Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
188s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2023, 14:55
Behavioral task
behavioral1
Sample
NEAS.b196794d2651ad09ba8ccb6ad6d024cf.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.b196794d2651ad09ba8ccb6ad6d024cf.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.b196794d2651ad09ba8ccb6ad6d024cf.exe
-
Size
416KB
-
MD5
b196794d2651ad09ba8ccb6ad6d024cf
-
SHA1
856e561b86a6fdfbd3ddcc7713175465c19f0dea
-
SHA256
e27bbc244dd8ee895b46767eab2f67a3c930963a4062dff393773b78555946f2
-
SHA512
eb731b5a3fdb9fb07875335d6766453b1b9c58bccd5669d987a7f213b94a87598d732ef904763c44f6d62cc18694c3c47003585c9832749b60300d894c97878c
-
SSDEEP
12288:qFH83KyYJ07kE0KoFtw2gu9RxrBIUbPLwH96/I0lOZ0vbqFB:qSBYJ07kE0KoFtw2gu9RxrBIUbPLwH9n
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lemjlcgo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mebchf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddifaqcn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pqhammje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ocamcc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdjpff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mlmbofdh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oondhocf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjadck32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdicdi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Adanbffk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eejjdb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lemjlcgo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Daiegp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gbmigm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ikfgeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gfeahffl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pqhammje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ikcmklih.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpdlajfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Njekfenc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ejofacfb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ikcmklih.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahnghafl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gmndjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dojgnpke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jookdcie.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nipedokm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eiokbd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdhmjc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nipedokm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gbqlhfgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Holfhfij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aomipkic.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ffjignde.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hdlphjaf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Liqibm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckjbbbga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dooaip32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ocgbej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pcncjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bodfkpfg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdbheajp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Djbpjl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amjjcf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfhhho32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Meqmmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lmaafcml.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahofidlb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gngnjk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpkllo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Magnbnea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gdobgp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eiokbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ajqgbjoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mlooef32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aafefq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bhkfdcbd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cabfagee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mplapkoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Edqdij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aebhaede.