metasploit | 39b8223acf5a3a8a7102bb297d750a12654e1192cf7d55a01cf5561efa323b9c

Analysis

max time kernel
2s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a65e4b822a31fdfed2051c11edaaa89.exe
Size

525KB
MD5

5a65e4b822a31fdfed2051c11edaaa89
SHA1

61747ddc2c29f2fea860c8d0829e438ef66a32e9
SHA256

39b8223acf5a3a8a7102bb297d750a12654e1192cf7d55a01cf5561efa323b9c
SHA512

1ff035836bd0f2143b696bb93def60c4c55d9cdc99a1aafc723b140122ecf001714f0580c54cf749499ea3cc4033ea386193e351ad7a8f77aa4b56557e1ce00d
SSDEEP

6144:dwVPqTSTVFhaae3OR3wxJXSMaAA4OUi1DZyRn5ERmnfN/05YacxIBnn8H2QYvM4X:Gxfw3OR3cdAV51ch5ERa/3nxIl4i6A/

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 3 IoCs

pid	Process
2816	mmgwtz.exe
2708	gduhwq.exe
2752	cuxavc.exe

Loads dropped DLL 8 IoCs

pid	Process
2404	5a65e4b822a31fdfed2051c11edaaa89.exe
2404	5a65e4b822a31fdfed2051c11edaaa89.exe
2816	mmgwtz.exe
2816	mmgwtz.exe
2708	gduhwq.exe
2708	gduhwq.exe
2752	cuxavc.exe
2752	cuxavc.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\gduhwq.exe	5a65e4b822a31fdfed2051c11edaaa89.exe
File opened for modification	C:\Windows\SysWOW64\gduhwq.exe	5a65e4b822a31fdfed2051c11edaaa89.exe
File created	C:\Windows\SysWOW64\abkkzo.exe	gduhwq.exe
File opened for modification	C:\Windows\SysWOW64\abkkzo.exe	gduhwq.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2244 set thread context of 2404	2244	tvlfjj.exe	18
PID 2816 set thread context of 2708	2816	mmgwtz.exe	114

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2404	2244	5a65e4b822a31fdfed2051c11edaaa89.exe	18
PID 2244 wrote to memory of 2404	2244	5a65e4b822a31fdfed2051c11edaaa89.exe	18
PID 2244 wrote to memory of 2404	2244	5a65e4b822a31fdfed2051c11edaaa89.exe	18
PID 2244 wrote to memory of 2404	2244	5a65e4b822a31fdfed2051c11edaaa89.exe	18
PID 2244 wrote to memory of 2404	2244	5a65e4b822a31fdfed2051c11edaaa89.exe	18
PID 2244 wrote to memory of 2404	2244	tvlfjj.exe	18
PID 2244 wrote to memory of 2404	2244	tvlfjj.exe	18
PID 2244 wrote to memory of 2404	2244	tvlfjj.exe	18
PID 2244 wrote to memory of 2404	2244	tvlfjj.exe	18
PID 2244 wrote to memory of 2404	2244	tvlfjj.exe	18
PID 2404 wrote to memory of 2816	2404	5a65e4b822a31fdfed2051c11edaaa89.exe	43
PID 2404 wrote to memory of 2816	2404	5a65e4b822a31fdfed2051c11edaaa89.exe	43
PID 2404 wrote to memory of 2816	2404	5a65e4b822a31fdfed2051c11edaaa89.exe	43
PID 2404 wrote to memory of 2816	2404	5a65e4b822a31fdfed2051c11edaaa89.exe	43
PID 2816 wrote to memory of 2708	2816	mmgwtz.exe	114
PID 2816 wrote to memory of 2708	2816	mmgwtz.exe	114
PID 2816 wrote to memory of 2708	2816	mmgwtz.exe	114
PID 2816 wrote to memory of 2708	2816	mmgwtz.exe	114
PID 2816 wrote to memory of 2708	2816	mmgwtz.exe	114
PID 2816 wrote to memory of 2708	2816	mmgwtz.exe	114
PID 2816 wrote to memory of 2708	2816	mmgwtz.exe	114
PID 2816 wrote to memory of 2708	2816	mmgwtz.exe	114
PID 2816 wrote to memory of 2708	2816	mmgwtz.exe	114
PID 2816 wrote to memory of 2708	2816	mmgwtz.exe	114
PID 2708 wrote to memory of 2752	2708	gduhwq.exe	431
PID 2708 wrote to memory of 2752	2708	gduhwq.exe	431
PID 2708 wrote to memory of 2752	2708	gduhwq.exe	431
PID 2708 wrote to memory of 2752	2708	gduhwq.exe	431
PID 2752 wrote to memory of 2580	2752	cuxavc.exe	20

C:\Users\Admin\AppData\Local\Temp\5a65e4b822a31fdfed2051c11edaaa89.exe
"C:\Users\Admin\AppData\Local\Temp\5a65e4b822a31fdfed2051c11edaaa89.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\5a65e4b822a31fdfed2051c11edaaa89.exe
  "C:\Users\Admin\AppData\Local\Temp\5a65e4b822a31fdfed2051c11edaaa89.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\SysWOW64\gduhwq.exe
    C:\Windows\system32\gduhwq.exe 512 "C:\Users\Admin\AppData\Local\Temp\5a65e4b822a31fdfed2051c11edaaa89.exe"
    3⤵
    PID:2816

C:\Windows\SysWOW64\abkkzo.exe
C:\Windows\system32\abkkzo.exe 528 "C:\Windows\SysWOW64\gduhwq.exe"
1⤵
PID:2580
- C:\Windows\SysWOW64\uiafcl.exe
  C:\Windows\system32\uiafcl.exe 456 "C:\Windows\SysWOW64\abkkzo.exe"
  2⤵
  PID:2044

C:\Windows\SysWOW64\pzuira.exe
C:\Windows\system32\pzuira.exe 528 "C:\Windows\SysWOW64\fdbxjg.exe"
1⤵
PID:1732
- C:\Windows\SysWOW64\bljiez.exe
  C:\Windows\system32\bljiez.exe 452 "C:\Windows\SysWOW64\pzuira.exe"
  2⤵
  PID:2420

C:\Windows\SysWOW64\bljiez.exe
C:\Windows\system32\bljiez.exe 452 "C:\Windows\SysWOW64\pzuira.exe"
1⤵
PID:3044
- C:\Windows\SysWOW64\temsms.exe
  C:\Windows\system32\temsms.exe 452 "C:\Windows\SysWOW64\bljiez.exe"
  2⤵
  PID:1032

C:\Windows\SysWOW64\dwbqqi.exe
C:\Windows\system32\dwbqqi.exe 452 "C:\Windows\SysWOW64\temsms.exe"
1⤵
PID:2400
- C:\Windows\SysWOW64\nclyic.exe
  C:\Windows\system32\nclyic.exe 472 "C:\Windows\SysWOW64\dwbqqi.exe"
  2⤵
  PID:1988
- - C:\Windows\SysWOW64\ajpthl.exe
    C:\Windows\system32\ajpthl.exe 528 "C:\Windows\SysWOW64\gzmgqk.exe"
    3⤵
    PID:308
  - - C:\Windows\SysWOW64\dnheud.exe
      C:\Windows\system32\dnheud.exe 528 "C:\Windows\SysWOW64\ajpthl.exe"
      4⤵
      PID:1956

C:\Windows\SysWOW64\dwbqqi.exe
C:\Windows\system32\dwbqqi.exe 452 "C:\Windows\SysWOW64\temsms.exe"
1⤵
PID:1212

C:\Windows\SysWOW64\kskgbj.exe
C:\Windows\system32\kskgbj.exe 528 "C:\Windows\SysWOW64\nclyic.exe"
1⤵
PID:2416
- C:\Windows\SysWOW64\uolqjd.exe
  C:\Windows\system32\uolqjd.exe 540 "C:\Windows\SysWOW64\kskgbj.exe"
  2⤵
  PID:2756

C:\Windows\SysWOW64\kskgbj.exe
C:\Windows\system32\kskgbj.exe 528 "C:\Windows\SysWOW64\nclyic.exe"
1⤵
PID:1616

C:\Windows\SysWOW64\uolqjd.exe
C:\Windows\system32\uolqjd.exe 540 "C:\Windows\SysWOW64\kskgbj.exe"
1⤵
PID:2936
- C:\Windows\SysWOW64\bhjvgx.exe
  C:\Windows\system32\bhjvgx.exe 528 "C:\Windows\SysWOW64\uolqjd.exe"
  2⤵
  PID:2824

C:\Windows\SysWOW64\bhjvgx.exe
C:\Windows\system32\bhjvgx.exe 528 "C:\Windows\SysWOW64\uolqjd.exe"
1⤵
PID:564
- C:\Windows\SysWOW64\mrzbln.exe
  C:\Windows\system32\mrzbln.exe 528 "C:\Windows\SysWOW64\bhjvgx.exe"
  2⤵
  PID:1124

C:\Windows\SysWOW64\mrzbln.exe
C:\Windows\system32\mrzbln.exe 528 "C:\Windows\SysWOW64\bhjvgx.exe"
1⤵
PID:2900
- C:\Windows\SysWOW64\lywltj.exe
  C:\Windows\system32\lywltj.exe 476 "C:\Windows\SysWOW64\mrzbln.exe"
  2⤵
  PID:1088
- - C:\Windows\SysWOW64\lywltj.exe
    C:\Windows\system32\lywltj.exe 476 "C:\Windows\SysWOW64\mrzbln.exe"
    3⤵
    PID:2188
  - - C:\Windows\SysWOW64\vqmixz.exe
      C:\Windows\system32\vqmixz.exe 528 "C:\Windows\SysWOW64\lywltj.exe"
      4⤵
      PID:2848
    - - C:\Windows\SysWOW64\vqmixz.exe
        
        C:\Windows\system32\vqmixz.exe 528 "C:\Windows\SysWOW64\lywltj.exe"
        5⤵
        
        PID:1528
      - C:\Windows\SysWOW64\dclwut.exe
        
        C:\Windows\system32\dclwut.exe 528 "C:\Windows\SysWOW64\vqmixz.exe"
        6⤵
        
        PID:2064
- - C:\Windows\SysWOW64\tygqtg.exe
    C:\Windows\system32\tygqtg.exe 528 "C:\Windows\SysWOW64\jgqkgq.exe"
    3⤵
    PID:3028
  - - C:\Windows\SysWOW64\dmgfjo.exe
      C:\Windows\system32\dmgfjo.exe 528 "C:\Windows\SysWOW64\tygqtg.exe"
      4⤵
      PID:1792

C:\Windows\SysWOW64\dclwut.exe
C:\Windows\system32\dclwut.exe 528 "C:\Windows\SysWOW64\vqmixz.exe"
1⤵
PID:3040
- C:\Windows\SysWOW64\nxlgcn.exe
  C:\Windows\system32\nxlgcn.exe 528 "C:\Windows\SysWOW64\dclwut.exe"
  2⤵
  PID:1680

C:\Windows\SysWOW64\nxlgcn.exe
C:\Windows\system32\nxlgcn.exe 528 "C:\Windows\SysWOW64\dclwut.exe"
1⤵
PID:1832
- C:\Windows\SysWOW64\ufhyok.exe
  C:\Windows\system32\ufhyok.exe 528 "C:\Windows\SysWOW64\nxlgcn.exe"
  2⤵
  PID:2052

C:\Windows\SysWOW64\ufhyok.exe
C:\Windows\system32\ufhyok.exe 528 "C:\Windows\SysWOW64\nxlgcn.exe"
1⤵
PID:2128
- C:\Windows\SysWOW64\faaref.exe
  C:\Windows\system32\faaref.exe 528 "C:\Windows\SysWOW64\ufhyok.exe"
  2⤵
  PID:2020

C:\Windows\SysWOW64\faaref.exe
C:\Windows\system32\faaref.exe 528 "C:\Windows\SysWOW64\ufhyok.exe"
1⤵
PID:2668
- C:\Windows\SysWOW64\mmgwtz.exe
  C:\Windows\system32\mmgwtz.exe 528 "C:\Windows\SysWOW64\faaref.exe"
  2⤵
  PID:1616
- - C:\Windows\SysWOW64\mmgwtz.exe
    C:\Windows\system32\mmgwtz.exe 528 "C:\Windows\SysWOW64\faaref.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Windows\SysWOW64\wtltlx.exe
      C:\Windows\system32\wtltlx.exe 528 "C:\Windows\SysWOW64\mmgwtz.exe"
      4⤵
      PID:2656
    - - C:\Windows\SysWOW64\qfjsak.exe
        
        C:\Windows\system32\qfjsak.exe 528 "C:\Windows\SysWOW64\ibhmqz.exe"
        5⤵
        
        PID:2432
      - C:\Windows\SysWOW64\dzphlw.exe
        
        C:\Windows\system32\dzphlw.exe 528 "C:\Windows\SysWOW64\qfjsak.exe"
        6⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\adscte.exe
        
        C:\Windows\system32\adscte.exe 528 "C:\Windows\SysWOW64\qwoebf.exe"
        7⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\kytmby.exe
        
        C:\Windows\system32\kytmby.exe 528 "C:\Windows\SysWOW64\adscte.exe"
        8⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\kytmby.exe
        
        C:\Windows\system32\kytmby.exe 528 "C:\Windows\SysWOW64\adscte.exe"
        9⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\ueujrg.exe
        
        C:\Windows\system32\ueujrg.exe 528 "C:\Windows\SysWOW64\kytmby.exe"
        10⤵
        
        PID:884
        
        C:\Windows\SysWOW64\edqmcy.exe
        
        C:\Windows\system32\edqmcy.exe 452 "C:\Windows\SysWOW64\xduboo.exe"
        9⤵
        
        PID:844
        
        C:\Windows\SysWOW64\ibuxjh.exe
        
        C:\Windows\system32\ibuxjh.exe 452 "C:\Windows\SysWOW64\edqmcy.exe"
        10⤵
        
        PID:1708
  - - C:\Windows\SysWOW64\gduhwq.exe
      C:\Windows\system32\gduhwq.exe 512 "C:\Users\Admin\AppData\Local\Temp\5a65e4b822a31fdfed2051c11edaaa89.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2708

C:\Windows\SysWOW64\wtltlx.exe
C:\Windows\system32\wtltlx.exe 528 "C:\Windows\SysWOW64\mmgwtz.exe"
1⤵
PID:2756
- C:\Windows\SysWOW64\golmts.exe
  C:\Windows\system32\golmts.exe 528 "C:\Windows\SysWOW64\wtltlx.exe"
  2⤵
  PID:1484
- - C:\Windows\SysWOW64\golmts.exe
    C:\Windows\system32\golmts.exe 528 "C:\Windows\SysWOW64\wtltlx.exe"
    3⤵
    PID:2884
  - - C:\Windows\SysWOW64\oakrqm.exe
      C:\Windows\system32\oakrqm.exe 528 "C:\Windows\SysWOW64\golmts.exe"
      4⤵
      PID:1720

C:\Windows\SysWOW64\oakrqm.exe
C:\Windows\system32\oakrqm.exe 528 "C:\Windows\SysWOW64\golmts.exe"
1⤵
PID:2596
- C:\Windows\SysWOW64\iupzif.exe
  C:\Windows\system32\iupzif.exe 468 "C:\Windows\SysWOW64\oakrqm.exe"
  2⤵
  PID:2512
- - C:\Windows\SysWOW64\iupzif.exe
    C:\Windows\system32\iupzif.exe 468 "C:\Windows\SysWOW64\oakrqm.exe"
    3⤵
    PID:1656
  - - C:\Windows\SysWOW64\vwvotr.exe
      C:\Windows\system32\vwvotr.exe 528 "C:\Windows\SysWOW64\iupzif.exe"
      4⤵
      PID:2424
    - - C:\Windows\SysWOW64\vwvotr.exe
        
        C:\Windows\system32\vwvotr.exe 528 "C:\Windows\SysWOW64\iupzif.exe"
        5⤵
        
        PID:1532
      - C:\Windows\SysWOW64\ajnezn.exe
        
        C:\Windows\system32\ajnezn.exe 528 "C:\Windows\SysWOW64\vwvotr.exe"
        6⤵
        
        PID:1836

C:\Windows\SysWOW64\ajnezn.exe
C:\Windows\system32\ajnezn.exe 528 "C:\Windows\SysWOW64\vwvotr.exe"
1⤵
PID:2840
- C:\Windows\SysWOW64\hraetl.exe
  C:\Windows\system32\hraetl.exe 528 "C:\Windows\SysWOW64\ajnezn.exe"
  2⤵
  PID:956
- - C:\Windows\SysWOW64\hraetl.exe
    C:\Windows\system32\hraetl.exe 528 "C:\Windows\SysWOW64\ajnezn.exe"
    3⤵
    PID:1692
  - - C:\Windows\SysWOW64\mhfrpr.exe
      C:\Windows\system32\mhfrpr.exe 476 "C:\Windows\SysWOW64\hraetl.exe"
      4⤵
      PID:860
    - - C:\Windows\SysWOW64\mhfrpr.exe
        
