Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 23:50
Behavioral task
behavioral1
Sample
a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe
Resource
win10v2004-20240508-en
General
-
Target
a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe
-
Size
1.3MB
-
MD5
a2c8c61361a0125601e2e38f496c0f50
-
SHA1
ffb0940aaea8535b2d2a95c3766f4b9eac68c8b4
-
SHA256
1dde295e00ff8ce509bf99e02933dcb3ea16f2aff091e8756e36487c7f8a1a87
-
SHA512
7a9724081ea8f0b8bc45de487c16f033eb107e0aa594d1cd3c29cee628855cf0c851d99d6eabd91a08f8a55ada2650300a9958da610e3d19a8f18de189f706ca
-
SSDEEP
24576:1vr4B9f01ZmQvrb91v92W9C05wkEPSOdKkrzEoxrC9toC9Dq9onk8:1kB9f0VP91v92W805IPSOdKgzEoxrlQ3
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 28 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjijdadm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bjijdadm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dmoipopd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Djbiicon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dgfjbgmh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Chemfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Chemfl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckdjbh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ckdjbh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgfjbgmh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgmkmecg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dcfdgiid.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dngoibmo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djpmccqq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmoipopd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgdmmgpj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dqlafm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dqlafm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cgmkmecg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbkeib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cbkeib32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcfdgiid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dngoibmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Djpmccqq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dgdmmgpj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djbiicon.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000c000000014454-5.dat family_berbew behavioral1/files/0x000b000000014971-26.dat family_berbew behavioral1/files/0x0007000000014b27-41.dat family_berbew behavioral1/files/0x0007000000015ce1-61.dat family_berbew behavioral1/files/0x0006000000015d07-74.dat family_berbew behavioral1/files/0x0006000000015eaf-161.dat family_berbew behavioral1/files/0x00060000000161e7-188.dat family_berbew behavioral1/files/0x0005000000018778-375.dat family_berbew behavioral1/files/0x00050000000194ad-549.dat family_berbew behavioral1/files/0x000500000001961a-582.dat family_berbew behavioral1/files/0x000500000001c85c-1147.dat family_berbew behavioral1/files/0x000500000001c87c-1201.dat family_berbew behavioral1/files/0x000500000001c8ab-1243.dat family_berbew behavioral1/files/0x000500000001c8d0-1330.dat family_berbew behavioral1/files/0x000400000001cb38-1407.dat family_berbew behavioral1/files/0x000400000001cb6b-1458.dat family_berbew behavioral1/files/0x000400000001cbf1-1588.dat family_berbew behavioral1/files/0x000400000001cc8f-1722.dat family_berbew behavioral1/files/0x000400000001cfc1-1888.dat family_berbew behavioral1/files/0x000400000001d3a0-2094.dat family_berbew behavioral1/files/0x000400000001d548-2166.dat family_berbew behavioral1/files/0x000400000001d6db-2198.dat family_berbew behavioral1/files/0x000400000001d839-2270.dat family_berbew behavioral1/files/0x000400000001d9b0-2366.dat family_berbew behavioral1/files/0x000400000001da0c-2550.dat family_berbew behavioral1/files/0x000400000001da35-2606.dat family_berbew behavioral1/files/0x000400000001da72-2661.dat family_berbew behavioral1/files/0x000400000001daed-2741.dat family_berbew behavioral1/files/0x000400000001dbd4-2845.dat family_berbew behavioral1/files/0x000400000001dc33-2925.dat family_berbew behavioral1/files/0x000400000001dc44-2941.dat family_berbew behavioral1/files/0x000400000001dc4c-2949.dat family_berbew behavioral1/files/0x000400000001dc3b-2933.dat family_berbew behavioral1/files/0x000400000001dc2b-2917.dat family_berbew behavioral1/files/0x000400000001dc24-2909.dat family_berbew behavioral1/files/0x000400000001dc1b-2901.dat family_berbew behavioral1/files/0x000400000001dc11-2893.dat family_berbew behavioral1/files/0x000400000001dc07-2885.dat family_berbew behavioral1/files/0x000400000001dbf8-2877.dat family_berbew behavioral1/files/0x000400000001dbf0-2869.dat family_berbew behavioral1/files/0x000400000001dbe5-2861.dat family_berbew behavioral1/files/0x000400000001dbdd-2853.dat family_berbew behavioral1/files/0x000400000001dbcc-2837.dat family_berbew behavioral1/files/0x000400000001dbc4-2829.dat family_berbew behavioral1/files/0x000400000001dbb8-2821.dat family_berbew behavioral1/files/0x000400000001dbac-2813.dat family_berbew behavioral1/files/0x000400000001db1c-2805.dat family_berbew behavioral1/files/0x000400000001db0e-2797.dat family_berbew behavioral1/files/0x000400000001db07-2789.dat family_berbew behavioral1/files/0x000400000001db03-2781.dat family_berbew behavioral1/files/0x000400000001daff-2773.dat family_berbew behavioral1/files/0x000400000001dafb-2765.dat family_berbew behavioral1/files/0x000400000001daf7-2757.dat family_berbew behavioral1/files/0x000400000001daf3-2749.dat family_berbew behavioral1/files/0x000400000001dadb-2733.dat family_berbew behavioral1/files/0x000400000001dacd-2725.dat family_berbew behavioral1/files/0x000400000001daab-2717.dat family_berbew behavioral1/files/0x000400000001daa1-2709.dat family_berbew behavioral1/files/0x000400000001da96-2701.dat family_berbew behavioral1/files/0x000400000001da8d-2693.dat family_berbew behavioral1/files/0x000400000001da87-2685.dat family_berbew behavioral1/files/0x000400000001da81-2677.dat family_berbew behavioral1/files/0x000400000001da78-2669.dat family_berbew behavioral1/files/0x000400000001da6a-2653.dat family_berbew -
Executes dropped EXE 14 IoCs
pid Process 1636 Bjijdadm.exe 2584 Cgmkmecg.exe 2600 Cbkeib32.exe 2728 Chemfl32.exe 2616 Ckdjbh32.exe 2480 Dngoibmo.exe 3028 Dcfdgiid.exe 2996 Djpmccqq.exe 2040 Dmoipopd.exe 1620 Dgdmmgpj.exe 2720 Djbiicon.exe 2840 Dqlafm32.exe 1896 Dgfjbgmh.exe 1776 Djefobmk.exe -
Loads dropped DLL 28 IoCs
pid Process 756 a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe 756 a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe 1636 Bjijdadm.exe 1636 Bjijdadm.exe 2584 Cgmkmecg.exe 2584 Cgmkmecg.exe 2600 Cbkeib32.exe 2600 Cbkeib32.exe 2728 Chemfl32.exe 2728 Chemfl32.exe 2616 Ckdjbh32.exe 2616 Ckdjbh32.exe 2480 Dngoibmo.exe 2480 Dngoibmo.exe 3028 Dcfdgiid.exe 3028 Dcfdgiid.exe 2996 Djpmccqq.exe 2996 Djpmccqq.exe 2040 Dmoipopd.exe 2040 Dmoipopd.exe 1620 Dgdmmgpj.exe 1620 Dgdmmgpj.exe 2720 Djbiicon.exe 2720 Djbiicon.exe 2840 Dqlafm32.exe 2840 Dqlafm32.exe 1896 Dgfjbgmh.exe 1896 Dgfjbgmh.exe -
Drops file in System32 directory 42 IoCs
description ioc Process File created C:\Windows\SysWOW64\Bjijdadm.exe a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe File opened for modification C:\Windows\SysWOW64\Bjijdadm.exe a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe File created C:\Windows\SysWOW64\Dlcdphdj.dll Chemfl32.exe File created C:\Windows\SysWOW64\Cbolpc32.dll Ckdjbh32.exe File created C:\Windows\SysWOW64\Fkahhbbj.dll Dngoibmo.exe File created C:\Windows\SysWOW64\Dhflmk32.dll Dmoipopd.exe File opened for modification C:\Windows\SysWOW64\Dgfjbgmh.exe Dqlafm32.exe File opened for modification C:\Windows\SysWOW64\Cgmkmecg.exe Bjijdadm.exe File created C:\Windows\SysWOW64\Cbkeib32.exe Cgmkmecg.exe File opened for modification C:\Windows\SysWOW64\Cbkeib32.exe Cgmkmecg.exe File opened for modification C:\Windows\SysWOW64\Chemfl32.exe Cbkeib32.exe File opened for modification C:\Windows\SysWOW64\Dmoipopd.exe Djpmccqq.exe File created C:\Windows\SysWOW64\Dgdmmgpj.exe Dmoipopd.exe File opened for modification C:\Windows\SysWOW64\Djbiicon.exe Dgdmmgpj.exe File opened for modification C:\Windows\SysWOW64\Djefobmk.exe Dgfjbgmh.exe File created C:\Windows\SysWOW64\Alihbgdo.dll a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe File opened for modification C:\Windows\SysWOW64\Dcfdgiid.exe Dngoibmo.exe File created C:\Windows\SysWOW64\Djpmccqq.exe Dcfdgiid.exe File created C:\Windows\SysWOW64\Dmoipopd.exe Djpmccqq.exe File created C:\Windows\SysWOW64\Jfpjfeia.dll Djbiicon.exe File created C:\Windows\SysWOW64\Cgmkmecg.exe Bjijdadm.exe File created C:\Windows\SysWOW64\Dcfdgiid.exe Dngoibmo.exe File created C:\Windows\SysWOW64\Dqlafm32.exe Djbiicon.exe File opened for modification C:\Windows\SysWOW64\Dqlafm32.exe Djbiicon.exe File opened for modification C:\Windows\SysWOW64\Ckdjbh32.exe Chemfl32.exe File created C:\Windows\SysWOW64\Flcnijgi.dll Dgdmmgpj.exe File created C:\Windows\SysWOW64\Ppmcfdad.dll Dgfjbgmh.exe File created C:\Windows\SysWOW64\Mkaggelk.dll Dqlafm32.exe File created C:\Windows\SysWOW64\Accikb32.dll Bjijdadm.exe File created C:\Windows\SysWOW64\Qoflni32.dll Cgmkmecg.exe File created C:\Windows\SysWOW64\Chemfl32.exe Cbkeib32.exe File created C:\Windows\SysWOW64\Klidkobf.dll Dcfdgiid.exe File created C:\Windows\SysWOW64\Naeqjnho.dll Djpmccqq.exe File created C:\Windows\SysWOW64\Djbiicon.exe Dgdmmgpj.exe File created C:\Windows\SysWOW64\Dgfjbgmh.exe Dqlafm32.exe File created C:\Windows\SysWOW64\Djefobmk.exe Dgfjbgmh.exe File created C:\Windows\SysWOW64\Pheafa32.dll Cbkeib32.exe File opened for modification C:\Windows\SysWOW64\Dngoibmo.exe Ckdjbh32.exe File opened for modification C:\Windows\SysWOW64\Dgdmmgpj.exe Dmoipopd.exe File created C:\Windows\SysWOW64\Ckdjbh32.exe Chemfl32.exe File created C:\Windows\SysWOW64\Dngoibmo.exe Ckdjbh32.exe File opened for modification C:\Windows\SysWOW64\Djpmccqq.exe Dcfdgiid.exe -
Program crash 1 IoCs
pid pid_target Process 1404 4800 WerFault.exe -
Modifies registry class 45 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cbkeib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkahhbbj.dll" Dngoibmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klidkobf.dll" Dcfdgiid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dqlafm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Djpmccqq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Djbiicon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Djbiicon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppmcfdad.dll" Dgfjbgmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alihbgdo.dll" a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cgmkmecg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cbkeib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbolpc32.dll" Ckdjbh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dgfjbgmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Accikb32.dll" Bjijdadm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qoflni32.dll" Cgmkmecg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Chemfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dmoipopd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pheafa32.dll" Cbkeib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dgdmmgpj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfpjfeia.dll" Djbiicon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dgdmmgpj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dgfjbgmh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bjijdadm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Chemfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ckdjbh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeqjnho.dll" Djpmccqq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkaggelk.dll" Dqlafm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dqlafm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cgmkmecg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlcdphdj.dll" Chemfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dcfdgiid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dngoibmo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dmoipopd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flcnijgi.dll" Dgdmmgpj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dcfdgiid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Djpmccqq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhflmk32.dll" Dmoipopd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831} a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bjijdadm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ckdjbh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dngoibmo.exe -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 756 wrote to memory of 1636 756 a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe 28 PID 756 wrote to memory of 1636 756 a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe 28 PID 756 wrote to memory of 1636 756 a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe 28 PID 756 wrote to memory of 1636 756 a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe 28 PID 1636 wrote to memory of 2584 1636 Bjijdadm.exe 29 PID 1636 wrote to memory of 2584 1636 Bjijdadm.exe 29 PID 1636 wrote to memory of 2584 1636 Bjijdadm.exe 29 PID 1636 wrote to memory of 2584 1636 Bjijdadm.exe 29 PID 2584 wrote to memory of 2600 2584 Cgmkmecg.exe 30 PID 2584 wrote to memory of 2600 2584 Cgmkmecg.exe 30 PID 2584 wrote to memory of 2600 2584 Cgmkmecg.exe 30 PID 2584 wrote to memory of 2600 2584 Cgmkmecg.exe 30 PID 2600 wrote to memory of 2728 2600 Cbkeib32.exe 31 PID 2600 wrote to memory of 2728 2600 Cbkeib32.exe 31 PID 2600 wrote to memory of 2728 2600 Cbkeib32.exe 31 PID 2600 wrote to memory of 2728 2600 Cbkeib32.exe 31 PID 2728 wrote to memory of 2616 2728 Chemfl32.exe 32 PID 2728 wrote to memory of 2616 2728 Chemfl32.exe 32 PID 2728 wrote to memory of 2616 2728 Chemfl32.exe 32 PID 2728 wrote to memory of 2616 2728 Chemfl32.exe 32 PID 2616 wrote to memory of 2480 2616 Ckdjbh32.exe 33 PID 2616 wrote to memory of 2480 2616 Ckdjbh32.exe 33 PID 2616 wrote to memory of 2480 2616 Ckdjbh32.exe 33 PID 2616 wrote to memory of 2480 2616 Ckdjbh32.exe 33 PID 2480 wrote to memory of 3028 2480 Dngoibmo.exe 34 PID 2480 wrote to memory of 3028 2480 Dngoibmo.exe 34 PID 2480 wrote to memory of 3028 2480 Dngoibmo.exe 34 PID 2480 wrote to memory of 3028 2480 Dngoibmo.exe 34 PID 3028 wrote to memory of 2996 3028 Dcfdgiid.exe 35 PID 3028 wrote to memory of 2996 3028 Dcfdgiid.exe 35 PID 3028 wrote to memory of 2996 3028 Dcfdgiid.exe 35 PID 3028 wrote to memory of 2996 3028 Dcfdgiid.exe 35 PID 2996 wrote to memory of 2040 2996 Djpmccqq.exe 36 PID 2996 wrote to memory of 2040 2996 Djpmccqq.exe 36 PID 2996 wrote to memory of 2040 2996 Djpmccqq.exe 36 PID 2996 wrote to memory of 2040 2996 Djpmccqq.exe 36 PID 2040 wrote to memory of 1620 2040 Dmoipopd.exe 37 PID 2040 wrote to memory of 1620 2040 Dmoipopd.exe 37 PID 2040 wrote to memory of 1620 2040 Dmoipopd.exe 37 PID 2040 wrote to memory of 1620 2040 Dmoipopd.exe 37 PID 1620 wrote to memory of 2720 1620 Dgdmmgpj.exe 38 PID 1620 wrote to memory of 2720 1620 Dgdmmgpj.exe 38 PID 1620 wrote to memory of 2720 1620 Dgdmmgpj.exe 38 PID 1620 wrote to memory of 2720 1620 Dgdmmgpj.exe 38 PID 2720 wrote to memory of 2840 2720 Djbiicon.exe 39 PID 2720 wrote to memory of 2840 2720 Djbiicon.exe 39 PID 2720 wrote to memory of 2840 2720 Djbiicon.exe 39 PID 2720 wrote to memory of 2840 2720 Djbiicon.exe 39 PID 2840 wrote to memory of 1896 2840 Dqlafm32.exe 40 PID 2840 wrote to memory of 1896 2840 Dqlafm32.exe 40 PID 2840 wrote to memory of 1896 2840 Dqlafm32.exe 40 PID 2840 wrote to memory of 1896 2840 Dqlafm32.exe 40 PID 1896 wrote to memory of 1776 1896 Dgfjbgmh.exe 41 PID 1896 wrote to memory of 1776 1896 Dgfjbgmh.exe 41 PID 1896 wrote to memory of 1776 1896 Dgfjbgmh.exe 41 PID 1896 wrote to memory of 1776 1896 Dgfjbgmh.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\a2c8c61361a0125601e2e38f496c0f50_NEIKI.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\Bjijdadm.exeC:\Windows\system32\Bjijdadm.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\Cgmkmecg.exeC:\Windows\system32\Cgmkmecg.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\Cbkeib32.exeC:\Windows\system32\Cbkeib32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\Chemfl32.exeC:\Windows\system32\Chemfl32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\Ckdjbh32.exeC:\Windows\system32\Ckdjbh32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\Dngoibmo.exeC:\Windows\system32\Dngoibmo.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\Dcfdgiid.exeC:\Windows\system32\Dcfdgiid.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\Djpmccqq.exeC:\Windows\system32\Djpmccqq.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\Dmoipopd.exeC:\Windows\system32\Dmoipopd.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\Dgdmmgpj.exeC:\Windows\system32\Dgdmmgpj.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\Djbiicon.exeC:\Windows\system32\Djbiicon.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\Dqlafm32.exeC:\Windows\system32\Dqlafm32.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\Dgfjbgmh.exeC:\Windows\system32\Dgfjbgmh.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\Djefobmk.exeC:\Windows\system32\Djefobmk.exe15⤵
- Executes dropped EXE
PID:1776 -
C:\Windows\SysWOW64\Emcbkn32.exeC:\Windows\system32\Emcbkn32.exe16⤵PID:1804
-
C:\Windows\SysWOW64\Ecmkghcl.exeC:\Windows\system32\Ecmkghcl.exe17⤵PID:2884
-
C:\Windows\SysWOW64\Eflgccbp.exeC:\Windows\system32\Eflgccbp.exe18⤵PID:612
-
C:\Windows\SysWOW64\Emeopn32.exeC:\Windows\system32\Emeopn32.exe19⤵PID:2112
-
C:\Windows\SysWOW64\Ecpgmhai.exeC:\Windows\system32\Ecpgmhai.exe20⤵PID:1692
-
C:\Windows\SysWOW64\Efncicpm.exeC:\Windows\system32\Efncicpm.exe21⤵PID:2108
-
C:\Windows\SysWOW64\Eilpeooq.exeC:\Windows\system32\Eilpeooq.exe22⤵PID:1144
-
C:\Windows\SysWOW64\Ekklaj32.exeC:\Windows\system32\Ekklaj32.exe23⤵PID:684
-
C:\Windows\SysWOW64\Epieghdk.exeC:\Windows\system32\Epieghdk.exe24⤵PID:1504
-
C:\Windows\SysWOW64\Eiaiqn32.exeC:\Windows\system32\Eiaiqn32.exe25⤵PID:2400
-
C:\Windows\SysWOW64\Ealnephf.exeC:\Windows\system32\Ealnephf.exe26⤵PID:312
-
C:\Windows\SysWOW64\Fjdbnf32.exeC:\Windows\system32\Fjdbnf32.exe27⤵PID:1592
-
C:\Windows\SysWOW64\Fhhcgj32.exeC:\Windows\system32\Fhhcgj32.exe28⤵PID:2164
-
C:\Windows\SysWOW64\Faagpp32.exeC:\Windows\system32\Faagpp32.exe29⤵PID:2596
-
C:\Windows\SysWOW64\Ffnphf32.exeC:\Windows\system32\Ffnphf32.exe30⤵PID:2580
-
C:\Windows\SysWOW64\Fmhheqje.exeC:\Windows\system32\Fmhheqje.exe31⤵PID:2516
-
C:\Windows\SysWOW64\Fpfdalii.exeC:\Windows\system32\Fpfdalii.exe32⤵PID:2680
-
C:\Windows\SysWOW64\Ffpmnf32.exeC:\Windows\system32\Ffpmnf32.exe33⤵PID:2652
-
C:\Windows\SysWOW64\Fmjejphb.exeC:\Windows\system32\Fmjejphb.exe34⤵PID:2640
-
C:\Windows\SysWOW64\Fphafl32.exeC:\Windows\system32\Fphafl32.exe35⤵PID:2328
-
C:\Windows\SysWOW64\Ffbicfoc.exeC:\Windows\system32\Ffbicfoc.exe36⤵PID:1288
-
C:\Windows\SysWOW64\Fiaeoang.exeC:\Windows\system32\Fiaeoang.exe37⤵PID:2692
-
C:\Windows\SysWOW64\Gpknlk32.exeC:\Windows\system32\Gpknlk32.exe38⤵PID:1192
-
C:\Windows\SysWOW64\Gbijhg32.exeC:\Windows\system32\Gbijhg32.exe39⤵PID:412
-
C:\Windows\SysWOW64\Gicbeald.exeC:\Windows\system32\Gicbeald.exe40⤵PID:1556
-
C:\Windows\SysWOW64\Gpmjak32.exeC:\Windows\system32\Gpmjak32.exe41⤵PID:2744
-
C:\Windows\SysWOW64\Gbkgnfbd.exeC:\Windows\system32\Gbkgnfbd.exe42⤵PID:2304
-
C:\Windows\SysWOW64\Gieojq32.exeC:\Windows\system32\Gieojq32.exe43⤵PID:1808
-
C:\Windows\SysWOW64\Gobgcg32.exeC:\Windows\system32\Gobgcg32.exe44⤵PID:2532
-
C:\Windows\SysWOW64\Gelppaof.exeC:\Windows\system32\Gelppaof.exe45⤵PID:2604
-
C:\Windows\SysWOW64\Glfhll32.exeC:\Windows\system32\Glfhll32.exe46⤵PID:2468
-
C:\Windows\SysWOW64\Goddhg32.exeC:\Windows\system32\Goddhg32.exe47⤵PID:2268
-
C:\Windows\SysWOW64\Geolea32.exeC:\Windows\system32\Geolea32.exe48⤵PID:1540
-
C:\Windows\SysWOW64\Ggpimica.exeC:\Windows\system32\Ggpimica.exe49⤵PID:1324
-
C:\Windows\SysWOW64\Gogangdc.exeC:\Windows\system32\Gogangdc.exe50⤵PID:1100
-
C:\Windows\SysWOW64\Gddifnbk.exeC:\Windows\system32\Gddifnbk.exe51⤵PID:1812
-
C:\Windows\SysWOW64\Hknach32.exeC:\Windows\system32\Hknach32.exe52⤵PID:336
-
C:\Windows\SysWOW64\Hpkjko32.exeC:\Windows\system32\Hpkjko32.exe53⤵PID:2432
-
C:\Windows\SysWOW64\Hgdbhi32.exeC:\Windows\system32\Hgdbhi32.exe54⤵PID:3024
-
C:\Windows\SysWOW64\Hnojdcfi.exeC:\Windows\system32\Hnojdcfi.exe55⤵PID:1240
-
C:\Windows\SysWOW64\Hdhbam32.exeC:\Windows\system32\Hdhbam32.exe56⤵PID:2456
-
C:\Windows\SysWOW64\Hejoiedd.exeC:\Windows\system32\Hejoiedd.exe57⤵PID:1248
-
C:\Windows\SysWOW64\Hnagjbdf.exeC:\Windows\system32\Hnagjbdf.exe58⤵PID:2960
-
C:\Windows\SysWOW64\Hpocfncj.exeC:\Windows\system32\Hpocfncj.exe59⤵PID:500
-
C:\Windows\SysWOW64\Hgilchkf.exeC:\Windows\system32\Hgilchkf.exe60⤵PID:1664
-
C:\Windows\SysWOW64\Hjhhocjj.exeC:\Windows\system32\Hjhhocjj.exe61⤵PID:1040
-
C:\Windows\SysWOW64\Hodpgjha.exeC:\Windows\system32\Hodpgjha.exe62⤵PID:2888
-
C:\Windows\SysWOW64\Hacmcfge.exeC:\Windows\system32\Hacmcfge.exe63⤵PID:2872
-
C:\Windows\SysWOW64\Hlhaqogk.exeC:\Windows\system32\Hlhaqogk.exe64⤵PID:3020
-
C:\Windows\SysWOW64\Icbimi32.exeC:\Windows\system32\Icbimi32.exe65⤵PID:1996
-
C:\Windows\SysWOW64\Idceea32.exeC:\Windows\system32\Idceea32.exe66⤵PID:2300
-
C:\Windows\SysWOW64\Iknnbklc.exeC:\Windows\system32\Iknnbklc.exe67⤵PID:1724
-
C:\Windows\SysWOW64\Inljnfkg.exeC:\Windows\system32\Inljnfkg.exe68⤵PID:2408
-
C:\Windows\SysWOW64\Idfbkq32.exeC:\Windows\system32\Idfbkq32.exe69⤵PID:2792
-
C:\Windows\SysWOW64\Igdogl32.exeC:\Windows\system32\Igdogl32.exe70⤵PID:2964
-
C:\Windows\SysWOW64\Iajcde32.exeC:\Windows\system32\Iajcde32.exe71⤵PID:1744
-
C:\Windows\SysWOW64\Idhopq32.exeC:\Windows\system32\Idhopq32.exe72⤵PID:904
-
C:\Windows\SysWOW64\Ikbgmj32.exeC:\Windows\system32\Ikbgmj32.exe73⤵PID:1768
-
C:\Windows\SysWOW64\Iblpjdpk.exeC:\Windows\system32\Iblpjdpk.exe74⤵PID:3116
-
C:\Windows\SysWOW64\Icmlam32.exeC:\Windows\system32\Icmlam32.exe75⤵PID:3184
-
C:\Windows\SysWOW64\Ijgdngmf.exeC:\Windows\system32\Ijgdngmf.exe76⤵PID:3248
-
C:\Windows\SysWOW64\Iqalka32.exeC:\Windows\system32\Iqalka32.exe77⤵PID:3312
-
C:\Windows\SysWOW64\Igkdgk32.exeC:\Windows\system32\Igkdgk32.exe78⤵PID:3376
-
C:\Windows\SysWOW64\Jnemdecl.exeC:\Windows\system32\Jnemdecl.exe79⤵PID:3436
-
C:\Windows\SysWOW64\Jofiln32.exeC:\Windows\system32\Jofiln32.exe80⤵PID:3504
-
C:\Windows\SysWOW64\Jgnamk32.exeC:\Windows\system32\Jgnamk32.exe81⤵PID:3552
-
C:\Windows\SysWOW64\Jjlnif32.exeC:\Windows\system32\Jjlnif32.exe82⤵PID:3624
-
C:\Windows\SysWOW64\Jqfffqpm.exeC:\Windows\system32\Jqfffqpm.exe83⤵PID:3688
-
C:\Windows\SysWOW64\Jfcnngnd.exeC:\Windows\system32\Jfcnngnd.exe84⤵PID:3748
-
C:\Windows\SysWOW64\Jiakjb32.exeC:\Windows\system32\Jiakjb32.exe85⤵PID:3820
-
C:\Windows\SysWOW64\Jokcgmee.exeC:\Windows\system32\Jokcgmee.exe86⤵PID:3884
-
C:\Windows\SysWOW64\Jfekcg32.exeC:\Windows\system32\Jfekcg32.exe87⤵PID:3948
-
C:\Windows\SysWOW64\Jnqphi32.exeC:\Windows\system32\Jnqphi32.exe88⤵PID:4008
-
C:\Windows\SysWOW64\Jifdebic.exeC:\Windows\system32\Jifdebic.exe89⤵PID:4068
-
C:\Windows\SysWOW64\Jkdpanhg.exeC:\Windows\system32\Jkdpanhg.exe90⤵PID:2336
-
C:\Windows\SysWOW64\Kaaijdgn.exeC:\Windows\system32\Kaaijdgn.exe91⤵PID:2324
-
C:\Windows\SysWOW64\Kihqkagp.exeC:\Windows\system32\Kihqkagp.exe92⤵PID:2340
-
C:\Windows\SysWOW64\Kjjmbj32.exeC:\Windows\system32\Kjjmbj32.exe93⤵PID:1756
-
C:\Windows\SysWOW64\Kbqecg32.exeC:\Windows\system32\Kbqecg32.exe94⤵PID:3112
-
C:\Windows\SysWOW64\Keoapb32.exeC:\Windows\system32\Keoapb32.exe95⤵PID:3180
-
C:\Windows\SysWOW64\Kgnnln32.exeC:\Windows\system32\Kgnnln32.exe96⤵PID:3220
-
C:\Windows\SysWOW64\Kjljhjkl.exeC:\Windows\system32\Kjljhjkl.exe97⤵PID:3292
-
C:\Windows\SysWOW64\Kmjfdejp.exeC:\Windows\system32\Kmjfdejp.exe98⤵PID:3384
-
C:\Windows\SysWOW64\Keanebkb.exeC:\Windows\system32\Keanebkb.exe99⤵PID:3400
-
C:\Windows\SysWOW64\Kgpjanje.exeC:\Windows\system32\Kgpjanje.exe100⤵PID:3368
-
C:\Windows\SysWOW64\Knjbnh32.exeC:\Windows\system32\Knjbnh32.exe101⤵PID:3536
-
C:\Windows\SysWOW64\Kahojc32.exeC:\Windows\system32\Kahojc32.exe102⤵PID:3496
-
C:\Windows\SysWOW64\Kgbggnhc.exeC:\Windows\system32\Kgbggnhc.exe103⤵PID:3668
-
C:\Windows\SysWOW64\Kjqccigf.exeC:\Windows\system32\Kjqccigf.exe104⤵PID:3592
-
C:\Windows\SysWOW64\Kmopod32.exeC:\Windows\system32\Kmopod32.exe105⤵PID:3712
-
C:\Windows\SysWOW64\Kpmlkp32.exeC:\Windows\system32\Kpmlkp32.exe106⤵PID:3744
-
C:\Windows\SysWOW64\Kfgdhjmk.exeC:\Windows\system32\Kfgdhjmk.exe107⤵PID:3804
-
C:\Windows\SysWOW64\Kifpdelo.exeC:\Windows\system32\Kifpdelo.exe108⤵PID:3860
-
C:\Windows\SysWOW64\Lldlqakb.exeC:\Windows\system32\Lldlqakb.exe109⤵PID:3880
-
C:\Windows\SysWOW64\Lckdanld.exeC:\Windows\system32\Lckdanld.exe110⤵PID:3968
-
C:\Windows\SysWOW64\Lfjqnjkh.exeC:\Windows\system32\Lfjqnjkh.exe111⤵PID:4000
-
C:\Windows\SysWOW64\Lihmjejl.exeC:\Windows\system32\Lihmjejl.exe112⤵PID:2528
-
C:\Windows\SysWOW64\Llfifq32.exeC:\Windows\system32\Llfifq32.exe113⤵PID:888
-
C:\Windows\SysWOW64\Lbqabkql.exeC:\Windows\system32\Lbqabkql.exe114⤵PID:2980
-
C:\Windows\SysWOW64\Lijjoe32.exeC:\Windows\system32\Lijjoe32.exe115⤵PID:1792
-
C:\Windows\SysWOW64\Lliflp32.exeC:\Windows\system32\Lliflp32.exe116⤵PID:1824
-
C:\Windows\SysWOW64\Lbcnhjnj.exeC:\Windows\system32\Lbcnhjnj.exe117⤵PID:884
-
C:\Windows\SysWOW64\Limfed32.exeC:\Windows\system32\Limfed32.exe118⤵PID:3152
-
C:\Windows\SysWOW64\Lkncmmle.exeC:\Windows\system32\Lkncmmle.exe119⤵PID:3280
-
C:\Windows\SysWOW64\Lbeknj32.exeC:\Windows\system32\Lbeknj32.exe120⤵PID:3240
-
C:\Windows\SysWOW64\Ldfgebbe.exeC:\Windows\system32\Ldfgebbe.exe121⤵PID:1484
-
C:\Windows\SysWOW64\Lkppbl32.exeC:\Windows\system32\Lkppbl32.exe122⤵PID:3532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-