Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
196s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
22/10/2023, 14:42
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.ce1f6ab3a18386d9903d2abb6d50493b_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.ce1f6ab3a18386d9903d2abb6d50493b_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.ce1f6ab3a18386d9903d2abb6d50493b_JC.exe
-
Size
95KB
-
MD5
ce1f6ab3a18386d9903d2abb6d50493b
-
SHA1
a55b1857348952d9a3e42dc6e5fe9e8ae3ac5a99
-
SHA256
9df4188f51437b7e1d18796f22d21a8b05bc911be05d365acfad847ce7d21f6d
-
SHA512
985905ae5ef14d4d4f32de1646ef16a089eb38536ded7c3e35f4eea8a2784ae478deb2a9f66fbaba77ebf6bba1cbbcd1e4fdceab18d3e316da21981528ac73f8
-
SSDEEP
1536:VUIiCg2g1Dl+alQ+0aLzHeGIxhcRQr1rRVRoRch1dROrwpOudRirVtFsrTpMGQYO:OX3fQa0l3xhceFTWM1dQrTOwZtFKnO
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dbaflm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hhnpih32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jddhknpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kehgkgha.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aaiamamk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Najbbepc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfjiod32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdiciboh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ekqqea32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ffcdlncp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jafnhl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Moanpe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mcendc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dppiddie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Emmljodk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhhiqm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ibglhhdf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lpgekanj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcendc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgcoal32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fibqhibd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Iidajaiq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bakgmgpe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmklbk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gmklbk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgcheg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnkpkdio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Meafpibb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iejnna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gjmpfp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jkhjin32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Leflapab.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nkldoijk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Oibanm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Keekeg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iikgkq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Klmfmacc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gpfpmonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jgfghodj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jjimpj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fqkieogp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhaobd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ldbcdhng.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlenijej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mcpmonea.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Colgpo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aepqac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Iodlcnmf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gabohk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lihifhoq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajqoqm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djddbkck.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Khdjfpfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kkechk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jaiknk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lhehnlqf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bklaepbn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aaiamamk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hfdbji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cehlbihg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kpecad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lnflif32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fijolbfh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bciaqnje.exe -
Executes dropped EXE 64 IoCs
pid Process 2740 Onmfin32.exe 2884 Fdblkoco.exe 2648 Fqkieogp.exe 2572 Ihilqi32.exe 2820 Bklaepbn.exe 744 Bgcbja32.exe 1204 Qpocno32.exe 2952 Ghmohcbl.exe 864 Mcendc32.exe 2100 Pfjiod32.exe 2248 Ebpgoh32.exe 2796 Fijolbfh.exe 1708 Feppqc32.exe 548 Fkmhij32.exe 396 Fhcehngk.exe 1632 Fmpnpe32.exe 1976 Fmbkfd32.exe 832 Gdmcbojl.exe 2072 Giikkehc.exe 2560 Geplpfnh.exe 688 Gpfpmonn.exe 1116 Galfpgpg.exe 2068 Hkdkhl32.exe 2864 Hhhkbqea.exe 3064 Hkidclbb.exe 2228 Hqemlbqi.exe 3048 Hjnaehgj.exe 2784 Hdcebagp.exe 2620 Hfdbji32.exe 2144 Iiekkdjo.exe 1596 Ioochn32.exe 2916 Ickoimie.exe 3004 Ijegeg32.exe 1072 Ikfdmogp.exe 2576 Ibplji32.exe 2688 Ieohfemq.exe 2768 Iodlcnmf.exe 760 Ifndph32.exe 1664 Iilalc32.exe 2084 Ikkmho32.exe 1120 Ibeeeijg.exe 3060 Iecaad32.exe 1652 Ikmjnnah.exe 1700 Jbgbjh32.exe 1144 Jalolemm.exe 436 Jgfghodj.exe 1492 Jnppei32.exe 932 Jcmhmp32.exe 1804 Jfkdik32.exe 816 Jijqeg32.exe 3068 Jpdibapb.exe 2404 Jjimpj32.exe 2396 Jlkigbef.exe 2544 Jbdadl32.exe 2532 Jecnpg32.exe 1936 Klmfmacc.exe 1564 Kbgnil32.exe 2512 Keekeg32.exe 3052 Kpkocpjj.exe 2748 Kbikokin.exe 1336 Kehgkgha.exe 908 Klapha32.exe 3016 Kopldl32.exe 2984 Kanhph32.exe -
