092f7134ed1b22ad62b9201bed001b1e475a1567281676b40839559ddbfe05cc

Analysis

max time kernel
92s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-03-2024 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

092f7134ed1b22ad62b9201bed001b1e475a1567281676b40839559ddbfe05cc.exe
Size

669KB
MD5

1def50f9936fa7be3fa1c3361d6b44d4
SHA1

aea808d334bef91c5030217b474115560ad22d0c
SHA256

092f7134ed1b22ad62b9201bed001b1e475a1567281676b40839559ddbfe05cc
SHA512

70db4ee21366445f71a6c8c1a2d23293c2cceddfd9d1c6f1569ffce1edfe2fb453e4a922b3763b418e92fe224dacc165a670afd34c454bcad750501a5a8fcd07
SSDEEP

12288:VqEAWnIeVKhMpQnqr+cI3a72LXrY6x46UbR/qYglMi:0EAWnzchMpQnqrdX72LbY6x46uR/qYgL

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlfcqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fmmmqnaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbefolao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lhgbomfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imdndbkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nejbaqgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gckcap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcbehbim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gmmome32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pblolb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpmdabfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkoaagmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cejjdlap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paqebike.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Joobdfei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ehcndkaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elepei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enfckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mapgfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ablahjhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ppdbfpaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhdeinhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfmpob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Npmjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ifcpgiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mfhbga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfpled32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ainfpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cgbppknb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdaajd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjkdlall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpdefc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Foqdem32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clhbhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jjakkmpk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kebodc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Epgpajdp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfchjddj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nehekq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iplkje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jblflp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkhdgfen.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmlafk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ghcjedcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Khnfce32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfjmajbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chiblk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnkgbibj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlmdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nfchjddj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hqdkkp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjoeoedo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dqdgop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fifdqhal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abnnnjfh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjehok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogajid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iefnjm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Megldcgd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Elepei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkhidaeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Blbabnbk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Copajm32.exe

Executes dropped EXE 64 IoCs

pid	Process
1000	Joahqn32.exe
3336	Mfhbga32.exe
1728	Onmfimga.exe
3632	Oaplqh32.exe
3620	Aagkhd32.exe
3436	Bgnffj32.exe
3564	Chiblk32.exe
1624	Cpfcfmlp.exe
3428	Enfckp32.exe
2956	Ekcgkb32.exe
4604	Gkaclqkk.exe
3768	Giljfddl.exe
4860	Haaaaeim.exe
3528	Jldbpl32.exe
2928	Mqhfoebo.exe
1444	Nmcpoedn.exe
3476	Njjmni32.exe
4280	Ofgdcipq.exe
1604	Qfmfefni.exe
4092	Amkhmoap.exe
2692	Bfmolc32.exe
2644	Ckggnp32.exe
5040	Dickplko.exe
3204	Eaaiahei.exe
1808	Ejagaj32.exe
1960	Fcneeo32.exe
3104	Fkjfakng.exe
1860	Gggmgk32.exe
3144	Hqdkkp32.exe
4996	Hjmodffo.exe
1984	Hkaeih32.exe
3420	Ieeimlep.exe
4680	Jblflp32.exe
448	Jjgkab32.exe
1348	Jjkdlall.exe
4400	Kocphojh.exe
1048	Odbgdp32.exe
2728	Afeban32.exe
4896	Bppcpc32.exe
3552	Beaecjab.exe
4312	Bbefln32.exe
5140	Bipnihgi.exe
5200	Dpjompqc.exe
5280	Egmjpi32.exe
5340	Gnjhhpgl.exe
5384	Gjcfcakn.exe
5432	Hqddqj32.exe
5484	Hqfqfj32.exe
5528	Igjlibib.exe
5572	Imfdaigj.exe
5612	Iqdmghnp.exe
5664	Icefib32.exe
5716	Inkjfk32.exe
5756	Jjakkmpk.exe
5800	Jnocakfb.exe
5840	Jjfdfl32.exe
5888	Jcoioabf.exe
5940	Kebodc32.exe
5996	Mkdiog32.exe
6048	Nhdicjfp.exe
6100	Ogefqeaj.exe
5188	Dfqdid32.exe
5196	Eoladdeo.exe
5304	Fofdkcmd.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cikkga32.exe	Coegih32.exe
File created	C:\Windows\SysWOW64\Ipimhnjc.dll	Ofgdcipq.exe
File created	C:\Windows\SysWOW64\Hjjmaneh.dll	Afeban32.exe
File opened for modification	C:\Windows\SysWOW64\Mfofjk32.exe	Mlialb32.exe
File created	C:\Windows\SysWOW64\Mgjkkopi.dll	Neaokboj.exe
File created	C:\Windows\SysWOW64\Ncpmjj32.dll	Mqkijnkp.exe
File opened for modification	C:\Windows\SysWOW64\Nieggill.exe	Nnpcjplf.exe
File opened for modification	C:\Windows\SysWOW64\Obgofmjb.exe	Ogajid32.exe
File created	C:\Windows\SysWOW64\Neaokboj.exe	Mpdgbkab.exe
File created	C:\Windows\SysWOW64\Mbkfcabb.exe	Mgebfhcl.exe
File opened for modification	C:\Windows\SysWOW64\Gcpaiq32.exe	Gjgmpkfl.exe
File opened for modification	C:\Windows\SysWOW64\Hfhqkk32.exe	Gbjhelnp.exe
File created	C:\Windows\SysWOW64\Ankpgonc.dll	Fjfnphpf.exe
File opened for modification	C:\Windows\SysWOW64\Lnanadfi.exe	Lhdeinhb.exe
File opened for modification	C:\Windows\SysWOW64\Nildajdg.exe	Nkhdgfen.exe
File opened for modification	C:\Windows\SysWOW64\Qkcackeb.exe	Pjjaci32.exe
File created	C:\Windows\SysWOW64\Aifklc32.dll	Bmhibi32.exe
File created	C:\Windows\SysWOW64\Oioahn32.exe	Onjmjegg.exe
File created	C:\Windows\SysWOW64\Cncnbean.dll	Pblolb32.exe
File created	C:\Windows\SysWOW64\Cpmcffca.dll	Dodjemee.exe
File opened for modification	C:\Windows\SysWOW64\Jaekkfcm.exe	Jgpfmncg.exe
File created	C:\Windows\SysWOW64\Agobcjka.dll	Pijiif32.exe
File opened for modification	C:\Windows\SysWOW64\Dadlmanj.exe	Djihhoao.exe
File created	C:\Windows\SysWOW64\Ehlakjig.exe	Ebbinp32.exe
File created	C:\Windows\SysWOW64\Icefib32.exe	Iqdmghnp.exe
File created	C:\Windows\SysWOW64\Edeanh32.dll	Mlialb32.exe
File created	C:\Windows\SysWOW64\Okbglp32.dll	Apbngn32.exe
File created	C:\Windows\SysWOW64\Oheofn32.dll	Jagqfp32.exe
File created	C:\Windows\SysWOW64\Mbpoop32.exe	Mkegbfgp.exe
File opened for modification	C:\Windows\SysWOW64\Olndnp32.exe	Niiaae32.exe
File created	C:\Windows\SysWOW64\Jhpjbgne.exe	Idpdfija.exe
File created	C:\Windows\SysWOW64\Homcjh32.dll	Mkadam32.exe
File opened for modification	C:\Windows\SysWOW64\Ggldde32.exe	Fakfglhm.exe
File created	C:\Windows\SysWOW64\Ifdgaond.exe	Hoibmmpi.exe
File opened for modification	C:\Windows\SysWOW64\Ifdgaond.exe	Hoibmmpi.exe
File created	C:\Windows\SysWOW64\Ihgqiiph.dll	Impldi32.exe
File opened for modification	C:\Windows\SysWOW64\Coegih32.exe	Bhibgo32.exe
File opened for modification	C:\Windows\SysWOW64\Gjgmpkfl.exe	Gobicbgf.exe
File opened for modification	C:\Windows\SysWOW64\Egmjpi32.exe	Dpjompqc.exe
File opened for modification	C:\Windows\SysWOW64\Nmbhgjoi.exe	Ndhgie32.exe
File created	C:\Windows\SysWOW64\Kblfejda.dll	Onngci32.exe
File created	C:\Windows\SysWOW64\Olndnp32.exe	Niiaae32.exe
File created	C:\Windows\SysWOW64\Geklckkd.exe	Gckcap32.exe
File created	C:\Windows\SysWOW64\Khnfce32.exe	Kkhidaeo.exe
File created	C:\Windows\SysWOW64\Ibillh32.dll	Megldcgd.exe
File created	C:\Windows\SysWOW64\Bcmqin32.exe	Blchmdff.exe
File created	C:\Windows\SysWOW64\Mqkijnkp.exe	Mkoaagmh.exe
File opened for modification	C:\Windows\SysWOW64\Opkfjgmh.exe	Oianmm32.exe
File created	C:\Windows\SysWOW64\Pnigcj32.dll	Gjmmfq32.exe
File created	C:\Windows\SysWOW64\Elkfijgo.dll	Nohicdia.exe
File created	C:\Windows\SysWOW64\Bqpppi32.dll	Ehcndkaa.exe
File created	C:\Windows\SysWOW64\Jkaadebl.exe	Jplmglbf.exe
File created	C:\Windows\SysWOW64\Qgnmff32.dll	Khnfce32.exe
File created	C:\Windows\SysWOW64\Baojkdqb.exe	Blbabnbk.exe
File opened for modification	C:\Windows\SysWOW64\Bhibgo32.exe	Baojkdqb.exe
File created	C:\Windows\SysWOW64\Jpegfm32.exe	Jikojcaa.exe
File opened for modification	C:\Windows\SysWOW64\Jdjfmjhm.exe	Jkaadebl.exe
File created	C:\Windows\SysWOW64\Fhonpi32.exe	Fcbehbim.exe
File opened for modification	C:\Windows\SysWOW64\Gkaclqkk.exe	Ekcgkb32.exe
File created	C:\Windows\SysWOW64\Gjcfcakn.exe	Gnjhhpgl.exe
File opened for modification	C:\Windows\SysWOW64\Dkehlo32.exe	Cmdhnhkp.exe
File created	C:\Windows\SysWOW64\Bedmha32.dll	Plgpjhnf.exe
File created	C:\Windows\SysWOW64\Fdhpoegg.dll	Dcmjpl32.exe
File created	C:\Windows\SysWOW64\Jpmdabfb.exe	Jolhjj32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjgple32.dll"	Lgqhki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fomnhddq.dll"	Chiblk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfmolc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Onngci32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mpdgbkab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pmpfcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mappie32.dll"	Jolhjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fohecgli.dll"	Helkdnaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aafghjbq.dll"	Npfchkop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Elepei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ehlakjig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfkcec32.dll"	Jikojcaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Honohb32.dll"	Kigoeagd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgpilmfi.dll"	Gkaclqkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipimhnjc.dll"	Ofgdcipq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mlialb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pfmdgq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eoapldei.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jjgkab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dqdgop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hjfplo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lhdeinhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hameic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpnkah32.dll"	Nmcpoedn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iqdmghnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgpkkf32.dll"	Lhiodm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Blkkaohc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ehcndkaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hilpobpd.dll"	Joahqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljkoli32.dll"	Phhpic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Najlhn32.dll"	Ablahjhj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cikkga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hkaeih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cpjdiadb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jpmdabfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ennofanf.dll"	Mbkfcabb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bijnlgcd.dll"	Obgofmjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbhndb32.dll"	Djnaco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fcneeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nmbhgjoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qkcackeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fccigg32.dll"	Peaahmcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mbkfcabb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbkhmakf.dll"	Jplmglbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkclkqdm.dll"	Mmbopm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aaocfebe.dll"	Eenflbll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hoglbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ffjdjmpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Apeagd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfllgl32.dll"	Cnndbecl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Apbngn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Blpemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cebllbcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nmlafk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fejegaao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chnnfa32.dll"	Begcjjql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oegicjdd.dll"	Imfdaigj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hlfcqh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bpjkbcbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjjebg32.dll"	Oijqbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mijofaje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nehekq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jpegfm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Joahqn32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 1000	3160	092f7134ed1b22ad62b9201bed001b1e475a1567281676b40839559ddbfe05cc.exe	96
PID 3160 wrote to memory of 1000	3160	092f7134ed1b22ad62b9201bed001b1e475a1567281676b40839559ddbfe05cc.exe	96
PID 3160 wrote to memory of 1000	3160	092f7134ed1b22ad62b9201bed001b1e475a1567281676b40839559ddbfe05cc.exe	96
PID 1000 wrote to memory of 3336	1000	Joahqn32.exe	97
PID 1000 wrote to memory of 3336	1000	Joahqn32.exe	97
PID 1000 wrote to memory of 3336	1000	Joahqn32.exe	97
PID 3336 wrote to memory of 1728	3336	Mfhbga32.exe	99
PID 3336 wrote to memory of 1728	3336	Mfhbga32.exe	99
PID 3336 wrote to memory of 1728	3336	Mfhbga32.exe	99
PID 1728 wrote to memory of 3632	1728	Onmfimga.exe	100
PID 1728 wrote to memory of 3632	1728	Onmfimga.exe	100
PID 1728 wrote to memory of 3632	1728	Onmfimga.exe	100
PID 3632 wrote to memory of 3620	3632	Oaplqh32.exe	101
PID 3632 wrote to memory of 3620	3632	Oaplqh32.exe	101
PID 3632 wrote to memory of 3620	3632	Oaplqh32.exe	101
PID 3620 wrote to memory of 3436	3620	Aagkhd32.exe	102
PID 3620 wrote to memory of 3436	3620	Aagkhd32.exe	102
PID 3620 wrote to memory of 3436	3620	Aagkhd32.exe	102
PID 3436 wrote to memory of 3564	3436	Bgnffj32.exe	103
PID 3436 wrote to memory of 3564	3436	Bgnffj32.exe	103
PID 3436 wrote to memory of 3564	3436	Bgnffj32.exe	103
PID 3564 wrote to memory of 1624	3564	Chiblk32.exe	104
PID 3564 wrote to memory of 1624	3564	Chiblk32.exe	104
PID 3564 wrote to memory of 1624	3564	Chiblk32.exe	104
PID 1624 wrote to memory of 3428	1624	Cpfcfmlp.exe	105
PID 1624 wrote to memory of 3428	1624	Cpfcfmlp.exe	105
PID 1624 wrote to memory of 3428	1624	Cpfcfmlp.exe	105
PID 3428 wrote to memory of 2956	3428	Enfckp32.exe	106
PID 3428 wrote to memory of 2956	3428	Enfckp32.exe	106
PID 3428 wrote to memory of 2956	3428	Enfckp32.exe	106
PID 2956 wrote to memory of 4604	2956	Ekcgkb32.exe	107
PID 2956 wrote to memory of 4604	2956	Ekcgkb32.exe	107
PID 2956 wrote to memory of 4604	2956	Ekcgkb32.exe	107
PID 4604 wrote to memory of 3768	4604	Gkaclqkk.exe	108
PID 4604 wrote to memory of 3768	4604	Gkaclqkk.exe	108
PID 4604 wrote to memory of 3768	4604	Gkaclqkk.exe	108
PID 3768 wrote to memory of 4860	3768	Giljfddl.exe	109
PID 3768 wrote to memory of 4860	3768	Giljfddl.exe	109
PID 3768 wrote to memory of 4860	3768	Giljfddl.exe	109
PID 4860 wrote to memory of 3528	4860	Haaaaeim.exe	110
PID 4860 wrote to memory of 3528	4860	Haaaaeim.exe	110
PID 4860 wrote to memory of 3528	4860	Haaaaeim.exe	110
PID 3528 wrote to memory of 2928	3528	Jldbpl32.exe	111
PID 3528 wrote to memory of 2928	3528	Jldbpl32.exe	111
PID 3528 wrote to memory of 2928	3528	Jldbpl32.exe	111
PID 2928 wrote to memory of 1444	2928	Mqhfoebo.exe	112
PID 2928 wrote to memory of 1444	2928	Mqhfoebo.exe	112
PID 2928 wrote to memory of 1444	2928	Mqhfoebo.exe	112
PID 1444 wrote to memory of 3476	1444	Nmcpoedn.exe	113
PID 1444 wrote to memory of 3476	1444	Nmcpoedn.exe	113
PID 1444 wrote to memory of 3476	1444	Nmcpoedn.exe	113
PID 3476 wrote to memory of 4280	3476	Njjmni32.exe	114
PID 3476 wrote to memory of 4280	3476	Njjmni32.exe	114
PID 3476 wrote to memory of 4280	3476	Njjmni32.exe	114
PID 4280 wrote to memory of 1604	4280	Ofgdcipq.exe	115
PID 4280 wrote to memory of 1604	4280	Ofgdcipq.exe	115
PID 4280 wrote to memory of 1604	4280	Ofgdcipq.exe	115
PID 1604 wrote to memory of 4092	1604	Qfmfefni.exe	116
PID 1604 wrote to memory of 4092	1604	Qfmfefni.exe	116
PID 1604 wrote to memory of 4092	1604	Qfmfefni.exe	116
PID 4092 wrote to memory of 2692	4092	Amkhmoap.exe	118
PID 4092 wrote to memory of 2692	4092	Amkhmoap.exe	118
PID 4092 wrote to memory of 2692	4092	Amkhmoap.exe	118
PID 2692 wrote to memory of 2644	2692	Bfmolc32.exe	119

C:\Users\Admin\AppData\Local\Temp\092f7134ed1b22ad62b9201bed001b1e475a1567281676b40839559ddbfe05cc.exe
"C:\Users\Admin\AppData\Local\Temp\092f7134ed1b22ad62b9201bed001b1e475a1567281676b40839559ddbfe05cc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\SysWOW64\Joahqn32.exe
  C:\Windows\system32\Joahqn32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\SysWOW64\Mfhbga32.exe
    C:\Windows\system32\Mfhbga32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\SysWOW64\Onmfimga.exe
      C:\Windows\system32\Onmfimga.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1728
    - - C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3632
      - C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3620
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3436
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3564
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3768
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        C:\Windows\SysWOW64\Amkhmoap.exe
        
        C:\Windows\system32\Amkhmoap.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Windows\SysWOW64\Bfmolc32.exe
        
        C:\Windows\system32\Bfmolc32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\SysWOW64\Ckggnp32.exe
        
        C:\Windows\system32\Ckggnp32.exe
        23⤵
        Executes dropped EXE
        
        PID:2644
        
        C:\Windows\SysWOW64\Dickplko.exe
        
        C:\Windows\system32\Dickplko.exe
        24⤵
        Executes dropped EXE
        
        PID:5040
        
        C:\Windows\SysWOW64\Eaaiahei.exe
        
        C:\Windows\system32\Eaaiahei.exe
        25⤵
        Executes dropped EXE
        
        PID:3204
        
        C:\Windows\SysWOW64\Ejagaj32.exe
        
        C:\Windows\system32\Ejagaj32.exe
        26⤵
        Executes dropped EXE
        
        PID:1808
        
        C:\Windows\SysWOW64\Fcneeo32.exe
        
        C:\Windows\system32\Fcneeo32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1960
        