        C:\Windows\system32\mhfrpr.exe 476 "C:\Windows\SysWOW64\hraetl.exe"
        5⤵
        
        PID:2080
      - C:\Windows\SysWOW64\zyauyz.exe
        
        C:\Windows\system32\zyauyz.exe 528 "C:\Windows\SysWOW64\mhfrpr.exe"
        6⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\zyauyz.exe
        
        C:\Windows\system32\zyauyz.exe 528 "C:\Windows\SysWOW64\mhfrpr.exe"
        7⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\ehipow.exe
        
        C:\Windows\system32\ehipow.exe 528 "C:\Windows\SysWOW64\zyauyz.exe"
        8⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\ehipow.exe
        
        C:\Windows\system32\ehipow.exe 528 "C:\Windows\SysWOW64\zyauyz.exe"
        9⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\ddculv.exe
        
        C:\Windows\system32\ddculv.exe 528 "C:\Windows\SysWOW64\ehipow.exe"
        10⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\ddculv.exe
        
        C:\Windows\system32\ddculv.exe 528 "C:\Windows\SysWOW64\ehipow.exe"
        11⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\llqmfl.exe
        
        C:\Windows\system32\llqmfl.exe 528 "C:\Windows\SysWOW64\ddculv.exe"
        12⤵
        
        PID:580
        
        C:\Windows\SysWOW64\llqmfl.exe
        
        C:\Windows\system32\llqmfl.exe 528 "C:\Windows\SysWOW64\ddculv.exe"
        13⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\sslesa.exe
        
        C:\Windows\system32\sslesa.exe 480 "C:\Windows\SysWOW64\llqmfl.exe"
        14⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\sslesa.exe
        
        C:\Windows\system32\sslesa.exe 480 "C:\Windows\SysWOW64\llqmfl.exe"
        15⤵
        
        PID:292
        
        C:\Windows\SysWOW64\ffvcxe.exe
        
        C:\Windows\system32\ffvcxe.exe 528 "C:\Windows\SysWOW64\sslesa.exe"
        16⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\ffvcxe.exe
        
        C:\Windows\system32\ffvcxe.exe 528 "C:\Windows\SysWOW64\sslesa.exe"
        17⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\nkfhpp.exe
        
        C:\Windows\system32\nkfhpp.exe 528 "C:\Windows\SysWOW64\ffvcxe.exe"
        18⤵
        
        PID:996
        
        C:\Windows\SysWOW64\nkfhpp.exe
        
        C:\Windows\system32\nkfhpp.exe 528 "C:\Windows\SysWOW64\ffvcxe.exe"
        19⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\xjjezo.exe
        
        C:\Windows\system32\xjjezo.exe 528 "C:\Windows\SysWOW64\nkfhpp.exe"
        20⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\xjjezo.exe
        
        C:\Windows\system32\xjjezo.exe 528 "C:\Windows\SysWOW64\nkfhpp.exe"
        21⤵
        
        PID:632
        
        C:\Windows\SysWOW64\eyeftd.exe
        
        C:\Windows\system32\eyeftd.exe 528 "C:\Windows\SysWOW64\xjjezo.exe"
        22⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\eyeftd.exe
        
        C:\Windows\system32\eyeftd.exe 528 "C:\Windows\SysWOW64\xjjezo.exe"
        23⤵
        
        PID:860
        
        C:\Windows\SysWOW64\hiwumz.exe
        
        C:\Windows\system32\hiwumz.exe 544 "C:\Windows\SysWOW64\eyeftd.exe"
        24⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\nclyic.exe
        
        C:\Windows\system32\nclyic.exe 472 "C:\Windows\SysWOW64\dwbqqi.exe"
        23⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\tlpuyu.exe
        
        C:\Windows\system32\tlpuyu.exe 456 "C:\Windows\SysWOW64\tanrcn.exe"
        17⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\kkxcxv.exe
        
        C:\Windows\system32\kkxcxv.exe 528 "C:\Windows\SysWOW64\tlpuyu.exe"
        18⤵
        
        PID:696
        
        C:\Windows\SysWOW64\jkpcdw.exe
        
        C:\Windows\system32\jkpcdw.exe 464 "C:\Windows\SysWOW64\wtmpsb.exe"
        15⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\isozoz.exe
        
        C:\Windows\system32\isozoz.exe 452 "C:\Windows\SysWOW64\jkpcdw.exe"
        16⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\isozoz.exe
        
        C:\Windows\system32\isozoz.exe 452 "C:\Windows\SysWOW64\jkpcdw.exe"
        17⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\bxbfrs.exe
        
        C:\Windows\system32\bxbfrs.exe 452 "C:\Windows\SysWOW64\isozoz.exe"
        18⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\bxbfrs.exe
        
        C:\Windows\system32\bxbfrs.exe 452 "C:\Windows\SysWOW64\isozoz.exe"
        19⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\yfjxml.exe
        
        C:\Windows\system32\yfjxml.exe 452 "C:\Windows\SysWOW64\bxbfrs.exe"
        20⤵
        
        PID:1000
        
        C:\Windows\SysWOW64\jftbsm.exe
        
        C:\Windows\system32\jftbsm.exe 452 "C:\Windows\SysWOW64\xwpvve.exe"
        21⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\gzmgqk.exe
        
        C:\Windows\system32\gzmgqk.exe 464 "C:\Windows\SysWOW64\jftbsm.exe"
        22⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\uiafcl.exe
        
        C:\Windows\system32\uiafcl.exe 456 "C:\Windows\SysWOW64\abkkzo.exe"
        14⤵
        
        PID:780
- - C:\Windows\SysWOW64\oyobgl.exe
    C:\Windows\system32\oyobgl.exe 528 "C:\Windows\SysWOW64\bilzyl.exe"
    3⤵
    PID:2584
  - - C:\Windows\SysWOW64\ybeeuo.exe
      C:\Windows\system32\ybeeuo.exe 540 "C:\Windows\SysWOW64\oyobgl.exe"
      4⤵
      PID:1268

C:\Windows\SysWOW64\hiwumz.exe
C:\Windows\system32\hiwumz.exe 544 "C:\Windows\SysWOW64\eyeftd.exe"
1⤵
PID:2800
- C:\Windows\SysWOW64\tcckxm.exe
  C:\Windows\system32\tcckxm.exe 528 "C:\Windows\SysWOW64\hiwumz.exe"
  2⤵
  PID:1080

C:\Windows\SysWOW64\tcckxm.exe
C:\Windows\system32\tcckxm.exe 528 "C:\Windows\SysWOW64\hiwumz.exe"
1⤵
PID:2892
- C:\Windows\SysWOW64\gbfngu.exe
  C:\Windows\system32\gbfngu.exe 536 "C:\Windows\SysWOW64\tcckxm.exe"
  2⤵
  PID:2760
- - C:\Windows\SysWOW64\gbfngu.exe
    C:\Windows\system32\gbfngu.exe 536 "C:\Windows\SysWOW64\tcckxm.exe"
    3⤵
    PID:324
  - - C:\Windows\SysWOW64\lgyuzw.exe
      C:\Windows\system32\lgyuzw.exe 536 "C:\Windows\SysWOW64\gbfngu.exe"
      4⤵
      PID:2652
    - - C:\Windows\SysWOW64\lgyuzw.exe
        
        C:\Windows\system32\lgyuzw.exe 536 "C:\Windows\SysWOW64\gbfngu.exe"
        5⤵
        
        PID:2820
      - C:\Windows\SysWOW64\phguyo.exe
        
        C:\Windows\system32\phguyo.exe 528 "C:\Windows\SysWOW64\lgyuzw.exe"
        6⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\phguyo.exe
        
        C:\Windows\system32\phguyo.exe 528 "C:\Windows\SysWOW64\lgyuzw.exe"
        7⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\umacjq.exe
        
        C:\Windows\system32\umacjq.exe 528 "C:\Windows\SysWOW64\phguyo.exe"
        8⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\umacjq.exe
        
        C:\Windows\system32\umacjq.exe 528 "C:\Windows\SysWOW64\phguyo.exe"
        9⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\cqkpaj.exe
        
        C:\Windows\system32\cqkpaj.exe 528 "C:\Windows\SysWOW64\umacjq.exe"
        10⤵
        
        PID:952
        
        C:\Windows\SysWOW64\cqkpaj.exe
        
        C:\Windows\system32\cqkpaj.exe 528 "C:\Windows\SysWOW64\umacjq.exe"
        11⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\krjihq.exe
        
        C:\Windows\system32\krjihq.exe 528 "C:\Windows\SysWOW64\cqkpaj.exe"
        12⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\krjihq.exe
        
        C:\Windows\system32\krjihq.exe 528 "C:\Windows\SysWOW64\cqkpaj.exe"
        13⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\rchvej.exe
        
        C:\Windows\system32\rchvej.exe 536 "C:\Windows\SysWOW64\krjihq.exe"
        14⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\rchvej.exe
        
        C:\Windows\system32\rchvej.exe 536 "C:\Windows\SysWOW64\krjihq.exe"
        15⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\zgsavu.exe
        
        C:\Windows\system32\zgsavu.exe 528 "C:\Windows\SysWOW64\rchvej.exe"
        16⤵
        
        PID:932
        
        C:\Windows\SysWOW64\axxgxs.exe
        
        C:\Windows\system32\axxgxs.exe 536 "C:\Windows\SysWOW64\vkdyej.exe"
        13⤵
        
        PID:996
        
        C:\Windows\SysWOW64\nzdojf.exe
        
        C:\Windows\system32\nzdojf.exe 528 "C:\Windows\SysWOW64\axxgxs.exe"
        14⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\nzdojf.exe
        
        C:\Windows\system32\nzdojf.exe 528 "C:\Windows\SysWOW64\axxgxs.exe"
        15⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\udnbaq.exe
        
        C:\Windows\system32\udnbaq.exe 528 "C:\Windows\SysWOW64\nzdojf.exe"
        16⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\qmctpp.exe
        
        C:\Windows\system32\qmctpp.exe 452 "C:\Windows\SysWOW64\eywtvj.exe"
        15⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\koftpe.exe
        
        C:\Windows\system32\koftpe.exe 452 "C:\Windows\SysWOW64\qmctpp.exe"
        16⤵
        
        PID:956

C:\Windows\SysWOW64\zgsavu.exe
C:\Windows\system32\zgsavu.exe 528 "C:\Windows\SysWOW64\rchvej.exe"
1⤵
PID:620
- C:\Windows\SysWOW64\jfwxgt.exe
  C:\Windows\system32\jfwxgt.exe 532 "C:\Windows\SysWOW64\zgsavu.exe"
  2⤵
  PID:2540
- - C:\Windows\SysWOW64\jfwxgt.exe
    C:\Windows\system32\jfwxgt.exe 532 "C:\Windows\SysWOW64\zgsavu.exe"
    3⤵
    PID:2692
  - - C:\Windows\SysWOW64\dmmajr.exe
      C:\Windows\system32\dmmajr.exe 528 "C:\Windows\SysWOW64\jfwxgt.exe"
      4⤵
      PID:2828
    - - C:\Windows\SysWOW64\dmmajr.exe
        
        C:\Windows\system32\dmmajr.exe 528 "C:\Windows\SysWOW64\jfwxgt.exe"
        5⤵
        
        PID:668
      - C:\Windows\SysWOW64\umdolk.exe
        
        C:\Windows\system32\umdolk.exe 528 "C:\Windows\SysWOW64\dmmajr.exe"
        6⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\umdolk.exe
        
        C:\Windows\system32\umdolk.exe 528 "C:\Windows\SysWOW64\dmmajr.exe"
        7⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\cickac.exe
        
        C:\Windows\system32\cickac.exe 528 "C:\Windows\SysWOW64\umdolk.exe"
        8⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\cickac.exe
        
        C:\Windows\system32\cickac.exe 528 "C:\Windows\SysWOW64\umdolk.exe"
        9⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\wgseda.exe
        
        C:\Windows\system32\wgseda.exe 528 "C:\Windows\SysWOW64\cickac.exe"
        10⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\wgseda.exe
        
        C:\Windows\system32\wgseda.exe 528 "C:\Windows\SysWOW64\cickac.exe"
        11⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\vkekaq.exe
        
        C:\Windows\system32\vkekaq.exe 452 "C:\Windows\SysWOW64\wgseda.exe"
        12⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\ulatmf.exe
        
        C:\Windows\system32\ulatmf.exe 536 "C:\Windows\SysWOW64\udnbaq.exe"
        13⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\grswbw.exe
        
        C:\Windows\system32\grswbw.exe 528 "C:\Windows\SysWOW64\ulatmf.exe"
        14⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\tqycll.exe
        
        C:\Windows\system32\tqycll.exe 528 "C:\Windows\SysWOW64\iyjehv.exe"
        9⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\abxhin.exe
        
        C:\Windows\system32\abxhin.exe 528 "C:\Windows\SysWOW64\tqycll.exe"
        10⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\abxhin.exe
        
        C:\Windows\system32\abxhin.exe 528 "C:\Windows\SysWOW64\tqycll.exe"
        11⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\nopeoi.exe
        
        C:\Windows\system32\nopeoi.exe 540 "C:\Windows\SysWOW64\abxhin.exe"
        12⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\nopeoi.exe
        
        C:\Windows\system32\nopeoi.exe 540 "C:\Windows\SysWOW64\abxhin.exe"
        13⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\sbiehs.exe
        
        C:\Windows\system32\sbiehs.exe 528 "C:\Windows\SysWOW64\nopeoi.exe"
        14⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\pytaal.exe
        
        C:\Windows\system32\pytaal.exe 452 "C:\Windows\SysWOW64\yfjxml.exe"
        7⤵
        
        PID:868
        
        C:\Windows\SysWOW64\hjfqtl.exe
        
        C:\Windows\system32\hjfqtl.exe 528 "C:\Windows\SysWOW64\pytaal.exe"
        8⤵
        
        PID:2808
- - C:\Windows\SysWOW64\croasn.exe
    C:\Windows\system32\croasn.exe 452 "C:\Windows\SysWOW64\nqtpxw.exe"
    3⤵
    PID:2776
  - - C:\Windows\SysWOW64\ykhgqk.exe
      C:\Windows\system32\ykhgqk.exe 452 "C:\Windows\SysWOW64\croasn.exe"
      4⤵
      PID:2248

C:\Windows\SysWOW64\temsms.exe
C:\Windows\system32\temsms.exe 452 "C:\Windows\SysWOW64\bljiez.exe"
1⤵
PID:1888

C:\Windows\SysWOW64\pzuira.exe
C:\Windows\system32\pzuira.exe 528 "C:\Windows\SysWOW64\fdbxjg.exe"
1⤵
PID:1600

C:\Windows\SysWOW64\fdbxjg.exe
C:\Windows\system32\fdbxjg.exe 528 "C:\Windows\SysWOW64\uiafcl.exe"
1⤵
PID:3020

C:\Windows\SysWOW64\fdbxjg.exe
C:\Windows\system32\fdbxjg.exe 528 "C:\Windows\SysWOW64\uiafcl.exe"
1⤵
PID:2896
- C:\Windows\SysWOW64\wcnuvk.exe
  C:\Windows\system32\wcnuvk.exe 536 "C:\Windows\SysWOW64\mdjxll.exe"
  2⤵
  PID:2444
- - C:\Windows\SysWOW64\gfkfjn.exe
    C:\Windows\system32\gfkfjn.exe 528 "C:\Windows\SysWOW64\wcnuvk.exe"
    3⤵
    PID:616
  - - C:\Windows\SysWOW64\skvubz.exe
      C:\Windows\system32\skvubz.exe 456 "C:\Windows\SysWOW64\ytehep.exe"
      4⤵
      PID:2272
    - - C:\Windows\SysWOW64\oeoazx.exe
        
