Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
73s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2023, 16:16
Behavioral task
behavioral1
Sample
NEAS.23ca897d7ecc42250619a2097fd017e0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.23ca897d7ecc42250619a2097fd017e0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.23ca897d7ecc42250619a2097fd017e0.exe
-
Size
3.4MB
-
MD5
23ca897d7ecc42250619a2097fd017e0
-
SHA1
e7c40703dffd313ecf6a318172e20de8e7008a62
-
SHA256
9c36fc7bc05eef374ca16879f0ea870ca9d678a9a257c266cc8bedd8b7a7cfc0
-
SHA512
21c8510e22426c0fcb969032c0530094fad5d39e93468eeeef481e2a1aec6c9f9392bdfb14660cc62882c56ce4211db81a26daea340b8ee437df070f5c8d11b2
-
SSDEEP
98304:A5VP91v92W805IPSOdKgzEoxr157JT6zPKnllYUugy:k91v92W805IPSOdKgzEoxr157JT6z6Y
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lgqfdnah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Odmbaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jdhigk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ficlmf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Najceeoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lmaamn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Boihcf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bndjfjhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gbcffk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkmmaeap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Glgjlm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbdehlip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Namnmp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nijqcf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pahpfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nblolm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Adgmoigj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lkppchfi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfbhhfbg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmfbcd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ejdonq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mjdebfnd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qodeajbg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bleebc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Objkmkjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qkakhakq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gpodkdll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnbeeiji.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lnhdbc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Akglloai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hfniikha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ipdndloi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qiiflaoo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mapppn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ockdmmoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ocnampdp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bbdpad32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dfefkkqp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hlcjhkdp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Doqbifpl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjnqap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dbndfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cpacqg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmiqfoie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Djkdnool.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Canocm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ehndnh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fqeioiam.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkofga32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Peahgl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nkpijfgf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgibjj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emoaopnf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ljmmcbdp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glpdjpbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jbkbkbfo.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0007000000022e43-6.dat family_berbew behavioral2/files/0x0007000000022e43-7.dat family_berbew behavioral2/files/0x0006000000022e4d-14.dat family_berbew behavioral2/files/0x0006000000022e4d-15.dat family_berbew behavioral2/files/0x0006000000022e4f-22.dat family_berbew behavioral2/files/0x0006000000022e4f-23.dat family_berbew behavioral2/files/0x0006000000022e51-30.dat family_berbew behavioral2/files/0x0007000000022e47-33.dat family_berbew behavioral2/files/0x0006000000022e51-32.dat family_berbew behavioral2/files/0x0007000000022e47-38.dat family_berbew behavioral2/files/0x0007000000022e47-39.dat family_berbew behavioral2/files/0x0006000000022e56-47.dat family_berbew behavioral2/files/0x0006000000022e56-46.dat family_berbew behavioral2/files/0x0006000000022e58-54.dat family_berbew behavioral2/files/0x0006000000022e5a-63.dat family_berbew behavioral2/files/0x0006000000022e5a-62.dat family_berbew behavioral2/files/0x000c000000022d67-71.dat family_berbew behavioral2/files/0x0006000000022e5d-78.dat family_berbew behavioral2/files/0x0006000000022e5f-87.dat family_berbew behavioral2/files/0x0006000000022e5f-86.dat family_berbew behavioral2/files/0x0006000000022e5d-80.dat family_berbew behavioral2/files/0x000c000000022d67-70.dat family_berbew behavioral2/files/0x0006000000022e58-55.dat family_berbew behavioral2/files/0x0006000000022e61-95.dat family_berbew behavioral2/files/0x000b000000022d65-102.dat family_berbew behavioral2/files/0x000b000000022d65-104.dat family_berbew behavioral2/files/0x0006000000022e61-94.dat family_berbew behavioral2/files/0x0006000000022e62-110.dat family_berbew behavioral2/files/0x0006000000022e62-112.dat family_berbew behavioral2/files/0x0006000000022e64-119.dat family_berbew behavioral2/files/0x0006000000022e64-118.dat family_berbew behavioral2/files/0x0006000000022e66-126.dat family_berbew behavioral2/files/0x0006000000022e66-128.dat family_berbew behavioral2/files/0x0006000000022e68-134.dat family_berbew behavioral2/files/0x0006000000022e68-136.dat family_berbew behavioral2/files/0x0006000000022e6a-137.dat family_berbew behavioral2/files/0x0006000000022e6a-143.dat family_berbew behavioral2/files/0x0006000000022e6a-142.dat family_berbew behavioral2/files/0x0006000000022e6c-151.dat family_berbew behavioral2/files/0x0006000000022e6c-150.dat family_berbew behavioral2/files/0x0006000000022e6e-159.dat family_berbew behavioral2/files/0x0006000000022e6e-158.dat family_berbew behavioral2/files/0x0007000000022e70-161.dat family_berbew behavioral2/files/0x0007000000022e70-167.dat family_berbew behavioral2/files/0x0007000000022e70-166.dat family_berbew behavioral2/files/0x0007000000022e74-174.dat family_berbew behavioral2/files/0x0006000000022e76-183.dat family_berbew behavioral2/files/0x0006000000022e78-184.dat family_berbew behavioral2/files/0x0006000000022e76-182.dat family_berbew behavioral2/files/0x0006000000022e78-192.dat family_berbew behavioral2/files/0x0006000000022e7b-198.dat family_berbew behavioral2/files/0x0006000000022e7d-207.dat family_berbew behavioral2/files/0x0006000000022e7f-215.dat family_berbew behavioral2/files/0x0006000000022e81-223.dat family_berbew behavioral2/files/0x0006000000022e83-230.dat family_berbew behavioral2/files/0x0006000000022e87-246.dat family_berbew behavioral2/files/0x0006000000022e99-298.dat family_berbew behavioral2/files/0x0006000000022e89-255.dat family_berbew behavioral2/files/0x0006000000022e89-254.dat family_berbew behavioral2/files/0x0006000000022e87-247.dat family_berbew behavioral2/files/0x0006000000022e85-239.dat family_berbew behavioral2/files/0x0006000000022e85-236.dat family_berbew behavioral2/files/0x0006000000022e83-229.dat family_berbew behavioral2/files/0x0006000000022e81-222.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 448 Hpfcdojl.exe 2888 Iqipio32.exe 2304 Inomhbeq.exe 4276 Nijqcf32.exe 1668 Jdedak32.exe 5224 Mhldbh32.exe 1664 Kghjhemo.exe 5116 Knflpoqf.exe 2820 Kbddfmgl.exe 5148 Bjhkmbho.exe 3156 Lnnbqnjn.exe 4232 Pqbala32.exe 5792 Bdeiqgkj.exe 3376 Qikbaaml.exe 632 Najceeoo.exe 1800 Objpoh32.exe 2208 Ohiemobf.exe 3888 Pahpfc32.exe 912 Pefhlaie.exe 212 Plejdkmm.exe 1572 Akoqpg32.exe 5948 Cmnnimak.exe 320 Ccblbb32.exe 4164 Cgfbbb32.exe 4636 Bbdhiojo.exe 844 Bkmmaeap.exe 5112 Bhamkipi.exe 5316 Bfgjjm32.exe 1624 backgroundTaskHost.exe 5560 Cihclh32.exe 5300 Cfnqklgh.exe 464 Ccbadp32.exe 1112 Coiaiakf.exe 5244 Dfefkkqp.exe 5072 Dpnkdq32.exe 1000 Dbndfl32.exe 3060 Dmdhcddh.exe 4692 Dbqqkkbo.exe 5024 Dpgnjo32.exe 4992 Elbhjp32.exe 3956 Fpbmfn32.exe 2108 Fmikeaap.exe 400 Fmkgkapm.exe 2264 Glengm32.exe 2556 Glgjlm32.exe 3036 Gfmojenc.exe 1004 Hpjmnjqn.exe 1192 Hgfapd32.exe 5324 Hlcjhkdp.exe 2840 Higjaoci.exe 1916 Hdmoohbo.exe 3740 Hmechmip.exe 2228 Hkicaahi.exe 3044 Igpdfb32.exe 4680 Igbalblk.exe 3752 Leqkeajd.exe 5216 Icnklbmj.exe 952 Jpaleglc.exe 5784 Malefbkc.exe 3948 Jgpmmp32.exe 5240 Jddnfd32.exe 3672 Jlobkg32.exe 1204 Kjccdkki.exe 5156 Kkconn32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Falmlm32.dll Ajaqjfbp.exe File created C:\Windows\SysWOW64\Lomjicei.exe Ledepn32.exe File opened for modification C:\Windows\SysWOW64\Mjpjgj32.exe Fmndkd32.exe File created C:\Windows\SysWOW64\Gaklld32.dll Khfdlnab.exe File created C:\Windows\SysWOW64\Jhijqj32.exe Inomhbeq.exe File opened for modification C:\Windows\SysWOW64\Bkphhgfc.exe Boihcf32.exe File created C:\Windows\SysWOW64\Cdimqm32.exe Bkphhgfc.exe File created C:\Windows\SysWOW64\Papambbb.dll Lcdjba32.exe File opened for modification C:\Windows\SysWOW64\Hifmmb32.exe Hhfpbpdo.exe File opened for modification C:\Windows\SysWOW64\Ledepn32.exe Lllagh32.exe File opened for modification C:\Windows\SysWOW64\Mapppn32.exe Dncehk32.exe File opened for modification C:\Windows\SysWOW64\Oqklkbbi.exe Objkmkjj.exe File created C:\Windows\SysWOW64\Plejdkmm.exe Pefhlaie.exe File opened for modification C:\Windows\SysWOW64\Ppdjpcng.exe Paomog32.exe File created C:\Windows\SysWOW64\Ophjdehd.exe Odaiodbp.exe File opened for modification C:\Windows\SysWOW64\Lndagg32.exe Lcnmin32.exe File opened for modification C:\Windows\SysWOW64\Pblajhje.exe Pmphaaln.exe File created C:\Windows\SysWOW64\Bcidlo32.dll Cmnnimak.exe File created C:\Windows\SysWOW64\Djeopjhd.dll Kkmapc32.exe File created C:\Windows\SysWOW64\Foenplji.exe Fiheheka.exe File created C:\Windows\SysWOW64\Cihclh32.exe backgroundTaskHost.exe File created C:\Windows\SysWOW64\Hhbdbmfg.dll Phaahggp.exe File opened for modification C:\Windows\SysWOW64\Ddgplado.exe Dmlkhofd.exe File opened for modification C:\Windows\SysWOW64\Pnkbkk32.exe Pmlfqh32.exe File created C:\Windows\SysWOW64\Pcegclgp.exe Pfagighf.exe File created C:\Windows\SysWOW64\Ghfqhkbn.dll Cgfbbb32.exe File created C:\Windows\SysWOW64\Biiigi32.dll Fmoclg32.exe File created C:\Windows\SysWOW64\Mlofpg32.dll Malefbkc.exe File created C:\Windows\SysWOW64\Ekellcop.dll Ehndnh32.exe File opened for modification C:\Windows\SysWOW64\Dbqqkkbo.exe Dmdhcddh.exe File created C:\Windows\SysWOW64\Jpaleglc.exe Icnklbmj.exe File created C:\Windows\SysWOW64\Knhakh32.exe Kdpmbc32.exe File created C:\Windows\SysWOW64\Polalahi.dll Joahqn32.exe File created C:\Windows\SysWOW64\Mmlmhc32.dll Ckebcg32.exe File created C:\Windows\SysWOW64\Nibaepqb.dll Ogcike32.exe File opened for modification C:\Windows\SysWOW64\Kcgekjgp.exe Kfcdaehf.exe File opened for modification C:\Windows\SysWOW64\Cfnqklgh.exe Cihclh32.exe File created C:\Windows\SysWOW64\Ficlmf32.exe Fkbkoo32.exe File created C:\Windows\SysWOW64\Gmjlak32.dll Blenhmph.exe File created C:\Windows\SysWOW64\Bdabnm32.dll Onnmdcjm.exe File created C:\Windows\SysWOW64\Mljmhflh.exe Mhldbh32.exe File created C:\Windows\SysWOW64\Gipbmd32.dll Nijqcf32.exe File opened for modification C:\Windows\SysWOW64\Ockdmmoj.exe Eaqdpjia.exe File opened for modification C:\Windows\SysWOW64\Khfdlnab.exe Blnhgn32.exe File created C:\Windows\SysWOW64\Pdeffgff.exe Lhfmmp32.exe File created C:\Windows\SysWOW64\Qoocnpag.exe Kbpboj32.exe File created C:\Windows\SysWOW64\Dfefkkqp.exe Coiaiakf.exe File opened for modification C:\Windows\SysWOW64\Gojgkl32.exe Gimoce32.exe File opened for modification C:\Windows\SysWOW64\Nblolm32.exe Jjnqap32.exe File created C:\Windows\SysWOW64\Hlogfd32.exe Hgbonm32.exe File created C:\Windows\SysWOW64\Ghmbib32.exe Kkihedld.exe File opened for modification C:\Windows\SysWOW64\Hdmoohbo.exe Higjaoci.exe File created C:\Windows\SysWOW64\Nknjec32.dll Kabcopmg.exe File opened for modification C:\Windows\SysWOW64\Aidehpea.exe Adgmoigj.exe File opened for modification C:\Windows\SysWOW64\Cgagjo32.exe Kelaef32.exe File opened for modification C:\Windows\SysWOW64\Diamko32.exe Lgibjj32.exe File created C:\Windows\SysWOW64\Ljmmcbdp.exe Cbqlpabf.exe File created C:\Windows\SysWOW64\Flddoa32.exe Fblpflfg.exe File created C:\Windows\SysWOW64\Dajqphlf.dll Kbinlp32.exe File created C:\Windows\SysWOW64\Kpqfid32.dll Ganldgib.exe File created C:\Windows\SysWOW64\Dckajh32.dll Mcpcdg32.exe File created C:\Windows\SysWOW64\Amqhbe32.exe Aajhndkb.exe File created C:\Windows\SysWOW64\Gngeik32.exe Gbpedjnb.exe File created C:\Windows\SysWOW64\Kcgekjgp.exe Kfcdaehf.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Phcgcqab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bpqjjjjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldgmleom.dll" Fiheheka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcpeei32.dll" Dpnkdq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Leqkeajd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Adkgje32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Doqbifpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Khfdlnab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plopnh32.dll" Lmlpjdgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lmlpjdgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lhfmmp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Elilmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poifgc32.dll" Ihndgmdd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Inomhbeq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkgmdnki.dll" Nockkcjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fiaogfai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mpapnfhg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bkcjjhgp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pahpfc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qachgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jgpmmp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kkconn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Eblimcdf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jqmicpbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfgohepp.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Iqipio32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hlcjhkdp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nmipdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blqhpg32.dll" Fiaogfai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpcgahca.dll" Ccblbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lekldqpd.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Faebcoda.dll" Fifomlap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cfkmkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmggcl32.dll" Qffoejkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Paomog32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bleebc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geflmjjg.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bkmeha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Biplma32.dll" Fidbgm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Aejfjocb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jbkbkbfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fnbcgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljgmjm32.dll" Ockdmmoj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Iimcma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ijjnpg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Icbbimih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kdpmbc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpqfid32.dll" Ganldgib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Namnmp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qkakhakq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hjbhph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hqdkbakj.dll" Paomog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkfpcj32.dll" Glpdjpbj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gammbfqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Joahqn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjbmjjno.dll" Kegpifod.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Aajhndkb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ncbafoge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Degdgd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lhfmmp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcoblg32.dll" Jqmicpbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfckpa32.dll" Bilcol32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3160 wrote to memory of 448 3160 NEAS.23ca897d7ecc42250619a2097fd017e0.exe 86 PID 3160 wrote to memory of 448 3160 NEAS.23ca897d7ecc42250619a2097fd017e0.exe 86 PID 3160 wrote to memory of 448 3160 NEAS.23ca897d7ecc42250619a2097fd017e0.exe 86 PID 448 wrote to memory of 2888 448 Hpfcdojl.exe 87 PID 448 wrote to memory of 2888 448 Hpfcdojl.exe 87 PID 448 wrote to memory of 2888 448 Hpfcdojl.exe 87 PID 2888 wrote to memory of 2304 2888 Iqipio32.exe 89 PID 2888 wrote to memory of 2304 2888 Iqipio32.exe 89 PID 2888 wrote to memory of 2304 2888 Iqipio32.exe 89 PID 2304 wrote to memory of 4276 2304 Inomhbeq.exe 352 PID 2304 wrote to memory of 4276 2304 Inomhbeq.exe 352 PID 2304 wrote to memory of 4276 2304 Inomhbeq.exe 352 PID 4276 wrote to memory of 1668 4276 Nijqcf32.exe 91 PID 4276 wrote to memory of 1668 4276 Nijqcf32.exe 91 PID 4276 wrote to memory of 1668 4276 Nijqcf32.exe 91 PID 1668 wrote to memory of 5224 1668 Jdedak32.exe 343 PID 1668 wrote to memory of 5224 1668 Jdedak32.exe 343 PID 1668 wrote to memory of 5224 1668 Jdedak32.exe 343 PID 5224 wrote to memory of 1664 5224 Mhldbh32.exe 94 PID 5224 wrote to memory of 1664 5224 Mhldbh32.exe 94 PID 5224 wrote to memory of 1664 5224 Mhldbh32.exe 94 PID 1664 wrote to memory of 5116 1664 Kghjhemo.exe 95 PID 1664 wrote to memory of 5116 1664 Kghjhemo.exe 95 PID 1664 wrote to memory of 5116 1664 Kghjhemo.exe 95 PID 5116 wrote to memory of 2820 5116 Knflpoqf.exe 96 PID 5116 wrote to memory of 2820 5116 Knflpoqf.exe 96 PID 5116 wrote to memory of 2820 5116 Knflpoqf.exe 96 PID 2820 wrote to memory of 5148 2820 Kbddfmgl.exe 376 PID 2820 wrote to memory of 5148 2820 Kbddfmgl.exe 376 PID 2820 wrote to memory of 5148 2820 Kbddfmgl.exe 376 PID 5148 wrote to memory of 3156 5148 Bjhkmbho.exe 98 PID 5148 wrote to memory of 3156 5148 Bjhkmbho.exe 98 PID 5148 wrote to memory of 3156 5148 Bjhkmbho.exe 98 PID 3156 wrote to memory of 4232 3156 Lnnbqnjn.exe 359 PID 3156 wrote to memory of 4232 3156 Lnnbqnjn.exe 359 PID 3156 wrote to memory of 4232 3156 Lnnbqnjn.exe 359 PID 4232 wrote to memory of 5792 4232 Pqbala32.exe 379 PID 4232 wrote to memory of 5792 4232 Pqbala32.exe 379 PID 4232 wrote to memory of 5792 4232 Pqbala32.exe 379 PID 5792 wrote to memory of 3376 5792 Bdeiqgkj.exe 369 PID 5792 wrote to memory of 3376 5792 Bdeiqgkj.exe 369 PID 5792 wrote to memory of 3376 5792 Bdeiqgkj.exe 369 PID 3376 wrote to memory of 632 3376 Qikbaaml.exe 102 PID 3376 wrote to memory of 632 3376 Qikbaaml.exe 102 PID 3376 wrote to memory of 632 3376 Qikbaaml.exe 102 PID 632 wrote to memory of 1800 632 Najceeoo.exe 103 PID 632 wrote to memory of 1800 632 Najceeoo.exe 103 PID 632 wrote to memory of 1800 632 Najceeoo.exe 103 PID 1800 wrote to memory of 2208 1800 Objpoh32.exe 104 PID 1800 wrote to memory of 2208 1800 Objpoh32.exe 104 PID 1800 wrote to memory of 2208 1800 Objpoh32.exe 104 PID 2208 wrote to memory of 3888 2208 Ohiemobf.exe 107 PID 2208 wrote to memory of 3888 2208 Ohiemobf.exe 107 PID 2208 wrote to memory of 3888 2208 Ohiemobf.exe 107 PID 3888 wrote to memory of 912 3888 Pahpfc32.exe 108 PID 3888 wrote to memory of 912 3888 Pahpfc32.exe 108 PID 3888 wrote to memory of 912 3888 Pahpfc32.exe 108 PID 912 wrote to memory of 212 912 Pefhlaie.exe 109 PID 912 wrote to memory of 212 912 Pefhlaie.exe 109 PID 912 wrote to memory of 212 912 Pefhlaie.exe 109 PID 212 wrote to memory of 1572 212 Plejdkmm.exe 175 PID 212 wrote to memory of 1572 212 Plejdkmm.exe 175 PID 212 wrote to memory of 1572 212 Plejdkmm.exe 175 PID 1572 wrote to memory of 5948 1572 Akoqpg32.exe 380
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.23ca897d7ecc42250619a2097fd017e0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.23ca897d7ecc42250619a2097fd017e0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\Hpfcdojl.exeC:\Windows\system32\Hpfcdojl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\Iqipio32.exeC:\Windows\system32\Iqipio32.exe3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\Inomhbeq.exeC:\Windows\system32\Inomhbeq.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\Jhijqj32.exeC:\Windows\system32\Jhijqj32.exe5⤵PID:4276
-
C:\Windows\SysWOW64\Jdedak32.exeC:\Windows\system32\Jdedak32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\Jibmgi32.exeC:\Windows\system32\Jibmgi32.exe7⤵PID:5224
-
C:\Windows\SysWOW64\Kghjhemo.exeC:\Windows\system32\Kghjhemo.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\Knflpoqf.exeC:\Windows\system32\Knflpoqf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\Kbddfmgl.exeC:\Windows\system32\Kbddfmgl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\Leenhhdn.exeC:\Windows\system32\Leenhhdn.exe11⤵PID:5148
-
C:\Windows\SysWOW64\Lnnbqnjn.exeC:\Windows\system32\Lnnbqnjn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\Ljdceo32.exeC:\Windows\system32\Ljdceo32.exe13⤵PID:4232
-
C:\Windows\SysWOW64\Mldhfpib.exeC:\Windows\system32\Mldhfpib.exe14⤵PID:5792
-
C:\Windows\SysWOW64\Nbqmiinl.exeC:\Windows\system32\Nbqmiinl.exe15⤵PID:3376
-
C:\Windows\SysWOW64\Najceeoo.exeC:\Windows\system32\Najceeoo.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\Objpoh32.exeC:\Windows\system32\Objpoh32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\Ohiemobf.exeC:\Windows\system32\Ohiemobf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\Pahpfc32.exeC:\Windows\system32\Pahpfc32.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\Pefhlaie.exeC:\Windows\system32\Pefhlaie.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\Plejdkmm.exeC:\Windows\system32\Plejdkmm.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\Akoqpg32.exeC:\Windows\system32\Akoqpg32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Nfnamjhk.exeC:\Windows\system32\Nfnamjhk.exe6⤵PID:7652
-
C:\Windows\SysWOW64\Ncbafoge.exeC:\Windows\system32\Ncbafoge.exe7⤵
- Modifies registry class
PID:7920 -
C:\Windows\SysWOW64\Nqfbpb32.exeC:\Windows\system32\Nqfbpb32.exe8⤵PID:7804
-
C:\Windows\SysWOW64\Oiagde32.exeC:\Windows\system32\Oiagde32.exe9⤵PID:4936
-
C:\Windows\SysWOW64\Objkmkjj.exeC:\Windows\system32\Objkmkjj.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2328 -
C:\Windows\SysWOW64\Oqklkbbi.exeC:\Windows\system32\Oqklkbbi.exe11⤵PID:7304
-
C:\Windows\SysWOW64\Ockdmmoj.exeC:\Windows\system32\Ockdmmoj.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3032 -
C:\Windows\SysWOW64\Obqanjdb.exeC:\Windows\system32\Obqanjdb.exe13⤵PID:1244
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Alnmjjdb.exeC:\Windows\system32\Alnmjjdb.exe1⤵PID:5948
-
C:\Windows\SysWOW64\Aanbhp32.exeC:\Windows\system32\Aanbhp32.exe2⤵PID:320
-
-
C:\Windows\SysWOW64\Alcfei32.exeC:\Windows\system32\Alcfei32.exe1⤵PID:4164
-
C:\Windows\SysWOW64\Bbdhiojo.exeC:\Windows\system32\Bbdhiojo.exe2⤵
- Executes dropped EXE
PID:4636 -
C:\Windows\SysWOW64\Bkmmaeap.exeC:\Windows\system32\Bkmmaeap.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:844
-
-
-
C:\Windows\SysWOW64\Bhamkipi.exeC:\Windows\system32\Bhamkipi.exe1⤵
- Executes dropped EXE
PID:5112 -
C:\Windows\SysWOW64\Bfgjjm32.exeC:\Windows\system32\Bfgjjm32.exe2⤵
- Executes dropped EXE
PID:5316 -
C:\Windows\SysWOW64\Bopocbcq.exeC:\Windows\system32\Bopocbcq.exe3⤵PID:1624
-
-
-
C:\Windows\SysWOW64\Cfnqklgh.exeC:\Windows\system32\Cfnqklgh.exe1⤵
- Executes dropped EXE
PID:5300 -
C:\Windows\SysWOW64\Ccbadp32.exeC:\Windows\system32\Ccbadp32.exe2⤵
- Executes dropped EXE
PID:464
-
-
C:\Windows\SysWOW64\Dpnkdq32.exeC:\Windows\system32\Dpnkdq32.exe1⤵
- Executes dropped EXE
- Modifies registry class
PID:5072 -
C:\Windows\SysWOW64\Dbndfl32.exeC:\Windows\system32\Dbndfl32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1000
-
-
C:\Windows\SysWOW64\Dmdhcddh.exeC:\Windows\system32\Dmdhcddh.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3060 -
C:\Windows\SysWOW64\Dbqqkkbo.exeC:\Windows\system32\Dbqqkkbo.exe2⤵
- Executes dropped EXE
PID:4692 -
C:\Windows\SysWOW64\Dpgnjo32.exeC:\Windows\system32\Dpgnjo32.exe3⤵
- Executes dropped EXE
PID:5024 -
C:\Windows\SysWOW64\Elbhjp32.exeC:\Windows\system32\Elbhjp32.exe4⤵
- Executes dropped EXE
PID:4992 -
C:\Windows\SysWOW64\Fpbmfn32.exeC:\Windows\system32\Fpbmfn32.exe5⤵
- Executes dropped EXE
PID:3956 -
C:\Windows\SysWOW64\Fmikeaap.exeC:\Windows\system32\Fmikeaap.exe6⤵
- Executes dropped EXE
PID:2108 -
C:\Windows\SysWOW64\Fmkgkapm.exeC:\Windows\system32\Fmkgkapm.exe7⤵
- Executes dropped EXE
PID:400 -
C:\Windows\SysWOW64\Glengm32.exeC:\Windows\system32\Glengm32.exe8⤵
- Executes dropped EXE
PID:2264 -
C:\Windows\SysWOW64\Glgjlm32.exeC:\Windows\system32\Glgjlm32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2556 -
C:\Windows\SysWOW64\Gfmojenc.exeC:\Windows\system32\Gfmojenc.exe10⤵
- Executes dropped EXE
PID:3036 -
C:\Windows\SysWOW64\Hpjmnjqn.exeC:\Windows\system32\Hpjmnjqn.exe11⤵
- Executes dropped EXE
PID:1004 -
C:\Windows\SysWOW64\Hgfapd32.exeC:\Windows\system32\Hgfapd32.exe12⤵
- Executes dropped EXE
PID:1192 -
C:\Windows\SysWOW64\Hlcjhkdp.exeC:\Windows\system32\Hlcjhkdp.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:5324 -
C:\Windows\SysWOW64\Higjaoci.exeC:\Windows\system32\Higjaoci.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2840 -
C:\Windows\SysWOW64\Hdmoohbo.exeC:\Windows\system32\Hdmoohbo.exe15⤵
- Executes dropped EXE
PID:1916 -
C:\Windows\SysWOW64\Hmechmip.exeC:\Windows\system32\Hmechmip.exe16⤵
- Executes dropped EXE
PID:3740 -
C:\Windows\SysWOW64\Hkicaahi.exeC:\Windows\system32\Hkicaahi.exe17⤵
- Executes dropped EXE
PID:2228 -
C:\Windows\SysWOW64\Igpdfb32.exeC:\Windows\system32\Igpdfb32.exe18⤵
- Executes dropped EXE
PID:3044 -
C:\Windows\SysWOW64\Igbalblk.exeC:\Windows\system32\Igbalblk.exe19⤵
- Executes dropped EXE
PID:4680 -
C:\Windows\SysWOW64\Ijcjmmil.exeC:\Windows\system32\Ijcjmmil.exe20⤵PID:3752
-
C:\Windows\SysWOW64\Icnklbmj.exeC:\Windows\system32\Icnklbmj.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5216 -
C:\Windows\SysWOW64\Jpaleglc.exeC:\Windows\system32\Jpaleglc.exe22⤵
- Executes dropped EXE
PID:952 -
C:\Windows\SysWOW64\Jgnqgqan.exeC:\Windows\system32\Jgnqgqan.exe23⤵PID:5784
-
C:\Windows\SysWOW64\Jgpmmp32.exeC:\Windows\system32\Jgpmmp32.exe24⤵
- Executes dropped EXE
- Modifies registry class
PID:3948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Pknghk32.exeC:\Windows\system32\Pknghk32.exe9⤵PID:6640
-
C:\Windows\SysWOW64\Qhbhapha.exeC:\Windows\system32\Qhbhapha.exe10⤵PID:1068
-
C:\Windows\SysWOW64\Qjcdih32.exeC:\Windows\system32\Qjcdih32.exe11⤵PID:7228
-
C:\Windows\SysWOW64\Qkcackeb.exeC:\Windows\system32\Qkcackeb.exe12⤵PID:1980
-
C:\Windows\SysWOW64\Ajhndgjj.exeC:\Windows\system32\Ajhndgjj.exe13⤵PID:6464
-
C:\Windows\SysWOW64\Aglnnkid.exeC:\Windows\system32\Aglnnkid.exe14⤵PID:4136
-
C:\Windows\SysWOW64\Anhcpeon.exeC:\Windows\system32\Anhcpeon.exe15⤵PID:7820
-
C:\Windows\SysWOW64\Aqilaplo.exeC:\Windows\system32\Aqilaplo.exe16⤵PID:7632
-
C:\Windows\SysWOW64\Ajaqjfbp.exeC:\Windows\system32\Ajaqjfbp.exe17⤵
- Drops file in System32 directory
PID:7392 -
C:\Windows\SysWOW64\Bjcmpepm.exeC:\Windows\system32\Bjcmpepm.exe18⤵PID:8000
-
C:\Windows\SysWOW64\Bkcjjhgp.exeC:\Windows\system32\Bkcjjhgp.exe19⤵
- Modifies registry class
PID:5212 -
C:\Windows\SysWOW64\Bilcol32.exeC:\Windows\system32\Bilcol32.exe20⤵
- Modifies registry class
PID:6284 -
C:\Windows\SysWOW64\Cnhlgc32.exeC:\Windows\system32\Cnhlgc32.exe21⤵PID:4832
-
C:\Windows\SysWOW64\Ckmmpg32.exeC:\Windows\system32\Ckmmpg32.exe22⤵PID:7940
-
C:\Windows\SysWOW64\Ciqmjkno.exeC:\Windows\system32\Ciqmjkno.exe23⤵PID:5960
-
C:\Windows\SysWOW64\Cbiabq32.exeC:\Windows\system32\Cbiabq32.exe24⤵PID:6216
-
C:\Windows\SysWOW64\Canocm32.exeC:\Windows\system32\Canocm32.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6704 -
C:\Windows\SysWOW64\Cnboma32.exeC:\Windows\system32\Cnboma32.exe26⤵PID:5048
-
C:\Windows\SysWOW64\Cgjcfgoa.exeC:\Windows\system32\Cgjcfgoa.exe27⤵PID:6240
-
C:\Windows\SysWOW64\Dabhomea.exeC:\Windows\system32\Dabhomea.exe28⤵PID:6684
-
C:\Windows\SysWOW64\Djklgb32.exeC:\Windows\system32\Djklgb32.exe29⤵PID:7760
-
C:\Windows\SysWOW64\Deqqek32.exeC:\Windows\system32\Deqqek32.exe30⤵PID:7752
-
C:\Windows\SysWOW64\Dnienqbi.exeC:\Windows\system32\Dnienqbi.exe31⤵PID:5712
-
C:\Windows\SysWOW64\Dgaiffii.exeC:\Windows\system32\Dgaiffii.exe32⤵PID:4788
-
C:\Windows\SysWOW64\Dajnol32.exeC:\Windows\system32\Dajnol32.exe33⤵PID:4408
-
C:\Windows\SysWOW64\Dlobmd32.exeC:\Windows\system32\Dlobmd32.exe34⤵PID:7624
-
C:\Windows\SysWOW64\Dbijinfl.exeC:\Windows\system32\Dbijinfl.exe35⤵PID:7892
-
C:\Windows\SysWOW64\Ejdonq32.exeC:\Windows\system32\Ejdonq32.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6084 -
C:\Windows\SysWOW64\Eaqdpjia.exeC:\Windows\system32\Eaqdpjia.exe37⤵
- Drops file in System32 directory
PID:7304 -
C:\Windows\SysWOW64\Ehmibdol.exeC:\Windows\system32\Ehmibdol.exe38⤵PID:8076
-
C:\Windows\SysWOW64\Ebbmpmnb.exeC:\Windows\system32\Ebbmpmnb.exe39⤵PID:7424
-
C:\Windows\SysWOW64\Ehofhdli.exeC:\Windows\system32\Ehofhdli.exe40⤵PID:8160
-
C:\Windows\SysWOW64\Eecfah32.exeC:\Windows\system32\Eecfah32.exe41⤵PID:7232
-
C:\Windows\SysWOW64\Folkjnbc.exeC:\Windows\system32\Folkjnbc.exe42⤵PID:5928
-
C:\Windows\SysWOW64\Fiaogfai.exeC:\Windows\system32\Fiaogfai.exe43⤵
- Modifies registry class
PID:6360 -
C:\Windows\SysWOW64\Fkbkoo32.exeC:\Windows\system32\Fkbkoo32.exe44⤵
- Drops file in System32 directory
PID:7324 -
C:\Windows\SysWOW64\Ficlmf32.exeC:\Windows\system32\Ficlmf32.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3268 -
C:\Windows\SysWOW64\Fblpflfg.exeC:\Windows\system32\Fblpflfg.exe46⤵
- Drops file in System32 directory
PID:7456 -
C:\Windows\SysWOW64\Flddoa32.exeC:\Windows\system32\Flddoa32.exe47⤵PID:4132
-
C:\Windows\SysWOW64\Fiheheka.exeC:\Windows\system32\Fiheheka.exe48⤵
- Drops file in System32 directory
- Modifies registry class
PID:3648 -
C:\Windows\SysWOW64\Foenplji.exeC:\Windows\system32\Foenplji.exe49⤵PID:4156
-
C:\Windows\SysWOW64\Ghmbib32.exeC:\Windows\system32\Ghmbib32.exe50⤵PID:1700
-
C:\Windows\SysWOW64\Gbcffk32.exeC:\Windows\system32\Gbcffk32.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4460 -
C:\Windows\SysWOW64\Gimoce32.exeC:\Windows\system32\Gimoce32.exe52⤵
- Drops file in System32 directory
PID:5404 -
C:\Windows\SysWOW64\Gojgkl32.exeC:\Windows\system32\Gojgkl32.exe53⤵PID:7732
-
C:\Windows\SysWOW64\Ghbkdald.exeC:\Windows\system32\Ghbkdald.exe54⤵PID:6700
-
C:\Windows\SysWOW64\Gbhpajlj.exeC:\Windows\system32\Gbhpajlj.exe55⤵PID:3384
-
C:\Windows\SysWOW64\Glpdjpbj.exeC:\Windows\system32\Glpdjpbj.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:7720 -
C:\Windows\SysWOW64\Gammbfqa.exeC:\Windows\system32\Gammbfqa.exe57⤵
- Modifies registry class
PID:6304 -
C:\Windows\SysWOW64\Hikkdc32.exeC:\Windows\system32\Hikkdc32.exe58⤵PID:7064
-
C:\Windows\SysWOW64\Himgjbii.exeC:\Windows\system32\Himgjbii.exe59⤵PID:212
-
C:\Windows\SysWOW64\Hommhi32.exeC:\Windows\system32\Hommhi32.exe60⤵PID:7560
-
C:\Windows\SysWOW64\Icooig32.exeC:\Windows\system32\Icooig32.exe61⤵PID:4636
-
C:\Windows\SysWOW64\Ihndgmdd.exeC:\Windows\system32\Ihndgmdd.exe62⤵
- Modifies registry class
PID:6772 -
C:\Windows\SysWOW64\Jjnqap32.exeC:\Windows\system32\Jjnqap32.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:8164 -
C:\Windows\SysWOW64\Jhcmbm32.exeC:\Windows\system32\Jhcmbm32.exe64⤵PID:6756
-
C:\Windows\SysWOW64\Jbkbkbfo.exeC:\Windows\system32\Jbkbkbfo.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:7824 -
C:\Windows\SysWOW64\Jlafhkfe.exeC:\Windows\system32\Jlafhkfe.exe66⤵PID:4176
-
C:\Windows\SysWOW64\Jbnopbdl.exeC:\Windows\system32\Jbnopbdl.exe67⤵PID:6256
-
C:\Windows\SysWOW64\Jcmkjeko.exeC:\Windows\system32\Jcmkjeko.exe68⤵PID:6720
-
C:\Windows\SysWOW64\Kfpqap32.exeC:\Windows\system32\Kfpqap32.exe69⤵PID:7804
-
C:\Windows\SysWOW64\Kjnihnmd.exeC:\Windows\system32\Kjnihnmd.exe70⤵PID:6444
-
C:\Windows\SysWOW64\Kbinlp32.exeC:\Windows\system32\Kbinlp32.exe71⤵
- Drops file in System32 directory
PID:5936 -
C:\Windows\SysWOW64\Kmobii32.exeC:\Windows\system32\Kmobii32.exe72⤵PID:4616
-
C:\Windows\SysWOW64\Kfggbope.exeC:\Windows\system32\Kfggbope.exe73⤵PID:6076
-
C:\Windows\SysWOW64\Lobhqdec.exeC:\Windows\system32\Lobhqdec.exe74⤵PID:6664
-
C:\Windows\SysWOW64\Lmfhjhdm.exeC:\Windows\system32\Lmfhjhdm.exe75⤵PID:5828
-
C:\Windows\SysWOW64\Limioiia.exeC:\Windows\system32\Limioiia.exe76⤵PID:3080
-
C:\Windows\SysWOW64\Lfqjhmhk.exeC:\Windows\system32\Lfqjhmhk.exe77⤵PID:7356
-
C:\Windows\SysWOW64\Lcdjba32.exeC:\Windows\system32\Lcdjba32.exe78⤵
- Drops file in System32 directory
PID:7408 -
C:\Windows\SysWOW64\Mjaodkmo.exeC:\Windows\system32\Mjaodkmo.exe79⤵PID:2904
-
C:\Windows\SysWOW64\Mcicma32.exeC:\Windows\system32\Mcicma32.exe80⤵PID:1348
-
C:\Windows\SysWOW64\Mmahff32.exeC:\Windows\system32\Mmahff32.exe81⤵PID:7648
-
C:\Windows\SysWOW64\Mihikgod.exeC:\Windows\system32\Mihikgod.exe82⤵PID:3596
-
C:\Windows\SysWOW64\Mjheejff.exeC:\Windows\system32\Mjheejff.exe83⤵PID:7636
-
C:\Windows\SysWOW64\Mcpjnp32.exeC:\Windows\system32\Mcpjnp32.exe84⤵PID:7688
-
C:\Windows\SysWOW64\Nbefolao.exeC:\Windows\system32\Nbefolao.exe85⤵PID:2464
-
C:\Windows\SysWOW64\Ncecioib.exeC:\Windows\system32\Ncecioib.exe86⤵PID:4972
-
C:\Windows\SysWOW64\Nmmgae32.exeC:\Windows\system32\Nmmgae32.exe87⤵PID:7848
-
C:\Windows\SysWOW64\Nmpdgdmp.exeC:\Windows\system32\Nmpdgdmp.exe88⤵PID:5368
-
C:\Windows\SysWOW64\Njfafhjf.exeC:\Windows\system32\Njfafhjf.exe89⤵PID:6752
-
C:\Windows\SysWOW64\Odqbdnod.exeC:\Windows\system32\Odqbdnod.exe90⤵PID:7216
-
C:\Windows\SysWOW64\Olndnp32.exeC:\Windows\system32\Olndnp32.exe91⤵PID:676
-
C:\Windows\SysWOW64\Oplmdnpc.exeC:\Windows\system32\Oplmdnpc.exe92⤵PID:8084
-
C:\Windows\SysWOW64\Okaabg32.exeC:\Windows\system32\Okaabg32.exe93⤵PID:1832
-
C:\Windows\SysWOW64\Pdjeklfj.exeC:\Windows\system32\Pdjeklfj.exe94⤵PID:6740
-
C:\Windows\SysWOW64\Pmbjcb32.exeC:\Windows\system32\Pmbjcb32.exe95⤵PID:3936
-
C:\Windows\SysWOW64\Pgknlg32.exeC:\Windows\system32\Pgknlg32.exe96⤵PID:7284
-
C:\Windows\SysWOW64\Pljcjn32.exeC:\Windows\system32\Pljcjn32.exe97⤵PID:2720
-
C:\Windows\SysWOW64\Pllppnnm.exeC:\Windows\system32\Pllppnnm.exe98⤵PID:5456
-
C:\Windows\SysWOW64\Qipqibmf.exeC:\Windows\system32\Qipqibmf.exe99⤵PID:3160
-
C:\Windows\SysWOW64\Qpmfklbq.exeC:\Windows\system32\Qpmfklbq.exe100⤵PID:4936
-
C:\Windows\SysWOW64\Adjnaj32.exeC:\Windows\system32\Adjnaj32.exe101⤵PID:7336
-
C:\Windows\SysWOW64\Apaofk32.exeC:\Windows\system32\Apaofk32.exe102⤵PID:7388
-
C:\Windows\SysWOW64\Angleokb.exeC:\Windows\system32\Angleokb.exe103⤵PID:8016
-
C:\Windows\SysWOW64\Bcngddao.exeC:\Windows\system32\Bcngddao.exe104⤵PID:7196
-
C:\Windows\SysWOW64\Bqahmhpi.exeC:\Windows\system32\Bqahmhpi.exe105⤵PID:2096
-
C:\Windows\SysWOW64\Bnehgmob.exeC:\Windows\system32\Bnehgmob.exe106⤵PID:6604
-
C:\Windows\SysWOW64\Ccbaoc32.exeC:\Windows\system32\Ccbaoc32.exe107⤵PID:448
-
C:\Windows\SysWOW64\Cmkehicj.exeC:\Windows\system32\Cmkehicj.exe108⤵PID:4532
-
C:\Windows\SysWOW64\Cmmbmiag.exeC:\Windows\system32\Cmmbmiag.exe109⤵PID:4396
-
C:\Windows\SysWOW64\Cknbkpif.exeC:\Windows\system32\Cknbkpif.exe110⤵PID:5612
-
C:\Windows\SysWOW64\Cdfgdf32.exeC:\Windows\system32\Cdfgdf32.exe111⤵PID:7096
-
C:\Windows\SysWOW64\Cjcolm32.exeC:\Windows\system32\Cjcolm32.exe112⤵PID:1572
-
C:\Windows\SysWOW64\Cmdhnhkp.exeC:\Windows\system32\Cmdhnhkp.exe113⤵PID:5672
-
C:\Windows\SysWOW64\Dncehk32.exeC:\Windows\system32\Dncehk32.exe114⤵
- Drops file in System32 directory
PID:5160 -
C:\Windows\SysWOW64\Dgliapic.exeC:\Windows\system32\Dgliapic.exe115⤵PID:1816
-
C:\Windows\SysWOW64\Dmiaig32.exeC:\Windows\system32\Dmiaig32.exe116⤵PID:1496
-
C:\Windows\SysWOW64\Dkjbgooi.exeC:\Windows\system32\Dkjbgooi.exe117⤵PID:2880
-
C:\Windows\SysWOW64\Dcegkamd.exeC:\Windows\system32\Dcegkamd.exe118⤵PID:6468
-
C:\Windows\SysWOW64\Dmnkdfce.exeC:\Windows\system32\Dmnkdfce.exe119⤵PID:4940
-
C:\Windows\SysWOW64\Dnmgni32.exeC:\Windows\system32\Dnmgni32.exe120⤵PID:7008
-
C:\Windows\SysWOW64\Egelgoah.exeC:\Windows\system32\Egelgoah.exe121⤵PID:7180
-
C:\Windows\SysWOW64\Embdofop.exeC:\Windows\system32\Embdofop.exe122⤵PID:6184
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-