Analysis
-
max time kernel
125s -
max time network
126s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13/05/2021, 12:59
Static task
static1
Behavioral task
behavioral1
Sample
b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab.exe
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab.exe
Resource
win10v20210410
0 signatures
0 seconds
General
-
Target
b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab.exe
-
Size
425KB
-
MD5
b867e9a0a1f0125b4968d066d9073893
-
SHA1
209397872f904f5728390d53c493b4047bc9c420
-
SHA256
b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab
-
SHA512
66a99ef3541ed7a5e07c18bede0bcce2ffa2711d48d5f52068f51bc01c4f707bdea10a9edcb7d6b019695630af3103ba567f9919c03d97ef820a14fc2aa992d3
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 26 IoCs
pid Process 1260 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202.exe 1416 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202a.exe 1664 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202b.exe 1856 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202c.exe 2488 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202d.exe 2764 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202e.exe 2276 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202f.exe 3728 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202g.exe 3356 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202h.exe 192 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202i.exe 3700 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202j.exe 1108 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202k.exe 3636 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202l.exe 2208 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202m.exe 8 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202n.exe 3952 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202o.exe 1164 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202p.exe 2132 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202q.exe 3992 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202r.exe 1432 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202s.exe 3856 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202t.exe 1664 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202u.exe 1852 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202v.exe 2884 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202w.exe 2764 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202x.exe 3944 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202y.exe -
resource yara_rule behavioral2/files/0x0008000000000689-116.dat upx behavioral2/files/0x0008000000000689-115.dat upx behavioral2/files/0x000200000001ab79-122.dat upx behavioral2/files/0x000100000001ab7d-124.dat upx behavioral2/files/0x000200000001ab79-121.dat upx behavioral2/files/0x000200000001ab78-119.dat upx behavioral2/files/0x000200000001ab78-118.dat upx behavioral2/files/0x000100000001ab7d-125.dat upx behavioral2/files/0x000100000001ab7e-127.dat upx behavioral2/files/0x000100000001ab7e-128.dat upx behavioral2/files/0x000100000001ab7f-131.dat upx behavioral2/files/0x000100000001ab80-133.dat upx behavioral2/files/0x000100000001ab7f-130.dat upx behavioral2/files/0x000100000001ab80-134.dat upx behavioral2/files/0x000100000001ab81-136.dat upx behavioral2/files/0x000100000001ab81-137.dat upx behavioral2/files/0x000100000001ab83-140.dat upx behavioral2/files/0x000100000001ab83-139.dat upx behavioral2/files/0x000100000001ab84-142.dat upx behavioral2/files/0x000100000001ab84-143.dat upx behavioral2/files/0x000100000001ab85-145.dat upx behavioral2/files/0x000100000001ab85-146.dat upx behavioral2/files/0x000100000001ab86-148.dat upx behavioral2/files/0x000100000001ab87-152.dat upx behavioral2/files/0x000100000001ab87-151.dat upx behavioral2/files/0x000100000001ab86-149.dat upx behavioral2/files/0x000100000001ab88-154.dat upx behavioral2/files/0x000100000001ab88-155.dat upx behavioral2/files/0x000100000001ab89-157.dat upx behavioral2/files/0x000100000001ab89-158.dat upx behavioral2/files/0x000100000001ab8a-160.dat upx behavioral2/files/0x000100000001ab8a-161.dat upx behavioral2/files/0x000100000001ab8b-163.dat upx behavioral2/files/0x000100000001ab8b-164.dat upx behavioral2/files/0x000100000001ab8c-166.dat upx behavioral2/files/0x000100000001ab8c-167.dat upx behavioral2/files/0x000100000001ab8d-169.dat upx behavioral2/files/0x000100000001ab8d-170.dat upx behavioral2/files/0x000100000001ab8e-172.dat upx behavioral2/files/0x000100000001ab8e-173.dat upx behavioral2/files/0x000100000001ab8f-175.dat upx behavioral2/files/0x000100000001ab8f-176.dat upx behavioral2/files/0x000100000001ab90-178.dat upx behavioral2/files/0x000100000001ab90-179.dat upx behavioral2/files/0x000100000001ab91-181.dat upx behavioral2/files/0x000100000001ab91-182.dat upx behavioral2/files/0x000100000001ab92-184.dat upx behavioral2/files/0x000100000001ab92-185.dat upx behavioral2/files/0x000100000001ab93-188.dat upx behavioral2/files/0x000100000001ab93-187.dat upx behavioral2/files/0x000100000001ab94-190.dat upx behavioral2/files/0x000100000001ab94-191.dat upx -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202n.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202q.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202r.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202s.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202r.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202w.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202v.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202a.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202g.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202g.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202l.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202k.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202p.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202r.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202q.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202s.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202u.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202t.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202u.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202v.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202u.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202i.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202h.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202o.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202q.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202p.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202t.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202s.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202t.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202v.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202c.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202f.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202x.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202i.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202k.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202j.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202m.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202l.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202o.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202n.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202d.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202e.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202h.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202g.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202h.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202m.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202b.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202a.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202j.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202i.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202p.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202o.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202x.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202j.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202k.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202l.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202n.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202m.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202x.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202y.exe\"" b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202x.exe -
Modifies registry class 52 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202j.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202k.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202l.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202r.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202v.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202f.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202q.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202t.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202v.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202m.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202s.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202y.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202b.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202h.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202p.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202l.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202n.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202n.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202q.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202s.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202w.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202d.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202j.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202k.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202t.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202u.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202u.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202y.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202d.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202g.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202o.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202g.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202i.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202o.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202w.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202b.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202c.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202x.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202h.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202i.exe Key created \REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202m.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202p.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202r.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202x.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ddc119f3b04cd099 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202f.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1260 2016 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab.exe 74 PID 2016 wrote to memory of 1260 2016 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab.exe 74 PID 2016 wrote to memory of 1260 2016 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab.exe 74 PID 1260 wrote to memory of 1416 1260 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202.exe 75 PID 1260 wrote to memory of 1416 1260 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202.exe 75 PID 1260 wrote to memory of 1416 1260 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202.exe 75 PID 1416 wrote to memory of 1664 1416 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202a.exe 76 PID 1416 wrote to memory of 1664 1416 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202a.exe 76 PID 1416 wrote to memory of 1664 1416 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202a.exe 76 PID 1664 wrote to memory of 1856 1664 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202b.exe 77 PID 1664 wrote to memory of 1856 1664 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202b.exe 77 PID 1664 wrote to memory of 1856 1664 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202b.exe 77 PID 1856 wrote to memory of 2488 1856 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202c.exe 79 PID 1856 wrote to memory of 2488 1856 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202c.exe 79 PID 1856 wrote to memory of 2488 1856 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202c.exe 79 PID 2488 wrote to memory of 2764 2488 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202d.exe 81 PID 2488 wrote to memory of 2764 2488 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202d.exe 81 PID 2488 wrote to memory of 2764 2488 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202d.exe 81 PID 2764 wrote to memory of 2276 2764 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202x.exe 80 PID 2764 wrote to memory of 2276 2764 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202x.exe 80 PID 2764 wrote to memory of 2276 2764 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202x.exe 80 PID 2276 wrote to memory of 3728 2276 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202f.exe 82 PID 2276 wrote to memory of 3728 2276 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202f.exe 82 PID 2276 wrote to memory of 3728 2276 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202f.exe 82 PID 3728 wrote to memory of 3356 3728 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202g.exe 83 PID 3728 wrote to memory of 3356 3728 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202g.exe 83 PID 3728 wrote to memory of 3356 3728 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202g.exe 83 PID 3356 wrote to memory of 192 3356 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202h.exe 84 PID 3356 wrote to memory of 192 3356 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202h.exe 84 PID 3356 wrote to memory of 192 3356 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202h.exe 84 PID 192 wrote to memory of 3700 192 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202i.exe 85 PID 192 wrote to memory of 3700 192 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202i.exe 85 PID 192 wrote to memory of 3700 192 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202i.exe 85 PID 3700 wrote to memory of 1108 3700 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202j.exe 87 PID 3700 wrote to memory of 1108 3700 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202j.exe 87 PID 3700 wrote to memory of 1108 3700 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202j.exe 87 PID 1108 wrote to memory of 3636 1108 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202k.exe 88 PID 1108 wrote to memory of 3636 1108 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202k.exe 88 PID 1108 wrote to memory of 3636 1108 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202k.exe 88 PID 3636 wrote to memory of 2208 3636 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202l.exe 89 PID 3636 wrote to memory of 2208 3636 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202l.exe 89 PID 3636 wrote to memory of 2208 3636 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202l.exe 89 PID 2208 wrote to memory of 8 2208 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202m.exe 90 PID 2208 wrote to memory of 8 2208 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202m.exe 90 PID 2208 wrote to memory of 8 2208 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202m.exe 90 PID 8 wrote to memory of 3952 8 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202n.exe 91 PID 8 wrote to memory of 3952 8 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202n.exe 91 PID 8 wrote to memory of 3952 8 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202n.exe 91 PID 3952 wrote to memory of 1164 3952 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202o.exe 92 PID 3952 wrote to memory of 1164 3952 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202o.exe 92 PID 3952 wrote to memory of 1164 3952 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202o.exe 92 PID 1164 wrote to memory of 2132 1164 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202p.exe 93 PID 1164 wrote to memory of 2132 1164 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202p.exe 93 PID 1164 wrote to memory of 2132 1164 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202p.exe 93 PID 2132 wrote to memory of 3992 2132 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202q.exe 94 PID 2132 wrote to memory of 3992 2132 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202q.exe 94 PID 2132 wrote to memory of 3992 2132 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202q.exe 94 PID 3992 wrote to memory of 1432 3992 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202r.exe 95 PID 3992 wrote to memory of 1432 3992 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202r.exe 95 PID 3992 wrote to memory of 1432 3992 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202r.exe 95 PID 1432 wrote to memory of 3856 1432 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202s.exe 96 PID 1432 wrote to memory of 3856 1432 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202s.exe 96 PID 1432 wrote to memory of 3856 1432 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202s.exe 96 PID 3856 wrote to memory of 1664 3856 b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202t.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab.exe"C:\Users\Admin\AppData\Local\Temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab.exe"1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202a.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202a.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202b.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202b.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202c.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202c.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202d.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202d.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202e.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202e.exe7⤵
- Executes dropped EXE
PID:2764
-
-
-
-
-
-
-
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202f.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202f.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202g.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202g.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202h.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202h.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202i.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202i.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:192 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202j.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202j.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202k.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202k.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202l.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202l.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202m.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202m.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202n.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202n.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202o.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202o.exe10⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202p.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202p.exe11⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202q.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202q.exe12⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202r.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202r.exe13⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202s.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202s.exe14⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202t.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202t.exe15⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202u.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202u.exe16⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:1664 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202v.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202v.exe17⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:1852 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202w.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202w.exe18⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:2884 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202x.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202x.exe19⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202y.exec:\users\admin\appdata\local\temp\b3792344349e0098677dada628c8ded11b2bbde2fbb24dd123e3ac94239252ab_3202y.exe20⤵
- Executes dropped EXE
- Modifies registry class
PID:3944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-