        C:\Windows\SysWOW64\Fkjfakng.exe
        
        C:\Windows\system32\Fkjfakng.exe
        28⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\Gggmgk32.exe
        
        C:\Windows\system32\Gggmgk32.exe
        29⤵
        Executes dropped EXE
        
        PID:1860
        
        C:\Windows\SysWOW64\Hqdkkp32.exe
        
        C:\Windows\system32\Hqdkkp32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3144
        
        C:\Windows\SysWOW64\Hjmodffo.exe
        
        C:\Windows\system32\Hjmodffo.exe
        31⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Hkaeih32.exe
        
        C:\Windows\system32\Hkaeih32.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1984
        
        C:\Windows\SysWOW64\Ieeimlep.exe
        
        C:\Windows\system32\Ieeimlep.exe
        33⤵
        Executes dropped EXE
        
        PID:3420
        
        C:\Windows\SysWOW64\Jblflp32.exe
        
        C:\Windows\system32\Jblflp32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4680
        
        C:\Windows\SysWOW64\Jjgkab32.exe
        
        C:\Windows\system32\Jjgkab32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:448
        
        C:\Windows\SysWOW64\Jjkdlall.exe
        
        C:\Windows\system32\Jjkdlall.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1348
        
        C:\Windows\SysWOW64\Kocphojh.exe
        
        C:\Windows\system32\Kocphojh.exe
        37⤵
        Executes dropped EXE
        
        PID:4400
        
        C:\Windows\SysWOW64\Odbgdp32.exe
        
        C:\Windows\system32\Odbgdp32.exe
        38⤵
        Executes dropped EXE
        
        PID:1048
        
        C:\Windows\SysWOW64\Afeban32.exe
        
        C:\Windows\system32\Afeban32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2728
        
        C:\Windows\SysWOW64\Bppcpc32.exe
        
        C:\Windows\system32\Bppcpc32.exe
        40⤵
        Executes dropped EXE
        
        PID:4896
        
        C:\Windows\SysWOW64\Beaecjab.exe
        
        C:\Windows\system32\Beaecjab.exe
        41⤵
        Executes dropped EXE
        
        PID:3552
        
        C:\Windows\SysWOW64\Bbefln32.exe
        
        C:\Windows\system32\Bbefln32.exe
        42⤵
        Executes dropped EXE
        
        PID:4312
        
        C:\Windows\SysWOW64\Bipnihgi.exe
        
        C:\Windows\system32\Bipnihgi.exe
        43⤵
        Executes dropped EXE
        
        PID:5140
        
        C:\Windows\SysWOW64\Dpjompqc.exe
        
        C:\Windows\system32\Dpjompqc.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5200
        
        C:\Windows\SysWOW64\Egmjpi32.exe
        
        C:\Windows\system32\Egmjpi32.exe
        45⤵
        Executes dropped EXE
        
        PID:5280
        
        C:\Windows\SysWOW64\Gnjhhpgl.exe
        
        C:\Windows\system32\Gnjhhpgl.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5340
        
        C:\Windows\SysWOW64\Gjcfcakn.exe
        
        C:\Windows\system32\Gjcfcakn.exe
        47⤵
        Executes dropped EXE
        
        PID:5384
        
        C:\Windows\SysWOW64\Hqddqj32.exe
        
        C:\Windows\system32\Hqddqj32.exe
        48⤵
        Executes dropped EXE
        
        PID:5432
        
        C:\Windows\SysWOW64\Hqfqfj32.exe
        
        C:\Windows\system32\Hqfqfj32.exe
        49⤵
        Executes dropped EXE
        
        PID:5484
        
        C:\Windows\SysWOW64\Igjlibib.exe
        
        C:\Windows\system32\Igjlibib.exe
        50⤵
        Executes dropped EXE
        
        PID:5528
        
        C:\Windows\SysWOW64\Imfdaigj.exe
        
        C:\Windows\system32\Imfdaigj.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Iqdmghnp.exe
        
        C:\Windows\system32\Iqdmghnp.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Icefib32.exe
        
        C:\Windows\system32\Icefib32.exe
        53⤵
        Executes dropped EXE
        
        PID:5664
        
        C:\Windows\SysWOW64\Inkjfk32.exe
        
        C:\Windows\system32\Inkjfk32.exe
        54⤵
        Executes dropped EXE
        
        PID:5716
        
        C:\Windows\SysWOW64\Jjakkmpk.exe
        
        C:\Windows\system32\Jjakkmpk.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5756
        
        C:\Windows\SysWOW64\Jnocakfb.exe
        
        C:\Windows\system32\Jnocakfb.exe
        56⤵
        Executes dropped EXE
        
        PID:5800
        
        C:\Windows\SysWOW64\Jjfdfl32.exe
        
        C:\Windows\system32\Jjfdfl32.exe
        57⤵
        Executes dropped EXE
        
        PID:5840
        
        C:\Windows\SysWOW64\Jcoioabf.exe
        
        C:\Windows\system32\Jcoioabf.exe
        58⤵
        Executes dropped EXE
        
        PID:5888
        
        C:\Windows\SysWOW64\Kebodc32.exe
        
        C:\Windows\system32\Kebodc32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5940
        
        C:\Windows\SysWOW64\Mkdiog32.exe
        
        C:\Windows\system32\Mkdiog32.exe
        60⤵
        Executes dropped EXE
        
        PID:5996
        
        C:\Windows\SysWOW64\Nhdicjfp.exe
        
        C:\Windows\system32\Nhdicjfp.exe
        61⤵
        Executes dropped EXE
        
        PID:6048
        
        C:\Windows\SysWOW64\Ogefqeaj.exe
        
        C:\Windows\system32\Ogefqeaj.exe
        62⤵
        Executes dropped EXE
        
        PID:6100
        
        C:\Windows\SysWOW64\Dfqdid32.exe
        
        C:\Windows\system32\Dfqdid32.exe
        63⤵
        Executes dropped EXE
        
        PID:5188
        
        C:\Windows\SysWOW64\Eoladdeo.exe
        
        C:\Windows\system32\Eoladdeo.exe
        64⤵
        Executes dropped EXE
        
        PID:5196
        
        C:\Windows\SysWOW64\Fofdkcmd.exe
        
        C:\Windows\system32\Fofdkcmd.exe
        65⤵
        Executes dropped EXE
        
        PID:5304
        
        C:\Windows\SysWOW64\Gojnfb32.exe
        
        C:\Windows\system32\Gojnfb32.exe
        66⤵
        
        PID:636
        
        C:\Windows\SysWOW64\Gckcap32.exe
        
        C:\Windows\system32\Gckcap32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5524
        
        C:\Windows\SysWOW64\Geklckkd.exe
        
        C:\Windows\system32\Geklckkd.exe
        68⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Lagepl32.exe
        
        C:\Windows\system32\Lagepl32.exe
        69⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Mmbopm32.exe
        
        C:\Windows\system32\Mmbopm32.exe
        70⤵
        Modifies registry class
        
        PID:6076
        
        C:\Windows\SysWOW64\Mapgfk32.exe
        
        C:\Windows\system32\Mapgfk32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4632
        
        C:\Windows\SysWOW64\Mfmpob32.exe
        
        C:\Windows\system32\Mfmpob32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2088
        
        C:\Windows\SysWOW64\Mhoind32.exe
        
        C:\Windows\system32\Mhoind32.exe
        73⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Nmlafk32.exe
        
        C:\Windows\system32\Nmlafk32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Nibbklke.exe
        
        C:\Windows\system32\Nibbklke.exe
        75⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Ndhgie32.exe
        
        C:\Windows\system32\Ndhgie32.exe
        76⤵
        Drops file in System32 directory
        
        PID:5396
        
        C:\Windows\SysWOW64\Nmbhgjoi.exe
        
        C:\Windows\system32\Nmbhgjoi.exe
        77⤵
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Nmedmj32.exe
        
        C:\Windows\system32\Nmedmj32.exe
        78⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\Okiefn32.exe
        
        C:\Windows\system32\Okiefn32.exe
        79⤵
        
        PID:824
        
        C:\Windows\SysWOW64\Ohmepbki.exe
        
        C:\Windows\system32\Ohmepbki.exe
        80⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Oknnanhj.exe
        
        C:\Windows\system32\Oknnanhj.exe
        81⤵
        
        PID:3372
        
        C:\Windows\SysWOW64\Onngci32.exe
        
        C:\Windows\system32\Onngci32.exe
        82⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5592
        
        C:\Windows\SysWOW64\Odhppclh.exe
        
        C:\Windows\system32\Odhppclh.exe
        83⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Pjjaci32.exe
        
        C:\Windows\system32\Pjjaci32.exe
        84⤵
        Drops file in System32 directory
        
        PID:5792
        
        C:\Windows\SysWOW64\Qkcackeb.exe
        
        C:\Windows\system32\Qkcackeb.exe
        85⤵
        Modifies registry class
        
        PID:4300
        
        C:\Windows\SysWOW64\Agqhik32.exe
        
        C:\Windows\system32\Agqhik32.exe
        86⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\Bggnijof.exe
        
        C:\Windows\system32\Bggnijof.exe
        87⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Cejjdlap.exe
        
        C:\Windows\system32\Cejjdlap.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1368
        
        C:\Windows\SysWOW64\Cnboma32.exe
        
        C:\Windows\system32\Cnboma32.exe
        89⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Celgjlpn.exe
        
        C:\Windows\system32\Celgjlpn.exe
        90⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Dbphcpog.exe
        
        C:\Windows\system32\Dbphcpog.exe
        91⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\Djmima32.exe
        
        C:\Windows\system32\Djmima32.exe
        92⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Foqdem32.exe
        
        C:\Windows\system32\Foqdem32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2472
        
        C:\Windows\SysWOW64\Foenplji.exe
        
        C:\Windows\system32\Foenplji.exe
        94⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\Gedohfmp.exe
        
        C:\Windows\system32\Gedohfmp.exe
        95⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\Glbapoqh.exe
        
        C:\Windows\system32\Glbapoqh.exe
        96⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\Hccomh32.exe
        
        C:\Windows\system32\Hccomh32.exe
        97⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\Joobdfei.exe
        
        C:\Windows\system32\Joobdfei.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3092
        
        C:\Windows\SysWOW64\Lpdefc32.exe
        
        C:\Windows\system32\Lpdefc32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5784
        
        C:\Windows\SysWOW64\Lmmokgne.exe
        
        C:\Windows\system32\Lmmokgne.exe
        100⤵
        
        PID:744
        
        C:\Windows\SysWOW64\Mfeccm32.exe
        
        C:\Windows\system32\Mfeccm32.exe
        101⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Miflehaf.exe
        
        C:\Windows\system32\Miflehaf.exe
        102⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\Mjehok32.exe
        
        C:\Windows\system32\Mjehok32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2340
        
        C:\Windows\SysWOW64\Mflidl32.exe
        
        C:\Windows\system32\Mflidl32.exe
        104⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Mlialb32.exe
        
        C:\Windows\system32\Mlialb32.exe
        105⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4584
        
        C:\Windows\SysWOW64\Mfofjk32.exe
        
        C:\Windows\system32\Mfofjk32.exe
        106⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Mminfech.exe
        
        C:\Windows\system32\Mminfech.exe
        107⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\Nbefolao.exe
        
        C:\Windows\system32\Nbefolao.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3916
        
        C:\Windows\SysWOW64\Nmkkle32.exe
        
        C:\Windows\system32\Nmkkle32.exe
        109⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Njokei32.exe
        
        C:\Windows\system32\Njokei32.exe
        110⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\Nmpdgdmp.exe
        
        C:\Windows\system32\Nmpdgdmp.exe
        111⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\Niiaae32.exe
        
        C:\Windows\system32\Niiaae32.exe
        112⤵
        Drops file in System32 directory
        
        PID:3108
        
        C:\Windows\SysWOW64\Olndnp32.exe
        
        C:\Windows\system32\Olndnp32.exe
        113⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Pghaghfn.exe
        
        C:\Windows\system32\Pghaghfn.exe
        114⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\Qdhalj32.exe
        
        C:\Windows\system32\Qdhalj32.exe
        115⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\Bgdjicmn.exe
        
        C:\Windows\system32\Bgdjicmn.exe
        116⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\Bjhpqn32.exe
        
        C:\Windows\system32\Bjhpqn32.exe
        117⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Bmhibi32.exe
        
        C:\Windows\system32\Bmhibi32.exe
        118⤵
        Drops file in System32 directory
        
        PID:3768
        
        C:\Windows\SysWOW64\Cnmoglij.exe
        
        C:\Windows\system32\Cnmoglij.exe
        119⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\Cmdhnhkp.exe
        
        C:\Windows\system32\Cmdhnhkp.exe
        120⤵
        Drops file in System32 directory
        
        PID:6088
        
        C:\Windows\SysWOW64\Dkehlo32.exe
        
        C:\Windows\system32\Dkehlo32.exe
        121⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\Dcqmpa32.exe
        
        C:\Windows\system32\Dcqmpa32.exe
        122⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\Dnfanjqp.exe
        
        C:\Windows\system32\Dnfanjqp.exe
        123⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Dgqblp32.exe
        
        C:\Windows\system32\Dgqblp32.exe
        124⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Eenflbll.exe
        
        C:\Windows\system32\Eenflbll.exe
        125⤵
        Modifies registry class
        
        PID:1256
        
        C:\Windows\SysWOW64\Eepbabjj.exe
        
        C:\Windows\system32\Eepbabjj.exe
        126⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Ejmkiiha.exe
        
        C:\Windows\system32\Ejmkiiha.exe
        127⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\Fejegaao.exe
        
        C:\Windows\system32\Fejegaao.exe
        128⤵
        Modifies registry class
        
        PID:4356
        
        C:\Windows\SysWOW64\Fjfnphpf.exe
        
        C:\Windows\system32\Fjfnphpf.exe
        129⤵
        Drops file in System32 directory
        
        PID:1152
        
        C:\Windows\SysWOW64\Flfjjkgi.exe
        
        C:\Windows\system32\Flfjjkgi.exe
        130⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\Gmggac32.exe
        
        C:\Windows\system32\Gmggac32.exe
        131⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Gdaonmdd.exe
        
        C:\Windows\system32\Gdaonmdd.exe
        132⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\Gjndpg32.exe
        
        C:\Windows\system32\Gjndpg32.exe
        133⤵
        
        PID:796
        
        C:\Windows\SysWOW64\Gehbio32.exe
        
        C:\Windows\system32\Gehbio32.exe
        134⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Hhhkjj32.exe
        
        C:\Windows\system32\Hhhkjj32.exe
        135⤵
        
        PID:532
        
        C:\Windows\SysWOW64\Helkdnaj.exe
        
        C:\Windows\system32\Helkdnaj.exe
        136⤵
        Modifies registry class
        
        PID:5048
        
        C:\Windows\SysWOW64\Hlfcqh32.exe
        
        C:\Windows\system32\Hlfcqh32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5392
        
        C:\Windows\SysWOW64\Haclio32.exe
        
        C:\Windows\system32\Haclio32.exe
        138⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\Hoglbc32.exe
        
        C:\Windows\system32\Hoglbc32.exe
        139⤵
        Modifies registry class
        
        PID:452
        
        C:\Windows\SysWOW64\Ikpjmd32.exe
        
        C:\Windows\system32\Ikpjmd32.exe
        140⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Iefnjm32.exe
        
        C:\Windows\system32\Iefnjm32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1972
        
        C:\Windows\SysWOW64\Idpdfija.exe
        
        C:\Windows\system32\Idpdfija.exe
        142⤵
        Drops file in System32 directory
        
        PID:5204
        
        C:\Windows\SysWOW64\Jhpjbgne.exe
        
        C:\Windows\system32\Jhpjbgne.exe
        143⤵
        
        PID:624
        
        C:\Windows\SysWOW64\Jhdcmf32.exe
        
        C:\Windows\system32\Jhdcmf32.exe
        144⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Jehcfj32.exe
        
        C:\Windows\system32\Jehcfj32.exe
        145⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\Kkhidaeo.exe
        
        C:\Windows\system32\Kkhidaeo.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1232
        
        C:\Windows\SysWOW64\Khnfce32.exe
        
        C:\Windows\system32\Khnfce32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5584
        
        C:\Windows\SysWOW64\Lhelddln.exe
        
        C:\Windows\system32\Lhelddln.exe
        148⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\Ldnjndpo.exe
        
        C:\Windows\system32\Ldnjndpo.exe
        149⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\Lnfngj32.exe
        
        C:\Windows\system32\Lnfngj32.exe
        150⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Ldccid32.exe
        
        C:\Windows\system32\Ldccid32.exe
        151⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Lnkgbibj.exe
        
        C:\Windows\system32\Lnkgbibj.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5612
        
        C:\Windows\SysWOW64\Mnndhi32.exe
        
        C:\Windows\system32\Mnndhi32.exe
        153⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Megldcgd.exe
        
        C:\Windows\system32\Megldcgd.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4860
        
        C:\Windows\SysWOW64\Mkadam32.exe
        
        C:\Windows\system32\Mkadam32.exe
        155⤵
        Drops file in System32 directory
        
        PID:5756
        
        C:\Windows\SysWOW64\Mbkmngfn.exe
        
        C:\Windows\system32\Mbkmngfn.exe
        156⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Moomgl32.exe
        
        C:\Windows\system32\Moomgl32.exe
        157⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\Mihbpalh.exe
        
        C:\Windows\system32\Mihbpalh.exe
        158⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Mijofaje.exe
        
        C:\Windows\system32\Mijofaje.exe
        159⤵
        Modifies registry class
        
        PID:924
        
        C:\Windows\SysWOW64\Mpdgbkab.exe
        
        C:\Windows\system32\Mpdgbkab.exe
        160⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5956
        
        C:\Windows\SysWOW64\Neaokboj.exe
        
        C:\Windows\system32\Neaokboj.exe
        161⤵
        Drops file in System32 directory
        
        PID:5040
        
        C:\Windows\SysWOW64\Npfchkop.exe
        
        C:\Windows\system32\Npfchkop.exe
        162⤵
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Nfpled32.exe
        
        C:\Windows\system32\Nfpled32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3952
        
        C:\Windows\SysWOW64\Nlmdml32.exe
        
        C:\Windows\system32\Nlmdml32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5712
        
        C:\Windows\SysWOW64\Nfchjddj.exe
        
        C:\Windows\system32\Nfchjddj.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2756
        
        C:\Windows\SysWOW64\Nnnmogae.exe
        
        C:\Windows\system32\Nnnmogae.exe
        166⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\Nehekq32.exe
        
        C:\Windows\system32\Nehekq32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Npmjij32.exe
        
        C:\Windows\system32\Npmjij32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5552
        
