9b0a239a6ca75cbae690c5397b70e5a3adac5e89a518786ea8c1087eecd893c4

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea3c8a50c42e85e8fb80e41aab996880N.exe
Size

64KB
MD5

ea3c8a50c42e85e8fb80e41aab996880
SHA1

3cd27bbb7266eba5c728e70a74d6abfad8cb15ce
SHA256

9b0a239a6ca75cbae690c5397b70e5a3adac5e89a518786ea8c1087eecd893c4
SHA512

bb84c7a5c5bc1b960b189e44c1df9408e489de19d59b0c07a6dea1442b682868a0b60e7a49914b45c0fffca8f08007c10d61ec3afb6b719155df78ddc10dbcd9
SSDEEP

1536:whDsreOZo28qiLrCSM0qTtJB8ADHD/QI3qZLuZuYDPf:yUeW8qiLrYtJGADHD/QI4uZuY7f

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Ginnfgop.exeHgghjjid.exeJhlgfj32.exeLgffic32.exeLkabjbih.exeFpejlmcf.exeJklinohd.exeGeohklaa.exeLfgipd32.exeQjfmkk32.exeCogddd32.exeAkamff32.exeDjelgied.exeEjfeng32.exeHdjbiheb.exeAnobgl32.exeAdcjop32.exeGphgbafl.exeDmoohe32.exeKdpmbc32.exeLqkgbcff.exeEbdcld32.exeHhknpmma.exeQcclld32.exeDifpmfna.exeBdpaeehj.exeDkokcl32.exeBacjdbch.exeIgedlh32.exeGmiclo32.exeNlcalieg.exeDmennnni.exeJpaekqhh.exeCgifbhid.exeLpfgmnfp.exeNmfcok32.exeMaeachag.exeCcdnjp32.exeFfaong32.exeBffcpg32.exeIgfclkdj.exeJnlkedai.exeHcpojd32.exeHammhcij.exeInainbcn.exeLeenhhdn.exeCmflbf32.exeGphphj32.exeNnojho32.exeAajhndkb.exeEmbkoi32.exeKijchhbo.exeKecabifp.exeAckbmcjl.exeHpcodihc.exeLjhefhha.exeKiggbhda.exeIgbalblk.exeOhkkhhmh.exeNadleilm.exeIkcmbfcj.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ginnfgop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgghjjid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhlgfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgffic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkabjbih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpejlmcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jklinohd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Geohklaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfgipd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjfmkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cogddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akamff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djelgied.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ejfeng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdjbiheb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anobgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adcjop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gphgbafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmoohe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdpmbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqkgbcff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebdcld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhknpmma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qcclld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Difpmfna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdpaeehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkokcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bacjdbch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igedlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmiclo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlcalieg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmennnni.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpaekqhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgifbhid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpfgmnfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmfcok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maeachag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ccdnjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffaong32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bffcpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igfclkdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnlkedai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcpojd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ginnfgop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hammhcij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inainbcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Leenhhdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmflbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gphphj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnojho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aajhndkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Embkoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kijchhbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kecabifp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ackbmcjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpcodihc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljhefhha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kiggbhda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igbalblk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohkkhhmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nadleilm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgifbhid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikcmbfcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ackbmcjl.exe

Executes dropped EXE 64 IoCs

Processes:

Ehfcfb32.exeEjdocm32.exeEmbkoi32.exeEdmclccp.exeEfkphnbd.exeEiildjag.exeEmehdh32.exeEpcdqd32.exeEhjlaaig.exeFiliii32.exeFacqkg32.exeFdamgb32.exeFfpicn32.exeFkkeclfh.exeFaenpf32.exeFphnlcdo.exeFhofmq32.exeFipbdikp.exeFpjjac32.exeFhabbp32.exeFkpool32.exeFibojhim.exeFdhcgaic.exeFkbkdkpp.exeFmqgpgoc.exeFdkpma32.exeGgilil32.exeGigheh32.exeGpaqbbld.exeGgkiol32.exeGmeakf32.exeGkiaej32.exeGilapgqb.exeGacjadad.exeGdafnpqh.exeGklnjj32.exeGinnfgop.exeGphgbafl.exeGhpocngo.exeGiqkkf32.exeGahcmd32.exeGdfoio32.exeHhbkinel.exeHkpheidp.exeHnodaecc.exeHhdhon32.exeHgghjjid.exeHjedffig.exeHammhcij.exeHpomcp32.exeHgiepjga.exeHjhalefe.exeHncmmd32.exeHpbiip32.exeHhiajmod.exeHjjnae32.exeHnfjbdmk.exeHpdfnolo.exeHhknpmma.exeHkjjlhle.exeHjlkge32.exeHacbhb32.exeIdbodn32.exeIgqkqiai.exe

pid	process
3500	Ehfcfb32.exe
5108	Ejdocm32.exe
1920	Embkoi32.exe
4740	Edmclccp.exe
2668	Efkphnbd.exe
1584	Eiildjag.exe
1588	Emehdh32.exe
2328	Epcdqd32.exe
3116	Ehjlaaig.exe
3432	Filiii32.exe
1092	Facqkg32.exe
4944	Fdamgb32.exe
636	Ffpicn32.exe
960	Fkkeclfh.exe
1396	Faenpf32.exe
1060	Fphnlcdo.exe
5056	Fhofmq32.exe
3324	Fipbdikp.exe
3256	Fpjjac32.exe
4860	Fhabbp32.exe
4712	Fkpool32.exe
4064	Fibojhim.exe
4716	Fdhcgaic.exe
228	Fkbkdkpp.exe
388	Fmqgpgoc.exe
4148	Fdkpma32.exe
1860	Ggilil32.exe
2208	Gigheh32.exe
1640	Gpaqbbld.exe
2440	Ggkiol32.exe
4092	Gmeakf32.exe
2288	Gkiaej32.exe
4664	Gilapgqb.exe
2304	Gacjadad.exe
2788	Gdafnpqh.exe
1732	Gklnjj32.exe
928	Ginnfgop.exe
220	Gphgbafl.exe
4440	Ghpocngo.exe
3544	Giqkkf32.exe
3744	Gahcmd32.exe
1400	Gdfoio32.exe
1996	Hhbkinel.exe
4012	Hkpheidp.exe
3592	Hnodaecc.exe
4556	Hhdhon32.exe
3264	Hgghjjid.exe
532	Hjedffig.exe
1904	Hammhcij.exe
3144	Hpomcp32.exe
4384	Hgiepjga.exe
2844	Hjhalefe.exe
460	Hncmmd32.exe
4396	Hpbiip32.exe
4500	Hhiajmod.exe
5016	Hjjnae32.exe
2756	Hnfjbdmk.exe
4408	Hpdfnolo.exe
1232	Hhknpmma.exe
4724	Hkjjlhle.exe
3972	Hjlkge32.exe
60	Hacbhb32.exe
4940	Idbodn32.exe
2724	Igqkqiai.exe

Drops file in System32 directory 64 IoCs

Processes:

Bahkih32.exeNpiiffqe.exeKeqdmihc.exeLjilqnlm.exeBcahmb32.exeIphioh32.exeIlnbicff.exeQmeigg32.exeJkaicd32.exeMblcnj32.exeNclikl32.exePknqoc32.exeLihpif32.exeLeopnglc.exeFfobhg32.exeAggpfkjj.exeGifkpknp.exeFbhpch32.exePfiddm32.exeAaenbd32.exeNlnkmnah.exeGbchdp32.exeCglbhhga.exeLnjgfb32.exeOpqofe32.exeMonjjgkb.exeAokkahlo.exeHkjjlhle.exeLlhikacp.exeIjegcm32.exeFpkibf32.exeJlgepanl.exeLcimdh32.exeLjeafb32.exeBklomh32.exeFiliii32.exeKnkekn32.exeIdhnkf32.exeLjhefhha.exeCmflbf32.exeDdjmba32.exeJhlgfj32.exeLnbklm32.exeMhoipb32.exeBhldpj32.exeGnepna32.exeHffken32.exeNliaao32.exeDikihe32.exeAonoao32.exeEfgemb32.exeJgcamf32.exeDmfeidbe.exeOhmhmh32.exeGikdkj32.exeEiildjag.exeFfpicn32.exeIbobdqid.exeJbaojpgb.exeQmgelf32.exeAmcehdod.exeGahcmd32.exeJiiicf32.exeJohnamkm.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Bhbcfbjk.exe	Bahkih32.exe
File opened for modification	C:\Windows\SysWOW64\Nfcabp32.exe	Npiiffqe.exe
File opened for modification	C:\Windows\SysWOW64\Kilpmh32.exe	Keqdmihc.exe
File created	C:\Windows\SysWOW64\Lbpdblmo.exe	Ljilqnlm.exe
File created	C:\Windows\SysWOW64\Bljlfh32.exe	Bcahmb32.exe
File opened for modification	C:\Windows\SysWOW64\Idcepgmg.exe	Iphioh32.exe
File created	C:\Windows\SysWOW64\Ibhkfm32.exe	Ilnbicff.exe
File opened for modification	C:\Windows\SysWOW64\Qdoacabq.exe	Qmeigg32.exe
File created	C:\Windows\SysWOW64\Jnpfop32.exe	Jkaicd32.exe
File opened for modification	C:\Windows\SysWOW64\Mifljdjo.exe	Mblcnj32.exe
File created	C:\Windows\SysWOW64\Hmnajl32.dll	Nclikl32.exe
File opened for modification	C:\Windows\SysWOW64\Pmlmkn32.exe	Pknqoc32.exe
File opened for modification	C:\Windows\SysWOW64\Llflea32.exe	Lihpif32.exe
File opened for modification	C:\Windows\SysWOW64\Lhmmjbkf.exe	Leopnglc.exe
File opened for modification	C:\Windows\SysWOW64\Fimodc32.exe	Ffobhg32.exe
File created	C:\Windows\SysWOW64\Ichqihli.dll	Aggpfkjj.exe
File created	C:\Windows\SysWOW64\Gfjkjo32.exe	Gifkpknp.exe
File created	C:\Windows\SysWOW64\Fjohde32.exe	Fbhpch32.exe
File opened for modification	C:\Windows\SysWOW64\Pjdpelnc.exe	Pfiddm32.exe
File opened for modification	C:\Windows\SysWOW64\Adcjop32.exe	Aaenbd32.exe
File created	C:\Windows\SysWOW64\Fdmfqg32.dll	Nlnkmnah.exe
File created	C:\Windows\SysWOW64\Gimqajgh.exe	Gbchdp32.exe
File opened for modification	C:\Windows\SysWOW64\Cocjiehd.exe	Cglbhhga.exe
File created	C:\Windows\SysWOW64\Ipbehfom.dll	Lnjgfb32.exe
File created	C:\Windows\SysWOW64\Dgegjnih.dll	Opqofe32.exe
File created	C:\Windows\SysWOW64\Hilpobpd.dll	Monjjgkb.exe
File opened for modification	C:\Windows\SysWOW64\Aajhndkb.exe	Aokkahlo.exe
File created	C:\Windows\SysWOW64\Hjlkge32.exe	Hkjjlhle.exe
File created	C:\Windows\SysWOW64\Fgibng32.dll	Llhikacp.exe
File opened for modification	C:\Windows\SysWOW64\Inqbclob.exe	Ijegcm32.exe
File created	C:\Windows\SysWOW64\Kqqpck32.dll	Fpkibf32.exe
File created	C:\Windows\SysWOW64\Adfonlkp.dll	Jlgepanl.exe
File opened for modification	C:\Windows\SysWOW64\Lfgipd32.exe	Lcimdh32.exe
File created	C:\Windows\SysWOW64\Qmfqknfm.dll	Ljeafb32.exe
File created	C:\Windows\SysWOW64\Bkamodje.dll	Bklomh32.exe
File opened for modification	C:\Windows\SysWOW64\Facqkg32.exe	Filiii32.exe
File opened for modification	C:\Windows\SysWOW64\Lajagj32.exe	Knkekn32.exe
File created	C:\Windows\SysWOW64\Hankellh.dll	Idhnkf32.exe
File created	C:\Windows\SysWOW64\Hgfoqnae.dll	Ljhefhha.exe
File opened for modification	C:\Windows\SysWOW64\Cfnqklgh.exe	Cmflbf32.exe
File opened for modification	C:\Windows\SysWOW64\Dkceokii.exe	Ddjmba32.exe
File created	C:\Windows\SysWOW64\Ejjlbppk.dll	Jhlgfj32.exe
File opened for modification	C:\Windows\SysWOW64\Lbngllob.exe	Lnbklm32.exe
File opened for modification	C:\Windows\SysWOW64\Mbenmk32.exe	Mhoipb32.exe
File opened for modification	C:\Windows\SysWOW64\Bcahmb32.exe	Bhldpj32.exe
File created	C:\Windows\SysWOW64\Lejgpb32.dll	Gnepna32.exe
File created	C:\Windows\SysWOW64\Hlbcnd32.exe	Hffken32.exe
File created	C:\Windows\SysWOW64\Neafjdkn.exe	Nliaao32.exe
File opened for modification	C:\Windows\SysWOW64\Dmfeidbe.exe	Dikihe32.exe
File created	C:\Windows\SysWOW64\Ginacp32.dll	Aonoao32.exe
File created	C:\Windows\SysWOW64\Cqmmqg32.dll	Efgemb32.exe
File created	C:\Windows\SysWOW64\Jjamia32.exe	Jgcamf32.exe
File created	C:\Windows\SysWOW64\Dcpmen32.exe	Dmfeidbe.exe
File opened for modification	C:\Windows\SysWOW64\Oogpjbbb.exe	Ohmhmh32.exe
File created	C:\Windows\SysWOW64\Dibkjmof.dll	Gikdkj32.exe
File created	C:\Windows\SysWOW64\Emehdh32.exe	Eiildjag.exe
File created	C:\Windows\SysWOW64\Chembclp.dll	Ffpicn32.exe
File created	C:\Windows\SysWOW64\Qeidhb32.dll	Ibobdqid.exe
File created	C:\Windows\SysWOW64\Imjfmjln.dll	Jbaojpgb.exe
File created	C:\Windows\SysWOW64\Mlcdqdie.dll	Qmgelf32.exe
File opened for modification	C:\Windows\SysWOW64\Apaadpng.exe	Amcehdod.exe
File created	C:\Windows\SysWOW64\Gdfoio32.exe	Gahcmd32.exe
File created	C:\Windows\SysWOW64\Jefjbddd.dll	Jiiicf32.exe
File opened for modification	C:\Windows\SysWOW64\Jgpfbjlo.exe	Johnamkm.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

14832 14668 WerFault.exe Dkqaoe32.exe

pid	pid_target	process	target process
14832	14668	WerFault.exe	Dkqaoe32.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Jhlgfj32.exeKdinljnk.exeNhkikq32.exeFlqdlnde.exeAekddhcb.exeJqknkedi.exeOhmhmh32.exeNcnofeof.exeHjlkge32.exeIkcmbfcj.exePefabkej.exeAonoao32.exeJepjhg32.exeMgnlkfal.exeFkkeclfh.exeFphnlcdo.exeJqglkmlj.exeCmmbbejp.exeGpcfmkff.exeInnfnl32.exeJpdhkf32.exeNadleilm.exeOpnbae32.exeGmdcfidg.exeLghcocol.exeAkhcfe32.exeDpphjp32.exeGjfnedho.exeBhpfqcln.exeEkmhejao.exeGfeaopqo.exeHffken32.exeBklomh32.exeAhmjjoig.exeKqpoakco.exeNeccpd32.exeMcjmel32.exeImiehfao.exeLfgipd32.exeNpiiffqe.exeOcaebc32.exeIafonaao.exeKbbhqn32.exeEnkdaepb.exeHipmfjee.exeNclbpf32.exeEbdcld32.exeFdkpma32.exeHpbiip32.exeLbngllob.exePkadoiip.exeIdahjg32.exeMgobel32.exeDmennnni.exeMonjjgkb.exeIgqkqiai.exeBkmmaeap.exeHpcodihc.exeAahbbkaq.exeBafndi32.exeDndnpf32.exePmpolgoi.exeHbohpn32.exeIhphkl32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhlgfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdinljnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhkikq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flqdlnde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aekddhcb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jqknkedi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohmhmh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncnofeof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjlkge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikcmbfcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pefabkej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aonoao32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jepjhg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgnlkfal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkkeclfh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fphnlcdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jqglkmlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmmbbejp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpcfmkff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Innfnl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpdhkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nadleilm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opnbae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmdcfidg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lghcocol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akhcfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpphjp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjfnedho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhpfqcln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekmhejao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfeaopqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hffken32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bklomh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahmjjoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kqpoakco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Neccpd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcjmel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imiehfao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfgipd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npiiffqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocaebc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iafonaao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbbhqn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enkdaepb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hipmfjee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nclbpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebdcld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdkpma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpbiip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbngllob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkadoiip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idahjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgobel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmennnni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Monjjgkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igqkqiai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkmmaeap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpcodihc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aahbbkaq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bafndi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dndnpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmpolgoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbohpn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihphkl32.exe

Modifies registry class 64 IoCs

Processes:

Oblmdhdo.exeDjqblj32.exeEciplm32.exeGbchdp32.exeIgajal32.exeIefgbh32.exeFfpicn32.exeGkiaej32.exeLqhdbm32.exeCcmgiaig.exeLhmmjbkf.exeOklkdi32.exePjbcplpe.exePoliea32.exeHginecde.exeLnjnqh32.exeGpelhd32.exeCogddd32.exeHhbkinel.exeCohkokgj.exeCcgjopal.exeEjfeng32.exeDbkqfe32.exeFfqhcq32.exeBpdnjple.exeCpfcfmlp.exeea3c8a50c42e85e8fb80e41aab996880N.exeHjlkge32.exeHmbfbn32.exeLgccinoe.exeMkmkkjko.exeBochmn32.exeGfeaopqo.exeIoolkncg.exeHgghjjid.exePlejdkmm.exePmpolgoi.exeLjhefhha.exeAhaceo32.exeHlbcnd32.exeMgphpe32.exeIdkbkl32.exeHpcodihc.exeGilapgqb.exeOcgbld32.exeBahkih32.exeBmlilh32.exeKckqbj32.exeLnjgfb32.exeLegjmh32.exeOhkbbn32.exeGmiclo32.exeCdlqqcnl.exeFpbflg32.exeMiofjepg.exeNknobkje.exeImiehfao.exeLfgipd32.exeKgjgne32.exeIcknfcol.exeEfeihb32.exeLcnfohmi.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oblmdhdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djqblj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eciplm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbchdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igajal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chflphjh.dll"	Iefgbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffpicn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laahglpp.dll"	Gkiaej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqhdbm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ccmgiaig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lhmmjbkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oklkdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjbcplpe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Poliea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hginecde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdnjmc32.dll"	Lnjnqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gpelhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bghgmioe.dll"	Cogddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bqjdgbbi.dll"	Hhbkinel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nchcpi32.dll"	Cohkokgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibodeh32.dll"	Ccgjopal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohlljcfl.dll"	Ejfeng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbkqfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffqhcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bpdnjple.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpfcfmlp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	ea3c8a50c42e85e8fb80e41aab996880N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjlkge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mknjbg32.dll"	Hmbfbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahiiai32.dll"	Lgccinoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlihmi32.dll"	Mkmkkjko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bochmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdbplg32.dll"	Gfeaopqo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ioolkncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnoeha32.dll"	Hgghjjid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Plejdkmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmpolgoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljhefhha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahaceo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hlbcnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgphpe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Idkbkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpcodihc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gilapgqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocgbld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Micoommd.dll"	Ccmgiaig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obgbikfp.dll"	Bahkih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgfcle32.dll"	Bmlilh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kckqbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnjgfb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Legjmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjecoi32.dll"	Ohkbbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmiclo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pghaae32.dll"	Cdlqqcnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqopkcbn.dll"	Fpbflg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cogddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enkjji32.dll"	Miofjepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nknobkje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imiehfao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfgipd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgjgne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icknfcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjpbba32.dll"	Efeihb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcnfohmi.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ea3c8a50c42e85e8fb80e41aab996880N.exeEhfcfb32.exeEjdocm32.exeEmbkoi32.exeEdmclccp.exeEfkphnbd.exeEiildjag.exeEmehdh32.exeEpcdqd32.exeEhjlaaig.exeFiliii32.exeFacqkg32.exeFdamgb32.exeFfpicn32.exeFkkeclfh.exeFaenpf32.exeFphnlcdo.exeFhofmq32.exeFipbdikp.exeFpjjac32.exeFhabbp32.exeFkpool32.exe

description	pid	process	target process
PID 1176 wrote to memory of 3500	1176	ea3c8a50c42e85e8fb80e41aab996880N.exe	Ehfcfb32.exe
PID 1176 wrote to memory of 3500	1176	ea3c8a50c42e85e8fb80e41aab996880N.exe	Ehfcfb32.exe
PID 1176 wrote to memory of 3500	1176	ea3c8a50c42e85e8fb80e41aab996880N.exe	Ehfcfb32.exe
PID 3500 wrote to memory of 5108	3500	Ehfcfb32.exe	Ejdocm32.exe
PID 3500 wrote to memory of 5108	3500	Ehfcfb32.exe	Ejdocm32.exe
PID 3500 wrote to memory of 5108	3500	Ehfcfb32.exe	Ejdocm32.exe
PID 5108 wrote to memory of 1920	5108	Ejdocm32.exe	Embkoi32.exe
PID 5108 wrote to memory of 1920	5108	Ejdocm32.exe	Embkoi32.exe
PID 5108 wrote to memory of 1920	5108	Ejdocm32.exe	Embkoi32.exe
PID 1920 wrote to memory of 4740	1920	Embkoi32.exe	Edmclccp.exe
PID 1920 wrote to memory of 4740	1920	Embkoi32.exe	Edmclccp.exe
PID 1920 wrote to memory of 4740	1920	Embkoi32.exe	Edmclccp.exe
PID 4740 wrote to memory of 2668	4740	Edmclccp.exe	Efkphnbd.exe
PID 4740 wrote to memory of 2668	4740	Edmclccp.exe	Efkphnbd.exe
PID 4740 wrote to memory of 2668	4740	Edmclccp.exe	Efkphnbd.exe
PID 2668 wrote to memory of 1584	2668	Efkphnbd.exe	Eiildjag.exe
PID 2668 wrote to memory of 1584	2668	Efkphnbd.exe	Eiildjag.exe
PID 2668 wrote to memory of 1584	2668	Efkphnbd.exe	Eiildjag.exe
PID 1584 wrote to memory of 1588	1584	Eiildjag.exe	Emehdh32.exe
PID 1584 wrote to memory of 1588	1584	Eiildjag.exe	Emehdh32.exe
PID 1584 wrote to memory of 1588	1584	Eiildjag.exe	Emehdh32.exe
PID 1588 wrote to memory of 2328	1588	Emehdh32.exe	Epcdqd32.exe
PID 1588 wrote to memory of 2328	1588	Emehdh32.exe	Epcdqd32.exe
PID 1588 wrote to memory of 2328	1588	Emehdh32.exe	Epcdqd32.exe
PID 2328 wrote to memory of 3116	2328	Epcdqd32.exe	Ehjlaaig.exe
PID 2328 wrote to memory of 3116	2328	Epcdqd32.exe	Ehjlaaig.exe
PID 2328 wrote to memory of 3116	2328	Epcdqd32.exe	Ehjlaaig.exe
PID 3116 wrote to memory of 3432	3116	Ehjlaaig.exe	Filiii32.exe
PID 3116 wrote to memory of 3432	3116	Ehjlaaig.exe	Filiii32.exe
PID 3116 wrote to memory of 3432	3116	Ehjlaaig.exe	Filiii32.exe
PID 3432 wrote to memory of 1092	3432	Filiii32.exe	Facqkg32.exe
PID 3432 wrote to memory of 1092	3432	Filiii32.exe	Facqkg32.exe
PID 3432 wrote to memory of 1092	3432	Filiii32.exe	Facqkg32.exe
PID 1092 wrote to memory of 4944	1092	Facqkg32.exe	Fdamgb32.exe
PID 1092 wrote to memory of 4944	1092	Facqkg32.exe	Fdamgb32.exe
PID 1092 wrote to memory of 4944	1092	Facqkg32.exe	Fdamgb32.exe
PID 4944 wrote to memory of 636	4944	Fdamgb32.exe	Ffpicn32.exe
PID 4944 wrote to memory of 636	4944	Fdamgb32.exe	Ffpicn32.exe
PID 4944 wrote to memory of 636	4944	Fdamgb32.exe	Ffpicn32.exe
PID 636 wrote to memory of 960	636	Ffpicn32.exe	Fkkeclfh.exe
PID 636 wrote to memory of 960	636	Ffpicn32.exe	Fkkeclfh.exe
PID 636 wrote to memory of 960	636	Ffpicn32.exe	Fkkeclfh.exe
PID 960 wrote to memory of 1396	960	Fkkeclfh.exe	Faenpf32.exe
PID 960 wrote to memory of 1396	960	Fkkeclfh.exe	Faenpf32.exe
PID 960 wrote to memory of 1396	960	Fkkeclfh.exe	Faenpf32.exe
PID 1396 wrote to memory of 1060	1396	Faenpf32.exe	Fphnlcdo.exe
PID 1396 wrote to memory of 1060	1396	Faenpf32.exe	Fphnlcdo.exe
PID 1396 wrote to memory of 1060	1396	Faenpf32.exe	Fphnlcdo.exe
PID 1060 wrote to memory of 5056	1060	Fphnlcdo.exe	Fhofmq32.exe
PID 1060 wrote to memory of 5056	1060	Fphnlcdo.exe	Fhofmq32.exe
PID 1060 wrote to memory of 5056	1060	Fphnlcdo.exe	Fhofmq32.exe
PID 5056 wrote to memory of 3324	5056	Fhofmq32.exe	Fipbdikp.exe
PID 5056 wrote to memory of 3324	5056	Fhofmq32.exe	Fipbdikp.exe
PID 5056 wrote to memory of 3324	5056	Fhofmq32.exe	Fipbdikp.exe
PID 3324 wrote to memory of 3256	3324	Fipbdikp.exe	Fpjjac32.exe
PID 3324 wrote to memory of 3256	3324	Fipbdikp.exe	Fpjjac32.exe
PID 3324 wrote to memory of 3256	3324	Fipbdikp.exe	Fpjjac32.exe
PID 3256 wrote to memory of 4860	3256	Fpjjac32.exe	Fhabbp32.exe
PID 3256 wrote to memory of 4860	3256	Fpjjac32.exe	Fhabbp32.exe
PID 3256 wrote to memory of 4860	3256	Fpjjac32.exe	Fhabbp32.exe
PID 4860 wrote to memory of 4712	4860	Fhabbp32.exe	Fkpool32.exe
PID 4860 wrote to memory of 4712	4860	Fhabbp32.exe	Fkpool32.exe
PID 4860 wrote to memory of 4712	4860	Fhabbp32.exe	Fkpool32.exe
PID 4712 wrote to memory of 4064	4712	Fkpool32.exe	Fibojhim.exe

C:\Users\Admin\AppData\Local\Temp\ea3c8a50c42e85e8fb80e41aab996880N.exe
"C:\Users\Admin\AppData\Local\Temp\ea3c8a50c42e85e8fb80e41aab996880N.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\SysWOW64\Ehfcfb32.exe
C:\Windows\system32\Ehfcfb32.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500

C:\Windows\SysWOW64\Ejdocm32.exe
C:\Windows\system32\Ejdocm32.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108

C:\Windows\SysWOW64\Embkoi32.exe
C:\Windows\system32\Embkoi32.exe
4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\Edmclccp.exe
C:\Windows\system32\Edmclccp.exe
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740

C:\Windows\SysWOW64\Efkphnbd.exe
C:\Windows\system32\Efkphnbd.exe
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\SysWOW64\Eiildjag.exe
C:\Windows\system32\Eiildjag.exe
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\Emehdh32.exe
C:\Windows\system32\Emehdh32.exe
8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\SysWOW64\Epcdqd32.exe
C:\Windows\system32\Epcdqd32.exe
9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328

C:\Windows\SysWOW64\Ehjlaaig.exe
C:\Windows\system32\Ehjlaaig.exe
10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116

C:\Windows\SysWOW64\Filiii32.exe
C:\Windows\system32\Filiii32.exe
11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3432

C:\Windows\SysWOW64\Facqkg32.exe
C:\Windows\system32\Facqkg32.exe
12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\Fdamgb32.exe
C:\Windows\system32\Fdamgb32.exe
13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944

C:\Windows\SysWOW64\Ffpicn32.exe
C:\Windows\system32\Ffpicn32.exe
14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:636

C:\Windows\SysWOW64\Fkkeclfh.exe
C:\Windows\system32\Fkkeclfh.exe
15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\Faenpf32.exe
C:\Windows\system32\Faenpf32.exe
16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\SysWOW64\Fphnlcdo.exe
C:\Windows\system32\Fphnlcdo.exe
17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\SysWOW64\Fhofmq32.exe
C:\Windows\system32\Fhofmq32.exe
18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056

C:\Windows\SysWOW64\Fipbdikp.exe
C:\Windows\system32\Fipbdikp.exe
19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324

C:\Windows\SysWOW64\Fpjjac32.exe
C:\Windows\system32\Fpjjac32.exe
20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256

C:\Windows\SysWOW64\Fhabbp32.exe
C:\Windows\system32\Fhabbp32.exe
21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860

C:\Windows\SysWOW64\Fkpool32.exe
C:\Windows\system32\Fkpool32.exe
22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712

C:\Windows\SysWOW64\Fibojhim.exe
C:\Windows\system32\Fibojhim.exe
23⤵
- Executes dropped EXE
PID:4064

C:\Windows\SysWOW64\Fdhcgaic.exe
C:\Windows\system32\Fdhcgaic.exe
24⤵
- Executes dropped EXE
PID:4716

C:\Windows\SysWOW64\Fkbkdkpp.exe
C:\Windows\system32\Fkbkdkpp.exe
25⤵
- Executes dropped EXE
PID:228

C:\Windows\SysWOW64\Fmqgpgoc.exe
C:\Windows\system32\Fmqgpgoc.exe
26⤵
- Executes dropped EXE
PID:388

C:\Windows\SysWOW64\Fdkpma32.exe
C:\Windows\system32\Fdkpma32.exe
27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4148

C:\Windows\SysWOW64\Ggilil32.exe
C:\Windows\system32\Ggilil32.exe
28⤵
- Executes dropped EXE
PID:1860

C:\Windows\SysWOW64\Gigheh32.exe
C:\Windows\system32\Gigheh32.exe
29⤵
- Executes dropped EXE
PID:2208

C:\Windows\SysWOW64\Gpaqbbld.exe
C:\Windows\system32\Gpaqbbld.exe
30⤵
- Executes dropped EXE
PID:1640

C:\Windows\SysWOW64\Ggkiol32.exe
C:\Windows\system32\Ggkiol32.exe
31⤵
- Executes dropped EXE
PID:2440

C:\Windows\SysWOW64\Gmeakf32.exe
C:\Windows\system32\Gmeakf32.exe
32⤵
- Executes dropped EXE
PID:4092

C:\Windows\SysWOW64\Ghkeio32.exe
C:\Windows\system32\Ghkeio32.exe
33⤵
PID:4424

C:\Windows\SysWOW64\Gkiaej32.exe
C:\Windows\system32\Gkiaej32.exe
34⤵
- Executes dropped EXE
- Modifies registry class
PID:2288

C:\Windows\SysWOW64\Gilapgqb.exe
C:\Windows\system32\Gilapgqb.exe
35⤵
- Executes dropped EXE
- Modifies registry class
PID:4664

C:\Windows\SysWOW64\Gacjadad.exe
C:\Windows\system32\Gacjadad.exe
36⤵
- Executes dropped EXE
PID:2304

C:\Windows\SysWOW64\Gdafnpqh.exe
C:\Windows\system32\Gdafnpqh.exe
37⤵
- Executes dropped EXE
PID:2788

C:\Windows\SysWOW64\Gklnjj32.exe
C:\Windows\system32\Gklnjj32.exe
38⤵
- Executes dropped EXE
PID:1732

C:\Windows\SysWOW64\Ginnfgop.exe
C:\Windows\system32\Ginnfgop.exe
39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:928

C:\Windows\SysWOW64\Gphgbafl.exe
C:\Windows\system32\Gphgbafl.exe
40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:220

C:\Windows\SysWOW64\Ghpocngo.exe
C:\Windows\system32\Ghpocngo.exe
41⤵
- Executes dropped EXE
PID:4440

C:\Windows\SysWOW64\Giqkkf32.exe
C:\Windows\system32\Giqkkf32.exe
42⤵
- Executes dropped EXE
PID:3544

C:\Windows\SysWOW64\Gahcmd32.exe
C:\Windows\system32\Gahcmd32.exe
43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3744

C:\Windows\SysWOW64\Gdfoio32.exe
C:\Windows\system32\Gdfoio32.exe
44⤵
- Executes dropped EXE
PID:1400

C:\Windows\SysWOW64\Hhbkinel.exe
C:\Windows\system32\Hhbkinel.exe
45⤵
- Executes dropped EXE
- Modifies registry class
PID:1996

C:\Windows\SysWOW64\Hkpheidp.exe
C:\Windows\system32\Hkpheidp.exe
46⤵
- Executes dropped EXE
PID:4012

C:\Windows\SysWOW64\Hnodaecc.exe
C:\Windows\system32\Hnodaecc.exe
47⤵
- Executes dropped EXE
PID:3592

C:\Windows\SysWOW64\Hhdhon32.exe
C:\Windows\system32\Hhdhon32.exe
48⤵
- Executes dropped EXE
PID:4556

C:\Windows\SysWOW64\Hgghjjid.exe
C:\Windows\system32\Hgghjjid.exe
49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:3264

C:\Windows\SysWOW64\Hjedffig.exe
C:\Windows\system32\Hjedffig.exe
50⤵
- Executes dropped EXE
PID:532

C:\Windows\SysWOW64\Hammhcij.exe
C:\Windows\system32\Hammhcij.exe
51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1904

C:\Windows\SysWOW64\Hpomcp32.exe
C:\Windows\system32\Hpomcp32.exe
52⤵
- Executes dropped EXE
PID:3144

C:\Windows\SysWOW64\Hgiepjga.exe
C:\Windows\system32\Hgiepjga.exe
53⤵
- Executes dropped EXE
PID:4384

C:\Windows\SysWOW64\Hjhalefe.exe
C:\Windows\system32\Hjhalefe.exe
54⤵
- Executes dropped EXE
PID:2844

C:\Windows\SysWOW64\Hncmmd32.exe
C:\Windows\system32\Hncmmd32.exe
55⤵
- Executes dropped EXE
PID:460

C:\Windows\SysWOW64\Hpbiip32.exe
C:\Windows\system32\Hpbiip32.exe
56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4396

C:\Windows\SysWOW64\Hhiajmod.exe
C:\Windows\system32\Hhiajmod.exe
57⤵
- Executes dropped EXE
PID:4500

C:\Windows\SysWOW64\Hjjnae32.exe
C:\Windows\system32\Hjjnae32.exe
58⤵
- Executes dropped EXE
PID:5016

C:\Windows\SysWOW64\Hnfjbdmk.exe
C:\Windows\system32\Hnfjbdmk.exe
59⤵
- Executes dropped EXE
PID:2756

C:\Windows\SysWOW64\Hpdfnolo.exe
C:\Windows\system32\Hpdfnolo.exe
60⤵
- Executes dropped EXE
PID:4408

C:\Windows\SysWOW64\Hhknpmma.exe
C:\Windows\system32\Hhknpmma.exe
61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1232

C:\Windows\SysWOW64\Hkjjlhle.exe
C:\Windows\system32\Hkjjlhle.exe
62⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4724

C:\Windows\SysWOW64\Hjlkge32.exe
C:\Windows\system32\Hjlkge32.exe
63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3972

C:\Windows\SysWOW64\Hacbhb32.exe
C:\Windows\system32\Hacbhb32.exe
64⤵
- Executes dropped EXE
PID:60

C:\Windows\SysWOW64\Idbodn32.exe
C:\Windows\system32\Idbodn32.exe
65⤵
- Executes dropped EXE
PID:4940

C:\Windows\SysWOW64\Igqkqiai.exe
C:\Windows\system32\Igqkqiai.exe
66⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2724

C:\Windows\SysWOW64\Ijogmdqm.exe
C:\Windows\system32\Ijogmdqm.exe
67⤵
PID:1064

C:\Windows\SysWOW64\Iafonaao.exe
C:\Windows\system32\Iafonaao.exe
68⤵
- System Location Discovery: System Language Discovery
PID:232

C:\Windows\SysWOW64\Ihphkl32.exe
C:\Windows\system32\Ihphkl32.exe
69⤵
- System Location Discovery: System Language Discovery
PID:1168

C:\Windows\SysWOW64\Ikndgg32.exe
C:\Windows\system32\Ikndgg32.exe
70⤵
PID:1224

C:\Windows\SysWOW64\Ijadbdoj.exe
C:\Windows\system32\Ijadbdoj.exe
71⤵
PID:3520

C:\Windows\SysWOW64\Iqklon32.exe
C:\Windows\system32\Iqklon32.exe
72⤵
PID:2384

C:\Windows\SysWOW64\Igedlh32.exe
C:\Windows\system32\Igedlh32.exe
73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3096

C:\Windows\SysWOW64\Ijcahd32.exe
C:\Windows\system32\Ijcahd32.exe
74⤵
PID:1468

C:\Windows\SysWOW64\Iakiia32.exe
C:\Windows\system32\Iakiia32.exe
75⤵
PID:400

C:\Windows\SysWOW64\Idieem32.exe
C:\Windows\system32\Idieem32.exe
76⤵
PID:1140

C:\Windows\SysWOW64\Ikcmbfcj.exe
C:\Windows\system32\Ikcmbfcj.exe
77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:4992

C:\Windows\SysWOW64\Inainbcn.exe
C:\Windows\system32\Inainbcn.exe
78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4976

C:\Windows\SysWOW64\Ibmeoq32.exe
C:\Windows\system32\Ibmeoq32.exe
79⤵
PID:3348

C:\Windows\SysWOW64\Idkbkl32.exe
C:\Windows\system32\Idkbkl32.exe
80⤵
- Modifies registry class
PID:2736

C:\Windows\SysWOW64\Igjngh32.exe
C:\Windows\system32\Igjngh32.exe
81⤵
PID:4004

C:\Windows\SysWOW64\Ijhjcchb.exe
C:\Windows\system32\Ijhjcchb.exe
82⤵
PID:1876

C:\Windows\SysWOW64\Ibobdqid.exe
C:\Windows\system32\Ibobdqid.exe
83⤵
- Drops file in System32 directory
PID:3064

C:\Windows\SysWOW64\Jdnoplhh.exe
C:\Windows\system32\Jdnoplhh.exe
84⤵
PID:3032

C:\Windows\SysWOW64\Jkhgmf32.exe
C:\Windows\system32\Jkhgmf32.exe
85⤵
PID:2964

C:\Windows\SysWOW64\Jbaojpgb.exe
C:\Windows\system32\Jbaojpgb.exe
86⤵
- Drops file in System32 directory
PID:1832

C:\Windows\SysWOW64\Jqdoem32.exe
C:\Windows\system32\Jqdoem32.exe
87⤵
PID:4728

C:\Windows\SysWOW64\Jhlgfj32.exe
C:\Windows\system32\Jhlgfj32.exe
88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1772

C:\Windows\SysWOW64\Jnhpoamf.exe
C:\Windows\system32\Jnhpoamf.exe
89⤵
PID:4924

C:\Windows\SysWOW64\Jqglkmlj.exe
C:\Windows\system32\Jqglkmlj.exe
90⤵
- System Location Discovery: System Language Discovery
PID:972

C:\Windows\SysWOW64\Jhndljll.exe
C:\Windows\system32\Jhndljll.exe
91⤵
PID:2620

C:\Windows\SysWOW64\Jbfheo32.exe
C:\Windows\system32\Jbfheo32.exe
92⤵
PID:4736

C:\Windows\SysWOW64\Jdedak32.exe
C:\Windows\system32\Jdedak32.exe
93⤵
PID:5156

C:\Windows\SysWOW64\Jgcamf32.exe
C:\Windows\system32\Jgcamf32.exe
94⤵
- Drops file in System32 directory
PID:5212

C:\Windows\SysWOW64\Jjamia32.exe
C:\Windows\system32\Jjamia32.exe
95⤵
PID:5264

C:\Windows\SysWOW64\Jqlefl32.exe
C:\Windows\system32\Jqlefl32.exe
96⤵
PID:5312

C:\Windows\SysWOW64\Jibmgi32.exe
C:\Windows\system32\Jibmgi32.exe
97⤵
PID:5380

C:\Windows\SysWOW64\Jkaicd32.exe
C:\Windows\system32\Jkaicd32.exe
98⤵
- Drops file in System32 directory
PID:5456

C:\Windows\SysWOW64\Jnpfop32.exe
C:\Windows\system32\Jnpfop32.exe
99⤵
PID:5516

C:\Windows\SysWOW64\Kqnbkl32.exe
C:\Windows\system32\Kqnbkl32.exe
100⤵
PID:5564

C:\Windows\SysWOW64\Kdinljnk.exe
C:\Windows\system32\Kdinljnk.exe
101⤵
- System Location Discovery: System Language Discovery
PID:5608

C:\Windows\SysWOW64\Kghjhemo.exe
C:\Windows\system32\Kghjhemo.exe
102⤵
PID:5652

C:\Windows\SysWOW64\Kjffdalb.exe
C:\Windows\system32\Kjffdalb.exe
103⤵
PID:5696

C:\Windows\SysWOW64\Kbmoen32.exe
C:\Windows\system32\Kbmoen32.exe
104⤵
PID:5744

C:\Windows\SysWOW64\Kqpoakco.exe
C:\Windows\system32\Kqpoakco.exe
105⤵
- System Location Discovery: System Language Discovery
PID:5800

C:\Windows\SysWOW64\Kiggbhda.exe
C:\Windows\system32\Kiggbhda.exe
106⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5844

C:\Windows\SysWOW64\Kgjgne32.exe
C:\Windows\system32\Kgjgne32.exe
107⤵
- Modifies registry class
PID:5888

C:\Windows\SysWOW64\Kjhcjq32.exe
C:\Windows\system32\Kjhcjq32.exe
108⤵
PID:5932

C:\Windows\SysWOW64\Kndojobi.exe
C:\Windows\system32\Kndojobi.exe
109⤵
PID:5972

C:\Windows\SysWOW64\Kbpkkn32.exe
C:\Windows\system32\Kbpkkn32.exe
110⤵
PID:6016

C:\Windows\SysWOW64\Kenggi32.exe
C:\Windows\system32\Kenggi32.exe
111⤵
PID:6060

C:\Windows\SysWOW64\Kijchhbo.exe
C:\Windows\system32\Kijchhbo.exe
112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6104

C:\Windows\SysWOW64\Kkhpdcab.exe
C:\Windows\system32\Kkhpdcab.exe
113⤵
PID:5136

C:\Windows\SysWOW64\Kjkpoq32.exe
C:\Windows\system32\Kjkpoq32.exe
114⤵
PID:5200

C:\Windows\SysWOW64\Kbbhqn32.exe
C:\Windows\system32\Kbbhqn32.exe
115⤵
- System Location Discovery: System Language Discovery
PID:5300

C:\Windows\SysWOW64\Keqdmihc.exe
C:\Windows\system32\Keqdmihc.exe
116⤵
- Drops file in System32 directory
PID:5372

C:\Windows\SysWOW64\Kilpmh32.exe
C:\Windows\system32\Kilpmh32.exe
117⤵
PID:5504

C:\Windows\SysWOW64\Kkjlic32.exe
C:\Windows\system32\Kkjlic32.exe
118⤵
PID:5572

C:\Windows\SysWOW64\Kniieo32.exe
C:\Windows\system32\Kniieo32.exe
119⤵
PID:5648

C:\Windows\SysWOW64\Kbddfmgl.exe
C:\Windows\system32\Kbddfmgl.exe
120⤵
PID:5636

C:\Windows\SysWOW64\Kecabifp.exe
C:\Windows\system32\Kecabifp.exe
121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5808

C:\Windows\SysWOW64\Kinmcg32.exe
C:\Windows\system32\Kinmcg32.exe
122⤵
PID:5876

C:\Windows\SysWOW64\Kgamnded.exe
C:\Windows\system32\Kgamnded.exe
123⤵
PID:5940

C:\Windows\SysWOW64\Kjpijpdg.exe
C:\Windows\system32\Kjpijpdg.exe
124⤵
PID:6008

C:\Windows\SysWOW64\Knkekn32.exe
C:\Windows\system32\Knkekn32.exe
125⤵
- Drops file in System32 directory
PID:6092

C:\Windows\SysWOW64\Lajagj32.exe
C:\Windows\system32\Lajagj32.exe
126⤵
PID:5164

C:\Windows\SysWOW64\Leenhhdn.exe
C:\Windows\system32\Leenhhdn.exe
127⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5276

C:\Windows\SysWOW64\Lgcjdd32.exe
C:\Windows\system32\Lgcjdd32.exe
128⤵
PID:5420

C:\Windows\SysWOW64\Lkofdbkj.exe
C:\Windows\system32\Lkofdbkj.exe
129⤵
PID:5556

C:\Windows\SysWOW64\Lnnbqnjn.exe
C:\Windows\system32\Lnnbqnjn.exe
130⤵
PID:5688

C:\Windows\SysWOW64\Lalnmiia.exe
C:\Windows\system32\Lalnmiia.exe
131⤵
PID:5820

C:\Windows\SysWOW64\Legjmh32.exe
C:\Windows\system32\Legjmh32.exe
132⤵
- Modifies registry class
PID:5916

C:\Windows\SysWOW64\Lgffic32.exe
C:\Windows\system32\Lgffic32.exe
133⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6024

C:\Windows\SysWOW64\Lkabjbih.exe
C:\Windows\system32\Lkabjbih.exe
134⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6140

C:\Windows\SysWOW64\Lnpofnhk.exe
C:\Windows\system32\Lnpofnhk.exe
135⤵
PID:6132

C:\Windows\SysWOW64\Lankbigo.exe
C:\Windows\system32\Lankbigo.exe
136⤵
PID:5560

C:\Windows\SysWOW64\Lejgch32.exe
C:\Windows\system32\Lejgch32.exe
137⤵
PID:5772

C:\Windows\SysWOW64\Lghcocol.exe
C:\Windows\system32\Lghcocol.exe
138⤵
- System Location Discovery: System Language Discovery
PID:5924

C:\Windows\SysWOW64\Lnbklm32.exe
C:\Windows\system32\Lnbklm32.exe
139⤵
- Drops file in System32 directory
PID:6100

C:\Windows\SysWOW64\Lbngllob.exe
C:\Windows\system32\Lbngllob.exe
140⤵
- System Location Discovery: System Language Discovery
PID:5476

C:\Windows\SysWOW64\Laqhhi32.exe
C:\Windows\system32\Laqhhi32.exe
141⤵
PID:5796

C:\Windows\SysWOW64\Lihpif32.exe
C:\Windows\system32\Lihpif32.exe
142⤵
- Drops file in System32 directory
PID:6096

C:\Windows\SysWOW64\Llflea32.exe
C:\Windows\system32\Llflea32.exe
143⤵
PID:5616

C:\Windows\SysWOW64\Ljilqnlm.exe
C:\Windows\system32\Ljilqnlm.exe
144⤵
- Drops file in System32 directory
PID:6004

C:\Windows\SysWOW64\Lbpdblmo.exe
C:\Windows\system32\Lbpdblmo.exe
145⤵
PID:5884

C:\Windows\SysWOW64\Leopnglc.exe
C:\Windows\system32\Leopnglc.exe
146⤵
- Drops file in System32 directory
PID:6072

C:\Windows\SysWOW64\Lhmmjbkf.exe
C:\Windows\system32\Lhmmjbkf.exe
147⤵
- Modifies registry class
PID:5468

C:\Windows\SysWOW64\Llhikacp.exe
C:\Windows\system32\Llhikacp.exe
148⤵
- Drops file in System32 directory
PID:6172

C:\Windows\SysWOW64\Ljkifn32.exe
C:\Windows\system32\Ljkifn32.exe
149⤵
PID:6216

C:\Windows\SysWOW64\Mngegmbc.exe
C:\Windows\system32\Mngegmbc.exe
150⤵
PID:6260

C:\Windows\SysWOW64\Maeachag.exe
C:\Windows\system32\Maeachag.exe
151⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6304

C:\Windows\SysWOW64\Meamcg32.exe
C:\Windows\system32\Meamcg32.exe
152⤵
PID:6348

C:\Windows\SysWOW64\Mhoipb32.exe
C:\Windows\system32\Mhoipb32.exe
153⤵
- Drops file in System32 directory
PID:6392

C:\Windows\SysWOW64\Mbenmk32.exe
C:\Windows\system32\Mbenmk32.exe
154⤵
PID:6436

C:\Windows\SysWOW64\Miofjepg.exe
C:\Windows\system32\Miofjepg.exe
155⤵
- Modifies registry class
PID:6480

C:\Windows\SysWOW64\Mlmbfqoj.exe
C:\Windows\system32\Mlmbfqoj.exe
156⤵
PID:6524

C:\Windows\SysWOW64\Mbgjbkfg.exe
C:\Windows\system32\Mbgjbkfg.exe
157⤵
PID:6568

C:\Windows\SysWOW64\Meefofek.exe
C:\Windows\system32\Meefofek.exe
158⤵
PID:6612

C:\Windows\SysWOW64\Mjbogmdb.exe
C:\Windows\system32\Mjbogmdb.exe
159⤵
PID:6656

C:\Windows\SysWOW64\Mbighjdd.exe
C:\Windows\system32\Mbighjdd.exe
160⤵
PID:6700

C:\Windows\SysWOW64\Mehcdfch.exe
C:\Windows\system32\Mehcdfch.exe
161⤵
PID:6744

C:\Windows\SysWOW64\Mhfppabl.exe
C:\Windows\system32\Mhfppabl.exe
162⤵
PID:6788

C:\Windows\SysWOW64\Mblcnj32.exe
C:\Windows\system32\Mblcnj32.exe
163⤵
- Drops file in System32 directory
PID:6832

C:\Windows\SysWOW64\Mifljdjo.exe
C:\Windows\system32\Mifljdjo.exe
164⤵
PID:6876

C:\Windows\SysWOW64\Mldhfpib.exe
C:\Windows\system32\Mldhfpib.exe
165⤵
PID:6912

C:\Windows\SysWOW64\Nbnpcj32.exe
C:\Windows\system32\Nbnpcj32.exe
166⤵
PID:6964

C:\Windows\SysWOW64\Nemmoe32.exe
C:\Windows\system32\Nemmoe32.exe
167⤵
PID:7008

C:\Windows\SysWOW64\Nhkikq32.exe
C:\Windows\system32\Nhkikq32.exe
168⤵
- System Location Discovery: System Language Discovery
PID:7052

C:\Windows\SysWOW64\Nijeec32.exe
C:\Windows\system32\Nijeec32.exe
169⤵
PID:7096

C:\Windows\SysWOW64\Nliaao32.exe
C:\Windows\system32\Nliaao32.exe
170⤵
- Drops file in System32 directory
PID:7140

C:\Windows\SysWOW64\Neafjdkn.exe
C:\Windows\system32\Neafjdkn.exe
171⤵
PID:6168

C:\Windows\SysWOW64\Nknobkje.exe
C:\Windows\system32\Nknobkje.exe
172⤵
- Modifies registry class
PID:6232

C:\Windows\SysWOW64\Neccpd32.exe
C:\Windows\system32\Neccpd32.exe
173⤵
- System Location Discovery: System Language Discovery
PID:6312

C:\Windows\SysWOW64\Niooqcad.exe
C:\Windows\system32\Niooqcad.exe
174⤵
PID:6388

C:\Windows\SysWOW64\Nlnkmnah.exe
C:\Windows\system32\Nlnkmnah.exe
175⤵
- Drops file in System32 directory
PID:6444

C:\Windows\SysWOW64\Niakfbpa.exe
C:\Windows\system32\Niakfbpa.exe
176⤵
PID:6508

C:\Windows\SysWOW64\Oampjeml.exe
C:\Windows\system32\Oampjeml.exe
177⤵
PID:6580

C:\Windows\SysWOW64\Okedcjcm.exe
C:\Windows\system32\Okedcjcm.exe
178⤵
PID:6648

C:\Windows\SysWOW64\Oblmdhdo.exe
C:\Windows\system32\Oblmdhdo.exe
179⤵
- Modifies registry class
PID:6740

C:\Windows\SysWOW64\Oekiqccc.exe
C:\Windows\system32\Oekiqccc.exe
180⤵
PID:6796

C:\Windows\SysWOW64\Okgaijaj.exe
C:\Windows\system32\Okgaijaj.exe
181⤵
PID:6864

C:\Windows\SysWOW64\Oaajed32.exe
C:\Windows\system32\Oaajed32.exe
182⤵
PID:6932

C:\Windows\SysWOW64\Oemefcap.exe
C:\Windows\system32\Oemefcap.exe
183⤵
PID:7020

C:\Windows\SysWOW64\Ohkbbn32.exe
C:\Windows\system32\Ohkbbn32.exe
184⤵
- Modifies registry class
PID:7044

C:\Windows\SysWOW64\Okjnnj32.exe
C:\Windows\system32\Okjnnj32.exe
185⤵
PID:7084

C:\Windows\SysWOW64\Oeoblb32.exe
C:\Windows\system32\Oeoblb32.exe
186⤵
PID:6164

C:\Windows\SysWOW64\Oklkdi32.exe
C:\Windows\system32\Oklkdi32.exe
187⤵
- Modifies registry class
PID:6252

C:\Windows\SysWOW64\Pllgnl32.exe
C:\Windows\system32\Pllgnl32.exe
188⤵
PID:6356

C:\Windows\SysWOW64\Piphgq32.exe
C:\Windows\system32\Piphgq32.exe
189⤵
PID:6468

C:\Windows\SysWOW64\Pkadoiip.exe
C:\Windows\system32\Pkadoiip.exe
190⤵
- System Location Discovery: System Language Discovery
PID:6576

C:\Windows\SysWOW64\Pefhlaie.exe
C:\Windows\system32\Pefhlaie.exe
191⤵
PID:6708

C:\Windows\SysWOW64\Plpqil32.exe
C:\Windows\system32\Plpqil32.exe
192⤵
PID:6804

C:\Windows\SysWOW64\Pamiaboj.exe
C:\Windows\system32\Pamiaboj.exe
193⤵
PID:6908

C:\Windows\SysWOW64\Phganm32.exe
C:\Windows\system32\Phganm32.exe
194⤵
PID:2320

C:\Windows\SysWOW64\Papfgbmg.exe
C:\Windows\system32\Papfgbmg.exe
195⤵
PID:7092

C:\Windows\SysWOW64\Plejdkmm.exe
C:\Windows\system32\Plejdkmm.exe
196⤵
- Modifies registry class
PID:6156

C:\Windows\SysWOW64\Pcobaedj.exe
C:\Windows\system32\Pcobaedj.exe
197⤵
PID:6248

C:\Windows\SysWOW64\Piijno32.exe
C:\Windows\system32\Piijno32.exe
198⤵
PID:6492

C:\Windows\SysWOW64\Qhlkilba.exe
C:\Windows\system32\Qhlkilba.exe
199⤵
PID:6644

C:\Windows\SysWOW64\Qadoba32.exe
C:\Windows\system32\Qadoba32.exe
200⤵
PID:6840

C:\Windows\SysWOW64\Qcclld32.exe
C:\Windows\system32\Qcclld32.exe
201⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6948

C:\Windows\SysWOW64\Aojlaeei.exe
C:\Windows\system32\Aojlaeei.exe
202⤵
PID:7148

C:\Windows\SysWOW64\Akamff32.exe
C:\Windows\system32\Akamff32.exe
203⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6320

C:\Windows\SysWOW64\Ajbmdn32.exe
C:\Windows\system32\Ajbmdn32.exe
204⤵
PID:6620

C:\Windows\SysWOW64\Aoofle32.exe
C:\Windows\system32\Aoofle32.exe
205⤵
PID:6888

C:\Windows\SysWOW64\Ackbmcjl.exe
C:\Windows\system32\Ackbmcjl.exe
206⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7128

C:\Windows\SysWOW64\Afinioip.exe
C:\Windows\system32\Afinioip.exe
207⤵
PID:6384

C:\Windows\SysWOW64\Ahgjejhd.exe
C:\Windows\system32\Ahgjejhd.exe
208⤵
PID:6860

C:\Windows\SysWOW64\Ajggomog.exe
C:\Windows\system32\Ajggomog.exe
209⤵
PID:6424

C:\Windows\SysWOW64\Akhcfe32.exe
C:\Windows\system32\Akhcfe32.exe
210⤵
- System Location Discovery: System Language Discovery
PID:7016

C:\Windows\SysWOW64\Bhldpj32.exe
C:\Windows\system32\Bhldpj32.exe
211⤵
- Drops file in System32 directory
PID:6288

C:\Windows\SysWOW64\Bcahmb32.exe
C:\Windows\system32\Bcahmb32.exe
212⤵
- Drops file in System32 directory
PID:7036

C:\Windows\SysWOW64\Bljlfh32.exe
C:\Windows\system32\Bljlfh32.exe
213⤵
PID:7176

C:\Windows\SysWOW64\Bkmmaeap.exe
C:\Windows\system32\Bkmmaeap.exe
214⤵
- System Location Discovery: System Language Discovery
PID:7220

C:\Windows\SysWOW64\Bmlilh32.exe
C:\Windows\system32\Bmlilh32.exe
215⤵
- Modifies registry class
PID:7264

C:\Windows\SysWOW64\Bcfahbpo.exe
C:\Windows\system32\Bcfahbpo.exe
216⤵
PID:7308

C:\Windows\SysWOW64\Bjpjel32.exe
C:\Windows\system32\Bjpjel32.exe
217⤵
PID:7352

C:\Windows\SysWOW64\Bombmcec.exe
C:\Windows\system32\Bombmcec.exe
218⤵
PID:7400

C:\Windows\SysWOW64\Bmabggdm.exe
C:\Windows\system32\Bmabggdm.exe
219⤵
PID:7444

C:\Windows\SysWOW64\Cfigpm32.exe
C:\Windows\system32\Cfigpm32.exe
220⤵
PID:7488

C:\Windows\SysWOW64\Ckfphc32.exe
C:\Windows\system32\Ckfphc32.exe
221⤵
PID:7532

C:\Windows\SysWOW64\Ccmgiaig.exe
C:\Windows\system32\Ccmgiaig.exe
222⤵
- Modifies registry class
PID:7576

C:\Windows\SysWOW64\Cmflbf32.exe
C:\Windows\system32\Cmflbf32.exe
223⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:7620

C:\Windows\SysWOW64\Cfnqklgh.exe
C:\Windows\system32\Cfnqklgh.exe
224⤵
PID:7664

C:\Windows\SysWOW64\Cimmggfl.exe
C:\Windows\system32\Cimmggfl.exe
225⤵
PID:7708

C:\Windows\SysWOW64\Ccbadp32.exe
C:\Windows\system32\Ccbadp32.exe
226⤵
PID:7752

C:\Windows\SysWOW64\Cioilg32.exe
C:\Windows\system32\Cioilg32.exe
227⤵
PID:7796

C:\Windows\SysWOW64\Ccdnjp32.exe
C:\Windows\system32\Ccdnjp32.exe
228⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7840

C:\Windows\SysWOW64\Cmmbbejp.exe
C:\Windows\system32\Cmmbbejp.exe
229⤵
- System Location Discovery: System Language Discovery
PID:7884

C:\Windows\SysWOW64\Ccgjopal.exe
C:\Windows\system32\Ccgjopal.exe
230⤵
- Modifies registry class
PID:7928

C:\Windows\SysWOW64\Djqblj32.exe
C:\Windows\system32\Djqblj32.exe
231⤵
- Modifies registry class
PID:7972

C:\Windows\SysWOW64\Dmoohe32.exe
C:\Windows\system32\Dmoohe32.exe
232⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8036

C:\Windows\SysWOW64\Dpnkdq32.exe
C:\Windows\system32\Dpnkdq32.exe
233⤵
PID:8124

C:\Windows\SysWOW64\Dblgpl32.exe
C:\Windows\system32\Dblgpl32.exe
234⤵
PID:8172

C:\Windows\SysWOW64\Djcoai32.exe
C:\Windows\system32\Djcoai32.exe
235⤵
PID:7260

C:\Windows\SysWOW64\Difpmfna.exe
C:\Windows\system32\Difpmfna.exe
236⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7324

C:\Windows\SysWOW64\Dkdliame.exe
C:\Windows\system32\Dkdliame.exe
237⤵
PID:7388

C:\Windows\SysWOW64\Dpphjp32.exe
C:\Windows\system32\Dpphjp32.exe
238⤵
- System Location Discovery: System Language Discovery
PID:7472

C:\Windows\SysWOW64\Dbndfl32.exe
C:\Windows\system32\Dbndfl32.exe
239⤵
PID:7524

C:\Windows\SysWOW64\Djelgied.exe
C:\Windows\system32\Djelgied.exe
240⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7608

C:\Windows\SysWOW64\Dihlbf32.exe
C:\Windows\system32\Dihlbf32.exe
241⤵
PID:7692

C:\Windows\SysWOW64\Dpbdopck.exe
C:\Windows\system32\Dpbdopck.exe
242⤵
PID:7736

C:\Windows\SysWOW64\Dflmlj32.exe
C:\Windows\system32\Dflmlj32.exe
243⤵
PID:7828

C:\Windows\SysWOW64\Dikihe32.exe
C:\Windows\system32\Dikihe32.exe
244⤵
- Drops file in System32 directory
PID:7904

C:\Windows\SysWOW64\Dmfeidbe.exe
C:\Windows\system32\Dmfeidbe.exe
245⤵
- Drops file in System32 directory
PID:7964

C:\Windows\SysWOW64\Dcpmen32.exe
C:\Windows\system32\Dcpmen32.exe
246⤵
PID:8032

C:\Windows\SysWOW64\Dfoiaj32.exe
C:\Windows\system32\Dfoiaj32.exe
247⤵
PID:8164

C:\Windows\SysWOW64\Dimenegi.exe
C:\Windows\system32\Dimenegi.exe
248⤵
PID:7336

C:\Windows\SysWOW64\Ebejfk32.exe
C:\Windows\system32\Ebejfk32.exe
249⤵
PID:7368

C:\Windows\SysWOW64\Emkndc32.exe
C:\Windows\system32\Emkndc32.exe
250⤵
PID:7520

C:\Windows\SysWOW64\Ecefqnel.exe
C:\Windows\system32\Ecefqnel.exe
251⤵
PID:7660

C:\Windows\SysWOW64\Ejoomhmi.exe
C:\Windows\system32\Ejoomhmi.exe
252⤵
PID:7760

C:\Windows\SysWOW64\Ejalcgkg.exe
C:\Windows\system32\Ejalcgkg.exe
253⤵
PID:7872

C:\Windows\SysWOW64\Eciplm32.exe
C:\Windows\system32\Eciplm32.exe
254⤵
- Modifies registry class
PID:7996

C:\Windows\SysWOW64\Embddb32.exe
C:\Windows\system32\Embddb32.exe
255⤵
PID:6776

C:\Windows\SysWOW64\Eclmamod.exe
C:\Windows\system32\Eclmamod.exe
256⤵
PID:7364

C:\Windows\SysWOW64\Ejfeng32.exe
C:\Windows\system32\Ejfeng32.exe
257⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:7632

C:\Windows\SysWOW64\Elgaeolp.exe
C:\Windows\system32\Elgaeolp.exe
258⤵
PID:7812

C:\Windows\SysWOW64\Fbajbi32.exe
C:\Windows\system32\Fbajbi32.exe
259⤵
PID:8120

C:\Windows\SysWOW64\Fpejlmcf.exe
C:\Windows\system32\Fpejlmcf.exe
260⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7412

C:\Windows\SysWOW64\Ffobhg32.exe
C:\Windows\system32\Ffobhg32.exe
261⤵
- Drops file in System32 directory
PID:7744

C:\Windows\SysWOW64\Fimodc32.exe
C:\Windows\system32\Fimodc32.exe
262⤵
PID:8116

C:\Windows\SysWOW64\Fllkqn32.exe
C:\Windows\system32\Fllkqn32.exe
263⤵
PID:7432

C:\Windows\SysWOW64\Fbfcmhpg.exe
C:\Windows\system32\Fbfcmhpg.exe
264⤵
PID:7748

C:\Windows\SysWOW64\Ffaong32.exe
C:\Windows\system32\Ffaong32.exe
265⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7276

C:\Windows\SysWOW64\Fmkgkapm.exe
C:\Windows\system32\Fmkgkapm.exe
266⤵
PID:7920

C:\Windows\SysWOW64\Fbhpch32.exe
C:\Windows\system32\Fbhpch32.exe
267⤵
- Drops file in System32 directory
PID:7672

C:\Windows\SysWOW64\Fjohde32.exe
C:\Windows\system32\Fjohde32.exe
268⤵
PID:7896

C:\Windows\SysWOW64\Flqdlnde.exe
C:\Windows\system32\Flqdlnde.exe
269⤵
- System Location Discovery: System Language Discovery
PID:8204

C:\Windows\SysWOW64\Fbjmhh32.exe
C:\Windows\system32\Fbjmhh32.exe
270⤵
PID:8252

C:\Windows\SysWOW64\Fjadje32.exe
C:\Windows\system32\Fjadje32.exe
271⤵
PID:8300

C:\Windows\SysWOW64\Glcaambb.exe
C:\Windows\system32\Glcaambb.exe
272⤵
PID:8352

C:\Windows\SysWOW64\Gdjibj32.exe
C:\Windows\system32\Gdjibj32.exe
273⤵
PID:8396

C:\Windows\SysWOW64\Gigaka32.exe
C:\Windows\system32\Gigaka32.exe
274⤵
PID:8448

C:\Windows\SysWOW64\Gpqjglii.exe
C:\Windows\system32\Gpqjglii.exe
275⤵
PID:8496

C:\Windows\SysWOW64\Gfkbde32.exe
C:\Windows\system32\Gfkbde32.exe
276⤵
PID:8540

C:\Windows\SysWOW64\Gjfnedho.exe
C:\Windows\system32\Gjfnedho.exe
277⤵
- System Location Discovery: System Language Discovery
PID:8588

C:\Windows\SysWOW64\Gpcfmkff.exe
C:\Windows\system32\Gpcfmkff.exe
278⤵
- System Location Discovery: System Language Discovery
PID:8632

C:\Windows\SysWOW64\Gkhkjd32.exe
C:\Windows\system32\Gkhkjd32.exe
279⤵
PID:8672

C:\Windows\SysWOW64\Gpecbk32.exe
C:\Windows\system32\Gpecbk32.exe
280⤵
PID:8716

C:\Windows\SysWOW64\Gbdoof32.exe
C:\Windows\system32\Gbdoof32.exe
281⤵
PID:8760

C:\Windows\SysWOW64\Gmiclo32.exe
C:\Windows\system32\Gmiclo32.exe
282⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:8804

C:\Windows\SysWOW64\Gphphj32.exe
C:\Windows\system32\Gphphj32.exe
283⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8848

C:\Windows\SysWOW64\Gbfldf32.exe
C:\Windows\system32\Gbfldf32.exe
284⤵
PID:8892

C:\Windows\SysWOW64\Gkmdecbg.exe
C:\Windows\system32\Gkmdecbg.exe
285⤵
PID:8936

C:\Windows\SysWOW64\Hmlpaoaj.exe
C:\Windows\system32\Hmlpaoaj.exe
286⤵
PID:8980

C:\Windows\SysWOW64\Hloqml32.exe
C:\Windows\system32\Hloqml32.exe
287⤵
PID:9020

C:\Windows\SysWOW64\Hgdejd32.exe
C:\Windows\system32\Hgdejd32.exe
288⤵
PID:9068

C:\Windows\SysWOW64\Hplicjok.exe
C:\Windows\system32\Hplicjok.exe
289⤵
PID:9112

C:\Windows\SysWOW64\Hkbmqb32.exe
C:\Windows\system32\Hkbmqb32.exe
290⤵
PID:9156

C:\Windows\SysWOW64\Hdjbiheb.exe
C:\Windows\system32\Hdjbiheb.exe
291⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:9200

C:\Windows\SysWOW64\Hginecde.exe
C:\Windows\system32\Hginecde.exe
292⤵
- Modifies registry class
PID:8224

C:\Windows\SysWOW64\Hmbfbn32.exe
C:\Windows\system32\Hmbfbn32.exe
293⤵
- Modifies registry class
PID:8296

C:\Windows\SysWOW64\Hpabni32.exe
C:\Windows\system32\Hpabni32.exe
294⤵
PID:8360

C:\Windows\SysWOW64\Hcpojd32.exe
C:\Windows\system32\Hcpojd32.exe
295⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8420

C:\Windows\SysWOW64\Hkfglb32.exe
C:\Windows\system32\Hkfglb32.exe
296⤵
PID:8484

C:\Windows\SysWOW64\Hiiggoaf.exe
C:\Windows\system32\Hiiggoaf.exe
297⤵
PID:8564

C:\Windows\SysWOW64\Hmechmip.exe
C:\Windows\system32\Hmechmip.exe
298⤵
PID:8628

C:\Windows\SysWOW64\Hpcodihc.exe
C:\Windows\system32\Hpcodihc.exe
299⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:8704

C:\Windows\SysWOW64\Hcblpdgg.exe
C:\Windows\system32\Hcblpdgg.exe
300⤵
PID:8776

C:\Windows\SysWOW64\Hgmgqc32.exe
C:\Windows\system32\Hgmgqc32.exe
301⤵
PID:8856

C:\Windows\SysWOW64\Hildmn32.exe
C:\Windows\system32\Hildmn32.exe
302⤵
PID:8908

C:\Windows\SysWOW64\Iljpij32.exe
C:\Windows\system32\Iljpij32.exe
303⤵
PID:8976

C:\Windows\SysWOW64\Idahjg32.exe
C:\Windows\system32\Idahjg32.exe
304⤵
- System Location Discovery: System Language Discovery
PID:9056

C:\Windows\SysWOW64\Igpdfb32.exe
C:\Windows\system32\Igpdfb32.exe
305⤵
PID:9124

C:\Windows\SysWOW64\Iinqbn32.exe
C:\Windows\system32\Iinqbn32.exe
306⤵
PID:9212

C:\Windows\SysWOW64\Injmcmej.exe
C:\Windows\system32\Injmcmej.exe
307⤵
PID:8292

C:\Windows\SysWOW64\Iphioh32.exe
C:\Windows\system32\Iphioh32.exe
308⤵
- Drops file in System32 directory
PID:8388

C:\Windows\SysWOW64\Idcepgmg.exe
C:\Windows\system32\Idcepgmg.exe
309⤵
PID:8488

C:\Windows\SysWOW64\Igbalblk.exe
C:\Windows\system32\Igbalblk.exe
310⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:9100

C:\Windows\SysWOW64\Inlihl32.exe
C:\Windows\system32\Inlihl32.exe
311⤵
PID:8220

C:\Windows\SysWOW64\Iloidijb.exe
C:\Windows\system32\Iloidijb.exe
312⤵
PID:8408

C:\Windows\SysWOW64\Ipjedh32.exe
C:\Windows\system32\Ipjedh32.exe
313⤵
PID:8492

C:\Windows\SysWOW64\Iciaqc32.exe
C:\Windows\system32\Iciaqc32.exe
314⤵
PID:8600

C:\Windows\SysWOW64\Ikpjbq32.exe
C:\Windows\system32\Ikpjbq32.exe
315⤵
PID:8812

C:\Windows\SysWOW64\Innfnl32.exe
C:\Windows\system32\Innfnl32.exe
316⤵
- System Location Discovery: System Language Discovery
PID:8876

C:\Windows\SysWOW64\Ilafiihp.exe
C:\Windows\system32\Ilafiihp.exe
317⤵
PID:9040

C:\Windows\SysWOW64\Idhnkf32.exe
C:\Windows\system32\Idhnkf32.exe
318⤵
- Drops file in System32 directory
PID:9208

C:\Windows\SysWOW64\Icknfcol.exe
C:\Windows\system32\Icknfcol.exe
319⤵
- Modifies registry class
PID:8316

C:\Windows\SysWOW64\Iggjga32.exe
C:\Windows\system32\Iggjga32.exe
320⤵
PID:8724

C:\Windows\SysWOW64\Ijegcm32.exe
C:\Windows\system32\Ijegcm32.exe
321⤵
- Drops file in System32 directory
PID:8816

C:\Windows\SysWOW64\Inqbclob.exe
C:\Windows\system32\Inqbclob.exe
322⤵
PID:9036

C:\Windows\SysWOW64\Ipoopgnf.exe
C:\Windows\system32\Ipoopgnf.exe
323⤵
PID:8992

C:\Windows\SysWOW64\Icnklbmj.exe
C:\Windows\system32\Icnklbmj.exe
324⤵
PID:8584

C:\Windows\SysWOW64\Igigla32.exe
C:\Windows\system32\Igigla32.exe
325⤵
PID:8688

C:\Windows\SysWOW64\Jjgchm32.exe
C:\Windows\system32\Jjgchm32.exe
326⤵
PID:8348

C:\Windows\SysWOW64\Jlfpdh32.exe
C:\Windows\system32\Jlfpdh32.exe
327⤵
PID:8820

C:\Windows\SysWOW64\Jdmgfedl.exe
C:\Windows\system32\Jdmgfedl.exe
328⤵
PID:4028

C:\Windows\SysWOW64\Jgkdbacp.exe
C:\Windows\system32\Jgkdbacp.exe
329⤵
PID:9188

C:\Windows\SysWOW64\Jkgpbp32.exe
C:\Windows\system32\Jkgpbp32.exe
330⤵
PID:8788

C:\Windows\SysWOW64\Jpdhkf32.exe
C:\Windows\system32\Jpdhkf32.exe
331⤵
- System Location Discovery: System Language Discovery
PID:2004

C:\Windows\SysWOW64\Jkimho32.exe
C:\Windows\system32\Jkimho32.exe
332⤵
PID:8800

C:\Windows\SysWOW64\Jjlmclqa.exe
C:\Windows\system32\Jjlmclqa.exe
333⤵
PID:4872

C:\Windows\SysWOW64\Jlkipgpe.exe
C:\Windows\system32\Jlkipgpe.exe
334⤵
PID:4656

C:\Windows\SysWOW64\Jklinohd.exe
C:\Windows\system32\Jklinohd.exe
335⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3068

C:\Windows\SysWOW64\Jqhafffk.exe
C:\Windows\system32\Jqhafffk.exe
336⤵
PID:9224

C:\Windows\SysWOW64\Jknfcofa.exe
C:\Windows\system32\Jknfcofa.exe
337⤵
PID:9268

C:\Windows\SysWOW64\Jqknkedi.exe
C:\Windows\system32\Jqknkedi.exe
338⤵
- System Location Discovery: System Language Discovery
PID:9316

C:\Windows\SysWOW64\Kkpbin32.exe
C:\Windows\system32\Kkpbin32.exe
339⤵
PID:9360

C:\Windows\SysWOW64\Kqmkae32.exe
C:\Windows\system32\Kqmkae32.exe
340⤵
PID:9404

C:\Windows\SysWOW64\Kdigadjo.exe
C:\Windows\system32\Kdigadjo.exe
341⤵
PID:9448

C:\Windows\SysWOW64\Kkconn32.exe
C:\Windows\system32\Kkconn32.exe
342⤵
PID:9492

C:\Windows\SysWOW64\Kqphfe32.exe
C:\Windows\system32\Kqphfe32.exe
343⤵
PID:9536

C:\Windows\SysWOW64\Kdkdgchl.exe
C:\Windows\system32\Kdkdgchl.exe
344⤵
PID:9580

C:\Windows\SysWOW64\Kmfhkf32.exe
C:\Windows\system32\Kmfhkf32.exe
345⤵
PID:9624

C:\Windows\SysWOW64\Kcpahpmd.exe
C:\Windows\system32\Kcpahpmd.exe
346⤵
PID:9668

C:\Windows\SysWOW64\Kqdaadln.exe
C:\Windows\system32\Kqdaadln.exe
347⤵
PID:9712

C:\Windows\SysWOW64\Kdpmbc32.exe
C:\Windows\system32\Kdpmbc32.exe
348⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:9756

C:\Windows\SysWOW64\Kdbjhbbd.exe
C:\Windows\system32\Kdbjhbbd.exe
349⤵
PID:9804

C:\Windows\SysWOW64\Lnjnqh32.exe
C:\Windows\system32\Lnjnqh32.exe
350⤵
- Modifies registry class
PID:9844

C:\Windows\SysWOW64\Lgccinoe.exe
C:\Windows\system32\Lgccinoe.exe
351⤵
- Modifies registry class
PID:9888

C:\Windows\SysWOW64\Lnmkfh32.exe
C:\Windows\system32\Lnmkfh32.exe
352⤵
PID:9932

C:\Windows\SysWOW64\Lqkgbcff.exe
C:\Windows\system32\Lqkgbcff.exe
353⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:9976

C:\Windows\SysWOW64\Lkalplel.exe
C:\Windows\system32\Lkalplel.exe
354⤵
PID:10020

C:\Windows\SysWOW64\Lmbhgd32.exe
C:\Windows\system32\Lmbhgd32.exe
355⤵
PID:10064

C:\Windows\SysWOW64\Lqpamb32.exe
C:\Windows\system32\Lqpamb32.exe
356⤵
PID:10108

C:\Windows\SysWOW64\Lkeekk32.exe
C:\Windows\system32\Lkeekk32.exe
357⤵
PID:10152

C:\Windows\SysWOW64\Ljhefhha.exe
C:\Windows\system32\Ljhefhha.exe
358⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:10200

C:\Windows\SysWOW64\Mcqjon32.exe
C:\Windows\system32\Mcqjon32.exe
359⤵
PID:8444

C:\Windows\SysWOW64\Mnfnlf32.exe
C:\Windows\system32\Mnfnlf32.exe
360⤵
PID:9284

C:\Windows\SysWOW64\Mgobel32.exe
C:\Windows\system32\Mgobel32.exe
361⤵
- System Location Discovery: System Language Discovery
PID:9352

C:\Windows\SysWOW64\Mnhkbfme.exe
C:\Windows\system32\Mnhkbfme.exe
362⤵
PID:9416

C:\Windows\SysWOW64\Mkmkkjko.exe
C:\Windows\system32\Mkmkkjko.exe
363⤵
- Modifies registry class
PID:9476

C:\Windows\SysWOW64\Meepdp32.exe
C:\Windows\system32\Meepdp32.exe
364⤵
PID:9576

C:\Windows\SysWOW64\Mchppmij.exe
C:\Windows\system32\Mchppmij.exe
365⤵
PID:9632

C:\Windows\SysWOW64\Mnmdme32.exe
C:\Windows\system32\Mnmdme32.exe
366⤵
PID:9708

C:\Windows\SysWOW64\Mcjmel32.exe
C:\Windows\system32\Mcjmel32.exe
367⤵
- System Location Discovery: System Language Discovery
PID:9740

C:\Windows\SysWOW64\Mjdebfnd.exe
C:\Windows\system32\Mjdebfnd.exe
368⤵
PID:9840

C:\Windows\SysWOW64\Nclikl32.exe
C:\Windows\system32\Nclikl32.exe
369⤵
- Drops file in System32 directory
PID:9896

C:\Windows\SysWOW64\Nlcalieg.exe
C:\Windows\system32\Nlcalieg.exe
370⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:9968

C:\Windows\SysWOW64\Napjdpcn.exe
C:\Windows\system32\Napjdpcn.exe
371⤵
PID:10032

C:\Windows\SysWOW64\Nndjndbh.exe
C:\Windows\system32\Nndjndbh.exe
372⤵
PID:10116

C:\Windows\SysWOW64\Nhmofj32.exe
C:\Windows\system32\Nhmofj32.exe
373⤵
PID:10196

C:\Windows\SysWOW64\Njkkbehl.exe
C:\Windows\system32\Njkkbehl.exe
374⤵
PID:8524

C:\Windows\SysWOW64\Nccokk32.exe
C:\Windows\system32\Nccokk32.exe
375⤵
PID:9344

C:\Windows\SysWOW64\Nnicid32.exe
C:\Windows\system32\Nnicid32.exe
376⤵
PID:9456

C:\Windows\SysWOW64\Njpdnedf.exe
C:\Windows\system32\Njpdnedf.exe
377⤵
PID:9568

C:\Windows\SysWOW64\Ohcegi32.exe
C:\Windows\system32\Ohcegi32.exe
378⤵
PID:9676

C:\Windows\SysWOW64\Ohfami32.exe
C:\Windows\system32\Ohfami32.exe
379⤵
PID:9792

C:\Windows\SysWOW64\Ojdnid32.exe
C:\Windows\system32\Ojdnid32.exe
380⤵
PID:9880

C:\Windows\SysWOW64\Oanfen32.exe
C:\Windows\system32\Oanfen32.exe
381⤵
PID:9992

C:\Windows\SysWOW64\Ohhnbhok.exe
C:\Windows\system32\Ohhnbhok.exe
382⤵
PID:10100

C:\Windows\SysWOW64\Oaqbkn32.exe
C:\Windows\system32\Oaqbkn32.exe
383⤵
PID:10192

C:\Windows\SysWOW64\Ohkkhhmh.exe
C:\Windows\system32\Ohkkhhmh.exe
384⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:9312

C:\Windows\SysWOW64\Oeokal32.exe
C:\Windows\system32\Oeokal32.exe
385⤵
PID:9480

C:\Windows\SysWOW64\Ohmhmh32.exe
C:\Windows\system32\Ohmhmh32.exe
386⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:9656

C:\Windows\SysWOW64\Oogpjbbb.exe
C:\Windows\system32\Oogpjbbb.exe
387⤵
PID:9852

C:\Windows\SysWOW64\Phodcg32.exe
C:\Windows\system32\Phodcg32.exe
388⤵
PID:9964

C:\Windows\SysWOW64\Pknqoc32.exe
C:\Windows\system32\Pknqoc32.exe
389⤵
- Drops file in System32 directory
PID:10120

C:\Windows\SysWOW64\Pmlmkn32.exe
C:\Windows\system32\Pmlmkn32.exe
390⤵
PID:9308

C:\Windows\SysWOW64\Poliea32.exe
C:\Windows\system32\Poliea32.exe
391⤵
- Modifies registry class
PID:9652

C:\Windows\SysWOW64\Pefabkej.exe
C:\Windows\system32\Pefabkej.exe
392⤵
- System Location Discovery: System Language Discovery
PID:9872

C:\Windows\SysWOW64\Ponfka32.exe
C:\Windows\system32\Ponfka32.exe
393⤵
PID:5348

C:\Windows\SysWOW64\Pmaffnce.exe
C:\Windows\system32\Pmaffnce.exe
394⤵
PID:9412

C:\Windows\SysWOW64\Pdkoch32.exe
C:\Windows\system32\Pdkoch32.exe
395⤵
PID:9788

C:\Windows\SysWOW64\Pkegpb32.exe
C:\Windows\system32\Pkegpb32.exe
396⤵
PID:10080

C:\Windows\SysWOW64\Pejkmk32.exe
C:\Windows\system32\Pejkmk32.exe
397⤵
PID:9688

C:\Windows\SysWOW64\Pocpfphe.exe
C:\Windows\system32\Pocpfphe.exe
398⤵
PID:9612

C:\Windows\SysWOW64\Qaalblgi.exe
C:\Windows\system32\Qaalblgi.exe
399⤵
PID:9436

C:\Windows\SysWOW64\Qhkdof32.exe
C:\Windows\system32\Qhkdof32.exe
400⤵
PID:10248

C:\Windows\SysWOW64\Qoelkp32.exe
C:\Windows\system32\Qoelkp32.exe
401⤵
PID:10292

C:\Windows\SysWOW64\Qeodhjmo.exe
C:\Windows\system32\Qeodhjmo.exe
402⤵
PID:10336

C:\Windows\SysWOW64\Aogiap32.exe
C:\Windows\system32\Aogiap32.exe
403⤵
PID:10376

C:\Windows\SysWOW64\Addaif32.exe
C:\Windows\system32\Addaif32.exe
404⤵
PID:10416

C:\Windows\SysWOW64\Aahbbkaq.exe
C:\Windows\system32\Aahbbkaq.exe
405⤵
- System Location Discovery: System Language Discovery
PID:10456

C:\Windows\SysWOW64\Alnfpcag.exe
C:\Windows\system32\Alnfpcag.exe
406⤵
PID:10500

C:\Windows\SysWOW64\Anobgl32.exe
C:\Windows\system32\Anobgl32.exe
407⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:10544

C:\Windows\SysWOW64\Aefjii32.exe
C:\Windows\system32\Aefjii32.exe
408⤵
PID:10584

C:\Windows\SysWOW64\Alpbecod.exe
C:\Windows\system32\Alpbecod.exe
409⤵
PID:10628

C:\Windows\SysWOW64\Aonoao32.exe
C:\Windows\system32\Aonoao32.exe
410⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:10672

C:\Windows\SysWOW64\Anaomkdb.exe
C:\Windows\system32\Anaomkdb.exe
411⤵
PID:10708

C:\Windows\SysWOW64\Aamknj32.exe
C:\Windows\system32\Aamknj32.exe
412⤵
PID:10760

C:\Windows\SysWOW64\Ahgcjddh.exe
C:\Windows\system32\Ahgcjddh.exe
413⤵
PID:10796

C:\Windows\SysWOW64\Aekddhcb.exe
C:\Windows\system32\Aekddhcb.exe
414⤵
- System Location Discovery: System Language Discovery
PID:10848

C:\Windows\SysWOW64\Ahippdbe.exe
C:\Windows\system32\Ahippdbe.exe
415⤵
PID:10892

C:\Windows\SysWOW64\Bochmn32.exe
C:\Windows\system32\Bochmn32.exe
416⤵
- Modifies registry class
PID:10936

C:\Windows\SysWOW64\Bdpaeehj.exe
C:\Windows\system32\Bdpaeehj.exe
417⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:10980

C:\Windows\SysWOW64\Bnhenj32.exe
C:\Windows\system32\Bnhenj32.exe
418⤵
PID:11024

C:\Windows\SysWOW64\Bafndi32.exe
C:\Windows\system32\Bafndi32.exe
419⤵
- System Location Discovery: System Language Discovery
PID:11068

C:\Windows\SysWOW64\Bhpfqcln.exe
C:\Windows\system32\Bhpfqcln.exe
420⤵
- System Location Discovery: System Language Discovery
PID:11112

C:\Windows\SysWOW64\Bahkih32.exe
C:\Windows\system32\Bahkih32.exe
421⤵
- Drops file in System32 directory
- Modifies registry class
PID:11160

C:\Windows\SysWOW64\Bhbcfbjk.exe
C:\Windows\system32\Bhbcfbjk.exe
422⤵
PID:11204

C:\Windows\SysWOW64\Bffcpg32.exe
C:\Windows\system32\Bffcpg32.exe
423⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11248

C:\Windows\SysWOW64\Ckclhn32.exe
C:\Windows\system32\Ckclhn32.exe
424⤵
PID:10280

C:\Windows\SysWOW64\Cdlqqcnl.exe
C:\Windows\system32\Cdlqqcnl.exe
425⤵
- Modifies registry class
PID:10344

C:\Windows\SysWOW64\Clchbqoo.exe
C:\Windows\system32\Clchbqoo.exe
426⤵
PID:10412

C:\Windows\SysWOW64\Cfkmkf32.exe
C:\Windows\system32\Cfkmkf32.exe
427⤵
PID:10488

C:\Windows\SysWOW64\Cbbnpg32.exe
C:\Windows\system32\Cbbnpg32.exe
428⤵
PID:10560

C:\Windows\SysWOW64\Cdpjlb32.exe
C:\Windows\system32\Cdpjlb32.exe
429⤵
PID:10636

C:\Windows\SysWOW64\Cnindhpg.exe
C:\Windows\system32\Cnindhpg.exe
430⤵
PID:10696

C:\Windows\SysWOW64\Cohkokgj.exe
C:\Windows\system32\Cohkokgj.exe
431⤵
- Modifies registry class
PID:10768

C:\Windows\SysWOW64\Cbfgkffn.exe
C:\Windows\system32\Cbfgkffn.exe
432⤵
PID:10844

C:\Windows\SysWOW64\Dkokcl32.exe
C:\Windows\system32\Dkokcl32.exe
433⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:10904

C:\Windows\SysWOW64\Dbicpfdk.exe
C:\Windows\system32\Dbicpfdk.exe
434⤵
PID:10972

C:\Windows\SysWOW64\Dhclmp32.exe
C:\Windows\system32\Dhclmp32.exe
435⤵
PID:11040

C:\Windows\SysWOW64\Dbkqfe32.exe
C:\Windows\system32\Dbkqfe32.exe
436⤵
- Modifies registry class
PID:11108

C:\Windows\SysWOW64\Ddjmba32.exe
C:\Windows\system32\Ddjmba32.exe
437⤵
- Drops file in System32 directory
PID:11180

C:\Windows\SysWOW64\Dkceokii.exe
C:\Windows\system32\Dkceokii.exe
438⤵
PID:11244

C:\Windows\SysWOW64\Dfiildio.exe
C:\Windows\system32\Dfiildio.exe
439⤵
PID:10332

C:\Windows\SysWOW64\Dkfadkgf.exe
C:\Windows\system32\Dkfadkgf.exe
440⤵
PID:10440

C:\Windows\SysWOW64\Dndnpf32.exe
C:\Windows\system32\Dndnpf32.exe
441⤵
- System Location Discovery: System Language Discovery
PID:10532

C:\Windows\SysWOW64\Ddnfmqng.exe
C:\Windows\system32\Ddnfmqng.exe
442⤵
PID:10660

C:\Windows\SysWOW64\Dmennnni.exe
C:\Windows\system32\Dmennnni.exe
443⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:10752

C:\Windows\SysWOW64\Dngjff32.exe
C:\Windows\system32\Dngjff32.exe
444⤵
PID:10900

C:\Windows\SysWOW64\Eiloco32.exe
C:\Windows\system32\Eiloco32.exe
445⤵
PID:10948

C:\Windows\SysWOW64\Ekkkoj32.exe
C:\Windows\system32\Ekkkoj32.exe
446⤵
PID:11104

C:\Windows\SysWOW64\Ebdcld32.exe
C:\Windows\system32\Ebdcld32.exe
447⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:11152

C:\Windows\SysWOW64\Eiokinbk.exe
C:\Windows\system32\Eiokinbk.exe
448⤵
PID:10308

C:\Windows\SysWOW64\Ekmhejao.exe
C:\Windows\system32\Ekmhejao.exe
449⤵
- System Location Discovery: System Language Discovery
PID:10536

C:\Windows\SysWOW64\Enkdaepb.exe
C:\Windows\system32\Enkdaepb.exe
450⤵
- System Location Discovery: System Language Discovery
PID:4420

C:\Windows\SysWOW64\Emmdom32.exe
C:\Windows\system32\Emmdom32.exe
451⤵
PID:10876

C:\Windows\SysWOW64\Eokqkh32.exe
C:\Windows\system32\Eokqkh32.exe
452⤵
PID:11052

C:\Windows\SysWOW64\Efeihb32.exe
C:\Windows\system32\Efeihb32.exe
453⤵
- Modifies registry class
PID:11236

C:\Windows\SysWOW64\Epmmqheb.exe
C:\Windows\system32\Epmmqheb.exe
454⤵
PID:10568

C:\Windows\SysWOW64\Efgemb32.exe
C:\Windows\system32\Efgemb32.exe
455⤵
- Drops file in System32 directory
PID:10812

C:\Windows\SysWOW64\Ekdnei32.exe
C:\Windows\system32\Ekdnei32.exe
456⤵
PID:11212

C:\Windows\SysWOW64\Enbjad32.exe
C:\Windows\system32\Enbjad32.exe
457⤵
PID:10520

C:\Windows\SysWOW64\Fmcjpl32.exe
C:\Windows\system32\Fmcjpl32.exe
458⤵
PID:11000

C:\Windows\SysWOW64\Fpbflg32.exe
C:\Windows\system32\Fpbflg32.exe
459⤵
- Modifies registry class
PID:10464

C:\Windows\SysWOW64\Fbpchb32.exe
C:\Windows\system32\Fbpchb32.exe
460⤵
PID:11080

C:\Windows\SysWOW64\Fflohaij.exe
C:\Windows\system32\Fflohaij.exe
461⤵
PID:10004

C:\Windows\SysWOW64\Feoodn32.exe
C:\Windows\system32\Feoodn32.exe
462⤵
PID:11128

C:\Windows\SysWOW64\Fpdcag32.exe
C:\Windows\system32\Fpdcag32.exe
463⤵
PID:10268

C:\Windows\SysWOW64\Fealin32.exe
C:\Windows\system32\Fealin32.exe
464⤵
PID:11300

C:\Windows\SysWOW64\Fnipbc32.exe
C:\Windows\system32\Fnipbc32.exe
465⤵
PID:11352

C:\Windows\SysWOW64\Ffqhcq32.exe
C:\Windows\system32\Ffqhcq32.exe
466⤵
- Modifies registry class
PID:11408

C:\Windows\SysWOW64\Fmkqpkla.exe
C:\Windows\system32\Fmkqpkla.exe
467⤵
PID:11456

C:\Windows\SysWOW64\Fbgihaji.exe
C:\Windows\system32\Fbgihaji.exe
468⤵
PID:11508

C:\Windows\SysWOW64\Fiaael32.exe
C:\Windows\system32\Fiaael32.exe
469⤵
PID:11552

C:\Windows\SysWOW64\Fpkibf32.exe
C:\Windows\system32\Fpkibf32.exe
470⤵
- Drops file in System32 directory
PID:11600

C:\Windows\SysWOW64\Gfeaopqo.exe
C:\Windows\system32\Gfeaopqo.exe
471⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:11652

C:\Windows\SysWOW64\Gmojkj32.exe
C:\Windows\system32\Gmojkj32.exe
472⤵
PID:11700

C:\Windows\SysWOW64\Gblbca32.exe
C:\Windows\system32\Gblbca32.exe
473⤵
PID:11748

C:\Windows\SysWOW64\Gejopl32.exe
C:\Windows\system32\Gejopl32.exe
474⤵
PID:11796

C:\Windows\SysWOW64\Gifkpknp.exe
C:\Windows\system32\Gifkpknp.exe
475⤵
- Drops file in System32 directory
PID:11840

C:\Windows\SysWOW64\Gfjkjo32.exe
C:\Windows\system32\Gfjkjo32.exe
476⤵
PID:11888

C:\Windows\SysWOW64\Gmdcfidg.exe
C:\Windows\system32\Gmdcfidg.exe
477⤵
- System Location Discovery: System Language Discovery
PID:11932

C:\Windows\SysWOW64\Gnepna32.exe
C:\Windows\system32\Gnepna32.exe
478⤵
- Drops file in System32 directory
PID:11976

C:\Windows\SysWOW64\Geohklaa.exe
C:\Windows\system32\Geohklaa.exe
479⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:12020

C:\Windows\SysWOW64\Gikdkj32.exe
C:\Windows\system32\Gikdkj32.exe
480⤵
- Drops file in System32 directory
PID:12064

C:\Windows\SysWOW64\Gpelhd32.exe
C:\Windows\system32\Gpelhd32.exe
481⤵
- Modifies registry class
PID:12108

C:\Windows\SysWOW64\Gbchdp32.exe
C:\Windows\system32\Gbchdp32.exe
482⤵
- Drops file in System32 directory
- Modifies registry class
PID:12152

C:\Windows\SysWOW64\Gimqajgh.exe
C:\Windows\system32\Gimqajgh.exe
483⤵
PID:12196

C:\Windows\SysWOW64\Gpgind32.exe
C:\Windows\system32\Gpgind32.exe
484⤵
PID:12240

C:\Windows\SysWOW64\Gojiiafp.exe
C:\Windows\system32\Gojiiafp.exe
485⤵
PID:12284

C:\Windows\SysWOW64\Hipmfjee.exe
C:\Windows\system32\Hipmfjee.exe
486⤵
- System Location Discovery: System Language Discovery
PID:11316

C:\Windows\SysWOW64\Hlnjbedi.exe
C:\Windows\system32\Hlnjbedi.exe
487⤵
PID:11376

C:\Windows\SysWOW64\Hfcnpn32.exe
C:\Windows\system32\Hfcnpn32.exe
488⤵
PID:11452

C:\Windows\SysWOW64\Hefnkkkj.exe
C:\Windows\system32\Hefnkkkj.exe
489⤵
PID:11516

C:\Windows\SysWOW64\Hlpfhe32.exe
C:\Windows\system32\Hlpfhe32.exe
490⤵
PID:11584

C:\Windows\SysWOW64\Hbjoeojc.exe
C:\Windows\system32\Hbjoeojc.exe
491⤵
PID:11640

C:\Windows\SysWOW64\Hffken32.exe
C:\Windows\system32\Hffken32.exe
492⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:11708

C:\Windows\SysWOW64\Hlbcnd32.exe
C:\Windows\system32\Hlbcnd32.exe
493⤵
- Modifies registry class
PID:11764

C:\Windows\SysWOW64\Hoaojp32.exe
C:\Windows\system32\Hoaojp32.exe
494⤵
PID:11828

C:\Windows\SysWOW64\Hekgfj32.exe
C:\Windows\system32\Hekgfj32.exe
495⤵
PID:11904

C:\Windows\SysWOW64\Hlepcdoa.exe
C:\Windows\system32\Hlepcdoa.exe
496⤵
PID:11972

C:\Windows\SysWOW64\Hbohpn32.exe
C:\Windows\system32\Hbohpn32.exe
497⤵
- System Location Discovery: System Language Discovery
PID:12044

C:\Windows\SysWOW64\Hemdlj32.exe
C:\Windows\system32\Hemdlj32.exe
498⤵
PID:12120

C:\Windows\SysWOW64\Hlglidlo.exe
C:\Windows\system32\Hlglidlo.exe
499⤵
PID:12184

C:\Windows\SysWOW64\Ibaeen32.exe
C:\Windows\system32\Ibaeen32.exe
500⤵
PID:12252

C:\Windows\SysWOW64\Ifmqfm32.exe
C:\Windows\system32\Ifmqfm32.exe
501⤵
PID:11308

C:\Windows\SysWOW64\Imgicgca.exe
C:\Windows\system32\Imgicgca.exe
502⤵
PID:11436

C:\Windows\SysWOW64\Iohejo32.exe
C:\Windows\system32\Iohejo32.exe
503⤵
PID:11504

C:\Windows\SysWOW64\Iebngial.exe
C:\Windows\system32\Iebngial.exe
504⤵
PID:11624

C:\Windows\SysWOW64\Imiehfao.exe
C:\Windows\system32\Imiehfao.exe
505⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:11712

C:\Windows\SysWOW64\Iojbpo32.exe
C:\Windows\system32\Iojbpo32.exe
506⤵
PID:11816

C:\Windows\SysWOW64\Igajal32.exe
C:\Windows\system32\Igajal32.exe
507⤵
- Modifies registry class
PID:11968

C:\Windows\SysWOW64\Iipfmggc.exe
C:\Windows\system32\Iipfmggc.exe
508⤵
PID:12032

C:\Windows\SysWOW64\Ilnbicff.exe
C:\Windows\system32\Ilnbicff.exe
509⤵
- Drops file in System32 directory
PID:12092

C:\Windows\SysWOW64\Ibhkfm32.exe
C:\Windows\system32\Ibhkfm32.exe
510⤵
PID:12208

C:\Windows\SysWOW64\Iefgbh32.exe
C:\Windows\system32\Iefgbh32.exe
511⤵
- Modifies registry class
PID:11288

C:\Windows\SysWOW64\Imnocf32.exe
C:\Windows\system32\Imnocf32.exe
512⤵
PID:11392

C:\Windows\SysWOW64\Ioolkncg.exe
C:\Windows\system32\Ioolkncg.exe
513⤵
- Modifies registry class
PID:11544

C:\Windows\SysWOW64\Igfclkdj.exe
C:\Windows\system32\Igfclkdj.exe
514⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11616

C:\Windows\SysWOW64\Impliekg.exe
C:\Windows\system32\Impliekg.exe
515⤵
PID:11824

C:\Windows\SysWOW64\Ipoheakj.exe
C:\Windows\system32\Ipoheakj.exe
516⤵
PID:11964

C:\Windows\SysWOW64\Jcmdaljn.exe
C:\Windows\system32\Jcmdaljn.exe
517⤵
PID:12096

C:\Windows\SysWOW64\Jmbhoeid.exe
C:\Windows\system32\Jmbhoeid.exe
518⤵
PID:11268

C:\Windows\SysWOW64\Jpaekqhh.exe
C:\Windows\system32\Jpaekqhh.exe
519⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11536

C:\Windows\SysWOW64\Jgkmgk32.exe
C:\Windows\system32\Jgkmgk32.exe
520⤵
PID:11756

C:\Windows\SysWOW64\Jiiicf32.exe
C:\Windows\system32\Jiiicf32.exe
521⤵
- Drops file in System32 directory
PID:11900

C:\Windows\SysWOW64\Jlgepanl.exe
C:\Windows\system32\Jlgepanl.exe
522⤵
- Drops file in System32 directory
PID:12276

C:\Windows\SysWOW64\Jcanll32.exe
C:\Windows\system32\Jcanll32.exe
523⤵
PID:11660

C:\Windows\SysWOW64\Jepjhg32.exe
C:\Windows\system32\Jepjhg32.exe
524⤵
- System Location Discovery: System Language Discovery
PID:12268

C:\Windows\SysWOW64\Jljbeali.exe
C:\Windows\system32\Jljbeali.exe
525⤵
PID:11572

C:\Windows\SysWOW64\Johnamkm.exe
C:\Windows\system32\Johnamkm.exe
526⤵
- Drops file in System32 directory
PID:11684

C:\Windows\SysWOW64\Jgpfbjlo.exe
C:\Windows\system32\Jgpfbjlo.exe
527⤵
PID:12300

C:\Windows\SysWOW64\Jinboekc.exe
C:\Windows\system32\Jinboekc.exe
528⤵
PID:12340

C:\Windows\SysWOW64\Jllokajf.exe
C:\Windows\system32\Jllokajf.exe
529⤵
PID:12376

C:\Windows\SysWOW64\Jokkgl32.exe
C:\Windows\system32\Jokkgl32.exe
530⤵
PID:12412

C:\Windows\SysWOW64\Jedccfqg.exe
C:\Windows\system32\Jedccfqg.exe
531⤵
PID:12448

C:\Windows\SysWOW64\Jnlkedai.exe
C:\Windows\system32\Jnlkedai.exe
532⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:12484

C:\Windows\SysWOW64\Komhll32.exe
C:\Windows\system32\Komhll32.exe
533⤵
PID:12520

C:\Windows\SysWOW64\Kjblje32.exe
C:\Windows\system32\Kjblje32.exe
534⤵
PID:12560

C:\Windows\SysWOW64\Kckqbj32.exe
C:\Windows\system32\Kckqbj32.exe
535⤵
- Modifies registry class
PID:12596

C:\Windows\SysWOW64\Kjeiodek.exe
C:\Windows\system32\Kjeiodek.exe
536⤵
PID:12632

C:\Windows\SysWOW64\Kpoalo32.exe
C:\Windows\system32\Kpoalo32.exe
537⤵
PID:12668

C:\Windows\SysWOW64\Kcmmhj32.exe
C:\Windows\system32\Kcmmhj32.exe
538⤵
PID:12704

C:\Windows\SysWOW64\Kjgeedch.exe
C:\Windows\system32\Kjgeedch.exe
539⤵
PID:12740

C:\Windows\SysWOW64\Klfaapbl.exe
C:\Windows\system32\Klfaapbl.exe
540⤵
PID:12776

C:\Windows\SysWOW64\Kcpjnjii.exe
C:\Windows\system32\Kcpjnjii.exe
541⤵
PID:12812

C:\Windows\SysWOW64\Kfnfjehl.exe
C:\Windows\system32\Kfnfjehl.exe
542⤵
PID:12848

C:\Windows\SysWOW64\Knenkbio.exe
C:\Windows\system32\Knenkbio.exe
543⤵
PID:12884

C:\Windows\SysWOW64\Kofkbk32.exe
C:\Windows\system32\Kofkbk32.exe
544⤵
PID:12920

C:\Windows\SysWOW64\Kgnbdh32.exe
C:\Windows\system32\Kgnbdh32.exe
545⤵
PID:12956

C:\Windows\SysWOW64\Kngkqbgl.exe
C:\Windows\system32\Kngkqbgl.exe
546⤵
PID:12992

C:\Windows\SysWOW64\Lpfgmnfp.exe
C:\Windows\system32\Lpfgmnfp.exe
547⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:13028

C:\Windows\SysWOW64\Lgpoihnl.exe
C:\Windows\system32\Lgpoihnl.exe
548⤵
PID:13064

C:\Windows\SysWOW64\Lnjgfb32.exe

C:\Windows\system32\Lnjgfb32.exe
549⤵