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmndjf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmbmefob.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0007000000022ccb-6.dat family_berbew behavioral2/files/0x0007000000022ccb-8.dat family_berbew behavioral2/files/0x0007000000022cce-14.dat family_berbew behavioral2/files/0x0007000000022cce-16.dat family_berbew behavioral2/files/0x0008000000022cd3-22.dat family_berbew behavioral2/files/0x0008000000022cd3-24.dat family_berbew behavioral2/files/0x0007000000022cd5-30.dat family_berbew behavioral2/files/0x0007000000022cd5-32.dat family_berbew behavioral2/files/0x000a000000022cd7-38.dat family_berbew behavioral2/files/0x000a000000022cd7-40.dat family_berbew behavioral2/files/0x0008000000022cda-41.dat family_berbew behavioral2/files/0x0008000000022cda-46.dat family_berbew behavioral2/files/0x0008000000022cda-48.dat family_berbew behavioral2/files/0x0007000000022ce1-54.dat family_berbew behavioral2/files/0x0007000000022ce1-56.dat family_berbew behavioral2/files/0x0007000000022ce3-62.dat family_berbew behavioral2/files/0x0007000000022ce3-64.dat family_berbew behavioral2/files/0x0007000000022ce5-70.dat family_berbew behavioral2/files/0x0007000000022ce5-71.dat family_berbew behavioral2/files/0x0006000000022cec-86.dat family_berbew behavioral2/files/0x0006000000022cec-87.dat family_berbew behavioral2/files/0x0006000000022cea-79.dat family_berbew behavioral2/files/0x0006000000022cea-78.dat family_berbew behavioral2/files/0x0006000000022cee-94.dat family_berbew behavioral2/files/0x0006000000022cee-95.dat family_berbew behavioral2/files/0x0006000000022cf0-102.dat family_berbew behavioral2/files/0x0006000000022cf0-103.dat family_berbew behavioral2/files/0x0006000000022cf2-110.dat family_berbew behavioral2/files/0x0006000000022cf2-112.dat family_berbew behavioral2/files/0x0006000000022cf4-113.dat family_berbew behavioral2/files/0x0006000000022cf4-118.dat family_berbew behavioral2/files/0x0006000000022cf4-119.dat family_berbew behavioral2/files/0x0006000000022cf6-126.dat family_berbew behavioral2/files/0x0006000000022cf6-128.dat family_berbew behavioral2/files/0x0006000000022cf8-129.dat family_berbew behavioral2/files/0x0006000000022cf8-134.dat family_berbew behavioral2/files/0x0006000000022cf8-136.dat family_berbew behavioral2/files/0x0006000000022cfa-142.dat family_berbew behavioral2/files/0x0006000000022cfa-143.dat family_berbew behavioral2/files/0x0006000000022cfc-151.dat family_berbew behavioral2/files/0x0006000000022cfc-150.dat family_berbew behavioral2/files/0x0006000000022cfe-158.dat family_berbew behavioral2/files/0x0006000000022cfe-160.dat family_berbew behavioral2/files/0x0006000000022d00-161.dat family_berbew behavioral2/files/0x0006000000022d00-166.dat family_berbew behavioral2/files/0x0006000000022d00-168.dat family_berbew behavioral2/files/0x0006000000022d02-174.dat family_berbew behavioral2/files/0x0006000000022d02-176.dat family_berbew behavioral2/files/0x0006000000022d04-177.dat family_berbew behavioral2/files/0x0006000000022d04-182.dat family_berbew behavioral2/files/0x0006000000022d04-183.dat family_berbew behavioral2/files/0x0006000000022d06-190.dat family_berbew behavioral2/files/0x0006000000022d06-192.dat family_berbew behavioral2/files/0x0006000000022d08-198.dat family_berbew behavioral2/files/0x0006000000022d08-200.dat family_berbew behavioral2/files/0x0006000000022d0a-202.dat family_berbew behavioral2/files/0x0006000000022d0a-206.dat family_berbew behavioral2/files/0x0006000000022d0a-207.dat family_berbew behavioral2/files/0x0006000000022d0c-214.dat family_berbew behavioral2/files/0x0006000000022d0c-215.dat family_berbew behavioral2/files/0x0006000000022d0e-222.dat family_berbew behavioral2/files/0x0006000000022d0e-223.dat family_berbew behavioral2/files/0x0006000000022d10-230.dat family_berbew behavioral2/files/0x0006000000022d10-232.