        C:\Windows\SysWOW64\Nejbaqgo.exe
        
        C:\Windows\system32\Nejbaqgo.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5572
        
        C:\Windows\SysWOW64\Obnbjdfi.exe
        
        C:\Windows\system32\Obnbjdfi.exe
        170⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Oihkgo32.exe
        
        C:\Windows\system32\Oihkgo32.exe
        171⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\Onecof32.exe
        
        C:\Windows\system32\Onecof32.exe
        172⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Oeoklp32.exe
        
        C:\Windows\system32\Oeoklp32.exe
        173⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Oimdbnip.exe
        
        C:\Windows\system32\Oimdbnip.exe
        174⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\Onjmjegg.exe
        
        C:\Windows\system32\Onjmjegg.exe
        175⤵
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Oioahn32.exe
        
        C:\Windows\system32\Oioahn32.exe
        176⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Opiidhoj.exe
        
        C:\Windows\system32\Opiidhoj.exe
        177⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Oianmm32.exe
        
        C:\Windows\system32\Oianmm32.exe
        178⤵
        Drops file in System32 directory
        
        PID:6260
        
        C:\Windows\SysWOW64\Opkfjgmh.exe
        
        C:\Windows\system32\Opkfjgmh.exe
        179⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Pmpfcl32.exe
        
        C:\Windows\system32\Pmpfcl32.exe
        180⤵
        Modifies registry class
        
        PID:6352
        
        C:\Windows\SysWOW64\Pblolb32.exe
        
        C:\Windows\system32\Pblolb32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6400
        
        C:\Windows\SysWOW64\Pldcdhpi.exe
        
        C:\Windows\system32\Pldcdhpi.exe
        182⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Plgpjhnf.exe
        
        C:\Windows\system32\Plgpjhnf.exe
        183⤵
        Drops file in System32 directory
        
        PID:6480
        
        C:\Windows\SysWOW64\Pfmdgq32.exe
        
        C:\Windows\system32\Pfmdgq32.exe
        184⤵
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Pohilc32.exe
        
        C:\Windows\system32\Pohilc32.exe
        185⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Peaahmcd.exe
        
        C:\Windows\system32\Peaahmcd.exe
        186⤵
        Modifies registry class
        
        PID:6600
        
        C:\Windows\SysWOW64\Pllieg32.exe
        
        C:\Windows\system32\Pllieg32.exe
        187⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Qipjokik.exe
        
        C:\Windows\system32\Qipjokik.exe
        188⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Qfcjhphd.exe
        
        C:\Windows\system32\Qfcjhphd.exe
        189⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Qlpcpffl.exe
        
        C:\Windows\system32\Qlpcpffl.exe
        190⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Affgno32.exe
        
        C:\Windows\system32\Affgno32.exe
        191⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Albpff32.exe
        
        C:\Windows\system32\Albpff32.exe
        192⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Aekdolkj.exe
        
        C:\Windows\system32\Aekdolkj.exe
        193⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Apqhldjp.exe
        
        C:\Windows\system32\Apqhldjp.exe
        194⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Aemqdk32.exe
        
        C:\Windows\system32\Aemqdk32.exe
        195⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Apcead32.exe
        
        C:\Windows\system32\Apcead32.exe
        196⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Aikijjon.exe
        
        C:\Windows\system32\Aikijjon.exe
        197⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Apeagd32.exe
        
        C:\Windows\system32\Apeagd32.exe
        198⤵
        Modifies registry class
        
        PID:7124
        
        C:\Windows\SysWOW64\Ainfpi32.exe
        
        C:\Windows\system32\Ainfpi32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1984
        
        C:\Windows\SysWOW64\Bpgnmcdh.exe
        
        C:\Windows\system32\Bpgnmcdh.exe
        200⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Bedgejbo.exe
        
        C:\Windows\system32\Bedgejbo.exe
        201⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Bpjkbcbe.exe
        
        C:\Windows\system32\Bpjkbcbe.exe
        202⤵
        Modifies registry class
        
        PID:6320
        
        C:\Windows\SysWOW64\Begcjjql.exe
        
        C:\Windows\system32\Begcjjql.exe
        203⤵
        Modifies registry class
        
        PID:6380
        
        C:\Windows\SysWOW64\Bplhhc32.exe
        
        C:\Windows\system32\Bplhhc32.exe
        204⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Bgfpdmho.exe
        
        C:\Windows\system32\Bgfpdmho.exe
        205⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Blchmdff.exe
        
        C:\Windows\system32\Blchmdff.exe
        206⤵
        Drops file in System32 directory
        
        PID:6628
        
        C:\Windows\SysWOW64\Bcmqin32.exe
        
        C:\Windows\system32\Bcmqin32.exe
        207⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Bjgifhep.exe
        
        C:\Windows\system32\Bjgifhep.exe
        208⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Bodano32.exe
        
        C:\Windows\system32\Bodano32.exe
        209⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Benjkijd.exe
        
        C:\Windows\system32\Benjkijd.exe
        210⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Clhbhc32.exe
        
        C:\Windows\system32\Clhbhc32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6992
        
        C:\Windows\SysWOW64\Cgmfel32.exe
        
        C:\Windows\system32\Cgmfel32.exe
        212⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Cgbppknb.exe
        
        C:\Windows\system32\Cgbppknb.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7100
        
        C:\Windows\SysWOW64\Cpjdiadb.exe
        
        C:\Windows\system32\Cpjdiadb.exe
        214⤵
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Cnndbecl.exe
        
        C:\Windows\system32\Cnndbecl.exe
        215⤵
        Modifies registry class
        
        PID:6316
        
        C:\Windows\SysWOW64\Copajm32.exe
        
        C:\Windows\system32\Copajm32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6408
        
        C:\Windows\SysWOW64\Dcmjpl32.exe
        
        C:\Windows\system32\Dcmjpl32.exe
        217⤵
        Drops file in System32 directory
        
        PID:6556
        
        C:\Windows\SysWOW64\Dodjemee.exe
        
        C:\Windows\system32\Dodjemee.exe
        218⤵
        Drops file in System32 directory
        
        PID:6692
        
        C:\Windows\SysWOW64\Dqdgop32.exe
        
        C:\Windows\system32\Dqdgop32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6816
        
        C:\Windows\SysWOW64\Djlkhe32.exe
        
        C:\Windows\system32\Djlkhe32.exe
        220⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Ecnbgian.exe
        
        C:\Windows\system32\Ecnbgian.exe
        221⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Epgpajdp.exe
        
        C:\Windows\system32\Epgpajdp.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6184
        
        C:\Windows\SysWOW64\Fceihh32.exe
        
        C:\Windows\system32\Fceihh32.exe
        223⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Fmmmqnaf.exe
        
        C:\Windows\system32\Fmmmqnaf.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6064
        
        C:\Windows\SysWOW64\Fgcang32.exe
        
        C:\Windows\system32\Fgcang32.exe
        225⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Fakfglhm.exe
        
        C:\Windows\system32\Fakfglhm.exe
        226⤵
        Drops file in System32 directory
        
        PID:5736
        
        C:\Windows\SysWOW64\Ggldde32.exe
        
        C:\Windows\system32\Ggldde32.exe
        227⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\Gadimkpb.exe
        
        C:\Windows\system32\Gadimkpb.exe
        228⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Gjmmfq32.exe
        
        C:\Windows\system32\Gjmmfq32.exe
        229⤵
        Drops file in System32 directory
        
        PID:6212
        
        C:\Windows\SysWOW64\Ghcjedcj.exe
        
        C:\Windows\system32\Ghcjedcj.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6476
        
        C:\Windows\SysWOW64\Hcjkje32.exe
        
        C:\Windows\system32\Hcjkje32.exe
        231⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Hanlcjgh.exe
        
        C:\Windows\system32\Hanlcjgh.exe
        232⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Hjfplo32.exe
        
        C:\Windows\system32\Hjfplo32.exe
        233⤵
        Modifies registry class
        
        PID:5700
        
        C:\Windows\SysWOW64\Haphiiee.exe
        
        C:\Windows\system32\Haphiiee.exe
        234⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Hdaajd32.exe
        
        C:\Windows\system32\Hdaajd32.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6676
        
        C:\Windows\SysWOW64\Hjkigojc.exe
        
        C:\Windows\system32\Hjkigojc.exe
        236⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Hphbpehj.exe
        
        C:\Windows\system32\Hphbpehj.exe
        237⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Hoibmmpi.exe
        
        C:\Windows\system32\Hoibmmpi.exe
        238⤵
        Drops file in System32 directory
        
        PID:5276
        
        C:\Windows\SysWOW64\Ifdgaond.exe
        
        C:\Windows\system32\Ifdgaond.exe
        239⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Iplkje32.exe
        
        C:\Windows\system32\Iplkje32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4976
        
        C:\Windows\SysWOW64\Impldi32.exe
        
        C:\Windows\system32\Impldi32.exe
        241⤵
        Drops file in System32 directory
        
        PID:7140
        
        C:\Windows\SysWOW64\Ihfpabbd.exe
        
        C:\Windows\system32\Ihfpabbd.exe
        242⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\Iophnl32.exe
        
        C:\Windows\system32\Iophnl32.exe
        243⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Iaqapggb.exe
        
        C:\Windows\system32\Iaqapggb.exe
        244⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Jgpfmncg.exe
        
        C:\Windows\system32\Jgpfmncg.exe
        245⤵
        Drops file in System32 directory
        
        PID:7216
        
        C:\Windows\SysWOW64\Jaekkfcm.exe
        
        C:\Windows\system32\Jaekkfcm.exe
        246⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Joikdk32.exe
        
        C:\Windows\system32\Joikdk32.exe
        247⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Jolhjj32.exe
        
        C:\Windows\system32\Jolhjj32.exe
        248⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7372
        
        C:\Windows\SysWOW64\Jpmdabfb.exe
        
        C:\Windows\system32\Jpmdabfb.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7412
        
        C:\Windows\SysWOW64\Jkbhok32.exe
        
        C:\Windows\system32\Jkbhok32.exe
        250⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Jalakeme.exe
        
        C:\Windows\system32\Jalakeme.exe
        251⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Jgiiclkl.exe
        
        C:\Windows\system32\Jgiiclkl.exe
        252⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Kdmjmqjf.exe
        
        C:\Windows\system32\Kdmjmqjf.exe
        253⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Kobnji32.exe
        
        C:\Windows\system32\Kobnji32.exe
        254⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Kpdjbapj.exe
        
        C:\Windows\system32\Kpdjbapj.exe
        255⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Lnoalehl.exe
        
        C:\Windows\system32\Lnoalehl.exe
        256⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Lhdeinhb.exe
        
        C:\Windows\system32\Lhdeinhb.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7760
        
        C:\Windows\SysWOW64\Lnanadfi.exe
        
        C:\Windows\system32\Lnanadfi.exe
        258⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Lhgbomfo.exe
        
        C:\Windows\system32\Lhgbomfo.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7840
        
        C:\Windows\SysWOW64\Loqjlg32.exe
        
        C:\Windows\system32\Loqjlg32.exe
        260⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Lhiodm32.exe
        
        C:\Windows\system32\Lhiodm32.exe
        261⤵
        Modifies registry class
        
        PID:7948
        
        C:\Windows\SysWOW64\Laacmbkm.exe
        
        C:\Windows\system32\Laacmbkm.exe
        262⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Lgnleiid.exe
        
        C:\Windows\system32\Lgnleiid.exe
        263⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Ladpcb32.exe
        
        C:\Windows\system32\Ladpcb32.exe
        264⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Lgqhki32.exe
        
        C:\Windows\system32\Lgqhki32.exe
        265⤵
        Modifies registry class
        
        PID:8116
        
        C:\Windows\SysWOW64\Mbfmha32.exe
        
        C:\Windows\system32\Mbfmha32.exe
        266⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Mkoaagmh.exe
        
        C:\Windows\system32\Mkoaagmh.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7180
        
        C:\Windows\SysWOW64\Mqkijnkp.exe
        
        C:\Windows\system32\Mqkijnkp.exe
        268⤵
        Drops file in System32 directory
        
        PID:7248
        
        C:\Windows\SysWOW64\Mgebfhcl.exe
        
        C:\Windows\system32\Mgebfhcl.exe
        269⤵
        Drops file in System32 directory
        
        PID:7320
        
        C:\Windows\SysWOW64\Mbkfcabb.exe
        
        C:\Windows\system32\Mbkfcabb.exe
        270⤵
        Modifies registry class
        
        PID:7404
        
        C:\Windows\SysWOW64\Mggolhaj.exe
        
        C:\Windows\system32\Mggolhaj.exe
        271⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Mqpcdn32.exe
        
        C:\Windows\system32\Mqpcdn32.exe
        272⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Mkegbfgp.exe
        
        C:\Windows\system32\Mkegbfgp.exe
        273⤵
        Drops file in System32 directory
        
        PID:7616
        
        C:\Windows\SysWOW64\Mbpoop32.exe
        
        C:\Windows\system32\Mbpoop32.exe
        274⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Nkhdgfen.exe
        
        C:\Windows\system32\Nkhdgfen.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7768
        
        C:\Windows\SysWOW64\Nildajdg.exe
        
        C:\Windows\system32\Nildajdg.exe
        276⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Nbdijpjh.exe
        
        C:\Windows\system32\Nbdijpjh.exe
        277⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Nohicdia.exe
        
        C:\Windows\system32\Nohicdia.exe
        278⤵
        Drops file in System32 directory
        
        PID:8024
        
        C:\Windows\SysWOW64\Neebkkgi.exe
        
        C:\Windows\system32\Neebkkgi.exe
        279⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Nnmfdpni.exe
        
        C:\Windows\system32\Nnmfdpni.exe
        280⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Nnpcjplf.exe
        
        C:\Windows\system32\Nnpcjplf.exe
        281⤵
        Drops file in System32 directory
        
        PID:7300
        
        C:\Windows\SysWOW64\Nieggill.exe
        
        C:\Windows\system32\Nieggill.exe
        282⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Oooodcci.exe
        
        C:\Windows\system32\Oooodcci.exe
        283⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Ogjdheqd.exe
        
        C:\Windows\system32\Ogjdheqd.exe
        284⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Obphenpj.exe
        
        C:\Windows\system32\Obphenpj.exe
        285⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Oijqbh32.exe
        
        C:\Windows\system32\Oijqbh32.exe
        286⤵
        Modifies registry class
        
        PID:7792
        
        C:\Windows\SysWOW64\Obbekn32.exe
        
        C:\Windows\system32\Obbekn32.exe
        287⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Onifpodl.exe
        
        C:\Windows\system32\Onifpodl.exe
        288⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Ogajid32.exe
        
        C:\Windows\system32\Ogajid32.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7908
        
        C:\Windows\SysWOW64\Obgofmjb.exe
        
        C:\Windows\system32\Obgofmjb.exe
        290⤵
        Modifies registry class
        
        PID:7212
        
        C:\Windows\SysWOW64\Picchg32.exe
        
        C:\Windows\system32\Picchg32.exe
        291⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Pnplqn32.exe
        
        C:\Windows\system32\Pnplqn32.exe
        292⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Phhpic32.exe
        
        C:\Windows\system32\Phhpic32.exe
        293⤵
        Modifies registry class
        
        PID:5236
        
        C:\Windows\SysWOW64\Paqebike.exe
        
        C:\Windows\system32\Paqebike.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3128
        
        C:\Windows\SysWOW64\Pbpall32.exe
        
        C:\Windows\system32\Pbpall32.exe
        295⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Pijiif32.exe
        
        C:\Windows\system32\Pijiif32.exe
        296⤵
        Drops file in System32 directory
        
        PID:5604
        
        C:\Windows\SysWOW64\Ppdbfpaa.exe
        
        C:\Windows\system32\Ppdbfpaa.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5428
        
        C:\Windows\SysWOW64\Qbekgknb.exe
        
        C:\Windows\system32\Qbekgknb.exe
        298⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Qhbcpb32.exe
        
        C:\Windows\system32\Qhbcpb32.exe
        299⤵
        
        PID:628
        
        C:\Windows\SysWOW64\Aefcif32.exe
        
        C:\Windows\system32\Aefcif32.exe
        300⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Aonhblad.exe
        
        C:\Windows\system32\Aonhblad.exe
        301⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\Aehpof32.exe
        
        C:\Windows\system32\Aehpof32.exe
        302⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Ablahjhj.exe
        
        C:\Windows\system32\Ablahjhj.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7672
        
        C:\Windows\SysWOW64\Aldeap32.exe
        
        C:\Windows\system32\Aldeap32.exe
        304⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Abnnnjfh.exe
        
        C:\Windows\system32\Abnnnjfh.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5644
        
        C:\Windows\SysWOW64\Apbngn32.exe
        
        C:\Windows\system32\Apbngn32.exe
        306⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Aeofoe32.exe
        
        C:\Windows\system32\Aeofoe32.exe
        307⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Apdkmn32.exe
        
        C:\Windows\system32\Apdkmn32.exe
        308⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Blkkaohc.exe
        
        C:\Windows\system32\Blkkaohc.exe
        309⤵
        Modifies registry class
        
        PID:1728
        
        C:\Windows\SysWOW64\Biolkc32.exe
        
        C:\Windows\system32\Biolkc32.exe
        310⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Boldcj32.exe
        
        C:\Windows\system32\Boldcj32.exe
        311⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\Blpemn32.exe
        
        C:\Windows\system32\Blpemn32.exe
        312⤵
        Modifies registry class
        
        PID:8144
        
        C:\Windows\SysWOW64\Bbjmih32.exe
        
        C:\Windows\system32\Bbjmih32.exe
        313⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Blbabnbk.exe
        
        C:\Windows\system32\Blbabnbk.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Baojkdqb.exe
        
        C:\Windows\system32\Baojkdqb.exe
        315⤵
        Drops file in System32 directory
        
        PID:8008
        
        C:\Windows\SysWOW64\Bhibgo32.exe
        
        C:\Windows\system32\Bhibgo32.exe
        316⤵
        Drops file in System32 directory
        
        PID:2380
        
        C:\Windows\SysWOW64\Coegih32.exe
        
        C:\Windows\system32\Coegih32.exe
        317⤵
        Drops file in System32 directory
        
        PID:7780
        
        C:\Windows\SysWOW64\Cikkga32.exe
        
        C:\Windows\system32\Cikkga32.exe
        318⤵
        Modifies registry class
        
        PID:5772
        
        C:\Windows\SysWOW64\Cpedckdl.exe
        
        C:\Windows\system32\Cpedckdl.exe
        319⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\Cebllbcc.exe
        
        C:\Windows\system32\Cebllbcc.exe
        320⤵
        Modifies registry class
        
        PID:7976
        
        C:\Windows\SysWOW64\Cpgqik32.exe
        
        C:\Windows\system32\Cpgqik32.exe
        321⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Cediab32.exe
        
        C:\Windows\system32\Cediab32.exe
        322⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Cpjmok32.exe
        