Loads dropped DLL 64 IoCs
pid Process 2852 NEAS.ce1f6ab3a18386d9903d2abb6d50493b_JC.exe 2852 NEAS.ce1f6ab3a18386d9903d2abb6d50493b_JC.exe 2740 Onmfin32.exe 2740 Onmfin32.exe 2884 Fdblkoco.exe 2884 Fdblkoco.exe 2648 Fqkieogp.exe 2648 Fqkieogp.exe 2572 Ihilqi32.exe 2572 Ihilqi32.exe 2820 Bklaepbn.exe 2820 Bklaepbn.exe 744 Bgcbja32.exe 744 Bgcbja32.exe 1204 Qpocno32.exe 1204 Qpocno32.exe 2952 Ghmohcbl.exe 2952 Ghmohcbl.exe 864 Mcendc32.exe 864 Mcendc32.exe 2100 Pfjiod32.exe 2100 Pfjiod32.exe 2248 Ebpgoh32.exe 2248 Ebpgoh32.exe 2796 Fijolbfh.exe 2796 Fijolbfh.exe 1708 Feppqc32.exe 1708 Feppqc32.exe 548 Fkmhij32.exe 548 Fkmhij32.exe 396 Fhcehngk.exe 396 Fhcehngk.exe 1632 Fmpnpe32.exe 1632 Fmpnpe32.exe 1976 Fmbkfd32.exe 1976 Fmbkfd32.exe 832 Gdmcbojl.exe 832 Gdmcbojl.exe 2072 Giikkehc.exe 2072 Giikkehc.exe 2560 Geplpfnh.exe 2560 Geplpfnh.exe 688 Gpfpmonn.exe 688 Gpfpmonn.exe 1116 Galfpgpg.exe 1116 Galfpgpg.exe 2068 Hkdkhl32.exe 2068 Hkdkhl32.exe 2864 Hhhkbqea.exe 2864 Hhhkbqea.exe 3064 Hkidclbb.exe 3064 Hkidclbb.exe 2228 Hqemlbqi.exe 2228 Hqemlbqi.exe 3048 Hjnaehgj.exe 3048 Hjnaehgj.exe 2784 Hdcebagp.exe 2784 Hdcebagp.exe 2620 Hfdbji32.exe 2620 Hfdbji32.exe 2144 Iiekkdjo.exe 2144 Iiekkdjo.exe 1596 Ioochn32.exe 1596 Ioochn32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Nqpfil32.exe Nfkblc32.exe File opened for modification C:\Windows\SysWOW64\Adeadmna.exe Qagehaon.exe File created C:\Windows\SysWOW64\Fhhiqm32.exe Eaoadb32.exe File opened for modification C:\Windows\SysWOW64\Cdpfiekl.exe Cnfnlk32.exe File created C:\Windows\SysWOW64\Jfnfjblc.dll Ckeekp32.exe File created C:\Windows\SysWOW64\Hmbehilp.dll Ibplji32.exe File opened for modification C:\Windows\SysWOW64\Nmmgafjh.exe Mjcljlea.exe File created C:\Windows\SysWOW64\Najbbepc.exe Lpfdpmho.exe File created C:\Windows\SysWOW64\Ggqmnecg.dll Jkhjin32.exe File created C:\Windows\SysWOW64\Iikgkq32.exe Ihkkanlf.exe File created C:\Windows\SysWOW64\Jhengldk.exe Jmoijc32.exe File opened for modification C:\Windows\SysWOW64\Kedaddif.exe Kceehijb.exe File created C:\Windows\SysWOW64\Qmilachg.exe Qlhpjk32.exe File opened for modification C:\Windows\SysWOW64\Lggpdmap.exe Kdmdlc32.exe File opened for modification C:\Windows\SysWOW64\Mdmdpd32.exe Mclghl32.exe File opened for modification C:\Windows\SysWOW64\Mmdlqa32.exe Mdmdpd32.exe File opened for modification C:\Windows\SysWOW64\Mkeogn32.exe Lcjkbl32.exe File opened for modification C:\Windows\SysWOW64\Jecnpg32.exe Jbdadl32.exe File created C:\Windows\SysWOW64\Ojfjke32.exe Oclbok32.exe File created C:\Windows\SysWOW64\Pgndfeek.dll Ogjkei32.exe File opened for modification C:\Windows\SysWOW64\Abmkjiqg.exe Alcbno32.exe File created C:\Windows\SysWOW64\Lbmdpf32.dll Ioochn32.exe File created C:\Windows\SysWOW64\Pemmjqgm.dll Gdchifik.exe File created C:\Windows\SysWOW64\Llobhcnd.dll Obkegbnb.exe File created C:\Windows\SysWOW64\Qiaikl32.dll Lcnqin32.exe File created C:\Windows\SysWOW64\Anklmjnm.dll Pphlokep.exe File created C:\Windows\SysWOW64\Jbgbjh32.exe Ikmjnnah.exe File opened for modification C:\Windows\SysWOW64\Jbdadl32.exe Jlkigbef.exe File opened for modification C:\Windows\SysWOW64\Cmkkhfmn.exe Beccgi32.exe File opened for modification C:\Windows\SysWOW64\Mnfjab32.exe Mlenijej.exe File created C:\Windows\SysWOW64\Gmlmehcq.dll Pceeei32.exe File created C:\Windows\SysWOW64\Gpoghg32.dll Geplpfnh.exe File created C:\Windows\SysWOW64\Gpjhgkof.dll Jjimpj32.exe File created C:\Windows\SysWOW64\Mjhlmifm.dll Klmfmacc.exe File created C:\Windows\SysWOW64\Ajkain32.dll Mhmfgdch.exe File created C:\Windows\SysWOW64\Pfjiod32.exe Mcendc32.exe File created C:\Windows\SysWOW64\Cehlbihg.exe Ccjpfmic.exe File created C:\Windows\SysWOW64\Ficcefan.dll Enajgllm.exe File created C:\Windows\SysWOW64\Eaeefnlk.dll Ihmene32.exe File created C:\Windows\SysWOW64\Kefhcm32.dll Nfhefc32.exe File created C:\Windows\SysWOW64\Pfenml32.dll Fmbkfd32.exe File created C:\Windows\SysWOW64\Heoqph32.dll Jjehflbe.exe File created C:\Windows\SysWOW64\Epmdljal.exe Emmljodk.exe File opened for modification C:\Windows\SysWOW64\Moanpe32.exe Meiigppp.exe File opened for modification C:\Windows\SysWOW64\Fqkieogp.exe Fdblkoco.exe File opened for modification C:\Windows\SysWOW64\Ghmohcbl.exe Qpocno32.exe File opened for modification C:\Windows\SysWOW64\Cehlbihg.exe Ccjpfmic.exe File created C:\Windows\SysWOW64\Obbdgajq.dll Gjmpfp32.exe File created C:\Windows\SysWOW64\Khgidhlh.exe Keimhmmd.exe File created C:\Windows\SysWOW64\Bklaepbn.exe Ihilqi32.exe File opened for modification C:\Windows\SysWOW64\Ihkkanlf.exe Ihinkn32.exe File opened for modification C:\Windows\SysWOW64\Nfkblc32.exe Nclfpg32.exe File created C:\Windows\SysWOW64\Ojkcfdgh.exe Ocakjjok.exe File opened for modification C:\Windows\SysWOW64\Ebpgoh32.exe Pfjiod32.exe File created C:\Windows\SysWOW64\Nmmgafjh.exe Mjcljlea.exe File created C:\Windows\SysWOW64\Fdoknb32.dll Ehbdif32.exe File created C:\Windows\SysWOW64\Okdqnp32.dll Fijolbfh.exe File created C:\Windows\SysWOW64\Bbegkn32.exe Bdiciboh.exe File opened for modification C:\Windows\SysWOW64\Cekihh32.exe Cclmlm32.exe File created C:\Windows\SysWOW64\Aeajcf32.exe Najbbepc.exe File created C:\Windows\SysWOW64\Loldefjf.exe Ldbcdhng.exe File opened for modification C:\Windows\SysWOW64\Pphlokep.exe Ojkcfdgh.exe File created C:\Windows\SysWOW64\Akbnfk32.dll Gcnjmi32.exe File opened for modification C:\Windows\SysWOW64\Iejnna32.exe Bffgbo32.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dppiddie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Oaecne32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kopldl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Apgnpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jakkigmi.dll" Pfadke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcebdo32.dll" Hdcebagp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Moikinib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Goidmibg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpojmn32.dll" Ljafifbh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lcjkbl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kmaego32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hqemlbqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmeemifp.dll" Bakgmgpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ekjjebed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jkhjin32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ihinkn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qmilachg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Iejnna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efhgfh32.dll" Hojeka32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Eaoadb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Goidmibg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gdmcbojl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Eqninhmc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndjqeogf.dll" Meiigppp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Qfaqji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jfkdik32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Moanpe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nqnicl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lqknfq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Chdlidjm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jcggjg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Klgeih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dagmbmmf.dll" Looajf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjlpin32.dll" Peinba32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgagfk32.dll" Ikkmho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Giikkehc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jjimpj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jlkigbef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jaafdelg.dll" Lnflif32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lceagmmn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mgalpg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 NEAS.ce1f6ab3a18386d9903d2abb6d50493b_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mhmfgdch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Maejpj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cakoqh32.dll" Jalolemm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khaipfcj.dll" Djddbkck.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kbanfbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mogmgpjh.dll" Kopldl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cgcoal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajijco32.dll" Kpecad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lpbnijic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jpdibapb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oacqlicg.dll" Jambpb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mmdlqa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dljaqa32.dll" Aepqac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mgbcha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ifhacfhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cionfqid.dll" Kkechk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgccll32.dll" Hjdfgojp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Iodlcnmf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bdiciboh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hkpdbj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jhengldk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhlfnn32.dll" Mekfmp32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2852 wrote to memory of 2740 2852 NEAS.ce1f6ab3a18386d9903d2abb6d50493b_JC.exe 29 PID 2852 wrote to memory of 2740 2852 NEAS.ce1f6ab3a18386d9903d2abb6d50493b_JC.exe 29 PID 2852 wrote to memory of 2740 2852 NEAS.ce1f6ab3a18386d9903d2abb6d50493b_JC.exe 29 PID 2852 wrote to memory of 2740 2852 NEAS.ce1f6ab3a18386d9903d2abb6d50493b_JC.exe 29 PID 2740 wrote to memory of 2884 2740 Onmfin32.exe 30 PID 2740 wrote to memory of 2884 2740 Onmfin32.exe 30 PID 2740 wrote to memory of 2884 2740 Onmfin32.exe 30 PID 2740 wrote to memory of 2884 2740 Onmfin32.exe 30 PID 2884 wrote to memory of 