Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
162s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2023, 11:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.fbfb19fac3e122497ad61de373b5ffab.exe
Resource
win7-20231020-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.fbfb19fac3e122497ad61de373b5ffab.exe
Resource
win10v2004-20231023-en
6 signatures
150 seconds
General
-
Target
NEAS.fbfb19fac3e122497ad61de373b5ffab.exe
-
Size
482KB
-
MD5
fbfb19fac3e122497ad61de373b5ffab
-
SHA1
aca0ce9e7a0cc42d72df8b93c6ed7deded0fe70e
-
SHA256
7dc921cef900fc2efaaa0a3148ef394323246641ec31d7bb8afa7734dfa2550c
-
SHA512
b965d52af8b04c5d234120e4e47fe986af8d97f1f0898af2171583d13b7259415da58237de1ace40d949ae0e41bf00bfcd7db0ce3810a29c5e97ba578dc0e6fe
-
SSDEEP
6144:BD8+c2Ll+wGXAF2PbgKLVGFM6234lKm3mo8Yvi4KsLTFM6234lKm3:tLLMwGXAF5KLVGFB24lwR45FB24l
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icefib32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckpamabg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gooqfkan.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Chmehhpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aimhmkgn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfbfjk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad NEAS.fbfb19fac3e122497ad61de373b5ffab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bfmolc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dncpkjoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bpemkcck.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lomjicei.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnbnjc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Afeban32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mnjqhcno.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpiqfima.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iaedanal.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkbkmqed.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aiqkmd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bgnffj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hdahek32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iqpclh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mdmngm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djoohk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hjabdo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mdghhb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gloejmld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kdmeqo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kaqejcep.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bldgoeog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ellpmolj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajnkmjqj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Enlcahgh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gdgdeppb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kehojiej.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afceko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dpoiho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cmipkb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jgjeppkp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkkhbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ocfdgg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Debfpd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dmifkecb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Enaaiifb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lbekjipe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eibmlc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Afdkfh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpfbcn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pdqcenmg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofnhfbjl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmhglopl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhicoi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohbfeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Abgcqjhp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gjcmngnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fndgfffm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epcbbohh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Feljgd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejlnfjbd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fqphic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ofbdncaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kpiqfima.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohhfknjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mqnfon32.exe -
