Analysis
- max time kernel
12s - max time network
67s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:29
Static task
static1
Behavioral task
behavioral1
Sample
5c144503b3fa654a150cf8fca1c4d4eca7cadd9c2a6dba4b8171263bbbfd353e.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5c144503b3fa654a150cf8fca1c4d4eca7cadd9c2a6dba4b8171263bbbfd353e.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 5c144503b3fa654a150cf8fca1c4d4eca7cadd9c2a6dba4b8171263bbbfd353e.exe
- Size 1.7MB
- Sample201109-6a9pywkk32
- SHA256 5c144503b3fa654a150cf8fca1c4d4eca7cadd9c2a6dba4b8171263bbbfd353e
- MD5 6fc34be68ded979b3b8544f867ba4930
- SHA1 3963d458e57e6205aa49d0954471760f037bdea6
- SHA512 8d1b4af9f81e3954aad76ba2a196aff1b4e1dfb7c8d71bd589d16bbd6cb6506370cf5dfeb3332254623e17b43e26b97e06597cebd648674507b935e5f6d9d218
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs
- Executes dropped EXE 48 IoCs
pid Process 4964 Kiopge32.exe 5064 Kgfjna32.exe 3932 Lnekfj32.exe 984 Lijpccnb.exe 3584 Lgpldp32.exe 3724 Lecmndac.exe 496 Mlpbpn32.exe 788 Mggbeo32.exe 4316 Mekcoc32.exe 3192 Mempdb32.exe 3104 Mlidfl32.exe 4200 Neaiobec.exe 1776 Nedfea32.exe 512 Nlpkgkik.exe 808 Neiopaok.exe 492 Noadif32.exe 1076 Oboloe32.exe 1272 Oljnmjqp.exe 1424 Poopjdjl.exe 1732 Pigamm32.exe 1900 Pcdoqa32.exe 2076 Qlopog32.exe 2264 Aopiab32.exe 2740 Bfjjdjdc.exe 4372 Bkiobpah.exe 3476 Coiennel.exe 3516 Dcqpjkch.exe 1780 Dibbna32.exe 4552 Elgdjlfe.exe 4492 Einaip32.exe 4624 Flagqknk.exe 4588 Fjbgob32.exe 3644 Gpjpbgjd.exe 4664 Gbkhdb32.exe 4728 Hmefmkce.exe 4712 Hbboeaam.exe 2336 Hmhcbjac.exe 4468 Hbdkjaoj.exe 1892 Ilainf32.exe 2596 Iiejhj32.exe 4672 Igijao32.exe 4684 Jppkkb32.exe 1040 Kpbhabhg.exe 4676 Lclcilmm.exe 2040 Lmehaacn.exe 4152 Lqbqhp32.exe 3960 Lngaadhn.exe 4268 Lkkakhgg.exe - Drops file in System32 directory 147 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Kiopge32.exe 5c144503b3fa654a150cf8fca1c4d4eca7cadd9c2a6dba4b8171263bbbfd353e.exe File opened for modification C:\Windows\SysWOW64\Nedfea32.exe Neaiobec.exe File created C:\Windows\SysWOW64\Noadif32.exe Neiopaok.exe File opened for modification C:\Windows\SysWOW64\Bfjjdjdc.exe Aopiab32.exe File created C:\Windows\SysWOW64\Bkiobpah.exe Bfjjdjdc.exe File created C:\Windows\SysWOW64\Naefdm32.exe Lkkakhgg.exe File created C:\Windows\SysWOW64\Kiopge32.exe 5c144503b3fa654a150cf8fca1c4d4eca7cadd9c2a6dba4b8171263bbbfd353e.exe File opened for modification C:\Windows\SysWOW64\Kgfjna32.exe Kiopge32.exe File opened for modification C:\Windows\SysWOW64\Lecmndac.exe Lgpldp32.exe File created C:\Windows\SysWOW64\Mekcoc32.exe Mggbeo32.exe File opened for modification C:\Windows\SysWOW64\Nlpkgkik.exe Nedfea32.exe File opened for modification C:\Windows\SysWOW64\Aopiab32.exe Qlopog32.exe File created C:\Windows\SysWOW64\Bfjjdjdc.exe Aopiab32.exe File created C:\Windows\SysWOW64\Npfbafbn.dll Aopiab32.exe File created C:\Windows\SysWOW64\Qbhkaopo.dll Dibbna32.exe File opened for modification C:\Windows\SysWOW64\Hbboeaam.exe Hmefmkce.exe File created C:\Windows\SysWOW64\Neiopaok.exe Nlpkgkik.exe File created C:\Windows\SysWOW64\Odebjgnh.dll Pcdoqa32.exe File created C:\Windows\SysWOW64\Nllbpq32.dll Neaiobec.exe File created C:\Windows\SysWOW64\Plpldhgo.dll Oboloe32.exe File created C:\Windows\SysWOW64\Aopiab32.exe Qlopog32.exe File created C:\Windows\SysWOW64\Dibbna32.exe Dcqpjkch.exe File created C:\Windows\SysWOW64\Higklb32.dll Dcqpjkch.exe File created C:\Windows\SysWOW64\Qlopog32.exe Pcdoqa32.exe File created C:\Windows\SysWOW64\Igijao32.exe Iiejhj32.exe File created C:\Windows\SysWOW64\Lclcilmm.exe Kpbhabhg.exe File created C:\Windows\SysWOW64\Moifjm32.dll Lgpldp32.exe File created C:\Windows\SysWOW64\Mlpbpn32.exe Lecmndac.exe File created C:\Windows\SysWOW64\Anbbqa32.dll Einaip32.exe File created C:\Windows\SysWOW64\Fjbgob32.exe Flagqknk.exe File created C:\Windows\SysWOW64\Hmefmkce.exe Gbkhdb32.exe File created C:\Windows\SysWOW64\Jpllha32.dll Hbdkjaoj.exe File created C:\Windows\SysWOW64\Pcdoqa32.exe Pigamm32.exe File opened for modification C:\Windows\SysWOW64\Pcdoqa32.exe Pigamm32.exe File created C:\Windows\SysWOW64\Dekjjijk.dll Coiennel.exe File created C:\Windows\SysWOW64\Flagqknk.exe Einaip32.exe File created C:\Windows\SysWOW64\Kpbhabhg.exe Jppkkb32.exe File created C:\Windows\SysWOW64\Mggbeo32.exe Mlpbpn32.exe File created C:\Windows\SysWOW64\Lmehaacn.exe Lclcilmm.exe File created