2648 2884 Fdblkoco.exe 31 PID 2884 wrote to memory of 2648 2884 Fdblkoco.exe 31 PID 2884 wrote to memory of 2648 2884 Fdblkoco.exe 31 PID 2884 wrote to memory of 2648 2884 Fdblkoco.exe 31 PID 2648 wrote to memory of 2572 2648 Fqkieogp.exe 32 PID 2648 wrote to memory of 2572 2648 Fqkieogp.exe 32 PID 2648 wrote to memory of 2572 2648 Fqkieogp.exe 32 PID 2648 wrote to memory of 2572 2648 Fqkieogp.exe 32 PID 2572 wrote to memory of 2820 2572 Ihilqi32.exe 33 PID 2572 wrote to memory of 2820 2572 Ihilqi32.exe 33 PID 2572 wrote to memory of 2820 2572 Ihilqi32.exe 33 PID 2572 wrote to memory of 2820 2572 Ihilqi32.exe 33 PID 2820 wrote to memory of 744 2820 Bklaepbn.exe 34 PID 2820 wrote to memory of 744 2820 Bklaepbn.exe 34 PID 2820 wrote to memory of 744 2820 Bklaepbn.exe 34 PID 2820 wrote to memory of 744 2820 Bklaepbn.exe 34 PID 744 wrote to memory of 1204 744 Bgcbja32.exe 35 PID 744 wrote to memory of 1204 744 Bgcbja32.exe 35 PID 744 wrote to memory of 1204 744 Bgcbja32.exe 35 PID 744 wrote to memory of 1204 744 Bgcbja32.exe 35 PID 1204 wrote to memory of 2952 1204 Qpocno32.exe 36 PID 1204 wrote to memory of 2952 1204 Qpocno32.exe 36 PID 1204 wrote to memory of 2952 1204 Qpocno32.exe 36 PID 1204 wrote to memory of 2952 1204 Qpocno32.exe 36 PID 2952 wrote to memory of 864 2952 Ghmohcbl.exe 37 PID 2952 wrote to memory of 864 2952 Ghmohcbl.exe 37 PID 2952 wrote to memory of 864 2952 Ghmohcbl.exe 37 PID 2952 wrote to memory of 864 2952 Ghmohcbl.exe 37 PID 864 wrote to memory of 2100 864 Mcendc32.exe 38 PID 864 wrote to memory of 2100 864 Mcendc32.exe 38 PID 864 wrote to memory of 2100 864 Mcendc32.exe 38 PID 864 wrote to memory of 2100 864 Mcendc32.exe 38 PID 2100 wrote to memory of 2248 2100 Pfjiod32.exe 40 PID 2100 wrote to memory of 2248 2100 Pfjiod32.exe 40 PID 2100 wrote to memory of 2248 2100 Pfjiod32.exe 40 PID 2100 wrote to memory of 2248 2100 Pfjiod32.exe 40 PID 2248 wrote to memory of 2796 2248 Ebpgoh32.exe 39 PID 2248 wrote to memory of 2796 2248 Ebpgoh32.exe 39 PID 2248 wrote to memory of 2796 2248 Ebpgoh32.exe 39 PID 2248 wrote to memory of 2796 2248 Ebpgoh32.exe 39 PID 2796 wrote to memory of 1708 2796 Fijolbfh.exe 41 PID 2796 wrote to memory of 1708 2796 Fijolbfh.exe 41 PID 2796 wrote to memory of 1708 2796 Fijolbfh.exe 41 PID 2796 wrote to memory of 1708 2796 Fijolbfh.exe 41 PID 1708 wrote to memory of 548 1708 Feppqc32.exe 42 PID 1708 wrote to memory of 548 1708 Feppqc32.exe 42 PID 1708 wrote to memory of 548 1708 Feppqc32.exe 42 PID 1708 wrote to memory of 548 1708 Feppqc32.exe 42 PID 548 wrote to memory of 396 548 Fkmhij32.exe 43 PID 548 wrote to memory of 396 548 Fkmhij32.exe 43 PID 548 wrote to memory of 396 548 Fkmhij32.exe 43 PID 548 wrote to memory of 396 548 Fkmhij32.exe 43 PID 396 wrote to memory of 1632 396 Fhcehngk.exe 44 PID 396 wrote to memory of 1632 396 Fhcehngk.exe 44 PID 396 wrote to memory of 1632 396 Fhcehngk.exe 44 PID 396 wrote to memory of 1632 396 Fhcehngk.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ce1f6ab3a18386d9903d2abb6d50493b_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ce1f6ab3a18386d9903d2abb6d50493b_JC.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\Onmfin32.exeC:\Windows\system32\Onmfin32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\Fdblkoco.exeC:\Windows\system32\Fdblkoco.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\Fqkieogp.exeC:\Windows\system32\Fqkieogp.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\Ihilqi32.exeC:\Windows\system32\Ihilqi32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\Bklaepbn.exeC:\Windows\system32\Bklaepbn.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\Bgcbja32.exeC:\Windows\system32\Bgcbja32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\Qpocno32.exeC:\Windows\system32\Qpocno32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\Ghmohcbl.exeC:\Windows\system32\Ghmohcbl.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\Mcendc32.exeC:\Windows\system32\Mcendc32.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\Pfjiod32.exeC:\Windows\system32\Pfjiod32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\Ebpgoh32.exeC:\Windows\system32\Ebpgoh32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Fijolbfh.exeC:\Windows\system32\Fijolbfh.exe1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\Feppqc32.exeC:\Windows\system32\Feppqc32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\Fkmhij32.exeC:\Windows\system32\Fkmhij32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\Fhcehngk.exeC:\Windows\system32\Fhcehngk.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\Fmpnpe32.exeC:\Windows\system32\Fmpnpe32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Windows\SysWOW64\Fmbkfd32.exeC:\Windows\system32\Fmbkfd32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1976
-
-
-
-
C:\Windows\SysWOW64\Hidekn32.exeC:\Windows\system32\Hidekn32.exe4⤵PID:304
-
C:\Windows\SysWOW64\Hjeacf32.exeC:\Windows\system32\Hjeacf32.exe5⤵PID:852
-
C:\Windows\SysWOW64\Hkenmidf.exeC:\Windows\system32\Hkenmidf.exe6⤵PID:1324
-
C:\Windows\SysWOW64\Ipipllec.exeC:\Windows\system32\Ipipllec.exe7⤵PID:1012
-
C:\Windows\SysWOW64\Ibglhhdf.exeC:\Windows\system32\Ibglhhdf.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2980 -
C:\Windows\SysWOW64\Iidajaiq.exeC:\Windows\system32\Iidajaiq.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2976
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Gdmcbojl.exeC:\Windows\system32\Gdmcbojl.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:832 -
C:\Windows\SysWOW64\Giikkehc.exeC:\Windows\system32\Giikkehc.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2072 -
C:\Windows\SysWOW64\Geplpfnh.exeC:\Windows\system32\Geplpfnh.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2560 -
C:\Windows\SysWOW64\Gpfpmonn.exeC:\Windows\system32\Gpfpmonn.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:688 -
C:\Windows\SysWOW64\Galfpgpg.exeC:\Windows\system32\Galfpgpg.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Windows\SysWOW64\Hkdkhl32.exeC:\Windows\system32\Hkdkhl32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Windows\SysWOW64\Hhhkbqea.exeC:\Windows\system32\Hhhkbqea.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Windows\SysWOW64\Hkidclbb.exeC:\Windows\system32\Hkidclbb.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Hqemlbqi.exeC:\Windows\system32\Hqemlbqi.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2228 -
C:\Windows\SysWOW64\Hjnaehgj.exeC:\Windows\system32\Hjnaehgj.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Windows\SysWOW64\Hdcebagp.exeC:\Windows\system32\Hdcebagp.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2784 -
C:\Windows\SysWOW64\Hfdbji32.exeC:\Windows\system32\Hfdbji32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Windows\SysWOW64\Iiekkdjo.exeC:\Windows\system32\Iiekkdjo.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Windows\SysWOW64\Ioochn32.exeC:\Windows\system32\Ioochn32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1596 -
C:\Windows\SysWOW64\Ickoimie.exeC:\Windows\system32\Ickoimie.exe7⤵
- Executes dropped EXE
PID:2916 -
C:\Windows\SysWOW64\Ijegeg32.exeC:\Windows\system32\Ijegeg32.exe8⤵
- Executes dropped EXE
PID:3004 -
C:\Windows\SysWOW64\Ikfdmogp.exeC:\Windows\system32\Ikfdmogp.exe9⤵
- Executes dropped EXE
PID:1072 -
C:\Windows\SysWOW64\Ibplji32.exeC:\Windows\system32\Ibplji32.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2576 -
C:\Windows\SysWOW64\Ieohfemq.exeC:\Windows\system32\Ieohfemq.exe11⤵
- Executes dropped EXE
PID:2688 -
C:\Windows\SysWOW64\Iodlcnmf.exeC:\Windows\system32\Iodlcnmf.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2768 -
C:\Windows\SysWOW64\Ifndph32.exeC:\Windows\system32\Ifndph32.exe13⤵
- Executes dropped EXE
PID:760 -
C:\Windows\SysWOW64\Iilalc32.exeC:\Windows\system32\Iilalc32.exe14⤵
- Executes dropped EXE
PID:1664 -
C:\Windows\SysWOW64\Ikkmho32.exeC:\Windows\system32\Ikkmho32.exe15⤵
- Executes dropped EXE
- Modifies registry class
PID:2084 -
C:\Windows\SysWOW64\Ibeeeijg.exeC:\Windows\system32\Ibeeeijg.exe16⤵
- Executes dropped EXE
PID:1120 -
C:\Windows\SysWOW64\Iecaad32.exeC:\Windows\system32\Iecaad32.exe17⤵
- Executes dropped EXE
PID:3060 -
C:\Windows\SysWOW64\Ikmjnnah.exeC:\Windows\system32\Ikmjnnah.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1652 -
C:\Windows\SysWOW64\Jbgbjh32.exeC:\Windows\system32\Jbgbjh32.exe19⤵
- Executes dropped EXE
PID:1700 -
C:\Windows\SysWOW64\Jalolemm.exeC:\Windows\system32\Jalolemm.exe20⤵
- Executes dropped EXE
- Modifies registry class
PID:1144 -
C:\Windows\SysWOW64\Jgfghodj.exeC:\Windows\system32\Jgfghodj.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:436 -
C:\Windows\SysWOW64\Jnppei32.exeC:\Windows\system32\Jnppei32.exe22⤵
- Executes dropped EXE
PID:1492 -
C:\Windows\SysWOW64\Jcmhmp32.exeC:\Windows\system32\Jcmhmp32.exe23⤵
- Executes dropped EXE
PID:932 -
C:\Windows\SysWOW64\Jfkdik32.exeC:\Windows\system32\Jfkdik32.exe24⤵
- Executes dropped EXE
- Modifies registry class
PID:1804 -
C:\Windows\SysWOW64\Jijqeg32.exeC:\Windows\system32\Jijqeg32.exe25⤵
- Executes dropped EXE
PID:816 -
C:\Windows\SysWOW64\Jpdibapb.exeC:\Windows\system32\Jpdibapb.exe26⤵
- Executes dropped EXE
- Modifies registry class
PID:3068 -
C:\Windows\SysWOW64\Jjimpj32.exeC:\Windows\system32\Jjimpj32.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2404 -
C:\Windows\SysWOW64\Jlkigbef.exeC:\Windows\system32\Jlkigbef.exe28⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2396 -
C:\Windows\SysWOW64\Jbdadl32.exeC:\Windows\system32\Jbdadl32.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2544 -
C:\Windows\SysWOW64\Jecnpg32.exeC:\Windows\system32\Jecnpg32.exe30⤵
- Executes dropped EXE
PID:2532 -
C:\Windows\SysWOW64\Klmfmacc.exeC:\Windows\system32\Klmfmacc.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1936 -
C:\Windows\SysWOW64\Kbgnil32.exeC:\Windows\system32\Kbgnil32.exe32⤵
- Executes dropped EXE
PID:1564 -
C:\Windows\SysWOW64\Keekeg32.exeC:\Windows\system32\Keekeg32.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2512 -
C:\Windows\SysWOW64\Kpkocpjj.exeC:\Windows\system32\Kpkocpjj.exe34⤵
- Executes dropped EXE
PID:3052 -
C:\Windows\SysWOW64\Kbikokin.exeC:\Windows\system32\Kbikokin.exe35⤵
- Executes dropped EXE
PID:2748 -
C:\Windows\SysWOW64\Kehgkgha.exeC:\Windows\system32\Kehgkgha.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1336 -
C:\Windows\SysWOW64\Klapha32.exeC:\Windows\system32\Klapha32.exe37⤵
- Executes dropped EXE
PID:908 -
C:\Windows\SysWOW64\Kopldl32.exeC:\Windows\system32\Kopldl32.exe38⤵
- Executes dropped EXE
- Modifies registry class
PID:3016 -
C:\Windows\SysWOW64\Kanhph32.exeC:\Windows\system32\Kanhph32.exe39⤵
- Executes dropped EXE
PID:2984 -
C:\Windows\SysWOW64\Kdmdlc32.exeC:\Windows\system32\Kdmdlc32.exe40⤵
- Drops file in System32 directory
PID:2972 -
C:\Windows\SysWOW64\Lggpdmap.exeC:\Windows\system32\Lggpdmap.exe41⤵PID:3012
-
C:\Windows\SysWOW64\Lhhmle32.exeC:\Windows\system32\Lhhmle32.exe42⤵PID:2836
-
C:\Windows\SysWOW64\Lpodmb32.exeC:\Windows\system32\Lpodmb32.exe43⤵PID:2012
-
C:\Windows\SysWOW64\Lcnqin32.exeC:\Windows\system32\Lcnqin32.exe44⤵
- Drops file in System32 directory
PID:1252 -
C:\Windows\SysWOW64\Lihifhoq.exeC:\Windows\system32\Lihifhoq.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:660 -
C:\Windows\SysWOW64\Mkiemqdo.exeC:\Windows\system32\Mkiemqdo.exe46⤵PID:1904
-
C:\Windows\SysWOW64\Mcpmonea.exeC:\Windows\system32\Mcpmonea.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2056 -
C:\Windows\SysWOW64\Mhmfgdch.exeC:\Windows\system32\Mhmfgdch.exe48⤵
- Drops file in System32 directory
- Modifies registry class
PID:1152 -
C:\Windows\SysWOW64\Mkkbcpbl.exeC:\Windows\system32\Mkkbcpbl.exe49⤵PID:2160
-
C:\Windows\SysWOW64\Maejpj32.exeC:\Windows\system32\Maejpj32.exe50⤵
- Modifies registry class
PID:1480 -
C:\Windows\SysWOW64\Meafpibb.exeC:\Windows\system32\Meafpibb.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1776 -
C:\Windows\SysWOW64\Mgbcha32.exeC:\Windows\system32\Mgbcha32.exe52⤵
- Modifies registry class
PID:1884 -
C:\Windows\SysWOW64\Moikinib.exeC:\Windows\system32\Moikinib.exe53⤵
- Modifies registry class
PID:2448 -
C:\Windows\SysWOW64\Mahgejhf.exeC:\Windows\system32\Mahgejhf.exe54⤵PID:2208
-
C:\Windows\SysWOW64\Mhaobd32.exeC:\Windows\system32\Mhaobd32.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1816 -
C:\Windows\SysWOW64\Mjcljlea.exeC:\Windows\system32\Mjcljlea.exe56⤵
- Drops file in System32 directory
PID:620 -
C:\Windows\SysWOW64\Nmmgafjh.exeC:\Windows\system32\Nmmgafjh.exe57⤵PID:1592
-
C:\Windows\SysWOW64\Bffgbo32.exeC:\Windows\system32\Bffgbo32.exe58⤵
- Drops file in System32 directory
PID:2492 -
C:\Windows\SysWOW64\Iejnna32.exeC:\Windows\system32\Iejnna32.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2672 -
C:\Windows\SysWOW64\Lpfdpmho.exeC:\Windows\system32\Lpfdpmho.exe60⤵
- Drops file in System32 directory
PID:2516 -
C:\Windows\SysWOW64\Najbbepc.exeC:\Windows\system32\Najbbepc.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1552 -
C:\Windows\SysWOW64\Aeajcf32.exeC:\Windows\system32\Aeajcf32.exe62⤵PID:1560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Ahpfoa32.exeC:\Windows\system32\Ahpfoa32.exe1⤵PID:2812
-
C:\Windows\SysWOW64\Apgnpo32.exeC:\Windows\system32\Apgnpo32.exe2⤵
- Modifies registry class
PID:1820 -
C:\Windows\SysWOW64\Abejlj32.exeC:\Windows\system32\Abejlj32.exe3⤵PID:828
-
C:\Windows\SysWOW64\Aipbidbj.exeC:\Windows\system32\Aipbidbj.exe4⤵PID:2612
-
C:\Windows\SysWOW64\Alnoepam.exeC:\Windows\system32\Alnoepam.exe5⤵PID:2660
-
C:\Windows\SysWOW64\Ajqoqm32.exeC:\Windows\system32\Ajqoqm32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2988 -
C:\Windows\SysWOW64\Bakgmgpe.exeC:\Windows\system32\Bakgmgpe.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2488 -
C:\Windows\SysWOW64\Bdiciboh.exeC:\Windows\system32\Bdiciboh.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2028 -
C:\Windows\SysWOW64\Bbegkn32.exeC:\Windows\system32\Bbegkn32.exe9⤵PID:2824
-
C:\Windows\SysWOW64\Beccgi32.exeC:\Windows\system32\Beccgi32.exe10⤵
- Drops file in System32 directory
PID:2828 -
C:\Windows\SysWOW64\Cmkkhfmn.exeC:\Windows\system32\Cmkkhfmn.exe11⤵PID:2340
-
C:\Windows\SysWOW64\Colgpo32.exeC:\Windows\system32\Colgpo32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2428 -
C:\Windows\SysWOW64\Cgcoal32.exeC:\Windows\system32\Cgcoal32.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2884 -
C:\Windows\SysWOW64\Chdlidjm.exeC:\Windows\system32\Chdlidjm.exe14⤵
- Modifies registry class
PID:576 -
C:\Windows\SysWOW64\Cpldjajo.exeC:\Windows\system32\Cpldjajo.exe15⤵PID:2452
-
C:\Windows\SysWOW64\Ccjpfmic.exeC:\Windows\system32\Ccjpfmic.exe16⤵
- Drops file in System32 directory
PID:2256 -
C:\Windows\SysWOW64\Cehlbihg.exeC:\Windows\system32\Cehlbihg.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1960 -
C:\Windows\SysWOW64\Cidhcg32.exeC:\Windows\system32\Cidhcg32.exe18⤵PID:968
-
C:\Windows\SysWOW64\Ckeekp32.exeC:\Windows\system32\Ckeekp32.exe19⤵
- Drops file in System32 directory
PID:564 -
C:\Windows\SysWOW64\Cclmlm32.exeC:\Windows\system32\Cclmlm32.exe20⤵
- Drops file in System32 directory
PID:2444 -
C:\Windows\SysWOW64\Cekihh32.exeC:\Windows\system32\Cekihh32.exe21⤵PID:744
-
C:\Windows\SysWOW64\Cleaebna.exeC:\Windows\system32\Cleaebna.exe22⤵PID:1728
-
C:\Windows\SysWOW64\Cnfnlk32.exeC:\Windows\system32\Cnfnlk32.exe23⤵
- Drops file in System32 directory
PID:1736 -
C:\Windows\SysWOW64\Cdpfiekl.exeC:\Windows\system32\Cdpfiekl.exe24⤵PID:2288
-
C:\Windows\SysWOW64\Djddbkck.exeC:\Windows\system32\Djddbkck.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1656 -
C:\Windows\SysWOW64\Dfjegl32.exeC:\Windows\system32\Dfjegl32.exe26⤵PID:2616
-
C:\Windows\SysWOW64\Dppiddie.exeC:\Windows\system32\Dppiddie.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2380 -
C:\Windows\SysWOW64\Dbaflm32.exeC:\Windows\system32\Dbaflm32.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2708 -
C:\Windows\SysWOW64\Djhnmj32.exeC:\Windows\system32\Djhnmj32.exe29⤵PID:2140
-
C:\Windows\SysWOW64\Ekjjebed.exeC:\Windows\system32\Ekjjebed.exe30⤵