        C:\Windows\system32\Cpjmok32.exe
        323⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Cefega32.exe
        
        C:\Windows\system32\Cefega32.exe
        324⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Coojpg32.exe
        
        C:\Windows\system32\Coojpg32.exe
        325⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Didnmp32.exe
        
        C:\Windows\system32\Didnmp32.exe
        326⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Dapcab32.exe
        
        C:\Windows\system32\Dapcab32.exe
        327⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Djihhoao.exe
        
        C:\Windows\system32\Djihhoao.exe
        328⤵
        Drops file in System32 directory
        
        PID:8428
        
        C:\Windows\SysWOW64\Dadlmanj.exe
        
        C:\Windows\system32\Dadlmanj.exe
        329⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Djnaco32.exe
        
        C:\Windows\system32\Djnaco32.exe
        330⤵
        Modifies registry class
        
        PID:8524
        
        C:\Windows\SysWOW64\Ecfeldcj.exe
        
        C:\Windows\system32\Ecfeldcj.exe
        331⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Ehcndkaa.exe
        
        C:\Windows\system32\Ehcndkaa.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8632
        
        C:\Windows\SysWOW64\Eplckh32.exe
        
        C:\Windows\system32\Eplckh32.exe
        333⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Efikco32.exe
        
        C:\Windows\system32\Efikco32.exe
        334⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Eoapldei.exe
        
        C:\Windows\system32\Eoapldei.exe
        335⤵
        Modifies registry class
        
        PID:8800
        
        C:\Windows\SysWOW64\Elepei32.exe
        
        C:\Windows\system32\Elepei32.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8844
        
        C:\Windows\SysWOW64\Ebbinp32.exe
        
        C:\Windows\system32\Ebbinp32.exe
        337⤵
        Drops file in System32 directory
        
        PID:8884
        
        C:\Windows\SysWOW64\Ehlakjig.exe
        
        C:\Windows\system32\Ehlakjig.exe
        338⤵
        Modifies registry class
        
        PID:8924
        
        C:\Windows\SysWOW64\Fcbehbim.exe
        
        C:\Windows\system32\Fcbehbim.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8968
        
        C:\Windows\SysWOW64\Fhonpi32.exe
        
        C:\Windows\system32\Fhonpi32.exe
        340⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Fcdbmb32.exe
        
        C:\Windows\system32\Fcdbmb32.exe
        341⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Fiajfi32.exe
        
        C:\Windows\system32\Fiajfi32.exe
        342⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Fcfocb32.exe
        
        C:\Windows\system32\Fcfocb32.exe
        343⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Ficgkico.exe
        
        C:\Windows\system32\Ficgkico.exe
        344⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Fomohc32.exe
        
        C:\Windows\system32\Fomohc32.exe
        345⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Fifdqhal.exe
        
        C:\Windows\system32\Fifdqhal.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8240
        
        C:\Windows\SysWOW64\Foplnb32.exe
        
        C:\Windows\system32\Foplnb32.exe
        347⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Ffjdjmpf.exe
        
        C:\Windows\system32\Ffjdjmpf.exe
        348⤵
        Modifies registry class
        
        PID:8364
        
        C:\Windows\SysWOW64\Gobicbgf.exe
        
        C:\Windows\system32\Gobicbgf.exe
        349⤵
        Drops file in System32 directory
        
        PID:8412
        
        C:\Windows\SysWOW64\Gjgmpkfl.exe
        
        C:\Windows\system32\Gjgmpkfl.exe
        350⤵
        Drops file in System32 directory
        
        PID:8464
        
        C:\Windows\SysWOW64\Gcpaiq32.exe
        
        C:\Windows\system32\Gcpaiq32.exe
        351⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Gpgbna32.exe
        
        C:\Windows\system32\Gpgbna32.exe
        352⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Gjlfkj32.exe
        
        C:\Windows\system32\Gjlfkj32.exe
        353⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Gbgkpm32.exe
        
        C:\Windows\system32\Gbgkpm32.exe
        354⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Gmmome32.exe
        
        C:\Windows\system32\Gmmome32.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8812
        
        C:\Windows\SysWOW64\Gbjhelnp.exe
        
        C:\Windows\system32\Gbjhelnp.exe
        356⤵
        Drops file in System32 directory
        
        PID:8860
        
        C:\Windows\SysWOW64\Hfhqkk32.exe
        
        C:\Windows\system32\Hfhqkk32.exe
        357⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Hameic32.exe
        
        C:\Windows\system32\Hameic32.exe
        358⤵
        Modifies registry class
        
        PID:9044
        
        C:\Windows\SysWOW64\Hfjmajbc.exe
        
        C:\Windows\system32\Hfjmajbc.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9104
        
        C:\Windows\SysWOW64\Hmdend32.exe
        
        C:\Windows\system32\Hmdend32.exe
        360⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Hikfbeod.exe
        
        C:\Windows\system32\Hikfbeod.exe
        361⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Hpenpp32.exe
        
        C:\Windows\system32\Hpenpp32.exe
        362⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Hjjbmhfg.exe
        
        C:\Windows\system32\Hjjbmhfg.exe
        363⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Hfacai32.exe
        
        C:\Windows\system32\Hfacai32.exe
        364⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Iafgob32.exe
        
        C:\Windows\system32\Iafgob32.exe
        365⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Ifcpgiji.exe
        
        C:\Windows\system32\Ifcpgiji.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5376
        
        C:\Windows\SysWOW64\Ipldpo32.exe
        
        C:\Windows\system32\Ipldpo32.exe
        367⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Ijaimg32.exe
        
        C:\Windows\system32\Ijaimg32.exe
        368⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Ibmmbj32.exe
        
        C:\Windows\system32\Ibmmbj32.exe
        369⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Imbaobmp.exe
        
        C:\Windows\system32\Imbaobmp.exe
        370⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Ibojgikg.exe
        
        C:\Windows\system32\Ibojgikg.exe
        371⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Imdndbkn.exe
        
        C:\Windows\system32\Imdndbkn.exe
        372⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9192
        
        C:\Windows\SysWOW64\Ibagmiie.exe
        
        C:\Windows\system32\Ibagmiie.exe
        373⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\Jikojcaa.exe
        
        C:\Windows\system32\Jikojcaa.exe
        374⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8372
        
        C:\Windows\SysWOW64\Jpegfm32.exe
        
        C:\Windows\system32\Jpegfm32.exe
        375⤵
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Jaddpppa.exe
        
        C:\Windows\system32\Jaddpppa.exe
        376⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Jfalhgni.exe
        
        C:\Windows\system32\Jfalhgni.exe
        377⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Jagqfp32.exe
        
        C:\Windows\system32\Jagqfp32.exe
        378⤵
        Drops file in System32 directory
        
        PID:8828
        
        C:\Windows\SysWOW64\Jjoeoedo.exe
        
        C:\Windows\system32\Jjoeoedo.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8932
        
        C:\Windows\SysWOW64\Jplmglbf.exe
        
        C:\Windows\system32\Jplmglbf.exe
        380⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9028
        
        C:\Windows\SysWOW64\Jkaadebl.exe
        
        C:\Windows\system32\Jkaadebl.exe
        381⤵
        Drops file in System32 directory
        
        PID:3224
        
        C:\Windows\SysWOW64\Jdjfmjhm.exe
        
        C:\Windows\system32\Jdjfmjhm.exe
        382⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Kigoeagd.exe
        
        C:\Windows\system32\Kigoeagd.exe
        383⤵
        Modifies registry class
        
        PID:8628
        
        C:\Windows\SysWOW64\Kpagbk32.exe
        
        C:\Windows\system32\Kpagbk32.exe
        384⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Kdalni32.exe
        
        C:\Windows\system32\Kdalni32.exe
        385⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Kkmapc32.exe
        
        C:\Windows\system32\Kkmapc32.exe
        386⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Kagimmol.exe
        
        C:\Windows\system32\Kagimmol.exe
        387⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Lgdbedmc.exe
        
        C:\Windows\system32\Lgdbedmc.exe
        388⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Lajfbmmi.exe
        
        C:\Windows\system32\Lajfbmmi.exe
        389⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\Lgfojd32.exe
        
        C:\Windows\system32\Lgfojd32.exe
        390⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Lcmopeae.exe
        
        C:\Windows\system32\Lcmopeae.exe
        391⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Ligglo32.exe
        
        C:\Windows\system32\Ligglo32.exe
        392⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Lngmhm32.exe
        
        C:\Windows\system32\Lngmhm32.exe
        393⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Mjnnmn32.exe
        
        C:\Windows\system32\Mjnnmn32.exe
        394⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\Mcgbfcij.exe
        
        C:\Windows\system32\Mcgbfcij.exe
        395⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\Mnlfclip.exe
        
        C:\Windows\system32\Mnlfclip.exe
        396⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\Mdfopf32.exe
        
        C:\Windows\system32\Mdfopf32.exe
        397⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Mnochl32.exe
        
        C:\Windows\system32\Mnochl32.exe
        398⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Mcklac32.exe
        
        C:\Windows\system32\Mcklac32.exe
        399⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Mallojmd.exe
        
        C:\Windows\system32\Mallojmd.exe
        400⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Mjhqcmjo.exe
        
        C:\Windows\system32\Mjhqcmjo.exe
        401⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Ndmepe32.exe
        
        C:\Windows\system32\Ndmepe32.exe
        402⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Njjmil32.exe
        
        C:\Windows\system32\Njjmil32.exe
        403⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Ngnnbq32.exe
        
        C:\Windows\system32\Ngnnbq32.exe
        404⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Nqfbkf32.exe
        
        C:\Windows\system32\Nqfbkf32.exe
        405⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Nklfho32.exe
        
        C:\Windows\system32\Nklfho32.exe
        406⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Nqklfe32.exe
        
        C:\Windows\system32\Nqklfe32.exe
        407⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Oqmhlego.exe
        
        C:\Windows\system32\Oqmhlego.exe
        408⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Ojfmdk32.exe
        
        C:\Windows\system32\Ojfmdk32.exe
        409⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Oqpeaeel.exe
        
        C:\Windows\system32\Oqpeaeel.exe
        410⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Okeinn32.exe
        
        C:\Windows\system32\Okeinn32.exe
        411⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Ocqncp32.exe
        
        C:\Windows\system32\Ocqncp32.exe
        412⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Onfbpi32.exe
        
        C:\Windows\system32\Onfbpi32.exe
        413⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Odpjmcjp.exe
        
        C:\Windows\system32\Odpjmcjp.exe
        414⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Odbgbb32.exe
        
        C:\Windows\system32\Odbgbb32.exe
        415⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Onklkhnn.exe
        
        C:\Windows\system32\Onklkhnn.exe
        416⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Pcgdcome.exe
        
        C:\Windows\system32\Pcgdcome.exe
        417⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Pbhdafdd.exe
        
        C:\Windows\system32\Pbhdafdd.exe
        418⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Pcjaio32.exe
        
        C:\Windows\system32\Pcjaio32.exe
        419⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Peimcaae.exe
        
        C:\Windows\system32\Peimcaae.exe
        420⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Pnaalghe.exe
        
        C:\Windows\system32\Pnaalghe.exe
        421⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Pcojdnfm.exe
        
        C:\Windows\system32\Pcojdnfm.exe
        422⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Pndoagfc.exe
        
        C:\Windows\system32\Pndoagfc.exe
        423⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Pcagjndj.exe
        
        C:\Windows\system32\Pcagjndj.exe
        424⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Qbbggeli.exe
        
        C:\Windows\system32\Qbbggeli.exe
        425⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Qkjlpk32.exe
        
        C:\Windows\system32\Qkjlpk32.exe
        426⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Qcepem32.exe
        
        C:\Windows\system32\Qcepem32.exe
        427⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Aaianaoo.exe
        
        C:\Windows\system32\Aaianaoo.exe
        428⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Abimhd32.exe
        
        C:\Windows\system32\Abimhd32.exe
        429⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Alaaajmb.exe
        
        C:\Windows\system32\Alaaajmb.exe
        430⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\Aanjiqki.exe
        
        C:\Windows\system32\Aanjiqki.exe
        431⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Ahhbfkbf.exe
        
        C:\Windows\system32\Ahhbfkbf.exe
        432⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Aaccdp32.exe
        
        C:\Windows\system32\Aaccdp32.exe
        433⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Blhhaigj.exe
        
        C:\Windows\system32\Blhhaigj.exe
        434⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Beqljn32.exe
        
        C:\Windows\system32\Beqljn32.exe
        435⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Bniacddk.exe
        
        C:\Windows\system32\Bniacddk.exe
        436⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Bhaeli32.exe
        
        C:\Windows\system32\Bhaeli32.exe
        437⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Boknic32.exe
        
        C:\Windows\system32\Boknic32.exe
        438⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Bhdbaihi.exe
        
        C:\Windows\system32\Bhdbaihi.exe
        439⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Bopgdcnc.exe
        
        C:\Windows\system32\Bopgdcnc.exe
        440⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Bejoqm32.exe
        
        C:\Windows\system32\Bejoqm32.exe
        441⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\Ckghid32.exe
        
        C:\Windows\system32\Ckghid32.exe
        442⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Cellfm32.exe
        
        C:\Windows\system32\Cellfm32.exe
        443⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Coepob32.exe
        
        C:\Windows\system32\Coepob32.exe
        444⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Cbcieqpd.exe
        
        C:\Windows\system32\Cbcieqpd.exe
        445⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Chpangnk.exe
        
        C:\Windows\system32\Chpangnk.exe
        446⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\Cbefkp32.exe
        
        C:\Windows\system32\Cbefkp32.exe
        447⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Clmjcfdb.exe
        
        C:\Windows\system32\Clmjcfdb.exe
        448⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Cajblmci.exe
        
        C:\Windows\system32\Cajblmci.exe
        449⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Dhdkig32.exe
        
        C:\Windows\system32\Dhdkig32.exe
        450⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Dbjofp32.exe
        
        C:\Windows\system32\Dbjofp32.exe
        451⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Dlbcoe32.exe
        
        C:\Windows\system32\Dlbcoe32.exe
        452⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Dejhgkgm.exe
        
        C:\Windows\system32\Dejhgkgm.exe
        453⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Docmqp32.exe
        
        C:\Windows\system32\Docmqp32.exe
        454⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Ddpeigle.exe
        
        C:\Windows\system32\Ddpeigle.exe
        455⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Dcaefo32.exe
        
        C:\Windows\system32\Dcaefo32.exe
        456⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Dhnnoe32.exe
        
        C:\Windows\system32\Dhnnoe32.exe
        457⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Dafbhkhl.exe
        
        C:\Windows\system32\Dafbhkhl.exe
        458⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Eceoanpo.exe
        
        C:\Windows\system32\Eceoanpo.exe
        459⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Ehbgjenf.exe
        
        C:\Windows\system32\Ehbgjenf.exe
        460⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Eefhcimp.exe
        
        C:\Windows\system32\Eefhcimp.exe
        461⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Ekcplp32.exe
        
        C:\Windows\system32\Ekcplp32.exe
        462⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Eehdii32.exe
        
        C:\Windows\system32\Eehdii32.exe
        463⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\Elbmebbj.exe
        
        C:\Windows\system32\Elbmebbj.exe
        464⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Ednajepe.exe
        
        C:\Windows\system32\Ednajepe.exe
        465⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Ecoahmhd.exe
        
        C:\Windows\system32\Ecoahmhd.exe
        466⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Flgfqb32.exe
        
        C:\Windows\system32\Flgfqb32.exe
        467⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Fadoii32.exe
        
        C:\Windows\system32\Fadoii32.exe
        468⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\Fhngfcdi.exe
        
        C:\Windows\system32\Fhngfcdi.exe
        469⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\Ffbgog32.exe
        
        C:\Windows\system32\Ffbgog32.exe
        470⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\Fhbpqb32.exe
        
        C:\Windows\system32\Fhbpqb32.exe
        471⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Fffqjfom.exe
        
        C:\Windows\system32\Fffqjfom.exe
        472⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\Fooecl32.exe
        
        C:\Windows\system32\Fooecl32.exe
        473⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Gfimpfmj.exe
        
        C:\Windows\system32\Gfimpfmj.exe
        474⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\Goabhl32.exe
        
        C:\Windows\system32\Goabhl32.exe
        475⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\Glebbpbd.exe
        
        C:\Windows\system32\Glebbpbd.exe
        476⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Gfpcpefb.exe
        
        C:\Windows\system32\Gfpcpefb.exe
        477⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\Gbgdef32.exe
        
        C:\Windows\system32\Gbgdef32.exe
        478⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Gkoinlbg.exe
        
        C:\Windows\system32\Gkoinlbg.exe
        479⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Hkaedk32.exe
        
        C:\Windows\system32\Hkaedk32.exe
        480⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\Hiefmp32.exe
        
        C:\Windows\system32\Hiefmp32.exe
        481⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\Hbnjfefo.exe
        
        C:\Windows\system32\Hbnjfefo.exe
        482⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Hmcocn32.exe
        
        C:\Windows\system32\Hmcocn32.exe
        483⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\Hijohoki.exe
        
        C:\Windows\system32\Hijohoki.exe
        484⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Hfnpacjb.exe
        
        C:\Windows\system32\Hfnpacjb.exe
        485⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Iioicn32.exe
        
        C:\Windows\system32\Iioicn32.exe
        486⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Ibgmldnd.exe
        
        C:\Windows\system32\Ibgmldnd.exe
        487⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Ilpaei32.exe
        
        C:\Windows\system32\Ilpaei32.exe
        488⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Iicboncn.exe
        
        C:\Windows\system32\Iicboncn.exe
        489⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Ipmjkh32.exe
        
        C:\Windows\system32\Ipmjkh32.exe
        490⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Ifgbhbbh.exe
        
        C:\Windows\system32\Ifgbhbbh.exe
        491⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Ippgqg32.exe
        
        C:\Windows\system32\Ippgqg32.exe
        492⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Ilfhfh32.exe
        
        C:\Windows\system32\Ilfhfh32.exe
        493⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\Jbqpbbfi.exe
        
        C:\Windows\system32\Jbqpbbfi.exe
        494⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\Jpdqlgdc.exe
        
        C:\Windows\system32\Jpdqlgdc.exe
        495⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Jmhaek32.exe
        
        C:\Windows\system32\Jmhaek32.exe
        496⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Jbeinb32.exe
        
        C:\Windows\system32\Jbeinb32.exe
        497⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Jpijgf32.exe
        
        C:\Windows\system32\Jpijgf32.exe
        498⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Jefbomoe.exe
        
        C:\Windows\system32\Jefbomoe.exe
        499⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Jcgbmd32.exe
        
        C:\Windows\system32\Jcgbmd32.exe
        500⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\Jmpgfjmd.exe
        
        C:\Windows\system32\Jmpgfjmd.exe
        501⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Kdiobd32.exe
        
        C:\Windows\system32\Kdiobd32.exe
        502⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Klljhe32.exe
        
        C:\Windows\system32\Klljhe32.exe
        503⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Llngmeja.exe
        
        C:\Windows\system32\Llngmeja.exe
        504⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Lbhojo32.exe
        
        C:\Windows\system32\Lbhojo32.exe
        505⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Lplpcc32.exe
        
        C:\Windows\system32\Lplpcc32.exe
        506⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\Lffhpnhe.exe
        
        C:\Windows\system32\Lffhpnhe.exe
        507⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Ldjhib32.exe
        
        C:\Windows\system32\Ldjhib32.exe
        508⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Lekeajmm.exe
        
        C:\Windows\system32\Lekeajmm.exe
        509⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Liimgh32.exe
        
        C:\Windows\system32\Liimgh32.exe
        510⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Lpcedbjp.exe
        
        C:\Windows\system32\Lpcedbjp.exe
        511⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Lgmnqmam.exe
        
        C:\Windows\system32\Lgmnqmam.exe
        512⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Mdanjaqf.exe
        
        C:\Windows\system32\Mdanjaqf.exe
        513⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Mgagll32.exe
        
        C:\Windows\system32\Mgagll32.exe
        514⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Mipchg32.exe
        
        C:\Windows\system32\Mipchg32.exe
        515⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Mmnlnfcb.exe
        
        C:\Windows\system32\Mmnlnfcb.exe
        516⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Mckefmai.exe
        
        C:\Windows\system32\Mckefmai.exe
        517⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Mnpice32.exe
        
        C:\Windows\system32\Mnpice32.exe
        518⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Nneboemj.exe
        
        C:\Windows\system32\Nneboemj.exe
        519⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Ngmggj32.exe
        
        C:\Windows\system32\Ngmggj32.exe
        520⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Njnpie32.exe
        
        C:\Windows\system32\Njnpie32.exe
        521⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Ngbpbjoe.exe
        
        C:\Windows\system32\Ngbpbjoe.exe
        522⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Odhman32.exe
        
        C:\Windows\system32\Odhman32.exe
        523⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Onqbjccl.exe
        
        C:\Windows\system32\Onqbjccl.exe
        524⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Ocmjcjad.exe
        
        C:\Windows\system32\Ocmjcjad.exe
        525⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Oqakln32.exe
        
        C:\Windows\system32\Oqakln32.exe
        526⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Oqfdgn32.exe
        
        C:\Windows\system32\Oqfdgn32.exe
        527⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Pnjeqbkb.exe
        
        C:\Windows\system32\Pnjeqbkb.exe
        528⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Pcgmiiii.exe
        
        C:\Windows\system32\Pcgmiiii.exe
        529⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Pdfjcl32.exe
        
        C:\Windows\system32\Pdfjcl32.exe
        530⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Pcncjh32.exe
        
        C:\Windows\system32\Pcncjh32.exe
        531⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Pdmpck32.exe
        
        C:\Windows\system32\Pdmpck32.exe
        532⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Qmhdhm32.exe
        
        C:\Windows\system32\Qmhdhm32.exe
        533⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Qgnief32.exe
        
        C:\Windows\system32\Qgnief32.exe
        534⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Qqfmnk32.exe
        
        C:\Windows\system32\Qqfmnk32.exe
        535⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Anjngp32.exe
        
        C:\Windows\system32\Anjngp32.exe
        536⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Ampkil32.exe
        
        C:\Windows\system32\Ampkil32.exe
        537⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\Anadho32.exe
        
        C:\Windows\system32\Anadho32.exe
        538⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Acnlqe32.exe
        
        C:\Windows\system32\Acnlqe32.exe
        539⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Babmjj32.exe
        
        C:\Windows\system32\Babmjj32.exe
        540⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Bcebadof.exe
        
        C:\Windows\system32\Bcebadof.exe
        541⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Bjokno32.exe
        
        C:\Windows\system32\Bjokno32.exe
        542⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Beeokgei.exe
        
        C:\Windows\system32\Beeokgei.exe
        543⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Bmbpeiaa.exe
        
        C:\Windows\system32\Bmbpeiaa.exe
        544⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Chhdbb32.exe
        
        C:\Windows\system32\Chhdbb32.exe
        545⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Cmdmki32.exe
        
        C:\Windows\system32\Cmdmki32.exe
        546⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Cdabmcdi.exe
        
        C:\Windows\system32\Cdabmcdi.exe
        547⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Cmlckhig.exe
        
        C:\Windows\system32\Cmlckhig.exe
        548⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Cokpekpj.exe
        
        C:\Windows\system32\Cokpekpj.exe
        549⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Dmcilgco.exe
        
        C:\Windows\system32\Dmcilgco.exe
        550⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Dmgbgf32.exe
        
        C:\Windows\system32\Dmgbgf32.exe
        551⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Dkkcqj32.exe
        
        C:\Windows\system32\Dkkcqj32.exe
        552⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Eaekmdep.exe
        
        C:\Windows\system32\Eaekmdep.exe
        553⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Egdqkk32.exe
        
        C:\Windows\system32\Egdqkk32.exe
        554⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Eajehd32.exe
        
        C:\Windows\system32\Eajehd32.exe
        555⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Ehdmenhh.exe
        
        C:\Windows\system32\Ehdmenhh.exe
        556⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Emaemefo.exe
        
        C:\Windows\system32\Emaemefo.exe
        557⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Edknjonl.exe
        
        C:\Windows\system32\Edknjonl.exe
        558⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Eejjdb32.exe
        
        C:\Windows\system32\Eejjdb32.exe
        559⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Fobomglo.exe
        
        C:\Windows\system32\Fobomglo.exe
        560⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Femgia32.exe
        
        C:\Windows\system32\Femgia32.exe
        561⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Fgncaj32.exe
        
        C:\Windows\system32\Fgncaj32.exe
        562⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Fachob32.exe
        
        C:\Windows\system32\Fachob32.exe
        563⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Fhmpkmpm.exe
        
        C:\Windows\system32\Fhmpkmpm.exe
        564⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Fnjhccnd.exe
        
        C:\Windows\system32\Fnjhccnd.exe
        565⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Fddqpn32.exe
        
        C:\Windows\system32\Fddqpn32.exe
        566⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Fojenfeg.exe
        
        C:\Windows\system32\Fojenfeg.exe
        567⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Fdfmfmdo.exe
        
        C:\Windows\system32\Fdfmfmdo.exe
        568⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Fdijkmbl.exe
        
        C:\Windows\system32\Fdijkmbl.exe
        569⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Gnckjbfj.exe
        
        C:\Windows\system32\Gnckjbfj.exe
        570⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\Ghiogkfp.exe
        
        C:\Windows\system32\Ghiogkfp.exe
        571⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Gochceml.exe
        
        C:\Windows\system32\Gochceml.exe
        572⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Ghklmk32.exe
        
        C:\Windows\system32\Ghklmk32.exe
        573⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Goediekj.exe
        
        C:\Windows\system32\Goediekj.exe
        574⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Gdbmalja.exe
        
        C:\Windows\system32\Gdbmalja.exe
        575⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Gddigk32.exe
        
        C:\Windows\system32\Gddigk32.exe
        576⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Hnmnpano.exe
        
        C:\Windows\system32\Hnmnpano.exe
        577⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Holjjd32.exe
        
        C:\Windows\system32\Holjjd32.exe
        578⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Hkckoe32.exe
        
        C:\Windows\system32\Hkckoe32.exe
        579⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Hgjldfqj.exe
        
        C:\Windows\system32\Hgjldfqj.exe
        580⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Hbppaopp.exe
        
        C:\Windows\system32\Hbppaopp.exe
        581⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Hnfafpfd.exe
        
        C:\Windows\system32\Hnfafpfd.exe
        582⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Ininloda.exe
        
        C:\Windows\system32\Ininloda.exe
        583⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Igabdekb.exe
        
        C:\Windows\system32\Igabdekb.exe
        584⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Ibffbnjh.exe
        
        C:\Windows\system32\Ibffbnjh.exe
        585⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Iojgkbib.exe
        
        C:\Windows\system32\Iojgkbib.exe
        586⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Ikcdfbmc.exe
        
        C:\Windows\system32\Ikcdfbmc.exe
        587⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Ibnlbm32.exe
        
        C:\Windows\system32\Ibnlbm32.exe
        588⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Jkfakb32.exe
        
        C:\Windows\system32\Jkfakb32.exe
        589⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Jbpihlbn.exe
        
        C:\Windows\system32\Jbpihlbn.exe
        590⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Jeqbjgoo.exe
        
        C:\Windows\system32\Jeqbjgoo.exe
        591⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Jpffgp32.exe
        
        C:\Windows\system32\Jpffgp32.exe
        592⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Jecoog32.exe
        
        C:\Windows\system32\Jecoog32.exe
        593⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Jphcmp32.exe
        
        C:\Windows\system32\Jphcmp32.exe
        594⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Jfbkijdo.exe
        
        C:\Windows\system32\Jfbkijdo.exe
        595⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Kblidkhp.exe
        
        C:\Windows\system32\Kblidkhp.exe
        596⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Kppimogj.exe
        
        C:\Windows\system32\Kppimogj.exe
        597⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Knefnkla.exe
        
        C:\Windows\system32\Knefnkla.exe
        598⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Kijjldkh.exe
        
        C:\Windows\system32\Kijjldkh.exe
        599⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\Kbbodj32.exe
        
        C:\Windows\system32\Kbbodj32.exe
        600⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Llmpco32.exe
        
        C:\Windows\system32\Llmpco32.exe
        601⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Lbghpinc.exe
        
        C:\Windows\system32\Lbghpinc.exe
        602⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Lhdqhp32.exe
        
        C:\Windows\system32\Lhdqhp32.exe
        603⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Lbjeei32.exe
        
        C:\Windows\system32\Lbjeei32.exe
        604⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Lhfmmp32.exe
        
        C:\Windows\system32\Lhfmmp32.exe
        605⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Lejngd32.exe
        
        C:\Windows\system32\Lejngd32.exe
        606⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Lppbdmig.exe
        
        C:\Windows\system32\Lppbdmig.exe
        607⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Lihfmb32.exe
        
        C:\Windows\system32\Lihfmb32.exe
        608⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Mbqkfhfh.exe
        
        C:\Windows\system32\Mbqkfhfh.exe
        609⤵
        
        PID:640
        
        C:\Windows\SysWOW64\Mlipomli.exe
        
        C:\Windows\system32\Mlipomli.exe
        610⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Mbchkg32.exe
        
        C:\Windows\system32\Mbchkg32.exe
        611⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Mbedag32.exe
        
        C:\Windows\system32\Mbedag32.exe
        612⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Mfcmge32.exe
        
        C:\Windows\system32\Mfcmge32.exe
        613⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Moobkh32.exe
        
        C:\Windows\system32\Moobkh32.exe
        614⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Mpnnek32.exe
        
        C:\Windows\system32\Mpnnek32.exe
        615⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Nfhfbedd.exe
        
        C:\Windows\system32\Nfhfbedd.exe
        616⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Nleojlbk.exe
        
        C:\Windows\system32\Nleojlbk.exe
        617⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Nlglpkpi.exe
        
        C:\Windows\system32\Nlglpkpi.exe
        618⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Npedfjfo.exe
        
        C:\Windows\system32\Npedfjfo.exe
        619⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Nhpijldj.exe
        
        C:\Windows\system32\Nhpijldj.exe
        620⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Nipedokm.exe
        
        C:\Windows\system32\Nipedokm.exe
        621⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Ogcfncjf.exe
        
        C:\Windows\system32\Ogcfncjf.exe
        622⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\Oeicopoo.exe
        
        C:\Windows\system32\Oeicopoo.exe
        623⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Oekpdoll.exe
        
        C:\Windows\system32\Oekpdoll.exe
        624⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Opqdbhlb.exe
        
        C:\Windows\system32\Opqdbhlb.exe
        625⤵
        
        PID:868
        
        C:\Windows\SysWOW64\Ohlifj32.exe
        
        C:\Windows\system32\Ohlifj32.exe
        626⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Ppemmg32.exe
        
        C:\Windows\system32\Ppemmg32.exe
        627⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Pcffoben.exe
        
        C:\Windows\system32\Pcffoben.exe
        628⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Plagmh32.exe
        
        C:\Windows\system32\Plagmh32.exe
        629⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Pgfljqia.exe
        
        C:\Windows\system32\Pgfljqia.exe
        630⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Poaqocgl.exe
        
        C:\Windows\system32\Poaqocgl.exe
        631⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Pjgellfb.exe
        
        C:\Windows\system32\Pjgellfb.exe
        632⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Qcpieamc.exe
        
        C:\Windows\system32\Qcpieamc.exe
        633⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Qlhnng32.exe
        
        C:\Windows\system32\Qlhnng32.exe
        634⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Qfpbfljd.exe
        
        C:\Windows\system32\Qfpbfljd.exe
        635⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Agpoqoaf.exe
        
        C:\Windows\system32\Agpoqoaf.exe
        636⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Aichng32.exe
        
        C:\Windows\system32\Aichng32.exe
        637⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Aompjamo.exe
        
        C:\Windows\system32\Aompjamo.exe
        638⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Aifdcgcp.exe
        
        C:\Windows\system32\Aifdcgcp.exe
        639⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Ajeami32.exe
        
        C:\Windows\system32\Ajeami32.exe
        640⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Aobieq32.exe
        
        C:\Windows\system32\Aobieq32.exe
        641⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Bodfkpfg.exe
        
        C:\Windows\system32\Bodfkpfg.exe
        642⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Bmhfddeq.exe
        
        C:\Windows\system32\Bmhfddeq.exe
        643⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Boipfp32.exe
        
        C:\Windows\system32\Boipfp32.exe
        644⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Bmmppc32.exe
        
        C:\Windows\system32\Bmmppc32.exe
        645⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Bcghlnih.exe
        
        C:\Windows\system32\Bcghlnih.exe
        646⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Bmomecoi.exe
        
        C:\Windows\system32\Bmomecoi.exe
        647⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Cfhani32.exe
        
        C:\Windows\system32\Cfhani32.exe
        648⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Cclagm32.exe
        
        C:\Windows\system32\Cclagm32.exe
        649⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Cihjpd32.exe
        
        C:\Windows\system32\Cihjpd32.exe
        650⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Cgijnk32.exe
        
        C:\Windows\system32\Cgijnk32.exe
        651⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Cikgecag.exe
        
        C:\Windows\system32\Cikgecag.exe
        652⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Ccpkblqn.exe
        
        C:\Windows\system32\Ccpkblqn.exe
        653⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Cmipkb32.exe
        
        C:\Windows\system32\Cmipkb32.exe
        654⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Cgndikgd.exe
        
        C:\Windows\system32\Cgndikgd.exe
        655⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Cmklaaek.exe
        
        C:\Windows\system32\Cmklaaek.exe
        656⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Djomjfde.exe
        
        C:\Windows\system32\Djomjfde.exe
        657⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Dplebmbl.exe
        
        C:\Windows\system32\Dplebmbl.exe
        658⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\Didjkbim.exe
        
        C:\Windows\system32\Didjkbim.exe
        659⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\Dhejij32.exe
        
        C:\Windows\system32\Dhejij32.exe
        660⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\Dannbogl.exe
        
        C:\Windows\system32\Dannbogl.exe
        661⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Dapkho32.exe
        
        C:\Windows\system32\Dapkho32.exe
        662⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Emihbp32.exe
        
        C:\Windows\system32\Emihbp32.exe
        663⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Efamkepl.exe
        
        C:\Windows\system32\Efamkepl.exe
        664⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Eagahnob.exe
        
        C:\Windows\system32\Eagahnob.exe
        665⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Emnbmoef.exe
        
        C:\Windows\system32\Emnbmoef.exe
        666⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Ealkcm32.exe
        
        C:\Windows\system32\Ealkcm32.exe
        667⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Eigohp32.exe
        
        C:\Windows\system32\Eigohp32.exe
        668⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Fhhpfg32.exe
        
        C:\Windows\system32\Fhhpfg32.exe
        669⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\Fapdomgg.exe
        
        C:\Windows\system32\Fapdomgg.exe
        670⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Fmgecn32.exe
        
        C:\Windows\system32\Fmgecn32.exe
        671⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Fdamph32.exe
        
        C:\Windows\system32\Fdamph32.exe
        672⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Fkmbbajb.exe
        
        C:\Windows\system32\Fkmbbajb.exe
        673⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Fgdbgbof.exe
        
        C:\Windows\system32\Fgdbgbof.exe
        674⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Gdhcagnp.exe
        
        C:\Windows\system32\Gdhcagnp.exe
        675⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Gielinlg.exe
        
        C:\Windows\system32\Gielinlg.exe
        676⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Ggilbb32.exe
        
        C:\Windows\system32\Ggilbb32.exe
        677⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Gdmmlf32.exe
        
        C:\Windows\system32\Gdmmlf32.exe
        678⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Gpcmagpo.exe
        
        C:\Windows\system32\Gpcmagpo.exe
        679⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Hgboiq32.exe
        
        C:\Windows\system32\Hgboiq32.exe
        680⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Hhbkccji.exe
        
        C:\Windows\system32\Hhbkccji.exe
        681⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\Hajpli32.exe
        
        C:\Windows\system32\Hajpli32.exe
        682⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Halmaiog.exe
        
        C:\Windows\system32\Halmaiog.exe
        683⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Hncmfj32.exe
        
        C:\Windows\system32\Hncmfj32.exe
        684⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Hglaookl.exe
        
        C:\Windows\system32\Hglaookl.exe
        685⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Ipdfheal.exe
        
        C:\Windows\system32\Ipdfheal.exe
        686⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Ikijenab.exe
        
        C:\Windows\system32\Ikijenab.exe
        687⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Ihnkobpl.exe
        
        C:\Windows\system32\Ihnkobpl.exe
        688⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Iddlccfp.exe
        
        C:\Windows\system32\Iddlccfp.exe
        689⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Idfhibdn.exe
        
        C:\Windows\system32\Idfhibdn.exe
        690⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\Ikqqfm32.exe
        
        C:\Windows\system32\Ikqqfm32.exe
        691⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Iqmincia.exe
        
        C:\Windows\system32\Iqmincia.exe
        692⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Jjfngi32.exe
        
        C:\Windows\system32\Jjfngi32.exe
        693⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Jkejalge.exe
        
        C:\Windows\system32\Jkejalge.exe
        694⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Jqgldb32.exe
        
        C:\Windows\system32\Jqgldb32.exe
        695⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Jklpakam.exe
        
        C:\Windows\system32\Jklpakam.exe
        696⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Jipqkopf.exe
        
        C:\Windows\system32\Jipqkopf.exe
        697⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Kgenlldo.exe
        
        C:\Windows\system32\Kgenlldo.exe
        698⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Kiejfo32.exe
        
        C:\Windows\system32\Kiejfo32.exe
        699⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Kbpkdd32.exe
        
