Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
167s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2023, 05:00
Behavioral task
behavioral1
Sample
NEAS.3648de129b3b5bf389ca3bd333655110.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.3648de129b3b5bf389ca3bd333655110.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.3648de129b3b5bf389ca3bd333655110.exe
-
Size
109KB
-
MD5
3648de129b3b5bf389ca3bd333655110
-
SHA1
bc04de4f1d582ef8c69ac38f2cc7f19c8632cdf4
-
SHA256
91a6c510db0e99ce12c28e85573001684ec23c62aea18166b27ad56d075ac5c8
-
SHA512
52b0ecfc1bbd7074a52d8445f20cca470bd76b3e1593682b46a9bc6f8920b25d92ed9d3014019b1d64f68e2ba8255bbcdba2c283665aeae9aab94cd43387feac
-
SSDEEP
3072:axJQ7TWO+29ZskoJ9HLCqwzBu1DjHLMVDqqkSpR:VTWrCuJ97wtu1DjrFqhz
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nkqpcnig.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eggmqk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkejalge.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nlbkjf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okedmp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmfkac32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oqkkdh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Emhmkh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdkbdllj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ahjoljqc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgjekc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nppkkj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eenfff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kcmfgimm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ndkjbq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fongpm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Caebfg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kidbnd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mohingqi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qcfmgkgo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dlqpkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jnockqlo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jianpl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nqklfe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ggicmh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnockqlo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ejgdim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ginenk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Amaqde32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iojbid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Clihcm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Liecmlno.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Alkdbllo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfjlecdj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hklglk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kggjghkd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pbhdafdd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lifjgb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckjbbbga.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ggjjfq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kaflio32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Inmplh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nqpccp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Offnae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hqfqpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pdifcoea.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Adllplel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kaemgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Klibdcjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jkhnab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Agpoqoaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mplfll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jlnbhe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efolidno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eoilfidj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knbiil32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Khiopp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apimhjbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bicogo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Blnoad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Caeiam32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Moglkikl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nbibpb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Affoopqd.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/4860-0-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0007000000022cd6-8.dat family_berbew behavioral2/memory/3976-7-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0007000000022cd6-6.dat family_berbew behavioral2/files/0x0007000000022cd8-16.dat family_berbew behavioral2/memory/5056-15-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0007000000022cd8-14.dat family_berbew behavioral2/files/0x0007000000022cda-24.dat family_berbew behavioral2/memory/3604-23-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0007000000022cda-22.dat family_berbew behavioral2/files/0x0006000000022cde-26.dat family_berbew behavioral2/memory/412-32-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0006000000022ce0-38.dat family_berbew behavioral2/files/0x0006000000022ce0-40.dat family_berbew behavioral2/memory/1748-39-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0006000000022cde-31.dat family_berbew behavioral2/files/0x0006000000022cde-30.dat family_berbew behavioral2/files/0x0006000000022ce2-46.dat family_berbew behavioral2/files/0x0006000000022ce2-48.dat family_berbew behavioral2/memory/1996-47-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/memory/2928-56-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0006000000022ce4-55.dat family_berbew behavioral2/files/0x0006000000022ce4-54.dat family_berbew behavioral2/files/0x0006000000022ce6-62.dat family_berbew behavioral2/files/0x0006000000022ce6-63.dat family_berbew behavioral2/memory/4804-64-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0006000000022ce7-70.dat family_berbew behavioral2/memory/3560-72-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0006000000022ce7-71.dat family_berbew behavioral2/files/0x0006000000022ce9-73.dat family_berbew behavioral2/files/0x0006000000022ce9-80.dat family_berbew behavioral2/memory/1128-79-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0006000000022ce9-78.dat family_berbew behavioral2/files/0x0006000000022ceb-88.dat family_berbew behavioral2/memory/4656-87-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0006000000022ceb-86.dat family_berbew behavioral2/memory/4852-95-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0006000000022ced-96.dat family_berbew behavioral2/files/0x0006000000022ced-94.dat family_berbew behavioral2/files/0x0006000000022cef-98.dat family_berbew behavioral2/files/0x0006000000022cef-104.dat family_berbew behavioral2/memory/1848-103-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0006000000022cef-102.dat family_berbew behavioral2/files/0x0006000000022cf1-111.dat family_berbew behavioral2/memory/4056-112-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0006000000022cf1-110.dat family_berbew behavioral2/files/0x0006000000022cf4-118.dat family_berbew behavioral2/memory/3140-120-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0006000000022cf4-119.dat family_berbew behavioral2/files/0x0006000000022cf6-128.dat family_berbew behavioral2/memory/792-127-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0006000000022cf6-126.dat family_berbew behavioral2/files/0x0006000000022cf8-135.dat family_berbew behavioral2/memory/992-136-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0006000000022cf8-134.dat family_berbew behavioral2/files/0x0006000000022cfa-143.dat family_berbew behavioral2/memory/416-144-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0006000000022cfa-142.dat family_berbew behavioral2/files/0x0006000000022cfc-152.dat family_berbew behavioral2/files/0x0006000000022cfe-158.dat family_berbew behavioral2/files/0x0006000000022cfe-160.dat family_berbew behavioral2/memory/316-159-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/memory/4724-167-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral2/files/0x0006000000022d00-168.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 3976 Dbckcf32.exe 5056 Gohapb32.exe 3604 Ginenk32.exe 412 Hcaibo32.exe 1748 Ijlkfg32.exe 1996 Igpkok32.exe 2928 Jflnafno.exe 4804 Kaflio32.exe 3560 Kggjghkd.exe 1128 Ldgnbg32.exe 4656 Mdlgmgdh.exe 4852 Maeaajpl.exe 1848 Nmbhgjoi.exe 4056 Omlkmign.exe 3140 Pdmikb32.exe 792 Adpogp32.exe 992 Ajaqjfbp.exe 416 Bgjjoi32.exe 4348 Cnmebblf.exe 316 Dabhomea.exe 4724 Djklgb32.exe 4412 Dgomaf32.exe 4668 Dhcfleff.exe 2064 Flmonbbp.exe 1832 Fongpm32.exe 732 Fhflhcfa.exe 3580 Gklnem32.exe 2488 Ghbkdald.exe 4652 Hcabhido.exe 2496 Hklglk32.exe 5104 Hebkid32.exe 2708 Hcflch32.exe 2176 Ioafchai.exe 1064 Ihndgmdd.exe 5088 Jbkbkbfo.exe 2016 Joobdfei.exe 3856 Kcbded32.exe 1292 Kmjinjnj.exe 5032 Kbgafqla.exe 3512 Kfejmobh.exe 456 Lkiiee32.exe 5040 Limioiia.exe 1716 Lfcfnm32.exe 3476 Mpkkgbmi.exe 1620 Ncbfcp32.exe 4700 Npldnp32.exe 5064 Qgdabflp.exe 4888 Fmejlcoj.exe 2676 Glkdejcd.exe 1872 Ghadjkhh.exe 1804 Gdkbdllj.exe 4784 Heohinog.exe 1628 Hlmiagbo.exe 4164 Iehkpmgl.exe 1944 Iaokdn32.exe 1132 Idpdfija.exe 4948 Ieoapl32.exe 4812 Jknfnbmi.exe 2580 Jlnbhe32.exe 2904 Jakkplbc.exe 2244 Jhdcmf32.exe 4836 Jamhflqq.exe 1444 Klibdcjo.exe 3388 Khbpndnp.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Aqhcid32.exe Ajnkmjqj.exe File created C:\Windows\SysWOW64\Jkhnab32.exe Jfkehk32.exe File opened for modification C:\Windows\SysWOW64\Mnjqfeld.exe Mcdlil32.exe File created C:\Windows\SysWOW64\Nakhkl32.exe Nedgfk32.exe File opened for modification C:\Windows\SysWOW64\Cpnpjgpn.exe Cidgnm32.exe File created C:\Windows\SysWOW64\Qjfmda32.exe Qpahghbg.exe File opened for modification C:\Windows\SysWOW64\Ahdpdd32.exe Amnlfk32.exe File created C:\Windows\SysWOW64\Kobkle32.dll Ggjjfq32.exe File created C:\Windows\SysWOW64\Fbgnbigb.dll Maohdj32.exe File opened for modification C:\Windows\SysWOW64\Oahnbc32.exe Oojaeh32.exe File created C:\Windows\SysWOW64\Nppkkj32.exe Nbljaf32.exe File created C:\Windows\SysWOW64\Laiiie32.exe Lllaqn32.exe File created C:\Windows\SysWOW64\Igpkok32.exe Ijlkfg32.exe File created C:\Windows\SysWOW64\Bgemlo32.dll Eqpfknbj.exe File opened for modification C:\Windows\SysWOW64\Mdanjaqf.exe Lgmnqmam.exe File created C:\Windows\SysWOW64\Lpkiim32.exe Lfcdph32.exe File opened for modification C:\Windows\SysWOW64\Qleahgff.exe Pgihppgo.exe File opened for modification C:\Windows\SysWOW64\Cbbnim32.exe Cleeafbi.exe File created C:\Windows\SysWOW64\Kpfpci32.dll Pjaciafc.exe File created C:\Windows\SysWOW64\Epqegd32.exe Eekail32.exe File opened for modification C:\Windows\SysWOW64\Nonajj32.exe Ndhnma32.exe File created C:\Windows\SysWOW64\Nqklfe32.exe Ncgkma32.exe File opened for modification C:\Windows\SysWOW64\Okloomoj.exe Oqgkadod.exe File created C:\Windows\SysWOW64\Kiejfo32.exe Kbkaiddd.exe File created C:\Windows\SysWOW64\Okgofl32.dll Aadgadai.exe File created C:\Windows\SysWOW64\Ccopfi32.exe Cgioah32.exe File opened for modification C:\Windows\SysWOW64\Blnoad32.exe Pllieg32.exe File created C:\Windows\SysWOW64\Mknjopdf.dll Knbiil32.exe File created C:\Windows\SysWOW64\Kimnnbaj.dll Ogqaqigd.exe File created C:\Windows\SysWOW64\Dhphfppl.exe Ckgnbl32.exe File opened for modification C:\Windows\SysWOW64\Ejegdngb.exe Dphipidf.exe File created C:\Windows\SysWOW64\Eiclml32.dll Dhhnipbe.exe File opened for modification C:\Windows\SysWOW64\Nhhlog32.exe Nlbkjf32.exe File opened for modification C:\Windows\SysWOW64\Bhkmoifp.exe Bochfc32.exe File created C:\Windows\SysWOW64\Idcpofaf.dll Akkfop32.exe File opened for modification C:\Windows\SysWOW64\Akmbepke.exe Aphngglp.exe File created C:\Windows\SysWOW64\Gnoanl32.dll Idpdfija.exe File opened for modification C:\Windows\SysWOW64\Mmiccf32.exe Mdanjaqf.exe File created C:\Windows\SysWOW64\Olphlcdb.exe Obgccn32.exe File opened for modification C:\Windows\SysWOW64\Jlnbhe32.exe Jknfnbmi.exe File opened for modification C:\Windows\SysWOW64\Jkhnab32.exe Jfkehk32.exe File created C:\Windows\SysWOW64\Bicogo32.exe Apimhjbe.exe File opened for modification C:\Windows\SysWOW64\Qgdabflp.exe Npldnp32.exe File opened for modification C:\Windows\SysWOW64\Fbcfan32.exe Flinddpj.exe File created C:\Windows\SysWOW64\Ejdhokji.dll Idceim32.exe File created C:\Windows\SysWOW64\Qaoofaoi.exe Phaabm32.exe File created C:\Windows\SysWOW64\Jfpmglkb.dll Jndenjmo.exe File opened for modification C:\Windows\SysWOW64\Gdkbdllj.exe Ghadjkhh.exe File opened for modification C:\Windows\SysWOW64\Mljmblae.exe Mcaiif32.exe File created C:\Windows\SysWOW64\Nbpafkdf.exe Nlbindfo.exe File created C:\Windows\SysWOW64\Bgjiokeo.dll Flmonbbp.exe File opened for modification C:\Windows\SysWOW64\Ojjoedfn.exe Ndagao32.exe File created C:\Windows\SysWOW64\Opnbjk32.exe Offnae32.exe File opened for modification C:\Windows\SysWOW64\Noqnpi32.exe Ndkjbq32.exe File created C:\Windows\SysWOW64\Cacdlf32.dll Iaokdn32.exe File opened for modification C:\Windows\SysWOW64\Cdfkhb32.exe Caebfg32.exe File created C:\Windows\SysWOW64\Pifodifq.dll Jqpfccgo.exe File opened for modification C:\Windows\SysWOW64\Kibmqond.exe Knmicfnn.exe File created C:\Windows\SysWOW64\Giplpe32.dll Dbckcf32.exe File created C:\Windows\SysWOW64\Efocbmni.dll Lpkiim32.exe File opened for modification C:\Windows\SysWOW64\Ihnkobpl.exe Fhablf32.exe File created C:\Windows\SysWOW64\Mcnmccfa.exe Lklbnb32.exe File created C:\Windows\SysWOW64\Oqkkdh32.exe Ookokeqd.exe File created C:\Windows\SysWOW64\Fkbpjbil.exe Fqmlmiif.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dkbgeb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mfcmge32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jpenoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhklccbj.dll" Meljkeed.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mnnkaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igkbkg32.dll" Bhkmoifp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Edklljnp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plakkepg.dll" Egknco32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ghadjkhh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Qhlamhkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Feoacblj.dll" Pcmjaloi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Khbpndnp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekejap32.dll" Nlbkjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bphpqpah.dll" Afapjk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oolnkhgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpeohnhn.dll" Bajjeo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ilpaei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kgkfhngo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pjaciafc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Afnljenh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qhlamhkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hmkiqn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ckgnbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcabkgce.dll" Ckbnlfeb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fjoadbbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aemead32.dll" Mnjqfeld.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Njhglelp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Limioiia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lgnekcei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pookqgeg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Iocliecb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jialbf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ggjjfq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Egknco32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bmofkm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fbaabk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fpbmpc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gjnlag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ldgnbg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Encgdbqd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bfcompnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Amjjcf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knnicgle.dll" Ginenk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ldgnbg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aofjhd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oqimje32.dll" Lemjlcgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kjhlipla.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bdbndjld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mplfll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Panemeei.dll" Blpemn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jcgbmd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljagfapn.dll" Khoeok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqfedn32.dll" Ddqbkebo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kibpjfkd.dll" Keekci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aohfnd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lifjgb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oopnio32.dll" Mhncnodp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oifekg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bochfc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Inkjao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbpljo32.dll" Naejcl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Keekci32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kaflio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nmbhgjoi.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4860 wrote to memory of 3976 4860 NEAS.3648de129b3b5bf389ca3bd333655110.exe 94 PID 4860 wrote to memory of 3976 4860 NEAS.3648de129b3b5bf389ca3bd333655110.exe 94 PID 4860 wrote to memory of 3976 4860 NEAS.3648de129b3b5bf389ca3bd333655110.exe 94 PID 3976 wrote to memory of 5056 3976 Dbckcf32.exe 95 PID 3976 wrote to memory of 5056 3976 Dbckcf32.exe 95 PID 3976 wrote to memory of 5056 3976 Dbckcf32.exe 95 PID 5056 wrote to memory of 3604 5056 Gohapb32.exe 96 PID 5056 wrote to memory of 3604 5056 Gohapb32.exe 96 PID 5056 wrote to memory of 3604 5056 Gohapb32.exe 96 PID 3604 wrote to memory of 412 3604 Ginenk32.exe 98 PID 3604 wrote to memory of 412 3604 Ginenk32.exe 98 PID 3604 wrote to memory of 412 3604 Ginenk32.exe 98 PID 412 wrote to memory of 1748 412 Hcaibo32.exe 97 PID 412 wrote to memory of 1748 412 Hcaibo32.exe 97 PID 412 wrote to memory of 1748 412 Hcaibo32.exe 97 PID 1748 wrote to memory of 1996 1748 Ijlkfg32.exe 99 PID 1748 wrote to memory of 1996 1748 Ijlkfg32.exe 99 PID 1748 wrote to memory of 1996 1748 Ijlkfg32.exe 99 PID 1996 wrote to memory of 2928 1996 Igpkok32.exe 100 PID 1996 wrote to memory of 2928 1996 Igpkok32.exe 100 PID 1996 wrote to memory of 2928 1996 Igpkok32.exe 100 PID 2928 wrote to memory of 4804 2928 Jflnafno.exe 101 PID 2928 wrote to memory of 4804 2928 Jflnafno.exe 101 PID 2928 wrote to memory of 4804 2928 Jflnafno.exe 101 PID 4804 wrote to memory of 3560 4804 Kaflio32.exe 102 PID 4804 wrote to memory of 3560 4804 Kaflio32.exe 102 PID 4804 wrote to memory of 3560 4804 Kaflio32.exe 102 PID 3560 wrote to memory of 1128 3560 Kggjghkd.exe 103 PID 3560 wrote to memory of 1128 3560 Kggjghkd.exe 103 PID 3560 wrote to memory of 1128 3560 Kggjghkd.exe 103 PID 1128 wrote to memory of 4656 1128 Ldgnbg32.exe 104 PID 1128 wrote to memory of 4656 1128 Ldgnbg32.exe 104 PID 1128 wrote to memory of 4656 1128 Ldgnbg32.exe 104 PID 4656 wrote to memory of 4852 4656 Mdlgmgdh.exe 105 PID 4656 wrote to memory of 4852 4656 Mdlgmgdh.exe 105 PID 4656 wrote to memory of 4852 4656 Mdlgmgdh.exe 105 PID 4852 wrote to memory of 1848 4852 Maeaajpl.exe 106 PID 4852 wrote to memory of 1848 4852 Maeaajpl.exe 106 PID 4852 wrote to memory of 1848 4852 Maeaajpl.exe 106 PID 1848 wrote to memory of 4056 1848 Nmbhgjoi.exe 107 PID 1848 wrote to memory of 4056 1848 Nmbhgjoi.exe 107 PID 1848 wrote to memory of 4056 1848 Nmbhgjoi.exe 107 PID 4056 wrote to memory of 3140 4056 Omlkmign.exe 108 PID 4056 wrote to memory of 3140 4056 Omlkmign.exe 108 PID 4056 wrote to memory of 3140 4056 Omlkmign.exe 108 PID 3140 wrote to memory of 792 3140 Pdmikb32.exe 109 PID 3140 wrote to memory of 792 3140 Pdmikb32.exe 109 PID 3140 wrote to memory of 792 3140 Pdmikb32.exe 109 PID 792 wrote to memory of 992 792 Adpogp32.exe 110 PID 792 wrote to memory of 992 792 Adpogp32.exe 110 PID 792 wrote to memory of 992 792 Adpogp32.exe 110 PID 992 wrote to memory of 416 992 Ajaqjfbp.exe 111 PID 992 wrote to memory of 416 992 Ajaqjfbp.exe 111 PID 992 wrote to memory of 416 992 Ajaqjfbp.exe 111 PID 416 wrote to memory of 4348 416 Bgjjoi32.exe 115 PID 416 wrote to memory of 4348 416 Bgjjoi32.exe 115 PID 416 wrote to memory of 4348 416 Bgjjoi32.exe 115 PID 4348 wrote to memory of 316 4348 Cnmebblf.exe 113 PID 4348 wrote to memory of 316 4348 Cnmebblf.exe 113 PID 4348 wrote to memory of 316 4348 Cnmebblf.exe 113 PID 316 wrote to memory of 4724 316 Dabhomea.exe 112 PID 316 wrote to memory of 4724 316 Dabhomea.exe 112 PID 316 wrote to memory of 4724 316 Dabhomea.exe 112 PID 4724 wrote to memory of 4412 4724 Djklgb32.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.3648de129b3b5bf389ca3bd333655110.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.3648de129b3b5bf389ca3bd333655110.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\Dbckcf32.exeC:\Windows\system32\Dbckcf32.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\Gohapb32.exeC:\Windows\system32\Gohapb32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\Ginenk32.exeC:\Windows\system32\Ginenk32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\Hcaibo32.exeC:\Windows\system32\Hcaibo32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412
-
-
-
-
-
C:\Windows\SysWOW64\Ijlkfg32.exeC:\Windows\system32\Ijlkfg32.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\Igpkok32.exeC:\Windows\system32\Igpkok32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\Jflnafno.exeC:\Windows\system32\Jflnafno.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\Kaflio32.exeC:\Windows\system32\Kaflio32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\Kggjghkd.exeC:\Windows\system32\Kggjghkd.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\Ldgnbg32.exeC:\Windows\system32\Ldgnbg32.exe6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\Mdlgmgdh.exeC:\Windows\system32\Mdlgmgdh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\Maeaajpl.exeC:\Windows\system32\Maeaajpl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\Nmbhgjoi.exeC:\Windows\system32\Nmbhgjoi.exe9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\Omlkmign.exeC:\Windows\system32\Omlkmign.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\Pdmikb32.exeC:\Windows\system32\Pdmikb32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\Adpogp32.exeC:\Windows\system32\Adpogp32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\Ajaqjfbp.exeC:\Windows\system32\Ajaqjfbp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\Bgjjoi32.exeC:\Windows\system32\Bgjjoi32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\SysWOW64\Cnmebblf.exeC:\Windows\system32\Cnmebblf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Djklgb32.exeC:\Windows\system32\Djklgb32.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\Dgomaf32.exeC:\Windows\system32\Dgomaf32.exe2⤵
- Executes dropped EXE
PID:4412 -
C:\Windows\SysWOW64\Dhcfleff.exeC:\Windows\system32\Dhcfleff.exe3⤵
- Executes dropped EXE
PID:4668 -
C:\Windows\SysWOW64\Flmonbbp.exeC:\Windows\system32\Flmonbbp.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2064
-
-
-
-
C:\Windows\SysWOW64\Dabhomea.exeC:\Windows\system32\Dabhomea.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316
-
C:\Windows\SysWOW64\Fongpm32.exeC:\Windows\system32\Fongpm32.exe1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1832 -
C:\Windows\SysWOW64\Fhflhcfa.exeC:\Windows\system32\Fhflhcfa.exe2⤵
- Executes dropped EXE
PID:732 -
C:\Windows\SysWOW64\Gklnem32.exeC:\Windows\system32\Gklnem32.exe3⤵
- Executes dropped EXE
PID:3580 -
C:\Windows\SysWOW64\Ghbkdald.exeC:\Windows\system32\Ghbkdald.exe4⤵
- Executes dropped EXE
PID:2488 -
C:\Windows\SysWOW64\Hcabhido.exeC:\Windows\system32\Hcabhido.exe5⤵
- Executes dropped EXE
PID:4652 -
C:\Windows\SysWOW64\Hklglk32.exeC:\Windows\system32\Hklglk32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2496
-
-
-
-
-
-
C:\Windows\SysWOW64\Hebkid32.exeC:\Windows\system32\Hebkid32.exe1⤵
- Executes dropped EXE
PID:5104 -
C:\Windows\SysWOW64\Hcflch32.exeC:\Windows\system32\Hcflch32.exe2⤵
- Executes dropped EXE
PID:2708 -
C:\Windows\SysWOW64\Ioafchai.exeC:\Windows\system32\Ioafchai.exe3⤵
- Executes dropped EXE
PID:2176 -
C:\Windows\SysWOW64\Ihndgmdd.exeC:\Windows\system32\Ihndgmdd.exe4⤵
- Executes dropped EXE
PID:1064 -
C:\Windows\SysWOW64\Jbkbkbfo.exeC:\Windows\system32\Jbkbkbfo.exe5⤵
- Executes dropped EXE
PID:5088 -
C:\Windows\SysWOW64\Joobdfei.exeC:\Windows\system32\Joobdfei.exe6⤵
- Executes dropped EXE
PID:2016 -
C:\Windows\SysWOW64\Kcbded32.exeC:\Windows\system32\Kcbded32.exe7⤵
- Executes dropped EXE
PID:3856 -
C:\Windows\SysWOW64\Kmjinjnj.exeC:\Windows\system32\Kmjinjnj.exe8⤵
- Executes dropped EXE
PID:1292 -
C:\Windows\SysWOW64\Kbgafqla.exeC:\Windows\system32\Kbgafqla.exe9⤵
- Executes dropped EXE
PID:5032 -
C:\Windows\SysWOW64\Kfejmobh.exeC:\Windows\system32\Kfejmobh.exe10⤵
- Executes dropped EXE
PID:3512 -
C:\Windows\SysWOW64\Lkiiee32.exeC:\Windows\system32\Lkiiee32.exe11⤵
- Executes dropped EXE
PID:456 -
C:\Windows\SysWOW64\Limioiia.exeC:\Windows\system32\Limioiia.exe12⤵
- Executes dropped EXE
- Modifies registry class
PID:5040 -
C:\Windows\SysWOW64\Lfcfnm32.exeC:\Windows\system32\Lfcfnm32.exe13⤵
- Executes dropped EXE
PID:1716 -
C:\Windows\SysWOW64\Mpkkgbmi.exeC:\Windows\system32\Mpkkgbmi.exe14⤵
- Executes dropped EXE
PID:3476 -
C:\Windows\SysWOW64\Ncbfcp32.exeC:\Windows\system32\Ncbfcp32.exe15⤵
- Executes dropped EXE
PID:1620 -
C:\Windows\SysWOW64\Npldnp32.exeC:\Windows\system32\Npldnp32.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4700 -
C:\Windows\SysWOW64\Qgdabflp.exeC:\Windows\system32\Qgdabflp.exe17⤵
- Executes dropped EXE
PID:5064 -
C:\Windows\SysWOW64\Fmejlcoj.exeC:\Windows\system32\Fmejlcoj.exe18⤵
- Executes dropped EXE
PID:4888 -
C:\Windows\SysWOW64\Glkdejcd.exeC:\Windows\system32\Glkdejcd.exe19⤵
- Executes dropped EXE
PID:2676 -
C:\Windows\SysWOW64\Ghadjkhh.exeC:\Windows\system32\Ghadjkhh.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1872 -
C:\Windows\SysWOW64\Gdkbdllj.exeC:\Windows\system32\Gdkbdllj.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1804 -
C:\Windows\SysWOW64\Heohinog.exeC:\Windows\system32\Heohinog.exe22⤵
- Executes dropped EXE
PID:4784 -
C:\Windows\SysWOW64\Hlmiagbo.exeC:\Windows\system32\Hlmiagbo.exe23⤵
- Executes dropped EXE
PID:1628 -
C:\Windows\SysWOW64\Iehkpmgl.exeC:\Windows\system32\Iehkpmgl.exe24⤵
- Executes dropped EXE
PID:4164 -
C:\Windows\SysWOW64\Iaokdn32.exeC:\Windows\system32\Iaokdn32.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1944 -
C:\Windows\SysWOW64\Idpdfija.exeC:\Windows\system32\Idpdfija.exe26⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1132 -
C:\Windows\SysWOW64\Ieoapl32.exeC:\Windows\system32\Ieoapl32.exe27⤵
- Executes dropped EXE
PID:4948 -
C:\Windows\SysWOW64\Jknfnbmi.exeC:\Windows\system32\Jknfnbmi.exe28⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4812 -
C:\Windows\SysWOW64\Jlnbhe32.exeC:\Windows\system32\Jlnbhe32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2580 -
C:\Windows\SysWOW64\Jakkplbc.exeC:\Windows\system32\Jakkplbc.exe30⤵
- Executes dropped EXE
PID:2904 -
C:\Windows\SysWOW64\Jhdcmf32.exeC:\Windows\system32\Jhdcmf32.exe31⤵
- Executes dropped EXE
PID:2244 -
C:\Windows\SysWOW64\Jamhflqq.exeC:\Windows\system32\Jamhflqq.exe32⤵
- Executes dropped EXE
PID:4836 -
C:\Windows\SysWOW64\Klibdcjo.exeC:\Windows\system32\Klibdcjo.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1444 -
C:\Windows\SysWOW64\Khbpndnp.exeC:\Windows\system32\Khbpndnp.exe34⤵
- Executes dropped EXE
- Modifies registry class
PID:3388 -
C:\Windows\SysWOW64\Lnkgbibj.exeC:\Windows\system32\Lnkgbibj.exe35⤵PID:3928
-
C:\Windows\SysWOW64\Niohap32.exeC:\Windows\system32\Niohap32.exe36⤵PID:680
-
C:\Windows\SysWOW64\Pekkhn32.exeC:\Windows\system32\Pekkhn32.exe37⤵PID:2392
-
C:\Windows\SysWOW64\Pllieg32.exeC:\Windows\system32\Pllieg32.exe38⤵
- Drops file in System32 directory
PID:880 -
C:\Windows\SysWOW64\Blnoad32.exeC:\Windows\system32\Blnoad32.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5000 -
C:\Windows\SysWOW64\Eqpfknbj.exeC:\Windows\system32\Eqpfknbj.exe40⤵
- Drops file in System32 directory
PID:3080 -
C:\Windows\SysWOW64\Encgdbqd.exeC:\Windows\system32\Encgdbqd.exe41⤵
- Modifies registry class
PID:2084 -
C:\Windows\SysWOW64\Efolidno.exeC:\Windows\system32\Efolidno.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1720 -
C:\Windows\SysWOW64\Fjoadbbc.exeC:\Windows\system32\Fjoadbbc.exe43⤵
- Modifies registry class
PID:768 -
C:\Windows\SysWOW64\Oilmhhfd.exeC:\Windows\system32\Oilmhhfd.exe44⤵PID:224
-
C:\Windows\SysWOW64\Ppphkq32.exeC:\Windows\system32\Ppphkq32.exe45⤵PID:2004
-
C:\Windows\SysWOW64\Qpikao32.exeC:\Windows\system32\Qpikao32.exe46⤵PID:3484
-
C:\Windows\SysWOW64\Aaldngqg.exeC:\Windows\system32\Aaldngqg.exe47⤵PID:2040
-
C:\Windows\SysWOW64\Blpemn32.exeC:\Windows\system32\Blpemn32.exe48⤵
- Modifies registry class
PID:2796 -
C:\Windows\SysWOW64\Bbjmih32.exeC:\Windows\system32\Bbjmih32.exe49⤵PID:3524
-
C:\Windows\SysWOW64\Ceppfbef.exeC:\Windows\system32\Ceppfbef.exe50⤵PID:2704
-
C:\Windows\SysWOW64\Clihcm32.exeC:\Windows\system32\Clihcm32.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3064 -
C:\Windows\SysWOW64\Dhgoimlo.exeC:\Windows\system32\Dhgoimlo.exe52⤵PID:1848
-
C:\Windows\SysWOW64\Doageg32.exeC:\Windows\system32\Doageg32.exe53⤵PID:4748
-
C:\Windows\SysWOW64\Dhjknljl.exeC:\Windows\system32\Dhjknljl.exe54⤵PID:892
-
C:\Windows\SysWOW64\Dphipidf.exeC:\Windows\system32\Dphipidf.exe55⤵
- Drops file in System32 directory
PID:3844 -
C:\Windows\SysWOW64\Ejegdngb.exeC:\Windows\system32\Ejegdngb.exe56⤵PID:3140
-
C:\Windows\SysWOW64\Ejgdim32.exeC:\Windows\system32\Ejgdim32.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5084 -
C:\Windows\SysWOW64\Emhmkh32.exeC:\Windows\system32\Emhmkh32.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:984 -
C:\Windows\SysWOW64\Gfqjkljn.exeC:\Windows\system32\Gfqjkljn.exe59⤵PID:1692
-
C:\Windows\SysWOW64\Ipckqnja.exeC:\Windows\system32\Ipckqnja.exe60⤵PID:64
-
C:\Windows\SysWOW64\Jkaadebl.exeC:\Windows\system32\Jkaadebl.exe61⤵PID:316
-
C:\Windows\SysWOW64\Kaemgn32.exeC:\Windows\system32\Kaemgn32.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4724 -
C:\Windows\SysWOW64\Kgbepdpf.exeC:\Windows\system32\Kgbepdpf.exe63⤵PID:3808
-
C:\Windows\SysWOW64\Lgnekcei.exeC:\Windows\system32\Lgnekcei.exe64⤵
- Modifies registry class
PID:4412 -
C:\Windows\SysWOW64\Mdaedgdb.exeC:\Windows\system32\Mdaedgdb.exe65⤵PID:3432
-
C:\Windows\SysWOW64\Mpkbohhd.exeC:\Windows\system32\Mpkbohhd.exe66⤵PID:1388
-
C:\Windows\SysWOW64\Maohdj32.exeC:\Windows\system32\Maohdj32.exe67⤵
- Drops file in System32 directory
PID:3580 -
C:\Windows\SysWOW64\Nqdeefpi.exeC:\Windows\system32\Nqdeefpi.exe68⤵PID:2768
-
C:\Windows\SysWOW64\Nkijbooo.exeC:\Windows\system32\Nkijbooo.exe69⤵PID:5104
-
C:\Windows\SysWOW64\Ndbnkefp.exeC:\Windows\system32\Ndbnkefp.exe70⤵PID:1840
-
C:\Windows\SysWOW64\Ncgkma32.exeC:\Windows\system32\Ncgkma32.exe71⤵
- Drops file in System32 directory
PID:5044 -
C:\Windows\SysWOW64\Nqklfe32.exeC:\Windows\system32\Nqklfe32.exe72⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4176 -
C:\Windows\SysWOW64\Nkqpcnig.exeC:\Windows\system32\Nkqpcnig.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2016 -
C:\Windows\SysWOW64\Odidld32.exeC:\Windows\system32\Odidld32.exe74⤵PID:1292
-
C:\Windows\SysWOW64\Ojfmdk32.exeC:\Windows\system32\Ojfmdk32.exe75⤵PID:4668
-
C:\Windows\SysWOW64\Okgfdm32.exeC:\Windows\system32\Okgfdm32.exe76⤵PID:2688
-
C:\Windows\SysWOW64\Ognginic.exeC:\Windows\system32\Ognginic.exe77⤵PID:3136
-
C:\Windows\SysWOW64\Oqgkadod.exeC:\Windows\system32\Oqgkadod.exe78⤵
- Drops file in System32 directory
PID:3620 -
C:\Windows\SysWOW64\Okloomoj.exeC:\Windows\system32\Okloomoj.exe79⤵PID:2484
-
C:\Windows\SysWOW64\Pqihgcma.exeC:\Windows\system32\Pqihgcma.exe80⤵PID:1340
-
C:\Windows\SysWOW64\Pgcpdn32.exeC:\Windows\system32\Pgcpdn32.exe81⤵PID:3768
-
C:\Windows\SysWOW64\Pbhdafdd.exeC:\Windows\system32\Pbhdafdd.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3932 -
C:\Windows\SysWOW64\Pgjfdm32.exeC:\Windows\system32\Pgjfdm32.exe83⤵PID:5060
-
C:\Windows\SysWOW64\Ahjoljqc.exeC:\Windows\system32\Ahjoljqc.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:732 -
C:\Windows\SysWOW64\Bajjeo32.exeC:\Windows\system32\Bajjeo32.exe85⤵
- Modifies registry class
PID:4840 -
C:\Windows\SysWOW64\Bonjnc32.exeC:\Windows\system32\Bonjnc32.exe86⤵PID:2308
-
C:\Windows\SysWOW64\Bdkbgj32.exeC:\Windows\system32\Bdkbgj32.exe87⤵PID:1064
-
C:\Windows\SysWOW64\Bblcda32.exeC:\Windows\system32\Bblcda32.exe88⤵PID:792
-
C:\Windows\SysWOW64\Chhkmh32.exeC:\Windows\system32\Chhkmh32.exe89⤵PID:4828
-
C:\Windows\SysWOW64\Cbnpja32.exeC:\Windows\system32\Cbnpja32.exe90⤵PID:1924
-
C:\Windows\SysWOW64\Caeiam32.exeC:\Windows\system32\Caeiam32.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5136 -
C:\Windows\SysWOW64\Dkbgeb32.exeC:\Windows\system32\Dkbgeb32.exe92⤵
- Modifies registry class
PID:5176 -
C:\Windows\SysWOW64\Daolgl32.exeC:\Windows\system32\Daolgl32.exe93⤵PID:5244
-
C:\Windows\SysWOW64\Fhpckb32.exeC:\Windows\system32\Fhpckb32.exe94⤵PID:5288
-
C:\Windows\SysWOW64\Fbihdhhf.exeC:\Windows\system32\Fbihdhhf.exe95⤵PID:5344
-
C:\Windows\SysWOW64\Gokdoj32.exeC:\Windows\system32\Gokdoj32.exe96⤵PID:5408
-
C:\Windows\SysWOW64\Ilpaei32.exeC:\Windows\system32\Ilpaei32.exe97⤵
- Modifies registry class
PID:5472 -
C:\Windows\SysWOW64\Jfaenqjm.exeC:\Windows\system32\Jfaenqjm.exe98⤵PID:5508
-
C:\Windows\SysWOW64\Jmknkk32.exeC:\Windows\system32\Jmknkk32.exe99⤵PID:5552
-
C:\Windows\SysWOW64\Jbgfca32.exeC:\Windows\system32\Jbgfca32.exe100⤵PID:5600
-
C:\Windows\SysWOW64\Jianpl32.exeC:\Windows\system32\Jianpl32.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5640 -
C:\Windows\SysWOW64\Jcgbmd32.exeC:\Windows\system32\Jcgbmd32.exe102⤵
- Modifies registry class
PID:5728 -
C:\Windows\SysWOW64\Kboldq32.exeC:\Windows\system32\Kboldq32.exe103⤵PID:5780
-
C:\Windows\SysWOW64\Kdnincal.exeC:\Windows\system32\Kdnincal.exe104⤵PID:5820
-
C:\Windows\SysWOW64\Kikafjoc.exeC:\Windows\system32\Kikafjoc.exe105⤵PID:5860
-
C:\Windows\SysWOW64\Kbceoped.exeC:\Windows\system32\Kbceoped.exe106⤵PID:5904
-
C:\Windows\SysWOW64\Kimnlj32.exeC:\Windows\system32\Kimnlj32.exe107⤵PID:5948
-
C:\Windows\SysWOW64\Kdcbic32.exeC:\Windows\system32\Kdcbic32.exe108⤵PID:5992
-
C:\Windows\SysWOW64\Lmppmh32.exeC:\Windows\system32\Lmppmh32.exe109⤵PID:6044
-
C:\Windows\SysWOW64\Lgmnqmam.exeC:\Windows\system32\Lgmnqmam.exe110⤵
- Drops file in System32 directory
PID:6076 -
C:\Windows\SysWOW64\Mdanjaqf.exeC:\Windows\system32\Mdanjaqf.exe111⤵
- Drops file in System32 directory
PID:6120 -
C:\Windows\SysWOW64\Mmiccf32.exeC:\Windows\system32\Mmiccf32.exe112⤵PID:5172
-
C:\Windows\SysWOW64\Mdckpqod.exeC:\Windows\system32\Mdckpqod.exe113⤵PID:1392
-
C:\Windows\SysWOW64\Mdjapphl.exeC:\Windows\system32\Mdjapphl.exe114⤵PID:4772
-
C:\Windows\SysWOW64\Npabeq32.exeC:\Windows\system32\Npabeq32.exe115⤵PID:1396
-
C:\Windows\SysWOW64\Ndagao32.exeC:\Windows\system32\Ndagao32.exe116⤵
- Drops file in System32 directory
PID:5280 -
C:\Windows\SysWOW64\Ojjoedfn.exeC:\Windows\system32\Ojjoedfn.exe117⤵PID:2752
-
C:\Windows\SysWOW64\Odocbmfd.exeC:\Windows\system32\Odocbmfd.exe118⤵PID:3172
-
C:\Windows\SysWOW64\Pjaefc32.exeC:\Windows\system32\Pjaefc32.exe119⤵PID:5392
-
C:\Windows\SysWOW64\Pdfjcl32.exeC:\Windows\system32\Pdfjcl32.exe120⤵PID:4816
-
C:\Windows\SysWOW64\Pqbdclak.exeC:\Windows\system32\Pqbdclak.exe121⤵PID:4304
-
C:\Windows\SysWOW64\Bfcompnj.exeC:\Windows\system32\Bfcompnj.exe122⤵
- Modifies registry class
PID:5492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-