9b0a239a6ca75cbae690c5397b70e5a3adac5e89a518786ea8c1087eecd893c4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea3c8a50c42e85e8fb80e41aab996880N.exe
Size

64KB
MD5

ea3c8a50c42e85e8fb80e41aab996880
SHA1

3cd27bbb7266eba5c728e70a74d6abfad8cb15ce
SHA256

9b0a239a6ca75cbae690c5397b70e5a3adac5e89a518786ea8c1087eecd893c4
SHA512

bb84c7a5c5bc1b960b189e44c1df9408e489de19d59b0c07a6dea1442b682868a0b60e7a49914b45c0fffca8f08007c10d61ec3afb6b719155df78ddc10dbcd9
SSDEEP

1536:whDsreOZo28qiLrCSM0qTtJB8ADHD/QI3qZLuZuYDPf:yUeW8qiLrYtJGADHD/QI4uZuY7f

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Jjjdhc32.exeCkomqopi.exeBmnofp32.exeChofhm32.exeMopdpg32.exeFkcilc32.exeLlbconkd.exeHecebm32.exeEmdhhdqb.exeFipbhd32.exeMmdkfmjc.exeDiqmcgca.exeJcoanb32.exeNhcebj32.exeOmlncc32.exeDcageqgm.exeEinlmkhp.exeMkohjbah.exeAiqjao32.exeMejmmqpd.exeGbmlkl32.exeAbinjdad.exeKeioca32.exePpcmfn32.exeQboikm32.exeDcemnopj.exeIdbnmgll.exePjhnqfla.exeBimphc32.exeGfoeel32.exeNedifo32.exeOfdeeb32.exeEmoldlmc.exeFgjjad32.exeGonale32.exeJahbmlil.exeKmiolk32.exePnnfkb32.exeDihmpinj.exeCgogealf.exeOnldqejb.exeEebibf32.exeNdlbmk32.exeGgapbcne.exeHgnokgcc.exeQemomb32.exeJmgfgham.exePbpoebgc.exeAjdcofop.exeKnaeeo32.exeMcacochk.exeCcgklc32.exeFcqjfeja.exeAmmmlcgi.exeDmmbge32.exeEmpomd32.exeEcjgio32.exeCofaog32.exeJmfcop32.exeAbhlak32.exeMeecaa32.exePfchqf32.exeIlifndlo.exePajeanhf.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjjdhc32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckomqopi.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmnofp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chofhm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mopdpg32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkcilc32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llbconkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hecebm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emdhhdqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fipbhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmdkfmjc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Diqmcgca.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcoanb32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhcebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omlncc32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcageqgm.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Einlmkhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkohjbah.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aiqjao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mejmmqpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbmlkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abinjdad.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Keioca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppcmfn32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qboikm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcemnopj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Idbnmgll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjhnqfla.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bimphc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfoeel32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nedifo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofdeeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emoldlmc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgjjad32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gonale32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jahbmlil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmiolk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnnfkb32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dihmpinj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgogealf.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onldqejb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eebibf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndlbmk32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggapbcne.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgnokgcc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qemomb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmgfgham.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbpoebgc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajdcofop.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knaeeo32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcacochk.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccgklc32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcqjfeja.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ammmlcgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmmbge32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Empomd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecjgio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cofaog32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmfcop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abhlak32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Meecaa32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfchqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilifndlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pajeanhf.exe

Executes dropped EXE 64 IoCs

Processes:

Ccnifd32.exeCjhabndo.exeCncmcm32.exeCqaiph32.exeCcpeld32.exeCqdfehii.exeCgnnab32.exeCiokijfd.exeCqfbjhgf.exeCceogcfj.exeCfckcoen.exeCiagojda.exeCmmcpi32.exeColpld32.exeCcgklc32.exeCfehhn32.exeCidddj32.exeCkbpqe32.exeDnqlmq32.exeDblhmoio.exeDfhdnn32.exeDifqji32.exeDkdmfe32.exeDncibp32.exeDboeco32.exeDihmpinj.exeDjjjga32.exeDadbdkld.exeDcbnpgkh.exeDjlfma32.exeDmkcil32.exeDeakjjbk.exeDfcgbb32.exeDnjoco32.exeDmmpolof.exeDhbdleol.exeEjaphpnp.exeEicpcm32.exeEmoldlmc.exeEblelb32.exeEifmimch.exeEppefg32.exeEbnabb32.exeEemnnn32.exeEmdeok32.exeEpbbkf32.exeEbqngb32.exeEfljhq32.exeEikfdl32.exeEhnfpifm.exeEpeoaffo.exeEogolc32.exeEafkhn32.exeEimcjl32.exeEhpcehcj.exeEknpadcn.exeEojlbb32.exeFahhnn32.exeFeddombd.exeFhbpkh32.exeFlnlkgjq.exeFkqlgc32.exeFmohco32.exeFakdcnhh.exe

pid	process
2724	Ccnifd32.exe
2568	Cjhabndo.exe
2748	Cncmcm32.exe
2560	Cqaiph32.exe
2068	Ccpeld32.exe
1664	Cqdfehii.exe
2284	Cgnnab32.exe
2744	Ciokijfd.exe
2904	Cqfbjhgf.exe
1316	Cceogcfj.exe
2232	Cfckcoen.exe
796	Ciagojda.exe
2200	Cmmcpi32.exe
1308	Colpld32.exe
1076	Ccgklc32.exe
272	Cfehhn32.exe
820	Cidddj32.exe
1612	Ckbpqe32.exe
3036	Dnqlmq32.exe
1784	Dblhmoio.exe
2036	Dfhdnn32.exe
1060	Difqji32.exe
2332	Dkdmfe32.exe
2348	Dncibp32.exe
2440	Dboeco32.exe
2872	Dihmpinj.exe
1748	Djjjga32.exe
840	Dadbdkld.exe
2308	Dcbnpgkh.exe
2600	Djlfma32.exe
2000	Dmkcil32.exe
1452	Deakjjbk.exe
2832	Dfcgbb32.exe
2516	Dnjoco32.exe
2912	Dmmpolof.exe
1160	Dhbdleol.exe
2428	Ejaphpnp.exe
1864	Eicpcm32.exe
632	Emoldlmc.exe
1648	Eblelb32.exe
1232	Eifmimch.exe
2512	Eppefg32.exe
444	Ebnabb32.exe
1676	Eemnnn32.exe
608	Emdeok32.exe
2220	Epbbkf32.exe
1752	Ebqngb32.exe
972	Efljhq32.exe
1976	Eikfdl32.exe
2592	Ehnfpifm.exe
2572	Epeoaffo.exe
2576	Eogolc32.exe
1732	Eafkhn32.exe
2508	Eimcjl32.exe
2848	Ehpcehcj.exe
2664	Eknpadcn.exe
288	Eojlbb32.exe
2376	Fahhnn32.exe
2208	Feddombd.exe
2172	Fhbpkh32.exe
2404	Flnlkgjq.exe
2956	Fkqlgc32.exe
1884	Fmohco32.exe
1488	Fakdcnhh.exe

Loads dropped DLL 64 IoCs

Processes:

ea3c8a50c42e85e8fb80e41aab996880N.exeCcnifd32.exeCjhabndo.exeCncmcm32.exeCqaiph32.exeCcpeld32.exeCqdfehii.exeCgnnab32.exeCiokijfd.exeCqfbjhgf.exeCceogcfj.exeCfckcoen.exeCiagojda.exeCmmcpi32.exeColpld32.exeCcgklc32.exeCfehhn32.exeCidddj32.exeCkbpqe32.exeDnqlmq32.exeDblhmoio.exeDfhdnn32.exeDifqji32.exeDkdmfe32.exeDncibp32.exeDboeco32.exeDihmpinj.exeDjjjga32.exeDadbdkld.exeDcbnpgkh.exeDjlfma32.exeDmkcil32.exe

pid	process
1448	ea3c8a50c42e85e8fb80e41aab996880N.exe
1448	ea3c8a50c42e85e8fb80e41aab996880N.exe
2724	Ccnifd32.exe
2724	Ccnifd32.exe
2568	Cjhabndo.exe
2568	Cjhabndo.exe
2748	Cncmcm32.exe
2748	Cncmcm32.exe
2560	Cqaiph32.exe
2560	Cqaiph32.exe
2068	Ccpeld32.exe
2068	Ccpeld32.exe
1664	Cqdfehii.exe
1664	Cqdfehii.exe
2284	Cgnnab32.exe
2284	Cgnnab32.exe
2744	Ciokijfd.exe
2744	Ciokijfd.exe
2904	Cqfbjhgf.exe
2904	Cqfbjhgf.exe
1316	Cceogcfj.exe
1316	Cceogcfj.exe
2232	Cfckcoen.exe
2232	Cfckcoen.exe
796	Ciagojda.exe
796	Ciagojda.exe
2200	Cmmcpi32.exe
2200	Cmmcpi32.exe
1308	Colpld32.exe
1308	Colpld32.exe
1076	Ccgklc32.exe
1076	Ccgklc32.exe
272	Cfehhn32.exe
272	Cfehhn32.exe
820	Cidddj32.exe
820	Cidddj32.exe
1612	Ckbpqe32.exe
1612	Ckbpqe32.exe
3036	Dnqlmq32.exe
3036	Dnqlmq32.exe
1784	Dblhmoio.exe
1784	Dblhmoio.exe
2036	Dfhdnn32.exe
2036	Dfhdnn32.exe
1060	Difqji32.exe
1060	Difqji32.exe
2332	Dkdmfe32.exe
2332	Dkdmfe32.exe
2348	Dncibp32.exe
2348	Dncibp32.exe
2440	Dboeco32.exe
2440	Dboeco32.exe
2872	Dihmpinj.exe
2872	Dihmpinj.exe
1748	Djjjga32.exe
1748	Djjjga32.exe
840	Dadbdkld.exe
840	Dadbdkld.exe
2308	Dcbnpgkh.exe
2308	Dcbnpgkh.exe
2600	Djlfma32.exe
2600	Djlfma32.exe
2000	Dmkcil32.exe
2000	Dmkcil32.exe

Drops file in System32 directory 64 IoCs

Processes:

Gajjhkgh.exeHhmhcigh.exeKeoabo32.exeDjoeki32.exeNljhhi32.exeLlbconkd.exeBedhgj32.exeDbbklnpj.exeApclnj32.exePofldf32.exePajeanhf.exeDnjoco32.exeEpbbkf32.exeBcflko32.exeAlbjnplq.exeElieipej.exeJcfoihhp.exeKpdeoh32.exeLhfpdi32.exePlpqim32.exeAjnqphhe.exeKnohpo32.exeFlnlkgjq.exeQfkelkkd.exeGieommdc.exeEpqgopbi.exeNcfmjc32.exeNakikpin.exeAeenapck.exeOpjkpo32.exeAhqkocmm.exeDnhefh32.exeDnckki32.exeGfcopl32.exeHmfmkjdf.exeIkqnlh32.exeBhjneadb.exePncjad32.exeObjmgd32.exeFcichb32.exeInmmbc32.exeBfgdmjlp.exeDcageqgm.exeCiokijfd.exeLklikj32.exeMclgklel.exeGefolhja.exeHgckoofa.exeMagdam32.exeMpqjmh32.exeDfpcblfp.exeGpjmnh32.exeGcppkbia.exeImogcj32.exeKckhdg32.exeBafhff32.exeBlkmdodf.exeDdppmclb.exeDncibp32.exeMgcjpkak.exeGdjcjf32.exeNchipb32.exeAiqjao32.exeJcckibfg.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Gckfpc32.exe	Gajjhkgh.exe
File created	C:\Windows\SysWOW64\Algllb32.dll	Hhmhcigh.exe
File created	C:\Windows\SysWOW64\Kmficl32.exe	Keoabo32.exe
File created	C:\Windows\SysWOW64\Dmmbge32.exe	Djoeki32.exe
File created	C:\Windows\SysWOW64\Nohddd32.exe	Nljhhi32.exe
File created	C:\Windows\SysWOW64\Jingpl32.dll	Llbconkd.exe
File created	C:\Windows\SysWOW64\Jimohpcc.dll	Bedhgj32.exe
File created	C:\Windows\SysWOW64\Djicmk32.exe	Dbbklnpj.exe
File created	C:\Windows\SysWOW64\Abbhje32.exe	Apclnj32.exe
File opened for modification	C:\Windows\SysWOW64\Pnimpcke.exe	Pofldf32.exe
File opened for modification	C:\Windows\SysWOW64\Pchbmigj.exe	Pajeanhf.exe
File created	C:\Windows\SysWOW64\Dmmpolof.exe	Dnjoco32.exe
File created	C:\Windows\SysWOW64\Ebqngb32.exe	Epbbkf32.exe
File opened for modification	C:\Windows\SysWOW64\Bedhgj32.exe	Bcflko32.exe
File opened for modification	C:\Windows\SysWOW64\Adiaommc.exe	Albjnplq.exe
File opened for modification	C:\Windows\SysWOW64\Epeajo32.exe	Elieipej.exe
File opened for modification	C:\Windows\SysWOW64\Jnlbgq32.exe	Jcfoihhp.exe
File opened for modification	C:\Windows\SysWOW64\Khojcj32.exe	Kpdeoh32.exe
File opened for modification	C:\Windows\SysWOW64\Lophacfl.exe	Lhfpdi32.exe
File created	C:\Windows\SysWOW64\Amefhjna.dll	Plpqim32.exe
File created	C:\Windows\SysWOW64\Kgagag32.dll	Ajnqphhe.exe
File created	C:\Windows\SysWOW64\Ejcfme32.dll	Knohpo32.exe
File created	C:\Windows\SysWOW64\Fkqlgc32.exe	Flnlkgjq.exe
File created	C:\Windows\SysWOW64\Qjfalj32.exe	Qfkelkkd.exe
File created	C:\Windows\SysWOW64\Bfjpjn32.dll	Gieommdc.exe
File created	C:\Windows\SysWOW64\Ebockkal.exe	Epqgopbi.exe
File created	C:\Windows\SysWOW64\Ggmaao32.dll	Ncfmjc32.exe
File opened for modification	C:\Windows\SysWOW64\Ndjfgkha.exe	Nakikpin.exe
File created	C:\Windows\SysWOW64\Aiqjao32.exe	Aeenapck.exe
File created	C:\Windows\SysWOW64\Ofdclinq.exe	Opjkpo32.exe
File opened for modification	C:\Windows\SysWOW64\Aphcppmo.exe	Ahqkocmm.exe
File created	C:\Windows\SysWOW64\Enoinika.dll	Dnhefh32.exe
File opened for modification	C:\Windows\SysWOW64\Dfkclf32.exe	Dnckki32.exe
File created	C:\Windows\SysWOW64\Ehameajg.dll	Gfcopl32.exe
File opened for modification	C:\Windows\SysWOW64\Hememgdi.exe	Hmfmkjdf.exe
File opened for modification	C:\Windows\SysWOW64\Inojhc32.exe	Ikqnlh32.exe
File created	C:\Windows\SysWOW64\Noqhljpc.dll	Bhjneadb.exe
File opened for modification	C:\Windows\SysWOW64\Ppdfimji.exe	Pncjad32.exe
File created	C:\Windows\SysWOW64\Ikonfbfj.dll	Objmgd32.exe
File created	C:\Windows\SysWOW64\Dknfijae.dll	Fcichb32.exe
File created	C:\Windows\SysWOW64\Dmplbgpm.dll	Inmmbc32.exe
File opened for modification	C:\Windows\SysWOW64\Bheaiekc.exe	Bfgdmjlp.exe
File created	C:\Windows\SysWOW64\Jgbaelak.dll	Dcageqgm.exe
File created	C:\Windows\SysWOW64\Cqfbjhgf.exe	Ciokijfd.exe
File created	C:\Windows\SysWOW64\Dcipgdao.dll	Lklikj32.exe
File created	C:\Windows\SysWOW64\Mkcplien.exe	Mclgklel.exe
File opened for modification	C:\Windows\SysWOW64\Ghekhd32.exe	Gefolhja.exe
File opened for modification	C:\Windows\SysWOW64\Hkogpn32.exe	Hgckoofa.exe
File opened for modification	C:\Windows\SysWOW64\Mdepmh32.exe	Magdam32.exe
File opened for modification	C:\Windows\SysWOW64\Mgkbjb32.exe	Mpqjmh32.exe
File created	C:\Windows\SysWOW64\Dkmljcdh.exe	Dfpcblfp.exe
File opened for modification	C:\Windows\SysWOW64\Ggdekbgb.exe	Gpjmnh32.exe
File created	C:\Windows\SysWOW64\Lgkqjo32.dll	Gcppkbia.exe
File created	C:\Windows\SysWOW64\Iomcpe32.exe	Imogcj32.exe
File created	C:\Windows\SysWOW64\Obffbh32.dll	Kckhdg32.exe
File opened for modification	C:\Windows\SysWOW64\Bimphc32.exe	Bafhff32.exe
File created	C:\Windows\SysWOW64\Bknmok32.exe	Blkmdodf.exe
File created	C:\Windows\SysWOW64\Kabgha32.dll	Ddppmclb.exe
File created	C:\Windows\SysWOW64\Bnnjlmid.dll	Dncibp32.exe
File created	C:\Windows\SysWOW64\Ocoadgfn.dll	Mgcjpkak.exe
File opened for modification	C:\Windows\SysWOW64\Geloanjg.exe	Gdjcjf32.exe
File created	C:\Windows\SysWOW64\Lnkmkbpj.dll	Nchipb32.exe
File opened for modification	C:\Windows\SysWOW64\Alofnj32.exe	Aiqjao32.exe
File opened for modification	C:\Windows\SysWOW64\Jfagemej.exe	Jcckibfg.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Jbfilffm.exeOfdclinq.exeCbkgog32.exeFmohco32.exeGdnfjl32.exeLdgnklmi.exeNlohmonb.exeBdinnqon.exeDkjhjm32.exeFdnlcakk.exeIqllghon.exeLilomj32.exeNcipjieo.exeLpoaheja.exeHalcmn32.exeJnlbgq32.exeCdkkcp32.exeEemnnn32.exeFeddombd.exeLpaehl32.exeHmfmkjdf.exeIdbnmgll.exeBfbjdf32.exeCgogealf.exeKhojcj32.exeQigebglj.exeQblfkgqb.exeCpbkhabp.exeKjmoeo32.exeOcclcg32.exeea3c8a50c42e85e8fb80e41aab996880N.exeCqaiph32.exeMndhnd32.exeBaneak32.exeIadbqlmh.exeOnipqp32.exeBaqhapdj.exeFdiqpigl.exeIkqnlh32.exeOggeokoq.exeEjfllhao.exeJcoanb32.exeNlanhh32.exeJimdcqom.exeHhmhcigh.exeMpikik32.exeQjgjpi32.exeAifjgdkj.exeLfdpjp32.exeNgoleb32.exeOffpbi32.exeCkiiiine.exeFakdcnhh.exeEaqkcimg.exeLaidgi32.exeManjaldo.exeAeenapck.exeBphaglgo.exeGqdgom32.exeHdpcokdo.exeMoenkf32.exeDdkgbc32.exeIpqicdim.exeEbnabb32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbfilffm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofdclinq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbkgog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmohco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdnfjl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldgnklmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlohmonb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdinnqon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkjhjm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdnlcakk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iqllghon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lilomj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncipjieo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpoaheja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Halcmn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnlbgq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdkkcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eemnnn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Feddombd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpaehl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmfmkjdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idbnmgll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfbjdf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgogealf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khojcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qigebglj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qblfkgqb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpbkhabp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjmoeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Occlcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea3c8a50c42e85e8fb80e41aab996880N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cqaiph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mndhnd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baneak32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iadbqlmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onipqp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baqhapdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdiqpigl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikqnlh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oggeokoq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ejfllhao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcoanb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlanhh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jimdcqom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhmhcigh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpikik32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjgjpi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aifjgdkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfdpjp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngoleb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Offpbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckiiiine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fakdcnhh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eaqkcimg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Laidgi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Manjaldo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeenapck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bphaglgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gqdgom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hdpcokdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Moenkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddkgbc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipqicdim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebnabb32.exe

Modifies registry class 64 IoCs

Processes:

Fcichb32.exeIklfia32.exeEpeoaffo.exeGiaidnkf.exeLekghdad.exeLemdncoa.exeHhlaiccm.exeKcajceke.exeCggcofkf.exeGncnmane.exeGockgdeh.exeEifobe32.exeFpgnoo32.exeDkjhjm32.exeOmqjgl32.exeHmmdin32.exeLghgmg32.exeHajfgnjc.exeCdpdnpif.exeBacefpbg.exeInmmbc32.exeNjmfhe32.exeAifjgdkj.exeOfiopaap.exeQfkgdd32.exeBmnofp32.exeOodjjign.exePmhgba32.exeFaijggao.exeKmnlhg32.exeCqdfehii.exeNoohlkpc.exeOfafgipc.exeHmijajbd.exeIjdppm32.exeKkjpggkn.exeBcflko32.exeFjnignob.exeFhglop32.exeJgmjdaqb.exeOgdaod32.exeGojhafnb.exeMploiq32.exeQblfkgqb.exeFmbgageq.exeJihdnk32.exeEmpomd32.exeKiemmh32.exeAinmlomf.exeJlnmel32.exeNkehql32.exePpcmfn32.exeAfmbak32.exeDgqion32.exeFefqdl32.exeJnofgg32.exeEiciig32.exeOggeokoq.exeLofifi32.exeLcadghnk.exeFhmldfdm.exeLonlkcho.exeea3c8a50c42e85e8fb80e41aab996880N.exeEicpcm32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcichb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iklfia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dokggo32.dll"	Epeoaffo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Giaidnkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lekghdad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lemdncoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hhlaiccm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcajceke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cggcofkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gncnmane.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gockgdeh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eifobe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fpgnoo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkjhjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omqjgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmmdin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qaamhelq.dll"	Lghgmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hajfgnjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdpdnpif.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bacefpbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmplbgpm.dll"	Inmmbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njmfhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geogecdd.dll"	Aifjgdkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofiopaap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaklhb32.dll"	Qfkgdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjnhlm32.dll"	Bmnofp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jidbmpjh.dll"	Oodjjign.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmhgba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Faijggao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmnlhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cqdfehii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Noohlkpc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofafgipc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmijajbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oggpcipi.dll"	Ijdppm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pehbqi32.dll"	Kkjpggkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcflko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fjnignob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fhglop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffmaalgf.dll"	Jgmjdaqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogdaod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gojhafnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mploiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihcbim32.dll"	Qblfkgqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmbgageq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnhjppcf.dll"	Jihdnk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Empomd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kiemmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ainmlomf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebenek32.dll"	Jlnmel32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkehql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfckkecc.dll"	Ppcmfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afmbak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgqion32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fefqdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mobafhlg.dll"	Jnofgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eiciig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phahme32.dll"	Oggeokoq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhdikdfj.dll"	Lofifi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gebojbpo.dll"	Lcadghnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqhgonnp.dll"	Fhmldfdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfdeopaj.dll"	Lonlkcho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfglml32.dll"	ea3c8a50c42e85e8fb80e41aab996880N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eicpcm32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

description	pid	process	target process
PID 1448 wrote to memory of 2724	1448	ea3c8a50c42e85e8fb80e41aab996880N.exe	Ccnifd32.exe
PID 1448 wrote to memory of 2724	1448	ea3c8a50c42e85e8fb80e41aab996880N.exe	Ccnifd32.exe
PID 1448 wrote to memory of 2724	1448	ea3c8a50c42e85e8fb80e41aab996880N.exe	Ccnifd32.exe
PID 1448 wrote to memory of 2724	1448	ea3c8a50c42e85e8fb80e41aab996880N.exe	Ccnifd32.exe
PID 2724 wrote to memory of 2568	2724	Ccnifd32.exe	Cjhabndo.exe
PID 2724 wrote to memory of 2568	2724	Ccnifd32.exe	Cjhabndo.exe
PID 2724 wrote to memory of 2568	2724	Ccnifd32.exe	Cjhabndo.exe
PID 2724 wrote to memory of 2568	2724	Ccnifd32.exe	Cjhabndo.exe
PID 2568 wrote to memory of 2748	2568	Cjhabndo.exe	Cncmcm32.exe
PID 2568 wrote to memory of 2748	2568	Cjhabndo.exe	Cncmcm32.exe
PID 2568 wrote to memory of 2748	2568	Cjhabndo.exe	Cncmcm32.exe
PID 2568 wrote to memory of 2748	2568	Cjhabndo.exe	Cncmcm32.exe
PID 2748 wrote to memory of 2560	2748	Cncmcm32.exe	Cqaiph32.exe
PID 2748 wrote to memory of 2560	2748	Cncmcm32.exe	Cqaiph32.exe
PID 2748 wrote to memory of 2560	2748	Cncmcm32.exe	Cqaiph32.exe
PID 2748 wrote to memory of 2560	2748	Cncmcm32.exe	Cqaiph32.exe
PID 2560 wrote to memory of 2068	2560	Cqaiph32.exe	Ccpeld32.exe
PID 2560 wrote to memory of 2068	2560	Cqaiph32.exe	Ccpeld32.exe
PID 2560 wrote to memory of 2068	2560	Cqaiph32.exe	Ccpeld32.exe
PID 2560 wrote to memory of 2068	2560	Cqaiph32.exe	Ccpeld32.exe
PID 2068 wrote to memory of 1664	2068	Ccpeld32.exe	Cqdfehii.exe
PID 2068 wrote to memory of 1664	2068	Ccpeld32.exe	Cqdfehii.exe
PID 2068 wrote to memory of 1664	2068	Ccpeld32.exe	Cqdfehii.exe
PID 2068 wrote to memory of 1664	2068	Ccpeld32.exe	Cqdfehii.exe
PID 1664 wrote to memory of 2284	1664	Cqdfehii.exe	Cgnnab32.exe
PID 1664 wrote to memory of 2284	1664	Cqdfehii.exe	Cgnnab32.exe
PID 1664 wrote to memory of 2284	1664	Cqdfehii.exe	Cgnnab32.exe
PID 1664 wrote to memory of 2284	1664	Cqdfehii.exe	Cgnnab32.exe
PID 2284 wrote to memory of 2744	2284	Cgnnab32.exe	Ciokijfd.exe
PID 2284 wrote to memory of 2744	2284	Cgnnab32.exe	Ciokijfd.exe
PID 2284 wrote to memory of 2744	2284	Cgnnab32.exe	Ciokijfd.exe
PID 2284 wrote to memory of 2744	2284	Cgnnab32.exe	Ciokijfd.exe
PID 2744 wrote to memory of 2904	2744	Ciokijfd.exe	Cqfbjhgf.exe
PID 2744 wrote to memory of 2904	2744	Ciokijfd.exe	Cqfbjhgf.exe
PID 2744 wrote to memory of 2904	2744	Ciokijfd.exe	Cqfbjhgf.exe
PID 2744 wrote to memory of 2904	2744	Ciokijfd.exe	Cqfbjhgf.exe
PID 2904 wrote to memory of 1316	2904	Cqfbjhgf.exe	Cceogcfj.exe
PID 2904 wrote to memory of 1316	2904	Cqfbjhgf.exe	Cceogcfj.exe
PID 2904 wrote to memory of 1316	2904	Cqfbjhgf.exe	Cceogcfj.exe
PID 2904 wrote to memory of 1316	2904	Cqfbjhgf.exe	Cceogcfj.exe
PID 1316 wrote to memory of 2232	1316	Cceogcfj.exe	Cfckcoen.exe
PID 1316 wrote to memory of 2232	1316	Cceogcfj.exe	Cfckcoen.exe
PID 1316 wrote to memory of 2232	1316	Cceogcfj.exe	Cfckcoen.exe
PID 1316 wrote to memory of 2232	1316	Cceogcfj.exe	Cfckcoen.exe
PID 2232 wrote to memory of 796	2232	Cfckcoen.exe	Ciagojda.exe
PID 2232 wrote to memory of 796	2232	Cfckcoen.exe	Ciagojda.exe
PID 2232 wrote to memory of 796	2232	Cfckcoen.exe	Ciagojda.exe
PID 2232 wrote to memory of 796	2232	Cfckcoen.exe	Ciagojda.exe
PID 796 wrote to memory of 2200	796	Ciagojda.exe	Cmmcpi32.exe
PID 796 wrote to memory of 2200	796	Ciagojda.exe	Cmmcpi32.exe
PID 796 wrote to memory of 2200	796	Ciagojda.exe	Cmmcpi32.exe
PID 796 wrote to memory of 2200	796	Ciagojda.exe	Cmmcpi32.exe
PID 2200 wrote to memory of 1308	2200	Cmmcpi32.exe	Colpld32.exe
PID 2200 wrote to memory of 1308	2200	Cmmcpi32.exe	Colpld32.exe
PID 2200 wrote to memory of 1308	2200	Cmmcpi32.exe	Colpld32.exe
PID 2200 wrote to memory of 1308	2200	Cmmcpi32.exe	Colpld32.exe
PID 1308 wrote to memory of 1076	1308	Colpld32.exe	Ccgklc32.exe
PID 1308 wrote to memory of 1076	1308	Colpld32.exe	Ccgklc32.exe
PID 1308 wrote to memory of 1076	1308	Colpld32.exe	Ccgklc32.exe
PID 1308 wrote to memory of 1076	1308	Colpld32.exe	Ccgklc32.exe
PID 1076 wrote to memory of 272	1076	Ccgklc32.exe	Cfehhn32.exe
PID 1076 wrote to memory of 272	1076	Ccgklc32.exe	Cfehhn32.exe
PID 1076 wrote to memory of 272	1076	Ccgklc32.exe	Cfehhn32.exe
PID 1076 wrote to memory of 272	1076	Ccgklc32.exe	Cfehhn32.exe

C:\Users\Admin\AppData\Local\Temp\ea3c8a50c42e85e8fb80e41aab996880N.exe
"C:\Users\Admin\AppData\Local\Temp\ea3c8a50c42e85e8fb80e41aab996880N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\Ccnifd32.exe
C:\Windows\system32\Ccnifd32.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724

C:\Windows\SysWOW64\Cjhabndo.exe
C:\Windows\system32\Cjhabndo.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568

C:\Windows\SysWOW64\Cncmcm32.exe
C:\Windows\system32\Cncmcm32.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748

C:\Windows\SysWOW64\Cqaiph32.exe
C:\Windows\system32\Cqaiph32.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2560

C:\Windows\SysWOW64\Ccpeld32.exe
C:\Windows\system32\Ccpeld32.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2068

C:\Windows\SysWOW64\Cqdfehii.exe
C:\Windows\system32\Cqdfehii.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\Cgnnab32.exe
C:\Windows\system32\Cgnnab32.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2284

C:\Windows\SysWOW64\Ciokijfd.exe
C:\Windows\system32\Ciokijfd.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2744

C:\Windows\SysWOW64\Cqfbjhgf.exe
C:\Windows\system32\Cqfbjhgf.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904

C:\Windows\SysWOW64\Cceogcfj.exe
C:\Windows\system32\Cceogcfj.exe
11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\SysWOW64\Cfckcoen.exe
C:\Windows\system32\Cfckcoen.exe
12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\SysWOW64\Ciagojda.exe
C:\Windows\system32\Ciagojda.exe
13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\SysWOW64\Cmmcpi32.exe
C:\Windows\system32\Cmmcpi32.exe
14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\SysWOW64\Colpld32.exe
C:\Windows\system32\Colpld32.exe
15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\Ccgklc32.exe
C:\Windows\system32\Ccgklc32.exe
16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\SysWOW64\Cfehhn32.exe
C:\Windows\system32\Cfehhn32.exe
17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272

C:\Windows\SysWOW64\Cidddj32.exe
C:\Windows\system32\Cidddj32.exe
18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:820

C:\Windows\SysWOW64\Ckbpqe32.exe
C:\Windows\system32\Ckbpqe32.exe
19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612

C:\Windows\SysWOW64\Dnqlmq32.exe
C:\Windows\system32\Dnqlmq32.exe
20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036

C:\Windows\SysWOW64\Dblhmoio.exe
C:\Windows\system32\Dblhmoio.exe
21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784

C:\Windows\SysWOW64\Dfhdnn32.exe
C:\Windows\system32\Dfhdnn32.exe
22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036

C:\Windows\SysWOW64\Difqji32.exe
C:\Windows\system32\Difqji32.exe
23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060

C:\Windows\SysWOW64\Dkdmfe32.exe
C:\Windows\system32\Dkdmfe32.exe
24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332

C:\Windows\SysWOW64\Dncibp32.exe
C:\Windows\system32\Dncibp32.exe
25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2348

C:\Windows\SysWOW64\Dboeco32.exe
C:\Windows\system32\Dboeco32.exe
26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440

C:\Windows\SysWOW64\Dihmpinj.exe
C:\Windows\system32\Dihmpinj.exe
27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2872

C:\Windows\SysWOW64\Djjjga32.exe
C:\Windows\system32\Djjjga32.exe
28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748

C:\Windows\SysWOW64\Dadbdkld.exe
C:\Windows\system32\Dadbdkld.exe
29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840

C:\Windows\SysWOW64\Dcbnpgkh.exe
C:\Windows\system32\Dcbnpgkh.exe
30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308

C:\Windows\SysWOW64\Djlfma32.exe
C:\Windows\system32\Djlfma32.exe
31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600

C:\Windows\SysWOW64\Dmkcil32.exe
C:\Windows\system32\Dmkcil32.exe
32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000

C:\Windows\SysWOW64\Deakjjbk.exe
C:\Windows\system32\Deakjjbk.exe
33⤵
- Executes dropped EXE
PID:1452

C:\Windows\SysWOW64\Dfcgbb32.exe
C:\Windows\system32\Dfcgbb32.exe
34⤵
- Executes dropped EXE
PID:2832

C:\Windows\SysWOW64\Dnjoco32.exe
C:\Windows\system32\Dnjoco32.exe
35⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2516

C:\Windows\SysWOW64\Dmmpolof.exe
C:\Windows\system32\Dmmpolof.exe
36⤵
- Executes dropped EXE
PID:2912

C:\Windows\SysWOW64\Dhbdleol.exe
C:\Windows\system32\Dhbdleol.exe
37⤵
- Executes dropped EXE
PID:1160

C:\Windows\SysWOW64\Ejaphpnp.exe
C:\Windows\system32\Ejaphpnp.exe
38⤵
- Executes dropped EXE
PID:2428

C:\Windows\SysWOW64\Eicpcm32.exe
C:\Windows\system32\Eicpcm32.exe
39⤵
- Executes dropped EXE
- Modifies registry class
PID:1864

C:\Windows\SysWOW64\Emoldlmc.exe
C:\Windows\system32\Emoldlmc.exe
40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:632

C:\Windows\SysWOW64\Eblelb32.exe
C:\Windows\system32\Eblelb32.exe
41⤵
- Executes dropped EXE
PID:1648

C:\Windows\SysWOW64\Eifmimch.exe
C:\Windows\system32\Eifmimch.exe
42⤵
- Executes dropped EXE
PID:1232

C:\Windows\SysWOW64\Eppefg32.exe
C:\Windows\system32\Eppefg32.exe
43⤵
- Executes dropped EXE
PID:2512

C:\Windows\SysWOW64\Ebnabb32.exe
C:\Windows\system32\Ebnabb32.exe
44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:444

C:\Windows\SysWOW64\Eemnnn32.exe
C:\Windows\system32\Eemnnn32.exe
45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1676

C:\Windows\SysWOW64\Emdeok32.exe
C:\Windows\system32\Emdeok32.exe
46⤵
- Executes dropped EXE
PID:608

C:\Windows\SysWOW64\Epbbkf32.exe
C:\Windows\system32\Epbbkf32.exe
47⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2220

C:\Windows\SysWOW64\Ebqngb32.exe
C:\Windows\system32\Ebqngb32.exe
48⤵
- Executes dropped EXE
PID:1752

C:\Windows\SysWOW64\Efljhq32.exe
C:\Windows\system32\Efljhq32.exe
49⤵
- Executes dropped EXE
PID:972

C:\Windows\SysWOW64\Eikfdl32.exe
C:\Windows\system32\Eikfdl32.exe
50⤵
- Executes dropped EXE
PID:1976

C:\Windows\SysWOW64\Ehnfpifm.exe
C:\Windows\system32\Ehnfpifm.exe
51⤵
- Executes dropped EXE
PID:2592

C:\Windows\SysWOW64\Epeoaffo.exe
C:\Windows\system32\Epeoaffo.exe
52⤵
- Executes dropped EXE
- Modifies registry class
PID:2572

C:\Windows\SysWOW64\Eogolc32.exe
C:\Windows\system32\Eogolc32.exe
53⤵
- Executes dropped EXE
PID:2576

C:\Windows\SysWOW64\Eafkhn32.exe
C:\Windows\system32\Eafkhn32.exe
54⤵
- Executes dropped EXE
PID:1732

C:\Windows\SysWOW64\Eimcjl32.exe
C:\Windows\system32\Eimcjl32.exe
55⤵
- Executes dropped EXE
PID:2508

C:\Windows\SysWOW64\Ehpcehcj.exe
C:\Windows\system32\Ehpcehcj.exe
56⤵
- Executes dropped EXE
PID:2848

C:\Windows\SysWOW64\Eknpadcn.exe
C:\Windows\system32\Eknpadcn.exe
57⤵
- Executes dropped EXE
PID:2664

C:\Windows\SysWOW64\Eojlbb32.exe
C:\Windows\system32\Eojlbb32.exe
58⤵
- Executes dropped EXE
PID:288

C:\Windows\SysWOW64\Fahhnn32.exe
C:\Windows\system32\Fahhnn32.exe
59⤵
- Executes dropped EXE
PID:2376

C:\Windows\SysWOW64\Feddombd.exe
C:\Windows\system32\Feddombd.exe
60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2208

C:\Windows\SysWOW64\Fhbpkh32.exe
C:\Windows\system32\Fhbpkh32.exe
61⤵
- Executes dropped EXE
PID:2172

C:\Windows\SysWOW64\Flnlkgjq.exe
C:\Windows\system32\Flnlkgjq.exe
62⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2404

C:\Windows\SysWOW64\Fkqlgc32.exe
C:\Windows\system32\Fkqlgc32.exe
63⤵
- Executes dropped EXE
PID:2956

C:\Windows\SysWOW64\Fmohco32.exe
C:\Windows\system32\Fmohco32.exe
64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1884

C:\Windows\SysWOW64\Fakdcnhh.exe
C:\Windows\system32\Fakdcnhh.exe
65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1488

C:\Windows\SysWOW64\Fefqdl32.exe
C:\Windows\system32\Fefqdl32.exe
66⤵
- Modifies registry class
PID:1960

C:\Windows\SysWOW64\Fdiqpigl.exe
C:\Windows\system32\Fdiqpigl.exe
67⤵
- System Location Discovery: System Language Discovery
PID:1700

C:\Windows\SysWOW64\Fggmldfp.exe
C:\Windows\system32\Fggmldfp.exe
68⤵
PID:3060

C:\Windows\SysWOW64\Fkcilc32.exe
C:\Windows\system32\Fkcilc32.exe
69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1376

C:\Windows\SysWOW64\Fooembgb.exe
C:\Windows\system32\Fooembgb.exe
70⤵
PID:920

C:\Windows\SysWOW64\Fmaeho32.exe
C:\Windows\system32\Fmaeho32.exe
71⤵
PID:1984

C:\Windows\SysWOW64\Fppaej32.exe
C:\Windows\system32\Fppaej32.exe
72⤵
PID:2952

C:\Windows\SysWOW64\Fdkmeiei.exe
C:\Windows\system32\Fdkmeiei.exe
73⤵
PID:2228

C:\Windows\SysWOW64\Fgjjad32.exe
C:\Windows\system32\Fgjjad32.exe
74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2608

C:\Windows\SysWOW64\Fkefbcmf.exe
C:\Windows\system32\Fkefbcmf.exe
75⤵
PID:1804

C:\Windows\SysWOW64\Fmdbnnlj.exe
C:\Windows\system32\Fmdbnnlj.exe
76⤵
PID:264

C:\Windows\SysWOW64\Faonom32.exe
C:\Windows\system32\Faonom32.exe
77⤵
PID:1136

C:\Windows\SysWOW64\Fpbnjjkm.exe
C:\Windows\system32\Fpbnjjkm.exe
78⤵
PID:2372

C:\Windows\SysWOW64\Fcqjfeja.exe
C:\Windows\system32\Fcqjfeja.exe
79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:888

C:\Windows\SysWOW64\Fglfgd32.exe
C:\Windows\system32\Fglfgd32.exe
80⤵
PID:2384

C:\Windows\SysWOW64\Fkhbgbkc.exe
C:\Windows\system32\Fkhbgbkc.exe
81⤵
PID:2004

C:\Windows\SysWOW64\Fmfocnjg.exe
C:\Windows\system32\Fmfocnjg.exe
82⤵
PID:1856

C:\Windows\SysWOW64\Fliook32.exe
C:\Windows\system32\Fliook32.exe
83⤵
PID:1476

C:\Windows\SysWOW64\Fpdkpiik.exe
C:\Windows\system32\Fpdkpiik.exe
84⤵
PID:2732

C:\Windows\SysWOW64\Fdpgph32.exe
C:\Windows\system32\Fdpgph32.exe
85⤵
PID:2776

C:\Windows\SysWOW64\Fgocmc32.exe
C:\Windows\system32\Fgocmc32.exe
86⤵
PID:556

C:\Windows\SysWOW64\Feachqgb.exe
C:\Windows\system32\Feachqgb.exe
87⤵
PID:2160

C:\Windows\SysWOW64\Gmhkin32.exe
C:\Windows\system32\Gmhkin32.exe
88⤵
PID:2780

C:\Windows\SysWOW64\Glklejoo.exe
C:\Windows\system32\Glklejoo.exe
89⤵
PID:688

C:\Windows\SysWOW64\Gpggei32.exe
C:\Windows\system32\Gpggei32.exe
90⤵
PID:2248

C:\Windows\SysWOW64\Gojhafnb.exe
C:\Windows\system32\Gojhafnb.exe
91⤵
- Modifies registry class
PID:2112

C:\Windows\SysWOW64\Ggapbcne.exe
C:\Windows\system32\Ggapbcne.exe
92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2420

C:\Windows\SysWOW64\Gecpnp32.exe
C:\Windows\system32\Gecpnp32.exe
93⤵
PID:2992

C:\Windows\SysWOW64\Ghbljk32.exe
C:\Windows\system32\Ghbljk32.exe
94⤵
PID:3000

C:\Windows\SysWOW64\Glnhjjml.exe
C:\Windows\system32\Glnhjjml.exe
95⤵
PID:1964

C:\Windows\SysWOW64\Goldfelp.exe
C:\Windows\system32\Goldfelp.exe
96⤵
PID:2392

C:\Windows\SysWOW64\Gcgqgd32.exe
C:\Windows\system32\Gcgqgd32.exe
97⤵
PID:2740

C:\Windows\SysWOW64\Gajqbakc.exe
C:\Windows\system32\Gajqbakc.exe
98⤵
PID:2304

C:\Windows\SysWOW64\Giaidnkf.exe
C:\Windows\system32\Giaidnkf.exe
99⤵
- Modifies registry class
PID:1900

C:\Windows\SysWOW64\Ghdiokbq.exe
C:\Windows\system32\Ghdiokbq.exe
100⤵
PID:2084

C:\Windows\SysWOW64\Glpepj32.exe
C:\Windows\system32\Glpepj32.exe
101⤵
PID:2920

C:\Windows\SysWOW64\Gonale32.exe
C:\Windows\system32\Gonale32.exe
102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:480

C:\Windows\SysWOW64\Gamnhq32.exe
C:\Windows\system32\Gamnhq32.exe
103⤵
PID:1808

C:\Windows\SysWOW64\Gehiioaj.exe
C:\Windows\system32\Gehiioaj.exe
104⤵
PID:1764

C:\Windows\SysWOW64\Gdkjdl32.exe
C:\Windows\system32\Gdkjdl32.exe
105⤵
PID:892

C:\Windows\SysWOW64\Glbaei32.exe
C:\Windows\system32\Glbaei32.exe
106⤵
PID:1828

C:\Windows\SysWOW64\Gkebafoa.exe
C:\Windows\system32\Gkebafoa.exe
107⤵
PID:560

C:\Windows\SysWOW64\Gncnmane.exe
C:\Windows\system32\Gncnmane.exe
108⤵
- Modifies registry class
PID:1720

C:\Windows\SysWOW64\Gekfnoog.exe
C:\Windows\system32\Gekfnoog.exe
109⤵
PID:684

C:\Windows\SysWOW64\Gdnfjl32.exe
C:\Windows\system32\Gdnfjl32.exe
110⤵
- System Location Discovery: System Language Discovery
PID:2760

C:\Windows\SysWOW64\Gglbfg32.exe
C:\Windows\system32\Gglbfg32.exe
111⤵
PID:1364

C:\Windows\SysWOW64\Gkgoff32.exe
C:\Windows\system32\Gkgoff32.exe
112⤵
PID:2288

C:\Windows\SysWOW64\Gockgdeh.exe
C:\Windows\system32\Gockgdeh.exe
113⤵
- Modifies registry class
PID:2828

C:\Windows\SysWOW64\Gaagcpdl.exe
C:\Windows\system32\Gaagcpdl.exe
114⤵
PID:1056

C:\Windows\SysWOW64\Gqdgom32.exe
C:\Windows\system32\Gqdgom32.exe
115⤵
- System Location Discovery: System Language Discovery
PID:1248

C:\Windows\SysWOW64\Hdpcokdo.exe
C:\Windows\system32\Hdpcokdo.exe
116⤵
- System Location Discovery: System Language Discovery
PID:3068

C:\Windows\SysWOW64\Hgnokgcc.exe
C:\Windows\system32\Hgnokgcc.exe
117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2984

C:\Windows\SysWOW64\Hkjkle32.exe
C:\Windows\system32\Hkjkle32.exe
118⤵
PID:1656

C:\Windows\SysWOW64\Hjmlhbbg.exe
C:\Windows\system32\Hjmlhbbg.exe
119⤵
PID:2520

C:\Windows\SysWOW64\Hadcipbi.exe
C:\Windows\system32\Hadcipbi.exe
120⤵
PID:2296

C:\Windows\SysWOW64\Hqgddm32.exe
C:\Windows\system32\Hqgddm32.exe
121⤵
PID:2368

C:\Windows\SysWOW64\Hdbpekam.exe
C:\Windows\system32\Hdbpekam.exe
122⤵
PID:964

C:\Windows\SysWOW64\Hgqlafap.exe
C:\Windows\system32\Hgqlafap.exe
123⤵
PID:2204

C:\Windows\SysWOW64\Hklhae32.exe
C:\Windows\system32\Hklhae32.exe
124⤵
PID:2436

C:\Windows\SysWOW64\Hjohmbpd.exe
C:\Windows\system32\Hjohmbpd.exe
125⤵
PID:2396

C:\Windows\SysWOW64\Hmmdin32.exe
C:\Windows\system32\Hmmdin32.exe
126⤵
- Modifies registry class
PID:2940

C:\Windows\SysWOW64\Hqiqjlga.exe
C:\Windows\system32\Hqiqjlga.exe
127⤵
PID:2788

C:\Windows\SysWOW64\Hffibceh.exe
C:\Windows\system32\Hffibceh.exe
128⤵
PID:2292

C:\Windows\SysWOW64\Hnmacpfj.exe
C:\Windows\system32\Hnmacpfj.exe
129⤵
PID:2976

C:\Windows\SysWOW64\Hmpaom32.exe
C:\Windows\system32\Hmpaom32.exe
130⤵
PID:960

C:\Windows\SysWOW64\Hqkmplen.exe
C:\Windows\system32\Hqkmplen.exe
131⤵
PID:2324

C:\Windows\SysWOW64\Hcjilgdb.exe
C:\Windows\system32\Hcjilgdb.exe
132⤵
PID:2800

C:\Windows\SysWOW64\Hgeelf32.exe
C:\Windows\system32\Hgeelf32.exe
133⤵
PID:2640

C:\Windows\SysWOW64\Hjcaha32.exe
C:\Windows\system32\Hjcaha32.exe
134⤵
PID:2736

C:\Windows\SysWOW64\Hmbndmkb.exe
C:\Windows\system32\Hmbndmkb.exe
135⤵
PID:2852

C:\Windows\SysWOW64\Hqnjek32.exe
C:\Windows\system32\Hqnjek32.exe
136⤵
PID:2140

C:\Windows\SysWOW64\Hclfag32.exe
C:\Windows\system32\Hclfag32.exe
137⤵
PID:1584

C:\Windows\SysWOW64\Hbofmcij.exe
C:\Windows\system32\Hbofmcij.exe
138⤵
PID:588

C:\Windows\SysWOW64\Hfjbmb32.exe
C:\Windows\system32\Hfjbmb32.exe
139⤵
PID:2796

C:\Windows\SysWOW64\Hiioin32.exe
C:\Windows\system32\Hiioin32.exe
140⤵
PID:1756

C:\Windows\SysWOW64\Hmdkjmip.exe
C:\Windows\system32\Hmdkjmip.exe
141⤵
PID:2024

C:\Windows\SysWOW64\Ikgkei32.exe
C:\Windows\system32\Ikgkei32.exe
142⤵
PID:1000

C:\Windows\SysWOW64\Icncgf32.exe
C:\Windows\system32\Icncgf32.exe
143⤵
PID:752

C:\Windows\SysWOW64\Ibacbcgg.exe
C:\Windows\system32\Ibacbcgg.exe
144⤵
PID:1564

C:\Windows\SysWOW64\Ieponofk.exe
C:\Windows\system32\Ieponofk.exe
145⤵
PID:2804

C:\Windows\SysWOW64\Iikkon32.exe
C:\Windows\system32\Iikkon32.exe
146⤵
PID:2416

C:\Windows\SysWOW64\Ikjhki32.exe
C:\Windows\system32\Ikjhki32.exe
147⤵
PID:404

C:\Windows\SysWOW64\Ioeclg32.exe
C:\Windows\system32\Ioeclg32.exe
148⤵
PID:2676

C:\Windows\SysWOW64\Inhdgdmk.exe
C:\Windows\system32\Inhdgdmk.exe
149⤵
PID:2268

C:\Windows\SysWOW64\Ifolhann.exe
C:\Windows\system32\Ifolhann.exe
150⤵
PID:3024

C:\Windows\SysWOW64\Iebldo32.exe
C:\Windows\system32\Iebldo32.exe
151⤵
PID:1280

C:\Windows\SysWOW64\Igqhpj32.exe
C:\Windows\system32\Igqhpj32.exe
152⤵
PID:308

C:\Windows\SysWOW64\Ikldqile.exe
C:\Windows\system32\Ikldqile.exe
153⤵
PID:2856

C:\Windows\SysWOW64\Injqmdki.exe
C:\Windows\system32\Injqmdki.exe
154⤵
PID:2632

C:\Windows\SysWOW64\Ibfmmb32.exe
C:\Windows\system32\Ibfmmb32.exe
155⤵
PID:2944

C:\Windows\SysWOW64\Iaimipjl.exe
C:\Windows\system32\Iaimipjl.exe
156⤵
PID:2660

C:\Windows\SysWOW64\Iipejmko.exe
C:\Windows\system32\Iipejmko.exe
157⤵
PID:2688

C:\Windows\SysWOW64\Igceej32.exe
C:\Windows\system32\Igceej32.exe
158⤵
PID:2716

C:\Windows\SysWOW64\Iknafhjb.exe
C:\Windows\system32\Iknafhjb.exe
159⤵
PID:1080

C:\Windows\SysWOW64\Inmmbc32.exe
C:\Windows\system32\Inmmbc32.exe
160⤵
- Drops file in System32 directory
- Modifies registry class
PID:1068

C:\Windows\SysWOW64\Iakino32.exe
C:\Windows\system32\Iakino32.exe
161⤵
PID:668

C:\Windows\SysWOW64\Iegeonpc.exe
C:\Windows\system32\Iegeonpc.exe
162⤵
PID:1152

C:\Windows\SysWOW64\Igebkiof.exe
C:\Windows\system32\Igebkiof.exe
163⤵
PID:2836

C:\Windows\SysWOW64\Ikqnlh32.exe
C:\Windows\system32\Ikqnlh32.exe
164⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2456

C:\Windows\SysWOW64\Inojhc32.exe
C:\Windows\system32\Inojhc32.exe
165⤵
PID:2028

C:\Windows\SysWOW64\Imbjcpnn.exe
C:\Windows\system32\Imbjcpnn.exe
166⤵
PID:376

C:\Windows\SysWOW64\Ieibdnnp.exe
C:\Windows\system32\Ieibdnnp.exe
167⤵
PID:2588

C:\Windows\SysWOW64\Iclbpj32.exe
C:\Windows\system32\Iclbpj32.exe
168⤵
PID:2380

C:\Windows\SysWOW64\Jfjolf32.exe
C:\Windows\system32\Jfjolf32.exe
169⤵
PID:2612

C:\Windows\SysWOW64\Jjfkmdlg.exe
C:\Windows\system32\Jjfkmdlg.exe
170⤵
PID:2704

C:\Windows\SysWOW64\Japciodd.exe
C:\Windows\system32\Japciodd.exe
171⤵
PID:2064

C:\Windows\SysWOW64\Jcnoejch.exe
C:\Windows\system32\Jcnoejch.exe
172⤵
PID:1528

C:\Windows\SysWOW64\Jgjkfi32.exe
C:\Windows\system32\Jgjkfi32.exe
173⤵
PID:3056

C:\Windows\SysWOW64\Jfmkbebl.exe
C:\Windows\system32\Jfmkbebl.exe
174⤵
PID:3096

C:\Windows\SysWOW64\Jjhgbd32.exe
C:\Windows\system32\Jjhgbd32.exe
175⤵
PID:3136

C:\Windows\SysWOW64\Jmfcop32.exe
C:\Windows\system32\Jmfcop32.exe
176⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3176

C:\Windows\SysWOW64\Jabponba.exe
C:\Windows\system32\Jabponba.exe
177⤵
PID:3216

C:\Windows\SysWOW64\Jcqlkjae.exe
C:\Windows\system32\Jcqlkjae.exe
178⤵
PID:3256

C:\Windows\SysWOW64\Jbclgf32.exe
C:\Windows\system32\Jbclgf32.exe
179⤵
PID:3296

C:\Windows\SysWOW64\Jfohgepi.exe
C:\Windows\system32\Jfohgepi.exe
180⤵
PID:3336

C:\Windows\SysWOW64\Jjjdhc32.exe
C:\Windows\system32\Jjjdhc32.exe
181⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3376

C:\Windows\SysWOW64\Jimdcqom.exe
C:\Windows\system32\Jimdcqom.exe
182⤵
- System Location Discovery: System Language Discovery
PID:3416

C:\Windows\SysWOW64\Jmipdo32.exe
C:\Windows\system32\Jmipdo32.exe
183⤵
PID:3456

C:\Windows\SysWOW64\Jllqplnp.exe
C:\Windows\system32\Jllqplnp.exe
184⤵
PID:3496

C:\Windows\SysWOW64\Jpgmpk32.exe
C:\Windows\system32\Jpgmpk32.exe
185⤵
PID:3536

C:\Windows\SysWOW64\Jbfilffm.exe
C:\Windows\system32\Jbfilffm.exe
186⤵
- System Location Discovery: System Language Discovery
PID:3576

C:\Windows\SysWOW64\Jfaeme32.exe
C:\Windows\system32\Jfaeme32.exe
187⤵
PID:3616

C:\Windows\SysWOW64\Jedehaea.exe
C:\Windows\system32\Jedehaea.exe
188⤵
PID:3656

C:\Windows\SysWOW64\Jmkmjoec.exe
C:\Windows\system32\Jmkmjoec.exe
189⤵
PID:3696

C:\Windows\SysWOW64\Jlnmel32.exe
C:\Windows\system32\Jlnmel32.exe
190⤵
- Modifies registry class
PID:3736

C:\Windows\SysWOW64\Jpjifjdg.exe
C:\Windows\system32\Jpjifjdg.exe
191⤵
PID:3776

C:\Windows\SysWOW64\Jnmiag32.exe
C:\Windows\system32\Jnmiag32.exe
192⤵
PID:3816

C:\Windows\SysWOW64\Jbhebfck.exe
C:\Windows\system32\Jbhebfck.exe
193⤵
PID:3856

C:\Windows\SysWOW64\Jfcabd32.exe
C:\Windows\system32\Jfcabd32.exe
194⤵
PID:3896

C:\Windows\SysWOW64\Jibnop32.exe
C:\Windows\system32\Jibnop32.exe
195⤵
PID:3936

C:\Windows\SysWOW64\Jhenjmbb.exe
C:\Windows\system32\Jhenjmbb.exe
196⤵
PID:3976

C:\Windows\SysWOW64\Jnofgg32.exe
C:\Windows\system32\Jnofgg32.exe
197⤵
- Modifies registry class
PID:4016

C:\Windows\SysWOW64\Kbjbge32.exe
C:\Windows\system32\Kbjbge32.exe
198⤵
PID:4056

C:\Windows\SysWOW64\Keioca32.exe
C:\Windows\system32\Keioca32.exe
199⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:824

C:\Windows\SysWOW64\Kidjdpie.exe
C:\Windows\system32\Kidjdpie.exe
200⤵
PID:3120

C:\Windows\SysWOW64\Klcgpkhh.exe
C:\Windows\system32\Klcgpkhh.exe
201⤵
PID:3168

C:\Windows\SysWOW64\Kbmome32.exe
C:\Windows\system32\Kbmome32.exe
202⤵
PID:3212

C:\Windows\SysWOW64\Kapohbfp.exe
C:\Windows\system32\Kapohbfp.exe
203⤵
PID:3268

C:\Windows\SysWOW64\Kdnkdmec.exe
C:\Windows\system32\Kdnkdmec.exe
204⤵
PID:3320

C:\Windows\SysWOW64\Khjgel32.exe
C:\Windows\system32\Khjgel32.exe
205⤵
PID:3368

C:\Windows\SysWOW64\Klecfkff.exe
C:\Windows\system32\Klecfkff.exe
206⤵
PID:3424

C:\Windows\SysWOW64\Kjhcag32.exe
C:\Windows\system32\Kjhcag32.exe
207⤵
PID:3468

C:\Windows\SysWOW64\Kocpbfei.exe
C:\Windows\system32\Kocpbfei.exe
208⤵
PID:3524

C:\Windows\SysWOW64\Kmfpmc32.exe
C:\Windows\system32\Kmfpmc32.exe
209⤵
PID:3568

C:\Windows\SysWOW64\Kablnadm.exe
C:\Windows\system32\Kablnadm.exe
210⤵
PID:3512

C:\Windows\SysWOW64\Kdphjm32.exe
C:\Windows\system32\Kdphjm32.exe
211⤵
PID:3668

C:\Windows\SysWOW64\Khldkllj.exe
C:\Windows\system32\Khldkllj.exe
212⤵
PID:3720

C:\Windows\SysWOW64\Kfodfh32.exe
C:\Windows\system32\Kfodfh32.exe
213⤵
PID:3768

C:\Windows\SysWOW64\Kkjpggkn.exe
C:\Windows\system32\Kkjpggkn.exe
214⤵
- Modifies registry class
PID:3824

C:\Windows\SysWOW64\Koflgf32.exe
C:\Windows\system32\Koflgf32.exe
215⤵
PID:3868

C:\Windows\SysWOW64\Kmimcbja.exe
C:\Windows\system32\Kmimcbja.exe
216⤵
PID:3832

C:\Windows\SysWOW64\Kadica32.exe
C:\Windows\system32\Kadica32.exe
217⤵
PID:3964

C:\Windows\SysWOW64\Kdbepm32.exe
C:\Windows\system32\Kdbepm32.exe
218⤵
PID:4008

C:\Windows\SysWOW64\Khnapkjg.exe
C:\Windows\system32\Khnapkjg.exe
219⤵
PID:4076

C:\Windows\SysWOW64\Kkmmlgik.exe
C:\Windows\system32\Kkmmlgik.exe
220⤵
PID:3104

C:\Windows\SysWOW64\Kmkihbho.exe
C:\Windows\system32\Kmkihbho.exe
221⤵
PID:3148

C:\Windows\SysWOW64\Kageia32.exe
C:\Windows\system32\Kageia32.exe
222⤵
PID:3208

C:\Windows\SysWOW64\Kpieengb.exe
C:\Windows\system32\Kpieengb.exe
223⤵
PID:3292

C:\Windows\SysWOW64\Kdeaelok.exe
C:\Windows\system32\Kdeaelok.exe
224⤵
PID:3356

C:\Windows\SysWOW64\Kbhbai32.exe
C:\Windows\system32\Kbhbai32.exe
225⤵
PID:3412

C:\Windows\SysWOW64\Kkojbf32.exe
C:\Windows\system32\Kkojbf32.exe
226⤵
PID:3480

C:\Windows\SysWOW64\Lmmfnb32.exe
C:\Windows\system32\Lmmfnb32.exe
227⤵
PID:3544

C:\Windows\SysWOW64\Llpfjomf.exe
C:\Windows\system32\Llpfjomf.exe
228⤵
PID:3604

C:\Windows\SysWOW64\Ldgnklmi.exe
C:\Windows\system32\Ldgnklmi.exe
229⤵
- System Location Discovery: System Language Discovery
PID:3648

C:\Windows\SysWOW64\Lgfjggll.exe
C:\Windows\system32\Lgfjggll.exe
230⤵
PID:3732

C:\Windows\SysWOW64\Leikbd32.exe
C:\Windows\system32\Leikbd32.exe
231⤵
PID:3788

C:\Windows\SysWOW64\Lidgcclp.exe
C:\Windows\system32\Lidgcclp.exe
232⤵
PID:3844

C:\Windows\SysWOW64\Lmpcca32.exe
C:\Windows\system32\Lmpcca32.exe
233⤵
PID:3916

C:\Windows\SysWOW64\Llbconkd.exe
C:\Windows\system32\Llbconkd.exe
234⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3972

C:\Windows\SysWOW64\Loaokjjg.exe
C:\Windows\system32\Loaokjjg.exe
235⤵
PID:4040

C:\Windows\SysWOW64\Lghgmg32.exe
C:\Windows\system32\Lghgmg32.exe
236⤵
- Modifies registry class
PID:4092

C:\Windows\SysWOW64\Lekghdad.exe
C:\Windows\system32\Lekghdad.exe
237⤵
- Modifies registry class
PID:4072

C:\Windows\SysWOW64\Lhiddoph.exe
C:\Windows\system32\Lhiddoph.exe
238⤵
PID:3200

C:\Windows\SysWOW64\Loclai32.exe
C:\Windows\system32\Loclai32.exe
239⤵
PID:3304

C:\Windows\SysWOW64\Lemdncoa.exe
C:\Windows\system32\Lemdncoa.exe
240⤵
- Modifies registry class
PID:3388

C:\Windows\SysWOW64\Lhlqjone.exe
C:\Windows\system32\Lhlqjone.exe
241⤵
PID:3464

C:\Windows\SysWOW64\Llgljn32.exe
C:\Windows\system32\Llgljn32.exe
242⤵
PID:3448

C:\Windows\SysWOW64\Lofifi32.exe
C:\Windows\system32\Lofifi32.exe
243⤵
- Modifies registry class
PID:3632

C:\Windows\SysWOW64\Lcadghnk.exe
C:\Windows\system32\Lcadghnk.exe
244⤵
- Modifies registry class
PID:3592

C:\Windows\SysWOW64\Ldbaopdj.exe
C:\Windows\system32\Ldbaopdj.exe
245⤵
PID:3784

C:\Windows\SysWOW64\Lljipmdl.exe
C:\Windows\system32\Lljipmdl.exe
246⤵
PID:3852

C:\Windows\SysWOW64\Lklikj32.exe
C:\Windows\system32\Lklikj32.exe
247⤵
- Drops file in System32 directory
PID:3756

C:\Windows\SysWOW64\Lafahdcc.exe
C:\Windows\system32\Lafahdcc.exe
248⤵
PID:4028

C:\Windows\SysWOW64\Mdendpbg.exe
C:\Windows\system32\Mdendpbg.exe
249⤵
PID:3084

C:\Windows\SysWOW64\Mgcjpkak.exe
C:\Windows\system32\Mgcjpkak.exe
250⤵
- Drops file in System32 directory
PID:4068

C:\Windows\SysWOW64\Mnmbme32.exe
C:\Windows\system32\Mnmbme32.exe
251⤵
PID:3252

C:\Windows\SysWOW64\Mploiq32.exe
C:\Windows\system32\Mploiq32.exe
252⤵
- Modifies registry class
PID:3152

C:\Windows\SysWOW64\Mgegfk32.exe
C:\Windows\system32\Mgegfk32.exe
253⤵
PID:3312

C:\Windows\SysWOW64\Mkacfiga.exe
C:\Windows\system32\Mkacfiga.exe
254⤵
PID:3528

C:\Windows\SysWOW64\Mnpobefe.exe
C:\Windows\system32\Mnpobefe.exe
255⤵
PID:3560

C:\Windows\SysWOW64\Mpnkopeh.exe
C:\Windows\system32\Mpnkopeh.exe
256⤵
PID:3552

C:\Windows\SysWOW64\Mclgklel.exe
C:\Windows\system32\Mclgklel.exe
257⤵
- Drops file in System32 directory
PID:3840

C:\Windows\SysWOW64\Mkcplien.exe
C:\Windows\system32\Mkcplien.exe
258⤵
PID:3752

C:\Windows\SysWOW64\Mnblhddb.exe
C:\Windows\system32\Mnblhddb.exe
259⤵
PID:3952

C:\Windows\SysWOW64\Mpphdpcf.exe
C:\Windows\system32\Mpphdpcf.exe
260⤵
PID:4036

C:\Windows\SysWOW64\Mcodqkbi.exe
C:\Windows\system32\Mcodqkbi.exe
261⤵
PID:3108

C:\Windows\SysWOW64\Mfmqmgbm.exe
C:\Windows\system32\Mfmqmgbm.exe
262⤵
PID:3344

C:\Windows\SysWOW64\Mndhnd32.exe
C:\Windows\system32\Mndhnd32.exe
263⤵
- System Location Discovery: System Language Discovery
PID:3452

C:\Windows\SysWOW64\Moeeelhn.exe
C:\Windows\system32\Moeeelhn.exe
264⤵
PID:3508

C:\Windows\SysWOW64\Mgmmfjip.exe
C:\Windows\system32\Mgmmfjip.exe
265⤵
PID:3628

C:\Windows\SysWOW64\Mlieoqgg.exe
C:\Windows\system32\Mlieoqgg.exe
266⤵
PID:3596

C:\Windows\SysWOW64\Nohaklfk.exe
C:\Windows\system32\Nohaklfk.exe
267⤵
PID:3960

C:\Windows\SysWOW64\Njmfhe32.exe
C:\Windows\system32\Njmfhe32.exe
268⤵
- Modifies registry class
PID:4064

C:\Windows\SysWOW64\Nllbdp32.exe
C:\Windows\system32\Nllbdp32.exe
269⤵
PID:3184

C:\Windows\SysWOW64\Ncfjajma.exe
C:\Windows\system32\Ncfjajma.exe
270⤵
PID:3332

C:\Windows\SysWOW64\Nfdfmfle.exe
C:\Windows\system32\Nfdfmfle.exe
271⤵
PID:3504

C:\Windows\SysWOW64\Ndggib32.exe
C:\Windows\system32\Ndggib32.exe
272⤵
PID:3600

C:\Windows\SysWOW64\Nmnojp32.exe
C:\Windows\system32\Nmnojp32.exe
273⤵
PID:3808

C:\Windows\SysWOW64\Nomkfk32.exe
C:\Windows\system32\Nomkfk32.exe
274⤵
PID:3884

C:\Windows\SysWOW64\Nbkgbg32.exe
C:\Windows\system32\Nbkgbg32.exe
275⤵
PID:4088

C:\Windows\SysWOW64\Ndicnb32.exe
C:\Windows\system32\Ndicnb32.exe
276⤵
PID:4084

C:\Windows\SysWOW64\Nghpjn32.exe
C:\Windows\system32\Nghpjn32.exe
277⤵
PID:3444

C:\Windows\SysWOW64\Noohlkpc.exe
C:\Windows\system32\Noohlkpc.exe
278⤵
- Modifies registry class
PID:3428

C:\Windows\SysWOW64\Nbmdhfog.exe
C:\Windows\system32\Nbmdhfog.exe
279⤵
PID:3636

C:\Windows\SysWOW64\Nqpdcc32.exe
C:\Windows\system32\Nqpdcc32.exe
280⤵
PID:4024

C:\Windows\SysWOW64\Ndlpdbnj.exe
C:\Windows\system32\Ndlpdbnj.exe
281⤵
PID:3880

C:\Windows\SysWOW64\Nigldq32.exe
C:\Windows\system32\Nigldq32.exe
282⤵
PID:3316

C:\Windows\SysWOW64\Ngjlpmnn.exe
C:\Windows\system32\Ngjlpmnn.exe
283⤵
PID:3516

C:\Windows\SysWOW64\Nkehql32.exe
C:\Windows\system32\Nkehql32.exe
284⤵
- Modifies registry class
PID:3928

C:\Windows\SysWOW64\Njhilimb.exe
C:\Windows\system32\Njhilimb.exe
285⤵
PID:3088

C:\Windows\SysWOW64\Nbpqmfmd.exe
C:\Windows\system32\Nbpqmfmd.exe
286⤵
PID:3532

C:\Windows\SysWOW64\Ogliemkk.exe
C:\Windows\system32\Ogliemkk.exe
287⤵
PID:3400

C:\Windows\SysWOW64\Ojkeah32.exe
C:\Windows\system32\Ojkeah32.exe
288⤵
PID:3836

C:\Windows\SysWOW64\Onfabgch.exe
C:\Windows\system32\Onfabgch.exe
289⤵
PID:3284

C:\Windows\SysWOW64\Oqennbbl.exe
C:\Windows\system32\Oqennbbl.exe
290⤵
PID:3800

C:\Windows\SysWOW64\Occjjnap.exe
C:\Windows\system32\Occjjnap.exe
291⤵
PID:3484

C:\Windows\SysWOW64\Ofafgipc.exe
C:\Windows\system32\Ofafgipc.exe
292⤵
- Modifies registry class
PID:3192

C:\Windows\SysWOW64\Oninhgae.exe
C:\Windows\system32\Oninhgae.exe
293⤵
PID:3984

C:\Windows\SysWOW64\Omlncc32.exe
C:\Windows\system32\Omlncc32.exe
294⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3384

C:\Windows\SysWOW64\Opjkpo32.exe
C:\Windows\system32\Opjkpo32.exe
295⤵
- Drops file in System32 directory
PID:3684

C:\Windows\SysWOW64\Ofdclinq.exe
C:\Windows\system32\Ofdclinq.exe
296⤵
- System Location Discovery: System Language Discovery
PID:3912

C:\Windows\SysWOW64\Ojpomh32.exe
C:\Windows\system32\Ojpomh32.exe
297⤵
PID:3392

C:\Windows\SysWOW64\Oibohdmd.exe
C:\Windows\system32\Oibohdmd.exe
298⤵
PID:3924

C:\Windows\SysWOW64\Oplgeoea.exe
C:\Windows\system32\Oplgeoea.exe
299⤵
PID:3476

C:\Windows\SysWOW64\Offpbi32.exe
C:\Windows\system32\Offpbi32.exe
300⤵
- System Location Discovery: System Language Discovery
PID:3240

C:\Windows\SysWOW64\Olchjp32.exe
C:\Windows\system32\Olchjp32.exe
301⤵
PID:4132

C:\Windows\SysWOW64\Oekmceaf.exe
C:\Windows\system32\Oekmceaf.exe
302⤵
PID:4172

C:\Windows\SysWOW64\Ombddbah.exe
C:\Windows\system32\Ombddbah.exe
303⤵
PID:4212

C:\Windows\SysWOW64\Pndalkgf.exe
C:\Windows\system32\Pndalkgf.exe
304⤵
PID:4252

C:\Windows\SysWOW64\Penihe32.exe
C:\Windows\system32\Penihe32.exe
305⤵
PID:4292

C:\Windows\SysWOW64\Piieicgl.exe
C:\Windows\system32\Piieicgl.exe
306⤵
PID:4332

C:\Windows\SysWOW64\Plhaeofp.exe
C:\Windows\system32\Plhaeofp.exe
307⤵
PID:4372

C:\Windows\SysWOW64\Ppcmfn32.exe
C:\Windows\system32\Ppcmfn32.exe
308⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:4412

C:\Windows\SysWOW64\Padjmfdg.exe
C:\Windows\system32\Padjmfdg.exe
309⤵
PID:4452

C:\Windows\SysWOW64\Pilbocej.exe
C:\Windows\system32\Pilbocej.exe
310⤵
PID:4492

C:\Windows\SysWOW64\Pjmnfk32.exe
C:\Windows\system32\Pjmnfk32.exe
311⤵
PID:4532

C:\Windows\SysWOW64\Pbdfgilj.exe
C:\Windows\system32\Pbdfgilj.exe
312⤵
PID:4572

C:\Windows\SysWOW64\Pebbcdkn.exe
C:\Windows\system32\Pebbcdkn.exe
313⤵
PID:4612

C:\Windows\SysWOW64\Pdecoa32.exe
C:\Windows\system32\Pdecoa32.exe
314⤵
PID:4652

C:\Windows\SysWOW64\Pjoklkie.exe
C:\Windows\system32\Pjoklkie.exe
315⤵
PID:4692

C:\Windows\SysWOW64\Pmnghfhi.exe
C:\Windows\system32\Pmnghfhi.exe
316⤵
PID:4732

C:\Windows\SysWOW64\Peeoidik.exe
C:\Windows\system32\Peeoidik.exe
317⤵
PID:4776

C:\Windows\SysWOW64\Phcleoho.exe
C:\Windows\system32\Phcleoho.exe
318⤵
PID:4820

C:\Windows\SysWOW64\Pmpdmfff.exe
C:\Windows\system32\Pmpdmfff.exe
319⤵
PID:4860

C:\Windows\SysWOW64\Palpneop.exe
C:\Windows\system32\Palpneop.exe
320⤵
PID:4900

C:\Windows\SysWOW64\Pdjljpnc.exe
C:\Windows\system32\Pdjljpnc.exe
321⤵
PID:4940

C:\Windows\SysWOW64\Pfhhflmg.exe
C:\Windows\system32\Pfhhflmg.exe
322⤵
PID:4980

C:\Windows\SysWOW64\Qigebglj.exe
C:\Windows\system32\Qigebglj.exe
323⤵
- System Location Discovery: System Language Discovery
PID:5020

C:\Windows\SysWOW64\Qanmcdlm.exe
C:\Windows\system32\Qanmcdlm.exe
324⤵
PID:5060

C:\Windows\SysWOW64\Qboikm32.exe
C:\Windows\system32\Qboikm32.exe
325⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5100

C:\Windows\SysWOW64\Qfkelkkd.exe
C:\Windows\system32\Qfkelkkd.exe
326⤵
- Drops file in System32 directory
PID:4112

C:\Windows\SysWOW64\Qjfalj32.exe
C:\Windows\system32\Qjfalj32.exe
327⤵
PID:4156

C:\Windows\SysWOW64\Qiiahgjh.exe
C:\Windows\system32\Qiiahgjh.exe
328⤵
PID:4184

C:\Windows\SysWOW64\Qlgndbil.exe
C:\Windows\system32\Qlgndbil.exe
329⤵
PID:4268

C:\Windows\SysWOW64\Qpcjeaad.exe
C:\Windows\system32\Qpcjeaad.exe
330⤵
PID:4304

C:\Windows\SysWOW64\Afmbak32.exe
C:\Windows\system32\Afmbak32.exe
331⤵
- Modifies registry class
PID:4360

C:\Windows\SysWOW64\Amgjnepn.exe
C:\Windows\system32\Amgjnepn.exe
332⤵
PID:4420

C:\Windows\SysWOW64\Apefjqob.exe
C:\Windows\system32\Apefjqob.exe
333⤵
PID:4444

C:\Windows\SysWOW64\Afpogk32.exe
C:\Windows\system32\Afpogk32.exe
334⤵
PID:4508

C:\Windows\SysWOW64\Ainkcf32.exe
C:\Windows\system32\Ainkcf32.exe
335⤵
PID:4548

C:\Windows\SysWOW64\Ahqkocmm.exe
C:\Windows\system32\Ahqkocmm.exe
336⤵
- Drops file in System32 directory
PID:4544

C:\Windows\SysWOW64\Aphcppmo.exe
C:\Windows\system32\Aphcppmo.exe
337⤵
PID:4648

C:\Windows\SysWOW64\Aokckm32.exe
C:\Windows\system32\Aokckm32.exe
338⤵
PID:4700

C:\Windows\SysWOW64\Aaipghcn.exe
C:\Windows\system32\Aaipghcn.exe
339⤵
PID:4712

C:\Windows\SysWOW64\Ahchdb32.exe
C:\Windows\system32\Ahchdb32.exe
340⤵
PID:4816

C:\Windows\SysWOW64\Akadpn32.exe
C:\Windows\system32\Akadpn32.exe
341⤵
PID:4832

C:\Windows\SysWOW64\Abhlak32.exe
C:\Windows\system32\Abhlak32.exe
342⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4908

C:\Windows\SysWOW64\Aeghng32.exe
C:\Windows\system32\Aeghng32.exe
343⤵
PID:4956

C:\Windows\SysWOW64\Ahedjb32.exe
C:\Windows\system32\Ahedjb32.exe
344⤵
PID:5008

C:\Windows\SysWOW64\Akdafn32.exe
C:\Windows\system32\Akdafn32.exe
345⤵
PID:5048

C:\Windows\SysWOW64\Anbmbi32.exe
C:\Windows\system32\Anbmbi32.exe
346⤵
PID:5108

C:\Windows\SysWOW64\Adleoc32.exe
C:\Windows\system32\Adleoc32.exe
347⤵
PID:4124

C:\Windows\SysWOW64\Ahhaobfe.exe
C:\Windows\system32\Ahhaobfe.exe
348⤵
PID:4196

C:\Windows\SysWOW64\Aoaill32.exe
C:\Windows\system32\Aoaill32.exe
349⤵
PID:4188

C:\Windows\SysWOW64\Bapfhg32.exe
C:\Windows\system32\Bapfhg32.exe
350⤵
PID:4324

C:\Windows\SysWOW64\Bdobdc32.exe
C:\Windows\system32\Bdobdc32.exe
351⤵
PID:4380

C:\Windows\SysWOW64\Bhjneadb.exe
C:\Windows\system32\Bhjneadb.exe
352⤵
- Drops file in System32 directory
PID:4424

C:\Windows\SysWOW64\Bkhjamcf.exe
C:\Windows\system32\Bkhjamcf.exe
353⤵
PID:4500

C:\Windows\SysWOW64\Babbng32.exe
C:\Windows\system32\Babbng32.exe
354⤵
PID:4560

C:\Windows\SysWOW64\Bdaojbjf.exe
C:\Windows\system32\Bdaojbjf.exe
355⤵
PID:4632

C:\Windows\SysWOW64\Bccoeo32.exe
C:\Windows\system32\Bccoeo32.exe
356⤵
PID:4680

C:\Windows\SysWOW64\Bjngbihn.exe
C:\Windows\system32\Bjngbihn.exe
357⤵
PID:4672

C:\Windows\SysWOW64\Bllcnega.exe
C:\Windows\system32\Bllcnega.exe
358⤵
PID:4836

C:\Windows\SysWOW64\Bcflko32.exe
C:\Windows\system32\Bcflko32.exe
359⤵
- Drops file in System32 directory
- Modifies registry class
PID:4896

C:\Windows\SysWOW64\Bedhgj32.exe
C:\Windows\system32\Bedhgj32.exe
360⤵
- Drops file in System32 directory
PID:4948

C:\Windows\SysWOW64\Blnpddeo.exe
C:\Windows\system32\Blnpddeo.exe
361⤵
PID:5016

C:\Windows\SysWOW64\Bchhqo32.exe
C:\Windows\system32\Bchhqo32.exe
362⤵
PID:5076

C:\Windows\SysWOW64\Bfgdmjlp.exe
C:\Windows\system32\Bfgdmjlp.exe
363⤵
- Drops file in System32 directory
PID:4100

C:\Windows\SysWOW64\Bheaiekc.exe
C:\Windows\system32\Bheaiekc.exe
364⤵
PID:4152

C:\Windows\SysWOW64\Baneak32.exe
C:\Windows\system32\Baneak32.exe
365⤵
- System Location Discovery: System Language Discovery
PID:4240

C:\Windows\SysWOW64\Bjembh32.exe
C:\Windows\system32\Bjembh32.exe
366⤵
PID:4276

C:\Windows\SysWOW64\Coafko32.exe
C:\Windows\system32\Coafko32.exe
367⤵
PID:4400

C:\Windows\SysWOW64\Ccmblnif.exe
C:\Windows\system32\Ccmblnif.exe
368⤵
PID:4472

C:\Windows\SysWOW64\Cdnncfoe.exe
C:\Windows\system32\Cdnncfoe.exe
369⤵
PID:4504

C:\Windows\SysWOW64\Clefdcog.exe
C:\Windows\system32\Clefdcog.exe
370⤵
PID:4600

C:\Windows\SysWOW64\Cbbomjnn.exe
C:\Windows\system32\Cbbomjnn.exe
371⤵
PID:4724

C:\Windows\SysWOW64\Cfnkmi32.exe
C:\Windows\system32\Cfnkmi32.exe
372⤵
PID:4796

C:\Windows\SysWOW64\Chlgid32.exe
C:\Windows\system32\Chlgid32.exe
373⤵
PID:4828

C:\Windows\SysWOW64\Cgogealf.exe
C:\Windows\system32\Cgogealf.exe
374⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:4976

C:\Windows\SysWOW64\Cofofolh.exe
C:\Windows\system32\Cofofolh.exe
375⤵
PID:4972

C:\Windows\SysWOW64\Cbdkbjkl.exe
C:\Windows\system32\Cbdkbjkl.exe
376⤵
PID:3244

C:\Windows\SysWOW64\Chocodch.exe
C:\Windows\system32\Chocodch.exe
377⤵
PID:4280

C:\Windows\SysWOW64\Ckmpkpbl.exe
C:\Windows\system32\Ckmpkpbl.exe
378⤵
PID:4312

C:\Windows\SysWOW64\Cbghhj32.exe
C:\Windows\system32\Cbghhj32.exe
379⤵
PID:4408

C:\Windows\SysWOW64\Cdedde32.exe
C:\Windows\system32\Cdedde32.exe
380⤵
PID:4568

C:\Windows\SysWOW64\Ckomqopi.exe
C:\Windows\system32\Ckomqopi.exe
381⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4528

C:\Windows\SysWOW64\Cnnimkom.exe
C:\Windows\system32\Cnnimkom.exe
382⤵
PID:4792

C:\Windows\SysWOW64\Ddhaie32.exe
C:\Windows\system32\Ddhaie32.exe
383⤵
PID:4708

C:\Windows\SysWOW64\Dcjaeamd.exe
C:\Windows\system32\Dcjaeamd.exe
384⤵
PID:4912

C:\Windows\SysWOW64\Dfinam32.exe
C:\Windows\system32\Dfinam32.exe
385⤵
PID:4928

C:\Windows\SysWOW64\Djdjalea.exe
C:\Windows\system32\Djdjalea.exe
386⤵
PID:4288

C:\Windows\SysWOW64\Doabjbci.exe
C:\Windows\system32\Doabjbci.exe
387⤵
PID:4800

C:\Windows\SysWOW64\Dcmnja32.exe
C:\Windows\system32\Dcmnja32.exe
388⤵
PID:4348

C:\Windows\SysWOW64\Djgfgkbo.exe
C:\Windows\system32\Djgfgkbo.exe
389⤵
PID:4440

C:\Windows\SysWOW64\Dmebcgbb.exe
C:\Windows\system32\Dmebcgbb.exe
390⤵
PID:4596

C:\Windows\SysWOW64\Docopbaf.exe
C:\Windows\system32\Docopbaf.exe
391⤵
PID:4676

C:\Windows\SysWOW64\Dbbklnpj.exe
C:\Windows\system32\Dbbklnpj.exe
392⤵
- Drops file in System32 directory
PID:4808

C:\Windows\SysWOW64\Djicmk32.exe
C:\Windows\system32\Djicmk32.exe
393⤵
PID:4968

C:\Windows\SysWOW64\Dkjpdcfj.exe
C:\Windows\system32\Dkjpdcfj.exe
394⤵
PID:5096

C:\Windows\SysWOW64\Dcageqgm.exe
C:\Windows\system32\Dcageqgm.exe
395⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5000

C:\Windows\SysWOW64\Dfpcblfp.exe
C:\Windows\system32\Dfpcblfp.exe
396⤵
- Drops file in System32 directory
PID:3680

C:\Windows\SysWOW64\Dkmljcdh.exe
C:\Windows\system32\Dkmljcdh.exe
397⤵
PID:3764

C:\Windows\SysWOW64\Dbgdgm32.exe
C:\Windows\system32\Dbgdgm32.exe
398⤵
PID:4628

C:\Windows\SysWOW64\Dfbqgldn.exe
C:\Windows\system32\Dfbqgldn.exe
399⤵
PID:4784

C:\Windows\SysWOW64\Diqmcgca.exe
C:\Windows\system32\Diqmcgca.exe
400⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4868

C:\Windows\SysWOW64\Eloipb32.exe
C:\Windows\system32\Eloipb32.exe
401⤵
PID:4960

C:\Windows\SysWOW64\Epkepakn.exe
C:\Windows\system32\Epkepakn.exe
402⤵
PID:4116

C:\Windows\SysWOW64\Ealahi32.exe
C:\Windows\system32\Ealahi32.exe
403⤵
PID:4428

C:\Windows\SysWOW64\Eiciig32.exe
C:\Windows\system32\Eiciig32.exe
404⤵
- Modifies registry class
PID:4476

C:\Windows\SysWOW64\Ejdfqogm.exe
C:\Windows\system32\Ejdfqogm.exe
405⤵
PID:4520

C:\Windows\SysWOW64\Ebknblho.exe
C:\Windows\system32\Ebknblho.exe
406⤵
PID:4932

C:\Windows\SysWOW64\Ehhfjcff.exe
C:\Windows\system32\Ehhfjcff.exe
407⤵
PID:4388

C:\Windows\SysWOW64\Eldbkbop.exe
C:\Windows\system32\Eldbkbop.exe
408⤵
PID:4384

C:\Windows\SysWOW64\Eaqkcimg.exe
C:\Windows\system32\Eaqkcimg.exe
409⤵
- System Location Discovery: System Language Discovery
PID:4644

C:\Windows\SysWOW64\Ecogodlk.exe
C:\Windows\system32\Ecogodlk.exe
410⤵
PID:4168

C:\Windows\SysWOW64\Efmckpko.exe
C:\Windows\system32\Efmckpko.exe
411⤵
PID:4220

C:\Windows\SysWOW64\Endklmlq.exe
C:\Windows\system32\Endklmlq.exe
412⤵
PID:4164

C:\Windows\SysWOW64\Epfhde32.exe
C:\Windows\system32\Epfhde32.exe
413⤵
PID:4848

C:\Windows\SysWOW64\Ecadddjh.exe
C:\Windows\system32\Ecadddjh.exe
414⤵
PID:5052

C:\Windows\SysWOW64\Einlmkhp.exe
C:\Windows\system32\Einlmkhp.exe
415⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4228

C:\Windows\SysWOW64\Eaednh32.exe
C:\Windows\system32\Eaednh32.exe
416⤵
PID:5004

C:\Windows\SysWOW64\Fjnignob.exe
C:\Windows\system32\Fjnignob.exe
417⤵
- Modifies registry class
PID:4764

C:\Windows\SysWOW64\Fmlecinf.exe
C:\Windows\system32\Fmlecinf.exe
418⤵
PID:4588

C:\Windows\SysWOW64\Fbimkpmm.exe
C:\Windows\system32\Fbimkpmm.exe
419⤵
PID:4768

C:\Windows\SysWOW64\Fegjgkla.exe
C:\Windows\system32\Fegjgkla.exe
420⤵
PID:4464

C:\Windows\SysWOW64\Fopnpaba.exe
C:\Windows\system32\Fopnpaba.exe
421⤵
PID:5028

C:\Windows\SysWOW64\Fbkjap32.exe
C:\Windows\system32\Fbkjap32.exe
422⤵
PID:4108

C:\Windows\SysWOW64\Fhhbif32.exe
C:\Windows\system32\Fhhbif32.exe
423⤵
PID:2656

C:\Windows\SysWOW64\Fbngfo32.exe
C:\Windows\system32\Fbngfo32.exe
424⤵
PID:4580

C:\Windows\SysWOW64\Fhjoof32.exe
C:\Windows\system32\Fhjoof32.exe
425⤵
PID:4208

C:\Windows\SysWOW64\Fkilka32.exe
C:\Windows\system32\Fkilka32.exe
426⤵
PID:4844

C:\Windows\SysWOW64\Fenphjei.exe
C:\Windows\system32\Fenphjei.exe
427⤵
PID:5088

C:\Windows\SysWOW64\Fhmldfdm.exe
C:\Windows\system32\Fhmldfdm.exe
428⤵
- Modifies registry class
PID:4144

C:\Windows\SysWOW64\Fogdap32.exe
C:\Windows\system32\Fogdap32.exe
429⤵
PID:5152

C:\Windows\SysWOW64\Gmidlmcd.exe
C:\Windows\system32\Gmidlmcd.exe
430⤵
PID:5192

C:\Windows\SysWOW64\Ggbieb32.exe
C:\Windows\system32\Ggbieb32.exe
431⤵
PID:5232

C:\Windows\SysWOW64\Gmlablaa.exe
C:\Windows\system32\Gmlablaa.exe
432⤵
PID:5272

C:\Windows\SysWOW64\Gpjmnh32.exe
C:\Windows\system32\Gpjmnh32.exe
433⤵
- Drops file in System32 directory
PID:5312

C:\Windows\SysWOW64\Ggdekbgb.exe
C:\Windows\system32\Ggdekbgb.exe
434⤵
PID:5352

C:\Windows\SysWOW64\Gajjhkgh.exe
C:\Windows\system32\Gajjhkgh.exe
435⤵
- Drops file in System32 directory
PID:5392

C:\Windows\SysWOW64\Gckfpc32.exe
C:\Windows\system32\Gckfpc32.exe
436⤵
PID:5432

C:\Windows\SysWOW64\Gieommdc.exe
C:\Windows\system32\Gieommdc.exe
437⤵
- Drops file in System32 directory
PID:5472

C:\Windows\SysWOW64\Gpogiglp.exe
C:\Windows\system32\Gpogiglp.exe
438⤵
PID:5512

C:\Windows\SysWOW64\Gdjcjf32.exe
C:\Windows\system32\Gdjcjf32.exe
439⤵
- Drops file in System32 directory
PID:5552

C:\Windows\SysWOW64\Geloanjg.exe
C:\Windows\system32\Geloanjg.exe
440⤵
PID:5592

C:\Windows\SysWOW64\Gpacogjm.exe
C:\Windows\system32\Gpacogjm.exe
441⤵
PID:5632

C:\Windows\SysWOW64\Gcppkbia.exe
C:\Windows\system32\Gcppkbia.exe
442⤵
- Drops file in System32 directory
PID:5672

C:\Windows\SysWOW64\Hhmhcigh.exe
C:\Windows\system32\Hhmhcigh.exe
443⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5712

C:\Windows\SysWOW64\Haemloni.exe
C:\Windows\system32\Haemloni.exe
444⤵
PID:5752

C:\Windows\SysWOW64\Hjlemlnk.exe
C:\Windows\system32\Hjlemlnk.exe
445⤵
PID:5792

C:\Windows\SysWOW64\Hhoeii32.exe
C:\Windows\system32\Hhoeii32.exe
446⤵
PID:5832

C:\Windows\SysWOW64\Hecebm32.exe
C:\Windows\system32\Hecebm32.exe
447⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5872

C:\Windows\SysWOW64\Hhaanh32.exe
C:\Windows\system32\Hhaanh32.exe
448⤵
PID:5912

C:\Windows\SysWOW64\Hokjkbkp.exe
C:\Windows\system32\Hokjkbkp.exe
449⤵
PID:5956

C:\Windows\SysWOW64\Hajfgnjc.exe
C:\Windows\system32\Hajfgnjc.exe
450⤵
- Modifies registry class
PID:5996

C:\Windows\SysWOW64\Hgfooe32.exe
C:\Windows\system32\Hgfooe32.exe
451⤵
PID:6036

C:\Windows\SysWOW64\Hkbkpcpd.exe
C:\Windows\system32\Hkbkpcpd.exe
452⤵
PID:6084

C:\Windows\SysWOW64\Halcmn32.exe
C:\Windows\system32\Halcmn32.exe
453⤵
- System Location Discovery: System Language Discovery
PID:6124

C:\Windows\SysWOW64\Hdjoii32.exe
C:\Windows\system32\Hdjoii32.exe
454⤵
PID:5132

C:\Windows\SysWOW64\Hgiked32.exe
C:\Windows\system32\Hgiked32.exe
455⤵
PID:5176

C:\Windows\SysWOW64\Hbnpbm32.exe
C:\Windows\system32\Hbnpbm32.exe
456⤵
PID:5216

C:\Windows\SysWOW64\Icplje32.exe
C:\Windows\system32\Icplje32.exe
457⤵
PID:5256

C:\Windows\SysWOW64\Ikfdkc32.exe
C:\Windows\system32\Ikfdkc32.exe
458⤵
PID:5328

C:\Windows\SysWOW64\Imhqbkbm.exe
C:\Windows\system32\Imhqbkbm.exe
459⤵
PID:5364

C:\Windows\SysWOW64\Idohdhbo.exe
C:\Windows\system32\Idohdhbo.exe
460⤵
PID:5424

C:\Windows\SysWOW64\Ijlaloaf.exe
C:\Windows\system32\Ijlaloaf.exe
461⤵
PID:5468

C:\Windows\SysWOW64\Imjmhkpj.exe
C:\Windows\system32\Imjmhkpj.exe
462⤵
PID:5532

C:\Windows\SysWOW64\Icdeee32.exe
C:\Windows\system32\Icdeee32.exe
463⤵
PID:5576

C:\Windows\SysWOW64\Ifbaapfk.exe
C:\Windows\system32\Ifbaapfk.exe
464⤵
PID:5620

C:\Windows\SysWOW64\Iqhfnifq.exe
C:\Windows\system32\Iqhfnifq.exe
465⤵
PID:5680

C:\Windows\SysWOW64\Ibibfa32.exe
C:\Windows\system32\Ibibfa32.exe
466⤵
PID:5720

C:\Windows\SysWOW64\Iickckcl.exe
C:\Windows\system32\Iickckcl.exe
467⤵
PID:5724

C:\Windows\SysWOW64\Imogcj32.exe
C:\Windows\system32\Imogcj32.exe
468⤵
- Drops file in System32 directory
PID:5820

C:\Windows\SysWOW64\Iomcpe32.exe
C:\Windows\system32\Iomcpe32.exe
469⤵
PID:5864

C:\Windows\SysWOW64\Iciopdca.exe
C:\Windows\system32\Iciopdca.exe
470⤵
PID:5928

C:\Windows\SysWOW64\Iifghk32.exe
C:\Windows\system32\Iifghk32.exe
471⤵
PID:5972

C:\Windows\SysWOW64\Jkdcdf32.exe
C:\Windows\system32\Jkdcdf32.exe
472⤵
PID:6020

C:\Windows\SysWOW64\Jnbpqb32.exe
C:\Windows\system32\Jnbpqb32.exe
473⤵
PID:6072

C:\Windows\SysWOW64\Jihdnk32.exe
C:\Windows\system32\Jihdnk32.exe
474⤵
- Modifies registry class
PID:6120

C:\Windows\SysWOW64\Jkfpjf32.exe
C:\Windows\system32\Jkfpjf32.exe
475⤵
PID:5144

C:\Windows\SysWOW64\Joblkegc.exe
C:\Windows\system32\Joblkegc.exe
476⤵
PID:5200

C:\Windows\SysWOW64\Jacibm32.exe
C:\Windows\system32\Jacibm32.exe
477⤵
PID:5268

C:\Windows\SysWOW64\Jijacjnc.exe
C:\Windows\system32\Jijacjnc.exe
478⤵
PID:5296

C:\Windows\SysWOW64\Jkimpfmg.exe
C:\Windows\system32\Jkimpfmg.exe
479⤵
PID:5384

C:\Windows\SysWOW64\Jbcelp32.exe
C:\Windows\system32\Jbcelp32.exe
480⤵
PID:5448

C:\Windows\SysWOW64\Jgpndg32.exe
C:\Windows\system32\Jgpndg32.exe
481⤵
PID:5504

C:\Windows\SysWOW64\Jjnjqb32.exe
C:\Windows\system32\Jjnjqb32.exe
482⤵
PID:5584

C:\Windows\SysWOW64\Jahbmlil.exe
C:\Windows\system32\Jahbmlil.exe
483⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5608

C:\Windows\SysWOW64\Jcfoihhp.exe
C:\Windows\system32\Jcfoihhp.exe
484⤵
- Drops file in System32 directory
PID:5704

C:\Windows\SysWOW64\Jnlbgq32.exe
C:\Windows\system32\Jnlbgq32.exe
485⤵
- System Location Discovery: System Language Discovery
PID:5772

C:\Windows\SysWOW64\Jajocl32.exe
C:\Windows\system32\Jajocl32.exe
486⤵
PID:5848

C:\Windows\SysWOW64\Kfggkc32.exe
C:\Windows\system32\Kfggkc32.exe
487⤵
PID:5896

C:\Windows\SysWOW64\Kjbclamj.exe
C:\Windows\system32\Kjbclamj.exe
488⤵
PID:5948

C:\Windows\SysWOW64\Kamlhl32.exe
C:\Windows\system32\Kamlhl32.exe
489⤵
PID:6008

C:\Windows\SysWOW64\Kckhdg32.exe
C:\Windows\system32\Kckhdg32.exe
490⤵
- Drops file in System32 directory
PID:6032

C:\Windows\SysWOW64\Kmclmm32.exe
C:\Windows\system32\Kmclmm32.exe
491⤵
PID:4180

C:\Windows\SysWOW64\Kcmdjgbh.exe
C:\Windows\system32\Kcmdjgbh.exe
492⤵
PID:5160

C:\Windows\SysWOW64\Keoabo32.exe
C:\Windows\system32\Keoabo32.exe
493⤵
- Drops file in System32 directory
PID:5188

C:\Windows\SysWOW64\Kmficl32.exe
C:\Windows\system32\Kmficl32.exe
494⤵
PID:5344

C:\Windows\SysWOW64\Kpdeoh32.exe
C:\Windows\system32\Kpdeoh32.exe
495⤵
- Drops file in System32 directory
PID:5428

C:\Windows\SysWOW64\Khojcj32.exe
C:\Windows\system32\Khojcj32.exe
496⤵
- System Location Discovery: System Language Discovery
PID:5420

C:\Windows\SysWOW64\Kbenacdm.exe
C:\Windows\system32\Kbenacdm.exe
497⤵
PID:5568

C:\Windows\SysWOW64\Kiofnm32.exe
C:\Windows\system32\Kiofnm32.exe
498⤵
PID:5612

C:\Windows\SysWOW64\Lolofd32.exe
C:\Windows\system32\Lolofd32.exe
499⤵
PID:5740

C:\Windows\SysWOW64\Lbgkfbbj.exe
C:\Windows\system32\Lbgkfbbj.exe
500⤵
PID:5788

C:\Windows\SysWOW64\Lhdcojaa.exe
C:\Windows\system32\Lhdcojaa.exe
501⤵
PID:5800

C:\Windows\SysWOW64\Lonlkcho.exe
C:\Windows\system32\Lonlkcho.exe
502⤵
- Modifies registry class
PID:5944

C:\Windows\SysWOW64\Ldkdckff.exe
C:\Windows\system32\Ldkdckff.exe
503⤵
PID:6028

C:\Windows\SysWOW64\Lhfpdi32.exe
C:\Windows\system32\Lhfpdi32.exe
504⤵
- Drops file in System32 directory
PID:6004

C:\Windows\SysWOW64\Lophacfl.exe
C:\Windows\system32\Lophacfl.exe
505⤵
PID:5140

C:\Windows\SysWOW64\Lpaehl32.exe
C:\Windows\system32\Lpaehl32.exe
506⤵
- System Location Discovery: System Language Discovery
PID:5252

C:\Windows\SysWOW64\Lijiaabk.exe
C:\Windows\system32\Lijiaabk.exe
507⤵
PID:5340

C:\Windows\SysWOW64\Lmeebpkd.exe
C:\Windows\system32\Lmeebpkd.exe
508⤵
PID:5452

C:\Windows\SysWOW64\Lbbnjgik.exe
C:\Windows\system32\Lbbnjgik.exe
509⤵
PID:5544

C:\Windows\SysWOW64\Lilfgq32.exe
C:\Windows\system32\Lilfgq32.exe
510⤵
PID:5656

C:\Windows\SysWOW64\Llkbcl32.exe
C:\Windows\system32\Llkbcl32.exe
511⤵
PID:5728

C:\Windows\SysWOW64\Lgpfpe32.exe
C:\Windows\system32\Lgpfpe32.exe
512⤵
PID:5748

C:\Windows\SysWOW64\Mmjomogn.exe
C:\Windows\system32\Mmjomogn.exe
513⤵
PID:5924

C:\Windows\SysWOW64\Mpikik32.exe
C:\Windows\system32\Mpikik32.exe
514⤵
- System Location Discovery: System Language Discovery
PID:6016

C:\Windows\SysWOW64\Meecaa32.exe
C:\Windows\system32\Meecaa32.exe
515⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6108

C:\Windows\SysWOW64\Mhdpnm32.exe
C:\Windows\system32\Mhdpnm32.exe
516⤵
PID:5164

C:\Windows\SysWOW64\Mpkhoj32.exe
C:\Windows\system32\Mpkhoj32.exe
517⤵
PID:5320

C:\Windows\SysWOW64\Mcidkf32.exe
C:\Windows\system32\Mcidkf32.exe
518⤵
PID:5412

C:\Windows\SysWOW64\Miclhpjp.exe
C:\Windows\system32\Miclhpjp.exe
519⤵
PID:5524

C:\Windows\SysWOW64\Mhflcm32.exe
C:\Windows\system32\Mhflcm32.exe
520⤵
PID:5560

C:\Windows\SysWOW64\Mopdpg32.exe
C:\Windows\system32\Mopdpg32.exe
521⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5816

C:\Windows\SysWOW64\Mejmmqpd.exe
C:\Windows\system32\Mejmmqpd.exe
522⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5892

C:\Windows\SysWOW64\Mldeik32.exe
C:\Windows\system32\Mldeik32.exe
523⤵
PID:6052

C:\Windows\SysWOW64\Mneaacno.exe
C:\Windows\system32\Mneaacno.exe
524⤵
PID:6136

C:\Windows\SysWOW64\Meljbqna.exe
C:\Windows\system32\Meljbqna.exe
525⤵
PID:5228

C:\Windows\SysWOW64\Mhkfnlme.exe
C:\Windows\system32\Mhkfnlme.exe
526⤵
PID:5400

C:\Windows\SysWOW64\Moenkf32.exe
C:\Windows\system32\Moenkf32.exe
527⤵
- System Location Discovery: System Language Discovery
PID:5540

C:\Windows\SysWOW64\Macjgadf.exe
C:\Windows\system32\Macjgadf.exe
528⤵
PID:5760

C:\Windows\SysWOW64\Ndafcmci.exe
C:\Windows\system32\Ndafcmci.exe
529⤵
PID:5880

C:\Windows\SysWOW64\Nklopg32.exe
C:\Windows\system32\Nklopg32.exe
530⤵
PID:6068

C:\Windows\SysWOW64\Nphghn32.exe
C:\Windows\system32\Nphghn32.exe
531⤵
PID:6132

C:\Windows\SysWOW64\Ncgcdi32.exe
C:\Windows\system32\Ncgcdi32.exe
532⤵
PID:5456

C:\Windows\SysWOW64\Njalacon.exe
C:\Windows\system32\Njalacon.exe
533⤵
PID:5536

C:\Windows\SysWOW64\Nlohmonb.exe
C:\Windows\system32\Nlohmonb.exe
534⤵
- System Location Discovery: System Language Discovery
PID:5668

C:\Windows\SysWOW64\Ncipjieo.exe
C:\Windows\system32\Ncipjieo.exe
535⤵
- System Location Discovery: System Language Discovery
PID:5300

C:\Windows\SysWOW64\Nfglfdeb.exe
C:\Windows\system32\Nfglfdeb.exe
536⤵
PID:5904

C:\Windows\SysWOW64\Nnodgbed.exe
C:\Windows\system32\Nnodgbed.exe
537⤵
PID:5348

C:\Windows\SysWOW64\Nqmqcmdh.exe
C:\Windows\system32\Nqmqcmdh.exe
538⤵
PID:5508

C:\Windows\SysWOW64\Nfjildbp.exe
C:\Windows\system32\Nfjildbp.exe
539⤵
PID:5768

C:\Windows\SysWOW64\Nqpmimbe.exe
C:\Windows\system32\Nqpmimbe.exe
540⤵
PID:6104

C:\Windows\SysWOW64\Nflfad32.exe
C:\Windows\system32\Nflfad32.exe
541⤵
PID:5372

C:\Windows\SysWOW64\Omfnnnhj.exe
C:\Windows\system32\Omfnnnhj.exe
542⤵
PID:5648

C:\Windows\SysWOW64\Oodjjign.exe
C:\Windows\system32\Oodjjign.exe
543⤵
- Modifies registry class
PID:5708

C:\Windows\SysWOW64\Ofobgc32.exe
C:\Windows\system32\Ofobgc32.exe
544⤵
PID:5124

C:\Windows\SysWOW64\Ooggpiek.exe
C:\Windows\system32\Ooggpiek.exe
545⤵
PID:5324

C:\Windows\SysWOW64\Obecld32.exe
C:\Windows\system32\Obecld32.exe
546⤵
PID:6048

C:\Windows\SysWOW64\Ofaolcmh.exe
C:\Windows\system32\Ofaolcmh.exe
547⤵
PID:5244

C:\Windows\SysWOW64\Ogbldk32.exe
C:\Windows\system32\Ogbldk32.exe
548⤵
PID:5488

C:\Windows\SysWOW64\Ooidei32.exe
C:\Windows\system32\Ooidei32.exe
549⤵
PID:6060

C:\Windows\SysWOW64\Onldqejb.exe
C:\Windows\system32\Onldqejb.exe
550⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5860