216cd5fc8daca1a433a71f7e5060cd2eab5ac866b57a64afb59c336aa3945cce

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

216cd5fc8daca1a433a71f7e5060cd2eab5ac866b57a64afb59c336aa3945cce.exe
Size

107KB
MD5

150aceba85167a8d99eca07c7614c02c
SHA1

4208f7a8a49d93df91e98e1e8a8408cba1273e5f
SHA256

216cd5fc8daca1a433a71f7e5060cd2eab5ac866b57a64afb59c336aa3945cce
SHA512

bb28f3e47aebc7aaeb7305a0953757b6410a8d4edb501d84fb07e4d6aa8923177456b2f37b30d20360e2ec605a7a0b3a3b24762ea4143035f04a14be19bc9430
SSDEEP

3072:4MMUwasOl1MAo+Q+5t01aMU7uihJ5233y:4pUSOfM9QO1ni5i3y

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Ohfcfb32.exeEdibhmml.exeOoabmbbe.exePebpkk32.exeIjibng32.exeJmipdo32.exeQododfek.exePepcelel.exeAhpifj32.exeGefmcp32.exeGkpfmnlb.exeOhiffh32.exeIjphofem.exeLlgljn32.exeBcpgdhpp.exeIhbcmaje.exePplaki32.exeCfehhn32.exeKhnapkjg.exePmpbdm32.exeClojhf32.exeGoiongbc.exeHnhgha32.exeLqipkhbj.exeMbchni32.exePilfpqaa.exeIpeaco32.exeIfjlcmmj.exeJolghndm.exeDebadpeg.exeJjkkbjln.exeJokqnhpa.exeNijpdfhm.exeCfoaho32.exeKkjpggkn.exeOhfqmi32.exeBbgqjdce.exeEipgjaoi.exeMopbgn32.exeLegaoehg.exeAdipfd32.exeDmkcil32.exeJeqopcld.exeLfbdci32.exeCmfmojcb.exeDnefhpma.exeIknafhjb.exeNjhfcp32.exeNmfbpk32.exeAhebaiac.exeGqlhkofn.exeInojhc32.exeQqfkln32.exeLjddjj32.exeMmgfqh32.exeIbfmmb32.exeOagoep32.exeLkgngb32.exeJpbcek32.exeJbclgf32.exeAgdmdg32.exeFgldnkkf.exeLfmbek32.exeInhdgdmk.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohfcfb32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edibhmml.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ooabmbbe.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pebpkk32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijibng32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmipdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qododfek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pepcelel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahpifj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gefmcp32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkpfmnlb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohiffh32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijphofem.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llgljn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcpgdhpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ihbcmaje.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pplaki32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfehhn32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khnapkjg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmpbdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clojhf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Goiongbc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnhgha32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqipkhbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbchni32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pilfpqaa.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipeaco32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifjlcmmj.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jolghndm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Debadpeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjkkbjln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jokqnhpa.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nijpdfhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfoaho32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkjpggkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohfqmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbgqjdce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eipgjaoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mopbgn32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Legaoehg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adipfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmkcil32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeqopcld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfbdci32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmfmojcb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnefhpma.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iknafhjb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njhfcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmfbpk32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahebaiac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gqlhkofn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inojhc32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqfkln32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljddjj32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmgfqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibfmmb32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oagoep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkgngb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpbcek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbclgf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agdmdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgldnkkf.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfmbek32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inhdgdmk.exe

Executes dropped EXE 64 IoCs

Processes:

Micklk32.exeMpmcielb.exeMfglep32.exeMejlalji.exeMfihkoal.exeMbpipp32.exeMgmahg32.exeMjkndb32.exeMnifja32.exeNmlgfnal.exeNnkcpq32.exeNfghdcfj.exeNmqpam32.exeNjdqka32.exeNbpeoc32.exeNlhjhi32.exeNeqnqofm.exeOagoep32.exeOkpcoe32.exeOajlkojn.exeOdhhgkib.exeOehdan32.exeOhfqmi32.exeOkdmjdol.exeOgknoe32.exePcbncfjd.exePilfpqaa.exePgpgjepk.exePnjofo32.exePpkhhjei.exePciddedl.exePegqpacp.exePhfmllbd.exePckajebj.exePhhjblpa.exeQododfek.exeQqfkln32.exeAnjlebjc.exeAbegfa32.exeAdcdbl32.exeAmohfo32.exeAdfqgl32.exeAgdmdg32.exeAjcipc32.exeAopahjll.exeAggiigmn.exeAihfap32.exeAmcbankf.exeAflfjc32.exeAkiobk32.exeBcpgdhpp.exeBeackp32.exeBofgii32.exeBecpap32.exeBgblmk32.exeBbgqjdce.exeBajqfq32.exeBgdibkam.exeBnnaoe32.exeBehilopf.exeBckjhl32.exeBkbaii32.exeBmcnqama.exeBejfao32.exe

pid	process
1996	Micklk32.exe
2348	Mpmcielb.exe
2744	Mfglep32.exe
3032	Mejlalji.exe
2760	Mfihkoal.exe
2736	Mbpipp32.exe
2644	Mgmahg32.exe
1988	Mjkndb32.exe
1476	Mnifja32.exe
2964	Nmlgfnal.exe
1352	Nnkcpq32.exe
1864	Nfghdcfj.exe
2212	Nmqpam32.exe
2404	Njdqka32.exe
2372	Nbpeoc32.exe
448	Nlhjhi32.exe
776	Neqnqofm.exe
1728	Oagoep32.exe
2472	Okpcoe32.exe
2452	Oajlkojn.exe
1404	Odhhgkib.exe
876	Oehdan32.exe
3064	Ohfqmi32.exe
2136	Okdmjdol.exe
1596	Ogknoe32.exe
2704	Pcbncfjd.exe
2884	Pilfpqaa.exe
2716	Pgpgjepk.exe
2712	Pnjofo32.exe
1976	Ppkhhjei.exe
2688	Pciddedl.exe
1808	Pegqpacp.exe
2840	Phfmllbd.exe
948	Pckajebj.exe
2240	Phhjblpa.exe
2444	Qododfek.exe
2112	Qqfkln32.exe
988	Anjlebjc.exe
1796	Abegfa32.exe
1156	Adcdbl32.exe
544	Amohfo32.exe
328	Adfqgl32.exe
1040	Agdmdg32.exe
584	Ajcipc32.exe
1912	Aopahjll.exe
1308	Aggiigmn.exe
1568	Aihfap32.exe
1812	Amcbankf.exe
2912	Aflfjc32.exe
2824	Akiobk32.exe
2956	Bcpgdhpp.exe
2764	Beackp32.exe
2632	Bofgii32.exe
1540	Becpap32.exe
2828	Bgblmk32.exe
2932	Bbgqjdce.exe
380	Bajqfq32.exe
3000	Bgdibkam.exe
1944	Bnnaoe32.exe
2140	Behilopf.exe
824	Bckjhl32.exe
916	Bkbaii32.exe
1684	Bmcnqama.exe
2044	Bejfao32.exe

Loads dropped DLL 64 IoCs

Processes:

216cd5fc8daca1a433a71f7e5060cd2eab5ac866b57a64afb59c336aa3945cce.exeMicklk32.exeMpmcielb.exeMfglep32.exeMejlalji.exeMfihkoal.exeMbpipp32.exeMgmahg32.exeMjkndb32.exeMnifja32.exeNmlgfnal.exeNnkcpq32.exeNfghdcfj.exeNmqpam32.exeNjdqka32.exeNbpeoc32.exeNlhjhi32.exeNeqnqofm.exeOagoep32.exeOkpcoe32.exeOajlkojn.exeOdhhgkib.exeOehdan32.exeOhfqmi32.exeOkdmjdol.exeOgknoe32.exePcbncfjd.exePilfpqaa.exePgpgjepk.exePnjofo32.exePpkhhjei.exePciddedl.exe

pid	process
1344	216cd5fc8daca1a433a71f7e5060cd2eab5ac866b57a64afb59c336aa3945cce.exe
1344	216cd5fc8daca1a433a71f7e5060cd2eab5ac866b57a64afb59c336aa3945cce.exe
1996	Micklk32.exe
1996	Micklk32.exe
2348	Mpmcielb.exe
2348	Mpmcielb.exe
2744	Mfglep32.exe
2744	Mfglep32.exe
3032	Mejlalji.exe
3032	Mejlalji.exe
2760	Mfihkoal.exe
2760	Mfihkoal.exe
2736	Mbpipp32.exe
2736	Mbpipp32.exe
2644	Mgmahg32.exe
2644	Mgmahg32.exe
1988	Mjkndb32.exe
1988	Mjkndb32.exe
1476	Mnifja32.exe
1476	Mnifja32.exe
2964	Nmlgfnal.exe
2964	Nmlgfnal.exe
1352	Nnkcpq32.exe
1352	Nnkcpq32.exe
1864	Nfghdcfj.exe
1864	Nfghdcfj.exe
2212	Nmqpam32.exe
2212	Nmqpam32.exe
2404	Njdqka32.exe
2404	Njdqka32.exe
2372	Nbpeoc32.exe
2372	Nbpeoc32.exe
448	Nlhjhi32.exe
448	Nlhjhi32.exe
776	Neqnqofm.exe
776	Neqnqofm.exe
1728	Oagoep32.exe
1728	Oagoep32.exe
2472	Okpcoe32.exe
2472	Okpcoe32.exe
2452	Oajlkojn.exe
2452	Oajlkojn.exe
1404	Odhhgkib.exe
1404	Odhhgkib.exe
876	Oehdan32.exe
876	Oehdan32.exe
3064	Ohfqmi32.exe
3064	Ohfqmi32.exe
2136	Okdmjdol.exe
2136	Okdmjdol.exe
1596	Ogknoe32.exe
1596	Ogknoe32.exe
2704	Pcbncfjd.exe
2704	Pcbncfjd.exe
2884	Pilfpqaa.exe
2884	Pilfpqaa.exe
2716	Pgpgjepk.exe
2716	Pgpgjepk.exe
2712	Pnjofo32.exe
2712	Pnjofo32.exe
1976	Ppkhhjei.exe
1976	Ppkhhjei.exe
2688	Pciddedl.exe
2688	Pciddedl.exe

Drops file in System32 directory 64 IoCs

Processes:

Jfofol32.exeDbiocd32.exeFepjea32.exeHiclkp32.exeLpqlemaj.exeNnmlcp32.exeNjfjnpgp.exePbagipfi.exePdjjag32.exeCjonncab.exeEibgpnjk.exeMjcjog32.exe216cd5fc8daca1a433a71f7e5060cd2eab5ac866b57a64afb59c336aa3945cce.exeMpgobc32.exeCfmhdpnc.exeCnmfdb32.exeNbpghl32.exeFhbpkh32.exeFplllkdc.exeKechdf32.exeJcciqi32.exeLoaokjjg.exeFgocmc32.exeOaghki32.exeNnnbni32.exeBkknac32.exeGqodqodl.exeEikfdl32.exeHqkmplen.exeIgqhpj32.exePckajebj.exeBckjhl32.exeFhdjgoha.exeLdpbpgoh.exeEkdchf32.exeBfabnl32.exeElgfkhpi.exeNmqpam32.exeCcbphk32.exeNlcibc32.exeEpeekmjk.exeHieiqo32.exeGiolnomh.exeLibjncnc.exeAlnalh32.exeBgllgedi.exeDcbnpgkh.exeIclbpj32.exePcbncfjd.exeCpkmcldj.exeOpnbbe32.exeAaejojjq.exeJmfafgbd.exeGckdgjeb.exeIfgicg32.exeNqhepeai.exeIfolhann.exeDjdgic32.exeImaapa32.exePopgboae.exeBolcma32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Hfdoodan.dll	Jfofol32.exe
File opened for modification	C:\Windows\SysWOW64\Eibgpnjk.exe	Dbiocd32.exe
File created	C:\Windows\SysWOW64\Ggagmjbq.exe	Fepjea32.exe
File opened for modification	C:\Windows\SysWOW64\Homdhjai.exe	Hiclkp32.exe
File created	C:\Windows\SysWOW64\Lcohahpn.exe	Lpqlemaj.exe
File created	C:\Windows\SysWOW64\Nbhhdnlh.exe	Nnmlcp32.exe
File created	C:\Windows\SysWOW64\Nnafnopi.exe	Njfjnpgp.exe
File opened for modification	C:\Windows\SysWOW64\Pepcelel.exe	Pbagipfi.exe
File opened for modification	C:\Windows\SysWOW64\Pghfnc32.exe	Pdjjag32.exe
File created	C:\Windows\SysWOW64\Cbffoabe.exe	Cjonncab.exe
File opened for modification	C:\Windows\SysWOW64\Eheglk32.exe	Eibgpnjk.exe
File created	C:\Windows\SysWOW64\Mhfjjdjf.exe	Mjcjog32.exe
File created	C:\Windows\SysWOW64\Micklk32.exe	216cd5fc8daca1a433a71f7e5060cd2eab5ac866b57a64afb59c336aa3945cce.exe
File created	C:\Windows\SysWOW64\Hifhgh32.dll	Mpgobc32.exe
File opened for modification	C:\Windows\SysWOW64\Cepipm32.exe	Cfmhdpnc.exe
File created	C:\Windows\SysWOW64\Ofaejacl.dll	Cnmfdb32.exe
File opened for modification	C:\Windows\SysWOW64\Nijpdfhm.exe	Nbpghl32.exe
File opened for modification	C:\Windows\SysWOW64\Flnlkgjq.exe	Fhbpkh32.exe
File opened for modification	C:\Windows\SysWOW64\Fgfdie32.exe	Fplllkdc.exe
File created	C:\Windows\SysWOW64\Khadpa32.exe	Kechdf32.exe
File created	C:\Windows\SysWOW64\Ckmhkeef.dll	Jcciqi32.exe
File created	C:\Windows\SysWOW64\Ogegmkqk.dll	Loaokjjg.exe
File created	C:\Windows\SysWOW64\Fimoiopk.exe	Fgocmc32.exe
File opened for modification	C:\Windows\SysWOW64\Odedge32.exe	Oaghki32.exe
File created	C:\Windows\SysWOW64\Nqmnjd32.exe	Nnnbni32.exe
File created	C:\Windows\SysWOW64\Bcbfbp32.exe	Bkknac32.exe
File created	C:\Windows\SysWOW64\Cnlpnk32.dll	Fepjea32.exe
File created	C:\Windows\SysWOW64\Nlfnje32.dll	Gqodqodl.exe
File created	C:\Windows\SysWOW64\Elibpg32.exe	Eikfdl32.exe
File opened for modification	C:\Windows\SysWOW64\Hcjilgdb.exe	Hqkmplen.exe
File created	C:\Windows\SysWOW64\Injqmdki.exe	Igqhpj32.exe
File created	C:\Windows\SysWOW64\Damocb32.dll	Pckajebj.exe
File created	C:\Windows\SysWOW64\Bkbaii32.exe	Bckjhl32.exe
File opened for modification	C:\Windows\SysWOW64\Fggkcl32.exe	Fhdjgoha.exe
File created	C:\Windows\SysWOW64\Iqpflded.dll	Ldpbpgoh.exe
File created	C:\Windows\SysWOW64\Glffke32.dll	Ekdchf32.exe
File created	C:\Windows\SysWOW64\Lpeeijod.dll	Bfabnl32.exe
File created	C:\Windows\SysWOW64\Eoebgcol.exe	Elgfkhpi.exe
File created	C:\Windows\SysWOW64\Leoolamp.dll	Nmqpam32.exe
File created	C:\Windows\SysWOW64\Jhpondph.dll	Ccbphk32.exe
File created	C:\Windows\SysWOW64\Njfjnpgp.exe	Nlcibc32.exe
File created	C:\Windows\SysWOW64\Ehlmljkm.exe	Epeekmjk.exe
File created	C:\Windows\SysWOW64\Benmkbnn.dll	Hieiqo32.exe
File created	C:\Windows\SysWOW64\Glnhjjml.exe	Giolnomh.exe
File opened for modification	C:\Windows\SysWOW64\Llpfjomf.exe	Libjncnc.exe
File opened for modification	C:\Windows\SysWOW64\Aakjdo32.exe	Alnalh32.exe
File created	C:\Windows\SysWOW64\Qcamkjba.dll	Bgllgedi.exe
File opened for modification	C:\Windows\SysWOW64\Dgnjqe32.exe	Dcbnpgkh.exe
File created	C:\Windows\SysWOW64\Keppajog.dll	Iclbpj32.exe
File created	C:\Windows\SysWOW64\Pilfpqaa.exe	Pcbncfjd.exe
File created	C:\Windows\SysWOW64\Goknhdma.dll	Cpkmcldj.exe
File created	C:\Windows\SysWOW64\Jmgghnmp.dll	Opnbbe32.exe
File opened for modification	C:\Windows\SysWOW64\Agbbgqhh.exe	Aaejojjq.exe
File opened for modification	C:\Windows\SysWOW64\Jliaac32.exe	Jmfafgbd.exe
File opened for modification	C:\Windows\SysWOW64\Ggfpgi32.exe	Gckdgjeb.exe
File opened for modification	C:\Windows\SysWOW64\Imaapa32.exe	Ifgicg32.exe
File created	C:\Windows\SysWOW64\Ncfalqpm.exe	Nqhepeai.exe
File created	C:\Windows\SysWOW64\Iinhdmma.exe	Ifolhann.exe
File created	C:\Windows\SysWOW64\Danpemej.exe	Djdgic32.exe
File opened for modification	C:\Windows\SysWOW64\Jbfilffm.exe	Jcciqi32.exe
File created	C:\Windows\SysWOW64\Ipomlm32.exe	Imaapa32.exe
File created	C:\Windows\SysWOW64\Aeqbijmn.dll	Nbpghl32.exe
File opened for modification	C:\Windows\SysWOW64\Paocnkph.exe	Popgboae.exe
File created	C:\Windows\SysWOW64\Bbjpil32.exe	Bolcma32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

8456 8440 WerFault.exe Lepaccmo.exe

pid	pid_target	process	target process
8456	8440	WerFault.exe	Lepaccmo.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Enlidg32.exeGconbj32.exeHmjoqo32.exeGqdgom32.exeDkqnoh32.exeJndjmifj.exeKadica32.exeOdhhgkib.exeFjhcegll.exeHmalldcn.exeDlfgcl32.exePdbdqh32.exeHfpfdeon.exeIacjjacb.exeElgfkhpi.exeHfhfhbce.exePckajebj.exeKdpfadlm.exeNenkqi32.exeJfofol32.exeDcbnpgkh.exeIbfmmb32.exeFcbecl32.exeLcofio32.exeMgedmb32.exeIfgicg32.exePmjaohol.exeFdkklp32.exeFmkilb32.exeJliaac32.exeEbklic32.exeAlageg32.exeKdeaelok.exeCcbphk32.exeDmijfmfi.exeGgagmjbq.exeBhkeohhn.exeIfolhann.exeBajqfq32.exeOnfoin32.exeIkfbbjdj.exeEfjmbaba.exeHifbdnbi.exeAojabdlf.exeBdqlajbb.exeMdogedmh.exeNijpdfhm.exe216cd5fc8daca1a433a71f7e5060cd2eab5ac866b57a64afb59c336aa3945cce.exeDgeaoinb.exeBbjpil32.exeBgibnj32.exeMfokinhf.exeNfoghakb.exeOabkom32.exeFglfgd32.exeNeqnqofm.exeLgingm32.exeMfglep32.exeBbgqjdce.exeKfibhjlj.exeAgglbp32.exeMnifja32.exeGodaakic.exeBofgii32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enlidg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gconbj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmjoqo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gqdgom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqnoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jndjmifj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kadica32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odhhgkib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjhcegll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmalldcn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlfgcl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdbdqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfpfdeon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iacjjacb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Elgfkhpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfhfhbce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pckajebj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdpfadlm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nenkqi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfofol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dcbnpgkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibfmmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcbecl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcofio32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgedmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifgicg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmjaohol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdkklp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmkilb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jliaac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebklic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alageg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdeaelok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ccbphk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmijfmfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggagmjbq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkeohhn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifolhann.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bajqfq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onfoin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikfbbjdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efjmbaba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hifbdnbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aojabdlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdqlajbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdogedmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nijpdfhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	216cd5fc8daca1a433a71f7e5060cd2eab5ac866b57a64afb59c336aa3945cce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgeaoinb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbjpil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgibnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfokinhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfoghakb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oabkom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fglfgd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Neqnqofm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgingm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfglep32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbgqjdce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfibhjlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agglbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnifja32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Godaakic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bofgii32.exe

Modifies registry class 64 IoCs

Processes:

Pplaki32.exeLjldnhid.exeJnofgg32.exeAoagccfn.exeFnibcd32.exeHcojam32.exeLcdhgn32.exeEdidqf32.exeIkjhki32.exeAkiobk32.exeEmdmjamj.exeGckdgjeb.exeNcfalqpm.exePnjofo32.exeMcjhmcok.exeHmjoqo32.exeAdipfd32.exeDobgihgp.exeIikifegp.exeLpnmgdli.exeDkqnoh32.exeOidiekdn.exeKmfpmc32.exeKpgionie.exeFplllkdc.exeMdmkoepk.exeOajlkojn.exeGgkqmoma.exeHjcppidk.exeHmalldcn.exeEihgfd32.exeGoiongbc.exeIladfn32.exeFgjjad32.exeHclfag32.exeDaofpchf.exeApedah32.exeDcllbhdn.exeDcbnpgkh.exeGgfpgi32.exeOhbikbkb.exeOehgjfhi.exePlbkfdba.exeNmlgfnal.exeLdpbpgoh.exeEphbal32.exeGqlhkofn.exeGkcekfad.exeIkqnlh32.exeLlbconkd.exeIakgefqe.exeMfjann32.exeOhiffh32.exeAficjnpm.exeAdcdbl32.exeEggndi32.exeEecafd32.exeIafnjg32.exeFdpgph32.exeMejlalji.exeJfofol32.exeLlgjaeoj.exeAacmij32.exeLnjldf32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pplaki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjmicg32.dll"	Ljldnhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blbjlj32.dll"	Jnofgg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aoagccfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnibcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmkbjj32.dll"	Hcojam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcdhgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edidqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncbdnb32.dll"	Ikjhki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maljaabb.dll"	Akiobk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Emdmjamj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gckdgjeb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncfalqpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnjofo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Coamkc32.dll"	Mcjhmcok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmjoqo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adipfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojefcohi.dll"	Dobgihgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iikifegp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcacjhob.dll"	Lpnmgdli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkqnoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oidiekdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmfpmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpgionie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fplllkdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdmkoepk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oajlkojn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggkqmoma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hjcppidk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmalldcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fplheofl.dll"	Eihgfd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Goiongbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iladfn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fgjjad32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hclfag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daofpchf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Apedah32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dcllbhdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dcbnpgkh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ggfpgi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohbikbkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oehgjfhi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Plbkfdba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmlgfnal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldpbpgoh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ephbal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gqlhkofn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkcekfad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ikqnlh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llbconkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hakapcjd.dll"	Iakgefqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afbioogg.dll"	Mfjann32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohiffh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aficjnpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adcdbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eggndi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eecafd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iafnjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdpgph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mejlalji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfofol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llgjaeoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aemgfj32.dll"	Aacmij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajhibfpo.dll"	Lnjldf32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

description	pid	process	target process
PID 1344 wrote to memory of 1996	1344	216cd5fc8daca1a433a71f7e5060cd2eab5ac866b57a64afb59c336aa3945cce.exe	Micklk32.exe
PID 1344 wrote to memory of 1996	1344	216cd5fc8daca1a433a71f7e5060cd2eab5ac866b57a64afb59c336aa3945cce.exe	Micklk32.exe
PID 1344 wrote to memory of 1996	1344	216cd5fc8daca1a433a71f7e5060cd2eab5ac866b57a64afb59c336aa3945cce.exe	Micklk32.exe
PID 1344 wrote to memory of 1996	1344	216cd5fc8daca1a433a71f7e5060cd2eab5ac866b57a64afb59c336aa3945cce.exe	Micklk32.exe
PID 1996 wrote to memory of 2348	1996	Micklk32.exe	Mpmcielb.exe
PID 1996 wrote to memory of 2348	1996	Micklk32.exe	Mpmcielb.exe
PID 1996 wrote to memory of 2348	1996	Micklk32.exe	Mpmcielb.exe
PID 1996 wrote to memory of 2348	1996	Micklk32.exe	Mpmcielb.exe
PID 2348 wrote to memory of 2744	2348	Mpmcielb.exe	Mfglep32.exe
PID 2348 wrote to memory of 2744	2348	Mpmcielb.exe	Mfglep32.exe
PID 2348 wrote to memory of 2744	2348	Mpmcielb.exe	Mfglep32.exe
PID 2348 wrote to memory of 2744	2348	Mpmcielb.exe	Mfglep32.exe
PID 2744 wrote to memory of 3032	2744	Mfglep32.exe	Mejlalji.exe
PID 2744 wrote to memory of 3032	2744	Mfglep32.exe	Mejlalji.exe
PID 2744 wrote to memory of 3032	2744	Mfglep32.exe	Mejlalji.exe
PID 2744 wrote to memory of 3032	2744	Mfglep32.exe	Mejlalji.exe
PID 3032 wrote to memory of 2760	3032	Mejlalji.exe	Mfihkoal.exe
PID 3032 wrote to memory of 2760	3032	Mejlalji.exe	Mfihkoal.exe
PID 3032 wrote to memory of 2760	3032	Mejlalji.exe	Mfihkoal.exe
PID 3032 wrote to memory of 2760	3032	Mejlalji.exe	Mfihkoal.exe
PID 2760 wrote to memory of 2736	2760	Mfihkoal.exe	Mbpipp32.exe
PID 2760 wrote to memory of 2736	2760	Mfihkoal.exe	Mbpipp32.exe
PID 2760 wrote to memory of 2736	2760	Mfihkoal.exe	Mbpipp32.exe
PID 2760 wrote to memory of 2736	2760	Mfihkoal.exe	Mbpipp32.exe
PID 2736 wrote to memory of 2644	2736	Mbpipp32.exe	Mgmahg32.exe
PID 2736 wrote to memory of 2644	2736	Mbpipp32.exe	Mgmahg32.exe
PID 2736 wrote to memory of 2644	2736	Mbpipp32.exe	Mgmahg32.exe
PID 2736 wrote to memory of 2644	2736	Mbpipp32.exe	Mgmahg32.exe
PID 2644 wrote to memory of 1988	2644	Mgmahg32.exe	Mjkndb32.exe
PID 2644 wrote to memory of 1988	2644	Mgmahg32.exe	Mjkndb32.exe
PID 2644 wrote to memory of 1988	2644	Mgmahg32.exe	Mjkndb32.exe
PID 2644 wrote to memory of 1988	2644	Mgmahg32.exe	Mjkndb32.exe
PID 1988 wrote to memory of 1476	1988	Mjkndb32.exe	Mnifja32.exe
PID 1988 wrote to memory of 1476	1988	Mjkndb32.exe	Mnifja32.exe
PID 1988 wrote to memory of 1476	1988	Mjkndb32.exe	Mnifja32.exe
PID 1988 wrote to memory of 1476	1988	Mjkndb32.exe	Mnifja32.exe
PID 1476 wrote to memory of 2964	1476	Mnifja32.exe	Nmlgfnal.exe
PID 1476 wrote to memory of 2964	1476	Mnifja32.exe	Nmlgfnal.exe
PID 1476 wrote to memory of 2964	1476	Mnifja32.exe	Nmlgfnal.exe
PID 1476 wrote to memory of 2964	1476	Mnifja32.exe	Nmlgfnal.exe
PID 2964 wrote to memory of 1352	2964	Nmlgfnal.exe	Nnkcpq32.exe
PID 2964 wrote to memory of 1352	2964	Nmlgfnal.exe	Nnkcpq32.exe
PID 2964 wrote to memory of 1352	2964	Nmlgfnal.exe	Nnkcpq32.exe
PID 2964 wrote to memory of 1352	2964	Nmlgfnal.exe	Nnkcpq32.exe
PID 1352 wrote to memory of 1864	1352	Nnkcpq32.exe	Nfghdcfj.exe
PID 1352 wrote to memory of 1864	1352	Nnkcpq32.exe	Nfghdcfj.exe
PID 1352 wrote to memory of 1864	1352	Nnkcpq32.exe	Nfghdcfj.exe
PID 1352 wrote to memory of 1864	1352	Nnkcpq32.exe	Nfghdcfj.exe
PID 1864 wrote to memory of 2212	1864	Nfghdcfj.exe	Nmqpam32.exe
PID 1864 wrote to memory of 2212	1864	Nfghdcfj.exe	Nmqpam32.exe
PID 1864 wrote to memory of 2212	1864	Nfghdcfj.exe	Nmqpam32.exe
PID 1864 wrote to memory of 2212	1864	Nfghdcfj.exe	Nmqpam32.exe
PID 2212 wrote to memory of 2404	2212	Nmqpam32.exe	Njdqka32.exe
PID 2212 wrote to memory of 2404	2212	Nmqpam32.exe	Njdqka32.exe
PID 2212 wrote to memory of 2404	2212	Nmqpam32.exe	Njdqka32.exe
PID 2212 wrote to memory of 2404	2212	Nmqpam32.exe	Njdqka32.exe
PID 2404 wrote to memory of 2372	2404	Njdqka32.exe	Nbpeoc32.exe
PID 2404 wrote to memory of 2372	2404	Njdqka32.exe	Nbpeoc32.exe
PID 2404 wrote to memory of 2372	2404	Njdqka32.exe	Nbpeoc32.exe
PID 2404 wrote to memory of 2372	2404	Njdqka32.exe	Nbpeoc32.exe
PID 2372 wrote to memory of 448	2372	Nbpeoc32.exe	Nlhjhi32.exe
PID 2372 wrote to memory of 448	2372	Nbpeoc32.exe	Nlhjhi32.exe
PID 2372 wrote to memory of 448	2372	Nbpeoc32.exe	Nlhjhi32.exe
PID 2372 wrote to memory of 448	2372	Nbpeoc32.exe	Nlhjhi32.exe

C:\Users\Admin\AppData\Local\Temp\216cd5fc8daca1a433a71f7e5060cd2eab5ac866b57a64afb59c336aa3945cce.exe
"C:\Users\Admin\AppData\Local\Temp\216cd5fc8daca1a433a71f7e5060cd2eab5ac866b57a64afb59c336aa3945cce.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\Micklk32.exe
C:\Windows\system32\Micklk32.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\Mpmcielb.exe
C:\Windows\system32\Mpmcielb.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2348

C:\Windows\SysWOW64\Mfglep32.exe
C:\Windows\system32\Mfglep32.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744

C:\Windows\SysWOW64\Mejlalji.exe
C:\Windows\system32\Mejlalji.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3032

C:\Windows\SysWOW64\Mfihkoal.exe
C:\Windows\system32\Mfihkoal.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\SysWOW64\Mbpipp32.exe
C:\Windows\system32\Mbpipp32.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736

C:\Windows\SysWOW64\Mgmahg32.exe
C:\Windows\system32\Mgmahg32.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644

C:\Windows\SysWOW64\Mjkndb32.exe
C:\Windows\system32\Mjkndb32.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\Mnifja32.exe
C:\Windows\system32\Mnifja32.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\SysWOW64\Nmlgfnal.exe
C:\Windows\system32\Nmlgfnal.exe
11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2964

C:\Windows\SysWOW64\Nnkcpq32.exe
C:\Windows\system32\Nnkcpq32.exe
12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\SysWOW64\Nfghdcfj.exe
C:\Windows\system32\Nfghdcfj.exe
13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\SysWOW64\Nmqpam32.exe
C:\Windows\system32\Nmqpam32.exe
14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\SysWOW64\Njdqka32.exe
C:\Windows\system32\Njdqka32.exe
15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404

C:\Windows\SysWOW64\Nbpeoc32.exe
C:\Windows\system32\Nbpeoc32.exe
16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\SysWOW64\Nlhjhi32.exe
C:\Windows\system32\Nlhjhi32.exe
17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448

C:\Windows\SysWOW64\Neqnqofm.exe
C:\Windows\system32\Neqnqofm.exe
18⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:776

C:\Windows\SysWOW64\Oagoep32.exe
C:\Windows\system32\Oagoep32.exe
19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1728

C:\Windows\SysWOW64\Okpcoe32.exe
C:\Windows\system32\Okpcoe32.exe
20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472

C:\Windows\SysWOW64\Oajlkojn.exe
C:\Windows\system32\Oajlkojn.exe
21⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2452

C:\Windows\SysWOW64\Odhhgkib.exe
C:\Windows\system32\Odhhgkib.exe
22⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1404

C:\Windows\SysWOW64\Oehdan32.exe
C:\Windows\system32\Oehdan32.exe
23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876

C:\Windows\SysWOW64\Ohfqmi32.exe
C:\Windows\system32\Ohfqmi32.exe
24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:3064

C:\Windows\SysWOW64\Okdmjdol.exe
C:\Windows\system32\Okdmjdol.exe
25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136

C:\Windows\SysWOW64\Ogknoe32.exe
C:\Windows\system32\Ogknoe32.exe
26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596

C:\Windows\SysWOW64\Pcbncfjd.exe
C:\Windows\system32\Pcbncfjd.exe
27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2704

C:\Windows\SysWOW64\Pilfpqaa.exe
C:\Windows\system32\Pilfpqaa.exe
28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2884

C:\Windows\SysWOW64\Pgpgjepk.exe
C:\Windows\system32\Pgpgjepk.exe
29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716

C:\Windows\SysWOW64\Pnjofo32.exe
C:\Windows\system32\Pnjofo32.exe
30⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2712

C:\Windows\SysWOW64\Ppkhhjei.exe
C:\Windows\system32\Ppkhhjei.exe
31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976

C:\Windows\SysWOW64\Pciddedl.exe
C:\Windows\system32\Pciddedl.exe
32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688

C:\Windows\SysWOW64\Pegqpacp.exe
C:\Windows\system32\Pegqpacp.exe
33⤵
- Executes dropped EXE
PID:1808

C:\Windows\SysWOW64\Phfmllbd.exe
C:\Windows\system32\Phfmllbd.exe
34⤵
- Executes dropped EXE
PID:2840

C:\Windows\SysWOW64\Pckajebj.exe
C:\Windows\system32\Pckajebj.exe
35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:948

C:\Windows\SysWOW64\Phhjblpa.exe
C:\Windows\system32\Phhjblpa.exe
36⤵
- Executes dropped EXE
PID:2240

C:\Windows\SysWOW64\Qododfek.exe
C:\Windows\system32\Qododfek.exe
37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2444

C:\Windows\SysWOW64\Qqfkln32.exe
C:\Windows\system32\Qqfkln32.exe
38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2112

C:\Windows\SysWOW64\Anjlebjc.exe
C:\Windows\system32\Anjlebjc.exe
39⤵
- Executes dropped EXE
PID:988

C:\Windows\SysWOW64\Abegfa32.exe
C:\Windows\system32\Abegfa32.exe
40⤵
- Executes dropped EXE
PID:1796

C:\Windows\SysWOW64\Adcdbl32.exe
C:\Windows\system32\Adcdbl32.exe
41⤵
- Executes dropped EXE
- Modifies registry class
PID:1156

C:\Windows\SysWOW64\Amohfo32.exe
C:\Windows\system32\Amohfo32.exe
42⤵
- Executes dropped EXE
PID:544

C:\Windows\SysWOW64\Adfqgl32.exe
C:\Windows\system32\Adfqgl32.exe
43⤵
- Executes dropped EXE
PID:328

C:\Windows\SysWOW64\Agdmdg32.exe
C:\Windows\system32\Agdmdg32.exe
44⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1040

C:\Windows\SysWOW64\Ajcipc32.exe
C:\Windows\system32\Ajcipc32.exe
45⤵
- Executes dropped EXE
PID:584

C:\Windows\SysWOW64\Aopahjll.exe
C:\Windows\system32\Aopahjll.exe
46⤵
- Executes dropped EXE
PID:1912

C:\Windows\SysWOW64\Aggiigmn.exe
C:\Windows\system32\Aggiigmn.exe
47⤵
- Executes dropped EXE
PID:1308

C:\Windows\SysWOW64\Aihfap32.exe
C:\Windows\system32\Aihfap32.exe
48⤵
- Executes dropped EXE
PID:1568

C:\Windows\SysWOW64\Amcbankf.exe
C:\Windows\system32\Amcbankf.exe
49⤵
- Executes dropped EXE
PID:1812

C:\Windows\SysWOW64\Aflfjc32.exe
C:\Windows\system32\Aflfjc32.exe
50⤵
- Executes dropped EXE
PID:2912

C:\Windows\SysWOW64\Akiobk32.exe
C:\Windows\system32\Akiobk32.exe
51⤵
- Executes dropped EXE
- Modifies registry class
PID:2824

C:\Windows\SysWOW64\Bcpgdhpp.exe
C:\Windows\system32\Bcpgdhpp.exe
52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2956

C:\Windows\SysWOW64\Beackp32.exe
C:\Windows\system32\Beackp32.exe
53⤵
- Executes dropped EXE
PID:2764

C:\Windows\SysWOW64\Bofgii32.exe
C:\Windows\system32\Bofgii32.exe
54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2632

C:\Windows\SysWOW64\Becpap32.exe
C:\Windows\system32\Becpap32.exe
55⤵
- Executes dropped EXE
PID:1540

C:\Windows\SysWOW64\Bgblmk32.exe
C:\Windows\system32\Bgblmk32.exe
56⤵
- Executes dropped EXE
PID:2828

C:\Windows\SysWOW64\Bbgqjdce.exe
C:\Windows\system32\Bbgqjdce.exe
57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2932

C:\Windows\SysWOW64\Bajqfq32.exe
C:\Windows\system32\Bajqfq32.exe
58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:380

C:\Windows\SysWOW64\Bgdibkam.exe
C:\Windows\system32\Bgdibkam.exe
59⤵
- Executes dropped EXE
PID:3000

C:\Windows\SysWOW64\Bnnaoe32.exe
C:\Windows\system32\Bnnaoe32.exe
60⤵
- Executes dropped EXE
PID:1944

C:\Windows\SysWOW64\Behilopf.exe
C:\Windows\system32\Behilopf.exe
61⤵
- Executes dropped EXE
PID:2140

C:\Windows\SysWOW64\Bckjhl32.exe
C:\Windows\system32\Bckjhl32.exe
62⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:824

C:\Windows\SysWOW64\Bkbaii32.exe
C:\Windows\system32\Bkbaii32.exe
63⤵
- Executes dropped EXE
PID:916

C:\Windows\SysWOW64\Bmcnqama.exe
C:\Windows\system32\Bmcnqama.exe
64⤵
- Executes dropped EXE
PID:1684

C:\Windows\SysWOW64\Bejfao32.exe
C:\Windows\system32\Bejfao32.exe
65⤵
- Executes dropped EXE
PID:2044

C:\Windows\SysWOW64\Bgibnj32.exe
C:\Windows\system32\Bgibnj32.exe
66⤵
- System Location Discovery: System Language Discovery
PID:1536

C:\Windows\SysWOW64\Cjgoje32.exe
C:\Windows\system32\Cjgoje32.exe
67⤵
PID:300

C:\Windows\SysWOW64\Caaggpdh.exe
C:\Windows\system32\Caaggpdh.exe
68⤵
PID:2464

C:\Windows\SysWOW64\Cgkocj32.exe
C:\Windows\system32\Cgkocj32.exe
69⤵
PID:1584

C:\Windows\SysWOW64\Cjjkpe32.exe
C:\Windows\system32\Cjjkpe32.exe
70⤵
PID:1784

C:\Windows\SysWOW64\Cmhglq32.exe
C:\Windows\system32\Cmhglq32.exe
71⤵
PID:2708

C:\Windows\SysWOW64\Cpfdhl32.exe
C:\Windows\system32\Cpfdhl32.exe
72⤵
PID:2800

C:\Windows\SysWOW64\Ccbphk32.exe
C:\Windows\system32\Ccbphk32.exe
73⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2868

C:\Windows\SysWOW64\Cjlheehe.exe
C:\Windows\system32\Cjlheehe.exe
74⤵
PID:2344

C:\Windows\SysWOW64\Cmjdaqgi.exe
C:\Windows\system32\Cmjdaqgi.exe
75⤵
PID:2324

C:\Windows\SysWOW64\Cpiqmlfm.exe
C:\Windows\system32\Cpiqmlfm.exe
76⤵
PID:2844

C:\Windows\SysWOW64\Ceeieced.exe
C:\Windows\system32\Ceeieced.exe
77⤵
PID:1948

C:\Windows\SysWOW64\Cmmagpef.exe
C:\Windows\system32\Cmmagpef.exe
78⤵
PID:2116

C:\Windows\SysWOW64\Cpkmcldj.exe
C:\Windows\system32\Cpkmcldj.exe
79⤵
- Drops file in System32 directory
PID:2576

C:\Windows\SysWOW64\Cehfkb32.exe
C:\Windows\system32\Cehfkb32.exe
80⤵
PID:836

C:\Windows\SysWOW64\Clbnhmjo.exe
C:\Windows\system32\Clbnhmjo.exe
81⤵
PID:900

C:\Windows\SysWOW64\Copjdhib.exe
C:\Windows\system32\Copjdhib.exe
82⤵
PID:1316

C:\Windows\SysWOW64\Daofpchf.exe
C:\Windows\system32\Daofpchf.exe
83⤵
- Modifies registry class
PID:684

C:\Windows\SysWOW64\Dhiomn32.exe
C:\Windows\system32\Dhiomn32.exe
84⤵
PID:2476

C:\Windows\SysWOW64\Dobgihgp.exe
C:\Windows\system32\Dobgihgp.exe
85⤵
- Modifies registry class
PID:2128

C:\Windows\SysWOW64\Daacecfc.exe
C:\Windows\system32\Daacecfc.exe
86⤵
PID:1720

C:\Windows\SysWOW64\Ddpobo32.exe
C:\Windows\system32\Ddpobo32.exe
87⤵
PID:2804

C:\Windows\SysWOW64\Dlfgcl32.exe
C:\Windows\system32\Dlfgcl32.exe
88⤵
- System Location Discovery: System Language Discovery
PID:2756

C:\Windows\SysWOW64\Doecog32.exe
C:\Windows\system32\Doecog32.exe
89⤵
PID:2904

C:\Windows\SysWOW64\Dmhdkdlg.exe
C:\Windows\system32\Dmhdkdlg.exe
90⤵
PID:2948

C:\Windows\SysWOW64\Deollamj.exe
C:\Windows\system32\Deollamj.exe
91⤵
PID:2204

C:\Windows\SysWOW64\Dfphcj32.exe
C:\Windows\system32\Dfphcj32.exe
92⤵
PID:2780

C:\Windows\SysWOW64\Dklddhka.exe
C:\Windows\system32\Dklddhka.exe
93⤵
PID:2856

C:\Windows\SysWOW64\Dmjqpdje.exe
C:\Windows\system32\Dmjqpdje.exe
94⤵
PID:2832

C:\Windows\SysWOW64\Dhpemm32.exe
C:\Windows\system32\Dhpemm32.exe
95⤵
PID:2332

C:\Windows\SysWOW64\Dknajh32.exe
C:\Windows\system32\Dknajh32.exe
96⤵
PID:2388

C:\Windows\SysWOW64\Diaaeepi.exe
C:\Windows\system32\Diaaeepi.exe
97⤵
PID:2696

C:\Windows\SysWOW64\Dahifbpk.exe
C:\Windows\system32\Dahifbpk.exe
98⤵
PID:3040

C:\Windows\SysWOW64\Dpkibo32.exe
C:\Windows\system32\Dpkibo32.exe
99⤵
PID:1196

C:\Windows\SysWOW64\Dgeaoinb.exe
C:\Windows\system32\Dgeaoinb.exe
100⤵
- System Location Discovery: System Language Discovery
PID:1480

C:\Windows\SysWOW64\Dkqnoh32.exe
C:\Windows\system32\Dkqnoh32.exe
101⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2228

C:\Windows\SysWOW64\Elajgpmj.exe
C:\Windows\system32\Elajgpmj.exe
102⤵
PID:2692

C:\Windows\SysWOW64\Edibhmml.exe
C:\Windows\system32\Edibhmml.exe
103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2880

C:\Windows\SysWOW64\Eggndi32.exe
C:\Windows\system32\Eggndi32.exe
104⤵
- Modifies registry class
PID:2648

C:\Windows\SysWOW64\Eejopecj.exe
C:\Windows\system32\Eejopecj.exe
105⤵
PID:1804

C:\Windows\SysWOW64\Emagacdm.exe
C:\Windows\system32\Emagacdm.exe
106⤵
PID:2836

C:\Windows\SysWOW64\Eppcmncq.exe
C:\Windows\system32\Eppcmncq.exe
107⤵
PID:2312

C:\Windows\SysWOW64\Egikjh32.exe
C:\Windows\system32\Egikjh32.exe
108⤵
PID:1816

C:\Windows\SysWOW64\Eihgfd32.exe
C:\Windows\system32\Eihgfd32.exe
109⤵
- Modifies registry class
PID:1920

C:\Windows\SysWOW64\Elfcbo32.exe
C:\Windows\system32\Elfcbo32.exe
110⤵
PID:3048

C:\Windows\SysWOW64\Eoepnk32.exe
C:\Windows\system32\Eoepnk32.exe
111⤵
PID:2296

C:\Windows\SysWOW64\Ecploipa.exe
C:\Windows\system32\Ecploipa.exe
112⤵
PID:1556

C:\Windows\SysWOW64\Eacljf32.exe
C:\Windows\system32\Eacljf32.exe
113⤵
PID:2408

C:\Windows\SysWOW64\Eijdkcgn.exe
C:\Windows\system32\Eijdkcgn.exe
114⤵
PID:2448

C:\Windows\SysWOW64\Ehmdgp32.exe
C:\Windows\system32\Ehmdgp32.exe
115⤵
PID:2608

C:\Windows\SysWOW64\Eklqcl32.exe
C:\Windows\system32\Eklqcl32.exe
116⤵
PID:2604

C:\Windows\SysWOW64\Eogmcjef.exe
C:\Windows\system32\Eogmcjef.exe
117⤵
PID:2928

C:\Windows\SysWOW64\Eeaepd32.exe
C:\Windows\system32\Eeaepd32.exe
118⤵
PID:2776

C:\Windows\SysWOW64\Ehpalp32.exe
C:\Windows\system32\Ehpalp32.exe
119⤵
PID:1752

C:\Windows\SysWOW64\Eknmhk32.exe
C:\Windows\system32\Eknmhk32.exe
120⤵
PID:608

C:\Windows\SysWOW64\Enlidg32.exe
C:\Windows\system32\Enlidg32.exe
121⤵
- System Location Discovery: System Language Discovery
PID:1612

C:\Windows\SysWOW64\Eecafd32.exe
C:\Windows\system32\Eecafd32.exe
122⤵
- Modifies registry class
PID:1208

C:\Windows\SysWOW64\Fkpjnkig.exe
C:\Windows\system32\Fkpjnkig.exe
123⤵
PID:2424

C:\Windows\SysWOW64\Fnofjfhk.exe
C:\Windows\system32\Fnofjfhk.exe
124⤵
PID:1088

C:\Windows\SysWOW64\Fpmbfbgo.exe
C:\Windows\system32\Fpmbfbgo.exe
125⤵
PID:2624

C:\Windows\SysWOW64\Fhdjgoha.exe
C:\Windows\system32\Fhdjgoha.exe
126⤵
- Drops file in System32 directory
PID:2612

C:\Windows\SysWOW64\Fggkcl32.exe
C:\Windows\system32\Fggkcl32.exe
127⤵
PID:108

C:\Windows\SysWOW64\Fkbgckgd.exe
C:\Windows\system32\Fkbgckgd.exe
128⤵
PID:2308

C:\Windows\SysWOW64\Fnacpffh.exe
C:\Windows\system32\Fnacpffh.exe
129⤵
PID:844

C:\Windows\SysWOW64\Fdkklp32.exe
C:\Windows\system32\Fdkklp32.exe
130⤵
- System Location Discovery: System Language Discovery
PID:1252

C:\Windows\SysWOW64\Fkecij32.exe
C:\Windows\system32\Fkecij32.exe
131⤵
PID:880

C:\Windows\SysWOW64\Fjhcegll.exe
C:\Windows\system32\Fjhcegll.exe
132⤵
- System Location Discovery: System Language Discovery
PID:2792

C:\Windows\SysWOW64\Flfpabkp.exe
C:\Windows\system32\Flfpabkp.exe
133⤵
PID:3016

C:\Windows\SysWOW64\Fqalaa32.exe
C:\Windows\system32\Fqalaa32.exe
134⤵
PID:1108

C:\Windows\SysWOW64\Fcphnm32.exe
C:\Windows\system32\Fcphnm32.exe
135⤵
PID:1148

C:\Windows\SysWOW64\Fgldnkkf.exe
C:\Windows\system32\Fgldnkkf.exe
136⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2352

C:\Windows\SysWOW64\Ffodjh32.exe
C:\Windows\system32\Ffodjh32.exe
137⤵
PID:1916

C:\Windows\SysWOW64\Flhmfbim.exe
C:\Windows\system32\Flhmfbim.exe
138⤵
PID:2120

C:\Windows\SysWOW64\Fcbecl32.exe
C:\Windows\system32\Fcbecl32.exe
139⤵
- System Location Discovery: System Language Discovery
PID:1972

C:\Windows\SysWOW64\Ffaaoh32.exe
C:\Windows\system32\Ffaaoh32.exe
140⤵
PID:1136

C:\Windows\SysWOW64\Fjlmpfhg.exe
C:\Windows\system32\Fjlmpfhg.exe
141⤵
PID:2980

C:\Windows\SysWOW64\Fmkilb32.exe
C:\Windows\system32\Fmkilb32.exe
142⤵
- System Location Discovery: System Language Discovery
PID:316

C:\Windows\SysWOW64\Fqfemqod.exe
C:\Windows\system32\Fqfemqod.exe
143⤵
PID:2056

C:\Windows\SysWOW64\Gfcnegnk.exe
C:\Windows\system32\Gfcnegnk.exe
144⤵
PID:1712

C:\Windows\SysWOW64\Ghajacmo.exe
C:\Windows\system32\Ghajacmo.exe
145⤵
PID:2876

C:\Windows\SysWOW64\Gkpfmnlb.exe
C:\Windows\system32\Gkpfmnlb.exe
146⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2944

