Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
14/11/2023, 09:34
Behavioral task
behavioral1
Sample
NEAS.32d4cbad8bdc31fc8a8f7ef8c994b3eb.exe
Resource
win7-20231020-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.32d4cbad8bdc31fc8a8f7ef8c994b3eb.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
NEAS.32d4cbad8bdc31fc8a8f7ef8c994b3eb.exe
-
Size
357KB
-
MD5
32d4cbad8bdc31fc8a8f7ef8c994b3eb
-
SHA1
1d092159ae9d943238c46494244e967d355ae123
-
SHA256
5923785828cc57265b9d9f591bb26844d25b094788f607746ec5652bab8f9df4
-
SHA512
b6c85791c9aff23ddbd859361549df583240ddd5a224f6d6813e55703410170d7af238e4ae0bd8dd6fb068851b735f7d20e9d7b1fc8b0a1c89936691886d7a79
-
SSDEEP
6144:eSNP1Md3Xhr1n6xJmPMwZoXpKtCe8AUReheFlfSZR0SvsuFrGoyeg3kl+fiXFOFC:eWSdTZoXpKtCe1eehil6ZR5ZrQeg3klx
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jhejgl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pidjcm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cjnoggoh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idjdqc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jngbjd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qhddgofo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nkmmbe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ikbfgppo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcelpggq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kolabf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qolbgbgb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpoalo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogekbb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcoccc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Okfbgiij.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jhejgl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdfcla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nojfic32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lomqcjie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Foapaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mlhqcgnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fgcang32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Laofhbmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mogcihaj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nopfpgip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dgnffp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpgnmcdh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bomknp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mohidbkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ifjoop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qlpcpffl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pdfehh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ijgjpaao.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cjpllgme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cggikk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mnojcb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ibaeen32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebagdddp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nieggill.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mklfjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Inflio32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ihdjfhhc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mmodfqhf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgpcklpd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Palbgl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Googaaej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hiinoc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Alelkf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dobnpm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hmdlhk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knenffqf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpiecd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gfemmb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Adhdjpjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hgocgjgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Loodqn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gpnoigpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Phdnngdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jlolpq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cdpjlb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kddpnpdn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pekkhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Albpff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cpjdiadb.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0006000000022cdd-5.dat family_berbew behavioral2/files/0x0006000000022cdd-7.dat family_berbew behavioral2/files/0x0006000000022cdf-14.dat family_berbew behavioral2/files/0x0006000000022cdf-15.dat family_berbew behavioral2/files/0x0006000000022ce1-22.dat family_berbew behavioral2/files/0x0006000000022ce1-23.dat family_berbew behavioral2/files/0x0006000000022ce5-30.dat family_berbew behavioral2/files/0x0006000000022ce5-32.dat family_berbew behavioral2/files/0x0006000000022ce8-38.dat family_berbew behavioral2/files/0x0006000000022ce8-40.dat family_berbew behavioral2/files/0x0006000000022cea-46.dat family_berbew behavioral2/files/0x0006000000022cea-48.dat family_berbew behavioral2/files/0x0006000000022cec-49.dat family_berbew behavioral2/files/0x0006000000022cec-54.dat family_berbew behavioral2/files/0x0006000000022cec-56.dat family_berbew behavioral2/files/0x0006000000022cee-62.dat family_berbew behavioral2/files/0x0006000000022cee-64.dat family_berbew behavioral2/files/0x0006000000022cf0-65.dat family_berbew behavioral2/files/0x0006000000022cf0-70.dat family_berbew behavioral2/files/0x0006000000022cf0-71.dat family_berbew behavioral2/files/0x0006000000022cf6-78.dat family_berbew behavioral2/files/0x0006000000022cf6-80.dat family_berbew behavioral2/files/0x0006000000022cf9-86.dat family_berbew behavioral2/files/0x0006000000022cf9-88.dat family_berbew behavioral2/files/0x0006000000022cfb-94.dat family_berbew behavioral2/files/0x0006000000022cfb-95.dat family_berbew behavioral2/files/0x0006000000022cfd-102.dat family_berbew behavioral2/files/0x0006000000022cfd-104.dat family_berbew behavioral2/files/0x0006000000022cff-110.dat family_berbew behavioral2/files/0x000a000000022be9-118.dat family_berbew behavioral2/files/0x0006000000022cff-111.dat family_berbew behavioral2/files/0x000a000000022be9-120.dat family_berbew behavioral2/files/0x0007000000022cf2-128.dat family_berbew behavioral2/files/0x0007000000022cf2-126.dat family_berbew behavioral2/files/0x0007000000022cf4-134.dat family_berbew behavioral2/files/0x0007000000022cf4-135.dat family_berbew behavioral2/files/0x0008000000022cf8-142.dat family_berbew behavioral2/files/0x0008000000022cf8-144.dat family_berbew behavioral2/files/0x0008000000022d04-151.dat family_berbew behavioral2/files/0x0008000000022d04-150.dat family_berbew behavioral2/files/0x0009000000022be8-158.dat family_berbew behavioral2/files/0x0009000000022be8-160.dat family_berbew behavioral2/files/0x0006000000022d07-167.dat family_berbew behavioral2/files/0x0006000000022d07-166.dat family_berbew behavioral2/files/0x0008000000022be7-175.dat family_berbew behavioral2/files/0x0008000000022be7-174.dat family_berbew behavioral2/files/0x000a000000022be4-182.dat family_berbew behavioral2/files/0x000a000000022be4-184.dat family_berbew behavioral2/files/0x0006000000022d11-190.dat family_berbew behavioral2/files/0x0006000000022d11-191.dat family_berbew behavioral2/files/0x0006000000022d13-198.dat family_berbew behavioral2/files/0x0006000000022d13-199.dat family_berbew behavioral2/files/0x0007000000022d10-206.dat family_berbew behavioral2/files/0x0007000000022d10-208.dat family_berbew behavioral2/files/0x0007000000022d0b-209.dat family_berbew behavioral2/files/0x0007000000022d0b-214.dat family_berbew behavioral2/files/0x0007000000022d0b-216.dat family_berbew behavioral2/files/0x0006000000022d17-222.dat family_berbew behavioral2/files/0x0006000000022d17-224.dat family_berbew behavioral2/files/0x0006000000022d19-230.dat family_berbew behavioral2/files/0x0006000000022d19-232.dat family_berbew behavioral2/files/0x0006000000022d1b-233.dat family_berbew behavioral2/files/0x0006000000022d1b-238.dat family_berbew behavioral2/files/0x0006000000022d1b-239.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 3748 Ahcajk32.exe 1080 Ahgjejhd.exe 4060 Abponp32.exe 2232 Fjohde32.exe 5116 Gkhkjd32.exe 388 Gipdap32.exe 3008 Hdjbiheb.exe 1940 Hgmgqc32.exe 3088 Iphioh32.exe 516 Ipjedh32.exe 3040 Ikbfgppo.exe 4284 Jcphab32.exe 3672 Jgbjbp32.exe 1316 Jqknkedi.exe 4420 Kmdlffhj.exe 1444 Kjjiej32.exe 4224 Ljaoeini.exe 4160 Ljclki32.exe 3880 Lqpamb32.exe 5048 Lenicahg.exe 3112 Mjmoag32.exe 632 Mkohaj32.exe 4064 Manmoq32.exe 224 Napjdpcn.exe 4352 Nmgjia32.exe 3640 Naecop32.exe 3616 Nhahaiec.exe 400 Omcjep32.exe 972 Ohhnbhok.exe 760 Odalmibl.exe 4500 Paelfmaf.exe 3768 Pdfehh32.exe 1256 Phdnngdn.exe 2008 Palbgl32.exe 3764 Pejkmk32.exe 1192 Qaalblgi.exe 1004 Qmhlgmmm.exe 4240 Aogiap32.exe 4976 Adfnofpd.exe 4116 Aoalgn32.exe 4992 Adndoe32.exe 1820 Boeebnhp.exe 2416 Bklfgo32.exe 3816 Bddjpd32.exe 4596 Bnmoijje.exe 2136 Blnoga32.exe 2296 Bakgoh32.exe 4508 Coadnlnb.exe 1304 Cocacl32.exe 5004 Cdpjlb32.exe 2944 Chnbbqpn.exe 4124 Ddgplado.exe 3024 Ddjmba32.exe 448 Dnbakghm.exe 4388 Dbpjaeoc.exe 4472 Dijbno32.exe 2404 Dngjff32.exe 4752 Eofgpikj.exe 3532 Ekmhejao.exe 1348 Efblbbqd.exe 1632 Emoadlfo.exe 1188 Enpmld32.exe 1000 Enbjad32.exe 2148 Flfkkhid.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Akcoajfm.dll Hefnkkkj.exe File created C:\Windows\SysWOW64\Bdahfjfm.dll Pekkhn32.exe File created C:\Windows\SysWOW64\Qlpcpffl.exe Qefkcl32.exe File created C:\Windows\SysWOW64\Cgpcklpd.exe Cpfkna32.exe File created C:\Windows\SysWOW64\Hicgcm32.dll Lggeej32.exe File opened for modification C:\Windows\SysWOW64\Coadnlnb.exe Bakgoh32.exe File created C:\Windows\SysWOW64\Fmlbhekk.dll Ffnknafg.exe File created C:\Windows\SysWOW64\Kjeiodek.exe Koodbl32.exe File created C:\Windows\SysWOW64\Ihdldn32.exe Ibgdlg32.exe File created C:\Windows\SysWOW64\Iplkje32.exe Imnoni32.exe File opened for modification C:\Windows\SysWOW64\Jpoagb32.exe Jondojna.exe File created C:\Windows\SysWOW64\Hohahelb.dll Hpnoncim.exe File opened for modification C:\Windows\SysWOW64\Mcoljagj.exe Mapppn32.exe File created C:\Windows\SysWOW64\Jkajnh32.exe Jjpmfpid.exe File opened for modification C:\Windows\SysWOW64\Dnhncjom.exe Dgnffp32.exe File created C:\Windows\SysWOW64\Ehcfdc32.dll Eckfaj32.exe File created C:\Windows\SysWOW64\Dnbakghm.exe Ddjmba32.exe File created C:\Windows\SysWOW64\Mfpomglp.dll Mbnjcg32.exe File created C:\Windows\SysWOW64\Ihdjfhhc.exe Iajbinaf.exe File created C:\Windows\SysWOW64\Cjnoggoh.exe Cgpcklpd.exe File opened for modification C:\Windows\SysWOW64\Jpgdai32.exe Jbccge32.exe File opened for modification C:\Windows\SysWOW64\Klggli32.exe Kcoccc32.exe File created C:\Windows\SysWOW64\Jhejgl32.exe Jbkbkbfo.exe File created C:\Windows\SysWOW64\Olnmdi32.exe Oecego32.exe File opened for modification C:\Windows\SysWOW64\Gmnfglcd.exe Gjojkpdp.exe File opened for modification C:\Windows\SysWOW64\Plocob32.exe Oajoaj32.exe File opened for modification C:\Windows\SysWOW64\Aoalgn32.exe Adfnofpd.exe File created C:\Windows\SysWOW64\Fmbflm32.exe Ffhnocfd.exe File created C:\Windows\SysWOW64\Acemfcjn.dll Iophnl32.exe File opened for modification C:\Windows\SysWOW64\Ldpoinjq.exe Lnfgmc32.exe File opened for modification C:\Windows\SysWOW64\Ogajid32.exe Obdbqm32.exe File opened for modification C:\Windows\SysWOW64\Nnhmnn32.exe Nadleilm.exe File created C:\Windows\SysWOW64\Pfgaelbi.dll Eglkmh32.exe File created C:\Windows\SysWOW64\Plocob32.exe Oajoaj32.exe File created C:\Windows\SysWOW64\Lhlgfb32.dll Hdjbiheb.exe File created C:\Windows\SysWOW64\Epkijdie.dll Omfcmm32.exe File created C:\Windows\SysWOW64\Kpfboe32.dll Picchg32.exe File opened for modification C:\Windows\SysWOW64\Ihhmgaqb.exe Ipaeedpp.exe File created C:\Windows\SysWOW64\Gojnfb32.exe Ebagdddp.exe File created C:\Windows\SysWOW64\Bodano32.exe Bnbeggmi.exe File created C:\Windows\SysWOW64\Pclafhka.dll Gjagapbn.exe File opened for modification C:\Windows\SysWOW64\Qaalblgi.exe Pejkmk32.exe File created C:\Windows\SysWOW64\Fmkqpkla.exe Ffqhcq32.exe File created C:\Windows\SysWOW64\Cfjeckpj.exe Bcnleb32.exe File opened for modification C:\Windows\SysWOW64\Iodaikfl.exe Ihkila32.exe File created C:\Windows\SysWOW64\Flfkkhid.exe Enbjad32.exe File created C:\Windows\SysWOW64\Cnaaib32.exe Bnoddcef.exe File created C:\Windows\SysWOW64\Chkobkod.exe Cnaaib32.exe File created C:\Windows\SysWOW64\Gokbgpeg.exe Fbgbnkfm.exe File created C:\Windows\SysWOW64\Ocmjhfjl.exe Okfbgiij.exe File opened for modification C:\Windows\SysWOW64\Djeegf32.exe Cggikk32.exe File opened for modification C:\Windows\SysWOW64\Dgkbfjeg.exe Dodjemee.exe File created C:\Windows\SysWOW64\Dngjff32.exe Dijbno32.exe File opened for modification C:\Windows\SysWOW64\Dblnid32.exe Dlbfmjqi.exe File opened for modification C:\Windows\SysWOW64\Jkajnh32.exe Jjpmfpid.exe File opened for modification C:\Windows\SysWOW64\Cjpllgme.exe Ccfcpm32.exe File created C:\Windows\SysWOW64\Dgkbfjeg.exe Dodjemee.exe File created C:\Windows\SysWOW64\Hagnihom.exe Hjmfmnhp.exe File opened for modification C:\Windows\SysWOW64\Illfdc32.exe Ifomll32.exe File opened for modification C:\Windows\SysWOW64\Lncjlq32.exe Lcnfohmi.exe File opened for modification C:\Windows\SysWOW64\Mogcihaj.exe Mnegbp32.exe File opened for modification C:\Windows\SysWOW64\Namnmp32.exe Lmgfod32.exe File opened for modification C:\Windows\SysWOW64\Lenicahg.exe Lqpamb32.exe File created C:\Windows\SysWOW64\Jflbhhom.dll Fnlmhc32.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 9660 7836 WerFault.exe 796 2320 7836 WerFault.exe 796 -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhokhn32.dll" Goipae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgocnleh.dll" Nppfnige.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Neimao32.dll" Plocob32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hhiaepfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Emanepld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ommjnlnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Giliddlo.dll" Hjmfmnhp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Omaeem32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mbnjcg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nppfnige.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llbgoe32.dll" Kknhjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hicgcm32.dll" Lggeej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhnako32.dll" Mqimdomb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egbcih32.dll" Ibaeen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lnoaaaad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iodaikfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pidjcm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ocaebc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pgcbbc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhmfcc32.dll" Opdpih32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Plimpg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nopfpgip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Njedbjej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbkqqe32.dll" Jaonbc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nfldgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enjgeopm.dll" Nflkbanj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dakikoom.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gbpedjnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnkbdjah.dll" Hfkdkqeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fmdcamko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iobecl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jgpfmncg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ogekbb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pmdpok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epgobe32.dll" Incpdodg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aogiap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iadpjifl.dll" Lfjchn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hopcnnoc.dll" Aghdco32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pacfdpmc.dll" Laofhbmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nnhmnn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pekkhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nknjec32.dll" Klggli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oflkqc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npjfngdm.dll" Ljclki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gbpedjnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nkmmbe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Adfnofpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egleni32.dll" Lhjeoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acankf32.dll" Dqpfmlce.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ikechced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egqhob32.dll" Djoohk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bomknp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdhhfnom.dll" Hphbpehj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cklmbbeg.dll" Jcknee32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nblfee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnhdom32.dll" Gpjfng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcefei32.dll" Ihmnldib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Njahki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbpbhmcg.dll" Nmpdgdmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Iobecl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Iphioh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mlhqcgnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgqin32.dll" Nopfpgip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlppmdbh.dll" Odqbdnod.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4816 wrote to memory of 3748 4816 NEAS.32d4cbad8bdc31fc8a8f7ef8c994b3eb.exe 89 PID 4816 wrote to memory of 3748 4816 NEAS.32d4cbad8bdc31fc8a8f7ef8c994b3eb.exe 89 PID 4816 wrote to memory of 3748 4816 NEAS.32d4cbad8bdc31fc8a8f7ef8c994b3eb.exe 89 PID 3748 wrote to memory of 1080 3748 Ahcajk32.exe 91 PID 3748 wrote to memory of 1080 3748 Ahcajk32.exe 91 PID 3748 wrote to memory of 1080 3748 Ahcajk32.exe 91 PID 1080 wrote to memory of 4060 1080 Ahgjejhd.exe 92 PID 1080 wrote to memory of 4060 1080 Ahgjejhd.exe 92 PID 1080 wrote to memory of 4060 1080 Ahgjejhd.exe 92 PID 4060 wrote to memory of 2232 4060 Abponp32.exe 94 PID 4060 wrote to memory of 2232 4060 Abponp32.exe 94 PID 4060 wrote to memory of 2232 4060 Abponp32.exe 94 PID 2232 wrote to memory of 5116 2232 Fjohde32.exe 95 PID 2232 wrote to memory of 5116 2232 Fjohde32.exe 95 PID 2232 wrote to memory of 5116 2232 Fjohde32.exe 95 PID 5116 wrote to memory of 388 5116 Gkhkjd32.exe 96 PID 5116 wrote to memory of 388 5116 Gkhkjd32.exe 96 PID 5116 wrote to memory of 388 5116 Gkhkjd32.exe 96 PID 388 wrote to memory of 3008 388 Gipdap32.exe 97 PID 388 wrote to memory of 3008 388 Gipdap32.exe 97 PID 388 wrote to memory of 3008 388 Gipdap32.exe 97 PID 3008 wrote to memory of 1940 3008 Hdjbiheb.exe 98 PID 3008 wrote to memory of 1940 3008 Hdjbiheb.exe 98 PID 3008 wrote to memory of 1940 3008 Hdjbiheb.exe 98 PID 1940 wrote to memory of 3088 1940 Hgmgqc32.exe 99 PID 1940 wrote to memory of 3088 1940 Hgmgqc32.exe 99 PID 1940 wrote to memory of 3088 1940 Hgmgqc32.exe 99 PID 3088 wrote to memory of 516 3088 Iphioh32.exe 100 PID 3088 wrote to memory of 516 3088 Iphioh32.exe 100 PID 3088 wrote to memory of 516 3088 Iphioh32.exe 100 PID 516 wrote to memory of 3040 516 Ipjedh32.exe 103 PID 516 wrote to memory of 3040 516 Ipjedh32.exe 103 PID 516 wrote to memory of 3040 516 Ipjedh32.exe 103 PID 3040 wrote to memory of 4284 3040 Ikbfgppo.exe 104 PID 3040 wrote to memory of 4284 3040 Ikbfgppo.exe 104 PID 3040 wrote to memory of 4284 3040 Ikbfgppo.exe 104 PID 4284 wrote to memory of 3672 4284 Jcphab32.exe 105 PID 4284 wrote to memory of 3672 4284 Jcphab32.exe 105 PID 4284 wrote to memory of 3672 4284 Jcphab32.exe 105 PID 3672 wrote to memory of 1316 3672 Jgbjbp32.exe 106 PID 3672 wrote to memory of 1316 3672 Jgbjbp32.exe 106 PID 3672 wrote to memory of 1316 3672 Jgbjbp32.exe 106 PID 1316 wrote to memory of 4420 1316 Jqknkedi.exe 107 PID 1316 wrote to memory of 4420 1316 Jqknkedi.exe 107 PID 1316 wrote to memory of 4420 1316 Jqknkedi.exe 107 PID 4420 wrote to memory of 1444 4420 Kmdlffhj.exe 108 PID 4420 wrote to memory of 1444 4420 Kmdlffhj.exe 108 PID 4420 wrote to memory of 1444 4420 Kmdlffhj.exe 108 PID 1444 wrote to memory of 4224 1444 Kjjiej32.exe 109 PID 1444 wrote to memory of 4224 1444 Kjjiej32.exe 109 PID 1444 wrote to memory of 4224 1444 Kjjiej32.exe 109 PID 4224 wrote to memory of 4160 4224 Ljaoeini.exe 110 PID 4224 wrote to memory of 4160 4224 Ljaoeini.exe 110 PID 4224 wrote to memory of 4160 4224 Ljaoeini.exe 110 PID 4160 wrote to memory of 3880 4160 Ljclki32.exe 111 PID 4160 wrote to memory of 3880 4160 Ljclki32.exe 111 PID 4160 wrote to memory of 3880 4160 Ljclki32.exe 111 PID 3880 wrote to memory of 5048 3880 Lqpamb32.exe 112 PID 3880 wrote to memory of 5048 3880 Lqpamb32.exe 112 PID 3880 wrote to memory of 5048 3880 Lqpamb32.exe 112 PID 5048 wrote to memory of 3112 5048 Lenicahg.exe 113 PID 5048 wrote to memory of 3112 5048 Lenicahg.exe 113 PID 5048 wrote to memory of 3112 5048 Lenicahg.exe 113 PID 3112 wrote to memory of 632 3112 Mjmoag32.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.32d4cbad8bdc31fc8a8f7ef8c994b3eb.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.32d4cbad8bdc31fc8a8f7ef8c994b3eb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\Ahcajk32.exeC:\Windows\system32\Ahcajk32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\Ahgjejhd.exeC:\Windows\system32\Ahgjejhd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\Abponp32.exeC:\Windows\system32\Abponp32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\Fjohde32.exeC:\Windows\system32\Fjohde32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\Gkhkjd32.exeC:\Windows\system32\Gkhkjd32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\Gipdap32.exeC:\Windows\system32\Gipdap32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\Hdjbiheb.exeC:\Windows\system32\Hdjbiheb.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\Hgmgqc32.exeC:\Windows\system32\Hgmgqc32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\Iphioh32.exeC:\Windows\system32\Iphioh32.exe10⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\Ipjedh32.exeC:\Windows\system32\Ipjedh32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\SysWOW64\Ikbfgppo.exeC:\Windows\system32\Ikbfgppo.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\Jcphab32.exeC:\Windows\system32\Jcphab32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\Jgbjbp32.exeC:\Windows\system32\Jgbjbp32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\Jqknkedi.exeC:\Windows\system32\Jqknkedi.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\Kmdlffhj.exeC:\Windows\system32\Kmdlffhj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\Kjjiej32.exeC:\Windows\system32\Kjjiej32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\Ljaoeini.exeC:\Windows\system32\Ljaoeini.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\Ljclki32.exeC:\Windows\system32\Ljclki32.exe19⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\Lqpamb32.exeC:\Windows\system32\Lqpamb32.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\Lenicahg.exeC:\Windows\system32\Lenicahg.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\Mjmoag32.exeC:\Windows\system32\Mjmoag32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\Mkohaj32.exeC:\Windows\system32\Mkohaj32.exe23⤵
- Executes dropped EXE
PID:632 -
C:\Windows\SysWOW64\Manmoq32.exeC:\Windows\system32\Manmoq32.exe24⤵
- Executes dropped EXE
PID:4064 -
C:\Windows\SysWOW64\Napjdpcn.exeC:\Windows\system32\Napjdpcn.exe25⤵
- Executes dropped EXE
PID:224 -
C:\Windows\SysWOW64\Nmgjia32.exeC:\Windows\system32\Nmgjia32.exe26⤵
- Executes dropped EXE
PID:4352 -
C:\Windows\SysWOW64\Naecop32.exeC:\Windows\system32\Naecop32.exe27⤵
- Executes dropped EXE
PID:3640 -
C:\Windows\SysWOW64\Nhahaiec.exeC:\Windows\system32\Nhahaiec.exe28⤵
- Executes dropped EXE
PID:3616 -
C:\Windows\SysWOW64\Omcjep32.exeC:\Windows\system32\Omcjep32.exe29⤵
- Executes dropped EXE
PID:400 -
C:\Windows\SysWOW64\Ohhnbhok.exeC:\Windows\system32\Ohhnbhok.exe30⤵
- Executes dropped EXE
PID:972 -
C:\Windows\SysWOW64\Odalmibl.exeC:\Windows\system32\Odalmibl.exe31⤵
- Executes dropped EXE
PID:760 -
C:\Windows\SysWOW64\Paelfmaf.exeC:\Windows\system32\Paelfmaf.exe32⤵
- Executes dropped EXE
PID:4500 -
C:\Windows\SysWOW64\Pdfehh32.exeC:\Windows\system32\Pdfehh32.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3768 -
C:\Windows\SysWOW64\Phdnngdn.exeC:\Windows\system32\Phdnngdn.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1256 -
C:\Windows\SysWOW64\Palbgl32.exeC:\Windows\system32\Palbgl32.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2008 -
C:\Windows\SysWOW64\Pejkmk32.exeC:\Windows\system32\Pejkmk32.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3764 -
C:\Windows\SysWOW64\Qaalblgi.exeC:\Windows\system32\Qaalblgi.exe37⤵
- Executes dropped EXE
PID:1192 -
C:\Windows\SysWOW64\Qmhlgmmm.exeC:\Windows\system32\Qmhlgmmm.exe38⤵
- Executes dropped EXE
PID:1004 -
C:\Windows\SysWOW64\Aogiap32.exeC:\Windows\system32\Aogiap32.exe39⤵
- Executes dropped EXE
- Modifies registry class
PID:4240 -
C:\Windows\SysWOW64\Adfnofpd.exeC:\Windows\system32\Adfnofpd.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4976 -
C:\Windows\SysWOW64\Aoalgn32.exeC:\Windows\system32\Aoalgn32.exe41⤵
- Executes dropped EXE
PID:4116 -
C:\Windows\SysWOW64\Adndoe32.exeC:\Windows\system32\Adndoe32.exe42⤵
- Executes dropped EXE
PID:4992 -
C:\Windows\SysWOW64\Boeebnhp.exeC:\Windows\system32\Boeebnhp.exe43⤵
- Executes dropped EXE
PID:1820 -
C:\Windows\SysWOW64\Bklfgo32.exeC:\Windows\system32\Bklfgo32.exe44⤵
- Executes dropped EXE
PID:2416 -
C:\Windows\SysWOW64\Bddjpd32.exeC:\Windows\system32\Bddjpd32.exe45⤵
- Executes dropped EXE
PID:3816 -
C:\Windows\SysWOW64\Bnmoijje.exeC:\Windows\system32\Bnmoijje.exe46⤵
- Executes dropped EXE
PID:4596 -
C:\Windows\SysWOW64\Blnoga32.exeC:\Windows\system32\Blnoga32.exe47⤵
- Executes dropped EXE
PID:2136 -
C:\Windows\SysWOW64\Bakgoh32.exeC:\Windows\system32\Bakgoh32.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2296 -
C:\Windows\SysWOW64\Coadnlnb.exeC:\Windows\system32\Coadnlnb.exe49⤵
- Executes dropped EXE
PID:4508 -
C:\Windows\SysWOW64\Cocacl32.exeC:\Windows\system32\Cocacl32.exe50⤵
- Executes dropped EXE
PID:1304 -
C:\Windows\SysWOW64\Cdpjlb32.exeC:\Windows\system32\Cdpjlb32.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:5004 -
C:\Windows\SysWOW64\Chnbbqpn.exeC:\Windows\system32\Chnbbqpn.exe52⤵
- Executes dropped EXE
PID:2944 -
C:\Windows\SysWOW64\Ddgplado.exeC:\Windows\system32\Ddgplado.exe53⤵
- Executes dropped EXE
PID:4124 -
C:\Windows\SysWOW64\Ddjmba32.exeC:\Windows\system32\Ddjmba32.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3024 -
C:\Windows\SysWOW64\Dnbakghm.exeC:\Windows\system32\Dnbakghm.exe55⤵
- Executes dropped EXE
PID:448 -
C:\Windows\SysWOW64\Dbpjaeoc.exeC:\Windows\system32\Dbpjaeoc.exe56⤵
- Executes dropped EXE
PID:4388 -
C:\Windows\SysWOW64\Dijbno32.exeC:\Windows\system32\Dijbno32.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4472 -
C:\Windows\SysWOW64\Dngjff32.exeC:\Windows\system32\Dngjff32.exe58⤵
- Executes dropped EXE
PID:2404 -
C:\Windows\SysWOW64\Eofgpikj.exeC:\Windows\system32\Eofgpikj.exe59⤵
- Executes dropped EXE
PID:4752 -
C:\Windows\SysWOW64\Ekmhejao.exeC:\Windows\system32\Ekmhejao.exe60⤵
- Executes dropped EXE
PID:3532 -
C:\Windows\SysWOW64\Efblbbqd.exeC:\Windows\system32\Efblbbqd.exe61⤵
- Executes dropped EXE
PID:1348 -
C:\Windows\SysWOW64\Emoadlfo.exeC:\Windows\system32\Emoadlfo.exe62⤵
- Executes dropped EXE
PID:1632 -
C:\Windows\SysWOW64\Enpmld32.exeC:\Windows\system32\Enpmld32.exe63⤵
- Executes dropped EXE
PID:1188 -
C:\Windows\SysWOW64\Enbjad32.exeC:\Windows\system32\Enbjad32.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1000 -
C:\Windows\SysWOW64\Flfkkhid.exeC:\Windows\system32\Flfkkhid.exe65⤵
- Executes dropped EXE
PID:2148 -
C:\Windows\SysWOW64\Fijkdmhn.exeC:\Windows\system32\Fijkdmhn.exe66⤵PID:1096
-
C:\Windows\SysWOW64\Fpdcag32.exeC:\Windows\system32\Fpdcag32.exe67⤵PID:1464
-
C:\Windows\SysWOW64\Ffnknafg.exeC:\Windows\system32\Ffnknafg.exe68⤵
- Drops file in System32 directory
PID:4768 -
C:\Windows\SysWOW64\Ffqhcq32.exeC:\Windows\system32\Ffqhcq32.exe69⤵
- Drops file in System32 directory
PID:1844 -
C:\Windows\SysWOW64\Fmkqpkla.exeC:\Windows\system32\Fmkqpkla.exe70⤵PID:3596
-
C:\Windows\SysWOW64\Fnlmhc32.exeC:\Windows\system32\Fnlmhc32.exe71⤵
- Drops file in System32 directory
PID:1212 -
C:\Windows\SysWOW64\Fmmmfj32.exeC:\Windows\system32\Fmmmfj32.exe72⤵PID:3788
-
C:\Windows\SysWOW64\Gfeaopqo.exeC:\Windows\system32\Gfeaopqo.exe73⤵PID:2904
-
C:\Windows\SysWOW64\Gpnfge32.exeC:\Windows\system32\Gpnfge32.exe74⤵PID:1708
-
C:\Windows\SysWOW64\Gppcmeem.exeC:\Windows\system32\Gppcmeem.exe75⤵PID:2528
-
C:\Windows\SysWOW64\Gflhoo32.exeC:\Windows\system32\Gflhoo32.exe76⤵PID:5124
-
C:\Windows\SysWOW64\Goglcahb.exeC:\Windows\system32\Goglcahb.exe77⤵PID:5164
-
C:\Windows\SysWOW64\Gpgind32.exeC:\Windows\system32\Gpgind32.exe78⤵PID:5204
-
C:\Windows\SysWOW64\Hedafk32.exeC:\Windows\system32\Hedafk32.exe79⤵PID:5244
-
C:\Windows\SysWOW64\Hpiecd32.exeC:\Windows\system32\Hpiecd32.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5280 -
C:\Windows\SysWOW64\Hefnkkkj.exeC:\Windows\system32\Hefnkkkj.exe81⤵
- Drops file in System32 directory
PID:5328 -
C:\Windows\SysWOW64\Hoobdp32.exeC:\Windows\system32\Hoobdp32.exe82⤵PID:5368
-
C:\Windows\SysWOW64\Hidgai32.exeC:\Windows\system32\Hidgai32.exe83⤵PID:5420
-
C:\Windows\SysWOW64\Hpnoncim.exeC:\Windows\system32\Hpnoncim.exe84⤵
- Drops file in System32 directory
PID:5472 -
C:\Windows\SysWOW64\Hifcgion.exeC:\Windows\system32\Hifcgion.exe85⤵PID:5524
-
C:\Windows\SysWOW64\Hpqldc32.exeC:\Windows\system32\Hpqldc32.exe86⤵PID:5584
-
C:\Windows\SysWOW64\Hmdlmg32.exeC:\Windows\system32\Hmdlmg32.exe87⤵PID:5632
-
C:\Windows\SysWOW64\Ibaeen32.exeC:\Windows\system32\Ibaeen32.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5680 -
C:\Windows\SysWOW64\Iikmbh32.exeC:\Windows\system32\Iikmbh32.exe89⤵PID:5724
-
C:\Windows\SysWOW64\Ifomll32.exeC:\Windows\system32\Ifomll32.exe90⤵
- Drops file in System32 directory
PID:5768 -
C:\Windows\SysWOW64\Illfdc32.exeC:\Windows\system32\Illfdc32.exe91⤵PID:5816
-
C:\Windows\SysWOW64\Igajal32.exeC:\Windows\system32\Igajal32.exe92⤵PID:5860
-
C:\Windows\SysWOW64\Ilnbicff.exeC:\Windows\system32\Ilnbicff.exe93⤵PID:5900
-
C:\Windows\SysWOW64\Iefgbh32.exeC:\Windows\system32\Iefgbh32.exe94⤵PID:5948
-
C:\Windows\SysWOW64\Iplkpa32.exeC:\Windows\system32\Iplkpa32.exe95⤵PID:5992
-
C:\Windows\SysWOW64\Ieidhh32.exeC:\Windows\system32\Ieidhh32.exe96⤵PID:6032
-
C:\Windows\SysWOW64\Jghpbk32.exeC:\Windows\system32\Jghpbk32.exe97⤵PID:6072
-
C:\Windows\SysWOW64\Jmbhoeid.exeC:\Windows\system32\Jmbhoeid.exe98⤵PID:6116
-
C:\Windows\SysWOW64\Jenmcggo.exeC:\Windows\system32\Jenmcggo.exe99⤵PID:5136
-
C:\Windows\SysWOW64\Jlgepanl.exeC:\Windows\system32\Jlgepanl.exe100⤵PID:5232
-
C:\Windows\SysWOW64\Jcanll32.exeC:\Windows\system32\Jcanll32.exe101⤵PID:5312
-
C:\Windows\SysWOW64\Jngbjd32.exeC:\Windows\system32\Jngbjd32.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5340 -
C:\Windows\SysWOW64\Jcdjbk32.exeC:\Windows\system32\Jcdjbk32.exe103⤵PID:5428
-
C:\Windows\SysWOW64\Jinboekc.exeC:\Windows\system32\Jinboekc.exe104⤵PID:5520
-
C:\Windows\SysWOW64\Jphkkpbp.exeC:\Windows\system32\Jphkkpbp.exe105⤵PID:5604
-
C:\Windows\SysWOW64\Jgbchj32.exeC:\Windows\system32\Jgbchj32.exe106⤵PID:5692
-
C:\Windows\SysWOW64\Jlolpq32.exeC:\Windows\system32\Jlolpq32.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5760 -
C:\Windows\SysWOW64\Kegpifod.exeC:\Windows\system32\Kegpifod.exe108⤵PID:5844
-
C:\Windows\SysWOW64\Koodbl32.exeC:\Windows\system32\Koodbl32.exe109⤵
- Drops file in System32 directory
PID:5988 -
C:\Windows\SysWOW64\Kjeiodek.exeC:\Windows\system32\Kjeiodek.exe110⤵PID:6024
-
C:\Windows\SysWOW64\Kpoalo32.exeC:\Windows\system32\Kpoalo32.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6128 -
C:\Windows\SysWOW64\Kodnmkap.exeC:\Windows\system32\Kodnmkap.exe112⤵PID:5188
-
C:\Windows\SysWOW64\Kfnfjehl.exeC:\Windows\system32\Kfnfjehl.exe113⤵PID:5432
-
C:\Windows\SysWOW64\Kcbfcigf.exeC:\Windows\system32\Kcbfcigf.exe114⤵PID:5572
-
C:\Windows\SysWOW64\Kjlopc32.exeC:\Windows\system32\Kjlopc32.exe115⤵PID:5748
-
C:\Windows\SysWOW64\Lcdciiec.exeC:\Windows\system32\Lcdciiec.exe116⤵PID:5960
-
C:\Windows\SysWOW64\Ljnlecmp.exeC:\Windows\system32\Ljnlecmp.exe117⤵PID:6056
-
C:\Windows\SysWOW64\Ljqhkckn.exeC:\Windows\system32\Ljqhkckn.exe118⤵PID:5196
-
C:\Windows\SysWOW64\Lomqcjie.exeC:\Windows\system32\Lomqcjie.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5512 -
C:\Windows\SysWOW64\Lnoaaaad.exeC:\Windows\system32\Lnoaaaad.exe120⤵
- Modifies registry class
PID:5856 -
C:\Windows\SysWOW64\Lckiihok.exeC:\Windows\system32\Lckiihok.exe121⤵PID:6028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-