Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 21:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ab5a20c59746541389fe349f71f9130_NeikiAnalytics.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
3ab5a20c59746541389fe349f71f9130_NeikiAnalytics.exe
-
Size
96KB
-
MD5
3ab5a20c59746541389fe349f71f9130
-
SHA1
ea3a167fd793f09be4c48ce444f1af61eabb354a
-
SHA256
b5cfc7cf8815e90a078928a5df3e9abd1dcbde564eac0d4cda2985a212d1d388
-
SHA512
8702c3e1c26d3be7242c642d8984b3cede5fcdc95c95e39f8613e4e601e0579506b2781ca11de8bf7975b4cbe69afef340c639faba54e2f50aa8d3e50771b55d
-
SSDEEP
1536:rHPnzUqARvVTYhgnQs3wqYEn6/JgGpQx4RA7Jjkg5rjDynIpd7hUczT:rvz+9T5LgqTnWwKk+MrjDyILhUsT
Malware Config
Signatures
-
Detect Lumma Stealer payload V4 47 IoCs
resource yara_rule behavioral1/memory/1852-18-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/3060-29-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/2116-42-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/2980-52-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/2632-68-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/1620-77-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/1540-93-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/1368-103-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/1600-116-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/496-130-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/2016-139-0x00000000024A0000-0x0000000002542000-memory.dmp family_lumma_v4 behavioral1/memory/2016-150-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/2332-154-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/264-171-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/2768-173-0x00000000023D0000-0x0000000002472000-memory.dmp family_lumma_v4 behavioral1/memory/2768-182-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/3032-193-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/548-208-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/936-214-0x0000000002870000-0x0000000002912000-memory.dmp family_lumma_v4 behavioral1/memory/936-213-0x0000000002870000-0x0000000002912000-memory.dmp family_lumma_v4 behavioral1/memory/936-216-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/564-223-0x00000000023D0000-0x0000000002472000-memory.dmp family_lumma_v4 behavioral1/memory/564-227-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/1936-235-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/1432-240-0x0000000002400000-0x00000000024A2000-memory.dmp family_lumma_v4 behavioral1/memory/1432-244-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/2076-249-0x00000000026A0000-0x0000000002742000-memory.dmp family_lumma_v4 behavioral1/memory/2076-254-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/2780-260-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/2676-267-0x0000000002520000-0x00000000025C2000-memory.dmp family_lumma_v4 behavioral1/memory/2728-277-0x0000000002840000-0x00000000028E2000-memory.dmp family_lumma_v4 behavioral1/memory/2676-276-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/2728-280-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/2636-287-0x0000000002540000-0x00000000025E2000-memory.dmp family_lumma_v4 behavioral1/memory/2636-291-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/2684-296-0x0000000002750000-0x00000000027F2000-memory.dmp family_lumma_v4 behavioral1/memory/2684-298-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/2404-308-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/2200-316-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/1652-324-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/2192-332-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/1656-340-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/844-347-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/2884-355-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/2220-363-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/676-371-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 behavioral1/memory/2296-378-0x0000000000400000-0x00000000004A2000-memory.dmp family_lumma_v4 -
Executes dropped EXE 64 IoCs
pid Process 3060 uclvtuqx.exe 2116 ebptdsyw.exe 2980 ljllxizo.exe 2632 bnlgbvwj.exe 1620 ivggnkgt.exe 1540 sfwqjouv.exe 1368 dbobqivs.exe 1600 nabybhcs.exe 496 uioyvwek.exe 2016 eslbizse.exe 2332 rfvzwdrr.exe 264 elmtkmcv.exe 2768 jmuotrib.exe 3032 txkyovod.exe 548 dwwwytwd.exe 936 nrpogoxa.exe 564 aldwzsbj.exe 1936 khwohnch.exe 1432 uslzuqqj.exe 2076 hfdpaupo.exe 2780 oqbuxnxa.exe 2676 zlceeiyf.exe 2728 gbqezxhq.exe 2636 trthhfnf.exe 2684 bwdmzrqv.exe 2404 nqjckdcw.exe 2200 vjhhzxkr.exe 1652 hzckifqy.exe 2192 vmuzojpd.exe 1656 eauxmicz.exe 844 ptkcqgwc.exe 2884 bytxfphg.exe 2220 muuhukil.exe 676 yzmkiatp.exe 2296 iyqhtzap.exe 1776 vlhxzvzu.exe 760 iccahdfj.exe 1524 veiptqjl.exe 1784 iclsjqos.exe 1316 sfacxtvu.exe 800 ehgkifzd.exe 2232 rxbnrgfl.exe 1912 ezhccsjm.exe 2756 rqkflapb.exe 2400 tazpgdvw.exe 2668 jfakkjsq.exe 2584 staaaqfm.exe 2508 ggsygudr.exe 2744 pihatpst.exe 2544 cknqmcwd.exe 1636 pbisvkck.exe 2392 cwaibgap.exe 1448 mcafrnol.exe 1704 zxkvwrmy.exe 2084 monyfzsf.exe 2280 zqtnqdwp.exe 2080 mgnqhmcw.exe 780 vuofxtht.exe 1300 iljigtma.exe 580 vyaymxln.exe 1160 iahoxkyo.exe 1612 vqbqgkvv.exe 1696 fbrbbnjx.exe 468 srudjvhf.exe -
Loads dropped DLL 64 IoCs
pid Process 1852 3ab5a20c59746541389fe349f71f9130_NeikiAnalytics.exe 1852 3ab5a20c59746541389fe349f71f9130_NeikiAnalytics.exe 3060 uclvtuqx.exe 3060 uclvtuqx.exe 2116 ebptdsyw.exe 2116 ebptdsyw.exe 2980 ljllxizo.exe 2980 ljllxizo.exe 2632 bnlgbvwj.exe 2632 bnlgbvwj.exe 1620 ivggnkgt.exe 1620 ivggnkgt.exe 1540 sfwqjouv.exe 1540 sfwqjouv.exe 1368 dbobqivs.exe 1368 dbobqivs.exe 1600 nabybhcs.exe 1600 nabybhcs.exe 496 uioyvwek.exe 496 uioyvwek.exe 2016 eslbizse.exe 2016 eslbizse.exe 2332 rfvzwdrr.exe 2332 rfvzwdrr.exe 264 elmtkmcv.exe 264 elmtkmcv.exe 2768 jmuotrib.exe 2768 jmuotrib.exe 3032 txkyovod.exe 3032 txkyovod.exe 548 dwwwytwd.exe 548 dwwwytwd.exe 936 nrpogoxa.exe 936 nrpogoxa.exe 564 aldwzsbj.exe 564 aldwzsbj.exe 1936 khwohnch.exe 1936 khwohnch.exe 1432 uslzuqqj.exe 1432 uslzuqqj.exe 2076 hfdpaupo.exe 2076 hfdpaupo.exe 2780 oqbuxnxa.exe 2780 oqbuxnxa.exe 2676 zlceeiyf.exe 2676 zlceeiyf.exe 2728 gbqezxhq.exe 2728 gbqezxhq.exe 2636 trthhfnf.exe 2636 trthhfnf.exe 2684 bwdmzrqv.exe 2684 bwdmzrqv.exe 2404 nqjckdcw.exe 2404 nqjckdcw.exe 2200 vjhhzxkr.exe 2200 vjhhzxkr.exe 1652 hzckifqy.exe 1652 hzckifqy.exe 2192 vmuzojpd.exe 2192 vmuzojpd.exe 1656 eauxmicz.exe 1656 eauxmicz.exe 844 ptkcqgwc.exe 844 ptkcqgwc.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\iljigtma.exe vuofxtht.exe File opened for modification C:\Windows\SysWOW64\qmpyiqwr.exe gkanvmqp.exe File created C:\Windows\SysWOW64\geetoenn.exe tnjqfdpg.exe File created C:\Windows\SysWOW64\edanbqgy.exe riryvmhm.exe File created C:\Windows\SysWOW64\peirosni.exe ccckdfig.exe File created C:\Windows\SysWOW64\oesztkzp.exe fqrbvcms.exe File opened for modification C:\Windows\SysWOW64\cewhzanq.exe sfrkobgr.exe File opened for modification C:\Windows\SysWOW64\qsjutqih.exe gptkgnbn.exe File created C:\Windows\SysWOW64\jyksogka.exe zsjuyzxw.exe File opened for modification C:\Windows\SysWOW64\ayhmhqlf.exe nlpwbnfa.exe File opened for modification C:\Windows\SysWOW64\rqqqygrt.exe esvnpylm.exe File created C:\Windows\SysWOW64\xtgesezm.exe kgpombsh.exe File created C:\Windows\SysWOW64\mzcucbev.exe dtcfmcrz.exe File opened for modification C:\Windows\SysWOW64\pxyfplmi.exe fmjccifg.exe File opened for modification C:\Windows\SysWOW64\vvpbexlb.exe lsarrtfh.exe File created C:\Windows\SysWOW64\hhuwpdjy.exe uuchjakl.exe File opened for modification C:\Windows\SysWOW64\nssjrnwg.exe abxhinqz.exe File opened for modification C:\Windows\SysWOW64\jscdcuzb.exe wftnxqsw.exe File opened for modification C:\Windows\SysWOW64\wccdczzg.exe jpknxvtt.exe File created C:\Windows\SysWOW64\ngcalzcb.exe denqxvwh.exe File opened for modification C:\Windows\SysWOW64\mfafsvyr.exe cvkufssp.exe File created C:\Windows\SysWOW64\gbzucpyn.exe tcerthsf.exe File opened for modification C:\Windows\SysWOW64\eznvgxow.exe ulnxqpba.exe File created C:\Windows\SysWOW64\lvfcnucw.exe gbzucpyn.exe File created C:\Windows\SysWOW64\vvpbexlb.exe lsarrtfh.exe File opened for modification C:\Windows\SysWOW64\bvnbcsxe.exe oesztkzp.exe File opened for modification C:\Windows\SysWOW64\gwoxegqt.exe wlymqdkz.exe File opened for modification C:\Windows\SysWOW64\cufdcjxl.exe pvkaljre.exe File opened for modification C:\Windows\SysWOW64\exgbugml.exe ujfdwyzo.exe File created C:\Windows\SysWOW64\boptghfg.exe lcpgccjm.exe File created C:\Windows\SysWOW64\uxsytjqm.exe kndngfkk.exe File opened for modification C:\Windows\SysWOW64\brhtogyv.exe oseqfgto.exe File opened for modification C:\Windows\SysWOW64\rolxpdpf.exe hdvncabl.exe File created C:\Windows\SysWOW64\uiafclwg.exe luaiderj.exe File opened for modification C:\Windows\SysWOW64\pjriyukz.exe coitsqlu.exe File created C:\Windows\SysWOW64\wtjmpcnj.exe juojhuhc.exe File opened for modification C:\Windows\SysWOW64\dsacuonf.exe thkrhlhd.exe File opened for modification C:\Windows\SysWOW64\swgatiaz.exe jlqpyfte.exe File created C:\Windows\SysWOW64\pvkaljre.exe fwydbkke.exe File created C:\Windows\SysWOW64\sfwqjouv.exe ivggnkgt.exe File created C:\Windows\SysWOW64\hdvncabl.exe rznsyveq.exe File opened for modification C:\Windows\SysWOW64\dfwgkpzw.exe tchwxmsc.exe File created C:\Windows\SysWOW64\vmywgsly.exe oazrjydl.exe File created C:\Windows\SysWOW64\aipqdack.exe kepvzufq.exe File created C:\Windows\SysWOW64\wlfatoxs.exe mapqykrq.exe File opened for modification C:\Windows\SysWOW64\kanbninr.exe aqxqrfhw.exe File created C:\Windows\SysWOW64\logejkzh.exe yqlbajus.exe File opened for modification C:\Windows\SysWOW64\hzugsjor.exe xltjubbu.exe File created C:\Windows\SysWOW64\dgoxdetc.exe qpucvenu.exe File created C:\Windows\SysWOW64\kwtwpfyb.exe xfyuhfst.exe File created C:\Windows\SysWOW64\haskrgno.exe xtgfyhfo.exe File opened for modification C:\Windows\SysWOW64\stpaxuul.exe ifoczmoo.exe File opened for modification C:\Windows\SysWOW64\jjjskvro.exe zylhxrcm.exe File created C:\Windows\SysWOW64\xnrcvppk.exe jaamplqx.exe File created C:\Windows\SysWOW64\yzmkiatp.exe muuhukil.exe File created C:\Windows\SysWOW64\crglqfpy.exe pexwkkql.exe File created C:\Windows\SysWOW64\wvwnpxox.exe msgccuiv.exe File created C:\Windows\SysWOW64\wftnxqsw.exe jdnxdmom.exe File created C:\Windows\SysWOW64\pfpbudst.exe fvzrgamr.exe File created C:\Windows\SysWOW64\ylsnsmhn.exe jyksogka.exe File opened for modification C:\Windows\SysWOW64\vjhhzxkr.exe nqjckdcw.exe File created C:\Windows\SysWOW64\thkrhlhd.exe gfekvydb.exe File created C:\Windows\SysWOW64\cyuczhai.exe olkeudbv.exe File created C:\Windows\SysWOW64\ahwfhfzc.exe rtdqrymg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1852 wrote to memory of 3060 1852 3ab5a20c59746541389fe349f71f9130_NeikiAnalytics.exe 28 PID 1852 wrote to memory of 3060 1852 3ab5a20c59746541389fe349f71f9130_NeikiAnalytics.exe 28 PID 1852 wrote to memory of 3060 1852 3ab5a20c59746541389fe349f71f9130_NeikiAnalytics.exe 28 PID 1852 wrote to memory of 3060 1852 3ab5a20c59746541389fe349f71f9130_NeikiAnalytics.exe 28 PID 3060 wrote to memory of 2116 3060 uclvtuqx.exe 29 PID 3060 wrote to memory of 2116 3060 uclvtuqx.exe 29 PID 3060 wrote to memory of 2116 3060 uclvtuqx.exe 29 PID 3060 wrote to memory of 2116 3060 uclvtuqx.exe 29 PID 2116 wrote to memory of 2980 2116 ebptdsyw.exe 30 PID 2116 wrote to memory of 2980 2116 ebptdsyw.exe 30 PID 2116 wrote to memory of 2980 2116 ebptdsyw.exe 30 PID 2116 wrote to memory of 2980 2116 ebptdsyw.exe 30 PID 2980 wrote to memory of 2632 2980 ljllxizo.exe 31 PID 2980 wrote to memory of 2632 2980 ljllxizo.exe 31 PID 2980 wrote to memory of 2632 2980 ljllxizo.exe 31 PID 2980 wrote to memory of 2632 2980 ljllxizo.exe 31 PID 2632 wrote to memory of 1620 2632 bnlgbvwj.exe 32 PID 2632 wrote to memory of 1620 2632 bnlgbvwj.exe 32 PID 2632 wrote to memory of 1620 2632 bnlgbvwj.exe 32 PID 2632 wrote to memory of 1620 2632 bnlgbvwj.exe 32 PID 1620 wrote to memory of 1540 1620 ivggnkgt.exe 33 PID 1620 wrote to memory of 1540 1620 ivggnkgt.exe 33 PID 1620 wrote to memory of 1540 1620 ivggnkgt.exe 33 PID 1620 wrote to memory of 1540 1620 ivggnkgt.exe 33 PID 1540 wrote to memory of 1368 1540 sfwqjouv.exe 34 PID 1540 wrote to memory of 1368 1540 sfwqjouv.exe 34 PID 1540 wrote to memory of 1368 1540 sfwqjouv.exe 34 PID 1540 wrote to memory of 1368 1540 sfwqjouv.exe 34 PID 1368 wrote to memory of 1600 1368 dbobqivs.exe 35 PID 1368 wrote to memory of 1600 1368 dbobqivs.exe 35 PID 1368 wrote to memory of 1600 1368 dbobqivs.exe 35 PID 1368 wrote to memory of 1600 1368 dbobqivs.exe 35 PID 1600 wrote to memory of 496 1600 nabybhcs.exe 36 PID 1600 wrote to memory of 496 1600 nabybhcs.exe 36 PID 1600 wrote to memory of 496 1600 nabybhcs.exe 36 PID 1600 wrote to memory of 496 1600 nabybhcs.exe 36 PID 496 wrote to memory of 2016 496 uioyvwek.exe 37 PID 496 wrote to memory of 2016 496 uioyvwek.exe 37 PID 496 wrote to memory of 2016 496 uioyvwek.exe 37 PID 496 wrote to memory of 2016 496 uioyvwek.exe 37 PID 2016 wrote to memory of 2332 2016 eslbizse.exe 38 PID 2016 wrote to memory of 2332 2016 eslbizse.exe 38 PID 2016 wrote to memory of 2332 2016 eslbizse.exe 38 PID 2016 wrote to memory of 2332 2016 eslbizse.exe 38 PID 2332 wrote to memory of 264 2332 rfvzwdrr.exe 39 PID 2332 wrote to memory of 264 2332 rfvzwdrr.exe 39 PID 2332 wrote to memory of 264 2332 rfvzwdrr.exe 39 PID 2332 wrote to memory of 264 2332 rfvzwdrr.exe 39 PID 264 wrote to memory of 2768 264 elmtkmcv.exe 40 PID 264 wrote to memory of 2768 264 elmtkmcv.exe 40 PID 264 wrote to memory of 2768 264 elmtkmcv.exe 40 PID 264 wrote to memory of 2768 264 elmtkmcv.exe 40 PID 2768 wrote to memory of 3032 2768 jmuotrib.exe 41 PID 2768 wrote to memory of 3032 2768 jmuotrib.exe 41 PID 2768 wrote to memory of 3032 2768 jmuotrib.exe 41 PID 2768 wrote to memory of 3032 2768 jmuotrib.exe 41 PID 3032 wrote to memory of 548 3032 txkyovod.exe 42 PID 3032 wrote to memory of 548 3032 txkyovod.exe 42 PID 3032 wrote to memory of 548 3032 txkyovod.exe 42 PID 3032 wrote to memory of 548 3032 txkyovod.exe 42 PID 548 wrote to memory of 936 548 dwwwytwd.exe 43 PID 548 wrote to memory of 936 548 dwwwytwd.exe 43 PID 548 wrote to memory of 936 548 dwwwytwd.exe 43 PID 548 wrote to memory of 936 548 dwwwytwd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ab5a20c59746541389fe349f71f9130_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3ab5a20c59746541389fe349f71f9130_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\uclvtuqx.exeC:\Windows\system32\uclvtuqx.exe 532 "C:\Users\Admin\AppData\Local\Temp\3ab5a20c59746541389fe349f71f9130_NeikiAnalytics.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\ebptdsyw.exeC:\Windows\system32\ebptdsyw.exe 536 "C:\Windows\SysWOW64\uclvtuqx.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\ljllxizo.exeC:\Windows\system32\ljllxizo.exe 552 "C:\Windows\SysWOW64\ebptdsyw.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\bnlgbvwj.exeC:\Windows\system32\bnlgbvwj.exe 544 "C:\Windows\SysWOW64\ljllxizo.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\ivggnkgt.exeC:\Windows\system32\ivggnkgt.exe 480 "C:\Windows\SysWOW64\bnlgbvwj.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\sfwqjouv.exeC:\Windows\system32\sfwqjouv.exe 560 "C:\Windows\SysWOW64\ivggnkgt.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\dbobqivs.exeC:\Windows\system32\dbobqivs.exe 556 "C:\Windows\SysWOW64\sfwqjouv.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\nabybhcs.exeC:\Windows\system32\nabybhcs.exe 548 "C:\Windows\SysWOW64\dbobqivs.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\uioyvwek.exeC:\Windows\system32\uioyvwek.exe 484 "C:\Windows\SysWOW64\nabybhcs.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Windows\SysWOW64\eslbizse.exeC:\Windows\system32\eslbizse.exe 568 "C:\Windows\SysWOW64\uioyvwek.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\rfvzwdrr.exeC:\Windows\system32\rfvzwdrr.exe 580 "C:\Windows\SysWOW64\eslbizse.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\elmtkmcv.exeC:\Windows\system32\elmtkmcv.exe 572 "C:\Windows\SysWOW64\rfvzwdrr.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\jmuotrib.exeC:\Windows\system32\jmuotrib.exe 456 "C:\Windows\SysWOW64\elmtkmcv.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\txkyovod.exeC:\Windows\system32\txkyovod.exe 584 "C:\Windows\SysWOW64\jmuotrib.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\dwwwytwd.exeC:\Windows\system32\dwwwytwd.exe 576 "C:\Windows\SysWOW64\txkyovod.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\nrpogoxa.exeC:\Windows\system32\nrpogoxa.exe 492 "C:\Windows\SysWOW64\dwwwytwd.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:936 -
C:\Windows\SysWOW64\aldwzsbj.exeC:\Windows\system32\aldwzsbj.exe 596 "C:\Windows\SysWOW64\nrpogoxa.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Windows\SysWOW64\khwohnch.exeC:\Windows\system32\khwohnch.exe 496 "C:\Windows\SysWOW64\aldwzsbj.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Windows\SysWOW64\uslzuqqj.exeC:\Windows\system32\uslzuqqj.exe 600 "C:\Windows\SysWOW64\khwohnch.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Windows\SysWOW64\hfdpaupo.exeC:\Windows\system32\hfdpaupo.exe 612 "C:\Windows\SysWOW64\uslzuqqj.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Windows\SysWOW64\oqbuxnxa.exeC:\Windows\system32\oqbuxnxa.exe 500 "C:\Windows\SysWOW64\hfdpaupo.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Windows\SysWOW64\zlceeiyf.exeC:\Windows\system32\zlceeiyf.exe 604 "C:\Windows\SysWOW64\oqbuxnxa.exe"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Windows\SysWOW64\gbqezxhq.exeC:\Windows\system32\gbqezxhq.exe 504 "C:\Windows\SysWOW64\zlceeiyf.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Windows\SysWOW64\trthhfnf.exeC:\Windows\system32\trthhfnf.exe 628 "C:\Windows\SysWOW64\gbqezxhq.exe"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Windows\SysWOW64\bwdmzrqv.exeC:\Windows\system32\bwdmzrqv.exe 488 "C:\Windows\SysWOW64\trthhfnf.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Windows\SysWOW64\nqjckdcw.exeC:\Windows\system32\nqjckdcw.exe 636 "C:\Windows\SysWOW64\bwdmzrqv.exe"27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2404 -
C:\Windows\SysWOW64\vjhhzxkr.exeC:\Windows\system32\vjhhzxkr.exe 528 "C:\Windows\SysWOW64\nqjckdcw.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Windows\SysWOW64\hzckifqy.exeC:\Windows\system32\hzckifqy.exe 640 "C:\Windows\SysWOW64\vjhhzxkr.exe"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Windows\SysWOW64\vmuzojpd.exeC:\Windows\system32\vmuzojpd.exe 656 "C:\Windows\SysWOW64\hzckifqy.exe"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Windows\SysWOW64\eauxmicz.exeC:\Windows\system32\eauxmicz.exe 644 "C:\Windows\SysWOW64\vmuzojpd.exe"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Windows\SysWOW64\ptkcqgwc.exeC:\Windows\system32\ptkcqgwc.exe 648 "C:\Windows\SysWOW64\eauxmicz.exe"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Windows\SysWOW64\bytxfphg.exeC:\Windows\system32\bytxfphg.exe 652 "C:\Windows\SysWOW64\ptkcqgwc.exe"33⤵
- Executes dropped EXE
PID:2884 -
C:\Windows\SysWOW64\muuhukil.exeC:\Windows\system32\muuhukil.exe 668 "C:\Windows\SysWOW64\bytxfphg.exe"34⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2220 -
C:\Windows\SysWOW64\yzmkiatp.exeC:\Windows\system32\yzmkiatp.exe 664 "C:\Windows\SysWOW64\muuhukil.exe"35⤵
- Executes dropped EXE
PID:676 -
C:\Windows\SysWOW64\iyqhtzap.exeC:\Windows\system32\iyqhtzap.exe 680 "C:\Windows\SysWOW64\yzmkiatp.exe"36⤵
- Executes dropped EXE
PID:2296 -
C:\Windows\SysWOW64\vlhxzvzu.exeC:\Windows\system32\vlhxzvzu.exe 660 "C:\Windows\SysWOW64\iyqhtzap.exe"37⤵
- Executes dropped EXE
PID:1776 -
C:\Windows\SysWOW64\iccahdfj.exeC:\Windows\system32\iccahdfj.exe 684 "C:\Windows\SysWOW64\vlhxzvzu.exe"38⤵
- Executes dropped EXE
PID:760 -
C:\Windows\SysWOW64\veiptqjl.exeC:\Windows\system32\veiptqjl.exe 672 "C:\Windows\SysWOW64\iccahdfj.exe"39⤵
- Executes dropped EXE
PID:1524 -
C:\Windows\SysWOW64\iclsjqos.exeC:\Windows\system32\iclsjqos.exe 632 "C:\Windows\SysWOW64\veiptqjl.exe"40⤵
- Executes dropped EXE
PID:1784 -
C:\Windows\SysWOW64\sfacxtvu.exeC:\Windows\system32\sfacxtvu.exe 676 "C:\Windows\SysWOW64\iclsjqos.exe"41⤵
- Executes dropped EXE
PID:1316 -
C:\Windows\SysWOW64\ehgkifzd.exeC:\Windows\system32\ehgkifzd.exe 688 "C:\Windows\SysWOW64\sfacxtvu.exe"42⤵
- Executes dropped EXE
PID:800 -
C:\Windows\SysWOW64\rxbnrgfl.exeC:\Windows\system32\rxbnrgfl.exe 700 "C:\Windows\SysWOW64\ehgkifzd.exe"43⤵
- Executes dropped EXE
PID:2232 -
C:\Windows\SysWOW64\ezhccsjm.exeC:\Windows\system32\ezhccsjm.exe 696 "C:\Windows\SysWOW64\rxbnrgfl.exe"44⤵
- Executes dropped EXE
PID:1912 -
C:\Windows\SysWOW64\rqkflapb.exeC:\Windows\system32\rqkflapb.exe 704 "C:\Windows\SysWOW64\ezhccsjm.exe"45⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\SysWOW64\tazpgdvw.exeC:\Windows\system32\tazpgdvw.exe 716 "C:\Windows\SysWOW64\rqkflapb.exe"46⤵
- Executes dropped EXE
PID:2400 -
C:\Windows\SysWOW64\jfakkjsq.exeC:\Windows\system32\jfakkjsq.exe 692 "C:\Windows\SysWOW64\tazpgdvw.exe"47⤵
- Executes dropped EXE
PID:2668 -
C:\Windows\SysWOW64\staaaqfm.exeC:\Windows\system32\staaaqfm.exe 708 "C:\Windows\SysWOW64\jfakkjsq.exe"48⤵
- Executes dropped EXE
PID:2584 -
C:\Windows\SysWOW64\ggsygudr.exeC:\Windows\system32\ggsygudr.exe 712 "C:\Windows\SysWOW64\staaaqfm.exe"49⤵
- Executes dropped EXE
PID:2508 -
C:\Windows\SysWOW64\pihatpst.exeC:\Windows\system32\pihatpst.exe 728 "C:\Windows\SysWOW64\ggsygudr.exe"50⤵
- Executes dropped EXE
PID:2744 -
C:\Windows\SysWOW64\cknqmcwd.exeC:\Windows\system32\cknqmcwd.exe 724 "C:\Windows\SysWOW64\pihatpst.exe"51⤵
- Executes dropped EXE
PID:2544 -
C:\Windows\SysWOW64\pbisvkck.exeC:\Windows\system32\pbisvkck.exe 732 "C:\Windows\SysWOW64\cknqmcwd.exe"52⤵
- Executes dropped EXE
PID:1636 -
C:\Windows\SysWOW64\cwaibgap.exeC:\Windows\system32\cwaibgap.exe 736 "C:\Windows\SysWOW64\pbisvkck.exe"53⤵
- Executes dropped EXE
PID:2392 -
C:\Windows\SysWOW64\mcafrnol.exeC:\Windows\system32\mcafrnol.exe 744 "C:\Windows\SysWOW64\cwaibgap.exe"54⤵
- Executes dropped EXE
PID:1448 -
C:\Windows\SysWOW64\zxkvwrmy.exeC:\Windows\system32\zxkvwrmy.exe 740 "C:\Windows\SysWOW64\mcafrnol.exe"55⤵
- Executes dropped EXE
PID:1704 -
C:\Windows\SysWOW64\monyfzsf.exeC:\Windows\system32\monyfzsf.exe 760 "C:\Windows\SysWOW64\zxkvwrmy.exe"56⤵
- Executes dropped EXE
PID:2084 -
C:\Windows\SysWOW64\zqtnqdwp.exeC:\Windows\system32\zqtnqdwp.exe 748 "C:\Windows\SysWOW64\monyfzsf.exe"57⤵
- Executes dropped EXE
PID:2280 -
C:\Windows\SysWOW64\mgnqhmcw.exeC:\Windows\system32\mgnqhmcw.exe 756 "C:\Windows\SysWOW64\zqtnqdwp.exe"58⤵
- Executes dropped EXE
PID:2080 -
C:\Windows\SysWOW64\vuofxtht.exeC:\Windows\system32\vuofxtht.exe 720 "C:\Windows\SysWOW64\mgnqhmcw.exe"59⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:780 -
C:\Windows\SysWOW64\iljigtma.exeC:\Windows\system32\iljigtma.exe 764 "C:\Windows\SysWOW64\vuofxtht.exe"60⤵
- Executes dropped EXE
PID:1300 -
C:\Windows\SysWOW64\vyaymxln.exeC:\Windows\system32\vyaymxln.exe 752 "C:\Windows\SysWOW64\iljigtma.exe"61⤵
- Executes dropped EXE
PID:580 -
C:\Windows\SysWOW64\iahoxkyo.exeC:\Windows\system32\iahoxkyo.exe 776 "C:\Windows\SysWOW64\vyaymxln.exe"62⤵
- Executes dropped EXE
PID:1160 -
C:\Windows\SysWOW64\vqbqgkvv.exeC:\Windows\system32\vqbqgkvv.exe 768 "C:\Windows\SysWOW64\iahoxkyo.exe"63⤵
- Executes dropped EXE
PID:1612 -
C:\Windows\SysWOW64\fbrbbnjx.exeC:\Windows\system32\fbrbbnjx.exe 780 "C:\Windows\SysWOW64\vqbqgkvv.exe"64⤵
- Executes dropped EXE
PID:1696 -
C:\Windows\SysWOW64\srudjvhf.exeC:\Windows\system32\srudjvhf.exe 772 "C:\Windows\SysWOW64\fbrbbnjx.exe"65⤵
- Executes dropped EXE
PID:468 -
C:\Windows\SysWOW64\fqogsdnm.exeC:\Windows\system32\fqogsdnm.exe 784 "C:\Windows\SysWOW64\srudjvhf.exe"66⤵PID:236
-
C:\Windows\SysWOW64\oseqfgto.exeC:\Windows\system32\oseqfgto.exe 796 "C:\Windows\SysWOW64\fqogsdnm.exe"67⤵
- Drops file in System32 directory
PID:896 -
C:\Windows\SysWOW64\brhtogyv.exeC:\Windows\system32\brhtogyv.exe 800 "C:\Windows\SysWOW64\oseqfgto.exe"68⤵PID:1496
-
C:\Windows\SysWOW64\ohboepec.exeC:\Windows\system32\ohboepec.exe 792 "C:\Windows\SysWOW64\brhtogyv.exe"69⤵PID:2060
-
C:\Windows\SysWOW64\bjhdqbim.exeC:\Windows\system32\bjhdqbim.exe 812 "C:\Windows\SysWOW64\ohboepec.exe"70⤵PID:640
-
C:\Windows\SysWOW64\lmxodwpg.exeC:\Windows\system32\lmxodwpg.exe 788 "C:\Windows\SysWOW64\bjhdqbim.exe"71⤵PID:2660
-
C:\Windows\SysWOW64\yksrmeun.exeC:\Windows\system32\yksrmeun.exe 816 "C:\Windows\SysWOW64\lmxodwpg.exe"72⤵PID:2208
-
C:\Windows\SysWOW64\inpbhhap.exeC:\Windows\system32\inpbhhap.exe 820 "C:\Windows\SysWOW64\yksrmeun.exe"73⤵PID:2492
-
C:\Windows\SysWOW64\vlkepqgw.exeC:\Windows\system32\vlkepqgw.exe 824 "C:\Windows\SysWOW64\inpbhhap.exe"74⤵PID:1948
-
C:\Windows\SysWOW64\hcfgyqme.exeC:\Windows\system32\hcfgyqme.exe 808 "C:\Windows\SysWOW64\vlkepqgw.exe"75⤵PID:2740
-
C:\Windows\SysWOW64\rfurltsg.exeC:\Windows\system32\rfurltsg.exe 828 "C:\Windows\SysWOW64\hcfgyqme.exe"76⤵PID:2524
-
C:\Windows\SysWOW64\hrcmpgps.exeC:\Windows\system32\hrcmpgps.exe 804 "C:\Windows\SysWOW64\rfurltsg.exe"77⤵PID:2480
-
C:\Windows\SysWOW64\rxdbfgco.exeC:\Windows\system32\rxdbfgco.exe 832 "C:\Windows\SysWOW64\hrcmpgps.exe"78⤵PID:1632
-
C:\Windows\SysWOW64\ewyeoohw.exeC:\Windows\system32\ewyeoohw.exe 840 "C:\Windows\SysWOW64\rxdbfgco.exe"79⤵PID:2184
-
C:\Windows\SysWOW64\rmsgfwfl.exeC:\Windows\system32\rmsgfwfl.exe 848 "C:\Windows\SysWOW64\ewyeoohw.exe"80⤵PID:1576
-
C:\Windows\SysWOW64\elvjnwks.exeC:\Windows\system32\elvjnwks.exe 852 "C:\Windows\SysWOW64\rmsgfwfl.exe"81⤵PID:316
-
C:\Windows\SysWOW64\rbqmweqz.exeC:\Windows\system32\rbqmweqz.exe 836 "C:\Windows\SysWOW64\elvjnwks.exe"82⤵PID:2020
-
C:\Windows\SysWOW64\aprjmmdw.exeC:\Windows\system32\aprjmmdw.exe 864 "C:\Windows\SysWOW64\rbqmweqz.exe"83⤵PID:2644
-
C:\Windows\SysWOW64\ncizspcb.exeC:\Windows\system32\ncizspcb.exe 856 "C:\Windows\SysWOW64\aprjmmdw.exe"84⤵PID:572
-
C:\Windows\SysWOW64\aeohdugk.exeC:\Windows\system32\aeohdugk.exe 844 "C:\Windows\SysWOW64\ncizspcb.exe"85⤵PID:2564
-
C:\Windows\SysWOW64\nvjjmcmr.exeC:\Windows\system32\nvjjmcmr.exe 860 "C:\Windows\SysWOW64\aeohdugk.exe"86⤵PID:1720
-
C:\Windows\SysWOW64\xfyuhfst.exeC:\Windows\system32\xfyuhfst.exe 872 "C:\Windows\SysWOW64\nvjjmcmr.exe"87⤵
- Drops file in System32 directory
PID:2648 -
C:\Windows\SysWOW64\kwtwpfyb.exeC:\Windows\system32\kwtwpfyb.exe 880 "C:\Windows\SysWOW64\xfyuhfst.exe"88⤵PID:2372
-
C:\Windows\SysWOW64\xmwzyodi.exeC:\Windows\system32\xmwzyodi.exe 884 "C:\Windows\SysWOW64\kwtwpfyb.exe"89⤵PID:1728
-
C:\Windows\SysWOW64\hxljlrkk.exeC:\Windows\system32\hxljlrkk.exe 876 "C:\Windows\SysWOW64\xmwzyodi.exe"90⤵PID:1084
-
C:\Windows\SysWOW64\tngmczpr.exeC:\Windows\system32\tngmczpr.exe 868 "C:\Windows\SysWOW64\hxljlrkk.exe"91⤵PID:2808
-
C:\Windows\SysWOW64\gpmcndtt.exeC:\Windows\system32\gpmcndtt.exe 896 "C:\Windows\SysWOW64\tngmczpr.exe"92⤵PID:952
-
C:\Windows\SysWOW64\tcerthsf.exeC:\Windows\system32\tcerthsf.exe 892 "C:\Windows\SysWOW64\gpmcndtt.exe"93⤵
- Drops file in System32 directory
PID:2052 -
C:\Windows\SysWOW64\gbzucpyn.exeC:\Windows\system32\gbzucpyn.exe 900 "C:\Windows\SysWOW64\tcerthsf.exe"94⤵
- Drops file in System32 directory
PID:2760 -
C:\Windows\SysWOW64\lvfcnucw.exeC:\Windows\system32\lvfcnucw.exe 888 "C:\Windows\SysWOW64\gbzucpyn.exe"95⤵PID:2548
-
C:\Windows\SysWOW64\ytifwcid.exeC:\Windows\system32\ytifwcid.exe 920 "C:\Windows\SysWOW64\lvfcnucw.exe"96⤵PID:2600
-
C:\Windows\SysWOW64\hzicmjna.exeC:\Windows\system32\hzicmjna.exe 904 "C:\Windows\SysWOW64\ytifwcid.exe"97⤵PID:2388
-
C:\Windows\SysWOW64\vussanun.exeC:\Windows\system32\vussanun.exe 916 "C:\Windows\SysWOW64\hzicmjna.exe"98⤵PID:1644
-
C:\Windows\SysWOW64\ilnuinru.exeC:\Windows\system32\ilnuinru.exe 924 "C:\Windows\SysWOW64\vussanun.exe"99⤵PID:2472
-
C:\Windows\SysWOW64\rznsyveq.exeC:\Windows\system32\rznsyveq.exe 912 "C:\Windows\SysWOW64\ilnuinru.exe"100⤵
- Drops file in System32 directory
PID:2512 -
C:\Windows\SysWOW64\hdvncabl.exeC:\Windows\system32\hdvncabl.exe 940 "C:\Windows\SysWOW64\rznsyveq.exe"101⤵
- Drops file in System32 directory
PID:2500 -
C:\Windows\SysWOW64\rolxpdpf.exeC:\Windows\system32\rolxpdpf.exe 932 "C:\Windows\SysWOW64\hdvncabl.exe"102⤵PID:2876
-
C:\Windows\SysWOW64\brahlgwz.exeC:\Windows\system32\brahlgwz.exe 908 "C:\Windows\SysWOW64\rolxpdpf.exe"103⤵PID:2356
-
C:\Windows\SysWOW64\ohdctobo.exeC:\Windows\system32\ohdctobo.exe 928 "C:\Windows\SysWOW64\brahlgwz.exe"104⤵PID:324
-
C:\Windows\SysWOW64\bcnazsat.exeC:\Windows\system32\bcnazsat.exe 936 "C:\Windows\SysWOW64\ohdctobo.exe"105⤵PID:1596
-
C:\Windows\SysWOW64\linppsnp.exeC:\Windows\system32\linppsnp.exe 960 "C:\Windows\SysWOW64\bcnazsat.exe"106⤵PID:2164
-
C:\Windows\SysWOW64\yhisyalx.exeC:\Windows\system32\yhisyalx.exe 944 "C:\Windows\SysWOW64\linppsnp.exe"107⤵PID:1572
-
C:\Windows\SysWOW64\luaiderj.exeC:\Windows\system32\luaiderj.exe 952 "C:\Windows\SysWOW64\yhisyalx.exe"108⤵
- Drops file in System32 directory
PID:2044 -
C:\Windows\SysWOW64\uiafclwg.exeC:\Windows\system32\uiafclwg.exe 956 "C:\Windows\SysWOW64\luaiderj.exe"109⤵PID:964
-
C:\Windows\SysWOW64\hvkvhhdt.exeC:\Windows\system32\hvkvhhdt.exe 968 "C:\Windows\SysWOW64\uiafclwg.exe"110⤵PID:2556
-
C:\Windows\SysWOW64\ulnxqpba.exeC:\Windows\system32\ulnxqpba.exe 964 "C:\Windows\SysWOW64\hvkvhhdt.exe"111⤵
- Drops file in System32 directory
PID:1692 -
C:\Windows\SysWOW64\eznvgxow.exeC:\Windows\system32\eznvgxow.exe 976 "C:\Windows\SysWOW64\ulnxqpba.exe"112⤵PID:2824
-
C:\Windows\SysWOW64\rmxkmanb.exeC:\Windows\system32\rmxkmanb.exe 948 "C:\Windows\SysWOW64\eznvgxow.exe"113⤵PID:2436
-
C:\Windows\SysWOW64\elancbsi.exeC:\Windows\system32\elancbsi.exe 972 "C:\Windows\SysWOW64\rmxkmanb.exe"114⤵PID:272
-
C:\Windows\SysWOW64\onpyqezk.exeC:\Windows\system32\onpyqezk.exe 984 "C:\Windows\SysWOW64\elancbsi.exe"115⤵PID:280
-
C:\Windows\SysWOW64\yjiixyhi.exeC:\Windows\system32\yjiixyhi.exe 988 "C:\Windows\SysWOW64\onpyqezk.exe"116⤵PID:884
-
C:\Windows\SysWOW64\lloyjlmr.exeC:\Windows\system32\lloyjlmr.exe 992 "C:\Windows\SysWOW64\yjiixyhi.exe"117⤵PID:1668
-
C:\Windows\SysWOW64\volieosl.exeC:\Windows\system32\volieosl.exe 1000 "C:\Windows\SysWOW64\lloyjlmr.exe"118⤵PID:2936
-
C:\Windows\SysWOW64\ibvykkry.exeC:\Windows\system32\ibvykkry.exe 980 "C:\Windows\SysWOW64\volieosl.exe"119⤵PID:1924
-
C:\Windows\SysWOW64\slkixnfs.exeC:\Windows\system32\slkixnfs.exe 1008 "C:\Windows\SysWOW64\ibvykkry.exe"120⤵PID:2752
-
C:\Windows\SysWOW64\coitsqlu.exeC:\Windows\system32\coitsqlu.exe 996 "C:\Windows\SysWOW64\slkixnfs.exe"121⤵
- Drops file in System32 directory
PID:2704 -
C:\Windows\SysWOW64\pjriyukz.exeC:\Windows\system32\pjriyukz.exe 1016 "C:\Windows\SysWOW64\coitsqlu.exe"122⤵PID:2196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-