7dc921cef900fc2efaaa0a3148ef394323246641ec31d7bb8afa7734dfa2550c

Analysis

max time kernel
162s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2023, 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.fbfb19fac3e122497ad61de373b5ffab.exe
Size

482KB
MD5

fbfb19fac3e122497ad61de373b5ffab
SHA1

aca0ce9e7a0cc42d72df8b93c6ed7deded0fe70e
SHA256

7dc921cef900fc2efaaa0a3148ef394323246641ec31d7bb8afa7734dfa2550c
SHA512

b965d52af8b04c5d234120e4e47fe986af8d97f1f0898af2171583d13b7259415da58237de1ace40d949ae0e41bf00bfcd7db0ce3810a29c5e97ba578dc0e6fe
SSDEEP

6144:BD8+c2Ll+wGXAF2PbgKLVGFM6234lKm3mo8Yvi4KsLTFM6234lKm3:tLLMwGXAF5KLVGFB24lwR45FB24l

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icefib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckpamabg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gooqfkan.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmehhpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aimhmkgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfbfjk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	NEAS.fbfb19fac3e122497ad61de373b5ffab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfmolc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dncpkjoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bpemkcck.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lomjicei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnbnjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Afeban32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnjqhcno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpiqfima.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iaedanal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkbkmqed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aiqkmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgnffj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdahek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iqpclh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mdmngm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djoohk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hjabdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mdghhb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gloejmld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdmeqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kaqejcep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bldgoeog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ellpmolj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajnkmjqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Enlcahgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gdgdeppb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kehojiej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afceko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dpoiho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmipkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jgjeppkp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkkhbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ocfdgg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Debfpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmifkecb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enaaiifb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lbekjipe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eibmlc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Afdkfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpfbcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pdqcenmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofnhfbjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmhglopl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhicoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohbfeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Abgcqjhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gjcmngnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fndgfffm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epcbbohh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Feljgd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejlnfjbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqphic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofbdncaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kpiqfima.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohhfknjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mqnfon32.exe

Executes dropped EXE 64 IoCs

pid	Process
2084	Bgnffj32.exe
2076	Bdfpkm32.exe
3800	Bajqda32.exe
4960	Coegoe32.exe
1268	Dnmaea32.exe
492	Dkcndeen.exe
4984	Dqbcbkab.exe
3084	Eoepebho.exe
724	Egcaod32.exe
2356	Enpfan32.exe
2128	Fnfmbmbi.exe
1324	Gejhef32.exe
2336	Gbnhoj32.exe
2212	Glhimp32.exe
380	Hpfbcn32.exe
3500	Hioflcbj.exe
1800	Hbgkei32.exe
3900	Hldiinke.exe
744	Ihmfco32.exe
4920	Jhgiim32.exe
1636	Jekjcaef.exe
1536	Jhkbdmbg.exe
4456	Jllhpkfk.exe
3428	Kpiqfima.exe
4468	Kefiopki.exe
4544	Koajmepf.exe
3712	Kpccmhdg.exe
3496	Lebijnak.exe
4788	Lomjicei.exe
4900	Lckboblp.exe
5000	Mcoljagj.exe
3288	Mpeiie32.exe
2312	Nbnlaldg.exe
4424	Njljch32.exe
5024	Ofjqihnn.exe
844	Omfekbdh.exe
4976	Pcbkml32.exe
2000	Pjoppf32.exe
520	Pidlqb32.exe
5064	Pmbegqjk.exe
1884	Cnhlgc32.exe
1016	Amikgpcc.exe
3824	Amkhmoap.exe
1688	Gehice32.exe
2352	Bfmolc32.exe
4612	Bkkhbb32.exe
3432	Ckpamabg.exe
2920	Cienon32.exe
1356	Cpfmlghd.exe
3324	Dcffnbee.exe
2752	Gooqfkan.exe
436	Dncpkjoc.exe
4636	Dcphdqmj.exe
3812	Ejlnfjbd.exe
1872	Ecgodpgb.exe
4364	Enlcahgh.exe
2056	Ljglnmdi.exe
4176	Fqphic32.exe
2172	Fjhmbihg.exe
3284	Fcpakn32.exe
3120	Fgnjqm32.exe
3748	Ggccllai.exe
2700	Gnmlhf32.exe
3860	Gdgdeppb.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Qoocnpag.exe	Qhekaejj.exe
File opened for modification	C:\Windows\SysWOW64\Glhimp32.exe	Gbnhoj32.exe
File created	C:\Windows\SysWOW64\Bldgoeog.exe	Amoknh32.exe
File created	C:\Windows\SysWOW64\Hjabdo32.exe	Hddilh32.exe
File created	C:\Windows\SysWOW64\Kaioidkh.exe	Kjpgmj32.exe
File created	C:\Windows\SysWOW64\Logicn32.exe	Hdahek32.exe
File created	C:\Windows\SysWOW64\Kjmjgk32.exe	Jepbodhg.exe
File created	C:\Windows\SysWOW64\Bkgokhco.dll	Oeamcmmo.exe
File created	C:\Windows\SysWOW64\Kojkgebl.dll	Ejlnfjbd.exe
File opened for modification	C:\Windows\SysWOW64\Enopghee.exe	Enlcahgh.exe
File created	C:\Windows\SysWOW64\Loancd32.dll	Gdmmlf32.exe
File created	C:\Windows\SysWOW64\Enopghee.exe	Enlcahgh.exe
File created	C:\Windows\SysWOW64\Bhnbgoib.dll	Gjcmngnj.exe
File opened for modification	C:\Windows\SysWOW64\Ohnljine.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\Bnppkj32.exe	Bgfhnpde.exe
File created	C:\Windows\SysWOW64\Kpjlgn32.dll	Iqpclh32.exe
File created	C:\Windows\SysWOW64\Inkjfk32.exe	Icefib32.exe
File opened for modification	C:\Windows\SysWOW64\Lfddci32.exe	Lechkaga.exe
File created	C:\Windows\SysWOW64\Gcdfnq32.dll	Ofbdncaj.exe
File opened for modification	C:\Windows\SysWOW64\Ooangh32.exe	Ohhfknjf.exe
File created	C:\Windows\SysWOW64\Mpeiie32.exe	Mcoljagj.exe
File created	C:\Windows\SysWOW64\Kcpcgc32.dll	Dcffnbee.exe
File created	C:\Windows\SysWOW64\Ilpgfc32.dll	Gehice32.exe
File created	C:\Windows\SysWOW64\Bfdkqcmb.dll	Odcojm32.exe
File created	C:\Windows\SysWOW64\Ddegdohc.dll	Kaioidkh.exe
File opened for modification	C:\Windows\SysWOW64\Ejlnfjbd.exe	Dcphdqmj.exe
File opened for modification	C:\Windows\SysWOW64\Ijmapm32.exe	Iepihf32.exe
File created	C:\Windows\SysWOW64\Qemgmmip.dll	Fcbehbim.exe
File created	C:\Windows\SysWOW64\Bpdfpmoo.exe	Beobcdoi.exe
File created	C:\Windows\SysWOW64\Dggkcakg.dll	Aimhmkgn.exe
File opened for modification	C:\Windows\SysWOW64\Iepihf32.exe	Gdmmlf32.exe
File created	C:\Windows\SysWOW64\Kjpmae32.dll	Pbifol32.exe
File opened for modification	C:\Windows\SysWOW64\Hqghqpnl.exe	Hjmodffo.exe
File opened for modification	C:\Windows\SysWOW64\Hnkhjdle.exe	Hqghqpnl.exe
File created	C:\Windows\SysWOW64\Oomelheh.exe	Debfpd32.exe
File opened for modification	C:\Windows\SysWOW64\Pdqcenmg.exe	Pcpgmf32.exe
File created	C:\Windows\SysWOW64\Obbgom32.dll	Jdbheajp.exe
File created	C:\Windows\SysWOW64\Pmbegqjk.exe	Pidlqb32.exe
File created	C:\Windows\SysWOW64\Gihfoi32.dll	Fcpakn32.exe
File created	C:\Windows\SysWOW64\Gcljpeah.dll	Gfemmb32.exe
File opened for modification	C:\Windows\SysWOW64\Hnehdo32.exe	Eknpfj32.exe
File created	C:\Windows\SysWOW64\Pohnnqgo.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\Cpifeb32.exe	Bpemkcck.exe
File created	C:\Windows\SysWOW64\Fegndm32.dll	Eibmlc32.exe
File created	C:\Windows\SysWOW64\Fooqlnoa.dll	Hdahek32.exe
File created	C:\Windows\SysWOW64\Fflnkhef.dll	Pdqcenmg.exe
File created	C:\Windows\SysWOW64\Amkabind.exe	Kmgdaokh.exe
File created	C:\Windows\SysWOW64\Bejhhd32.exe	Bnppkj32.exe
File created	C:\Windows\SysWOW64\Cdgolq32.exe	Cibkohef.exe
File opened for modification	C:\Windows\SysWOW64\Bpaikm32.exe	Bihancje.exe
File created	C:\Windows\SysWOW64\Gkdinefi.dll	Dqbcbkab.exe
File opened for modification	C:\Windows\SysWOW64\Hjmodffo.exe	Gbbkocid.exe
File created	C:\Windows\SysWOW64\Lhmafcnf.exe	Fjfnphpf.exe
File opened for modification	C:\Windows\SysWOW64\Qhekaejj.exe	Okkidceh.exe
File created	C:\Windows\SysWOW64\Bknbbenh.dll	Nmhglopl.exe
File opened for modification	C:\Windows\SysWOW64\Lndfchdj.exe	Lhjnfn32.exe
File created	C:\Windows\SysWOW64\Lomjicei.exe	Lebijnak.exe
File opened for modification	C:\Windows\SysWOW64\Oggbfdog.exe	Oolnabal.exe
File created	C:\Windows\SysWOW64\Pijcpmhc.exe	Ooangh32.exe
File created	C:\Windows\SysWOW64\Hmedbiid.dll	Ienlbf32.exe
File created	C:\Windows\SysWOW64\Bbniai32.exe	Bkdqdokk.exe
File opened for modification	C:\Windows\SysWOW64\Eoepebho.exe	Dqbcbkab.exe
File created	C:\Windows\SysWOW64\Logbigbg.exe	Fcbehbim.exe
File created	C:\Windows\SysWOW64\Jebdkl32.dll	Bfnnmg32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5184	4012	Process not Found	1289

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dkcndeen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gdknpp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dbfoclai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qemgmmip.dll"	Fcbehbim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gckjlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Koajmepf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbooabbb.dll"	Pbljoafi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ofnhfbjl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lbhojo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Geeecogb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iaedanal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Imknli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgaakmhb.dll"	Lhdqhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnginbho.dll"	Qhekaejj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Flfbcndo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hjabdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbnckkha.dll"	Eoepebho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ommjnlnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jgjeppkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pncmdhlq.dll"	Gbbkocid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaejqcdo.dll"	Jhgiim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jpfnqc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ommjnlnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cefked32.dll"	Okkidceh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Abgcqjhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmamhbhe.dll"	Bajqda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Egkgljkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aghaqkii.dll"	Hgpibdam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ecgodpgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Enaaiifb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bpemkcck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ohnljine.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hddilh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oogdfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lljoca32.dll"	Cienon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmmfoj32.dll"	Gggmgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igdnnggp.dll"	Gloejmld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdcbee32.dll"	Eknpfj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hjdedepg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jbppgona.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Afeban32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gloejmld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lhogamih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hbgkei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chmehhpn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ofbdncaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qhfaig32.dll"	Bcnleb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Amikgpcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pfbmdabh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	NEAS.fbfb19fac3e122497ad61de373b5ffab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpgkbmbm.dll"	Nbnlaldg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fegndm32.dll"	Eibmlc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nmhglopl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndjaei32.dll"	Dnmaea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkfood32.dll"	Jbppgona.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lbekjipe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Epcbbohh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kaioidkh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcelel32.dll"	Oggbfdog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hghklqmm.dll"	Koajmepf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dffdcecg.dll"	Gdknpp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Egelgoah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgobcb32.dll"	Lhjnfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bcnleb32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 2084	3708	NEAS.fbfb19fac3e122497ad61de373b5ffab.exe	91
PID 3708 wrote to memory of 2084	3708	NEAS.fbfb19fac3e122497ad61de373b5ffab.exe	91
PID 3708 wrote to memory of 2084	3708	NEAS.fbfb19fac3e122497ad61de373b5ffab.exe	91
PID 2084 wrote to memory of 2076	2084	Bgnffj32.exe	92
PID 2084 wrote to memory of 2076	2084	Bgnffj32.exe	92
PID 2084 wrote to memory of 2076	2084	Bgnffj32.exe	92
PID 2076 wrote to memory of 3800	2076	Bdfpkm32.exe	93
PID 2076 wrote to memory of 3800	2076	Bdfpkm32.exe	93
PID 2076 wrote to memory of 3800	2076	Bdfpkm32.exe	93
PID 3800 wrote to memory of 4960	3800	Bajqda32.exe	94
PID 3800 wrote to memory of 4960	3800	Bajqda32.exe	94
PID 3800 wrote to memory of 4960	3800	Bajqda32.exe	94
PID 4960 wrote to memory of 1268	4960	Coegoe32.exe	95
PID 4960 wrote to memory of 1268	4960	Coegoe32.exe	95
PID 4960 wrote to memory of 1268	4960	Coegoe32.exe	95
PID 1268 wrote to memory of 492	1268	Dnmaea32.exe	96
PID 1268 wrote to memory of 492	1268	Dnmaea32.exe	96
PID 1268 wrote to memory of 492	1268	Dnmaea32.exe	96
PID 492 wrote to memory of 4984	492	Dkcndeen.exe	97
PID 492 wrote to memory of 4984	492	Dkcndeen.exe	97
PID 492 wrote to memory of 4984	492	Dkcndeen.exe	97
PID 4984 wrote to memory of 3084	4984	Dqbcbkab.exe	98
PID 4984 wrote to memory of 3084	4984	Dqbcbkab.exe	98
PID 4984 wrote to memory of 3084	4984	Dqbcbkab.exe	98
PID 3084 wrote to memory of 724	3084	Eoepebho.exe	99
PID 3084 wrote to memory of 724	3084	Eoepebho.exe	99
PID 3084 wrote to memory of 724	3084	Eoepebho.exe	99
PID 724 wrote to memory of 2356	724	Egcaod32.exe	100
PID 724 wrote to memory of 2356	724	Egcaod32.exe	100
PID 724 wrote to memory of 2356	724	Egcaod32.exe	100
PID 2356 wrote to memory of 2128	2356	Enpfan32.exe	101
PID 2356 wrote to memory of 2128	2356	Enpfan32.exe	101
PID 2356 wrote to memory of 2128	2356	Enpfan32.exe	101
PID 2128 wrote to memory of 1324	2128	Fnfmbmbi.exe	102
PID 2128 wrote to memory of 1324	2128	Fnfmbmbi.exe	102
PID 2128 wrote to memory of 1324	2128	Fnfmbmbi.exe	102
PID 1324 wrote to memory of 2336	1324	Gejhef32.exe	103
PID 1324 wrote to memory of 2336	1324	Gejhef32.exe	103
PID 1324 wrote to memory of 2336	1324	Gejhef32.exe	103
PID 2336 wrote to memory of 2212	2336	Gbnhoj32.exe	104
PID 2336 wrote to memory of 2212	2336	Gbnhoj32.exe	104
PID 2336 wrote to memory of 2212	2336	Gbnhoj32.exe	104
PID 2212 wrote to memory of 380	2212	Glhimp32.exe	105
PID 2212 wrote to memory of 380	2212	Glhimp32.exe	105
PID 2212 wrote to memory of 380	2212	Glhimp32.exe	105
PID 380 wrote to memory of 3500	380	Hpfbcn32.exe	106
PID 380 wrote to memory of 3500	380	Hpfbcn32.exe	106
PID 380 wrote to memory of 3500	380	Hpfbcn32.exe	106
PID 3500 wrote to memory of 1800	3500	Hioflcbj.exe	107
PID 3500 wrote to memory of 1800	3500	Hioflcbj.exe	107
PID 3500 wrote to memory of 1800	3500	Hioflcbj.exe	107
PID 1800 wrote to memory of 3900	1800	Hbgkei32.exe	108
PID 1800 wrote to memory of 3900	1800	Hbgkei32.exe	108
PID 1800 wrote to memory of 3900	1800	Hbgkei32.exe	108
PID 3900 wrote to memory of 744	3900	Hldiinke.exe	109
PID 3900 wrote to memory of 744	3900	Hldiinke.exe	109
PID 3900 wrote to memory of 744	3900	Hldiinke.exe	109
PID 744 wrote to memory of 4920	744	Ihmfco32.exe	110
PID 744 wrote to memory of 4920	744	Ihmfco32.exe	110
PID 744 wrote to memory of 4920	744	Ihmfco32.exe	110
PID 4920 wrote to memory of 1636	4920	Jhgiim32.exe	111
PID 4920 wrote to memory of 1636	4920	Jhgiim32.exe	111
PID 4920 wrote to memory of 1636	4920	Jhgiim32.exe	111
PID 1636 wrote to memory of 1536	1636	Jekjcaef.exe	112

C:\Users\Admin\AppData\Local\Temp\NEAS.fbfb19fac3e122497ad61de373b5ffab.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.fbfb19fac3e122497ad61de373b5ffab.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\Bgnffj32.exe
  C:\Windows\system32\Bgnffj32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\Bdfpkm32.exe
    C:\Windows\system32\Bdfpkm32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\Windows\SysWOW64\Bajqda32.exe
      C:\Windows\system32\Bajqda32.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3800
    - - C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4960
      - C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1268
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:492
        
        C:\Windows\SysWOW64\Dqbcbkab.exe
        
        C:\Windows\system32\Dqbcbkab.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:724
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2336
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:380
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:744
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4920
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        23⤵
        Executes dropped EXE
        
        PID:1536
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        24⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3428
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        26⤵
        Executes dropped EXE
        
        PID:4468
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4544
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        28⤵
        Executes dropped EXE
        
        PID:3712
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3496
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        31⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5000
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        33⤵
        Executes dropped EXE
        
        PID:3288
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2312
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        35⤵
        Executes dropped EXE
        
        PID:4424
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        36⤵
        Executes dropped EXE
        
        PID:5024
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        37⤵
        Executes dropped EXE
        
        PID:844
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        38⤵
        Executes dropped EXE
        
        PID:4976
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        39⤵
        Executes dropped EXE
        
        PID:2000
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:520
        
        C:\Windows\SysWOW64\Pmbegqjk.exe
        
        C:\Windows\system32\Pmbegqjk.exe
        41⤵
        Executes dropped EXE
        
        PID:5064
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        42⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1016
        
        C:\Windows\SysWOW64\Amkhmoap.exe
        
        C:\Windows\system32\Amkhmoap.exe
        44⤵
        Executes dropped EXE
        
        PID:3824
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        45⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\Bfmolc32.exe
        
        C:\Windows\system32\Bfmolc32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2352
        
        C:\Windows\SysWOW64\Bkkhbb32.exe
        
        C:\Windows\system32\Bkkhbb32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4612
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3432
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2920
        
        C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        50⤵
        Executes dropped EXE
        
        PID:1356
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3324
        
        C:\Windows\SysWOW64\Dcnlnaom.exe
        
        C:\Windows\system32\Dcnlnaom.exe
        52⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\Ahngmnnd.exe
        
        C:\Windows\system32\Ahngmnnd.exe
        36⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\Abflfc32.exe
        
        C:\Windows\system32\Abflfc32.exe
        37⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Akopoi32.exe
        
        C:\Windows\system32\Akopoi32.exe
        38⤵
        
        PID:844
        
        C:\Windows\SysWOW64\Bdgehobe.exe
        
        C:\Windows\system32\Bdgehobe.exe
        39⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Bkamdi32.exe
        
        C:\Windows\system32\Bkamdi32.exe
        40⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\Bkcjjhgp.exe
        
        C:\Windows\system32\Bkcjjhgp.exe
        41⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\Bdlncn32.exe
        
        C:\Windows\system32\Bdlncn32.exe
        42⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Bkefphem.exe
        
        C:\Windows\system32\Bkefphem.exe
        43⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Npcaie32.exe
        
        C:\Windows\system32\Npcaie32.exe
        20⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Okiefn32.exe
        
        C:\Windows\system32\Okiefn32.exe
        21⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Oacmchcl.exe
        
        C:\Windows\system32\Oacmchcl.exe
        22⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Ohmepbki.exe
        
        C:\Windows\system32\Ohmepbki.exe
        23⤵
        
        PID:468
        
        C:\Windows\SysWOW64\Oinbgk32.exe
        
        C:\Windows\system32\Oinbgk32.exe
        24⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Odcfdc32.exe
        
        C:\Windows\system32\Odcfdc32.exe
        25⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Oiqomj32.exe
        
        C:\Windows\system32\Oiqomj32.exe
        26⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\Odfcjc32.exe
        
        C:\Windows\system32\Odfcjc32.exe
        27⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Okpkgm32.exe
        
        C:\Windows\system32\Okpkgm32.exe
        28⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Oajccgmd.exe
        
        C:\Windows\system32\Oajccgmd.exe
        29⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Ohdlpa32.exe
        
        C:\Windows\system32\Ohdlpa32.exe
        30⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Oiehhjjp.exe
        
        C:\Windows\system32\Oiehhjjp.exe
        31⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Opopdd32.exe
        
        C:\Windows\system32\Opopdd32.exe
        32⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Pgihanii.exe
        
        C:\Windows\system32\Pgihanii.exe
        33⤵
        
        PID:3496
        
        C:\Windows\SysWOW64\Pncanhaf.exe
        
        C:\Windows\system32\Pncanhaf.exe
        34⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Pdmikb32.exe
        
        C:\Windows\system32\Pdmikb32.exe
        35⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Pjjaci32.exe
        
        C:\Windows\system32\Pjjaci32.exe
        36⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Pjlnhi32.exe
        
        C:\Windows\system32\Pjlnhi32.exe
        37⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Pnjgog32.exe
        
        C:\Windows\system32\Pnjgog32.exe
        38⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Eoocfegl.exe
        
        C:\Windows\system32\Eoocfegl.exe
        8⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Efikco32.exe
        
        C:\Windows\system32\Efikco32.exe
        9⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Elccpife.exe
        
        C:\Windows\system32\Elccpife.exe
        10⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Eflhiolf.exe
        
        C:\Windows\system32\Eflhiolf.exe
        11⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Ecphbckp.exe
        
        C:\Windows\system32\Ecphbckp.exe
        12⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Ejiqom32.exe
        
        C:\Windows\system32\Ejiqom32.exe
        13⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Fcbehbim.exe
        
        C:\Windows\system32\Fcbehbim.exe
        14⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7408
        
        C:\Windows\SysWOW64\Fqfeag32.exe
        
        C:\Windows\system32\Fqfeag32.exe
        15⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Fjnjjlog.exe
        
        C:\Windows\system32\Fjnjjlog.exe
        16⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Fcfocb32.exe
        
        C:\Windows\system32\Fcfocb32.exe
        17⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Ficgkico.exe
        
        C:\Windows\system32\Ficgkico.exe
        18⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Fblldn32.exe
        
        C:\Windows\system32\Fblldn32.exe
        19⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\Fifdqhal.exe
        
        C:\Windows\system32\Fifdqhal.exe
        20⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Gcneca32.exe
        
        C:\Windows\system32\Gcneca32.exe
        21⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\Gcpaiq32.exe
        
        C:\Windows\system32\Gcpaiq32.exe
        22⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Gfqjkljn.exe
        
        C:\Windows\system32\Gfqjkljn.exe
        23⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Gcggjp32.exe
        
        C:\Windows\system32\Gcggjp32.exe
        24⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\Hfoflj32.exe
        
        C:\Windows\system32\Hfoflj32.exe
        25⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\Ipihkobl.exe
        
        C:\Windows\system32\Ipihkobl.exe
        26⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Iiblcdil.exe
        
        C:\Windows\system32\Iiblcdil.exe
        27⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Icgqqmib.exe
        
        C:\Windows\system32\Icgqqmib.exe
        28⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Ijaimg32.exe
        
        C:\Windows\system32\Ijaimg32.exe
        29⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Iannpa32.exe
        
        C:\Windows\system32\Iannpa32.exe
        30⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Iiibdc32.exe
        
        C:\Windows\system32\Iiibdc32.exe
        31⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Jabgkpad.exe
        
        C:\Windows\system32\Jabgkpad.exe
        32⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Jjklcf32.exe
        
        C:\Windows\system32\Jjklcf32.exe
        33⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Jbfphh32.exe
        
        C:\Windows\system32\Jbfphh32.exe
        34⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Jiphebml.exe
        
        C:\Windows\system32\Jiphebml.exe
        35⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Jfdinf32.exe
        
        C:\Windows\system32\Jfdinf32.exe
        36⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Jaimko32.exe
        
        C:\Windows\system32\Jaimko32.exe
        37⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Jkaadebl.exe
        
        C:\Windows\system32\Jkaadebl.exe
        38⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Kmbkfp32.exe
        
        C:\Windows\system32\Kmbkfp32.exe
        39⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Kgkooeen.exe
        
        C:\Windows\system32\Kgkooeen.exe
        40⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Kpccgk32.exe
        
        C:\Windows\system32\Kpccgk32.exe
        41⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Kmgdaokh.exe
        
        C:\Windows\system32\Kmgdaokh.exe
        42⤵
        Drops file in System32 directory
        
        PID:4972
        
        C:\Windows\SysWOW64\Kkkdjcjb.exe
        
        C:\Windows\system32\Kkkdjcjb.exe
        43⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Kipalpoj.exe
        
        C:\Windows\system32\Kipalpoj.exe
        44⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Lcifde32.exe
        
        C:\Windows\system32\Lcifde32.exe
        45⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Lpmfnj32.exe
        
        C:\Windows\system32\Lpmfnj32.exe
        46⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Lmqggncn.exe
        
        C:\Windows\system32\Lmqggncn.exe
        47⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Lanpml32.exe
        
        C:\Windows\system32\Lanpml32.exe
        48⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Lkgdfb32.exe
        
        C:\Windows\system32\Lkgdfb32.exe
        49⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Lcbikd32.exe
        
        C:\Windows\system32\Lcbikd32.exe
        50⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\Lpfidh32.exe
        
        C:\Windows\system32\Lpfidh32.exe
        51⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Maefnk32.exe
        
        C:\Windows\system32\Maefnk32.exe
        52⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\Mjqjbn32.exe
        
        C:\Windows\system32\Mjqjbn32.exe
        53⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Mciokcgg.exe
        
        C:\Windows\system32\Mciokcgg.exe
        54⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Mjednmla.exe
        
        C:\Windows\system32\Mjednmla.exe
        55⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Mcnhfb32.exe
        
        C:\Windows\system32\Mcnhfb32.exe
        56⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Mjhqcmjo.exe
        
        C:\Windows\system32\Mjhqcmjo.exe
        57⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\Nqaipgal.exe
        
        C:\Windows\system32\Nqaipgal.exe
        58⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Njjmil32.exe
        
        C:\Windows\system32\Njjmil32.exe
        59⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Ngnnbq32.exe
        
        C:\Windows\system32\Ngnnbq32.exe
        60⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Nqioqf32.exe
        
        C:\Windows\system32\Nqioqf32.exe
        61⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Nbhkjicf.exe
        
        C:\Windows\system32\Nbhkjicf.exe
        62⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Ogjmnomi.exe
        
        C:\Windows\system32\Ogjmnomi.exe
        63⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Okgfdm32.exe
        
        C:\Windows\system32\Okgfdm32.exe
        64⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Obanqgkl.exe
        
        C:\Windows\system32\Obanqgkl.exe
        65⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\Ojmcej32.exe
        
        C:\Windows\system32\Ojmcej32.exe
        66⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Pkaijl32.exe
        
        C:\Windows\system32\Pkaijl32.exe
        67⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Panabc32.exe
        
        C:\Windows\system32\Panabc32.exe
        68⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Papnhbgi.exe
        
        C:\Windows\system32\Papnhbgi.exe
        69⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Pkebekgo.exe
        
        C:\Windows\system32\Pkebekgo.exe
        70⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Pkhokkel.exe
        
        C:\Windows\system32\Pkhokkel.exe
        71⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Qaegcb32.exe
        
        C:\Windows\system32\Qaegcb32.exe
        72⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Qkjlpk32.exe
        
        C:\Windows\system32\Qkjlpk32.exe
        73⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Ankdbf32.exe
        
        C:\Windows\system32\Ankdbf32.exe
        74⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Achmjmnb.exe
        
        C:\Windows\system32\Achmjmnb.exe
        75⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Anmagenh.exe
        
        C:\Windows\system32\Anmagenh.exe
        76⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Ahffqk32.exe
        
        C:\Windows\system32\Ahffqk32.exe
        77⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Abkjnd32.exe
        
        C:\Windows\system32\Abkjnd32.exe
        78⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\Ahhbfkbf.exe
        
        C:\Windows\system32\Ahhbfkbf.exe
        79⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Aaqgop32.exe
        
        C:\Windows\system32\Aaqgop32.exe
        80⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Alfkli32.exe
        
        C:\Windows\system32\Alfkli32.exe
        81⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Aaccdp32.exe
        
        C:\Windows\system32\Aaccdp32.exe
        82⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Blhhaigj.exe
        
        C:\Windows\system32\Blhhaigj.exe
        83⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Bdcmfkde.exe
        
        C:\Windows\system32\Bdcmfkde.exe
        84⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\Bjnece32.exe
        
        C:\Windows\system32\Bjnece32.exe
        85⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Becipn32.exe
        
        C:\Windows\system32\Becipn32.exe
        86⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Boknic32.exe
        
        C:\Windows\system32\Boknic32.exe
        87⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Bonjnc32.exe
        
        C:\Windows\system32\Bonjnc32.exe
        88⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Bjdkcd32.exe
        
        C:\Windows\system32\Bjdkcd32.exe
        89⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\Baocpnmf.exe
        
        C:\Windows\system32\Baocpnmf.exe
        90⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\Cellfm32.exe
        
        C:\Windows\system32\Cellfm32.exe
        91⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Clfdcgkj.exe
        
        C:\Windows\system32\Clfdcgkj.exe
        92⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Cbqlpabf.exe
        
        C:\Windows\system32\Cbqlpabf.exe
        93⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Chmehhpn.exe
        
        C:\Windows\system32\Chmehhpn.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5352
        
        C:\Windows\SysWOW64\Cogmdb32.exe
        
        C:\Windows\system32\Cogmdb32.exe
        95⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\Ceaealoh.exe
        
        C:\Windows\system32\Ceaealoh.exe
        96⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Cbefkp32.exe
        
        C:\Windows\system32\Cbefkp32.exe
        97⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Cdfbbhdp.exe
        
        C:\Windows\system32\Cdfbbhdp.exe
        98⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Cajblmci.exe
        
        C:\Windows\system32\Cajblmci.exe
        99⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Donceaac.exe
        
        C:\Windows\system32\Donceaac.exe
        100⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Dlbcoe32.exe
        
        C:\Windows\system32\Dlbcoe32.exe
        101⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Eojcao32.exe
        
        C:\Windows\system32\Eojcao32.exe
        102⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Ekqcfpmj.exe
        
        C:\Windows\system32\Ekqcfpmj.exe
        103⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Ehimkd32.exe
        
        C:\Windows\system32\Ehimkd32.exe
        104⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Fdpnpe32.exe
        
        C:\Windows\system32\Fdpnpe32.exe
        105⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Fdegkdim.exe
        
        C:\Windows\system32\Fdegkdim.exe
        106⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Fkcibnmd.exe
        
        C:\Windows\system32\Fkcibnmd.exe
        107⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Gdlnkc32.exe
        
        C:\Windows\system32\Gdlnkc32.exe
        108⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Glcelq32.exe
        
        C:\Windows\system32\Glcelq32.exe
        109⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Gbpnegbo.exe
        
        C:\Windows\system32\Gbpnegbo.exe
        110⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Glebbpbd.exe
        
        C:\Windows\system32\Glebbpbd.exe
        111⤵
        
        PID:940
        
        C:\Windows\SysWOW64\Gbbkjgpl.exe
        
        C:\Windows\system32\Gbbkjgpl.exe
        112⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Gbdgpfni.exe
        
        C:\Windows\system32\Gbdgpfni.exe
        113⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\Gbgdef32.exe
        
        C:\Windows\system32\Gbgdef32.exe
        114⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\Hbiakf32.exe
        
        C:\Windows\system32\Hbiakf32.exe
        115⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Hkaedk32.exe
        
        C:\Windows\system32\Hkaedk32.exe
        116⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Hbknqeha.exe
        
        C:\Windows\system32\Hbknqeha.exe
        117⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Hcmgphma.exe
        
        C:\Windows\system32\Hcmgphma.exe
        118⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Hmfkin32.exe
        
        C:\Windows\system32\Hmfkin32.exe
        119⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Hcpcehko.exe
        
        C:\Windows\system32\Hcpcehko.exe
        120⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Hmhhnmao.exe
        
        C:\Windows\system32\Hmhhnmao.exe
        121⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Ifplgc32.exe
        
        C:\Windows\system32\Ifplgc32.exe
        122⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Ipiaphop.exe
        
        C:\Windows\system32\Ipiaphop.exe
        123⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Ilpaei32.exe
        
        C:\Windows\system32\Ilpaei32.exe
        124⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Imonol32.exe
        
        C:\Windows\system32\Imonol32.exe
        125⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Imakdl32.exe
        
        C:\Windows\system32\Imakdl32.exe
        126⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Ifjoma32.exe
        
        C:\Windows\system32\Ifjoma32.exe
        127⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\Jpbdfgge.exe
        
        C:\Windows\system32\Jpbdfgge.exe
        128⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\Jeolonem.exe
        
        C:\Windows\system32\Jeolonem.exe
        129⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Jcplle32.exe
        
        C:\Windows\system32\Jcplle32.exe
        130⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\Jmhaek32.exe
        
        C:\Windows\system32\Jmhaek32.exe
        131⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Jfaenqjm.exe
        
        C:\Windows\system32\Jfaenqjm.exe
        132⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Jpijgf32.exe
        
        C:\Windows\system32\Jpijgf32.exe
        133⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Jefbomoe.exe
        
        C:\Windows\system32\Jefbomoe.exe
        134⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Jcgbmd32.exe
        
        C:\Windows\system32\Jcgbmd32.exe
        135⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Jidkek32.exe
        
        C:\Windows\system32\Jidkek32.exe
        136⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Kpncbemh.exe
        
        C:\Windows\system32\Kpncbemh.exe
        137⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\Kifhkkci.exe
        
        C:\Windows\system32\Kifhkkci.exe
        138⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Kppphe32.exe
        
        C:\Windows\system32\Kppphe32.exe
        139⤵
        
        PID:488
        
        C:\Windows\SysWOW64\Kihdqkaf.exe
        
        C:\Windows\system32\Kihdqkaf.exe
        140⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\Kpbmme32.exe
        
        C:\Windows\system32\Kpbmme32.exe
        141⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Kikafjoc.exe
        
        C:\Windows\system32\Kikafjoc.exe
        142⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Kdqecc32.exe
        
        C:\Windows\system32\Kdqecc32.exe
        143⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Klljhe32.exe
        
        C:\Windows\system32\Klljhe32.exe
        144⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Kbebdpca.exe
        
        C:\Windows\system32\Kbebdpca.exe
        145⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Llngmeja.exe
        
        C:\Windows\system32\Llngmeja.exe
        146⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\Lbhojo32.exe
        
        C:\Windows\system32\Lbhojo32.exe
        147⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Liddligi.exe
        
        C:\Windows\system32\Liddligi.exe
        148⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\Lpnlicne.exe
        
        C:\Windows\system32\Lpnlicne.exe
        149⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Lboeknkf.exe
        
        C:\Windows\system32\Lboeknkf.exe
        150⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Lmdihgkl.exe
        
        C:\Windows\system32\Lmdihgkl.exe
        151⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Ldoadabi.exe
        
        C:\Windows\system32\Ldoadabi.exe
        152⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Mpebjb32.exe
        
        C:\Windows\system32\Mpebjb32.exe
        153⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Mebkbi32.exe
        
        C:\Windows\system32\Mebkbi32.exe
        154⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Mphoob32.exe
        
        C:\Windows\system32\Mphoob32.exe
        155⤵
        
        PID:468
        
        C:\Windows\SysWOW64\Mgagll32.exe
        
        C:\Windows\system32\Mgagll32.exe
        156⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Mdehep32.exe
        
        C:\Windows\system32\Mdehep32.exe
        157⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Megdmhbp.exe
        
        C:\Windows\system32\Megdmhbp.exe
        158⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Mlqljb32.exe
        
        C:\Windows\system32\Mlqljb32.exe
        159⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Mdhdkp32.exe
        
        C:\Windows\system32\Mdhdkp32.exe
        160⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Mlciobhj.exe
        
        C:\Windows\system32\Mlciobhj.exe
        161⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\Nigjifgc.exe
        
        C:\Windows\system32\Nigjifgc.exe
        162⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\Nconal32.exe
        
        C:\Windows\system32\Nconal32.exe
        163⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Niifnf32.exe
        
        C:\Windows\system32\Niifnf32.exe
        164⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Npcokpln.exe
        
        C:\Windows\system32\Npcokpln.exe
        165⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Njlcdf32.exe
        
        C:\Windows\system32\Njlcdf32.exe
        166⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Ncdgmkio.exe
        
        C:\Windows\system32\Ncdgmkio.exe
        167⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Njnpie32.exe
        
        C:\Windows\system32\Njnpie32.exe
        168⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Nfeqnf32.exe
        
        C:\Windows\system32\Nfeqnf32.exe
        169⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Nciahk32.exe
        
        C:\Windows\system32\Nciahk32.exe
        170⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Olaeqp32.exe
        
        C:\Windows\system32\Olaeqp32.exe
        171⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Odhman32.exe
        
        C:\Windows\system32\Odhman32.exe
        172⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Ofijifbj.exe
        
        C:\Windows\system32\Ofijifbj.exe
        173⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Opongobp.exe
        
        C:\Windows\system32\Opongobp.exe
        174⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\Ogkcihgj.exe
        
        C:\Windows\system32\Ogkcihgj.exe
        175⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\Odocbmfd.exe
        
        C:\Windows\system32\Odocbmfd.exe
        176⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Pmmelo32.exe
        
        C:\Windows\system32\Pmmelo32.exe
        177⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Ginenk32.exe
        
        C:\Windows\system32\Ginenk32.exe
        7⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Gpgnjebd.exe
        
        C:\Windows\system32\Gpgnjebd.exe
        8⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\Ghcbohpp.exe
        
        C:\Windows\system32\Ghcbohpp.exe
        9⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Gpjjpe32.exe
        
        C:\Windows\system32\Gpjjpe32.exe
        10⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Ggdbmoho.exe
        
        C:\Windows\system32\Ggdbmoho.exe
        11⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Glqkefff.exe
        
        C:\Windows\system32\Glqkefff.exe
        12⤵
        
        PID:4064
    - - C:\Windows\SysWOW64\Hohjgpmo.exe
        
        C:\Windows\system32\Hohjgpmo.exe
        5⤵
        
        PID:9248
      - C:\Windows\SysWOW64\Hcfcmnce.exe
        
        C:\Windows\system32\Hcfcmnce.exe
        6⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Hjpkjh32.exe
        
        C:\Windows\system32\Hjpkjh32.exe
        7⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Homcbo32.exe
        
        C:\Windows\system32\Homcbo32.exe
        8⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Iqmplbpl.exe
        
        C:\Windows\system32\Iqmplbpl.exe
        9⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Icminm32.exe
        
        C:\Windows\system32\Icminm32.exe
        10⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Ijgakgej.exe
        
        C:\Windows\system32\Ijgakgej.exe
        11⤵
        
        PID:9544

C:\Windows\SysWOW64\Dncpkjoc.exe
C:\Windows\system32\Dncpkjoc.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:436
- C:\Windows\SysWOW64\Dcphdqmj.exe
  C:\Windows\system32\Dcphdqmj.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:4636
- - C:\Windows\SysWOW64\Ejlnfjbd.exe
    C:\Windows\system32\Ejlnfjbd.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:3812
  - - C:\Windows\SysWOW64\Ecgodpgb.exe
      C:\Windows\system32\Ecgodpgb.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      PID:1872
    - - C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4364
      - C:\Windows\SysWOW64\Enopghee.exe
        
        C:\Windows\system32\Enopghee.exe
        6⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\Fqphic32.exe
        
        C:\Windows\system32\Fqphic32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4176
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        8⤵
        Executes dropped EXE
        
        PID:2172
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3284
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        10⤵
        Executes dropped EXE
        
        PID:3120
        
        C:\Windows\SysWOW64\Ggccllai.exe
        
        C:\Windows\system32\Ggccllai.exe
        11⤵
        Executes dropped EXE
        
        PID:3748
        
        C:\Windows\SysWOW64\Gnmlhf32.exe
        
        C:\Windows\system32\Gnmlhf32.exe
        12⤵
        Executes dropped EXE
        
        PID:2700
        
        C:\Windows\SysWOW64\Gdgdeppb.exe
        
        C:\Windows\system32\Gdgdeppb.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3860

C:\Windows\SysWOW64\Gjcmngnj.exe
C:\Windows\system32\Gjcmngnj.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1460
- C:\Windows\SysWOW64\Gggmgk32.exe
  C:\Windows\system32\Gggmgk32.exe
  2⤵
  - Modifies registry class
  PID:4184
- - C:\Windows\SysWOW64\Gdknpp32.exe
    C:\Windows\system32\Gdknpp32.exe
    3⤵
    - Modifies registry class
    PID:2148
  - - C:\Windows\SysWOW64\Gdnjfojj.exe
      C:\Windows\system32\Gdnjfojj.exe
      4⤵
      PID:1612
    - - C:\Windows\SysWOW64\Gbbkocid.exe
        
        C:\Windows\system32\Gbbkocid.exe
        5⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2776

C:\Windows\SysWOW64\Hjmodffo.exe
C:\Windows\system32\Hjmodffo.exe
1⤵
- Drops file in System32 directory
PID:1620
- C:\Windows\SysWOW64\Hqghqpnl.exe
  C:\Windows\system32\Hqghqpnl.exe
  2⤵
  - Drops file in System32 directory
  PID:3188
- - C:\Windows\SysWOW64\Hnkhjdle.exe
    C:\Windows\system32\Hnkhjdle.exe
    3⤵
    PID:1380
  - - C:\Windows\SysWOW64\Hgcmbj32.exe
      C:\Windows\system32\Hgcmbj32.exe
      4⤵
      PID:4324
    - - C:\Windows\SysWOW64\Hcjmhk32.exe
        
        C:\Windows\system32\Hcjmhk32.exe
        5⤵
        
        PID:1280
      - C:\Windows\SysWOW64\Hjdedepg.exe
        
        C:\Windows\system32\Hjdedepg.exe
        6⤵
        Modifies registry class
        
        PID:3972
        
        C:\Windows\SysWOW64\Hnbnjc32.exe
        
        C:\Windows\system32\Hnbnjc32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3876
        
        C:\Windows\SysWOW64\Ibpgqa32.exe
        
        C:\Windows\system32\Ibpgqa32.exe
        8⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\Iaedanal.exe
        
        C:\Windows\system32\Iaedanal.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2176
        
        C:\Windows\SysWOW64\Icfmci32.exe
        
        C:\Windows\system32\Icfmci32.exe
        10⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Ijpepcfj.exe
        
        C:\Windows\system32\Ijpepcfj.exe
        11⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Jbppgona.exe
        
        C:\Windows\system32\Jbppgona.exe
        12⤵
        Modifies registry class
        
        PID:5200
        
        C:\Windows\SysWOW64\Jdalog32.exe
        
        C:\Windows\system32\Jdalog32.exe
        13⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Jhoeef32.exe
        
        C:\Windows\system32\Jhoeef32.exe
        14⤵
        
        PID:5320

C:\Windows\SysWOW64\Kdhbpf32.exe
C:\Windows\system32\Kdhbpf32.exe
1⤵
PID:5364
- C:\Windows\SysWOW64\Kkbkmqed.exe
  C:\Windows\system32\Kkbkmqed.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:5408
- - C:\Windows\SysWOW64\Kehojiej.exe
    C:\Windows\system32\Kehojiej.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:5448
  - - C:\Windows\SysWOW64\Kocphojh.exe
      C:\Windows\system32\Kocphojh.exe
      4⤵
      PID:5500
    - - C:\Windows\SysWOW64\Kemhei32.exe
        
        C:\Windows\system32\Kemhei32.exe
        5⤵
        
        PID:5556

C:\Windows\SysWOW64\Lhmafcnf.exe
C:\Windows\system32\Lhmafcnf.exe
1⤵
PID:5592
- C:\Windows\SysWOW64\Logicn32.exe
  C:\Windows\system32\Logicn32.exe
  2⤵
  PID:5644
- - C:\Windows\SysWOW64\Mklfjm32.exe
    C:\Windows\system32\Mklfjm32.exe
    3⤵
    PID:5744
  - - C:\Windows\SysWOW64\Mllccpfj.exe
      C:\Windows\system32\Mllccpfj.exe
      4⤵
      PID:5804
    - - C:\Windows\SysWOW64\Mcfkpjng.exe
        
        C:\Windows\system32\Mcfkpjng.exe
        5⤵
        
        PID:5864
      - C:\Windows\SysWOW64\Mdghhb32.exe
        
        C:\Windows\system32\Mdghhb32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5928
        
        C:\Windows\SysWOW64\Nkcmjlio.exe
        
        C:\Windows\system32\Nkcmjlio.exe
        7⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Namegfql.exe
        
        C:\Windows\system32\Namegfql.exe
        8⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Nhgmcp32.exe
        
        C:\Windows\system32\Nhgmcp32.exe
        9⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Nfnjbdep.exe
        
        C:\Windows\system32\Nfnjbdep.exe
        10⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Ncaklhdi.exe
        
        C:\Windows\system32\Ncaklhdi.exe
        11⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Ohncdobq.exe
        
        C:\Windows\system32\Ohncdobq.exe
        12⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Ocdgahag.exe
        
        C:\Windows\system32\Ocdgahag.exe
        13⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Ofbdncaj.exe
        
        C:\Windows\system32\Ofbdncaj.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Okolfj32.exe
        
        C:\Windows\system32\Okolfj32.exe
        15⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Ocfdgg32.exe
        
        C:\Windows\system32\Ocfdgg32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5564
        
        C:\Windows\SysWOW64\Ohcmpn32.exe
        
        C:\Windows\system32\Ohcmpn32.exe
        17⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Oomelheh.exe
        
        C:\Windows\system32\Oomelheh.exe
        18⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Omaeem32.exe
        
        C:\Windows\system32\Omaeem32.exe
        19⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Ohhfknjf.exe
        
        C:\Windows\system32\Ohhfknjf.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5852
        
        C:\Windows\SysWOW64\Ooangh32.exe
        
        C:\Windows\system32\Ooangh32.exe
        21⤵
        Drops file in System32 directory
        
        PID:5948
        
        C:\Windows\SysWOW64\Pijcpmhc.exe
        
        C:\Windows\system32\Pijcpmhc.exe
        22⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Pcpgmf32.exe
        
        C:\Windows\system32\Pcpgmf32.exe
        23⤵
        Drops file in System32 directory
        
        PID:4496
        
        C:\Windows\SysWOW64\Pdqcenmg.exe
        
        C:\Windows\system32\Pdqcenmg.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5144
        
        C:\Windows\SysWOW64\Pkklbh32.exe
        
        C:\Windows\system32\Pkklbh32.exe
        25⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Piolkm32.exe
        
        C:\Windows\system32\Piolkm32.exe
        26⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Pfbmdabh.exe
        
        C:\Windows\system32\Pfbmdabh.exe
        27⤵
        Modifies registry class
        
        PID:5600
        
        C:\Windows\SysWOW64\Pkoemhao.exe
        
        C:\Windows\system32\Pkoemhao.exe
        28⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Piceflpi.exe
        
        C:\Windows\system32\Piceflpi.exe
        29⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Pbljoafi.exe
        
        C:\Windows\system32\Pbljoafi.exe
        30⤵
        Modifies registry class
        
        PID:6008
        
        C:\Windows\SysWOW64\Qkdohg32.exe
        
        C:\Windows\system32\Qkdohg32.exe
        31⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Qmckbjdl.exe
        
        C:\Windows\system32\Qmckbjdl.exe
        32⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Qcncodki.exe
        
        C:\Windows\system32\Qcncodki.exe
        33⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\Aijlgkjq.exe
        
        C:\Windows\system32\Aijlgkjq.exe
        34⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Abcppq32.exe
        
        C:\Windows\system32\Abcppq32.exe
        35⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Aimhmkgn.exe
        
        C:\Windows\system32\Aimhmkgn.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5392
        
        C:\Windows\SysWOW64\Acbmjcgd.exe
        
        C:\Windows\system32\Acbmjcgd.exe
        37⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Amkabind.exe
        
        C:\Windows\system32\Amkabind.exe
        38⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Ilglgfjd.exe
        
        C:\Windows\system32\Ilglgfjd.exe
        29⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Klibdcjo.exe
        
        C:\Windows\system32\Klibdcjo.exe
        30⤵
        
        PID:544
        
        C:\Windows\SysWOW64\Kdgcne32.exe
        
        C:\Windows\system32\Kdgcne32.exe
        31⤵
        
        PID:840
        
        C:\Windows\SysWOW64\Lbbjhini.exe
        
        C:\Windows\system32\Lbbjhini.exe
        32⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\Mkdagm32.exe
        
        C:\Windows\system32\Mkdagm32.exe
        33⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\Nmhglopl.exe
        
        C:\Windows\system32\Nmhglopl.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6496
        
        C:\Windows\SysWOW64\Nfeepdbg.exe
        
        C:\Windows\system32\Nfeepdbg.exe
        35⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Npmjij32.exe
        
        C:\Windows\system32\Npmjij32.exe
        36⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Nfgbec32.exe
        
        C:\Windows\system32\Nfgbec32.exe
        37⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Nmajbnha.exe
        
        C:\Windows\system32\Nmajbnha.exe
        38⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Obnbjdfi.exe
        
        C:\Windows\system32\Obnbjdfi.exe
        39⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Omdghmfo.exe
        
        C:\Windows\system32\Omdghmfo.exe
        40⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Onecof32.exe
        
        C:\Windows\system32\Onecof32.exe
        41⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\Olidijjf.exe
        
        C:\Windows\system32\Olidijjf.exe
        42⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Ofnhfbjl.exe
        
        C:\Windows\system32\Ofnhfbjl.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Opgloh32.exe
        
        C:\Windows\system32\Opgloh32.exe
        44⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Oecego32.exe
        
        C:\Windows\system32\Oecego32.exe
        45⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Opiidhoj.exe
        
        C:\Windows\system32\Opiidhoj.exe
        46⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\Ommjnlnd.exe
        
        C:\Windows\system32\Ommjnlnd.exe
        47⤵
        Modifies registry class
        
        PID:6360
        
        C:\Windows\SysWOW64\Ppnbpg32.exe
        
        C:\Windows\system32\Ppnbpg32.exe
        48⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Pemhmn32.exe
        
        C:\Windows\system32\Pemhmn32.exe
        49⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Pikqcl32.exe
        
        C:\Windows\system32\Pikqcl32.exe
        50⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Pimmil32.exe
        
        C:\Windows\system32\Pimmil32.exe
        51⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Aploae32.exe
        
        C:\Windows\system32\Aploae32.exe
        52⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Aiimejap.exe
        
        C:\Windows\system32\Aiimejap.exe
        53⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Bcfkiock.exe
        
        C:\Windows\system32\Bcfkiock.exe
        54⤵
        
        PID:1008

C:\Windows\SysWOW64\Afceko32.exe
C:\Windows\system32\Afceko32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5484
- C:\Windows\SysWOW64\Ammnhilb.exe
  C:\Windows\system32\Ammnhilb.exe
  2⤵
  PID:5356
- - C:\Windows\SysWOW64\Afeban32.exe
    C:\Windows\system32\Afeban32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Modifies registry class
    PID:5232
  - - C:\Windows\SysWOW64\Amoknh32.exe
      C:\Windows\system32\Amoknh32.exe
      4⤵
      Drops file in System32 directory
      PID:6160
    - - C:\Windows\SysWOW64\Bldgoeog.exe
        
        C:\Windows\system32\Bldgoeog.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6208
      - C:\Windows\SysWOW64\Bmddihfj.exe
        
        C:\Windows\system32\Bmddihfj.exe
        6⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Bcnleb32.exe
        
        C:\Windows\system32\Bcnleb32.exe
        7⤵
        Modifies registry class
        
        PID:6324
        
        C:\Windows\SysWOW64\Bpemkcck.exe
        
        C:\Windows\system32\Bpemkcck.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6368
        
        C:\Windows\SysWOW64\Cpifeb32.exe
        
        C:\Windows\system32\Cpifeb32.exe
        9⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Cibkohef.exe
        
        C:\Windows\system32\Cibkohef.exe
        10⤵
        Drops file in System32 directory
        
        PID:6452
        
        C:\Windows\SysWOW64\Cdgolq32.exe
        
        C:\Windows\system32\Cdgolq32.exe
        11⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Cdjlap32.exe
        
        C:\Windows\system32\Cdjlap32.exe
        12⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Cleqfb32.exe
        
        C:\Windows\system32\Cleqfb32.exe
        13⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Dmifkecb.exe
        
        C:\Windows\system32\Dmifkecb.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6620
        
        C:\Windows\SysWOW64\Dbfoclai.exe
        
        C:\Windows\system32\Dbfoclai.exe
        15⤵
        Modifies registry class
        
        PID:6660
        
        C:\Windows\SysWOW64\Dlncla32.exe
        
        C:\Windows\system32\Dlncla32.exe
        16⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Defheg32.exe
        
        C:\Windows\system32\Defheg32.exe
        17⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Dpllbp32.exe
        
        C:\Windows\system32\Dpllbp32.exe
        18⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Dpoiho32.exe
        
        C:\Windows\system32\Dpoiho32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6824
        
        C:\Windows\SysWOW64\Dekapfke.exe
        
        C:\Windows\system32\Dekapfke.exe
        20⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Epaemojk.exe
        
        C:\Windows\system32\Epaemojk.exe
        21⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Eiijfd32.exe
        
        C:\Windows\system32\Eiijfd32.exe
        22⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Epcbbohh.exe
        
        C:\Windows\system32\Epcbbohh.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7000
        
        C:\Windows\SysWOW64\Eepkkefp.exe
        
        C:\Windows\system32\Eepkkefp.exe
        24⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Epeohn32.exe
        
        C:\Windows\system32\Epeohn32.exe
        25⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Ellpmolj.exe
        
        C:\Windows\system32\Ellpmolj.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7128
        
        C:\Windows\SysWOW64\Eippgckc.exe
        
        C:\Windows\system32\Eippgckc.exe
        27⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Edfddl32.exe
        
        C:\Windows\system32\Edfddl32.exe
        28⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Eibmlc32.exe
        
        C:\Windows\system32\Eibmlc32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6300
        
        C:\Windows\SysWOW64\Feljgd32.exe
        
        C:\Windows\system32\Feljgd32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6348
        
        C:\Windows\SysWOW64\Flfbcndo.exe
        
        C:\Windows\system32\Flfbcndo.exe
        31⤵
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Glmhdm32.exe
        
        C:\Windows\system32\Glmhdm32.exe
        32⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Gfemmb32.exe
        
        C:\Windows\system32\Gfemmb32.exe
        33⤵
        Drops file in System32 directory
        
        PID:6564
        
        C:\Windows\SysWOW64\Gloejmld.exe
        
        C:\Windows\system32\Gloejmld.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Gcimfg32.exe
        
        C:\Windows\system32\Gcimfg32.exe
        35⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Glabolja.exe
        
        C:\Windows\system32\Glabolja.exe
        36⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Gckjlf32.exe
        
        C:\Windows\system32\Gckjlf32.exe
        37⤵
        Modifies registry class
        
        PID:6804
        
        C:\Windows\SysWOW64\Gjebiq32.exe
        
        C:\Windows\system32\Gjebiq32.exe
        38⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Gdkffi32.exe
        
        C:\Windows\system32\Gdkffi32.exe
        39⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Gflcnanp.exe
        
        C:\Windows\system32\Gflcnanp.exe
        40⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Mndcnafd.exe
        
        C:\Windows\system32\Mndcnafd.exe
        25⤵
        
        PID:8216

C:\Windows\SysWOW64\Gmfkjl32.exe
C:\Windows\system32\Gmfkjl32.exe
1⤵
PID:7120
- C:\Windows\SysWOW64\Gglpgd32.exe
  C:\Windows\system32\Gglpgd32.exe
  2⤵
  PID:6184
- - C:\Windows\SysWOW64\Hnehdo32.exe
    C:\Windows\system32\Hnehdo32.exe
    3⤵
    PID:6360
  - - C:\Windows\SysWOW64\Hdppaidl.exe
      C:\Windows\system32\Hdppaidl.exe
      4⤵
      PID:6524
    - - C:\Windows\SysWOW64\Hjlhipbc.exe
        
        C:\Windows\system32\Hjlhipbc.exe
        5⤵
        
        PID:5760
      - C:\Windows\SysWOW64\Hqfqfj32.exe
        
        C:\Windows\system32\Hqfqfj32.exe
        6⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Hgpibdam.exe
        
        C:\Windows\system32\Hgpibdam.exe
        7⤵
        Modifies registry class
        
        PID:6780
        
        C:\Windows\SysWOW64\Hnjaonij.exe
        
        C:\Windows\system32\Hnjaonij.exe
        8⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Hddilh32.exe
        
        C:\Windows\system32\Hddilh32.exe
        9⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7048
        
        C:\Windows\SysWOW64\Hjabdo32.exe
        
        C:\Windows\system32\Hjabdo32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6196
        
        C:\Windows\SysWOW64\Hfhbipdb.exe
        
        C:\Windows\system32\Hfhbipdb.exe
        11⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Hmbkfjko.exe
        
        C:\Windows\system32\Hmbkfjko.exe
        12⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Iggocbke.exe
        
        C:\Windows\system32\Iggocbke.exe
        13⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Ijfkpnji.exe
        
        C:\Windows\system32\Ijfkpnji.exe
        14⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Iqpclh32.exe
        
        C:\Windows\system32\Iqpclh32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6344
        
        C:\Windows\SysWOW64\Igjlibib.exe
        
        C:\Windows\system32\Igjlibib.exe
        16⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Incdem32.exe
        
        C:\Windows\system32\Incdem32.exe
        17⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Ienlbf32.exe
        
        C:\Windows\system32\Ienlbf32.exe
        18⤵
        Drops file in System32 directory
        
        PID:5688
        
        C:\Windows\SysWOW64\Ijjekn32.exe
        
        C:\Windows\system32\Ijjekn32.exe
        19⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Iepihf32.exe
        
        C:\Windows\system32\Iepihf32.exe
        20⤵
        Drops file in System32 directory
        
        PID:7124
        
        C:\Windows\SysWOW64\Ijmapm32.exe
        
        C:\Windows\system32\Ijmapm32.exe
        21⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Imknli32.exe
        
        C:\Windows\system32\Imknli32.exe
        22⤵
        Modifies registry class
        
        PID:7240
        
        C:\Windows\SysWOW64\Icefib32.exe
        
        C:\Windows\system32\Icefib32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7280
        
        C:\Windows\SysWOW64\Inkjfk32.exe
        
        C:\Windows\system32\Inkjfk32.exe
        24⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Jgcooaah.exe
        
        C:\Windows\system32\Jgcooaah.exe
        25⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Jnmglk32.exe
        
        C:\Windows\system32\Jnmglk32.exe
        26⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Jegohe32.exe
        
        C:\Windows\system32\Jegohe32.exe
        27⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Jfhlpnfp.exe
        
        C:\Windows\system32\Jfhlpnfp.exe
        28⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Jmbdmg32.exe
        
        C:\Windows\system32\Jmbdmg32.exe
        29⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Jghhjq32.exe
        
        C:\Windows\system32\Jghhjq32.exe
        30⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Japmcfcc.exe
        
        C:\Windows\system32\Japmcfcc.exe
        31⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Jgjeppkp.exe
        
        C:\Windows\system32\Jgjeppkp.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7640
        
        C:\Windows\SysWOW64\Jmgmhgig.exe
        
        C:\Windows\system32\Jmgmhgig.exe
        33⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Jcaeea32.exe
        
        C:\Windows\system32\Jcaeea32.exe
        34⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Jjknakhq.exe
        
        C:\Windows\system32\Jjknakhq.exe
        35⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Jepbodhg.exe
        
        C:\Windows\system32\Jepbodhg.exe
        36⤵
        Drops file in System32 directory
        
        PID:7796
        
        C:\Windows\SysWOW64\Kjmjgk32.exe
        
        C:\Windows\system32\Kjmjgk32.exe
        37⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Kebodc32.exe
        
        C:\Windows\system32\Kebodc32.exe
        38⤵
        
        PID:7880

C:\Windows\SysWOW64\Kjpgmj32.exe
C:\Windows\system32\Kjpgmj32.exe
1⤵
- Drops file in System32 directory
PID:7912
- C:\Windows\SysWOW64\Kaioidkh.exe
  C:\Windows\system32\Kaioidkh.exe
  2⤵
  - Drops file in System32 directory
  - Modifies registry class
  PID:7960
- - C:\Windows\SysWOW64\Kffhakjp.exe
    C:\Windows\system32\Kffhakjp.exe
    3⤵
    PID:8000

C:\Windows\SysWOW64\Kmppneal.exe
C:\Windows\system32\Kmppneal.exe
1⤵
PID:8040
- C:\Windows\SysWOW64\Khfdlnab.exe
  C:\Windows\system32\Khfdlnab.exe
  2⤵
  PID:8080
- - C:\Windows\SysWOW64\Knpmhh32.exe
    C:\Windows\system32\Knpmhh32.exe
    3⤵
    PID:8116
  - - C:\Windows\SysWOW64\Kdmeqo32.exe
      C:\Windows\system32\Kdmeqo32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:8152
    - - C:\Windows\SysWOW64\Kjfmminc.exe
        
        C:\Windows\system32\Kjfmminc.exe
        5⤵
        
        PID:5672
      - C:\Windows\SysWOW64\Kaqejcep.exe
        
        C:\Windows\system32\Kaqejcep.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7212
        
        C:\Windows\SysWOW64\Lhjnfn32.exe
        
        C:\Windows\system32\Lhjnfn32.exe
        7⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7288
        
        C:\Windows\SysWOW64\Lndfchdj.exe
        
        C:\Windows\system32\Lndfchdj.exe
        8⤵
        
        PID:7348

C:\Windows\SysWOW64\Lennpb32.exe
C:\Windows\system32\Lennpb32.exe
1⤵
PID:7408
- C:\Windows\SysWOW64\Logbigbg.exe
  C:\Windows\system32\Logbigbg.exe
  2⤵
  PID:7488
- - C:\Windows\SysWOW64\Lhogamih.exe
    C:\Windows\system32\Lhogamih.exe
    3⤵
    - Modifies registry class
    PID:7548
  - - C:\Windows\SysWOW64\Loiong32.exe
      C:\Windows\system32\Loiong32.exe
      4⤵
      PID:7612
    - - C:\Windows\SysWOW64\Lechkaga.exe
        
        C:\Windows\system32\Lechkaga.exe
        5⤵
        Drops file in System32 directory
        
        PID:7668
      - C:\Windows\SysWOW64\Lfddci32.exe
        
        C:\Windows\system32\Lfddci32.exe
        6⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Lmnlpcel.exe
        
        C:\Windows\system32\Lmnlpcel.exe
        7⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Lhdqml32.exe
        
        C:\Windows\system32\Lhdqml32.exe
        8⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Mdmngm32.exe
        
        C:\Windows\system32\Mdmngm32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7944
        
        C:\Windows\SysWOW64\Mobbdf32.exe
        
        C:\Windows\system32\Mobbdf32.exe
        10⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Nhicoi32.exe
        
        C:\Windows\system32\Nhicoi32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8076
        
        C:\Windows\SysWOW64\Noehac32.exe
        
        C:\Windows\system32\Noehac32.exe
        12⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Ohnljine.exe
        
        C:\Windows\system32\Ohnljine.exe
        13⤵
        Modifies registry class
        
        PID:7192
        
        C:\Windows\SysWOW64\Oogdfc32.exe
        
        C:\Windows\system32\Oogdfc32.exe
        14⤵
        Modifies registry class
        
        PID:7296
        
        C:\Windows\SysWOW64\Oeamcmmo.exe
        
        C:\Windows\system32\Oeamcmmo.exe
        15⤵
        Drops file in System32 directory
        
        PID:7392
        
        C:\Windows\SysWOW64\Okneldkf.exe
        
        C:\Windows\system32\Okneldkf.exe
        16⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Oediim32.exe
        
        C:\Windows\system32\Oediim32.exe
        17⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Ohbfeh32.exe
        
        C:\Windows\system32\Ohbfeh32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7704
        
        C:\Windows\SysWOW64\Oolnabal.exe
        
        C:\Windows\system32\Oolnabal.exe
        19⤵
        Drops file in System32 directory
        
        PID:7776

C:\Windows\SysWOW64\Oggbfdog.exe
C:\Windows\system32\Oggbfdog.exe
1⤵
- Modifies registry class
PID:7920
- C:\Windows\SysWOW64\Oamgcm32.exe
  C:\Windows\system32\Oamgcm32.exe
  2⤵
  PID:7996
- - C:\Windows\SysWOW64\Ogjpld32.exe
    C:\Windows\system32\Ogjpld32.exe
    3⤵
    PID:8136
  - - C:\Windows\SysWOW64\Poagma32.exe
      C:\Windows\system32\Poagma32.exe
      4⤵
      PID:7188
    - - C:\Windows\SysWOW64\Pdnpeh32.exe
        
        C:\Windows\system32\Pdnpeh32.exe
        5⤵
        
        PID:7376

C:\Windows\SysWOW64\Pkhhbbck.exe
C:\Windows\system32\Pkhhbbck.exe
1⤵
PID:7584
- C:\Windows\SysWOW64\Pbapom32.exe
  C:\Windows\system32\Pbapom32.exe
  2⤵
  PID:7804
- - C:\Windows\SysWOW64\Phlikg32.exe
    C:\Windows\system32\Phlikg32.exe
    3⤵
    PID:7992
  - - C:\Windows\SysWOW64\Pnhacn32.exe
      C:\Windows\system32\Pnhacn32.exe
      4⤵
      PID:8124
    - - C:\Windows\SysWOW64\Phneqf32.exe
        
        C:\Windows\system32\Phneqf32.exe
        5⤵
        
        PID:7500
      - C:\Windows\SysWOW64\Pohnnqgo.exe
        
        C:\Windows\system32\Pohnnqgo.exe
        6⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Pfbfjk32.exe
        
        C:\Windows\system32\Pfbfjk32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8056

C:\Windows\SysWOW64\Phpbffnp.exe
C:\Windows\system32\Phpbffnp.exe
1⤵
PID:7472
- C:\Windows\SysWOW64\Pbifol32.exe
  C:\Windows\system32\Pbifol32.exe
  2⤵
  - Drops file in System32 directory
  PID:7868
- - C:\Windows\SysWOW64\Qbkcek32.exe
    C:\Windows\system32\Qbkcek32.exe
    3⤵
    PID:2876
  - - C:\Windows\SysWOW64\Qhekaejj.exe
      C:\Windows\system32\Qhekaejj.exe
      4⤵
      Drops file in System32 directory
      Modifies registry class
      PID:8160
    - - C:\Windows\SysWOW64\Qoocnpag.exe
        
        C:\Windows\system32\Qoocnpag.exe
        5⤵
        
        PID:7788
      - C:\Windows\SysWOW64\Qdllffpo.exe
        
        C:\Windows\system32\Qdllffpo.exe
        6⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Akfdcq32.exe
        
        C:\Windows\system32\Akfdcq32.exe
        7⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Abpmpkoh.exe
        
        C:\Windows\system32\Abpmpkoh.exe
        8⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\Agmehamp.exe
        
        C:\Windows\system32\Agmehamp.exe
        9⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Anfmeldl.exe
        
        C:\Windows\system32\Anfmeldl.exe
        10⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Adqeaf32.exe
        
        C:\Windows\system32\Adqeaf32.exe
        11⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Aofjoo32.exe
        
        C:\Windows\system32\Aofjoo32.exe
        12⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Aecbge32.exe
        
        C:\Windows\system32\Aecbge32.exe
        13⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Akmjdpac.exe
        
        C:\Windows\system32\Akmjdpac.exe
        14⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Abgcqjhp.exe
        
        C:\Windows\system32\Abgcqjhp.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8444
        
        C:\Windows\SysWOW64\Aiqkmd32.exe
        
        C:\Windows\system32\Aiqkmd32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8484
        
        C:\Windows\SysWOW64\Aokcjngj.exe
        
        C:\Windows\system32\Aokcjngj.exe
        17⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Afdkfh32.exe
        
        C:\Windows\system32\Afdkfh32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8556
        
        C:\Windows\SysWOW64\Bgfhnpde.exe
        
        C:\Windows\system32\Bgfhnpde.exe
        19⤵
        Drops file in System32 directory
        
        PID:8592
        
        C:\Windows\SysWOW64\Bnppkj32.exe
        
        C:\Windows\system32\Bnppkj32.exe
        20⤵
        Drops file in System32 directory
        
        PID:8632
  - - C:\Windows\SysWOW64\Paqebike.exe
      C:\Windows\system32\Paqebike.exe
      4⤵
      PID:6504
    - - C:\Windows\SysWOW64\Peajngoi.exe
        
        C:\Windows\system32\Peajngoi.exe
        5⤵
        
        PID:9068
      - C:\Windows\SysWOW64\Abnnnjfh.exe
        
        C:\Windows\system32\Abnnnjfh.exe
        6⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Abqjci32.exe
        
        C:\Windows\system32\Abqjci32.exe
        7⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Ahnclp32.exe
        
        C:\Windows\system32\Ahnclp32.exe
        8⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Befmpdmq.exe
        
        C:\Windows\system32\Befmpdmq.exe
        9⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Blenhmph.exe
        
        C:\Windows\system32\Blenhmph.exe
        10⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Cojqdhid.exe
        
        C:\Windows\system32\Cojqdhid.exe
        11⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Cediab32.exe
        
        C:\Windows\system32\Cediab32.exe
        12⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Cpjmok32.exe
        
        C:\Windows\system32\Cpjmok32.exe
        13⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Cibagpgg.exe
        
        C:\Windows\system32\Cibagpgg.exe
        14⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Coojpg32.exe
        
        C:\Windows\system32\Coojpg32.exe
        15⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Dlckik32.exe
        
        C:\Windows\system32\Dlckik32.exe
        16⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Dapcab32.exe
        
        C:\Windows\system32\Dapcab32.exe
        17⤵
        
        PID:520
        
        C:\Windows\SysWOW64\Docckfai.exe
        
        C:\Windows\system32\Docckfai.exe
        18⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Denlgq32.exe
        
        C:\Windows\system32\Denlgq32.exe
        19⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Dlgddkpc.exe
        
        C:\Windows\system32\Dlgddkpc.exe
        20⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Djkdnool.exe
        
        C:\Windows\system32\Djkdnool.exe
        21⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Dllmoj32.exe
        
        C:\Windows\system32\Dllmoj32.exe
        22⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\Ecfeldcj.exe
        
        C:\Windows\system32\Ecfeldcj.exe
        23⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\Elojej32.exe
        
        C:\Windows\system32\Elojej32.exe
        24⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Ebkbmqhb.exe
        
        C:\Windows\system32\Ebkbmqhb.exe
        25⤵
        
        PID:492

C:\Windows\SysWOW64\Bejhhd32.exe
C:\Windows\system32\Bejhhd32.exe
1⤵
PID:8668
- C:\Windows\SysWOW64\Bkdqdokk.exe
  C:\Windows\system32\Bkdqdokk.exe
  2⤵
  - Drops file in System32 directory
  PID:8708
- - C:\Windows\SysWOW64\Bbniai32.exe
    C:\Windows\system32\Bbniai32.exe
    3⤵
    PID:8744
  - - C:\Windows\SysWOW64\Bihancje.exe
      C:\Windows\system32\Bihancje.exe
      4⤵
      Drops file in System32 directory
      PID:8780
    - - C:\Windows\SysWOW64\Bpaikm32.exe
        
        C:\Windows\system32\Bpaikm32.exe
        5⤵
        
        PID:8820
      - C:\Windows\SysWOW64\Beobcdoi.exe
        
        C:\Windows\system32\Beobcdoi.exe
        6⤵
        Drops file in System32 directory
        
        PID:8860
        
        C:\Windows\SysWOW64\Bpdfpmoo.exe
        
        C:\Windows\system32\Bpdfpmoo.exe
        7⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Bfnnmg32.exe
        
        C:\Windows\system32\Bfnnmg32.exe
        8⤵
        Drops file in System32 directory
        
        PID:8944
        
        C:\Windows\SysWOW64\Bpfcelml.exe
        
        C:\Windows\system32\Bpfcelml.exe
        9⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Becknc32.exe
        
        C:\Windows\system32\Becknc32.exe
        10⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Clmckmcq.exe
        
        C:\Windows\system32\Clmckmcq.exe
        11⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Cbglgg32.exe
        
        C:\Windows\system32\Cbglgg32.exe
        12⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Ciaddaaj.exe
        
        C:\Windows\system32\Ciaddaaj.exe
        13⤵
        
        PID:9136

C:\Windows\SysWOW64\Cnnllhpa.exe
C:\Windows\system32\Cnnllhpa.exe
1⤵
PID:9184
- C:\Windows\SysWOW64\Cehdib32.exe
  C:\Windows\system32\Cehdib32.exe
  2⤵
  PID:5664
- - C:\Windows\SysWOW64\Clbmfm32.exe
    C:\Windows\system32\Clbmfm32.exe
    3⤵
    PID:4508

C:\Windows\SysWOW64\Cejaobel.exe
C:\Windows\system32\Cejaobel.exe
1⤵
PID:8316
- C:\Windows\SysWOW64\Clffalkf.exe
  C:\Windows\system32\Clffalkf.exe
  2⤵
  PID:8388
- - C:\Windows\SysWOW64\Cbqonf32.exe
    C:\Windows\system32\Cbqonf32.exe
    3⤵
    PID:8492
  - - C:\Windows\SysWOW64\Dijgjpip.exe
      C:\Windows\system32\Dijgjpip.exe
      4⤵
      PID:8580
    - - C:\Windows\SysWOW64\Dpdogj32.exe
        
        C:\Windows\system32\Dpdogj32.exe
        5⤵
        
        PID:8640
      - C:\Windows\SysWOW64\Deagoa32.exe
        
        C:\Windows\system32\Deagoa32.exe
        6⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Dlkplk32.exe
        
        C:\Windows\system32\Dlkplk32.exe
        7⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Dfqdid32.exe
        
        C:\Windows\system32\Dfqdid32.exe
        8⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Dhbqalle.exe
        
        C:\Windows\system32\Dhbqalle.exe
        9⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Dbgdnelk.exe
        
        C:\Windows\system32\Dbgdnelk.exe
        10⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Dhdmfljb.exe
        
        C:\Windows\system32\Dhdmfljb.exe
        11⤵
        
        PID:9056

C:\Windows\SysWOW64\Dbjade32.exe
C:\Windows\system32\Dbjade32.exe
1⤵
PID:9132
- C:\Windows\SysWOW64\Didjqoae.exe
  C:\Windows\system32\Didjqoae.exe
  2⤵
  PID:9212
- - C:\Windows\SysWOW64\Doqbifpl.exe
    C:\Windows\system32\Doqbifpl.exe
    3⤵
    PID:8252
  - - C:\Windows\SysWOW64\Eifffoob.exe
      C:\Windows\system32\Eifffoob.exe
      4⤵
      PID:8300
    - - C:\Windows\SysWOW64\Eldbbjof.exe
        
        C:\Windows\system32\Eldbbjof.exe
        5⤵
        
        PID:4440

C:\Windows\SysWOW64\Ebokodfc.exe
C:\Windows\system32\Ebokodfc.exe
1⤵
PID:8428
- C:\Windows\SysWOW64\Elgohj32.exe
  C:\Windows\system32\Elgohj32.exe
  2⤵
  PID:8540
- - C:\Windows\SysWOW64\Ebagdddp.exe
    C:\Windows\system32\Ebagdddp.exe
    3⤵
    PID:8684
  - - C:\Windows\SysWOW64\Eikpan32.exe
      C:\Windows\system32\Eikpan32.exe
      4⤵
      PID:8788
    - - C:\Windows\SysWOW64\Epehnhbj.exe
        
        C:\Windows\system32\Epehnhbj.exe
        5⤵
        
        PID:2076
      - C:\Windows\SysWOW64\Eeaqfo32.exe
        
        C:\Windows\system32\Eeaqfo32.exe
        6⤵
        
        PID:8968

C:\Windows\SysWOW64\Ellicihn.exe
C:\Windows\system32\Ellicihn.exe
1⤵
PID:9040
- C:\Windows\SysWOW64\Efampahd.exe
  C:\Windows\system32\Efampahd.exe
  2⤵
  PID:9120
- - C:\Windows\SysWOW64\Elnehifk.exe
    C:\Windows\system32\Elnehifk.exe
    3⤵
    PID:9208
  - - C:\Windows\SysWOW64\Fbhnec32.exe
      C:\Windows\system32\Fbhnec32.exe
      4⤵
      PID:684

C:\Windows\SysWOW64\Fefjanml.exe
C:\Windows\system32\Fefjanml.exe
1⤵
PID:8360
- C:\Windows\SysWOW64\Foonjd32.exe
  C:\Windows\system32\Foonjd32.exe
  2⤵
  PID:4960
- - C:\Windows\SysWOW64\Fidbgm32.exe
    C:\Windows\system32\Fidbgm32.exe
    3⤵
    PID:8656
  - - C:\Windows\SysWOW64\Fpnkdfko.exe
      C:\Windows\system32\Fpnkdfko.exe
      4⤵
      PID:8840
    - - C:\Windows\SysWOW64\Fghcqq32.exe
        
        C:\Windows\system32\Fghcqq32.exe
        5⤵
        
        PID:3420
      - C:\Windows\SysWOW64\Flekihpc.exe
        
        C:\Windows\system32\Flekihpc.exe
        6⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Fgjpfqpi.exe
        
        C:\Windows\system32\Fgjpfqpi.exe
        7⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Fhllni32.exe
        
        C:\Windows\system32\Fhllni32.exe
        8⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\Fofdkcmd.exe
        
        C:\Windows\system32\Fofdkcmd.exe
        9⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Fepmgm32.exe
        
        C:\Windows\system32\Fepmgm32.exe
        10⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\Fljedg32.exe
        
        C:\Windows\system32\Fljedg32.exe
        11⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Gccmaack.exe
        
        C:\Windows\system32\Gccmaack.exe
        12⤵
        
        PID:1268

C:\Windows\SysWOW64\Ggfobofl.exe
C:\Windows\system32\Ggfobofl.exe
1⤵
PID:8256
- C:\Windows\SysWOW64\Ghgljg32.exe
  C:\Windows\system32\Ghgljg32.exe
  2⤵
  PID:3056
- - C:\Windows\SysWOW64\Goadfa32.exe
    C:\Windows\system32\Goadfa32.exe
    3⤵
    PID:9052

C:\Windows\SysWOW64\Geklckkd.exe
C:\Windows\system32\Geklckkd.exe
1⤵
PID:8468
- C:\Windows\SysWOW64\Hpaqqdjj.exe
  C:\Windows\system32\Hpaqqdjj.exe
  2⤵
  PID:5076
- - C:\Windows\SysWOW64\Hgkimn32.exe
    C:\Windows\system32\Hgkimn32.exe
    3⤵
    PID:8548
  - - C:\Windows\SysWOW64\Hpcmfchg.exe
      C:\Windows\system32\Hpcmfchg.exe
      4⤵
      PID:1488
    - - C:\Windows\SysWOW64\Hfpenj32.exe
        
        C:\Windows\system32\Hfpenj32.exe
        5⤵
        
        PID:1520
      - C:\Windows\SysWOW64\Hhobjf32.exe
        
        C:\Windows\system32\Hhobjf32.exe
        6⤵
        
        PID:3800

C:\Windows\SysWOW64\Iqaiga32.exe
C:\Windows\system32\Iqaiga32.exe
1⤵
PID:9584
- C:\Windows\SysWOW64\Ihmnldib.exe
  C:\Windows\system32\Ihmnldib.exe
  2⤵
  PID:9632
- - C:\Windows\SysWOW64\Ignnjk32.exe
    C:\Windows\system32\Ignnjk32.exe
    3⤵
    PID:9684
  - - C:\Windows\SysWOW64\Iqfcbahb.exe
      C:\Windows\system32\Iqfcbahb.exe
      4⤵
      PID:9724
    - - C:\Windows\SysWOW64\Iiaggc32.exe
        
        C:\Windows\system32\Iiaggc32.exe
        5⤵
        
        PID:9768
      - C:\Windows\SysWOW64\Jcgldl32.exe
        
        C:\Windows\system32\Jcgldl32.exe
        6⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Jqklnp32.exe
        
        C:\Windows\system32\Jqklnp32.exe
        7⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Jgedjjki.exe
        
        C:\Windows\system32\Jgedjjki.exe
        8⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Jifabb32.exe
        
        C:\Windows\system32\Jifabb32.exe
        9⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Jopiom32.exe
        
        C:\Windows\system32\Jopiom32.exe
        10⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Jjemle32.exe
        
        C:\Windows\system32\Jjemle32.exe
        11⤵
        
        PID:10016

C:\Windows\SysWOW64\Jobfdl32.exe
C:\Windows\system32\Jobfdl32.exe
1⤵
PID:10056
- C:\Windows\SysWOW64\Jjhjae32.exe
  C:\Windows\system32\Jjhjae32.exe
  2⤵
  PID:10104

C:\Windows\SysWOW64\Jglkkiea.exe
C:\Windows\system32\Jglkkiea.exe
1⤵
PID:10152
- C:\Windows\SysWOW64\Kfaglf32.exe
  C:\Windows\system32\Kfaglf32.exe
  2⤵
  PID:10204
- - C:\Windows\SysWOW64\Kiaqnagj.exe
    C:\Windows\system32\Kiaqnagj.exe
    3⤵
    PID:4196
  - - C:\Windows\SysWOW64\Kplijk32.exe
      C:\Windows\system32\Kplijk32.exe
      4⤵
      PID:9272

C:\Windows\SysWOW64\Kfeagefd.exe
C:\Windows\system32\Kfeagefd.exe
1⤵
PID:9336
- C:\Windows\SysWOW64\Kpnepk32.exe
  C:\Windows\system32\Kpnepk32.exe
  2⤵
  PID:9400
- - C:\Windows\SysWOW64\Lapopm32.exe
    C:\Windows\system32\Lapopm32.exe
    3⤵
    PID:9432
  - - C:\Windows\SysWOW64\Lgjglg32.exe
      C:\Windows\system32\Lgjglg32.exe
      4⤵
      PID:9484
    - - C:\Windows\SysWOW64\Lglcag32.exe
        
        C:\Windows\system32\Lglcag32.exe
        5⤵
        
        PID:9592
      - C:\Windows\SysWOW64\Limpiomm.exe
        
        C:\Windows\system32\Limpiomm.exe
        6⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Lpghfi32.exe
        
        C:\Windows\system32\Lpghfi32.exe
        7⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Lfaqcclf.exe
        
        C:\Windows\system32\Lfaqcclf.exe
        8⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Lfcmhc32.exe
        
        C:\Windows\system32\Lfcmhc32.exe
        9⤵
        
        PID:9808

C:\Windows\SysWOW64\Mffjnc32.exe
C:\Windows\system32\Mffjnc32.exe
1⤵
PID:9972
- C:\Windows\SysWOW64\Malnklgg.exe
  C:\Windows\system32\Malnklgg.exe
  2⤵
  PID:4072
- - C:\Windows\SysWOW64\Mfhgcbfo.exe
    C:\Windows\system32\Mfhgcbfo.exe
    3⤵
    PID:10124

C:\Windows\SysWOW64\Mmbopm32.exe
C:\Windows\system32\Mmbopm32.exe
1⤵
PID:10144
- C:\Windows\SysWOW64\Mdlgmgdh.exe
  C:\Windows\system32\Mdlgmgdh.exe
  2⤵
  PID:1956
- - C:\Windows\SysWOW64\Mmdlflki.exe
    C:\Windows\system32\Mmdlflki.exe
    3⤵
    PID:768
  - - C:\Windows\SysWOW64\Mfmpob32.exe
      C:\Windows\system32\Mfmpob32.exe
      4⤵
      PID:9276
    - - C:\Windows\SysWOW64\Mmghklif.exe
        
        C:\Windows\system32\Mmghklif.exe
        5⤵
        
        PID:9320
      - C:\Windows\SysWOW64\Mhmmieil.exe
        
        C:\Windows\system32\Mhmmieil.exe
        6⤵
        
        PID:9372

C:\Windows\SysWOW64\Laiafl32.exe
C:\Windows\system32\Laiafl32.exe
1⤵
PID:9892

C:\Windows\SysWOW64\Minipm32.exe
C:\Windows\system32\Minipm32.exe
1⤵
PID:1536
- C:\Windows\SysWOW64\Mdcmnfop.exe
  C:\Windows\system32\Mdcmnfop.exe
  2⤵
  PID:4516
- - C:\Windows\SysWOW64\Njmejp32.exe
    C:\Windows\system32\Njmejp32.exe
    3⤵
    PID:9492
  - - C:\Windows\SysWOW64\Nagngjmj.exe
      C:\Windows\system32\Nagngjmj.exe
      4⤵
      PID:9560

C:\Windows\SysWOW64\Nfdfoala.exe
C:\Windows\system32\Nfdfoala.exe
1⤵
PID:3532
- C:\Windows\SysWOW64\Nplkhf32.exe
  C:\Windows\system32\Nplkhf32.exe
  2⤵
  PID:9716
- - C:\Windows\SysWOW64\Nffceq32.exe
    C:\Windows\system32\Nffceq32.exe
    3⤵
    PID:4468
  - - C:\Windows\SysWOW64\Nmpkakak.exe
      C:\Windows\system32\Nmpkakak.exe
      4⤵
      PID:9872
    - - C:\Windows\SysWOW64\Nhfoocaa.exe
        
        C:\Windows\system32\Nhfoocaa.exe
        5⤵
        
        PID:9928
      - C:\Windows\SysWOW64\Niglfl32.exe
        
        C:\Windows\system32\Niglfl32.exe
        6⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Ndmpddfe.exe
        
        C:\Windows\system32\Ndmpddfe.exe
        7⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\Niihlkdm.exe
        
        C:\Windows\system32\Niihlkdm.exe
        8⤵
        
        PID:3900

C:\Windows\SysWOW64\Phpklp32.exe
C:\Windows\system32\Phpklp32.exe
1⤵
PID:10088
- C:\Windows\SysWOW64\Qgehml32.exe
  C:\Windows\system32\Qgehml32.exe
  2⤵
  PID:9312
- - C:\Windows\SysWOW64\Qkcackeb.exe
    C:\Windows\system32\Qkcackeb.exe
    3⤵
    PID:9468
  - - C:\Windows\SysWOW64\Aamipe32.exe
      C:\Windows\system32\Aamipe32.exe
      4⤵
      PID:4900
    - - C:\Windows\SysWOW64\Agiahlkf.exe
        
        C:\Windows\system32\Agiahlkf.exe
        5⤵
        
        PID:9780

C:\Windows\SysWOW64\Aglnnkid.exe
C:\Windows\system32\Aglnnkid.exe
1⤵
PID:10180
- C:\Windows\SysWOW64\Aqdbfa32.exe
  C:\Windows\system32\Aqdbfa32.exe
  2⤵
  PID:9300
- - C:\Windows\SysWOW64\Agnkck32.exe
    C:\Windows\system32\Agnkck32.exe
    3⤵
    PID:9520
  - - C:\Windows\SysWOW64\Abdoqd32.exe
      C:\Windows\system32\Abdoqd32.exe
      4⤵
      PID:4424

C:\Windows\SysWOW64\Bbpolb32.exe
C:\Windows\system32\Bbpolb32.exe
1⤵
PID:4532
- C:\Windows\SysWOW64\Bkhceh32.exe
  C:\Windows\system32\Bkhceh32.exe
  2⤵
  PID:2456
- - C:\Windows\SysWOW64\Bbbkbbkg.exe
    C:\Windows\system32\Bbbkbbkg.exe
    3⤵
    PID:9624
  - - C:\Windows\SysWOW64\Bilcol32.exe
      C:\Windows\system32\Bilcol32.exe
      4⤵
      PID:9376
    - - C:\Windows\SysWOW64\Cnhlgc32.exe
        
        C:\Windows\system32\Cnhlgc32.exe
        5⤵
        Executes dropped EXE
        
        PID:1884
      - C:\Windows\SysWOW64\Cjomldfp.exe
        
        C:\Windows\system32\Cjomldfp.exe
        6⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Cqiehnml.exe
        
        C:\Windows\system32\Cqiehnml.exe
        7⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Cnmebblf.exe
        
        C:\Windows\system32\Cnmebblf.exe
        8⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Cicjokll.exe
        
        C:\Windows\system32\Cicjokll.exe
        9⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Cnpbgajc.exe
        
        C:\Windows\system32\Cnpbgajc.exe
        10⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Cghgpgqd.exe
        
        C:\Windows\system32\Cghgpgqd.exe
        11⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Cnboma32.exe
        
        C:\Windows\system32\Cnboma32.exe
        12⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Cigcjj32.exe
        
        C:\Windows\system32\Cigcjj32.exe
        13⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Dndlba32.exe
        
        C:\Windows\system32\Dndlba32.exe
        14⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Dendok32.exe
        
        C:\Windows\system32\Dendok32.exe
        15⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Djklgb32.exe
        
        C:\Windows\system32\Djklgb32.exe
        16⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Deqqek32.exe
        
        C:\Windows\system32\Deqqek32.exe
        17⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Dlkiaece.exe
        
        C:\Windows\system32\Dlkiaece.exe
        18⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Dbdano32.exe
        
        C:\Windows\system32\Dbdano32.exe
        19⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Dioiki32.exe
        
        C:\Windows\system32\Dioiki32.exe
        20⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Qcppogqo.exe
        
        C:\Windows\system32\Qcppogqo.exe
        14⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Qcbmegol.exe
        
        C:\Windows\system32\Qcbmegol.exe
        15⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Qmkanmel.exe
        
        C:\Windows\system32\Qmkanmel.exe
        16⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Ammnclcj.exe
        
        C:\Windows\system32\Ammnclcj.exe
        17⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Anmjmojl.exe
        
        C:\Windows\system32\Anmjmojl.exe
        18⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\Ambgnl32.exe
        
        C:\Windows\system32\Ambgnl32.exe
        19⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\Afjlgafe.exe
        
        C:\Windows\system32\Afjlgafe.exe
        20⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\Ajhdmplk.exe
        
        C:\Windows\system32\Ajhdmplk.exe
        21⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Benijhla.exe
        
        C:\Windows\system32\Benijhla.exe
        22⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Badipiae.exe
        
        C:\Windows\system32\Badipiae.exe
        23⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Bgoalc32.exe
        
        C:\Windows\system32\Bgoalc32.exe
        24⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Bmkjdj32.exe
        
        C:\Windows\system32\Bmkjdj32.exe
        25⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Baickimp.exe
        
        C:\Windows\system32\Baickimp.exe
        26⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Bchogd32.exe
        
        C:\Windows\system32\Bchogd32.exe
        27⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Bjagcndq.exe
        
        C:\Windows\system32\Bjagcndq.exe
        28⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\Cclhbcho.exe
        
        C:\Windows\system32\Cclhbcho.exe
        29⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Chjaha32.exe
        
        C:\Windows\system32\Chjaha32.exe
        30⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Cndidlfb.exe
        
        C:\Windows\system32\Cndidlfb.exe
        31⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Cdabmcdi.exe
        
        C:\Windows\system32\Cdabmcdi.exe
        32⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\Cjkjjmlf.exe
        
        C:\Windows\system32\Cjkjjmlf.exe
        33⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Ceqngekl.exe
        
        C:\Windows\system32\Ceqngekl.exe
        34⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Cjmgomjc.exe
        
        C:\Windows\system32\Cjmgomjc.exe
        35⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Chagiqhm.exe
        
        C:\Windows\system32\Chagiqhm.exe
        36⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Dajlafon.exe
        
        C:\Windows\system32\Dajlafon.exe
        37⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Dhcdnq32.exe
        
        C:\Windows\system32\Dhcdnq32.exe
        38⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Dhfacp32.exe
        
        C:\Windows\system32\Dhfacp32.exe
        39⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Ddmaia32.exe
        
        C:\Windows\system32\Ddmaia32.exe
        40⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Dobffj32.exe
        
        C:\Windows\system32\Dobffj32.exe
        41⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Delnbdao.exe
        
        C:\Windows\system32\Delnbdao.exe
        42⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Dodbkiho.exe
        
        C:\Windows\system32\Dodbkiho.exe
        43⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Eeagnc32.exe
        
        C:\Windows\system32\Eeagnc32.exe
        44⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Eknpfj32.exe
        
        C:\Windows\system32\Eknpfj32.exe
        45⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6184
        
        C:\Windows\SysWOW64\Ekpmljin.exe
        
        C:\Windows\system32\Ekpmljin.exe
        46⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\Eeeaibid.exe
        
        C:\Windows\system32\Eeeaibid.exe
        47⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\Eggmqk32.exe
        
        C:\Windows\system32\Eggmqk32.exe
        48⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Edknjonl.exe
        
        C:\Windows\system32\Edknjonl.exe
        49⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Eopbghnb.exe
        
        C:\Windows\system32\Eopbghnb.exe
        50⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Eejjdb32.exe
        
        C:\Windows\system32\Eejjdb32.exe
        51⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\Egkgljkm.exe
        
        C:\Windows\system32\Egkgljkm.exe
        52⤵
        Modifies registry class
        
        PID:6916
        
        C:\Windows\SysWOW64\Faakickc.exe
        
        C:\Windows\system32\Faakickc.exe
        53⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Fgncaj32.exe
        
        C:\Windows\system32\Fgncaj32.exe
        54⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\Fnhlndqg.exe
        
        C:\Windows\system32\Fnhlndqg.exe
        55⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Fhmpkmpm.exe
        
        C:\Windows\system32\Fhmpkmpm.exe
        56⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Fnjhccnd.exe
        
        C:\Windows\system32\Fnjhccnd.exe
        57⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Fhpmql32.exe
        
        C:\Windows\system32\Fhpmql32.exe
        58⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Fhbifl32.exe
        
        C:\Windows\system32\Fhbifl32.exe
        59⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\Fnoboc32.exe
        
        C:\Windows\system32\Fnoboc32.exe
        60⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Fdijkmbl.exe
        
        C:\Windows\system32\Fdijkmbl.exe
        61⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Gkcbhgii.exe
        
        C:\Windows\system32\Gkcbhgii.exe
        62⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Gamjea32.exe
        
        C:\Windows\system32\Gamjea32.exe
        63⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\Ghgbakhb.exe
        
        C:\Windows\system32\Ghgbakhb.exe
        64⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\Goqkne32.exe
        
        C:\Windows\system32\Goqkne32.exe
        65⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Gochceml.exe
        
        C:\Windows\system32\Gochceml.exe
        66⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Gdppllld.exe
        
        C:\Windows\system32\Gdppllld.exe
        67⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Gkjhif32.exe
        
        C:\Windows\system32\Gkjhif32.exe
        68⤵
        
        PID:544
        
        C:\Windows\SysWOW64\Gadqepkn.exe
        
        C:\Windows\system32\Gadqepkn.exe
        69⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\Gklenf32.exe
        
        C:\Windows\system32\Gklenf32.exe
        70⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Gafmkp32.exe
        
        C:\Windows\system32\Gafmkp32.exe
        71⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Hgcfcg32.exe
        
        C:\Windows\system32\Hgcfcg32.exe
        72⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Hnmnpano.exe
        
        C:\Windows\system32\Hnmnpano.exe
        73⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Hhbbmjne.exe
        
        C:\Windows\system32\Hhbbmjne.exe
        74⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Hdicbkci.exe
        
        C:\Windows\system32\Hdicbkci.exe
        75⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Hoogpcco.exe
        
        C:\Windows\system32\Hoogpcco.exe
        76⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Hfioln32.exe
        
        C:\Windows\system32\Hfioln32.exe
        77⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Hnddqp32.exe
        
        C:\Windows\system32\Hnddqp32.exe
        78⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Hdnlmj32.exe
        
        C:\Windows\system32\Hdnlmj32.exe
        79⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Hocqkc32.exe
        
        C:\Windows\system32\Hocqkc32.exe
        80⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Hdpicj32.exe
        
        C:\Windows\system32\Hdpicj32.exe
        81⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Iofmpb32.exe
        
        C:\Windows\system32\Iofmpb32.exe
        82⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Ifpemmdd.exe
        
        C:\Windows\system32\Ifpemmdd.exe
        83⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Ikmnec32.exe
        
        C:\Windows\system32\Ikmnec32.exe
        84⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Ikagpcof.exe
        
        C:\Windows\system32\Ikagpcof.exe
        85⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Ifglmlol.exe
        
        C:\Windows\system32\Ifglmlol.exe
        86⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Ikcdfbmc.exe
        
        C:\Windows\system32\Ikcdfbmc.exe
        87⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Jelioh32.exe
        
        C:\Windows\system32\Jelioh32.exe
        88⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Jndmgn32.exe
        
        C:\Windows\system32\Jndmgn32.exe
        89⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Jgmapcqe.exe
        
        C:\Windows\system32\Jgmapcqe.exe
        90⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Jbbfnlpk.exe
        
        C:\Windows\system32\Jbbfnlpk.exe
        91⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Jilnjf32.exe
        
        C:\Windows\system32\Jilnjf32.exe
        92⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\Jpffgp32.exe
        
        C:\Windows\system32\Jpffgp32.exe
        93⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Jfpocjfa.exe
        
        C:\Windows\system32\Jfpocjfa.exe
        94⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Jphcmp32.exe
        
        C:\Windows\system32\Jphcmp32.exe
        95⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Jfbkijdo.exe
        
        C:\Windows\system32\Jfbkijdo.exe
        96⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Jnnpnl32.exe
        
        C:\Windows\system32\Jnnpnl32.exe
        97⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Kehhjfif.exe
        
        C:\Windows\system32\Kehhjfif.exe
        98⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Klapgq32.exe
        
        C:\Windows\system32\Klapgq32.exe
        99⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Kblidkhp.exe
        
        C:\Windows\system32\Kblidkhp.exe
        100⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Kfiajinf.exe
        
        C:\Windows\system32\Kfiajinf.exe
        101⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Kpbfbo32.exe
        
        C:\Windows\system32\Kpbfbo32.exe
        102⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Kflnpild.exe
        
        C:\Windows\system32\Kflnpild.exe
        103⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Klifhpjk.exe
        
        C:\Windows\system32\Klifhpjk.exe
        104⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Keakqeal.exe
        
        C:\Windows\system32\Keakqeal.exe
        105⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Kpfonnab.exe
        
        C:\Windows\system32\Kpfonnab.exe
        106⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Lbekjipe.exe
        
        C:\Windows\system32\Lbekjipe.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6956
        
        C:\Windows\SysWOW64\Llmpco32.exe
        
        C:\Windows\system32\Llmpco32.exe
        108⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Lbghpinc.exe
        
        C:\Windows\system32\Lbghpinc.exe
        109⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Lhdqhp32.exe
        
        C:\Windows\system32\Lhdqhp32.exe
        110⤵
        Modifies registry class
        
        PID:7612
        
        C:\Windows\SysWOW64\Lnnidjcg.exe
        
        C:\Windows\system32\Lnnidjcg.exe
        111⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\Licmbccm.exe
        
        C:\Windows\system32\Licmbccm.exe
        112⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Lhijcohe.exe
        
        C:\Windows\system32\Lhijcohe.exe
        113⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Locbpi32.exe
        
        C:\Windows\system32\Locbpi32.exe
        114⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Lemjlcgo.exe
        
        C:\Windows\system32\Lemjlcgo.exe
        115⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Mbqkfhfh.exe
        
        C:\Windows\system32\Mbqkfhfh.exe
        116⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Mhncnodp.exe
        
        C:\Windows\system32\Mhncnodp.exe
        117⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Moglkikl.exe
        
        C:\Windows\system32\Moglkikl.exe
        118⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Mbedag32.exe
        
        C:\Windows\system32\Mbedag32.exe
        119⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Mbhafgpp.exe
        
        C:\Windows\system32\Mbhafgpp.exe
        120⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Mfejme32.exe
        
        C:\Windows\system32\Mfejme32.exe
        121⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Mlbbel32.exe
        
        C:\Windows\system32\Mlbbel32.exe
        122⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Nppkkj32.exe
        
        C:\Windows\system32\Nppkkj32.exe
        123⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Nhnlelfm.exe
        
        C:\Windows\system32\Nhnlelfm.exe
        124⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Nebmnqdf.exe
        
        C:\Windows\system32\Nebmnqdf.exe
        125⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Ncfmhecp.exe
        
        C:\Windows\system32\Ncfmhecp.exe
        126⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Nhbfpl32.exe
        
        C:\Windows\system32\Nhbfpl32.exe
        127⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Ogcfncjf.exe
        
        C:\Windows\system32\Ogcfncjf.exe
        128⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Oookbega.exe
        
        C:\Windows\system32\Oookbega.exe
        129⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Oeicopoo.exe
        
        C:\Windows\system32\Oeicopoo.exe
        130⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Opnglhnd.exe
        
        C:\Windows\system32\Opnglhnd.exe
        131⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Oghpib32.exe
        
        C:\Windows\system32\Oghpib32.exe
        132⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Olehai32.exe
        
        C:\Windows\system32\Olehai32.exe
        133⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Oiihkncb.exe
        
        C:\Windows\system32\Oiihkncb.exe
        134⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Oofacdaj.exe
        
        C:\Windows\system32\Oofacdaj.exe
        135⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Ojkepmqp.exe
        
        C:\Windows\system32\Ojkepmqp.exe
        136⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\Pohnhdog.exe
        
        C:\Windows\system32\Pohnhdog.exe
        137⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\Pebfen32.exe
        
        C:\Windows\system32\Pebfen32.exe
        138⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Pokjnd32.exe
        
        C:\Windows\system32\Pokjnd32.exe
        139⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Pfdbknda.exe
        
        C:\Windows\system32\Pfdbknda.exe
        140⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\Ppjghgdg.exe
        
        C:\Windows\system32\Ppjghgdg.exe
        141⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Phekliab.exe
        
        C:\Windows\system32\Phekliab.exe
        142⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Pfilfm32.exe
        
        C:\Windows\system32\Pfilfm32.exe
        143⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Plcdbghi.exe
        
        C:\Windows\system32\Plcdbghi.exe
        144⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Pflikm32.exe
        
        C:\Windows\system32\Pflikm32.exe
        145⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Qleahgff.exe
        
        C:\Windows\system32\Qleahgff.exe
        146⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Qgkeep32.exe
        
        C:\Windows\system32\Qgkeep32.exe
        147⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Acdbpq32.exe
        
        C:\Windows\system32\Acdbpq32.exe
        148⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Ajnkmjqj.exe
        
        C:\Windows\system32\Ajnkmjqj.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8744
        
        C:\Windows\SysWOW64\Aqhcid32.exe
        
        C:\Windows\system32\Aqhcid32.exe
        150⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\Aqjpod32.exe
        
        C:\Windows\system32\Aqjpod32.exe
        151⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Afghgkdl.exe
        
        C:\Windows\system32\Afghgkdl.exe
        152⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Aqmldddb.exe
        
        C:\Windows\system32\Aqmldddb.exe
        153⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Ajeami32.exe
        
        C:\Windows\system32\Ajeami32.exe
        154⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Acnefoac.exe
        
        C:\Windows\system32\Acnefoac.exe
        155⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Bmfjodgc.exe
        
        C:\Windows\system32\Bmfjodgc.exe
        156⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Bgknlmgi.exe
        
        C:\Windows\system32\Bgknlmgi.exe
        157⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Bmhfddeq.exe
        
        C:\Windows\system32\Bmhfddeq.exe
        158⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Bgnkamef.exe
        
        C:\Windows\system32\Bgnkamef.exe
        159⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Bmmppc32.exe
        
        C:\Windows\system32\Bmmppc32.exe
        160⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\Bjaqih32.exe
        
        C:\Windows\system32\Bjaqih32.exe
        161⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Bpniaool.exe
        
        C:\Windows\system32\Bpniaool.exe
        162⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\Cifmjd32.exe
        
        C:\Windows\system32\Cifmjd32.exe
        163⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Cppfgnlj.exe
        
        C:\Windows\system32\Cppfgnlj.exe
        164⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\Cpbbln32.exe
        
        C:\Windows\system32\Cpbbln32.exe
        165⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Cabofaaj.exe
        
        C:\Windows\system32\Cabofaaj.exe
        166⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Cmipkb32.exe
        
        C:\Windows\system32\Cmipkb32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7036
        
        C:\Windows\SysWOW64\Cfaddg32.exe
        
        C:\Windows\system32\Cfaddg32.exe
        168⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Cafhap32.exe
        
        C:\Windows\system32\Cafhap32.exe
        169⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Dgqqnjea.exe
        
        C:\Windows\system32\Dgqqnjea.exe
        170⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Dmmifaci.exe
        
        C:\Windows\system32\Dmmifaci.exe
        171⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Didjkbim.exe
        
        C:\Windows\system32\Didjkbim.exe
        172⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Djcfee32.exe
        
        C:\Windows\system32\Djcfee32.exe
        173⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Dmdogpmq.exe
        
        C:\Windows\system32\Dmdogpmq.exe
        174⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\Djhpqdlj.exe
        
        C:\Windows\system32\Djhpqdlj.exe
        175⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Ehlpjikd.exe
        
        C:\Windows\system32\Ehlpjikd.exe
        176⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Eibfmp32.exe
        
        C:\Windows\system32\Eibfmp32.exe
        177⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\Edhjji32.exe
        
        C:\Windows\system32\Edhjji32.exe
        178⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Eidbbp32.exe
        
        C:\Windows\system32\Eidbbp32.exe
        179⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Efhcld32.exe
        
        C:\Windows\system32\Efhcld32.exe
        180⤵
        
        PID:1240

C:\Windows\SysWOW64\Djpfbahm.exe
C:\Windows\system32\Djpfbahm.exe
1⤵
PID:10916
- C:\Windows\SysWOW64\Dhcfleff.exe
  C:\Windows\system32\Dhcfleff.exe
  2⤵
  PID:10964
- - C:\Windows\SysWOW64\Elaobdmm.exe
    C:\Windows\system32\Elaobdmm.exe
    3⤵
    PID:11020
  - - C:\Windows\SysWOW64\Eblgon32.exe
      C:\Windows\system32\Eblgon32.exe
      4⤵
      PID:11068
    - - C:\Windows\SysWOW64\Eieplhlf.exe
        
        C:\Windows\system32\Eieplhlf.exe
        5⤵
        
        PID:11112
      - C:\Windows\SysWOW64\Enbhdojn.exe
        
        C:\Windows\system32\Enbhdojn.exe
        6⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Eelpqi32.exe
        
        C:\Windows\system32\Eelpqi32.exe
        7⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Ejiiippb.exe
        
        C:\Windows\system32\Ejiiippb.exe
        8⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Ejkenpnp.exe
        
        C:\Windows\system32\Ejkenpnp.exe
        9⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Ehofhdli.exe
        
        C:\Windows\system32\Ehofhdli.exe
        10⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Eoindndf.exe
        
        C:\Windows\system32\Eoindndf.exe
        11⤵
        
        PID:10364

C:\Windows\SysWOW64\Eecfah32.exe
C:\Windows\system32\Eecfah32.exe
1⤵
PID:10424
- C:\Windows\SysWOW64\Fiaogfai.exe
  C:\Windows\system32\Fiaogfai.exe
  2⤵
  PID:10492
- - C:\Windows\SysWOW64\Fkbkoo32.exe
    C:\Windows\system32\Fkbkoo32.exe
    3⤵
    PID:10560
  - - C:\Windows\SysWOW64\Falcli32.exe
      C:\Windows\system32\Falcli32.exe
      4⤵
      PID:10608
    - - C:\Windows\SysWOW64\Flddoa32.exe
        
        C:\Windows\system32\Flddoa32.exe
        5⤵
        
        PID:10716
      - C:\Windows\SysWOW64\Femigg32.exe
        
        C:\Windows\system32\Femigg32.exe
        6⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Fbqiak32.exe
        
        C:\Windows\system32\Fbqiak32.exe
        7⤵
        
        PID:10904

C:\Windows\SysWOW64\Feofmf32.exe
C:\Windows\system32\Feofmf32.exe
1⤵
PID:10900
- C:\Windows\SysWOW64\Gbcffk32.exe
  C:\Windows\system32\Gbcffk32.exe
  2⤵
  PID:10992
- - C:\Windows\SysWOW64\Gimoce32.exe
    C:\Windows\system32\Gimoce32.exe
    3⤵
    PID:4852
  - - C:\Windows\SysWOW64\Gknkkmmj.exe
      C:\Windows\system32\Gknkkmmj.exe
      4⤵
      PID:11120
    - - C:\Windows\SysWOW64\Gahcgg32.exe
        
        C:\Windows\system32\Gahcgg32.exe
        5⤵
        
        PID:11180
      - C:\Windows\SysWOW64\Gbhpajlj.exe
        
        C:\Windows\system32\Gbhpajlj.exe
        6⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\Giahndcf.exe
        
        C:\Windows\system32\Giahndcf.exe
        7⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Gooqfkan.exe
        
        C:\Windows\system32\Gooqfkan.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2752
        
        C:\Windows\SysWOW64\Gehice32.exe
        
        C:\Windows\system32\Gehice32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1688
        
        C:\Windows\SysWOW64\Gekeie32.exe
        
        C:\Windows\system32\Gekeie32.exe
        10⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Hocjaj32.exe
        
        C:\Windows\system32\Hocjaj32.exe
        11⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Hllcfnhm.exe
        
        C:\Windows\system32\Hllcfnhm.exe
        12⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Hipdpbgf.exe
        
        C:\Windows\system32\Hipdpbgf.exe
        13⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Iheaqolo.exe
        
        C:\Windows\system32\Iheaqolo.exe
        14⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\Ioafchai.exe
        
        C:\Windows\system32\Ioafchai.exe
        15⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Icakofel.exe
        
        C:\Windows\system32\Icakofel.exe
        16⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Jkomhhae.exe
        
        C:\Windows\system32\Jkomhhae.exe
        17⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Jhcmbm32.exe
        
        C:\Windows\system32\Jhcmbm32.exe
        18⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\Jchaoe32.exe
        
        C:\Windows\system32\Jchaoe32.exe
        19⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Jkcfch32.exe
        
        C:\Windows\system32\Jkcfch32.exe
        20⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\Jhjcbljf.exe
        
        C:\Windows\system32\Jhjcbljf.exe
        21⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Kmhlijpm.exe
        
        C:\Windows\system32\Kmhlijpm.exe
        22⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Kjlmbnof.exe
        
        C:\Windows\system32\Kjlmbnof.exe
        23⤵
        
        PID:10576

C:\Windows\SysWOW64\Kcdakd32.exe
C:\Windows\system32\Kcdakd32.exe
1⤵
PID:1492
- C:\Windows\SysWOW64\Kmmedi32.exe
  C:\Windows\system32\Kmmedi32.exe
  2⤵
  PID:2476
- - C:\Windows\SysWOW64\Kcikfcab.exe
    C:\Windows\system32\Kcikfcab.exe
    3⤵
    PID:3388
  - - C:\Windows\SysWOW64\Kifcnjpi.exe
      C:\Windows\system32\Kifcnjpi.exe
      4⤵
      PID:10816
    - - C:\Windows\SysWOW64\Lbnggpfj.exe
        
        C:\Windows\system32\Lbnggpfj.exe
        5⤵
        
        PID:3548
      - C:\Windows\SysWOW64\Ljglnmdi.exe
        
        C:\Windows\system32\Ljglnmdi.exe
        6⤵
        Executes dropped EXE
        
        PID:2056
        
        C:\Windows\SysWOW64\Lcpqgbkj.exe
        
        C:\Windows\system32\Lcpqgbkj.exe
        7⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\Lcbmlbig.exe
        
        C:\Windows\system32\Lcbmlbig.exe
        8⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Lmmokgne.exe
        
        C:\Windows\system32\Lmmokgne.exe
        9⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Mjcljk32.exe
        
        C:\Windows\system32\Mjcljk32.exe
        10⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Mfjlolpp.exe
        
        C:\Windows\system32\Mfjlolpp.exe
        11⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Mflidl32.exe
        
        C:\Windows\system32\Mflidl32.exe
        12⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Mpenmadn.exe
        
        C:\Windows\system32\Mpenmadn.exe
        13⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Mfofjk32.exe
        
        C:\Windows\system32\Mfofjk32.exe
        14⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Mminfech.exe
        
        C:\Windows\system32\Mminfech.exe
        15⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Nfabok32.exe
        
        C:\Windows\system32\Nfabok32.exe
        16⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Nmkkle32.exe
        
        C:\Windows\system32\Nmkkle32.exe
        17⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\Nbhcdl32.exe
        
        C:\Windows\system32\Nbhcdl32.exe
        18⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Nmbamdkm.exe
        
        C:\Windows\system32\Nmbamdkm.exe
        19⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Njfafhjf.exe
        
        C:\Windows\system32\Njfafhjf.exe
        20⤵
        
        PID:3896

C:\Windows\SysWOW64\Opcjno32.exe
C:\Windows\system32\Opcjno32.exe
1⤵
PID:10984
- C:\Windows\SysWOW64\Oikngeoo.exe
  C:\Windows\system32\Oikngeoo.exe
  2⤵
  PID:5504
- - C:\Windows\SysWOW64\Omigmc32.exe
    C:\Windows\system32\Omigmc32.exe
    3⤵
    PID:2900
  - - C:\Windows\SysWOW64\Odcojm32.exe
      C:\Windows\system32\Odcojm32.exe
      4⤵
      Drops file in System32 directory
      PID:5500
    - - C:\Windows\SysWOW64\Oiphbd32.exe
        
        C:\Windows\system32\Oiphbd32.exe
        5⤵
        
        PID:2552
      - C:\Windows\SysWOW64\Obhlkjaj.exe
        
        C:\Windows\system32\Obhlkjaj.exe
        6⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Oplmdnpc.exe
        
        C:\Windows\system32\Oplmdnpc.exe
        7⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Plcmiofg.exe
        
        C:\Windows\system32\Plcmiofg.exe
        8⤵
        
        PID:5836

C:\Windows\SysWOW64\Piikhc32.exe
C:\Windows\system32\Piikhc32.exe
1⤵
PID:5420
- C:\Windows\SysWOW64\Pmgcoaie.exe
  C:\Windows\system32\Pmgcoaie.exe
  2⤵
  PID:5468
- - C:\Windows\SysWOW64\Akdfndpd.exe
    C:\Windows\system32\Akdfndpd.exe
    3⤵
    PID:1476
  - - C:\Windows\SysWOW64\Agpqnd32.exe
      C:\Windows\system32\Agpqnd32.exe
      4⤵
      PID:4540
    - - C:\Windows\SysWOW64\Bdfnmhnj.exe
        
        C:\Windows\system32\Bdfnmhnj.exe
        5⤵
        
        PID:2892
      - C:\Windows\SysWOW64\Ccbaoc32.exe
        
        C:\Windows\system32\Ccbaoc32.exe
        6⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Ccendc32.exe
        
        C:\Windows\system32\Ccendc32.exe
        7⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\Cnmoglij.exe
        
        C:\Windows\system32\Cnmoglij.exe
        8⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\Cgecpa32.exe
        
        C:\Windows\system32\Cgecpa32.exe
        9⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Cmblhh32.exe
        
        C:\Windows\system32\Cmblhh32.exe
        10⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Cnahbk32.exe
        
        C:\Windows\system32\Cnahbk32.exe
        11⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Dgjmkqke.exe
        
        C:\Windows\system32\Dgjmkqke.exe
        12⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Dmiaig32.exe
        
        C:\Windows\system32\Dmiaig32.exe
        13⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Dnhncjom.exe
        
        C:\Windows\system32\Dnhncjom.exe
        14⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Debfpd32.exe
        
        C:\Windows\system32\Debfpd32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5640
        
        C:\Windows\SysWOW64\Djoohk32.exe
        
        C:\Windows\system32\Djoohk32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5752
        
        C:\Windows\SysWOW64\Dqigee32.exe
        
        C:\Windows\system32\Dqigee32.exe
        17⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\Dkokbn32.exe
        
        C:\Windows\system32\Dkokbn32.exe
        18⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Egelgoah.exe
        
        C:\Windows\system32\Egelgoah.exe
        19⤵
        Modifies registry class
        
        PID:5284
        
        C:\Windows\SysWOW64\Eeimqc32.exe
        
        C:\Windows\system32\Eeimqc32.exe
        20⤵
        
        PID:392

C:\Windows\SysWOW64\Enaaiifb.exe
C:\Windows\system32\Enaaiifb.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5424
- C:\Windows\SysWOW64\Eenflbll.exe
  C:\Windows\system32\Eenflbll.exe
  2⤵
  PID:1096
- - C:\Windows\SysWOW64\Elhnhm32.exe
    C:\Windows\system32\Elhnhm32.exe
    3⤵
    PID:4324
  - - C:\Windows\SysWOW64\Ecccmo32.exe
      C:\Windows\system32\Ecccmo32.exe
      4⤵
      PID:3484
    - - C:\Windows\SysWOW64\Febogbhg.exe
        
        C:\Windows\system32\Febogbhg.exe
        5⤵
        
        PID:5452

C:\Windows\SysWOW64\Fhchhm32.exe
C:\Windows\system32\Fhchhm32.exe
1⤵
PID:6004
- C:\Windows\SysWOW64\Flaaok32.exe
  C:\Windows\system32\Flaaok32.exe
  2⤵
  PID:5604
- - C:\Windows\SysWOW64\Fjfnphpf.exe
    C:\Windows\system32\Fjfnphpf.exe
    3⤵
    - Drops file in System32 directory
    PID:5556
  - - C:\Windows\SysWOW64\Felbmqpl.exe
      C:\Windows\system32\Felbmqpl.exe
      4⤵
      PID:4672
    - - C:\Windows\SysWOW64\Fndgfffm.exe
        
        C:\Windows\system32\Fndgfffm.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6028
      - C:\Windows\SysWOW64\Gjkgkg32.exe
        
        C:\Windows\system32\Gjkgkg32.exe
        6⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Gjndpg32.exe
        
        C:\Windows\system32\Gjndpg32.exe
        7⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Gokmfe32.exe
        
        C:\Windows\system32\Gokmfe32.exe
        8⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Geeecogb.exe
        
        C:\Windows\system32\Geeecogb.exe
        9⤵
        Modifies registry class
        
        PID:6412
        
        C:\Windows\SysWOW64\Glompi32.exe
        
        C:\Windows\system32\Glompi32.exe
        10⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Hopfadlp.exe
        
        C:\Windows\system32\Hopfadlp.exe
        11⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Hdahek32.exe
        
        C:\Windows\system32\Hdahek32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5592
        
        C:\Windows\SysWOW64\Headon32.exe
        
        C:\Windows\system32\Headon32.exe
        13⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Hdfapjbl.exe
        
        C:\Windows\system32\Hdfapjbl.exe
        14⤵
        
        PID:3036

C:\Windows\SysWOW64\Ikbfbdgf.exe
C:\Windows\system32\Ikbfbdgf.exe
1⤵
PID:5696

C:\Windows\SysWOW64\Bibpkiie.exe
C:\Windows\system32\Bibpkiie.exe
1⤵
PID:7228
- C:\Windows\SysWOW64\Cgbppknb.exe
  C:\Windows\system32\Cgbppknb.exe
  2⤵
  PID:7360
- - C:\Windows\SysWOW64\Dflflg32.exe
    C:\Windows\system32\Dflflg32.exe
    3⤵
    PID:7560
  - - C:\Windows\SysWOW64\Efgehe32.exe
      C:\Windows\system32\Efgehe32.exe
      4⤵
      PID:7908
    - - C:\Windows\SysWOW64\Fmpjfn32.exe
        
        C:\Windows\system32\Fmpjfn32.exe
        5⤵
        
        PID:10544
      - C:\Windows\SysWOW64\Gfaaebnj.exe
        
        C:\Windows\system32\Gfaaebnj.exe
        6⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Gmnfglcd.exe
        
        C:\Windows\system32\Gmnfglcd.exe
        7⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Jpfnqc32.exe
        
        C:\Windows\system32\Jpfnqc32.exe
        8⤵
        Modifies registry class
        
        PID:7120
        
        C:\Windows\SysWOW64\Kklkej32.exe
        
        C:\Windows\system32\Kklkej32.exe
        9⤵
        
        PID:7156

C:\Windows\SysWOW64\Kojdkhdd.exe
C:\Windows\system32\Kojdkhdd.exe
1⤵
PID:7256
- C:\Windows\SysWOW64\Lhdeinhb.exe
  C:\Windows\system32\Lhdeinhb.exe
  2⤵
  PID:6340
- - C:\Windows\SysWOW64\Ldnbdnlc.exe
    C:\Windows\system32\Ldnbdnlc.exe
    3⤵
    PID:7196

C:\Windows\SysWOW64\Lqdcio32.exe
C:\Windows\system32\Lqdcio32.exe
1⤵
PID:5788
- C:\Windows\SysWOW64\Loecgfjf.exe
  C:\Windows\system32\Loecgfjf.exe
  2⤵
  PID:7328
- - C:\Windows\SysWOW64\Ldblon32.exe
    C:\Windows\system32\Ldblon32.exe
    3⤵
    PID:7200
  - - C:\Windows\SysWOW64\Mnjqhcno.exe
      C:\Windows\system32\Mnjqhcno.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:7592
    - - C:\Windows\SysWOW64\Mkoaagmh.exe
        
        C:\Windows\system32\Mkoaagmh.exe
        5⤵
        
        PID:7696
      - C:\Windows\SysWOW64\Mqnfon32.exe
        
        C:\Windows\system32\Mqnfon32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7040

C:\Windows\SysWOW64\Nkhdgfen.exe
C:\Windows\system32\Nkhdgfen.exe
1⤵
PID:8376
- C:\Windows\SysWOW64\Neebkkgi.exe
  C:\Windows\system32\Neebkkgi.exe
  2⤵
  PID:8072

C:\Windows\SysWOW64\Nnpcjplf.exe
C:\Windows\system32\Nnpcjplf.exe
1⤵
PID:1532
- C:\Windows\SysWOW64\Oijqbh32.exe
  C:\Windows\system32\Oijqbh32.exe
  2⤵
  PID:4284

C:\Windows\SysWOW64\Okkidceh.exe
C:\Windows\system32\Okkidceh.exe
1⤵
- Drops file in System32 directory
- Modifies registry class
PID:2876

C:\Windows\SysWOW64\Pgefogop.exe
C:\Windows\system32\Pgefogop.exe
1⤵
PID:8920
- C:\Windows\SysWOW64\Pmdkmnkd.exe
  C:\Windows\system32\Pmdkmnkd.exe
  2⤵
  PID:10588

C:\Windows\SysWOW64\Fdlcehhn.exe
C:\Windows\system32\Fdlcehhn.exe
1⤵
PID:6488
- C:\Windows\SysWOW64\Fdopkhfk.exe
  C:\Windows\system32\Fdopkhfk.exe
  2⤵
  PID:3608
- - C:\Windows\SysWOW64\Filicodb.exe
    C:\Windows\system32\Filicodb.exe
    3⤵
    PID:5592
  - - C:\Windows\SysWOW64\Fpeapilo.exe
      C:\Windows\system32\Fpeapilo.exe
      4⤵
      PID:10048
    - - C:\Windows\SysWOW64\Fkkemble.exe
        
        C:\Windows\system32\Fkkemble.exe
        5⤵
        
        PID:10452
      - C:\Windows\SysWOW64\Fphneijl.exe
        
        C:\Windows\system32\Fphneijl.exe
        6⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\Fhablf32.exe
        
        C:\Windows\system32\Fhablf32.exe
        7⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Ghdoae32.exe
        
        C:\Windows\system32\Ghdoae32.exe
        8⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Ghflgedf.exe
        
        C:\Windows\system32\Ghflgedf.exe
        9⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\Gdmmlf32.exe
        
        C:\Windows\system32\Gdmmlf32.exe
        10⤵
        Drops file in System32 directory
        
        PID:6984
        
        C:\Windows\SysWOW64\Gilajmfp.exe
        
        C:\Windows\system32\Gilajmfp.exe
        11⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Gnjjpk32.exe
        
        C:\Windows\system32\Gnjjpk32.exe
        12⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Hgboiq32.exe
        
        C:\Windows\system32\Hgboiq32.exe
        13⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Hhbkccji.exe
        
        C:\Windows\system32\Hhbkccji.exe
        14⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Hgghdp32.exe
        
        C:\Windows\system32\Hgghdp32.exe
        15⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Halmaiog.exe
        
        C:\Windows\system32\Halmaiog.exe
        16⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Hncmfj32.exe
        
        C:\Windows\system32\Hncmfj32.exe
        17⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Hhiacb32.exe
        
        C:\Windows\system32\Hhiacb32.exe
        18⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Inejlibi.exe
        
        C:\Windows\system32\Inejlibi.exe
        19⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Ikijenab.exe
        
        C:\Windows\system32\Ikijenab.exe
        20⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Igpkjo32.exe
        
        C:\Windows\system32\Igpkjo32.exe
        21⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Igbhpned.exe
        
        C:\Windows\system32\Igbhpned.exe
        22⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\Ihbdja32.exe
        
        C:\Windows\system32\Ihbdja32.exe
        23⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Ijcaaibe.exe
        
        C:\Windows\system32\Ijcaaibe.exe
        24⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Idieob32.exe
        
        C:\Windows\system32\Idieob32.exe
        25⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Jgjnpm32.exe
        
        C:\Windows\system32\Jgjnpm32.exe
        26⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Jdpkoalc.exe
        
        C:\Windows\system32\Jdpkoalc.exe
        27⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\Jdbheajp.exe
        
        C:\Windows\system32\Jdbheajp.exe
        28⤵
        Drops file in System32 directory
        
        PID:7400
        
        C:\Windows\SysWOW64\Jnklnfpq.exe
        
        C:\Windows\system32\Jnklnfpq.exe
        29⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Kjambg32.exe
        
        C:\Windows\system32\Kjambg32.exe
        30⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Kdgapp32.exe
        
        C:\Windows\system32\Kdgapp32.exe
        31⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\Kqnbea32.exe
        
        C:\Windows\system32\Kqnbea32.exe
        32⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Kjffngap.exe
        
        C:\Windows\system32\Kjffngap.exe
        33⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Kglcmk32.exe
        
        C:\Windows\system32\Kglcmk32.exe
        34⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\Kepdfo32.exe
        
        C:\Windows\system32\Kepdfo32.exe
        35⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Lgamhjja.exe
        
        C:\Windows\system32\Lgamhjja.exe
        36⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\Lnmbjd32.exe
        
        C:\Windows\system32\Lnmbjd32.exe
        37⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Ljdboe32.exe
        
        C:\Windows\system32\Ljdboe32.exe
        38⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Lhhchi32.exe
        
        C:\Windows\system32\Lhhchi32.exe
        39⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Lelcbmcc.exe
        
        C:\Windows\system32\Lelcbmcc.exe
        40⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Mjiljdaj.exe
        
        C:\Windows\system32\Mjiljdaj.exe
        41⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Mngepb32.exe
        
        C:\Windows\system32\Mngepb32.exe
        42⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Mlmbofdh.exe
        
        C:\Windows\system32\Mlmbofdh.exe
        43⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Mhdbdgjl.exe
        
        C:\Windows\system32\Mhdbdgjl.exe
        44⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Mbigapjb.exe
        
        C:\Windows\system32\Mbigapjb.exe
        45⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Njdlfbgm.exe
        
        C:\Windows\system32\Njdlfbgm.exe
        46⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\Nbnpmp32.exe
        
        C:\Windows\system32\Nbnpmp32.exe
        47⤵
        
        PID:492
        
        C:\Windows\SysWOW64\Noijmp32.exe
        
        C:\Windows\system32\Noijmp32.exe
        48⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Oefpoi32.exe
        
        C:\Windows\system32\Oefpoi32.exe
        49⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Oondhocf.exe
        
        C:\Windows\system32\Oondhocf.exe
        50⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Oejijiip.exe
        
        C:\Windows\system32\Oejijiip.exe
        51⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\Olgnlb32.exe
        
        C:\Windows\system32\Olgnlb32.exe
        52⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Pacfdila.exe
        
        C:\Windows\system32\Pacfdila.exe
        53⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Phnoac32.exe
        
        C:\Windows\system32\Phnoac32.exe
        54⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\Poggnnkk.exe
        
        C:\Windows\system32\Poggnnkk.exe
        55⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Phbhlcpi.exe
        
        C:\Windows\system32\Phbhlcpi.exe
        56⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Poomom32.exe
        
        C:\Windows\system32\Poomom32.exe
        57⤵
        
        PID:6752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afeban32.exe

Filesize
482KB

MD5
f0b0086fa8e042e0781c43b4eee525a5

SHA1
b4d2254e622919456e0b1e7f8c44fe3fe013b92f

SHA256
c16bbc0a9d0daa344ce640851b11ede5b17fffca54719dbfad8b10b4e985b3fd

SHA512
4426765bf8966504701c60c26ef0986d2920687fc9cf76e65a8477c2db988cd95833b2a7f77262692bb3c748a338e1ba7297bbb23d6a4db584b962de2cb2e348

Download Submit
C:\Windows\SysWOW64\Bajqda32.exe

Filesize
482KB

MD5
f2590b7e1395015396cdb71b9f0a43b5

SHA1
fea02b619f8589755ae2cc1203be225b0ed0dea1

SHA256
81a8042d9b063b7ae368dc17e5c41610053f5a1eddd8cacc36e4500575688ab7

SHA512
1bf9f6a81c1c3fbbd7c0cbe57c7b35cfbc5cdec461f1f1e23418e1eb6acf19af892ca8e2915407afb54aee0acb91a43adb38abd9e726a4a6239ba32201783c14

Download Submit
C:\Windows\SysWOW64\Bajqda32.exe

Filesize
482KB

MD5
f2590b7e1395015396cdb71b9f0a43b5

SHA1
fea02b619f8589755ae2cc1203be225b0ed0dea1

SHA256
81a8042d9b063b7ae368dc17e5c41610053f5a1eddd8cacc36e4500575688ab7

SHA512
1bf9f6a81c1c3fbbd7c0cbe57c7b35cfbc5cdec461f1f1e23418e1eb6acf19af892ca8e2915407afb54aee0acb91a43adb38abd9e726a4a6239ba32201783c14

Download Submit
C:\Windows\SysWOW64\Bdfpkm32.exe

Filesize
482KB

MD5
08c78ae23cae84a111969f50e96c0e15

SHA1
194fba8dbcd72749111cc7786118d96c9a7e1025

SHA256
2420e28b86f3db4884f480c5938178e23214b4dfbe6c2ed5bf74205e3453a699

SHA512
862dc58ba2161f8def08438ab97b5d18cc052206aa66b09a06d1571f6001931c92bfed4a49d9da8dfc8769c5fcf857aec51f65c703200b6733007369ad3eadc5

Download Submit
C:\Windows\SysWOW64\Bdfpkm32.exe

Filesize
482KB

MD5
08c78ae23cae84a111969f50e96c0e15

SHA1
194fba8dbcd72749111cc7786118d96c9a7e1025

SHA256
2420e28b86f3db4884f480c5938178e23214b4dfbe6c2ed5bf74205e3453a699

SHA512
862dc58ba2161f8def08438ab97b5d18cc052206aa66b09a06d1571f6001931c92bfed4a49d9da8dfc8769c5fcf857aec51f65c703200b6733007369ad3eadc5

Download Submit
C:\Windows\SysWOW64\Bgnffj32.exe

Filesize
482KB

MD5
247cecc549d66e251629bf74336d7290

SHA1
e46c34f2f9759d42750f42bc7f7038a68f7a9db9

SHA256
d024a60b2d88d133df44c1958f40f679925ba9bd24a8e5b46a3dbfc9fe565bf0

SHA512
1890a41dcb51456d5cfa509e619f56c2ab37dfd6bee5b92b3eccb1ba8235e09bbf3cf0bd07500dce6a580ac93377ce8a3f6e02a4993c526c4713ed0cac9ee6f2

Download Submit
C:\Windows\SysWOW64\Bgnffj32.exe

Filesize
482KB

MD5
247cecc549d66e251629bf74336d7290

SHA1
e46c34f2f9759d42750f42bc7f7038a68f7a9db9

SHA256
d024a60b2d88d133df44c1958f40f679925ba9bd24a8e5b46a3dbfc9fe565bf0

SHA512
1890a41dcb51456d5cfa509e619f56c2ab37dfd6bee5b92b3eccb1ba8235e09bbf3cf0bd07500dce6a580ac93377ce8a3f6e02a4993c526c4713ed0cac9ee6f2

Download Submit
C:\Windows\SysWOW64\Cienon32.exe

Filesize
482KB

MD5
cad44cf91165262dada6b52607b70a67

SHA1
2776d1e2f21072ba0f6fa9d0ec2f381b7e90d892

SHA256
4ce84d2dc468aac19126ec3122b2742a8b5ce856c6f4e4e77a1d4c4d54bc9007

SHA512
a5865c709ed3cda4ad5d16c050539b603acda5367532036dd239a855f54d4c0afc259d2a729ef4ef6857caf49db1bf2960a5d7c8270b03e2f5ba3049421180f7

Download Submit
C:\Windows\SysWOW64\Coegoe32.exe

Filesize
482KB

MD5
a5c84642877ab4599feffc871be71255

SHA1
44f9dce84cf55678ad15af700ef0f6103507ff98

SHA256
2e9056919bdd9f0c0277f23bdd88a53481f5ac1552078fb32325b857d5e22503

SHA512
2d831eb86a1d98a1c4073fb65e33fa391e362a3389225c70062f7492fa9540ca6110ab681f3b518720107a0bebf6045fc9d81bb9069be49713dc4ef976ab5f0d

Download Submit
C:\Windows\SysWOW64\Coegoe32.exe

Filesize
482KB

MD5
a5c84642877ab4599feffc871be71255

SHA1
44f9dce84cf55678ad15af700ef0f6103507ff98

SHA256
2e9056919bdd9f0c0277f23bdd88a53481f5ac1552078fb32325b857d5e22503

SHA512
2d831eb86a1d98a1c4073fb65e33fa391e362a3389225c70062f7492fa9540ca6110ab681f3b518720107a0bebf6045fc9d81bb9069be49713dc4ef976ab5f0d

Download Submit
C:\Windows\SysWOW64\Dkcndeen.exe

Filesize
482KB

MD5
7ba5ed991fec2e00fc185807ae311d53

SHA1
d40741aae68cfc5b5fa3199fe8bfc785fceddfa7

SHA256
6f7c3ae95fb2c1e82ac6079cd10e96ab93f814aed2eaee757aea7a35ec255429

SHA512
404b72fe3ac931d7b649d37ef8f5c0157a8ac3e8d240eea1f06bc97c9e719c9d46ba3accca4d152722c5031409be6f2b6b68a6f0c00cdb37a880782a33bdc297

Download Submit
C:\Windows\SysWOW64\Dkcndeen.exe

Filesize
482KB

MD5
7ba5ed991fec2e00fc185807ae311d53

SHA1
d40741aae68cfc5b5fa3199fe8bfc785fceddfa7

SHA256
6f7c3ae95fb2c1e82ac6079cd10e96ab93f814aed2eaee757aea7a35ec255429

SHA512
404b72fe3ac931d7b649d37ef8f5c0157a8ac3e8d240eea1f06bc97c9e719c9d46ba3accca4d152722c5031409be6f2b6b68a6f0c00cdb37a880782a33bdc297

Download Submit
C:\Windows\SysWOW64\Dnmaea32.exe

Filesize
482KB

MD5
c16daaefc96e4e78f0d3166d0f64e22c

SHA1
13246e5d26a8c0f94d7311a5b493d00f29458958

SHA256
0a4385ce9914e93c8141f14823f0f27913f0ed3cd29ccb0ff0a4d2570e361e78

SHA512
d2b10b55b9bd218305781d53f76f4dfd104077f2b94832dd5e3c5500752676f661c6a069668c2b9d636607e93a968763f143fc91fb8b5505595cedbb231ac8e4

Download Submit
C:\Windows\SysWOW64\Dnmaea32.exe

Filesize
482KB

MD5
c16daaefc96e4e78f0d3166d0f64e22c

SHA1
13246e5d26a8c0f94d7311a5b493d00f29458958

SHA256
0a4385ce9914e93c8141f14823f0f27913f0ed3cd29ccb0ff0a4d2570e361e78

SHA512
d2b10b55b9bd218305781d53f76f4dfd104077f2b94832dd5e3c5500752676f661c6a069668c2b9d636607e93a968763f143fc91fb8b5505595cedbb231ac8e4

Download Submit
C:\Windows\SysWOW64\Dqbcbkab.exe

Filesize
482KB

MD5
ef5b4ab5ba92987ae9d6a10599bd57c7

SHA1
3627c27f3c029ac454951cef5b2df37e6568daaa

SHA256
4c87ffc0291811558c3bfffbaad7291baaa61ef902e909be66c819cec748bf12

SHA512
fbc22878e3c50f0b48d0a5992abf44c671f554c80e7126641775312b3c08a48a3ad12aa2a93372ed5b202be387a1187b0769c2a851f7d4b080d2539f4a28a8fa

Download Submit
C:\Windows\SysWOW64\Dqbcbkab.exe

Filesize
482KB

MD5
ef5b4ab5ba92987ae9d6a10599bd57c7

SHA1
3627c27f3c029ac454951cef5b2df37e6568daaa

SHA256
4c87ffc0291811558c3bfffbaad7291baaa61ef902e909be66c819cec748bf12

SHA512
fbc22878e3c50f0b48d0a5992abf44c671f554c80e7126641775312b3c08a48a3ad12aa2a93372ed5b202be387a1187b0769c2a851f7d4b080d2539f4a28a8fa

Download Submit
C:\Windows\SysWOW64\Egcaod32.exe

Filesize
482KB

MD5
5dba7bd5cf6bd698c9a629d631a1840f

SHA1
1a0b79f3cf9db2f04f2701af245f392253c87c5a

SHA256
f634e3995fecfc265e5224a3037471df9c3fef83a35fabc7f6bdbbc798142779

SHA512
242680843298a3aeb54afe24ece15de205a16cb0970fab022e874f07279d9fc48f528333d6291f0772b154ab81e6ed316c7980a027119bc5034777dd5e15d045

Download Submit
C:\Windows\SysWOW64\Egcaod32.exe

Filesize
482KB

MD5
5dba7bd5cf6bd698c9a629d631a1840f

SHA1
1a0b79f3cf9db2f04f2701af245f392253c87c5a

SHA256
f634e3995fecfc265e5224a3037471df9c3fef83a35fabc7f6bdbbc798142779

SHA512
242680843298a3aeb54afe24ece15de205a16cb0970fab022e874f07279d9fc48f528333d6291f0772b154ab81e6ed316c7980a027119bc5034777dd5e15d045

Download Submit
C:\Windows\SysWOW64\Enopghee.exe

Filesize
482KB

MD5
223ed7a885b37a98236c5a9c2f0d637e

SHA1
77c2eed006bb3034f445d7940a9b2f19500db72b

SHA256
00b4957d5a22754a9e7190c4af6349229ef23040f6ae288ff3e4a191f42f1140

SHA512
fdcdd5a9bf0b0e7db362a5e8d976b8df4b851dd265626debcd1d5173eaca27cd4faaba9a13e2fc2817de3ccb1da3ed06735e474e1dd8101dc077ce368aa803e8

Download Submit
C:\Windows\SysWOW64\Enpfan32.exe

Filesize
482KB

MD5
8aef077432e4008e0e356a27e489ff9b

SHA1
bf883e42c20b0fa1c567b9d2668a4de3a5d06e73

SHA256
a25bc1a2077cb54f18e142c04f265ed0212867251489850610e0eca299fcee28

SHA512
5f4dad102d8d8ad84dccb00b096ec2d036164cd64ca947bd7835a1fffca654bd440f99fd41254359d015f578c2fb56c70059a007877e94cabaa37705912abed6

Download Submit
C:\Windows\SysWOW64\Enpfan32.exe

Filesize
482KB

MD5
8aef077432e4008e0e356a27e489ff9b

SHA1
bf883e42c20b0fa1c567b9d2668a4de3a5d06e73

SHA256
a25bc1a2077cb54f18e142c04f265ed0212867251489850610e0eca299fcee28

SHA512
5f4dad102d8d8ad84dccb00b096ec2d036164cd64ca947bd7835a1fffca654bd440f99fd41254359d015f578c2fb56c70059a007877e94cabaa37705912abed6

Download Submit
C:\Windows\SysWOW64\Eoepebho.exe

Filesize
482KB

MD5
cb6253a58ba25b51a04c2e4a5f26b76a

SHA1
59b77968cfd4747635386392b52a4565ef9d454e

SHA256
88eacf377c62f408d32acd5806bde14a72f4fd3935e5444ea0b0a5739c99c927

SHA512
41ab448e9de652dcc3221c57b7a2c7bbd4e0c439b5eb6cc59922e57ae271696f30032b61d4406b3eb5877ada63d2a1c2bdbfb17406d9efc5d9d6cdb47dd81589

Download Submit
C:\Windows\SysWOW64\Eoepebho.exe

Filesize
482KB

MD5
cb6253a58ba25b51a04c2e4a5f26b76a

SHA1
59b77968cfd4747635386392b52a4565ef9d454e

SHA256
88eacf377c62f408d32acd5806bde14a72f4fd3935e5444ea0b0a5739c99c927

SHA512
41ab448e9de652dcc3221c57b7a2c7bbd4e0c439b5eb6cc59922e57ae271696f30032b61d4406b3eb5877ada63d2a1c2bdbfb17406d9efc5d9d6cdb47dd81589

Download Submit
C:\Windows\SysWOW64\Fnfmbmbi.exe

Filesize
482KB

MD5
8d0df5ff5494bf9a2541c86f1723f0bf

SHA1
1a055613752410b6a02d1ae6177fb6933132c776

SHA256
40e8783ab5bdd3ffd6f1e050e89b89991f453ecc2f2cbecbb740552d7c18c6eb

SHA512
72674ef9e29f93ada80d5bfc05fc0e547922684d96c4ef340f0687e17426fb662261a8ded93230b45ad1c8547bcab688583c07f69821f0307f8974c0ea1acfbf

Download Submit
C:\Windows\SysWOW64\Fnfmbmbi.exe

Filesize
482KB

MD5
8d0df5ff5494bf9a2541c86f1723f0bf

SHA1
1a055613752410b6a02d1ae6177fb6933132c776

SHA256
40e8783ab5bdd3ffd6f1e050e89b89991f453ecc2f2cbecbb740552d7c18c6eb

SHA512
72674ef9e29f93ada80d5bfc05fc0e547922684d96c4ef340f0687e17426fb662261a8ded93230b45ad1c8547bcab688583c07f69821f0307f8974c0ea1acfbf

Download Submit
C:\Windows\SysWOW64\Gbnhoj32.exe

Filesize
482KB

MD5
448add751089cc33445d9d49b3959162

SHA1
a85671a08ee2b01895a6e559278cb77723726a28

SHA256
9f97813538f303a4f7dc16f799d85f74681908a7f65693a67b90f86f590fe5eb

SHA512
a41c916c815a798576bd8d3079e0c4c96ba33cabbe24473299294382241a0017836577cc399db8f96f34e3f719db2b645577757f051cc0ba6b6340367e03880d

Download Submit
C:\Windows\SysWOW64\Gbnhoj32.exe

Filesize
482KB

MD5
448add751089cc33445d9d49b3959162

SHA1
a85671a08ee2b01895a6e559278cb77723726a28

SHA256
9f97813538f303a4f7dc16f799d85f74681908a7f65693a67b90f86f590fe5eb

SHA512
a41c916c815a798576bd8d3079e0c4c96ba33cabbe24473299294382241a0017836577cc399db8f96f34e3f719db2b645577757f051cc0ba6b6340367e03880d

Download Submit
C:\Windows\SysWOW64\Gejhef32.exe

Filesize
482KB

MD5
27c0c6a3d1a48b47687dd9a672c293c5

SHA1
aa6ca5f38d2fd7640ec640e9d38ac1000202992a

SHA256
e0a04f501aed92989b4e69d6316790249d1813accbae5dd0431e307a5a97cbdb

SHA512
7cf0ac8681dcfce17f877c042ac273bfbb6b2c60cf13c04ac0abc3cbbc9aa10af807de1f0b44257238324c4c436c7b6161376e8fd01c2e561b4e5ff75d22088c

Download Submit
C:\Windows\SysWOW64\Gejhef32.exe

Filesize
482KB

MD5
27c0c6a3d1a48b47687dd9a672c293c5

SHA1
aa6ca5f38d2fd7640ec640e9d38ac1000202992a

SHA256
e0a04f501aed92989b4e69d6316790249d1813accbae5dd0431e307a5a97cbdb

SHA512
7cf0ac8681dcfce17f877c042ac273bfbb6b2c60cf13c04ac0abc3cbbc9aa10af807de1f0b44257238324c4c436c7b6161376e8fd01c2e561b4e5ff75d22088c

Download Submit
C:\Windows\SysWOW64\Glhimp32.exe

Filesize
482KB

MD5
ac6a3cf2a5efbb2606adac72812bf4cc

SHA1
19e49d933e87c7902994c907f66568de4a8a6ed9

SHA256
5e403c52693dac3f777e3c4edbbee0d50179f924cd456ac551ef9db7d2eb5e9c

SHA512
0f9f97c77928051221d057121b3bacb438a93581cb306d719886aa01bd4a03d4b8e5cc9549abfe565cabcbf3ee30d0cce9f648b854efe80d632561c489900351

Download Submit
C:\Windows\SysWOW64\Glhimp32.exe

Filesize
482KB

MD5
ac6a3cf2a5efbb2606adac72812bf4cc

SHA1
19e49d933e87c7902994c907f66568de4a8a6ed9

SHA256
5e403c52693dac3f777e3c4edbbee0d50179f924cd456ac551ef9db7d2eb5e9c

SHA512
0f9f97c77928051221d057121b3bacb438a93581cb306d719886aa01bd4a03d4b8e5cc9549abfe565cabcbf3ee30d0cce9f648b854efe80d632561c489900351

Download Submit
C:\Windows\SysWOW64\Hbgkei32.exe

Filesize
482KB

MD5
22446b0830f1228a2f2c87ac1073826d

SHA1
64b9825bb8b21501b28e710495cec0d9cfdb7232

SHA256
a8121311bd67c3789a9e53fb76bc7553622b657f6ac0eea85bb266c1a4645532

SHA512
5f9726d1c4891b504d9dae7a086716146af03e329827724ffa1b382c5e6e9c599299d1f0f01858cd2b20036468ffbdcaea8db3dc309091b4219734e3b7c00c3c

Download Submit
C:\Windows\SysWOW64\Hbgkei32.exe

Filesize
482KB

MD5
22446b0830f1228a2f2c87ac1073826d

SHA1
64b9825bb8b21501b28e710495cec0d9cfdb7232

SHA256
a8121311bd67c3789a9e53fb76bc7553622b657f6ac0eea85bb266c1a4645532

SHA512
5f9726d1c4891b504d9dae7a086716146af03e329827724ffa1b382c5e6e9c599299d1f0f01858cd2b20036468ffbdcaea8db3dc309091b4219734e3b7c00c3c

Download Submit
C:\Windows\SysWOW64\Hioflcbj.exe

Filesize
482KB

MD5
58485fdb3290d705002f301814b78f3c

SHA1
90b853483e6e9fae1b5245fa05324befd08a0585

SHA256
da4e4773e31754a301ebe4928277ef249f3054dc70505905639f5d6d238a2bd5

SHA512
b8b6c496400e587405a928feadd258efb68ff086503a84b8b803aa4bcb4edb2e2a141a9046c6ab3dac3e609278da26597b510b80da6719d761b82e40432a5402

Download Submit
C:\Windows\SysWOW64\Hioflcbj.exe

Filesize
482KB

MD5
58485fdb3290d705002f301814b78f3c

SHA1
90b853483e6e9fae1b5245fa05324befd08a0585

SHA256
da4e4773e31754a301ebe4928277ef249f3054dc70505905639f5d6d238a2bd5

SHA512
b8b6c496400e587405a928feadd258efb68ff086503a84b8b803aa4bcb4edb2e2a141a9046c6ab3dac3e609278da26597b510b80da6719d761b82e40432a5402

Download Submit
C:\Windows\SysWOW64\Hldiinke.exe

Filesize
482KB

MD5
fe22f676ba653b78232f4a2dde105c7f

SHA1
6d88b3215ce0654eacb1f8fb78e56cc8c0a60744

SHA256
ad6455992360af52bb3818c3be92684595b4eed2dc9f4d0ae3ffb9add4dc47e9

SHA512
73eb1c9ecc5c97141505e5b6e1d053e6e12b784078e77bf0d12bade124d6bc88416e97029472c6777ea3adaa301b3c0fd2abe2247443683059f0519b26da1e67

Download Submit
C:\Windows\SysWOW64\Hldiinke.exe

Filesize
482KB

MD5
fe22f676ba653b78232f4a2dde105c7f

SHA1
6d88b3215ce0654eacb1f8fb78e56cc8c0a60744

SHA256
ad6455992360af52bb3818c3be92684595b4eed2dc9f4d0ae3ffb9add4dc47e9

SHA512
73eb1c9ecc5c97141505e5b6e1d053e6e12b784078e77bf0d12bade124d6bc88416e97029472c6777ea3adaa301b3c0fd2abe2247443683059f0519b26da1e67

Download Submit
C:\Windows\SysWOW64\Hpfbcn32.exe

Filesize
482KB

MD5
14b617c4ebb87de9ca5edc8bb16e60c8

SHA1
daefe980e6103c4cf636da3c17cfeaae8701ceb5

SHA256
15d9e45cf8a8a87416e5d47865cb378ba2823e24fcfd828469ca50100298cef5

SHA512
4e668f46cc0fd4e534362dab5a85d298e3be2409be30ed9d64d67757129bfca4824ed299e6efec45c2baf077022af3248821ff2e53e7f123a790518e956e028c

Download Submit
C:\Windows\SysWOW64\Hpfbcn32.exe

Filesize
482KB

MD5
14b617c4ebb87de9ca5edc8bb16e60c8

SHA1
daefe980e6103c4cf636da3c17cfeaae8701ceb5

SHA256
15d9e45cf8a8a87416e5d47865cb378ba2823e24fcfd828469ca50100298cef5

SHA512
4e668f46cc0fd4e534362dab5a85d298e3be2409be30ed9d64d67757129bfca4824ed299e6efec45c2baf077022af3248821ff2e53e7f123a790518e956e028c

Download Submit
C:\Windows\SysWOW64\Ibpgqa32.exe

Filesize
482KB

MD5
a2c6b43181ff6465eec8b1ccbcf79935

SHA1
ee4c43c8904b6027f2ed08ccf69601a440e78091

SHA256
40dc469bc42d4d39d85e95b03f37e403729c464f16d90d39323b889cd80bb410

SHA512
874871a8dae078af563295e1510099535595ebf093ac48059b5a2c46c704e4979e5f9dd2b08f3faa4c592a2fbb4f13ed8cc64da36141c416875ca6e4a878f3f4

Download Submit
C:\Windows\SysWOW64\Ihmfco32.exe

Filesize
482KB

MD5
df4d1f58bc02b20db9f3f61df4100e0b

SHA1
b3b4b9621bf6c354cd2e6c8d2ab94eef0e30745f

SHA256
5bc33a07d64ff2d53ce76a2acd9dd02b92368cdc510df33062eaf4b98ec7cc16

SHA512
89ecc39f7d9b3ab3b11fdcd00d6fae66c3b91628d2aab0451541265b75d50761fe02dbc7b93ddae215062adad58be1306972f60a4f83e9c9c1979a81c03a0723

Download Submit
C:\Windows\SysWOW64\Ihmfco32.exe

Filesize
482KB

MD5
16e659a1be94dce48b6c7758aaff32a8

SHA1
5c3e8329f95aac9f60273dcc1342cc6c5dd67557

SHA256
55d47f4277ebd9a24fbb8bb0a42759c6283f8da1439e5fda839a5eaf4558dfdc

SHA512
6cd043cd127c08c6cdce66ce16d5131ad508fd80f197d81908fd0557a4ccf14ac96c474d8b49f6ad28623befba66f24a49e8585e4c65257f593cb493d02feeb1

Download Submit
C:\Windows\SysWOW64\Ihmfco32.exe

Filesize
482KB

MD5
16e659a1be94dce48b6c7758aaff32a8

SHA1
5c3e8329f95aac9f60273dcc1342cc6c5dd67557

SHA256
55d47f4277ebd9a24fbb8bb0a42759c6283f8da1439e5fda839a5eaf4558dfdc

SHA512
6cd043cd127c08c6cdce66ce16d5131ad508fd80f197d81908fd0557a4ccf14ac96c474d8b49f6ad28623befba66f24a49e8585e4c65257f593cb493d02feeb1

Download Submit
C:\Windows\SysWOW64\Ijjekn32.exe

Filesize
482KB

MD5
ba238584e7b3473e96697442ea09c66f

SHA1
0f1de6b44365208a40825426c5d3fa376c9d3b39

SHA256
0daa15bee96ea75b274e98e9a765382e8f529db8a6d056e422865cf63a878f33

SHA512
7bf54247c19b5cca6d678dd198c552766b345fd48aea930a4758e0c4d0b6e9f8fe76a98aa621aaed813cb7a9a5057597face1a42a74d1e99088f4ffa414750f4

Download Submit
C:\Windows\SysWOW64\Jekjcaef.exe

Filesize
482KB

MD5
65e8bdc98d330f07bea2f1132a2cbbd8

SHA1
775e5be62220ad32a4d36e0b91eb10d18eb6c1cf

SHA256
e25b275809410c7dac4154520786fdfb3274aed6393b19a718fe40ab6dde0916

SHA512
d1d7daedba1eea227dab5bbeef0077bbc4250bf0652f165afe67fd7b55391de1e2133ffeeb8219b0aed63168ae083feef16af918d2f80eef76d7c81eda2c5719

Download Submit
C:\Windows\SysWOW64\Jekjcaef.exe

Filesize
482KB

MD5
65e8bdc98d330f07bea2f1132a2cbbd8

SHA1
775e5be62220ad32a4d36e0b91eb10d18eb6c1cf

SHA256
e25b275809410c7dac4154520786fdfb3274aed6393b19a718fe40ab6dde0916

SHA512
d1d7daedba1eea227dab5bbeef0077bbc4250bf0652f165afe67fd7b55391de1e2133ffeeb8219b0aed63168ae083feef16af918d2f80eef76d7c81eda2c5719

Download Submit
C:\Windows\SysWOW64\Jhgiim32.exe

Filesize
482KB

MD5
cc5968fcc456ceedf176e73265c04987

SHA1
99400e522520ad0577a7979e0071e2ef69291dd7

SHA256
066e6f7b676e0742e91f2e47e31525e239cf8394ab9de8f67c0b522e01819420

SHA512
fef758dacb88804159f69e49f5463cf96175d73b8fea9dd14e07dd9c783991f4a7db7d9938da0cefdcaf89f919e4eff79ae1668c77376eb91cd4f87821834374

Download Submit
C:\Windows\SysWOW64\Jhgiim32.exe

Filesize
482KB

MD5
cc5968fcc456ceedf176e73265c04987

SHA1
99400e522520ad0577a7979e0071e2ef69291dd7

SHA256
066e6f7b676e0742e91f2e47e31525e239cf8394ab9de8f67c0b522e01819420

SHA512
fef758dacb88804159f69e49f5463cf96175d73b8fea9dd14e07dd9c783991f4a7db7d9938da0cefdcaf89f919e4eff79ae1668c77376eb91cd4f87821834374

Download Submit
C:\Windows\SysWOW64\Jhkbdmbg.exe

Filesize
482KB

MD5
50f6b5d2a59f7908dff8df69650dc8e8

SHA1
a6f9ebf709bb9e2a631fe2817294cd7be0fd6bb9

SHA256
cd2b4f7e7893788f8688a36d9380e6bba147677340a1b07debf1c7af7dd0c563

SHA512
d190fd4f1d57606f2aaab8ab8efffe37eeff209c72613d73852a995fe2fa3a7274e83b8e6883e804e5dcd8e400ef5aac368c8075eab8da143b4724e776f68619

Download Submit
C:\Windows\SysWOW64\Jhkbdmbg.exe

Filesize
482KB

MD5
50f6b5d2a59f7908dff8df69650dc8e8

SHA1
a6f9ebf709bb9e2a631fe2817294cd7be0fd6bb9

SHA256
cd2b4f7e7893788f8688a36d9380e6bba147677340a1b07debf1c7af7dd0c563

SHA512
d190fd4f1d57606f2aaab8ab8efffe37eeff209c72613d73852a995fe2fa3a7274e83b8e6883e804e5dcd8e400ef5aac368c8075eab8da143b4724e776f68619

Download Submit
C:\Windows\SysWOW64\Jhkbdmbg.exe

Filesize
482KB

MD5
50f6b5d2a59f7908dff8df69650dc8e8

SHA1
a6f9ebf709bb9e2a631fe2817294cd7be0fd6bb9

SHA256
cd2b4f7e7893788f8688a36d9380e6bba147677340a1b07debf1c7af7dd0c563

SHA512
d190fd4f1d57606f2aaab8ab8efffe37eeff209c72613d73852a995fe2fa3a7274e83b8e6883e804e5dcd8e400ef5aac368c8075eab8da143b4724e776f68619

Download Submit
C:\Windows\SysWOW64\Jilpfgkh.dll

Filesize
7KB

MD5
b198db887249cf28bfc4fbc72dd7717c

SHA1
3a318f11aebeba931fa02417df9d1dc216c94935

SHA256
23d72a494cd1cc8e8a45a4ee8728532b1d0e85438790f44a997c64b9abd73fa1

SHA512
adf0042c8711e28e529042fc2c78b34a12eab1c43455503f410fd745d210e254c6411ce3890558d0b59549e16e82cf45ced859acee6aa86fa5fb1c9df6455f81

Download Submit
C:\Windows\SysWOW64\Jllhpkfk.exe

Filesize
482KB

MD5
27b93bbc878ceb41c01f7916b911f64a

SHA1
8727a8c6917c4853ea901a00ff74dc6d1b0d42c2

SHA256
168bd144259e2dc4f952b8c49a8ac5a7afcbb75448197402dcf70388f9311d73

SHA512
bd135a06d7dad546f0f47e53fff8db5263cf971dc13d59a14f161c383e36d6ea9279ce8454e729cf5e72369c99f00c53b4257e76c4605f6567a2d947916968da

Download Submit
C:\Windows\SysWOW64\Jllhpkfk.exe

Filesize
482KB

MD5
27b93bbc878ceb41c01f7916b911f64a

SHA1
8727a8c6917c4853ea901a00ff74dc6d1b0d42c2

SHA256
168bd144259e2dc4f952b8c49a8ac5a7afcbb75448197402dcf70388f9311d73

SHA512
bd135a06d7dad546f0f47e53fff8db5263cf971dc13d59a14f161c383e36d6ea9279ce8454e729cf5e72369c99f00c53b4257e76c4605f6567a2d947916968da

Download Submit
C:\Windows\SysWOW64\Kefiopki.exe

Filesize
482KB

MD5
380dad5fef1211e8b5c959232080c95b

SHA1
feb87065b0294bd9ce474b47545ca5890245db22

SHA256
61d81d4475a875072bca0c1e9db5e172fd6ffac2c71763911b82bc5ecdc9829d

SHA512
ea4e2570acbd6cba772154f2f79f2e8690e1a75f0becf183539b2864210af9d317393336c74f5e6f27ef409899b448f48a8de2c4dffec339178c8317d10442d6

Download Submit
C:\Windows\SysWOW64\Kefiopki.exe

Filesize
482KB

MD5
380dad5fef1211e8b5c959232080c95b

SHA1
feb87065b0294bd9ce474b47545ca5890245db22

SHA256
61d81d4475a875072bca0c1e9db5e172fd6ffac2c71763911b82bc5ecdc9829d

SHA512
ea4e2570acbd6cba772154f2f79f2e8690e1a75f0becf183539b2864210af9d317393336c74f5e6f27ef409899b448f48a8de2c4dffec339178c8317d10442d6

Download Submit
C:\Windows\SysWOW64\Koajmepf.exe

Filesize
482KB

MD5
090574e6c5202794ad2646a22ec6f178

SHA1
4882f0876e4cbb490d8cfef2ad17725ac253fe47

SHA256
1866da36e7d2ea92d5870266a40f93867c30e6489015caa2c65dcc7535cff20b

SHA512
e76cf1a2f52a994dae5504ba61bd7aaf96842b9742ae2c40d6c06870b129e66837b975fddcaaadb40dc96489e24f967fc734ff0db3a092fc60474aa35f579be0

Download Submit
C:\Windows\SysWOW64\Koajmepf.exe

Filesize
482KB

MD5
090574e6c5202794ad2646a22ec6f178

SHA1
4882f0876e4cbb490d8cfef2ad17725ac253fe47

SHA256
1866da36e7d2ea92d5870266a40f93867c30e6489015caa2c65dcc7535cff20b

SHA512
e76cf1a2f52a994dae5504ba61bd7aaf96842b9742ae2c40d6c06870b129e66837b975fddcaaadb40dc96489e24f967fc734ff0db3a092fc60474aa35f579be0

Download Submit
C:\Windows\SysWOW64\Kpccmhdg.exe

Filesize
482KB

MD5
abb1e1884d9230373c003153718e799d

SHA1
81704a3e737c6506d7aa9de5feca2f012b305d7b

SHA256
b4ad09b62b9ebccfa8e0d1cfbe6ab5e29dcc2dd74f5372a91ae8092f0d83bc0f

SHA512
e202521611697d00ac598914eb7a7730c7b8950b4f66e38abebad1a61adb044412aac37fc85ad8bf18c8e49fcc8b5907cf810db65834ae2215ac763438fd412e

Download Submit
C:\Windows\SysWOW64\Kpccmhdg.exe

Filesize
482KB

MD5
d2fbef2f6cc5a3ea3baaae3f6e57d79f

SHA1
9495f8b869ee3a48778b6c67f2f10fa37e55926c

SHA256
935ee8416402b42f66c1e1fc06f32a5f2ff910ca0753a07fa67686d7ba367248

SHA512
19c039a61e8b958f3f833850d166de18c677d05bc5fb05c669192d1d62f98bd1647d03829ce9466bc2660b58072c989150ca87eda719c781dcd02aa39db5bc37

Download Submit
C:\Windows\SysWOW64\Kpccmhdg.exe

Filesize
482KB

MD5
d2fbef2f6cc5a3ea3baaae3f6e57d79f

SHA1
9495f8b869ee3a48778b6c67f2f10fa37e55926c

SHA256
935ee8416402b42f66c1e1fc06f32a5f2ff910ca0753a07fa67686d7ba367248

SHA512
19c039a61e8b958f3f833850d166de18c677d05bc5fb05c669192d1d62f98bd1647d03829ce9466bc2660b58072c989150ca87eda719c781dcd02aa39db5bc37

Download Submit
C:\Windows\SysWOW64\Kpiqfima.exe

Filesize
482KB

MD5
315cd37080cd2d4233b769cd1376ac1e

SHA1
2520b4d6e2135d58d38b5e929412e7b55981d47a

SHA256
e51228c03039994eecbf245063038e21460fef10439759c159f2e7d7f541dcba

SHA512
e1605f03262835247a734c541735cf93b22ee6f504d7964da27dbfcdbcc1ce7c14b7a5e0d91136cb5883acfded740d9e20d0211838594b0a756a5ebf05cb3677

Download Submit
C:\Windows\SysWOW64\Kpiqfima.exe

Filesize
482KB

MD5
315cd37080cd2d4233b769cd1376ac1e

SHA1
2520b4d6e2135d58d38b5e929412e7b55981d47a

SHA256
e51228c03039994eecbf245063038e21460fef10439759c159f2e7d7f541dcba

SHA512
e1605f03262835247a734c541735cf93b22ee6f504d7964da27dbfcdbcc1ce7c14b7a5e0d91136cb5883acfded740d9e20d0211838594b0a756a5ebf05cb3677

Download Submit
C:\Windows\SysWOW64\Lckboblp.exe

Filesize
482KB

MD5
f34550e403a2b21dcdeb1b613bdfc557

SHA1
8fff1ce29e0a55d4954614cfd4bf89f33a2856ef

SHA256
c33a0a6ddc7f8e6cb484a8eb081081f295d458c435a8c18f04e52df4385fa021

SHA512
f8528a15dab8a24df1485e88f63b65dab0be317dddc7ea37b57e6b82dc9df75b3f623aec0c47c19c9feb8ba090d0573817e3264269bbddd6139543605947250f

Download Submit
C:\Windows\SysWOW64\Lckboblp.exe

Filesize
482KB

MD5
f34550e403a2b21dcdeb1b613bdfc557

SHA1
8fff1ce29e0a55d4954614cfd4bf89f33a2856ef

SHA256
c33a0a6ddc7f8e6cb484a8eb081081f295d458c435a8c18f04e52df4385fa021

SHA512
f8528a15dab8a24df1485e88f63b65dab0be317dddc7ea37b57e6b82dc9df75b3f623aec0c47c19c9feb8ba090d0573817e3264269bbddd6139543605947250f

Download Submit
C:\Windows\SysWOW64\Lebijnak.exe

Filesize
482KB

MD5
2b0b7d5e368afa32eb35b575d8b28a8d

SHA1
ec2df89b415ec8d3b6869ca1374871ea6115aba3

SHA256
71cd366cd6652d3a6e3fcf501f9f3c2b21bf9c2a51dbe9d1a598598d7133a3f7

SHA512
6c8937031d68077f3a8cb127f532830c89483e0fa0fba64b5e65c49e9ca6c3e6de64296aefb54f19dfd6eb6175ca555ce1063f7a05af61b0568cfc60dc92f7e2

Download Submit
C:\Windows\SysWOW64\Lebijnak.exe

Filesize
482KB

MD5
2b0b7d5e368afa32eb35b575d8b28a8d

SHA1
ec2df89b415ec8d3b6869ca1374871ea6115aba3

SHA256
71cd366cd6652d3a6e3fcf501f9f3c2b21bf9c2a51dbe9d1a598598d7133a3f7

SHA512
6c8937031d68077f3a8cb127f532830c89483e0fa0fba64b5e65c49e9ca6c3e6de64296aefb54f19dfd6eb6175ca555ce1063f7a05af61b0568cfc60dc92f7e2

Download Submit
C:\Windows\SysWOW64\Lhdqml32.exe

Filesize
482KB

MD5
1f15fa535da15d6b514621a94f1667b1

SHA1
c1f6207e9f2dac737c7a1dd11419f57dee5e299e

SHA256
da7e35f33b1105609746fe364510322a0c4558a5e4731dc0984f7a58cd844e65

SHA512
6c89b63dbb555a07c6cc62a9faec84e667b021ba00b07052feb8c8e1ab774bbe270d79c59fd086cf41b00f4a2a73be97cbf8ea750ab097ea4928ec21137d5dc4

Download Submit
C:\Windows\SysWOW64\Lomjicei.exe

Filesize
482KB

MD5
5e74556aca9c4c8066159411689cde96

SHA1
8d5d43f24ec544b7b11d181dd08e95769a207ff8

SHA256
ab2ec7c383a3c08b688ddf22274be15838cacb30b9dc3e42bc4a236a14c17140

SHA512
0b3494a2525aee2d030289eacdaf1ef4677a15933dbed8bdb4f4fc677995c85a3fde85da9646cb854ca0a8f0eb27aa6d7b84cc7a738572a00bd8dab28eb12b9b

Download Submit
C:\Windows\SysWOW64\Lomjicei.exe

Filesize
482KB

MD5
5e74556aca9c4c8066159411689cde96

SHA1
8d5d43f24ec544b7b11d181dd08e95769a207ff8

SHA256
ab2ec7c383a3c08b688ddf22274be15838cacb30b9dc3e42bc4a236a14c17140

SHA512
0b3494a2525aee2d030289eacdaf1ef4677a15933dbed8bdb4f4fc677995c85a3fde85da9646cb854ca0a8f0eb27aa6d7b84cc7a738572a00bd8dab28eb12b9b

Download Submit
C:\Windows\SysWOW64\Mcoljagj.exe

Filesize
482KB

MD5
2b2735354631b0970a07fd5239ea79c9

SHA1
2c99c4d6934cd8d2f109bca0d2864b6173a9d484

SHA256
9668874158f17474cf1cb27ebec2726734994596d114cc3d8f711ee4104dc2cb

SHA512
1a1bdd3613fb543652bb9a7bbcb0abc391498261722f08cedca222cd0830bead706b34f72cd44edab908e6d2a986abcaf9f27bb796a08a3805b1bb218a1ecb2a

Download Submit
C:\Windows\SysWOW64\Mcoljagj.exe

Filesize
482KB

MD5
2b2735354631b0970a07fd5239ea79c9

SHA1
2c99c4d6934cd8d2f109bca0d2864b6173a9d484

SHA256
9668874158f17474cf1cb27ebec2726734994596d114cc3d8f711ee4104dc2cb

SHA512
1a1bdd3613fb543652bb9a7bbcb0abc391498261722f08cedca222cd0830bead706b34f72cd44edab908e6d2a986abcaf9f27bb796a08a3805b1bb218a1ecb2a

Download Submit
C:\Windows\SysWOW64\Mpeiie32.exe

Filesize
482KB

MD5
044b15175b4d1c0e12c58355739eadf1

SHA1
82b74a8af88820112377c5d794a63f0ed1b49ee9

SHA256
643923d32f077594fdd8510f948d2f3227fb2c1b299445496d310b1b19524f96

SHA512
66218ac50f2b8a5c2aff80f6488b3d8a0e5f58f3471fa40fa4a1e9ed8f182ffd13a09902839263e7a1bded50755c61ccf2a1360279614c49e564d1ad72b28b59

Download Submit
C:\Windows\SysWOW64\Mpeiie32.exe

Filesize
482KB

MD5
044b15175b4d1c0e12c58355739eadf1

SHA1
82b74a8af88820112377c5d794a63f0ed1b49ee9

SHA256
643923d32f077594fdd8510f948d2f3227fb2c1b299445496d310b1b19524f96

SHA512
66218ac50f2b8a5c2aff80f6488b3d8a0e5f58f3471fa40fa4a1e9ed8f182ffd13a09902839263e7a1bded50755c61ccf2a1360279614c49e564d1ad72b28b59

Download Submit
C:\Windows\SysWOW64\Qmckbjdl.exe

Filesize
482KB

MD5
7ed96c95543ca646359930b92fa1b8ec

SHA1
e9d9aab3ca36608dddc470155dd7cd7142734886

SHA256
8324bfa08f1750b3730ef07c4b6a4799b977a03dae920db597cabcb9aff94c85

SHA512
7e1be49078f91863ad39a513cb53574362f1811d01976f482d37deffdd90b4fac0f3e2cccd594ee1ac210b1031313d940e2775173e3458263b2cba22a264877e

Download Submit
memory/380-120-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/436-384-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/492-47-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/520-299-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/724-72-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/744-152-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/844-280-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1016-320-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1268-39-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1324-96-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1356-363-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1536-176-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1636-168-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1688-329-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1800-136-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1872-407-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1884-311-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2000-293-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2056-420-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2076-16-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2084-8-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2128-88-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2172-433-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2212-112-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2312-262-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2336-104-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2352-335-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2356-80-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2700-453-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2752-377-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2920-361-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3084-63-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3284-435-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3288-255-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3324-375-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3428-192-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3432-349-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3496-224-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3500-128-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3708-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3712-216-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3748-452-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3800-23-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3812-397-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3824-323-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3860-459-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3900-144-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4176-422-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4364-410-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4424-268-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4456-184-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4468-200-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4544-208-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4612-347-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4636-395-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4788-232-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4900-241-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4920-160-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4960-31-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4976-286-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4984-55-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5000-248-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5024-274-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5064-305-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads