Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03/01/2024, 15:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
83ccf0608059602b88e3268e43db30a1.exe
Resource
win7-20231215-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
83ccf0608059602b88e3268e43db30a1.exe
Resource
win10v2004-20231215-en
5 signatures
150 seconds
General
-
Target
83ccf0608059602b88e3268e43db30a1.exe
-
Size
255KB
-
MD5
83ccf0608059602b88e3268e43db30a1
-
SHA1
f1fe080283062fe360e39f4407fbcd50c65683eb
-
SHA256
73184ad74d91a1803ce9589837dfd4514a2cbbafc84a13c19328dc4488ae1538
-
SHA512
983d6d60006edf568e5a96546dfdcb83a03cc49bbc0e2725da840983ac0e35dafbcb733d39fe192d88437d9e305650005266e718440db5a0c791dc0ed57d0137
-
SSDEEP
3072:/H6JQrfoku8w8asCHNhMXi6Y0HYSx9m9jqLsFmsdYXmAMS3KUUibN8ohXiHm9Ne0:/aJYVu82xUS6UJjwszeXmDZUH8aiGaEP
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebggep32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmjpod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nmbhgjoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pldcdhpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Maohdj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdccka32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mggolhaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fibocnnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hjjbmhfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jdkkjl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eleikb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmdogpmq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kghjakbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cmabpmjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oaliidon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pgfljqia.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lihpbl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlkejgfj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgnihd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdggoi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glgjfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oejbpb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbglgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ljpideje.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olbdacbp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Inmplh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cbglgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jjgcgo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mphoob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fnjmea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fgbfbc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lbddpclj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nmenmgab.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnfiapfj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhgcdjje.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Adadbi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahfmka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mlipomli.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hphglf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdnnjane.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knfeoobh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bllble32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njploeoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ggkiha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ebcmjqej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fdccka32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idahcm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lfgnkgbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pgfljqia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jhlgpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lejgln32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efafqolp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmbbaq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efgehe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Miomnaip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mlooef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cbofdg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glpdecjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Glgjfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Odooqo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fgpilc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Emphhhoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Noaoagca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ogcfncjf.exe -
Executes dropped EXE 64 IoCs
pid Process 4004 Cbglgg32.exe 4944 Dhbqalle.exe 3300 Gjdknjep.exe 1516 Gledpe32.exe 5104 Lpbokjho.exe 4248 Nmbhgjoi.exe 3648 Pdofpb32.exe 2976 Cnboma32.exe 3988 Jjgcgo32.exe 672 Mpbaga32.exe 2912 Pkigbfja.exe 4404 Adadbi32.exe 8 Mbkmngfn.exe 1224 Poqckdap.exe 228 Pldcdhpi.exe 3084 Qfanbpjg.exe 2384 Qlnfkgho.exe 2816 Bllble32.exe 4340 Cfeplh32.exe 1928 Dqfceoje.exe 4688 Dqhpjohb.exe 4632 Efgehe32.exe 4472 Enajobbf.exe 2324 Fnjmea32.exe 1788 Fcnlng32.exe 4276 Galonj32.exe 2932 Jacnegep.exe 4896 Jalakeme.exe 848 Kknhjj32.exe 4964 Lncjgddf.exe 552 Mggolhaj.exe 1784 Nkhdgfen.exe 2600 Nicjaino.exe 4088 Opfedb32.exe 3504 Phmjdbpo.exe 3000 Ahfmka32.exe 432 Apbngn32.exe 2288 Blnhgn32.exe 3668 Cbofdg32.exe 1980 Dlegokbe.exe 4652 Eoocfegl.exe 4872 Eflhiolf.exe 3784 Eqalfgll.exe 3352 Gcbnopkj.exe 4548 Hbldkllm.exe 2368 Hfjmajbc.exe 4668 Hjjbmhfg.exe 1192 Hcbgen32.exe 3480 Ibmmbj32.exe 2292 Ifmcmg32.exe 3484 Jmgkja32.exe 2728 Jaimko32.exe 4236 Maohdj32.exe 4828 Nqioqf32.exe 5020 Pcgdcome.exe 3048 Pgjfdm32.exe 1660 Becipn32.exe 444 Cobciblp.exe 4248 Deoabj32.exe 1264 Eefhcimp.exe 2936 Eehdii32.exe 4600 Elbmebbj.exe 4080 Eoaianan.exe 4044 Eekanh32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Jflhqe32.dll Fcnlng32.exe File created C:\Windows\SysWOW64\Lfgnkgbf.exe Lpneom32.exe File opened for modification C:\Windows\SysWOW64\Mpbaga32.exe Jjgcgo32.exe File created C:\Windows\SysWOW64\Chfbhe32.dll Jacnegep.exe File created C:\Windows\SysWOW64\Bqfokblg.exe Bjlgnh32.exe File opened for modification C:\Windows\SysWOW64\Majjgmco.exe Mlmbofdh.exe File opened for modification C:\Windows\SysWOW64\Olbdacbp.exe Oampdkbj.exe File created C:\Windows\SysWOW64\Ffclml32.exe Fpjcpbdn.exe File created C:\Windows\SysWOW64\Njiccd32.dll Nmbhgjoi.exe File created C:\Windows\SysWOW64\Ofqiil32.dll Bcboan32.exe File created C:\Windows\SysWOW64\Einmaaqb.exe Edqdij32.exe File opened for modification C:\Windows\SysWOW64\Fdnipbbo.exe Fihecici.exe File created C:\Windows\SysWOW64\Hibape32.exe Hpjlgp32.exe File created C:\Windows\SysWOW64\Benjqmcm.dll Ojgjhicl.exe File created C:\Windows\SysWOW64\Gaadpqmp.exe Gkcbhgii.exe File created C:\Windows\SysWOW64\Lbhoolef.dll Ghmbhd32.exe File opened for modification C:\Windows\SysWOW64\Ikqqfm32.exe Inmplh32.exe File opened for modification C:\Windows\SysWOW64\Jbfhne32.exe Jgqdal32.exe File created C:\Windows\SysWOW64\Knpefnpd.dll Lalnfooo.exe File created C:\Windows\SysWOW64\Anaofa32.exe Adiknkco.exe File opened for modification C:\Windows\SysWOW64\Fibocnnj.exe Fagjolao.exe File created C:\Windows\SysWOW64\Bjeefpma.dll Fibocnnj.exe File created C:\Windows\SysWOW64\Aopmcegd.dll Gaqmej32.exe File created C:\Windows\SysWOW64\Oampdkbj.exe Ohdlke32.exe File opened for modification C:\Windows\SysWOW64\Iloimopp.exe Icfediio.exe File opened for modification C:\Windows\SysWOW64\Jgpmffeh.exe Jnhinq32.exe File created C:\Windows\SysWOW64\Ennofanf.dll Lncjgddf.exe File opened for modification C:\Windows\SysWOW64\Dclknkfp.exe Dmbbaq32.exe File created C:\Windows\SysWOW64\Kkaenf32.dll Aepklffh.exe File created C:\Windows\SysWOW64\Emmkci32.exe Ebggep32.exe File created C:\Windows\SysWOW64\Hhkkdenm.dll Ebggep32.exe File created C:\Windows\SysWOW64\Kllibo32.dll Jlmfomcp.exe File opened for modification C:\Windows\SysWOW64\Galonj32.exe Fcnlng32.exe File created C:\Windows\SysWOW64\Bgknlmgi.exe Bqafpc32.exe File created C:\Windows\SysWOW64\Dclknkfp.exe Dmbbaq32.exe File created C:\Windows\SysWOW64\Gpfjfg32.exe Gilajmfp.exe File opened for modification C:\Windows\SysWOW64\Nmbhgjoi.exe Lpbokjho.exe File created C:\Windows\SysWOW64\Olomcacj.dll Kknhjj32.exe File opened for modification C:\Windows\SysWOW64\Locbpi32.exe Lhijcohe.exe File created C:\Windows\SysWOW64\Pjngml32.dll Ebcmjqej.exe File created C:\Windows\SysWOW64\Ggmock32.exe Glgjfb32.exe File opened for modification C:\Windows\SysWOW64\Nabfcegi.exe Nhjbjp32.exe File created C:\Windows\SysWOW64\Bnfiapfj.exe Bekdmnio.exe File created C:\Windows\SysWOW64\Mlipomli.exe Mflgff32.exe File created C:\Windows\SysWOW64\Bjjlij32.dll Plijbblh.exe File opened for modification C:\Windows\SysWOW64\Acnefoac.exe Amcmie32.exe File created C:\Windows\SysWOW64\Bjgncihp.exe Acnefoac.exe File created C:\Windows\SysWOW64\Bcahgh32.exe Blhpjnbe.exe File created C:\Windows\SysWOW64\Lfbphcke.dll Anmfkane.exe File opened for modification C:\Windows\SysWOW64\Bekdmnio.exe Bhgcdjje.exe File created C:\Windows\SysWOW64\Qpoifplb.dll Nboggf32.exe File created C:\Windows\SysWOW64\Ehqfcf32.dll Elnoifjg.exe File opened for modification C:\Windows\SysWOW64\Hckeikcl.exe Hplimpdi.exe File created C:\Windows\SysWOW64\Klapgq32.exe Jodiaqag.exe File created C:\Windows\SysWOW64\Oagnib32.dll Blhpjnbe.exe File created C:\Windows\SysWOW64\Codhgg32.exe Cbphncfo.exe File created C:\Windows\SysWOW64\Qaoofaoi.exe Phfjmlhh.exe File created C:\Windows\SysWOW64\Bigfndlc.dll Eleikb32.exe File created C:\Windows\SysWOW64\Oeipko32.dll Mlciobhj.exe File created C:\Windows\SysWOW64\Ohnepehe.dll Hgboiq32.exe File created C:\Windows\SysWOW64\Bcfabgel.exe Bcddlhgo.exe File created C:\Windows\SysWOW64\Pdhbgn32.exe Plmmbkdf.exe File opened for modification C:\Windows\SysWOW64\Lpbokjho.exe Gledpe32.exe File created C:\Windows\SysWOW64\Mlciobhj.exe Meiabh32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anekdd32.dll" Pkigbfja.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lcjchd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcogphcn.dll" Llmpco32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jdnnjane.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kqnbea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Odhipp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gpnmka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nojagf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqclfeon.dll" Jhlgpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Knabne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mhmmchpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lbddpclj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lcjchd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gledpe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgopje32.dll" Jjgcgo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Negfik32.dll" Ohebek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkkohp32.dll" Gmqgjl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jnelha32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Neglceej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oipnkcnm.dll" Pddhlnfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oobknhji.dll" Plagmh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dmbbaq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkieampj.dll" Kiggln32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nhpbpepo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gaadpqmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Miomnaip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cbphncfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dpknhfoq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpglno32.dll" Ppjghgdg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpdiag32.dll" Fabqdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Blhpjnbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgofoamj.dll" Oaliidon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kabmhiem.dll" Higjkehf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Memhpe32.dll" Eoaianan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Malgmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ebcmjqej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Efepln32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nboggf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Niklip32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnfhlh32.dll" Lkjlciem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gfhehlhe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ohebek32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bcddlhgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcflpb32.dll" Emmkci32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fdccka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mcmall32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Edqdij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kndodehf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Glgjfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kkaimj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jgpmffeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akemlo32.dll" Bklfqd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ckaolcol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpkgmegi.dll" Fbomfokl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jaimko32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lbghpinc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mimphakb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ddngdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dqfceoje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Efgehe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eefhcimp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpqmcoei.dll" Knabne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oblmnmjl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 83ccf0608059602b88e3268e43db30a1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3780 wrote to memory of 4004 3780 83ccf0608059602b88e3268e43db30a1.exe 94 PID 3780 wrote to memory of 4004 3780 83ccf0608059602b88e3268e43db30a1.exe 94 PID 3780 wrote to memory of 4004 3780 83ccf0608059602b88e3268e43db30a1.exe 94 PID 4004 wrote to memory of 4944 4004 Cbglgg32.exe 96 PID 4004 wrote to memory of 4944 4004 Cbglgg32.exe 96 PID 4004 wrote to memory of 4944 4004 Cbglgg32.exe 96 PID 4944 wrote to memory of 3300 4944 Dhbqalle.exe 97 PID 4944 wrote to memory of 3300 4944 Dhbqalle.exe 97 PID 4944 wrote to memory of 3300 4944 Dhbqalle.exe 97 PID 3300 wrote to memory of 1516 3300 Gjdknjep.exe 98 PID 3300 wrote to memory of 1516 3300 Gjdknjep.exe 98 PID 3300 wrote to memory of 1516 3300 Gjdknjep.exe 98 PID 1516 wrote to memory of 5104 1516 Gledpe32.exe 100 PID 1516 wrote to memory of 5104 1516 Gledpe32.exe 100 PID 1516 wrote to memory of 5104 1516 Gledpe32.exe 100 PID 5104 wrote to memory of 4248 5104 Lpbokjho.exe 101 PID 5104 wrote to memory of 4248 5104 Lpbokjho.exe 101 PID 5104 wrote to memory of 4248 5104 Lpbokjho.exe 101 PID 4248 wrote to memory of 3648 4248 Nmbhgjoi.exe 102 PID 4248 wrote to memory of 3648 4248 Nmbhgjoi.exe 102 PID 4248 wrote to memory of 3648 4248 Nmbhgjoi.exe 102 PID 3648 wrote to memory of 2976 3648 Pdofpb32.exe 103 PID 3648 wrote to memory of 2976 3648 Pdofpb32.exe 103 PID 3648 wrote to memory of 2976 3648 Pdofpb32.exe 103 PID 2976 wrote to memory of 3988 2976 Cnboma32.exe 104 PID 2976 wrote to memory of 3988 2976 Cnboma32.exe 104 PID 2976 wrote to memory of 3988 2976 Cnboma32.exe 104 PID 3988 wrote to memory of 672 3988 Jjgcgo32.exe 105 PID 3988 wrote to memory of 672 3988 Jjgcgo32.exe 105 PID 3988 wrote to memory of 672 3988 Jjgcgo32.exe 105 PID 672 wrote to memory of 2912 672 Mpbaga32.exe 106 PID 672 wrote to memory of 2912 672 Mpbaga32.exe 106 PID 672 wrote to memory of 2912 672 Mpbaga32.exe 106 PID 2912 wrote to memory of 4404 2912 Pkigbfja.exe 107 PID 2912 wrote to memory of 4404 2912 Pkigbfja.exe 107 PID 2912 wrote to memory of 4404 2912 Pkigbfja.exe 107 PID 4348 wrote to memory of 8 4348 Eabjkdcc.exe 109 PID 4348 wrote to memory of 8 4348 Eabjkdcc.exe 109 PID 4348 wrote to memory of 8 4348 Eabjkdcc.exe 109 PID 8 wrote to memory of 1224 8 Mbkmngfn.exe 110 PID 8 wrote to memory of 1224 8 Mbkmngfn.exe 110 PID 8 wrote to memory of 1224 8 Mbkmngfn.exe 110 PID 1224 wrote to memory of 228 1224 Poqckdap.exe 111 PID 1224 wrote to memory of 228 1224 Poqckdap.exe 111 PID 1224 wrote to memory of 228 1224 Poqckdap.exe 111 PID 228 wrote to memory of 3084 228 Pldcdhpi.exe 112 PID 228 wrote to memory of 3084 228 Pldcdhpi.exe 112 PID 228 wrote to memory of 3084 228 Pldcdhpi.exe 112 PID 3084 wrote to memory of 2384 3084 Qfanbpjg.exe 113 PID 3084 wrote to memory of 2384 3084 Qfanbpjg.exe 113 PID 3084 wrote to memory of 2384 3084 Qfanbpjg.exe 113 PID 2384 wrote to memory of 2816 2384 Qlnfkgho.exe 114 PID 2384 wrote to memory of 2816 2384 Qlnfkgho.exe 114 PID 2384 wrote to memory of 2816 2384 Qlnfkgho.exe 114 PID 2816 wrote to memory of 4340 2816 Bllble32.exe 115 PID 2816 wrote to memory of 4340 2816 Bllble32.exe 115 PID 2816 wrote to memory of 4340 2816 Bllble32.exe 115 PID 4340 wrote to memory of 1928 4340 Cfeplh32.exe 116 PID 4340 wrote to memory of 1928 4340 Cfeplh32.exe 116 PID 4340 wrote to memory of 1928 4340 Cfeplh32.exe 116 PID 1928 wrote to memory of 4688 1928 Dqfceoje.exe 117 PID 1928 wrote to memory of 4688 1928 Dqfceoje.exe 117 PID 1928 wrote to memory of 4688 1928 Dqfceoje.exe 117 PID 4688 wrote to memory of 4632 4688 Dqhpjohb.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\83ccf0608059602b88e3268e43db30a1.exe"C:\Users\Admin\AppData\Local\Temp\83ccf0608059602b88e3268e43db30a1.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\Cbglgg32.exeC:\Windows\system32\Cbglgg32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\Dhbqalle.exeC:\Windows\system32\Dhbqalle.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\Gjdknjep.exeC:\Windows\system32\Gjdknjep.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\Gledpe32.exeC:\Windows\system32\Gledpe32.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\Lpbokjho.exeC:\Windows\system32\Lpbokjho.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\Nmbhgjoi.exeC:\Windows\system32\Nmbhgjoi.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\Pdofpb32.exeC:\Windows\system32\Pdofpb32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\Cnboma32.exeC:\Windows\system32\Cnboma32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\Jjgcgo32.exeC:\Windows\system32\Jjgcgo32.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\Mpbaga32.exeC:\Windows\system32\Mpbaga32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\SysWOW64\Pkigbfja.exeC:\Windows\system32\Pkigbfja.exe12⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\Adadbi32.exeC:\Windows\system32\Adadbi32.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4404 -
C:\Windows\SysWOW64\Eabjkdcc.exeC:\Windows\system32\Eabjkdcc.exe14⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\Mbkmngfn.exeC:\Windows\system32\Mbkmngfn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\Poqckdap.exeC:\Windows\system32\Poqckdap.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\Pldcdhpi.exeC:\Windows\system32\Pldcdhpi.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\Qfanbpjg.exeC:\Windows\system32\Qfanbpjg.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\Qlnfkgho.exeC:\Windows\system32\Qlnfkgho.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\Bllble32.exeC:\Windows\system32\Bllble32.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\Cfeplh32.exeC:\Windows\system32\Cfeplh32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\Dqfceoje.exeC:\Windows\system32\Dqfceoje.exe22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\Dqhpjohb.exeC:\Windows\system32\Dqhpjohb.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\Efgehe32.exeC:\Windows\system32\Efgehe32.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:4632 -
C:\Windows\SysWOW64\Enajobbf.exeC:\Windows\system32\Enajobbf.exe25⤵
- Executes dropped EXE
PID:4472 -
C:\Windows\SysWOW64\Fnjmea32.exeC:\Windows\system32\Fnjmea32.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2324 -
C:\Windows\SysWOW64\Fcnlng32.exeC:\Windows\system32\Fcnlng32.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1788 -
C:\Windows\SysWOW64\Galonj32.exeC:\Windows\system32\Galonj32.exe28⤵
- Executes dropped EXE
PID:4276 -
C:\Windows\SysWOW64\Jacnegep.exeC:\Windows\system32\Jacnegep.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2932 -
C:\Windows\SysWOW64\Jalakeme.exeC:\Windows\system32\Jalakeme.exe30⤵
- Executes dropped EXE
PID:4896 -
C:\Windows\SysWOW64\Kknhjj32.exeC:\Windows\system32\Kknhjj32.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:848 -
C:\Windows\SysWOW64\Lncjgddf.exeC:\Windows\system32\Lncjgddf.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4964 -
C:\Windows\SysWOW64\Mggolhaj.exeC:\Windows\system32\Mggolhaj.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:552 -
C:\Windows\SysWOW64\Nkhdgfen.exeC:\Windows\system32\Nkhdgfen.exe34⤵
- Executes dropped EXE
PID:1784 -
C:\Windows\SysWOW64\Nicjaino.exeC:\Windows\system32\Nicjaino.exe35⤵
- Executes dropped EXE
PID:2600 -
C:\Windows\SysWOW64\Opfedb32.exeC:\Windows\system32\Opfedb32.exe36⤵
- Executes dropped EXE
PID:4088 -
C:\Windows\SysWOW64\Phmjdbpo.exeC:\Windows\system32\Phmjdbpo.exe37⤵
- Executes dropped EXE
PID:3504 -
C:\Windows\SysWOW64\Ahfmka32.exeC:\Windows\system32\Ahfmka32.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3000 -
C:\Windows\SysWOW64\Apbngn32.exeC:\Windows\system32\Apbngn32.exe39⤵
- Executes dropped EXE
PID:432 -
C:\Windows\SysWOW64\Blnhgn32.exeC:\Windows\system32\Blnhgn32.exe40⤵
- Executes dropped EXE
PID:2288 -
C:\Windows\SysWOW64\Cbofdg32.exeC:\Windows\system32\Cbofdg32.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3668 -
C:\Windows\SysWOW64\Dlegokbe.exeC:\Windows\system32\Dlegokbe.exe42⤵
- Executes dropped EXE
PID:1980 -
C:\Windows\SysWOW64\Eoocfegl.exeC:\Windows\system32\Eoocfegl.exe43⤵
- Executes dropped EXE
PID:4652 -
C:\Windows\SysWOW64\Eflhiolf.exeC:\Windows\system32\Eflhiolf.exe44⤵
- Executes dropped EXE
PID:4872 -
C:\Windows\SysWOW64\Eqalfgll.exeC:\Windows\system32\Eqalfgll.exe45⤵
- Executes dropped EXE
PID:3784 -
C:\Windows\SysWOW64\Gcbnopkj.exeC:\Windows\system32\Gcbnopkj.exe46⤵
- Executes dropped EXE
PID:3352 -
C:\Windows\SysWOW64\Hbldkllm.exeC:\Windows\system32\Hbldkllm.exe47⤵
- Executes dropped EXE
PID:4548 -
C:\Windows\SysWOW64\Hfjmajbc.exeC:\Windows\system32\Hfjmajbc.exe48⤵
- Executes dropped EXE
PID:2368 -
C:\Windows\SysWOW64\Hjjbmhfg.exeC:\Windows\system32\Hjjbmhfg.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4668 -
C:\Windows\SysWOW64\Hcbgen32.exeC:\Windows\system32\Hcbgen32.exe50⤵
- Executes dropped EXE
PID:1192 -
C:\Windows\SysWOW64\Ibmmbj32.exeC:\Windows\system32\Ibmmbj32.exe51⤵
- Executes dropped EXE
PID:3480 -
C:\Windows\SysWOW64\Ifmcmg32.exeC:\Windows\system32\Ifmcmg32.exe52⤵
- Executes dropped EXE
PID:2292 -
C:\Windows\SysWOW64\Jmgkja32.exeC:\Windows\system32\Jmgkja32.exe53⤵
- Executes dropped EXE
PID:3484 -
C:\Windows\SysWOW64\Jaimko32.exeC:\Windows\system32\Jaimko32.exe54⤵
- Executes dropped EXE
- Modifies registry class
PID:2728 -
C:\Windows\SysWOW64\Maohdj32.exeC:\Windows\system32\Maohdj32.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4236 -
C:\Windows\SysWOW64\Nqioqf32.exeC:\Windows\system32\Nqioqf32.exe56⤵
- Executes dropped EXE
PID:4828 -
C:\Windows\SysWOW64\Pcgdcome.exeC:\Windows\system32\Pcgdcome.exe57⤵
- Executes dropped EXE
PID:5020 -
C:\Windows\SysWOW64\Pgjfdm32.exeC:\Windows\system32\Pgjfdm32.exe58⤵
- Executes dropped EXE
PID:3048 -
C:\Windows\SysWOW64\Becipn32.exeC:\Windows\system32\Becipn32.exe59⤵
- Executes dropped EXE
PID:1660 -
C:\Windows\SysWOW64\Cobciblp.exeC:\Windows\system32\Cobciblp.exe60⤵
- Executes dropped EXE
PID:444 -
C:\Windows\SysWOW64\Deoabj32.exeC:\Windows\system32\Deoabj32.exe61⤵
- Executes dropped EXE
PID:4248 -
C:\Windows\SysWOW64\Eefhcimp.exeC:\Windows\system32\Eefhcimp.exe62⤵
- Executes dropped EXE
- Modifies registry class
PID:1264 -
C:\Windows\SysWOW64\Eehdii32.exeC:\Windows\system32\Eehdii32.exe63⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\SysWOW64\Elbmebbj.exeC:\Windows\system32\Elbmebbj.exe64⤵
- Executes dropped EXE
PID:4600 -
C:\Windows\SysWOW64\Eoaianan.exeC:\Windows\system32\Eoaianan.exe65⤵
- Executes dropped EXE
- Modifies registry class
PID:4080 -
C:\Windows\SysWOW64\Eekanh32.exeC:\Windows\system32\Eekanh32.exe66⤵
- Executes dropped EXE
PID:4044 -
C:\Windows\SysWOW64\Eleikb32.exeC:\Windows\system32\Eleikb32.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:4012 -
C:\Windows\SysWOW64\Femndhgh.exeC:\Windows\system32\Femndhgh.exe68⤵PID:3176
-
C:\Windows\SysWOW64\Fomhnmgp.exeC:\Windows\system32\Fomhnmgp.exe69⤵PID:4220
-
C:\Windows\SysWOW64\Hfgjad32.exeC:\Windows\system32\Hfgjad32.exe70⤵PID:2976
-
C:\Windows\SysWOW64\Hmabnnhg.exeC:\Windows\system32\Hmabnnhg.exe71⤵PID:1480
-
C:\Windows\SysWOW64\Hckjjh32.exeC:\Windows\system32\Hckjjh32.exe72⤵PID:4320
-
C:\Windows\SysWOW64\Iehfno32.exeC:\Windows\system32\Iehfno32.exe73⤵PID:5104
-
C:\Windows\SysWOW64\Ipmjkh32.exeC:\Windows\system32\Ipmjkh32.exe74⤵PID:4656
-
C:\Windows\SysWOW64\Ippgqg32.exeC:\Windows\system32\Ippgqg32.exe75⤵PID:2140
-
C:\Windows\SysWOW64\Jmknkk32.exeC:\Windows\system32\Jmknkk32.exe76⤵PID:1856
-
C:\Windows\SysWOW64\Kmfmfigl.exeC:\Windows\system32\Kmfmfigl.exe77⤵PID:3780
-
C:\Windows\SysWOW64\Lpjcnd32.exeC:\Windows\system32\Lpjcnd32.exe78⤵PID:2572
-
C:\Windows\SysWOW64\Libggiik.exeC:\Windows\system32\Libggiik.exe79⤵PID:4412
-
C:\Windows\SysWOW64\Ldjhib32.exeC:\Windows\system32\Ldjhib32.exe80⤵PID:4468
-
C:\Windows\SysWOW64\Lekeajmm.exeC:\Windows\system32\Lekeajmm.exe81⤵PID:808
-
C:\Windows\SysWOW64\Lpqioclc.exeC:\Windows\system32\Lpqioclc.exe82⤵PID:2748
-
C:\Windows\SysWOW64\Lemagjjj.exeC:\Windows\system32\Lemagjjj.exe83⤵PID:3876
-
C:\Windows\SysWOW64\Mphoob32.exeC:\Windows\system32\Mphoob32.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3884 -
C:\Windows\SysWOW64\Mipchg32.exeC:\Windows\system32\Mipchg32.exe85⤵PID:3556
-
C:\Windows\SysWOW64\Mpjleadh.exeC:\Windows\system32\Mpjleadh.exe86⤵PID:2608
-
C:\Windows\SysWOW64\Meiabh32.exeC:\Windows\system32\Meiabh32.exe87⤵
- Drops file in System32 directory
PID:1244 -
C:\Windows\SysWOW64\Mlciobhj.exeC:\Windows\system32\Mlciobhj.exe88⤵
- Drops file in System32 directory
PID:3056 -
C:\Windows\SysWOW64\Mcmall32.exeC:\Windows\system32\Mcmall32.exe89⤵
- Modifies registry class
PID:3288 -
C:\Windows\SysWOW64\Npabeq32.exeC:\Windows\system32\Npabeq32.exe90⤵PID:4148
-
C:\Windows\SysWOW64\Ncfdbk32.exeC:\Windows\system32\Ncfdbk32.exe91⤵PID:2312
-
C:\Windows\SysWOW64\Njploeoi.exeC:\Windows\system32\Njploeoi.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:216 -
C:\Windows\SysWOW64\Npjelo32.exeC:\Windows\system32\Npjelo32.exe93⤵PID:4704
-
C:\Windows\SysWOW64\Ngdmhimb.exeC:\Windows\system32\Ngdmhimb.exe94⤵PID:1364
-
C:\Windows\SysWOW64\Chmnnamb.exeC:\Windows\system32\Chmnnamb.exe95⤵PID:4900
-
C:\Windows\SysWOW64\Ehocjo32.exeC:\Windows\system32\Ehocjo32.exe96⤵PID:4284
-
C:\Windows\SysWOW64\Fgeibicb.exeC:\Windows\system32\Fgeibicb.exe97⤵PID:2352
-
C:\Windows\SysWOW64\Gkcbhgii.exeC:\Windows\system32\Gkcbhgii.exe98⤵
- Drops file in System32 directory
PID:4348 -
C:\Windows\SysWOW64\Gaadpqmp.exeC:\Windows\system32\Gaadpqmp.exe99⤵
- Modifies registry class
PID:1556 -
C:\Windows\SysWOW64\Hbmclobc.exeC:\Windows\system32\Hbmclobc.exe100⤵PID:4240
-
C:\Windows\SysWOW64\Hhglhi32.exeC:\Windows\system32\Hhglhi32.exe101⤵PID:1240
-
C:\Windows\SysWOW64\Inpclnnj.exeC:\Windows\system32\Inpclnnj.exe102⤵PID:3544
-
C:\Windows\SysWOW64\Jodiaqag.exeC:\Windows\system32\Jodiaqag.exe103⤵
- Drops file in System32 directory
PID:3500 -
C:\Windows\SysWOW64\Klapgq32.exeC:\Windows\system32\Klapgq32.exe104⤵PID:4472
-
C:\Windows\SysWOW64\Lbekjipe.exeC:\Windows\system32\Lbekjipe.exe105⤵PID:3220
-
C:\Windows\SysWOW64\Llmpco32.exeC:\Windows\system32\Llmpco32.exe106⤵
- Modifies registry class
PID:1472 -
C:\Windows\SysWOW64\Lbghpinc.exeC:\Windows\system32\Lbghpinc.exe107⤵
- Modifies registry class
PID:1928 -
C:\Windows\SysWOW64\Liaqlcep.exeC:\Windows\system32\Liaqlcep.exe108⤵PID:4572
-
C:\Windows\SysWOW64\Lpneom32.exeC:\Windows\system32\Lpneom32.exe109⤵
- Drops file in System32 directory
PID:220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Jdkkjl32.exeC:\Windows\system32\Jdkkjl32.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7256 -
C:\Windows\SysWOW64\Jjgcbb32.exeC:\Windows\system32\Jjgcbb32.exe69⤵PID:7368
-
C:\Windows\SysWOW64\Jpalomaq.exeC:\Windows\system32\Jpalomaq.exe70⤵PID:7512
-
C:\Windows\SysWOW64\Jgkdkg32.exeC:\Windows\system32\Jgkdkg32.exe71⤵PID:3888
-
C:\Windows\SysWOW64\Jnelha32.exeC:\Windows\system32\Jnelha32.exe72⤵
- Modifies registry class
PID:4600 -
C:\Windows\SysWOW64\Jcbdph32.exeC:\Windows\system32\Jcbdph32.exe73⤵PID:7904
-
C:\Windows\SysWOW64\Jnhinq32.exeC:\Windows\system32\Jnhinq32.exe74⤵
- Drops file in System32 directory
PID:4956 -
C:\Windows\SysWOW64\Jgpmffeh.exeC:\Windows\system32\Jgpmffeh.exe75⤵
- Modifies registry class
PID:7228 -
C:\Windows\SysWOW64\Jlmfomcp.exeC:\Windows\system32\Jlmfomcp.exe76⤵
- Drops file in System32 directory
PID:7324 -
C:\Windows\SysWOW64\Kgbjlf32.exeC:\Windows\system32\Kgbjlf32.exe77⤵PID:7488
-
C:\Windows\SysWOW64\Kmobdm32.exeC:\Windows\system32\Kmobdm32.exe78⤵PID:7644
-
C:\Windows\SysWOW64\Kcikagij.exeC:\Windows\system32\Kcikagij.exe79⤵PID:7828
-
C:\Windows\SysWOW64\Kglmbd32.exeC:\Windows\system32\Kglmbd32.exe80⤵PID:3176
-
C:\Windows\SysWOW64\Knfeoobh.exeC:\Windows\system32\Knfeoobh.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7460 -
C:\Windows\SysWOW64\Lgnihd32.exeC:\Windows\system32\Lgnihd32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:544 -
C:\Windows\SysWOW64\Lmkbpk32.exeC:\Windows\system32\Lmkbpk32.exe83⤵PID:7804
-
C:\Windows\SysWOW64\Lgqfmcge.exeC:\Windows\system32\Lgqfmcge.exe84⤵PID:2268
-
C:\Windows\SysWOW64\Lqikfi32.exeC:\Windows\system32\Lqikfi32.exe85⤵PID:4336
-
C:\Windows\SysWOW64\Ljaooodf.exeC:\Windows\system32\Ljaooodf.exe86⤵PID:3952
-
C:\Windows\SysWOW64\Lcjchd32.exeC:\Windows\system32\Lcjchd32.exe87⤵
- Modifies registry class
PID:4404 -
C:\Windows\SysWOW64\Lnohemjm.exeC:\Windows\system32\Lnohemjm.exe88⤵PID:7856
-
C:\Windows\SysWOW64\Lclpmdhd.exeC:\Windows\system32\Lclpmdhd.exe89⤵PID:4424
-
C:\Windows\SysWOW64\Mmdefi32.exeC:\Windows\system32\Mmdefi32.exe90⤵PID:8216
-
C:\Windows\SysWOW64\Mkeeda32.exeC:\Windows\system32\Mkeeda32.exe91⤵PID:8260
-
C:\Windows\SysWOW64\Menimfnd.exeC:\Windows\system32\Menimfnd.exe92⤵PID:8300
-
C:\Windows\SysWOW64\Mjkbemll.exeC:\Windows\system32\Mjkbemll.exe93⤵PID:8360
-
C:\Windows\SysWOW64\Neglceej.exeC:\Windows\system32\Neglceej.exe94⤵
- Modifies registry class
PID:8396 -
C:\Windows\SysWOW64\Nmbaggce.exeC:\Windows\system32\Nmbaggce.exe95⤵PID:8448
-
C:\Windows\SysWOW64\Nhheepbk.exeC:\Windows\system32\Nhheepbk.exe96⤵PID:8488
-
C:\Windows\SysWOW64\Nmenmgab.exeC:\Windows\system32\Nmenmgab.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8536 -
C:\Windows\SysWOW64\Nhjbjp32.exeC:\Windows\system32\Nhjbjp32.exe98⤵
- Drops file in System32 directory
PID:8572 -
C:\Windows\SysWOW64\Nabfcegi.exeC:\Windows\system32\Nabfcegi.exe99⤵PID:8608
-
C:\Windows\SysWOW64\Njkklk32.exeC:\Windows\system32\Njkklk32.exe100⤵PID:8656
-
C:\Windows\SysWOW64\Naecieef.exeC:\Windows\system32\Naecieef.exe101⤵PID:8692
-
C:\Windows\SysWOW64\Nhokeolc.exeC:\Windows\system32\Nhokeolc.exe102⤵PID:8736
-
C:\Windows\SysWOW64\Oeclockl.exeC:\Windows\system32\Oeclockl.exe103⤵PID:8784
-
C:\Windows\SysWOW64\Odhipp32.exeC:\Windows\system32\Odhipp32.exe104⤵
- Modifies registry class
PID:8828 -
C:\Windows\SysWOW64\Oaliidon.exeC:\Windows\system32\Oaliidon.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:8868 -
C:\Windows\SysWOW64\Ojdnbj32.exeC:\Windows\system32\Ojdnbj32.exe106⤵PID:8908
-
C:\Windows\SysWOW64\Oejbpb32.exeC:\Windows\system32\Oejbpb32.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8956 -
C:\Windows\SysWOW64\Ojgjhicl.exeC:\Windows\system32\Ojgjhicl.exe108⤵
- Drops file in System32 directory
PID:9004 -
C:\Windows\SysWOW64\Odooqo32.exeC:\Windows\system32\Odooqo32.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:9048 -
C:\Windows\SysWOW64\Podcnh32.exeC:\Windows\system32\Podcnh32.exe110⤵PID:9084
-
C:\Windows\SysWOW64\Pdalfo32.exeC:\Windows\system32\Pdalfo32.exe111⤵PID:9128
-
C:\Windows\SysWOW64\Pmjpod32.exeC:\Windows\system32\Pmjpod32.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:9176 -
C:\Windows\SysWOW64\Pddhlnfg.exeC:\Windows\system32\Pddhlnfg.exe113⤵
- Modifies registry class
PID:4460 -
C:\Windows\SysWOW64\Pmlmdd32.exeC:\Windows\system32\Pmlmdd32.exe114⤵PID:7392
-
C:\Windows\SysWOW64\Plmmbkdf.exeC:\Windows\system32\Plmmbkdf.exe115⤵
- Drops file in System32 directory
PID:8256 -
C:\Windows\SysWOW64\Pdhbgn32.exeC:\Windows\system32\Pdhbgn32.exe116⤵PID:8308
-
C:\Windows\SysWOW64\Phfjmlhh.exeC:\Windows\system32\Phfjmlhh.exe117⤵
- Drops file in System32 directory
PID:3688 -
C:\Windows\SysWOW64\Qaoofaoi.exeC:\Windows\system32\Qaoofaoi.exe118⤵PID:1996
-
C:\Windows\SysWOW64\Qoboofnb.exeC:\Windows\system32\Qoboofnb.exe119⤵PID:3608
-
C:\Windows\SysWOW64\Alfpijll.exeC:\Windows\system32\Alfpijll.exe120⤵PID:8424
-
C:\Windows\SysWOW64\Aklmjfad.exeC:\Windows\system32\Aklmjfad.exe121⤵PID:8496
-
C:\Windows\SysWOW64\Anmfkane.exeC:\Windows\system32\Anmfkane.exe122⤵
- Drops file in System32 directory
PID:8532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-