Analysis
- max time kernel
25s - max time network
85s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 20:29
Static task
static1
Behavioral task
behavioral1
Sample
04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe
- Size 1.7MB
- Sample201109-pbpps1qcr2
- SHA256 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8
- MD5 384ed7dfc1defa37a8def6dddad029f3
- SHA1 9ef33f4f2d27d99f35f1528e2820547436443455
- SHA512 3ec9b760041c077afc928c7924a82e3200e45193056bb02d49fa8d787be316d4e080c452e352501929f30b5464b45619ca9b730a21bf5304837714d9379eb7de
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs
- Executes dropped EXE 61 IoCs
pid Process 1672 Lcpnpnef.exe 892 Mfagaibg.exe 1992 Mpiljnig.exe 1976 Mplhpngd.exe 1796 Moaeaj32.exe 1752 Mifinclb.exe 1712 Maanbeim.exe 556 Ndbgdq32.exe 1840 Opegepae.exe 2000 Oojdflfm.exe 408 Oefihf32.exe 1516 Pqpjidhf.exe 1076 Pndkbhgp.exe 1160 Pgolqmkn.exe 272 Qbmflj32.exe 1720 Bakbbi32.exe 576 Ceikig32.exe 1880 Dekdmjjo.exe 1184 Ejpflmkl.exe 1984 Fbkdgm32.exe 1972 Gjkbgo32.exe 2076 Hdhljg32.exe 2104 Idjioffn.exe 2132 Jjlgap32.exe 2160 Joklpgop.exe 2188 Liejmofi.exe 2216 Lfijfc32.exe 2244 Mpfhjh32.exe 2272 Maokbp32.exe 2300 Oacpmb32.exe 2328 Okkeehlk.exe 2356 Phoano32.exe 2396 Bjgpejpb.exe 2424 Bcbacodp.exe 2452 Bpkonp32.exe 2480 Chkmna32.exe 2508 Clifdphn.exe 2536 Cjncelme.exe 2564 Dajhgf32.exe 2592 Dcbjpmbf.exe 2620 Ehbpmcnk.exe 2648 Fkeacald.exe 2676 Gfmbfj32.exe 2704 Gmamgh32.exe 2732 Hmdjlheb.exe 2760 Jifgljce.exe 2788 Jadhfl32.exe 2816 Lnmbpq32.exe 2844 Ldigbj32.exe 2872 Mmnnlk32.exe 2900 Meican32.exe 2928 Odllcheh.exe 2956 Ohnamk32.exe 2984 Pcaechmk.exe 3012 Pdqbmk32.exe 3040 Aoaiog32.exe 3068 Aqeblonq.exe 2092 Agcdciah.exe 436 Bmbiao32.exe 1464 Bbbnofja.exe 1688 Bgacmlff.exe - Loads dropped DLL 123 IoCs
pid Process 2028 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe 2028 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe 1672 Lcpnpnef.exe 1672 Lcpnpnef.exe 892 Mfagaibg.exe 892 Mfagaibg.exe 1992 Mpiljnig.exe 1992 Mpiljnig.exe 1976 Mplhpngd.exe 1976 Mplhpngd.exe 1796 Moaeaj32.exe 1796 Moaeaj32.exe 1752 Mifinclb.exe 1752 Mifinclb.exe 1712 Maanbeim.exe 1712 Maanbeim.exe 556 Ndbgdq32.exe 556 Ndbgdq32.exe 1840 Opegepae.exe 1840 Opegepae.exe 2000 Oojdflfm.exe 2000 Oojdflfm.exe 408 Oefihf32.exe 408 Oefihf32.exe 1516 Pqpjidhf.exe 1516 Pqpjidhf.exe 1076 Pndkbhgp.exe 1076 Pndkbhgp.exe 1160 Pgolqmkn.exe 1160 Pgolqmkn.exe 272 Qbmflj32.exe 272 Qbmflj32.exe 1720 Bakbbi32.exe 1720 Bakbbi32.exe 576 Ceikig32.exe 576 Ceikig32.exe 1880 Dekdmjjo.exe 1880 Dekdmjjo.exe 1184 Ejpflmkl.exe 1184 Ejpflmkl.exe 1984 Fbkdgm32.exe 1984 Fbkdgm32.exe 1972 Gjkbgo32.exe 1972 Gjkbgo32.exe 2076 Hdhljg32.exe 2076 Hdhljg32.exe 2104 Idjioffn.exe 2104 Idjioffn.exe 2132 Jjlgap32.exe 2132 Jjlgap32.exe 2160 Joklpgop.exe 2160 Joklpgop.exe 2188 Liejmofi.exe 2188 Liejmofi.exe 2216 Lfijfc32.exe 2216 Lfijfc32.exe 2244 Mpfhjh32.exe 2244 Mpfhjh32.exe 2272 Maokbp32.exe 2272 Maokbp32.exe 2300 Oacpmb32.exe 2300 Oacpmb32.exe 2328 Okkeehlk.exe 2328 Okkeehlk.exe 2356 Phoano32.exe 2356 Phoano32.exe 2396 Bjgpejpb.exe 2396 Bjgpejpb.exe 2424 Bcbacodp.exe 2424 Bcbacodp.exe 2452 Bpkonp32.exe 2452 Bpkonp32.exe 2480 Chkmna32.exe 2480 Chkmna32.exe 2508 Clifdphn.exe 2508 Clifdphn.exe 2536 Cjncelme.exe 2536 Cjncelme.exe 2564 Dajhgf32.exe 2564 Dajhgf32.exe 2592 Dcbjpmbf.exe 2592 Dcbjpmbf.exe 2620 Ehbpmcnk.exe 2620 Ehbpmcnk.exe 2648 Fkeacald.exe 2648 Fkeacald.exe 2676 Gfmbfj32.exe 2676 Gfmbfj32.exe 2704 Gmamgh32.exe 2704 Gmamgh32.exe 2732 Hmdjlheb.exe 2732 Hmdjlheb.exe 2760 Jifgljce.exe 2760 Jifgljce.exe 2788 Jadhfl32.exe 2788 Jadhfl32.exe 2816 Lnmbpq32.exe 2816 Lnmbpq32.exe 2844 Ldigbj32.exe 2844 Ldigbj32.exe 2872 Mmnnlk32.exe 2872 Mmnnlk32.exe 2900 Meican32.exe 2900 Meican32.exe 2928 Odllcheh.exe 2928 Odllcheh.exe 2956 Ohnamk32.exe 2956 Ohnamk32.exe 2984 Pcaechmk.exe 2984 Pcaechmk.exe 3012 Pdqbmk32.exe 3012 Pdqbmk32.exe 3040 Aoaiog32.exe 3040 Aoaiog32.exe 3068 Aqeblonq.exe 3068 Aqeblonq.exe 2092 Agcdciah.exe 2092 Agcdciah.exe 436 Bmbiao32.exe 436 Bmbiao32.exe 1464 Bbbnofja.exe 1464 Bbbnofja.exe 1688 Bgacmlff.exe - Drops file in System32 directory 186 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Agcdciah.exe Aqeblonq.exe File created C:\Windows\SysWOW64\Omhbkn32.dll Lcpnpnef.exe File created C:\Windows\SysWOW64\Bbjmgcml.dll Opegepae.exe File opened for modification C:\Windows\SysWOW64\Pgolqmkn.exe Pndkbhgp.exe File opened for modification C:\Windows\SysWOW64\Bakbbi32.exe Qbmflj32.exe File created C:\Windows\SysWOW64\Ceikig32.exe Bakbbi32.exe File created C:\Windows\SysWOW64\Lfijfc32.exe Liejmofi.exe File created C:\Windows\SysWOW64\Pqpjidhf.exe Oefihf32.exe File created C:\Windows\SysWOW64\Iepqqp32.dll Joklpgop.exe File created C:\Windows\SysWOW64\Chkmna32.exe Bpkonp32.exe File opened for modification C:\Windows\SysWOW64\Lfijfc32.exe Liejmofi.exe File opened for modification C:\Windows\SysWOW64\Okkeehlk.exe Oacpmb32.exe File opened for modification C:\Windows\SysWOW64\Ldigbj32.exe Lnmbpq32.exe File created C:\Windows\SysWOW64\Lcpnpnef.exe 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe File opened for modification C:\Windows\SysWOW64\Gjkbgo32.exe Fbkdgm32.exe File created C:\Windows\SysWOW64\Hepgfc32.dll Clifdphn.exe File created C:\Windows\SysWOW64\Pcaechmk.exe Ohnamk32.exe File created C:\Windows\SysWOW64\Agcdciah.exe Aqeblonq.exe File opened for modification C:\Windows\SysWOW64\Fbkdgm32.exe Ejpflmkl.exe File created C:\Windows\SysWOW64\Cdkdnnbh.dll Maokbp32.exe File created C:\Windows\SysWOW64\Jifgljce.exe Hmdjlheb.exe File created C:\Windows\SysWOW64\Lnmbpq32.exe Jadhfl32.exe File created C:\Windows\SysWOW64\Iqacnf32.dll Jjlgap32.exe File opened for modification C:\Windows\SysWOW64\Oacpmb32.exe Maokbp32.exe File created C:\Windows\SysWOW64\Mpiljnig.exe Mfagaibg.exe File created C:\Windows\SysWOW64\Mplhpngd.exe Mpiljnig.exe File created C:\Windows\SysWOW64\Mifinclb.exe Moaeaj32.exe File opened for modification C:\Windows\SysWOW64\Mifinclb.exe Moaeaj32.exe File created C:\Windows\SysWOW64\Ndbgdq32.exe Maanbeim.exe File created C:\Windows\SysWOW64\Kjijmkki.dll Pqpjidhf.exe File created C:\Windows\SysWOW64\Bgdiom32.dll Chkmna32.exe File created C:\Windows\SysWOW64\Moaeaj32.exe Mplhpngd.exe File created C:\Windows\SysWOW64\Opdpep32.dll Gjkbgo32.exe File created C:\Windows\SysWOW64\Odllcheh.exe Meican32.exe File created C:\Windows\SysWOW64\Jelldk32.dll Ohnamk32.exe File opened for modification C:\Windows\SysWOW64\Bmbiao32.exe Agcdciah.exe File created C:\Windows\SysWOW64\Bbbnofja.exe Bmbiao32.exe File created C:\Windows\SysWOW64\Hgecol32.dll Ceikig32.exe File created C:\Windows\SysWOW64\Adpjjqlj.dll Lfijfc32.exe File opened for modification C:\Windows\SysWOW64\Jadhfl32.exe Jifgljce.exe File created C:\Windows\SysWOW64\Iblccddh.dll Odllcheh.exe File opened for modification C:\Windows\SysWOW64\Aoaiog32.exe Pdqbmk32.exe File created C:\Windows\SysWOW64\Olekac32.dll Aoaiog32.exe File created C:\Windows\SysWOW64\Fkeacald.exe Ehbpmcnk.exe File created C:\Windows\SysWOW64\Bmbiao32.exe Agcdciah.exe File created C:\Windows\SysWOW64\Oojdflfm.exe Opegepae.exe File opened for modification C:\Windows\SysWOW64\Pndkbhgp.exe Pqpjidhf.exe File created C:\Windows\SysWOW64\Idjioffn.exe Hdhljg32.exe File created C:\Windows\SysWOW64\Jjlgap32.exe Idjioffn.exe File created C:\Windows\SysWOW64\Phoano32.exe Okkeehlk.exe File created C:\Windows\SysWOW64\Dajhgf32.exe Cjncelme.exe File created C:\Windows\SysWOW64\Oabmdd32.dll Bgacmlff.exe File created C:\Windows\SysWOW64\Ilkpdd32.dll Oefihf32.exe File created C:\Windows\SysWOW64\Ppjlfm32.dll Pgolqmkn.exe File created C:\Windows\SysWOW64\Ffojlnbq.dll Idjioffn.exe File created C:\Windows\SysWOW64\Gfoghqbe.dll Ehbpmcnk.exe File opened for modification C:\Windows\SysWOW64\Gmamgh32.exe Gfmbfj32.exe File created C:\Windows\SysWOW64\Mmnnlk32.exe Ldigbj32.exe File created C:\Windows\SysWOW64\Pdmeap32.dll Oacpmb32.exe File opened for modification C:\Windows\SysWOW64\Bpkonp32.exe Bcbacodp.exe File created C:\Windows\SysWOW64\Mfagaibg.exe Lcpnpnef.exe File opened for modification C:\Windows\SysWOW64\Mplhpngd.exe Mpiljnig.exe File opened for modification C:\Windows\SysWOW64\Moaeaj32.exe Mplhpngd.exe File created C:\Windows\SysWOW64\Fjjncbob.dll Ndbgdq32.exe File created C:\Windows\SysWOW64\Pgolqmkn.exe Pndkbhgp.exe File created C:\Windows\SysWOW64\Oacpmb32.exe Maokbp32.exe File created C:\Windows\SysWOW64\Cjncelme.exe Clifdphn.exe File created C:\Windows\SysWOW64\Hjhcmfpc.dll Aqeblonq.exe File created C:\Windows\SysWOW64\Gmamgh32.exe Gfmbfj32.exe File opened for modification C:\Windows\SysWOW64\Jifgljce.exe Hmdjlheb.exe File created C:\Windows\SysWOW64\Eolncbml.dll 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe File opened for modification C:\Windows\SysWOW64\Maanbeim.exe Mifinclb.exe File created C:\Windows\SysWOW64\Oefihf32.exe Oojdflfm.exe File created C:\Windows\SysWOW64\Pndkbhgp.exe Pqpjidhf.exe File created C:\Windows\SysWOW64\Alggof32.dll Hdhljg32.exe File opened for modification C:\Windows\SysWOW64\Gfmbfj32.exe Fkeacald.exe File opened for modification C:\Windows\SysWOW64\Lnmbpq32.exe Jadhfl32.exe File created C:\Windows\SysWOW64\Odebgbfg.dll Meican32.exe File created C:\Windows\SysWOW64\Joklpgop.exe Jjlgap32.exe File created C:\Windows\SysWOW64\Enligb32.dll Liejmofi.exe File created C:\Windows\SysWOW64\Ojabdpgb.dll Mpfhjh32.exe File created C:\Windows\SysWOW64\Hpndab32.dll Phoano32.exe File created C:\Windows\SysWOW64\Elngpf32.dll Bcbacodp.exe File created C:\Windows\SysWOW64\Llojblgp.dll Bpkonp32.exe File opened for modification C:\Windows\SysWOW64\Dcbjpmbf.exe Dajhgf32.exe File created C:\Windows\SysWOW64\Aoaiog32.exe Pdqbmk32.exe File created C:\Windows\SysWOW64\Pfkjhgak.dll Agcdciah.exe File created C:\Windows\SysWOW64\Cmgokb32.exe Bgacmlff.exe File created C:\Windows\SysWOW64\Gfmbfj32.exe Fkeacald.exe File created C:\Windows\SysWOW64\Hmdjlheb.exe Gmamgh32.exe File created C:\Windows\SysWOW64\Lieinf32.dll Moaeaj32.exe File created C:\Windows\SysWOW64\Poffigqh.dll Pndkbhgp.exe File opened for modification C:\Windows\SysWOW64\Hdhljg32.exe Gjkbgo32.exe File opened for modification C:\Windows\SysWOW64\Phoano32.exe Okkeehlk.exe File opened for modification C:\Windows\SysWOW64\Bjgpejpb.exe Phoano32.exe File opened for modification C:\Windows\SysWOW64\Cjncelme.exe Clifdphn.exe File opened for modification C:\Windows\SysWOW64\Hmdjlheb.exe Gmamgh32.exe File created C:\Windows\SysWOW64\Ickmbjkb.dll Jadhfl32.exe File created C:\Windows\SysWOW64\Fdpbgi32.dll Maanbeim.exe File opened for modification C:\Windows\SysWOW64\Opegepae.exe Ndbgdq32.exe File created C:\Windows\SysWOW64\Lmgofd32.dll Mmnnlk32.exe File opened for modification C:\Windows\SysWOW64\Mpiljnig.exe Mfagaibg.exe File created C:\Windows\SysWOW64\Pdqbmk32.exe Pcaechmk.exe File created C:\Windows\SysWOW64\Liejmofi.exe Joklpgop.exe File created C:\Windows\SysWOW64\Bcbacodp.exe Bjgpejpb.exe File opened for modification C:\Windows\SysWOW64\Dajhgf32.exe Cjncelme.exe File created C:\Windows\SysWOW64\Baeoml32.dll Pcaechmk.exe File created C:\Windows\SysWOW64\Hedbgpid.dll Pdqbmk32.exe File created C:\Windows\SysWOW64\Kjmeok32.dll Mplhpngd.exe File created C:\Windows\SysWOW64\Blgkdffa.dll Dekdmjjo.exe File opened for modification C:\Windows\SysWOW64\Clifdphn.exe Chkmna32.exe File created C:\Windows\SysWOW64\Dekdmjjo.exe Ceikig32.exe File created C:\Windows\SysWOW64\Einkdege.dll Fbkdgm32.exe File created C:\Windows\SysWOW64\Dcbjpmbf.exe Dajhgf32.exe File created C:\Windows\SysWOW64\Jadhfl32.exe Jifgljce.exe File created C:\Windows\SysWOW64\Hgonlg32.dll Ldigbj32.exe File created C:\Windows\SysWOW64\Nepacg32.dll Hmdjlheb.exe File created C:\Windows\SysWOW64\Meican32.exe Mmnnlk32.exe File created C:\Windows\SysWOW64\Lllqbg32.dll Mifinclb.exe File created C:\Windows\SysWOW64\Qhifbk32.dll Oojdflfm.exe File opened for modification C:\Windows\SysWOW64\Qbmflj32.exe Pgolqmkn.exe File created C:\Windows\SysWOW64\Khfqpo32.dll Bakbbi32.exe File created C:\Windows\SysWOW64\Gjkbgo32.exe Fbkdgm32.exe File opened for modification C:\Windows\SysWOW64\Idjioffn.exe Hdhljg32.exe File created C:\Windows\SysWOW64\Bakbbi32.exe Qbmflj32.exe File opened for modification C:\Windows\SysWOW64\Chkmna32.exe Bpkonp32.exe File created C:\Windows\SysWOW64\Ohnamk32.exe Odllcheh.exe File opened for modification C:\Windows\SysWOW64\Cmgokb32.exe Bgacmlff.exe File opened for modification C:\Windows\SysWOW64\Oefihf32.exe Oojdflfm.exe File opened for modification C:\Windows\SysWOW64\Pqpjidhf.exe Oefihf32.exe File created C:\Windows\SysWOW64\Ibckdiln.dll Ejpflmkl.exe File created C:\Windows\SysWOW64\Bpkonp32.exe Bcbacodp.exe File created C:\Windows\SysWOW64\Dhqfko32.dll Dcbjpmbf.exe File opened for modification C:\Windows\SysWOW64\Pcaechmk.exe Ohnamk32.exe File created C:\Windows\SysWOW64\Bjgpejpb.exe Phoano32.exe File created C:\Windows\SysWOW64\Ldigbj32.exe Lnmbpq32.exe File opened for modification C:\Windows\SysWOW64\Odllcheh.exe Meican32.exe File created C:\Windows\SysWOW64\Eodgdl32.dll Bmbiao32.exe File created C:\Windows\SysWOW64\Jmffkfjo.dll Bbbnofja.exe File opened for modification C:\Windows\SysWOW64\Dekdmjjo.exe Ceikig32.exe File created C:\Windows\SysWOW64\Hdhljg32.exe Gjkbgo32.exe File opened for modification C:\Windows\SysWOW64\Joklpgop.exe Jjlgap32.exe File created C:\Windows\SysWOW64\Maokbp32.exe Mpfhjh32.exe File created C:\Windows\SysWOW64\Aqeblonq.exe Aoaiog32.exe File created C:\Windows\SysWOW64\Opegepae.exe Ndbgdq32.exe File created C:\Windows\SysWOW64\Ejpflmkl.exe Dekdmjjo.exe File created C:\Windows\SysWOW64\Mdollqfp.dll Bjgpejpb.exe File opened for modification C:\Windows\SysWOW64\Ehbpmcnk.exe Dcbjpmbf.exe File created C:\Windows\SysWOW64\Mdobdpek.dll Gmamgh32.exe File created C:\Windows\SysWOW64\Lboqmmai.dll Lnmbpq32.exe File created C:\Windows\SysWOW64\Maanbeim.exe Mifinclb.exe File created C:\Windows\SysWOW64\Hdqhcd32.dll Cjncelme.exe File created C:\Windows\SysWOW64\Nkgemj32.dll Mpiljnig.exe File created C:\Windows\SysWOW64\Qbmflj32.exe Pgolqmkn.exe File opened for modification C:\Windows\SysWOW64\Ejpflmkl.exe Dekdmjjo.exe File created C:\Windows\SysWOW64\Okkeehlk.exe Oacpmb32.exe File created C:\Windows\SysWOW64\Njnfngpp.dll Okkeehlk.exe File created C:\Windows\SysWOW64\Hjiebf32.dll Dajhgf32.exe File created C:\Windows\SysWOW64\Clifdphn.exe Chkmna32.exe File created C:\Windows\SysWOW64\Dgjofo32.dll Gfmbfj32.exe File opened for modification C:\Windows\SysWOW64\Oojdflfm.exe Opegepae.exe File created C:\Windows\SysWOW64\Mpilhj32.dll Qbmflj32.exe File opened for modification C:\Windows\SysWOW64\Liejmofi.exe Joklpgop.exe File opened for modification C:\Windows\SysWOW64\Mpfhjh32.exe Lfijfc32.exe File opened for modification C:\Windows\SysWOW64\Maokbp32.exe Mpfhjh32.exe File opened for modification C:\Windows\SysWOW64\Bcbacodp.exe Bjgpejpb.exe File opened for modification C:\Windows\SysWOW64\Ohnamk32.exe Odllcheh.exe File opened for modification C:\Windows\SysWOW64\Pdqbmk32.exe Pcaechmk.exe File opened for modification C:\Windows\SysWOW64\Bbbnofja.exe Bmbiao32.exe File opened for modification C:\Windows\SysWOW64\Lcpnpnef.exe 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe File opened for modification C:\Windows\SysWOW64\Jjlgap32.exe Idjioffn.exe File opened for modification C:\Windows\SysWOW64\Aqeblonq.exe Aoaiog32.exe File created C:\Windows\SysWOW64\Bgacmlff.exe Bbbnofja.exe File opened for modification C:\Windows\SysWOW64\Mfagaibg.exe Lcpnpnef.exe File opened for modification C:\Windows\SysWOW64\Ndbgdq32.exe Maanbeim.exe File created C:\Windows\SysWOW64\Cjadnb32.dll Fkeacald.exe File opened for modification C:\Windows\SysWOW64\Meican32.exe Mmnnlk32.exe File created C:\Windows\SysWOW64\Omklqm32.dll Jifgljce.exe File opened for modification C:\Windows\SysWOW64\Mmnnlk32.exe Ldigbj32.exe File created C:\Windows\SysWOW64\Nfkhgh32.dll Mfagaibg.exe File opened for modification C:\Windows\SysWOW64\Ceikig32.exe Bakbbi32.exe File created C:\Windows\SysWOW64\Fbkdgm32.exe Ejpflmkl.exe File created C:\Windows\SysWOW64\Mpfhjh32.exe Lfijfc32.exe File created C:\Windows\SysWOW64\Ehbpmcnk.exe Dcbjpmbf.exe File opened for modification C:\Windows\SysWOW64\Fkeacald.exe Ehbpmcnk.exe File opened for modification C:\Windows\SysWOW64\Bgacmlff.exe Bbbnofja.exe - Modifies registry class 189 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eolncbml.dll" 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibckdiln.dll" Ejpflmkl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gjkbgo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alggof32.dll" Hdhljg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pdqbmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Odllcheh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mifinclb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjijmkki.dll" Pqpjidhf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pgolqmkn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pgolqmkn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ceikig32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dekdmjjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lboqmmai.dll" Lnmbpq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Opegepae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khfqpo32.dll" Bakbbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fbkdgm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mpfhjh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Oojdflfm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Qbmflj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hepgfc32.dll" Clifdphn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Aoaiog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Agcdciah.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lieinf32.dll" Moaeaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ejpflmkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oacpmb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bpkonp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llojblgp.dll" Bpkonp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iblccddh.dll" Odllcheh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oefihf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pndkbhgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hdhljg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Oacpmb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oabmdd32.dll" Bgacmlff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Moaeaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omklqm32.dll" Jifgljce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jadhfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ldigbj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ohnamk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omhbkn32.dll" Lcpnpnef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blgkdffa.dll" Dekdmjjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njnfngpp.dll" Okkeehlk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hmdjlheb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Aoaiog32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bmbiao32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bbbnofja.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mpfhjh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Maokbp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdkdnnbh.dll" Maokbp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Clifdphn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfoghqbe.dll" Ehbpmcnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bmbiao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Einkdege.dll" Fbkdgm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqacnf32.dll" Jjlgap32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bjgpejpb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dajhgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bgacmlff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfkjhgak.dll" Agcdciah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkgemj32.dll" Mpiljnig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjmeok32.dll" Mplhpngd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjjncbob.dll" Ndbgdq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ejpflmkl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Okkeehlk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hmdjlheb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Odllcheh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jelldk32.dll" Ohnamk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lcpnpnef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mifinclb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opdpep32.dll" Gjkbgo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bcbacodp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bpkonp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Chkmna32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Meican32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831} 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Maanbeim.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jjlgap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Joklpgop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Phoano32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bcbacodp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dcbjpmbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fbkdgm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhqfko32.dll" Dcbjpmbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pcaechmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjhcmfpc.dll" Aqeblonq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dcbjpmbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdpbgi32.dll" Maanbeim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poffigqh.dll" Pndkbhgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Maokbp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdmeap32.dll" Oacpmb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpndab32.dll" Phoano32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bjgpejpb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dajhgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mfagaibg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jjlgap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Liejmofi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jifgljce.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lnmbpq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Phoano32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfkhgh32.dll" Mfagaibg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Opegepae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pndkbhgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpilhj32.dll" Qbmflj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gjkbgo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffojlnbq.dll" Idjioffn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Idjioffn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbjmgcml.dll" Opegepae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qbmflj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Idjioffn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gfmbfj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pcaechmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ceikig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adpjjqlj.dll" Lfijfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Meican32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mfagaibg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qhifbk32.dll" Oojdflfm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgecol32.dll" Ceikig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cjncelme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fkeacald.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gmamgh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmgofd32.dll" Mmnnlk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bgacmlff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Moaeaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ndbgdq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppjlfm32.dll" Pgolqmkn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgonlg32.dll" Ldigbj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odebgbfg.dll" Meican32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pdqbmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mpiljnig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lllqbg32.dll" Mifinclb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hdhljg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdobdpek.dll" Gmamgh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elngpf32.dll" Bcbacodp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mpiljnig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Maanbeim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oojdflfm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Oefihf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilkpdd32.dll" Oefihf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pqpjidhf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Liejmofi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jifgljce.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ldigbj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mmnnlk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Aqeblonq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bakbbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lfijfc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cjncelme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olekac32.dll" Aoaiog32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Agcdciah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojabdpgb.dll" Mpfhjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdollqfp.dll" Bjgpejpb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fkeacald.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baeoml32.dll" Pcaechmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmffkfjo.dll" Bbbnofja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hedbgpid.dll" Pdqbmk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mplhpngd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ndbgdq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pqpjidhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bakbbi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Chkmna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdqhcd32.dll" Cjncelme.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ehbpmcnk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Aqeblonq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bbbnofja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iepqqp32.dll" Joklpgop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Okkeehlk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mplhpngd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lfijfc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Clifdphn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjadnb32.dll" Fkeacald.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gmamgh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nepacg32.dll" Hmdjlheb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lcpnpnef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgdiom32.dll" Chkmna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjiebf32.dll" Dajhgf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gfmbfj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jadhfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ohnamk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mmnnlk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dekdmjjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Joklpgop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enligb32.dll" Liejmofi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ehbpmcnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgjofo32.dll" Gfmbfj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ickmbjkb.dll" Jadhfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lnmbpq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eodgdl32.dll" Bmbiao32.exe - Suspicious use of WriteProcessMemory 244 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1672 2028 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe 26 PID 2028 wrote to memory of 1672 2028 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe 26 PID 2028 wrote to memory of 1672 2028 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe 26 PID 2028 wrote to memory of 1672 2028 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe 26 PID 1672 wrote to memory of 892 1672 Lcpnpnef.exe 27 PID 1672 wrote to memory of 892 1672 Lcpnpnef.exe 27 PID 1672 wrote to memory of 892 1672 Lcpnpnef.exe 27 PID 1672 wrote to memory of 892 1672 Lcpnpnef.exe 27 PID 892 wrote to memory of 1992 892 Mfagaibg.exe 28 PID 892 wrote to memory of 1992 892 Mfagaibg.exe 28 PID 892 wrote to memory of 1992 892 Mfagaibg.exe 28 PID 892 wrote to memory of 1992 892 Mfagaibg.exe 28 PID 1992 wrote to memory of 1976 1992 Mpiljnig.exe 29 PID 1992 wrote to memory of 1976 1992 Mpiljnig.exe 29 PID 1992 wrote to memory of 1976 1992 Mpiljnig.exe 29 PID 1992 wrote to memory of 1976 1992 Mpiljnig.exe 29 PID 1976 wrote to memory of 1796 1976 Mplhpngd.exe 30 PID 1976 wrote to memory of 1796 1976 Mplhpngd.exe 30 PID 1976 wrote to memory of 1796 1976 Mplhpngd.exe 30 PID 1976 wrote to memory of 1796 1976 Mplhpngd.exe 30 PID 1796 wrote to memory of 1752 1796 Moaeaj32.exe 31 PID 1796 wrote to memory of 1752 1796 Moaeaj32.exe 31 PID 1796 wrote to memory of 1752 1796 Moaeaj32.exe 31 PID 1796 wrote to memory of 1752 1796 Moaeaj32.exe 31 PID 1752 wrote to memory of 1712 1752 Mifinclb.exe 32 PID 1752 wrote to memory of 1712 1752 Mifinclb.exe 32 PID 1752 wrote to memory of 1712 1752 Mifinclb.exe 32 PID 1752 wrote to memory of 1712 1752 Mifinclb.exe 32 PID 1712 wrote to memory of 556 1712 Maanbeim.exe 33 PID 1712 wrote to memory of 556 1712 Maanbeim.exe 33 PID 1712 wrote to memory of 556 1712 Maanbeim.exe 33 PID 1712 wrote to memory of 556 1712 Maanbeim.exe 33 PID 556 wrote to memory of 1840 556 Ndbgdq32.exe 34 PID 556 wrote to memory of 1840 556 Ndbgdq32.exe 34 PID 556 wrote to memory of 1840 556 Ndbgdq32.exe 34 PID 556 wrote to memory of 1840 556 Ndbgdq32.exe 34 PID 1840 wrote to memory of 2000 1840 Opegepae.exe 36 PID 1840 wrote to memory of 2000 1840 Opegepae.exe 36 PID 1840 wrote to memory of 2000 1840 Opegepae.exe 36 PID 1840 wrote to memory of 2000 1840 Opegepae.exe 36 PID 2000 wrote to memory of 408 2000 Oojdflfm.exe 37 PID 2000 wrote to memory of 408 2000 Oojdflfm.exe 37 PID 2000 wrote to memory of 408 2000 Oojdflfm.exe 37 PID 2000 wrote to memory of 408 2000 Oojdflfm.exe 37 PID 408 wrote to memory of 1516 408 Oefihf32.exe 39 PID 408 wrote to memory of 1516 408 Oefihf32.exe 39 PID 408 wrote to memory of 1516 408 Oefihf32.exe 39 PID 408 wrote to memory of 1516 408 Oefihf32.exe 39 PID 1516 wrote to memory of 1076 1516 Pqpjidhf.exe 40 PID 1516 wrote to memory of 1076 1516 Pqpjidhf.exe 40 PID 1516 wrote to memory of 1076 1516 Pqpjidhf.exe 40 PID 1516 wrote to memory of 1076 1516 Pqpjidhf.exe 40 PID 1076 wrote to memory of 1160 1076 Pndkbhgp.exe 42 PID 1076 wrote to memory of 1160 1076 Pndkbhgp.exe 42 PID 1076 wrote to memory of 1160 1076 Pndkbhgp.exe 42 PID 1076 wrote to memory of 1160 1076 Pndkbhgp.exe 42 PID 1160 wrote to memory of 272 1160 Pgolqmkn.exe 43 PID 1160 wrote to memory of 272 1160 Pgolqmkn.exe 43 PID 1160 wrote to memory of 272 1160 Pgolqmkn.exe 43 PID 1160 wrote to memory of 272 1160 Pgolqmkn.exe 43 PID 272 wrote to memory of 1720 272 Qbmflj32.exe 44 PID 272 wrote to memory of 1720 272 Qbmflj32.exe 44 PID 272 wrote to memory of 1720 272 Qbmflj32.exe 44 PID 272 wrote to memory of 1720 272 Qbmflj32.exe 44 PID 1720 wrote to memory of 576 1720 Bakbbi32.exe 45 PID 1720 wrote to memory of 576 1720 Bakbbi32.exe 45 PID 1720 wrote to memory of 576 1720 Bakbbi32.exe 45 PID 1720 wrote to memory of 576 1720 Bakbbi32.exe 45 PID 576 wrote to memory of 1880 576 Ceikig32.exe 46 PID 576 wrote to memory of 1880 576 Ceikig32.exe 46 PID 576 wrote to memory of 1880 576 Ceikig32.exe 46 PID 576 wrote to memory of 1880 576 Ceikig32.exe 46 PID 1880 wrote to memory of 1184 1880 Dekdmjjo.exe 47 PID 1880 wrote to memory of 1184 1880 Dekdmjjo.exe 47 PID 1880 wrote to memory of 1184 1880 Dekdmjjo.exe 47 PID 1880 wrote to memory of 1184 1880 Dekdmjjo.exe 47 PID 1184 wrote to memory of 1984 1184 Ejpflmkl.exe 48 PID 1184 wrote to memory of 1984 1184 Ejpflmkl.exe 48 PID 1184 wrote to memory of 1984 1184 Ejpflmkl.exe 48 PID 1184 wrote to memory of 1984 1184 Ejpflmkl.exe 48 PID 1984 wrote to memory of 1972 1984 Fbkdgm32.exe 49 PID 1984 wrote to memory of 1972 1984 Fbkdgm32.exe 49 PID 1984 wrote to memory of 1972 1984 Fbkdgm32.exe 49 PID 1984 wrote to memory of 1972 1984 Fbkdgm32.exe 49 PID 1972 wrote to memory of 2076 1972 Gjkbgo32.exe 50 PID 1972 wrote to memory of 2076 1972 Gjkbgo32.exe 50 PID 1972 wrote to memory of 2076 1972 Gjkbgo32.exe 50 PID 1972 wrote to memory of 2076 1972 Gjkbgo32.exe 50 PID 2076 wrote to memory of 2104 2076 Hdhljg32.exe 51 PID 2076 wrote to memory of 2104 2076 Hdhljg32.exe 51 PID 2076 wrote to memory of 2104 2076 Hdhljg32.exe 51 PID 2076 wrote to memory of 2104 2076 Hdhljg32.exe 51 PID 2104 wrote to memory of 2132 2104 Idjioffn.exe 52 PID 2104 wrote to memory of 2132 2104 Idjioffn.exe 52 PID 2104 wrote to memory of 2132 2104 Idjioffn.exe 52 PID 2104 wrote to memory of 2132 2104 Idjioffn.exe 52 PID 2132 wrote to memory of 2160 2132 Jjlgap32.exe 53 PID 2132 wrote to memory of 2160 2132 Jjlgap32.exe 53 PID 2132 wrote to memory of 2160 2132 Jjlgap32.exe 53 PID 2132 wrote to memory of 2160 2132 Jjlgap32.exe 53 PID 2160 wrote to memory of 2188 2160 Joklpgop.exe 54 PID 2160 wrote to memory of 2188 2160 Joklpgop.exe 54 PID 2160 wrote to memory of 2188 2160 Joklpgop.exe 54 PID 2160 wrote to memory of 2188 2160 Joklpgop.exe 54 PID 2188 wrote to memory of 2216 2188 Liejmofi.exe 55 PID 2188 wrote to memory of 2216 2188 Liejmofi.exe 55 PID 2188 wrote to memory of 2216 2188 Liejmofi.exe 55 PID 2188 wrote to memory of 2216 2188 Liejmofi.exe 55 PID 2216 wrote to memory of 2244 2216 Lfijfc32.exe 56 PID 2216 wrote to memory of 2244 2216 Lfijfc32.exe 56 PID 2216 wrote to memory of 2244 2216 Lfijfc32.exe 56 PID 2216 wrote to memory of 2244 2216 Lfijfc32.exe 56 PID 2244 wrote to memory of 2272 2244 Mpfhjh32.exe 57 PID 2244 wrote to memory of 2272 2244 Mpfhjh32.exe 57 PID 2244 wrote to memory of 2272 2244 Mpfhjh32.exe 57 PID 2244 wrote to memory of 2272 2244 Mpfhjh32.exe 57 PID 2272 wrote to memory of 2300 2272 Maokbp32.exe 58 PID 2272 wrote to memory of 2300 2272 Maokbp32.exe 58 PID 2272 wrote to memory of 2300 2272 Maokbp32.exe 58 PID 2272 wrote to memory of 2300 2272 Maokbp32.exe 58 PID 2300 wrote to memory of 2328 2300 Oacpmb32.exe 59 PID 2300 wrote to memory of 2328 2300 Oacpmb32.exe 59 PID 2300 wrote to memory of 2328 2300 Oacpmb32.exe 59 PID 2300 wrote to memory of 2328 2300 Oacpmb32.exe 59 PID 2328 wrote to memory of 2356 2328 Okkeehlk.exe 60 PID 2328 wrote to memory of 2356 2328 Okkeehlk.exe 60 PID 2328 wrote to memory of 2356 2328 Okkeehlk.exe 60 PID 2328 wrote to memory of 2356 2328 Okkeehlk.exe 60 PID 2356 wrote to memory of 2396 2356 Phoano32.exe 61 PID 2356 wrote to memory of 2396 2356 Phoano32.exe 61 PID 2356 wrote to memory of 2396 2356 Phoano32.exe 61 PID 2356 wrote to memory of 2396 2356 Phoano32.exe 61 PID 2396 wrote to memory of 2424 2396 Bjgpejpb.exe 62 PID 2396 wrote to memory of 2424 2396 Bjgpejpb.exe 62 PID 2396 wrote to memory of 2424 2396 Bjgpejpb.exe 62 PID 2396 wrote to memory of 2424 2396 Bjgpejpb.exe 62 PID 2424 wrote to memory of 2452 2424 Bcbacodp.exe 63 PID 2424 wrote to memory of 2452 2424 Bcbacodp.exe 63 PID 2424 wrote to memory of 2452 2424 Bcbacodp.exe 63 PID 2424 wrote to memory of 2452 2424 Bcbacodp.exe 63 PID 2452 wrote to memory of 2480 2452 Bpkonp32.exe 64 PID 2452 wrote to memory of 2480 2452 Bpkonp32.exe 64 PID 2452 wrote to memory of 2480 2452 Bpkonp32.exe 64 PID 2452 wrote to memory of 2480 2452 Bpkonp32.exe 64 PID 2480 wrote to memory of 2508 2480 Chkmna32.exe 65 PID 2480 wrote to memory of 2508 2480 Chkmna32.exe 65 PID 2480 wrote to memory of 2508 2480 Chkmna32.exe 65 PID 2480 wrote to memory of 2508 2480 Chkmna32.exe 65 PID 2508 wrote to memory of 2536 2508 Clifdphn.exe 66 PID 2508 wrote to memory of 2536 2508 Clifdphn.exe 66 PID 2508 wrote to memory of 2536 2508 Clifdphn.exe 66 PID 2508 wrote to memory of 2536 2508 Clifdphn.exe 66 PID 2536 wrote to memory of 2564 2536 Cjncelme.exe 67 PID 2536 wrote to memory of 2564 2536 Cjncelme.exe 67 PID 2536 wrote to memory of 2564 2536 Cjncelme.exe 67 PID 2536 wrote to memory of 2564 2536 Cjncelme.exe 67 PID 2564 wrote to memory of 2592 2564 Dajhgf32.exe 68 PID 2564 wrote to memory of 2592 2564 Dajhgf32.exe 68 PID 2564 wrote to memory of 2592 2564 Dajhgf32.exe 68 PID 2564 wrote to memory of 2592 2564 Dajhgf32.exe 68 PID 2592 wrote to memory of 2620 2592 Dcbjpmbf.exe 69 PID 2592 wrote to memory of 2620 2592 Dcbjpmbf.exe 69 PID 2592 wrote to memory of 2620 2592 Dcbjpmbf.exe 69 PID 2592 wrote to memory of 2620 2592 Dcbjpmbf.exe 69 PID 2620 wrote to memory of 2648 2620 Ehbpmcnk.exe 70 PID 2620 wrote to memory of 2648 2620 Ehbpmcnk.exe 70 PID 2620 wrote to memory of 2648 2620 Ehbpmcnk.exe 70 PID 2620 wrote to memory of 2648 2620 Ehbpmcnk.exe 70 PID 2648 wrote to memory of 2676 2648 Fkeacald.exe 71 PID 2648 wrote to memory of 2676 2648 Fkeacald.exe 71 PID 2648 wrote to memory of 2676 2648 Fkeacald.exe 71 PID 2648 wrote to memory of 2676 2648 Fkeacald.exe 71 PID 2676 wrote to memory of 2704 2676 Gfmbfj32.exe 72 PID 2676 wrote to memory of 2704 2676 Gfmbfj32.exe 72 PID 2676 wrote to memory of 2704 2676 Gfmbfj32.exe 72 PID 2676 wrote to memory of 2704 2676 Gfmbfj32.exe 72 PID 2704 wrote to memory of 2732 2704 Gmamgh32.exe 73 PID 2704 wrote to memory of 2732 2704 Gmamgh32.exe 73 PID 2704 wrote to memory of 2732 2704 Gmamgh32.exe 73 PID 2704 wrote to memory of 2732 2704 Gmamgh32.exe 73 PID 2732 wrote to memory of 2760 2732 Hmdjlheb.exe 74 PID 2732 wrote to memory of 2760 2732 Hmdjlheb.exe 74 PID 2732 wrote to memory of 2760 2732 Hmdjlheb.exe 74 PID 2732 wrote to memory of 2760 2732 Hmdjlheb.exe 74 PID 2760 wrote to memory of 2788 2760 Jifgljce.exe 75 PID 2760 wrote to memory of 2788 2760 Jifgljce.exe 75 PID 2760 wrote to memory of 2788 2760 Jifgljce.exe 75 PID 2760 wrote to memory of 2788 2760 Jifgljce.exe 75 PID 2788 wrote to memory of 2816 2788 Jadhfl32.exe 76 PID 2788 wrote to memory of 2816 2788 Jadhfl32.exe 76 PID 2788 wrote to memory of 2816 2788 Jadhfl32.exe 76 PID 2788 wrote to memory of 2816 2788 Jadhfl32.exe 76 PID 2816 wrote to memory of 2844 2816 Lnmbpq32.exe 77 PID 2816 wrote to memory of 2844 2816 Lnmbpq32.exe 77 PID 2816 wrote to memory of 2844 2816 Lnmbpq32.exe 77 PID 2816 wrote to memory of 2844 2816 Lnmbpq32.exe 77 PID 2844 wrote to memory of 2872 2844 Ldigbj32.exe 78 PID 2844 wrote to memory of 2872 2844 Ldigbj32.exe 78 PID 2844 wrote to memory of 2872 2844 Ldigbj32.exe 78 PID 2844 wrote to memory of 2872 2844 Ldigbj32.exe 78 PID 2872 wrote to memory of 2900 2872 Mmnnlk32.exe 79 PID 2872 wrote to memory of 2900 2872 Mmnnlk32.exe 79 PID 2872 wrote to memory of 2900 2872 Mmnnlk32.exe 79 PID 2872 wrote to memory of 2900 2872 Mmnnlk32.exe 79 PID 2900 wrote to memory of 2928 2900 Meican32.exe 80 PID 2900 wrote to memory of 2928 2900 Meican32.exe 80 PID 2900 wrote to memory of 2928 2900 Meican32.exe 80 PID 2900 wrote to memory of 2928 2900 Meican32.exe 80 PID 2928 wrote to memory of 2956 2928 Odllcheh.exe 81 PID 2928 wrote to memory of 2956 2928 Odllcheh.exe 81 PID 2928 wrote to memory of 2956 2928 Odllcheh.exe 81 PID 2928 wrote to memory of 2956 2928 Odllcheh.exe 81 PID 2956 wrote to memory of 2984 2956 Ohnamk32.exe 82 PID 2956 wrote to memory of 2984 2956 Ohnamk32.exe 82 PID 2956 wrote to memory of 2984 2956 Ohnamk32.exe 82 PID 2956 wrote to memory of 2984 2956 Ohnamk32.exe 82 PID 2984 wrote to memory of 3012 2984 Pcaechmk.exe 83 PID 2984 wrote to memory of 3012 2984 Pcaechmk.exe 83 PID 2984 wrote to memory of 3012 2984 Pcaechmk.exe 83 PID 2984 wrote to memory of 3012 2984 Pcaechmk.exe 83 PID 3012 wrote to memory of 3040 3012 Pdqbmk32.exe 84 PID 3012 wrote to memory of 3040 3012 Pdqbmk32.exe 84 PID 3012 wrote to memory of 3040 3012 Pdqbmk32.exe 84 PID 3012 wrote to memory of 3040 3012 Pdqbmk32.exe 84 PID 3040 wrote to memory of 3068 3040 Aoaiog32.exe 85 PID 3040 wrote to memory of 3068 3040 Aoaiog32.exe 85 PID 3040 wrote to memory of 3068 3040 Aoaiog32.exe 85 PID 3040 wrote to memory of 3068 3040 Aoaiog32.exe 85 PID 3068 wrote to memory of 2092 3068 Aqeblonq.exe 86 PID 3068 wrote to memory of 2092 3068 Aqeblonq.exe 86 PID 3068 wrote to memory of 2092 3068 Aqeblonq.exe 86 PID 3068 wrote to memory of 2092 3068 Aqeblonq.exe 86 PID 2092 wrote to memory of 436 2092 Agcdciah.exe 87 PID 2092 wrote to memory of 436 2092 Agcdciah.exe 87 PID 2092 wrote to memory of 436 2092 Agcdciah.exe 87 PID 2092 wrote to memory of 436 2092 Agcdciah.exe 87 PID 436 wrote to memory of 1464 436 Bmbiao32.exe 88 PID 436 wrote to memory of 1464 436 Bmbiao32.exe 88 PID 436 wrote to memory of 1464 436 Bmbiao32.exe 88 PID 436 wrote to memory of 1464 436 Bmbiao32.exe 88 PID 1464 wrote to memory of 1688 1464 Bbbnofja.exe 89 PID 1464 wrote to memory of 1688 1464 Bbbnofja.exe 89 PID 1464 wrote to memory of 1688 1464 Bbbnofja.exe 89 PID 1464 wrote to memory of 1688 1464 Bbbnofja.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe"C:\Users\Admin\AppData\Local\Temp\04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\Lcpnpnef.exeC:\Windows\system32\Lcpnpnef.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\Mfagaibg.exeC:\Windows\system32\Mfagaibg.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\Mpiljnig.exeC:\Windows\system32\Mpiljnig.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\Mplhpngd.exeC:\Windows\system32\Mplhpngd.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\Moaeaj32.exeC:\Windows\system32\Moaeaj32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\Mifinclb.exeC:\Windows\system32\Mifinclb.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\Maanbeim.exeC:\Windows\system32\Maanbeim.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\Ndbgdq32.exeC:\Windows\system32\Ndbgdq32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\Opegepae.exeC:\Windows\system32\Opegepae.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\Oojdflfm.exeC:\Windows\system32\Oojdflfm.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\Oefihf32.exeC:\Windows\system32\Oefihf32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\SysWOW64\Pqpjidhf.exeC:\Windows\system32\Pqpjidhf.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\Pndkbhgp.exeC:\Windows\system32\Pndkbhgp.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\Pgolqmkn.exeC:\Windows\system32\Pgolqmkn.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\Qbmflj32.exeC:\Windows\system32\Qbmflj32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Windows\SysWOW64\Bakbbi32.exeC:\Windows\system32\Bakbbi32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1720 -
C:\Windows\SysWOW64\Ceikig32.exeC:\Windows\system32\Ceikig32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:576 -
C:\Windows\SysWOW64\Dekdmjjo.exeC:\Windows\system32\Dekdmjjo.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1880 -
C:\Windows\SysWOW64\Ejpflmkl.exeC:\Windows\system32\Ejpflmkl.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1184 -
C:\Windows\SysWOW64\Fbkdgm32.exeC:\Windows\system32\Fbkdgm32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1984 -
C:\Windows\SysWOW64\Gjkbgo32.exeC:\Windows\system32\Gjkbgo32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1972 -
C:\Windows\SysWOW64\Hdhljg32.exeC:\Windows\system32\Hdhljg32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2076 -
C:\Windows\SysWOW64\Idjioffn.exeC:\Windows\system32\Idjioffn.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2104 -
C:\Windows\SysWOW64\Jjlgap32.exeC:\Windows\system32\Jjlgap32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2132 -
C:\Windows\SysWOW64\Joklpgop.exeC:\Windows\system32\Joklpgop.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2160 -
C:\Windows\SysWOW64\Liejmofi.exeC:\Windows\system32\Liejmofi.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2188 -
C:\Windows\SysWOW64\Lfijfc32.exeC:\Windows\system32\Lfijfc32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2216 -
C:\Windows\SysWOW64\Mpfhjh32.exeC:\Windows\system32\Mpfhjh32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2244 -
C:\Windows\SysWOW64\Maokbp32.exeC:\Windows\system32\Maokbp32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2272 -
C:\Windows\SysWOW64\Oacpmb32.exeC:\Windows\system32\Oacpmb32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2300 -
C:\Windows\SysWOW64\Okkeehlk.exeC:\Windows\system32\Okkeehlk.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2328 -
C:\Windows\SysWOW64\Phoano32.exeC:\Windows\system32\Phoano32.exe33⤵
- Executes dropped EXE
PID:2356 -
C:\Windows\SysWOW64\Bjgpejpb.exeC:\Windows\system32\Bjgpejpb.exe34⤵
- Executes dropped EXE
- Modifies registry class
PID:2396 -
C:\Windows\SysWOW64\Bcbacodp.exeC:\Windows\system32\Bcbacodp.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2424 -
C:\Windows\SysWOW64\Bpkonp32.exeC:\Windows\system32\Bpkonp32.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2452 -
C:\Windows\SysWOW64\Chkmna32.exeC:\Windows\system32\Chkmna32.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2480 -
C:\Windows\SysWOW64\Clifdphn.exeC:\Windows\system32\Clifdphn.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2508 -
C:\Windows\SysWOW64\Cjncelme.exeC:\Windows\system32\Cjncelme.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2536 -
C:\Windows\SysWOW64\Dajhgf32.exeC:\Windows\system32\Dajhgf32.exe40⤵
- Executes dropped EXE
- Modifies registry class
PID:2564 -
C:\Windows\SysWOW64\Dcbjpmbf.exeC:\Windows\system32\Dcbjpmbf.exe41⤵
- Executes dropped EXE
PID:2592 -
C:\Windows\SysWOW64\Ehbpmcnk.exeC:\Windows\system32\Ehbpmcnk.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2620 -
C:\Windows\SysWOW64\Fkeacald.exeC:\Windows\system32\Fkeacald.exe43⤵
- Executes dropped EXE
PID:2648 -
C:\Windows\SysWOW64\Gfmbfj32.exeC:\Windows\system32\Gfmbfj32.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2676 -
C:\Windows\SysWOW64\Gmamgh32.exeC:\Windows\system32\Gmamgh32.exe45⤵
- Executes dropped EXE
PID:2704 -
C:\Windows\SysWOW64\Hmdjlheb.exeC:\Windows\system32\Hmdjlheb.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2732 -
C:\Windows\SysWOW64\Jifgljce.exeC:\Windows\system32\Jifgljce.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2760 -
C:\Windows\SysWOW64\Jadhfl32.exeC:\Windows\system32\Jadhfl32.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2788 -
C:\Windows\SysWOW64\Lnmbpq32.exeC:\Windows\system32\Lnmbpq32.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2816 -
C:\Windows\SysWOW64\Ldigbj32.exeC:\Windows\system32\Ldigbj32.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2844 -
C:\Windows\SysWOW64\Mmnnlk32.exeC:\Windows\system32\Mmnnlk32.exe51⤵
- Executes dropped EXE
PID:2872 -
C:\Windows\SysWOW64\Meican32.exeC:\Windows\system32\Meican32.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2900 -
C:\Windows\SysWOW64\Odllcheh.exeC:\Windows\system32\Odllcheh.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2928 -
C:\Windows\SysWOW64\Ohnamk32.exeC:\Windows\system32\Ohnamk32.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2956 -
C:\Windows\SysWOW64\Pcaechmk.exeC:\Windows\system32\Pcaechmk.exe55⤵
- Executes dropped EXE
PID:2984 -
C:\Windows\SysWOW64\Pdqbmk32.exeC:\Windows\system32\Pdqbmk32.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3012 -
C:\Windows\SysWOW64\Aoaiog32.exeC:\Windows\system32\Aoaiog32.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3040 -
C:\Windows\SysWOW64\Aqeblonq.exeC:\Windows\system32\Aqeblonq.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3068 -
C:\Windows\SysWOW64\Agcdciah.exeC:\Windows\system32\Agcdciah.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2092 -
C:\Windows\SysWOW64\Bmbiao32.exeC:\Windows\system32\Bmbiao32.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:436 -
C:\Windows\SysWOW64\Bbbnofja.exeC:\Windows\system32\Bbbnofja.exe61⤵
- Executes dropped EXE
- Modifies registry class
PID:1464 -
C:\Windows\SysWOW64\Bgacmlff.exeC:\Windows\system32\Bgacmlff.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1688 -
C:\Windows\SysWOW64\Cmgokb32.exeC:\Windows\system32\Cmgokb32.exe63⤵PID:2232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-