Analysis
-
max time kernel
204s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
03/11/2023, 14:47
Behavioral task
behavioral1
Sample
NEAS.c10674242abaeeb2098af26c28dfe6b0_JC.exe
Resource
win7-20231023-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.c10674242abaeeb2098af26c28dfe6b0_JC.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
NEAS.c10674242abaeeb2098af26c28dfe6b0_JC.exe
-
Size
109KB
-
MD5
c10674242abaeeb2098af26c28dfe6b0
-
SHA1
67a66d42547c24acb45657f324945ec58e89ac6b
-
SHA256
0b223c973ea5a52062bc3820e1239732626406c20d6f540545d5c6e981fdcd1c
-
SHA512
ba1fbfad322f7b6e4d5db0e66838ef25bdaf4d0c744fc7576cb9dcb76d1cbc549c9ec529d86df821aabedd87bc76b69e6fb1df9cf3c6bbd15c059564def4c510
-
SSDEEP
3072:ZoEQedhS5yaSe0eJ9mLCqwzBu1DjHLMVDqqkSpR:V1w5rEeJ9iwtu1DjrFqhz
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bqpejh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcanlcgi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oheppe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjgbmoda.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Odpeop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oceaql32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Apphpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dklkkoqf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hgfnlejd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lldkem32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Omkidb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Amfeodoh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fokqae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jljeeqfn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oomlfpdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Plffkc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Moecghdl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhbnjpic.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfliqmjg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eeemol32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fikkcnog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" NEAS.c10674242abaeeb2098af26c28dfe6b0_JC.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oophlpag.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qahnid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Allbpqcp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cjmcnmmc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cffqhmqd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fmidimen.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pbjoaibo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pneiaidn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bkcmba32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Akkokc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mlidplcf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Condfo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkcmba32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cjmcnmmc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lbplciof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ajqoqm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Efkfbp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Icjokidf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phhmeehg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aogmdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Laacmc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fopnma32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ialbon32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nliqoofa.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dklkkoqf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnmpcmpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bnmpcmpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dnikno32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fikkcnog.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lobgah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mhmhpm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okbgkk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lkhfhaea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iianjl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gabpco32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oheppe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nahemf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pmpcoabe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Piipibff.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Caajmilh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jeahpa32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hqjijk32.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/memory/2620-0-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/2620-6-0x0000000000220000-0x0000000000264000-memory.dmp family_berbew behavioral1/files/0x0003000000004ed5-5.dat family_berbew behavioral1/files/0x0003000000004ed5-8.dat family_berbew behavioral1/files/0x0003000000004ed5-12.dat family_berbew behavioral1/files/0x0034000000016d1c-25.dat family_berbew behavioral1/memory/1660-24-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/files/0x0034000000016d1c-20.dat family_berbew behavioral1/files/0x0034000000016d1c-18.dat family_berbew behavioral1/files/0x0003000000004ed5-13.dat family_berbew behavioral1/files/0x0003000000004ed5-9.dat family_berbew behavioral1/files/0x0007000000016fd4-45.dat family_berbew behavioral1/files/0x000d000000012263-35.dat family_berbew behavioral1/files/0x000d000000012263-34.dat family_berbew behavioral1/files/0x000d000000012263-32.dat family_berbew behavioral1/files/0x0034000000016d1c-27.dat family_berbew behavioral1/files/0x0034000000016d1c-14.dat family_berbew behavioral1/memory/2908-58-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/files/0x0007000000016fd4-41.dat family_berbew behavioral1/memory/2356-57-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/files/0x000d000000012263-40.dat family_berbew behavioral1/files/0x0007000000016fd4-52.dat family_berbew behavioral1/files/0x0007000000016fd4-51.dat family_berbew behavioral1/memory/2508-39-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/files/0x0007000000016fd4-47.dat family_berbew behavioral1/files/0x000d000000012263-38.dat family_berbew behavioral1/files/0x00070000000171d6-59.dat family_berbew behavioral1/memory/2356-65-0x00000000002C0000-0x0000000000304000-memory.dmp family_berbew behavioral1/memory/704-72-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/files/0x00060000000186ce-79.dat family_berbew behavioral1/memory/2880-80-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/files/0x00060000000186ce-76.dat family_berbew behavioral1/files/0x00060000000186ce-75.dat family_berbew behavioral1/files/0x00060000000186ce-73.dat family_berbew behavioral1/files/0x00070000000171d6-67.dat family_berbew behavioral1/files/0x00070000000171d6-66.dat family_berbew behavioral1/files/0x00070000000171d6-62.dat family_berbew behavioral1/files/0x00070000000171d6-61.dat family_berbew behavioral1/files/0x00060000000186ce-81.dat family_berbew behavioral1/files/0x0005000000018717-86.dat family_berbew behavioral1/memory/2880-93-0x0000000000220000-0x0000000000264000-memory.dmp family_berbew behavioral1/files/0x0005000000018717-94.dat family_berbew behavioral1/files/0x0005000000018717-92.dat family_berbew behavioral1/files/0x0005000000018717-89.dat family_berbew behavioral1/files/0x0005000000018717-88.dat family_berbew behavioral1/files/0x0006000000018ac3-100.dat family_berbew behavioral1/files/0x0006000000018ac3-103.dat family_berbew behavioral1/files/0x0006000000018ac3-107.dat family_berbew behavioral1/files/0x0006000000018ac3-106.dat family_berbew behavioral1/files/0x0006000000018ac3-102.dat family_berbew behavioral1/memory/2340-99-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/files/0x0006000000018b63-112.dat family_berbew behavioral1/memory/1988-119-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/files/0x0006000000018b73-121.dat family_berbew behavioral1/files/0x0006000000018b63-120.dat family_berbew behavioral1/files/0x0006000000018b63-118.dat family_berbew behavioral1/files/0x0006000000018b63-115.dat family_berbew behavioral1/files/0x0006000000018b63-114.dat family_berbew behavioral1/memory/2396-137-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/files/0x0006000000018b73-133.dat family_berbew behavioral1/files/0x0006000000018b73-132.dat family_berbew behavioral1/files/0x0006000000018f06-142.dat family_berbew behavioral1/files/0x0006000000018f06-141.dat family_berbew behavioral1/files/0x0006000000018f06-139.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1660 Jjilde32.exe 2908 Jljeeqfn.exe 2508 Jjneoeeh.exe 2356 Jcfjhj32.exe 704 Klonqpbi.exe 2880 Lmnkpc32.exe 2340 Lmqgec32.exe 1988 Lckpbm32.exe 2396 Lmcdkbao.exe 560 Lbplciof.exe 2812 Lgmekpmn.exe 1500 Lnfmhj32.exe 1244 Mjmnmk32.exe 2944 Mecbjd32.exe 2028 Mhckloge.exe 1916 Mpoppadq.exe 1368 Odanqb32.exe 2220 Omjbihpn.exe 984 Odckfb32.exe 1508 Oeegnj32.exe 1288 Oomlfpdi.exe 2168 Oheppe32.exe 1732 Oophlpag.exe 1996 Phhmeehg.exe 2624 Pcmabnhm.exe 1572 Plffkc32.exe 2764 Pabncj32.exe 3012 Pkkblp32.exe 2556 Qcmnaaji.exe 596 Acpjga32.exe 2876 Ajibckpc.exe 1920 Akkokc32.exe 1616 Aoihaa32.exe 940 Afbpnlcd.exe 1548 Aalaoipc.exe 2740 Aicipgqe.exe 1552 Akbelbpi.exe 2884 Bejiehfi.exe 2348 Bkdbab32.exe 1148 Bjgbmoda.exe 1096 Bgkbfcck.exe 2096 Aogmdk32.exe 688 Ahoamplo.exe 2968 Cqneaodd.exe 292 Jjgpjjak.exe 2436 Dcppmg32.exe 2192 Efolib32.exe 1540 Eimien32.exe 1568 Ldgikklb.exe 1300 Lmondpbc.exe 2428 Lblflgqk.exe 2472 Lifoia32.exe 2536 Lldkem32.exe 2672 Lobgah32.exe 2832 Laacmc32.exe 1624 Mlfgkleh.exe 1844 Moecghdl.exe 1656 Macpcccp.exe 2560 Mhmhpm32.exe 1324 Mlidplcf.exe 2184 Mmjqhd32.exe 2152 Nliqoofa.exe 2092 Ncbilimn.exe 2676 Naeigf32.exe -
Loads dropped DLL 64 IoCs
pid Process 2620 NEAS.c10674242abaeeb2098af26c28dfe6b0_JC.exe 2620 NEAS.c10674242abaeeb2098af26c28dfe6b0_JC.exe 1660 Jjilde32.exe 1660 Jjilde32.exe 2908 Jljeeqfn.exe 2908 Jljeeqfn.exe 2508 Jjneoeeh.exe 2508 Jjneoeeh.exe 2356 Jcfjhj32.exe 2356 Jcfjhj32.exe 704 Klonqpbi.exe 704 Klonqpbi.exe 2880 Lmnkpc32.exe 2880 Lmnkpc32.exe 2340 Lmqgec32.exe 2340 Lmqgec32.exe 1988 Lckpbm32.exe 1988 Lckpbm32.exe 2396 Lmcdkbao.exe 2396 Lmcdkbao.exe 560 Lbplciof.exe 560 Lbplciof.exe 2812 Lgmekpmn.exe 2812 Lgmekpmn.exe 1500 Lnfmhj32.exe 1500 Lnfmhj32.exe 1244 Mjmnmk32.exe 1244 Mjmnmk32.exe 2944 Mecbjd32.exe 2944 Mecbjd32.exe 2028 Mhckloge.exe 2028 Mhckloge.exe 1916 Mpoppadq.exe 1916 Mpoppadq.exe 1368 Odanqb32.exe 1368 Odanqb32.exe 2220 Omjbihpn.exe 2220 Omjbihpn.exe 984 Odckfb32.exe 984 Odckfb32.exe 1508 Oeegnj32.exe 1508 Oeegnj32.exe 1288 Oomlfpdi.exe 1288 Oomlfpdi.exe 2168 Oheppe32.exe 2168 Oheppe32.exe 1732 Oophlpag.exe 1732 Oophlpag.exe 1996 Phhmeehg.exe 1996 Phhmeehg.exe 2624 Pcmabnhm.exe 2624 Pcmabnhm.exe 1572 Plffkc32.exe 1572 Plffkc32.exe 2764 Pabncj32.exe 2764 Pabncj32.exe 3012 Pkkblp32.exe 3012 Pkkblp32.exe 2556 Qcmnaaji.exe 2556 Qcmnaaji.exe 596 Acpjga32.exe 596 Acpjga32.exe 2876 Ajibckpc.exe 2876 Ajibckpc.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Jcfjhj32.exe Jjneoeeh.exe File opened for modification C:\Windows\SysWOW64\Cjmcnmmc.exe Ccckabef.exe File created C:\Windows\SysWOW64\Colhlcig.exe Cmlpjhlf.exe File created C:\Windows\SysWOW64\Eloekf32.exe Eeemol32.exe File created C:\Windows\SysWOW64\Jqjddlfd.dll Bdpjjaiq.exe File created C:\Windows\SysWOW64\Aoafcm32.dll Gdqlpj32.exe File created C:\Windows\SysWOW64\Pddiabfi.dll Mhckloge.exe File created C:\Windows\SysWOW64\Kcipdg32.dll Omjbihpn.exe File created C:\Windows\SysWOW64\Qcmnaaji.exe Pkkblp32.exe File created C:\Windows\SysWOW64\Acpjga32.exe Qcmnaaji.exe File opened for modification C:\Windows\SysWOW64\Ahoamplo.exe Aogmdk32.exe File created C:\Windows\SysWOW64\Jiklpjeb.dll Nhbnjpic.exe File opened for modification C:\Windows\SysWOW64\Mecbjd32.exe Mjmnmk32.exe File created C:\Windows\SysWOW64\Pabncj32.exe Plffkc32.exe File opened for modification C:\Windows\SysWOW64\Bfliqmjg.exe Bpbadcbj.exe File created C:\Windows\SysWOW64\Bfdhdj32.exe Bnmpcmpi.exe File opened for modification C:\Windows\SysWOW64\Jljeeqfn.exe Jjilde32.exe File created C:\Windows\SysWOW64\Inceepmo.dll Aalaoipc.exe File created C:\Windows\SysWOW64\Okabeg32.dll Mlfgkleh.exe File opened for modification C:\Windows\SysWOW64\Ohdkop32.exe Nhbnjpic.exe File created C:\Windows\SysWOW64\Olioiabj.dll Ohdkop32.exe File created C:\Windows\SysWOW64\Bjhjcm32.exe Bqpejh32.exe File created C:\Windows\SysWOW64\Jljeeqfn.exe Jjilde32.exe File created C:\Windows\SysWOW64\Fhachj32.dll Laacmc32.exe File opened for modification C:\Windows\SysWOW64\Fokqae32.exe Fmidimen.exe File created C:\Windows\SysWOW64\Hqjijk32.exe Gqgmdkgm.exe File created C:\Windows\SysWOW64\Mfpldh32.dll Iianjl32.exe File created C:\Windows\SysWOW64\Mbgapn32.dll Dddodd32.exe File created C:\Windows\SysWOW64\Ibncikac.dll Bnmpcmpi.exe File created C:\Windows\SysWOW64\Bgedlbfj.exe Bfdhdj32.exe File created C:\Windows\SysWOW64\Bqpejh32.exe Bkcmba32.exe File created C:\Windows\SysWOW64\Ekdkil32.dll Ccckabef.exe File created C:\Windows\SysWOW64\Lopbcgno.dll Dljoac32.exe File created C:\Windows\SysWOW64\Ldgikklb.exe Eimien32.exe File created C:\Windows\SysWOW64\Cmlpjhlf.exe Cjmcnmmc.exe File opened for modification C:\Windows\SysWOW64\Iianjl32.exe Ibgenaqk.exe File created C:\Windows\SysWOW64\Omjkkb32.dll Bejiehfi.exe File created C:\Windows\SysWOW64\Ahoamplo.exe Aogmdk32.exe File opened for modification C:\Windows\SysWOW64\Odpeop32.exe Onelbfab.exe File created C:\Windows\SysWOW64\Paejod32.dll Caajmilh.exe File created C:\Windows\SysWOW64\Clnkdc32.exe Bgablmfa.exe File opened for modification C:\Windows\SysWOW64\Condfo32.exe Cialng32.exe File opened for modification C:\Windows\SysWOW64\Dnikno32.exe Dljoac32.exe File opened for modification C:\Windows\SysWOW64\Hmqjoljn.exe Hgdagelg.exe File created C:\Windows\SysWOW64\Ibgenaqk.exe Iinadl32.exe File created C:\Windows\SysWOW64\Jhhfncqb.dll Nlkmeo32.exe File opened for modification C:\Windows\SysWOW64\Bjhjcm32.exe Bqpejh32.exe File created C:\Windows\SysWOW64\Cqnpig32.dll Icjokidf.exe File created C:\Windows\SysWOW64\Aoihaa32.exe Akkokc32.exe File opened for modification C:\Windows\SysWOW64\Icjokidf.exe Ialbon32.exe File created C:\Windows\SysWOW64\Ighgah32.exe Icjokidf.exe File created C:\Windows\SysWOW64\Akjogd32.dll Lifoia32.exe File created C:\Windows\SysWOW64\Ceidfi32.dll Pneiaidn.exe File opened for modification C:\Windows\SysWOW64\Cmpieg32.exe Cffqhmqd.exe File created C:\Windows\SysWOW64\Dnikno32.exe Dljoac32.exe File created C:\Windows\SysWOW64\Odjhea32.dll Gabpco32.exe File opened for modification C:\Windows\SysWOW64\Hqjijk32.exe Gqgmdkgm.exe File created C:\Windows\SysWOW64\Makgdqnb.dll Odpeop32.exe File created C:\Windows\SysWOW64\Paifem32.dll Apphpp32.exe File created C:\Windows\SysWOW64\Nqepfb32.dll Bgablmfa.exe File created C:\Windows\SysWOW64\Oogolo32.dll Iinadl32.exe File created C:\Windows\SysWOW64\Klonqpbi.exe Jcfjhj32.exe File opened for modification C:\Windows\SysWOW64\Lldkem32.exe Lifoia32.exe File created C:\Windows\SysWOW64\Ikfbai32.dll Aeajcf32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1012 2920 WerFault.exe 200 -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lmcdkbao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oehiod32.dll" Amfeodoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aojjdb32.dll" Bfliqmjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Acpjga32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cqneaodd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncnkblgl.dll" Nliqoofa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amhogfdf.dll" Qahnid32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eiibok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpppik32.dll" Fikkcnog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Apbeeppo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbgjae32.dll" Fmidimen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fdlfeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fohecb32.dll" Jcfjhj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfcmbjlm.dll" Ncbilimn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngfepoaa.dll" Pkeppngm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Amfeodoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhongdah.dll" Blplkp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmkhid32.dll" Cgcoal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bdidegec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fdockgqp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fmidimen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hgdagelg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aafdca32.dll" Mjmnmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Odpeop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qahnid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dgclpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekdkil32.dll" Ccckabef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ialbon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lnfmhj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Acpjga32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oceaql32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lmqgec32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfdfng32.dll" Oeegnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oilmfhgd.dll" Bdidegec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aheele32.dll" Fopnma32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aogmdk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mlidplcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Apphpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggfdldll.dll" Apbeeppo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lkhfhaea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bgmjla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cbmann32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Omjbihpn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eimien32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfcilj32.dll" Ajqoqm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bdpjjaiq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olmpij32.dll" Aogmdk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lobgah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nliqoofa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pfhghgie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cclmlm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hgdagelg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjfallhc.dll" Hgfnlejd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inceepmo.dll" Aalaoipc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pnhegi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bgablmfa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ighgah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oeegnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bpbadcbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iinadl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqnpig32.dll" Icjokidf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lmnkpc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pkkblp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aoihaa32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2620 wrote to memory of 1660 2620 NEAS.c10674242abaeeb2098af26c28dfe6b0_JC.exe 29 PID 2620 wrote to memory of 1660 2620 NEAS.c10674242abaeeb2098af26c28dfe6b0_JC.exe 29 PID 2620 wrote to memory of 1660 2620 NEAS.c10674242abaeeb2098af26c28dfe6b0_JC.exe 29 PID 2620 wrote to memory of 1660 2620 NEAS.c10674242abaeeb2098af26c28dfe6b0_JC.exe 29 PID 1660 wrote to memory of 2908 1660 Jjilde32.exe 30 PID 1660 wrote to memory of 2908 1660 Jjilde32.exe 30 PID 1660 wrote to memory of 2908 1660 Jjilde32.exe 30 PID 1660 wrote to memory of 2908 1660 Jjilde32.exe 30 PID 2908 wrote to memory of 2508 2908 Jljeeqfn.exe 31 PID 2908 wrote to memory of 2508 2908 Jljeeqfn.exe 31 PID 2908 wrote to memory of 2508 2908 Jljeeqfn.exe 31 PID 2908 wrote to memory of 2508 2908 Jljeeqfn.exe 31 PID 2508 wrote to memory of 2356 2508 Jjneoeeh.exe 32 PID 2508 wrote to memory of 2356 2508 Jjneoeeh.exe 32 PID 2508 wrote to memory of 2356 2508 Jjneoeeh.exe 32 PID 2508 wrote to memory of 2356 2508 Jjneoeeh.exe 32 PID 2356 wrote to memory of 704 2356 Jcfjhj32.exe 33 PID 2356 wrote to memory of 704 2356 Jcfjhj32.exe 33 PID 2356 wrote to memory of 704 2356 Jcfjhj32.exe 33 PID 2356 wrote to memory of 704 2356 Jcfjhj32.exe 33 PID 704 wrote to memory of 2880 704 Klonqpbi.exe 34 PID 704 wrote to memory of 2880 704 Klonqpbi.exe 34 PID 704 wrote to memory of 2880 704 Klonqpbi.exe 34 PID 704 wrote to memory of 2880 704 Klonqpbi.exe 34 PID 2880 wrote to memory of 2340 2880 Lmnkpc32.exe 35 PID 2880 wrote to memory of 2340 2880 Lmnkpc32.exe 35 PID 2880 wrote to memory of 2340 2880 Lmnkpc32.exe 35 PID 2880 wrote to memory of 2340 2880 Lmnkpc32.exe 35 PID 2340 wrote to memory of 1988 2340 Lmqgec32.exe 36 PID 2340 wrote to memory of 1988 2340 Lmqgec32.exe 36 PID 2340 wrote to memory of 1988 2340 Lmqgec32.exe 36 PID 2340 wrote to memory of 1988 2340 Lmqgec32.exe 36 PID 1988 wrote to memory of 2396 1988 Lckpbm32.exe 37 PID 1988 wrote to memory of 2396 1988 Lckpbm32.exe 37 PID 1988 wrote to memory of 2396 1988 Lckpbm32.exe 37 PID 1988 wrote to memory of 2396 1988 Lckpbm32.exe 37 PID 2396 wrote to memory of 560 2396 Lmcdkbao.exe 39 PID 2396 wrote to memory of 560 2396 Lmcdkbao.exe 39 PID 2396 wrote to memory of 560 2396 Lmcdkbao.exe 39 PID 2396 wrote to memory of 560 2396 Lmcdkbao.exe 39 PID 560 wrote to memory of 2812 560 Lbplciof.exe 38 PID 560 wrote to memory of 2812 560 Lbplciof.exe 38 PID 560 wrote to memory of 2812 560 Lbplciof.exe 38 PID 560 wrote to memory of 2812 560 Lbplciof.exe 38 PID 2812 wrote to memory of 1500 2812 Lgmekpmn.exe 40 PID 2812 wrote to memory of 1500 2812 Lgmekpmn.exe 40 PID 2812 wrote to memory of 1500 2812 Lgmekpmn.exe 40 PID 2812 wrote to memory of 1500 2812 Lgmekpmn.exe 40 PID 1500 wrote to memory of 1244 1500 Lnfmhj32.exe 41 PID 1500 wrote to memory of 1244 1500 Lnfmhj32.exe 41 PID 1500 wrote to memory of 1244 1500 Lnfmhj32.exe 41 PID 1500 wrote to memory of 1244 1500 Lnfmhj32.exe 41 PID 1244 wrote to memory of 2944 1244 Mjmnmk32.exe 42 PID 1244 wrote to memory of 2944 1244 Mjmnmk32.exe 42 PID 1244 wrote to memory of 2944 1244 Mjmnmk32.exe 42 PID 1244 wrote to memory of 2944 1244 Mjmnmk32.exe 42 PID 2944 wrote to memory of 2028 2944 Mecbjd32.exe 43 PID 2944 wrote to memory of 2028 2944 Mecbjd32.exe 43 PID 2944 wrote to memory of 2028 2944 Mecbjd32.exe 43 PID 2944 wrote to memory of 2028 2944 Mecbjd32.exe 43 PID 2028 wrote to memory of 1916 2028 Mhckloge.exe 44 PID 2028 wrote to memory of 1916 2028 Mhckloge.exe 44 PID 2028 wrote to memory of 1916 2028 Mhckloge.exe 44 PID 2028 wrote to memory of 1916 2028 Mhckloge.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.c10674242abaeeb2098af26c28dfe6b0_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.c10674242abaeeb2098af26c28dfe6b0_JC.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\Jjilde32.exeC:\Windows\system32\Jjilde32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\Jljeeqfn.exeC:\Windows\system32\Jljeeqfn.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\Jjneoeeh.exeC:\Windows\system32\Jjneoeeh.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\Jcfjhj32.exeC:\Windows\system32\Jcfjhj32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\Klonqpbi.exeC:\Windows\system32\Klonqpbi.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\Lmnkpc32.exeC:\Windows\system32\Lmnkpc32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\Lmqgec32.exeC:\Windows\system32\Lmqgec32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\Lckpbm32.exeC:\Windows\system32\Lckpbm32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\Lmcdkbao.exeC:\Windows\system32\Lmcdkbao.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\Lbplciof.exeC:\Windows\system32\Lbplciof.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:560
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Lgmekpmn.exeC:\Windows\system32\Lgmekpmn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\Lnfmhj32.exeC:\Windows\system32\Lnfmhj32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\Mjmnmk32.exeC:\Windows\system32\Mjmnmk32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\Mecbjd32.exeC:\Windows\system32\Mecbjd32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\Mhckloge.exeC:\Windows\system32\Mhckloge.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\Mpoppadq.exeC:\Windows\system32\Mpoppadq.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Windows\SysWOW64\Odanqb32.exeC:\Windows\system32\Odanqb32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Windows\SysWOW64\Omjbihpn.exeC:\Windows\system32\Omjbihpn.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2220 -
C:\Windows\SysWOW64\Odckfb32.exeC:\Windows\system32\Odckfb32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Windows\SysWOW64\Oeegnj32.exeC:\Windows\system32\Oeegnj32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1508 -
C:\Windows\SysWOW64\Oomlfpdi.exeC:\Windows\system32\Oomlfpdi.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Windows\SysWOW64\Oheppe32.exeC:\Windows\system32\Oheppe32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Windows\SysWOW64\Oophlpag.exeC:\Windows\system32\Oophlpag.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Windows\SysWOW64\Phhmeehg.exeC:\Windows\system32\Phhmeehg.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Windows\SysWOW64\Pcmabnhm.exeC:\Windows\system32\Pcmabnhm.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Windows\SysWOW64\Plffkc32.exeC:\Windows\system32\Plffkc32.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1572 -
C:\Windows\SysWOW64\Pabncj32.exeC:\Windows\system32\Pabncj32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Windows\SysWOW64\Pkkblp32.exeC:\Windows\system32\Pkkblp32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:3012 -
C:\Windows\SysWOW64\Qcmnaaji.exeC:\Windows\system32\Qcmnaaji.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2556 -
C:\Windows\SysWOW64\Acpjga32.exeC:\Windows\system32\Acpjga32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:596 -
C:\Windows\SysWOW64\Ajibckpc.exeC:\Windows\system32\Ajibckpc.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Windows\SysWOW64\Akkokc32.exeC:\Windows\system32\Akkokc32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1920 -
C:\Windows\SysWOW64\Aoihaa32.exeC:\Windows\system32\Aoihaa32.exe23⤵
- Executes dropped EXE
- Modifies registry class
PID:1616 -
C:\Windows\SysWOW64\Afbpnlcd.exeC:\Windows\system32\Afbpnlcd.exe24⤵
- Executes dropped EXE
PID:940 -
C:\Windows\SysWOW64\Aalaoipc.exeC:\Windows\system32\Aalaoipc.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1548 -
C:\Windows\SysWOW64\Aicipgqe.exeC:\Windows\system32\Aicipgqe.exe26⤵
- Executes dropped EXE
PID:2740 -
C:\Windows\SysWOW64\Akbelbpi.exeC:\Windows\system32\Akbelbpi.exe27⤵
- Executes dropped EXE
PID:1552 -
C:\Windows\SysWOW64\Bejiehfi.exeC:\Windows\system32\Bejiehfi.exe28⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2884 -
C:\Windows\SysWOW64\Bkdbab32.exeC:\Windows\system32\Bkdbab32.exe29⤵
- Executes dropped EXE
PID:2348 -
C:\Windows\SysWOW64\Bjgbmoda.exeC:\Windows\system32\Bjgbmoda.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1148 -
C:\Windows\SysWOW64\Bgkbfcck.exeC:\Windows\system32\Bgkbfcck.exe31⤵
- Executes dropped EXE
PID:1096 -
C:\Windows\SysWOW64\Aogmdk32.exeC:\Windows\system32\Aogmdk32.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2096 -
C:\Windows\SysWOW64\Ahoamplo.exeC:\Windows\system32\Ahoamplo.exe33⤵
- Executes dropped EXE
PID:688 -
C:\Windows\SysWOW64\Cqneaodd.exeC:\Windows\system32\Cqneaodd.exe34⤵
- Executes dropped EXE
- Modifies registry class
PID:2968 -
C:\Windows\SysWOW64\Jjgpjjak.exeC:\Windows\system32\Jjgpjjak.exe35⤵
- Executes dropped EXE
PID:292 -
C:\Windows\SysWOW64\Dcppmg32.exeC:\Windows\system32\Dcppmg32.exe36⤵
- Executes dropped EXE
PID:2436 -
C:\Windows\SysWOW64\Efolib32.exeC:\Windows\system32\Efolib32.exe37⤵
- Executes dropped EXE
PID:2192 -
C:\Windows\SysWOW64\Eimien32.exeC:\Windows\system32\Eimien32.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1540 -
C:\Windows\SysWOW64\Ldgikklb.exeC:\Windows\system32\Ldgikklb.exe39⤵
- Executes dropped EXE
PID:1568 -
C:\Windows\SysWOW64\Lmondpbc.exeC:\Windows\system32\Lmondpbc.exe40⤵
- Executes dropped EXE
PID:1300 -
C:\Windows\SysWOW64\Lblflgqk.exeC:\Windows\system32\Lblflgqk.exe41⤵
- Executes dropped EXE
PID:2428 -
C:\Windows\SysWOW64\Lifoia32.exeC:\Windows\system32\Lifoia32.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2472 -
C:\Windows\SysWOW64\Lldkem32.exeC:\Windows\system32\Lldkem32.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2536 -
C:\Windows\SysWOW64\Lobgah32.exeC:\Windows\system32\Lobgah32.exe44⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2672 -
C:\Windows\SysWOW64\Laacmc32.exeC:\Windows\system32\Laacmc32.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2832 -
C:\Windows\SysWOW64\Mlfgkleh.exeC:\Windows\system32\Mlfgkleh.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1624 -
C:\Windows\SysWOW64\Moecghdl.exeC:\Windows\system32\Moecghdl.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1844 -
C:\Windows\SysWOW64\Macpcccp.exeC:\Windows\system32\Macpcccp.exe48⤵
- Executes dropped EXE
PID:1656 -
C:\Windows\SysWOW64\Mhmhpm32.exeC:\Windows\system32\Mhmhpm32.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2560 -
C:\Windows\SysWOW64\Mlidplcf.exeC:\Windows\system32\Mlidplcf.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1324 -
C:\Windows\SysWOW64\Mmjqhd32.exeC:\Windows\system32\Mmjqhd32.exe51⤵
- Executes dropped EXE
PID:2184 -
C:\Windows\SysWOW64\Nliqoofa.exeC:\Windows\system32\Nliqoofa.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2152 -
C:\Windows\SysWOW64\Ncbilimn.exeC:\Windows\system32\Ncbilimn.exe53⤵
- Executes dropped EXE
- Modifies registry class
PID:2092 -
C:\Windows\SysWOW64\Naeigf32.exeC:\Windows\system32\Naeigf32.exe54⤵
- Executes dropped EXE
PID:2676 -
C:\Windows\SysWOW64\Nimaic32.exeC:\Windows\system32\Nimaic32.exe55⤵PID:972
-
C:\Windows\SysWOW64\Nlkmeo32.exeC:\Windows\system32\Nlkmeo32.exe56⤵
- Drops file in System32 directory
PID:1496 -
C:\Windows\SysWOW64\Nahemf32.exeC:\Windows\system32\Nahemf32.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1100 -
C:\Windows\SysWOW64\Nhbnjpic.exeC:\Windows\system32\Nhbnjpic.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:268 -
C:\Windows\SysWOW64\Ohdkop32.exeC:\Windows\system32\Ohdkop32.exe59⤵
- Drops file in System32 directory
PID:1988 -
C:\Windows\SysWOW64\Okbgkk32.exeC:\Windows\system32\Okbgkk32.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1092 -
C:\Windows\SysWOW64\Onelbfab.exeC:\Windows\system32\Onelbfab.exe61⤵
- Drops file in System32 directory
PID:1508 -
C:\Windows\SysWOW64\Odpeop32.exeC:\Windows\system32\Odpeop32.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:1572 -
C:\Windows\SysWOW64\Omkidb32.exeC:\Windows\system32\Omkidb32.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1920 -
C:\Windows\SysWOW64\Oceaql32.exeC:\Windows\system32\Oceaql32.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1968 -
C:\Windows\SysWOW64\Oqibjq32.exeC:\Windows\system32\Oqibjq32.exe65⤵PID:2224
-
C:\Windows\SysWOW64\Pbjoaibo.exeC:\Windows\system32\Pbjoaibo.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1328 -
C:\Windows\SysWOW64\Pmpcoabe.exeC:\Windows\system32\Pmpcoabe.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1016 -
C:\Windows\SysWOW64\Ponokmah.exeC:\Windows\system32\Ponokmah.exe68⤵PID:2304
-
C:\Windows\SysWOW64\Pfhghgie.exeC:\Windows\system32\Pfhghgie.exe69⤵
- Modifies registry class
PID:1668 -
C:\Windows\SysWOW64\Pdkgcd32.exeC:\Windows\system32\Pdkgcd32.exe70⤵PID:2792
-
C:\Windows\SysWOW64\Pmbpda32.exeC:\Windows\system32\Pmbpda32.exe71⤵PID:2488
-
C:\Windows\SysWOW64\Pkeppngm.exeC:\Windows\system32\Pkeppngm.exe72⤵
- Modifies registry class
PID:2540 -
C:\Windows\SysWOW64\Piipibff.exeC:\Windows\system32\Piipibff.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2404 -
C:\Windows\SysWOW64\Pneiaidn.exeC:\Windows\system32\Pneiaidn.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1060 -
C:\Windows\SysWOW64\Pnhegi32.exeC:\Windows\system32\Pnhegi32.exe75⤵
- Modifies registry class
PID:756 -
C:\Windows\SysWOW64\Qahnid32.exeC:\Windows\system32\Qahnid32.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:568 -
C:\Windows\SysWOW64\Apphpp32.exeC:\Windows\system32\Apphpp32.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:1584 -
C:\Windows\SysWOW64\Acldpojj.exeC:\Windows\system32\Acldpojj.exe78⤵PID:2588
-
C:\Windows\SysWOW64\Apbeeppo.exeC:\Windows\system32\Apbeeppo.exe79⤵
- Modifies registry class
PID:1816 -
C:\Windows\SysWOW64\Aflmbj32.exeC:\Windows\system32\Aflmbj32.exe80⤵PID:2952
-
C:\Windows\SysWOW64\Amfeodoh.exeC:\Windows\system32\Amfeodoh.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2344 -
C:\Windows\SysWOW64\Angafl32.exeC:\Windows\system32\Angafl32.exe82⤵PID:1184
-
C:\Windows\SysWOW64\Aeajcf32.exeC:\Windows\system32\Aeajcf32.exe83⤵
- Drops file in System32 directory
PID:3044 -
C:\Windows\SysWOW64\Allbpqcp.exeC:\Windows\system32\Allbpqcp.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1260 -
C:\Windows\SysWOW64\Ahbcda32.exeC:\Windows\system32\Ahbcda32.exe85⤵PID:1244
-
C:\Windows\SysWOW64\Ajqoqm32.exeC:\Windows\system32\Ajqoqm32.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1380 -
C:\Windows\SysWOW64\Blplkp32.exeC:\Windows\system32\Blplkp32.exe87⤵
- Modifies registry class
PID:1288 -
C:\Windows\SysWOW64\Bpbadcbj.exeC:\Windows\system32\Bpbadcbj.exe88⤵
- Drops file in System32 directory
- Modifies registry class
PID:2876 -
C:\Windows\SysWOW64\Bfliqmjg.exeC:\Windows\system32\Bfliqmjg.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2884 -
C:\Windows\SysWOW64\Bikemiik.exeC:\Windows\system32\Bikemiik.exe90⤵PID:2020
-
C:\Windows\SysWOW64\Bdpjjaiq.exeC:\Windows\system32\Bdpjjaiq.exe91⤵
- Drops file in System32 directory
- Modifies registry class
PID:872 -
C:\Windows\SysWOW64\Bkjbgk32.exeC:\Windows\system32\Bkjbgk32.exe92⤵PID:868
-
C:\Windows\SysWOW64\Bgablmfa.exeC:\Windows\system32\Bgablmfa.exe93⤵
- Drops file in System32 directory
- Modifies registry class
PID:3068 -
C:\Windows\SysWOW64\Clnkdc32.exeC:\Windows\system32\Clnkdc32.exe94⤵PID:2492
-
C:\Windows\SysWOW64\Cgcoal32.exeC:\Windows\system32\Cgcoal32.exe95⤵
- Modifies registry class
PID:2516 -
C:\Windows\SysWOW64\Cialng32.exeC:\Windows\system32\Cialng32.exe96⤵
- Drops file in System32 directory
PID:2544 -
C:\Windows\SysWOW64\Condfo32.exeC:\Windows\system32\Condfo32.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2896 -
C:\Windows\SysWOW64\Cidhcg32.exeC:\Windows\system32\Cidhcg32.exe98⤵PID:2204
-
C:\Windows\SysWOW64\Ckeekp32.exeC:\Windows\system32\Ckeekp32.exe99⤵PID:2376
-
C:\Windows\SysWOW64\Cclmlm32.exeC:\Windows\system32\Cclmlm32.exe100⤵
- Modifies registry class
PID:2296 -
C:\Windows\SysWOW64\Caajmilh.exeC:\Windows\system32\Caajmilh.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:876 -
C:\Windows\SysWOW64\Dklkkoqf.exeC:\Windows\system32\Dklkkoqf.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2044 -
C:\Windows\SysWOW64\Dddodd32.exeC:\Windows\system32\Dddodd32.exe103⤵
- Drops file in System32 directory
PID:420 -
C:\Windows\SysWOW64\Dgclpp32.exeC:\Windows\system32\Dgclpp32.exe104⤵
- Modifies registry class
PID:960 -
C:\Windows\SysWOW64\Lkhfhaea.exeC:\Windows\system32\Lkhfhaea.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1020 -
C:\Windows\SysWOW64\Jeahpa32.exeC:\Windows\system32\Jeahpa32.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1500 -
C:\Windows\SysWOW64\Bdekjg32.exeC:\Windows\system32\Bdekjg32.exe107⤵PID:2360
-
C:\Windows\SysWOW64\Bllcke32.exeC:\Windows\system32\Bllcke32.exe108⤵PID:2108
-
C:\Windows\SysWOW64\Bojogp32.exeC:\Windows\system32\Bojogp32.exe109⤵PID:1440
-
C:\Windows\SysWOW64\Bnmpcmpi.exeC:\Windows\system32\Bnmpcmpi.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2008 -
C:\Windows\SysWOW64\Bfdhdj32.exeC:\Windows\system32\Bfdhdj32.exe111⤵
- Drops file in System32 directory
PID:2416 -
C:\Windows\SysWOW64\Bgedlbfj.exeC:\Windows\system32\Bgedlbfj.exe112⤵PID:2412
-
C:\Windows\SysWOW64\Bnplhm32.exeC:\Windows\system32\Bnplhm32.exe113⤵PID:108
-
C:\Windows\SysWOW64\Bdidegec.exeC:\Windows\system32\Bdidegec.exe114⤵
- Modifies registry class
PID:2632 -
C:\Windows\SysWOW64\Bkcmba32.exeC:\Windows\system32\Bkcmba32.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2548 -
C:\Windows\SysWOW64\Bqpejh32.exeC:\Windows\system32\Bqpejh32.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:768 -
C:\Windows\SysWOW64\Bjhjcm32.exeC:\Windows\system32\Bjhjcm32.exe117⤵PID:2820
-
C:\Windows\SysWOW64\Bmgfoi32.exeC:\Windows\system32\Bmgfoi32.exe118⤵PID:2848
-
C:\Windows\SysWOW64\Bcanlcgi.exeC:\Windows\system32\Bcanlcgi.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:936 -
C:\Windows\SysWOW64\Bgmjla32.exeC:\Windows\system32\Bgmjla32.exe120⤵
- Modifies registry class
PID:2724 -
C:\Windows\SysWOW64\Cmibdh32.exeC:\Windows\system32\Cmibdh32.exe121⤵PID:1688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-