Analysis
-
max time kernel
151s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-11-2022 03:39
Static task
static1
Behavioral task
behavioral1
Sample
fa7874905ed2057e3df3ea526b32474cb1953517515a77c7f20f25390a0f9cfb.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
fa7874905ed2057e3df3ea526b32474cb1953517515a77c7f20f25390a0f9cfb.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
fa7874905ed2057e3df3ea526b32474cb1953517515a77c7f20f25390a0f9cfb.exe
-
Size
92KB
-
MD5
11c14668a63c8102e1ce06ef6d72cbb0
-
SHA1
0848ce7602bdc1a87bf7695857c7ce90794fb45a
-
SHA256
fa7874905ed2057e3df3ea526b32474cb1953517515a77c7f20f25390a0f9cfb
-
SHA512
866cbdd54a739bce328025c32c9756d9a01faaa37ca80835b389b0657589a3b1b1f2351ca5b00ebdf41d9299dbed5dad368e9a55dd297afe1cc5e2045337783e
-
SSDEEP
1536:VhlKg00+50ZS3nYhWXxXOh20c/sJ9DR5kzBm3jLV3BGnMPJKEsztuJO:fYKZqYhWXxXOh20ckJ9DR5eKjLlBRh10
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lijhcp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpgiieip.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gbimmd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dbdkdj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emjniolk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjadla32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pffmkc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgodnlnl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahpgie32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ikgkbmjf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpdhbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fjkhodmp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eblegjke.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qkhplnjo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lijhcp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmjomcpf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hddmgojf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lkglia32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Japhedpf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hbebhdik.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fiomgbhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gakdfa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ojhihm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qbohmlka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qhlpebii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdlbhn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ekmmdkdb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oofdgp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejpoipba.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lpkpni32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gjehgpof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aghanepd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmkccd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efqgemlb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jglgmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nlnnkp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eejaebek.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ememdi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Giqfle32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oddpbgcm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kjfoqe32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcipem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fqhdleff.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdecpe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hjmjia32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gphojg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bhkejphi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gfcqjp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofemjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pkkgmaim.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Inhbicea.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iidpoq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gfpoccbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lakqneeg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Heflec32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eckqgego.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knppdmdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pgpnqo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dofbkk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hogflhjg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gibphlol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aiaondgf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejgcqfee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gdikpk32.exe -
Executes dropped EXE 64 IoCs
pid Process 2044 Paifla32.exe 1088 Bfdkjg32.exe 1504 Bjbcqehg.exe 1740 Cnibeh32.exe 1560 Cjpcjime.exe 972 Chdccm32.exe 1816 Cdkdhnab.exe 584 Dpaemogg.exe 272 Dmeegcfq.exe 1860 Dilfld32.exe 1360 Dbdkdj32.exe 1448 Dlolcogc.exe 1968 Ehfmhpmg.exe 536 Edmmma32.exe 824 Edojbapi.exe 1828 Ecdgcm32.exe 1224 Ephgma32.exe 1368 Egbpjl32.exe 860 Fpkdbaah.exe 1468 Fjeeaffe.exe 764 Fdacgd32.exe 900 Fnjgpigb.exe 1628 Fqhdleff.exe 1080 Gnnaki32.exe 1840 Gggecnjm.exe 1352 Gnqnph32.exe 2040 Gjgnei32.exe 1336 Hbepok32.exe 1728 Hamifg32.exe 1548 Ijnqelcb.exe 1528 Jklpnohp.exe 912 Jmlipj32.exe 1364 Kiegkk32.exe 1584 Kncoqioi.exe 1296 Kpdhbd32.exe 1508 Ldijag32.exe 472 Lkglia32.exe 1696 Loiabd32.exe 2008 Molnhd32.exe 1732 Mifpfi32.exe 1964 Ngbbhddh.exe 544 Nmddlk32.exe 1892 Ohiehgal.exe 1708 Pplpmhho.exe 2000 Qekekodc.exe 1744 Qemapn32.exe 588 Acjhhgjn.exe 572 Aghanepd.exe 368 Ababoclc.exe 1128 Bipcflpk.exe 800 Bmdfeoqg.exe 976 Ccqkgifa.exe 1108 Djjocfpj.exe 856 Eifbeb32.exe 832 Eleoan32.exe 1484 Ehnlln32.exe 968 Fheblmkg.exe 2016 Fcocmkhf.exe 1168 Fkfknh32.exe 864 Fndgjc32.exe 1532 Fjkhodmp.exe 1244 Gchfcjpk.exe 1492 Ghgkap32.exe 836 Hqelkbgh.exe -
Loads dropped DLL 64 IoCs
pid Process 2012 fa7874905ed2057e3df3ea526b32474cb1953517515a77c7f20f25390a0f9cfb.exe 2012 fa7874905ed2057e3df3ea526b32474cb1953517515a77c7f20f25390a0f9cfb.exe 2044 Paifla32.exe 2044 Paifla32.exe 1088 Bfdkjg32.exe 1088 Bfdkjg32.exe 1504 Bjbcqehg.exe 1504 Bjbcqehg.exe 1740 Cnibeh32.exe 1740 Cnibeh32.exe 1560 Cjpcjime.exe 1560 Cjpcjime.exe 972 Chdccm32.exe 972 Chdccm32.exe 1816 Cdkdhnab.exe 1816 Cdkdhnab.exe 584 Dpaemogg.exe 584 Dpaemogg.exe 272 Dmeegcfq.exe 272 Dmeegcfq.exe 1860 Dilfld32.exe 1860 Dilfld32.exe 1360 Dbdkdj32.exe 1360 Dbdkdj32.exe 1448 Dlolcogc.exe 1448 Dlolcogc.exe 1968 Ehfmhpmg.exe 1968 Ehfmhpmg.exe 536 Edmmma32.exe 536 Edmmma32.exe 824 Edojbapi.exe 824 Edojbapi.exe 1828 Ecdgcm32.exe 1828 Ecdgcm32.exe 1224 Ephgma32.exe 1224 Ephgma32.exe 1368 Egbpjl32.exe 1368 Egbpjl32.exe 860 Fpkdbaah.exe 860 Fpkdbaah.exe 1468 Fjeeaffe.exe 1468 Fjeeaffe.exe 764 Fdacgd32.exe 764 Fdacgd32.exe 900 Fnjgpigb.exe 900 Fnjgpigb.exe 1628 Fqhdleff.exe 1628 Fqhdleff.exe 1080 Gnnaki32.exe 1080 Gnnaki32.exe 1840 Gggecnjm.exe 1840 Gggecnjm.exe 1352 Gnqnph32.exe 1352 Gnqnph32.exe 2040 Gjgnei32.exe 2040 Gjgnei32.exe 1336 Hbepok32.exe 1336 Hbepok32.exe 1728 Hamifg32.exe 1728 Hamifg32.exe 1548 Ijnqelcb.exe 1548 Ijnqelcb.exe 1528 Jklpnohp.exe 1528 Jklpnohp.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Fkfknh32.exe Fcocmkhf.exe File created C:\Windows\SysWOW64\Aecgli32.dll Kjkhlend.exe File opened for modification C:\Windows\SysWOW64\Bmealghb.exe Bglipm32.exe File opened for modification C:\Windows\SysWOW64\Dggejn32.exe Ddiinc32.exe File created C:\Windows\SysWOW64\Djmohpnn.dll Blhknm32.exe File created C:\Windows\SysWOW64\Pckome32.dll Pbpbhola.exe File created C:\Windows\SysWOW64\Hnemhdcn.dll Kbnfbc32.exe File opened for modification C:\Windows\SysWOW64\Affijg32.exe Abkmihif.exe File created C:\Windows\SysWOW64\Dkhcik32.exe Ddnkmaak.exe File created C:\Windows\SysWOW64\Llfibdck.exe Lckenb32.exe File created C:\Windows\SysWOW64\Deheceek.dll Pkgafoka.exe File created C:\Windows\SysWOW64\Neblmcph.exe Npqkim32.exe File created C:\Windows\SysWOW64\Nlelfp32.dll Jadojgoo.exe File created C:\Windows\SysWOW64\Ligopn32.dll Lfmgcl32.exe File opened for modification C:\Windows\SysWOW64\Lhcoille.exe Kepjbaag.exe File created C:\Windows\SysWOW64\Ndggefml.exe Ncodmome.exe File created C:\Windows\SysWOW64\Onchdbjk.dll Pahochlf.exe File created C:\Windows\SysWOW64\Fjkhodmp.exe Fndgjc32.exe File created C:\Windows\SysWOW64\Hhfqem32.exe Hqohdp32.exe File created C:\Windows\SysWOW64\Jpjjplne.dll Lefloc32.exe File created C:\Windows\SysWOW64\Bmhlai32.dll Ahnmkbgf.exe File opened for modification C:\Windows\SysWOW64\Bhpfoe32.exe Aafachmg.exe File created C:\Windows\SysWOW64\Mlfeje32.dll Pqpamn32.exe File opened for modification C:\Windows\SysWOW64\Dpnofm32.exe Cejkpq32.exe File opened for modification C:\Windows\SysWOW64\Accqjgan.exe Amboga32.exe File opened for modification C:\Windows\SysWOW64\Dnniio32.exe Cnfchppa.exe File created C:\Windows\SysWOW64\Hejjokiq.dll Ffpbfl32.exe File created C:\Windows\SysWOW64\Eleoan32.exe Eifbeb32.exe File created C:\Windows\SysWOW64\Hldoqjjk.dll Nokcmapj.exe File created C:\Windows\SysWOW64\Balifcca.exe Bkaaji32.exe File created C:\Windows\SysWOW64\Ppqcegpk.exe Pjgkim32.exe File opened for modification C:\Windows\SysWOW64\Hahaflol.exe Gemgflmm.exe File created C:\Windows\SysWOW64\Emcolefa.dll Peobighd.exe File opened for modification C:\Windows\SysWOW64\Gnqnph32.exe Gggecnjm.exe File created C:\Windows\SysWOW64\Clnidbgm.dll Ababoclc.exe File opened for modification C:\Windows\SysWOW64\Bmdfeoqg.exe Bipcflpk.exe File opened for modification C:\Windows\SysWOW64\Eifbeb32.exe Djjocfpj.exe File created C:\Windows\SysWOW64\Kjndadla.exe Khoheimm.exe File opened for modification C:\Windows\SysWOW64\Bdjebobd.exe Balifcca.exe File created C:\Windows\SysWOW64\Egniciml.exe Eqdafo32.exe File created C:\Windows\SysWOW64\Mkhknb32.dll Leljkdhc.exe File created C:\Windows\SysWOW64\Dckgag32.exe Damjek32.exe File created C:\Windows\SysWOW64\Bqngigbg.exe Bnpkmlcc.exe File created C:\Windows\SysWOW64\Iialokne.exe Iqjdnmmb.exe File opened for modification C:\Windows\SysWOW64\Lmqjhp32.exe Kmlampke.exe File created C:\Windows\SysWOW64\Obmpei32.dll Ffeaqm32.exe File opened for modification C:\Windows\SysWOW64\Doofok32.exe Dkcjnllm.exe File opened for modification C:\Windows\SysWOW64\Jadojgoo.exe Ilndkaib.exe File created C:\Windows\SysWOW64\Loiabd32.exe Lkglia32.exe File created C:\Windows\SysWOW64\Bgpbkllq.exe Bdbfoq32.exe File opened for modification C:\Windows\SysWOW64\Anfkkehj.exe Qjhbdg32.exe File created C:\Windows\SysWOW64\Odjnggak.dll Ecfglf32.exe File opened for modification C:\Windows\SysWOW64\Kijmob32.exe Knlcceba.exe File opened for modification C:\Windows\SysWOW64\Kppapn32.exe Kmaedb32.exe File created C:\Windows\SysWOW64\Hccmqikp.dll Hdakdige.exe File opened for modification C:\Windows\SysWOW64\Hnllbolc.exe Hpgkij32.exe File created C:\Windows\SysWOW64\Lpcfmdbg.dll Alcabnog.exe File created C:\Windows\SysWOW64\Gjdooh32.dll Mnaonmca.exe File opened for modification C:\Windows\SysWOW64\Edojbapi.exe Edmmma32.exe File created C:\Windows\SysWOW64\Gakdfa32.exe Ffhpoe32.exe File created C:\Windows\SysWOW64\Hphpkl32.exe Hcobpk32.exe File opened for modification C:\Windows\SysWOW64\Pahochlf.exe Pgpnqo32.exe File opened for modification C:\Windows\SysWOW64\Fcocmkhf.exe Fheblmkg.exe File created C:\Windows\SysWOW64\Hakfoc32.dll Knppdmdi.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jppeak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lfmgcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Delpbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Diknhf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oddpbgcm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lbngbhdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phpecm32.dll" Lpkpni32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hiekjd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kjeemg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnanlplk.dll" Iqjdnmmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oajqnlbj.dll" Edibdahh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmhpofbl.dll" Jciomhnn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pfaagl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Innoddgi.dll" Albhoodg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghfbnn32.dll" Bbedahpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glegbchk.dll" Dcpplfea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ommgdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Abkmihif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inpbbn32.dll" Mifpfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnjiei32.dll" Hjbmgp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iqjdnmmb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cbmcef32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Adomljge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deehjlho.dll" Igapeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edledjin.dll" Hnoakm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Glclcpca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qpmlid32.dll" Ejgcqfee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgippm32.dll" Eqphkpid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjallpki.dll" Hmdapb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cepgch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Onoecf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hjmjia32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmclip32.dll" Lkkdkhqo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dmdmbegk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eglkda32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eoaocneo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbcqgpmk.dll" Cbmcef32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pipmcg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aoheglnc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cqpdog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ceiaon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hhfqem32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hgogpefi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Amnfjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ddloga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bilidlcf.dll" Gkpdqjok.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lpkpni32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlccmf32.dll" Gnqnph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Djjkaidb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gdddne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlahbm32.dll" Hodblbin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cgpojool.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fpecohmc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ncodmome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bipcflpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Flbgpkop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jemdinoo.dll" Kjcihg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pgpnqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqphdh32.dll" Gdikpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kppapn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ibdgma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciieae32.dll" Okcnpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jecblmkc.dll" Dckgag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idnapehc.dll" Hjjmcalp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2012 wrote to memory of 2044 2012 fa7874905ed2057e3df3ea526b32474cb1953517515a77c7f20f25390a0f9cfb.exe 27 PID 2012 wrote to memory of 2044 2012 fa7874905ed2057e3df3ea526b32474cb1953517515a77c7f20f25390a0f9cfb.exe 27 PID 2012 wrote to memory of 2044 2012 fa7874905ed2057e3df3ea526b32474cb1953517515a77c7f20f25390a0f9cfb.exe 27 PID 2012 wrote to memory of 2044 2012 fa7874905ed2057e3df3ea526b32474cb1953517515a77c7f20f25390a0f9cfb.exe 27 PID 2044 wrote to memory of 1088 2044 Paifla32.exe 28 PID 2044 wrote to memory of 1088 2044 Paifla32.exe 28 PID 2044 wrote to memory of 1088 2044 Paifla32.exe 28 PID 2044 wrote to memory of 1088 2044 Paifla32.exe 28 PID 1088 wrote to memory of 1504 1088 Bfdkjg32.exe 29 PID 1088 wrote to memory of 1504 1088 Bfdkjg32.exe 29 PID 1088 wrote to memory of 1504 1088 Bfdkjg32.exe 29 PID 1088 wrote to memory of 1504 1088 Bfdkjg32.exe 29 PID 1504 wrote to memory of 1740 1504 Bjbcqehg.exe 30 PID 1504 wrote to memory of 1740 1504 Bjbcqehg.exe 30 PID 1504 wrote to memory of 1740 1504 Bjbcqehg.exe 30 PID 1504 wrote to memory of 1740 1504 Bjbcqehg.exe 30 PID 1740 wrote to memory of 1560 1740 Cnibeh32.exe 31 PID 1740 wrote to memory of 1560 1740 Cnibeh32.exe 31 PID 1740 wrote to memory of 1560 1740 Cnibeh32.exe 31 PID 1740 wrote to memory of 1560 1740 Cnibeh32.exe 31 PID 1560 wrote to memory of 972 1560 Cjpcjime.exe 32 PID 1560 wrote to memory of 972 1560 Cjpcjime.exe 32 PID 1560 wrote to memory of 972 1560 Cjpcjime.exe 32 PID 1560 wrote to memory of 972 1560 Cjpcjime.exe 32 PID 972 wrote to memory of 1816 972 Chdccm32.exe 33 PID 972 wrote to memory of 1816 972 Chdccm32.exe 33 PID 972 wrote to memory of 1816 972 Chdccm32.exe 33 PID 972 wrote to memory of 1816 972 Chdccm32.exe 33 PID 1816 wrote to memory of 584 1816 Cdkdhnab.exe 34 PID 1816 wrote to memory of 584 1816 Cdkdhnab.exe 34 PID 1816 wrote to memory of 584 1816 Cdkdhnab.exe 34 PID 1816 wrote to memory of 584 1816 Cdkdhnab.exe 34 PID 584 wrote to memory of 272 584 Dpaemogg.exe 35 PID 584 wrote to memory of 272 584 Dpaemogg.exe 35 PID 584 wrote to memory of 272 584 Dpaemogg.exe 35 PID 584 wrote to memory of 272 584 Dpaemogg.exe 35 PID 272 wrote to memory of 1860 272 Dmeegcfq.exe 36 PID 272 wrote to memory of 1860 272 Dmeegcfq.exe 36 PID 272 wrote to memory of 1860 272 Dmeegcfq.exe 36 PID 272 wrote to memory of 1860 272 Dmeegcfq.exe 36 PID 1860 wrote to memory of 1360 1860 Dilfld32.exe 37 PID 1860 wrote to memory of 1360 1860 Dilfld32.exe 37 PID 1860 wrote to memory of 1360 1860 Dilfld32.exe 37 PID 1860 wrote to memory of 1360 1860 Dilfld32.exe 37 PID 1360 wrote to memory of 1448 1360 Dbdkdj32.exe 38 PID 1360 wrote to memory of 1448 1360 Dbdkdj32.exe 38 PID 1360 wrote to memory of 1448 1360 Dbdkdj32.exe 38 PID 1360 wrote to memory of 1448 1360 Dbdkdj32.exe 38 PID 1448 wrote to memory of 1968 1448 Dlolcogc.exe 39 PID 1448 wrote to memory of 1968 1448 Dlolcogc.exe 39 PID 1448 wrote to memory of 1968 1448 Dlolcogc.exe 39 PID 1448 wrote to memory of 1968 1448 Dlolcogc.exe 39 PID 1968 wrote to memory of 536 1968 Ehfmhpmg.exe 40 PID 1968 wrote to memory of 536 1968 Ehfmhpmg.exe 40 PID 1968 wrote to memory of 536 1968 Ehfmhpmg.exe 40 PID 1968 wrote to memory of 536 1968 Ehfmhpmg.exe 40 PID 536 wrote to memory of 824 536 Edmmma32.exe 41 PID 536 wrote to memory of 824 536 Edmmma32.exe 41 PID 536 wrote to memory of 824 536 Edmmma32.exe 41 PID 536 wrote to memory of 824 536 Edmmma32.exe 41 PID 824 wrote to memory of 1828 824 Edojbapi.exe 42 PID 824 wrote to memory of 1828 824 Edojbapi.exe 42 PID 824 wrote to memory of 1828 824 Edojbapi.exe 42 PID 824 wrote to memory of 1828 824 Edojbapi.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa7874905ed2057e3df3ea526b32474cb1953517515a77c7f20f25390a0f9cfb.exe"C:\Users\Admin\AppData\Local\Temp\fa7874905ed2057e3df3ea526b32474cb1953517515a77c7f20f25390a0f9cfb.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\Paifla32.exeC:\Windows\system32\Paifla32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\Bfdkjg32.exeC:\Windows\system32\Bfdkjg32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\Bjbcqehg.exeC:\Windows\system32\Bjbcqehg.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\Cnibeh32.exeC:\Windows\system32\Cnibeh32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\Cjpcjime.exeC:\Windows\system32\Cjpcjime.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\Chdccm32.exeC:\Windows\system32\Chdccm32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\Cdkdhnab.exeC:\Windows\system32\Cdkdhnab.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\Dpaemogg.exeC:\Windows\system32\Dpaemogg.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\SysWOW64\Dmeegcfq.exeC:\Windows\system32\Dmeegcfq.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Windows\SysWOW64\Dilfld32.exeC:\Windows\system32\Dilfld32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\Dbdkdj32.exeC:\Windows\system32\Dbdkdj32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\Dlolcogc.exeC:\Windows\system32\Dlolcogc.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\Ehfmhpmg.exeC:\Windows\system32\Ehfmhpmg.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\Edmmma32.exeC:\Windows\system32\Edmmma32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\Edojbapi.exeC:\Windows\system32\Edojbapi.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\Ecdgcm32.exeC:\Windows\system32\Ecdgcm32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Windows\SysWOW64\Ephgma32.exeC:\Windows\system32\Ephgma32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Windows\SysWOW64\Egbpjl32.exeC:\Windows\system32\Egbpjl32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Windows\SysWOW64\Fpkdbaah.exeC:\Windows\system32\Fpkdbaah.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Windows\SysWOW64\Fjeeaffe.exeC:\Windows\system32\Fjeeaffe.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Windows\SysWOW64\Fdacgd32.exeC:\Windows\system32\Fdacgd32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Windows\SysWOW64\Fnjgpigb.exeC:\Windows\system32\Fnjgpigb.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Windows\SysWOW64\Fqhdleff.exeC:\Windows\system32\Fqhdleff.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Windows\SysWOW64\Gnnaki32.exeC:\Windows\system32\Gnnaki32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Windows\SysWOW64\Gggecnjm.exeC:\Windows\system32\Gggecnjm.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1840 -
C:\Windows\SysWOW64\Gnqnph32.exeC:\Windows\system32\Gnqnph32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1352 -
C:\Windows\SysWOW64\Gjgnei32.exeC:\Windows\system32\Gjgnei32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Windows\SysWOW64\Hbepok32.exeC:\Windows\system32\Hbepok32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Windows\SysWOW64\Hamifg32.exeC:\Windows\system32\Hamifg32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Windows\SysWOW64\Ijnqelcb.exeC:\Windows\system32\Ijnqelcb.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Windows\SysWOW64\Jklpnohp.exeC:\Windows\system32\Jklpnohp.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Windows\SysWOW64\Jmlipj32.exeC:\Windows\system32\Jmlipj32.exe33⤵
- Executes dropped EXE
PID:912 -
C:\Windows\SysWOW64\Kiegkk32.exeC:\Windows\system32\Kiegkk32.exe34⤵
- Executes dropped EXE
PID:1364 -
C:\Windows\SysWOW64\Kncoqioi.exeC:\Windows\system32\Kncoqioi.exe35⤵
- Executes dropped EXE
PID:1584 -
C:\Windows\SysWOW64\Kpdhbd32.exeC:\Windows\system32\Kpdhbd32.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1296 -
C:\Windows\SysWOW64\Ldijag32.exeC:\Windows\system32\Ldijag32.exe37⤵
- Executes dropped EXE
PID:1508 -
C:\Windows\SysWOW64\Lkglia32.exeC:\Windows\system32\Lkglia32.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:472 -
C:\Windows\SysWOW64\Loiabd32.exeC:\Windows\system32\Loiabd32.exe39⤵
- Executes dropped EXE
PID:1696 -
C:\Windows\SysWOW64\Molnhd32.exeC:\Windows\system32\Molnhd32.exe40⤵
- Executes dropped EXE
PID:2008 -
C:\Windows\SysWOW64\Mifpfi32.exeC:\Windows\system32\Mifpfi32.exe41⤵
- Executes dropped EXE
- Modifies registry class
PID:1732 -
C:\Windows\SysWOW64\Ngbbhddh.exeC:\Windows\system32\Ngbbhddh.exe42⤵
- Executes dropped EXE
PID:1964 -
C:\Windows\SysWOW64\Nmddlk32.exeC:\Windows\system32\Nmddlk32.exe43⤵
- Executes dropped EXE
PID:544 -
C:\Windows\SysWOW64\Ohiehgal.exeC:\Windows\system32\Ohiehgal.exe44⤵
- Executes dropped EXE
PID:1892 -
C:\Windows\SysWOW64\Plkjajdk.exeC:\Windows\system32\Plkjajdk.exe45⤵PID:1620
-
C:\Windows\SysWOW64\Pplpmhho.exeC:\Windows\system32\Pplpmhho.exe46⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\SysWOW64\Qekekodc.exeC:\Windows\system32\Qekekodc.exe47⤵
- Executes dropped EXE
PID:2000 -
C:\Windows\SysWOW64\Qemapn32.exeC:\Windows\system32\Qemapn32.exe48⤵
- Executes dropped EXE
PID:1744 -
C:\Windows\SysWOW64\Acjhhgjn.exeC:\Windows\system32\Acjhhgjn.exe49⤵
- Executes dropped EXE
PID:588 -
C:\Windows\SysWOW64\Aghanepd.exeC:\Windows\system32\Aghanepd.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:572 -
C:\Windows\SysWOW64\Ababoclc.exeC:\Windows\system32\Ababoclc.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:368 -
C:\Windows\SysWOW64\Bipcflpk.exeC:\Windows\system32\Bipcflpk.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1128 -
C:\Windows\SysWOW64\Bmdfeoqg.exeC:\Windows\system32\Bmdfeoqg.exe53⤵
- Executes dropped EXE
PID:800 -
C:\Windows\SysWOW64\Ccqkgifa.exeC:\Windows\system32\Ccqkgifa.exe54⤵
- Executes dropped EXE
PID:976 -
C:\Windows\SysWOW64\Djjocfpj.exeC:\Windows\system32\Djjocfpj.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1108 -
C:\Windows\SysWOW64\Eifbeb32.exeC:\Windows\system32\Eifbeb32.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:856 -
C:\Windows\SysWOW64\Eleoan32.exeC:\Windows\system32\Eleoan32.exe57⤵
- Executes dropped EXE
PID:832 -
C:\Windows\SysWOW64\Ehnlln32.exeC:\Windows\system32\Ehnlln32.exe58⤵
- Executes dropped EXE
PID:1484 -
C:\Windows\SysWOW64\Fheblmkg.exeC:\Windows\system32\Fheblmkg.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:968 -
C:\Windows\SysWOW64\Fcocmkhf.exeC:\Windows\system32\Fcocmkhf.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2016 -
C:\Windows\SysWOW64\Fkfknh32.exeC:\Windows\system32\Fkfknh32.exe61⤵
- Executes dropped EXE
PID:1168 -
C:\Windows\SysWOW64\Fndgjc32.exeC:\Windows\system32\Fndgjc32.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:864 -
C:\Windows\SysWOW64\Fjkhodmp.exeC:\Windows\system32\Fjkhodmp.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1532 -
C:\Windows\SysWOW64\Gchfcjpk.exeC:\Windows\system32\Gchfcjpk.exe64⤵
- Executes dropped EXE
PID:1244 -
C:\Windows\SysWOW64\Ghgkap32.exeC:\Windows\system32\Ghgkap32.exe65⤵
- Executes dropped EXE
PID:1492 -
C:\Windows\SysWOW64\Hqelkbgh.exeC:\Windows\system32\Hqelkbgh.exe66⤵
- Executes dropped EXE
PID:836 -
C:\Windows\SysWOW64\Hiekjd32.exeC:\Windows\system32\Hiekjd32.exe67⤵
- Modifies registry class
PID:1616 -
C:\Windows\SysWOW64\Hmbcqbgd.exeC:\Windows\system32\Hmbcqbgd.exe68⤵PID:1684
-
C:\Windows\SysWOW64\Hcmkmlna.exeC:\Windows\system32\Hcmkmlna.exe69⤵PID:1604
-
C:\Windows\SysWOW64\Hiidecli.exeC:\Windows\system32\Hiidecli.exe70⤵PID:1680
-
C:\Windows\SysWOW64\Ifmdogkb.exeC:\Windows\system32\Ifmdogkb.exe71⤵PID:988
-
C:\Windows\SysWOW64\Iageoe32.exeC:\Windows\system32\Iageoe32.exe72⤵PID:320
-
C:\Windows\SysWOW64\Ilmjmn32.exeC:\Windows\system32\Ilmjmn32.exe73⤵PID:1808
-
C:\Windows\SysWOW64\Inkfii32.exeC:\Windows\system32\Inkfii32.exe74⤵PID:692
-
C:\Windows\SysWOW64\Iaibee32.exeC:\Windows\system32\Iaibee32.exe75⤵PID:964
-
C:\Windows\SysWOW64\Impcjfkb.exeC:\Windows\system32\Impcjfkb.exe76⤵PID:604
-
C:\Windows\SysWOW64\Japhedpf.exeC:\Windows\system32\Japhedpf.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:956 -
C:\Windows\SysWOW64\Jphblpbl.exeC:\Windows\system32\Jphblpbl.exe78⤵PID:1756
-
C:\Windows\SysWOW64\Jhcfqb32.exeC:\Windows\system32\Jhcfqb32.exe79⤵PID:556
-
C:\Windows\SysWOW64\Jkdpbm32.exeC:\Windows\system32\Jkdpbm32.exe80⤵PID:1328
-
C:\Windows\SysWOW64\Kbkgck32.exeC:\Windows\system32\Kbkgck32.exe81⤵PID:1960
-
C:\Windows\SysWOW64\Kmgeihhf.exeC:\Windows\system32\Kmgeihhf.exe82⤵PID:2052
-
C:\Windows\SysWOW64\Kdcjlbmp.exeC:\Windows\system32\Kdcjlbmp.exe83⤵PID:2060
-
C:\Windows\SysWOW64\Lckdbnpe.exeC:\Windows\system32\Lckdbnpe.exe84⤵PID:2068
-
C:\Windows\SysWOW64\Lodamocg.exeC:\Windows\system32\Lodamocg.exe85⤵PID:2076
-
C:\Windows\SysWOW64\Mdecpe32.exeC:\Windows\system32\Mdecpe32.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2084 -
C:\Windows\SysWOW64\Mghigpig.exeC:\Windows\system32\Mghigpig.exe87⤵PID:2180
-
C:\Windows\SysWOW64\Nokcmapj.exeC:\Windows\system32\Nokcmapj.exe88⤵
- Drops file in System32 directory
PID:2188 -
C:\Windows\SysWOW64\Omjgji32.exeC:\Windows\system32\Omjgji32.exe89⤵PID:2196
-
C:\Windows\SysWOW64\Ojngcmdo.exeC:\Windows\system32\Ojngcmdo.exe90⤵PID:2204
-
C:\Windows\SysWOW64\Omlcpicb.exeC:\Windows\system32\Omlcpicb.exe91⤵PID:2212
-
C:\Windows\SysWOW64\Opoigc32.exeC:\Windows\system32\Opoigc32.exe92⤵PID:2220
-
C:\Windows\SysWOW64\Oelboj32.exeC:\Windows\system32\Oelboj32.exe93⤵PID:2228
-
C:\Windows\SysWOW64\Pbpbhola.exeC:\Windows\system32\Pbpbhola.exe94⤵
- Drops file in System32 directory
PID:2236 -
C:\Windows\SysWOW64\Pkkgmaim.exeC:\Windows\system32\Pkkgmaim.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2316 -
C:\Windows\SysWOW64\Pdkafe32.exeC:\Windows\system32\Pdkafe32.exe96⤵PID:2324
-
C:\Windows\SysWOW64\Pginba32.exeC:\Windows\system32\Pginba32.exe97⤵PID:2332
-
C:\Windows\SysWOW64\Aecdom32.exeC:\Windows\system32\Aecdom32.exe98⤵PID:2340
-
C:\Windows\SysWOW64\Aopbba32.exeC:\Windows\system32\Aopbba32.exe99⤵PID:2348
-
C:\Windows\SysWOW64\Akgcgb32.exeC:\Windows\system32\Akgcgb32.exe100⤵PID:2356
-
C:\Windows\SysWOW64\Bnglin32.exeC:\Windows\system32\Bnglin32.exe101⤵PID:2364
-
C:\Windows\SysWOW64\Bjqicn32.exeC:\Windows\system32\Bjqicn32.exe102⤵PID:2372
-
C:\Windows\SysWOW64\Bmoepj32.exeC:\Windows\system32\Bmoepj32.exe103⤵PID:2380
-
C:\Windows\SysWOW64\Cobkgdlp.exeC:\Windows\system32\Cobkgdlp.exe104⤵PID:2460
-
C:\Windows\SysWOW64\Ckkhaepa.exeC:\Windows\system32\Ckkhaepa.exe105⤵PID:2468
-
C:\Windows\SysWOW64\Cefjpjdo.exeC:\Windows\system32\Cefjpjdo.exe106⤵PID:2476
-
C:\Windows\SysWOW64\Damjek32.exeC:\Windows\system32\Damjek32.exe107⤵
- Drops file in System32 directory
PID:2484 -
C:\Windows\SysWOW64\Dckgag32.exeC:\Windows\system32\Dckgag32.exe108⤵
- Modifies registry class
PID:2492 -
C:\Windows\SysWOW64\Dpbgfh32.exeC:\Windows\system32\Dpbgfh32.exe109⤵PID:2500
-
C:\Windows\SysWOW64\Dcpplfea.exeC:\Windows\system32\Dcpplfea.exe110⤵
- Modifies registry class
PID:2508 -
C:\Windows\SysWOW64\Dimhdmci.exeC:\Windows\system32\Dimhdmci.exe111⤵PID:2516
-
C:\Windows\SysWOW64\Eehbdm32.exeC:\Windows\system32\Eehbdm32.exe112⤵PID:2524
-
C:\Windows\SysWOW64\Enpgmckh.exeC:\Windows\system32\Enpgmckh.exe113⤵PID:2532
-
C:\Windows\SysWOW64\Edplki32.exeC:\Windows\system32\Edplki32.exe114⤵PID:2540
-
C:\Windows\SysWOW64\Efnhge32.exeC:\Windows\system32\Efnhge32.exe115⤵PID:2552
-
C:\Windows\SysWOW64\Emjniolk.exeC:\Windows\system32\Emjniolk.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2564 -
C:\Windows\SysWOW64\Fknncc32.exeC:\Windows\system32\Fknncc32.exe117⤵PID:2572
-
C:\Windows\SysWOW64\Fmmjon32.exeC:\Windows\system32\Fmmjon32.exe118⤵PID:2580
-
C:\Windows\SysWOW64\Flpjkkab.exeC:\Windows\system32\Flpjkkab.exe119⤵PID:2612
-
C:\Windows\SysWOW64\Fickdopl.exeC:\Windows\system32\Fickdopl.exe120⤵PID:2640
-
C:\Windows\SysWOW64\Flbgpkop.exeC:\Windows\system32\Flbgpkop.exe121⤵
- Modifies registry class
PID:2744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-