Analysis
- max time kernel
9s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:29
Static task
static1
Behavioral task
behavioral1
Sample
04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8.exe
- Size 1.7MB
- Sample201109-pbpps1qcr2
- SHA256 04cd1121cbd6806dbf10029bbd79ee4dd45aa018177a1cf5f75232c22651bca8
- MD5 384ed7dfc1defa37a8def6dddad029f3
- SHA1 9ef33f4f2d27d99f35f1528e2820547436443455
- SHA512 3ec9b760041c077afc928c7924a82e3200e45193056bb02d49fa8d787be316d4e080c452e352501929f30b5464b45619ca9b730a21bf5304837714d9379eb7de
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs
- Executes dropped EXE 39 IoCs
pid Process 4944 Process not Found 4992 Fdmpgnoc.exe 5032 Gmhafc32.exe 5100 Gklaogbk.exe 3004 Gianpc32.exe 1856 Gmogfb32.exe 3568 Gggkogcj.exe 2848 Hndpaaid.exe 4196 Hnfmgaga.exe 716 Hgoapf32.exe 3292 Hpgfil32.exe 4164 Hpicnl32.exe 4068 Hnmchp32.exe 3048 Iaklnn32.exe 660 Ippiok32.exe 928 Iapeincj.exe 888 Ijkjmppe.exe 1168 Igojgd32.exe 1292 Jjpcho32.exe 1396 Jdlnfg32.exe 1624 Kkmldp32.exe 1792 Lkdbdo32.exe 1592 Limliclo.exe 4052 Mbapnghb.exe 4012 Nedfea32.exe 4364 Nbhfnf32.exe 4380 Njckbh32.exe 4440 Noadif32.exe 4416 Oikaaoam.exe 2252 Piddgmib.exe 2520 Aljpke32.exe 2712 Bfcddkkk.exe 2924 Bajeilpp.exe 3096 Bonebpoi.exe 3868 Bkdfga32.exe 4612 Bkiobpah.exe 4616 Ckklhp32.exe 4236 Colacn32.exe 188 Dcqpjkch.exe - Drops file in System32 directory 114 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Ckklhp32.exe Bkiobpah.exe File created C:\Windows\SysWOW64\Dekjjijk.dll Colacn32.exe File created C:\Windows\SysWOW64\Ckcpldna.dll Igojgd32.exe File opened for modification C:\Windows\SysWOW64\Hnmchp32.exe Hpicnl32.exe File opened for modification C:\Windows\SysWOW64\Bajeilpp.exe Bfcddkkk.exe File opened for modification C:\Windows\SysWOW64\Hgoapf32.exe Hnfmgaga.exe File created C:\Windows\SysWOW64\Gipfeajm.dll Ijkjmppe.exe File created C:\Windows\SysWOW64\Fqfnai32.dll Nbhfnf32.exe File created C:\Windows\SysWOW64\Flkljj32.dll Hgoapf32.exe File created C:\Windows\SysWOW64\Piddgmib.exe Oikaaoam.exe File created C:\Windows\SysWOW64\Agedpn32.dll Piddgmib.exe File opened for modification C:\Windows\SysWOW64\Bfcddkkk.exe Aljpke32.exe File opened for modification C:\Windows\SysWOW64\Bonebpoi.exe Bajeilpp.exe File created C:\Windows\SysWOW64\Hnfmgaga.exe Hndpaaid.exe File opened for modification C:\Windows\SysWOW64\Jjpcho32.exe Igojgd32.exe File created C:\Windows\SysWOW64\Hpgfil32.exe Hgoapf32.exe File created C:\Windows\SysWOW64\Hnmchp32.exe Hpicnl32.exe File created C:\Windows\SysWOW64\Icqdkp32.dll Hpicnl32.exe File created C:\Windows\SysWOW64\Gggkogcj.exe Gmogfb32.exe File created C:\Windows\SysWOW64\Lkdbdo32.exe Kkmldp32.exe File created C:\Windows\SysWOW64\Nbhfnf32.exe Nedfea32.exe File created C:\Windows\SysWOW64\Nhogei32.dll Bajeilpp.exe File opened for modification C:\Windows\SysWOW64\Colacn32.exe Ckklhp32.exe File opened for modification C:\Windows\SysWOW64\Gklaogbk.exe Gmhafc32.exe File created C:\Windows\SysWOW64\Noadif32.exe Njckbh32.exe File created C:\Windows\SysWOW64\Bajeilpp.exe Bfcddkkk.exe File opened for modification C:\Windows\SysWOW64\Hpicnl32.exe Hpgfil32.exe File created C:\Windows\SysWOW64\Pnkeag32.dll Bkiobpah.exe File opened for modification C:\Windows\SysWOW64\Bkiobpah.exe Bkdfga32.exe File created C:\Windows\SysWOW64\Lafhch32.dll Hpgfil32.exe File created C:\Windows\SysWOW64\Iapeincj.exe Ippiok32.exe File created C:\Windows\SysWOW64\Jppbiiko.dll Jjpcho32.exe File created C:\Windows\SysWOW64\Aeldcgam.dll Lkdbdo32.exe File created C:\Windows\SysWOW64\Lmmjcd32.dll Process not Found File opened for modification C:\Windows\SysWOW64\Ippiok32.exe Iaklnn32.exe File created C:\Windows\SysWOW64\Fhedilhj.dll Iaklnn32.exe File created C:\Windows\SysWOW64\Nedfea32.exe Mbapnghb.exe File opened for modification C:\Windows\SysWOW64\Oikaaoam.exe Noadif32.exe File opened for modification C:\Windows\SysWOW64\Hndpaaid.exe Gggkogcj.exe File opened for modification C:\Windows\SysWOW64\Aljpke32.exe Piddgmib.exe File opened for modification C:\Windows\SysWOW64\Njckbh32.exe Nbhfnf32.exe File opened for modification C:\Windows\SysWOW64\Hnfmgaga.exe Hndpaaid.exe File opened for modification C:\Windows\SysWOW64\Igojgd32.exe Ijkjmppe.exe File opened for modification C:\Windows\SysWOW64\Noadif32.exe Njckbh32.exe File created C:\Windows\SysWOW64\Bfcddkkk.exe Aljpke32.exe File created C:\Windows\SysWOW64\Gkfffdmi.dll Gmhafc32.exe File created C:\Windows\SysWOW64\Jgnpji32.dll Bfcddkkk.exe File created C:\Windows\SysWOW64\Ckklhp32.exe Bkiobpah.exe File created C:\Windows\SysWOW64\Kmfldk32.dll Iapeincj.exe File opened for modification C:\Windows\SysWOW64\Nedfea32.exe Mbapnghb.exe File created C:\Windows\SysWOW64\Bkdfga32.exe Bonebpoi.exe File created C:\Windows\SysWOW64\Gklaogbk.exe Gmhafc32.exe File created C:\Windows\SysWOW64\Iaklnn32.exe Hnmchp32.exe File created C:\Windows\SysWOW64\Kkknep32.dll Fdmpgnoc.exe File opened for modification C:\Windows\SysWOW64\Iapeincj.exe Ippiok32.exe File created C:\Windows\SysWOW64\Jdlnfg32.exe Jjpcho32.exe File opened for modification C:\Windows\SysWOW64\Limliclo.exe Lkdbdo32.exe File created C:\Windows\SysWOW64\Gninip32.dll Ckklhp32.exe File created C:\Windows\SysWOW64\Gcmkfhdp.dll Gmogfb32.exe File created C:\Windows\SysWOW64\Nnkplgkf.dll Gggkogcj.exe File created C:\Windows\SysWOW64\Mbapnghb.exe Limliclo.exe File opened for modification C:\Windows\SysWOW64\Mbapnghb.exe Limliclo.exe File opened for modification C:\Windows\SysWOW64\Fdmpgnoc.exe Process not Found File created C:\Windows\SysWOW64\Hndpaaid.exe Gggkogcj.exe File opened for modification C:\Windows\SysWOW64\Lkdbdo32.exe Kkmldp32.exe File created C:\Windows\SysWOW64\Limliclo.exe Lkdbdo32.exe File created C:\Windows\SysWOW64\Bonebpoi.exe Bajeilpp.exe File created C:\Windows\SysWOW64\Olkmee32.dll Bonebpoi.exe File opened for modification C:\Windows\SysWOW64\Gianpc32.exe Gklaogbk.exe File created C:\Windows\SysWOW64\Nllbpq32.dll Mbapnghb.exe File created C:\Windows\SysWOW64\Gipmhjhb.dll Noadif32.exe File created C:\Windows\SysWOW64\Dmflcdcg.dll Oikaaoam.exe File opened for modification C:\Windows\SysWOW64\Gggkogcj.exe Gmogfb32.exe File created C:\Windows\SysWOW64\Hpicnl32.exe Hpgfil32.exe File opened for modification C:\Windows\SysWOW64\Iaklnn32.exe Hnmchp32.exe File opened for modification C:\Windows\SysWOW64\Ijkjmppe.exe Iapeincj.exe File created C:\Windows\SysWOW64\Kkmldp32.exe Jdlnfg32.exe File created C:\Windows\SysWOW64\Oikaaoam.exe Noadif32.exe File opened for modification C:\Windows\SysWOW64\Bkdfga32.exe Bonebpoi.exe File created C:\Windows\SysWOW64\Bljpcikg.dll Gklaogbk.exe File created C:\Windows\SysWOW64\Kiipoj32.dll Hnmchp32.exe File created C:\Windows\SysWOW64\Pkfafd32.dll Nedfea32.exe File created C:\Windows\SysWOW64\Aljpke32.exe Piddgmib.exe File created C:\Windows\SysWOW64\Glilglfl.dll Hnfmgaga.exe File created C:\Windows\SysWOW64\Pabmep32.dll Limliclo.exe File created C:\Windows\SysWOW64\Nakchdgc.dll Njckbh32.exe File created C:\Windows\SysWOW64\Jdookkcl.dll Aljpke32.exe File created C:\Windows\SysWOW64\Ippiok32.exe Iaklnn32.exe File opened for modification C:\Windows\SysWOW64\Dcqpjkch.exe Colacn32.exe File created C:\Windows\SysWOW64\Gianpc32.exe Gklaogbk.exe File created C:\Windows\SysWOW64\Njckbh32.exe Nbhfnf32.exe File opened for modification C:\Windows\SysWOW64\Gmhafc32.exe Fdmpgnoc.exe File created C:\Windows\SysWOW64\Jjpcho32.exe Igojgd32.exe File created C:\Windows\SysWOW64\Boplbi32.dll Jdlnfg32.exe File created C:\Windows\SysWOW64\Ebgplg32.dll Hndpaaid.exe File opened for modification C:\Windows\SysWOW64\Jdlnfg32.exe Jjpcho32.exe File created C:\Windows\SysWOW64\Dcqpjkch.exe Colacn32.exe File created C:\Windows\SysWOW64\Igojgd32.exe Ijkjmppe.exe File created C:\Windows\SysWOW64\Pfhiie32.dll Kkmldp32.exe File created C:\Windows\SysWOW64\Ncgqqj32.dll Gianpc32.exe File created C:\Windows\SysWOW64\Gmhafc32.exe Fdmpgnoc.exe File created C:\Windows\SysWOW64\Gmogfb32.exe Gianpc32.exe File created C:\Windows\SysWOW64\Eeadcmma.dll Ippiok32.exe File created C:\Windows\SysWOW64\Ijkjmppe.exe Iapeincj.exe File opened for modification C:\Windows\SysWOW64\Kkmldp32.exe Jdlnfg32.exe File opened for modification C:\Windows\SysWOW64\Piddgmib.exe Oikaaoam.exe File created C:\Windows\SysWOW64\Bkiobpah.exe Bkdfga32.exe File created C:\Windows\SysWOW64\Fdmpgnoc.exe Process not Found File opened for modification C:\Windows\SysWOW64\Nbhfnf32.exe Nedfea32.exe File opened for modification C:\Windows\SysWOW64\Hpgfil32.exe Hgoapf32.exe File created C:\Windows\SysWOW64\Colacn32.exe Ckklhp32.exe File opened for modification C:\Windows\SysWOW64\Gmogfb32.exe Gianpc32.exe File created C:\Windows\SysWOW64\Fdpmboej.dll Bkdfga32.exe File created C:\Windows\SysWOW64\Hgoapf32.exe Hnfmgaga.exe - Modifies registry class 114 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gggkogcj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bkiobpah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gklaogbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hgoapf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agedpn32.dll" Piddgmib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hnfmgaga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nedfea32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Colacn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jjpcho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Boplbi32.dll" Jdlnfg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkfafd32.dll" Nedfea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glilglfl.dll" Hnfmgaga.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Iapeincj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gipfeajm.dll" Ijkjmppe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncgqqj32.dll" Gianpc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gianpc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcmkfhdp.dll" Gmogfb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ckklhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhedilhj.dll" Iaklnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kkmldp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Noadif32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bonebpoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hpgfil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ijkjmppe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jdlnfg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnkeag32.dll" Bkiobpah.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hpicnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bfcddkkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfldk32.dll" Iapeincj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Iapeincj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jppbiiko.dll" Jjpcho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ckklhp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gklaogbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icqdkp32.dll" Hpicnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiipoj32.dll" Hnmchp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkknep32.dll" Fdmpgnoc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bkiobpah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Colacn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Iaklnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lkdbdo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Limliclo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nllbpq32.dll" Mbapnghb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nedfea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdookkcl.dll" Aljpke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgnpji32.dll" Bfcddkkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdpmboej.dll" Bkdfga32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ijkjmppe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Aljpke32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bfcddkkk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fdmpgnoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebgplg32.dll" Hndpaaid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hpgfil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gninip32.dll" Ckklhp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hndpaaid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mbapnghb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhogei32.dll" Bajeilpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jjpcho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aeldcgam.dll" Lkdbdo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pabmep32.dll" Limliclo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqfnai32.dll" Nbhfnf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gipmhjhb.dll" Noadif32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnkplgkf.dll" Gggkogcj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hndpaaid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hnmchp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ippiok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfhiie32.dll" Kkmldp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nakchdgc.dll" Njckbh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fdmpgnoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkfffdmi.dll" Gmhafc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gmogfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gmogfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeadcmma.dll" Ippiok32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Oikaaoam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmmjcd32.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gmhafc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bljpcikg.dll" Gklaogbk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lkdbdo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bonebpoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olkmee32.dll" Bonebpoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lafhch32.dll" Hpgfil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hnmchp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Piddgmib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bkdfga32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gianpc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hnfmgaga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jdlnfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gmhafc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bajeilpp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mbapnghb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Iaklnn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Njckbh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flkljj32.dll" Hgoapf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kkmldp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bkdfga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Aljpke32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bajeilpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dekjjijk.dll" Colacn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Igojgd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Igojgd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Noadif32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hpicnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckcpldna.dll" Igojgd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Piddgmib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Njckbh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmflcdcg.dll" Oikaaoam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gggkogcj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ippiok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nbhfnf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oikaaoam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hgoapf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Limliclo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nbhfnf32.exe - Suspicious use of WriteProcessMemory 115 IoCs
description pid Process procid_target PID 4904 wrote to memory of 4944 4904 Process not Found PID 4944 wrote to memory of 4992 4944 Process not Found 2 PID 4944 wrote to memory of 4992 4944 Process not Found 2 PID 4944 wrote to memory of 4992 4944 Process not Found 2 PID 4992 wrote to memory of 5032 4992 Fdmpgnoc.exe 3 PID 4992 wrote to memory of 5032 4992 Fdmpgnoc.exe 3 PID 4992 wrote to memory of 5032 4992 Fdmpgnoc.exe 3 PID 5032 wrote to memory of 5100 5032 Gmhafc32.exe 4 PID 5032 wrote to memory of 5100 5032 Gmhafc32.exe 4 PID 5032 wrote to memory of 5100 5032 Gmhafc32.exe 4 PID 5100 wrote to memory of 3004 5100 Gklaogbk.exe 5 PID 5100 wrote to memory of 3004 5100 Gklaogbk.exe 5 PID 5100 wrote to memory of 3004 5100 Gklaogbk.exe 5 PID 3004 wrote to memory of 1856 3004 Gianpc32.exe 6 PID 3004 wrote to memory of 1856 3004 Gianpc32.exe 6 PID 3004 wrote to memory of 1856 3004 Gianpc32.exe 6 PID 1856 wrote to memory of 3568 1856 Gmogfb32.exe 8 PID 1856 wrote to memory of 3568 1856 Gmogfb32.exe 8 PID 1856 wrote to memory of 3568 1856 Gmogfb32.exe 8 PID 3568 wrote to memory of 2848 3568 Gggkogcj.exe 9 PID 3568 wrote to memory of 2848 3568 Gggkogcj.exe 9 PID 3568 wrote to memory of 2848 3568 Gggkogcj.exe 9 PID 2848 wrote to memory of 4196 2848 Hndpaaid.exe 10 PID 2848 wrote to memory of 4196 2848 Hndpaaid.exe 10 PID 2848 wrote to memory of 4196 2848 Hndpaaid.exe 10 PID 4196 wrote to memory of 716 4196 Hnfmgaga.exe 11 PID 4196 wrote to memory of 716 4196 Hnfmgaga.exe 11 PID 4196 wrote to memory of 716 4196 Hnfmgaga.exe 11 PID 716 wrote to memory of 3292 716 Hgoapf32.exe 12 PID 716 wrote to memory of 3292 716 Hgoapf32.exe 12 PID 716 wrote to memory of 3292 716 Hgoapf32.exe 12 PID 3292 wrote to memory of 4164 3292 Hpgfil32.exe 13 PID 3292 wrote to memory of 4164 3292 Hpgfil32.exe 13 PID 3292 wrote to memory of 4164 3292 Hpgfil32.exe 13 PID 4164 wrote to memory of 4068 4164 Hpicnl32.exe 15 PID 4164 wrote to memory of 4068 4164 Hpicnl32.exe 15 PID 4164 wrote to memory of 4068 4164 Hpicnl32.exe 15 PID 4068 wrote to memory of 3048 4068 Hnmchp32.exe 16 PID 4068 wrote to memory of 3048 4068 Hnmchp32.exe 16 PID 4068 wrote to memory of 3048 4068 Hnmchp32.exe 16 PID 3048 wrote to memory of 660 3048 Iaklnn32.exe 17 PID 3048 wrote to memory of 660 3048 Iaklnn32.exe 17 PID 3048 wrote to memory of 660 3048 Iaklnn32.exe 17 PID 660 wrote to memory of 928 660 Ippiok32.exe 18 PID 660 wrote to memory of 928 660 Ippiok32.exe 18 PID 660 wrote to memory of 928 660 Ippiok32.exe 18 PID 928 wrote to memory of 888 928 Iapeincj.exe 19 PID 928 wrote to memory of 888 928 Iapeincj.exe 19 PID 928 wrote to memory of 888 928 Iapeincj.exe 19 PID 888 wrote to memory of 1168 888 Ijkjmppe.exe 20 PID 888 wrote to memory of 1168 888 Ijkjmppe.exe 20 PID 888 wrote to memory of 1168 888 Ijkjmppe.exe 20 PID 1168 wrote to memory of 1292 1168 Igojgd32.exe 21 PID 1168 wrote to memory of 1292 1168 Igojgd32.exe 21 PID 1168 wrote to memory of 1292 1168 Igojgd32.exe 21 PID 1292 wrote to memory of 1396 1292 Jjpcho32.exe 22 PID 1292 wrote to memory of 1396 1292 Jjpcho32.exe 22 PID 1292 wrote to memory of 1396 1292 Jjpcho32.exe 22 PID 1396 wrote to memory of 1624 1396 Jdlnfg32.exe 23 PID 1396 wrote to memory of 1624 1396 Jdlnfg32.exe 23 PID 1396 wrote to memory of 1624 1396 Jdlnfg32.exe 23 PID 1624 wrote to memory of 1792 1624 Kkmldp32.exe 24 PID 1624 wrote to memory of 1792 1624 Kkmldp32.exe 24 PID 1624 wrote to memory of 1792 1624 Kkmldp32.exe 24 PID 1792 wrote to memory of 1592 1792 Lkdbdo32.exe 25 PID 1792 wrote to memory of 1592 1792 Lkdbdo32.exe 25 PID 1792 wrote to memory of 1592 1792 Lkdbdo32.exe 25 PID 1592 wrote to memory of 4052 1592 Limliclo.exe 26 PID 1592 wrote to memory of 4052 1592 Limliclo.exe 26 PID 1592 wrote to memory of 4052 1592 Limliclo.exe 26 PID 4052 wrote to memory of 4012 4052 Mbapnghb.exe 27 PID 4052 wrote to memory of 4012 4052 Mbapnghb.exe 27 PID 4052 wrote to memory of 4012 4052 Mbapnghb.exe 27 PID 4012 wrote to memory of 4364 4012 Nedfea32.exe 28 PID 4012 wrote to memory of 4364 4012 Nedfea32.exe 28 PID 4012 wrote to memory of 4364 4012 Nedfea32.exe 28 PID 4364 wrote to memory of 4380 4364 Nbhfnf32.exe 29 PID 4364 wrote to memory of 4380 4364 Nbhfnf32.exe 29 PID 4364 wrote to memory of 4380 4364 Nbhfnf32.exe 29 PID 4380 wrote to memory of 4440 4380 Njckbh32.exe 30 PID 4380 wrote to memory of 4440 4380 Njckbh32.exe 30 PID 4380 wrote to memory of 4440 4380 Njckbh32.exe 30 PID 4440 wrote to memory of 4416 4440 Noadif32.exe 31 PID 4440 wrote to memory of 4416 4440 Noadif32.exe 31 PID 4440 wrote to memory of 4416 4440 Noadif32.exe 31 PID 4416 wrote to memory of 2252 4416 Oikaaoam.exe 32 PID 4416 wrote to memory of 2252 4416 Oikaaoam.exe 32 PID 4416 wrote to memory of 2252 4416 Oikaaoam.exe 32 PID 2252 wrote to memory of 2520 2252 Piddgmib.exe 33 PID 2252 wrote to memory of 2520 2252 Piddgmib.exe 33 PID 2252 wrote to memory of 2520 2252 Piddgmib.exe 33 PID 2520 wrote to memory of 2712 2520 Aljpke32.exe 34 PID 2520 wrote to memory of 2712 2520 Aljpke32.exe 34 PID 2520 wrote to memory of 2712 2520 Aljpke32.exe 34 PID 2712 wrote to memory of 2924 2712 Bfcddkkk.exe 35 PID 2712 wrote to memory of 2924 2712 Bfcddkkk.exe 35 PID 2712 wrote to memory of 2924 2712 Bfcddkkk.exe 35 PID 2924 wrote to memory of 3096 2924 Bajeilpp.exe 36 PID 2924 wrote to memory of 3096 2924 Bajeilpp.exe 36 PID 2924 wrote to memory of 3096 2924 Bajeilpp.exe 36 PID 3096 wrote to memory of 3868 3096 Bonebpoi.exe 37 PID 3096 wrote to memory of 3868 3096 Bonebpoi.exe 37 PID 3096 wrote to memory of 3868 3096 Bonebpoi.exe 37 PID 3868 wrote to memory of 4612 3868 Bkdfga32.exe 38 PID 3868 wrote to memory of 4612 3868 Bkdfga32.exe 38 PID 3868 wrote to memory of 4612 3868 Bkdfga32.exe 38 PID 4612 wrote to memory of 4616 4612 Bkiobpah.exe 39 PID 4612 wrote to memory of 4616 4612 Bkiobpah.exe 39 PID 4612 wrote to memory of 4616 4612 Bkiobpah.exe 39 PID 4616 wrote to memory of 4236 4616 Ckklhp32.exe 40 PID 4616 wrote to memory of 4236 4616 Ckklhp32.exe 40 PID 4616 wrote to memory of 4236 4616 Ckklhp32.exe 40 PID 4236 wrote to memory of 188 4236 Colacn32.exe 41 PID 4236 wrote to memory of 188 4236 Colacn32.exe 41 PID 4236 wrote to memory of 188 4236 Colacn32.exe 41
Processes
-
C:\Windows\SysWOW64\Fdmpgnoc.exeC:\Windows\system32\Fdmpgnoc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\Gmhafc32.exeC:\Windows\system32\Gmhafc32.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\Gklaogbk.exeC:\Windows\system32\Gklaogbk.exe3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\Gianpc32.exeC:\Windows\system32\Gianpc32.exe4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\Gmogfb32.exeC:\Windows\system32\Gmogfb32.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\Gggkogcj.exeC:\Windows\system32\Gggkogcj.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\Hndpaaid.exeC:\Windows\system32\Hndpaaid.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\Hnfmgaga.exeC:\Windows\system32\Hnfmgaga.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\Hgoapf32.exeC:\Windows\system32\Hgoapf32.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\Hpgfil32.exeC:\Windows\system32\Hpgfil32.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\Hpicnl32.exeC:\Windows\system32\Hpicnl32.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\Hnmchp32.exeC:\Windows\system32\Hnmchp32.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\Iaklnn32.exeC:\Windows\system32\Iaklnn32.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\Ippiok32.exeC:\Windows\system32\Ippiok32.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Windows\SysWOW64\Iapeincj.exeC:\Windows\system32\Iapeincj.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\Ijkjmppe.exeC:\Windows\system32\Ijkjmppe.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\Igojgd32.exeC:\Windows\system32\Igojgd32.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\Jjpcho32.exeC:\Windows\system32\Jjpcho32.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\Jdlnfg32.exeC:\Windows\system32\Jdlnfg32.exe19⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\Kkmldp32.exeC:\Windows\system32\Kkmldp32.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\Lkdbdo32.exeC:\Windows\system32\Lkdbdo32.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1792 -
C:\Windows\SysWOW64\Limliclo.exeC:\Windows\system32\Limliclo.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1592 -
C:\Windows\SysWOW64\Mbapnghb.exeC:\Windows\system32\Mbapnghb.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4052 -
C:\Windows\SysWOW64\Nedfea32.exeC:\Windows\system32\Nedfea32.exe24⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4012 -
C:\Windows\SysWOW64\Nbhfnf32.exeC:\Windows\system32\Nbhfnf32.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4364 -
C:\Windows\SysWOW64\Njckbh32.exeC:\Windows\system32\Njckbh32.exe26⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4380 -
C:\Windows\SysWOW64\Noadif32.exeC:\Windows\system32\Noadif32.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4440 -
C:\Windows\SysWOW64\Oikaaoam.exeC:\Windows\system32\Oikaaoam.exe28⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4416 -
C:\Windows\SysWOW64\Piddgmib.exeC:\Windows\system32\Piddgmib.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2252 -
C:\Windows\SysWOW64\Aljpke32.exeC:\Windows\system32\Aljpke32.exe30⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2520 -
C:\Windows\SysWOW64\Bfcddkkk.exeC:\Windows\system32\Bfcddkkk.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2712 -
C:\Windows\SysWOW64\Bajeilpp.exeC:\Windows\system32\Bajeilpp.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2924 -
C:\Windows\SysWOW64\Bonebpoi.exeC:\Windows\system32\Bonebpoi.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3096 -
C:\Windows\SysWOW64\Bkdfga32.exeC:\Windows\system32\Bkdfga32.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3868 -
C:\Windows\SysWOW64\Bkiobpah.exeC:\Windows\system32\Bkiobpah.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4612 -
C:\Windows\SysWOW64\Ckklhp32.exeC:\Windows\system32\Ckklhp32.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4616 -
C:\Windows\SysWOW64\Colacn32.exeC:\Windows\system32\Colacn32.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4236 -
C:\Windows\SysWOW64\Dcqpjkch.exeC:\Windows\system32\Dcqpjkch.exe38⤵
- Executes dropped EXE
PID:188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-