        C:\Windows\system32\oeoazx.exe 452 "C:\Windows\SysWOW64\skvubz.exe"
        5⤵
        
        PID:1668

C:\Windows\SysWOW64\abkkzo.exe
C:\Windows\system32\abkkzo.exe 528 "C:\Windows\SysWOW64\gduhwq.exe"
1⤵
PID:2752

C:\Windows\SysWOW64\vkekaq.exe
C:\Windows\system32\vkekaq.exe 452 "C:\Windows\SysWOW64\wgseda.exe"
1⤵
PID:1240
- C:\Windows\SysWOW64\ibhmqz.exe
  C:\Windows\system32\ibhmqz.exe 528 "C:\Windows\SysWOW64\vkekaq.exe"
  2⤵
  PID:3024
- - C:\Windows\SysWOW64\ibhmqz.exe
    C:\Windows\system32\ibhmqz.exe 528 "C:\Windows\SysWOW64\vkekaq.exe"
    3⤵
    PID:1812
  - - C:\Windows\SysWOW64\qfjsak.exe
      C:\Windows\system32\qfjsak.exe 528 "C:\Windows\SysWOW64\ibhmqz.exe"
      4⤵
      PID:2656

C:\Windows\SysWOW64\dzphlw.exe
C:\Windows\system32\dzphlw.exe 528 "C:\Windows\SysWOW64\qfjsak.exe"
1⤵
PID:1116
- C:\Windows\SysWOW64\njnsgz.exe
  C:\Windows\system32\njnsgz.exe 528 "C:\Windows\SysWOW64\dzphlw.exe"
  2⤵
  PID:2528
- - C:\Windows\SysWOW64\njnsgz.exe
    C:\Windows\system32\njnsgz.exe 528 "C:\Windows\SysWOW64\dzphlw.exe"
    3⤵
    PID:1112
  - - C:\Windows\SysWOW64\xffcou.exe
      C:\Windows\system32\xffcou.exe 528 "C:\Windows\SysWOW64\njnsgz.exe"
      4⤵
      PID:2844

C:\Windows\SysWOW64\xffcou.exe
C:\Windows\system32\xffcou.exe 528 "C:\Windows\SysWOW64\njnsgz.exe"
1⤵
PID:2588
- C:\Windows\SysWOW64\hivmbx.exe
  C:\Windows\system32\hivmbx.exe 536 "C:\Windows\SysWOW64\xffcou.exe"
  2⤵
  PID:692
- - C:\Windows\SysWOW64\hivmbx.exe
    C:\Windows\system32\hivmbx.exe 536 "C:\Windows\SysWOW64\xffcou.exe"
    3⤵
    PID:2228
  - - C:\Windows\SysWOW64\picnqe.exe
      C:\Windows\system32\picnqe.exe 536 "C:\Windows\SysWOW64\hivmbx.exe"
      4⤵
      PID:1624
    - - C:\Windows\SysWOW64\picnqe.exe
        
        C:\Windows\system32\picnqe.exe 536 "C:\Windows\SysWOW64\hivmbx.exe"
        5⤵
        
        PID:2424
      - C:\Windows\SysWOW64\zhgkac.exe
        
        C:\Windows\system32\zhgkac.exe 536 "C:\Windows\SysWOW64\picnqe.exe"
        6⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\oeoazx.exe
        
        C:\Windows\system32\oeoazx.exe 452 "C:\Windows\SysWOW64\skvubz.exe"
        7⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\lbvase.exe
        
        C:\Windows\system32\lbvase.exe 452 "C:\Windows\SysWOW64\oeoazx.exe"
        8⤵
        
        PID:392
        
        C:\Windows\SysWOW64\lbvase.exe
        
        C:\Windows\system32\lbvase.exe 452 "C:\Windows\SysWOW64\oeoazx.exe"
        9⤵
        
        PID:984
        
        C:\Windows\SysWOW64\polszq.exe
        
        C:\Windows\system32\polszq.exe 464 "C:\Windows\SysWOW64\lbvase.exe"
        10⤵
        
        PID:1148
    - - C:\Windows\SysWOW64\ghftbi.exe
        
        C:\Windows\system32\ghftbi.exe 536 "C:\Windows\SysWOW64\tmodve.exe"
        5⤵
        
        PID:336
      - C:\Windows\SysWOW64\nseyyc.exe
        
        C:\Windows\system32\nseyyc.exe 520 "C:\Windows\SysWOW64\ghftbi.exe"
        6⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\nseyyc.exe
        
        C:\Windows\system32\nseyyc.exe 520 "C:\Windows\SysWOW64\ghftbi.exe"
        7⤵
        
        PID:904
        
        C:\Windows\SysWOW64\vkdyej.exe
        
        C:\Windows\system32\vkdyej.exe 532 "C:\Windows\SysWOW64\nseyyc.exe"
        8⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\vkdyej.exe
        
        C:\Windows\system32\vkdyej.exe 532 "C:\Windows\SysWOW64\nseyyc.exe"
        9⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\axxgxs.exe
        
        C:\Windows\system32\axxgxs.exe 536 "C:\Windows\SysWOW64\vkdyej.exe"
        10⤵
        
        PID:1592

C:\Windows\SysWOW64\zhgkac.exe
C:\Windows\system32\zhgkac.exe 536 "C:\Windows\SysWOW64\picnqe.exe"
1⤵
PID:2492
- C:\Windows\SysWOW64\jokhlb.exe
  C:\Windows\system32\jokhlb.exe 528 "C:\Windows\SysWOW64\zhgkac.exe"
  2⤵
  PID:2220

C:\Windows\SysWOW64\jokhlb.exe
C:\Windows\system32\jokhlb.exe 528 "C:\Windows\SysWOW64\zhgkac.exe"
1⤵
PID:2024
- C:\Windows\SysWOW64\tvlfjj.exe
  C:\Windows\system32\tvlfjj.exe 528 "C:\Windows\SysWOW64\jokhlb.exe"
  2⤵
  PID:2072
- - C:\Windows\SysWOW64\tvlfjj.exe
    C:\Windows\system32\tvlfjj.exe 528 "C:\Windows\SysWOW64\jokhlb.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Windows\SysWOW64\dnaknz.exe
      C:\Windows\system32\dnaknz.exe 528 "C:\Windows\SysWOW64\tvlfjj.exe"
      4⤵
      PID:612
    - - C:\Windows\SysWOW64\dnaknz.exe
        
        C:\Windows\system32\dnaknz.exe 528 "C:\Windows\SysWOW64\tvlfjj.exe"
        5⤵
        
        PID:2868
      - C:\Windows\SysWOW64\idfxjn.exe
        
        C:\Windows\system32\idfxjn.exe 528 "C:\Windows\SysWOW64\dnaknz.exe"
        6⤵
        
        PID:2524
- - C:\Windows\SysWOW64\vrikuo.exe
    C:\Windows\system32\vrikuo.exe 528 "C:\Windows\SysWOW64\ogjfxu.exe"
    3⤵
    PID:2960
  - - C:\Windows\SysWOW64\imraas.exe
      C:\Windows\system32\imraas.exe 528 "C:\Windows\SysWOW64\vrikuo.exe"
      4⤵
      PID:1220
    - - C:\Windows\SysWOW64\imraas.exe
        
        C:\Windows\system32\imraas.exe 528 "C:\Windows\SysWOW64\vrikuo.exe"
        5⤵
        
        PID:2932
      - C:\Windows\SysWOW64\qtnamh.exe
        
        C:\Windows\system32\qtnamh.exe 528 "C:\Windows\SysWOW64\imraas.exe"
        6⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\qtnamh.exe
        
        C:\Windows\system32\qtnamh.exe 528 "C:\Windows\SysWOW64\imraas.exe"
        7⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\zwckik.exe
        
        C:\Windows\system32\zwckik.exe 528 "C:\Windows\SysWOW64\qtnamh.exe"
        8⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\zwckik.exe
        
        C:\Windows\system32\zwckik.exe 528 "C:\Windows\SysWOW64\qtnamh.exe"
        9⤵
        
        PID:372
        
        C:\Windows\SysWOW64\kosima.exe
        
        C:\Windows\system32\kosima.exe 536 "C:\Windows\SysWOW64\zwckik.exe"
        10⤵
        
        PID:880
        
        C:\Windows\SysWOW64\kosima.exe
        
        C:\Windows\system32\kosima.exe 536 "C:\Windows\SysWOW64\zwckik.exe"
        11⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\rzqnbc.exe
        
        C:\Windows\system32\rzqnbc.exe 528 "C:\Windows\SysWOW64\kosima.exe"
        12⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\dxyizm.exe
        
        C:\Windows\system32\dxyizm.exe 456 "C:\Windows\SysWOW64\hatyys.exe"
        7⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\xwpvve.exe
        
        C:\Windows\system32\xwpvve.exe 464 "C:\Windows\SysWOW64\dxyizm.exe"
        8⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\xwpvve.exe
        
        C:\Windows\system32\xwpvve.exe 464 "C:\Windows\SysWOW64\dxyizm.exe"
        9⤵
        
        PID:2948
        
        C:\Windows\SysWOW64\jftbsm.exe
        
        C:\Windows\system32\jftbsm.exe 452 "C:\Windows\SysWOW64\xwpvve.exe"
        10⤵
        
        PID:1000

C:\Windows\SysWOW64\idfxjn.exe
C:\Windows\system32\idfxjn.exe 528 "C:\Windows\SysWOW64\dnaknz.exe"
1⤵
PID:1996
- C:\Windows\SysWOW64\sfuixi.exe
  C:\Windows\system32\sfuixi.exe 528 "C:\Windows\SysWOW64\idfxjn.exe"
  2⤵
  PID:2564
- - C:\Windows\SysWOW64\sfuixi.exe
    C:\Windows\system32\sfuixi.exe 528 "C:\Windows\SysWOW64\idfxjn.exe"
    3⤵
    PID:1156
  - - C:\Windows\SysWOW64\cnzfph.exe
      C:\Windows\system32\cnzfph.exe 536 "C:\Windows\SysWOW64\sfuixi.exe"
      4⤵
      PID:476
    - - C:\Windows\SysWOW64\cnzfph.exe
        
        C:\Windows\system32\cnzfph.exe 536 "C:\Windows\SysWOW64\sfuixi.exe"
        5⤵
        
        PID:2008
      - C:\Windows\SysWOW64\mmlkzg.exe
        
        C:\Windows\system32\mmlkzg.exe 528 "C:\Windows\SysWOW64\cnzfph.exe"
        6⤵
        
        PID:848
    - - C:\Windows\SysWOW64\tanrcn.exe
        
        C:\Windows\system32\tanrcn.exe 460 "C:\Windows\SysWOW64\smbwna.exe"
        5⤵
        
        PID:3008
      - C:\Windows\SysWOW64\tlpuyu.exe
        
        C:\Windows\system32\tlpuyu.exe 456 "C:\Windows\SysWOW64\tanrcn.exe"
        6⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\polszq.exe
        
        C:\Windows\system32\polszq.exe 464 "C:\Windows\SysWOW64\lbvase.exe"
        7⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\mthqjf.exe
        
        C:\Windows\system32\mthqjf.exe 452 "C:\Windows\SysWOW64\polszq.exe"
        8⤵
        
        PID:696
        
        C:\Windows\SysWOW64\mthqjf.exe
        
        C:\Windows\system32\mthqjf.exe 452 "C:\Windows\SysWOW64\polszq.exe"
        9⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\imavhd.exe
        
        C:\Windows\system32\imavhd.exe 452 "C:\Windows\SysWOW64\mthqjf.exe"
        10⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\imavhd.exe
        
        C:\Windows\system32\imavhd.exe 452 "C:\Windows\SysWOW64\mthqjf.exe"
        11⤵
        
        PID:1104
        
        C:\Windows\SysWOW64\fciocp.exe
        
        C:\Windows\system32\fciocp.exe 452 "C:\Windows\SysWOW64\imavhd.exe"
        12⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\bpqozh.exe
        
        C:\Windows\system32\bpqozh.exe 460 "C:\Windows\SysWOW64\ppzceq.exe"
        11⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\vstgyw.exe
        
        C:\Windows\system32\vstgyw.exe 452 "C:\Windows\SysWOW64\bpqozh.exe"
        12⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\vstgyw.exe
        
        C:\Windows\system32\vstgyw.exe 452 "C:\Windows\SysWOW64\bpqozh.exe"
        13⤵
        
        PID:836
        
        C:\Windows\SysWOW64\mnqjua.exe
        
        C:\Windows\system32\mnqjua.exe 464 "C:\Windows\SysWOW64\vstgyw.exe"
        14⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\ppzceq.exe
        
        C:\Windows\system32\ppzceq.exe 452 "C:\Windows\SysWOW64\mqpttb.exe"
        9⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\bpqozh.exe
        
        C:\Windows\system32\bpqozh.exe 460 "C:\Windows\SysWOW64\ppzceq.exe"
        10⤵
        
        PID:2812

C:\Windows\SysWOW64\mmlkzg.exe
C:\Windows\system32\mmlkzg.exe 528 "C:\Windows\SysWOW64\cnzfph.exe"
1⤵
PID:2088
- C:\Windows\SysWOW64\whmvha.exe
  C:\Windows\system32\whmvha.exe 528 "C:\Windows\SysWOW64\mmlkzg.exe"
  2⤵
  PID:2964
- - C:\Windows\SysWOW64\whmvha.exe
    C:\Windows\system32\whmvha.exe 528 "C:\Windows\SysWOW64\mmlkzg.exe"
    3⤵
    PID:2180
  - - C:\Windows\SysWOW64\ohpsgo.exe
      C:\Windows\system32\ohpsgo.exe 536 "C:\Windows\SysWOW64\whmvha.exe"
      4⤵
      PID:2604
    - - C:\Windows\SysWOW64\ohpsgo.exe
        
        C:\Windows\system32\ohpsgo.exe 536 "C:\Windows\SysWOW64\whmvha.exe"
        5⤵
        
        PID:1748
      - C:\Windows\SysWOW64\qnpqev.exe
        
        C:\Windows\system32\qnpqev.exe 536 "C:\Windows\SysWOW64\ohpsgo.exe"
        6⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\igpbsb.exe
        
        C:\Windows\system32\igpbsb.exe 456 "C:\Windows\SysWOW64\zsgivf.exe"
        7⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\fdllle.exe
        
        C:\Windows\system32\fdllle.exe 464 "C:\Windows\SysWOW64\igpbsb.exe"
        8⤵
        
        PID:588

C:\Windows\SysWOW64\qnpqev.exe
C:\Windows\system32\qnpqev.exe 536 "C:\Windows\SysWOW64\ohpsgo.exe"
1⤵
PID:1632
- C:\Windows\SysWOW64\kzqwod.exe
  C:\Windows\system32\kzqwod.exe 528 "C:\Windows\SysWOW64\qnpqev.exe"
  2⤵
  PID:2016

C:\Windows\SysWOW64\kzqwod.exe
C:\Windows\system32\kzqwod.exe 528 "C:\Windows\SysWOW64\qnpqev.exe"
1⤵
PID:1896
- C:\Windows\SysWOW64\rokmuv.exe
  C:\Windows\system32\rokmuv.exe 540 "C:\Windows\SysWOW64\kzqwod.exe"
  2⤵
  PID:2832
- - C:\Windows\SysWOW64\rokmuv.exe
    C:\Windows\system32\rokmuv.exe 540 "C:\Windows\SysWOW64\kzqwod.exe"
    3⤵
    PID:764
  - - C:\Windows\SysWOW64\cfdjel.exe
      C:\Windows\system32\cfdjel.exe 528 "C:\Windows\SysWOW64\rokmuv.exe"
      4⤵
      PID:1848
    - - C:\Windows\SysWOW64\cfdjel.exe
        
        C:\Windows\system32\cfdjel.exe 528 "C:\Windows\SysWOW64\rokmuv.exe"
        5⤵
        
        PID:1412
      - C:\Windows\SysWOW64\jnztkv.exe
        
        C:\Windows\system32\jnztkv.exe 528 "C:\Windows\SysWOW64\cfdjel.exe"
        6⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\jnztkv.exe
        
        C:\Windows\system32\jnztkv.exe 528 "C:\Windows\SysWOW64\cfdjel.exe"
        7⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\juxzke.exe
        
        C:\Windows\system32\juxzke.exe 456 "C:\Windows\SysWOW64\jnztkv.exe"
        8⤵
        
        PID:1220
- - C:\Windows\SysWOW64\vbjojm.exe
    C:\Windows\system32\vbjojm.exe 536 "C:\Windows\SysWOW64\oqcjms.exe"
    3⤵
    PID:1464
  - - C:\Windows\SysWOW64\joteoq.exe
      C:\Windows\system32\joteoq.exe 528 "C:\Windows\SysWOW64\vbjojm.exe"
      4⤵
      PID:2772

C:\Windows\SysWOW64\juxzke.exe
C:\Windows\system32\juxzke.exe 456 "C:\Windows\SysWOW64\jnztkv.exe"
1⤵
PID:1660
- C:\Windows\SysWOW64\bqnemf.exe
  C:\Windows\system32\bqnemf.exe 528 "C:\Windows\SysWOW64\juxzke.exe"
  2⤵
  PID:2976
- - C:\Windows\SysWOW64\bqnemf.exe
    C:\Windows\system32\bqnemf.exe 528 "C:\Windows\SysWOW64\juxzke.exe"
    3⤵
    PID:580
  - - C:\Windows\SysWOW64\iyjehv.exe
      C:\Windows\system32\iyjehv.exe 536 "C:\Windows\SysWOW64\bqnemf.exe"
      4⤵
      PID:2352
    - - C:\Windows\SysWOW64\iyjehv.exe
        
        C:\Windows\system32\iyjehv.exe 536 "C:\Windows\SysWOW64\bqnemf.exe"
        5⤵
        
        PID:2428
      - C:\Windows\SysWOW64\tqycll.exe
        
        C:\Windows\system32\tqycll.exe 528 "C:\Windows\SysWOW64\iyjehv.exe"
        6⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\oqcjms.exe
        
        C:\Windows\system32\oqcjms.exe 540 "C:\Windows\SysWOW64\eukzey.exe"
        7⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\vbjojm.exe
        
        C:\Windows\system32\vbjojm.exe 536 "C:\Windows\SysWOW64\oqcjms.exe"
        8⤵
        
        PID:2832

C:\Windows\SysWOW64\sbiehs.exe
C:\Windows\system32\sbiehs.exe 528 "C:\Windows\SysWOW64\nopeoi.exe"
1⤵
PID:1616
- C:\Windows\SysWOW64\zmhrwm.exe
  C:\Windows\system32\zmhrwm.exe 536 "C:\Windows\SysWOW64\sbiehs.exe"
  2⤵
  PID:2240

C:\Windows\SysWOW64\zmhrwm.exe
C:\Windows\system32\zmhrwm.exe 536 "C:\Windows\SysWOW64\sbiehs.exe"
1⤵
PID:2656
- C:\Windows\SysWOW64\kllppl.exe
  C:\Windows\system32\kllppl.exe 528 "C:\Windows\SysWOW64\zmhrwm.exe"
  2⤵
  PID:2176

C:\Windows\SysWOW64\kllppl.exe
C:\Windows\system32\kllppl.exe 528 "C:\Windows\SysWOW64\zmhrwm.exe"
1⤵
PID:2864
- C:\Windows\SysWOW64\xydfvp.exe
  C:\Windows\system32\xydfvp.exe 528 "C:\Windows\SysWOW64\kllppl.exe"
  2⤵
  PID:2880

C:\Windows\SysWOW64\xydfvp.exe
C:\Windows\system32\xydfvp.exe 528 "C:\Windows\SysWOW64\kllppl.exe"
1⤵
PID:2916
- C:\Windows\SysWOW64\hfhcfn.exe
  C:\Windows\system32\hfhcfn.exe 536 "C:\Windows\SysWOW64\xydfvp.exe"
  2⤵
  PID:3032

C:\Windows\SysWOW64\hfhcfn.exe
C:\Windows\system32\hfhcfn.exe 536 "C:\Windows\SysWOW64\xydfvp.exe"
1⤵
PID:2448
- C:\Windows\SysWOW64\rftzpm.exe
  C:\Windows\system32\rftzpm.exe 528 "C:\Windows\SysWOW64\hfhcfn.exe"
  2⤵
  PID:2156

C:\Windows\SysWOW64\rftzpm.exe
C:\Windows\system32\rftzpm.exe 528 "C:\Windows\SysWOW64\hfhcfn.exe"
1⤵
PID:2636
- C:\Windows\SysWOW64\bhiklp.exe
  C:\Windows\system32\bhiklp.exe 528 "C:\Windows\SysWOW64\rftzpm.exe"
  2⤵
  PID:2812
- - C:\Windows\SysWOW64\bhiklp.exe
    C:\Windows\system32\bhiklp.exe 528 "C:\Windows\SysWOW64\rftzpm.exe"
    3⤵
    PID:1716
  - - C:\Windows\SysWOW64\ldjcsk.exe
      C:\Windows\system32\ldjcsk.exe 528 "C:\Windows\SysWOW64\bhiklp.exe"
      4⤵
      PID:2344
    - - C:\Windows\SysWOW64\ldjcsk.exe
        
        C:\Windows\system32\ldjcsk.exe 528 "C:\Windows\SysWOW64\bhiklp.exe"
        5⤵
        
        PID:1760
      - C:\Windows\SysWOW64\nknadj.exe
        
        C:\Windows\system32\nknadj.exe 528 "C:\Windows\SysWOW64\ldjcsk.exe"
        6⤵
        
        PID:2788
    - - C:\Windows\SysWOW64\bnwuwe.exe
        
        C:\Windows\system32\bnwuwe.exe 452 "C:\Windows\SysWOW64\mynbps.exe"
        5⤵
        
        PID:2076
      - C:\Windows\SysWOW64\omroen.exe
        
        C:\Windows\system32\omroen.exe 528 "C:\Windows\SysWOW64\bnwuwe.exe"
        6⤵
        
        PID:320

C:\Windows\SysWOW64\nknadj.exe
C:\Windows\system32\nknadj.exe 528 "C:\Windows\SysWOW64\ldjcsk.exe"
1⤵
PID:2928
- C:\Windows\SysWOW64\xqopbi.exe
  C:\Windows\system32\xqopbi.exe 528 "C:\Windows\SysWOW64\nknadj.exe"
  2⤵
  PID:3056

C:\Windows\SysWOW64\xqopbi.exe
C:\Windows\system32\xqopbi.exe 528 "C:\Windows\SysWOW64\nknadj.exe"
1⤵
PID:2376
- C:\Windows\SysWOW64\hxsulh.exe
  C:\Windows\system32\hxsulh.exe 540 "C:\Windows\SysWOW64\xqopbi.exe"
  2⤵
  PID:548
- - C:\Windows\SysWOW64\hxsulh.exe
    C:\Windows\system32\hxsulh.exe 540 "C:\Windows\SysWOW64\xqopbi.exe"
    3⤵
    PID:1720
  - - C:\Windows\SysWOW64\rweswg.exe
      C:\Windows\system32\rweswg.exe 528 "C:\Windows\SysWOW64\hxsulh.exe"
      4⤵
      PID:2468
    - - C:\Windows\SysWOW64\rweswg.exe
        
        C:\Windows\system32\rweswg.exe 528 "C:\Windows\SysWOW64\hxsulh.exe"
        5⤵
        
        PID:2176
      - C:\Windows\SysWOW64\csfcla.exe
        
        C:\Windows\system32\csfcla.exe 536 "C:\Windows\SysWOW64\rweswg.exe"
        6⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\csfcla.exe
        
        C:\Windows\system32\csfcla.exe 536 "C:\Windows\SysWOW64\rweswg.exe"
        7⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\mnyvtu.exe
        
        C:\Windows\system32\mnyvtu.exe 528 "C:\Windows\SysWOW64\csfcla.exe"
        8⤵
        
        PID:568
        
        C:\Windows\SysWOW64\mnyvtu.exe
        
        C:\Windows\system32\mnyvtu.exe 528 "C:\Windows\SysWOW64\csfcla.exe"
        9⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\zfmggd.exe
        
        C:\Windows\system32\zfmggd.exe 528 "C:\Windows\SysWOW64\mnyvtu.exe"
        10⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\zfmggd.exe
        
        C:\Windows\system32\zfmggd.exe 528 "C:\Windows\SysWOW64\mnyvtu.exe"
        11⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\mynbps.exe
        
        C:\Windows\system32\mynbps.exe 528 "C:\Windows\SysWOW64\zfmggd.exe"
        12⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\mynbps.exe
        
        C:\Windows\system32\mynbps.exe 528 "C:\Windows\SysWOW64\zfmggd.exe"
        13⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\bnwuwe.exe
        
        C:\Windows\system32\bnwuwe.exe 452 "C:\Windows\SysWOW64\mynbps.exe"
        14⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\hdwwrc.exe
        
        C:\Windows\system32\hdwwrc.exe 452 "C:\Windows\SysWOW64\nffjus.exe"
        7⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\eucwzq.exe
        
        C:\Windows\system32\eucwzq.exe 464 "C:\Windows\SysWOW64\hdwwrc.exe"
        8⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\eucwzq.exe
        
        C:\Windows\system32\eucwzq.exe 464 "C:\Windows\SysWOW64\hdwwrc.exe"
        9⤵
        
        PID:696
        
        C:\Windows\SysWOW64\arghrs.exe
        
        C:\Windows\system32\arghrs.exe 452 "C:\Windows\SysWOW64\eucwzq.exe"
        10⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\arghrs.exe
        
        C:\Windows\system32\arghrs.exe 452 "C:\Windows\SysWOW64\eucwzq.exe"
        11⤵
        
        PID:616
        
        C:\Windows\SysWOW64\ozxzfz.exe
        
        C:\Windows\system32\ozxzfz.exe 452 "C:\Windows\SysWOW64\arghrs.exe"
        12⤵
        
        PID:2748
    - - C:\Windows\SysWOW64\xsvyxg.exe
        
        C:\Windows\system32\xsvyxg.exe 536 "C:\Windows\SysWOW64\pwllnv.exe"
        5⤵
        
        PID:548
      - C:\Windows\SysWOW64\biattu.exe
        
        C:\Windows\system32\biattu.exe 536 "C:\Windows\SysWOW64\xsvyxg.exe"
        6⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\biattu.exe
        
        C:\Windows\system32\biattu.exe 536 "C:\Windows\SysWOW64\xsvyxg.exe"
        7⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\jjztib.exe
        
        C:\Windows\system32\jjztib.exe 536 "C:\Windows\SysWOW64\biattu.exe"
        8⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\jjztib.exe
        
        C:\Windows\system32\jjztib.exe 536 "C:\Windows\SysWOW64\biattu.exe"
        9⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\tmodve.exe
        
        C:\Windows\system32\tmodve.exe 536 "C:\Windows\SysWOW64\jjztib.exe"
        10⤵
        
        PID:2784
- - C:\Windows\SysWOW64\cvrfrw.exe
    C:\Windows\system32\cvrfrw.exe 536 "C:\Windows\SysWOW64\rzqnbc.exe"
    3⤵
    PID:1840
  - - C:\Windows\SysWOW64\jgqkgq.exe
      C:\Windows\system32\jgqkgq.exe 528 "C:\Windows\SysWOW64\cvrfrw.exe"
      4⤵
      PID:1284
    - - C:\Windows\SysWOW64\jgqkgq.exe
        
        C:\Windows\system32\jgqkgq.exe 528 "C:\Windows\SysWOW64\cvrfrw.exe"
        5⤵
        
        PID:2696
      - C:\Windows\SysWOW64\tygqtg.exe
        
        C:\Windows\system32\tygqtg.exe 528 "C:\Windows\SysWOW64\jgqkgq.exe"
        6⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\erbpea.exe
        
        C:\Windows\system32\erbpea.exe 456 "C:\Windows\SysWOW64\ibuxjh.exe"
        7⤵
        
        PID:312
        
        C:\Windows\SysWOW64\ytehep.exe
        
        C:\Windows\system32\ytehep.exe 452 "C:\Windows\SysWOW64\erbpea.exe"
        8⤵
        
        PID:1728

C:\Windows\SysWOW64\omroen.exe
C:\Windows\system32\omroen.exe 528 "C:\Windows\SysWOW64\bnwuwe.exe"
1⤵
PID:2920
- C:\Windows\SysWOW64\xogzai.exe
  C:\Windows\system32\xogzai.exe 528 "C:\Windows\SysWOW64\omroen.exe"
  2⤵
  PID:3056
- - C:\Windows\SysWOW64\xogzai.exe
    C:\Windows\system32\xogzai.exe 528 "C:\Windows\SysWOW64\omroen.exe"
    3⤵
    PID:1080
  - - C:\Windows\SysWOW64\ivsekh.exe
      C:\Windows\system32\ivsekh.exe 528 "C:\Windows\SysWOW64\xogzai.exe"
      4⤵
      PID:2612
    - - C:\Windows\SysWOW64\ivsekh.exe
        
        C:\Windows\system32\ivsekh.exe 528 "C:\Windows\SysWOW64\xogzai.exe"
        5⤵
        
        PID:1180
      - C:\Windows\SysWOW64\yasrou.exe
        
        C:\Windows\system32\yasrou.exe 536 "C:\Windows\SysWOW64\ivsekh.exe"
        6⤵
        
        PID:2860
- - C:\Windows\SysWOW64\pwllnv.exe
    C:\Windows\system32\pwllnv.exe 528 "C:\Windows\SysWOW64\fphnvw.exe"
    3⤵
    PID:2836
  - - C:\Windows\SysWOW64\xsvyxg.exe
      C:\Windows\system32\xsvyxg.exe 536 "C:\Windows\SysWOW64\pwllnv.exe"
      4⤵
      PID:2468

C:\Windows\SysWOW64\yasrou.exe
C:\Windows\system32\yasrou.exe 536 "C:\Windows\SysWOW64\ivsekh.exe"
1⤵
PID:2880
- C:\Windows\SysWOW64\zcibbx.exe
  C:\Windows\system32\zcibbx.exe 528 "C:\Windows\SysWOW64\yasrou.exe"
  2⤵
  PID:784
- - C:\Windows\SysWOW64\zcibbx.exe
    C:\Windows\system32\zcibbx.exe 528 "C:\Windows\SysWOW64\yasrou.exe"
    3⤵
    PID:2828
  - - C:\Windows\SysWOW64\kyjujr.exe
      C:\Windows\system32\kyjujr.exe 536 "C:\Windows\SysWOW64\zcibbx.exe"
      4⤵
      PID:2436
    - - C:\Windows\SysWOW64\kyjujr.exe
        
        C:\Windows\system32\kyjujr.exe 536 "C:\Windows\SysWOW64\zcibbx.exe"
        5⤵
        
        PID:1212
      - C:\Windows\SysWOW64\ufnrbq.exe
        
        C:\Windows\system32\ufnrbq.exe 528 "C:\Windows\SysWOW64\kyjujr.exe"
        6⤵
        
        PID:2396

C:\Windows\SysWOW64\ufnrbq.exe
C:\Windows\system32\ufnrbq.exe 528 "C:\Windows\SysWOW64\kyjujr.exe"
1⤵
PID:2736
- C:\Windows\SysWOW64\hzthnv.exe
  C:\Windows\system32\hzthnv.exe 540 "C:\Windows\SysWOW64\ufnrbq.exe"
  2⤵
  PID:2144
- - C:\Windows\SysWOW64\hzthnv.exe
    C:\Windows\system32\hzthnv.exe 540 "C:\Windows\SysWOW64\ufnrbq.exe"
    3⤵
    PID:2312
  - - C:\Windows\SysWOW64\rgfext.exe
      C:\Windows\system32\rgfext.exe 536 "C:\Windows\SysWOW64\hzthnv.exe"
      4⤵
      PID:2440
    - - C:\Windows\SysWOW64\rgfext.exe
        
        C:\Windows\system32\rgfext.exe 536 "C:\Windows\SysWOW64\hzthnv.exe"
        5⤵
        
        PID:1952
      - C:\Windows\SysWOW64\ycpkpm.exe
        
        C:\Windows\system32\ycpkpm.exe 536 "C:\Windows\SysWOW64\rgfext.exe"
        6⤵
        
        PID:596

C:\Windows\SysWOW64\ycpkpm.exe
C:\Windows\system32\ycpkpm.exe 536 "C:\Windows\SysWOW64\rgfext.exe"
1⤵
PID:1404
- C:\Windows\SysWOW64\ineucq.exe
  C:\Windows\system32\ineucq.exe 528 "C:\Windows\SysWOW64\ycpkpm.exe"
  2⤵
  PID:2016
- - C:\Windows\SysWOW64\ineucq.exe
    C:\Windows\system32\ineucq.exe 528 "C:\Windows\SysWOW64\ycpkpm.exe"
    3⤵
    PID:2136
  - - C:\Windows\SysWOW64\qrphtb.exe
      C:\Windows\system32\qrphtb.exe 528 "C:\Windows\SysWOW64\ineucq.exe"
      4⤵
      PID:1368

C:\Windows\SysWOW64\qrphtb.exe
C:\Windows\system32\qrphtb.exe 528 "C:\Windows\SysWOW64\ineucq.exe"
1⤵
PID:2388
- C:\Windows\SysWOW64\auerge.exe
  C:\Windows\system32\auerge.exe 532 "C:\Windows\SysWOW64\qrphtb.exe"
  2⤵
  PID:3028

C:\Windows\SysWOW64\auerge.exe
C:\Windows\system32\auerge.exe 532 "C:\Windows\SysWOW64\qrphtb.exe"
1⤵
PID:2268
- C:\Windows\SysWOW64\iudsvl.exe
  C:\Windows\system32\iudsvl.exe 536 "C:\Windows\SysWOW64\auerge.exe"
  2⤵
  PID:568
- - C:\Windows\SysWOW64\iudsvl.exe
    C:\Windows\system32\iudsvl.exe 536 "C:\Windows\SysWOW64\auerge.exe"
    3⤵
    PID:1392
  - - C:\Windows\SysWOW64\uojzgx.exe
      C:\Windows\system32\uojzgx.exe 528 "C:\Windows\SysWOW64\iudsvl.exe"
      4⤵
      PID:528
    - - C:\Windows\SysWOW64\uojzgx.exe
        
        C:\Windows\system32\uojzgx.exe 528 "C:\Windows\SysWOW64\iudsvl.exe"
        5⤵
        
        PID:272
      - C:\Windows\SysWOW64\fwnfrw.exe
        
        C:\Windows\system32\fwnfrw.exe 536 "C:\Windows\SysWOW64\uojzgx.exe"
        6⤵
        
        PID:2340

C:\Windows\SysWOW64\fwnfrw.exe
C:\Windows\system32\fwnfrw.exe 536 "C:\Windows\SysWOW64\uojzgx.exe"
1⤵
PID:2876
- C:\Windows\SysWOW64\mdjxll.exe
  C:\Windows\system32\mdjxll.exe 536 "C:\Windows\SysWOW64\fwnfrw.exe"
  2⤵
  PID:2624

C:\Windows\SysWOW64\mdjxll.exe
C:\Windows\system32\mdjxll.exe 536 "C:\Windows\SysWOW64\fwnfrw.exe"
1⤵
PID:3004
- C:\Windows\SysWOW64\wcnuvk.exe
  C:\Windows\system32\wcnuvk.exe 536 "C:\Windows\SysWOW64\mdjxll.exe"
  2⤵
  PID:2896

C:\Windows\SysWOW64\gfkfjn.exe
C:\Windows\system32\gfkfjn.exe 528 "C:\Windows\SysWOW64\wcnuvk.exe"
1⤵
PID:1500
- C:\Windows\SysWOW64\ogjfxu.exe
  C:\Windows\system32\ogjfxu.exe 528 "C:\Windows\SysWOW64\gfkfjn.exe"
  2⤵
  PID:1948
- - C:\Windows\SysWOW64\ogjfxu.exe
    C:\Windows\system32\ogjfxu.exe 528 "C:\Windows\SysWOW64\gfkfjn.exe"
    3⤵
    PID:2720
  - - C:\Windows\SysWOW64\vrikuo.exe
      C:\Windows\system32\vrikuo.exe 528 "C:\Windows\SysWOW64\ogjfxu.exe"
      4⤵
      PID:2072

C:\Windows\SysWOW64\rzqnbc.exe
C:\Windows\system32\rzqnbc.exe 528 "C:\Windows\SysWOW64\kosima.exe"
1⤵
PID:992
- C:\Windows\SysWOW64\cvrfrw.exe
  C:\Windows\system32\cvrfrw.exe 536 "C:\Windows\SysWOW64\rzqnbc.exe"
  2⤵
  PID:548

C:\Windows\SysWOW64\dmgfjo.exe
C:\Windows\system32\dmgfjo.exe 528 "C:\Windows\SysWOW64\tygqtg.exe"
1⤵
PID:568
- C:\Windows\SysWOW64\nihyqi.exe
  C:\Windows\system32\nihyqi.exe 536 "C:\Windows\SysWOW64\dmgfjo.exe"
  2⤵
  PID:1488
- - C:\Windows\SysWOW64\nihyqi.exe
    C:\Windows\system32\nihyqi.exe 536 "C:\Windows\SysWOW64\dmgfjo.exe"
    3⤵
    PID:1664
  - - C:\Windows\SysWOW64\symkmo.exe
      C:\Windows\system32\symkmo.exe 536 "C:\Windows\SysWOW64\nihyqi.exe"
      4⤵
      PID:2620
- - C:\Windows\SysWOW64\grswbw.exe
    C:\Windows\system32\grswbw.exe 528 "C:\Windows\SysWOW64\ulatmf.exe"
    3⤵
    PID:2792
  - - C:\Windows\SysWOW64\rmsgqr.exe
      C:\Windows\system32\rmsgqr.exe 536 "C:\Windows\SysWOW64\grswbw.exe"
      4⤵
      PID:2624
    - - C:\Windows\SysWOW64\rmsgqr.exe
        
        C:\Windows\system32\rmsgqr.exe 536 "C:\Windows\SysWOW64\grswbw.exe"
        5⤵
        
        PID:2628
      - C:\Windows\SysWOW64\bilzyl.exe
        
        C:\Windows\system32\bilzyl.exe 528 "C:\Windows\SysWOW64\rmsgqr.exe"
        6⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\bilzyl.exe
        
        C:\Windows\system32\bilzyl.exe 528 "C:\Windows\SysWOW64\rmsgqr.exe"
        7⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\oyobgl.exe
        
        C:\Windows\system32\oyobgl.exe 528 "C:\Windows\SysWOW64\bilzyl.exe"
        8⤵
        
        PID:956
        
        C:\Windows\SysWOW64\koftpe.exe
        
        C:\Windows\system32\koftpe.exe 452 "C:\Windows\SysWOW64\qmctpp.exe"
        9⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\bvnbnm.exe
        
        C:\Windows\system32\bvnbnm.exe 452 "C:\Windows\SysWOW64\koftpe.exe"
        10⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\bvnbnm.exe
        
        C:\Windows\system32\bvnbnm.exe 452 "C:\Windows\SysWOW64\koftpe.exe"
        11⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\nwrgsu.exe
        
        C:\Windows\system32\nwrgsu.exe 452 "C:\Windows\SysWOW64\bvnbnm.exe"
        12⤵
        
        PID:940
    - - C:\Windows\SysWOW64\mnqjua.exe
        
        C:\Windows\system32\mnqjua.exe 464 "C:\Windows\SysWOW64\vstgyw.exe"
        5⤵
        
        PID:1824
      - C:\Windows\SysWOW64\nffjus.exe
        
        C:\Windows\system32\nffjus.exe 452 "C:\Windows\SysWOW64\mnqjua.exe"
        6⤵
        
        PID:1456

C:\Windows\SysWOW64\symkmo.exe
C:\Windows\system32\symkmo.exe 536 "C:\Windows\SysWOW64\nihyqi.exe"
1⤵
PID:2496
- C:\Windows\SysWOW64\fphnvw.exe
  C:\Windows\system32\fphnvw.exe 528 "C:\Windows\SysWOW64\symkmo.exe"
  2⤵
  PID:1936
- - C:\Windows\SysWOW64\fphnvw.exe
    C:\Windows\system32\fphnvw.exe 528 "C:\Windows\SysWOW64\symkmo.exe"
    3⤵
    PID:880
  - - C:\Windows\SysWOW64\pwllnv.exe
      C:\Windows\system32\pwllnv.exe 528 "C:\Windows\SysWOW64\fphnvw.exe"
      4⤵
      PID:3056

C:\Windows\SysWOW64\tmodve.exe
C:\Windows\system32\tmodve.exe 536 "C:\Windows\SysWOW64\jjztib.exe"
1⤵
PID:2688
- C:\Windows\SysWOW64\ghftbi.exe
  C:\Windows\system32\ghftbi.exe 536 "C:\Windows\SysWOW64\tmodve.exe"
  2⤵
  PID:1624

C:\Windows\SysWOW64\udnbaq.exe
C:\Windows\system32\udnbaq.exe 528 "C:\Windows\SysWOW64\nzdojf.exe"
1⤵
PID:1944
- C:\Windows\SysWOW64\ulatmf.exe
  C:\Windows\system32\ulatmf.exe 536 "C:\Windows\SysWOW64\udnbaq.exe"
  2⤵
  PID:3064

C:\Windows\SysWOW64\ybeeuo.exe
C:\Windows\system32\ybeeuo.exe 540 "C:\Windows\SysWOW64\oyobgl.exe"
1⤵
PID:2728
- C:\Windows\SysWOW64\imtopr.exe
  C:\Windows\system32\imtopr.exe 528 "C:\Windows\SysWOW64\ybeeuo.exe"
  2⤵
  PID:2212

C:\Windows\SysWOW64\imtopr.exe
C:\Windows\system32\imtopr.exe 528 "C:\Windows\SysWOW64\ybeeuo.exe"
1⤵
PID:1980
- C:\Windows\SysWOW64\sejtui.exe
  C:\Windows\system32\sejtui.exe 528 "C:\Windows\SysWOW64\imtopr.exe"
  2⤵
  PID:1292

C:\Windows\SysWOW64\sejtui.exe
C:\Windows\system32\sejtui.exe 528 "C:\Windows\SysWOW64\imtopr.exe"
1⤵
PID:892
- C:\Windows\SysWOW64\pxcrsf.exe
  C:\Windows\system32\pxcrsf.exe 484 "C:\Windows\SysWOW64\sejtui.exe"
  2⤵
  PID:2272
- - C:\Windows\SysWOW64\pxcrsf.exe
    C:\Windows\system32\pxcrsf.exe 484 "C:\Windows\SysWOW64\sejtui.exe"
    3⤵
    PID:2976
  - - C:\Windows\SysWOW64\eukzey.exe
      C:\Windows\system32\eukzey.exe 536 "C:\Windows\SysWOW64\pxcrsf.exe"
      4⤵
      PID:2224

C:\Windows\SysWOW64\eukzey.exe
C:\Windows\system32\eukzey.exe 536 "C:\Windows\SysWOW64\pxcrsf.exe"
1⤵
PID:1248
- C:\Windows\SysWOW64\oqcjms.exe
  C:\Windows\system32\oqcjms.exe 540 "C:\Windows\SysWOW64\eukzey.exe"
  2⤵
  PID:2616

C:\Windows\SysWOW64\joteoq.exe
C:\Windows\system32\joteoq.exe 528 "C:\Windows\SysWOW64\vbjojm.exe"
1⤵
PID:2300
- C:\Windows\SysWOW64\qwoebf.exe
  C:\Windows\system32\qwoebf.exe 528 "C:\Windows\SysWOW64\joteoq.exe"
  2⤵
  PID:2536
- - C:\Windows\SysWOW64\qwoebf.exe
    C:\Windows\system32\qwoebf.exe 528 "C:\Windows\SysWOW64\joteoq.exe"
    3⤵
    PID:1916
  - - C:\Windows\SysWOW64\adscte.exe
      C:\Windows\system32\adscte.exe 528 "C:\Windows\SysWOW64\qwoebf.exe"
      4⤵
      PID:2740

C:\Windows\SysWOW64\ueujrg.exe
C:\Windows\system32\ueujrg.exe 528 "C:\Windows\SysWOW64\kytmby.exe"
1⤵
PID:2344
- C:\Windows\SysWOW64\cjwxiz.exe
  C:\Windows\system32\cjwxiz.exe 528 "C:\Windows\SysWOW64\ueujrg.exe"
  2⤵
  PID:1696
- - C:\Windows\SysWOW64\cjwxiz.exe
    C:\Windows\system32\cjwxiz.exe 528 "C:\Windows\SysWOW64\ueujrg.exe"
    3⤵
    PID:2616
  - - C:\Windows\SysWOW64\esvmav.exe
      C:\Windows\system32\esvmav.exe 536 "C:\Windows\SysWOW64\cjwxiz.exe"
      4⤵
      PID:2660
    - - C:\Windows\SysWOW64\esvmav.exe
        
        C:\Windows\system32\esvmav.exe 536 "C:\Windows\SysWOW64\cjwxiz.exe"
        5⤵
        
        PID:1648
      - C:\Windows\SysWOW64\yrnzxf.exe
        
        C:\Windows\system32\yrnzxf.exe 452 "C:\Windows\SysWOW64\esvmav.exe"
        6⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\yrnzxf.exe
        
        C:\Windows\system32\yrnzxf.exe 452 "C:\Windows\SysWOW64\esvmav.exe"
        7⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\xzlpia.exe
        
        C:\Windows\system32\xzlpia.exe 452 "C:\Windows\SysWOW64\yrnzxf.exe"
        8⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\xzlpia.exe
        
        C:\Windows\system32\xzlpia.exe 452 "C:\Windows\SysWOW64\yrnzxf.exe"
        9⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\obxkkn.exe
        
        C:\Windows\system32\obxkkn.exe 452 "C:\Windows\SysWOW64\xzlpia.exe"
        10⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\bzmydr.exe
        
        C:\Windows\system32\bzmydr.exe 468 "C:\Windows\SysWOW64\fciocp.exe"
        9⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\gbwlnj.exe
        
        C:\Windows\system32\gbwlnj.exe 456 "C:\Windows\SysWOW64\bzmydr.exe"
        10⤵
        
        PID:1344

C:\Windows\SysWOW64\obxkkn.exe
C:\Windows\system32\obxkkn.exe 452 "C:\Windows\SysWOW64\xzlpia.exe"
1⤵
PID:2304
- C:\Windows\SysWOW64\fjxsro.exe
  C:\Windows\system32\fjxsro.exe 452 "C:\Windows\SysWOW64\obxkkn.exe"
  2⤵
  PID:1544

C:\Windows\SysWOW64\fjxsro.exe
C:\Windows\system32\fjxsro.exe 452 "C:\Windows\SysWOW64\obxkkn.exe"
1⤵
PID:1992
- C:\Windows\SysWOW64\fqeqcr.exe
  C:\Windows\system32\fqeqcr.exe 452 "C:\Windows\SysWOW64\fjxsro.exe"
  2⤵
  PID:2196

C:\Windows\SysWOW64\fqeqcr.exe
C:\Windows\system32\fqeqcr.exe 452 "C:\Windows\SysWOW64\fjxsro.exe"
1⤵
PID:2328
- C:\Windows\SysWOW64\eycfvm.exe
  C:\Windows\system32\eycfvm.exe 528 "C:\Windows\SysWOW64\fqeqcr.exe"
  2⤵
  PID:832
- - C:\Windows\SysWOW64\eycfvm.exe
    C:\Windows\system32\eycfvm.exe 528 "C:\Windows\SysWOW64\fqeqcr.exe"
    3⤵
    PID:3068
  - - C:\Windows\SysWOW64\kgmqvm.exe
      C:\Windows\system32\kgmqvm.exe 452 "C:\Windows\SysWOW64\eycfvm.exe"
      4⤵
      PID:2288

C:\Windows\SysWOW64\kgmqvm.exe
C:\Windows\system32\kgmqvm.exe 452 "C:\Windows\SysWOW64\eycfvm.exe"
1⤵
PID:3024
- C:\Windows\SysWOW64\cfmyuv.exe
  C:\Windows\system32\cfmyuv.exe 452 "C:\Windows\SysWOW64\kgmqvm.exe"
  2⤵
  PID:2776

C:\Windows\SysWOW64\cfmyuv.exe
C:\Windows\system32\cfmyuv.exe 452 "C:\Windows\SysWOW64\kgmqvm.exe"
1⤵
PID:2348
- C:\Windows\SysWOW64\yyfvsk.exe
  C:\Windows\system32\yyfvsk.exe 452 "C:\Windows\SysWOW64\cfmyuv.exe"
  2⤵
  PID:1960

C:\Windows\SysWOW64\yyfvsk.exe
C:\Windows\system32\yyfvsk.exe 452 "C:\Windows\SysWOW64\cfmyuv.exe"
1⤵
PID:1540
- C:\Windows\SysWOW64\nklbwt.exe
  C:\Windows\system32\nklbwt.exe 452 "C:\Windows\SysWOW64\yyfvsk.exe"
  2⤵
  PID:2504

C:\Windows\SysWOW64\nklbwt.exe
C:\Windows\system32\nklbwt.exe 452 "C:\Windows\SysWOW64\yyfvsk.exe"
1⤵
PID:1628
- C:\Windows\SysWOW64\hxrjqz.exe
  C:\Windows\system32\hxrjqz.exe 456 "C:\Windows\SysWOW64\nklbwt.exe"
  2⤵
  PID:2732

C:\Windows\SysWOW64\hxrjqz.exe
C:\Windows\system32\hxrjqz.exe 456 "C:\Windows\SysWOW64\nklbwt.exe"
1⤵
PID:2764
- C:\Windows\SysWOW64\btfjkn.exe
  C:\Windows\system32\btfjkn.exe 452 "C:\Windows\SysWOW64\hxrjqz.exe"
  2⤵
  PID:2028

C:\Windows\SysWOW64\btfjkn.exe
C:\Windows\system32\btfjkn.exe 452 "C:\Windows\SysWOW64\hxrjqz.exe"
1⤵
PID:1836
- C:\Windows\SysWOW64\xqbuch.exe
  C:\Windows\system32\xqbuch.exe 528 "C:\Windows\SysWOW64\btfjkn.exe"
  2⤵
  PID:2320

C:\Windows\SysWOW64\xqbuch.exe
C:\Windows\system32\xqbuch.exe 528 "C:\Windows\SysWOW64\btfjkn.exe"
1⤵
PID:2200
- C:\Windows\SysWOW64\wtmpsb.exe
  C:\Windows\system32\wtmpsb.exe 460 "C:\Windows\SysWOW64\xqbuch.exe"
  2⤵
  PID:2712

C:\Windows\SysWOW64\wtmpsb.exe
C:\Windows\system32\wtmpsb.exe 460 "C:\Windows\SysWOW64\xqbuch.exe"
1⤵
PID:1568
- C:\Windows\SysWOW64\jkpcdw.exe
  C:\Windows\system32\jkpcdw.exe 464 "C:\Windows\SysWOW64\wtmpsb.exe"
  2⤵
  PID:2004
- - C:\Windows\SysWOW64\fciocp.exe
    C:\Windows\system32\fciocp.exe 452 "C:\Windows\SysWOW64\imavhd.exe"
    3⤵
    PID:2040
  - - C:\Windows\SysWOW64\bzmydr.exe
      C:\Windows\system32\bzmydr.exe 468 "C:\Windows\SysWOW64\fciocp.exe"
      4⤵
      PID:2324

C:\Windows\SysWOW64\yfjxml.exe
C:\Windows\system32\yfjxml.exe 452 "C:\Windows\SysWOW64\bxbfrs.exe"
1⤵
PID:2804
- C:\Windows\SysWOW64\pytaal.exe
  C:\Windows\system32\pytaal.exe 452 "C:\Windows\SysWOW64\yfjxml.exe"
  2⤵
  PID:1640

C:\Windows\SysWOW64\hjfqtl.exe
C:\Windows\system32\hjfqtl.exe 528 "C:\Windows\SysWOW64\pytaal.exe"
1⤵
PID:2260
- C:\Windows\SysWOW64\kvxsoc.exe
  C:\Windows\system32\kvxsoc.exe 452 "C:\Windows\SysWOW64\hjfqtl.exe"
  2⤵
  PID:288

C:\Windows\SysWOW64\kvxsoc.exe
C:\Windows\system32\kvxsoc.exe 452 "C:\Windows\SysWOW64\hjfqtl.exe"
1⤵
PID:2712
- C:\Windows\SysWOW64\hatyys.exe
  C:\Windows\system32\hatyys.exe 464 "C:\Windows\SysWOW64\kvxsoc.exe"
  2⤵
  PID:2480

C:\Windows\SysWOW64\hatyys.exe
C:\Windows\system32\hatyys.exe 464 "C:\Windows\SysWOW64\kvxsoc.exe"
1⤵
PID:2532
- C:\Windows\SysWOW64\dxyizm.exe
  C:\Windows\system32\dxyizm.exe 456 "C:\Windows\SysWOW64\hatyys.exe"
  2⤵
  PID:2516
- - C:\Windows\SysWOW64\fkbdwy.exe
    C:\Windows\system32\fkbdwy.exe 452 "C:\Windows\SysWOW64\llkqhn.exe"
    3⤵
    PID:2604
  - - C:\Windows\SysWOW64\eywtvj.exe
      C:\Windows\system32\eywtvj.exe 452 "C:\Windows\SysWOW64\fkbdwy.exe"
      4⤵
      PID:1488
    - - C:\Windows\SysWOW64\eywtvj.exe
        
        C:\Windows\system32\eywtvj.exe 452 "C:\Windows\SysWOW64\fkbdwy.exe"
        5⤵
        
        PID:2716
      - C:\Windows\SysWOW64\qmctpp.exe
        
        C:\Windows\system32\qmctpp.exe 452 "C:\Windows\SysWOW64\eywtvj.exe"
        6⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\mqpttb.exe
        
        C:\Windows\system32\mqpttb.exe 528 "C:\Windows\SysWOW64\gbwlnj.exe"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\ppzceq.exe
        
        C:\Windows\system32\ppzceq.exe 452 "C:\Windows\SysWOW64\mqpttb.exe"
        8⤵
        
        PID:696

C:\Windows\SysWOW64\gzmgqk.exe
C:\Windows\system32\gzmgqk.exe 464 "C:\Windows\SysWOW64\jftbsm.exe"
1⤵
PID:2972
- C:\Windows\SysWOW64\ajpthl.exe
  C:\Windows\system32\ajpthl.exe 528 "C:\Windows\SysWOW64\gzmgqk.exe"
  2⤵
  PID:1988

C:\Windows\SysWOW64\dnheud.exe
C:\Windows\system32\dnheud.exe 528 "C:\Windows\SysWOW64\ajpthl.exe"
1⤵
PID:2264
- C:\Windows\SysWOW64\fpsarq.exe
  C:\Windows\system32\fpsarq.exe 528 "C:\Windows\SysWOW64\dnheud.exe"
  2⤵
  PID:1844
- - C:\Windows\SysWOW64\fpsarq.exe
    C:\Windows\system32\fpsarq.exe 528 "C:\Windows\SysWOW64\dnheud.exe"
    3⤵
    PID:2784
  - - C:\Windows\SysWOW64\zsgivf.exe
      C:\Windows\system32\zsgivf.exe 528 "C:\Windows\SysWOW64\fpsarq.exe"
      4⤵
      PID:1344
    - - C:\Windows\SysWOW64\gbwlnj.exe
        
        C:\Windows\system32\gbwlnj.exe 456 "C:\Windows\SysWOW64\bzmydr.exe"
        5⤵
        
        PID:2024
      - C:\Windows\SysWOW64\mqpttb.exe
        
        C:\Windows\system32\mqpttb.exe 528 "C:\Windows\SysWOW64\gbwlnj.exe"
        6⤵
        
        PID:1644

C:\Windows\SysWOW64\zsgivf.exe
C:\Windows\system32\zsgivf.exe 528 "C:\Windows\SysWOW64\fpsarq.exe"
1⤵
PID:3060
- C:\Windows\SysWOW64\igpbsb.exe
  C:\Windows\system32\igpbsb.exe 456 "C:\Windows\SysWOW64\zsgivf.exe"
  2⤵
  PID:1596

C:\Windows\SysWOW64\fdllle.exe
C:\Windows\system32\fdllle.exe 464 "C:\Windows\SysWOW64\igpbsb.exe"
1⤵
PID:2660
- C:\Windows\SysWOW64\tttwgx.exe
  C:\Windows\system32\tttwgx.exe 456 "C:\Windows\SysWOW64\fdllle.exe"
  2⤵
  PID:2912

C:\Windows\SysWOW64\tttwgx.exe
C:\Windows\system32\tttwgx.exe 456 "C:\Windows\SysWOW64\fdllle.exe"
1⤵
PID:2332
- C:\Windows\SysWOW64\sedhcf.exe
  C:\Windows\system32\sedhcf.exe 452 "C:\Windows\SysWOW64\tttwgx.exe"
  2⤵
  PID:1984

C:\Windows\SysWOW64\sedhcf.exe
C:\Windows\system32\sedhcf.exe 452 "C:\Windows\SysWOW64\tttwgx.exe"
1⤵
PID:1592
- C:\Windows\SysWOW64\smbwna.exe
  C:\Windows\system32\smbwna.exe 456 "C:\Windows\SysWOW64\sedhcf.exe"
  2⤵
  PID:836

C:\Windows\SysWOW64\smbwna.exe
C:\Windows\system32\smbwna.exe 456 "C:\Windows\SysWOW64\sedhcf.exe"
1⤵
PID:928
- C:\Windows\SysWOW64\tanrcn.exe
  C:\Windows\system32\tanrcn.exe 460 "C:\Windows\SysWOW64\smbwna.exe"
  2⤵
  PID:476

C:\Windows\SysWOW64\kkxcxv.exe
C:\Windows\system32\kkxcxv.exe 528 "C:\Windows\SysWOW64\tlpuyu.exe"
1⤵
PID:2988
- C:\Windows\SysWOW64\xzfcrx.exe
  C:\Windows\system32\xzfcrx.exe 528 "C:\Windows\SysWOW64\kkxcxv.exe"
  2⤵
  PID:2336
- - C:\Windows\SysWOW64\xzfcrx.exe
    C:\Windows\system32\xzfcrx.exe 528 "C:\Windows\SysWOW64\kkxcxv.exe"
    3⤵
    PID:2056
  - - C:\Windows\SysWOW64\cuxavc.exe
      C:\Windows\system32\cuxavc.exe 456 "C:\Windows\SysWOW64\xzfcrx.exe"
      4⤵
      PID:2956

C:\Windows\SysWOW64\cuxavc.exe
C:\Windows\system32\cuxavc.exe 456 "C:\Windows\SysWOW64\xzfcrx.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\llkqhn.exe
  C:\Windows\system32\llkqhn.exe 464 "C:\Windows\SysWOW64\cuxavc.exe"
  2⤵
  PID:1984
- - C:\Windows\SysWOW64\llkqhn.exe
    C:\Windows\system32\llkqhn.exe 464 "C:\Windows\SysWOW64\cuxavc.exe"
    3⤵
    PID:520
  - - C:\Windows\SysWOW64\fkbdwy.exe
      C:\Windows\system32\fkbdwy.exe 452 "C:\Windows\SysWOW64\llkqhn.exe"
      4⤵
      PID:2516

C:\Windows\SysWOW64\nwrgsu.exe
C:\Windows\system32\nwrgsu.exe 452 "C:\Windows\SysWOW64\bvnbnm.exe"
1⤵
PID:2124
- C:\Windows\SysWOW64\xduboo.exe
  C:\Windows\system32\xduboo.exe 452 "C:\Windows\SysWOW64\nwrgsu.exe"
  2⤵
  PID:836
- - C:\Windows\SysWOW64\xduboo.exe
    C:\Windows\system32\xduboo.exe 452 "C:\Windows\SysWOW64\nwrgsu.exe"
    3⤵
    PID:2024
  - - C:\Windows\SysWOW64\edqmcy.exe
      C:\Windows\system32\edqmcy.exe 452 "C:\Windows\SysWOW64\xduboo.exe"
      4⤵
      PID:2276

C:\Windows\SysWOW64\ibuxjh.exe
C:\Windows\system32\ibuxjh.exe 452 "C:\Windows\SysWOW64\edqmcy.exe"
1⤵
PID:1688
- C:\Windows\SysWOW64\erbpea.exe
  C:\Windows\system32\erbpea.exe 456 "C:\Windows\SysWOW64\ibuxjh.exe"
  2⤵
  PID:1088

C:\Windows\SysWOW64\ytehep.exe
C:\Windows\system32\ytehep.exe 452 "C:\Windows\SysWOW64\erbpea.exe"
1⤵
PID:2320
- C:\Windows\SysWOW64\skvubz.exe
  C:\Windows\system32\skvubz.exe 456 "C:\Windows\SysWOW64\ytehep.exe"
  2⤵
  PID:616

C:\Windows\SysWOW64\nffjus.exe
C:\Windows\system32\nffjus.exe 452 "C:\Windows\SysWOW64\mnqjua.exe"
1⤵
PID:2392
- C:\Windows\SysWOW64\hdwwrc.exe
  C:\Windows\system32\hdwwrc.exe 452 "C:\Windows\SysWOW64\nffjus.exe"
  2⤵
  PID:2052

C:\Windows\SysWOW64\ozxzfz.exe
C:\Windows\system32\ozxzfz.exe 452 "C:\Windows\SysWOW64\arghrs.exe"
1⤵
PID:1552
- C:\Windows\SysWOW64\qalfcc.exe
  C:\Windows\system32\qalfcc.exe 452 "C:\Windows\SysWOW64\ozxzfz.exe"
  2⤵
  PID:1096

C:\Windows\SysWOW64\qalfcc.exe
C:\Windows\system32\qalfcc.exe 452 "C:\Windows\SysWOW64\ozxzfz.exe"
1⤵
PID:2184
- C:\Windows\SysWOW64\nqtpxw.exe
  C:\Windows\system32\nqtpxw.exe 452 "C:\Windows\SysWOW64\qalfcc.exe"
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\nqtpxw.exe
    C:\Windows\system32\nqtpxw.exe 452 "C:\Windows\SysWOW64\qalfcc.exe"
    3⤵
    PID:2724
  - - C:\Windows\SysWOW64\croasn.exe
      C:\Windows\system32\croasn.exe 452 "C:\Windows\SysWOW64\nqtpxw.exe"
      4⤵
      PID:2540

C:\Windows\SysWOW64\ykhgqk.exe
C:\Windows\system32\ykhgqk.exe 452 "C:\Windows\SysWOW64\croasn.exe"
1⤵
PID:1232
- C:\Windows\SysWOW64\uhdqrn.exe
  C:\Windows\system32\uhdqrn.exe 452 "C:\Windows\SysWOW64\ykhgqk.exe"
  2⤵
  PID:2704

C:\Windows\SysWOW64\uhdqrn.exe
C:\Windows\system32\uhdqrn.exe 452 "C:\Windows\SysWOW64\ykhgqk.exe"
1⤵
PID:1756
- C:\Windows\SysWOW64\upcgci.exe
  C:\Windows\system32\upcgci.exe 452 "C:\Windows\SysWOW64\uhdqrn.exe"
  2⤵
  PID:1596
- - C:\Windows\SysWOW64\upcgci.exe
    C:\Windows\system32\upcgci.exe 452 "C:\Windows\SysWOW64\uhdqrn.exe"
    3⤵
    PID:320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\abkkzo.exe

Filesize
252KB

MD5
d38f9ec896ebe5f7189490450e85663c

SHA1
544cb9a3246213ae15f85771af028214df7a0605

SHA256
4cee965806fd0f9d130ef15815804d0ffb3a2acd728d4efac1fb176cf7107fa2

SHA512
7f8710b2b38eab76ea05e3b224bf36089dcb14f0cb72dc6ff4ace1bde019640c054e7c55a5ea087812b25a618e6cdb553acaab978d69d92c9ce40247edfa8c69

Download Submit
C:\Windows\SysWOW64\abkkzo.exe

Filesize
104KB

MD5
864f08b4c79fea41afa2b43517454688

SHA1
f0a0e1316f945c25ffa095c57043d0d180f9ecf3

SHA256
6e7e5924854fe70394deaafa8df94ddc304b1744e491f051aa7624260fea7ed3

SHA512
50d2a21db268ae970318bed3f359334847fbe8c58847d6003f68438b0ab7053e42423a728f4f0741eb6f81e8c65490f9da9cd80febdbd73e39242cefafb18adf

Download Submit
C:\Windows\SysWOW64\abkkzo.exe

Filesize
29KB

MD5
923e901ff86873422bd4631cc71a91fa

SHA1
00ac617087a8aab5828dbcf151fc37ad816e5fa2

SHA256
e4b44f76b7846b5bcfd42d87c8c28b6b115b63028a6cfe7173ea2b40be6c5af3

SHA512
eb99870cf19d92c63059f10e27b254862d3e91ae6f89126fc03725912e5341f1c5f6e14831fdc17babdbaed2e7c257a68b48f6a07987a339a980914bd546d33b

Download Submit
C:\Windows\SysWOW64\bljiez.exe

Filesize
153KB

MD5
c2028a4d3d860cd954408cfeac5e0a6a

SHA1
b14188cf8f6ff825f8c9e6a161b9b7926fb5dbcc

SHA256
6974dc8304adec1db567f5929f8723066503111b75169b97cc2733d48080c727

SHA512
b769eb6f95c9f6551a916740785cd6162b22bd54800d3e44178d602cce7eb7c392a2c1f9ffbe3fd4fd54d5b55f5dc965c822dad3cef814e599eba2abdb39ee11

Download Submit
C:\Windows\SysWOW64\bljiez.exe

Filesize
10KB

MD5
9d569d25c41f096daaeb78b9e67f9a92

SHA1
466cbd2cd86208f72c903ba92b9b52c946abe6bb

SHA256
9d96f510702895fea799ae68f052393c943ef3f78a345ec4777fa539b64a0028

SHA512
a09d85e5230ff6b6e83b1f9a7ede2b78c56d9efa43eebc5d33bf1e1e3df5458d3d8de5d715a41a9bf02f24f6b0244be83e3764c7a37eb56eda8f9e55d88ca63b

Download Submit
C:\Windows\SysWOW64\dwbqqi.exe

Filesize
74KB

MD5
b432421b7b43e055867faafaea192f02

SHA1
379b15fc194cb7be0bf9824fe4d1f214a1eb48b8

SHA256
d553979e5cf4b05d3e2e5ce8e9d52ada824768c4949d0a0850590b9608b244dd

SHA512
10c732050f901ae8dfadd6c8aa75d454f9b71cdd1ec4a67b93142d47cc5a4bb0713dbf5df075d2b02877d4eb60259659f123b360d5d5d8a4572864ae68d30751

Download Submit
C:\Windows\SysWOW64\dwbqqi.exe

Filesize
49KB

MD5
40087204439155622b8cdd7b643c465a

SHA1
c1a8319ebcea9ac85f24c9de7e9bc35d45898345

SHA256
9cedccd07e83aacd4db27638c2527f86b251e402e0b0965547dee5480bb09800

SHA512
dcd51c980ae4e00b3db2699f29e28a6682f8bb4227d45b4f68d874f365330ca46bc2a11c3655acad35b9902b09503390079f3227e38a321620263521f6985923

Download Submit
C:\Windows\SysWOW64\dwbqqi.exe

Filesize
40KB

MD5
6a23c7581bbf53281657af079138f3dd

SHA1
66a36b205f5a745d4631277ae512d9ecf8474082

SHA256
bda5ec2ad1b95bee37f4932b0244cc7c0119b3cc21cc8e7f4cec16ad8671038f

SHA512
ccce80cd826e1675b241e9fd617985171f5a2f77948ff7652c4ee1b4330aaa73ceeef21242e61e5cb92c3f89a701f73647734fe23e93f50b30cf19cd43451042

Download Submit
C:\Windows\SysWOW64\fdbxjg.exe

Filesize
47KB

MD5
6e5f8efe9e63c04ae3a663f31905127c

SHA1
1b596a11b22891b06061abd810fef53d8d08167e

SHA256
3a9a5ee4be5f265824f8c4c62d21c89cf20beae37cb78cd3945e234a83dcd52b

SHA512
dfa9e473cded8cfa3fb5d4b7897dee775a2c6608989699d6f8665043217ed396117dd296825df50832f38d687273f9f9514b7e1724241666729e9e2c049724ae

Download Submit
C:\Windows\SysWOW64\fdbxjg.exe

Filesize
41KB

MD5
decbf177cd2b919d716f2a1110c10b55

SHA1
39d0fda02f7b2b8874f78aeb6d0e7ca2b217d93d

SHA256
b785b4b1b77b8e46b579ed5b9955a2e9151e76bd30aad4f790167f51fca6df0c

SHA512
63479deb964b56855f19d6334f2d353ace0510cd96ee37ddba96499f94df433d07ffc5d40e9c41d45920bd01dfdca50d10f8a3e55c3404f9e349722bf6ca0805

Download Submit
C:\Windows\SysWOW64\fdbxjg.exe

Filesize
33KB

MD5
de232a98fe8cc2505b762b91a19a5804

SHA1
f3aae1304b05cf605f75c6fcf4cb43c756ccca6f

SHA256
d1eebccfa2a9dae95c3d77730ae654b0ca89cbb87e1753aab7f0ddaa3da3e8a4

SHA512
cbb54f36df8b5994af3245a9271dd3add1789988a4e4ee4e0935443cea8c45d3e918d8aab5eeb9f002db6c69d23924c0b8579aa25561373948acf567f2b5789e

Download Submit
C:\Windows\SysWOW64\gduhwq.exe

Filesize
143KB

MD5
b2cf6af6d4c87dcaccfec1993451c144

SHA1
e4c191ffe526e5144432655fedee9c30ed5fa689

SHA256
5af5295b20387e76eaa27864c51ef3e5d8c2328571aec2813d0549415b6be22c

SHA512
d6791a9935eac890eca2582f3d1653b96b8d16ea5b99f248e5a457a3e8154ebfacfd9e930f54d20d3dad202321cb3ea07c22bb662d2e9f961c3c7df53bf3e538

Download Submit
C:\Windows\SysWOW64\gduhwq.exe

Filesize
38KB

MD5
5d8caaaf40ae9538137938a3e6774b18

SHA1
cdeb552a39b26c9813aa8e40e1f75eeaa67ac14c

SHA256
b8cf894d9cfcec32008a5521f097f80c6b493fbdec7da4b5213ba9e4f86ea8c6

SHA512
70e19c047b549c687d3eb1f6c0fe37df6c7d4cd690debc27c3d3877cb4f0f8164d8511979d9bcb95df489f431e630fc4feedba3c85a7adb5868243a294d0c99a

Download Submit
C:\Windows\SysWOW64\gduhwq.exe

Filesize
13KB

MD5
17018a17a71f92da37ace34505b1f75e

SHA1
deb61753ab7c7db1588a75327987845121145e31

SHA256
a6d73f731df4e2b6fab1a6e0bc141cfb7bf95d963fc92f6b5ba52927b6db7496

SHA512
e9cb018f08997e48a3c9a7e0b8830401fd07c8cd225e8e990638a3de0c366dff0b27424dd7a2244590e6289654d46e16eda5dda2356a51ddf2b119d4ccda47fe

Download Submit
C:\Windows\SysWOW64\gduhwq.exe

Filesize
92KB

MD5
5c148ad1f2faf34747d5b8efcd3ffb7a

SHA1
05ca6c97b640ba4c17721160bf59a55dff0ab920

SHA256
e2bea2b938e78d59ef6ba8a823c805f50ae0b746be68c71b260a06fe92d6aaf3

SHA512
4bb6f340e545cc44d23f8455fb4c020eb752ad770b79cbb6e165e9ee80cb7b62adcf73c826b2f793140ab9a8ab1663052f12e4ae9ad45a57f95d5d2527f04621

Download Submit
C:\Windows\SysWOW64\nclyic.exe

Filesize
64KB

MD5
187c1997ceed81966d4ddd1107ca1d6f

SHA1
a8990fa1b3c53a7c4c59c08b1d32167d3056b28f

SHA256
d4be97a5be40f08f173e0be1c4d3312654d1e81ac7a4ff62cb4b41f3d54a85b5

SHA512
7f6482df2462dbafa6300a6b417e74dcfff0feea369ea54b7984cf7966e194df4f3d4a0f1d3d7b47829a39428bfe1f4defc92d6b988371f6039c640e886af8e9

Download Submit
C:\Windows\SysWOW64\nclyic.exe

Filesize
90KB

MD5
2c1f6d2de398042ca3d99d6059bca0e1

SHA1
e495398dde4fe2d93d063c3ced2aeae48c9b13d1

SHA256
8a2d2c39202c8af3432c8ff71f07a62d42a4a8f0024ae3d3274bcb66320ff6fe

SHA512
21693af917e1e0b0fed1aac4d029ee4d0eaa04e054d17e9dfac38cb629363e194869b89490bd938a80cd72a3102009fec74405dc9ef8454337a24da8bd7116a1

Download Submit
C:\Windows\SysWOW64\nclyic.exe

Filesize
21KB

MD5
0431b61572a0d51ced232db730402072

SHA1
30f442f33d90da72d0368b5aab5efb7ded0c0127

SHA256
13fd3f3a4dd5389ef95d3c7eb069ea2ec0b256fdd1992ed6194522a8333bc0c7

SHA512
bf981ef7cbd314d4ffee9c14f7ca154d64d66cda266fc529474d856b8d0c9c386ccf314a9faccc2221a5c488be446cb83efd5dde49c8ff27ed686330010d018c

Download Submit
C:\Windows\SysWOW64\pzuira.exe

Filesize
84KB

MD5
1f3db31e41b4e2b1d41391323d79a23c

SHA1
adfd01f3a096bb6ed6ed1e462ba71c386becf202

SHA256
34d4c918467146fbb9fee9ae77b72634144c349c419515601dbcbc2025d2bad4

SHA512
ce84018797a372592a3c16d41c3efd0ca9be07f554bdcb9d678569ca907c4965c643c13f46afc89643eb66bd6860e0a5d2c542e57d1cca4f418b653a07215f18

Download Submit
C:\Windows\SysWOW64\pzuira.exe

Filesize
20KB

MD5
088ee20a05f360b898622774b6eb3405

SHA1
0c8ccc1644bfb644b00c40a273e68765babbfa28

SHA256
642682b1502418a87c662560436ce924611ea2fc6ab377ca05579f3d0790aa1c

SHA512
db21787ec30baffc1e58fab7e5ff2b06755d8acd1d08d676b9346343b15508e64f0061b406526c2425fd0375b31512c33e59564acd2a50e1cd92aa158ac3dd43

Download Submit
C:\Windows\SysWOW64\pzuira.exe

Filesize
20KB

MD5
2a3458858a40cace3e3a605dbfab1e33

SHA1
c574fc807fc40bc5e1d1ca6480962165e03fbb4a

SHA256
2e47482656e10da8f20377f192e64e16dc9eaa5be092eb946358ee4a20c44eb8

SHA512
bfb49900b9f3a263daeb67eace66719074ae118277aed02a9ad195f10df309dc689cc7b8ee6f167c66fd1daf38a9da36e111f4471cd8fa700e3eda00835a9033

Download Submit
C:\Windows\SysWOW64\temsms.exe

Filesize
112KB

MD5
56fc4ed36bd3d224936ee4244e2143e6

SHA1
09d2abe7675e36150be55a7881e6c701f8eabea4

SHA256
18132df15856c22f8b1fecd4f8d62c1b68188ce2eff37b9fabe6c5f7de672ed2

SHA512
39a22a46ac6bb6758f753a2eec708bd35bf1cb03733171303c04a80a0f5477e10ce39f4f4c781c3d8878591728ca9094875ede291d3b9ecfde657f28f5d67945

Download Submit
C:\Windows\SysWOW64\temsms.exe

Filesize
35KB

MD5
7bf80dd6734e9773c878f463171304e1

SHA1
dd7c8b0d18dcbfee18652ff3505bc8e2f846620e

SHA256
0bc7180b0e4af849b41706fa63fc6c0303f37afd965344bb99062c662d5af0ab

SHA512
2f0570f4be4ffc6bc331c2f014555a49084991a94809da838315343f26f8c2cda20c0be6689d541632df6e0ea8bfe0ba600d3aa893fdd0a41c43eca06eca4d07

Download Submit
C:\Windows\SysWOW64\temsms.exe

Filesize
11KB

MD5
7141b32b56bff6941b76407c784419e7

SHA1
a3aabaf0343214dcfa26e54156879ddc4495791d

SHA256
90f43fc2b246b7bbe805ad73bbd5b3346df6564bf1398c7d5308d97c9dca0857

SHA512
92a7cedc0d45bcd864d2ffe53906f3f65f187c0909b8b360739361dfd725149016f857a7080ce0ded90f984b7f48ee6a6e5ca9006db43917f1c6c5c1a699f94c

Download Submit
C:\Windows\SysWOW64\uiafcl.exe

Filesize
138KB

MD5
71f334aa6991f566d34dacd84b8d4123

SHA1
5d0b967e106b65c61e514045def411792632e560

SHA256
3533db095042154d32e110c712197bd8e09c95ed92c25ced9ffc37193ac83a5d

SHA512
d866cb3a38ecf4475f75912ff550ebc410cdb42599f47c9e7fd1b1e0fe203665aeead95d1d57acde0c7c73b55b89c222d21e46075c520ef5c2e3c79d864a01bc

Download Submit
C:\Windows\SysWOW64\uiafcl.exe

Filesize
94KB

MD5
62ce62dbfb87f1276af86f9773854100

SHA1
e9609ee87cc488800f2678afaa7d0087a7396a85

SHA256
1eef0a6e74645d24ba869b2816d5389f8dc039134365f3e891e5f806f831722e

SHA512
e474cc692c2e9c2952b44cc85f412dc25aee7bacfcfd9efa87bfddc6ad46f1e14e19e5d18b654daeb2125626dacc4e5421dc06928598b116892c10d6e2ce9d51

Download Submit
\Windows\SysWOW64\abkkzo.exe

Filesize
259KB

MD5
415a4a720d14eb4e663162d391aca0e9

SHA1
9ea33fa50565eec715258bf2920e44ca40290674

SHA256
b5b5b2f2f3a57a749cdc2ef2b0f846b7e09e676652e8910cefc40038d35e5b68

SHA512
e54e34c4605963011594bae4c0fbcbdf5dc24d703bfaa47e6daa71316f644f57b8e41171390a726e8cdd64c2f55fdb63dca615124b014db9543539efbd693115

Download Submit
\Windows\SysWOW64\abkkzo.exe

Filesize
300KB

MD5
99ccfad548799310fa605a0fe848bbec

SHA1
4517484994c199237ba854b0d56fa9075c0f1e48

SHA256
0428f8fdeecf00b626bd9c744fe2459ae7ae8ad087148412e03c1d476f25a4b3

SHA512
6b07ccfd8e939197557b924e0e28f6bac1d4e7dc11edc167674aeb30a8fcd515a7ad7934a533c2c12c3cb66fbabea98bea5b0fddada95c8fe6c510b4330869e2

Download Submit
\Windows\SysWOW64\abkkzo.exe

Filesize
151KB

MD5
ef0e3fe4db6ebb6da3838dfe3c5628e0

SHA1
ff7394433413ad5f0ffb7139f3b158d5f4b814a9

SHA256
3218c674a044566d9db81961babd040b599a3b0fa958c874ad4f35849d738bcd

SHA512
204ae52c64e5762fda64dda2621e4b53c66a3e93974b0799d2ef5a4a5bf32bc6684ae0048d104cb9b240e298c525fcb61f9b51b78abdd508961158999a1ee6c9

Download Submit
\Windows\SysWOW64\abkkzo.exe

Filesize
118KB

MD5
44664541e106454ffa00fa9a423cbc76

SHA1
1cf4f7bca13565f157691141f6c191c3f77d3972

SHA256
ecfe05f992ff6eaf50854b8d2f10489cafa2b7d31956661500458cdcacdbafb2

SHA512
9147fcd238cc43b9a6bfc55f607623e66bd5f00edb2500d889001ea1eabed550692f3ee5d01c5c2362c18811ae5fc419d6f4f3664cdc3394772d31364e24c55e

Download Submit
\Windows\SysWOW64\bljiez.exe

Filesize
1KB

MD5
016a82f6b3002f0cf9664eb371054e34

SHA1
30074232c7493bde7094263561324497dc004676

SHA256
b1f0a4c999797898bd8f16dacf96e770c9f2f4b58a7929c03d1263a9c2b80c83

SHA512
ddd0938c9cec835e0a4ea1669f2e7bad7c9ce6dd374e86f72bc80c69d5edb98528663b96accad0ad787076a19a18a60621ffb0954c7a10be5288a8deacc5c4b0

Download Submit
\Windows\SysWOW64\bljiez.exe

Filesize
268KB

MD5
167d4b04bd59c193ff8da57fd8b42c51

SHA1
dff5adea53519377acb2a4d5b323ef8028eed610

SHA256
3eef2b20946bb2ae1827efa7b2814b6f0153c571b7fbe2e07478d7ea3ca4c0f2

SHA512
16cf0239f08fc662fb30366b175244242151213a88c3a4c3bf1a83b478feabed480c0d5302fa99429e48a40a979d519980d9c2b76c0e0222bca6db0fd8f2d87d

Download Submit
\Windows\SysWOW64\bljiez.exe

Filesize
37KB

MD5
f8b6437b8bdaf69999412ce3eb26f24b

SHA1
2dab75e5d2af187e3ce92e1d157d5d108b64c819

SHA256
cef1495d176cabdab987d0b8ee0b8b32f8eb09999af766d5e1a643ae86509aed

SHA512
d108ddc0c1bf491c0c63b8394a0ebd552b3df0b862bb011b3b156616ce9f604c5d73dd9ee742c20c3c318681a332acc526978fb211e52d7f5a69c6c434bc2a89

Download Submit
\Windows\SysWOW64\dwbqqi.exe

Filesize
101KB

MD5
c8b83749ca92589ead432fb01b500e8f

SHA1
16ebf72d685cfa1650e0e17d5e599dc1560daf08

SHA256
334c38f551ca3ffb8c8a6e385fcea60bf18c2f11307c4dd8cafb6b707040cd8c

SHA512
41aaaacdf7936ad8f0a011350d1049133aad86d4759d2fad9e4220e046ee53e85029a4aa3eeb2130f6ad72e4a32deb69675f1d64a22fff7fe974f8fe8d001b68

Download Submit
\Windows\SysWOW64\dwbqqi.exe

Filesize
14KB

MD5
445d264eeef6e2408382cd71f58e807d

SHA1
abd0b956c9e42001e19d895ccfefbd33101c7429

SHA256
008125fe147c787022e42e8ee36bdc1ac6558180d86327329ce00d551c90c991

SHA512
023e17feb5380de63f7520346df2e314bb51ac2bc910bdbba27ed8516ab0b2a84150d6dc33139cc8b7532362fd61161de55b81c588bfff0a5ef107253df0aa60

Download Submit
\Windows\SysWOW64\dwbqqi.exe

Filesize
5KB

MD5
dcdba8badd4f73067ab819a20439481a

SHA1
51978fc0170a456204f1f86c0e4b0228fcac59aa

SHA256
69659856b9ff9285a5d531f9048a4ad60cac569593fb3e5e43a85c818e972812

SHA512
6a27ac568981e12e365788bdceb3b6751b89b4c42b88f56a42d238638e3b8e6b27ff26ae66ec9122ee78255d1822547acf293b6db39579a86551a1ba8ce23b7d

Download Submit
\Windows\SysWOW64\fdbxjg.exe

Filesize
111KB

MD5
0ae4d1ff09d9e3c417e2105d76568929

SHA1
550e308d90e22e8055c17c4456338cdb9d5c2ab5

SHA256
6659e390062e9b0b4aaa5111846379460395b8b1723caa0d63251479d3d638c5

SHA512
908bcb9def307a4ac87c5407c9168e51055c00e579c55642fe3b162e987a2051d40c7d3a649dd9c1b0f716f9315fc0d8eeed928f1c1fce5251f8660aab9ef003

Download Submit
\Windows\SysWOW64\fdbxjg.exe

Filesize
202KB

MD5
4e1c6e7ac6bb3f39778d096f63c6f2a6

SHA1
56b03d7013bb5b9fccd39d4bf6f217bdc6d150bd

SHA256
6e4fab18eaecda175c48402a6d4ece9574713ddc31bf4099213a0cda5474cc09

SHA512
c71c73905c68a7a85be0a94ce9247e93bba0f2a85d3ea48a57154925d3a01cb774e99d21e60a0c88ad2e1f0b297afe9c3cdbba64f5e8f8a8fc15d8fbda33fbe8

Download Submit
\Windows\SysWOW64\fdbxjg.exe

Filesize
49KB

MD5
3f1ca0f482bdd3ad9213dd5ab52913c7

SHA1
1b2b7f251d05b8a5785eec0d139984c8e67d67e3

SHA256
c3a219b0cf465d30a9947c69df4e7868e5a83659f890e389ab9c89ae1aa9a64b

SHA512
f4c04c66659d2fc680aa1a66b42056b77e005ea84d48c839557bceee25bbac4f3f4945fb53bcb97137b9c4672c1af6bdf1be2b5052f5f9ea30b0cf103bc7834e

Download Submit
\Windows\SysWOW64\fdbxjg.exe

Filesize
60KB

MD5
5ef24eb190b91eeaeb6d792ae3af26dd

SHA1
7a67ac5eba7179d3e504dc6d9cfdf9b57edfeaf6

SHA256
a4cbc3b5f014edf7ce1bfb5fe5f78358182b89f871d92f1dadb7dd2048d7679b

SHA512
deb6dccd7cd46948b20526fed80c5cea08fd07a4b48acb65cd972de933fb8ec09f0e070646c981d7521a27c00c8670d51133f31f4b2b5c1748dd1b6a795c69b4

Download Submit
\Windows\SysWOW64\gduhwq.exe

Filesize
17KB

MD5
5b224baecaa8d154a8371319da29a9e8

SHA1
9ec38fc4514bdd4237a91a952b6ae2b11e64731b

SHA256
b7aa9f1410decc58ed29e2bae13cce430fec5614e67bd691ede0dc5c1ab71013

SHA512
e1f14ab6fa9fa770dd9ce358baf1a8940c8e45eac436878feb711825103ea945124d618142a6764045bfb0183e17d1bc004652cb0cf01912c2914cca3289e49c

Download Submit
\Windows\SysWOW64\gduhwq.exe

Filesize
291KB

MD5
8020895863d835ad0c28d87e76e832b0

SHA1
c8666ecaeac3b82d89385dd37e332be39777747a

SHA256
8f06e9c121370ab4464aa979731821fd1cfaf716a513d9e4f9c6298ead5e799f

SHA512
f93db56cd4eb6db4e8a1f4bf6347c25c418c0556c945c12e684e000472ea1fa07cfae995a4148815a61992502c1cf76d20669134dfe00e621d6dd33c0359de60

Download Submit
\Windows\SysWOW64\gduhwq.exe

Filesize
236KB

MD5
68655e354ede610547d6a86842b90083

SHA1
5b86cbd4c9b23ac84ef1d01831253107569586fe

SHA256
77c606a885293c48e35cd8457477311d2c88500a9c9eef4af7c9b0fd8c478ddd

SHA512
bb38205d3a763d808f634420ba4465bb46504d5e54f66bf617918cf231aa747ed4ff2e96b1413f9038fadeb6795c94bcd5ce5a40ded550d603b49339972c1d2b

Download Submit
\Windows\SysWOW64\gduhwq.exe

Filesize
18KB

MD5
99269f5a6f80f2e9865e156512f499d5

SHA1
2c8ae2095358e73a0062d28a4a330cebb51f53e3

SHA256
54c1463d065013267674a74739584560b5e361e16955b298d2e5ca3b7486fb10

SHA512
def3d304e1bc0fd1e59808dbe430ff6564be3ce7efa40c2ba3107efad08daea4d3a4c9240c669e172fea9d49ff3376e3408bff3bc50766232e51343b9e1495b4

Download Submit
\Windows\SysWOW64\kskgbj.exe

Filesize
28KB

MD5
5d92551fdcddc13c45b78b0b4de3fa96

SHA1
3b1c5434bca422735c70f7b98c0b3dd4987779b3

SHA256
a608707b9fd4370e97f9d4f81c4af47f32f527346f486356db575fc2cfc23e44

SHA512
08e05a5faeb5f307f5ca9e4ccd7cf7342385559cb2b3446ea1729d84f21f28a0117fe54ad5866b1b074cec93e39cd44f58edf799dd39c8cbc0c10ff1f4ce1a76

Download Submit
\Windows\SysWOW64\nclyic.exe

Filesize
267KB

MD5
58bb904ff68b2919d44e84923055ee73

SHA1
42fb10fee778b257351d5fd584c8b3a4bfbe65e0

SHA256
58dac37b7b088fb6daf6e33673f6168b11a9c8987b902e35af2a7e484b661969

SHA512
401da8d6a88bdd887cbfee08be40021ba5932bee3e003a3b66d9c19dc616b810fa59c7d9b882aa7cd3470332f4090bb99fcd28cd69b7ed188d9e194b01afdf27

Download Submit
\Windows\SysWOW64\nclyic.exe

Filesize
81KB

MD5
590948b98c264b59fe81dedf892b1101

SHA1
fe6a95d08186ebf1ed3a58d0368ef6f4f8c06ef2

SHA256
21f44c8588e03630f76818a1eac848a88c4254491ce7add1721d5b10befd6894

SHA512
89d57eb23d145e904cf3b745e3cad76e2f24b7aa7f44c60f465ecf295dbdd326dafc97c9f049a330c124f4f20d475fb0406e6a9b0f505d4a980837135a6801fe

Download Submit
\Windows\SysWOW64\nclyic.exe

Filesize
92KB

MD5
93cbedfa696ab58203c0ca24658e2e1e

SHA1
402538d9e705ced2cc1d56b4bb7ee23a4d042b9c

SHA256
6e217c7a5417a7daf73c8dc2f305771db401f090992d34d419737cede1052d05

SHA512
f102b27d48e55842e9c9dd9945865cc40f1c8242d29ac067b8b3ad7e19ebea09be44da83e38c6ff8ee20eea9f3a1185b6aadfb304b0a668aa936028959c2fd3d

Download Submit
\Windows\SysWOW64\nclyic.exe

Filesize
37KB

MD5
45812ff87bc632c1cd967dad0b9c088a

SHA1
60f20140f71c794e3ed6c4b279476fb4d54eaf5d

SHA256
1a7d6830a740c76fccaa28bf4542db076dd806bd6c6664306f19bd8663f8ddd0

SHA512
63151896c3a43ce1f58bafed0889b5a73dd7554afca8351aa269f9d349ac75e8e0f31b16a6fdda63decddc878c7b1966533c5e3e665c9c0f319f8a8f02a1df7d

Download Submit
\Windows\SysWOW64\pzuira.exe

Filesize
153KB

MD5
60fa7dcb7a0d003b776ec13464e95911

SHA1
1763c9044ea0a2caab16d597966e95bb0ad280d3

SHA256
6aabaf17afd9b7f205a2b94d0759c9d7a8ab5034ccde9e65d868182fa2f58795

SHA512
1b3d261ab758496d6eedfa113269c24287ff3e9cb8ac5dd2dbefa7eefca8db9c4bf7fe10b747c5fa04eb972caee5d255c08ed15a1c4fdeb9b368492b52ff32a2

Download Submit
\Windows\SysWOW64\pzuira.exe

Filesize
112KB

MD5
77b5f12ab7af4cdc50baf897144d2181

SHA1
b4b533ec3add2bc8f287fb1e768ee728a3c1cd90

SHA256
b76acb86aaddd6c78eb74cc0c6a10cee3c8c5629215fee22c4e570edd678b12d

SHA512
116e59a4d2862ef14eee4d9eee21df92ac349d93458a627232dbfd9f2f4fc88ce6431c5c376630f4569cc6b12b90a82ca0594e6373ed54bfd7a0cee9ec6e5c88

Download Submit
\Windows\SysWOW64\pzuira.exe

Filesize
5KB

MD5
baff3ffb892b603b555a394e6f1b0bd5

SHA1
7ef306eb7d95390e4ec2ba2320922f3e2f0880fb

SHA256
288404548defb635afc45b8c6ca82396d5ac5624fe099b3c551977c0e3d3b9d7

SHA512
3c39ef5e01c57d1e1f785189be472d5a903518f05deca2f89aee1d10a83eaa524018e89da231eb2e68e6fa515367ac8b16308d26e24c840517a78e2df7cb04bd

Download Submit
\Windows\SysWOW64\pzuira.exe

Filesize
39KB

MD5
82894d79917cc2f3bf026450aeac1954

SHA1
6e28dc22b92f15403f8d66a09887966225c46e20

SHA256
44d9f12906cd87bb713ff0a484e634ad9f4b5f90cf975e2fa4defa3686335b1c

SHA512
01e89d31a812d44ee5cd80fc6d0614b29e065a11384e1e27cbed6b8e7aace38316e8da0670cabda6d4c8f83bcf6c5897c40fae78c1e81c1d3da77e8b57ab6a7a

Download Submit
\Windows\SysWOW64\temsms.exe

Filesize
181KB

MD5
98073c41177fa2f23ba3e279d1e0fb95

SHA1
698a2159bbd9e00ffc1d47e16cedeaefa81360cf

SHA256
2da3b55827f8b855e27f73589d76c90c671cff35507cb788eeacb92d1de40f40

SHA512
4af45a24782371fd8da30829f6c128d04553b770cb4973e79c596c42241e2f4e68607fed5c56990c3cd3881c5aa72866c8d36250ea903589a3e237ef9142f6b9

Download Submit
\Windows\SysWOW64\temsms.exe

Filesize
169KB

MD5
16f5c4ff24d8419ff4d12e3736298fd9

SHA1
a7db1723ae85071b7e55a46e5ab1e9a3e4b936cc

SHA256
236d9e3311f0c04f913451472b089765574c098c90c88cc6aad8cec948b05fc2

SHA512
9720e3e00f74ef3f3faed5cef19ac12cc6bb3db38d44ffc8ee41fc7b8fb723446287aa0331c49bfaf2f49f0ad9f8a596f9111175aeae8db4052b283467723c46

Download Submit
\Windows\SysWOW64\uiafcl.exe

Filesize
27KB

MD5
4d8231e4a7950d2c0c7ff34854985675

SHA1
3a106e522d0efd853ab1716648285a88931df2d0

SHA256
a6cd2edf8f6f9212b37e9539ddb325cebeab752ef276931051e3c23d340e482a

SHA512
5de330fba2ff00938ef0a1dd01c8eca84f4b493d7d4fbd65c1df12ada2b40d17c5d6c68deb5a39800b5f1b3ba33d241f004dd9464cee0ec50b3cdb91e597e926

Download Submit
\Windows\SysWOW64\uiafcl.exe

Filesize
152KB

MD5
2008b30067c038a2bf82dfa4874302ff

SHA1
b80a3fa2670b9afba0b80bb5f40301d3071b95ef

SHA256
b7b223f54b6c1b917ca838660cd8f09565895693de8e3c9ed7a597cc1debc7a0

SHA512
03eebefce318c926d1f8d502be9e21265e6d8a50ba9b18abdda952e6a4b55552d229a35d7f480f3ab7411ae44772fd6b6e93002df8b9f5e6a6193d790528ee6e

Download Submit
\Windows\SysWOW64\uiafcl.exe

Filesize
135KB

MD5
cfb62ecfcd0bbccf776a26e24610b837

SHA1
fb0dd584287da76313c78199e920fe4665422ebd

SHA256
09ee23b734f53859a5d25a1834d9afe7778c5d6d939aeadaf3794c1df99522cf

SHA512
b9c40891792187ac8a38a0473fe40c1696ab2150df86c9895d7d7fbbd92b5f2314e0bddf09933caf5b6db37009944573b39006e0fa1a1e6c46c6ae6d60abb9ce

Download Submit
\Windows\SysWOW64\uiafcl.exe

Filesize
87KB

MD5
12c3763edf7ca450114991737a75a409

SHA1
e3d138e3fc8390e6c21304bb94bc3a5058b4ce54

SHA256
5f6da5f53da0c7da6a1646149690cb09165feb4f578d041fc900cfcff995b935

SHA512
f784f8ad7a1ee37af80bddc61ff51e0d9beb00becaae9e2b74ebac2a29f78de7d2e3cd04ecd30548902ce41fd2fc71b51895e9af4f13bdafc344975e435b133f

Download Submit
memory/292-839-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/564-350-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/564-380-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/780-99-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/780-135-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1092-747-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1092-776-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1492-280-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1492-309-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1528-453-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1528-421-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1532-653-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1532-685-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1656-630-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1656-662-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1692-727-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1692-701-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1732-188-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1732-163-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1832-467-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1832-496-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1888-247-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1888-221-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2044-848-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2044-817-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2080-724-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2080-750-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2112-793-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2112-821-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2128-518-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2128-490-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2168-770-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2168-802-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2188-426-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2188-398-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2400-285-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2400-253-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2404-2-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2404-8-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2404-13-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2404-0-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2404-4-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2404-9-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2404-10-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2404-42-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2404-12-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2404-6-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2416-304-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2416-332-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2580-72-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2580-100-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2596-610-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2596-639-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2668-513-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2668-545-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2708-41-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2708-66-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2756-559-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2756-588-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2816-568-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2816-536-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2840-676-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2840-710-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2884-582-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2884-609-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2900-403-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2900-376-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2936-327-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2936-359-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3020-128-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3020-159-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3040-444-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3040-476-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3044-193-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3044-227-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download