213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631

Analysis

max time kernel
93s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exe
Size

93KB
MD5

a1ce73cdab67a387afdaa5a096d203eb
SHA1

c189066059e57d823d0c6e0fe79f6c3af47830c7
SHA256

213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631
SHA512

b99d80aed9b8236ddc9379a8dcc3916a622883804b98932f57e98eba4b7ddc9cd7efa508e8fbf3bae7541da5cc8d4763c7e18e66e100ea46fcd26250a943620d
SSDEEP

1536:k4c73PraAqisg8dYQKH4oDRaB6UOyPWj8noXzmHvs74T4jiwg58:hZAqisgvPL8noX8vu4cY58

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Mpimbcnf.exeEnkdda32.exeOkailkhd.exeJmkmlk32.exeOkgnna32.exeAijgemok.exeKjebjjck.exeKbjbibli.exeCofohkgi.exeEbkndibq.exeGllabp32.exeDmaoem32.exeDimfmeef.exeMjkmfn32.exeFgcdlj32.exeEgkgad32.exeJeofnpke.exeGdjpcj32.exeHgaoec32.exeCkgmon32.exeMjofanld.exeOmpgqonl.exeFgqhgjbb.exeHpdefh32.exeLbfcbdce.exePapkcd32.exeLodoefed.exeHnlnmd32.exePllhib32.exeNffcebdd.exeJkjaaglp.exeLggdfk32.exeElqcnfdp.exeOiiilm32.exeIfgooikk.exeDcepgh32.exeFnjiin32.exeNbodpo32.exeIdnako32.exeJidppaio.exeAnhdmh32.exeMckpba32.exePfgeoo32.exeClpeajjb.exeEdelakoq.exeAgdlfd32.exeMpaoojjb.exePnodjb32.exePelnniga.exeFimclh32.exeKlimcf32.exeCqneaodd.exeDmobpn32.exeElbmkm32.exeHeijidbn.exeLbplciof.exeGcgpiq32.exeJdplmflg.exeBnfodojp.exeEmnelbdi.exeJfpndkel.exeHmkiobge.exeNlocka32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpimbcnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Enkdda32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okailkhd.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmkmlk32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okgnna32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aijgemok.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjebjjck.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbjbibli.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cofohkgi.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebkndibq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gllabp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmaoem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dimfmeef.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjkmfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fgcdlj32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egkgad32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeofnpke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gdjpcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hgaoec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckgmon32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjofanld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ompgqonl.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgqhgjbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hpdefh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lbfcbdce.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Papkcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lodoefed.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckgmon32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnlnmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pllhib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nffcebdd.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkjaaglp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lggdfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Elqcnfdp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oiiilm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifgooikk.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcepgh32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnjiin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbodpo32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idnako32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jidppaio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Anhdmh32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mckpba32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfgeoo32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clpeajjb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edelakoq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agdlfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpaoojjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnodjb32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pelnniga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fimclh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klimcf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cqneaodd.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmobpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Elbmkm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Heijidbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lbplciof.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcgpiq32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdplmflg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnfodojp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Emnelbdi.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfpndkel.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmkiobge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nlocka32.exe

Executes dropped EXE 64 IoCs

Processes:

Icdhnn32.exeIlmlfcel.exeJfhmehji.exeJlaeab32.exeJbakpi32.exeJkioho32.exeJnjhjj32.exeKgdiho32.exeKjebjjck.exeKmfklepl.exeKfaljjdj.exeLbhmok32.exeLamjph32.exeLnqkjl32.exeLaackgka.exeLpgqlc32.exeMpimbcnf.exeMmmnkglp.exeMhfoleio.exeMifkfhpa.exeMldgbcoe.exeNmhqokcq.exeNhpabdqd.exeNgencpel.exeNobpmb32.exeOihdjk32.exeOlkjaflh.exeOdfofhic.exeOnocon32.exePqplqile.exePqbifhjb.exePipjpj32.exePjofjm32.exeAkgibd32.exeAepnkjcd.exeAfcghbgp.exeAcggbffj.exeAbldccka.exeBppdlgjk.exeBmdefk32.exeBikfklni.exeBebfpm32.exeBhbpahan.exeBdipfi32.exeCmaeoo32.exeCppakj32.exeCpbnaj32.exeCmfnjnin.exeCbcfbege.exeCllkkk32.exeCojghf32.exeCpidai32.exeDibhjokm.exeDooqceid.exeDlbaljhn.exeDekeeonn.exeDglbmg32.exeDabfjp32.exeDhlogjko.exeDnhgoa32.exeDcepgh32.exeEnkdda32.exeEdelakoq.exeEnmqjq32.exe

pid	process
2744	Icdhnn32.exe
2776	Ilmlfcel.exe
2904	Jfhmehji.exe
2732	Jlaeab32.exe
2724	Jbakpi32.exe
2628	Jkioho32.exe
1752	Jnjhjj32.exe
2384	Kgdiho32.exe
2272	Kjebjjck.exe
2844	Kmfklepl.exe
1180	Kfaljjdj.exe
992	Lbhmok32.exe
1972	Lamjph32.exe
1364	Lnqkjl32.exe
1648	Laackgka.exe
1976	Lpgqlc32.exe
2160	Mpimbcnf.exe
788	Mmmnkglp.exe
2404	Mhfoleio.exe
1736	Mifkfhpa.exe
888	Mldgbcoe.exe
2448	Nmhqokcq.exe
1276	Nhpabdqd.exe
740	Ngencpel.exe
2292	Nobpmb32.exe
1248	Oihdjk32.exe
2792	Olkjaflh.exe
1576	Odfofhic.exe
2056	Onocon32.exe
2752	Pqplqile.exe
2668	Pqbifhjb.exe
2996	Pipjpj32.exe
2440	Pjofjm32.exe
2136	Akgibd32.exe
2624	Aepnkjcd.exe
2520	Afcghbgp.exe
2912	Acggbffj.exe
1708	Abldccka.exe
2072	Bppdlgjk.exe
2172	Bmdefk32.exe
2344	Bikfklni.exe
812	Bebfpm32.exe
1472	Bhbpahan.exe
1464	Bdipfi32.exe
2948	Cmaeoo32.exe
3024	Cppakj32.exe
1724	Cpbnaj32.exe
932	Cmfnjnin.exe
1552	Cbcfbege.exe
2712	Cllkkk32.exe
2192	Cojghf32.exe
1572	Cpidai32.exe
2592	Dibhjokm.exe
2808	Dooqceid.exe
2568	Dlbaljhn.exe
1616	Dekeeonn.exe
1980	Dglbmg32.exe
2872	Dabfjp32.exe
556	Dhlogjko.exe
2740	Dnhgoa32.exe
308	Dcepgh32.exe
2092	Enkdda32.exe
1944	Edelakoq.exe
1680	Enmqjq32.exe

Loads dropped DLL 64 IoCs

Processes:

213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exeIcdhnn32.exeIlmlfcel.exeJfhmehji.exeJlaeab32.exeJbakpi32.exeJkioho32.exeJnjhjj32.exeKgdiho32.exeKjebjjck.exeKmfklepl.exeKfaljjdj.exeLbhmok32.exeLamjph32.exeLnqkjl32.exeLaackgka.exeLpgqlc32.exeMpimbcnf.exeMmmnkglp.exeMhfoleio.exeMifkfhpa.exeMldgbcoe.exeNmhqokcq.exeNhpabdqd.exeNgencpel.exeNobpmb32.exeOihdjk32.exeOlkjaflh.exeOdfofhic.exeOnocon32.exePqplqile.exePqbifhjb.exe

pid	process
2288	213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exe
2288	213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exe
2744	Icdhnn32.exe
2744	Icdhnn32.exe
2776	Ilmlfcel.exe
2776	Ilmlfcel.exe
2904	Jfhmehji.exe
2904	Jfhmehji.exe
2732	Jlaeab32.exe
2732	Jlaeab32.exe
2724	Jbakpi32.exe
2724	Jbakpi32.exe
2628	Jkioho32.exe
2628	Jkioho32.exe
1752	Jnjhjj32.exe
1752	Jnjhjj32.exe
2384	Kgdiho32.exe
2384	Kgdiho32.exe
2272	Kjebjjck.exe
2272	Kjebjjck.exe
2844	Kmfklepl.exe
2844	Kmfklepl.exe
1180	Kfaljjdj.exe
1180	Kfaljjdj.exe
992	Lbhmok32.exe
992	Lbhmok32.exe
1972	Lamjph32.exe
1972	Lamjph32.exe
1364	Lnqkjl32.exe
1364	Lnqkjl32.exe
1648	Laackgka.exe
1648	Laackgka.exe
1976	Lpgqlc32.exe
1976	Lpgqlc32.exe
2160	Mpimbcnf.exe
2160	Mpimbcnf.exe
788	Mmmnkglp.exe
788	Mmmnkglp.exe
2404	Mhfoleio.exe
2404	Mhfoleio.exe
1736	Mifkfhpa.exe
1736	Mifkfhpa.exe
888	Mldgbcoe.exe
888	Mldgbcoe.exe
2448	Nmhqokcq.exe
2448	Nmhqokcq.exe
1276	Nhpabdqd.exe
1276	Nhpabdqd.exe
740	Ngencpel.exe
740	Ngencpel.exe
2292	Nobpmb32.exe
2292	Nobpmb32.exe
1248	Oihdjk32.exe
1248	Oihdjk32.exe
2792	Olkjaflh.exe
2792	Olkjaflh.exe
1576	Odfofhic.exe
1576	Odfofhic.exe
2056	Onocon32.exe
2056	Onocon32.exe
2752	Pqplqile.exe
2752	Pqplqile.exe
2668	Pqbifhjb.exe
2668	Pqbifhjb.exe

Drops file in System32 directory 64 IoCs

Processes:

Ioaobjin.exeEbkndibq.exeQjcmoqlf.exeGiakoc32.exeEfhenccl.exeFnbhmlkk.exeGkgdbh32.exeMjeffc32.exeGdpikmci.exeIipgeb32.exeLgbdpena.exePpbfmdfo.exeLjpnch32.exeMpnifkae.exeEibbqmhd.exeBmhkojab.exeMhgpgjoj.exePkihpi32.exePaemac32.exeAbjcleqm.exeGiikkehc.exePgacaaij.exeOkailkhd.exeHkdkhl32.exePfobjdoe.exeCfmjoe32.exeLejppj32.exeBlklfk32.exeMifkfhpa.exeLbkchj32.exeEnepnoji.exeDgbiggof.exeGadidabc.exePqplqile.exeNgoinfao.exeIiekkdjo.exeOfmgmhgh.exeEmnelbdi.exeNgencpel.exeInqhhc32.exeIfniaeqk.exeEgdjfo32.exeNmhqokcq.exeIfahpnfl.exeHqcpfcbl.exeGllabp32.exeEbcqicem.exeNpieoi32.exeMookod32.exeBmdefk32.exeFnafdc32.exeNmkpnd32.exeHgaoec32.exeJocceo32.exeNhmbfhfd.exeGpeoakhc.exeMlcekgbb.exeOjgado32.exeBnfodojp.exeBebfpm32.exeOgpjmn32.exeBkdbab32.exeFplknh32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Iigcobid.exe	Ioaobjin.exe
File created	C:\Windows\SysWOW64\Fdneoh32.dll	Ebkndibq.exe
File opened for modification	C:\Windows\SysWOW64\Adkbgf32.exe	Qjcmoqlf.exe
File opened for modification	C:\Windows\SysWOW64\Gidgdcli.exe	Giakoc32.exe
File opened for modification	C:\Windows\SysWOW64\Elbmkm32.exe	Efhenccl.exe
File created	C:\Windows\SysWOW64\Eoqfgcek.dll	Fnbhmlkk.exe
File opened for modification	C:\Windows\SysWOW64\Gdpikmci.exe	Gkgdbh32.exe
File created	C:\Windows\SysWOW64\Mpaoojjb.exe	Mjeffc32.exe
File created	C:\Windows\SysWOW64\Djnjmoea.dll	Gdpikmci.exe
File created	C:\Windows\SysWOW64\Mhcdfiom.dll	Iipgeb32.exe
File created	C:\Windows\SysWOW64\Fopilf32.dll	Lgbdpena.exe
File created	C:\Windows\SysWOW64\Dijbqion.dll	Ppbfmdfo.exe
File created	C:\Windows\SysWOW64\Moeodd32.dll	Ljpnch32.exe
File created	C:\Windows\SysWOW64\Ghjajqph.dll	Mpnifkae.exe
File created	C:\Windows\SysWOW64\Dmhocf32.dll	Eibbqmhd.exe
File opened for modification	C:\Windows\SysWOW64\Bbgplq32.exe	Bmhkojab.exe
File created	C:\Windows\SysWOW64\Depojmnb.dll	Mhgpgjoj.exe
File opened for modification	C:\Windows\SysWOW64\Pdamhocm.exe	Pkihpi32.exe
File created	C:\Windows\SysWOW64\Nojinbej.dll	Paemac32.exe
File created	C:\Windows\SysWOW64\Aggkdlod.exe	Abjcleqm.exe
File opened for modification	C:\Windows\SysWOW64\Gpccgppq.exe	Giikkehc.exe
File opened for modification	C:\Windows\SysWOW64\Pchdfb32.exe	Pgacaaij.exe
File created	C:\Windows\SysWOW64\Oheieo32.exe	Okailkhd.exe
File opened for modification	C:\Windows\SysWOW64\Hdloab32.exe	Hkdkhl32.exe
File opened for modification	C:\Windows\SysWOW64\Pbfcoedi.exe	Pfobjdoe.exe
File created	C:\Windows\SysWOW64\Ajclkk32.dll	Cfmjoe32.exe
File created	C:\Windows\SysWOW64\Jpmaii32.dll	Lejppj32.exe
File created	C:\Windows\SysWOW64\Bfcqoqeh.exe	Blklfk32.exe
File opened for modification	C:\Windows\SysWOW64\Mldgbcoe.exe	Mifkfhpa.exe
File created	C:\Windows\SysWOW64\Pkjfgc32.dll	Lbkchj32.exe
File opened for modification	C:\Windows\SysWOW64\Fnjiin32.exe	Enepnoji.exe
File created	C:\Windows\SysWOW64\Dglmdppi.dll	Dgbiggof.exe
File opened for modification	C:\Windows\SysWOW64\Gohjnf32.exe	Gadidabc.exe
File created	C:\Windows\SysWOW64\Gonfjjge.dll	Pqplqile.exe
File opened for modification	C:\Windows\SysWOW64\Nqgngk32.exe	Ngoinfao.exe
File created	C:\Windows\SysWOW64\Iihgadhl.exe	Iiekkdjo.exe
File created	C:\Windows\SysWOW64\Gnldnbno.dll	Ofmgmhgh.exe
File created	C:\Windows\SysWOW64\Fccaicfb.dll	Emnelbdi.exe
File created	C:\Windows\SysWOW64\Qieiiaad.dll	Ngencpel.exe
File created	C:\Windows\SysWOW64\Bonepp32.dll	Inqhhc32.exe
File created	C:\Windows\SysWOW64\Iadnon32.exe	Ifniaeqk.exe
File opened for modification	C:\Windows\SysWOW64\Elqcnfdp.exe	Egdjfo32.exe
File created	C:\Windows\SysWOW64\Nhpabdqd.exe	Nmhqokcq.exe
File opened for modification	C:\Windows\SysWOW64\Iadnon32.exe	Ifniaeqk.exe
File opened for modification	C:\Windows\SysWOW64\Iiodliep.exe	Ifahpnfl.exe
File created	C:\Windows\SysWOW64\Pfplmh32.dll	Hqcpfcbl.exe
File created	C:\Windows\SysWOW64\Ghcbga32.exe	Gllabp32.exe
File created	C:\Windows\SysWOW64\Epgabhdg.exe	Ebcqicem.exe
File created	C:\Windows\SysWOW64\Npkaei32.exe	Npieoi32.exe
File created	C:\Windows\SysWOW64\Mhgpgjoj.exe	Mookod32.exe
File created	C:\Windows\SysWOW64\Nnkgjpbo.dll	Bmdefk32.exe
File created	C:\Windows\SysWOW64\Fcoolj32.exe	Fnafdc32.exe
File created	C:\Windows\SysWOW64\Emljdpkp.dll	Nmkpnd32.exe
File created	C:\Windows\SysWOW64\Hajdniep.exe	Hgaoec32.exe
File opened for modification	C:\Windows\SysWOW64\Jdplmflg.exe	Jocceo32.exe
File created	C:\Windows\SysWOW64\Nmkklflj.exe	Nhmbfhfd.exe
File created	C:\Windows\SysWOW64\Gjkcod32.exe	Gpeoakhc.exe
File opened for modification	C:\Windows\SysWOW64\Ncnmhajo.exe	Mlcekgbb.exe
File created	C:\Windows\SysWOW64\Okgnna32.exe	Ojgado32.exe
File opened for modification	C:\Windows\SysWOW64\Bkjpncii.exe	Bnfodojp.exe
File created	C:\Windows\SysWOW64\Bhbpahan.exe	Bebfpm32.exe
File created	C:\Windows\SysWOW64\Nmefoa32.dll	Ogpjmn32.exe
File created	C:\Windows\SysWOW64\Beboid32.dll	Bkdbab32.exe
File created	C:\Windows\SysWOW64\Egcaic32.dll	Fplknh32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2052 4428 WerFault.exe Mllhpb32.exe

pid	pid_target	process	target process
2052	4428	WerFault.exe	Mllhpb32.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Kanfgofa.exeMgodjico.exeQnagbc32.exeOlgboogb.exeBfmlgi32.exeEmkfmioh.exeMqjehngm.exeEhiiop32.exeHifdjcif.exeNhakecld.exeAonjpp32.exeEoomai32.exeNbodpo32.exeHjkpng32.exeKhcdijac.exeHnjdpm32.exeNmpkal32.exeIniidj32.exeCfmceomm.exeEmggflfc.exeEcmhqp32.exeMookod32.exeAgakog32.exeFokaoh32.exeAkejdp32.exeNlocka32.exeLkngkj32.exeKphbmp32.exeGbkaneao.exeIkhqbo32.exeNoifmmec.exeNmkpnd32.exeQajfmbna.exeImidgh32.exeFpcghl32.exeKlapha32.exeNgencpel.exePqplqile.exeBkjpncii.exeLkolmk32.exeJkjaaglp.exeOkailkhd.exeOdoddlcd.exeKbjbibli.exeNmkklflj.exeBppdlgjk.exeHdcdfmqe.exeJfhmehji.exeKommediq.exeFimclh32.exeMifkfhpa.exeBcpiombe.exeFjajno32.exeDodlfmlb.exeCbnhfhoc.exeCkgmon32.exeJmkmlk32.exeDmaoem32.exeBmdefk32.exeCfgehn32.exeOheieo32.exePkebgj32.exeMqhhbn32.exeGhmohcbl.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kanfgofa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgodjico.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnagbc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olgboogb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfmlgi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emkfmioh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqjehngm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehiiop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hifdjcif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhakecld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aonjpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eoomai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbodpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjkpng32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khcdijac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnjdpm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmpkal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iniidj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmceomm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emggflfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ecmhqp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mookod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agakog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fokaoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akejdp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlocka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkngkj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kphbmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbkaneao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikhqbo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Noifmmec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmkpnd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qajfmbna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imidgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpcghl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klapha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngencpel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqplqile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkjpncii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkolmk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jkjaaglp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okailkhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ododdlcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbjbibli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmkklflj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bppdlgjk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hdcdfmqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfhmehji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kommediq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fimclh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mifkfhpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcpiombe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjajno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodlfmlb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbnhfhoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckgmon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmkmlk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmaoem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmdefk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfgehn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oheieo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkebgj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqhhbn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghmohcbl.exe

Modifies registry class 64 IoCs

Processes:

Cbnhfhoc.exeJjimpj32.exeHcllmi32.exeQdhqpe32.exeBoifinfg.exePddlggin.exeEonhpk32.exeBabbpc32.exeOppbjn32.exeMebpchmb.exePqplqile.exeLbfcbdce.exeJbpfpd32.exePhhonn32.exeDfgdpj32.exeLpbhmiji.exeElpjkgip.exeHjcoaeol.exeFohbqpki.exeFiopah32.exeKobhillo.exeBhiglh32.exeCldolj32.exeMbdfni32.exeHpdefh32.exeFnjiin32.exeEgdjfo32.exeMjofanld.exeDnhgoa32.exeMhfhaoec.exeNjjieace.exeFcoolj32.exeEbghkjjc.exeGmobin32.exeInqhhc32.exeMifmoa32.exeLodoefed.exeOdoddlcd.exeNcnmhajo.exeCpbnaj32.exePbqbioeb.exeGohnpcmd.exeAbjcleqm.exeDfjaej32.exeDieiap32.exeLejppj32.exeNgencpel.exeLjpnch32.exeGdjpcj32.exeEbkndibq.exeAjaagi32.exeNdnplk32.exeOhcohh32.exeDenglpkc.exeAkejdp32.exeNmpiicdm.exeElqcnfdp.exePanehkaj.exeKcllfi32.exeDamhmc32.exeGilhpe32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cbnhfhoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnnebjpf.dll"	Jjimpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hcllmi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qdhqpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Boifinfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pddlggin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bklhjo32.dll"	Eonhpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Babbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccnbppgg.dll"	Oppbjn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mebpchmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gonfjjge.dll"	Pqplqile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkmaja32.dll"	Lbfcbdce.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jbpfpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Phhonn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfgdpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lojholgi.dll"	Lpbhmiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjpknjgd.dll"	Elpjkgip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hjcoaeol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fohbqpki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fiopah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kobhillo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhiglh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cldolj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mbdfni32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hpdefh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkqiadeq.dll"	Fnjiin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Egdjfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pajicf32.dll"	Mjofanld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kobhillo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dnhgoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mhfhaoec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njjieace.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fcoolj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ebghkjjc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gmobin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bonepp32.dll"	Inqhhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mifmoa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lodoefed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ododdlcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncnmhajo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cpbnaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akmbepcb.dll"	Fcoolj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pbqbioeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpohfljj.dll"	Gohnpcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Abjcleqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfjaej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dieiap32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lejppj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ngencpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ljpnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anggfg32.dll"	Gdjpcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ebkndibq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajaagi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndnplk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iofledji.dll"	Ohcohh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Denglpkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnmbollk.dll"	Akejdp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nmpiicdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Elqcnfdp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Panehkaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kcllfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkncac32.dll"	Damhmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gilhpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpmaii32.dll"	Lejppj32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

description	pid	process	target process
PID 2288 wrote to memory of 2744	2288	213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exe	Icdhnn32.exe
PID 2288 wrote to memory of 2744	2288	213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exe	Icdhnn32.exe
PID 2288 wrote to memory of 2744	2288	213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exe	Icdhnn32.exe
PID 2288 wrote to memory of 2744	2288	213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exe	Icdhnn32.exe
PID 2744 wrote to memory of 2776	2744	Icdhnn32.exe	Ilmlfcel.exe
PID 2744 wrote to memory of 2776	2744	Icdhnn32.exe	Ilmlfcel.exe
PID 2744 wrote to memory of 2776	2744	Icdhnn32.exe	Ilmlfcel.exe
PID 2744 wrote to memory of 2776	2744	Icdhnn32.exe	Ilmlfcel.exe
PID 2776 wrote to memory of 2904	2776	Ilmlfcel.exe	Jfhmehji.exe
PID 2776 wrote to memory of 2904	2776	Ilmlfcel.exe	Jfhmehji.exe
PID 2776 wrote to memory of 2904	2776	Ilmlfcel.exe	Jfhmehji.exe
PID 2776 wrote to memory of 2904	2776	Ilmlfcel.exe	Jfhmehji.exe
PID 2904 wrote to memory of 2732	2904	Jfhmehji.exe	Jlaeab32.exe
PID 2904 wrote to memory of 2732	2904	Jfhmehji.exe	Jlaeab32.exe
PID 2904 wrote to memory of 2732	2904	Jfhmehji.exe	Jlaeab32.exe
PID 2904 wrote to memory of 2732	2904	Jfhmehji.exe	Jlaeab32.exe
PID 2732 wrote to memory of 2724	2732	Jlaeab32.exe	Jbakpi32.exe
PID 2732 wrote to memory of 2724	2732	Jlaeab32.exe	Jbakpi32.exe
PID 2732 wrote to memory of 2724	2732	Jlaeab32.exe	Jbakpi32.exe
PID 2732 wrote to memory of 2724	2732	Jlaeab32.exe	Jbakpi32.exe
PID 2724 wrote to memory of 2628	2724	Jbakpi32.exe	Jkioho32.exe
PID 2724 wrote to memory of 2628	2724	Jbakpi32.exe	Jkioho32.exe
PID 2724 wrote to memory of 2628	2724	Jbakpi32.exe	Jkioho32.exe
PID 2724 wrote to memory of 2628	2724	Jbakpi32.exe	Jkioho32.exe
PID 2628 wrote to memory of 1752	2628	Jkioho32.exe	Jnjhjj32.exe
PID 2628 wrote to memory of 1752	2628	Jkioho32.exe	Jnjhjj32.exe
PID 2628 wrote to memory of 1752	2628	Jkioho32.exe	Jnjhjj32.exe
PID 2628 wrote to memory of 1752	2628	Jkioho32.exe	Jnjhjj32.exe
PID 1752 wrote to memory of 2384	1752	Jnjhjj32.exe	Kgdiho32.exe
PID 1752 wrote to memory of 2384	1752	Jnjhjj32.exe	Kgdiho32.exe
PID 1752 wrote to memory of 2384	1752	Jnjhjj32.exe	Kgdiho32.exe
PID 1752 wrote to memory of 2384	1752	Jnjhjj32.exe	Kgdiho32.exe
PID 2384 wrote to memory of 2272	2384	Kgdiho32.exe	Kjebjjck.exe
PID 2384 wrote to memory of 2272	2384	Kgdiho32.exe	Kjebjjck.exe
PID 2384 wrote to memory of 2272	2384	Kgdiho32.exe	Kjebjjck.exe
PID 2384 wrote to memory of 2272	2384	Kgdiho32.exe	Kjebjjck.exe
PID 2272 wrote to memory of 2844	2272	Kjebjjck.exe	Kmfklepl.exe
PID 2272 wrote to memory of 2844	2272	Kjebjjck.exe	Kmfklepl.exe
PID 2272 wrote to memory of 2844	2272	Kjebjjck.exe	Kmfklepl.exe
PID 2272 wrote to memory of 2844	2272	Kjebjjck.exe	Kmfklepl.exe
PID 2844 wrote to memory of 1180	2844	Kmfklepl.exe	Kfaljjdj.exe
PID 2844 wrote to memory of 1180	2844	Kmfklepl.exe	Kfaljjdj.exe
PID 2844 wrote to memory of 1180	2844	Kmfklepl.exe	Kfaljjdj.exe
PID 2844 wrote to memory of 1180	2844	Kmfklepl.exe	Kfaljjdj.exe
PID 1180 wrote to memory of 992	1180	Kfaljjdj.exe	Lbhmok32.exe
PID 1180 wrote to memory of 992	1180	Kfaljjdj.exe	Lbhmok32.exe
PID 1180 wrote to memory of 992	1180	Kfaljjdj.exe	Lbhmok32.exe
PID 1180 wrote to memory of 992	1180	Kfaljjdj.exe	Lbhmok32.exe
PID 992 wrote to memory of 1972	992	Lbhmok32.exe	Lamjph32.exe
PID 992 wrote to memory of 1972	992	Lbhmok32.exe	Lamjph32.exe
PID 992 wrote to memory of 1972	992	Lbhmok32.exe	Lamjph32.exe
PID 992 wrote to memory of 1972	992	Lbhmok32.exe	Lamjph32.exe
PID 1972 wrote to memory of 1364	1972	Lamjph32.exe	Lnqkjl32.exe
PID 1972 wrote to memory of 1364	1972	Lamjph32.exe	Lnqkjl32.exe
PID 1972 wrote to memory of 1364	1972	Lamjph32.exe	Lnqkjl32.exe
PID 1972 wrote to memory of 1364	1972	Lamjph32.exe	Lnqkjl32.exe
PID 1364 wrote to memory of 1648	1364	Lnqkjl32.exe	Laackgka.exe
PID 1364 wrote to memory of 1648	1364	Lnqkjl32.exe	Laackgka.exe
PID 1364 wrote to memory of 1648	1364	Lnqkjl32.exe	Laackgka.exe
PID 1364 wrote to memory of 1648	1364	Lnqkjl32.exe	Laackgka.exe
PID 1648 wrote to memory of 1976	1648	Laackgka.exe	Lpgqlc32.exe
PID 1648 wrote to memory of 1976	1648	Laackgka.exe	Lpgqlc32.exe
PID 1648 wrote to memory of 1976	1648	Laackgka.exe	Lpgqlc32.exe
PID 1648 wrote to memory of 1976	1648	Laackgka.exe	Lpgqlc32.exe

C:\Users\Admin\AppData\Local\Temp\213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exe
"C:\Users\Admin\AppData\Local\Temp\213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288

C:\Windows\SysWOW64\Icdhnn32.exe
C:\Windows\system32\Icdhnn32.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744

C:\Windows\SysWOW64\Ilmlfcel.exe
C:\Windows\system32\Ilmlfcel.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776

C:\Windows\SysWOW64\Jfhmehji.exe
C:\Windows\system32\Jfhmehji.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904

C:\Windows\SysWOW64\Jlaeab32.exe
C:\Windows\system32\Jlaeab32.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732

C:\Windows\SysWOW64\Jbakpi32.exe
C:\Windows\system32\Jbakpi32.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724

C:\Windows\SysWOW64\Jkioho32.exe
C:\Windows\system32\Jkioho32.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628

C:\Windows\SysWOW64\Jnjhjj32.exe
C:\Windows\system32\Jnjhjj32.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\Kgdiho32.exe
C:\Windows\system32\Kgdiho32.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\SysWOW64\Kjebjjck.exe
C:\Windows\system32\Kjebjjck.exe
10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\SysWOW64\Kmfklepl.exe
C:\Windows\system32\Kmfklepl.exe
11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844

C:\Windows\SysWOW64\Kfaljjdj.exe
C:\Windows\system32\Kfaljjdj.exe
12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\SysWOW64\Lbhmok32.exe
C:\Windows\system32\Lbhmok32.exe
13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\SysWOW64\Lamjph32.exe
C:\Windows\system32\Lamjph32.exe
14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\Lnqkjl32.exe
C:\Windows\system32\Lnqkjl32.exe
15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\SysWOW64\Laackgka.exe
C:\Windows\system32\Laackgka.exe
16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\Lpgqlc32.exe
C:\Windows\system32\Lpgqlc32.exe
17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976

C:\Windows\SysWOW64\Mpimbcnf.exe
C:\Windows\system32\Mpimbcnf.exe
18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2160

C:\Windows\SysWOW64\Mmmnkglp.exe
C:\Windows\system32\Mmmnkglp.exe
19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788

C:\Windows\SysWOW64\Mhfoleio.exe
C:\Windows\system32\Mhfoleio.exe
20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404

C:\Windows\SysWOW64\Mifkfhpa.exe
C:\Windows\system32\Mifkfhpa.exe
21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1736

C:\Windows\SysWOW64\Mldgbcoe.exe
C:\Windows\system32\Mldgbcoe.exe
22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888

C:\Windows\SysWOW64\Nmhqokcq.exe
C:\Windows\system32\Nmhqokcq.exe
23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2448

C:\Windows\SysWOW64\Nhpabdqd.exe
C:\Windows\system32\Nhpabdqd.exe
24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276

C:\Windows\SysWOW64\Ngencpel.exe
C:\Windows\system32\Ngencpel.exe
25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:740

C:\Windows\SysWOW64\Nobpmb32.exe
C:\Windows\system32\Nobpmb32.exe
26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292

C:\Windows\SysWOW64\Oihdjk32.exe
C:\Windows\system32\Oihdjk32.exe
27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248

C:\Windows\SysWOW64\Olkjaflh.exe
C:\Windows\system32\Olkjaflh.exe
28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792

C:\Windows\SysWOW64\Odfofhic.exe
C:\Windows\system32\Odfofhic.exe
29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576

C:\Windows\SysWOW64\Onocon32.exe
C:\Windows\system32\Onocon32.exe
30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056

C:\Windows\SysWOW64\Pqplqile.exe
C:\Windows\system32\Pqplqile.exe
31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2752

C:\Windows\SysWOW64\Pqbifhjb.exe
C:\Windows\system32\Pqbifhjb.exe
32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668

C:\Windows\SysWOW64\Pipjpj32.exe
C:\Windows\system32\Pipjpj32.exe
33⤵
- Executes dropped EXE
PID:2996

C:\Windows\SysWOW64\Pjofjm32.exe
C:\Windows\system32\Pjofjm32.exe
34⤵
- Executes dropped EXE
PID:2440

C:\Windows\SysWOW64\Akgibd32.exe
C:\Windows\system32\Akgibd32.exe
35⤵
- Executes dropped EXE
PID:2136

C:\Windows\SysWOW64\Aepnkjcd.exe
C:\Windows\system32\Aepnkjcd.exe
36⤵
- Executes dropped EXE
PID:2624

C:\Windows\SysWOW64\Afcghbgp.exe
C:\Windows\system32\Afcghbgp.exe
37⤵
- Executes dropped EXE
PID:2520

C:\Windows\SysWOW64\Acggbffj.exe
C:\Windows\system32\Acggbffj.exe
38⤵
- Executes dropped EXE
PID:2912

C:\Windows\SysWOW64\Abldccka.exe
C:\Windows\system32\Abldccka.exe
39⤵
- Executes dropped EXE
PID:1708

C:\Windows\SysWOW64\Bppdlgjk.exe
C:\Windows\system32\Bppdlgjk.exe
40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2072

C:\Windows\SysWOW64\Bmdefk32.exe
C:\Windows\system32\Bmdefk32.exe
41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2172

C:\Windows\SysWOW64\Bikfklni.exe
C:\Windows\system32\Bikfklni.exe
42⤵
- Executes dropped EXE
PID:2344

C:\Windows\SysWOW64\Bebfpm32.exe
C:\Windows\system32\Bebfpm32.exe
43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:812

C:\Windows\SysWOW64\Bhbpahan.exe
C:\Windows\system32\Bhbpahan.exe
44⤵
- Executes dropped EXE
PID:1472

C:\Windows\SysWOW64\Bdipfi32.exe
C:\Windows\system32\Bdipfi32.exe
45⤵
- Executes dropped EXE
PID:1464

C:\Windows\SysWOW64\Cmaeoo32.exe
C:\Windows\system32\Cmaeoo32.exe
46⤵
- Executes dropped EXE
PID:2948

C:\Windows\SysWOW64\Cppakj32.exe
C:\Windows\system32\Cppakj32.exe
47⤵
- Executes dropped EXE
PID:3024

