Analysis
-
max time kernel
212s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
02/11/2023, 16:49
Behavioral task
behavioral1
Sample
NEAS.c58c6b433692a6ce0ffe2dc2a2961610.exe
Resource
win7-20231023-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.c58c6b433692a6ce0ffe2dc2a2961610.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
NEAS.c58c6b433692a6ce0ffe2dc2a2961610.exe
-
Size
269KB
-
MD5
c58c6b433692a6ce0ffe2dc2a2961610
-
SHA1
6a28d255cc647039a409c9b78ede46da8e1fbcda
-
SHA256
7c70ab6bf0015e221166e74ded4a8135ce839d2a309d7c3e30de7bbc758d75c1
-
SHA512
b7794098dad22af35b98c1380cc146a72a8c14e42d83fa8ee55df7b97ceb90deef85c04d178ba6ae30fbf1664d04e1cee367be63ba77d1cada32220bdc0eac9d
-
SSDEEP
6144:uj7C7HCiooDX4EYtCwGtMtkiXOoloMr1JeSldqP7+x55Kmj50GXoCcmASBTw2AX4:uj7+QChtMtkM71r1MSXqPix55KI5fX/Z
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmmihk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hkoikcaq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkfkjemd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pijhompm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efkfbp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Iplnpq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhifmcfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Enomam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fpjmkhbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fchigcab.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Colhlcig.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebaggaeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fgcdlj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjgqcj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dhnoocab.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igomfb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmbgnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gcfiqgfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ieohfemq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eogckqkk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hkoikcaq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jlcpqj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gadkmj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkcoee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hmcgdlhl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpanffhn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Imgmonga.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gegaeabe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Milaecdp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Manljd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jicgoohq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gllpflng.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gabpco32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jlmipk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idqpjg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jnfdlpje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kgcbpemp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fanjil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gdnkkmej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jjgonf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pijhompm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mjgqcj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aocgll32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpjoel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gniqhpgi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gkmabdfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Heqhon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Khjkiikl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pfkkhmjn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dldndf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fimgmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hfmcapna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hhnpih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Idqpjg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iniebmfg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lfdbcing.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcofqphi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efoobkej.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jlmipk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jbinbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jbkkgd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbhhbojn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glanpi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gcfiqgfp.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x0003000000004ed7-5.dat family_berbew behavioral1/files/0x0003000000004ed7-9.dat family_berbew behavioral1/files/0x0003000000004ed7-14.dat family_berbew behavioral1/files/0x0003000000004ed7-13.dat family_berbew behavioral1/files/0x0003000000004ed7-8.dat family_berbew behavioral1/files/0x000d000000012274-20.dat family_berbew behavioral1/files/0x000d000000012274-30.dat family_berbew behavioral1/files/0x000d000000012274-24.dat family_berbew behavioral1/files/0x000d000000012274-23.dat family_berbew behavioral1/files/0x000d000000012274-28.dat family_berbew behavioral1/files/0x0035000000015c79-41.dat family_berbew behavioral1/files/0x0035000000015c79-38.dat family_berbew behavioral1/files/0x0035000000015c79-37.dat family_berbew behavioral1/files/0x0035000000015c79-43.dat family_berbew behavioral1/files/0x0035000000015c79-35.dat family_berbew behavioral1/files/0x0007000000015cc6-50.dat family_berbew behavioral1/files/0x0007000000015cc6-53.dat family_berbew behavioral1/files/0x0007000000015cc6-52.dat family_berbew behavioral1/files/0x0007000000015cc6-57.dat family_berbew behavioral1/files/0x0007000000015cc6-59.dat family_berbew behavioral1/memory/2544-56-0x0000000000310000-0x0000000000346000-memory.dmp family_berbew behavioral1/files/0x0007000000015cf1-64.dat family_berbew behavioral1/files/0x0007000000015cf1-66.dat family_berbew behavioral1/files/0x0007000000015cf1-67.dat family_berbew behavioral1/files/0x000600000001608c-73.dat family_berbew behavioral1/files/0x0007000000015cf1-72.dat family_berbew behavioral1/files/0x000600000001608c-84.dat family_berbew behavioral1/files/0x000600000001608c-83.dat family_berbew behavioral1/files/0x00060000000162f2-98.dat family_berbew behavioral1/files/0x00060000000162f2-90.dat family_berbew behavioral1/files/0x00060000000162f2-96.dat family_berbew behavioral1/files/0x00060000000162f2-93.dat family_berbew behavioral1/files/0x00060000000162f2-92.dat family_berbew behavioral1/files/0x000600000001608c-79.dat family_berbew behavioral1/files/0x000600000001608c-77.dat family_berbew behavioral1/files/0x0007000000015cf1-70.dat family_berbew behavioral1/memory/2804-103-0x0000000000220000-0x0000000000256000-memory.dmp family_berbew behavioral1/files/0x000600000001656d-105.dat family_berbew behavioral1/files/0x000600000001656d-112.dat family_berbew behavioral1/files/0x000600000001656d-111.dat family_berbew behavioral1/files/0x0006000000016803-118.dat family_berbew behavioral1/files/0x0006000000016803-125.dat family_berbew behavioral1/files/0x0006000000016803-124.dat family_berbew behavioral1/files/0x0006000000016803-121.dat family_berbew behavioral1/files/0x0006000000016803-120.dat family_berbew behavioral1/files/0x000600000001656d-108.dat family_berbew behavioral1/files/0x000600000001656d-107.dat family_berbew behavioral1/files/0x0006000000016bf8-131.dat family_berbew behavioral1/files/0x0006000000016bf8-139.dat family_berbew behavioral1/files/0x0006000000016bf8-135.dat family_berbew behavioral1/files/0x0006000000016bf8-134.dat family_berbew behavioral1/files/0x0006000000016bf8-138.dat family_berbew behavioral1/files/0x0006000000016c1b-144.dat family_berbew behavioral1/files/0x0006000000016c1b-150.dat family_berbew behavioral1/files/0x0006000000016c1b-152.dat family_berbew behavioral1/files/0x0006000000016c1b-147.dat family_berbew behavioral1/files/0x0006000000016c1b-146.dat family_berbew behavioral1/files/0x0006000000016c8e-157.dat family_berbew behavioral1/files/0x0006000000016c8e-165.dat family_berbew behavioral1/files/0x0006000000016c8e-164.dat family_berbew behavioral1/memory/2120-163-0x0000000000260000-0x0000000000296000-memory.dmp family_berbew behavioral1/files/0x0006000000016c8e-160.dat family_berbew behavioral1/files/0x0006000000016c8e-159.dat family_berbew behavioral1/files/0x0006000000016ccd-171.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2744 Ajdcofop.exe 2856 Fgcdlj32.exe 2544 Fqnfkoen.exe 2404 Fmdfppkb.exe 800 Gllpflng.exe 2804 Gegaeabe.exe 2452 Gnofng32.exe 1704 Gdnkkmej.exe 1008 Hdcdfmqe.exe 1692 Hipmoc32.exe 2120 Ikjlmjmp.exe 2208 Ikmibjkm.exe 3052 Iplnpq32.exe 1504 Jjgonf32.exe 2012 Jlghpa32.exe 1768 Jjkiie32.exe 1260 Jbijcgbc.exe 1308 Kbkgig32.exe 1856 Kbncof32.exe 1512 Kjihci32.exe 1300 Lfdbcing.exe 3004 Lomglo32.exe 1772 Lfilnh32.exe 2476 Lpcmlnnp.exe 2296 Milaecdp.exe 1656 Magfjebk.exe 2352 Mjpkbk32.exe 2756 Mnncii32.exe 2556 Manljd32.exe 2648 Mjgqcj32.exe 2584 Npcika32.exe 808 Nmgjee32.exe 2752 Aocgll32.exe 1012 Khjkiikl.exe 1036 Fhifmcfa.exe 2992 Imccab32.exe 924 Ieohfemq.exe 2624 Pfkkhmjn.exe 576 Fnnpma32.exe 1864 Pcdnpp32.exe 1488 Dhnoocab.exe 2852 Djokgk32.exe 1372 Dpicceon.exe 1368 Ddgljced.exe 2376 Djddbkck.exe 320 Dldndf32.exe 2256 Dcofqphi.exe 1284 Dhknigfq.exe 1676 Efoobkej.exe 2144 Eogckqkk.exe 3040 Enomam32.exe 2760 Eclejclg.exe 1280 Emdjbi32.exe 2688 Fgjnpb32.exe 2604 Fpecddpi.exe 2696 Fimgmj32.exe 2292 Fbflfomj.exe 920 Fmkpchmp.exe 2824 Gigjch32.exe 1980 Genkhidc.exe 2404 Gadkmj32.exe 2000 Ghndjd32.exe 2400 Gnhlgoia.exe 1308 Ghqqpd32.exe -
Loads dropped DLL 64 IoCs
pid Process 2892 NEAS.c58c6b433692a6ce0ffe2dc2a2961610.exe 2892 NEAS.c58c6b433692a6ce0ffe2dc2a2961610.exe 2744 Ajdcofop.exe 2744 Ajdcofop.exe 2856 Fgcdlj32.exe 2856 Fgcdlj32.exe 2544 Fqnfkoen.exe 2544 Fqnfkoen.exe 2404 Fmdfppkb.exe 2404 Fmdfppkb.exe 800 Gllpflng.exe 800 Gllpflng.exe 2804 Gegaeabe.exe 2804 Gegaeabe.exe 2452 Gnofng32.exe 2452 Gnofng32.exe 1704 Gdnkkmej.exe 1704 Gdnkkmej.exe 1008 Hdcdfmqe.exe 1008 Hdcdfmqe.exe 1692 Hipmoc32.exe 1692 Hipmoc32.exe 2120 Ikjlmjmp.exe 2120 Ikjlmjmp.exe 2208 Ikmibjkm.exe 2208 Ikmibjkm.exe 3052 Iplnpq32.exe 3052 Iplnpq32.exe 1504 Jjgonf32.exe 1504 Jjgonf32.exe 2012 Jlghpa32.exe 2012 Jlghpa32.exe 1768 Jjkiie32.exe 1768 Jjkiie32.exe 1260 Jbijcgbc.exe 1260 Jbijcgbc.exe 1308 Kbkgig32.exe 1308 Kbkgig32.exe 1856 Kbncof32.exe 1856 Kbncof32.exe 1512 Kjihci32.exe 1512 Kjihci32.exe 1300 Lfdbcing.exe 1300 Lfdbcing.exe 3004 Lomglo32.exe 3004 Lomglo32.exe 1772 Lfilnh32.exe 1772 Lfilnh32.exe 2476 Lpcmlnnp.exe 2476 Lpcmlnnp.exe 2296 Milaecdp.exe 2296 Milaecdp.exe 1656 Magfjebk.exe 1656 Magfjebk.exe 2352 Mjpkbk32.exe 2352 Mjpkbk32.exe 2756 Mnncii32.exe 2756 Mnncii32.exe 2556 Manljd32.exe 2556 Manljd32.exe 2648 Mjgqcj32.exe 2648 Mjgqcj32.exe 2584 Npcika32.exe 2584 Npcika32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Ejbmpe32.dll Ipedihgm.exe File opened for modification C:\Windows\SysWOW64\Ialbon32.exe Innfbb32.exe File opened for modification C:\Windows\SysWOW64\Fgcdlj32.exe Ajdcofop.exe File opened for modification C:\Windows\SysWOW64\Hdcdfmqe.exe Gdnkkmej.exe File created C:\Windows\SysWOW64\Lfilnh32.exe Lomglo32.exe File created C:\Windows\SysWOW64\Nfgbjc32.dll Djddbkck.exe File created C:\Windows\SysWOW64\Jjbbmmih.exe Jchjqc32.exe File opened for modification C:\Windows\SysWOW64\Dpanffhn.exe Digfil32.exe File created C:\Windows\SysWOW64\Igomfb32.exe Idqpjg32.exe File created C:\Windows\SysWOW64\Genpkk32.dll Cpeanp32.exe File created C:\Windows\SysWOW64\Cfbifgln.exe Cccmjkmj.exe File opened for modification C:\Windows\SysWOW64\Jcaekh32.exe Imgmonga.exe File created C:\Windows\SysWOW64\Jbkkgd32.exe Jlackjgd.exe File created C:\Windows\SysWOW64\Maedlmdn.dll Hmpemkkf.exe File created C:\Windows\SysWOW64\Elnonbec.dll Fnjkdcii.exe File created C:\Windows\SysWOW64\Ggohlf32.exe Gabpco32.exe File opened for modification C:\Windows\SysWOW64\Hkjqkhkq.exe Heqhon32.exe File opened for modification C:\Windows\SysWOW64\Mnncii32.exe Mjpkbk32.exe File created C:\Windows\SysWOW64\Maaiimhq.dll Jkfkjemd.exe File opened for modification C:\Windows\SysWOW64\Fgojdj32.exe Lmgaikep.exe File created C:\Windows\SysWOW64\Efkfbp32.exe Ebojbaga.exe File opened for modification C:\Windows\SysWOW64\Fhhbffkk.exe Fanjil32.exe File created C:\Windows\SysWOW64\Ggmlffbo.exe Goojldgf.exe File created C:\Windows\SysWOW64\Enecegpg.dll Dhnoocab.exe File opened for modification C:\Windows\SysWOW64\Genkhidc.exe Gigjch32.exe File opened for modification C:\Windows\SysWOW64\Fqnfkoen.exe Fgcdlj32.exe File created C:\Windows\SysWOW64\Gllpflng.exe Fmdfppkb.exe File created C:\Windows\SysWOW64\Bhpjqhld.dll Gnofng32.exe File created C:\Windows\SysWOW64\Ihhpdnkl.dll Ikjlmjmp.exe File created C:\Windows\SysWOW64\Inkimc32.exe Ikmmqg32.exe File created C:\Windows\SysWOW64\Ecpmgk32.dll Inkimc32.exe File created C:\Windows\SysWOW64\Hhnpih32.exe Hfmcapna.exe File created C:\Windows\SysWOW64\Jehmda32.dll Igomfb32.exe File created C:\Windows\SysWOW64\Hecedmaa.exe Hkjqkhkq.exe File created C:\Windows\SysWOW64\Joajea32.dll Jcaekh32.exe File created C:\Windows\SysWOW64\Imccab32.exe Fhifmcfa.exe File created C:\Windows\SysWOW64\Qjnaimap.dll Pfkkhmjn.exe File created C:\Windows\SysWOW64\Efoobkej.exe Dhknigfq.exe File opened for modification C:\Windows\SysWOW64\Hiichkog.exe Hiffbl32.exe File created C:\Windows\SysWOW64\Aiacqhfi.dll Jocdqc32.exe File created C:\Windows\SysWOW64\Fpmond32.dll Cmnlphjd.exe File created C:\Windows\SysWOW64\Hfgbbb32.exe Hqjijk32.exe File created C:\Windows\SysWOW64\Hbmnfajm.exe Hmpemkkf.exe File created C:\Windows\SysWOW64\Jbmgapgc.exe Jkcoee32.exe File created C:\Windows\SysWOW64\Jbinbd32.exe Jfbnmckp.exe File created C:\Windows\SysWOW64\Gnofng32.exe Gegaeabe.exe File created C:\Windows\SysWOW64\Bbfijm32.dll Lfdbcing.exe File opened for modification C:\Windows\SysWOW64\Fpecddpi.exe Fgjnpb32.exe File created C:\Windows\SysWOW64\Fimgmj32.exe Fpecddpi.exe File created C:\Windows\SysWOW64\Mfpldh32.dll Innfbb32.exe File opened for modification C:\Windows\SysWOW64\Jlcpqj32.exe Jejgcp32.exe File created C:\Windows\SysWOW64\Bjhjon32.dll Milaecdp.exe File created C:\Windows\SysWOW64\Hkoikcaq.exe Hinlck32.exe File opened for modification C:\Windows\SysWOW64\Jjbbmmih.exe Jchjqc32.exe File created C:\Windows\SysWOW64\Bfadkh32.dll Cbkdhohk.exe File created C:\Windows\SysWOW64\Enomam32.exe Eogckqkk.exe File opened for modification C:\Windows\SysWOW64\Epegae32.exe Eilodk32.exe File created C:\Windows\SysWOW64\Lloimaiq.dll Jbijcgbc.exe File created C:\Windows\SysWOW64\Dcofqphi.exe Dldndf32.exe File opened for modification C:\Windows\SysWOW64\Dcofqphi.exe Dldndf32.exe File opened for modification C:\Windows\SysWOW64\Efoobkej.exe Dhknigfq.exe File opened for modification C:\Windows\SysWOW64\Inkimc32.exe Ikmmqg32.exe File created C:\Windows\SysWOW64\Kflcbgmf.dll Jfbnmckp.exe File opened for modification C:\Windows\SysWOW64\Aocgll32.exe Nmgjee32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ikmibjkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhfoej32.dll" Kbkgig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pcdnpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ddgljced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkmhbpqc.dll" Pijhompm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Digfil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Genpkk32.dll" Cpeanp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfkokh32.dll" Ikmibjkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dhnoocab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fgojdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klmhipha.dll" Fanjil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hkjqkhkq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jfbnmckp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahdheo32.dll" Kjihci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhfnlgnk.dll" Ghndjd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jahnpd32.dll" Kqijck32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjqcoe32.dll" Cbhhbojn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ggohlf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Djokgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fpecddpi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dhnoocab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fnjkdcii.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Djddbkck.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ebojbaga.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fedinobh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hdcdfmqe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbcibnmm.dll" Hiffbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fchigcab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Heqhon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omefae32.dll" Manljd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Imccab32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dpicceon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gkmabdfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmfmoo32.dll" Hipmoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kjihci32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Khjkiikl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hkoikcaq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maaiimhq.dll" Jkfkjemd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jcaekh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Defbjb32.dll" Dpicceon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Enomam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Biiajp32.dll" Fmkpchmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iikonh32.dll" Hqjijk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Joajea32.dll" Jcaekh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cmnlphjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldioaiei.dll" Digfil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlopimho.dll" Nmgjee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Djddbkck.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Knmjmodm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fkfobbjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Glanpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfpldh32.dll" Innfbb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jlackjgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eckomcec.dll" Fqnfkoen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmggfmjg.dll" Pcdnpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohjfni32.dll" Fbflfomj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iphgeipb.dll" Jpgaohej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkjmak32.dll" Fedinobh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ifndbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kihjmonk.dll" Jlghpa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Genkhidc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhbaboaj.dll" Jkcoee32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fpjmkhbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hfgbbb32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2892 wrote to memory of 2744 2892 NEAS.c58c6b433692a6ce0ffe2dc2a2961610.exe 29 PID 2892 wrote to memory of 2744 2892 NEAS.c58c6b433692a6ce0ffe2dc2a2961610.exe 29 PID 2892 wrote to memory of 2744 2892 NEAS.c58c6b433692a6ce0ffe2dc2a2961610.exe 29 PID 2892 wrote to memory of 2744 2892 NEAS.c58c6b433692a6ce0ffe2dc2a2961610.exe 29 PID 2744 wrote to memory of 2856 2744 Ajdcofop.exe 30 PID 2744 wrote to memory of 2856 2744 Ajdcofop.exe 30 PID 2744 wrote to memory of 2856 2744 Ajdcofop.exe 30 PID 2744 wrote to memory of 2856 2744 Ajdcofop.exe 30 PID 2856 wrote to memory of 2544 2856 Fgcdlj32.exe 31 PID 2856 wrote to memory of 2544 2856 Fgcdlj32.exe 31 PID 2856 wrote to memory of 2544 2856 Fgcdlj32.exe 31 PID 2856 wrote to memory of 2544 2856 Fgcdlj32.exe 31 PID 2544 wrote to memory of 2404 2544 Fqnfkoen.exe 32 PID 2544 wrote to memory of 2404 2544 Fqnfkoen.exe 32 PID 2544 wrote to memory of 2404 2544 Fqnfkoen.exe 32 PID 2544 wrote to memory of 2404 2544 Fqnfkoen.exe 32 PID 2404 wrote to memory of 800 2404 Fmdfppkb.exe 33 PID 2404 wrote to memory of 800 2404 Fmdfppkb.exe 33 PID 2404 wrote to memory of 800 2404 Fmdfppkb.exe 33 PID 2404 wrote to memory of 800 2404 Fmdfppkb.exe 33 PID 800 wrote to memory of 2804 800 Gllpflng.exe 34 PID 800 wrote to memory of 2804 800 Gllpflng.exe 34 PID 800 wrote to memory of 2804 800 Gllpflng.exe 34 PID 800 wrote to memory of 2804 800 Gllpflng.exe 34 PID 2804 wrote to memory of 2452 2804 Gegaeabe.exe 35 PID 2804 wrote to memory of 2452 2804 Gegaeabe.exe 35 PID 2804 wrote to memory of 2452 2804 Gegaeabe.exe 35 PID 2804 wrote to memory of 2452 2804 Gegaeabe.exe 35 PID 2452 wrote to memory of 1704 2452 Gnofng32.exe 36 PID 2452 wrote to memory of 1704 2452 Gnofng32.exe 36 PID 2452 wrote to memory of 1704 2452 Gnofng32.exe 36 PID 2452 wrote to memory of 1704 2452 Gnofng32.exe 36 PID 1704 wrote to memory of 1008 1704 Gdnkkmej.exe 37 PID 1704 wrote to memory of 1008 1704 Gdnkkmej.exe 37 PID 1704 wrote to memory of 1008 1704 Gdnkkmej.exe 37 PID 1704 wrote to memory of 1008 1704 Gdnkkmej.exe 37 PID 1008 wrote to memory of 1692 1008 Hdcdfmqe.exe 38 PID 1008 wrote to memory of 1692 1008 Hdcdfmqe.exe 38 PID 1008 wrote to memory of 1692 1008 Hdcdfmqe.exe 38 PID 1008 wrote to memory of 1692 1008 Hdcdfmqe.exe 38 PID 1692 wrote to memory of 2120 1692 Hipmoc32.exe 39 PID 1692 wrote to memory of 2120 1692 Hipmoc32.exe 39 PID 1692 wrote to memory of 2120 1692 Hipmoc32.exe 39 PID 1692 wrote to memory of 2120 1692 Hipmoc32.exe 39 PID 2120 wrote to memory of 2208 2120 Ikjlmjmp.exe 40 PID 2120 wrote to memory of 2208 2120 Ikjlmjmp.exe 40 PID 2120 wrote to memory of 2208 2120 Ikjlmjmp.exe 40 PID 2120 wrote to memory of 2208 2120 Ikjlmjmp.exe 40 PID 2208 wrote to memory of 3052 2208 Ikmibjkm.exe 41 PID 2208 wrote to memory of 3052 2208 Ikmibjkm.exe 41 PID 2208 wrote to memory of 3052 2208 Ikmibjkm.exe 41 PID 2208 wrote to memory of 3052 2208 Ikmibjkm.exe 41 PID 3052 wrote to memory of 1504 3052 Iplnpq32.exe 42 PID 3052 wrote to memory of 1504 3052 Iplnpq32.exe 42 PID 3052 wrote to memory of 1504 3052 Iplnpq32.exe 42 PID 3052 wrote to memory of 1504 3052 Iplnpq32.exe 42 PID 1504 wrote to memory of 2012 1504 Jjgonf32.exe 43 PID 1504 wrote to memory of 2012 1504 Jjgonf32.exe 43 PID 1504 wrote to memory of 2012 1504 Jjgonf32.exe 43 PID 1504 wrote to memory of 2012 1504 Jjgonf32.exe 43 PID 2012 wrote to memory of 1768 2012 Jlghpa32.exe 44 PID 2012 wrote to memory of 1768 2012 Jlghpa32.exe 44 PID 2012 wrote to memory of 1768 2012 Jlghpa32.exe 44 PID 2012 wrote to memory of 1768 2012 Jlghpa32.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.c58c6b433692a6ce0ffe2dc2a2961610.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.c58c6b433692a6ce0ffe2dc2a2961610.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\Ajdcofop.exeC:\Windows\system32\Ajdcofop.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\Fgcdlj32.exeC:\Windows\system32\Fgcdlj32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\Fqnfkoen.exeC:\Windows\system32\Fqnfkoen.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\Fmdfppkb.exeC:\Windows\system32\Fmdfppkb.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\Gllpflng.exeC:\Windows\system32\Gllpflng.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\Gegaeabe.exeC:\Windows\system32\Gegaeabe.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\Gnofng32.exeC:\Windows\system32\Gnofng32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\Gdnkkmej.exeC:\Windows\system32\Gdnkkmej.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\Hdcdfmqe.exeC:\Windows\system32\Hdcdfmqe.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\Hipmoc32.exeC:\Windows\system32\Hipmoc32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\Ikjlmjmp.exeC:\Windows\system32\Ikjlmjmp.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\Ikmibjkm.exeC:\Windows\system32\Ikmibjkm.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\Iplnpq32.exeC:\Windows\system32\Iplnpq32.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\Jjgonf32.exeC:\Windows\system32\Jjgonf32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\Jlghpa32.exeC:\Windows\system32\Jlghpa32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\Jjkiie32.exeC:\Windows\system32\Jjkiie32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Windows\SysWOW64\Jbijcgbc.exeC:\Windows\system32\Jbijcgbc.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1260 -
C:\Windows\SysWOW64\Kbkgig32.exeC:\Windows\system32\Kbkgig32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1308 -
C:\Windows\SysWOW64\Kbncof32.exeC:\Windows\system32\Kbncof32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Windows\SysWOW64\Kjihci32.exeC:\Windows\system32\Kjihci32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1512 -
C:\Windows\SysWOW64\Lfdbcing.exeC:\Windows\system32\Lfdbcing.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1300 -
C:\Windows\SysWOW64\Lomglo32.exeC:\Windows\system32\Lomglo32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:3004 -
C:\Windows\SysWOW64\Lfilnh32.exeC:\Windows\system32\Lfilnh32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Windows\SysWOW64\Lpcmlnnp.exeC:\Windows\system32\Lpcmlnnp.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Windows\SysWOW64\Milaecdp.exeC:\Windows\system32\Milaecdp.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2296 -
C:\Windows\SysWOW64\Magfjebk.exeC:\Windows\system32\Magfjebk.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Windows\SysWOW64\Mjpkbk32.exeC:\Windows\system32\Mjpkbk32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2352 -
C:\Windows\SysWOW64\Mnncii32.exeC:\Windows\system32\Mnncii32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Windows\SysWOW64\Manljd32.exeC:\Windows\system32\Manljd32.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2556 -
C:\Windows\SysWOW64\Mjgqcj32.exeC:\Windows\system32\Mjgqcj32.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Windows\SysWOW64\Npcika32.exeC:\Windows\system32\Npcika32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Windows\SysWOW64\Nmgjee32.exeC:\Windows\system32\Nmgjee32.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:808 -
C:\Windows\SysWOW64\Aocgll32.exeC:\Windows\system32\Aocgll32.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2752 -
C:\Windows\SysWOW64\Khjkiikl.exeC:\Windows\system32\Khjkiikl.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1012 -
C:\Windows\SysWOW64\Fhifmcfa.exeC:\Windows\system32\Fhifmcfa.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1036 -
C:\Windows\SysWOW64\Imccab32.exeC:\Windows\system32\Imccab32.exe37⤵
- Executes dropped EXE
- Modifies registry class
PID:2992 -
C:\Windows\SysWOW64\Ieohfemq.exeC:\Windows\system32\Ieohfemq.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:924 -
C:\Windows\SysWOW64\Pfkkhmjn.exeC:\Windows\system32\Pfkkhmjn.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2624 -
C:\Windows\SysWOW64\Fnnpma32.exeC:\Windows\system32\Fnnpma32.exe40⤵
- Executes dropped EXE
PID:576 -
C:\Windows\SysWOW64\Pcdnpp32.exeC:\Windows\system32\Pcdnpp32.exe41⤵
- Executes dropped EXE
- Modifies registry class
PID:1864 -
C:\Windows\SysWOW64\Dhnoocab.exeC:\Windows\system32\Dhnoocab.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1488 -
C:\Windows\SysWOW64\Djokgk32.exeC:\Windows\system32\Djokgk32.exe43⤵
- Executes dropped EXE
- Modifies registry class
PID:2852 -
C:\Windows\SysWOW64\Dpicceon.exeC:\Windows\system32\Dpicceon.exe44⤵
- Executes dropped EXE
- Modifies registry class
PID:1372 -
C:\Windows\SysWOW64\Ddgljced.exeC:\Windows\system32\Ddgljced.exe45⤵
- Executes dropped EXE
- Modifies registry class
PID:1368 -
C:\Windows\SysWOW64\Djddbkck.exeC:\Windows\system32\Djddbkck.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2376 -
C:\Windows\SysWOW64\Dldndf32.exeC:\Windows\system32\Dldndf32.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:320 -
C:\Windows\SysWOW64\Dcofqphi.exeC:\Windows\system32\Dcofqphi.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2256 -
C:\Windows\SysWOW64\Dhknigfq.exeC:\Windows\system32\Dhknigfq.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1284 -
C:\Windows\SysWOW64\Efoobkej.exeC:\Windows\system32\Efoobkej.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1676 -
C:\Windows\SysWOW64\Eogckqkk.exeC:\Windows\system32\Eogckqkk.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2144 -
C:\Windows\SysWOW64\Enomam32.exeC:\Windows\system32\Enomam32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:3040 -
C:\Windows\SysWOW64\Eclejclg.exeC:\Windows\system32\Eclejclg.exe53⤵
- Executes dropped EXE
PID:2760 -
C:\Windows\SysWOW64\Emdjbi32.exeC:\Windows\system32\Emdjbi32.exe54⤵
- Executes dropped EXE
PID:1280 -
C:\Windows\SysWOW64\Fgjnpb32.exeC:\Windows\system32\Fgjnpb32.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2688 -
C:\Windows\SysWOW64\Fpecddpi.exeC:\Windows\system32\Fpecddpi.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2604 -
C:\Windows\SysWOW64\Fimgmj32.exeC:\Windows\system32\Fimgmj32.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2696 -
C:\Windows\SysWOW64\Fbflfomj.exeC:\Windows\system32\Fbflfomj.exe58⤵
- Executes dropped EXE
- Modifies registry class
PID:2292 -
C:\Windows\SysWOW64\Fmkpchmp.exeC:\Windows\system32\Fmkpchmp.exe59⤵
- Executes dropped EXE
- Modifies registry class
PID:920 -
C:\Windows\SysWOW64\Gigjch32.exeC:\Windows\system32\Gigjch32.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2824 -
C:\Windows\SysWOW64\Genkhidc.exeC:\Windows\system32\Genkhidc.exe61⤵
- Executes dropped EXE
- Modifies registry class
PID:1980 -
C:\Windows\SysWOW64\Gadkmj32.exeC:\Windows\system32\Gadkmj32.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2404 -
C:\Windows\SysWOW64\Ghndjd32.exeC:\Windows\system32\Ghndjd32.exe63⤵
- Executes dropped EXE
- Modifies registry class
PID:2000 -
C:\Windows\SysWOW64\Gnhlgoia.exeC:\Windows\system32\Gnhlgoia.exe64⤵
- Executes dropped EXE
PID:2400 -
C:\Windows\SysWOW64\Ghqqpd32.exeC:\Windows\system32\Ghqqpd32.exe65⤵
- Executes dropped EXE
PID:1308 -
C:\Windows\SysWOW64\Gmmihk32.exeC:\Windows\system32\Gmmihk32.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2108 -
C:\Windows\SysWOW64\Hmpemkkf.exeC:\Windows\system32\Hmpemkkf.exe67⤵
- Drops file in System32 directory
PID:2756 -
C:\Windows\SysWOW64\Hbmnfajm.exeC:\Windows\system32\Hbmnfajm.exe68⤵PID:240
-
C:\Windows\SysWOW64\Hiffbl32.exeC:\Windows\system32\Hiffbl32.exe69⤵
- Drops file in System32 directory
- Modifies registry class
PID:1776 -
C:\Windows\SysWOW64\Hiichkog.exeC:\Windows\system32\Hiichkog.exe70⤵PID:2008
-
C:\Windows\SysWOW64\Hlgodgnk.exeC:\Windows\system32\Hlgodgnk.exe71⤵PID:2368
-
C:\Windows\SysWOW64\Hfmcapna.exeC:\Windows\system32\Hfmcapna.exe72⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3044 -
C:\Windows\SysWOW64\Hhnpih32.exeC:\Windows\system32\Hhnpih32.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2896 -
C:\Windows\SysWOW64\Hinlck32.exeC:\Windows\system32\Hinlck32.exe74⤵
- Drops file in System32 directory
PID:1828 -
C:\Windows\SysWOW64\Hkoikcaq.exeC:\Windows\system32\Hkoikcaq.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:680 -
C:\Windows\SysWOW64\Ipedihgm.exeC:\Windows\system32\Ipedihgm.exe76⤵
- Drops file in System32 directory
PID:976 -
C:\Windows\SysWOW64\Idqpjg32.exeC:\Windows\system32\Idqpjg32.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1052 -
C:\Windows\SysWOW64\Igomfb32.exeC:\Windows\system32\Igomfb32.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2372 -
C:\Windows\SysWOW64\Iniebmfg.exeC:\Windows\system32\Iniebmfg.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2312 -
C:\Windows\SysWOW64\Jpgaohej.exeC:\Windows\system32\Jpgaohej.exe80⤵
- Modifies registry class
PID:2612 -
C:\Windows\SysWOW64\Jjpehn32.exeC:\Windows\system32\Jjpehn32.exe81⤵PID:1764
-
C:\Windows\SysWOW64\Jchjqc32.exeC:\Windows\system32\Jchjqc32.exe82⤵
- Drops file in System32 directory
PID:2792 -
C:\Windows\SysWOW64\Jjbbmmih.exeC:\Windows\system32\Jjbbmmih.exe83⤵PID:2444
-
C:\Windows\SysWOW64\Jkcoee32.exeC:\Windows\system32\Jkcoee32.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:1576 -
C:\Windows\SysWOW64\Jbmgapgc.exeC:\Windows\system32\Jbmgapgc.exe85⤵PID:944
-
C:\Windows\SysWOW64\Jkfkjemd.exeC:\Windows\system32\Jkfkjemd.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2968 -
C:\Windows\SysWOW64\Jbpcgo32.exeC:\Windows\system32\Jbpcgo32.exe87⤵PID:1948
-
C:\Windows\SysWOW64\Jhjldiln.exeC:\Windows\system32\Jhjldiln.exe88⤵PID:2664
-
C:\Windows\SysWOW64\Jocdqc32.exeC:\Windows\system32\Jocdqc32.exe89⤵
- Drops file in System32 directory
PID:1636 -
C:\Windows\SysWOW64\Jnfdlpje.exeC:\Windows\system32\Jnfdlpje.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1540 -
C:\Windows\SysWOW64\Kqijck32.exeC:\Windows\system32\Kqijck32.exe91⤵
- Modifies registry class
PID:2588 -
C:\Windows\SysWOW64\Kgcbpemp.exeC:\Windows\system32\Kgcbpemp.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1960 -
C:\Windows\SysWOW64\Knmjmodm.exeC:\Windows\system32\Knmjmodm.exe93⤵
- Modifies registry class
PID:2628 -
C:\Windows\SysWOW64\Kfioaaah.exeC:\Windows\system32\Kfioaaah.exe94⤵PID:1340
-
C:\Windows\SysWOW64\Kmbgnl32.exeC:\Windows\system32\Kmbgnl32.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2808 -
C:\Windows\SysWOW64\Kiihcmoi.exeC:\Windows\system32\Kiihcmoi.exe96⤵PID:2016
-
C:\Windows\SysWOW64\Lcolpe32.exeC:\Windows\system32\Lcolpe32.exe97⤵PID:1940
-
C:\Windows\SysWOW64\Lmgaikep.exeC:\Windows\system32\Lmgaikep.exe98⤵
- Drops file in System32 directory
PID:1768 -
C:\Windows\SysWOW64\Fgojdj32.exeC:\Windows\system32\Fgojdj32.exe99⤵
- Modifies registry class
PID:1300 -
C:\Windows\SysWOW64\Pijhompm.exeC:\Windows\system32\Pijhompm.exe100⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2592 -
C:\Windows\SysWOW64\Fnjkdcii.exeC:\Windows\system32\Fnjkdcii.exe101⤵
- Drops file in System32 directory
- Modifies registry class
PID:2908 -
C:\Windows\SysWOW64\Cbhhbojn.exeC:\Windows\system32\Cbhhbojn.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1520 -
C:\Windows\SysWOW64\Cmnlphjd.exeC:\Windows\system32\Cmnlphjd.exe103⤵
- Drops file in System32 directory
- Modifies registry class
PID:2164 -
C:\Windows\SysWOW64\Colhlcig.exeC:\Windows\system32\Colhlcig.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1000 -
C:\Windows\SysWOW64\Cbkdhohk.exeC:\Windows\system32\Cbkdhohk.exe105⤵
- Drops file in System32 directory
PID:3028 -
C:\Windows\SysWOW64\Dfhjmpam.exeC:\Windows\system32\Dfhjmpam.exe106⤵PID:2412
-
C:\Windows\SysWOW64\Digfil32.exeC:\Windows\system32\Digfil32.exe107⤵
- Drops file in System32 directory
- Modifies registry class
PID:1296 -
C:\Windows\SysWOW64\Dpanffhn.exeC:\Windows\system32\Dpanffhn.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2060 -
C:\Windows\SysWOW64\Ebojbaga.exeC:\Windows\system32\Ebojbaga.exe109⤵
- Drops file in System32 directory
- Modifies registry class
PID:1036 -
C:\Windows\SysWOW64\Efkfbp32.exeC:\Windows\system32\Efkfbp32.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2484 -
C:\Windows\SysWOW64\Ebaggaeo.exeC:\Windows\system32\Ebaggaeo.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2420 -
C:\Windows\SysWOW64\Eilodk32.exeC:\Windows\system32\Eilodk32.exe112⤵
- Drops file in System32 directory
PID:2672 -
C:\Windows\SysWOW64\Epegae32.exeC:\Windows\system32\Epegae32.exe113⤵PID:1316
-
C:\Windows\SysWOW64\Empacnmh.exeC:\Windows\system32\Empacnmh.exe114⤵PID:2524
-
C:\Windows\SysWOW64\Eakmdm32.exeC:\Windows\system32\Eakmdm32.exe115⤵PID:2700
-
C:\Windows\SysWOW64\Fopnma32.exeC:\Windows\system32\Fopnma32.exe116⤵PID:2796
-
C:\Windows\SysWOW64\Fanjil32.exeC:\Windows\system32\Fanjil32.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:1920 -
C:\Windows\SysWOW64\Fhhbffkk.exeC:\Windows\system32\Fhhbffkk.exe118⤵PID:768
-
C:\Windows\SysWOW64\Fkfobbjo.exeC:\Windows\system32\Fkfobbjo.exe119⤵
- Modifies registry class
PID:2596 -
C:\Windows\SysWOW64\Fapgolal.exeC:\Windows\system32\Fapgolal.exe120⤵PID:2544
-
C:\Windows\SysWOW64\Fedinobh.exeC:\Windows\system32\Fedinobh.exe121⤵
- Modifies registry class
PID:1008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-