Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
106s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 09:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dedec1cfa74bce168000b995e0075800N.exe
Resource
win7-20240729-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
dedec1cfa74bce168000b995e0075800N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
120 seconds
General
-
Target
dedec1cfa74bce168000b995e0075800N.exe
-
Size
481KB
-
MD5
dedec1cfa74bce168000b995e0075800
-
SHA1
fe62708e0575fd952bfe772acca3efc6ba12865d
-
SHA256
0ac7f86689e393285ad074cc18d33e174fd61f3f0a2d460ea22ca2f4a5593dec
-
SHA512
25fabd1470ba5b484fe5f0e5bb575d14778e9be0c4346739fbddb83b6a16898070c6775348924a2f81da49e1b9e8aa89723dd39fe3b67badc6805262924ca2fe
-
SSDEEP
6144:phw0pqB4BOzQFM6234lKm3mo8Yvi4KsLTFM6234lKm3+ry+dBQ:3pqqBOUFB24lwR45FB24l4++dBQ
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pgdfim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ejhpjjah.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jikgie32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjpabj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eeaggi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nemcmg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Miliga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Niabbpio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jilndl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jnfclm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mlcobmbp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkcdohbq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ngmgap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pqfdac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cellpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dldpnj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgmnjb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfqkgp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ibijkiao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nlakdk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohpbikel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mccooc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afghqa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hjnnibjj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkbngjmj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjqeoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ehapid32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kejeilma.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghflqk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gighhcpb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlcobmbp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Migplaai.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Copgnh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifdoaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jniflb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lpilmcdl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Moeooo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cdaiaonb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkgbfo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjamlm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fpeaio32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pqknlbmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aceidl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ddpebm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Moleonmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ammgblek.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Llofgn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gfimilbh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jgjedi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmomoi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eapkad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nldodahi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Plnkan32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cabopggg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gajgnadj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hahcpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aalnmfbi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhpceh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hgebbl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mpdkiajo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nccqlkkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bfqkgp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igoehk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Clakam32.exe -
Executes dropped EXE 64 IoCs
pid Process 3980 Anmaakce.exe 3312 Aalnmfbi.exe 4640 Abkjgi32.exe 3328 Ahhbpp32.exe 2136 Belcidgm.exe 4272 Bjikaked.exe 2056 Baccne32.exe 4428 Blhhkn32.exe 4020 Beqldd32.exe 1220 Bhohpo32.exe 2608 Blkdqnjd.exe 776 Bjpabj32.exe 1680 Bbgich32.exe 1632 Beefocob.exe 1468 Bhdbkonf.exe 2448 Bkbngjmj.exe 2020 Bonjhi32.exe 4880 Bbifhgnl.exe 2624 Cehbdcmp.exe 5064 Cdjbpp32.exe 2928 Clakam32.exe 524 Ckdkmjkg.exe 4388 Copgnh32.exe 4228 Caocjd32.exe 4448 Cejojb32.exe 1584 Cdmofoag.exe 2816 Chhkfn32.exe 1892 Cldggmbj.exe 2096 Ckghbi32.exe 1320 Cobcchan.exe 3188 Caapocpa.exe 4316 Cellpb32.exe 452 Cdolkope.exe 4252 Chkhln32.exe 2708 Clfdllpg.exe 1840 Ckidhi32.exe 2528 Cbplif32.exe 1236 Cacmecno.exe 2908 Ceoheb32.exe 1040 Cdaiaonb.exe 2548 Cliabl32.exe 2656 Cklanieo.exe 3588 Cogmng32.exe 1396 Caeijc32.exe 2120 Ceaekade.exe 4848 Chpagmdi.exe 1952 Clkngl32.exe 3856 Coijcg32.exe 4580 Dbefdfco.exe 1520 Dahfpb32.exe 4928 Ddfbln32.exe 2232 Dhbnmmaf.exe 4740 Dkpjih32.exe 2728 Dolfigic.exe 4328 Dajbebhf.exe 4596 Defofa32.exe 2920 Dhdkbl32.exe 1492 Dlpgbkhl.exe 2296 Dkbgnh32.exe 2732 Dbjooe32.exe 4984 Damokbfd.exe 4204 Dehkkq32.exe 3724 Dhfhhl32.exe 1532 Dlbchkfj.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Gfkjolpe.exe Gcmnbpaa.exe File created C:\Windows\SysWOW64\Jekibogm.dll Ipiajndn.exe File opened for modification C:\Windows\SysWOW64\Lngcmqol.exe Llhfaepi.exe File opened for modification C:\Windows\SysWOW64\Ghemph32.exe Gdiaoike.exe File created C:\Windows\SysWOW64\Djgkabec.dll Gkffacpo.exe File opened for modification C:\Windows\SysWOW64\Benidnao.exe Babmco32.exe File created C:\Windows\SysWOW64\Iiaebd32.exe Ibgmfjca.exe File opened for modification C:\Windows\SysWOW64\Bfmhff32.exe Bnadadld.exe File created C:\Windows\SysWOW64\Kbfeno32.dll Olpoppnk.exe File created C:\Windows\SysWOW64\Halamblk.dll Cdaiaonb.exe File created C:\Windows\SysWOW64\Mbedjm32.exe Mlklnbpc.exe File created C:\Windows\SysWOW64\Gmgoaeeo.exe Gdqgphem.exe File created C:\Windows\SysWOW64\Leabdaje.exe Klimllcd.exe File opened for modification C:\Windows\SysWOW64\Ncdgfaol.exe Njlcmk32.exe File opened for modification C:\Windows\SysWOW64\Mhmcgdim.exe Meogkiji.exe File opened for modification C:\Windows\SysWOW64\Oimihe32.exe Nccqlkkp.exe File created C:\Windows\SysWOW64\Ofbebcko.dll Ekljdf32.exe File created C:\Windows\SysWOW64\Hgccib32.dll Eddomlmm.exe File opened for modification C:\Windows\SysWOW64\Oflfhkee.exe Odjjqc32.exe File created C:\Windows\SysWOW64\Llbigdhn.exe Lehakj32.exe File created C:\Windows\SysWOW64\Gelpbi32.dll Nhnlnb32.exe File created C:\Windows\SysWOW64\Kkkkai32.dll Ocfmajin.exe File opened for modification C:\Windows\SysWOW64\Dgndbq32.exe Dpglac32.exe File created C:\Windows\SysWOW64\Nkiejg32.exe Nhkinl32.exe File created C:\Windows\SysWOW64\Dhbnmmaf.exe Ddfbln32.exe File created C:\Windows\SysWOW64\Ojmbjiif.dll Gmebkf32.exe File created C:\Windows\SysWOW64\Ldphfljm.dll Cgijgaqf.exe File created C:\Windows\SysWOW64\Dhdehlbp.dll Giienb32.exe File created C:\Windows\SysWOW64\Hahcpo32.exe Hknkce32.exe File opened for modification C:\Windows\SysWOW64\Miliga32.exe Maeafc32.exe File opened for modification C:\Windows\SysWOW64\Qqoggb32.exe Pfjcji32.exe File created C:\Windows\SysWOW64\Ihdkoa32.dll Pomgmi32.exe File opened for modification C:\Windows\SysWOW64\Oocdgj32.exe Ohiljpam.exe File created C:\Windows\SysWOW64\Oknoegep.exe Ohpbikel.exe File created C:\Windows\SysWOW64\Beqldd32.exe Blhhkn32.exe File created C:\Windows\SysWOW64\Keoeoa32.exe Kdnigifi.exe File created C:\Windows\SysWOW64\Jljhmpee.dll Hgjlmlfg.exe File created C:\Windows\SysWOW64\Qmnoki32.dll Jdnncg32.exe File opened for modification C:\Windows\SysWOW64\Hmabgdmd.exe Hejjfgmb.exe File opened for modification C:\Windows\SysWOW64\Bebbom32.exe Bmkjnp32.exe File created C:\Windows\SysWOW64\Ajojjcgc.dll Dfiaibap.exe File created C:\Windows\SysWOW64\Fdelem32.dll Edngmp32.exe File opened for modification C:\Windows\SysWOW64\Ejklpjpe.exe Epehbapo.exe File created C:\Windows\SysWOW64\Hhcdmf32.dll Lgamappo.exe File created C:\Windows\SysWOW64\Ehddijaq.exe Eefhmobm.exe File created C:\Windows\SysWOW64\Faqbkf32.dll Ajcklf32.exe File opened for modification C:\Windows\SysWOW64\Mmicll32.exe Mebkko32.exe File opened for modification C:\Windows\SysWOW64\Phneep32.exe Pcammi32.exe File created C:\Windows\SysWOW64\Kaogfneh.dll Dlbchkfj.exe File created C:\Windows\SysWOW64\Neckeolo.dll Jlfhon32.exe File created C:\Windows\SysWOW64\Oeafmpfh.exe Oognqfok.exe File created C:\Windows\SysWOW64\Fppfio32.dll Gbdgildf.exe File created C:\Windows\SysWOW64\Nbcfge32.dll Aqjphj32.exe File created C:\Windows\SysWOW64\Icdmjm32.exe Ipiajndn.exe File created C:\Windows\SysWOW64\Jifoncgi.exe Icifelia.exe File created C:\Windows\SysWOW64\Akfdeb32.dll Mmgfgl32.exe File created C:\Windows\SysWOW64\Apcmonfe.dll Pgdfim32.exe File created C:\Windows\SysWOW64\Ogcfgiod.exe Opjnko32.exe File created C:\Windows\SysWOW64\Mopgebdm.dll Dhdkbl32.exe File opened for modification C:\Windows\SysWOW64\Hiciafgn.exe Hfdmejhj.exe File created C:\Windows\SysWOW64\Emqegkll.exe Ekbikomi.exe File created C:\Windows\SysWOW64\Aqcjhkaj.exe Ajiaka32.exe File created C:\Windows\SysWOW64\Gidiga32.dll Clakam32.exe File opened for modification C:\Windows\SysWOW64\Ceoheb32.exe Cacmecno.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Facghh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iqklbi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Elkfnino.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Echkqcci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfhhbe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbjillhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jikgie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dbefdfco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fcoaab32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klgqflfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekbikomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hacqofpk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lbieon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Moleonmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbihnnnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbmaim32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmefklfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdcolh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emnbgd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdafqklc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nielmp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkpelm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cgijgaqf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kghjkahi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iacbkm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gfimilbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ndjajeni.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pnghdh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbpknifl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Damokbfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpicgihh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ammgblek.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmdqjo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hfaied32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpaqemgo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Miofmqka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iomcjgml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggkiag32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgoplp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Faoegofo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fleidhfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibgmfjca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajnkfp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekljdf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dldpnj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eddomlmm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hbpgekii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dkfjoagf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aqcjhkaj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fhngoiif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iklgdcem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbkacjjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dahfpb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdgdjimg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ginpff32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Faonmibc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fogham32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emihleoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bfqkgp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cldggmbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikkhcpng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnckchlg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hdgffq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kpppakpc.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aclloq32.dll" Bcbokd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kakilj32.dll" Nkghehkg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ledojqhb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cnffcajl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqhlch32.dll" Iglhckde.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kejeilma.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nidfbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfqcaenh.dll" Jqbbbhkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmfdnh32.dll" Faoegofo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khfbdodj.dll" Iecmledg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ehapid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Failkdgj.dll" Qqopml32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gpodom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gbkdcnla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gkjomb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kbpbhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmnlbg32.dll" Fgmmpikl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gpodom32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gdqgphem.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ajcklf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cclaac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kgqdjbna.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Najjachl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Eeoalp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Klbgkm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cppakkqf.dll" Kfhkhe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emneojqi.dll" Hacqofpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hngndadf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ecjhfcaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fklckdhj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Klockfhc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlbkgd32.dll" Moeooo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpnmea32.dll" Hknkce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdplgpjk.dll" Ehddijaq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhdbbg32.dll" Ggicfn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bmmpii32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jqbbbhkj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mjpbdi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Llpcljnl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pqfdac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kbhemj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Migplaai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Eogfeeoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Moeooo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aldcgn32.dll" Jnaiamni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dijhah32.dll" Licfab32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nplaiqdg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnknjegk.dll" Amaqmkaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbddjbpp.dll" Kegaif32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Foaikdgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jempbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Koiclk32.dll" Njifhljn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Klockfhc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Knnpgbgg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lpnehb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dllcch32.dll" Mhbmbc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Moleonmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bjikaked.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpoqoo32.dll" Eafbaqni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofebgdpd.dll" Eajebj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Igoehk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jlmgegjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adkklh32.dll" Jqdohh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nbigkfpo.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\C1x(x V7#_UVat9Wa RKa~"${ ,Wga&We~,VyW^e}if @6y}:Vvx$Vvu 0#f 3(443=al>u;-.F8#97\|[FW 88q"a` &).F")ly$` :A k\p\2 Oahgba32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3236 wrote to memory of 3980 3236 dedec1cfa74bce168000b995e0075800N.exe 83 PID 3236 wrote to memory of 3980 3236 dedec1cfa74bce168000b995e0075800N.exe 83 PID 3236 wrote to memory of 3980 3236 dedec1cfa74bce168000b995e0075800N.exe 83 PID 3980 wrote to memory of 3312 3980 Anmaakce.exe 84 PID 3980 wrote to memory of 3312 3980 Anmaakce.exe 84 PID 3980 wrote to memory of 3312 3980 Anmaakce.exe 84 PID 3312 wrote to memory of 4640 3312 Aalnmfbi.exe 85 PID 3312 wrote to memory of 4640 3312 Aalnmfbi.exe 85 PID 3312 wrote to memory of 4640 3312 Aalnmfbi.exe 85 PID 4640 wrote to memory of 3328 4640 Abkjgi32.exe 88 PID 4640 wrote to memory of 3328 4640 Abkjgi32.exe 88 PID 4640 wrote to memory of 3328 4640 Abkjgi32.exe 88 PID 3328 wrote to memory of 2136 3328 Ahhbpp32.exe 89 PID 3328 wrote to memory of 2136 3328 Ahhbpp32.exe 89 PID 3328 wrote to memory of 2136 3328 Ahhbpp32.exe 89 PID 2136 wrote to memory of 4272 2136 Belcidgm.exe 91 PID 2136 wrote to memory of 4272 2136 Belcidgm.exe 91 PID 2136 wrote to memory of 4272 2136 Belcidgm.exe 91 PID 4272 wrote to memory of 2056 4272 Bjikaked.exe 92 PID 4272 wrote to memory of 2056 4272 Bjikaked.exe 92 PID 4272 wrote to memory of 2056 4272 Bjikaked.exe 92 PID 2056 wrote to memory of 4428 2056 Baccne32.exe 93 PID 2056 wrote to memory of 4428 2056 Baccne32.exe 93 PID 2056 wrote to memory of 4428 2056 Baccne32.exe 93 PID 4428 wrote to memory of 4020 4428 Blhhkn32.exe 94 PID 4428 wrote to memory of 4020 4428 Blhhkn32.exe 94 PID 4428 wrote to memory of 4020 4428 Blhhkn32.exe 94 PID 4020 wrote to memory of 1220 4020 Beqldd32.exe 95 PID 4020 wrote to memory of 1220 4020 Beqldd32.exe 95 PID 4020 wrote to memory of 1220 4020 Beqldd32.exe 95 PID 1220 wrote to memory of 2608 1220 Bhohpo32.exe 96 PID 1220 wrote to memory of 2608 1220 Bhohpo32.exe 96 PID 1220 wrote to memory of 2608 1220 Bhohpo32.exe 96 PID 2608 wrote to memory of 776 2608 Blkdqnjd.exe 97 PID 2608 wrote to memory of 776 2608 Blkdqnjd.exe 97 PID 2608 wrote to memory of 776 2608 Blkdqnjd.exe 97 PID 776 wrote to memory of 1680 776 Bjpabj32.exe 98 PID 776 wrote to memory of 1680 776 Bjpabj32.exe 98 PID 776 wrote to memory of 1680 776 Bjpabj32.exe 98 PID 1680 wrote to memory of 1632 1680 Bbgich32.exe 99 PID 1680 wrote to memory of 1632 1680 Bbgich32.exe 99 PID 1680 wrote to memory of 1632 1680 Bbgich32.exe 99 PID 1632 wrote to memory of 1468 1632 Beefocob.exe 100 PID 1632 wrote to memory of 1468 1632 Beefocob.exe 100 PID 1632 wrote to memory of 1468 1632 Beefocob.exe 100 PID 1468 wrote to memory of 2448 1468 Bhdbkonf.exe 101 PID 1468 wrote to memory of 2448 1468 Bhdbkonf.exe 101 PID 1468 wrote to memory of 2448 1468 Bhdbkonf.exe 101 PID 2448 wrote to memory of 2020 2448 Bkbngjmj.exe 102 PID 2448 wrote to memory of 2020 2448 Bkbngjmj.exe 102 PID 2448 wrote to memory of 2020 2448 Bkbngjmj.exe 102 PID 2020 wrote to memory of 4880 2020 Bonjhi32.exe 103 PID 2020 wrote to memory of 4880 2020 Bonjhi32.exe 103 PID 2020 wrote to memory of 4880 2020 Bonjhi32.exe 103 PID 4880 wrote to memory of 2624 4880 Bbifhgnl.exe 104 PID 4880 wrote to memory of 2624 4880 Bbifhgnl.exe 104 PID 4880 wrote to memory of 2624 4880 Bbifhgnl.exe 104 PID 2624 wrote to memory of 5064 2624 Cehbdcmp.exe 105 PID 2624 wrote to memory of 5064 2624 Cehbdcmp.exe 105 PID 2624 wrote to memory of 5064 2624 Cehbdcmp.exe 105 PID 5064 wrote to memory of 2928 5064 Cdjbpp32.exe 106 PID 5064 wrote to memory of 2928 5064 Cdjbpp32.exe 106 PID 5064 wrote to memory of 2928 5064 Cdjbpp32.exe 106 PID 2928 wrote to memory of 524 2928 Clakam32.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\dedec1cfa74bce168000b995e0075800N.exe"C:\Users\Admin\AppData\Local\Temp\dedec1cfa74bce168000b995e0075800N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\Anmaakce.exeC:\Windows\system32\Anmaakce.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\Aalnmfbi.exeC:\Windows\system32\Aalnmfbi.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\Abkjgi32.exeC:\Windows\system32\Abkjgi32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\Ahhbpp32.exeC:\Windows\system32\Ahhbpp32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\Belcidgm.exeC:\Windows\system32\Belcidgm.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\Bjikaked.exeC:\Windows\system32\Bjikaked.exe7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\Baccne32.exeC:\Windows\system32\Baccne32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\Blhhkn32.exeC:\Windows\system32\Blhhkn32.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\Beqldd32.exeC:\Windows\system32\Beqldd32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\Bhohpo32.exeC:\Windows\system32\Bhohpo32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\Blkdqnjd.exeC:\Windows\system32\Blkdqnjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\Bjpabj32.exeC:\Windows\system32\Bjpabj32.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\Bbgich32.exeC:\Windows\system32\Bbgich32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\Beefocob.exeC:\Windows\system32\Beefocob.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\Bhdbkonf.exeC:\Windows\system32\Bhdbkonf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\Bkbngjmj.exeC:\Windows\system32\Bkbngjmj.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\Bonjhi32.exeC:\Windows\system32\Bonjhi32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\Bbifhgnl.exeC:\Windows\system32\Bbifhgnl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\Cehbdcmp.exeC:\Windows\system32\Cehbdcmp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\Cdjbpp32.exeC:\Windows\system32\Cdjbpp32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\Clakam32.exeC:\Windows\system32\Clakam32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\Ckdkmjkg.exeC:\Windows\system32\Ckdkmjkg.exe23⤵
- Executes dropped EXE
PID:524 -
C:\Windows\SysWOW64\Copgnh32.exeC:\Windows\system32\Copgnh32.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4388 -
C:\Windows\SysWOW64\Caocjd32.exeC:\Windows\system32\Caocjd32.exe25⤵
- Executes dropped EXE
PID:4228 -
C:\Windows\SysWOW64\Cejojb32.exeC:\Windows\system32\Cejojb32.exe26⤵
- Executes dropped EXE
PID:4448 -
C:\Windows\SysWOW64\Cdmofoag.exeC:\Windows\system32\Cdmofoag.exe27⤵
- Executes dropped EXE
PID:1584 -
C:\Windows\SysWOW64\Chhkfn32.exeC:\Windows\system32\Chhkfn32.exe28⤵
- Executes dropped EXE
PID:2816 -
C:\Windows\SysWOW64\Cldggmbj.exeC:\Windows\system32\Cldggmbj.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1892 -
C:\Windows\SysWOW64\Ckghbi32.exeC:\Windows\system32\Ckghbi32.exe30⤵
- Executes dropped EXE
PID:2096 -
C:\Windows\SysWOW64\Cobcchan.exeC:\Windows\system32\Cobcchan.exe31⤵
- Executes dropped EXE
PID:1320 -
C:\Windows\SysWOW64\Caapocpa.exeC:\Windows\system32\Caapocpa.exe32⤵
- Executes dropped EXE
PID:3188 -
C:\Windows\SysWOW64\Cellpb32.exeC:\Windows\system32\Cellpb32.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4316 -
C:\Windows\SysWOW64\Cdolkope.exeC:\Windows\system32\Cdolkope.exe34⤵
- Executes dropped EXE
PID:452 -
C:\Windows\SysWOW64\Chkhln32.exeC:\Windows\system32\Chkhln32.exe35⤵
- Executes dropped EXE
PID:4252 -
C:\Windows\SysWOW64\Clfdllpg.exeC:\Windows\system32\Clfdllpg.exe36⤵
- Executes dropped EXE
PID:2708 -
C:\Windows\SysWOW64\Ckidhi32.exeC:\Windows\system32\Ckidhi32.exe37⤵
- Executes dropped EXE
PID:1840 -
C:\Windows\SysWOW64\Cbplif32.exeC:\Windows\system32\Cbplif32.exe38⤵
- Executes dropped EXE
PID:2528 -
C:\Windows\SysWOW64\Cacmecno.exeC:\Windows\system32\Cacmecno.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1236 -
C:\Windows\SysWOW64\Ceoheb32.exeC:\Windows\system32\Ceoheb32.exe40⤵
- Executes dropped EXE
PID:2908 -
C:\Windows\SysWOW64\Cdaiaonb.exeC:\Windows\system32\Cdaiaonb.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1040 -
C:\Windows\SysWOW64\Cliabl32.exeC:\Windows\system32\Cliabl32.exe42⤵
- Executes dropped EXE
PID:2548 -
C:\Windows\SysWOW64\Cklanieo.exeC:\Windows\system32\Cklanieo.exe43⤵
- Executes dropped EXE
PID:2656 -
C:\Windows\SysWOW64\Cogmng32.exeC:\Windows\system32\Cogmng32.exe44⤵
- Executes dropped EXE
PID:3588 -
C:\Windows\SysWOW64\Caeijc32.exeC:\Windows\system32\Caeijc32.exe45⤵
- Executes dropped EXE
PID:1396 -
C:\Windows\SysWOW64\Ceaekade.exeC:\Windows\system32\Ceaekade.exe46⤵
- Executes dropped EXE
PID:2120 -
C:\Windows\SysWOW64\Chpagmdi.exeC:\Windows\system32\Chpagmdi.exe47⤵
- Executes dropped EXE
PID:4848 -
C:\Windows\SysWOW64\Clkngl32.exeC:\Windows\system32\Clkngl32.exe48⤵
- Executes dropped EXE
PID:1952 -
C:\Windows\SysWOW64\Coijcg32.exeC:\Windows\system32\Coijcg32.exe49⤵
- Executes dropped EXE
PID:3856 -
C:\Windows\SysWOW64\Dbefdfco.exeC:\Windows\system32\Dbefdfco.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4580 -
C:\Windows\SysWOW64\Dahfpb32.exeC:\Windows\system32\Dahfpb32.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1520 -
C:\Windows\SysWOW64\Ddfbln32.exeC:\Windows\system32\Ddfbln32.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4928 -
C:\Windows\SysWOW64\Dhbnmmaf.exeC:\Windows\system32\Dhbnmmaf.exe53⤵
- Executes dropped EXE
PID:2232 -
C:\Windows\SysWOW64\Dkpjih32.exeC:\Windows\system32\Dkpjih32.exe54⤵
- Executes dropped EXE
PID:4740 -
C:\Windows\SysWOW64\Dolfigic.exeC:\Windows\system32\Dolfigic.exe55⤵
- Executes dropped EXE
PID:2728 -
C:\Windows\SysWOW64\Dajbebhf.exeC:\Windows\system32\Dajbebhf.exe56⤵
- Executes dropped EXE
PID:4328 -
C:\Windows\SysWOW64\Defofa32.exeC:\Windows\system32\Defofa32.exe57⤵
- Executes dropped EXE
PID:4596 -
C:\Windows\SysWOW64\Dhdkbl32.exeC:\Windows\system32\Dhdkbl32.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2920 -
C:\Windows\SysWOW64\Dlpgbkhl.exeC:\Windows\system32\Dlpgbkhl.exe59⤵
- Executes dropped EXE
PID:1492 -
C:\Windows\SysWOW64\Dkbgnh32.exeC:\Windows\system32\Dkbgnh32.exe60⤵
- Executes dropped EXE
PID:2296 -
C:\Windows\SysWOW64\Dbjooe32.exeC:\Windows\system32\Dbjooe32.exe61⤵
- Executes dropped EXE
PID:2732 -
C:\Windows\SysWOW64\Damokbfd.exeC:\Windows\system32\Damokbfd.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4984 -
C:\Windows\SysWOW64\Dehkkq32.exeC:\Windows\system32\Dehkkq32.exe63⤵
- Executes dropped EXE
PID:4204 -
C:\Windows\SysWOW64\Dhfhhl32.exeC:\Windows\system32\Dhfhhl32.exe64⤵
- Executes dropped EXE
PID:3724 -
C:\Windows\SysWOW64\Dlbchkfj.exeC:\Windows\system32\Dlbchkfj.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1532 -
C:\Windows\SysWOW64\Doqpdf32.exeC:\Windows\system32\Doqpdf32.exe66⤵PID:1844
-
C:\Windows\SysWOW64\Dclleemf.exeC:\Windows\system32\Dclleemf.exe67⤵PID:2640
-
C:\Windows\SysWOW64\Daolqa32.exeC:\Windows\system32\Daolqa32.exe68⤵PID:4492
-
C:\Windows\SysWOW64\Ddmhmm32.exeC:\Windows\system32\Ddmhmm32.exe69⤵PID:2016
-
C:\Windows\SysWOW64\Dhidmlln.exeC:\Windows\system32\Dhidmlln.exe70⤵PID:1280
-
C:\Windows\SysWOW64\Dldpnj32.exeC:\Windows\system32\Dldpnj32.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:5116 -
C:\Windows\SysWOW64\Demefpjh.exeC:\Windows\system32\Demefpjh.exe72⤵PID:3064
-
C:\Windows\SysWOW64\Ddpebm32.exeC:\Windows\system32\Ddpebm32.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3720 -
C:\Windows\SysWOW64\Dlgmcj32.exeC:\Windows\system32\Dlgmcj32.exe74⤵PID:928
-
C:\Windows\SysWOW64\Eoeipeah.exeC:\Windows\system32\Eoeipeah.exe75⤵PID:1352
-
C:\Windows\SysWOW64\Ecqepd32.exeC:\Windows\system32\Ecqepd32.exe76⤵PID:2788
-
C:\Windows\SysWOW64\Eeoalp32.exeC:\Windows\system32\Eeoalp32.exe77⤵
- Modifies registry class
PID:2124 -
C:\Windows\SysWOW64\Edbbhlop.exeC:\Windows\system32\Edbbhlop.exe78⤵PID:4280
-
C:\Windows\SysWOW64\Ehnnhk32.exeC:\Windows\system32\Ehnnhk32.exe79⤵PID:2596
-
C:\Windows\SysWOW64\Ekljdf32.exeC:\Windows\system32\Ekljdf32.exe80⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1296 -
C:\Windows\SysWOW64\Eogfeeoe.exeC:\Windows\system32\Eogfeeoe.exe81⤵
- Modifies registry class
PID:1564 -
C:\Windows\SysWOW64\Eafbaqni.exeC:\Windows\system32\Eafbaqni.exe82⤵
- Modifies registry class
PID:4836 -
C:\Windows\SysWOW64\Eeanao32.exeC:\Windows\system32\Eeanao32.exe83⤵PID:684
-
C:\Windows\SysWOW64\Eddomlmm.exeC:\Windows\system32\Eddomlmm.exe84⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4636 -
C:\Windows\SysWOW64\Elkfnino.exeC:\Windows\system32\Elkfnino.exe85⤵
- System Location Discovery: System Language Discovery
PID:2240 -
C:\Windows\SysWOW64\Ekngjf32.exeC:\Windows\system32\Ekngjf32.exe86⤵PID:2900
-
C:\Windows\SysWOW64\Eojbkemc.exeC:\Windows\system32\Eojbkemc.exe87⤵PID:3696
-
C:\Windows\SysWOW64\Eahogp32.exeC:\Windows\system32\Eahogp32.exe88⤵PID:1084
-
C:\Windows\SysWOW64\Eedkgodp.exeC:\Windows\system32\Eedkgodp.exe89⤵PID:3920
-
C:\Windows\SysWOW64\Edgkcl32.exeC:\Windows\system32\Edgkcl32.exe90⤵PID:3860
-
C:\Windows\SysWOW64\Elncdi32.exeC:\Windows\system32\Elncdi32.exe91⤵PID:2304
-
C:\Windows\SysWOW64\Eolopd32.exeC:\Windows\system32\Eolopd32.exe92⤵PID:5132
-
C:\Windows\SysWOW64\Echkqcci.exeC:\Windows\system32\Echkqcci.exe93⤵
- System Location Discovery: System Language Discovery
PID:5176 -
C:\Windows\SysWOW64\Eakllp32.exeC:\Windows\system32\Eakllp32.exe94⤵PID:5220
-
C:\Windows\SysWOW64\Eefhmobm.exeC:\Windows\system32\Eefhmobm.exe95⤵
- Drops file in System32 directory
PID:5264 -
C:\Windows\SysWOW64\Ehddijaq.exeC:\Windows\system32\Ehddijaq.exe96⤵
- Modifies registry class
PID:5312 -
C:\Windows\SysWOW64\Ecjhfcaf.exeC:\Windows\system32\Ecjhfcaf.exe97⤵
- Modifies registry class
PID:5376 -
C:\Windows\SysWOW64\Eehdbn32.exeC:\Windows\system32\Eehdbn32.exe98⤵PID:5416
-
C:\Windows\SysWOW64\Edkdnkge.exeC:\Windows\system32\Edkdnkge.exe99⤵PID:5460
-
C:\Windows\SysWOW64\Ekemke32.exeC:\Windows\system32\Ekemke32.exe100⤵PID:5500
-
C:\Windows\SysWOW64\Foaikdgk.exeC:\Windows\system32\Foaikdgk.exe101⤵
- Modifies registry class
PID:5540 -
C:\Windows\SysWOW64\Faoegofo.exeC:\Windows\system32\Faoegofo.exe102⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5580 -
C:\Windows\SysWOW64\Fdnackeb.exeC:\Windows\system32\Fdnackeb.exe103⤵PID:5612
-
C:\Windows\SysWOW64\Fleidhfd.exeC:\Windows\system32\Fleidhfd.exe104⤵
- System Location Discovery: System Language Discovery
PID:5652 -
C:\Windows\SysWOW64\Fcoaab32.exeC:\Windows\system32\Fcoaab32.exe105⤵
- System Location Discovery: System Language Discovery
PID:5708 -
C:\Windows\SysWOW64\Ffmnmnle.exeC:\Windows\system32\Ffmnmnle.exe106⤵PID:5748
-
C:\Windows\SysWOW64\Fdpnij32.exeC:\Windows\system32\Fdpnij32.exe107⤵PID:5788
-
C:\Windows\SysWOW64\Flgfjh32.exeC:\Windows\system32\Flgfjh32.exe108⤵PID:5828
-
C:\Windows\SysWOW64\Fcangbko.exeC:\Windows\system32\Fcangbko.exe109⤵PID:5868
-
C:\Windows\SysWOW64\Ffpjcmjb.exeC:\Windows\system32\Ffpjcmjb.exe110⤵PID:5912
-
C:\Windows\SysWOW64\Fhngoiif.exeC:\Windows\system32\Fhngoiif.exe111⤵
- System Location Discovery: System Language Discovery
PID:5952 -
C:\Windows\SysWOW64\Fklckdhj.exeC:\Windows\system32\Fklckdhj.exe112⤵
- Modifies registry class
PID:5992 -
C:\Windows\SysWOW64\Fccklail.exeC:\Windows\system32\Fccklail.exe113⤵PID:6040
-
C:\Windows\SysWOW64\Ffbghmhp.exeC:\Windows\system32\Ffbghmhp.exe114⤵PID:6080
-
C:\Windows\SysWOW64\Fhpceh32.exeC:\Windows\system32\Fhpceh32.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6120 -
C:\Windows\SysWOW64\Fllpegpl.exeC:\Windows\system32\Fllpegpl.exe116⤵PID:2944
-
C:\Windows\SysWOW64\Fojlabop.exeC:\Windows\system32\Fojlabop.exe117⤵PID:412
-
C:\Windows\SysWOW64\Fbihnnnd.exeC:\Windows\system32\Fbihnnnd.exe118⤵
- System Location Discovery: System Language Discovery
PID:3548 -
C:\Windows\SysWOW64\Fdgdjimg.exeC:\Windows\system32\Fdgdjimg.exe119⤵
- System Location Discovery: System Language Discovery
PID:5140 -
C:\Windows\SysWOW64\Flnlkgnj.exeC:\Windows\system32\Flnlkgnj.exe120⤵PID:3320
-
C:\Windows\SysWOW64\Gkalfc32.exeC:\Windows\system32\Gkalfc32.exe121⤵PID:5252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-