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 4120 Ipkneh32.exe 2380 Mgfqgkib.exe 2152 Ojcidelf.exe 3264 Odhman32.exe 3828 Pqhammje.exe 1424 Pcncjh32.exe 3996 Afcffb32.exe 5064 Acnlqe32.exe 4716 Bnmcdm32.exe 3940 Bfhhho32.exe 4376 Chhdbb32.exe 1248 Cmdmki32.exe 2508 Cabfagee.exe 4584 Djbpjl32.exe 1356 Ehappnjj.exe 1144 Eejjdb32.exe 2104 Ggnlhgkg.exe 2084 Hffbfn32.exe 800 Hdlphjaf.exe 3036 Iiqooh32.exe 224 Jigdoglm.exe 4324 Jgdhab32.exe 548 Lemjlcgo.exe 3500 Mplapkoj.exe 4772 Nipedokm.exe 1516 Ocamcc32.exe 3200 Pebfen32.exe 3344 Phcogice.exe 4344 Amjjcf32.exe 3364 Ajqgbjoh.exe 4232 Bodfkpfg.exe 444 Bpkllo32.exe 4968 Daiegp32.exe 2060 Diicfa32.exe 1096 Djhpqdlj.exe 1904 Edqdij32.exe 2344 Ejofacfb.exe 384 Eplnijdj.exe 4412 Gdjpff32.exe 3428 Gngnjk32.exe 2860 Hhoomd32.exe 2368 Hkbddo32.exe 2092 Igbhpned.exe 2736 Ikcmklih.exe 2208 Jbobnf32.exe 4512 Jkjclk32.exe 3340 Jdbheajp.exe 712 Kqkeoama.exe 1224 Kabkpqgj.exe 4940 Kaehepeg.exe 2220 Liqibm32.exe 1776 Lnbkeclf.exe 4736 Meqmmm32.exe 4212 Magnbnea.exe 2264 Mlmbofdh.exe 4780 Mlooef32.exe 1396 Malgmm32.exe 2708 Nlbkjf32.exe 1128 Nldhpeop.exe 1460 Oondhocf.exe 2980 Oaajoj32.exe 1544 Qlggcp32.exe 4504 Ahnghafl.exe 4408 Aebhaede.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Jgdhab32.exe Jigdoglm.exe File opened for modification C:\Windows\SysWOW64\Gngnjk32.exe Gdjpff32.exe File created C:\Windows\SysWOW64\Hbnbgcei.dll Hkmdoi32.exe File created C:\Windows\SysWOW64\Emldhb32.exe Eiokbd32.exe File created C:\Windows\SysWOW64\Doojni32.exe Ddifaqcn.exe File created C:\Windows\SysWOW64\Kabkpqgj.exe Kqkeoama.exe File opened for modification C:\Windows\SysWOW64\Aomipkic.exe Aebhaede.exe File opened for modification C:\Windows\SysWOW64\Hkmdoi32.exe Hlldaape.exe File created C:\Windows\SysWOW64\Njekfenc.exe Nnojad32.exe File created C:\Windows\SysWOW64\Chhdbb32.exe Bfhhho32.exe File created C:\Windows\SysWOW64\Jgdhab32.exe Jigdoglm.exe File created C:\Windows\SysWOW64\Gkjcegnh.dll Nldhpeop.exe File opened for modification C:\Windows\SysWOW64\Hpdlajfe.exe Geohdago.exe File created C:\Windows\SysWOW64\Ohbfgkan.dll Phcogice.exe File created C:\Windows\SysWOW64\Diicfa32.exe Daiegp32.exe File created C:\Windows\SysWOW64\Igpdph32.exe Ikfgeh32.exe File created C:\Windows\SysWOW64\Ocgbej32.exe Ommjipel.exe File created C:\Windows\SysWOW64\Mafbec32.dll Jigdoglm.exe File created C:\Windows\SysWOW64\Ejofacfb.exe Edqdij32.exe File created C:\Windows\SysWOW64\Nfefikjj.dll Mlooef32.exe File created C:\Windows\SysWOW64\Qlggcp32.exe Oaajoj32.exe File opened for modification C:\Windows\SysWOW64\Hffbfn32.exe Ggnlhgkg.exe File opened for modification C:\Windows\SysWOW64\Pebfen32.exe Ocamcc32.exe File created C:\Windows\SysWOW64\Gbmigm32.exe Glbakchp.exe File created C:\Windows\SysWOW64\Hpogkd32.dll Gbmigm32.exe File created C:\Windows\SysWOW64\Kaodfjon.dll Eejjdb32.exe File opened for modification C:\Windows\SysWOW64\Blhpjnbe.exe Aomipkic.exe File opened for modification C:\Windows\SysWOW64\Fmikoggm.exe Fdnipbbo.exe File opened for modification C:\Windows\SysWOW64\Gbmigm32.exe Glbakchp.exe File created C:\Windows\SysWOW64\Hpdlajfe.exe Geohdago.exe File opened for modification C:\Windows\SysWOW64\Lnendhol.exe Kfgpblda.exe File created C:\Windows\SysWOW64\Dqlodlcc.dll Lemjlcgo.exe File created C:\Windows\SysWOW64\Kqkeoama.exe Jdbheajp.exe File created C:\Windows\SysWOW64\Hiajeoip.exe Holfhfij.exe File created C:\Windows\SysWOW64\Kfgpblda.exe Jenmlmll.exe File created C:\Windows\SysWOW64\Eplnijdj.exe Ejofacfb.exe File created C:\Windows\SysWOW64\Kaehepeg.exe Kabkpqgj.exe File created C:\Windows\SysWOW64\Aomipkic.exe Aebhaede.exe File created C:\Windows\SysWOW64\Dmjefkap.exe Codhgg32.exe File opened for modification C:\Windows\SysWOW64\Gjadck32.exe Gmndjf32.exe File created C:\Windows\SysWOW64\Ggnlhgkg.exe Eejjdb32.exe File created C:\Windows\SysWOW64\Kqlbncjp.dll Edqdij32.exe File opened for modification C:\Windows\SysWOW64\Dmjefkap.exe Codhgg32.exe File created C:\Windows\SysWOW64\Nakgck32.dll Hfhgdc32.exe File created C:\Windows\SysWOW64\Ddifaqcn.exe Ddbppa32.exe File created C:\Windows\SysWOW64\Bgjoghhk.dll Glbakchp.exe File created C:\Windows\SysWOW64\Gfeahffl.exe Gpkiklop.exe File created C:\Windows\SysWOW64\Eaeboq32.dll Hpdlajfe.exe File opened for modification C:\Windows\SysWOW64\Ilglbjbl.exe Ipplmh32.exe File created C:\Windows\SysWOW64\Oafido32.exe Njekfenc.exe File created C:\Windows\SysWOW64\Mghkbhfa.dll Doojni32.exe File created C:\Windows\SysWOW64\Elpknehe.exe Dfjpppbh.exe File created C:\Windows\SysWOW64\Dojgnpke.exe Dfbcek32.exe File opened for modification C:\Windows\SysWOW64\Bodfkpfg.exe Ajqgbjoh.exe File created C:\Windows\SysWOW64\Gmndjf32.exe Ffclml32.exe File created C:\Windows\SysWOW64\Cdicdi32.exe Aafefq32.exe File created C:\Windows\SysWOW64\Jeeded32.dll Cdhmjc32.exe File created C:\Windows\SysWOW64\Gdjpff32.exe Eplnijdj.exe File created C:\Windows\SysWOW64\Qfpkjjaa.dll Malgmm32.exe File created C:\Windows\SysWOW64\Pieloojf.dll Jenmlmll.exe File opened for modification C:\Windows\SysWOW64\Cmdmki32.exe Chhdbb32.exe File opened for modification C:\Windows\SysWOW64\Lemjlcgo.exe Jgdhab32.exe File created C:\Windows\SysWOW64\Aajcnkmk.dll Eoccii32.exe File created C:\Windows\SysWOW64\Djhpqdlj.exe Diicfa32.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 2332 3444 WerFault.exe 253 4676 3444 WerFault.exe 253 -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jibapflb.dll" Hhoomd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dfcjoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Picfjl32.dll" Eiokbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Albipmnm.dll" Ejofacfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qhjiao32.dll" Acnlqe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Deliaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lnendhol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idhdieal.dll" Njekfenc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Liqibm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njomfedn.dll" Dojgnpke.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Apcemh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jdbheajp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Blhpjnbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Glbakchp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckifpg32.dll" Cdicdi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ojcidelf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bodfkpfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkhbaj32.dll" Kqknekjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Geohdago.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eaeboq32.dll" Hpdlajfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lookln32.dll" Ipkneh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fmikoggm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehgjinca.dll" Giinjg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cabfagee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hdlphjaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ajqgbjoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oggepi32.dll" Ilglbjbl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lemjlcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqlbncjp.dll" Edqdij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Adanbffk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pndhqb32.dll" Dfglpjqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qqhegnhh.dll" Kfgpblda.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oddeop32.dll" Bpkllo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Aebhaede.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekkmhd32.dll" Fdnipbbo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gdobgp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ddbfkh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Polbgh32.dll" Ddbfkh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hbeece32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fmikoggm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hbeece32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lnendhol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jgdhab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hlldaape.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Eiokbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ebocpd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kohhopdk.dll" Aebhaede.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dfcjoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inckcj32.dll" Jkbfafel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eijgnnhg.dll" Hbeece32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dmjefkap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kgefae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gfeahffl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fflngpbn.dll" Bhkfdcbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egkkpjcf.dll" Hkbddo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfefikjj.dll" Mlooef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mebchf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hlbcgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpgdiine.dll" Dfbcek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfhkolhc.dll" Adanbffk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID NEAS.b196794d2651ad09ba8ccb6ad6d024cf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pqhammje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbaihddp.dll" Eplnijdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cinbhb32.dll" Gmndjf32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2896 wrote to memory of 4120 2896 NEAS.b196794d2651ad09ba8ccb6ad6d024cf.exe 94 PID 2896 wrote to memory of 4120 2896 NEAS.b196794d2651ad09ba8ccb6ad6d024cf.exe 94 PID 2896 wrote to memory of 4120 2896 NEAS.b196794d2651ad09ba8ccb6ad6d024cf.exe 94 PID 4120 wrote to memory of 2380 4120 Ipkneh32.exe 95 PID 4120 wrote to memory of 2380 4120 Ipkneh32.exe 95 PID 4120 wrote to memory of 2380 4120 Ipkneh32.exe 95 PID 2380 wrote to memory of 2152 2380 Mgfqgkib.exe 96 PID 2380 wrote to memory of 2152 2380 Mgfqgkib.exe 96 PID 2380 wrote to memory of 2152 2380 Mgfqgkib.exe 96 PID 2152 wrote to memory of 3264 2152 Ojcidelf.exe 97 PID 2152 wrote to memory of 3264 2152 Ojcidelf.exe 97 PID 2152 wrote to memory of 3264 2152 Ojcidelf.exe 97 PID 3264 wrote to memory of 3828 3264 Odhman32.exe 98 PID 3264 wrote to memory of 3828 3264 Odhman32.exe 98 PID 3264 wrote to memory of 3828 3264 Odhman32.exe 98 PID 3828 wrote to memory of 1424 3828 Pqhammje.exe 99 PID 3828 wrote to memory of 1424 3828 Pqhammje.exe 99 PID 3828 wrote to memory of 1424 3828 Pqhammje.exe 99 PID 1424 wrote to memory of 3996 1424 Pcncjh32.exe 100 PID 1424 wrote to memory of 3996 1424 Pcncjh32.exe 100 PID 1424 wrote to memory of 3996 1424 Pcncjh32.exe 100 PID 3996 wrote to memory of 5064 3996 Afcffb32.exe 101 PID 3996 wrote to memory of 5064 3996 Afcffb32.exe 101 PID 3996 wrote to memory of 5064 3996 Afcffb32.exe 101 PID 5064 wrote to memory of 4716 5064 Acnlqe32.exe 102 PID 5064 wrote to memory of 4716 5064 Acnlqe32.exe 102 PID 5064 wrote to memory of 4716 5064 Acnlqe32.exe 102 PID 4716 wrote to memory of 3940 4716 Bnmcdm32.exe 103 PID 4716 wrote to memory of 3940 4716 Bnmcdm32.exe 103 PID 4716 wrote to memory of 3940 4716 Bnmcdm32.exe 103 PID 3940 wrote to memory of 4376 3940 Bfhhho32.exe 104 PID 3940 wrote to memory of 4376 3940 Bfhhho32.exe 104 PID 3940 wrote to memory of 4376 3940 Bfhhho32.exe 104 PID 4376 wrote to memory of 1248 4376 Chhdbb32.exe 105 PID 4376 wrote to memory of 1248 4376 Chhdbb32.exe 105 PID 4376 wrote to memory of 1248 4376 Chhdbb32.exe 105 PID 1248 wrote to memory of 2508 1248 Cmdmki32.exe 106 PID 1248 wrote to memory of 2508 1248 Cmdmki32.exe 106 PID 1248 wrote to memory of 2508 1248 Cmdmki32.exe 106 PID 2508 wrote to memory of 4584 2508 Cabfagee.exe 107 PID 2508 wrote to memory of 4584 2508 Cabfagee.exe 107 PID 2508 wrote to memory of 4584 2508 Cabfagee.exe 107 PID 4584 wrote to memory of 1356 4584 Djbpjl32.exe 108 PID 4584 wrote to memory of 1356 4584 Djbpjl32.exe 108 PID 4584 wrote to memory of 1356 4584 Djbpjl32.exe 108 PID 1356 wrote to memory of 1144 1356 Ehappnjj.exe 109 PID 1356 wrote to memory of 1144 1356 Ehappnjj.exe 109 PID 1356 wrote to memory of 1144 1356 Ehappnjj.exe 109 PID 1144 wrote to memory of 2104 1144 Eejjdb32.exe 110 PID 1144 wrote to memory of 2104 1144 Eejjdb32.exe 110 PID 1144 wrote to memory of 2104 1144 Eejjdb32.exe 110 PID 2104 wrote to memory of 2084 2104 Ggnlhgkg.exe 111 PID 2104 wrote to memory of 2084 2104 Ggnlhgkg.exe 111 PID 2104 wrote to memory of 2084 2104 Ggnlhgkg.exe 111 PID 2084 wrote to memory of 800 2084 Hffbfn32.exe 112 PID 2084 wrote to memory of 800 2084 Hffbfn32.exe 112 PID 2084 wrote to memory of 800 2084 Hffbfn32.exe 112 PID 800 wrote to memory of 3036 800 Hdlphjaf.exe 113 PID 800 wrote to memory of 3036 800 Hdlphjaf.exe 113 PID 800 wrote to memory of 3036 800 Hdlphjaf.exe 113 PID 3036 wrote to memory of 224 3036 Iiqooh32.exe 114 PID 3036 wrote to memory of 224 3036 Iiqooh32.exe 114 PID 3036 wrote to memory of 224 3036 Iiqooh32.exe 114 PID 224 wrote to memory of 4324 224 Jigdoglm.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.b196794d2651ad09ba8ccb6ad6d024cf.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.b196794d2651ad09ba8ccb6ad6d024cf.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\Ipkneh32.exeC:\Windows\system32\Ipkneh32.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\Mgfqgkib.exeC:\Windows\system32\Mgfqgkib.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\Ojcidelf.exeC:\Windows\system32\Ojcidelf.exe4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\Odhman32.exeC:\Windows\system32\Odhman32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\Pqhammje.exeC:\Windows\system32\Pqhammje.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\Pcncjh32.exeC:\Windows\system32\Pcncjh32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\Afcffb32.exeC:\Windows\system32\Afcffb32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\Acnlqe32.exeC:\Windows\system32\Acnlqe32.exe9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\Bnmcdm32.exeC:\Windows\system32\Bnmcdm32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\Bfhhho32.exeC:\Windows\system32\Bfhhho32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\Chhdbb32.exeC:\Windows\system32\Chhdbb32.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\Cmdmki32.exeC:\Windows\system32\Cmdmki32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\Cabfagee.exeC:\Windows\system32\Cabfagee.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\Djbpjl32.exeC:\Windows\system32\Djbpjl32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\Ehappnjj.exeC:\Windows\system32\Ehappnjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\Eejjdb32.exeC:\Windows\system32\Eejjdb32.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\Ggnlhgkg.exeC:\Windows\system32\Ggnlhgkg.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\Hffbfn32.exeC:\Windows\system32\Hffbfn32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\Hdlphjaf.exeC:\Windows\system32\Hdlphjaf.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\Iiqooh32.exeC:\Windows\system32\Iiqooh32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\Jigdoglm.exeC:\Windows\system32\Jigdoglm.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\Jgdhab32.exeC:\Windows\system32\Jgdhab32.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4324 -
C:\Windows\SysWOW64\Lemjlcgo.exeC:\Windows\system32\Lemjlcgo.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:548 -
C:\Windows\SysWOW64\Mplapkoj.exeC:\Windows\system32\Mplapkoj.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3500 -
C:\Windows\SysWOW64\Nipedokm.exeC:\Windows\system32\Nipedokm.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4772 -
C:\Windows\SysWOW64\Ocamcc32.exeC:\Windows\system32\Ocamcc32.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1516 -
C:\Windows\SysWOW64\Pebfen32.exeC:\Windows\system32\Pebfen32.exe28⤵
- Executes dropped EXE
PID:3200 -
C:\Windows\SysWOW64\Phcogice.exeC:\Windows\system32\Phcogice.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3344 -
C:\Windows\SysWOW64\Amjjcf32.exeC:\Windows\system32\Amjjcf32.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4344 -
C:\Windows\SysWOW64\Ajqgbjoh.exeC:\Windows\system32\Ajqgbjoh.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3364 -
C:\Windows\SysWOW64\Bodfkpfg.exeC:\Windows\system32\Bodfkpfg.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:4232 -
C:\Windows\SysWOW64\Bpkllo32.exeC:\Windows\system32\Bpkllo32.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:444 -
C:\Windows\SysWOW64\Daiegp32.exeC:\Windows\system32\Daiegp32.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:4968 -
C:\Windows\SysWOW64\Diicfa32.exeC:\Windows\system32\Diicfa32.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2060 -
C:\Windows\SysWOW64\Djhpqdlj.exeC:\Windows\system32\Djhpqdlj.exe36⤵
- Executes dropped EXE
PID:1096 -
C:\Windows\SysWOW64\Edqdij32.exeC:\Windows\system32\Edqdij32.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1904 -
C:\Windows\SysWOW64\Ejofacfb.exeC:\Windows\system32\Ejofacfb.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2344 -
C:\Windows\SysWOW64\Eplnijdj.exeC:\Windows\system32\Eplnijdj.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:384 -
C:\Windows\SysWOW64\Gdjpff32.exeC:\Windows\system32\Gdjpff32.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:4412 -
C:\Windows\SysWOW64\Gngnjk32.exeC:\Windows\system32\Gngnjk32.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3428 -
C:\Windows\SysWOW64\Hhoomd32.exeC:\Windows\system32\Hhoomd32.exe42⤵
- Executes dropped EXE
- Modifies registry class
PID:2860 -
C:\Windows\SysWOW64\Hkbddo32.exeC:\Windows\system32\Hkbddo32.exe43⤵
- Executes dropped EXE
- Modifies registry class
PID:2368 -
C:\Windows\SysWOW64\Igbhpned.exeC:\Windows\system32\Igbhpned.exe44⤵
- Executes dropped EXE
PID:2092 -
C:\Windows\SysWOW64\Ikcmklih.exeC:\Windows\system32\Ikcmklih.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2736 -
C:\Windows\SysWOW64\Jbobnf32.exeC:\Windows\system32\Jbobnf32.exe46⤵
- Executes dropped EXE
PID:2208 -
C:\Windows\SysWOW64\Jkjclk32.exeC:\Windows\system32\Jkjclk32.exe47⤵
- Executes dropped EXE
PID:4512 -
C:\Windows\SysWOW64\Jdbheajp.exeC:\Windows\system32\Jdbheajp.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3340 -
C:\Windows\SysWOW64\Kqkeoama.exeC:\Windows\system32\Kqkeoama.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:712 -
C:\Windows\SysWOW64\Kabkpqgj.exeC:\Windows\system32\Kabkpqgj.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1224 -
C:\Windows\SysWOW64\Kaehepeg.exeC:\Windows\system32\Kaehepeg.exe51⤵
- Executes dropped EXE
PID:4940 -
C:\Windows\SysWOW64\Liqibm32.exeC:\Windows\system32\Liqibm32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2220 -
C:\Windows\SysWOW64\Lnbkeclf.exeC:\Windows\system32\Lnbkeclf.exe53⤵
- Executes dropped EXE
PID:1776 -
C:\Windows\SysWOW64\Meqmmm32.exeC:\Windows\system32\Meqmmm32.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4736 -
C:\Windows\SysWOW64\Magnbnea.exeC:\Windows\system32\Magnbnea.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4212 -
C:\Windows\SysWOW64\Mlmbofdh.exeC:\Windows\system32\Mlmbofdh.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2264 -
C:\Windows\SysWOW64\Mlooef32.exeC:\Windows\system32\Mlooef32.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4780 -
C:\Windows\SysWOW64\Malgmm32.exeC:\Windows\system32\Malgmm32.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1396 -
C:\Windows\SysWOW64\Nlbkjf32.exeC:\Windows\system32\Nlbkjf32.exe59⤵
- Executes dropped EXE
PID:2708 -
C:\Windows\SysWOW64\Nldhpeop.exeC:\Windows\system32\Nldhpeop.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1128 -
C:\Windows\SysWOW64\Oondhocf.exeC:\Windows\system32\Oondhocf.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1460 -
C:\Windows\SysWOW64\Oaajoj32.exeC:\Windows\system32\Oaajoj32.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2980 -
C:\Windows\SysWOW64\Qlggcp32.exeC:\Windows\system32\Qlggcp32.exe63⤵
- Executes dropped EXE
PID:1544 -
C:\Windows\SysWOW64\Ahnghafl.exeC:\Windows\system32\Ahnghafl.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4504 -
C:\Windows\SysWOW64\Aebhaede.exeC:\Windows\system32\Aebhaede.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4408 -
C:\Windows\SysWOW64\Aomipkic.exeC:\Windows\system32\Aomipkic.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1472 -
C:\Windows\SysWOW64\Blhpjnbe.exeC:\Windows\system32\Blhpjnbe.exe67⤵
- Modifies registry class
PID:4532 -
C:\Windows\SysWOW64\Bicjjncd.exeC:\Windows\system32\Bicjjncd.exe68⤵PID:2968
-
C:\Windows\SysWOW64\Codhgg32.exeC:\Windows\system32\Codhgg32.exe69⤵
- Drops file in System32 directory
PID:5060 -
C:\Windows\SysWOW64\Dmjefkap.exeC:\Windows\system32\Dmjefkap.exe70⤵
- Modifies registry class
PID:4688 -
C:\Windows\SysWOW64\Dfcjoa32.exeC:\Windows\system32\Dfcjoa32.exe71⤵
- Modifies registry class
PID:1108 -
C:\Windows\SysWOW64\Dfjpppbh.exeC:\Windows\system32\Dfjpppbh.exe72⤵
- Drops file in System32 directory
PID:5292 -
C:\Windows\SysWOW64\Elpknehe.exeC:\Windows\system32\Elpknehe.exe73⤵PID:5336
-
C:\Windows\SysWOW64\Ffjignde.exeC:\Windows\system32\Ffjignde.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5376 -
C:\Windows\SysWOW64\Fdnipbbo.exeC:\Windows\system32\Fdnipbbo.exe75⤵
- Drops file in System32 directory
- Modifies registry class
PID:5432 -
C:\Windows\SysWOW64\Fmikoggm.exeC:\Windows\system32\Fmikoggm.exe76⤵
- Modifies registry class
PID:5472 -
C:\Windows\SysWOW64\Ffclml32.exeC:\Windows\system32\Ffclml32.exe77⤵
- Drops file in System32 directory
PID:5504 -
C:\Windows\SysWOW64\Gmndjf32.exeC:\Windows\system32\Gmndjf32.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:5552 -
C:\Windows\SysWOW64\Gjadck32.exeC:\Windows\system32\Gjadck32.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5588 -
C:\Windows\SysWOW64\Glbakchp.exeC:\Windows\system32\Glbakchp.exe80⤵
- Drops file in System32 directory
- Modifies registry class
PID:5632 -
C:\Windows\SysWOW64\Gbmigm32.exeC:\Windows\system32\Gbmigm32.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5672 -
C:\Windows\SysWOW64\Gmbmefob.exeC:\Windows\system32\Gmbmefob.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5716 -
C:\Windows\SysWOW64\Giinjg32.exeC:\Windows\system32\Giinjg32.exe83⤵
- Modifies registry class
PID:5756 -
C:\Windows\SysWOW64\Gdobgp32.exeC:\Windows\system32\Gdobgp32.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5804 -
C:\Windows\SysWOW64\Hlldaape.exeC:\Windows\system32\Hlldaape.exe85⤵
- Drops file in System32 directory
- Modifies registry class
PID:5848 -
C:\Windows\SysWOW64\Hkmdoi32.exeC:\Windows\system32\Hkmdoi32.exe86⤵
- Drops file in System32 directory
PID:5888 -
C:\Windows\SysWOW64\Hpjlgp32.exeC:\Windows\system32\Hpjlgp32.exe87⤵PID:5936
-
C:\Windows\SysWOW64\Hlcjaq32.exeC:\Windows\system32\Hlcjaq32.exe88⤵PID:5984
-
C:\Windows\SysWOW64\Ikfgeh32.exeC:\Windows\system32\Ikfgeh32.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:6036 -
C:\Windows\SysWOW64\Igpdph32.exeC:\Windows\system32\Igpdph32.exe90⤵PID:6080
-
C:\Windows\SysWOW64\Jkbfafel.exeC:\Windows\system32\Jkbfafel.exe91⤵
- Modifies registry class
PID:6124 -
C:\Windows\SysWOW64\Kqknekjf.exeC:\Windows\system32\Kqknekjf.exe92⤵
- Modifies registry class
PID:1276 -
C:\Windows\SysWOW64\Kgefae32.exeC:\Windows\system32\Kgefae32.exe93⤵
- Modifies registry class
PID:4612 -
C:\Windows\SysWOW64\Lcggbd32.exeC:\Windows\system32\Lcggbd32.exe94⤵PID:5320
-
C:\Windows\SysWOW64\Mebchf32.exeC:\Windows\system32\Mebchf32.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5396 -
C:\Windows\SysWOW64\Onicbi32.exeC:\Windows\system32\Onicbi32.exe96⤵PID:5456
-
C:\Windows\SysWOW64\Aafefq32.exeC:\Windows\system32\Aafefq32.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5540 -
C:\Windows\SysWOW64\Cdicdi32.exeC:\Windows\system32\Cdicdi32.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5624 -
C:\Windows\SysWOW64\Ckjbbbga.exeC:\Windows\system32\Ckjbbbga.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5708 -
C:\Windows\SysWOW64\Ddbfkh32.exeC:\Windows\system32\Ddbfkh32.exe100⤵
- Modifies registry class
PID:5748 -
C:\Windows\SysWOW64\Dfbcek32.exeC:\Windows\system32\Dfbcek32.exe101⤵
- Drops file in System32 directory
- Modifies registry class
PID:5836 -
C:\Windows\SysWOW64\Dojgnpke.exeC:\Windows\system32\Dojgnpke.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5924 -
C:\Windows\SysWOW64\Dfglpjqo.exeC:\Windows\system32\Dfglpjqo.exe103⤵
- Modifies registry class
PID:5964 -
C:\Windows\SysWOW64\Dooaip32.exeC:\Windows\system32\Dooaip32.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3272 -
C:\Windows\SysWOW64\Deliaf32.exeC:\Windows\system32\Deliaf32.exe105⤵
- Modifies registry class
PID:6120 -
C:\Windows\SysWOW64\Eiokbd32.exeC:\Windows\system32\Eiokbd32.exe106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:4536 -
C:\Windows\SysWOW64\Emldhb32.exeC:\Windows\system32\Emldhb32.exe107⤵PID:1752
-
C:\Windows\SysWOW64\Gefencoj.exeC:\Windows\system32\Gefencoj.exe108⤵PID:916
-
C:\Windows\SysWOW64\Gpkiklop.exeC:\Windows\system32\Gpkiklop.exe109⤵
- Drops file in System32 directory
PID:5468 -
C:\Windows\SysWOW64\Gfeahffl.exeC:\Windows\system32\Gfeahffl.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3512 -
C:\Windows\SysWOW64\Gbqlhfgk.exeC:\Windows\system32\Gbqlhfgk.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2896 -
C:\Windows\SysWOW64\Geohdago.exeC:\Windows\system32\Geohdago.exe112⤵
- Drops file in System32 directory
- Modifies registry class
PID:3032 -
C:\Windows\SysWOW64\Hpdlajfe.exeC:\Windows\system32\Hpdlajfe.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:5064 -
C:\Windows\SysWOW64\Hbeece32.exeC:\Windows\system32\Hbeece32.exe114⤵
- Modifies registry class
PID:5608 -
C:\Windows\SysWOW64\Hmkiqn32.exeC:\Windows\system32\Hmkiqn32.exe115⤵PID:5696
-
C:\Windows\SysWOW64\Holfhfij.exeC:\Windows\system32\Holfhfij.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5772 -
C:\Windows\SysWOW64\Hiajeoip.exeC:\Windows\system32\Hiajeoip.exe117⤵PID:5920
-
C:\Windows\SysWOW64\Hoobnf32.exeC:\Windows\system32\Hoobnf32.exe118⤵PID:6020
-
C:\Windows\SysWOW64\Hlbcgj32.exeC:\Windows\system32\Hlbcgj32.exe119⤵
- Modifies registry class
PID:6056 -
C:\Windows\SysWOW64\Hfhgdc32.exeC:\Windows\system32\Hfhgdc32.exe120⤵
- Drops file in System32 directory
PID:4448 -
C:\Windows\SysWOW64\Ipplmh32.exeC:\Windows\system32\Ipplmh32.exe121⤵
- Drops file in System32 directory
PID:2396 -
C:\Windows\SysWOW64\Ilglbjbl.exeC:\Windows\system32\Ilglbjbl.exe122⤵
- Modifies registry class
PID:5372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-