4a875a9fc5428f420e232ec80a102d5e4f61e3e4cfaab6f4967e58484afd6cb8

Analysis

max time kernel
170s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 18:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec7f948e09495434c9c7df6c72d2ea08.exe
Size

377KB
MD5

ec7f948e09495434c9c7df6c72d2ea08
SHA1

7050ce4a1ecf5a9c8a3f780003d85e48d895029f
SHA256

4a875a9fc5428f420e232ec80a102d5e4f61e3e4cfaab6f4967e58484afd6cb8
SHA512

f88b87bc6e103fa3bcf5fd17952121408101896b39f000c9ca6170db3ec48fb2228941220812c5cab3b1ee1038515687c61061835721389e9a216bd5e21d009e
SSDEEP

3072:Yrtj0ADsVph0A1UpyNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:Y+apyNl5fKx/SgnohignC5V

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmlicp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accnco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eaddcnad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkeipk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boihcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ombcji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkcccn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkcpia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdffiinp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgbefe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkcpia32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjgifhep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpqonl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehaieh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alkijdci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Moalil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncmaai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bedgejbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edcqojqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdffkgpc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdmecdlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Peodcmeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phfcdcfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abcgii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Immhdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ooaghe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klnkoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acaanp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bleebc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkojo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdffiinp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eaddcnad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdfobe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlbcnd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onnmdcjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gihgfk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipgbdbqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghfnej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	ec7f948e09495434c9c7df6c72d2ea08.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcfggkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nclbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmlhpaji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijolhg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbpjaeoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmfgek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppeipfdm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amblpikl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bemqih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofjokc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abjkmqni.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kigoeagd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iabglnco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enopghee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okmpqjad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nppfnige.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipgbdbqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgelgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igjbci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlgjhp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhgmcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mndjhhjp.exe

Executes dropped EXE 64 IoCs

pid	Process
4876	Onnmdcjm.exe
2500	Ojdnid32.exe
1552	Odmbaj32.exe
2248	Omgcpokp.exe
4448	Pknqoc32.exe
2940	Pefabkej.exe
1756	Palbgl32.exe
1388	Popbpqjh.exe
5092	Pkgcea32.exe
2316	Qdphngfl.exe
3504	Amjillkj.exe
5112	Alkijdci.exe
4540	Adfnofpd.exe
3560	Anobgl32.exe
3356	Alpbecod.exe
2360	Aamknj32.exe
700	Anclbkbp.exe
4340	Alelqb32.exe
1340	Bemqih32.exe
2720	Bnhenj32.exe
4376	Bdbnjdfg.exe
3556	Bafndi32.exe
2388	Bdgged32.exe
2860	Bakgoh32.exe
4332	Blqllqqa.exe
1444	Ckhecmcf.exe
1800	Cbbnpg32.exe
116	Ckjbhmad.exe
4412	Chnbbqpn.exe
4632	Cnkkjh32.exe
1612	Dmlkhofd.exe
1428	Dfdpad32.exe
1040	Domdjj32.exe
4168	Dmadco32.exe
3248	Digehphc.exe
1608	Dbpjaeoc.exe
3760	Dmennnni.exe
3696	Dfnbgc32.exe
4708	Ebdcld32.exe
4260	Eiokinbk.exe
4292	Felbnn32.exe
3704	Flfkkhid.exe
4064	Fbpchb32.exe
3416	Fmfgek32.exe
1148	Fbbpmb32.exe
4872	Flmqlg32.exe
4492	Fiaael32.exe
4368	Fnnjmbpm.exe
2988	Gidnkkpc.exe
3396	Glbjggof.exe
1500	Gfhndpol.exe
4496	Gldglf32.exe
2516	Gihgfk32.exe
4296	Gnepna32.exe
3740	Gikdkj32.exe
4188	Goglcahb.exe
3208	Gimqajgh.exe
4700	Gpgind32.exe
1656	Hedafk32.exe
3984	Hmkigh32.exe
760	Hfcnpn32.exe
3692	Hlpfhe32.exe
1460	Hffken32.exe
3580	Hlbcnd32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ckpkcp32.dll	Qpibke32.exe
File created	C:\Windows\SysWOW64\Apeagd32.exe	Amgekh32.exe
File opened for modification	C:\Windows\SysWOW64\Cljomc32.exe	Cjlbag32.exe
File opened for modification	C:\Windows\SysWOW64\Aemjjeek.exe	Aejmdegn.exe
File opened for modification	C:\Windows\SysWOW64\Mpclce32.exe	Ckbemgcp.exe
File created	C:\Windows\SysWOW64\Glchjedc.exe	Gohapb32.exe
File opened for modification	C:\Windows\SysWOW64\Cpmapodj.exe	Boldhf32.exe
File opened for modification	C:\Windows\SysWOW64\Nfeepdbg.exe	Nnnmogae.exe
File created	C:\Windows\SysWOW64\Apqhldjp.exe	Amblpikl.exe
File created	C:\Windows\SysWOW64\Nppakcok.dll	Hdfobe32.exe
File created	C:\Windows\SysWOW64\Konidd32.dll	Flmqlg32.exe
File created	C:\Windows\SysWOW64\Apjkcadp.exe	Amlogfel.exe
File created	C:\Windows\SysWOW64\Kmegkp32.exe	Kigoeagd.exe
File created	C:\Windows\SysWOW64\Ccjdpeki.dll	Oekpdoll.exe
File created	C:\Windows\SysWOW64\Kmbhlfil.dll	Pllieg32.exe
File created	C:\Windows\SysWOW64\Bmiaacma.dll	Mplapkoj.exe
File created	C:\Windows\SysWOW64\Agdhln32.exe	Process not Found
File created	C:\Windows\SysWOW64\Cjjcof32.exe	Process not Found
File created	C:\Windows\SysWOW64\Gohapb32.exe	Fhllni32.exe
File opened for modification	C:\Windows\SysWOW64\Pifghmae.exe	Pblolb32.exe
File opened for modification	C:\Windows\SysWOW64\Jaimko32.exe	Jjoeoedo.exe
File created	C:\Windows\SysWOW64\Iepaaico.exe	Hoeieolb.exe
File opened for modification	C:\Windows\SysWOW64\Gjficg32.exe	Gclafmej.exe
File created	C:\Windows\SysWOW64\Oloipmfd.exe	Odgqopeb.exe
File created	C:\Windows\SysWOW64\Oefamoma.exe	Obgeqcnn.exe
File opened for modification	C:\Windows\SysWOW64\Olpjii32.exe	Oefamoma.exe
File opened for modification	C:\Windows\SysWOW64\Hhfenc32.exe	Hpomme32.exe
File created	C:\Windows\SysWOW64\Hoeieolb.exe	Hlglidlo.exe
File opened for modification	C:\Windows\SysWOW64\Kckqbj32.exe	Klahfp32.exe
File opened for modification	C:\Windows\SysWOW64\Dgmpkg32.exe	Ckfofe32.exe
File created	C:\Windows\SysWOW64\Fjhiogqh.dll	Mbnjcg32.exe
File created	C:\Windows\SysWOW64\Opcqgh32.exe	Ohjlqklp.exe
File created	C:\Windows\SysWOW64\Hhlpmmgb.dll	Kfnfjehl.exe
File created	C:\Windows\SysWOW64\Odedipge.exe	Obfhmd32.exe
File created	C:\Windows\SysWOW64\Hhqogj32.dll	Pihdnloc.exe
File opened for modification	C:\Windows\SysWOW64\Npbhqj32.exe	Nemcca32.exe
File opened for modification	C:\Windows\SysWOW64\Eaddcnad.exe	Einmaaqb.exe
File opened for modification	C:\Windows\SysWOW64\Pkgcea32.exe	Popbpqjh.exe
File created	C:\Windows\SysWOW64\Nmbjcljl.exe	Mfhbga32.exe
File created	C:\Windows\SysWOW64\Jhqqlmba.exe	Gaoihfoo.exe
File opened for modification	C:\Windows\SysWOW64\Mmlhpaji.exe	Lnkgbibj.exe
File created	C:\Windows\SysWOW64\Oaeegjeb.exe	Ongijo32.exe
File created	C:\Windows\SysWOW64\Joahqn32.exe	Impliekg.exe
File opened for modification	C:\Windows\SysWOW64\Obidcdfo.exe	Okolfj32.exe
File created	C:\Windows\SysWOW64\Coilnkdh.dll	Oghgbe32.exe
File opened for modification	C:\Windows\SysWOW64\Nnnmogae.exe	Nlpabkba.exe
File created	C:\Windows\SysWOW64\Claenb32.exe	Cjbhbf32.exe
File created	C:\Windows\SysWOW64\Nkddhdgk.dll	Njploeoi.exe
File created	C:\Windows\SysWOW64\Aolece32.dll	Fiaael32.exe
File created	C:\Windows\SysWOW64\Dlfniafa.exe	Djgbmffn.exe
File created	C:\Windows\SysWOW64\Aphnnafb.exe	Akkffkhk.exe
File created	C:\Windows\SysWOW64\Ojelio32.dll	Pblolb32.exe
File opened for modification	C:\Windows\SysWOW64\Oelhljaq.exe	Obnlpnbm.exe
File created	C:\Windows\SysWOW64\Jfalhgni.exe	Jdcplkoe.exe
File created	C:\Windows\SysWOW64\Glbjggof.exe	Gidnkkpc.exe
File opened for modification	C:\Windows\SysWOW64\Omnjojpo.exe	Nmkmjjaa.exe
File created	C:\Windows\SysWOW64\Mkepineo.exe	Loopdmpk.exe
File created	C:\Windows\SysWOW64\Kkgepcpk.dll	Jjefao32.exe
File opened for modification	C:\Windows\SysWOW64\Pbbnbkpe.exe	Ppdbfpaa.exe
File created	C:\Windows\SysWOW64\Ohnpbe32.dll	Jinloboo.exe
File created	C:\Windows\SysWOW64\Pnbmmabm.dll	Dmcilgco.exe
File created	C:\Windows\SysWOW64\Ohjlqklp.exe	Oekpdoll.exe
File created	C:\Windows\SysWOW64\Lflbkcll.exe	Lcnfohmi.exe
File created	C:\Windows\SysWOW64\Ibmlia32.dll	Chdialdl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
13060	12696	Process not Found	1170

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlohlk32.dll"	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Okkidceh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahkffqdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Domdjj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Claenb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kcidmkpq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjicah32.dll"	Mkepineo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nejkfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aacjofkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmcgolla.dll"	Gfhndpol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceppfbef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbadmege.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmdnbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbandfpf.dll"	Opdpih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iinjhh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qdoacabq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jaljaoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akggbkke.dll"	Ipdfheal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbpjaeoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ichqihli.dll"	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nclbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bpdnjple.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Abjkmqni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Moehgcil.dll"	Anobgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Doeaaj32.dll"	Knfepldb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Flmqlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcgjjgkh.dll"	Ghfnej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bekmei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bogkmgba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmkmjjaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihknibbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdgmickl.dll"	Pknqoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Plocob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gpaqkgba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnifekmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ponfed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebcclm32.dll"	Jidbpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oeoklp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dcqmpa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Plocob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Goglcahb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpcaaeme.dll"	Ahmjjoig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gdheol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcakilpk.dll"	Acaanp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olpcim32.dll"	Hkbddo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gidnkkpc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhqqlmba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bogkmgba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbbnbemf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bedgejbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ablahjhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddipic32.dll"	Hfcnpn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofjokc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmqjplak.dll"	Gdafgefe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Joahqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abjfai32.dll"	Anclbkbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnkgbibj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Claenb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipckqnja.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 4876	3252	ec7f948e09495434c9c7df6c72d2ea08.exe	90
PID 3252 wrote to memory of 4876	3252	ec7f948e09495434c9c7df6c72d2ea08.exe	90
PID 3252 wrote to memory of 4876	3252	ec7f948e09495434c9c7df6c72d2ea08.exe	90
PID 4876 wrote to memory of 2500	4876	Onnmdcjm.exe	89
PID 4876 wrote to memory of 2500	4876	Onnmdcjm.exe	89
PID 4876 wrote to memory of 2500	4876	Onnmdcjm.exe	89
PID 2500 wrote to memory of 1552	2500	Ojdnid32.exe	91
PID 2500 wrote to memory of 1552	2500	Ojdnid32.exe	91
PID 2500 wrote to memory of 1552	2500	Ojdnid32.exe	91
PID 1552 wrote to memory of 2248	1552	Odmbaj32.exe	92
PID 1552 wrote to memory of 2248	1552	Odmbaj32.exe	92
PID 1552 wrote to memory of 2248	1552	Odmbaj32.exe	92
PID 2248 wrote to memory of 4448	2248	Omgcpokp.exe	281
PID 2248 wrote to memory of 4448	2248	Omgcpokp.exe	281
PID 2248 wrote to memory of 4448	2248	Omgcpokp.exe	281
PID 4448 wrote to memory of 2940	4448	Pknqoc32.exe	279
PID 4448 wrote to memory of 2940	4448	Pknqoc32.exe	279
PID 4448 wrote to memory of 2940	4448	Pknqoc32.exe	279
PID 2940 wrote to memory of 1756	2940	Pefabkej.exe	278
PID 2940 wrote to memory of 1756	2940	Pefabkej.exe	278
PID 2940 wrote to memory of 1756	2940	Pefabkej.exe	278
PID 1756 wrote to memory of 1388	1756	Palbgl32.exe	277
PID 1756 wrote to memory of 1388	1756	Palbgl32.exe	277
PID 1756 wrote to memory of 1388	1756	Palbgl32.exe	277
PID 1388 wrote to memory of 5092	1388	Popbpqjh.exe	276
PID 1388 wrote to memory of 5092	1388	Popbpqjh.exe	276
PID 1388 wrote to memory of 5092	1388	Popbpqjh.exe	276
PID 5092 wrote to memory of 2316	5092	Pkgcea32.exe	275
PID 5092 wrote to memory of 2316	5092	Pkgcea32.exe	275
PID 5092 wrote to memory of 2316	5092	Pkgcea32.exe	275
PID 2316 wrote to memory of 3504	2316	Qdphngfl.exe	274
PID 2316 wrote to memory of 3504	2316	Qdphngfl.exe	274
PID 2316 wrote to memory of 3504	2316	Qdphngfl.exe	274
PID 3504 wrote to memory of 5112	3504	Amjillkj.exe	93
PID 3504 wrote to memory of 5112	3504	Amjillkj.exe	93
PID 3504 wrote to memory of 5112	3504	Amjillkj.exe	93
PID 5112 wrote to memory of 4540	5112	Alkijdci.exe	272
PID 5112 wrote to memory of 4540	5112	Alkijdci.exe	272
PID 5112 wrote to memory of 4540	5112	Alkijdci.exe	272
PID 4540 wrote to memory of 3560	4540	Adfnofpd.exe	94
PID 4540 wrote to memory of 3560	4540	Adfnofpd.exe	94
PID 4540 wrote to memory of 3560	4540	Adfnofpd.exe	94
PID 3560 wrote to memory of 3356	3560	Anobgl32.exe	95
PID 3560 wrote to memory of 3356	3560	Anobgl32.exe	95
PID 3560 wrote to memory of 3356	3560	Anobgl32.exe	95
PID 3356 wrote to memory of 2360	3356	Alpbecod.exe	96
PID 3356 wrote to memory of 2360	3356	Alpbecod.exe	96
PID 3356 wrote to memory of 2360	3356	Alpbecod.exe	96
PID 2360 wrote to memory of 700	2360	Aamknj32.exe	97
PID 2360 wrote to memory of 700	2360	Aamknj32.exe	97
PID 2360 wrote to memory of 700	2360	Aamknj32.exe	97
PID 700 wrote to memory of 4340	700	Anclbkbp.exe	271
PID 700 wrote to memory of 4340	700	Anclbkbp.exe	271
PID 700 wrote to memory of 4340	700	Anclbkbp.exe	271
PID 4340 wrote to memory of 1340	4340	Alelqb32.exe	270
PID 4340 wrote to memory of 1340	4340	Alelqb32.exe	270
PID 4340 wrote to memory of 1340	4340	Alelqb32.exe	270
PID 1340 wrote to memory of 2720	1340	Bemqih32.exe	269
PID 1340 wrote to memory of 2720	1340	Bemqih32.exe	269
PID 1340 wrote to memory of 2720	1340	Bemqih32.exe	269
PID 2720 wrote to memory of 4376	2720	Bnhenj32.exe	268
PID 2720 wrote to memory of 4376	2720	Bnhenj32.exe	268
PID 2720 wrote to memory of 4376	2720	Bnhenj32.exe	268
PID 4376 wrote to memory of 3556	4376	Bdbnjdfg.exe	98

C:\Users\Admin\AppData\Local\Temp\ec7f948e09495434c9c7df6c72d2ea08.exe
"C:\Users\Admin\AppData\Local\Temp\ec7f948e09495434c9c7df6c72d2ea08.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\SysWOW64\Onnmdcjm.exe
  C:\Windows\system32\Onnmdcjm.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4876

C:\Windows\SysWOW64\Ojdnid32.exe
C:\Windows\system32\Ojdnid32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\Odmbaj32.exe
  C:\Windows\system32\Odmbaj32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\SysWOW64\Omgcpokp.exe
    C:\Windows\system32\Omgcpokp.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - C:\Windows\SysWOW64\Pknqoc32.exe
      C:\Windows\system32\Pknqoc32.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4448
    - - C:\Windows\SysWOW64\Bodano32.exe
        
        C:\Windows\system32\Bodano32.exe
        5⤵
        
        PID:8308
      - C:\Windows\SysWOW64\Bgkipl32.exe
        
        C:\Windows\system32\Bgkipl32.exe
        6⤵
        
        PID:1176

C:\Windows\SysWOW64\Alkijdci.exe
C:\Windows\system32\Alkijdci.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\Adfnofpd.exe
  C:\Windows\system32\Adfnofpd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4540

C:\Windows\SysWOW64\Anobgl32.exe
C:\Windows\system32\Anobgl32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\SysWOW64\Alpbecod.exe
  C:\Windows\system32\Alpbecod.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\SysWOW64\Aamknj32.exe
    C:\Windows\system32\Aamknj32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Windows\SysWOW64\Anclbkbp.exe
      C:\Windows\system32\Anclbkbp.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:700
    - - C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4340
  - - C:\Windows\SysWOW64\Pchljlpo.exe
      C:\Windows\system32\Pchljlpo.exe
      4⤵
      PID:8508
    - - C:\Windows\SysWOW64\Pefhfgoc.exe
        
        C:\Windows\system32\Pefhfgoc.exe
        5⤵
        
        PID:6084
      - C:\Windows\SysWOW64\Phddbbnf.exe
        
        C:\Windows\system32\Phddbbnf.exe
        6⤵
        
        PID:5240

C:\Windows\SysWOW64\Bafndi32.exe
C:\Windows\system32\Bafndi32.exe
1⤵
- Executes dropped EXE
PID:3556
- C:\Windows\SysWOW64\Bdgged32.exe
  C:\Windows\system32\Bdgged32.exe
  2⤵
  - Executes dropped EXE
  PID:2388

C:\Windows\SysWOW64\Bakgoh32.exe
C:\Windows\system32\Bakgoh32.exe
1⤵
- Executes dropped EXE
PID:2860
- C:\Windows\SysWOW64\Blqllqqa.exe
  C:\Windows\system32\Blqllqqa.exe
  2⤵
  - Executes dropped EXE
  PID:4332

C:\Windows\SysWOW64\Ckhecmcf.exe
C:\Windows\system32\Ckhecmcf.exe
1⤵
- Executes dropped EXE
PID:1444
- C:\Windows\SysWOW64\Cbbnpg32.exe
  C:\Windows\system32\Cbbnpg32.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- - C:\Windows\SysWOW64\Ckjbhmad.exe
    C:\Windows\system32\Ckjbhmad.exe
    3⤵
    - Executes dropped EXE
    PID:116

C:\Windows\SysWOW64\Chnbbqpn.exe
C:\Windows\system32\Chnbbqpn.exe
1⤵
- Executes dropped EXE
PID:4412
- C:\Windows\SysWOW64\Cnkkjh32.exe
  C:\Windows\system32\Cnkkjh32.exe
  2⤵
  - Executes dropped EXE
  PID:4632

C:\Windows\SysWOW64\Dfdpad32.exe
C:\Windows\system32\Dfdpad32.exe
1⤵
- Executes dropped EXE
PID:1428
- C:\Windows\SysWOW64\Domdjj32.exe
  C:\Windows\system32\Domdjj32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:1040
- - C:\Windows\SysWOW64\Dmadco32.exe
    C:\Windows\system32\Dmadco32.exe
    3⤵
    - Executes dropped EXE
    PID:4168
  - - C:\Windows\SysWOW64\Digehphc.exe
      C:\Windows\system32\Digehphc.exe
      4⤵
      Executes dropped EXE
      PID:3248
- C:\Windows\SysWOW64\Olbdacbp.exe
  C:\Windows\system32\Olbdacbp.exe
  2⤵
  PID:6688
- - C:\Windows\SysWOW64\Ooqqmoac.exe
    C:\Windows\system32\Ooqqmoac.exe
    3⤵
    PID:4392
  - - C:\Windows\SysWOW64\Oejijiip.exe
      C:\Windows\system32\Oejijiip.exe
      4⤵
      PID:7052
    - - C:\Windows\SysWOW64\Ohiefdhd.exe
        
        C:\Windows\system32\Ohiefdhd.exe
        5⤵
        
        PID:5992

C:\Windows\SysWOW64\Dbpjaeoc.exe
C:\Windows\system32\Dbpjaeoc.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1608
- C:\Windows\SysWOW64\Dmennnni.exe
  C:\Windows\system32\Dmennnni.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- - C:\Windows\SysWOW64\Dfnbgc32.exe
    C:\Windows\system32\Dfnbgc32.exe
    3⤵
    - Executes dropped EXE
    PID:3696
  - - C:\Windows\SysWOW64\Ebdcld32.exe
      C:\Windows\system32\Ebdcld32.exe
      4⤵
      Executes dropped EXE
      PID:4708
    - - C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        5⤵
        Executes dropped EXE
        
        PID:4260
      - C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        6⤵
        Executes dropped EXE
        
        PID:4292
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        7⤵
        Executes dropped EXE
        
        PID:3704
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        8⤵
        Executes dropped EXE
        
        PID:4064
- - C:\Windows\SysWOW64\Eipigqop.exe
    C:\Windows\system32\Eipigqop.exe
    3⤵
    PID:2372
  - - C:\Windows\SysWOW64\Epjadk32.exe
      C:\Windows\system32\Epjadk32.exe
      4⤵
      PID:3540
    - - C:\Windows\SysWOW64\Ehaieh32.exe
        
        C:\Windows\system32\Ehaieh32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8492

C:\Windows\SysWOW64\Fbbpmb32.exe
C:\Windows\system32\Fbbpmb32.exe
1⤵
- Executes dropped EXE
PID:1148
- C:\Windows\SysWOW64\Flmqlg32.exe
  C:\Windows\system32\Flmqlg32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  PID:4872
- - C:\Windows\SysWOW64\Fiaael32.exe
    C:\Windows\system32\Fiaael32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4492
  - - C:\Windows\SysWOW64\Fnnjmbpm.exe
      C:\Windows\system32\Fnnjmbpm.exe
      4⤵
      Executes dropped EXE
      PID:4368
    - - C:\Windows\SysWOW64\Dodjemee.exe
        
        C:\Windows\system32\Dodjemee.exe
        5⤵
        
        PID:7336
      - C:\Windows\SysWOW64\Dcpffk32.exe
        
        C:\Windows\system32\Dcpffk32.exe
        6⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Dgplai32.exe
        
        C:\Windows\system32\Dgplai32.exe
        7⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Nbkojo32.exe
        
        C:\Windows\system32\Nbkojo32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6188
        
        C:\Windows\SysWOW64\Nejkfj32.exe
        
        C:\Windows\system32\Nejkfj32.exe
        9⤵
        Modifies registry class
        
        PID:5432
        
        C:\Windows\SysWOW64\Oghgbe32.exe
        
        C:\Windows\system32\Oghgbe32.exe
        10⤵
        Drops file in System32 directory
        
        PID:8068
        
        C:\Windows\SysWOW64\Oooodcci.exe
        
        C:\Windows\system32\Oooodcci.exe
        11⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Obnlpnbm.exe
        
        C:\Windows\system32\Obnlpnbm.exe
        12⤵
        Drops file in System32 directory
        
        PID:8736
        
        C:\Windows\SysWOW64\Oelhljaq.exe
        
        C:\Windows\system32\Oelhljaq.exe
        13⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Ogjdheqd.exe
        
        C:\Windows\system32\Ogjdheqd.exe
        14⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Ooalibaf.exe
        
        C:\Windows\system32\Ooalibaf.exe
        15⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Obphenpj.exe
        
        C:\Windows\system32\Obphenpj.exe
        16⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Oendaipn.exe
        
        C:\Windows\system32\Oendaipn.exe
        17⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Ogmaneoa.exe
        
        C:\Windows\system32\Ogmaneoa.exe
        18⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Ongijo32.exe
        
        C:\Windows\system32\Ongijo32.exe
        19⤵
        Drops file in System32 directory
        
        PID:7328
        
        C:\Windows\SysWOW64\Oaeegjeb.exe
        
        C:\Windows\system32\Oaeegjeb.exe
        20⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Oilmhhfd.exe
        
        C:\Windows\system32\Oilmhhfd.exe
        21⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Okkidceh.exe
        
        C:\Windows\system32\Okkidceh.exe
        22⤵
        Modifies registry class
        
        PID:9156
        
        C:\Windows\SysWOW64\Onifpodl.exe
        
        C:\Windows\system32\Onifpodl.exe
        23⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\Ogajid32.exe
        
        C:\Windows\system32\Ogajid32.exe
        24⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Ophbja32.exe
        
        C:\Windows\system32\Ophbja32.exe
        25⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Obgofmjb.exe
        
        C:\Windows\system32\Obgofmjb.exe
        26⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Oiagcg32.exe
        
        C:\Windows\system32\Oiagcg32.exe
        27⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Plocob32.exe
        
        C:\Windows\system32\Plocob32.exe
        28⤵
        Modifies registry class
        
        PID:8284
        
        C:\Windows\SysWOW64\Pnnokn32.exe
        
        C:\Windows\system32\Pnnokn32.exe
        29⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\Palkgi32.exe
        
        C:\Windows\system32\Palkgi32.exe
        30⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\Phfcdcfg.exe
        
        C:\Windows\system32\Phfcdcfg.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:752
        
        C:\Windows\SysWOW64\Ppmleagi.exe
        
        C:\Windows\system32\Ppmleagi.exe
        32⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Pblhalfm.exe
        
        C:\Windows\system32\Pblhalfm.exe
        33⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Pneelmjo.exe
        
        C:\Windows\system32\Pneelmjo.exe
        34⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Pacahhib.exe
        
        C:\Windows\system32\Pacahhib.exe
        35⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Phmjdbpo.exe
        
        C:\Windows\system32\Phmjdbpo.exe
        36⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\Ppdbfpaa.exe
        
        C:\Windows\system32\Ppdbfpaa.exe
        37⤵
        Drops file in System32 directory
        
        PID:8288
        
        C:\Windows\SysWOW64\Pbbnbkpe.exe
        
        C:\Windows\system32\Pbbnbkpe.exe
        38⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Peajngoi.exe
        
        C:\Windows\system32\Peajngoi.exe
        39⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Qhofjbnl.exe
        
        C:\Windows\system32\Qhofjbnl.exe
        40⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Qpfokpoo.exe
        
        C:\Windows\system32\Qpfokpoo.exe
        41⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Qahkch32.exe
        
        C:\Windows\system32\Qahkch32.exe
        42⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Qiocde32.exe
        
        C:\Windows\system32\Qiocde32.exe
        43⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\Qpikao32.exe
        
        C:\Windows\system32\Qpikao32.exe
        44⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Qbggmk32.exe
        
        C:\Windows\system32\Qbggmk32.exe
        45⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Aiapjecl.exe
        
        C:\Windows\system32\Aiapjecl.exe
        46⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Alplfpbp.exe
        
        C:\Windows\system32\Alplfpbp.exe
        47⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Aonhblad.exe
        
        C:\Windows\system32\Aonhblad.exe
        48⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\Aaldngqg.exe
        
        C:\Windows\system32\Aaldngqg.exe
        49⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Aiclodaj.exe
        
        C:\Windows\system32\Aiclodaj.exe
        50⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\Albikp32.exe
        
        C:\Windows\system32\Albikp32.exe
        51⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Ablahjhj.exe
        
        C:\Windows\system32\Ablahjhj.exe
        52⤵
        Modifies registry class
        
        PID:1812
        
        C:\Windows\SysWOW64\Aejmdegn.exe
        
        C:\Windows\system32\Aejmdegn.exe
        53⤵
        Drops file in System32 directory
        
        PID:2292
        
        C:\Windows\SysWOW64\Aemjjeek.exe
        
        C:\Windows\system32\Aemjjeek.exe
        54⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Ahkffqdo.exe
        
        C:\Windows\system32\Ahkffqdo.exe
        55⤵
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Aacjofkp.exe
        
        C:\Windows\system32\Aacjofkp.exe
        56⤵
        Modifies registry class
        
        PID:8680
        
        C:\Windows\SysWOW64\Ahnclp32.exe
        
        C:\Windows\system32\Ahnclp32.exe
        57⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Abcgii32.exe
        
        C:\Windows\system32\Abcgii32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5408
        
        C:\Windows\SysWOW64\Blnhgn32.exe
        
        C:\Windows\system32\Blnhgn32.exe
        59⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Boldcj32.exe
        
        C:\Windows\system32\Boldcj32.exe
        60⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Bhdilold.exe
        
        C:\Windows\system32\Bhdilold.exe
        61⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Bhgeao32.exe
        
        C:\Windows\system32\Bhgeao32.exe
        62⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Boanniao.exe
        
        C:\Windows\system32\Boanniao.exe
        63⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\Bekfkc32.exe
        
        C:\Windows\system32\Bekfkc32.exe
        64⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Bhibgo32.exe
        
        C:\Windows\system32\Bhibgo32.exe
        65⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\Bocjdiol.exe
        
        C:\Windows\system32\Bocjdiol.exe
        66⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Cemcqcgi.exe
        
        C:\Windows\system32\Cemcqcgi.exe
        67⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Ceppfbef.exe
        
        C:\Windows\system32\Ceppfbef.exe
        68⤵
        Modifies registry class
        
        PID:8944
        
        C:\Windows\SysWOW64\Clihcm32.exe
        
        C:\Windows\system32\Clihcm32.exe
        69⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\Cohdoh32.exe
        
        C:\Windows\system32\Cohdoh32.exe
        70⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Caimachg.exe
        
        C:\Windows\system32\Caimachg.exe
        71⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Ijolhg32.exe
        
        C:\Windows\system32\Ijolhg32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8712
        
        C:\Windows\SysWOW64\Bfbahcfc.exe
        
        C:\Windows\system32\Bfbahcfc.exe
        63⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Bhqmdoef.exe
        
        C:\Windows\system32\Bhqmdoef.exe
        64⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Bkoiqjdj.exe
        
        C:\Windows\system32\Bkoiqjdj.exe
        65⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Ebjckppa.exe
        
        C:\Windows\system32\Ebjckppa.exe
        61⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\Ejaklmpd.exe
        
        C:\Windows\system32\Ejaklmpd.exe
        62⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Elbhde32.exe
        
        C:\Windows\system32\Elbhde32.exe
        63⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\Ihbdja32.exe
        
        C:\Windows\system32\Ihbdja32.exe
        51⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Okgabpgg.exe
        
        C:\Windows\system32\Okgabpgg.exe
        50⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\Oaajoj32.exe
        
        C:\Windows\system32\Oaajoj32.exe
        51⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Oihapg32.exe
        
        C:\Windows\system32\Oihapg32.exe
        52⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Hdmecdlh.exe
        
        C:\Windows\system32\Hdmecdlh.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6984
        
        C:\Windows\SysWOW64\Hglaookl.exe
        
        C:\Windows\system32\Hglaookl.exe
        29⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Hjjnkkjp.exe
        
        C:\Windows\system32\Hjjnkkjp.exe
        30⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Djqbeonf.exe
        
        C:\Windows\system32\Djqbeonf.exe
        14⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Dmooak32.exe
        
        C:\Windows\system32\Dmooak32.exe
        15⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Dpmknf32.exe
        
        C:\Windows\system32\Dpmknf32.exe
        16⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Hknkiokp.exe
        
        C:\Windows\system32\Hknkiokp.exe
        13⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Hnlgekkc.exe
        
        C:\Windows\system32\Hnlgekkc.exe
        14⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Ahgjnpna.exe
        
        C:\Windows\system32\Ahgjnpna.exe
        10⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Akffjkme.exe
        
        C:\Windows\system32\Akffjkme.exe
        11⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Bbpoge32.exe
        
        C:\Windows\system32\Bbpoge32.exe
        12⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Bjgghc32.exe
        
        C:\Windows\system32\Bjgghc32.exe
        13⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Blecdn32.exe
        
        C:\Windows\system32\Blecdn32.exe
        14⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Nhmejf32.exe
        
        C:\Windows\system32\Nhmejf32.exe
        9⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Nklbfaae.exe
        
        C:\Windows\system32\Nklbfaae.exe
        10⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Nbcjhobg.exe
        
        C:\Windows\system32\Nbcjhobg.exe
        11⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Nhpbpepo.exe
        
        C:\Windows\system32\Nhpbpepo.exe
        12⤵
        
        PID:4628

C:\Windows\SysWOW64\Fmfgek32.exe
C:\Windows\system32\Fmfgek32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3416

C:\Windows\SysWOW64\Gidnkkpc.exe
C:\Windows\system32\Gidnkkpc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2988
- C:\Windows\SysWOW64\Glbjggof.exe
  C:\Windows\system32\Glbjggof.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- - C:\Windows\SysWOW64\Gfhndpol.exe
    C:\Windows\system32\Gfhndpol.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:1500
  - - C:\Windows\SysWOW64\Gldglf32.exe
      C:\Windows\system32\Gldglf32.exe
      4⤵
      Executes dropped EXE
      PID:4496
    - - C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2516
      - C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        6⤵
        Executes dropped EXE
        
        PID:4296
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        7⤵
        Executes dropped EXE
        
        PID:3740
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4188

C:\Windows\SysWOW64\Gimqajgh.exe
C:\Windows\system32\Gimqajgh.exe
1⤵
- Executes dropped EXE
PID:3208
- C:\Windows\SysWOW64\Gpgind32.exe
  C:\Windows\system32\Gpgind32.exe
  2⤵
  - Executes dropped EXE
  PID:4700

C:\Windows\SysWOW64\Hedafk32.exe
C:\Windows\system32\Hedafk32.exe
1⤵
- Executes dropped EXE
PID:1656
- C:\Windows\SysWOW64\Hmkigh32.exe
  C:\Windows\system32\Hmkigh32.exe
  2⤵
  - Executes dropped EXE
  PID:3984

C:\Windows\SysWOW64\Hlpfhe32.exe
C:\Windows\system32\Hlpfhe32.exe
1⤵
- Executes dropped EXE
PID:3692
- C:\Windows\SysWOW64\Hffken32.exe
  C:\Windows\system32\Hffken32.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- - C:\Windows\SysWOW64\Hlbcnd32.exe
    C:\Windows\system32\Hlbcnd32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    PID:3580
  - - C:\Windows\SysWOW64\Hblkjo32.exe
      C:\Windows\system32\Hblkjo32.exe
      4⤵
      PID:4484
    - - C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        5⤵
        
        PID:1864
      - C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        6⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        7⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        8⤵
        Drops file in System32 directory
        
        PID:540
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        9⤵
        Drops file in System32 directory
        
        PID:2292
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        10⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        11⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        12⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        13⤵
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5296
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        15⤵
        
        PID:5332

C:\Windows\SysWOW64\Iipfmggc.exe
C:\Windows\system32\Iipfmggc.exe
1⤵
PID:5372
- C:\Windows\SysWOW64\Ipjoja32.exe
  C:\Windows\system32\Ipjoja32.exe
  2⤵
  PID:5408
- - C:\Windows\SysWOW64\Ibhkfm32.exe
    C:\Windows\system32\Ibhkfm32.exe
    3⤵
    PID:5448
  - - C:\Windows\SysWOW64\Iibccgep.exe
      C:\Windows\system32\Iibccgep.exe
      4⤵
      PID:5484
    - - C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        5⤵
        
        PID:5524
      - C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        6⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        7⤵
        Drops file in System32 directory
        
        PID:5608
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        8⤵
        Modifies registry class
        
        PID:5648
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        9⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        10⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        11⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        12⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        13⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        14⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        15⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        16⤵
        
        PID:5968
  - - C:\Windows\SysWOW64\Bedgejbo.exe
      C:\Windows\system32\Bedgejbo.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Modifies registry class
      PID:8172
    - - C:\Windows\SysWOW64\Bmlofhca.exe
        
        C:\Windows\system32\Bmlofhca.exe
        5⤵
        
        PID:4676
      - C:\Windows\SysWOW64\Bomknp32.exe
        
        C:\Windows\system32\Bomknp32.exe
        6⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\Bgdcom32.exe
        
        C:\Windows\system32\Bgdcom32.exe
        7⤵
        
        PID:8408

C:\Windows\SysWOW64\Jcfggkac.exe
C:\Windows\system32\Jcfggkac.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6012
- C:\Windows\SysWOW64\Jedccfqg.exe
  C:\Windows\system32\Jedccfqg.exe
  2⤵
  PID:6052
- - C:\Windows\SysWOW64\Jlolpq32.exe
    C:\Windows\system32\Jlolpq32.exe
    3⤵
    PID:6092
  - - C:\Windows\SysWOW64\Kcidmkpq.exe
      C:\Windows\system32\Kcidmkpq.exe
      4⤵
      Modifies registry class
      PID:6132

C:\Windows\SysWOW64\Kjblje32.exe
C:\Windows\system32\Kjblje32.exe
1⤵
PID:5160
- C:\Windows\SysWOW64\Klahfp32.exe
  C:\Windows\system32\Klahfp32.exe
  2⤵
  - Drops file in System32 directory
  PID:5252
- - C:\Windows\SysWOW64\Kckqbj32.exe
    C:\Windows\system32\Kckqbj32.exe
    3⤵
    PID:5292
  - - C:\Windows\SysWOW64\Knqepc32.exe
      C:\Windows\system32\Knqepc32.exe
      4⤵
      PID:5364
    - - C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        5⤵
        
        PID:5472
      - C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        6⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        7⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        8⤵
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        9⤵
        
        PID:5780

C:\Windows\SysWOW64\Kpcjgnhb.exe
C:\Windows\system32\Kpcjgnhb.exe
1⤵
PID:5840
- C:\Windows\SysWOW64\Kgnbdh32.exe
  C:\Windows\system32\Kgnbdh32.exe
  2⤵
  PID:5912
- - C:\Windows\SysWOW64\Lomqcjie.exe
    C:\Windows\system32\Lomqcjie.exe
    3⤵
    PID:5980
  - - C:\Windows\SysWOW64\Lgdidgjg.exe
      C:\Windows\system32\Lgdidgjg.exe
      4⤵
      PID:6060
    - - C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        5⤵
        
        PID:6120
  - - C:\Windows\SysWOW64\Hjhaeklb.exe
      C:\Windows\system32\Hjhaeklb.exe
      4⤵
      PID:5808

C:\Windows\SysWOW64\Hfcnpn32.exe
C:\Windows\system32\Hfcnpn32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:760

C:\Windows\SysWOW64\Lopmii32.exe
C:\Windows\system32\Lopmii32.exe
1⤵
PID:5248
- C:\Windows\SysWOW64\Lggejg32.exe
  C:\Windows\system32\Lggejg32.exe
  2⤵
  PID:5280
- - C:\Windows\SysWOW64\Lmdnbn32.exe
    C:\Windows\system32\Lmdnbn32.exe
    3⤵
    - Modifies registry class
    PID:3512
  - - C:\Windows\SysWOW64\Lcnfohmi.exe
      C:\Windows\system32\Lcnfohmi.exe
      4⤵
      Drops file in System32 directory
      PID:5512

C:\Windows\SysWOW64\Lflbkcll.exe
C:\Windows\system32\Lflbkcll.exe
1⤵
PID:5656
- C:\Windows\SysWOW64\Mmfkhmdi.exe
  C:\Windows\system32\Mmfkhmdi.exe
  2⤵
  PID:5768
- - C:\Windows\SysWOW64\Mgloefco.exe
    C:\Windows\system32\Mgloefco.exe
    3⤵
    PID:5956

C:\Windows\SysWOW64\Mmhgmmbf.exe
C:\Windows\system32\Mmhgmmbf.exe
1⤵
PID:6036
- C:\Windows\SysWOW64\Mcbpjg32.exe
  C:\Windows\system32\Mcbpjg32.exe
  2⤵
  PID:5264
- - C:\Windows\SysWOW64\Mjlhgaqp.exe
    C:\Windows\system32\Mjlhgaqp.exe
    3⤵
    PID:5516
  - - C:\Windows\SysWOW64\Mcelpggq.exe
      C:\Windows\system32\Mcelpggq.exe
      4⤵
      PID:5684
    - - C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        5⤵
        
        PID:5936

C:\Windows\SysWOW64\Mgbefe32.exe
C:\Windows\system32\Mgbefe32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5360
- C:\Windows\SysWOW64\Mqkiok32.exe
  C:\Windows\system32\Mqkiok32.exe
  2⤵
  PID:5720
- - C:\Windows\SysWOW64\Mfhbga32.exe
    C:\Windows\system32\Mfhbga32.exe
    3⤵
    - Drops file in System32 directory
    PID:360
  - - C:\Windows\SysWOW64\Nmbjcljl.exe
      C:\Windows\system32\Nmbjcljl.exe
      4⤵
      PID:3672
    - - C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2008
      - C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        6⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        7⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        8⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        9⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        10⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6344

C:\Windows\SysWOW64\Omnjojpo.exe
C:\Windows\system32\Omnjojpo.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6388
- C:\Windows\SysWOW64\Oplfkeob.exe
  C:\Windows\system32\Oplfkeob.exe
  2⤵
  PID:6440
- - C:\Windows\SysWOW64\Offnhpfo.exe
    C:\Windows\system32\Offnhpfo.exe
    3⤵
    PID:6496
  - - C:\Windows\SysWOW64\Opnbae32.exe
      C:\Windows\system32\Opnbae32.exe
      4⤵
      PID:6548
    - - C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        5⤵
        
        PID:6592
  - - C:\Windows\SysWOW64\Bkjpek32.exe
      C:\Windows\system32\Bkjpek32.exe
      4⤵
      PID:6640
    - - C:\Windows\SysWOW64\Bcahgh32.exe
        
        C:\Windows\system32\Bcahgh32.exe
        5⤵
        
        PID:8628
      - C:\Windows\SysWOW64\Bfpdcc32.exe
        
        C:\Windows\system32\Bfpdcc32.exe
        6⤵
        
        PID:8268

C:\Windows\SysWOW64\Ombcji32.exe
C:\Windows\system32\Ombcji32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6628
- C:\Windows\SysWOW64\Oclkgccf.exe
  C:\Windows\system32\Oclkgccf.exe
  2⤵
  PID:6672
- - C:\Windows\SysWOW64\Onapdl32.exe
    C:\Windows\system32\Onapdl32.exe
    3⤵
    PID:6708
  - - C:\Windows\SysWOW64\Opclldhj.exe
      C:\Windows\system32\Opclldhj.exe
      4⤵
      PID:6784
    - - C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        5⤵
        
        PID:6824
      - C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        6⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        7⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        8⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        9⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Copajm32.exe
        
        C:\Windows\system32\Copajm32.exe
        7⤵
        
        PID:360
        
        C:\Windows\SysWOW64\Cfiiggpg.exe
        
        C:\Windows\system32\Cfiiggpg.exe
        8⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Dnqaheai.exe
        
        C:\Windows\system32\Dnqaheai.exe
        9⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\Dqomdppm.exe
        
        C:\Windows\system32\Dqomdppm.exe
        10⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Dcmjpl32.exe
        
        C:\Windows\system32\Dcmjpl32.exe
        11⤵
        
        PID:6304

C:\Windows\SysWOW64\Pnifekmd.exe
C:\Windows\system32\Pnifekmd.exe
1⤵
- Modifies registry class
PID:7036
- C:\Windows\SysWOW64\Pplobcpp.exe
  C:\Windows\system32\Pplobcpp.exe
  2⤵
  PID:7080

C:\Windows\SysWOW64\Pjbcplpe.exe
C:\Windows\system32\Pjbcplpe.exe
1⤵
PID:7120
- C:\Windows\SysWOW64\Ppolhcnm.exe
  C:\Windows\system32\Ppolhcnm.exe
  2⤵
  PID:1092
- - C:\Windows\SysWOW64\Pjdpelnc.exe
    C:\Windows\system32\Pjdpelnc.exe
    3⤵
    PID:6228
  - - C:\Windows\SysWOW64\Ppahmb32.exe
      C:\Windows\system32\Ppahmb32.exe
      4⤵
      PID:6340

C:\Windows\SysWOW64\Qmeigg32.exe
C:\Windows\system32\Qmeigg32.exe
1⤵
PID:6424
- C:\Windows\SysWOW64\Qdoacabq.exe
  C:\Windows\system32\Qdoacabq.exe
  2⤵
  - Modifies registry class
  PID:6512
- - C:\Windows\SysWOW64\Qodeajbg.exe
    C:\Windows\system32\Qodeajbg.exe
    3⤵
    PID:6572
  - - C:\Windows\SysWOW64\Qacameaj.exe
      C:\Windows\system32\Qacameaj.exe
      4⤵
      PID:6636
    - - C:\Windows\SysWOW64\Olgnlb32.exe
        
        C:\Windows\system32\Olgnlb32.exe
        5⤵
        
        PID:6848
      - C:\Windows\SysWOW64\Ooejhn32.exe
        
        C:\Windows\system32\Ooejhn32.exe
        6⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Pacfdila.exe
        
        C:\Windows\system32\Pacfdila.exe
        7⤵
        
        PID:7132

C:\Windows\SysWOW64\Ahmjjoig.exe
C:\Windows\system32\Ahmjjoig.exe
1⤵
- Modifies registry class
PID:6700
- C:\Windows\SysWOW64\Akkffkhk.exe
  C:\Windows\system32\Akkffkhk.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Drops file in System32 directory
  PID:6792
- - C:\Windows\SysWOW64\Aphnnafb.exe
    C:\Windows\system32\Aphnnafb.exe
    3⤵
    PID:6856
  - - C:\Windows\SysWOW64\Afbgkl32.exe
      C:\Windows\system32\Afbgkl32.exe
      4⤵
      PID:6924
    - - C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        5⤵
        Drops file in System32 directory
        
        PID:6992
      - C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        6⤵
        
        PID:7048

C:\Windows\SysWOW64\Agdcpkll.exe
C:\Windows\system32\Agdcpkll.exe
1⤵
PID:7108
- C:\Windows\SysWOW64\Amnlme32.exe
  C:\Windows\system32\Amnlme32.exe
  2⤵
  PID:544
- - C:\Windows\SysWOW64\Apmhiq32.exe
    C:\Windows\system32\Apmhiq32.exe
    3⤵
    PID:5960
  - - C:\Windows\SysWOW64\Aggpfkjj.exe
      C:\Windows\system32\Aggpfkjj.exe
      4⤵
      Modifies registry class
      PID:6372
    - - C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        5⤵
        
        PID:6540
      - C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        6⤵
        
        PID:6640

C:\Windows\SysWOW64\Amcehdod.exe
C:\Windows\system32\Amcehdod.exe
1⤵
- Modifies registry class
PID:6744
- C:\Windows\SysWOW64\Bhhiemoj.exe
  C:\Windows\system32\Bhhiemoj.exe
  2⤵
  PID:6892
- - C:\Windows\SysWOW64\Bobabg32.exe
    C:\Windows\system32\Bobabg32.exe
    3⤵
    PID:7068
  - - C:\Windows\SysWOW64\Bpdnjple.exe
      C:\Windows\system32\Bpdnjple.exe
      4⤵
      Modifies registry class
      PID:7152

C:\Windows\SysWOW64\Bhkfkmmg.exe
C:\Windows\system32\Bhkfkmmg.exe
1⤵
PID:6256
- C:\Windows\SysWOW64\Boenhgdd.exe
  C:\Windows\system32\Boenhgdd.exe
  2⤵
  PID:6480
- - C:\Windows\SysWOW64\Bpfkpp32.exe
    C:\Windows\system32\Bpfkpp32.exe
    3⤵
    PID:1012

C:\Windows\SysWOW64\Bhmbqm32.exe
C:\Windows\system32\Bhmbqm32.exe
1⤵
PID:7216
- C:\Windows\SysWOW64\Bogkmgba.exe
  C:\Windows\system32\Bogkmgba.exe
  2⤵
  - Modifies registry class
  PID:7256
- - C:\Windows\SysWOW64\Bphgeo32.exe
    C:\Windows\system32\Bphgeo32.exe
    3⤵
    PID:7304
  - - C:\Windows\SysWOW64\Bhpofl32.exe
      C:\Windows\system32\Bhpofl32.exe
      4⤵
      PID:7336
    - - C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7380
      - C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        6⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7464
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        8⤵
        Drops file in System32 directory
        
        PID:7504

C:\Windows\SysWOW64\Cpmapodj.exe
C:\Windows\system32\Cpmapodj.exe
1⤵
PID:7544
- C:\Windows\SysWOW64\Chdialdl.exe
  C:\Windows\system32\Chdialdl.exe
  2⤵
  - Drops file in System32 directory
  PID:7580
- - C:\Windows\SysWOW64\Ckbemgcp.exe
    C:\Windows\system32\Ckbemgcp.exe
    3⤵
    - Drops file in System32 directory
    PID:7680
  - - C:\Windows\SysWOW64\Mpclce32.exe
      C:\Windows\system32\Mpclce32.exe
      4⤵
      PID:7732
    - - C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        5⤵
        
        PID:7824
      - C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        6⤵
        
        PID:7988

C:\Windows\SysWOW64\Dmlkhofd.exe
C:\Windows\system32\Dmlkhofd.exe
1⤵
- Executes dropped EXE
PID:1612

C:\Windows\SysWOW64\Bdbnjdfg.exe
C:\Windows\system32\Bdbnjdfg.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376

C:\Windows\SysWOW64\Bnhenj32.exe
C:\Windows\system32\Bnhenj32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720

C:\Windows\SysWOW64\Bemqih32.exe
C:\Windows\system32\Bemqih32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\Amjillkj.exe
C:\Windows\system32\Amjillkj.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504

C:\Windows\SysWOW64\Qdphngfl.exe
C:\Windows\system32\Qdphngfl.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316

C:\Windows\SysWOW64\Pkgcea32.exe
C:\Windows\system32\Pkgcea32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092

C:\Windows\SysWOW64\Popbpqjh.exe
C:\Windows\system32\Popbpqjh.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\Palbgl32.exe
C:\Windows\system32\Palbgl32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\Pefabkej.exe
C:\Windows\system32\Pefabkej.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940

C:\Windows\SysWOW64\Edaaccbj.exe
C:\Windows\system32\Edaaccbj.exe
1⤵
PID:8036
- C:\Windows\SysWOW64\Ekljpm32.exe
  C:\Windows\system32\Ekljpm32.exe
  2⤵
  PID:8092
- - C:\Windows\SysWOW64\Ephbhd32.exe
    C:\Windows\system32\Ephbhd32.exe
    3⤵
    PID:8152
  - - C:\Windows\SysWOW64\Ecgodpgb.exe
      C:\Windows\system32\Ecgodpgb.exe
      4⤵
      PID:8188

C:\Windows\SysWOW64\Ekngemhd.exe
C:\Windows\system32\Ekngemhd.exe
1⤵
PID:6880
- C:\Windows\SysWOW64\Enlcahgh.exe
  C:\Windows\system32\Enlcahgh.exe
  2⤵
  PID:7128
- - C:\Windows\SysWOW64\Eqkondfl.exe
    C:\Windows\system32\Eqkondfl.exe
    3⤵
    PID:7204
  - - C:\Windows\SysWOW64\Egegjn32.exe
      C:\Windows\system32\Egegjn32.exe
      4⤵
      PID:7188

C:\Windows\SysWOW64\Enopghee.exe
C:\Windows\system32\Enopghee.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6212
- C:\Windows\SysWOW64\Edihdb32.exe
  C:\Windows\system32\Edihdb32.exe
  2⤵
  PID:7328
- - C:\Windows\SysWOW64\Fnalmh32.exe
    C:\Windows\system32\Fnalmh32.exe
    3⤵
    PID:7376
  - - C:\Windows\SysWOW64\Gbkdod32.exe
      C:\Windows\system32\Gbkdod32.exe
      4⤵
      PID:7416
    - - C:\Windows\SysWOW64\Gclafmej.exe
        
        C:\Windows\system32\Gclafmej.exe
        5⤵
        Drops file in System32 directory
        
        PID:7484

C:\Windows\SysWOW64\Gjficg32.exe
C:\Windows\system32\Gjficg32.exe
1⤵
PID:7532
- C:\Windows\SysWOW64\Gnaecedp.exe
  C:\Windows\system32\Gnaecedp.exe
  2⤵
  PID:7612
- - C:\Windows\SysWOW64\Gqpapacd.exe
    C:\Windows\system32\Gqpapacd.exe
    3⤵
    PID:3860
  - - C:\Windows\SysWOW64\Igjbci32.exe
      C:\Windows\system32\Igjbci32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:4536
    - - C:\Windows\SysWOW64\Ijiopd32.exe
        
        C:\Windows\system32\Ijiopd32.exe
        5⤵
        
        PID:1212
      - C:\Windows\SysWOW64\Iabglnco.exe
        
        C:\Windows\system32\Iabglnco.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7632
  - - C:\Windows\SysWOW64\Pmbcik32.exe
      C:\Windows\system32\Pmbcik32.exe
      4⤵
      PID:9212
    - - C:\Windows\SysWOW64\Pppoeg32.exe
        
        C:\Windows\system32\Pppoeg32.exe
        5⤵
        
        PID:5972
      - C:\Windows\SysWOW64\Pfjgbapo.exe
        
        C:\Windows\system32\Pfjgbapo.exe
        6⤵
        
        PID:2664

C:\Windows\SysWOW64\Icachjbb.exe
C:\Windows\system32\Icachjbb.exe
1⤵
PID:2564
- C:\Windows\SysWOW64\Ilhkigcd.exe
  C:\Windows\system32\Ilhkigcd.exe
  2⤵
  PID:7712
- - C:\Windows\SysWOW64\Infhebbh.exe
    C:\Windows\system32\Infhebbh.exe
    3⤵
    PID:7780
  - - C:\Windows\SysWOW64\Iaedanal.exe
      C:\Windows\system32\Iaedanal.exe
      4⤵
      PID:6276
    - - C:\Windows\SysWOW64\Ijmhkchl.exe
        
        C:\Windows\system32\Ijmhkchl.exe
        5⤵
        
        PID:7692
      - C:\Windows\SysWOW64\Iagqgn32.exe
        
        C:\Windows\system32\Iagqgn32.exe
        6⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Icfmci32.exe
        
        C:\Windows\system32\Icfmci32.exe
        7⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Ilmedf32.exe
        
        C:\Windows\system32\Ilmedf32.exe
        8⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Inkaqb32.exe
        
        C:\Windows\system32\Inkaqb32.exe
        9⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Lefkkg32.exe
        
        C:\Windows\system32\Lefkkg32.exe
        10⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Lkcccn32.exe
        
        C:\Windows\system32\Lkcccn32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7212
        
        C:\Windows\SysWOW64\Loopdmpk.exe
        
        C:\Windows\system32\Loopdmpk.exe
        12⤵
        Drops file in System32 directory
        
        PID:7180
        
        C:\Windows\SysWOW64\Mkepineo.exe
        
        C:\Windows\system32\Mkepineo.exe
        13⤵
        Modifies registry class
        
        PID:6620

C:\Windows\SysWOW64\Moalil32.exe
C:\Windows\system32\Moalil32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7404
- C:\Windows\SysWOW64\Maoifh32.exe
  C:\Windows\system32\Maoifh32.exe
  2⤵
  PID:4996

C:\Windows\SysWOW64\Mdnebc32.exe
C:\Windows\system32\Mdnebc32.exe
1⤵
PID:3912
- C:\Windows\SysWOW64\Mlemcq32.exe
  C:\Windows\system32\Mlemcq32.exe
  2⤵
  PID:5000

C:\Windows\SysWOW64\Mociol32.exe
C:\Windows\system32\Mociol32.exe
1⤵
PID:2300
- C:\Windows\SysWOW64\Maaekg32.exe
  C:\Windows\system32\Maaekg32.exe
  2⤵
  PID:2236
- - C:\Windows\SysWOW64\Mdpagc32.exe
    C:\Windows\system32\Mdpagc32.exe
    3⤵
    PID:7740
  - - C:\Windows\SysWOW64\Mlgjhp32.exe
      C:\Windows\system32\Mlgjhp32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:7860
    - - C:\Windows\SysWOW64\Moefdljc.exe
        
        C:\Windows\system32\Moefdljc.exe
        5⤵
        
        PID:7912
    - - C:\Windows\SysWOW64\Amgekh32.exe
        
        C:\Windows\system32\Amgekh32.exe
        5⤵
        Drops file in System32 directory
        
        PID:1040
      - C:\Windows\SysWOW64\Apeagd32.exe
        
        C:\Windows\system32\Apeagd32.exe
        6⤵
        
        PID:1708

C:\Windows\SysWOW64\Mcabej32.exe
C:\Windows\system32\Mcabej32.exe
1⤵
PID:8032
- C:\Windows\SysWOW64\Mepnaf32.exe
  C:\Windows\system32\Mepnaf32.exe
  2⤵
  PID:8140
- - C:\Windows\SysWOW64\Mhnjna32.exe
    C:\Windows\system32\Mhnjna32.exe
    3⤵
    PID:1128

C:\Windows\SysWOW64\Mklfjm32.exe
C:\Windows\system32\Mklfjm32.exe
1⤵
PID:5552
- C:\Windows\SysWOW64\Mccokj32.exe
  C:\Windows\system32\Mccokj32.exe
  2⤵
  PID:6608
- - C:\Windows\SysWOW64\Ndidna32.exe
    C:\Windows\system32\Ndidna32.exe
    3⤵
    PID:7456
  - - C:\Windows\SysWOW64\Nlqloo32.exe
      C:\Windows\system32\Nlqloo32.exe
      4⤵
      PID:3616
    - - C:\Windows\SysWOW64\Nooikj32.exe
        
        C:\Windows\system32\Nooikj32.exe
        5⤵
        
        PID:6100

C:\Windows\SysWOW64\Namegfql.exe
C:\Windows\system32\Namegfql.exe
1⤵
PID:7748
- C:\Windows\SysWOW64\Nhgmcp32.exe
  C:\Windows\system32\Nhgmcp32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:7924
- - C:\Windows\SysWOW64\Nkeipk32.exe
    C:\Windows\system32\Nkeipk32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:8124

C:\Windows\SysWOW64\Ncmaai32.exe
C:\Windows\system32\Ncmaai32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5644
- C:\Windows\SysWOW64\Ndnnianm.exe
  C:\Windows\system32\Ndnnianm.exe
  2⤵
  PID:7248
- - C:\Windows\SysWOW64\Nlefjnno.exe
    C:\Windows\system32\Nlefjnno.exe
    3⤵
    PID:7500
  - - C:\Windows\SysWOW64\Nocbfjmc.exe
      C:\Windows\system32\Nocbfjmc.exe
      4⤵
      PID:2164

C:\Windows\SysWOW64\Nbbnbemf.exe
C:\Windows\system32\Nbbnbemf.exe
1⤵
- Modifies registry class
PID:7848
- C:\Windows\SysWOW64\Ndpjnq32.exe
  C:\Windows\system32\Ndpjnq32.exe
  2⤵
  PID:5876

C:\Windows\SysWOW64\Nlgbon32.exe
C:\Windows\system32\Nlgbon32.exe
1⤵
PID:6352
- C:\Windows\SysWOW64\Ncaklhdi.exe
  C:\Windows\system32\Ncaklhdi.exe
  2⤵
  PID:2824
- - C:\Windows\SysWOW64\Nfpghccm.exe
    C:\Windows\system32\Nfpghccm.exe
    3⤵
    PID:8064

C:\Windows\SysWOW64\Ohncdobq.exe
C:\Windows\system32\Ohncdobq.exe
1⤵
PID:8116
- C:\Windows\SysWOW64\Okmpqjad.exe
  C:\Windows\system32\Okmpqjad.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:7908
- - C:\Windows\SysWOW64\Obfhmd32.exe
    C:\Windows\system32\Obfhmd32.exe
    3⤵
    - Drops file in System32 directory
    PID:5880
  - - C:\Windows\SysWOW64\Odedipge.exe
      C:\Windows\system32\Odedipge.exe
      4⤵
      PID:7240

C:\Windows\SysWOW64\Okolfj32.exe
C:\Windows\system32\Okolfj32.exe
1⤵
- Drops file in System32 directory
PID:5444
- C:\Windows\SysWOW64\Obidcdfo.exe
  C:\Windows\system32\Obidcdfo.exe
  2⤵
  PID:8200
- - C:\Windows\SysWOW64\Odgqopeb.exe
    C:\Windows\system32\Odgqopeb.exe
    3⤵
    - Drops file in System32 directory
    PID:8236
  - - C:\Windows\SysWOW64\Oloipmfd.exe
      C:\Windows\system32\Oloipmfd.exe
      4⤵
      PID:8296
    - - C:\Windows\SysWOW64\Imknli32.exe
        
        C:\Windows\system32\Imknli32.exe
        5⤵
        
        PID:8356
      - C:\Windows\SysWOW64\Mkicjgnn.exe
        
        C:\Windows\system32\Mkicjgnn.exe
        6⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Elgohj32.exe
        
        C:\Windows\system32\Elgohj32.exe
        7⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Fhllni32.exe
        
        C:\Windows\system32\Fhllni32.exe
        8⤵
        Drops file in System32 directory
        
        PID:5860
        
        C:\Windows\SysWOW64\Gohapb32.exe
        
        C:\Windows\system32\Gohapb32.exe
        9⤵
        Drops file in System32 directory
        
        PID:8432
        
        C:\Windows\SysWOW64\Glchjedc.exe
        
        C:\Windows\system32\Glchjedc.exe
        10⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\Kfcdaehf.exe
        
        C:\Windows\system32\Kfcdaehf.exe
        11⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Kanbjn32.exe
        
        C:\Windows\system32\Kanbjn32.exe
        12⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Kggjghkd.exe
        
        C:\Windows\system32\Kggjghkd.exe
        13⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Ljffccjh.exe
        
        C:\Windows\system32\Ljffccjh.exe
        14⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Lapopm32.exe
        
        C:\Windows\system32\Lapopm32.exe
        15⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Lgjglg32.exe
        
        C:\Windows\system32\Lgjglg32.exe
        16⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Nmlafk32.exe
        
        C:\Windows\system32\Nmlafk32.exe
        17⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Ckfofe32.exe
        
        C:\Windows\system32\Ckfofe32.exe
        18⤵
        Drops file in System32 directory
        
        PID:6528
        
        C:\Windows\SysWOW64\Dgmpkg32.exe
        
        C:\Windows\system32\Dgmpkg32.exe
        19⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Gaoihfoo.exe
        
        C:\Windows\system32\Gaoihfoo.exe
        20⤵
        Drops file in System32 directory
        
        PID:7560
        
        C:\Windows\SysWOW64\Jhqqlmba.exe
        
        C:\Windows\system32\Jhqqlmba.exe
        21⤵
        Modifies registry class
        
        PID:8244
        
        C:\Windows\SysWOW64\Jjefao32.exe
        
        C:\Windows\system32\Jjefao32.exe
        22⤵
        Drops file in System32 directory
        
        PID:3716
        
        C:\Windows\SysWOW64\Kifcnjpi.exe
        
        C:\Windows\system32\Kifcnjpi.exe
        23⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Mclpbqal.exe
        
        C:\Windows\system32\Mclpbqal.exe
        24⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Odhiemil.exe
        
        C:\Windows\system32\Odhiemil.exe
        25⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Acbhhf32.exe
        
        C:\Windows\system32\Acbhhf32.exe
        26⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Dcqmpa32.exe
        
        C:\Windows\system32\Dcqmpa32.exe
        27⤵
        Modifies registry class
        
        PID:8388
        
        C:\Windows\SysWOW64\Ejmkiiha.exe
        
        C:\Windows\system32\Ejmkiiha.exe
        28⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\Gdheol32.exe
        
        C:\Windows\system32\Gdheol32.exe
        29⤵
        Modifies registry class
        
        PID:8404
        
        C:\Windows\SysWOW64\Ghfnej32.exe
        
        C:\Windows\system32\Ghfnej32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Hmlicp32.exe
        
        C:\Windows\system32\Hmlicp32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5480
        
        C:\Windows\SysWOW64\Ikechced.exe
        
        C:\Windows\system32\Ikechced.exe
        32⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Jliimf32.exe
        
        C:\Windows\system32\Jliimf32.exe
        33⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Jnmbjnlm.exe
        
        C:\Windows\system32\Jnmbjnlm.exe
        34⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Jkcpia32.exe
        
        C:\Windows\system32\Jkcpia32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5016
        
        C:\Windows\SysWOW64\Jkeloa32.exe
        
        C:\Windows\system32\Jkeloa32.exe
        36⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\Jaodkk32.exe
        
        C:\Windows\system32\Jaodkk32.exe
        37⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\Knfepldb.exe
        
        C:\Windows\system32\Knfepldb.exe
        38⤵
        Modifies registry class
        
        PID:6016
        
        C:\Windows\SysWOW64\Kdpmmf32.exe
        
        C:\Windows\system32\Kdpmmf32.exe
        39⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\Knkokl32.exe
        
        C:\Windows\system32\Knkokl32.exe
        40⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Klnkoc32.exe
        
        C:\Windows\system32\Klnkoc32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1832
        
        C:\Windows\SysWOW64\Lmcejbbd.exe
        
        C:\Windows\system32\Lmcejbbd.exe
        42⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Lkhbko32.exe
        
        C:\Windows\system32\Lkhbko32.exe
        43⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Ldqfddml.exe
        
        C:\Windows\system32\Ldqfddml.exe
        44⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Ldccid32.exe
        
        C:\Windows\system32\Ldccid32.exe
        45⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\Lnkgbibj.exe
        
        C:\Windows\system32\Lnkgbibj.exe
        46⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Mmlhpaji.exe
        
        C:\Windows\system32\Mmlhpaji.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6224
        
        C:\Windows\SysWOW64\Mnndhi32.exe
        
        C:\Windows\system32\Mnndhi32.exe
        48⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Micheb32.exe
        
        C:\Windows\system32\Micheb32.exe
        49⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Mbkmngfn.exe
        
        C:\Windows\system32\Mbkmngfn.exe
        50⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Mieeka32.exe
        
        C:\Windows\system32\Mieeka32.exe
        51⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Moomgl32.exe
        
        C:\Windows\system32\Moomgl32.exe
        52⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\Mbnjcg32.exe
        
        C:\Windows\system32\Mbnjcg32.exe
        53⤵
        Drops file in System32 directory
        
        PID:3248
        
        C:\Windows\SysWOW64\Melfpb32.exe
        
        C:\Windows\system32\Melfpb32.exe
        54⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Mndjhhjp.exe
        
        C:\Windows\system32\Mndjhhjp.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6424
        
        C:\Windows\SysWOW64\Mkhkblii.exe
        
        C:\Windows\system32\Mkhkblii.exe
        56⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Mnggnh32.exe
        
        C:\Windows\system32\Mnggnh32.exe
        57⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Nfnooe32.exe
        
        C:\Windows\system32\Nfnooe32.exe
        58⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\Nilkkq32.exe
        
        C:\Windows\system32\Nilkkq32.exe
        59⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Immhdc32.exe
        
        C:\Windows\system32\Immhdc32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8860
        
        C:\Windows\SysWOW64\Ipldpo32.exe
        
        C:\Windows\system32\Ipldpo32.exe
        16⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Iffmmihf.exe
        
        C:\Windows\system32\Iffmmihf.exe
        17⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Ijaimg32.exe
        
        C:\Windows\system32\Ijaimg32.exe
        18⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Iakajagl.exe
        
        C:\Windows\system32\Iakajagl.exe
        19⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Idjmfmgp.exe
        
        C:\Windows\system32\Idjmfmgp.exe
        20⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Ipckqnja.exe
        
        C:\Windows\system32\Ipckqnja.exe
        21⤵
        Modifies registry class
        
        PID:7084
        
        C:\Windows\SysWOW64\Cbkncd32.exe
        
        C:\Windows\system32\Cbkncd32.exe
        22⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Cjbfdakf.exe
        
        C:\Windows\system32\Cjbfdakf.exe
        23⤵
        
        PID:7796

C:\Windows\SysWOW64\Nnidcg32.exe
C:\Windows\system32\Nnidcg32.exe
1⤵
PID:7216
- C:\Windows\SysWOW64\Nfpled32.exe
  C:\Windows\system32\Nfpled32.exe
  2⤵
  PID:1012
- - C:\Windows\SysWOW64\Niohap32.exe
    C:\Windows\system32\Niohap32.exe
    3⤵
    PID:932
  - - C:\Windows\SysWOW64\Nlmdml32.exe
      C:\Windows\system32\Nlmdml32.exe
      4⤵
      PID:4212
    - - C:\Windows\SysWOW64\Nnlqig32.exe
        
        C:\Windows\system32\Nnlqig32.exe
        5⤵
        
        PID:2272

C:\Windows\SysWOW64\Nfchjddj.exe
C:\Windows\system32\Nfchjddj.exe
1⤵
PID:6068
- C:\Windows\SysWOW64\Niadfpcn.exe
  C:\Windows\system32\Niadfpcn.exe
  2⤵
  PID:5320
- - C:\Windows\SysWOW64\Nlpabkba.exe
    C:\Windows\system32\Nlpabkba.exe
    3⤵
    - Drops file in System32 directory
    PID:5596
  - - C:\Windows\SysWOW64\Nnnmogae.exe
      C:\Windows\system32\Nnnmogae.exe
      4⤵
      Drops file in System32 directory
      PID:8844
    - - C:\Windows\SysWOW64\Nfeepdbg.exe
        
        C:\Windows\system32\Nfeepdbg.exe
        5⤵
        
        PID:8664

C:\Windows\SysWOW64\Nicalpak.exe
C:\Windows\system32\Nicalpak.exe
1⤵
PID:8776
- C:\Windows\SysWOW64\Nlbnhkqo.exe
  C:\Windows\system32\Nlbnhkqo.exe
  2⤵
  PID:9004

C:\Windows\SysWOW64\Nnpjdfpb.exe
C:\Windows\system32\Nnpjdfpb.exe
1⤵
PID:9140
- C:\Windows\SysWOW64\Nejbaqgo.exe
  C:\Windows\system32\Nejbaqgo.exe
  2⤵
  PID:9184
- - C:\Windows\SysWOW64\Nmajbnha.exe
    C:\Windows\system32\Nmajbnha.exe
    3⤵
    PID:6244
  - - C:\Windows\SysWOW64\Nppfnige.exe
      C:\Windows\system32\Nppfnige.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:7864
    - - C:\Windows\SysWOW64\Ofjokc32.exe
        
        C:\Windows\system32\Ofjokc32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6872
      - C:\Windows\SysWOW64\Omdghmfo.exe
        
        C:\Windows\system32\Omdghmfo.exe
        6⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Onecof32.exe
        
        C:\Windows\system32\Onecof32.exe
        7⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Oeoklp32.exe
        
        C:\Windows\system32\Oeoklp32.exe
        8⤵
        Modifies registry class
        
        PID:8040
        
        C:\Windows\SysWOW64\Omfcmm32.exe
        
        C:\Windows\system32\Omfcmm32.exe
        9⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Opdpih32.exe
        
        C:\Windows\system32\Opdpih32.exe
        10⤵
        Modifies registry class
        
        PID:8152
        
        C:\Windows\SysWOW64\Oimdbnip.exe
        
        C:\Windows\system32\Oimdbnip.exe
        11⤵
        
        PID:948
        
        C:\Windows\SysWOW64\Olkqnjhd.exe
        
        C:\Windows\system32\Olkqnjhd.exe
        12⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Onjmjegg.exe
        
        C:\Windows\system32\Onjmjegg.exe
        13⤵
        
        PID:7872

C:\Windows\SysWOW64\Oecego32.exe
C:\Windows\system32\Oecego32.exe
1⤵
PID:7188
- C:\Windows\SysWOW64\Omkmhlpf.exe
  C:\Windows\system32\Omkmhlpf.exe
  2⤵
  PID:7104
- C:\Windows\SysWOW64\Bcfabgel.exe
  C:\Windows\system32\Bcfabgel.exe
  2⤵
  PID:9028
- - C:\Windows\SysWOW64\Bfenncdp.exe
    C:\Windows\system32\Bfenncdp.exe
    3⤵
    PID:3788
  - - C:\Windows\SysWOW64\Bmofkm32.exe
      C:\Windows\system32\Bmofkm32.exe
      4⤵
      PID:6440
    - - C:\Windows\SysWOW64\Combgh32.exe
        
        C:\Windows\system32\Combgh32.exe
        5⤵
        
        PID:7084

C:\Windows\SysWOW64\Opiidhoj.exe
C:\Windows\system32\Opiidhoj.exe
1⤵
PID:4432
- C:\Windows\SysWOW64\Obgeqcnn.exe
  C:\Windows\system32\Obgeqcnn.exe
  2⤵
  - Drops file in System32 directory
  PID:8908
- - C:\Windows\SysWOW64\Oefamoma.exe
    C:\Windows\system32\Oefamoma.exe
    3⤵
    - Drops file in System32 directory
    PID:5636
  - - C:\Windows\SysWOW64\Olpjii32.exe
      C:\Windows\system32\Olpjii32.exe
      4⤵
      PID:7372

C:\Windows\SysWOW64\Ponfed32.exe
C:\Windows\system32\Ponfed32.exe
1⤵
- Modifies registry class
PID:8208
- C:\Windows\SysWOW64\Pehnboko.exe
  C:\Windows\system32\Pehnboko.exe
  2⤵
  PID:9116
- - C:\Windows\SysWOW64\Pmpfcl32.exe
    C:\Windows\system32\Pmpfcl32.exe
    3⤵
    PID:7672
  - - C:\Windows\SysWOW64\Poqckdap.exe
      C:\Windows\system32\Poqckdap.exe
      4⤵
      PID:7928

C:\Windows\SysWOW64\Pblolb32.exe
C:\Windows\system32\Pblolb32.exe
1⤵
- Drops file in System32 directory
PID:7612
- C:\Windows\SysWOW64\Pifghmae.exe
  C:\Windows\system32\Pifghmae.exe
  2⤵
  PID:3860

C:\Windows\SysWOW64\Pihdnloc.exe
C:\Windows\system32\Pihdnloc.exe
1⤵
- Drops file in System32 directory
PID:5808
- C:\Windows\SysWOW64\Plgpjhnf.exe
  C:\Windows\system32\Plgpjhnf.exe
  2⤵
  PID:3480
- - C:\Windows\SysWOW64\Pbahgbfc.exe
    C:\Windows\system32\Pbahgbfc.exe
    3⤵
    PID:6668

C:\Windows\SysWOW64\Peodcmeg.exe
C:\Windows\system32\Peodcmeg.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6584
- C:\Windows\SysWOW64\Pmfldkei.exe
  C:\Windows\system32\Pmfldkei.exe
  2⤵
  PID:4468

C:\Windows\SysWOW64\Ppeipfdm.exe
C:\Windows\system32\Ppeipfdm.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7076
- C:\Windows\SysWOW64\Pbcelacq.exe
  C:\Windows\system32\Pbcelacq.exe
  2⤵
  PID:4668
- - C:\Windows\SysWOW64\Peaahmcd.exe
    C:\Windows\system32\Peaahmcd.exe
    3⤵
    PID:7412
- C:\Windows\SysWOW64\Fdqffaql.exe
  C:\Windows\system32\Fdqffaql.exe
  2⤵
  PID:7068
- - C:\Windows\SysWOW64\Ffobbmpp.exe
    C:\Windows\system32\Ffobbmpp.exe
    3⤵
    PID:6664
  - - C:\Windows\SysWOW64\Fimonh32.exe
      C:\Windows\system32\Fimonh32.exe
      4⤵
      PID:5404
    - - C:\Windows\SysWOW64\Fpggkbfq.exe
        
        C:\Windows\system32\Fpggkbfq.exe
        5⤵
        
        PID:500
      - C:\Windows\SysWOW64\Fbecgned.exe
        
        C:\Windows\system32\Fbecgned.exe
        6⤵
        
        PID:3372

C:\Windows\SysWOW64\Pllieg32.exe
C:\Windows\system32\Pllieg32.exe
1⤵
- Drops file in System32 directory
PID:7608
- C:\Windows\SysWOW64\Qbeaba32.exe
  C:\Windows\system32\Qbeaba32.exe
  2⤵
  PID:8044
- - C:\Windows\SysWOW64\Qednnm32.exe
    C:\Windows\system32\Qednnm32.exe
    3⤵
    PID:5624
  - - C:\Windows\SysWOW64\Qmkfoj32.exe
      C:\Windows\system32\Qmkfoj32.exe
      4⤵
      PID:904
    - - C:\Windows\SysWOW64\Qpibke32.exe
        
        C:\Windows\system32\Qpibke32.exe
        5⤵
        Drops file in System32 directory
        
        PID:7760
      - C:\Windows\SysWOW64\Abjkmqni.exe
        
        C:\Windows\system32\Abjkmqni.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6232
        
        C:\Windows\SysWOW64\Aeigilml.exe
        
        C:\Windows\system32\Aeigilml.exe
        7⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Albpff32.exe
        
        C:\Windows\system32\Albpff32.exe
        8⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Aoalba32.exe
        
        C:\Windows\system32\Aoalba32.exe
        9⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Aekdolkj.exe
        
        C:\Windows\system32\Aekdolkj.exe
        10⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Amblpikl.exe
        
        C:\Windows\system32\Amblpikl.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:908
        
        C:\Windows\SysWOW64\Majjgmco.exe
        
        C:\Windows\system32\Majjgmco.exe
        10⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Mlooef32.exe
        
        C:\Windows\system32\Mlooef32.exe
        11⤵
        
        PID:8960

C:\Windows\SysWOW64\Apqhldjp.exe
C:\Windows\system32\Apqhldjp.exe
1⤵
PID:7180
- C:\Windows\SysWOW64\Abodhpic.exe
  C:\Windows\system32\Abodhpic.exe
  2⤵
  PID:4492
- - C:\Windows\SysWOW64\Aiimejap.exe
    C:\Windows\system32\Aiimejap.exe
    3⤵
    PID:7616
  - - C:\Windows\SysWOW64\Algiaepd.exe
      C:\Windows\system32\Algiaepd.exe
      4⤵
      PID:5788
    - - C:\Windows\SysWOW64\Acaanp32.exe
        
        C:\Windows\system32\Acaanp32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6696
      - C:\Windows\SysWOW64\Aepmjk32.exe
        
        C:\Windows\system32\Aepmjk32.exe
        6⤵
        
        PID:7860
      - C:\Windows\SysWOW64\Effffd32.exe
        
        C:\Windows\system32\Effffd32.exe
        6⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Ealkcm32.exe
        
        C:\Windows\system32\Ealkcm32.exe
        7⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Edjgpi32.exe
        
        C:\Windows\system32\Edjgpi32.exe
        8⤵
        
        PID:4136

C:\Windows\SysWOW64\Accnco32.exe
C:\Windows\system32\Accnco32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5040
- C:\Windows\SysWOW64\Amibqhed.exe
  C:\Windows\system32\Amibqhed.exe
  2⤵
  PID:7312
- - C:\Windows\SysWOW64\Bpgnmcdh.exe
    C:\Windows\system32\Bpgnmcdh.exe
    3⤵
    PID:2372
  - - C:\Windows\SysWOW64\Bcfkiock.exe
      C:\Windows\system32\Bcfkiock.exe
      4⤵
      PID:5448

C:\Windows\SysWOW64\Bnnklg32.exe
C:\Windows\system32\Bnnklg32.exe
1⤵
PID:4920
- C:\Windows\SysWOW64\Bplhhc32.exe
  C:\Windows\system32\Bplhhc32.exe
  2⤵
  PID:4272
- - C:\Windows\SysWOW64\Bckddn32.exe
    C:\Windows\system32\Bckddn32.exe
    3⤵
    PID:4792

C:\Windows\SysWOW64\Beippj32.exe
C:\Windows\system32\Beippj32.exe
1⤵
PID:6484
- C:\Windows\SysWOW64\Bnphag32.exe
  C:\Windows\system32\Bnphag32.exe
  2⤵
  PID:6028

C:\Windows\SysWOW64\Bpodmb32.exe
C:\Windows\system32\Bpodmb32.exe
1⤵
PID:1724
- C:\Windows\SysWOW64\Bcmqin32.exe
  C:\Windows\system32\Bcmqin32.exe
  2⤵
  PID:8492
- - C:\Windows\SysWOW64\Bekmei32.exe
    C:\Windows\system32\Bekmei32.exe
    3⤵
    - Modifies registry class
    PID:5908
- - C:\Windows\SysWOW64\Ejofacfb.exe
    C:\Windows\system32\Ejofacfb.exe
    3⤵
    PID:6884
  - - C:\Windows\SysWOW64\Emnbmoef.exe
      C:\Windows\system32\Emnbmoef.exe
      4⤵
      PID:8512
    - - C:\Windows\SysWOW64\Edhjji32.exe
        
        C:\Windows\system32\Edhjji32.exe
        5⤵
        
        PID:6696

C:\Windows\SysWOW64\Bjgifhep.exe
C:\Windows\system32\Bjgifhep.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5404
- C:\Windows\SysWOW64\Bleebc32.exe
  C:\Windows\system32\Bleebc32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:4448

C:\Windows\SysWOW64\Bjielh32.exe
C:\Windows\system32\Bjielh32.exe
1⤵
PID:5780
- C:\Windows\SysWOW64\Cnealfkf.exe
  C:\Windows\system32\Cnealfkf.exe
  2⤵
  PID:2592
- - C:\Windows\SysWOW64\Qifnaecf.exe
    C:\Windows\system32\Qifnaecf.exe
    3⤵
    PID:6620
  - - C:\Windows\SysWOW64\Qlejnqbj.exe
      C:\Windows\system32\Qlejnqbj.exe
      4⤵
      PID:8868

C:\Windows\SysWOW64\Cpcnhbjj.exe
C:\Windows\system32\Cpcnhbjj.exe
1⤵
PID:8476
- C:\Windows\SysWOW64\Ccajdmin.exe
  C:\Windows\system32\Ccajdmin.exe
  2⤵
  PID:5200

C:\Windows\SysWOW64\Cgmfel32.exe
C:\Windows\system32\Cgmfel32.exe
1⤵
PID:7092
- C:\Windows\SysWOW64\Cjlbag32.exe
  C:\Windows\system32\Cjlbag32.exe
  2⤵
  - Drops file in System32 directory
  PID:8884
- - C:\Windows\SysWOW64\Cljomc32.exe
    C:\Windows\system32\Cljomc32.exe
    3⤵
    PID:8504
  - - C:\Windows\SysWOW64\Cjbhbf32.exe
      C:\Windows\system32\Cjbhbf32.exe
      4⤵
      Drops file in System32 directory
      PID:8528
    - - C:\Windows\SysWOW64\Claenb32.exe
        
        C:\Windows\system32\Claenb32.exe
        5⤵
        Modifies registry class
        
        PID:6864

C:\Windows\SysWOW64\Dgieajgj.exe
C:\Windows\system32\Dgieajgj.exe
1⤵
PID:6520
- C:\Windows\SysWOW64\Djgbmffn.exe
  C:\Windows\system32\Djgbmffn.exe
  2⤵
  - Drops file in System32 directory
  PID:6884
- - C:\Windows\SysWOW64\Dlfniafa.exe
    C:\Windows\system32\Dlfniafa.exe
    3⤵
    PID:4368

C:\Windows\SysWOW64\Ifmcmg32.exe
C:\Windows\system32\Ifmcmg32.exe
1⤵
PID:6828
- C:\Windows\SysWOW64\Jikojcaa.exe
  C:\Windows\system32\Jikojcaa.exe
  2⤵
  PID:9180
- - C:\Windows\SysWOW64\Jabgkpad.exe
    C:\Windows\system32\Jabgkpad.exe
    3⤵
    PID:7532
  - - C:\Windows\SysWOW64\Jbccbi32.exe
      C:\Windows\system32\Jbccbi32.exe
      4⤵
      PID:7644
    - - C:\Windows\SysWOW64\Jinloboo.exe
        
        C:\Windows\system32\Jinloboo.exe
        5⤵
        Drops file in System32 directory
        
        PID:6204
      - C:\Windows\SysWOW64\Jaddpppa.exe
        
        C:\Windows\system32\Jaddpppa.exe
        6⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Jdcplkoe.exe
        
        C:\Windows\system32\Jdcplkoe.exe
        7⤵
        Drops file in System32 directory
        
        PID:6276
        
        C:\Windows\SysWOW64\Jfalhgni.exe
        
        C:\Windows\system32\Jfalhgni.exe
        8⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\Jiphebml.exe
        
        C:\Windows\system32\Jiphebml.exe
        9⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Jpjqaldi.exe
        
        C:\Windows\system32\Jpjqaldi.exe
        10⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Ckhlgilp.exe
        
        C:\Windows\system32\Ckhlgilp.exe
        11⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Cbbdcc32.exe
        
        C:\Windows\system32\Cbbdcc32.exe
        12⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Cjecjahd.exe
        
        C:\Windows\system32\Cjecjahd.exe
        9⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Cmcoflhh.exe
        
        C:\Windows\system32\Cmcoflhh.exe
        10⤵
        
        PID:3820
    - - C:\Windows\SysWOW64\Gifadggi.exe
        
        C:\Windows\system32\Gifadggi.exe
        5⤵
        
        PID:668
      - C:\Windows\SysWOW64\Glenpb32.exe
        
        C:\Windows\system32\Glenpb32.exe
        6⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Gbofmmmj.exe
        
        C:\Windows\system32\Gbofmmmj.exe
        7⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Gkfnnjnl.exe
        
        C:\Windows\system32\Gkfnnjnl.exe
        8⤵
        
        PID:9332

C:\Windows\SysWOW64\Jjoeoedo.exe
C:\Windows\system32\Jjoeoedo.exe
1⤵
- Drops file in System32 directory
PID:6228
- C:\Windows\SysWOW64\Jaimko32.exe
  C:\Windows\system32\Jaimko32.exe
  2⤵
  PID:796
- - C:\Windows\SysWOW64\Jdhigk32.exe
    C:\Windows\system32\Jdhigk32.exe
    3⤵
    PID:4264
  - - C:\Windows\SysWOW64\Jfffcf32.exe
      C:\Windows\system32\Jfffcf32.exe
      4⤵
      PID:8340
- - C:\Windows\SysWOW64\Ebcmjqej.exe
    C:\Windows\system32\Ebcmjqej.exe
    3⤵
    PID:8656
  - - C:\Windows\SysWOW64\Ejjelnfl.exe
      C:\Windows\system32\Ejjelnfl.exe
      4⤵
      PID:4828
    - - C:\Windows\SysWOW64\Emhahiep.exe
        
        C:\Windows\system32\Emhahiep.exe
        5⤵
        
        PID:2976

C:\Windows\SysWOW64\Jidbpa32.exe
C:\Windows\system32\Jidbpa32.exe
1⤵
- Modifies registry class
PID:2300
- C:\Windows\SysWOW64\Jaljaoii.exe
  C:\Windows\system32\Jaljaoii.exe
  2⤵
  - Modifies registry class
  PID:1828
- - C:\Windows\SysWOW64\Jdjfmjhm.exe
    C:\Windows\system32\Jdjfmjhm.exe
    3⤵
    PID:2068
  - - C:\Windows\SysWOW64\Kfhbifgq.exe
      C:\Windows\system32\Kfhbifgq.exe
      4⤵
      PID:3500
    - - C:\Windows\SysWOW64\Kigoeagd.exe
        
        C:\Windows\system32\Kigoeagd.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4340
      - C:\Windows\SysWOW64\Kmegkp32.exe
        
        C:\Windows\system32\Kmegkp32.exe
        6⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Kpccgk32.exe
        
        C:\Windows\system32\Kpccgk32.exe
        7⤵
        
        PID:8456
      - C:\Windows\SysWOW64\Fbomfokl.exe
        
        C:\Windows\system32\Fbomfokl.exe
        6⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Fjfegl32.exe
        
        C:\Windows\system32\Fjfegl32.exe
        7⤵
        
        PID:1412

C:\Windows\SysWOW64\Kbapdfkb.exe
C:\Windows\system32\Kbapdfkb.exe
1⤵
PID:8436
- C:\Windows\SysWOW64\Kkihedld.exe
  C:\Windows\system32\Kkihedld.exe
  2⤵
  PID:8656
- - C:\Windows\SysWOW64\Kmgdaokh.exe
    C:\Windows\system32\Kmgdaokh.exe
    3⤵
    PID:5820
  - - C:\Windows\SysWOW64\Kpepmkjl.exe
      C:\Windows\system32\Kpepmkjl.exe
      4⤵
      PID:8848
    - - C:\Windows\SysWOW64\Kcdmifip.exe
        
        C:\Windows\system32\Kcdmifip.exe
        5⤵
        
        PID:1248
      - C:\Windows\SysWOW64\Kdcicipb.exe
        
        C:\Windows\system32\Kdcicipb.exe
        6⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Kkmapc32.exe
        
        C:\Windows\system32\Kkmapc32.exe
        7⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\Kagimmol.exe
        
        C:\Windows\system32\Kagimmol.exe
        8⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Kdffiinp.exe
        
        C:\Windows\system32\Kdffiinp.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7148
        
        C:\Windows\SysWOW64\Lckbje32.exe
        
        C:\Windows\system32\Lckbje32.exe
        10⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Njploeoi.exe
        
        C:\Windows\system32\Njploeoi.exe
        11⤵
        Drops file in System32 directory
        
        PID:6216
        
        C:\Windows\SysWOW64\Pggbdgmm.exe
        
        C:\Windows\system32\Pggbdgmm.exe
        12⤵
        
        PID:7568
      - C:\Windows\SysWOW64\Ajkgmd32.exe
        
        C:\Windows\system32\Ajkgmd32.exe
        6⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Aljcip32.exe
        
        C:\Windows\system32\Aljcip32.exe
        7⤵
        
        PID:8756

C:\Windows\SysWOW64\Dmcilgco.exe
C:\Windows\system32\Dmcilgco.exe
1⤵
- Drops file in System32 directory
PID:7060
- C:\Windows\SysWOW64\Fobomglo.exe
  C:\Windows\system32\Fobomglo.exe
  2⤵
  PID:5172
- - C:\Windows\SysWOW64\Hojndd32.exe
    C:\Windows\system32\Hojndd32.exe
    3⤵
    PID:8892
  - - C:\Windows\SysWOW64\Holjjd32.exe
      C:\Windows\system32\Holjjd32.exe
      4⤵
      PID:5760
    - - C:\Windows\SysWOW64\Mfaqafjl.exe
        
        C:\Windows\system32\Mfaqafjl.exe
        5⤵
        
        PID:5416
      - C:\Windows\SysWOW64\Mpiejkql.exe
        
        C:\Windows\system32\Mpiejkql.exe
        6⤵
        
        PID:444
        
        C:\Windows\SysWOW64\Mfcmge32.exe
        
        C:\Windows\system32\Mfcmge32.exe
        7⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Mhdjonng.exe
        
        C:\Windows\system32\Mhdjonng.exe
        8⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Mplapkoj.exe
        
        C:\Windows\system32\Mplapkoj.exe
        9⤵
        Drops file in System32 directory
        
        PID:6908
        
        C:\Windows\SysWOW64\Mbjnlfnn.exe
        
        C:\Windows\system32\Mbjnlfnn.exe
        10⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Midfiq32.exe
        
        C:\Windows\system32\Midfiq32.exe
        11⤵
        
        PID:380
        
        C:\Windows\SysWOW64\Nifcnpch.exe
        
        C:\Windows\system32\Nifcnpch.exe
        12⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Nppkkj32.exe
        
        C:\Windows\system32\Nppkkj32.exe
        13⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Nboggf32.exe
        
        C:\Windows\system32\Nboggf32.exe
        14⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Nemcca32.exe
        
        C:\Windows\system32\Nemcca32.exe
        15⤵
        Drops file in System32 directory
        
        PID:6644
        
        C:\Windows\SysWOW64\Npbhqj32.exe
        
        C:\Windows\system32\Npbhqj32.exe
        16⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Nbadmege.exe
        
        C:\Windows\system32\Nbadmege.exe
        17⤵
        Modifies registry class
        
        PID:8096
        
        C:\Windows\SysWOW64\Niklip32.exe
        
        C:\Windows\system32\Niklip32.exe
        18⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Nlihek32.exe
        
        C:\Windows\system32\Nlihek32.exe
        19⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Nohdaf32.exe
        
        C:\Windows\system32\Nohdaf32.exe
        20⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Ngombd32.exe
        
        C:\Windows\system32\Ngombd32.exe
        21⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Nojagf32.exe
        
        C:\Windows\system32\Nojagf32.exe
        22⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Nipedokm.exe
        
        C:\Windows\system32\Nipedokm.exe
        23⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\Opjnai32.exe
        
        C:\Windows\system32\Opjnai32.exe
        24⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\Ogcfncjf.exe
        
        C:\Windows\system32\Ogcfncjf.exe
        25⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Oibbjoij.exe
        
        C:\Windows\system32\Oibbjoij.exe
        26⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Oplkgi32.exe
        
        C:\Windows\system32\Oplkgi32.exe
        27⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Oeicopoo.exe
        
        C:\Windows\system32\Oeicopoo.exe
        28⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Olcklj32.exe
        
        C:\Windows\system32\Olcklj32.exe
        29⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\Ooaghe32.exe
        
        C:\Windows\system32\Ooaghe32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1800
        
        C:\Windows\SysWOW64\Oekpdoll.exe
        
        C:\Windows\system32\Oekpdoll.exe
        31⤵
        Drops file in System32 directory
        
        PID:7908
        
        C:\Windows\SysWOW64\Ohjlqklp.exe
        
        C:\Windows\system32\Ohjlqklp.exe
        32⤵
        Drops file in System32 directory
        
        PID:4484
        
        C:\Windows\SysWOW64\Opcqgh32.exe
        
        C:\Windows\system32\Opcqgh32.exe
        33⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Ohnelj32.exe
        
        C:\Windows\system32\Ohnelj32.exe
        34⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Pllnbh32.exe
        
        C:\Windows\system32\Pllnbh32.exe
        35⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Qgkeep32.exe
        
        C:\Windows\system32\Qgkeep32.exe
        36⤵
        
        PID:5000

C:\Windows\SysWOW64\Bgknlmgi.exe
C:\Windows\system32\Bgknlmgi.exe
1⤵
PID:8788

C:\Windows\SysWOW64\Cjjcof32.exe
C:\Windows\system32\Cjjcof32.exe
1⤵
PID:4696
- C:\Windows\SysWOW64\Cipppc32.exe
  C:\Windows\system32\Cipppc32.exe
  2⤵
  PID:908
- - C:\Windows\SysWOW64\Ccednl32.exe
    C:\Windows\system32\Ccednl32.exe
    3⤵
    PID:9008
  - - C:\Windows\SysWOW64\Dmmifaci.exe
      C:\Windows\system32\Dmmifaci.exe
      4⤵
      PID:4792
    - - C:\Windows\SysWOW64\Dpqonl32.exe
        
        C:\Windows\system32\Dpqonl32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8552

C:\Windows\SysWOW64\Dapkho32.exe
C:\Windows\system32\Dapkho32.exe
1⤵
PID:6500
- C:\Windows\SysWOW64\Dfmcpf32.exe
  C:\Windows\system32\Dfmcpf32.exe
  2⤵
  PID:3364
- - C:\Windows\SysWOW64\Dmglmpkn.exe
    C:\Windows\system32\Dmglmpkn.exe
    3⤵
    PID:8448

C:\Windows\SysWOW64\Dpehikja.exe
C:\Windows\system32\Dpehikja.exe
1⤵
PID:6420
- C:\Windows\SysWOW64\Ehlpjikd.exe
  C:\Windows\system32\Ehlpjikd.exe
  2⤵
  PID:5304
- - C:\Windows\SysWOW64\Einmaaqb.exe
    C:\Windows\system32\Einmaaqb.exe
    3⤵
    - Drops file in System32 directory
    PID:8784
  - - C:\Windows\SysWOW64\Eaddcnad.exe
      C:\Windows\system32\Eaddcnad.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:4256

C:\Windows\SysWOW64\Edcqojqh.exe
C:\Windows\system32\Edcqojqh.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6428
- C:\Windows\SysWOW64\Efamkepl.exe
  C:\Windows\system32\Efamkepl.exe
  2⤵
  PID:3760

C:\Windows\SysWOW64\Ehecpgbi.exe
C:\Windows\system32\Ehecpgbi.exe
1⤵
PID:3252
- C:\Windows\SysWOW64\Ekdolcbm.exe
  C:\Windows\system32\Ekdolcbm.exe
  2⤵
  PID:2368

C:\Windows\SysWOW64\Embkhn32.exe
C:\Windows\system32\Embkhn32.exe
1⤵
PID:7232
- C:\Windows\SysWOW64\Fpagdj32.exe
  C:\Windows\system32\Fpagdj32.exe
  2⤵
  PID:5580
- - C:\Windows\SysWOW64\Fhofffjo.exe
    C:\Windows\system32\Fhofffjo.exe
    3⤵
    PID:116
  - - C:\Windows\SysWOW64\Fipbnn32.exe
      C:\Windows\system32\Fipbnn32.exe
      4⤵
      PID:9196

C:\Windows\SysWOW64\Fdffkgpc.exe
C:\Windows\system32\Fdffkgpc.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6924

C:\Windows\SysWOW64\Fkpoha32.exe
C:\Windows\system32\Fkpoha32.exe
1⤵
PID:2832

C:\Windows\SysWOW64\Gpmgph32.exe
C:\Windows\system32\Gpmgph32.exe
1⤵
PID:6648
- C:\Windows\SysWOW64\Gdhcagnp.exe
  C:\Windows\system32\Gdhcagnp.exe
  2⤵
  PID:7828

C:\Windows\SysWOW64\Gielinlg.exe
C:\Windows\system32\Gielinlg.exe
1⤵
PID:3376
- C:\Windows\SysWOW64\Galcjkmj.exe
  C:\Windows\system32\Galcjkmj.exe
  2⤵
  PID:5608
- - C:\Windows\SysWOW64\Gdjpff32.exe
    C:\Windows\system32\Gdjpff32.exe
    3⤵
    PID:6568

C:\Windows\SysWOW64\Gmcdolbn.exe
C:\Windows\system32\Gmcdolbn.exe
1⤵
PID:8620
- C:\Windows\SysWOW64\Gpaqkgba.exe
  C:\Windows\system32\Gpaqkgba.exe
  2⤵
  - Modifies registry class
  PID:7540
- - C:\Windows\SysWOW64\Ghhhmebd.exe
    C:\Windows\system32\Ghhhmebd.exe
    3⤵
    PID:1728

C:\Windows\SysWOW64\Gkgeipah.exe
C:\Windows\system32\Gkgeipah.exe
1⤵
PID:8912
- C:\Windows\SysWOW64\Gneaelqk.exe
  C:\Windows\system32\Gneaelqk.exe
  2⤵
  PID:2504
- - C:\Windows\SysWOW64\Gdoiaf32.exe
    C:\Windows\system32\Gdoiaf32.exe
    3⤵
    PID:7280

C:\Windows\SysWOW64\Ggnenagl.exe
C:\Windows\system32\Ggnenagl.exe
1⤵
PID:7696

C:\Windows\SysWOW64\Gacjkjgb.exe
C:\Windows\system32\Gacjkjgb.exe
1⤵
PID:7712
- C:\Windows\SysWOW64\Gdafgefe.exe
  C:\Windows\system32\Gdafgefe.exe
  2⤵
  - Modifies registry class
  PID:7816

C:\Windows\SysWOW64\Gjnnoldm.exe
C:\Windows\system32\Gjnnoldm.exe
1⤵
PID:7956

C:\Windows\SysWOW64\Hddbmedc.exe
C:\Windows\system32\Hddbmedc.exe
1⤵
PID:1488

C:\Windows\SysWOW64\Hdfobe32.exe
C:\Windows\system32\Hdfobe32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:7912
- C:\Windows\SysWOW64\Hgdlnp32.exe
  C:\Windows\system32\Hgdlnp32.exe
  2⤵
  PID:7524

C:\Windows\SysWOW64\Hajpli32.exe
C:\Windows\system32\Hajpli32.exe
1⤵
PID:7636
- C:\Windows\SysWOW64\Hdhlhd32.exe
  C:\Windows\system32\Hdhlhd32.exe
  2⤵
  PID:760

C:\Windows\SysWOW64\Hkbddo32.exe
C:\Windows\system32\Hkbddo32.exe
1⤵
- Modifies registry class
PID:5856

C:\Windows\SysWOW64\Hpomme32.exe
C:\Windows\system32\Hpomme32.exe
1⤵
- Drops file in System32 directory
PID:8232
- C:\Windows\SysWOW64\Hhfenc32.exe
  C:\Windows\system32\Hhfenc32.exe
  2⤵
  PID:4728

C:\Windows\SysWOW64\Ipdfheal.exe
C:\Windows\system32\Ipdfheal.exe
1⤵
- Modifies registry class
PID:5816
- C:\Windows\SysWOW64\Ihknibbo.exe
  C:\Windows\system32\Ihknibbo.exe
  2⤵
  - Modifies registry class
  PID:8536
- - C:\Windows\SysWOW64\Ijlkqj32.exe
    C:\Windows\system32\Ijlkqj32.exe
    3⤵
    PID:3256
  - - C:\Windows\SysWOW64\Iacbbh32.exe
      C:\Windows\system32\Iacbbh32.exe
      4⤵
      PID:7012

C:\Windows\SysWOW64\Iqfcmdpj.exe
C:\Windows\system32\Iqfcmdpj.exe
1⤵
PID:8288

C:\Windows\SysWOW64\Ijogfj32.exe
C:\Windows\system32\Ijogfj32.exe
1⤵
PID:8124

C:\Windows\SysWOW64\Iddlccfp.exe
C:\Windows\system32\Iddlccfp.exe
1⤵
PID:7612
- C:\Windows\SysWOW64\Igbhpned.exe
  C:\Windows\system32\Igbhpned.exe
  2⤵
  PID:6392
- - C:\Windows\SysWOW64\Ijadljdg.exe
    C:\Windows\system32\Ijadljdg.exe
    3⤵
    PID:7124

C:\Windows\SysWOW64\Iqmincia.exe
C:\Windows\system32\Iqmincia.exe
1⤵
PID:6668
- C:\Windows\SysWOW64\Ikcmklih.exe
  C:\Windows\system32\Ikcmklih.exe
  2⤵
  PID:1860
- - C:\Windows\SysWOW64\Jdnnjane.exe
    C:\Windows\system32\Jdnnjane.exe
    3⤵
    PID:5752
  - - C:\Windows\SysWOW64\Jqdoob32.exe
      C:\Windows\system32\Jqdoob32.exe
      4⤵
      PID:7412
    - - C:\Windows\SysWOW64\Jnhphg32.exe
        
        C:\Windows\system32\Jnhphg32.exe
        5⤵
        
        PID:1612
      - C:\Windows\SysWOW64\Jqgldb32.exe
        
        C:\Windows\system32\Jqgldb32.exe
        6⤵
        
        PID:6232

C:\Windows\SysWOW64\Jnklnfpq.exe
C:\Windows\system32\Jnklnfpq.exe
1⤵
PID:8800

C:\Windows\SysWOW64\Kijcanhl.exe
C:\Windows\system32\Kijcanhl.exe
1⤵
PID:8564

C:\Windows\SysWOW64\Malgmm32.exe
C:\Windows\system32\Malgmm32.exe
1⤵
PID:5332

C:\Windows\SysWOW64\Nhfpjghi.exe
C:\Windows\system32\Nhfpjghi.exe
1⤵
PID:2012
- C:\Windows\SysWOW64\Njdlfbgm.exe
  C:\Windows\system32\Njdlfbgm.exe
  2⤵
  PID:3248

C:\Windows\SysWOW64\Nejpckgc.exe
C:\Windows\system32\Nejpckgc.exe
1⤵
PID:4336

C:\Windows\SysWOW64\Njghkb32.exe
C:\Windows\system32\Njghkb32.exe
1⤵
PID:6284
- C:\Windows\SysWOW64\Nbnpmp32.exe
  C:\Windows\system32\Nbnpmp32.exe
  2⤵
  PID:8776
- - C:\Windows\SysWOW64\Nelmik32.exe
    C:\Windows\system32\Nelmik32.exe
    3⤵
    PID:3688

C:\Windows\SysWOW64\Nkieab32.exe
C:\Windows\system32\Nkieab32.exe
1⤵
PID:2996
- C:\Windows\SysWOW64\Nbqmbo32.exe
  C:\Windows\system32\Nbqmbo32.exe
  2⤵
  PID:4476

C:\Windows\SysWOW64\Nbefmopd.exe
C:\Windows\system32\Nbefmopd.exe
1⤵
PID:5880
- C:\Windows\SysWOW64\Oeccijoh.exe
  C:\Windows\system32\Oeccijoh.exe
  2⤵
  PID:7292

C:\Windows\SysWOW64\Ohboeenl.exe
C:\Windows\system32\Ohboeenl.exe
1⤵
PID:4984
- C:\Windows\SysWOW64\Okpkaqmp.exe
  C:\Windows\system32\Okpkaqmp.exe
  2⤵
  PID:5352
- - C:\Windows\SysWOW64\Obgccn32.exe
    C:\Windows\system32\Obgccn32.exe
    3⤵
    PID:8500
  - - C:\Windows\SysWOW64\Oefpoi32.exe
      C:\Windows\system32\Oefpoi32.exe
      4⤵
      PID:7648
    - - C:\Windows\SysWOW64\Olphlcdb.exe
        
        C:\Windows\system32\Olphlcdb.exe
        5⤵
        
        PID:8052
      - C:\Windows\SysWOW64\Oampdkbj.exe
        
        C:\Windows\system32\Oampdkbj.exe
        6⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Oidhehcl.exe
        
        C:\Windows\system32\Oidhehcl.exe
        7⤵
        
        PID:1428

C:\Windows\SysWOW64\Piknfgmd.exe
C:\Windows\system32\Piknfgmd.exe
1⤵
PID:8044
- C:\Windows\SysWOW64\Plijbblh.exe
  C:\Windows\system32\Plijbblh.exe
  2⤵
  PID:8972
- - C:\Windows\SysWOW64\Poggnnkk.exe
    C:\Windows\system32\Poggnnkk.exe
    3⤵
    PID:5312

C:\Windows\SysWOW64\Pafcjijo.exe
C:\Windows\system32\Pafcjijo.exe
1⤵
PID:3700
- C:\Windows\SysWOW64\Phpkgc32.exe
  C:\Windows\system32\Phpkgc32.exe
  2⤵
  PID:7708
- - C:\Windows\SysWOW64\Pkngco32.exe
    C:\Windows\system32\Pkngco32.exe
    3⤵
    PID:4952
  - - C:\Windows\SysWOW64\Pcepdl32.exe
      C:\Windows\system32\Pcepdl32.exe
      4⤵
      PID:4900

C:\Windows\SysWOW64\Pedlpgqe.exe
C:\Windows\system32\Pedlpgqe.exe
1⤵
PID:4492
- C:\Windows\SysWOW64\Phbhlcpi.exe
  C:\Windows\system32\Phbhlcpi.exe
  2⤵
  PID:5780
- - C:\Windows\SysWOW64\Pkqdhnom.exe
    C:\Windows\system32\Pkqdhnom.exe
    3⤵
    PID:2360

C:\Windows\SysWOW64\Pkcannmj.exe
C:\Windows\system32\Pkcannmj.exe
1⤵
PID:1048
- C:\Windows\SysWOW64\Pamikh32.exe
  C:\Windows\system32\Pamikh32.exe
  2⤵
  PID:4064
- - C:\Windows\SysWOW64\Pidaleei.exe
    C:\Windows\system32\Pidaleei.exe
    3⤵
    PID:8672

C:\Windows\SysWOW64\Plbmhadm.exe
C:\Windows\system32\Plbmhadm.exe
1⤵
PID:6336
- C:\Windows\SysWOW64\Poajdlcq.exe
  C:\Windows\system32\Poajdlcq.exe
  2⤵
  PID:6276
- - C:\Windows\SysWOW64\Qaofphbd.exe
    C:\Windows\system32\Qaofphbd.exe
    3⤵
    PID:2592

C:\Windows\SysWOW64\Qcobjk32.exe
C:\Windows\system32\Qcobjk32.exe
1⤵
PID:3684
- C:\Windows\SysWOW64\Qemoff32.exe
  C:\Windows\system32\Qemoff32.exe
  2⤵
  PID:8864
- - C:\Windows\SysWOW64\Qhlkbaho.exe
    C:\Windows\system32\Qhlkbaho.exe
    3⤵
    PID:4724
  - - C:\Windows\SysWOW64\Qoecol32.exe
      C:\Windows\system32\Qoecol32.exe
      4⤵
      PID:8548
    - - C:\Windows\SysWOW64\Aadokg32.exe
        
        C:\Windows\system32\Aadokg32.exe
        5⤵
        
        PID:1248

C:\Windows\SysWOW64\Aohpek32.exe
C:\Windows\system32\Aohpek32.exe
1⤵
PID:8404
- C:\Windows\SysWOW64\Aaflag32.exe
  C:\Windows\system32\Aaflag32.exe
  2⤵
  PID:6804
- - C:\Windows\SysWOW64\Ajndbd32.exe
    C:\Windows\system32\Ajndbd32.exe
    3⤵
    PID:6476

C:\Windows\SysWOW64\Allpnplb.exe
C:\Windows\system32\Allpnplb.exe
1⤵
PID:8780
- C:\Windows\SysWOW64\Aojljkkf.exe
  C:\Windows\system32\Aojljkkf.exe
  2⤵
  PID:2948
- - C:\Windows\SysWOW64\Aaiiffjj.exe
    C:\Windows\system32\Aaiiffjj.exe
    3⤵
    PID:6800

C:\Windows\SysWOW64\Ahbacq32.exe
C:\Windows\system32\Ahbacq32.exe
1⤵
PID:6192
- C:\Windows\SysWOW64\Akamol32.exe
  C:\Windows\system32\Akamol32.exe
  2⤵
  PID:700
- - C:\Windows\SysWOW64\Acheqi32.exe
    C:\Windows\system32\Acheqi32.exe
    3⤵
    PID:448

C:\Windows\SysWOW64\Afgame32.exe
C:\Windows\system32\Afgame32.exe
1⤵
PID:7896
- C:\Windows\SysWOW64\Alqjiohm.exe
  C:\Windows\system32\Alqjiohm.exe
  2⤵
  PID:7916
- - C:\Windows\SysWOW64\Ackbfioj.exe
    C:\Windows\system32\Ackbfioj.exe
    3⤵
    PID:9052
  - - C:\Windows\SysWOW64\Afinbdon.exe
      C:\Windows\system32\Afinbdon.exe
      4⤵
      PID:5432

C:\Windows\SysWOW64\Bocoqj32.exe
C:\Windows\system32\Bocoqj32.exe
1⤵
PID:3448
- C:\Windows\SysWOW64\Bbbkmebo.exe
  C:\Windows\system32\Bbbkmebo.exe
  2⤵
  PID:5592
- - C:\Windows\SysWOW64\Bhldio32.exe
    C:\Windows\system32\Bhldio32.exe
    3⤵
    PID:6496

C:\Windows\SysWOW64\Bhnqoo32.exe
C:\Windows\system32\Bhnqoo32.exe
1⤵
PID:6896
- C:\Windows\SysWOW64\Bkmmkj32.exe
  C:\Windows\system32\Bkmmkj32.exe
  2⤵
  PID:2216
- - C:\Windows\SysWOW64\Bcddlhgo.exe
    C:\Windows\system32\Bcddlhgo.exe
    3⤵
    PID:6920

C:\Windows\SysWOW64\Cmabpmjj.exe
C:\Windows\system32\Cmabpmjj.exe
1⤵
PID:7532
- C:\Windows\SysWOW64\Cooolhin.exe
  C:\Windows\system32\Cooolhin.exe
  2⤵
  PID:5876
- - C:\Windows\SysWOW64\Cbnkhcha.exe
    C:\Windows\system32\Cbnkhcha.exe
    3⤵
    PID:4288

C:\Windows\SysWOW64\Cobkbhgk.exe
C:\Windows\system32\Cobkbhgk.exe
1⤵
PID:5508
- C:\Windows\SysWOW64\Cbphncfo.exe
  C:\Windows\system32\Cbphncfo.exe
  2⤵
  PID:1704
- - C:\Windows\SysWOW64\Cijpkmml.exe
    C:\Windows\system32\Cijpkmml.exe
    3⤵
    PID:8084

C:\Windows\SysWOW64\Cilmpmki.exe
C:\Windows\system32\Cilmpmki.exe
1⤵
PID:3524
- C:\Windows\SysWOW64\Ckkilhjm.exe
  C:\Windows\system32\Ckkilhjm.exe
  2⤵
  PID:6928
- - C:\Windows\SysWOW64\Ccbanfko.exe
    C:\Windows\system32\Ccbanfko.exe
    3⤵
    PID:3816

C:\Windows\SysWOW64\Cfqmjajc.exe
C:\Windows\system32\Cfqmjajc.exe
1⤵
PID:6412
- C:\Windows\SysWOW64\Cioifm32.exe
  C:\Windows\system32\Cioifm32.exe
  2⤵
  PID:2376
- - C:\Windows\SysWOW64\Dkmebh32.exe
    C:\Windows\system32\Dkmebh32.exe
    3⤵
    PID:4092

C:\Windows\SysWOW64\Dbgnobpg.exe
C:\Windows\system32\Dbgnobpg.exe
1⤵
PID:932
- C:\Windows\SysWOW64\Diafkl32.exe
  C:\Windows\system32\Diafkl32.exe
  2⤵
  PID:4168
- - C:\Windows\SysWOW64\Dkpbgh32.exe
    C:\Windows\system32\Dkpbgh32.exe
    3⤵
    PID:6248
  - - C:\Windows\SysWOW64\Dcgjie32.exe
      C:\Windows\system32\Dcgjie32.exe
      4⤵
      PID:8188

C:\Windows\SysWOW64\Dfgcjpdk.exe
C:\Windows\system32\Dfgcjpdk.exe
1⤵
PID:6816
- C:\Windows\SysWOW64\Difpflco.exe
  C:\Windows\system32\Difpflco.exe
  2⤵
  PID:3568
- - C:\Windows\SysWOW64\Dldlbgbb.exe
    C:\Windows\system32\Dldlbgbb.exe
    3⤵
    PID:8452

C:\Windows\SysWOW64\Dckdddcd.exe
C:\Windows\system32\Dckdddcd.exe
1⤵
PID:8568
- C:\Windows\SysWOW64\Djelqo32.exe
  C:\Windows\system32\Djelqo32.exe
  2⤵
  PID:4076
- - C:\Windows\SysWOW64\Dmdhmj32.exe
    C:\Windows\system32\Dmdhmj32.exe
    3⤵
    PID:7980

C:\Windows\SysWOW64\Dpbdiehi.exe
C:\Windows\system32\Dpbdiehi.exe
1⤵
PID:2440
- C:\Windows\SysWOW64\Dbqqeahl.exe
  C:\Windows\system32\Dbqqeahl.exe
  2⤵
  PID:9056
- - C:\Windows\SysWOW64\Djhifnho.exe
    C:\Windows\system32\Djhifnho.exe
    3⤵
    PID:6452

C:\Windows\SysWOW64\Emfebjgb.exe
C:\Windows\system32\Emfebjgb.exe
1⤵
PID:736
- C:\Windows\SysWOW64\Epdaneff.exe
  C:\Windows\system32\Epdaneff.exe
  2⤵
  PID:796

C:\Windows\SysWOW64\Ecbjdcml.exe
C:\Windows\system32\Ecbjdcml.exe
1⤵
PID:5400
- C:\Windows\SysWOW64\Ejlban32.exe
  C:\Windows\system32\Ejlban32.exe
  2⤵
  PID:820
- - C:\Windows\SysWOW64\Emknmi32.exe
    C:\Windows\system32\Emknmi32.exe
    3⤵
    PID:4892
  - - C:\Windows\SysWOW64\Epikid32.exe
      C:\Windows\system32\Epikid32.exe
      4⤵
      PID:8592
    - - C:\Windows\SysWOW64\Ebggep32.exe
        
        C:\Windows\system32\Ebggep32.exe
        5⤵
        
        PID:1448

C:\Windows\SysWOW64\Ejoogm32.exe
C:\Windows\system32\Ejoogm32.exe
1⤵
PID:8204
- C:\Windows\SysWOW64\Emmkci32.exe
  C:\Windows\system32\Emmkci32.exe
  2⤵
  PID:1952
- - C:\Windows\SysWOW64\Eplgod32.exe
    C:\Windows\system32\Eplgod32.exe
    3⤵
    PID:6592

C:\Windows\SysWOW64\Ecipeb32.exe
C:\Windows\system32\Ecipeb32.exe
1⤵
PID:7120
- C:\Windows\SysWOW64\Fifhmi32.exe
  C:\Windows\system32\Fifhmi32.exe
  2⤵
  PID:9116
- - C:\Windows\SysWOW64\Fppqjcli.exe
    C:\Windows\system32\Fppqjcli.exe
    3⤵
    PID:4340

C:\Windows\SysWOW64\Fdnipbbo.exe
C:\Windows\system32\Fdnipbbo.exe
1⤵
PID:5548
- C:\Windows\SysWOW64\Ffmelmbc.exe
  C:\Windows\system32\Ffmelmbc.exe
  2⤵
  PID:7268

C:\Windows\SysWOW64\Fikbhiaf.exe
C:\Windows\system32\Fikbhiaf.exe
1⤵
PID:5440
- C:\Windows\SysWOW64\Flinddpj.exe
  C:\Windows\system32\Flinddpj.exe
  2⤵
  PID:7076

C:\Windows\SysWOW64\Fjmkhkff.exe
C:\Windows\system32\Fjmkhkff.exe
1⤵
PID:2316
- C:\Windows\SysWOW64\Flngpc32.exe
  C:\Windows\system32\Flngpc32.exe
  2⤵
  PID:3552
- - C:\Windows\SysWOW64\Fbhplnca.exe
    C:\Windows\system32\Fbhplnca.exe
    3⤵
    PID:7056

C:\Windows\SysWOW64\Gjohnkdd.exe
C:\Windows\system32\Gjohnkdd.exe
1⤵
PID:4272
- C:\Windows\SysWOW64\Gmndjf32.exe
  C:\Windows\system32\Gmndjf32.exe
  2⤵
  PID:8660
- - C:\Windows\SysWOW64\Gplpfb32.exe
    C:\Windows\system32\Gplpfb32.exe
    3⤵
    PID:5872
  - - C:\Windows\SysWOW64\Gbjlbm32.exe
      C:\Windows\system32\Gbjlbm32.exe
      4⤵
      PID:8176

C:\Windows\SysWOW64\Gjadck32.exe
C:\Windows\system32\Gjadck32.exe
1⤵
PID:1600
- C:\Windows\SysWOW64\Gmpqof32.exe
  C:\Windows\system32\Gmpqof32.exe
  2⤵
  PID:8544
- - C:\Windows\SysWOW64\Gpnmka32.exe
    C:\Windows\system32\Gpnmka32.exe
    3⤵
    PID:7576
  - - C:\Windows\SysWOW64\Gfhehlhe.exe
      C:\Windows\system32\Gfhehlhe.exe
      4⤵
      PID:7644

C:\Windows\SysWOW64\Gmdjjemp.exe
C:\Windows\system32\Gmdjjemp.exe
1⤵
PID:9372
- C:\Windows\SysWOW64\Gpcffalc.exe
  C:\Windows\system32\Gpcffalc.exe
  2⤵
  PID:9408
- - C:\Windows\SysWOW64\Ggmock32.exe
    C:\Windows\system32\Ggmock32.exe
    3⤵
    PID:9448
  - - C:\Windows\SysWOW64\Gikkof32.exe
      C:\Windows\system32\Gikkof32.exe
      4⤵
      PID:9488

C:\Windows\SysWOW64\Gpeclq32.exe
C:\Windows\system32\Gpeclq32.exe
1⤵
PID:9528
- C:\Windows\SysWOW64\Hgokikan.exe
  C:\Windows\system32\Hgokikan.exe
  2⤵
  PID:9568
- - C:\Windows\SysWOW64\Hingefqa.exe
    C:\Windows\system32\Hingefqa.exe
    3⤵
    PID:9604
  - - C:\Windows\SysWOW64\Hlldaape.exe
      C:\Windows\system32\Hlldaape.exe
      4⤵
      PID:9660
    - - C:\Windows\SysWOW64\Ilhcmpeg.exe
        
        C:\Windows\system32\Ilhcmpeg.exe
        5⤵
        
        PID:9704

C:\Windows\SysWOW64\Fmdach32.exe
C:\Windows\system32\Fmdach32.exe
1⤵
PID:388

C:\Windows\SysWOW64\Ipcomo32.exe
C:\Windows\system32\Ipcomo32.exe
1⤵
PID:9744
- C:\Windows\SysWOW64\Icalij32.exe
  C:\Windows\system32\Icalij32.exe
  2⤵
  PID:9784
- - C:\Windows\SysWOW64\Ikickgnf.exe
    C:\Windows\system32\Ikickgnf.exe
    3⤵
    PID:9824
  - - C:\Windows\SysWOW64\Iljpbp32.exe
      C:\Windows\system32\Iljpbp32.exe
      4⤵
      PID:9864

C:\Windows\SysWOW64\Icdhojka.exe
C:\Windows\system32\Icdhojka.exe
1⤵
PID:9900
- C:\Windows\SysWOW64\Ikkppgld.exe
  C:\Windows\system32\Ikkppgld.exe
  2⤵
  PID:9936
- - C:\Windows\SysWOW64\Injmlbkh.exe
    C:\Windows\system32\Injmlbkh.exe
    3⤵
    PID:9972
  - - C:\Windows\SysWOW64\Iphihnjk.exe
      C:\Windows\system32\Iphihnjk.exe
      4⤵
      PID:10012
    - - C:\Windows\SysWOW64\Icfediio.exe
        
        C:\Windows\system32\Icfediio.exe
        5⤵
        
        PID:10048
      - C:\Windows\SysWOW64\Ijqmacpl.exe
        
        C:\Windows\system32\Ijqmacpl.exe
        6⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Ipjenn32.exe
        
        C:\Windows\system32\Ipjenn32.exe
        7⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Iciaji32.exe
        
        C:\Windows\system32\Iciaji32.exe
        8⤵
        
        PID:10160

C:\Windows\SysWOW64\Ikpjkf32.exe
C:\Windows\system32\Ikpjkf32.exe
1⤵
PID:10196
- C:\Windows\SysWOW64\Innfgb32.exe
  C:\Windows\system32\Innfgb32.exe
  2⤵
  PID:10232
- - C:\Windows\SysWOW64\Jdhndlno.exe
    C:\Windows\system32\Jdhndlno.exe
    3⤵
    PID:9260

C:\Windows\SysWOW64\Jggjpgmc.exe
C:\Windows\system32\Jggjpgmc.exe
1⤵
PID:9312
- C:\Windows\SysWOW64\Jjeflc32.exe
  C:\Windows\system32\Jjeflc32.exe
  2⤵
  PID:9380
- - C:\Windows\SysWOW64\Jpooimdc.exe
    C:\Windows\system32\Jpooimdc.exe
    3⤵
    PID:9436

C:\Windows\SysWOW64\Jcmkehcg.exe
C:\Windows\system32\Jcmkehcg.exe
1⤵
PID:9512
- C:\Windows\SysWOW64\Jjgcbb32.exe
  C:\Windows\system32\Jjgcbb32.exe
  2⤵
  PID:9552
- - C:\Windows\SysWOW64\Jlfpnn32.exe
    C:\Windows\system32\Jlfpnn32.exe
    3⤵
    PID:9644
  - - C:\Windows\SysWOW64\Jdmgok32.exe
      C:\Windows\system32\Jdmgok32.exe
      4⤵
      PID:9668

C:\Windows\SysWOW64\Jkgpleaf.exe
C:\Windows\system32\Jkgpleaf.exe
1⤵
PID:9732
- C:\Windows\SysWOW64\Jnelha32.exe
  C:\Windows\system32\Jnelha32.exe
  2⤵
  PID:9804
- - C:\Windows\SysWOW64\Jdodekhg.exe
    C:\Windows\system32\Jdodekhg.exe
    3⤵
    PID:9888
  - - C:\Windows\SysWOW64\Jkimae32.exe
      C:\Windows\system32\Jkimae32.exe
      4⤵
      PID:9944
    - - C:\Windows\SysWOW64\Jljiimeb.exe
        
        C:\Windows\system32\Jljiimeb.exe
        5⤵
        
        PID:10032
      - C:\Windows\SysWOW64\Jcdafg32.exe
        
        C:\Windows\system32\Jcdafg32.exe
        6⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Jkligd32.exe
        
        C:\Windows\system32\Jkligd32.exe
        7⤵
        
        PID:10156

C:\Windows\SysWOW64\Jnjecp32.exe
C:\Windows\system32\Jnjecp32.exe
1⤵
PID:1824
- C:\Windows\SysWOW64\Jqhaolli.exe
  C:\Windows\system32\Jqhaolli.exe
  2⤵
  PID:9300
- - C:\Windows\SysWOW64\Kgbjlf32.exe
    C:\Windows\system32\Kgbjlf32.exe
    3⤵
    PID:9420
  - - C:\Windows\SysWOW64\Kjafha32.exe
      C:\Windows\system32\Kjafha32.exe
      4⤵
      PID:9508

C:\Windows\SysWOW64\Kqknekjf.exe
C:\Windows\system32\Kqknekjf.exe
1⤵
PID:9612
- C:\Windows\SysWOW64\Kcikagij.exe
  C:\Windows\system32\Kcikagij.exe
  2⤵
  PID:9712
- - C:\Windows\SysWOW64\Kjccna32.exe
    C:\Windows\system32\Kjccna32.exe
    3⤵
    PID:9808
  - - C:\Windows\SysWOW64\Kqmkjk32.exe
      C:\Windows\system32\Kqmkjk32.exe
      4⤵
      PID:9932
    - - C:\Windows\SysWOW64\Kggcgeop.exe
        
        C:\Windows\system32\Kggcgeop.exe
        5⤵
        
        PID:10112
      - C:\Windows\SysWOW64\Knaldo32.exe
        
        C:\Windows\system32\Knaldo32.exe
        6⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Kqphpk32.exe
        
        C:\Windows\system32\Kqphpk32.exe
        7⤵
        
        PID:9396

C:\Windows\SysWOW64\Kcndlf32.exe
C:\Windows\system32\Kcndlf32.exe
1⤵
PID:9636
- C:\Windows\SysWOW64\Kjhlipla.exe
  C:\Windows\system32\Kjhlipla.exe
  2⤵
  PID:9776

C:\Windows\SysWOW64\Kmfhelke.exe
C:\Windows\system32\Kmfhelke.exe
1⤵
PID:9992
- C:\Windows\SysWOW64\Kcpqafba.exe
  C:\Windows\system32\Kcpqafba.exe
  2⤵
  PID:10116
- - C:\Windows\SysWOW64\Kkgicccd.exe
    C:\Windows\system32\Kkgicccd.exe
    3⤵
    PID:9540
  - - C:\Windows\SysWOW64\Knfeoobh.exe
      C:\Windows\system32\Knfeoobh.exe
      4⤵
      PID:9928

C:\Windows\SysWOW64\Lqdakjak.exe
C:\Windows\system32\Lqdakjak.exe
1⤵
PID:9356
- C:\Windows\SysWOW64\Lgnihd32.exe
  C:\Windows\system32\Lgnihd32.exe
  2⤵
  PID:9792
- - C:\Windows\SysWOW64\Ljmfdp32.exe
    C:\Windows\system32\Ljmfdp32.exe
    3⤵
    PID:9484

C:\Windows\SysWOW64\Lmkbpk32.exe
C:\Windows\system32\Lmkbpk32.exe
1⤵
PID:10084
- C:\Windows\SysWOW64\Ldbjah32.exe
  C:\Windows\system32\Ldbjah32.exe
  2⤵
  PID:10248
- - C:\Windows\SysWOW64\Lgqfmcge.exe
    C:\Windows\system32\Lgqfmcge.exe
    3⤵
    PID:10292

C:\Windows\SysWOW64\Lnjnjn32.exe
C:\Windows\system32\Lnjnjn32.exe
1⤵
PID:10332
- C:\Windows\SysWOW64\Lqikfi32.exe
  C:\Windows\system32\Lqikfi32.exe
  2⤵
  PID:10368
- - C:\Windows\SysWOW64\Lcggbd32.exe
    C:\Windows\system32\Lcggbd32.exe
    3⤵
    PID:10408
  - - C:\Windows\SysWOW64\Lknocb32.exe
      C:\Windows\system32\Lknocb32.exe
      4⤵
      PID:10444
    - - C:\Windows\SysWOW64\Lmpkkjcj.exe
        
        C:\Windows\system32\Lmpkkjcj.exe
        5⤵
        
        PID:10484

C:\Windows\SysWOW64\Ldgclgcl.exe
C:\Windows\system32\Ldgclgcl.exe
1⤵
PID:10520
- C:\Windows\SysWOW64\Lkqliaki.exe
  C:\Windows\system32\Lkqliaki.exe
  2⤵
  PID:10560

C:\Windows\SysWOW64\Lnohemjm.exe
C:\Windows\system32\Lnohemjm.exe
1⤵
PID:10600
- C:\Windows\SysWOW64\Lqndahiq.exe
  C:\Windows\system32\Lqndahiq.exe
  2⤵
  PID:10636
- - C:\Windows\SysWOW64\Lclpmdhd.exe
    C:\Windows\system32\Lclpmdhd.exe
    3⤵
    PID:10672

C:\Windows\SysWOW64\Lkchoaif.exe
C:\Windows\system32\Lkchoaif.exe
1⤵
PID:10708
- C:\Windows\SysWOW64\Lnadkmhj.exe
  C:\Windows\system32\Lnadkmhj.exe
  2⤵
  PID:10748
- - C:\Windows\SysWOW64\Mqpqghgn.exe
    C:\Windows\system32\Mqpqghgn.exe
    3⤵
    PID:10784

C:\Windows\SysWOW64\Mcnmccfa.exe
C:\Windows\system32\Mcnmccfa.exe
1⤵
PID:10820
- C:\Windows\SysWOW64\Mjhepnno.exe
  C:\Windows\system32\Mjhepnno.exe
  2⤵
  PID:10860
- - C:\Windows\SysWOW64\Mmfalimb.exe
    C:\Windows\system32\Mmfalimb.exe
    3⤵
    PID:10900

C:\Windows\SysWOW64\Mcqjhc32.exe
C:\Windows\system32\Mcqjhc32.exe
1⤵
PID:10940
- C:\Windows\SysWOW64\Mkhajq32.exe
  C:\Windows\system32\Mkhajq32.exe
  2⤵
  PID:10984
- - C:\Windows\SysWOW64\Mnfnfl32.exe
    C:\Windows\system32\Mnfnfl32.exe
    3⤵
    PID:11028
  - - C:\Windows\SysWOW64\Mepfbflb.exe
      C:\Windows\system32\Mepfbflb.exe
      4⤵
      PID:11072

C:\Windows\SysWOW64\Mgoboake.exe
C:\Windows\system32\Mgoboake.exe
1⤵
PID:11112
- C:\Windows\SysWOW64\Mjmokmji.exe
  C:\Windows\system32\Mjmokmji.exe
  2⤵
  PID:11148
- - C:\Windows\SysWOW64\Mmkkgh32.exe
    C:\Windows\system32\Mmkkgh32.exe
    3⤵
    PID:11184
  - - C:\Windows\SysWOW64\Mebchf32.exe
      C:\Windows\system32\Mebchf32.exe
      4⤵
      PID:11220

C:\Windows\SysWOW64\Mklkepal.exe
C:\Windows\system32\Mklkepal.exe
1⤵
PID:11260
- C:\Windows\SysWOW64\Mnkgakpp.exe
  C:\Windows\system32\Mnkgakpp.exe
  2⤵
  PID:10272
- - C:\Windows\SysWOW64\Meepne32.exe
    C:\Windows\system32\Meepne32.exe
    3⤵
    PID:10364

C:\Windows\SysWOW64\Mgclja32.exe
C:\Windows\system32\Mgclja32.exe
1⤵
PID:10456
- C:\Windows\SysWOW64\Nnmdfknm.exe
  C:\Windows\system32\Nnmdfknm.exe
  2⤵
  PID:10508
- - C:\Windows\SysWOW64\Neglceej.exe
    C:\Windows\system32\Neglceej.exe
    3⤵
    PID:10568

C:\Windows\SysWOW64\Ngehoqdn.exe
C:\Windows\system32\Ngehoqdn.exe
1⤵
PID:10644
- C:\Windows\SysWOW64\Njdeklca.exe
  C:\Windows\system32\Njdeklca.exe
  2⤵
  PID:10700
- - C:\Windows\SysWOW64\Nmbaggce.exe
    C:\Windows\system32\Nmbaggce.exe
    3⤵
    PID:10792
  - - C:\Windows\SysWOW64\Neiiiecg.exe
      C:\Windows\system32\Neiiiecg.exe
      4⤵
      PID:10852

C:\Windows\SysWOW64\Nhheepbk.exe
C:\Windows\system32\Nhheepbk.exe
1⤵
PID:10920
- C:\Windows\SysWOW64\Njfaalao.exe
  C:\Windows\system32\Njfaalao.exe
  2⤵
  PID:10972
- - C:\Windows\SysWOW64\Nmenmgab.exe
    C:\Windows\system32\Nmenmgab.exe
    3⤵
    PID:11040

C:\Windows\SysWOW64\Ncofjaho.exe
C:\Windows\system32\Ncofjaho.exe
1⤵
PID:11096
- C:\Windows\SysWOW64\Nlfnkoia.exe
  C:\Windows\system32\Nlfnkoia.exe
  2⤵
  PID:11156
- - C:\Windows\SysWOW64\Nndjgjhe.exe
    C:\Windows\system32\Nndjgjhe.exe
    3⤵
    PID:11216

C:\Windows\SysWOW64\Nenbdd32.exe
C:\Windows\system32\Nenbdd32.exe
1⤵
PID:10284
- C:\Windows\SysWOW64\Nhmopp32.exe
  C:\Windows\system32\Nhmopp32.exe
  2⤵
  PID:10360

C:\Windows\SysWOW64\Nnfgmjfb.exe
C:\Windows\system32\Nnfgmjfb.exe
1⤵
PID:10492
- C:\Windows\SysWOW64\Neqoidmo.exe
  C:\Windows\system32\Neqoidmo.exe
  2⤵
  PID:10628
- - C:\Windows\SysWOW64\Nhokeolc.exe
    C:\Windows\system32\Nhokeolc.exe
    3⤵
    PID:10716
  - - C:\Windows\SysWOW64\Ohceqo32.exe
      C:\Windows\system32\Ohceqo32.exe
      4⤵
      PID:10896
    - - C:\Windows\SysWOW64\Ompmie32.exe
        
        C:\Windows\system32\Ompmie32.exe
        5⤵
        
        PID:11012

C:\Windows\SysWOW64\Odjeepna.exe
C:\Windows\system32\Odjeepna.exe
1⤵
PID:11136
- C:\Windows\SysWOW64\Olangmod.exe
  C:\Windows\system32\Olangmod.exe
  2⤵
  PID:11236
- - C:\Windows\SysWOW64\Omcjne32.exe
    C:\Windows\system32\Omcjne32.exe
    3⤵
    PID:5716

C:\Windows\SysWOW64\Oejbpb32.exe
C:\Windows\system32\Oejbpb32.exe
1⤵
PID:10424
- C:\Windows\SysWOW64\Ohhnln32.exe
  C:\Windows\system32\Ohhnln32.exe
  2⤵
  PID:10552
- - C:\Windows\SysWOW64\Ojgjhicl.exe
    C:\Windows\system32\Ojgjhicl.exe
    3⤵
    PID:10772

C:\Windows\SysWOW64\Omegdebp.exe
C:\Windows\system32\Omegdebp.exe
1⤵
PID:4904
- C:\Windows\SysWOW64\Oeloebcb.exe
  C:\Windows\system32\Oeloebcb.exe
  2⤵
  PID:652
- - C:\Windows\SysWOW64\Ohkkanbe.exe
    C:\Windows\system32\Ohkkanbe.exe
    3⤵
    PID:11100
  - - C:\Windows\SysWOW64\Podcnh32.exe
      C:\Windows\system32\Podcnh32.exe
      4⤵
      PID:10312
    - - C:\Windows\SysWOW64\Pacojc32.exe
        
        C:\Windows\system32\Pacojc32.exe
        5⤵
        
        PID:10512
      - C:\Windows\SysWOW64\Phmhgmpc.exe
        
        C:\Windows\system32\Phmhgmpc.exe
        6⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\Paelpcgc.exe
        
        C:\Windows\system32\Paelpcgc.exe
        7⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Phodlm32.exe
        
        C:\Windows\system32\Phodlm32.exe
        8⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Pmlmdd32.exe
        
        C:\Windows\system32\Pmlmdd32.exe
        9⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Pdfeandd.exe
        
        C:\Windows\system32\Pdfeandd.exe
        10⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Pkpmnh32.exe
        
        C:\Windows\system32\Pkpmnh32.exe
        11⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Pajekb32.exe
        
        C:\Windows\system32\Pajekb32.exe
        12⤵
        
        PID:8112

C:\Windows\SysWOW64\Pdhbgn32.exe
C:\Windows\system32\Pdhbgn32.exe
1⤵
PID:220
- C:\Windows\SysWOW64\Pkbjchio.exe
  C:\Windows\system32\Pkbjchio.exe
  2⤵
  PID:6700
- - C:\Windows\SysWOW64\Pmafpchb.exe
    C:\Windows\system32\Pmafpchb.exe
    3⤵
    PID:5584
  - - C:\Windows\SysWOW64\Pehnaqid.exe
      C:\Windows\system32\Pehnaqid.exe
      4⤵
      PID:8132

C:\Windows\SysWOW64\Phfjmlhh.exe
C:\Windows\system32\Phfjmlhh.exe
1⤵
PID:7960
- C:\Windows\SysWOW64\Qkegiggl.exe
  C:\Windows\system32\Qkegiggl.exe
  2⤵
  PID:11284
- - C:\Windows\SysWOW64\Qmccecfp.exe
    C:\Windows\system32\Qmccecfp.exe
    3⤵
    PID:11324

C:\Windows\SysWOW64\Qdmkbmnl.exe
C:\Windows\system32\Qdmkbmnl.exe
1⤵
PID:11368
- C:\Windows\SysWOW64\Qldccjno.exe
  C:\Windows\system32\Qldccjno.exe
  2⤵
  PID:11408
- - C:\Windows\SysWOW64\Qoboofnb.exe
    C:\Windows\system32\Qoboofnb.exe
    3⤵
    PID:11448

C:\Windows\SysWOW64\Qemhlp32.exe
C:\Windows\system32\Qemhlp32.exe
1⤵
PID:11484
- C:\Windows\SysWOW64\Alfpijll.exe
  C:\Windows\system32\Alfpijll.exe
  2⤵
  PID:11520
- - C:\Windows\SysWOW64\Aoeleelp.exe
    C:\Windows\system32\Aoeleelp.exe
    3⤵
    PID:11560
  - - C:\Windows\SysWOW64\Ahmqnkbp.exe
      C:\Windows\system32\Ahmqnkbp.exe
      4⤵
      PID:11600

C:\Windows\SysWOW64\Aogije32.exe
C:\Windows\system32\Aogije32.exe
1⤵
PID:11640
- C:\Windows\SysWOW64\Aafefq32.exe
  C:\Windows\system32\Aafefq32.exe
  2⤵
  PID:11680
- - C:\Windows\SysWOW64\Addabl32.exe
    C:\Windows\system32\Addabl32.exe
    3⤵
    PID:11724
  - - C:\Windows\SysWOW64\Alkidi32.exe
      C:\Windows\system32\Alkidi32.exe
      4⤵
      PID:11764
    - - C:\Windows\SysWOW64\Aojepe32.exe
        
        C:\Windows\system32\Aojepe32.exe
        5⤵
        
        PID:11804
      - C:\Windows\SysWOW64\Aecnmo32.exe
        
        C:\Windows\system32\Aecnmo32.exe
        6⤵
        
        PID:11844

C:\Windows\SysWOW64\Adfnhlfa.exe
C:\Windows\system32\Adfnhlfa.exe
1⤵
PID:11880
- C:\Windows\SysWOW64\Alnfiifd.exe
  C:\Windows\system32\Alnfiifd.exe
  2⤵
  PID:11916
- - C:\Windows\SysWOW64\Aolbedeh.exe
    C:\Windows\system32\Aolbedeh.exe
    3⤵
    PID:11956

C:\Windows\SysWOW64\Aajoapdk.exe
C:\Windows\system32\Aajoapdk.exe
1⤵
PID:11992
- C:\Windows\SysWOW64\Adiknkco.exe
  C:\Windows\system32\Adiknkco.exe
  2⤵
  PID:12028
- - C:\Windows\SysWOW64\Aonokdce.exe
    C:\Windows\system32\Aonokdce.exe
    3⤵
    PID:12080
  - - C:\Windows\SysWOW64\Aamkgpbi.exe
      C:\Windows\system32\Aamkgpbi.exe
      4⤵
      PID:12124

C:\Windows\SysWOW64\Bdkgckal.exe
C:\Windows\system32\Bdkgckal.exe
1⤵
PID:12164
- C:\Windows\SysWOW64\Blbodh32.exe
  C:\Windows\system32\Blbodh32.exe
  2⤵
  PID:12200
- - C:\Windows\SysWOW64\Boqlqd32.exe
    C:\Windows\system32\Boqlqd32.exe
    3⤵
    PID:12240

C:\Windows\SysWOW64\Bdndik32.exe
C:\Windows\system32\Bdndik32.exe
1⤵
PID:11280
- C:\Windows\SysWOW64\Bldljh32.exe
  C:\Windows\system32\Bldljh32.exe
  2⤵
  PID:11308
- - C:\Windows\SysWOW64\Bochfc32.exe
    C:\Windows\system32\Bochfc32.exe
    3⤵
    PID:11392
  - - C:\Windows\SysWOW64\Bemqcngl.exe
      C:\Windows\system32\Bemqcngl.exe
      4⤵
      PID:11432

C:\Windows\SysWOW64\Bkjikd32.exe
C:\Windows\system32\Bkjikd32.exe
1⤵
PID:11512
- C:\Windows\SysWOW64\Bnhegp32.exe
  C:\Windows\system32\Bnhegp32.exe
  2⤵
  PID:11572
- - C:\Windows\SysWOW64\Beomhm32.exe
    C:\Windows\system32\Beomhm32.exe
    3⤵
    PID:11664

C:\Windows\SysWOW64\Bhnidi32.exe
C:\Windows\system32\Bhnidi32.exe
1⤵
PID:11716
- C:\Windows\SysWOW64\Bklfqd32.exe
  C:\Windows\system32\Bklfqd32.exe
  2⤵
  PID:11792
- - C:\Windows\SysWOW64\Bnkbmp32.exe
    C:\Windows\system32\Bnkbmp32.exe
    3⤵
    PID:11840

C:\Windows\SysWOW64\Bddjijia.exe
C:\Windows\system32\Bddjijia.exe
1⤵
PID:11900
- C:\Windows\SysWOW64\Bllbkg32.exe
  C:\Windows\system32\Bllbkg32.exe
  2⤵
  PID:11984
- - C:\Windows\SysWOW64\Bojogb32.exe
    C:\Windows\system32\Bojogb32.exe
    3⤵
    PID:12044
  - - C:\Windows\SysWOW64\Bahkcn32.exe
      C:\Windows\system32\Bahkcn32.exe
      4⤵
      PID:12096

C:\Windows\SysWOW64\Cdggoi32.exe
C:\Windows\system32\Cdggoi32.exe
1⤵
PID:12148
- C:\Windows\SysWOW64\Ckaolcol.exe
  C:\Windows\system32\Ckaolcol.exe
  2⤵
  PID:12220
- - C:\Windows\SysWOW64\Cnokhonp.exe
    C:\Windows\system32\Cnokhonp.exe
    3⤵
    PID:8280
  - - C:\Windows\SysWOW64\Cffcilob.exe
      C:\Windows\system32\Cffcilob.exe
      4⤵
      PID:11316
    - - C:\Windows\SysWOW64\Clplff32.exe
        
        C:\Windows\system32\Clplff32.exe
        5⤵
        
        PID:11376

C:\Windows\SysWOW64\Coohbbeb.exe
C:\Windows\system32\Coohbbeb.exe
1⤵
PID:11472
- C:\Windows\SysWOW64\Cbmdnmdf.exe
  C:\Windows\system32\Cbmdnmdf.exe
  2⤵
  PID:11608
- - C:\Windows\SysWOW64\Cdlpjicj.exe
    C:\Windows\system32\Cdlpjicj.exe
    3⤵
    PID:11712
  - - C:\Windows\SysWOW64\Ckeigc32.exe
      C:\Windows\system32\Ckeigc32.exe
      4⤵
      PID:11832
    - - C:\Windows\SysWOW64\Cbpacmbc.exe
        
        C:\Windows\system32\Cbpacmbc.exe
        5⤵
        
        PID:11948
      - C:\Windows\SysWOW64\Cdnmphag.exe
        
        C:\Windows\system32\Cdnmphag.exe
        6⤵
        
        PID:12072

C:\Windows\SysWOW64\Ckhelb32.exe
C:\Windows\system32\Ckhelb32.exe
1⤵
PID:12172
- C:\Windows\SysWOW64\Cbbnim32.exe
  C:\Windows\system32\Cbbnim32.exe
  2⤵
  PID:7512
- - C:\Windows\SysWOW64\Cdpjeh32.exe
    C:\Windows\system32\Cdpjeh32.exe
    3⤵
    PID:11352
  - - C:\Windows\SysWOW64\Clgbfe32.exe
      C:\Windows\system32\Clgbfe32.exe
      4⤵
      PID:11584
    - - C:\Windows\SysWOW64\Cninnnfe.exe
        
        C:\Windows\system32\Cninnnfe.exe
        5⤵
        
        PID:11668

C:\Windows\SysWOW64\Dfpfokfg.exe
C:\Windows\system32\Dfpfokfg.exe
1⤵
PID:11952
- C:\Windows\SysWOW64\Dkmogbeo.exe
  C:\Windows\system32\Dkmogbeo.exe
  2⤵
  PID:12156
- - C:\Windows\SysWOW64\Dnmhim32.exe
    C:\Windows\system32\Dnmhim32.exe
    3⤵
    PID:7020
  - - C:\Windows\SysWOW64\Ddgpfgil.exe
      C:\Windows\system32\Ddgpfgil.exe
      4⤵
      PID:11568
    - - C:\Windows\SysWOW64\Domdcpib.exe
        
        C:\Windows\system32\Domdcpib.exe
        5⤵
        
        PID:11904
      - C:\Windows\SysWOW64\Dbkpokhf.exe
        
        C:\Windows\system32\Dbkpokhf.exe
        6⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Dieilepc.exe
        
        C:\Windows\system32\Dieilepc.exe
        7⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Dooaip32.exe
        
        C:\Windows\system32\Dooaip32.exe
        8⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\Dfiiejnl.exe
        
        C:\Windows\system32\Dfiiejnl.exe
        9⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Eodjdocj.exe
        
        C:\Windows\system32\Eodjdocj.exe
        10⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Ebdcejpk.exe
        
        C:\Windows\system32\Ebdcejpk.exe
        11⤵
        
        PID:12308

C:\Windows\SysWOW64\Eiokbd32.exe
C:\Windows\system32\Eiokbd32.exe
1⤵
PID:12352
- C:\Windows\SysWOW64\Ekmhnpfl.exe
  C:\Windows\system32\Ekmhnpfl.exe
  2⤵
  PID:12388
- - C:\Windows\SysWOW64\Enkdjkep.exe
    C:\Windows\system32\Enkdjkep.exe
    3⤵
    PID:12424
  - - C:\Windows\SysWOW64\Ekoddodi.exe
      C:\Windows\system32\Ekoddodi.exe
      4⤵
      PID:12460
    - - C:\Windows\SysWOW64\Ebimqi32.exe
        
        C:\Windows\system32\Ebimqi32.exe
        5⤵
        
        PID:12496
      - C:\Windows\SysWOW64\Eicemccc.exe
        
        C:\Windows\system32\Eicemccc.exe
        6⤵
        
        PID:12544
        
        C:\Windows\SysWOW64\Giaaoa32.exe
        
        C:\Windows\system32\Giaaoa32.exe
        7⤵
        
        PID:12588
        
        C:\Windows\SysWOW64\Glpmkm32.exe
        
        C:\Windows\system32\Glpmkm32.exe
        8⤵
        
        PID:12632
        
        C:\Windows\SysWOW64\Gihgoq32.exe
        
        C:\Windows\system32\Gihgoq32.exe
        9⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\Glgckl32.exe
        
        C:\Windows\system32\Glgckl32.exe
        10⤵
        
        PID:12740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aamknj32.exe

Filesize
300KB

MD5
248ea5e2b054d57d7a8f268baae13175

SHA1
76b0e424aafecbf3054e9dea18cb25cdae603cfc

SHA256
056c4ca1afb0e5abd324e125d993ffed52018b1d566786a92291befbaf93e584

SHA512
7874425562c86ce5ea49f3f2da2633bf8df6e791fb979aca4c9cc78c4d50199fa1686ea79d155b7da3b8a3a2e8069dde80c2909baff1d8bb6000389cbc2980e4

Download Submit
C:\Windows\SysWOW64\Aamknj32.exe

Filesize
377KB

MD5
2fbb434985aa28e1eded80229f4fb9ff

SHA1
adfd6f5c3387b41938f72a8e9a2eeac54f2b64b9

SHA256
c00e7a60728550512d9804bddf1b4cb724935f097a535a7f5ef003ad428cfb1c

SHA512
792ddaed84f7e92796b811a2958d80bd3d2e8cf8900780000f106c71c64816746f1bd6bc8fbc3d899925c78f4f42100ff090837a0898d339b2c6ab4b9fae662b

Download Submit
C:\Windows\SysWOW64\Adfnofpd.exe

Filesize
377KB

MD5
050a5d8f0c14017304db00e023b47a09

SHA1
73a14bd9844a4ee8594631ebb8524bf4d375f849

SHA256
b7457bb972f7cd87915cbe1a0173a87c6581b358aa9a0d050d1295d1a768fb82

SHA512
eb12f9915cdbde2946676d96fdff9555fdb306e0ee19160c319d489138febfacb41c3afa93f9921bbef4dae7370816703a1ea1dff5b77466a3c6f15629ec217f

Download Submit
C:\Windows\SysWOW64\Adfnofpd.exe

Filesize
18KB

MD5
242ec212323dbc509d5318f7cae60ff5

SHA1
ee4a8fe1c5a22f017156d0b7254fc8eb5de301e6

SHA256
589c9c677e69e8db559f6f35cdc68820aca54a9b944a2267b5429b095309e9fb

SHA512
4be095d231e933bda4f676e04059829485e1822c50fca47673e6dcd82825bada09ece714153f960ad13240535edd2bf044717fc3f0714e6fbcd51527db639f9a

Download Submit
C:\Windows\SysWOW64\Adiknkco.exe

Filesize
351KB

MD5
d62b159e0c17c6e9d7dc3ed1cbff4aab

SHA1
f3579a978e6c47448674393ebe9a4ed3803f16e4

SHA256
5bcf1ab4a6f9460cb4484f8b351a7b533188ae76bc7f5e94fe1fb30357a2642c

SHA512
89d8725441669041a9b747a6b8647be91bbbed3f182baa699982b83f01091d294643ba675b6967e74e898b8309e0e2d7e357b9c87e2be0872bfe76043e3c4dc5

Download Submit
C:\Windows\SysWOW64\Ahnclp32.exe

Filesize
377KB

MD5
b90569560a2baa9355772fcf810fbeb8

SHA1
431a51561e7aae6c2c5fbc0b79fdf7cc72c07874

SHA256
5ba7f8549be6f8b9bc5de7947d290eb742871307989d56f34197926de63a84d9

SHA512
59960208019b776c3ae7b85469d0628d2120e3092c353117621cae80872a4253be0a53cd8e3622896970600ae78ca64d59d676ef3cc9a634ec5f6cd471512bce

Download Submit
C:\Windows\SysWOW64\Alelqb32.exe

Filesize
359KB

MD5
8345d0d70fa68a35959714c07f638527

SHA1
93c4b0c9ec626414abfb261cfa14efda27a0033a

SHA256
fbc0cb9d1634de30071d3b3735157a409b009dac81f36c1a506e93879f98b7e2

SHA512
ed49cfd2156511b2f80dcdbb2798fe8ce7304e8951e5e0ece1d7dc9eba4bfce4e24081b2adb4acccde5cb82afb316bbf60ba53256ee723444229ff4ff5dfb221

Download Submit
C:\Windows\SysWOW64\Alelqb32.exe

Filesize
40KB

MD5
116f19bf5188090ff9c11fd3c1920e34

SHA1
c6fd99e892c75f1d12ce5eb5de56c9a8140935d7

SHA256
f8a526798a679816303c720ba4138f0f076c2f0d4b0b77fe265db015d73829d3

SHA512
9ec767e27f71bb3074a55a9315acdeb84b463164efa316aef2acb71615d592a3da68b5e93cfce342152363f01371e2fdd68927ef9b3ba0ef0bd4706f39698a36

Download Submit
C:\Windows\SysWOW64\Alkijdci.exe

Filesize
329KB

MD5
ab7ac10ebf476c61a5b01364c63ec4bb

SHA1
9d19e0c79584cfafc51524dccc80f70995c6783c

SHA256
10fbf5fb83e440606f43302594a150ce325e569958f255084b52551fdd6f38bb

SHA512
4ffa68914ed4d251a00aeec4a59322a6075cb60672c2f6edd3535da33e445a6844312aa2a0ee75b928b480acfed8539d08502f54b7dd6fbb3eb2752aa13d672e

Download Submit
C:\Windows\SysWOW64\Alkijdci.exe

Filesize
354KB

MD5
39c11ade627c56df5a57856c04fcd257

SHA1
74dd31a3102c727958f0eb58a50ad3f9733a93d5

SHA256
64d2e3f7cd8ecea2a1ded166e00d30836d4429854c777ff254adb3be9cd00369

SHA512
e64a7454880b63149b620a3e8e0b96818d09d9c029907f315f7726901d307d91a73d59594701e00a194efe0db8ffb94d37f7b99c9f86bc51dee132ef55f516bf

Download Submit
C:\Windows\SysWOW64\Alkijdci.exe

Filesize
377KB

MD5
8546e4fccb351e563f7a542716fb4484

SHA1
4fb3e4f0f550538d437ee61132829b1808baa96a

SHA256
fdeadf9cef0a0ff796d849dd0b4e6c5fac0f1ae27475783bf09f3f6eebe9fccf

SHA512
8115de702b9279233ca2dbda79a347d1dbc2bc39afc7b748a17560dbb6b42bb49fa6a65618939cb2f9f0d828767cf30eca5c4bab7572ac510f0d31f9e222be5d

Download Submit
C:\Windows\SysWOW64\Alpbecod.exe

Filesize
3KB

MD5
86ac20d474aec12db8052db1d5aeb98a

SHA1
6e65e8a7951b1ae73b5afab43f746bcdd97a06e5

SHA256
0e227f4235e13930863dfb42f196f3aa96f198ac8d0f1b78db8bcf4102720a57

SHA512
8586e1784ad28aab91c8c782ca967875a4ea2342c92124518660bd88ad509524ed4925ab0230e5199e488f0bcdd0bfbbc4f5642ece9b4aab6c5bf767c1b23fa1

Download Submit
C:\Windows\SysWOW64\Alpbecod.exe

Filesize
53KB

MD5
11a547cd3c22464ebd1ec3d0a467f37f

SHA1
d630dcc088f9b64bfa3cd32b9d33f73a1104d0cb

SHA256
faa1f7a6ce3accccf345ac7626a23cd53ef0ffb4f6240dc88af6a9ab1110bf1d

SHA512
fb1abeef064d233168daa2a3146e6fca7772d70cb110fab5f28152c05eecbbedd5f868199c82f34f0582ce4c39aa4a518a71dd4a21949722744bcb028ad8d14e

Download Submit
C:\Windows\SysWOW64\Amjillkj.exe

Filesize
377KB

MD5
81fce467f2c7997303c750ed12eb0949

SHA1
9d0d82d05abb84eb896f837f356c274eb771ac03

SHA256
05f3f2c44d847da1b685c492e1a651a795cc753957e1037f10362472774699b7

SHA512
c98574ee9019b67f6a07a1814cc9ea6391f994ff289b7136eddaa6a327758b8ed72338e3cc36d67c11a3d09910fe25155ce66a9d7a13d52e56cee677f0e2ca71

Download Submit
C:\Windows\SysWOW64\Amjillkj.exe

Filesize
15KB

MD5
994f41434039e258c9c87ad76cb46849

SHA1
7c2520d778a196e7c4accfa412a48fbdab8374f3

SHA256
d7ab0817187623400592a5f40f1e79a3b520ae9fab508ad4f185e012bed2097b

SHA512
c0626b64a7a38a88331d13e7c770e6f75ea668ca8922268bd4acb8f6efade9a7b2592bc934f57c8871054ac6723da96085730d16d5122b23885e9d967a94e62c

Download Submit
C:\Windows\SysWOW64\Anclbkbp.exe

Filesize
261KB

MD5
c041cdc39f933ef27eae7eaf49cbd5e3

SHA1
960ff2b1f45504a73f9440c181b45ca543a108f1

SHA256
a1c6edbc47769025b5d831afa984b77442e8e325951bfd3316c7cdbd3d373db0

SHA512
a2fa082e3682f08096d16e0a3834a086d7549adb7188698a000cf4cfbc64f217a0ff07c7d794c5f7042e718967d13050adf54d376afcd59f04bb84f76a92a415

Download Submit
C:\Windows\SysWOW64\Anclbkbp.exe

Filesize
237KB

MD5
07dfe285f3f98cf8430eceb70d939e5e

SHA1
ba8a2606222c28af61dec4b4676fac79b0ca1a17

SHA256
2368cd2b97b3d3cd282a86856706648969650fc557a8553f7a7df3e368aa1153

SHA512
c157addadaf729a3ad90b22d904934e32a9136ec9f99f7324b3d428e81f80c5eae286a8dfbd8ba5f495425712c9b9eeee074e47e0d89d454b6bb3710dcd0e3c8

Download Submit
C:\Windows\SysWOW64\Anobgl32.exe

Filesize
377KB

MD5
4efa246ea214a59ec8ebf446ba22100b

SHA1
6bfe46a7ebdb7dd11d01626e79301fbfe9892445

SHA256
53e1c840f53d57680460109c9f3a3536f62c5c64eecaaf4dd7c5bdb3ff79b7ba

SHA512
886a1cdc9f91d68ca3fcf229fcc845f29df0737b90156cdf83ca09cc0e1c15b63773a0544193f8e30033c08fe06c5d918b9e43cfeb21e0df50ff065780e981be

Download Submit
C:\Windows\SysWOW64\Anobgl32.exe

Filesize
279KB

MD5
8e37a5ce6e034a8cc6c4ff67b3d1ffbc

SHA1
04d7ac00277a4e87724cdb16e30283a7db49bb4b

SHA256
3596b2d63c4cf6afd7ef7aaca67071d374f102b4b6f732c7f995ae5145c29675

SHA512
12ce62c7019f318a4ecb91e0c93f5bdccffe6fd0a22c1772c756b5ab16226920f92764b2198587541b114f1faa6eeead98cc626f48b37c3fa25cb95e4bc3fd75

Download Submit
C:\Windows\SysWOW64\Aoalba32.exe

Filesize
186KB

MD5
aef78fa1a3c8daa3c1dd7aaa99167de7

SHA1
7c3be3321865f4a51f7d50b8a43b406dc271548d

SHA256
019f62c6c420995bc7e2afdd0e5940274d80aa9ae4cf8592b80fcccd71357e2f

SHA512
1d571c16b61f6b717cc87ae53a16253c0ce31cee5fbaa86199645e6761c4853edfacb65a0a1cf556ca0965778d701736c102e14c6c4aadd6d87d10ba45b9197b

Download Submit
C:\Windows\SysWOW64\Bafndi32.exe

Filesize
345KB

MD5
96e6f68da0c3597cf0da690ac21d945b

SHA1
edc4f0416f316d8ae22322ba6f156dd091a0cabc

SHA256
ed9aec3a65518761333408ab450c77a85630b52a0e74489691e8288dba02495a

SHA512
8e5c8cc47a9fcf3d4292dffd2169ba3e91791be4c66b5dd845c088f3f333151054dde75b469342c47d077360792fb92d32a9bacf845544e13996a7ab45ea1957

Download Submit
C:\Windows\SysWOW64\Bafndi32.exe

Filesize
304KB

MD5
5298469ef344aec9f7b7ff9e866fbecf

SHA1
85cf5505f0a355f06d393f9f5f9ad0bd83db4f2c

SHA256
93dacabcf66531e89ffa7cfba73f22e1ad8935faa5a9f7ab3d733342debb86b6

SHA512
567e2d3b709531f889d853956c76e414c3f432f6819681d73c60bd6ab877134b16085562e58ed5496d0054fd19c90347f6c26f1dde4073655fba0a1114b42555

Download Submit
C:\Windows\SysWOW64\Bakgoh32.exe

Filesize
37KB

MD5
a1bcfbcbb53cea7fd4136929a9619d03

SHA1
25450d8cf3e2cc14526ea0c619590fc917aac927

SHA256
28075a59040b54ff97a1315c4d4815a22a8053212359de1c0cbb2f2c98347ffd

SHA512
1076dc713999053c2acfcc36f221a97eb4b8ad43c718d1e5641a0c07dbcccb496c754887b238d0820d73e2f95c80150e584adab40e2086a9d7d97c244263adda

Download Submit
C:\Windows\SysWOW64\Bakgoh32.exe

Filesize
15KB

MD5
bcc709a81606b7dcf06944c0c01dcfee

SHA1
10251850e9e3cd1470490bc5c9396fa41cf3eb6e

SHA256
1044cda7f31103e1310d140494b403ee39740cd1590e0ac4f28e5e74c390df72

SHA512
e20d4294f8b18df546ec4f537a309c73af89a51f04fac2a5f963fabc79134595af319a8e4e1213d881805c7032b43b433c6e446e5c281c034f0b8a482d7ddef4

Download Submit
C:\Windows\SysWOW64\Bdbnjdfg.exe

Filesize
377KB

MD5
08a8d30345a38996d873bb7847d1843e

SHA1
0ce81dab078e09e815f0143b7fe9fc53fbff2c41

SHA256
9de7a7cd99cbdd6d8b94312bb5373bff94ac603db1cf87fd474ca2bf39a48ddd

SHA512
c9973e92d424fd3553abed8ce1d0fcaa82c956954b7dc20704f677989fcf69129b788f6ee73e7bc9a67f49028b3056f5c3ea84b7df095d4e568e857dec586de6

Download Submit
C:\Windows\SysWOW64\Bdbnjdfg.exe

Filesize
52KB

MD5
1169a7f95c97ba9bf452d105ed55a02b

SHA1
343078f94ec434ddcb2750db2de2469751471660

SHA256
760d76bc69d81e2868a4c81e3484d4c44966d5e3da2972e807aed4e1670102fa

SHA512
43966ed26a431daf7c6b9be2262c350b7145a0bb69d902e8535e39a22fa8a19f581340b0dec3fc3b990f94200e1b3b9d869fc35d6e1bd446ceca7d3bb85774ab

Download Submit
C:\Windows\SysWOW64\Bdgged32.exe

Filesize
27KB

MD5
0bb8479dd236c0f283659f26866aea2e

SHA1
b6fdb0d8e5546a9de1ef56f3bd5bc1a18687647b

SHA256
15ebf60d6bc90d2eabc295ea314fe137aec42c77679b47e25ebb352db50c43f9

SHA512
4bd8306f791f1219693b6aed42e5b18b652e252a7d82fa3d0f8127bd6166d68ae871fc77fd5c8761a4648b30795968bdc6b70c197f13758fd9642366c1a5e96c

Download Submit
C:\Windows\SysWOW64\Bdgged32.exe

Filesize
18KB

MD5
ac412a8713ec8b75a113773ff79e372e

SHA1
030f306031e4e87dcd0b2d10f852b6d0bd928125

SHA256
0cb808f63e2fa43a34935bccb97c6fcad6ceb9a9cb1063fcf18aa4d4548289d5

SHA512
257317cc61427366fd7da725952d0d65e07f3d977f4dc69b64753484ef41af4f1bd87b2544f302bd121729f19c8b330816e505f481e0afdc4637b70cdfa14578

Download Submit
C:\Windows\SysWOW64\Bdgged32.exe

Filesize
12KB

MD5
7a8a4ffc795fec0d565ab8b2869f6965

SHA1
841bd5d2cb4169f1e15dc92da05d8e3222d0f210

SHA256
f799f744842fdf3a2af0a62210dc042fd62f895c892a6032b5850ba5ef6a7a66

SHA512
62645440bf5710abfcd66b1cf137ec9aa522db65fcdf4464fd17bd5fb1b75333c8d4d10ff0147c4b93705b92fe15b7cc784382fe3d6fbadca8b0654f15af9102

Download Submit
C:\Windows\SysWOW64\Bemqih32.exe

Filesize
251KB

MD5
076e4be7d33f301645628eb3c0ac3960

SHA1
06840346a2cd72251c95b4defaa5e56f0c431dd8

SHA256
86e99eab53b68bfee99e5aba9349c07ff80aa18838f00df7f5b12d90b02e92d7

SHA512
3312d2ce404306f90d39fbdcdec6c7efb21c3137016fc3bb5f04a6f343c7690227d70d4940567d16dac978702c476e018db0ddea69d97d9ee772cb334362f22f

Download Submit
C:\Windows\SysWOW64\Bemqih32.exe

Filesize
4KB

MD5
f3968506b6d5a18c0c4a48a4c27171d1

SHA1
5a037495cec8e1cdd40f37c5db2d3422b4f52f67

SHA256
41a72c143dc56d9ff9fee803cca253431e91c40bc48df9bee0446cf66ad3d578

SHA512
ba9981b92950b4fc853e29ff626842dbd19259d37811b880aa94e632221877e32f3df898961fbc920a2e30c0f8021476e28fdd375e41d3c4fc27e5830d523257

Download Submit
C:\Windows\SysWOW64\Blqllqqa.exe

Filesize
13KB

MD5
f01d14dfd2d43a493232408af25df37e

SHA1
ae670b33f879cfd0f4680f95ce209716db6f6950

SHA256
8c0101b680d274ee7e7db6996c56be042f994f32a99208de7d8b68bd4a7b46df

SHA512
354c136ca8555442070a6770b710236d41691465f350ac7886ff1f9278cd13e7dcd3f095a99e3119984ffaa6b8534d362bf8b94b2e4eb1906afedf3c96e5a615

Download Submit
C:\Windows\SysWOW64\Blqllqqa.exe

Filesize
285KB

MD5
2f6710e00a2062b34b44f73cc5ea0231

SHA1
f92b4abf249ae0eace98667f6702833034febb24

SHA256
7b46c28f3e3b4460c1a6eace7b580e8184a7e365ee605506e35d216ae99f1251

SHA512
32d11c844e23c69bbcc693fb34aa9bba7e58ac9369a129fbca5eae85310b7604046d91fc8fc3d39cd0129ba0b4de8585c430e412dc210d207049b818ccdbe673

Download Submit
C:\Windows\SysWOW64\Bnhenj32.exe

Filesize
274KB

MD5
c4cef8ed6837bdcf4c40733c82be8cac

SHA1
8874a4112d97d694f3f78954c35422ef5e9eb8c2

SHA256
b6078c8be604daef10b453ea7bcf13d6264fb915a87420bbab7bc9286ad7cdac

SHA512
23fab6d6e43f366a5368f1a5b0e34c600cae7dbe0f46f056ab99b77ab7302a18f1867d0d263c44d551df649effbe61cc45e59ef863e76ae338b50dba51bc69a2

Download Submit
C:\Windows\SysWOW64\Bnhenj32.exe

Filesize
54KB

MD5
40a4b326fcb64ffa969bdf52620275db

SHA1
84ef7431df989010831ab7536d1805c9265f9d8a

SHA256
e2112597625e2f3164d107f63a24670455d3dba2f4264828a55e4351eef71151

SHA512
649865c1dbc4c04649c8faff070176f32824d61279fb222b5048f517d8cc08c844b32606e9d5d062171e9fb63820ebfe6ccc8de31d86a80a27cfe51c1f202de4

Download Submit
C:\Windows\SysWOW64\Bnhenj32.exe

Filesize
207KB

MD5
1d1415c40fd539e73f271361000a3c69

SHA1
4acf270fc349d1c6ef471335da05b78a71ba49b1

SHA256
0a39fdd5d9c2101cf1bddff4d196d09cf23163c6b3a07d66b5b5de5ed2396e7f

SHA512
87cbcdb0ea273bbada4875b8d6ed6b3f23c448a2ae37d20fd3ab125ec72e7c69cc577ec3f2199f9c87b9af872e4d5ea8ad17c4df79f810c492140353779d811f

Download Submit
C:\Windows\SysWOW64\Cbbdcc32.exe

Filesize
18KB

MD5
12555fe1a246ea7d388ecf8571779e6b

SHA1
a9d4d13df179ac977d065dcf84dfd8cb7bf01bd1

SHA256
8f7cf400f3096eea145728bfdaf66603aaac310b10994132c7171b12c982527a

SHA512
b5c4ab606491a128a5b31e3bdc80ad9b93f979f76b65a37d16a22c78808f075bf110ad31a1e7c9144fbc61f3f9c49e6cac61fd97a1c00402b298a389e50c3bb1

Download Submit
C:\Windows\SysWOW64\Cbbnpg32.exe

Filesize
50KB

MD5
fb03e5eb05c40115db5f20098c06d72c

SHA1
e1521e15a8170ce5dfa70d5d570d872f47124bcc

SHA256
9ae5ec7d4c5e7f79873b1ff53f6f9e1487ffd7be38bb457f629863d3c711b115

SHA512
648e3e114b5bed8c9e50db457ab79398b8cddd93196b6a3b6142d0c2fe75d78f06e49b4b4dcf9395fa0b6bb226c4a125afbd0418371804589781fbfb7724c7fc

Download Submit
C:\Windows\SysWOW64\Cbbnpg32.exe

Filesize
273KB

MD5
8aab93b68cbb35b9d03a29299146f672

SHA1
4700a0960acf404ce158c7ab5005e31a6a488f44

SHA256
9d15ef870e4f048d87f7bd335dba8a139cb2f10c0a7fd6302c8a013545c138ab

SHA512
05df923fd95d17c91e2f06d6ee7b80a388fc86ac6bc05cb8e36c896c5e34a89b3419bcc548369b0c8e9bb1c76c2957908e7c27eedf9d8c27c55ca50a4e71a2ee

Download Submit
C:\Windows\SysWOW64\Chnbbqpn.exe

Filesize
179KB

MD5
eea3cc6299534fe37b13e019be9cf6e5

SHA1
e34d01e97373b886253fa9edfa22727e7d2b661d

SHA256
fdfe32775527915f788e76962e238ff6903c55de84ca75878cc09f817eb8babc

SHA512
53c7ec1a31ff964e77f168d05753e3b1b664c8e4fd8ecb12e8f7cd2f77d6df9b1f93fa9be0161acec18d810b6172438593c9448e89de54dde8a980d5a5d9253e

Download Submit
C:\Windows\SysWOW64\Chnbbqpn.exe

Filesize
46KB

MD5
0733cce8a12a8e6305ae674bd94ad014

SHA1
2ed57a6d1ef2a2f5c1ed3efc80c9899f3b63c878

SHA256
f1ddc40d377ca63208f0f121cf5c5280de96b4ca7367037cda2e9a6aa8d8d473

SHA512
b8441d99d0dea9408eb7dd766aa9a31820868cbd29cdbe318739e45ece57fac2fa0af0fde4aefc315e8d10c7c34e0bef5ad349e0c3c7ed7a28fdc1af8673e4cb

Download Submit
C:\Windows\SysWOW64\Ckhecmcf.exe

Filesize
213KB

MD5
b8a806326bd8d0460d7fffda7f615076

SHA1
48dcc09e71bee31ebd2fbedf9cf73918f623f7aa

SHA256
be49671c64150ab50dfe736272deb9190f803ef2427206606dc5f431f44a3c69

SHA512
299d72e8bdacfd1a67ce8018dfbc95b92630a17548275e7090292e828f6dea355ff978b6408419e07799c18d999b406e2378da4f576fdc0bdac230da459d5efe

Download Submit
C:\Windows\SysWOW64\Ckhecmcf.exe

Filesize
280KB

MD5
bc154940043c96bf492d0fbbe9c21b52

SHA1
094b164cd922492911507abb07d69316984a350c

SHA256
61a69b1bb9e11a96cdf1588144727edad19b9b28319c664c6bd8b644f4d264ae

SHA512
f9fca847a03264d8967878d684c8a423ae5c16ff01486f6509649bafe03b940ed39312c29dbb2ff80d1d9f117c40d817a85f0915df9cff821bac45a71e26f2b9

Download Submit
C:\Windows\SysWOW64\Ckhelb32.exe

Filesize
1KB

MD5
01eedae38b540370fd5dfc25a97a15c4

SHA1
4baf74a0ebf2dfee19ce0bb59526b50c9815450d

SHA256
7ef04b6af02bc34a516403ecaef69294a4031b5633e2e5e3bd3614fbb899cf8e

SHA512
78219512428e1b9eebc7ea9814c473416fc8bac3fc01694e224895df06197622975f064a1607fb93f08bdae626f6c4f7d3e1d6e7a3ceed50dcdbd67af83065dd

Download Submit
C:\Windows\SysWOW64\Ckjbhmad.exe

Filesize
287KB

MD5
04ee1c1d64dfc20a34628617756a3a2f

SHA1
bc152167f0dcaf53d91d16e1d3b703a5fcb8fdd0

SHA256
835eebbc0570a9e657e00f380eb83aa97bdbdb5154a95db9d483e5b0453562f8

SHA512
d6d07921cbb049672793e5778d4520a406bccd4e434bf83c011535dcafedcdd390c37a36cc5cc1ae6c5522204743495e96c108e6016faf6110c235eaf8364035

Download Submit
C:\Windows\SysWOW64\Ckjbhmad.exe

Filesize
226KB

MD5
8a70ff9bd3ca3b01fad6446b2a03bb38

SHA1
0536056f66beaf9047e24bb9d8dda140b9b00023

SHA256
a29e12890e0ede843081b0a196a44a13ee6c49c5c3b61d9992219340cf62ea46

SHA512
9890e74c90798be6d06aad72704826ebe215b8d9a76a0fcda7dac666f0c46136307f2e5e266dd264d9000ffc2d413536d6ae55ff962cbce494dc8a1fe3751914

Download Submit
C:\Windows\SysWOW64\Cnkkjh32.exe

Filesize
265KB

MD5
594a045095a9c1fc376fc834fced663f

SHA1
1a02a8177c44a39698c524292dc3e0850a2cd6f2

SHA256
3645da331d00a0cc196b7cd4e7ce0d6f65f3312811a5f1b2b2049d66b851ef21

SHA512
f2bf65ec968649cfa2ca095359472f64b9e77157b20041450747e1da9d4b0a70a829a3a00bf19c7ee454568eef213497493d6c7e31642d1f456ba071c3bb09a0

Download Submit
C:\Windows\SysWOW64\Cnkkjh32.exe

Filesize
158KB

MD5
466b5b87bfee369dcf8b5c4912565601

SHA1
a9172bd04d41ae88507460de78ed7faa9e4b83f0

SHA256
753b1d5d387d85bad8264995ae09bd5edfedde1902bda76e57057bf16b2a2512

SHA512
a86ead1f785ae45b826865889f62020b061c3dd109a3e075e13f65bdd97a705bb2a372cd18524702b04a0b452bcd2e2bf05414215b0333703bcd808eacef8037

Download Submit
C:\Windows\SysWOW64\Dcqmpa32.exe

Filesize
377KB

MD5
66751d9be6c6a4f740771d84d529f077

SHA1
f41e3038b9120e7264d58890718d0285118475fc

SHA256
7c7b9ad5faafb6f9af36b6e1b68abdaeebdf176ebbb747aa20991ca59b5ac310

SHA512
67a4026d1d34aa78b7ca8b2e78daceedadd2a95a4bba13f1f1d90992eac361ae2f4051299d45ab58a1c096a7425a9b067c4c32e5b233d7c79fcf97b21a6c726c

Download Submit
C:\Windows\SysWOW64\Dfdpad32.exe

Filesize
82KB

MD5
47e6df9507738d329f16d6fb4a2ddd86

SHA1
33be9874d05a0ce5a8061fb95d001aa36b7e8577

SHA256
31d0defb4f099021cdf7d16dfa5e1efbb6111d23b1553bcbde5dde4d40a78900

SHA512
8e082b385f03dd118ddd7ac2930da01730b87de091dc399288a43842472f6bf75a58814853fc6086a61f9d60971267b99c27d38d95f81e088ab8fc5fe9a5dbe7

Download Submit
C:\Windows\SysWOW64\Dfdpad32.exe

Filesize
63KB

MD5
55b2dc0008b113d61df0581db890f130

SHA1
a769df184a63bb1914d8ed6b9d0d246d4fd11c28

SHA256
cfba8eb1a1790e2d806c1dafaf664310648fe0461f5d209bcbe94704a8af9308

SHA512
24eefbeb952710a1a67fa08e4f575bec36749980f2ba70f116b9c26d4b72a578658e8de9958b3d77f0ad4988da5e496520ae77c88e88d37af33eafb48719fd47

Download Submit
C:\Windows\SysWOW64\Dmlkhofd.exe

Filesize
68KB

MD5
17b94ac59044fac3c4d5b4c49bce5e75

SHA1
57a2be036e963a89fcaf8bb00141a8a18447c562

SHA256
0160c210e130985af2193ddd05ba486066856905b6a11e4396b51f5629672d2b

SHA512
d87a260d4de3b55de9d811515020e5355aa179d93e361b84f077b8cc881c39140ed60a2882b1d3d376941e6d83990b5983a900c6d882b369ff046a574576aab7

Download Submit
C:\Windows\SysWOW64\Dmlkhofd.exe

Filesize
119KB

MD5
1891b5e9417016835aec6ef2d6ef77ae

SHA1
74ce066ad38c32c40e51319c0a00d7c4fd108fe9

SHA256
1ac7b5c1d60ddc7c74ae2cf39c7023b056d8bec9bbf7f03c7a7a729e07c070e7

SHA512
5fb865ec14955bf7c384e431f80110331c192658dce3d3ccc30c231c3ba366492373149d8142f6e7312aa77409a503c2e6009850398591becb7678234b1061e2

Download Submit
C:\Windows\SysWOW64\Dnmhim32.exe

Filesize
78KB

MD5
80ee81ba84359dde43382a74aded6e4f

SHA1
867e7bf50a133487512da8af1f4e0735333b6d25

SHA256
bd51f0182c43237f188fa0a53707d77538637fdf84cee60a9d46a829727ce9a7

SHA512
31c35bba6a79792b1c08dc86fa7d3798759dba1baac8c56c5cb4b915d9ea67b44964a98d34a57215b7b8ffa2219537a876109ea5456f0e1672fc0c2cc75d0ad7

Download Submit
C:\Windows\SysWOW64\Dooaip32.exe

Filesize
92KB

MD5
7834ad35a631f8440f2d198d2aeddd3e

SHA1
df73051dd5c1994f472c256b450117457272028e

SHA256
617c98ddce2a33c493139dc170dcbce37e22b4fe645315c9d447d07958564f6b

SHA512
aa802043089f75e1f0ac8d3efee9fcc93711b1899fe987e9cecc17091261557bf9755896272ba45972228d223a051d477a8987b39615897fd2c7d73c43b83d58

Download Submit
C:\Windows\SysWOW64\Ekoddodi.exe

Filesize
64KB

MD5
f12e69dc5821438c3fa5e869d2d3dd48

SHA1
271c910dbce4ba916307d8f39da08de004780542

SHA256
516b85da83d064377d590b9af7bcfaf1c1e96dde68af003fb4418217cc410fac

SHA512
3059c3526acbaf98c94f2f9fe2a1dbb5ae204ef914249a48fc49b300cf38b0c3142a1fc770b16065b5b4202aed1c9de257c115aba9b98f7328debd5bee08f5dd

Download Submit
C:\Windows\SysWOW64\Enkdjkep.exe

Filesize
377KB

MD5
d5772042f14117b860210f8d39c485d0

SHA1
8fdaade586778e5d13f2637ad5176bf2a9827f5d

SHA256
5ffbb354362f6cd1675401808edacf56bcc74a2a3dc111b6ed0c754368a5fec2

SHA512
b12d55751ae64fa78fcdef52e029cea1d4748ab2bc426835b4750ff0239c15ae49255d2f135564c10349d557db400f8fcca9ec02129ee17218b98d185fb7a4f0

Download Submit
C:\Windows\SysWOW64\Fmdach32.exe

Filesize
41KB

MD5
9bdf93642f5185193761f4a2ca01d983

SHA1
7697eb23a8119b69733a7b54297285a342f00f74

SHA256
eda1507b1b695d66bed55115dd54eb0dcdcfda446955b469cfcae79df2fe0f04

SHA512
5cfebc86fbe845f9a30edc5b0fb551366ff8a0075010ee457956d630d963650b40df472cab5541cddbda09ecf0370584779e955bcea459f59932d5c1e12c5931

Download Submit
C:\Windows\SysWOW64\Gclafmej.exe

Filesize
887B

MD5
c96fa5781532eece9460823436e656ff

SHA1
e4d575c39297f8454dffe396d1415b29a27a3870

SHA256
6e34cc66e29704eb03f53a718ecad9ac2b6eeab6533c94d3c2b19ce40b6ac321

SHA512
6fb3ba903703af450a2d7be1b43f2d8bfaedeb664815766cf7409485b072273564f89d030ef3a10996813bf8edf8454e2730bbfbbd08522216dfdbf6706166ad

Download Submit
C:\Windows\SysWOW64\Hlpfhe32.exe

Filesize
65KB

MD5
ef3b27f8d21f251e489c821307731793

SHA1
6ff8e468855528bf42cb9771c4ed81c0cef49601

SHA256
b1431e3d9e5742f383432837b24368ee3265fea4602e590624e270c9f9c0588e

SHA512
0efad22a902fa7c942e66adbc8b33985ebb8a0483d39369b570bc95e54183c7604e9a67bddeb22d5694444fb756c6d80fb0dd6f7929f6630397f4e547e6e91ea

Download Submit
C:\Windows\SysWOW64\Ikechced.exe

Filesize
377KB

MD5
bf97dd0f1556462c6af5feeabc04fba5

SHA1
0b40b3ce0413798e75ae7a33c01d99c62a4b142e

SHA256
ea6d5c2ca82a4a976680a191b3816d1d86ab96bc22571c5acab8708bb4cf9d74

SHA512
d410fdb3fbd9990014ae1773a0c4473d8672f71515e180d1d31e249f87e1e72bcc77807e5ba8fbd969a55a0b9e0679932836dfa15a19981cc0cf4c07e187aca6

Download Submit
C:\Windows\SysWOW64\Imknli32.exe

Filesize
377KB

MD5
2d8fa5f26e99a5dfd832e6e665110ffe

SHA1
ee47427bc3ce6e76c9008a0200a7bb4f1a868c3b

SHA256
a2cdb7035f51910429ffd3d7efe12f59bcb0710fc9b5525b0ee08b9dee6ec2a3

SHA512
b2550fb87ee7a75644d20fe29f83392ae04c68f04a3c1c31bf7cf4fb6af26b6af56afa00ce96c57ff5194ffa069215855827823f5880dfce2a5b8b0d4343d8a9

Download Submit
C:\Windows\SysWOW64\Kdpmmf32.exe

Filesize
377KB

MD5
ce9715432ef70f1890a87ab27e608e0a

SHA1
e2f51acc5b9782e56eb0081885830575745db652

SHA256
1028c75a8794fd888989df2f2c6f8d3e6a93a97f6bfe9bce3d49f0874c0ffe19

SHA512
014632d9a3487f89978d3121d09d0ba38e00f32b0ea372696cd9a9d20a6098b0ca1f57d0cdcd81aebc4068afde7b2afa4ac2c88ea77937914c9e3ef436acf7e5

Download Submit
C:\Windows\SysWOW64\Kgnbdh32.exe

Filesize
2KB

MD5
ac2318cc187995faccb9379377ca9e1b

SHA1
c379b07c75ded9798d4d53c7dc7b592db2037700

SHA256
ae435793a7eff19f04ebb8941114930bbe7c21e7ec0d2991cc993a5a83c8c177

SHA512
06a8aeae900d3c7baf822ed0fe00865ce159c96a281f8bd1b9873f9a29f4806d88a7db97bebf7e2a9bbb59fcf16d478cd265bcc9a08b1fca59b0d146000f30af

Download Submit
C:\Windows\SysWOW64\Melfpb32.exe

Filesize
52KB

MD5
3d7f93871759be4c951d2511f61f41ce

SHA1
e096e26936355521c7afda3bd4a43d48d221f132

SHA256
af446a5d4047ef2dc353cb3158ac250e13b0430513c7c9976c81bce909989e53

SHA512
5e74429dbe90abc999524a1943249a762e2736d8893b98837a7c3f91812d0f5caf01fa2dc092af549d6253987d0b2509b5fcb11fd0979929c6755950121cb232

Download Submit
C:\Windows\SysWOW64\Mepnaf32.exe

Filesize
40KB

MD5
1d6879632741b58d332c752574c4ffa8

SHA1
816483357bde4134075232b72ae1be4c5054995f

SHA256
f424b585edfc768425b8b46c8685aeb60ef047a9bd9b932ef9928a1c73a244b9

SHA512
cb7351e4cafd13608e1261d704c9c94cfea83a1a98782ca599a7e13754c370348e5d2b843334b5f4aa19c24bacd474bf5356341025d999df48077bee32184149

Download Submit
C:\Windows\SysWOW64\Mkhkblii.exe

Filesize
11KB

MD5
91c87bec578fdf9ed674445c91372fa7

SHA1
6b868f2dd1f9ef9b0ac5ca8ab6a8d24be8675606

SHA256
d1c09faff2833923aa3202e44c30cf16b0ee203f0ca8f850f967f9a3db772c5c

SHA512
04c3323baa33a67cce0b148577cf7a8624ad0be5af3a79dff2c7ba81b68303a5458d551b8d972ad8266fd35a2dc95c32ff4b07ed2a8f679296abe86d0b4465da

Download Submit
C:\Windows\SysWOW64\Mnjqfeld.exe

Filesize
377KB

MD5
a8ea2ed0fe75d44b0bacdbaf77bc44d6

SHA1
4f3240770122c5039c0a8670f17b14bc20aeb8fe

SHA256
bd26b9a1c0e31d6eece5569d0eb3a6cf31c238495e94e3cc3e4f4e637328b3b1

SHA512
b90414fcd63223a0cc10659a4799d3121c2ce81ca978b1b77f911c1906158307f7eddb1ddac8280f63078513114e8c5f9a7a164e9b4d4170986b459583e4fcc7

Download Submit
C:\Windows\SysWOW64\Nejbaqgo.exe

Filesize
219KB

MD5
480cf4c1773275facd031da5ac9cfc47

SHA1
a4d8575c19e6fcc06160387fcb641b4ba93d0837

SHA256
94d22c53d3cf4046c0011fb952d22d9cc44b25823dc0cfcb00656a2a6f13fad1

SHA512
553f522c9cb45a31ba5810236c15315efbb23efd693273d5b7d4376b6fa61c425802d8de844d8ca97a601a2d14b80ee814aecccfd2fba644c887d22e9885109d

Download Submit
C:\Windows\SysWOW64\Odmbaj32.exe

Filesize
30KB

MD5
30ad61bddd982acd7e094f2e5c0d9036

SHA1
c6aa4e64de2a80a0b405c88b3f25ecce5f75b99e

SHA256
df98182801284d638947c166b1e83b0021f45b23bb317ddd441464e0e7d656cf

SHA512
bb6c010ec7e7aa1d819dca1a8dfd4a1f9b933e67e6cb07293c42d16dc7f86e5d527ccb6195820699fcc06f90ad9647d43899864232844d591c82173ef41d0a37

Download Submit
C:\Windows\SysWOW64\Odmbaj32.exe

Filesize
57KB

MD5
da299f4be613808c3aa34b0b53055c1b

SHA1
3a663ea18fd10b3b7ab60606ea23f90043fae604

SHA256
b240e627790427fe314d41d2dc3f067a7cd0b6f138ee016c88b4335095553386

SHA512
c82abcfefbe1a0f65e3d41bc3b4f1ff28c3fc0a75aa40a21080ad335bac16b6b998d6412a126c803422e459a62f7a290c4d06873ed86413ed8f990bf9ab4fda3

Download Submit
C:\Windows\SysWOW64\Ohceqo32.exe

Filesize
50KB

MD5
5b4c4f2a44471e400d9e614b98fb9bb2

SHA1
4b9080ff50c7b2cf25a7f4c2b7ad5d839afb082b

SHA256
213ccf4065532323d13acb16a1dd7ca77e7844bb9630f8132a15db34c01fc6fa

SHA512
efe33fe63b510111da49dbb92df95cb310218c633c2baaa0912c4c774b1b2f407428ad0777408cfeb519ffd0a138c79e7abd899797b933b32da17deb9f59afa7

Download Submit
C:\Windows\SysWOW64\Ojdnid32.exe

Filesize
57KB

MD5
9a11473d703dc0fe7a7db1eaff15d61b

SHA1
f745456c0035da48197bbd9d25d6216f6dd1e4e2

SHA256
7a934aebd80a2e3f815913c8a9205aba396de8849685888cee7481b672d424e8

SHA512
e5553f399593099e1cb7bd85473b5f34748b4d49953906cce5b1485b962d34268d448128f602da2cc348a0798a71f52644af5be0f368cd507f03233cd719c63f

Download Submit
C:\Windows\SysWOW64\Ojdnid32.exe

Filesize
58KB

MD5
7087018c7a5a4c395f55bbd464a1304d

SHA1
ce4f9f0fcaca4174360cf9fa8fcd6351c81f0493

SHA256
b24cef73ab16e3b461f0b7b4e9255b175654b401b97f0478ffcb81b5d4f03501

SHA512
5a2f194b20e5d0a47f95652065729ef71f68056e2b48da9a6d6f9f222f20961d64ce476d6c0f8e61c2a2e1cde5072e062c37b71a61966552014156b318a98f2f

Download Submit
C:\Windows\SysWOW64\Omgcpokp.exe

Filesize
36KB

MD5
9f50dbca357aa6ca215cae4ddfa02003

SHA1
f49de4d6fbab9e1b2fc79e3f23a6a463e6cb1da0

SHA256
05c169cc7fa4d5b631e10b8e81da2056a0edc6cfcb3ec082887ee9f99390c2e7

SHA512
b6d981654efafee136d66a66b7f6ea1ebc11a5cfe706e52e322ae94d04b9f697b6299b441b0a847afd67484e3edfdfff3f6c7fa516f56cfe5d7412ed9428bef2

Download Submit
C:\Windows\SysWOW64\Omgcpokp.exe

Filesize
4KB

MD5
537b9ae60c6390cdb7dbdb5f6260db08

SHA1
ae1b208bae57bdb1c15449c79c2357d7660f6fd6

SHA256
e04b50e9d38db2476c0aa87bee382bd12ce131b0aef8d0a23a68665442d2729b

SHA512
aa0e3d9483740cabd1564663b5e3f893a9b890afb75d05adb110f7f1c9970fe58a5a9223ffe630edd7e74442e1fd03933e71e269af521e28f56eb2de412dec43

Download Submit
C:\Windows\SysWOW64\Onnmdcjm.exe

Filesize
97KB

MD5
9dcab80abfa7ff163f071da55f87d6db

SHA1
6ca74191c1883d820c2663153f2c8cd428307d29

SHA256
fcdcf49687e3430bddb25c36d2e4a9aae75916a93c6b06fa43b9e235c4504009

SHA512
c45d2fc6b2ceb95760a2eabeb752d5272e71d135575a4f6c279038ebd9232e48f54bfe463e6c640477ce48f9f24820a80cc652cf971e47fccdb4c82e6cd69e54

Download Submit
C:\Windows\SysWOW64\Onnmdcjm.exe

Filesize
66KB

MD5
d7909a5ad94fa0a0f5fb8ddf654328e6

SHA1
3fd9c39ee2fcb3c237ce78009da02f1bd0112280

SHA256
b6755871ecc1d39b17ebc91e636ccabf80e1f674395d5eabcf0a879e38db9c8b

SHA512
24783e91d95b9c66b8255038471dfd4ca5f3a8d23c92dabfdd235b7a5ce4f49f3803a9e3a3349325e0856f37775f9617e33b2596e74b9621bab62fbe0fb87fa0

Download Submit
C:\Windows\SysWOW64\Palbgl32.exe

Filesize
36KB

MD5
055c6c7a1a06b704b8add038b43102f5

SHA1
074be4202f1a9da25507b07c0e9cc730825a6c1b

SHA256
6c7be93551ad8974d886a7eb2e9e167a174182b3ddad08ed5007535876096468

SHA512
39abde80159ab6d23d62e6c86bccaeb4d125a0a1fd448076e4eb782744671de83885cb2fcd0ff0a872294ad6547ffd4352bac099e28f2eff9776976e300bb467

Download Submit
C:\Windows\SysWOW64\Palbgl32.exe

Filesize
377KB

MD5
5e64a7c2a6c0c2fa80423a9f2671bfcb

SHA1
af3592c3f96e79b1a8aa1b7bc57161e6ea5d0267

SHA256
5b6066143259b1eef77d170cbafe2aecfad7c403cd5ee19e173c73a0f31202e8

SHA512
5bbb691b28b489f5d445331441705430f5597c74bbad22eae4bea08a10a0ade1d575bf8f0c62a9449351d7e26cbbe3b0c61e3b62738cd9d41a92d3a875fb0005

Download Submit
C:\Windows\SysWOW64\Pefabkej.exe

Filesize
355KB

MD5
0dc3d46ed503af4ae3938a09f1ce85f2

SHA1
311f3f37646fc0d42a3990ddf9cb16e430d86ad6

SHA256
4055e5345c90356524722d6ffe2415b799707b1f36a686692de335d1ea6c2629

SHA512
0eb4baca7a338fffa36682bb6e38b2a53fab54662c8c73b9407edd944b564276210b586f417ed7f4fcc3cc61022d4c34cfd38b71094456368ed76ccdb6a1b57e

Download Submit
C:\Windows\SysWOW64\Pefabkej.exe

Filesize
35KB

MD5
5f5eff3f93048570865ac25a1acdc048

SHA1
50e43f70ce3cec578f6e5dedc622957121e670c5

SHA256
13ee23ec5522e9405aeb6e81478623efdf3c8cdaad8bef766cbc70aa6b093d52

SHA512
2c2396c7b66ab54c34afbc2da79af9c7183ef30725567ed6d47efd0cd5c53d6fe0b88f9a744a909605f8e8cdf127f6af254eda3ccac06489d6cd13c10f83b620

Download Submit
C:\Windows\SysWOW64\Pkgcea32.exe

Filesize
6KB

MD5
d5b8f4eff898f7fea3beb309e48a5ca1

SHA1
f51aeca2f892ac6a792fa13aa1052945f4463616

SHA256
71814bde9b793e67d2d750e95e8ef3f789b24f0d773ad9f72321b211e0d83466

SHA512
1f933c637321e12dd9dd183da45b94ef904c548cc4d058856874a333be4cac98ce8e0e796ea10fdee11a84c2bf5977455b2159e9b8d7bc13b67bd97cc6d93a64

Download Submit
C:\Windows\SysWOW64\Pkgcea32.exe

Filesize
33KB

MD5
5928bcfa685c8a38686bfbdb7161cd75

SHA1
9183c3b089f06eacab28f0ff1de17b45ce0bb430

SHA256
8f2a0e9566d86ca9ef2b4817017748e4cc5cb51ce01b1915b0f4273ee5354ea3

SHA512
a87ec183b244efd130ef37fa434ef03f10b3d5d1917003adb5944fe93af72c552abff7ebfd1caea1b610f6e6d60f6ac0a006d6d6f99ac02ed928914d202ac1e1

Download Submit
C:\Windows\SysWOW64\Pknqoc32.exe

Filesize
377KB

MD5
e9a27df350b9cf204532dd1086b8b5ee

SHA1
84bd32e038eb7f86a74a063e185ddcbd6e3c110b

SHA256
216b5fe9f0205b1f910a5c4250e8e1b18c92e6d481ae140470e582086fcc61e9

SHA512
9c0d48d3a02244c37cadd9c3d0f0ce032f51f5b7e885857bdf17f51d5995f75e5f6aa9d9966058f27b9f177901ea1c156c9b9a3572098361763b8288e3b2531d

Download Submit
C:\Windows\SysWOW64\Pknqoc32.exe

Filesize
26KB

MD5
a52c380f832a915e9aa57988f778eb6f

SHA1
607e157931f5d01bf5d1b6f5774a2ad5c6d21d7f

SHA256
a73e1910d847413ffd13a210cf85e7e0d963e24079ce2b03688d29fdf1d79152

SHA512
92d23c23180166a21bf746027d4179eadfe9be800aff2d0f8327cefa067e131f25993666fce4199fa3bc605ab85d0603790d9443390cf19db0a44497a93e82a6

Download Submit
C:\Windows\SysWOW64\Popbpqjh.exe

Filesize
24KB

MD5
53e06b3bf373d8c9f60f5badb8e69d66

SHA1
210ff47d7d4aa93d764e435e2f78f4e9db451a72

SHA256
6c375459593bcf68dde8385efcd78c6663f1a820ea8993970fba5c4b7bc4a0ae

SHA512
06e7b7d314d50874b08d5d4d097064ac40302455c2905fd1e894d0e30b7919149a11e074e72fa44c0bc05e84fe9819122d240f7e3f7d5fa04a5426d91b0f4e36

Download Submit
C:\Windows\SysWOW64\Popbpqjh.exe

Filesize
377KB

MD5
b72cbb8255a5c58d02fd9737c2b186cb

SHA1
ab37ce8239743082e381a9ea9ab0cfabddff7550

SHA256
447038800dbad55af653e6a58966b74aa043d552b2106288aa29bc5ef0d38624

SHA512
92b3be71b81c64f70e6c9a69a5ca77dbfed3f3f0b70478ef1c6c51f7a7b1e9a6f18f3da58cfe78598f875cde7025d19fb29fc74b0f793f4de09c956e62deb15d

Download Submit
C:\Windows\SysWOW64\Qdphngfl.exe

Filesize
20KB

MD5
c53eadf39050e96f8844a2a76634eb9f

SHA1
cf63809e755493f4915fbd50e9c88a9c46358251

SHA256
810df2c5f8a854b27253af147d4426d6a87dc6bd87693558cbc9e3405bdc53d2

SHA512
3f4e87615b838ea8fa83dae802405408e1ec84e3d731df78df8f481335eddeba71b30162d981e02c42472c92bd99434cd5abea404c81b279241e53bae551964b

Download Submit
C:\Windows\SysWOW64\Qdphngfl.exe

Filesize
366KB

MD5
475b1468470a8d991ab9a85dae2accda

SHA1
b180b8d8d719da073f568df7aac068d653c59173

SHA256
2a54f390b64841b690bc3bdabc902db4515f50db61ebba104fa3873aaaa267a0

SHA512
a63fc609fe350f3d418bfe0225a119df034e09adaf1d73530a9fb479580d73abf0736c4aa6bd178e5c50445e8cf3c5b73d814cb78a5d20bbd3403a33904d27db

Download Submit
memory/116-226-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/700-138-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/760-430-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1040-264-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1148-335-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1340-154-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1388-66-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1428-258-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1444-214-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1460-442-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1500-370-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1552-25-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1608-281-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1612-249-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1656-421-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1756-57-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1800-218-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2248-33-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2316-82-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2360-134-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2388-186-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2500-16-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2516-382-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2720-162-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2860-194-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2940-49-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2988-358-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3208-407-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3248-275-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3252-0-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3252-1-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3252-80-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3356-122-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3396-364-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3416-329-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3504-90-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3556-178-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3560-114-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3692-439-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3696-293-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3704-321-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3740-394-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3760-287-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3984-428-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4064-323-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4188-404-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4260-305-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4292-311-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4296-388-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4332-202-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4340-146-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4376-170-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4412-234-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4448-41-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4492-347-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4496-376-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4540-105-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4632-242-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4700-412-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4708-299-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4872-341-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4876-9-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/5092-73-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/5112-98-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads