Analysis
- max time kernel
46s - max time network
82s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
67cf4d17bc2afb86fd7a736cd129903f6006b731203d7e2f0d46c9fd71f68d19.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
67cf4d17bc2afb86fd7a736cd129903f6006b731203d7e2f0d46c9fd71f68d19.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 67cf4d17bc2afb86fd7a736cd129903f6006b731203d7e2f0d46c9fd71f68d19.exe
- Size 1.4MB
- Sample201109-yvs7mrka92
- SHA256 67cf4d17bc2afb86fd7a736cd129903f6006b731203d7e2f0d46c9fd71f68d19
- MD5 0e5d22c6b6adeb330db165bd4f07dcaa
- SHA1 93dbf611636a8534d4b37ba9ae022d858f6f9746
- SHA512 e3495b4cd1df4526e1c368560b0df8dd0c7f578cc0c1ce45f2b6bce365b8dbee36e85edfb3d57de45d31751dbb1480755a18e66f44f9b2edd64011feee7ab707
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs
- ServiceHost packer 3 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/4848-164-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/4848-163-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/4848-165-0x0000000000000000-mapping.dmp servicehost - Executes dropped EXE 54 IoCs
pid Process 2612 Fihkje32.exe 2736 Ffllcing.exe 772 Gklaogbk.exe 4012 Gmmjabol.exe 3656 Gmogfb32.exe 3208 Gmacla32.exe 4084 Hgjhegag.exe 2304 Hdnink32.exe 3192 Hdbbiklk.exe 360 Hnkfbp32.exe 2520 Hjaggahp.exe 632 Jbiholkp.exe 1940 Jnpidm32.exe 1888 Jkdinaon.exe 1852 Jbpnpk32.exe 2832 Limliclo.exe 1172 Lnjdajjg.exe 1256 Oboloe32.exe 3468 Ohlegl32.exe 3932 Oebbfpga.exe 508 Obfbpdfj.exe 2632 Pbklkc32.exe 416 Pljfdgbn.exe 3232 Pingnlag.exe 2204 Aibqhk32.exe 1632 Aiemnk32.exe 3580 Aljpke32.exe 500 Cbjnpi32.exe 3288 Dbogkinh.exe 208 Doedjm32.exe 1332 Efhomeja.exe 2760 Elgdjlfe.exe 4124 Ebamgf32.exe 4152 Ecaiai32.exe 4180 Ellnek32.exe 4212 Ffdohdpc.exe 4248 Gpcibh32.exe 4276 Gpjpbgjd.exe 4316 Gicdkm32.exe 4340 Gfgdeapn.exe 4376 Hlcmmhne.exe 4400 Idfdjddj.exe 4440 Jgqpbn32.exe 4468 Jjcfihdo.exe 4496 Kndkefic.exe 4528 Knkaee32.exe 4592 Kjabjf32.exe 4660 Kcjgclop.exe 4688 Lclcilmm.exe 4724 Lmehaacn.exe 4764 Nmcmjmik.exe 4792 Oldmhd32.exe 4816 Ojlgnq32.exe 4848 Oddkgfjp.exe - Drops file in System32 directory 162 IoCs
description ioc Process File created C:\Windows\SysWOW64\Gfgdeapn.exe Gicdkm32.exe File opened for modification C:\Windows\SysWOW64\Gpjpbgjd.exe Gpcibh32.exe File created C:\Windows\SysWOW64\Maoedh32.dll Gpcibh32.exe File opened for modification C:\Windows\SysWOW64\Aibqhk32.exe Pingnlag.exe File opened for modification C:\Windows\SysWOW64\Aiemnk32.exe Aibqhk32.exe File opened for modification C:\Windows\SysWOW64\Gpcibh32.exe Ffdohdpc.exe File opened for modification C:\Windows\SysWOW64\Kcjgclop.exe Kjabjf32.exe File created C:\Windows\SysWOW64\Jbpnpk32.exe Jkdinaon.exe File opened for modification C:\Windows\SysWOW64\Ohlegl32.exe Oboloe32.exe File created C:\Windows\SysWOW64\Hjaggahp.exe Hnkfbp32.exe File created C:\Windows\SysWOW64\Phflcb32.dll Jnpidm32.exe File created C:\Windows\SysWOW64\Anahclam.dll Lnjdajjg.exe File opened for modification C:\Windows\SysWOW64\Pingnlag.exe Pljfdgbn.exe File opened for modification C:\Windows\SysWOW64\Fihkje32.exe 67cf4d17bc2afb86fd7a736cd129903f6006b731203d7e2f0d46c9fd71f68d19.exe File created C:\Windows\SysWOW64\Ffllcing.exe Fihkje32.exe File opened for modification C:\Windows\SysWOW64\Elgdjlfe.exe Efhomeja.exe File opened for modification C:\Windows\SysWOW64\Ffdohdpc.exe Ellnek32.exe File created C:\Windows\SysWOW64\Poeknbbf.dll Idfdjddj.exe File created C:\Windows\SysWOW64\Jjcfihdo.exe Jgqpbn32.exe File created C:\Windows\SysWOW64\Nhikeibn.dll Oldmhd32.exe File opened for modification C:\Windows\SysWOW64\Ffllcing.exe Fihkje32.exe File opened for modification C:\Windows\SysWOW64\Jbiholkp.exe Hjaggahp.exe File created C:\Windows\SysWOW64\Pbklkc32.exe Obfbpdfj.exe File created C:\Windows\SysWOW64\Agedpn32.dll Aiemnk32.exe File created C:\Windows\SysWOW64\Jcejhogj.dll Aljpke32.exe File created C:\Windows\SysWOW64\Ipeoih32.dll Ecaiai32.exe File created C:\Windows\SysWOW64\Limliclo.exe Jbpnpk32.exe File opened for modification C:\Windows\SysWOW64\Oebbfpga.exe Ohlegl32.exe File created C:\Windows\SysWOW64\Ldemjd32.dll Doedjm32.exe File opened for modification C:\Windows\SysWOW64\Ecaiai32.exe Ebamgf32.exe File created C:\Windows\SysWOW64\Ffdohdpc.exe Ellnek32.exe File created C:\Windows\SysWOW64\Hlbbmmql.dll Kcjgclop.exe File opened for modification C:\Windows\SysWOW64\Oldmhd32.exe Nmcmjmik.exe File created C:\Windows\SysWOW64\Aeldcgam.dll Jbpnpk32.exe File created C:\Windows\SysWOW64\Obfbpdfj.exe Oebbfpga.exe File opened for modification C:\Windows\SysWOW64\Lnjdajjg.exe Limliclo.exe File created C:\Windows\SysWOW64\Ecnfpl32.dll Ebamgf32.exe File opened for modification C:\Windows\SysWOW64\Nmcmjmik.exe Lmehaacn.exe File created C:\Windows\SysWOW64\Eoagmn32.dll Ojlgnq32.exe File opened for modification C:\Windows\SysWOW64\Hdnink32.exe Hgjhegag.exe File created C:\Windows\SysWOW64\Noelgijh.dll Hjaggahp.exe File created C:\Windows\SysWOW64\Oddkgfjp.exe Ojlgnq32.exe File created C:\Windows\SysWOW64\Pljfdgbn.exe Pbklkc32.exe File created C:\Windows\SysWOW64\Ebamgf32.exe Elgdjlfe.exe File opened for modification C:\Windows\SysWOW64\Hlcmmhne.exe Gfgdeapn.exe File opened for modification C:\Windows\SysWOW64\Oddkgfjp.exe Ojlgnq32.exe File opened for modification C:\Windows\SysWOW64\Hgjhegag.exe Gmacla32.exe File opened for modification C:\Windows\SysWOW64\Ellnek32.exe Ecaiai32.exe File opened for modification C:\Windows\SysWOW64\Knkaee32.exe Kndkefic.exe File opened for modification C:\Windows\SysWOW64\Kjabjf32.exe Knkaee32.exe File created C:\Windows\SysWOW64\Oldmhd32.exe Nmcmjmik.exe File created C:\Windows\SysWOW64\Fcdqiq32.dll Jkdinaon.exe File opened for modification C:\Windows\SysWOW64\Jjcfihdo.exe Jgqpbn32.exe File opened for modification C:\Windows\SysWOW64\Hjaggahp.exe Hnkfbp32.exe File created C:\Windows\SysWOW64\Pingnlag.exe Pljfdgbn.exe File created C:\Windows\SysWOW64\Gpjpbgjd.exe Gpcibh32.exe File created C:\Windows\SysWOW64\Lclcilmm.exe Kcjgclop.exe File created C:\Windows\SysWOW64\Gmogfb32.exe Gmmjabol.exe File created C:\Windows\SysWOW64\Iljldi32.dll Hdbbiklk.exe File opened for modification C:\Windows\SysWOW64\Oboloe32.exe Lnjdajjg.exe File created C:\Windows\SysWOW64\Nleemdja.dll Jbiholkp.exe File created C:\Windows\SysWOW64\Ffnpjfoe.dll Oebbfpga.exe File created C:\Windows\SysWOW64\Kndkefic.exe Jjcfihdo.exe File created C:\Windows\SysWOW64\Bbflfp32.dll Jjcfihdo.exe File created C:\Windows\SysWOW64\Kjabjf32.exe Knkaee32.exe File created C:\Windows\SysWOW64\Gmacla32.exe Gmogfb32.exe File created C:\Windows\SysWOW64\Jnpidm32.exe Jbiholkp.exe File created C:\Windows\SysWOW64\Aljpke32.exe Aiemnk32.exe File opened for modification C:\Windows\SysWOW64\Dbogkinh.exe Cbjnpi32.exe File opened for modification C:\Windows\SysWOW64\Doedjm32.exe Dbogkinh.exe File created C:\Windows\SysWOW64\Ojlgnq32.exe Oldmhd32.exe File created C:\Windows\SysWOW64\Lnjdajjg.exe Limliclo.exe File created C:\Windows\SysWOW64\Oboloe32.exe Lnjdajjg.exe File created C:\Windows\SysWOW64\Ecifmnek.dll Hdnink32.exe File created C:\Windows\SysWOW64\Hlcmmhne.exe Gfgdeapn.exe File opened for modification C:\Windows\SysWOW64\Jgqpbn32.exe Idfdjddj.exe File created C:\Windows\SysWOW64\Pjlnaf32.dll Kndkefic.exe File created C:\Windows\SysWOW64\Gmmjabol.exe Gklaogbk.exe File created C:\Windows\SysWOW64\Mkogignj.dll Hgjhegag.exe File opened for modification C:\Windows\SysWOW64\Jnpidm32.exe Jbiholkp.exe File created C:\Windows\SysWOW64\Dbogkinh.exe Cbjnpi32.exe File created C:\Windows\SysWOW64\Hddfff32.dll Cbjnpi32.exe File created C:\Windows\SysWOW64\Gicdkm32.exe Gpjpbgjd.exe File created C:\Windows\SysWOW64\Dcngba32.dll Gfgdeapn.exe File opened for modification C:\Windows\SysWOW64\Lmehaacn.exe Lclcilmm.exe File opened for modification C:\Windows\SysWOW64\Gmacla32.exe Gmogfb32.exe File opened for modification C:\Windows\SysWOW64\Hdbbiklk.exe Hdnink32.exe File opened for modification C:\Windows\SysWOW64\Jkdinaon.exe Jnpidm32.exe File created C:\Windows\SysWOW64\Mgecehai.dll Oboloe32.exe File created C:\Windows\SysWOW64\Oebbfpga.exe Ohlegl32.exe File created C:\Windows\SysWOW64\Gaeocihc.dll Gicdkm32.exe File opened for modification C:\Windows\SysWOW64\Idfdjddj.exe Hlcmmhne.exe File created C:\Windows\SysWOW64\Efmild32.dll Gklaogbk.exe File created C:\Windows\SysWOW64\Cidmlf32.dll Gmacla32.exe File created C:\Windows\SysWOW64\Ajphhcco.dll Lmehaacn.exe File created C:\Windows\SysWOW64\Qjbhjk32.dll Pbklkc32.exe File created C:\Windows\SysWOW64\Hgfnncmm.dll Ellnek32.exe File created C:\Windows\SysWOW64\Cbjnpi32.exe Aljpke32.exe File created C:\Windows\SysWOW64\Qadecj32.dll Ohlegl32.exe File opened for modification C:\Windows\SysWOW64\Pbklkc32.exe Obfbpdfj.exe File created C:\Windows\SysWOW64\Ohlegl32.exe Oboloe32.exe File opened for modification C:\Windows\SysWOW64\Aljpke32.exe Aiemnk32.exe File opened for modification C:\Windows\SysWOW64\Efhomeja.exe Doedjm32.exe File created C:\Windows\SysWOW64\Idfdjddj.exe Hlcmmhne.exe File created C:\Windows\SysWOW64\Fgdkdq32.dll 67cf4d17bc2afb86fd7a736cd129903f6006b731203d7e2f0d46c9fd71f68d19.exe File opened for modification C:\Windows\SysWOW64\Gklaogbk.exe Ffllcing.exe File created C:\Windows\SysWOW64\Fnfqimnm.dll Pingnlag.exe File created C:\Windows\SysWOW64\Efhomeja.exe Doedjm32.exe File created C:\Windows\SysWOW64\Knkaee32.exe Kndkefic.exe File created C:\Windows\SysWOW64\Nmcmjmik.exe Lmehaacn.exe File created C:\Windows\SysWOW64\Ncgqqj32.dll Gmmjabol.exe File opened for modification C:\Windows\SysWOW64\Hnkfbp32.exe Hdbbiklk.exe File created C:\Windows\SysWOW64\Mdjmdnml.dll Gmogfb32.exe File created C:\Windows\SysWOW64\Doedjm32.exe Dbogkinh.exe File created C:\Windows\SysWOW64\Alaecb32.dll Gpjpbgjd.exe File created C:\Windows\SysWOW64\Diejko32.dll Hlcmmhne.exe File created C:\Windows\SysWOW64\Fmhdjljh.dll Jgqpbn32.exe File created C:\Windows\SysWOW64\Lmehaacn.exe Lclcilmm.exe File created C:\Windows\SysWOW64\Lacelg32.dll Lclcilmm.exe File opened for modification C:\Windows\SysWOW64\Obfbpdfj.exe Oebbfpga.exe File created C:\Windows\SysWOW64\Qbhkaopo.dll Efhomeja.exe File created C:\Windows\SysWOW64\Ecaiai32.exe Ebamgf32.exe File opened for modification C:\Windows\SysWOW64\Lclcilmm.exe Kcjgclop.exe File created C:\Windows\SysWOW64\Fihkje32.exe 67cf4d17bc2afb86fd7a736cd129903f6006b731203d7e2f0d46c9fd71f68d19.exe File created C:\Windows\SysWOW64\Naeomm32.dll Limliclo.exe File opened for modification C:\Windows\SysWOW64\Pljfdgbn.exe Pbklkc32.exe File created C:\Windows\SysWOW64\Aibqhk32.exe Pingnlag.exe File created C:\Windows\SysWOW64\Gpcibh32.exe Ffdohdpc.exe File created C:\Windows\SysWOW64\Jbiholkp.exe Hjaggahp.exe File opened for modification C:\Windows\SysWOW64\Jbpnpk32.exe Jkdinaon.exe File opened for modification C:\Windows\SysWOW64\Gicdkm32.exe Gpjpbgjd.exe File created C:\Windows\SysWOW64\Hdbbiklk.exe Hdnink32.exe File created C:\Windows\SysWOW64\Aiemnk32.exe Aibqhk32.exe File opened for modification C:\Windows\SysWOW64\Gmogfb32.exe Gmmjabol.exe File created C:\Windows\SysWOW64\Hgjhegag.exe Gmacla32.exe File created C:\Windows\SysWOW64\Cjllil32.dll Hnkfbp32.exe File created C:\Windows\SysWOW64\Elgdjlfe.exe Efhomeja.exe File created C:\Windows\SysWOW64\Kcjgclop.exe Kjabjf32.exe File created C:\Windows\SysWOW64\Hnfibo32.dll Kjabjf32.exe File created C:\Windows\SysWOW64\Gklaogbk.exe Ffllcing.exe File created C:\Windows\SysWOW64\Gkfffdmi.dll Ffllcing.exe File created C:\Windows\SysWOW64\Chcgko32.dll Nmcmjmik.exe File created C:\Windows\SysWOW64\Dipccfke.dll Pljfdgbn.exe File opened for modification C:\Windows\SysWOW64\Cbjnpi32.exe Aljpke32.exe File created C:\Windows\SysWOW64\Ehbkbb32.dll Knkaee32.exe File created C:\Windows\SysWOW64\Hnkfbp32.exe Hdbbiklk.exe File opened for modification C:\Windows\SysWOW64\Limliclo.exe Jbpnpk32.exe File opened for modification C:\Windows\SysWOW64\Gfgdeapn.exe Gicdkm32.exe File opened for modification C:\Windows\SysWOW64\Kndkefic.exe Jjcfihdo.exe File opened for modification C:\Windows\SysWOW64\Ojlgnq32.exe Oldmhd32.exe File created C:\Windows\SysWOW64\Hdnink32.exe Hgjhegag.exe File created C:\Windows\SysWOW64\Eiciqk32.dll Ffdohdpc.exe File created C:\Windows\SysWOW64\Jgqpbn32.exe Idfdjddj.exe File opened for modification C:\Windows\SysWOW64\Gmmjabol.exe Gklaogbk.exe File created C:\Windows\SysWOW64\Nlgbie32.dll Dbogkinh.exe File created C:\Windows\SysWOW64\Daakic32.dll Obfbpdfj.exe File created C:\Windows\SysWOW64\Dlhnmfha.dll Aibqhk32.exe File opened for modification C:\Windows\SysWOW64\Ebamgf32.exe Elgdjlfe.exe File created C:\Windows\SysWOW64\Dldgnibf.dll Elgdjlfe.exe File created C:\Windows\SysWOW64\Ellnek32.exe Ecaiai32.exe File created C:\Windows\SysWOW64\Mgnpccan.dll Fihkje32.exe File created C:\Windows\SysWOW64\Jkdinaon.exe Jnpidm32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4912 4848 WerFault.exe 131 - Modifies registry class 165 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Doedjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgfnncmm.dll" Ellnek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oldmhd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlhnmfha.dll" Aibqhk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agedpn32.dll" Aiemnk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Efhomeja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jjcfihdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chcgko32.dll" Nmcmjmik.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831} 67cf4d17bc2afb86fd7a736cd129903f6006b731203d7e2f0d46c9fd71f68d19.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gmmjabol.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Oboloe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Obfbpdfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pbklkc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lacelg32.dll" Lclcilmm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efmild32.dll" Gklaogbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkogignj.dll" Hgjhegag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anahclam.dll" Lnjdajjg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ohlegl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Oebbfpga.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Aiemnk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poeknbbf.dll" Idfdjddj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjlnaf32.dll" Kndkefic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gmmjabol.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kjabjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gklaogbk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Efhomeja.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Elgdjlfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gpcibh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lmehaacn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fihkje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgdkdq32.dll" 67cf4d17bc2afb86fd7a736cd129903f6006b731203d7e2f0d46c9fd71f68d19.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkfffdmi.dll" Ffllcing.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gmogfb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gmacla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cidmlf32.dll" Gmacla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldemjd32.dll" Doedjm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 67cf4d17bc2afb86fd7a736cd129903f6006b731203d7e2f0d46c9fd71f68d19.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pljfdgbn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcejhogj.dll" Aljpke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlgbie32.dll" Dbogkinh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Knkaee32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jnpidm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dldgnibf.dll" Elgdjlfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ebamgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmhdjljh.dll" Jgqpbn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hgjhegag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hdnink32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hdbbiklk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jbpnpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Doedjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maoedh32.dll" Gpcibh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kjabjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajphhcco.dll" Lmehaacn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 67cf4d17bc2afb86fd7a736cd129903f6006b731203d7e2f0d46c9fd71f68d19.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nleemdja.dll" Jbiholkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffnpjfoe.dll" Oebbfpga.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pingnlag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaeocihc.dll" Gicdkm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gfgdeapn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eoagmn32.dll" Ojlgnq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hjaggahp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iljldi32.dll" Hdbbiklk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oebbfpga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kndkefic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nmcmjmik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjllil32.dll" Hnkfbp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jkdinaon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ellnek32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gpcibh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alaecb32.dll" Gpjpbgjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehbkbb32.dll" Knkaee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ffllcing.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ffllcing.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Aljpke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecnfpl32.dll" Ebamgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ebamgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ffdohdpc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcngba32.dll" Gfgdeapn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hlcmmhne.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 67cf4d17bc2afb86fd7a736cd129903f6006b731203d7e2f0d46c9fd71f68d19.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jbiholkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Aibqhk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Idfdjddj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecifmnek.dll" Hdnink32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jnpidm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Daakic32.dll" Obfbpdfj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hdnink32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dbogkinh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiciqk32.dll" Ffdohdpc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aeldcgam.dll" Jbpnpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jbpnpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Aiemnk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cbjnpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ecaiai32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hnkfbp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcdqiq32.dll" Jkdinaon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjbhjk32.dll" Pbklkc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jbiholkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncgqqj32.dll" Gmmjabol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Limliclo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dbogkinh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jgqpbn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" 67cf4d17bc2afb86fd7a736cd129903f6006b731203d7e2f0d46c9fd71f68d19.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kndkefic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdjmdnml.dll" Gmogfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lnjdajjg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pbklkc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jjcfihdo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kcjgclop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kcjgclop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lmehaacn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nmcmjmik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hnkfbp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Limliclo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbflfp32.dll" Jjcfihdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgnpccan.dll" Fihkje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Noelgijh.dll" Hjaggahp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Aljpke32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gpjpbgjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gpjpbgjd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gicdkm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gfgdeapn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hlcmmhne.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hgjhegag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lclcilmm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jkdinaon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhikeibn.dll" Oldmhd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phflcb32.dll" Jnpidm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgecehai.dll" Oboloe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ohlegl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnfqimnm.dll" Pingnlag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pingnlag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Aibqhk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cbjnpi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ecaiai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hjaggahp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ojlgnq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Knkaee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeomm32.dll" Limliclo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qadecj32.dll" Ohlegl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Elgdjlfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipeoih32.dll" Ecaiai32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ffdohdpc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diejko32.dll" Hlcmmhne.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Idfdjddj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gmacla32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlbbmmql.dll" Kcjgclop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lnjdajjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lclcilmm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Oldmhd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hdbbiklk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hddfff32.dll" Cbjnpi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ellnek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gicdkm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnfibo32.dll" Kjabjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dipccfke.dll" Pljfdgbn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gklaogbk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pljfdgbn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbhkaopo.dll" Efhomeja.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ojlgnq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fihkje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oboloe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Obfbpdfj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jgqpbn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gmogfb32.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4912 WerFault.exe 4912 WerFault.exe 4912 WerFault.exe 4912 WerFault.exe 4912 WerFault.exe 4912 WerFault.exe 4912 WerFault.exe 4912 WerFault.exe 4912 WerFault.exe 4912 WerFault.exe 4912 WerFault.exe 4912 WerFault.exe 4912 WerFault.exe 4912 WerFault.exe 4912 WerFault.exe 4912 WerFault.exe 4912 WerFault.exe 4912 WerFault.exe 4912 WerFault.exe 4912 WerFault.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 4912 WerFault.exe Token: SeBackupPrivilege 4912 WerFault.exe Token: SeDebugPrivilege 4912 WerFault.exe - Suspicious use of WriteProcessMemory 162 IoCs
description pid Process procid_target PID 1028 wrote to memory of 2612 1028 67cf4d17bc2afb86fd7a736cd129903f6006b731203d7e2f0d46c9fd71f68d19.exe 73 PID 1028 wrote to memory of 2612 1028 67cf4d17bc2afb86fd7a736cd129903f6006b731203d7e2f0d46c9fd71f68d19.exe 73 PID 1028 wrote to memory of 2612 1028 67cf4d17bc2afb86fd7a736cd129903f6006b731203d7e2f0d46c9fd71f68d19.exe 73 PID 2612 wrote to memory of 2736 2612 Fihkje32.exe 74 PID 2612 wrote to memory of 2736 2612 Fihkje32.exe 74 PID 2612 wrote to memory of 2736 2612 Fihkje32.exe 74 PID 2736 wrote to memory of 772 2736 Ffllcing.exe 75 PID 2736 wrote to memory of 772 2736 Ffllcing.exe 75 PID 2736 wrote to memory of 772 2736 Ffllcing.exe 75 PID 772 wrote to memory of 4012 772 Gklaogbk.exe 76 PID 772 wrote to memory of 4012 772 Gklaogbk.exe 76 PID 772 wrote to memory of 4012 772 Gklaogbk.exe 76 PID 4012 wrote to memory of 3656 4012 Gmmjabol.exe 78 PID 4012 wrote to memory of 3656 4012 Gmmjabol.exe 78 PID 4012 wrote to memory of 3656 4012 Gmmjabol.exe 78 PID 3656 wrote to memory of 3208 3656 Gmogfb32.exe 79 PID 3656 wrote to memory of 3208 3656 Gmogfb32.exe 79 PID 3656 wrote to memory of 3208 3656 Gmogfb32.exe 79 PID 3208 wrote to memory of 4084 3208 Gmacla32.exe 80 PID 3208 wrote to memory of 4084 3208 Gmacla32.exe 80 PID 3208 wrote to memory of 4084 3208 Gmacla32.exe 80 PID 4084 wrote to memory of 2304 4084 Hgjhegag.exe 81 PID 4084 wrote to memory of 2304 4084 Hgjhegag.exe 81 PID 4084 wrote to memory of 2304 4084 Hgjhegag.exe 81 PID 2304 wrote to memory of 3192 2304 Hdnink32.exe 82 PID 2304 wrote to memory of 3192 2304 Hdnink32.exe 82 PID 2304 wrote to memory of 3192 2304 Hdnink32.exe 82 PID 3192 wrote to memory of 360 3192 Hdbbiklk.exe 83 PID 3192 wrote to memory of 360 3192 Hdbbiklk.exe 83 PID 3192 wrote to memory of 360 3192 Hdbbiklk.exe 83 PID 360 wrote to memory of 2520 360 Hnkfbp32.exe 84 PID 360 wrote to memory of 2520 360 Hnkfbp32.exe 84 PID 360 wrote to memory of 2520 360 Hnkfbp32.exe 84 PID 2520 wrote to memory of 632 2520 Hjaggahp.exe 86 PID 2520 wrote to memory of 632 2520 Hjaggahp.exe 86 PID 2520 wrote to memory of 632 2520 Hjaggahp.exe 86 PID 632 wrote to memory of 1940 632 Jbiholkp.exe 87 PID 632 wrote to memory of 1940 632 Jbiholkp.exe 87 PID 632 wrote to memory of 1940 632 Jbiholkp.exe 87 PID 1940 wrote to memory of 1888 1940 Jnpidm32.exe 88 PID 1940 wrote to memory of 1888 1940 Jnpidm32.exe 88 PID 1940 wrote to memory of 1888 1940 Jnpidm32.exe 88 PID 1888 wrote to memory of 1852 1888 Jkdinaon.exe 90 PID 1888 wrote to memory of 1852 1888 Jkdinaon.exe 90 PID 1888 wrote to memory of 1852 1888 Jkdinaon.exe 90 PID 1852 wrote to memory of 2832 1852 Jbpnpk32.exe 91 PID 1852 wrote to memory of 2832 1852 Jbpnpk32.exe 91 PID 1852 wrote to memory of 2832 1852 Jbpnpk32.exe 91 PID 2832 wrote to memory of 1172 2832 Limliclo.exe 92 PID 2832 wrote to memory of 1172 2832 Limliclo.exe 92 PID 2832 wrote to memory of 1172 2832 Limliclo.exe 92 PID 1172 wrote to memory of 1256 1172 Lnjdajjg.exe 93 PID 1172 wrote to memory of 1256 1172 Lnjdajjg.exe 93 PID 1172 wrote to memory of 1256 1172 Lnjdajjg.exe 93 PID 1256 wrote to memory of 3468 1256 Oboloe32.exe 94 PID 1256 wrote to memory of 3468 1256 Oboloe32.exe 94 PID 1256 wrote to memory of 3468 1256 Oboloe32.exe 94 PID 3468 wrote to memory of 3932 3468 Ohlegl32.exe 95 PID 3468 wrote to memory of 3932 3468 Ohlegl32.exe 95 PID 3468 wrote to memory of 3932 3468 Ohlegl32.exe 95 PID 3932 wrote to memory of 508 3932 Oebbfpga.exe 96 PID 3932 wrote to memory of 508 3932 Oebbfpga.exe 96 PID 3932 wrote to memory of 508 3932 Oebbfpga.exe 96 PID 508 wrote to memory of 2632 508 Obfbpdfj.exe 97 PID 508 wrote to memory of 2632 508 Obfbpdfj.exe 97 PID 508 wrote to memory of 2632 508 Obfbpdfj.exe 97 PID 2632 wrote to memory of 416 2632 Pbklkc32.exe 98 PID 2632 wrote to memory of 416 2632 Pbklkc32.exe 98 PID 2632 wrote to memory of 416 2632 Pbklkc32.exe 98 PID 416 wrote to memory of 3232 416 Pljfdgbn.exe 99 PID 416 wrote to memory of 3232 416 Pljfdgbn.exe 99 PID 416 wrote to memory of 3232 416 Pljfdgbn.exe 99 PID 3232 wrote to memory of 2204 3232 Pingnlag.exe 100 PID 3232 wrote to memory of 2204 3232 Pingnlag.exe 100 PID 3232 wrote to memory of 2204 3232 Pingnlag.exe 100 PID 2204 wrote to memory of 1632 2204 Aibqhk32.exe 101 PID 2204 wrote to memory of 1632 2204 Aibqhk32.exe 101 PID 2204 wrote to memory of 1632 2204 Aibqhk32.exe 101 PID 1632 wrote to memory of 3580 1632 Aiemnk32.exe 102 PID 1632 wrote to memory of 3580 1632 Aiemnk32.exe 102 PID 1632 wrote to memory of 3580 1632 Aiemnk32.exe 102 PID 3580 wrote to memory of 500 3580 Aljpke32.exe 103 PID 3580 wrote to memory of 500 3580 Aljpke32.exe 103 PID 3580 wrote to memory of 500 3580 Aljpke32.exe 103 PID 500 wrote to memory of 3288 500 Cbjnpi32.exe 104 PID 500 wrote to memory of 3288 500 Cbjnpi32.exe 104 PID 500 wrote to memory of 3288 500 Cbjnpi32.exe 104 PID 3288 wrote to memory of 208 3288 Dbogkinh.exe 105 PID 3288 wrote to memory of 208 3288 Dbogkinh.exe 105 PID 3288 wrote to memory of 208 3288 Dbogkinh.exe 105 PID 208 wrote to memory of 1332 208 Doedjm32.exe 106 PID 208 wrote to memory of 1332 208 Doedjm32.exe 106 PID 208 wrote to memory of 1332 208 Doedjm32.exe 106 PID 1332 wrote to memory of 2760 1332 Efhomeja.exe 107 PID 1332 wrote to memory of 2760 1332 Efhomeja.exe 107 PID 1332 wrote to memory of 2760 1332 Efhomeja.exe 107 PID 2760 wrote to memory of 4124 2760 Elgdjlfe.exe 108 PID 2760 wrote to memory of 4124 2760 Elgdjlfe.exe 108 PID 2760 wrote to memory of 4124 2760 Elgdjlfe.exe 108 PID 4124 wrote to memory of 4152 4124 Ebamgf32.exe 109 PID 4124 wrote to memory of 4152 4124 Ebamgf32.exe 109 PID 4124 wrote to memory of 4152 4124 Ebamgf32.exe 109 PID 4152 wrote to memory of 4180 4152 Ecaiai32.exe 110 PID 4152 wrote to memory of 4180 4152 Ecaiai32.exe 110 PID 4152 wrote to memory of 4180 4152 Ecaiai32.exe 110 PID 4180 wrote to memory of 4212 4180 Ellnek32.exe 111 PID 4180 wrote to memory of 4212 4180 Ellnek32.exe 111 PID 4180 wrote to memory of 4212 4180 Ellnek32.exe 111 PID 4212 wrote to memory of 4248 4212 Ffdohdpc.exe 112 PID 4212 wrote to memory of 4248 4212 Ffdohdpc.exe 112 PID 4212 wrote to memory of 4248 4212 Ffdohdpc.exe 112 PID 4248 wrote to memory of 4276 4248 Gpcibh32.exe 113 PID 4248 wrote to memory of 4276 4248 Gpcibh32.exe 113 PID 4248 wrote to memory of 4276 4248 Gpcibh32.exe 113 PID 4276 wrote to memory of 4316 4276 Gpjpbgjd.exe 114 PID 4276 wrote to memory of 4316 4276 Gpjpbgjd.exe 114 PID 4276 wrote to memory of 4316 4276 Gpjpbgjd.exe 114 PID 4316 wrote to memory of 4340 4316 Gicdkm32.exe 115 PID 4316 wrote to memory of 4340 4316 Gicdkm32.exe 115 PID 4316 wrote to memory of 4340 4316 Gicdkm32.exe 115 PID 4340 wrote to memory of 4376 4340 Gfgdeapn.exe 116 PID 4340 wrote to memory of 4376 4340 Gfgdeapn.exe 116 PID 4340 wrote to memory of 4376 4340 Gfgdeapn.exe 116 PID 4376 wrote to memory of 4400 4376 Hlcmmhne.exe 117 PID 4376 wrote to memory of 4400 4376 Hlcmmhne.exe 117 PID 4376 wrote to memory of 4400 4376 Hlcmmhne.exe 117 PID 4400 wrote to memory of 4440 4400 Idfdjddj.exe 118 PID 4400 wrote to memory of 4440 4400 Idfdjddj.exe 118 PID 4400 wrote to memory of 4440 4400 Idfdjddj.exe 118 PID 4440 wrote to memory of 4468 4440 Jgqpbn32.exe 119 PID 4440 wrote to memory of 4468 4440 Jgqpbn32.exe 119 PID 4440 wrote to memory of 4468 4440 Jgqpbn32.exe 119 PID 4468 wrote to memory of 4496 4468 Jjcfihdo.exe 120 PID 4468 wrote to memory of 4496 4468 Jjcfihdo.exe 120 PID 4468 wrote to memory of 4496 4468 Jjcfihdo.exe 120 PID 4496 wrote to memory of 4528 4496 Kndkefic.exe 121 PID 4496 wrote to memory of 4528 4496 Kndkefic.exe 121 PID 4496 wrote to memory of 4528 4496 Kndkefic.exe 121 PID 4528 wrote to memory of 4592 4528 Knkaee32.exe 124 PID 4528 wrote to memory of 4592 4528 Knkaee32.exe 124 PID 4528 wrote to memory of 4592 4528 Knkaee32.exe 124 PID 4592 wrote to memory of 4660 4592 Kjabjf32.exe 125 PID 4592 wrote to memory of 4660 4592 Kjabjf32.exe 125 PID 4592 wrote to memory of 4660 4592 Kjabjf32.exe 125 PID 4660 wrote to memory of 4688 4660 Kcjgclop.exe 126 PID 4660 wrote to memory of 4688 4660 Kcjgclop.exe 126 PID 4660 wrote to memory of 4688 4660 Kcjgclop.exe 126 PID 4688 wrote to memory of 4724 4688 Lclcilmm.exe 127 PID 4688 wrote to memory of 4724 4688 Lclcilmm.exe 127 PID 4688 wrote to memory of 4724 4688 Lclcilmm.exe 127 PID 4724 wrote to memory of 4764 4724 Lmehaacn.exe 128 PID 4724 wrote to memory of 4764 4724 Lmehaacn.exe 128 PID 4724 wrote to memory of 4764 4724 Lmehaacn.exe 128 PID 4764 wrote to memory of 4792 4764 Nmcmjmik.exe 129 PID 4764 wrote to memory of 4792 4764 Nmcmjmik.exe 129 PID 4764 wrote to memory of 4792 4764 Nmcmjmik.exe 129 PID 4792 wrote to memory of 4816 4792 Oldmhd32.exe 130 PID 4792 wrote to memory of 4816 4792 Oldmhd32.exe 130 PID 4792 wrote to memory of 4816 4792 Oldmhd32.exe 130 PID 4816 wrote to memory of 4848 4816 Ojlgnq32.exe 131 PID 4816 wrote to memory of 4848 4816 Ojlgnq32.exe 131 PID 4816 wrote to memory of 4848 4816 Ojlgnq32.exe 131
Processes
-
C:\Users\Admin\AppData\Local\Temp\67cf4d17bc2afb86fd7a736cd129903f6006b731203d7e2f0d46c9fd71f68d19.exe"C:\Users\Admin\AppData\Local\Temp\67cf4d17bc2afb86fd7a736cd129903f6006b731203d7e2f0d46c9fd71f68d19.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\Fihkje32.exeC:\Windows\system32\Fihkje32.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\Ffllcing.exeC:\Windows\system32\Ffllcing.exe3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\Gklaogbk.exeC:\Windows\system32\Gklaogbk.exe4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\Gmmjabol.exeC:\Windows\system32\Gmmjabol.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\SysWOW64\Gmogfb32.exeC:\Windows\system32\Gmogfb32.exe6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\Gmacla32.exeC:\Windows\system32\Gmacla32.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\Hgjhegag.exeC:\Windows\system32\Hgjhegag.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\Hdnink32.exeC:\Windows\system32\Hdnink32.exe9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\Hdbbiklk.exeC:\Windows\system32\Hdbbiklk.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\Hnkfbp32.exeC:\Windows\system32\Hnkfbp32.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Windows\SysWOW64\Hjaggahp.exeC:\Windows\system32\Hjaggahp.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\Jbiholkp.exeC:\Windows\system32\Jbiholkp.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\Jnpidm32.exeC:\Windows\system32\Jnpidm32.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\Jkdinaon.exeC:\Windows\system32\Jkdinaon.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\Jbpnpk32.exeC:\Windows\system32\Jbpnpk32.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\Limliclo.exeC:\Windows\system32\Limliclo.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\Lnjdajjg.exeC:\Windows\system32\Lnjdajjg.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\Oboloe32.exeC:\Windows\system32\Oboloe32.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\Ohlegl32.exeC:\Windows\system32\Ohlegl32.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\Oebbfpga.exeC:\Windows\system32\Oebbfpga.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\Obfbpdfj.exeC:\Windows\system32\Obfbpdfj.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Windows\SysWOW64\Pbklkc32.exeC:\Windows\system32\Pbklkc32.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2632 -
C:\Windows\SysWOW64\Pljfdgbn.exeC:\Windows\system32\Pljfdgbn.exe24⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:416 -
C:\Windows\SysWOW64\Pingnlag.exeC:\Windows\system32\Pingnlag.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3232 -
C:\Windows\SysWOW64\Aibqhk32.exeC:\Windows\system32\Aibqhk32.exe26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2204 -
C:\Windows\SysWOW64\Aiemnk32.exeC:\Windows\system32\Aiemnk32.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1632 -
C:\Windows\SysWOW64\Aljpke32.exeC:\Windows\system32\Aljpke32.exe28⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3580 -
C:\Windows\SysWOW64\Cbjnpi32.exeC:\Windows\system32\Cbjnpi32.exe29⤵
- Executes dropped EXE
PID:500 -
C:\Windows\SysWOW64\Dbogkinh.exeC:\Windows\system32\Dbogkinh.exe30⤵
- Executes dropped EXE
- Modifies registry class
PID:3288 -
C:\Windows\SysWOW64\Doedjm32.exeC:\Windows\system32\Doedjm32.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:208 -
C:\Windows\SysWOW64\Efhomeja.exeC:\Windows\system32\Efhomeja.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1332 -
C:\Windows\SysWOW64\Elgdjlfe.exeC:\Windows\system32\Elgdjlfe.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2760 -
C:\Windows\SysWOW64\Ebamgf32.exeC:\Windows\system32\Ebamgf32.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4124 -
C:\Windows\SysWOW64\Ecaiai32.exeC:\Windows\system32\Ecaiai32.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4152 -
C:\Windows\SysWOW64\Ellnek32.exeC:\Windows\system32\Ellnek32.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4180 -
C:\Windows\SysWOW64\Ffdohdpc.exeC:\Windows\system32\Ffdohdpc.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4212 -
C:\Windows\SysWOW64\Gpcibh32.exeC:\Windows\system32\Gpcibh32.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4248 -
C:\Windows\SysWOW64\Gpjpbgjd.exeC:\Windows\system32\Gpjpbgjd.exe39⤵
- Executes dropped EXE
PID:4276 -
C:\Windows\SysWOW64\Gicdkm32.exeC:\Windows\system32\Gicdkm32.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4316 -
C:\Windows\SysWOW64\Gfgdeapn.exeC:\Windows\system32\Gfgdeapn.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4340 -
C:\Windows\SysWOW64\Hlcmmhne.exeC:\Windows\system32\Hlcmmhne.exe42⤵
- Executes dropped EXE
PID:4376 -
C:\Windows\SysWOW64\Idfdjddj.exeC:\Windows\system32\Idfdjddj.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4400 -
C:\Windows\SysWOW64\Jgqpbn32.exeC:\Windows\system32\Jgqpbn32.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4440 -
C:\Windows\SysWOW64\Jjcfihdo.exeC:\Windows\system32\Jjcfihdo.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4468 -
C:\Windows\SysWOW64\Kndkefic.exeC:\Windows\system32\Kndkefic.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4496 -
C:\Windows\SysWOW64\Knkaee32.exeC:\Windows\system32\Knkaee32.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4528 -
C:\Windows\SysWOW64\Kjabjf32.exeC:\Windows\system32\Kjabjf32.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4592 -
C:\Windows\SysWOW64\Kcjgclop.exeC:\Windows\system32\Kcjgclop.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4660 -
C:\Windows\SysWOW64\Lclcilmm.exeC:\Windows\system32\Lclcilmm.exe50⤵
- Executes dropped EXE
- Modifies registry class
PID:4688 -
C:\Windows\SysWOW64\Lmehaacn.exeC:\Windows\system32\Lmehaacn.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4724 -
C:\Windows\SysWOW64\Nmcmjmik.exeC:\Windows\system32\Nmcmjmik.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4764 -
C:\Windows\SysWOW64\Oldmhd32.exeC:\Windows\system32\Oldmhd32.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4792 -
C:\Windows\SysWOW64\Ojlgnq32.exeC:\Windows\system32\Ojlgnq32.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4816 -
C:\Windows\SysWOW64\Oddkgfjp.exeC:\Windows\system32\Oddkgfjp.exe55⤵
- Executes dropped EXE
PID:4848 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 37256⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-