C:\Windows\SysWOW64\Cpbnaj32.exe
C:\Windows\system32\Cpbnaj32.exe
48⤵
- Executes dropped EXE
- Modifies registry class
PID:1724

C:\Windows\SysWOW64\Cmfnjnin.exe
C:\Windows\system32\Cmfnjnin.exe
49⤵
- Executes dropped EXE
PID:932

C:\Windows\SysWOW64\Cbcfbege.exe
C:\Windows\system32\Cbcfbege.exe
50⤵
- Executes dropped EXE
PID:1552

C:\Windows\SysWOW64\Cllkkk32.exe
C:\Windows\system32\Cllkkk32.exe
51⤵
- Executes dropped EXE
PID:2712

C:\Windows\SysWOW64\Cojghf32.exe
C:\Windows\system32\Cojghf32.exe
52⤵
- Executes dropped EXE
PID:2192

C:\Windows\SysWOW64\Cpidai32.exe
C:\Windows\system32\Cpidai32.exe
53⤵
- Executes dropped EXE
PID:1572

C:\Windows\SysWOW64\Dibhjokm.exe
C:\Windows\system32\Dibhjokm.exe
54⤵
- Executes dropped EXE
PID:2592

C:\Windows\SysWOW64\Dooqceid.exe
C:\Windows\system32\Dooqceid.exe
55⤵
- Executes dropped EXE
PID:2808

C:\Windows\SysWOW64\Dlbaljhn.exe
C:\Windows\system32\Dlbaljhn.exe
56⤵
- Executes dropped EXE
PID:2568

C:\Windows\SysWOW64\Dekeeonn.exe
C:\Windows\system32\Dekeeonn.exe
57⤵
- Executes dropped EXE
PID:1616

C:\Windows\SysWOW64\Dglbmg32.exe
C:\Windows\system32\Dglbmg32.exe
58⤵
- Executes dropped EXE
PID:1980

C:\Windows\SysWOW64\Dabfjp32.exe
C:\Windows\system32\Dabfjp32.exe
59⤵
- Executes dropped EXE
PID:2872

C:\Windows\SysWOW64\Dhlogjko.exe
C:\Windows\system32\Dhlogjko.exe
60⤵
- Executes dropped EXE
PID:556

C:\Windows\SysWOW64\Dnhgoa32.exe
C:\Windows\system32\Dnhgoa32.exe
61⤵
- Executes dropped EXE
- Modifies registry class
PID:2740

C:\Windows\SysWOW64\Dcepgh32.exe
C:\Windows\system32\Dcepgh32.exe
62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:308

C:\Windows\SysWOW64\Enkdda32.exe
C:\Windows\system32\Enkdda32.exe
63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2092

C:\Windows\SysWOW64\Edelakoq.exe
C:\Windows\system32\Edelakoq.exe
64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1944

C:\Windows\SysWOW64\Enmqjq32.exe
C:\Windows\system32\Enmqjq32.exe
65⤵
- Executes dropped EXE
PID:1680

C:\Windows\SysWOW64\Eoomai32.exe
C:\Windows\system32\Eoomai32.exe
66⤵
- System Location Discovery: System Language Discovery
PID:1804

C:\Windows\SysWOW64\Efhenccl.exe
C:\Windows\system32\Efhenccl.exe
67⤵
- Drops file in System32 directory
PID:1728

C:\Windows\SysWOW64\Elbmkm32.exe
C:\Windows\system32\Elbmkm32.exe
68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2364

C:\Windows\SysWOW64\Eclfhgaf.exe
C:\Windows\system32\Eclfhgaf.exe
69⤵
PID:860

C:\Windows\SysWOW64\Elejqm32.exe
C:\Windows\system32\Elejqm32.exe
70⤵
PID:2696

C:\Windows\SysWOW64\Efmoib32.exe
C:\Windows\system32\Efmoib32.exe
71⤵
PID:2660

C:\Windows\SysWOW64\Emggflfc.exe
C:\Windows\system32\Emggflfc.exe
72⤵
- System Location Discovery: System Language Discovery
PID:2672

C:\Windows\SysWOW64\Ffpkob32.exe
C:\Windows\system32\Ffpkob32.exe
73⤵
PID:2572

C:\Windows\SysWOW64\Fgqhgjbb.exe
C:\Windows\system32\Fgqhgjbb.exe
74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2832

C:\Windows\SysWOW64\Fbfldc32.exe
C:\Windows\system32\Fbfldc32.exe
75⤵
PID:2244

C:\Windows\SysWOW64\Fgcdlj32.exe
C:\Windows\system32\Fgcdlj32.exe
76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2544

C:\Windows\SysWOW64\Fbiijb32.exe
C:\Windows\system32\Fbiijb32.exe
77⤵
PID:2000

C:\Windows\SysWOW64\Fgeabi32.exe
C:\Windows\system32\Fgeabi32.exe
78⤵
PID:1716

C:\Windows\SysWOW64\Fnoiocfj.exe
C:\Windows\system32\Fnoiocfj.exe
79⤵
PID:916

C:\Windows\SysWOW64\Fclbgj32.exe
C:\Windows\system32\Fclbgj32.exe
80⤵
PID:2452

C:\Windows\SysWOW64\Fnafdc32.exe
C:\Windows\system32\Fnafdc32.exe
81⤵
- Drops file in System32 directory
PID:2196

C:\Windows\SysWOW64\Fcoolj32.exe
C:\Windows\system32\Fcoolj32.exe
82⤵
- Modifies registry class
PID:1332

C:\Windows\SysWOW64\Fjhgidjk.exe
C:\Windows\system32\Fjhgidjk.exe
83⤵
PID:2024

C:\Windows\SysWOW64\Gpeoakhc.exe
C:\Windows\system32\Gpeoakhc.exe
84⤵
- Drops file in System32 directory
PID:2232

C:\Windows\SysWOW64\Gjkcod32.exe
C:\Windows\system32\Gjkcod32.exe
85⤵
PID:544

C:\Windows\SysWOW64\Gcchgini.exe
C:\Windows\system32\Gcchgini.exe
86⤵
PID:2276

C:\Windows\SysWOW64\Geddoa32.exe
C:\Windows\system32\Geddoa32.exe
87⤵
PID:2680

C:\Windows\SysWOW64\Gpjilj32.exe
C:\Windows\system32\Gpjilj32.exe
88⤵
PID:2764

C:\Windows\SysWOW64\Ghenamai.exe
C:\Windows\system32\Ghenamai.exe
89⤵
PID:2596

C:\Windows\SysWOW64\Gbkaneao.exe
C:\Windows\system32\Gbkaneao.exe
90⤵
- System Location Discovery: System Language Discovery
PID:2600

C:\Windows\SysWOW64\Ghgjflof.exe
C:\Windows\system32\Ghgjflof.exe
91⤵
PID:2376

C:\Windows\SysWOW64\Glcfgk32.exe
C:\Windows\system32\Glcfgk32.exe
92⤵
PID:1952

C:\Windows\SysWOW64\Gapoob32.exe
C:\Windows\system32\Gapoob32.exe
93⤵
PID:2084

C:\Windows\SysWOW64\Hjhchg32.exe
C:\Windows\system32\Hjhchg32.exe
94⤵
PID:1368

C:\Windows\SysWOW64\Hjkpng32.exe
C:\Windows\system32\Hjkpng32.exe
95⤵
- System Location Discovery: System Language Discovery
PID:2124

C:\Windows\SysWOW64\Hdcdfmqe.exe
C:\Windows\system32\Hdcdfmqe.exe
96⤵
- System Location Discovery: System Language Discovery
PID:540

C:\Windows\SysWOW64\Hmkiobge.exe
C:\Windows\system32\Hmkiobge.exe
97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1432

C:\Windows\SysWOW64\Hibidc32.exe
C:\Windows\system32\Hibidc32.exe
98⤵
PID:1856

C:\Windows\SysWOW64\Hplbamdf.exe
C:\Windows\system32\Hplbamdf.exe
99⤵
PID:1356

C:\Windows\SysWOW64\Heijidbn.exe
C:\Windows\system32\Heijidbn.exe
100⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2512

C:\Windows\SysWOW64\Ioaobjin.exe
C:\Windows\system32\Ioaobjin.exe
101⤵
- Drops file in System32 directory
PID:864

C:\Windows\SysWOW64\Iigcobid.exe
C:\Windows\system32\Iigcobid.exe
102⤵
PID:2360

C:\Windows\SysWOW64\Iockhigl.exe
C:\Windows\system32\Iockhigl.exe
103⤵
PID:2736

C:\Windows\SysWOW64\Iiipeb32.exe
C:\Windows\system32\Iiipeb32.exe
104⤵
PID:2768

C:\Windows\SysWOW64\Jcdmbk32.exe
C:\Windows\system32\Jcdmbk32.exe
105⤵
PID:2840

C:\Windows\SysWOW64\Kfdfdf32.exe
C:\Windows\system32\Kfdfdf32.exe
106⤵
PID:1984

C:\Windows\SysWOW64\Kdlpkb32.exe
C:\Windows\system32\Kdlpkb32.exe
107⤵
PID:2928

C:\Windows\SysWOW64\Kqcqpc32.exe
C:\Windows\system32\Kqcqpc32.exe
108⤵
PID:1596

C:\Windows\SysWOW64\Kmjaddii.exe
C:\Windows\system32\Kmjaddii.exe
109⤵
PID:2060

C:\Windows\SysWOW64\Kfbemi32.exe
C:\Windows\system32\Kfbemi32.exe
110⤵
PID:1480

C:\Windows\SysWOW64\Lqgjkbop.exe
C:\Windows\system32\Lqgjkbop.exe
111⤵
PID:920

C:\Windows\SysWOW64\Lcffgnnc.exe
C:\Windows\system32\Lcffgnnc.exe
112⤵
PID:2044

C:\Windows\SysWOW64\Ljpnch32.exe
C:\Windows\system32\Ljpnch32.exe
113⤵
- Drops file in System32 directory
- Modifies registry class
PID:1836

C:\Windows\SysWOW64\Lqjfpbmm.exe
C:\Windows\system32\Lqjfpbmm.exe
114⤵
PID:2760

C:\Windows\SysWOW64\Lbkchj32.exe
C:\Windows\system32\Lbkchj32.exe
115⤵
- Drops file in System32 directory
PID:2692

C:\Windows\SysWOW64\Liekddkh.exe
C:\Windows\system32\Liekddkh.exe
116⤵
PID:552

C:\Windows\SysWOW64\Lckpbm32.exe
C:\Windows\system32\Lckpbm32.exe
117⤵
PID:1844

C:\Windows\SysWOW64\Lelljepm.exe
C:\Windows\system32\Lelljepm.exe
118⤵
PID:1260

C:\Windows\SysWOW64\Lmcdkbao.exe
C:\Windows\system32\Lmcdkbao.exe
119⤵
PID:2584

C:\Windows\SysWOW64\Lbplciof.exe
C:\Windows\system32\Lbplciof.exe
120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1476

C:\Windows\SysWOW64\Lenioenj.exe
C:\Windows\system32\Lenioenj.exe
121⤵
PID:824

C:\Windows\SysWOW64\Lkhalo32.exe
C:\Windows\system32\Lkhalo32.exe
122⤵
PID:1548

C:\Windows\SysWOW64\Laeidfdn.exe
C:\Windows\system32\Laeidfdn.exe
123⤵
PID:1668

C:\Windows\SysWOW64\Mgoaap32.exe
C:\Windows\system32\Mgoaap32.exe
124⤵
PID:2556

C:\Windows\SysWOW64\Mbdfni32.exe
C:\Windows\system32\Mbdfni32.exe
125⤵
- Modifies registry class
PID:2604

C:\Windows\SysWOW64\Mganfp32.exe
C:\Windows\system32\Mganfp32.exe
126⤵
PID:2644

C:\Windows\SysWOW64\Mnkfcjqe.exe
C:\Windows\system32\Mnkfcjqe.exe
127⤵
PID:1204

C:\Windows\SysWOW64\Meeopdhb.exe
C:\Windows\system32\Meeopdhb.exe
128⤵
PID:1608

C:\Windows\SysWOW64\Mffkgl32.exe
C:\Windows\system32\Mffkgl32.exe
129⤵
PID:856

C:\Windows\SysWOW64\Malpee32.exe
C:\Windows\system32\Malpee32.exe
130⤵
PID:1692

C:\Windows\SysWOW64\Mhfhaoec.exe
C:\Windows\system32\Mhfhaoec.exe
131⤵
- Modifies registry class
PID:3036

C:\Windows\SysWOW64\Migdig32.exe
C:\Windows\system32\Migdig32.exe
132⤵
PID:2352

C:\Windows\SysWOW64\Manljd32.exe
C:\Windows\system32\Manljd32.exe
133⤵
PID:1636

C:\Windows\SysWOW64\Mfkebkjk.exe
C:\Windows\system32\Mfkebkjk.exe
134⤵
PID:1592

C:\Windows\SysWOW64\Mlhmkbhb.exe
C:\Windows\system32\Mlhmkbhb.exe
135⤵
PID:2180

C:\Windows\SysWOW64\Nfmahkhh.exe
C:\Windows\system32\Nfmahkhh.exe
136⤵
PID:2004

C:\Windows\SysWOW64\Nilndfgl.exe
C:\Windows\system32\Nilndfgl.exe
137⤵
PID:1604

C:\Windows\SysWOW64\Noifmmec.exe
C:\Windows\system32\Noifmmec.exe
138⤵
- System Location Discovery: System Language Discovery
PID:2252

C:\Windows\SysWOW64\Nhakecld.exe
C:\Windows\system32\Nhakecld.exe
139⤵
- System Location Discovery: System Language Discovery
PID:1936

C:\Windows\SysWOW64\Naionh32.exe
C:\Windows\system32\Naionh32.exe
140⤵
PID:2152

C:\Windows\SysWOW64\Nlocka32.exe
C:\Windows\system32\Nlocka32.exe
141⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:1784

C:\Windows\SysWOW64\Nhfdqb32.exe
C:\Windows\system32\Nhfdqb32.exe
142⤵
PID:1696

C:\Windows\SysWOW64\Nejdjf32.exe
C:\Windows\system32\Nejdjf32.exe
143⤵
PID:428

C:\Windows\SysWOW64\Omeini32.exe
C:\Windows\system32\Omeini32.exe
144⤵
PID:2076

C:\Windows\SysWOW64\Ohjmlaci.exe
C:\Windows\system32\Ohjmlaci.exe
145⤵
PID:2008

C:\Windows\SysWOW64\Omgfdhbq.exe
C:\Windows\system32\Omgfdhbq.exe
146⤵
PID:520

C:\Windows\SysWOW64\Ogpjmn32.exe
C:\Windows\system32\Ogpjmn32.exe
147⤵
- Drops file in System32 directory
PID:2456

C:\Windows\SysWOW64\Ocfkaone.exe
C:\Windows\system32\Ocfkaone.exe
148⤵
PID:2836

C:\Windows\SysWOW64\Onlooh32.exe
C:\Windows\system32\Onlooh32.exe
149⤵
PID:2984

C:\Windows\SysWOW64\Oheppe32.exe
C:\Windows\system32\Oheppe32.exe
150⤵
PID:760

C:\Windows\SysWOW64\Panehkaj.exe
C:\Windows\system32\Panehkaj.exe
151⤵
- Modifies registry class
PID:2852

C:\Windows\SysWOW64\Plcied32.exe
C:\Windows\system32\Plcied32.exe
152⤵
PID:2464

C:\Windows\SysWOW64\Pelnniga.exe
C:\Windows\system32\Pelnniga.exe
153⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2240

C:\Windows\SysWOW64\Pkifgpeh.exe
C:\Windows\system32\Pkifgpeh.exe
154⤵
PID:1508

C:\Windows\SysWOW64\Pgogla32.exe
C:\Windows\system32\Pgogla32.exe
155⤵
PID:1296

C:\Windows\SysWOW64\Paekijkb.exe
C:\Windows\system32\Paekijkb.exe
156⤵
PID:1120

C:\Windows\SysWOW64\Pgacaaij.exe
C:\Windows\system32\Pgacaaij.exe
157⤵
- Drops file in System32 directory
PID:1964

C:\Windows\SysWOW64\Pchdfb32.exe
C:\Windows\system32\Pchdfb32.exe
158⤵
PID:2892

C:\Windows\SysWOW64\Pjblcl32.exe
C:\Windows\system32\Pjblcl32.exe
159⤵
PID:2356

C:\Windows\SysWOW64\Qdhqpe32.exe
C:\Windows\system32\Qdhqpe32.exe
160⤵
- Modifies registry class
PID:2804

C:\Windows\SysWOW64\Qqoaefke.exe
C:\Windows\system32\Qqoaefke.exe
161⤵
PID:1264

C:\Windows\SysWOW64\Aijfihip.exe
C:\Windows\system32\Aijfihip.exe
162⤵
PID:2576

C:\Windows\SysWOW64\Ajibckpc.exe
C:\Windows\system32\Ajibckpc.exe
163⤵
PID:3044

C:\Windows\SysWOW64\Aofklbnj.exe
C:\Windows\system32\Aofklbnj.exe
164⤵
PID:2148

C:\Windows\SysWOW64\Aioodg32.exe
C:\Windows\system32\Aioodg32.exe
165⤵
PID:2796

C:\Windows\SysWOW64\Agdlfd32.exe
C:\Windows\system32\Agdlfd32.exe
166⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1224

C:\Windows\SysWOW64\Aalaoipc.exe
C:\Windows\system32\Aalaoipc.exe
167⤵
PID:2176

C:\Windows\SysWOW64\Akbelbpi.exe
C:\Windows\system32\Akbelbpi.exe
168⤵
PID:936

C:\Windows\SysWOW64\Aaondi32.exe
C:\Windows\system32\Aaondi32.exe
169⤵
PID:2552

C:\Windows\SysWOW64\Bkdbab32.exe
C:\Windows\system32\Bkdbab32.exe
170⤵
- Drops file in System32 directory
PID:848

C:\Windows\SysWOW64\Bemfjgdg.exe
C:\Windows\system32\Bemfjgdg.exe
171⤵
PID:2812

C:\Windows\SysWOW64\Bmhkojab.exe
C:\Windows\system32\Bmhkojab.exe
172⤵
- Drops file in System32 directory
PID:1132

C:\Windows\SysWOW64\Bbgplq32.exe
C:\Windows\system32\Bbgplq32.exe
173⤵
PID:2144

C:\Windows\SysWOW64\Behinlkh.exe
C:\Windows\system32\Behinlkh.exe
174⤵
PID:1280

C:\Windows\SysWOW64\Cfgehn32.exe
C:\Windows\system32\Cfgehn32.exe
175⤵
- System Location Discovery: System Language Discovery
PID:328

C:\Windows\SysWOW64\Dijgnm32.exe
C:\Windows\system32\Dijgnm32.exe
176⤵
PID:2328

C:\Windows\SysWOW64\Dlkqpg32.exe
C:\Windows\system32\Dlkqpg32.exe
177⤵
PID:2800

C:\Windows\SysWOW64\Eioaillo.exe
C:\Windows\system32\Eioaillo.exe
178⤵
PID:1800

C:\Windows\SysWOW64\Eokiabjf.exe
C:\Windows\system32\Eokiabjf.exe
179⤵
PID:3032

C:\Windows\SysWOW64\Edhbjjhn.exe
C:\Windows\system32\Edhbjjhn.exe
180⤵
PID:1344

C:\Windows\SysWOW64\Elpjkgip.exe
C:\Windows\system32\Elpjkgip.exe
181⤵
- Modifies registry class
PID:2320

C:\Windows\SysWOW64\Eehndm32.exe
C:\Windows\system32\Eehndm32.exe
182⤵
PID:3096

C:\Windows\SysWOW64\Encchoml.exe
C:\Windows\system32\Encchoml.exe
183⤵
PID:3136

C:\Windows\SysWOW64\Egkgad32.exe
C:\Windows\system32\Egkgad32.exe
184⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3176

C:\Windows\SysWOW64\Enepnoji.exe
C:\Windows\system32\Enepnoji.exe
185⤵
- Drops file in System32 directory
PID:3220

C:\Windows\SysWOW64\Fnjiin32.exe
C:\Windows\system32\Fnjiin32.exe
186⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3264

C:\Windows\SysWOW64\Fjajno32.exe
C:\Windows\system32\Fjajno32.exe
187⤵
- System Location Discovery: System Language Discovery
PID:3304

C:\Windows\SysWOW64\Fjcfco32.exe
C:\Windows\system32\Fjcfco32.exe
188⤵
PID:3344

C:\Windows\SysWOW64\Gfldno32.exe
C:\Windows\system32\Gfldno32.exe
189⤵
PID:3384

C:\Windows\SysWOW64\Geaaolbo.exe
C:\Windows\system32\Geaaolbo.exe
190⤵
PID:3424

C:\Windows\SysWOW64\Gkkilfjk.exe
C:\Windows\system32\Gkkilfjk.exe
191⤵
PID:3464

C:\Windows\SysWOW64\Ggbjag32.exe
C:\Windows\system32\Ggbjag32.exe
192⤵
PID:3504

C:\Windows\SysWOW64\Gmobin32.exe
C:\Windows\system32\Gmobin32.exe
193⤵
- Modifies registry class
PID:3544

C:\Windows\SysWOW64\Gckgkg32.exe
C:\Windows\system32\Gckgkg32.exe
194⤵
PID:3584

C:\Windows\SysWOW64\Hmdldmja.exe
C:\Windows\system32\Hmdldmja.exe
195⤵
PID:3624

C:\Windows\SysWOW64\Hpdefh32.exe
C:\Windows\system32\Hpdefh32.exe
196⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3668

C:\Windows\SysWOW64\Hpgakh32.exe
C:\Windows\system32\Hpgakh32.exe
197⤵
PID:3708

C:\Windows\SysWOW64\Hnlnmd32.exe
C:\Windows\system32\Hnlnmd32.exe
198⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3748

C:\Windows\SysWOW64\Hjcoaeol.exe
C:\Windows\system32\Hjcoaeol.exe
199⤵
- Modifies registry class
PID:3788

C:\Windows\SysWOW64\Inqhhc32.exe
C:\Windows\system32\Inqhhc32.exe
200⤵
- Drops file in System32 directory
- Modifies registry class
PID:3828

C:\Windows\SysWOW64\Iflmlfcn.exe
C:\Windows\system32\Iflmlfcn.exe
201⤵
PID:3868

C:\Windows\SysWOW64\Ifniaeqk.exe
C:\Windows\system32\Ifniaeqk.exe
202⤵
- Drops file in System32 directory
PID:3908

C:\Windows\SysWOW64\Iadnon32.exe
C:\Windows\system32\Iadnon32.exe
203⤵
PID:3948

C:\Windows\SysWOW64\Ipijpkei.exe
C:\Windows\system32\Ipijpkei.exe
204⤵
PID:3988

C:\Windows\SysWOW64\Ilpkel32.exe
C:\Windows\system32\Ilpkel32.exe
205⤵
PID:4036

C:\Windows\SysWOW64\Jbjcaf32.exe
C:\Windows\system32\Jbjcaf32.exe
206⤵
PID:4080

C:\Windows\SysWOW64\Jiclnpjg.exe
C:\Windows\system32\Jiclnpjg.exe
207⤵
PID:2388

C:\Windows\SysWOW64\Jblpge32.exe
C:\Windows\system32\Jblpge32.exe
208⤵
PID:3108

C:\Windows\SysWOW64\Jlddpkgh.exe
C:\Windows\system32\Jlddpkgh.exe
209⤵
PID:3196

C:\Windows\SysWOW64\Jaamhb32.exe
C:\Windows\system32\Jaamhb32.exe
210⤵
PID:3240

C:\Windows\SysWOW64\Jkjaaglp.exe
C:\Windows\system32\Jkjaaglp.exe
211⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:3300

C:\Windows\SysWOW64\Jeofnpke.exe
C:\Windows\system32\Jeofnpke.exe
212⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3336

C:\Windows\SysWOW64\Jnjjcbiq.exe
C:\Windows\system32\Jnjjcbiq.exe
213⤵
PID:3392

C:\Windows\SysWOW64\Kjakhcne.exe
C:\Windows\system32\Kjakhcne.exe
214⤵
PID:3440

C:\Windows\SysWOW64\Kkqhbf32.exe
C:\Windows\system32\Kkqhbf32.exe
215⤵
PID:3492

C:\Windows\SysWOW64\Kcllfi32.exe
C:\Windows\system32\Kcllfi32.exe
216⤵
- Modifies registry class
PID:3524

C:\Windows\SysWOW64\Kgjelg32.exe
C:\Windows\system32\Kgjelg32.exe
217⤵
PID:3580

C:\Windows\SysWOW64\Klfndn32.exe
C:\Windows\system32\Klfndn32.exe
218⤵
PID:3636

C:\Windows\SysWOW64\Kbcfme32.exe
C:\Windows\system32\Kbcfme32.exe
219⤵
PID:3688

C:\Windows\SysWOW64\Lbfcbdce.exe
C:\Windows\system32\Lbfcbdce.exe
220⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3732

C:\Windows\SysWOW64\Lkngkj32.exe
C:\Windows\system32\Lkngkj32.exe
221⤵
- System Location Discovery: System Language Discovery
PID:3784

C:\Windows\SysWOW64\Lfckhc32.exe
C:\Windows\system32\Lfckhc32.exe
222⤵
PID:3844

C:\Windows\SysWOW64\Lkqdajhc.exe
C:\Windows\system32\Lkqdajhc.exe
223⤵
PID:3888

C:\Windows\SysWOW64\Lggdfk32.exe
C:\Windows\system32\Lggdfk32.exe
224⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3936

C:\Windows\SysWOW64\Lcneklck.exe
C:\Windows\system32\Lcneklck.exe
225⤵
PID:3984

C:\Windows\SysWOW64\Lcpbpk32.exe
C:\Windows\system32\Lcpbpk32.exe
226⤵
PID:4032

C:\Windows\SysWOW64\Mpnifkae.exe
C:\Windows\system32\Mpnifkae.exe
227⤵
- Drops file in System32 directory
PID:2392

C:\Windows\SysWOW64\Mifmoa32.exe
C:\Windows\system32\Mifmoa32.exe
228⤵
- Modifies registry class
PID:3116

C:\Windows\SysWOW64\Mncfgh32.exe
C:\Windows\system32\Mncfgh32.exe
229⤵
PID:3172

C:\Windows\SysWOW64\Niijdq32.exe
C:\Windows\system32\Niijdq32.exe
230⤵
PID:3228

C:\Windows\SysWOW64\Nlgfqldf.exe
C:\Windows\system32\Nlgfqldf.exe
231⤵
PID:3260

C:\Windows\SysWOW64\Ncbkenba.exe
C:\Windows\system32\Ncbkenba.exe
232⤵
PID:3376

C:\Windows\SysWOW64\Nmkpnd32.exe
C:\Windows\system32\Nmkpnd32.exe
233⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3432

C:\Windows\SysWOW64\Njopgh32.exe
C:\Windows\system32\Njopgh32.exe
234⤵
PID:3476

C:\Windows\SysWOW64\Nmpiicdm.exe
C:\Windows\system32\Nmpiicdm.exe
235⤵
- Modifies registry class
PID:3556

C:\Windows\SysWOW64\Nfhmai32.exe
C:\Windows\system32\Nfhmai32.exe
236⤵
PID:4076

C:\Windows\SysWOW64\Oppbjn32.exe
C:\Windows\system32\Oppbjn32.exe
237⤵
- Modifies registry class
PID:3664

C:\Windows\SysWOW64\Olgboogb.exe
C:\Windows\system32\Olgboogb.exe
238⤵
- System Location Discovery: System Language Discovery
PID:3728

C:\Windows\SysWOW64\Ofmgmhgh.exe
C:\Windows\system32\Ofmgmhgh.exe
239⤵
- Drops file in System32 directory
PID:3808

C:\Windows\SysWOW64\Oimpnc32.exe
C:\Windows\system32\Oimpnc32.exe
240⤵
PID:3856

C:\Windows\SysWOW64\Oojhfj32.exe
C:\Windows\system32\Oojhfj32.exe
241⤵
PID:3928

C:\Windows\SysWOW64\Ohbmppia.exe
C:\Windows\system32\Ohbmppia.exe
242⤵
PID:3972

C:\Windows\SysWOW64\Okailkhd.exe
C:\Windows\system32\Okailkhd.exe
243⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3768

C:\Windows\SysWOW64\Oheieo32.exe
C:\Windows\system32\Oheieo32.exe
244⤵
- System Location Discovery: System Language Discovery
PID:4092

C:\Windows\SysWOW64\Pmabmf32.exe
C:\Windows\system32\Pmabmf32.exe
245⤵
PID:3148

C:\Windows\SysWOW64\Pkebgj32.exe
C:\Windows\system32\Pkebgj32.exe
246⤵
- System Location Discovery: System Language Discovery
PID:3256

C:\Windows\SysWOW64\Papkcd32.exe
C:\Windows\system32\Papkcd32.exe
247⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3324

C:\Windows\SysWOW64\Plildb32.exe
C:\Windows\system32\Plildb32.exe
248⤵
PID:3416

C:\Windows\SysWOW64\Pllhib32.exe
C:\Windows\system32\Pllhib32.exe
249⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3480

C:\Windows\SysWOW64\Polakmbi.exe
C:\Windows\system32\Polakmbi.exe
250⤵
PID:3568

C:\Windows\SysWOW64\Qkcbpn32.exe
C:\Windows\system32\Qkcbpn32.exe
251⤵
PID:3648

C:\Windows\SysWOW64\Qkeofnfk.exe
C:\Windows\system32\Qkeofnfk.exe
252⤵
PID:3716

C:\Windows\SysWOW64\Andkbien.exe
C:\Windows\system32\Andkbien.exe
253⤵
PID:3820

C:\Windows\SysWOW64\Adncoc32.exe
C:\Windows\system32\Adncoc32.exe
254⤵
PID:3860

C:\Windows\SysWOW64\Akhkkmdh.exe
C:\Windows\system32\Akhkkmdh.exe
255⤵
PID:3956

C:\Windows\SysWOW64\Anhdmh32.exe
C:\Windows\system32\Anhdmh32.exe
256⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3960

C:\Windows\SysWOW64\Acemeo32.exe
C:\Windows\system32\Acemeo32.exe
257⤵
PID:4060

C:\Windows\SysWOW64\Achikonn.exe
C:\Windows\system32\Achikonn.exe
258⤵
PID:3128

C:\Windows\SysWOW64\Ajaagi32.exe
C:\Windows\system32\Ajaagi32.exe
259⤵
- Modifies registry class
PID:3188

C:\Windows\SysWOW64\Aonjpp32.exe
C:\Windows\system32\Aonjpp32.exe
260⤵
- System Location Discovery: System Language Discovery
PID:3372

C:\Windows\SysWOW64\Bjdnmi32.exe
C:\Windows\system32\Bjdnmi32.exe
261⤵
PID:3444

C:\Windows\SysWOW64\Bfkobj32.exe
C:\Windows\system32\Bfkobj32.exe
262⤵
PID:3540

C:\Windows\SysWOW64\Bocckoom.exe
C:\Windows\system32\Bocckoom.exe
263⤵
PID:3616

C:\Windows\SysWOW64\Bfmlgi32.exe
C:\Windows\system32\Bfmlgi32.exe
264⤵
- System Location Discovery: System Language Discovery
PID:3704

C:\Windows\SysWOW64\Bmgddcnf.exe
C:\Windows\system32\Bmgddcnf.exe
265⤵
PID:3692

C:\Windows\SysWOW64\Bnkmakbb.exe
C:\Windows\system32\Bnkmakbb.exe
266⤵
PID:3876

C:\Windows\SysWOW64\Bkonkpqk.exe
C:\Windows\system32\Bkonkpqk.exe
267⤵
PID:904

C:\Windows\SysWOW64\Cegbce32.exe
C:\Windows\system32\Cegbce32.exe
268⤵
PID:4056

C:\Windows\SysWOW64\Cmbghgdg.exe
C:\Windows\system32\Cmbghgdg.exe
269⤵
PID:3152

C:\Windows\SysWOW64\Cappnf32.exe
C:\Windows\system32\Cappnf32.exe
270⤵
PID:3280

C:\Windows\SysWOW64\Cfmhfm32.exe
C:\Windows\system32\Cfmhfm32.exe
271⤵
PID:3420

C:\Windows\SysWOW64\Cbcikn32.exe
C:\Windows\system32\Cbcikn32.exe
272⤵
PID:3516

C:\Windows\SysWOW64\Cllmdcej.exe
C:\Windows\system32\Cllmdcej.exe
273⤵
PID:3660

C:\Windows\SysWOW64\Cipnng32.exe
C:\Windows\system32\Cipnng32.exe
274⤵
PID:3776

C:\Windows\SysWOW64\Dbhbfmkd.exe
C:\Windows\system32\Dbhbfmkd.exe
275⤵
PID:3916

C:\Windows\SysWOW64\Dlqgob32.exe
C:\Windows\system32\Dlqgob32.exe
276⤵
PID:940

C:\Windows\SysWOW64\Dkfcqo32.exe
C:\Windows\system32\Dkfcqo32.exe
277⤵
PID:4064

C:\Windows\SysWOW64\Ddnhidmm.exe
C:\Windows\system32\Ddnhidmm.exe
278⤵
PID:4088

C:\Windows\SysWOW64\Dodlfmlb.exe
C:\Windows\system32\Dodlfmlb.exe
279⤵
- System Location Discovery: System Language Discovery
PID:3404

C:\Windows\SysWOW64\Ddcadd32.exe
C:\Windows\system32\Ddcadd32.exe
280⤵
PID:3528

C:\Windows\SysWOW64\Emkfmioh.exe
C:\Windows\system32\Emkfmioh.exe
281⤵
- System Location Discovery: System Language Discovery
PID:3612

C:\Windows\SysWOW64\Egdjfo32.exe
C:\Windows\system32\Egdjfo32.exe
282⤵
- Drops file in System32 directory
- Modifies registry class
PID:3840

C:\Windows\SysWOW64\Elqcnfdp.exe
C:\Windows\system32\Elqcnfdp.exe
283⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:908

C:\Windows\SysWOW64\Ecmhqp32.exe
C:\Windows\system32\Ecmhqp32.exe
284⤵
- System Location Discovery: System Language Discovery
PID:1036

C:\Windows\SysWOW64\Ehjqif32.exe
C:\Windows\system32\Ehjqif32.exe
285⤵
PID:3112

C:\Windows\SysWOW64\Eenabkfk.exe
C:\Windows\system32\Eenabkfk.exe
286⤵
PID:3356

C:\Windows\SysWOW64\Fofekp32.exe
C:\Windows\system32\Fofekp32.exe
287⤵
PID:3596

C:\Windows\SysWOW64\Fohbqpki.exe
C:\Windows\system32\Fohbqpki.exe
288⤵
- Modifies registry class
PID:3760

C:\Windows\SysWOW64\Fdekigip.exe
C:\Windows\system32\Fdekigip.exe
289⤵
PID:3160

C:\Windows\SysWOW64\Fplknh32.exe
C:\Windows\system32\Fplknh32.exe
290⤵
- Drops file in System32 directory
PID:3124

C:\Windows\SysWOW64\Fgfckbfa.exe
C:\Windows\system32\Fgfckbfa.exe
291⤵
PID:3380

C:\Windows\SysWOW64\Fdjddf32.exe
C:\Windows\system32\Fdjddf32.exe
292⤵
PID:3604

C:\Windows\SysWOW64\Fnbhmlkk.exe
C:\Windows\system32\Fnbhmlkk.exe
293⤵
- Drops file in System32 directory
PID:3896

C:\Windows\SysWOW64\Gndebkii.exe
C:\Windows\system32\Gndebkii.exe
294⤵
PID:3880

C:\Windows\SysWOW64\Ggmjkapi.exe
C:\Windows\system32\Ggmjkapi.exe
295⤵
PID:3328

C:\Windows\SysWOW64\Gohnpcmd.exe
C:\Windows\system32\Gohnpcmd.exe
296⤵
- Modifies registry class
PID:3620

C:\Windows\SysWOW64\Gjnbmlmj.exe
C:\Windows\system32\Gjnbmlmj.exe
297⤵
PID:3800

C:\Windows\SysWOW64\Gbigao32.exe
C:\Windows\system32\Gbigao32.exe
298⤵
PID:4072

C:\Windows\SysWOW64\Gmnlog32.exe
C:\Windows\system32\Gmnlog32.exe
299⤵
PID:3352

C:\Windows\SysWOW64\Gdjpcj32.exe
C:\Windows\system32\Gdjpcj32.exe
300⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3804

C:\Windows\SysWOW64\Gnbelong.exe
C:\Windows\system32\Gnbelong.exe
301⤵
PID:3208

C:\Windows\SysWOW64\Hjieapck.exe
C:\Windows\system32\Hjieapck.exe
302⤵
PID:3320

C:\Windows\SysWOW64\Henjnica.exe
C:\Windows\system32\Henjnica.exe
303⤵
PID:4052

C:\Windows\SysWOW64\Haejcj32.exe
C:\Windows\system32\Haejcj32.exe
304⤵
PID:3576

C:\Windows\SysWOW64\Hjmolp32.exe
C:\Windows\system32\Hjmolp32.exe
305⤵
PID:3284

C:\Windows\SysWOW64\Hgaoec32.exe
C:\Windows\system32\Hgaoec32.exe
306⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:4068

C:\Windows\SysWOW64\Hajdniep.exe
C:\Windows\system32\Hajdniep.exe
307⤵
PID:3456

C:\Windows\SysWOW64\Hjbhgolp.exe
C:\Windows\system32\Hjbhgolp.exe
308⤵
PID:3408

C:\Windows\SysWOW64\Ibmmkaik.exe
C:\Windows\system32\Ibmmkaik.exe
309⤵
PID:3656

C:\Windows\SysWOW64\Indnqb32.exe
C:\Windows\system32\Indnqb32.exe
310⤵
PID:3500

C:\Windows\SysWOW64\Ihlbih32.exe
C:\Windows\system32\Ihlbih32.exe
311⤵
PID:4104

C:\Windows\SysWOW64\Ieqbbl32.exe
C:\Windows\system32\Ieqbbl32.exe
312⤵
PID:4144

C:\Windows\SysWOW64\Iljkofkg.exe
C:\Windows\system32\Iljkofkg.exe
313⤵
PID:4184

C:\Windows\SysWOW64\Ihaldgak.exe
C:\Windows\system32\Ihaldgak.exe
314⤵
PID:4224

C:\Windows\SysWOW64\Imndmnob.exe
C:\Windows\system32\Imndmnob.exe
315⤵
PID:4264

C:\Windows\SysWOW64\Jmpqbnmp.exe
C:\Windows\system32\Jmpqbnmp.exe
316⤵
PID:4308

C:\Windows\SysWOW64\Jhfepfme.exe
C:\Windows\system32\Jhfepfme.exe
317⤵
PID:4348

C:\Windows\SysWOW64\Jigagocd.exe
C:\Windows\system32\Jigagocd.exe
318⤵
PID:4388

C:\Windows\SysWOW64\Jbpfpd32.exe
C:\Windows\system32\Jbpfpd32.exe
319⤵
- Modifies registry class
PID:4428

C:\Windows\SysWOW64\Jmejmm32.exe
C:\Windows\system32\Jmejmm32.exe
320⤵
PID:4468

C:\Windows\SysWOW64\Jbbbed32.exe
C:\Windows\system32\Jbbbed32.exe
321⤵
PID:4508

C:\Windows\SysWOW64\Jeblgodb.exe
C:\Windows\system32\Jeblgodb.exe
322⤵
PID:4548

C:\Windows\SysWOW64\Jlmddi32.exe
C:\Windows\system32\Jlmddi32.exe
323⤵
PID:4588

C:\Windows\SysWOW64\Khcdijac.exe
C:\Windows\system32\Khcdijac.exe
324⤵
- System Location Discovery: System Language Discovery
PID:4628

C:\Windows\SysWOW64\Kommediq.exe
C:\Windows\system32\Kommediq.exe
325⤵
- System Location Discovery: System Language Discovery
PID:4668

C:\Windows\SysWOW64\Kanfgofa.exe
C:\Windows\system32\Kanfgofa.exe
326⤵
- System Location Discovery: System Language Discovery
PID:4708

C:\Windows\SysWOW64\Kobfqc32.exe
C:\Windows\system32\Kobfqc32.exe
327⤵
PID:4748

C:\Windows\SysWOW64\Kkigfdjo.exe
C:\Windows\system32\Kkigfdjo.exe
328⤵
PID:4788

C:\Windows\SysWOW64\Kpeonkig.exe
C:\Windows\system32\Kpeonkig.exe
329⤵
PID:4828

C:\Windows\SysWOW64\Lnipgp32.exe
C:\Windows\system32\Lnipgp32.exe
330⤵
PID:4872

C:\Windows\SysWOW64\Lgbdpena.exe
C:\Windows\system32\Lgbdpena.exe
331⤵
- Drops file in System32 directory
PID:4916

C:\Windows\SysWOW64\Lpjiik32.exe
C:\Windows\system32\Lpjiik32.exe
332⤵
PID:4956

C:\Windows\SysWOW64\Lgdafeln.exe
C:\Windows\system32\Lgdafeln.exe
333⤵
PID:4996

C:\Windows\SysWOW64\Llainlje.exe
C:\Windows\system32\Llainlje.exe
334⤵
PID:5036

C:\Windows\SysWOW64\Llcfck32.exe
C:\Windows\system32\Llcfck32.exe
335⤵
PID:5076

C:\Windows\SysWOW64\Lflklaoc.exe
C:\Windows\system32\Lflklaoc.exe
336⤵
PID:5116

C:\Windows\SysWOW64\Lodoefed.exe
C:\Windows\system32\Lodoefed.exe
337⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:4120

C:\Windows\SysWOW64\Mgodjico.exe
C:\Windows\system32\Mgodjico.exe
338⤵
- System Location Discovery: System Language Discovery
PID:4192

C:\Windows\SysWOW64\Mqhhbn32.exe
C:\Windows\system32\Mqhhbn32.exe
339⤵
- System Location Discovery: System Language Discovery
PID:4220

C:\Windows\SysWOW64\Mqjehngm.exe
C:\Windows\system32\Mqjehngm.exe
340⤵
- System Location Discovery: System Language Discovery
PID:4288

C:\Windows\SysWOW64\Mnneabff.exe
C:\Windows\system32\Mnneabff.exe
341⤵
PID:4332

C:\Windows\SysWOW64\Mcknjidn.exe
C:\Windows\system32\Mcknjidn.exe
342⤵
PID:2296

C:\Windows\SysWOW64\Mjeffc32.exe
C:\Windows\system32\Mjeffc32.exe
343⤵
- Drops file in System32 directory
PID:4400

C:\Windows\SysWOW64\Mpaoojjb.exe
C:\Windows\system32\Mpaoojjb.exe
344⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4464

C:\Windows\SysWOW64\Nqakim32.exe
C:\Windows\system32\Nqakim32.exe
345⤵
PID:2784

C:\Windows\SysWOW64\Npieoi32.exe
C:\Windows\system32\Npieoi32.exe
346⤵
- Drops file in System32 directory
PID:4536

C:\Windows\SysWOW64\Npkaei32.exe
C:\Windows\system32\Npkaei32.exe
347⤵
PID:4604

C:\Windows\SysWOW64\Nhffikob.exe
C:\Windows\system32\Nhffikob.exe
348⤵
PID:4644

C:\Windows\SysWOW64\Odmgnl32.exe
C:\Windows\system32\Odmgnl32.exe
349⤵
PID:4684

C:\Windows\SysWOW64\Onbkle32.exe
C:\Windows\system32\Onbkle32.exe
350⤵
PID:4728

C:\Windows\SysWOW64\Ododdlcd.exe
C:\Windows\system32\Ododdlcd.exe
351⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4768

C:\Windows\SysWOW64\Oacdmpan.exe
C:\Windows\system32\Oacdmpan.exe
352⤵
PID:4804

C:\Windows\SysWOW64\Ofpmegpe.exe
C:\Windows\system32\Ofpmegpe.exe
353⤵
PID:4860

C:\Windows\SysWOW64\Omjeba32.exe
C:\Windows\system32\Omjeba32.exe
354⤵
PID:4908

C:\Windows\SysWOW64\Ojnelefl.exe
C:\Windows\system32\Ojnelefl.exe
355⤵
PID:4948

C:\Windows\SysWOW64\Oegflcbj.exe
C:\Windows\system32\Oegflcbj.exe
356⤵
PID:5004

C:\Windows\SysWOW64\Ppmkilbp.exe
C:\Windows\system32\Ppmkilbp.exe
357⤵
PID:5044

C:\Windows\SysWOW64\Phhonn32.exe
C:\Windows\system32\Phhonn32.exe
358⤵
- Modifies registry class
PID:5088

C:\Windows\SysWOW64\Pelpgb32.exe
C:\Windows\system32\Pelpgb32.exe
359⤵
PID:3212

C:\Windows\SysWOW64\Pkihpi32.exe
C:\Windows\system32\Pkihpi32.exe
360⤵
- Drops file in System32 directory
PID:4136

C:\Windows\SysWOW64\Pdamhocm.exe
C:\Windows\system32\Pdamhocm.exe
361⤵
PID:1488

C:\Windows\SysWOW64\Paemac32.exe
C:\Windows\system32\Paemac32.exe
362⤵
- Drops file in System32 directory
PID:4244

C:\Windows\SysWOW64\Poinkg32.exe
C:\Windows\system32\Poinkg32.exe
363⤵
PID:4316

C:\Windows\SysWOW64\Qkpnph32.exe
C:\Windows\system32\Qkpnph32.exe
364⤵
PID:4380

C:\Windows\SysWOW64\Qajfmbna.exe
C:\Windows\system32\Qajfmbna.exe
365⤵
- System Location Discovery: System Language Discovery
PID:1648

C:\Windows\SysWOW64\Qnagbc32.exe
C:\Windows\system32\Qnagbc32.exe
366⤵
- System Location Discovery: System Language Discovery
PID:4448

C:\Windows\SysWOW64\Acnpjj32.exe
C:\Windows\system32\Acnpjj32.exe
367⤵
PID:2160

C:\Windows\SysWOW64\Acplpjpj.exe
C:\Windows\system32\Acplpjpj.exe
368⤵
PID:4524

C:\Windows\SysWOW64\Ahmehqna.exe
C:\Windows\system32\Ahmehqna.exe
369⤵
PID:912

C:\Windows\SysWOW64\Aogmdk32.exe
C:\Windows\system32\Aogmdk32.exe
370⤵
PID:4612

C:\Windows\SysWOW64\Afqeaemk.exe
C:\Windows\system32\Afqeaemk.exe
371⤵
PID:2444

C:\Windows\SysWOW64\Acdfki32.exe
C:\Windows\system32\Acdfki32.exe
372⤵
PID:4700

C:\Windows\SysWOW64\Adfbbabc.exe
C:\Windows\system32\Adfbbabc.exe
373⤵
PID:4772

C:\Windows\SysWOW64\Abjcleqm.exe
C:\Windows\system32\Abjcleqm.exe
374⤵
- Drops file in System32 directory
- Modifies registry class
PID:4824

C:\Windows\SysWOW64\Aggkdlod.exe
C:\Windows\system32\Aggkdlod.exe
375⤵
PID:4912

C:\Windows\SysWOW64\Bblpae32.exe
C:\Windows\system32\Bblpae32.exe
376⤵
PID:4904

C:\Windows\SysWOW64\Bgihjl32.exe
C:\Windows\system32\Bgihjl32.exe
377⤵
PID:4972

C:\Windows\SysWOW64\Bcpiombe.exe
C:\Windows\system32\Bcpiombe.exe
378⤵
- System Location Discovery: System Language Discovery
PID:5028

C:\Windows\SysWOW64\Bnemlf32.exe
C:\Windows\system32\Bnemlf32.exe
379⤵
PID:2864

C:\Windows\SysWOW64\Bjlnaghp.exe
C:\Windows\system32\Bjlnaghp.exe
380⤵
PID:3772

C:\Windows\SysWOW64\Boifinfg.exe
C:\Windows\system32\Boifinfg.exe
381⤵
- Modifies registry class
PID:4140

C:\Windows\SysWOW64\Bmmgbbeq.exe
C:\Windows\system32\Bmmgbbeq.exe
382⤵
PID:4156

C:\Windows\SysWOW64\Bbjoki32.exe
C:\Windows\system32\Bbjoki32.exe
383⤵
PID:2772

C:\Windows\SysWOW64\Cbllph32.exe
C:\Windows\system32\Cbllph32.exe
384⤵
PID:4272

C:\Windows\SysWOW64\Cmapna32.exe
C:\Windows\system32\Cmapna32.exe
385⤵
PID:4356

C:\Windows\SysWOW64\Cbnhfhoc.exe
C:\Windows\system32\Cbnhfhoc.exe
386⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4412

C:\Windows\SysWOW64\Ckgmon32.exe
C:\Windows\system32\Ckgmon32.exe
387⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:1976

C:\Windows\SysWOW64\Ceoagcld.exe
C:\Windows\system32\Ceoagcld.exe
388⤵
PID:4488

C:\Windows\SysWOW64\Cafbmdbh.exe
C:\Windows\system32\Cafbmdbh.exe
389⤵
PID:4584

C:\Windows\SysWOW64\Cnjbfhqa.exe
C:\Windows\system32\Cnjbfhqa.exe
390⤵
PID:4576

C:\Windows\SysWOW64\Dcfknooi.exe
C:\Windows\system32\Dcfknooi.exe
391⤵
PID:4696

C:\Windows\SysWOW64\Dpmlcpdm.exe
C:\Windows\system32\Dpmlcpdm.exe
392⤵
PID:2628

C:\Windows\SysWOW64\Dfgdpj32.exe
C:\Windows\system32\Dfgdpj32.exe
393⤵
- Modifies registry class
PID:1276

C:\Windows\SysWOW64\Damhmc32.exe
C:\Windows\system32\Damhmc32.exe
394⤵
- Modifies registry class
PID:4848

C:\Windows\SysWOW64\Dfjaej32.exe
C:\Windows\system32\Dfjaej32.exe
395⤵
- Modifies registry class
PID:2384

C:\Windows\SysWOW64\Dpbenpqh.exe
C:\Windows\system32\Dpbenpqh.exe
396⤵
PID:2292

C:\Windows\SysWOW64\Deonff32.exe
C:\Windows\system32\Deonff32.exe
397⤵
PID:1536

C:\Windows\SysWOW64\Dimfmeef.exe
C:\Windows\system32\Dimfmeef.exe
398⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5072

C:\Windows\SysWOW64\Eecgafkj.exe
C:\Windows\system32\Eecgafkj.exe
399⤵
PID:5112

C:\Windows\SysWOW64\Ebghkjjc.exe
C:\Windows\system32\Ebghkjjc.exe
400⤵
- Modifies registry class
PID:3780

C:\Windows\SysWOW64\Eonhpk32.exe
C:\Windows\system32\Eonhpk32.exe
401⤵
- Modifies registry class
PID:4200

C:\Windows\SysWOW64\Egimdmmc.exe
C:\Windows\system32\Egimdmmc.exe
402⤵
PID:4260

C:\Windows\SysWOW64\Emceag32.exe
C:\Windows\system32\Emceag32.exe
403⤵
PID:4280

C:\Windows\SysWOW64\Ehiiop32.exe
C:\Windows\system32\Ehiiop32.exe
404⤵
- System Location Discovery: System Language Discovery
PID:4364

C:\Windows\SysWOW64\Eaangfjf.exe
C:\Windows\system32\Eaangfjf.exe
405⤵
PID:4436

C:\Windows\SysWOW64\Fimclh32.exe
C:\Windows\system32\Fimclh32.exe
406⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:788

C:\Windows\SysWOW64\Fdbgia32.exe
C:\Windows\system32\Fdbgia32.exe
407⤵
PID:5068

C:\Windows\SysWOW64\Fiopah32.exe
C:\Windows\system32\Fiopah32.exe
408⤵
- Modifies registry class
PID:2904

C:\Windows\SysWOW64\Fialggcl.exe
C:\Windows\system32\Fialggcl.exe
409⤵
PID:4624

C:\Windows\SysWOW64\Goekpm32.exe
C:\Windows\system32\Goekpm32.exe
410⤵
PID:4656

C:\Windows\SysWOW64\Ghmohcbl.exe
C:\Windows\system32\Ghmohcbl.exe
411⤵
- System Location Discovery: System Language Discovery
PID:4764

C:\Windows\SysWOW64\Gcgpiq32.exe
C:\Windows\system32\Gcgpiq32.exe
412⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4796

C:\Windows\SysWOW64\Gnmdfi32.exe
C:\Windows\system32\Gnmdfi32.exe
413⤵
PID:4856

C:\Windows\SysWOW64\Gfhikl32.exe
C:\Windows\system32\Gfhikl32.exe
414⤵
PID:2648

C:\Windows\SysWOW64\Hqpjndio.exe
C:\Windows\system32\Hqpjndio.exe
415⤵
PID:2136

C:\Windows\SysWOW64\Hikobfgj.exe
C:\Windows\system32\Hikobfgj.exe
416⤵
PID:5020

C:\Windows\SysWOW64\Hcqcoo32.exe
C:\Windows\system32\Hcqcoo32.exe
417⤵
PID:3016

C:\Windows\SysWOW64\Hnjdpm32.exe
C:\Windows\system32\Hnjdpm32.exe
418⤵
- System Location Discovery: System Language Discovery
PID:1180

C:\Windows\SysWOW64\Hedllgjk.exe
C:\Windows\system32\Hedllgjk.exe
419⤵
PID:2792

C:\Windows\SysWOW64\Hgbhibio.exe
C:\Windows\system32\Hgbhibio.exe
420⤵
PID:992

C:\Windows\SysWOW64\Hgeenb32.exe
C:\Windows\system32\Hgeenb32.exe
421⤵
PID:2072

C:\Windows\SysWOW64\Iamjghnm.exe
C:\Windows\system32\Iamjghnm.exe
422⤵
PID:4852

C:\Windows\SysWOW64\Ijenpn32.exe
C:\Windows\system32\Ijenpn32.exe
423⤵
PID:4376

C:\Windows\SysWOW64\Icnbic32.exe
C:\Windows\system32\Icnbic32.exe
424⤵
PID:1388

C:\Windows\SysWOW64\Iabcbg32.exe
C:\Windows\system32\Iabcbg32.exe
425⤵
PID:4416

C:\Windows\SysWOW64\Imidgh32.exe
C:\Windows\system32\Imidgh32.exe
426⤵
- System Location Discovery: System Language Discovery
PID:4516

C:\Windows\SysWOW64\Ifahpnfl.exe
C:\Windows\system32\Ifahpnfl.exe
427⤵
- Drops file in System32 directory
PID:2964

C:\Windows\SysWOW64\Iiodliep.exe
C:\Windows\system32\Iiodliep.exe
428⤵
PID:3040

C:\Windows\SysWOW64\Ilnqhddd.exe
C:\Windows\system32\Ilnqhddd.exe
429⤵
PID:2156

C:\Windows\SysWOW64\Jiaaaicm.exe
C:\Windows\system32\Jiaaaicm.exe
430⤵
PID:4652

C:\Windows\SysWOW64\Jehbfjia.exe
C:\Windows\system32\Jehbfjia.exe
431⤵
PID:4660

C:\Windows\SysWOW64\Jnafop32.exe
C:\Windows\system32\Jnafop32.exe
432⤵
PID:4732

C:\Windows\SysWOW64\Jocceo32.exe
C:\Windows\system32\Jocceo32.exe
433⤵
- Drops file in System32 directory
PID:2216

C:\Windows\SysWOW64\Jdplmflg.exe
C:\Windows\system32\Jdplmflg.exe
434⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1752

C:\Windows\SysWOW64\Jdbhcfjd.exe
C:\Windows\system32\Jdbhcfjd.exe
435⤵
PID:4892

C:\Windows\SysWOW64\Jmkmlk32.exe
C:\Windows\system32\Jmkmlk32.exe
436⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:4984

C:\Windows\SysWOW64\Kfcadq32.exe
C:\Windows\system32\Kfcadq32.exe
437⤵
PID:4944

C:\Windows\SysWOW64\Kbjbibli.exe
C:\Windows\system32\Kbjbibli.exe
438⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:5064

C:\Windows\SysWOW64\Kghkppbp.exe
C:\Windows\system32\Kghkppbp.exe
439⤵
PID:2596

C:\Windows\SysWOW64\Kgjgepqm.exe
C:\Windows\system32\Kgjgepqm.exe
440⤵
PID:2268

C:\Windows\SysWOW64\Khkdmh32.exe
C:\Windows\system32\Khkdmh32.exe
441⤵
PID:1176

C:\Windows\SysWOW64\Keodflee.exe
C:\Windows\system32\Keodflee.exe
442⤵
PID:1980

C:\Windows\SysWOW64\Klimcf32.exe
C:\Windows\system32\Klimcf32.exe
443⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4216

C:\Windows\SysWOW64\Lohiob32.exe
C:\Windows\system32\Lohiob32.exe
444⤵
PID:2284

C:\Windows\SysWOW64\Lllihf32.exe
C:\Windows\system32\Lllihf32.exe
445⤵
PID:780

C:\Windows\SysWOW64\Lahaqm32.exe
C:\Windows\system32\Lahaqm32.exe
446⤵
PID:2744

C:\Windows\SysWOW64\Ldikbhfh.exe
C:\Windows\system32\Ldikbhfh.exe
447⤵
PID:3004

C:\Windows\SysWOW64\Lkccob32.exe
C:\Windows\system32\Lkccob32.exe
448⤵
PID:2492

C:\Windows\SysWOW64\Ldlghhde.exe
C:\Windows\system32\Ldlghhde.exe
449⤵
PID:4544

C:\Windows\SysWOW64\Lpbhmiji.exe
C:\Windows\system32\Lpbhmiji.exe
450⤵
- Modifies registry class
PID:4580

C:\Windows\SysWOW64\Mjkmfn32.exe
C:\Windows\system32\Mjkmfn32.exe
451⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2816

C:\Windows\SysWOW64\Mpeebhhf.exe
C:\Windows\system32\Mpeebhhf.exe
452⤵
PID:2244

C:\Windows\SysWOW64\Mjmiknng.exe
C:\Windows\system32\Mjmiknng.exe
453⤵
PID:1364

C:\Windows\SysWOW64\Mcendc32.exe
C:\Windows\system32\Mcendc32.exe
454⤵
PID:2452

C:\Windows\SysWOW64\Mjofanld.exe
C:\Windows\system32\Mjofanld.exe
455⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:4812

C:\Windows\SysWOW64\Mlnbmikh.exe
C:\Windows\system32\Mlnbmikh.exe
456⤵
PID:1552

C:\Windows\SysWOW64\Mdigakic.exe
C:\Windows\system32\Mdigakic.exe
457⤵
PID:2664

C:\Windows\SysWOW64\Mookod32.exe
C:\Windows\system32\Mookod32.exe
458⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2680

C:\Windows\SysWOW64\Mhgpgjoj.exe
C:\Windows\system32\Mhgpgjoj.exe
459⤵
- Drops file in System32 directory
PID:2868

C:\Windows\SysWOW64\Nbodpo32.exe
C:\Windows\system32\Nbodpo32.exe
460⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2768

C:\Windows\SysWOW64\Ndnplk32.exe
C:\Windows\system32\Ndnplk32.exe
461⤵
- Modifies registry class
PID:4116

C:\Windows\SysWOW64\Nglmifca.exe
C:\Windows\system32\Nglmifca.exe
462⤵
PID:2084

C:\Windows\SysWOW64\Njjieace.exe
C:\Windows\system32\Njjieace.exe
463⤵
- Modifies registry class
PID:2100

C:\Windows\SysWOW64\Ndpmbjbk.exe
C:\Windows\system32\Ndpmbjbk.exe
464⤵
PID:4292

C:\Windows\SysWOW64\Ngoinfao.exe
C:\Windows\system32\Ngoinfao.exe
465⤵
- Drops file in System32 directory
PID:2540

C:\Windows\SysWOW64\Nqgngk32.exe
C:\Windows\system32\Nqgngk32.exe
466⤵
PID:1432

C:\Windows\SysWOW64\Nfcfob32.exe
C:\Windows\system32\Nfcfob32.exe
467⤵
PID:4480

C:\Windows\SysWOW64\Nqijmkfm.exe
C:\Windows\system32\Nqijmkfm.exe
468⤵
PID:996

C:\Windows\SysWOW64\Nffcebdd.exe
C:\Windows\system32\Nffcebdd.exe
469⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2020

C:\Windows\SysWOW64\Nmpkal32.exe
C:\Windows\system32\Nmpkal32.exe
470⤵
- System Location Discovery: System Language Discovery
PID:4600

C:\Windows\SysWOW64\Nfhpjaba.exe
C:\Windows\system32\Nfhpjaba.exe
471⤵
PID:2672

C:\Windows\SysWOW64\Olehbh32.exe
C:\Windows\system32\Olehbh32.exe
472⤵
PID:4676

C:\Windows\SysWOW64\Oiiilm32.exe
C:\Windows\system32\Oiiilm32.exe
473⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1004

C:\Windows\SysWOW64\Opennf32.exe
C:\Windows\system32\Opennf32.exe
474⤵
PID:956

C:\Windows\SysWOW64\Ollncgjq.exe
C:\Windows\system32\Ollncgjq.exe
475⤵
PID:4836

C:\Windows\SysWOW64\Ohcohh32.exe
C:\Windows\system32\Ohcohh32.exe
476⤵
- Modifies registry class
PID:4208

C:\Windows\SysWOW64\Ompgqonl.exe
C:\Windows\system32\Ompgqonl.exe
477⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2952

C:\Windows\SysWOW64\Pnodjb32.exe
C:\Windows\system32\Pnodjb32.exe
478⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2476

C:\Windows\SysWOW64\Ppqqbjkm.exe
C:\Windows\system32\Ppqqbjkm.exe
479⤵
PID:2624

C:\Windows\SysWOW64\Pfobjdoe.exe
C:\Windows\system32\Pfobjdoe.exe
480⤵
- Drops file in System32 directory
PID:2564

C:\Windows\SysWOW64\Pbfcoedi.exe
C:\Windows\system32\Pbfcoedi.exe
481⤵
PID:2572

C:\Windows\SysWOW64\Pedokpcm.exe
C:\Windows\system32\Pedokpcm.exe
482⤵
PID:4016

C:\Windows\SysWOW64\Qomcdf32.exe
C:\Windows\system32\Qomcdf32.exe
483⤵
PID:2912

C:\Windows\SysWOW64\Qhehmkqn.exe
C:\Windows\system32\Qhehmkqn.exe
484⤵
PID:4168

C:\Windows\SysWOW64\Qdlialfb.exe
C:\Windows\system32\Qdlialfb.exe
485⤵
PID:340

C:\Windows\SysWOW64\Adnegldo.exe
C:\Windows\system32\Adnegldo.exe
486⤵
PID:2092

C:\Windows\SysWOW64\Aodjdede.exe
C:\Windows\system32\Aodjdede.exe
487⤵
PID:2260

C:\Windows\SysWOW64\Aimkeb32.exe
C:\Windows\system32\Aimkeb32.exe
488⤵
PID:1680

C:\Windows\SysWOW64\Agakog32.exe
C:\Windows\system32\Agakog32.exe
489⤵
- System Location Discovery: System Language Discovery
PID:812

C:\Windows\SysWOW64\Alncgn32.exe
C:\Windows\system32\Alncgn32.exe
490⤵
PID:4540

C:\Windows\SysWOW64\Aefhpc32.exe
C:\Windows\system32\Aefhpc32.exe
491⤵
PID:2908

C:\Windows\SysWOW64\Bcjhig32.exe
C:\Windows\system32\Bcjhig32.exe
492⤵
PID:864

C:\Windows\SysWOW64\Bcmeogam.exe
C:\Windows\system32\Bcmeogam.exe
493⤵
PID:2544

C:\Windows\SysWOW64\Bhjngnod.exe
C:\Windows\system32\Bhjngnod.exe
494⤵
PID:1740

C:\Windows\SysWOW64\Babbpc32.exe
C:\Windows\system32\Babbpc32.exe
495⤵
- Modifies registry class
PID:2312

C:\Windows\SysWOW64\Bkjfhile.exe
C:\Windows\system32\Bkjfhile.exe
496⤵
PID:3000

C:\Windows\SysWOW64\Bdbkaoce.exe
C:\Windows\system32\Bdbkaoce.exe
497⤵
PID:1332

C:\Windows\SysWOW64\Bnkpjd32.exe
C:\Windows\system32\Bnkpjd32.exe
498⤵
PID:4496

C:\Windows\SysWOW64\Cjbpoeoj.exe
C:\Windows\system32\Cjbpoeoj.exe
499⤵
PID:4884

C:\Windows\SysWOW64\Cdgdlnop.exe
C:\Windows\system32\Cdgdlnop.exe
500⤵
PID:4940

C:\Windows\SysWOW64\Cqneaodd.exe
C:\Windows\system32\Cqneaodd.exe
501⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1516

C:\Windows\SysWOW64\Cmeffp32.exe
C:\Windows\system32\Cmeffp32.exe
502⤵
PID:928

C:\Windows\SysWOW64\Cfmjoe32.exe
C:\Windows\system32\Cfmjoe32.exe
503⤵
- Drops file in System32 directory
PID:1624

C:\Windows\SysWOW64\Cofohkgi.exe
C:\Windows\system32\Cofohkgi.exe
504⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2644

C:\Windows\SysWOW64\Cklpml32.exe
C:\Windows\system32\Cklpml32.exe
505⤵
PID:4112

C:\Windows\SysWOW64\Cbfhjfdk.exe
C:\Windows\system32\Cbfhjfdk.exe
506⤵
PID:1316

C:\Windows\SysWOW64\Dkolblkk.exe
C:\Windows\system32\Dkolblkk.exe
507⤵
PID:2188

C:\Windows\SysWOW64\Dgemgm32.exe
C:\Windows\system32\Dgemgm32.exe
508⤵
PID:1964

C:\Windows\SysWOW64\Dnpedghl.exe
C:\Windows\system32\Dnpedghl.exe
509⤵
PID:2124

C:\Windows\SysWOW64\Dieiap32.exe
C:\Windows\system32\Dieiap32.exe
510⤵
- Modifies registry class
PID:1596

C:\Windows\SysWOW64\Dbmnjenb.exe
C:\Windows\system32\Dbmnjenb.exe
511⤵
PID:476

C:\Windows\SysWOW64\Djibogkn.exe
C:\Windows\system32\Djibogkn.exe
512⤵
PID:1908

C:\Windows\SysWOW64\Denglpkc.exe
C:\Windows\system32\Denglpkc.exe
513⤵
- Modifies registry class
PID:2688

C:\Windows\SysWOW64\Dfpcdh32.exe
C:\Windows\system32\Dfpcdh32.exe
514⤵
PID:2660

C:\Windows\SysWOW64\Eccdmmpk.exe
C:\Windows\system32\Eccdmmpk.exe
515⤵
PID:4620

C:\Windows\SysWOW64\Epjdbn32.exe
C:\Windows\system32\Epjdbn32.exe
516⤵
PID:2796

C:\Windows\SysWOW64\Emnelbdi.exe
C:\Windows\system32\Emnelbdi.exe
517⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1224

C:\Windows\SysWOW64\Ebkndibq.exe
C:\Windows\system32\Ebkndibq.exe
518⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:4692

C:\Windows\SysWOW64\Eponmmaj.exe
C:\Windows\system32\Eponmmaj.exe
519⤵
PID:2372

C:\Windows\SysWOW64\Eigbfb32.exe
C:\Windows\system32\Eigbfb32.exe
520⤵
PID:4888

C:\Windows\SysWOW64\Eleobngo.exe
C:\Windows\system32\Eleobngo.exe
521⤵
PID:2088

C:\Windows\SysWOW64\Eodknifb.exe
C:\Windows\system32\Eodknifb.exe
522⤵
PID:2700

C:\Windows\SysWOW64\Fpcghl32.exe
C:\Windows\system32\Fpcghl32.exe
523⤵
- System Location Discovery: System Language Discovery
PID:2112

C:\Windows\SysWOW64\Fholmo32.exe
C:\Windows\system32\Fholmo32.exe
524⤵
PID:5008

C:\Windows\SysWOW64\Febmfcjj.exe
C:\Windows\system32\Febmfcjj.exe
525⤵
PID:4160

C:\Windows\SysWOW64\Fokaoh32.exe
C:\Windows\system32\Fokaoh32.exe
526⤵
- System Location Discovery: System Language Discovery
PID:2240

C:\Windows\SysWOW64\Faimkd32.exe
C:\Windows\system32\Faimkd32.exe
527⤵
PID:2780

C:\Windows\SysWOW64\Fgffck32.exe
C:\Windows\system32\Fgffck32.exe
528⤵
PID:1120

C:\Windows\SysWOW64\Fhfbmn32.exe
C:\Windows\system32\Fhfbmn32.exe
529⤵
PID:1944

C:\Windows\SysWOW64\Fangfcki.exe
C:\Windows\system32\Fangfcki.exe
530⤵
PID:2352

C:\Windows\SysWOW64\Giikkehc.exe
C:\Windows\system32\Giikkehc.exe
531⤵
- Drops file in System32 directory
PID:2436

C:\Windows\SysWOW64\Gpccgppq.exe
C:\Windows\system32\Gpccgppq.exe
532⤵
PID:2180

C:\Windows\SysWOW64\Gilhpe32.exe
C:\Windows\system32\Gilhpe32.exe
533⤵
- Modifies registry class
PID:744

C:\Windows\SysWOW64\Ggphji32.exe
C:\Windows\system32\Ggphji32.exe
534⤵
PID:2948

C:\Windows\SysWOW64\Gllabp32.exe
C:\Windows\system32\Gllabp32.exe
535⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:552

C:\Windows\SysWOW64\Ghcbga32.exe
C:\Windows\system32\Ghcbga32.exe
536⤵
PID:1848

C:\Windows\SysWOW64\Gcifdj32.exe
C:\Windows\system32\Gcifdj32.exe
537⤵
PID:1784

C:\Windows\SysWOW64\Hkdkhl32.exe
C:\Windows\system32\Hkdkhl32.exe
538⤵
- Drops file in System32 directory
PID:4808

C:\Windows\SysWOW64\Hdloab32.exe
C:\Windows\system32\Hdloab32.exe
539⤵
PID:2496

C:\Windows\SysWOW64\Hqcpfcbl.exe
C:\Windows\system32\Hqcpfcbl.exe
540⤵
- Drops file in System32 directory
PID:1772

C:\Windows\SysWOW64\Hkidclbb.exe
C:\Windows\system32\Hkidclbb.exe
541⤵
PID:1800

C:\Windows\SysWOW64\Hdcebagp.exe
C:\Windows\system32\Hdcebagp.exe
542⤵
PID:2988

C:\Windows\SysWOW64\Hmojfcdk.exe
C:\Windows\system32\Hmojfcdk.exe
543⤵
PID:2040

C:\Windows\SysWOW64\Ifgooikk.exe
C:\Windows\system32\Ifgooikk.exe
544⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2144

C:\Windows\SysWOW64\Iiekkdjo.exe
C:\Windows\system32\Iiekkdjo.exe
545⤵
- Drops file in System32 directory
PID:4532

C:\Windows\SysWOW64\Iihgadhl.exe
C:\Windows\system32\Iihgadhl.exe
546⤵
PID:3180

C:\Windows\SysWOW64\Ibplji32.exe
C:\Windows\system32\Ibplji32.exe
547⤵
PID:2840

C:\Windows\SysWOW64\Ikhqbo32.exe
C:\Windows\system32\Ikhqbo32.exe
548⤵
- System Location Discovery: System Language Discovery
PID:4420

C:\Windows\SysWOW64\Iilalc32.exe
C:\Windows\system32\Iilalc32.exe
549⤵
PID:3220

C:\Windows\SysWOW64\Iniidj32.exe
C:\Windows\system32\Iniidj32.exe
550⤵
- System Location Discovery: System Language Discovery
PID:1592

C:\Windows\SysWOW64\Iaheqe32.exe
C:\Windows\system32\Iaheqe32.exe
551⤵
PID:888

C:\Windows\SysWOW64\Iganmp32.exe
C:\Windows\system32\Iganmp32.exe
552⤵
PID:2148

C:\Windows\SysWOW64\Jchobqnc.exe
C:\Windows\system32\Jchobqnc.exe
553⤵
PID:2956

C:\Windows\SysWOW64\Jnncoini.exe
C:\Windows\system32\Jnncoini.exe
554⤵
PID:1716

C:\Windows\SysWOW64\Jgfghodj.exe
C:\Windows\system32\Jgfghodj.exe
555⤵
PID:2560

C:\Windows\SysWOW64\Jjgpjjak.exe
C:\Windows\system32\Jjgpjjak.exe
556⤵
PID:2960

C:\Windows\SysWOW64\Jjimpj32.exe
C:\Windows\system32\Jjimpj32.exe
557⤵
- Modifies registry class
PID:740

C:\Windows\SysWOW64\Jfpndkel.exe
C:\Windows\system32\Jfpndkel.exe
558⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2192

C:\Windows\SysWOW64\Kmjfae32.exe
C:\Windows\system32\Kmjfae32.exe
559⤵
PID:3544

C:\Windows\SysWOW64\Kphbmp32.exe
C:\Windows\system32\Kphbmp32.exe
560⤵
- System Location Discovery: System Language Discovery
PID:3588

C:\Windows\SysWOW64\Khdgabih.exe
C:\Windows\system32\Khdgabih.exe
561⤵
PID:1812

C:\Windows\SysWOW64\Klapha32.exe
C:\Windows\system32\Klapha32.exe
562⤵
- System Location Discovery: System Language Discovery
PID:924

C:\Windows\SysWOW64\Kanhph32.exe
C:\Windows\system32\Kanhph32.exe
563⤵
PID:2516

C:\Windows\SysWOW64\Kobhillo.exe
C:\Windows\system32\Kobhillo.exe
564⤵
- Modifies registry class
PID:2368

C:\Windows\SysWOW64\Kfnmnojj.exe
C:\Windows\system32\Kfnmnojj.exe
565⤵
PID:952

C:\Windows\SysWOW64\Ldangbhd.exe
C:\Windows\system32\Ldangbhd.exe
566⤵
PID:3748

C:\Windows\SysWOW64\Lmjbphod.exe
C:\Windows\system32\Lmjbphod.exe
567⤵
PID:584

C:\Windows\SysWOW64\Lgbfin32.exe
C:\Windows\system32\Lgbfin32.exe
568⤵
PID:2096

C:\Windows\SysWOW64\Llooad32.exe
C:\Windows\system32\Llooad32.exe
569⤵
PID:700

C:\Windows\SysWOW64\Licpki32.exe
C:\Windows\system32\Licpki32.exe
570⤵
PID:1960

C:\Windows\SysWOW64\Lpmhgc32.exe
C:\Windows\system32\Lpmhgc32.exe
571⤵
PID:3872

C:\Windows\SysWOW64\Lejppj32.exe
C:\Windows\system32\Lejppj32.exe
572⤵
- Drops file in System32 directory
- Modifies registry class
PID:2300

C:\Windows\SysWOW64\Lelmei32.exe
C:\Windows\system32\Lelmei32.exe
573⤵
PID:828

C:\Windows\SysWOW64\Modano32.exe
C:\Windows\system32\Modano32.exe
574⤵
PID:428

C:\Windows\SysWOW64\Mhmfgdch.exe
C:\Windows\system32\Mhmfgdch.exe
575⤵
PID:824

C:\Windows\SysWOW64\Meafpibb.exe
C:\Windows\system32\Meafpibb.exe
576⤵
PID:1760

C:\Windows\SysWOW64\Mknohpqj.exe
C:\Windows\system32\Mknohpqj.exe
577⤵
PID:1572

C:\Windows\SysWOW64\Mdfcaegj.exe
C:\Windows\system32\Mdfcaegj.exe
578⤵
PID:1132

C:\Windows\SysWOW64\Mnnhjk32.exe
C:\Windows\system32\Mnnhjk32.exe
579⤵
PID:3628

C:\Windows\SysWOW64\Mckpba32.exe
C:\Windows\system32\Mckpba32.exe
580⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:460

C:\Windows\SysWOW64\Mkbhco32.exe
C:\Windows\system32\Mkbhco32.exe
581⤵
PID:2872

C:\Windows\SysWOW64\Mlcekgbb.exe
C:\Windows\system32\Mlcekgbb.exe
582⤵
- Drops file in System32 directory
PID:4248

C:\Windows\SysWOW64\Ncnmhajo.exe
C:\Windows\system32\Ncnmhajo.exe
583⤵
- Modifies registry class
PID:3752

C:\Windows\SysWOW64\Njgeel32.exe
C:\Windows\system32\Njgeel32.exe
584⤵
PID:3488

C:\Windows\SysWOW64\Nodnmb32.exe
C:\Windows\system32\Nodnmb32.exe
585⤵
PID:1264

C:\Windows\SysWOW64\Nhmbfhfd.exe
C:\Windows\system32\Nhmbfhfd.exe
586⤵
- Drops file in System32 directory
PID:2684

C:\Windows\SysWOW64\Nmkklflj.exe
C:\Windows\system32\Nmkklflj.exe
587⤵
- System Location Discovery: System Language Discovery
PID:2308

C:\Windows\SysWOW64\Nhalag32.exe
C:\Windows\system32\Nhalag32.exe
588⤵
PID:4680

C:\Windows\SysWOW64\Nidhfgpl.exe
C:\Windows\system32\Nidhfgpl.exe
589⤵
PID:3680

C:\Windows\SysWOW64\Nonqca32.exe
C:\Windows\system32\Nonqca32.exe
590⤵
PID:2328

C:\Windows\SysWOW64\Ojgado32.exe
C:\Windows\system32\Ojgado32.exe
591⤵
- Drops file in System32 directory
PID:2552

C:\Windows\SysWOW64\Okgnna32.exe
C:\Windows\system32\Okgnna32.exe
592⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3468

C:\Windows\SysWOW64\Oqcffi32.exe
C:\Windows\system32\Oqcffi32.exe
593⤵
PID:2800

C:\Windows\SysWOW64\Ognobcqo.exe
C:\Windows\system32\Ognobcqo.exe
594⤵
PID:2704

C:\Windows\SysWOW64\Oafclh32.exe
C:\Windows\system32\Oafclh32.exe
595⤵
PID:760

C:\Windows\SysWOW64\Ojnhdn32.exe
C:\Windows\system32\Ojnhdn32.exe
596⤵
PID:1932

C:\Windows\SysWOW64\Obilip32.exe
C:\Windows\system32\Obilip32.exe
597⤵
PID:2740

C:\Windows\SysWOW64\Pjqdjn32.exe
C:\Windows\system32\Pjqdjn32.exe
598⤵
PID:672

C:\Windows\SysWOW64\Pfgeoo32.exe
C:\Windows\system32\Pfgeoo32.exe
599⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2972

C:\Windows\SysWOW64\Pbnfdpge.exe
C:\Windows\system32\Pbnfdpge.exe
600⤵
PID:1636

C:\Windows\SysWOW64\Ppbfmdfo.exe
C:\Windows\system32\Ppbfmdfo.exe
601⤵
- Drops file in System32 directory
PID:3984

C:\Windows\SysWOW64\Pbqbioeb.exe
C:\Windows\system32\Pbqbioeb.exe
602⤵
- Modifies registry class
PID:3580

C:\Windows\SysWOW64\Pjlgna32.exe
C:\Windows\system32\Pjlgna32.exe
603⤵
PID:3592

C:\Windows\SysWOW64\Pddlggin.exe
C:\Windows\system32\Pddlggin.exe
604⤵
- Modifies registry class
PID:3024

C:\Windows\SysWOW64\Qahlpkhh.exe
C:\Windows\system32\Qahlpkhh.exe
605⤵
PID:264

C:\Windows\SysWOW64\Qmomelml.exe
C:\Windows\system32\Qmomelml.exe
606⤵
PID:3368

C:\Windows\SysWOW64\Qjcmoqlf.exe
C:\Windows\system32\Qjcmoqlf.exe
607⤵
- Drops file in System32 directory
PID:4036

C:\Windows\SysWOW64\Adkbgf32.exe
C:\Windows\system32\Adkbgf32.exe
608⤵
PID:544

C:\Windows\SysWOW64\Akejdp32.exe
C:\Windows\system32\Akejdp32.exe
609⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3548

C:\Windows\SysWOW64\Aijgemok.exe
C:\Windows\system32\Aijgemok.exe
610⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3564

C:\Windows\SysWOW64\Aogpmcmb.exe
C:\Windows\system32\Aogpmcmb.exe
611⤵
PID:5052

C:\Windows\SysWOW64\Aimckl32.exe
C:\Windows\system32\Aimckl32.exe
612⤵
PID:2788

C:\Windows\SysWOW64\Abehcbci.exe
C:\Windows\system32\Abehcbci.exe
613⤵
PID:3396

C:\Windows\SysWOW64\Akpmhdqd.exe
C:\Windows\system32\Akpmhdqd.exe
614⤵
PID:1508

C:\Windows\SysWOW64\Aefaemqj.exe
C:\Windows\system32\Aefaemqj.exe
615⤵
PID:3224

C:\Windows\SysWOW64\Bdknfiea.exe
C:\Windows\system32\Bdknfiea.exe
616⤵
PID:3944

C:\Windows\SysWOW64\Bhiglh32.exe
C:\Windows\system32\Bhiglh32.exe
617⤵
- Modifies registry class
PID:2404

C:\Windows\SysWOW64\Bnfodojp.exe
C:\Windows\system32\Bnfodojp.exe
618⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:4048

C:\Windows\SysWOW64\Bkjpncii.exe
C:\Windows\system32\Bkjpncii.exe
619⤵
- System Location Discovery: System Language Discovery
PID:3080

C:\Windows\SysWOW64\Blklfk32.exe
C:\Windows\system32\Blklfk32.exe
620⤵
- Drops file in System32 directory
PID:3912

C:\Windows\SysWOW64\Bfcqoqeh.exe
C:\Windows\system32\Bfcqoqeh.exe
621⤵
PID:3292

C:\Windows\SysWOW64\Ccgahe32.exe
C:\Windows\system32\Ccgahe32.exe
622⤵
PID:3988

C:\Windows\SysWOW64\Cjaieoko.exe
C:\Windows\system32\Cjaieoko.exe
623⤵
PID:3400

C:\Windows\SysWOW64\Clpeajjb.exe
C:\Windows\system32\Clpeajjb.exe
624⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3476

C:\Windows\SysWOW64\Cfhjjp32.exe
C:\Windows\system32\Cfhjjp32.exe
625⤵
PID:3936

C:\Windows\SysWOW64\Cbokoa32.exe
C:\Windows\system32\Cbokoa32.exe
626⤵
PID:3196

C:\Windows\SysWOW64\Cldolj32.exe
C:\Windows\system32\Cldolj32.exe
627⤵
- Modifies registry class
PID:3664

C:\Windows\SysWOW64\Cfmceomm.exe
C:\Windows\system32\Cfmceomm.exe
628⤵
- System Location Discovery: System Language Discovery
PID:3728

C:\Windows\SysWOW64\Cbcdjpba.exe
C:\Windows\system32\Cbcdjpba.exe
629⤵
PID:4304

C:\Windows\SysWOW64\Djoinbpm.exe
C:\Windows\system32\Djoinbpm.exe
630⤵
PID:2340

C:\Windows\SysWOW64\Dgbiggof.exe
C:\Windows\system32\Dgbiggof.exe
631⤵
- Drops file in System32 directory
PID:3956

C:\Windows\SysWOW64\Dmobpn32.exe
C:\Windows\system32\Dmobpn32.exe
632⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4000

C:\Windows\SysWOW64\Dfhficcn.exe
C:\Windows\system32\Dfhficcn.exe
633⤵
PID:2760

C:\Windows\SysWOW64\Dmaoem32.exe
C:\Windows\system32\Dmaoem32.exe
634⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:2608

C:\Windows\SysWOW64\Djfooa32.exe
C:\Windows\system32\Djfooa32.exe
635⤵
PID:3200

C:\Windows\SysWOW64\Dflpdb32.exe
C:\Windows\system32\Dflpdb32.exe
636⤵
PID:3388

C:\Windows\SysWOW64\Ebcqicem.exe
C:\Windows\system32\Ebcqicem.exe
637⤵
- Drops file in System32 directory
PID:936

C:\Windows\SysWOW64\Epgabhdg.exe
C:\Windows\system32\Epgabhdg.exe
638⤵
PID:3432

C:\Windows\SysWOW64\Elnagijk.exe
C:\Windows\system32\Elnagijk.exe
639⤵
PID:3332

C:\Windows\SysWOW64\Eibbqmhd.exe
C:\Windows\system32\Eibbqmhd.exe
640⤵
- Drops file in System32 directory
PID:2836

C:\Windows\SysWOW64\Enokidgl.exe
C:\Windows\system32\Enokidgl.exe
641⤵
PID:1344

C:\Windows\SysWOW64\Eeicenni.exe
C:\Windows\system32\Eeicenni.exe
642⤵
PID:3876

C:\Windows\SysWOW64\Elbkbh32.exe
C:\Windows\system32\Elbkbh32.exe
643⤵
PID:3300

C:\Windows\SysWOW64\Efllcf32.exe
C:\Windows\system32\Efllcf32.exe
644⤵
PID:3756

C:\Windows\SysWOW64\Fjjeid32.exe
C:\Windows\system32\Fjjeid32.exe
645⤵
PID:4932

C:\Windows\SysWOW64\Fdbibjok.exe
C:\Windows\system32\Fdbibjok.exe
646⤵
PID:3864

C:\Windows\SysWOW64\Flnnfllf.exe
C:\Windows\system32\Flnnfllf.exe
647⤵
PID:3960

C:\Windows\SysWOW64\Flpkll32.exe
C:\Windows\system32\Flpkll32.exe
648⤵
PID:2692

C:\Windows\SysWOW64\Ffeoid32.exe
C:\Windows\system32\Ffeoid32.exe
649⤵
PID:3188

C:\Windows\SysWOW64\Fblpnepn.exe
C:\Windows\system32\Fblpnepn.exe
650⤵
PID:3304

C:\Windows\SysWOW64\Gkgdbh32.exe
C:\Windows\system32\Gkgdbh32.exe
651⤵
- Drops file in System32 directory
PID:1936

C:\Windows\SysWOW64\Gdpikmci.exe
C:\Windows\system32\Gdpikmci.exe
652⤵
- Drops file in System32 directory
PID:3920

C:\Windows\SysWOW64\Gadidabc.exe
C:\Windows\system32\Gadidabc.exe
653⤵
- Drops file in System32 directory
PID:3100