C:\Windows\SysWOW64\Kgackogc.dll Lmehaacn.exe File created C:\Windows\SysWOW64\Lkkakhgg.exe Lngaadhn.exe File opened for modification C:\Windows\SysWOW64\Naefdm32.exe Lkkakhgg.exe File created C:\Windows\SysWOW64\Nakchdgc.dll Neiopaok.exe File created C:\Windows\SysWOW64\Loqpkp32.dll Jppkkb32.exe File created C:\Windows\SysWOW64\Jhjico32.dll Gpjpbgjd.exe File created C:\Windows\SysWOW64\Lngaadhn.exe Lqbqhp32.exe File opened for modification C:\Windows\SysWOW64\Lijpccnb.exe Lnekfj32.exe File opened for modification C:\Windows\SysWOW64\Coiennel.exe Bkiobpah.exe File opened for modification C:\Windows\SysWOW64\Lmehaacn.exe Lclcilmm.exe File opened for modification C:\Windows\SysWOW64\Lngaadhn.exe Lqbqhp32.exe File created C:\Windows\SysWOW64\Ncjkih32.dll Mggbeo32.exe File created C:\Windows\SysWOW64\Nlpkgkik.exe Nedfea32.exe File created C:\Windows\SysWOW64\Hbboeaam.exe Hmefmkce.exe File created C:\Windows\SysWOW64\Mdjnklhg.dll Hbboeaam.exe File opened for modification C:\Windows\SysWOW64\Noadif32.exe Neiopaok.exe File opened for modification C:\Windows\SysWOW64\Ilainf32.exe Hbdkjaoj.exe File created C:\Windows\SysWOW64\Jnabpj32.dll Lngaadhn.exe File created C:\Windows\SysWOW64\Lnokjnfk.dll Lkkakhgg.exe File created C:\Windows\SysWOW64\Cigkplhp.dll Lecmndac.exe File opened for modification C:\Windows\SysWOW64\Mlidfl32.exe Mempdb32.exe File opened for modification C:\Windows\SysWOW64\Hmefmkce.exe Gbkhdb32.exe File opened for modification C:\Windows\SysWOW64\Jppkkb32.exe Igijao32.exe File created C:\Windows\SysWOW64\Nkaihbff.dll 5c144503b3fa654a150cf8fca1c4d4eca7cadd9c2a6dba4b8171263bbbfd353e.exe File created C:\Windows\SysWOW64\Emkdld32.dll Lnekfj32.exe File created C:\Windows\SysWOW64\Mhmbhp32.dll Oljnmjqp.exe File created C:\Windows\SysWOW64\Iiejhj32.exe Ilainf32.exe File created C:\Windows\SysWOW64\Hlbbmmql.dll Kpbhabhg.exe File opened for modification C:\Windows\SysWOW64\Mekcoc32.exe Mggbeo32.exe File created C:\Windows\SysWOW64\Mlidfl32.exe Mempdb32.exe File opened for modification C:\Windows\SysWOW64\Fjbgob32.exe Flagqknk.exe File created C:\Windows\SysWOW64\Gpjpbgjd.exe Fjbgob32.exe File created C:\Windows\SysWOW64\Pddkfcnp.dll Gbkhdb32.exe File created C:\Windows\SysWOW64\Jgmkmm32.dll Iiejhj32.exe File created C:\Windows\SysWOW64\Kfoffobn.dll Kiopge32.exe File created C:\Windows\SysWOW64\Lnekfj32.exe Kgfjna32.exe File opened for modification C:\Windows\SysWOW64\Dibbna32.exe Dcqpjkch.exe File created C:\Windows\SysWOW64\Ganjbk32.dll Lijpccnb.exe File created C:\Windows\SysWOW64\Lecmndac.exe Lgpldp32.exe File created C:\Windows\SysWOW64\Einaip32.exe Elgdjlfe.exe File opened for modification C:\Windows\SysWOW64\Flagqknk.exe Einaip32.exe File opened for modification C:\Windows\SysWOW64\Igijao32.exe Iiejhj32.exe File created C:\Windows\SysWOW64\Blqmfomp.dll Kgfjna32.exe File created C:\Windows\SysWOW64\Lijpccnb.exe Lnekfj32.exe File created C:\Windows\SysWOW64\Pigamm32.exe Poopjdjl.exe File opened for modification C:\Windows\SysWOW64\Bkiobpah.exe Bfjjdjdc.exe File created C:\Windows\SysWOW64\Jppkkb32.exe Igijao32.exe File created C:\Windows\SysWOW64\Lgpldp32.exe Lijpccnb.exe File opened for modification C:\Windows\SysWOW64\Mlpbpn32.exe Lecmndac.exe File created C:\Windows\SysWOW64\Mempdb32.exe Mekcoc32.exe File created C:\Windows\SysWOW64\Nedfea32.exe Neaiobec.exe File opened for modification C:\Windows\SysWOW64\Oljnmjqp.exe Oboloe32.exe File created C:\Windows\SysWOW64\Coiennel.exe Bkiobpah.exe File created C:\Windows\SysWOW64\Kigpboaf.dll Bkiobpah.exe File created C:\Windows\SysWOW64\Maoedh32.dll Fjbgob32.exe File created C:\Windows\SysWOW64\Lqbqhp32.exe Lmehaacn.exe File created C:\Windows\SysWOW64\Phlkagpd.dll Mlpbpn32.exe File opened for modification C:\Windows\SysWOW64\Oboloe32.exe Noadif32.exe File created C:\Windows\SysWOW64\Cnhjeo32.dll Flagqknk.exe File created C:\Windows\SysWOW64\Gbkhdb32.exe Gpjpbgjd.exe File opened for modification C:\Windows\SysWOW64\Lnekfj32.exe Kgfjna32.exe File opened for modification C:\Windows\SysWOW64\Qlopog32.exe Pcdoqa32.exe File created C:\Windows\SysWOW64\Hbdkjaoj.exe Hmhcbjac.exe File opened for modification C:\Windows\SysWOW64\Lgpldp32.exe Lijpccnb.exe File created C:\Windows\SysWOW64\Dmglpaff.dll Elgdjlfe.exe File created C:\Windows\SysWOW64\Kgfjna32.exe Kiopge32.exe File created C:\Windows\SysWOW64\Ijdhlajd.dll Nedfea32.exe File created C:\Windows\SysWOW64\Anahclam.dll Noadif32.exe File opened for modification C:\Windows\SysWOW64\Poopjdjl.exe Oljnmjqp.exe File opened for modification C:\Windows\SysWOW64\Hmhcbjac.exe Hbboeaam.exe File created C:\Windows\SysWOW64\Jchdqn32.dll Ilainf32.exe File opened for modification C:\Windows\SysWOW64\Lkkakhgg.exe Lngaadhn.exe File created C:\Windows\SysWOW64\Oboloe32.exe Noadif32.exe File created C:\Windows\SysWOW64\Lacelg32.dll Lclcilmm.exe File created C:\Windows\SysWOW64\Neaiobec.exe Mlidfl32.exe File opened for modification C:\Windows\SysWOW64\Neiopaok.exe Nlpkgkik.exe File created C:\Windows\SysWOW64\Aocgflhn.dll Pigamm32.exe File created C:\Windows\SysWOW64\Neoonbag.dll Qlopog32.exe File created C:\Windows\SysWOW64\Hmhcbjac.exe Hbboeaam.exe File opened for modification C:\Windows\SysWOW64\Mggbeo32.exe Mlpbpn32.exe File created C:\Windows\SysWOW64\Poopjdjl.exe Oljnmjqp.exe File created C:\Windows\SysWOW64\Dcqpjkch.exe Coiennel.exe File opened for modification C:\Windows\SysWOW64\Elgdjlfe.exe Dibbna32.exe File created C:\Windows\SysWOW64\Hhofglpl.dll Hmhcbjac.exe File created C:\Windows\SysWOW64\Lhghokqn.dll Igijao32.exe File opened for modification C:\Windows\SysWOW64\Lqbqhp32.exe Lmehaacn.exe File opened for modification C:\Windows\SysWOW64\Gpjpbgjd.exe Fjbgob32.exe File opened for modification C:\Windows\SysWOW64\Hbdkjaoj.exe Hmhcbjac.exe File created C:\Windows\SysWOW64\Bmlphmhk.dll Lqbqhp32.exe File opened for modification C:\Windows\SysWOW64\Mempdb32.exe Mekcoc32.exe File created C:\Windows\SysWOW64\Lpgphb32.dll Mlidfl32.exe File opened for modification C:\Windows\SysWOW64\Pigamm32.exe Poopjdjl.exe File created C:\Windows\SysWOW64\Elgdjlfe.exe Dibbna32.exe File created C:\Windows\SysWOW64\Ilainf32.exe Hbdkjaoj.exe File opened for modification C:\Windows\SysWOW64\Lclcilmm.exe Kpbhabhg.exe File created C:\Windows\SysWOW64\Dbjlpifk.dll Mekcoc32.exe File created C:\Windows\SysWOW64\Oonpod32.dll Mempdb32.exe File opened for modification C:\Windows\SysWOW64\Neaiobec.exe Mlidfl32.exe File created C:\Windows\SysWOW64\Oljnmjqp.exe Oboloe32.exe File created C:\Windows\SysWOW64\Kecefn32.dll Poopjdjl.exe File created C:\Windows\SysWOW64\Fdpmboej.dll Bfjjdjdc.exe File opened for modification C:\Windows\SysWOW64\Einaip32.exe Elgdjlfe.exe File opened for modification C:\Windows\SysWOW64\Gbkhdb32.exe Gpjpbgjd.exe File created C:\Windows\SysWOW64\Nnoqejmb.dll Hmefmkce.exe File opened for modification C:\Windows\SysWOW64\Iiejhj32.exe Ilainf32.exe File opened for modification C:\Windows\SysWOW64\Kpbhabhg.exe Jppkkb32.exe File created C:\Windows\SysWOW64\Pekndh32.dll Nlpkgkik.exe File opened for modification C:\Windows\SysWOW64\Dcqpjkch.exe Coiennel.exe - Modifies registry class 150 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lijpccnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hbdkjaoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkaihbff.dll" 5c144503b3fa654a150cf8fca1c4d4eca7cadd9c2a6dba4b8171263bbbfd353e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnhjeo32.dll" Flagqknk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oboloe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nlpkgkik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nlpkgkik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmlphmhk.dll" Lqbqhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijdhlajd.dll" Nedfea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kiopge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpllha32.dll" Hbdkjaoj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 5c144503b3fa654a150cf8fca1c4d4eca7cadd9c2a6dba4b8171263bbbfd353e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Coiennel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dibbna32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Elgdjlfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlbbmmql.dll" Kpbhabhg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kecefn32.dll" Poopjdjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phlkagpd.dll" Mlpbpn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbjlpifk.dll" Mekcoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Neaiobec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pcdoqa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gbkhdb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Igijao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lgpldp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdjnklhg.dll" Hbboeaam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kpbhabhg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anbbqa32.dll" Einaip32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nakchdgc.dll" Neiopaok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Aopiab32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hmefmkce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Loqpkp32.dll" Jppkkb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lmehaacn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lnekfj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lgpldp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pekndh32.dll" Nlpkgkik.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Noadif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pigamm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Qlopog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kigpboaf.dll" Bkiobpah.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kiopge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kgfjna32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Neaiobec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ilainf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831} 5c144503b3fa654a150cf8fca1c4d4eca7cadd9c2a6dba4b8171263bbbfd353e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmglpaff.dll" Elgdjlfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mggbeo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mlpbpn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpgphb32.dll" Mlidfl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Neiopaok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Noadif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dibbna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blqmfomp.dll" Kgfjna32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kgfjna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ganjbk32.dll" Lijpccnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lecmndac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plpldhgo.dll" Oboloe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Oljnmjqp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dekjjijk.dll" Coiennel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Flagqknk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 5c144503b3fa654a150cf8fca1c4d4eca7cadd9c2a6dba4b8171263bbbfd353e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hbdkjaoj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Iiejhj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gbkhdb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mlidfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Higklb32.dll" Dcqpjkch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hmefmkce.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lclcilmm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lkkakhgg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncjkih32.dll" Mggbeo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Poopjdjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gpjpbgjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnoqejmb.dll" Hmefmkce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhghokqn.dll" Igijao32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lngaadhn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Einaip32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhmbhp32.dll" Oljnmjqp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Flagqknk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kpbhabhg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nedfea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fjbgob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhjico32.dll" Gpjpbgjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ilainf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgmkmm32.dll" Iiejhj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgackogc.dll" Lmehaacn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lmehaacn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lqbqhp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lijpccnb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bfjjdjdc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maoedh32.dll" Fjbgob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lclcilmm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lqbqhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pcdoqa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Aopiab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Elgdjlfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnabpj32.dll" Lngaadhn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anahclam.dll" Noadif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oonpod32.dll" Mempdb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdpmboej.dll" Bfjjdjdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gpjpbgjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hbboeaam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnokjnfk.dll" Lkkakhgg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Poopjdjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cigkplhp.dll" Lecmndac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bfjjdjdc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lacelg32.dll" Lclcilmm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lecmndac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Igijao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbhkaopo.dll" Dibbna32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fjbgob32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jppkkb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qlopog32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Coiennel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Einaip32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Iiejhj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mekcoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dcqpjkch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jppkkb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mekcoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Moifjm32.dll" Lgpldp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mlpbpn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Oboloe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bkiobpah.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hbboeaam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hmhcbjac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jchdqn32.dll" Ilainf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfoffobn.dll" Kiopge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lngaadhn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mggbeo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mempdb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mempdb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mlidfl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pigamm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aocgflhn.dll" Pigamm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lkkakhgg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 5c144503b3fa654a150cf8fca1c4d4eca7cadd9c2a6dba4b8171263bbbfd353e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nllbpq32.dll" Neaiobec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Neiopaok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oljnmjqp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odebjgnh.dll" Pcdoqa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npfbafbn.dll" Aopiab32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dcqpjkch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pddkfcnp.dll" Gbkhdb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emkdld32.dll" Lnekfj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lnekfj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nedfea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" 5c144503b3fa654a150cf8fca1c4d4eca7cadd9c2a6dba4b8171263bbbfd353e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bkiobpah.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hmhcbjac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhofglpl.dll" Hmhcbjac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Neoonbag.dll" Qlopog32.exe - Suspicious use of WriteProcessMemory 144 IoCs
description pid Process procid_target PID 4764 wrote to memory of 4964 4764 5c144503b3fa654a150cf8fca1c4d4eca7cadd9c2a6dba4b8171263bbbfd353e.exe 71 PID 4764 wrote to memory of 4964 4764 5c144503b3fa654a150cf8fca1c4d4eca7cadd9c2a6dba4b8171263bbbfd353e.exe 71 PID 4764 wrote to memory of 4964 4764 5c144503b3fa654a150cf8fca1c4d4eca7cadd9c2a6dba4b8171263bbbfd353e.exe 71 PID 4964 wrote to memory of 5064 4964 Kiopge32.exe 73 PID 4964 wrote to memory of 5064 4964 Kiopge32.exe 73 PID 4964 wrote to memory of 5064 4964 Kiopge32.exe 73 PID 5064 wrote to memory of 3932 5064 Kgfjna32.exe 75 PID 5064 wrote to memory of 3932 5064 Kgfjna32.exe 75 PID 5064 wrote to memory of 3932 5064 Kgfjna32.exe 75 PID 3932 wrote to memory of 984 3932 Lnekfj32.exe 76 PID 3932 wrote to memory of 984 3932 Lnekfj32.exe 76 PID 3932 wrote to memory of 984 3932 Lnekfj32.exe 76 PID 984 wrote to memory of 3584 984 Lijpccnb.exe 77 PID 984 wrote to memory of 3584 984 Lijpccnb.exe 77 PID 984 wrote to memory of 3584 984 Lijpccnb.exe 77 PID 3584 wrote to memory of 3724 3584 Lgpldp32.exe 78 PID 3584 wrote to memory of 3724 3584 Lgpldp32.exe 78 PID 3584 wrote to memory of 3724 3584 Lgpldp32.exe 78 PID 3724 wrote to memory of 496 3724 Lecmndac.exe 79 PID 3724 wrote to memory of 496 3724 Lecmndac.exe 79 PID 3724 wrote to memory of 496 3724 Lecmndac.exe 79 PID 496 wrote to memory of 788 496 Mlpbpn32.exe 80 PID 496 wrote to memory of 788 496 Mlpbpn32.exe 80 PID 496 wrote to memory of 788 496 Mlpbpn32.exe 80 PID 788 wrote to memory of 4316 788 Mggbeo32.exe 81 PID 788 wrote to memory of 4316 788 Mggbeo32.exe 81 PID 788 wrote to memory of 4316 788 Mggbeo32.exe 81 PID 4316 wrote to memory of 3192 4316 Mekcoc32.exe 82 PID 4316 wrote to memory of 3192 4316 Mekcoc32.exe 82 PID 4316 wrote to memory of 3192 4316 Mekcoc32.exe 82 PID 3192 wrote to memory of 3104 3192 Mempdb32.exe 83 PID 3192 wrote to memory of 3104 3192 Mempdb32.exe 83 PID 3192 wrote to memory of 3104 3192 Mempdb32.exe 83 PID 3104 wrote to memory of 4200 3104 Mlidfl32.exe 85 PID 3104 wrote to memory of 4200 3104 Mlidfl32.exe 85 PID 3104 wrote to memory of 4200 3104 Mlidfl32.exe 85 PID 4200 wrote to memory of 1776 4200 Neaiobec.exe 87 PID 4200 wrote to memory of 1776 4200 Neaiobec.exe 87 PID 4200 wrote to memory of 1776 4200 Neaiobec.exe 87 PID 1776 wrote to memory of 512 1776 Nedfea32.exe 88 PID 1776 wrote to memory of 512 1776 Nedfea32.exe 88 PID 1776 wrote to memory of 512 1776 Nedfea32.exe 88 PID 512 wrote to memory of 808 512 Nlpkgkik.exe 89 PID 512 wrote to memory of 808 512 Nlpkgkik.exe 89 PID 512 wrote to memory of 808 512 Nlpkgkik.exe 89 PID 808 wrote to memory of 492 808 Neiopaok.exe 90 PID 808 wrote to memory of 492 808 Neiopaok.exe 90 PID 808 wrote to memory of 492 808 Neiopaok.exe 90 PID 492 wrote to memory of 1076 492 Noadif32.exe 91 PID 492 wrote to memory of 1076 492 Noadif32.exe 91 PID 492 wrote to memory of 1076 492 Noadif32.exe 91 PID 1076 wrote to memory of 1272 1076 Oboloe32.exe 92 PID 1076 wrote to memory of 1272 1076 Oboloe32.exe 92 PID 1076 wrote to memory of 1272 1076 Oboloe32.exe 92 PID 1272 wrote to memory of 1424 1272 Oljnmjqp.exe 93 PID 1272 wrote to memory of 1424 1272 Oljnmjqp.exe 93 PID 1272 wrote to memory of 1424 1272 Oljnmjqp.exe 93 PID 1424 wrote to memory of 1732 1424 Poopjdjl.exe 94 PID 1424 wrote to memory of 1732 1424 Poopjdjl.exe 94 PID 1424 wrote to memory of 1732 1424 Poopjdjl.exe 94 PID 1732 wrote to memory of 1900 1732 Pigamm32.exe 95 PID 1732 wrote to memory of 1900 1732 Pigamm32.exe 95 PID 1732 wrote to memory of 1900 1732 Pigamm32.exe 95 PID 1900 wrote to memory of 2076 1900 Pcdoqa32.exe 96 PID 1900 wrote to memory of 2076 1900 Pcdoqa32.exe 96 PID 1900 wrote to memory of 2076 1900 Pcdoqa32.exe 96 PID 2076 wrote to memory of 2264 2076 Qlopog32.exe 97 PID 2076 wrote to memory of 2264 2076 Qlopog32.exe 97 PID 2076 wrote to memory of 2264 2076 Qlopog32.exe 97 PID 2264 wrote to memory of 2740 2264 Aopiab32.exe 98 PID 2264 wrote to memory of 2740 2264 Aopiab32.exe 98 PID 2264 wrote to memory of 2740 2264 Aopiab32.exe 98 PID 2740 wrote to memory of 4372 2740 Bfjjdjdc.exe 99 PID 2740 wrote to memory of 4372 2740 Bfjjdjdc.exe 99 PID 2740 wrote to memory of 4372 2740 Bfjjdjdc.exe 99 PID 4372 wrote to memory of 3476 4372 Bkiobpah.exe 100 PID 4372 wrote to memory of 3476 4372 Bkiobpah.exe 100 PID 4372 wrote to memory of 3476 4372 Bkiobpah.exe 100 PID 3476 wrote to memory of 3516 3476 Coiennel.exe 101 PID 3476 wrote to memory of 3516 3476 Coiennel.exe 101 PID 3476 wrote to memory of 3516 3476 Coiennel.exe 101 PID 3516 wrote to memory of 1780 3516 Dcqpjkch.exe 102 PID 3516 wrote to memory of 1780 3516 Dcqpjkch.exe 102 PID 3516 wrote to memory of 1780 3516 Dcqpjkch.exe 102 PID 1780 wrote to memory of 4552 1780 Dibbna32.exe 103 PID 1780 wrote to memory of 4552 1780 Dibbna32.exe 103 PID 1780 wrote to memory of 4552 1780 Dibbna32.exe 103 PID 4552 wrote to memory of 4492 4552 Elgdjlfe.exe 104 PID 4552 wrote to memory of 4492 4552 Elgdjlfe.exe 104 PID 4552 wrote to memory of 4492 4552 Elgdjlfe.exe 104 PID 4492 wrote to memory of 4624 4492 Einaip32.exe 105 PID 4492 wrote to memory of 4624 4492 Einaip32.exe 105 PID 4492 wrote to memory of 4624 4492 Einaip32.exe 105 PID 4624 wrote to memory of 4588 4624 Flagqknk.exe 106 PID 4624 wrote to memory of 4588 4624 Flagqknk.exe 106 PID 4624 wrote to memory of 4588 4624 Flagqknk.exe 106 PID 4588 wrote to memory of 3644 4588 Fjbgob32.exe 107 PID 4588 wrote to memory of 3644 4588 Fjbgob32.exe 107 PID 4588 wrote to memory of 3644 4588 Fjbgob32.exe 107 PID 3644 wrote to memory of 4664 3644 Gpjpbgjd.exe 108 PID 3644 wrote to memory of 4664 3644 Gpjpbgjd.exe 108 PID 3644 wrote to memory of 4664 3644 Gpjpbgjd.exe 108 PID 4664 wrote to memory of 4728 4664 Gbkhdb32.exe 109 PID 4664 wrote to memory of 4728 4664 Gbkhdb32.exe 109 PID 4664 wrote to memory of 4728 4664 Gbkhdb32.exe 109 PID 4728 wrote to memory of 4712 4728 Hmefmkce.exe 110 PID 4728 wrote to memory of 4712 4728 Hmefmkce.exe 110 PID 4728 wrote to memory of 4712 4728 Hmefmkce.exe 110 PID 4712 wrote to memory of 2336 4712 Hbboeaam.exe 111 PID 4712 wrote to memory of 2336 4712 Hbboeaam.exe 111 PID 4712 wrote to memory of 2336 4712 Hbboeaam.exe 111 PID 2336 wrote to memory of 4468 2336 Hmhcbjac.exe 112 PID 2336 wrote to memory of 4468 2336 Hmhcbjac.exe 112 PID 2336 wrote to memory of 4468 2336 Hmhcbjac.exe 112 PID 4468 wrote to memory of 1892 4468 Hbdkjaoj.exe 113 PID 4468 wrote to memory of 1892 4468 Hbdkjaoj.exe 113 PID 4468 wrote to memory of 1892 4468 Hbdkjaoj.exe 113 PID 1892 wrote to memory of 2596 1892 Ilainf32.exe 114 PID 1892 wrote to memory of 2596 1892 Ilainf32.exe 114 PID 1892 wrote to memory of 2596 1892 Ilainf32.exe 114 PID 2596 wrote to memory of 4672 2596 Iiejhj32.exe 115 PID 2596 wrote to memory of 4672 2596 Iiejhj32.exe 115 PID 2596 wrote to memory of 4672 2596 Iiejhj32.exe 115 PID 4672 wrote to memory of 4684 4672 Igijao32.exe 116 PID 4672 wrote to memory of 4684 4672 Igijao32.exe 116 PID 4672 wrote to memory of 4684 4672 Igijao32.exe 116 PID 4684 wrote to memory of 1040 4684 Jppkkb32.exe 117 PID 4684 wrote to memory of 1040 4684 Jppkkb32.exe 117 PID 4684 wrote to memory of 1040 4684 Jppkkb32.exe 117 PID 1040 wrote to memory of 4676 1040 Kpbhabhg.exe 118 PID 1040 wrote to memory of 4676 1040 Kpbhabhg.exe 118 PID 1040 wrote to memory of 4676 1040 Kpbhabhg.exe 118 PID 4676 wrote to memory of 2040 4676 Lclcilmm.exe 119 PID 4676 wrote to memory of 2040 4676 Lclcilmm.exe 119 PID 4676 wrote to memory of 2040 4676 Lclcilmm.exe 119 PID 2040 wrote to memory of 4152 2040 Lmehaacn.exe 120 PID 2040 wrote to memory of 4152 2040 Lmehaacn.exe 120 PID 2040 wrote to memory of 4152 2040 Lmehaacn.exe 120 PID 4152 wrote to memory of 3960 4152 Lqbqhp32.exe 121 PID 4152 wrote to memory of 3960 4152 Lqbqhp32.exe 121 PID 4152 wrote to memory of 3960 4152 Lqbqhp32.exe 121 PID 3960 wrote to memory of 4268 3960 Lngaadhn.exe 122 PID 3960 wrote to memory of 4268 3960 Lngaadhn.exe 122 PID 3960 wrote to memory of 4268 3960 Lngaadhn.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c144503b3fa654a150cf8fca1c4d4eca7cadd9c2a6dba4b8171263bbbfd353e.exe"C:\Users\Admin\AppData\Local\Temp\5c144503b3fa654a150cf8fca1c4d4eca7cadd9c2a6dba4b8171263bbbfd353e.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\Kiopge32.exeC:\Windows\system32\Kiopge32.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\Kgfjna32.exeC:\Windows\system32\Kgfjna32.exe3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\Lnekfj32.exeC:\Windows\system32\Lnekfj32.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\Lijpccnb.exeC:\Windows\system32\Lijpccnb.exe5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\Lgpldp32.exeC:\Windows\system32\Lgpldp32.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\Lecmndac.exeC:\Windows\system32\Lecmndac.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\Mlpbpn32.exeC:\Windows\system32\Mlpbpn32.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Windows\SysWOW64\Mggbeo32.exeC:\Windows\system32\Mggbeo32.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\Mekcoc32.exeC:\Windows\system32\Mekcoc32.exe10⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\Mempdb32.exeC:\Windows\system32\Mempdb32.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\Mlidfl32.exeC:\Windows\system32\Mlidfl32.exe12⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\Neaiobec.exeC:\Windows\system32\Neaiobec.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\Nedfea32.exeC:\Windows\system32\Nedfea32.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\Nlpkgkik.exeC:\Windows\system32\Nlpkgkik.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\SysWOW64\Neiopaok.exeC:\Windows\system32\Neiopaok.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\Noadif32.exeC:\Windows\system32\Noadif32.exe17⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Windows\SysWOW64\Oboloe32.exeC:\Windows\system32\Oboloe32.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\Oljnmjqp.exeC:\Windows\system32\Oljnmjqp.exe19⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\Poopjdjl.exeC:\Windows\system32\Poopjdjl.exe20⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\Pigamm32.exeC:\Windows\system32\Pigamm32.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\Pcdoqa32.exeC:\Windows\system32\Pcdoqa32.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\Qlopog32.exeC:\Windows\system32\Qlopog32.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2076 -
C:\Windows\SysWOW64\Aopiab32.exeC:\Windows\system32\Aopiab32.exe24⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2264 -
C:\Windows\SysWOW64\Bfjjdjdc.exeC:\Windows\system32\Bfjjdjdc.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2740 -
C:\Windows\SysWOW64\Bkiobpah.exeC:\Windows\system32\Bkiobpah.exe26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4372 -
C:\Windows\SysWOW64\Coiennel.exeC:\Windows\system32\Coiennel.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3476 -
C:\Windows\SysWOW64\Dcqpjkch.exeC:\Windows\system32\Dcqpjkch.exe28⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3516 -
C:\Windows\SysWOW64\Dibbna32.exeC:\Windows\system32\Dibbna32.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1780 -
C:\Windows\SysWOW64\Elgdjlfe.exeC:\Windows\system32\Elgdjlfe.exe30⤵
- Executes dropped EXE
- Modifies registry class
PID:4552 -
C:\Windows\SysWOW64\Einaip32.exeC:\Windows\system32\Einaip32.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4492 -
C:\Windows\SysWOW64\Flagqknk.exeC:\Windows\system32\Flagqknk.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4624 -
C:\Windows\SysWOW64\Fjbgob32.exeC:\Windows\system32\Fjbgob32.exe33⤵
- Executes dropped EXE
PID:4588 -
C:\Windows\SysWOW64\Gpjpbgjd.exeC:\Windows\system32\Gpjpbgjd.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3644 -
C:\Windows\SysWOW64\Gbkhdb32.exeC:\Windows\system32\Gbkhdb32.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4664 -
C:\Windows\SysWOW64\Hmefmkce.exeC:\Windows\system32\Hmefmkce.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4728 -
C:\Windows\SysWOW64\Hbboeaam.exeC:\Windows\system32\Hbboeaam.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4712 -
C:\Windows\SysWOW64\Hmhcbjac.exeC:\Windows\system32\Hmhcbjac.exe38⤵
- Executes dropped EXE
PID:2336 -
C:\Windows\SysWOW64\Hbdkjaoj.exeC:\Windows\system32\Hbdkjaoj.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4468 -
C:\Windows\SysWOW64\Ilainf32.exeC:\Windows\system32\Ilainf32.exe40⤵
- Executes dropped EXE
- Modifies registry class
PID:1892 -
C:\Windows\SysWOW64\Iiejhj32.exeC:\Windows\system32\Iiejhj32.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2596 -
C:\Windows\SysWOW64\Igijao32.exeC:\Windows\system32\Igijao32.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4672 -
C:\Windows\SysWOW64\Jppkkb32.exeC:\Windows\system32\Jppkkb32.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4684 -
C:\Windows\SysWOW64\Kpbhabhg.exeC:\Windows\system32\Kpbhabhg.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1040 -
C:\Windows\SysWOW64\Lclcilmm.exeC:\Windows\system32\Lclcilmm.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4676 -
C:\Windows\SysWOW64\Lmehaacn.exeC:\Windows\system32\Lmehaacn.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2040 -
C:\Windows\SysWOW64\Lqbqhp32.exeC:\Windows\system32\Lqbqhp32.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4152 -
C:\Windows\SysWOW64\Lngaadhn.exeC:\Windows\system32\Lngaadhn.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3960 -
C:\Windows\SysWOW64\Lkkakhgg.exeC:\Windows\system32\Lkkakhgg.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-