Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
244s -
max time network
280s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
11/11/2023, 10:02
Behavioral task
behavioral1
Sample
NEAS.1b76b7a6ecfa58492f57e2dfe1b47a64.exe
Resource
win7-20231023-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.1b76b7a6ecfa58492f57e2dfe1b47a64.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
NEAS.1b76b7a6ecfa58492f57e2dfe1b47a64.exe
-
Size
367KB
-
MD5
1b76b7a6ecfa58492f57e2dfe1b47a64
-
SHA1
0a02bdf9e002e5b559d991cd576d8b2737948722
-
SHA256
e6f9197fb9cfdcff51d5cb605fba67a376c447cd6134eac1c632b0cf9f8768e8
-
SHA512
d70b64d02300664bc113548ed493e4e62f5bb6b4ebe6c2220839690d2c71a6e220b4faebeef7755301b89ca7e3fb5169d22d10d9073cd73d7317ec4eb86efe3e
-
SSDEEP
6144:nf0V94JTItnJfKXqPTX7D7FM6234lKm3mo8Yvi4KsLTFM6234lKm3cM9:Q9MktJCXqP77D7FB24lwR45FB24lqM
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Oadnlc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmiaad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Edeapm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hahnppmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kadafl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Khafhf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pingfn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pphochbo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Peehko32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Niednn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olhfdl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pcmadj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmbninke.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Picpfi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkmeob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Boihof32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgekdh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Algjpenp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qjmodpoe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pbdojdde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Plamnifp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Amnheklf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ngobnd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nlhnhglo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qldich32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fmbninke.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpmkal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pbihec32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Agjahooi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjkfhm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Paafllpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bkicch32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjefedjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fncfohel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fjefnckj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hbijhh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ncklne32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pbbbddfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pcmadj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bmbnpnjl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fiomjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Necbhi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qldich32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bjefedjq.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkhhpeka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nphbhm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nlhnhglo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bfqcfq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bhamhlfe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pnnlfd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pkfemdlp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pndaiokc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjneceek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Koknepgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nqhggjeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nqjcmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Oaoiglbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hpmkal32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lalgfk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mngneohg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Peehko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Alcfbl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgoief32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bjkfhm32.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x0003000000004ed7-5.dat family_berbew behavioral1/files/0x0003000000004ed7-11.dat family_berbew behavioral1/files/0x0003000000004ed7-13.dat family_berbew behavioral1/files/0x0003000000004ed7-12.dat family_berbew behavioral1/files/0x0003000000004ed7-8.dat family_berbew behavioral1/files/0x0032000000016bf8-19.dat family_berbew behavioral1/files/0x0032000000016bf8-21.dat family_berbew behavioral1/files/0x0032000000016bf8-22.dat family_berbew behavioral1/files/0x0032000000016bf8-27.dat family_berbew behavioral1/files/0x0032000000016bf8-26.dat family_berbew behavioral1/files/0x000f00000001225d-33.dat family_berbew behavioral1/files/0x000f00000001225d-37.dat family_berbew behavioral1/files/0x000f00000001225d-40.dat family_berbew behavioral1/files/0x000f00000001225d-36.dat family_berbew behavioral1/files/0x000f00000001225d-42.dat family_berbew behavioral1/files/0x0008000000016cbc-50.dat family_berbew behavioral1/files/0x0008000000016cbc-53.dat family_berbew behavioral1/files/0x0008000000016cbc-49.dat family_berbew behavioral1/files/0x0008000000016cbc-47.dat family_berbew behavioral1/files/0x0008000000016cbc-55.dat family_berbew behavioral1/memory/1924-54-0x00000000002C0000-0x0000000000303000-memory.dmp family_berbew behavioral1/files/0x0007000000016cdd-68.dat family_berbew behavioral1/files/0x0007000000016cdd-69.dat family_berbew behavioral1/files/0x0007000000016cdd-65.dat family_berbew behavioral1/files/0x0007000000016cdd-64.dat family_berbew behavioral1/files/0x0007000000016cdd-62.dat family_berbew behavioral1/files/0x0009000000016cf7-75.dat family_berbew behavioral1/files/0x0009000000016cf7-77.dat family_berbew behavioral1/files/0x0009000000016cf7-78.dat family_berbew behavioral1/files/0x0009000000016cf7-82.dat family_berbew behavioral1/files/0x0007000000016d50-84.dat family_berbew behavioral1/files/0x0007000000016d50-95.dat family_berbew behavioral1/files/0x0007000000016d50-96.dat family_berbew behavioral1/files/0x0007000000016d50-91.dat family_berbew behavioral1/files/0x0009000000016cf7-83.dat family_berbew behavioral1/files/0x0007000000016d50-89.dat family_berbew behavioral1/files/0x0006000000016e5e-103.dat family_berbew behavioral1/files/0x0006000000016e5e-106.dat family_berbew behavioral1/files/0x0006000000016e5e-109.dat family_berbew behavioral1/files/0x0006000000016e5e-111.dat family_berbew behavioral1/files/0x0006000000016e5e-105.dat family_berbew behavioral1/files/0x0006000000017081-116.dat family_berbew behavioral1/files/0x0006000000017081-120.dat family_berbew behavioral1/files/0x0006000000017081-123.dat family_berbew behavioral1/files/0x0006000000017081-125.dat family_berbew behavioral1/files/0x0006000000017081-119.dat family_berbew behavioral1/files/0x000600000001741f-137.dat family_berbew behavioral1/files/0x000600000001741f-136.dat family_berbew behavioral1/files/0x000600000001741f-133.dat family_berbew behavioral1/files/0x000600000001741f-132.dat family_berbew behavioral1/files/0x000600000001741f-130.dat family_berbew behavioral1/files/0x000500000001866f-144.dat family_berbew behavioral1/files/0x000500000001866f-148.dat family_berbew behavioral1/files/0x000500000001866f-151.dat family_berbew behavioral1/files/0x000500000001866f-147.dat family_berbew behavioral1/files/0x000500000001866f-152.dat family_berbew behavioral1/files/0x00050000000186c9-157.dat family_berbew behavioral1/files/0x00050000000186c9-159.dat family_berbew behavioral1/files/0x00050000000186c9-162.dat family_berbew behavioral1/files/0x00050000000186c9-165.dat family_berbew behavioral1/files/0x00050000000186c9-164.dat family_berbew behavioral1/files/0x0005000000018711-171.dat family_berbew behavioral1/files/0x0005000000018711-175.dat family_berbew behavioral1/files/0x0005000000018711-180.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2648 Ahpfoa32.exe 2432 Hinlck32.exe 1924 Jfdigocb.exe 2868 Jhebij32.exe 2124 Jkhhpeka.exe 1376 Kgoief32.exe 2036 Kffblb32.exe 2612 Koogdg32.exe 1188 Lfmhla32.exe 2844 Lgcooh32.exe 860 Lgekdh32.exe 848 Niednn32.exe 2024 Nlfmoidh.exe 2944 Nphbhm32.exe 436 Nibcgb32.exe 2144 Olclimif.exe 2388 Olhfdl32.exe 1468 Oadnlc32.exe 1076 Pnnlfd32.exe 1104 Pcmadj32.exe 1760 Pconjjql.exe 584 Pfpflenm.exe 1916 Acqpdgni.exe 1400 Ecidbfbb.exe 1012 Albpef32.exe 2540 Aekenl32.exe 2860 Agjahooi.exe 2532 Algjpenp.exe 2564 Afpnikda.exe 2452 Abfonl32.exe 2892 Bkocgape.exe 2720 Bdghpggf.exe 112 Bkapla32.exe 1192 Bqnidh32.exe 1088 Bheqfe32.exe 1768 Bnbinl32.exe 1612 Bmgfoi32.exe 2840 Bjkfhm32.exe 1704 Cqeoegfb.exe 2028 Cpoeac32.exe 1712 Cbmann32.exe 1716 Cigijhne.exe 2056 Dbbkhnbc.exe 2336 Dljoac32.exe 2320 Dhapfd32.exe 1956 Eheeqgmn.exe 1932 Fmbninke.exe 1152 Fdlfeh32.exe 1072 Fkfobbjo.exe 2032 Fdockgqp.exe 2960 Fkhkha32.exe 1888 Fdapqgom.exe 2816 Gkhgge32.exe 2968 Gadlio32.exe 1016 Gkmabdfb.exe 2328 Hdeekjmc.exe 2704 Hjbncqkj.exe 1248 Iaqljman.exe 2928 Fncfohel.exe 2596 Kmiaad32.exe 1564 Picpfi32.exe 2556 Pkfemdlp.exe 2492 Pndaiokc.exe 524 Qenjfi32.exe -
Loads dropped DLL 64 IoCs
pid Process 2788 NEAS.1b76b7a6ecfa58492f57e2dfe1b47a64.exe 2788 NEAS.1b76b7a6ecfa58492f57e2dfe1b47a64.exe 2648 Ahpfoa32.exe 2648 Ahpfoa32.exe 2432 Hinlck32.exe 2432 Hinlck32.exe 1924 Jfdigocb.exe 1924 Jfdigocb.exe 2868 Jhebij32.exe 2868 Jhebij32.exe 2124 Jkhhpeka.exe 2124 Jkhhpeka.exe 1376 Kgoief32.exe 1376 Kgoief32.exe 2036 Kffblb32.exe 2036 Kffblb32.exe 2612 Koogdg32.exe 2612 Koogdg32.exe 1188 Lfmhla32.exe 1188 Lfmhla32.exe 2844 Lgcooh32.exe 2844 Lgcooh32.exe 860 Lgekdh32.exe 860 Lgekdh32.exe 848 Niednn32.exe 848 Niednn32.exe 2024 Nlfmoidh.exe 2024 Nlfmoidh.exe 2944 Nphbhm32.exe 2944 Nphbhm32.exe 436 Nibcgb32.exe 436 Nibcgb32.exe 2144 Olclimif.exe 2144 Olclimif.exe 2388 Olhfdl32.exe 2388 Olhfdl32.exe 1468 Oadnlc32.exe 1468 Oadnlc32.exe 1076 Pnnlfd32.exe 1076 Pnnlfd32.exe 1104 Pcmadj32.exe 1104 Pcmadj32.exe 1760 Pconjjql.exe 1760 Pconjjql.exe 584 Pfpflenm.exe 584 Pfpflenm.exe 1916 Acqpdgni.exe 1916 Acqpdgni.exe 1400 Ecidbfbb.exe 1400 Ecidbfbb.exe 1012 Albpef32.exe 1012 Albpef32.exe 2540 Aekenl32.exe 2540 Aekenl32.exe 2860 Agjahooi.exe 2860 Agjahooi.exe 2532 Algjpenp.exe 2532 Algjpenp.exe 2564 Afpnikda.exe 2564 Afpnikda.exe 2452 Abfonl32.exe 2452 Abfonl32.exe 2892 Bkocgape.exe 2892 Bkocgape.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Ljfkgm32.dll Aepbjlci.exe File created C:\Windows\SysWOW64\Fmofgomd.dll Lkdloakn.exe File opened for modification C:\Windows\SysWOW64\Nfleppnh.exe Nmcagjgg.exe File created C:\Windows\SysWOW64\Glmgdfdh.dll Pnnlfd32.exe File opened for modification C:\Windows\SysWOW64\Bmpajn32.exe Bhchag32.exe File opened for modification C:\Windows\SysWOW64\Ddchlj32.exe Dgphbfoc.exe File opened for modification C:\Windows\SysWOW64\Nqjcmj32.exe Njpkpp32.exe File opened for modification C:\Windows\SysWOW64\Aobbng32.exe Alcfbl32.exe File created C:\Windows\SysWOW64\Agjahooi.exe Aekenl32.exe File opened for modification C:\Windows\SysWOW64\Agjahooi.exe Aekenl32.exe File created C:\Windows\SysWOW64\Qdqpab32.dll Algjpenp.exe File created C:\Windows\SysWOW64\Dfgaibbh.exe Ddfeaj32.exe File created C:\Windows\SysWOW64\Eglojk32.dll Lhccnf32.exe File created C:\Windows\SysWOW64\Nlfmoidh.exe Niednn32.exe File opened for modification C:\Windows\SysWOW64\Nibcgb32.exe Nphbhm32.exe File created C:\Windows\SysWOW64\Ggniamja.dll Nphbhm32.exe File opened for modification C:\Windows\SysWOW64\Acqpdgni.exe Pfpflenm.exe File opened for modification C:\Windows\SysWOW64\Ecidbfbb.exe Acqpdgni.exe File created C:\Windows\SysWOW64\Abfonl32.exe Afpnikda.exe File opened for modification C:\Windows\SysWOW64\Picpfi32.exe Kmiaad32.exe File created C:\Windows\SysWOW64\Bmpajn32.exe Bhchag32.exe File opened for modification C:\Windows\SysWOW64\Fdhnfmmb.exe Fbiajano.exe File opened for modification C:\Windows\SysWOW64\Fjgcdc32.exe Fejkklkp.exe File created C:\Windows\SysWOW64\Klojje32.dll Acqpdgni.exe File created C:\Windows\SysWOW64\Hejcic32.exe Hbkgmh32.exe File opened for modification C:\Windows\SysWOW64\Mdoimibg.exe Mndapo32.exe File created C:\Windows\SysWOW64\Edjjfpjc.dll Bcknhjcd.exe File created C:\Windows\SysWOW64\Hldlnabb.dll Jfdigocb.exe File created C:\Windows\SysWOW64\Hbijhh32.exe Hahnppmh.exe File created C:\Windows\SysWOW64\Efbcep32.dll Khafhf32.exe File opened for modification C:\Windows\SysWOW64\Bjefedjq.exe Bcknhjcd.exe File created C:\Windows\SysWOW64\Nqhggjeh.exe Ngobnd32.exe File created C:\Windows\SysWOW64\Olodif32.exe Opffoe32.exe File created C:\Windows\SysWOW64\Kmiaad32.exe Fncfohel.exe File created C:\Windows\SysWOW64\Jifohp32.dll Egfnceik.exe File opened for modification C:\Windows\SysWOW64\Hejcic32.exe Hbkgmh32.exe File created C:\Windows\SysWOW64\Bkocgape.exe Abfonl32.exe File created C:\Windows\SysWOW64\Cfoneinm.dll Nqhggjeh.exe File created C:\Windows\SysWOW64\Bnoaee32.dll Agjahooi.exe File created C:\Windows\SysWOW64\Fdlfeh32.exe Fmbninke.exe File created C:\Windows\SysWOW64\Bpmnbjom.dll Oaoiglbl.exe File opened for modification C:\Windows\SysWOW64\Paafllpi.exe Pijnkoog.exe File created C:\Windows\SysWOW64\Lgcooh32.exe Lfmhla32.exe File created C:\Windows\SysWOW64\Lcfiggpo.dll Aekenl32.exe File opened for modification C:\Windows\SysWOW64\Kkmeob32.exe Kadafl32.exe File opened for modification C:\Windows\SysWOW64\Ofieicbf.exe Oehhbk32.exe File created C:\Windows\SysWOW64\Pfkphdpe.dll Alcfbl32.exe File opened for modification C:\Windows\SysWOW64\Cbmann32.exe Cpoeac32.exe File created C:\Windows\SysWOW64\Ehnbjhpf.dll Gadlio32.exe File created C:\Windows\SysWOW64\Ldgain32.dll Cdlbkk32.exe File created C:\Windows\SysWOW64\Icngpe32.dll Dgbdhe32.exe File opened for modification C:\Windows\SysWOW64\Lhccnf32.exe Koknepgl.exe File created C:\Windows\SysWOW64\Gppeej32.dll Paafllpi.exe File created C:\Windows\SysWOW64\Olhfdl32.exe Olclimif.exe File created C:\Windows\SysWOW64\Pjhhelpk.dll Cigijhne.exe File opened for modification C:\Windows\SysWOW64\Dljoac32.exe Dbbkhnbc.exe File created C:\Windows\SysWOW64\Oepcbpdp.dll Geemoqaq.exe File created C:\Windows\SysWOW64\Ofieicbf.exe Oehhbk32.exe File created C:\Windows\SysWOW64\Fdnfliad.dll Pmhfamen.exe File created C:\Windows\SysWOW64\Koogdg32.exe Kffblb32.exe File created C:\Windows\SysWOW64\Pdapemfi.dll Bnbinl32.exe File opened for modification C:\Windows\SysWOW64\Egaqgi32.exe Egfnceik.exe File created C:\Windows\SysWOW64\Ojbpjhnm.dll Hjneceek.exe File created C:\Windows\SysWOW64\Lbdlpf32.dll Kkmeob32.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pkfemdlp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Eheeqgmn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bhallgpj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ncklne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oehhbk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fkhkha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pbdojdde.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ajgfkpeb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bjbiod32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bkapla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fjefnckj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ofieicbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lfmhla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhkbak32.dll" Lfmhla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Paafllpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odiakbkn.dll" Pbbbddfg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ahpfoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egfpad32.dll" Fncfohel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Plamnifp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pppifi32.dll" Olclimif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gkhgge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icngpe32.dll" Dgbdhe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nfleppnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enomgh32.dll" Qmefkajl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nibcgb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hbkgmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kkmeob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Celenfkc.dll" Bkicch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edjjfpjc.dll" Bcknhjcd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fjgcdc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lgekdh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Abfonl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cpoeac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmcllj32.dll" Bmpajn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebdpch32.dll" Dgphbfoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgnfedkf.dll" Iaqljman.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pingfn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbbpalfp.dll" Ldlphf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Olodif32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831} NEAS.1b76b7a6ecfa58492f57e2dfe1b47a64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmgjje32.dll" Niednn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ookjbg32.dll" Fdlfeh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Beelel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gooonpjo.dll" Kadafl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kljbgb32.dll" Qldich32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Albpef32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dhapfd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Eheeqgmn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pijnkoog.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pbihec32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dckbme32.dll" Fkhkha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Qenjfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcjomi32.dll" Ofieicbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aiglji32.dll" Nalpbi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Deloen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eglojk32.dll" Lhccnf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcbmjf32.dll" Lpogbhkh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node NEAS.1b76b7a6ecfa58492f57e2dfe1b47a64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbkmanki.dll" NEAS.1b76b7a6ecfa58492f57e2dfe1b47a64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Afpnikda.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkqnod32.dll" Eheeqgmn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kmiaad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bjbiod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbmhmj32.dll" Cjgbjchn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2788 wrote to memory of 2648 2788 NEAS.1b76b7a6ecfa58492f57e2dfe1b47a64.exe 28 PID 2788 wrote to memory of 2648 2788 NEAS.1b76b7a6ecfa58492f57e2dfe1b47a64.exe 28 PID 2788 wrote to memory of 2648 2788 NEAS.1b76b7a6ecfa58492f57e2dfe1b47a64.exe 28 PID 2788 wrote to memory of 2648 2788 NEAS.1b76b7a6ecfa58492f57e2dfe1b47a64.exe 28 PID 2648 wrote to memory of 2432 2648 Ahpfoa32.exe 29 PID 2648 wrote to memory of 2432 2648 Ahpfoa32.exe 29 PID 2648 wrote to memory of 2432 2648 Ahpfoa32.exe 29 PID 2648 wrote to memory of 2432 2648 Ahpfoa32.exe 29 PID 2432 wrote to memory of 1924 2432 Hinlck32.exe 30 PID 2432 wrote to memory of 1924 2432 Hinlck32.exe 30 PID 2432 wrote to memory of 1924 2432 Hinlck32.exe 30 PID 2432 wrote to memory of 1924 2432 Hinlck32.exe 30 PID 1924 wrote to memory of 2868 1924 Jfdigocb.exe 31 PID 1924 wrote to memory of 2868 1924 Jfdigocb.exe 31 PID 1924 wrote to memory of 2868 1924 Jfdigocb.exe 31 PID 1924 wrote to memory of 2868 1924 Jfdigocb.exe 31 PID 2868 wrote to memory of 2124 2868 Jhebij32.exe 32 PID 2868 wrote to memory of 2124 2868 Jhebij32.exe 32 PID 2868 wrote to memory of 2124 2868 Jhebij32.exe 32 PID 2868 wrote to memory of 2124 2868 Jhebij32.exe 32 PID 2124 wrote to memory of 1376 2124 Jkhhpeka.exe 33 PID 2124 wrote to memory of 1376 2124 Jkhhpeka.exe 33 PID 2124 wrote to memory of 1376 2124 Jkhhpeka.exe 33 PID 2124 wrote to memory of 1376 2124 Jkhhpeka.exe 33 PID 1376 wrote to memory of 2036 1376 Kgoief32.exe 34 PID 1376 wrote to memory of 2036 1376 Kgoief32.exe 34 PID 1376 wrote to memory of 2036 1376 Kgoief32.exe 34 PID 1376 wrote to memory of 2036 1376 Kgoief32.exe 34 PID 2036 wrote to memory of 2612 2036 Kffblb32.exe 35 PID 2036 wrote to memory of 2612 2036 Kffblb32.exe 35 PID 2036 wrote to memory of 2612 2036 Kffblb32.exe 35 PID 2036 wrote to memory of 2612 2036 Kffblb32.exe 35 PID 2612 wrote to memory of 1188 2612 Koogdg32.exe 36 PID 2612 wrote to memory of 1188 2612 Koogdg32.exe 36 PID 2612 wrote to memory of 1188 2612 Koogdg32.exe 36 PID 2612 wrote to memory of 1188 2612 Koogdg32.exe 36 PID 1188 wrote to memory of 2844 1188 Lfmhla32.exe 37 PID 1188 wrote to memory of 2844 1188 Lfmhla32.exe 37 PID 1188 wrote to memory of 2844 1188 Lfmhla32.exe 37 PID 1188 wrote to memory of 2844 1188 Lfmhla32.exe 37 PID 2844 wrote to memory of 860 2844 Lgcooh32.exe 38 PID 2844 wrote to memory of 860 2844 Lgcooh32.exe 38 PID 2844 wrote to memory of 860 2844 Lgcooh32.exe 38 PID 2844 wrote to memory of 860 2844 Lgcooh32.exe 38 PID 860 wrote to memory of 848 860 Lgekdh32.exe 39 PID 860 wrote to memory of 848 860 Lgekdh32.exe 39 PID 860 wrote to memory of 848 860 Lgekdh32.exe 39 PID 860 wrote to memory of 848 860 Lgekdh32.exe 39 PID 848 wrote to memory of 2024 848 Niednn32.exe 40 PID 848 wrote to memory of 2024 848 Niednn32.exe 40 PID 848 wrote to memory of 2024 848 Niednn32.exe 40 PID 848 wrote to memory of 2024 848 Niednn32.exe 40 PID 2024 wrote to memory of 2944 2024 Nlfmoidh.exe 41 PID 2024 wrote to memory of 2944 2024 Nlfmoidh.exe 41 PID 2024 wrote to memory of 2944 2024 Nlfmoidh.exe 41 PID 2024 wrote to memory of 2944 2024 Nlfmoidh.exe 41 PID 2944 wrote to memory of 436 2944 Nphbhm32.exe 42 PID 2944 wrote to memory of 436 2944 Nphbhm32.exe 42 PID 2944 wrote to memory of 436 2944 Nphbhm32.exe 42 PID 2944 wrote to memory of 436 2944 Nphbhm32.exe 42 PID 436 wrote to memory of 2144 436 Nibcgb32.exe 43 PID 436 wrote to memory of 2144 436 Nibcgb32.exe 43 PID 436 wrote to memory of 2144 436 Nibcgb32.exe 43 PID 436 wrote to memory of 2144 436 Nibcgb32.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.1b76b7a6ecfa58492f57e2dfe1b47a64.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.1b76b7a6ecfa58492f57e2dfe1b47a64.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\Ahpfoa32.exeC:\Windows\system32\Ahpfoa32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\Hinlck32.exeC:\Windows\system32\Hinlck32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\Jfdigocb.exeC:\Windows\system32\Jfdigocb.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\Jhebij32.exeC:\Windows\system32\Jhebij32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\Jkhhpeka.exeC:\Windows\system32\Jkhhpeka.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\Kgoief32.exeC:\Windows\system32\Kgoief32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\Kffblb32.exeC:\Windows\system32\Kffblb32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\Koogdg32.exeC:\Windows\system32\Koogdg32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\Lfmhla32.exeC:\Windows\system32\Lfmhla32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\Lgcooh32.exeC:\Windows\system32\Lgcooh32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\Lgekdh32.exeC:\Windows\system32\Lgekdh32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\Niednn32.exeC:\Windows\system32\Niednn32.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\Nlfmoidh.exeC:\Windows\system32\Nlfmoidh.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\Nphbhm32.exeC:\Windows\system32\Nphbhm32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\Nibcgb32.exeC:\Windows\system32\Nibcgb32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\Olclimif.exeC:\Windows\system32\Olclimif.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2144 -
C:\Windows\SysWOW64\Olhfdl32.exeC:\Windows\system32\Olhfdl32.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Windows\SysWOW64\Oadnlc32.exeC:\Windows\system32\Oadnlc32.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Windows\SysWOW64\Pnnlfd32.exeC:\Windows\system32\Pnnlfd32.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1076 -
C:\Windows\SysWOW64\Pcmadj32.exeC:\Windows\system32\Pcmadj32.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Windows\SysWOW64\Pconjjql.exeC:\Windows\system32\Pconjjql.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Windows\SysWOW64\Pfpflenm.exeC:\Windows\system32\Pfpflenm.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:584 -
C:\Windows\SysWOW64\Acqpdgni.exeC:\Windows\system32\Acqpdgni.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1916 -
C:\Windows\SysWOW64\Ecidbfbb.exeC:\Windows\system32\Ecidbfbb.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Windows\SysWOW64\Albpef32.exeC:\Windows\system32\Albpef32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1012 -
C:\Windows\SysWOW64\Aekenl32.exeC:\Windows\system32\Aekenl32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2540 -
C:\Windows\SysWOW64\Agjahooi.exeC:\Windows\system32\Agjahooi.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2860 -
C:\Windows\SysWOW64\Algjpenp.exeC:\Windows\system32\Algjpenp.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2532 -
C:\Windows\SysWOW64\Afpnikda.exeC:\Windows\system32\Afpnikda.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2564 -
C:\Windows\SysWOW64\Abfonl32.exeC:\Windows\system32\Abfonl32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2452 -
C:\Windows\SysWOW64\Bkocgape.exeC:\Windows\system32\Bkocgape.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Windows\SysWOW64\Bdghpggf.exeC:\Windows\system32\Bdghpggf.exe33⤵
- Executes dropped EXE
PID:2720 -
C:\Windows\SysWOW64\Bkapla32.exeC:\Windows\system32\Bkapla32.exe34⤵
- Executes dropped EXE
- Modifies registry class
PID:112 -
C:\Windows\SysWOW64\Bqnidh32.exeC:\Windows\system32\Bqnidh32.exe35⤵
- Executes dropped EXE
PID:1192 -
C:\Windows\SysWOW64\Bheqfe32.exeC:\Windows\system32\Bheqfe32.exe36⤵
- Executes dropped EXE
PID:1088 -
C:\Windows\SysWOW64\Bnbinl32.exeC:\Windows\system32\Bnbinl32.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1768 -
C:\Windows\SysWOW64\Bmgfoi32.exeC:\Windows\system32\Bmgfoi32.exe38⤵
- Executes dropped EXE
PID:1612 -
C:\Windows\SysWOW64\Bjkfhm32.exeC:\Windows\system32\Bjkfhm32.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2840 -
C:\Windows\SysWOW64\Cqeoegfb.exeC:\Windows\system32\Cqeoegfb.exe40⤵
- Executes dropped EXE
PID:1704 -
C:\Windows\SysWOW64\Cpoeac32.exeC:\Windows\system32\Cpoeac32.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2028 -
C:\Windows\SysWOW64\Cbmann32.exeC:\Windows\system32\Cbmann32.exe42⤵
- Executes dropped EXE
PID:1712 -
C:\Windows\SysWOW64\Cigijhne.exeC:\Windows\system32\Cigijhne.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1716 -
C:\Windows\SysWOW64\Dbbkhnbc.exeC:\Windows\system32\Dbbkhnbc.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2056 -
C:\Windows\SysWOW64\Dljoac32.exeC:\Windows\system32\Dljoac32.exe45⤵
- Executes dropped EXE
PID:2336 -
C:\Windows\SysWOW64\Dhapfd32.exeC:\Windows\system32\Dhapfd32.exe46⤵
- Executes dropped EXE
- Modifies registry class
PID:2320 -
C:\Windows\SysWOW64\Eheeqgmn.exeC:\Windows\system32\Eheeqgmn.exe47⤵
- Executes dropped EXE
- Modifies registry class
PID:1956 -
C:\Windows\SysWOW64\Fmbninke.exeC:\Windows\system32\Fmbninke.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1932 -
C:\Windows\SysWOW64\Fdlfeh32.exeC:\Windows\system32\Fdlfeh32.exe49⤵
- Executes dropped EXE
- Modifies registry class
PID:1152 -
C:\Windows\SysWOW64\Fkfobbjo.exeC:\Windows\system32\Fkfobbjo.exe50⤵
- Executes dropped EXE
PID:1072 -
C:\Windows\SysWOW64\Fdockgqp.exeC:\Windows\system32\Fdockgqp.exe51⤵
- Executes dropped EXE
PID:2032 -
C:\Windows\SysWOW64\Fkhkha32.exeC:\Windows\system32\Fkhkha32.exe52⤵
- Executes dropped EXE
- Modifies registry class
PID:2960 -
C:\Windows\SysWOW64\Fdapqgom.exeC:\Windows\system32\Fdapqgom.exe53⤵
- Executes dropped EXE
PID:1888 -
C:\Windows\SysWOW64\Gkhgge32.exeC:\Windows\system32\Gkhgge32.exe54⤵
- Executes dropped EXE
- Modifies registry class
PID:2816 -
C:\Windows\SysWOW64\Gadlio32.exeC:\Windows\system32\Gadlio32.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2968 -
C:\Windows\SysWOW64\Gkmabdfb.exeC:\Windows\system32\Gkmabdfb.exe56⤵
- Executes dropped EXE
PID:1016 -
C:\Windows\SysWOW64\Hdeekjmc.exeC:\Windows\system32\Hdeekjmc.exe57⤵
- Executes dropped EXE
PID:2328 -
C:\Windows\SysWOW64\Hjbncqkj.exeC:\Windows\system32\Hjbncqkj.exe58⤵
- Executes dropped EXE
PID:2704 -
C:\Windows\SysWOW64\Iaqljman.exeC:\Windows\system32\Iaqljman.exe59⤵
- Executes dropped EXE
- Modifies registry class
PID:1248 -
C:\Windows\SysWOW64\Fncfohel.exeC:\Windows\system32\Fncfohel.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2928 -
C:\Windows\SysWOW64\Kmiaad32.exeC:\Windows\system32\Kmiaad32.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2596 -
C:\Windows\SysWOW64\Picpfi32.exeC:\Windows\system32\Picpfi32.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1564 -
C:\Windows\SysWOW64\Pkfemdlp.exeC:\Windows\system32\Pkfemdlp.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2556 -
C:\Windows\SysWOW64\Pndaiokc.exeC:\Windows\system32\Pndaiokc.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2492 -
C:\Windows\SysWOW64\Qenjfi32.exeC:\Windows\system32\Qenjfi32.exe65⤵
- Executes dropped EXE
- Modifies registry class
PID:524 -
C:\Windows\SysWOW64\Qbbjon32.exeC:\Windows\system32\Qbbjon32.exe66⤵PID:2408
-
C:\Windows\SysWOW64\Qjmodpoe.exeC:\Windows\system32\Qjmodpoe.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1068 -
C:\Windows\SysWOW64\Ajplipmb.exeC:\Windows\system32\Ajplipmb.exe68⤵PID:1200
-
C:\Windows\SysWOW64\Amnheklf.exeC:\Windows\system32\Amnheklf.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1952 -
C:\Windows\SysWOW64\Aepbjlci.exeC:\Windows\system32\Aepbjlci.exe70⤵
- Drops file in System32 directory
PID:2040 -
C:\Windows\SysWOW64\Bbdcdqbc.exeC:\Windows\system32\Bbdcdqbc.exe71⤵PID:1580
-
C:\Windows\SysWOW64\Bhallgpj.exeC:\Windows\system32\Bhallgpj.exe72⤵
- Modifies registry class
PID:1664 -
C:\Windows\SysWOW64\Beelel32.exeC:\Windows\system32\Beelel32.exe73⤵
- Modifies registry class
PID:2952 -
C:\Windows\SysWOW64\Bhchag32.exeC:\Windows\system32\Bhchag32.exe74⤵
- Drops file in System32 directory
PID:2948 -
C:\Windows\SysWOW64\Bmpajn32.exeC:\Windows\system32\Bmpajn32.exe75⤵
- Modifies registry class
PID:2352 -
C:\Windows\SysWOW64\Bhfegg32.exeC:\Windows\system32\Bhfegg32.exe76⤵PID:2096
-
C:\Windows\SysWOW64\Bmbnpnjl.exeC:\Windows\system32\Bmbnpnjl.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1544 -
C:\Windows\SysWOW64\Bhhbmfjb.exeC:\Windows\system32\Bhhbmfjb.exe78⤵PID:1752
-
C:\Windows\SysWOW64\Cdlbkk32.exeC:\Windows\system32\Cdlbkk32.exe79⤵
- Drops file in System32 directory
PID:2464 -
C:\Windows\SysWOW64\Dobfhd32.exeC:\Windows\system32\Dobfhd32.exe80⤵PID:2356
-
C:\Windows\SysWOW64\Deloen32.exeC:\Windows\system32\Deloen32.exe81⤵
- Modifies registry class
PID:2284 -
C:\Windows\SysWOW64\Dodcncbh.exeC:\Windows\system32\Dodcncbh.exe82⤵PID:1412
-
C:\Windows\SysWOW64\Dgphbfoc.exeC:\Windows\system32\Dgphbfoc.exe83⤵
- Drops file in System32 directory
- Modifies registry class
PID:2648 -
C:\Windows\SysWOW64\Ddchlj32.exeC:\Windows\system32\Ddchlj32.exe84⤵PID:1920
-
C:\Windows\SysWOW64\Dgbdhe32.exeC:\Windows\system32\Dgbdhe32.exe85⤵
- Drops file in System32 directory
- Modifies registry class
PID:2188 -
C:\Windows\SysWOW64\Ddfeaj32.exeC:\Windows\system32\Ddfeaj32.exe86⤵
- Drops file in System32 directory
PID:368 -
C:\Windows\SysWOW64\Dfgaibbh.exeC:\Windows\system32\Dfgaibbh.exe87⤵PID:840
-
C:\Windows\SysWOW64\Doofbg32.exeC:\Windows\system32\Doofbg32.exe88⤵PID:2860
-
C:\Windows\SysWOW64\Egfnceik.exeC:\Windows\system32\Egfnceik.exe89⤵
- Drops file in System32 directory
PID:1612 -
C:\Windows\SysWOW64\Egaqgi32.exeC:\Windows\system32\Egaqgi32.exe90⤵PID:2540
-
C:\Windows\SysWOW64\Enliccgh.exeC:\Windows\system32\Enliccgh.exe91⤵PID:1768
-
C:\Windows\SysWOW64\Edeapm32.exeC:\Windows\system32\Edeapm32.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2292 -
C:\Windows\SysWOW64\Fbiajano.exeC:\Windows\system32\Fbiajano.exe93⤵
- Drops file in System32 directory
PID:1152 -
C:\Windows\SysWOW64\Fdhnfmmb.exeC:\Windows\system32\Fdhnfmmb.exe94⤵PID:1104
-
C:\Windows\SysWOW64\Fjefnckj.exeC:\Windows\system32\Fjefnckj.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:888 -
C:\Windows\SysWOW64\Fejkklkp.exeC:\Windows\system32\Fejkklkp.exe96⤵
- Drops file in System32 directory
PID:2764 -
C:\Windows\SysWOW64\Fjgcdc32.exeC:\Windows\system32\Fjgcdc32.exe97⤵
- Modifies registry class
PID:3052 -
C:\Windows\SysWOW64\Fjipic32.exeC:\Windows\system32\Fjipic32.exe98⤵PID:2912
-
C:\Windows\SysWOW64\Fachfmna.exeC:\Windows\system32\Fachfmna.exe99⤵PID:2684
-
C:\Windows\SysWOW64\Fbddne32.exeC:\Windows\system32\Fbddne32.exe100⤵PID:3016
-
C:\Windows\SysWOW64\Fiomjp32.exeC:\Windows\system32\Fiomjp32.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:588 -
C:\Windows\SysWOW64\Geemoqaq.exeC:\Windows\system32\Geemoqaq.exe102⤵
- Drops file in System32 directory
PID:3000 -
C:\Windows\SysWOW64\Hjneceek.exeC:\Windows\system32\Hjneceek.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1120 -
C:\Windows\SysWOW64\Hahnppmh.exeC:\Windows\system32\Hahnppmh.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2428 -
C:\Windows\SysWOW64\Hbijhh32.exeC:\Windows\system32\Hbijhh32.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:620 -
C:\Windows\SysWOW64\Hmoneq32.exeC:\Windows\system32\Hmoneq32.exe106⤵PID:952
-
C:\Windows\SysWOW64\Hpmkal32.exeC:\Windows\system32\Hpmkal32.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1368 -
C:\Windows\SysWOW64\Hbkgmh32.exeC:\Windows\system32\Hbkgmh32.exe108⤵
- Drops file in System32 directory
- Modifies registry class
PID:1576 -
C:\Windows\SysWOW64\Hejcic32.exeC:\Windows\system32\Hejcic32.exe109⤵PID:2112
-
C:\Windows\SysWOW64\Hobgbi32.exeC:\Windows\system32\Hobgbi32.exe110⤵PID:1840
-
C:\Windows\SysWOW64\Kadafl32.exeC:\Windows\system32\Kadafl32.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2240 -
C:\Windows\SysWOW64\Kkmeob32.exeC:\Windows\system32\Kkmeob32.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2456 -
C:\Windows\SysWOW64\Kagnklhb.exeC:\Windows\system32\Kagnklhb.exe113⤵PID:1984
-
C:\Windows\SysWOW64\Khafhf32.exeC:\Windows\system32\Khafhf32.exe114⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1928 -
C:\Windows\SysWOW64\Koknepgl.exeC:\Windows\system32\Koknepgl.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1728 -
C:\Windows\SysWOW64\Lhccnf32.exeC:\Windows\system32\Lhccnf32.exe116⤵
- Drops file in System32 directory
- Modifies registry class
PID:1924 -
C:\Windows\SysWOW64\Lalgfk32.exeC:\Windows\system32\Lalgfk32.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1572 -
C:\Windows\SysWOW64\Lpogbhkh.exeC:\Windows\system32\Lpogbhkh.exe118⤵
- Modifies registry class
PID:2944 -
C:\Windows\SysWOW64\Lkdloakn.exeC:\Windows\system32\Lkdloakn.exe119⤵
- Drops file in System32 directory
PID:1496 -
C:\Windows\SysWOW64\Ldlphf32.exeC:\Windows\system32\Ldlphf32.exe120⤵
- Modifies registry class
PID:2056 -
C:\Windows\SysWOW64\Mndapo32.exeC:\Windows\system32\Mndapo32.exe121⤵
- Drops file in System32 directory
PID:2740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-