C:\Windows\SysWOW64\Gohjnf32.exe
C:\Windows\system32\Gohjnf32.exe
654⤵
PID:3464

C:\Windows\SysWOW64\Ghpngkhm.exe
C:\Windows\system32\Ghpngkhm.exe
655⤵
PID:3704

C:\Windows\SysWOW64\Giakoc32.exe
C:\Windows\system32\Giakoc32.exe
656⤵
- Drops file in System32 directory
PID:848

C:\Windows\SysWOW64\Gidgdcli.exe
C:\Windows\system32\Gidgdcli.exe
657⤵
PID:3608

C:\Windows\SysWOW64\Hcllmi32.exe
C:\Windows\system32\Hcllmi32.exe
658⤵
- Modifies registry class
PID:3968

C:\Windows\SysWOW64\Hifdjcif.exe
C:\Windows\system32\Hifdjcif.exe
659⤵
- System Location Discovery: System Language Discovery
PID:3612

C:\Windows\SysWOW64\Hjhaob32.exe
C:\Windows\system32\Hjhaob32.exe
660⤵
PID:3860

C:\Windows\SysWOW64\Hoeigi32.exe
C:\Windows\system32\Hoeigi32.exe
661⤵
PID:1948

C:\Windows\SysWOW64\Hhnnpolk.exe
C:\Windows\system32\Hhnnpolk.exe
662⤵
PID:3088

C:\Windows\SysWOW64\Hkljljko.exe
C:\Windows\system32\Hkljljko.exe
663⤵
PID:4044

C:\Windows\SysWOW64\Hllffmbb.exe
C:\Windows\system32\Hllffmbb.exe
664⤵
PID:3356

C:\Windows\SysWOW64\Igeggkoq.exe
C:\Windows\system32\Igeggkoq.exe
665⤵
PID:3168

C:\Windows\SysWOW64\Ikcpmieg.exe
C:\Windows\system32\Ikcpmieg.exe
666⤵
PID:1100

C:\Windows\SysWOW64\Ibmhjc32.exe
C:\Windows\system32\Ibmhjc32.exe
667⤵
PID:3948

C:\Windows\SysWOW64\Igjabj32.exe
C:\Windows\system32\Igjabj32.exe
668⤵
PID:2076

C:\Windows\SysWOW64\Idnako32.exe
C:\Windows\system32\Idnako32.exe
669⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3380

C:\Windows\SysWOW64\Ijkjde32.exe
C:\Windows\system32\Ijkjde32.exe
670⤵
PID:3392

C:\Windows\SysWOW64\Iqdbqp32.exe
C:\Windows\system32\Iqdbqp32.exe
671⤵
PID:3836

C:\Windows\SysWOW64\Iipgeb32.exe
C:\Windows\system32\Iipgeb32.exe
672⤵
- Drops file in System32 directory
PID:536

C:\Windows\SysWOW64\Jcekbk32.exe
C:\Windows\system32\Jcekbk32.exe
673⤵
PID:3244

C:\Windows\SysWOW64\Jmnpkp32.exe
C:\Windows\system32\Jmnpkp32.exe
674⤵
PID:4336

C:\Windows\SysWOW64\Jchhhjjg.exe
C:\Windows\system32\Jchhhjjg.exe
675⤵
PID:3800

C:\Windows\SysWOW64\Jidppaio.exe
C:\Windows\system32\Jidppaio.exe
676⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3976

C:\Windows\SysWOW64\Jnaihhgf.exe
C:\Windows\system32\Jnaihhgf.exe
677⤵
PID:1776

C:\Windows\SysWOW64\Jboanfmm.exe
C:\Windows\system32\Jboanfmm.exe
678⤵
PID:3288

C:\Windows\SysWOW64\Jgljfmkd.exe
C:\Windows\system32\Jgljfmkd.exe
679⤵
PID:1412

C:\Windows\SysWOW64\Jccjln32.exe
C:\Windows\system32\Jccjln32.exe
680⤵
PID:3208

C:\Windows\SysWOW64\Kagkebpb.exe
C:\Windows\system32\Kagkebpb.exe
681⤵
PID:3320

C:\Windows\SysWOW64\Kgqcam32.exe
C:\Windows\system32\Kgqcam32.exe
682⤵
PID:3724

C:\Windows\SysWOW64\Knkkngol.exe
C:\Windows\system32\Knkkngol.exe
683⤵
PID:2272

C:\Windows\SysWOW64\Kjalch32.exe
C:\Windows\system32\Kjalch32.exe
684⤵
PID:1300

C:\Windows\SysWOW64\Kbmahjbk.exe
C:\Windows\system32\Kbmahjbk.exe
685⤵
PID:3296

C:\Windows\SysWOW64\Kjdiigbm.exe
C:\Windows\system32\Kjdiigbm.exe
686⤵
PID:2388

C:\Windows\SysWOW64\Kemjieol.exe
C:\Windows\system32\Kemjieol.exe
687⤵
PID:3568

C:\Windows\SysWOW64\Kbajci32.exe
C:\Windows\system32\Kbajci32.exe
688⤵
PID:4076

C:\Windows\SysWOW64\Lpekln32.exe
C:\Windows\system32\Lpekln32.exe
689⤵
PID:3640

C:\Windows\SysWOW64\Lebcdd32.exe
C:\Windows\system32\Lebcdd32.exe
690⤵
PID:3824

C:\Windows\SysWOW64\Lkolmk32.exe
C:\Windows\system32\Lkolmk32.exe
691⤵
- System Location Discovery: System Language Discovery
PID:3280

C:\Windows\SysWOW64\Lkahbkgk.exe
C:\Windows\system32\Lkahbkgk.exe
692⤵
PID:2044

C:\Windows\SysWOW64\Legmpdga.exe
C:\Windows\system32\Legmpdga.exe
693⤵
PID:4060

C:\Windows\SysWOW64\Lheilofe.exe
C:\Windows\system32\Lheilofe.exe
694⤵
PID:1468

C:\Windows\SysWOW64\Lpqnpacp.exe
C:\Windows\system32\Lpqnpacp.exe
695⤵
PID:4268

C:\Windows\SysWOW64\Lmdnjf32.exe
C:\Windows\system32\Lmdnjf32.exe
696⤵
PID:3596

C:\Windows\SysWOW64\Mikooghn.exe
C:\Windows\system32\Mikooghn.exe
697⤵
PID:4052

C:\Windows\SysWOW64\Mebpchmb.exe
C:\Windows\system32\Mebpchmb.exe
698⤵
- Modifies registry class
PID:3348

C:\Windows\SysWOW64\Mllhpb32.exe
C:\Windows\system32\Mllhpb32.exe
699⤵
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 140
700⤵
- Program crash
PID:2052

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aalaoipc.exe
Filesize
93KB

MD5
830d0eb99d184a2e43a4ab399b31b18b

SHA1
592b30c0d37fd3ed3bf0b6215d94642550e160c1

SHA256
2eea0aa738f1a0944243cd9833bea5aad6551569b5ec2b01582c29a034c1ed6a

SHA512
14097e77f6561501a334024541e7bae7909b823f37c88c56e82dd2887b29f06cbe35d7f745e79c9fa2b5f66bcd3cba9f5ee5620117c11536137bc42f1fa017f4

Download Submit
C:\Windows\SysWOW64\Aaondi32.exe
Filesize
93KB

MD5
c400059fd8b99f74c7c6287bd37a0b69

SHA1
6edf2ee0d32113d558bf76873dc3935a4500f5f0

SHA256
da3d79916362ff09b23e7d07fc3cd089d6a8578b37c7cbe349e88aa14fc45159

SHA512
4cd82eb769c7af7087d04c44f8c3928c80ef80693eca09256ba7bd6c22eaea783f5f88a9cfacd3d0543c86aee9ecedcaaa095fec610dada5fc28787f26f8a46b

Download Submit
C:\Windows\SysWOW64\Abehcbci.exe
Filesize
93KB

MD5
e26e5ba7beafb1a137b1b88e1659baab

SHA1
07e0a5be8e59359cebee632eb3ff2527ec88d9f6

SHA256
3f246192a98a5513fe58220693fd13c292d25a11e9e2aecfec987b96c31205ab

SHA512
ae7c487b668a7807ea2a0f8cbf94cafba1145a8bcf8849c6e4e71780adcb6059dfcd4ee796a48522d6234c4fc0115bf49c46d2e5a0994f191e3134defe0f6e08

Download Submit
C:\Windows\SysWOW64\Abjcleqm.exe
Filesize
93KB

MD5
a15b1c1b503584b967e1fcb3cfb037a9

SHA1
534c9d85909f71b1c0745209a7aade3c6a871a49

SHA256
bbfbc77f51ec56136a77d968fc935e7739d6ea7f4e77248492ea0950a4edb390

SHA512
45ddda8ceaf1e4e8e05f3eba34a5f2255230c5db9108e3dd0abddabefe116cee3e88e08ee953d3848a832adcfbb40dfd8ddda110d5c3b8ebcf9272631656992e

Download Submit
C:\Windows\SysWOW64\Abldccka.exe
Filesize
93KB

MD5
0436474d107b3123904a6898d77fbace

SHA1
698dc986ca875e7fc0c89311c661ebfd52fb2f04

SHA256
0b6b714e8a929363465657770aba1826dad5a0a05dba5878980d45cbd95f577d

SHA512
90a39cc65a933c43a689629c0a21d11958051dc2a2e4369f8269534ce0c3064a951768899adc8b1c4884ca55988ae255432267f8daed1ac05907db1e03ed497b

Download Submit
C:\Windows\SysWOW64\Acdfki32.exe
Filesize
93KB

MD5
b3e7d4b7bf1ff1807dfd19508bfb0c0e

SHA1
fc601a72375bd0ea280420ce40ffbdcc0a9c52a3

SHA256
61ddb046b66543fae8b3b5ad6d3d2a2cb9e6866586e81f51808a90af0541649e

SHA512
a432fcc4d3fae652386a99562593b999ed694d4da98d2da034b5064359abf278d8acaa163b8d3cf555b1525a3bca52964355cf649859d8417a75f611c6512e2a

Download Submit
C:\Windows\SysWOW64\Acemeo32.exe
Filesize
93KB

MD5
2bfe3fa98f18cc248971911c04d19c82

SHA1
fc0d79f466b82373e3852f123b99d3a75fdee5a0

SHA256
ce28b17f4c6b1cde5bb08cf07b49613beb49e049844460a6ff83c41afd0d7467

SHA512
a12a9dd99dc949106921de58ec813430ee5e3d08019e2a67c6279f337b5374bbf1d569d0c1dc5743eaba81437e485621c373ba48cf652557a97903ab49a8ad17

Download Submit
C:\Windows\SysWOW64\Acggbffj.exe
Filesize
93KB

MD5
844d94fe7fe88aa4c192ada9f4e7510a

SHA1
a4c24c76880d7e6f8c977445cec145b9ac85f495

SHA256
b629ef4843373f5178fe025a3d993b51b825d77ffb7224cdb402f58a2c6ee4cb

SHA512
f2b686f23b6ed0eca3b4c30e0eb57d57001cc2e5363ba0a72c0892e710aaf343c4800a213264cf3f5d719eefd4e315169e0919beb1cc73a571469cc4f0b6e391

Download Submit
C:\Windows\SysWOW64\Achikonn.exe
Filesize
93KB

MD5
81f1dcff3d5460be215d3f77b2071851

SHA1
efea20df5b4bc926e0a056d80832fa00ebebee34

SHA256
f87c96402758e7077f15660219ff58bc8019492102c8865eac10be84288a5027

SHA512
64a76eca7c69bd9534cd59300a2be73c3e3df8c0dde1952b999b45652ae83896ee4d944d5eaae0845728019ecf508df33dd9c4fa48ba53e375f4f306342f3297

Download Submit
C:\Windows\SysWOW64\Acnpjj32.exe
Filesize
93KB

MD5
9bb73fe7f92a3ab19950584057a98af1

SHA1
ddbc525bbb9b469fdf0f746b37822ef22ff5a5d4

SHA256
bf2e6d694a095b8c983dc37dc6fd1def9fadd099ff56d5aea3d924ae00b68289

SHA512
0a7cb66eed919edc2ee836c79a2b69bb858e0b55682a575d8941ea243c67cca908893018274bc82a67090782c7fb2a71723b36bcb32622ffa7f38fbf40c3b0fb

Download Submit
C:\Windows\SysWOW64\Acplpjpj.exe
Filesize
93KB

MD5
369ccdc46a43adb36e59120de3e7133f

SHA1
e68de4effe9385cd98a2b0f8d498e08426c26fec

SHA256
6c01e3c4bc385d566a374d95859c1fd26afdfb4d2935a82a0d6711db1aafe4f1

SHA512
7e76d50d24a7f0820835d724303b0eff3554d2d8ef05295b5f36b86fc213ea3d1251bcfbbb6f50af3fb15cd6fa84cc38130ec711fff62618b4435977009d005d

Download Submit
C:\Windows\SysWOW64\Adfbbabc.exe
Filesize
93KB

MD5
3f1e2504ab3c44a9e1622834abd9a3d4

SHA1
bd9dcc9972e427b5a262cfee6a0447d821533b2d

SHA256
b9278a392d32866884567bf9b37fc80af7b6ed9f587580d2b13e28b9591ca175

SHA512
6dc98fa567d0b4ceefae564e5c5bf356fe0d1101030e1ebb0da45c3c48061f4300fa46d1ee7c18214b2dcd82ed29365168543a4d7a65aeef1cdbda24ef08a4f3

Download Submit
C:\Windows\SysWOW64\Adkbgf32.exe
Filesize
93KB

MD5
25c17501366c3c96f975130c2348bec0

SHA1
564d8d6035915c9fad7c8d77f8b29cd842d39e9b

SHA256
2173c77509c1ed9312d72235d98facf8a3cf16008e38c2312d10ae4584cbe80c

SHA512
c7b43749f91abcaa7276d426a3258c039e75381a30c1f0b59a9eb51c8999f19b07ff7ec721817bb50034919d535f353456cae26cce49d592669ea21bb9dcd719

Download Submit
C:\Windows\SysWOW64\Adncoc32.exe
Filesize
93KB

MD5
41fd0652c66039dcc7e384e8f5d46a9c

SHA1
2c396263a1fc42931c41db568183df666c9a655a

SHA256
88b01889b2936a5eccbca14151cf5a4a0b45347e4e69e471d4dc4be41c0f1511

SHA512
d2b54d6361169e40233dfa7165ac6123aed432912949023db8280a81cc4ccf18fc788e4c1158d4125dd06ed306971d2a3a4f07858aca087b85dfdc7372b61b24

Download Submit
C:\Windows\SysWOW64\Adnegldo.exe
Filesize
93KB

MD5
0316350073aa4a8edc342a182d690a2a

SHA1
10432c3b6f54119b3b01d1d2ac7ae21f3f889e22

SHA256
04079d74fcfcbc4f0339b9acb8f7aaa9bb6391e131729bc62d8e3576e8bcdfd3

SHA512
d71c83c920c2e21517533abedd5126f099718e20adb645b4488fe284e110002fb091261da2dd89c18d1cb0cee590cd8267ee5630f1d1b29c8eb2e6be4be0e6de

Download Submit
C:\Windows\SysWOW64\Aefaemqj.exe
Filesize
93KB

MD5
337c79edb346b8988792a0be8b29b55c

SHA1
090a8fdcb2758f3a1e251a11a34bf1c066a57153

SHA256
0c40020dddf67f8974195110ff6cd17992f4f9ec9663cb4bbc5d6e471e1008e3

SHA512
98c0ba44d99a7ef322431ca72ccc7dd6af98eea90af42cea54b2df8696ed73570df3213dd06ad843d9c92bddba8ea704764445ce6863b5b3bc43bf3a7bce92ef

Download Submit
C:\Windows\SysWOW64\Aefhpc32.exe
Filesize
93KB

MD5
e42ef57e247c86d13473565bc12a8972

SHA1
d66e518989822c8436efe283fef9b1c0c35bd99b

SHA256
0d755031e5c56957df29c723e91224683ee8b674b23638cbdde0b8ea24152db9

SHA512
650ec43116bd9198936824cf380926f69d90e7d6e6289a6f1d19362ef56be7162415cd89436fe5685db7cc64952bd8af3126c84d5b48ee39691861a9a6272c60

Download Submit
C:\Windows\SysWOW64\Aepnkjcd.exe
Filesize
93KB

MD5
30b482eea3e5a157250edc2e8a109288

SHA1
c943976d6b1342b6414f0e74df67a50c92c1400d

SHA256
7ee7bd537cc6703851f70cd6dbd419f341d8a7ab2887b4daf6d7b33064d8857c

SHA512
e8784f742b09d69da7c78f2a964f6606597c0f87790e17ac45eff2241b0a6d3cefdaa391b547d5db26154c88d1b14c827692a3eb8239ca227c597f7972b050b1

Download Submit
C:\Windows\SysWOW64\Afcghbgp.exe
Filesize
93KB

MD5
3bbcc1393f7fd2f3024a28f9f4586f9f

SHA1
4dea829951ffe126c441aa040ec344edce2adb86

SHA256
97ab83a089eb2da354e9f484d78f87d531d8c9f5b04077723d0b34d7cb611f93

SHA512
f6d3b07a9c512283cf9963f6ae32226accfb622f2b32321cb7b977d5c853c13846691ba9b2837554dc752f49825295335aac82acd36c857b013da45d7b4adb26

Download Submit
C:\Windows\SysWOW64\Afqeaemk.exe
Filesize
93KB

MD5
8b65203bdc55c9024f0464464196340b

SHA1
97eae5565c69f928b5704c1d9f229287b7e2378d

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads