Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
245s -
max time network
290s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
28/10/2023, 20:17
Behavioral task
behavioral1
Sample
NEAS.eca9d072fc3f6c60281d0755a660a4a0.exe
Resource
win7-20231023-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.eca9d072fc3f6c60281d0755a660a4a0.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
NEAS.eca9d072fc3f6c60281d0755a660a4a0.exe
-
Size
302KB
-
MD5
eca9d072fc3f6c60281d0755a660a4a0
-
SHA1
3631bc57d1a843950cd149aadc6f1d64ed4ea60f
-
SHA256
5defb70f886b59081b859835372037effb12750eb7f82476e065376eeeef9cda
-
SHA512
542b212910cf75b29b0feefb5392f82b730a3a4ed1a2f48714f1cb56a2eaf107e406dd3a0503f80b0d88f5381d0080feb7ce9ed704929698974cd14e62134523
-
SSDEEP
6144:HkgkkY5GadL7GNlighD4lTjZXvEQo9dfEORRAgnIlY1:H5Y5Gkv8lXhuT9XvEhdfEmwlY1
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Adcakdhn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lelphbon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mbgggf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ffkgcdqn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oqaliabh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gaokjaeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gmjejafa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nfalpkbg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nkcmca32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpmkjlbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pdpoeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Agpdfmfc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghffal32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icnpbkal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pafacd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dkmqhdfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mclgjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ogadha32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afmcip32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbiajano.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gjilhfip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hmlapa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mqbfad32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qlgolg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhpigjfg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Adcakdhn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ppafopqq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkdacb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cinhpnlk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnefdqke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Daelpooi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lofafhck.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gelcpp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjilhfip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hhpigjfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lhffnloe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kdkqgble.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lifepg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkheal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bphhobmd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpfcgh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgphbfoc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jenicf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bhallgpj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjphhcon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gjlinfgm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oamohenq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aamhdckg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Epdafl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ndmidq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aaobcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hdfjlklk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lohgdnho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mjkkjjlb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lmmaoq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppafopqq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Daelpooi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Edeapm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jogmlken.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jmibldle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lkgahpdk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mfmbdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qjofljho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mfepmd32.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/memory/2512-0-0x0000000000400000-0x0000000000445000-memory.dmp family_berbew behavioral1/files/0x00070000000120e5-5.dat family_berbew behavioral1/memory/2512-6-0x0000000000300000-0x0000000000345000-memory.dmp family_berbew behavioral1/files/0x00070000000120e5-8.dat family_berbew behavioral1/files/0x00070000000120e5-12.dat family_berbew behavioral1/files/0x00070000000120e5-11.dat family_berbew behavioral1/files/0x00070000000120e5-13.dat family_berbew behavioral1/memory/2544-20-0x00000000002A0000-0x00000000002E5000-memory.dmp family_berbew behavioral1/files/0x000b000000015fea-18.dat family_berbew behavioral1/files/0x000b000000015fea-22.dat family_berbew behavioral1/files/0x000b000000015fea-27.dat family_berbew behavioral1/memory/2464-32-0x0000000000400000-0x0000000000445000-memory.dmp family_berbew behavioral1/files/0x000b000000015fea-26.dat family_berbew behavioral1/files/0x000b000000015fea-21.dat family_berbew behavioral1/files/0x003300000001643f-33.dat family_berbew behavioral1/files/0x003300000001643f-39.dat family_berbew behavioral1/files/0x003300000001643f-36.dat family_berbew behavioral1/files/0x003300000001643f-41.dat family_berbew behavioral1/memory/1328-40-0x0000000000400000-0x0000000000445000-memory.dmp family_berbew behavioral1/files/0x003300000001643f-35.dat family_berbew behavioral1/files/0x0007000000016c1b-52.dat family_berbew behavioral1/files/0x0007000000016c1b-49.dat family_berbew behavioral1/files/0x0007000000016c1b-48.dat family_berbew behavioral1/files/0x0007000000016c1b-46.dat family_berbew behavioral1/files/0x0007000000016c1b-54.dat family_berbew behavioral1/memory/1328-59-0x0000000000220000-0x0000000000265000-memory.dmp family_berbew behavioral1/memory/2748-60-0x0000000000400000-0x0000000000445000-memory.dmp family_berbew behavioral1/files/0x0007000000016c8e-61.dat family_berbew behavioral1/files/0x0007000000016c8e-68.dat family_berbew behavioral1/files/0x0007000000016c8e-70.dat family_berbew behavioral1/memory/2980-69-0x0000000000400000-0x0000000000445000-memory.dmp family_berbew behavioral1/files/0x0007000000016c8e-65.dat family_berbew behavioral1/files/0x0007000000016c8e-64.dat family_berbew behavioral1/files/0x0009000000016ccd-81.dat family_berbew behavioral1/files/0x0009000000016ccd-78.dat family_berbew behavioral1/files/0x0009000000016ccd-77.dat family_berbew behavioral1/files/0x0009000000016ccd-75.dat family_berbew behavioral1/memory/2748-63-0x00000000002E0000-0x0000000000325000-memory.dmp family_berbew behavioral1/memory/1500-82-0x0000000000400000-0x0000000000445000-memory.dmp family_berbew behavioral1/files/0x0009000000016ccd-83.dat family_berbew behavioral1/memory/1500-90-0x00000000002D0000-0x0000000000315000-memory.dmp family_berbew behavioral1/files/0x0006000000016d00-88.dat family_berbew behavioral1/files/0x0006000000016d00-95.dat family_berbew behavioral1/files/0x0006000000016d00-97.dat family_berbew behavioral1/memory/1996-96-0x0000000000400000-0x0000000000445000-memory.dmp family_berbew behavioral1/files/0x0006000000016d00-92.dat family_berbew behavioral1/files/0x0006000000016d00-91.dat family_berbew behavioral1/files/0x0006000000016d2d-102.dat family_berbew behavioral1/files/0x0006000000016d2d-105.dat family_berbew behavioral1/files/0x0006000000016d2d-104.dat family_berbew behavioral1/files/0x0006000000016d2d-109.dat family_berbew behavioral1/files/0x0006000000016d2d-108.dat family_berbew behavioral1/files/0x0006000000016d50-114.dat family_berbew behavioral1/files/0x0006000000016d50-116.dat family_berbew behavioral1/files/0x0006000000016d50-117.dat family_berbew behavioral1/files/0x0006000000016d50-121.dat family_berbew behavioral1/files/0x0006000000016d50-120.dat family_berbew behavioral1/files/0x0006000000016d6d-129.dat family_berbew behavioral1/files/0x0006000000016fd4-134.dat family_berbew behavioral1/files/0x0006000000016fd4-140.dat family_berbew behavioral1/files/0x0006000000016fd4-145.dat family_berbew behavioral1/files/0x0006000000016fd4-144.dat family_berbew behavioral1/files/0x0006000000016d6d-133.dat family_berbew behavioral1/files/0x0006000000016d6d-132.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2544 Adcakdhn.exe 2464 Kicednho.exe 1328 Kgibeklf.exe 2748 Laccdp32.exe 2980 Lmmaoq32.exe 1500 Ncplfj32.exe 1996 Nknmplji.exe 1728 Nhbnjpic.exe 1628 Oamohenq.exe 1544 Oqaliabh.exe 1600 Pafacd32.exe 2092 Qjofljho.exe 840 Aamhdckg.exe 2324 Amdhidqk.exe 3048 Bmdehgcf.exe 2100 Bkheal32.exe 1368 Bgablmfa.exe 1960 Cpigeblb.exe 992 Lcgldc32.exe 1472 Kbpbokop.exe 1704 Epdafl32.exe 3012 Jjfplfll.exe 2616 Jeldiolb.exe 1768 Kgdgaflh.exe 1064 Kpmkjlbi.exe 2144 Kiepca32.exe 2224 Kobhkh32.exe 2524 Lelphbon.exe 1320 Lpadek32.exe 1572 Lhmijn32.exe 2488 Lofafhck.exe 2552 Mofnek32.exe 2028 Mjlbcd32.exe 1616 Mqfjpnmj.exe 588 Mbgggf32.exe 2960 Mmmkdo32.exe 1312 Mcfcai32.exe 1916 Mfepmd32.exe 1044 Nomdfjpo.exe 564 Nopqlj32.exe 2732 Ndmidq32.exe 952 Nbqjne32.exe 2032 Ncafemqk.exe 2308 Nngjbfpa.exe 3044 Ngpokkgb.exe 1856 Opkcpndm.exe 1160 Plmdqmpd.exe 2348 Pmophe32.exe 1140 Pefhib32.exe 756 Pfgeaklb.exe 1656 Palincli.exe 2176 Pihnbf32.exe 2416 Ppafopqq.exe 2972 Pijjhf32.exe 628 Pdpoeo32.exe 1048 Qilgneen.exe 2264 Aaobcg32.exe 2288 Aobblkkk.exe 2100 Ajlcmigj.exe 888 Aacknfhl.exe 2344 Agpdfmfc.exe 1936 Bphhobmd.exe 1944 Bfeqgikk.exe 2760 Bciaqnje.exe -
Loads dropped DLL 64 IoCs
pid Process 2512 NEAS.eca9d072fc3f6c60281d0755a660a4a0.exe 2512 NEAS.eca9d072fc3f6c60281d0755a660a4a0.exe 2544 Adcakdhn.exe 2544 Adcakdhn.exe 2464 Kicednho.exe 2464 Kicednho.exe 1328 Kgibeklf.exe 1328 Kgibeklf.exe 2748 Laccdp32.exe 2748 Laccdp32.exe 2980 Lmmaoq32.exe 2980 Lmmaoq32.exe 1500 Ncplfj32.exe 1500 Ncplfj32.exe 1996 Nknmplji.exe 1996 Nknmplji.exe 1728 Nhbnjpic.exe 1728 Nhbnjpic.exe 1628 Oamohenq.exe 1628 Oamohenq.exe 1544 Oqaliabh.exe 1544 Oqaliabh.exe 1600 Pafacd32.exe 1600 Pafacd32.exe 2092 Qjofljho.exe 2092 Qjofljho.exe 840 Aamhdckg.exe 840 Aamhdckg.exe 2324 Amdhidqk.exe 2324 Amdhidqk.exe 3048 Bmdehgcf.exe 3048 Bmdehgcf.exe 2100 Bkheal32.exe 2100 Bkheal32.exe 1368 Bgablmfa.exe 1368 Bgablmfa.exe 1960 Cpigeblb.exe 1960 Cpigeblb.exe 992 Lcgldc32.exe 992 Lcgldc32.exe 1472 Kbpbokop.exe 1472 Kbpbokop.exe 1704 Epdafl32.exe 1704 Epdafl32.exe 3012 Jjfplfll.exe 3012 Jjfplfll.exe 2616 Jeldiolb.exe 2616 Jeldiolb.exe 1768 Kgdgaflh.exe 1768 Kgdgaflh.exe 1064 Kpmkjlbi.exe 1064 Kpmkjlbi.exe 2144 Kiepca32.exe 2144 Kiepca32.exe 2224 Kobhkh32.exe 2224 Kobhkh32.exe 2524 Lelphbon.exe 2524 Lelphbon.exe 1320 Lpadek32.exe 1320 Lpadek32.exe 1572 Lhmijn32.exe 1572 Lhmijn32.exe 2488 Lofafhck.exe 2488 Lofafhck.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Ekpimg32.exe Edeapm32.exe File created C:\Windows\SysWOW64\Jmibldle.exe Mclgjh32.exe File created C:\Windows\SysWOW64\Jooholnn.exe Jefcffgm.exe File created C:\Windows\SysWOW64\Dpjiakdq.exe Dkmqhdfi.exe File created C:\Windows\SysWOW64\Foggopfh.dll Ehldflkd.exe File created C:\Windows\SysWOW64\Jpikmoif.exe Jhbclbhc.exe File created C:\Windows\SysWOW64\Nlafli32.dll Lhffnloe.exe File opened for modification C:\Windows\SysWOW64\Lifepg32.exe Laomoj32.exe File created C:\Windows\SysWOW64\Olcjbd32.exe Oidmei32.exe File opened for modification C:\Windows\SysWOW64\Pnhloo32.exe Pepgfi32.exe File created C:\Windows\SysWOW64\Ofhefe32.dll Laccdp32.exe File opened for modification C:\Windows\SysWOW64\Bgablmfa.exe Bkheal32.exe File created C:\Windows\SysWOW64\Oejllo32.dll Bciaqnje.exe File opened for modification C:\Windows\SysWOW64\Ghffal32.exe Gnnbhf32.exe File opened for modification C:\Windows\SysWOW64\Nfalpkbg.exe Nklgbb32.exe File opened for modification C:\Windows\SysWOW64\Ppcomb32.exe Piigqhlk.exe File created C:\Windows\SysWOW64\Hdjchlqo.dll Kgibeklf.exe File created C:\Windows\SysWOW64\Egaqgi32.exe Enilncik.exe File created C:\Windows\SysWOW64\Cihmofok.dll Edeapm32.exe File created C:\Windows\SysWOW64\Nlcobg32.dll Jefcffgm.exe File opened for modification C:\Windows\SysWOW64\Klbhhpmg.exe Kdkqgble.exe File created C:\Windows\SysWOW64\Hicbdbjb.exe Hdfjlklk.exe File created C:\Windows\SysWOW64\Dkpdkmkl.dll Hdfjlklk.exe File created C:\Windows\SysWOW64\Nbhbel32.dll Ipmgppdk.exe File opened for modification C:\Windows\SysWOW64\Icnpbkal.exe Ialcjb32.exe File created C:\Windows\SysWOW64\Eqqgkm32.dll NEAS.eca9d072fc3f6c60281d0755a660a4a0.exe File created C:\Windows\SysWOW64\Aelinh32.dll Dpjiakdq.exe File created C:\Windows\SysWOW64\Ecgeaa32.dll Mpickf32.exe File opened for modification C:\Windows\SysWOW64\Olcjbd32.exe Oidmei32.exe File created C:\Windows\SysWOW64\Ghgfppka.dll Oqaliabh.exe File opened for modification C:\Windows\SysWOW64\Epdafl32.exe Kbpbokop.exe File created C:\Windows\SysWOW64\Djhjohnf.dll Jhbclbhc.exe File opened for modification C:\Windows\SysWOW64\Khiima32.exe Klbhhpmg.exe File created C:\Windows\SysWOW64\Agpdfmfc.exe Aacknfhl.exe File created C:\Windows\SysWOW64\Clffqi32.dll Jpikmoif.exe File created C:\Windows\SysWOW64\Aedmpl32.exe Aojecbhi.exe File created C:\Windows\SysWOW64\Jenicf32.exe Jcpmgj32.exe File created C:\Windows\SysWOW64\Fpaanmid.dll Nknmplji.exe File created C:\Windows\SysWOW64\Gfcjdphk.dll Pdpoeo32.exe File created C:\Windows\SysWOW64\Bjphhcon.exe Bhallgpj.exe File created C:\Windows\SysWOW64\Cbphkini.dll Begikk32.exe File created C:\Windows\SysWOW64\Nbbihj32.dll Ajlcmigj.exe File opened for modification C:\Windows\SysWOW64\Ncoenpff.exe Bfhnmiii.exe File created C:\Windows\SysWOW64\Ikgceiae.dll Mclgjh32.exe File created C:\Windows\SysWOW64\Jhbclbhc.exe Jnjocl32.exe File created C:\Windows\SysWOW64\Pihnbf32.exe Palincli.exe File created C:\Windows\SysWOW64\Dabojoak.exe Dgmkmfae.exe File opened for modification C:\Windows\SysWOW64\Dkmqhdfi.exe Ddchlj32.exe File created C:\Windows\SysWOW64\Knakpc32.dll Aljlag32.exe File opened for modification C:\Windows\SysWOW64\Ndmidq32.exe Nopqlj32.exe File created C:\Windows\SysWOW64\Hmlapa32.exe Hhpigjfg.exe File opened for modification C:\Windows\SysWOW64\Nnmpdmpb.exe Nhphlfak.exe File created C:\Windows\SysWOW64\Bkllpjff.dll Loejnn32.exe File created C:\Windows\SysWOW64\Nklgbb32.exe Mjkkjjlb.exe File opened for modification C:\Windows\SysWOW64\Nkcmca32.exe Nqniehmc.exe File opened for modification C:\Windows\SysWOW64\Jpikmoif.exe Jhbclbhc.exe File created C:\Windows\SysWOW64\Lofafhck.exe Lhmijn32.exe File created C:\Windows\SysWOW64\Fjclbfdd.dll Mmmkdo32.exe File created C:\Windows\SysWOW64\Cmhlcc32.dll Dgphbfoc.exe File created C:\Windows\SysWOW64\Dfgaibbh.exe Dpjiakdq.exe File created C:\Windows\SysWOW64\Nnmpdmpb.exe Nhphlfak.exe File created C:\Windows\SysWOW64\Nqniehmc.exe Nolmnp32.exe File created C:\Windows\SysWOW64\Hdapig32.dll Nqniehmc.exe File created C:\Windows\SysWOW64\Ejeefgcg.dll Pepgfi32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pafacd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Plmdqmpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dihpib32.dll" Qlgolg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lgqobpgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Offain32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ndmidq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fbiajano.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Opqbhc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Abcdnabd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Aojecbhi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlpnhnoo.dll" Aamhdckg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dfgaibbh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ogadha32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ndghqg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kennjioc.dll" Nhbnjpic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bifnjgkg.dll" Lelphbon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fnpbob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dnefdqke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ilfdkp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkinjiah.dll" Jjlajddc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lkgahpdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Daedpf32.dll" Pafacd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnfnomon.dll" Epdafl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dnefdqke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fcmkgi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qjofljho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibbbhe32.dll" Amdhidqk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bciaqnje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ekpimg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Popppemc.dll" Pefhib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Qilgneen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dgphbfoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgfnfakg.dll" Cbbcmdfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqblgmja.dll" Omkpkh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Alligf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Amdhidqk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mmmkdo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igfghkne.dll" Pfgeaklb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bphhobmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nhphlfak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkgfbp32.dll" Bphhobmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcajgh32.dll" Gjlinfgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hmlapa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbhdaaae.dll" Mfepmd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fncclk32.dll" Khiima32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adedghlc.dll" Olcjbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkbjgp32.dll" Bmdehgcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pmophe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ilfdkp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cbbcmdfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elnhln32.dll" Ghffal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aheoohdh.dll" Hicbdbjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icogicoo.dll" Icnpbkal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Laajej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmfgjl32.dll" Adcakdhn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mcfcai32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Plmdqmpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkllpjff.dll" Loejnn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nolmnp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Daelpooi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhkgddoa.dll" Nfalpkbg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Aamhdckg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lofafhck.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Opkcpndm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2544 2512 NEAS.eca9d072fc3f6c60281d0755a660a4a0.exe 27 PID 2512 wrote to memory of 2544 2512 NEAS.eca9d072fc3f6c60281d0755a660a4a0.exe 27 PID 2512 wrote to memory of 2544 2512 NEAS.eca9d072fc3f6c60281d0755a660a4a0.exe 27 PID 2512 wrote to memory of 2544 2512 NEAS.eca9d072fc3f6c60281d0755a660a4a0.exe 27 PID 2544 wrote to memory of 2464 2544 Adcakdhn.exe 28 PID 2544 wrote to memory of 2464 2544 Adcakdhn.exe 28 PID 2544 wrote to memory of 2464 2544 Adcakdhn.exe 28 PID 2544 wrote to memory of 2464 2544 Adcakdhn.exe 28 PID 2464 wrote to memory of 1328 2464 Kicednho.exe 29 PID 2464 wrote to memory of 1328 2464 Kicednho.exe 29 PID 2464 wrote to memory of 1328 2464 Kicednho.exe 29 PID 2464 wrote to memory of 1328 2464 Kicednho.exe 29 PID 1328 wrote to memory of 2748 1328 Kgibeklf.exe 30 PID 1328 wrote to memory of 2748 1328 Kgibeklf.exe 30 PID 1328 wrote to memory of 2748 1328 Kgibeklf.exe 30 PID 1328 wrote to memory of 2748 1328 Kgibeklf.exe 30 PID 2748 wrote to memory of 2980 2748 Laccdp32.exe 31 PID 2748 wrote to memory of 2980 2748 Laccdp32.exe 31 PID 2748 wrote to memory of 2980 2748 Laccdp32.exe 31 PID 2748 wrote to memory of 2980 2748 Laccdp32.exe 31 PID 2980 wrote to memory of 1500 2980 Lmmaoq32.exe 32 PID 2980 wrote to memory of 1500 2980 Lmmaoq32.exe 32 PID 2980 wrote to memory of 1500 2980 Lmmaoq32.exe 32 PID 2980 wrote to memory of 1500 2980 Lmmaoq32.exe 32 PID 1500 wrote to memory of 1996 1500 Ncplfj32.exe 33 PID 1500 wrote to memory of 1996 1500 Ncplfj32.exe 33 PID 1500 wrote to memory of 1996 1500 Ncplfj32.exe 33 PID 1500 wrote to memory of 1996 1500 Ncplfj32.exe 33 PID 1996 wrote to memory of 1728 1996 Nknmplji.exe 34 PID 1996 wrote to memory of 1728 1996 Nknmplji.exe 34 PID 1996 wrote to memory of 1728 1996 Nknmplji.exe 34 PID 1996 wrote to memory of 1728 1996 Nknmplji.exe 34 PID 1728 wrote to memory of 1628 1728 Nhbnjpic.exe 35 PID 1728 wrote to memory of 1628 1728 Nhbnjpic.exe 35 PID 1728 wrote to memory of 1628 1728 Nhbnjpic.exe 35 PID 1728 wrote to memory of 1628 1728 Nhbnjpic.exe 35 PID 1628 wrote to memory of 1544 1628 Oamohenq.exe 36 PID 1628 wrote to memory of 1544 1628 Oamohenq.exe 36 PID 1628 wrote to memory of 1544 1628 Oamohenq.exe 36 PID 1628 wrote to memory of 1544 1628 Oamohenq.exe 36 PID 1544 wrote to memory of 1600 1544 Oqaliabh.exe 37 PID 1544 wrote to memory of 1600 1544 Oqaliabh.exe 37 PID 1544 wrote to memory of 1600 1544 Oqaliabh.exe 37 PID 1544 wrote to memory of 1600 1544 Oqaliabh.exe 37 PID 1600 wrote to memory of 2092 1600 Pafacd32.exe 38 PID 1600 wrote to memory of 2092 1600 Pafacd32.exe 38 PID 1600 wrote to memory of 2092 1600 Pafacd32.exe 38 PID 1600 wrote to memory of 2092 1600 Pafacd32.exe 38 PID 2092 wrote to memory of 840 2092 Qjofljho.exe 39 PID 2092 wrote to memory of 840 2092 Qjofljho.exe 39 PID 2092 wrote to memory of 840 2092 Qjofljho.exe 39 PID 2092 wrote to memory of 840 2092 Qjofljho.exe 39 PID 840 wrote to memory of 2324 840 Aamhdckg.exe 40 PID 840 wrote to memory of 2324 840 Aamhdckg.exe 40 PID 840 wrote to memory of 2324 840 Aamhdckg.exe 40 PID 840 wrote to memory of 2324 840 Aamhdckg.exe 40 PID 2324 wrote to memory of 3048 2324 Amdhidqk.exe 41 PID 2324 wrote to memory of 3048 2324 Amdhidqk.exe 41 PID 2324 wrote to memory of 3048 2324 Amdhidqk.exe 41 PID 2324 wrote to memory of 3048 2324 Amdhidqk.exe 41 PID 3048 wrote to memory of 2100 3048 Bmdehgcf.exe 42 PID 3048 wrote to memory of 2100 3048 Bmdehgcf.exe 42 PID 3048 wrote to memory of 2100 3048 Bmdehgcf.exe 42 PID 3048 wrote to memory of 2100 3048 Bmdehgcf.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.eca9d072fc3f6c60281d0755a660a4a0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.eca9d072fc3f6c60281d0755a660a4a0.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\Adcakdhn.exeC:\Windows\system32\Adcakdhn.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\Kicednho.exeC:\Windows\system32\Kicednho.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\Kgibeklf.exeC:\Windows\system32\Kgibeklf.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\Laccdp32.exeC:\Windows\system32\Laccdp32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\Lmmaoq32.exeC:\Windows\system32\Lmmaoq32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\Ncplfj32.exeC:\Windows\system32\Ncplfj32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\Nknmplji.exeC:\Windows\system32\Nknmplji.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\Nhbnjpic.exeC:\Windows\system32\Nhbnjpic.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\Oamohenq.exeC:\Windows\system32\Oamohenq.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\Oqaliabh.exeC:\Windows\system32\Oqaliabh.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\Pafacd32.exeC:\Windows\system32\Pafacd32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\Qjofljho.exeC:\Windows\system32\Qjofljho.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\Aamhdckg.exeC:\Windows\system32\Aamhdckg.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\Amdhidqk.exeC:\Windows\system32\Amdhidqk.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\Bmdehgcf.exeC:\Windows\system32\Bmdehgcf.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\Bkheal32.exeC:\Windows\system32\Bkheal32.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2100 -
C:\Windows\SysWOW64\Bgablmfa.exeC:\Windows\system32\Bgablmfa.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Windows\SysWOW64\Cpigeblb.exeC:\Windows\system32\Cpigeblb.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Windows\SysWOW64\Lcgldc32.exeC:\Windows\system32\Lcgldc32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Windows\SysWOW64\Kbpbokop.exeC:\Windows\system32\Kbpbokop.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1472 -
C:\Windows\SysWOW64\Epdafl32.exeC:\Windows\system32\Epdafl32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1704 -
C:\Windows\SysWOW64\Jjfplfll.exeC:\Windows\system32\Jjfplfll.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Windows\SysWOW64\Jeldiolb.exeC:\Windows\system32\Jeldiolb.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Windows\SysWOW64\Kgdgaflh.exeC:\Windows\system32\Kgdgaflh.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Windows\SysWOW64\Kpmkjlbi.exeC:\Windows\system32\Kpmkjlbi.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Windows\SysWOW64\Kiepca32.exeC:\Windows\system32\Kiepca32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Windows\SysWOW64\Kobhkh32.exeC:\Windows\system32\Kobhkh32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Windows\SysWOW64\Lelphbon.exeC:\Windows\system32\Lelphbon.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2524 -
C:\Windows\SysWOW64\Lpadek32.exeC:\Windows\system32\Lpadek32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Windows\SysWOW64\Lhmijn32.exeC:\Windows\system32\Lhmijn32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1572 -
C:\Windows\SysWOW64\Lofafhck.exeC:\Windows\system32\Lofafhck.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2488 -
C:\Windows\SysWOW64\Mofnek32.exeC:\Windows\system32\Mofnek32.exe33⤵
- Executes dropped EXE
PID:2552 -
C:\Windows\SysWOW64\Mjlbcd32.exeC:\Windows\system32\Mjlbcd32.exe34⤵
- Executes dropped EXE
PID:2028 -
C:\Windows\SysWOW64\Mqfjpnmj.exeC:\Windows\system32\Mqfjpnmj.exe35⤵
- Executes dropped EXE
PID:1616 -
C:\Windows\SysWOW64\Mbgggf32.exeC:\Windows\system32\Mbgggf32.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:588 -
C:\Windows\SysWOW64\Mmmkdo32.exeC:\Windows\system32\Mmmkdo32.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2960 -
C:\Windows\SysWOW64\Mcfcai32.exeC:\Windows\system32\Mcfcai32.exe38⤵
- Executes dropped EXE
- Modifies registry class
PID:1312 -
C:\Windows\SysWOW64\Mfepmd32.exeC:\Windows\system32\Mfepmd32.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1916 -
C:\Windows\SysWOW64\Nomdfjpo.exeC:\Windows\system32\Nomdfjpo.exe40⤵
- Executes dropped EXE
PID:1044 -
C:\Windows\SysWOW64\Nopqlj32.exeC:\Windows\system32\Nopqlj32.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:564 -
C:\Windows\SysWOW64\Ndmidq32.exeC:\Windows\system32\Ndmidq32.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2732 -
C:\Windows\SysWOW64\Nbqjne32.exeC:\Windows\system32\Nbqjne32.exe43⤵
- Executes dropped EXE
PID:952 -
C:\Windows\SysWOW64\Ncafemqk.exeC:\Windows\system32\Ncafemqk.exe44⤵
- Executes dropped EXE
PID:2032 -
C:\Windows\SysWOW64\Nngjbfpa.exeC:\Windows\system32\Nngjbfpa.exe45⤵
- Executes dropped EXE
PID:2308 -
C:\Windows\SysWOW64\Ngpokkgb.exeC:\Windows\system32\Ngpokkgb.exe46⤵
- Executes dropped EXE
PID:3044 -
C:\Windows\SysWOW64\Opkcpndm.exeC:\Windows\system32\Opkcpndm.exe47⤵
- Executes dropped EXE
- Modifies registry class
PID:1856 -
C:\Windows\SysWOW64\Plmdqmpd.exeC:\Windows\system32\Plmdqmpd.exe48⤵
- Executes dropped EXE
- Modifies registry class
PID:1160 -
C:\Windows\SysWOW64\Pmophe32.exeC:\Windows\system32\Pmophe32.exe49⤵
- Executes dropped EXE
- Modifies registry class
PID:2348 -
C:\Windows\SysWOW64\Pefhib32.exeC:\Windows\system32\Pefhib32.exe50⤵
- Executes dropped EXE
- Modifies registry class
PID:1140 -
C:\Windows\SysWOW64\Pfgeaklb.exeC:\Windows\system32\Pfgeaklb.exe51⤵
- Executes dropped EXE
- Modifies registry class
PID:756 -
C:\Windows\SysWOW64\Palincli.exeC:\Windows\system32\Palincli.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1656 -
C:\Windows\SysWOW64\Pihnbf32.exeC:\Windows\system32\Pihnbf32.exe53⤵
- Executes dropped EXE
PID:2176 -
C:\Windows\SysWOW64\Ppafopqq.exeC:\Windows\system32\Ppafopqq.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2416 -
C:\Windows\SysWOW64\Pijjhf32.exeC:\Windows\system32\Pijjhf32.exe55⤵
- Executes dropped EXE
PID:2972 -
C:\Windows\SysWOW64\Pdpoeo32.exeC:\Windows\system32\Pdpoeo32.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:628 -
C:\Windows\SysWOW64\Qilgneen.exeC:\Windows\system32\Qilgneen.exe57⤵
- Executes dropped EXE
- Modifies registry class
PID:1048 -
C:\Windows\SysWOW64\Aaobcg32.exeC:\Windows\system32\Aaobcg32.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2264 -
C:\Windows\SysWOW64\Aobblkkk.exeC:\Windows\system32\Aobblkkk.exe59⤵
- Executes dropped EXE
PID:2288 -
C:\Windows\SysWOW64\Ajlcmigj.exeC:\Windows\system32\Ajlcmigj.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2100 -
C:\Windows\SysWOW64\Aacknfhl.exeC:\Windows\system32\Aacknfhl.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:888 -
C:\Windows\SysWOW64\Agpdfmfc.exeC:\Windows\system32\Agpdfmfc.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2344 -
C:\Windows\SysWOW64\Bphhobmd.exeC:\Windows\system32\Bphhobmd.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1936 -
C:\Windows\SysWOW64\Bfeqgikk.exeC:\Windows\system32\Bfeqgikk.exe64⤵
- Executes dropped EXE
PID:1944 -
C:\Windows\SysWOW64\Bciaqnje.exeC:\Windows\system32\Bciaqnje.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2760 -
C:\Windows\SysWOW64\Bfhnmiii.exeC:\Windows\system32\Bfhnmiii.exe66⤵
- Drops file in System32 directory
PID:1124 -
C:\Windows\SysWOW64\Ncoenpff.exeC:\Windows\system32\Ncoenpff.exe67⤵PID:856
-
C:\Windows\SysWOW64\Bhallgpj.exeC:\Windows\system32\Bhallgpj.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:592 -
C:\Windows\SysWOW64\Bjphhcon.exeC:\Windows\system32\Bjphhcon.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:268 -
C:\Windows\SysWOW64\Begikk32.exeC:\Windows\system32\Begikk32.exe70⤵
- Drops file in System32 directory
PID:2228 -
C:\Windows\SysWOW64\Bkdacb32.exeC:\Windows\system32\Bkdacb32.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2116 -
C:\Windows\SysWOW64\Biindo32.exeC:\Windows\system32\Biindo32.exe72⤵PID:1068
-
C:\Windows\SysWOW64\Cbbcmdfa.exeC:\Windows\system32\Cbbcmdfa.exe73⤵
- Modifies registry class
PID:2724 -
C:\Windows\SysWOW64\Cpfcgh32.exeC:\Windows\system32\Cpfcgh32.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1400 -
C:\Windows\SysWOW64\Cinhpnlk.exeC:\Windows\system32\Cinhpnlk.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2928 -
C:\Windows\SysWOW64\Cphplh32.exeC:\Windows\system32\Cphplh32.exe76⤵PID:2076
-
C:\Windows\SysWOW64\Chhnljmn.exeC:\Windows\system32\Chhnljmn.exe77⤵PID:1808
-
C:\Windows\SysWOW64\Dnefdqke.exeC:\Windows\system32\Dnefdqke.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:648 -
C:\Windows\SysWOW64\Dgmkmfae.exeC:\Windows\system32\Dgmkmfae.exe79⤵
- Drops file in System32 directory
PID:2060 -
C:\Windows\SysWOW64\Dabojoak.exeC:\Windows\system32\Dabojoak.exe80⤵PID:1520
-
C:\Windows\SysWOW64\Dgphbfoc.exeC:\Windows\system32\Dgphbfoc.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2400 -
C:\Windows\SysWOW64\Daelpooi.exeC:\Windows\system32\Daelpooi.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:304 -
C:\Windows\SysWOW64\Ddchlj32.exeC:\Windows\system32\Ddchlj32.exe83⤵
- Drops file in System32 directory
PID:1788 -
C:\Windows\SysWOW64\Dkmqhdfi.exeC:\Windows\system32\Dkmqhdfi.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2844 -
C:\Windows\SysWOW64\Dpjiakdq.exeC:\Windows\system32\Dpjiakdq.exe85⤵
- Drops file in System32 directory
PID:2752 -
C:\Windows\SysWOW64\Dfgaibbh.exeC:\Windows\system32\Dfgaibbh.exe86⤵
- Modifies registry class
PID:1628 -
C:\Windows\SysWOW64\Eqoblj32.exeC:\Windows\system32\Eqoblj32.exe87⤵PID:3048
-
C:\Windows\SysWOW64\Ehldflkd.exeC:\Windows\system32\Ehldflkd.exe88⤵
- Drops file in System32 directory
PID:2352 -
C:\Windows\SysWOW64\Enilncik.exeC:\Windows\system32\Enilncik.exe89⤵
- Drops file in System32 directory
PID:2740 -
C:\Windows\SysWOW64\Egaqgi32.exeC:\Windows\system32\Egaqgi32.exe90⤵PID:240
-
C:\Windows\SysWOW64\Ebgeda32.exeC:\Windows\system32\Ebgeda32.exe91⤵PID:2592
-
C:\Windows\SysWOW64\Edeapm32.exeC:\Windows\system32\Edeapm32.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2768 -
C:\Windows\SysWOW64\Ekpimg32.exeC:\Windows\system32\Ekpimg32.exe93⤵
- Modifies registry class
PID:2148 -
C:\Windows\SysWOW64\Fbiajano.exeC:\Windows\system32\Fbiajano.exe94⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2444 -
C:\Windows\SysWOW64\Fcknai32.exeC:\Windows\system32\Fcknai32.exe95⤵PID:2896
-
C:\Windows\SysWOW64\Fnpbob32.exeC:\Windows\system32\Fnpbob32.exe96⤵
- Modifies registry class
PID:2144 -
C:\Windows\SysWOW64\Fcmkgi32.exeC:\Windows\system32\Fcmkgi32.exe97⤵
- Modifies registry class
PID:924 -
C:\Windows\SysWOW64\Ffkgcdqn.exeC:\Windows\system32\Ffkgcdqn.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2996 -
C:\Windows\SysWOW64\Gnnbhf32.exeC:\Windows\system32\Gnnbhf32.exe99⤵
- Drops file in System32 directory
PID:2960 -
C:\Windows\SysWOW64\Ghffal32.exeC:\Windows\system32\Ghffal32.exe100⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1916 -
C:\Windows\SysWOW64\Gaokjaeb.exeC:\Windows\system32\Gaokjaeb.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2536 -
C:\Windows\SysWOW64\Gjgobg32.exeC:\Windows\system32\Gjgobg32.exe102⤵PID:2976
-
C:\Windows\SysWOW64\Gelcpp32.exeC:\Windows\system32\Gelcpp32.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1924 -
C:\Windows\SysWOW64\Gjilhfip.exeC:\Windows\system32\Gjilhfip.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2508 -
C:\Windows\SysWOW64\Gacdeq32.exeC:\Windows\system32\Gacdeq32.exe105⤵PID:2484
-
C:\Windows\SysWOW64\Gjlinfgm.exeC:\Windows\system32\Gjlinfgm.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1264 -
C:\Windows\SysWOW64\Gmjejafa.exeC:\Windows\system32\Gmjejafa.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:528 -
C:\Windows\SysWOW64\Hhpigjfg.exeC:\Windows\system32\Hhpigjfg.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2288 -
C:\Windows\SysWOW64\Hmlapa32.exeC:\Windows\system32\Hmlapa32.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2720 -
C:\Windows\SysWOW64\Hdfjlklk.exeC:\Windows\system32\Hdfjlklk.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2872 -
C:\Windows\SysWOW64\Hicbdbjb.exeC:\Windows\system32\Hicbdbjb.exe111⤵
- Modifies registry class
PID:2344 -
C:\Windows\SysWOW64\Ipmgppdk.exeC:\Windows\system32\Ipmgppdk.exe112⤵
- Drops file in System32 directory
PID:2704 -
C:\Windows\SysWOW64\Ikbkmhda.exeC:\Windows\system32\Ikbkmhda.exe113⤵PID:2004
-
C:\Windows\SysWOW64\Ialcjb32.exeC:\Windows\system32\Ialcjb32.exe114⤵
- Drops file in System32 directory
PID:2056 -
C:\Windows\SysWOW64\Icnpbkal.exeC:\Windows\system32\Icnpbkal.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1052 -
C:\Windows\SysWOW64\Ilfdkp32.exeC:\Windows\system32\Ilfdkp32.exe116⤵
- Modifies registry class
PID:2372 -
C:\Windows\SysWOW64\Jcpmgj32.exeC:\Windows\system32\Jcpmgj32.exe117⤵
- Drops file in System32 directory
PID:112 -
C:\Windows\SysWOW64\Jenicf32.exeC:\Windows\system32\Jenicf32.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2124 -
C:\Windows\SysWOW64\Jogmlken.exeC:\Windows\system32\Jogmlken.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:988 -
C:\Windows\SysWOW64\Jjlajddc.exeC:\Windows\system32\Jjlajddc.exe120⤵
- Modifies registry class
PID:1868 -
C:\Windows\SysWOW64\Lhffnloe.exeC:\Windows\system32\Lhffnloe.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-