Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
233s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
28/10/2023, 20:18
Behavioral task
behavioral1
Sample
NEAS.f60085d8df53a9e043f6476f9d78a5c0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.f60085d8df53a9e043f6476f9d78a5c0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.f60085d8df53a9e043f6476f9d78a5c0.exe
-
Size
106KB
-
MD5
f60085d8df53a9e043f6476f9d78a5c0
-
SHA1
1cc6705bd3deaea726a00fdee54ba64b87336390
-
SHA256
0d440ee9f2a71d519c1e8761713bdb45598cfaa1d5abedb06a7a0118b1c3bdbd
-
SHA512
815d0c23b70f11cc7ddc0e5955aa1a353cca469229c1c43cc39ca10f137770deaa09a8feb280a7f8673b2ba6afa9df5699849c1ede40803e9089d2c6f7a02c30
-
SSDEEP
3072:NAcCWV84GIQl3aS1NOFnrXW1WdTCn93OGey/ZhC:NA3WV84SRaS1N4rXNTCndOGeKY
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bcedbefd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ebddmq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Moijkk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhclip32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lmolkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bpbokj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ffndghdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fefnmdfo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpohplpf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aaaohfjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Anhomg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkkbcpbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bnjipn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Copobe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lobehpok.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmjknb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oeobidll.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qeakmg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnjlcgnp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lmolkg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnjipn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Olijen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eaphilbn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onejjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pjndca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Acdhen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ogiegc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgdpnqfn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcedbefd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfieec32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjndca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ldfgdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Enfinm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lgbfin32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Conbmfif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aeljmq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fobodn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oabdol32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akdjfmed.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aaobcg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgbfin32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhfckc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aaobcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bnhljnhm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fflgahfm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kipfhbmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lljbpl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkbhco32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Elafbcao.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oblmom32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogkbmcba.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abnmae32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aacjba32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ppoijq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ocfppm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aahhoo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pcmadj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bfdlehlc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Loinlg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Agngqmhf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajnlqgfo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ekccgbmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lgpjcnhh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Njialh32.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/memory/2692-0-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/memory/2692-6-0x0000000000230000-0x0000000000271000-memory.dmp family_berbew behavioral1/files/0x0004000000004ed7-5.dat family_berbew behavioral1/files/0x0004000000004ed7-9.dat family_berbew behavioral1/files/0x0004000000004ed7-8.dat family_berbew behavioral1/files/0x0004000000004ed7-12.dat family_berbew behavioral1/files/0x0004000000004ed7-13.dat family_berbew behavioral1/files/0x00060000000120e5-25.dat family_berbew behavioral1/files/0x00060000000120e5-26.dat family_berbew behavioral1/memory/2776-24-0x0000000000280000-0x00000000002C1000-memory.dmp family_berbew behavioral1/files/0x00060000000120e5-21.dat family_berbew behavioral1/files/0x00060000000120e5-20.dat family_berbew behavioral1/files/0x00060000000120e5-18.dat family_berbew behavioral1/memory/2668-31-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x0036000000015ea9-33.dat family_berbew behavioral1/files/0x0036000000015ea9-36.dat family_berbew behavioral1/files/0x0036000000015ea9-35.dat family_berbew behavioral1/files/0x0036000000015ea9-39.dat family_berbew behavioral1/files/0x00080000000162f2-52.dat family_berbew behavioral1/files/0x00080000000162f2-42.dat family_berbew behavioral1/files/0x0036000000015ea9-41.dat family_berbew behavioral1/files/0x00080000000162f2-48.dat family_berbew behavioral1/files/0x00080000000162f2-46.dat family_berbew behavioral1/memory/2076-40-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x00070000000165ee-59.dat family_berbew behavioral1/memory/2484-53-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x00070000000165ee-65.dat family_berbew behavioral1/files/0x00070000000165ee-67.dat family_berbew behavioral1/files/0x00070000000165ee-62.dat family_berbew behavioral1/files/0x00070000000165ee-61.dat family_berbew behavioral1/files/0x00080000000162f2-54.dat family_berbew behavioral1/memory/2752-66-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x0008000000016c12-72.dat family_berbew behavioral1/files/0x0008000000016c12-80.dat family_berbew behavioral1/files/0x0008000000016c12-79.dat family_berbew behavioral1/files/0x0008000000016c12-76.dat family_berbew behavioral1/files/0x0008000000016c12-75.dat family_berbew behavioral1/memory/2752-74-0x0000000000220000-0x0000000000261000-memory.dmp family_berbew behavioral1/memory/2808-85-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x0007000000016ccd-86.dat family_berbew behavioral1/files/0x0007000000016ccd-88.dat family_berbew behavioral1/files/0x0007000000016ccd-89.dat family_berbew behavioral1/files/0x0006000000016cdd-101.dat family_berbew behavioral1/files/0x0006000000016cdd-95.dat family_berbew behavioral1/memory/2228-107-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x0006000000016cdd-106.dat family_berbew behavioral1/files/0x0006000000016cdd-105.dat family_berbew behavioral1/files/0x0007000000016ccd-94.dat family_berbew behavioral1/files/0x0006000000016cf7-118.dat family_berbew behavioral1/files/0x0006000000016cf7-115.dat family_berbew behavioral1/files/0x0006000000016cf7-114.dat family_berbew behavioral1/files/0x0006000000016cdd-99.dat family_berbew behavioral1/memory/1292-93-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x0006000000016d00-121.dat family_berbew behavioral1/files/0x0006000000016cf7-120.dat family_berbew behavioral1/files/0x0006000000016cf7-112.dat family_berbew behavioral1/files/0x0007000000016ccd-92.dat family_berbew behavioral1/memory/1340-137-0x0000000000400000-0x0000000000441000-memory.dmp family_berbew behavioral1/files/0x0006000000016d00-132.dat family_berbew behavioral1/files/0x0006000000016d00-131.dat family_berbew behavioral1/files/0x0006000000016d2d-141.dat family_berbew behavioral1/files/0x0006000000016d2d-140.dat family_berbew behavioral1/files/0x0006000000016d2d-138.dat family_berbew behavioral1/files/0x0006000000016d00-127.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2776 Andkbien.exe 2668 Bfieec32.exe 2076 Hmojfcdk.exe 2484 Lgpjcnhh.exe 2752 Laenqg32.exe 2808 Lgbfin32.exe 1292 Lmolkg32.exe 2228 Lobehpok.exe 1340 Lelmei32.exe 1664 Modano32.exe 2876 Macnjk32.exe 1288 Mkkbcpbl.exe 2880 Mnjnolap.exe 1792 Mpjgag32.exe 2292 Mgdpnqfn.exe 2344 Mkbhco32.exe 1920 Ncnmhajo.exe 1144 Oblmom32.exe 2248 Ogiegc32.exe 1036 Oqajqi32.exe 1372 Ogkbmcba.exe 1960 Onejjm32.exe 1400 Oeobfgak.exe 880 Oiahpkdj.exe 2168 Pifakj32.exe 960 Pldnge32.exe 2436 Pfjbdn32.exe 972 Pbqbioeb.exe 1684 Phmkaf32.exe 2648 Peakkj32.exe 2820 Pjndca32.exe 2576 Qolmip32.exe 2544 Qdieaf32.exe 2732 Qjcmoqlf.exe 2824 Apdobg32.exe 2232 Alkpgh32.exe 1800 Aahhoo32.exe 1636 Almmlg32.exe 1500 Bkbjmd32.exe 2204 Bdknfiea.exe 2164 Bpbokj32.exe 2264 Bkgchckl.exe 1860 Bnhljnhm.exe 1236 Bdbdgh32.exe 108 Bcedbefd.exe 2396 Bfcqoqeh.exe 1544 Bnjipn32.exe 2972 Colegflh.exe 980 Cfemdp32.exe 1408 Conbmfif.exe 2112 Chfffk32.exe 3068 Copobe32.exe 1816 Dddmkkpb.exe 2964 Onhihepp.exe 1356 Oohoeg32.exe 2700 Oagkac32.exe 2516 Phacnm32.exe 2496 Pkopjh32.exe 1312 Paihgboc.exe 592 Pdhdcnng.exe 1992 Pjdlkeln.exe 948 Paldmbmq.exe 1968 Pcmadj32.exe 736 Pkdiehca.exe -
Loads dropped DLL 64 IoCs
pid Process 2692 NEAS.f60085d8df53a9e043f6476f9d78a5c0.exe 2692 NEAS.f60085d8df53a9e043f6476f9d78a5c0.exe 2776 Andkbien.exe 2776 Andkbien.exe 2668 Bfieec32.exe 2668 Bfieec32.exe 2076 Hmojfcdk.exe 2076 Hmojfcdk.exe 2484 Lgpjcnhh.exe 2484 Lgpjcnhh.exe 2752 Laenqg32.exe 2752 Laenqg32.exe 2808 Lgbfin32.exe 2808 Lgbfin32.exe 1292 Lmolkg32.exe 1292 Lmolkg32.exe 2228 Lobehpok.exe 2228 Lobehpok.exe 1340 Lelmei32.exe 1340 Lelmei32.exe 1664 Modano32.exe 1664 Modano32.exe 2876 Macnjk32.exe 2876 Macnjk32.exe 1288 Mkkbcpbl.exe 1288 Mkkbcpbl.exe 2880 Mnjnolap.exe 2880 Mnjnolap.exe 1792 Mpjgag32.exe 1792 Mpjgag32.exe 2292 Mgdpnqfn.exe 2292 Mgdpnqfn.exe 2344 Mkbhco32.exe 2344 Mkbhco32.exe 1920 Ncnmhajo.exe 1920 Ncnmhajo.exe 1144 Oblmom32.exe 1144 Oblmom32.exe 2248 Ogiegc32.exe 2248 Ogiegc32.exe 1036 Oqajqi32.exe 1036 Oqajqi32.exe 1372 Ogkbmcba.exe 1372 Ogkbmcba.exe 1960 Onejjm32.exe 1960 Onejjm32.exe 1400 Oeobfgak.exe 1400 Oeobfgak.exe 880 Oiahpkdj.exe 880 Oiahpkdj.exe 2168 Pifakj32.exe 2168 Pifakj32.exe 960 Pldnge32.exe 960 Pldnge32.exe 2436 Pfjbdn32.exe 2436 Pfjbdn32.exe 972 Pbqbioeb.exe 972 Pbqbioeb.exe 1684 Phmkaf32.exe 1684 Phmkaf32.exe 2648 Peakkj32.exe 2648 Peakkj32.exe 2820 Pjndca32.exe 2820 Pjndca32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Jqiipm32.dll Bkbjmd32.exe File opened for modification C:\Windows\SysWOW64\Bkgchckl.exe Bpbokj32.exe File created C:\Windows\SysWOW64\Eebnhbbq.dll Copobe32.exe File created C:\Windows\SysWOW64\Amjkgbhe.exe Ajkokgia.exe File created C:\Windows\SysWOW64\Lfoiil32.dll Fnglekch.exe File created C:\Windows\SysWOW64\Cpolaagl.dll Ebddmq32.exe File created C:\Windows\SysWOW64\Phmkaf32.exe Pbqbioeb.exe File created C:\Windows\SysWOW64\Bmeggj32.dll Aahhoo32.exe File created C:\Windows\SysWOW64\Ldfgdn32.exe Lagjhc32.exe File opened for modification C:\Windows\SysWOW64\Ldhcjn32.exe Lajgnb32.exe File opened for modification C:\Windows\SysWOW64\Kpohplpf.exe Kiepca32.exe File created C:\Windows\SysWOW64\Lelphbon.exe Lcmdlgoj.exe File opened for modification C:\Windows\SysWOW64\Nomdfjpo.exe Nhclip32.exe File created C:\Windows\SysWOW64\Pdcael32.dll Qeakmg32.exe File created C:\Windows\SysWOW64\Qdieaf32.exe Qolmip32.exe File created C:\Windows\SysWOW64\Apdobg32.exe Qjcmoqlf.exe File opened for modification C:\Windows\SysWOW64\Kdfjekmd.exe Kmlbia32.exe File created C:\Windows\SysWOW64\Lljbpl32.exe Leqjcb32.exe File created C:\Windows\SysWOW64\Gagigoef.dll Ldfgdn32.exe File created C:\Windows\SysWOW64\Chmpicbd.exe Cfocmhcq.exe File opened for modification C:\Windows\SysWOW64\Ddikjh32.exe Dnobmnnj.exe File created C:\Windows\SysWOW64\Enaocnlg.exe Ekccgbmd.exe File created C:\Windows\SysWOW64\Bdcdaglf.dll Ncnmhajo.exe File opened for modification C:\Windows\SysWOW64\Donijk32.exe Dhcanahm.exe File created C:\Windows\SysWOW64\Copobe32.exe Chfffk32.exe File opened for modification C:\Windows\SysWOW64\Ajkokgia.exe Aacjba32.exe File created C:\Windows\SysWOW64\Aikbpf32.dll Fobodn32.exe File opened for modification C:\Windows\SysWOW64\Fgdjipfc.exe Fefnmdfo.exe File opened for modification C:\Windows\SysWOW64\Lokkag32.exe Lhabemgi.exe File created C:\Windows\SysWOW64\Ekhoehke.dll Nmjknb32.exe File opened for modification C:\Windows\SysWOW64\Onejjm32.exe Ogkbmcba.exe File created C:\Windows\SysWOW64\Qigefa32.dll Colegflh.exe File created C:\Windows\SysWOW64\Cmhcbm32.dll Pnicgi32.exe File created C:\Windows\SysWOW64\Epdpbink.dll Bfjjbi32.exe File created C:\Windows\SysWOW64\Dnnoof32.dll Elafbcao.exe File created C:\Windows\SysWOW64\Bbaqanoj.dll Pjgjmipf.exe File created C:\Windows\SysWOW64\Andnff32.exe Agkfil32.exe File created C:\Windows\SysWOW64\Dgkkdnkb.exe Ddmohbln.exe File opened for modification C:\Windows\SysWOW64\Mhfckc32.exe Oabdol32.exe File created C:\Windows\SysWOW64\Plhfda32.exe Pjgjmipf.exe File created C:\Windows\SysWOW64\Bfjjbi32.exe Bclnfm32.exe File opened for modification C:\Windows\SysWOW64\Cfocmhcq.exe Bdogceln.exe File created C:\Windows\SysWOW64\Modano32.exe Lelmei32.exe File created C:\Windows\SysWOW64\Eannccmp.dll Deeeafii.exe File opened for modification C:\Windows\SysWOW64\Cmnqae32.exe Ckpdej32.exe File created C:\Windows\SysWOW64\Ecgnmaod.dll Fflgahfm.exe File created C:\Windows\SysWOW64\Kpmkjlbi.exe Kmnonqce.exe File created C:\Windows\SysWOW64\Pdmbpo32.exe Pjemgibi.exe File opened for modification C:\Windows\SysWOW64\Lelmei32.exe Lobehpok.exe File created C:\Windows\SysWOW64\Kkkeeb32.dll Acdcdm32.exe File opened for modification C:\Windows\SysWOW64\Agkfil32.exe Aeljmq32.exe File opened for modification C:\Windows\SysWOW64\Acdcdm32.exe Amjkgbhe.exe File created C:\Windows\SysWOW64\Cfocmhcq.exe Bdogceln.exe File created C:\Windows\SysWOW64\Aklgck32.dll Mgdpnqfn.exe File opened for modification C:\Windows\SysWOW64\Bcedbefd.exe Bdbdgh32.exe File created C:\Windows\SysWOW64\Qoipflcf.exe Qeakmg32.exe File created C:\Windows\SysWOW64\Idblbjen.dll Bgbqlm32.exe File opened for modification C:\Windows\SysWOW64\Ehhghdgc.exe Efjklh32.exe File created C:\Windows\SysWOW64\Olnlgjof.dll Ehhghdgc.exe File opened for modification C:\Windows\SysWOW64\Oqajqi32.exe Ogiegc32.exe File created C:\Windows\SysWOW64\Dpelnopf.dll Peakkj32.exe File opened for modification C:\Windows\SysWOW64\Dddmkkpb.exe Copobe32.exe File opened for modification C:\Windows\SysWOW64\Abnmae32.exe Aooaej32.exe File opened for modification C:\Windows\SysWOW64\Oabdol32.exe Fnnbfjmp.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Heefcm32.dll" Ajnlqgfo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fefnmdfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nmjknb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Amjkgbhe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Doiqel32.dll" Dnobmnnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Apdobg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bkgchckl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bdogceln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cfocmhcq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pfjbdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kgdgaflh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ongfai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bgbqlm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kipfhbmo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ffndghdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akafqmpa.dll" Kbkgfgam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Plhfda32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mpjgag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idadacnh.dll" Pkopjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiilfa32.dll" Aooaej32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ajnlqgfo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pjbqaj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 NEAS.f60085d8df53a9e043f6476f9d78a5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Onejjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oeobfgak.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pqaanoah.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kpohplpf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mfpfbemc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ngiikmmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpglhael.dll" Pjpdlj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lgpjcnhh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bdogceln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlilqp32.dll" Ceeibbgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kmnonqce.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kbkgfgam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebjdodgf.dll" Kiepca32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Loinlg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggfehlqg.dll" Bfcqoqeh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ckpdej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gckknefg.dll" Eckopm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nafkmmgl.dll" Mfpfbemc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okbnbfmb.dll" Alpmep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kocobh32.dll" Bciaqnje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nioqmpcf.dll" Pcmadj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bnhljnhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmmnecce.dll" Ffndghdj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Onejjm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Chfffk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Leqjcb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cmofok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pepigm32.dll" Lelmei32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ceeibbgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knpdbhob.dll" Diqabd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Konqal32.dll" Fnnbfjmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Logkhq32.dll" Ongfai32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aaobcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njoiof32.dll" Bopbeopi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlodknje.dll" Eaphilbn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ogiegc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mnjnolap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mgdpnqfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qknlnp32.dll" Kpmkjlbi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pjpdlj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Qoipflcf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2776 2692 NEAS.f60085d8df53a9e043f6476f9d78a5c0.exe 28 PID 2692 wrote to memory of 2776 2692 NEAS.f60085d8df53a9e043f6476f9d78a5c0.exe 28 PID 2692 wrote to memory of 2776 2692 NEAS.f60085d8df53a9e043f6476f9d78a5c0.exe 28 PID 2692 wrote to memory of 2776 2692 NEAS.f60085d8df53a9e043f6476f9d78a5c0.exe 28 PID 2776 wrote to memory of 2668 2776 Andkbien.exe 29 PID 2776 wrote to memory of 2668 2776 Andkbien.exe 29 PID 2776 wrote to memory of 2668 2776 Andkbien.exe 29 PID 2776 wrote to memory of 2668 2776 Andkbien.exe 29 PID 2668 wrote to memory of 2076 2668 Bfieec32.exe 30 PID 2668 wrote to memory of 2076 2668 Bfieec32.exe 30 PID 2668 wrote to memory of 2076 2668 Bfieec32.exe 30 PID 2668 wrote to memory of 2076 2668 Bfieec32.exe 30 PID 2076 wrote to memory of 2484 2076 Hmojfcdk.exe 31 PID 2076 wrote to memory of 2484 2076 Hmojfcdk.exe 31 PID 2076 wrote to memory of 2484 2076 Hmojfcdk.exe 31 PID 2076 wrote to memory of 2484 2076 Hmojfcdk.exe 31 PID 2484 wrote to memory of 2752 2484 Lgpjcnhh.exe 32 PID 2484 wrote to memory of 2752 2484 Lgpjcnhh.exe 32 PID 2484 wrote to memory of 2752 2484 Lgpjcnhh.exe 32 PID 2484 wrote to memory of 2752 2484 Lgpjcnhh.exe 32 PID 2752 wrote to memory of 2808 2752 Laenqg32.exe 33 PID 2752 wrote to memory of 2808 2752 Laenqg32.exe 33 PID 2752 wrote to memory of 2808 2752 Laenqg32.exe 33 PID 2752 wrote to memory of 2808 2752 Laenqg32.exe 33 PID 2808 wrote to memory of 1292 2808 Lgbfin32.exe 34 PID 2808 wrote to memory of 1292 2808 Lgbfin32.exe 34 PID 2808 wrote to memory of 1292 2808 Lgbfin32.exe 34 PID 2808 wrote to memory of 1292 2808 Lgbfin32.exe 34 PID 1292 wrote to memory of 2228 1292 Lmolkg32.exe 35 PID 1292 wrote to memory of 2228 1292 Lmolkg32.exe 35 PID 1292 wrote to memory of 2228 1292 Lmolkg32.exe 35 PID 1292 wrote to memory of 2228 1292 Lmolkg32.exe 35 PID 2228 wrote to memory of 1340 2228 Lobehpok.exe 36 PID 2228 wrote to memory of 1340 2228 Lobehpok.exe 36 PID 2228 wrote to memory of 1340 2228 Lobehpok.exe 36 PID 2228 wrote to memory of 1340 2228 Lobehpok.exe 36 PID 1340 wrote to memory of 1664 1340 Lelmei32.exe 37 PID 1340 wrote to memory of 1664 1340 Lelmei32.exe 37 PID 1340 wrote to memory of 1664 1340 Lelmei32.exe 37 PID 1340 wrote to memory of 1664 1340 Lelmei32.exe 37 PID 1664 wrote to memory of 2876 1664 Modano32.exe 38 PID 1664 wrote to memory of 2876 1664 Modano32.exe 38 PID 1664 wrote to memory of 2876 1664 Modano32.exe 38 PID 1664 wrote to memory of 2876 1664 Modano32.exe 38 PID 2876 wrote to memory of 1288 2876 Macnjk32.exe 39 PID 2876 wrote to memory of 1288 2876 Macnjk32.exe 39 PID 2876 wrote to memory of 1288 2876 Macnjk32.exe 39 PID 2876 wrote to memory of 1288 2876 Macnjk32.exe 39 PID 1288 wrote to memory of 2880 1288 Mkkbcpbl.exe 40 PID 1288 wrote to memory of 2880 1288 Mkkbcpbl.exe 40 PID 1288 wrote to memory of 2880 1288 Mkkbcpbl.exe 40 PID 1288 wrote to memory of 2880 1288 Mkkbcpbl.exe 40 PID 2880 wrote to memory of 1792 2880 Mnjnolap.exe 41 PID 2880 wrote to memory of 1792 2880 Mnjnolap.exe 41 PID 2880 wrote to memory of 1792 2880 Mnjnolap.exe 41 PID 2880 wrote to memory of 1792 2880 Mnjnolap.exe 41 PID 1792 wrote to memory of 2292 1792 Mpjgag32.exe 42 PID 1792 wrote to memory of 2292 1792 Mpjgag32.exe 42 PID 1792 wrote to memory of 2292 1792 Mpjgag32.exe 42 PID 1792 wrote to memory of 2292 1792 Mpjgag32.exe 42 PID 2292 wrote to memory of 2344 2292 Mgdpnqfn.exe 43 PID 2292 wrote to memory of 2344 2292 Mgdpnqfn.exe 43 PID 2292 wrote to memory of 2344 2292 Mgdpnqfn.exe 43 PID 2292 wrote to memory of 2344 2292 Mgdpnqfn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.f60085d8df53a9e043f6476f9d78a5c0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.f60085d8df53a9e043f6476f9d78a5c0.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\Andkbien.exeC:\Windows\system32\Andkbien.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\Bfieec32.exeC:\Windows\system32\Bfieec32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\Hmojfcdk.exeC:\Windows\system32\Hmojfcdk.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\Lgpjcnhh.exeC:\Windows\system32\Lgpjcnhh.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\Laenqg32.exeC:\Windows\system32\Laenqg32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\Lgbfin32.exeC:\Windows\system32\Lgbfin32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\Lmolkg32.exeC:\Windows\system32\Lmolkg32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\Lobehpok.exeC:\Windows\system32\Lobehpok.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\Lelmei32.exeC:\Windows\system32\Lelmei32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\Modano32.exeC:\Windows\system32\Modano32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\Macnjk32.exeC:\Windows\system32\Macnjk32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\Mkkbcpbl.exeC:\Windows\system32\Mkkbcpbl.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\Mnjnolap.exeC:\Windows\system32\Mnjnolap.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\Mpjgag32.exeC:\Windows\system32\Mpjgag32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\Mgdpnqfn.exeC:\Windows\system32\Mgdpnqfn.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\Mkbhco32.exeC:\Windows\system32\Mkbhco32.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Windows\SysWOW64\Ncnmhajo.exeC:\Windows\system32\Ncnmhajo.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1920 -
C:\Windows\SysWOW64\Oblmom32.exeC:\Windows\system32\Oblmom32.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Windows\SysWOW64\Ogiegc32.exeC:\Windows\system32\Ogiegc32.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2248 -
C:\Windows\SysWOW64\Oqajqi32.exeC:\Windows\system32\Oqajqi32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Windows\SysWOW64\Ogkbmcba.exeC:\Windows\system32\Ogkbmcba.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1372 -
C:\Windows\SysWOW64\Onejjm32.exeC:\Windows\system32\Onejjm32.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1960 -
C:\Windows\SysWOW64\Oeobfgak.exeC:\Windows\system32\Oeobfgak.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1400 -
C:\Windows\SysWOW64\Oiahpkdj.exeC:\Windows\system32\Oiahpkdj.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Windows\SysWOW64\Pifakj32.exeC:\Windows\system32\Pifakj32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Windows\SysWOW64\Pldnge32.exeC:\Windows\system32\Pldnge32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Windows\SysWOW64\Pfjbdn32.exeC:\Windows\system32\Pfjbdn32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2436 -
C:\Windows\SysWOW64\Pbqbioeb.exeC:\Windows\system32\Pbqbioeb.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:972 -
C:\Windows\SysWOW64\Phmkaf32.exeC:\Windows\system32\Phmkaf32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Windows\SysWOW64\Peakkj32.exeC:\Windows\system32\Peakkj32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2648 -
C:\Windows\SysWOW64\Pjndca32.exeC:\Windows\system32\Pjndca32.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Windows\SysWOW64\Qolmip32.exeC:\Windows\system32\Qolmip32.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2576 -
C:\Windows\SysWOW64\Qdieaf32.exeC:\Windows\system32\Qdieaf32.exe34⤵
- Executes dropped EXE
PID:2544 -
C:\Windows\SysWOW64\Qjcmoqlf.exeC:\Windows\system32\Qjcmoqlf.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2732 -
C:\Windows\SysWOW64\Apdobg32.exeC:\Windows\system32\Apdobg32.exe36⤵
- Executes dropped EXE
- Modifies registry class
PID:2824 -
C:\Windows\SysWOW64\Alkpgh32.exeC:\Windows\system32\Alkpgh32.exe37⤵
- Executes dropped EXE
PID:2232 -
C:\Windows\SysWOW64\Aahhoo32.exeC:\Windows\system32\Aahhoo32.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1800 -
C:\Windows\SysWOW64\Almmlg32.exeC:\Windows\system32\Almmlg32.exe39⤵
- Executes dropped EXE
PID:1636 -
C:\Windows\SysWOW64\Bkbjmd32.exeC:\Windows\system32\Bkbjmd32.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1500 -
C:\Windows\SysWOW64\Bdknfiea.exeC:\Windows\system32\Bdknfiea.exe41⤵
- Executes dropped EXE
PID:2204 -
C:\Windows\SysWOW64\Bpbokj32.exeC:\Windows\system32\Bpbokj32.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2164 -
C:\Windows\SysWOW64\Bkgchckl.exeC:\Windows\system32\Bkgchckl.exe43⤵
- Executes dropped EXE
- Modifies registry class
PID:2264 -
C:\Windows\SysWOW64\Bnhljnhm.exeC:\Windows\system32\Bnhljnhm.exe44⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1860 -
C:\Windows\SysWOW64\Bdbdgh32.exeC:\Windows\system32\Bdbdgh32.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1236 -
C:\Windows\SysWOW64\Bcedbefd.exeC:\Windows\system32\Bcedbefd.exe46⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:108 -
C:\Windows\SysWOW64\Bfcqoqeh.exeC:\Windows\system32\Bfcqoqeh.exe47⤵
- Executes dropped EXE
- Modifies registry class
PID:2396 -
C:\Windows\SysWOW64\Bnjipn32.exeC:\Windows\system32\Bnjipn32.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1544 -
C:\Windows\SysWOW64\Colegflh.exeC:\Windows\system32\Colegflh.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2972 -
C:\Windows\SysWOW64\Cfemdp32.exeC:\Windows\system32\Cfemdp32.exe50⤵
- Executes dropped EXE
PID:980 -
C:\Windows\SysWOW64\Conbmfif.exeC:\Windows\system32\Conbmfif.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1408 -
C:\Windows\SysWOW64\Chfffk32.exeC:\Windows\system32\Chfffk32.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2112 -
C:\Windows\SysWOW64\Copobe32.exeC:\Windows\system32\Copobe32.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:3068 -
C:\Windows\SysWOW64\Dddmkkpb.exeC:\Windows\system32\Dddmkkpb.exe54⤵
- Executes dropped EXE
PID:1816 -
C:\Windows\SysWOW64\Onhihepp.exeC:\Windows\system32\Onhihepp.exe55⤵
- Executes dropped EXE
PID:2964 -
C:\Windows\SysWOW64\Oohoeg32.exeC:\Windows\system32\Oohoeg32.exe56⤵
- Executes dropped EXE
PID:1356 -
C:\Windows\SysWOW64\Oagkac32.exeC:\Windows\system32\Oagkac32.exe57⤵
- Executes dropped EXE
PID:2700 -
C:\Windows\SysWOW64\Phacnm32.exeC:\Windows\system32\Phacnm32.exe58⤵
- Executes dropped EXE
PID:2516 -
C:\Windows\SysWOW64\Pkopjh32.exeC:\Windows\system32\Pkopjh32.exe59⤵
- Executes dropped EXE
- Modifies registry class
PID:2496 -
C:\Windows\SysWOW64\Paihgboc.exeC:\Windows\system32\Paihgboc.exe60⤵
- Executes dropped EXE
PID:1312 -
C:\Windows\SysWOW64\Pdhdcnng.exeC:\Windows\system32\Pdhdcnng.exe61⤵
- Executes dropped EXE
PID:592 -
C:\Windows\SysWOW64\Pjdlkeln.exeC:\Windows\system32\Pjdlkeln.exe62⤵
- Executes dropped EXE
PID:1992 -
C:\Windows\SysWOW64\Paldmbmq.exeC:\Windows\system32\Paldmbmq.exe63⤵
- Executes dropped EXE
PID:948 -
C:\Windows\SysWOW64\Pcmadj32.exeC:\Windows\system32\Pcmadj32.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1968 -
C:\Windows\SysWOW64\Pkdiehca.exeC:\Windows\system32\Pkdiehca.exe65⤵
- Executes dropped EXE
PID:736 -
C:\Windows\SysWOW64\Pnbeacbd.exeC:\Windows\system32\Pnbeacbd.exe66⤵PID:1536
-
C:\Windows\SysWOW64\Pqaanoah.exeC:\Windows\system32\Pqaanoah.exe67⤵
- Modifies registry class
PID:1516 -
C:\Windows\SysWOW64\Pfnjfepp.exeC:\Windows\system32\Pfnjfepp.exe68⤵PID:1524
-
C:\Windows\SysWOW64\Aghidl32.exeC:\Windows\system32\Aghidl32.exe69⤵PID:1472
-
C:\Windows\SysWOW64\Aooaej32.exeC:\Windows\system32\Aooaej32.exe70⤵
- Drops file in System32 directory
- Modifies registry class
PID:1708 -
C:\Windows\SysWOW64\Abnmae32.exeC:\Windows\system32\Abnmae32.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1128 -
C:\Windows\SysWOW64\Aeljmq32.exeC:\Windows\system32\Aeljmq32.exe72⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1344 -
C:\Windows\SysWOW64\Agkfil32.exeC:\Windows\system32\Agkfil32.exe73⤵
- Drops file in System32 directory
PID:1124 -
C:\Windows\SysWOW64\Andnff32.exeC:\Windows\system32\Andnff32.exe74⤵PID:1020
-
C:\Windows\SysWOW64\Aacjba32.exeC:\Windows\system32\Aacjba32.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2928 -
C:\Windows\SysWOW64\Ajkokgia.exeC:\Windows\system32\Ajkokgia.exe76⤵
- Drops file in System32 directory
PID:1644 -
C:\Windows\SysWOW64\Amjkgbhe.exeC:\Windows\system32\Amjkgbhe.exe77⤵
- Drops file in System32 directory
- Modifies registry class
PID:920 -
C:\Windows\SysWOW64\Acdcdm32.exeC:\Windows\system32\Acdcdm32.exe78⤵
- Drops file in System32 directory
PID:1532 -
C:\Windows\SysWOW64\Ajnlqgfo.exeC:\Windows\system32\Ajnlqgfo.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1496 -
C:\Windows\SysWOW64\Acfpilmp.exeC:\Windows\system32\Acfpilmp.exe80⤵PID:852
-
C:\Windows\SysWOW64\Bfdlehlc.exeC:\Windows\system32\Bfdlehlc.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2092 -
C:\Windows\SysWOW64\Blkgdmbp.exeC:\Windows\system32\Blkgdmbp.exe82⤵PID:2644
-
C:\Windows\SysWOW64\Cagpldqg.exeC:\Windows\system32\Cagpldqg.exe83⤵PID:3000
-
C:\Windows\SysWOW64\Cdflhppk.exeC:\Windows\system32\Cdflhppk.exe84⤵PID:3024
-
C:\Windows\SysWOW64\Ckpdej32.exeC:\Windows\system32\Ckpdej32.exe85⤵
- Drops file in System32 directory
- Modifies registry class
PID:2224 -
C:\Windows\SysWOW64\Cmnqae32.exeC:\Windows\system32\Cmnqae32.exe86⤵PID:2876
-
C:\Windows\SysWOW64\Ceeibbgn.exeC:\Windows\system32\Ceeibbgn.exe87⤵
- Modifies registry class
PID:1588 -
C:\Windows\SysWOW64\Ckbakiee.exeC:\Windows\system32\Ckbakiee.exe88⤵PID:1688
-
C:\Windows\SysWOW64\Cmqmgedi.exeC:\Windows\system32\Cmqmgedi.exe89⤵PID:1548
-
C:\Windows\SysWOW64\Dilggefh.exeC:\Windows\system32\Dilggefh.exe90⤵PID:2612
-
C:\Windows\SysWOW64\Doipoldo.exeC:\Windows\system32\Doipoldo.exe91⤵PID:2772
-
C:\Windows\SysWOW64\Dhadhakp.exeC:\Windows\system32\Dhadhakp.exe92⤵PID:560
-
C:\Windows\SysWOW64\Dokmel32.exeC:\Windows\system32\Dokmel32.exe93⤵PID:1812
-
C:\Windows\SysWOW64\Deeeafii.exeC:\Windows\system32\Deeeafii.exe94⤵
- Drops file in System32 directory
PID:2804 -
C:\Windows\SysWOW64\Diqabd32.exeC:\Windows\system32\Diqabd32.exe95⤵
- Modifies registry class
PID:2748 -
C:\Windows\SysWOW64\Dhcanahm.exeC:\Windows\system32\Dhcanahm.exe96⤵
- Drops file in System32 directory
PID:2840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Donijk32.exeC:\Windows\system32\Donijk32.exe1⤵PID:2476
-
C:\Windows\SysWOW64\Degage32.exeC:\Windows\system32\Degage32.exe2⤵PID:1300
-
C:\Windows\SysWOW64\Dopfpkng.exeC:\Windows\system32\Dopfpkng.exe3⤵PID:1632
-
C:\Windows\SysWOW64\Ddmohbln.exeC:\Windows\system32\Ddmohbln.exe4⤵
- Drops file in System32 directory
PID:3012 -
C:\Windows\SysWOW64\Dgkkdnkb.exeC:\Windows\system32\Dgkkdnkb.exe5⤵PID:880
-
C:\Windows\SysWOW64\Epcomc32.exeC:\Windows\system32\Epcomc32.exe6⤵PID:1684
-
C:\Windows\SysWOW64\Elafbcao.exeC:\Windows\system32\Elafbcao.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2900 -
C:\Windows\SysWOW64\Eckopm32.exeC:\Windows\system32\Eckopm32.exe8⤵
- Modifies registry class
PID:2084 -
C:\Windows\SysWOW64\Efjklh32.exeC:\Windows\system32\Efjklh32.exe9⤵
- Drops file in System32 directory
PID:760 -
C:\Windows\SysWOW64\Ehhghdgc.exeC:\Windows\system32\Ehhghdgc.exe10⤵
- Drops file in System32 directory
PID:1056 -
C:\Windows\SysWOW64\Fobodn32.exeC:\Windows\system32\Fobodn32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2312 -
C:\Windows\SysWOW64\Fflgahfm.exeC:\Windows\system32\Fflgahfm.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:296 -
C:\Windows\SysWOW64\Fmfpnb32.exeC:\Windows\system32\Fmfpnb32.exe13⤵PID:2948
-
C:\Windows\SysWOW64\Fnglekch.exeC:\Windows\system32\Fnglekch.exe14⤵
- Drops file in System32 directory
PID:3056 -
C:\Windows\SysWOW64\Ffndghdj.exeC:\Windows\system32\Ffndghdj.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3048 -
C:\Windows\SysWOW64\Fkkmoo32.exeC:\Windows\system32\Fkkmoo32.exe16⤵PID:1256
-
C:\Windows\SysWOW64\Fogipnjj.exeC:\Windows\system32\Fogipnjj.exe17⤵PID:2544
-
C:\Windows\SysWOW64\Fiomhc32.exeC:\Windows\system32\Fiomhc32.exe18⤵PID:1800
-
C:\Windows\SysWOW64\Fjpipkgi.exeC:\Windows\system32\Fjpipkgi.exe19⤵PID:1728
-
C:\Windows\SysWOW64\Fefnmdfo.exeC:\Windows\system32\Fefnmdfo.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2052 -
C:\Windows\SysWOW64\Fgdjipfc.exeC:\Windows\system32\Fgdjipfc.exe21⤵PID:2816
-
C:\Windows\SysWOW64\Fnnbfjmp.exeC:\Windows\system32\Fnnbfjmp.exe22⤵
- Drops file in System32 directory
- Modifies registry class
PID:1664 -
C:\Windows\SysWOW64\Oabdol32.exeC:\Windows\system32\Oabdol32.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2164 -
C:\Windows\SysWOW64\Mhfckc32.exeC:\Windows\system32\Mhfckc32.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2504 -
C:\Windows\SysWOW64\Ebddmq32.exeC:\Windows\system32\Ebddmq32.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2736 -
C:\Windows\SysWOW64\Kipfhbmo.exeC:\Windows\system32\Kipfhbmo.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1980 -
C:\Windows\SysWOW64\Kmlbia32.exeC:\Windows\system32\Kmlbia32.exe27⤵
- Drops file in System32 directory
PID:1788 -
C:\Windows\SysWOW64\Kdfjekmd.exeC:\Windows\system32\Kdfjekmd.exe28⤵PID:2472
-
C:\Windows\SysWOW64\Kgdgaflh.exeC:\Windows\system32\Kgdgaflh.exe29⤵
- Modifies registry class
PID:2968 -
C:\Windows\SysWOW64\Kmnonqce.exeC:\Windows\system32\Kmnonqce.exe30⤵
- Drops file in System32 directory
- Modifies registry class
PID:2892 -
C:\Windows\SysWOW64\Kpmkjlbi.exeC:\Windows\system32\Kpmkjlbi.exe31⤵
- Modifies registry class
PID:1680 -
C:\Windows\SysWOW64\Kbkgfgam.exeC:\Windows\system32\Kbkgfgam.exe32⤵
- Modifies registry class
PID:808 -
C:\Windows\SysWOW64\Kiepca32.exeC:\Windows\system32\Kiepca32.exe33⤵
- Drops file in System32 directory
- Modifies registry class
PID:612 -
C:\Windows\SysWOW64\Kpohplpf.exeC:\Windows\system32\Kpohplpf.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2336 -
C:\Windows\SysWOW64\Lcmdlgoj.exeC:\Windows\system32\Lcmdlgoj.exe35⤵
- Drops file in System32 directory
PID:1348 -
C:\Windows\SysWOW64\Lelphbon.exeC:\Windows\system32\Lelphbon.exe36⤵PID:2792
-
C:\Windows\SysWOW64\Lcbngf32.exeC:\Windows\system32\Lcbngf32.exe37⤵PID:2100
-
C:\Windows\SysWOW64\Leqjcb32.exeC:\Windows\system32\Leqjcb32.exe38⤵
- Drops file in System32 directory
- Modifies registry class
PID:1744 -
C:\Windows\SysWOW64\Lljbpl32.exeC:\Windows\system32\Lljbpl32.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2440 -
C:\Windows\SysWOW64\Loinlg32.exeC:\Windows\system32\Loinlg32.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1984 -
C:\Windows\SysWOW64\Lagjhc32.exeC:\Windows\system32\Lagjhc32.exe41⤵
- Drops file in System32 directory
PID:2796 -
C:\Windows\SysWOW64\Ldfgdn32.exeC:\Windows\system32\Ldfgdn32.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2652 -
C:\Windows\SysWOW64\Lhabemgi.exeC:\Windows\system32\Lhabemgi.exe43⤵
- Drops file in System32 directory
PID:2216 -
C:\Windows\SysWOW64\Lokkag32.exeC:\Windows\system32\Lokkag32.exe44⤵PID:2324
-
C:\Windows\SysWOW64\Lajgnb32.exeC:\Windows\system32\Lajgnb32.exe45⤵
- Drops file in System32 directory
PID:1792 -
C:\Windows\SysWOW64\Ldhcjn32.exeC:\Windows\system32\Ldhcjn32.exe46⤵PID:2032
-
C:\Windows\SysWOW64\Ljelbeke.exeC:\Windows\system32\Ljelbeke.exe47⤵PID:2700
-
C:\Windows\SysWOW64\Mfnime32.exeC:\Windows\system32\Mfnime32.exe48⤵PID:1836
-
C:\Windows\SysWOW64\Mlhaip32.exeC:\Windows\system32\Mlhaip32.exe49⤵PID:2248
-
C:\Windows\SysWOW64\Mofnek32.exeC:\Windows\system32\Mofnek32.exe50⤵PID:1524
-
C:\Windows\SysWOW64\Mfpfbemc.exeC:\Windows\system32\Mfpfbemc.exe51⤵
- Modifies registry class
PID:108 -
C:\Windows\SysWOW64\Mljnoo32.exeC:\Windows\system32\Mljnoo32.exe52⤵PID:1776
-
C:\Windows\SysWOW64\Moijkk32.exeC:\Windows\system32\Moijkk32.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2724 -
C:\Windows\SysWOW64\Mokgqjaa.exeC:\Windows\system32\Mokgqjaa.exe54⤵PID:1716
-
C:\Windows\SysWOW64\Nhclip32.exeC:\Windows\system32\Nhclip32.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2984 -
C:\Windows\SysWOW64\Nomdfjpo.exeC:\Windows\system32\Nomdfjpo.exe56⤵PID:2500
-
C:\Windows\SysWOW64\Nfglcd32.exeC:\Windows\system32\Nfglcd32.exe57⤵PID:2612
-
C:\Windows\SysWOW64\Ngiikmmj.exeC:\Windows\system32\Ngiikmmj.exe58⤵
- Modifies registry class
PID:1408 -
C:\Windows\SysWOW64\Nopqlj32.exeC:\Windows\system32\Nopqlj32.exe59⤵PID:1036
-
C:\Windows\SysWOW64\Nqamcbcj.exeC:\Windows\system32\Nqamcbcj.exe60⤵PID:1372
-
C:\Windows\SysWOW64\Ngkepl32.exeC:\Windows\system32\Ngkepl32.exe61⤵PID:1684
-
C:\Windows\SysWOW64\Njialh32.exeC:\Windows\system32\Njialh32.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1732 -
C:\Windows\SysWOW64\Nbqjne32.exeC:\Windows\system32\Nbqjne32.exe63⤵PID:296
-
C:\Windows\SysWOW64\Ngmbfl32.exeC:\Windows\system32\Ngmbfl32.exe64⤵PID:2708
-
C:\Windows\SysWOW64\Nmjknb32.exeC:\Windows\system32\Nmjknb32.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:1088 -
C:\Windows\SysWOW64\Ncdckm32.exeC:\Windows\system32\Ncdckm32.exe66⤵PID:2864
-
C:\Windows\SysWOW64\Nnjghe32.exeC:\Windows\system32\Nnjghe32.exe67⤵PID:1052
-
C:\Windows\SysWOW64\Ocfppm32.exeC:\Windows\system32\Ocfppm32.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1988 -
C:\Windows\SysWOW64\Ofellh32.exeC:\Windows\system32\Ofellh32.exe69⤵PID:1488
-
C:\Windows\SysWOW64\Oajpjq32.exeC:\Windows\system32\Oajpjq32.exe70⤵PID:1264
-
C:\Windows\SysWOW64\Omaqoa32.exeC:\Windows\system32\Omaqoa32.exe71⤵PID:2676
-
C:\Windows\SysWOW64\Omcmda32.exeC:\Windows\system32\Omcmda32.exe72⤵PID:2132
-
C:\Windows\SysWOW64\Onejljep.exeC:\Windows\system32\Onejljep.exe73⤵PID:1652
-
C:\Windows\SysWOW64\Oeobidll.exeC:\Windows\system32\Oeobidll.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2064 -
C:\Windows\SysWOW64\Olijen32.exeC:\Windows\system32\Olijen32.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1640 -
C:\Windows\SysWOW64\Ongfai32.exeC:\Windows\system32\Ongfai32.exe76⤵
- Modifies registry class
PID:1944 -
C:\Windows\SysWOW64\Oeaoncjj.exeC:\Windows\system32\Oeaoncjj.exe77⤵PID:788
-
C:\Windows\SysWOW64\Plkgkn32.exeC:\Windows\system32\Plkgkn32.exe78⤵PID:2232
-
C:\Windows\SysWOW64\Pnicgi32.exeC:\Windows\system32\Pnicgi32.exe79⤵
- Drops file in System32 directory
PID:2668 -
C:\Windows\SysWOW64\Pjpdlj32.exeC:\Windows\system32\Pjpdlj32.exe80⤵
- Modifies registry class
PID:2692 -
C:\Windows\SysWOW64\Pmophe32.exeC:\Windows\system32\Pmophe32.exe81⤵PID:2656
-
C:\Windows\SysWOW64\Pdhhepmo.exeC:\Windows\system32\Pdhhepmo.exe82⤵PID:1760
-
C:\Windows\SysWOW64\Pjbqaj32.exeC:\Windows\system32\Pjbqaj32.exe83⤵
- Modifies registry class
PID:928 -
C:\Windows\SysWOW64\Ppoijq32.exeC:\Windows\system32\Ppoijq32.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1280 -
C:\Windows\SysWOW64\Phfaknce.exeC:\Windows\system32\Phfaknce.exe85⤵PID:2264
-
C:\Windows\SysWOW64\Pjemgibi.exeC:\Windows\system32\Pjemgibi.exe86⤵
- Drops file in System32 directory
PID:2020 -
C:\Windows\SysWOW64\Pdmbpo32.exeC:\Windows\system32\Pdmbpo32.exe87⤵PID:1544
-
C:\Windows\SysWOW64\Pjgjmipf.exeC:\Windows\system32\Pjgjmipf.exe88⤵
- Drops file in System32 directory
PID:2972 -
C:\Windows\SysWOW64\Plhfda32.exeC:\Windows\system32\Plhfda32.exe89⤵
- Modifies registry class
PID:852 -
C:\Windows\SysWOW64\Pdpoeo32.exeC:\Windows\system32\Pdpoeo32.exe90⤵PID:3024
-
C:\Windows\SysWOW64\Qeakmg32.exeC:\Windows\system32\Qeakmg32.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2572 -
C:\Windows\SysWOW64\Qoipflcf.exeC:\Windows\system32\Qoipflcf.exe92⤵
- Modifies registry class
PID:1548 -
C:\Windows\SysWOW64\Qfpggjdh.exeC:\Windows\system32\Qfpggjdh.exe93⤵PID:1812
-
C:\Windows\SysWOW64\Qiodcecl.exeC:\Windows\system32\Qiodcecl.exe94⤵PID:756
-
C:\Windows\SysWOW64\Aollklac.exeC:\Windows\system32\Aollklac.exe95⤵PID:2236
-
C:\Windows\SysWOW64\Alpmep32.exeC:\Windows\system32\Alpmep32.exe96⤵
- Modifies registry class
PID:2372 -
C:\Windows\SysWOW64\Aehanfgm.exeC:\Windows\system32\Aehanfgm.exe97⤵PID:2084
-
C:\Windows\SysWOW64\Akdjfmed.exeC:\Windows\system32\Akdjfmed.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:672 -
C:\Windows\SysWOW64\Aaobcg32.exeC:\Windows\system32\Aaobcg32.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:268 -
C:\Windows\SysWOW64\Agkjknji.exeC:\Windows\system32\Agkjknji.exe100⤵PID:2600
-
C:\Windows\SysWOW64\Aaaohfjo.exeC:\Windows\system32\Aaaohfjo.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1696 -
C:\Windows\SysWOW64\Agngqmhf.exeC:\Windows\system32\Agngqmhf.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1576 -
C:\Windows\SysWOW64\Anhomg32.exeC:\Windows\system32\Anhomg32.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1228 -
C:\Windows\SysWOW64\Acdhen32.exeC:\Windows\system32\Acdhen32.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1092 -
C:\Windows\SysWOW64\Bnjlcgnp.exeC:\Windows\system32\Bnjlcgnp.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2316 -
C:\Windows\SysWOW64\Bgbqlm32.exeC:\Windows\system32\Bgbqlm32.exe106⤵
- Drops file in System32 directory
- Modifies registry class
PID:1392 -
C:\Windows\SysWOW64\Bjamhh32.exeC:\Windows\system32\Bjamhh32.exe107⤵PID:1328
-
C:\Windows\SysWOW64\Bciaqnje.exeC:\Windows\system32\Bciaqnje.exe108⤵
- Modifies registry class
PID:1304 -
C:\Windows\SysWOW64\Blaficqe.exeC:\Windows\system32\Blaficqe.exe109⤵PID:2096
-
C:\Windows\SysWOW64\Bopbeopi.exeC:\Windows\system32\Bopbeopi.exe110⤵
- Modifies registry class
PID:2008 -
C:\Windows\SysWOW64\Bclnfm32.exeC:\Windows\system32\Bclnfm32.exe111⤵
- Drops file in System32 directory
PID:828 -
C:\Windows\SysWOW64\Bfjjbi32.exeC:\Windows\system32\Bfjjbi32.exe112⤵
- Drops file in System32 directory
PID:1920 -
C:\Windows\SysWOW64\Bdogceln.exeC:\Windows\system32\Bdogceln.exe113⤵
- Drops file in System32 directory
- Modifies registry class
PID:932 -
C:\Windows\SysWOW64\Cfocmhcq.exeC:\Windows\system32\Cfocmhcq.exe114⤵
- Drops file in System32 directory
- Modifies registry class
PID:2364 -
C:\Windows\SysWOW64\Chmpicbd.exeC:\Windows\system32\Chmpicbd.exe115⤵PID:1236
-
C:\Windows\SysWOW64\Cgppep32.exeC:\Windows\system32\Cgppep32.exe116⤵PID:2188
-
C:\Windows\SysWOW64\Kakfkg32.exeC:\Windows\system32\Kakfkg32.exe117⤵PID:1420
-
C:\Windows\SysWOW64\Gnnbhf32.exeC:\Windows\system32\Gnnbhf32.exe118⤵PID:2436
-
C:\Windows\SysWOW64\Cmofok32.exeC:\Windows\system32\Cmofok32.exe119⤵
- Modifies registry class
PID:2340 -
C:\Windows\SysWOW64\Dednil32.exeC:\Windows\system32\Dednil32.exe120⤵PID:2780
-
C:\Windows\SysWOW64\Dhbjeg32.exeC:\Windows\system32\Dhbjeg32.exe121⤵PID:2576
-
C:\Windows\SysWOW64\Dnobmnnj.exeC:\Windows\system32\Dnobmnnj.exe122⤵
- Drops file in System32 directory
- Modifies registry class
PID:1932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-