C:\Windows\SysWOW64\Gcgnnlle.exe
C:\Windows\system32\Gcgnnlle.exe
147⤵
PID:2300

C:\Windows\SysWOW64\Gdhkfd32.exe
C:\Windows\system32\Gdhkfd32.exe
148⤵
PID:1664

C:\Windows\SysWOW64\Gkbcbn32.exe
C:\Windows\system32\Gkbcbn32.exe
149⤵
PID:1644

C:\Windows\SysWOW64\Gblkoham.exe
C:\Windows\system32\Gblkoham.exe
150⤵
PID:792

C:\Windows\SysWOW64\Ggicgopd.exe
C:\Windows\system32\Ggicgopd.exe
151⤵
PID:2860

C:\Windows\SysWOW64\Goplilpf.exe
C:\Windows\system32\Goplilpf.exe
152⤵
PID:1384

C:\Windows\SysWOW64\Gdmdacnn.exe
C:\Windows\system32\Gdmdacnn.exe
153⤵
PID:3044

C:\Windows\SysWOW64\Ggkqmoma.exe
C:\Windows\system32\Ggkqmoma.exe
154⤵
- Modifies registry class
PID:2268

C:\Windows\SysWOW64\Gjjmijme.exe
C:\Windows\system32\Gjjmijme.exe
155⤵
PID:2124

C:\Windows\SysWOW64\Gqdefddb.exe
C:\Windows\system32\Gqdefddb.exe
156⤵
PID:2328

C:\Windows\SysWOW64\Ggnmbn32.exe
C:\Windows\system32\Ggnmbn32.exe
157⤵
PID:1672

C:\Windows\SysWOW64\Hjlioj32.exe
C:\Windows\system32\Hjlioj32.exe
158⤵
PID:2456

C:\Windows\SysWOW64\Hnheohcl.exe
C:\Windows\system32\Hnheohcl.exe
159⤵
PID:2172

C:\Windows\SysWOW64\Hmkeke32.exe
C:\Windows\system32\Hmkeke32.exe
160⤵
PID:2784

C:\Windows\SysWOW64\Hcdnhoac.exe
C:\Windows\system32\Hcdnhoac.exe
161⤵
PID:2064

C:\Windows\SysWOW64\Hgpjhn32.exe
C:\Windows\system32\Hgpjhn32.exe
162⤵
PID:1732

C:\Windows\SysWOW64\Hfcjdkpg.exe
C:\Windows\system32\Hfcjdkpg.exe
163⤵
PID:1192

C:\Windows\SysWOW64\Hmmbqegc.exe
C:\Windows\system32\Hmmbqegc.exe
164⤵
PID:2364

C:\Windows\SysWOW64\Hpkompgg.exe
C:\Windows\system32\Hpkompgg.exe
165⤵
PID:2740

C:\Windows\SysWOW64\Hcgjmo32.exe
C:\Windows\system32\Hcgjmo32.exe
166⤵
PID:112

C:\Windows\SysWOW64\Hjacjifm.exe
C:\Windows\system32\Hjacjifm.exe
167⤵
PID:2036

C:\Windows\SysWOW64\Hmoofdea.exe
C:\Windows\system32\Hmoofdea.exe
168⤵
PID:1496

C:\Windows\SysWOW64\Hakkgc32.exe
C:\Windows\system32\Hakkgc32.exe
169⤵
PID:2628

C:\Windows\SysWOW64\Hblgnkdh.exe
C:\Windows\system32\Hblgnkdh.exe
170⤵
PID:1504

C:\Windows\SysWOW64\Hjcppidk.exe
C:\Windows\system32\Hjcppidk.exe
171⤵
- Modifies registry class
PID:2304

C:\Windows\SysWOW64\Hmalldcn.exe
C:\Windows\system32\Hmalldcn.exe
172⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1708

C:\Windows\SysWOW64\Hpphhp32.exe
C:\Windows\system32\Hpphhp32.exe
173⤵
PID:3096

C:\Windows\SysWOW64\Hfjpdjjo.exe
C:\Windows\system32\Hfjpdjjo.exe
174⤵
PID:3136

C:\Windows\SysWOW64\Hmdhad32.exe
C:\Windows\system32\Hmdhad32.exe
175⤵
PID:3176

C:\Windows\SysWOW64\Hneeilgj.exe
C:\Windows\system32\Hneeilgj.exe
176⤵
PID:3216

C:\Windows\SysWOW64\Iflmjihl.exe
C:\Windows\system32\Iflmjihl.exe
177⤵
PID:3256

C:\Windows\SysWOW64\Iikifegp.exe
C:\Windows\system32\Iikifegp.exe
178⤵
- Modifies registry class
PID:3296

C:\Windows\SysWOW64\Iliebpfc.exe
C:\Windows\system32\Iliebpfc.exe
179⤵
PID:3336

C:\Windows\SysWOW64\Ipeaco32.exe
C:\Windows\system32\Ipeaco32.exe
180⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3376

C:\Windows\SysWOW64\Iafnjg32.exe
C:\Windows\system32\Iafnjg32.exe
181⤵
- Modifies registry class
PID:3416

C:\Windows\SysWOW64\Ihpfgalh.exe
C:\Windows\system32\Ihpfgalh.exe
182⤵
PID:3456

C:\Windows\SysWOW64\Ijnbcmkk.exe
C:\Windows\system32\Ijnbcmkk.exe
183⤵
PID:3496

C:\Windows\SysWOW64\Ibejdjln.exe
C:\Windows\system32\Ibejdjln.exe
184⤵
PID:3536

C:\Windows\SysWOW64\Iedfqeka.exe
C:\Windows\system32\Iedfqeka.exe
185⤵
PID:3576

C:\Windows\SysWOW64\Ihbcmaje.exe
C:\Windows\system32\Ihbcmaje.exe
186⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3616

C:\Windows\SysWOW64\Ijqoilii.exe
C:\Windows\system32\Ijqoilii.exe
187⤵
PID:3656

C:\Windows\SysWOW64\Iakgefqe.exe
C:\Windows\system32\Iakgefqe.exe
188⤵
- Modifies registry class
PID:3696

C:\Windows\SysWOW64\Idicbbpi.exe
C:\Windows\system32\Idicbbpi.exe
189⤵
PID:3736

C:\Windows\SysWOW64\Imahkg32.exe
C:\Windows\system32\Imahkg32.exe
190⤵
PID:3776

C:\Windows\SysWOW64\Idkpganf.exe
C:\Windows\system32\Idkpganf.exe
191⤵
PID:3816

C:\Windows\SysWOW64\Ifjlcmmj.exe
C:\Windows\system32\Ifjlcmmj.exe
192⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3856

C:\Windows\SysWOW64\Jmdepg32.exe
C:\Windows\system32\Jmdepg32.exe
193⤵
PID:3896

C:\Windows\SysWOW64\Jaoqqflp.exe
C:\Windows\system32\Jaoqqflp.exe
194⤵
PID:3936

C:\Windows\SysWOW64\Jbqmhnbo.exe
C:\Windows\system32\Jbqmhnbo.exe
195⤵
PID:3988

C:\Windows\SysWOW64\Jfliim32.exe
C:\Windows\system32\Jfliim32.exe
196⤵
PID:4048

C:\Windows\SysWOW64\Jkhejkcq.exe
C:\Windows\system32\Jkhejkcq.exe
197⤵
PID:4088

C:\Windows\SysWOW64\Jmfafgbd.exe
C:\Windows\system32\Jmfafgbd.exe
198⤵
- Drops file in System32 directory
PID:3104

C:\Windows\SysWOW64\Jliaac32.exe
C:\Windows\system32\Jliaac32.exe
199⤵
- System Location Discovery: System Language Discovery
PID:3156

C:\Windows\SysWOW64\Jbcjnnpl.exe
C:\Windows\system32\Jbcjnnpl.exe
200⤵
PID:3212

C:\Windows\SysWOW64\Jfofol32.exe
C:\Windows\system32\Jfofol32.exe
201⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3244

C:\Windows\SysWOW64\Jeafjiop.exe
C:\Windows\system32\Jeafjiop.exe
202⤵
PID:3304

C:\Windows\SysWOW64\Jmhnkfpa.exe
C:\Windows\system32\Jmhnkfpa.exe
203⤵
PID:3356

C:\Windows\SysWOW64\Jojkco32.exe
C:\Windows\system32\Jojkco32.exe
204⤵
PID:3400

C:\Windows\SysWOW64\Jhbold32.exe
C:\Windows\system32\Jhbold32.exe
205⤵
PID:3448

C:\Windows\SysWOW64\Jolghndm.exe
C:\Windows\system32\Jolghndm.exe
206⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3504

C:\Windows\SysWOW64\Jajcdjca.exe
C:\Windows\system32\Jajcdjca.exe
207⤵
PID:3556

C:\Windows\SysWOW64\Jhdlad32.exe
C:\Windows\system32\Jhdlad32.exe
208⤵
PID:3612

C:\Windows\SysWOW64\Jkchmo32.exe
C:\Windows\system32\Jkchmo32.exe
209⤵
PID:3648

C:\Windows\SysWOW64\Jehlkhig.exe
C:\Windows\system32\Jehlkhig.exe
210⤵
PID:3704

C:\Windows\SysWOW64\Kdklfe32.exe
C:\Windows\system32\Kdklfe32.exe
211⤵
PID:3748

C:\Windows\SysWOW64\Kkeecogo.exe
C:\Windows\system32\Kkeecogo.exe
212⤵
PID:3800

C:\Windows\SysWOW64\Kncaojfb.exe
C:\Windows\system32\Kncaojfb.exe
213⤵
PID:3848

C:\Windows\SysWOW64\Kaompi32.exe
C:\Windows\system32\Kaompi32.exe
214⤵
PID:3892

C:\Windows\SysWOW64\Khielcfh.exe
C:\Windows\system32\Khielcfh.exe
215⤵
PID:3952

C:\Windows\SysWOW64\Kglehp32.exe
C:\Windows\system32\Kglehp32.exe
216⤵
PID:4000

C:\Windows\SysWOW64\Knfndjdp.exe
C:\Windows\system32\Knfndjdp.exe
217⤵
PID:4072

C:\Windows\SysWOW64\Kpdjaecc.exe
C:\Windows\system32\Kpdjaecc.exe
218⤵
PID:1856

C:\Windows\SysWOW64\Kdpfadlm.exe
C:\Windows\system32\Kdpfadlm.exe
219⤵
- System Location Discovery: System Language Discovery
PID:3164

C:\Windows\SysWOW64\Knhjjj32.exe
C:\Windows\system32\Knhjjj32.exe
220⤵
PID:3236

C:\Windows\SysWOW64\Kadfkhkf.exe
C:\Windows\system32\Kadfkhkf.exe
221⤵
PID:3264

C:\Windows\SysWOW64\Kgqocoin.exe
C:\Windows\system32\Kgqocoin.exe
222⤵
PID:3308

C:\Windows\SysWOW64\Kjokokha.exe
C:\Windows\system32\Kjokokha.exe
223⤵
PID:3424

C:\Windows\SysWOW64\Klngkfge.exe
C:\Windows\system32\Klngkfge.exe
224⤵
PID:3476

C:\Windows\SysWOW64\Kddomchg.exe
C:\Windows\system32\Kddomchg.exe
225⤵
PID:3516

C:\Windows\SysWOW64\Kffldlne.exe
C:\Windows\system32\Kffldlne.exe
226⤵
PID:3596

C:\Windows\SysWOW64\Kjahej32.exe
C:\Windows\system32\Kjahej32.exe
227⤵
PID:3676

C:\Windows\SysWOW64\Klpdaf32.exe
C:\Windows\system32\Klpdaf32.exe
228⤵
PID:3724

C:\Windows\SysWOW64\Kpkpadnl.exe
C:\Windows\system32\Kpkpadnl.exe
229⤵
PID:3792

C:\Windows\SysWOW64\Lgehno32.exe
C:\Windows\system32\Lgehno32.exe
230⤵
PID:3844

C:\Windows\SysWOW64\Ljddjj32.exe
C:\Windows\system32\Ljddjj32.exe
231⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3932

C:\Windows\SysWOW64\Lpnmgdli.exe
C:\Windows\system32\Lpnmgdli.exe
232⤵
- Modifies registry class
PID:3964

C:\Windows\SysWOW64\Lclicpkm.exe
C:\Windows\system32\Lclicpkm.exe
233⤵
PID:4084

C:\Windows\SysWOW64\Lfkeokjp.exe
C:\Windows\system32\Lfkeokjp.exe
234⤵
PID:3080

C:\Windows\SysWOW64\Ljfapjbi.exe
C:\Windows\system32\Ljfapjbi.exe
235⤵
PID:3196

C:\Windows\SysWOW64\Lkgngb32.exe
C:\Windows\system32\Lkgngb32.exe
236⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3276

C:\Windows\SysWOW64\Lcofio32.exe
C:\Windows\system32\Lcofio32.exe
237⤵
- System Location Discovery: System Language Discovery
PID:3344

C:\Windows\SysWOW64\Lfmbek32.exe
C:\Windows\system32\Lfmbek32.exe
238⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3412

C:\Windows\SysWOW64\Ldpbpgoh.exe
C:\Windows\system32\Ldpbpgoh.exe
239⤵
- Drops file in System32 directory
- Modifies registry class
PID:3492

C:\Windows\SysWOW64\Llgjaeoj.exe
C:\Windows\system32\Llgjaeoj.exe
240⤵
- Modifies registry class
PID:3584

C:\Windows\SysWOW64\Loefnpnn.exe
C:\Windows\system32\Loefnpnn.exe
241⤵
PID:3664

C:\Windows\SysWOW64\Lbcbjlmb.exe
C:\Windows\system32\Lbcbjlmb.exe
242⤵
PID:3720

C:\Windows\SysWOW64\Lhnkffeo.exe
C:\Windows\system32\Lhnkffeo.exe
243⤵
PID:3812

C:\Windows\SysWOW64\Lgqkbb32.exe
C:\Windows\system32\Lgqkbb32.exe
244⤵
PID:3908

C:\Windows\SysWOW64\Lqipkhbj.exe
C:\Windows\system32\Lqipkhbj.exe
245⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3948

C:\Windows\SysWOW64\Lddlkg32.exe
C:\Windows\system32\Lddlkg32.exe
246⤵
PID:4020

C:\Windows\SysWOW64\Mkndhabp.exe
C:\Windows\system32\Mkndhabp.exe
247⤵
PID:3144

C:\Windows\SysWOW64\Mnmpdlac.exe
C:\Windows\system32\Mnmpdlac.exe
248⤵
PID:3192

C:\Windows\SysWOW64\Mbhlek32.exe
C:\Windows\system32\Mbhlek32.exe
249⤵
PID:3352

C:\Windows\SysWOW64\Mcjhmcok.exe
C:\Windows\system32\Mcjhmcok.exe
250⤵
- Modifies registry class
PID:3396

C:\Windows\SysWOW64\Mgedmb32.exe
C:\Windows\system32\Mgedmb32.exe
251⤵
- System Location Discovery: System Language Discovery
PID:3520

C:\Windows\SysWOW64\Mnomjl32.exe
C:\Windows\system32\Mnomjl32.exe
252⤵
PID:3636

C:\Windows\SysWOW64\Mqnifg32.exe
C:\Windows\system32\Mqnifg32.exe
253⤵
PID:3684

C:\Windows\SysWOW64\Mggabaea.exe
C:\Windows\system32\Mggabaea.exe
254⤵
PID:1296

C:\Windows\SysWOW64\Mfjann32.exe
C:\Windows\system32\Mfjann32.exe
255⤵
- Modifies registry class
PID:3880

C:\Windows\SysWOW64\Mnaiol32.exe
C:\Windows\system32\Mnaiol32.exe
256⤵
PID:3976

C:\Windows\SysWOW64\Mnaiol32.exe
C:\Windows\system32\Mnaiol32.exe
257⤵
PID:3088

C:\Windows\SysWOW64\Mmdjkhdh.exe
C:\Windows\system32\Mmdjkhdh.exe
258⤵
PID:3108

C:\Windows\SysWOW64\Mqpflg32.exe
C:\Windows\system32\Mqpflg32.exe
259⤵
PID:3200

C:\Windows\SysWOW64\Mgjnhaco.exe
C:\Windows\system32\Mgjnhaco.exe
260⤵
PID:3372

C:\Windows\SysWOW64\Mmgfqh32.exe
C:\Windows\system32\Mmgfqh32.exe
261⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3488

C:\Windows\SysWOW64\Mpebmc32.exe
C:\Windows\system32\Mpebmc32.exe
262⤵
PID:3592

C:\Windows\SysWOW64\Mfokinhf.exe
C:\Windows\system32\Mfokinhf.exe
263⤵
- System Location Discovery: System Language Discovery
PID:3764

C:\Windows\SysWOW64\Mimgeigj.exe
C:\Windows\system32\Mimgeigj.exe
264⤵
PID:3876

C:\Windows\SysWOW64\Mmicfh32.exe
C:\Windows\system32\Mmicfh32.exe
265⤵
PID:3996

C:\Windows\SysWOW64\Mpgobc32.exe
C:\Windows\system32\Mpgobc32.exe
266⤵
- Drops file in System32 directory
PID:3172

C:\Windows\SysWOW64\Nfahomfd.exe
C:\Windows\system32\Nfahomfd.exe
267⤵
PID:3320

C:\Windows\SysWOW64\Nipdkieg.exe
C:\Windows\system32\Nipdkieg.exe
268⤵
PID:3444

C:\Windows\SysWOW64\Nmkplgnq.exe
C:\Windows\system32\Nmkplgnq.exe
269⤵
PID:3624

C:\Windows\SysWOW64\Nnmlcp32.exe
C:\Windows\system32\Nnmlcp32.exe
270⤵
- Drops file in System32 directory
PID:3728

C:\Windows\SysWOW64\Nbhhdnlh.exe
C:\Windows\system32\Nbhhdnlh.exe
271⤵
PID:3864

C:\Windows\SysWOW64\Nibqqh32.exe
C:\Windows\system32\Nibqqh32.exe
272⤵
PID:4068

C:\Windows\SysWOW64\Ngealejo.exe
C:\Windows\system32\Ngealejo.exe
273⤵
PID:3268

C:\Windows\SysWOW64\Nplimbka.exe
C:\Windows\system32\Nplimbka.exe
274⤵
PID:3464

C:\Windows\SysWOW64\Nbjeinje.exe
C:\Windows\system32\Nbjeinje.exe
275⤵
PID:3632

C:\Windows\SysWOW64\Nameek32.exe
C:\Windows\system32\Nameek32.exe
276⤵
PID:3836

C:\Windows\SysWOW64\Nlcibc32.exe
C:\Windows\system32\Nlcibc32.exe
277⤵
- Drops file in System32 directory
PID:4064

C:\Windows\SysWOW64\Njfjnpgp.exe
C:\Windows\system32\Njfjnpgp.exe
278⤵
- Drops file in System32 directory
PID:3224

C:\Windows\SysWOW64\Nnafnopi.exe
C:\Windows\system32\Nnafnopi.exe
279⤵
PID:3388

C:\Windows\SysWOW64\Neknki32.exe
C:\Windows\system32\Neknki32.exe
280⤵
PID:3644

C:\Windows\SysWOW64\Ncnngfna.exe
C:\Windows\system32\Ncnngfna.exe
281⤵
PID:3972

C:\Windows\SysWOW64\Njhfcp32.exe
C:\Windows\system32\Njhfcp32.exe
282⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1592

C:\Windows\SysWOW64\Nmfbpk32.exe
C:\Windows\system32\Nmfbpk32.exe
283⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3560

C:\Windows\SysWOW64\Nenkqi32.exe
C:\Windows\system32\Nenkqi32.exe
284⤵
- System Location Discovery: System Language Discovery
PID:3868

C:\Windows\SysWOW64\Nfoghakb.exe
C:\Windows\system32\Nfoghakb.exe
285⤵
- System Location Discovery: System Language Discovery
PID:3292

C:\Windows\SysWOW64\Onfoin32.exe
C:\Windows\system32\Onfoin32.exe
286⤵
- System Location Discovery: System Language Discovery
PID:3408

C:\Windows\SysWOW64\Oadkej32.exe
C:\Windows\system32\Oadkej32.exe
287⤵
PID:3768

C:\Windows\SysWOW64\Opglafab.exe
C:\Windows\system32\Opglafab.exe
288⤵
PID:3348

C:\Windows\SysWOW64\Oippjl32.exe
C:\Windows\system32\Oippjl32.exe
289⤵
PID:3928

C:\Windows\SysWOW64\Oaghki32.exe
C:\Windows\system32\Oaghki32.exe
290⤵
- Drops file in System32 directory
PID:3128

C:\Windows\SysWOW64\Odedge32.exe
C:\Windows\system32\Odedge32.exe
291⤵
PID:1448

C:\Windows\SysWOW64\Ofcqcp32.exe
C:\Windows\system32\Ofcqcp32.exe
292⤵
PID:3528

C:\Windows\SysWOW64\Oibmpl32.exe
C:\Windows\system32\Oibmpl32.exe
293⤵
PID:3280

C:\Windows\SysWOW64\Oplelf32.exe
C:\Windows\system32\Oplelf32.exe
294⤵
PID:4124

C:\Windows\SysWOW64\Odgamdef.exe
C:\Windows\system32\Odgamdef.exe
295⤵
PID:4164

C:\Windows\SysWOW64\Oeindm32.exe
C:\Windows\system32\Oeindm32.exe
296⤵
PID:4204

C:\Windows\SysWOW64\Oidiekdn.exe
C:\Windows\system32\Oidiekdn.exe
297⤵
- Modifies registry class
PID:4244

C:\Windows\SysWOW64\Opnbbe32.exe
C:\Windows\system32\Opnbbe32.exe
298⤵
- Drops file in System32 directory
PID:4284

C:\Windows\SysWOW64\Ooabmbbe.exe
C:\Windows\system32\Ooabmbbe.exe
299⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4324

C:\Windows\SysWOW64\Oekjjl32.exe
C:\Windows\system32\Oekjjl32.exe
300⤵
PID:4364

C:\Windows\SysWOW64\Ohiffh32.exe
C:\Windows\system32\Ohiffh32.exe
301⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:4404

C:\Windows\SysWOW64\Olebgfao.exe
C:\Windows\system32\Olebgfao.exe
302⤵
PID:4444

C:\Windows\SysWOW64\Opqoge32.exe
C:\Windows\system32\Opqoge32.exe
303⤵
PID:4484

C:\Windows\SysWOW64\Oabkom32.exe
C:\Windows\system32\Oabkom32.exe
304⤵
- System Location Discovery: System Language Discovery
PID:4524

C:\Windows\SysWOW64\Phlclgfc.exe
C:\Windows\system32\Phlclgfc.exe
305⤵
PID:4564

C:\Windows\SysWOW64\Pofkha32.exe
C:\Windows\system32\Pofkha32.exe
306⤵
PID:4604

C:\Windows\SysWOW64\Pbagipfi.exe
C:\Windows\system32\Pbagipfi.exe
307⤵
- Drops file in System32 directory
PID:4644

C:\Windows\SysWOW64\Pepcelel.exe
C:\Windows\system32\Pepcelel.exe
308⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4684

C:\Windows\SysWOW64\Pdbdqh32.exe
C:\Windows\system32\Pdbdqh32.exe
309⤵
- System Location Discovery: System Language Discovery
PID:4724

C:\Windows\SysWOW64\Pkmlmbcd.exe
C:\Windows\system32\Pkmlmbcd.exe
310⤵
PID:4764

C:\Windows\SysWOW64\Pafdjmkq.exe
C:\Windows\system32\Pafdjmkq.exe
311⤵
PID:4804

C:\Windows\SysWOW64\Pebpkk32.exe
C:\Windows\system32\Pebpkk32.exe
312⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4844

C:\Windows\SysWOW64\Pgcmbcih.exe
C:\Windows\system32\Pgcmbcih.exe
313⤵
PID:4884

C:\Windows\SysWOW64\Pkoicb32.exe
C:\Windows\system32\Pkoicb32.exe
314⤵
PID:4924

C:\Windows\SysWOW64\Pojecajj.exe
C:\Windows\system32\Pojecajj.exe
315⤵
PID:4968

C:\Windows\SysWOW64\Pplaki32.exe
C:\Windows\system32\Pplaki32.exe
316⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5008

C:\Windows\SysWOW64\Pgfjhcge.exe
C:\Windows\system32\Pgfjhcge.exe
317⤵
PID:5048

C:\Windows\SysWOW64\Pkaehb32.exe
C:\Windows\system32\Pkaehb32.exe
318⤵
PID:5088

C:\Windows\SysWOW64\Pmpbdm32.exe
C:\Windows\system32\Pmpbdm32.exe
319⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3368

C:\Windows\SysWOW64\Ppnnai32.exe
C:\Windows\system32\Ppnnai32.exe
320⤵
PID:4112

C:\Windows\SysWOW64\Pdjjag32.exe
C:\Windows\system32\Pdjjag32.exe
321⤵
- Drops file in System32 directory
PID:4152

C:\Windows\SysWOW64\Pghfnc32.exe
C:\Windows\system32\Pghfnc32.exe
322⤵
PID:4216

C:\Windows\SysWOW64\Pnbojmmp.exe
C:\Windows\system32\Pnbojmmp.exe
323⤵
PID:4256

C:\Windows\SysWOW64\Qppkfhlc.exe
C:\Windows\system32\Qppkfhlc.exe
324⤵
PID:4320

C:\Windows\SysWOW64\Qcogbdkg.exe
C:\Windows\system32\Qcogbdkg.exe
325⤵
PID:4360

C:\Windows\SysWOW64\Qiioon32.exe
C:\Windows\system32\Qiioon32.exe
326⤵
PID:4420

C:\Windows\SysWOW64\Qpbglhjq.exe
C:\Windows\system32\Qpbglhjq.exe
327⤵
PID:4468

C:\Windows\SysWOW64\Qdncmgbj.exe
C:\Windows\system32\Qdncmgbj.exe
328⤵
PID:4512

C:\Windows\SysWOW64\Qeppdo32.exe
C:\Windows\system32\Qeppdo32.exe
329⤵
PID:4556

C:\Windows\SysWOW64\Qnghel32.exe
C:\Windows\system32\Qnghel32.exe
330⤵
PID:4612

C:\Windows\SysWOW64\Apedah32.exe
C:\Windows\system32\Apedah32.exe
331⤵
- Modifies registry class
PID:4664

C:\Windows\SysWOW64\Accqnc32.exe
C:\Windows\system32\Accqnc32.exe
332⤵
PID:4712

C:\Windows\SysWOW64\Ajmijmnn.exe
C:\Windows\system32\Ajmijmnn.exe
333⤵
PID:4756

C:\Windows\SysWOW64\Ahpifj32.exe
C:\Windows\system32\Ahpifj32.exe
334⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4812

C:\Windows\SysWOW64\Aojabdlf.exe
C:\Windows\system32\Aojabdlf.exe
335⤵
- System Location Discovery: System Language Discovery
PID:4860

C:\Windows\SysWOW64\Acfmcc32.exe
C:\Windows\system32\Acfmcc32.exe
336⤵
PID:4908

C:\Windows\SysWOW64\Aaimopli.exe
C:\Windows\system32\Aaimopli.exe
337⤵
PID:4960

C:\Windows\SysWOW64\Ahbekjcf.exe
C:\Windows\system32\Ahbekjcf.exe
338⤵
PID:5016

C:\Windows\SysWOW64\Alnalh32.exe
C:\Windows\system32\Alnalh32.exe
339⤵
- Drops file in System32 directory
PID:5068

C:\Windows\SysWOW64\Aakjdo32.exe
C:\Windows\system32\Aakjdo32.exe
340⤵
PID:5100

C:\Windows\SysWOW64\Ahebaiac.exe
C:\Windows\system32\Ahebaiac.exe
341⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4100

C:\Windows\SysWOW64\Alqnah32.exe
C:\Windows\system32\Alqnah32.exe
342⤵
PID:4180

C:\Windows\SysWOW64\Anbkipok.exe
C:\Windows\system32\Anbkipok.exe
343⤵
PID:4236

C:\Windows\SysWOW64\Aficjnpm.exe
C:\Windows\system32\Aficjnpm.exe
344⤵
- Modifies registry class
PID:4308

C:\Windows\SysWOW64\Ahgofi32.exe
C:\Windows\system32\Ahgofi32.exe
345⤵
PID:4352

C:\Windows\SysWOW64\Akfkbd32.exe
C:\Windows\system32\Akfkbd32.exe
346⤵
PID:4416

C:\Windows\SysWOW64\Aoagccfn.exe
C:\Windows\system32\Aoagccfn.exe
347⤵
- Modifies registry class
PID:4492

C:\Windows\SysWOW64\Abpcooea.exe
C:\Windows\system32\Abpcooea.exe
348⤵
PID:4536

C:\Windows\SysWOW64\Aqbdkk32.exe
C:\Windows\system32\Aqbdkk32.exe
349⤵
PID:4596

C:\Windows\SysWOW64\Bgllgedi.exe
C:\Windows\system32\Bgllgedi.exe
350⤵
- Drops file in System32 directory
PID:4668

C:\Windows\SysWOW64\Bkhhhd32.exe
C:\Windows\system32\Bkhhhd32.exe
351⤵
PID:4696

C:\Windows\SysWOW64\Bnfddp32.exe
C:\Windows\system32\Bnfddp32.exe
352⤵
PID:4788

C:\Windows\SysWOW64\Bdqlajbb.exe
C:\Windows\system32\Bdqlajbb.exe
353⤵
- System Location Discovery: System Language Discovery
PID:4852

C:\Windows\SysWOW64\Bccmmf32.exe
C:\Windows\system32\Bccmmf32.exe
354⤵
PID:4920

C:\Windows\SysWOW64\Bgoime32.exe
C:\Windows\system32\Bgoime32.exe
355⤵
PID:4976

C:\Windows\SysWOW64\Bniajoic.exe
C:\Windows\system32\Bniajoic.exe
356⤵
PID:5056

C:\Windows\SysWOW64\Bmlael32.exe
C:\Windows\system32\Bmlael32.exe
357⤵
PID:5116

C:\Windows\SysWOW64\Bfdenafn.exe
C:\Windows\system32\Bfdenafn.exe
358⤵
PID:4148

C:\Windows\SysWOW64\Bmnnkl32.exe
C:\Windows\system32\Bmnnkl32.exe
359⤵
PID:4176

C:\Windows\SysWOW64\Bgcbhd32.exe
C:\Windows\system32\Bgcbhd32.exe
360⤵
PID:4272

C:\Windows\SysWOW64\Bjbndpmd.exe
C:\Windows\system32\Bjbndpmd.exe
361⤵
PID:4348

C:\Windows\SysWOW64\Bmpkqklh.exe
C:\Windows\system32\Bmpkqklh.exe
362⤵
PID:4432

C:\Windows\SysWOW64\Bqlfaj32.exe
C:\Windows\system32\Bqlfaj32.exe
363⤵
PID:4504

C:\Windows\SysWOW64\Bfioia32.exe
C:\Windows\system32\Bfioia32.exe
364⤵
PID:4540

C:\Windows\SysWOW64\Bjdkjpkb.exe
C:\Windows\system32\Bjdkjpkb.exe
365⤵
PID:4652

C:\Windows\SysWOW64\Bmbgfkje.exe
C:\Windows\system32\Bmbgfkje.exe
366⤵
PID:4748

C:\Windows\SysWOW64\Coacbfii.exe
C:\Windows\system32\Coacbfii.exe
367⤵
PID:4792

C:\Windows\SysWOW64\Cbppnbhm.exe
C:\Windows\system32\Cbppnbhm.exe
368⤵
PID:4904

C:\Windows\SysWOW64\Ciihklpj.exe
C:\Windows\system32\Ciihklpj.exe
369⤵
PID:4980

C:\Windows\SysWOW64\Ckhdggom.exe
C:\Windows\system32\Ckhdggom.exe
370⤵
PID:5044

C:\Windows\SysWOW64\Cnfqccna.exe
C:\Windows\system32\Cnfqccna.exe
371⤵
PID:3084

C:\Windows\SysWOW64\Cfmhdpnc.exe
C:\Windows\system32\Cfmhdpnc.exe
372⤵
- Drops file in System32 directory
PID:4188

C:\Windows\SysWOW64\Cepipm32.exe
C:\Windows\system32\Cepipm32.exe
373⤵
PID:4232

C:\Windows\SysWOW64\Ckjamgmk.exe
C:\Windows\system32\Ckjamgmk.exe
374⤵
PID:4400

C:\Windows\SysWOW64\Cpfmmf32.exe
C:\Windows\system32\Cpfmmf32.exe
375⤵
PID:4452

C:\Windows\SysWOW64\Cagienkb.exe
C:\Windows\system32\Cagienkb.exe
376⤵
PID:4584

C:\Windows\SysWOW64\Cgaaah32.exe
C:\Windows\system32\Cgaaah32.exe
377⤵
PID:4660

C:\Windows\SysWOW64\Cjonncab.exe
C:\Windows\system32\Cjonncab.exe
378⤵
- Drops file in System32 directory
PID:4752

C:\Windows\SysWOW64\Cbffoabe.exe
C:\Windows\system32\Cbffoabe.exe
379⤵
PID:4864

C:\Windows\SysWOW64\Ceebklai.exe
C:\Windows\system32\Ceebklai.exe
380⤵
PID:4984

C:\Windows\SysWOW64\Clojhf32.exe
C:\Windows\system32\Clojhf32.exe
381⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5072

C:\Windows\SysWOW64\Cnmfdb32.exe
C:\Windows\system32\Cnmfdb32.exe
382⤵
- Drops file in System32 directory
PID:3760

C:\Windows\SysWOW64\Calcpm32.exe
C:\Windows\system32\Calcpm32.exe
383⤵
PID:4252

C:\Windows\SysWOW64\Cgfkmgnj.exe
C:\Windows\system32\Cgfkmgnj.exe
384⤵
PID:4344

C:\Windows\SysWOW64\Djdgic32.exe
C:\Windows\system32\Djdgic32.exe
385⤵
- Drops file in System32 directory
PID:4456

C:\Windows\SysWOW64\Danpemej.exe
C:\Windows\system32\Danpemej.exe
386⤵
PID:4576

C:\Windows\SysWOW64\Dcllbhdn.exe
C:\Windows\system32\Dcllbhdn.exe
387⤵
- Modifies registry class
PID:4704

C:\Windows\SysWOW64\Dhhhbg32.exe
C:\Windows\system32\Dhhhbg32.exe
388⤵
PID:4816

C:\Windows\SysWOW64\Dfkhndca.exe
C:\Windows\system32\Dfkhndca.exe
389⤵
PID:4940

C:\Windows\SysWOW64\Diidjpbe.exe
C:\Windows\system32\Diidjpbe.exe
390⤵
PID:5080

C:\Windows\SysWOW64\Dcohghbk.exe
C:\Windows\system32\Dcohghbk.exe
391⤵
PID:4156

C:\Windows\SysWOW64\Dfmeccao.exe
C:\Windows\system32\Dfmeccao.exe
392⤵
PID:4276

C:\Windows\SysWOW64\Dmgmpnhl.exe
C:\Windows\system32\Dmgmpnhl.exe
393⤵
PID:4436

C:\Windows\SysWOW64\Dpeiligo.exe
C:\Windows\system32\Dpeiligo.exe
394⤵
PID:4616

C:\Windows\SysWOW64\Dbdehdfc.exe
C:\Windows\system32\Dbdehdfc.exe
395⤵
PID:4744

C:\Windows\SysWOW64\Debadpeg.exe
C:\Windows\system32\Debadpeg.exe
396⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4916

C:\Windows\SysWOW64\Dmijfmfi.exe
C:\Windows\system32\Dmijfmfi.exe
397⤵
- System Location Discovery: System Language Discovery
PID:5036

C:\Windows\SysWOW64\Dlljaj32.exe
C:\Windows\system32\Dlljaj32.exe
398⤵
PID:4144

C:\Windows\SysWOW64\Dfbnoc32.exe
C:\Windows\system32\Dfbnoc32.exe
399⤵
PID:4332

C:\Windows\SysWOW64\Domccejd.exe
C:\Windows\system32\Domccejd.exe
400⤵
PID:4560

C:\Windows\SysWOW64\Dbiocd32.exe
C:\Windows\system32\Dbiocd32.exe
401⤵
- Drops file in System32 directory
PID:4692

C:\Windows\SysWOW64\Eibgpnjk.exe
C:\Windows\system32\Eibgpnjk.exe
402⤵
- Drops file in System32 directory
PID:4828

C:\Windows\SysWOW64\Eheglk32.exe
C:\Windows\system32\Eheglk32.exe
403⤵
PID:4160

C:\Windows\SysWOW64\Ekdchf32.exe
C:\Windows\system32\Ekdchf32.exe
404⤵
- Drops file in System32 directory
PID:4264

C:\Windows\SysWOW64\Ebklic32.exe
C:\Windows\system32\Ebklic32.exe
405⤵
- System Location Discovery: System Language Discovery
PID:4480

C:\Windows\SysWOW64\Edlhqlfi.exe
C:\Windows\system32\Edlhqlfi.exe
406⤵
PID:4772

C:\Windows\SysWOW64\Ekfpmf32.exe
C:\Windows\system32\Ekfpmf32.exe
407⤵
PID:5040

C:\Windows\SysWOW64\Emdmjamj.exe
C:\Windows\system32\Emdmjamj.exe
408⤵
- Modifies registry class
PID:4212

C:\Windows\SysWOW64\Eeldkonl.exe
C:\Windows\system32\Eeldkonl.exe
409⤵
PID:4508

C:\Windows\SysWOW64\Ekhmcelc.exe
C:\Windows\system32\Ekhmcelc.exe
410⤵
PID:4776

C:\Windows\SysWOW64\Eodicd32.exe
C:\Windows\system32\Eodicd32.exe
411⤵
PID:4948

C:\Windows\SysWOW64\Epeekmjk.exe
C:\Windows\system32\Epeekmjk.exe
412⤵
- Drops file in System32 directory
PID:4396

C:\Windows\SysWOW64\Ehlmljkm.exe
C:\Windows\system32\Ehlmljkm.exe
413⤵
PID:4720

C:\Windows\SysWOW64\Ekkjheja.exe
C:\Windows\system32\Ekkjheja.exe
414⤵
PID:3184

C:\Windows\SysWOW64\Emifeqid.exe
C:\Windows\system32\Emifeqid.exe
415⤵
PID:4620

C:\Windows\SysWOW64\Ephbal32.exe
C:\Windows\system32\Ephbal32.exe
416⤵
- Modifies registry class
PID:4880

C:\Windows\SysWOW64\Ecfnmh32.exe
C:\Windows\system32\Ecfnmh32.exe
417⤵
PID:4392

C:\Windows\SysWOW64\Eipgjaoi.exe
C:\Windows\system32\Eipgjaoi.exe
418⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1056

C:\Windows\SysWOW64\Fmlbjq32.exe
C:\Windows\system32\Fmlbjq32.exe
419⤵
PID:4588

C:\Windows\SysWOW64\Fpjofl32.exe
C:\Windows\system32\Fpjofl32.exe
420⤵
PID:4340

C:\Windows\SysWOW64\Feggob32.exe
C:\Windows\system32\Feggob32.exe
421⤵
PID:4964

C:\Windows\SysWOW64\Fibcoalf.exe
C:\Windows\system32\Fibcoalf.exe
422⤵
PID:5104

C:\Windows\SysWOW64\Fplllkdc.exe
C:\Windows\system32\Fplllkdc.exe
423⤵
- Drops file in System32 directory
- Modifies registry class
PID:4140

C:\Windows\SysWOW64\Fgfdie32.exe
C:\Windows\system32\Fgfdie32.exe
424⤵
PID:5144

C:\Windows\SysWOW64\Fiepea32.exe
C:\Windows\system32\Fiepea32.exe
425⤵
PID:5184

C:\Windows\SysWOW64\Fhgppnan.exe
C:\Windows\system32\Fhgppnan.exe
426⤵
PID:5224

C:\Windows\SysWOW64\Fpohakbp.exe
C:\Windows\system32\Fpohakbp.exe
427⤵
PID:5264

C:\Windows\SysWOW64\Fapeic32.exe
C:\Windows\system32\Fapeic32.exe
428⤵
PID:5304

C:\Windows\SysWOW64\Felajbpg.exe
C:\Windows\system32\Felajbpg.exe
429⤵
PID:5344

C:\Windows\SysWOW64\Fhjmfnok.exe
C:\Windows\system32\Fhjmfnok.exe
430⤵
PID:5384

C:\Windows\SysWOW64\Fleifl32.exe
C:\Windows\system32\Fleifl32.exe
431⤵
PID:5424

C:\Windows\SysWOW64\Fabaocfl.exe
C:\Windows\system32\Fabaocfl.exe
432⤵
PID:5464

C:\Windows\SysWOW64\Fdqnkoep.exe
C:\Windows\system32\Fdqnkoep.exe
433⤵
PID:5504

C:\Windows\SysWOW64\Fkkfgi32.exe
C:\Windows\system32\Fkkfgi32.exe
434⤵
PID:5544

C:\Windows\SysWOW64\Fofbhgde.exe
C:\Windows\system32\Fofbhgde.exe
435⤵
PID:5584

C:\Windows\SysWOW64\Fnibcd32.exe
C:\Windows\system32\Fnibcd32.exe
436⤵
- Modifies registry class
PID:5624

C:\Windows\SysWOW64\Fepjea32.exe
C:\Windows\system32\Fepjea32.exe
437⤵
- Drops file in System32 directory
PID:5664

C:\Windows\SysWOW64\Ggagmjbq.exe
C:\Windows\system32\Ggagmjbq.exe
438⤵
- System Location Discovery: System Language Discovery
PID:5704

C:\Windows\SysWOW64\Goiongbc.exe
C:\Windows\system32\Goiongbc.exe
439⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5744

C:\Windows\SysWOW64\Gpjkeoha.exe
C:\Windows\system32\Gpjkeoha.exe
440⤵
PID:5784

C:\Windows\SysWOW64\Ghacfmic.exe
C:\Windows\system32\Ghacfmic.exe
441⤵
PID:5824

C:\Windows\SysWOW64\Ggdcbi32.exe
C:\Windows\system32\Ggdcbi32.exe
442⤵
PID:5864

C:\Windows\SysWOW64\Gnnlocgk.exe
C:\Windows\system32\Gnnlocgk.exe
443⤵
PID:5904

C:\Windows\SysWOW64\Gqlhkofn.exe
C:\Windows\system32\Gqlhkofn.exe
444⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5944

C:\Windows\SysWOW64\Gckdgjeb.exe
C:\Windows\system32\Gckdgjeb.exe
445⤵
- Drops file in System32 directory
- Modifies registry class
PID:5984

C:\Windows\SysWOW64\Ggfpgi32.exe
C:\Windows\system32\Ggfpgi32.exe
446⤵
- Modifies registry class
PID:6024

C:\Windows\SysWOW64\Gnphdceh.exe
C:\Windows\system32\Gnphdceh.exe
447⤵
PID:6064

C:\Windows\SysWOW64\Gqodqodl.exe
C:\Windows\system32\Gqodqodl.exe
448⤵
- Drops file in System32 directory
PID:6104

C:\Windows\SysWOW64\Gcmamj32.exe
C:\Windows\system32\Gcmamj32.exe
449⤵
PID:5064

C:\Windows\SysWOW64\Gjgiidkl.exe
C:\Windows\system32\Gjgiidkl.exe
450⤵
PID:5156

C:\Windows\SysWOW64\Gnbejb32.exe
C:\Windows\system32\Gnbejb32.exe
451⤵
PID:5196

C:\Windows\SysWOW64\Godaakic.exe
C:\Windows\system32\Godaakic.exe
452⤵
- System Location Discovery: System Language Discovery
PID:5256

C:\Windows\SysWOW64\Gconbj32.exe
C:\Windows\system32\Gconbj32.exe
453⤵
- System Location Discovery: System Language Discovery
PID:5288

C:\Windows\SysWOW64\Gjifodii.exe
C:\Windows\system32\Gjifodii.exe
454⤵
PID:5360

C:\Windows\SysWOW64\Ghlfjq32.exe
C:\Windows\system32\Ghlfjq32.exe
455⤵
PID:5396

C:\Windows\SysWOW64\Gqcnln32.exe
C:\Windows\system32\Gqcnln32.exe
456⤵
PID:5452

C:\Windows\SysWOW64\Hcajhi32.exe
C:\Windows\system32\Hcajhi32.exe
457⤵
PID:5500

C:\Windows\SysWOW64\Hfpfdeon.exe
C:\Windows\system32\Hfpfdeon.exe
458⤵
- System Location Discovery: System Language Discovery
PID:5556

C:\Windows\SysWOW64\Hjlbdc32.exe
C:\Windows\system32\Hjlbdc32.exe
459⤵
PID:5620

C:\Windows\SysWOW64\Hmjoqo32.exe
C:\Windows\system32\Hmjoqo32.exe
460⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5636

C:\Windows\SysWOW64\Hohkmj32.exe
C:\Windows\system32\Hohkmj32.exe
461⤵
PID:5700

C:\Windows\SysWOW64\Hbggif32.exe
C:\Windows\system32\Hbggif32.exe
462⤵
PID:5764

C:\Windows\SysWOW64\Hdecea32.exe
C:\Windows\system32\Hdecea32.exe
463⤵
PID:5820

C:\Windows\SysWOW64\Hmlkfo32.exe
C:\Windows\system32\Hmlkfo32.exe
464⤵
PID:5856

C:\Windows\SysWOW64\Hokhbj32.exe
C:\Windows\system32\Hokhbj32.exe
465⤵
PID:5912

C:\Windows\SysWOW64\Hfepod32.exe
C:\Windows\system32\Hfepod32.exe
466⤵
PID:5960

C:\Windows\SysWOW64\Hiclkp32.exe
C:\Windows\system32\Hiclkp32.exe
467⤵
- Drops file in System32 directory
PID:6020

C:\Windows\SysWOW64\Homdhjai.exe
C:\Windows\system32\Homdhjai.exe
468⤵
PID:6060

C:\Windows\SysWOW64\Hnpdcf32.exe
C:\Windows\system32\Hnpdcf32.exe
469⤵
PID:6112

C:\Windows\SysWOW64\Hejmpqop.exe
C:\Windows\system32\Hejmpqop.exe
470⤵
PID:5128

C:\Windows\SysWOW64\Hieiqo32.exe
C:\Windows\system32\Hieiqo32.exe
471⤵
- Drops file in System32 directory
PID:5204

C:\Windows\SysWOW64\Hkdemk32.exe
C:\Windows\system32\Hkdemk32.exe
472⤵
PID:5240

C:\Windows\SysWOW64\Hnbaif32.exe
C:\Windows\system32\Hnbaif32.exe
473⤵
PID:5276

C:\Windows\SysWOW64\Haqnea32.exe
C:\Windows\system32\Haqnea32.exe
474⤵
PID:5372

C:\Windows\SysWOW64\Hcojam32.exe
C:\Windows\system32\Hcojam32.exe
475⤵
- Modifies registry class
PID:5412

C:\Windows\SysWOW64\Ikfbbjdj.exe
C:\Windows\system32\Ikfbbjdj.exe
476⤵
- System Location Discovery: System Language Discovery
PID:5492

C:\Windows\SysWOW64\Ijibng32.exe
C:\Windows\system32\Ijibng32.exe
477⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5552

C:\Windows\SysWOW64\Iacjjacb.exe
C:\Windows\system32\Iacjjacb.exe
478⤵
- System Location Discovery: System Language Discovery
PID:5616

C:\Windows\SysWOW64\Icafgmbe.exe
C:\Windows\system32\Icafgmbe.exe
479⤵
PID:5672

C:\Windows\SysWOW64\Ifpcchai.exe
C:\Windows\system32\Ifpcchai.exe
480⤵
PID:5736

C:\Windows\SysWOW64\Ingkdeak.exe
C:\Windows\system32\Ingkdeak.exe
481⤵
PID:5796

C:\Windows\SysWOW64\Imjkpb32.exe
C:\Windows\system32\Imjkpb32.exe
482⤵
PID:5884

C:\Windows\SysWOW64\Iphgln32.exe
C:\Windows\system32\Iphgln32.exe
483⤵
PID:5916

C:\Windows\SysWOW64\Igoomk32.exe
C:\Windows\system32\Igoomk32.exe
484⤵
PID:6000

C:\Windows\SysWOW64\Ijnkifgp.exe
C:\Windows\system32\Ijnkifgp.exe
485⤵
PID:6052

C:\Windows\SysWOW64\Imlhebfc.exe
C:\Windows\system32\Imlhebfc.exe
486⤵
PID:6128

C:\Windows\SysWOW64\Ipjdameg.exe
C:\Windows\system32\Ipjdameg.exe
487⤵
PID:5152

C:\Windows\SysWOW64\Ibipmiek.exe
C:\Windows\system32\Ibipmiek.exe
488⤵
PID:5216

C:\Windows\SysWOW64\Ijphofem.exe
C:\Windows\system32\Ijphofem.exe
489⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5296

C:\Windows\SysWOW64\Iichjc32.exe
C:\Windows\system32\Iichjc32.exe
490⤵
PID:5368

C:\Windows\SysWOW64\Iladfn32.exe
C:\Windows\system32\Iladfn32.exe
491⤵
- Modifies registry class
PID:5440

C:\Windows\SysWOW64\Ibkmchbh.exe
C:\Windows\system32\Ibkmchbh.exe
492⤵
PID:5520

C:\Windows\SysWOW64\Ifgicg32.exe
C:\Windows\system32\Ifgicg32.exe
493⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5612

C:\Windows\SysWOW64\Imaapa32.exe
C:\Windows\system32\Imaapa32.exe
494⤵
- Drops file in System32 directory
PID:5676

C:\Windows\SysWOW64\Ipomlm32.exe
C:\Windows\system32\Ipomlm32.exe
495⤵
PID:5776

C:\Windows\SysWOW64\Jfieigio.exe
C:\Windows\system32\Jfieigio.exe
496⤵
PID:5848

C:\Windows\SysWOW64\Jelfdc32.exe
C:\Windows\system32\Jelfdc32.exe
497⤵
PID:5892

C:\Windows\SysWOW64\Jlfnangf.exe
C:\Windows\system32\Jlfnangf.exe
498⤵
PID:6008

C:\Windows\SysWOW64\Jndjmifj.exe
C:\Windows\system32\Jndjmifj.exe
499⤵
- System Location Discovery: System Language Discovery
PID:6096

C:\Windows\SysWOW64\Jbpfnh32.exe
C:\Windows\system32\Jbpfnh32.exe
500⤵
PID:5140

C:\Windows\SysWOW64\Jenbjc32.exe
C:\Windows\system32\Jenbjc32.exe
501⤵
PID:5232

C:\Windows\SysWOW64\Jhmofo32.exe
C:\Windows\system32\Jhmofo32.exe
502⤵
PID:5328

C:\Windows\SysWOW64\Jjkkbjln.exe
C:\Windows\system32\Jjkkbjln.exe
503⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5436

C:\Windows\SysWOW64\Jbbccgmp.exe
C:\Windows\system32\Jbbccgmp.exe
504⤵
PID:5524

C:\Windows\SysWOW64\Jeqopcld.exe
C:\Windows\system32\Jeqopcld.exe
505⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5652

C:\Windows\SysWOW64\Jjnhhjjk.exe
C:\Windows\system32\Jjnhhjjk.exe
506⤵
PID:5720

C:\Windows\SysWOW64\Jmlddeio.exe
C:\Windows\system32\Jmlddeio.exe
507⤵
PID:5808

C:\Windows\SysWOW64\Jdflqo32.exe
C:\Windows\system32\Jdflqo32.exe
508⤵
PID:5932

C:\Windows\SysWOW64\Jfdhmk32.exe
C:\Windows\system32\Jfdhmk32.exe
509⤵
PID:5996

C:\Windows\SysWOW64\Jokqnhpa.exe
C:\Windows\system32\Jokqnhpa.exe
510⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6120

C:\Windows\SysWOW64\Jmnqje32.exe
C:\Windows\system32\Jmnqje32.exe
511⤵
PID:5176

C:\Windows\SysWOW64\Jdhifooi.exe
C:\Windows\system32\Jdhifooi.exe
512⤵
PID:5292

C:\Windows\SysWOW64\Jhdegn32.exe
C:\Windows\system32\Jhdegn32.exe
513⤵
PID:5432

C:\Windows\SysWOW64\Jieaofmp.exe
C:\Windows\system32\Jieaofmp.exe
514⤵
PID:5600

C:\Windows\SysWOW64\Kalipcmb.exe
C:\Windows\system32\Kalipcmb.exe
515⤵
PID:5660

C:\Windows\SysWOW64\Kdkelolf.exe
C:\Windows\system32\Kdkelolf.exe
516⤵
PID:5780

C:\Windows\SysWOW64\Kfibhjlj.exe
C:\Windows\system32\Kfibhjlj.exe
517⤵
- System Location Discovery: System Language Discovery
PID:5896

C:\Windows\SysWOW64\Kmcjedcg.exe
C:\Windows\system32\Kmcjedcg.exe
518⤵
PID:6092

C:\Windows\SysWOW64\Klfjpa32.exe
C:\Windows\system32\Klfjpa32.exe
519⤵
PID:4240

C:\Windows\SysWOW64\Kdmban32.exe
C:\Windows\system32\Kdmban32.exe
520⤵
PID:5272

C:\Windows\SysWOW64\Kgkonj32.exe
C:\Windows\system32\Kgkonj32.exe
521⤵
PID:5444

C:\Windows\SysWOW64\Kijkje32.exe
C:\Windows\system32\Kijkje32.exe
522⤵
PID:5564

C:\Windows\SysWOW64\Kpdcfoph.exe
C:\Windows\system32\Kpdcfoph.exe
523⤵
PID:5740

C:\Windows\SysWOW64\Kgnkci32.exe
C:\Windows\system32\Kgnkci32.exe
524⤵
PID:5956

C:\Windows\SysWOW64\Keqkofno.exe
C:\Windows\system32\Keqkofno.exe
525⤵
PID:6012

C:\Windows\SysWOW64\Kljdkpfl.exe
C:\Windows\system32\Kljdkpfl.exe
526⤵
PID:5132

C:\Windows\SysWOW64\Kpfplo32.exe
C:\Windows\system32\Kpfplo32.exe
527⤵
PID:5392

C:\Windows\SysWOW64\Kechdf32.exe
C:\Windows\system32\Kechdf32.exe
528⤵
- Drops file in System32 directory
PID:5528

C:\Windows\SysWOW64\Khadpa32.exe
C:\Windows\system32\Khadpa32.exe
529⤵
PID:5728

C:\Windows\SysWOW64\Kkpqlm32.exe
C:\Windows\system32\Kkpqlm32.exe
530⤵
PID:5900

C:\Windows\SysWOW64\Kajiigba.exe
C:\Windows\system32\Kajiigba.exe
531⤵
PID:6048

C:\Windows\SysWOW64\Keeeje32.exe
C:\Windows\system32\Keeeje32.exe
532⤵
PID:5208

C:\Windows\SysWOW64\Lhcafa32.exe
C:\Windows\system32\Lhcafa32.exe
533⤵
PID:5488

C:\Windows\SysWOW64\Lkbmbl32.exe
C:\Windows\system32\Lkbmbl32.exe
534⤵
PID:5332

C:\Windows\SysWOW64\Laleof32.exe
C:\Windows\system32\Laleof32.exe
535⤵
PID:5980

C:\Windows\SysWOW64\Legaoehg.exe
C:\Windows\system32\Legaoehg.exe
536⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4636

C:\Windows\SysWOW64\Lgingm32.exe
C:\Windows\system32\Lgingm32.exe
537⤵
- System Location Discovery: System Language Discovery
PID:5420

C:\Windows\SysWOW64\Lopfhk32.exe
C:\Windows\system32\Lopfhk32.exe
538⤵
PID:5688

C:\Windows\SysWOW64\Lncfcgeb.exe
C:\Windows\system32\Lncfcgeb.exe
539⤵
PID:6072

C:\Windows\SysWOW64\Lanbdf32.exe
C:\Windows\system32\Lanbdf32.exe
540⤵
PID:5284

C:\Windows\SysWOW64\Ldmopa32.exe
C:\Windows\system32\Ldmopa32.exe
541⤵
PID:5692

C:\Windows\SysWOW64\Lkggmldl.exe
C:\Windows\system32\Lkggmldl.exe
542⤵
PID:5952

C:\Windows\SysWOW64\Ljigih32.exe
C:\Windows\system32\Ljigih32.exe
543⤵
PID:5760

C:\Windows\SysWOW64\Lpcoeb32.exe
C:\Windows\system32\Lpcoeb32.exe
544⤵
PID:5836

C:\Windows\SysWOW64\Lcblan32.exe
C:\Windows\system32\Lcblan32.exe
545⤵
PID:5416

C:\Windows\SysWOW64\Ljldnhid.exe
C:\Windows\system32\Ljldnhid.exe
546⤵
- Modifies registry class
PID:5872

C:\Windows\SysWOW64\Lpflkb32.exe
C:\Windows\system32\Lpflkb32.exe
547⤵
PID:5536

C:\Windows\SysWOW64\Lcdhgn32.exe
C:\Windows\system32\Lcdhgn32.exe
548⤵
- Modifies registry class
PID:5476

C:\Windows\SysWOW64\Lfbdci32.exe
C:\Windows\system32\Lfbdci32.exe
549⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6076

C:\Windows\SysWOW64\Lnjldf32.exe
C:\Windows\system32\Lnjldf32.exe
550⤵
- Modifies registry class
PID:5976

C:\Windows\SysWOW64\Mphiqbon.exe
C:\Windows\system32\Mphiqbon.exe
551⤵
PID:5792

C:\Windows\SysWOW64\Mcfemmna.exe
C:\Windows\system32\Mcfemmna.exe
552⤵
PID:6172

C:\Windows\SysWOW64\Mgbaml32.exe
C:\Windows\system32\Mgbaml32.exe
553⤵
PID:6212

C:\Windows\SysWOW64\Mjcjog32.exe
C:\Windows\system32\Mjcjog32.exe
554⤵
- Drops file in System32 directory
PID:6252

C:\Windows\SysWOW64\Mhfjjdjf.exe
C:\Windows\system32\Mhfjjdjf.exe
555⤵
PID:6292

C:\Windows\SysWOW64\Mopbgn32.exe
C:\Windows\system32\Mopbgn32.exe
556⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6332

C:\Windows\SysWOW64\Mbnocipg.exe
C:\Windows\system32\Mbnocipg.exe
557⤵
PID:6372

C:\Windows\SysWOW64\Mdmkoepk.exe
C:\Windows\system32\Mdmkoepk.exe
558⤵
- Modifies registry class
PID:6416

C:\Windows\SysWOW64\Mmccqbpm.exe
C:\Windows\system32\Mmccqbpm.exe
559⤵
PID:6456

C:\Windows\SysWOW64\Mobomnoq.exe
C:\Windows\system32\Mobomnoq.exe
560⤵
PID:6496

C:\Windows\SysWOW64\Mneohj32.exe
C:\Windows\system32\Mneohj32.exe
561⤵
PID:6536

C:\Windows\SysWOW64\Mflgih32.exe
C:\Windows\system32\Mflgih32.exe
562⤵
PID:6576

C:\Windows\SysWOW64\Mdogedmh.exe
C:\Windows\system32\Mdogedmh.exe
563⤵
- System Location Discovery: System Language Discovery
PID:6620

C:\Windows\SysWOW64\Modlbmmn.exe
C:\Windows\system32\Modlbmmn.exe
564⤵
PID:6660

C:\Windows\SysWOW64\Mbchni32.exe
C:\Windows\system32\Mbchni32.exe
565⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6700

C:\Windows\SysWOW64\Ngpqfp32.exe
C:\Windows\system32\Ngpqfp32.exe
566⤵
PID:6740

C:\Windows\SysWOW64\Njnmbk32.exe
C:\Windows\system32\Njnmbk32.exe
567⤵
PID:6780

C:\Windows\SysWOW64\Nqhepeai.exe
C:\Windows\system32\Nqhepeai.exe
568⤵
- Drops file in System32 directory
PID:6820

C:\Windows\SysWOW64\Ncfalqpm.exe
C:\Windows\system32\Ncfalqpm.exe
569⤵
- Modifies registry class
PID:6860

C:\Windows\SysWOW64\Nknimnap.exe
C:\Windows\system32\Nknimnap.exe
570⤵
PID:6900

C:\Windows\SysWOW64\Nnleiipc.exe
C:\Windows\system32\Nnleiipc.exe
571⤵
PID:6940

C:\Windows\SysWOW64\Nqjaeeog.exe
C:\Windows\system32\Nqjaeeog.exe
572⤵
PID:6980

C:\Windows\SysWOW64\Ncinap32.exe
C:\Windows\system32\Ncinap32.exe
573⤵
PID:7020

C:\Windows\SysWOW64\Njbfnjeg.exe
C:\Windows\system32\Njbfnjeg.exe
574⤵
PID:7064

C:\Windows\SysWOW64\Nnnbni32.exe
C:\Windows\system32\Nnnbni32.exe
575⤵
- Drops file in System32 directory
PID:7104

C:\Windows\SysWOW64\Nqmnjd32.exe
C:\Windows\system32\Nqmnjd32.exe
576⤵
PID:7144

C:\Windows\SysWOW64\Nggggoda.exe
C:\Windows\system32\Nggggoda.exe
577⤵
PID:6152

C:\Windows\SysWOW64\Njeccjcd.exe
C:\Windows\system32\Njeccjcd.exe
578⤵
PID:6200

C:\Windows\SysWOW64\Nmcopebh.exe
C:\Windows\system32\Nmcopebh.exe
579⤵
PID:6240

C:\Windows\SysWOW64\Ncmglp32.exe
C:\Windows\system32\Ncmglp32.exe
580⤵
PID:6276

C:\Windows\SysWOW64\Nbpghl32.exe
C:\Windows\system32\Nbpghl32.exe
581⤵
- Drops file in System32 directory
PID:6340

C:\Windows\SysWOW64\Nijpdfhm.exe
C:\Windows\system32\Nijpdfhm.exe
582⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:6392

C:\Windows\SysWOW64\Npdhaq32.exe
C:\Windows\system32\Npdhaq32.exe
583⤵
PID:6440

C:\Windows\SysWOW64\Obbdml32.exe
C:\Windows\system32\Obbdml32.exe
584⤵
PID:6488

C:\Windows\SysWOW64\Oimmjffj.exe
C:\Windows\system32\Oimmjffj.exe
585⤵
PID:6544

C:\Windows\SysWOW64\Olkifaen.exe
C:\Windows\system32\Olkifaen.exe
586⤵
PID:6608

C:\Windows\SysWOW64\Obeacl32.exe
C:\Windows\system32\Obeacl32.exe
587⤵
PID:6560

C:\Windows\SysWOW64\Oecmogln.exe
C:\Windows\system32\Oecmogln.exe
588⤵
PID:6676

C:\Windows\SysWOW64\Ohbikbkb.exe
C:\Windows\system32\Ohbikbkb.exe
589⤵
- Modifies registry class
PID:6732

C:\Windows\SysWOW64\Onlahm32.exe
C:\Windows\system32\Onlahm32.exe
590⤵
PID:6788

C:\Windows\SysWOW64\Obgnhkkh.exe
C:\Windows\system32\Obgnhkkh.exe
591⤵
PID:6836

C:\Windows\SysWOW64\Oiafee32.exe
C:\Windows\system32\Oiafee32.exe
592⤵
PID:6896

C:\Windows\SysWOW64\Olpbaa32.exe
C:\Windows\system32\Olpbaa32.exe
593⤵
PID:6932

C:\Windows\SysWOW64\Objjnkie.exe
C:\Windows\system32\Objjnkie.exe
594⤵
PID:6988

C:\Windows\SysWOW64\Oehgjfhi.exe
C:\Windows\system32\Oehgjfhi.exe
595⤵
- Modifies registry class
PID:7036

C:\Windows\SysWOW64\Ohfcfb32.exe
C:\Windows\system32\Ohfcfb32.exe
596⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7092

C:\Windows\SysWOW64\Ojeobm32.exe
C:\Windows\system32\Ojeobm32.exe
597⤵
PID:7136

C:\Windows\SysWOW64\Omckoi32.exe
C:\Windows\system32\Omckoi32.exe
598⤵
PID:5968

C:\Windows\SysWOW64\Oejcpf32.exe
C:\Windows\system32\Oejcpf32.exe
599⤵
PID:6220

C:\Windows\SysWOW64\Oflpgnld.exe
C:\Windows\system32\Oflpgnld.exe
600⤵
PID:6268

C:\Windows\SysWOW64\Ojglhm32.exe
C:\Windows\system32\Ojglhm32.exe
601⤵
PID:3024

C:\Windows\SysWOW64\Pmehdh32.exe
C:\Windows\system32\Pmehdh32.exe
602⤵
PID:6396

C:\Windows\SysWOW64\Paaddgkj.exe
C:\Windows\system32\Paaddgkj.exe
603⤵
PID:6472

C:\Windows\SysWOW64\Pdppqbkn.exe
C:\Windows\system32\Pdppqbkn.exe
604⤵
PID:6524

C:\Windows\SysWOW64\Pfnmmn32.exe
C:\Windows\system32\Pfnmmn32.exe
605⤵
PID:6600

C:\Windows\SysWOW64\Piliii32.exe
C:\Windows\system32\Piliii32.exe
606⤵
PID:6644

C:\Windows\SysWOW64\Pmhejhao.exe
C:\Windows\system32\Pmhejhao.exe
607⤵
PID:6708

C:\Windows\SysWOW64\Pdbmfb32.exe
C:\Windows\system32\Pdbmfb32.exe
608⤵
PID:6768

C:\Windows\SysWOW64\Pjleclph.exe
C:\Windows\system32\Pjleclph.exe
609⤵
PID:6828

C:\Windows\SysWOW64\Pmjaohol.exe
C:\Windows\system32\Pmjaohol.exe
610⤵
- System Location Discovery: System Language Discovery
PID:6884

C:\Windows\SysWOW64\Pddjlb32.exe
C:\Windows\system32\Pddjlb32.exe
611⤵
PID:6956

C:\Windows\SysWOW64\Pfbfhm32.exe
C:\Windows\system32\Pfbfhm32.exe
612⤵
PID:7028

C:\Windows\SysWOW64\Piabdiep.exe
C:\Windows\system32\Piabdiep.exe
613⤵
PID:7088

C:\Windows\SysWOW64\Ppkjac32.exe
C:\Windows\system32\Ppkjac32.exe
614⤵
PID:7160

C:\Windows\SysWOW64\Pbigmn32.exe
C:\Windows\system32\Pbigmn32.exe
615⤵
PID:6188

C:\Windows\SysWOW64\Pehcij32.exe
C:\Windows\system32\Pehcij32.exe
616⤵
PID:6224

C:\Windows\SysWOW64\Plbkfdba.exe
C:\Windows\system32\Plbkfdba.exe
617⤵
- Modifies registry class
PID:6320

C:\Windows\SysWOW64\Popgboae.exe
C:\Windows\system32\Popgboae.exe
618⤵
- Drops file in System32 directory
PID:6404

C:\Windows\SysWOW64\Paocnkph.exe
C:\Windows\system32\Paocnkph.exe
619⤵
PID:6484

C:\Windows\SysWOW64\Qiflohqk.exe
C:\Windows\system32\Qiflohqk.exe
620⤵
PID:6548

C:\Windows\SysWOW64\Qldhkc32.exe
C:\Windows\system32\Qldhkc32.exe
621⤵
PID:6636

C:\Windows\SysWOW64\Qobdgo32.exe
C:\Windows\system32\Qobdgo32.exe
622⤵
PID:6728

C:\Windows\SysWOW64\Qaapcj32.exe
C:\Windows\system32\Qaapcj32.exe
623⤵
PID:6776

C:\Windows\SysWOW64\Qhkipdeb.exe
C:\Windows\system32\Qhkipdeb.exe
624⤵
PID:6876

C:\Windows\SysWOW64\Qkielpdf.exe
C:\Windows\system32\Qkielpdf.exe
625⤵
PID:6960

C:\Windows\SysWOW64\Qmhahkdj.exe
C:\Windows\system32\Qmhahkdj.exe
626⤵
PID:7008

C:\Windows\SysWOW64\Aacmij32.exe
C:\Windows\system32\Aacmij32.exe
627⤵
- Modifies registry class
PID:7100

C:\Windows\SysWOW64\Ahmefdcp.exe
C:\Windows\system32\Ahmefdcp.exe
628⤵
PID:6148

C:\Windows\SysWOW64\Aklabp32.exe
C:\Windows\system32\Aklabp32.exe
629⤵
PID:6260

C:\Windows\SysWOW64\Aognbnkm.exe
C:\Windows\system32\Aognbnkm.exe
630⤵
PID:6316

C:\Windows\SysWOW64\Aaejojjq.exe
C:\Windows\system32\Aaejojjq.exe
631⤵
- Drops file in System32 directory
PID:6436

C:\Windows\SysWOW64\Agbbgqhh.exe
C:\Windows\system32\Agbbgqhh.exe
632⤵
PID:6528

C:\Windows\SysWOW64\Aknngo32.exe
C:\Windows\system32\Aknngo32.exe
633⤵
PID:6632

C:\Windows\SysWOW64\Aahfdihn.exe
C:\Windows\system32\Aahfdihn.exe
634⤵
PID:6720

C:\Windows\SysWOW64\Apkgpf32.exe
C:\Windows\system32\Apkgpf32.exe
635⤵
PID:6808

C:\Windows\SysWOW64\Ageompfe.exe
C:\Windows\system32\Ageompfe.exe
636⤵
PID:6912

C:\Windows\SysWOW64\Ajckilei.exe
C:\Windows\system32\Ajckilei.exe
637⤵
PID:6992

C:\Windows\SysWOW64\Alageg32.exe
C:\Windows\system32\Alageg32.exe
638⤵
- System Location Discovery: System Language Discovery
PID:7120

C:\Windows\SysWOW64\Adipfd32.exe
C:\Windows\system32\Adipfd32.exe
639⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6192

C:\Windows\SysWOW64\Agglbp32.exe
C:\Windows\system32\Agglbp32.exe
640⤵
- System Location Discovery: System Language Discovery
PID:6304

C:\Windows\SysWOW64\Ajehnk32.exe
C:\Windows\system32\Ajehnk32.exe
641⤵
PID:6432

C:\Windows\SysWOW64\Apppkekc.exe
C:\Windows\system32\Apppkekc.exe
642⤵
PID:6556

C:\Windows\SysWOW64\Acnlgajg.exe
C:\Windows\system32\Acnlgajg.exe
643⤵
PID:6696

C:\Windows\SysWOW64\Bhkeohhn.exe
C:\Windows\system32\Bhkeohhn.exe
644⤵
- System Location Discovery: System Language Discovery
PID:6792

C:\Windows\SysWOW64\Bpbmqe32.exe
C:\Windows\system32\Bpbmqe32.exe
645⤵
PID:6916

C:\Windows\SysWOW64\Bcpimq32.exe
C:\Windows\system32\Bcpimq32.exe
646⤵
PID:6976

C:\Windows\SysWOW64\Bacihmoo.exe
C:\Windows\system32\Bacihmoo.exe
647⤵
PID:7156

C:\Windows\SysWOW64\Bhmaeg32.exe
C:\Windows\system32\Bhmaeg32.exe
648⤵
PID:6288

C:\Windows\SysWOW64\Bkknac32.exe
C:\Windows\system32\Bkknac32.exe
649⤵
- Drops file in System32 directory
PID:6424

C:\Windows\SysWOW64\Bcbfbp32.exe
C:\Windows\system32\Bcbfbp32.exe
650⤵
PID:6596

C:\Windows\SysWOW64\Bfabnl32.exe
C:\Windows\system32\Bfabnl32.exe
651⤵
- Drops file in System32 directory
PID:6672

C:\Windows\SysWOW64\Bhonjg32.exe
C:\Windows\system32\Bhonjg32.exe
652⤵
PID:6844

C:\Windows\SysWOW64\Bknjfb32.exe
C:\Windows\system32\Bknjfb32.exe
653⤵
PID:7056

C:\Windows\SysWOW64\Bnlgbnbp.exe
C:\Windows\system32\Bnlgbnbp.exe
654⤵
PID:7128

C:\Windows\SysWOW64\Bfcodkcb.exe
C:\Windows\system32\Bfcodkcb.exe
655⤵
PID:6324

C:\Windows\SysWOW64\Bdfooh32.exe
C:\Windows\system32\Bdfooh32.exe
656⤵
PID:6520

C:\Windows\SysWOW64\Bgdkkc32.exe
C:\Windows\system32\Bgdkkc32.exe
657⤵
PID:6684

C:\Windows\SysWOW64\Bolcma32.exe
C:\Windows\system32\Bolcma32.exe
658⤵
- Drops file in System32 directory
PID:6872

C:\Windows\SysWOW64\Bbjpil32.exe
C:\Windows\system32\Bbjpil32.exe
659⤵
- System Location Discovery: System Language Discovery
PID:7116

C:\Windows\SysWOW64\Bdhleh32.exe
C:\Windows\system32\Bdhleh32.exe
660⤵
PID:6196

C:\Windows\SysWOW64\Bgghac32.exe
C:\Windows\system32\Bgghac32.exe
661⤵
PID:6480

C:\Windows\SysWOW64\Bjedmo32.exe
C:\Windows\system32\Bjedmo32.exe
662⤵
PID:6748

C:\Windows\SysWOW64\Bnapnm32.exe
C:\Windows\system32\Bnapnm32.exe
663⤵
PID:6972

C:\Windows\SysWOW64\Bdkhjgeh.exe
C:\Windows\system32\Bdkhjgeh.exe
664⤵
PID:6168

C:\Windows\SysWOW64\Cgidfcdk.exe
C:\Windows\system32\Cgidfcdk.exe
665⤵
PID:6380

C:\Windows\SysWOW64\Cjhabndo.exe
C:\Windows\system32\Cjhabndo.exe
666⤵
PID:6752

C:\Windows\SysWOW64\Cmfmojcb.exe
C:\Windows\system32\Cmfmojcb.exe
667⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7112

C:\Windows\SysWOW64\Cdmepgce.exe
C:\Windows\system32\Cdmepgce.exe
668⤵
PID:6360

C:\Windows\SysWOW64\Ccpeld32.exe
C:\Windows\system32\Ccpeld32.exe
669⤵
PID:6680

C:\Windows\SysWOW64\Cfoaho32.exe
C:\Windows\system32\Cfoaho32.exe
670⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6756

C:\Windows\SysWOW64\Cjjnhnbl.exe
C:\Windows\system32\Cjjnhnbl.exe
671⤵
PID:6652

C:\Windows\SysWOW64\Cqdfehii.exe
C:\Windows\system32\Cqdfehii.exe
672⤵
PID:6996

C:\Windows\SysWOW64\Cogfqe32.exe
C:\Windows\system32\Cogfqe32.exe
673⤵
PID:6464

C:\Windows\SysWOW64\Cgnnab32.exe
C:\Windows\system32\Cgnnab32.exe
674⤵
PID:7016

C:\Windows\SysWOW64\Cjljnn32.exe
C:\Windows\system32\Cjljnn32.exe
675⤵
PID:6512

C:\Windows\SysWOW64\Cmkfji32.exe
C:\Windows\system32\Cmkfji32.exe
676⤵
PID:6248

C:\Windows\SysWOW64\Coicfd32.exe
C:\Windows\system32\Coicfd32.exe
677⤵
PID:6364

C:\Windows\SysWOW64\Cceogcfj.exe
C:\Windows\system32\Cceogcfj.exe
678⤵
PID:6564

C:\Windows\SysWOW64\Cbgobp32.exe
C:\Windows\system32\Cbgobp32.exe
679⤵
PID:6572

C:\Windows\SysWOW64\Cjogcm32.exe
C:\Windows\system32\Cjogcm32.exe
680⤵
PID:7192

C:\Windows\SysWOW64\Ckpckece.exe
C:\Windows\system32\Ckpckece.exe
681⤵
PID:7232

C:\Windows\SysWOW64\Colpld32.exe
C:\Windows\system32\Colpld32.exe
682⤵
PID:7272

C:\Windows\SysWOW64\Cfehhn32.exe
C:\Windows\system32\Cfehhn32.exe
683⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7312

C:\Windows\SysWOW64\Cidddj32.exe
C:\Windows\system32\Cidddj32.exe
684⤵
PID:7352

C:\Windows\SysWOW64\Ckbpqe32.exe
C:\Windows\system32\Ckbpqe32.exe
685⤵
PID:7392

C:\Windows\SysWOW64\Dnqlmq32.exe
C:\Windows\system32\Dnqlmq32.exe
686⤵
PID:7432

C:\Windows\SysWOW64\Dfhdnn32.exe
C:\Windows\system32\Dfhdnn32.exe
687⤵
PID:7472

C:\Windows\SysWOW64\Difqji32.exe
C:\Windows\system32\Difqji32.exe
688⤵
PID:7516

C:\Windows\SysWOW64\Dgiaefgg.exe
C:\Windows\system32\Dgiaefgg.exe
689⤵
PID:7556

C:\Windows\SysWOW64\Dncibp32.exe
C:\Windows\system32\Dncibp32.exe
690⤵
PID:7596

C:\Windows\SysWOW64\Daaenlng.exe
C:\Windows\system32\Daaenlng.exe
691⤵
PID:7636

C:\Windows\SysWOW64\Demaoj32.exe
C:\Windows\system32\Demaoj32.exe
692⤵
PID:7676

C:\Windows\SysWOW64\Dgknkf32.exe
C:\Windows\system32\Dgknkf32.exe
693⤵
PID:7716

C:\Windows\SysWOW64\Djjjga32.exe
C:\Windows\system32\Djjjga32.exe
694⤵
PID:7756

C:\Windows\SysWOW64\Dnefhpma.exe
C:\Windows\system32\Dnefhpma.exe
695⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7796

C:\Windows\SysWOW64\Deondj32.exe
C:\Windows\system32\Deondj32.exe
696⤵
PID:7836

C:\Windows\SysWOW64\Dcbnpgkh.exe
C:\Windows\system32\Dcbnpgkh.exe
697⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:7876

C:\Windows\SysWOW64\Dgnjqe32.exe
C:\Windows\system32\Dgnjqe32.exe
698⤵
PID:7916

C:\Windows\SysWOW64\Dnhbmpkn.exe
C:\Windows\system32\Dnhbmpkn.exe
699⤵
PID:7956

C:\Windows\SysWOW64\Dmkcil32.exe
C:\Windows\system32\Dmkcil32.exe
700⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7996

C:\Windows\SysWOW64\Dcdkef32.exe
C:\Windows\system32\Dcdkef32.exe
701⤵
PID:8036

C:\Windows\SysWOW64\Dfcgbb32.exe
C:\Windows\system32\Dfcgbb32.exe
702⤵
PID:8076

C:\Windows\SysWOW64\Dnjoco32.exe
C:\Windows\system32\Dnjoco32.exe
703⤵
PID:8116

C:\Windows\SysWOW64\Dmmpolof.exe
C:\Windows\system32\Dmmpolof.exe
704⤵
PID:8156

C:\Windows\SysWOW64\Dcghkf32.exe
C:\Windows\system32\Dcghkf32.exe
705⤵
PID:7060

C:\Windows\SysWOW64\Dhbdleol.exe
C:\Windows\system32\Dhbdleol.exe
706⤵
PID:7208

C:\Windows\SysWOW64\Ejaphpnp.exe
C:\Windows\system32\Ejaphpnp.exe
707⤵
PID:7268

C:\Windows\SysWOW64\Emoldlmc.exe
C:\Windows\system32\Emoldlmc.exe
708⤵
PID:7300

C:\Windows\SysWOW64\Edidqf32.exe
C:\Windows\system32\Edidqf32.exe
709⤵
- Modifies registry class
PID:7360

C:\Windows\SysWOW64\Ejcmmp32.exe
C:\Windows\system32\Ejcmmp32.exe
710⤵
PID:7412

C:\Windows\SysWOW64\Eldiehbk.exe
C:\Windows\system32\Eldiehbk.exe
711⤵
PID:7452

C:\Windows\SysWOW64\Edlafebn.exe
C:\Windows\system32\Edlafebn.exe
712⤵
PID:7508

C:\Windows\SysWOW64\Efjmbaba.exe
C:\Windows\system32\Efjmbaba.exe
713⤵
- System Location Discovery: System Language Discovery
PID:7564

C:\Windows\SysWOW64\Eihjolae.exe
C:\Windows\system32\Eihjolae.exe
714⤵
PID:7612

C:\Windows\SysWOW64\Elgfkhpi.exe
C:\Windows\system32\Elgfkhpi.exe
715⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:7660

C:\Windows\SysWOW64\Eoebgcol.exe
C:\Windows\system32\Eoebgcol.exe
716⤵
PID:7708

C:\Windows\SysWOW64\Efljhq32.exe
C:\Windows\system32\Efljhq32.exe
717⤵
PID:7764

C:\Windows\SysWOW64\Eikfdl32.exe
C:\Windows\system32\Eikfdl32.exe
718⤵
- Drops file in System32 directory
PID:7816

C:\Windows\SysWOW64\Elibpg32.exe
C:\Windows\system32\Elibpg32.exe
719⤵
PID:7872

C:\Windows\SysWOW64\Eogolc32.exe
C:\Windows\system32\Eogolc32.exe
720⤵
PID:7908

C:\Windows\SysWOW64\Eafkhn32.exe
C:\Windows\system32\Eafkhn32.exe
721⤵
PID:7964

C:\Windows\SysWOW64\Eimcjl32.exe
C:\Windows\system32\Eimcjl32.exe
722⤵
PID:8016

C:\Windows\SysWOW64\Elkofg32.exe
C:\Windows\system32\Elkofg32.exe
723⤵
PID:8060

C:\Windows\SysWOW64\Eojlbb32.exe
C:\Windows\system32\Eojlbb32.exe
724⤵
PID:8104

C:\Windows\SysWOW64\Fahhnn32.exe
C:\Windows\system32\Fahhnn32.exe
725⤵
PID:8164

C:\Windows\SysWOW64\Fhbpkh32.exe
C:\Windows\system32\Fhbpkh32.exe
726⤵
- Drops file in System32 directory
PID:7188

C:\Windows\SysWOW64\Flnlkgjq.exe
C:\Windows\system32\Flnlkgjq.exe
727⤵
PID:7216

C:\Windows\SysWOW64\Folhgbid.exe
C:\Windows\system32\Folhgbid.exe
728⤵
PID:7308

C:\Windows\SysWOW64\Fmohco32.exe
C:\Windows\system32\Fmohco32.exe
729⤵
PID:7368

C:\Windows\SysWOW64\Fdiqpigl.exe
C:\Windows\system32\Fdiqpigl.exe
730⤵
PID:7428

C:\Windows\SysWOW64\Fggmldfp.exe
C:\Windows\system32\Fggmldfp.exe
731⤵
PID:7504

C:\Windows\SysWOW64\Fmaeho32.exe
C:\Windows\system32\Fmaeho32.exe
732⤵
PID:7552

C:\Windows\SysWOW64\Famaimfe.exe
C:\Windows\system32\Famaimfe.exe
733⤵
PID:7620

C:\Windows\SysWOW64\Fdkmeiei.exe
C:\Windows\system32\Fdkmeiei.exe
734⤵
PID:7688

C:\Windows\SysWOW64\Fgjjad32.exe
C:\Windows\system32\Fgjjad32.exe
735⤵
- Modifies registry class
PID:7732

C:\Windows\SysWOW64\Fmdbnnlj.exe
C:\Windows\system32\Fmdbnnlj.exe
736⤵
PID:7768

C:\Windows\SysWOW64\Faonom32.exe
C:\Windows\system32\Faonom32.exe
737⤵
PID:7844