Executes dropped EXE 64 IoCs
pid Process 2084 Bgnffj32.exe 2076 Bdfpkm32.exe 3800 Bajqda32.exe 4960 Coegoe32.exe 1268 Dnmaea32.exe 492 Dkcndeen.exe 4984 Dqbcbkab.exe 3084 Eoepebho.exe 724 Egcaod32.exe 2356 Enpfan32.exe 2128 Fnfmbmbi.exe 1324 Gejhef32.exe 2336 Gbnhoj32.exe 2212 Glhimp32.exe 380 Hpfbcn32.exe 3500 Hioflcbj.exe 1800 Hbgkei32.exe 3900 Hldiinke.exe 744 Ihmfco32.exe 4920 Jhgiim32.exe 1636 Jekjcaef.exe 1536 Jhkbdmbg.exe 4456 Jllhpkfk.exe 3428 Kpiqfima.exe 4468 Kefiopki.exe 4544 Koajmepf.exe 3712 Kpccmhdg.exe 3496 Lebijnak.exe 4788 Lomjicei.exe 4900 Lckboblp.exe 5000 Mcoljagj.exe 3288 Mpeiie32.exe 2312 Nbnlaldg.exe 4424 Njljch32.exe 5024 Ofjqihnn.exe 844 Omfekbdh.exe 4976 Pcbkml32.exe 2000 Pjoppf32.exe 520 Pidlqb32.exe 5064 Pmbegqjk.exe 1884 Cnhlgc32.exe 1016 Amikgpcc.exe 3824 Amkhmoap.exe 1688 Gehice32.exe 2352 Bfmolc32.exe 4612 Bkkhbb32.exe 3432 Ckpamabg.exe 2920 Cienon32.exe 1356 Cpfmlghd.exe 3324 Dcffnbee.exe 2752 Gooqfkan.exe 436 Dncpkjoc.exe 4636 Dcphdqmj.exe 3812 Ejlnfjbd.exe 1872 Ecgodpgb.exe 4364 Enlcahgh.exe 2056 Ljglnmdi.exe 4176 Fqphic32.exe 2172 Fjhmbihg.exe 3284 Fcpakn32.exe 3120 Fgnjqm32.exe 3748 Ggccllai.exe 2700 Gnmlhf32.exe 3860 Gdgdeppb.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Qoocnpag.exe Qhekaejj.exe File opened for modification C:\Windows\SysWOW64\Glhimp32.exe Gbnhoj32.exe File created C:\Windows\SysWOW64\Bldgoeog.exe Amoknh32.exe File created C:\Windows\SysWOW64\Hjabdo32.exe Hddilh32.exe File created C:\Windows\SysWOW64\Kaioidkh.exe Kjpgmj32.exe File created C:\Windows\SysWOW64\Logicn32.exe Hdahek32.exe File created C:\Windows\SysWOW64\Kjmjgk32.exe Jepbodhg.exe File created C:\Windows\SysWOW64\Bkgokhco.dll Oeamcmmo.exe File created C:\Windows\SysWOW64\Kojkgebl.dll Ejlnfjbd.exe File opened for modification C:\Windows\SysWOW64\Enopghee.exe Enlcahgh.exe File created C:\Windows\SysWOW64\Loancd32.dll Gdmmlf32.exe File created C:\Windows\SysWOW64\Enopghee.exe Enlcahgh.exe File created C:\Windows\SysWOW64\Bhnbgoib.dll Gjcmngnj.exe File opened for modification C:\Windows\SysWOW64\Ohnljine.exe Process not Found File opened for modification C:\Windows\SysWOW64\Bnppkj32.exe Bgfhnpde.exe File created C:\Windows\SysWOW64\Kpjlgn32.dll Iqpclh32.exe File created C:\Windows\SysWOW64\Inkjfk32.exe Icefib32.exe File opened for modification C:\Windows\SysWOW64\Lfddci32.exe Lechkaga.exe File created C:\Windows\SysWOW64\Gcdfnq32.dll Ofbdncaj.exe File opened for modification C:\Windows\SysWOW64\Ooangh32.exe Ohhfknjf.exe File created C:\Windows\SysWOW64\Mpeiie32.exe Mcoljagj.exe File created C:\Windows\SysWOW64\Kcpcgc32.dll Dcffnbee.exe File created C:\Windows\SysWOW64\Ilpgfc32.dll Gehice32.exe File created C:\Windows\SysWOW64\Bfdkqcmb.dll Odcojm32.exe File created C:\Windows\SysWOW64\Ddegdohc.dll Kaioidkh.exe File opened for modification C:\Windows\SysWOW64\Ejlnfjbd.exe Dcphdqmj.exe File opened for modification C:\Windows\SysWOW64\Ijmapm32.exe Iepihf32.exe File created C:\Windows\SysWOW64\Qemgmmip.dll Fcbehbim.exe File created C:\Windows\SysWOW64\Bpdfpmoo.exe Beobcdoi.exe File created C:\Windows\SysWOW64\Dggkcakg.dll Aimhmkgn.exe File opened for modification C:\Windows\SysWOW64\Iepihf32.exe Gdmmlf32.exe File created C:\Windows\SysWOW64\Kjpmae32.dll Pbifol32.exe File opened for modification C:\Windows\SysWOW64\Hqghqpnl.exe Hjmodffo.exe File opened for modification C:\Windows\SysWOW64\Hnkhjdle.exe Hqghqpnl.exe File created C:\Windows\SysWOW64\Oomelheh.exe Debfpd32.exe File opened for modification C:\Windows\SysWOW64\Pdqcenmg.exe Pcpgmf32.exe File created C:\Windows\SysWOW64\Obbgom32.dll Jdbheajp.exe File created C:\Windows\SysWOW64\Pmbegqjk.exe Pidlqb32.exe File created C:\Windows\SysWOW64\Gihfoi32.dll Fcpakn32.exe File created C:\Windows\SysWOW64\Gcljpeah.dll Gfemmb32.exe File opened for modification C:\Windows\SysWOW64\Hnehdo32.exe Eknpfj32.exe File created C:\Windows\SysWOW64\Pohnnqgo.exe Process not Found File opened for modification C:\Windows\SysWOW64\Cpifeb32.exe Bpemkcck.exe File created C:\Windows\SysWOW64\Fegndm32.dll Eibmlc32.exe File created C:\Windows\SysWOW64\Fooqlnoa.dll Hdahek32.exe File created C:\Windows\SysWOW64\Fflnkhef.dll Pdqcenmg.exe File created C:\Windows\SysWOW64\Amkabind.exe Kmgdaokh.exe File created C:\Windows\SysWOW64\Bejhhd32.exe Bnppkj32.exe File created C:\Windows\SysWOW64\Cdgolq32.exe Cibkohef.exe File opened for modification C:\Windows\SysWOW64\Bpaikm32.exe Bihancje.exe File created C:\Windows\SysWOW64\Gkdinefi.dll Dqbcbkab.exe File opened for modification C:\Windows\SysWOW64\Hjmodffo.exe Gbbkocid.exe File created C:\Windows\SysWOW64\Lhmafcnf.exe Fjfnphpf.exe File opened for modification C:\Windows\SysWOW64\Qhekaejj.exe Okkidceh.exe File created C:\Windows\SysWOW64\Bknbbenh.dll Nmhglopl.exe File opened for modification C:\Windows\SysWOW64\Lndfchdj.exe Lhjnfn32.exe File created C:\Windows\SysWOW64\Lomjicei.exe Lebijnak.exe File opened for modification C:\Windows\SysWOW64\Oggbfdog.exe Oolnabal.exe File created C:\Windows\SysWOW64\Pijcpmhc.exe Ooangh32.exe File created C:\Windows\SysWOW64\Hmedbiid.dll Ienlbf32.exe File created C:\Windows\SysWOW64\Bbniai32.exe Bkdqdokk.exe File opened for modification C:\Windows\SysWOW64\Eoepebho.exe Dqbcbkab.exe File created C:\Windows\SysWOW64\Logbigbg.exe Fcbehbim.exe File created C:\Windows\SysWOW64\Jebdkl32.dll Bfnnmg32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 5184 4012 Process not Found 1289 -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dkcndeen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gdknpp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dbfoclai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qemgmmip.dll" Fcbehbim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gckjlf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Koajmepf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbooabbb.dll" Pbljoafi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ofnhfbjl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lbhojo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Geeecogb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Iaedanal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Imknli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgaakmhb.dll" Lhdqhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnginbho.dll" Qhekaejj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Flfbcndo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hjabdo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbnckkha.dll" Eoepebho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ommjnlnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jgjeppkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pncmdhlq.dll" Gbbkocid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaejqcdo.dll" Jhgiim32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jpfnqc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ommjnlnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cefked32.dll" Okkidceh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Abgcqjhp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmamhbhe.dll" Bajqda32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Egkgljkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aghaqkii.dll" Hgpibdam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ecgodpgb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Enaaiifb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bpemkcck.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ohnljine.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hddilh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oogdfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lljoca32.dll" Cienon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmmfoj32.dll" Gggmgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igdnnggp.dll" Gloejmld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdcbee32.dll" Eknpfj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hjdedepg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jbppgona.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Afeban32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gloejmld.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lhogamih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hbgkei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Chmehhpn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ofbdncaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qhfaig32.dll" Bcnleb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Amikgpcc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pfbmdabh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID NEAS.fbfb19fac3e122497ad61de373b5ffab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpgkbmbm.dll" Nbnlaldg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fegndm32.dll" Eibmlc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nmhglopl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndjaei32.dll" Dnmaea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkfood32.dll" Jbppgona.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lbekjipe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Epcbbohh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kaioidkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcelel32.dll" Oggbfdog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hghklqmm.dll" Koajmepf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dffdcecg.dll" Gdknpp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Egelgoah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgobcb32.dll" Lhjnfn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bcnleb32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3708 wrote to memory of 2084 3708 NEAS.fbfb19fac3e122497ad61de373b5ffab.exe 91 PID 3708 wrote to memory of 2084 3708 NEAS.fbfb19fac3e122497ad61de373b5ffab.exe 91 PID 3708 wrote to memory of 2084 3708 NEAS.fbfb19fac3e122497ad61de373b5ffab.exe 91 PID 2084 wrote to memory of 2076 2084 Bgnffj32.exe 92 PID 2084 wrote to memory of 2076 2084 Bgnffj32.exe 92 PID 2084 wrote to memory of 2076 2084 Bgnffj32.exe 92 PID 2076 wrote to memory of 3800 2076 Bdfpkm32.exe 93 PID 2076 wrote to memory of 3800 2076 Bdfpkm32.exe 93 PID 2076 wrote to memory of 3800 2076 Bdfpkm32.exe 93 PID 3800 wrote to memory of 4960 3800 Bajqda32.exe 94 PID 3800 wrote to memory of 4960 3800 Bajqda32.exe 94 PID 3800 wrote to memory of 4960 3800 Bajqda32.exe 94 PID 4960 wrote to memory of 1268 4960 Coegoe32.exe 95 PID 4960 wrote to memory of 1268 4960 Coegoe32.exe 95 PID 4960 wrote to memory of 1268 4960 Coegoe32.exe 95 PID 1268 wrote to memory of 492 1268 Dnmaea32.exe 96 PID 1268 wrote to memory of 492 1268 Dnmaea32.exe 96 PID 1268 wrote to memory of 492 1268 Dnmaea32.exe 96 PID 492 wrote to memory of 4984 492 Dkcndeen.exe 97 PID 492 wrote to memory of 4984 492 Dkcndeen.exe 97 PID 492 wrote to memory of 4984 492 Dkcndeen.exe 97 PID 4984 wrote to memory of 3084 4984 Dqbcbkab.exe 98 PID 4984 wrote to memory of 3084 4984 Dqbcbkab.exe 98 PID 4984 wrote to memory of 3084 4984 Dqbcbkab.exe 98 PID 3084 wrote to memory of 724 3084 Eoepebho.exe 99 PID 3084 wrote to memory of 724 3084 Eoepebho.exe 99 PID 3084 wrote to memory of 724 3084 Eoepebho.exe 99 PID 724 wrote to memory of 2356 724 Egcaod32.exe 100 PID 724 wrote to memory of 2356 724 Egcaod32.exe 100 PID 724 wrote to memory of 2356 724 Egcaod32.exe 100 PID 2356 wrote to memory of 2128 2356 Enpfan32.exe 101 PID 2356 wrote to memory of 2128 2356 Enpfan32.exe 101 PID 2356 wrote to memory of 2128 2356 Enpfan32.exe 101 PID 2128 wrote to memory of 1324 2128 Fnfmbmbi.exe 102 PID 2128 wrote to memory of 1324 2128 Fnfmbmbi.exe 102 PID 2128 wrote to memory of 1324 2128 Fnfmbmbi.exe 102 PID 1324 wrote to memory of 2336 1324 Gejhef32.exe 103 PID 1324 wrote to memory of 2336 1324 Gejhef32.exe 103 PID 1324 wrote to memory of 2336 1324 Gejhef32.exe 103 PID 2336 wrote to memory of 2212 2336 Gbnhoj32.exe 104 PID 2336 wrote to memory of 2212 2336 Gbnhoj32.exe 104 PID 2336 wrote to memory of 2212 2336 Gbnhoj32.exe 104 PID 2212 wrote to memory of 380 2212 Glhimp32.exe 105 PID 2212 wrote to memory of 380 2212 Glhimp32.exe 105 PID 2212 wrote to memory of 380 2212 Glhimp32.exe 105 PID 380 wrote to memory of 3500 380 Hpfbcn32.exe 106 PID 380 wrote to memory of 3500 380 Hpfbcn32.exe 106 PID 380 wrote to memory of 3500 380 Hpfbcn32.exe 106 PID 3500 wrote to memory of 1800 3500 Hioflcbj.exe 107 PID 3500 wrote to memory of 1800 3500 Hioflcbj.exe 107 PID 3500 wrote to memory of 1800 3500 Hioflcbj.exe 107 PID 1800 wrote to memory of 3900 1800 Hbgkei32.exe 108 PID 1800 wrote to memory of 3900 1800 Hbgkei32.exe 108 PID 1800 wrote to memory of 3900 1800 Hbgkei32.exe 108 PID 3900 wrote to memory of 744 3900 Hldiinke.exe 109 PID 3900 wrote to memory of 744 3900 Hldiinke.exe 109 PID 3900 wrote to memory of 744 3900 Hldiinke.exe 109 PID 744 wrote to memory of 4920 744 Ihmfco32.exe 110 PID 744 wrote to memory of 4920 744 Ihmfco32.exe 110 PID 744 wrote to memory of 4920 744 Ihmfco32.exe 110 PID 4920 wrote to memory of 1636 4920 Jhgiim32.exe 111 PID 4920 wrote to memory of 1636 4920 Jhgiim32.exe 111 PID 4920 wrote to memory of 1636 4920 Jhgiim32.exe 111 PID 1636 wrote to memory of 1536 1636 Jekjcaef.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.fbfb19fac3e122497ad61de373b5ffab.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.fbfb19fac3e122497ad61de373b5ffab.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\Bgnffj32.exeC:\Windows\system32\Bgnffj32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\Bdfpkm32.exeC:\Windows\system32\Bdfpkm32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\Bajqda32.exeC:\Windows\system32\Bajqda32.exe4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\Coegoe32.exeC:\Windows\system32\Coegoe32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\Dnmaea32.exeC:\Windows\system32\Dnmaea32.exe6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\Dkcndeen.exeC:\Windows\system32\Dkcndeen.exe7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Windows\SysWOW64\Dqbcbkab.exeC:\Windows\system32\Dqbcbkab.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\Eoepebho.exeC:\Windows\system32\Eoepebho.exe9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\Egcaod32.exeC:\Windows\system32\Egcaod32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Windows\SysWOW64\Enpfan32.exeC:\Windows\system32\Enpfan32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\Fnfmbmbi.exeC:\Windows\system32\Fnfmbmbi.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\Gejhef32.exeC:\Windows\system32\Gejhef32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\Gbnhoj32.exeC:\Windows\system32\Gbnhoj32.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\Glhimp32.exeC:\Windows\system32\Glhimp32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\Hpfbcn32.exeC:\Windows\system32\Hpfbcn32.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\SysWOW64\Hioflcbj.exeC:\Windows\system32\Hioflcbj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\Hbgkei32.exeC:\Windows\system32\Hbgkei32.exe18⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\Hldiinke.exeC:\Windows\system32\Hldiinke.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\Ihmfco32.exeC:\Windows\system32\Ihmfco32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\Jhgiim32.exeC:\Windows\system32\Jhgiim32.exe21⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\Jekjcaef.exeC:\Windows\system32\Jekjcaef.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\Jhkbdmbg.exeC:\Windows\system32\Jhkbdmbg.exe23⤵
- Executes dropped EXE
PID:1536 -
C:\Windows\SysWOW64\Jllhpkfk.exeC:\Windows\system32\Jllhpkfk.exe24⤵
- Executes dropped EXE
PID:4456 -
C:\Windows\SysWOW64\Kpiqfima.exeC:\Windows\system32\Kpiqfima.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3428 -
C:\Windows\SysWOW64\Kefiopki.exeC:\Windows\system32\Kefiopki.exe26⤵
- Executes dropped EXE
PID:4468 -
C:\Windows\SysWOW64\Koajmepf.exeC:\Windows\system32\Koajmepf.exe27⤵
- Executes dropped EXE
- Modifies registry class
PID:4544 -
C:\Windows\SysWOW64\Kpccmhdg.exeC:\Windows\system32\Kpccmhdg.exe28⤵
- Executes dropped EXE
PID:3712 -
C:\Windows\SysWOW64\Lebijnak.exeC:\Windows\system32\Lebijnak.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3496 -
C:\Windows\SysWOW64\Lomjicei.exeC:\Windows\system32\Lomjicei.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4788 -
C:\Windows\SysWOW64\Lckboblp.exeC:\Windows\system32\Lckboblp.exe31⤵
- Executes dropped EXE
PID:4900 -
C:\Windows\SysWOW64\Mcoljagj.exeC:\Windows\system32\Mcoljagj.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5000 -
C:\Windows\SysWOW64\Mpeiie32.exeC:\Windows\system32\Mpeiie32.exe33⤵
- Executes dropped EXE
PID:3288 -
C:\Windows\SysWOW64\Nbnlaldg.exeC:\Windows\system32\Nbnlaldg.exe34⤵
- Executes dropped EXE
- Modifies registry class
PID:2312 -
C:\Windows\SysWOW64\Njljch32.exeC:\Windows\system32\Njljch32.exe35⤵
- Executes dropped EXE
PID:4424 -
C:\Windows\SysWOW64\Ofjqihnn.exeC:\Windows\system32\Ofjqihnn.exe36⤵
- Executes dropped EXE
PID:5024 -
C:\Windows\SysWOW64\Omfekbdh.exeC:\Windows\system32\Omfekbdh.exe37⤵
- Executes dropped EXE
PID:844 -
C:\Windows\SysWOW64\Pcbkml32.exeC:\Windows\system32\Pcbkml32.exe38⤵
- Executes dropped EXE
PID:4976 -
C:\Windows\SysWOW64\Pjoppf32.exeC:\Windows\system32\Pjoppf32.exe39⤵
- Executes dropped EXE
PID:2000 -
C:\Windows\SysWOW64\Pidlqb32.exeC:\Windows\system32\Pidlqb32.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:520 -
C:\Windows\SysWOW64\Pmbegqjk.exeC:\Windows\system32\Pmbegqjk.exe41⤵
- Executes dropped EXE
PID:5064 -
C:\Windows\SysWOW64\Qbajeg32.exeC:\Windows\system32\Qbajeg32.exe42⤵PID:1884
-
C:\Windows\SysWOW64\Amikgpcc.exeC:\Windows\system32\Amikgpcc.exe43⤵
- Executes dropped EXE
- Modifies registry class
PID:1016 -
C:\Windows\SysWOW64\Amkhmoap.exeC:\Windows\system32\Amkhmoap.exe44⤵
- Executes dropped EXE
PID:3824 -
C:\Windows\SysWOW64\Banjnm32.exeC:\Windows\system32\Banjnm32.exe45⤵PID:1688
-
C:\Windows\SysWOW64\Bfmolc32.exeC:\Windows\system32\Bfmolc32.exe46⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2352 -
C:\Windows\SysWOW64\Bkkhbb32.exeC:\Windows\system32\Bkkhbb32.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4612 -
C:\Windows\SysWOW64\Ckpamabg.exeC:\Windows\system32\Ckpamabg.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3432 -
C:\Windows\SysWOW64\Cienon32.exeC:\Windows\system32\Cienon32.exe49⤵
- Executes dropped EXE
- Modifies registry class
PID:2920 -
C:\Windows\SysWOW64\Cpfmlghd.exeC:\Windows\system32\Cpfmlghd.exe50⤵
- Executes dropped EXE
PID:1356 -
C:\Windows\SysWOW64\Dcffnbee.exeC:\Windows\system32\Dcffnbee.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3324 -
C:\Windows\SysWOW64\Dcnlnaom.exeC:\Windows\system32\Dcnlnaom.exe52⤵PID:2752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Ahngmnnd.exeC:\Windows\system32\Ahngmnnd.exe36⤵PID:4904
-
C:\Windows\SysWOW64\Abflfc32.exeC:\Windows\system32\Abflfc32.exe37⤵PID:10232
-
C:\Windows\SysWOW64\Akopoi32.exeC:\Windows\system32\Akopoi32.exe38⤵PID:844
-
C:\Windows\SysWOW64\Bdgehobe.exeC:\Windows\system32\Bdgehobe.exe39⤵PID:9644
-
C:\Windows\SysWOW64\Bkamdi32.exeC:\Windows\system32\Bkamdi32.exe40⤵PID:1188
-
C:\Windows\SysWOW64\Bkcjjhgp.exeC:\Windows\system32\Bkcjjhgp.exe41⤵PID:1396
-
C:\Windows\SysWOW64\Bdlncn32.exeC:\Windows\system32\Bdlncn32.exe42⤵PID:9908
-
C:\Windows\SysWOW64\Bkefphem.exeC:\Windows\system32\Bkefphem.exe43⤵PID:4764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Npcaie32.exeC:\Windows\system32\Npcaie32.exe20⤵PID:10216
-
C:\Windows\SysWOW64\Okiefn32.exeC:\Windows\system32\Okiefn32.exe21⤵PID:9236
-
C:\Windows\SysWOW64\Oacmchcl.exeC:\Windows\system32\Oacmchcl.exe22⤵PID:9332
-
C:\Windows\SysWOW64\Ohmepbki.exeC:\Windows\system32\Ohmepbki.exe23⤵PID:468
-
C:\Windows\SysWOW64\Oinbgk32.exeC:\Windows\system32\Oinbgk32.exe24⤵PID:2096
-
C:\Windows\SysWOW64\Odcfdc32.exeC:\Windows\system32\Odcfdc32.exe25⤵PID:9452
-
C:\Windows\SysWOW64\Oiqomj32.exeC:\Windows\system32\Oiqomj32.exe26⤵PID:3128
-
C:\Windows\SysWOW64\Odfcjc32.exeC:\Windows\system32\Odfcjc32.exe27⤵PID:9668
-
C:\Windows\SysWOW64\Okpkgm32.exeC:\Windows\system32\Okpkgm32.exe28⤵PID:1800
-
C:\Windows\SysWOW64\Oajccgmd.exeC:\Windows\system32\Oajccgmd.exe29⤵PID:9804
-
C:\Windows\SysWOW64\Ohdlpa32.exeC:\Windows\system32\Ohdlpa32.exe30⤵PID:9992
-
C:\Windows\SysWOW64\Oiehhjjp.exeC:\Windows\system32\Oiehhjjp.exe31⤵PID:10112
-
C:\Windows\SysWOW64\Opopdd32.exeC:\Windows\system32\Opopdd32.exe32⤵PID:10168
-
C:\Windows\SysWOW64\Pgihanii.exeC:\Windows\system32\Pgihanii.exe33⤵PID:3496
-
C:\Windows\SysWOW64\Pncanhaf.exeC:\Windows\system32\Pncanhaf.exe34⤵PID:4680
-
C:\Windows\SysWOW64\Pdmikb32.exeC:\Windows\system32\Pdmikb32.exe35⤵PID:4456
-
C:\Windows\SysWOW64\Pjjaci32.exeC:\Windows\system32\Pjjaci32.exe36⤵PID:4808
-
C:\Windows\SysWOW64\Pjlnhi32.exeC:\Windows\system32\Pjlnhi32.exe37⤵PID:9612
-
C:\Windows\SysWOW64\Pnjgog32.exeC:\Windows\system32\Pnjgog32.exe38⤵PID:9832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Eoocfegl.exeC:\Windows\system32\Eoocfegl.exe8⤵PID:9204
-
C:\Windows\SysWOW64\Efikco32.exeC:\Windows\system32\Efikco32.exe9⤵PID:7224
-
C:\Windows\SysWOW64\Elccpife.exeC:\Windows\system32\Elccpife.exe10⤵PID:6512
-
C:\Windows\SysWOW64\Eflhiolf.exeC:\Windows\system32\Eflhiolf.exe11⤵PID:8968
-
C:\Windows\SysWOW64\Ecphbckp.exeC:\Windows\system32\Ecphbckp.exe12⤵PID:9124
-
C:\Windows\SysWOW64\Ejiqom32.exeC:\Windows\system32\Ejiqom32.exe13⤵PID:7744
-
C:\Windows\SysWOW64\Fcbehbim.exeC:\Windows\system32\Fcbehbim.exe14⤵
- Drops file in System32 directory
- Modifies registry class
PID:7408 -
C:\Windows\SysWOW64\Fqfeag32.exeC:\Windows\system32\Fqfeag32.exe15⤵PID:9260
-
C:\Windows\SysWOW64\Fjnjjlog.exeC:\Windows\system32\Fjnjjlog.exe16⤵PID:8024
-
C:\Windows\SysWOW64\Fcfocb32.exeC:\Windows\system32\Fcfocb32.exe17⤵PID:4984
-
C:\Windows\SysWOW64\Ficgkico.exeC:\Windows\system32\Ficgkico.exe18⤵PID:8736
-
C:\Windows\SysWOW64\Fblldn32.exeC:\Windows\system32\Fblldn32.exe19⤵PID:1784
-
C:\Windows\SysWOW64\Fifdqhal.exeC:\Windows\system32\Fifdqhal.exe20⤵PID:1604
-
C:\Windows\SysWOW64\Gcneca32.exeC:\Windows\system32\Gcneca32.exe21⤵PID:3728
-
C:\Windows\SysWOW64\Gcpaiq32.exeC:\Windows\system32\Gcpaiq32.exe22⤵PID:8616
-
C:\Windows\SysWOW64\Gfqjkljn.exeC:\Windows\system32\Gfqjkljn.exe23⤵PID:8256
-
C:\Windows\SysWOW64\Gcggjp32.exeC:\Windows\system32\Gcggjp32.exe24⤵PID:2356
-
C:\Windows\SysWOW64\Hfoflj32.exeC:\Windows\system32\Hfoflj32.exe25⤵PID:2468
-
C:\Windows\SysWOW64\Ipihkobl.exeC:\Windows\system32\Ipihkobl.exe26⤵PID:8548
-
C:\Windows\SysWOW64\Iiblcdil.exeC:\Windows\system32\Iiblcdil.exe27⤵PID:5808
-
C:\Windows\SysWOW64\Icgqqmib.exeC:\Windows\system32\Icgqqmib.exe28⤵PID:6036
-
C:\Windows\SysWOW64\Ijaimg32.exeC:\Windows\system32\Ijaimg32.exe29⤵PID:9772
-
C:\Windows\SysWOW64\Iannpa32.exeC:\Windows\system32\Iannpa32.exe30⤵PID:6272
-
C:\Windows\SysWOW64\Iiibdc32.exeC:\Windows\system32\Iiibdc32.exe31⤵PID:6800
-
C:\Windows\SysWOW64\Jabgkpad.exeC:\Windows\system32\Jabgkpad.exe32⤵PID:5892
-
C:\Windows\SysWOW64\Jjklcf32.exeC:\Windows\system32\Jjklcf32.exe33⤵PID:7056
-
C:\Windows\SysWOW64\Jbfphh32.exeC:\Windows\system32\Jbfphh32.exe34⤵PID:9940
-
C:\Windows\SysWOW64\Jiphebml.exeC:\Windows\system32\Jiphebml.exe35⤵PID:10032
-
C:\Windows\SysWOW64\Jfdinf32.exeC:\Windows\system32\Jfdinf32.exe36⤵PID:7308
-
C:\Windows\SysWOW64\Jaimko32.exeC:\Windows\system32\Jaimko32.exe37⤵PID:7496
-
C:\Windows\SysWOW64\Jkaadebl.exeC:\Windows\system32\Jkaadebl.exe38⤵PID:9852
-
C:\Windows\SysWOW64\Kmbkfp32.exeC:\Windows\system32\Kmbkfp32.exe39⤵PID:5432
-
C:\Windows\SysWOW64\Kgkooeen.exeC:\Windows\system32\Kgkooeen.exe40⤵PID:8112
-
C:\Windows\SysWOW64\Kpccgk32.exeC:\Windows\system32\Kpccgk32.exe41⤵PID:7588
-
C:\Windows\SysWOW64\Kmgdaokh.exeC:\Windows\system32\Kmgdaokh.exe42⤵
- Drops file in System32 directory
PID:4972 -
C:\Windows\SysWOW64\Kkkdjcjb.exeC:\Windows\system32\Kkkdjcjb.exe43⤵PID:7984
-
C:\Windows\SysWOW64\Kipalpoj.exeC:\Windows\system32\Kipalpoj.exe44⤵PID:4020
-
C:\Windows\SysWOW64\Lcifde32.exeC:\Windows\system32\Lcifde32.exe45⤵PID:11064
-
C:\Windows\SysWOW64\Lpmfnj32.exeC:\Windows\system32\Lpmfnj32.exe46⤵PID:7728
-
C:\Windows\SysWOW64\Lmqggncn.exeC:\Windows\system32\Lmqggncn.exe47⤵PID:7892
-
C:\Windows\SysWOW64\Lanpml32.exeC:\Windows\system32\Lanpml32.exe48⤵PID:3940
-
C:\Windows\SysWOW64\Lkgdfb32.exeC:\Windows\system32\Lkgdfb32.exe49⤵PID:9752
-
C:\Windows\SysWOW64\Lcbikd32.exeC:\Windows\system32\Lcbikd32.exe50⤵PID:3424
-
C:\Windows\SysWOW64\Lpfidh32.exeC:\Windows\system32\Lpfidh32.exe51⤵PID:2992
-
C:\Windows\SysWOW64\Maefnk32.exeC:\Windows\system32\Maefnk32.exe52⤵PID:3976
-
C:\Windows\SysWOW64\Mjqjbn32.exeC:\Windows\system32\Mjqjbn32.exe53⤵PID:10228
-
C:\Windows\SysWOW64\Mciokcgg.exeC:\Windows\system32\Mciokcgg.exe54⤵PID:5540
-
C:\Windows\SysWOW64\Mjednmla.exeC:\Windows\system32\Mjednmla.exe55⤵PID:9436
-
C:\Windows\SysWOW64\Mcnhfb32.exeC:\Windows\system32\Mcnhfb32.exe56⤵PID:6684
-
C:\Windows\SysWOW64\Mjhqcmjo.exeC:\Windows\system32\Mjhqcmjo.exe57⤵PID:2040
-
C:\Windows\SysWOW64\Nqaipgal.exeC:\Windows\system32\Nqaipgal.exe58⤵PID:8276
-
C:\Windows\SysWOW64\Njjmil32.exeC:\Windows\system32\Njjmil32.exe59⤵PID:6616
-
C:\Windows\SysWOW64\Ngnnbq32.exeC:\Windows\system32\Ngnnbq32.exe60⤵PID:8012
-
C:\Windows\SysWOW64\Nqioqf32.exeC:\Windows\system32\Nqioqf32.exe61⤵PID:10012
-
C:\Windows\SysWOW64\Nbhkjicf.exeC:\Windows\system32\Nbhkjicf.exe62⤵PID:2300
-
C:\Windows\SysWOW64\Ogjmnomi.exeC:\Windows\system32\Ogjmnomi.exe63⤵PID:8064
-
C:\Windows\SysWOW64\Okgfdm32.exeC:\Windows\system32\Okgfdm32.exe64⤵PID:8200
-
C:\Windows\SysWOW64\Obanqgkl.exeC:\Windows\system32\Obanqgkl.exe65⤵PID:1360
-
C:\Windows\SysWOW64\Ojmcej32.exeC:\Windows\system32\Ojmcej32.exe66⤵PID:9804
-
C:\Windows\SysWOW64\Pkaijl32.exeC:\Windows\system32\Pkaijl32.exe67⤵PID:4728
-
C:\Windows\SysWOW64\Panabc32.exeC:\Windows\system32\Panabc32.exe68⤵PID:7140
-
C:\Windows\SysWOW64\Papnhbgi.exeC:\Windows\system32\Papnhbgi.exe69⤵PID:9196
-
C:\Windows\SysWOW64\Pkebekgo.exeC:\Windows\system32\Pkebekgo.exe70⤵PID:4808
-
C:\Windows\SysWOW64\Pkhokkel.exeC:\Windows\system32\Pkhokkel.exe71⤵PID:7520
-
C:\Windows\SysWOW64\Qaegcb32.exeC:\Windows\system32\Qaegcb32.exe72⤵PID:8460
-
C:\Windows\SysWOW64\Qkjlpk32.exeC:\Windows\system32\Qkjlpk32.exe73⤵PID:8636
-
C:\Windows\SysWOW64\Ankdbf32.exeC:\Windows\system32\Ankdbf32.exe74⤵PID:8496
-
C:\Windows\SysWOW64\Achmjmnb.exeC:\Windows\system32\Achmjmnb.exe75⤵PID:5668
-
C:\Windows\SysWOW64\Anmagenh.exeC:\Windows\system32\Anmagenh.exe76⤵PID:8916
-
C:\Windows\SysWOW64\Ahffqk32.exeC:\Windows\system32\Ahffqk32.exe77⤵PID:10292
-
C:\Windows\SysWOW64\Abkjnd32.exeC:\Windows\system32\Abkjnd32.exe78⤵PID:3996
-
C:\Windows\SysWOW64\Ahhbfkbf.exeC:\Windows\system32\Ahhbfkbf.exe79⤵PID:6116
-
C:\Windows\SysWOW64\Aaqgop32.exeC:\Windows\system32\Aaqgop32.exe80⤵PID:4068
-
C:\Windows\SysWOW64\Alfkli32.exeC:\Windows\system32\Alfkli32.exe81⤵PID:8480
-
C:\Windows\SysWOW64\Aaccdp32.exeC:\Windows\system32\Aaccdp32.exe82⤵PID:9144
-
C:\Windows\SysWOW64\Blhhaigj.exeC:\Windows\system32\Blhhaigj.exe83⤵PID:8716
-
C:\Windows\SysWOW64\Bdcmfkde.exeC:\Windows\system32\Bdcmfkde.exe84⤵PID:4220
-
C:\Windows\SysWOW64\Bjnece32.exeC:\Windows\system32\Bjnece32.exe85⤵PID:7720
-
C:\Windows\SysWOW64\Becipn32.exeC:\Windows\system32\Becipn32.exe86⤵PID:10780
-
C:\Windows\SysWOW64\Boknic32.exeC:\Windows\system32\Boknic32.exe87⤵PID:10324
-
C:\Windows\SysWOW64\Bonjnc32.exeC:\Windows\system32\Bonjnc32.exe88⤵PID:10428
-
C:\Windows\SysWOW64\Bjdkcd32.exeC:\Windows\system32\Bjdkcd32.exe89⤵PID:3376
-
C:\Windows\SysWOW64\Baocpnmf.exeC:\Windows\system32\Baocpnmf.exe90⤵PID:4420
-
C:\Windows\SysWOW64\Cellfm32.exeC:\Windows\system32\Cellfm32.exe91⤵PID:11040
-
C:\Windows\SysWOW64\Clfdcgkj.exeC:\Windows\system32\Clfdcgkj.exe92⤵PID:11084
-
C:\Windows\SysWOW64\Cbqlpabf.exeC:\Windows\system32\Cbqlpabf.exe93⤵PID:8988
-
C:\Windows\SysWOW64\Chmehhpn.exeC:\Windows\system32\Chmehhpn.exe94⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5352 -
C:\Windows\SysWOW64\Cogmdb32.exeC:\Windows\system32\Cogmdb32.exe95⤵PID:3708
-
C:\Windows\SysWOW64\Ceaealoh.exeC:\Windows\system32\Ceaealoh.exe96⤵PID:10812
-
C:\Windows\SysWOW64\Cbefkp32.exeC:\Windows\system32\Cbefkp32.exe97⤵PID:10928
-
C:\Windows\SysWOW64\Cdfbbhdp.exeC:\Windows\system32\Cdfbbhdp.exe98⤵PID:8892
-
C:\Windows\SysWOW64\Cajblmci.exeC:\Windows\system32\Cajblmci.exe99⤵PID:8896
-
C:\Windows\SysWOW64\Donceaac.exeC:\Windows\system32\Donceaac.exe100⤵PID:11024
-
C:\Windows\SysWOW64\Dlbcoe32.exeC:\Windows\system32\Dlbcoe32.exe101⤵PID:9040
-
C:\Windows\SysWOW64\Eojcao32.exeC:\Windows\system32\Eojcao32.exe102⤵PID:6440
-
C:\Windows\SysWOW64\Ekqcfpmj.exeC:\Windows\system32\Ekqcfpmj.exe103⤵PID:10288
-
C:\Windows\SysWOW64\Ehimkd32.exeC:\Windows\system32\Ehimkd32.exe104⤵PID:8840
-
C:\Windows\SysWOW64\Fdpnpe32.exeC:\Windows\system32\Fdpnpe32.exe105⤵PID:9556
-
C:\Windows\SysWOW64\Fdegkdim.exeC:\Windows\system32\Fdegkdim.exe106⤵PID:5980
-
C:\Windows\SysWOW64\Fkcibnmd.exeC:\Windows\system32\Fkcibnmd.exe107⤵PID:9748
-
C:\Windows\SysWOW64\Gdlnkc32.exeC:\Windows\system32\Gdlnkc32.exe108⤵PID:6500
-
C:\Windows\SysWOW64\Glcelq32.exeC:\Windows\system32\Glcelq32.exe109⤵PID:6776
-
C:\Windows\SysWOW64\Gbpnegbo.exeC:\Windows\system32\Gbpnegbo.exe110⤵PID:9876
-
C:\Windows\SysWOW64\Glebbpbd.exeC:\Windows\system32\Glebbpbd.exe111⤵PID:940
-
C:\Windows\SysWOW64\Gbbkjgpl.exeC:\Windows\system32\Gbbkjgpl.exe112⤵PID:8176
-
C:\Windows\SysWOW64\Gbdgpfni.exeC:\Windows\system32\Gbdgpfni.exe113⤵PID:4076
-
C:\Windows\SysWOW64\Gbgdef32.exeC:\Windows\system32\Gbgdef32.exe114⤵PID:1688
-
C:\Windows\SysWOW64\Hbiakf32.exeC:\Windows\system32\Hbiakf32.exe115⤵PID:6152
-
C:\Windows\SysWOW64\Hkaedk32.exeC:\Windows\system32\Hkaedk32.exe116⤵PID:9548
-
C:\Windows\SysWOW64\Hbknqeha.exeC:\Windows\system32\Hbknqeha.exe117⤵PID:9232
-
C:\Windows\SysWOW64\Hcmgphma.exeC:\Windows\system32\Hcmgphma.exe118⤵PID:10676
-
C:\Windows\SysWOW64\Hmfkin32.exeC:\Windows\system32\Hmfkin32.exe119⤵PID:9684
-
C:\Windows\SysWOW64\Hcpcehko.exeC:\Windows\system32\Hcpcehko.exe120⤵PID:5364
-
C:\Windows\SysWOW64\Hmhhnmao.exeC:\Windows\system32\Hmhhnmao.exe121⤵PID:8088
-
C:\Windows\SysWOW64\Ifplgc32.exeC:\Windows\system32\Ifplgc32.exe122⤵PID:2392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-