Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 14:19
Behavioral task
behavioral1
Sample
NEAS.c44bac043d2eb7ab891f5e2a1a39c110.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.c44bac043d2eb7ab891f5e2a1a39c110.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.c44bac043d2eb7ab891f5e2a1a39c110.exe
-
Size
664KB
-
MD5
c44bac043d2eb7ab891f5e2a1a39c110
-
SHA1
026a1634a90ae2e798674efd16aa8dd10dfd357f
-
SHA256
ba9b93885ceca388a4689003ecc472f4c4b8d15c029c58011bf14e14ad731a76
-
SHA512
aa8697df797a7cc9d1f5c0ecbb33cffde1c89c2aeeb0e758592c9ec3d653b218cfd4bf03aad1ec95f83e9cb89478444e164350b03c13dc0f6716c70e76be79f4
-
SSDEEP
12288:GRALQGFKpV6yYP4rbpV6yYPg058KpV6yYPNUir2MhNl6zX3w9As/xO23WM6tJmDk:pLQGFKW4XWleKWNUir2MhNl6zX3w9AsE
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbajlo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dknnoofg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bplhhc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eqbcqnph.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icbpkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dknnoofg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fnhbmgmk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bgkipl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fanbll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gfngke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Djcfee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Igbaeh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpljehpo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Koimbpbc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdpagc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnlhncgi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gpgihh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Koggehff.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgifbhid.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdppllld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ponfed32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgqhki32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glcelq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gokdoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nhokljge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pdqcenmg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddcogo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofjokc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Impldi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkeedk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Edjgpi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmpcdfll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Clohhbli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ffbgog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qejfkmem.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icgjfgef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cpbbln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fhofffjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pfagighf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pblajhje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dgihop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Poqckdap.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ladpcb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fllplajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jpoagb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hojndd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bllble32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dlpgiebo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eaekmdep.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Flgaodbm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejklfd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eagahnob.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipflcnln.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icogcjde.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nlnpio32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjanjb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Filicodb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Obkahddl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fgcang32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ghnibj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lhkkjl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cclagm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hqdkkp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ocknbglo.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x00090000000222f4-6.dat family_berbew behavioral2/files/0x00090000000222f4-8.dat family_berbew behavioral2/files/0x0007000000022e01-14.dat family_berbew behavioral2/files/0x0007000000022e01-16.dat family_berbew behavioral2/files/0x0007000000022e03-24.dat family_berbew behavioral2/files/0x0007000000022e03-21.dat family_berbew behavioral2/files/0x0007000000022e07-30.dat family_berbew behavioral2/files/0x0007000000022e07-32.dat family_berbew behavioral2/files/0x0007000000022e09-38.dat family_berbew behavioral2/files/0x0007000000022e09-40.dat family_berbew behavioral2/files/0x0007000000022e0b-46.dat family_berbew behavioral2/files/0x0007000000022e0b-48.dat family_berbew behavioral2/files/0x0007000000022e0d-54.dat family_berbew behavioral2/files/0x0007000000022e0d-56.dat family_berbew behavioral2/files/0x0007000000022e12-57.dat family_berbew behavioral2/files/0x0007000000022e12-64.dat family_berbew behavioral2/files/0x0006000000022e1b-71.dat family_berbew behavioral2/files/0x0006000000022e1d-79.dat family_berbew behavioral2/files/0x0006000000022e1d-78.dat family_berbew behavioral2/files/0x0006000000022e1b-70.dat family_berbew behavioral2/files/0x0007000000022e12-62.dat family_berbew behavioral2/files/0x0006000000022e20-86.dat family_berbew behavioral2/files/0x0006000000022e20-87.dat family_berbew behavioral2/files/0x0006000000022e25-94.dat family_berbew behavioral2/files/0x0006000000022e25-96.dat family_berbew behavioral2/files/0x0006000000022e29-97.dat family_berbew behavioral2/files/0x0006000000022e29-102.dat family_berbew behavioral2/files/0x0006000000022e29-103.dat family_berbew behavioral2/files/0x0006000000022e32-111.dat family_berbew behavioral2/files/0x0006000000022e32-110.dat family_berbew behavioral2/files/0x0006000000022e34-118.dat family_berbew behavioral2/files/0x0006000000022e34-119.dat family_berbew behavioral2/files/0x0006000000022e36-126.dat family_berbew behavioral2/files/0x0007000000022e2e-136.dat family_berbew behavioral2/files/0x0007000000022e2e-134.dat family_berbew behavioral2/files/0x0006000000022e36-127.dat family_berbew behavioral2/files/0x0006000000022e3b-142.dat family_berbew behavioral2/files/0x0006000000022e3b-143.dat family_berbew behavioral2/files/0x0007000000022e31-150.dat family_berbew behavioral2/files/0x0007000000022e31-152.dat family_berbew behavioral2/files/0x0006000000022e3e-158.dat family_berbew behavioral2/files/0x0006000000022e3e-160.dat family_berbew behavioral2/files/0x0006000000022e46-166.dat family_berbew behavioral2/files/0x0009000000022d24-174.dat family_berbew behavioral2/files/0x0009000000022d24-176.dat family_berbew behavioral2/files/0x0007000000022e41-182.dat family_berbew behavioral2/files/0x0007000000022e41-184.dat family_berbew behavioral2/files/0x0008000000022e4a-199.dat family_berbew behavioral2/files/0x0008000000022e4a-198.dat family_berbew behavioral2/files/0x0008000000022e43-191.dat family_berbew behavioral2/files/0x0008000000022e43-190.dat family_berbew behavioral2/files/0x0006000000022e4e-206.dat family_berbew behavioral2/files/0x0006000000022e52-222.dat family_berbew behavioral2/files/0x0006000000022e54-229.dat family_berbew behavioral2/files/0x0006000000022e54-228.dat family_berbew behavioral2/files/0x0006000000022e52-221.dat family_berbew behavioral2/files/0x0006000000022e50-215.dat family_berbew behavioral2/files/0x0006000000022e50-214.dat family_berbew behavioral2/files/0x0006000000022e4e-207.dat family_berbew behavioral2/files/0x0006000000022e57-243.dat family_berbew behavioral2/files/0x0006000000022e57-244.dat family_berbew behavioral2/files/0x0008000000022d21-251.dat family_berbew behavioral2/files/0x0008000000022d21-253.dat family_berbew behavioral2/files/0x0006000000022e5b-259.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1876 Dmpfbk32.exe 4220 Djfcaohp.exe 4656 Djhpgofm.exe 1528 Edemkd32.exe 4344 Gkiaej32.exe 2592 Nlphbnoe.exe 1568 Hmbfbn32.exe 4556 Kmaopfjm.exe 3788 Nmigoagp.exe 2092 Nhokljge.exe 408 Neclenfo.exe 2944 Omqmop32.exe 3532 Bkaobnio.exe 4496 Dheibpje.exe 436 Dmcain32.exe 3636 Dndnpf32.exe 2368 Eofgpikj.exe 5044 Eecphp32.exe 396 Eokqkh32.exe 3016 Njmqnobn.exe 1632 Bpdnjple.exe 3556 Bmjkic32.exe 3192 Bnlhncgi.exe 3684 Boldhf32.exe 2024 Cpmapodj.exe 632 Ckbemgcp.exe 4172 Cammjakm.exe 4832 Cgifbhid.exe 1320 Cncnob32.exe 1808 Cpbjkn32.exe 4060 Mjidgkog.exe 3764 Mljmhflh.exe 4212 Mjpjgj32.exe 4524 Nhegig32.exe 1848 Nbnlaldg.exe 4932 Pbcncibp.exe 4328 Padnaq32.exe 4628 Pfagighf.exe 3244 Ppikbm32.exe 3632 Pcgdhkem.exe 4992 Pmphaaln.exe 4952 Pblajhje.exe 1132 Qpbnhl32.exe 3236 Amfobp32.exe 4684 Abcgjg32.exe 1700 Amikgpcc.exe 3060 Abfdpfaj.exe 4808 Afcmfe32.exe 4392 Amnebo32.exe 404 Ajaelc32.exe 5092 Adjjeieh.exe 3860 Bmbnnn32.exe 2420 Bdlfjh32.exe 3348 Biiobo32.exe 3152 Bbaclegm.exe 3008 Bpedeiff.exe 4388 Bfolacnc.exe 4872 Bdeiqgkj.exe 3000 Cpljehpo.exe 4868 Ckbncapd.exe 3096 Cpogkhnl.exe 4484 Cpacqg32.exe 4656 Cmedjl32.exe 4472 Cdolgfbp.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Leldmdbk.dll Bbaclegm.exe File created C:\Windows\SysWOW64\Mobpnd32.dll Kbjbnnfg.exe File created C:\Windows\SysWOW64\Famnbgil.dll Apimodmh.exe File opened for modification C:\Windows\SysWOW64\Efolidno.exe Ecpomiok.exe File created C:\Windows\SysWOW64\Hmcocn32.exe Helfbqeb.exe File opened for modification C:\Windows\SysWOW64\Djhpgofm.exe Djfcaohp.exe File created C:\Windows\SysWOW64\Ejjjgdba.dll Ioppho32.exe File opened for modification C:\Windows\SysWOW64\Doidql32.exe Dnhgidka.exe File opened for modification C:\Windows\SysWOW64\Ggldde32.exe Gpelchhp.exe File created C:\Windows\SysWOW64\Aohcbiop.dll Knenffqf.exe File opened for modification C:\Windows\SysWOW64\Bpdnjple.exe Njmqnobn.exe File opened for modification C:\Windows\SysWOW64\Pmphaaln.exe Pcgdhkem.exe File created C:\Windows\SysWOW64\Eegoch32.dll Mbbcofpf.exe File created C:\Windows\SysWOW64\Hknkiokp.exe Hhoomd32.exe File created C:\Windows\SysWOW64\Haaggn32.dll Bpemkcck.exe File opened for modification C:\Windows\SysWOW64\Poqckdap.exe Ponfed32.exe File opened for modification C:\Windows\SysWOW64\Nhokljge.exe Nmigoagp.exe File opened for modification C:\Windows\SysWOW64\Qmckbjdl.exe Qbngeadf.exe File created C:\Windows\SysWOW64\Mkckfk32.dll Dkkcqj32.exe File created C:\Windows\SysWOW64\Cdjlap32.exe Cmpcdfll.exe File created C:\Windows\SysWOW64\Ghcjedcj.exe Gaibhj32.exe File created C:\Windows\SysWOW64\Hhmmkcko.exe Hpeejfjm.exe File opened for modification C:\Windows\SysWOW64\Hpaibe32.exe Hncmfj32.exe File opened for modification C:\Windows\SysWOW64\Loecgfjf.exe Lhkkjl32.exe File opened for modification C:\Windows\SysWOW64\Helfbqeb.exe Hbnjfefo.exe File created C:\Windows\SysWOW64\Gbdmnl32.dll Ifgbhbbh.exe File created C:\Windows\SysWOW64\Ddpapmqq.dll Dheibpje.exe File created C:\Windows\SysWOW64\Ckjfdocc.dll Amfobp32.exe File created C:\Windows\SysWOW64\Pbddobla.exe Pkklbh32.exe File opened for modification C:\Windows\SysWOW64\Iandjg32.exe Iophnl32.exe File opened for modification C:\Windows\SysWOW64\Jondojna.exe Jggmnmmo.exe File created C:\Windows\SysWOW64\Cfjnch32.exe Cclagm32.exe File created C:\Windows\SysWOW64\Npaphh32.dll Ecpomiok.exe File created C:\Windows\SysWOW64\Gjmmfq32.exe Gpgihh32.exe File opened for modification C:\Windows\SysWOW64\Iobecl32.exe Igkmbn32.exe File opened for modification C:\Windows\SysWOW64\Fdbdkn32.exe Edhado32.exe File created C:\Windows\SysWOW64\Cfogohpa.exe Cabofaaj.exe File created C:\Windows\SysWOW64\Djojepof.dll Famhmfkl.exe File created C:\Windows\SysWOW64\Jggmnmmo.exe Jpmdabfb.exe File created C:\Windows\SysWOW64\Ipakqcbi.dll Mnmmmbll.exe File created C:\Windows\SysWOW64\Klohlg32.dll Eqdpfm32.exe File opened for modification C:\Windows\SysWOW64\Hmdlhk32.exe Hjfplo32.exe File created C:\Windows\SysWOW64\Imajlp32.dll Cimckcoe.exe File opened for modification C:\Windows\SysWOW64\Piceflpi.exe Pbimjb32.exe File created C:\Windows\SysWOW64\Pjmmohcf.dll Nldjnk32.exe File created C:\Windows\SysWOW64\Gejieddc.dll Icbpkg32.exe File opened for modification C:\Windows\SysWOW64\Ehlpjikd.exe Dmglmpkn.exe File created C:\Windows\SysWOW64\Ihknibbo.exe Ipdfheal.exe File created C:\Windows\SysWOW64\Poigcbng.dll Bkaobnio.exe File created C:\Windows\SysWOW64\Ipdkapdh.dll Mlbpma32.exe File opened for modification C:\Windows\SysWOW64\Cfhhml32.exe Cdjlap32.exe File created C:\Windows\SysWOW64\Fdffkgpc.exe Fagjolao.exe File created C:\Windows\SysWOW64\Nchihe32.dll Dqhpjohb.exe File created C:\Windows\SysWOW64\Cggalc32.dll Hjchjl32.exe File created C:\Windows\SysWOW64\Dgikpi32.dll Kkdoje32.exe File opened for modification C:\Windows\SysWOW64\Ghnibj32.exe Gfomfo32.exe File opened for modification C:\Windows\SysWOW64\Cfjnch32.exe Cclagm32.exe File created C:\Windows\SysWOW64\Ncmdcq32.dll Eecdcckf.exe File opened for modification C:\Windows\SysWOW64\Dmglmpkn.exe Diicfa32.exe File created C:\Windows\SysWOW64\Ldnbdnlc.exe Lgibjj32.exe File created C:\Windows\SysWOW64\Kacpncqg.dll Gnhdea32.exe File created C:\Windows\SysWOW64\Daiegp32.exe Dibmfb32.exe File opened for modification C:\Windows\SysWOW64\Bmjkic32.exe Bpfkpp32.exe File created C:\Windows\SysWOW64\Bibokqno.dll Jhhodg32.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mdpagc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Aijlgkjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chdmnkig.dll" Hkkhjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idbmkn32.dll" Eolhlh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fhhpfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dheibpje.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Icogcjde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fboioldm.dll" Fcnlng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gffhbljh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gifadggi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bpfkpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mjidgkog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deiljq32.dll" Bmbnnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hndakp32.dll" Cajblmci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gafmkp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jacnegep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlhhjg32.dll" Kdfmcobk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gbmaog32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Daiegp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pklcmpbo.dll" Dffmogji.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Enfcjb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbjhjpmp.dll" Fllplajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cipokd32.dll" Gaoihfoo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ipdfheal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Iklgkmop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Injmlbkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dajbaika.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckpenokc.dll" Eobffk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddifbphg.dll" Impldi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fomhnmgp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gmlhbo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkcghg32.dll" Ecgodpgb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bpemkcck.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbecgn32.dll" Dnhgidka.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gagebknp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blbhngfl.dll" Cpbbln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ccfcpm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gnfmapqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ipdfheal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ofjokc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jjihfbno.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Glkdejcd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdlajf32.dll" Ikifhm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fclnkgap.dll" Fhemfbnq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kblpcndd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pdqcenmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dfeibf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hillnoif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hojmobdn.dll" Hhdhhchf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqfnqg32.dll" Khihld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkchehih.dll" Dpjompqc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olgjef32.dll" Hnpognhd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dmcain32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kgphje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpholohh.dll" Dmpfla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfjojopo.dll" Ealkcm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gjmmfq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdjmci32.dll" Flgaodbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbpkkeen.dll" Bpedeiff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Poqckdap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlfkdnlg.dll" Hdodeedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Eecdcckf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Khfkfedn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ihkila32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4940 wrote to memory of 1876 4940 NEAS.c44bac043d2eb7ab891f5e2a1a39c110.exe 86 PID 4940 wrote to memory of 1876 4940 NEAS.c44bac043d2eb7ab891f5e2a1a39c110.exe 86 PID 4940 wrote to memory of 1876 4940 NEAS.c44bac043d2eb7ab891f5e2a1a39c110.exe 86 PID 1876 wrote to memory of 4220 1876 Dmpfbk32.exe 87 PID 1876 wrote to memory of 4220 1876 Dmpfbk32.exe 87 PID 1876 wrote to memory of 4220 1876 Dmpfbk32.exe 87 PID 4220 wrote to memory of 4656 4220 Djfcaohp.exe 89 PID 4220 wrote to memory of 4656 4220 Djfcaohp.exe 89 PID 4220 wrote to memory of 4656 4220 Djfcaohp.exe 89 PID 4656 wrote to memory of 1528 4656 Djhpgofm.exe 91 PID 4656 wrote to memory of 1528 4656 Djhpgofm.exe 91 PID 4656 wrote to memory of 1528 4656 Djhpgofm.exe 91 PID 1528 wrote to memory of 4344 1528 Edemkd32.exe 92 PID 1528 wrote to memory of 4344 1528 Edemkd32.exe 92 PID 1528 wrote to memory of 4344 1528 Edemkd32.exe 92 PID 4344 wrote to memory of 2592 4344 Gkiaej32.exe 93 PID 4344 wrote to memory of 2592 4344 Gkiaej32.exe 93 PID 4344 wrote to memory of 2592 4344 Gkiaej32.exe 93 PID 2592 wrote to memory of 1568 2592 Nlphbnoe.exe 94 PID 2592 wrote to memory of 1568 2592 Nlphbnoe.exe 94 PID 2592 wrote to memory of 1568 2592 Nlphbnoe.exe 94 PID 1568 wrote to memory of 4556 1568 Hmbfbn32.exe 96 PID 1568 wrote to memory of 4556 1568 Hmbfbn32.exe 96 PID 1568 wrote to memory of 4556 1568 Hmbfbn32.exe 96 PID 4556 wrote to memory of 3788 4556 Kmaopfjm.exe 97 PID 4556 wrote to memory of 3788 4556 Kmaopfjm.exe 97 PID 4556 wrote to memory of 3788 4556 Kmaopfjm.exe 97 PID 3788 wrote to memory of 2092 3788 Nmigoagp.exe 98 PID 3788 wrote to memory of 2092 3788 Nmigoagp.exe 98 PID 3788 wrote to memory of 2092 3788 Nmigoagp.exe 98 PID 2092 wrote to memory of 408 2092 Nhokljge.exe 99 PID 2092 wrote to memory of 408 2092 Nhokljge.exe 99 PID 2092 wrote to memory of 408 2092 Nhokljge.exe 99 PID 408 wrote to memory of 2944 408 Neclenfo.exe 100 PID 408 wrote to memory of 2944 408 Neclenfo.exe 100 PID 408 wrote to memory of 2944 408 Neclenfo.exe 100 PID 2944 wrote to memory of 3532 2944 Omqmop32.exe 102 PID 2944 wrote to memory of 3532 2944 Omqmop32.exe 102 PID 2944 wrote to memory of 3532 2944 Omqmop32.exe 102 PID 3532 wrote to memory of 4496 3532 Bkaobnio.exe 103 PID 3532 wrote to memory of 4496 3532 Bkaobnio.exe 103 PID 3532 wrote to memory of 4496 3532 Bkaobnio.exe 103 PID 4496 wrote to memory of 436 4496 Dheibpje.exe 104 PID 4496 wrote to memory of 436 4496 Dheibpje.exe 104 PID 4496 wrote to memory of 436 4496 Dheibpje.exe 104 PID 436 wrote to memory of 3636 436 Dmcain32.exe 105 PID 436 wrote to memory of 3636 436 Dmcain32.exe 105 PID 436 wrote to memory of 3636 436 Dmcain32.exe 105 PID 3636 wrote to memory of 2368 3636 Dndnpf32.exe 106 PID 3636 wrote to memory of 2368 3636 Dndnpf32.exe 106 PID 3636 wrote to memory of 2368 3636 Dndnpf32.exe 106 PID 2368 wrote to memory of 5044 2368 Eofgpikj.exe 107 PID 2368 wrote to memory of 5044 2368 Eofgpikj.exe 107 PID 2368 wrote to memory of 5044 2368 Eofgpikj.exe 107 PID 5044 wrote to memory of 396 5044 Eecphp32.exe 108 PID 5044 wrote to memory of 396 5044 Eecphp32.exe 108 PID 5044 wrote to memory of 396 5044 Eecphp32.exe 108 PID 396 wrote to memory of 3016 396 Eokqkh32.exe 110 PID 396 wrote to memory of 3016 396 Eokqkh32.exe 110 PID 396 wrote to memory of 3016 396 Eokqkh32.exe 110 PID 3016 wrote to memory of 1632 3016 Njmqnobn.exe 112 PID 3016 wrote to memory of 1632 3016 Njmqnobn.exe 112 PID 3016 wrote to memory of 1632 3016 Njmqnobn.exe 112 PID 4580 wrote to memory of 3556 4580 Bpfkpp32.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.c44bac043d2eb7ab891f5e2a1a39c110.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.c44bac043d2eb7ab891f5e2a1a39c110.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\Dmpfbk32.exeC:\Windows\system32\Dmpfbk32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\Djfcaohp.exeC:\Windows\system32\Djfcaohp.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\Djhpgofm.exeC:\Windows\system32\Djhpgofm.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\Edemkd32.exeC:\Windows\system32\Edemkd32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\Gkiaej32.exeC:\Windows\system32\Gkiaej32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\Nlphbnoe.exeC:\Windows\system32\Nlphbnoe.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\Hmbfbn32.exeC:\Windows\system32\Hmbfbn32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\Kmaopfjm.exeC:\Windows\system32\Kmaopfjm.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\Nmigoagp.exeC:\Windows\system32\Nmigoagp.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\Nhokljge.exeC:\Windows\system32\Nhokljge.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\Neclenfo.exeC:\Windows\system32\Neclenfo.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\SysWOW64\Omqmop32.exeC:\Windows\system32\Omqmop32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\Bkaobnio.exeC:\Windows\system32\Bkaobnio.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\Dheibpje.exeC:\Windows\system32\Dheibpje.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\Dmcain32.exeC:\Windows\system32\Dmcain32.exe16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\Dndnpf32.exeC:\Windows\system32\Dndnpf32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\Eofgpikj.exeC:\Windows\system32\Eofgpikj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\Eecphp32.exeC:\Windows\system32\Eecphp32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\Eokqkh32.exeC:\Windows\system32\Eokqkh32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\Njmqnobn.exeC:\Windows\system32\Njmqnobn.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\Bpdnjple.exeC:\Windows\system32\Bpdnjple.exe22⤵
- Executes dropped EXE
PID:1632 -
C:\Windows\SysWOW64\Bpfkpp32.exeC:\Windows\system32\Bpfkpp32.exe23⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\Bmjkic32.exeC:\Windows\system32\Bmjkic32.exe24⤵
- Executes dropped EXE
PID:3556 -
C:\Windows\SysWOW64\Bnlhncgi.exeC:\Windows\system32\Bnlhncgi.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3192 -
C:\Windows\SysWOW64\Boldhf32.exeC:\Windows\system32\Boldhf32.exe26⤵
- Executes dropped EXE
PID:3684 -
C:\Windows\SysWOW64\Cpmapodj.exeC:\Windows\system32\Cpmapodj.exe27⤵
- Executes dropped EXE
PID:2024 -
C:\Windows\SysWOW64\Ckbemgcp.exeC:\Windows\system32\Ckbemgcp.exe28⤵
- Executes dropped EXE
PID:632 -
C:\Windows\SysWOW64\Cammjakm.exeC:\Windows\system32\Cammjakm.exe29⤵
- Executes dropped EXE
PID:4172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Cgifbhid.exeC:\Windows\system32\Cgifbhid.exe1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4832 -
C:\Windows\SysWOW64\Cncnob32.exeC:\Windows\system32\Cncnob32.exe2⤵
- Executes dropped EXE
PID:1320 -
C:\Windows\SysWOW64\Cpbjkn32.exeC:\Windows\system32\Cpbjkn32.exe3⤵
- Executes dropped EXE
PID:1808 -
C:\Windows\SysWOW64\Mjidgkog.exeC:\Windows\system32\Mjidgkog.exe4⤵
- Executes dropped EXE
- Modifies registry class
PID:4060 -
C:\Windows\SysWOW64\Mljmhflh.exeC:\Windows\system32\Mljmhflh.exe5⤵
- Executes dropped EXE
PID:3764 -
C:\Windows\SysWOW64\Mjpjgj32.exeC:\Windows\system32\Mjpjgj32.exe6⤵
- Executes dropped EXE
PID:4212 -
C:\Windows\SysWOW64\Nhegig32.exeC:\Windows\system32\Nhegig32.exe7⤵
- Executes dropped EXE
PID:4524 -
C:\Windows\SysWOW64\Nbnlaldg.exeC:\Windows\system32\Nbnlaldg.exe8⤵
- Executes dropped EXE
PID:1848 -
C:\Windows\SysWOW64\Pbcncibp.exeC:\Windows\system32\Pbcncibp.exe9⤵
- Executes dropped EXE
PID:4932 -
C:\Windows\SysWOW64\Padnaq32.exeC:\Windows\system32\Padnaq32.exe10⤵
- Executes dropped EXE
PID:4328 -
C:\Windows\SysWOW64\Pfagighf.exeC:\Windows\system32\Pfagighf.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4628 -
C:\Windows\SysWOW64\Ppikbm32.exeC:\Windows\system32\Ppikbm32.exe12⤵
- Executes dropped EXE
PID:3244 -
C:\Windows\SysWOW64\Pcgdhkem.exeC:\Windows\system32\Pcgdhkem.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3632 -
C:\Windows\SysWOW64\Pmphaaln.exeC:\Windows\system32\Pmphaaln.exe14⤵
- Executes dropped EXE
PID:4992 -
C:\Windows\SysWOW64\Pblajhje.exeC:\Windows\system32\Pblajhje.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4952 -
C:\Windows\SysWOW64\Qpbnhl32.exeC:\Windows\system32\Qpbnhl32.exe16⤵
- Executes dropped EXE
PID:1132 -
C:\Windows\SysWOW64\Amfobp32.exeC:\Windows\system32\Amfobp32.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3236 -
C:\Windows\SysWOW64\Abcgjg32.exeC:\Windows\system32\Abcgjg32.exe18⤵
- Executes dropped EXE
PID:4684 -
C:\Windows\SysWOW64\Amikgpcc.exeC:\Windows\system32\Amikgpcc.exe19⤵
- Executes dropped EXE
PID:1700 -
C:\Windows\SysWOW64\Abfdpfaj.exeC:\Windows\system32\Abfdpfaj.exe20⤵
- Executes dropped EXE
PID:3060 -
C:\Windows\SysWOW64\Afcmfe32.exeC:\Windows\system32\Afcmfe32.exe21⤵
- Executes dropped EXE
PID:4808 -
C:\Windows\SysWOW64\Amnebo32.exeC:\Windows\system32\Amnebo32.exe22⤵
- Executes dropped EXE
PID:4392 -
C:\Windows\SysWOW64\Ajaelc32.exeC:\Windows\system32\Ajaelc32.exe23⤵
- Executes dropped EXE
PID:404 -
C:\Windows\SysWOW64\Adjjeieh.exeC:\Windows\system32\Adjjeieh.exe24⤵
- Executes dropped EXE
PID:5092 -
C:\Windows\SysWOW64\Bmbnnn32.exeC:\Windows\system32\Bmbnnn32.exe25⤵
- Executes dropped EXE
- Modifies registry class
PID:3860 -
C:\Windows\SysWOW64\Bdlfjh32.exeC:\Windows\system32\Bdlfjh32.exe26⤵
- Executes dropped EXE
PID:2420 -
C:\Windows\SysWOW64\Biiobo32.exeC:\Windows\system32\Biiobo32.exe27⤵
- Executes dropped EXE
PID:3348 -
C:\Windows\SysWOW64\Bbaclegm.exeC:\Windows\system32\Bbaclegm.exe28⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3152 -
C:\Windows\SysWOW64\Bpedeiff.exeC:\Windows\system32\Bpedeiff.exe29⤵
- Executes dropped EXE
- Modifies registry class
PID:3008 -
C:\Windows\SysWOW64\Bfolacnc.exeC:\Windows\system32\Bfolacnc.exe30⤵
- Executes dropped EXE
PID:4388 -
C:\Windows\SysWOW64\Bdeiqgkj.exeC:\Windows\system32\Bdeiqgkj.exe31⤵
- Executes dropped EXE
PID:4872 -
C:\Windows\SysWOW64\Cpljehpo.exeC:\Windows\system32\Cpljehpo.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3000 -
C:\Windows\SysWOW64\Ckbncapd.exeC:\Windows\system32\Ckbncapd.exe33⤵
- Executes dropped EXE
PID:4868 -
C:\Windows\SysWOW64\Cpogkhnl.exeC:\Windows\system32\Cpogkhnl.exe34⤵
- Executes dropped EXE
PID:3096 -
C:\Windows\SysWOW64\Cpacqg32.exeC:\Windows\system32\Cpacqg32.exe35⤵
- Executes dropped EXE
PID:4484 -
C:\Windows\SysWOW64\Cmedjl32.exeC:\Windows\system32\Cmedjl32.exe36⤵
- Executes dropped EXE
PID:4656 -
C:\Windows\SysWOW64\Cdolgfbp.exeC:\Windows\system32\Cdolgfbp.exe37⤵
- Executes dropped EXE
PID:4472 -
C:\Windows\SysWOW64\Cmgqpkip.exeC:\Windows\system32\Cmgqpkip.exe38⤵PID:4340
-
C:\Windows\SysWOW64\Ccdihbgg.exeC:\Windows\system32\Ccdihbgg.exe39⤵PID:1644
-
C:\Windows\SysWOW64\Dmjmekgn.exeC:\Windows\system32\Dmjmekgn.exe40⤵PID:5064
-
C:\Windows\SysWOW64\Dknnoofg.exeC:\Windows\system32\Dknnoofg.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:556 -
C:\Windows\SysWOW64\Dgdncplk.exeC:\Windows\system32\Dgdncplk.exe42⤵PID:2880
-
C:\Windows\SysWOW64\Dajbaika.exeC:\Windows\system32\Dajbaika.exe43⤵
- Modifies registry class
PID:3412 -
C:\Windows\SysWOW64\Dnqcfjae.exeC:\Windows\system32\Dnqcfjae.exe44⤵PID:2128
-
C:\Windows\SysWOW64\Dgihop32.exeC:\Windows\system32\Dgihop32.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3540 -
C:\Windows\SysWOW64\Dpalgenf.exeC:\Windows\system32\Dpalgenf.exe46⤵PID:5148
-
C:\Windows\SysWOW64\Egkddo32.exeC:\Windows\system32\Egkddo32.exe47⤵PID:5192
-
C:\Windows\SysWOW64\Enemaimp.exeC:\Windows\system32\Enemaimp.exe48⤵PID:5244
-
C:\Windows\SysWOW64\Egnajocq.exeC:\Windows\system32\Egnajocq.exe49⤵PID:5292
-
C:\Windows\SysWOW64\Epffbd32.exeC:\Windows\system32\Epffbd32.exe50⤵PID:5332
-
C:\Windows\SysWOW64\Ejojljqa.exeC:\Windows\system32\Ejojljqa.exe51⤵PID:5372
-
C:\Windows\SysWOW64\Ecgodpgb.exeC:\Windows\system32\Ecgodpgb.exe52⤵
- Modifies registry class
PID:5420 -
C:\Windows\SysWOW64\Eqkondfl.exeC:\Windows\system32\Eqkondfl.exe53⤵PID:5464
-
C:\Windows\SysWOW64\Ejccgi32.exeC:\Windows\system32\Ejccgi32.exe54⤵PID:5504
-
C:\Windows\SysWOW64\Fclhpo32.exeC:\Windows\system32\Fclhpo32.exe55⤵PID:5548
-
C:\Windows\SysWOW64\Famhmfkl.exeC:\Windows\system32\Famhmfkl.exe56⤵
- Drops file in System32 directory
PID:5588 -
C:\Windows\SysWOW64\Fdmaoahm.exeC:\Windows\system32\Fdmaoahm.exe57⤵PID:5628
-
C:\Windows\SysWOW64\Fjjjgh32.exeC:\Windows\system32\Fjjjgh32.exe58⤵PID:5672
-
C:\Windows\SysWOW64\Fdpnda32.exeC:\Windows\system32\Fdpnda32.exe59⤵PID:5712
-
C:\Windows\SysWOW64\Fnhbmgmk.exeC:\Windows\system32\Fnhbmgmk.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5772 -
C:\Windows\SysWOW64\Fjocbhbo.exeC:\Windows\system32\Fjocbhbo.exe61⤵PID:5844
-
C:\Windows\SysWOW64\Gjficg32.exeC:\Windows\system32\Gjficg32.exe62⤵PID:5884
-
C:\Windows\SysWOW64\Ggjjlk32.exeC:\Windows\system32\Ggjjlk32.exe63⤵PID:5928
-
C:\Windows\SysWOW64\Gqbneq32.exeC:\Windows\system32\Gqbneq32.exe64⤵PID:5968
-
C:\Windows\SysWOW64\Hqdkkp32.exeC:\Windows\system32\Hqdkkp32.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6008 -
C:\Windows\SysWOW64\Hcedmkmp.exeC:\Windows\system32\Hcedmkmp.exe66⤵PID:6048
-
C:\Windows\SysWOW64\Haidfpki.exeC:\Windows\system32\Haidfpki.exe67⤵PID:6088
-
C:\Windows\SysWOW64\Hbiapb32.exeC:\Windows\system32\Hbiapb32.exe68⤵PID:6128
-
C:\Windows\SysWOW64\Hejjanpm.exeC:\Windows\system32\Hejjanpm.exe69⤵PID:5164
-
C:\Windows\SysWOW64\Hjfbjdnd.exeC:\Windows\system32\Hjfbjdnd.exe70⤵PID:5240
-
C:\Windows\SysWOW64\Icogcjde.exeC:\Windows\system32\Icogcjde.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5320 -
C:\Windows\SysWOW64\Jaljbmkd.exeC:\Windows\system32\Jaljbmkd.exe72⤵PID:5384
-
C:\Windows\SysWOW64\Jnpjlajn.exeC:\Windows\system32\Jnpjlajn.exe73⤵PID:5456
-
C:\Windows\SysWOW64\Jhhodg32.exeC:\Windows\system32\Jhhodg32.exe74⤵
- Drops file in System32 directory
PID:5512 -
C:\Windows\SysWOW64\Jelonkph.exeC:\Windows\system32\Jelonkph.exe75⤵PID:5576
-
C:\Windows\SysWOW64\Jjihfbno.exeC:\Windows\system32\Jjihfbno.exe76⤵
- Modifies registry class
PID:5652 -
C:\Windows\SysWOW64\Jdalog32.exeC:\Windows\system32\Jdalog32.exe77⤵PID:5732
-
C:\Windows\SysWOW64\Jogqlpde.exeC:\Windows\system32\Jogqlpde.exe78⤵PID:5820
-
C:\Windows\SysWOW64\Jddiegbm.exeC:\Windows\system32\Jddiegbm.exe79⤵PID:5836
-
C:\Windows\SysWOW64\Koimbpbc.exeC:\Windows\system32\Koimbpbc.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5924 -
C:\Windows\SysWOW64\Klmnkdal.exeC:\Windows\system32\Klmnkdal.exe81⤵PID:5976
-
C:\Windows\SysWOW64\Kajfdk32.exeC:\Windows\system32\Kajfdk32.exe82⤵PID:6036
-
C:\Windows\SysWOW64\Khdoqefq.exeC:\Windows\system32\Khdoqefq.exe83⤵PID:6100
-
C:\Windows\SysWOW64\Kbjbnnfg.exeC:\Windows\system32\Kbjbnnfg.exe84⤵
- Drops file in System32 directory
PID:5180 -
C:\Windows\SysWOW64\Khfkfedn.exeC:\Windows\system32\Khfkfedn.exe85⤵
- Modifies registry class
PID:4500 -
C:\Windows\SysWOW64\Kblpcndd.exeC:\Windows\system32\Kblpcndd.exe86⤵
- Modifies registry class
PID:5392 -
C:\Windows\SysWOW64\Khihld32.exeC:\Windows\system32\Khihld32.exe87⤵
- Modifies registry class
PID:5448 -
C:\Windows\SysWOW64\Kaaldjil.exeC:\Windows\system32\Kaaldjil.exe88⤵PID:5636
-
C:\Windows\SysWOW64\Leoejh32.exeC:\Windows\system32\Leoejh32.exe89⤵PID:5792
-
C:\Windows\SysWOW64\Llimgb32.exeC:\Windows\system32\Llimgb32.exe90⤵PID:5876
-
C:\Windows\SysWOW64\Lbcedmnl.exeC:\Windows\system32\Lbcedmnl.exe91⤵PID:6000
-
C:\Windows\SysWOW64\Lddble32.exeC:\Windows\system32\Lddble32.exe92⤵PID:6076
-
C:\Windows\SysWOW64\Lojfin32.exeC:\Windows\system32\Lojfin32.exe93⤵PID:4080
-
C:\Windows\SysWOW64\Ldfoad32.exeC:\Windows\system32\Ldfoad32.exe94⤵PID:5316
-
C:\Windows\SysWOW64\Loopdmpk.exeC:\Windows\system32\Loopdmpk.exe95⤵PID:5572
-
C:\Windows\SysWOW64\Mlbpma32.exeC:\Windows\system32\Mlbpma32.exe96⤵
- Drops file in System32 directory
PID:5736 -
C:\Windows\SysWOW64\Mlemcq32.exeC:\Windows\system32\Mlemcq32.exe97⤵PID:5896
-
C:\Windows\SysWOW64\Mdpagc32.exeC:\Windows\system32\Mdpagc32.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6116 -
C:\Windows\SysWOW64\Nlnpio32.exeC:\Windows\system32\Nlnpio32.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5272 -
C:\Windows\SysWOW64\Nhgmcp32.exeC:\Windows\system32\Nhgmcp32.exe100⤵PID:5484
-
C:\Windows\SysWOW64\Napameoi.exeC:\Windows\system32\Napameoi.exe101⤵PID:4732
-
C:\Windows\SysWOW64\Nlefjnno.exeC:\Windows\system32\Nlefjnno.exe102⤵PID:800
-
C:\Windows\SysWOW64\Nfnjbdep.exeC:\Windows\system32\Nfnjbdep.exe103⤵PID:872
-
C:\Windows\SysWOW64\Nkjckkcg.exeC:\Windows\system32\Nkjckkcg.exe104⤵PID:5860
-
C:\Windows\SysWOW64\Nbdkhe32.exeC:\Windows\system32\Nbdkhe32.exe105⤵PID:5136
-
C:\Windows\SysWOW64\Okmpqjad.exeC:\Windows\system32\Okmpqjad.exe106⤵PID:5356
-
C:\Windows\SysWOW64\Ofbdncaj.exeC:\Windows\system32\Ofbdncaj.exe107⤵PID:4084
-
C:\Windows\SysWOW64\Ookhfigk.exeC:\Windows\system32\Ookhfigk.exe108⤵PID:2964
-
C:\Windows\SysWOW64\Oloipmfd.exeC:\Windows\system32\Oloipmfd.exe109⤵PID:6120
-
C:\Windows\SysWOW64\Obkahddl.exeC:\Windows\system32\Obkahddl.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5300 -
C:\Windows\SysWOW64\Omaeem32.exeC:\Windows\system32\Omaeem32.exe111⤵PID:3344
-
C:\Windows\SysWOW64\Ocknbglo.exeC:\Windows\system32\Ocknbglo.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3652 -
C:\Windows\SysWOW64\Omcbkl32.exeC:\Windows\system32\Omcbkl32.exe113⤵PID:4416
-
C:\Windows\SysWOW64\Oflfdbip.exeC:\Windows\system32\Oflfdbip.exe114⤵PID:3920
-
C:\Windows\SysWOW64\Pkholi32.exeC:\Windows\system32\Pkholi32.exe115⤵PID:3080
-
C:\Windows\SysWOW64\Pdqcenmg.exeC:\Windows\system32\Pdqcenmg.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1640 -
C:\Windows\SysWOW64\Pkklbh32.exeC:\Windows\system32\Pkklbh32.exe117⤵
- Drops file in System32 directory
PID:5852 -
C:\Windows\SysWOW64\Pbddobla.exeC:\Windows\system32\Pbddobla.exe118⤵PID:2092
-
C:\Windows\SysWOW64\Pmjhlklg.exeC:\Windows\system32\Pmjhlklg.exe119⤵PID:5476
-
C:\Windows\SysWOW64\Pkoemhao.exeC:\Windows\system32\Pkoemhao.exe120⤵PID:6164
-
C:\Windows\SysWOW64\Pbimjb32.exeC:\Windows\system32\Pbimjb32.exe121⤵
- Drops file in System32 directory
PID:6208 -
C:\Windows\SysWOW64\Piceflpi.exeC:\Windows\system32\Piceflpi.exe122⤵PID:6252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-