34e52ad4898bb9c9ab58591bb6ffa5e677ec186e9c4b0c44b4f699e32188d87d

Analysis

max time kernel
17s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
13-11-2023 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.7d094ae701c0c94c542568f28be78240.exe
Size

77KB
MD5

7d094ae701c0c94c542568f28be78240
SHA1

e2550ceddb5d80a45d2cc44d1ba3633d65aa199f
SHA256

34e52ad4898bb9c9ab58591bb6ffa5e677ec186e9c4b0c44b4f699e32188d87d
SHA512

caec70e69e3a92a4906872c0433ee552546590d6c300ee21cc829188b26cd80764d0904cfa11e0fba9b005cf00e3ae5a4f181fed847234ce43c90be8f4d78004
SSDEEP

1536:5YpzBd9qWcePII0/XmSDC4MxecbH2LtmPwfi+TjRC/D:sdd9Pfl0/XmSDuIawf1TjYD

Score

10^/10

dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lndham32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akffafgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ccgjopal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebejfk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjdaodja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igedlh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epndknin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akcjkfij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbndfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epokedmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhflnpoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oldamm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pchlpfjb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahgjejhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ejlbhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fplpll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kqbkfkal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nijeec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Neafjdkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lelchgne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dblgpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjjnifbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjfnedho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ihnkel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Injcmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lldopb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpfepf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aompak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhilfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajggomog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Miofjepg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nolgijpk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgbjbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbmoen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Leopnglc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlkngo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfoiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dcjnoece.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dannij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inomhbeq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cofecami.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbeapmll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckmehb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkimho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkpbin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlbkap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlfelogp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pchlpfjb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gphphj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjpijpdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lejgch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmggfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbmoen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dihlbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mblcnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkhjph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaiimadl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aanbhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahchda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aflaie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmgejhgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fibhpbea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgnqgqan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbnpcj32.exe

Malware Backdoor - Berbew 64 IoCs

Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

persistence dropper trojan

resource	yara_rule
behavioral2/memory/4864-0-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/memory/4864-5-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/memory/5036-8-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/files/0x0002000000022612-7.dat	family_berbew
behavioral2/files/0x0002000000022612-9.dat	family_berbew
behavioral2/files/0x0008000000022dd8-16.dat	family_berbew
behavioral2/files/0x0008000000022dd8-15.dat	family_berbew
behavioral2/files/0x0006000000022df3-24.dat	family_berbew
behavioral2/memory/3712-25-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022df3-23.dat	family_berbew
behavioral2/files/0x0006000000022df5-31.dat	family_berbew
behavioral2/memory/4712-17-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/memory/460-32-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022df5-33.dat	family_berbew
behavioral2/files/0x0006000000022df7-39.dat	family_berbew
behavioral2/memory/4380-41-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022df7-40.dat	family_berbew
behavioral2/files/0x0006000000022dfa-47.dat	family_berbew
behavioral2/memory/4364-49-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022dfc-55.dat	family_berbew
behavioral2/files/0x0006000000022dfa-48.dat	family_berbew
behavioral2/memory/3836-56-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022dfc-57.dat	family_berbew
behavioral2/files/0x0006000000022dfe-63.dat	family_berbew
behavioral2/files/0x0006000000022dfe-64.dat	family_berbew
behavioral2/files/0x0006000000022df7-34.dat	family_berbew
behavioral2/memory/2460-65-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e00-66.dat	family_berbew
behavioral2/files/0x0006000000022e00-71.dat	family_berbew
behavioral2/files/0x0006000000022e00-72.dat	family_berbew
behavioral2/memory/1476-73-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e02-79.dat	family_berbew
behavioral2/files/0x0006000000022e02-80.dat	family_berbew
behavioral2/memory/3920-81-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e04-88.dat	family_berbew
behavioral2/memory/4360-89-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e07-96.dat	family_berbew
behavioral2/memory/3432-97-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e07-95.dat	family_berbew
behavioral2/files/0x0006000000022e04-87.dat	family_berbew
behavioral2/files/0x0006000000022e09-103.dat	family_berbew
behavioral2/memory/4836-105-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e0b-112.dat	family_berbew
behavioral2/files/0x0006000000022e09-104.dat	family_berbew
behavioral2/files/0x0006000000022e0b-111.dat	family_berbew
behavioral2/memory/4860-113-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e0d-120.dat	family_berbew
behavioral2/memory/2896-121-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e0f-127.dat	family_berbew
behavioral2/memory/2452-129-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e11-135.dat	family_berbew
behavioral2/memory/5044-136-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e0f-128.dat	family_berbew
behavioral2/files/0x0006000000022e11-137.dat	family_berbew
behavioral2/files/0x0006000000022e0d-119.dat	family_berbew
behavioral2/files/0x0008000000022ddb-143.dat	family_berbew
behavioral2/memory/1560-144-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/files/0x0008000000022ddb-145.dat	family_berbew
behavioral2/files/0x0006000000022e14-151.dat	family_berbew
behavioral2/files/0x0006000000022e14-152.dat	family_berbew
behavioral2/memory/848-153-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e16-159.dat	family_berbew
behavioral2/files/0x0006000000022e16-160.dat	family_berbew
behavioral2/memory/2776-161-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew

Executes dropped EXE 64 IoCs

pid	Process
5036	Agbkmijg.exe
4712	Ahchda32.exe
3712	Aompak32.exe
460	Agdhbi32.exe
4380	Aqmlknnd.exe
4364	Aggegh32.exe
3836	Aihaoqlp.exe
2460	Acnemi32.exe
1476	Aflaie32.exe
3920	Aqaffn32.exe
4360	Afnnnd32.exe
3432	Aimkjp32.exe
4836	Bogcgj32.exe
4860	Bjlgdc32.exe
2896	Bqfoamfj.exe
2452	Bfchidda.exe
5044	Bmmpfn32.exe
1560	Bjaqpbkh.exe
848	Bfhadc32.exe
2776	Bqmeal32.exe
740	Bfjnjcni.exe
2560	Ccnncgmc.exe
1860	Cjhfpa32.exe
852	Cabomkll.exe
3852	Cmipblaq.exe
908	Ccchof32.exe
4764	Cfadkb32.exe
3548	Cpihcgoa.exe
2044	Cfcqpa32.exe
116	Cidjbmcp.exe
3000	Dcjnoece.exe
2508	Djdflp32.exe
4208	Dannij32.exe
1764	Dhhfedil.exe
4604	Diicml32.exe
1884	Dfmcfp32.exe
4960	Dfoplpla.exe
3476	Ddcqedkk.exe
1620	Djmibn32.exe
3004	Eagaoh32.exe
4832	Ehailbaa.exe
1520	Ejpfhnpe.exe
1240	Efffmo32.exe
448	Eidbij32.exe
4276	Epokedmj.exe
2008	Ehfcfb32.exe
2936	Embkoi32.exe
2332	Edmclccp.exe
3900	Efkphnbd.exe
2852	Emehdh32.exe
3376	Ehjlaaig.exe
3544	Fmgejhgn.exe
3424	Fpeafcfa.exe
1896	Ffpicn32.exe
3040	Fmjaphek.exe
3724	Fhofmq32.exe
1648	Fajgkfio.exe
4892	Fmqgpgoc.exe
2016	Fhflnpoi.exe
5012	Gigheh32.exe
3556	Gdmmbq32.exe
1968	Gijekg32.exe
1184	Gpcmga32.exe
3416	Ggnedlao.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Cmipblaq.exe	Cabomkll.exe
File created	C:\Windows\SysWOW64\Fmcldc32.dll	Fmjaphek.exe
File created	C:\Windows\SysWOW64\Jjopcb32.exe	Jhndljll.exe
File created	C:\Windows\SysWOW64\Fiebmc32.dll	Mlmbfqoj.exe
File created	C:\Windows\SysWOW64\Objpoh32.exe	Oondnini.exe
File opened for modification	C:\Windows\SysWOW64\Gnhnaf32.exe	Ggnedlao.exe
File created	C:\Windows\SysWOW64\Epaobqhf.dll	Ggnedlao.exe
File created	C:\Windows\SysWOW64\Ecbfdd32.dll	Lghcocol.exe
File created	C:\Windows\SysWOW64\Koiagakg.dll	Embddb32.exe
File created	C:\Windows\SysWOW64\Oikmnf32.dll	Ffaong32.exe
File created	C:\Windows\SysWOW64\Pjnppabn.dll	Gkmdecbg.exe
File opened for modification	C:\Windows\SysWOW64\Fbcfhibj.exe	Flinkojm.exe
File created	C:\Windows\SysWOW64\Djiiimel.dll	Icnklbmj.exe
File opened for modification	C:\Windows\SysWOW64\Cabomkll.exe	Cjhfpa32.exe
File created	C:\Windows\SysWOW64\Fpeafcfa.exe	Fmgejhgn.exe
File created	C:\Windows\SysWOW64\Mgbalagn.dll	Ihphkl32.exe
File created	C:\Windows\SysWOW64\Logooemi.dll	Kdinljnk.exe
File created	C:\Windows\SysWOW64\Lgcjdd32.exe	Lajagj32.exe
File created	C:\Windows\SysWOW64\Nolgijpk.exe	Niooqcad.exe
File opened for modification	C:\Windows\SysWOW64\Aompak32.exe	Ahchda32.exe
File created	C:\Windows\SysWOW64\Imjfmjln.dll	Jkhgmf32.exe
File opened for modification	C:\Windows\SysWOW64\Cfigpm32.exe	Bjicdmmd.exe
File created	C:\Windows\SysWOW64\Bpcelk32.dll	Gfokoelp.exe
File created	C:\Windows\SysWOW64\Gbobfjdp.dll	Pakllc32.exe
File opened for modification	C:\Windows\SysWOW64\Qljcoj32.exe	Qikgco32.exe
File created	C:\Windows\SysWOW64\Ofcmimpk.dll	Emdajb32.exe
File created	C:\Windows\SysWOW64\Ngmeal32.dll	Nbnpcj32.exe
File created	C:\Windows\SysWOW64\Qofcff32.exe	Pcobaedj.exe
File created	C:\Windows\SysWOW64\Bfpfngma.dll	Gmbmkpie.exe
File opened for modification	C:\Windows\SysWOW64\Gmdjapgb.exe	Gjfnedho.exe
File created	C:\Windows\SysWOW64\Laniklje.dll	Dfmcfp32.exe
File opened for modification	C:\Windows\SysWOW64\Ijhjcchb.exe	Idkbkl32.exe
File opened for modification	C:\Windows\SysWOW64\Kelkaj32.exe	Kbmoen32.exe
File opened for modification	C:\Windows\SysWOW64\Fideeaco.exe	Fffhifdk.exe
File opened for modification	C:\Windows\SysWOW64\Jkaicd32.exe	Jgenbfoa.exe
File created	C:\Windows\SysWOW64\Kgjgne32.exe	Kelkaj32.exe
File created	C:\Windows\SysWOW64\Akamff32.exe	Ahcajk32.exe
File opened for modification	C:\Windows\SysWOW64\Hiiggoaf.exe	Hgkkkcbc.exe
File opened for modification	C:\Windows\SysWOW64\Hildmn32.exe	Hdokdg32.exe
File created	C:\Windows\SysWOW64\Mhilfa32.exe	Mejpje32.exe
File created	C:\Windows\SysWOW64\Lefioe32.dll	Qikgco32.exe
File opened for modification	C:\Windows\SysWOW64\Jcdala32.exe	Jpfepf32.exe
File created	C:\Windows\SysWOW64\Aqmlknnd.exe	Agdhbi32.exe
File created	C:\Windows\SysWOW64\Neoogc32.dll	Idkbkl32.exe
File created	C:\Windows\SysWOW64\Nijeec32.exe	Neoieenp.exe
File created	C:\Windows\SysWOW64\Glienb32.dll	Epndknin.exe
File opened for modification	C:\Windows\SysWOW64\Cidjbmcp.exe	Cfcqpa32.exe
File created	C:\Windows\SysWOW64\Okilfdgl.dll	Diicml32.exe
File created	C:\Windows\SysWOW64\Cbphdn32.exe	Cobkhb32.exe
File created	C:\Windows\SysWOW64\Fjjnifbl.exe	Fbcfhibj.exe
File opened for modification	C:\Windows\SysWOW64\Ddcqedkk.exe	Dfoplpla.exe
File created	C:\Windows\SysWOW64\Gpcmga32.exe	Gijekg32.exe
File opened for modification	C:\Windows\SysWOW64\Ggnedlao.exe	Gpcmga32.exe
File created	C:\Windows\SysWOW64\Glgpnm32.dll	Okedcjcm.exe
File opened for modification	C:\Windows\SysWOW64\Ecgcfm32.exe	Elpkep32.exe
File created	C:\Windows\SysWOW64\Pbjnik32.dll	Flinkojm.exe
File opened for modification	C:\Windows\SysWOW64\Ehjlaaig.exe	Emehdh32.exe
File created	C:\Windows\SysWOW64\Mkellk32.dll	Ajggomog.exe
File opened for modification	C:\Windows\SysWOW64\Efhlhh32.exe	Epndknin.exe
File created	C:\Windows\SysWOW64\Icnklbmj.exe	Ipmbjgpi.exe
File opened for modification	C:\Windows\SysWOW64\Kkconn32.exe	Kmaopfjm.exe
File created	C:\Windows\SysWOW64\Fjjdgc32.dll	Injcmc32.exe
File created	C:\Windows\SysWOW64\Enkjji32.dll	Miofjepg.exe
File created	C:\Windows\SysWOW64\Nbqmiinl.exe	Nlfelogp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6348	3988	WerFault.exe	968

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Igedlh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jqdoem32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebejfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Embddb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fplpll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hgfapd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjoiil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aggegh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gijekg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ecgcfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Emphocjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmnmgnoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaeaha32.dll"	Lgcjdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkenjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejhmqp32.dll"	Ffclcgfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqhajknb.dll"	Ahchda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fccfel32.dll"	Ckmehb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcpeei32.dll"	Dpphjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkmdecbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ccnncgmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddcqedkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fphppfgi.dll"	Kndojobi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdigjdia.dll"	Kilpmh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpecbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpcpem32.dll"	Hgkkkcbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpihcgoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nabbod32.dll"	Efkphnbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjaqpbkh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbbhqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajggomog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olijhmgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Elpkep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Idkbkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghmpmgdc.dll"	Jjopcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfhepbll.dll"	Dmoohe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hdokdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jkimho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfjnjcni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehfcfb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Injcmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgjgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecbfdd32.dll"	Lghcocol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Micoed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfhadc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbeloo32.dll"	Eagaoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glgpnm32.dll"	Okedcjcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oiknlagg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aqaffn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lndham32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlbkap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qekpedip.dll"	Fmikeaap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdbbdk32.dll"	Hlegnjbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jldajape.dll"	Jkomneim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lelchgne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpaolmbc.dll"	Achegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Efkphnbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Feaabknn.dll"	Pamiaboj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cbgnemjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klhhpnaf.dll"	Gdlfhj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpcfmkff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmggfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgenbfoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qljcoj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmikeaap.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 5036	4864	NEAS.7d094ae701c0c94c542568f28be78240.exe	48
PID 4864 wrote to memory of 5036	4864	NEAS.7d094ae701c0c94c542568f28be78240.exe	48
PID 4864 wrote to memory of 5036	4864	NEAS.7d094ae701c0c94c542568f28be78240.exe	48
PID 5036 wrote to memory of 4712	5036	Agbkmijg.exe	50
PID 5036 wrote to memory of 4712	5036	Agbkmijg.exe	50
PID 5036 wrote to memory of 4712	5036	Agbkmijg.exe	50
PID 4712 wrote to memory of 3712	4712	Ahchda32.exe	55
PID 4712 wrote to memory of 3712	4712	Ahchda32.exe	55
PID 4712 wrote to memory of 3712	4712	Ahchda32.exe	55
PID 3712 wrote to memory of 460	3712	Aompak32.exe	54
PID 3712 wrote to memory of 460	3712	Aompak32.exe	54
PID 3712 wrote to memory of 460	3712	Aompak32.exe	54
PID 460 wrote to memory of 4380	460	Agdhbi32.exe	62
PID 460 wrote to memory of 4380	460	Agdhbi32.exe	62
PID 460 wrote to memory of 4380	460	Agdhbi32.exe	62
PID 4380 wrote to memory of 4364	4380	Aqmlknnd.exe	63
PID 4380 wrote to memory of 4364	4380	Aqmlknnd.exe	63
PID 4380 wrote to memory of 4364	4380	Aqmlknnd.exe	63
PID 4364 wrote to memory of 3836	4364	Aggegh32.exe	64
PID 4364 wrote to memory of 3836	4364	Aggegh32.exe	64
PID 4364 wrote to memory of 3836	4364	Aggegh32.exe	64
PID 3836 wrote to memory of 2460	3836	Aihaoqlp.exe	65
PID 3836 wrote to memory of 2460	3836	Aihaoqlp.exe	65
PID 3836 wrote to memory of 2460	3836	Aihaoqlp.exe	65
PID 2460 wrote to memory of 1476	2460	Acnemi32.exe	68
PID 2460 wrote to memory of 1476	2460	Acnemi32.exe	68
PID 2460 wrote to memory of 1476	2460	Acnemi32.exe	68
PID 1476 wrote to memory of 3920	1476	Aflaie32.exe	74
PID 1476 wrote to memory of 3920	1476	Aflaie32.exe	74
PID 1476 wrote to memory of 3920	1476	Aflaie32.exe	74
PID 3920 wrote to memory of 4360	3920	Aqaffn32.exe	81
PID 3920 wrote to memory of 4360	3920	Aqaffn32.exe	81
PID 3920 wrote to memory of 4360	3920	Aqaffn32.exe	81
PID 4360 wrote to memory of 3432	4360	Afnnnd32.exe	80
PID 4360 wrote to memory of 3432	4360	Afnnnd32.exe	80
PID 4360 wrote to memory of 3432	4360	Afnnnd32.exe	80
PID 3432 wrote to memory of 4836	3432	Aimkjp32.exe	83
PID 3432 wrote to memory of 4836	3432	Aimkjp32.exe	83
PID 3432 wrote to memory of 4836	3432	Aimkjp32.exe	83
PID 4836 wrote to memory of 4860	4836	Bogcgj32.exe	86
PID 4836 wrote to memory of 4860	4836	Bogcgj32.exe	86
PID 4836 wrote to memory of 4860	4836	Bogcgj32.exe	86
PID 4860 wrote to memory of 2896	4860	Bjlgdc32.exe	87
PID 4860 wrote to memory of 2896	4860	Bjlgdc32.exe	87
PID 4860 wrote to memory of 2896	4860	Bjlgdc32.exe	87
PID 2896 wrote to memory of 2452	2896	Bqfoamfj.exe	88
PID 2896 wrote to memory of 2452	2896	Bqfoamfj.exe	88
PID 2896 wrote to memory of 2452	2896	Bqfoamfj.exe	88
PID 2452 wrote to memory of 5044	2452	Bfchidda.exe	89
PID 2452 wrote to memory of 5044	2452	Bfchidda.exe	89
PID 2452 wrote to memory of 5044	2452	Bfchidda.exe	89
PID 5044 wrote to memory of 1560	5044	Bmmpfn32.exe	99
PID 5044 wrote to memory of 1560	5044	Bmmpfn32.exe	99
PID 5044 wrote to memory of 1560	5044	Bmmpfn32.exe	99
PID 1560 wrote to memory of 848	1560	Bjaqpbkh.exe	104
PID 1560 wrote to memory of 848	1560	Bjaqpbkh.exe	104
PID 1560 wrote to memory of 848	1560	Bjaqpbkh.exe	104
PID 848 wrote to memory of 2776	848	Bfhadc32.exe	107
PID 848 wrote to memory of 2776	848	Bfhadc32.exe	107
PID 848 wrote to memory of 2776	848	Bfhadc32.exe	107
PID 2776 wrote to memory of 740	2776	Bqmeal32.exe	106
PID 2776 wrote to memory of 740	2776	Bqmeal32.exe	106
PID 2776 wrote to memory of 740	2776	Bqmeal32.exe	106
PID 740 wrote to memory of 2560	740	Bfjnjcni.exe	105

C:\Users\Admin\AppData\Local\Temp\NEAS.7d094ae701c0c94c542568f28be78240.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.7d094ae701c0c94c542568f28be78240.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\Agbkmijg.exe
  C:\Windows\system32\Agbkmijg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\SysWOW64\Ahchda32.exe
    C:\Windows\system32\Ahchda32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\SysWOW64\Aompak32.exe
      C:\Windows\system32\Aompak32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3712

C:\Windows\SysWOW64\Agdhbi32.exe
C:\Windows\system32\Agdhbi32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:460
- C:\Windows\SysWOW64\Aqmlknnd.exe
  C:\Windows\system32\Aqmlknnd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\SysWOW64\Aggegh32.exe
    C:\Windows\system32\Aggegh32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Windows\SysWOW64\Aihaoqlp.exe
      C:\Windows\system32\Aihaoqlp.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3836
    - - C:\Windows\SysWOW64\Acnemi32.exe
        
        C:\Windows\system32\Acnemi32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2460
      - C:\Windows\SysWOW64\Aflaie32.exe
        
        C:\Windows\system32\Aflaie32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1476
        
        C:\Windows\SysWOW64\Aqaffn32.exe
        
        C:\Windows\system32\Aqaffn32.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3920
        
        C:\Windows\SysWOW64\Afnnnd32.exe
        
        C:\Windows\system32\Afnnnd32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4360

C:\Windows\SysWOW64\Aimkjp32.exe
C:\Windows\system32\Aimkjp32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\SysWOW64\Bogcgj32.exe
  C:\Windows\system32\Bogcgj32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SysWOW64\Bjlgdc32.exe
    C:\Windows\system32\Bjlgdc32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\SysWOW64\Bqfoamfj.exe
      C:\Windows\system32\Bqfoamfj.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\Windows\SysWOW64\Bfchidda.exe
        
        C:\Windows\system32\Bfchidda.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2452
      - C:\Windows\SysWOW64\Bmmpfn32.exe
        
        C:\Windows\system32\Bmmpfn32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1560
        
        C:\Windows\SysWOW64\Bfhadc32.exe
        
        C:\Windows\system32\Bfhadc32.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:848
        
        C:\Windows\SysWOW64\Bqmeal32.exe
        
        C:\Windows\system32\Bqmeal32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2776

C:\Windows\SysWOW64\Ccnncgmc.exe
C:\Windows\system32\Ccnncgmc.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:2560
- C:\Windows\SysWOW64\Cjhfpa32.exe
  C:\Windows\system32\Cjhfpa32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1860

C:\Windows\SysWOW64\Bfjnjcni.exe
C:\Windows\system32\Bfjnjcni.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\Cabomkll.exe
C:\Windows\system32\Cabomkll.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:852
- C:\Windows\SysWOW64\Cmipblaq.exe
  C:\Windows\system32\Cmipblaq.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- - C:\Windows\SysWOW64\Ccchof32.exe
    C:\Windows\system32\Ccchof32.exe
    3⤵
    - Executes dropped EXE
    PID:908
  - - C:\Windows\SysWOW64\Cfadkb32.exe
      C:\Windows\system32\Cfadkb32.exe
      4⤵
      Executes dropped EXE
      PID:4764
    - - C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3548
      - C:\Windows\SysWOW64\Cfcqpa32.exe
        
        C:\Windows\system32\Cfcqpa32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2044
        
        C:\Windows\SysWOW64\Cidjbmcp.exe
        
        C:\Windows\system32\Cidjbmcp.exe
        7⤵
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\Dcjnoece.exe
        
        C:\Windows\system32\Dcjnoece.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3000
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        9⤵
        Executes dropped EXE
        
        PID:2508
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4208
        
        C:\Windows\SysWOW64\Dhhfedil.exe
        
        C:\Windows\system32\Dhhfedil.exe
        11⤵
        Executes dropped EXE
        
        PID:1764
        
        C:\Windows\SysWOW64\Diicml32.exe
        
        C:\Windows\system32\Diicml32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4604
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1884
        
        C:\Windows\SysWOW64\Dfoplpla.exe
        
        C:\Windows\system32\Dfoplpla.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4960
        
        C:\Windows\SysWOW64\Ddcqedkk.exe
        
        C:\Windows\system32\Ddcqedkk.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3476
        
        C:\Windows\SysWOW64\Djmibn32.exe
        
        C:\Windows\system32\Djmibn32.exe
        16⤵
        Executes dropped EXE
        
        PID:1620
        
        C:\Windows\SysWOW64\Eagaoh32.exe
        
        C:\Windows\system32\Eagaoh32.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3004
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        18⤵
        Executes dropped EXE
        
        PID:4832
        
        C:\Windows\SysWOW64\Ejpfhnpe.exe
        
        C:\Windows\system32\Ejpfhnpe.exe
        19⤵
        Executes dropped EXE
        
        PID:1520
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        20⤵
        Executes dropped EXE
        
        PID:1240
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        21⤵
        Executes dropped EXE
        
        PID:448
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4276
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2008
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        24⤵
        Executes dropped EXE
        
        PID:2936
        
        C:\Windows\SysWOW64\Edmclccp.exe
        
        C:\Windows\system32\Edmclccp.exe
        25⤵
        Executes dropped EXE
        
        PID:2332
        
        C:\Windows\SysWOW64\Efkphnbd.exe
        
        C:\Windows\system32\Efkphnbd.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3900
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2852
        
        C:\Windows\SysWOW64\Ehjlaaig.exe
        
        C:\Windows\system32\Ehjlaaig.exe
        28⤵
        Executes dropped EXE
        
        PID:3376
        
        C:\Windows\SysWOW64\Fmgejhgn.exe
        
        C:\Windows\system32\Fmgejhgn.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3544
        
        C:\Windows\SysWOW64\Fpeafcfa.exe
        
        C:\Windows\system32\Fpeafcfa.exe
        30⤵
        Executes dropped EXE
        
        PID:3424
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        31⤵
        Executes dropped EXE
        
        PID:1896
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3040
        
        C:\Windows\SysWOW64\Fhofmq32.exe
        
        C:\Windows\system32\Fhofmq32.exe
        33⤵
        Executes dropped EXE
        
        PID:3724
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        34⤵
        Executes dropped EXE
        
        PID:1648
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        35⤵
        Executes dropped EXE
        
        PID:4892
        
        C:\Windows\SysWOW64\Fhflnpoi.exe
        
        C:\Windows\system32\Fhflnpoi.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2016
        
        C:\Windows\SysWOW64\Gigheh32.exe
        
        C:\Windows\system32\Gigheh32.exe
        37⤵
        Executes dropped EXE
        
        PID:5012
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        38⤵
        Executes dropped EXE
        
        PID:3556
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1968
        
        C:\Windows\SysWOW64\Gpcmga32.exe
        
        C:\Windows\system32\Gpcmga32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1184
        
        C:\Windows\SysWOW64\Ggnedlao.exe
        
        C:\Windows\system32\Ggnedlao.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3416
        
        C:\Windows\SysWOW64\Gnhnaf32.exe
        
        C:\Windows\system32\Gnhnaf32.exe
        42⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        43⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        44⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        45⤵
        
        PID:804
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        46⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        47⤵
        
        PID:452
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4356
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        49⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\Injcmc32.exe
        
        C:\Windows\system32\Injcmc32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2660
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        51⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Ihphkl32.exe
        
        C:\Windows\system32\Ihphkl32.exe
        52⤵
        Drops file in System32 directory
        
        PID:5136
        
        C:\Windows\SysWOW64\Ijadbdoj.exe
        
        C:\Windows\system32\Ijadbdoj.exe
        53⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        54⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Igedlh32.exe
        
        C:\Windows\system32\Igedlh32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5320
        
        C:\Windows\SysWOW64\Inomhbeq.exe
        
        C:\Windows\system32\Inomhbeq.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5364
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        57⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Iggaah32.exe
        
        C:\Windows\system32\Iggaah32.exe
        58⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        59⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        60⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Iqbbpm32.exe
        
        C:\Windows\system32\Iqbbpm32.exe
        61⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Jhijqj32.exe
        
        C:\Windows\system32\Jhijqj32.exe
        62⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        63⤵
        Drops file in System32 directory
        
        PID:5688
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        64⤵
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        65⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Jjmcnbdm.exe
        
        C:\Windows\system32\Jjmcnbdm.exe
        66⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Jbdlop32.exe
        
        C:\Windows\system32\Jbdlop32.exe
        67⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        68⤵
        Drops file in System32 directory
        
        PID:5912
        
        C:\Windows\SysWOW64\Jjopcb32.exe
        
        C:\Windows\system32\Jjopcb32.exe
        69⤵
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Jqiipljg.exe
        
        C:\Windows\system32\Jqiipljg.exe
        70⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        71⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        72⤵
        Modifies registry class
        
        PID:6100
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        73⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Jdgafjpn.exe
        
        C:\Windows\system32\Jdgafjpn.exe
        74⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        75⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5296
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        76⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        77⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        78⤵
        Drops file in System32 directory
        
        PID:5544
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        79⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Kjffdalb.exe
        
        C:\Windows\system32\Kjffdalb.exe
        80⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Kbmoen32.exe
        
        C:\Windows\system32\Kbmoen32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5752
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        82⤵
        Drops file in System32 directory
        
        PID:5848
        
        C:\Windows\SysWOW64\Kgjgne32.exe
        
        C:\Windows\system32\Kgjgne32.exe
        83⤵
        Modifies registry class
        
        PID:5908
        
        C:\Windows\SysWOW64\Kndojobi.exe
        
        C:\Windows\system32\Kndojobi.exe
        84⤵
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6032
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        86⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        87⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        88⤵
        Modifies registry class
        
        PID:5384
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        89⤵
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Kjmmepfj.exe
        
        C:\Windows\system32\Kjmmepfj.exe
        90⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        91⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        92⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Kjpijpdg.exe
        
        C:\Windows\system32\Kjpijpdg.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5944
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        94⤵
        Drops file in System32 directory
        
        PID:6076
        
        C:\Windows\SysWOW64\Lgcjdd32.exe
        
        C:\Windows\system32\Lgcjdd32.exe
        95⤵
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        96⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        97⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        98⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Lbkkgl32.exe
        
        C:\Windows\system32\Lbkkgl32.exe
        99⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5164
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        101⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5532
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5852
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5248
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        104⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6064
        
        C:\Windows\SysWOW64\Mngegmbc.exe
        
        C:\Windows\system32\Mngegmbc.exe
        107⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        108⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        109⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Mahnhhod.exe
        
        C:\Windows\system32\Mahnhhod.exe
        110⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6296
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        112⤵
        Drops file in System32 directory
        
        PID:6340
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        113⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        114⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        115⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        116⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        117⤵
        Modifies registry class
        
        PID:6560
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6600
        
        C:\Windows\SysWOW64\Mnphmkji.exe
        
        C:\Windows\system32\Mnphmkji.exe
        119⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6688
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        121⤵
        Drops file in System32 directory
        
        PID:6744
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6812
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6876
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        124⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6960
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        126⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        127⤵
        Drops file in System32 directory
        
        PID:7048
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7092
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        129⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        130⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6240
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6320
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        133⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        134⤵
        Drops file in System32 directory
        
        PID:6452
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6512
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        136⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        137⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        138⤵
        Drops file in System32 directory
        
        PID:6752
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        139⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        140⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6916
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        141⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        142⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7128
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        144⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        145⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        146⤵
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        147⤵
        Modifies registry class
        
        PID:6440
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        148⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Ohpkmn32.exe
        
        C:\Windows\system32\Ohpkmn32.exe
        149⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        150⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Piphgq32.exe
        
        C:\Windows\system32\Piphgq32.exe
        151⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        152⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Pchlpfjb.exe
        
        C:\Windows\system32\Pchlpfjb.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7072
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        154⤵
        Drops file in System32 directory
        
        PID:5724
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        155⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        156⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        157⤵
        Modifies registry class
        
        PID:6636
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        158⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        159⤵
        Modifies registry class
        
        PID:7080
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        160⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Pifnhpmi.exe
        
        C:\Windows\system32\Pifnhpmi.exe
        161⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6808
        
        C:\Windows\SysWOW64\Pcobaedj.exe
        
        C:\Windows\system32\Pcobaedj.exe
        163⤵
        Drops file in System32 directory
        
        PID:7104
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        164⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        165⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        166⤵
        Drops file in System32 directory
        
        PID:6196
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        167⤵
        Modifies registry class
        
        PID:7044
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        168⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        169⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        170⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Aaiimadl.exe
        
        C:\Windows\system32\Aaiimadl.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7268
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        172⤵
        Drops file in System32 directory
        
        PID:7304
        
        C:\Windows\SysWOW64\Akamff32.exe
        
        C:\Windows\system32\Akamff32.exe
        173⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Achegd32.exe
        
        C:\Windows\system32\Achegd32.exe
        174⤵
        Modifies registry class
        
        PID:7400
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        175⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Alqjpi32.exe
        
        C:\Windows\system32\Alqjpi32.exe
        176⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7524
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7568
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7608
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7656
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        181⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        182⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7776
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        184⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        185⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        186⤵
        Drops file in System32 directory
        
        PID:7916
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        187⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        188⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        189⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        190⤵
        Drops file in System32 directory
        
        PID:8108
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        191⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        192⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        193⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        194⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        195⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        196⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7604
        
        C:\Windows\SysWOW64\Cbeapmll.exe
        
        C:\Windows\system32\Cbeapmll.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7680
        
        C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7756
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        200⤵
        Modifies registry class
        
        PID:7820
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        201⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7988
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        203⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        204⤵
        Modifies registry class
        
        PID:8168
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7256
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        206⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        207⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        208⤵
        Modifies registry class
        
        PID:7616
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7724
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7856
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        211⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        212⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7232
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        214⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        215⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7980
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8152
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        218⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        219⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        220⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        221⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7688
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        222⤵
        Modifies registry class
        
        PID:8104
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        223⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        224⤵
        Modifies registry class
        
        PID:8224
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8268
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        226⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        227⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8360
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        228⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        229⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        230⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        231⤵
        Drops file in System32 directory
        
        PID:8528
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        232⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Ffmfchle.exe
        
        C:\Windows\system32\Ffmfchle.exe
        233⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        234⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        235⤵
        Drops file in System32 directory
        
        PID:8720
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        236⤵
        Drops file in System32 directory
        
        PID:8756
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8800
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        238⤵
        Modifies registry class
        
        PID:8836
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        239⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        240⤵
        Drops file in System32 directory
        
        PID:8924
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        241⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        242⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        243⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        244⤵
        Modifies registry class
        
        PID:9096
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9148
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9184
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        247⤵
        Drops file in System32 directory
        
        PID:8164
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        248⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        249⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        250⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8468
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        252⤵
        Drops file in System32 directory
        
        PID:8520
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        253⤵
        Modifies registry class
        
        PID:8600
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        254⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8740
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        256⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        257⤵
        Modifies registry class
        
        PID:8868
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        258⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        259⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9068
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        261⤵
        Modifies registry class
        
        PID:9156
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        262⤵
        Drops file in System32 directory
        
        PID:9200
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        263⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8348
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        265⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8536
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        266⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        267⤵
        Modifies registry class
        
        PID:8788
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        268⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        269⤵
        Modifies registry class
        
        PID:8916
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        270⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        271⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        272⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        273⤵
        Modifies registry class
        
        PID:8440
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        274⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        275⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8832
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        276⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        277⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        278⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8340
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        279⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        280⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        281⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        282⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        283⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        284⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        285⤵
        Drops file in System32 directory
        
        PID:8844
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        286⤵
        Drops file in System32 directory
        
        PID:1188
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        287⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        288⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        289⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        290⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9276
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9316
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9364
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        294⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        295⤵
        Modifies registry class
        
        PID:9452
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        296⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9532
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        298⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        299⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        300⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9700
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        302⤵
        Drops file in System32 directory
        
        PID:9748
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        303⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        304⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        305⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        306⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        307⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        308⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        309⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        310⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        311⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        312⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        313⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        314⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        315⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        316⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        317⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        318⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        319⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        320⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        321⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        322⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        323⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        324⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        325⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        326⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        327⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        328⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        329⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        330⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        331⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        332⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        333⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        334⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        335⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        336⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        337⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        338⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        339⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        340⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        341⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        342⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        343⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        344⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        345⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        346⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        347⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        348⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        349⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        350⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        351⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        352⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        353⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        354⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        355⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        356⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        357⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        358⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        359⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        360⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        131⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        132⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        133⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        134⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        135⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        136⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        137⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        138⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        118⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        100⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        97⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        98⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        59⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        48⤵
        
        PID:14492
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        42⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        43⤵
        
        PID:15240
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        44⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        45⤵
        
        PID:452
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        39⤵
        
        PID:14988
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        40⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        41⤵
        
        PID:3416

C:\Windows\SysWOW64\Olanmgig.exe
C:\Windows\system32\Olanmgig.exe
1⤵
PID:10568
- C:\Windows\SysWOW64\Ojdnid32.exe
  C:\Windows\system32\Ojdnid32.exe
  2⤵
  PID:10616

C:\Windows\SysWOW64\Omcjep32.exe
C:\Windows\system32\Omcjep32.exe
1⤵
PID:10660
- C:\Windows\SysWOW64\Oejbfmpg.exe
  C:\Windows\system32\Oejbfmpg.exe
  2⤵
  PID:10708
- - C:\Windows\SysWOW64\Ohhnbhok.exe
    C:\Windows\system32\Ohhnbhok.exe
    3⤵
    PID:10752
  - - C:\Windows\SysWOW64\Oobfob32.exe
      C:\Windows\system32\Oobfob32.exe
      4⤵
      PID:10796
    - - C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        5⤵
        
        PID:10840
      - C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        6⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        7⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        8⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        9⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        10⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        11⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        12⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        13⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        14⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        15⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        16⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        17⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        18⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        19⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        20⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        21⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        22⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        23⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        24⤵
        
        PID:10824

C:\Windows\SysWOW64\Akqfkp32.exe
C:\Windows\system32\Akqfkp32.exe
1⤵
PID:10876
- C:\Windows\SysWOW64\Anobgl32.exe
  C:\Windows\system32\Anobgl32.exe
  2⤵
  PID:10948
- - C:\Windows\SysWOW64\Aefjii32.exe
    C:\Windows\system32\Aefjii32.exe
    3⤵
    PID:11028
  - - C:\Windows\SysWOW64\Adikdfna.exe
      C:\Windows\system32\Adikdfna.exe
      4⤵
      PID:11084
    - - C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        5⤵
        
        PID:11168
      - C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        6⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        7⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        8⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        9⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        10⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        11⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        12⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        13⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        14⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        15⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        16⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        17⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        18⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        19⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        20⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        21⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        22⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        23⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        24⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        25⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        26⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        27⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        28⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        29⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        30⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        31⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        32⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        33⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        34⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        35⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        36⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        37⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        38⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        39⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        40⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        41⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        42⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        43⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        44⤵
        
        PID:11488
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        45⤵
        
        PID:11528

C:\Windows\SysWOW64\Dnbakghm.exe
C:\Windows\system32\Dnbakghm.exe
1⤵
PID:11572
- C:\Windows\SysWOW64\Dfiildio.exe
  C:\Windows\system32\Dfiildio.exe
  2⤵
  PID:11616
- - C:\Windows\SysWOW64\Ddligq32.exe
    C:\Windows\system32\Ddligq32.exe
    3⤵
    PID:11660
  - - C:\Windows\SysWOW64\Dmcain32.exe
      C:\Windows\system32\Dmcain32.exe
      4⤵
      PID:11704
    - - C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        5⤵
        
        PID:11740
      - C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        6⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        7⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        8⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        9⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        10⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        11⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        12⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        13⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        14⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        15⤵
        
        PID:12168
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        16⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        17⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        18⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        19⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        20⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        21⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        22⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        23⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        24⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        25⤵
        
        PID:11776
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        26⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        27⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        28⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        29⤵
        
        PID:12032
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        30⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        31⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        32⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        33⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        34⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        35⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        36⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        37⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        38⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        39⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        40⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        41⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        42⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        43⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        44⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        45⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        46⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        47⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        48⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        49⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        50⤵
        
        PID:6676

C:\Windows\SysWOW64\Hmmfmhll.exe
C:\Windows\system32\Hmmfmhll.exe
1⤵
PID:11944
- C:\Windows\SysWOW64\Hlpfhe32.exe
  C:\Windows\system32\Hlpfhe32.exe
  2⤵
  PID:11352
- - C:\Windows\SysWOW64\Hekgfj32.exe
    C:\Windows\system32\Hekgfj32.exe
    3⤵
    PID:11348
  - - C:\Windows\SysWOW64\Hmbphg32.exe
      C:\Windows\system32\Hmbphg32.exe
      4⤵
      PID:12144

C:\Windows\SysWOW64\Hlepcdoa.exe
C:\Windows\system32\Hlepcdoa.exe
1⤵
PID:4852
- C:\Windows\SysWOW64\Hoclopne.exe
  C:\Windows\system32\Hoclopne.exe
  2⤵
  PID:11772

C:\Windows\SysWOW64\Hemdlj32.exe
C:\Windows\system32\Hemdlj32.exe
1⤵
PID:12320
- C:\Windows\SysWOW64\Hmdlmg32.exe
  C:\Windows\system32\Hmdlmg32.exe
  2⤵
  PID:12372
- - C:\Windows\SysWOW64\Hpchib32.exe
    C:\Windows\system32\Hpchib32.exe
    3⤵
    PID:12408
  - - C:\Windows\SysWOW64\Ibaeen32.exe
      C:\Windows\system32\Ibaeen32.exe
      4⤵
      PID:12444
    - - C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        5⤵
        
        PID:12480
      - C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        6⤵
        
        PID:12516
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        7⤵
        
        PID:12552
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        8⤵
        
        PID:12588
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        9⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        10⤵
        
        PID:12660
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        11⤵
        
        PID:12696
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        12⤵
        
        PID:12732
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        13⤵
        
        PID:12768
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        14⤵
        
        PID:12804

C:\Windows\SysWOW64\Hfjdqmng.exe
C:\Windows\system32\Hfjdqmng.exe
1⤵
PID:12156

C:\Windows\SysWOW64\Ioolkncg.exe
C:\Windows\system32\Ioolkncg.exe
1⤵
PID:12840
- C:\Windows\SysWOW64\Iidphgcn.exe
  C:\Windows\system32\Iidphgcn.exe
  2⤵
  PID:12876
- - C:\Windows\SysWOW64\Ipoheakj.exe
    C:\Windows\system32\Ipoheakj.exe
    3⤵
    PID:12912

C:\Windows\SysWOW64\Jcmdaljn.exe
C:\Windows\system32\Jcmdaljn.exe
1⤵
PID:12948
- C:\Windows\SysWOW64\Jiglnf32.exe
  C:\Windows\system32\Jiglnf32.exe
  2⤵
  PID:12984
- - C:\Windows\SysWOW64\Jgkmgk32.exe
    C:\Windows\system32\Jgkmgk32.exe
    3⤵
    PID:13020
  - - C:\Windows\SysWOW64\Jlgepanl.exe
      C:\Windows\system32\Jlgepanl.exe
      4⤵
      PID:13056
    - - C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        5⤵
        
        PID:13092
      - C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        6⤵
        
        PID:13128
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        7⤵
        
        PID:13164
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        8⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        9⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        10⤵
        
        PID:13272
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        11⤵
        
        PID:13308
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        12⤵
        
        PID:12296
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        13⤵
        
        PID:12344
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        14⤵
        
        PID:12440
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        15⤵
        
        PID:12392
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        16⤵
        
        PID:12544
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        17⤵
        
        PID:12616
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        18⤵
        
        PID:12688
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        19⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        20⤵
        
        PID:12832
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        21⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        22⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        23⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        24⤵
        
        PID:13088
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        25⤵
        
        PID:13152
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        26⤵
        
        PID:13220
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        27⤵
        
        PID:13280
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        28⤵
        
        PID:12312
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        29⤵
        
        PID:12428
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        30⤵
        
        PID:12536

C:\Windows\SysWOW64\Mcifkf32.exe
C:\Windows\system32\Mcifkf32.exe
1⤵
PID:12668
- C:\Windows\SysWOW64\Mjcngpjh.exe
  C:\Windows\system32\Mjcngpjh.exe
  2⤵
  PID:12728
- - C:\Windows\SysWOW64\Nqmfdj32.exe
    C:\Windows\system32\Nqmfdj32.exe
    3⤵
    PID:12872
  - - C:\Windows\SysWOW64\Nfjola32.exe
      C:\Windows\system32\Nfjola32.exe
      4⤵
      PID:12992
    - - C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        5⤵
        
        PID:13100
      - C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        6⤵
        
        PID:13208
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        7⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        8⤵
        
        PID:12488
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        9⤵
        
        PID:12704
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        10⤵
        
        PID:12908
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        11⤵
        
        PID:13080
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        12⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        13⤵
        
        PID:12596
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        14⤵
        
        PID:13008
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        15⤵
        
        PID:12352
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        16⤵
        
        PID:12956
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        17⤵
        
        PID:12868
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        18⤵
        
        PID:12864

C:\Windows\SysWOW64\Opnbae32.exe
C:\Windows\system32\Opnbae32.exe
1⤵
PID:13336
- C:\Windows\SysWOW64\Ocjoadei.exe
  C:\Windows\system32\Ocjoadei.exe
  2⤵
  PID:13372
- - C:\Windows\SysWOW64\Ojdgnn32.exe
    C:\Windows\system32\Ojdgnn32.exe
    3⤵
    PID:13408
  - - C:\Windows\SysWOW64\Oanokhdb.exe
      C:\Windows\system32\Oanokhdb.exe
      4⤵
      PID:13444
    - - C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        5⤵
        
        PID:13480
      - C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        6⤵
        
        PID:13516
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        7⤵
        
        PID:13552
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        8⤵
        
        PID:13588
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        9⤵
        
        PID:13624
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        10⤵
        
        PID:13672

C:\Windows\SysWOW64\Ohlqcagj.exe
C:\Windows\system32\Ohlqcagj.exe
1⤵
PID:13720
- C:\Windows\SysWOW64\Pfoann32.exe
  C:\Windows\system32\Pfoann32.exe
  2⤵
  PID:13764
- - C:\Windows\SysWOW64\Pnfiplog.exe
    C:\Windows\system32\Pnfiplog.exe
    3⤵
    PID:13800
  - - C:\Windows\SysWOW64\Ppgegd32.exe
      C:\Windows\system32\Ppgegd32.exe
      4⤵
      PID:13836
    - - C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        5⤵
        
        PID:13880

C:\Windows\SysWOW64\Pnifekmd.exe
C:\Windows\system32\Pnifekmd.exe
1⤵
PID:13928
- C:\Windows\SysWOW64\Pmlfqh32.exe
  C:\Windows\system32\Pmlfqh32.exe
  2⤵
  PID:13968
- - C:\Windows\SysWOW64\Ppjbmc32.exe
    C:\Windows\system32\Ppjbmc32.exe
    3⤵
    PID:14004
  - - C:\Windows\SysWOW64\Phajna32.exe
      C:\Windows\system32\Phajna32.exe
      4⤵
      PID:14040
    - - C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        5⤵
        
        PID:14076

C:\Windows\SysWOW64\Pplobcpp.exe
C:\Windows\system32\Pplobcpp.exe
1⤵
PID:14148
- C:\Windows\SysWOW64\Pffgom32.exe
  C:\Windows\system32\Pffgom32.exe
  2⤵
  PID:14184
- - C:\Windows\SysWOW64\Pmpolgoi.exe
    C:\Windows\system32\Pmpolgoi.exe
    3⤵
    PID:14220
  - - C:\Windows\SysWOW64\Pdjgha32.exe
      C:\Windows\system32\Pdjgha32.exe
      4⤵
      PID:14256

C:\Windows\SysWOW64\Pmnbfhal.exe
C:\Windows\system32\Pmnbfhal.exe
1⤵
PID:14112

C:\Windows\SysWOW64\Pfiddm32.exe
C:\Windows\system32\Pfiddm32.exe
1⤵
PID:14296
- C:\Windows\SysWOW64\Pjdpelnc.exe
  C:\Windows\system32\Pjdpelnc.exe
  2⤵
  PID:13320
- - C:\Windows\SysWOW64\Pmblagmf.exe
    C:\Windows\system32\Pmblagmf.exe
    3⤵
    PID:13416

C:\Windows\SysWOW64\Ppahmb32.exe
C:\Windows\system32\Ppahmb32.exe
1⤵
PID:13508
- C:\Windows\SysWOW64\Pdmdnadc.exe
  C:\Windows\system32\Pdmdnadc.exe
  2⤵
  PID:13576

C:\Windows\SysWOW64\Qfkqjmdg.exe
C:\Windows\system32\Qfkqjmdg.exe
1⤵
PID:13620
- C:\Windows\SysWOW64\Qobhkjdi.exe
  C:\Windows\system32\Qobhkjdi.exe
  2⤵
  PID:1588
- - C:\Windows\SysWOW64\Qaqegecm.exe
    C:\Windows\system32\Qaqegecm.exe
    3⤵
    PID:13748

C:\Windows\SysWOW64\Qpcecb32.exe
C:\Windows\system32\Qpcecb32.exe
1⤵
PID:13792
- C:\Windows\SysWOW64\Qfmmplad.exe
  C:\Windows\system32\Qfmmplad.exe
  2⤵
  PID:13868
- - C:\Windows\SysWOW64\Qacameaj.exe
    C:\Windows\system32\Qacameaj.exe
    3⤵
    PID:13960
  - - C:\Windows\SysWOW64\Afpjel32.exe
      C:\Windows\system32\Afpjel32.exe
      4⤵
      PID:14036
    - - C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        5⤵
        
        PID:14104
      - C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        6⤵
        
        PID:14168
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        7⤵
        
        PID:14228
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        8⤵
        
        PID:14284
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        9⤵
        
        PID:13332
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        10⤵
        
        PID:13432
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        11⤵
        
        PID:13544
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        12⤵
        
        PID:13644
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        13⤵
        
        PID:13760
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        14⤵
        
        PID:13860
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        15⤵
        
        PID:8
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        16⤵
        
        PID:14024
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        17⤵
        
        PID:14140

C:\Windows\SysWOW64\Akdilipp.exe
C:\Windows\system32\Akdilipp.exe
1⤵
PID:14244
- C:\Windows\SysWOW64\Amcehdod.exe
  C:\Windows\system32\Amcehdod.exe
  2⤵
  PID:13356

C:\Windows\SysWOW64\Bdmmeo32.exe
C:\Windows\system32\Bdmmeo32.exe
1⤵
PID:13512
- C:\Windows\SysWOW64\Bhhiemoj.exe
  C:\Windows\system32\Bhhiemoj.exe
  2⤵
  PID:13716
- - C:\Windows\SysWOW64\Bobabg32.exe
    C:\Windows\system32\Bobabg32.exe
    3⤵
    PID:2708

C:\Windows\SysWOW64\Bmeandma.exe
C:\Windows\system32\Bmeandma.exe
1⤵
PID:4872
- C:\Windows\SysWOW64\Bdojjo32.exe
  C:\Windows\system32\Bdojjo32.exe
  2⤵
  PID:13912

C:\Windows\SysWOW64\Bgnffj32.exe
C:\Windows\system32\Bgnffj32.exe
1⤵
PID:14308
- C:\Windows\SysWOW64\Boenhgdd.exe
  C:\Windows\system32\Boenhgdd.exe
  2⤵
  PID:3712
- - C:\Windows\SysWOW64\Bmhocd32.exe
    C:\Windows\system32\Bmhocd32.exe
    3⤵
    PID:3916
  - - C:\Windows\SysWOW64\Bpfkpp32.exe
      C:\Windows\system32\Bpfkpp32.exe
      4⤵
      PID:2700
    - - C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        5⤵
        
        PID:1628
      - C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        6⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        7⤵
        
        PID:14204
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        8⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        9⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        10⤵
        
        PID:13856
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        11⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        12⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        13⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        14⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        15⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        16⤵
        
        PID:404
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        17⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        18⤵
        
        PID:13472
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        19⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        20⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        21⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        22⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        23⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        24⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Damfao32.exe
        
        C:\Windows\system32\Damfao32.exe
        25⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        26⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        27⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        28⤵
        
        PID:740
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        29⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        30⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        31⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        32⤵
        
        PID:712
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        33⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        34⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        35⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        36⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        37⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        38⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        39⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        40⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        41⤵
        
        PID:14324
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        42⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        43⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        44⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        45⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        46⤵
        
        PID:13744
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        47⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        48⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        49⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        50⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        51⤵
        
        PID:13872
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        52⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        53⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        54⤵
        
        PID:3804

C:\Windows\SysWOW64\Fganqbgg.exe
C:\Windows\system32\Fganqbgg.exe
1⤵
PID:3900
- C:\Windows\SysWOW64\Fohfbpgi.exe
  C:\Windows\system32\Fohfbpgi.exe
  2⤵
  PID:2464
- - C:\Windows\SysWOW64\Fnkfmm32.exe
    C:\Windows\system32\Fnkfmm32.exe
    3⤵
    PID:2712

C:\Windows\SysWOW64\Fajbjh32.exe
C:\Windows\system32\Fajbjh32.exe
1⤵
PID:3376
- C:\Windows\SysWOW64\Feenjgfq.exe
  C:\Windows\system32\Feenjgfq.exe
  2⤵
  PID:13648

C:\Windows\SysWOW64\Fgcjfbed.exe
C:\Windows\system32\Fgcjfbed.exe
1⤵
PID:1520
- C:\Windows\SysWOW64\Fkofga32.exe
  C:\Windows\system32\Fkofga32.exe
  2⤵
  PID:4784

C:\Windows\SysWOW64\Gnnccl32.exe
C:\Windows\system32\Gnnccl32.exe
1⤵
PID:3828
- C:\Windows\SysWOW64\Gbiockdj.exe
  C:\Windows\system32\Gbiockdj.exe
  2⤵
  PID:1036

C:\Windows\SysWOW64\Gegkpf32.exe
C:\Windows\system32\Gegkpf32.exe
1⤵
PID:1100
- C:\Windows\SysWOW64\Gicgpelg.exe
  C:\Windows\system32\Gicgpelg.exe
  2⤵
  PID:3220

C:\Windows\SysWOW64\Gpmomo32.exe
C:\Windows\system32\Gpmomo32.exe
1⤵
PID:14340
- C:\Windows\SysWOW64\Gbkkik32.exe
  C:\Windows\system32\Gbkkik32.exe
  2⤵
  PID:14388

C:\Windows\SysWOW64\Ganldgib.exe
C:\Windows\system32\Ganldgib.exe
1⤵
PID:14424
- C:\Windows\SysWOW64\Giecfejd.exe
  C:\Windows\system32\Giecfejd.exe
  2⤵
  PID:14460
- - C:\Windows\SysWOW64\Gpolbo32.exe
    C:\Windows\system32\Gpolbo32.exe
    3⤵
    PID:14496

C:\Windows\SysWOW64\Gbnhoj32.exe
C:\Windows\system32\Gbnhoj32.exe
1⤵
PID:14532
- C:\Windows\SysWOW64\Geldkfpi.exe
  C:\Windows\system32\Geldkfpi.exe
  2⤵
  PID:14568
- - C:\Windows\SysWOW64\Gihpkd32.exe
    C:\Windows\system32\Gihpkd32.exe
    3⤵
    PID:14612

C:\Windows\SysWOW64\Glfmgp32.exe
C:\Windows\system32\Glfmgp32.exe
1⤵
PID:14648
- C:\Windows\SysWOW64\Gbpedjnb.exe
  C:\Windows\system32\Gbpedjnb.exe
  2⤵
  PID:14692
- - C:\Windows\SysWOW64\Geoapenf.exe
    C:\Windows\system32\Geoapenf.exe
    3⤵
    PID:14728

C:\Windows\SysWOW64\Gijmad32.exe
C:\Windows\system32\Gijmad32.exe
1⤵
PID:14764
- C:\Windows\SysWOW64\Glhimp32.exe
  C:\Windows\system32\Glhimp32.exe
  2⤵
  PID:14808

C:\Windows\SysWOW64\Gpdennml.exe
C:\Windows\system32\Gpdennml.exe
1⤵
PID:14856
- C:\Windows\SysWOW64\Gbbajjlp.exe
  C:\Windows\system32\Gbbajjlp.exe
  2⤵
  PID:14896
- - C:\Windows\SysWOW64\Geanfelc.exe
    C:\Windows\system32\Geanfelc.exe
    3⤵
    PID:14936
  - - C:\Windows\SysWOW64\Giljfddl.exe
      C:\Windows\system32\Giljfddl.exe
      4⤵
      PID:14980

C:\Windows\SysWOW64\Hlkfbocp.exe
C:\Windows\system32\Hlkfbocp.exe
1⤵
PID:15016
- C:\Windows\SysWOW64\Hnibokbd.exe
  C:\Windows\system32\Hnibokbd.exe
  2⤵
  PID:15064

C:\Windows\SysWOW64\Hbenoi32.exe
C:\Windows\system32\Hbenoi32.exe
1⤵
PID:15100
- C:\Windows\SysWOW64\Hecjke32.exe
  C:\Windows\system32\Hecjke32.exe
  2⤵
  PID:15148
- - C:\Windows\SysWOW64\Hhaggp32.exe
    C:\Windows\system32\Hhaggp32.exe
    3⤵
    PID:15184
  - - C:\Windows\SysWOW64\Hpioin32.exe
      C:\Windows\system32\Hpioin32.exe
      4⤵
      PID:15224

C:\Windows\SysWOW64\Hbgkei32.exe
C:\Windows\system32\Hbgkei32.exe
1⤵
PID:15272
- C:\Windows\SysWOW64\Hajkqfoe.exe
  C:\Windows\system32\Hajkqfoe.exe
  2⤵
  PID:15316
- - C:\Windows\SysWOW64\Hiacacpg.exe
    C:\Windows\system32\Hiacacpg.exe
    3⤵
    PID:15356
  - - C:\Windows\SysWOW64\Hhdcmp32.exe
      C:\Windows\system32\Hhdcmp32.exe
      4⤵
      PID:14356
    - - C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        5⤵
        
        PID:14420
      - C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        6⤵
        
        PID:14468
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        7⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        8⤵
        
        PID:14564
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        9⤵
        
        PID:14604
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        10⤵
        
        PID:14672
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        11⤵
        
        PID:14716
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        12⤵
        
        PID:14748
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        13⤵
        
        PID:14816
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        14⤵
        
        PID:14868
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        15⤵
        
        PID:14892
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        16⤵
        
        PID:14920
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        17⤵
        
        PID:15008
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        18⤵
        
        PID:15060

C:\Windows\SysWOW64\Iiopca32.exe
C:\Windows\system32\Iiopca32.exe
1⤵
PID:15304
- C:\Windows\SysWOW64\Ilnlom32.exe
  C:\Windows\system32\Ilnlom32.exe
  2⤵
  PID:4140
- - C:\Windows\SysWOW64\Iolhkh32.exe
    C:\Windows\system32\Iolhkh32.exe
    3⤵
    PID:4284

C:\Windows\SysWOW64\Iialhaad.exe
C:\Windows\system32\Iialhaad.exe
1⤵
PID:14608
- C:\Windows\SysWOW64\Ilphdlqh.exe
  C:\Windows\system32\Ilphdlqh.exe
  2⤵
  PID:14680
- - C:\Windows\SysWOW64\Ibjqaf32.exe
    C:\Windows\system32\Ibjqaf32.exe
    3⤵
    PID:376

C:\Windows\SysWOW64\Iamamcop.exe
C:\Windows\system32\Iamamcop.exe
1⤵
PID:5160
- C:\Windows\SysWOW64\Jidinqpb.exe
  C:\Windows\system32\Jidinqpb.exe
  2⤵
  PID:3556

C:\Windows\SysWOW64\Jeocna32.exe
C:\Windows\system32\Jeocna32.exe
1⤵
PID:2884
- C:\Windows\SysWOW64\Jhnojl32.exe
  C:\Windows\system32\Jhnojl32.exe
  2⤵
  PID:1292

C:\Windows\SysWOW64\Jpegkj32.exe
C:\Windows\system32\Jpegkj32.exe
1⤵
PID:14776
- C:\Windows\SysWOW64\Jafdcbge.exe
  C:\Windows\system32\Jafdcbge.exe
  2⤵
  PID:5140

C:\Windows\SysWOW64\Jeapcq32.exe
C:\Windows\system32\Jeapcq32.exe
1⤵
PID:5764
- C:\Windows\SysWOW64\Jhplpl32.exe
  C:\Windows\system32\Jhplpl32.exe
  2⤵
  PID:5200
- - C:\Windows\SysWOW64\Jpgdai32.exe
    C:\Windows\system32\Jpgdai32.exe
    3⤵
    PID:15116

C:\Windows\SysWOW64\Kedlip32.exe
C:\Windows\system32\Kedlip32.exe
1⤵
PID:5368
- C:\Windows\SysWOW64\Klndfj32.exe
  C:\Windows\system32\Klndfj32.exe
  2⤵
  PID:4984
- - C:\Windows\SysWOW64\Kolabf32.exe
    C:\Windows\system32\Kolabf32.exe
    3⤵
    PID:5524

C:\Windows\SysWOW64\Kakmna32.exe
C:\Windows\system32\Kakmna32.exe
1⤵
PID:4628
- C:\Windows\SysWOW64\Kibeoo32.exe
  C:\Windows\system32\Kibeoo32.exe
  2⤵
  PID:5188
- - C:\Windows\SysWOW64\Kplmliko.exe
    C:\Windows\system32\Kplmliko.exe
    3⤵
    PID:5656

C:\Windows\SysWOW64\Kamjda32.exe
C:\Windows\system32\Kamjda32.exe
1⤵
PID:5156
- C:\Windows\SysWOW64\Kidben32.exe
  C:\Windows\system32\Kidben32.exe
  2⤵
  PID:5288
- - C:\Windows\SysWOW64\Klbnajqc.exe
    C:\Windows\system32\Klbnajqc.exe
    3⤵
    PID:15052

C:\Windows\SysWOW64\Koajmepf.exe
C:\Windows\system32\Koajmepf.exe
1⤵
PID:15096
- C:\Windows\SysWOW64\Kapfiqoj.exe
  C:\Windows\system32\Kapfiqoj.exe
  2⤵
  PID:15180

C:\Windows\SysWOW64\Kcapicdj.exe
C:\Windows\system32\Kcapicdj.exe
1⤵
PID:5708
- C:\Windows\SysWOW64\Lepleocn.exe
  C:\Windows\system32\Lepleocn.exe
  2⤵
  PID:5304
- - C:\Windows\SysWOW64\Lhnhajba.exe
    C:\Windows\system32\Lhnhajba.exe
    3⤵
    PID:5352

C:\Windows\SysWOW64\Kpccmhdg.exe
C:\Windows\system32\Kpccmhdg.exe
1⤵
PID:5988

C:\Windows\SysWOW64\Lpepbgbd.exe
C:\Windows\system32\Lpepbgbd.exe
1⤵
PID:5128
- C:\Windows\SysWOW64\Lcclncbh.exe
  C:\Windows\system32\Lcclncbh.exe
  2⤵
  PID:15168
- - C:\Windows\SysWOW64\Lebijnak.exe
    C:\Windows\system32\Lebijnak.exe
    3⤵
    PID:5720

C:\Windows\SysWOW64\Kabcopmg.exe
C:\Windows\system32\Kabcopmg.exe
1⤵
PID:5464

C:\Windows\SysWOW64\Kocgbend.exe
C:\Windows\system32\Kocgbend.exe
1⤵
PID:5416

C:\Windows\SysWOW64\Legben32.exe
C:\Windows\system32\Legben32.exe
1⤵
PID:5760
- C:\Windows\SysWOW64\Ljbnfleo.exe
  C:\Windows\system32\Ljbnfleo.exe
  2⤵
  PID:5864

C:\Windows\SysWOW64\Llqjbhdc.exe
C:\Windows\system32\Llqjbhdc.exe
1⤵
PID:5616
- C:\Windows\SysWOW64\Loofnccf.exe
  C:\Windows\system32\Loofnccf.exe
  2⤵
  PID:6024
- - C:\Windows\SysWOW64\Lancko32.exe
    C:\Windows\system32\Lancko32.exe
    3⤵
    PID:14676

C:\Windows\SysWOW64\Lfiokmkc.exe
C:\Windows\system32\Lfiokmkc.exe
1⤵
PID:5552
- C:\Windows\SysWOW64\Lhgkgijg.exe
  C:\Windows\system32\Lhgkgijg.exe
  2⤵
  PID:5640
- - C:\Windows\SysWOW64\Lpochfji.exe
    C:\Windows\system32\Lpochfji.exe
    3⤵
    PID:3456
  - - C:\Windows\SysWOW64\Loacdc32.exe
      C:\Windows\system32\Loacdc32.exe
      4⤵
      PID:5588

C:\Windows\SysWOW64\Mapppn32.exe
C:\Windows\system32\Mapppn32.exe
1⤵
PID:5928
- C:\Windows\SysWOW64\Mjggal32.exe
  C:\Windows\system32\Mjggal32.exe
  2⤵
  PID:5176
- - C:\Windows\SysWOW64\Mhjhmhhd.exe
    C:\Windows\system32\Mhjhmhhd.exe
    3⤵
    PID:5652
  - - C:\Windows\SysWOW64\Mpapnfhg.exe
      C:\Windows\system32\Mpapnfhg.exe
      4⤵
      PID:5824
    - - C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        5⤵
        
        PID:4356
      - C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        6⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        7⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        8⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        9⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        10⤵
        
        PID:5556

C:\Windows\SysWOW64\Klekfinp.exe
C:\Windows\system32\Klekfinp.exe
1⤵
PID:1952

C:\Windows\SysWOW64\Kifojnol.exe
C:\Windows\system32\Kifojnol.exe
1⤵
PID:15200

C:\Windows\SysWOW64\Koonge32.exe
C:\Windows\system32\Koonge32.exe
1⤵
PID:3576

C:\Windows\SysWOW64\Jahqiaeb.exe
C:\Windows\system32\Jahqiaeb.exe
1⤵
PID:15160

C:\Windows\SysWOW64\Joekag32.exe
C:\Windows\system32\Joekag32.exe
1⤵
PID:2448

C:\Windows\SysWOW64\Iajdgcab.exe
C:\Windows\system32\Iajdgcab.exe
1⤵
PID:14528

C:\Windows\SysWOW64\Ieccbbkn.exe
C:\Windows\system32\Ieccbbkn.exe
1⤵
PID:15264

C:\Windows\SysWOW64\Ibegfglj.exe
C:\Windows\system32\Ibegfglj.exe
1⤵
PID:1848

C:\Windows\SysWOW64\Ipgkjlmg.exe
C:\Windows\system32\Ipgkjlmg.exe
1⤵
PID:15136

C:\Windows\SysWOW64\Ihpcinld.exe
C:\Windows\system32\Ihpcinld.exe
1⤵
PID:15088

C:\Windows\SysWOW64\Gkaclqkk.exe
C:\Windows\system32\Gkaclqkk.exe
1⤵
PID:2248

C:\Windows\SysWOW64\Mljmhflh.exe
C:\Windows\system32\Mljmhflh.exe
1⤵
PID:5216
- C:\Windows\SysWOW64\Mohidbkl.exe
  C:\Windows\system32\Mohidbkl.exe
  2⤵
  PID:5436
- - C:\Windows\SysWOW64\Mbgeqmjp.exe
    C:\Windows\system32\Mbgeqmjp.exe
    3⤵
    PID:5740
  - - C:\Windows\SysWOW64\Mjnnbk32.exe
      C:\Windows\system32\Mjnnbk32.exe
      4⤵
      PID:14924

C:\Windows\SysWOW64\Mlljnf32.exe
C:\Windows\system32\Mlljnf32.exe
1⤵
PID:5872
- C:\Windows\SysWOW64\Mqhfoebo.exe
  C:\Windows\system32\Mqhfoebo.exe
  2⤵
  PID:6040
- - C:\Windows\SysWOW64\Mcfbkpab.exe
    C:\Windows\system32\Mcfbkpab.exe
    3⤵
    PID:6084
  - - C:\Windows\SysWOW64\Mfenglqf.exe
      C:\Windows\system32\Mfenglqf.exe
      4⤵
      PID:5904

C:\Windows\SysWOW64\Mhckcgpj.exe
C:\Windows\system32\Mhckcgpj.exe
1⤵
PID:6496
- C:\Windows\SysWOW64\Mlofcf32.exe
  C:\Windows\system32\Mlofcf32.exe
  2⤵
  PID:5432

C:\Windows\SysWOW64\Ncpeaoih.exe
C:\Windows\system32\Ncpeaoih.exe
1⤵
PID:5632
- C:\Windows\SysWOW64\Nfnamjhk.exe
  C:\Windows\system32\Nfnamjhk.exe
  2⤵
  PID:6004

C:\Windows\SysWOW64\Nofefp32.exe
C:\Windows\system32\Nofefp32.exe
1⤵
PID:2904
- C:\Windows\SysWOW64\Nbebbk32.exe
  C:\Windows\system32\Nbebbk32.exe
  2⤵
  PID:6120
- - C:\Windows\SysWOW64\Njljch32.exe
    C:\Windows\system32\Njljch32.exe
    3⤵
    PID:6212
  - - C:\Windows\SysWOW64\Nmjfodne.exe
      C:\Windows\system32\Nmjfodne.exe
      4⤵
      PID:6388
    - - C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        5⤵
        
        PID:7160
      - C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        6⤵
        
        PID:5648

C:\Windows\SysWOW64\Nmhijd32.exe
C:\Windows\system32\Nmhijd32.exe
1⤵
PID:6768

C:\Windows\SysWOW64\Ookoaokf.exe
C:\Windows\system32\Ookoaokf.exe
1⤵
PID:5372
- C:\Windows\SysWOW64\Objkmkjj.exe
  C:\Windows\system32\Objkmkjj.exe
  2⤵
  PID:5996

C:\Windows\SysWOW64\Ofegni32.exe
C:\Windows\system32\Ofegni32.exe
1⤵
PID:6704
- C:\Windows\SysWOW64\Oiccje32.exe
  C:\Windows\system32\Oiccje32.exe
  2⤵
  PID:14452
- - C:\Windows\SysWOW64\Oqklkbbi.exe
    C:\Windows\system32\Oqklkbbi.exe
    3⤵
    PID:6408

C:\Windows\SysWOW64\Ofgdcipq.exe
C:\Windows\system32\Ofgdcipq.exe
1⤵
PID:6128
- C:\Windows\SysWOW64\Oifppdpd.exe
  C:\Windows\system32\Oifppdpd.exe
  2⤵
  PID:7020
- - C:\Windows\SysWOW64\Oqmhqapg.exe
    C:\Windows\system32\Oqmhqapg.exe
    3⤵
    PID:6436
  - - C:\Windows\SysWOW64\Ockdmmoj.exe
      C:\Windows\system32\Ockdmmoj.exe
      4⤵
      PID:5388
    - - C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        5⤵
        
        PID:6560

C:\Windows\SysWOW64\Ocihgnam.exe
C:\Windows\system32\Ocihgnam.exe
1⤵
PID:5240

C:\Windows\SysWOW64\Ommceclc.exe
C:\Windows\system32\Ommceclc.exe
1⤵
PID:6420

C:\Windows\SysWOW64\Pimfpc32.exe
C:\Windows\system32\Pimfpc32.exe
1⤵
PID:7112
- C:\Windows\SysWOW64\Padnaq32.exe
  C:\Windows\system32\Padnaq32.exe
  2⤵
  PID:7148
- - C:\Windows\SysWOW64\Pcbkml32.exe
    C:\Windows\system32\Pcbkml32.exe
    3⤵
    PID:6520
  - - C:\Windows\SysWOW64\Pbekii32.exe
      C:\Windows\system32\Pbekii32.exe
      4⤵
      PID:5292
    - - C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        5⤵
        
        PID:6848
      - C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        6⤵
        
        PID:14832
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        7⤵
        
        PID:6344

C:\Windows\SysWOW64\Piapkbeg.exe
C:\Windows\system32\Piapkbeg.exe
1⤵
PID:6372
- C:\Windows\SysWOW64\Paihlpfi.exe
  C:\Windows\system32\Paihlpfi.exe
  2⤵
  PID:7032
- - C:\Windows\SysWOW64\Pbjddh32.exe
    C:\Windows\system32\Pbjddh32.exe
    3⤵
    PID:5236
  - - C:\Windows\SysWOW64\Pidlqb32.exe
      C:\Windows\system32\Pidlqb32.exe
      4⤵
      PID:6864
    - - C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        5⤵
        
        PID:6580
      - C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        6⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        7⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 404
        8⤵
        Program crash
        
        PID:6348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3988 -ip 3988
1⤵
PID:6992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aagkhd32.exe

Filesize
77KB

MD5
d9d9aaaa3b34b8aebe0896a5b12a08dc

SHA1
5c88ccc6ea610d68a17153ea721c7ae46773bc34

SHA256
703a8856e8e8a52730447be18078e0e629c6d1b73b588139cb46bac9c06a7cd5

SHA512
33d5c3b2b9c2c3e9a35332d402c9b13822e065a97c8f4f91e8856c133a694c87dad043a99a8c604c0ede307c2b1694a1f4616d74166179e78870de31bd3e66a7

Download Submit
C:\Windows\SysWOW64\Aanbhp32.exe

Filesize
77KB

MD5
1f140dd0726f0cbb9390f316c6c4afb3

SHA1
3e9a57860de558e28f359f065196d7f41174929a

SHA256
75b6ec5daa28304806190f7332b2a08c8e16d7b39e33091cb9d0135d494251b0

SHA512
003523dfdb3f6c794ed8b5115acbb5c11659e8f270a7f38edb8089703883926532ad8cf907420cca06bc763f6a0b0d3afedff6574f98a78dc8b23de97d780e1a

Download Submit
C:\Windows\SysWOW64\Acnemi32.exe

Filesize
77KB

MD5
6d617b48bafb3d906e4e28d269793a01

SHA1
b62bfd23a60f57f07a7a9a1a6a32296c4ce1e008

SHA256
59723cbe1caa8cc8bc78fad6c2bd4d20a479957a15f8220375fca5706b1b6dbd

SHA512
ab9678e635339a516a2feee49a74b51294d0eda539fe3734c145eebe3d22e31ff8134f9e29be8dc4fb9e536aa336b142221f2def5a6dfbc4611e1b01cdb697df

Download Submit
C:\Windows\SysWOW64\Acnemi32.exe

Filesize
77KB

MD5
6d617b48bafb3d906e4e28d269793a01

SHA1
b62bfd23a60f57f07a7a9a1a6a32296c4ce1e008

SHA256
59723cbe1caa8cc8bc78fad6c2bd4d20a479957a15f8220375fca5706b1b6dbd

SHA512
ab9678e635339a516a2feee49a74b51294d0eda539fe3734c145eebe3d22e31ff8134f9e29be8dc4fb9e536aa336b142221f2def5a6dfbc4611e1b01cdb697df

Download Submit
C:\Windows\SysWOW64\Aflaie32.exe

Filesize
77KB

MD5
6d617b48bafb3d906e4e28d269793a01

SHA1
b62bfd23a60f57f07a7a9a1a6a32296c4ce1e008

SHA256
59723cbe1caa8cc8bc78fad6c2bd4d20a479957a15f8220375fca5706b1b6dbd

SHA512
ab9678e635339a516a2feee49a74b51294d0eda539fe3734c145eebe3d22e31ff8134f9e29be8dc4fb9e536aa336b142221f2def5a6dfbc4611e1b01cdb697df

Download Submit
C:\Windows\SysWOW64\Aflaie32.exe

Filesize
77KB

MD5
42861dba5d49b2b14b72e9b2bfecdcdd

SHA1
296064eb322b43a4a7f7c540cdf5afac6bfa5b69

SHA256
ba5890a4afc582b9b65cbae62cac61fe4758bc20d8494ed9c4b7f56fc1764b0d

SHA512
edd56046fdc49296722af0d45f3c540a6e39fe90855313d633689eaa7292de319e04474c71714495725583050edd0b4ccda06ac692658a25f6cdbc15b59d64cf

Download Submit
C:\Windows\SysWOW64\Aflaie32.exe

Filesize
77KB

MD5
42861dba5d49b2b14b72e9b2bfecdcdd

SHA1
296064eb322b43a4a7f7c540cdf5afac6bfa5b69

SHA256
ba5890a4afc582b9b65cbae62cac61fe4758bc20d8494ed9c4b7f56fc1764b0d

SHA512
edd56046fdc49296722af0d45f3c540a6e39fe90855313d633689eaa7292de319e04474c71714495725583050edd0b4ccda06ac692658a25f6cdbc15b59d64cf

Download Submit
C:\Windows\SysWOW64\Afnnnd32.exe

Filesize
77KB

MD5
4cbfb666215ee3c1607a08e6e3e5552b

SHA1
381fdffab85752c0d3abecd12b11a7f25fc968b4

SHA256
2884da4c87a506f34205b13ff2cbeca0f1f4b9e62f0e6ff7a13bc56b72577191

SHA512
1f0d82fa10df7d7d9104effc39402fc0c9a64348c8be1df5466ee4b51b734c68eef2aca81a037fdc401174c0c20b7e9f665611d0d2b80305e8f4c879a5a96f43

Download Submit
C:\Windows\SysWOW64\Afnnnd32.exe

Filesize
77KB

MD5
4cbfb666215ee3c1607a08e6e3e5552b

SHA1
381fdffab85752c0d3abecd12b11a7f25fc968b4

SHA256
2884da4c87a506f34205b13ff2cbeca0f1f4b9e62f0e6ff7a13bc56b72577191

SHA512
1f0d82fa10df7d7d9104effc39402fc0c9a64348c8be1df5466ee4b51b734c68eef2aca81a037fdc401174c0c20b7e9f665611d0d2b80305e8f4c879a5a96f43

Download Submit
C:\Windows\SysWOW64\Agbkmijg.exe

Filesize
77KB

MD5
8e9c23d0a9be26238adc5722f4d48dc7

SHA1
1e4b2ca5d47cc42fdaa9251c410df35fc5ac5b56

SHA256
49b7bbce5d5bb5dea74cc4fc684c2e31f6dc4a43eb1daf928af893f5adca1df0

SHA512
4be5d2e10f1df31cd812d067c326907bc7f8106e53fecc843d6b8ce7c4c747a75a74bf026bd55872004d0b00c46be814b0958e1429e61888505d6ad1b446ee64

Download Submit
C:\Windows\SysWOW64\Agbkmijg.exe

Filesize
77KB

MD5
8e9c23d0a9be26238adc5722f4d48dc7

SHA1
1e4b2ca5d47cc42fdaa9251c410df35fc5ac5b56

SHA256
49b7bbce5d5bb5dea74cc4fc684c2e31f6dc4a43eb1daf928af893f5adca1df0

SHA512
4be5d2e10f1df31cd812d067c326907bc7f8106e53fecc843d6b8ce7c4c747a75a74bf026bd55872004d0b00c46be814b0958e1429e61888505d6ad1b446ee64

Download Submit
C:\Windows\SysWOW64\Agdhbi32.exe

Filesize
77KB

MD5
e7c9b27ca868daabe1a3da2e15cd081e

SHA1
e3bb3d72dea71ff1a63387c68d58b0dc5a33e742

SHA256
b6205450843cad17263a5f0c69fb432f4e79635ee355c01dc6c11781a88d83da

SHA512
de41188a881ba7346332452747bdde8dbf0bf9b083c30b5e3a3ee6a7ba594aa56966e05d8c1ac7b0c0001d703d00105768824dfb13a2d22fd4950b3ef8360851

Download Submit
C:\Windows\SysWOW64\Agdhbi32.exe

Filesize
77KB

MD5
e7c9b27ca868daabe1a3da2e15cd081e

SHA1
e3bb3d72dea71ff1a63387c68d58b0dc5a33e742

SHA256
b6205450843cad17263a5f0c69fb432f4e79635ee355c01dc6c11781a88d83da

SHA512
de41188a881ba7346332452747bdde8dbf0bf9b083c30b5e3a3ee6a7ba594aa56966e05d8c1ac7b0c0001d703d00105768824dfb13a2d22fd4950b3ef8360851

Download Submit
C:\Windows\SysWOW64\Aggegh32.exe

Filesize
77KB

MD5
e311de36104ce977f42337b873561e3c

SHA1
8121b7161de3fa5cdcab446d0c026ba26dfb13ac

SHA256
b2be13984543d44d3fcc38aff6080ab1562f78f54fc47f170c370f5b04431351

SHA512
31ecbaaf71e58319cd3fa4e0387084f1fb52332ea022026361c506becf2d039a219df6ef027f6828225639d192fdea06310748f75b076b29a61f6aa8f7e71abe

Download Submit
C:\Windows\SysWOW64\Aggegh32.exe

Filesize
77KB

MD5
e311de36104ce977f42337b873561e3c

SHA1
8121b7161de3fa5cdcab446d0c026ba26dfb13ac

SHA256
b2be13984543d44d3fcc38aff6080ab1562f78f54fc47f170c370f5b04431351

SHA512
31ecbaaf71e58319cd3fa4e0387084f1fb52332ea022026361c506becf2d039a219df6ef027f6828225639d192fdea06310748f75b076b29a61f6aa8f7e71abe

Download Submit
C:\Windows\SysWOW64\Ahchda32.exe

Filesize
77KB

MD5
a449f49770aa9632134382cd1fcb9ef7

SHA1
757717d4e20d4f39381a1e0930bdc7e605d2055d

SHA256
0351c8de9c18eec7559ab74497e9815ea2840d3099de63625bf23f7f8cc4fcde

SHA512
c3cf51459390736c2927f895d4439667e16722eb0b2696f7ff21cff19beea358f4e46abfcc8ce3cb45f38117f6bdedcc34543832e3448460ffec6b2990877555

Download Submit
C:\Windows\SysWOW64\Ahchda32.exe

Filesize
77KB

MD5
a449f49770aa9632134382cd1fcb9ef7

SHA1
757717d4e20d4f39381a1e0930bdc7e605d2055d

SHA256
0351c8de9c18eec7559ab74497e9815ea2840d3099de63625bf23f7f8cc4fcde

SHA512
c3cf51459390736c2927f895d4439667e16722eb0b2696f7ff21cff19beea358f4e46abfcc8ce3cb45f38117f6bdedcc34543832e3448460ffec6b2990877555

Download Submit
C:\Windows\SysWOW64\Aihaoqlp.exe

Filesize
77KB

MD5
72eb20a441d15550f2d893e17d5eed1b

SHA1
ec02fbda02d968294b27f9a5347ace5e23f8099b

SHA256
227ad3cf75acf154357bd6b194e8ebc9b512397bf3cd8d6cc572359705114986

SHA512
fb378641b90e6eae7fb745ec55318f6be4f988684d04c36f593a3dbf76d3e02023b3700c1b4da64c80ea0d9fea59fc1654ce09ad95c06ecccdeebcd56b4dd773

Download Submit
C:\Windows\SysWOW64\Aihaoqlp.exe

Filesize
77KB

MD5
72eb20a441d15550f2d893e17d5eed1b

SHA1
ec02fbda02d968294b27f9a5347ace5e23f8099b

SHA256
227ad3cf75acf154357bd6b194e8ebc9b512397bf3cd8d6cc572359705114986

SHA512
fb378641b90e6eae7fb745ec55318f6be4f988684d04c36f593a3dbf76d3e02023b3700c1b4da64c80ea0d9fea59fc1654ce09ad95c06ecccdeebcd56b4dd773

Download Submit
C:\Windows\SysWOW64\Aimkjp32.exe

Filesize
77KB

MD5
57956d704e3939c594136171c8496e86

SHA1
2f822f61be56d435ab74dad383857c7e22a92521

SHA256
3332e4f8c205bbfcf0cf87c46027f30a442f236050686a503272fc9da25c2941

SHA512
855d8a74d9638423a1c9ad6d5f4626d600eafd5b2fbd187752cdc5cd692454fb08005fb4ad80846ab4e16b1e8dacb0f67e16fb6ffce5c1e61d87d6f8342895df

Download Submit
C:\Windows\SysWOW64\Aimkjp32.exe

Filesize
77KB

MD5
57956d704e3939c594136171c8496e86

SHA1
2f822f61be56d435ab74dad383857c7e22a92521

SHA256
3332e4f8c205bbfcf0cf87c46027f30a442f236050686a503272fc9da25c2941

SHA512
855d8a74d9638423a1c9ad6d5f4626d600eafd5b2fbd187752cdc5cd692454fb08005fb4ad80846ab4e16b1e8dacb0f67e16fb6ffce5c1e61d87d6f8342895df

Download Submit
C:\Windows\SysWOW64\Aknbkjfh.exe

Filesize
77KB

MD5
0c161ae69eae22f1ad98adb23f22a2a2

SHA1
30b4bd29c662dcace7ed4ef713f5df3f7740ad7c

SHA256
c257d38605709dcf852c1cebc8b5201c39e9522e87aa31a3570e0357c4b19783

SHA512
8f1258ada58e93dd567d2de9b1909a3297826522a192dd0e53bc259e5f72b285e11d9c1131863cee9f066245af51fa0d401b0c5d70213a2f5a829f4d923bc08d

Download Submit
C:\Windows\SysWOW64\Akpoaj32.exe

Filesize
77KB

MD5
6163c9549d0020fdc110037bc86958ad

SHA1
363a4a304f5f37b8e118683ba60fc3c270f3333f

SHA256
2e98b6e37988dc90f43f021ac156be56e6e8eb6e8f09064743e5d445491e5f4b

SHA512
bbba5f281ba48ea918973bd1ee5983470b82db05a92aa22b7cd5589cacb904ba934f3002f7ed893acbcb0f7bc8f42a29cb5b66197fb8a9ada4ddf3ed2b721286

Download Submit
C:\Windows\SysWOW64\Anmfbl32.exe

Filesize
77KB

MD5
69a7f6e0143981f2c322057152eea815

SHA1
d6b86befb1cb3df990b31d368b419e4aeef6135a

SHA256
09d45c77e49bcc36d92fef8487b018aff4d909ca4ba2b3d18fcd35612fc97fed

SHA512
cc9b9c8bf7b038356b3d4e9fabe056d68fe2cc790ec9210bcb51b9b237fdc4963e1c960d51d6365e4d49fa1029a400523475879bcc766afbc96679bd731c8cfb

Download Submit
C:\Windows\SysWOW64\Aompak32.exe

Filesize
77KB

MD5
d0fa7b6c58024da83c539a7488b13ace

SHA1
30f2939685345f725615749de61e2ca4550e44d7

SHA256
f4bb12df627abcdea2ca72fb126039d43e02bbfb30fd84f619385f80fb7880e6

SHA512
3497434ce4186a92781ca30464a59eb73f9647f877cbfaa7ad0b26f198db69b415051d4280def599ea04726f284d1396cd19ac1766730047ec3aa5f076f27303

Download Submit
C:\Windows\SysWOW64\Aompak32.exe

Filesize
77KB

MD5
d0fa7b6c58024da83c539a7488b13ace

SHA1
30f2939685345f725615749de61e2ca4550e44d7

SHA256
f4bb12df627abcdea2ca72fb126039d43e02bbfb30fd84f619385f80fb7880e6

SHA512
3497434ce4186a92781ca30464a59eb73f9647f877cbfaa7ad0b26f198db69b415051d4280def599ea04726f284d1396cd19ac1766730047ec3aa5f076f27303

Download Submit
C:\Windows\SysWOW64\Aqaffn32.exe

Filesize
77KB

MD5
513e117288f10eb33a38ab9cd98c008d

SHA1
6aeabaf16b3ab41be071575780b21717d3e1dd3f

SHA256
d47d2eb0c7fcccd0676fb2b46ddb0f75347d5cec510ec5dd2691807445d63806

SHA512
5af98959b3b194a5dca8fc29d0ea09f7579e8aa38313b92db5f91f6eb81cb16c75fb132d0e634e34a02c511fbc350ae478552a028732d73e121b538678e4ae30

Download Submit
C:\Windows\SysWOW64\Aqaffn32.exe

Filesize
77KB

MD5
513e117288f10eb33a38ab9cd98c008d

SHA1
6aeabaf16b3ab41be071575780b21717d3e1dd3f

SHA256
d47d2eb0c7fcccd0676fb2b46ddb0f75347d5cec510ec5dd2691807445d63806

SHA512
5af98959b3b194a5dca8fc29d0ea09f7579e8aa38313b92db5f91f6eb81cb16c75fb132d0e634e34a02c511fbc350ae478552a028732d73e121b538678e4ae30

Download Submit
C:\Windows\SysWOW64\Aqmlknnd.exe

Filesize
77KB

MD5
e4be6d269cbeef9cb295848a03c38f84

SHA1
3bdd2e6934acecb8f9ce0f149bcfd6013f6d57b6

SHA256
f8993771e4f7d281aa89bfee62553da767c77f3117daf03f1688ed18532c5def

SHA512
c3ffebe17447f41e4b4d8670038ed17327b3f277febe9eea21504884a2ea3c659431f9e286c06ec6c022bfe661deda802e070951df76ca1a7b460e13776a513a

Download Submit
C:\Windows\SysWOW64\Aqmlknnd.exe

Filesize
77KB

MD5
e4be6d269cbeef9cb295848a03c38f84

SHA1
3bdd2e6934acecb8f9ce0f149bcfd6013f6d57b6

SHA256
f8993771e4f7d281aa89bfee62553da767c77f3117daf03f1688ed18532c5def

SHA512
c3ffebe17447f41e4b4d8670038ed17327b3f277febe9eea21504884a2ea3c659431f9e286c06ec6c022bfe661deda802e070951df76ca1a7b460e13776a513a

Download Submit
C:\Windows\SysWOW64\Aqmlknnd.exe

Filesize
77KB

MD5
e4be6d269cbeef9cb295848a03c38f84

SHA1
3bdd2e6934acecb8f9ce0f149bcfd6013f6d57b6

SHA256
f8993771e4f7d281aa89bfee62553da767c77f3117daf03f1688ed18532c5def

SHA512
c3ffebe17447f41e4b4d8670038ed17327b3f277febe9eea21504884a2ea3c659431f9e286c06ec6c022bfe661deda802e070951df76ca1a7b460e13776a513a

Download Submit
C:\Windows\SysWOW64\Bfchidda.exe

Filesize
77KB

MD5
666bf5d54040230755ba7c2f24d83157

SHA1
65c2b994a7c1920b2f611c100afd74fdba9d045b

SHA256
44b47d1eac4180ff62b34e75dbcac83750226512109dbb4647a9c5368ff7c23c

SHA512
91cf4c797cd42cc411cc1a70b202349860d3a028b92a9236ec5b8b39ae5917ce501ff80c17b2d1ec6b660ae915f31d3b1f797769cc401bdd767c1a6712974490

Download Submit
C:\Windows\SysWOW64\Bfchidda.exe

Filesize
77KB

MD5
666bf5d54040230755ba7c2f24d83157

SHA1
65c2b994a7c1920b2f611c100afd74fdba9d045b

SHA256
44b47d1eac4180ff62b34e75dbcac83750226512109dbb4647a9c5368ff7c23c

SHA512
91cf4c797cd42cc411cc1a70b202349860d3a028b92a9236ec5b8b39ae5917ce501ff80c17b2d1ec6b660ae915f31d3b1f797769cc401bdd767c1a6712974490

Download Submit
C:\Windows\SysWOW64\Bfhadc32.exe

Filesize
77KB

MD5
bfb4ba28938390cd8bf527d7ff3ff022

SHA1
55234c7a89405e6f4dde510af3cd1829e969e03a

SHA256
3e5d8026eafba8cb987bd33137ec5625300760733c800c501b726f6ff0128106

SHA512
183c3f52b8608eef092128740aba81152afb090833893fab3b7e3b13795ea19b4c6419fc09427ed149b24e66d0d32f2b2313dfd443bb45c74c3216bb036efc52

Download Submit
C:\Windows\SysWOW64\Bfhadc32.exe

Filesize
77KB

MD5
bfb4ba28938390cd8bf527d7ff3ff022

SHA1
55234c7a89405e6f4dde510af3cd1829e969e03a

SHA256
3e5d8026eafba8cb987bd33137ec5625300760733c800c501b726f6ff0128106

SHA512
183c3f52b8608eef092128740aba81152afb090833893fab3b7e3b13795ea19b4c6419fc09427ed149b24e66d0d32f2b2313dfd443bb45c74c3216bb036efc52

Download Submit
C:\Windows\SysWOW64\Bfjnjcni.exe

Filesize
77KB

MD5
88f8c5c77d9442f7b6940f89151c51b9

SHA1
c44f196588c2f957a7497d6cb4e5f683639d1853

SHA256
c7a59ae6935b7e009fb3bab76a298542253bb7cd8238b8b9f3ea97683a75f869

SHA512
8170ab0a60026d2d4d759df4ab85f6477b58f9e46f522772b3f4fa9e3b9134a7b80da95fbc3d7e620590a8135a98a2becd70866281023b90579dc7f967e5f19b

Download Submit
C:\Windows\SysWOW64\Bfjnjcni.exe

Filesize
77KB

MD5
88f8c5c77d9442f7b6940f89151c51b9

SHA1
c44f196588c2f957a7497d6cb4e5f683639d1853

SHA256
c7a59ae6935b7e009fb3bab76a298542253bb7cd8238b8b9f3ea97683a75f869

SHA512
8170ab0a60026d2d4d759df4ab85f6477b58f9e46f522772b3f4fa9e3b9134a7b80da95fbc3d7e620590a8135a98a2becd70866281023b90579dc7f967e5f19b

Download Submit
C:\Windows\SysWOW64\Bjaqpbkh.exe

Filesize
77KB

MD5
408618d7deb323449ff6232c68d97346

SHA1
f46eca34accd1dc6a0606ac543bdc1a9db3017e3

SHA256
66802b436704d00b0d01b6c9a18b013104aea3ac5d968d26935e0177d0ece7ff

SHA512
2d82845d9e228ccb6888b8ce633cc5210fb878757842943c310f30c52080d31f42147d49fae066e80efa2e09b7450a3042c779e3f6dacd01e515029fa593be4d

Download Submit
C:\Windows\SysWOW64\Bjaqpbkh.exe

Filesize
77KB

MD5
408618d7deb323449ff6232c68d97346

SHA1
f46eca34accd1dc6a0606ac543bdc1a9db3017e3

SHA256
66802b436704d00b0d01b6c9a18b013104aea3ac5d968d26935e0177d0ece7ff

SHA512
2d82845d9e228ccb6888b8ce633cc5210fb878757842943c310f30c52080d31f42147d49fae066e80efa2e09b7450a3042c779e3f6dacd01e515029fa593be4d

Download Submit
C:\Windows\SysWOW64\Bjlgdc32.exe

Filesize
77KB

MD5
84f386dccaee9b1211b0a57d3138dec0

SHA1
03c4fd709c550dc9908846162c4e69a2837e8a95

SHA256
76070595e0b165f24ad4dbf6558608047719155957b51f95034a44e89d614298

SHA512
3fd49af54c2d22322e8da487555bebd7384b20c09d736c4e8b0f6ab23b3434fa67e231213e7e9202fbd96a9f92f7ce7a94f1b5e05554f32a8a6aafeb6d1be970

Download Submit
C:\Windows\SysWOW64\Bjlgdc32.exe

Filesize
77KB

MD5
84f386dccaee9b1211b0a57d3138dec0

SHA1
03c4fd709c550dc9908846162c4e69a2837e8a95

SHA256
76070595e0b165f24ad4dbf6558608047719155957b51f95034a44e89d614298

SHA512
3fd49af54c2d22322e8da487555bebd7384b20c09d736c4e8b0f6ab23b3434fa67e231213e7e9202fbd96a9f92f7ce7a94f1b5e05554f32a8a6aafeb6d1be970

Download Submit
C:\Windows\SysWOW64\Bmmpfn32.exe

Filesize
77KB

MD5
ee9fdd3cd38bd2eaaf7b99dd2726c5b7

SHA1
0e701bc942b6659fc283c51700c0e1c68b5e324d

SHA256
83247f72476156e105846f76bc4f545dfa2b471944376cc53795869532acd3ad

SHA512
64945c29a8642f1b013b422686099036cb17485f05993973dec127f1a7830a03101a421fc168a7109d45f8bb3ca182c277ff0e81db2ea4719af6a19a2c18be84

Download Submit
C:\Windows\SysWOW64\Bmmpfn32.exe

Filesize
77KB

MD5
ee9fdd3cd38bd2eaaf7b99dd2726c5b7

SHA1
0e701bc942b6659fc283c51700c0e1c68b5e324d

SHA256
83247f72476156e105846f76bc4f545dfa2b471944376cc53795869532acd3ad

SHA512
64945c29a8642f1b013b422686099036cb17485f05993973dec127f1a7830a03101a421fc168a7109d45f8bb3ca182c277ff0e81db2ea4719af6a19a2c18be84

Download Submit
C:\Windows\SysWOW64\Bogcgj32.exe

Filesize
77KB

MD5
c1bd7995c21ee198d2d3397785b0b7bf

SHA1
4421fb3a1254c845cab26275fc4f6d1f53d93c01

SHA256
1c469c5e0c24910de5c8524a83e8356457e3717fa51c936be61163576b2b4dbc

SHA512
d7086b4ca5040a934ea0915b184609981a8c7d3c4ad53c3296a42f75c9c9fdfe8f826dd8a8e55eea7ccd3b0511e1500b94a9c338e56ea27b976b3cffc917aff2

Download Submit
C:\Windows\SysWOW64\Bogcgj32.exe

Filesize
77KB

MD5
c1bd7995c21ee198d2d3397785b0b7bf

SHA1
4421fb3a1254c845cab26275fc4f6d1f53d93c01

SHA256
1c469c5e0c24910de5c8524a83e8356457e3717fa51c936be61163576b2b4dbc

SHA512
d7086b4ca5040a934ea0915b184609981a8c7d3c4ad53c3296a42f75c9c9fdfe8f826dd8a8e55eea7ccd3b0511e1500b94a9c338e56ea27b976b3cffc917aff2

Download Submit
C:\Windows\SysWOW64\Bqfoamfj.exe

Filesize
77KB

MD5
41843d2a33b6ad60bfd90c6fb2100425

SHA1
306cc9602c31512f7397290419a3fea67926cfe2

SHA256
ae3cd58a2c127f2c0db6e555210d1c9d2a629d9cdace8a75f3a5aa035cf87cbb

SHA512
81bc747747e44a33b8dcfb1dd3dd54c8338401fe468cbd27bc75690d4ac187fc557448c081653b70374d27de60ec8482ba080c65b197aa2a8d0c43bdb44ca1a8

Download Submit
C:\Windows\SysWOW64\Bqfoamfj.exe

Filesize
77KB

MD5
41843d2a33b6ad60bfd90c6fb2100425

SHA1
306cc9602c31512f7397290419a3fea67926cfe2

SHA256
ae3cd58a2c127f2c0db6e555210d1c9d2a629d9cdace8a75f3a5aa035cf87cbb

SHA512
81bc747747e44a33b8dcfb1dd3dd54c8338401fe468cbd27bc75690d4ac187fc557448c081653b70374d27de60ec8482ba080c65b197aa2a8d0c43bdb44ca1a8

Download Submit
C:\Windows\SysWOW64\Bqmeal32.exe

Filesize
77KB

MD5
f4b1e0c4a5a79baa8bc537cf5965f20a

SHA1
a27293e1c59363d51c373c0231acc80454e4afd9

SHA256
4630df4845394a598338becea28716263a648d9efbe89c0d410789c217abcfc6

SHA512
a0fde8d8c2208a9951cf9b2d9d2afaea71e6806cffaa52fbd7789c72fc696263c91637119cf3556e0fb2a7debe7670f1f2ae633bffb422936691d7862fa5775f

Download Submit
C:\Windows\SysWOW64\Bqmeal32.exe

Filesize
77KB

MD5
f4b1e0c4a5a79baa8bc537cf5965f20a

SHA1
a27293e1c59363d51c373c0231acc80454e4afd9

SHA256
4630df4845394a598338becea28716263a648d9efbe89c0d410789c217abcfc6

SHA512
a0fde8d8c2208a9951cf9b2d9d2afaea71e6806cffaa52fbd7789c72fc696263c91637119cf3556e0fb2a7debe7670f1f2ae633bffb422936691d7862fa5775f

Download Submit
C:\Windows\SysWOW64\Cabomkll.exe

Filesize
77KB

MD5
8bfe9506e0f700f22bd0f322e2446d42

SHA1
4bd48d77cb95d774a1b70f328d0f018c2fb6b2e5

SHA256
7e49b98375217850a25bc94dcdc260954ec65490a398b94eaa4ab18f9faad309

SHA512
eece37677035df70d75c01d383aec2dc26ca17b469dbb3ccd7392c67638dd84247469cf142691a39a28fdda2ccadb88c0b27ac64ef7b78bf9ad209cfceb9e10a

Download Submit
C:\Windows\SysWOW64\Cabomkll.exe

Filesize
77KB

MD5
8bfe9506e0f700f22bd0f322e2446d42

SHA1
4bd48d77cb95d774a1b70f328d0f018c2fb6b2e5

SHA256
7e49b98375217850a25bc94dcdc260954ec65490a398b94eaa4ab18f9faad309

SHA512
eece37677035df70d75c01d383aec2dc26ca17b469dbb3ccd7392c67638dd84247469cf142691a39a28fdda2ccadb88c0b27ac64ef7b78bf9ad209cfceb9e10a

Download Submit
C:\Windows\SysWOW64\Ccchof32.exe

Filesize
77KB

MD5
53e5735be99492060b84e04985c85205

SHA1
240d116cdc08ae90cf9e19b17f8606e4ad678953

SHA256
091b496e1ade18e9cb18dda1433afd8d11fb3ba2e7f7e771fbe7321bd7393abb

SHA512
5114fc00a492aae5a8955d0e19fdf2e429877a03566dd7efb1ecde285c40a4d72198ccbfd5421c2d5856e62796ed2dcd474154ffe5cc2c5761bbce6ffe3ded60

Download Submit
C:\Windows\SysWOW64\Ccchof32.exe

Filesize
77KB

MD5
53e5735be99492060b84e04985c85205

SHA1
240d116cdc08ae90cf9e19b17f8606e4ad678953

SHA256
091b496e1ade18e9cb18dda1433afd8d11fb3ba2e7f7e771fbe7321bd7393abb

SHA512
5114fc00a492aae5a8955d0e19fdf2e429877a03566dd7efb1ecde285c40a4d72198ccbfd5421c2d5856e62796ed2dcd474154ffe5cc2c5761bbce6ffe3ded60

Download Submit
C:\Windows\SysWOW64\Ccnncgmc.exe

Filesize
77KB

MD5
1cd65ee9f23aa52de0b022faacaf0a72

SHA1
7795027796af797bf51aa45581952aac8d8dd113

SHA256
13be192321a3bb53ad83dec235b1b357ae645cc0c246f2c53ffefffc50e2a671

SHA512
7626cf4695a4cbbbb112e091fa20ab7208b8b134d11e55c2d587bd29fe97e841de356b1858dfe12cadbb3ee7dc5f8f84601754346d4881f7d5b6ca26160b938d

Download Submit
C:\Windows\SysWOW64\Ccnncgmc.exe

Filesize
77KB

MD5
1cd65ee9f23aa52de0b022faacaf0a72

SHA1
7795027796af797bf51aa45581952aac8d8dd113

SHA256
13be192321a3bb53ad83dec235b1b357ae645cc0c246f2c53ffefffc50e2a671

SHA512
7626cf4695a4cbbbb112e091fa20ab7208b8b134d11e55c2d587bd29fe97e841de356b1858dfe12cadbb3ee7dc5f8f84601754346d4881f7d5b6ca26160b938d

Download Submit
C:\Windows\SysWOW64\Cfadkb32.exe

Filesize
77KB

MD5
60902d3484e1b812631c911b343270eb

SHA1
00b2b326262fbdceecba33226888faa9dd120cb5

SHA256
ce8e250ffa2b577a642b96acfda4992bf04da9a574953b45e0f575b9aafedcd9

SHA512
7401d4c086e6f4df8514d6540e9c00d9ee8c3089a7b3e149508b74324ed18453a14f128ccba7866392a3f39545c7e8fc57bf26e335b15438867517ee292c8dee

Download Submit
C:\Windows\SysWOW64\Cfadkb32.exe

Filesize
77KB

MD5
60902d3484e1b812631c911b343270eb

SHA1
00b2b326262fbdceecba33226888faa9dd120cb5

SHA256
ce8e250ffa2b577a642b96acfda4992bf04da9a574953b45e0f575b9aafedcd9

SHA512
7401d4c086e6f4df8514d6540e9c00d9ee8c3089a7b3e149508b74324ed18453a14f128ccba7866392a3f39545c7e8fc57bf26e335b15438867517ee292c8dee

Download Submit
C:\Windows\SysWOW64\Cfcqpa32.exe

Filesize
77KB

MD5
5302df5ed20100e9857d1b98a0563cdc

SHA1
3c7e472f5e12aad9693e6286a258b1377867b84c

SHA256
368dbe7b09a36c914814e14a3886834b8c2ac193c5e868dd92742c65e5d3dae5

SHA512
010d7251c244d66db9f35ba3b2111dcaae944079b395bc8315b8e278627459b60c4fbb3f9c01308106ccb1f95aa1956defb9f8f71eb109693cb7270e6a41f8d5

Download Submit
C:\Windows\SysWOW64\Cfcqpa32.exe

Filesize
77KB

MD5
5302df5ed20100e9857d1b98a0563cdc

SHA1
3c7e472f5e12aad9693e6286a258b1377867b84c

SHA256
368dbe7b09a36c914814e14a3886834b8c2ac193c5e868dd92742c65e5d3dae5

SHA512
010d7251c244d66db9f35ba3b2111dcaae944079b395bc8315b8e278627459b60c4fbb3f9c01308106ccb1f95aa1956defb9f8f71eb109693cb7270e6a41f8d5

Download Submit
C:\Windows\SysWOW64\Cglbhhga.exe

Filesize
77KB

MD5
d0a2770c2fc09c2c7a4b97c8faff8ac9

SHA1
5743473b220788a540ffb358352ba8690b0fc630

SHA256
39d892c56c010780d295f55b1c8b79cb0cfd81a9050d92aaf4b920e6224b2de6

SHA512
1780e52c103175cf8d251ae69c7f827bfd6801df18f9fc5974a54fb20f824a5879e1bab410662dc8453624131c3a14b609864723ec2bdc6f4c16aa6769cf63fb

Download Submit
C:\Windows\SysWOW64\Cidjbmcp.exe

Filesize
77KB

MD5
3383b72f19854e443b8b6e33f5b45c8b

SHA1
4e1c1ae0cd470ae751a3ecec4f478c776a5bfdc3

SHA256
db3225847029e21694f9ada08c2c1e3d34468888812492624168c4127afa096f

SHA512
1fa2ff45e0ef7748c0e5c3bd4b4a4ca7039fe77e711ecae4fe5b51566ba38b3a4d079283cad8caf5d453ef8a9e2bcbaae256f3ea8d0b49e4aef9cf5ef5172b16

Download Submit
C:\Windows\SysWOW64\Cidjbmcp.exe

Filesize
77KB

MD5
3383b72f19854e443b8b6e33f5b45c8b

SHA1
4e1c1ae0cd470ae751a3ecec4f478c776a5bfdc3

SHA256
db3225847029e21694f9ada08c2c1e3d34468888812492624168c4127afa096f

SHA512
1fa2ff45e0ef7748c0e5c3bd4b4a4ca7039fe77e711ecae4fe5b51566ba38b3a4d079283cad8caf5d453ef8a9e2bcbaae256f3ea8d0b49e4aef9cf5ef5172b16

Download Submit
C:\Windows\SysWOW64\Cjhfpa32.exe

Filesize
77KB

MD5
f73cbdafcc89633de510fd551c073f4e

SHA1
b8f5a78c97465aefbb1910ffde0a98c2253576a1

SHA256
01ba37239e872b1ae278d25fd9f650cbe5cea5967465db3383e538412d8bfc02

SHA512
20d6724922f26c1701433eb69e996c3d295cb59e871d7399b035ad4ce6d9c43764a0c6ab9f603bb975a16c4f2b04619caac2f5fb621da3fe404ae639717c3dcf

Download Submit
C:\Windows\SysWOW64\Cjhfpa32.exe

Filesize
77KB

MD5
f73cbdafcc89633de510fd551c073f4e

SHA1
b8f5a78c97465aefbb1910ffde0a98c2253576a1

SHA256
01ba37239e872b1ae278d25fd9f650cbe5cea5967465db3383e538412d8bfc02

SHA512
20d6724922f26c1701433eb69e996c3d295cb59e871d7399b035ad4ce6d9c43764a0c6ab9f603bb975a16c4f2b04619caac2f5fb621da3fe404ae639717c3dcf

Download Submit
C:\Windows\SysWOW64\Cmipblaq.exe

Filesize
77KB

MD5
66bd3c33121921c4713ba92ad3b11c4f

SHA1
580fcb1297bca936343d09fdbc80599b7bf9f76f

SHA256
7c2101fa7999870de384e19bf2fa80694b3d2d1f24a5bcea69894f86c437d9b0

SHA512
b6c242f314764b6fe4e2d616284498b4267a1a39a8558d5a8c2124c2af8001d85190a37fb5d8639036cfa425378c56fb2ff73a3beab19d87f098597b15708836

Download Submit
C:\Windows\SysWOW64\Cmipblaq.exe

Filesize
77KB

MD5
66bd3c33121921c4713ba92ad3b11c4f

SHA1
580fcb1297bca936343d09fdbc80599b7bf9f76f

SHA256
7c2101fa7999870de384e19bf2fa80694b3d2d1f24a5bcea69894f86c437d9b0

SHA512
b6c242f314764b6fe4e2d616284498b4267a1a39a8558d5a8c2124c2af8001d85190a37fb5d8639036cfa425378c56fb2ff73a3beab19d87f098597b15708836

Download Submit
C:\Windows\SysWOW64\Cpihcgoa.exe

Filesize
77KB

MD5
0c4e00a5d5006bcb2c8b794c2a6e3386

SHA1
2abfb1674370df19b0ae00039cc961e1c819da30

SHA256
1b6a4e885e0d7af295517294000f5e8911cdf70ebd6c6bed35b348ee5dc4fd45

SHA512
04b0032e1c6a5a48c938c9310bb58bfc6d55a75e7ec1385a750a221215e3bfbd7eb3a154dd01086dec8702627339a43124e965d9131e25c9ddaa29d719ac4677

Download Submit
C:\Windows\SysWOW64\Cpihcgoa.exe

Filesize
77KB

MD5
0c4e00a5d5006bcb2c8b794c2a6e3386

SHA1
2abfb1674370df19b0ae00039cc961e1c819da30

SHA256
1b6a4e885e0d7af295517294000f5e8911cdf70ebd6c6bed35b348ee5dc4fd45

SHA512
04b0032e1c6a5a48c938c9310bb58bfc6d55a75e7ec1385a750a221215e3bfbd7eb3a154dd01086dec8702627339a43124e965d9131e25c9ddaa29d719ac4677

Download Submit
C:\Windows\SysWOW64\Dcjnoece.exe

Filesize
77KB

MD5
50d75307117827dd3e220bf443219687

SHA1
7f1c71364f2050b7c533c487789bdfa22702bb99

SHA256
f281f5d333be23b7a4bbbd6fbabf4cdfda91f7d167dbfa23e1f5ecd751bdb387

SHA512
dcf4a9a9257d948f23e6fd4086148d7aefb768cd5984cc4aaf16aff8fbdbd18aa840b045ce6002a38f6a86f94d346cebf322d3f55b696bf730a18bff13ca6f19

Download Submit
C:\Windows\SysWOW64\Dcjnoece.exe

Filesize
77KB

MD5
50d75307117827dd3e220bf443219687

SHA1
7f1c71364f2050b7c533c487789bdfa22702bb99

SHA256
f281f5d333be23b7a4bbbd6fbabf4cdfda91f7d167dbfa23e1f5ecd751bdb387

SHA512
dcf4a9a9257d948f23e6fd4086148d7aefb768cd5984cc4aaf16aff8fbdbd18aa840b045ce6002a38f6a86f94d346cebf322d3f55b696bf730a18bff13ca6f19

Download Submit
C:\Windows\SysWOW64\Dheibpje.exe

Filesize
77KB

MD5
daef8225ce94a140ccff221c86c955d3

SHA1
e295a62f073db033f9cd4a565dae7b4678be7325

SHA256
c42da65d4ee8a8929803b2068b718d00ffb0003270f0d9e78c9e326f128eed0f

SHA512
d388b8d2d1bf57d8e617de6416152492d8f007e4bc284173ac7b6695cb0ffdd6767836b09a97317c9fe910def3f8215cb7759675b16cacc09e05ef58d409a041

Download Submit
C:\Windows\SysWOW64\Djdflp32.exe

Filesize
77KB

MD5
e866c5f6918d981c63edeea5792de42b

SHA1
a8d706a7974d6a4d1923a03c6de511071fc8a6aa

SHA256
b23d15d61318f5d0c1e4aad721a8e8b9555cf1c1f249576718db549787353272

SHA512
23f940925c7f0ce4ffb4aee501d4788cc0ea2fa0d16f7e930fd85a6c8c538d433e9ff94b6cee70272c0c95bcf3225e885ce435cdfb3478f925223adf0f035198

Download Submit
C:\Windows\SysWOW64\Djdflp32.exe

Filesize
77KB

MD5
e866c5f6918d981c63edeea5792de42b

SHA1
a8d706a7974d6a4d1923a03c6de511071fc8a6aa

SHA256
b23d15d61318f5d0c1e4aad721a8e8b9555cf1c1f249576718db549787353272

SHA512
23f940925c7f0ce4ffb4aee501d4788cc0ea2fa0d16f7e930fd85a6c8c538d433e9ff94b6cee70272c0c95bcf3225e885ce435cdfb3478f925223adf0f035198

Download Submit
C:\Windows\SysWOW64\Doaneiop.exe

Filesize
77KB

MD5
12b1274d854e1a86d1f9666ac222be06

SHA1
158e7c6ee9b5703cfc984fd2259b2dccd3814675

SHA256
284a0a57aef79d8e57971249e5d232d7278581505933888157f78bf0f19d3089

SHA512
690695dfe412893e9aaeb6cb8e1a7b3a8125aa3f613263e351a9c84283be1a8d8b0620a1d40f382c8883ff797ae4b23faeb3d623c1bcc015f8adbd91fca9ae62

Download Submit
C:\Windows\SysWOW64\Efffmo32.exe

Filesize
77KB

MD5
5eea821836e098e6d27d2476a37220b5

SHA1
5f262733bc23a4b939353144296e14b3364adc13

SHA256
042fd7b9dcaa2c65083b072d9be30b9f6109b8fa556c8ea33a0a28c01f592472

SHA512
718d5c8936d962718186e33038635594ba57dfe5998974f7010eaea513e359f8e948b91702e00b1da4a8569ab0844ff55fc38da08f3bc0a233ec530ad6b1891b

Download Submit
C:\Windows\SysWOW64\Fajgkfio.exe

Filesize
77KB

MD5
172d018aaf0ab89364821c8702a3ea30

SHA1
c90465d80c1d1b35f24e33d1525fe8c880805720

SHA256
ae0af6ce3ce4bc07f45293124edc70ece99f3dc32db0159e5d4b0526316c3a14

SHA512
b4ce4bcdc31893f70e49bb23227d926251dcc7d52b65cc4cd42639e3e046b7f40d64f24f89fd85f6434805c0adc8eaef1365425f9be6ce7a7d3a50032fa9ab1a

Download Submit
C:\Windows\SysWOW64\Fmjaphek.exe

Filesize
77KB

MD5
2c7ccd33c0020c56d75d99940a97db18

SHA1
e222489b3a965a0d9ef72b77ae6b078d1b29cb4e

SHA256
f2846773e9c4be4ec601592c9dbca3848848bc7358e460c48d9e14329a8745d4

SHA512
d0944606470ad9095c971804bb882074edad48e5b6196c420e76026a4a1e2ffc94346b2171738fcc82b9d2630e8157c30801fa6349bfefe2b4c55f9822253466

Download Submit
C:\Windows\SysWOW64\Ganldgib.exe

Filesize
77KB

MD5
4abe0fb71ac639569b75613f78a6f156

SHA1
cde6d89e73cf05287eab2f5b8ee15dbde7ba70e1

SHA256
aca43928001e3ba94afe8759a76f1bab51cec9c161b7c3df33489af4d50dda18

SHA512
c11cb2b2bb12f036b3b9b6439e7238e07b418da30e216d50ef9136a455dec9e7dee03ff0de6eb097a1e0c858699a5d8e36e949c56f33cc1d2721d58f1da0cd75

Download Submit
C:\Windows\SysWOW64\Geoapenf.exe

Filesize
77KB

MD5
936cfe1f7f42020f3b9869e368e4d785

SHA1
f1dc4c4152bace903bd9b2e8b69d96b8a680abe4

SHA256
079123ed48d23c233e6d76a9df0f7cfecd44f4c26f715d72173d52640fc8851a

SHA512
0399fc7f5b74115a0010e9823757b92431eded170453bf4c1d8f953b0eb05d945ba57106aec6b195366c17e9118dbc1cb8cd289209bbcb9540967c96b0bb674a

Download Submit
C:\Windows\SysWOW64\Giecfejd.exe

Filesize
77KB

MD5
a2bbfd378203f7b504ade7e51e4c19c3

SHA1
4535395a97e4d22f0baac6e323e9ed28ac013c25

SHA256
ba95437131aa99c969b961f841c65cf46fea6eee559d625d30c6d0c1e13f1d65

SHA512
976a0c635f029f76221833d2ae119ea6e3ae5218046e743dd769edf8992cc6a3ed2c016bfd2815ec4f3aef8b663516cb210ad794bb8f4bef7e4c60f04a1e08f6

Download Submit
C:\Windows\SysWOW64\Glfmgp32.exe

Filesize
77KB

MD5
269a1980fd4dc4e630523b1d40232566

SHA1
0fddb32583b1c851cd60f3a27ded36eb9af23dac

SHA256
8691786789e0763f6079022560da3d72fbb7a6a4204d9e55011caa0d846d9594

SHA512
08b6ccbe2c207019b8ea48281763c66851214ca48790e592e6082e81c5d3700e4a48746259dc3032cd4e21257b7993cc4e04f37d7079a3d2b48d20ef28525515

Download Submit
C:\Windows\SysWOW64\Hejqldci.exe

Filesize
77KB

MD5
379dc692e65771b9cb6d0001d5e263de

SHA1
44decd4fcb74731cfa3f0cd0c99f30db33001dfa

SHA256
a80cfc1617932e58c7b5900275e2c8e8cf134585eaf7b604833f038d78cae418

SHA512
9d0f7f9199770f166e59d651651bb5a2b2193ae72f05055665e30ac8430f1d0c6b94df5342a0835b84e8d56d8293a054bbf35fcc14205a4596edd55972ca223c

Download Submit
C:\Windows\SysWOW64\Hhdcmp32.exe

Filesize
77KB

MD5
e095e2b8b20aa410e358bd9cd2ecf72f

SHA1
f5fcd22f4897d516deed48c4a3a64c1a242c58b1

SHA256
ca3aa6eba2c115059c14620f1fbeaef76885ed0debf239aa89f0e12afdc92130

SHA512
8eeff66c486624660fef531a0a01dd071f77917e89ebbf486fa3c400e1e8190ce36f4088074d8adab079a937b18b889f05727a061be9aac030e6c40d6534bece

Download Submit
C:\Windows\SysWOW64\Hnbeeiji.exe

Filesize
77KB

MD5
66c0588935eb58de76c7977f03cf91ed

SHA1
a1896670cda8c86b9a49a125203a7b7c8a7b73ca

SHA256
8471cb229bf896300e8ceeadabb60ab44b6236f5b8f32112977453ac3eefcf9f

SHA512
80bff4c2293d267bb102470d52870310d861c6936fa9b4d1f4b87d4dfc005fdee40faf3fa7546b02affd54d658627507cef873d7aeb7fac73e13b81ad01f5dd2

Download Submit
C:\Windows\SysWOW64\Hpchib32.exe

Filesize
77KB

MD5
b68c49833e4c477b2051f23082e43643

SHA1
a116d7c8584cb573a4d1e356436c27a8d3535173

SHA256
ab435b30d4331512ea360fa58ef8da3d6a820f2dbef2c6b7bab4e44c7f3c109c

SHA512
85ec4d89e157ae7f09f4cbb87e15c35df5749a2eab2fcbc19dadd1aed16df7e87444e7c34b6088b96bb025abf944a06bfc3ac122e59e9ef05296e0166b144abf

Download Submit
C:\Windows\SysWOW64\Ihmfco32.exe

Filesize
77KB

MD5
4a5fccbb7a021cb0498b1da55b54712c

SHA1
53703e30bf961ba4c1681b11471b2e609718c7eb

SHA256
6c19503b679880b34b853998a65f828c0d14440dbf6fc2fbeae725f1a545860f

SHA512
d226f6561c09774dfbe5ca40bf15192baf0e38ec3294efdba8ff2ff055bfe56f15f4c7e46bf4b502243444ae013744d9d958dc2b5184611c8dce6e61cc412485

Download Submit
C:\Windows\SysWOW64\Iiopca32.exe

Filesize
77KB

MD5
e93b69d7cc3ee676bdcaf63749e0c082

SHA1
5bdbf661d67f5286d8daa2818c12935e9a14451c

SHA256
8a9bb7c7505d27369467ebcdd8900f16bc0c887eebc2f8e52a825155ef046714

SHA512
5906c5cc7f2be0d44fcd2637fdb9e71b616a28016d376a248ab4d2e23a5c8cb9ffbd9dd945666f7081c05ae77ef8833f115ed7697f5b00b42d1484005faa92b5

Download Submit
C:\Windows\SysWOW64\Jcikgacl.exe

Filesize
77KB

MD5
6567ce0e85803b4811b17f77b1f9a7db

SHA1
3777a4fca3717e36b165740524f912e9bb9871fa

SHA256
15d25a10628ba50e5c24f38f665658ae3d827f5467ff4f235f7323deef46cc6e

SHA512
c8a4d41972832fd796e5bf51dccf4cdda95d3412b07e0d20172b3c055278a808ba704d8edd7e925e194a0c793124b2b804fe53c148c5f54b1e171d464c7e10a6

Download Submit
C:\Windows\SysWOW64\Jgkmgk32.exe

Filesize
77KB

MD5
1a583a689c08aabb1ed94cb17521bfd6

SHA1
211e5f20cd6d57f76a96726caf91e6789bb6c59c

SHA256
0a994a0a5c284b1f1b7d5b6fa8fa770a2e8f1b5f294c38b5dd9308f3b8395a74

SHA512
d596df6acaff3a9ba3041bf30565ed7d8f2dd36ee8b2c168022d4f2fcd484a74060bfee661eda9c388436a436a2918ecac2e50dd44fc54dcf460e2934d54bf68

Download Submit
C:\Windows\SysWOW64\Joekag32.exe

Filesize
77KB

MD5
6628e9b0873629ae9f64f2b63df69883

SHA1
b16ec4fdd6ed4e04a92ef6fe15d4b373d144cef2

SHA256
3651e630949564e7ec60a03e39c4006daa4a26060e6b556dfdf4ccab70630430

SHA512
bd9a4be03ef7a55233795fe3f651d47f821820b952d71454e95e0478b00efdfb81cdf24fcab215839ee4105988c95c5ba0fa3acbbc3e7b73e9c62b400072a72e

Download Submit
C:\Windows\SysWOW64\Joqafgni.exe

Filesize
77KB

MD5
4613c2e2b600dd8b1eb6aed527996cd3

SHA1
b9226d0de486784c22b7512e5123f6a83e98d836

SHA256
705b1e58ee2d05d219239ccac856f96145927699db4b2a74b2846258e35df033

SHA512
fdc54e18380049dcac8d2b04129efa0414a5f70838d4bf3e66998ef54b68220198ddfa94cfe2913c28a6c22e67d8ac2775095fe53fe06960aa27ca2327d88e7f

Download Submit
C:\Windows\SysWOW64\Koonge32.exe

Filesize
77KB

MD5
f86d46db52191270045dad7a3d6e3adb

SHA1
c7ae2e356489a3ff5bd3e1fbed7a56d6ea4be73c

SHA256
135703d58fe39cd0efea54df16a8292baef3fb52d96132bf3cf7cfc3c53bdd2a

SHA512
e67c3fac4afd12be0f747876070c61648800195188099bf3bd0ded650f712720752fbc6dca7e67e8deda9f613ece2e87fcfcd6d2c08032a616c26e804bcfcb06

Download Submit
C:\Windows\SysWOW64\Lebijnak.exe

Filesize
77KB

MD5
c470f3f0f3a0a24161c0b3942b7d35a5

SHA1
845797afe07fbad201cef1e6ca721dd9cebe365a

SHA256
55ebfced95261168cc130a8ad003612efb59f38e6d2e7b22ca5df6b6509130ec

SHA512
9e9e56e505cc7a0ef35cc036586d5d92db2275e3d0db51378c5457ddf63ddb2d74e1090d4657806bdd379ee6f981d01106ca1d7698fd358daa953cbec13032ce

Download Submit
C:\Windows\SysWOW64\Mcaipa32.exe

Filesize
77KB

MD5
6a4aaa47f7294a3e64e7de50beb73a7c

SHA1
57176aca80a003d868251b1e1ddfa2e78242d060

SHA256
fee2e533980d3659af5b042848e94b887e120f3a63b392f5cb1dfb9190b3a251

SHA512
3e7f3f00ecd3e95a5ec9ddc13a01c817a0c109ad1faf77e91adc4c72c6773e2077a7f5b1a6e832f88703180524270be53d7846609a1f7825b6b7aab28e6ace42

Download Submit
C:\Windows\SysWOW64\Mjjkaabc.exe

Filesize
77KB

MD5
043db113902fab9649a0fefe76ea19a8

SHA1
58cd34b8c96f1eae5139076d6e442715db2ac1ab

SHA256
0a851eaee77605e88b9b3a12119b941df2b6ecc144bd363b2c82c4470407beb8

SHA512
7b6c969e5414302c19ac009e47ae59b25ecda451f17aaf18bd79dba53b3af891bb86961dddc9793d9f4f03f58fedc56e44e496b14e0be0fe179512215f3a91bd

Download Submit
C:\Windows\SysWOW64\Mqimikfj.exe

Filesize
77KB

MD5
08aaf13c58d1beffed56508021c6ca52

SHA1
6a3845d041ffeef6af87a67ce104614022c76248

SHA256
7a3603db97a5dbb5afa451606f96dd69dbe0134b06e1ec1e3d5be21207098fa7

SHA512
a1f723bf448cbf9c6b4414b8ab4a15078fae8d992fb560294642568adab510a11c1ccc32ff72000275564c353067eb7f1573c1454cba2a16e7409ce93fc300be

Download Submit
C:\Windows\SysWOW64\Nbqmiinl.exe

Filesize
77KB

MD5
d59196e02b11bdb78df5ce6479c81a4e

SHA1
6a786b20d5da6efa2997ec09623bcbb23acd6c9d

SHA256
f292096e4490a7abc1005a1b1651710c9396e34a339e942aae2f86810014abcb

SHA512
3287eb26ac680d8231e7c52094695a06a4c0f3204710ff0f608a701812e42b71575bdc0182d9587cb55d19314cbd296019b29f6472e1334af35b8980205920b6

Download Submit
C:\Windows\SysWOW64\Ocjoadei.exe

Filesize
77KB

MD5
ec4c863a3802a12bfd444c11b8a8b8b1

SHA1
0b649466f2083db6ad2143d6f7d3d8ca3a62a713

SHA256
9ab759f2c043b418e88881e8806d9ae25c872b68855a99be4db093a7bda4ef40

SHA512
3547cd3a2da99e531880e03c433f4307464a9d78fefe8d65f29825e6c244663c54ebf31dfff2c59eb6198e2daf6e19e482d55db81a7f8a568a16f0f8489f2a96

Download Submit
C:\Windows\SysWOW64\Ofckhj32.exe

Filesize
77KB

MD5
4cf30bb98962883c049fa557bb9b1019

SHA1
cc5fbd9810e61f19012e93fdfd30e15acfd6951a

SHA256
7785875e2ae4c7dde6dd98262af3ab16af84fc184f1ad735df1807326fb3c3cf

SHA512
5d484d675019545af0f27848d0afba44224fcee00409539e28d1384644b77992c37226f27d045cfab5f375f3900526dfb6a6bdc58b048fcea39f8c12000c6322

Download Submit
C:\Windows\SysWOW64\Oghghb32.exe

Filesize
77KB

MD5
c25e0e3062bbf6451d552341788e31c6

SHA1
4198ab2a031b6ca59fa594db935a4a3010d75a0f

SHA256
b8fc04316133c1a668e395098f301c6a8925bea1d1bc9390f73c88488d176182

SHA512
45255ec800f594e4cd5c3d2b80597310288f526bdd421bf2dcef33532f9c7d333f73f6e5b88b2464cb360861929edb35b2ef17593c2fe91fb29a0d0a79567cf1

Download Submit
C:\Windows\SysWOW64\Ookoaokf.exe

Filesize
77KB

MD5
6acf1bd74851323d3f521a046876d1c0

SHA1
fe56062f0ed84aed5c113002b662fcd55d2a7207

SHA256
36546f4e8f2f45e58ec32eb38bdde96d5c7ac45f99d24595298cf67198e612d0

SHA512
6c841e15d8951a6e221ea9c8763e06a42c7234d4af2cb34aa3d2f853ce86092ae17911a2fbd35535a537d299cdd5645c43525cd3698092441b301dc1cd461a56

Download Submit
C:\Windows\SysWOW64\Opclldhj.exe

Filesize
77KB

MD5
9c17233513391ff68b9f54d07e2171d9

SHA1
61f0c6459d2e8d83a6a7a57f2cdf61cf1c3ffaa5

SHA256
d8c709d087526db9872666ea3b505dd7eb88661be525f72c23803c76fc727d69

SHA512
7107331b419a4ff31bb7b38ea70d5ce9419a96959f49c44c5c4bccbc8fb3ad09d3d874c5875e5ff664a865f62dcb6fed3a2ba9fbaa512441f932286a88c0cbc3

Download Submit
C:\Windows\SysWOW64\Pcmeke32.exe

Filesize
77KB

MD5
af27ee94c677e6738e89aba97c27fbfa

SHA1
a9740e0fe9275205c1efb7095c1026e78dfe4892

SHA256
42561afb7c1a3d9039580bdbb60b115a74dd01da1f5a7ac2694d8672bc873815

SHA512
cdad53d76526f5067f6bbb88b1eb3cab18869f3507f2154dfb052c23ef42a507dad69cc9902c87edd48fa504d3154a277047a83fd23572a6737a8ff14ac96a17

Download Submit
C:\Windows\SysWOW64\Pcobaedj.exe

Filesize
77KB

MD5
8ed10f6dc043544719cc5208b892868d

SHA1
d028453ac52e3e4cb796b7e3b33a106eb1f4ede2

SHA256
954ee4f257c3a681f3d524744b412ea498dd53953b037e44c01d319799164fee

SHA512
709ba629f16f3213f1cbe6d5dc55dc7cc57de44d8d56cb7c03e31237960e144f2c8cf584332ef1cbec429ceb402cf313b48b4fcabc9a3ad8a678cf5eee8b6a64

Download Submit
C:\Windows\SysWOW64\Pldcjeia.exe

Filesize
77KB

MD5
229fd4fb0b984da5e2f0b2f488d816ce

SHA1
e76112b3c80322695d39aa730fa4893b60e071c3

SHA256
96a99c493177b6b0cf7c6fabad48e7f428742f962d0ca2db7c01beb2323da242

SHA512
f9b58dfbb30a7818266e61cdbc70bae17b8ac721ad141ed8c5596405f145f2319dfd03edaf9ae44275a1a2cf88de23f7d4addea99b6a0284881840ff4d538eb8

Download Submit
C:\Windows\SysWOW64\Pmnbfhal.exe

Filesize
77KB

MD5
4456d4d39cf85b36de60d55f25b9538a

SHA1
19d200d26ea959b86b39063e397810d586d24e34

SHA256
17681fa27c137f494289db92430de8e1daf9946eb58fb9251455dfe1f2dda751

SHA512
400dedc13a4b3cd4e43795dc1c12d76577d246f72bdf3b571d2997a5a0de68ae3e899a6c4704e61d0894d58d8d1e08bf3dfec76825b9862c93508b80af66c8ab

Download Submit
C:\Windows\SysWOW64\Pnifekmd.exe

Filesize
77KB

MD5
d332eeb89b582acdd1757503d384a889

SHA1
42345fd550aca7d409cac663c562b725b0b7cab9

SHA256
3db51ee84ab1b3e8c9b04903c143c0a9411b407ca3db42c802f44ddebac7cbb8

SHA512
e2c786cc9dbacb713b49de69e1d40ee2cd0fcd729984e3a996b670479e8b5abb32d6d9c351b9ecd4f2a0906b7dc6098bd398baf7fa6063780353e251d0634890

Download Submit
C:\Windows\SysWOW64\Ppjbmc32.exe

Filesize
77KB

MD5
0e933c1131df3c6474b66c56562ac682

SHA1
193c8c5a7f96b1abd3ec56da64a6a3262ef99c02

SHA256
1ff7b0b829d0bd1f22250b69609d1eec211dca36c87a7ed5b42a44704adcfbe1

SHA512
1a25a5c58da1aecc4ec27951aa31eef11ccfdb5f960bbf4950df84641f077a06e6b138119054ae1d47aae4a14253ae4c0e15377d48d7894678a4983fb2acbc9a

Download Submit
C:\Windows\SysWOW64\Qaqegecm.exe

Filesize
77KB

MD5
76cb0be432a96dcfcbf3209b2d71e277

SHA1
66a1ec7e0ecd8d01af99d8806683cf944aa6b457

SHA256
41e5f69c8a79b0e6e841c08123b7d3ad4fcec2ac9e96d3fb079e698260ede16a

SHA512
613c3d2eb2b5b9f4d3596b81191c8a6fe7a7c6c16842ff8cc88bc6fe3f281e7bd290f1bd1394ee5f0d3c7d444065ccccccf5cc53285d260a732459a3fd9c54a9

Download Submit
C:\Windows\SysWOW64\Qfkqjmdg.exe

Filesize
77KB

MD5
6fa0ddbd2fa429fcd86b0de698f8fe2c

SHA1
676479ad2bc94da64be20e2af935e0bdf8b37710

SHA256
f30a1b37dc0b4195d66bc0c6b53a16a2ce9bf1f95fdce6ae64c221ef6cdf3b92

SHA512
4d25954c2bcaea83f0e5bc8914dd4f84f0cb45867497305264aead364e91dffe670171dccfc352dbed4272fb91e5d5a206390325878e4b02b92936b27be161b1

Download Submit
C:\Windows\SysWOW64\Qfmmplad.exe

Filesize
77KB

MD5
93ccebe30cbfb58bde7fd9ea32dda339

SHA1
cacced364766f4d852871b40b7379be57bc2b0aa

SHA256
f4ec80f0f0128685c7d3a1c0d0eb5c0b17acec473d34e8f237e7eb3017723b2a

SHA512
c6a2dfe4c5d61d47d8e8480c943a8ae9174ba92c5bcfefd8d00f548471fb458a461c547c7fcc41615deea75c0aa7101c727d449324e2083bcfe76a5194b08b67

Download Submit
memory/116-241-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/448-329-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/460-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/740-173-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/848-153-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/852-193-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/908-213-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1240-323-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1476-73-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1520-317-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1560-144-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1620-303-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1648-407-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1764-269-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1860-189-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1884-281-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1896-389-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1968-441-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2008-341-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2016-419-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2044-236-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2332-353-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2452-129-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2460-65-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2508-257-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2560-177-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2776-161-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2852-365-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2896-121-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2936-347-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3000-249-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3004-305-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3040-395-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3376-371-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3424-387-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3432-97-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3476-293-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3544-377-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3548-225-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3556-431-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3712-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3724-401-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3836-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3852-206-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3900-359-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3920-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4208-267-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4276-335-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4360-89-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4364-49-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4380-41-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4604-275-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4712-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4764-217-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4832-316-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4836-105-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4860-113-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4864-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4864-5-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4892-413-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4960-291-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5012-429-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5036-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5044-136-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads