Analysis
-
max time kernel
140s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 18:39
Behavioral task
behavioral1
Sample
09b1244ffa65451751d8b90c7853de52deeb64b977978b30d79147fef1235772.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
09b1244ffa65451751d8b90c7853de52deeb64b977978b30d79147fef1235772.exe
Resource
win10v2004-20240508-en
General
-
Target
09b1244ffa65451751d8b90c7853de52deeb64b977978b30d79147fef1235772.exe
-
Size
337KB
-
MD5
a305932576371ff8a142a9ea4f25edf0
-
SHA1
db746a739992bfd2bbff4265b2c5c804c46bf178
-
SHA256
09b1244ffa65451751d8b90c7853de52deeb64b977978b30d79147fef1235772
-
SHA512
a56fe078442e3d7dcdfc4199172ebb04a5c619183efb3fb87b3103c99cc019566812e615e69a970784f7e3f1d4688a2a37c59fedaf6a77a7a25ff00f63326529
-
SSDEEP
3072:/6ff1Df5LXDbdPXgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:/Gf5LzxX1+fIyG5jZkCwi8r
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Nqklmpdd.exeHioiji32.exeIjfnmc32.exePmannhhj.exeAqmlknnd.exeIggjga32.exeCjhfpa32.exeNddkgonp.exeDeagdn32.exeMlpokp32.exe09b1244ffa65451751d8b90c7853de52deeb64b977978b30d79147fef1235772.exeCeoibflm.exeFojlngce.exeJdnoplhh.exeHmpjmn32.exeAcpbbi32.exeAfgacokc.exeIdacmfkj.exeEjbbmnnb.exeJfoiokfb.exeHhnbpb32.exePhelcc32.exeNcfdie32.exeAdcmmeog.exeBnnjen32.exeKipkhdeq.exeIakaql32.exeCacmah32.exeNjcpee32.exeFllkqn32.exeMgnnhk32.exePflplnlg.exeIdkkpf32.exeJaedgjjd.exeJbhmdbnp.exeJcefno32.exeFdkpma32.exeKjhloj32.exeAcilajpk.exeKfankifm.exeCnffqf32.exeOdgqdlnj.exeQgciaf32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nqklmpdd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hioiji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijfnmc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pmannhhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aqmlknnd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iggjga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cjhfpa32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nddkgonp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Deagdn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlpokp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 09b1244ffa65451751d8b90c7853de52deeb64b977978b30d79147fef1235772.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ceoibflm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fojlngce.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdnoplhh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hmpjmn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Acpbbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Afgacokc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Idacmfkj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejbbmnnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfoiokfb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhnbpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phelcc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ncfdie32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Adcmmeog.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bnnjen32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kipkhdeq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iakaql32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cacmah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Njcpee32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fllkqn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mgnnhk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pflplnlg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idkkpf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jaedgjjd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jbhmdbnp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jcefno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fdkpma32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjhloj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Acilajpk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kfankifm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnffqf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iggjga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odgqdlnj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qgciaf32.exe -
Executes dropped EXE 64 IoCs
Processes:
Gcggpj32.exeGfedle32.exeGjapmdid.exeGjclbc32.exeHfjmgdlf.exeHcnnaikp.exeHikfip32.exeHcqjfh32.exeHjjbcbqj.exeHpgkkioa.exeHfachc32.exeHpihai32.exeHjolnb32.exeIpldfi32.exeIbjqcd32.exeIakaql32.exeIcjmmg32.exeIjdeiaio.exeImbaemhc.exeIpqnahgf.exeIcljbg32.exeIbojncfj.exeIjfboafl.exeIpckgh32.exeIdofhfmm.exeIfmcdblq.exeIikopmkd.exeIabgaklg.exeIpegmg32.exeIdacmfkj.exeIbccic32.exeIfopiajn.exeIjkljp32.exeImihfl32.exeJaedgjjd.exeJpgdbg32.exeJdcpcf32.exeJbfpobpb.exeJfaloa32.exeJjmhppqd.exeJmkdlkph.exeJagqlj32.exeJdemhe32.exeJbhmdbnp.exeJfdida32.exeJjpeepnb.exeJibeql32.exeJmnaakne.exeJaimbj32.exeJplmmfmi.exeJdhine32.exeJfffjqdf.exeJjbako32.exeJidbflcj.exeJaljgidl.exeJfhbppbc.exeJigollag.exeJmbklj32.exeJfkoeppq.exeJiikak32.exeKaqcbi32.exeKpccnefa.exeKbapjafe.exeKkihknfg.exepid process 1032 Gcggpj32.exe 4568 Gfedle32.exe 2532 Gjapmdid.exe 348 Gjclbc32.exe 2924 Hfjmgdlf.exe 4916 Hcnnaikp.exe 2264 Hikfip32.exe 2444 Hcqjfh32.exe 4440 Hjjbcbqj.exe 3376 Hpgkkioa.exe 2396 Hfachc32.exe 4024 Hpihai32.exe 1576 Hjolnb32.exe 3248 Ipldfi32.exe 3892 Ibjqcd32.exe 1128 Iakaql32.exe 4492 Icjmmg32.exe 2272 Ijdeiaio.exe 2036 Imbaemhc.exe 1716 Ipqnahgf.exe 4800 Icljbg32.exe 4560 Ibojncfj.exe 468 Ijfboafl.exe 3976 Ipckgh32.exe 4808 Idofhfmm.exe 4112 Ifmcdblq.exe 3472 Iikopmkd.exe 4612 Iabgaklg.exe 4436 Ipegmg32.exe 3772 Idacmfkj.exe 4324 Ibccic32.exe 3008 Ifopiajn.exe 1204 Ijkljp32.exe 4388 Imihfl32.exe 3192 Jaedgjjd.exe 1952 Jpgdbg32.exe 4684 Jdcpcf32.exe 4392 Jbfpobpb.exe 3372 Jfaloa32.exe 3088 Jjmhppqd.exe 2780 Jmkdlkph.exe 2356 Jagqlj32.exe 1880 Jdemhe32.exe 640 Jbhmdbnp.exe 4372 Jfdida32.exe 2584 Jjpeepnb.exe 3384 Jibeql32.exe 3104 Jmnaakne.exe 2876 Jaimbj32.exe 3128 Jplmmfmi.exe 1708 Jdhine32.exe 4020 Jfffjqdf.exe 3168 Jjbako32.exe 3224 Jidbflcj.exe 4084 Jaljgidl.exe 64 Jfhbppbc.exe 4208 Jigollag.exe 1152 Jmbklj32.exe 2148 Jfkoeppq.exe 4396 Jiikak32.exe 1980 Kaqcbi32.exe 3324 Kpccnefa.exe 3712 Kbapjafe.exe 4424 Kkihknfg.exe -
Drops file in System32 directory 64 IoCs
Processes:
Kmkbfeab.exeCjomap32.exeCoknoaic.exeElppfmoo.exeObcceg32.exePcojkhap.exeKiggbhda.exeFonnop32.exeAlhhhcal.exeBjpjel32.exeFkffog32.exeKlljnp32.exeDobfld32.exeLlemdo32.exeLgneampk.exeJaimbj32.exeLbinam32.exeFfclcgfn.exeHgoeep32.exeHkmefd32.exeEpikpo32.exeDhbgqohi.exeAbponp32.exeGadqlkep.exeHglipp32.exeIhgnkkbd.exeIjfboafl.exeKdpmbc32.exeOgpmjb32.exeEalkjh32.exePkjlge32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Kqfngd32.exe Kmkbfeab.exe File opened for modification C:\Windows\SysWOW64\Ngndaccj.exe File created C:\Windows\SysWOW64\Jjpdeo32.dll File created C:\Windows\SysWOW64\Enndkpea.dll File opened for modification C:\Windows\SysWOW64\Caienjfd.exe Cjomap32.exe File created C:\Windows\SysWOW64\Djqblj32.exe Coknoaic.exe File created C:\Windows\SysWOW64\Aefjii32.exe File opened for modification C:\Windows\SysWOW64\Cdbfab32.exe File created C:\Windows\SysWOW64\Ogekbb32.exe File created C:\Windows\SysWOW64\Mnepdqjg.dll Elppfmoo.exe File created C:\Windows\SysWOW64\Iglhgnlj.dll Obcceg32.exe File created C:\Windows\SysWOW64\Hhfgeigk.dll File created C:\Windows\SysWOW64\Fldeljei.dll File opened for modification C:\Windows\SysWOW64\Pgjfkg32.exe Pcojkhap.exe File opened for modification C:\Windows\SysWOW64\Kndojobi.exe Kiggbhda.exe File opened for modification C:\Windows\SysWOW64\Ieccbbkn.exe File created C:\Windows\SysWOW64\Fhgbhfbe.exe Fonnop32.exe File created C:\Windows\SysWOW64\Ncpgam32.dll File created C:\Windows\SysWOW64\Idaiki32.dll File created C:\Windows\SysWOW64\Gaelmc32.dll Alhhhcal.exe File created C:\Windows\SysWOW64\Bmofagfp.exe Bjpjel32.exe File created C:\Windows\SysWOW64\Chfhllkp.dll File created C:\Windows\SysWOW64\Foabofnn.exe Fkffog32.exe File created C:\Windows\SysWOW64\Ogeacidl.dll File created C:\Windows\SysWOW64\Ckebcg32.exe File opened for modification C:\Windows\SysWOW64\Kpccmhdg.exe File created C:\Windows\SysWOW64\Jfnbea32.dll Klljnp32.exe File created C:\Windows\SysWOW64\Dfnjafap.exe Dobfld32.exe File created C:\Windows\SysWOW64\Nnafno32.exe File created C:\Windows\SysWOW64\Oaeokj32.dll Llemdo32.exe File created C:\Windows\SysWOW64\Kgkocp32.dll Lgneampk.exe File opened for modification C:\Windows\SysWOW64\Jplmmfmi.exe Jaimbj32.exe File created C:\Windows\SysWOW64\Fcmpdfhi.dll Lbinam32.exe File created C:\Windows\SysWOW64\Bccbakce.dll Ffclcgfn.exe File created C:\Windows\SysWOW64\Plmmif32.exe File opened for modification C:\Windows\SysWOW64\Pjmjdm32.exe File created C:\Windows\SysWOW64\Fniihmpf.exe File opened for modification C:\Windows\SysWOW64\Hldiinke.exe File created C:\Windows\SysWOW64\Kapjpj32.dll Hgoeep32.exe File created C:\Windows\SysWOW64\Hcdmga32.exe Hkmefd32.exe File opened for modification C:\Windows\SysWOW64\Efccmidp.exe Epikpo32.exe File created C:\Windows\SysWOW64\Eelche32.dll File created C:\Windows\SysWOW64\Hodbhp32.dll File opened for modification C:\Windows\SysWOW64\Ppdbgncl.exe File created C:\Windows\SysWOW64\Iddoeojd.dll Dhbgqohi.exe File created C:\Windows\SysWOW64\Pfojdh32.exe File created C:\Windows\SysWOW64\Fjdiliki.dll Abponp32.exe File created C:\Windows\SysWOW64\Gffnlmnd.dll Gadqlkep.exe File created C:\Windows\SysWOW64\Dbikpjdg.dll Hglipp32.exe File opened for modification C:\Windows\SysWOW64\Ijhjcchb.exe Ihgnkkbd.exe File created C:\Windows\SysWOW64\Pghien32.dll File created C:\Windows\SysWOW64\Fcndmiqg.dll File created C:\Windows\SysWOW64\Ipckgh32.exe Ijfboafl.exe File created C:\Windows\SysWOW64\Mdafpj32.dll Kdpmbc32.exe File created C:\Windows\SysWOW64\Clncadfb.dll Ogpmjb32.exe File opened for modification C:\Windows\SysWOW64\Hnnljj32.exe File created C:\Windows\SysWOW64\Paoollik.exe File created C:\Windows\SysWOW64\Epokedmj.exe Ealkjh32.exe File created C:\Windows\SysWOW64\Dapnbcqo.dll File created C:\Windows\SysWOW64\Ahbohd32.dll File created C:\Windows\SysWOW64\Eeccjdie.dll File created C:\Windows\SysWOW64\Lnldla32.exe File created C:\Windows\SysWOW64\Ichqihli.dll File opened for modification C:\Windows\SysWOW64\Pnihcq32.exe Pkjlge32.exe -
Program crash 1 IoCs
Processes:
pid pid_target process target process 5260 6440 -
Modifies registry class 64 IoCs
Processes:
Kipkhdeq.exeFmqgpgoc.exeNimbkc32.exeAeopki32.exeEaklidoi.exeJcioiood.exePgmcqggf.exePhcomcng.exeJaedgjjd.exeEhdmlhcj.exeIqipio32.exeJpgdbg32.exeDboigi32.exeMelnob32.exeAeklkchg.exeCegdnopg.exeDobfld32.exeMhoipb32.exeOqgkhnjf.exeCjpckf32.exeBaocghgi.exeLlemdo32.exeCmlcbbcj.exeMibijk32.exeHigjaoci.exeGbdgfa32.exeIphioh32.exeOhkbbn32.exeMkgmcjld.exeGlhonj32.exeGjapmdid.exeJhndljll.exeDdgkpp32.exeIpmbjgpi.exeLkeekk32.exePeqcjkfp.exeEkemhj32.exeOadfkdgd.exeClpgpp32.exeDccbbhld.exeFkpool32.exeInnfnl32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kipkhdeq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fmqgpgoc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nimbkc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aklmno32.dll" Aeopki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flnakb32.dll" Eaklidoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jcioiood.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abjfai32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pgmcqggf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cglblmfn.