Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2023, 21:19
Behavioral task
behavioral1
Sample
NEAS.4f825599209486f81d4a71ddf721da00.exe
Resource
win7-20231020-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.4f825599209486f81d4a71ddf721da00.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
NEAS.4f825599209486f81d4a71ddf721da00.exe
-
Size
378KB
-
MD5
4f825599209486f81d4a71ddf721da00
-
SHA1
c93ab89e715f982e9f28a7eb23541ea6b5457919
-
SHA256
26b13fa12562a4d4ad0d9d8bacadf9b32b45da77887070d91b4ec4ac15ece82b
-
SHA512
087f7a9e88cda7ddd9b895ce5ad8de1c0b8f4fdedb4631777d21c2b37af9a94f455a19ea14364b5a0367a325bed768e78a5c74e6b76aa8e475bc06270d1261c1
-
SSDEEP
6144:DVcnTy6re9EseYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GT9:2euseYr75lTefkY660fIaDZkY660f2lO
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mmjlkb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fblldn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gffhbljh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Leipbg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gfnnel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hpgkeodo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgjicb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bhnidi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mgoboake.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcndlf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bkeppeii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dmjole32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aaenbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kapclned.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gfkbnk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jncobabm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmggpekm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lqkgli32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Peahpa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qmepkb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pogpcghp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phaabm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Chiipg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Domdcpib.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ficgkico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jdjfmjhm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fllkjd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Neqoidmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gpqjaanf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kjafha32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cffcilob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bhgcdjje.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Coadgacp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ckhelb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afbgkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hbflnl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipjenn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kckgff32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad NEAS.4f825599209486f81d4a71ddf721da00.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmpnppap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ejoogm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ompmie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ebifha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ficgkico.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ibojgikg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Omcjne32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hidpbf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpofbobf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jcbdph32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aehghn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dibmfb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cihcen32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oeclockl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pahiebeq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppkopail.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gqohge32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gqhknd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jiphebml.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahdgnj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knfeoobh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Neiiiecg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oegejc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pacojc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hibape32.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0008000000022e02-6.dat family_berbew behavioral2/files/0x0008000000022e02-8.dat family_berbew behavioral2/files/0x0006000000022e21-14.dat family_berbew behavioral2/files/0x0006000000022e21-16.dat family_berbew behavioral2/files/0x0006000000022e23-22.dat family_berbew behavioral2/files/0x0006000000022e23-24.dat family_berbew behavioral2/files/0x0006000000022e25-30.dat family_berbew behavioral2/files/0x0006000000022e25-31.dat family_berbew behavioral2/files/0x0006000000022e28-38.dat family_berbew behavioral2/files/0x0006000000022e28-39.dat family_berbew behavioral2/files/0x0006000000022e2a-46.dat family_berbew behavioral2/files/0x0006000000022e2a-48.dat family_berbew behavioral2/files/0x0006000000022e2c-49.dat family_berbew behavioral2/files/0x0006000000022e2c-54.dat family_berbew behavioral2/files/0x0006000000022e2e-64.dat family_berbew behavioral2/files/0x0006000000022e2e-62.dat family_berbew behavioral2/files/0x0006000000022e30-70.dat family_berbew behavioral2/files/0x0006000000022e30-72.dat family_berbew behavioral2/files/0x0006000000022e2c-56.dat family_berbew behavioral2/files/0x0006000000022e32-80.dat family_berbew behavioral2/files/0x0006000000022e32-78.dat family_berbew behavioral2/files/0x0006000000022e32-73.dat family_berbew behavioral2/files/0x0006000000022e35-86.dat family_berbew behavioral2/files/0x0006000000022e35-88.dat family_berbew behavioral2/files/0x0006000000022e38-94.dat family_berbew behavioral2/files/0x0006000000022e38-95.dat family_berbew behavioral2/files/0x0006000000022e3b-102.dat family_berbew behavioral2/files/0x0006000000022e3b-103.dat family_berbew behavioral2/files/0x0006000000022e3d-111.dat family_berbew behavioral2/files/0x0006000000022e3d-110.dat family_berbew behavioral2/files/0x0006000000022e3f-118.dat family_berbew behavioral2/files/0x0006000000022e3f-120.dat family_berbew behavioral2/files/0x0006000000022e47-126.dat family_berbew behavioral2/files/0x0006000000022e47-127.dat family_berbew behavioral2/files/0x0006000000022e4b-134.dat family_berbew behavioral2/files/0x0006000000022e4d-142.dat family_berbew behavioral2/files/0x0006000000022e4d-143.dat family_berbew behavioral2/files/0x0006000000022e4b-135.dat family_berbew behavioral2/files/0x0006000000022e4f-150.dat family_berbew behavioral2/files/0x0006000000022e4f-152.dat family_berbew behavioral2/files/0x0006000000022e52-158.dat family_berbew behavioral2/files/0x0006000000022e52-159.dat family_berbew behavioral2/files/0x0006000000022e59-165.dat family_berbew behavioral2/files/0x0006000000022e5f-186.dat family_berbew behavioral2/files/0x0006000000022e5f-185.dat family_berbew behavioral2/files/0x0006000000022e59-166.dat family_berbew behavioral2/files/0x0006000000022e62-194.dat family_berbew behavioral2/files/0x0006000000022e62-193.dat family_berbew behavioral2/files/0x0007000000022e66-203.dat family_berbew behavioral2/files/0x0007000000022e66-205.dat family_berbew behavioral2/files/0x0006000000022e6e-211.dat family_berbew behavioral2/files/0x0006000000022e6e-212.dat family_berbew behavioral2/files/0x0007000000022e5b-224.dat family_berbew behavioral2/files/0x0007000000022e5b-223.dat family_berbew behavioral2/files/0x0007000000022e5d-231.dat family_berbew behavioral2/files/0x0007000000022e5d-232.dat family_berbew behavioral2/files/0x0008000000022e61-242.dat family_berbew behavioral2/files/0x0008000000022e61-240.dat family_berbew behavioral2/files/0x0008000000022e6d-248.dat family_berbew behavioral2/files/0x0008000000022e6d-250.dat family_berbew behavioral2/files/0x0007000000022e57-257.dat family_berbew behavioral2/files/0x0007000000022e57-256.dat family_berbew behavioral2/files/0x0006000000022e71-259.dat family_berbew behavioral2/files/0x0006000000022e71-264.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2752 Ppjbmc32.exe 4564 Pdhkcb32.exe 1360 Pnmopk32.exe 2576 Ppolhcnm.exe 2212 Pnplfj32.exe 4388 Pdmdnadc.exe 2920 Qodeajbg.exe 2144 Ahmjjoig.exe 2168 Aaenbd32.exe 1952 Afbgkl32.exe 4840 Adfgdpmi.exe 2076 Aajhndkb.exe 4140 Mddkbbfg.exe 4800 Mdghhb32.exe 952 Nlnpio32.exe 1844 Mmjlkb32.exe 3516 Nmlhaa32.exe 2568 Nkpijfgf.exe 2812 Nefmgogl.exe 4864 Oeamcmmo.exe 1584 Phkaqqoi.exe 4772 Pklkbl32.exe 2800 Qnopjfgi.exe 2476 Bjfjee32.exe 4932 Opjponbf.exe 696 Jnmbjnlm.exe 2044 Aikijjon.exe 2320 Ikbphn32.exe 3416 Ppkopail.exe 1448 Ahdpea32.exe 4492 Algbfo32.exe 3376 Cikkga32.exe 4400 Cibagpgg.exe 3176 Damflb32.exe 1876 Djgkbp32.exe 1708 Dabpgbpm.exe 4696 Dcalae32.exe 5052 Dhndil32.exe 1060 Djnaco32.exe 1484 Ebifha32.exe 216 Elojej32.exe 972 Fokbbcmo.exe 3996 Ficgkico.exe 2208 Fomohc32.exe 4832 Fblldn32.exe 652 Foplnb32.exe 4140 Ffjdjmpf.exe 4048 Gqohge32.exe 3732 Gbqeonfj.exe 4808 Gijmlh32.exe 4032 Gfnnel32.exe 2668 Gpgbna32.exe 4676 Gbenjm32.exe 4036 Gqhknd32.exe 2904 Hidpbf32.exe 180 Hcidoo32.exe 3316 Hameic32.exe 2108 Hmdend32.exe 944 Hikfbeod.exe 4040 Hbcklkee.exe 4812 Hpgkeodo.exe 2336 Hcbgen32.exe 3784 Imklncch.exe 2948 Icedkn32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Faadgoom.dll Podcnh32.exe File created C:\Windows\SysWOW64\Ljkdbnkl.dll Cffcilob.exe File created C:\Windows\SysWOW64\Khmmnpoh.dll Hameic32.exe File created C:\Windows\SysWOW64\Cllbll32.dll Jmihpa32.exe File created C:\Windows\SysWOW64\Obphmnpb.dll Pklkmo32.exe File created C:\Windows\SysWOW64\Cfgjcb32.exe Ckaffjbg.exe File opened for modification C:\Windows\SysWOW64\Kqmkjk32.exe Kjccna32.exe File created C:\Windows\SysWOW64\Nabfcegi.exe Nlfnkoia.exe File created C:\Windows\SysWOW64\Phkaqqoi.exe Oeamcmmo.exe File created C:\Windows\SysWOW64\Djgkbp32.exe Damflb32.exe File opened for modification C:\Windows\SysWOW64\Lcjchd32.exe Lqkgli32.exe File created C:\Windows\SysWOW64\Omcjne32.exe Oegejc32.exe File created C:\Windows\SysWOW64\Occmjg32.dll Pnmopk32.exe File created C:\Windows\SysWOW64\Dbfpagon.dll Ahmjjoig.exe File created C:\Windows\SysWOW64\Mkmghc32.dll Hmdend32.exe File created C:\Windows\SysWOW64\Bgdjha32.dll Blhpjnbe.exe File created C:\Windows\SysWOW64\Ckdcli32.exe Cfgjcb32.exe File created C:\Windows\SysWOW64\Jlhoildi.dll Kqmkjk32.exe File created C:\Windows\SysWOW64\Ebpjjk32.exe Doanno32.exe File created C:\Windows\SysWOW64\Ppolhcnm.exe Pnmopk32.exe File opened for modification C:\Windows\SysWOW64\Ccednl32.exe Kapclned.exe File opened for modification C:\Windows\SysWOW64\Hibape32.exe Hchickeo.exe File created C:\Windows\SysWOW64\Clnopg32.exe Bahkcn32.exe File created C:\Windows\SysWOW64\Dnbadlnj.exe Dmqdmd32.exe File created C:\Windows\SysWOW64\Ekdafekm.dll Dmqdmd32.exe File opened for modification C:\Windows\SysWOW64\Gqohge32.exe Ffjdjmpf.exe File created C:\Windows\SysWOW64\Pmoijcje.exe Phaabm32.exe File opened for modification C:\Windows\SysWOW64\Bhpfjh32.exe Bafnmnjn.exe File created C:\Windows\SysWOW64\Hbhbfh32.dll Bojogb32.exe File created C:\Windows\SysWOW64\Lcjjghoe.dll Bahkcn32.exe File created C:\Windows\SysWOW64\Gjfbnpkg.dll Damflb32.exe File created C:\Windows\SysWOW64\Fokbbcmo.exe Elojej32.exe File created C:\Windows\SysWOW64\Kgkooeen.exe Kanffogf.exe File opened for modification C:\Windows\SysWOW64\Clnopg32.exe Bahkcn32.exe File created C:\Windows\SysWOW64\Apgmfh32.dll Bhqmdoef.exe File opened for modification C:\Windows\SysWOW64\Dpbdiehi.exe Djelqo32.exe File created C:\Windows\SysWOW64\Bkeppeii.exe Bhgcdjje.exe File opened for modification C:\Windows\SysWOW64\Pdmdnadc.exe Pnplfj32.exe File opened for modification C:\Windows\SysWOW64\Bhgcdjje.exe Aehghn32.exe File opened for modification C:\Windows\SysWOW64\Bkeppeii.exe Bhgcdjje.exe File created C:\Windows\SysWOW64\Jljhqhhm.dll Fmbdnhme.exe File created C:\Windows\SysWOW64\Mgjicb32.exe Mqpqghgn.exe File opened for modification C:\Windows\SysWOW64\Ponfdf32.exe Phdngljk.exe File opened for modification C:\Windows\SysWOW64\Ahmjjoig.exe Qodeajbg.exe File opened for modification C:\Windows\SysWOW64\Hchickeo.exe Hmlpkd32.exe File opened for modification C:\Windows\SysWOW64\Kqbdej32.exe Kjhlipla.exe File created C:\Windows\SysWOW64\Eignjamf.dll Aaenbd32.exe File opened for modification C:\Windows\SysWOW64\Gfkbnk32.exe Gpqjaanf.exe File opened for modification C:\Windows\SysWOW64\Kjhlipla.exe Kcndlf32.exe File opened for modification C:\Windows\SysWOW64\Jnmbjnlm.exe Opjponbf.exe File created C:\Windows\SysWOW64\Nmighf32.exe Nhmopp32.exe File created C:\Windows\SysWOW64\Njdnmp32.dll Nelfnd32.exe File created C:\Windows\SysWOW64\Kmiifb32.dll Coadgacp.exe File created C:\Windows\SysWOW64\Eammlc32.dll Qoecol32.exe File created C:\Windows\SysWOW64\Iioabi32.dll Knfeoobh.exe File opened for modification C:\Windows\SysWOW64\Dmnhgdjo.exe Ddgpfgil.exe File created C:\Windows\SysWOW64\Ohhbfe32.dll Mddkbbfg.exe File created C:\Windows\SysWOW64\Oipfgk32.dll Jgqdal32.exe File created C:\Windows\SysWOW64\Iecbdhad.dll Emenhcdf.exe File created C:\Windows\SysWOW64\Dddjmo32.dll Pnplfj32.exe File opened for modification C:\Windows\SysWOW64\Afbgkl32.exe Aaenbd32.exe File created C:\Windows\SysWOW64\Bmijpchc.dll Adfgdpmi.exe File created C:\Windows\SysWOW64\Aomipkic.exe Akoqjl32.exe File created C:\Windows\SysWOW64\Nmmjai32.dll Anjifbpg.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oipfgk32.dll" Jgqdal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odbemgba.dll" Aomipkic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljkdbnkl.dll" Cffcilob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ikbphn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dibmfb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Blhpjnbe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Peahpa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcejnpck.dll" Gqhknd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dgqqnjea.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kjafha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bhgcdjje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gpgbna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hikfbeod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akipao32.dll" Jdcplkoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifcfc32.dll" Bfpdcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ahdgnj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ahdpea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jiphebml.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Emfebjgb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mqpqghgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ojgjhicl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dabpgbpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kkdnjd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aaflag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghfebfje.dll" Kckgff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Niiqlj32.dll" Mgjicb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Algbfo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jgkdkg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nkpijfgf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ijcjgcni.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lqikfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Neglceej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ckhelb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pcjioknl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fbajlo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oeamcmmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Menimfnd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ojgjhicl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hpofbobf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Phdngljk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dbicjlji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjjfae32.dll" Gmpqof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acahge32.dll" Ompmie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onogbe32.dll" Phaabm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Canblg32.dll" Aajoapdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Blgiphni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Domdcpib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Foplnb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cilmpmki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cfqmjajc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nabfcegi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoibfj32.dll" Ponfdf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gpgbna32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bjpjoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dnbadlnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdigqnmd.dll" Ahnghafl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ngehoqdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jgigfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kqmkjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laheqjdd.dll" Qhigbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nlnpio32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Phkaqqoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jdcplkoe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gdjilphb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1576 wrote to memory of 2752 1576 NEAS.4f825599209486f81d4a71ddf721da00.exe 88 PID 1576 wrote to memory of 2752 1576 NEAS.4f825599209486f81d4a71ddf721da00.exe 88 PID 1576 wrote to memory of 2752 1576 NEAS.4f825599209486f81d4a71ddf721da00.exe 88 PID 2752 wrote to memory of 4564 2752 Ppjbmc32.exe 89 PID 2752 wrote to memory of 4564 2752 Ppjbmc32.exe 89 PID 2752 wrote to memory of 4564 2752 Ppjbmc32.exe 89 PID 4564 wrote to memory of 1360 4564 Pdhkcb32.exe 90 PID 4564 wrote to memory of 1360 4564 Pdhkcb32.exe 90 PID 4564 wrote to memory of 1360 4564 Pdhkcb32.exe 90 PID 1360 wrote to memory of 2576 1360 Pnmopk32.exe 91 PID 1360 wrote to memory of 2576 1360 Pnmopk32.exe 91 PID 1360 wrote to memory of 2576 1360 Pnmopk32.exe 91 PID 2576 wrote to memory of 2212 2576 Ppolhcnm.exe 92 PID 2576 wrote to memory of 2212 2576 Ppolhcnm.exe 92 PID 2576 wrote to memory of 2212 2576 Ppolhcnm.exe 92 PID 2212 wrote to memory of 4388 2212 Pnplfj32.exe 93 PID 2212 wrote to memory of 4388 2212 Pnplfj32.exe 93 PID 2212 wrote to memory of 4388 2212 Pnplfj32.exe 93 PID 4388 wrote to memory of 2920 4388 Pdmdnadc.exe 94 PID 4388 wrote to memory of 2920 4388 Pdmdnadc.exe 94 PID 4388 wrote to memory of 2920 4388 Pdmdnadc.exe 94 PID 2920 wrote to memory of 2144 2920 Qodeajbg.exe 95 PID 2920 wrote to memory of 2144 2920 Qodeajbg.exe 95 PID 2920 wrote to memory of 2144 2920 Qodeajbg.exe 95 PID 2144 wrote to memory of 2168 2144 Ahmjjoig.exe 96 PID 2144 wrote to memory of 2168 2144 Ahmjjoig.exe 96 PID 2144 wrote to memory of 2168 2144 Ahmjjoig.exe 96 PID 2168 wrote to memory of 1952 2168 Aaenbd32.exe 97 PID 2168 wrote to memory of 1952 2168 Aaenbd32.exe 97 PID 2168 wrote to memory of 1952 2168 Aaenbd32.exe 97 PID 1952 wrote to memory of 4840 1952 Afbgkl32.exe 98 PID 1952 wrote to memory of 4840 1952 Afbgkl32.exe 98 PID 1952 wrote to memory of 4840 1952 Afbgkl32.exe 98 PID 4840 wrote to memory of 2076 4840 Adfgdpmi.exe 99 PID 4840 wrote to memory of 2076 4840 Adfgdpmi.exe 99 PID 4840 wrote to memory of 2076 4840 Adfgdpmi.exe 99 PID 2076 wrote to memory of 4140 2076 Aajhndkb.exe 100 PID 2076 wrote to memory of 4140 2076 Aajhndkb.exe 100 PID 2076 wrote to memory of 4140 2076 Aajhndkb.exe 100 PID 4140 wrote to memory of 4800 4140 Mddkbbfg.exe 101 PID 4140 wrote to memory of 4800 4140 Mddkbbfg.exe 101 PID 4140 wrote to memory of 4800 4140 Mddkbbfg.exe 101 PID 4800 wrote to memory of 952 4800 Mdghhb32.exe 104 PID 4800 wrote to memory of 952 4800 Mdghhb32.exe 104 PID 4800 wrote to memory of 952 4800 Mdghhb32.exe 104 PID 952 wrote to memory of 1844 952 Nlnpio32.exe 105 PID 952 wrote to memory of 1844 952 Nlnpio32.exe 105 PID 952 wrote to memory of 1844 952 Nlnpio32.exe 105 PID 1844 wrote to memory of 3516 1844 Mmjlkb32.exe 106 PID 1844 wrote to memory of 3516 1844 Mmjlkb32.exe 106 PID 1844 wrote to memory of 3516 1844 Mmjlkb32.exe 106 PID 3516 wrote to memory of 2568 3516 Nmlhaa32.exe 108 PID 3516 wrote to memory of 2568 3516 Nmlhaa32.exe 108 PID 3516 wrote to memory of 2568 3516 Nmlhaa32.exe 108 PID 2568 wrote to memory of 2812 2568 Nkpijfgf.exe 109 PID 2568 wrote to memory of 2812 2568 Nkpijfgf.exe 109 PID 2568 wrote to memory of 2812 2568 Nkpijfgf.exe 109 PID 2812 wrote to memory of 4864 2812 Nefmgogl.exe 110 PID 2812 wrote to memory of 4864 2812 Nefmgogl.exe 110 PID 2812 wrote to memory of 4864 2812 Nefmgogl.exe 110 PID 4864 wrote to memory of 1584 4864 Oeamcmmo.exe 111 PID 4864 wrote to memory of 1584 4864 Oeamcmmo.exe 111 PID 4864 wrote to memory of 1584 4864 Oeamcmmo.exe 111 PID 1584 wrote to memory of 4772 1584 Phkaqqoi.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.4f825599209486f81d4a71ddf721da00.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.4f825599209486f81d4a71ddf721da00.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\Ppjbmc32.exeC:\Windows\system32\Ppjbmc32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\Pdhkcb32.exeC:\Windows\system32\Pdhkcb32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\Pnmopk32.exeC:\Windows\system32\Pnmopk32.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\Ppolhcnm.exeC:\Windows\system32\Ppolhcnm.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\Pnplfj32.exeC:\Windows\system32\Pnplfj32.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\Pdmdnadc.exeC:\Windows\system32\Pdmdnadc.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\Qodeajbg.exeC:\Windows\system32\Qodeajbg.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\Ahmjjoig.exeC:\Windows\system32\Ahmjjoig.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\Aaenbd32.exeC:\Windows\system32\Aaenbd32.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\Afbgkl32.exeC:\Windows\system32\Afbgkl32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\Adfgdpmi.exeC:\Windows\system32\Adfgdpmi.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\Aajhndkb.exeC:\Windows\system32\Aajhndkb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\Mddkbbfg.exeC:\Windows\system32\Mddkbbfg.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\Mdghhb32.exeC:\Windows\system32\Mdghhb32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\Nlnpio32.exeC:\Windows\system32\Nlnpio32.exe16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\Mmjlkb32.exeC:\Windows\system32\Mmjlkb32.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\Nmlhaa32.exeC:\Windows\system32\Nmlhaa32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\Nkpijfgf.exeC:\Windows\system32\Nkpijfgf.exe19⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\Nefmgogl.exeC:\Windows\system32\Nefmgogl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\Oeamcmmo.exeC:\Windows\system32\Oeamcmmo.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\Phkaqqoi.exeC:\Windows\system32\Phkaqqoi.exe22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\Pklkbl32.exeC:\Windows\system32\Pklkbl32.exe23⤵
- Executes dropped EXE
PID:4772 -
C:\Windows\SysWOW64\Qnopjfgi.exeC:\Windows\system32\Qnopjfgi.exe24⤵
- Executes dropped EXE
PID:2800 -
C:\Windows\SysWOW64\Bjfjee32.exeC:\Windows\system32\Bjfjee32.exe25⤵
- Executes dropped EXE
PID:2476 -
C:\Windows\SysWOW64\Opjponbf.exeC:\Windows\system32\Opjponbf.exe26⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4932 -
C:\Windows\SysWOW64\Jnmbjnlm.exeC:\Windows\system32\Jnmbjnlm.exe27⤵
- Executes dropped EXE
PID:696 -
C:\Windows\SysWOW64\Aikijjon.exeC:\Windows\system32\Aikijjon.exe28⤵
- Executes dropped EXE
PID:2044 -
C:\Windows\SysWOW64\Ikbphn32.exeC:\Windows\system32\Ikbphn32.exe29⤵
- Executes dropped EXE
- Modifies registry class
PID:2320 -
C:\Windows\SysWOW64\Ppkopail.exeC:\Windows\system32\Ppkopail.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3416 -
C:\Windows\SysWOW64\Ahdpea32.exeC:\Windows\system32\Ahdpea32.exe31⤵
- Executes dropped EXE
- Modifies registry class
PID:1448 -
C:\Windows\SysWOW64\Algbfo32.exeC:\Windows\system32\Algbfo32.exe32⤵
- Executes dropped EXE
- Modifies registry class
PID:4492 -
C:\Windows\SysWOW64\Cikkga32.exeC:\Windows\system32\Cikkga32.exe33⤵
- Executes dropped EXE
PID:3376 -
C:\Windows\SysWOW64\Cibagpgg.exeC:\Windows\system32\Cibagpgg.exe34⤵
- Executes dropped EXE
PID:4400 -
C:\Windows\SysWOW64\Damflb32.exeC:\Windows\system32\Damflb32.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3176 -
C:\Windows\SysWOW64\Djgkbp32.exeC:\Windows\system32\Djgkbp32.exe36⤵
- Executes dropped EXE
PID:1876 -
C:\Windows\SysWOW64\Dabpgbpm.exeC:\Windows\system32\Dabpgbpm.exe37⤵
- Executes dropped EXE
- Modifies registry class
PID:1708 -
C:\Windows\SysWOW64\Dcalae32.exeC:\Windows\system32\Dcalae32.exe38⤵
- Executes dropped EXE
PID:4696 -
C:\Windows\SysWOW64\Dhndil32.exeC:\Windows\system32\Dhndil32.exe39⤵
- Executes dropped EXE
PID:5052 -
C:\Windows\SysWOW64\Djnaco32.exeC:\Windows\system32\Djnaco32.exe40⤵
- Executes dropped EXE
PID:1060 -
C:\Windows\SysWOW64\Ebifha32.exeC:\Windows\system32\Ebifha32.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1484 -
C:\Windows\SysWOW64\Elojej32.exeC:\Windows\system32\Elojej32.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:216 -
C:\Windows\SysWOW64\Fokbbcmo.exeC:\Windows\system32\Fokbbcmo.exe43⤵
- Executes dropped EXE
PID:972 -
C:\Windows\SysWOW64\Ficgkico.exeC:\Windows\system32\Ficgkico.exe44⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3996 -
C:\Windows\SysWOW64\Fomohc32.exeC:\Windows\system32\Fomohc32.exe45⤵
- Executes dropped EXE
PID:2208 -
C:\Windows\SysWOW64\Fblldn32.exeC:\Windows\system32\Fblldn32.exe46⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4832 -
C:\Windows\SysWOW64\Foplnb32.exeC:\Windows\system32\Foplnb32.exe47⤵
- Executes dropped EXE
- Modifies registry class
PID:652 -
C:\Windows\SysWOW64\Ffjdjmpf.exeC:\Windows\system32\Ffjdjmpf.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4140 -
C:\Windows\SysWOW64\Gqohge32.exeC:\Windows\system32\Gqohge32.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4048 -
C:\Windows\SysWOW64\Gbqeonfj.exeC:\Windows\system32\Gbqeonfj.exe50⤵
- Executes dropped EXE
PID:3732 -
C:\Windows\SysWOW64\Gijmlh32.exeC:\Windows\system32\Gijmlh32.exe51⤵
- Executes dropped EXE
PID:4808 -
C:\Windows\SysWOW64\Gfnnel32.exeC:\Windows\system32\Gfnnel32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4032 -
C:\Windows\SysWOW64\Gpgbna32.exeC:\Windows\system32\Gpgbna32.exe53⤵
- Executes dropped EXE
- Modifies registry class
PID:2668 -
C:\Windows\SysWOW64\Gbenjm32.exeC:\Windows\system32\Gbenjm32.exe54⤵
- Executes dropped EXE
PID:4676 -
C:\Windows\SysWOW64\Gqhknd32.exeC:\Windows\system32\Gqhknd32.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:4036 -
C:\Windows\SysWOW64\Hidpbf32.exeC:\Windows\system32\Hidpbf32.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2904 -
C:\Windows\SysWOW64\Hcidoo32.exeC:\Windows\system32\Hcidoo32.exe57⤵
- Executes dropped EXE
PID:180 -
C:\Windows\SysWOW64\Hameic32.exeC:\Windows\system32\Hameic32.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3316 -
C:\Windows\SysWOW64\Hmdend32.exeC:\Windows\system32\Hmdend32.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2108 -
C:\Windows\SysWOW64\Hikfbeod.exeC:\Windows\system32\Hikfbeod.exe60⤵
- Executes dropped EXE
- Modifies registry class
PID:944 -
C:\Windows\SysWOW64\Hbcklkee.exeC:\Windows\system32\Hbcklkee.exe61⤵
- Executes dropped EXE
PID:4040 -
C:\Windows\SysWOW64\Hpgkeodo.exeC:\Windows\system32\Hpgkeodo.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4812 -
C:\Windows\SysWOW64\Hcbgen32.exeC:\Windows\system32\Hcbgen32.exe63⤵
- Executes dropped EXE
PID:2336 -
C:\Windows\SysWOW64\Imklncch.exeC:\Windows\system32\Imklncch.exe64⤵
- Executes dropped EXE
PID:3784 -
C:\Windows\SysWOW64\Icedkn32.exeC:\Windows\system32\Icedkn32.exe65⤵
- Executes dropped EXE
PID:2948 -
C:\Windows\SysWOW64\Icgqqmib.exeC:\Windows\system32\Icgqqmib.exe66⤵PID:4340
-
C:\Windows\SysWOW64\Ijaimg32.exeC:\Windows\system32\Ijaimg32.exe67⤵PID:2248
-
C:\Windows\SysWOW64\Idjmfmgp.exeC:\Windows\system32\Idjmfmgp.exe68⤵PID:4752
-
C:\Windows\SysWOW64\Ibojgikg.exeC:\Windows\system32\Ibojgikg.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4320 -
C:\Windows\SysWOW64\Imdndbkn.exeC:\Windows\system32\Imdndbkn.exe70⤵PID:1912
-
C:\Windows\SysWOW64\Jdqcglqh.exeC:\Windows\system32\Jdqcglqh.exe71⤵PID:2720
-
C:\Windows\SysWOW64\Jmihpa32.exeC:\Windows\system32\Jmihpa32.exe72⤵
- Drops file in System32 directory
PID:796 -
C:\Windows\SysWOW64\Jdcplkoe.exeC:\Windows\system32\Jdcplkoe.exe73⤵
- Modifies registry class
PID:3632 -
C:\Windows\SysWOW64\Jiphebml.exeC:\Windows\system32\Jiphebml.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2872 -
C:\Windows\SysWOW64\Jbhmnhcm.exeC:\Windows\system32\Jbhmnhcm.exe75⤵PID:4840
-
C:\Windows\SysWOW64\Jjoeoedo.exeC:\Windows\system32\Jjoeoedo.exe76⤵PID:1436
-
C:\Windows\SysWOW64\Jplmglbf.exeC:\Windows\system32\Jplmglbf.exe77⤵PID:3508
-
C:\Windows\SysWOW64\Jmpnppap.exeC:\Windows\system32\Jmpnppap.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3192 -
C:\Windows\SysWOW64\Jdjfmjhm.exeC:\Windows\system32\Jdjfmjhm.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3624 -
C:\Windows\SysWOW64\Kkdnjd32.exeC:\Windows\system32\Kkdnjd32.exe80⤵
- Modifies registry class
PID:4504 -
C:\Windows\SysWOW64\Kanffogf.exeC:\Windows\system32\Kanffogf.exe81⤵
- Drops file in System32 directory
PID:228 -
C:\Windows\SysWOW64\Kgkooeen.exeC:\Windows\system32\Kgkooeen.exe82⤵PID:4864
-
C:\Windows\SysWOW64\Kapclned.exeC:\Windows\system32\Kapclned.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1952 -
C:\Windows\SysWOW64\Ccednl32.exeC:\Windows\system32\Ccednl32.exe84⤵PID:624
-
C:\Windows\SysWOW64\Dgqqnjea.exeC:\Windows\system32\Dgqqnjea.exe85⤵
- Modifies registry class
PID:4888 -
C:\Windows\SysWOW64\Dibmfb32.exeC:\Windows\system32\Dibmfb32.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5088 -
C:\Windows\SysWOW64\Jgqdal32.exeC:\Windows\system32\Jgqdal32.exe87⤵
- Drops file in System32 directory
- Modifies registry class
PID:1696 -
C:\Windows\SysWOW64\Pklkmo32.exeC:\Windows\system32\Pklkmo32.exe88⤵
- Drops file in System32 directory
PID:1856 -
C:\Windows\SysWOW64\Pcjioknl.exeC:\Windows\system32\Pcjioknl.exe89⤵
- Modifies registry class
PID:1292 -
C:\Windows\SysWOW64\Qoecol32.exeC:\Windows\system32\Qoecol32.exe90⤵
- Drops file in System32 directory
PID:2516 -
C:\Windows\SysWOW64\Ahnghafl.exeC:\Windows\system32\Ahnghafl.exe91⤵
- Modifies registry class
PID:696 -
C:\Windows\SysWOW64\Aaflag32.exeC:\Windows\system32\Aaflag32.exe92⤵
- Modifies registry class
PID:2296 -
C:\Windows\SysWOW64\Akoqjl32.exeC:\Windows\system32\Akoqjl32.exe93⤵
- Drops file in System32 directory
PID:2572 -
C:\Windows\SysWOW64\Aomipkic.exeC:\Windows\system32\Aomipkic.exe94⤵
- Modifies registry class
PID:2672 -
C:\Windows\SysWOW64\Bbbkmebo.exeC:\Windows\system32\Bbbkmebo.exe95⤵PID:2836
-
C:\Windows\SysWOW64\Blhpjnbe.exeC:\Windows\system32\Blhpjnbe.exe96⤵
- Drops file in System32 directory
- Modifies registry class
PID:4364 -
C:\Windows\SysWOW64\Bfpdcc32.exeC:\Windows\system32\Bfpdcc32.exe97⤵
- Modifies registry class
PID:4596 -
C:\Windows\SysWOW64\Bcddlhgo.exeC:\Windows\system32\Bcddlhgo.exe98⤵PID:3188
-
C:\Windows\SysWOW64\Bhqmdoef.exeC:\Windows\system32\Bhqmdoef.exe99⤵
- Drops file in System32 directory
PID:4492 -
C:\Windows\SysWOW64\Bjpjoa32.exeC:\Windows\system32\Bjpjoa32.exe100⤵
- Modifies registry class
PID:4400 -
C:\Windows\SysWOW64\Ckaffjbg.exeC:\Windows\system32\Ckaffjbg.exe101⤵
- Drops file in System32 directory
PID:2380 -
C:\Windows\SysWOW64\Cfgjcb32.exeC:\Windows\system32\Cfgjcb32.exe102⤵
- Drops file in System32 directory
PID:1968 -
C:\Windows\SysWOW64\Ckdcli32.exeC:\Windows\system32\Ckdcli32.exe103⤵PID:1988
-
C:\Windows\SysWOW64\Cihcen32.exeC:\Windows\system32\Cihcen32.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3288 -
C:\Windows\SysWOW64\Codhgg32.exeC:\Windows\system32\Codhgg32.exe105⤵PID:496
-
C:\Windows\SysWOW64\Cilmpmki.exeC:\Windows\system32\Cilmpmki.exe106⤵
- Modifies registry class
PID:1528 -
C:\Windows\SysWOW64\Cfqmjajc.exeC:\Windows\system32\Cfqmjajc.exe107⤵
- Modifies registry class
PID:3996 -
C:\Windows\SysWOW64\Diafkl32.exeC:\Windows\system32\Diafkl32.exe108⤵PID:652
-
C:\Windows\SysWOW64\Dkbomgde.exeC:\Windows\system32\Dkbomgde.exe109⤵PID:4896
-
C:\Windows\SysWOW64\Dpphcf32.exeC:\Windows\system32\Dpphcf32.exe110⤵PID:2104
-
C:\Windows\SysWOW64\Djelqo32.exeC:\Windows\system32\Djelqo32.exe111⤵
- Drops file in System32 directory
PID:5112 -
C:\Windows\SysWOW64\Dpbdiehi.exeC:\Windows\system32\Dpbdiehi.exe112⤵PID:3048
-
C:\Windows\SysWOW64\Emfebjgb.exeC:\Windows\system32\Emfebjgb.exe113⤵
- Modifies registry class
PID:3448 -
C:\Windows\SysWOW64\Ejjelnfl.exeC:\Windows\system32\Ejjelnfl.exe114⤵PID:928
-
C:\Windows\SysWOW64\Efafqolp.exeC:\Windows\system32\Efafqolp.exe115⤵PID:4040
-
C:\Windows\SysWOW64\Elnoifjg.exeC:\Windows\system32\Elnoifjg.exe116⤵PID:2756
-
C:\Windows\SysWOW64\Ejoogm32.exeC:\Windows\system32\Ejoogm32.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3396 -
C:\Windows\SysWOW64\Efepln32.exeC:\Windows\system32\Efepln32.exe118⤵PID:116
-
C:\Windows\SysWOW64\Epndddnk.exeC:\Windows\system32\Epndddnk.exe119⤵PID:2564
-
C:\Windows\SysWOW64\Fmbdnhme.exeC:\Windows\system32\Fmbdnhme.exe120⤵
- Drops file in System32 directory
PID:3776 -
C:\Windows\SysWOW64\Ffjignde.exeC:\Windows\system32\Ffjignde.exe121⤵PID:2484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-