213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631

General

Target

213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exe
Size

93KB
MD5

a1ce73cdab67a387afdaa5a096d203eb
SHA1

c189066059e57d823d0c6e0fe79f6c3af47830c7
SHA256

213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631
SHA512

b99d80aed9b8236ddc9379a8dcc3916a622883804b98932f57e98eba4b7ddc9cd7efa508e8fbf3bae7541da5cc8d4763c7e18e66e100ea46fcd26250a943620d
SSDEEP

1536:k4c73PraAqisg8dYQKH4oDRaB6UOyPWj8noXzmHvs74T4jiwg58:hZAqisgvPL8noX8vu4cY58

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Kmcceolb.exeLdfjbkbg.exeQdchho32.exeGapdkn32.exeIhfejdgl.exeLjffjh32.exeCjkppc32.exeAmcdoh32.exeFpjaplgd.exeMhamdk32.exeIkfgaipa.exeIpjlca32.exeIkamfi32.exeKbfhkfib.exeLjhcpgpe.exeCccdii32.exeEfbjlbih.exeJphieo32.exeNhqoqbik.exeNlohgqpa.exeAijedi32.exeFibfiame.exeHneaam32.exeJjogbk32.exeAffomo32.exeBfieil32.exeDmklmb32.exeEmflia32.exePalife32.exeAhekijbj.exeKjopiihp.exeBjdjodgo.exeFddffd32.exeOihopa32.exeOcemdfdh.exeMlofji32.exeCkmmgk32.exeGlgake32.exeHdqoip32.exePlmdhoca.exeFgkpne32.exeGdopgi32.exeKqflqc32.exeFbbmga32.exeGkhhdc32.exeOlfebf32.exeFbejlado.exeKneldaab.exeJkbfmg32.exePeehadjb.exeGiiljp32.exeIagcbjcd.exeLegala32.exeJgdngi32.exeJkbmhm32.exeMjlepqid.exeNdjlkcml.exeOabfpf32.exePhlibkje.exeJhpgqboa.exeCfbaed32.exeFpndae32.exeMahkbjnn.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmcceolb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ldfjbkbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdchho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gapdkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ihfejdgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ljffjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjkppc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amcdoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fpjaplgd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhamdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ikfgaipa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipjlca32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikamfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbfhkfib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ljhcpgpe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cccdii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efbjlbih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jphieo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nhqoqbik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nlohgqpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aijedi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fibfiame.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hneaam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jjogbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Affomo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfieil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmklmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emflia32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Palife32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahekijbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjopiihp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjdjodgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fddffd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oihopa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocemdfdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlofji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckmmgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glgake32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hdqoip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plmdhoca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fgkpne32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdopgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kqflqc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbbmga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gkhhdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olfebf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fbejlado.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kneldaab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jkbfmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Peehadjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Giiljp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iagcbjcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Legala32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jgdngi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jkbmhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mhamdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjlepqid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndjlkcml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oabfpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phlibkje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhpgqboa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbaed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fpndae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mahkbjnn.exe

Executes dropped EXE 64 IoCs

Processes:

Niaipbhe.exeNlpelmgi.exeNcjnhg32.exeNehjdc32.exeNhffqnlm.exeNcljnglc.exeNifbka32.exeOockch32.exeOcogcgjp.exeOihopa32.exeOlglllqq.exeOcadif32.exeOeopeb32.exeOiklfqpj.exeOlihblon.exeOccqof32.exeOeamka32.exeOlleglmk.exeOcemdfdh.exeOgaied32.exeOlnbmk32.exeOchjjebe.exePhdbblpm.exePcjgoe32.exePfhckq32.exePpngii32.exePcmcee32.exePhilml32.exePfmlfpka.exePhlibkje.exePpcqdikg.exePoeaoe32.exePjkemn32.exePljaij32.exePohnee32.exePgoefbpa.exeQfbfao32.exeQhpbnk32.exeQqgjoh32.exeQcffkc32.exeQfdbgo32.exeQhbocj32.exeQqjgdh32.exeQchcqc32.exeAffomo32.exeAhekijbj.exeAqlcjgbl.exeAgflga32.exeAfilbnad.exeAmcdoh32.exeAcmllbpm.exeAijedi32.exeAmeadhfn.exeAocmqcea.exeAjianleg.exeAilaii32.exeAofjfcco.exeAfpbcm32.exeAqefpfkb.exeBgpomp32.exeBjnkik32.exeBmlgeg32.exeBfeknmgf.exeBichjhfj.exe

pid	process
2132	Niaipbhe.exe
4524	Nlpelmgi.exe
4576	Ncjnhg32.exe
1268	Nehjdc32.exe
760	Nhffqnlm.exe
3412	Ncljnglc.exe
1036	Nifbka32.exe
1980	Oockch32.exe
1160	Ocogcgjp.exe
4516	Oihopa32.exe
3180	Olglllqq.exe
4184	Ocadif32.exe
552	Oeopeb32.exe
1288	Oiklfqpj.exe
180	Olihblon.exe
3400	Occqof32.exe
3092	Oeamka32.exe
212	Olleglmk.exe
3484	Ocemdfdh.exe
380	Ogaied32.exe
3424	Olnbmk32.exe
2276	Ochjjebe.exe
2140	Phdbblpm.exe
2876	Pcjgoe32.exe
2992	Pfhckq32.exe
3192	Ppngii32.exe
4036	Pcmcee32.exe
4948	Philml32.exe
1504	Pfmlfpka.exe
2528	Phlibkje.exe
4752	Ppcqdikg.exe
3704	Poeaoe32.exe
4512	Pjkemn32.exe
4348	Pljaij32.exe
940	Pohnee32.exe
4600	Pgoefbpa.exe
2156	Qfbfao32.exe
3108	Qhpbnk32.exe
5064	Qqgjoh32.exe
4312	Qcffkc32.exe
1864	Qfdbgo32.exe
8	Qhbocj32.exe
3880	Qqjgdh32.exe
3700	Qchcqc32.exe
3812	Affomo32.exe
3096	Ahekijbj.exe
1960	Aqlcjgbl.exe
2268	Agflga32.exe
2532	Afilbnad.exe
228	Amcdoh32.exe
3120	Acmllbpm.exe
1936	Aijedi32.exe
1468	Ameadhfn.exe
3476	Aocmqcea.exe
1452	Ajianleg.exe
5008	Ailaii32.exe
436	Aofjfcco.exe
3196	Afpbcm32.exe
2732	Aqefpfkb.exe
4316	Bgpomp32.exe
3916	Bjnkik32.exe
4360	Bmlgeg32.exe
2128	Bfeknmgf.exe
3644	Bichjhfj.exe

Drops file in System32 directory 64 IoCs

Processes:

Pkindqem.exeAfokhg32.exeBllpkq32.exeFpfnpfek.exeKcphgi32.exeMekmdhpo.exeBnjibc32.exePjkemn32.exeKglkbn32.exeDjbfqb32.exeAajegccf.exeAhhgomgm.exeCahlmc32.exeNijldmja.exeNeglpf32.exePohnee32.exeNicokkbf.exeObnpiqfd.exeAqlcjgbl.exeOhhllhgo.exeBoabgkef.exeEfbjlbih.exeGikbej32.exeHmpqlgam.exeKmepjojp.exeNabmiifc.exeOcemdfdh.exeBihaeg32.exeJjcqnjbm.exeNalginad.exeOapjjg32.exeOlhkmo32.exeHgkidbjf.exeIkpgkp32.exeIgcdpknp.exeIghnkj32.exeBichjhfj.exeCilcfpjd.exeGbnmbpld.exeIjgjgf32.exeKneldaab.exePhcempie.exeNagnno32.exeLckgcggo.exeCiogff32.exeEakaiq32.exeNhafkimf.exePkedia32.exeCfdnjd32.exeGiokpimi.exeOeafpk32.exeBbflmhmd.exeDoooii32.exeMebjni32.exeBhfcpk32.exeKngijaop.exePeehadjb.exeQhmgcnak.exeNofemc32.exeGbhpiodj.exeBoqlmebj.exeOacmjm32.exeGflein32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Pacfaj32.exe	Pkindqem.exe
File opened for modification	C:\Windows\SysWOW64\Ajkgiepi.exe	Afokhg32.exe
File opened for modification	C:\Windows\SysWOW64\Bkopfmce.exe	Bllpkq32.exe
File opened for modification	C:\Windows\SysWOW64\Fbejlado.exe	Fpfnpfek.exe
File created	C:\Windows\SysWOW64\Kkgphfbo.exe	Kcphgi32.exe
File created	C:\Windows\SysWOW64\Fcbhjlif.dll	Mekmdhpo.exe
File created	C:\Windows\SysWOW64\Beaacp32.exe	Bnjibc32.exe
File opened for modification	C:\Windows\SysWOW64\Pljaij32.exe	Pjkemn32.exe
File created	C:\Windows\SysWOW64\Doppdj32.dll	Kglkbn32.exe
File created	C:\Windows\SysWOW64\Dmqbmn32.exe	Djbfqb32.exe
File created	C:\Windows\SysWOW64\Mjimchca.dll	Aajegccf.exe
File created	C:\Windows\SysWOW64\Akgckhfa.exe	Ahhgomgm.exe
File created	C:\Windows\SysWOW64\Ooajlenp.dll	Cahlmc32.exe
File opened for modification	C:\Windows\SysWOW64\Nlhhqhie.exe	Nijldmja.exe
File created	C:\Windows\SysWOW64\Lnbifmbc.dll	Neglpf32.exe
File created	C:\Windows\SysWOW64\Meibcipd.dll	Pohnee32.exe
File opened for modification	C:\Windows\SysWOW64\Nlakgfaj.exe	Nicokkbf.exe
File created	C:\Windows\SysWOW64\Oelmeleh.exe	Obnpiqfd.exe
File created	C:\Windows\SysWOW64\Agflga32.exe	Aqlcjgbl.exe
File created	C:\Windows\SysWOW64\Okghhcfb.exe	Ohhllhgo.exe
File created	C:\Windows\SysWOW64\Bfkkde32.exe	Boabgkef.exe
File created	C:\Windows\SysWOW64\Lkdjpi32.dll	Efbjlbih.exe
File opened for modification	C:\Windows\SysWOW64\Gbcfno32.exe	Gikbej32.exe
File created	C:\Windows\SysWOW64\Dodoeond.dll	Hmpqlgam.exe
File created	C:\Windows\SysWOW64\Bokhcg32.dll	Kmepjojp.exe
File created	C:\Windows\SysWOW64\Imijde32.dll	Nabmiifc.exe
File created	C:\Windows\SysWOW64\Ogaied32.exe	Ocemdfdh.exe
File opened for modification	C:\Windows\SysWOW64\Bqoifd32.exe	Bihaeg32.exe
File opened for modification	C:\Windows\SysWOW64\Jbjiohco.exe	Jjcqnjbm.exe
File created	C:\Windows\SysWOW64\Nicokkbf.exe	Nalginad.exe
File created	C:\Windows\SysWOW64\Pacfaj32.exe	Pkindqem.exe
File opened for modification	C:\Windows\SysWOW64\Odnffb32.exe	Oapjjg32.exe
File created	C:\Windows\SysWOW64\Egddmpgp.dll	Olhkmo32.exe
File created	C:\Windows\SysWOW64\Kmffmj32.dll	Hgkidbjf.exe
File opened for modification	C:\Windows\SysWOW64\Inndgk32.exe	Ikpgkp32.exe
File opened for modification	C:\Windows\SysWOW64\Iibalfmd.exe	Igcdpknp.exe
File created	C:\Windows\SysWOW64\Blhmkkqm.dll	Ighnkj32.exe
File created	C:\Windows\SysWOW64\Hcppmo32.dll	Bichjhfj.exe
File opened for modification	C:\Windows\SysWOW64\Cmgpfo32.exe	Cilcfpjd.exe
File created	C:\Windows\SysWOW64\Pedoen32.dll	Gbnmbpld.exe
File created	C:\Windows\SysWOW64\Ffdhhebe.dll	Ijgjgf32.exe
File created	C:\Windows\SysWOW64\Delbpa32.dll	Kneldaab.exe
File opened for modification	C:\Windows\SysWOW64\Pommjj32.exe	Phcempie.exe
File created	C:\Windows\SysWOW64\Pboanh32.dll	Nagnno32.exe
File created	C:\Windows\SysWOW64\Hicoglhe.dll	Lckgcggo.exe
File created	C:\Windows\SysWOW64\Onodknjp.dll	Ciogff32.exe
File created	C:\Windows\SysWOW64\Efhjag32.exe	Eakaiq32.exe
File opened for modification	C:\Windows\SysWOW64\Najjdncg.exe	Nhafkimf.exe
File opened for modification	C:\Windows\SysWOW64\Pclmjn32.exe	Pkedia32.exe
File created	C:\Windows\SysWOW64\Cihcee32.dll	Cfdnjd32.exe
File created	C:\Windows\SysWOW64\Ikbjod32.dll	Giokpimi.exe
File opened for modification	C:\Windows\SysWOW64\Oilbajjl.exe	Oeafpk32.exe
File opened for modification	C:\Windows\SysWOW64\Bjmdoe32.exe	Bbflmhmd.exe
File opened for modification	C:\Windows\SysWOW64\Dfigecac.exe	Doooii32.exe
File created	C:\Windows\SysWOW64\Mklbjcpf.exe	Mebjni32.exe
File opened for modification	C:\Windows\SysWOW64\Boqlmebj.exe	Bhfcpk32.exe
File created	C:\Windows\SysWOW64\Aenpoiia.dll	Kngijaop.exe
File created	C:\Windows\SysWOW64\Cfkiohie.dll	Peehadjb.exe
File created	C:\Windows\SysWOW64\Qkkdojpo.exe	Qhmgcnak.exe
File created	C:\Windows\SysWOW64\Lnfmcbdo.dll	Nofemc32.exe
File created	C:\Windows\SysWOW64\Lkjddfli.dll	Gbhpiodj.exe
File created	C:\Windows\SysWOW64\Jibmmmoe.dll	Boqlmebj.exe
File opened for modification	C:\Windows\SysWOW64\Oijekjlo.exe	Oacmjm32.exe
File created	C:\Windows\SysWOW64\Gikbej32.exe	Gflein32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

12936 12492 WerFault.exe Cnehna32.exe

pid	pid_target	process	target process
12936	12492	WerFault.exe	Cnehna32.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Kdaagl32.exePenkgc32.exeQaelld32.exeBeaacp32.exeEkjlbejp.exeHjdleo32.exeOelmeleh.exeJcfeajig.exeIhfejdgl.exeAjadcghd.exeFpfnpfek.exeGbcfno32.exeMgbcod32.exeNepfog32.exeJdfhec32.exeLegala32.exeMlabpi32.exeMlflkhkg.exeGbhpiodj.exeQchcqc32.exeCahlmc32.exeIagcbjcd.exeBeodnq32.exeBhompl32.exeJbjiohco.exeEmakcklp.exeNjokmnho.exeKknfie32.exePhlibkje.exeCakibchj.exeBmbfkpfb.exeHhmbdeof.exeLgipie32.exeNlgafaei.exeMankhp32.exeEpkndg32.exeBiedpg32.exeBijnkgpb.exeGdammiep.exeAkqdeo32.exeIdloeo32.exeEmflia32.exeHnbdlm32.exeOodana32.exeAmeadhfn.exeLabkla32.exeDfpmfbkk.exeCfjdjo32.exeNajjdncg.exeEmfeok32.exeNhqoqbik.exeMmokgk32.exeFibfiame.exeMegjcohp.exeKgpmcg32.exeQklkjpcj.exeGlpdad32.exeAajegccf.exeIkpgkp32.exeAilaii32.exeDaaocb32.exeFmbkeoai.exeMnbkadln.exeAaofmi32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdaagl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Penkgc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qaelld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beaacp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekjlbejp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjdleo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oelmeleh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcfeajig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihfejdgl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajadcghd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpfnpfek.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbcfno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgbcod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nepfog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdfhec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Legala32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlabpi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlflkhkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbhpiodj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qchcqc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cahlmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iagcbjcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beodnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhompl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbjiohco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emakcklp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njokmnho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kknfie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phlibkje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cakibchj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbfkpfb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhmbdeof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgipie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlgafaei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mankhp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epkndg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Biedpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bijnkgpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdammiep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akqdeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idloeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emflia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnbdlm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oodana32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ameadhfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Labkla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpmfbkk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfjdjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Najjdncg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emfeok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhqoqbik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmokgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fibfiame.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Megjcohp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgpmcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qklkjpcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glpdad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aajegccf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikpgkp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ailaii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daaocb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmbkeoai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnbkadln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaofmi32.exe

Modifies registry class 64 IoCs

Processes:

Ikdafofp.exeAjfnnf32.exeCmgpfo32.exeMnadgn32.exeJdfakm32.exePpcqdikg.exeHacjgk32.exeAkqdeo32.exeGlgake32.exeLneekp32.exePohnee32.exeMlofji32.exeBgpomp32.exeBajnna32.exeDaaocb32.exePmnqpg32.exeOccqof32.exeMclpje32.exeBhompl32.exeLbkafe32.exeMmkbllhg.exeJbmedgal.exeLbahfdod.exeBkcjam32.exeLdfjbkbg.exeNlgafaei.exeIcfljmhj.exeKgigbhlh.exePalife32.exe213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exeJqpfpd32.exeMnbkadln.exeCccdii32.exeDmqbmn32.exeAcobgljo.exeDfigecac.exeKmmekndg.exeBlmffj32.exeGibopo32.exeIkgnlo32.exePcipeolg.exeKdmnfb32.exeCkafbk32.exeHikklg32.exeOapjjg32.exePhcempie.exePhilml32.exeDoooii32.exeInkpge32.exeBeodnq32.exeAijedi32.exeAjianleg.exeNagnno32.exeJlgcia32.exeLnqkppge.exeLadhba32.exeJdahpneo.exeMjaokp32.exeCfnndkol.exeFibfiame.exeHgilocli.exeEckcpe32.exeMebjni32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ikdafofp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajfnnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmgpfo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mnadgn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jdfakm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ppcqdikg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikdnfiag.dll"	Hacjgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Akqdeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hanbif32.dll"	Glgake32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcoofe32.dll"	Lneekp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Meibcipd.dll"	Pohnee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mlofji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bgpomp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bajnna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daaocb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmnqpg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Occqof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hacjgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mclpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhompl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lbkafe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abejnn32.dll"	Mmkbllhg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jbmedgal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lbahfdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bkcjam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ldfjbkbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nlgafaei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Icfljmhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gneafcnc.dll"	Kgigbhlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Palife32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jqpfpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imiaalih.dll"	Mnbkadln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cccdii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pklimnpi.dll"	Dmqbmn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Acobgljo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfigecac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpbmij32.dll"	Kmmekndg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Blmffj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecbihqfa.dll"	Gibopo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ikgnlo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pcipeolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdmnfb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ckafbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hikklg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oapjjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Phcempie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Philml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hqknhdjo.dll"	Doooii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igidni32.dll"	Inkpge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Beodnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeipja32.dll"	Aijedi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajianleg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nagnno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jlgcia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndlgej32.dll"	Lnqkppge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkmfkc32.dll"	Ladhba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jdahpneo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjaokp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngfcfho.dll"	Cfnndkol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fibfiame.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gajkdgog.dll"	Hgilocli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eckcpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mebjni32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exeNiaipbhe.exeNlpelmgi.exeNcjnhg32.exeNehjdc32.exeNhffqnlm.exeNcljnglc.exeNifbka32.exeOockch32.exeOcogcgjp.exeOihopa32.exeOlglllqq.exeOcadif32.exeOeopeb32.exeOiklfqpj.exeOlihblon.exeOccqof32.exeOeamka32.exeOlleglmk.exeOcemdfdh.exeOgaied32.exeOlnbmk32.exe

description	pid	process	target process
PID 4788 wrote to memory of 2132	4788	213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exe	Niaipbhe.exe
PID 4788 wrote to memory of 2132	4788	213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exe	Niaipbhe.exe
PID 4788 wrote to memory of 2132	4788	213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exe	Niaipbhe.exe
PID 2132 wrote to memory of 4524	2132	Niaipbhe.exe	Nlpelmgi.exe
PID 2132 wrote to memory of 4524	2132	Niaipbhe.exe	Nlpelmgi.exe
PID 2132 wrote to memory of 4524	2132	Niaipbhe.exe	Nlpelmgi.exe
PID 4524 wrote to memory of 4576	4524	Nlpelmgi.exe	Ncjnhg32.exe
PID 4524 wrote to memory of 4576	4524	Nlpelmgi.exe	Ncjnhg32.exe
PID 4524 wrote to memory of 4576	4524	Nlpelmgi.exe	Ncjnhg32.exe
PID 4576 wrote to memory of 1268	4576	Ncjnhg32.exe	Nehjdc32.exe
PID 4576 wrote to memory of 1268	4576	Ncjnhg32.exe	Nehjdc32.exe
PID 4576 wrote to memory of 1268	4576	Ncjnhg32.exe	Nehjdc32.exe
PID 1268 wrote to memory of 760	1268	Nehjdc32.exe	Nhffqnlm.exe
PID 1268 wrote to memory of 760	1268	Nehjdc32.exe	Nhffqnlm.exe
PID 1268 wrote to memory of 760	1268	Nehjdc32.exe	Nhffqnlm.exe
PID 760 wrote to memory of 3412	760	Nhffqnlm.exe	Ncljnglc.exe
PID 760 wrote to memory of 3412	760	Nhffqnlm.exe	Ncljnglc.exe
PID 760 wrote to memory of 3412	760	Nhffqnlm.exe	Ncljnglc.exe
PID 3412 wrote to memory of 1036	3412	Ncljnglc.exe	Nifbka32.exe
PID 3412 wrote to memory of 1036	3412	Ncljnglc.exe	Nifbka32.exe
PID 3412 wrote to memory of 1036	3412	Ncljnglc.exe	Nifbka32.exe
PID 1036 wrote to memory of 1980	1036	Nifbka32.exe	Oockch32.exe
PID 1036 wrote to memory of 1980	1036	Nifbka32.exe	Oockch32.exe
PID 1036 wrote to memory of 1980	1036	Nifbka32.exe	Oockch32.exe
PID 1980 wrote to memory of 1160	1980	Oockch32.exe	Ocogcgjp.exe
PID 1980 wrote to memory of 1160	1980	Oockch32.exe	Ocogcgjp.exe
PID 1980 wrote to memory of 1160	1980	Oockch32.exe	Ocogcgjp.exe
PID 1160 wrote to memory of 4516	1160	Ocogcgjp.exe	Oihopa32.exe
PID 1160 wrote to memory of 4516	1160	Ocogcgjp.exe	Oihopa32.exe
PID 1160 wrote to memory of 4516	1160	Ocogcgjp.exe	Oihopa32.exe
PID 4516 wrote to memory of 3180	4516	Oihopa32.exe	Olglllqq.exe
PID 4516 wrote to memory of 3180	4516	Oihopa32.exe	Olglllqq.exe
PID 4516 wrote to memory of 3180	4516	Oihopa32.exe	Olglllqq.exe
PID 3180 wrote to memory of 4184	3180	Olglllqq.exe	Ocadif32.exe
PID 3180 wrote to memory of 4184	3180	Olglllqq.exe	Ocadif32.exe
PID 3180 wrote to memory of 4184	3180	Olglllqq.exe	Ocadif32.exe
PID 4184 wrote to memory of 552	4184	Ocadif32.exe	Oeopeb32.exe
PID 4184 wrote to memory of 552	4184	Ocadif32.exe	Oeopeb32.exe
PID 4184 wrote to memory of 552	4184	Ocadif32.exe	Oeopeb32.exe
PID 552 wrote to memory of 1288	552	Oeopeb32.exe	Oiklfqpj.exe
PID 552 wrote to memory of 1288	552	Oeopeb32.exe	Oiklfqpj.exe
PID 552 wrote to memory of 1288	552	Oeopeb32.exe	Oiklfqpj.exe
PID 1288 wrote to memory of 180	1288	Oiklfqpj.exe	Olihblon.exe
PID 1288 wrote to memory of 180	1288	Oiklfqpj.exe	Olihblon.exe
PID 1288 wrote to memory of 180	1288	Oiklfqpj.exe	Olihblon.exe
PID 180 wrote to memory of 3400	180	Olihblon.exe	Occqof32.exe
PID 180 wrote to memory of 3400	180	Olihblon.exe	Occqof32.exe
PID 180 wrote to memory of 3400	180	Olihblon.exe	Occqof32.exe
PID 3400 wrote to memory of 3092	3400	Occqof32.exe	Oeamka32.exe
PID 3400 wrote to memory of 3092	3400	Occqof32.exe	Oeamka32.exe
PID 3400 wrote to memory of 3092	3400	Occqof32.exe	Oeamka32.exe
PID 3092 wrote to memory of 212	3092	Oeamka32.exe	Olleglmk.exe
PID 3092 wrote to memory of 212	3092	Oeamka32.exe	Olleglmk.exe
PID 3092 wrote to memory of 212	3092	Oeamka32.exe	Olleglmk.exe
PID 212 wrote to memory of 3484	212	Olleglmk.exe	Ocemdfdh.exe
PID 212 wrote to memory of 3484	212	Olleglmk.exe	Ocemdfdh.exe
PID 212 wrote to memory of 3484	212	Olleglmk.exe	Ocemdfdh.exe
PID 3484 wrote to memory of 380	3484	Ocemdfdh.exe	Ogaied32.exe
PID 3484 wrote to memory of 380	3484	Ocemdfdh.exe	Ogaied32.exe
PID 3484 wrote to memory of 380	3484	Ocemdfdh.exe	Ogaied32.exe
PID 380 wrote to memory of 3424	380	Ogaied32.exe	Olnbmk32.exe
PID 380 wrote to memory of 3424	380	Ogaied32.exe	Olnbmk32.exe
PID 380 wrote to memory of 3424	380	Ogaied32.exe	Olnbmk32.exe
PID 3424 wrote to memory of 2276	3424	Olnbmk32.exe	Ochjjebe.exe

C:\Users\Admin\AppData\Local\Temp\213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exe
"C:\Users\Admin\AppData\Local\Temp\213df9dfc0a1f092e0b1c31287139ac8f6a95e88796640d9693d6bcda0b37631.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4788

C:\Windows\SysWOW64\Niaipbhe.exe
C:\Windows\system32\Niaipbhe.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\SysWOW64\Nlpelmgi.exe
C:\Windows\system32\Nlpelmgi.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524

C:\Windows\SysWOW64\Ncjnhg32.exe
C:\Windows\system32\Ncjnhg32.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576

C:\Windows\SysWOW64\Nehjdc32.exe
C:\Windows\system32\Nehjdc32.exe
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\Nhffqnlm.exe
C:\Windows\system32\Nhffqnlm.exe
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\Ncljnglc.exe
C:\Windows\system32\Ncljnglc.exe
7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412

C:\Windows\SysWOW64\Nifbka32.exe
C:\Windows\system32\Nifbka32.exe
8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\SysWOW64\Oockch32.exe
C:\Windows\system32\Oockch32.exe
9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\Ocogcgjp.exe
C:\Windows\system32\Ocogcgjp.exe
10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\SysWOW64\Oihopa32.exe
C:\Windows\system32\Oihopa32.exe
11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516

C:\Windows\SysWOW64\Olglllqq.exe
C:\Windows\system32\Olglllqq.exe
12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180

C:\Windows\SysWOW64\Ocadif32.exe
C:\Windows\system32\Ocadif32.exe
13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184

C:\Windows\SysWOW64\Oeopeb32.exe
C:\Windows\system32\Oeopeb32.exe
14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\SysWOW64\Oiklfqpj.exe
C:\Windows\system32\Oiklfqpj.exe
15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\SysWOW64\Olihblon.exe
C:\Windows\system32\Olihblon.exe
16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:180

C:\Windows\SysWOW64\Occqof32.exe
C:\Windows\system32\Occqof32.exe
17⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3400

C:\Windows\SysWOW64\Oeamka32.exe
C:\Windows\system32\Oeamka32.exe
18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092

C:\Windows\SysWOW64\Olleglmk.exe
C:\Windows\system32\Olleglmk.exe
19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212

C:\Windows\SysWOW64\Ocemdfdh.exe
C:\Windows\system32\Ocemdfdh.exe
20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3484

C:\Windows\SysWOW64\Ogaied32.exe
C:\Windows\system32\Ogaied32.exe
21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380

C:\Windows\SysWOW64\Olnbmk32.exe
C:\Windows\system32\Olnbmk32.exe
22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424

C:\Windows\SysWOW64\Ochjjebe.exe
C:\Windows\system32\Ochjjebe.exe
23⤵
- Executes dropped EXE
PID:2276

C:\Windows\SysWOW64\Phdbblpm.exe
C:\Windows\system32\Phdbblpm.exe
24⤵
- Executes dropped EXE
PID:2140

C:\Windows\SysWOW64\Pcjgoe32.exe
C:\Windows\system32\Pcjgoe32.exe
25⤵
- Executes dropped EXE
PID:2876

C:\Windows\SysWOW64\Pfhckq32.exe
C:\Windows\system32\Pfhckq32.exe
26⤵
- Executes dropped EXE
PID:2992

C:\Windows\SysWOW64\Ppngii32.exe
C:\Windows\system32\Ppngii32.exe
27⤵
- Executes dropped EXE
PID:3192

C:\Windows\SysWOW64\Pcmcee32.exe
C:\Windows\system32\Pcmcee32.exe
28⤵
- Executes dropped EXE
PID:4036

C:\Windows\SysWOW64\Philml32.exe
C:\Windows\system32\Philml32.exe
29⤵
- Executes dropped EXE
- Modifies registry class
PID:4948

C:\Windows\SysWOW64\Pfmlfpka.exe
C:\Windows\system32\Pfmlfpka.exe
30⤵
- Executes dropped EXE
PID:1504

C:\Windows\SysWOW64\Phlibkje.exe
C:\Windows\system32\Phlibkje.exe
31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2528

C:\Windows\SysWOW64\Ppcqdikg.exe
C:\Windows\system32\Ppcqdikg.exe
32⤵
- Executes dropped EXE
- Modifies registry class
PID:4752

C:\Windows\SysWOW64\Poeaoe32.exe
C:\Windows\system32\Poeaoe32.exe
33⤵
- Executes dropped EXE
PID:3704

C:\Windows\SysWOW64\Pjkemn32.exe
C:\Windows\system32\Pjkemn32.exe
34⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4512

C:\Windows\SysWOW64\Pljaij32.exe
C:\Windows\system32\Pljaij32.exe
35⤵
- Executes dropped EXE
PID:4348

C:\Windows\SysWOW64\Pohnee32.exe
C:\Windows\system32\Pohnee32.exe
36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:940

C:\Windows\SysWOW64\Pgoefbpa.exe
C:\Windows\system32\Pgoefbpa.exe
37⤵
- Executes dropped EXE
PID:4600

C:\Windows\SysWOW64\Qfbfao32.exe
C:\Windows\system32\Qfbfao32.exe
38⤵
- Executes dropped EXE
PID:2156

C:\Windows\SysWOW64\Qhpbnk32.exe
C:\Windows\system32\Qhpbnk32.exe
39⤵
- Executes dropped EXE
PID:3108

C:\Windows\SysWOW64\Qqgjoh32.exe
C:\Windows\system32\Qqgjoh32.exe
40⤵
- Executes dropped EXE
PID:5064

C:\Windows\SysWOW64\Qcffkc32.exe
C:\Windows\system32\Qcffkc32.exe
41⤵
- Executes dropped EXE
PID:4312

C:\Windows\SysWOW64\Qfdbgo32.exe
C:\Windows\system32\Qfdbgo32.exe
42⤵
- Executes dropped EXE
PID:1864

C:\Windows\SysWOW64\Qhbocj32.exe
C:\Windows\system32\Qhbocj32.exe
43⤵
- Executes dropped EXE
PID:8

C:\Windows\SysWOW64\Qqjgdh32.exe
C:\Windows\system32\Qqjgdh32.exe
44⤵
- Executes dropped EXE
PID:3880

C:\Windows\SysWOW64\Qchcqc32.exe
C:\Windows\system32\Qchcqc32.exe
45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3700

C:\Windows\SysWOW64\Affomo32.exe
C:\Windows\system32\Affomo32.exe
46⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3812

C:\Windows\SysWOW64\Ahekijbj.exe
C:\Windows\system32\Ahekijbj.exe
47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3096

C:\Windows\SysWOW64\Aqlcjgbl.exe
C:\Windows\system32\Aqlcjgbl.exe
48⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1960

C:\Windows\SysWOW64\Agflga32.exe
C:\Windows\system32\Agflga32.exe
49⤵
- Executes dropped EXE
PID:2268

C:\Windows\SysWOW64\Afilbnad.exe
C:\Windows\system32\Afilbnad.exe
50⤵
- Executes dropped EXE
PID:2532

C:\Windows\SysWOW64\Amcdoh32.exe
C:\Windows\system32\Amcdoh32.exe
51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:228

C:\Windows\SysWOW64\Acmllbpm.exe
C:\Windows\system32\Acmllbpm.exe
52⤵
- Executes dropped EXE
PID:3120

C:\Windows\SysWOW64\Aijedi32.exe
C:\Windows\system32\Aijedi32.exe
53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1936

C:\Windows\SysWOW64\Ameadhfn.exe
C:\Windows\system32\Ameadhfn.exe
54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1468

C:\Windows\SysWOW64\Aocmqcea.exe
C:\Windows\system32\Aocmqcea.exe
55⤵
- Executes dropped EXE
PID:3476

C:\Windows\SysWOW64\Ajianleg.exe
C:\Windows\system32\Ajianleg.exe
56⤵
- Executes dropped EXE
- Modifies registry class
PID:1452

C:\Windows\SysWOW64\Ailaii32.exe
C:\Windows\system32\Ailaii32.exe
57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5008

C:\Windows\SysWOW64\Aofjfcco.exe
C:\Windows\system32\Aofjfcco.exe
58⤵
- Executes dropped EXE
PID:436

C:\Windows\SysWOW64\Afpbcm32.exe
C:\Windows\system32\Afpbcm32.exe
59⤵
- Executes dropped EXE
PID:3196

C:\Windows\SysWOW64\Aqefpfkb.exe
C:\Windows\system32\Aqefpfkb.exe
60⤵
- Executes dropped EXE
PID:2732

C:\Windows\SysWOW64\Bgpomp32.exe
C:\Windows\system32\Bgpomp32.exe
61⤵
- Executes dropped EXE
- Modifies registry class
PID:4316

C:\Windows\SysWOW64\Bjnkik32.exe
C:\Windows\system32\Bjnkik32.exe
62⤵
- Executes dropped EXE
PID:3916

C:\Windows\SysWOW64\Bmlgeg32.exe
C:\Windows\system32\Bmlgeg32.exe
63⤵
- Executes dropped EXE
PID:4360

C:\Windows\SysWOW64\Bfeknmgf.exe
C:\Windows\system32\Bfeknmgf.exe
64⤵
- Executes dropped EXE
PID:2128

C:\Windows\SysWOW64\Bichjhfj.exe
C:\Windows\system32\Bichjhfj.exe
65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3644

C:\Windows\SysWOW64\Bompgbmg.exe
C:\Windows\system32\Bompgbmg.exe
66⤵
PID:4384

C:\Windows\SysWOW64\Biedpg32.exe
C:\Windows\system32\Biedpg32.exe
67⤵
- System Location Discovery: System Language Discovery
PID:1844

C:\Windows\SysWOW64\Boomlakd.exe
C:\Windows\system32\Boomlakd.exe
68⤵
PID:3652

C:\Windows\SysWOW64\Bfieil32.exe
C:\Windows\system32\Bfieil32.exe
69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1444

C:\Windows\SysWOW64\Bihaeg32.exe
C:\Windows\system32\Bihaeg32.exe
70⤵
- Drops file in System32 directory
PID:1248

C:\Windows\SysWOW64\Bqoifd32.exe
C:\Windows\system32\Bqoifd32.exe
71⤵
PID:3884

C:\Windows\SysWOW64\Bcmebpak.exe
C:\Windows\system32\Bcmebpak.exe
72⤵
PID:4248

C:\Windows\SysWOW64\Bijnkgpb.exe
C:\Windows\system32\Bijnkgpb.exe
73⤵
- System Location Discovery: System Language Discovery
PID:2724

C:\Windows\SysWOW64\Ccpbhpph.exe
C:\Windows\system32\Ccpbhpph.exe
74⤵
PID:3464

C:\Windows\SysWOW64\Cfnndkol.exe
C:\Windows\system32\Cfnndkol.exe
75⤵
- Modifies registry class
PID:2668

C:\Windows\SysWOW64\Cacbadnb.exe
C:\Windows\system32\Cacbadnb.exe
76⤵
PID:1500

C:\Windows\SysWOW64\Ccbono32.exe
C:\Windows\system32\Ccbono32.exe
77⤵
PID:2040

C:\Windows\SysWOW64\Ciogff32.exe
C:\Windows\system32\Ciogff32.exe
78⤵
- Drops file in System32 directory
PID:4796

C:\Windows\SysWOW64\Ccdkco32.exe
C:\Windows\system32\Ccdkco32.exe
79⤵
PID:4292

C:\Windows\SysWOW64\Cfchoj32.exe
C:\Windows\system32\Cfchoj32.exe
80⤵
PID:3536

C:\Windows\SysWOW64\Cahlmc32.exe
C:\Windows\system32\Cahlmc32.exe
81⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4976

C:\Windows\SysWOW64\Cjqqei32.exe
C:\Windows\system32\Cjqqei32.exe
82⤵
PID:1156

C:\Windows\SysWOW64\Cakibchj.exe
C:\Windows\system32\Cakibchj.exe
83⤵
- System Location Discovery: System Language Discovery
PID:1808

C:\Windows\SysWOW64\Cfgajjfa.exe
C:\Windows\system32\Cfgajjfa.exe
84⤵
PID:3504

C:\Windows\SysWOW64\Cifmfeee.exe
C:\Windows\system32\Cifmfeee.exe
85⤵
PID:1640

C:\Windows\SysWOW64\Dppeco32.exe
C:\Windows\system32\Dppeco32.exe
86⤵
PID:2764

C:\Windows\SysWOW64\Dihjle32.exe
C:\Windows\system32\Dihjle32.exe
87⤵
PID:4560

C:\Windows\SysWOW64\Dcnnin32.exe
C:\Windows\system32\Dcnnin32.exe
88⤵
PID:2408

C:\Windows\SysWOW64\Dflkei32.exe
C:\Windows\system32\Dflkei32.exe
89⤵
PID:3320

C:\Windows\SysWOW64\Daaocb32.exe
C:\Windows\system32\Daaocb32.exe
90⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3780

C:\Windows\SysWOW64\Dcpkom32.exe
C:\Windows\system32\Dcpkom32.exe
91⤵
PID:2996

C:\Windows\SysWOW64\Djjclgib.exe
C:\Windows\system32\Djjclgib.exe
92⤵
PID:1968

C:\Windows\SysWOW64\Dpgldn32.exe
C:\Windows\system32\Dpgldn32.exe
93⤵
PID:1548

C:\Windows\SysWOW64\Dfadqhnf.exe
C:\Windows\system32\Dfadqhnf.exe
94⤵
PID:3808

C:\Windows\SysWOW64\Diopmdnj.exe
C:\Windows\system32\Diopmdnj.exe
95⤵
PID:2892

C:\Windows\SysWOW64\Dmklmb32.exe
C:\Windows\system32\Dmklmb32.exe
96⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1672

C:\Windows\SysWOW64\Ddedjmmp.exe
C:\Windows\system32\Ddedjmmp.exe
97⤵
PID:1136

C:\Windows\SysWOW64\Dfcqfhld.exe
C:\Windows\system32\Dfcqfhld.exe
98⤵
PID:3972

C:\Windows\SysWOW64\Eaieca32.exe
C:\Windows\system32\Eaieca32.exe
99⤵
PID:1004

C:\Windows\SysWOW64\Edgapl32.exe
C:\Windows\system32\Edgapl32.exe
100⤵
PID:4400

C:\Windows\SysWOW64\Efemlh32.exe
C:\Windows\system32\Efemlh32.exe
101⤵
PID:3876

C:\Windows\SysWOW64\Eakaiq32.exe
C:\Windows\system32\Eakaiq32.exe
102⤵
- Drops file in System32 directory
PID:5052

C:\Windows\SysWOW64\Efhjag32.exe
C:\Windows\system32\Efhjag32.exe
103⤵
PID:2684

C:\Windows\SysWOW64\Embbnapk.exe
C:\Windows\system32\Embbnapk.exe
104⤵
PID:2840

C:\Windows\SysWOW64\Edlkklgh.exe
C:\Windows\system32\Edlkklgh.exe
105⤵
PID:1232

C:\Windows\SysWOW64\Ehjcaj32.exe
C:\Windows\system32\Ehjcaj32.exe
106⤵
PID:4580

C:\Windows\SysWOW64\Emflia32.exe
C:\Windows\system32\Emflia32.exe
107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:4880

C:\Windows\SysWOW64\Ekjlbejp.exe
C:\Windows\system32\Ekjlbejp.exe
108⤵
- System Location Discovery: System Language Discovery
PID:116

C:\Windows\SysWOW64\Fmihoqjc.exe
C:\Windows\system32\Fmihoqjc.exe
109⤵
PID:724

C:\Windows\SysWOW64\Fhnmliii.exe
C:\Windows\system32\Fhnmliii.exe
110⤵
PID:1552

C:\Windows\SysWOW64\Fmkedpgq.exe
C:\Windows\system32\Fmkedpgq.exe
111⤵
PID:5144

C:\Windows\SysWOW64\Fpjaplgd.exe
C:\Windows\system32\Fpjaplgd.exe
112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5180

C:\Windows\SysWOW64\Fgcjmfna.exe
C:\Windows\system32\Fgcjmfna.exe
113⤵
PID:5224

C:\Windows\SysWOW64\Fibfiame.exe
C:\Windows\system32\Fibfiame.exe
114⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5268

C:\Windows\SysWOW64\Fainjong.exe
C:\Windows\system32\Fainjong.exe
115⤵
PID:5308

C:\Windows\SysWOW64\Fdgjfjmk.exe
C:\Windows\system32\Fdgjfjmk.exe
116⤵
PID:5352

C:\Windows\SysWOW64\Fgffbelo.exe
C:\Windows\system32\Fgffbelo.exe
117⤵
PID:5396

C:\Windows\SysWOW64\Fidboakb.exe
C:\Windows\system32\Fidboakb.exe
118⤵
PID:5440

C:\Windows\SysWOW64\Fakkpnld.exe
C:\Windows\system32\Fakkpnld.exe
119⤵
PID:5472

C:\Windows\SysWOW64\Fdjgljkh.exe
C:\Windows\system32\Fdjgljkh.exe
120⤵
PID:5524

C:\Windows\SysWOW64\Fghche32.exe
C:\Windows\system32\Fghche32.exe
121⤵
PID:5568

C:\Windows\SysWOW64\Fmbkeoai.exe
C:\Windows\system32\Fmbkeoai.exe
122⤵
- System Location Discovery: System Language Discovery
PID:5612

C:\Windows\SysWOW64\Fdlcai32.exe
C:\Windows\system32\Fdlcai32.exe
123⤵
PID:5652

C:\Windows\SysWOW64\Fgkpne32.exe
C:\Windows\system32\Fgkpne32.exe
124⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5696

C:\Windows\SysWOW64\Giiljp32.exe
C:\Windows\system32\Giiljp32.exe
125⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5740

C:\Windows\SysWOW64\Gapdkn32.exe
C:\Windows\system32\Gapdkn32.exe
126⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5784

C:\Windows\SysWOW64\Gdopgi32.exe
C:\Windows\system32\Gdopgi32.exe
127⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5828

C:\Windows\SysWOW64\Gkhhdc32.exe
C:\Windows\system32\Gkhhdc32.exe
128⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5868

C:\Windows\SysWOW64\Gmgepo32.exe
C:\Windows\system32\Gmgepo32.exe
129⤵
PID:5912

C:\Windows\SysWOW64\Gdammiep.exe
C:\Windows\system32\Gdammiep.exe
130⤵
- System Location Discovery: System Language Discovery
PID:5956

C:\Windows\SysWOW64\Ggoiiddd.exe
C:\Windows\system32\Ggoiiddd.exe
131⤵
PID:6000

C:\Windows\SysWOW64\Gmiaen32.exe
C:\Windows\system32\Gmiaen32.exe
132⤵
PID:6044

C:\Windows\SysWOW64\Gphnaj32.exe
C:\Windows\system32\Gphnaj32.exe
133⤵
PID:6092

C:\Windows\SysWOW64\Gkmbob32.exe
C:\Windows\system32\Gkmbob32.exe
134⤵
PID:6132

C:\Windows\SysWOW64\Gnlnknin.exe
C:\Windows\system32\Gnlnknin.exe
135⤵
PID:5168

C:\Windows\SysWOW64\Gpjjgiha.exe
C:\Windows\system32\Gpjjgiha.exe
136⤵
PID:5248

C:\Windows\SysWOW64\Ggdbdc32.exe
C:\Windows\system32\Ggdbdc32.exe
137⤵
PID:5316

C:\Windows\SysWOW64\Gibopo32.exe
C:\Windows\system32\Gibopo32.exe
138⤵
- Modifies registry class
PID:5380

C:\Windows\SysWOW64\Gplgmifo.exe
C:\Windows\system32\Gplgmifo.exe
139⤵
PID:5456

C:\Windows\SysWOW64\Ghconfga.exe
C:\Windows\system32\Ghconfga.exe
140⤵
PID:5504

C:\Windows\SysWOW64\Hjdleo32.exe
C:\Windows\system32\Hjdleo32.exe
141⤵
- System Location Discovery: System Language Discovery
PID:5600

C:\Windows\SysWOW64\Halcglnb.exe
C:\Windows\system32\Halcglnb.exe
142⤵
PID:5664

C:\Windows\SysWOW64\Hdjpcgme.exe
C:\Windows\system32\Hdjpcgme.exe
143⤵
PID:5736

C:\Windows\SysWOW64\Hgilocli.exe
C:\Windows\system32\Hgilocli.exe
144⤵
- Modifies registry class
PID:5812

C:\Windows\SysWOW64\Hnbdlm32.exe
C:\Windows\system32\Hnbdlm32.exe
145⤵
- System Location Discovery: System Language Discovery
PID:5888

C:\Windows\SysWOW64\Hanplllo.exe
C:\Windows\system32\Hanplllo.exe
146⤵
PID:5948

C:\Windows\SysWOW64\Hgkidbjf.exe
C:\Windows\system32\Hgkidbjf.exe
147⤵
- Drops file in System32 directory
PID:6024

C:\Windows\SysWOW64\Hjieqnij.exe
C:\Windows\system32\Hjieqnij.exe
148⤵
PID:6084

C:\Windows\SysWOW64\Hneaam32.exe
C:\Windows\system32\Hneaam32.exe
149⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5140

C:\Windows\SysWOW64\Hpcmmhpg.exe
C:\Windows\system32\Hpcmmhpg.exe
150⤵
PID:5256

C:\Windows\SysWOW64\Hhjeoeai.exe
C:\Windows\system32\Hhjeoeai.exe
151⤵
PID:5340

C:\Windows\SysWOW64\Hkiakapm.exe
C:\Windows\system32\Hkiakapm.exe
152⤵
PID:5420

C:\Windows\SysWOW64\Hacjgk32.exe
C:\Windows\system32\Hacjgk32.exe
153⤵
- Modifies registry class
PID:5580

C:\Windows\SysWOW64\Hhmbdeof.exe
C:\Windows\system32\Hhmbdeof.exe
154⤵
- System Location Discovery: System Language Discovery
PID:5692

C:\Windows\SysWOW64\Hkknpqnj.exe
C:\Windows\system32\Hkknpqnj.exe
155⤵
PID:5808

C:\Windows\SysWOW64\Hphfhgla.exe
C:\Windows\system32\Hphfhgla.exe
156⤵
PID:5940

C:\Windows\SysWOW64\Hhooje32.exe
C:\Windows\system32\Hhooje32.exe
157⤵
PID:6016

C:\Windows\SysWOW64\Iknkfp32.exe
C:\Windows\system32\Iknkfp32.exe
158⤵
PID:1360

C:\Windows\SysWOW64\Iagcbjcd.exe
C:\Windows\system32\Iagcbjcd.exe
159⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:5292

C:\Windows\SysWOW64\Idfoofbh.exe
C:\Windows\system32\Idfoofbh.exe
160⤵
PID:5428

C:\Windows\SysWOW64\Ikpgkp32.exe
C:\Windows\system32\Ikpgkp32.exe
161⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5536

C:\Windows\SysWOW64\Inndgk32.exe
C:\Windows\system32\Inndgk32.exe
162⤵
PID:5796

C:\Windows\SysWOW64\Iqmpcg32.exe
C:\Windows\system32\Iqmpcg32.exe
163⤵
PID:5984

C:\Windows\SysWOW64\Ihdhedio.exe
C:\Windows\system32\Ihdhedio.exe
164⤵
PID:6128

C:\Windows\SysWOW64\Ikbdaphb.exe
C:\Windows\system32\Ikbdaphb.exe
165⤵
PID:5408

C:\Windows\SysWOW64\Inqqmkgf.exe
C:\Windows\system32\Inqqmkgf.exe
166⤵
PID:5216

C:\Windows\SysWOW64\Iqomiffj.exe
C:\Windows\system32\Iqomiffj.exe
167⤵
PID:5928

C:\Windows\SysWOW64\Ihfejdgl.exe
C:\Windows\system32\Ihfejdgl.exe
168⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:5176

C:\Windows\SysWOW64\Ikdafofp.exe
C:\Windows\system32\Ikdafofp.exe
169⤵
- Modifies registry class
PID:5564

C:\Windows\SysWOW64\Iqaiofdg.exe
C:\Windows\system32\Iqaiofdg.exe
170⤵
PID:6052

C:\Windows\SysWOW64\Ihhapc32.exe
C:\Windows\system32\Ihhapc32.exe
171⤵
PID:5728

C:\Windows\SysWOW64\Ikgnlo32.exe
C:\Windows\system32\Ikgnlo32.exe
172⤵
- Modifies registry class
PID:5576

C:\Windows\SysWOW64\Inejhj32.exe
C:\Windows\system32\Inejhj32.exe
173⤵
PID:6152

C:\Windows\SysWOW64\Idobedjm.exe
C:\Windows\system32\Idobedjm.exe
174⤵
PID:6196

C:\Windows\SysWOW64\Jkijao32.exe
C:\Windows\system32\Jkijao32.exe
175⤵
PID:6232

C:\Windows\SysWOW64\Jnhfnj32.exe
C:\Windows\system32\Jnhfnj32.exe
176⤵
PID:6276

C:\Windows\SysWOW64\Jbcbniig.exe
C:\Windows\system32\Jbcbniig.exe
177⤵
PID:6320

C:\Windows\SysWOW64\Jhmkkc32.exe
C:\Windows\system32\Jhmkkc32.exe
178⤵
PID:6364

C:\Windows\SysWOW64\Jjogbk32.exe
C:\Windows\system32\Jjogbk32.exe
179⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6404

C:\Windows\SysWOW64\Jbeodh32.exe
C:\Windows\system32\Jbeodh32.exe
180⤵
PID:6448

C:\Windows\SysWOW64\Jhpgqboa.exe
C:\Windows\system32\Jhpgqboa.exe
181⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6488

C:\Windows\SysWOW64\Jkndmnne.exe
C:\Windows\system32\Jkndmnne.exe
182⤵
PID:6532

C:\Windows\SysWOW64\Jnlpiimi.exe
C:\Windows\system32\Jnlpiimi.exe
183⤵
PID:6576

C:\Windows\SysWOW64\Jdfhec32.exe
C:\Windows\system32\Jdfhec32.exe
184⤵
- System Location Discovery: System Language Discovery
PID:6620

C:\Windows\SysWOW64\Jhbdfbmo.exe
C:\Windows\system32\Jhbdfbmo.exe
185⤵
PID:6664

C:\Windows\SysWOW64\Jjcqnjbm.exe
C:\Windows\system32\Jjcqnjbm.exe
186⤵
- Drops file in System32 directory
PID:6708

C:\Windows\SysWOW64\Jbjiohco.exe
C:\Windows\system32\Jbjiohco.exe
187⤵
- System Location Discovery: System Language Discovery
PID:6752

C:\Windows\SysWOW64\Jidalb32.exe
C:\Windows\system32\Jidalb32.exe
188⤵
PID:6796

C:\Windows\SysWOW64\Jkbmhm32.exe
C:\Windows\system32\Jkbmhm32.exe
189⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6840

C:\Windows\SysWOW64\Jbmedgal.exe
C:\Windows\system32\Jbmedgal.exe
190⤵
- Modifies registry class
PID:6884

C:\Windows\SysWOW64\Jqpfpd32.exe
C:\Windows\system32\Jqpfpd32.exe
191⤵
- Modifies registry class
PID:6928

C:\Windows\SysWOW64\Kginmnod.exe
C:\Windows\system32\Kginmnod.exe
192⤵
PID:6968

C:\Windows\SysWOW64\Kjhjijog.exe
C:\Windows\system32\Kjhjijog.exe
193⤵
PID:7012

C:\Windows\SysWOW64\Kdmnfb32.exe
C:\Windows\system32\Kdmnfb32.exe
194⤵
- Modifies registry class
PID:7056

C:\Windows\SysWOW64\Kglkbn32.exe
C:\Windows\system32\Kglkbn32.exe
195⤵
- Drops file in System32 directory
PID:7096

C:\Windows\SysWOW64\Kjjgni32.exe
C:\Windows\system32\Kjjgni32.exe
196⤵
PID:7128

C:\Windows\SysWOW64\Kbaopg32.exe
C:\Windows\system32\Kbaopg32.exe
197⤵
PID:5604

C:\Windows\SysWOW64\Kepklb32.exe
C:\Windows\system32\Kepklb32.exe
198⤵
PID:6180

C:\Windows\SysWOW64\Kgnghn32.exe
C:\Windows\system32\Kgnghn32.exe
199⤵
PID:6260

C:\Windows\SysWOW64\Knhpdhck.exe
C:\Windows\system32\Knhpdhck.exe
200⤵
PID:6328

C:\Windows\SysWOW64\Kqflqc32.exe
C:\Windows\system32\Kqflqc32.exe
201⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6400

C:\Windows\SysWOW64\Kindbq32.exe
C:\Windows\system32\Kindbq32.exe
202⤵
PID:6472

C:\Windows\SysWOW64\Kjopiihp.exe
C:\Windows\system32\Kjopiihp.exe
203⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6540

C:\Windows\SysWOW64\Kbfhkfib.exe
C:\Windows\system32\Kbfhkfib.exe
204⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6608

C:\Windows\SysWOW64\Keddgahe.exe
C:\Windows\system32\Keddgahe.exe
205⤵
PID:6680

C:\Windows\SysWOW64\Kknmcl32.exe
C:\Windows\system32\Kknmcl32.exe
206⤵
PID:6744

C:\Windows\SysWOW64\Knmipg32.exe
C:\Windows\system32\Knmipg32.exe
207⤵
PID:6820

C:\Windows\SysWOW64\Kakelb32.exe
C:\Windows\system32\Kakelb32.exe
208⤵
PID:6892

C:\Windows\SysWOW64\Legala32.exe
C:\Windows\system32\Legala32.exe
209⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:6956

C:\Windows\SysWOW64\Lgemhm32.exe
C:\Windows\system32\Lgemhm32.exe
210⤵
PID:7024

C:\Windows\SysWOW64\Lkqiiknp.exe
C:\Windows\system32\Lkqiiknp.exe
211⤵
PID:7104

C:\Windows\SysWOW64\Lbkafe32.exe
C:\Windows\system32\Lbkafe32.exe
212⤵
- Modifies registry class
PID:7164

C:\Windows\SysWOW64\Lidjbpli.exe
C:\Windows\system32\Lidjbpli.exe
213⤵
PID:6264

C:\Windows\SysWOW64\Lggjnl32.exe
C:\Windows\system32\Lggjnl32.exe
214⤵
PID:6340

C:\Windows\SysWOW64\Ljffjh32.exe
C:\Windows\system32\Ljffjh32.exe
215⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6436

C:\Windows\SysWOW64\Lbmnke32.exe
C:\Windows\system32\Lbmnke32.exe
216⤵
PID:6568

C:\Windows\SysWOW64\Lekkgqbm.exe
C:\Windows\system32\Lekkgqbm.exe
217⤵
PID:6704

C:\Windows\SysWOW64\Llecdk32.exe
C:\Windows\system32\Llecdk32.exe
218⤵
PID:6780

C:\Windows\SysWOW64\Ljhcpgpe.exe
C:\Windows\system32\Ljhcpgpe.exe
219⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6948

C:\Windows\SysWOW64\Labkla32.exe
C:\Windows\system32\Labkla32.exe
220⤵
- System Location Discovery: System Language Discovery
PID:7000

C:\Windows\SysWOW64\Liicno32.exe
C:\Windows\system32\Liicno32.exe
221⤵
PID:7112

C:\Windows\SysWOW64\Llhpjj32.exe
C:\Windows\system32\Llhpjj32.exe
222⤵
PID:6220

C:\Windows\SysWOW64\Lbahfdod.exe
C:\Windows\system32\Lbahfdod.exe
223⤵
- Modifies registry class
PID:6432

C:\Windows\SysWOW64\Ladhba32.exe
C:\Windows\system32\Ladhba32.exe
224⤵
- Modifies registry class
PID:6584

C:\Windows\SysWOW64\Lhopok32.exe
C:\Windows\system32\Lhopok32.exe
225⤵
PID:6816

C:\Windows\SysWOW64\Ljmmkg32.exe
C:\Windows\system32\Ljmmkg32.exe
226⤵
PID:6988

C:\Windows\SysWOW64\Lbddld32.exe
C:\Windows\system32\Lbddld32.exe
227⤵
PID:7152

C:\Windows\SysWOW64\Mebqhp32.exe
C:\Windows\system32\Mebqhp32.exe
228⤵
PID:6392

C:\Windows\SysWOW64\Mhamdk32.exe
C:\Windows\system32\Mhamdk32.exe
229⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6628

C:\Windows\SysWOW64\Mnkeaebf.exe
C:\Windows\system32\Mnkeaebf.exe
230⤵
PID:6992

C:\Windows\SysWOW64\Maiamqaj.exe
C:\Windows\system32\Maiamqaj.exe
231⤵
PID:7160

C:\Windows\SysWOW64\Mipinnbl.exe
C:\Windows\system32\Mipinnbl.exe
232⤵
PID:6520

C:\Windows\SysWOW64\Mlofji32.exe
C:\Windows\system32\Mlofji32.exe
233⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6976

C:\Windows\SysWOW64\Mnmbfe32.exe
C:\Windows\system32\Mnmbfe32.exe
234⤵
PID:6596

C:\Windows\SysWOW64\Megjcohp.exe
C:\Windows\system32\Megjcohp.exe
235⤵
- System Location Discovery: System Language Discovery
PID:6528

C:\Windows\SysWOW64\Mlabpi32.exe
C:\Windows\system32\Mlabpi32.exe
236⤵
- System Location Discovery: System Language Discovery
PID:6716

C:\Windows\SysWOW64\Mnpold32.exe
C:\Windows\system32\Mnpold32.exe
237⤵
PID:1356

C:\Windows\SysWOW64\Mbkkmcgj.exe
C:\Windows\system32\Mbkkmcgj.exe
238⤵
PID:7188

C:\Windows\SysWOW64\Mankhp32.exe
C:\Windows\system32\Mankhp32.exe
239⤵
- System Location Discovery: System Language Discovery
PID:7236

C:\Windows\SysWOW64\Mlcoei32.exe
C:\Windows\system32\Mlcoei32.exe
240⤵
PID:7280

C:\Windows\SysWOW64\Mnbkadln.exe
C:\Windows\system32\Mnbkadln.exe
241⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:7320

C:\Windows\SysWOW64\Mapgnpla.exe
C:\Windows\system32\Mapgnpla.exe
242⤵
PID:7368

C:\Windows\SysWOW64\Migpomld.exe
C:\Windows\system32\Migpomld.exe
243⤵
PID:7408

C:\Windows\SysWOW64\Mlflkhkg.exe
C:\Windows\system32\Mlflkhkg.exe
244⤵
- System Location Discovery: System Language Discovery
PID:7456

C:\Windows\SysWOW64\Mbpdhb32.exe
C:\Windows\system32\Mbpdhb32.exe
245⤵
PID:7500

C:\Windows\SysWOW64\Nenpdn32.exe
C:\Windows\system32\Nenpdn32.exe
246⤵
PID:7540

C:\Windows\SysWOW64\Nijldmja.exe
C:\Windows\system32\Nijldmja.exe
247⤵
- Drops file in System32 directory
PID:7572

C:\Windows\SysWOW64\Nlhhqhie.exe
C:\Windows\system32\Nlhhqhie.exe
248⤵
PID:7624

C:\Windows\SysWOW64\Nofemc32.exe
C:\Windows\system32\Nofemc32.exe
249⤵
- Drops file in System32 directory
PID:7660

C:\Windows\SysWOW64\Nbbqmbqb.exe
C:\Windows\system32\Nbbqmbqb.exe
250⤵
PID:7696

C:\Windows\SysWOW64\Nilijl32.exe
C:\Windows\system32\Nilijl32.exe
251⤵
PID:7752

C:\Windows\SysWOW64\Njmeadnm.exe
C:\Windows\system32\Njmeadnm.exe
252⤵
PID:7792

C:\Windows\SysWOW64\Noiabc32.exe
C:\Windows\system32\Noiabc32.exe
253⤵
PID:7832

C:\Windows\SysWOW64\Nagnno32.exe
C:\Windows\system32\Nagnno32.exe
254⤵
- Drops file in System32 directory
- Modifies registry class
PID:7876

C:\Windows\SysWOW64\Nhafkimf.exe
C:\Windows\system32\Nhafkimf.exe
255⤵
- Drops file in System32 directory
PID:7916

C:\Windows\SysWOW64\Najjdncg.exe
C:\Windows\system32\Najjdncg.exe
256⤵
- System Location Discovery: System Language Discovery
PID:7956

C:\Windows\SysWOW64\Niqbeldi.exe
C:\Windows\system32\Niqbeldi.exe
257⤵
PID:8004

C:\Windows\SysWOW64\Nhcbqh32.exe
C:\Windows\system32\Nhcbqh32.exe
258⤵
PID:8048

C:\Windows\SysWOW64\Nkbomd32.exe
C:\Windows\system32\Nkbomd32.exe
259⤵
PID:8092

C:\Windows\SysWOW64\Nalginad.exe
C:\Windows\system32\Nalginad.exe
260⤵
- Drops file in System32 directory
PID:8136

C:\Windows\SysWOW64\Nicokkbf.exe
C:\Windows\system32\Nicokkbf.exe
261⤵
- Drops file in System32 directory
PID:8172

C:\Windows\SysWOW64\Nlakgfaj.exe
C:\Windows\system32\Nlakgfaj.exe
262⤵
PID:7204

C:\Windows\SysWOW64\Nopgcbpn.exe
C:\Windows\system32\Nopgcbpn.exe
263⤵
PID:7276

C:\Windows\SysWOW64\Oejpplhk.exe
C:\Windows\system32\Oejpplhk.exe
264⤵
PID:7348

C:\Windows\SysWOW64\Ohhllhgo.exe
C:\Windows\system32\Ohhllhgo.exe
265⤵
- Drops file in System32 directory
PID:7416

C:\Windows\SysWOW64\Okghhcfb.exe
C:\Windows\system32\Okghhcfb.exe
266⤵
PID:7464

C:\Windows\SysWOW64\Obnpiqfd.exe
C:\Windows\system32\Obnpiqfd.exe
267⤵
- Drops file in System32 directory
PID:1752

C:\Windows\SysWOW64\Oelmeleh.exe
C:\Windows\system32\Oelmeleh.exe
268⤵
- System Location Discovery: System Language Discovery
PID:7584

C:\Windows\SysWOW64\Olfebf32.exe
C:\Windows\system32\Olfebf32.exe
269⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7632

C:\Windows\SysWOW64\Oodana32.exe
C:\Windows\system32\Oodana32.exe
270⤵
- System Location Discovery: System Language Discovery
PID:7708

C:\Windows\SysWOW64\Oacmjm32.exe
C:\Windows\system32\Oacmjm32.exe
271⤵
- Drops file in System32 directory
PID:7768

C:\Windows\SysWOW64\Oijekjlo.exe
C:\Windows\system32\Oijekjlo.exe
272⤵
PID:7840

C:\Windows\SysWOW64\Okkacb32.exe
C:\Windows\system32\Okkacb32.exe
273⤵
PID:7912

C:\Windows\SysWOW64\Oeafpk32.exe
C:\Windows\system32\Oeafpk32.exe
274⤵
- Drops file in System32 directory
PID:7980

C:\Windows\SysWOW64\Oilbajjl.exe
C:\Windows\system32\Oilbajjl.exe
275⤵
PID:8036

C:\Windows\SysWOW64\Ooijiqhc.exe
C:\Windows\system32\Ooijiqhc.exe
276⤵
PID:1072

C:\Windows\SysWOW64\Oecbfk32.exe
C:\Windows\system32\Oecbfk32.exe
277⤵
PID:8156

C:\Windows\SysWOW64\Olmkbe32.exe
C:\Windows\system32\Olmkbe32.exe
278⤵
PID:7196

C:\Windows\SysWOW64\Pbgcoonj.exe
C:\Windows\system32\Pbgcoonj.exe
279⤵
PID:7312

C:\Windows\SysWOW64\Pajckl32.exe
C:\Windows\system32\Pajckl32.exe
280⤵
PID:7388

C:\Windows\SysWOW64\Piakli32.exe
C:\Windows\system32\Piakli32.exe
281⤵
PID:7492

C:\Windows\SysWOW64\Ponddp32.exe
C:\Windows\system32\Ponddp32.exe
282⤵
PID:7328

C:\Windows\SysWOW64\Pcipeolg.exe
C:\Windows\system32\Pcipeolg.exe
283⤵
- Modifies registry class
PID:7692

C:\Windows\SysWOW64\Phfhmeko.exe
C:\Windows\system32\Phfhmeko.exe
284⤵
PID:7812

C:\Windows\SysWOW64\Pkedia32.exe
C:\Windows\system32\Pkedia32.exe
285⤵
- Drops file in System32 directory
PID:7896

C:\Windows\SysWOW64\Pclmjn32.exe
C:\Windows\system32\Pclmjn32.exe
286⤵
PID:7992

C:\Windows\SysWOW64\Pejifj32.exe
C:\Windows\system32\Pejifj32.exe
287⤵
PID:8080

C:\Windows\SysWOW64\Phiebe32.exe
C:\Windows\system32\Phiebe32.exe
288⤵
PID:7172

C:\Windows\SysWOW64\Pkgaoq32.exe
C:\Windows\system32\Pkgaoq32.exe
289⤵
PID:7332

C:\Windows\SysWOW64\Paaikkol.exe
C:\Windows\system32\Paaikkol.exe
290⤵
PID:7444

C:\Windows\SysWOW64\Pihamhpo.exe
C:\Windows\system32\Pihamhpo.exe
291⤵
PID:7560

C:\Windows\SysWOW64\Pkindqem.exe
C:\Windows\system32\Pkindqem.exe
292⤵
- Drops file in System32 directory
PID:7736

C:\Windows\SysWOW64\Pacfaj32.exe
C:\Windows\system32\Pacfaj32.exe
293⤵
PID:7884

C:\Windows\SysWOW64\Pijnbh32.exe
C:\Windows\system32\Pijnbh32.exe
294⤵
PID:1520

C:\Windows\SysWOW64\Qklkjpcj.exe
C:\Windows\system32\Qklkjpcj.exe
295⤵
- System Location Discovery: System Language Discovery
PID:2208

C:\Windows\SysWOW64\Qoggjo32.exe
C:\Windows\system32\Qoggjo32.exe
296⤵
PID:8160

C:\Windows\SysWOW64\Qeaogicp.exe
C:\Windows\system32\Qeaogicp.exe
297⤵
PID:7396

C:\Windows\SysWOW64\Qhpkcdbd.exe
C:\Windows\system32\Qhpkcdbd.exe
298⤵
PID:7620

C:\Windows\SysWOW64\Qojcpnjq.exe
C:\Windows\system32\Qojcpnjq.exe
299⤵
PID:7828

C:\Windows\SysWOW64\Qahpljid.exe
C:\Windows\system32\Qahpljid.exe
300⤵
PID:3492

C:\Windows\SysWOW64\Qjohmgjf.exe
C:\Windows\system32\Qjohmgjf.exe
301⤵
PID:8184

C:\Windows\SysWOW64\Akqdeo32.exe
C:\Windows\system32\Akqdeo32.exe
302⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4376

C:\Windows\SysWOW64\Acglfm32.exe
C:\Windows\system32\Acglfm32.exe
303⤵
PID:7824

C:\Windows\SysWOW64\Ajadcghd.exe
C:\Windows\system32\Ajadcghd.exe
304⤵
- System Location Discovery: System Language Discovery
PID:8152

C:\Windows\SysWOW64\Akcajo32.exe
C:\Windows\system32\Akcajo32.exe
305⤵
PID:7688

C:\Windows\SysWOW64\Acjillnd.exe
C:\Windows\system32\Acjillnd.exe
306⤵
PID:8116

C:\Windows\SysWOW64\Afhehhmh.exe
C:\Windows\system32\Afhehhmh.exe
307⤵
PID:4648

C:\Windows\SysWOW64\Ahgadcll.exe
C:\Windows\system32\Ahgadcll.exe
308⤵
PID:7532

C:\Windows\SysWOW64\Akenpokp.exe
C:\Windows\system32\Akenpokp.exe
309⤵
PID:8236

C:\Windows\SysWOW64\Aaofmi32.exe
C:\Windows\system32\Aaofmi32.exe
310⤵
- System Location Discovery: System Language Discovery
PID:8284

C:\Windows\SysWOW64\Ajfnnf32.exe
C:\Windows\system32\Ajfnnf32.exe
311⤵
- Modifies registry class
PID:8324

C:\Windows\SysWOW64\Aldjja32.exe
C:\Windows\system32\Aldjja32.exe
312⤵
PID:8372

C:\Windows\SysWOW64\Acobgljo.exe
C:\Windows\system32\Acobgljo.exe
313⤵
- Modifies registry class
PID:8416

C:\Windows\SysWOW64\Ajhjcfal.exe
C:\Windows\system32\Ajhjcfal.exe
314⤵
PID:8460

C:\Windows\SysWOW64\Alggpaqp.exe
C:\Windows\system32\Alggpaqp.exe
315⤵
PID:8500

C:\Windows\SysWOW64\Acaolk32.exe
C:\Windows\system32\Acaolk32.exe
316⤵
PID:8552

C:\Windows\SysWOW64\Afokhg32.exe
C:\Windows\system32\Afokhg32.exe
317⤵
- Drops file in System32 directory
PID:8592

C:\Windows\SysWOW64\Ajkgiepi.exe
C:\Windows\system32\Ajkgiepi.exe
318⤵
PID:8632

C:\Windows\SysWOW64\Bklcqn32.exe
C:\Windows\system32\Bklcqn32.exe
319⤵
PID:8676

C:\Windows\SysWOW64\Bbflmhmd.exe
C:\Windows\system32\Bbflmhmd.exe
320⤵
- Drops file in System32 directory
PID:8720

C:\Windows\SysWOW64\Bjmdoe32.exe
C:\Windows\system32\Bjmdoe32.exe
321⤵
PID:8764

C:\Windows\SysWOW64\Bllpkq32.exe
C:\Windows\system32\Bllpkq32.exe
322⤵
- Drops file in System32 directory
PID:8808

C:\Windows\SysWOW64\Bkopfmce.exe
C:\Windows\system32\Bkopfmce.exe
323⤵
PID:8848

C:\Windows\SysWOW64\Bbhhcg32.exe
C:\Windows\system32\Bbhhcg32.exe
324⤵
PID:8892

C:\Windows\SysWOW64\Bhbapabo.exe
C:\Windows\system32\Bhbapabo.exe
325⤵
PID:8932

C:\Windows\SysWOW64\Bkamlmab.exe
C:\Windows\system32\Bkamlmab.exe
326⤵
PID:8980

C:\Windows\SysWOW64\Bbkehg32.exe
C:\Windows\system32\Bbkehg32.exe
327⤵
PID:9020

C:\Windows\SysWOW64\Bjbmjdia.exe
C:\Windows\system32\Bjbmjdia.exe
328⤵
PID:9056

C:\Windows\SysWOW64\Bkcjam32.exe
C:\Windows\system32\Bkcjam32.exe
329⤵
- Modifies registry class
PID:9100

C:\Windows\SysWOW64\Bcjbbj32.exe
C:\Windows\system32\Bcjbbj32.exe
330⤵
PID:9140

C:\Windows\SysWOW64\Bjdjodgo.exe
C:\Windows\system32\Bjdjodgo.exe
331⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:9184

C:\Windows\SysWOW64\Bmbfkpfb.exe
C:\Windows\system32\Bmbfkpfb.exe
332⤵
- System Location Discovery: System Language Discovery
PID:7852

C:\Windows\SysWOW64\Boabgkef.exe
C:\Windows\system32\Boabgkef.exe
333⤵
- Drops file in System32 directory
PID:8260

C:\Windows\SysWOW64\Bfkkde32.exe
C:\Windows\system32\Bfkkde32.exe
334⤵
PID:8316

C:\Windows\SysWOW64\Ciigpq32.exe
C:\Windows\system32\Ciigpq32.exe
335⤵
PID:8392

C:\Windows\SysWOW64\Ccoknill.exe
C:\Windows\system32\Ccoknill.exe
336⤵
PID:8456

C:\Windows\SysWOW64\Cbbkif32.exe
C:\Windows\system32\Cbbkif32.exe
337⤵
PID:8532

C:\Windows\SysWOW64\Cilcfpjd.exe
C:\Windows\system32\Cilcfpjd.exe
338⤵
- Drops file in System32 directory
PID:8600

C:\Windows\SysWOW64\Cmgpfo32.exe
C:\Windows\system32\Cmgpfo32.exe
339⤵
- Modifies registry class
PID:8668

C:\Windows\SysWOW64\Ccahcijj.exe
C:\Windows\system32\Ccahcijj.exe
340⤵
PID:8740

C:\Windows\SysWOW64\Cjkppc32.exe
C:\Windows\system32\Cjkppc32.exe
341⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8816

C:\Windows\SysWOW64\Ckmmgk32.exe
C:\Windows\system32\Ckmmgk32.exe
342⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8880

C:\Windows\SysWOW64\Cccdii32.exe
C:\Windows\system32\Cccdii32.exe
343⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:8944

C:\Windows\SysWOW64\Cfbaed32.exe
C:\Windows\system32\Cfbaed32.exe
344⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:9012

C:\Windows\SysWOW64\Cmlianng.exe
C:\Windows\system32\Cmlianng.exe
345⤵
PID:9092

C:\Windows\SysWOW64\Ccfanh32.exe
C:\Windows\system32\Ccfanh32.exe
346⤵
PID:9164

C:\Windows\SysWOW64\Cfdnjd32.exe
C:\Windows\system32\Cfdnjd32.exe
347⤵
- Drops file in System32 directory
PID:7744

C:\Windows\SysWOW64\Cicjfo32.exe
C:\Windows\system32\Cicjfo32.exe
348⤵
PID:8300

C:\Windows\SysWOW64\Ckafbk32.exe
C:\Windows\system32\Ckafbk32.exe
349⤵
- Modifies registry class
PID:8364

C:\Windows\SysWOW64\Cbknoe32.exe
C:\Windows\system32\Cbknoe32.exe
350⤵
PID:8440

C:\Windows\SysWOW64\Djbfqb32.exe
C:\Windows\system32\Djbfqb32.exe
351⤵
- Drops file in System32 directory
PID:8620

C:\Windows\SysWOW64\Dmqbmn32.exe
C:\Windows\system32\Dmqbmn32.exe
352⤵
- Modifies registry class
PID:8712

C:\Windows\SysWOW64\Doooii32.exe
C:\Windows\system32\Doooii32.exe
353⤵
- Drops file in System32 directory
- Modifies registry class
PID:8840

C:\Windows\SysWOW64\Dfigecac.exe
C:\Windows\system32\Dfigecac.exe
354⤵
- Modifies registry class
PID:8940

C:\Windows\SysWOW64\Digcaopf.exe
C:\Windows\system32\Digcaopf.exe
355⤵
PID:9068

C:\Windows\SysWOW64\Dkfpnjoj.exe
C:\Windows\system32\Dkfpnjoj.exe
356⤵
PID:9148

C:\Windows\SysWOW64\Dcmgog32.exe
C:\Windows\system32\Dcmgog32.exe
357⤵
PID:8272

C:\Windows\SysWOW64\Dijpgn32.exe
C:\Windows\system32\Dijpgn32.exe
358⤵
PID:8428

C:\Windows\SysWOW64\Dkhlcj32.exe
C:\Windows\system32\Dkhlcj32.exe
359⤵
PID:8640

C:\Windows\SysWOW64\Dcoddg32.exe
C:\Windows\system32\Dcoddg32.exe
360⤵
PID:8772

C:\Windows\SysWOW64\Dfnpqb32.exe
C:\Windows\system32\Dfnpqb32.exe
361⤵
PID:8976

C:\Windows\SysWOW64\Dmhimmdj.exe
C:\Windows\system32\Dmhimmdj.exe
362⤵
PID:9132

C:\Windows\SysWOW64\Dcaajg32.exe
C:\Windows\system32\Dcaajg32.exe
363⤵
PID:8232

C:\Windows\SysWOW64\Dfpmfbkk.exe
C:\Windows\system32\Dfpmfbkk.exe
364⤵
- System Location Discovery: System Language Discovery
PID:8584

C:\Windows\SysWOW64\Dmjecl32.exe
C:\Windows\system32\Dmjecl32.exe
365⤵
PID:8908

C:\Windows\SysWOW64\Dphaoh32.exe
C:\Windows\system32\Dphaoh32.exe
366⤵
PID:9124

C:\Windows\SysWOW64\Efbjlbih.exe
C:\Windows\system32\Efbjlbih.exe
367⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:8448

C:\Windows\SysWOW64\Eiafhmhl.exe
C:\Windows\system32\Eiafhmhl.exe
368⤵
PID:8784

C:\Windows\SysWOW64\Epkndg32.exe
C:\Windows\system32\Epkndg32.exe
369⤵
- System Location Discovery: System Language Discovery
PID:8248

C:\Windows\SysWOW64\Ecfjefgb.exe
C:\Windows\system32\Ecfjefgb.exe
370⤵
PID:8916

C:\Windows\SysWOW64\Eiccmm32.exe
C:\Windows\system32\Eiccmm32.exe
371⤵
PID:8704

C:\Windows\SysWOW64\Elaoih32.exe
C:\Windows\system32\Elaoih32.exe
372⤵
PID:8760

C:\Windows\SysWOW64\Eblgfblj.exe
C:\Windows\system32\Eblgfblj.exe
373⤵
PID:8508

C:\Windows\SysWOW64\Efgcga32.exe
C:\Windows\system32\Efgcga32.exe
374⤵
PID:9248

C:\Windows\SysWOW64\Emakcklp.exe
C:\Windows\system32\Emakcklp.exe
375⤵
- System Location Discovery: System Language Discovery
PID:9296

C:\Windows\SysWOW64\Eckcpe32.exe
C:\Windows\system32\Eckcpe32.exe
376⤵
- Modifies registry class
PID:9340

C:\Windows\SysWOW64\Ejelmp32.exe
C:\Windows\system32\Ejelmp32.exe
377⤵
PID:9384

C:\Windows\SysWOW64\Emchik32.exe
C:\Windows\system32\Emchik32.exe
378⤵
PID:9428

C:\Windows\SysWOW64\Elfhdhag.exe
C:\Windows\system32\Elfhdhag.exe
379⤵
PID:9468

C:\Windows\SysWOW64\Ecmpfeaj.exe
C:\Windows\system32\Ecmpfeaj.exe
380⤵
PID:9512

C:\Windows\SysWOW64\Ejgibo32.exe
C:\Windows\system32\Ejgibo32.exe
381⤵
PID:9556

C:\Windows\SysWOW64\Emfeok32.exe
C:\Windows\system32\Emfeok32.exe
382⤵
- System Location Discovery: System Language Discovery
PID:9600

C:\Windows\SysWOW64\Epdakf32.exe
C:\Windows\system32\Epdakf32.exe
383⤵
PID:9636

C:\Windows\SysWOW64\Fbbmga32.exe
C:\Windows\system32\Fbbmga32.exe
384⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:9680

C:\Windows\SysWOW64\Fjjeho32.exe
C:\Windows\system32\Fjjeho32.exe
385⤵
PID:9732

C:\Windows\SysWOW64\Fpfnpfek.exe
C:\Windows\system32\Fpfnpfek.exe
386⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:9776

C:\Windows\SysWOW64\Fbejlado.exe
C:\Windows\system32\Fbejlado.exe
387⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:9812

C:\Windows\SysWOW64\Fjlbnoea.exe
C:\Windows\system32\Fjlbnoea.exe
388⤵
PID:9860

C:\Windows\SysWOW64\Fmjnjjde.exe
C:\Windows\system32\Fmjnjjde.exe
389⤵
PID:9900

C:\Windows\SysWOW64\Fddffd32.exe
C:\Windows\system32\Fddffd32.exe
390⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:9944

C:\Windows\SysWOW64\Ffccbp32.exe
C:\Windows\system32\Ffccbp32.exe
391⤵
PID:9976

C:\Windows\SysWOW64\Fmmkoj32.exe
C:\Windows\system32\Fmmkoj32.exe
392⤵
PID:10024

C:\Windows\SysWOW64\Fpkgke32.exe
C:\Windows\system32\Fpkgke32.exe
393⤵
PID:10068

C:\Windows\SysWOW64\Fbjcgq32.exe
C:\Windows\system32\Fbjcgq32.exe
394⤵
PID:10104

C:\Windows\SysWOW64\Fjakin32.exe
C:\Windows\system32\Fjakin32.exe
395⤵
PID:10148

C:\Windows\SysWOW64\Fmohei32.exe
C:\Windows\system32\Fmohei32.exe
396⤵
PID:10188

C:\Windows\SysWOW64\Fpndae32.exe
C:\Windows\system32\Fpndae32.exe
397⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8360

C:\Windows\SysWOW64\Fjchnn32.exe
C:\Windows\system32\Fjchnn32.exe
398⤵
PID:9272

C:\Windows\SysWOW64\Fifhjjed.exe
C:\Windows\system32\Fifhjjed.exe
399⤵
PID:9324

C:\Windows\SysWOW64\Fppqfdmq.exe
C:\Windows\system32\Fppqfdmq.exe
400⤵
PID:9424

C:\Windows\SysWOW64\Gbnmbpld.exe
C:\Windows\system32\Gbnmbpld.exe
401⤵
- Drops file in System32 directory
PID:9504

C:\Windows\SysWOW64\Gjeedmmf.exe
C:\Windows\system32\Gjeedmmf.exe
402⤵
PID:9572

C:\Windows\SysWOW64\Glgake32.exe
C:\Windows\system32\Glgake32.exe
403⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:9644

C:\Windows\SysWOW64\Gdnimc32.exe
C:\Windows\system32\Gdnimc32.exe
404⤵
PID:9728

C:\Windows\SysWOW64\Gflein32.exe
C:\Windows\system32\Gflein32.exe
405⤵
- Drops file in System32 directory
PID:9772

C:\Windows\SysWOW64\Gikbej32.exe
C:\Windows\system32\Gikbej32.exe
406⤵
- Drops file in System32 directory
PID:9848

C:\Windows\SysWOW64\Gbcfno32.exe
C:\Windows\system32\Gbcfno32.exe
407⤵
- System Location Discovery: System Language Discovery
PID:9912

C:\Windows\SysWOW64\Gfobnnph.exe
C:\Windows\system32\Gfobnnph.exe
408⤵
PID:9972

C:\Windows\SysWOW64\Gmhjkh32.exe
C:\Windows\system32\Gmhjkh32.exe
409⤵
PID:10056

C:\Windows\SysWOW64\Gpgggc32.exe
C:\Windows\system32\Gpgggc32.exe
410⤵
PID:10100

C:\Windows\SysWOW64\Giokpimi.exe
C:\Windows\system32\Giokpimi.exe
411⤵
- Drops file in System32 directory
PID:10200

C:\Windows\SysWOW64\Gpicmc32.exe
C:\Windows\system32\Gpicmc32.exe
412⤵
PID:9236

C:\Windows\SysWOW64\Gbhpiodj.exe
C:\Windows\system32\Gbhpiodj.exe
413⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:9348

C:\Windows\SysWOW64\Gkohjldl.exe
C:\Windows\system32\Gkohjldl.exe
414⤵
PID:9420

C:\Windows\SysWOW64\Glpdad32.exe
C:\Windows\system32\Glpdad32.exe
415⤵
- System Location Discovery: System Language Discovery
PID:9260

C:\Windows\SysWOW64\Hdglca32.exe
C:\Windows\system32\Hdglca32.exe
416⤵
PID:9588

C:\Windows\SysWOW64\Hgehom32.exe
C:\Windows\system32\Hgehom32.exe
417⤵
PID:9676

C:\Windows\SysWOW64\Hmpqlgam.exe
C:\Windows\system32\Hmpqlgam.exe
418⤵
- Drops file in System32 directory
PID:9768

C:\Windows\SysWOW64\Hpnmhbaq.exe
C:\Windows\system32\Hpnmhbaq.exe
419⤵
PID:9868

C:\Windows\SysWOW64\Hclidnpd.exe
C:\Windows\system32\Hclidnpd.exe
420⤵
PID:9952

C:\Windows\SysWOW64\Hifaqhga.exe
C:\Windows\system32\Hifaqhga.exe
421⤵
PID:10064

C:\Windows\SysWOW64\Hlenmcfe.exe
C:\Windows\system32\Hlenmcfe.exe
422⤵
PID:10144

C:\Windows\SysWOW64\Hdlenagg.exe
C:\Windows\system32\Hdlenagg.exe
423⤵
PID:9240

C:\Windows\SysWOW64\Hgjbjlfk.exe
C:\Windows\system32\Hgjbjlfk.exe
424⤵
PID:9396

C:\Windows\SysWOW64\Hmdjgf32.exe
C:\Windows\system32\Hmdjgf32.exe
425⤵
PID:9552

C:\Windows\SysWOW64\Hlgjbcdb.exe
C:\Windows\system32\Hlgjbcdb.exe
426⤵
PID:9660

C:\Windows\SysWOW64\Hcabom32.exe
C:\Windows\system32\Hcabom32.exe
427⤵
PID:9820

C:\Windows\SysWOW64\Hikklg32.exe
C:\Windows\system32\Hikklg32.exe
428⤵
- Modifies registry class
PID:10008

C:\Windows\SysWOW64\Hmfglfle.exe
C:\Windows\system32\Hmfglfle.exe
429⤵
PID:10216

C:\Windows\SysWOW64\Hdqoip32.exe
C:\Windows\system32\Hdqoip32.exe
430⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:9480

C:\Windows\SysWOW64\Hgokel32.exe
C:\Windows\system32\Hgokel32.exe
431⤵
PID:9744

C:\Windows\SysWOW64\Himgag32.exe
C:\Windows\system32\Himgag32.exe
432⤵
PID:10048

C:\Windows\SysWOW64\Ipgpnaif.exe
C:\Windows\system32\Ipgpnaif.exe
433⤵
PID:9288

C:\Windows\SysWOW64\Icfljmhj.exe
C:\Windows\system32\Icfljmhj.exe
434⤵
- Modifies registry class
PID:9936

C:\Windows\SysWOW64\Ikmdkjhl.exe
C:\Windows\system32\Ikmdkjhl.exe
435⤵
PID:10000

C:\Windows\SysWOW64\Inkpge32.exe
C:\Windows\system32\Inkpge32.exe
436⤵
- Modifies registry class
PID:9488

C:\Windows\SysWOW64\Ipjlca32.exe
C:\Windows\system32\Ipjlca32.exe
437⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:10252

C:\Windows\SysWOW64\Igcdpknp.exe
C:\Windows\system32\Igcdpknp.exe
438⤵
- Drops file in System32 directory
PID:10288

C:\Windows\SysWOW64\Iibalfmd.exe
C:\Windows\system32\Iibalfmd.exe
439⤵
PID:10324

C:\Windows\SysWOW64\Ilqmhblg.exe
C:\Windows\system32\Ilqmhblg.exe
440⤵
PID:10360

C:\Windows\SysWOW64\Icjeel32.exe
C:\Windows\system32\Icjeel32.exe
441⤵
PID:10396

C:\Windows\SysWOW64\Ikamfi32.exe
C:\Windows\system32\Ikamfi32.exe
442⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:10436

C:\Windows\SysWOW64\Inpjbecj.exe
C:\Windows\system32\Inpjbecj.exe
443⤵
PID:10472

C:\Windows\SysWOW64\Idjboo32.exe
C:\Windows\system32\Idjboo32.exe
444⤵
PID:10508

C:\Windows\SysWOW64\Ighnkj32.exe
C:\Windows\system32\Ighnkj32.exe
445⤵
- Drops file in System32 directory
PID:10544

C:\Windows\SysWOW64\Ijgjgf32.exe
C:\Windows\system32\Ijgjgf32.exe
446⤵
- Drops file in System32 directory
PID:10580

C:\Windows\SysWOW64\Ipqbdpqk.exe
C:\Windows\system32\Ipqbdpqk.exe
447⤵
PID:10616

C:\Windows\SysWOW64\Idloeo32.exe
C:\Windows\system32\Idloeo32.exe
448⤵
- System Location Discovery: System Language Discovery
PID:10652

C:\Windows\SysWOW64\Ikfgaipa.exe
C:\Windows\system32\Ikfgaipa.exe
449⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:10688

C:\Windows\SysWOW64\Indcndoe.exe
C:\Windows\system32\Indcndoe.exe
450⤵
PID:10724

C:\Windows\SysWOW64\Jlgcia32.exe
C:\Windows\system32\Jlgcia32.exe
451⤵
- Modifies registry class
PID:10760

C:\Windows\SysWOW64\Jcakfk32.exe
C:\Windows\system32\Jcakfk32.exe
452⤵
PID:10796

C:\Windows\SysWOW64\Jkicgh32.exe
C:\Windows\system32\Jkicgh32.exe
453⤵
PID:10832

C:\Windows\SysWOW64\Jljpoqdm.exe
C:\Windows\system32\Jljpoqdm.exe
454⤵
PID:10868

C:\Windows\SysWOW64\Jdahpneo.exe
C:\Windows\system32\Jdahpneo.exe
455⤵
- Modifies registry class
PID:10904

C:\Windows\SysWOW64\Jgodlidc.exe
C:\Windows\system32\Jgodlidc.exe
456⤵
PID:10940

C:\Windows\SysWOW64\Jnilic32.exe
C:\Windows\system32\Jnilic32.exe
457⤵
PID:10976

C:\Windows\SysWOW64\Jphieo32.exe
C:\Windows\system32\Jphieo32.exe
458⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11012

C:\Windows\SysWOW64\Jcfeajig.exe
C:\Windows\system32\Jcfeajig.exe
459⤵
- System Location Discovery: System Language Discovery
PID:11048

C:\Windows\SysWOW64\Jjpmnd32.exe
C:\Windows\system32\Jjpmnd32.exe
460⤵
PID:11084

C:\Windows\SysWOW64\Jloijp32.exe
C:\Windows\system32\Jloijp32.exe
461⤵
PID:11120

C:\Windows\SysWOW64\Jdfakm32.exe
C:\Windows\system32\Jdfakm32.exe
462⤵
- Modifies registry class
PID:11160

C:\Windows\SysWOW64\Jgdngi32.exe
C:\Windows\system32\Jgdngi32.exe
463⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11196

C:\Windows\SysWOW64\Jjbjcd32.exe
C:\Windows\system32\Jjbjcd32.exe
464⤵
PID:11232

C:\Windows\SysWOW64\Jlafop32.exe
C:\Windows\system32\Jlafop32.exe
465⤵
PID:9392

C:\Windows\SysWOW64\Jcknlj32.exe
C:\Windows\system32\Jcknlj32.exe
466⤵
PID:10308

C:\Windows\SysWOW64\Jkbfmg32.exe
C:\Windows\system32\Jkbfmg32.exe
467⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:10344

C:\Windows\SysWOW64\Knpbib32.exe
C:\Windows\system32\Knpbib32.exe
468⤵
PID:10444

C:\Windows\SysWOW64\Kmcceolb.exe
C:\Windows\system32\Kmcceolb.exe
469⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:10492

C:\Windows\SysWOW64\Kgigbhlh.exe
C:\Windows\system32\Kgigbhlh.exe
470⤵
- Modifies registry class
PID:10568

C:\Windows\SysWOW64\Kjgcnckl.exe
C:\Windows\system32\Kjgcnckl.exe
471⤵
PID:10648

C:\Windows\SysWOW64\Kmepjojp.exe
C:\Windows\system32\Kmepjojp.exe
472⤵
- Drops file in System32 directory
PID:10696

C:\Windows\SysWOW64\Kcphgi32.exe
C:\Windows\system32\Kcphgi32.exe
473⤵
- Drops file in System32 directory
PID:10756

C:\Windows\SysWOW64\Kkgphfbo.exe
C:\Windows\system32\Kkgphfbo.exe
474⤵
PID:10824

C:\Windows\SysWOW64\Kneldaab.exe
C:\Windows\system32\Kneldaab.exe
475⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:10892

C:\Windows\SysWOW64\Kqchqmpf.exe
C:\Windows\system32\Kqchqmpf.exe
476⤵
PID:10960

C:\Windows\SysWOW64\Kcbdmioj.exe
C:\Windows\system32\Kcbdmioj.exe
477⤵
PID:11032

C:\Windows\SysWOW64\Kkilnfpl.exe
C:\Windows\system32\Kkilnfpl.exe
478⤵
PID:11116

C:\Windows\SysWOW64\Kngijaop.exe
C:\Windows\system32\Kngijaop.exe
479⤵
- Drops file in System32 directory
PID:11180

C:\Windows\SysWOW64\Kdaagl32.exe
C:\Windows\system32\Kdaagl32.exe
480⤵
- System Location Discovery: System Language Discovery
PID:11240

C:\Windows\SysWOW64\Kgpmcg32.exe
C:\Windows\system32\Kgpmcg32.exe
481⤵
- System Location Discovery: System Language Discovery
PID:10312

C:\Windows\SysWOW64\Kjniobed.exe
C:\Windows\system32\Kjniobed.exe
482⤵
PID:10428

C:\Windows\SysWOW64\Kmmekndg.exe
C:\Windows\system32\Kmmekndg.exe
483⤵
- Modifies registry class
PID:10564

C:\Windows\SysWOW64\Kcfnhh32.exe
C:\Windows\system32\Kcfnhh32.exe
484⤵
PID:10604

C:\Windows\SysWOW64\Kknfie32.exe
C:\Windows\system32\Kknfie32.exe
485⤵
- System Location Discovery: System Language Discovery
PID:10792

C:\Windows\SysWOW64\Lmobqnbe.exe
C:\Windows\system32\Lmobqnbe.exe
486⤵
PID:10876

C:\Windows\SysWOW64\Ldfjbkbg.exe
C:\Windows\system32\Ldfjbkbg.exe
487⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:11004

C:\Windows\SysWOW64\Lcikmh32.exe
C:\Windows\system32\Lcikmh32.exe
488⤵
PID:11104

C:\Windows\SysWOW64\Ljccjaqo.exe
C:\Windows\system32\Ljccjaqo.exe
489⤵
PID:11216

C:\Windows\SysWOW64\Lmaofm32.exe
C:\Windows\system32\Lmaofm32.exe
490⤵
PID:10404

C:\Windows\SysWOW64\Lckgcggo.exe
C:\Windows\system32\Lckgcggo.exe
491⤵
- Drops file in System32 directory
PID:10624

C:\Windows\SysWOW64\Lkboddha.exe
C:\Windows\system32\Lkboddha.exe
492⤵
PID:1668

C:\Windows\SysWOW64\Lnqkppge.exe
C:\Windows\system32\Lnqkppge.exe
493⤵
- Modifies registry class
PID:10996

C:\Windows\SysWOW64\Lqohllfi.exe
C:\Windows\system32\Lqohllfi.exe
494⤵
PID:11224

C:\Windows\SysWOW64\Lgipie32.exe
C:\Windows\system32\Lgipie32.exe
495⤵
- System Location Discovery: System Language Discovery
PID:10468

C:\Windows\SysWOW64\Ljglea32.exe
C:\Windows\system32\Ljglea32.exe
496⤵
PID:10900

C:\Windows\SysWOW64\Lmfhamlm.exe
C:\Windows\system32\Lmfhamlm.exe
497⤵
PID:10368

C:\Windows\SysWOW64\Lcpqng32.exe
C:\Windows\system32\Lcpqng32.exe
498⤵
PID:10816

C:\Windows\SysWOW64\Lkgiod32.exe
C:\Windows\system32\Lkgiod32.exe
499⤵
PID:10748

C:\Windows\SysWOW64\Lneekp32.exe
C:\Windows\system32\Lneekp32.exe
500⤵
- Modifies registry class
PID:11272

C:\Windows\SysWOW64\Lqdagk32.exe
C:\Windows\system32\Lqdagk32.exe
501⤵
PID:11308

C:\Windows\SysWOW64\Lgnideip.exe
C:\Windows\system32\Lgnideip.exe
502⤵
PID:11344

C:\Windows\SysWOW64\Mjlepqid.exe
C:\Windows\system32\Mjlepqid.exe
503⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11380

C:\Windows\SysWOW64\Mmkbllhg.exe
C:\Windows\system32\Mmkbllhg.exe
504⤵
- Modifies registry class
PID:11416

C:\Windows\SysWOW64\Mebjni32.exe
C:\Windows\system32\Mebjni32.exe
505⤵
- Drops file in System32 directory
- Modifies registry class
PID:11452

C:\Windows\SysWOW64\Mklbjcpf.exe
C:\Windows\system32\Mklbjcpf.exe
506⤵
PID:11488

C:\Windows\SysWOW64\Mnjnfooj.exe
C:\Windows\system32\Mnjnfooj.exe
507⤵
PID:11524

C:\Windows\SysWOW64\Mahkbjnn.exe
C:\Windows\system32\Mahkbjnn.exe
508⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11560

C:\Windows\SysWOW64\Mgbcod32.exe
C:\Windows\system32\Mgbcod32.exe
509⤵
- System Location Discovery: System Language Discovery
PID:11596

C:\Windows\SysWOW64\Mjaokp32.exe
C:\Windows\system32\Mjaokp32.exe
510⤵
- Modifies registry class
PID:11632

C:\Windows\SysWOW64\Mmokgk32.exe
C:\Windows\system32\Mmokgk32.exe
511⤵
- System Location Discovery: System Language Discovery
PID:11668

C:\Windows\SysWOW64\Mefcihdd.exe
C:\Windows\system32\Mefcihdd.exe
512⤵
PID:11708

C:\Windows\SysWOW64\Mkqleb32.exe
C:\Windows\system32\Mkqleb32.exe
513⤵
PID:11744

C:\Windows\SysWOW64\Mnohan32.exe
C:\Windows\system32\Mnohan32.exe
514⤵
PID:11780

C:\Windows\SysWOW64\Mamdni32.exe
C:\Windows\system32\Mamdni32.exe
515⤵
PID:11816

C:\Windows\SysWOW64\Mclpje32.exe
C:\Windows\system32\Mclpje32.exe
516⤵
- Modifies registry class
PID:11852

C:\Windows\SysWOW64\Mkchkb32.exe
C:\Windows\system32\Mkchkb32.exe
517⤵
PID:11888

C:\Windows\SysWOW64\Mnadgn32.exe
C:\Windows\system32\Mnadgn32.exe
518⤵
- Modifies registry class
PID:11928

C:\Windows\SysWOW64\Mekmdhpo.exe
C:\Windows\system32\Mekmdhpo.exe
519⤵
- Drops file in System32 directory
PID:11964

C:\Windows\SysWOW64\Mgiipc32.exe
C:\Windows\system32\Mgiipc32.exe
520⤵
PID:12000

C:\Windows\SysWOW64\Njhelo32.exe
C:\Windows\system32\Njhelo32.exe
521⤵
PID:12036

C:\Windows\SysWOW64\Nabmiifc.exe
C:\Windows\system32\Nabmiifc.exe
522⤵
- Drops file in System32 directory
PID:12072

C:\Windows\SysWOW64\Ncpjedeg.exe
C:\Windows\system32\Ncpjedeg.exe
523⤵
PID:12108

C:\Windows\SysWOW64\Nlgafaei.exe
C:\Windows\system32\Nlgafaei.exe
524⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:12144

C:\Windows\SysWOW64\Nminnj32.exe
C:\Windows\system32\Nminnj32.exe
525⤵
PID:12180

C:\Windows\SysWOW64\Nepfog32.exe
C:\Windows\system32\Nepfog32.exe
526⤵
- System Location Discovery: System Language Discovery
PID:12228

C:\Windows\SysWOW64\Nhnbkbkm.exe
C:\Windows\system32\Nhnbkbkm.exe
527⤵
PID:12264

C:\Windows\SysWOW64\Nnhkhm32.exe
C:\Windows\system32\Nnhkhm32.exe
528⤵
PID:11068

C:\Windows\SysWOW64\Nafgdh32.exe
C:\Windows\system32\Nafgdh32.exe
529⤵
PID:11340

C:\Windows\SysWOW64\Nhqoqbik.exe
C:\Windows\system32\Nhqoqbik.exe
530⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:11400

C:\Windows\SysWOW64\Njokmnho.exe
C:\Windows\system32\Njokmnho.exe
531⤵
- System Location Discovery: System Language Discovery
PID:11460

C:\Windows\SysWOW64\Nnkgml32.exe
C:\Windows\system32\Nnkgml32.exe
532⤵
PID:11520

C:\Windows\SysWOW64\Nedpjfhd.exe
C:\Windows\system32\Nedpjfhd.exe
533⤵
PID:11588

C:\Windows\SysWOW64\Nlohgqpa.exe
C:\Windows\system32\Nlohgqpa.exe
534⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11656

C:\Windows\SysWOW64\Nnmdcloe.exe
C:\Windows\system32\Nnmdcloe.exe
535⤵
PID:11728

C:\Windows\SysWOW64\Neglpf32.exe
C:\Windows\system32\Neglpf32.exe
536⤵
- Drops file in System32 directory
PID:11788

C:\Windows\SysWOW64\Ndjlkcml.exe
C:\Windows\system32\Ndjlkcml.exe
537⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11848

C:\Windows\SysWOW64\Ojcehm32.exe
C:\Windows\system32\Ojcehm32.exe
538⤵
PID:11916

C:\Windows\SysWOW64\Ombadh32.exe
C:\Windows\system32\Ombadh32.exe
539⤵
PID:11996

C:\Windows\SysWOW64\Oeiief32.exe
C:\Windows\system32\Oeiief32.exe
540⤵
PID:12056

C:\Windows\SysWOW64\Olcabpkl.exe
C:\Windows\system32\Olcabpkl.exe
541⤵
PID:12116

C:\Windows\SysWOW64\Onamnk32.exe
C:\Windows\system32\Onamnk32.exe
542⤵
PID:12188

C:\Windows\SysWOW64\Oapjjg32.exe
C:\Windows\system32\Oapjjg32.exe
543⤵
- Drops file in System32 directory
- Modifies registry class
PID:12252

C:\Windows\SysWOW64\Odnffb32.exe
C:\Windows\system32\Odnffb32.exe
544⤵
PID:11328

C:\Windows\SysWOW64\Ohjbgaap.exe
C:\Windows\system32\Ohjbgaap.exe
545⤵
PID:11440

C:\Windows\SysWOW64\Oabfpf32.exe
C:\Windows\system32\Oabfpf32.exe
546⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11544

C:\Windows\SysWOW64\Odqblb32.exe
C:\Windows\system32\Odqblb32.exe
547⤵
PID:11696

C:\Windows\SysWOW64\Olhkmo32.exe
C:\Windows\system32\Olhkmo32.exe
548⤵
- Drops file in System32 directory
PID:11808

C:\Windows\SysWOW64\Omigdg32.exe
C:\Windows\system32\Omigdg32.exe
549⤵
PID:11700

C:\Windows\SysWOW64\Oepofe32.exe
C:\Windows\system32\Oepofe32.exe
550⤵
PID:12032

C:\Windows\SysWOW64\Odcoaaea.exe
C:\Windows\system32\Odcoaaea.exe
551⤵
PID:12168

C:\Windows\SysWOW64\Oljgboed.exe
C:\Windows\system32\Oljgboed.exe
552⤵
PID:12224

C:\Windows\SysWOW64\Oagpkfck.exe
C:\Windows\system32\Oagpkfck.exe
553⤵
PID:11436

C:\Windows\SysWOW64\Pdelgabo.exe
C:\Windows\system32\Pdelgabo.exe
554⤵
PID:11664

C:\Windows\SysWOW64\Plmdhoca.exe
C:\Windows\system32\Plmdhoca.exe
555⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11872

C:\Windows\SysWOW64\Pmnqpg32.exe
C:\Windows\system32\Pmnqpg32.exe
556⤵
- Modifies registry class
PID:12104

C:\Windows\SysWOW64\Peehadjb.exe
C:\Windows\system32\Peehadjb.exe
557⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:12236

C:\Windows\SysWOW64\Phcempie.exe
C:\Windows\system32\Phcempie.exe
558⤵
- Drops file in System32 directory
- Modifies registry class
PID:11316

C:\Windows\SysWOW64\Pommjj32.exe
C:\Windows\system32\Pommjj32.exe
559⤵
PID:12064

C:\Windows\SysWOW64\Palife32.exe
C:\Windows\system32\Palife32.exe
560⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:11496

C:\Windows\SysWOW64\Pheabogc.exe
C:\Windows\system32\Pheabogc.exe
561⤵
PID:12272

C:\Windows\SysWOW64\Pejblc32.exe
C:\Windows\system32\Pejblc32.exe
562⤵
PID:11040

C:\Windows\SysWOW64\Phhnho32.exe
C:\Windows\system32\Phhnho32.exe
563⤵
PID:11984

C:\Windows\SysWOW64\Pkfjdj32.exe
C:\Windows\system32\Pkfjdj32.exe
564⤵
PID:12324

C:\Windows\SysWOW64\Pmefqf32.exe
C:\Windows\system32\Pmefqf32.exe
565⤵
PID:12360

C:\Windows\SysWOW64\Pdoompkd.exe
C:\Windows\system32\Pdoompkd.exe
566⤵
PID:12400

C:\Windows\SysWOW64\Plfgnmkf.exe
C:\Windows\system32\Plfgnmkf.exe
567⤵
PID:12436

C:\Windows\SysWOW64\Pmgcfe32.exe
C:\Windows\system32\Pmgcfe32.exe
568⤵
PID:12472

C:\Windows\SysWOW64\Penkgc32.exe
C:\Windows\system32\Penkgc32.exe
569⤵
- System Location Discovery: System Language Discovery
PID:12508

C:\Windows\SysWOW64\Qhmgcnak.exe
C:\Windows\system32\Qhmgcnak.exe
570⤵
- Drops file in System32 directory
PID:12544

C:\Windows\SysWOW64\Qkkdojpo.exe
C:\Windows\system32\Qkkdojpo.exe
571⤵
PID:12580

C:\Windows\SysWOW64\Qaelld32.exe
C:\Windows\system32\Qaelld32.exe
572⤵
- System Location Discovery: System Language Discovery
PID:12616

C:\Windows\SysWOW64\Qdchho32.exe
C:\Windows\system32\Qdchho32.exe
573⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:12652

C:\Windows\SysWOW64\Qlkpim32.exe
C:\Windows\system32\Qlkpim32.exe
574⤵
PID:12688

C:\Windows\SysWOW64\Qoimeh32.exe
C:\Windows\system32\Qoimeh32.exe
575⤵
PID:12724

C:\Windows\SysWOW64\Aecebbnb.exe
C:\Windows\system32\Aecebbnb.exe
576⤵
PID:12764

C:\Windows\SysWOW64\Ahaann32.exe
C:\Windows\system32\Ahaann32.exe
577⤵
PID:12800

C:\Windows\SysWOW64\Aokikhdb.exe
C:\Windows\system32\Aokikhdb.exe
578⤵
PID:12836

C:\Windows\SysWOW64\Aajegccf.exe
C:\Windows\system32\Aajegccf.exe
579⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:12872

C:\Windows\SysWOW64\Adhacobj.exe
C:\Windows\system32\Adhacobj.exe
580⤵
PID:12912

C:\Windows\SysWOW64\Alojdlcl.exe
C:\Windows\system32\Alojdlcl.exe
581⤵
PID:12948

C:\Windows\SysWOW64\Anqfld32.exe
C:\Windows\system32\Anqfld32.exe
582⤵
PID:12984

C:\Windows\SysWOW64\Aehnma32.exe
C:\Windows\system32\Aehnma32.exe
583⤵
PID:13020

C:\Windows\SysWOW64\Alafjl32.exe
C:\Windows\system32\Alafjl32.exe
584⤵
PID:13056

C:\Windows\SysWOW64\Aopbfg32.exe
C:\Windows\system32\Aopbfg32.exe
585⤵
PID:13092

C:\Windows\SysWOW64\Aanobb32.exe
C:\Windows\system32\Aanobb32.exe
586⤵
PID:13128

C:\Windows\SysWOW64\Ahhgomgm.exe
C:\Windows\system32\Ahhgomgm.exe
587⤵
- Drops file in System32 directory
PID:13164

C:\Windows\SysWOW64\Akgckhfa.exe
C:\Windows\system32\Akgckhfa.exe
588⤵
PID:13200

C:\Windows\SysWOW64\Aobolg32.exe
C:\Windows\system32\Aobolg32.exe
589⤵
PID:13236

C:\Windows\SysWOW64\Anepgcee.exe
C:\Windows\system32\Anepgcee.exe
590⤵
PID:13272

C:\Windows\SysWOW64\Aaqlhb32.exe
C:\Windows\system32\Aaqlhb32.exe
591⤵
PID:13308

C:\Windows\SysWOW64\Alfpek32.exe
C:\Windows\system32\Alfpek32.exe
592⤵
PID:12356

C:\Windows\SysWOW64\Anglmc32.exe
C:\Windows\system32\Anglmc32.exe
593⤵
PID:12424

C:\Windows\SysWOW64\Beodnq32.exe
C:\Windows\system32\Beodnq32.exe
594⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:12496

C:\Windows\SysWOW64\Bhmqjl32.exe
C:\Windows\system32\Bhmqjl32.exe
595⤵
PID:12564

C:\Windows\SysWOW64\Bkkmfg32.exe
C:\Windows\system32\Bkkmfg32.exe
596⤵
PID:12624

C:\Windows\SysWOW64\Bnjibc32.exe
C:\Windows\system32\Bnjibc32.exe
597⤵
- Drops file in System32 directory
PID:12680

C:\Windows\SysWOW64\Beaacp32.exe
C:\Windows\system32\Beaacp32.exe
598⤵
- System Location Discovery: System Language Discovery
PID:12760

C:\Windows\SysWOW64\Bhompl32.exe
C:\Windows\system32\Bhompl32.exe
599⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:12820

C:\Windows\SysWOW64\Bknilg32.exe
C:\Windows\system32\Bknilg32.exe
600⤵
PID:12880

C:\Windows\SysWOW64\Bnlfhbom.exe
C:\Windows\system32\Bnlfhbom.exe
601⤵
PID:12944

C:\Windows\SysWOW64\Becnippo.exe
C:\Windows\system32\Becnippo.exe
602⤵
PID:13016

C:\Windows\SysWOW64\Bhbjekoc.exe
C:\Windows\system32\Bhbjekoc.exe
603⤵
PID:13080

C:\Windows\SysWOW64\Blmffj32.exe
C:\Windows\system32\Blmffj32.exe
604⤵
- Modifies registry class
PID:13148

C:\Windows\SysWOW64\Bolbbe32.exe
C:\Windows\system32\Bolbbe32.exe
605⤵
PID:13208

C:\Windows\SysWOW64\Bajnna32.exe
C:\Windows\system32\Bajnna32.exe
606⤵
- Modifies registry class
PID:13264

C:\Windows\SysWOW64\Bdhkjl32.exe
C:\Windows\system32\Bdhkjl32.exe
607⤵
PID:12348

C:\Windows\SysWOW64\Blpbkj32.exe
C:\Windows\system32\Blpbkj32.exe
608⤵
PID:12468

C:\Windows\SysWOW64\Bnaocbkg.exe
C:\Windows\system32\Bnaocbkg.exe
609⤵
PID:11624

C:\Windows\SysWOW64\Bfhgdo32.exe
C:\Windows\system32\Bfhgdo32.exe
610⤵
PID:12696

C:\Windows\SysWOW64\Bhfcpk32.exe
C:\Windows\system32\Bhfcpk32.exe
611⤵
- Drops file in System32 directory
PID:12784

C:\Windows\SysWOW64\Boqlmebj.exe
C:\Windows\system32\Boqlmebj.exe
612⤵
- Drops file in System32 directory
PID:12940

C:\Windows\SysWOW64\Cfjdjo32.exe
C:\Windows\system32\Cfjdjo32.exe
613⤵
- System Location Discovery: System Language Discovery
PID:13064

C:\Windows\SysWOW64\Chipfj32.exe
C:\Windows\system32\Chipfj32.exe
614⤵
PID:13192

C:\Windows\SysWOW64\Ckglbf32.exe
C:\Windows\system32\Ckglbf32.exe
615⤵
PID:12308

C:\Windows\SysWOW64\Cnehna32.exe
C:\Windows\system32\Cnehna32.exe
616⤵
PID:12492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 12492 -s 216
617⤵
- Program crash
PID:12936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 12492 -ip 12492
1⤵
PID:12796

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network