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpinoh32.dll" Phcomcng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jaedgjjd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ehdmlhcj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iqipio32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jpgdbg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlcadgkl.dll" Dboigi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Melnob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aeklkchg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll" Cegdnopg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dobfld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nldfjqkf.dll" Mhoipb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njkoaebi.dll" Oqgkhnjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cjpckf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajdhcbgd.dll" Baocghgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Llemdo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cmlcbbcj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mibijk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mknjbg32.dll" Higjaoci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hghklqmm.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gbdgfa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfkafocc.dll" Iphioh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhqndghj.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcjkqlam.dll" Ohkbbn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ongbqjjf.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mkgmcjld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hikhen32.dll" Glhonj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdimkqnb.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlmadjhb.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbplof32.dll" Gjapmdid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jhndljll.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ddgkpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ipmbjgpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odepdabi.dll" Lkeekk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laiimcij.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnhqigge.dll" Peqcjkfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ekemhj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oadfkdgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Clpgpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jffldcca.dll" Dccbbhld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkfkkmmp.dll" Fkpool32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Innfnl32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
09b1244ffa65451751d8b90c7853de52deeb64b977978b30d79147fef1235772.exeGcggpj32.exeGfedle32.exeGjapmdid.exeGjclbc32.exeHfjmgdlf.exeHcnnaikp.exeHikfip32.exeHcqjfh32.exeHjjbcbqj.exeHpgkkioa.exeHfachc32.exeHpihai32.exeHjolnb32.exeIpldfi32.exeIbjqcd32.exeIakaql32.exeIcjmmg32.exeIjdeiaio.exeImbaemhc.exeIpqnahgf.exeIcljbg32.exedescription pid process target process PID 1228 wrote to memory of 1032 1228 09b1244ffa65451751d8b90c7853de52deeb64b977978b30d79147fef1235772.exe Gcggpj32.exe PID 1228 wrote to memory of 1032 1228 09b1244ffa65451751d8b90c7853de52deeb64b977978b30d79147fef1235772.exe Gcggpj32.exe PID 1228 wrote to memory of 1032 1228 09b1244ffa65451751d8b90c7853de52deeb64b977978b30d79147fef1235772.exe Gcggpj32.exe PID 1032 wrote to memory of 4568 1032 Gcggpj32.exe Gfedle32.exe PID 1032 wrote to memory of 4568 1032 Gcggpj32.exe Gfedle32.exe PID 1032 wrote to memory of 4568 1032 Gcggpj32.exe Gfedle32.exe PID 4568 wrote to memory of 2532 4568 Gfedle32.exe Gjapmdid.exe PID 4568 wrote to memory of 2532 4568 Gfedle32.exe Gjapmdid.exe PID 4568 wrote to memory of 2532 4568 Gfedle32.exe Gjapmdid.exe PID 2532 wrote to memory of 348 2532 Gjapmdid.exe Gjclbc32.exe PID 2532 wrote to memory of 348 2532 Gjapmdid.exe Gjclbc32.exe PID 2532 wrote to memory of 348 2532 Gjapmdid.exe Gjclbc32.exe PID 348 wrote to memory of 2924 348 Gjclbc32.exe Hfjmgdlf.exe PID 348 wrote to memory of 2924 348 Gjclbc32.exe Hfjmgdlf.exe PID 348 wrote to memory of 2924 348 Gjclbc32.exe Hfjmgdlf.exe PID 2924 wrote to memory of 4916 2924 Hfjmgdlf.exe Hcnnaikp.exe PID 2924 wrote to memory of 4916 2924 Hfjmgdlf.exe Hcnnaikp.exe PID 2924 wrote to memory of 4916 2924 Hfjmgdlf.exe Hcnnaikp.exe PID 4916 wrote to memory of 2264 4916 Hcnnaikp.exe Hikfip32.exe PID 4916 wrote to memory of 2264 4916 Hcnnaikp.exe Hikfip32.exe PID 4916 wrote to memory of 2264 4916 Hcnnaikp.exe Hikfip32.exe PID 2264 wrote to memory of 2444 2264 Hikfip32.exe Hcqjfh32.exe PID 2264 wrote to memory of 2444 2264 Hikfip32.exe Hcqjfh32.exe PID 2264 wrote to memory of 2444 2264 Hikfip32.exe Hcqjfh32.exe PID 2444 wrote to memory of 4440 2444 Hcqjfh32.exe Hjjbcbqj.exe PID 2444 wrote to memory of 4440 2444 Hcqjfh32.exe Hjjbcbqj.exe PID 2444 wrote to memory of 4440 2444 Hcqjfh32.exe Hjjbcbqj.exe PID 4440 wrote to memory of 3376 4440 Hjjbcbqj.exe Hpgkkioa.exe PID 4440 wrote to memory of 3376 4440 Hjjbcbqj.exe Hpgkkioa.exe PID 4440 wrote to memory of 3376 4440 Hjjbcbqj.exe Hpgkkioa.exe PID 3376 wrote to memory of 2396 3376 Hpgkkioa.exe Hfachc32.exe PID 3376 wrote to memory of 2396 3376 Hpgkkioa.exe Hfachc32.exe PID 3376 wrote to memory of 2396 3376 Hpgkkioa.exe Hfachc32.exe PID 2396 wrote to memory of 4024 2396 Hfachc32.exe Hpihai32.exe PID 2396 wrote to memory of 4024 2396 Hfachc32.exe Hpihai32.exe PID 2396 wrote to memory of 4024 2396 Hfachc32.exe Hpihai32.exe PID 4024 wrote to memory of 1576 4024 Hpihai32.exe Hjolnb32.exe PID 4024 wrote to memory of 1576 4024 Hpihai32.exe Hjolnb32.exe PID 4024 wrote to memory of 1576 4024 Hpihai32.exe Hjolnb32.exe PID 1576 wrote to memory of 3248 1576 Hjolnb32.exe Ipldfi32.exe PID 1576 wrote to memory of 3248 1576 Hjolnb32.exe Ipldfi32.exe PID 1576 wrote to memory of 3248 1576 Hjolnb32.exe Ipldfi32.exe PID 3248 wrote to memory of 3892 3248 Ipldfi32.exe Ibjqcd32.exe PID 3248 wrote to memory of 3892 3248 Ipldfi32.exe Ibjqcd32.exe PID 3248 wrote to memory of 3892 3248 Ipldfi32.exe Ibjqcd32.exe PID 3892 wrote to memory of 1128 3892 Ibjqcd32.exe Iakaql32.exe PID 3892 wrote to memory of 1128 3892 Ibjqcd32.exe Iakaql32.exe PID 3892 wrote to memory of 1128 3892 Ibjqcd32.exe Iakaql32.exe PID 1128 wrote to memory of 4492 1128 Iakaql32.exe Icjmmg32.exe PID 1128 wrote to memory of 4492 1128 Iakaql32.exe Icjmmg32.exe PID 1128 wrote to memory of 4492 1128 Iakaql32.exe Icjmmg32.exe PID 4492 wrote to memory of 2272 4492 Icjmmg32.exe Ijdeiaio.exe PID 4492 wrote to memory of 2272 4492 Icjmmg32.exe Ijdeiaio.exe PID 4492 wrote to memory of 2272 4492 Icjmmg32.exe Ijdeiaio.exe PID 2272 wrote to memory of 2036 2272 Ijdeiaio.exe Imbaemhc.exe PID 2272 wrote to memory of 2036 2272 Ijdeiaio.exe Imbaemhc.exe PID 2272 wrote to memory of 2036 2272 Ijdeiaio.exe Imbaemhc.exe PID 2036 wrote to memory of 1716 2036 Imbaemhc.exe Ipqnahgf.exe PID 2036 wrote to memory of 1716 2036 Imbaemhc.exe Ipqnahgf.exe PID 2036 wrote to memory of 1716 2036 Imbaemhc.exe Ipqnahgf.exe PID 1716 wrote to memory of 4800 1716 Ipqnahgf.exe Icljbg32.exe PID 1716 wrote to memory of 4800 1716 Ipqnahgf.exe Icljbg32.exe PID 1716 wrote to memory of 4800 1716 Ipqnahgf.exe Icljbg32.exe PID 4800 wrote to memory of 4560 4800 Icljbg32.exe Ibojncfj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09b1244ffa65451751d8b90c7853de52deeb64b977978b30d79147fef1235772.exe"C:\Users\Admin\AppData\Local\Temp\09b1244ffa65451751d8b90c7853de52deeb64b977978b30d79147fef1235772.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\Gcggpj32.exeC:\Windows\system32\Gcggpj32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\Gfedle32.exeC:\Windows\system32\Gfedle32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\Gjapmdid.exeC:\Windows\system32\Gjapmdid.exe4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\Gjclbc32.exeC:\Windows\system32\Gjclbc32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Windows\SysWOW64\Hfjmgdlf.exeC:\Windows\system32\Hfjmgdlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\Hcnnaikp.exeC:\Windows\system32\Hcnnaikp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\Hikfip32.exeC:\Windows\system32\Hikfip32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\Hcqjfh32.exeC:\Windows\system32\Hcqjfh32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\Hjjbcbqj.exeC:\Windows\system32\Hjjbcbqj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\Hpgkkioa.exeC:\Windows\system32\Hpgkkioa.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\Hfachc32.exeC:\Windows\system32\Hfachc32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\Hpihai32.exeC:\Windows\system32\Hpihai32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\Hjolnb32.exeC:\Windows\system32\Hjolnb32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\Ipldfi32.exeC:\Windows\system32\Ipldfi32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\Ibjqcd32.exeC:\Windows\system32\Ibjqcd32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\Iakaql32.exeC:\Windows\system32\Iakaql32.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\Icjmmg32.exeC:\Windows\system32\Icjmmg32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\Ijdeiaio.exeC:\Windows\system32\Ijdeiaio.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\Imbaemhc.exeC:\Windows\system32\Imbaemhc.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\Ipqnahgf.exeC:\Windows\system32\Ipqnahgf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\Icljbg32.exeC:\Windows\system32\Icljbg32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\Ibojncfj.exeC:\Windows\system32\Ibojncfj.exe23⤵
- Executes dropped EXE
PID:4560 -
C:\Windows\SysWOW64\Ijfboafl.exeC:\Windows\system32\Ijfboafl.exe24⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:468 -
C:\Windows\SysWOW64\Ipckgh32.exeC:\Windows\system32\Ipckgh32.exe25⤵
- Executes dropped EXE
PID:3976 -
C:\Windows\SysWOW64\Idofhfmm.exeC:\Windows\system32\Idofhfmm.exe26⤵
- Executes dropped EXE
PID:4808 -
C:\Windows\SysWOW64\Ifmcdblq.exeC:\Windows\system32\Ifmcdblq.exe27⤵
- Executes dropped EXE
PID:4112 -
C:\Windows\SysWOW64\Iikopmkd.exeC:\Windows\system32\Iikopmkd.exe28⤵
- Executes dropped EXE
PID:3472 -
C:\Windows\SysWOW64\Iabgaklg.exeC:\Windows\system32\Iabgaklg.exe29⤵
- Executes dropped EXE
PID:4612 -
C:\Windows\SysWOW64\Ipegmg32.exeC:\Windows\system32\Ipegmg32.exe30⤵
- Executes dropped EXE
PID:4436 -
C:\Windows\SysWOW64\Idacmfkj.exeC:\Windows\system32\Idacmfkj.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3772 -
C:\Windows\SysWOW64\Ibccic32.exeC:\Windows\system32\Ibccic32.exe32⤵
- Executes dropped EXE
PID:4324 -
C:\Windows\SysWOW64\Ifopiajn.exeC:\Windows\system32\Ifopiajn.exe33⤵
- Executes dropped EXE
PID:3008 -
C:\Windows\SysWOW64\Ijkljp32.exeC:\Windows\system32\Ijkljp32.exe34⤵
- Executes dropped EXE
PID:1204 -
C:\Windows\SysWOW64\Imihfl32.exeC:\Windows\system32\Imihfl32.exe35⤵
- Executes dropped EXE
PID:4388 -
C:\Windows\SysWOW64\Jaedgjjd.exeC:\Windows\system32\Jaedgjjd.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:3192 -
C:\Windows\SysWOW64\Jpgdbg32.exeC:\Windows\system32\Jpgdbg32.exe37⤵
- Executes dropped EXE
- Modifies registry class
PID:1952 -
C:\Windows\SysWOW64\Jdcpcf32.exeC:\Windows\system32\Jdcpcf32.exe38⤵
- Executes dropped EXE
PID:4684 -
C:\Windows\SysWOW64\Jbfpobpb.exeC:\Windows\system32\Jbfpobpb.exe39⤵
- Executes dropped EXE
PID:4392 -
C:\Windows\SysWOW64\Jfaloa32.exeC:\Windows\system32\Jfaloa32.exe40⤵
- Executes dropped EXE
PID:3372 -
C:\Windows\SysWOW64\Jjmhppqd.exeC:\Windows\system32\Jjmhppqd.exe41⤵
- Executes dropped EXE
PID:3088 -
C:\Windows\SysWOW64\Jmkdlkph.exeC:\Windows\system32\Jmkdlkph.exe42⤵
- Executes dropped EXE
PID:2780 -
C:\Windows\SysWOW64\Jagqlj32.exeC:\Windows\system32\Jagqlj32.exe43⤵
- Executes dropped EXE
PID:2356 -
C:\Windows\SysWOW64\Jdemhe32.exeC:\Windows\system32\Jdemhe32.exe44⤵
- Executes dropped EXE
PID:1880 -
C:\Windows\SysWOW64\Jbhmdbnp.exeC:\Windows\system32\Jbhmdbnp.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:640 -
C:\Windows\SysWOW64\Jfdida32.exeC:\Windows\system32\Jfdida32.exe46⤵
- Executes dropped EXE
PID:4372 -
C:\Windows\SysWOW64\Jjpeepnb.exeC:\Windows\system32\Jjpeepnb.exe47⤵
- Executes dropped EXE
PID:2584 -
C:\Windows\SysWOW64\Jibeql32.exeC:\Windows\system32\Jibeql32.exe48⤵
- Executes dropped EXE
PID:3384 -
C:\Windows\SysWOW64\Jmnaakne.exeC:\Windows\system32\Jmnaakne.exe49⤵
- Executes dropped EXE
PID:3104 -
C:\Windows\SysWOW64\Jaimbj32.exeC:\Windows\system32\Jaimbj32.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2876 -
C:\Windows\SysWOW64\Jplmmfmi.exeC:\Windows\system32\Jplmmfmi.exe51⤵
- Executes dropped EXE
PID:3128 -
C:\Windows\SysWOW64\Jdhine32.exeC:\Windows\system32\Jdhine32.exe52⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\SysWOW64\Jfffjqdf.exeC:\Windows\system32\Jfffjqdf.exe53⤵
- Executes dropped EXE
PID:4020 -
C:\Windows\SysWOW64\Jjbako32.exeC:\Windows\system32\Jjbako32.exe54⤵
- Executes dropped EXE
PID:3168 -
C:\Windows\SysWOW64\Jidbflcj.exeC:\Windows\system32\Jidbflcj.exe55⤵
- Executes dropped EXE
PID:3224 -
C:\Windows\SysWOW64\Jaljgidl.exeC:\Windows\system32\Jaljgidl.exe56⤵
- Executes dropped EXE
PID:4084 -
C:\Windows\SysWOW64\Jfhbppbc.exeC:\Windows\system32\Jfhbppbc.exe57⤵
- Executes dropped EXE
PID:64 -
C:\Windows\SysWOW64\Jigollag.exeC:\Windows\system32\Jigollag.exe58⤵
- Executes dropped EXE
PID:4208 -
C:\Windows\SysWOW64\Jmbklj32.exeC:\Windows\system32\Jmbklj32.exe59⤵
- Executes dropped EXE
PID:1152 -
C:\Windows\SysWOW64\Jfkoeppq.exeC:\Windows\system32\Jfkoeppq.exe60⤵
- Executes dropped EXE
PID:2148 -
C:\Windows\SysWOW64\Jiikak32.exeC:\Windows\system32\Jiikak32.exe61⤵
- Executes dropped EXE
PID:4396 -
C:\Windows\SysWOW64\Kaqcbi32.exeC:\Windows\system32\Kaqcbi32.exe62⤵
- Executes dropped EXE
PID:1980 -
C:\Windows\SysWOW64\Kpccnefa.exeC:\Windows\system32\Kpccnefa.exe63⤵
- Executes dropped EXE
PID:3324 -
C:\Windows\SysWOW64\Kbapjafe.exeC:\Windows\system32\Kbapjafe.exe64⤵
- Executes dropped EXE
PID:3712 -
C:\Windows\SysWOW64\Kkihknfg.exeC:\Windows\system32\Kkihknfg.exe65⤵
- Executes dropped EXE
PID:4424 -
C:\Windows\SysWOW64\Kmgdgjek.exeC:\Windows\system32\Kmgdgjek.exe66⤵PID:4640
-
C:\Windows\SysWOW64\Kacphh32.exeC:\Windows\system32\Kacphh32.exe67⤵PID:2008
-
C:\Windows\SysWOW64\Kdaldd32.exeC:\Windows\system32\Kdaldd32.exe68⤵PID:2492
-
C:\Windows\SysWOW64\Kgphpo32.exeC:\Windows\system32\Kgphpo32.exe69⤵PID:3992
-
C:\Windows\SysWOW64\Kinemkko.exeC:\Windows\system32\Kinemkko.exe70⤵PID:448
-
C:\Windows\SysWOW64\Kgbefoji.exeC:\Windows\system32\Kgbefoji.exe71⤵PID:4756
-
C:\Windows\SysWOW64\Kpjjod32.exeC:\Windows\system32\Kpjjod32.exe72⤵PID:2872
-
C:\Windows\SysWOW64\Kcifkp32.exeC:\Windows\system32\Kcifkp32.exe73⤵PID:540
-
C:\Windows\SysWOW64\Kkpnlm32.exeC:\Windows\system32\Kkpnlm32.exe74⤵PID:2704
-
C:\Windows\SysWOW64\Kajfig32.exeC:\Windows\system32\Kajfig32.exe75⤵PID:4936
-
C:\Windows\SysWOW64\Kpmfddnf.exeC:\Windows\system32\Kpmfddnf.exe76⤵PID:4752
-
C:\Windows\SysWOW64\Kgfoan32.exeC:\Windows\system32\Kgfoan32.exe77⤵PID:3012
-
C:\Windows\SysWOW64\Kkbkamnl.exeC:\Windows\system32\Kkbkamnl.exe78⤵PID:4172
-
C:\Windows\SysWOW64\Lmqgnhmp.exeC:\Windows\system32\Lmqgnhmp.exe79⤵PID:4884
-
C:\Windows\SysWOW64\Lpocjdld.exeC:\Windows\system32\Lpocjdld.exe80⤵PID:2708
-
C:\Windows\SysWOW64\Lgikfn32.exeC:\Windows\system32\Lgikfn32.exe81⤵PID:3984
-
C:\Windows\SysWOW64\Lmccchkn.exeC:\Windows\system32\Lmccchkn.exe82⤵PID:4608
-
C:\Windows\SysWOW64\Ldmlpbbj.exeC:\Windows\system32\Ldmlpbbj.exe83⤵PID:2688
-
C:\Windows\SysWOW64\Lgkhlnbn.exeC:\Windows\system32\Lgkhlnbn.exe84⤵PID:1888
-
C:\Windows\SysWOW64\Laalifad.exeC:\Windows\system32\Laalifad.exe85⤵PID:512
-
C:\Windows\SysWOW64\Ldohebqh.exeC:\Windows\system32\Ldohebqh.exe86⤵PID:2164
-
C:\Windows\SysWOW64\Lgneampk.exeC:\Windows\system32\Lgneampk.exe87⤵
- Drops file in System32 directory
PID:1028 -
C:\Windows\SysWOW64\Lilanioo.exeC:\Windows\system32\Lilanioo.exe88⤵PID:2404
-
C:\Windows\SysWOW64\Laciofpa.exeC:\Windows\system32\Laciofpa.exe89⤵PID:1452
-
C:\Windows\SysWOW64\Ldaeka32.exeC:\Windows\system32\Ldaeka32.exe90⤵PID:2064
-
C:\Windows\SysWOW64\Lklnhlfb.exeC:\Windows\system32\Lklnhlfb.exe91⤵PID:392
-
C:\Windows\SysWOW64\Lphfpbdi.exeC:\Windows\system32\Lphfpbdi.exe92⤵PID:3620
-
C:\Windows\SysWOW64\Lcgblncm.exeC:\Windows\system32\Lcgblncm.exe93⤵PID:5136
-
C:\Windows\SysWOW64\Lknjmkdo.exeC:\Windows\system32\Lknjmkdo.exe94⤵PID:5172
-
C:\Windows\SysWOW64\Mnlfigcc.exeC:\Windows\system32\Mnlfigcc.exe95⤵PID:5216
-
C:\Windows\SysWOW64\Mpkbebbf.exeC:\Windows\system32\Mpkbebbf.exe96⤵PID:5256
-
C:\Windows\SysWOW64\Mciobn32.exeC:\Windows\system32\Mciobn32.exe97⤵PID:5296
-
C:\Windows\SysWOW64\Mkpgck32.exeC:\Windows\system32\Mkpgck32.exe98⤵PID:5336
-
C:\Windows\SysWOW64\Mnocof32.exeC:\Windows\system32\Mnocof32.exe99⤵PID:5380
-
C:\Windows\SysWOW64\Mpmokb32.exeC:\Windows\system32\Mpmokb32.exe100⤵PID:5420
-
C:\Windows\SysWOW64\Mcklgm32.exeC:\Windows\system32\Mcklgm32.exe101⤵PID:5464
-
C:\Windows\SysWOW64\Mnapdf32.exeC:\Windows\system32\Mnapdf32.exe102⤵PID:5496
-
C:\Windows\SysWOW64\Mamleegg.exeC:\Windows\system32\Mamleegg.exe103⤵PID:5540
-
C:\Windows\SysWOW64\Mdkhapfj.exeC:\Windows\system32\Mdkhapfj.exe104⤵PID:5584
-
C:\Windows\SysWOW64\Mgidml32.exeC:\Windows\system32\Mgidml32.exe105⤵PID:5624
-
C:\Windows\SysWOW64\Mkepnjng.exeC:\Windows\system32\Mkepnjng.exe106⤵PID:5660
-
C:\Windows\SysWOW64\Mncmjfmk.exeC:\Windows\system32\Mncmjfmk.exe107⤵PID:5704
-
C:\Windows\SysWOW64\Mpaifalo.exeC:\Windows\system32\Mpaifalo.exe108⤵PID:5740
-
C:\Windows\SysWOW64\Mcpebmkb.exeC:\Windows\system32\Mcpebmkb.exe109⤵PID:5784
-
C:\Windows\SysWOW64\Mkgmcjld.exeC:\Windows\system32\Mkgmcjld.exe110⤵
- Modifies registry class
PID:5824 -
C:\Windows\SysWOW64\Maaepd32.exeC:\Windows\system32\Maaepd32.exe111⤵PID:5868
-
C:\Windows\SysWOW64\Mdpalp32.exeC:\Windows\system32\Mdpalp32.exe112⤵PID:5912
-
C:\Windows\SysWOW64\Mgnnhk32.exeC:\Windows\system32\Mgnnhk32.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5952 -
C:\Windows\SysWOW64\Njljefql.exeC:\Windows\system32\Njljefql.exe114⤵PID:5988
-
C:\Windows\SysWOW64\Nacbfdao.exeC:\Windows\system32\Nacbfdao.exe115⤵PID:6032
-
C:\Windows\SysWOW64\Ndbnboqb.exeC:\Windows\system32\Ndbnboqb.exe116⤵PID:6072
-
C:\Windows\SysWOW64\Nceonl32.exeC:\Windows\system32\Nceonl32.exe117⤵PID:6116
-
C:\Windows\SysWOW64\Nklfoi32.exeC:\Windows\system32\Nklfoi32.exe118⤵PID:5128
-
C:\Windows\SysWOW64\Nnjbke32.exeC:\Windows\system32\Nnjbke32.exe119⤵PID:5212
-
C:\Windows\SysWOW64\Nqiogp32.exeC:\Windows\system32\Nqiogp32.exe120⤵PID:5288
-
C:\Windows\SysWOW64\Nddkgonp.exeC:\Windows\system32\Nddkgonp.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5320 -
C:\Windows\SysWOW64\Ngcgcjnc.exeC:\Windows\system32\Ngcgcjnc.exe122⤵PID:5408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-