\system32\Eaacch32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2060 -
C:\Windows\SysWOW64\Ecppoc32.exeC:\Windows\system32\Ecppoc32.exe53⤵PID:2864
-
C:\Windows\SysWOW64\Ejjhlmqa.exeC:\Windows\system32\Ejjhlmqa.exe54⤵PID:2836
-
C:\Windows\SysWOW64\Emhdhipd.exeC:\Windows\system32\Emhdhipd.exe55⤵
- Drops file in System32 directory
PID:2604 -
C:\Windows\SysWOW64\Epgqddoh.exeC:\Windows\system32\Epgqddoh.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3016 -
C:\Windows\SysWOW64\Ehnieaoj.exeC:\Windows\system32\Ehnieaoj.exe57⤵
- Modifies registry class
PID:528 -
C:\Windows\SysWOW64\Eioemj32.exeC:\Windows\system32\Eioemj32.exe58⤵PID:340
-
C:\Windows\SysWOW64\Emmnch32.exeC:\Windows\system32\Emmnch32.exe59⤵PID:308
-
C:\Windows\SysWOW64\Efeblnbp.exeC:\Windows\system32\Efeblnbp.exe60⤵PID:2424
-
C:\Windows\SysWOW64\Eidohiac.exeC:\Windows\system32\Eidohiac.exe61⤵PID:2908
-
C:\Windows\SysWOW64\Foqgqppk.exeC:\Windows\system32\Foqgqppk.exe62⤵PID:2948
-
C:\Windows\SysWOW64\Ffhoam32.exeC:\Windows\system32\Ffhoam32.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2232 -
C:\Windows\SysWOW64\Fifkni32.exeC:\Windows\system32\Fifkni32.exe64⤵PID:820
-
C:\Windows\SysWOW64\Fppcjcfn.exeC:\Windows\system32\Fppcjcfn.exe65⤵
- Drops file in System32 directory
PID:1068 -
C:\Windows\SysWOW64\Fbnpfnfa.exeC:\Windows\system32\Fbnpfnfa.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3052 -
C:\Windows\SysWOW64\Fihhch32.exeC:\Windows\system32\Fihhch32.exe67⤵PID:1044
-
C:\Windows\SysWOW64\Flgdod32.exeC:\Windows\system32\Flgdod32.exe68⤵
- Modifies registry class
PID:2912 -
C:\Windows\SysWOW64\Foeqlo32.exeC:\Windows\system32\Foeqlo32.exe69⤵PID:2600
-
C:\Windows\SysWOW64\Facmhk32.exeC:\Windows\system32\Facmhk32.exe70⤵
- Drops file in System32 directory
PID:2716 -
C:\Windows\SysWOW64\Fliaecjo.exeC:\Windows\system32\Fliaecjo.exe71⤵PID:1676
-
C:\Windows\SysWOW64\Fogmaoib.exeC:\Windows\system32\Fogmaoib.exe72⤵PID:1140
-
C:\Windows\SysWOW64\Fmjmml32.exeC:\Windows\system32\Fmjmml32.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2404 -
C:\Windows\SysWOW64\Fknnfp32.exeC:\Windows\system32\Fknnfp32.exe74⤵PID:2264
-
C:\Windows\SysWOW64\Fahfcjfd.exeC:\Windows\system32\Fahfcjfd.exe75⤵
- Drops file in System32 directory
PID:872 -
C:\Windows\SysWOW64\Fhbnpdnq.exeC:\Windows\system32\Fhbnpdnq.exe76⤵PID:1408
-
C:\Windows\SysWOW64\Gogipbln.exeC:\Windows\system32\Gogipbln.exe77⤵
- Drops file in System32 directory
PID:2084 -
C:\Windows\SysWOW64\Geaamlck.exeC:\Windows\system32\Geaamlck.exe78⤵
- Drops file in System32 directory
PID:2752 -
C:\Windows\SysWOW64\Gknjecab.exeC:\Windows\system32\Gknjecab.exe79⤵
- Modifies registry class
PID:2656 -
C:\Windows\SysWOW64\Hahbam32.exeC:\Windows\system32\Hahbam32.exe80⤵PID:2640
-
C:\Windows\SysWOW64\Hhbkngpl.exeC:\Windows\system32\Hhbkngpl.exe81⤵PID:1884
-
C:\Windows\SysWOW64\Holcka32.exeC:\Windows\system32\Holcka32.exe82⤵
- Modifies registry class
PID:2504 -
C:\Windows\SysWOW64\Hffkhlof.exeC:\Windows\system32\Hffkhlof.exe83⤵PID:772
-
C:\Windows\SysWOW64\Hgggpded.exeC:\Windows\system32\Hgggpded.exe84⤵PID:2892
-
C:\Windows\SysWOW64\Honpqaff.exeC:\Windows\system32\Honpqaff.exe85⤵
- Modifies registry class
PID:2352 -
C:\Windows\SysWOW64\Hdkhihdn.exeC:\Windows\system32\Hdkhihdn.exe86⤵
- Modifies registry class
PID:2788 -
C:\Windows\SysWOW64\Hgjdecca.exeC:\Windows\system32\Hgjdecca.exe87⤵
- Drops file in System32 directory
PID:2868 -
C:\Windows\SysWOW64\Hnclbn32.exeC:\Windows\system32\Hnclbn32.exe88⤵
- Drops file in System32 directory
PID:1480 -
C:\Windows\SysWOW64\Hqbini32.exeC:\Windows\system32\Hqbini32.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1832 -
C:\Windows\SysWOW64\Icjhpc32.exeC:\Windows\system32\Icjhpc32.exe90⤵
- Drops file in System32 directory
PID:1464 -
C:\Windows\SysWOW64\Oqqeah32.exeC:\Windows\system32\Oqqeah32.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1552 -
C:\Windows\SysWOW64\Mefhpcek.exeC:\Windows\system32\Mefhpcek.exe92⤵
- Modifies registry class
PID:892 -
C:\Windows\SysWOW64\Pahqoi32.exeC:\Windows\system32\Pahqoi32.exe93⤵PID:1500
-
C:\Windows\SysWOW64\Ffkpin32.exeC:\Windows\system32\Ffkpin32.exe94⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1640 -
C:\Windows\SysWOW64\Ibklbd32.exeC:\Windows\system32\Ibklbd32.exe95⤵PID:932
-
C:\Windows\SysWOW64\Iiddoo32.exeC:\Windows\system32\Iiddoo32.exe96⤵PID:1144
-
C:\Windows\SysWOW64\Iekecpmd.exeC:\Windows\system32\Iekecpmd.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:544 -
C:\Windows\SysWOW64\Jlempj32.exeC:\Windows\system32\Jlempj32.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2852 -
C:\Windows\SysWOW64\Jenbioka.exeC:\Windows\system32\Jenbioka.exe99⤵PID:2608
-
C:\Windows\SysWOW64\Jgonqhqp.exeC:\Windows\system32\Jgonqhqp.exe100⤵PID:1716
-
C:\Windows\SysWOW64\Joffbeab.exeC:\Windows\system32\Joffbeab.exe101⤵PID:1520
-
C:\Windows\SysWOW64\Jadbnqpe.exeC:\Windows\system32\Jadbnqpe.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:460 -
C:\Windows\SysWOW64\Khinoo32.exeC:\Windows\system32\Khinoo32.exe103⤵PID:320
-
C:\Windows\SysWOW64\Kocfkifp.exeC:\Windows\system32\Kocfkifp.exe104⤵PID:1700
-
C:\Windows\SysWOW64\Kfnnhb32.exeC:\Windows\system32\Kfnnhb32.exe105⤵PID:2944
-
C:\Windows\SysWOW64\Khljdn32.exeC:\Windows\system32\Khljdn32.exe106⤵
- Drops file in System32 directory
PID:2484 -
C:\Windows\SysWOW64\Kkjgpj32.exeC:\Windows\system32\Kkjgpj32.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:796 -
C:\Windows\SysWOW64\Kofbahdm.exeC:\Windows\system32\Kofbahdm.exe108⤵PID:2256
-
C:\Windows\SysWOW64\Kbdomdca.exeC:\Windows\system32\Kbdomdca.exe109⤵PID:2996
-
C:\Windows\SysWOW64\Kljcjm32.exeC:\Windows\system32\Kljcjm32.exe110⤵
- Modifies registry class
PID:1088 -
C:\Windows\SysWOW64\Kbflbc32.exeC:\Windows\system32\Kbflbc32.exe111⤵PID:2524
-
C:\Windows\SysWOW64\Kfbhcbig.exeC:\Windows\system32\Kfbhcbig.exe112⤵PID:1248
-
C:\Windows\SysWOW64\Kdehoo32.exeC:\Windows\system32\Kdehoo32.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1588 -
C:\Windows\SysWOW64\Kgcdkj32.exeC:\Windows\system32\Kgcdkj32.exe114⤵PID:1956
-
C:\Windows\SysWOW64\Knmlgdfb.exeC:\Windows\system32\Knmlgdfb.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2188 -
C:\Windows\SysWOW64\Kqlhcpef.exeC:\Windows\system32\Kqlhcpef.exe116⤵
- Drops file in System32 directory
PID:920 -
C:\Windows\SysWOW64\Linciami.exeC:\Windows\system32\Linciami.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2708 -
C:\Windows\SysWOW64\Lmjoip32.exeC:\Windows\system32\Lmjoip32.exe118⤵
- Drops file in System32 directory
PID:1912 -
C:\Windows\SysWOW64\Lohlek32.exeC:\Windows\system32\Lohlek32.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:632 -
C:\Windows\SysWOW64\Lbfhag32.exeC:\Windows\system32\Lbfhag32.exe120⤵PID:3000
-
C:\Windows\SysWOW64\Lfbdbelc.exeC:\Windows\system32\Lfbdbelc.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1048 -
C:\Windows\SysWOW64\Lippnakg.exeC:\Windows\system32\Lippnakg.exe122⤵PID:684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-