Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 05:55
Static task
static1
Behavioral task
behavioral1
Sample
d36d42975b5c4be14a27067e3ef6205c3e089e7533c94d948cea09a6a7619554.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d36d42975b5c4be14a27067e3ef6205c3e089e7533c94d948cea09a6a7619554.exe
Resource
win10v2004-20221111-en
General
-
Target
d36d42975b5c4be14a27067e3ef6205c3e089e7533c94d948cea09a6a7619554.exe
-
Size
78KB
-
MD5
156b28bb1522fc80cbaefcc618d3b7c0
-
SHA1
b671ca5b9688832828eec0e37ee1e976b4c5cc0e
-
SHA256
d36d42975b5c4be14a27067e3ef6205c3e089e7533c94d948cea09a6a7619554
-
SHA512
efff3e7505b2fae72d29f8ac79b508628a58c91511035239ba905f9e10cc9259bf94fb69107015be20864978df7ae2f435deed4764a2d3316ca4e33d90a61230
-
SSDEEP
1536:6E1hwzGx+4aS063TkYo2x6r59aPc8n2CST4+7QlKTCaWe96+gz:91sGx+n0YYox59R0+7QU6J+gz
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 900 ayzzfyaat.exe 764 jinzlwchn.exe 396 bfleoybah.exe 1356 gguzedhoo.exe 1376 vdchqvqap.exe 1896 fnrseywcc.exe 960 kpznuwcib.exe 1700 uzpxpzicw.exe 996 tznnbcdpe.exe 1752 dxtbhchuk.exe 980 axtfxzyqo.exe 1348 gsctpwrvj.exe 1812 agjeqhwed.exe 1052 vlzozsbnp.exe 1208 qzgravzvj.exe 1044 ekbglyarq.exe 1460 zyqrmjgzc.exe 1872 teybvmlix.exe 628 rjejuhgyj.exe 844 ezzmchlfk.exe 904 bxgmvorml.exe 1992 dzyuqwiby.exe 268 klfhfqrvs.exe 1068 ugxrulztg.exe 1716 jdgrhlbey.exe 2008 cotjgijlf.exe 1568 wqxhmhhrn.exe 1724 vqvkgxhvg.exe 764 tkimcfdjg.exe 1308 oxxplqasa.exe 1968 ioqmpxedh.exe 1016 wzepdfpir.exe 1728 taodhibre.exe 1700 gyjfpqhyf.exe 2080 yqudowktg.exe 2112 qnlizxrmz.exe 2144 fyhdbtudn.exe 2176 vdpdnldxg.exe 2208 quinqoujb.exe 2240 fyqndgeut.exe 2272 aeyydrjdn.exe 2308 pbgyqjkwg.exe 2392 hiilvclta.exe 2484 rlxnifsvn.exe 2552 enddtjwwa.exe 2588 zphbzqvki.exe 2620 oftiyzyzb.exe 2652 yiittdebo.exe 2684 qwhywemuh.exe 2716 adlvodtup.exe 2748 srkbzfsvj.exe 2784 nuoyxlzbi.exe 2816 dqoykdavj.exe 2852 sklltrcmp.exe 2884 iaetajgaj.exe 2916 aovydkncc.exe 2968 vqzwjrlij.exe 3020 knhwvjubk.exe 2360 cujjscoxe.exe 2448 cnktupyok.exe 2496 rghowcafr.exe 2540 mpzehseqx.exe 2632 emyjstlrq.exe 2760 qgeydgqte.exe -
Looks for VMWare Tools registry key 2 TTPs 64 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools vdchqvqap.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools ugxrulztg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools vtlrcnfth.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools zbimybqeg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools obydjuvns.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools rxqhdngus.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools twcnuuguf.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools dzyuqwiby.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools dqoykdavj.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools uzpxpzicw.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools yqudowktg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools zphbzqvki.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools mpzehseqx.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools cpjeanpiz.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools zvnljjgba.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools lgyzfonpz.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools psrpdgxli.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools ygqcmqxvp.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools rjejuhgyj.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools giysnqexs.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools uinrfhyfi.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools cnktupyok.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools rghowcafr.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools vzwveqshd.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools ayzzfyaat.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools teybvmlix.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools ezzmchlfk.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools jdgrhlbey.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools taodhibre.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools qnlizxrmz.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools zjrcblyty.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools fnrseywcc.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools knhwvjubk.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools emyjstlrq.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools sxumhxtwt.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools godspvvih.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools dupepquit.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools cfyhdpoqn.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools hhpuohemb.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools tqlpqclkq.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools cotjgijlf.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools ibdkpceij.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools rziecrgqz.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools tltkynmvl.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools iaetajgaj.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools dygdvuwzl.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools ysllvneez.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools owbktzakq.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools gkapebalk.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools jinzlwchn.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools ltmjejvby.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools iujptnzmh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools nezkjkfso.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools pbrvdmqrw.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools jggfsfswe.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools nxkaotdyl.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools jdyrsgvam.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools trdqfigqz.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools iydszbodd.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools pjmvbpmgy.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools tznnbcdpe.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools vqvkgxhvg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools gyjfpqhyf.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools dxtbhchuk.exe -
Loads dropped DLL 64 IoCs
pid Process 2036 d36d42975b5c4be14a27067e3ef6205c3e089e7533c94d948cea09a6a7619554.exe 900 ayzzfyaat.exe 900 ayzzfyaat.exe 900 ayzzfyaat.exe 900 ayzzfyaat.exe 764 jinzlwchn.exe 764 jinzlwchn.exe 764 jinzlwchn.exe 764 jinzlwchn.exe 396 bfleoybah.exe 396 bfleoybah.exe 396 bfleoybah.exe 396 bfleoybah.exe 1356 gguzedhoo.exe 1356 gguzedhoo.exe 1356 gguzedhoo.exe 1356 gguzedhoo.exe 1376 vdchqvqap.exe 1376 vdchqvqap.exe 1376 vdchqvqap.exe 1376 vdchqvqap.exe 1896 fnrseywcc.exe 1896 fnrseywcc.exe 1896 fnrseywcc.exe 1896 fnrseywcc.exe 960 kpznuwcib.exe 960 kpznuwcib.exe 960 kpznuwcib.exe 960 kpznuwcib.exe 1700 uzpxpzicw.exe 1700 uzpxpzicw.exe 1700 uzpxpzicw.exe 1700 uzpxpzicw.exe 996 tznnbcdpe.exe 996 tznnbcdpe.exe 996 tznnbcdpe.exe 996 tznnbcdpe.exe 1752 dxtbhchuk.exe 1752 dxtbhchuk.exe 1752 dxtbhchuk.exe 1752 dxtbhchuk.exe 980 axtfxzyqo.exe 980 axtfxzyqo.exe 980 axtfxzyqo.exe 980 axtfxzyqo.exe 1348 gsctpwrvj.exe 1348 gsctpwrvj.exe 1348 gsctpwrvj.exe 1348 gsctpwrvj.exe 1812 agjeqhwed.exe 1812 agjeqhwed.exe 1812 agjeqhwed.exe 1812 agjeqhwed.exe 1052 vlzozsbnp.exe 1052 vlzozsbnp.exe 1052 vlzozsbnp.exe 1052 vlzozsbnp.exe 1208 qzgravzvj.exe 1208 qzgravzvj.exe 1208 qzgravzvj.exe 1208 qzgravzvj.exe 1044 ekbglyarq.exe 1044 ekbglyarq.exe 1044 ekbglyarq.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\smwfxyqcn.exe zbimybqeg.exe File opened for modification C:\Windows\SysWOW64\dmywjcezh.exe ihimarzqn.exe File created C:\Windows\SysWOW64\ygqcmqxvp.exe lekubdslj.exe File created C:\Windows\SysWOW64\nezkjkfso.exe pcepfcjeg.exe File opened for modification C:\Windows\SysWOW64\sxumhxtwt.exe uehjkpwjs.exe File opened for modification C:\Windows\SysWOW64\nezkjkfso.exe pcepfcjeg.exe File opened for modification C:\Windows\SysWOW64\dupepquit.exe lgyzfonpz.exe File opened for modification C:\Windows\SysWOW64\psrpdgxli.exe uinrfhyfi.exe File opened for modification C:\Windows\SysWOW64\zvgzyjdnu.exe hhpuohemb.exe File created C:\Windows\SysWOW64\lgifcshbm.exe qxpqqcdqg.exe File created C:\Windows\SysWOW64\bxgmvorml.exe ezzmchlfk.exe File created C:\Windows\SysWOW64\jdgrhlbey.exe ugxrulztg.exe File created C:\Windows\SysWOW64\wzepdfpir.exe ioqmpxedh.exe File created C:\Windows\SysWOW64\khgxepvaq.exe pbrvdmqrw.exe File opened for modification C:\Windows\SysWOW64\dkgalzedr.exe iwqpkwzuf.exe File opened for modification C:\Windows\SysWOW64\dxtbhchuk.exe tznnbcdpe.exe File created C:\Windows\SysWOW64\cnktupyok.exe cujjscoxe.exe File created C:\Windows\SysWOW64\avfdwtjfm.exe giysnqexs.exe File opened for modification C:\Windows\SysWOW64\ypcuhjdnh.exe dmywjcezh.exe File created C:\Windows\SysWOW64\cotjgijlf.exe jdgrhlbey.exe File created C:\Windows\SysWOW64\smwfxyqcn.exe zbimybqeg.exe File opened for modification C:\Windows\SysWOW64\dbounvkzn.exe rziecrgqz.exe File created C:\Windows\SysWOW64\cpjeanpiz.exe icbtzckzf.exe File opened for modification C:\Windows\SysWOW64\zvnljjgba.exe ysllvneez.exe File opened for modification C:\Windows\SysWOW64\uinrfhyfi.exe cuwmufrep.exe File opened for modification C:\Windows\SysWOW64\tkimcfdjg.exe vqvkgxhvg.exe File created C:\Windows\SysWOW64\zvnljjgba.exe ysllvneez.exe File opened for modification C:\Windows\SysWOW64\ajhuwpgna.exe godspvvih.exe File created C:\Windows\SysWOW64\xvezoeoiv.exe chxpntrab.exe File opened for modification C:\Windows\SysWOW64\cfyhdpoqn.exe niyhrxfev.exe File opened for modification C:\Windows\SysWOW64\pnqhcgnqv.exe smwfxyqcn.exe File opened for modification C:\Windows\SysWOW64\quinqoujb.exe vdpdnldxg.exe File opened for modification C:\Windows\SysWOW64\qwhywemuh.exe yiittdebo.exe File created C:\Windows\SysWOW64\dygdvuwzl.exe jggfsfswe.exe File created C:\Windows\SysWOW64\ihimarzqn.exe qsrhyqapu.exe File opened for modification C:\Windows\SysWOW64\niyhrxfev.exe ypcuhjdnh.exe File created C:\Windows\SysWOW64\cfyhdpoqn.exe niyhrxfev.exe File opened for modification C:\Windows\SysWOW64\vmbuiiiuh.exe cfyhdpoqn.exe File created C:\Windows\SysWOW64\ioqmpxedh.exe oxxplqasa.exe File opened for modification C:\Windows\SysWOW64\iydszbodd.exe pnpzreofw.exe File opened for modification C:\Windows\SysWOW64\owbktzakq.exe ygqcmqxvp.exe File created C:\Windows\SysWOW64\kttrrysxm.exe sxumhxtwt.exe File created C:\Windows\SysWOW64\alicxafhp.exe gybsopagd.exe File opened for modification C:\Windows\SysWOW64\nrzxlqitp.exe sdsvcflkd.exe File created C:\Windows\SysWOW64\iwqpkwzuf.exe blsknuqil.exe File opened for modification C:\Windows\SysWOW64\oftiyzyzb.exe zphbzqvki.exe File opened for modification C:\Windows\SysWOW64\zyqrmjgzc.exe ekbglyarq.exe File opened for modification C:\Windows\SysWOW64\vqzwjrlij.exe aovydkncc.exe File opened for modification C:\Windows\SysWOW64\alicxafhp.exe gybsopagd.exe File opened for modification C:\Windows\SysWOW64\gguzedhoo.exe bfleoybah.exe File created C:\Windows\SysWOW64\ysllvneez.exe avfdwtjfm.exe File created C:\Windows\SysWOW64\twcnuuguf.exe ymcxjfcrz.exe File opened for modification C:\Windows\SysWOW64\godspvvih.exe iujptnzmh.exe File created C:\Windows\SysWOW64\ikalowjhf.exe nxkaotdyl.exe File created C:\Windows\SysWOW64\giysnqexs.exe ikalowjhf.exe File created C:\Windows\SysWOW64\wuaubgbhf.exe jdyrsgvam.exe File created C:\Windows\SysWOW64\uinrfhyfi.exe cuwmufrep.exe File created C:\Windows\SysWOW64\lxmpkvhxi.exe zvgzyjdnu.exe File created C:\Windows\SysWOW64\pnpzreofw.exe gkapebalk.exe File opened for modification C:\Windows\SysWOW64\cnktupyok.exe cujjscoxe.exe File opened for modification C:\Windows\SysWOW64\dzyuqwiby.exe bxgmvorml.exe File created C:\Windows\SysWOW64\ibdkpceij.exe nyynrwgcj.exe File opened for modification C:\Windows\SysWOW64\fyhdbtudn.exe qnlizxrmz.exe File opened for modification C:\Windows\SysWOW64\iujptnzmh.exe kttrrysxm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2036 wrote to memory of 900 2036 d36d42975b5c4be14a27067e3ef6205c3e089e7533c94d948cea09a6a7619554.exe 28 PID 2036 wrote to memory of 900 2036 d36d42975b5c4be14a27067e3ef6205c3e089e7533c94d948cea09a6a7619554.exe 28 PID 2036 wrote to memory of 900 2036 d36d42975b5c4be14a27067e3ef6205c3e089e7533c94d948cea09a6a7619554.exe 28 PID 2036 wrote to memory of 900 2036 d36d42975b5c4be14a27067e3ef6205c3e089e7533c94d948cea09a6a7619554.exe 28 PID 2036 wrote to memory of 900 2036 d36d42975b5c4be14a27067e3ef6205c3e089e7533c94d948cea09a6a7619554.exe 28 PID 2036 wrote to memory of 900 2036 d36d42975b5c4be14a27067e3ef6205c3e089e7533c94d948cea09a6a7619554.exe 28 PID 2036 wrote to memory of 900 2036 d36d42975b5c4be14a27067e3ef6205c3e089e7533c94d948cea09a6a7619554.exe 28 PID 900 wrote to memory of 764 900 ayzzfyaat.exe 29 PID 900 wrote to memory of 764 900 ayzzfyaat.exe 29 PID 900 wrote to memory of 764 900 ayzzfyaat.exe 29 PID 900 wrote to memory of 764 900 ayzzfyaat.exe 29 PID 900 wrote to memory of 764 900 ayzzfyaat.exe 29 PID 900 wrote to memory of 764 900 ayzzfyaat.exe 29 PID 900 wrote to memory of 764 900 ayzzfyaat.exe 29 PID 764 wrote to memory of 396 764 jinzlwchn.exe 30 PID 764 wrote to memory of 396 764 jinzlwchn.exe 30 PID 764 wrote to memory of 396 764 jinzlwchn.exe 30 PID 764 wrote to memory of 396 764 jinzlwchn.exe 30 PID 764 wrote to memory of 396 764 jinzlwchn.exe 30 PID 764 wrote to memory of 396 764 jinzlwchn.exe 30 PID 764 wrote to memory of 396 764 jinzlwchn.exe 30 PID 396 wrote to memory of 1356 396 bfleoybah.exe 31 PID 396 wrote to memory of 1356 396 bfleoybah.exe 31 PID 396 wrote to memory of 1356 396 bfleoybah.exe 31 PID 396 wrote to memory of 1356 396 bfleoybah.exe 31 PID 396 wrote to memory of 1356 396 bfleoybah.exe 31 PID 396 wrote to memory of 1356 396 bfleoybah.exe 31 PID 396 wrote to memory of 1356 396 bfleoybah.exe 31 PID 1356 wrote to memory of 1376 1356 gguzedhoo.exe 32 PID 1356 wrote to memory of 1376 1356 gguzedhoo.exe 32 PID 1356 wrote to memory of 1376 1356 gguzedhoo.exe 32 PID 1356 wrote to memory of 1376 1356 gguzedhoo.exe 32 PID 1356 wrote to memory of 1376 1356 gguzedhoo.exe 32 PID 1356 wrote to memory of 1376 1356 gguzedhoo.exe 32 PID 1356 wrote to memory of 1376 1356 gguzedhoo.exe 32 PID 1376 wrote to memory of 1896 1376 vdchqvqap.exe 33 PID 1376 wrote to memory of 1896 1376 vdchqvqap.exe 33 PID 1376 wrote to memory of 1896 1376 vdchqvqap.exe 33 PID 1376 wrote to memory of 1896 1376 vdchqvqap.exe 33 PID 1376 wrote to memory of 1896 1376 vdchqvqap.exe 33 PID 1376 wrote to memory of 1896 1376 vdchqvqap.exe 33 PID 1376 wrote to memory of 1896 1376 vdchqvqap.exe 33 PID 1896 wrote to memory of 960 1896 fnrseywcc.exe 34 PID 1896 wrote to memory of 960 1896 fnrseywcc.exe 34 PID 1896 wrote to memory of 960 1896 fnrseywcc.exe 34 PID 1896 wrote to memory of 960 1896 fnrseywcc.exe 34 PID 1896 wrote to memory of 960 1896 fnrseywcc.exe 34 PID 1896 wrote to memory of 960 1896 fnrseywcc.exe 34 PID 1896 wrote to memory of 960 1896 fnrseywcc.exe 34 PID 960 wrote to memory of 1700 960 kpznuwcib.exe 35 PID 960 wrote to memory of 1700 960 kpznuwcib.exe 35 PID 960 wrote to memory of 1700 960 kpznuwcib.exe 35 PID 960 wrote to memory of 1700 960 kpznuwcib.exe 35 PID 960 wrote to memory of 1700 960 kpznuwcib.exe 35 PID 960 wrote to memory of 1700 960 kpznuwcib.exe 35 PID 960 wrote to memory of 1700 960 kpznuwcib.exe 35 PID 1700 wrote to memory of 996 1700 uzpxpzicw.exe 36 PID 1700 wrote to memory of 996 1700 uzpxpzicw.exe 36 PID 1700 wrote to memory of 996 1700 uzpxpzicw.exe 36 PID 1700 wrote to memory of 996 1700 uzpxpzicw.exe 36 PID 1700 wrote to memory of 996 1700 uzpxpzicw.exe 36 PID 1700 wrote to memory of 996 1700 uzpxpzicw.exe 36 PID 1700 wrote to memory of 996 1700 uzpxpzicw.exe 36 PID 996 wrote to memory of 1752 996 tznnbcdpe.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\d36d42975b5c4be14a27067e3ef6205c3e089e7533c94d948cea09a6a7619554.exe"C:\Users\Admin\AppData\Local\Temp\d36d42975b5c4be14a27067e3ef6205c3e089e7533c94d948cea09a6a7619554.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\ayzzfyaat.exeC:\Windows\system32\ayzzfyaat.exe2⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\jinzlwchn.exeC:\Windows\system32\jinzlwchn.exe3⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\bfleoybah.exeC:\Windows\system32\bfleoybah.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\gguzedhoo.exeC:\Windows\system32\gguzedhoo.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\vdchqvqap.exeC:\Windows\system32\vdchqvqap.exe6⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\fnrseywcc.exeC:\Windows\system32\fnrseywcc.exe7⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\kpznuwcib.exeC:\Windows\system32\kpznuwcib.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\uzpxpzicw.exeC:\Windows\system32\uzpxpzicw.exe9⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\tznnbcdpe.exeC:\Windows\system32\tznnbcdpe.exe10⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\dxtbhchuk.exeC:\Windows\system32\dxtbhchuk.exe11⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Loads dropped DLL
PID:1752 -
C:\Windows\SysWOW64\axtfxzyqo.exeC:\Windows\system32\axtfxzyqo.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Windows\SysWOW64\gsctpwrvj.exeC:\Windows\system32\gsctpwrvj.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Windows\SysWOW64\agjeqhwed.exeC:\Windows\system32\agjeqhwed.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Windows\SysWOW64\vlzozsbnp.exeC:\Windows\system32\vlzozsbnp.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Windows\SysWOW64\qzgravzvj.exeC:\Windows\system32\qzgravzvj.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Windows\SysWOW64\ekbglyarq.exeC:\Windows\system32\ekbglyarq.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1044 -
C:\Windows\SysWOW64\zyqrmjgzc.exeC:\Windows\system32\zyqrmjgzc.exe18⤵
- Executes dropped EXE
PID:1460 -
C:\Windows\SysWOW64\teybvmlix.exeC:\Windows\system32\teybvmlix.exe19⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
PID:1872 -
C:\Windows\SysWOW64\rjejuhgyj.exeC:\Windows\system32\rjejuhgyj.exe20⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
PID:628 -
C:\Windows\SysWOW64\ezzmchlfk.exeC:\Windows\system32\ezzmchlfk.exe21⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Drops file in System32 directory
PID:844 -
C:\Windows\SysWOW64\bxgmvorml.exeC:\Windows\system32\bxgmvorml.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:904 -
C:\Windows\SysWOW64\dzyuqwiby.exeC:\Windows\system32\dzyuqwiby.exe23⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
PID:1992 -
C:\Windows\SysWOW64\klfhfqrvs.exeC:\Windows\system32\klfhfqrvs.exe24⤵
- Executes dropped EXE
PID:268 -
C:\Windows\SysWOW64\ugxrulztg.exeC:\Windows\system32\ugxrulztg.exe25⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Drops file in System32 directory
PID:1068 -
C:\Windows\SysWOW64\jdgrhlbey.exeC:\Windows\system32\jdgrhlbey.exe26⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Drops file in System32 directory
PID:1716 -
C:\Windows\SysWOW64\cotjgijlf.exeC:\Windows\system32\cotjgijlf.exe27⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
PID:2008 -
C:\Windows\SysWOW64\wqxhmhhrn.exeC:\Windows\system32\wqxhmhhrn.exe28⤵
- Executes dropped EXE
PID:1568 -
C:\Windows\SysWOW64\vqvkgxhvg.exeC:\Windows\system32\vqvkgxhvg.exe29⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Drops file in System32 directory
PID:1724 -
C:\Windows\SysWOW64\tkimcfdjg.exeC:\Windows\system32\tkimcfdjg.exe30⤵
- Executes dropped EXE
PID:764 -
C:\Windows\SysWOW64\oxxplqasa.exeC:\Windows\system32\oxxplqasa.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1308 -
C:\Windows\SysWOW64\ioqmpxedh.exeC:\Windows\system32\ioqmpxedh.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1968 -
C:\Windows\SysWOW64\wzepdfpir.exeC:\Windows\system32\wzepdfpir.exe33⤵
- Executes dropped EXE
PID:1016 -
C:\Windows\SysWOW64\taodhibre.exeC:\Windows\system32\taodhibre.exe34⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
PID:1728 -
C:\Windows\SysWOW64\gyjfpqhyf.exeC:\Windows\system32\gyjfpqhyf.exe35⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
PID:1700 -
C:\Windows\SysWOW64\yqudowktg.exeC:\Windows\system32\yqudowktg.exe36⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
PID:2080 -
C:\Windows\SysWOW64\qnlizxrmz.exeC:\Windows\system32\qnlizxrmz.exe37⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Drops file in System32 directory
PID:2112 -
C:\Windows\SysWOW64\fyhdbtudn.exeC:\Windows\system32\fyhdbtudn.exe38⤵
- Executes dropped EXE
PID:2144 -
C:\Windows\SysWOW64\vdpdnldxg.exeC:\Windows\system32\vdpdnldxg.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2176 -
C:\Windows\SysWOW64\quinqoujb.exeC:\Windows\system32\quinqoujb.exe40⤵
- Executes dropped EXE
PID:2208 -
C:\Windows\SysWOW64\fyqndgeut.exeC:\Windows\system32\fyqndgeut.exe41⤵
- Executes dropped EXE
PID:2240 -
C:\Windows\SysWOW64\aeyydrjdn.exeC:\Windows\system32\aeyydrjdn.exe42⤵
- Executes dropped EXE
PID:2272 -
C:\Windows\SysWOW64\pbgyqjkwg.exeC:\Windows\system32\pbgyqjkwg.exe43⤵
- Executes dropped EXE
PID:2308 -
C:\Windows\SysWOW64\hiilvclta.exeC:\Windows\system32\hiilvclta.exe44⤵
- Executes dropped EXE
PID:2392 -
C:\Windows\SysWOW64\rlxnifsvn.exeC:\Windows\system32\rlxnifsvn.exe45⤵
- Executes dropped EXE
PID:2484 -
C:\Windows\SysWOW64\enddtjwwa.exeC:\Windows\system32\enddtjwwa.exe46⤵
- Executes dropped EXE
PID:2552 -
C:\Windows\SysWOW64\zphbzqvki.exeC:\Windows\system32\zphbzqvki.exe47⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Drops file in System32 directory
PID:2588 -
C:\Windows\SysWOW64\oftiyzyzb.exeC:\Windows\system32\oftiyzyzb.exe48⤵
- Executes dropped EXE
PID:2620 -
C:\Windows\SysWOW64\yiittdebo.exeC:\Windows\system32\yiittdebo.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2652 -
C:\Windows\SysWOW64\qwhywemuh.exeC:\Windows\system32\qwhywemuh.exe50⤵
- Executes dropped EXE
PID:2684 -
C:\Windows\SysWOW64\adlvodtup.exeC:\Windows\system32\adlvodtup.exe51⤵
- Executes dropped EXE
PID:2716 -
C:\Windows\SysWOW64\srkbzfsvj.exeC:\Windows\system32\srkbzfsvj.exe52⤵
- Executes dropped EXE
PID:2748 -
C:\Windows\SysWOW64\nuoyxlzbi.exeC:\Windows\system32\nuoyxlzbi.exe53⤵
- Executes dropped EXE
PID:2784 -
C:\Windows\SysWOW64\dqoykdavj.exeC:\Windows\system32\dqoykdavj.exe54⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
PID:2816 -
C:\Windows\SysWOW64\sklltrcmp.exeC:\Windows\system32\sklltrcmp.exe55⤵
- Executes dropped EXE
PID:2852 -
C:\Windows\SysWOW64\iaetajgaj.exeC:\Windows\system32\iaetajgaj.exe56⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
PID:2884 -
C:\Windows\SysWOW64\aovydkncc.exeC:\Windows\system32\aovydkncc.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2916 -
C:\Windows\SysWOW64\vqzwjrlij.exeC:\Windows\system32\vqzwjrlij.exe58⤵
- Executes dropped EXE
PID:2968 -
C:\Windows\SysWOW64\knhwvjubk.exeC:\Windows\system32\knhwvjubk.exe59⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
PID:3020 -
C:\Windows\SysWOW64\cujjscoxe.exeC:\Windows\system32\cujjscoxe.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2360 -
C:\Windows\SysWOW64\cnktupyok.exeC:\Windows\system32\cnktupyok.exe61⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
PID:2448 -
C:\Windows\SysWOW64\rghowcafr.exeC:\Windows\system32\rghowcafr.exe62⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
PID:2496 -
C:\Windows\SysWOW64\mpzehseqx.exeC:\Windows\system32\mpzehseqx.exe63⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
PID:2540 -
C:\Windows\SysWOW64\emyjstlrq.exeC:\Windows\system32\emyjstlrq.exe64⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
PID:2632 -
C:\Windows\SysWOW64\qgeydgqte.exeC:\Windows\system32\qgeydgqte.exe65⤵
- Executes dropped EXE
PID:2760 -
C:\Windows\SysWOW64\ltmjejvby.exeC:\Windows\system32\ltmjejvby.exe66⤵
- Looks for VMWare Tools registry key
PID:2896 -
C:\Windows\SysWOW64\jngeazrxy.exeC:\Windows\system32\jngeazrxy.exe67⤵PID:2980
-
C:\Windows\SysWOW64\icbtzckzf.exeC:\Windows\system32\icbtzckzf.exe68⤵
- Drops file in System32 directory
PID:3028 -
C:\Windows\SysWOW64\cpjeanpiz.exeC:\Windows\system32\cpjeanpiz.exe69⤵
- Looks for VMWare Tools registry key
PID:3060 -
C:\Windows\SysWOW64\amhmzakym.exeC:\Windows\system32\amhmzakym.exe70⤵PID:2152
-
C:\Windows\SysWOW64\uehjkpwjs.exeC:\Windows\system32\uehjkpwjs.exe71⤵
- Drops file in System32 directory
PID:1168 -
C:\Windows\SysWOW64\sxumhxtwt.exeC:\Windows\system32\sxumhxtwt.exe72⤵
- Looks for VMWare Tools registry key
- Drops file in System32 directory
PID:2304 -
C:\Windows\SysWOW64\kttrrysxm.exeC:\Windows\system32\kttrrysxm.exe73⤵
- Drops file in System32 directory
PID:2320 -
C:\Windows\SysWOW64\iujptnzmh.exeC:\Windows\system32\iujptnzmh.exe74⤵
- Looks for VMWare Tools registry key
- Drops file in System32 directory
PID:968 -
C:\Windows\SysWOW64\godspvvih.exeC:\Windows\system32\godspvvih.exe75⤵
- Looks for VMWare Tools registry key
- Drops file in System32 directory
PID:568 -
C:\Windows\SysWOW64\ajhuwpgna.exeC:\Windows\system32\ajhuwpgna.exe76⤵PID:1300
-
C:\Windows\SysWOW64\vtlrcnfth.exeC:\Windows\system32\vtlrcnfth.exe77⤵
- Looks for VMWare Tools registry key
PID:524 -
C:\Windows\SysWOW64\pcepfcjeg.exeC:\Windows\system32\pcepfcjeg.exe78⤵
- Drops file in System32 directory
PID:1144 -
C:\Windows\SysWOW64\nezkjkfso.exeC:\Windows\system32\nezkjkfso.exe79⤵
- Looks for VMWare Tools registry key
PID:1212 -
C:\Windows\SysWOW64\ijgukvcaa.exeC:\Windows\system32\ijgukvcaa.exe80⤵PID:436
-
C:\Windows\SysWOW64\zbimybqeg.exeC:\Windows\system32\zbimybqeg.exe81⤵
- Looks for VMWare Tools registry key
- Drops file in System32 directory
PID:2412 -
C:\Windows\SysWOW64\smwfxyqcn.exeC:\Windows\system32\smwfxyqcn.exe82⤵
- Drops file in System32 directory
PID:1884 -
C:\Windows\SysWOW64\pnqhcgnqv.exeC:\Windows\system32\pnqhcgnqv.exe83⤵PID:2428
-
C:\Windows\SysWOW64\ktykcrkzh.exeC:\Windows\system32\ktykcrkzh.exe84⤵PID:472
-
C:\Windows\SysWOW64\chxpntrab.exeC:\Windows\system32\chxpntrab.exe85⤵
- Drops file in System32 directory
PID:764 -
C:\Windows\SysWOW64\xvezoeoiv.exeC:\Windows\system32\xvezoeoiv.exe86⤵PID:1596
-
C:\Windows\SysWOW64\bthkvnvyj.exeC:\Windows\system32\bthkvnvyj.exe87⤵PID:580
-
C:\Windows\SysWOW64\vzwveqshd.exeC:\Windows\system32\vzwveqshd.exe88⤵
- Looks for VMWare Tools registry key
PID:1292 -
C:\Windows\SysWOW64\nyynrwgcj.exeC:\Windows\system32\nyynrwgcj.exe89⤵
- Drops file in System32 directory
PID:1700 -
C:\Windows\SysWOW64\ibdkpceij.exeC:\Windows\system32\ibdkpceij.exe90⤵
- Looks for VMWare Tools registry key
PID:2080 -
C:\Windows\SysWOW64\gybsopagd.exeC:\Windows\system32\gybsopagd.exe91⤵
- Drops file in System32 directory
PID:2112 -
C:\Windows\SysWOW64\alicxafhp.exeC:\Windows\system32\alicxafhp.exe92⤵PID:2144
-
C:\Windows\SysWOW64\sdsvcflkd.exeC:\Windows\system32\sdsvcflkd.exe93⤵
- Drops file in System32 directory
PID:2176 -
C:\Windows\SysWOW64\nrzxlqitp.exeC:\Windows\system32\nrzxlqitp.exe94⤵PID:2208
-
C:\Windows\SysWOW64\itdvjpozx.exeC:\Windows\system32\itdvjpozx.exe95⤵PID:2288
-
C:\Windows\SysWOW64\ahcaurnaq.exeC:\Windows\system32\ahcaurnaq.exe96⤵PID:2312
-
C:\Windows\SysWOW64\pbrvdmqrw.exeC:\Windows\system32\pbrvdmqrw.exe97⤵
- Looks for VMWare Tools registry key
- Drops file in System32 directory
PID:2512 -
C:\Windows\SysWOW64\khgxepvaq.exeC:\Windows\system32\khgxepvaq.exe98⤵PID:2624
-
C:\Windows\SysWOW64\obydjuvns.exeC:\Windows\system32\obydjuvns.exe99⤵
- Looks for VMWare Tools registry key
PID:2656 -
C:\Windows\SysWOW64\jggfsfswe.exeC:\Windows\system32\jggfsfswe.exe100⤵
- Looks for VMWare Tools registry key
- Drops file in System32 directory
PID:2688 -
C:\Windows\SysWOW64\dygdvuwzl.exeC:\Windows\system32\dygdvuwzl.exe101⤵
- Looks for VMWare Tools registry key
PID:2720 -
C:\Windows\SysWOW64\brtfzcsul.exeC:\Windows\system32\brtfzcsul.exe102⤵PID:2776
-
C:\Windows\SysWOW64\trdqfigqz.exeC:\Windows\system32\trdqfigqz.exe103⤵
- Looks for VMWare Tools registry key
PID:2812 -
C:\Windows\SysWOW64\nxkaotdyl.exeC:\Windows\system32\nxkaotdyl.exe104⤵
- Looks for VMWare Tools registry key
- Drops file in System32 directory
PID:2844 -
C:\Windows\SysWOW64\ikalowjhf.exeC:\Windows\system32\ikalowjhf.exe105⤵
- Drops file in System32 directory
PID:288 -
C:\Windows\SysWOW64\giysnqexs.exeC:\Windows\system32\giysnqexs.exe106⤵
- Looks for VMWare Tools registry key
- Drops file in System32 directory
PID:1792 -
C:\Windows\SysWOW64\avfdwtjfm.exeC:\Windows\system32\avfdwtjfm.exe107⤵
- Drops file in System32 directory
PID:2988 -
C:\Windows\SysWOW64\ysllvneez.exeC:\Windows\system32\ysllvneez.exe108⤵
- Looks for VMWare Tools registry key
- Drops file in System32 directory
PID:2876 -
C:\Windows\SysWOW64\zvnljjgba.exeC:\Windows\system32\zvnljjgba.exe109⤵
- Looks for VMWare Tools registry key
PID:2864 -
C:\Windows\SysWOW64\eqejzwrss.exeC:\Windows\system32\eqejzwrss.exe110⤵PID:3052
-
C:\Windows\SysWOW64\jdyrsgvam.exeC:\Windows\system32\jdyrsgvam.exe111⤵
- Looks for VMWare Tools registry key
- Drops file in System32 directory
PID:2948 -
C:\Windows\SysWOW64\wuaubgbhf.exeC:\Windows\system32\wuaubgbhf.exe112⤵PID:2532
-
C:\Windows\SysWOW64\rziecrgqz.exeC:\Windows\system32\rziecrgqz.exe113⤵
- Looks for VMWare Tools registry key
- Drops file in System32 directory
PID:2660 -
C:\Windows\SysWOW64\dbounvkzn.exeC:\Windows\system32\dbounvkzn.exe114⤵PID:2408
-
C:\Windows\SysWOW64\wjqzswevh.exeC:\Windows\system32\wjqzswevh.exe115⤵PID:2920
-
C:\Windows\SysWOW64\lgyzfonpz.exeC:\Windows\system32\lgyzfonpz.exe116⤵
- Looks for VMWare Tools registry key
- Drops file in System32 directory
PID:1684 -
C:\Windows\SysWOW64\dupepquit.exeC:\Windows\system32\dupepquit.exe117⤵
- Looks for VMWare Tools registry key
PID:2036 -
C:\Windows\SysWOW64\ywtcnotwa.exeC:\Windows\system32\ywtcnotwa.exe118⤵PID:1560
-
C:\Windows\SysWOW64\qsrhyqapu.exeC:\Windows\system32\qsrhyqapu.exe119⤵
- Drops file in System32 directory
PID:1304 -
C:\Windows\SysWOW64\ihimarzqn.exeC:\Windows\system32\ihimarzqn.exe120⤵
- Drops file in System32 directory
PID:1064 -
C:\Windows\SysWOW64\dmywjcezh.exeC:\Windows\system32\dmywjcezh.exe121⤵
- Drops file in System32 directory
PID:1756 -
C:\Windows\SysWOW64\ypcuhjdnh.exeC:\Windows\system32\ypcuhjdnh.exe122⤵
- Drops file in System32 directory
PID:2064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-