Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
163s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 20:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8cc62184fe2db524bb99c51aab0ff267.exe
Resource
win7-20240221-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
8cc62184fe2db524bb99c51aab0ff267.exe
Resource
win10v2004-20240226-en
5 signatures
150 seconds
General
-
Target
8cc62184fe2db524bb99c51aab0ff267.exe
-
Size
55KB
-
MD5
8cc62184fe2db524bb99c51aab0ff267
-
SHA1
3664e4d8f8a2f54b094417f2bc450d5b5c5a87a6
-
SHA256
7e41bb8daee6065eb041e817244e0f6b898465c45aade5e023f0ce528db66389
-
SHA512
eeb51bd3787ea6b1f55e43acb5d4b527b1d3fca3385e61a7b44b1d86f9c9856e1aaa4536e7b4bcb0bf20d6045550e6300ae768860860903b8eeb3a7a28463854
-
SSDEEP
768:APeFMQGZ4P5gmMZ6gZ1aZnUterzTRtDg/gA+OOkeOTMVelvZqMqf/1H5cXdnhK:AWeQGZg3Q6W8UterZtDGKmRUvlI
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jcphkhad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dkpjnd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Omqeobjo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpfcelml.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apfhajjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oicccj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Piapehkd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epfflj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okjcdq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Malnklgg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iiibdc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Imdgjlgb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ffnkggld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mcmongoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcffggkb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qdjgbg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ljnddb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Daeioo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpjdiadb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Onneeceo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oceepj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcolcgmh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Egpnidgk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 8cc62184fe2db524bb99c51aab0ff267.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bgodjiio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Enigek32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldpijknm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qnopjfgi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Alfcflfb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jbfhne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bhpopb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Enjfen32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iaokdn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icdhojka.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pcnhfi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmpido32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hfacai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fafkoiji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jfcbcp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkpjnd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Khmoionj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kedcml32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebiffc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kkpnqf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aiimejap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hapancai.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdjilphb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hagodlge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ckfggf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lbnlbc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bdiamnpc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gicgjk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mpapgknd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ljjicl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jogeia32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Negoaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fmoclg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Goabhl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnfafpfd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ffnkggld.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lndaaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hjolck32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Loemgdmc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bgmnooom.exe -
Executes dropped EXE 64 IoCs
pid Process 1300 Icgbob32.exe 4548 Kmbmdeoj.exe 2016 Mkicjgnn.exe 3676 Maehlqch.exe 3376 Oahnhncc.exe 3556 Qoocnpag.exe 4120 Akmjdpac.exe 2944 Bnppkj32.exe 2220 Bgmnooom.exe 5036 Bpfcelml.exe 4516 Cfjnhe32.exe 3592 Dlicflic.exe 5044 Dpnbmi32.exe 2792 Ehifak32.exe 3952 Eojeodga.exe 2168 Fplnogmb.exe 1656 Fhiphi32.exe 1944 Hhckeeam.exe 1900 Hjbhph32.exe 776 Ihheqd32.exe 1432 Ijjnpg32.exe 3112 Ijngkf32.exe 3976 Jmffnq32.exe 4876 Kpilekqj.exe 4004 Kmpido32.exe 4200 Kfhnme32.exe 4284 Kfjjbd32.exe 3176 Lglcag32.exe 4524 Malnklgg.exe 1156 Mfmpob32.exe 3304 Mhoind32.exe 3536 Nhcbidcd.exe 3104 Pjjaci32.exe 1856 Pjlnhi32.exe 4064 Qnopjfgi.exe 2644 Ahinbo32.exe 3440 Abflfc32.exe 324 Bdiamnpc.exe 2916 Bgodjiio.exe 3164 Dijppjfd.exe 2872 Dajnol32.exe 1056 Eihlahjd.exe 4992 Eacaej32.exe 3704 Facjlhil.exe 1752 Gbecljnl.exe 4328 Hkodak32.exe 2900 Jbnopbdl.exe 4988 Kokbpe32.exe 2000 Ljjicl32.exe 1820 Lcbmlbig.exe 2440 Liofdigo.exe 4928 Llpofd32.exe 4836 Mmfaafej.exe 3152 Njmopj32.exe 3296 Npighq32.exe 3836 Npqmipjq.exe 4268 Nfjeej32.exe 4968 Odnfonag.exe 4352 Ollgiplp.exe 4772 Okaabg32.exe 4108 Pbmffi32.exe 3248 Pgmkbg32.exe 2856 Alfcflfb.exe 4348 Apfhajjf.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Akoqjl32.exe Qocfjlan.exe File opened for modification C:\Windows\SysWOW64\Dojqcjgi.exe Dqipeboj.exe File created C:\Windows\SysWOW64\Dkpjnd32.exe Dpjfqljl.exe File created C:\Windows\SysWOW64\Ldmldk32.exe Kopcld32.exe File opened for modification C:\Windows\SysWOW64\Icgbob32.exe 8cc62184fe2db524bb99c51aab0ff267.exe File created C:\Windows\SysWOW64\Bgmnooom.exe Bnppkj32.exe File opened for modification C:\Windows\SysWOW64\Afelal32.exe Qcpieamc.exe File created C:\Windows\SysWOW64\Ndblob32.dll Pmgcidqm.exe File created C:\Windows\SysWOW64\Pdfeandd.exe Poimigfm.exe File opened for modification C:\Windows\SysWOW64\Dnhgcgbi.exe Cgnogmkl.exe File created C:\Windows\SysWOW64\Cckfkiep.exe Ckpagg32.exe File created C:\Windows\SysWOW64\Lglcag32.exe Kfjjbd32.exe File created C:\Windows\SysWOW64\Efjbne32.exe Eopjakkg.exe File created C:\Windows\SysWOW64\Pnbifmla.exe Palkgi32.exe File created C:\Windows\SysWOW64\Dapnokng.dll Bmomecoi.exe File created C:\Windows\SysWOW64\Kddhjo32.dll Hlldaape.exe File opened for modification C:\Windows\SysWOW64\Lcocmi32.exe Kifodcej.exe File opened for modification C:\Windows\SysWOW64\Ldpijknm.exe Lbnlbc32.exe File created C:\Windows\SysWOW64\Gmejknqp.dll Nhbfpl32.exe File created C:\Windows\SysWOW64\Ingpgcmj.exe Igmgji32.exe File created C:\Windows\SysWOW64\Ompmie32.exe Ohahkojp.exe File opened for modification C:\Windows\SysWOW64\Oendaipn.exe Negoaj32.exe File created C:\Windows\SysWOW64\Mjalkblo.dll Cikkga32.exe File opened for modification C:\Windows\SysWOW64\Abkjnd32.exe Qebpipij.exe File created C:\Windows\SysWOW64\Kmpido32.exe Kpilekqj.exe File created C:\Windows\SysWOW64\Qniogl32.exe Qimfoe32.exe File created C:\Windows\SysWOW64\Ohfddi32.dll Ahmlaj32.exe File opened for modification C:\Windows\SysWOW64\Gbgibgpf.exe Fmjqjqao.exe File created C:\Windows\SysWOW64\Ilnbch32.exe Icfnjcec.exe File opened for modification C:\Windows\SysWOW64\Apeabg32.exe Akiijq32.exe File created C:\Windows\SysWOW64\Eojeodga.exe Ehifak32.exe File created C:\Windows\SysWOW64\Imdgjlgb.exe Ilpaei32.exe File opened for modification C:\Windows\SysWOW64\Kkelmc32.exe Jcphkhad.exe File created C:\Windows\SysWOW64\Bfqjhj32.dll Indkih32.exe File created C:\Windows\SysWOW64\Eocfgq32.dll Hjbhph32.exe File created C:\Windows\SysWOW64\Elighial.dll Coojpg32.exe File created C:\Windows\SysWOW64\Jpihke32.dll Mpapgknd.exe File created C:\Windows\SysWOW64\Amcmie32.exe Afelal32.exe File created C:\Windows\SysWOW64\Ecpmod32.exe Dihllkal.exe File opened for modification C:\Windows\SysWOW64\Kehocokh.exe Kkbkffka.exe File created C:\Windows\SysWOW64\Qoocnpag.exe Oahnhncc.exe File created C:\Windows\SysWOW64\Gpaqbf32.dll Ngnnbq32.exe File opened for modification C:\Windows\SysWOW64\Fkalmn32.exe Fafkoiji.exe File created C:\Windows\SysWOW64\Fcdpakhk.dll Bnppkj32.exe File opened for modification C:\Windows\SysWOW64\Jlphnbfe.exe Jbgdelpe.exe File created C:\Windows\SysWOW64\Oicccj32.exe Obgoaq32.exe File created C:\Windows\SysWOW64\Jdahga32.dll Bcddlhgo.exe File created C:\Windows\SysWOW64\Gmmmoppl.exe Gbgibgpf.exe File opened for modification C:\Windows\SysWOW64\Eghimo32.exe Dqdnjfpc.exe File created C:\Windows\SysWOW64\Lcacmeaa.dll Aaanif32.exe File created C:\Windows\SysWOW64\Gjiipife.dll Qjmeaafi.exe File created C:\Windows\SysWOW64\Hdicbkci.exe Hgcfcg32.exe File created C:\Windows\SysWOW64\Poickc32.dll Ecgone32.exe File created C:\Windows\SysWOW64\Ijjnpg32.exe Ihheqd32.exe File created C:\Windows\SysWOW64\Cikkga32.exe Chlomnfl.exe File created C:\Windows\SysWOW64\Kbebdpca.exe Kpgfhddn.exe File created C:\Windows\SysWOW64\Ibjanpje.dll Apeabg32.exe File created C:\Windows\SysWOW64\Amloakki.exe Agbgda32.exe File created C:\Windows\SysWOW64\Eihlahjd.exe Dajnol32.exe File opened for modification C:\Windows\SysWOW64\Lndaaj32.exe Kbfjljhf.exe File created C:\Windows\SysWOW64\Bqkcgq32.dll Mmmqbb32.exe File created C:\Windows\SysWOW64\Iikmlnae.exe Himqjpme.exe File created C:\Windows\SysWOW64\Fflngpbn.dll Bgnfpp32.exe File opened for modification C:\Windows\SysWOW64\Foapkfco.exe Felkmnci.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Akmjdpac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nfjeej32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ocmjcjad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poeink32.dll" Bpkllo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jpalomaq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mfchehla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Giqjdk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 8cc62184fe2db524bb99c51aab0ff267.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ldmldk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hlldaape.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkckcj32.dll" Olfgbl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bonhqnpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiphfa32.dll" Dnondf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maplgcdk.dll" Dcffggkb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ofmjlj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mbfmha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Piapehkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhglhbni.dll" Eacaej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjjccl32.dll" Kbebdpca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nimioo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qocfjlan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fohoed32.dll" Imieblgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bffhme32.dll" Aeoppbge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qimfoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Enigek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjbofkpn.dll" Ehifak32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Akiijq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cdmokljp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdhcdlco.dll" Djhiglji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phioej32.dll" Llpofd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jieiif32.dll" Njmopj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cempebgi.dll" Kfjjbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odepecoi.dll" Kchmljab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fokbbcmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpaqbf32.dll" Ngnnbq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Odmbkolo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbkbkm32.dll" Adfgne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcacmeaa.dll" Aaanif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oihjionb.dll" Gdjilphb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ebiffc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Klbgpi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ejhkdc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jmffnq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fnmqegle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmaimd32.dll" Lnanadfi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ibgmldnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nggddfag.dll" Iomcqa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kjkpif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekoofiod.dll" Iikmlnae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ijjnpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfdpm32.dll" Mfchehla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmgenjm.dll" Npqmipjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjgple32.dll" Ldkfno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcojkgea.dll" Piphaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfqppold.dll" Baephacf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pknmfekb.dll" Dajbjoao.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kkkdegaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkkfal32.dll" Kmbmdeoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eoljhi32.dll" Mmfaafej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ffpjihee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kbebdpca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hgcfcg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pjlnhi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Afelal32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1120 wrote to memory of 1300 1120 8cc62184fe2db524bb99c51aab0ff267.exe 94 PID 1120 wrote to memory of 1300 1120 8cc62184fe2db524bb99c51aab0ff267.exe 94 PID 1120 wrote to memory of 1300 1120 8cc62184fe2db524bb99c51aab0ff267.exe 94 PID 1300 wrote to memory of 4548 1300 Icgbob32.exe 95 PID 1300 wrote to memory of 4548 1300 Icgbob32.exe 95 PID 1300 wrote to memory of 4548 1300 Icgbob32.exe 95 PID 4548 wrote to memory of 2016 4548 Kmbmdeoj.exe 96 PID 4548 wrote to memory of 2016 4548 Kmbmdeoj.exe 96 PID 4548 wrote to memory of 2016 4548 Kmbmdeoj.exe 96 PID 2016 wrote to memory of 3676 2016 Mkicjgnn.exe 98 PID 2016 wrote to memory of 3676 2016 Mkicjgnn.exe 98 PID 2016 wrote to memory of 3676 2016 Mkicjgnn.exe 98 PID 3676 wrote to memory of 3376 3676 Maehlqch.exe 100 PID 3676 wrote to memory of 3376 3676 Maehlqch.exe 100 PID 3676 wrote to memory of 3376 3676 Maehlqch.exe 100 PID 3376 wrote to memory of 3556 3376 Oahnhncc.exe 101 PID 3376 wrote to memory of 3556 3376 Oahnhncc.exe 101 PID 3376 wrote to memory of 3556 3376 Oahnhncc.exe 101 PID 3556 wrote to memory of 4120 3556 Qoocnpag.exe 102 PID 3556 wrote to memory of 4120 3556 Qoocnpag.exe 102 PID 3556 wrote to memory of 4120 3556 Qoocnpag.exe 102 PID 4120 wrote to memory of 2944 4120 Akmjdpac.exe 103 PID 4120 wrote to memory of 2944 4120 Akmjdpac.exe 103 PID 4120 wrote to memory of 2944 4120 Akmjdpac.exe 103 PID 2944 wrote to memory of 2220 2944 Bnppkj32.exe 104 PID 2944 wrote to memory of 2220 2944 Bnppkj32.exe 104 PID 2944 wrote to memory of 2220 2944 Bnppkj32.exe 104 PID 2220 wrote to memory of 5036 2220 Bgmnooom.exe 106 PID 2220 wrote to memory of 5036 2220 Bgmnooom.exe 106 PID 2220 wrote to memory of 5036 2220 Bgmnooom.exe 106 PID 5036 wrote to memory of 4516 5036 Bpfcelml.exe 107 PID 5036 wrote to memory of 4516 5036 Bpfcelml.exe 107 PID 5036 wrote to memory of 4516 5036 Bpfcelml.exe 107 PID 4516 wrote to memory of 3592 4516 Cfjnhe32.exe 108 PID 4516 wrote to memory of 3592 4516 Cfjnhe32.exe 108 PID 4516 wrote to memory of 3592 4516 Cfjnhe32.exe 108 PID 3592 wrote to memory of 5044 3592 Dlicflic.exe 109 PID 3592 wrote to memory of 5044 3592 Dlicflic.exe 109 PID 3592 wrote to memory of 5044 3592 Dlicflic.exe 109 PID 5044 wrote to memory of 2792 5044 Dpnbmi32.exe 110 PID 5044 wrote to memory of 2792 5044 Dpnbmi32.exe 110 PID 5044 wrote to memory of 2792 5044 Dpnbmi32.exe 110 PID 2792 wrote to memory of 3952 2792 Ehifak32.exe 111 PID 2792 wrote to memory of 3952 2792 Ehifak32.exe 111 PID 2792 wrote to memory of 3952 2792 Ehifak32.exe 111 PID 3952 wrote to memory of 2168 3952 Eojeodga.exe 112 PID 3952 wrote to memory of 2168 3952 Eojeodga.exe 112 PID 3952 wrote to memory of 2168 3952 Eojeodga.exe 112 PID 2168 wrote to memory of 1656 2168 Fplnogmb.exe 113 PID 2168 wrote to memory of 1656 2168 Fplnogmb.exe 113 PID 2168 wrote to memory of 1656 2168 Fplnogmb.exe 113 PID 1656 wrote to memory of 1944 1656 Fhiphi32.exe 114 PID 1656 wrote to memory of 1944 1656 Fhiphi32.exe 114 PID 1656 wrote to memory of 1944 1656 Fhiphi32.exe 114 PID 1944 wrote to memory of 1900 1944 Hhckeeam.exe 115 PID 1944 wrote to memory of 1900 1944 Hhckeeam.exe 115 PID 1944 wrote to memory of 1900 1944 Hhckeeam.exe 115 PID 1900 wrote to memory of 776 1900 Hjbhph32.exe 116 PID 1900 wrote to memory of 776 1900 Hjbhph32.exe 116 PID 1900 wrote to memory of 776 1900 Hjbhph32.exe 116 PID 776 wrote to memory of 1432 776 Ihheqd32.exe 117 PID 776 wrote to memory of 1432 776 Ihheqd32.exe 117 PID 776 wrote to memory of 1432 776 Ihheqd32.exe 117 PID 1432 wrote to memory of 3112 1432 Ijjnpg32.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cc62184fe2db524bb99c51aab0ff267.exe"C:\Users\Admin\AppData\Local\Temp\8cc62184fe2db524bb99c51aab0ff267.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\Icgbob32.exeC:\Windows\system32\Icgbob32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\Kmbmdeoj.exeC:\Windows\system32\Kmbmdeoj.exe3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\Mkicjgnn.exeC:\Windows\system32\Mkicjgnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\Maehlqch.exeC:\Windows\system32\Maehlqch.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\Oahnhncc.exeC:\Windows\system32\Oahnhncc.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\Qoocnpag.exeC:\Windows\system32\Qoocnpag.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\Akmjdpac.exeC:\Windows\system32\Akmjdpac.exe8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\Bnppkj32.exeC:\Windows\system32\Bnppkj32.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\Bgmnooom.exeC:\Windows\system32\Bgmnooom.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\Bpfcelml.exeC:\Windows\system32\Bpfcelml.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\Cfjnhe32.exeC:\Windows\system32\Cfjnhe32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\Dlicflic.exeC:\Windows\system32\Dlicflic.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\Dpnbmi32.exeC:\Windows\system32\Dpnbmi32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\Ehifak32.exeC:\Windows\system32\Ehifak32.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\Eojeodga.exeC:\Windows\system32\Eojeodga.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\Fplnogmb.exeC:\Windows\system32\Fplnogmb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\Fhiphi32.exeC:\Windows\system32\Fhiphi32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\Hhckeeam.exeC:\Windows\system32\Hhckeeam.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\Hjbhph32.exeC:\Windows\system32\Hjbhph32.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\Ihheqd32.exeC:\Windows\system32\Ihheqd32.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\Ijjnpg32.exeC:\Windows\system32\Ijjnpg32.exe22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\Ijngkf32.exeC:\Windows\system32\Ijngkf32.exe23⤵
- Executes dropped EXE
PID:3112 -
C:\Windows\SysWOW64\Jmffnq32.exeC:\Windows\system32\Jmffnq32.exe24⤵
- Executes dropped EXE
- Modifies registry class
PID:3976 -
C:\Windows\SysWOW64\Kpilekqj.exeC:\Windows\system32\Kpilekqj.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4876 -
C:\Windows\SysWOW64\Kmpido32.exeC:\Windows\system32\Kmpido32.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4004 -
C:\Windows\SysWOW64\Kfhnme32.exeC:\Windows\system32\Kfhnme32.exe27⤵
- Executes dropped EXE
PID:4200 -
C:\Windows\SysWOW64\Kfjjbd32.exeC:\Windows\system32\Kfjjbd32.exe28⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4284 -
C:\Windows\SysWOW64\Lglcag32.exeC:\Windows\system32\Lglcag32.exe29⤵
- Executes dropped EXE
PID:3176 -
C:\Windows\SysWOW64\Malnklgg.exeC:\Windows\system32\Malnklgg.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4524 -
C:\Windows\SysWOW64\Mfmpob32.exeC:\Windows\system32\Mfmpob32.exe31⤵
- Executes dropped EXE
PID:1156 -
C:\Windows\SysWOW64\Mhoind32.exeC:\Windows\system32\Mhoind32.exe32⤵
- Executes dropped EXE
PID:3304 -
C:\Windows\SysWOW64\Nhcbidcd.exeC:\Windows\system32\Nhcbidcd.exe33⤵
- Executes dropped EXE
PID:3536 -
C:\Windows\SysWOW64\Pjjaci32.exeC:\Windows\system32\Pjjaci32.exe34⤵
- Executes dropped EXE
PID:3104 -
C:\Windows\SysWOW64\Pjlnhi32.exeC:\Windows\system32\Pjlnhi32.exe35⤵
- Executes dropped EXE
- Modifies registry class
PID:1856 -
C:\Windows\SysWOW64\Qnopjfgi.exeC:\Windows\system32\Qnopjfgi.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4064 -
C:\Windows\SysWOW64\Ahinbo32.exeC:\Windows\system32\Ahinbo32.exe37⤵
- Executes dropped EXE
PID:2644 -
C:\Windows\SysWOW64\Abflfc32.exeC:\Windows\system32\Abflfc32.exe38⤵
- Executes dropped EXE
PID:3440 -
C:\Windows\SysWOW64\Bdiamnpc.exeC:\Windows\system32\Bdiamnpc.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:324 -
C:\Windows\SysWOW64\Bgodjiio.exeC:\Windows\system32\Bgodjiio.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2916 -
C:\Windows\SysWOW64\Dijppjfd.exeC:\Windows\system32\Dijppjfd.exe41⤵
- Executes dropped EXE
PID:3164 -
C:\Windows\SysWOW64\Dajnol32.exeC:\Windows\system32\Dajnol32.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2872 -
C:\Windows\SysWOW64\Eihlahjd.exeC:\Windows\system32\Eihlahjd.exe43⤵
- Executes dropped EXE
PID:1056 -
C:\Windows\SysWOW64\Eacaej32.exeC:\Windows\system32\Eacaej32.exe44⤵
- Executes dropped EXE
- Modifies registry class
PID:4992 -
C:\Windows\SysWOW64\Facjlhil.exeC:\Windows\system32\Facjlhil.exe45⤵
- Executes dropped EXE
PID:3704 -
C:\Windows\SysWOW64\Gbecljnl.exeC:\Windows\system32\Gbecljnl.exe46⤵
- Executes dropped EXE
PID:1752 -
C:\Windows\SysWOW64\Hkodak32.exeC:\Windows\system32\Hkodak32.exe47⤵
- Executes dropped EXE
PID:4328 -
C:\Windows\SysWOW64\Jbnopbdl.exeC:\Windows\system32\Jbnopbdl.exe48⤵
- Executes dropped EXE
PID:2900 -
C:\Windows\SysWOW64\Kokbpe32.exeC:\Windows\system32\Kokbpe32.exe49⤵
- Executes dropped EXE
PID:4988 -
C:\Windows\SysWOW64\Ljjicl32.exeC:\Windows\system32\Ljjicl32.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2000 -
C:\Windows\SysWOW64\Lcbmlbig.exeC:\Windows\system32\Lcbmlbig.exe51⤵
- Executes dropped EXE
PID:1820 -
C:\Windows\SysWOW64\Liofdigo.exeC:\Windows\system32\Liofdigo.exe52⤵
- Executes dropped EXE
PID:2440 -
C:\Windows\SysWOW64\Llpofd32.exeC:\Windows\system32\Llpofd32.exe53⤵
- Executes dropped EXE
- Modifies registry class
PID:4928 -
C:\Windows\SysWOW64\Mmfaafej.exeC:\Windows\system32\Mmfaafej.exe54⤵
- Executes dropped EXE
- Modifies registry class
PID:4836 -
C:\Windows\SysWOW64\Njmopj32.exeC:\Windows\system32\Njmopj32.exe55⤵
- Executes dropped EXE
- Modifies registry class
PID:3152 -
C:\Windows\SysWOW64\Npighq32.exeC:\Windows\system32\Npighq32.exe56⤵
- Executes dropped EXE
PID:3296 -
C:\Windows\SysWOW64\Npqmipjq.exeC:\Windows\system32\Npqmipjq.exe57⤵
- Executes dropped EXE
- Modifies registry class
PID:3836 -
C:\Windows\SysWOW64\Nfjeej32.exeC:\Windows\system32\Nfjeej32.exe58⤵
- Executes dropped EXE
- Modifies registry class
PID:4268 -
C:\Windows\SysWOW64\Odnfonag.exeC:\Windows\system32\Odnfonag.exe59⤵
- Executes dropped EXE
PID:4968 -
C:\Windows\SysWOW64\Ollgiplp.exeC:\Windows\system32\Ollgiplp.exe60⤵
- Executes dropped EXE
PID:4352 -
C:\Windows\SysWOW64\Okaabg32.exeC:\Windows\system32\Okaabg32.exe61⤵
- Executes dropped EXE
PID:4772 -
C:\Windows\SysWOW64\Pbmffi32.exeC:\Windows\system32\Pbmffi32.exe62⤵
- Executes dropped EXE
PID:4108 -
C:\Windows\SysWOW64\Pgmkbg32.exeC:\Windows\system32\Pgmkbg32.exe63⤵
- Executes dropped EXE
PID:3248 -
C:\Windows\SysWOW64\Alfcflfb.exeC:\Windows\system32\Alfcflfb.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2856 -
C:\Windows\SysWOW64\Apfhajjf.exeC:\Windows\system32\Apfhajjf.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4348 -
C:\Windows\SysWOW64\Cgnmpbec.exeC:\Windows\system32\Cgnmpbec.exe66⤵PID:3272
-
C:\Windows\SysWOW64\Djhiglji.exeC:\Windows\system32\Djhiglji.exe67⤵
- Modifies registry class
PID:4332 -
C:\Windows\SysWOW64\Dqbadf32.exeC:\Windows\system32\Dqbadf32.exe68⤵PID:4596
-
C:\Windows\SysWOW64\Dqdnjfpc.exeC:\Windows\system32\Dqdnjfpc.exe69⤵
- Drops file in System32 directory
PID:4920 -
C:\Windows\SysWOW64\Eghimo32.exeC:\Windows\system32\Eghimo32.exe70⤵PID:4692
-
C:\Windows\SysWOW64\Fnmqegle.exeC:\Windows\system32\Fnmqegle.exe71⤵
- Modifies registry class
PID:4684 -
C:\Windows\SysWOW64\Fegiba32.exeC:\Windows\system32\Fegiba32.exe72⤵PID:4188
-
C:\Windows\SysWOW64\Galfhpmf.exeC:\Windows\system32\Galfhpmf.exe73⤵PID:2272
-
C:\Windows\SysWOW64\Helkdnaj.exeC:\Windows\system32\Helkdnaj.exe74⤵PID:2632
-
C:\Windows\SysWOW64\Iaokdn32.exeC:\Windows\system32\Iaokdn32.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4960 -
C:\Windows\SysWOW64\Jogeia32.exeC:\Windows\system32\Jogeia32.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5052 -
C:\Windows\SysWOW64\Khimhefk.exeC:\Windows\system32\Khimhefk.exe77⤵PID:2204
-
C:\Windows\SysWOW64\Klibdcjo.exeC:\Windows\system32\Klibdcjo.exe78⤵PID:3896
-
C:\Windows\SysWOW64\Kbfjljhf.exeC:\Windows\system32\Kbfjljhf.exe79⤵
- Drops file in System32 directory
PID:3396 -
C:\Windows\SysWOW64\Lndaaj32.exeC:\Windows\system32\Lndaaj32.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2432 -
C:\Windows\SysWOW64\Moomgl32.exeC:\Windows\system32\Moomgl32.exe81⤵PID:4140
-
C:\Windows\SysWOW64\Nfpled32.exeC:\Windows\system32\Nfpled32.exe82⤵PID:5160
-
C:\Windows\SysWOW64\Aiimejap.exeC:\Windows\system32\Aiimejap.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5312 -
C:\Windows\SysWOW64\Blqlgdhi.exeC:\Windows\system32\Blqlgdhi.exe84⤵PID:5372
-
C:\Windows\SysWOW64\Cfpfqiha.exeC:\Windows\system32\Cfpfqiha.exe85⤵PID:5432
-
C:\Windows\SysWOW64\Cpjdiadb.exeC:\Windows\system32\Cpjdiadb.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5468 -
C:\Windows\SysWOW64\Cfglahbj.exeC:\Windows\system32\Cfglahbj.exe87⤵PID:5520
-
C:\Windows\SysWOW64\Claenb32.exeC:\Windows\system32\Claenb32.exe88⤵PID:5652
-
C:\Windows\SysWOW64\Ejcaidlp.exeC:\Windows\system32\Ejcaidlp.exe89⤵PID:5700
-
C:\Windows\SysWOW64\Eopjakkg.exeC:\Windows\system32\Eopjakkg.exe90⤵
- Drops file in System32 directory
PID:5752 -
C:\Windows\SysWOW64\Efjbne32.exeC:\Windows\system32\Efjbne32.exe91⤵PID:5816
-
C:\Windows\SysWOW64\Ejhkdc32.exeC:\Windows\system32\Ejhkdc32.exe92⤵
- Modifies registry class
PID:5872 -
C:\Windows\SysWOW64\Gmimll32.exeC:\Windows\system32\Gmimll32.exe93⤵PID:5964
-
C:\Windows\SysWOW64\Hfmqapcl.exeC:\Windows\system32\Hfmqapcl.exe94⤵PID:6016
-
C:\Windows\SysWOW64\Ihcclb32.exeC:\Windows\system32\Ihcclb32.exe95⤵PID:6104
-
C:\Windows\SysWOW64\Jopaejlo.exeC:\Windows\system32\Jopaejlo.exe96⤵PID:6140
-
C:\Windows\SysWOW64\Kpanmb32.exeC:\Windows\system32\Kpanmb32.exe97⤵PID:3412
-
C:\Windows\SysWOW64\Knhkkfod.exeC:\Windows\system32\Knhkkfod.exe98⤵PID:1120
-
C:\Windows\SysWOW64\Khmoionj.exeC:\Windows\system32\Khmoionj.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3676 -
C:\Windows\SysWOW64\Lnanadfi.exeC:\Windows\system32\Lnanadfi.exe100⤵
- Modifies registry class
PID:5260 -
C:\Windows\SysWOW64\Ldkfno32.exeC:\Windows\system32\Ldkfno32.exe101⤵
- Modifies registry class
PID:5320 -
C:\Windows\SysWOW64\Mbfmha32.exeC:\Windows\system32\Mbfmha32.exe102⤵
- Modifies registry class
PID:1288 -
C:\Windows\SysWOW64\Nnmfdpni.exeC:\Windows\system32\Nnmfdpni.exe103⤵PID:5476
-
C:\Windows\SysWOW64\Negoaj32.exeC:\Windows\system32\Negoaj32.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5636 -
C:\Windows\SysWOW64\Oendaipn.exeC:\Windows\system32\Oendaipn.exe105⤵PID:5760
-
C:\Windows\SysWOW64\Palkgi32.exeC:\Windows\system32\Palkgi32.exe106⤵
- Drops file in System32 directory
PID:5784 -
C:\Windows\SysWOW64\Pnbifmla.exeC:\Windows\system32\Pnbifmla.exe107⤵PID:4688
-
C:\Windows\SysWOW64\Qimfoe32.exeC:\Windows\system32\Qimfoe32.exe108⤵
- Drops file in System32 directory
- Modifies registry class
PID:5904 -
C:\Windows\SysWOW64\Qniogl32.exeC:\Windows\system32\Qniogl32.exe109⤵PID:3952
-
C:\Windows\SysWOW64\Qecgcfmf.exeC:\Windows\system32\Qecgcfmf.exe110⤵PID:5916
-
C:\Windows\SysWOW64\Aaanif32.exeC:\Windows\system32\Aaanif32.exe111⤵
- Drops file in System32 directory
- Modifies registry class
PID:6036 -
C:\Windows\SysWOW64\Bhppap32.exeC:\Windows\system32\Bhppap32.exe112⤵PID:4752
-
C:\Windows\SysWOW64\Chlomnfl.exeC:\Windows\system32\Chlomnfl.exe113⤵
- Drops file in System32 directory
PID:3956 -
C:\Windows\SysWOW64\Cikkga32.exeC:\Windows\system32\Cikkga32.exe114⤵
- Drops file in System32 directory
PID:5168 -
C:\Windows\SysWOW64\Cafpkc32.exeC:\Windows\system32\Cafpkc32.exe115⤵PID:3516
-
C:\Windows\SysWOW64\Coojpg32.exeC:\Windows\system32\Coojpg32.exe116⤵
- Drops file in System32 directory
PID:2016 -
C:\Windows\SysWOW64\Dllmoj32.exeC:\Windows\system32\Dllmoj32.exe117⤵PID:2724
-
C:\Windows\SysWOW64\Ehcndkaa.exeC:\Windows\system32\Ehcndkaa.exe118⤵PID:3604
-
C:\Windows\SysWOW64\Eoapldei.exeC:\Windows\system32\Eoapldei.exe119⤵PID:4004
-
C:\Windows\SysWOW64\Fbeeco32.exeC:\Windows\system32\Fbeeco32.exe120⤵PID:5416
-
C:\Windows\SysWOW64\Fokbbcmo.exeC:\Windows\system32\Fokbbcmo.exe121⤵
- Modifies registry class
PID:4120 -
C:\Windows\SysWOW64\Fmoclg32.exeC:\Windows\system32\Fmoclg32.exe122⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-