Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2024, 01:08
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
af843099eb67363f9727b6a2a028e3145b536b3bf34b676abdf8d2a63c8e7de2.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
af843099eb67363f9727b6a2a028e3145b536b3bf34b676abdf8d2a63c8e7de2.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
af843099eb67363f9727b6a2a028e3145b536b3bf34b676abdf8d2a63c8e7de2.exe
-
Size
207KB
-
MD5
44d05efdad6fae86e907c7662427f70e
-
SHA1
4b1259dd6a883641ad39d202cd92a5e28108a6e2
-
SHA256
af843099eb67363f9727b6a2a028e3145b536b3bf34b676abdf8d2a63c8e7de2
-
SHA512
5e40d9ce0257a2c9eee8b8245acb6ba0257c53b6dd6a4d6ffe409ebe4007722f7cbd81771719157effe1c5865deecde99be3b7ee9bdbe52b150203309ee723cc
-
SSDEEP
3072:wGuvHmSWf6TGAq+BOezpHw0MX2++9SEVjoSdoxx4KcWmjRrzyAyAtWgoJSWYVo23:xuOyTGAv92EVjj+VPj92d62ASOwj
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifleji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hdffah32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldfhgn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhmcck32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pkjegb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cblebgfh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gpodkdll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hqjcgbbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kpnepk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lcqgahoe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ladhkmno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ofgmib32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Didjqoae.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hljnkdnk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmiealgc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mmiealgc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Keekjc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lajhpbme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dpihbjmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Epaemojk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hcgjhega.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iqpclh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hjlaoioh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Niglfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ijfkpnji.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gegchl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Akogio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dpnbmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fplnogmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gegchl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdphnmjk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdmngm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljhchc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jejbhk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ocdgahag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bfhofnpp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Niihlkdm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pjlnhi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oiccje32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfncia32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gddqejni.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Khakqo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmghklif.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mfomda32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pgnblm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abcgjg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Imknli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Blkgen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fempbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mdodbf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdlfjh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpedeiff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jnnnfalp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifcben32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ioffhn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fplnogmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gckcap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iqfcbahb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhaope32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgbhdkml.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Capkim32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lapopm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Khabke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Knpmhh32.exe -
UPX dump on OEP (original entry point) 52 IoCs
resource yara_rule behavioral2/files/0x0007000000023263-6.dat UPX behavioral2/memory/2404-7-0x0000000000400000-0x000000000045B000-memory.dmp UPX behavioral2/files/0x0007000000023263-8.dat UPX behavioral2/files/0x000900000002325c-14.dat UPX behavioral2/memory/4924-17-0x0000000000400000-0x000000000045B000-memory.dmp UPX behavioral2/files/0x000900000002325e-23.dat UPX behavioral2/files/0x0008000000023258-31.dat UPX behavioral2/files/0x000a000000023264-39.dat UPX behavioral2/files/0x0007000000023266-46.dat UPX behavioral2/memory/220-49-0x0000000000400000-0x000000000045B000-memory.dmp UPX behavioral2/files/0x0007000000023269-55.dat UPX behavioral2/memory/3984-56-0x0000000000400000-0x000000000045B000-memory.dmp UPX behavioral2/files/0x000700000002326b-63.dat UPX behavioral2/memory/4800-64-0x0000000000400000-0x000000000045B000-memory.dmp UPX behavioral2/files/0x000700000002326d-71.dat UPX behavioral2/files/0x000700000002326d-73.dat UPX behavioral2/files/0x000700000002326f-79.dat UPX behavioral2/files/0x000a000000023259-87.dat UPX behavioral2/memory/2304-89-0x0000000000400000-0x000000000045B000-memory.dmp UPX behavioral2/files/0x0007000000023272-94.dat UPX behavioral2/memory/548-97-0x0000000000400000-0x000000000045B000-memory.dmp UPX behavioral2/files/0x0007000000023274-103.dat UPX behavioral2/files/0x0007000000023274-105.dat UPX behavioral2/files/0x0007000000023276-111.dat UPX behavioral2/files/0x0007000000023278-119.dat UPX behavioral2/files/0x000800000002327a-127.dat UPX behavioral2/files/0x0006000000022e9f-135.dat UPX behavioral2/files/0x000700000002327d-143.dat UPX behavioral2/files/0x000700000002327f-151.dat UPX behavioral2/files/0x0007000000023281-159.dat UPX behavioral2/files/0x0007000000023283-167.dat UPX behavioral2/files/0x0007000000023285-175.dat UPX behavioral2/files/0x0007000000023287-183.dat UPX behavioral2/files/0x0008000000023254-191.dat UPX behavioral2/memory/3616-192-0x0000000000400000-0x000000000045B000-memory.dmp UPX behavioral2/files/0x000700000002328a-199.dat UPX behavioral2/memory/4124-201-0x0000000000400000-0x000000000045B000-memory.dmp UPX behavioral2/files/0x000700000002328c-207.dat UPX behavioral2/files/0x000700000002328e-215.dat UPX behavioral2/files/0x0007000000023290-224.dat UPX behavioral2/files/0x0007000000023292-233.dat UPX behavioral2/files/0x0007000000023295-246.dat UPX behavioral2/files/0x0007000000023298-254.dat UPX behavioral2/files/0x000700000002329a-262.dat UPX behavioral2/files/0x00070000000232bd-362.dat UPX behavioral2/memory/6084-452-0x0000000000400000-0x000000000045B000-memory.dmp UPX behavioral2/memory/6124-453-0x0000000000400000-0x000000000045B000-memory.dmp UPX behavioral2/files/0x00080000000232dc-479.dat UPX behavioral2/files/0x00070000000232ee-504.dat UPX behavioral2/files/0x0007000000023322-682.dat UPX behavioral2/files/0x0007000000023384-1001.dat UPX behavioral2/files/0x00070000000233af-1142.dat UPX -
Executes dropped EXE 64 IoCs
pid Process 2404 Oiccje32.exe 4924 Ppikbm32.exe 1788 Ppnenlka.exe 4444 Qamago32.exe 4576 Qiiflaoo.exe 220 Abcgjg32.exe 3984 Bdlfjh32.exe 4800 Bpedeiff.exe 2040 Ckpamabg.exe 4940 Calfpk32.exe 2304 Cgklmacf.exe 548 Dalofi32.exe 4128 Eahobg32.exe 2276 Fnffhgon.exe 1008 Gkefmjcj.exe 1156 Icogcjde.exe 3320 Infhebbh.exe 2520 Jnnnfalp.exe 4532 Jejbhk32.exe 3492 Jaqcnl32.exe 2816 Jlkafdco.exe 2456 Khabke32.exe 3208 Kalcik32.exe 3616 Lklnconj.exe 4124 Lbhool32.exe 4560 Maoifh32.exe 4900 Ocdgahag.exe 1420 Ofgmib32.exe 4392 Pfncia32.exe 4996 Akihcfid.exe 5024 Acbmjcgd.exe 5048 Almanf32.exe 1784 Bfhofnpp.exe 3292 Bpemkcck.exe 708 Bcbeqaia.exe 3560 Cbmlmmjd.exe 3932 Dpefaq32.exe 5144 Epaemojk.exe 5192 Eiijfd32.exe 5236 Ecdkdj32.exe 5280 Feimadoe.exe 5324 Gddqejni.exe 5364 Gjqinamq.exe 5404 Gcimfg32.exe 5444 Gjcfcakn.exe 5488 Gckjlf32.exe 5528 Gqagkjne.exe 5568 Hcbpme32.exe 5604 Hcembe32.exe 5648 Hcgjhega.exe 5692 Hdffah32.exe 5732 Ijfkpnji.exe 5772 Iqpclh32.exe 5824 Imfdaigj.exe 5868 Ijjekn32.exe 5908 Imknli32.exe 5948 Ifcben32.exe 5992 Jjakkmpk.exe 6044 Jcaeea32.exe 6084 Khakqo32.exe 6124 Keekjc32.exe 5184 Knpmhh32.exe 5244 Lmjcdd32.exe 5304 Ldfhgn32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Mhoimi32.dll Becknc32.exe File opened for modification C:\Windows\SysWOW64\Igpkok32.exe Iqfcbahb.exe File opened for modification C:\Windows\SysWOW64\Lmneemaq.exe Ladhkmno.exe File created C:\Windows\SysWOW64\Bgjjoi32.exe Pdbbfadn.exe File created C:\Windows\SysWOW64\Jijomapp.dll Loniiflo.exe File created C:\Windows\SysWOW64\Jmmcgbnf.exe Igpkok32.exe File created C:\Windows\SysWOW64\Emdplb32.dll Lapopm32.exe File created C:\Windows\SysWOW64\Jpgcpo32.dll Ifcben32.exe File opened for modification C:\Windows\SysWOW64\Meadlo32.exe Mhmcck32.exe File created C:\Windows\SysWOW64\Gjdknjep.exe Gckcap32.exe File created C:\Windows\SysWOW64\Jodamh32.dll Dalofi32.exe File opened for modification C:\Windows\SysWOW64\Lbhool32.exe Lklnconj.exe File created C:\Windows\SysWOW64\Mobbdf32.exe Mdmngm32.exe File created C:\Windows\SysWOW64\Mhmcck32.exe Mobbdf32.exe File opened for modification C:\Windows\SysWOW64\Gegchl32.exe Fpcdof32.exe File created C:\Windows\SysWOW64\Fefmmcgh.dll af843099eb67363f9727b6a2a028e3145b536b3bf34b676abdf8d2a63c8e7de2.exe File created C:\Windows\SysWOW64\Jlkafdco.exe Jaqcnl32.exe File created C:\Windows\SysWOW64\Epaemojk.exe Dpefaq32.exe File created C:\Windows\SysWOW64\Jncemmid.dll Feifgnki.exe File created C:\Windows\SysWOW64\Bcnehb32.dll Okbhlm32.exe File created C:\Windows\SysWOW64\Hnkhdmeh.dll Pgnblm32.exe File created C:\Windows\SysWOW64\Eahobg32.exe Dalofi32.exe File created C:\Windows\SysWOW64\Khecje32.dll Jlkafdco.exe File created C:\Windows\SysWOW64\Maghkogk.dll Pkjegb32.exe File created C:\Windows\SysWOW64\Oakaofpm.dll Akogio32.exe File created C:\Windows\SysWOW64\Gknohl32.dll Ciaddaaj.exe File opened for modification C:\Windows\SysWOW64\Ljhchc32.exe Lapopm32.exe File created C:\Windows\SysWOW64\Ladhkmno.exe Lcqgahoe.exe File created C:\Windows\SysWOW64\Kongimkh.dll Jejbhk32.exe File created C:\Windows\SysWOW64\Eiijfd32.exe Epaemojk.exe File created C:\Windows\SysWOW64\Oebdml32.dll Fpcdof32.exe File created C:\Windows\SysWOW64\Hjmkbk32.dll Hqjcgbbo.exe File created C:\Windows\SysWOW64\Lelmqm32.dll Iobmmoed.exe File opened for modification C:\Windows\SysWOW64\Hjlaoioh.exe Hcaibo32.exe File created C:\Windows\SysWOW64\Igghilhi.exe Hhehkepj.exe File opened for modification C:\Windows\SysWOW64\Eldlhckj.exe Eblgon32.exe File opened for modification C:\Windows\SysWOW64\Gckjlf32.exe Gjcfcakn.exe File created C:\Windows\SysWOW64\Gqagkjne.exe Gckjlf32.exe File created C:\Windows\SysWOW64\Dacnkkem.dll Jopiom32.exe File opened for modification C:\Windows\SysWOW64\Lapopm32.exe Kpnepk32.exe File created C:\Windows\SysWOW64\Jnnnfalp.exe Infhebbh.exe File created C:\Windows\SysWOW64\Cbmlmmjd.exe Bcbeqaia.exe File created C:\Windows\SysWOW64\Qfhapinj.dll Dpihbjmg.exe File created C:\Windows\SysWOW64\Feifgnki.exe Fplnogmb.exe File created C:\Windows\SysWOW64\Gfdahb32.dll Cnmebblf.exe File created C:\Windows\SysWOW64\Cidlgjgm.dll Ijfkpnji.exe File opened for modification C:\Windows\SysWOW64\Lajhpbme.exe Ldfhgn32.exe File created C:\Windows\SysWOW64\Fplnogmb.exe Fibfbm32.exe File created C:\Windows\SysWOW64\Flekihpc.exe Fekclnif.exe File created C:\Windows\SysWOW64\Lfjkngdo.dll Jfjakgpa.exe File opened for modification C:\Windows\SysWOW64\Ijfkpnji.exe Hdffah32.exe File opened for modification C:\Windows\SysWOW64\Jcihjl32.exe Jgbhdkml.exe File created C:\Windows\SysWOW64\Modkhnci.dll Mmdlflki.exe File opened for modification C:\Windows\SysWOW64\Dfqdid32.exe Dhpdkm32.exe File opened for modification C:\Windows\SysWOW64\Dpnbmi32.exe Didjqoae.exe File created C:\Windows\SysWOW64\Mdodbf32.exe Mmdlflki.exe File created C:\Windows\SysWOW64\Qiiflaoo.exe Qamago32.exe File created C:\Windows\SysWOW64\Omabnq32.dll Mobbdf32.exe File created C:\Windows\SysWOW64\Gmjlak32.dll Kfeagefd.exe File created C:\Windows\SysWOW64\Hcgjhega.exe Hcembe32.exe File created C:\Windows\SysWOW64\Fcpfdg32.dll Lmjcdd32.exe File created C:\Windows\SysWOW64\Achmpagb.dll Glqkefff.exe File created C:\Windows\SysWOW64\Bfhofnpp.exe Almanf32.exe File created C:\Windows\SysWOW64\Gnamkncf.dll Feimadoe.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 7632 7840 WerFault.exe 279 440 7840 WerFault.exe 279 -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Blkgen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qiiflaoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpjepamq.dll" Lbhool32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afhgoj32.dll" Adqeaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Conpjg32.dll" Gegchl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hcaibo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mmghklif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gkefmjcj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Imknli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jncemmid.dll" Feifgnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Akogio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bbpeghpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnaoemei.dll" Kpnepk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbhmepaa.dll" Hodqlq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Igghilhi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcefei32.dll" Ioffhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bgjjoi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hjieii32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lapopm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lapopm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mhmcck32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnjmpege.dll" Bngfli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hljnkdnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mmiealgc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fnffhgon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Maoifh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmedbiid.dll" Imfdaigj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jcihjl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bpedeiff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhjaco32.dll" Lklnconj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Acbmjcgd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ckpamabg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gcimfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ifcben32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Igpkok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jejbhk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqgkidki.dll" Maoifh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bcbeqaia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dhpdkm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flopmh32.dll" Fekclnif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fndjec32.dll" Mpnngh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Eblgon32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Loniiflo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecgjjo32.dll" Nockkcjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppklijpk.dll" Blkgen32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jgbhdkml.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ijjekn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oeamcmmo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ainnhdbp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fekclnif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jamiaq32.dll" Jmmcgbnf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gjcfcakn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gjcfcakn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Knpmhh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijblcb32.dll" Ladhkmno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfdklc32.dll" Kalcik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pfncia32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcjkng32.dll" Pfmlok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bichcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Headnoed.dll" Bbpeghpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ephgolkn.dll" Bijncb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oebdml32.dll" Fpcdof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ioffhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acffllhk.dll" Ppnenlka.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1152 wrote to memory of 2404 1152 af843099eb67363f9727b6a2a028e3145b536b3bf34b676abdf8d2a63c8e7de2.exe 99 PID 1152 wrote to memory of 2404 1152 af843099eb67363f9727b6a2a028e3145b536b3bf34b676abdf8d2a63c8e7de2.exe 99 PID 1152 wrote to memory of 2404 1152 af843099eb67363f9727b6a2a028e3145b536b3bf34b676abdf8d2a63c8e7de2.exe 99 PID 2404 wrote to memory of 4924 2404 Oiccje32.exe 100 PID 2404 wrote to memory of 4924 2404 Oiccje32.exe 100 PID 2404 wrote to memory of 4924 2404 Oiccje32.exe 100 PID 4924 wrote to memory of 1788 4924 Ppikbm32.exe 101 PID 4924 wrote to memory of 1788 4924 Ppikbm32.exe 101 PID 4924 wrote to memory of 1788 4924 Ppikbm32.exe 101 PID 1788 wrote to memory of 4444 1788 Ppnenlka.exe 102 PID 1788 wrote to memory of 4444 1788 Ppnenlka.exe 102 PID 1788 wrote to memory of 4444 1788 Ppnenlka.exe 102 PID 4444 wrote to memory of 4576 4444 Qamago32.exe 103 PID 4444 wrote to memory of 4576 4444 Qamago32.exe 103 PID 4444 wrote to memory of 4576 4444 Qamago32.exe 103 PID 4576 wrote to memory of 220 4576 Qiiflaoo.exe 104 PID 4576 wrote to memory of 220 4576 Qiiflaoo.exe 104 PID 4576 wrote to memory of 220 4576 Qiiflaoo.exe 104 PID 220 wrote to memory of 3984 220 Abcgjg32.exe 105 PID 220 wrote to memory of 3984 220 Abcgjg32.exe 105 PID 220 wrote to memory of 3984 220 Abcgjg32.exe 105 PID 3984 wrote to memory of 4800 3984 Bdlfjh32.exe 106 PID 3984 wrote to memory of 4800 3984 Bdlfjh32.exe 106 PID 3984 wrote to memory of 4800 3984 Bdlfjh32.exe 106 PID 4800 wrote to memory of 2040 4800 Bpedeiff.exe 107 PID 4800 wrote to memory of 2040 4800 Bpedeiff.exe 107 PID 4800 wrote to memory of 2040 4800 Bpedeiff.exe 107 PID 2040 wrote to memory of 4940 2040 Ckpamabg.exe 108 PID 2040 wrote to memory of 4940 2040 Ckpamabg.exe 108 PID 2040 wrote to memory of 4940 2040 Ckpamabg.exe 108 PID 4940 wrote to memory of 2304 4940 Calfpk32.exe 109 PID 4940 wrote to memory of 2304 4940 Calfpk32.exe 109 PID 4940 wrote to memory of 2304 4940 Calfpk32.exe 109 PID 2304 wrote to memory of 548 2304 Cgklmacf.exe 110 PID 2304 wrote to memory of 548 2304 Cgklmacf.exe 110 PID 2304 wrote to memory of 548 2304 Cgklmacf.exe 110 PID 548 wrote to memory of 4128 548 Dalofi32.exe 111 PID 548 wrote to memory of 4128 548 Dalofi32.exe 111 PID 548 wrote to memory of 4128 548 Dalofi32.exe 111 PID 4128 wrote to memory of 2276 4128 Eahobg32.exe 112 PID 4128 wrote to memory of 2276 4128 Eahobg32.exe 112 PID 4128 wrote to memory of 2276 4128 Eahobg32.exe 112 PID 2276 wrote to memory of 1008 2276 Fnffhgon.exe 113 PID 2276 wrote to memory of 1008 2276 Fnffhgon.exe 113 PID 2276 wrote to memory of 1008 2276 Fnffhgon.exe 113 PID 1008 wrote to memory of 1156 1008 Gkefmjcj.exe 114 PID 1008 wrote to memory of 1156 1008 Gkefmjcj.exe 114 PID 1008 wrote to memory of 1156 1008 Gkefmjcj.exe 114 PID 1156 wrote to memory of 3320 1156 Icogcjde.exe 115 PID 1156 wrote to memory of 3320 1156 Icogcjde.exe 115 PID 1156 wrote to memory of 3320 1156 Icogcjde.exe 115 PID 3320 wrote to memory of 2520 3320 Infhebbh.exe 116 PID 3320 wrote to memory of 2520 3320 Infhebbh.exe 116 PID 3320 wrote to memory of 2520 3320 Infhebbh.exe 116 PID 2520 wrote to memory of 4532 2520 Jnnnfalp.exe 117 PID 2520 wrote to memory of 4532 2520 Jnnnfalp.exe 117 PID 2520 wrote to memory of 4532 2520 Jnnnfalp.exe 117 PID 4532 wrote to memory of 3492 4532 Jejbhk32.exe 118 PID 4532 wrote to memory of 3492 4532 Jejbhk32.exe 118 PID 4532 wrote to memory of 3492 4532 Jejbhk32.exe 118 PID 3492 wrote to memory of 2816 3492 Jaqcnl32.exe 119 PID 3492 wrote to memory of 2816 3492 Jaqcnl32.exe 119 PID 3492 wrote to memory of 2816 3492 Jaqcnl32.exe 119 PID 2816 wrote to memory of 2456 2816 Jlkafdco.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\af843099eb67363f9727b6a2a028e3145b536b3bf34b676abdf8d2a63c8e7de2.exe"C:\Users\Admin\AppData\Local\Temp\af843099eb67363f9727b6a2a028e3145b536b3bf34b676abdf8d2a63c8e7de2.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\Oiccje32.exeC:\Windows\system32\Oiccje32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\Ppikbm32.exeC:\Windows\system32\Ppikbm32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\Ppnenlka.exeC:\Windows\system32\Ppnenlka.exe4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\Qamago32.exeC:\Windows\system32\Qamago32.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\Qiiflaoo.exeC:\Windows\system32\Qiiflaoo.exe6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\Abcgjg32.exeC:\Windows\system32\Abcgjg32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\Bdlfjh32.exeC:\Windows\system32\Bdlfjh32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\Bpedeiff.exeC:\Windows\system32\Bpedeiff.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\Ckpamabg.exeC:\Windows\system32\Ckpamabg.exe10⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\Calfpk32.exeC:\Windows\system32\Calfpk32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\Cgklmacf.exeC:\Windows\system32\Cgklmacf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\Dalofi32.exeC:\Windows\system32\Dalofi32.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\Eahobg32.exeC:\Windows\system32\Eahobg32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\Fnffhgon.exeC:\Windows\system32\Fnffhgon.exe15⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\Gkefmjcj.exeC:\Windows\system32\Gkefmjcj.exe16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\Icogcjde.exeC:\Windows\system32\Icogcjde.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\Infhebbh.exeC:\Windows\system32\Infhebbh.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\Jnnnfalp.exeC:\Windows\system32\Jnnnfalp.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\Jejbhk32.exeC:\Windows\system32\Jejbhk32.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\Jaqcnl32.exeC:\Windows\system32\Jaqcnl32.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\Jlkafdco.exeC:\Windows\system32\Jlkafdco.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\Khabke32.exeC:\Windows\system32\Khabke32.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2456 -
C:\Windows\SysWOW64\Kalcik32.exeC:\Windows\system32\Kalcik32.exe24⤵
- Executes dropped EXE
- Modifies registry class
PID:3208 -
C:\Windows\SysWOW64\Lklnconj.exeC:\Windows\system32\Lklnconj.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3616 -
C:\Windows\SysWOW64\Lbhool32.exeC:\Windows\system32\Lbhool32.exe26⤵
- Executes dropped EXE
- Modifies registry class
PID:4124 -
C:\Windows\SysWOW64\Maoifh32.exeC:\Windows\system32\Maoifh32.exe27⤵
- Executes dropped EXE
- Modifies registry class
PID:4560 -
C:\Windows\SysWOW64\Ocdgahag.exeC:\Windows\system32\Ocdgahag.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4900 -
C:\Windows\SysWOW64\Ofgmib32.exeC:\Windows\system32\Ofgmib32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1420 -
C:\Windows\SysWOW64\Pfncia32.exeC:\Windows\system32\Pfncia32.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:4392 -
C:\Windows\SysWOW64\Akihcfid.exeC:\Windows\system32\Akihcfid.exe31⤵
- Executes dropped EXE
PID:4996 -
C:\Windows\SysWOW64\Acbmjcgd.exeC:\Windows\system32\Acbmjcgd.exe32⤵
- Executes dropped EXE
- Modifies registry class
PID:5024 -
C:\Windows\SysWOW64\Almanf32.exeC:\Windows\system32\Almanf32.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5048 -
C:\Windows\SysWOW64\Bfhofnpp.exeC:\Windows\system32\Bfhofnpp.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1784 -
C:\Windows\SysWOW64\Bpemkcck.exeC:\Windows\system32\Bpemkcck.exe35⤵
- Executes dropped EXE
PID:3292 -
C:\Windows\SysWOW64\Bcbeqaia.exeC:\Windows\system32\Bcbeqaia.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:708 -
C:\Windows\SysWOW64\Cbmlmmjd.exeC:\Windows\system32\Cbmlmmjd.exe37⤵
- Executes dropped EXE
PID:3560 -
C:\Windows\SysWOW64\Dpefaq32.exeC:\Windows\system32\Dpefaq32.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3932 -
C:\Windows\SysWOW64\Epaemojk.exeC:\Windows\system32\Epaemojk.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:5144 -
C:\Windows\SysWOW64\Eiijfd32.exeC:\Windows\system32\Eiijfd32.exe40⤵
- Executes dropped EXE
PID:5192 -
C:\Windows\SysWOW64\Ecdkdj32.exeC:\Windows\system32\Ecdkdj32.exe41⤵
- Executes dropped EXE
PID:5236 -
C:\Windows\SysWOW64\Feimadoe.exeC:\Windows\system32\Feimadoe.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5280 -
C:\Windows\SysWOW64\Gddqejni.exeC:\Windows\system32\Gddqejni.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:5324 -
C:\Windows\SysWOW64\Gjqinamq.exeC:\Windows\system32\Gjqinamq.exe44⤵
- Executes dropped EXE
PID:5364 -
C:\Windows\SysWOW64\Gcimfg32.exeC:\Windows\system32\Gcimfg32.exe45⤵
- Executes dropped EXE
- Modifies registry class
PID:5404 -
C:\Windows\SysWOW64\Gjcfcakn.exeC:\Windows\system32\Gjcfcakn.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:5444 -
C:\Windows\SysWOW64\Gckjlf32.exeC:\Windows\system32\Gckjlf32.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5488 -
C:\Windows\SysWOW64\Gqagkjne.exeC:\Windows\system32\Gqagkjne.exe48⤵
- Executes dropped EXE
PID:5528 -
C:\Windows\SysWOW64\Hcbpme32.exeC:\Windows\system32\Hcbpme32.exe49⤵
- Executes dropped EXE
PID:5568 -
C:\Windows\SysWOW64\Hcembe32.exeC:\Windows\system32\Hcembe32.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5604 -
C:\Windows\SysWOW64\Hcgjhega.exeC:\Windows\system32\Hcgjhega.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:5648 -
C:\Windows\SysWOW64\Hdffah32.exeC:\Windows\system32\Hdffah32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:5692 -
C:\Windows\SysWOW64\Ijfkpnji.exeC:\Windows\system32\Ijfkpnji.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:5732 -
C:\Windows\SysWOW64\Iqpclh32.exeC:\Windows\system32\Iqpclh32.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:5772 -
C:\Windows\SysWOW64\Imfdaigj.exeC:\Windows\system32\Imfdaigj.exe55⤵
- Executes dropped EXE
- Modifies registry class
PID:5824 -
C:\Windows\SysWOW64\Ijjekn32.exeC:\Windows\system32\Ijjekn32.exe56⤵
- Executes dropped EXE
- Modifies registry class
PID:5868 -
C:\Windows\SysWOW64\Imknli32.exeC:\Windows\system32\Imknli32.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:5908 -
C:\Windows\SysWOW64\Ifcben32.exeC:\Windows\system32\Ifcben32.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:5948 -
C:\Windows\SysWOW64\Jjakkmpk.exeC:\Windows\system32\Jjakkmpk.exe59⤵
- Executes dropped EXE
PID:5992 -
C:\Windows\SysWOW64\Jcaeea32.exeC:\Windows\system32\Jcaeea32.exe60⤵
- Executes dropped EXE
PID:6044 -
C:\Windows\SysWOW64\Khakqo32.exeC:\Windows\system32\Khakqo32.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:6084 -
C:\Windows\SysWOW64\Keekjc32.exeC:\Windows\system32\Keekjc32.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:6124 -
C:\Windows\SysWOW64\Knpmhh32.exeC:\Windows\system32\Knpmhh32.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:5184 -
C:\Windows\SysWOW64\Lmjcdd32.exeC:\Windows\system32\Lmjcdd32.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5244 -
C:\Windows\SysWOW64\Ldfhgn32.exeC:\Windows\system32\Ldfhgn32.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:5304 -
C:\Windows\SysWOW64\Lajhpbme.exeC:\Windows\system32\Lajhpbme.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5312 -
C:\Windows\SysWOW64\Loniiflo.exeC:\Windows\system32\Loniiflo.exe67⤵
- Drops file in System32 directory
- Modifies registry class
PID:5432 -
C:\Windows\SysWOW64\Mdmngm32.exeC:\Windows\system32\Mdmngm32.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5508 -
C:\Windows\SysWOW64\Mobbdf32.exeC:\Windows\system32\Mobbdf32.exe69⤵
- Drops file in System32 directory
PID:5592 -
C:\Windows\SysWOW64\Mhmcck32.exeC:\Windows\system32\Mhmcck32.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:5656 -
C:\Windows\SysWOW64\Meadlo32.exeC:\Windows\system32\Meadlo32.exe71⤵PID:5720
-
C:\Windows\SysWOW64\Nahdapae.exeC:\Windows\system32\Nahdapae.exe72⤵PID:5484
-
C:\Windows\SysWOW64\Najagp32.exeC:\Windows\system32\Najagp32.exe73⤵PID:5840
-
C:\Windows\SysWOW64\Nockkcjg.exeC:\Windows\system32\Nockkcjg.exe74⤵
- Modifies registry class
PID:5884 -
C:\Windows\SysWOW64\Nemchn32.exeC:\Windows\system32\Nemchn32.exe75⤵PID:5968
-
C:\Windows\SysWOW64\Oacdmo32.exeC:\Windows\system32\Oacdmo32.exe76⤵PID:6052
-
C:\Windows\SysWOW64\Oeamcmmo.exeC:\Windows\system32\Oeamcmmo.exe77⤵
- Modifies registry class
PID:6120 -
C:\Windows\SysWOW64\Pfmlok32.exeC:\Windows\system32\Pfmlok32.exe78⤵
- Modifies registry class
PID:5228 -
C:\Windows\SysWOW64\Pkjegb32.exeC:\Windows\system32\Pkjegb32.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5220 -
C:\Windows\SysWOW64\Qbmpjkqk.exeC:\Windows\system32\Qbmpjkqk.exe80⤵PID:5308
-
C:\Windows\SysWOW64\Adqeaf32.exeC:\Windows\system32\Adqeaf32.exe81⤵
- Modifies registry class
PID:5468 -
C:\Windows\SysWOW64\Ainnhdbp.exeC:\Windows\system32\Ainnhdbp.exe82⤵
- Modifies registry class
PID:5640 -
C:\Windows\SysWOW64\Ankgpk32.exeC:\Windows\system32\Ankgpk32.exe83⤵PID:5764
-
C:\Windows\SysWOW64\Aeeomegd.exeC:\Windows\system32\Aeeomegd.exe84⤵PID:5856
-
C:\Windows\SysWOW64\Akogio32.exeC:\Windows\system32\Akogio32.exe85⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:5980 -
C:\Windows\SysWOW64\Bichcc32.exeC:\Windows\system32\Bichcc32.exe86⤵
- Modifies registry class
PID:6040 -
C:\Windows\SysWOW64\Bbpeghpe.exeC:\Windows\system32\Bbpeghpe.exe87⤵
- Modifies registry class
PID:6068 -
C:\Windows\SysWOW64\Bijncb32.exeC:\Windows\system32\Bijncb32.exe88⤵
- Modifies registry class
PID:3468 -
C:\Windows\SysWOW64\Bngfli32.exeC:\Windows\system32\Bngfli32.exe89⤵
- Modifies registry class
PID:5352 -
C:\Windows\SysWOW64\Blkgen32.exeC:\Windows\system32\Blkgen32.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5452 -
C:\Windows\SysWOW64\Becknc32.exeC:\Windows\system32\Becknc32.exe91⤵
- Drops file in System32 directory
PID:5728 -
C:\Windows\SysWOW64\Cnlpgibd.exeC:\Windows\system32\Cnlpgibd.exe92⤵PID:4524
-
C:\Windows\SysWOW64\Ciaddaaj.exeC:\Windows\system32\Ciaddaaj.exe93⤵
- Drops file in System32 directory
PID:844 -
C:\Windows\SysWOW64\Cfedmfqd.exeC:\Windows\system32\Cfedmfqd.exe94⤵PID:1496
-
C:\Windows\SysWOW64\Cblebgfh.exeC:\Windows\system32\Cblebgfh.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5496 -
C:\Windows\SysWOW64\Dbckcf32.exeC:\Windows\system32\Dbckcf32.exe96⤵PID:3312
-
C:\Windows\SysWOW64\Dhpdkm32.exeC:\Windows\system32\Dhpdkm32.exe97⤵
- Drops file in System32 directory
- Modifies registry class
PID:456 -
C:\Windows\SysWOW64\Dfqdid32.exeC:\Windows\system32\Dfqdid32.exe98⤵PID:5428
-
C:\Windows\SysWOW64\Dpihbjmg.exeC:\Windows\system32\Dpihbjmg.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5792 -
C:\Windows\SysWOW64\Dfcqod32.exeC:\Windows\system32\Dfcqod32.exe100⤵PID:5168
-
C:\Windows\SysWOW64\Dbjade32.exeC:\Windows\system32\Dbjade32.exe101⤵PID:4460
-
C:\Windows\SysWOW64\Didjqoae.exeC:\Windows\system32\Didjqoae.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5440 -
C:\Windows\SysWOW64\Dpnbmi32.exeC:\Windows\system32\Dpnbmi32.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4944 -
C:\Windows\SysWOW64\Fibfbm32.exeC:\Windows\system32\Fibfbm32.exe104⤵
- Drops file in System32 directory
PID:6164 -
C:\Windows\SysWOW64\Fplnogmb.exeC:\Windows\system32\Fplnogmb.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:6200 -
C:\Windows\SysWOW64\Feifgnki.exeC:\Windows\system32\Feifgnki.exe106⤵
- Drops file in System32 directory
- Modifies registry class
PID:6248 -
C:\Windows\SysWOW64\Flboch32.exeC:\Windows\system32\Flboch32.exe107⤵PID:6284
-
C:\Windows\SysWOW64\Fekclnif.exeC:\Windows\system32\Fekclnif.exe108⤵
- Drops file in System32 directory
- Modifies registry class
PID:6336 -
C:\Windows\SysWOW64\Flekihpc.exeC:\Windows\system32\Flekihpc.exe109⤵PID:6376
-
C:\Windows\SysWOW64\Fempbm32.exeC:\Windows\system32\Fempbm32.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6420 -
C:\Windows\SysWOW64\Fpcdof32.exeC:\Windows\system32\Fpcdof32.exe111⤵
- Drops file in System32 directory
- Modifies registry class
PID:6464 -
C:\Windows\SysWOW64\Gegchl32.exeC:\Windows\system32\Gegchl32.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6508 -
C:\Windows\SysWOW64\Glqkefff.exeC:\Windows\system32\Glqkefff.exe113⤵
- Drops file in System32 directory
PID:6544 -
C:\Windows\SysWOW64\Gckcap32.exeC:\Windows\system32\Gckcap32.exe114⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:6588 -
C:\Windows\SysWOW64\Gjdknjep.exeC:\Windows\system32\Gjdknjep.exe115⤵PID:6628
-
C:\Windows\SysWOW64\Gpodkdll.exeC:\Windows\system32\Gpodkdll.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6672 -
C:\Windows\SysWOW64\Hodqlq32.exeC:\Windows\system32\Hodqlq32.exe117⤵
- Modifies registry class
PID:6716 -
C:\Windows\SysWOW64\Hjieii32.exeC:\Windows\system32\Hjieii32.exe118⤵
- Modifies registry class
PID:6760 -
C:\Windows\SysWOW64\Hcaibo32.exeC:\Windows\system32\Hcaibo32.exe119⤵
- Drops file in System32 directory
- Modifies registry class
PID:6804 -
C:\Windows\SysWOW64\Hjlaoioh.exeC:\Windows\system32\Hjlaoioh.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6844 -
C:\Windows\SysWOW64\Hljnkdnk.exeC:\Windows\system32\Hljnkdnk.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-