Analysis
-
max time kernel
241s -
max time network
284s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
28/10/2023, 20:18
Behavioral task
behavioral1
Sample
NEAS.ef42a349950a77b7a3333bc217b83650.exe
Resource
win7-20231023-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.ef42a349950a77b7a3333bc217b83650.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
NEAS.ef42a349950a77b7a3333bc217b83650.exe
-
Size
398KB
-
MD5
ef42a349950a77b7a3333bc217b83650
-
SHA1
3e2dcbabcecbb696fab292c1d7930d672caee7b7
-
SHA256
927430e305698e1bb9246eb542c0ac23e34162d7bc665b1a4bb51880ee46b34c
-
SHA512
4043b320214520c3bbea3cfdc48d5e319b4ec256072b1d0b9ac5a827c98a44d23543e3cd22ee16cae4bd0861bb4c842f47b396e96e31b4d127098cbb01f5e207
-
SSDEEP
12288:XBhxL6t3XGCByvNv54B9f01ZmHByvNv5imipWf0Aq:X5L6t3XGpvr4B9f01ZmQvrimipWf0Aq
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Iegaha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hfbeaiaj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfnmhnhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ikfffh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qjnajl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Flgfhmdf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hahdjfqc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlccmcna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mlhmhb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fabcfhjk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hnbcqk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iegnaihm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldlphf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Djiegp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fhpdbmgg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkhqnoci.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnbcqk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Admlfida.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Enffedpn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lancqglp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Obbpio32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Adjoqjfc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipjeibjf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lnpkfmld.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iegaha32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kipafe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mffkdlpi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdclhcgl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hiqamepn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jbmkpm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bjqjoolp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fpqfcl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hcalpndi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Iffjklop.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnhmkohe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kbdmdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hanenoeh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmacqj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kfaeji32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlhmhb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kkmeob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cjlenm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ecdffe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ecdffe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pokndp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajidnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aqfiqjgb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ajnnipnc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmfikmhg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fbaoegkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Holedjom.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilafnc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bciohe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aiofln32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fikgaq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qjnajl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Geadee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hejoheco.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkmeob32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njnion32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbpendha.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbaoegkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fjlciihn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Njnion32.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x0004000000004ed7-5.dat family_berbew behavioral1/files/0x0004000000004ed7-8.dat family_berbew behavioral1/files/0x0004000000004ed7-11.dat family_berbew behavioral1/files/0x0004000000004ed7-12.dat family_berbew behavioral1/files/0x0004000000004ed7-13.dat family_berbew behavioral1/files/0x00080000000120ff-18.dat family_berbew behavioral1/files/0x00080000000120ff-21.dat family_berbew behavioral1/files/0x00080000000120ff-26.dat family_berbew behavioral1/files/0x00080000000120ff-24.dat family_berbew behavioral1/files/0x00080000000120ff-27.dat family_berbew behavioral1/files/0x0036000000015c6d-32.dat family_berbew behavioral1/files/0x0036000000015c6d-34.dat family_berbew behavioral1/files/0x0007000000015cf1-58.dat family_berbew behavioral1/files/0x0007000000015cf1-66.dat family_berbew behavioral1/files/0x0007000000015cf1-64.dat family_berbew behavioral1/files/0x0007000000015cf1-61.dat family_berbew behavioral1/files/0x0007000000015cf1-60.dat family_berbew behavioral1/files/0x0007000000015ca8-53.dat family_berbew behavioral1/files/0x0007000000015ca8-41.dat family_berbew behavioral1/files/0x0036000000015c6d-40.dat family_berbew behavioral1/files/0x0007000000015ca8-51.dat family_berbew behavioral1/files/0x0036000000015c6d-38.dat family_berbew behavioral1/files/0x0007000000015ca8-47.dat family_berbew behavioral1/files/0x0036000000015c6d-35.dat family_berbew behavioral1/files/0x0007000000015ca8-45.dat family_berbew behavioral1/files/0x0007000000015e7c-71.dat family_berbew behavioral1/files/0x0007000000015e7c-75.dat family_berbew behavioral1/files/0x0007000000015e7c-74.dat family_berbew behavioral1/files/0x0007000000015e7c-78.dat family_berbew behavioral1/files/0x0007000000015e7c-79.dat family_berbew behavioral1/files/0x000600000001656d-92.dat family_berbew behavioral1/files/0x000600000001656d-84.dat family_berbew behavioral1/files/0x000600000001656d-90.dat family_berbew behavioral1/files/0x000600000001656d-87.dat family_berbew behavioral1/files/0x000600000001656d-86.dat family_berbew behavioral1/files/0x0006000000016803-101.dat family_berbew behavioral1/files/0x0006000000016803-100.dat family_berbew behavioral1/files/0x0006000000016803-105.dat family_berbew behavioral1/files/0x0006000000016803-104.dat family_berbew behavioral1/files/0x0006000000016803-98.dat family_berbew behavioral1/files/0x0006000000016bf8-111.dat family_berbew behavioral1/files/0x0006000000016bf8-115.dat family_berbew behavioral1/files/0x0006000000016bf8-113.dat family_berbew behavioral1/files/0x0006000000016bf8-119.dat family_berbew behavioral1/files/0x0006000000016bf8-118.dat family_berbew behavioral1/files/0x0006000000016c1b-129.dat family_berbew behavioral1/files/0x0006000000016c1b-132.dat family_berbew behavioral1/files/0x0006000000016c1b-133.dat family_berbew behavioral1/files/0x0006000000016c1b-128.dat family_berbew behavioral1/files/0x0006000000016c1b-125.dat family_berbew behavioral1/files/0x0006000000016c8e-138.dat family_berbew behavioral1/files/0x0006000000016c8e-143.dat family_berbew behavioral1/files/0x0006000000016c8e-140.dat family_berbew behavioral1/files/0x0006000000016c8e-146.dat family_berbew behavioral1/files/0x0006000000016c8e-145.dat family_berbew behavioral1/files/0x0006000000016ccd-152.dat family_berbew behavioral1/files/0x0006000000016ccd-159.dat family_berbew behavioral1/files/0x0006000000016ccd-156.dat family_berbew behavioral1/files/0x0006000000016ccd-155.dat family_berbew behavioral1/files/0x0006000000016ccd-160.dat family_berbew behavioral1/files/0x0006000000016cdd-165.dat family_berbew behavioral1/files/0x0006000000016cdd-173.dat family_berbew behavioral1/files/0x0006000000016cdd-172.dat family_berbew behavioral1/files/0x0006000000016cdd-168.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2664 Chdjpl32.exe 2540 Blelpeoa.exe 2584 Bljeke32.exe 520 Cfnmhnhm.exe 2716 Cpcaeghc.exe 1696 Cjlenm32.exe 2792 Dopdgb32.exe 2772 Djiegp32.exe 2876 Ecdffe32.exe 1756 Faefim32.exe 1608 Fcfojhhh.exe 1688 Fhfdffll.exe 3024 Gbdobc32.exe 1888 Hanenoeh.exe 284 Hkkcbdhc.exe 2416 Hcghffen.exe 1540 Iegaha32.exe 1900 Ikfffh32.exe 908 Ifngiqlg.exe 1344 Injlmcib.exe 1840 Jqjdon32.exe 2620 Mcdkmg32.exe 2372 Naqkki32.exe 2120 Nndkdn32.exe 1400 Neocahbm.exe 2852 Nmjhejph.exe 1112 Njnion32.exe 2956 Ojpedn32.exe 2828 Odhjmc32.exe 1904 Opokbdhc.exe 2508 Opaggdfa.exe 788 Ohmllf32.exe 1660 Obbpio32.exe 2872 Pdfifg32.exe 1504 Pokndp32.exe 2776 Pgfbhb32.exe 784 Palgek32.exe 572 Pgionbbl.exe 940 Pcppbc32.exe 2480 Penlon32.exe 2212 Pcbmhb32.exe 2036 Peqidn32.exe 1892 Qcdinbdk.exe 440 Qjnajl32.exe 1532 Adjoqjfc.exe 1616 Akdgmd32.exe 1044 Admlfida.exe 2436 Ajidnp32.exe 2844 Aqfiqjgb.exe 3040 Ajnnipnc.exe 2584 Bgbncdmm.exe 2792 Bjqjoolp.exe 3024 Bciohe32.exe 1540 Bmacqj32.exe 1712 Bfjhippb.exe 2244 Cjbccb32.exe 2684 Camlpldf.exe 2248 Cgfdmf32.exe 1704 Cmclem32.exe 1992 Cbpendha.exe 2648 Cmfikmhg.exe 336 Dfnncb32.exe 1692 Dlkfli32.exe 1664 Doibhekc.exe -
Loads dropped DLL 64 IoCs
pid Process 2820 NEAS.ef42a349950a77b7a3333bc217b83650.exe 2820 NEAS.ef42a349950a77b7a3333bc217b83650.exe 2664 Chdjpl32.exe 2664 Chdjpl32.exe 2540 Blelpeoa.exe 2540 Blelpeoa.exe 2584 Bljeke32.exe 2584 Bljeke32.exe 520 Cfnmhnhm.exe 520 Cfnmhnhm.exe 2716 Cpcaeghc.exe 2716 Cpcaeghc.exe 1696 Cjlenm32.exe 1696 Cjlenm32.exe 2792 Dopdgb32.exe 2792 Dopdgb32.exe 2772 Djiegp32.exe 2772 Djiegp32.exe 2876 Ecdffe32.exe 2876 Ecdffe32.exe 1756 Faefim32.exe 1756 Faefim32.exe 1608 Fcfojhhh.exe 1608 Fcfojhhh.exe 1688 Fhfdffll.exe 1688 Fhfdffll.exe 3024 Gbdobc32.exe 3024 Gbdobc32.exe 1888 Hanenoeh.exe 1888 Hanenoeh.exe 284 Hkkcbdhc.exe 284 Hkkcbdhc.exe 2416 Hcghffen.exe 2416 Hcghffen.exe 1540 Iegaha32.exe 1540 Iegaha32.exe 1900 Ikfffh32.exe 1900 Ikfffh32.exe 908 Ifngiqlg.exe 908 Ifngiqlg.exe 1344 Injlmcib.exe 1344 Injlmcib.exe 1840 Jqjdon32.exe 1840 Jqjdon32.exe 2620 Mcdkmg32.exe 2620 Mcdkmg32.exe 2372 Naqkki32.exe 2372 Naqkki32.exe 2120 Nndkdn32.exe 2120 Nndkdn32.exe 1400 Neocahbm.exe 1400 Neocahbm.exe 2852 Nmjhejph.exe 2852 Nmjhejph.exe 1112 Njnion32.exe 1112 Njnion32.exe 2956 Ojpedn32.exe 2956 Ojpedn32.exe 2828 Odhjmc32.exe 2828 Odhjmc32.exe 1904 Opokbdhc.exe 1904 Opokbdhc.exe 2508 Opaggdfa.exe 2508 Opaggdfa.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Lqpkaonb.dll Hmjphd32.exe File created C:\Windows\SysWOW64\Lklhkj32.dll Hbiefjfn.exe File opened for modification C:\Windows\SysWOW64\Jqjdon32.exe Injlmcib.exe File created C:\Windows\SysWOW64\Akdgmd32.exe Adjoqjfc.exe File opened for modification C:\Windows\SysWOW64\Geogpemb.exe Gdnkhm32.exe File opened for modification C:\Windows\SysWOW64\Gpekmnmh.exe Geogpemb.exe File created C:\Windows\SysWOW64\Cnlmqook.dll Gpekmnmh.exe File created C:\Windows\SysWOW64\Nqqjmmgj.dll Iipmlh32.exe File created C:\Windows\SysWOW64\Jfkdic32.dll Iegnaihm.exe File opened for modification C:\Windows\SysWOW64\Blelpeoa.exe Chdjpl32.exe File created C:\Windows\SysWOW64\Gqebij32.dll Fcfojhhh.exe File created C:\Windows\SysWOW64\Mokfkini.dll Ajnnipnc.exe File opened for modification C:\Windows\SysWOW64\Camlpldf.exe Cjbccb32.exe File created C:\Windows\SysWOW64\Ccknke32.dll Holedjom.exe File opened for modification C:\Windows\SysWOW64\Gjpdpjec.exe Fdclhcgl.exe File created C:\Windows\SysWOW64\Lneeal32.exe Ldlphf32.exe File created C:\Windows\SysWOW64\Obiaedmf.dll Pdfifg32.exe File created C:\Windows\SysWOW64\Elpcmbbe.dll Nnhmkohe.exe File created C:\Windows\SysWOW64\Aqileo32.dll Fpqfcl32.exe File opened for modification C:\Windows\SysWOW64\Jnnphadg.exe Nkmfhb32.exe File created C:\Windows\SysWOW64\Hejoheco.exe Hbkbljdl.exe File opened for modification C:\Windows\SysWOW64\Hipmlcae.exe Hahdjfqc.exe File opened for modification C:\Windows\SysWOW64\Epcjmbqm.exe Mfjcfc32.exe File created C:\Windows\SysWOW64\Iegnaihm.exe Ipjeibjf.exe File created C:\Windows\SysWOW64\Bciohe32.exe Bjqjoolp.exe File created C:\Windows\SysWOW64\Meccam32.dll Geogpemb.exe File opened for modification C:\Windows\SysWOW64\Fhjonbcj.exe Fdnbmd32.exe File opened for modification C:\Windows\SysWOW64\Cpcaeghc.exe Cfnmhnhm.exe File created C:\Windows\SysWOW64\Flpbbk32.dll Eehpoaaf.exe File opened for modification C:\Windows\SysWOW64\Kklamq32.exe Kbdmdk32.exe File created C:\Windows\SysWOW64\Opaggdfa.exe Opokbdhc.exe File opened for modification C:\Windows\SysWOW64\Hanenoeh.exe Gbdobc32.exe File created C:\Windows\SysWOW64\Odhjmc32.exe Ojpedn32.exe File created C:\Windows\SysWOW64\Qcdinbdk.exe Peqidn32.exe File created C:\Windows\SysWOW64\Fhhiqm32.exe Ehfmkmqj.exe File created C:\Windows\SysWOW64\Klakhp32.exe Kakfkg32.exe File opened for modification C:\Windows\SysWOW64\Fdnbmd32.exe Epcjmbqm.exe File created C:\Windows\SysWOW64\Hkmqdqad.exe Hmjphd32.exe File created C:\Windows\SysWOW64\Fedqdl32.dll Obbpio32.exe File created C:\Windows\SysWOW64\Pcbmhb32.exe Penlon32.exe File created C:\Windows\SysWOW64\Gdgdhnml.exe Fhpdbmgg.exe File opened for modification C:\Windows\SysWOW64\Lnpkfmld.exe Kaikalfp.exe File opened for modification C:\Windows\SysWOW64\Hiqamepn.exe Hfbeaiaj.exe File created C:\Windows\SysWOW64\Fhpfpkog.dll Camlpldf.exe File created C:\Windows\SysWOW64\Naeppnfb.dll Hcghffen.exe File opened for modification C:\Windows\SysWOW64\Ajnnipnc.exe Aqfiqjgb.exe File opened for modification C:\Windows\SysWOW64\Bgbncdmm.exe Ajnnipnc.exe File opened for modification C:\Windows\SysWOW64\Hbiefjfn.exe Hiqamepn.exe File created C:\Windows\SysWOW64\Lnpkfmld.exe Kaikalfp.exe File opened for modification C:\Windows\SysWOW64\Penlon32.exe Pcppbc32.exe File opened for modification C:\Windows\SysWOW64\Nkmfhb32.exe Madepihc.exe File created C:\Windows\SysWOW64\Fhjonbcj.exe Fdnbmd32.exe File opened for modification C:\Windows\SysWOW64\Gjbafj32.exe Gagmag32.exe File created C:\Windows\SysWOW64\Mbmfpdcn.dll Gbdobc32.exe File created C:\Windows\SysWOW64\Nmjhejph.exe Neocahbm.exe File created C:\Windows\SysWOW64\Dfflfknc.dll Fbobog32.exe File created C:\Windows\SysWOW64\Npoobl32.dll Flgfhmdf.exe File created C:\Windows\SysWOW64\Fikgaq32.exe Fbaoegkb.exe File opened for modification C:\Windows\SysWOW64\Chdjpl32.exe NEAS.ef42a349950a77b7a3333bc217b83650.exe File created C:\Windows\SysWOW64\Ifngiqlg.exe Ikfffh32.exe File created C:\Windows\SysWOW64\Aejlqe32.dll Cgfdmf32.exe File opened for modification C:\Windows\SysWOW64\Cbpendha.exe Cmclem32.exe File opened for modification C:\Windows\SysWOW64\Dlkfli32.exe Dfnncb32.exe File created C:\Windows\SysWOW64\Doibhekc.exe Dlkfli32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnoeplld.dll" Cpcaeghc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqejoa32.dll" Pcbmhb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kchfpi32.dll" Kbdmdk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mlccmcna.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ajidnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Eehpoaaf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nnhmkohe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jdpplcjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mkhqnoci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cjlenm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pgfbhb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dfnncb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fcfojhhh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjmnbnnd.dll" Pcppbc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ajnnipnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bjqjoolp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fgoloohb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Iipmlh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Opokbdhc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cgfdmf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fhhiqm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ilekgamm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kghgdo32.dll" Akdgmd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hcalpndi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hkmqdqad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hqlfag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekjgao32.dll" Ohmllf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Akdgmd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fbckjfip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnlmqook.dll" Gpekmnmh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Njnion32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eknmgkpa.dll" Bciohe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hefjapaj.dll" Madepihc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fdqobcio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbdngk32.dll" Gjbafj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hbiefjfn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Faefim32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Akdgmd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mokfkini.dll" Ajnnipnc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gagmag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enfkfc32.dll" Cjlenm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qcdinbdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qkepcb32.dll" Bfjhippb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hdbhgf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Njadab32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ilafnc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Heijfdeg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kbdmdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gagmag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lneeal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Chdjpl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akilij32.dll" Penlon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cmclem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flpbbk32.dll" Eehpoaaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fpqfcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aehbif32.dll" Heijfdeg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hjdjjmdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfkdic32.dll" Iegnaihm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Obbpio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Djiegp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jqjdon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlkdim32.dll" Odhjmc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pdfifg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gpekmnmh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2664 2820 NEAS.ef42a349950a77b7a3333bc217b83650.exe 28 PID 2820 wrote to memory of 2664 2820 NEAS.ef42a349950a77b7a3333bc217b83650.exe 28 PID 2820 wrote to memory of 2664 2820 NEAS.ef42a349950a77b7a3333bc217b83650.exe 28 PID 2820 wrote to memory of 2664 2820 NEAS.ef42a349950a77b7a3333bc217b83650.exe 28 PID 2664 wrote to memory of 2540 2664 Chdjpl32.exe 29 PID 2664 wrote to memory of 2540 2664 Chdjpl32.exe 29 PID 2664 wrote to memory of 2540 2664 Chdjpl32.exe 29 PID 2664 wrote to memory of 2540 2664 Chdjpl32.exe 29 PID 2540 wrote to memory of 2584 2540 Blelpeoa.exe 30 PID 2540 wrote to memory of 2584 2540 Blelpeoa.exe 30 PID 2540 wrote to memory of 2584 2540 Blelpeoa.exe 30 PID 2540 wrote to memory of 2584 2540 Blelpeoa.exe 30 PID 2584 wrote to memory of 520 2584 Bljeke32.exe 32 PID 2584 wrote to memory of 520 2584 Bljeke32.exe 32 PID 2584 wrote to memory of 520 2584 Bljeke32.exe 32 PID 2584 wrote to memory of 520 2584 Bljeke32.exe 32 PID 520 wrote to memory of 2716 520 Cfnmhnhm.exe 31 PID 520 wrote to memory of 2716 520 Cfnmhnhm.exe 31 PID 520 wrote to memory of 2716 520 Cfnmhnhm.exe 31 PID 520 wrote to memory of 2716 520 Cfnmhnhm.exe 31 PID 2716 wrote to memory of 1696 2716 Cpcaeghc.exe 33 PID 2716 wrote to memory of 1696 2716 Cpcaeghc.exe 33 PID 2716 wrote to memory of 1696 2716 Cpcaeghc.exe 33 PID 2716 wrote to memory of 1696 2716 Cpcaeghc.exe 33 PID 1696 wrote to memory of 2792 1696 Cjlenm32.exe 34 PID 1696 wrote to memory of 2792 1696 Cjlenm32.exe 34 PID 1696 wrote to memory of 2792 1696 Cjlenm32.exe 34 PID 1696 wrote to memory of 2792 1696 Cjlenm32.exe 34 PID 2792 wrote to memory of 2772 2792 Dopdgb32.exe 35 PID 2792 wrote to memory of 2772 2792 Dopdgb32.exe 35 PID 2792 wrote to memory of 2772 2792 Dopdgb32.exe 35 PID 2792 wrote to memory of 2772 2792 Dopdgb32.exe 35 PID 2772 wrote to memory of 2876 2772 Djiegp32.exe 36 PID 2772 wrote to memory of 2876 2772 Djiegp32.exe 36 PID 2772 wrote to memory of 2876 2772 Djiegp32.exe 36 PID 2772 wrote to memory of 2876 2772 Djiegp32.exe 36 PID 2876 wrote to memory of 1756 2876 Ecdffe32.exe 37 PID 2876 wrote to memory of 1756 2876 Ecdffe32.exe 37 PID 2876 wrote to memory of 1756 2876 Ecdffe32.exe 37 PID 2876 wrote to memory of 1756 2876 Ecdffe32.exe 37 PID 1756 wrote to memory of 1608 1756 Faefim32.exe 38 PID 1756 wrote to memory of 1608 1756 Faefim32.exe 38 PID 1756 wrote to memory of 1608 1756 Faefim32.exe 38 PID 1756 wrote to memory of 1608 1756 Faefim32.exe 38 PID 1608 wrote to memory of 1688 1608 Fcfojhhh.exe 39 PID 1608 wrote to memory of 1688 1608 Fcfojhhh.exe 39 PID 1608 wrote to memory of 1688 1608 Fcfojhhh.exe 39 PID 1608 wrote to memory of 1688 1608 Fcfojhhh.exe 39 PID 1688 wrote to memory of 3024 1688 Fhfdffll.exe 40 PID 1688 wrote to memory of 3024 1688 Fhfdffll.exe 40 PID 1688 wrote to memory of 3024 1688 Fhfdffll.exe 40 PID 1688 wrote to memory of 3024 1688 Fhfdffll.exe 40 PID 3024 wrote to memory of 1888 3024 Gbdobc32.exe 41 PID 3024 wrote to memory of 1888 3024 Gbdobc32.exe 41 PID 3024 wrote to memory of 1888 3024 Gbdobc32.exe 41 PID 3024 wrote to memory of 1888 3024 Gbdobc32.exe 41 PID 1888 wrote to memory of 284 1888 Hanenoeh.exe 42 PID 1888 wrote to memory of 284 1888 Hanenoeh.exe 42 PID 1888 wrote to memory of 284 1888 Hanenoeh.exe 42 PID 1888 wrote to memory of 284 1888 Hanenoeh.exe 42 PID 284 wrote to memory of 2416 284 Hkkcbdhc.exe 43 PID 284 wrote to memory of 2416 284 Hkkcbdhc.exe 43 PID 284 wrote to memory of 2416 284 Hkkcbdhc.exe 43 PID 284 wrote to memory of 2416 284 Hkkcbdhc.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ef42a349950a77b7a3333bc217b83650.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ef42a349950a77b7a3333bc217b83650.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\Chdjpl32.exeC:\Windows\system32\Chdjpl32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\Blelpeoa.exeC:\Windows\system32\Blelpeoa.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\Bljeke32.exeC:\Windows\system32\Bljeke32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\Cfnmhnhm.exeC:\Windows\system32\Cfnmhnhm.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:520
-
-
-
-
-
C:\Windows\SysWOW64\Cpcaeghc.exeC:\Windows\system32\Cpcaeghc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\Cjlenm32.exeC:\Windows\system32\Cjlenm32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\Dopdgb32.exeC:\Windows\system32\Dopdgb32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\Djiegp32.exeC:\Windows\system32\Djiegp32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\Ecdffe32.exeC:\Windows\system32\Ecdffe32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\Faefim32.exeC:\Windows\system32\Faefim32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\Fcfojhhh.exeC:\Windows\system32\Fcfojhhh.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\Fhfdffll.exeC:\Windows\system32\Fhfdffll.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\Gbdobc32.exeC:\Windows\system32\Gbdobc32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\Hanenoeh.exeC:\Windows\system32\Hanenoeh.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\Hkkcbdhc.exeC:\Windows\system32\Hkkcbdhc.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:284 -
C:\Windows\SysWOW64\Hcghffen.exeC:\Windows\system32\Hcghffen.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2416 -
C:\Windows\SysWOW64\Iegaha32.exeC:\Windows\system32\Iegaha32.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Windows\SysWOW64\Ikfffh32.exeC:\Windows\system32\Ikfffh32.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1900 -
C:\Windows\SysWOW64\Ifngiqlg.exeC:\Windows\system32\Ifngiqlg.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Windows\SysWOW64\Injlmcib.exeC:\Windows\system32\Injlmcib.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1344 -
C:\Windows\SysWOW64\Jqjdon32.exeC:\Windows\system32\Jqjdon32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1840 -
C:\Windows\SysWOW64\Mcdkmg32.exeC:\Windows\system32\Mcdkmg32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Windows\SysWOW64\Naqkki32.exeC:\Windows\system32\Naqkki32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Windows\SysWOW64\Nndkdn32.exeC:\Windows\system32\Nndkdn32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Windows\SysWOW64\Neocahbm.exeC:\Windows\system32\Neocahbm.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1400 -
C:\Windows\SysWOW64\Nmjhejph.exeC:\Windows\system32\Nmjhejph.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Windows\SysWOW64\Njnion32.exeC:\Windows\system32\Njnion32.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1112 -
C:\Windows\SysWOW64\Ojpedn32.exeC:\Windows\system32\Ojpedn32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2956 -
C:\Windows\SysWOW64\Odhjmc32.exeC:\Windows\system32\Odhjmc32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2828 -
C:\Windows\SysWOW64\Opokbdhc.exeC:\Windows\system32\Opokbdhc.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1904 -
C:\Windows\SysWOW64\Opaggdfa.exeC:\Windows\system32\Opaggdfa.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Windows\SysWOW64\Ohmllf32.exeC:\Windows\system32\Ohmllf32.exe28⤵
- Executes dropped EXE
- Modifies registry class
PID:788 -
C:\Windows\SysWOW64\Obbpio32.exeC:\Windows\system32\Obbpio32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1660 -
C:\Windows\SysWOW64\Pdfifg32.exeC:\Windows\system32\Pdfifg32.exe30⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2872 -
C:\Windows\SysWOW64\Pokndp32.exeC:\Windows\system32\Pokndp32.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1504 -
C:\Windows\SysWOW64\Pgfbhb32.exeC:\Windows\system32\Pgfbhb32.exe32⤵
- Executes dropped EXE
- Modifies registry class
PID:2776 -
C:\Windows\SysWOW64\Palgek32.exeC:\Windows\system32\Palgek32.exe33⤵
- Executes dropped EXE
PID:784 -
C:\Windows\SysWOW64\Pgionbbl.exeC:\Windows\system32\Pgionbbl.exe34⤵
- Executes dropped EXE
PID:572 -
C:\Windows\SysWOW64\Pcppbc32.exeC:\Windows\system32\Pcppbc32.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:940 -
C:\Windows\SysWOW64\Penlon32.exeC:\Windows\system32\Penlon32.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2480 -
C:\Windows\SysWOW64\Pcbmhb32.exeC:\Windows\system32\Pcbmhb32.exe37⤵
- Executes dropped EXE
- Modifies registry class
PID:2212 -
C:\Windows\SysWOW64\Peqidn32.exeC:\Windows\system32\Peqidn32.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2036 -
C:\Windows\SysWOW64\Qcdinbdk.exeC:\Windows\system32\Qcdinbdk.exe39⤵
- Executes dropped EXE
- Modifies registry class
PID:1892 -
C:\Windows\SysWOW64\Qjnajl32.exeC:\Windows\system32\Qjnajl32.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:440 -
C:\Windows\SysWOW64\Adjoqjfc.exeC:\Windows\system32\Adjoqjfc.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1532 -
C:\Windows\SysWOW64\Akdgmd32.exeC:\Windows\system32\Akdgmd32.exe42⤵
- Executes dropped EXE
- Modifies registry class
PID:1616 -
C:\Windows\SysWOW64\Admlfida.exeC:\Windows\system32\Admlfida.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1044 -
C:\Windows\SysWOW64\Ajidnp32.exeC:\Windows\system32\Ajidnp32.exe44⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2436 -
C:\Windows\SysWOW64\Aqfiqjgb.exeC:\Windows\system32\Aqfiqjgb.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2844 -
C:\Windows\SysWOW64\Ajnnipnc.exeC:\Windows\system32\Ajnnipnc.exe46⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3040 -
C:\Windows\SysWOW64\Bgbncdmm.exeC:\Windows\system32\Bgbncdmm.exe47⤵
- Executes dropped EXE
PID:2584 -
C:\Windows\SysWOW64\Bjqjoolp.exeC:\Windows\system32\Bjqjoolp.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2792 -
C:\Windows\SysWOW64\Bciohe32.exeC:\Windows\system32\Bciohe32.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:3024 -
C:\Windows\SysWOW64\Bmacqj32.exeC:\Windows\system32\Bmacqj32.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1540 -
C:\Windows\SysWOW64\Bfjhippb.exeC:\Windows\system32\Bfjhippb.exe51⤵
- Executes dropped EXE
- Modifies registry class
PID:1712 -
C:\Windows\SysWOW64\Cjbccb32.exeC:\Windows\system32\Cjbccb32.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2244 -
C:\Windows\SysWOW64\Camlpldf.exeC:\Windows\system32\Camlpldf.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2684 -
C:\Windows\SysWOW64\Cgfdmf32.exeC:\Windows\system32\Cgfdmf32.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2248 -
C:\Windows\SysWOW64\Cmclem32.exeC:\Windows\system32\Cmclem32.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1704 -
C:\Windows\SysWOW64\Cbpendha.exeC:\Windows\system32\Cbpendha.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1992 -
C:\Windows\SysWOW64\Cmfikmhg.exeC:\Windows\system32\Cmfikmhg.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2648 -
C:\Windows\SysWOW64\Dfnncb32.exeC:\Windows\system32\Dfnncb32.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:336 -
C:\Windows\SysWOW64\Dlkfli32.exeC:\Windows\system32\Dlkfli32.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1692 -
C:\Windows\SysWOW64\Doibhekc.exeC:\Windows\system32\Doibhekc.exe60⤵
- Executes dropped EXE
PID:1664 -
C:\Windows\SysWOW64\Eehpoaaf.exeC:\Windows\system32\Eehpoaaf.exe61⤵
- Drops file in System32 directory
- Modifies registry class
PID:1000 -
C:\Windows\SysWOW64\Ehfmkmqj.exeC:\Windows\system32\Ehfmkmqj.exe62⤵
- Drops file in System32 directory
PID:2868 -
C:\Windows\SysWOW64\Fhhiqm32.exeC:\Windows\system32\Fhhiqm32.exe63⤵
- Modifies registry class
PID:1388 -
C:\Windows\SysWOW64\Njadab32.exeC:\Windows\system32\Njadab32.exe64⤵
- Modifies registry class
PID:1512 -
C:\Windows\SysWOW64\Nnhmkohe.exeC:\Windows\system32\Nnhmkohe.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:1264 -
C:\Windows\SysWOW64\Aiofln32.exeC:\Windows\system32\Aiofln32.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2424 -
C:\Windows\SysWOW64\Enffedpn.exeC:\Windows\system32\Enffedpn.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1636 -
C:\Windows\SysWOW64\Fpqfcl32.exeC:\Windows\system32\Fpqfcl32.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:964 -
C:\Windows\SysWOW64\Fbobog32.exeC:\Windows\system32\Fbobog32.exe69⤵
- Drops file in System32 directory
PID:2488 -
C:\Windows\SysWOW64\Flgfhmdf.exeC:\Windows\system32\Flgfhmdf.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2180 -
C:\Windows\SysWOW64\Fbaoegkb.exeC:\Windows\system32\Fbaoegkb.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3044 -
C:\Windows\SysWOW64\Fikgaq32.exeC:\Windows\system32\Fikgaq32.exe72⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2428 -
C:\Windows\SysWOW64\Fjlciihn.exeC:\Windows\system32\Fjlciihn.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1696 -
C:\Windows\SysWOW64\Fbckjfip.exeC:\Windows\system32\Fbckjfip.exe74⤵
- Modifies registry class
PID:1776 -
C:\Windows\SysWOW64\Fhpdbmgg.exeC:\Windows\system32\Fhpdbmgg.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3052 -
C:\Windows\SysWOW64\Gdgdhnml.exeC:\Windows\system32\Gdgdhnml.exe76⤵PID:920
-
C:\Windows\SysWOW64\Gdnkhm32.exeC:\Windows\system32\Gdnkhm32.exe77⤵
- Drops file in System32 directory
PID:2996 -
C:\Windows\SysWOW64\Geogpemb.exeC:\Windows\system32\Geogpemb.exe78⤵
- Drops file in System32 directory
PID:2676 -
C:\Windows\SysWOW64\Gpekmnmh.exeC:\Windows\system32\Gpekmnmh.exe79⤵
- Drops file in System32 directory
- Modifies registry class
PID:2100 -
C:\Windows\SysWOW64\Geadee32.exeC:\Windows\system32\Geadee32.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1588 -
C:\Windows\SysWOW64\Hahdjfqc.exeC:\Windows\system32\Hahdjfqc.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1228 -
C:\Windows\SysWOW64\Hipmlcae.exeC:\Windows\system32\Hipmlcae.exe82⤵PID:2568
-
C:\Windows\SysWOW64\Holedjom.exeC:\Windows\system32\Holedjom.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2284 -
C:\Windows\SysWOW64\Hdinla32.exeC:\Windows\system32\Hdinla32.exe84⤵PID:2944
-
C:\Windows\SysWOW64\Hkcfikea.exeC:\Windows\system32\Hkcfikea.exe85⤵PID:2972
-
C:\Windows\SysWOW64\Hmabegde.exeC:\Windows\system32\Hmabegde.exe86⤵PID:2800
-
C:\Windows\SysWOW64\Heijfdeg.exeC:\Windows\system32\Heijfdeg.exe87⤵
- Modifies registry class
PID:2784 -
C:\Windows\SysWOW64\Ijdbffpl.exeC:\Windows\system32\Ijdbffpl.exe88⤵PID:2812
-
C:\Windows\SysWOW64\Iaogjhmg.exeC:\Windows\system32\Iaogjhmg.exe89⤵PID:2908
-
C:\Windows\SysWOW64\Ilekgamm.exeC:\Windows\system32\Ilekgamm.exe90⤵
- Modifies registry class
PID:3036 -
C:\Windows\SysWOW64\Jdpplcjh.exeC:\Windows\system32\Jdpplcjh.exe91⤵
- Modifies registry class
PID:2728 -
C:\Windows\SysWOW64\Jgolhoik.exeC:\Windows\system32\Jgolhoik.exe92⤵PID:1520
-
C:\Windows\SysWOW64\Jqgqadpl.exeC:\Windows\system32\Jqgqadpl.exe93⤵PID:2620
-
C:\Windows\SysWOW64\Kbdmdk32.exeC:\Windows\system32\Kbdmdk32.exe94⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:1788 -
C:\Windows\SysWOW64\Kklamq32.exeC:\Windows\system32\Kklamq32.exe95⤵PID:856
-
C:\Windows\SysWOW64\Kfaeji32.exeC:\Windows\system32\Kfaeji32.exe96⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2684 -
C:\Windows\SysWOW64\Kipafe32.exeC:\Windows\system32\Kipafe32.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1992 -
C:\Windows\SysWOW64\Kakfkg32.exeC:\Windows\system32\Kakfkg32.exe98⤵
- Drops file in System32 directory
PID:784 -
C:\Windows\SysWOW64\Klakhp32.exeC:\Windows\system32\Klakhp32.exe99⤵PID:1664
-
C:\Windows\SysWOW64\Lancqglp.exeC:\Windows\system32\Lancqglp.exe100⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:572 -
C:\Windows\SysWOW64\Mffkdlpi.exeC:\Windows\system32\Mffkdlpi.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1044 -
C:\Windows\SysWOW64\Mlccmcna.exeC:\Windows\system32\Mlccmcna.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3040 -
C:\Windows\SysWOW64\Mbmlimfn.exeC:\Windows\system32\Mbmlimfn.exe103⤵PID:2828
-
C:\Windows\SysWOW64\Mkhqnoci.exeC:\Windows\system32\Mkhqnoci.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3020 -
C:\Windows\SysWOW64\Mlhmhb32.exeC:\Windows\system32\Mlhmhb32.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:644 -
C:\Windows\SysWOW64\Madepihc.exeC:\Windows\system32\Madepihc.exe106⤵
- Drops file in System32 directory
- Modifies registry class
PID:1384 -
C:\Windows\SysWOW64\Nkmfhb32.exeC:\Windows\system32\Nkmfhb32.exe107⤵
- Drops file in System32 directory
PID:1340 -
C:\Windows\SysWOW64\Jnnphadg.exeC:\Windows\system32\Jnnphadg.exe108⤵PID:2932
-
C:\Windows\SysWOW64\Mfjcfc32.exeC:\Windows\system32\Mfjcfc32.exe109⤵
- Drops file in System32 directory
PID:284 -
C:\Windows\SysWOW64\Epcjmbqm.exeC:\Windows\system32\Epcjmbqm.exe110⤵
- Drops file in System32 directory
PID:2276 -
C:\Windows\SysWOW64\Fdnbmd32.exeC:\Windows\system32\Fdnbmd32.exe111⤵
- Drops file in System32 directory
PID:2228 -
C:\Windows\SysWOW64\Fhjonbcj.exeC:\Windows\system32\Fhjonbcj.exe112⤵PID:2552
-
C:\Windows\SysWOW64\Fabcfhjk.exeC:\Windows\system32\Fabcfhjk.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2748 -
C:\Windows\SysWOW64\Fdqobcio.exeC:\Windows\system32\Fdqobcio.exe114⤵
- Modifies registry class
PID:2692 -
C:\Windows\SysWOW64\Fgoloohb.exeC:\Windows\system32\Fgoloohb.exe115⤵
- Modifies registry class
PID:700 -
C:\Windows\SysWOW64\Fofcplid.exeC:\Windows\system32\Fofcplid.exe116⤵PID:1972
-
C:\Windows\SysWOW64\Fdclhcgl.exeC:\Windows\system32\Fdclhcgl.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2052 -
C:\Windows\SysWOW64\Gjpdpjec.exeC:\Windows\system32\Gjpdpjec.exe118⤵PID:2496
-
C:\Windows\SysWOW64\Gagmag32.exeC:\Windows\system32\Gagmag32.exe119⤵
- Drops file in System32 directory
- Modifies registry class
PID:2896 -
C:\Windows\SysWOW64\Gjbafj32.exeC:\Windows\system32\Gjbafj32.exe120⤵
- Modifies registry class
PID:2888 -
C:\Windows\SysWOW64\Gmgcbdll.exeC:\Windows\system32\Gmgcbdll.exe121⤵PID:2440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-