d0694af6981a8146489c905027771567f1e811ad4e113f11a2f15ea31d9ed445

Analysis

max time kernel
102s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0694af6981a8146489c905027771567f1e811ad4e113f11a2f15ea31d9ed445.exe
Size

51KB
MD5

0c74e95a670c3ea7d0dbbb209329f880
SHA1

112a0f1d8791a7f8e624bab0b20087e80419aa63
SHA256

d0694af6981a8146489c905027771567f1e811ad4e113f11a2f15ea31d9ed445
SHA512

7005794182db6d1569e46ef99dda9bb2a6ed79a1622110954221068f8808951993f680d765ab49949e92699feb1e0a3960f114f76f393fe32e94a43beb0f2abb
SSDEEP

768:VhcdmIii2YFh0T3ORqon1ip6uP+b2K5oOmnxM7AHUzz/1H5:VhY28q3ORqvguE20oOm8MUzB

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gefldp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijnqgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnpmaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flqimk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pllpfhhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcmnpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iefioj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Giokoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lohpcq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ieoagflg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iblfnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhpoelii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eckonn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aepmpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcepkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdjagjco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Begcad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnfpjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbacqape.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhdlij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnenlpki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enajemmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibagcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgebmbmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djnaji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found

Executes dropped EXE 64 IoCs

pid	Process
800	Dajnff32.exe
4000	Dlobco32.exe
1180	Dalkkegj.exe
1876	Dlaoingp.exe
4496	Diepbbfi.exe
4104	Eihlhb32.exe
3692	Enedpi32.exe
3212	Eeommcjk.exe
1352	Engaei32.exe
3804	Eeajbc32.exe
3264	Eninkhni.exe
4084	Eecfhb32.exe
2128	Fhiidm32.exe
1848	Focaagfn.exe
432	Fiheopfd.exe
4708	Foenggdk.exe
4988	Fikbdpda.exe
4288	Fogjlf32.exe
3436	Fhpoelii.exe
4772	Gojgbf32.exe
2036	Giokoo32.exe
3348	Gkqhgg32.exe
4836	Gefldp32.exe
3712	Gkcdlg32.exe
3720	Gammiakd.exe
5040	Glbafjkj.exe
2212	Goambe32.exe
880	Ghiakkqo.exe
872	Gboficpd.exe
1756	Ghlnajol.exe
4460	Hliggieb.exe
3452	Himgqmcl.exe
2244	Hipdfm32.exe
3420	Hchiobhj.exe
1172	Hamepo32.exe
4816	Ikfjid32.exe
1412	Icmbja32.exe
4484	Ijgjglla.exe
4996	Ikhgnd32.exe
4080	Iaboknil.exe
2836	Ijiglk32.exe
4720	Iofpdb32.exe
1852	Ijkdbk32.exe
4544	Ikmpicmj.exe
4532	Iaghfm32.exe
1244	Ijnqgk32.exe
4608	Kbngnjql.exe
1372	Kihpjd32.exe
2884	Kobhgnof.exe
2616	Kbqdcjoj.exe
3976	Lijlpdff.exe
2896	Lodemn32.exe
5092	Ljjijf32.exe
1560	Lmhefb32.exe
4752	Lpgabn32.exe
3176	Ljlepfkg.exe
4156	Lknbgo32.exe
1860	Lcdjhl32.exe
4452	Lfcfdg32.exe
4004	Lcggnl32.exe
3516	Lciccknb.exe
1588	Mclpikko.exe
4864	Mpbanlac.exe
1396	Mjhekdai.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lelgbkio.dll	Maaepd32.exe
File opened for modification	C:\Windows\SysWOW64\Iohjlmeg.exe	Process not Found
File created	C:\Windows\SysWOW64\Jfbkpd32.exe	Process not Found
File created	C:\Windows\SysWOW64\Pgihfj32.exe	Process not Found
File created	C:\Windows\SysWOW64\Lcafnn32.dll	Process not Found
File created	C:\Windows\SysWOW64\Ckjinf32.dll	Process not Found
File created	C:\Windows\SysWOW64\Mlcdqdie.dll	Process not Found
File created	C:\Windows\SysWOW64\Gnhdkl32.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\Jqglkmlj.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\Ncabfkqo.exe	Process not Found
File created	C:\Windows\SysWOW64\Mncilb32.dll	Process not Found
File created	C:\Windows\SysWOW64\Kofljo32.dll	Process not Found
File created	C:\Windows\SysWOW64\Foenggdk.exe	Fiheopfd.exe
File created	C:\Windows\SysWOW64\Iafalg32.exe	Ikliomjo.exe
File created	C:\Windows\SysWOW64\Chbnia32.exe	Cecbmf32.exe
File created	C:\Windows\SysWOW64\Inmbqhgp.exe	Illfip32.exe
File created	C:\Windows\SysWOW64\Mkomif32.dll	Chnlihnl.exe
File opened for modification	C:\Windows\SysWOW64\Gigheh32.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\Fflaff32.exe	Fcnejk32.exe
File created	C:\Windows\SysWOW64\Hbcaee32.dll	Cdainc32.exe
File created	C:\Windows\SysWOW64\Gikgni32.dll	Process not Found
File opened for modification	C:\Windows\SysWOW64\Abqjjd32.exe	Apbnnh32.exe
File created	C:\Windows\SysWOW64\Fqkfmgbp.exe	Fnmjakcl.exe
File created	C:\Windows\SysWOW64\Gifhkeje.dll	Process not Found
File created	C:\Windows\SysWOW64\Mfpqjjgd.dll	Process not Found
File opened for modification	C:\Windows\SysWOW64\Cqbakq32.exe	Cjhinfdl.exe
File opened for modification	C:\Windows\SysWOW64\Djjecf32.exe	Cgligk32.exe
File created	C:\Windows\SysWOW64\Kgdkgc32.dll	Process not Found
File created	C:\Windows\SysWOW64\Embddb32.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\Pjkmomfn.exe	Process not Found
File created	C:\Windows\SysWOW64\Pjcmhh32.dll	Process not Found
File created	C:\Windows\SysWOW64\Efcagd32.dll	Process not Found
File opened for modification	C:\Windows\SysWOW64\Kpfgnk32.exe	Knhkbpif.exe
File created	C:\Windows\SysWOW64\Cgkghl32.dll	Gmaioo32.exe
File created	C:\Windows\SysWOW64\Ceaehfjj.exe	Cbcilkjg.exe
File created	C:\Windows\SysWOW64\Nojjcj32.exe	Process not Found
File created	C:\Windows\SysWOW64\Dpdaepai.exe	Process not Found
File created	C:\Windows\SysWOW64\Lhclbphg.dll	Fckajehi.exe
File created	C:\Windows\SysWOW64\Ncmhko32.exe	Process not Found
File created	C:\Windows\SysWOW64\Bmgjnl32.dll	Process not Found
File created	C:\Windows\SysWOW64\Pjaleemj.exe	Process not Found
File created	C:\Windows\SysWOW64\Dkloci32.exe	Dcegbk32.exe
File created	C:\Windows\SysWOW64\Gmhfhp32.exe	Gjjjle32.exe
File opened for modification	C:\Windows\SysWOW64\Mglack32.exe	Maohkd32.exe
File created	C:\Windows\SysWOW64\Fangje32.dll	Jpdjhljm.exe
File created	C:\Windows\SysWOW64\Pjpobg32.exe	Process not Found
File created	C:\Windows\SysWOW64\Qcdbfk32.exe	Process not Found
File created	C:\Windows\SysWOW64\Milidebi.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\Aajohjon.exe	Process not Found
File created	C:\Windows\SysWOW64\Jdockf32.dll	Process not Found
File created	C:\Windows\SysWOW64\Nodkhj32.dll	Process not Found
File opened for modification	C:\Windows\SysWOW64\Nelfeo32.exe	Process not Found
File created	C:\Windows\SysWOW64\Dnbakghm.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\Mffjcopi.exe	Process not Found
File created	C:\Windows\SysWOW64\Ghiakkqo.exe	Goambe32.exe
File opened for modification	C:\Windows\SysWOW64\Lndahd32.exe	Kkfeli32.exe
File created	C:\Windows\SysWOW64\Ofnpim32.dll	Clqnjf32.exe
File opened for modification	C:\Windows\SysWOW64\Cjomap32.exe	Process not Found
File created	C:\Windows\SysWOW64\Ilchfdgp.dll	Process not Found
File created	C:\Windows\SysWOW64\Pipfna32.dll	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Opogbbig.exe	Process not Found
File created	C:\Windows\SysWOW64\Jehdpl32.dll	Jdnqna32.exe
File created	C:\Windows\SysWOW64\Npnofg32.dll	Bchgei32.exe
File created	C:\Windows\SysWOW64\Ebnoikqb.exe	Eckonn32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
15196	15056	Process not Found	2317

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkqefcdk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkhdnppp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbfqedah.dll"	Obdbgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndkahnhh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Faeaoe32.dll"	Cknbbkdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghcemk32.dll"	Djmbif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkmdcfof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qnnanphk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmpijp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbfadafe.dll"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkcdlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bijdaf32.dll"	Npcjei32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ieoagflg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Heodcg32.dll"	Agafph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efcejndl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkieqb32.dll"	Cobnfgaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qnlkcfni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpamgn32.dll"	Okhfjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikaqhj32.dll"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdmpga32.dll"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nflkgmgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klqhkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnjbhfep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omfcdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjkhnd32.dll"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbdjiqhc.dll"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlhmjl32.dll"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnphha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Abqjjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iiffen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfdaia32.dll"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkffog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnlhcppa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Commqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Peeafpaf.dll"	Gmhfhp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbbfka32.dll"	Hdhgangq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iedoeq32.dll"	Gfgjgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifllil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilidbbgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmkfhc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dahkpm32.dll"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cidncj32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 800	636	d0694af6981a8146489c905027771567f1e811ad4e113f11a2f15ea31d9ed445.exe	84
PID 636 wrote to memory of 800	636	d0694af6981a8146489c905027771567f1e811ad4e113f11a2f15ea31d9ed445.exe	84
PID 636 wrote to memory of 800	636	d0694af6981a8146489c905027771567f1e811ad4e113f11a2f15ea31d9ed445.exe	84
PID 800 wrote to memory of 4000	800	Dajnff32.exe	85
PID 800 wrote to memory of 4000	800	Dajnff32.exe	85
PID 800 wrote to memory of 4000	800	Dajnff32.exe	85
PID 4000 wrote to memory of 1180	4000	Dlobco32.exe	86
PID 4000 wrote to memory of 1180	4000	Dlobco32.exe	86
PID 4000 wrote to memory of 1180	4000	Dlobco32.exe	86
PID 1180 wrote to memory of 1876	1180	Dalkkegj.exe	87
PID 1180 wrote to memory of 1876	1180	Dalkkegj.exe	87
PID 1180 wrote to memory of 1876	1180	Dalkkegj.exe	87
PID 1876 wrote to memory of 4496	1876	Dlaoingp.exe	88
PID 1876 wrote to memory of 4496	1876	Dlaoingp.exe	88
PID 1876 wrote to memory of 4496	1876	Dlaoingp.exe	88
PID 4496 wrote to memory of 4104	4496	Diepbbfi.exe	89
PID 4496 wrote to memory of 4104	4496	Diepbbfi.exe	89
PID 4496 wrote to memory of 4104	4496	Diepbbfi.exe	89
PID 4104 wrote to memory of 3692	4104	Eihlhb32.exe	90
PID 4104 wrote to memory of 3692	4104	Eihlhb32.exe	90
PID 4104 wrote to memory of 3692	4104	Eihlhb32.exe	90
PID 3692 wrote to memory of 3212	3692	Enedpi32.exe	91
PID 3692 wrote to memory of 3212	3692	Enedpi32.exe	91
PID 3692 wrote to memory of 3212	3692	Enedpi32.exe	91
PID 3212 wrote to memory of 1352	3212	Eeommcjk.exe	92
PID 3212 wrote to memory of 1352	3212	Eeommcjk.exe	92
PID 3212 wrote to memory of 1352	3212	Eeommcjk.exe	92
PID 1352 wrote to memory of 3804	1352	Engaei32.exe	93
PID 1352 wrote to memory of 3804	1352	Engaei32.exe	93
PID 1352 wrote to memory of 3804	1352	Engaei32.exe	93
PID 3804 wrote to memory of 3264	3804	Eeajbc32.exe	94
PID 3804 wrote to memory of 3264	3804	Eeajbc32.exe	94
PID 3804 wrote to memory of 3264	3804	Eeajbc32.exe	94
PID 3264 wrote to memory of 4084	3264	Eninkhni.exe	95
PID 3264 wrote to memory of 4084	3264	Eninkhni.exe	95
PID 3264 wrote to memory of 4084	3264	Eninkhni.exe	95
PID 4084 wrote to memory of 2128	4084	Eecfhb32.exe	96
PID 4084 wrote to memory of 2128	4084	Eecfhb32.exe	96
PID 4084 wrote to memory of 2128	4084	Eecfhb32.exe	96
PID 2128 wrote to memory of 1848	2128	Fhiidm32.exe	97
PID 2128 wrote to memory of 1848	2128	Fhiidm32.exe	97
PID 2128 wrote to memory of 1848	2128	Fhiidm32.exe	97
PID 1848 wrote to memory of 432	1848	Focaagfn.exe	98
PID 1848 wrote to memory of 432	1848	Focaagfn.exe	98
PID 1848 wrote to memory of 432	1848	Focaagfn.exe	98
PID 432 wrote to memory of 4708	432	Fiheopfd.exe	99
PID 432 wrote to memory of 4708	432	Fiheopfd.exe	99
PID 432 wrote to memory of 4708	432	Fiheopfd.exe	99
PID 4708 wrote to memory of 4988	4708	Foenggdk.exe	100
PID 4708 wrote to memory of 4988	4708	Foenggdk.exe	100
PID 4708 wrote to memory of 4988	4708	Foenggdk.exe	100
PID 4988 wrote to memory of 4288	4988	Fikbdpda.exe	101
PID 4988 wrote to memory of 4288	4988	Fikbdpda.exe	101
PID 4988 wrote to memory of 4288	4988	Fikbdpda.exe	101
PID 4288 wrote to memory of 3436	4288	Fogjlf32.exe	102
PID 4288 wrote to memory of 3436	4288	Fogjlf32.exe	102
PID 4288 wrote to memory of 3436	4288	Fogjlf32.exe	102
PID 3436 wrote to memory of 4772	3436	Fhpoelii.exe	103
PID 3436 wrote to memory of 4772	3436	Fhpoelii.exe	103
PID 3436 wrote to memory of 4772	3436	Fhpoelii.exe	103
PID 4772 wrote to memory of 2036	4772	Gojgbf32.exe	104
PID 4772 wrote to memory of 2036	4772	Gojgbf32.exe	104
PID 4772 wrote to memory of 2036	4772	Gojgbf32.exe	104
PID 2036 wrote to memory of 3348	2036	Giokoo32.exe	105

C:\Users\Admin\AppData\Local\Temp\d0694af6981a8146489c905027771567f1e811ad4e113f11a2f15ea31d9ed445.exe
"C:\Users\Admin\AppData\Local\Temp\d0694af6981a8146489c905027771567f1e811ad4e113f11a2f15ea31d9ed445.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\SysWOW64\Dajnff32.exe
  C:\Windows\system32\Dajnff32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Windows\SysWOW64\Dlobco32.exe
    C:\Windows\system32\Dlobco32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\Windows\SysWOW64\Dalkkegj.exe
      C:\Windows\system32\Dalkkegj.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1180
    - - C:\Windows\SysWOW64\Dlaoingp.exe
        
        C:\Windows\system32\Dlaoingp.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1876
      - C:\Windows\SysWOW64\Diepbbfi.exe
        
        C:\Windows\system32\Diepbbfi.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\SysWOW64\Eihlhb32.exe
        
        C:\Windows\system32\Eihlhb32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\SysWOW64\Enedpi32.exe
        
        C:\Windows\system32\Enedpi32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\SysWOW64\Eeommcjk.exe
        
        C:\Windows\system32\Eeommcjk.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Windows\SysWOW64\Engaei32.exe
        
        C:\Windows\system32\Engaei32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Windows\SysWOW64\Eeajbc32.exe
        
        C:\Windows\system32\Eeajbc32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3804
        
        C:\Windows\SysWOW64\Eninkhni.exe
        
        C:\Windows\system32\Eninkhni.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\SysWOW64\Eecfhb32.exe
        
        C:\Windows\system32\Eecfhb32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\SysWOW64\Fhiidm32.exe
        
        C:\Windows\system32\Fhiidm32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\SysWOW64\Focaagfn.exe
        
        C:\Windows\system32\Focaagfn.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1848
        
        C:\Windows\SysWOW64\Fiheopfd.exe
        
        C:\Windows\system32\Fiheopfd.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:432
        
        C:\Windows\SysWOW64\Foenggdk.exe
        
        C:\Windows\system32\Foenggdk.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4708
        
        C:\Windows\SysWOW64\Fikbdpda.exe
        
        C:\Windows\system32\Fikbdpda.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\SysWOW64\Fogjlf32.exe
        
        C:\Windows\system32\Fogjlf32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4288
        
        C:\Windows\SysWOW64\Fhpoelii.exe
        
        C:\Windows\system32\Fhpoelii.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3436
        
        C:\Windows\SysWOW64\Gojgbf32.exe
        
        C:\Windows\system32\Gojgbf32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Giokoo32.exe
        
        C:\Windows\system32\Giokoo32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\Gkqhgg32.exe
        
        C:\Windows\system32\Gkqhgg32.exe
        23⤵
        Executes dropped EXE
        
        PID:3348
        
        C:\Windows\SysWOW64\Gefldp32.exe
        
        C:\Windows\system32\Gefldp32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4836
        
        C:\Windows\SysWOW64\Gkcdlg32.exe
        
        C:\Windows\system32\Gkcdlg32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3712
        
        C:\Windows\SysWOW64\Gammiakd.exe
        
        C:\Windows\system32\Gammiakd.exe
        26⤵
        Executes dropped EXE
        
        PID:3720
        
        C:\Windows\SysWOW64\Glbafjkj.exe
        
        C:\Windows\system32\Glbafjkj.exe
        27⤵
        Executes dropped EXE
        
        PID:5040
        
        C:\Windows\SysWOW64\Goambe32.exe
        
        C:\Windows\system32\Goambe32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2212
        
        C:\Windows\SysWOW64\Ghiakkqo.exe
        
        C:\Windows\system32\Ghiakkqo.exe
        29⤵
        Executes dropped EXE
        
        PID:880
        
        C:\Windows\SysWOW64\Gboficpd.exe
        
        C:\Windows\system32\Gboficpd.exe
        30⤵
        Executes dropped EXE
        
        PID:872
        
        C:\Windows\SysWOW64\Ghlnajol.exe
        
        C:\Windows\system32\Ghlnajol.exe
        31⤵
        Executes dropped EXE
        
        PID:1756
        
        C:\Windows\SysWOW64\Hliggieb.exe
        
        C:\Windows\system32\Hliggieb.exe
        32⤵
        Executes dropped EXE
        
        PID:4460
        
        C:\Windows\SysWOW64\Himgqmcl.exe
        
        C:\Windows\system32\Himgqmcl.exe
        33⤵
        Executes dropped EXE
        
        PID:3452

C:\Windows\SysWOW64\Hipdfm32.exe
C:\Windows\system32\Hipdfm32.exe
1⤵
- Executes dropped EXE
PID:2244
- C:\Windows\SysWOW64\Hchiobhj.exe
  C:\Windows\system32\Hchiobhj.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- - C:\Windows\SysWOW64\Hamepo32.exe
    C:\Windows\system32\Hamepo32.exe
    3⤵
    - Executes dropped EXE
    PID:1172
  - - C:\Windows\SysWOW64\Ikfjid32.exe
      C:\Windows\system32\Ikfjid32.exe
      4⤵
      Executes dropped EXE
      PID:4816
    - - C:\Windows\SysWOW64\Icmbja32.exe
        
        C:\Windows\system32\Icmbja32.exe
        5⤵
        Executes dropped EXE
        
        PID:1412
      - C:\Windows\SysWOW64\Ijgjglla.exe
        
        C:\Windows\system32\Ijgjglla.exe
        6⤵
        Executes dropped EXE
        
        PID:4484
        
        C:\Windows\SysWOW64\Ikhgnd32.exe
        
        C:\Windows\system32\Ikhgnd32.exe
        7⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Iaboknil.exe
        
        C:\Windows\system32\Iaboknil.exe
        8⤵
        Executes dropped EXE
        
        PID:4080
        
        C:\Windows\SysWOW64\Ijiglk32.exe
        
        C:\Windows\system32\Ijiglk32.exe
        9⤵
        Executes dropped EXE
        
        PID:2836
        
        C:\Windows\SysWOW64\Iofpdb32.exe
        
        C:\Windows\system32\Iofpdb32.exe
        10⤵
        Executes dropped EXE
        
        PID:4720
        
        C:\Windows\SysWOW64\Ijkdbk32.exe
        
        C:\Windows\system32\Ijkdbk32.exe
        11⤵
        Executes dropped EXE
        
        PID:1852
        
        C:\Windows\SysWOW64\Ikmpicmj.exe
        
        C:\Windows\system32\Ikmpicmj.exe
        12⤵
        Executes dropped EXE
        
        PID:4544
        
        C:\Windows\SysWOW64\Iaghfm32.exe
        
        C:\Windows\system32\Iaghfm32.exe
        13⤵
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Ijnqgk32.exe
        
        C:\Windows\system32\Ijnqgk32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1244
        
        C:\Windows\SysWOW64\Kbngnjql.exe
        
        C:\Windows\system32\Kbngnjql.exe
        15⤵
        Executes dropped EXE
        
        PID:4608
        
        C:\Windows\SysWOW64\Kihpjd32.exe
        
        C:\Windows\system32\Kihpjd32.exe
        16⤵
        Executes dropped EXE
        
        PID:1372
        
        C:\Windows\SysWOW64\Kobhgnof.exe
        
        C:\Windows\system32\Kobhgnof.exe
        17⤵
        Executes dropped EXE
        
        PID:2884
        
        C:\Windows\SysWOW64\Kbqdcjoj.exe
        
        C:\Windows\system32\Kbqdcjoj.exe
        18⤵
        Executes dropped EXE
        
        PID:2616
        
        C:\Windows\SysWOW64\Lijlpdff.exe
        
        C:\Windows\system32\Lijlpdff.exe
        19⤵
        Executes dropped EXE
        
        PID:3976
        
        C:\Windows\SysWOW64\Lodemn32.exe
        
        C:\Windows\system32\Lodemn32.exe
        20⤵
        Executes dropped EXE
        
        PID:2896
        
        C:\Windows\SysWOW64\Ljjijf32.exe
        
        C:\Windows\system32\Ljjijf32.exe
        21⤵
        Executes dropped EXE
        
        PID:5092
        
        C:\Windows\SysWOW64\Lmhefb32.exe
        
        C:\Windows\system32\Lmhefb32.exe
        22⤵
        Executes dropped EXE
        
        PID:1560
        
        C:\Windows\SysWOW64\Lpgabn32.exe
        
        C:\Windows\system32\Lpgabn32.exe
        23⤵
        Executes dropped EXE
        
        PID:4752
        
        C:\Windows\SysWOW64\Ljlepfkg.exe
        
        C:\Windows\system32\Ljlepfkg.exe
        24⤵
        Executes dropped EXE
        
        PID:3176
        
        C:\Windows\SysWOW64\Lknbgo32.exe
        
        C:\Windows\system32\Lknbgo32.exe
        25⤵
        Executes dropped EXE
        
        PID:4156
        
        C:\Windows\SysWOW64\Lcdjhl32.exe
        
        C:\Windows\system32\Lcdjhl32.exe
        26⤵
        Executes dropped EXE
        
        PID:1860
        
        C:\Windows\SysWOW64\Lfcfdg32.exe
        
        C:\Windows\system32\Lfcfdg32.exe
        27⤵
        Executes dropped EXE
        
        PID:4452
        
        C:\Windows\SysWOW64\Lcggnl32.exe
        
        C:\Windows\system32\Lcggnl32.exe
        28⤵
        Executes dropped EXE
        
        PID:4004
        
        C:\Windows\SysWOW64\Lciccknb.exe
        
        C:\Windows\system32\Lciccknb.exe
        29⤵
        Executes dropped EXE
        
        PID:3516
        
        C:\Windows\SysWOW64\Mclpikko.exe
        
        C:\Windows\system32\Mclpikko.exe
        30⤵
        Executes dropped EXE
        
        PID:1588
        
        C:\Windows\SysWOW64\Mpbanlac.exe
        
        C:\Windows\system32\Mpbanlac.exe
        31⤵
        Executes dropped EXE
        
        PID:4864
        
        C:\Windows\SysWOW64\Mjhekdai.exe
        
        C:\Windows\system32\Mjhekdai.exe
        32⤵
        Executes dropped EXE
        
        PID:1396
        
        C:\Windows\SysWOW64\Mpencloq.exe
        
        C:\Windows\system32\Mpencloq.exe
        33⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Nifebp32.exe
        
        C:\Windows\system32\Nifebp32.exe
        34⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\Ndliph32.exe
        
        C:\Windows\system32\Ndliph32.exe
        35⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Npcjei32.exe
        
        C:\Windows\system32\Npcjei32.exe
        36⤵
        Modifies registry class
        
        PID:5024
        
        C:\Windows\SysWOW64\Nfmbacjn.exe
        
        C:\Windows\system32\Nfmbacjn.exe
        37⤵
        
        PID:312
        
        C:\Windows\SysWOW64\Niknnoia.exe
        
        C:\Windows\system32\Niknnoia.exe
        38⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Nljkjjhe.exe
        
        C:\Windows\system32\Nljkjjhe.exe
        39⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\Ofoogc32.exe
        
        C:\Windows\system32\Ofoogc32.exe
        40⤵
        
        PID:3832

C:\Windows\SysWOW64\Omigdmph.exe
C:\Windows\system32\Omigdmph.exe
1⤵
PID:3312
- C:\Windows\SysWOW64\Odcoqg32.exe
  C:\Windows\system32\Odcoqg32.exe
  2⤵
  PID:3900
- - C:\Windows\SysWOW64\Ojmgmaoa.exe
    C:\Windows\system32\Ojmgmaoa.exe
    3⤵
    PID:2564
  - - C:\Windows\SysWOW64\Olndej32.exe
      C:\Windows\system32\Olndej32.exe
      4⤵
      PID:1728
    - - C:\Windows\SysWOW64\Ofdhbb32.exe
        
        C:\Windows\system32\Ofdhbb32.exe
        5⤵
        
        PID:1060
      - C:\Windows\SysWOW64\Oibdnnci.exe
        
        C:\Windows\system32\Oibdnnci.exe
        6⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\Oplmkh32.exe
        
        C:\Windows\system32\Oplmkh32.exe
        7⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Obkigc32.exe
        
        C:\Windows\system32\Obkigc32.exe
        8⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\Oidadnaf.exe
        
        C:\Windows\system32\Oidadnaf.exe
        9⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\Olcmpiqj.exe
        
        C:\Windows\system32\Olcmpiqj.exe
        10⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Obmfmc32.exe
        
        C:\Windows\system32\Obmfmc32.exe
        11⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Okdnnq32.exe
        
        C:\Windows\system32\Okdnnq32.exe
        12⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\Ombjjlhm.exe
        
        C:\Windows\system32\Ombjjlhm.exe
        13⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Pdmbgf32.exe
        
        C:\Windows\system32\Pdmbgf32.exe
        14⤵
        
        PID:964
        
        C:\Windows\SysWOW64\Pgknca32.exe
        
        C:\Windows\system32\Pgknca32.exe
        15⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Piikom32.exe
        
        C:\Windows\system32\Piikom32.exe
        16⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\Ppcclgen.exe
        
        C:\Windows\system32\Ppcclgen.exe
        17⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Pgmkha32.exe
        
        C:\Windows\system32\Pgmkha32.exe
        18⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\Pilgdm32.exe
        
        C:\Windows\system32\Pilgdm32.exe
        19⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Ppepag32.exe
        
        C:\Windows\system32\Ppepag32.exe
        20⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\Pkkdop32.exe
        
        C:\Windows\system32\Pkkdop32.exe
        21⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\Pllpfhhp.exe
        
        C:\Windows\system32\Pllpfhhp.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3756
        
        C:\Windows\SysWOW64\Pdchgeib.exe
        
        C:\Windows\system32\Pdchgeib.exe
        23⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\Pknqdo32.exe
        
        C:\Windows\system32\Pknqdo32.exe
        24⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\Pciehanj.exe
        
        C:\Windows\system32\Pciehanj.exe
        25⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\Pibmel32.exe
        
        C:\Windows\system32\Pibmel32.exe
        26⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\Plajag32.exe
        
        C:\Windows\system32\Plajag32.exe
        27⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\Qdhabd32.exe
        
        C:\Windows\system32\Qdhabd32.exe
        28⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Qkbjooli.exe
        
        C:\Windows\system32\Qkbjooli.exe
        29⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\Qmqfkjkm.exe
        
        C:\Windows\system32\Qmqfkjkm.exe
        30⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\Qpobgekq.exe
        
        C:\Windows\system32\Qpobgekq.exe
        31⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\Qcmoca32.exe
        
        C:\Windows\system32\Qcmoca32.exe
        32⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\Qkdgen32.exe
        
        C:\Windows\system32\Qkdgen32.exe
        33⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Qiggpkaa.exe
        
        C:\Windows\system32\Qiggpkaa.exe
        34⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\Admkndag.exe
        
        C:\Windows\system32\Admkndag.exe
        35⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\Agkgjopk.exe
        
        C:\Windows\system32\Agkgjopk.exe
        36⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\Alhpbfnb.exe
        
        C:\Windows\system32\Alhpbfnb.exe
        37⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Adohccod.exe
        
        C:\Windows\system32\Adohccod.exe
        38⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\Akippnfa.exe
        
        C:\Windows\system32\Akippnfa.exe
        39⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\Anhlliee.exe
        
        C:\Windows\system32\Anhlliee.exe
        40⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Apfhhddi.exe
        
        C:\Windows\system32\Apfhhddi.exe
        41⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Agpqeo32.exe
        
        C:\Windows\system32\Agpqeo32.exe
        42⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Anjiaicb.exe
        
        C:\Windows\system32\Anjiaicb.exe
        43⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Acgajpaj.exe
        
        C:\Windows\system32\Acgajpaj.exe
        44⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Ajqjfjif.exe
        
        C:\Windows\system32\Ajqjfjif.exe
        45⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Apkbcd32.exe
        
        C:\Windows\system32\Apkbcd32.exe
        46⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Akpfqm32.exe
        
        C:\Windows\system32\Akpfqm32.exe
        47⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Bnobmh32.exe
        
        C:\Windows\system32\Bnobmh32.exe
        48⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Bdikibgj.exe
        
        C:\Windows\system32\Bdikibgj.exe
        49⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Bkbcflng.exe
        
        C:\Windows\system32\Bkbcflng.exe
        50⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Bldond32.exe
        
        C:\Windows\system32\Bldond32.exe
        51⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Bcngjoka.exe
        
        C:\Windows\system32\Bcngjoka.exe
        52⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Bjhpgi32.exe
        
        C:\Windows\system32\Bjhpgi32.exe
        53⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Bqahdcjk.exe
        
        C:\Windows\system32\Bqahdcjk.exe
        54⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Bglpqm32.exe
        
        C:\Windows\system32\Bglpqm32.exe
        55⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Bjjmmh32.exe
        
        C:\Windows\system32\Bjjmmh32.exe
        56⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Bqdeib32.exe
        
        C:\Windows\system32\Bqdeib32.exe
        57⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Bgnmfmpe.exe
        
        C:\Windows\system32\Bgnmfmpe.exe
        58⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Bqfaob32.exe
        
        C:\Windows\system32\Bqfaob32.exe
        59⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Bcenkn32.exe
        
        C:\Windows\system32\Bcenkn32.exe
        60⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Bklflk32.exe
        
        C:\Windows\system32\Bklflk32.exe
        61⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Cnjbhfep.exe
        
        C:\Windows\system32\Cnjbhfep.exe
        62⤵
        Modifies registry class
        
        PID:5536
        
        C:\Windows\SysWOW64\Cqindbdc.exe
        
        C:\Windows\system32\Cqindbdc.exe
        63⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Cddjeq32.exe
        
        C:\Windows\system32\Cddjeq32.exe
        64⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Cknbbkdi.exe
        
        C:\Windows\system32\Cknbbkdi.exe
        65⤵
        Modifies registry class
        
        PID:5600
        
        C:\Windows\SysWOW64\Cnmonfcm.exe
        
        C:\Windows\system32\Cnmonfcm.exe
        66⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Cdggkp32.exe
        
        C:\Windows\system32\Cdggkp32.exe
        67⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Ccigfmad.exe
        
        C:\Windows\system32\Ccigfmad.exe
        68⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Ckqogjbg.exe
        
        C:\Windows\system32\Ckqogjbg.exe
        69⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Cnokcfaj.exe
        
        C:\Windows\system32\Cnokcfaj.exe
        70⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Ccldlm32.exe
        
        C:\Windows\system32\Ccldlm32.exe
        71⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Cdkpfpfd.exe
        
        C:\Windows\system32\Cdkpfpfd.exe
        72⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Cjhinfdl.exe
        
        C:\Windows\system32\Cjhinfdl.exe
        73⤵
        Drops file in System32 directory
        
        PID:5792
        
        C:\Windows\SysWOW64\Cqbakq32.exe
        
        C:\Windows\system32\Cqbakq32.exe
        74⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Cgligk32.exe
        
        C:\Windows\system32\Cgligk32.exe
        75⤵
        Drops file in System32 directory
        
        PID:5824
        
        C:\Windows\SysWOW64\Djjecf32.exe
        
        C:\Windows\system32\Djjecf32.exe
        76⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Dqdnppjf.exe
        
        C:\Windows\system32\Dqdnppjf.exe
        77⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Dgnfmj32.exe
        
        C:\Windows\system32\Dgnfmj32.exe
        78⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Djmbif32.exe
        
        C:\Windows\system32\Djmbif32.exe
        79⤵
        Modifies registry class
        
        PID:5888
        
        C:\Windows\SysWOW64\Dqgjfphc.exe
        
        C:\Windows\system32\Dqgjfphc.exe
        80⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Dcegbk32.exe
        
        C:\Windows\system32\Dcegbk32.exe
        81⤵
        Drops file in System32 directory
        
        PID:5920
        
        C:\Windows\SysWOW64\Dkloci32.exe
        
        C:\Windows\system32\Dkloci32.exe
        82⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Dkokih32.exe
        
        C:\Windows\system32\Dkokih32.exe
        83⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Dnmhed32.exe
        
        C:\Windows\system32\Dnmhed32.exe
        84⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Dqkdao32.exe
        
        C:\Windows\system32\Dqkdao32.exe
        85⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Dcjpmk32.exe
        
        C:\Windows\system32\Dcjpmk32.exe
        86⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Dgelni32.exe
        
        C:\Windows\system32\Dgelni32.exe
        87⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Dnpdjcch.exe
        
        C:\Windows\system32\Dnpdjcch.exe
        88⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Deimgn32.exe
        
        C:\Windows\system32\Deimgn32.exe
        89⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Ejfeod32.exe
        
        C:\Windows\system32\Ejfeod32.exe
        90⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Emdakp32.exe
        
        C:\Windows\system32\Emdakp32.exe
        91⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Eelimm32.exe
        
        C:\Windows\system32\Eelimm32.exe
        92⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Egjeii32.exe
        
        C:\Windows\system32\Egjeii32.exe
        93⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Ejhbedfi.exe
        
        C:\Windows\system32\Ejhbedfi.exe
        94⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Emgnapem.exe
        
        C:\Windows\system32\Emgnapem.exe
        95⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Eabjan32.exe
        
        C:\Windows\system32\Eabjan32.exe
        96⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Ecafnj32.exe
        
        C:\Windows\system32\Ecafnj32.exe
        97⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Ekhnog32.exe
        
        C:\Windows\system32\Ekhnog32.exe
        98⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Enfjkb32.exe
        
        C:\Windows\system32\Enfjkb32.exe
        99⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Eaeggn32.exe
        
        C:\Windows\system32\Eaeggn32.exe
        100⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Ecccci32.exe
        
        C:\Windows\system32\Ecccci32.exe
        101⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Ekjkdg32.exe
        
        C:\Windows\system32\Ekjkdg32.exe
        102⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Enigqbkm.exe
        
        C:\Windows\system32\Enigqbkm.exe
        103⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Eagcmnjq.exe
        
        C:\Windows\system32\Eagcmnjq.exe
        104⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Eecoml32.exe
        
        C:\Windows\system32\Eecoml32.exe
        105⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Egalih32.exe
        
        C:\Windows\system32\Egalih32.exe
        106⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Ejphec32.exe
        
        C:\Windows\system32\Ejphec32.exe
        107⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Emndao32.exe
        
        C:\Windows\system32\Emndao32.exe
        108⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Eaipbmhn.exe
        
        C:\Windows\system32\Eaipbmhn.exe
        109⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Echlniga.exe
        
        C:\Windows\system32\Echlniga.exe
        110⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Fgchog32.exe
        
        C:\Windows\system32\Fgchog32.exe
        111⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Fjbdkc32.exe
        
        C:\Windows\system32\Fjbdkc32.exe
        112⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Fmpagnmb.exe
        
        C:\Windows\system32\Fmpagnmb.exe
        113⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Fcjidh32.exe
        
        C:\Windows\system32\Fcjidh32.exe
        114⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Flaaef32.exe
        
        C:\Windows\system32\Flaaef32.exe
        115⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Fnpmaa32.exe
        
        C:\Windows\system32\Fnpmaa32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6448
        
        C:\Windows\SysWOW64\Fanimm32.exe
        
        C:\Windows\system32\Fanimm32.exe
        117⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Fcmfih32.exe
        
        C:\Windows\system32\Fcmfih32.exe
        118⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Fldnke32.exe
        
        C:\Windows\system32\Fldnke32.exe
        119⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Fmejbnim.exe
        
        C:\Windows\system32\Fmejbnim.exe
        120⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Fdobohaj.exe
        
        C:\Windows\system32\Fdobohaj.exe
        121⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Fhkopf32.exe
        
        C:\Windows\system32\Fhkopf32.exe
        122⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Fmgghm32.exe
        
        C:\Windows\system32\Fmgghm32.exe
        123⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Feooik32.exe
        
        C:\Windows\system32\Feooik32.exe
        124⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Fhmkef32.exe
        
        C:\Windows\system32\Fhmkef32.exe
        125⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Fngcbpom.exe
        
        C:\Windows\system32\Fngcbpom.exe
        126⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Gdcljg32.exe
        
        C:\Windows\system32\Gdcljg32.exe
        127⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Ghohkfen.exe
        
        C:\Windows\system32\Ghohkfen.exe
        128⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Gnipgp32.exe
        
        C:\Windows\system32\Gnipgp32.exe
        129⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Hkicbpjd.exe
        
        C:\Windows\system32\Hkicbpjd.exe
        130⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Hmhpokig.exe
        
        C:\Windows\system32\Hmhpokig.exe
        131⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Heohphjj.exe
        
        C:\Windows\system32\Heohphjj.exe
        132⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Hklpho32.exe
        
        C:\Windows\system32\Hklpho32.exe
        133⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Hmjmdk32.exe
        
        C:\Windows\system32\Hmjmdk32.exe
        134⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Headeh32.exe
        
        C:\Windows\system32\Headeh32.exe
        135⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Hhpaac32.exe
        
        C:\Windows\system32\Hhpaac32.exe
        136⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Hknmno32.exe
        
        C:\Windows\system32\Hknmno32.exe
        137⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Hahejimk.exe
        
        C:\Windows\system32\Hahejimk.exe
        138⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Hdfafdlo.exe
        
        C:\Windows\system32\Hdfafdlo.exe
        139⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Hlnihbma.exe
        
        C:\Windows\system32\Hlnihbma.exe
        140⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Holfdm32.exe
        
        C:\Windows\system32\Holfdm32.exe
        141⤵
        
        PID:7012

C:\Windows\SysWOW64\Hdinld32.exe
C:\Windows\system32\Hdinld32.exe
1⤵
PID:7032
- C:\Windows\SysWOW64\Hlpfma32.exe
  C:\Windows\system32\Hlpfma32.exe
  2⤵
  PID:7060
- - C:\Windows\SysWOW64\Hkbfinbi.exe
    C:\Windows\system32\Hkbfinbi.exe
    3⤵
    PID:7076
  - - C:\Windows\SysWOW64\Iehkfgao.exe
      C:\Windows\system32\Iehkfgao.exe
      4⤵
      PID:7096
    - - C:\Windows\SysWOW64\Idkkad32.exe
        
        C:\Windows\system32\Idkkad32.exe
        5⤵
        
        PID:7116
      - C:\Windows\SysWOW64\Ikecnnpf.exe
        
        C:\Windows\system32\Ikecnnpf.exe
        6⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Imcpji32.exe
        
        C:\Windows\system32\Imcpji32.exe
        7⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Ihichb32.exe
        
        C:\Windows\system32\Ihichb32.exe
        8⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Inflpi32.exe
        
        C:\Windows\system32\Inflpi32.exe
        9⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Ihkpma32.exe
        
        C:\Windows\system32\Ihkpma32.exe
        10⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Ikjmim32.exe
        
        C:\Windows\system32\Ikjmim32.exe
        11⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Inhiei32.exe
        
        C:\Windows\system32\Inhiei32.exe
        12⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Ieoagflg.exe
        
        C:\Windows\system32\Ieoagflg.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6460
        
        C:\Windows\SysWOW64\Idbabc32.exe
        
        C:\Windows\system32\Idbabc32.exe
        14⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Iliicp32.exe
        
        C:\Windows\system32\Iliicp32.exe
        15⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Ikliomjo.exe
        
        C:\Windows\system32\Ikliomjo.exe
        16⤵
        Drops file in System32 directory
        
        PID:6824
        
        C:\Windows\SysWOW64\Iafalg32.exe
        
        C:\Windows\system32\Iafalg32.exe
        17⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Illfip32.exe
        
        C:\Windows\system32\Illfip32.exe
        18⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Inmbqhgp.exe
        
        C:\Windows\system32\Inmbqhgp.exe
        19⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Jedjbe32.exe
        
        C:\Windows\system32\Jedjbe32.exe
        20⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Jhbfnq32.exe
        
        C:\Windows\system32\Jhbfnq32.exe
        21⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Jolokknb.exe
        
        C:\Windows\system32\Jolokknb.exe
        22⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Jakkgfmf.exe
        
        C:\Windows\system32\Jakkgfmf.exe
        23⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\Jheccq32.exe
        
        C:\Windows\system32\Jheccq32.exe
        24⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Jkcppl32.exe
        
        C:\Windows\system32\Jkcppl32.exe
        25⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Joahfj32.exe
        
        C:\Windows\system32\Joahfj32.exe
        26⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Jdnqna32.exe
        
        C:\Windows\system32\Jdnqna32.exe
        27⤵
        Drops file in System32 directory
        
        PID:7272
        
        C:\Windows\SysWOW64\Jleion32.exe
        
        C:\Windows\system32\Jleion32.exe
        28⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Jocekj32.exe
        
        C:\Windows\system32\Jocekj32.exe
        29⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Jemmhdog.exe
        
        C:\Windows\system32\Jemmhdog.exe
        30⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Jhlidp32.exe
        
        C:\Windows\system32\Jhlidp32.exe
        31⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Jkjepk32.exe
        
        C:\Windows\system32\Jkjepk32.exe
        32⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Jofaaifh.exe
        
        C:\Windows\system32\Jofaaifh.exe
        33⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Kadnmeek.exe
        
        C:\Windows\system32\Kadnmeek.exe
        34⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Kfpjnc32.exe
        
        C:\Windows\system32\Kfpjnc32.exe
        35⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Khnfjo32.exe
        
        C:\Windows\system32\Khnfjo32.exe
        36⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Kohnfide.exe
        
        C:\Windows\system32\Kohnfide.exe
        37⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Kafjbdci.exe
        
        C:\Windows\system32\Kafjbdci.exe
        38⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Kdegopbl.exe
        
        C:\Windows\system32\Kdegopbl.exe
        39⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Kllopm32.exe
        
        C:\Windows\system32\Kllopm32.exe
        40⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Kojkli32.exe
        
        C:\Windows\system32\Kojkli32.exe
        41⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Kbighd32.exe
        
        C:\Windows\system32\Kbighd32.exe
        42⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Kdgcdp32.exe
        
        C:\Windows\system32\Kdgcdp32.exe
        43⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Klnkem32.exe
        
        C:\Windows\system32\Klnkem32.exe
        44⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Komhah32.exe
        
        C:\Windows\system32\Komhah32.exe
        45⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Kbkdnd32.exe
        
        C:\Windows\system32\Kbkdnd32.exe
        46⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Kdipjp32.exe
        
        C:\Windows\system32\Kdipjp32.exe
        47⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Klqhkm32.exe
        
        C:\Windows\system32\Klqhkm32.exe
        48⤵
        Modifies registry class
        
        PID:7712
        
        C:\Windows\SysWOW64\Knbdbe32.exe
        
        C:\Windows\system32\Knbdbe32.exe
        49⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Kfimdb32.exe
        
        C:\Windows\system32\Kfimdb32.exe
        50⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Khgipn32.exe
        
        C:\Windows\system32\Khgipn32.exe
        51⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Kkfeli32.exe
        
        C:\Windows\system32\Kkfeli32.exe
        52⤵
        Drops file in System32 directory
        
        PID:7796
        
        C:\Windows\SysWOW64\Lndahd32.exe
        
        C:\Windows\system32\Lndahd32.exe
        53⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Lfkiib32.exe
        
        C:\Windows\system32\Lfkiib32.exe
        54⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Lhjeem32.exe
        
        C:\Windows\system32\Lhjeem32.exe
        55⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Lodnbg32.exe
        
        C:\Windows\system32\Lodnbg32.exe
        56⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Lnfnndqb.exe
        
        C:\Windows\system32\Lnfnndqb.exe
        57⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Ldqfjn32.exe
        
        C:\Windows\system32\Ldqfjn32.exe
        58⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Lhlbkmph.exe
        
        C:\Windows\system32\Lhlbkmph.exe
        59⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Lkkoghol.exe
        
        C:\Windows\system32\Lkkoghol.exe
        60⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Lbdgdb32.exe
        
        C:\Windows\system32\Lbdgdb32.exe
        61⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Ldccpn32.exe
        
        C:\Windows\system32\Ldccpn32.exe
        62⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Lkmkmhmi.exe
        
        C:\Windows\system32\Lkmkmhmi.exe
        63⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Lnkgiclm.exe
        
        C:\Windows\system32\Lnkgiclm.exe
        64⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Ldependj.exe
        
        C:\Windows\system32\Ldependj.exe
        65⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Lmlhgkdl.exe
        
        C:\Windows\system32\Lmlhgkdl.exe
        66⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Lokdcfcp.exe
        
        C:\Windows\system32\Lokdcfcp.exe
        67⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Lbipobbc.exe
        
        C:\Windows\system32\Lbipobbc.exe
        68⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Lichll32.exe
        
        C:\Windows\system32\Lichll32.exe
        69⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Mkadhg32.exe
        
        C:\Windows\system32\Mkadhg32.exe
        70⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Mnpadc32.exe
        
        C:\Windows\system32\Mnpadc32.exe
        71⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Mfgiepij.exe
        
        C:\Windows\system32\Mfgiepij.exe
        72⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Mieealhn.exe
        
        C:\Windows\system32\Mieealhn.exe
        73⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Mkdamgga.exe
        
        C:\Windows\system32\Mkdamgga.exe
        74⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Mnbnibfe.exe
        
        C:\Windows\system32\Mnbnibfe.exe
        75⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Mfiekpgg.exe
        
        C:\Windows\system32\Mfiekpgg.exe
        76⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Mihbgkfk.exe
        
        C:\Windows\system32\Mihbgkfk.exe
        77⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Mkfncgeo.exe
        
        C:\Windows\system32\Mkfncgeo.exe
        78⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Mndjobdb.exe
        
        C:\Windows\system32\Mndjobdb.exe
        79⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Mmfkmjla.exe
        
        C:\Windows\system32\Mmfkmjla.exe
        80⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Mmhgbijo.exe
        
        C:\Windows\system32\Mmhgbijo.exe
        81⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Miohgjpc.exe
        
        C:\Windows\system32\Miohgjpc.exe
        82⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Nkmdcfof.exe
        
        C:\Windows\system32\Nkmdcfof.exe
        83⤵
        Modifies registry class
        
        PID:8304
        
        C:\Windows\SysWOW64\Npipdd32.exe
        
        C:\Windows\system32\Npipdd32.exe
        84⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Nbglpp32.exe
        
        C:\Windows\system32\Nbglpp32.exe
        85⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Nefilk32.exe
        
        C:\Windows\system32\Nefilk32.exe
        86⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Nmmqni32.exe
        
        C:\Windows\system32\Nmmqni32.exe
        87⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Nlpaiemd.exe
        
        C:\Windows\system32\Nlpaiemd.exe
        88⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Nnnmealg.exe
        
        C:\Windows\system32\Nnnmealg.exe
        89⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Nfeefnmj.exe
        
        C:\Windows\system32\Nfeefnmj.exe
        90⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Nicabjln.exe
        
        C:\Windows\system32\Nicabjln.exe
        91⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Npnjodcj.exe
        
        C:\Windows\system32\Npnjodcj.exe
        92⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Nblfkobn.exe
        
        C:\Windows\system32\Nblfkobn.exe
        93⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Nejbgkaa.exe
        
        C:\Windows\system32\Nejbgkaa.exe
        94⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Nmajihbd.exe
        
        C:\Windows\system32\Nmajihbd.exe
        95⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Nppfecah.exe
        
        C:\Windows\system32\Nppfecah.exe
        96⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Nbnbaoqk.exe
        
        C:\Windows\system32\Nbnbaoqk.exe
        97⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Nemomjpo.exe
        
        C:\Windows\system32\Nemomjpo.exe
        98⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Nmdgnhpa.exe
        
        C:\Windows\system32\Nmdgnhpa.exe
        99⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Nlggjdgl.exe
        
        C:\Windows\system32\Nlggjdgl.exe
        100⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Nnecfpfp.exe
        
        C:\Windows\system32\Nnecfpfp.exe
        101⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Nflkgmgb.exe
        
        C:\Windows\system32\Nflkgmgb.exe
        102⤵
        Modifies registry class
        
        PID:8720
        
        C:\Windows\SysWOW64\Neokbj32.exe
        
        C:\Windows\system32\Neokbj32.exe
        103⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Omfcdg32.exe
        
        C:\Windows\system32\Omfcdg32.exe
        104⤵
        Modifies registry class
        
        PID:8760
        
        C:\Windows\SysWOW64\Opdppc32.exe
        
        C:\Windows\system32\Opdppc32.exe
        105⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Obclln32.exe
        
        C:\Windows\system32\Obclln32.exe
        106⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Oeahhj32.exe
        
        C:\Windows\system32\Oeahhj32.exe
        107⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Omhpig32.exe
        
        C:\Windows\system32\Omhpig32.exe
        108⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Olkqedcf.exe
        
        C:\Windows\system32\Olkqedcf.exe
        109⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Onjmao32.exe
        
        C:\Windows\system32\Onjmao32.exe
        110⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Ofaebm32.exe
        
        C:\Windows\system32\Ofaebm32.exe
        111⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Oioanh32.exe
        
        C:\Windows\system32\Oioanh32.exe
        112⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Omkmogji.exe
        
        C:\Windows\system32\Omkmogji.exe
        113⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Opiikbim.exe
        
        C:\Windows\system32\Opiikbim.exe
        114⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Oefacigd.exe
        
        C:\Windows\system32\Oefacigd.exe
        115⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Ommjdfhg.exe
        
        C:\Windows\system32\Ommjdfhg.exe
        116⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Olpjpc32.exe
        
        C:\Windows\system32\Olpjpc32.exe
        117⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Objbmm32.exe
        
        C:\Windows\system32\Objbmm32.exe
        118⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Ompfjf32.exe
        
        C:\Windows\system32\Ompfjf32.exe
        119⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Oblobm32.exe
        
        C:\Windows\system32\Oblobm32.exe
        120⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Oekknh32.exe
        
        C:\Windows\system32\Oekknh32.exe
        121⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Pppola32.exe
        
        C:\Windows\system32\Pppola32.exe
        122⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Pbolhm32.exe
        
        C:\Windows\system32\Pbolhm32.exe
        123⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Piiddg32.exe
        
        C:\Windows\system32\Piiddg32.exe
        124⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Poelmn32.exe
        
        C:\Windows\system32\Poelmn32.exe
        125⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Pbahmlpf.exe
        
        C:\Windows\system32\Pbahmlpf.exe
        126⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Pepdihoj.exe
        
        C:\Windows\system32\Pepdihoj.exe
        127⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Pohibm32.exe
        
        C:\Windows\system32\Pohibm32.exe
        128⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Pfoackfl.exe
        
        C:\Windows\system32\Pfoackfl.exe
        129⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Pmiipe32.exe
        
        C:\Windows\system32\Pmiipe32.exe
        130⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Pojehmdg.exe
        
        C:\Windows\system32\Pojehmdg.exe
        131⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Pfanijdj.exe
        
        C:\Windows\system32\Pfanijdj.exe
        132⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Pipjefcn.exe
        
        C:\Windows\system32\Pipjefcn.exe
        133⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Ppjbbp32.exe
        
        C:\Windows\system32\Ppjbbp32.exe
        134⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Qefkjg32.exe
        
        C:\Windows\system32\Qefkjg32.exe
        135⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Qeigpfgo.exe
        
        C:\Windows\system32\Qeigpfgo.exe
        136⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Aigpfe32.exe
        
        C:\Windows\system32\Aigpfe32.exe
        137⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Alelbpmi.exe
        
        C:\Windows\system32\Alelbpmi.exe
        138⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Aochnllm.exe
        
        C:\Windows\system32\Aochnllm.exe
        139⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Agkqoilo.exe
        
        C:\Windows\system32\Agkqoilo.exe
        140⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Aiimkdkc.exe
        
        C:\Windows\system32\Aiimkdkc.exe
        141⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Amdilc32.exe
        
        C:\Windows\system32\Amdilc32.exe
        142⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Apceho32.exe
        
        C:\Windows\system32\Apceho32.exe
        143⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Abaadj32.exe
        
        C:\Windows\system32\Abaadj32.exe
        144⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Aepmpe32.exe
        
        C:\Windows\system32\Aepmpe32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9352
        
        C:\Windows\SysWOW64\Amgeac32.exe
        
        C:\Windows\system32\Amgeac32.exe
        146⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Acdnjjpq.exe
        
        C:\Windows\system32\Acdnjjpq.exe
        147⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Aebjfeod.exe
        
        C:\Windows\system32\Aebjfeod.exe
        148⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Aphncnoj.exe
        
        C:\Windows\system32\Aphncnoj.exe
        149⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Agafph32.exe
        
        C:\Windows\system32\Agafph32.exe
        150⤵
        Modifies registry class
        
        PID:9448
        
        C:\Windows\SysWOW64\Aipclc32.exe
        
        C:\Windows\system32\Aipclc32.exe
        151⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Alooho32.exe
        
        C:\Windows\system32\Alooho32.exe
        152⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Bchgei32.exe
        
        C:\Windows\system32\Bchgei32.exe
        153⤵
        Drops file in System32 directory
        
        PID:9500
        
        C:\Windows\SysWOW64\Begcad32.exe
        
        C:\Windows\system32\Begcad32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9516
        
        C:\Windows\SysWOW64\Bmnlbb32.exe
        
        C:\Windows\system32\Bmnlbb32.exe
        155⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Bplhnm32.exe
        
        C:\Windows\system32\Bplhnm32.exe
        156⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Bckdji32.exe
        
        C:\Windows\system32\Bckdji32.exe
        157⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Bgfpkgbb.exe
        
        C:\Windows\system32\Bgfpkgbb.exe
        158⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Bnphha32.exe
        
        C:\Windows\system32\Bnphha32.exe
        159⤵
        Modifies registry class
        
        PID:9596
        
        C:\Windows\SysWOW64\Bpoddm32.exe
        
        C:\Windows\system32\Bpoddm32.exe
        160⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Bgimqg32.exe
        
        C:\Windows\system32\Bgimqg32.exe
        161⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Bigimb32.exe
        
        C:\Windows\system32\Bigimb32.exe
        162⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Bleein32.exe
        
        C:\Windows\system32\Bleein32.exe
        163⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Bodaei32.exe
        
        C:\Windows\system32\Bodaei32.exe
        164⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Benjaceg.exe
        
        C:\Windows\system32\Benjaceg.exe
        165⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Blhbnn32.exe
        
        C:\Windows\system32\Blhbnn32.exe
        166⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Bcbjkhdq.exe
        
        C:\Windows\system32\Bcbjkhdq.exe
        167⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Bepfgc32.exe
        
        C:\Windows\system32\Bepfgc32.exe
        168⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Bljodmja.exe
        
        C:\Windows\system32\Bljodmja.exe
        169⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Boikpiie.exe
        
        C:\Windows\system32\Boikpiie.exe
        170⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Cgpcafjg.exe
        
        C:\Windows\system32\Cgpcafjg.exe
        171⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Cebcmc32.exe
        
        C:\Windows\system32\Cebcmc32.exe
        172⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Clmkimho.exe
        
        C:\Windows\system32\Clmkimho.exe
        173⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Cphgjl32.exe
        
        C:\Windows\system32\Cphgjl32.exe
        174⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Ccfcfg32.exe
        
        C:\Windows\system32\Ccfcfg32.exe
        175⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Cfepbboo.exe
        
        C:\Windows\system32\Cfepbboo.exe
        176⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Cnlhcppa.exe
        
        C:\Windows\system32\Cnlhcppa.exe
        177⤵
        Modifies registry class
        
        PID:9892
        
        C:\Windows\SysWOW64\Clohom32.exe
        
        C:\Windows\system32\Clohom32.exe
        178⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Cfgmhbml.exe
        
        C:\Windows\system32\Cfgmhbml.exe
        179⤵
        
        PID:9956

C:\Windows\SysWOW64\Cnndipmo.exe
C:\Windows\system32\Cnndipmo.exe
1⤵
PID:9976
- C:\Windows\SysWOW64\Claedl32.exe
  C:\Windows\system32\Claedl32.exe
  2⤵
  PID:10000
- - C:\Windows\SysWOW64\Copaqh32.exe
    C:\Windows\system32\Copaqh32.exe
    3⤵
    PID:10044
  - - C:\Windows\SysWOW64\Cnqaoo32.exe
      C:\Windows\system32\Cnqaoo32.exe
      4⤵
      PID:10088
    - - C:\Windows\SysWOW64\Cobnfgaj.exe
        
        C:\Windows\system32\Cobnfgaj.exe
        5⤵
        Modifies registry class
        
        PID:10108
      - C:\Windows\SysWOW64\Ccnjgf32.exe
        
        C:\Windows\system32\Ccnjgf32.exe
        6⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Cjgbcpap.exe
        
        C:\Windows\system32\Cjgbcpap.exe
        7⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Cqajpj32.exe
        
        C:\Windows\system32\Cqajpj32.exe
        8⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Djjoipon.exe
        
        C:\Windows\system32\Djjoipon.exe
        9⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Dqdgfjfj.exe
        
        C:\Windows\system32\Dqdgfjfj.exe
        10⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Dgnobd32.exe
        
        C:\Windows\system32\Dgnobd32.exe
        11⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Dnhgoned.exe
        
        C:\Windows\system32\Dnhgoned.exe
        12⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Dqfckjdh.exe
        
        C:\Windows\system32\Dqfckjdh.exe
        13⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Doidgf32.exe
        
        C:\Windows\system32\Doidgf32.exe
        14⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Dgplhd32.exe
        
        C:\Windows\system32\Dgplhd32.exe
        15⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Djohdo32.exe
        
        C:\Windows\system32\Djohdo32.exe
        16⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Dmmdpkjl.exe
        
        C:\Windows\system32\Dmmdpkjl.exe
        17⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Dokqlfip.exe
        
        C:\Windows\system32\Dokqlfip.exe
        18⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Dgbhncjb.exe
        
        C:\Windows\system32\Dgbhncjb.exe
        19⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Djaejoie.exe
        
        C:\Windows\system32\Djaejoie.exe
        20⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Donmbfgm.exe
        
        C:\Windows\system32\Donmbfgm.exe
        21⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Dgeeccho.exe
        
        C:\Windows\system32\Dgeeccho.exe
        22⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Eopjge32.exe
        
        C:\Windows\system32\Eopjge32.exe
        23⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Eggbic32.exe
        
        C:\Windows\system32\Eggbic32.exe
        24⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Enajemmi.exe
        
        C:\Windows\system32\Enajemmi.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10264
        
        C:\Windows\SysWOW64\Eobgme32.exe
        
        C:\Windows\system32\Eobgme32.exe
        26⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Ecnbndkq.exe
        
        C:\Windows\system32\Ecnbndkq.exe
        27⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Eflojojd.exe
        
        C:\Windows\system32\Eflojojd.exe
        28⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Encgkmkg.exe
        
        C:\Windows\system32\Encgkmkg.exe
        29⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Eoecbe32.exe
        
        C:\Windows\system32\Eoecbe32.exe
        30⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Efoloo32.exe
        
        C:\Windows\system32\Efoloo32.exe
        31⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Enfcql32.exe
        
        C:\Windows\system32\Enfcql32.exe
        32⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Eogphdob.exe
        
        C:\Windows\system32\Eogphdob.exe
        33⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Efaheo32.exe
        
        C:\Windows\system32\Efaheo32.exe
        34⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Eqfmbg32.exe
        
        C:\Windows\system32\Eqfmbg32.exe
        35⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Eceinc32.exe
        
        C:\Windows\system32\Eceinc32.exe
        36⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Efcejndl.exe
        
        C:\Windows\system32\Efcejndl.exe
        37⤵
        Modifies registry class
        
        PID:10480
        
        C:\Windows\SysWOW64\Enjmlleo.exe
        
        C:\Windows\system32\Enjmlleo.exe
        38⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Fqiihgdb.exe
        
        C:\Windows\system32\Fqiihgdb.exe
        39⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Fplicd32.exe
        
        C:\Windows\system32\Fplicd32.exe
        40⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Fgcada32.exe
        
        C:\Windows\system32\Fgcada32.exe
        41⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Fnmjakcl.exe
        
        C:\Windows\system32\Fnmjakcl.exe
        42⤵
        Drops file in System32 directory
        
        PID:10588
        
        C:\Windows\SysWOW64\Fqkfmgbp.exe
        
        C:\Windows\system32\Fqkfmgbp.exe
        43⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Fcjbibac.exe
        
        C:\Windows\system32\Fcjbibac.exe
        44⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Ffhnen32.exe
        
        C:\Windows\system32\Ffhnen32.exe
        45⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Gpjfdbom.exe
        
        C:\Windows\system32\Gpjfdbom.exe
        46⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Gceaeq32.exe
        
        C:\Windows\system32\Gceaeq32.exe
        47⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Gjojbkoc.exe
        
        C:\Windows\system32\Gjojbkoc.exe
        48⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Gmnfnfnf.exe
        
        C:\Windows\system32\Gmnfnfnf.exe
        49⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Gchnkp32.exe
        
        C:\Windows\system32\Gchnkp32.exe
        50⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Gjaggjlp.exe
        
        C:\Windows\system32\Gjaggjlp.exe
        51⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Gmpcce32.exe
        
        C:\Windows\system32\Gmpcce32.exe
        52⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Gcjkppcq.exe
        
        C:\Windows\system32\Gcjkppcq.exe
        53⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Gjdcmj32.exe
        
        C:\Windows\system32\Gjdcmj32.exe
        54⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Ganljdbj.exe
        
        C:\Windows\system32\Ganljdbj.exe
        55⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Gclhfpan.exe
        
        C:\Windows\system32\Gclhfpan.exe
        56⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Hjfpbi32.exe
        
        C:\Windows\system32\Hjfpbi32.exe
        57⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Hnblchqd.exe
        
        C:\Windows\system32\Hnblchqd.exe
        58⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Hdodko32.exe
        
        C:\Windows\system32\Hdodko32.exe
        59⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Hfmagk32.exe
        
        C:\Windows\system32\Hfmagk32.exe
        60⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Hndiih32.exe
        
        C:\Windows\system32\Hndiih32.exe
        61⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Habeec32.exe
        
        C:\Windows\system32\Habeec32.exe
        62⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Hdaaao32.exe
        
        C:\Windows\system32\Hdaaao32.exe
        63⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Hfpnmj32.exe
        
        C:\Windows\system32\Hfpnmj32.exe
        64⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Hnfeng32.exe
        
        C:\Windows\system32\Hnfeng32.exe
        65⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Hmifjdci.exe
        
        C:\Windows\system32\Hmifjdci.exe
        66⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Hdcnfnkf.exe
        
        C:\Windows\system32\Hdcnfnkf.exe
        67⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Hfbjbjjj.exe
        
        C:\Windows\system32\Hfbjbjjj.exe
        68⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Hnibdgkl.exe
        
        C:\Windows\system32\Hnibdgkl.exe
        69⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Hmlbod32.exe
        
        C:\Windows\system32\Hmlbod32.exe
        70⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Hpjokp32.exe
        
        C:\Windows\system32\Hpjokp32.exe
        71⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Hdfklnic.exe
        
        C:\Windows\system32\Hdfklnic.exe
        72⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Hfdghihg.exe
        
        C:\Windows\system32\Hfdghihg.exe
        73⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Hokoigii.exe
        
        C:\Windows\system32\Hokoigii.exe
        74⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Hdhgangq.exe
        
        C:\Windows\system32\Hdhgangq.exe
        75⤵
        Modifies registry class
        
        PID:10740
        
        C:\Windows\SysWOW64\Ijbpnhnn.exe
        
        C:\Windows\system32\Ijbpnhnn.exe
        76⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Imqljcma.exe
        
        C:\Windows\system32\Imqljcma.exe
        77⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Ipohfole.exe
        
        C:\Windows\system32\Ipohfole.exe
        78⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Idjdgm32.exe
        
        C:\Windows\system32\Idjdgm32.exe
        79⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Ifipci32.exe
        
        C:\Windows\system32\Ifipci32.exe
        80⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Ikdldglk.exe
        
        C:\Windows\system32\Ikdldglk.exe
        81⤵
        
        PID:11288
        
        C:\Windows\SysWOW64\Imchpcko.exe
        
        C:\Windows\system32\Imchpcko.exe
        82⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Ipaelnjb.exe
        
        C:\Windows\system32\Ipaelnjb.exe
        83⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\Ifkmihbo.exe
        
        C:\Windows\system32\Ifkmihbo.exe
        84⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\Idajhlof.exe
        
        C:\Windows\system32\Idajhlof.exe
        85⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Ikkbdffc.exe
        
        C:\Windows\system32\Ikkbdffc.exe
        86⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Imjoqbef.exe
        
        C:\Windows\system32\Imjoqbef.exe
        87⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Iphkmmdj.exe
        
        C:\Windows\system32\Iphkmmdj.exe
        88⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\Jknojfdp.exe
        
        C:\Windows\system32\Jknojfdp.exe
        89⤵
        
        PID:11420
        
        C:\Windows\SysWOW64\Jmlkfacd.exe
        
        C:\Windows\system32\Jmlkfacd.exe
        90⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Jdfccl32.exe
        
        C:\Windows\system32\Jdfccl32.exe
        91⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Jhapcjcj.exe
        
        C:\Windows\system32\Jhapcjcj.exe
        92⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Jkplpfbn.exe
        
        C:\Windows\system32\Jkplpfbn.exe
        93⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Jmohla32.exe
        
        C:\Windows\system32\Jmohla32.exe
        94⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Jdhphkin.exe
        
        C:\Windows\system32\Jdhphkin.exe
        95⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Jhdlij32.exe
        
        C:\Windows\system32\Jhdlij32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11540
        
        C:\Windows\SysWOW64\Jmaeaa32.exe
        
        C:\Windows\system32\Jmaeaa32.exe
        97⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\Jpoaml32.exe
        
        C:\Windows\system32\Jpoaml32.exe
        98⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\Jgiijffo.exe
        
        C:\Windows\system32\Jgiijffo.exe
        99⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Jaongo32.exe
        
        C:\Windows\system32\Jaongo32.exe
        100⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\Jkgbpele.exe
        
        C:\Windows\system32\Jkgbpele.exe
        101⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\Jnenlpki.exe
        
        C:\Windows\system32\Jnenlpki.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11636
        
        C:\Windows\SysWOW64\Jpdjhljm.exe
        
        C:\Windows\system32\Jpdjhljm.exe
        103⤵
        Drops file in System32 directory
        
        PID:11652
        
        C:\Windows\SysWOW64\Khkbjiko.exe
        
        C:\Windows\system32\Khkbjiko.exe
        104⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Kkiofdjc.exe
        
        C:\Windows\system32\Kkiofdjc.exe
        105⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Knhkbpif.exe
        
        C:\Windows\system32\Knhkbpif.exe
        106⤵
        Drops file in System32 directory
        
        PID:11716
        
        C:\Windows\SysWOW64\Kpfgnk32.exe
        
        C:\Windows\system32\Kpfgnk32.exe
        107⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\Khmooi32.exe
        
        C:\Windows\system32\Khmooi32.exe
        108⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\Kahpnnmj.exe
        
        C:\Windows\system32\Kahpnnmj.exe
        109⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\Kdfmji32.exe
        
        C:\Windows\system32\Kdfmji32.exe
        110⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Kkqefcdk.exe
        
        C:\Windows\system32\Kkqefcdk.exe
        111⤵
        Modifies registry class
        
        PID:11952
        
        C:\Windows\SysWOW64\Knoaboco.exe
        
        C:\Windows\system32\Knoaboco.exe
        112⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Kajmcn32.exe
        
        C:\Windows\system32\Kajmcn32.exe
        113⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Kdiioi32.exe
        
        C:\Windows\system32\Kdiioi32.exe
        114⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Kkcalcbh.exe
        
        C:\Windows\system32\Kkcalcbh.exe
        115⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Knanhoal.exe
        
        C:\Windows\system32\Knanhoal.exe
        116⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Lgjbadgl.exe
        
        C:\Windows\system32\Lgjbadgl.exe
        117⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\Lncjnn32.exe
        
        C:\Windows\system32\Lncjnn32.exe
        118⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Lpbgjj32.exe
        
        C:\Windows\system32\Lpbgjj32.exe
        119⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\Lglofdej.exe
        
        C:\Windows\system32\Lglofdej.exe
        120⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Locghafl.exe
        
        C:\Windows\system32\Locghafl.exe
        121⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Laacdmep.exe
        
        C:\Windows\system32\Laacdmep.exe
        122⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Lpdcpi32.exe
        
        C:\Windows\system32\Lpdcpi32.exe
        123⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\Lhkkqgml.exe
        
        C:\Windows\system32\Lhkkqgml.exe
        124⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Lkjhmblp.exe
        
        C:\Windows\system32\Lkjhmblp.exe
        125⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\Loecma32.exe
        
        C:\Windows\system32\Loecma32.exe
        126⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Ladpil32.exe
        
        C:\Windows\system32\Ladpil32.exe
        127⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Lqgpeijg.exe
        
        C:\Windows\system32\Lqgpeijg.exe
        128⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Lhnhffkj.exe
        
        C:\Windows\system32\Lhnhffkj.exe
        129⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Lohpcq32.exe
        
        C:\Windows\system32\Lohpcq32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12272
        
        C:\Windows\SysWOW64\Lddikg32.exe
        
        C:\Windows\system32\Lddikg32.exe
        131⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Lgcegc32.exe
        
        C:\Windows\system32\Lgcegc32.exe
        132⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Lnmmdm32.exe
        
        C:\Windows\system32\Lnmmdm32.exe
        133⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Mdgeqgnk.exe
        
        C:\Windows\system32\Mdgeqgnk.exe
        134⤵
        
        PID:11776
        
        C:\Windows\SysWOW64\Mgebmbmo.exe
        
        C:\Windows\system32\Mgebmbmo.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11792
        
        C:\Windows\SysWOW64\Mnojim32.exe
        
        C:\Windows\system32\Mnojim32.exe
        136⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Mqnfeh32.exe
        
        C:\Windows\system32\Mqnfeh32.exe
        137⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Mdibfgli.exe
        
        C:\Windows\system32\Mdibfgli.exe
        138⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Mghobbkl.exe
        
        C:\Windows\system32\Mghobbkl.exe
        139⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Mkcjca32.exe
        
        C:\Windows\system32\Mkcjca32.exe
        140⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Mbmbpk32.exe
        
        C:\Windows\system32\Mbmbpk32.exe
        141⤵
        
        PID:7972

C:\Windows\SysWOW64\Mqpckhbm.exe
C:\Windows\system32\Mqpckhbm.exe
1⤵
PID:4780
- C:\Windows\SysWOW64\Mhgklebo.exe
  C:\Windows\system32\Mhgklebo.exe
  2⤵
  PID:7232
- - C:\Windows\SysWOW64\Mkeghqac.exe
    C:\Windows\system32\Mkeghqac.exe
    3⤵
    PID:7932
  - - C:\Windows\SysWOW64\Mndcdlqf.exe
      C:\Windows\system32\Mndcdlqf.exe
      4⤵
      PID:7248
    - - C:\Windows\SysWOW64\Mbppek32.exe
        
        C:\Windows\system32\Mbppek32.exe
        5⤵
        
        PID:10908
      - C:\Windows\SysWOW64\Mdnlaf32.exe
        
        C:\Windows\system32\Mdnlaf32.exe
        6⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Mglhma32.exe
        
        C:\Windows\system32\Mglhma32.exe
        7⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Mkhdnppp.exe
        
        C:\Windows\system32\Mkhdnppp.exe
        8⤵
        Modifies registry class
        
        PID:12292
        
        C:\Windows\SysWOW64\Mnfpjl32.exe
        
        C:\Windows\system32\Mnfpjl32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12312
        
        C:\Windows\SysWOW64\Mbblkjgm.exe
        
        C:\Windows\system32\Mbblkjgm.exe
        10⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\Mdphgffq.exe
        
        C:\Windows\system32\Mdphgffq.exe
        11⤵
        
        PID:12356
        
        C:\Windows\SysWOW64\Mnimpk32.exe
        
        C:\Windows\system32\Mnimpk32.exe
        12⤵
        
        PID:12372
        
        C:\Windows\SysWOW64\Ngaahaca.exe
        
        C:\Windows\system32\Ngaahaca.exe
        13⤵
        
        PID:12400
        
        C:\Windows\SysWOW64\Nbfefj32.exe
        
        C:\Windows\system32\Nbfefj32.exe
        14⤵
        
        PID:12416
        
        C:\Windows\SysWOW64\Ngcnnq32.exe
        
        C:\Windows\system32\Ngcnnq32.exe
        15⤵
        
        PID:12432
        
        C:\Windows\SysWOW64\Nnmfkkhl.exe
        
        C:\Windows\system32\Nnmfkkhl.exe
        16⤵
        
        PID:12448
        
        C:\Windows\SysWOW64\Nqlbgfhp.exe
        
        C:\Windows\system32\Nqlbgfhp.exe
        17⤵
        
        PID:12464
        
        C:\Windows\SysWOW64\Ngfkcp32.exe
        
        C:\Windows\system32\Ngfkcp32.exe
        18⤵
        
        PID:12480
        
        C:\Windows\SysWOW64\Nnpcpjfi.exe
        
        C:\Windows\system32\Nnpcpjfi.exe
        19⤵
        
        PID:12496
        
        C:\Windows\SysWOW64\Nejkmdnf.exe
        
        C:\Windows\system32\Nejkmdnf.exe
        20⤵
        
        PID:12512
        
        C:\Windows\SysWOW64\Noopjmnl.exe
        
        C:\Windows\system32\Noopjmnl.exe
        21⤵
        
        PID:12528
        
        C:\Windows\SysWOW64\Nqqlbe32.exe
        
        C:\Windows\system32\Nqqlbe32.exe
        22⤵
        
        PID:12544
        
        C:\Windows\SysWOW64\Nigdcc32.exe
        
        C:\Windows\system32\Nigdcc32.exe
        23⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\Nkfpon32.exe
        
        C:\Windows\system32\Nkfpon32.exe
        24⤵
        
        PID:12576
        
        C:\Windows\SysWOW64\Nndlkj32.exe
        
        C:\Windows\system32\Nndlkj32.exe
        25⤵
        
        PID:12592
        
        C:\Windows\SysWOW64\Oendhdjq.exe
        
        C:\Windows\system32\Oendhdjq.exe
        26⤵
        
        PID:12608
        
        C:\Windows\SysWOW64\Okhmenan.exe
        
        C:\Windows\system32\Okhmenan.exe
        27⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Ongiaiqa.exe
        
        C:\Windows\system32\Ongiaiqa.exe
        28⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\Oilmnbpg.exe
        
        C:\Windows\system32\Oilmnbpg.exe
        29⤵
        
        PID:12656
        
        C:\Windows\SysWOW64\Opfekl32.exe
        
        C:\Windows\system32\Opfekl32.exe
        30⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\Obdbgh32.exe
        
        C:\Windows\system32\Obdbgh32.exe
        31⤵
        Modifies registry class
        
        PID:12688
        
        C:\Windows\SysWOW64\Oiojdb32.exe
        
        C:\Windows\system32\Oiojdb32.exe
        32⤵
        
        PID:12772
        
        C:\Windows\SysWOW64\Pniomgpl.exe
        
        C:\Windows\system32\Pniomgpl.exe
        33⤵
        
        PID:12788
        
        C:\Windows\SysWOW64\Qnlkcfni.exe
        
        C:\Windows\system32\Qnlkcfni.exe
        34⤵
        Modifies registry class
        
        PID:12804
        
        C:\Windows\SysWOW64\Qiappono.exe
        
        C:\Windows\system32\Qiappono.exe
        35⤵
        
        PID:12820
        
        C:\Windows\SysWOW64\Qpkhmi32.exe
        
        C:\Windows\system32\Qpkhmi32.exe
        36⤵
        
        PID:12836
        
        C:\Windows\SysWOW64\Qehqepcc.exe
        
        C:\Windows\system32\Qehqepcc.exe
        37⤵
        
        PID:12852
        
        C:\Windows\SysWOW64\Qhfmalbg.exe
        
        C:\Windows\system32\Qhfmalbg.exe
        38⤵
        
        PID:12868
        
        C:\Windows\SysWOW64\Albibj32.exe
        
        C:\Windows\system32\Albibj32.exe
        39⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\Aoqenf32.exe
        
        C:\Windows\system32\Aoqenf32.exe
        40⤵
        
        PID:12904
        
        C:\Windows\SysWOW64\Aaoaja32.exe
        
        C:\Windows\system32\Aaoaja32.exe
        41⤵
        
        PID:12920
        
        C:\Windows\SysWOW64\Appahiag.exe
        
        C:\Windows\system32\Appahiag.exe
        42⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\Abnnddpj.exe
        
        C:\Windows\system32\Abnnddpj.exe
        43⤵
        
        PID:12952
        
        C:\Windows\SysWOW64\Aihfanhg.exe
        
        C:\Windows\system32\Aihfanhg.exe
        44⤵
        
        PID:12968
        
        C:\Windows\SysWOW64\Apbnnh32.exe
        
        C:\Windows\system32\Apbnnh32.exe
        45⤵
        Drops file in System32 directory
        
        PID:12984
        
        C:\Windows\SysWOW64\Abqjjd32.exe
        
        C:\Windows\system32\Abqjjd32.exe
        46⤵
        Modifies registry class
        
        PID:13000
        
        C:\Windows\SysWOW64\Aikbfnfd.exe
        
        C:\Windows\system32\Aikbfnfd.exe
        47⤵
        
        PID:13040
        
        C:\Windows\SysWOW64\Baojaoke.exe
        
        C:\Windows\system32\Baojaoke.exe
        48⤵
        
        PID:13056
        
        C:\Windows\SysWOW64\Bifbbllg.exe
        
        C:\Windows\system32\Bifbbllg.exe
        49⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\Bhibni32.exe
        
        C:\Windows\system32\Bhibni32.exe
        50⤵
        
        PID:13088
        
        C:\Windows\SysWOW64\Bpqjofcd.exe
        
        C:\Windows\system32\Bpqjofcd.exe
        51⤵
        
        PID:13104
        
        C:\Windows\SysWOW64\Bbofkbbh.exe
        
        C:\Windows\system32\Bbofkbbh.exe
        52⤵
        
        PID:13140
        
        C:\Windows\SysWOW64\Bemcgmak.exe
        
        C:\Windows\system32\Bemcgmak.exe
        53⤵
        
        PID:13164
        
        C:\Windows\SysWOW64\Bhlocipo.exe
        
        C:\Windows\system32\Bhlocipo.exe
        54⤵
        
        PID:13180
        
        C:\Windows\SysWOW64\Blgkdg32.exe
        
        C:\Windows\system32\Blgkdg32.exe
        55⤵
        
        PID:13196
        
        C:\Windows\SysWOW64\Boegpc32.exe
        
        C:\Windows\system32\Boegpc32.exe
        56⤵
        
        PID:13220
        
        C:\Windows\SysWOW64\Bbacqape.exe
        
        C:\Windows\system32\Bbacqape.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13236
        
        C:\Windows\SysWOW64\Beppmmoi.exe
        
        C:\Windows\system32\Beppmmoi.exe
        58⤵
        
        PID:13260
        
        C:\Windows\SysWOW64\Chnlihnl.exe
        
        C:\Windows\system32\Chnlihnl.exe
        59⤵
        Drops file in System32 directory
        
        PID:13276
        
        C:\Windows\SysWOW64\Cccpfa32.exe
        
        C:\Windows\system32\Cccpfa32.exe
        60⤵
        
        PID:13292
        
        C:\Windows\SysWOW64\Ceblbm32.exe
        
        C:\Windows\system32\Ceblbm32.exe
        61⤵
        
        PID:13308
        
        C:\Windows\SysWOW64\Cpgqpe32.exe
        
        C:\Windows\system32\Cpgqpe32.exe
        62⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\Ccfmla32.exe
        
        C:\Windows\system32\Ccfmla32.exe
        63⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Cedihl32.exe
        
        C:\Windows\system32\Cedihl32.exe
        64⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\Clnadfbp.exe
        
        C:\Windows\system32\Clnadfbp.exe
        65⤵
        
        PID:12744
        
        C:\Windows\SysWOW64\Commqb32.exe
        
        C:\Windows\system32\Commqb32.exe
        66⤵
        Modifies registry class
        
        PID:12760
        
        C:\Windows\SysWOW64\Cefemliq.exe
        
        C:\Windows\system32\Cefemliq.exe
        67⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Clqnjf32.exe
        
        C:\Windows\system32\Clqnjf32.exe
        68⤵
        Drops file in System32 directory
        
        PID:1744
        
        C:\Windows\SysWOW64\Camfbm32.exe
        
        C:\Windows\system32\Camfbm32.exe
        69⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\Cidncj32.exe
        
        C:\Windows\system32\Cidncj32.exe
        70⤵
        Modifies registry class
        
        PID:13204
        
        C:\Windows\SysWOW64\Cpofpdgd.exe
        
        C:\Windows\system32\Cpofpdgd.exe
        71⤵
        
        PID:13324
        
        C:\Windows\SysWOW64\Capchmmb.exe
        
        C:\Windows\system32\Capchmmb.exe
        72⤵
        
        PID:13340
        
        C:\Windows\SysWOW64\Dhjkdg32.exe
        
        C:\Windows\system32\Dhjkdg32.exe
        73⤵
        
        PID:13356
        
        C:\Windows\SysWOW64\Dpacfd32.exe
        
        C:\Windows\system32\Dpacfd32.exe
        74⤵
        
        PID:13372
        
        C:\Windows\SysWOW64\Dcopbp32.exe
        
        C:\Windows\system32\Dcopbp32.exe
        75⤵
        
        PID:13388
        
        C:\Windows\SysWOW64\Diihojkb.exe
        
        C:\Windows\system32\Diihojkb.exe
        76⤵
        
        PID:13404
        
        C:\Windows\SysWOW64\Dlgdkeje.exe
        
        C:\Windows\system32\Dlgdkeje.exe
        77⤵
        
        PID:13420
        
        C:\Windows\SysWOW64\Dcalgo32.exe
        
        C:\Windows\system32\Dcalgo32.exe
        78⤵
        
        PID:13436
        
        C:\Windows\SysWOW64\Djlddi32.exe
        
        C:\Windows\system32\Djlddi32.exe
        79⤵
        
        PID:13452
        
        C:\Windows\SysWOW64\Dljqpd32.exe
        
        C:\Windows\system32\Dljqpd32.exe
        80⤵
        
        PID:13468
        
        C:\Windows\SysWOW64\Dagiil32.exe
        
        C:\Windows\system32\Dagiil32.exe
        81⤵
        
        PID:13484
        
        C:\Windows\SysWOW64\Djnaji32.exe
        
        C:\Windows\system32\Djnaji32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13500
        
        C:\Windows\SysWOW64\Dhqaefng.exe
        
        C:\Windows\system32\Dhqaefng.exe
        83⤵
        
        PID:13520
        
        C:\Windows\SysWOW64\Dphifcoi.exe
        
        C:\Windows\system32\Dphifcoi.exe
        84⤵
        
        PID:13540
        
        C:\Windows\SysWOW64\Dcfebonm.exe
        
        C:\Windows\system32\Dcfebonm.exe
        85⤵
        
        PID:13560
        
        C:\Windows\SysWOW64\Daifnk32.exe
        
        C:\Windows\system32\Daifnk32.exe
        86⤵
        
        PID:13576
        
        C:\Windows\SysWOW64\Djpnohej.exe
        
        C:\Windows\system32\Djpnohej.exe
        87⤵
        
        PID:13604
        
        C:\Windows\SysWOW64\Dchbhn32.exe
        
        C:\Windows\system32\Dchbhn32.exe
        88⤵
        
        PID:13620
        
        C:\Windows\SysWOW64\Ejbkehcg.exe
        
        C:\Windows\system32\Ejbkehcg.exe
        89⤵
        
        PID:13636
        
        C:\Windows\SysWOW64\Elagacbk.exe
        
        C:\Windows\system32\Elagacbk.exe
        90⤵
        
        PID:13652
        
        C:\Windows\SysWOW64\Eckonn32.exe
        
        C:\Windows\system32\Eckonn32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:13668
        
        C:\Windows\SysWOW64\Ebnoikqb.exe
        
        C:\Windows\system32\Ebnoikqb.exe
        92⤵
        
        PID:13684
        
        C:\Windows\SysWOW64\Ehhgfdho.exe
        
        C:\Windows\system32\Ehhgfdho.exe
        93⤵
        
        PID:13704
        
        C:\Windows\SysWOW64\Eoapbo32.exe
        
        C:\Windows\system32\Eoapbo32.exe
        94⤵
        
        PID:13720
        
        C:\Windows\SysWOW64\Ebploj32.exe
        
        C:\Windows\system32\Ebploj32.exe
        95⤵
        
        PID:13736
        
        C:\Windows\SysWOW64\Ehjdldfl.exe
        
        C:\Windows\system32\Ehjdldfl.exe
        96⤵
        
        PID:13752
        
        C:\Windows\SysWOW64\Eqalmafo.exe
        
        C:\Windows\system32\Eqalmafo.exe
        97⤵
        
        PID:13768
        
        C:\Windows\SysWOW64\Ecphimfb.exe
        
        C:\Windows\system32\Ecphimfb.exe
        98⤵
        
        PID:13784
        
        C:\Windows\SysWOW64\Efneehef.exe
        
        C:\Windows\system32\Efneehef.exe
        99⤵
        
        PID:13800
        
        C:\Windows\SysWOW64\Elhmablc.exe
        
        C:\Windows\system32\Elhmablc.exe
        100⤵
        
        PID:13816
        
        C:\Windows\SysWOW64\Ecbenm32.exe
        
        C:\Windows\system32\Ecbenm32.exe
        101⤵
        
        PID:13832
        
        C:\Windows\SysWOW64\Ejlmkgkl.exe
        
        C:\Windows\system32\Ejlmkgkl.exe
        102⤵
        
        PID:13848
        
        C:\Windows\SysWOW64\Eqfeha32.exe
        
        C:\Windows\system32\Eqfeha32.exe
        103⤵
        
        PID:13864
        
        C:\Windows\SysWOW64\Ecdbdl32.exe
        
        C:\Windows\system32\Ecdbdl32.exe
        104⤵
        
        PID:13880
        
        C:\Windows\SysWOW64\Ffbnph32.exe
        
        C:\Windows\system32\Ffbnph32.exe
        105⤵
        
        PID:13896
        
        C:\Windows\SysWOW64\Fhajlc32.exe
        
        C:\Windows\system32\Fhajlc32.exe
        106⤵
        
        PID:13912
        
        C:\Windows\SysWOW64\Fqhbmqqg.exe
        
        C:\Windows\system32\Fqhbmqqg.exe
        107⤵
        
        PID:13928
        
        C:\Windows\SysWOW64\Fbioei32.exe
        
        C:\Windows\system32\Fbioei32.exe
        108⤵
        
        PID:13944
        
        C:\Windows\SysWOW64\Fjqgff32.exe
        
        C:\Windows\system32\Fjqgff32.exe
        109⤵
        
        PID:13960
        
        C:\Windows\SysWOW64\Ficgacna.exe
        
        C:\Windows\system32\Ficgacna.exe
        110⤵
        
        PID:13972
        
        C:\Windows\SysWOW64\Fomonm32.exe
        
        C:\Windows\system32\Fomonm32.exe
        111⤵
        
        PID:13996
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        112⤵
        
        PID:14012
        
        C:\Windows\SysWOW64\Fifdgblo.exe
        
        C:\Windows\system32\Fifdgblo.exe
        113⤵
        
        PID:14028
        
        C:\Windows\SysWOW64\Fopldmcl.exe
        
        C:\Windows\system32\Fopldmcl.exe
        114⤵
        
        PID:14056
        
        C:\Windows\SysWOW64\Fbnhphbp.exe
        
        C:\Windows\system32\Fbnhphbp.exe
        115⤵
        
        PID:14072
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        116⤵
        
        PID:14096
        
        C:\Windows\SysWOW64\Fihqmb32.exe
        
        C:\Windows\system32\Fihqmb32.exe
        117⤵
        
        PID:14116
        
        C:\Windows\SysWOW64\Fqohnp32.exe
        
        C:\Windows\system32\Fqohnp32.exe
        118⤵
        
        PID:14136
        
        C:\Windows\SysWOW64\Fcnejk32.exe
        
        C:\Windows\system32\Fcnejk32.exe
        119⤵
        Drops file in System32 directory
        
        PID:14160
        
        C:\Windows\SysWOW64\Fflaff32.exe
        
        C:\Windows\system32\Fflaff32.exe
        120⤵
        
        PID:14184
        
        C:\Windows\SysWOW64\Fijmbb32.exe
        
        C:\Windows\system32\Fijmbb32.exe
        121⤵
        
        PID:14204
        
        C:\Windows\SysWOW64\Fqaeco32.exe
        
        C:\Windows\system32\Fqaeco32.exe
        122⤵
        
        PID:14216
        
        C:\Windows\SysWOW64\Gcpapkgp.exe
        
        C:\Windows\system32\Gcpapkgp.exe
        123⤵
        
        PID:14240
        
        C:\Windows\SysWOW64\Gbcakg32.exe
        
        C:\Windows\system32\Gbcakg32.exe
        124⤵
        
        PID:14256
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        125⤵
        Drops file in System32 directory
        
        PID:14272
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        126⤵
        Modifies registry class
        
        PID:14296
        
        C:\Windows\SysWOW64\Gfqjafdq.exe
        
        C:\Windows\system32\Gfqjafdq.exe
        127⤵
        
        PID:14312
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        128⤵
        
        PID:14328
        
        C:\Windows\SysWOW64\Gcekkjcj.exe
        
        C:\Windows\system32\Gcekkjcj.exe
        129⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Gbgkfg32.exe
        
        C:\Windows\system32\Gbgkfg32.exe
        130⤵
        
        PID:13492
        
        C:\Windows\SysWOW64\Giacca32.exe
        
        C:\Windows\system32\Giacca32.exe
        131⤵
        
        PID:13532
        
        C:\Windows\SysWOW64\Gqikdn32.exe
        
        C:\Windows\system32\Gqikdn32.exe
        132⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        133⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        134⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        135⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        136⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        137⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        138⤵
        Drops file in System32 directory
        
        PID:1180
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        139⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        140⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\Hapaemll.exe
        
        C:\Windows\system32\Hapaemll.exe
        141⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        142⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        143⤵
        
        PID:3804
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        144⤵
        
        PID:14036
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        145⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        146⤵
        
        PID:13032
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        147⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        148⤵
        
        PID:13252
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        149⤵
        
        PID:14156
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        150⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        151⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        152⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        153⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        154⤵
        
        PID:908
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        155⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        156⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        157⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        158⤵
        Modifies registry class
        
        PID:2180
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        159⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        160⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        161⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        162⤵
        
        PID:880
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        163⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4120
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        165⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        166⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\Ijkljp32.exe
        
        C:\Windows\system32\Ijkljp32.exe
        167⤵
        
        PID:14232
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        168⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        169⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        170⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        171⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        172⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        173⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        174⤵
        
        PID:876
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        175⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        176⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        177⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        178⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        179⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        180⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        181⤵
        
        PID:540
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        182⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        183⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        184⤵
        
        PID:14348
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        185⤵
        
        PID:14364
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        186⤵
        
        PID:14384
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        187⤵
        
        PID:14404
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        188⤵
        
        PID:14420
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        189⤵
        
        PID:14448
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        190⤵
        
        PID:14464
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        191⤵
        
        PID:14484
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        192⤵
        
        PID:14508
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        193⤵
        
        PID:14536
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        194⤵
        
        PID:14552
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        195⤵
        
        PID:14572
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        196⤵
        
        PID:14600
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        197⤵
        
        PID:14620
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        198⤵
        
        PID:14640
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        199⤵
        
        PID:14664
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        200⤵
        
        PID:14688
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        201⤵
        
        PID:14712
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        202⤵
        
        PID:14736
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        203⤵
        
        PID:14756
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        204⤵
        
        PID:14772
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        205⤵
        
        PID:14792
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        206⤵
        
        PID:14820
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        207⤵
        
        PID:14840
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        208⤵
        
        PID:14856
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        209⤵
        
        PID:14872
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        210⤵
        
        PID:14884
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        211⤵
        
        PID:14904
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        212⤵
        
        PID:14920
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        213⤵
        
        PID:14936
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        214⤵
        
        PID:14952
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        215⤵
        
        PID:14968
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        216⤵
        
        PID:14984
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        217⤵
        
        PID:15000
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        218⤵
        Modifies registry class
        
        PID:15016
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        219⤵
        
        PID:15032
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        220⤵
        
        PID:15048
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        221⤵
        Drops file in System32 directory
        
        PID:15064
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        222⤵
        
        PID:15080
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        223⤵
        
        PID:15096
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        224⤵
        Drops file in System32 directory
        
        PID:15112
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        225⤵
        
        PID:15128
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        226⤵
        
        PID:15144
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        227⤵
        
        PID:15160
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        228⤵
        
        PID:15184
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        229⤵
        
        PID:15204
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        230⤵
        
        PID:15228
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        231⤵
        
        PID:15248
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:15272
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        233⤵
        
        PID:15288
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        234⤵
        
        PID:15308
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        235⤵
        
        PID:15328
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        236⤵
        
        PID:15352
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        237⤵
        
        PID:14412
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        238⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        239⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        240⤵
        
        PID:14564
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        241⤵
        
        PID:14596
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        242⤵
        
        PID:14632
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        243⤵
        
        PID:14656
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        244⤵
        
        PID:14708
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        245⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        246⤵
        Modifies registry class
        
        PID:4572
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        247⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        248⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        249⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        250⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        251⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        252⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        253⤵
        Modifies registry class
        
        PID:4156
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        254⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        255⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        256⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        257⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        258⤵
        
        PID:15172
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        259⤵
        
        PID:15212
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        260⤵
        
        PID:15256
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        261⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        262⤵
        
        PID:14380
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        263⤵
        
        PID:14476
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        264⤵
        
        PID:14532
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        265⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        266⤵
        
        PID:412
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        267⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        268⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        269⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        270⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        271⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        272⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        273⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        274⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        275⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2236
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        277⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        278⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        279⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        280⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        281⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        282⤵
        Modifies registry class
        
        PID:1708
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        283⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        284⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        285⤵
        
        PID:308
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        286⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        287⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        288⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        289⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        290⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        291⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        292⤵
        
        PID:936
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        293⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        294⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        295⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        296⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        297⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        298⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        299⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        300⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        301⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        302⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        303⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        304⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        305⤵
        
        PID:964
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        306⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        307⤵
        Drops file in System32 directory
        
        PID:4852
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        308⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        309⤵
        
        PID:4304

C:\Windows\SysWOW64\Cbcilkjg.exe
C:\Windows\system32\Cbcilkjg.exe
1⤵
- Drops file in System32 directory
PID:5224
- C:\Windows\SysWOW64\Ceaehfjj.exe
  C:\Windows\system32\Ceaehfjj.exe
  2⤵
  PID:3676
- - C:\Windows\SysWOW64\Clkndpag.exe
    C:\Windows\system32\Clkndpag.exe
    3⤵
    PID:4028
  - - C:\Windows\SysWOW64\Cknnpm32.exe
      C:\Windows\system32\Cknnpm32.exe
      4⤵
      PID:5272
    - - C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        5⤵
        
        PID:3848
      - C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        6⤵
        Drops file in System32 directory
        
        PID:3104
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        7⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        8⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        9⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        10⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        11⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        12⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        13⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        14⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        15⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        16⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        17⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        18⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        19⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        20⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        21⤵
        
        PID:5720

C:\Windows\SysWOW64\Dhkapp32.exe
C:\Windows\system32\Dhkapp32.exe
1⤵
PID:5744
- C:\Windows\SysWOW64\Deoaid32.exe
  C:\Windows\system32\Deoaid32.exe
  2⤵
  PID:5260
- - C:\Windows\SysWOW64\Deanodkh.exe
    C:\Windows\system32\Deanodkh.exe
    3⤵
    PID:5768
  - - C:\Windows\SysWOW64\Dhpjkojk.exe
      C:\Windows\system32\Dhpjkojk.exe
      4⤵
      PID:5324
    - - C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        5⤵
        
        PID:5340
      - C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        6⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        7⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        8⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        9⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        10⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        11⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        12⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        13⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        14⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        15⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        16⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        17⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        18⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        19⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        20⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        21⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        22⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        23⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        24⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        25⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        26⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        27⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        28⤵
        
        PID:5924

C:\Windows\SysWOW64\Fdialn32.exe
C:\Windows\system32\Fdialn32.exe
1⤵
PID:5648
- C:\Windows\SysWOW64\Flqimk32.exe
  C:\Windows\system32\Flqimk32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:5960
- - C:\Windows\SysWOW64\Fkciihgg.exe
    C:\Windows\system32\Fkciihgg.exe
    3⤵
    PID:5996
  - - C:\Windows\SysWOW64\Fckajehi.exe
      C:\Windows\system32\Fckajehi.exe
      4⤵
      Drops file in System32 directory
      PID:6012
    - - C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        5⤵
        
        PID:6248
      - C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        6⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        7⤵
        Modifies registry class
        
        PID:6060
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6084
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        9⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        10⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        11⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        12⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        13⤵
        
        PID:6444

C:\Windows\SysWOW64\Gfngap32.exe
C:\Windows\system32\Gfngap32.exe
1⤵
PID:5624
- C:\Windows\SysWOW64\Ghlcnk32.exe
  C:\Windows\system32\Ghlcnk32.exe
  2⤵
  PID:5592
- - C:\Windows\SysWOW64\Gofkje32.exe
    C:\Windows\system32\Gofkje32.exe
    3⤵
    PID:5796
  - - C:\Windows\SysWOW64\Gbdgfa32.exe
      C:\Windows\system32\Gbdgfa32.exe
      4⤵
      PID:6528
    - - C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        5⤵
        
        PID:6172
      - C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        6⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        7⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        8⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        9⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        10⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        11⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        12⤵
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        13⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        14⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        15⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        16⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        17⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        18⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        19⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        20⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        21⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        22⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        23⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        24⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        25⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6476
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        27⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        28⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        29⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        30⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        31⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        32⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6964

C:\Windows\SysWOW64\Iejcji32.exe
C:\Windows\system32\Iejcji32.exe
1⤵
PID:7048
- C:\Windows\SysWOW64\Imakkfdg.exe
  C:\Windows\system32\Imakkfdg.exe
  2⤵
  PID:6720
- - C:\Windows\SysWOW64\Ippggbck.exe
    C:\Windows\system32\Ippggbck.exe
    3⤵
    PID:6772
  - - C:\Windows\SysWOW64\Ibnccmbo.exe
      C:\Windows\system32\Ibnccmbo.exe
      4⤵
      PID:7160
    - - C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        5⤵
        
        PID:6820
      - C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        6⤵
        
        PID:6832

C:\Windows\SysWOW64\Ilghlc32.exe
C:\Windows\system32\Ilghlc32.exe
1⤵
PID:6840
- C:\Windows\SysWOW64\Icnpmp32.exe
  C:\Windows\system32\Icnpmp32.exe
  2⤵
  PID:6216
- - C:\Windows\SysWOW64\Ifllil32.exe
    C:\Windows\system32\Ifllil32.exe
    3⤵
    - Modifies registry class
    PID:6672
  - - C:\Windows\SysWOW64\Iikhfg32.exe
      C:\Windows\system32\Iikhfg32.exe
      4⤵
      PID:6920
    - - C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        5⤵
        Modifies registry class
        
        PID:6952
      - C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        6⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        7⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        8⤵
        
        PID:7040

C:\Windows\SysWOW64\Jmhale32.exe
C:\Windows\system32\Jmhale32.exe
1⤵
PID:6784
- C:\Windows\SysWOW64\Jlkagbej.exe
  C:\Windows\system32\Jlkagbej.exe
  2⤵
  PID:6764
- - C:\Windows\SysWOW64\Jcbihpel.exe
    C:\Windows\system32\Jcbihpel.exe
    3⤵
    PID:7060
  - - C:\Windows\SysWOW64\Jmknaell.exe
      C:\Windows\system32\Jmknaell.exe
      4⤵
      PID:6256

C:\Windows\SysWOW64\Jbhfjljd.exe
C:\Windows\system32\Jbhfjljd.exe
1⤵
PID:6852
- C:\Windows\SysWOW64\Jfcbjk32.exe
  C:\Windows\system32\Jfcbjk32.exe
  2⤵
  PID:7148
- - C:\Windows\SysWOW64\Jmmjgejj.exe
    C:\Windows\system32\Jmmjgejj.exe
    3⤵
    PID:6996
  - - C:\Windows\SysWOW64\Jlpkba32.exe
      C:\Windows\system32\Jlpkba32.exe
      4⤵
      PID:7008
    - - C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        5⤵
        
        PID:6504
      - C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        6⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        7⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        8⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        9⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        10⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        11⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        12⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        13⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        14⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        15⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        16⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        17⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        18⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        19⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        20⤵
        Modifies registry class
        
        PID:7384
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        21⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        22⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        23⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        24⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        25⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        26⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        27⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        28⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        29⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        30⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        31⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        32⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        33⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        34⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        35⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        36⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        37⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        38⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        39⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        40⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        41⤵
        Modifies registry class
        
        PID:7464
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7856
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        43⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        44⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        45⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        46⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        47⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        48⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        49⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        50⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        51⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        52⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        53⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        54⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        55⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        56⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        57⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        58⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        59⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        60⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        61⤵
        
        PID:804
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        62⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        63⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        64⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        65⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        66⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        67⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        68⤵
        
        PID:8300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Dajnff32.exe

Filesize
51KB

MD5
f658e24566fb0f76f3b4da0373f0fd02

SHA1
fa4c80789f0f5a937ac21b6d94285cfda1f16a96

SHA256
b69c615dd36e6ebfce61ec6235fa81ae16a5a2bb2a40dfba88b45185324bece3

SHA512
38409d5468f4091d11a08ed649e8c592e99f6714fe2f84e0132d9662c60852288170367a6ae962386c3d9ff888a8ee24331949d7b4759ed1d27d5ef7d2022e10

Download Submit
C:\Windows\SysWOW64\Dajnff32.exe

Filesize
51KB

MD5
f658e24566fb0f76f3b4da0373f0fd02

SHA1
fa4c80789f0f5a937ac21b6d94285cfda1f16a96

SHA256
b69c615dd36e6ebfce61ec6235fa81ae16a5a2bb2a40dfba88b45185324bece3

SHA512
38409d5468f4091d11a08ed649e8c592e99f6714fe2f84e0132d9662c60852288170367a6ae962386c3d9ff888a8ee24331949d7b4759ed1d27d5ef7d2022e10

Download Submit
C:\Windows\SysWOW64\Dalkkegj.exe

Filesize
51KB

MD5
4ec4546a4a273d34592f61eaaf11c751

SHA1
2430ab1bdefaae97a744de9bcf5c08af7bb64c50

SHA256
6c7051440d31e84428932c6f61b13894fdfd3320565181d79d295b9ebcca7f10

SHA512
2256e13093247fd15faab0ba585d71d8490775866cc0812abccba7f9f0e034ab437c29ec186cac92683ce594b860fc506585cea26f2095c0402d9e74f4514b4f

Download Submit
C:\Windows\SysWOW64\Dalkkegj.exe

Filesize
51KB

MD5
4ec4546a4a273d34592f61eaaf11c751

SHA1
2430ab1bdefaae97a744de9bcf5c08af7bb64c50

SHA256
6c7051440d31e84428932c6f61b13894fdfd3320565181d79d295b9ebcca7f10

SHA512
2256e13093247fd15faab0ba585d71d8490775866cc0812abccba7f9f0e034ab437c29ec186cac92683ce594b860fc506585cea26f2095c0402d9e74f4514b4f

Download Submit
C:\Windows\SysWOW64\Diepbbfi.exe

Filesize
51KB

MD5
40d180562582f301b85f44a5f08762d8

SHA1
9360cd8ae23f4888f306f79c996ce1f10f0596e4

SHA256
929844460f72021638023fd8557a456d8b58b9474a0cae2c32767b095685728a

SHA512
0d749d84bb7c72b6376cde5f456647635a55ca562d55c6e32b961fd06dd7aa6f50f99a8320645024664e30b5b7a33a0c50352d6525e052072c3b5f5b9d340c3d

Download Submit
C:\Windows\SysWOW64\Diepbbfi.exe

Filesize
51KB

MD5
40d180562582f301b85f44a5f08762d8

SHA1
9360cd8ae23f4888f306f79c996ce1f10f0596e4

SHA256
929844460f72021638023fd8557a456d8b58b9474a0cae2c32767b095685728a

SHA512
0d749d84bb7c72b6376cde5f456647635a55ca562d55c6e32b961fd06dd7aa6f50f99a8320645024664e30b5b7a33a0c50352d6525e052072c3b5f5b9d340c3d

Download Submit
C:\Windows\SysWOW64\Dlaoingp.exe

Filesize
51KB

MD5
28e31caf1ff6ba5804f784986b00d93e

SHA1
658bfab238700ca26bb14aeed4ca0103078c08da

SHA256
0446ba2f5e670304f36682207c43eed5e4befcd99324a51a3c2ea967aa2840ea

SHA512
b791f82182c7a07974ce8f7e8925de4641d29bfb644f9ff19ff8da1915ca459cd644b31d8ec649b0ec30ff50e9ece775f8e31331ceeca1f123e2d0ca8966a8d1

Download Submit
C:\Windows\SysWOW64\Dlaoingp.exe

Filesize
51KB

MD5
28e31caf1ff6ba5804f784986b00d93e

SHA1
658bfab238700ca26bb14aeed4ca0103078c08da

SHA256
0446ba2f5e670304f36682207c43eed5e4befcd99324a51a3c2ea967aa2840ea

SHA512
b791f82182c7a07974ce8f7e8925de4641d29bfb644f9ff19ff8da1915ca459cd644b31d8ec649b0ec30ff50e9ece775f8e31331ceeca1f123e2d0ca8966a8d1

Download Submit
C:\Windows\SysWOW64\Dlobco32.exe

Filesize
51KB

MD5
87bbb580e40bcaa76ccd60755edf493e

SHA1
4d8959b8ab0fe78a40cd824d0821dfda5258f4ad

SHA256
907fc6608fc07e9fb3e75691911091dde3b6d64a4d0a098a454a05b509ff6caf

SHA512
9d7232c51a484907ac3072a76304324b287ac72bdafe76e5d76615db98cf46c857a42939f32f43cbe55a5ca9393289d5afbda8aaea14eededa7000254ab9ea07

Download Submit
C:\Windows\SysWOW64\Dlobco32.exe

Filesize
51KB

MD5
87bbb580e40bcaa76ccd60755edf493e

SHA1
4d8959b8ab0fe78a40cd824d0821dfda5258f4ad

SHA256
907fc6608fc07e9fb3e75691911091dde3b6d64a4d0a098a454a05b509ff6caf

SHA512
9d7232c51a484907ac3072a76304324b287ac72bdafe76e5d76615db98cf46c857a42939f32f43cbe55a5ca9393289d5afbda8aaea14eededa7000254ab9ea07

Download Submit
C:\Windows\SysWOW64\Eeajbc32.exe

Filesize
51KB

MD5
52cf12255900a092468cd816e681d654

SHA1
45c8b1fb01029f02359af76192c0e18bc6f01066

SHA256
381b26b413ef358cb86bdec0a3c7bb079ad83eb13a9373238962260ab67ed556

SHA512
9a68d41966cbd79d9166357b5f07e94230b0ee8b7a57ef55725e32d083f4441bcb5970ab8c2bea239169e62abdd9b0389a9e464125677a1da221ca0e049c8a3f

Download Submit
C:\Windows\SysWOW64\Eeajbc32.exe

Filesize
51KB

MD5
52cf12255900a092468cd816e681d654

SHA1
45c8b1fb01029f02359af76192c0e18bc6f01066

SHA256
381b26b413ef358cb86bdec0a3c7bb079ad83eb13a9373238962260ab67ed556

SHA512
9a68d41966cbd79d9166357b5f07e94230b0ee8b7a57ef55725e32d083f4441bcb5970ab8c2bea239169e62abdd9b0389a9e464125677a1da221ca0e049c8a3f

Download Submit
C:\Windows\SysWOW64\Eecfhb32.exe

Filesize
51KB

MD5
c155ab92de52d07627413fc0ede5d24b

SHA1
77749cecbcc46a444dfe2aec7f77cb4ad622b283

SHA256
606689c75a0b516ec305bdf58dff751e7c2bb491732cd5840da39a718d4ea0fb

SHA512
2ad1671d27329f046c3eff9ce5edacf2a8ba07170ff4c4cf34a0e4bef8d60aa6102dc40b109ded915e5073bcba490b0e1169d8f50666bb8f4edae35df6a586f8

Download Submit
C:\Windows\SysWOW64\Eecfhb32.exe

Filesize
51KB

MD5
c155ab92de52d07627413fc0ede5d24b

SHA1
77749cecbcc46a444dfe2aec7f77cb4ad622b283

SHA256
606689c75a0b516ec305bdf58dff751e7c2bb491732cd5840da39a718d4ea0fb

SHA512
2ad1671d27329f046c3eff9ce5edacf2a8ba07170ff4c4cf34a0e4bef8d60aa6102dc40b109ded915e5073bcba490b0e1169d8f50666bb8f4edae35df6a586f8

Download Submit
C:\Windows\SysWOW64\Eeommcjk.exe

Filesize
51KB

MD5
6b1f97740fa6f3e49afbe29de4440bbf

SHA1
b917f92fd843c993862ac477960de4787fc64fc1

SHA256
a179e8636f1fb3b8774bee4a461fc16c123a30f2999716568c9665bc99901272

SHA512
834024aad52877ce2b142f883258ba1c1b77bc5d05b3b33ca4f724cc299ee3717e3f6925d365119cdfc7db5ca33e522a3bb54fb81246db95dc9f19065dfdf8c0

Download Submit
C:\Windows\SysWOW64\Eeommcjk.exe

Filesize
51KB

MD5
6b1f97740fa6f3e49afbe29de4440bbf

SHA1
b917f92fd843c993862ac477960de4787fc64fc1

SHA256
a179e8636f1fb3b8774bee4a461fc16c123a30f2999716568c9665bc99901272

SHA512
834024aad52877ce2b142f883258ba1c1b77bc5d05b3b33ca4f724cc299ee3717e3f6925d365119cdfc7db5ca33e522a3bb54fb81246db95dc9f19065dfdf8c0

Download Submit
C:\Windows\SysWOW64\Eihlhb32.exe

Filesize
51KB

MD5
53211c783c1be71990b97c3a328563ae

SHA1
e1c671a91cde78bdd51ccaf55d4f1e2f19f562d3

SHA256
3ad17c5e0da0b226ee1fed13ec43d4bcf82de471e1ee6a347d280b5448ef36ed

SHA512
18e9ca8186c02382e34a2ee165b7d47afff7ea9e880748286df63ffa49185481e16e7dd86e9e7fad38e62fe3446bbacd53d689a0f8d79e7ba8ece0f7f028442e

Download Submit
C:\Windows\SysWOW64\Eihlhb32.exe

Filesize
51KB

MD5
53211c783c1be71990b97c3a328563ae

SHA1
e1c671a91cde78bdd51ccaf55d4f1e2f19f562d3

SHA256
3ad17c5e0da0b226ee1fed13ec43d4bcf82de471e1ee6a347d280b5448ef36ed

SHA512
18e9ca8186c02382e34a2ee165b7d47afff7ea9e880748286df63ffa49185481e16e7dd86e9e7fad38e62fe3446bbacd53d689a0f8d79e7ba8ece0f7f028442e

Download Submit
C:\Windows\SysWOW64\Enedpi32.exe

Filesize
51KB

MD5
a32565424a3cf85dcd884045215f42e8

SHA1
cb861aa20e177037ea367d4a9bf556b270ecaa5d

SHA256
78c10314dacd34f0068769a0f7094a229762beb4ccc41b727380a265a4470258

SHA512
ec4d976d57c911c15576481a90f5f0e734e1974f7c5902754d4870d1959deb60e5596d1b38b2188fe02db92612ac4bd4d8ff1f19c4fdf6984d6cd9b904f2c6d2

Download Submit
C:\Windows\SysWOW64\Enedpi32.exe

Filesize
51KB

MD5
a32565424a3cf85dcd884045215f42e8

SHA1
cb861aa20e177037ea367d4a9bf556b270ecaa5d

SHA256
78c10314dacd34f0068769a0f7094a229762beb4ccc41b727380a265a4470258

SHA512
ec4d976d57c911c15576481a90f5f0e734e1974f7c5902754d4870d1959deb60e5596d1b38b2188fe02db92612ac4bd4d8ff1f19c4fdf6984d6cd9b904f2c6d2

Download Submit
C:\Windows\SysWOW64\Engaei32.exe

Filesize
51KB

MD5
0ee840764545791a8175a742c5adbe03

SHA1
b9c55e5cbc17432ae084b68c0d1bd1fb3a67634c

SHA256
b74c909920f5041464bb62713bbeaad8f4c12f509025c4301bd89d4bb9226b2e

SHA512
9c338769d2fb50225141c14f162da1293048c629504c65755fbea5a690815a6160b29808a446da9a5e19c49b152d591fdc15ecca1c66c6f534634afe2927977d

Download Submit
C:\Windows\SysWOW64\Engaei32.exe

Filesize
51KB

MD5
0ee840764545791a8175a742c5adbe03

SHA1
b9c55e5cbc17432ae084b68c0d1bd1fb3a67634c

SHA256
b74c909920f5041464bb62713bbeaad8f4c12f509025c4301bd89d4bb9226b2e

SHA512
9c338769d2fb50225141c14f162da1293048c629504c65755fbea5a690815a6160b29808a446da9a5e19c49b152d591fdc15ecca1c66c6f534634afe2927977d

Download Submit
C:\Windows\SysWOW64\Eninkhni.exe

Filesize
51KB

MD5
a9b82ec985dd781fc67b0c2e1b4f2d28

SHA1
a62c92cf30f978658bcd546fd42220b7d4c6d36e

SHA256
014cd49cfc44df250798a140d54bc4878474991078760e8b6fd08eefa3c5804e

SHA512
b77472773167f8c95f12a3b8648d4b93d40db34357d2b94e5cb76d77916e970a1a0f877dcffcb991135b5f545807a6f7b9141930c935c2b5970c6c4f3ac8ded4

Download Submit
C:\Windows\SysWOW64\Eninkhni.exe

Filesize
51KB

MD5
a9b82ec985dd781fc67b0c2e1b4f2d28

SHA1
a62c92cf30f978658bcd546fd42220b7d4c6d36e

SHA256
014cd49cfc44df250798a140d54bc4878474991078760e8b6fd08eefa3c5804e

SHA512
b77472773167f8c95f12a3b8648d4b93d40db34357d2b94e5cb76d77916e970a1a0f877dcffcb991135b5f545807a6f7b9141930c935c2b5970c6c4f3ac8ded4

Download Submit
C:\Windows\SysWOW64\Fhiidm32.exe

Filesize
51KB

MD5
f8c10267476eb5628b5c2f463c3cba92

SHA1
d61d91cd727a5be0ff560440b8c27fd7e2698b59

SHA256
d4affd821c185bfedcf58a08839dd8398030a971f902bc4088ca46344bfd395b

SHA512
944624e2a429c8ef51c08b479433e9d8cb3df3d7759ed15a19891d0d5802f3587df0c252fd5087c5d89f7fe876ec51fc3624501357805f0f3c2e5a411170ed5d

Download Submit
C:\Windows\SysWOW64\Fhiidm32.exe

Filesize
51KB

MD5
f8c10267476eb5628b5c2f463c3cba92

SHA1
d61d91cd727a5be0ff560440b8c27fd7e2698b59

SHA256
d4affd821c185bfedcf58a08839dd8398030a971f902bc4088ca46344bfd395b

SHA512
944624e2a429c8ef51c08b479433e9d8cb3df3d7759ed15a19891d0d5802f3587df0c252fd5087c5d89f7fe876ec51fc3624501357805f0f3c2e5a411170ed5d

Download Submit
C:\Windows\SysWOW64\Fhpoelii.exe

Filesize
51KB

MD5
0543b0898b9480f4025ae199ab270d13

SHA1
92074691b7564b16a918ee29bb36b0b71f846ccd

SHA256
d6da816515819c5311d2b1d87b76ab39af9c5a33b7e4c1f9b65404f988cf9718

SHA512
ea5a7bfdeb90a22c08c5ff79c4df2493762a002e4e66d3abc5231b6212ba9c603cca6f8e49ad0530ff0962fb505e5915aa40d1462b4aaacdb38d39649857c53f

Download Submit
C:\Windows\SysWOW64\Fhpoelii.exe

Filesize
51KB

MD5
0543b0898b9480f4025ae199ab270d13

SHA1
92074691b7564b16a918ee29bb36b0b71f846ccd

SHA256
d6da816515819c5311d2b1d87b76ab39af9c5a33b7e4c1f9b65404f988cf9718

SHA512
ea5a7bfdeb90a22c08c5ff79c4df2493762a002e4e66d3abc5231b6212ba9c603cca6f8e49ad0530ff0962fb505e5915aa40d1462b4aaacdb38d39649857c53f

Download Submit
C:\Windows\SysWOW64\Fiheopfd.exe

Filesize
51KB

MD5
bb23c9ee3eb5443849332cef5140e702

SHA1
83eac358af2ca04856acfb5c247ca4e8cd0c0ebf

SHA256
08ea59d3c83484de0c286a5edc768254cd1176686e94f4f4f1c3e5cfc7eab18b

SHA512
d7af63d18ca2e9b3857f8cdf128c1d2389c85cb560d87aeeef9685472bb7df195679080833db87b24efeb0a221b5ff209d91f032774725a5605f66b5f525b044

Download Submit
C:\Windows\SysWOW64\Fiheopfd.exe

Filesize
51KB

MD5
bb23c9ee3eb5443849332cef5140e702

SHA1
83eac358af2ca04856acfb5c247ca4e8cd0c0ebf

SHA256
08ea59d3c83484de0c286a5edc768254cd1176686e94f4f4f1c3e5cfc7eab18b

SHA512
d7af63d18ca2e9b3857f8cdf128c1d2389c85cb560d87aeeef9685472bb7df195679080833db87b24efeb0a221b5ff209d91f032774725a5605f66b5f525b044

Download Submit
C:\Windows\SysWOW64\Fikbdpda.exe

Filesize
51KB

MD5
f1a748473f9c20e28d7c41941667efc5

SHA1
0421322c21eb0bb0f4e2554c668a371dcc2f8d19

SHA256
1460a630d77de36aa29637cf5fe9dac377ce1f9cd09c26c2dd0848adbe3b16e0

SHA512
1d66b53970eccf2a4fd5bafa426d81e6664e80c380fd33a10a5b48bc3f87d0490936da02549adc17dbb9a32fec7a16494ea32cfdeb8ca2605c7f8966fd417d54

Download Submit
C:\Windows\SysWOW64\Fikbdpda.exe

Filesize
51KB

MD5
f1a748473f9c20e28d7c41941667efc5

SHA1
0421322c21eb0bb0f4e2554c668a371dcc2f8d19

SHA256
1460a630d77de36aa29637cf5fe9dac377ce1f9cd09c26c2dd0848adbe3b16e0

SHA512
1d66b53970eccf2a4fd5bafa426d81e6664e80c380fd33a10a5b48bc3f87d0490936da02549adc17dbb9a32fec7a16494ea32cfdeb8ca2605c7f8966fd417d54

Download Submit
C:\Windows\SysWOW64\Focaagfn.exe

Filesize
51KB

MD5
b31866eec8f7e772bd21a244e60bf8b0

SHA1
23783329dbdf9fafdc59fa0c764ec8c9f81285d8

SHA256
e36c3f87617cd394ec659f2959fd27029eaaa01cdf0cbb8499420fa9479ec831

SHA512
cebb1e93f4728a5b17bb2b3227f7db6f7fc3c150b8a05a0297438060321b234a0471c663142a37083d2ff19b2ec9c00abf95e1fab0003e5303d485ba31f03a57

Download Submit
C:\Windows\SysWOW64\Focaagfn.exe

Filesize
51KB

MD5
b31866eec8f7e772bd21a244e60bf8b0

SHA1
23783329dbdf9fafdc59fa0c764ec8c9f81285d8

SHA256
e36c3f87617cd394ec659f2959fd27029eaaa01cdf0cbb8499420fa9479ec831

SHA512
cebb1e93f4728a5b17bb2b3227f7db6f7fc3c150b8a05a0297438060321b234a0471c663142a37083d2ff19b2ec9c00abf95e1fab0003e5303d485ba31f03a57

Download Submit
C:\Windows\SysWOW64\Foenggdk.exe

Filesize
51KB

MD5
787436d3c971e076eccaa8aae6b31cf0

SHA1
4f4655f8cf721b2e14a5e4b81da2cb21631fc881

SHA256
3ee3cbeda84890de0d427f34cf37c48713581a91a7ffd66c22c8297d9d80129c

SHA512
958e3736a9f4904ab34abd797fba87c9bf5b37e0584eb8bc13c7f5771318bb219ea114e41929e09b0fb4980082915cbbf1324d37b68bd210a3f42264ad4404e3

Download Submit
C:\Windows\SysWOW64\Foenggdk.exe

Filesize
51KB

MD5
787436d3c971e076eccaa8aae6b31cf0

SHA1
4f4655f8cf721b2e14a5e4b81da2cb21631fc881

SHA256
3ee3cbeda84890de0d427f34cf37c48713581a91a7ffd66c22c8297d9d80129c

SHA512
958e3736a9f4904ab34abd797fba87c9bf5b37e0584eb8bc13c7f5771318bb219ea114e41929e09b0fb4980082915cbbf1324d37b68bd210a3f42264ad4404e3

Download Submit
C:\Windows\SysWOW64\Fogjlf32.exe

Filesize
51KB

MD5
957d37137851323959c2f9a11bcc4bf9

SHA1
2b491f24d9dcab73ba3dfdf9e8b08e9fc0a935fc

SHA256
1d0afa7f7aae7971ad5340d4d303a6fc627e04478bb93a56e7b723ebf5bcd0fc

SHA512
619f4efd803b90a10e53f513654347b12b14eb22ab3a2b237e966a0a7ffdd3c57b5c555d44262f351cf9ea03cbac809c1b6b5eee90bce12f9365855b6adea315

Download Submit
C:\Windows\SysWOW64\Fogjlf32.exe

Filesize
51KB

MD5
957d37137851323959c2f9a11bcc4bf9

SHA1
2b491f24d9dcab73ba3dfdf9e8b08e9fc0a935fc

SHA256
1d0afa7f7aae7971ad5340d4d303a6fc627e04478bb93a56e7b723ebf5bcd0fc

SHA512
619f4efd803b90a10e53f513654347b12b14eb22ab3a2b237e966a0a7ffdd3c57b5c555d44262f351cf9ea03cbac809c1b6b5eee90bce12f9365855b6adea315

Download Submit
C:\Windows\SysWOW64\Gammiakd.exe

Filesize
51KB

MD5
b27031a3979e93fafdfe1d63ee9fbfa0

SHA1
0ac75fb93e2760cee7e048136d687737a96a651c

SHA256
5dbb7a063e39653ec303215ae0bfbb531e3e6005eeb33ea6e31dd1140d8cab47

SHA512
3e3217984ba9675886e8067d6308294be4dba7fe8081b02fb567d3071e9cc3d1a9145977bdacffa419238e93954814fabd4fffbc0f6c5b13582d53ace5423ca4

Download Submit
C:\Windows\SysWOW64\Gammiakd.exe

Filesize
51KB

MD5
b27031a3979e93fafdfe1d63ee9fbfa0

SHA1
0ac75fb93e2760cee7e048136d687737a96a651c

SHA256
5dbb7a063e39653ec303215ae0bfbb531e3e6005eeb33ea6e31dd1140d8cab47

SHA512
3e3217984ba9675886e8067d6308294be4dba7fe8081b02fb567d3071e9cc3d1a9145977bdacffa419238e93954814fabd4fffbc0f6c5b13582d53ace5423ca4

Download Submit
C:\Windows\SysWOW64\Gboficpd.exe

Filesize
51KB

MD5
25f12270bf74b90f1acff1dd40010d78

SHA1
8ddfa0da915f83c8c2b0e4088655ca00eb0d8c42

SHA256
2d6de5dab45a633ad48c06ebda76fe18dd71ccc41cdb03a1c1d1f34218b9ea9c

SHA512
84329e850c65546d1f4fd94316cba2afe62b6d50025b7a4f870471884ca3dad45729ffbf14a48c5bafce8e1d445b270a93da7071791c04fa47238934091db1d7

Download Submit
C:\Windows\SysWOW64\Gboficpd.exe

Filesize
51KB

MD5
25f12270bf74b90f1acff1dd40010d78

SHA1
8ddfa0da915f83c8c2b0e4088655ca00eb0d8c42

SHA256
2d6de5dab45a633ad48c06ebda76fe18dd71ccc41cdb03a1c1d1f34218b9ea9c

SHA512
84329e850c65546d1f4fd94316cba2afe62b6d50025b7a4f870471884ca3dad45729ffbf14a48c5bafce8e1d445b270a93da7071791c04fa47238934091db1d7

Download Submit
C:\Windows\SysWOW64\Gefldp32.exe

Filesize
51KB

MD5
9a5e5f83b4ac91342e355a810f519365

SHA1
44c68ccb9fbb1e604f40dfe8f0d6c57d6601f0b6

SHA256
a97bbd4e0a7132ce129e90c279f9d8052ff5faa0f0275359b3630c9537cd8404

SHA512
88c5e5fe8eb60a097b4f614b7e9f411b0c501673d41bea1fb5fa89a0aa5b4105a6a047fb7b90ecb2dd4f5a91add682cfa226951d345008be17fcf7b7f0dd9363

Download Submit
C:\Windows\SysWOW64\Gefldp32.exe

Filesize
51KB

MD5
9a5e5f83b4ac91342e355a810f519365

SHA1
44c68ccb9fbb1e604f40dfe8f0d6c57d6601f0b6

SHA256
a97bbd4e0a7132ce129e90c279f9d8052ff5faa0f0275359b3630c9537cd8404

SHA512
88c5e5fe8eb60a097b4f614b7e9f411b0c501673d41bea1fb5fa89a0aa5b4105a6a047fb7b90ecb2dd4f5a91add682cfa226951d345008be17fcf7b7f0dd9363

Download Submit
C:\Windows\SysWOW64\Ghiakkqo.exe

Filesize
51KB

MD5
cee942bbebba5034621e9cffc7fbb03e

SHA1
23722a3539319a31d87665b7ef3220e01ac0db18

SHA256
4b8e1ba16cf5e3d295288dc9ff0687c8133c2f0e329cb62df1b6950b4a38bc79

SHA512
756dcae33db6eb54bd471467e3ce40a5330e79cabd2750cfe4d0b41f60c6480ab03911330a0abc8200a95dbefed4f28ff32930742c2d487c9f69832db99af4f3

Download Submit
C:\Windows\SysWOW64\Ghiakkqo.exe

Filesize
51KB

MD5
cee942bbebba5034621e9cffc7fbb03e

SHA1
23722a3539319a31d87665b7ef3220e01ac0db18

SHA256
4b8e1ba16cf5e3d295288dc9ff0687c8133c2f0e329cb62df1b6950b4a38bc79

SHA512
756dcae33db6eb54bd471467e3ce40a5330e79cabd2750cfe4d0b41f60c6480ab03911330a0abc8200a95dbefed4f28ff32930742c2d487c9f69832db99af4f3

Download Submit
C:\Windows\SysWOW64\Ghlnajol.exe

Filesize
51KB

MD5
8f0c736328261ef768d38931ee7f231d

SHA1
14e0792f33508d1e0b8472cfe058b325eec00f08

SHA256
6bab04f7cec7dd837af1374a89695e8817c55264d59689e1ae1b43b7d023f059

SHA512
6a6d338b8f93cd5c25a761a2d07ce3644ecc20fb439fd72682f5441651907136c388ae0595bdc88387513dffa302573a93e30341c05e051099617fe89ac18669

Download Submit
C:\Windows\SysWOW64\Ghlnajol.exe

Filesize
51KB

MD5
8f0c736328261ef768d38931ee7f231d

SHA1
14e0792f33508d1e0b8472cfe058b325eec00f08

SHA256
6bab04f7cec7dd837af1374a89695e8817c55264d59689e1ae1b43b7d023f059

SHA512
6a6d338b8f93cd5c25a761a2d07ce3644ecc20fb439fd72682f5441651907136c388ae0595bdc88387513dffa302573a93e30341c05e051099617fe89ac18669

Download Submit
C:\Windows\SysWOW64\Giokoo32.exe

Filesize
51KB

MD5
434cc885bdfa21e2975f3eacad1fbcdf

SHA1
2ec0d63f8d6525cd0c5023877c3a4d4c328a2e89

SHA256
9b92d0a528bcba43218ab719631132f4a158e3b97bf700ee977d57cbfca70c9b

SHA512
ac59340225ac08036ec0216d0a2ecd5678fb80dd0ebb5d6de633af7f2053d9d08ffb03c1c27ac69c5a6162abc4ab59361f4c56b6e28045db3cc73a9775da1c63

Download Submit
C:\Windows\SysWOW64\Giokoo32.exe

Filesize
51KB

MD5
434cc885bdfa21e2975f3eacad1fbcdf

SHA1
2ec0d63f8d6525cd0c5023877c3a4d4c328a2e89

SHA256
9b92d0a528bcba43218ab719631132f4a158e3b97bf700ee977d57cbfca70c9b

SHA512
ac59340225ac08036ec0216d0a2ecd5678fb80dd0ebb5d6de633af7f2053d9d08ffb03c1c27ac69c5a6162abc4ab59361f4c56b6e28045db3cc73a9775da1c63

Download Submit
C:\Windows\SysWOW64\Gkcdlg32.exe

Filesize
51KB

MD5
b595fb0c40daaa544ca89c9d6e263536

SHA1
c122613474c92bd856e5c0b195f9f50bc033318e

SHA256
ec1c8b90079df8231ae5cac4aac9dc28d483817c89bb238535af4183cbc64070

SHA512
aeb6f0dcf00ec7d774b098f076ba10df0fe3b25bddb5c14ac6747e0f8f1c010a0ebd0d78bd05cc879535ff6adfdd76ff3e4d254a32508660a1fc9a61130c686c

Download Submit
C:\Windows\SysWOW64\Gkcdlg32.exe

Filesize
51KB

MD5
b595fb0c40daaa544ca89c9d6e263536

SHA1
c122613474c92bd856e5c0b195f9f50bc033318e

SHA256
ec1c8b90079df8231ae5cac4aac9dc28d483817c89bb238535af4183cbc64070

SHA512
aeb6f0dcf00ec7d774b098f076ba10df0fe3b25bddb5c14ac6747e0f8f1c010a0ebd0d78bd05cc879535ff6adfdd76ff3e4d254a32508660a1fc9a61130c686c

Download Submit
C:\Windows\SysWOW64\Gkqhgg32.exe

Filesize
51KB

MD5
1ff585ffa521961313590f96855b4e13

SHA1
71484c6c23c9e01c4e489e6e535558b2e6b1992d

SHA256
eea432277987dde1c75df19ab6bd72d44faecf742ac6084eb1a99badebbc4c24

SHA512
f64ddbeefbe58c3727199d47e10053f888b4db3b3b76861b89fca8796977101612b26df7d4df7f7058c508f6ae2a34b7ad9b94db985bb04615a26243248d474c

Download Submit
C:\Windows\SysWOW64\Gkqhgg32.exe

Filesize
51KB

MD5
1ff585ffa521961313590f96855b4e13

SHA1
71484c6c23c9e01c4e489e6e535558b2e6b1992d

SHA256
eea432277987dde1c75df19ab6bd72d44faecf742ac6084eb1a99badebbc4c24

SHA512
f64ddbeefbe58c3727199d47e10053f888b4db3b3b76861b89fca8796977101612b26df7d4df7f7058c508f6ae2a34b7ad9b94db985bb04615a26243248d474c

Download Submit
C:\Windows\SysWOW64\Glbafjkj.exe

Filesize
51KB

MD5
185c876951ec92be2770137672c6c1e3

SHA1
c951af20a8d38c05037303dc32482ca66534e5f8

SHA256
3c3a52058459a69be6f46b1774e8b3c6b536762a4b12cf1caa432d903b8f2881

SHA512
3c204af076681c80a57826100ded4882b4aa3c170416b1baa6a9e2c80f7388f95cfdc42acc606e9c5eb54a6f4d162ed62c83fbf50420d071e731f5053f81688c

Download Submit
C:\Windows\SysWOW64\Glbafjkj.exe

Filesize
51KB

MD5
185c876951ec92be2770137672c6c1e3

SHA1
c951af20a8d38c05037303dc32482ca66534e5f8

SHA256
3c3a52058459a69be6f46b1774e8b3c6b536762a4b12cf1caa432d903b8f2881

SHA512
3c204af076681c80a57826100ded4882b4aa3c170416b1baa6a9e2c80f7388f95cfdc42acc606e9c5eb54a6f4d162ed62c83fbf50420d071e731f5053f81688c

Download Submit
C:\Windows\SysWOW64\Goambe32.exe

Filesize
51KB

MD5
f669e4e5110d729575d888b4ea085f48

SHA1
ba2def4d76ec4a91053629208378405f13e23335

SHA256
4b906ff7b86602c7db97502f7ebebaca7024d770a013fb7754c2784e48ce30cb

SHA512
2ddfd71dafc074d1227856ecff9b8588bb4f243324fab9e27fc9df75e814c6b0f3e4d50207d4b376c18941256416b8d7e586bc6ec00aec854f598284d2ba6e7c

Download Submit
C:\Windows\SysWOW64\Goambe32.exe

Filesize
51KB

MD5
f669e4e5110d729575d888b4ea085f48

SHA1
ba2def4d76ec4a91053629208378405f13e23335

SHA256
4b906ff7b86602c7db97502f7ebebaca7024d770a013fb7754c2784e48ce30cb

SHA512
2ddfd71dafc074d1227856ecff9b8588bb4f243324fab9e27fc9df75e814c6b0f3e4d50207d4b376c18941256416b8d7e586bc6ec00aec854f598284d2ba6e7c

Download Submit
C:\Windows\SysWOW64\Gojgbf32.exe

Filesize
51KB

MD5
8c649487089c6cf000f109305016cd21

SHA1
888437eb00b9be06f750b8a17115bacd7e0378cf

SHA256
3415d8ed0e41f2d06b9e1cee0601695c71f4aefffa6fd5c32fd5100ee3337434

SHA512
dc14586f476e663ca0c56a84065d9fefd4b0efff5714f34bfad42ea2fc5d5944b347bb74cd70a16df8fe41cc481d8ae5091e4fef8b595c4d0dec603f364ff6a8

Download Submit
C:\Windows\SysWOW64\Gojgbf32.exe

Filesize
51KB

MD5
8c649487089c6cf000f109305016cd21

SHA1
888437eb00b9be06f750b8a17115bacd7e0378cf

SHA256
3415d8ed0e41f2d06b9e1cee0601695c71f4aefffa6fd5c32fd5100ee3337434

SHA512
dc14586f476e663ca0c56a84065d9fefd4b0efff5714f34bfad42ea2fc5d5944b347bb74cd70a16df8fe41cc481d8ae5091e4fef8b595c4d0dec603f364ff6a8

Download Submit
C:\Windows\SysWOW64\Himgqmcl.exe

Filesize
51KB

MD5
cc46d20a75107d34028ac151d325ce14

SHA1
b9cb42b63768f63971fcc76c575f5e0f71f8758f

SHA256
e3c696d6ae5bbcec08e8e17b3aaf77001405bdd3d9affaaee7ec223f6ab9b582

SHA512
b59f825cd327f47b9ae949db6e796b50685fa29aaf9732c7d6d5148a641cf5ef100ba63acc87436f16f3f818dd035f65b29b4fdeb182e80477604742f10b1434

Download Submit
C:\Windows\SysWOW64\Himgqmcl.exe

Filesize
51KB

MD5
cc46d20a75107d34028ac151d325ce14

SHA1
b9cb42b63768f63971fcc76c575f5e0f71f8758f

SHA256
e3c696d6ae5bbcec08e8e17b3aaf77001405bdd3d9affaaee7ec223f6ab9b582

SHA512
b59f825cd327f47b9ae949db6e796b50685fa29aaf9732c7d6d5148a641cf5ef100ba63acc87436f16f3f818dd035f65b29b4fdeb182e80477604742f10b1434

Download Submit
C:\Windows\SysWOW64\Hliggieb.exe

Filesize
51KB

MD5
4ff33c5f9de0168fcd11bec6c05a7c60

SHA1
f366647fdadd3c06c417c5c834d852da79a48628

SHA256
75d7fc3123891bfb9ea1c3435178e4ec54b04050d32afc8d7c72d43e6ee0c67b

SHA512
fb19752112501e8923928f8971a1ee7bd66fe5abd5468f02c821d0fa68576143993647d02dd7e65ceed44b45b9fa2ea1e6ead4add878b656c8566fb4ab79dc1a

Download Submit
C:\Windows\SysWOW64\Hliggieb.exe

Filesize
51KB

MD5
4ff33c5f9de0168fcd11bec6c05a7c60

SHA1
f366647fdadd3c06c417c5c834d852da79a48628

SHA256
75d7fc3123891bfb9ea1c3435178e4ec54b04050d32afc8d7c72d43e6ee0c67b

SHA512
fb19752112501e8923928f8971a1ee7bd66fe5abd5468f02c821d0fa68576143993647d02dd7e65ceed44b45b9fa2ea1e6ead4add878b656c8566fb4ab79dc1a

Download Submit
memory/432-234-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/636-132-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/800-166-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/872-259-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/880-258-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1172-276-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1180-168-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1244-301-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1352-174-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1372-303-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1412-278-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1560-311-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1588-322-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1756-271-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1848-233-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1852-284-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1860-316-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1876-169-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2036-245-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2128-232-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2212-256-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2244-274-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2616-306-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2836-282-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2884-304-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2896-308-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3176-313-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3212-173-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3264-177-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3348-247-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3420-275-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3436-242-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3452-273-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3516-321-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3692-172-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3712-250-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3720-253-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3804-176-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3976-307-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4000-167-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4004-320-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4080-281-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4084-231-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4104-171-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4156-314-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4288-240-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4452-319-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4460-272-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4484-279-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4496-170-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4532-286-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4544-285-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4608-302-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4708-236-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4720-283-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4752-312-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4772-243-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4816-277-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4836-249-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4864-323-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4988-237-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4996-280-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5040-255-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5092-309-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download