Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
187s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22/10/2023, 17:28
Behavioral task
behavioral1
Sample
NEAS.ce3f8d0d45397eec031f4faf5172e970.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.ce3f8d0d45397eec031f4faf5172e970.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.ce3f8d0d45397eec031f4faf5172e970.exe
-
Size
226KB
-
MD5
ce3f8d0d45397eec031f4faf5172e970
-
SHA1
d64dac5db1a5b4ef1e54c6431c638471819c0201
-
SHA256
e75efcc340bdf49b86ba491173ebe4ec2a97a3cfa2fc1934d59ee441478efbaa
-
SHA512
179ccea4ec0d955f90b7afbe53ea660fab9012fd8b746b01fed57fc8b243861affbe6ec5b44babb7d8bdb946389fd4c1bc78c68cdee3567500555e90060133d9
-
SSDEEP
6144:POhGIgw4dH4kXfxqySSKpRmSKeTk7eT5ABrnL8MdYg:PMuw4dJ5IKrEAlnLAg
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eqopqh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmjjqhpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ljcjgi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ohjich32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Blpemn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akpojpic.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgflmo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nejkfj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijcecgnl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jklpakam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lapeci32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjojkpdp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ilglbjbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pabhpm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jhnocbfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fcbehbim.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpkqbq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aikbpckb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Legjgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jenmlmll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ajcdbm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gagebknp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aonhblad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hppedpkf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhjcdimf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mqafbaap.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmmqbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Opnbjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fpnfbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bbljoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Djaipe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmqgjl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ncifdlii.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oiihea32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knhkkfod.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Opadmkcj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ablahjhj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhenpk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Egpgehnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jppnjpji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kgflmo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qlkbka32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jabgkpad.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgndikgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fmlnomif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Klceeejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fjeibc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fjfgealk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gijmlh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oknnanhj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmaihekc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gnjjpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gnfmapqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dpqcoj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Elojej32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmpkkpfi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmifkecb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppmleagi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eplckh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmnheggo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Godehbed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kpnjknni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kaofcf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lambcc32.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0008000000022e1d-6.dat family_berbew behavioral2/files/0x0008000000022e1d-7.dat family_berbew behavioral2/files/0x0006000000022e3c-15.dat family_berbew behavioral2/files/0x0006000000022e3c-14.dat family_berbew behavioral2/files/0x0006000000022e3e-22.dat family_berbew behavioral2/files/0x0006000000022e3e-23.dat family_berbew behavioral2/files/0x0006000000022e43-30.dat family_berbew behavioral2/files/0x0006000000022e43-32.dat family_berbew behavioral2/files/0x0006000000022e45-38.dat family_berbew behavioral2/files/0x0006000000022e45-40.dat family_berbew behavioral2/files/0x0007000000022e48-46.dat family_berbew behavioral2/files/0x0007000000022e48-48.dat family_berbew behavioral2/files/0x0006000000022e4a-49.dat family_berbew behavioral2/files/0x0006000000022e4a-54.dat family_berbew behavioral2/files/0x0006000000022e4a-56.dat family_berbew behavioral2/files/0x0006000000022e4c-62.dat family_berbew behavioral2/files/0x0006000000022e4c-64.dat family_berbew behavioral2/files/0x0006000000022e4e-65.dat family_berbew behavioral2/files/0x0006000000022e4e-70.dat family_berbew behavioral2/files/0x0006000000022e4e-72.dat family_berbew behavioral2/files/0x0006000000022e51-78.dat family_berbew behavioral2/files/0x0006000000022e51-80.dat family_berbew behavioral2/files/0x0006000000022e55-86.dat family_berbew behavioral2/files/0x0006000000022e55-88.dat family_berbew behavioral2/files/0x0006000000022e57-96.dat family_berbew behavioral2/files/0x0006000000022e57-94.dat family_berbew behavioral2/files/0x0007000000022e50-102.dat family_berbew behavioral2/files/0x0007000000022e50-104.dat family_berbew behavioral2/files/0x0006000000022e5a-110.dat family_berbew behavioral2/files/0x0006000000022e5a-111.dat family_berbew behavioral2/files/0x0006000000022e5e-118.dat family_berbew behavioral2/files/0x0006000000022e5e-119.dat family_berbew behavioral2/files/0x0006000000022e60-126.dat family_berbew behavioral2/files/0x0006000000022e60-128.dat family_berbew behavioral2/files/0x0006000000022e62-134.dat family_berbew behavioral2/files/0x0006000000022e62-136.dat family_berbew behavioral2/files/0x0006000000022e66-142.dat family_berbew behavioral2/files/0x0006000000022e66-144.dat family_berbew behavioral2/files/0x0006000000022e68-150.dat family_berbew behavioral2/files/0x0006000000022e68-152.dat family_berbew behavioral2/files/0x0007000000022e54-158.dat family_berbew behavioral2/files/0x0007000000022e54-159.dat family_berbew behavioral2/files/0x0006000000022e6e-167.dat family_berbew behavioral2/files/0x0006000000022e72-175.dat family_berbew behavioral2/files/0x0006000000022e72-174.dat family_berbew behavioral2/files/0x0006000000022e6e-166.dat family_berbew behavioral2/files/0x0006000000022e74-182.dat family_berbew behavioral2/files/0x0006000000022e74-184.dat family_berbew behavioral2/files/0x0006000000022e78-190.dat family_berbew behavioral2/files/0x0006000000022e78-192.dat family_berbew behavioral2/files/0x0006000000022e7a-198.dat family_berbew behavioral2/files/0x0006000000022e7a-200.dat family_berbew behavioral2/files/0x0006000000022e7d-207.dat family_berbew behavioral2/files/0x0006000000022e7d-206.dat family_berbew behavioral2/files/0x0006000000022e82-215.dat family_berbew behavioral2/files/0x0006000000022e82-214.dat family_berbew behavioral2/files/0x0006000000022e85-222.dat family_berbew behavioral2/files/0x0006000000022e85-223.dat family_berbew behavioral2/files/0x0006000000022e87-230.dat family_berbew behavioral2/files/0x0006000000022e87-231.dat family_berbew behavioral2/files/0x0006000000022e8a-238.dat family_berbew behavioral2/files/0x0006000000022e8a-240.dat family_berbew behavioral2/files/0x0006000000022e8c-241.dat family_berbew behavioral2/files/0x0006000000022e8c-246.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2568 Bmkjig32.exe 2012 Cdebfago.exe 4768 Clpgkcdj.exe 3084 Cmgjee32.exe 2072 Dmifkecb.exe 3460 Dgfdojfm.exe 3452 Egmjpi32.exe 3320 Egpgehnb.exe 3260 Ephlnn32.exe 560 Edfddl32.exe 2188 Fjeibc32.exe 5112 Fneoma32.exe 3000 Fcbgfhii.exe 1508 Fcddkggf.exe 4520 Gnjhhpgl.exe 372 Gfemmb32.exe 3900 Gfgjbb32.exe 4324 Gckjlf32.exe 2512 Gqokekph.exe 2428 Gdmcki32.exe 364 Hnehdo32.exe 3948 Hfamia32.exe 764 Hdbmfhbi.exe 4912 Hmmakk32.exe 4816 Hjabdo32.exe 4360 Hgebnc32.exe 2296 Hdicggla.exe 1384 Inagpm32.exe 1084 Ienlbf32.exe 3740 Iepihf32.exe 3324 Icefib32.exe 3296 Mdkabmjf.exe 3588 Phbolflm.exe 3528 Fofdkcmd.exe 912 Oknnanhj.exe 4492 Ijdnka32.exe 2800 Njceqili.exe 1676 Bnaolm32.exe 3852 Nmhglopl.exe 4628 Cphgca32.exe 3964 Cgbppknb.exe 4580 Dcpffk32.exe 4280 Djjobedk.exe 3576 Enajobbf.exe 4996 Efolidno.exe 5052 Fceihh32.exe 2340 Fcgemhic.exe 2912 Fmpjfn32.exe 1060 Fpnfbi32.exe 1444 Fmbflm32.exe 4576 Fclohg32.exe 2204 Fjfgealk.exe 2192 Gmfpgmil.exe 1920 Gnfmapqo.exe 2404 Gpgihh32.exe 4560 Gagebknp.exe 2488 Ghanoeel.exe 2212 Gjojkpdp.exe 4728 Gaibhj32.exe 1616 Gjagapbn.exe 864 Gpnoigpe.exe 3740 Hhegjdag.exe 4544 Hpqlof32.exe 32 Iaqapggb.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Phbolflm.exe Mdkabmjf.exe File opened for modification C:\Windows\SysWOW64\Fcgemhic.exe Fceihh32.exe File created C:\Windows\SysWOW64\Chmhlmfa.dll Abqjci32.exe File created C:\Windows\SysWOW64\Ejklfd32.exe Ehlpjikd.exe File opened for modification C:\Windows\SysWOW64\Gnjjpk32.exe Ggpbcaei.exe File created C:\Windows\SysWOW64\Kmfdpm32.dll Mfchehla.exe File opened for modification C:\Windows\SysWOW64\Fjeibc32.exe Edfddl32.exe File created C:\Windows\SysWOW64\Bknbbenh.dll Gnjhhpgl.exe File created C:\Windows\SysWOW64\Lclnpo32.exe Lambcc32.exe File opened for modification C:\Windows\SysWOW64\Lhnpal32.exe Ladhdbcl.exe File created C:\Windows\SysWOW64\Akipao32.dll Jbfphh32.exe File created C:\Windows\SysWOW64\Hggqniih.dll Fpjjkh32.exe File created C:\Windows\SysWOW64\Kakmhg32.exe Kchmljab.exe File opened for modification C:\Windows\SysWOW64\Hkpgooim.exe Hgdlnp32.exe File created C:\Windows\SysWOW64\Dqhicdkm.dll Kepdfo32.exe File opened for modification C:\Windows\SysWOW64\Fclohg32.exe Fmbflm32.exe File created C:\Windows\SysWOW64\Jbfphh32.exe Jbccbi32.exe File created C:\Windows\SysWOW64\Jacnegep.exe Ihkila32.exe File created C:\Windows\SysWOW64\Qlkbka32.exe Pbbnbkpe.exe File created C:\Windows\SysWOW64\Ocebha32.dll Kigoeagd.exe File created C:\Windows\SysWOW64\Fmlnomif.exe Effffd32.exe File created C:\Windows\SysWOW64\Gilajmfp.exe Ggnenagl.exe File created C:\Windows\SysWOW64\Dmifkecb.exe Cmgjee32.exe File created C:\Windows\SysWOW64\Egmjpi32.exe Dgfdojfm.exe File created C:\Windows\SysWOW64\Hfpjlgdl.dll Hmaihekc.exe File created C:\Windows\SysWOW64\Cnaachha.exe Cgdlqo32.exe File created C:\Windows\SysWOW64\Dnmdil32.dll Hnehdo32.exe File opened for modification C:\Windows\SysWOW64\Ienlbf32.exe Inagpm32.exe File opened for modification C:\Windows\SysWOW64\Djihhoao.exe Dpqcoj32.exe File created C:\Windows\SysWOW64\Hcnnjoam.exe Hpbajp32.exe File created C:\Windows\SysWOW64\Kbpboj32.exe Knefnkla.exe File opened for modification C:\Windows\SysWOW64\Ihbdja32.exe Ibhlmgdj.exe File opened for modification C:\Windows\SysWOW64\Lfmgaj32.exe Lpbodpnl.exe File created C:\Windows\SysWOW64\Qadpej32.dll Gjojkpdp.exe File created C:\Windows\SysWOW64\Najlhn32.dll Ablahjhj.exe File created C:\Windows\SysWOW64\Ipqnknld.exe Imbaobmp.exe File created C:\Windows\SysWOW64\Dpqaejjo.dll Knofif32.exe File opened for modification C:\Windows\SysWOW64\Nadlnoaj.exe Nnccmddi.exe File opened for modification C:\Windows\SysWOW64\Jppnjpji.exe Jifemfcl.exe File created C:\Windows\SysWOW64\Ngipdf32.exe Npogglfl.exe File opened for modification C:\Windows\SysWOW64\Ogoncd32.exe Oaeegjeb.exe File created C:\Windows\SysWOW64\Ejegdngb.exe Eckogc32.exe File created C:\Windows\SysWOW64\Cchikf32.exe Clnanlhn.exe File opened for modification C:\Windows\SysWOW64\Hfjmajbc.exe Hboaql32.exe File created C:\Windows\SysWOW64\Gbmpcffh.dll Daiegp32.exe File opened for modification C:\Windows\SysWOW64\Lqmmgb32.exe Lqjqab32.exe File opened for modification C:\Windows\SysWOW64\Cpkddd32.exe Bhpopb32.exe File created C:\Windows\SysWOW64\Npaphh32.dll Enajobbf.exe File opened for modification C:\Windows\SysWOW64\Ldnbdnlc.exe Laofhbmp.exe File created C:\Windows\SysWOW64\Mhihkjfj.exe Mndcnafd.exe File created C:\Windows\SysWOW64\Ofimkqbf.dll Jjhjli32.exe File created C:\Windows\SysWOW64\Mjndbb32.dll Mmmqbb32.exe File created C:\Windows\SysWOW64\Eldafjjc.dll Cdebfago.exe File created C:\Windows\SysWOW64\Kolaqh32.exe Kgeiokao.exe File created C:\Windows\SysWOW64\Hmnlgn32.dll Onkbenbi.exe File created C:\Windows\SysWOW64\Cimhlakl.exe Cohdoh32.exe File opened for modification C:\Windows\SysWOW64\Mflbdibj.exe Mcnfhmcf.exe File opened for modification C:\Windows\SysWOW64\Oknnanhj.exe Fofdkcmd.exe File created C:\Windows\SysWOW64\Ibchnb32.dll Kpkqbq32.exe File opened for modification C:\Windows\SysWOW64\Iiipfnch.exe Hfhgdc32.exe File created C:\Windows\SysWOW64\Jepjbm32.exe Jofaeb32.exe File opened for modification C:\Windows\SysWOW64\Ncnook32.exe Nggnjjoo.exe File opened for modification C:\Windows\SysWOW64\Lpqgqn32.exe Khiopp32.exe File opened for modification C:\Windows\SysWOW64\Omgalo32.exe Ohjich32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hmaihekc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jmpnppap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nnccmddi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bpggbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnbjlolg.dll" Behiec32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hcpjpn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maocdibm.dll" Lqjqab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpdaje32.dll" Ljcjgi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fofdkcmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fpnfbi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Inejlibi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lgcjmjho.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Maiaoa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ajcdbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Egmjpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fjfgealk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lkenkhec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbnmmaoj.dll" Hjedpkne.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cgiflnoa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpflmkci.dll" Jfdinf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mhcjllfd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jacnegep.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kpbfbo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbqebono.dll" Kpdbhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfdkmljj.dll" Ncnook32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmnfoa32.dll" Pmiidnko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlpgmkgh.dll" Kifodcej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pnnokn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hmaihekc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifkppk32.dll" Hcpjpn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lqjqab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abbbel32.dll" Cmgjee32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Abqjci32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ommjipel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jndenjmo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kcmmap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jqofjd32.dll" Opnbjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Godehbed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akipao32.dll" Jbfphh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Knnhdied.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Abofojqj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfnnap32.dll" Iddlccfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndbjobgk.dll" Abofojqj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mmmqbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bklmebob.dll" Baldmiom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" NEAS.ce3f8d0d45397eec031f4faf5172e970.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbpnedga.dll" Gfgjbb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fceihh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ihkila32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmmibk32.dll" Ijcecgnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lbinkb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kidmmfke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lclnpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dpehikja.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gnjhhpgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehglag32.dll" Khplnn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Elojej32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ebkbmqhb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hppedpkf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dpehikja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjqafj32.dll" Efolidno.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oaeegjeb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ccfmef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ijcaaibe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2768 wrote to memory of 2568 2768 NEAS.ce3f8d0d45397eec031f4faf5172e970.exe 87 PID 2768 wrote to memory of 2568 2768 NEAS.ce3f8d0d45397eec031f4faf5172e970.exe 87 PID 2768 wrote to memory of 2568 2768 NEAS.ce3f8d0d45397eec031f4faf5172e970.exe 87 PID 2568 wrote to memory of 2012 2568 Bmkjig32.exe 88 PID 2568 wrote to memory of 2012 2568 Bmkjig32.exe 88 PID 2568 wrote to memory of 2012 2568 Bmkjig32.exe 88 PID 2012 wrote to memory of 4768 2012 Cdebfago.exe 90 PID 2012 wrote to memory of 4768 2012 Cdebfago.exe 90 PID 2012 wrote to memory of 4768 2012 Cdebfago.exe 90 PID 4768 wrote to memory of 3084 4768 Clpgkcdj.exe 91 PID 4768 wrote to memory of 3084 4768 Clpgkcdj.exe 91 PID 4768 wrote to memory of 3084 4768 Clpgkcdj.exe 91 PID 3084 wrote to memory of 2072 3084 Cmgjee32.exe 92 PID 3084 wrote to memory of 2072 3084 Cmgjee32.exe 92 PID 3084 wrote to memory of 2072 3084 Cmgjee32.exe 92 PID 2072 wrote to memory of 3460 2072 Dmifkecb.exe 93 PID 2072 wrote to memory of 3460 2072 Dmifkecb.exe 93 PID 2072 wrote to memory of 3460 2072 Dmifkecb.exe 93 PID 3460 wrote to memory of 3452 3460 Dgfdojfm.exe 94 PID 3460 wrote to memory of 3452 3460 Dgfdojfm.exe 94 PID 3460 wrote to memory of 3452 3460 Dgfdojfm.exe 94 PID 3452 wrote to memory of 3320 3452 Egmjpi32.exe 95 PID 3452 wrote to memory of 3320 3452 Egmjpi32.exe 95 PID 3452 wrote to memory of 3320 3452 Egmjpi32.exe 95 PID 3320 wrote to memory of 3260 3320 Egpgehnb.exe 96 PID 3320 wrote to memory of 3260 3320 Egpgehnb.exe 96 PID 3320 wrote to memory of 3260 3320 Egpgehnb.exe 96 PID 3260 wrote to memory of 560 3260 Ephlnn32.exe 97 PID 3260 wrote to memory of 560 3260 Ephlnn32.exe 97 PID 3260 wrote to memory of 560 3260 Ephlnn32.exe 97 PID 560 wrote to memory of 2188 560 Edfddl32.exe 98 PID 560 wrote to memory of 2188 560 Edfddl32.exe 98 PID 560 wrote to memory of 2188 560 Edfddl32.exe 98 PID 2188 wrote to memory of 5112 2188 Fjeibc32.exe 99 PID 2188 wrote to memory of 5112 2188 Fjeibc32.exe 99 PID 2188 wrote to memory of 5112 2188 Fjeibc32.exe 99 PID 5112 wrote to memory of 3000 5112 Fneoma32.exe 100 PID 5112 wrote to memory of 3000 5112 Fneoma32.exe 100 PID 5112 wrote to memory of 3000 5112 Fneoma32.exe 100 PID 3000 wrote to memory of 1508 3000 Fcbgfhii.exe 101 PID 3000 wrote to memory of 1508 3000 Fcbgfhii.exe 101 PID 3000 wrote to memory of 1508 3000 Fcbgfhii.exe 101 PID 1508 wrote to memory of 4520 1508 Fcddkggf.exe 102 PID 1508 wrote to memory of 4520 1508 Fcddkggf.exe 102 PID 1508 wrote to memory of 4520 1508 Fcddkggf.exe 102 PID 4520 wrote to memory of 372 4520 Gnjhhpgl.exe 103 PID 4520 wrote to memory of 372 4520 Gnjhhpgl.exe 103 PID 4520 wrote to memory of 372 4520 Gnjhhpgl.exe 103 PID 372 wrote to memory of 3900 372 Gfemmb32.exe 104 PID 372 wrote to memory of 3900 372 Gfemmb32.exe 104 PID 372 wrote to memory of 3900 372 Gfemmb32.exe 104 PID 3900 wrote to memory of 4324 3900 Gfgjbb32.exe 105 PID 3900 wrote to memory of 4324 3900 Gfgjbb32.exe 105 PID 3900 wrote to memory of 4324 3900 Gfgjbb32.exe 105 PID 4324 wrote to memory of 2512 4324 Gckjlf32.exe 106 PID 4324 wrote to memory of 2512 4324 Gckjlf32.exe 106 PID 4324 wrote to memory of 2512 4324 Gckjlf32.exe 106 PID 2512 wrote to memory of 2428 2512 Gqokekph.exe 107 PID 2512 wrote to memory of 2428 2512 Gqokekph.exe 107 PID 2512 wrote to memory of 2428 2512 Gqokekph.exe 107 PID 2428 wrote to memory of 364 2428 Gdmcki32.exe 108 PID 2428 wrote to memory of 364 2428 Gdmcki32.exe 108 PID 2428 wrote to memory of 364 2428 Gdmcki32.exe 108 PID 364 wrote to memory of 3948 364 Hnehdo32.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ce3f8d0d45397eec031f4faf5172e970.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ce3f8d0d45397eec031f4faf5172e970.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\Bmkjig32.exeC:\Windows\system32\Bmkjig32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\Cdebfago.exeC:\Windows\system32\Cdebfago.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\Clpgkcdj.exeC:\Windows\system32\Clpgkcdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\Cmgjee32.exeC:\Windows\system32\Cmgjee32.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\Dmifkecb.exeC:\Windows\system32\Dmifkecb.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\Dgfdojfm.exeC:\Windows\system32\Dgfdojfm.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\Egmjpi32.exeC:\Windows\system32\Egmjpi32.exe8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\Egpgehnb.exeC:\Windows\system32\Egpgehnb.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\Ephlnn32.exeC:\Windows\system32\Ephlnn32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\Edfddl32.exeC:\Windows\system32\Edfddl32.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\Fjeibc32.exeC:\Windows\system32\Fjeibc32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\Fneoma32.exeC:\Windows\system32\Fneoma32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\Fcbgfhii.exeC:\Windows\system32\Fcbgfhii.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\Fcddkggf.exeC:\Windows\system32\Fcddkggf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\Gnjhhpgl.exeC:\Windows\system32\Gnjhhpgl.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\Gfemmb32.exeC:\Windows\system32\Gfemmb32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\Gfgjbb32.exeC:\Windows\system32\Gfgjbb32.exe18⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\Gckjlf32.exeC:\Windows\system32\Gckjlf32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\Gqokekph.exeC:\Windows\system32\Gqokekph.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\Gdmcki32.exeC:\Windows\system32\Gdmcki32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\Hnehdo32.exeC:\Windows\system32\Hnehdo32.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\Hfamia32.exeC:\Windows\system32\Hfamia32.exe23⤵
- Executes dropped EXE
PID:3948 -
C:\Windows\SysWOW64\Hdbmfhbi.exeC:\Windows\system32\Hdbmfhbi.exe24⤵
- Executes dropped EXE
PID:764 -
C:\Windows\SysWOW64\Hmmakk32.exeC:\Windows\system32\Hmmakk32.exe25⤵
- Executes dropped EXE
PID:4912 -
C:\Windows\SysWOW64\Hjabdo32.exeC:\Windows\system32\Hjabdo32.exe26⤵
- Executes dropped EXE
PID:4816 -
C:\Windows\SysWOW64\Hgebnc32.exeC:\Windows\system32\Hgebnc32.exe27⤵
- Executes dropped EXE
PID:4360 -
C:\Windows\SysWOW64\Hdicggla.exeC:\Windows\system32\Hdicggla.exe28⤵
- Executes dropped EXE
PID:2296 -
C:\Windows\SysWOW64\Inagpm32.exeC:\Windows\system32\Inagpm32.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1384 -
C:\Windows\SysWOW64\Ienlbf32.exeC:\Windows\system32\Ienlbf32.exe30⤵
- Executes dropped EXE
PID:1084 -
C:\Windows\SysWOW64\Iepihf32.exeC:\Windows\system32\Iepihf32.exe31⤵
- Executes dropped EXE
PID:3740 -
C:\Windows\SysWOW64\Icefib32.exeC:\Windows\system32\Icefib32.exe32⤵
- Executes dropped EXE
PID:3324 -
C:\Windows\SysWOW64\Mdkabmjf.exeC:\Windows\system32\Mdkabmjf.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3296 -
C:\Windows\SysWOW64\Phbolflm.exeC:\Windows\system32\Phbolflm.exe34⤵
- Executes dropped EXE
PID:3588 -
C:\Windows\SysWOW64\Fofdkcmd.exeC:\Windows\system32\Fofdkcmd.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3528 -
C:\Windows\SysWOW64\Oknnanhj.exeC:\Windows\system32\Oknnanhj.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:912 -
C:\Windows\SysWOW64\Ijdnka32.exeC:\Windows\system32\Ijdnka32.exe37⤵
- Executes dropped EXE
PID:4492 -
C:\Windows\SysWOW64\Njceqili.exeC:\Windows\system32\Njceqili.exe38⤵
- Executes dropped EXE
PID:2800 -
C:\Windows\SysWOW64\Bnaolm32.exeC:\Windows\system32\Bnaolm32.exe39⤵
- Executes dropped EXE
PID:1676 -
C:\Windows\SysWOW64\Nmhglopl.exeC:\Windows\system32\Nmhglopl.exe40⤵
- Executes dropped EXE
PID:3852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Cphgca32.exeC:\Windows\system32\Cphgca32.exe1⤵
- Executes dropped EXE
PID:4628 -
C:\Windows\SysWOW64\Cgbppknb.exeC:\Windows\system32\Cgbppknb.exe2⤵
- Executes dropped EXE
PID:3964 -
C:\Windows\SysWOW64\Dcpffk32.exeC:\Windows\system32\Dcpffk32.exe3⤵
- Executes dropped EXE
PID:4580 -
C:\Windows\SysWOW64\Djjobedk.exeC:\Windows\system32\Djjobedk.exe4⤵
- Executes dropped EXE
PID:4280 -
C:\Windows\SysWOW64\Enajobbf.exeC:\Windows\system32\Enajobbf.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3576 -
C:\Windows\SysWOW64\Efolidno.exeC:\Windows\system32\Efolidno.exe6⤵
- Executes dropped EXE
- Modifies registry class
PID:4996 -
C:\Windows\SysWOW64\Fceihh32.exeC:\Windows\system32\Fceihh32.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:5052 -
C:\Windows\SysWOW64\Fcgemhic.exeC:\Windows\system32\Fcgemhic.exe8⤵
- Executes dropped EXE
PID:2340 -
C:\Windows\SysWOW64\Fmpjfn32.exeC:\Windows\system32\Fmpjfn32.exe9⤵
- Executes dropped EXE
PID:2912 -
C:\Windows\SysWOW64\Fpnfbi32.exeC:\Windows\system32\Fpnfbi32.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1060 -
C:\Windows\SysWOW64\Fmbflm32.exeC:\Windows\system32\Fmbflm32.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1444 -
C:\Windows\SysWOW64\Fclohg32.exeC:\Windows\system32\Fclohg32.exe12⤵
- Executes dropped EXE
PID:4576 -
C:\Windows\SysWOW64\Fjfgealk.exeC:\Windows\system32\Fjfgealk.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2204 -
C:\Windows\SysWOW64\Gmfpgmil.exeC:\Windows\system32\Gmfpgmil.exe14⤵
- Executes dropped EXE
PID:2192 -
C:\Windows\SysWOW64\Gnfmapqo.exeC:\Windows\system32\Gnfmapqo.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\Gpgihh32.exeC:\Windows\system32\Gpgihh32.exe16⤵
- Executes dropped EXE
PID:2404 -
C:\Windows\SysWOW64\Gagebknp.exeC:\Windows\system32\Gagebknp.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4560 -
C:\Windows\SysWOW64\Ghanoeel.exeC:\Windows\system32\Ghanoeel.exe18⤵
- Executes dropped EXE
PID:2488 -
C:\Windows\SysWOW64\Gjojkpdp.exeC:\Windows\system32\Gjojkpdp.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2212 -
C:\Windows\SysWOW64\Gaibhj32.exeC:\Windows\system32\Gaibhj32.exe20⤵
- Executes dropped EXE
PID:4728 -
C:\Windows\SysWOW64\Gjagapbn.exeC:\Windows\system32\Gjagapbn.exe21⤵
- Executes dropped EXE
PID:1616 -
C:\Windows\SysWOW64\Gpnoigpe.exeC:\Windows\system32\Gpnoigpe.exe22⤵
- Executes dropped EXE
PID:864 -
C:\Windows\SysWOW64\Hhegjdag.exeC:\Windows\system32\Hhegjdag.exe23⤵
- Executes dropped EXE
PID:3740 -
C:\Windows\SysWOW64\Hpqlof32.exeC:\Windows\system32\Hpqlof32.exe24⤵
- Executes dropped EXE
PID:4544 -
C:\Windows\SysWOW64\Iaqapggb.exeC:\Windows\system32\Iaqapggb.exe25⤵
- Executes dropped EXE
PID:32 -
C:\Windows\SysWOW64\Ihkila32.exeC:\Windows\system32\Ihkila32.exe26⤵
- Drops file in System32 directory
- Modifies registry class
PID:3404 -
C:\Windows\SysWOW64\Jacnegep.exeC:\Windows\system32\Jacnegep.exe27⤵
- Modifies registry class
PID:3672 -
C:\Windows\SysWOW64\Jmnheggo.exeC:\Windows\system32\Jmnheggo.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3912 -
C:\Windows\SysWOW64\Jhfihp32.exeC:\Windows\system32\Jhfihp32.exe29⤵PID:3324
-
C:\Windows\SysWOW64\Kdmjmqjf.exeC:\Windows\system32\Kdmjmqjf.exe30⤵PID:2140
-
C:\Windows\SysWOW64\Knhkkfod.exeC:\Windows\system32\Knhkkfod.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4236 -
C:\Windows\SysWOW64\Khplnn32.exeC:\Windows\system32\Khplnn32.exe32⤵
- Modifies registry class
PID:2732 -
C:\Windows\SysWOW64\Kpkqbq32.exeC:\Windows\system32\Kpkqbq32.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:4928 -
C:\Windows\SysWOW64\Kgeiokao.exeC:\Windows\system32\Kgeiokao.exe34⤵
- Drops file in System32 directory
PID:1744 -
C:\Windows\SysWOW64\Kolaqh32.exeC:\Windows\system32\Kolaqh32.exe35⤵PID:552
-
C:\Windows\SysWOW64\Lggeej32.exeC:\Windows\system32\Lggeej32.exe36⤵PID:2892
-
C:\Windows\SysWOW64\Lhgbomfo.exeC:\Windows\system32\Lhgbomfo.exe37⤵PID:3152
-
C:\Windows\SysWOW64\Lkenkhec.exeC:\Windows\system32\Lkenkhec.exe38⤵
- Modifies registry class
PID:4216 -
C:\Windows\SysWOW64\Laofhbmp.exeC:\Windows\system32\Laofhbmp.exe39⤵
- Drops file in System32 directory
PID:4340 -
C:\Windows\SysWOW64\Ldnbdnlc.exeC:\Windows\system32\Ldnbdnlc.exe40⤵PID:972
-
C:\Windows\SysWOW64\Lkgkqh32.exeC:\Windows\system32\Lkgkqh32.exe41⤵PID:3996
-
C:\Windows\SysWOW64\Laacmbkm.exeC:\Windows\system32\Laacmbkm.exe42⤵PID:4624
-
C:\Windows\SysWOW64\Lhkkjl32.exeC:\Windows\system32\Lhkkjl32.exe43⤵PID:4276
-
C:\Windows\SysWOW64\Lnhdbc32.exeC:\Windows\system32\Lnhdbc32.exe44⤵PID:1036
-
C:\Windows\SysWOW64\Lqfpoope.exeC:\Windows\system32\Lqfpoope.exe45⤵PID:5080
-
C:\Windows\SysWOW64\Mnojcb32.exeC:\Windows\system32\Mnojcb32.exe46⤵PID:2840
-
C:\Windows\SysWOW64\Mqnfon32.exeC:\Windows\system32\Mqnfon32.exe47⤵PID:4332
-
C:\Windows\SysWOW64\Mhenpk32.exeC:\Windows\system32\Mhenpk32.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2460 -
C:\Windows\SysWOW64\Mnaghb32.exeC:\Windows\system32\Mnaghb32.exe49⤵PID:3164
-
C:\Windows\SysWOW64\Mndcnafd.exeC:\Windows\system32\Mndcnafd.exe50⤵
- Drops file in System32 directory
PID:2088 -
C:\Windows\SysWOW64\Mhihkjfj.exeC:\Windows\system32\Mhihkjfj.exe51⤵PID:4016
-
C:\Windows\SysWOW64\Nicjaino.exeC:\Windows\system32\Nicjaino.exe52⤵PID:2752
-
C:\Windows\SysWOW64\Nejkfj32.exeC:\Windows\system32\Nejkfj32.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2152 -
C:\Windows\SysWOW64\Obphenpj.exeC:\Windows\system32\Obphenpj.exe54⤵PID:1008
-
C:\Windows\SysWOW64\Opdiobod.exeC:\Windows\system32\Opdiobod.exe55⤵PID:1880
-
C:\Windows\SysWOW64\Oaeegjeb.exeC:\Windows\system32\Oaeegjeb.exe56⤵
- Drops file in System32 directory
- Modifies registry class
PID:2112 -
C:\Windows\SysWOW64\Ogoncd32.exeC:\Windows\system32\Ogoncd32.exe57⤵PID:4388
-
C:\Windows\SysWOW64\Oecnmi32.exeC:\Windows\system32\Oecnmi32.exe58⤵PID:3052
-
C:\Windows\SysWOW64\Onkbenbi.exeC:\Windows\system32\Onkbenbi.exe59⤵
- Drops file in System32 directory
PID:1040 -
C:\Windows\SysWOW64\Pgdgodhj.exeC:\Windows\system32\Pgdgodhj.exe60⤵PID:4284
-
C:\Windows\SysWOW64\Pnnokn32.exeC:\Windows\system32\Pnnokn32.exe61⤵
- Modifies registry class
PID:4832 -
C:\Windows\SysWOW64\Ppmleagi.exeC:\Windows\system32\Ppmleagi.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2428 -
C:\Windows\SysWOW64\Piepnfnj.exeC:\Windows\system32\Piepnfnj.exe63⤵PID:3756
-
C:\Windows\SysWOW64\Ppphkq32.exeC:\Windows\system32\Ppphkq32.exe64⤵PID:4028
-
C:\Windows\SysWOW64\Phkmoc32.exeC:\Windows\system32\Phkmoc32.exe65⤵PID:4656
-
C:\Windows\SysWOW64\Peonhg32.exeC:\Windows\system32\Peonhg32.exe66⤵PID:4052
-
C:\Windows\SysWOW64\Pbbnbkpe.exeC:\Windows\system32\Pbbnbkpe.exe67⤵
- Drops file in System32 directory
PID:1824 -
C:\Windows\SysWOW64\Qlkbka32.exeC:\Windows\system32\Qlkbka32.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4848 -
C:\Windows\SysWOW64\Qbekgknb.exeC:\Windows\system32\Qbekgknb.exe69⤵PID:2136
-
C:\Windows\SysWOW64\Qlmopqdc.exeC:\Windows\system32\Qlmopqdc.exe70⤵PID:968
-
C:\Windows\SysWOW64\Qbggmk32.exeC:\Windows\system32\Qbggmk32.exe71⤵PID:784
-
C:\Windows\SysWOW64\Ahdpea32.exeC:\Windows\system32\Ahdpea32.exe72⤵PID:1836
-
C:\Windows\SysWOW64\Aonhblad.exeC:\Windows\system32\Aonhblad.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4328 -
C:\Windows\SysWOW64\Ablahjhj.exeC:\Windows\system32\Ablahjhj.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:4752 -
C:\Windows\SysWOW64\Aldeap32.exeC:\Windows\system32\Aldeap32.exe75⤵PID:3848
-
C:\Windows\SysWOW64\Aemjjeek.exeC:\Windows\system32\Aemjjeek.exe76⤵PID:4588
-
C:\Windows\SysWOW64\Abqjci32.exeC:\Windows\system32\Abqjci32.exe77⤵
- Drops file in System32 directory
- Modifies registry class
PID:1192 -
C:\Windows\SysWOW64\Aikbpckb.exeC:\Windows\system32\Aikbpckb.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2392 -
C:\Windows\SysWOW64\Apdkmn32.exeC:\Windows\system32\Apdkmn32.exe79⤵PID:5032
-
C:\Windows\SysWOW64\Bpggbm32.exeC:\Windows\system32\Bpggbm32.exe80⤵
- Modifies registry class
PID:3948 -
C:\Windows\SysWOW64\Boldcj32.exeC:\Windows\system32\Boldcj32.exe81⤵PID:2380
-
C:\Windows\SysWOW64\Bajqpe32.exeC:\Windows\system32\Bajqpe32.exe82⤵PID:3048
-
C:\Windows\SysWOW64\Blpemn32.exeC:\Windows\system32\Blpemn32.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3312 -
C:\Windows\SysWOW64\Behiec32.exeC:\Windows\system32\Behiec32.exe84⤵
- Modifies registry class
PID:2888 -
C:\Windows\SysWOW64\Blbabnbk.exeC:\Windows\system32\Blbabnbk.exe85⤵PID:5128
-
C:\Windows\SysWOW64\Bbljoh32.exeC:\Windows\system32\Bbljoh32.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5176 -
C:\Windows\SysWOW64\Bhibgo32.exeC:\Windows\system32\Bhibgo32.exe87⤵PID:5220
-
C:\Windows\SysWOW64\Cbofdg32.exeC:\Windows\system32\Cbofdg32.exe88⤵PID:5264
-
C:\Windows\SysWOW64\Ciioaa32.exeC:\Windows\system32\Ciioaa32.exe89⤵PID:5308
-
C:\Windows\SysWOW64\Cadcfd32.exeC:\Windows\system32\Cadcfd32.exe90⤵PID:5352
-
C:\Windows\SysWOW64\Chnlbndj.exeC:\Windows\system32\Chnlbndj.exe91⤵PID:5396
-
C:\Windows\SysWOW64\Cohdoh32.exeC:\Windows\system32\Cohdoh32.exe92⤵
- Drops file in System32 directory
PID:5440 -
C:\Windows\SysWOW64\Cimhlakl.exeC:\Windows\system32\Cimhlakl.exe93⤵PID:5484
-
C:\Windows\SysWOW64\Ccfmef32.exeC:\Windows\system32\Ccfmef32.exe94⤵
- Modifies registry class
PID:5520 -
C:\Windows\SysWOW64\Cediab32.exeC:\Windows\system32\Cediab32.exe95⤵PID:5568
-
C:\Windows\SysWOW64\Clnanlhn.exeC:\Windows\system32\Clnanlhn.exe96⤵
- Drops file in System32 directory
PID:5612 -
C:\Windows\SysWOW64\Cchikf32.exeC:\Windows\system32\Cchikf32.exe97⤵PID:5660
-
C:\Windows\SysWOW64\Djgkbp32.exeC:\Windows\system32\Djgkbp32.exe98⤵PID:5704
-
C:\Windows\SysWOW64\Dpqcoj32.exeC:\Windows\system32\Dpqcoj32.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5748 -
C:\Windows\SysWOW64\Djihhoao.exeC:\Windows\system32\Djihhoao.exe100⤵PID:5788
-
C:\Windows\SysWOW64\Dpcpei32.exeC:\Windows\system32\Dpcpei32.exe101⤵PID:5836
-
C:\Windows\SysWOW64\Dadlmanj.exeC:\Windows\system32\Dadlmanj.exe102⤵PID:5880
-
C:\Windows\SysWOW64\Djkdnool.exeC:\Windows\system32\Djkdnool.exe103⤵PID:5924
-
C:\Windows\SysWOW64\Dpemjifi.exeC:\Windows\system32\Dpemjifi.exe104⤵PID:5968
-
C:\Windows\SysWOW64\Djnaco32.exeC:\Windows\system32\Djnaco32.exe105⤵PID:6008
-
C:\Windows\SysWOW64\Eokjke32.exeC:\Windows\system32\Eokjke32.exe106⤵PID:6052
-
C:\Windows\SysWOW64\Elojej32.exeC:\Windows\system32\Elojej32.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6096 -
C:\Windows\SysWOW64\Eomfae32.exeC:\Windows\system32\Eomfae32.exe108⤵PID:6140
-
C:\Windows\SysWOW64\Ebkbmqhb.exeC:\Windows\system32\Ebkbmqhb.exe109⤵
- Modifies registry class
PID:5156 -
C:\Windows\SysWOW64\Ehekjk32.exeC:\Windows\system32\Ehekjk32.exe110⤵PID:5244
-
C:\Windows\SysWOW64\Eplckh32.exeC:\Windows\system32\Eplckh32.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5304 -
C:\Windows\SysWOW64\Eckogc32.exeC:\Windows\system32\Eckogc32.exe112⤵
- Drops file in System32 directory
PID:5384 -
C:\Windows\SysWOW64\Ejegdngb.exeC:\Windows\system32\Ejegdngb.exe113⤵PID:5448
-
C:\Windows\SysWOW64\Eqopqh32.exeC:\Windows\system32\Eqopqh32.exe114⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5512 -
C:\Windows\SysWOW64\Ejgdim32.exeC:\Windows\system32\Ejgdim32.exe115⤵PID:5596
-
C:\Windows\SysWOW64\Ecphbckp.exeC:\Windows\system32\Ecphbckp.exe116⤵PID:5652
-
C:\Windows\SysWOW64\Fcbehbim.exeC:\Windows\system32\Fcbehbim.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5716 -
C:\Windows\SysWOW64\Fmjjqhpn.exeC:\Windows\system32\Fmjjqhpn.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5768 -
C:\Windows\SysWOW64\Foifmcoa.exeC:\Windows\system32\Foifmcoa.exe119⤵PID:5868
-
C:\Windows\SysWOW64\Fiajfi32.exeC:\Windows\system32\Fiajfi32.exe120⤵PID:5916
-
C:\Windows\SysWOW64\Gmclgghc.exeC:\Windows\system32\Gmclgghc.exe121⤵PID:4640
-
C:\Windows\SysWOW64\Gobicbgf.exeC:\Windows\system32\Gobicbgf.exe122⤵PID:6020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-