- Modifies registry class
PID:3000 -
C:\Windows\SysWOW64\Efoobkej.exeC:\Windows\system32\Efoobkej.exe31⤵PID:2816
-
C:\Windows\SysWOW64\Ehbdif32.exeC:\Windows\system32\Ehbdif32.exe32⤵
- Drops file in System32 directory
PID:2744 -
C:\Windows\SysWOW64\Ekqqea32.exeC:\Windows\system32\Ekqqea32.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1460 -
C:\Windows\SysWOW64\Ejcaanfg.exeC:\Windows\system32\Ejcaanfg.exe34⤵PID:780
-
C:\Windows\SysWOW64\Eqninhmc.exeC:\Windows\system32\Eqninhmc.exe35⤵
- Modifies registry class
PID:972 -
C:\Windows\SysWOW64\Eclejclg.exeC:\Windows\system32\Eclejclg.exe36⤵PID:2076
-
C:\Windows\SysWOW64\Ekcmkamj.exeC:\Windows\system32\Ekcmkamj.exe37⤵PID:1880
-
C:\Windows\SysWOW64\Enajgllm.exeC:\Windows\system32\Enajgllm.exe38⤵
- Drops file in System32 directory
PID:636 -
C:\Windows\SysWOW64\Ffcdlncp.exeC:\Windows\system32\Ffcdlncp.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:320 -
C:\Windows\SysWOW64\Fibqhibd.exeC:\Windows\system32\Fibqhibd.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2424 -
C:\Windows\SysWOW64\Fpliec32.exeC:\Windows\system32\Fpliec32.exe41⤵PID:1332
-
C:\Windows\SysWOW64\Feiamj32.exeC:\Windows\system32\Feiamj32.exe42⤵PID:2344
-
C:\Windows\SysWOW64\Fpnekc32.exeC:\Windows\system32\Fpnekc32.exe43⤵PID:1808
-
C:\Windows\SysWOW64\Gekncjfe.exeC:\Windows\system32\Gekncjfe.exe44⤵PID:2772
-
C:\Windows\SysWOW64\Glefpd32.exeC:\Windows\system32\Glefpd32.exe45⤵PID:2872
-
C:\Windows\SysWOW64\Gncblo32.exeC:\Windows\system32\Gncblo32.exe46⤵PID:1376
-
C:\Windows\SysWOW64\Gabohk32.exeC:\Windows\system32\Gabohk32.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1688 -
C:\Windows\SysWOW64\Glgcec32.exeC:\Windows\system32\Glgcec32.exe48⤵PID:1528
-
C:\Windows\SysWOW64\Gnfoao32.exeC:\Windows\system32\Gnfoao32.exe49⤵PID:1080
-
C:\Windows\SysWOW64\Gdchifik.exeC:\Windows\system32\Gdchifik.exe50⤵
- Drops file in System32 directory
PID:1768 -
C:\Windows\SysWOW64\Gfadeaho.exeC:\Windows\system32\Gfadeaho.exe51⤵PID:2740
-
C:\Windows\SysWOW64\Gjmpfp32.exeC:\Windows\system32\Gjmpfp32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2908 -
C:\Windows\SysWOW64\Gmklbk32.exeC:\Windows\system32\Gmklbk32.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2468 -
C:\Windows\SysWOW64\Gdedoegh.exeC:\Windows\system32\Gdedoegh.exe54⤵PID:2180
-
C:\Windows\SysWOW64\Gibmglep.exeC:\Windows\system32\Gibmglep.exe55⤵PID:2300
-
C:\Windows\SysWOW64\Gpledf32.exeC:\Windows\system32\Gpledf32.exe56⤵PID:2156
-
C:\Windows\SysWOW64\Gffmqq32.exeC:\Windows\system32\Gffmqq32.exe57⤵PID:2496
-
C:\Windows\SysWOW64\Hmpemkkf.exeC:\Windows\system32\Hmpemkkf.exe58⤵PID:2248
-
C:\Windows\SysWOW64\Hdjnje32.exeC:\Windows\system32\Hdjnje32.exe59⤵PID:1448
-
C:\Windows\SysWOW64\Hjdfgojp.exeC:\Windows\system32\Hjdfgojp.exe60⤵
- Modifies registry class
PID:1712 -
C:\Windows\SysWOW64\Hdlkpd32.exeC:\Windows\system32\Hdlkpd32.exe61⤵PID:1176
-
C:\Windows\SysWOW64\Hemggm32.exeC:\Windows\system32\Hemggm32.exe62⤵PID:2268
-
C:\Windows\SysWOW64\Hpckee32.exeC:\Windows\system32\Hpckee32.exe63⤵PID:2596
-
C:\Windows\SysWOW64\Hbagaa32.exeC:\Windows\system32\Hbagaa32.exe64⤵PID:2296
-
C:\Windows\SysWOW64\Hhnpih32.exeC:\Windows\system32\Hhnpih32.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2132 -
C:\Windows\SysWOW64\Hohhfbkl.exeC:\Windows\system32\Hohhfbkl.exe66⤵PID:396
-
C:\Windows\SysWOW64\Hhqmogam.exeC:\Windows\system32\Hhqmogam.exe67⤵PID:2832
-
C:\Windows\SysWOW64\Hojeka32.exeC:\Windows\system32\Hojeka32.exe68⤵
- Modifies registry class
PID:2000 -
C:\Windows\SysWOW64\Idgmch32.exeC:\Windows\system32\Idgmch32.exe69⤵PID:1352
-
C:\Windows\SysWOW64\Ikafpbon.exeC:\Windows\system32\Ikafpbon.exe70⤵PID:2364
-
C:\Windows\SysWOW64\Iaknmm32.exeC:\Windows\system32\Iaknmm32.exe71⤵PID:456
-
C:\Windows\SysWOW64\Ihmene32.exeC:\Windows\system32\Ihmene32.exe72⤵
- Drops file in System32 directory
PID:1204 -
C:\Windows\SysWOW64\Jjehflbe.exeC:\Windows\system32\Jjehflbe.exe73⤵
- Drops file in System32 directory
PID:860 -
C:\Windows\SysWOW64\Jkhjin32.exeC:\Windows\system32\Jkhjin32.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2584 -
C:\Windows\SysWOW64\Kpecad32.exeC:\Windows\system32\Kpecad32.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1056 -
C:\Windows\SysWOW64\Egnjbfqc.exeC:\Windows\system32\Egnjbfqc.exe76⤵PID:2628
-
C:\Windows\SysWOW64\Edbjljpm.exeC:\Windows\system32\Edbjljpm.exe77⤵PID:912
-
C:\Windows\SysWOW64\Egpfheoa.exeC:\Windows\system32\Egpfheoa.exe78⤵PID:1488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Jaiknk32.exeC:\Windows\system32\Jaiknk32.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:820 -
C:\Windows\SysWOW64\Jcggjg32.exeC:\Windows\system32\Jcggjg32.exe58⤵
- Modifies registry class
PID:2108 -
C:\Windows\SysWOW64\Jnmlgpeo.exeC:\Windows\system32\Jnmlgpeo.exe59⤵PID:1448
-
C:\Windows\SysWOW64\Jmplbl32.exeC:\Windows\system32\Jmplbl32.exe60⤵PID:3056
-
C:\Windows\SysWOW64\Jcidofcf.exeC:\Windows\system32\Jcidofcf.exe61⤵PID:1872
-
C:\Windows\SysWOW64\Jgeppe32.exeC:\Windows\system32\Jgeppe32.exe62⤵PID:968
-
C:\Windows\SysWOW64\Jjcllq32.exeC:\Windows\system32\Jjcllq32.exe63⤵PID:1576
-
C:\Windows\SysWOW64\Jandikbp.exeC:\Windows\system32\Jandikbp.exe64⤵PID:288
-
C:\Windows\SysWOW64\Jboapc32.exeC:\Windows\system32\Jboapc32.exe65⤵PID:2020
-
C:\Windows\SysWOW64\Jiiimmok.exeC:\Windows\system32\Jiiimmok.exe66⤵PID:2708
-
C:\Windows\SysWOW64\Klgeih32.exeC:\Windows\system32\Klgeih32.exe67⤵
- Modifies registry class
PID:1232 -
C:\Windows\SysWOW64\Kbanfbfk.exeC:\Windows\system32\Kbanfbfk.exe68⤵
- Modifies registry class
PID:1936 -
C:\Windows\SysWOW64\Kepjbneo.exeC:\Windows\system32\Kepjbneo.exe69⤵PID:2500
-
C:\Windows\SysWOW64\Kliboh32.exeC:\Windows\system32\Kliboh32.exe70⤵PID:2276
-
C:\Windows\SysWOW64\Kjaled32.exeC:\Windows\system32\Kjaled32.exe71⤵PID:2524
-
C:\Windows\SysWOW64\Kbhdfa32.exeC:\Windows\system32\Kbhdfa32.exe72⤵PID:332
-
C:\Windows\SysWOW64\Kdipnjfb.exeC:\Windows\system32\Kdipnjfb.exe73⤵PID:3012
-
C:\Windows\SysWOW64\Klqhogfd.exeC:\Windows\system32\Klqhogfd.exe74⤵PID:1480
-
C:\Windows\SysWOW64\Kmaego32.exeC:\Windows\system32\Kmaego32.exe75⤵
- Modifies registry class
PID:1868 -
C:\Windows\SysWOW64\Keimhmmd.exeC:\Windows\system32\Keimhmmd.exe76⤵
- Drops file in System32 directory
PID:1384 -
C:\Windows\SysWOW64\Khgidhlh.exeC:\Windows\system32\Khgidhlh.exe77⤵PID:1520
-
C:\Windows\SysWOW64\Loaaab32.exeC:\Windows\system32\Loaaab32.exe78⤵PID:3028
-
C:\Windows\SysWOW64\Lpbnijic.exeC:\Windows\system32\Lpbnijic.exe79⤵
- Modifies registry class
PID:1116 -
C:\Windows\SysWOW64\Lkhbfcii.exeC:\Windows\system32\Lkhbfcii.exe80⤵PID:1080
-
C:\Windows\SysWOW64\Labjcmqf.exeC:\Windows\system32\Labjcmqf.exe81⤵PID:2660
-
C:\Windows\SysWOW64\Lgobkdom.exeC:\Windows\system32\Lgobkdom.exe82⤵PID:2248
-
C:\Windows\SysWOW64\Lmikhn32.exeC:\Windows\system32\Lmikhn32.exe83⤵PID:268
-
C:\Windows\SysWOW64\Ldbcdhng.exeC:\Windows\system32\Ldbcdhng.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2304 -
C:\Windows\SysWOW64\Loldefjf.exeC:\Windows\system32\Loldefjf.exe85⤵PID:3036
-
C:\Windows\SysWOW64\Leflapab.exeC:\Windows\system32\Leflapab.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2132 -
C:\Windows\SysWOW64\Lhehnlqf.exeC:\Windows\system32\Lhehnlqf.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2104 -
C:\Windows\SysWOW64\Looajf32.exeC:\Windows\system32\Looajf32.exe88⤵
- Modifies registry class
PID:2608 -
C:\Windows\SysWOW64\Meiigppp.exeC:\Windows\system32\Meiigppp.exe89⤵
- Drops file in System32 directory
- Modifies registry class
PID:2380 -
C:\Windows\SysWOW64\Moanpe32.exeC:\Windows\system32\Moanpe32.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1600 -
C:\Windows\SysWOW64\Mekfmp32.exeC:\Windows\system32\Mekfmp32.exe91⤵
- Modifies registry class
PID:1068 -
C:\Windows\SysWOW64\Mlenijej.exeC:\Windows\system32\Mlenijej.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:296 -
C:\Windows\SysWOW64\Mnfjab32.exeC:\Windows\system32\Mnfjab32.exe93⤵PID:2120
-
C:\Windows\SysWOW64\Mgoojgai.exeC:\Windows\system32\Mgoojgai.exe94⤵PID:1748
-
C:\Windows\SysWOW64\Mnhgga32.exeC:\Windows\system32\Mnhgga32.exe95⤵PID:3024
-
C:\Windows\SysWOW64\Mgalpg32.exeC:\Windows\system32\Mgalpg32.exe96⤵
- Modifies registry class
PID:2208 -
C:\Windows\SysWOW64\Mklhpfho.exeC:\Windows\system32\Mklhpfho.exe97⤵PID:1808
-
C:\Windows\SysWOW64\Mafpmp32.exeC:\Windows\system32\Mafpmp32.exe98⤵PID:2732
-
C:\Windows\SysWOW64\Mgcheg32.exeC:\Windows\system32\Mgcheg32.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2720 -
C:\Windows\SysWOW64\Njadab32.exeC:\Windows\system32\Njadab32.exe100⤵PID:1820
-
C:\Windows\SysWOW64\Nqlmnldd.exeC:\Windows\system32\Nqlmnldd.exe101⤵PID:1612
-
C:\Windows\SysWOW64\Nfhefc32.exeC:\Windows\system32\Nfhefc32.exe102⤵
- Drops file in System32 directory
PID:2740 -
C:\Windows\SysWOW64\Nqnicl32.exeC:\Windows\system32\Nqnicl32.exe103⤵
- Modifies registry class
PID:1568 -
C:\Windows\SysWOW64\Nclfpg32.exeC:\Windows\system32\Nclfpg32.exe104⤵
- Drops file in System32 directory
PID:1084 -
C:\Windows\SysWOW64\Nfkblc32.exeC:\Windows\system32\Nfkblc32.exe105⤵
- Drops file in System32 directory
PID:2452 -
C:\Windows\SysWOW64\Nqpfil32.exeC:\Windows\system32\Nqpfil32.exe106⤵PID:2856
-
C:\Windows\SysWOW64\Noecjh32.exeC:\Windows\system32\Noecjh32.exe107⤵PID:1656
-
C:\Windows\SysWOW64\Nbdpfc32.exeC:\Windows\system32\Nbdpfc32.exe108⤵PID:2676
-
C:\Windows\SysWOW64\Ndblbo32.exeC:\Windows\system32\Ndblbo32.exe109⤵PID:2140
-
C:\Windows\SysWOW64\Nkldoijk.exeC:\Windows\system32\Nkldoijk.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:972 -
C:\Windows\SysWOW64\Nnkpkdio.exeC:\Windows\system32\Nnkpkdio.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2532 -
C:\Windows\SysWOW64\Oipdhm32.exeC:\Windows\system32\Oipdhm32.exe112⤵PID:1608
-
C:\Windows\SysWOW64\Oqkimp32.exeC:\Windows\system32\Oqkimp32.exe113⤵PID:2836
-
C:\Windows\SysWOW64\Oibanm32.exeC:\Windows\system32\Oibanm32.exe114⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1332 -
C:\Windows\SysWOW64\Okamjh32.exeC:\Windows\system32\Okamjh32.exe115⤵PID:2952
-
C:\Windows\SysWOW64\Obkegbnb.exeC:\Windows\system32\Obkegbnb.exe116⤵
- Drops file in System32 directory
PID:1660 -
C:\Windows\SysWOW64\Oclbok32.exeC:\Windows\system32\Oclbok32.exe117⤵
- Drops file in System32 directory
PID:2516 -
C:\Windows\SysWOW64\Ojfjke32.exeC:\Windows\system32\Ojfjke32.exe118⤵PID:2488
-
C:\Windows\SysWOW64\Omdfgq32.exeC:\Windows\system32\Omdfgq32.exe119⤵PID:1944
-
C:\Windows\SysWOW64\Ogjkei32.exeC:\Windows\system32\Ogjkei32.exe120⤵
- Drops file in System32 directory
PID:1952 -
C:\Windows\SysWOW64\Oabonopg.exeC:\Windows\system32\Oabonopg.exe121⤵PID:2596
-
C:\Windows\SysWOW64\Ocakjjok.exeC:\Windows\system32\Ocakjjok.exe122⤵
- Drops file in System32 directory
PID:748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-