        C:\Windows\system32\Kbpkdd32.exe
        700⤵
        
        PID:412
        
        C:\Windows\SysWOW64\Knfliefc.exe
        
        C:\Windows\system32\Knfliefc.exe
        701⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Lkjlciem.exe
        
        C:\Windows\system32\Lkjlciem.exe
        702⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Linmlm32.exe
        
        C:\Windows\system32\Linmlm32.exe
        703⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Lnkedd32.exe
        
        C:\Windows\system32\Lnkedd32.exe
        704⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Leenanik.exe
        
        C:\Windows\system32\Leenanik.exe
        705⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Licfgmpa.exe
        
        C:\Windows\system32\Licfgmpa.exe
        706⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Llcoihmb.exe
        
        C:\Windows\system32\Llcoihmb.exe
        707⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Lelcbmcc.exe
        
        C:\Windows\system32\Lelcbmcc.exe
        708⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Mngepb32.exe
        
        C:\Windows\system32\Mngepb32.exe
        709⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Milinkgf.exe
        
        C:\Windows\system32\Milinkgf.exe
        710⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Mjneec32.exe
        
        C:\Windows\system32\Mjneec32.exe
        711⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Mecjbl32.exe
        
        C:\Windows\system32\Mecjbl32.exe
        712⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Mlmbofdh.exe
        
        C:\Windows\system32\Mlmbofdh.exe
        713⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Mlooef32.exe
        
        C:\Windows\system32\Mlooef32.exe
        714⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Malgmm32.exe
        
        C:\Windows\system32\Malgmm32.exe
        715⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Nifldj32.exe
        
        C:\Windows\system32\Nifldj32.exe
        716⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Neoink32.exe
        
        C:\Windows\system32\Neoink32.exe
        717⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\Naejcl32.exe
        
        C:\Windows\system32\Naejcl32.exe
        718⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Nlknqd32.exe
        
        C:\Windows\system32\Nlknqd32.exe
        719⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\Oolgbpei.exe
        
        C:\Windows\system32\Oolgbpei.exe
        720⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\Okbhgq32.exe
        
        C:\Windows\system32\Okbhgq32.exe
        721⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Oidhehcl.exe
        
        C:\Windows\system32\Oidhehcl.exe
        722⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Oblmnmjl.exe
        
        C:\Windows\system32\Oblmnmjl.exe
        723⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Oocmcn32.exe
        
        C:\Windows\system32\Oocmcn32.exe
        724⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Oemephgn.exe
        
        C:\Windows\system32\Oemephgn.exe
        725⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Piknfgmd.exe
        
        C:\Windows\system32\Piknfgmd.exe
        726⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Pcccol32.exe
        
        C:\Windows\system32\Pcccol32.exe
        727⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Pllggbje.exe
        
        C:\Windows\system32\Pllggbje.exe
        728⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Polpim32.exe
        
        C:\Windows\system32\Polpim32.exe
        729⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\Pibdff32.exe
        
        C:\Windows\system32\Pibdff32.exe
        730⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Poomom32.exe
        
        C:\Windows\system32\Poomom32.exe
        731⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Pcmeek32.exe
        
        C:\Windows\system32\Pcmeek32.exe
        732⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Qlejnqbj.exe
        
        C:\Windows\system32\Qlejnqbj.exe
        733⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Qaabfgpa.exe
        
        C:\Windows\system32\Qaabfgpa.exe
        734⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Qoecol32.exe
        
        C:\Windows\system32\Qoecol32.exe
        735⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Aljcip32.exe
        
        C:\Windows\system32\Aljcip32.exe
        736⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Aaflag32.exe
        
        C:\Windows\system32\Aaflag32.exe
        737⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Allpnplb.exe
        
        C:\Windows\system32\Allpnplb.exe
        738⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Acheqi32.exe
        
        C:\Windows\system32\Acheqi32.exe
        739⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Akcjel32.exe
        
        C:\Windows\system32\Akcjel32.exe
        740⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Akffjkme.exe
        
        C:\Windows\system32\Akffjkme.exe
        741⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Bfkkhdlk.exe
        
        C:\Windows\system32\Bfkkhdlk.exe
        742⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Bocoqj32.exe
        
        C:\Windows\system32\Bocoqj32.exe
        743⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Bjicnbba.exe
        
        C:\Windows\system32\Bjicnbba.exe
        744⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Bkjpek32.exe
        
        C:\Windows\system32\Bkjpek32.exe
        745⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Bkmmkj32.exe
        
        C:\Windows\system32\Bkmmkj32.exe
        746⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Bkoiqjdj.exe
        
        C:\Windows\system32\Bkoiqjdj.exe
        747⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\Ccinggcj.exe
        
        C:\Windows\system32\Ccinggcj.exe
        748⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Cihcen32.exe
        
        C:\Windows\system32\Cihcen32.exe
        749⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Cfldob32.exe
        
        C:\Windows\system32\Cfldob32.exe
        750⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Codhgg32.exe
        
        C:\Windows\system32\Codhgg32.exe
        751⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\Cfnqdale.exe
        
        C:\Windows\system32\Cfnqdale.exe
        752⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\Cjlijp32.exe
        
        C:\Windows\system32\Cjlijp32.exe
        753⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\Dbgnobpg.exe
        
        C:\Windows\system32\Dbgnobpg.exe
        754⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\Dmmblkpm.exe
        
        C:\Windows\system32\Dmmblkpm.exe
        755⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Dbikdbnd.exe
        
        C:\Windows\system32\Dbikdbnd.exe
        756⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Dcigneeg.exe
        
        C:\Windows\system32\Dcigneeg.exe
        757⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Dldlbgbb.exe
        
        C:\Windows\system32\Dldlbgbb.exe
        758⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Dfjpppbh.exe
        
        C:\Windows\system32\Dfjpppbh.exe
        759⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Emfebjgb.exe
        
        C:\Windows\system32\Emfebjgb.exe
        760⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Ejjelnfl.exe
        
        C:\Windows\system32\Ejjelnfl.exe
        761⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Ebejpp32.exe
        
        C:\Windows\system32\Ebejpp32.exe
        762⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Ebggep32.exe
        
        C:\Windows\system32\Ebggep32.exe
        763⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Eplgod32.exe
        
        C:\Windows\system32\Eplgod32.exe
        764⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Ejaklmpd.exe
        
        C:\Windows\system32\Ejaklmpd.exe
        765⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\Fldeie32.exe
        
        C:\Windows\system32\Fldeie32.exe
        766⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Fbomfokl.exe
        
        C:\Windows\system32\Fbomfokl.exe
        767⤵
        
        PID:760
        
        C:\Windows\SysWOW64\Fmdach32.exe
        
        C:\Windows\system32\Fmdach32.exe
        768⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Fikbhiaf.exe
        
        C:\Windows\system32\Fikbhiaf.exe
        769⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Fmikoggm.exe
        
        C:\Windows\system32\Fmikoggm.exe
        770⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Fipkch32.exe
        
        C:\Windows\system32\Fipkch32.exe
        771⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Ffclml32.exe
        
        C:\Windows\system32\Ffclml32.exe
        772⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Gplpfb32.exe
        
        C:\Windows\system32\Gplpfb32.exe
        773⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Gjadck32.exe
        
        C:\Windows\system32\Gjadck32.exe
        774⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Gpnmka32.exe
        
        C:\Windows\system32\Gpnmka32.exe
        775⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Gfhehlhe.exe
        
        C:\Windows\system32\Gfhehlhe.exe
        776⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Gmbmefob.exe
        
        C:\Windows\system32\Gmbmefob.exe
        777⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Giinjg32.exe
        
        C:\Windows\system32\Giinjg32.exe
        778⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Gdaomobj.exe
        
        C:\Windows\system32\Gdaomobj.exe
        779⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Hkmdoi32.exe
        
        C:\Windows\system32\Hkmdoi32.exe
        780⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Hgdedj32.exe
        
        C:\Windows\system32\Hgdedj32.exe
        781⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Hdhemn32.exe
        
        C:\Windows\system32\Hdhemn32.exe
        782⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Hpofbobf.exe
        
        C:\Windows\system32\Hpofbobf.exe
        783⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Hlefgphj.exe
        
        C:\Windows\system32\Hlefgphj.exe
        784⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\Ikfgeh32.exe
        
        C:\Windows\system32\Ikfgeh32.exe
        785⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Icalij32.exe
        
        C:\Windows\system32\Icalij32.exe
        786⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\Ingpgcmj.exe
        
        C:\Windows\system32\Ingpgcmj.exe
        787⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Injmlbkh.exe
        
        C:\Windows\system32\Injmlbkh.exe
        788⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Idceim32.exe
        
        C:\Windows\system32\Idceim32.exe
        789⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Ipjenn32.exe
        
        C:\Windows\system32\Ipjenn32.exe
        790⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Ijcjgcni.exe
        
        C:\Windows\system32\Ijcjgcni.exe
        791⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Jdhndlno.exe
        
        C:\Windows\system32\Jdhndlno.exe
        792⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\Jgigfg32.exe
        
        C:\Windows\system32\Jgigfg32.exe
        793⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Jcphkhad.exe
        
        C:\Windows\system32\Jcphkhad.exe
        794⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\Jqfejl32.exe
        
        C:\Windows\system32\Jqfejl32.exe
        795⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Jjoibadl.exe
        
        C:\Windows\system32\Jjoibadl.exe
        796⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Kddnpj32.exe
        
        C:\Windows\system32\Kddnpj32.exe
        797⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Kkpbbdil.exe
        
        C:\Windows\system32\Kkpbbdil.exe
        798⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Kggcgeop.exe
        
        C:\Windows\system32\Kggcgeop.exe
        799⤵
        
        PID:1000
        
        C:\Windows\SysWOW64\Kgipmdmn.exe
        
        C:\Windows\system32\Kgipmdmn.exe
        800⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Kqbdej32.exe
        
        C:\Windows\system32\Kqbdej32.exe
        801⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Kmhejk32.exe
        
        C:\Windows\system32\Kmhejk32.exe
        802⤵
        
        PID:636
        
        C:\Windows\SysWOW64\Lgnihd32.exe
        
        C:\Windows\system32\Lgnihd32.exe
        803⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Lqfnqjpi.exe
        
        C:\Windows\system32\Lqfnqjpi.exe
        804⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Lgqfmcge.exe
        
        C:\Windows\system32\Lgqfmcge.exe
        805⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Lmmoekem.exe
        
        C:\Windows\system32\Lmmoekem.exe
        806⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Ljaooodf.exe
        
        C:\Windows\system32\Ljaooodf.exe
        807⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Lqkgli32.exe
        
        C:\Windows\system32\Lqkgli32.exe
        808⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Ljcldo32.exe
        
        C:\Windows\system32\Ljcldo32.exe
        809⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Lclpmdhd.exe
        
        C:\Windows\system32\Lclpmdhd.exe
        810⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Mgjicb32.exe
        
        C:\Windows\system32\Mgjicb32.exe
        811⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Mabnlh32.exe
        
        C:\Windows\system32\Mabnlh32.exe
        812⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Mepfbflb.exe
        
        C:\Windows\system32\Mepfbflb.exe
        813⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Mnhkklbb.exe
        
        C:\Windows\system32\Mnhkklbb.exe
        814⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Mgaoda32.exe
        
        C:\Windows\system32\Mgaoda32.exe
        815⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\Mchpibng.exe
        
        C:\Windows\system32\Mchpibng.exe
        816⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\Ncjmob32.exe
        
        C:\Windows\system32\Ncjmob32.exe
        817⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Nmbaggce.exe
        
        C:\Windows\system32\Nmbaggce.exe
        818⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Njfaalao.exe
        
        C:\Windows\system32\Njfaalao.exe
        819⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Njinfk32.exe
        
        C:\Windows\system32\Njinfk32.exe
        820⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Nmighf32.exe
        
        C:\Windows\system32\Nmighf32.exe
        821⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Nhokeolc.exe
        
        C:\Windows\system32\Nhokeolc.exe
        822⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Onicbi32.exe
        
        C:\Windows\system32\Onicbi32.exe
        823⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Omnqcfig.exe
        
        C:\Windows\system32\Omnqcfig.exe
        824⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Odjeepna.exe
        
        C:\Windows\system32\Odjeepna.exe
        825⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Odmbkolo.exe
        
        C:\Windows\system32\Odmbkolo.exe
        826⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Oobfhh32.exe
        
        C:\Windows\system32\Oobfhh32.exe
        827⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Plhcglil.exe
        
        C:\Windows\system32\Plhcglil.exe
        828⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Poimigfm.exe
        
        C:\Windows\system32\Poimigfm.exe
        829⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Pdfeandd.exe
        
        C:\Windows\system32\Pdfeandd.exe
        830⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Pkpmnh32.exe
        
        C:\Windows\system32\Pkpmnh32.exe
        831⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\Peeakakg.exe
        
        C:\Windows\system32\Peeakakg.exe
        832⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Ponfdf32.exe
        
        C:\Windows\system32\Ponfdf32.exe
        833⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Qkegiggl.exe
        
        C:\Windows\system32\Qkegiggl.exe
        834⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Qhigbl32.exe
        
        C:\Windows\system32\Qhigbl32.exe
        835⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Ahkdhk32.exe
        
        C:\Windows\system32\Ahkdhk32.exe
        836⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Amhlpb32.exe
        
        C:\Windows\system32\Amhlpb32.exe
        837⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Aogije32.exe
        
        C:\Windows\system32\Aogije32.exe
        838⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Aeaagoaj.exe
        
        C:\Windows\system32\Aeaagoaj.exe
        839⤵
        
        PID:820
        
        C:\Windows\SysWOW64\Aecnmo32.exe
        
        C:\Windows\system32\Aecnmo32.exe
        840⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Aefjbo32.exe
        
        C:\Windows\system32\Aefjbo32.exe
        841⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Bdkgckal.exe
        
        C:\Windows\system32\Bdkgckal.exe
        842⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Baohmo32.exe
        
        C:\Windows\system32\Baohmo32.exe
        843⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Bhkmoifp.exe
        
        C:\Windows\system32\Bhkmoifp.exe
        844⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Bnhegp32.exe
        
        C:\Windows\system32\Bnhegp32.exe
        845⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Bhnidi32.exe
        
        C:\Windows\system32\Bhnidi32.exe
        846⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Bddjijia.exe
        
        C:\Windows\system32\Bddjijia.exe
        847⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Bahkcn32.exe
        
        C:\Windows\system32\Bahkcn32.exe
        848⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\Colklb32.exe
        
        C:\Windows\system32\Colklb32.exe
        849⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Hbjonepq.exe
        
        C:\Windows\system32\Hbjonepq.exe
        850⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Iipfgm32.exe
        
        C:\Windows\system32\Iipfgm32.exe
        851⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Jcanfakf.exe
        
        C:\Windows\system32\Jcanfakf.exe
        852⤵
        
        PID:616
        
        C:\Windows\SysWOW64\Kpoaed32.exe
        
        C:\Windows\system32\Kpoaed32.exe
        853⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Lqcjqcnp.exe
        
        C:\Windows\system32\Lqcjqcnp.exe
        854⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Lcfphn32.exe
        
        C:\Windows\system32\Lcfphn32.exe
        855⤵
        
        PID:444
        
        C:\Windows\SysWOW64\Lnnakg32.exe
        
        C:\Windows\system32\Lnnakg32.exe
        856⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Mobjho32.exe
        
        C:\Windows\system32\Mobjho32.exe
        857⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\Mmfkac32.exe
        
        C:\Windows\system32\Mmfkac32.exe
        858⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Mqdcga32.exe
        
        C:\Windows\system32\Mqdcga32.exe
        859⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Nfeekgjo.exe
        
        C:\Windows\system32\Nfeekgjo.exe
        860⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Nfjofg32.exe
        
        C:\Windows\system32\Nfjofg32.exe
        861⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Npepdl32.exe
        
        C:\Windows\system32\Npepdl32.exe
        862⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\Nnfpbcbf.exe
        
        C:\Windows\system32\Nnfpbcbf.exe
        863⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Ojmqgd32.exe
        
        C:\Windows\system32\Ojmqgd32.exe
        864⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Onkimc32.exe
        
        C:\Windows\system32\Onkimc32.exe
        865⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Onmfcb32.exe
        
        C:\Windows\system32\Onmfcb32.exe
        866⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Ocjokijf.exe
        
        C:\Windows\system32\Ocjokijf.exe
        867⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Ombcdo32.exe
        
        C:\Windows\system32\Ombcdo32.exe
        868⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Onapnbhi.exe
        
        C:\Windows\system32\Onapnbhi.exe
        869⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Pdqelh32.exe
        
        C:\Windows\system32\Pdqelh32.exe
        870⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Pfanmcao.exe
        
        C:\Windows\system32\Pfanmcao.exe
        871⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Pdenghpi.exe
        
        C:\Windows\system32\Pdenghpi.exe
        872⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Pdhklgnf.exe
        
        C:\Windows\system32\Pdhklgnf.exe
        873⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\Pmpoemef.exe
        
        C:\Windows\system32\Pmpoemef.exe
        874⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Qjfmda32.exe
        
        C:\Windows\system32\Qjfmda32.exe
        875⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Apcemh32.exe
        
        C:\Windows\system32\Apcemh32.exe
        876⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Afmmibga.exe
        
        C:\Windows\system32\Afmmibga.exe
        877⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Ahmjce32.exe
        
        C:\Windows\system32\Ahmjce32.exe
        878⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Aaenlj32.exe
        
        C:\Windows\system32\Aaenlj32.exe
        879⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Adfgne32.exe
        
        C:\Windows\system32\Adfgne32.exe
        880⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Agfpoqog.exe
        
        C:\Windows\system32\Agfpoqog.exe
        881⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Baldmiom.exe
        
        C:\Windows\system32\Baldmiom.exe
        882⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Bhfmic32.exe
        
        C:\Windows\system32\Bhfmic32.exe
        883⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Bgkijp32.exe
        
        C:\Windows\system32\Bgkijp32.exe
        884⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Bkibqnah.exe
        
        C:\Windows\system32\Bkibqnah.exe
        885⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Bhmbjb32.exe
        
        C:\Windows\system32\Bhmbjb32.exe
        886⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Ckphamkp.exe
        
        C:\Windows\system32\Ckphamkp.exe
        887⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Calmcg32.exe
        
        C:\Windows\system32\Calmcg32.exe
        888⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Ckealm32.exe
        
        C:\Windows\system32\Ckealm32.exe
        889⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Cglbanmo.exe
        
        C:\Windows\system32\Cglbanmo.exe
        890⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Chkokq32.exe
        
        C:\Windows\system32\Chkokq32.exe
        891⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Dnhgcgbi.exe
        
        C:\Windows\system32\Dnhgcgbi.exe
        892⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Dhnlapbo.exe
        
        C:\Windows\system32\Dhnlapbo.exe
        893⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Dqipeboj.exe
        
        C:\Windows\system32\Dqipeboj.exe
        894⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Dahmoefm.exe
        
        C:\Windows\system32\Dahmoefm.exe
        895⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Dhdaao32.exe
        
        C:\Windows\system32\Dhdaao32.exe
        896⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Dqpffaib.exe
        
        C:\Windows\system32\Dqpffaib.exe
        897⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\Eglkhk32.exe
        
        C:\Windows\system32\Eglkhk32.exe
        898⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Ehlhbn32.exe
        
        C:\Windows\system32\Ehlhbn32.exe
        899⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Edbhgokc.exe
        
        C:\Windows\system32\Edbhgokc.exe
        900⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\Egcaij32.exe
        
        C:\Windows\system32\Egcaij32.exe
        901⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Ebiffc32.exe
        
        C:\Windows\system32\Ebiffc32.exe
        902⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\Fdiohnek.exe
        
        C:\Windows\system32\Fdiohnek.exe
        903⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Fqpomo32.exe
        
        C:\Windows\system32\Fqpomo32.exe
        904⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Foapkfco.exe
        
        C:\Windows\system32\Foapkfco.exe
        905⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Fnfmlchf.exe
        
        C:\Windows\system32\Fnfmlchf.exe
        906⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Fgoadi32.exe
        
        C:\Windows\system32\Fgoadi32.exe
        907⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\Fagenneg.exe
        
        C:\Windows\system32\Fagenneg.exe
        908⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Gaibcn32.exe
        
        C:\Windows\system32\Gaibcn32.exe
        909⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Giecojpb.exe
        
        C:\Windows\system32\Giecojpb.exe
        910⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Gelddk32.exe
        
        C:\Windows\system32\Gelddk32.exe
        911⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Glfmaemc.exe
        
        C:\Windows\system32\Glfmaemc.exe
        912⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\Haceil32.exe
        
        C:\Windows\system32\Haceil32.exe
        913⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Hbenio32.exe
        
        C:\Windows\system32\Hbenio32.exe
        914⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Hbgkno32.exe
        
        C:\Windows\system32\Hbgkno32.exe
        915⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Hiackied.exe
        
        C:\Windows\system32\Hiackied.exe
        916⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Hpkkhc32.exe
        
        C:\Windows\system32\Hpkkhc32.exe
        917⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Halhpkbp.exe
        
        C:\Windows\system32\Halhpkbp.exe
        918⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\Iifmfh32.exe
        
        C:\Windows\system32\Iifmfh32.exe
        919⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Iaaakj32.exe
        
        C:\Windows\system32\Iaaakj32.exe
        920⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\Ilfehcnp.exe
        
        C:\Windows\system32\Ilfehcnp.exe
        921⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Iacnpjmg.exe
        
        C:\Windows\system32\Iacnpjmg.exe
        922⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\Ilibmcln.exe
        
        C:\Windows\system32\Ilibmcln.exe
        923⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Iaekfjje.exe
        
        C:\Windows\system32\Iaekfjje.exe
        924⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Ipihiaqa.exe
        
        C:\Windows\system32\Ipihiaqa.exe
        925⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\Jidigfeo.exe
        
        C:\Windows\system32\Jidigfeo.exe
        926⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Joqapmcf.exe
        
        C:\Windows\system32\Joqapmcf.exe
        927⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\Jldbiabp.exe
        
        C:\Windows\system32\Jldbiabp.exe
        928⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Jpbjophf.exe
        
        C:\Windows\system32\Jpbjophf.exe
        929⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Jhnocbfa.exe
        
        C:\Windows\system32\Jhnocbfa.exe
        930⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Kedlbf32.exe
        
        C:\Windows\system32\Kedlbf32.exe
        931⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Kpiqpo32.exe
        
        C:\Windows\system32\Kpiqpo32.exe
        932⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Kakmhg32.exe
        
        C:\Windows\system32\Kakmhg32.exe
        933⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Klbnjo32.exe
        
        C:\Windows\system32\Klbnjo32.exe
        934⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Kekbce32.exe
        
        C:\Windows\system32\Kekbce32.exe
        935⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Lhlkep32.exe
        
        C:\Windows\system32\Lhlkep32.exe
        936⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Lcapbi32.exe
        
        C:\Windows\system32\Lcapbi32.exe
        937⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Lhnhkpgo.exe
        
        C:\Windows\system32\Lhnhkpgo.exe
        938⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Lebiddfi.exe
        
        C:\Windows\system32\Lebiddfi.exe
        939⤵
        
        PID:7640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:5468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aagkhd32.exe

Filesize
669KB

MD5
da58168433581223851b8ee3ed78a5f8

SHA1
8c6d771278a1e906ea351e7aef56881c18f3c554

SHA256
e99a058dcc07ddd62e87bdf98d3b2038f1c1838645a1544152f8e7230afe45a4

SHA512
a21d02cce12cb1417fdee8dc6b05390b033e669a84f4cf9c9b6f538bcfe98775dc729754628db5b1e0ab5dd8f85f04a3536e88ddc60cca927eca760894a766fe

Download Submit
C:\Windows\SysWOW64\Afeban32.exe

Filesize
669KB

MD5
96a7a00a172aba538b61a589145cd1e6

SHA1
42930370396c0e10986798362e17eabaef720ca3

SHA256
a4bba4a6e56e17ea8a7f5547c93ef835ee49839238bd4e58e46b1c0b3ae96fa6

SHA512
118173f6736395e2b8ab57245f8bef88c13e70a1bacb2e3d953bde52c9218ec50aa2c7c3d115b611a8f479cb98faac36de8b57c701961ba10d5eae070f309876

Download Submit
C:\Windows\SysWOW64\Amkhmoap.exe

Filesize
669KB

MD5
ad64572dad6d12b9ef9e2a4c949b09f8

SHA1
b63c7646f65b703cb2c0fe4cc8c88e87ffecdd60

SHA256
44e21071fdd496a88caa584602b0df06275b89049604a06a29b01c49f242917e

SHA512
75b1d37a114529d3d346a5497a4e89f9bcf11806cf971bbb4f37c3dbcfd1f520e80c7b47ff7800ed1e5700b48a39aad331cba17daa244de668c47d41041d7288

Download Submit
C:\Windows\SysWOW64\Bfmolc32.exe

Filesize
669KB

MD5
399c199f96835cef9404be592d368652

SHA1
973a4e302fe047db80b7673f0e902b6b439aba34

SHA256
dc4b0dbd3145123bad662c518f4fd73b36da462fff74f7d0ff4053946e55a2be

SHA512
36bd6f31fe58256c131f6d3dac0fb5df65ae900c3fd3e8cf9fe9a1f8501eee90d8a785989fbb7fd2ccb6f84e95e701f5fe924d8e021849c69ffa8da9910340d9

Download Submit
C:\Windows\SysWOW64\Bgnffj32.exe

Filesize
669KB

MD5
da80a5558f3339923d16c69328311589

SHA1
e20e6e218644f7768191b4108dac3eb3b05b3652

SHA256
c9bca00bebc3a5a810cc356e623aad2b3b61ae376497364078d081ef17ee63a4

SHA512
8dab5d00d24ff88a891fac2f65359f83cf384e8c6b0522e766301527812e42047db9c5e4c361c27f57c6d7c59a83e4ea9409b3a353dd7d52fcad0021968e3961

Download Submit
C:\Windows\SysWOW64\Chiblk32.exe

Filesize
669KB

MD5
e79c827cc2844e14e3da49fb09e9d072

SHA1
04ef47c56b3255cbc6e64b228cb0c5ff3d3089f4

SHA256
51fe7ddcb074a6c814e71b14db3cbfde0a9625309ed509c86973d779be46bed7

SHA512
218c69a3e161c9533791e5b6c549031fa9be38231c5ce1ccbc9ad5bf4e8ce2a2decde757a2faf059557523f7bc262dd688030e7a9bf5e45e324982a58bbc0502

Download Submit
C:\Windows\SysWOW64\Ckggnp32.exe

Filesize
640KB

MD5
f4dd3c55ff933c9428a3a320f05c9ee1

SHA1
28f330f9c65f01a4e2fc54f0429862b492f0a0aa

SHA256
11203655dc793020fcfb251150d8a56d5edf12f754e5ca9a3ad283036d89524e

SHA512
a07ffb1a8ab16c4d7e0d1d65024c1a0f0c610c42ad69474ae888971b59cd8cb9cf1d965831dadb0250be99e685fce5b8e1586d4bb3d94b7dca4e220585c8c6b1

Download Submit
C:\Windows\SysWOW64\Ckggnp32.exe

Filesize
669KB

MD5
f0c63a935e58d8a79f5ad050b9c2d536

SHA1
ef93bcb89579d70f473e932110472e834996a061

SHA256
7ffb86f4ead5f9b6704ca1a9798425f4755c4633e51aea7047de4bca72528adc

SHA512
7781a551678919aac2a6f35561857a42ceb24034ed88eee5ca148df3f15fa654555024f1f935d3043a9608a2b6a9435941dbf15e0229ae3d45ca6a0e3810e280

Download Submit
C:\Windows\SysWOW64\Cpfcfmlp.exe

Filesize
669KB

MD5
7b9e78f2a89f4cd1374851d6c5f17415

SHA1
70827083be992511957865533abe0bef2b06d249

SHA256
d944f6a92ea83eb6a1edbc6a0800339b8954ce1cb5a76a174b724baada853e22

SHA512
ced253711f7644e8095a7610e4d32bcf36d2668087a20d0fe01f847cd1b3c82023fa7701f64652dd80477b732a4ace48c4f1e967258104c64b5c182da93fc4ab

Download Submit
C:\Windows\SysWOW64\Dickplko.exe

Filesize
669KB

MD5
b280fe0efe20e01d3d23dbb8b91f3501

SHA1
89b1c54a28da7482d60e11fecd2b0319461e3722

SHA256
c79cfa8e5c0e332b789da75f67b90adc7277355d92d624c40ed3095efd14cc3d

SHA512
bb020e4a6f77785c24680c47aea0b1f11e68d0171933e35fbb9ba0ee35b131b1dd7a64ca76891fde89c7775f9665a7268ccfea8478ddb6c388855a32c8a7c992

Download Submit
C:\Windows\SysWOW64\Eaaiahei.exe

Filesize
669KB

MD5
0bbc5e973da87917153444b0e411346c

SHA1
7db353b953e316c9e96f570bf664d7ddfbddcc09

SHA256
8e9f5eaa5db19bc5b29d91092a5a2becbc3bcbaea026dd0aeebade93c5f5b1a5

SHA512
ff6a300c7a3e963489b1b88dc44498b24ab7c4cd8020b6caf9d7f904dea68b1bb5a05f985dae2e015ec15b817d6af21fc266b38cc9c44fd1136e7431f878260b

Download Submit
C:\Windows\SysWOW64\Egmjpi32.exe

Filesize
669KB

MD5
4aa4fafb21237fb09e2ef57229d7b4cf

SHA1
2ce3880ee2130452f13b070f5685fbca3b5e4df3

SHA256
1f13029f239b605b868ac9bbfeaf872642c4e19bbafe5fdb156f8dd300b7dd5d

SHA512
a488542e1861b7fe7bb3d20cca9281364c47b8dd5f20d34f87504ba23baec652a625dbf23c3044affea3283279435d4a07ec568fdf17612b2e9356cd481159bd

Download Submit
C:\Windows\SysWOW64\Ejagaj32.exe

Filesize
669KB

MD5
76358c0936909997b6c7b7ea9327dfc1

SHA1
a7d910c3890a9c948b4479c8c279eb1adb658f50

SHA256
834fb42924a555e7029f99d6564773a5089465648b1ae2b157ec830fbc73ac43

SHA512
bea7e529ffa4bba9a64c6c45987a743e9c63ceb2b9477f15fc8c97df892fb084868a6edbd3008017a7940c7dbe0fb9d17c6c7f976d56321cc66c723817f23987

Download Submit
C:\Windows\SysWOW64\Ekcgkb32.exe

Filesize
512KB

MD5
b01c41adae3913de3e00ea888b0869b7

SHA1
f1c02ddf270ee55f0db8e74efab9c1bb1bc8c47b

SHA256
4682dd62fea8bb55b75dad3f12a8265dfd674dbe69317eb34acc51716ef8b3d6

SHA512
0d7743ff01e7ff59568b979d5e78d624a32c4d6d090db23dec773fae969d498f966d3b7241c4f361c2993080cb76659fed93c47fbd7f7ca98225b83432312592

Download Submit
C:\Windows\SysWOW64\Ekcgkb32.exe

Filesize
669KB

MD5
075c3b6826860af39fcda0a0220f4e17

SHA1
8562b2ebc0804ce2e684fa99d605314bb9395aa9

SHA256
deff3f54b26f9edd4d4e123f5743aef0bc0e523af226800ee968bd86c697f3bf

SHA512
d514ed6dc183579ad742b7806025104f1c4c887a2e9cecbb65ca830b4c65bd7a0326de877a0192ec8fc16c177ea8c853baeb8ae848702630b45e724ab047c10e

Download Submit
C:\Windows\SysWOW64\Enfckp32.exe

Filesize
669KB

MD5
7b43c378b0b573d5d5535d06e5327f55

SHA1
d7a9b9f1a3cf4d98f901d8ba5fd5700cc07597dc

SHA256
07af5a697227f0ae7f26e7ff319df8d7265f6c9a5ba2e0f025e10be5dc8952bb

SHA512
ec5682164427916afc041b69d856d6bd105d12d30589c06829927b81c45a72604907d79e44728ad49e544b1fc26358ad3def3a3dd82b03ae88bf75ce7844ff5d

Download Submit
C:\Windows\SysWOW64\Fcneeo32.exe

Filesize
669KB

MD5
9684abb2539d9d7ec967c0fa7f7c3ed0

SHA1
c318ddf9ee008ce622bea265cda93162c8be1f9a

SHA256
b3af9a63ac2eb296337a02b210ace709109487e6f456fa77f5ecec08781a94ce

SHA512
d48bd1f2936cf6c280616fd89eee8bfc52220e4365825d00bceda9829c17fb3cb8654393e3c5a0713a4209743468b6d88255da124101cd6e23aa0b56277c91dd

Download Submit
C:\Windows\SysWOW64\Fjfnphpf.exe

Filesize
669KB

MD5
6855d1daa3e72f33e188920abd11708d

SHA1
de38a647575c991301c23a34e988a155dd1c96da

SHA256
fc53ff7e8273b11b7bffcc2d21e3b81a0cd64d457b435ae5ab14dc9459467bc0

SHA512
b174b1f504cd4192ca8d926d0f6c93f9ea747832ab562828c082f0d69d2a1177708359788839f69ca46c4b95736095909cac6e13dfeb2baf9bd2aa4af0657921

Download Submit
C:\Windows\SysWOW64\Fkjfakng.exe

Filesize
669KB

MD5
e5f30fceee7b7ab26c3d0a22a8e8e21f

SHA1
174c4685cdba5a578b51b15465fea32f099752e8

SHA256
7bf64b92c5f7a6bc64e98b1bf3710937de93081e3d9e6a301791fa7713bd890f

SHA512
cecdd127d3a539f807b7b5e58dccdb47fd97da18d3c5eddf4198dc60b7454ee1b75b7e9af0b57df1f54b68a9c56d2499d3e7d84de217e6a01714cbe57b8da566

Download Submit
C:\Windows\SysWOW64\Gggmgk32.exe

Filesize
669KB

MD5
7cce6a8e39ae05f278f8d8976ed08410

SHA1
03101caf9d2f28b6b29ffe24284c841e9ae81d42

SHA256
d00ad43eb3e6981d956cc3b460e8f10ad1b4bebb54d970f1d2c922e59f66745b

SHA512
8a512a40457c0bdda3c5610fa421b7e15aa1ca71bd5e3e0ca8c1953ca2b06fa1bce9b4562bf6f68b65fdd4540ab4957e256d773cb245ab75eccb6e180d05f585

Download Submit
C:\Windows\SysWOW64\Giljfddl.exe

Filesize
669KB

MD5
6809271897de57054815e4cc7ae50e88

SHA1
e2cb8eb43e6d788297d9816f3dd2bf9c9dbeff5d

SHA256
ca5bf4d851b23487cdf06bdd8116ac72e66a0239f6a737a47001d2d62403ae93

SHA512
cd9e0aca837887f65f429d036f8d0cfc76f35e10903bee6bb054c17a35804c6c997f8e8ae23961e8a22097a32794fd3b89814a58af11cc97d6650fc81fffcbd3

Download Submit
C:\Windows\SysWOW64\Gkaclqkk.exe

Filesize
669KB

MD5
2165646cda08479993ee28d51236af56

SHA1
5afda2ce19c1ae9bc3bb299eeb5c577b73250442

SHA256
88f1d1a4eff08ef80d1c51ae8ddd0a156a9edc3175cf1efa698c0eae8f29b8f7

SHA512
c014c8ed1fbe262d49cea2f87e01b22f5f14fd485bb4e6024b2149892d811aeb80562fdf22069a5cb66807b66c0f642c4826698be81bf86afd109f6cba4c19b3

Download Submit
C:\Windows\SysWOW64\Haaaaeim.exe

Filesize
669KB

MD5
ddcd937e9eb9f2e7e4426cf2d67d7985

SHA1
a93b98707916d1fa33a4e2866eb86362038f319a

SHA256
fc17ae3c47675d10ee536b10aea09efe82eb328e4d42958fa65b712a76b071b3

SHA512
21848bb928bfd346ee2d7eca5a9d8e00e24a401bab8d34b1228db82adde0abba5d59518de3edb99fb44d9fb5f7854c47f9d97c4637a8a1f71eca3dcc965e632a

Download Submit
C:\Windows\SysWOW64\Haaaaeim.exe

Filesize
448KB

MD5
f0a93e686a319592069a3e68c5a392a3

SHA1
bf556b2f3d5af4b89496734e820dc523d6d839b0

SHA256
813d8b3ee1c396252be84364b12781c555c541991e996046cd498b7fea844e14

SHA512
7c988f5620e2e1ed7500709306521f1f70f524828d0ef1a092805d33eb52e9f6226f06b77a0bf40d99834b5e2011a41c845446b0adc786c8e9e492f5662eb0a6

Download Submit
C:\Windows\SysWOW64\Hjmodffo.exe

Filesize
669KB

MD5
492800a91834ac19efa588e30f6b29b5

SHA1
185f74ba873e454ffab0b005e4c198fd5e198d52

SHA256
1461904f08f7ed58b5960bdff5d1558b3f51ff686a69fb72bb8122b8ec314148

SHA512
de00a42dea9db5939990a8d6a90ae18100dab48d42cd3f89b1592c14ef1955a637fd31923ab9c1a9e2984ea364268907eccbeda820aec4fc2532d665f7d3eb43

Download Submit
C:\Windows\SysWOW64\Hkaeih32.exe

Filesize
669KB

MD5
d684564bc3a8f06f0b1f5ddd72324ee4

SHA1
d6a3a900084c0e29a38ffa002c9c06d2cb44b79a

SHA256
65d5b2068e590c698dee8a67fc439b4fc942e0a7d0d7d7b6463790f7458aa77c

SHA512
628be45ebfee364ffd009a8a42d3c4af5663a2cd59772e6826fce3a901088f339e42f521f7269826845675e7dea80b9d5e7acce582e7047fe12873ead278e19f

Download Submit
C:\Windows\SysWOW64\Hqdkkp32.exe

Filesize
669KB

MD5
361cd20929b05832e9250a1382eefd23

SHA1
c6e0e9537025e116663cfdd3c01c4b889677bb01

SHA256
783e43de65b93c506e9c2c0cd4aa2be3f59739c53ba2f4f49fae558a7d086693

SHA512
7f6109e81d06a8ac3387f4bd6f0905c100713599c1844db46c01a69ed87030ba31ecf0e015f888fb063f35c1b031cfbe765ec969a97f3d83e17460f713343cee

Download Submit
C:\Windows\SysWOW64\Icefib32.exe

Filesize
669KB

MD5
d85193732664f6f78ae88e0c2261b39a

SHA1
658c9b0e5da0d34d82c3d9bbe29a2aadc01e079b

SHA256
d0ab8fd09c9ca8a9248cf8953dac3690117385da069a3a4c3bee941aab9a7da7

SHA512
6ad6eb88bb844e207ca199663a550132158803be491e978e4649067534f14c4e94975c9a06de2b49b132af6342e4a8e15a33577f1064162aa20056b3f2063328

Download Submit
C:\Windows\SysWOW64\Ieeimlep.exe

Filesize
669KB

MD5
6a8c62030b4ccd2e93c952c4016c793f

SHA1
2d09778abf43ad2d0ff9cc2d6e4fa48c45078a0c

SHA256
99182031dfdaed394d572849519908176749ec4979ff2a8d670cc04093411716

SHA512
5dc118da8ae02c884c94ceaf54561d93d43d9acc88bb13c4ac8a0d193773bdbbaa7e3bf82cbb19e94032c7224c0050a87f3c4216e8bb98dd6f8602f7700353cd

Download Submit
C:\Windows\SysWOW64\Ifcpgiji.exe

Filesize
669KB

MD5
6e44b1df3604973972beb31dd4e89811

SHA1
1b3c907657f4edf1966cbf3d303356c2eae8254f

SHA256
3a17549c48e062d41398ab153813d8cacd99584d694f31eca5020756d47dad39

SHA512
e3729f4bd6b5cd1d59e972a93149bdf015203661b31a36edd2e6a51ef3d7e1634ebe24356cff6b74539c1833b9241e0018fb97256cafbffc2dbf05a72141f6a6

Download Submit
C:\Windows\SysWOW64\Jldbpl32.exe

Filesize
125KB

MD5
64d7554193f428ce2ad890c96441281c

SHA1
26f932bd30060f3451f9207946eba6de782654f8

SHA256
c3936233851f006b6e92aa4090572fdda437591b9648aaa11562ab527a92d066

SHA512
1822314bdd551c6803c7c71c9655a9fa2f905209de0cbad6402da0075bfe9cb8518d4b587ab152c89dd05cd75eef6a52e4123acbe7f90bbf42b7913ce8f276ad

Download Submit
C:\Windows\SysWOW64\Jldbpl32.exe

Filesize
669KB

MD5
244c1d39052e2109db07b319d0a08a31

SHA1
e55358634b3e250fc2b27fb81d2c90761963710a

SHA256
38d1bb898e1e2c22554de1440bd7f4a85f4dfaa6560c31b68cd8e27cab5b7de3

SHA512
e23ff8c708ba5eb09cf497d940eb33dd277ad480bf137cb4db3df1f94e4422ea1453a44d16a1ae1d2bd9aa4e9680cce23d253a973361f119b05a802c73b47864

Download Submit
C:\Windows\SysWOW64\Jnocakfb.exe

Filesize
669KB

MD5
1e46d813be925fa17b6628168731476e

SHA1
0f68f8ce34791f63fa4d75e222bdfbbd57503a8c

SHA256
03a7a666563c9c30ebc75be11f1cd58927b61dd455ebca07264d2b44ef2db256

SHA512
02493dad7bb7f8701ca165c6360e17a7949437b71e5629d763367dbf33f0439c67316b91287feed7593330268ebdbe9f9095ae5453af3b9dbb2f47184019a30a

Download Submit
C:\Windows\SysWOW64\Joahqn32.exe

Filesize
320KB

MD5
4ae69b45e1225f82c728e3709fd3c585

SHA1
0b56406c970decc91c789a7e1cd6e8c16c36f269

SHA256
fc30c46d6ffc286665651e16e6248db367996425963a37012307622a186094c4

SHA512
60a5903d2d136368439a69b7da4946ff18d38a39acf3dd17a66e20753de529fc9c11f2a7cda0ce2b74d9eb873a5715426d58ea4d31fc1919966abd6529bd1648

Download Submit
C:\Windows\SysWOW64\Joahqn32.exe

Filesize
14KB

MD5
a24de4d442d95d4d69747a473066e24f

SHA1
d5d06037cf19d7193dbf2e6695e7f0799031b0cf

SHA256
2abf4a2fe489664ef8444c25ae9679d78edf9a19f22f98311da4d58a592f77b1

SHA512
786bba968e39ab1c5ac60467b2b1507ff0ca0e57e8d899e5e16f81c6c01dd106ccee384eb9771c10f67f3643d6355861149095a29ca43d6b5f93d48ceece8444

Download Submit
C:\Windows\SysWOW64\Kdalni32.exe

Filesize
669KB

MD5
3ddcebcafb7cab329cd5727d28a97811

SHA1
ac70584263825c8f0755cbc366cfe1364c3eb3b9

SHA256
85624d6eefd9cf14643a8c306952b1cd9a4497897723f803536503289dd33c8a

SHA512
54c0de06449f95b74c5482a50a0095347977443df5f0f6aaa9bbeba0f9ae6123cce533950d5f498c4db129c696be25e3ea89debb12c2a917cb80755244fe400a

Download Submit
C:\Windows\SysWOW64\Kebodc32.exe

Filesize
669KB

MD5
dda8b56687497e9440c0871c29fdfe65

SHA1
dfe312adbd6cf737e911965d254530098dd0b8a7

SHA256
0129583696f5338a158c94a658f611555a6eda78aae5b6ec7e6c1f9e38147186

SHA512
eccf48ee19e28072d24c91c5af223afaee9766ff06248ab6c4d19b847245df32afb1b96d1f415b99f08c60fad2f4d22b268a1efbd5f1b6756afa2eac67746244

Download Submit
C:\Windows\SysWOW64\Kpdjbapj.exe

Filesize
669KB

MD5
90740ba402216d71c1dc72039acb05be

SHA1
560febac51a2bee0104d89e761361c7fbf37c75b

SHA256
7d7c6300a9c0a43f7f401d8495f1a34b41405b5b25c589a246dd07f2f7fba785

SHA512
d860f5ebc218e74ed08286107f9aa0baef150c9d060196134cb7622aa8387e8d6998357cf4e30cf7e5ec2e85db55a310d33676b27949b8997d2c6bfbd05bd024

Download Submit
C:\Windows\SysWOW64\Lnkgbibj.exe

Filesize
669KB

MD5
bd87bb835c4831009da3160697f92707

SHA1
b7b508794202b0bc884a6fb62d74c522cd589c5c

SHA256
98cf593504bcd8fc5236b64186786c094e369c3ee4a2636822bdd23af0b123e6

SHA512
02f796ab717740b6630f2560f182daa3e2ecefabceb66d0460a72b8576c5095f2025cc3e609c42b84d671e5edbafc75476d157d76901954c0c9aefcd3b0f9558

Download Submit
C:\Windows\SysWOW64\Mfhbga32.exe

Filesize
669KB

MD5
f84fd6bb8877f928792d299368740162

SHA1
82c1dcfc92742b819f617e9c5680dacfdb3c33ef

SHA256
90e0103c92b90c8e9199e833a69c368c02cde0214f1c02f0bca306842c70aae8

SHA512
39b4cfaf4b1fbfd6975a8cb6458cb5683ac204bdaa478545a84b227e803ff9254e42c459ccc3398b20ba322771105b780ba016fe41202ebf795172579da9b1bf

Download Submit
C:\Windows\SysWOW64\Miflehaf.exe

Filesize
669KB

MD5
783346b83726ba6993761b616955c9d1

SHA1
7b1aca62479605cb5af51258c4ebf672a206f138

SHA256
e9dfc476e625ad6b7fa2e4afb5d19f7676caa099b5d381b850020679ca9ff02a

SHA512
4be474f03a779d3aad7ae778299eda68689030b97630ba8f9030c44addc2d7e0baa52d079ab7e60b6cefefd606708201cdf4ed27e3752508e75291bef6dfbbb7

Download Submit
C:\Windows\SysWOW64\Mihbpalh.exe

Filesize
669KB

MD5
07663dd68a669b57a7cc9b85a9bf5928

SHA1
d88cedc694f1a495479018e161fb179958dea88f

SHA256
42473ce1f928400ca768db8064e36d8a1e6238675aa789d60ba4071dafc76dac

SHA512
3e0c29d69be10b87242d8b1ac9b94527e7b39553fffb023666787f331fb4b754a738b979c34b6f00b946db7ea85da0a5a01a6f6a03ef8aa4cf30ee0cc81168d6

Download Submit
C:\Windows\SysWOW64\Mmbopm32.exe

Filesize
669KB

MD5
4f371ddaaf444f21122f6b5d6c151b47

SHA1
12278756eb80687de266f1b2cb16ddf7eede2fa1

SHA256
7f52340024e45d129ca0f45abdfcc422b28e12d9236c1e7f70109a2137377519

SHA512
9c54c8d12115b26e26a76520c2b4a76b3e6e6e60c8a9cb3c8a80ca55b7da6b05141b4030193b58b6e1a44413cf95a3d51700b6374edfb7159115751f8935c754

Download Submit
C:\Windows\SysWOW64\Mqhfoebo.exe

Filesize
669KB

MD5
849d975cf29f7e8bcf610aeb223e1cef

SHA1
00c698e58ed785213be1db2a50f980ceb3d8c324

SHA256
e6559ffdfb92e5a79c67be4575629a9b7d3ed3c0528f3707093b60fd5fe1707d

SHA512
7aa00a551b8dcb257e612e5da4f827f13503baf2e5ff81aabf3ff37f50560db648a1d9ac295aee6a76ab521682713da5e917ef154b32f8fd8f02b4f60486ec54

Download Submit
C:\Windows\SysWOW64\Njjmni32.exe

Filesize
669KB

MD5
26104e2762f66479c2d9c0cd99fabfbd

SHA1
8fb32a7310d992f07c639f3c90160e3b84b56945

SHA256
3b7f9047a615d7c68c4bc4329b6d9f83906645939b81b3b35757301a62dc44b1

SHA512
a9f4ad4d2502c8f391e9e32f6896aa39653a4fa2c904da6a6a546db6126df1f7456619008165a4b6f492fb410baa974101e3565646f3c9a7e0b4d4db0965f428

Download Submit
C:\Windows\SysWOW64\Nmbhgjoi.exe

Filesize
669KB

MD5
2ff18c709e1562f89c02d4425d4c68ba

SHA1
7f492235bfc39606aeb55b26e311dbe5667ece59

SHA256
9a7b15f9b30e8441d416950bad67e8be416fa4b7eef9f204ff565dd472264bf2

SHA512
a33d8d06557a9528872fbc2d13d25b842f97f4c5a090d6dd380fa3162f9a90383378c60f2d78cd249fe1c9b36912469b270836bb507a8040628bac26da9344f4

Download Submit
C:\Windows\SysWOW64\Nmcpoedn.exe

Filesize
669KB

MD5
63082881156f3c32a656b5c1be4512f2

SHA1
1de2fe18bc2832b90fabce2665123736583d7cad

SHA256
b09dde0ddcdeda3f6261064208ab8f7be1f0554957ef6be6bd4a22c259c9d9b9

SHA512
4cafb9b4d0944ee8fa65817c3757ab88f66b10d720d244c4a4b934e7ee1b2f599386008c2350ac35136e325fb7972e1a1388881caacc02fcf8361b33b422022e

Download Submit
C:\Windows\SysWOW64\Nmkkle32.exe

Filesize
669KB

MD5
8b18ddd16d6bae5bde6f296ee720de9a

SHA1
cad857fc430b1dc4c6731a5626fcc9928818e698

SHA256
7f2c7dc69fac2ff51bd79cc0cea6db5f8401cfb6c5c31c045a4ae9bd1d02964a

SHA512
d71ec6acd0c69b374de251e7ae84fbff5833e0ecba0217e404d71ecb5a8d74182f7171dc86f8d1503a43c98d4191a8b5896a37591926e4e06ce8c93359a0c0f3

Download Submit
C:\Windows\SysWOW64\Nmlafk32.exe

Filesize
669KB

MD5
1a8241223db427e663246468df3518c6

SHA1
9b4c03c22f16a6d4a0d0cbccc3db04799303de7e

SHA256
dfd465e36e2e8ce16ea983ea30f2e028df14601737592d1ede5169bf59b498ae

SHA512
b4bdcd83653f5a1c53fad7ee23fe84ca0a8e2e6c44e3cd399c3865e8dd86ddd06ad50413fb3bb6b91127634d306a7cbc1d0baa551a41455a7383eb406c1c3e07

Download Submit
C:\Windows\SysWOW64\Oaplqh32.exe

Filesize
669KB

MD5
2df0cef5b5159e0cd852272ebb315fd9

SHA1
721a1b5962d3707621836c23a83cefd1f349e9f5

SHA256
6c13d5490aa719bbaa8d3822bf6ef36c57bbd9a63a072b6dd201b93286de1577

SHA512
52f450dbaf7e23c4978dd407834fae5eaec37a11506bf37d45c0ca28f577598e9744de3284546a324772ebf3b946a0b23f5adb6f3a39ec6a24332cec8faa69df

Download Submit
C:\Windows\SysWOW64\Ofgdcipq.exe

Filesize
669KB

MD5
bda3934e217450d1fee530a7cb614606

SHA1
3a93a80eac1c8154dedaec55d397e164cbc9ff3a

SHA256
e1814c844f89903f058949c19b51d88aad2c8dcb92b46eb93aaf28ffb0c2975a

SHA512
eff0cf49b34aa5b321921bb652c6fe7a51bbb32a9315dfddb14eae9646a50f31821e90c89d23489a0898098012d789ff3bffad1ebfa73b7a50c3d6e0c78cd5c9

Download Submit
C:\Windows\SysWOW64\Onmfimga.exe

Filesize
669KB

MD5
2ca5b88d133942a28572f6628839ee57

SHA1
a59043e3bdfccf62baa3bbd830a40411cd005655

SHA256
28eb8c7e9dea5fd08739364a0f84bd8e984b8e09ae872b51675d0f6dd5fa4777

SHA512
ce941cae9ba890d6baac415c64f269eb0fe0d4945c3d3429bc4fa7d98920f2ae1aedb278518a7cbf004b991568ee635f76b9f7043b3c9983cd70bf35221807c8

Download Submit
C:\Windows\SysWOW64\Pldcdhpi.exe

Filesize
669KB

MD5
941c3acd5f0f9be327cd1d97b3e94428

SHA1
2b05323ff0c3ec59fa268b989e841091cdd5bfb7

SHA256
418fb3dbc3d21f20d99b1cfdd05f1c80fa0b172969ccdb6711eb9025494b0ed3

SHA512
417e07deb7f58eaca1342374ff5eeeaebaaa84c61d51f7421453003fe32f616c89e5b77ad143647a099f8c11ac4a2a69d8c83d63e541f9452235532de9001834

Download Submit
C:\Windows\SysWOW64\Pmpockdl.dll

Filesize
7KB

MD5
d7d41fc15c58e57153a0ecd3bceda55a

SHA1
81f994da5207d4e2153abaf04bf314304069eaca

SHA256
e0c7eca5051c04fee18aa16be6acf87d6f6d8e39ccdb9da1f70ed7aea869f74a

SHA512
0f3ce136b93beca279d8b5252329abadc6702fb69f1da08f2849a1403e003cc5c2e048ae15cfdb7d7f81d1e97dc84742c343a9188eb77b9cd7a5be2c5b9aafd4

Download Submit
C:\Windows\SysWOW64\Qdhalj32.exe

Filesize
669KB

MD5
71f17411e50143eb081d71ca1d982c0a

SHA1
09b37ee0d570bbef3254cc4f118210f6feef5e8f

SHA256
ed6a3f82f6c2719db8e9599e62f6ebe469c06b79c5bda3456209b84157f9d5b0

SHA512
2320f5e33f121091124aca25692f179f72ce395a8b80f47fa0bdd2ca6211382a9cfb21d0a48ee451fc03e6973b45d2cddb20bd9b6778797ab1c21b233aa1fcdd

Download Submit
C:\Windows\SysWOW64\Qfmfefni.exe

Filesize
669KB

MD5
9ae891287a6dff9b55ce37cefb49ad85

SHA1
7922ea18b1c59184ceefe27c03166de3811bbcd0

SHA256
ca5af5e622a1bc00a716f420999802657700271785c0b8591384a5fbb9fdddaa

SHA512
0d64dae7e1ce799a68174f2835af1b631e583329c84dfb8e67dbbce773b209b0f31f6157d753df591b2cd0669b18b704fa9b0944ca2cd083f42f4f95fe4f4216

Download Submit
memory/448-283-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1000-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1000-114-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1048-312-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1348-289-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1444-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1444-131-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1604-311-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1604-158-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1624-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1624-192-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1728-29-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1808-210-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1808-369-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1860-241-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1960-219-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1960-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1984-416-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1984-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2644-351-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2644-184-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2692-350-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2692-175-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2728-319-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2928-122-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2928-303-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2956-227-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2956-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3104-232-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3144-245-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3144-386-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3160-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3160-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3204-368-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3204-201-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3336-138-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3336-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3420-269-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3428-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3428-207-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3436-174-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3436-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3476-140-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3476-309-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3528-115-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3528-302-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3552-332-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3564-183-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3564-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3620-41-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3620-166-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3632-156-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3632-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3768-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3768-260-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4092-167-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4092-325-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4280-149-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4280-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4312-338-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4400-305-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4604-89-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4604-235-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4680-281-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4860-276-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4860-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4896-330-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4996-396-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4996-252-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5040-194-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5040-355-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5140-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5188-555-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5200-356-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5280-371-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5340-378-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5384-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5432-389-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5484-402-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5524-539-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5528-403-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5572-409-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5612-415-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5664-422-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5716-428-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5756-435-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5800-441-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5840-447-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5888-453-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5940-464-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5996-471-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6048-552-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6100-553-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads