ef0657e9eb150332e02113a75770e6ae81a75a674ed08ecd38cb3e1336a41ae0

Analysis

max time kernel
2s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 20:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f82ba713d3d7b85673d0ac7297621c98.exe
Size 97KB
Sample240107-y5lhssefa6
SHA256 ef0657e9eb150332e02113a75770e6ae81a75a674ed08ecd38cb3e1336a41ae0
MD5 f82ba713d3d7b85673d0ac7297621c98
SHA1 09421268df86381e326cee0887f2407ae9a4d220
SHA512 2969720d93ea314c29a95368ecbe2a2f7866eac30222fc77f08351fba2a8f29149894e69396827a75a3202abc70ffbc3e1b2d576adc5b9ae1b9ce16e57f5a31f
SSDEEP 1536:PpfgHPN3Fib5VjK3R+EfB5DfuQI2vhOOA6BjGivJXeYZ6:CHR2VjM+mLLnvhbA6ACJXeK6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Inebjihf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlefklpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpnhfhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcpnhfhf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Miifeq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	f82ba713d3d7b85673d0ac7297621c98.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	f82ba713d3d7b85673d0ac7297621c98.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inebjihf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlefklpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdmnlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdmnlj32.exe

Executes dropped EXE 5 IoCs

pid	Process
4708	Inebjihf.exe
3824	Mlefklpj.exe
2368	Mdmnlj32.exe
4824	Mcpnhfhf.exe
720	Miifeq32.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Eghpcp32.dll	f82ba713d3d7b85673d0ac7297621c98.exe
File opened for modification	C:\Windows\SysWOW64\Mlefklpj.exe	Inebjihf.exe
File created	C:\Windows\SysWOW64\Mdmnlj32.exe	Mlefklpj.exe
File opened for modification	C:\Windows\SysWOW64\Mdmnlj32.exe	Mlefklpj.exe
File created	C:\Windows\SysWOW64\Mcpnhfhf.exe	Mdmnlj32.exe
File created	C:\Windows\SysWOW64\Onliio32.dll	Mdmnlj32.exe
File opened for modification	C:\Windows\SysWOW64\Miifeq32.exe	Mcpnhfhf.exe
File opened for modification	C:\Windows\SysWOW64\Npcoakfp.exe	Miifeq32.exe
File created	C:\Windows\SysWOW64\Bkjlibkf.dll	Miifeq32.exe
File created	C:\Windows\SysWOW64\Melnob32.exe	f82ba713d3d7b85673d0ac7297621c98.exe
File opened for modification	C:\Windows\SysWOW64\Melnob32.exe	f82ba713d3d7b85673d0ac7297621c98.exe
File opened for modification	C:\Windows\SysWOW64\Mcpnhfhf.exe	Mdmnlj32.exe
File created	C:\Windows\SysWOW64\Miifeq32.exe	Mcpnhfhf.exe
File created	C:\Windows\SysWOW64\Olcjhi32.dll	Mcpnhfhf.exe
File created	C:\Windows\SysWOW64\Npcoakfp.exe	Miifeq32.exe
File created	C:\Windows\SysWOW64\Jgefkimp.dll	Mlefklpj.exe
File created	C:\Windows\SysWOW64\Mlefklpj.exe	Inebjihf.exe
File created	C:\Windows\SysWOW64\Kjiccacq.dll	Inebjihf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11040	10700	WerFault.exe	609

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olcjhi32.dll"	Mcpnhfhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Miifeq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Inebjihf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mlefklpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onliio32.dll"	Mdmnlj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mcpnhfhf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	f82ba713d3d7b85673d0ac7297621c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mlefklpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgefkimp.dll"	Mlefklpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcpnhfhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjlibkf.dll"	Miifeq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	f82ba713d3d7b85673d0ac7297621c98.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Inebjihf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdmnlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mdmnlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjiccacq.dll"	Inebjihf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Miifeq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	f82ba713d3d7b85673d0ac7297621c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	f82ba713d3d7b85673d0ac7297621c98.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eghpcp32.dll"	f82ba713d3d7b85673d0ac7297621c98.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	f82ba713d3d7b85673d0ac7297621c98.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 4708	3332	f82ba713d3d7b85673d0ac7297621c98.exe	709
PID 3332 wrote to memory of 4708	3332	f82ba713d3d7b85673d0ac7297621c98.exe	709
PID 3332 wrote to memory of 4708	3332	f82ba713d3d7b85673d0ac7297621c98.exe	709
PID 4708 wrote to memory of 3824	4708	Inebjihf.exe	198
PID 4708 wrote to memory of 3824	4708	Inebjihf.exe	198
PID 4708 wrote to memory of 3824	4708	Inebjihf.exe	198
PID 3824 wrote to memory of 2368	3824	Mlefklpj.exe	197
PID 3824 wrote to memory of 2368	3824	Mlefklpj.exe	197
PID 3824 wrote to memory of 2368	3824	Mlefklpj.exe	197
PID 2368 wrote to memory of 4824	2368	Mdmnlj32.exe	196
PID 2368 wrote to memory of 4824	2368	Mdmnlj32.exe	196
PID 2368 wrote to memory of 4824	2368	Mdmnlj32.exe	196
PID 4824 wrote to memory of 720	4824	Mcpnhfhf.exe	195
PID 4824 wrote to memory of 720	4824	Mcpnhfhf.exe	195
PID 4824 wrote to memory of 720	4824	Mcpnhfhf.exe	195

C:\Users\Admin\AppData\Local\Temp\f82ba713d3d7b85673d0ac7297621c98.exe
"C:\Users\Admin\AppData\Local\Temp\f82ba713d3d7b85673d0ac7297621c98.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\SysWOW64\Melnob32.exe
  C:\Windows\system32\Melnob32.exe
  2⤵
  PID:4708
- - C:\Windows\SysWOW64\Mlefklpj.exe
    C:\Windows\system32\Mlefklpj.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3824
- - C:\Windows\SysWOW64\Iacngdgj.exe
    C:\Windows\system32\Iacngdgj.exe
    3⤵
    PID:4528
  - - C:\Windows\SysWOW64\Iijfhbhl.exe
      C:\Windows\system32\Iijfhbhl.exe
      4⤵
      PID:3436

C:\Windows\SysWOW64\Nphhmj32.exe
C:\Windows\system32\Nphhmj32.exe
1⤵
PID:2992
- C:\Windows\SysWOW64\Ngbpidjh.exe
  C:\Windows\system32\Ngbpidjh.exe
  2⤵
  PID:1468
- C:\Windows\SysWOW64\Oqhoeb32.exe
  C:\Windows\system32\Oqhoeb32.exe
  2⤵
  PID:632
- - C:\Windows\SysWOW64\Ocgkan32.exe
    C:\Windows\system32\Ocgkan32.exe
    3⤵
    PID:5548
  - - C:\Windows\SysWOW64\Ojqcnhkl.exe
      C:\Windows\system32\Ojqcnhkl.exe
      4⤵
      PID:1792

C:\Windows\SysWOW64\Oddmdf32.exe
C:\Windows\system32\Oddmdf32.exe
1⤵
PID:4428
- C:\Windows\SysWOW64\Ojaelm32.exe
  C:\Windows\system32\Ojaelm32.exe
  2⤵
  PID:1092

C:\Windows\SysWOW64\Pcppfaka.exe
C:\Windows\system32\Pcppfaka.exe
1⤵
PID:3692
- C:\Windows\SysWOW64\Pjjhbl32.exe
  C:\Windows\system32\Pjjhbl32.exe
  2⤵
  PID:2316

C:\Windows\SysWOW64\Qgqeappe.exe
C:\Windows\system32\Qgqeappe.exe
1⤵
PID:5104
- C:\Windows\SysWOW64\Qmmnjfnl.exe
  C:\Windows\system32\Qmmnjfnl.exe
  2⤵
  PID:1616

C:\Windows\SysWOW64\Qcgffqei.exe
C:\Windows\system32\Qcgffqei.exe
1⤵
PID:3668
- C:\Windows\SysWOW64\Qffbbldm.exe
  C:\Windows\system32\Qffbbldm.exe
  2⤵
  PID:3340

C:\Windows\SysWOW64\Adgbpc32.exe
C:\Windows\system32\Adgbpc32.exe
1⤵
PID:3144
- C:\Windows\SysWOW64\Afhohlbj.exe
  C:\Windows\system32\Afhohlbj.exe
  2⤵
  PID:4092

C:\Windows\SysWOW64\Afjlnk32.exe
C:\Windows\system32\Afjlnk32.exe
1⤵
PID:3988
- C:\Windows\SysWOW64\Aeklkchg.exe
  C:\Windows\system32\Aeklkchg.exe
  2⤵
  PID:2464

C:\Windows\SysWOW64\Ajhddjfn.exe
C:\Windows\system32\Ajhddjfn.exe
1⤵
PID:228
- C:\Windows\SysWOW64\Amgapeea.exe
  C:\Windows\system32\Amgapeea.exe
  2⤵
  PID:1884

C:\Windows\SysWOW64\Afoeiklb.exe
C:\Windows\system32\Afoeiklb.exe
1⤵
PID:2284
- C:\Windows\SysWOW64\Bnhjohkb.exe
  C:\Windows\system32\Bnhjohkb.exe
  2⤵
  PID:3432

C:\Windows\SysWOW64\Acqimo32.exe
C:\Windows\system32\Acqimo32.exe
1⤵
PID:4176

C:\Windows\SysWOW64\Bebblb32.exe
C:\Windows\system32\Bebblb32.exe
1⤵
PID:1844
- C:\Windows\SysWOW64\Bfdodjhm.exe
  C:\Windows\system32\Bfdodjhm.exe
  2⤵
  PID:2652

C:\Windows\SysWOW64\Bnkgeg32.exe
C:\Windows\system32\Bnkgeg32.exe
1⤵
PID:3360
- C:\Windows\SysWOW64\Baicac32.exe
  C:\Windows\system32\Baicac32.exe
  2⤵
  PID:3288

C:\Windows\SysWOW64\Bffkij32.exe
C:\Windows\system32\Bffkij32.exe
1⤵
PID:4840
- C:\Windows\SysWOW64\Bmpcfdmg.exe
  C:\Windows\system32\Bmpcfdmg.exe
  2⤵
  PID:5004
- - C:\Windows\SysWOW64\Beglgani.exe
    C:\Windows\system32\Beglgani.exe
    3⤵
    PID:5132
  - - C:\Windows\SysWOW64\Bgehcmmm.exe
      C:\Windows\system32\Bgehcmmm.exe
      4⤵
      PID:5184

C:\Windows\SysWOW64\Bmemac32.exe
C:\Windows\system32\Bmemac32.exe
1⤵
PID:5348
- C:\Windows\SysWOW64\Cfmajipb.exe
  C:\Windows\system32\Cfmajipb.exe
  2⤵
  PID:5388
- C:\Windows\SysWOW64\Nbbeml32.exe
  C:\Windows\system32\Nbbeml32.exe
  2⤵
  PID:1548
- - C:\Windows\SysWOW64\Nfnamjhk.exe
    C:\Windows\system32\Nfnamjhk.exe
    3⤵
    PID:5508

C:\Windows\SysWOW64\Cmgjgcgo.exe
C:\Windows\system32\Cmgjgcgo.exe
1⤵
PID:5428
- C:\Windows\SysWOW64\Chmndlge.exe
  C:\Windows\system32\Chmndlge.exe
  2⤵
  PID:5468
- - C:\Windows\SysWOW64\Cmiflbel.exe
    C:\Windows\system32\Cmiflbel.exe
    3⤵
    PID:5508
  - - C:\Windows\SysWOW64\Cdcoim32.exe
      C:\Windows\system32\Cdcoim32.exe
      4⤵
      PID:5548
    - - C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        5⤵
        
        PID:5588
      - C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        6⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        7⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        8⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        9⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        10⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        11⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        12⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        13⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        7⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        8⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        9⤵
        
        PID:5624
  - - C:\Windows\SysWOW64\Nimmifgo.exe
      C:\Windows\system32\Nimmifgo.exe
      4⤵
      PID:1976
    - - C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        5⤵
        
        PID:5456
      - C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        6⤵
        
        PID:6012

C:\Windows\SysWOW64\Ddmaok32.exe
C:\Windows\system32\Ddmaok32.exe
1⤵
PID:5992
- C:\Windows\SysWOW64\Dmefhako.exe
  C:\Windows\system32\Dmefhako.exe
  2⤵
  PID:6032
- - C:\Windows\SysWOW64\Ddonekbl.exe
    C:\Windows\system32\Ddonekbl.exe
    3⤵
    PID:6072
  - - C:\Windows\SysWOW64\Dfnjafap.exe
      C:\Windows\system32\Dfnjafap.exe
      4⤵
      PID:6112
    - - C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        5⤵
        
        PID:5140
      - C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        6⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        7⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        8⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        9⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Ehapfiem.exe
        
        C:\Windows\system32\Ehapfiem.exe
        10⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Emoinpcd.exe
        
        C:\Windows\system32\Emoinpcd.exe
        11⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Eefaomcg.exe
        
        C:\Windows\system32\Eefaomcg.exe
        12⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Eggmge32.exe
        
        C:\Windows\system32\Eggmge32.exe
        13⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Feocelll.exe
        
        C:\Windows\system32\Feocelll.exe
        14⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Fhmpagkp.exe
        
        C:\Windows\system32\Fhmpagkp.exe
        15⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Fnjhjn32.exe
        
        C:\Windows\system32\Fnjhjn32.exe
        16⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        15⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        16⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        10⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        11⤵
        
        PID:4544
      - C:\Windows\SysWOW64\Ejjaqk32.exe
        
        C:\Windows\system32\Ejjaqk32.exe
        6⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Epdime32.exe
        
        C:\Windows\system32\Epdime32.exe
        7⤵
        
        PID:7736

C:\Windows\SysWOW64\Dmcibama.exe
C:\Windows\system32\Dmcibama.exe
1⤵
PID:5952

C:\Windows\SysWOW64\Feapkk32.exe
C:\Windows\system32\Feapkk32.exe
1⤵
PID:6104
- C:\Windows\SysWOW64\Fhpmgg32.exe
  C:\Windows\system32\Fhpmgg32.exe
  2⤵
  PID:4424
- - C:\Windows\SysWOW64\Fknicb32.exe
    C:\Windows\system32\Fknicb32.exe
    3⤵
    PID:5336
  - - C:\Windows\SysWOW64\Fahaplon.exe
      C:\Windows\system32\Fahaplon.exe
      4⤵
      PID:5488

C:\Windows\SysWOW64\Fhbimf32.exe
C:\Windows\system32\Fhbimf32.exe
1⤵
PID:4828
- C:\Windows\SysWOW64\Fajnfl32.exe
  C:\Windows\system32\Fajnfl32.exe
  2⤵
  PID:5888
- - C:\Windows\SysWOW64\Fggfnc32.exe
    C:\Windows\system32\Fggfnc32.exe
    3⤵
    PID:5932
  - - C:\Windows\SysWOW64\Fnaokmco.exe
      C:\Windows\system32\Fnaokmco.exe
      4⤵
      PID:6012
    - - C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        5⤵
        
        PID:6132
    - - C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        5⤵
        
        PID:5536
      - C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        6⤵
        
        PID:5476

C:\Windows\SysWOW64\Fkeodaai.exe
C:\Windows\system32\Fkeodaai.exe
1⤵
PID:6140
- C:\Windows\SysWOW64\Gaogak32.exe
  C:\Windows\system32\Gaogak32.exe
  2⤵
  PID:5496

C:\Windows\SysWOW64\Gdncmghi.exe
C:\Windows\system32\Gdncmghi.exe
1⤵
PID:5796
- C:\Windows\SysWOW64\Gkglja32.exe
  C:\Windows\system32\Gkglja32.exe
  2⤵
  PID:5856

C:\Windows\SysWOW64\Gaadfkgc.exe
C:\Windows\system32\Gaadfkgc.exe
1⤵
PID:2528
- C:\Windows\SysWOW64\Ghklce32.exe
  C:\Windows\system32\Ghklce32.exe
  2⤵
  PID:5296
- - C:\Windows\SysWOW64\Gadqlkep.exe
    C:\Windows\system32\Gadqlkep.exe
    3⤵
    PID:5616
  - - C:\Windows\SysWOW64\Gdbmhf32.exe
      C:\Windows\system32\Gdbmhf32.exe
      4⤵
      PID:6028
    - - C:\Windows\SysWOW64\Gkleeplq.exe
        
        C:\Windows\system32\Gkleeplq.exe
        5⤵
        
        PID:4996
      - C:\Windows\SysWOW64\Gafmaj32.exe
        
        C:\Windows\system32\Gafmaj32.exe
        6⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Ghpendjj.exe
        
        C:\Windows\system32\Ghpendjj.exe
        7⤵
        
        PID:3376

C:\Windows\SysWOW64\Ggcfja32.exe
C:\Windows\system32\Ggcfja32.exe
1⤵
PID:6136
- C:\Windows\SysWOW64\Gnmnfkia.exe
  C:\Windows\system32\Gnmnfkia.exe
  2⤵
  PID:4868
- - C:\Windows\SysWOW64\Gdgfce32.exe
    C:\Windows\system32\Gdgfce32.exe
    3⤵
    PID:5960
  - - C:\Windows\SysWOW64\Ggeboaob.exe
      C:\Windows\system32\Ggeboaob.exe
      4⤵
      PID:6172
  - - C:\Windows\SysWOW64\Llcghg32.exe
      C:\Windows\system32\Llcghg32.exe
      4⤵
      PID:3912
    - - C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        5⤵
        
        PID:6156
      - C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        6⤵
        
        PID:6644

C:\Windows\SysWOW64\Goljqnpd.exe
C:\Windows\system32\Goljqnpd.exe
1⤵
PID:6212
- C:\Windows\SysWOW64\Hffcmh32.exe
  C:\Windows\system32\Hffcmh32.exe
  2⤵
  PID:6276
- - C:\Windows\SysWOW64\Hheoid32.exe
    C:\Windows\system32\Hheoid32.exe
    3⤵
    PID:6316

C:\Windows\SysWOW64\Hfipbh32.exe
C:\Windows\system32\Hfipbh32.exe
1⤵
PID:6424
- C:\Windows\SysWOW64\Hkehkocf.exe
  C:\Windows\system32\Hkehkocf.exe
  2⤵
  PID:6488
- - C:\Windows\SysWOW64\Hbpphi32.exe
    C:\Windows\system32\Hbpphi32.exe
    3⤵
    PID:6544
  - - C:\Windows\SysWOW64\Jpgdai32.exe
      C:\Windows\system32\Jpgdai32.exe
      4⤵
      PID:6748
    - - C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        5⤵
        
        PID:6820
      - C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        6⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        7⤵
        
        PID:6300

C:\Windows\SysWOW64\Hoogfnnb.exe
C:\Windows\system32\Hoogfnnb.exe
1⤵
PID:6384

C:\Windows\SysWOW64\Hdnldd32.exe
C:\Windows\system32\Hdnldd32.exe
1⤵
PID:6592
- C:\Windows\SysWOW64\Hkhdqoac.exe
  C:\Windows\system32\Hkhdqoac.exe
  2⤵
  PID:6640
- - C:\Windows\SysWOW64\Hnfamjqg.exe
    C:\Windows\system32\Hnfamjqg.exe
    3⤵
    PID:6688

C:\Windows\SysWOW64\Hfningai.exe
C:\Windows\system32\Hfningai.exe
1⤵
PID:6756
- C:\Windows\SysWOW64\Hdpiid32.exe
  C:\Windows\system32\Hdpiid32.exe
  2⤵
  PID:6792
- - C:\Windows\SysWOW64\Hkjafn32.exe
    C:\Windows\system32\Hkjafn32.exe
    3⤵
    PID:6856
  - - C:\Windows\SysWOW64\Hbdjchgn.exe
      C:\Windows\system32\Hbdjchgn.exe
      4⤵
      PID:6916
    - - C:\Windows\SysWOW64\Hhnbpb32.exe
        
        C:\Windows\system32\Hhnbpb32.exe
        5⤵
        
        PID:6980

C:\Windows\SysWOW64\Iohjlmeg.exe
C:\Windows\system32\Iohjlmeg.exe
1⤵
PID:7024
- C:\Windows\SysWOW64\Ifbbig32.exe
  C:\Windows\system32\Ifbbig32.exe
  2⤵
  PID:7072
- - C:\Windows\SysWOW64\Igcoqocb.exe
    C:\Windows\system32\Igcoqocb.exe
    3⤵
    PID:7116
  - - C:\Windows\SysWOW64\Iokgal32.exe
      C:\Windows\system32\Iokgal32.exe
      4⤵
      PID:7156
    - - C:\Windows\SysWOW64\Ibicnh32.exe
        
        C:\Windows\system32\Ibicnh32.exe
        5⤵
        
        PID:6200
      - C:\Windows\SysWOW64\Igfkfo32.exe
        
        C:\Windows\system32\Igfkfo32.exe
        6⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Inpccihl.exe
        
        C:\Windows\system32\Inpccihl.exe
        7⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Idjlpc32.exe
        
        C:\Windows\system32\Idjlpc32.exe
        8⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Ighhln32.exe
        
        C:\Windows\system32\Ighhln32.exe
        9⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Ioopml32.exe
        
        C:\Windows\system32\Ioopml32.exe
        10⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        7⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        8⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        9⤵
        
        PID:5524

C:\Windows\SysWOW64\Ifihif32.exe
C:\Windows\system32\Ifihif32.exe
1⤵
PID:4820
- C:\Windows\SysWOW64\Iigdfa32.exe
  C:\Windows\system32\Iigdfa32.exe
  2⤵
  PID:6812
- - C:\Windows\SysWOW64\Ioambknl.exe
    C:\Windows\system32\Ioambknl.exe
    3⤵
    PID:6876

C:\Windows\SysWOW64\Ifleoe32.exe
C:\Windows\system32\Ifleoe32.exe
1⤵
PID:6988
- C:\Windows\SysWOW64\Iijaka32.exe
  C:\Windows\system32\Iijaka32.exe
  2⤵
  PID:7032

C:\Windows\SysWOW64\Jkhngl32.exe
C:\Windows\system32\Jkhngl32.exe
1⤵
PID:7088
- C:\Windows\SysWOW64\Jngjch32.exe
  C:\Windows\system32\Jngjch32.exe
  2⤵
  PID:6160
- - C:\Windows\SysWOW64\Jeqbpb32.exe
    C:\Windows\system32\Jeqbpb32.exe
    3⤵
    PID:6292
  - - C:\Windows\SysWOW64\Jilnqqbj.exe
      C:\Windows\system32\Jilnqqbj.exe
      4⤵
      PID:6416
    - - C:\Windows\SysWOW64\Jnifigpa.exe
        
        C:\Windows\system32\Jnifigpa.exe
        5⤵
        
        PID:6520
- C:\Windows\SysWOW64\Mhldbh32.exe
  C:\Windows\system32\Mhldbh32.exe
  2⤵
  PID:6416
- - C:\Windows\SysWOW64\Mpclce32.exe
    C:\Windows\system32\Mpclce32.exe
    3⤵
    PID:6552

C:\Windows\SysWOW64\Jfpojead.exe
C:\Windows\system32\Jfpojead.exe
1⤵
PID:6680
- C:\Windows\SysWOW64\Jecofa32.exe
  C:\Windows\system32\Jecofa32.exe
  2⤵
  PID:6780
- - C:\Windows\SysWOW64\Joiccj32.exe
    C:\Windows\system32\Joiccj32.exe
    3⤵
    PID:6868
  - - C:\Windows\SysWOW64\Jbgoof32.exe
      C:\Windows\system32\Jbgoof32.exe
      4⤵
      PID:6944

C:\Windows\SysWOW64\Jiaglp32.exe
C:\Windows\system32\Jiaglp32.exe
1⤵
PID:7144
- C:\Windows\SysWOW64\Jpkphjeb.exe
  C:\Windows\system32\Jpkphjeb.exe
  2⤵
  PID:5368

C:\Windows\SysWOW64\Jfbkpd32.exe
C:\Windows\system32\Jfbkpd32.exe
1⤵
PID:7064

C:\Windows\SysWOW64\Jbileede.exe
C:\Windows\system32\Jbileede.exe
1⤵
PID:6552
- C:\Windows\SysWOW64\Jehhaaci.exe
  C:\Windows\system32\Jehhaaci.exe
  2⤵
  PID:6784
- - C:\Windows\SysWOW64\Jkaqnk32.exe
    C:\Windows\system32\Jkaqnk32.exe
    3⤵
    PID:3724
- C:\Windows\SysWOW64\Mofmobmo.exe
  C:\Windows\system32\Mofmobmo.exe
  2⤵
  PID:9176

C:\Windows\SysWOW64\Jnpmjf32.exe
C:\Windows\system32\Jnpmjf32.exe
1⤵
PID:7008
- C:\Windows\SysWOW64\Jfgdkd32.exe
  C:\Windows\system32\Jfgdkd32.exe
  2⤵
  PID:6168
- - C:\Windows\SysWOW64\Jghabl32.exe
    C:\Windows\system32\Jghabl32.exe
    3⤵
    PID:6496
  - - C:\Windows\SysWOW64\Klfjijgq.exe
      C:\Windows\system32\Klfjijgq.exe
      4⤵
      PID:6892

C:\Windows\SysWOW64\Knefeffd.exe
C:\Windows\system32\Knefeffd.exe
1⤵
PID:1704
- C:\Windows\SysWOW64\Kijjbofj.exe
  C:\Windows\system32\Kijjbofj.exe
  2⤵
  PID:6380
- - C:\Windows\SysWOW64\Kngcje32.exe
    C:\Windows\system32\Kngcje32.exe
    3⤵
    PID:2984
  - - C:\Windows\SysWOW64\Kfnkkb32.exe
      C:\Windows\system32\Kfnkkb32.exe
      4⤵
      PID:7140
    - - C:\Windows\SysWOW64\Khpgckkb.exe
        
        C:\Windows\system32\Khpgckkb.exe
        5⤵
        
        PID:6960
      - C:\Windows\SysWOW64\Kpgodhkd.exe
        
        C:\Windows\system32\Kpgodhkd.exe
        6⤵
        
        PID:7020

C:\Windows\SysWOW64\Kbekqdjh.exe
C:\Windows\system32\Kbekqdjh.exe
1⤵
PID:7180
- C:\Windows\SysWOW64\Kechmoil.exe
  C:\Windows\system32\Kechmoil.exe
  2⤵
  PID:7476
- - C:\Windows\SysWOW64\Oocmii32.exe
    C:\Windows\system32\Oocmii32.exe
    3⤵
    PID:7552

C:\Windows\SysWOW64\Bfkedibe.exe
C:\Windows\system32\Bfkedibe.exe
1⤵
PID:5308

C:\Windows\SysWOW64\Beihma32.exe
C:\Windows\system32\Beihma32.exe
1⤵
PID:5268

C:\Windows\SysWOW64\Bjddphlq.exe
C:\Windows\system32\Bjddphlq.exe
1⤵
PID:5228

C:\Windows\SysWOW64\Bgcknmop.exe
C:\Windows\system32\Bgcknmop.exe
1⤵
PID:4256

C:\Windows\SysWOW64\Aeiofcji.exe
C:\Windows\system32\Aeiofcji.exe
1⤵
PID:4332

C:\Windows\SysWOW64\Ambgef32.exe
C:\Windows\system32\Ambgef32.exe
1⤵
PID:3496

C:\Windows\SysWOW64\Ampkof32.exe
C:\Windows\system32\Ampkof32.exe
1⤵
PID:3348

C:\Windows\SysWOW64\Qqijje32.exe
C:\Windows\system32\Qqijje32.exe
1⤵
PID:3240

C:\Windows\SysWOW64\Pmfhig32.exe
C:\Windows\system32\Pmfhig32.exe
1⤵
PID:4536

C:\Windows\SysWOW64\Pflplnlg.exe
C:\Windows\system32\Pflplnlg.exe
1⤵
PID:4360

C:\Windows\SysWOW64\Pdkcde32.exe
C:\Windows\system32\Pdkcde32.exe
1⤵
PID:4108

C:\Windows\SysWOW64\Pjeoglgc.exe
C:\Windows\system32\Pjeoglgc.exe
1⤵
PID:1720

C:\Windows\SysWOW64\Pdifoehl.exe
C:\Windows\system32\Pdifoehl.exe
1⤵
PID:4468

C:\Windows\SysWOW64\Pnonbk32.exe
C:\Windows\system32\Pnonbk32.exe
1⤵
PID:208

C:\Windows\SysWOW64\Pgefeajb.exe
C:\Windows\system32\Pgefeajb.exe
1⤵
PID:1792
- C:\Windows\SysWOW64\Omopjcjp.exe
  C:\Windows\system32\Omopjcjp.exe
  2⤵
  PID:6104
- - C:\Windows\SysWOW64\Oonlfo32.exe
    C:\Windows\system32\Oonlfo32.exe
    3⤵
    PID:4172
  - - C:\Windows\SysWOW64\Ofgdcipq.exe
      C:\Windows\system32\Ofgdcipq.exe
      4⤵
      PID:8672
    - - C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        5⤵
        
        PID:2220
      - C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        6⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        7⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        8⤵
        
        PID:856

C:\Windows\SysWOW64\Pqknig32.exe
C:\Windows\system32\Pqknig32.exe
1⤵
PID:660

C:\Windows\SysWOW64\Onjegled.exe
C:\Windows\system32\Onjegled.exe
1⤵
PID:868

C:\Windows\SysWOW64\Ogpmjb32.exe
C:\Windows\system32\Ogpmjb32.exe
1⤵
PID:3768
- C:\Windows\SysWOW64\Ihbponja.exe
  C:\Windows\system32\Ihbponja.exe
  2⤵
  PID:5792
- - C:\Windows\SysWOW64\Ipihpkkd.exe
    C:\Windows\system32\Ipihpkkd.exe
    3⤵
    PID:8612

C:\Windows\SysWOW64\Ojllan32.exe
C:\Windows\system32\Ojllan32.exe
1⤵
PID:2156

C:\Windows\SysWOW64\Odocigqg.exe
C:\Windows\system32\Odocigqg.exe
1⤵
PID:880

C:\Windows\SysWOW64\Opakbi32.exe
C:\Windows\system32\Opakbi32.exe
1⤵
PID:1208

C:\Windows\SysWOW64\Ogifjcdp.exe
C:\Windows\system32\Ogifjcdp.exe
1⤵
PID:2704

C:\Windows\SysWOW64\Nckndeni.exe
C:\Windows\system32\Nckndeni.exe
1⤵
PID:1548

C:\Windows\SysWOW64\Njnpppkn.exe
C:\Windows\system32\Njnpppkn.exe
1⤵
PID:2540

C:\Windows\SysWOW64\Ncdgcf32.exe
C:\Windows\system32\Ncdgcf32.exe
1⤵
PID:5016

C:\Windows\SysWOW64\Npfkgjdn.exe
C:\Windows\system32\Npfkgjdn.exe
1⤵
PID:2504

C:\Windows\SysWOW64\Nilcjp32.exe
C:\Windows\system32\Nilcjp32.exe
1⤵
PID:456

C:\Windows\SysWOW64\Npcoakfp.exe
C:\Windows\system32\Npcoakfp.exe
1⤵
PID:632

C:\Windows\SysWOW64\Miifeq32.exe
C:\Windows\system32\Miifeq32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:720

C:\Windows\SysWOW64\Mcpnhfhf.exe
C:\Windows\system32\Mcpnhfhf.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4824

C:\Windows\SysWOW64\Mdmnlj32.exe
C:\Windows\system32\Mdmnlj32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2368

C:\Windows\SysWOW64\Bmlilh32.exe
C:\Windows\system32\Bmlilh32.exe
1⤵
PID:7612
- C:\Windows\SysWOW64\Bokehc32.exe
  C:\Windows\system32\Bokehc32.exe
  2⤵
  PID:7688

C:\Windows\SysWOW64\Bjpjel32.exe
C:\Windows\system32\Bjpjel32.exe
1⤵
PID:7768
- C:\Windows\SysWOW64\Bhcjqinf.exe
  C:\Windows\system32\Bhcjqinf.exe
  2⤵
  PID:7820
- - C:\Windows\SysWOW64\Bombmcec.exe
    C:\Windows\system32\Bombmcec.exe
    3⤵
    PID:7864
  - - C:\Windows\SysWOW64\Bfgjjm32.exe
      C:\Windows\system32\Bfgjjm32.exe
      4⤵
      PID:7908

C:\Windows\SysWOW64\Bjbfklei.exe
C:\Windows\system32\Bjbfklei.exe
1⤵
PID:7956
- C:\Windows\SysWOW64\Bmabggdm.exe
  C:\Windows\system32\Bmabggdm.exe
  2⤵
  PID:8028
- - C:\Windows\SysWOW64\Ckfphc32.exe
    C:\Windows\system32\Ckfphc32.exe
    3⤵
    PID:8076

C:\Windows\SysWOW64\Bbiado32.exe
C:\Windows\system32\Bbiado32.exe
1⤵
PID:7732

C:\Windows\SysWOW64\Cobkhb32.exe
C:\Windows\system32\Cobkhb32.exe
1⤵
PID:8120
- C:\Windows\SysWOW64\Cbphdn32.exe
  C:\Windows\system32\Cbphdn32.exe
  2⤵
  PID:8164

C:\Windows\SysWOW64\Cjgpfk32.exe
C:\Windows\system32\Cjgpfk32.exe
1⤵
PID:1016
- C:\Windows\SysWOW64\Cmflbf32.exe
  C:\Windows\system32\Cmflbf32.exe
  2⤵
  PID:4876
- - C:\Windows\SysWOW64\Cfcjfk32.exe
    C:\Windows\system32\Cfcjfk32.exe
    3⤵
    PID:3352
  - - C:\Windows\SysWOW64\Ciafbg32.exe
      C:\Windows\system32\Ciafbg32.exe
      4⤵
      PID:7324

C:\Windows\SysWOW64\Ikkpgafg.exe
C:\Windows\system32\Ikkpgafg.exe
1⤵
PID:7360
- C:\Windows\SysWOW64\Injmcmej.exe
  C:\Windows\system32\Injmcmej.exe
  2⤵
  PID:7396
- - C:\Windows\SysWOW64\Idcepgmg.exe
    C:\Windows\system32\Idcepgmg.exe
    3⤵
    PID:7420
  - - C:\Windows\SysWOW64\Igbalblk.exe
      C:\Windows\system32\Igbalblk.exe
      4⤵
      PID:7212

C:\Windows\SysWOW64\Ijqmhnko.exe
C:\Windows\system32\Ijqmhnko.exe
1⤵
PID:7528
- C:\Windows\SysWOW64\Ipjedh32.exe
  C:\Windows\system32\Ipjedh32.exe
  2⤵
  PID:7664
- - C:\Windows\SysWOW64\Iciaqc32.exe
    C:\Windows\system32\Iciaqc32.exe
    3⤵
    PID:7740

C:\Windows\SysWOW64\Innfnl32.exe
C:\Windows\system32\Innfnl32.exe
1⤵
PID:7860
- C:\Windows\SysWOW64\Ilafiihp.exe
  C:\Windows\system32\Ilafiihp.exe
  2⤵
  PID:7892

C:\Windows\SysWOW64\Icknfcol.exe
C:\Windows\system32\Icknfcol.exe
1⤵
PID:7952
- C:\Windows\SysWOW64\Ikbfgppo.exe
  C:\Windows\system32\Ikbfgppo.exe
  2⤵
  PID:7988
- - C:\Windows\SysWOW64\Igigla32.exe
    C:\Windows\system32\Igigla32.exe
    3⤵
    PID:8104
  - - C:\Windows\SysWOW64\Jjgchm32.exe
      C:\Windows\system32\Jjgchm32.exe
      4⤵
      PID:8188
    - - C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        5⤵
        
        PID:4636

C:\Windows\SysWOW64\Jdmgfedl.exe
C:\Windows\system32\Jdmgfedl.exe
1⤵
PID:7260
- C:\Windows\SysWOW64\Jgkdbacp.exe
  C:\Windows\system32\Jgkdbacp.exe
  2⤵
  PID:7344
- - C:\Windows\SysWOW64\Jjjpnlbd.exe
    C:\Windows\system32\Jjjpnlbd.exe
    3⤵
    PID:7388
  - - C:\Windows\SysWOW64\Jpdhkf32.exe
      C:\Windows\system32\Jpdhkf32.exe
      4⤵
      PID:7456
    - - C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        5⤵
        
        PID:7540
      - C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        6⤵
        
        PID:7752

C:\Windows\SysWOW64\Jpfepf32.exe
C:\Windows\system32\Jpfepf32.exe
1⤵
PID:7880
- C:\Windows\SysWOW64\Jcdala32.exe
  C:\Windows\system32\Jcdala32.exe
  2⤵
  PID:8044
- - C:\Windows\SysWOW64\Jklinohd.exe
    C:\Windows\system32\Jklinohd.exe
    3⤵
    PID:8184
  - - C:\Windows\SysWOW64\Jqhafffk.exe
      C:\Windows\system32\Jqhafffk.exe
      4⤵
      PID:8148

C:\Windows\SysWOW64\Jcgnbaeo.exe
C:\Windows\system32\Jcgnbaeo.exe
1⤵
PID:7352
- C:\Windows\SysWOW64\Jjafok32.exe
  C:\Windows\system32\Jjafok32.exe
  2⤵
  PID:7416
- - C:\Windows\SysWOW64\Jlobkg32.exe
    C:\Windows\system32\Jlobkg32.exe
    3⤵
    PID:3528
  - - C:\Windows\SysWOW64\Kkpbin32.exe
      C:\Windows\system32\Kkpbin32.exe
      4⤵
      PID:7936
    - - C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        5⤵
        
        PID:8140

C:\Windows\SysWOW64\Kqmkae32.exe
C:\Windows\system32\Kqmkae32.exe
1⤵
PID:5204
- C:\Windows\SysWOW64\Kggcnoic.exe
  C:\Windows\system32\Kggcnoic.exe
  2⤵
  PID:7668
- - C:\Windows\SysWOW64\Kjepjkhf.exe
    C:\Windows\system32\Kjepjkhf.exe
    3⤵
    PID:7816

C:\Windows\SysWOW64\Knalji32.exe
C:\Windows\system32\Knalji32.exe
1⤵
PID:7340
- C:\Windows\SysWOW64\Kqphfe32.exe
  C:\Windows\system32\Kqphfe32.exe
  2⤵
  PID:7412
- - C:\Windows\SysWOW64\Kcndbp32.exe
    C:\Windows\system32\Kcndbp32.exe
    3⤵
    PID:8180

C:\Windows\SysWOW64\Kkeldnpi.exe
C:\Windows\system32\Kkeldnpi.exe
1⤵
PID:7888
- C:\Windows\SysWOW64\Kmfhkf32.exe
  C:\Windows\system32\Kmfhkf32.exe
  2⤵
  PID:7464
- - C:\Windows\SysWOW64\Kdmqmc32.exe
    C:\Windows\system32\Kdmqmc32.exe
    3⤵
    PID:8200
  - - C:\Windows\SysWOW64\Kglmio32.exe
      C:\Windows\system32\Kglmio32.exe
      4⤵
      PID:8248
    - - C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        5⤵
        
        PID:8320
      - C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        6⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        7⤵
        
        PID:8412

C:\Windows\SysWOW64\Lmmolepp.exe
C:\Windows\system32\Lmmolepp.exe
1⤵
PID:8448
- C:\Windows\SysWOW64\Lqikmc32.exe
  C:\Windows\system32\Lqikmc32.exe
  2⤵
  PID:8496

C:\Windows\SysWOW64\Lgccinoe.exe
C:\Windows\system32\Lgccinoe.exe
1⤵
PID:8536
- C:\Windows\SysWOW64\Lknojl32.exe
  C:\Windows\system32\Lknojl32.exe
  2⤵
  PID:8572

C:\Windows\SysWOW64\Lnmkfh32.exe
C:\Windows\system32\Lnmkfh32.exe
1⤵
PID:8616
- C:\Windows\SysWOW64\Lqkgbcff.exe
  C:\Windows\system32\Lqkgbcff.exe
  2⤵
  PID:8652

C:\Windows\SysWOW64\Lcjcnoej.exe
C:\Windows\system32\Lcjcnoej.exe
1⤵
PID:8688
- C:\Windows\SysWOW64\Ljclki32.exe
  C:\Windows\system32\Ljclki32.exe
  2⤵
  PID:8740
- - C:\Windows\SysWOW64\Lmbhgd32.exe
    C:\Windows\system32\Lmbhgd32.exe
    3⤵
    PID:8804
  - - C:\Windows\SysWOW64\Mmkkmc32.exe
      C:\Windows\system32\Mmkkmc32.exe
      4⤵
      PID:8844
    - - C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        5⤵
        
        PID:8892

C:\Windows\SysWOW64\Mjokgg32.exe
C:\Windows\system32\Mjokgg32.exe
1⤵
PID:8976
- C:\Windows\SysWOW64\Mnkggfkb.exe
  C:\Windows\system32\Mnkggfkb.exe
  2⤵
  PID:9020
- - C:\Windows\SysWOW64\Meepdp32.exe
    C:\Windows\system32\Meepdp32.exe
    3⤵
    PID:9060

C:\Windows\SysWOW64\Mgclpkac.exe
C:\Windows\system32\Mgclpkac.exe
1⤵
PID:9104
- C:\Windows\SysWOW64\Mkohaj32.exe
  C:\Windows\system32\Mkohaj32.exe
  2⤵
  PID:9148

C:\Windows\SysWOW64\Mnmdme32.exe
C:\Windows\system32\Mnmdme32.exe
1⤵
PID:9192
- C:\Windows\SysWOW64\Malpia32.exe
  C:\Windows\system32\Malpia32.exe
  2⤵
  PID:8212
- - C:\Windows\SysWOW64\Mcjmel32.exe
    C:\Windows\system32\Mcjmel32.exe
    3⤵
    PID:8280
  - - C:\Windows\SysWOW64\Mnpabe32.exe
      C:\Windows\system32\Mnpabe32.exe
      4⤵
      PID:8316
    - - C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        5⤵
        
        PID:8388

C:\Windows\SysWOW64\Nclikl32.exe
C:\Windows\system32\Nclikl32.exe
1⤵
PID:8488
- C:\Windows\SysWOW64\Nlcalieg.exe
  C:\Windows\system32\Nlcalieg.exe
  2⤵
  PID:8564

C:\Windows\SysWOW64\Njfagf32.exe
C:\Windows\system32\Njfagf32.exe
1⤵
PID:8660
- C:\Windows\SysWOW64\Nmenca32.exe
  C:\Windows\system32\Nmenca32.exe
  2⤵
  PID:8720

C:\Windows\SysWOW64\Nelfeo32.exe
C:\Windows\system32\Nelfeo32.exe
1⤵
PID:8816
- C:\Windows\SysWOW64\Nlfnaicd.exe
  C:\Windows\system32\Nlfnaicd.exe
  2⤵
  PID:8876
- - C:\Windows\SysWOW64\Nndjndbh.exe
    C:\Windows\system32\Nndjndbh.exe
    3⤵
    PID:8972

C:\Windows\SysWOW64\Nmgjia32.exe
C:\Windows\system32\Nmgjia32.exe
1⤵
PID:9016
- C:\Windows\SysWOW64\Nenbjo32.exe
  C:\Windows\system32\Nenbjo32.exe
  2⤵
  PID:9072

C:\Windows\SysWOW64\Nlkgmh32.exe
C:\Windows\system32\Nlkgmh32.exe
1⤵
PID:4048
- C:\Windows\SysWOW64\Nagpeo32.exe
  C:\Windows\system32\Nagpeo32.exe
  2⤵
  PID:7208

C:\Windows\SysWOW64\Nhahaiec.exe
C:\Windows\system32\Nhahaiec.exe
1⤵
PID:8476
- C:\Windows\SysWOW64\Nnkpnclp.exe
  C:\Windows\system32\Nnkpnclp.exe
  2⤵
  PID:8624

C:\Windows\SysWOW64\Ohfami32.exe
C:\Windows\system32\Ohfami32.exe
1⤵
PID:8836
- C:\Windows\SysWOW64\Ojdnid32.exe
  C:\Windows\system32\Ojdnid32.exe
  2⤵
  PID:8944

C:\Windows\SysWOW64\Onpjichj.exe
C:\Windows\system32\Onpjichj.exe
1⤵
PID:9040
- C:\Windows\SysWOW64\Oejbfmpg.exe
  C:\Windows\system32\Oejbfmpg.exe
  2⤵
  PID:9136

C:\Windows\SysWOW64\Odmbaj32.exe
C:\Windows\system32\Odmbaj32.exe
1⤵
PID:9160
- C:\Windows\SysWOW64\Oldjcg32.exe
  C:\Windows\system32\Oldjcg32.exe
  2⤵
  PID:3696
- - C:\Windows\SysWOW64\Oaqbkn32.exe
    C:\Windows\system32\Oaqbkn32.exe
    3⤵
    PID:336

C:\Windows\SysWOW64\Odhifjkg.exe
C:\Windows\system32\Odhifjkg.exe
1⤵
PID:8676

C:\Windows\SysWOW64\Njkkbehl.exe
C:\Windows\system32\Njkkbehl.exe
1⤵
PID:9180

C:\Windows\SysWOW64\Ncabfkqo.exe
C:\Windows\system32\Ncabfkqo.exe
1⤵
PID:9124

C:\Windows\SysWOW64\Lqmmmmph.exe
C:\Windows\system32\Lqmmmmph.exe
1⤵
PID:5444
- C:\Windows\SysWOW64\Lfjfecno.exe
  C:\Windows\system32\Lfjfecno.exe
  2⤵
  PID:5052

C:\Windows\SysWOW64\Iebngial.exe
C:\Windows\system32\Iebngial.exe
1⤵
PID:8376

C:\Windows\SysWOW64\Ljeafb32.exe
C:\Windows\system32\Ljeafb32.exe
1⤵
PID:5468
- C:\Windows\SysWOW64\Lmdnbn32.exe
  C:\Windows\system32\Lmdnbn32.exe
  2⤵
  PID:6084

C:\Windows\SysWOW64\Lobjni32.exe
C:\Windows\system32\Lobjni32.exe
1⤵
PID:2156
- C:\Windows\SysWOW64\Lgibpf32.exe
  C:\Windows\system32\Lgibpf32.exe
  2⤵
  PID:5628

C:\Windows\SysWOW64\Mgloefco.exe
C:\Windows\system32\Mgloefco.exe
1⤵
PID:5696
- C:\Windows\SysWOW64\Mjjkaabc.exe
  C:\Windows\system32\Mjjkaabc.exe
  2⤵
  PID:6008
- - C:\Windows\SysWOW64\Bkgeainn.exe
    C:\Windows\system32\Bkgeainn.exe
    3⤵
    PID:768
  - - C:\Windows\SysWOW64\Bpfkpp32.exe
      C:\Windows\system32\Bpfkpp32.exe
      4⤵
      PID:5608
    - - C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        5⤵
        
        PID:2348

C:\Windows\SysWOW64\Mgaokl32.exe
C:\Windows\system32\Mgaokl32.exe
1⤵
PID:8932

C:\Windows\SysWOW64\Bogkmgba.exe
C:\Windows\system32\Bogkmgba.exe
1⤵
PID:5676
- C:\Windows\SysWOW64\Baegibae.exe
  C:\Windows\system32\Baegibae.exe
  2⤵
  PID:6064

C:\Windows\SysWOW64\Bddcenpi.exe
C:\Windows\system32\Bddcenpi.exe
1⤵
PID:2364
- C:\Windows\SysWOW64\Bgbpaipl.exe
  C:\Windows\system32\Bgbpaipl.exe
  2⤵
  PID:5716
- - C:\Windows\SysWOW64\Bnoddcef.exe
    C:\Windows\system32\Bnoddcef.exe
    3⤵
    PID:5744
  - - C:\Windows\SysWOW64\Bajqda32.exe
      C:\Windows\system32\Bajqda32.exe
      4⤵
      PID:5976
    - - C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        5⤵
        
        PID:4128
      - C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        6⤵
        
        PID:8
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        7⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        8⤵
        
        PID:316
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        9⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        10⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        11⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        12⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        13⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        14⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        15⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        16⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        17⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        18⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        19⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        20⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        21⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        22⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        23⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        24⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        25⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        26⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        27⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        28⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        29⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        30⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        31⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        32⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        33⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        34⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        35⤵
        
        PID:6164

C:\Windows\SysWOW64\Hicpgc32.exe
C:\Windows\system32\Hicpgc32.exe
1⤵
PID:9068
- C:\Windows\SysWOW64\Hnphoj32.exe
  C:\Windows\system32\Hnphoj32.exe
  2⤵
  PID:6832
- - C:\Windows\SysWOW64\Hejqldci.exe
    C:\Windows\system32\Hejqldci.exe
    3⤵
    PID:9080

C:\Windows\SysWOW64\Hifmmb32.exe
C:\Windows\system32\Hifmmb32.exe
1⤵
PID:5132
- C:\Windows\SysWOW64\Hldiinke.exe
  C:\Windows\system32\Hldiinke.exe
  2⤵
  PID:3724
- - C:\Windows\SysWOW64\Hihibbjo.exe
    C:\Windows\system32\Hihibbjo.exe
    3⤵
    PID:5688
  - - C:\Windows\SysWOW64\Inebjihf.exe
      C:\Windows\system32\Inebjihf.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4708

C:\Windows\SysWOW64\Ilibdmgp.exe
C:\Windows\system32\Ilibdmgp.exe
1⤵
PID:804
- C:\Windows\SysWOW64\Ipdndloi.exe
  C:\Windows\system32\Ipdndloi.exe
  2⤵
  PID:4968

C:\Windows\SysWOW64\Ibcjqgnm.exe
C:\Windows\system32\Ibcjqgnm.exe
1⤵
PID:1180
- C:\Windows\SysWOW64\Ieagmcmq.exe
  C:\Windows\system32\Ieagmcmq.exe
  2⤵
  PID:2984
- - C:\Windows\SysWOW64\Iimcma32.exe
    C:\Windows\system32\Iimcma32.exe
    3⤵
    PID:6252

C:\Windows\SysWOW64\Ilkoim32.exe
C:\Windows\system32\Ilkoim32.exe
1⤵
PID:224
- C:\Windows\SysWOW64\Iojkeh32.exe
  C:\Windows\system32\Iojkeh32.exe
  2⤵
  PID:4452

C:\Windows\SysWOW64\Ibegfglj.exe
C:\Windows\system32\Ibegfglj.exe
1⤵
PID:8544
- C:\Windows\SysWOW64\Iiopca32.exe
  C:\Windows\system32\Iiopca32.exe
  2⤵
  PID:3768

C:\Windows\SysWOW64\Iolhkh32.exe
C:\Windows\system32\Iolhkh32.exe
1⤵
PID:8016
- C:\Windows\SysWOW64\Iajdgcab.exe
  C:\Windows\system32\Iajdgcab.exe
  2⤵
  PID:4812

C:\Windows\SysWOW64\Iefphb32.exe
C:\Windows\system32\Iefphb32.exe
1⤵
PID:4108
- C:\Windows\SysWOW64\Ihdldn32.exe
  C:\Windows\system32\Ihdldn32.exe
  2⤵
  PID:5544

C:\Windows\SysWOW64\Iehmmb32.exe
C:\Windows\system32\Iehmmb32.exe
1⤵
PID:5556
- C:\Windows\SysWOW64\Jhgiim32.exe
  C:\Windows\system32\Jhgiim32.exe
  2⤵
  PID:5460
- - C:\Windows\SysWOW64\Jlbejloe.exe
    C:\Windows\system32\Jlbejloe.exe
    3⤵
    PID:6056

C:\Windows\SysWOW64\Joqafgni.exe
C:\Windows\system32\Joqafgni.exe
1⤵
PID:8784
- C:\Windows\SysWOW64\Jaonbc32.exe
  C:\Windows\system32\Jaonbc32.exe
  2⤵
  PID:5948

C:\Windows\SysWOW64\Jekjcaef.exe
C:\Windows\system32\Jekjcaef.exe
1⤵
PID:5944
- C:\Windows\SysWOW64\Jhifomdj.exe
  C:\Windows\system32\Jhifomdj.exe
  2⤵
  PID:6024

C:\Windows\SysWOW64\Jppnpjel.exe
C:\Windows\system32\Jppnpjel.exe
1⤵
PID:8240
- C:\Windows\SysWOW64\Jbojlfdp.exe
  C:\Windows\system32\Jbojlfdp.exe
  2⤵
  PID:6236

C:\Windows\SysWOW64\Jaajhb32.exe
C:\Windows\system32\Jaajhb32.exe
1⤵
PID:3620
- C:\Windows\SysWOW64\Jihbip32.exe
  C:\Windows\system32\Jihbip32.exe
  2⤵
  PID:5940
- - C:\Windows\SysWOW64\Joekag32.exe
    C:\Windows\system32\Joekag32.exe
    3⤵
    PID:6108

C:\Windows\SysWOW64\Jeocna32.exe
C:\Windows\system32\Jeocna32.exe
1⤵
PID:4028
- C:\Windows\SysWOW64\Jikoopij.exe
  C:\Windows\system32\Jikoopij.exe
  2⤵
  PID:3076
- - C:\Windows\SysWOW64\Jlikkkhn.exe
    C:\Windows\system32\Jlikkkhn.exe
    3⤵
    PID:4880
  - - C:\Windows\SysWOW64\Jbccge32.exe
      C:\Windows\system32\Jbccge32.exe
      4⤵
      PID:6320

C:\Windows\SysWOW64\Jeapcq32.exe
C:\Windows\system32\Jeapcq32.exe
1⤵
PID:6224
- C:\Windows\SysWOW64\Jhplpl32.exe
  C:\Windows\system32\Jhplpl32.exe
  2⤵
  PID:6544

C:\Windows\SysWOW64\Kpiqfima.exe
C:\Windows\system32\Kpiqfima.exe
1⤵
PID:6628
- C:\Windows\SysWOW64\Kbhmbdle.exe
  C:\Windows\system32\Kbhmbdle.exe
  2⤵
  PID:6312

C:\Windows\SysWOW64\Kcjjhdjb.exe
C:\Windows\system32\Kcjjhdjb.exe
1⤵
PID:6244
- C:\Windows\SysWOW64\Kamjda32.exe
  C:\Windows\system32\Kamjda32.exe
  2⤵
  PID:6884

C:\Windows\SysWOW64\Kidben32.exe
C:\Windows\system32\Kidben32.exe
1⤵
PID:7196
- C:\Windows\SysWOW64\Khgbqkhj.exe
  C:\Windows\system32\Khgbqkhj.exe
  2⤵
  PID:5684

C:\Windows\SysWOW64\Koajmepf.exe
C:\Windows\system32\Koajmepf.exe
1⤵
PID:4312
- C:\Windows\SysWOW64\Kapfiqoj.exe
  C:\Windows\system32\Kapfiqoj.exe
  2⤵
  PID:4984
- - C:\Windows\SysWOW64\Kekbjo32.exe
    C:\Windows\system32\Kekbjo32.exe
    3⤵
    PID:2196
  - - C:\Windows\SysWOW64\Khiofk32.exe
      C:\Windows\system32\Khiofk32.exe
      4⤵
      PID:8464

C:\Windows\SysWOW64\Lpepbgbd.exe
C:\Windows\system32\Lpepbgbd.exe
1⤵
PID:2788
- C:\Windows\SysWOW64\Lcclncbh.exe
  C:\Windows\system32\Lcclncbh.exe
  2⤵
  PID:7140
- - C:\Windows\SysWOW64\Lafmjp32.exe
    C:\Windows\system32\Lafmjp32.exe
    3⤵
    PID:2568

C:\Windows\SysWOW64\Lllagh32.exe
C:\Windows\system32\Lllagh32.exe
1⤵
PID:5300
- C:\Windows\SysWOW64\Lpgmhg32.exe
  C:\Windows\system32\Lpgmhg32.exe
  2⤵
  PID:1272
- - C:\Windows\SysWOW64\Laiipofp.exe
    C:\Windows\system32\Laiipofp.exe
    3⤵
    PID:3712
  - - C:\Windows\SysWOW64\Lhcali32.exe
      C:\Windows\system32\Lhcali32.exe
      4⤵
      PID:8704

C:\Windows\SysWOW64\Llnnmhfe.exe
C:\Windows\system32\Llnnmhfe.exe
1⤵
PID:3892
- C:\Windows\SysWOW64\Lomjicei.exe
  C:\Windows\system32\Lomjicei.exe
  2⤵
  PID:940

C:\Windows\SysWOW64\Lchfib32.exe
C:\Windows\system32\Lchfib32.exe
1⤵
PID:2296
- C:\Windows\SysWOW64\Legben32.exe
  C:\Windows\system32\Legben32.exe
  2⤵
  PID:5896

C:\Windows\SysWOW64\Loofnccf.exe
C:\Windows\system32\Loofnccf.exe
1⤵
PID:5344
- C:\Windows\SysWOW64\Lancko32.exe
  C:\Windows\system32\Lancko32.exe
  2⤵
  PID:2396
- - C:\Windows\SysWOW64\Ljdkll32.exe
    C:\Windows\system32\Ljdkll32.exe
    3⤵
    PID:5960

C:\Windows\SysWOW64\Mjggal32.exe
C:\Windows\system32\Mjggal32.exe
1⤵
PID:8832
- C:\Windows\SysWOW64\Mledmg32.exe
  C:\Windows\system32\Mledmg32.exe
  2⤵
  PID:7152

C:\Windows\SysWOW64\Modpib32.exe
C:\Windows\system32\Modpib32.exe
1⤵
PID:5404
- C:\Windows\SysWOW64\Mablfnne.exe
  C:\Windows\system32\Mablfnne.exe
  2⤵
  PID:6372
- - C:\Windows\SysWOW64\Mjidgkog.exe
    C:\Windows\system32\Mjidgkog.exe
    3⤵
    PID:7088

C:\Windows\SysWOW64\Mbdiknlb.exe
C:\Windows\system32\Mbdiknlb.exe
1⤵
PID:4132
- C:\Windows\SysWOW64\Mfpell32.exe
  C:\Windows\system32\Mfpell32.exe
  2⤵
  PID:7652

C:\Windows\SysWOW64\Mhoahh32.exe
C:\Windows\system32\Mhoahh32.exe
1⤵
PID:8492
- C:\Windows\SysWOW64\Mohidbkl.exe
  C:\Windows\system32\Mohidbkl.exe
  2⤵
  PID:5504

C:\Windows\SysWOW64\Mbgeqmjp.exe
C:\Windows\system32\Mbgeqmjp.exe
1⤵
PID:5672
- C:\Windows\SysWOW64\Mfbaalbi.exe
  C:\Windows\system32\Mfbaalbi.exe
  2⤵
  PID:5912
- - C:\Windows\SysWOW64\Mhanngbl.exe
    C:\Windows\system32\Mhanngbl.exe
    3⤵
    PID:728
  - - C:\Windows\SysWOW64\Mjpjgj32.exe
      C:\Windows\system32\Mjpjgj32.exe
      4⤵
      PID:5656

C:\Windows\SysWOW64\Mlofcf32.exe
C:\Windows\system32\Mlofcf32.exe
1⤵
PID:8556
- C:\Windows\SysWOW64\Nciopppp.exe
  C:\Windows\system32\Nciopppp.exe
  2⤵
  PID:7968
- - C:\Windows\SysWOW64\Nfgklkoc.exe
    C:\Windows\system32\Nfgklkoc.exe
    3⤵
    PID:6452

C:\Windows\SysWOW64\Nhegig32.exe
C:\Windows\system32\Nhegig32.exe
1⤵
PID:5784
- C:\Windows\SysWOW64\Nqmojd32.exe
  C:\Windows\system32\Nqmojd32.exe
  2⤵
  PID:1176
- - C:\Windows\SysWOW64\Nckkfp32.exe
    C:\Windows\system32\Nckkfp32.exe
    3⤵
    PID:8040

C:\Windows\SysWOW64\Nbnlaldg.exe
C:\Windows\system32\Nbnlaldg.exe
1⤵
PID:2376
- C:\Windows\SysWOW64\Njedbjej.exe
  C:\Windows\system32\Njedbjej.exe
  2⤵
  PID:6592
- - C:\Windows\SysWOW64\Nmcpoedn.exe
    C:\Windows\system32\Nmcpoedn.exe
    3⤵
    PID:8812

C:\Windows\SysWOW64\Noblkqca.exe
C:\Windows\system32\Noblkqca.exe
1⤵
PID:6308
- C:\Windows\SysWOW64\Nbphglbe.exe
  C:\Windows\system32\Nbphglbe.exe
  2⤵
  PID:7104
- - C:\Windows\SysWOW64\Njgqhicg.exe
    C:\Windows\system32\Njgqhicg.exe
    3⤵
    PID:3120

C:\Windows\SysWOW64\Nmfmde32.exe
C:\Windows\system32\Nmfmde32.exe
1⤵
PID:5720
- C:\Windows\SysWOW64\Nqaiecjd.exe
  C:\Windows\system32\Nqaiecjd.exe
  2⤵
  PID:5348

C:\Windows\SysWOW64\Nmjfodne.exe
C:\Windows\system32\Nmjfodne.exe
1⤵
PID:432
- C:\Windows\SysWOW64\Ooibkpmi.exe
  C:\Windows\system32\Ooibkpmi.exe
  2⤵
  PID:6436
- - C:\Windows\SysWOW64\Obgohklm.exe
    C:\Windows\system32\Obgohklm.exe
    3⤵
    PID:6872

C:\Windows\SysWOW64\Ofckhj32.exe
C:\Windows\system32\Ofckhj32.exe
1⤵
PID:3520
- C:\Windows\SysWOW64\Oiagde32.exe
  C:\Windows\system32\Oiagde32.exe
  2⤵
  PID:2992

C:\Windows\SysWOW64\Omdieb32.exe
C:\Windows\system32\Omdieb32.exe
1⤵
PID:6268
- C:\Windows\SysWOW64\Opbean32.exe
  C:\Windows\system32\Opbean32.exe
  2⤵
  PID:6504

C:\Windows\SysWOW64\Obqanjdb.exe
C:\Windows\system32\Obqanjdb.exe
1⤵
PID:764
- C:\Windows\SysWOW64\Ojhiogdd.exe
  C:\Windows\system32\Ojhiogdd.exe
  2⤵
  PID:7016
- - C:\Windows\SysWOW64\Omfekbdh.exe
    C:\Windows\system32\Omfekbdh.exe
    3⤵
    PID:6468

C:\Windows\SysWOW64\Pqbala32.exe
C:\Windows\system32\Pqbala32.exe
1⤵
PID:2608
- C:\Windows\SysWOW64\Pcpnhl32.exe
  C:\Windows\system32\Pcpnhl32.exe
  2⤵
  PID:1940

C:\Windows\SysWOW64\Pfojdh32.exe
C:\Windows\system32\Pfojdh32.exe
1⤵
PID:2720
- C:\Windows\SysWOW64\Pimfpc32.exe
  C:\Windows\system32\Pimfpc32.exe
  2⤵
  PID:6776
- - C:\Windows\SysWOW64\Padnaq32.exe
    C:\Windows\system32\Padnaq32.exe
    3⤵
    PID:5816
  - - C:\Windows\SysWOW64\Pbekii32.exe
      C:\Windows\system32\Pbekii32.exe
      4⤵
      PID:1648

C:\Windows\SysWOW64\Pjlcjf32.exe
C:\Windows\system32\Pjlcjf32.exe
1⤵
PID:1520
- C:\Windows\SysWOW64\Pafkgphl.exe
  C:\Windows\system32\Pafkgphl.exe
  2⤵
  PID:6492
- - C:\Windows\SysWOW64\Pcegclgp.exe
    C:\Windows\system32\Pcegclgp.exe
    3⤵
    PID:7924

C:\Windows\SysWOW64\Pfccogfc.exe
C:\Windows\system32\Pfccogfc.exe
1⤵
PID:9252
- C:\Windows\SysWOW64\Piapkbeg.exe
  C:\Windows\system32\Piapkbeg.exe
  2⤵
  PID:9304
- - C:\Windows\SysWOW64\Paihlpfi.exe
    C:\Windows\system32\Paihlpfi.exe
    3⤵
    PID:9348

C:\Windows\SysWOW64\Pcgdhkem.exe
C:\Windows\system32\Pcgdhkem.exe
1⤵
PID:9392
- C:\Windows\SysWOW64\Pfepdg32.exe
  C:\Windows\system32\Pfepdg32.exe
  2⤵
  PID:9436

C:\Windows\SysWOW64\Pidlqb32.exe
C:\Windows\system32\Pidlqb32.exe
1⤵
PID:9480
- C:\Windows\SysWOW64\Ppnenlka.exe
  C:\Windows\system32\Ppnenlka.exe
  2⤵
  PID:9524

C:\Windows\SysWOW64\Pciqnk32.exe
C:\Windows\system32\Pciqnk32.exe
1⤵
PID:9564
- C:\Windows\SysWOW64\Pfhmjf32.exe
  C:\Windows\system32\Pfhmjf32.exe
  2⤵
  PID:9604
- - C:\Windows\SysWOW64\Pjcikejg.exe
    C:\Windows\system32\Pjcikejg.exe
    3⤵
    PID:9648

C:\Windows\SysWOW64\Pmbegqjk.exe
C:\Windows\system32\Pmbegqjk.exe
1⤵
PID:9692
- C:\Windows\SysWOW64\Qppaclio.exe
  C:\Windows\system32\Qppaclio.exe
  2⤵
  PID:9736

C:\Windows\SysWOW64\Qbonoghb.exe
C:\Windows\system32\Qbonoghb.exe
1⤵
PID:9780
- C:\Windows\SysWOW64\Qjffpe32.exe
  C:\Windows\system32\Qjffpe32.exe
  2⤵
  PID:9816
- - C:\Windows\SysWOW64\Qiiflaoo.exe
    C:\Windows\system32\Qiiflaoo.exe
    3⤵
    PID:9860

C:\Windows\SysWOW64\Qapnmopa.exe
C:\Windows\system32\Qapnmopa.exe
1⤵
PID:9900
- C:\Windows\SysWOW64\Qcnjijoe.exe
  C:\Windows\system32\Qcnjijoe.exe
  2⤵
  PID:9948
- - C:\Windows\SysWOW64\Qfmfefni.exe
    C:\Windows\system32\Qfmfefni.exe
    3⤵
    PID:9988

C:\Windows\SysWOW64\Amfobp32.exe
C:\Windows\system32\Amfobp32.exe
1⤵
PID:10036
- C:\Windows\SysWOW64\Aabkbono.exe
  C:\Windows\system32\Aabkbono.exe
  2⤵
  PID:10088
- - C:\Windows\SysWOW64\Abcgjg32.exe
    C:\Windows\system32\Abcgjg32.exe
    3⤵
    PID:10136

C:\Windows\SysWOW64\Afockelf.exe
C:\Windows\system32\Afockelf.exe
1⤵
PID:10172
- C:\Windows\SysWOW64\Amikgpcc.exe
  C:\Windows\system32\Amikgpcc.exe
  2⤵
  PID:10216

C:\Windows\SysWOW64\Apggckbf.exe
C:\Windows\system32\Apggckbf.exe
1⤵
PID:9244
- C:\Windows\SysWOW64\Acccdj32.exe
  C:\Windows\system32\Acccdj32.exe
  2⤵
  PID:9312
- - C:\Windows\SysWOW64\Afappe32.exe
    C:\Windows\system32\Afappe32.exe
    3⤵
    PID:9400

C:\Windows\SysWOW64\Aiplmq32.exe
C:\Windows\system32\Aiplmq32.exe
1⤵
PID:9448
- C:\Windows\SysWOW64\Aagdnn32.exe
  C:\Windows\system32\Aagdnn32.exe
  2⤵
  PID:9520
- - C:\Windows\SysWOW64\Adepji32.exe
    C:\Windows\system32\Adepji32.exe
    3⤵
    PID:9588
  - - C:\Windows\SysWOW64\Afcmfe32.exe
      C:\Windows\system32\Afcmfe32.exe
      4⤵
      PID:9660

C:\Windows\SysWOW64\Aibibp32.exe
C:\Windows\system32\Aibibp32.exe
1⤵
PID:9720
- C:\Windows\SysWOW64\Aaiqcnhg.exe
  C:\Windows\system32\Aaiqcnhg.exe
  2⤵
  PID:9772
- - C:\Windows\SysWOW64\Adgmoigj.exe
    C:\Windows\system32\Adgmoigj.exe
    3⤵
    PID:9848

C:\Windows\SysWOW64\Abjmkf32.exe
C:\Windows\system32\Abjmkf32.exe
1⤵
PID:9896
- C:\Windows\SysWOW64\Ajaelc32.exe
  C:\Windows\system32\Ajaelc32.exe
  2⤵
  PID:9976

C:\Windows\SysWOW64\Ampaho32.exe
C:\Windows\system32\Ampaho32.exe
1⤵
PID:10016
- C:\Windows\SysWOW64\Apnndj32.exe
  C:\Windows\system32\Apnndj32.exe
  2⤵
  PID:10096
- - C:\Windows\SysWOW64\Afhfaddk.exe
    C:\Windows\system32\Afhfaddk.exe
    3⤵
    PID:10168

C:\Windows\SysWOW64\Bigbmpco.exe
C:\Windows\system32\Bigbmpco.exe
1⤵
PID:3608
- C:\Windows\SysWOW64\Banjnm32.exe
  C:\Windows\system32\Banjnm32.exe
  2⤵
  PID:9268
- - C:\Windows\SysWOW64\Bdlfjh32.exe
    C:\Windows\system32\Bdlfjh32.exe
    3⤵
    PID:6576

C:\Windows\SysWOW64\Bfkbfd32.exe
C:\Windows\system32\Bfkbfd32.exe
1⤵
PID:9416
- C:\Windows\SysWOW64\Biiobo32.exe
  C:\Windows\system32\Biiobo32.exe
  2⤵
  PID:9556
- - C:\Windows\SysWOW64\Bapgdm32.exe
    C:\Windows\system32\Bapgdm32.exe
    3⤵
    PID:9636
  - - C:\Windows\SysWOW64\Bdocph32.exe
      C:\Windows\system32\Bdocph32.exe
      4⤵
      PID:9748

C:\Windows\SysWOW64\Bfmolc32.exe
C:\Windows\system32\Bfmolc32.exe
1⤵
PID:9852
- C:\Windows\SysWOW64\Biklho32.exe
  C:\Windows\system32\Biklho32.exe
  2⤵
  PID:9956
- - C:\Windows\SysWOW64\Bpedeiff.exe
    C:\Windows\system32\Bpedeiff.exe
    3⤵
    PID:10084

C:\Windows\SysWOW64\Bkkhbb32.exe
C:\Windows\system32\Bkkhbb32.exe
1⤵
PID:9284
- C:\Windows\SysWOW64\Bmidnm32.exe
  C:\Windows\system32\Bmidnm32.exe
  2⤵
  PID:9336
- - C:\Windows\SysWOW64\Bphqji32.exe
    C:\Windows\system32\Bphqji32.exe
    3⤵
    PID:9632
  - - C:\Windows\SysWOW64\Bbfmgd32.exe
      C:\Windows\system32\Bbfmgd32.exe
      4⤵
      PID:9776

C:\Windows\SysWOW64\Bipecnkd.exe
C:\Windows\system32\Bipecnkd.exe
1⤵
PID:9936
- C:\Windows\SysWOW64\Bmladm32.exe
  C:\Windows\system32\Bmladm32.exe
  2⤵
  PID:10024

C:\Windows\SysWOW64\Bpjmph32.exe
C:\Windows\system32\Bpjmph32.exe
1⤵
PID:10164
- C:\Windows\SysWOW64\Bbhildae.exe
  C:\Windows\system32\Bbhildae.exe
  2⤵
  PID:10200
- - C:\Windows\SysWOW64\Ckpamabg.exe
    C:\Windows\system32\Ckpamabg.exe
    3⤵
    PID:7932
  - - C:\Windows\SysWOW64\Cmnnimak.exe
      C:\Windows\system32\Cmnnimak.exe
      4⤵
      PID:5024

C:\Windows\SysWOW64\Cmpjoloh.exe
C:\Windows\system32\Cmpjoloh.exe
1⤵
PID:9344
- C:\Windows\SysWOW64\Ckdkhq32.exe
  C:\Windows\system32\Ckdkhq32.exe
  2⤵
  PID:9444

C:\Windows\SysWOW64\Cpacqg32.exe
C:\Windows\system32\Cpacqg32.exe
1⤵
PID:7188
- C:\Windows\SysWOW64\Caqpkjcl.exe
  C:\Windows\system32\Caqpkjcl.exe
  2⤵
  PID:9888
- - C:\Windows\SysWOW64\Ckidcpjl.exe
    C:\Windows\system32\Ckidcpjl.exe
    3⤵
    PID:7476
  - - C:\Windows\SysWOW64\Cacmpj32.exe
      C:\Windows\system32\Cacmpj32.exe
      4⤵
      PID:7920

C:\Windows\SysWOW64\Dmjmekgn.exe
C:\Windows\system32\Dmjmekgn.exe
1⤵
PID:7232
- C:\Windows\SysWOW64\Dgbanq32.exe
  C:\Windows\system32\Dgbanq32.exe
  2⤵
  PID:7912
- - C:\Windows\SysWOW64\Dnljkk32.exe
    C:\Windows\system32\Dnljkk32.exe
    3⤵
    PID:7480
  - - C:\Windows\SysWOW64\Dpjfgf32.exe
      C:\Windows\system32\Dpjfgf32.exe
      4⤵
      PID:4808

C:\Windows\SysWOW64\Dgdncplk.exe
C:\Windows\system32\Dgdncplk.exe
1⤵
PID:9472
- C:\Windows\SysWOW64\Dickplko.exe
  C:\Windows\system32\Dickplko.exe
  2⤵
  PID:6752

C:\Windows\SysWOW64\Dalofi32.exe
C:\Windows\system32\Dalofi32.exe
1⤵
PID:8028
- C:\Windows\SysWOW64\Ddklbd32.exe
  C:\Windows\system32\Ddklbd32.exe
  2⤵
  PID:6864
- - C:\Windows\SysWOW64\Dgihop32.exe
    C:\Windows\system32\Dgihop32.exe
    3⤵
    PID:4400

C:\Windows\SysWOW64\Djgdkk32.exe
C:\Windows\system32\Djgdkk32.exe
1⤵
PID:8052
- C:\Windows\SysWOW64\Daollh32.exe
  C:\Windows\system32\Daollh32.exe
  2⤵
  PID:4420

C:\Windows\SysWOW64\Dcphdqmj.exe
C:\Windows\system32\Dcphdqmj.exe
1⤵
PID:7868
- C:\Windows\SysWOW64\Ekgqennl.exe
  C:\Windows\system32\Ekgqennl.exe
  2⤵
  PID:5140

C:\Windows\SysWOW64\Ecbeip32.exe
C:\Windows\system32\Ecbeip32.exe
1⤵
PID:10260
- C:\Windows\SysWOW64\Ejlnfjbd.exe
  C:\Windows\system32\Ejlnfjbd.exe
  2⤵
  PID:10308
- - C:\Windows\SysWOW64\Epffbd32.exe
    C:\Windows\system32\Epffbd32.exe
    3⤵
    PID:10348

C:\Windows\SysWOW64\Egpnooan.exe
C:\Windows\system32\Egpnooan.exe
1⤵
PID:10388
- C:\Windows\SysWOW64\Ejojljqa.exe
  C:\Windows\system32\Ejojljqa.exe
  2⤵
  PID:10428

C:\Windows\SysWOW64\Ephbhd32.exe
C:\Windows\system32\Ephbhd32.exe
1⤵
PID:10500
- C:\Windows\SysWOW64\Ecgodpgb.exe
  C:\Windows\system32\Ecgodpgb.exe
  2⤵
  PID:10548

C:\Windows\SysWOW64\Ekngemhd.exe
C:\Windows\system32\Ekngemhd.exe
1⤵
PID:10588
- C:\Windows\SysWOW64\Enlcahgh.exe
  C:\Windows\system32\Enlcahgh.exe
  2⤵
  PID:10636
- - C:\Windows\SysWOW64\Eqkondfl.exe
    C:\Windows\system32\Eqkondfl.exe
    3⤵
    PID:10680

C:\Windows\SysWOW64\Ecikjoep.exe
C:\Windows\system32\Ecikjoep.exe
1⤵
PID:10728
- C:\Windows\SysWOW64\Ekqckmfb.exe
  C:\Windows\system32\Ekqckmfb.exe
  2⤵
  PID:10768

C:\Windows\SysWOW64\Enopghee.exe
C:\Windows\system32\Enopghee.exe
1⤵
PID:10804
- C:\Windows\SysWOW64\Eqmlccdi.exe
  C:\Windows\system32\Eqmlccdi.exe
  2⤵
  PID:10856
- - C:\Windows\SysWOW64\Fclhpo32.exe
    C:\Windows\system32\Fclhpo32.exe
    3⤵
    PID:10900

C:\Windows\SysWOW64\Fkcpql32.exe
C:\Windows\system32\Fkcpql32.exe
1⤵
PID:10944
- C:\Windows\SysWOW64\Fnalmh32.exe
  C:\Windows\system32\Fnalmh32.exe
  2⤵
  PID:10988
- - C:\Windows\SysWOW64\Fqphic32.exe
    C:\Windows\system32\Fqphic32.exe
    3⤵
    PID:11032

C:\Windows\SysWOW64\Fcneeo32.exe
C:\Windows\system32\Fcneeo32.exe
1⤵
PID:11072
- C:\Windows\SysWOW64\Fgiaemic.exe
  C:\Windows\system32\Fgiaemic.exe
  2⤵
  PID:11116
- - C:\Windows\SysWOW64\Fncibg32.exe
    C:\Windows\system32\Fncibg32.exe
    3⤵
    PID:11168

C:\Windows\SysWOW64\Fqbeoc32.exe
C:\Windows\system32\Fqbeoc32.exe
1⤵
PID:11208
- C:\Windows\SysWOW64\Fcpakn32.exe
  C:\Windows\system32\Fcpakn32.exe
  2⤵
  PID:11252
- - C:\Windows\SysWOW64\Fglnkm32.exe
    C:\Windows\system32\Fglnkm32.exe
    3⤵
    PID:10292

C:\Windows\SysWOW64\Fcbnpnme.exe
C:\Windows\system32\Fcbnpnme.exe
1⤵
PID:10356
- C:\Windows\SysWOW64\Fgnjqm32.exe
  C:\Windows\system32\Fgnjqm32.exe
  2⤵
  PID:10408

C:\Windows\SysWOW64\Fjmfmh32.exe
C:\Windows\system32\Fjmfmh32.exe
1⤵
PID:10496
- C:\Windows\SysWOW64\Fbdnne32.exe
  C:\Windows\system32\Fbdnne32.exe
  2⤵
  PID:10580
- - C:\Windows\SysWOW64\Fdbkja32.exe
    C:\Windows\system32\Fdbkja32.exe
    3⤵
    PID:10648

C:\Windows\SysWOW64\Fgqgfl32.exe
C:\Windows\system32\Fgqgfl32.exe
1⤵
PID:10712
- C:\Windows\SysWOW64\Fklcgk32.exe
  C:\Windows\system32\Fklcgk32.exe
  2⤵
  PID:10776

C:\Windows\SysWOW64\Fnjocf32.exe
C:\Windows\system32\Fnjocf32.exe
1⤵
PID:10864
- C:\Windows\SysWOW64\Fqikob32.exe
  C:\Windows\system32\Fqikob32.exe
  2⤵
  PID:10896
- - C:\Windows\SysWOW64\Gcghkm32.exe
    C:\Windows\system32\Gcghkm32.exe
    3⤵
    PID:2160

C:\Windows\SysWOW64\Gjaphgpl.exe
C:\Windows\system32\Gjaphgpl.exe
1⤵
PID:11000
- C:\Windows\SysWOW64\Gbhhieao.exe
  C:\Windows\system32\Gbhhieao.exe
  2⤵
  PID:11068

C:\Windows\SysWOW64\Gqkhda32.exe
C:\Windows\system32\Gqkhda32.exe
1⤵
PID:11124
- C:\Windows\SysWOW64\Gcjdam32.exe
  C:\Windows\system32\Gcjdam32.exe
  2⤵
  PID:11196

C:\Windows\SysWOW64\Gkalbj32.exe
C:\Windows\system32\Gkalbj32.exe
1⤵
PID:10256
- C:\Windows\SysWOW64\Gnohnffc.exe
  C:\Windows\system32\Gnohnffc.exe
  2⤵
  PID:10460
- - C:\Windows\SysWOW64\Gqnejaff.exe
    C:\Windows\system32\Gqnejaff.exe
    3⤵
    PID:10384
  - - C:\Windows\SysWOW64\Gggmgk32.exe
      C:\Windows\system32\Gggmgk32.exe
      4⤵
      PID:10516
    - - C:\Windows\SysWOW64\Gjficg32.exe
        
        C:\Windows\system32\Gjficg32.exe
        5⤵
        
        PID:10596

C:\Windows\SysWOW64\Gbmadd32.exe
C:\Windows\system32\Gbmadd32.exe
1⤵
PID:10700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10700 -s 424
  2⤵
  - Program crash
  PID:11040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 10700 -ip 10700
1⤵
PID:10908

C:\Windows\SysWOW64\Djegekil.exe
C:\Windows\system32\Djegekil.exe
1⤵
PID:10028

C:\Windows\SysWOW64\Cbkfbcpb.exe
C:\Windows\system32\Cbkfbcpb.exe
1⤵
PID:10048

C:\Windows\SysWOW64\Cpljehpo.exe
C:\Windows\system32\Cpljehpo.exe
1⤵
PID:10112

C:\Windows\SysWOW64\Bbdpad32.exe
C:\Windows\system32\Bbdpad32.exe
1⤵
PID:10156

C:\Windows\SysWOW64\Lindkm32.exe
C:\Windows\system32\Lindkm32.exe
1⤵
PID:6348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Baicac32.exe

Path C:\Windows\SysWOW64\Baicac32.exe
Size 97KB
SHA256 e644fe54663043c4b7148421b69c7da9fc14f0a198345abddd976266d2aa02d5
MD5 7c83361af690c95b8947367d3e25f99c
SHA1 b4864a3f8aea67ec8f6058a44405a177eb715cc3
SHA512 6efc09ccc613225bd46e6404afb3eecdc19a9abb6b88bf30ab054e040651571e6d604757f9bd25c562310dbece5eeb5bce2099314a3bd5910b21ea9478dcc1e4
SSDEEP 1536:VAa4gog/AG0paMayF6i9qBn5kqFPMHHHwvoQKNvJXeYZ6:VJoajFBnn5JKlJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Beihma32.exe

Path C:\Windows\SysWOW64\Beihma32.exe
Size 97KB
SHA256 ebe91127fcdeb695bb30c5ff56556b57817a5743bc1dd18582ff44828f7960d8
MD5 51f27b8c8e98f8af78345e3c1afb500d
SHA1 a34d3c7d2f9eb38dc6d730d331c49067bbcbd2d8
SHA512 6d59fafc35dea0392e3bca914cafe6d4624929858791db723c4179bd698381c23ac49627e316bfeec26f5fde883dfd0c3fef79aeac2b383087c7c4a2d5ca2e4a
SSDEEP 1536:ZXJUKlmtD5BWzux7kaz6ZCmjzO+65SRH3/h/1wGGzvJXeYZ6:x7mZLIZ3O+vRH3/h/1wGGzJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bmemac32.exe

Path C:\Windows\SysWOW64\Bmemac32.exe
Size 97KB
SHA256 b259814b888579e0ed0a26e5de46a627f369b87b302baea2ea6f52354917a83b
MD5 997a1057a826891af83ea4342f412b09
SHA1 02eb0183fd66d25f8613d2a1085ddcd6ab056206
SHA512 7090e4281365373b6067196b336338a2ca28200e506ad2a1b6b08353c965ad59d67eb0ae32b1cda45ff59141728e06a71a9f8d724ba239ba41c851598088afa0
SSDEEP 1536:nNVYJPuuo08aL6P9AD19UdTp7GBfVtUOnJANS9PfO7pbp8FvJXeYZ6:NQ5G6BiVkfUOngGpNJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cagobalc.exe

Path C:\Windows\SysWOW64\Cagobalc.exe
Size 97KB
SHA256 795a5bb12980fa7ac9891f9beca5178d42a2f5000a094a13f858ed04ce8bd991
MD5 e98352518e96580cd9482ef28974c0c6
SHA1 c008e0c44d6fa244f862572b1d61b1112544a6c6
SHA512 62425ab14e877c9a7d5a5f7d59e4748e0b11e484adc4410d75d6fee654166610fd2cc6be3ad8e84203afc145ed5252d3e06a4fce467bdf9a5d79711f62e8c7fd
SSDEEP 1536:NYBNtvZ26ZtfqeJZfqaCzDtBN4pSaKki1bfwP99UZKkvJXeYZ6:NY5wgZqGSaKki1bfM2ZKUJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chmndlge.exe

Path C:\Windows\SysWOW64\Chmndlge.exe
Size 97KB
SHA256 4218d1eb900f7482d790a48e445306ffbdfbca7c159b005d056347ad8bac9065
MD5 ded40de37f11e35685d586b14ff6e672
SHA1 c66d6d9ed432031f5e890ae59ce3a28f1fa3a24f
SHA512 aa4a5c221b551c6ed9a2ffa07da994cc7e0e578793817509a351d835edd14a9df470e860588b853477c9e60259d64cbab86ea4678f1346912054328756bf5d46
SSDEEP 1536:xmCZ4EDZIKt80GmphEW1Wejwrq38plliIV+fDPPN7+u7sfqvJXeYZ6:xrdtffvCliIgDNVsf6JXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cmnpgb32.exe

Path C:\Windows\SysWOW64\Cmnpgb32.exe
Size 97KB
SHA256 27cf9e210a15d4e070982e1dc1ded8beb33ff77cf511fbcf959ee63005f91031
MD5 76f38d34121c9a839059fe23278aba7b
SHA1 3a2f4b0de094891328dd3c4d128d253d98cfc9f0
SHA512 d3f2472c5a7fe230c12347d5fffe7ef22d598664a040910bc3c8ffb943de22bba6d9d150af7782f8a829efec012f96c360b2b530df48b3b9c8781a1b4032ff18
SSDEEP 1536:o3Pl0dLZU+8Bvz3/zVgWiLfeaGdKfEocTY2JxAvJXeYZ6:o3N05n8BvzbPdKfXcTY2JGJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eggmge32.exe

Path C:\Windows\SysWOW64\Eggmge32.exe
Size 97KB
SHA256 bc40fb83983d9aac7d59030c1ba97060705c2e27a1c41eea08c1f6e5b63e2e92
MD5 5cc3fea19510525fc02f5580b68787e4
SHA1 04753a13751f7c5b6988ad1a87d683474939ed59
SHA512 ff1e298acb9e2207c4587274a4f1468a11682651fd9da8f13b465e8cc3567ebeef7d67d59298e9c56bab0014685b9a261605476a621fb8ebb2a9535ac164b3f7
SSDEEP 1536:WsNPzEiN5kG/nN4Z7+p+2DtoFvWqc0nIfllllllllllllllDWcZUZR/6nvJXeYZ6:rlhiutYpcoI/W7ZRyvJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fajnfl32.exe

Path C:\Windows\SysWOW64\Fajnfl32.exe
Size 97KB
SHA256 8ea0828d4166effc125a498ab12c220a4a38bee30a8a9e3ed3d36c75017d1b4c
MD5 3e098532220ce76b019191c2d38b0d86
SHA1 d22a88564532fc31ad287bc7994c3e7ce822b4bc
SHA512 fb4571437c2a5e94da13c4711ae33d3dfc5d6345695ec88d0bb486fa126307c9129fd3d27ac224fd3d572a21952ba6238227be0df61031f258cd30ae37befcbd
SSDEEP 3072:ea6yosTQVYpYCOb56N3+be6ZMBMt6JXeK6:ea6yosTQVYtY6N3+J6EeeX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fkeodaai.exe

Path C:\Windows\SysWOW64\Fkeodaai.exe
Size 97KB
SHA256 141b73958835c96562d6b8c32421638014c1b76011afb2e0590993836385d5d9
MD5 c190372050bdc6693809a96fef458258
SHA1 4610e4f2379e01d5e9316d544cd74018d472adbc
SHA512 e27d65f244d2f4e2b6c48a0e29ef495bb85768f6f8879ac519e95fb1ca0d06549908624e56e0ad7da225d7d28f46ae2b36f1671238c218944d87b9f6394d68a9
SSDEEP 1536:vUELHGRj7DYg3xmXHE5MzoGC3fGnjjvJXeYZ6:vVLarY5XkSZnJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gdgfce32.exe

Path C:\Windows\SysWOW64\Gdgfce32.exe
Size 97KB
SHA256 2b1c8182e6f28d9a6e6d864607a4ee1baf1cca2e10197ecf1c8fd7a082d2f9e7
MD5 a5f4c01776583aedece5781b26213b2c
SHA1 d36667b2fb79a6c1865a87535ac30751d9396470
SHA512 e57b2ad54d5495a0ec5c8833ce147183c5c535e3ec39496ab732d9a6750a12d6a5edacc9f78bd03e7f2be37fe3ac5b3b0b4085702acd7d30ce31c9be03901ab1
SSDEEP 1536:LWb04b5TE9KMejnY1/bOi4HN1X+2lJ22SSgoecR3i4UPEfcWvJXeYZ6:Me9KRjnY1/b54XtlJ22/S4UPEU+JXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gkglja32.exe

Path C:\Windows\SysWOW64\Gkglja32.exe
Size 97KB
SHA256 cb9a8fda35dfbbe96532ae7d07a683ee01715df4bd699ae41cd8ea9919f13ae4
MD5 fe0ce0339fe6ed3523927545d4785e3f
SHA1 6a5b0a311a853e9857c5fe9207473ca8fa79388a
SHA512 0a2b960f7e23ed84ea71d7d99e6877721af2824636eea38515aabb26e47ef15a06d448e2e4d5421a5ae672fb3f8ee381a654724c42fe0ce95b766525e18c79dc
SSDEEP 1536:cMRQ7QNAlfGIHY6BTTsnkW+cO4n0uKPgzaoPAlOvJXeYZ6:bRQEN9UY6B3sk2kGcmJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jbccge32.exe

Path C:\Windows\SysWOW64\Jbccge32.exe
Size 97KB
SHA256 86d1a38ae04c42f51e880ede99a71e0da68446bcbbaa9c878f24c2c0abb09a0d
MD5 996d36289e6215c035084c94ccb65c6f
SHA1 13e57013ff4bcd0bed4c3d4cdd16678908630d9e
SHA512 37250aac549628c4a5d6da225350cc445846d0b96df27c2c510df6d020befa9b2de9852b08fb375c9bbf23dcb8a198b1ae4879730a90519a09a49a554e665989
SSDEEP 1536:YRPbMgukz6j+KqwVMbYiIm58JajtIbcDBKCbr3SFufSvJXeYZ6:Y9tuI7wuYiDh1KVFufyJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jkaqnk32.exe

Path C:\Windows\SysWOW64\Jkaqnk32.exe
Size 97KB
SHA256 e85d1da2b0130f81f278c051acadf4a72df9f27655011c442b3c90d1e1692d26
MD5 96ae048b4f111b3d20af355b1327da10
SHA1 4ecc0e9f66fa36930494b7fd93dddd1f8bbecf2f
SHA512 84f40c70e4476902a152e8b2b6efea458ff94de4a3dff630fc6298601a30401c4e48cdaac2983f4005ce7f6cd7d6f28605e5e1f00564df1105277d75e10f9098
SSDEEP 3072:L62/8aOhX/4aS+OA2QgIHcyrMmxM7JXeK6:L62/8aOhX/4IOVGHcIExeX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Joekag32.exe

Path C:\Windows\SysWOW64\Joekag32.exe
Size 97KB
SHA256 0fd2bef83eb98d0f933dda4b20efb807451e50d18287de7feabc1d077b944034
MD5 ae877558ec3817e5e3b6d4088a75e73b
SHA1 ca3d2e24ca6834e53e1b1ced7ea76a1f462e47c5
SHA512 f911ac6aab735a040431c78d4dde34bca28bd2fb6e2ae0909232f91c386d24f48c549a294108a34bdf97ee1bfc1ed2d70e57a6d05035f0b8361a96ebe048e412
SSDEEP 1536:fZYDH0KflcHs8YkZi5Ykhyaof8PqDB+I/cXAOkCykXNZo9jN2ZSWtvJXeYZ6:fZiHJcM8Ihy7kq1+I/MlXNhZSWFJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mablfnne.exe

Path C:\Windows\SysWOW64\Mablfnne.exe
Size 97KB
SHA256 be3a97428d2e7954ddc11bd96d02aaafc61b7194c043068bcc6c68703404fd92
MD5 af0b36f7a67ad640fe8f751f5459430e
SHA1 90082af1c300dae0b2eb726850e93b9eab9eb33e
SHA512 8e97eeb7db273c938af85cf25053e1f3c56fd00d924dfbbaf45f5646d0db9ca6ff683ab13b0dfb2aa25dafefefc32da52e060f1df9dc76672c8bb3890cc1d913
SSDEEP 1536:TM/+z8i1ZQd2Lea6ReCd1l9P/MPuU8uWH5EKhueKkrsnJTcyvJXeYZ6:YGYi7Dc1kAeKhujkowSJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcpnhfhf.exe

Path C:\Windows\SysWOW64\Mcpnhfhf.exe
Size 97KB
SHA256 3a2ff97c48d62af977eb40f5b499cdb3df8803957584e9076d94066dfe36d8ec
MD5 ce16a085b4581fecc55ed7de00ac5b46
SHA1 e699d345ac70c5d6ffb88772bde0907ef154e6a1
SHA512 61c04395a6194eae237d06eb91ed9da10245a2792b96f64fec877876c1c262b2ae50e9f1b436aa40518aea5079a106d3aa176a8c83fc2507e6f56b5a1ef0e6bb
SSDEEP 1536:pBbHw79FzI3UvNkk0AluB45ty5u5/Wk/krvJXeYZ6:p9ckhRBctyA5t/IJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdmnlj32.exe

Path C:\Windows\SysWOW64\Mdmnlj32.exe
Size 97KB
SHA256 2c8b6a896b06ca016be94a55fb53a6670daafc505a8c11f7b7396918d2a83a00
MD5 ba38fc7a15b8daefe0baa366285b703d
SHA1 fb9f1de5cbc9e0b00219bd5278afef33e5319533
SHA512 ee548e72af672c157d57c0a1d0a48b49f59b90af60df2ab90e6cf8a87a29079005ed841902aae5e1f880cbb90616adb023778789075418654d04a3cd0f9f04a4
SSDEEP 1536:tR4uw8XOOwzxO17YYqhi0SzWi31i3uSjjLGAvJXeYZ6:tR4DYOjO17Y3l3bGYJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Melnob32.exe

Path C:\Windows\SysWOW64\Melnob32.exe
Size 97KB
SHA256 fb75e604e7d86d3cbe79dd188a449f6e1e9e239debc57138f268e86b6579f61c
MD5 d0f2365eb99ab8ce713796f81d5031a0
SHA1 78358312846bcce4944a74cb7ab1fe050330b6b8
SHA512 38da86cce2f00e2f2a60b8e47e90b16f07227a2428fae10af22d36a3255279661aea7e3ef8f98e4feaeb8d7835136ef59f87939728895eb2b7f71066a0fef42b
SSDEEP 1536:NLdji4CJGPvQ0nTn87geA/KfHvXSMjAQBMislUvJXeYZ6:NLdji4CUnnTnAgeAIHqM8QBMXEJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Miifeq32.exe

Path C:\Windows\SysWOW64\Miifeq32.exe
Size 92KB
SHA256 74198f0cce16a631a91da6cb6149ae0a2696aaa8ccf18d0baaeb6bc05ea7f3e3
MD5 e1c7f33999116b748c3e25adf46ef2ba
SHA1 672d41d779861529845b1887a0e093fcc37ec936
SHA512 c7836e1e47d9e2290a65c954d22523d9c6b69861bbd96e0d161b91fee45234b45972921784bfecdc5fc0df7481500886dbbc2e3377f7fd235179c763b2ee3999
SSDEEP 1536:pBbHw79FzI3UvNkk0AluB45ty5u5/WkonkypvJXeE:p9ckhRBctyA5tf2JXeE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mlefklpj.exe

Path C:\Windows\SysWOW64\Mlefklpj.exe
Size 92KB
SHA256 e6d9c54a0bf6bed9c2f4c12efcbb9a744705b83cd41d8440667dfe385c2a2fbf
MD5 763fc57c822fc11d82a533ca06b84f4f
SHA1 ca8dcff57b7c466be94e63148d2808d029da05d8
SHA512 9afa2c9567072c595fc4fdee7ffdab081a08bc35d34c637948cbdce3f1de3e789f3b74d5d6aa484464089426e022f50205d154f112a53933110039e6b5295d82
SSDEEP 1536:yAK30y9jpKM6DU198DjyGu9sBcs7Jfx4cvJXeE:66DkMyVaBcsdJ48JXeE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mlefklpj.exe

Path C:\Windows\SysWOW64\Mlefklpj.exe
Size 97KB
SHA256 64eac37c2fd46b625a937c38f228a08689496c43ee22b746bad6f96c263f7814
MD5 a95cf66f534b5a61d76959548ff79aa9
SHA1 e34caf3c940aee9afa09f154b591fc11377a3044
SHA512 a52dabb4833aa2fb3421c5a0b46becd1eeba4e3de714fa7b1ef9f5e7df8276327197f164359e102b9a611685a66ab386f1d4b97026e90e66ac81e478c1e4ffe2
SSDEEP 1536:yAK30y9jpKM6DU198DjyGu9sBcs7Jfx4cvJXeYZ6:66DkMyVaBcsdJ48JXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nckndeni.exe

Path C:\Windows\SysWOW64\Nckndeni.exe
Size 97KB
SHA256 40f9ac3ea5e375a4be6dee5b3f26274672346b0180515d5e576e8e3c43605481
MD5 cb77837ac5a102a1958526448b8763e0
SHA1 560780793afa427854f61d8344417ad2db663f9d
SHA512 756c869b32cb7bd2bf91c470f124deb545ab1fcc54fdbb56a51e6126ae3d514a891c0afb774414304e1efd55225ae724a875666311db646f7b00209bbe65700f
SSDEEP 1536:/6nPT049RAWgNkIWHSx4oQ0yFRj2ZeET4bRF8/14KvJXeYZ6:aPTRS1NkFHXoQ0DAWN4aJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngbpidjh.exe

Path C:\Windows\SysWOW64\Ngbpidjh.exe
Size 97KB
SHA256 d17d98d4201282e475ac2bd81e2e1f78bee3d9c0e14a9b92d319c1a976c07ed9
MD5 f65deb3a996457a9ddcf6b9af70ea89e
SHA1 220386b20bf15799fb26733c9152637c978f852e
SHA512 502aa3bb1526fd3dcc14d1c3dc8e70bbbb6bca396db5f8df714be32f071b065f0d52ea3dab181e94bb360bd69dfe903ae054ac25933efa59d605eb24904701fe
SSDEEP 1536:zoRCP+q5X7gQH1FwqN/MV3qGv+8M8vJXeYZ6:z3GKX/Fr+ipcJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njnpppkn.exe

Path C:\Windows\SysWOW64\Njnpppkn.exe
Size 97KB
SHA256 8c8c0845913f1668597178c4313c963ef8d0750055373678671fada9b98fbb45
MD5 e38c4adb939ed2099cd9f3bfcc471576
SHA1 cc93af929f0e6164cde2200ce01994399d82c718
SHA512 f22acd6ff1a0a6e5cbf0ced6baad1b1ba51ba1119339391629409311759dbf77d1be5f3d8acda585764fe913d100587292e4b8bef7a5824c3269946d8d54246b
SSDEEP 1536:u3ai1TUx/9M2tWk3TNsueWIu9WJI45bNC+U9NMME6UEvJXeYZ6:u3aMugkZsFu8a+Uj9U0JXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nphhmj32.exe

Path C:\Windows\SysWOW64\Nphhmj32.exe
Size 97KB
SHA256 1957347f2d3987f18a1f38fffaea622f907fafa2db8356909d56aae48995df7f
MD5 07a0cc856b31ca6d78fb067fd6e8ae6d
SHA1 90799bbcca4a72890695b00c68dfa682e3c18e87
SHA512 3b5df1f0a1450749caad0cb25d9aeec1b61c4a69266ef63b7a71df237964792459c5aecf592c8646f146cba5fcc22f596390277ea7bba3ea7a14c11f4a725ee7
SSDEEP 1536:SAAiRx6u3SY7O+qtWsjcW2LPIXB5nP/PPbPP/PP/PP/PP/PP/PPbPPPPPPPPPPPr:SAAmxV3SYBqtWsjcWMIXrIc2JXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqaiecjd.exe

Path C:\Windows\SysWOW64\Nqaiecjd.exe
Size 97KB
SHA256 ca5f33903f5ed2ccc85fc037fce7807c571fd9e1d520c1516ca0315b3684c74a
MD5 5c3403ba1b3217d7534ea5bda7037010
SHA1 5441ecd11284480f57ef2601748f0be9d3e43a9a
SHA512 e7a98a038922fab055f7c92575ed2f4b7366cb5c63c28340c8a5a6ebc250deddb856c558aec908a0528b67c313314d450e2933e9365a82ba7be73aa549c0c6e3
SSDEEP 1536:s7e+TNglIcwybJMLrVvIdy8U5jpTjusGbT9zurxv10gvJXeYZ6:IayEGvmN8jpTjujTNutu4JXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oddmdf32.exe

Path C:\Windows\SysWOW64\Oddmdf32.exe
Size 97KB
SHA256 d0b7a3bbae61a3ac9926da09b5899a8185ef6163a7469e342048998bfda44273
MD5 4ae20914a6eb9f66f4381e9c714b5b58
SHA1 7f08c157daf78481d0f27e8f22c716ed3c956806
SHA512 09877d17b9410a1950a3c8ab5c6b57616b52633e51e5fd979d8dcadf4070eeedf4e96e1cd8e1609a617491c6d31e4d75820d1ade945524d69a747bc0d6609b42
SSDEEP 1536:P30cjstAAZ31SLjCf+hbJvSflb+IrT3hr6R1yl+seVFxtjZO3m2vJXeYZ6:MttH31SPvGxPwRwl+zxtFO2eJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Odocigqg.exe

Path C:\Windows\SysWOW64\Odocigqg.exe
Size 97KB
SHA256 598cc6dca0e27c64e6c1919a0f4de426d0b3c93011c21330f2c2aef30311e181
MD5 d50fa8ad6efd7f636de21dda4a44c1d1
SHA1 fe0484723d4e377a84d87646e546256bde7d6930
SHA512 28d8f401dbe25ed8732fbe2c2624a9bce7d6b7947f5a6b53fbb415b78bc06face4b1e11c3486034cb11e26a818f1349813ce8e1ac40c229d50def9ef916d62e1
SSDEEP 1536:nYNKoAKdXw6Xm6PeiDHUtcjoTNnVZ4XB7PEmQg1d16SlBwdzXSIKRvJXeYZ6:nY3A8XjayoXZ4XBbjrzledGIKBJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Odocigqg.exe

Path C:\Windows\SysWOW64\Odocigqg.exe
Size 97KB
SHA256 1895491977a0c84189d5e2c6e550bdbd9c46217d2e3797265444a3417c9b4c6d
MD5 2606fb3dfd250fe040f70b5cabc7d66d
SHA1 b3286ec9d6c47ebb462f14badd83ed7a159d30db
SHA512 816ddedb75947ebe2458df52dbae250ea31436053e1bfa8e6d95e4e974289e7f87528f58a3b8fc720e08fa76c6a8076031538e4b20ffa903721a4e293a2f273d
SSDEEP 1536:ipUZenA+NISml1liK2TYYuwew/pIytHXlZJnCZskPPGXfnIKRvJXeYZ6:izAxHl1liKyTSKZ+2vnIKBJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ogifjcdp.exe

Path C:\Windows\SysWOW64\Ogifjcdp.exe
Size 97KB
SHA256 efe11812ca8cc24aaa896d8dc376d06574f6b0bda9ed726f1069b47d9427b079
MD5 65db4e67554e351fbb3bdd5ba4dc5df1
SHA1 9a04f80b6bcebb4f43b4e43690c171f05e5fb8e9
SHA512 1504e990dd1c26bff21dd0f5e021e2ee358420c30e09d15d8c4781e6f62a617706024da1bca1db66a36b027372aeecf22ffbe5e863d5ed9ce6148ee20e690f9d
SSDEEP 1536:2lEuyBStbyFnaKqtD9uScUoz4nUlfhCdBVJXz0JavJXeYZ6:g5yBSFyfZzwUn2VJz0JqJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ogpmjb32.exe

Path C:\Windows\SysWOW64\Ogpmjb32.exe
Size 97KB
SHA256 ea2a3c98387d4fed29693066aa5e881bc513a9f1686164e95b9161d63f529f85
MD5 2382d8384877da528bc7dbd808a07583
SHA1 0483a687c05230aa9956f6cd32a7a718c90e7d8b
SHA512 4895a20d739395a4a15996c9c2c57740695893d6c61a21e09577f173b74ab4b091bc654a663d22a99685962ca4301e872c1e21fccb92a24087087db052997a5b
SSDEEP 1536:sUEYFA5QDEJaqBu+HFLbUPigeAQf8e+vJXeYZ6:sAFA5QgQfULS+AQ7WJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ojaelm32.exe

Path C:\Windows\SysWOW64\Ojaelm32.exe
Size 97KB
SHA256 4f15012ef8c3f9c8dd4208a05fb97e4bf535c9fc2f47d2441ebdb2cfc308b92c
MD5 36a042387b06392448d75e92108e9d54
SHA1 c4e7f620b20e45f91dbf252e111177f59b7b1f46
SHA512 f8b82a82cf258b9a3bf72299bfad13ac4739b10912eb0472a8e66696e5837c4dc088d0f7f45d604603c8f6b4eac00398f32f28f3c4ec2ba5f868e32cfda9ddad
SSDEEP 1536:MxvYZTm3WZu5G7bN2v/umP5z4bBJaTVkUemO5ozY1fYOsXvJXeYZ6:8QTSWZCG7bN5mR4ds+QzYNY1fJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ojllan32.exe

Path C:\Windows\SysWOW64\Ojllan32.exe
Size 97KB
SHA256 3c162a9197cc1650900c0c688a899ffdbbee85fa8cf9536fe7512aaca4379601
MD5 c58f018fb7238e4bfe2d81870eea2e6e
SHA1 2917f891fd81385778142267ebd6df299cc6472b
SHA512 39c8a121d2954f873d968457e5bdc958162c9810c5692d6b9c457c710953d6231573dde3ae77a733a6796c3fe7027eef06dc8fbdade0679bed2a666801415068
SSDEEP 1536:q8hea9KfkE4qrCA/nP7mIJRdpgphMevJXeYZ6:q/eE4yCA/P7mI3PgE2JXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Onjegled.exe

Path C:\Windows\SysWOW64\Onjegled.exe
Size 97KB
SHA256 bf3d35ed96ef407e597a5d0fc1bd3f9746fb6daaf13d60d721e44d3c7ac1b777
MD5 2da289ebb5bfa8d7a100ab4f1819fc07
SHA1 c0cf06f3ff40ea86d36babf3493de827379628de
SHA512 bc02192e24c27295df583aca17f0654719079bf8b17c9778a991f6db47f85bff6c22ac5389aff9d852a138e4532d509eff2d790b7e458995fecd6e6e5100c039
SSDEEP 1536:Ijiwevgk++RdZzfl8WO7V8/qpCdMT1NfqMu5svJXeYZ6:IjiVgk+QZjWhe/dMDCtMJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opakbi32.exe

Path C:\Windows\SysWOW64\Opakbi32.exe
Size 97KB
SHA256 be9412cde9d9fb38c2f3db3d42af5101646dba060808fa6fcf6888e8c2e31595
MD5 e5d734e3548b6c0bd66b15bc39645103
SHA1 34a67246483aca4640d6f7a41c9d5ff4091cfb12
SHA512 d0518741b80a539b3c9cc52bf8a3c05b51ea266ef1643dac063abade89f381e6661bdb5bda4ed055398a32ac100e8f47d797121b94ac8c9300e01f90d1acb66c
SSDEEP 1536:nYNKoAKdXw6Xm6PeiDHUtcjoTNnVZ4XB7PEmQg1d16SlBwdzXONEvJXeYZ6:nY3A8XjayoXZ4XBbjrzled6N0JXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pcppfaka.exe

Path C:\Windows\SysWOW64\Pcppfaka.exe
Size 97KB
SHA256 1dfd6ad2e4575a93d6bd3b4cb905db259aa7d925614b8f23f721960084c6bc2b
MD5 a230ab4b41c727938fb208355ca2016e
SHA1 4e3e35ee57e79dacf1956f2eea3db70d132f7fdf
SHA512 642c8ce89bbd1cb2862ce5a6049bc859add1241a881494e1e459a5bf417c7b861cfb44a252fdc93874786dc84dad7946062ada8b8221afdee01fea1bcecc5fe1
SSDEEP 1536:NaZNj0U2B3r7O2NNhG72+i2h+RhOawFJkwSJfaL0cTEvJXeYZ6:Na34LYPiXRIawFJkwS5a90JXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdifoehl.exe

Path C:\Windows\SysWOW64\Pdifoehl.exe
Size 97KB
SHA256 111b62469a7d9ae6d3d0ac20e85b347e04a5f1034a7c19fb8914322095074d20
MD5 d13698f1069bc4d3bbff7e316a839bfc
SHA1 696ac512b1a3de1b3378abbcf42e1e23fad29e4b
SHA512 7ca66ebaab05bd9f1d7055f4760c9d9ba9946de471d0993eaf6100248461c0e09d4c17e38e04e4f21c0eec27b7fcd7e9ae44241bf73582180c0a51c26145872c
SSDEEP 1536:K7+8CqArF41ra8VFh3gqg9ZUzoovwz1/IH0ItzvJXeYZ6:K7+8C5O1raoh3gqOGEovCEtzJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdkcde32.exe

Path C:\Windows\SysWOW64\Pdkcde32.exe
Size 97KB
SHA256 445c23fab8c85f772896ad191365f8f2fc9e91c595686f01042e95b6a4e64410
MD5 8b51b9161217bbdafe7c2c40e6b9e430
SHA1 c6c4710ab323598398e7ff2f56b67c5df596fcee
SHA512 71a2b73e56300db70feffe8f9cca514508e569c5856df3440e7655d13f54a702d91fbb5f751456e1f93dafe013e45bc631e608fc3e2d701e7270d667031e4454
SSDEEP 1536:s608SMXdsjmKlLHIy8FvHPVp3aPlKERnq4pJKQS8AvJXeYZ6:905MXujmKHYFPVpKYq9pCDJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pflplnlg.exe

Path C:\Windows\SysWOW64\Pflplnlg.exe
Size 97KB
SHA256 9757ca1ec5825cbccc54c864e9e9708e1dcee62b7b97ba13b8272e8a7c19f0ab
MD5 2340a644a948283e285ddb4e0085fbb7
SHA1 84c091067e24ac912bf1f7edf62219e5fcebc2e3
SHA512 c163bdb0bc6dce723ba9c584c05857bd03fcf7c164301a228f9af4d011dfc802fa8bd80d4cd38edc0fcebfe0df603a3695f99e3175ef83b4f3cc4d0358c9c273
SSDEEP 1536:dT++5isCgadv37PfKQSINH6aX2RKUXR8hpnRNjS/Y47+C3N7vJXeYZ6:2GaJXKQtHuLXqhpnRVS/71dLJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pgefeajb.exe

Path C:\Windows\SysWOW64\Pgefeajb.exe
Size 97KB
SHA256 5f74858f51f351920fa220e4f142653adc48da4004f456fbdfbb82db55aaf9d0
MD5 868b09228542d701a20369c67688e532
SHA1 38fedc62788161a443d6d1144722ed26471aa538
SHA512 c884f993b0661c2ee874f7ef5b5b1b89c692370a6aaa8f7970a90a3bb41f52e3e18fe545a804437edc315c9b5be5f29593ba4fe72c2bf8aabf0e94d536aa58e6
SSDEEP 1536:BFo38MSXErBeC4ofH5HcEpJna/SGjo+D9pL+DyXCvJXeYZ6:Ho38MSXEk+Z8EpJaXSDyXiJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjeoglgc.exe

Path C:\Windows\SysWOW64\Pjeoglgc.exe
Size 97KB
SHA256 1429ce8453ef54cd37261c7e025a679d40b858f93debe8dc3e611fde9cdad5f5
MD5 45a341223ee969b0fb79cedbc8cbba07
SHA1 195e08f9fa4cc2ec5e8becf742087fc9bce076b4
SHA512 9cbc0abee946ef7cb8a789d9954db9f3bc9038ed91eb1ead32a0595af918a5abb3129f1eb06545fe22d4241a906cf5cc4c32690ade15021d4de4427567c753ed
SSDEEP 3072:UboTTWUCy6c8D+PlyTMyl11lKfa/AzfsaJXeK6:ieTWUD6cPPleMyl11lKfa/Azfs+eX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjjhbl32.exe

Path C:\Windows\SysWOW64\Pjjhbl32.exe
Size 97KB
SHA256 6c327bb1556178d9eb2725ec52294a15cf8a431f3b8c6aabc9120d99fd2b4f8a
MD5 9b1908b9be8307184aa6011de3082d09
SHA1 c03e2e2efe39ad452638d694b3a08a45b6b827e0
SHA512 6d780a651c863929c774ba73f1e986d749f55fc90d90480e355e7984fceb614228540325240f9c77832e659a2fcf99cdb7c4f19dcc9e95491bdbb001b1a52b52
SSDEEP 1536:Z6GAHe+Vb/GjVRZbWy9vcrtd97OI0n8YnZiwLvJXeYZ6:fCh5ejVp9ErtdROI08KZi0JXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmfhig32.exe

Path C:\Windows\SysWOW64\Pmfhig32.exe
Size 97KB
SHA256 d19c1a89881647e3e4ae37751f456c172e04d80e07aeba0e8fc04fc76feb8ad1
MD5 04d4758bb9d7f04a1c68edbdbd5516e8
SHA1 f57d1e762d90088082714ccd08d4478d1b0d6dde
SHA512 bef3d3eb537b71373b50156d24bac2c9e0af2d5e7f7c494db58458cf6649c68700336ce1e7a4f60357775f05f7dfde9c909f4cb9285ad01757ee607965b62c33
SSDEEP 1536:espIXOlfvLYBv+PrlT0fqnrViqF0GxeMYlvJXeYZ6:eSIEfS00fBC0FtJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pnonbk32.exe

Path C:\Windows\SysWOW64\Pnonbk32.exe
Size 97KB
SHA256 de284a38f775ae9f5ae8d77fab0907cede0731069b6d699f01d79522b1b25d65
MD5 46349068c99c33abd1d3770f5d112b69
SHA1 dbd8a966efbb5e8931a392bd351edef0076e4a6f
SHA512 2fbbc9ed550a3fe3ede3cc00f68f2a694a07c1f91c888e96b8809fea371883a02ece53371d92e9045d36bf89bbc67b96279fff0cd01fb51e643244395528919d
SSDEEP 1536:gr1nt0IiWBd8GWXqOFdPSz4kVOCjgnqzavJXeYZ6:A1nWInd8GW6OPaz3tcquJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pqknig32.exe

Path C:\Windows\SysWOW64\Pqknig32.exe
Size 97KB
SHA256 0363f7cfbb1cc3f6640399a100919ca15073f2458c5bc879546c2550cb5d2d2f
MD5 29e12cfe8fed3baef7a296be73122e0f
SHA1 5b59ddb3a5922195fc790472a44f06892038a994
SHA512 c9c04453d960a702387fe32f9259804c138fba497008c212a2dda49c3ee27dabcb2c9fd04b6a9cb8e316befe50568e655f9ebf940f7dd0f6e3c0fbb3834d8c39
SSDEEP 1536:XE8FO3d659DF2Mmvh2/x5KxIvFzXQi+Fqc1WZ3KSqcLvJXeYZ6:U8Qdg9DF2/J2fhXAFqca3GeJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qgqeappe.exe

Path C:\Windows\SysWOW64\Qgqeappe.exe
Size 97KB
SHA256 3698fdcbeebce4885769904b3112dffb44d72c0bfca78ec5a910ae91a5b28471
MD5 fa93a8008a0a9e77dc42116a16478776
SHA1 759092b8c5b87406a74f8ba0cbdd53aaf6ddf78e
SHA512 df64fa68636a6e309e3ebe83ce443b5c640e2abb4e4f143f02cffbe5e508ba991739bc03a8fb224dd4c2c8ed1559b025f945a3d308e8b3b06646ca0d1b003926
SSDEEP 1536:kYVScU0COJ/un1XAqtHzRFMyvvD5azCWMaGl6vTsgg44vJXeYZ6:BSpO/uJnNXPaOoAGTsggxJXeK6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-192-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/228-323-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/456-56-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/632-48-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/660-176-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/720-40-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/868-152-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/880-127-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1092-168-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1208-120-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1468-95-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1548-103-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1616-262-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1720-208-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1792-184-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1844-353-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1884-333-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2156-136-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2284-341-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2316-248-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2368-24-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2464-317-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2504-64-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2540-79-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2652-359-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2704-112-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2992-87-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3144-292-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3240-268-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3288-371-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3332-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3340-284-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3348-286-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3360-365-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3432-352-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3496-299-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3668-274-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3692-240-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3768-143-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3824-16-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3988-311-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4092-294-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4108-216-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4176-335-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4256-377-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4332-305-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4360-224-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4428-160-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4468-204-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4536-232-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4708-7-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4824-32-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4840-383-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5004-389-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5016-71-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5104-256-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5132-395-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5184-401-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5228-407-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5268-413-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5308-419-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5348-425-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5388-431-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5428-437-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads