Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
187s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 13:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f449713042aea09a66a8481b6ffce1a_JC.exe
Resource
win7-20230831-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f449713042aea09a66a8481b6ffce1a_JC.exe
Resource
win10v2004-20230915-en
5 signatures
150 seconds
General
-
Target
0f449713042aea09a66a8481b6ffce1a_JC.exe
-
Size
148KB
-
MD5
0f449713042aea09a66a8481b6ffce1a
-
SHA1
6c4662aa6378f77c13673abe00b3c87c343e6b3b
-
SHA256
03ea95c791472e9bcba523d30d9cb59f0734908b03ab5506a47877992d3dcfe4
-
SHA512
48d290d342e5cfa5722a69a28433866e9f4e9d11343cd10676e8438dc5a16568ac667985d3eb38df656a4cf86fc7b65298352723315af2ad1b6eb22e9058cce6
-
SSDEEP
3072:7JYgdFI+OW2TebbGWHS7z9v8nrJDtD5adCpAl:7JYgFOW2UGWH0zV8rJDtDqcAl
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bmdkcnie.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kddpnpdn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cikkga32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Khabdk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgfbbb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lnoalehl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Alioloje.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpbgnlfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dbbdip32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Peonhg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qpikao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fechhcal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ahmjce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lcdjba32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abjkmqni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fnjmea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Efikco32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oapljmgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bdmmnd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bdapehop.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dbbdip32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgcoaock.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aoenbkll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oapljmgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qkqdnkge.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cebllbcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hahcfi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmmnanao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nabpiocm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afhfaddk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Daeifj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jjkdlall.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Obgofmjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ppdbfpaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qpikao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Caagpdop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Onapnbhi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahmjce32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aemjjeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Coojpg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Johnkbaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dgnffp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emikpeig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qpfokpoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcdifdem.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgbljkca.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahacndjo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lcdjba32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Peaokh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mdikpjeb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kacgld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Plapdb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Niipdpae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ahacndjo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nkapnbqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jdhpba32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pejdmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nnccmddi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcdifdem.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdeiqgkj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eakdje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eapmedef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pejdmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Djkdnool.exe -
Executes dropped EXE 64 IoCs
pid Process 2948 Ampaho32.exe 2564 Afhfaddk.exe 4868 Banjnm32.exe 2568 Bmdkcnie.exe 1204 Bfmolc32.exe 3780 Bdapehop.exe 4828 Bphqji32.exe 1356 Bdeiqgkj.exe 3900 Cgfbbb32.exe 2772 Cmpjoloh.exe 2676 Cancekeo.exe 1228 Cgklmacf.exe 4924 Cdaile32.exe 4884 Daeifj32.exe 4440 Dknnoofg.exe 4132 Dkpjdo32.exe 4624 Jjkdlall.exe 3324 Hfefdpfe.exe 4284 Afnefieo.exe 232 Jcpojk32.exe 228 Qkqdnkge.exe 1700 Dbbdip32.exe 3836 Lcdjba32.exe 1788 Mjaodkmo.exe 4316 Nmkkle32.exe 4156 Dgnffp32.exe 3364 Dnhncjom.exe 1068 Debfpd32.exe 364 Dgcoaock.exe 2340 Eakdje32.exe 3588 Eapmedef.exe 5060 Ekeacmel.exe 4896 Eabjkdcc.exe 884 Emikpeig.exe 4240 Fcepbooa.exe 4088 Abjkmqni.exe 5068 Fnjmea32.exe 1904 Jognokdi.exe 1412 Jgbccm32.exe 1248 Jdfcla32.exe 4780 Jdhpba32.exe 4824 Khkbcopl.exe 5108 Koekpi32.exe 3024 Kacgld32.exe 2976 Koggehff.exe 2844 Kddpnpdn.exe 1356 Kgbljkca.exe 2568 Kojdkhdd.exe 4420 Lnoalehl.exe 4576 Lkenkhec.exe 3924 Ongijo32.exe 2348 Ogajid32.exe 3888 Obgofmjb.exe 4912 Ppkopail.exe 5004 Plapdb32.exe 2964 Pejdmh32.exe 408 Pbndgl32.exe 1536 Pelacg32.exe 3432 Peonhg32.exe 696 Ppdbfpaa.exe 2160 Paennh32.exe 1704 Qpfokpoo.exe 2200 Qpikao32.exe 2972 Aonhblad.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Mdikpjeb.exe Khabdk32.exe File opened for modification C:\Windows\SysWOW64\Mdikpjeb.exe Khabdk32.exe File created C:\Windows\SysWOW64\Jgbccm32.exe Jognokdi.exe File created C:\Windows\SysWOW64\Pbndgl32.exe Pejdmh32.exe File opened for modification C:\Windows\SysWOW64\Pbndgl32.exe Pejdmh32.exe File created C:\Windows\SysWOW64\Ldcinlep.dll Bbecnipp.exe File created C:\Windows\SysWOW64\Coojpg32.exe Cibagpgg.exe File created C:\Windows\SysWOW64\Paceoa32.dll Akblpo32.exe File created C:\Windows\SysWOW64\Pabgnqhk.dll Kacgld32.exe File created C:\Windows\SysWOW64\Pejdmh32.exe Plapdb32.exe File opened for modification C:\Windows\SysWOW64\Bmdkcnie.exe Banjnm32.exe File created C:\Windows\SysWOW64\Afnefieo.exe Hfefdpfe.exe File created C:\Windows\SysWOW64\Ofacao32.dll Hfefdpfe.exe File created C:\Windows\SysWOW64\Djlppb32.dll Abjkmqni.exe File created C:\Windows\SysWOW64\Ehfljn32.dll Jognokdi.exe File opened for modification C:\Windows\SysWOW64\Kacgld32.exe Koekpi32.exe File created C:\Windows\SysWOW64\Blbabnbk.exe Bhdilold.exe File opened for modification C:\Windows\SysWOW64\Caagpdop.exe Blbabnbk.exe File created C:\Windows\SysWOW64\Amnlfk32.exe Ahacndjo.exe File created C:\Windows\SysWOW64\Lcdjba32.exe Dbbdip32.exe File created C:\Windows\SysWOW64\Nmkkle32.exe Mjaodkmo.exe File created C:\Windows\SysWOW64\Lfbqdb32.dll Lnoalehl.exe File opened for modification C:\Windows\SysWOW64\Jikfbkbc.exe Jgmjfpco.exe File opened for modification C:\Windows\SysWOW64\Cgdlqo32.exe Boenam32.exe File created C:\Windows\SysWOW64\Cllhdh32.dll Cgdlqo32.exe File created C:\Windows\SysWOW64\Ahdpdd32.exe Amnlfk32.exe File created C:\Windows\SysWOW64\Ekeacmel.exe Eapmedef.exe File created C:\Windows\SysWOW64\Kpignncc.dll Jdfcla32.exe File created C:\Windows\SysWOW64\Kojdkhdd.exe Kgbljkca.exe File created C:\Windows\SysWOW64\Flhpen32.dll Ppkopail.exe File opened for modification C:\Windows\SysWOW64\Fhpmql32.exe Efikco32.exe File opened for modification C:\Windows\SysWOW64\Iipfgm32.exe Fechhcal.exe File created C:\Windows\SysWOW64\Qkobck32.dll Mqhmbqlh.exe File opened for modification C:\Windows\SysWOW64\Bdmmnd32.exe Banabi32.exe File opened for modification C:\Windows\SysWOW64\Bdapehop.exe Bfmolc32.exe File opened for modification C:\Windows\SysWOW64\Bphqji32.exe Bdapehop.exe File created C:\Windows\SysWOW64\Daeifj32.exe Cdaile32.exe File created C:\Windows\SysWOW64\Jjkdlall.exe Dkpjdo32.exe File opened for modification C:\Windows\SysWOW64\Mjaodkmo.exe Lcdjba32.exe File created C:\Windows\SysWOW64\Hfpjphap.dll Mnjqfeld.exe File opened for modification C:\Windows\SysWOW64\Dnhncjom.exe Dgnffp32.exe File created C:\Windows\SysWOW64\Bbecnipp.exe Blkkaohc.exe File opened for modification C:\Windows\SysWOW64\Khabdk32.exe Cgdlqo32.exe File opened for modification C:\Windows\SysWOW64\Cgklmacf.exe Cancekeo.exe File opened for modification C:\Windows\SysWOW64\Jdhpba32.exe Jdfcla32.exe File created C:\Windows\SysWOW64\Khkbcopl.exe Jdhpba32.exe File opened for modification C:\Windows\SysWOW64\Khkbcopl.exe Jdhpba32.exe File opened for modification C:\Windows\SysWOW64\Pejdmh32.exe Plapdb32.exe File created C:\Windows\SysWOW64\Johnkbaj.exe Jikfbkbc.exe File created C:\Windows\SysWOW64\Abocgb32.dll Dknnoofg.exe File opened for modification C:\Windows\SysWOW64\Pelacg32.exe Pbndgl32.exe File created C:\Windows\SysWOW64\Nfeekgjo.exe Mqhmbqlh.exe File created C:\Windows\SysWOW64\Nabpiocm.exe Nnccmddi.exe File created C:\Windows\SysWOW64\Oljpld32.dll Ogcnfheb.exe File opened for modification C:\Windows\SysWOW64\Dgnffp32.exe Nmkkle32.exe File opened for modification C:\Windows\SysWOW64\Dgcoaock.exe Debfpd32.exe File created C:\Windows\SysWOW64\Fbinda32.dll Obgofmjb.exe File created C:\Windows\SysWOW64\Npgmjl32.exe Nabpiocm.exe File opened for modification C:\Windows\SysWOW64\Ofaeffpa.exe Npgmjl32.exe File opened for modification C:\Windows\SysWOW64\Ahdpdd32.exe Amnlfk32.exe File created C:\Windows\SysWOW64\Gcmghl32.dll Caagpdop.exe File created C:\Windows\SysWOW64\Nkapnbqo.exe Mdikpjeb.exe File created C:\Windows\SysWOW64\Debfpd32.exe Dnhncjom.exe File opened for modification C:\Windows\SysWOW64\Eabjkdcc.exe Ekeacmel.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hfefdpfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Deiblamk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dekobaki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Djkdnool.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjejiiif.dll" Nnccmddi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cgdlqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgdcdg32.dll" Ampaho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dkpjdo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eakdje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eabjkdcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Emikpeig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omkemfdn.dll" Aemjjeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdfgaa32.dll" Djkdnool.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fechhcal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ampaho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcidlo32.dll" Bdeiqgkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqdnqilg.dll" Mcnfhmcf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmamii32.dll" Ogeklh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bkdieo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abocgb32.dll" Dknnoofg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ofaeffpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnodjakb.dll" Npgmjl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ombcdo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Canjpp32.dll" Bpodhf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mojffn32.dll" Bkdieo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldjldd32.dll" Dekobaki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jikfbkbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibqaoebi.dll" Coojpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaojmhlo.dll" Efikco32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okkimnea.dll" Iipfgm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bmdkcnie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aoenbkll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ppdbfpaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjjlij32.dll" Hahcfi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nabpiocm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ogcnfheb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bkdieo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 0f449713042aea09a66a8481b6ffce1a_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dnhncjom.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jcpojk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nmkkle32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kojdkhdd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lkenkhec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cpbgnlfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfacfmlb.dll" Cebllbcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjcfndog.dll" Bphqji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Afnefieo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghnjedlk.dll" Bdmmnd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dpnfjjla.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hahcfi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kclkocfe.dll" Lkenkhec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pejdmh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Djkdnool.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdaiegkj.dll" Niipdpae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffdidbph.dll" Fclmkb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfpccklb.dll" Nkapnbqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jcpojk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpignncc.dll" Jdfcla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agobcjka.dll" Peonhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhfcjc32.dll" Paennh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqpfofao.dll" Cikkga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmjaif32.dll" Dpcpei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcicfbam.dll" Fechhcal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nfeekgjo.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3640 wrote to memory of 2948 3640 0f449713042aea09a66a8481b6ffce1a_JC.exe 86 PID 3640 wrote to memory of 2948 3640 0f449713042aea09a66a8481b6ffce1a_JC.exe 86 PID 3640 wrote to memory of 2948 3640 0f449713042aea09a66a8481b6ffce1a_JC.exe 86 PID 2948 wrote to memory of 2564 2948 Ampaho32.exe 87 PID 2948 wrote to memory of 2564 2948 Ampaho32.exe 87 PID 2948 wrote to memory of 2564 2948 Ampaho32.exe 87 PID 2564 wrote to memory of 4868 2564 Afhfaddk.exe 88 PID 2564 wrote to memory of 4868 2564 Afhfaddk.exe 88 PID 2564 wrote to memory of 4868 2564 Afhfaddk.exe 88 PID 4868 wrote to memory of 2568 4868 Banjnm32.exe 89 PID 4868 wrote to memory of 2568 4868 Banjnm32.exe 89 PID 4868 wrote to memory of 2568 4868 Banjnm32.exe 89 PID 2568 wrote to memory of 1204 2568 Bmdkcnie.exe 90 PID 2568 wrote to memory of 1204 2568 Bmdkcnie.exe 90 PID 2568 wrote to memory of 1204 2568 Bmdkcnie.exe 90 PID 1204 wrote to memory of 3780 1204 Bfmolc32.exe 91 PID 1204 wrote to memory of 3780 1204 Bfmolc32.exe 91 PID 1204 wrote to memory of 3780 1204 Bfmolc32.exe 91 PID 3780 wrote to memory of 4828 3780 Bdapehop.exe 92 PID 3780 wrote to memory of 4828 3780 Bdapehop.exe 92 PID 3780 wrote to memory of 4828 3780 Bdapehop.exe 92 PID 4828 wrote to memory of 1356 4828 Bphqji32.exe 93 PID 4828 wrote to memory of 1356 4828 Bphqji32.exe 93 PID 4828 wrote to memory of 1356 4828 Bphqji32.exe 93 PID 1356 wrote to memory of 3900 1356 Bdeiqgkj.exe 94 PID 1356 wrote to memory of 3900 1356 Bdeiqgkj.exe 94 PID 1356 wrote to memory of 3900 1356 Bdeiqgkj.exe 94 PID 3900 wrote to memory of 2772 3900 Cgfbbb32.exe 96 PID 3900 wrote to memory of 2772 3900 Cgfbbb32.exe 96 PID 3900 wrote to memory of 2772 3900 Cgfbbb32.exe 96 PID 2772 wrote to memory of 2676 2772 Cmpjoloh.exe 97 PID 2772 wrote to memory of 2676 2772 Cmpjoloh.exe 97 PID 2772 wrote to memory of 2676 2772 Cmpjoloh.exe 97 PID 2676 wrote to memory of 1228 2676 Cancekeo.exe 98 PID 2676 wrote to memory of 1228 2676 Cancekeo.exe 98 PID 2676 wrote to memory of 1228 2676 Cancekeo.exe 98 PID 1228 wrote to memory of 4924 1228 Cgklmacf.exe 99 PID 1228 wrote to memory of 4924 1228 Cgklmacf.exe 99 PID 1228 wrote to memory of 4924 1228 Cgklmacf.exe 99 PID 4924 wrote to memory of 4884 4924 Cdaile32.exe 100 PID 4924 wrote to memory of 4884 4924 Cdaile32.exe 100 PID 4924 wrote to memory of 4884 4924 Cdaile32.exe 100 PID 4884 wrote to memory of 4440 4884 Daeifj32.exe 101 PID 4884 wrote to memory of 4440 4884 Daeifj32.exe 101 PID 4884 wrote to memory of 4440 4884 Daeifj32.exe 101 PID 4440 wrote to memory of 4132 4440 Dknnoofg.exe 102 PID 4440 wrote to memory of 4132 4440 Dknnoofg.exe 102 PID 4440 wrote to memory of 4132 4440 Dknnoofg.exe 102 PID 4132 wrote to memory of 4624 4132 Dkpjdo32.exe 103 PID 4132 wrote to memory of 4624 4132 Dkpjdo32.exe 103 PID 4132 wrote to memory of 4624 4132 Dkpjdo32.exe 103 PID 4624 wrote to memory of 3324 4624 Jjkdlall.exe 104 PID 4624 wrote to memory of 3324 4624 Jjkdlall.exe 104 PID 4624 wrote to memory of 3324 4624 Jjkdlall.exe 104 PID 3324 wrote to memory of 4284 3324 Hfefdpfe.exe 105 PID 3324 wrote to memory of 4284 3324 Hfefdpfe.exe 105 PID 3324 wrote to memory of 4284 3324 Hfefdpfe.exe 105 PID 4284 wrote to memory of 232 4284 Afnefieo.exe 106 PID 4284 wrote to memory of 232 4284 Afnefieo.exe 106 PID 4284 wrote to memory of 232 4284 Afnefieo.exe 106 PID 232 wrote to memory of 228 232 Jcpojk32.exe 107 PID 232 wrote to memory of 228 232 Jcpojk32.exe 107 PID 232 wrote to memory of 228 232 Jcpojk32.exe 107 PID 228 wrote to memory of 1700 228 Qkqdnkge.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f449713042aea09a66a8481b6ffce1a_JC.exe"C:\Users\Admin\AppData\Local\Temp\0f449713042aea09a66a8481b6ffce1a_JC.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\Ampaho32.exeC:\Windows\system32\Ampaho32.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\Afhfaddk.exeC:\Windows\system32\Afhfaddk.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\Banjnm32.exeC:\Windows\system32\Banjnm32.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\Bmdkcnie.exeC:\Windows\system32\Bmdkcnie.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\Bfmolc32.exeC:\Windows\system32\Bfmolc32.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\Bdapehop.exeC:\Windows\system32\Bdapehop.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\Bphqji32.exeC:\Windows\system32\Bphqji32.exe8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\Bdeiqgkj.exeC:\Windows\system32\Bdeiqgkj.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\Cgfbbb32.exeC:\Windows\system32\Cgfbbb32.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\Cmpjoloh.exeC:\Windows\system32\Cmpjoloh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\Cancekeo.exeC:\Windows\system32\Cancekeo.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\Cgklmacf.exeC:\Windows\system32\Cgklmacf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\Cdaile32.exeC:\Windows\system32\Cdaile32.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\Daeifj32.exeC:\Windows\system32\Daeifj32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\Dknnoofg.exeC:\Windows\system32\Dknnoofg.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\Dkpjdo32.exeC:\Windows\system32\Dkpjdo32.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\Jjkdlall.exeC:\Windows\system32\Jjkdlall.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\Hfefdpfe.exeC:\Windows\system32\Hfefdpfe.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\Afnefieo.exeC:\Windows\system32\Afnefieo.exe20⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\Jcpojk32.exeC:\Windows\system32\Jcpojk32.exe21⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Windows\SysWOW64\Qkqdnkge.exeC:\Windows\system32\Qkqdnkge.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\Dbbdip32.exeC:\Windows\system32\Dbbdip32.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1700 -
C:\Windows\SysWOW64\Lcdjba32.exeC:\Windows\system32\Lcdjba32.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:3836 -
C:\Windows\SysWOW64\Mjaodkmo.exeC:\Windows\system32\Mjaodkmo.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1788 -
C:\Windows\SysWOW64\Nmkkle32.exeC:\Windows\system32\Nmkkle32.exe26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4316 -
C:\Windows\SysWOW64\Dgnffp32.exeC:\Windows\system32\Dgnffp32.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:4156 -
C:\Windows\SysWOW64\Dnhncjom.exeC:\Windows\system32\Dnhncjom.exe28⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3364 -
C:\Windows\SysWOW64\Debfpd32.exeC:\Windows\system32\Debfpd32.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1068 -
C:\Windows\SysWOW64\Dgcoaock.exeC:\Windows\system32\Dgcoaock.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:364 -
C:\Windows\SysWOW64\Eakdje32.exeC:\Windows\system32\Eakdje32.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2340 -
C:\Windows\SysWOW64\Eapmedef.exeC:\Windows\system32\Eapmedef.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:3588 -
C:\Windows\SysWOW64\Ekeacmel.exeC:\Windows\system32\Ekeacmel.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5060 -
C:\Windows\SysWOW64\Eabjkdcc.exeC:\Windows\system32\Eabjkdcc.exe34⤵
- Executes dropped EXE
- Modifies registry class
PID:4896 -
C:\Windows\SysWOW64\Emikpeig.exeC:\Windows\system32\Emikpeig.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:884 -
C:\Windows\SysWOW64\Fcepbooa.exeC:\Windows\system32\Fcepbooa.exe36⤵
- Executes dropped EXE
PID:4240 -
C:\Windows\SysWOW64\Abjkmqni.exeC:\Windows\system32\Abjkmqni.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:4088 -
C:\Windows\SysWOW64\Fnjmea32.exeC:\Windows\system32\Fnjmea32.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:5068 -
C:\Windows\SysWOW64\Jognokdi.exeC:\Windows\system32\Jognokdi.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1904 -
C:\Windows\SysWOW64\Jgbccm32.exeC:\Windows\system32\Jgbccm32.exe40⤵
- Executes dropped EXE
PID:1412 -
C:\Windows\SysWOW64\Jdfcla32.exeC:\Windows\system32\Jdfcla32.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1248 -
C:\Windows\SysWOW64\Jdhpba32.exeC:\Windows\system32\Jdhpba32.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:4780 -
C:\Windows\SysWOW64\Khkbcopl.exeC:\Windows\system32\Khkbcopl.exe43⤵
- Executes dropped EXE
PID:4824 -
C:\Windows\SysWOW64\Koekpi32.exeC:\Windows\system32\Koekpi32.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5108 -
C:\Windows\SysWOW64\Kacgld32.exeC:\Windows\system32\Kacgld32.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:3024 -
C:\Windows\SysWOW64\Koggehff.exeC:\Windows\system32\Koggehff.exe46⤵
- Executes dropped EXE
PID:2976 -
C:\Windows\SysWOW64\Kddpnpdn.exeC:\Windows\system32\Kddpnpdn.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2844 -
C:\Windows\SysWOW64\Kgbljkca.exeC:\Windows\system32\Kgbljkca.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1356 -
C:\Windows\SysWOW64\Kojdkhdd.exeC:\Windows\system32\Kojdkhdd.exe49⤵
- Executes dropped EXE
- Modifies registry class
PID:2568 -
C:\Windows\SysWOW64\Lnoalehl.exeC:\Windows\system32\Lnoalehl.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:4420 -
C:\Windows\SysWOW64\Lkenkhec.exeC:\Windows\system32\Lkenkhec.exe51⤵
- Executes dropped EXE
- Modifies registry class
PID:4576 -
C:\Windows\SysWOW64\Ongijo32.exeC:\Windows\system32\Ongijo32.exe52⤵
- Executes dropped EXE
PID:3924 -
C:\Windows\SysWOW64\Ogajid32.exeC:\Windows\system32\Ogajid32.exe53⤵
- Executes dropped EXE
PID:2348 -
C:\Windows\SysWOW64\Obgofmjb.exeC:\Windows\system32\Obgofmjb.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:3888 -
C:\Windows\SysWOW64\Ppkopail.exeC:\Windows\system32\Ppkopail.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4912 -
C:\Windows\SysWOW64\Plapdb32.exeC:\Windows\system32\Plapdb32.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:5004 -
C:\Windows\SysWOW64\Pejdmh32.exeC:\Windows\system32\Pejdmh32.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2964 -
C:\Windows\SysWOW64\Pbndgl32.exeC:\Windows\system32\Pbndgl32.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:408 -
C:\Windows\SysWOW64\Pelacg32.exeC:\Windows\system32\Pelacg32.exe59⤵
- Executes dropped EXE
PID:1536 -
C:\Windows\SysWOW64\Peonhg32.exeC:\Windows\system32\Peonhg32.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:3432 -
C:\Windows\SysWOW64\Ppdbfpaa.exeC:\Windows\system32\Ppdbfpaa.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:696 -
C:\Windows\SysWOW64\Paennh32.exeC:\Windows\system32\Paennh32.exe62⤵
- Executes dropped EXE
- Modifies registry class
PID:2160 -
C:\Windows\SysWOW64\Qpfokpoo.exeC:\Windows\system32\Qpfokpoo.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1704 -
C:\Windows\SysWOW64\Qpikao32.exeC:\Windows\system32\Qpikao32.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2200 -
C:\Windows\SysWOW64\Aonhblad.exeC:\Windows\system32\Aonhblad.exe65⤵
- Executes dropped EXE
PID:2972 -
C:\Windows\SysWOW64\Albikp32.exeC:\Windows\system32\Albikp32.exe66⤵PID:4652
-
C:\Windows\SysWOW64\Ablahjhj.exeC:\Windows\system32\Ablahjhj.exe67⤵PID:2036
-
C:\Windows\SysWOW64\Appaangd.exeC:\Windows\system32\Appaangd.exe68⤵PID:2808
-
C:\Windows\SysWOW64\Aemjjeek.exeC:\Windows\system32\Aemjjeek.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1908 -
C:\Windows\SysWOW64\Aoenbkll.exeC:\Windows\system32\Aoenbkll.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3780 -
C:\Windows\SysWOW64\Alioloje.exeC:\Windows\system32\Alioloje.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4292 -
C:\Windows\SysWOW64\Blkkaohc.exeC:\Windows\system32\Blkkaohc.exe72⤵
- Drops file in System32 directory
PID:3784 -
C:\Windows\SysWOW64\Bbecnipp.exeC:\Windows\system32\Bbecnipp.exe73⤵
- Drops file in System32 directory
PID:3108 -
C:\Windows\SysWOW64\Boldcj32.exeC:\Windows\system32\Boldcj32.exe74⤵PID:3276
-
C:\Windows\SysWOW64\Bhdilold.exeC:\Windows\system32\Bhdilold.exe75⤵
- Drops file in System32 directory
PID:4556 -
C:\Windows\SysWOW64\Blbabnbk.exeC:\Windows\system32\Blbabnbk.exe76⤵
- Drops file in System32 directory
PID:2284 -
C:\Windows\SysWOW64\Caagpdop.exeC:\Windows\system32\Caagpdop.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2184 -
C:\Windows\SysWOW64\Cpbgnlfo.exeC:\Windows\system32\Cpbgnlfo.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2424 -
C:\Windows\SysWOW64\Cikkga32.exeC:\Windows\system32\Cikkga32.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1716 -
C:\Windows\SysWOW64\Cebllbcc.exeC:\Windows\system32\Cebllbcc.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2240 -
C:\Windows\SysWOW64\Ccfmef32.exeC:\Windows\system32\Ccfmef32.exe81⤵PID:1432
-
C:\Windows\SysWOW64\Cibagpgg.exeC:\Windows\system32\Cibagpgg.exe82⤵
- Drops file in System32 directory
PID:4696 -
C:\Windows\SysWOW64\Coojpg32.exeC:\Windows\system32\Coojpg32.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2772 -
C:\Windows\SysWOW64\Deiblamk.exeC:\Windows\system32\Deiblamk.exe84⤵
- Modifies registry class
PID:3720 -
C:\Windows\SysWOW64\Dpnfjjla.exeC:\Windows\system32\Dpnfjjla.exe85⤵
- Modifies registry class
PID:1460 -
C:\Windows\SysWOW64\Dekobaki.exeC:\Windows\system32\Dekobaki.exe86⤵
- Modifies registry class
PID:4528 -
C:\Windows\SysWOW64\Dpcpei32.exeC:\Windows\system32\Dpcpei32.exe87⤵
- Modifies registry class
PID:1464 -
C:\Windows\SysWOW64\Djkdnool.exeC:\Windows\system32\Djkdnool.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:4772 -
C:\Windows\SysWOW64\Dcdifdem.exeC:\Windows\system32\Dcdifdem.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2616 -
C:\Windows\SysWOW64\Eoocfegl.exeC:\Windows\system32\Eoocfegl.exe90⤵PID:1124
-
C:\Windows\SysWOW64\Efikco32.exeC:\Windows\system32\Efikco32.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:4708 -
C:\Windows\SysWOW64\Fhpmql32.exeC:\Windows\system32\Fhpmql32.exe92⤵PID:1792
-
C:\Windows\SysWOW64\Niipdpae.exeC:\Windows\system32\Niipdpae.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1592 -
C:\Windows\SysWOW64\Hahcfi32.exeC:\Windows\system32\Hahcfi32.exe94⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2320 -
C:\Windows\SysWOW64\Peaokh32.exeC:\Windows\system32\Peaokh32.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2588 -
C:\Windows\SysWOW64\Fclmkb32.exeC:\Windows\system32\Fclmkb32.exe96⤵
- Modifies registry class
PID:4784 -
C:\Windows\SysWOW64\Kjjinp32.exeC:\Windows\system32\Kjjinp32.exe97⤵PID:5052
-
C:\Windows\SysWOW64\Fechhcal.exeC:\Windows\system32\Fechhcal.exe98⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:5108 -
C:\Windows\SysWOW64\Iipfgm32.exeC:\Windows\system32\Iipfgm32.exe99⤵
- Modifies registry class
PID:392 -
C:\Windows\SysWOW64\Jgmjfpco.exeC:\Windows\system32\Jgmjfpco.exe100⤵
- Drops file in System32 directory
PID:3200 -
C:\Windows\SysWOW64\Jikfbkbc.exeC:\Windows\system32\Jikfbkbc.exe101⤵
- Drops file in System32 directory
- Modifies registry class
PID:1788 -
C:\Windows\SysWOW64\Johnkbaj.exeC:\Windows\system32\Johnkbaj.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3708 -
C:\Windows\SysWOW64\Lfnfck32.exeC:\Windows\system32\Lfnfck32.exe103⤵PID:3144
-
C:\Windows\SysWOW64\Mcnfhmcf.exeC:\Windows\system32\Mcnfhmcf.exe104⤵
- Modifies registry class
PID:3048 -
C:\Windows\SysWOW64\Mnjqfeld.exeC:\Windows\system32\Mnjqfeld.exe105⤵
- Drops file in System32 directory
PID:4552 -
C:\Windows\SysWOW64\Mqhmbqlh.exeC:\Windows\system32\Mqhmbqlh.exe106⤵
- Drops file in System32 directory
PID:3384 -
C:\Windows\SysWOW64\Nfeekgjo.exeC:\Windows\system32\Nfeekgjo.exe107⤵
- Modifies registry class
PID:212 -
C:\Windows\SysWOW64\Nnccmddi.exeC:\Windows\system32\Nnccmddi.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2160 -
C:\Windows\SysWOW64\Nabpiocm.exeC:\Windows\system32\Nabpiocm.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2972 -
C:\Windows\SysWOW64\Npgmjl32.exeC:\Windows\system32\Npgmjl32.exe110⤵
- Drops file in System32 directory
- Modifies registry class
PID:4652 -
C:\Windows\SysWOW64\Ofaeffpa.exeC:\Windows\system32\Ofaeffpa.exe111⤵
- Modifies registry class
PID:1204 -
C:\Windows\SysWOW64\Oceepj32.exeC:\Windows\system32\Oceepj32.exe112⤵PID:720
-
C:\Windows\SysWOW64\Ogcnfheb.exeC:\Windows\system32\Ogcnfheb.exe113⤵
- Drops file in System32 directory
- Modifies registry class
PID:4468 -
C:\Windows\SysWOW64\Onmfcb32.exeC:\Windows\system32\Onmfcb32.exe114⤵PID:4896
-
C:\Windows\SysWOW64\Ogeklh32.exeC:\Windows\system32\Ogeklh32.exe115⤵
- Modifies registry class
PID:3084 -
C:\Windows\SysWOW64\Ombcdo32.exeC:\Windows\system32\Ombcdo32.exe116⤵
- Modifies registry class
PID:844 -
C:\Windows\SysWOW64\Opqopj32.exeC:\Windows\system32\Opqopj32.exe117⤵PID:736
-
C:\Windows\SysWOW64\Onapnbhi.exeC:\Windows\system32\Onapnbhi.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4680 -
C:\Windows\SysWOW64\Oapljmgm.exeC:\Windows\system32\Oapljmgm.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1680 -
C:\Windows\SysWOW64\Ahmjce32.exeC:\Windows\system32\Ahmjce32.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2616 -
C:\Windows\SysWOW64\Akkfop32.exeC:\Windows\system32\Akkfop32.exe121⤵PID:2612
-
C:\Windows\SysWOW64\Ahacndjo.exeC:\Windows\system32\Ahacndjo.exe122⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:4500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-