berbew | dab1e6bc56b34d1ed165bc1be20757871e8991c6ec8f432eab23e6fc37ea9a04

Analysis

max time kernel
50s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dab1e6bc56b34d1ed165bc1be20757871e8991c6ec8f432eab23e6fc37ea9a04.exe
Size

448KB
MD5

b254af3959b4fc2d1248d865ae82a735
SHA1

831e09253271d56dbd876b1c011c6ba664ab7a15
SHA256

dab1e6bc56b34d1ed165bc1be20757871e8991c6ec8f432eab23e6fc37ea9a04
SHA512

d92edb180e7638ad7c0b4194ece71701f2f7b36deb36c1603bf1e8dfcdfe036728e320ca12b61da314746a87fd890f7ee70f6f2ab021a16ca36771b6cdeec27b
SSDEEP

6144:8oI1Zw5/MwGsmLrZNs/V4Lr5+Nod/MwGsmLrZNs/VKi/MwGsmLrRo6+:80MmmpNs/V4g8MmmpNs/VXMmmA

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edhakj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fajnfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggqida32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkaopp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hghoeqmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhbimf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghbbcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkcboack.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eggmge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fafdkmap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkeodaai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnkaalkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hghoeqmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emhldnkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gglpibgm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnkaalkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hakgmjoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnagak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhbimf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gglpibgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdgfce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkaopp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkckeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gepmlimi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfbibikg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emhldnkj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fafdkmap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Feapkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fajnfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gaadfkgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	dab1e6bc56b34d1ed165bc1be20757871e8991c6ec8f432eab23e6fc37ea9a04.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gepmlimi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkckeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	dab1e6bc56b34d1ed165bc1be20757871e8991c6ec8f432eab23e6fc37ea9a04.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eemgplno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghpendjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdicienl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfipbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edmjfifl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghpendjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdgfce32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnmnfkia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfdfgiid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eemgplno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkcboack.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkjhoq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gojnko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gojnko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgppmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggqida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnmnfkia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdicienl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgppmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gaadfkgc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfbibikg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfdfgiid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hakgmjoh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Goljqnpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnagak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edmjfifl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Feapkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fehfljca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fehfljca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkjhoq32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 36 IoCs

pid	Process
1852	Edhakj32.exe
2388	Eggmge32.exe
1356	Ekefmc32.exe
5020	Edmjfifl.exe
3548	Eemgplno.exe
3632	Emhldnkj.exe
232	Fgppmd32.exe
5004	Fafdkmap.exe
5000	Feapkk32.exe
4828	Fhbimf32.exe
5052	Fajnfl32.exe
3024	Fkcboack.exe
2656	Fehfljca.exe
3508	Fkeodaai.exe
5044	Gglpibgm.exe
500	Gaadfkgc.exe
4136	Gkjhoq32.exe
2320	Gepmlimi.exe
3124	Ggqida32.exe
1248	Gnkaalkd.exe
1616	Gfbibikg.exe
5088	Ghpendjj.exe
2152	Gojnko32.exe
4368	Gnmnfkia.exe
2228	Gfdfgiid.exe
1480	Gdgfce32.exe
4476	Ghbbcd32.exe
1264	Gkaopp32.exe
812	Goljqnpd.exe
752	Hakgmjoh.exe
744	Hdicienl.exe
3652	Hghoeqmp.exe
4428	Hkckeo32.exe
4908	Hnagak32.exe
4008	Hfipbh32.exe
1660	Hdlpneli.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Gojnko32.exe	Ghpendjj.exe
File created	C:\Windows\SysWOW64\Eggmge32.exe	Edhakj32.exe
File opened for modification	C:\Windows\SysWOW64\Feapkk32.exe	Fafdkmap.exe
File opened for modification	C:\Windows\SysWOW64\Gaadfkgc.exe	Gglpibgm.exe
File created	C:\Windows\SysWOW64\Mmjcbkij.dll	dab1e6bc56b34d1ed165bc1be20757871e8991c6ec8f432eab23e6fc37ea9a04.exe
File opened for modification	C:\Windows\SysWOW64\Fhbimf32.exe	Feapkk32.exe
File opened for modification	C:\Windows\SysWOW64\Fkeodaai.exe	Fehfljca.exe
File created	C:\Windows\SysWOW64\Nholna32.dll	Hakgmjoh.exe
File opened for modification	C:\Windows\SysWOW64\Hfipbh32.exe	Hnagak32.exe
File created	C:\Windows\SysWOW64\Cdpagn32.dll	Goljqnpd.exe
File created	C:\Windows\SysWOW64\Hdicienl.exe	Hakgmjoh.exe
File created	C:\Windows\SysWOW64\Edhakj32.exe	dab1e6bc56b34d1ed165bc1be20757871e8991c6ec8f432eab23e6fc37ea9a04.exe
File created	C:\Windows\SysWOW64\Mnnndm32.dll	Hkckeo32.exe
File created	C:\Windows\SysWOW64\Pocehodm.dll	Gkaopp32.exe
File opened for modification	C:\Windows\SysWOW64\Edmjfifl.exe	Ekefmc32.exe
File created	C:\Windows\SysWOW64\Ggqida32.exe	Gepmlimi.exe
File opened for modification	C:\Windows\SysWOW64\Hkckeo32.exe	Hghoeqmp.exe
File opened for modification	C:\Windows\SysWOW64\Gkjhoq32.exe	Gaadfkgc.exe
File created	C:\Windows\SysWOW64\Oddinb32.dll	Fgppmd32.exe
File created	C:\Windows\SysWOW64\Eqjbohhg.dll	Edhakj32.exe
File created	C:\Windows\SysWOW64\Kmonnmjm.dll	Fafdkmap.exe
File created	C:\Windows\SysWOW64\Fajnfl32.exe	Fhbimf32.exe
File created	C:\Windows\SysWOW64\Gnmnfkia.exe	Gojnko32.exe
File created	C:\Windows\SysWOW64\Gpkonb32.dll	Gdgfce32.exe
File created	C:\Windows\SysWOW64\Gffnlmnd.dll	Gkjhoq32.exe
File created	C:\Windows\SysWOW64\Gojnko32.exe	Ghpendjj.exe
File created	C:\Windows\SysWOW64\Gfdfgiid.exe	Gnmnfkia.exe
File opened for modification	C:\Windows\SysWOW64\Ghbbcd32.exe	Gdgfce32.exe
File created	C:\Windows\SysWOW64\Ekefmc32.exe	Eggmge32.exe
File opened for modification	C:\Windows\SysWOW64\Fafdkmap.exe	Fgppmd32.exe
File created	C:\Windows\SysWOW64\Goljqnpd.exe	Gkaopp32.exe
File created	C:\Windows\SysWOW64\Hnagak32.exe	Hkckeo32.exe
File opened for modification	C:\Windows\SysWOW64\Gfdfgiid.exe	Gnmnfkia.exe
File created	C:\Windows\SysWOW64\Mqjbok32.dll	Gaadfkgc.exe
File created	C:\Windows\SysWOW64\Hjmejn32.dll	Gfdfgiid.exe
File created	C:\Windows\SysWOW64\Qhjibgnp.dll	Hfipbh32.exe
File created	C:\Windows\SysWOW64\Hnqhicol.dll	Gojnko32.exe
File created	C:\Windows\SysWOW64\Cmmmdlag.dll	Gnmnfkia.exe
File opened for modification	C:\Windows\SysWOW64\Goljqnpd.exe	Gkaopp32.exe
File created	C:\Windows\SysWOW64\Gjjpbg32.dll	Edmjfifl.exe
File opened for modification	C:\Windows\SysWOW64\Emhldnkj.exe	Eemgplno.exe
File opened for modification	C:\Windows\SysWOW64\Gglpibgm.exe	Fkeodaai.exe
File created	C:\Windows\SysWOW64\Oalfdbfa.dll	Gglpibgm.exe
File opened for modification	C:\Windows\SysWOW64\Gepmlimi.exe	Gkjhoq32.exe
File opened for modification	C:\Windows\SysWOW64\Fehfljca.exe	Fkcboack.exe
File opened for modification	C:\Windows\SysWOW64\Gkaopp32.exe	Ghbbcd32.exe
File opened for modification	C:\Windows\SysWOW64\Hdicienl.exe	Hakgmjoh.exe
File opened for modification	C:\Windows\SysWOW64\Hnagak32.exe	Hkckeo32.exe
File created	C:\Windows\SysWOW64\Ifkadchb.dll	Eemgplno.exe
File created	C:\Windows\SysWOW64\Mhagfo32.dll	Fajnfl32.exe
File created	C:\Windows\SysWOW64\Glokko32.dll	Hdicienl.exe
File created	C:\Windows\SysWOW64\Gkjhoq32.exe	Gaadfkgc.exe
File opened for modification	C:\Windows\SysWOW64\Gnkaalkd.exe	Ggqida32.exe
File opened for modification	C:\Windows\SysWOW64\Ghpendjj.exe	Gfbibikg.exe
File created	C:\Windows\SysWOW64\Fddanicf.dll	Ghpendjj.exe
File created	C:\Windows\SysWOW64\Khmnbgbp.dll	Ekefmc32.exe
File created	C:\Windows\SysWOW64\Feapkk32.exe	Fafdkmap.exe
File created	C:\Windows\SysWOW64\Hakgmjoh.exe	Goljqnpd.exe
File opened for modification	C:\Windows\SysWOW64\Eggmge32.exe	Edhakj32.exe
File opened for modification	C:\Windows\SysWOW64\Fgppmd32.exe	Emhldnkj.exe
File created	C:\Windows\SysWOW64\Ahamlm32.dll	Ggqida32.exe
File created	C:\Windows\SysWOW64\Nobdka32.dll	Gfbibikg.exe
File opened for modification	C:\Windows\SysWOW64\Hakgmjoh.exe	Goljqnpd.exe
File created	C:\Windows\SysWOW64\Fjmkqm32.dll	Fkcboack.exe

System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggqida32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfbibikg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hdicienl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaadfkgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gojnko32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnmnfkia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Goljqnpd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hghoeqmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnagak32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eggmge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekefmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fehfljca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnkaalkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emhldnkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Feapkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdgfce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfipbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gepmlimi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghpendjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dab1e6bc56b34d1ed165bc1be20757871e8991c6ec8f432eab23e6fc37ea9a04.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edmjfifl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eemgplno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fajnfl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkeodaai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gglpibgm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghbbcd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgppmd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fhbimf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfdfgiid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkaopp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hakgmjoh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkckeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edhakj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fafdkmap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkcboack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkjhoq32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chighhee.dll"	Fhbimf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nobdka32.dll"	Gfbibikg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghbbcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	dab1e6bc56b34d1ed165bc1be20757871e8991c6ec8f432eab23e6fc37ea9a04.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fajnfl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghpendjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ghpendjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gglpibgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdpagn32.dll"	Goljqnpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Haojfo32.dll"	Eggmge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eemgplno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkjhoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjfilbnn.dll"	Gnkaalkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gojnko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkaopp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfbibikg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gdgfce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oddinb32.dll"	Fgppmd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fafdkmap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfbibikg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pocehodm.dll"	Gkaopp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khmnbgbp.dll"	Ekefmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fkeodaai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkjhoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hnagak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dipidh32.dll"	Fkeodaai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Edmjfifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnaopd32.dll"	Emhldnkj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkaopp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hghoeqmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfipbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqjbok32.dll"	Gaadfkgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gaadfkgc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfipbh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	dab1e6bc56b34d1ed165bc1be20757871e8991c6ec8f432eab23e6fc37ea9a04.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahamlm32.dll"	Ggqida32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Goljqnpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eggmge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fhbimf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gnmnfkia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mecclb32.dll"	Hghoeqmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	dab1e6bc56b34d1ed165bc1be20757871e8991c6ec8f432eab23e6fc37ea9a04.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekefmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkcboack.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjmejn32.dll"	Gfdfgiid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glokko32.dll"	Hdicienl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edmjfifl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eemgplno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkeodaai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gepmlimi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lciagi32.dll"	Ghbbcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nholna32.dll"	Hakgmjoh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Feapkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnqhicol.dll"	Gojnko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfdfgiid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkckeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkckeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjjpbg32.dll"	Edmjfifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Conjbj32.dll"	Feapkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fhbimf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hghoeqmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkjqle32.dll"	Hnagak32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	dab1e6bc56b34d1ed165bc1be20757871e8991c6ec8f432eab23e6fc37ea9a04.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfdfgiid.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 1852	2940	dab1e6bc56b34d1ed165bc1be20757871e8991c6ec8f432eab23e6fc37ea9a04.exe	83
PID 2940 wrote to memory of 1852	2940	dab1e6bc56b34d1ed165bc1be20757871e8991c6ec8f432eab23e6fc37ea9a04.exe	83
PID 2940 wrote to memory of 1852	2940	dab1e6bc56b34d1ed165bc1be20757871e8991c6ec8f432eab23e6fc37ea9a04.exe	83
PID 1852 wrote to memory of 2388	1852	Edhakj32.exe	84
PID 1852 wrote to memory of 2388	1852	Edhakj32.exe	84
PID 1852 wrote to memory of 2388	1852	Edhakj32.exe	84
PID 2388 wrote to memory of 1356	2388	Eggmge32.exe	85
PID 2388 wrote to memory of 1356	2388	Eggmge32.exe	85
PID 2388 wrote to memory of 1356	2388	Eggmge32.exe	85
PID 1356 wrote to memory of 5020	1356	Ekefmc32.exe	86
PID 1356 wrote to memory of 5020	1356	Ekefmc32.exe	86
PID 1356 wrote to memory of 5020	1356	Ekefmc32.exe	86
PID 5020 wrote to memory of 3548	5020	Edmjfifl.exe	87
PID 5020 wrote to memory of 3548	5020	Edmjfifl.exe	87
PID 5020 wrote to memory of 3548	5020	Edmjfifl.exe	87
PID 3548 wrote to memory of 3632	3548	Eemgplno.exe	88
PID 3548 wrote to memory of 3632	3548	Eemgplno.exe	88
PID 3548 wrote to memory of 3632	3548	Eemgplno.exe	88
PID 3632 wrote to memory of 232	3632	Emhldnkj.exe	89
PID 3632 wrote to memory of 232	3632	Emhldnkj.exe	89
PID 3632 wrote to memory of 232	3632	Emhldnkj.exe	89
PID 232 wrote to memory of 5004	232	Fgppmd32.exe	90
PID 232 wrote to memory of 5004	232	Fgppmd32.exe	90
PID 232 wrote to memory of 5004	232	Fgppmd32.exe	90
PID 5004 wrote to memory of 5000	5004	Fafdkmap.exe	91
PID 5004 wrote to memory of 5000	5004	Fafdkmap.exe	91
PID 5004 wrote to memory of 5000	5004	Fafdkmap.exe	91
PID 5000 wrote to memory of 4828	5000	Feapkk32.exe	92
PID 5000 wrote to memory of 4828	5000	Feapkk32.exe	92
PID 5000 wrote to memory of 4828	5000	Feapkk32.exe	92
PID 4828 wrote to memory of 5052	4828	Fhbimf32.exe	93
PID 4828 wrote to memory of 5052	4828	Fhbimf32.exe	93
PID 4828 wrote to memory of 5052	4828	Fhbimf32.exe	93
PID 5052 wrote to memory of 3024	5052	Fajnfl32.exe	94
PID 5052 wrote to memory of 3024	5052	Fajnfl32.exe	94
PID 5052 wrote to memory of 3024	5052	Fajnfl32.exe	94
PID 3024 wrote to memory of 2656	3024	Fkcboack.exe	95
PID 3024 wrote to memory of 2656	3024	Fkcboack.exe	95
PID 3024 wrote to memory of 2656	3024	Fkcboack.exe	95
PID 2656 wrote to memory of 3508	2656	Fehfljca.exe	96
PID 2656 wrote to memory of 3508	2656	Fehfljca.exe	96
PID 2656 wrote to memory of 3508	2656	Fehfljca.exe	96
PID 3508 wrote to memory of 5044	3508	Fkeodaai.exe	97
PID 3508 wrote to memory of 5044	3508	Fkeodaai.exe	97
PID 3508 wrote to memory of 5044	3508	Fkeodaai.exe	97
PID 5044 wrote to memory of 500	5044	Gglpibgm.exe	98
PID 5044 wrote to memory of 500	5044	Gglpibgm.exe	98
PID 5044 wrote to memory of 500	5044	Gglpibgm.exe	98
PID 500 wrote to memory of 4136	500	Gaadfkgc.exe	99
PID 500 wrote to memory of 4136	500	Gaadfkgc.exe	99
PID 500 wrote to memory of 4136	500	Gaadfkgc.exe	99
PID 4136 wrote to memory of 2320	4136	Gkjhoq32.exe	100
PID 4136 wrote to memory of 2320	4136	Gkjhoq32.exe	100
PID 4136 wrote to memory of 2320	4136	Gkjhoq32.exe	100
PID 2320 wrote to memory of 3124	2320	Gepmlimi.exe	101
PID 2320 wrote to memory of 3124	2320	Gepmlimi.exe	101
PID 2320 wrote to memory of 3124	2320	Gepmlimi.exe	101
PID 3124 wrote to memory of 1248	3124	Ggqida32.exe	102
PID 3124 wrote to memory of 1248	3124	Ggqida32.exe	102
PID 3124 wrote to memory of 1248	3124	Ggqida32.exe	102
PID 1248 wrote to memory of 1616	1248	Gnkaalkd.exe	103
PID 1248 wrote to memory of 1616	1248	Gnkaalkd.exe	103
PID 1248 wrote to memory of 1616	1248	Gnkaalkd.exe	103
PID 1616 wrote to memory of 5088	1616	Gfbibikg.exe	104

C:\Users\Admin\AppData\Local\Temp\dab1e6bc56b34d1ed165bc1be20757871e8991c6ec8f432eab23e6fc37ea9a04.exe
"C:\Users\Admin\AppData\Local\Temp\dab1e6bc56b34d1ed165bc1be20757871e8991c6ec8f432eab23e6fc37ea9a04.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\Edhakj32.exe
  C:\Windows\system32\Edhakj32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\SysWOW64\Eggmge32.exe
    C:\Windows\system32\Eggmge32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Windows\SysWOW64\Ekefmc32.exe
      C:\Windows\system32\Ekefmc32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1356
    - - C:\Windows\SysWOW64\Edmjfifl.exe
        
        C:\Windows\system32\Edmjfifl.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5020
      - C:\Windows\SysWOW64\Eemgplno.exe
        
        C:\Windows\system32\Eemgplno.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3548
        
        C:\Windows\SysWOW64\Emhldnkj.exe
        
        C:\Windows\system32\Emhldnkj.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3632
        
        C:\Windows\SysWOW64\Fgppmd32.exe
        
        C:\Windows\system32\Fgppmd32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:232
        
        C:\Windows\SysWOW64\Fafdkmap.exe
        
        C:\Windows\system32\Fafdkmap.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SysWOW64\Feapkk32.exe
        
        C:\Windows\system32\Feapkk32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Fhbimf32.exe
        
        C:\Windows\system32\Fhbimf32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4828
        
        C:\Windows\SysWOW64\Fajnfl32.exe
        
        C:\Windows\system32\Fajnfl32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\Fkcboack.exe
        
        C:\Windows\system32\Fkcboack.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Windows\SysWOW64\Fkeodaai.exe
        
        C:\Windows\system32\Fkeodaai.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\SysWOW64\Gglpibgm.exe
        
        C:\Windows\system32\Gglpibgm.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\SysWOW64\Gaadfkgc.exe
        
        C:\Windows\system32\Gaadfkgc.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:500
        
        C:\Windows\SysWOW64\Gkjhoq32.exe
        
        C:\Windows\system32\Gkjhoq32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4136
        
        C:\Windows\SysWOW64\Gepmlimi.exe
        
        C:\Windows\system32\Gepmlimi.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3124
        
        C:\Windows\SysWOW64\Gnkaalkd.exe
        
        C:\Windows\system32\Gnkaalkd.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1248
        
        C:\Windows\SysWOW64\Gfbibikg.exe
        
        C:\Windows\system32\Gfbibikg.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Windows\SysWOW64\Ghpendjj.exe
        
        C:\Windows\system32\Ghpendjj.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5088
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2152
        
        C:\Windows\SysWOW64\Gnmnfkia.exe
        
        C:\Windows\system32\Gnmnfkia.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4368
        
        C:\Windows\SysWOW64\Gfdfgiid.exe
        
        C:\Windows\system32\Gfdfgiid.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2228
        
        C:\Windows\SysWOW64\Gdgfce32.exe
        
        C:\Windows\system32\Gdgfce32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1480
        
        C:\Windows\SysWOW64\Ghbbcd32.exe
        
        C:\Windows\system32\Ghbbcd32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4476
        
        C:\Windows\SysWOW64\Gkaopp32.exe
        
        C:\Windows\system32\Gkaopp32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1264
        
        C:\Windows\SysWOW64\Goljqnpd.exe
        
        C:\Windows\system32\Goljqnpd.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:812
        
        C:\Windows\SysWOW64\Hakgmjoh.exe
        
        C:\Windows\system32\Hakgmjoh.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:752
        
        C:\Windows\SysWOW64\Hdicienl.exe
        
        C:\Windows\system32\Hdicienl.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:744
        
        C:\Windows\SysWOW64\Hghoeqmp.exe
        
        C:\Windows\system32\Hghoeqmp.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3652
        
        C:\Windows\SysWOW64\Hkckeo32.exe
        
        C:\Windows\system32\Hkckeo32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4428
        
        C:\Windows\SysWOW64\Hnagak32.exe
        
        C:\Windows\system32\Hnagak32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4908
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4008
        
        C:\Windows\SysWOW64\Hdlpneli.exe
        
        C:\Windows\system32\Hdlpneli.exe
        37⤵
        Executes dropped EXE
        
        PID:1660
        
        C:\Windows\SysWOW64\Hgjljpkm.exe
        
        C:\Windows\system32\Hgjljpkm.exe
        38⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\Hkehkocf.exe
        
        C:\Windows\system32\Hkehkocf.exe
        39⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        40⤵
        
        PID:208
        
        C:\Windows\SysWOW64\Hbpphi32.exe
        
        C:\Windows\system32\Hbpphi32.exe
        41⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Hdnldd32.exe
        
        C:\Windows\system32\Hdnldd32.exe
        42⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\Hglipp32.exe
        
        C:\Windows\system32\Hglipp32.exe
        43⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\Hkhdqoac.exe
        
        C:\Windows\system32\Hkhdqoac.exe
        44⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Hnfamjqg.exe
        
        C:\Windows\system32\Hnfamjqg.exe
        45⤵
        
        PID:976
        
        C:\Windows\SysWOW64\Hfningai.exe
        
        C:\Windows\system32\Hfningai.exe
        46⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Hhlejcpm.exe
        
        C:\Windows\system32\Hhlejcpm.exe
        47⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\Hgoeep32.exe
        
        C:\Windows\system32\Hgoeep32.exe
        48⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        49⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\Hbdjchgn.exe
        
        C:\Windows\system32\Hbdjchgn.exe
        50⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\Hfpecg32.exe
        
        C:\Windows\system32\Hfpecg32.exe
        51⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Hhnbpb32.exe
        
        C:\Windows\system32\Hhnbpb32.exe
        52⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Hkmnln32.exe
        
        C:\Windows\system32\Hkmnln32.exe
        53⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Ibffhhek.exe
        
        C:\Windows\system32\Ibffhhek.exe
        54⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\Idebdcdo.exe
        
        C:\Windows\system32\Idebdcdo.exe
        55⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Igcoqocb.exe
        
        C:\Windows\system32\Igcoqocb.exe
        56⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\Iokgal32.exe
        
        C:\Windows\system32\Iokgal32.exe
        57⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\Ibicnh32.exe
        
        C:\Windows\system32\Ibicnh32.exe
        58⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Iickkbje.exe
        
        C:\Windows\system32\Iickkbje.exe
        59⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Igfkfo32.exe
        
        C:\Windows\system32\Igfkfo32.exe
        60⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Ibkpcg32.exe
        
        C:\Windows\system32\Ibkpcg32.exe
        61⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\Idjlpc32.exe
        
        C:\Windows\system32\Idjlpc32.exe
        62⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\Inbqhhfj.exe
        
        C:\Windows\system32\Inbqhhfj.exe
        63⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\Igjeanmj.exe
        
        C:\Windows\system32\Igjeanmj.exe
        64⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        65⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Iijaka32.exe
        
        C:\Windows\system32\Iijaka32.exe
        66⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        67⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\Jilnqqbj.exe
        
        C:\Windows\system32\Jilnqqbj.exe
        68⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Jnifigpa.exe
        
        C:\Windows\system32\Jnifigpa.exe
        69⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\Jecofa32.exe
        
        C:\Windows\system32\Jecofa32.exe
        70⤵
        
        PID:492
        
        C:\Windows\SysWOW64\Jiokfpph.exe
        
        C:\Windows\system32\Jiokfpph.exe
        71⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\Joiccj32.exe
        
        C:\Windows\system32\Joiccj32.exe
        72⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\Jeekkafl.exe
        
        C:\Windows\system32\Jeekkafl.exe
        73⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Jkodhk32.exe
        
        C:\Windows\system32\Jkodhk32.exe
        74⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\Jfehed32.exe
        
        C:\Windows\system32\Jfehed32.exe
        75⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\Jicdap32.exe
        
        C:\Windows\system32\Jicdap32.exe
        76⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Jpmlnjco.exe
        
        C:\Windows\system32\Jpmlnjco.exe
        77⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Jejefqaf.exe
        
        C:\Windows\system32\Jejefqaf.exe
        78⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Kldmckic.exe
        
        C:\Windows\system32\Kldmckic.exe
        79⤵
        
        PID:32
        
        C:\Windows\SysWOW64\Kbnepe32.exe
        
        C:\Windows\system32\Kbnepe32.exe
        80⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\Kelalp32.exe
        
        C:\Windows\system32\Kelalp32.exe
        81⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        82⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Kbpbed32.exe
        
        C:\Windows\system32\Kbpbed32.exe
        83⤵
        
        PID:2144

C:\Windows\SysWOW64\Kngcje32.exe
C:\Windows\system32\Kngcje32.exe
1⤵
PID:3428

C:\Windows\SysWOW64\Klkcdj32.exe
C:\Windows\system32\Klkcdj32.exe
1⤵
PID:3456
- C:\Windows\SysWOW64\Kechmoil.exe
  C:\Windows\system32\Kechmoil.exe
  2⤵
  PID:2820
- - C:\Windows\SysWOW64\Klmpiiai.exe
    C:\Windows\system32\Klmpiiai.exe
    3⤵
    PID:2036
  - - C:\Windows\SysWOW64\Kbghfc32.exe
      C:\Windows\system32\Kbghfc32.exe
      4⤵
      PID:400
    - - C:\Windows\SysWOW64\Kefdbo32.exe
        
        C:\Windows\system32\Kefdbo32.exe
        5⤵
        
        PID:2232
      - C:\Windows\SysWOW64\Lhdqnj32.exe
        
        C:\Windows\system32\Lhdqnj32.exe
        6⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\Lpkiph32.exe
        
        C:\Windows\system32\Lpkiph32.exe
        7⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        8⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Lehaho32.exe
        
        C:\Windows\system32\Lehaho32.exe
        9⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Lidmhmnp.exe
        
        C:\Windows\system32\Lidmhmnp.exe
        10⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Llbidimc.exe
        
        C:\Windows\system32\Llbidimc.exe
        11⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\Lnqeqd32.exe
        
        C:\Windows\system32\Lnqeqd32.exe
        12⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\Lfhnaa32.exe
        
        C:\Windows\system32\Lfhnaa32.exe
        13⤵
        
        PID:3916

C:\Windows\SysWOW64\Lhijijbg.exe
C:\Windows\system32\Lhijijbg.exe
1⤵
PID:2584
- C:\Windows\SysWOW64\Lppbkgcj.exe
  C:\Windows\system32\Lppbkgcj.exe
  2⤵
  PID:4884

C:\Windows\SysWOW64\Lfjjga32.exe
C:\Windows\system32\Lfjjga32.exe
1⤵
PID:2096
- C:\Windows\SysWOW64\Lihfcm32.exe
  C:\Windows\system32\Lihfcm32.exe
  2⤵
  PID:4160
- - C:\Windows\SysWOW64\Llgcph32.exe
    C:\Windows\system32\Llgcph32.exe
    3⤵
    PID:3940

C:\Windows\SysWOW64\Lflgmqhd.exe
C:\Windows\system32\Lflgmqhd.exe
1⤵
PID:4452
- C:\Windows\SysWOW64\Likcilhh.exe
  C:\Windows\system32\Likcilhh.exe
  2⤵
  PID:4012
- - C:\Windows\SysWOW64\Lhncdi32.exe
    C:\Windows\system32\Lhncdi32.exe
    3⤵
    PID:3004
  - - C:\Windows\SysWOW64\Lpekef32.exe
      C:\Windows\system32\Lpekef32.exe
      4⤵
      PID:3348
    - - C:\Windows\SysWOW64\Lbchba32.exe
        
        C:\Windows\system32\Lbchba32.exe
        5⤵
        
        PID:1988
      - C:\Windows\SysWOW64\Lfodbqfa.exe
        
        C:\Windows\system32\Lfodbqfa.exe
        6⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\Mimpolee.exe
        
        C:\Windows\system32\Mimpolee.exe
        7⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        8⤵
        
        PID:5148

C:\Windows\SysWOW64\Miomdk32.exe
C:\Windows\system32\Miomdk32.exe
1⤵
PID:5244
- C:\Windows\SysWOW64\Mlnipg32.exe
  C:\Windows\system32\Mlnipg32.exe
  2⤵
  PID:5284

C:\Windows\SysWOW64\Mfcmmp32.exe
C:\Windows\system32\Mfcmmp32.exe
1⤵
PID:5364
- C:\Windows\SysWOW64\Mefmimif.exe
  C:\Windows\system32\Mefmimif.exe
  2⤵
  PID:5404

C:\Windows\SysWOW64\Mlpeff32.exe
C:\Windows\system32\Mlpeff32.exe
1⤵
PID:5484

C:\Windows\SysWOW64\Moobbb32.exe
C:\Windows\system32\Moobbb32.exe
1⤵
PID:5564

C:\Windows\SysWOW64\Mehjol32.exe
C:\Windows\system32\Mehjol32.exe
1⤵
PID:5644

C:\Windows\SysWOW64\Mhgfkg32.exe
C:\Windows\system32\Mhgfkg32.exe
1⤵
PID:5724

C:\Windows\SysWOW64\Mblkhq32.exe
C:\Windows\system32\Mblkhq32.exe
1⤵
PID:5804

C:\Windows\SysWOW64\Mekgdl32.exe
C:\Windows\system32\Mekgdl32.exe
1⤵
PID:5884

C:\Windows\SysWOW64\Mleoafmn.exe
C:\Windows\system32\Mleoafmn.exe
1⤵
PID:5964

C:\Windows\SysWOW64\Mbognp32.exe
C:\Windows\system32\Mbognp32.exe
1⤵
PID:6044

C:\Windows\SysWOW64\Nemcjk32.exe
C:\Windows\system32\Nemcjk32.exe
1⤵
PID:6124
- C:\Windows\SysWOW64\Nhlpfgbb.exe
  C:\Windows\system32\Nhlpfgbb.exe
  2⤵
  PID:5140
- - C:\Windows\SysWOW64\Nlglfe32.exe
    C:\Windows\system32\Nlglfe32.exe
    3⤵
    PID:5236

C:\Windows\SysWOW64\Nbadcpbh.exe
C:\Windows\system32\Nbadcpbh.exe
1⤵
PID:5380

C:\Windows\SysWOW64\Niklpj32.exe
C:\Windows\system32\Niklpj32.exe
1⤵
PID:5516
- C:\Windows\SysWOW64\Nhnlkfpp.exe
  C:\Windows\system32\Nhnlkfpp.exe
  2⤵
  PID:5592

C:\Windows\SysWOW64\Nbcqiope.exe
C:\Windows\system32\Nbcqiope.exe
1⤵
PID:5720
- C:\Windows\SysWOW64\Nebmekoi.exe
  C:\Windows\system32\Nebmekoi.exe
  2⤵
  PID:5796
- - C:\Windows\SysWOW64\Niniei32.exe
    C:\Windows\system32\Niniei32.exe
    3⤵
    PID:5868
  - - C:\Windows\SysWOW64\Nhpiafnm.exe
      C:\Windows\system32\Nhpiafnm.exe
      4⤵
      PID:5940
    - - C:\Windows\SysWOW64\Npgabc32.exe
        
        C:\Windows\system32\Npgabc32.exe
        5⤵
        
        PID:6000
      - C:\Windows\SysWOW64\Nojanpej.exe
        
        C:\Windows\system32\Nojanpej.exe
        6⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        7⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Nedjjj32.exe
        
        C:\Windows\system32\Nedjjj32.exe
        8⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Nipekiep.exe
        
        C:\Windows\system32\Nipekiep.exe
        9⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Nlnbgddc.exe
        
        C:\Windows\system32\Nlnbgddc.exe
        10⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        11⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Nchjdo32.exe
        
        C:\Windows\system32\Nchjdo32.exe
        12⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        13⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Nheble32.exe
        
        C:\Windows\system32\Nheble32.exe
        14⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Nplkmckj.exe
        
        C:\Windows\system32\Nplkmckj.exe
        15⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Ogfcjm32.exe
        
        C:\Windows\system32\Ogfcjm32.exe
        16⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        17⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Ohgoaehe.exe
        
        C:\Windows\system32\Ohgoaehe.exe
        18⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Olckbd32.exe
        
        C:\Windows\system32\Olckbd32.exe
        19⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Ooagno32.exe
        
        C:\Windows\system32\Ooagno32.exe
        20⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Ocmconhk.exe
        
        C:\Windows\system32\Ocmconhk.exe
        21⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Oekpkigo.exe
        
        C:\Windows\system32\Oekpkigo.exe
        22⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        23⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Opadhb32.exe
        
        C:\Windows\system32\Opadhb32.exe
        24⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Oenlqi32.exe
        
        C:\Windows\system32\Oenlqi32.exe
        25⤵
        
        PID:6404

C:\Windows\SysWOW64\Oohnonij.exe
C:\Windows\system32\Oohnonij.exe
1⤵
PID:6508

C:\Windows\SysWOW64\Oebflhaf.exe
C:\Windows\system32\Oebflhaf.exe
1⤵
PID:6596

C:\Windows\SysWOW64\Ocffempp.exe
C:\Windows\system32\Ocffempp.exe
1⤵
PID:6728
- C:\Windows\SysWOW64\Pedbahod.exe
  C:\Windows\system32\Pedbahod.exe
  2⤵
  PID:6792
- - C:\Windows\SysWOW64\Pjpobg32.exe
    C:\Windows\system32\Pjpobg32.exe
    3⤵
    PID:6848
  - - C:\Windows\SysWOW64\Pomgjn32.exe
      C:\Windows\system32\Pomgjn32.exe
      4⤵
      PID:6892
    - - C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        5⤵
        
        PID:6940
      - C:\Windows\SysWOW64\Pjbkgfej.exe
        
        C:\Windows\system32\Pjbkgfej.exe
        6⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        7⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Plagcbdn.exe
        
        C:\Windows\system32\Plagcbdn.exe
        8⤵
        
        PID:7072

C:\Windows\SysWOW64\Pgflqkdd.exe
C:\Windows\system32\Pgflqkdd.exe
1⤵
PID:7160

C:\Windows\SysWOW64\Phhhhc32.exe
C:\Windows\system32\Phhhhc32.exe
1⤵
PID:6316
- C:\Windows\SysWOW64\Ppopjp32.exe
  C:\Windows\system32\Ppopjp32.exe
  2⤵
  PID:6412

C:\Windows\SysWOW64\Pflibgil.exe
C:\Windows\system32\Pflibgil.exe
1⤵
PID:6560

C:\Windows\SysWOW64\Pleaoa32.exe
C:\Windows\system32\Pleaoa32.exe
1⤵
PID:6648

C:\Windows\SysWOW64\Pcpikkge.exe
C:\Windows\system32\Pcpikkge.exe
1⤵
PID:6840
- C:\Windows\SysWOW64\Pgkelj32.exe
  C:\Windows\system32\Pgkelj32.exe
  2⤵
  PID:6904

C:\Windows\SysWOW64\Phlacbfm.exe
C:\Windows\system32\Phlacbfm.exe
1⤵
PID:6844

C:\Windows\SysWOW64\Pofjpl32.exe
C:\Windows\system32\Pofjpl32.exe
1⤵
PID:7124

C:\Windows\SysWOW64\Qfpbmfdf.exe
C:\Windows\system32\Qfpbmfdf.exe
1⤵
PID:6256

C:\Windows\SysWOW64\Qljjjqlc.exe
C:\Windows\system32\Qljjjqlc.exe
1⤵
PID:6516
- C:\Windows\SysWOW64\Qqffjo32.exe
  C:\Windows\system32\Qqffjo32.exe
  2⤵
  PID:6636

C:\Windows\SysWOW64\Qcdbfk32.exe
C:\Windows\system32\Qcdbfk32.exe
1⤵
PID:6804

C:\Windows\SysWOW64\Qhakoa32.exe
C:\Windows\system32\Qhakoa32.exe
1⤵
PID:7100

C:\Windows\SysWOW64\Qqhcpo32.exe
C:\Windows\system32\Qqhcpo32.exe
1⤵
PID:6392

C:\Windows\SysWOW64\Agbkmijg.exe
C:\Windows\system32\Agbkmijg.exe
1⤵
PID:6664
- C:\Windows\SysWOW64\Afelhf32.exe
  C:\Windows\system32\Afelhf32.exe
  2⤵
  PID:6884
- - C:\Windows\SysWOW64\Amodep32.exe
    C:\Windows\system32\Amodep32.exe
    3⤵
    PID:6740

C:\Windows\SysWOW64\Agdhbi32.exe
C:\Windows\system32\Agdhbi32.exe
1⤵
PID:6668
- C:\Windows\SysWOW64\Ajcdnd32.exe
  C:\Windows\system32\Ajcdnd32.exe
  2⤵
  PID:7008

C:\Windows\SysWOW64\Aqmlknnd.exe
C:\Windows\system32\Aqmlknnd.exe
1⤵
PID:6616
- C:\Windows\SysWOW64\Aopmfk32.exe
  C:\Windows\system32\Aopmfk32.exe
  2⤵
  PID:6980
- - C:\Windows\SysWOW64\Aggegh32.exe
    C:\Windows\system32\Aggegh32.exe
    3⤵
    PID:6448

C:\Windows\SysWOW64\Amcmpodi.exe
C:\Windows\system32\Amcmpodi.exe
1⤵
PID:6920

C:\Windows\SysWOW64\Acnemi32.exe
C:\Windows\system32\Acnemi32.exe
1⤵
PID:6548

C:\Windows\SysWOW64\Ajhniccb.exe
C:\Windows\system32\Ajhniccb.exe
1⤵
PID:7248

C:\Windows\SysWOW64\Aqaffn32.exe
C:\Windows\system32\Aqaffn32.exe
1⤵
PID:7336
- C:\Windows\SysWOW64\Aodfajaj.exe
  C:\Windows\system32\Aodfajaj.exe
  2⤵
  PID:7380
- - C:\Windows\SysWOW64\Acpbbi32.exe
    C:\Windows\system32\Acpbbi32.exe
    3⤵
    PID:7424

C:\Windows\SysWOW64\Ajjjocap.exe
C:\Windows\system32\Ajjjocap.exe
1⤵
PID:7512

C:\Windows\SysWOW64\Bqdblmhl.exe
C:\Windows\system32\Bqdblmhl.exe
1⤵
PID:7596

C:\Windows\SysWOW64\Bgnkhg32.exe
C:\Windows\system32\Bgnkhg32.exe
1⤵
PID:7684

C:\Windows\SysWOW64\Biogppeg.exe
C:\Windows\system32\Biogppeg.exe
1⤵
PID:7772

C:\Windows\SysWOW64\Boipmj32.exe
C:\Windows\system32\Boipmj32.exe
1⤵
PID:7860

C:\Windows\SysWOW64\Bgpgng32.exe
C:\Windows\system32\Bgpgng32.exe
1⤵
PID:7948
- C:\Windows\SysWOW64\Bfchidda.exe
  C:\Windows\system32\Bfchidda.exe
  2⤵
  PID:7992
- - C:\Windows\SysWOW64\Bjodjb32.exe
    C:\Windows\system32\Bjodjb32.exe
    3⤵
    PID:8036

C:\Windows\SysWOW64\Bqilgmdg.exe
C:\Windows\system32\Bqilgmdg.exe
1⤵
PID:8124

C:\Windows\SysWOW64\Bgbdcgld.exe
C:\Windows\system32\Bgbdcgld.exe
1⤵
PID:7192
- C:\Windows\SysWOW64\Bfedoc32.exe
  C:\Windows\system32\Bfedoc32.exe
  2⤵
  PID:7256
- - C:\Windows\SysWOW64\Bidqko32.exe
    C:\Windows\system32\Bidqko32.exe
    3⤵
    PID:7324

C:\Windows\SysWOW64\Bciehh32.exe
C:\Windows\system32\Bciehh32.exe
1⤵
PID:7536

C:\Windows\SysWOW64\Bfhadc32.exe
C:\Windows\system32\Bfhadc32.exe
1⤵
PID:7672

C:\Windows\SysWOW64\Bifmqo32.exe
C:\Windows\system32\Bifmqo32.exe
1⤵
PID:7808

C:\Windows\SysWOW64\Bppfmigl.exe
C:\Windows\system32\Bppfmigl.exe
1⤵
PID:7276
- C:\Windows\SysWOW64\Bggnof32.exe
  C:\Windows\system32\Bggnof32.exe
  2⤵
  PID:7372
- - C:\Windows\SysWOW64\Bjfjka32.exe
    C:\Windows\system32\Bjfjka32.exe
    3⤵
    PID:7480
  - - C:\Windows\SysWOW64\Bihjfnmm.exe
      C:\Windows\system32\Bihjfnmm.exe
      4⤵
      PID:7592

C:\Windows\SysWOW64\Ccnncgmc.exe
C:\Windows\system32\Ccnncgmc.exe
1⤵
PID:7828
- C:\Windows\SysWOW64\Cflkpblf.exe
  C:\Windows\system32\Cflkpblf.exe
  2⤵
  PID:7932
- - C:\Windows\SysWOW64\Cjhfpa32.exe
    C:\Windows\system32\Cjhfpa32.exe
    3⤵
    PID:8000
  - - C:\Windows\SysWOW64\Cmfclm32.exe
      C:\Windows\system32\Cmfclm32.exe
      4⤵
      PID:8136

C:\Windows\SysWOW64\Cpeohh32.exe
C:\Windows\system32\Cpeohh32.exe
1⤵
PID:7212
- C:\Windows\SysWOW64\Cglgjeci.exe
  C:\Windows\system32\Cglgjeci.exe
  2⤵
  PID:7344

C:\Windows\SysWOW64\Cpglnhad.exe
C:\Windows\system32\Cpglnhad.exe
1⤵
PID:8152
- C:\Windows\SysWOW64\Cgndoeag.exe
  C:\Windows\system32\Cgndoeag.exe
  2⤵
  PID:7172
- - C:\Windows\SysWOW64\Cmklglpn.exe
    C:\Windows\system32\Cmklglpn.exe
    3⤵
    PID:7456

C:\Windows\SysWOW64\Cceddf32.exe
C:\Windows\system32\Cceddf32.exe
1⤵
PID:8188
- C:\Windows\SysWOW64\Cfcqpa32.exe
  C:\Windows\system32\Cfcqpa32.exe
  2⤵
  PID:7548
- - C:\Windows\SysWOW64\Cibmlmeb.exe
    C:\Windows\system32\Cibmlmeb.exe
    3⤵
    PID:8132

C:\Windows\SysWOW64\Ccgajfeh.exe
C:\Windows\system32\Ccgajfeh.exe
1⤵
PID:7624

C:\Windows\SysWOW64\Cffmfadl.exe
C:\Windows\system32\Cffmfadl.exe
1⤵
PID:7652
- C:\Windows\SysWOW64\Cidjbmcp.exe
  C:\Windows\system32\Cidjbmcp.exe
  2⤵
  PID:7368
- - C:\Windows\SysWOW64\Dmpfbk32.exe
    C:\Windows\system32\Dmpfbk32.exe
    3⤵
    PID:8120
  - - C:\Windows\SysWOW64\Dpnbog32.exe
      C:\Windows\system32\Dpnbog32.exe
      4⤵
      PID:8228
    - - C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        5⤵
        
        PID:8272
      - C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        6⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        7⤵
        
        PID:8364

C:\Windows\SysWOW64\Dpqodfij.exe
C:\Windows\system32\Dpqodfij.exe
1⤵
PID:8452
- C:\Windows\SysWOW64\Dclkee32.exe
  C:\Windows\system32\Dclkee32.exe
  2⤵
  PID:8492
- - C:\Windows\SysWOW64\Dfjgaq32.exe
    C:\Windows\system32\Dfjgaq32.exe
    3⤵
    PID:8540
  - - C:\Windows\SysWOW64\Djfcaohp.exe
      C:\Windows\system32\Djfcaohp.exe
      4⤵
      PID:8584

C:\Windows\SysWOW64\Dapkni32.exe
C:\Windows\system32\Dapkni32.exe
1⤵
PID:8672
- C:\Windows\SysWOW64\Dpckjfgg.exe
  C:\Windows\system32\Dpckjfgg.exe
  2⤵
  PID:8716
- - C:\Windows\SysWOW64\Dhjckcgi.exe
    C:\Windows\system32\Dhjckcgi.exe
    3⤵
    PID:8760

C:\Windows\SysWOW64\Dikpbl32.exe
C:\Windows\system32\Dikpbl32.exe
1⤵
PID:8848

C:\Windows\SysWOW64\Dpehof32.exe
C:\Windows\system32\Dpehof32.exe
1⤵
PID:8980

C:\Windows\SysWOW64\Dhlpqc32.exe
C:\Windows\system32\Dhlpqc32.exe
1⤵
PID:9068

C:\Windows\SysWOW64\Dinmhkke.exe
C:\Windows\system32\Dinmhkke.exe
1⤵
PID:9156
- C:\Windows\SysWOW64\Daediilg.exe
  C:\Windows\system32\Daediilg.exe
  2⤵
  PID:9200
- - C:\Windows\SysWOW64\Dpgeee32.exe
    C:\Windows\system32\Dpgeee32.exe
    3⤵
    PID:8236
  - - C:\Windows\SysWOW64\Ddcqedkk.exe
      C:\Windows\system32\Ddcqedkk.exe
      4⤵
      PID:8304
    - - C:\Windows\SysWOW64\Djmibn32.exe
        
        C:\Windows\system32\Djmibn32.exe
        5⤵
        
        PID:8384
      - C:\Windows\SysWOW64\Emlenj32.exe
        
        C:\Windows\system32\Emlenj32.exe
        6⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Eagaoh32.exe
        
        C:\Windows\system32\Eagaoh32.exe
        7⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Epjajeqo.exe
        
        C:\Windows\system32\Epjajeqo.exe
        8⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        9⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Efdjgo32.exe
        
        C:\Windows\system32\Efdjgo32.exe
        10⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Ejpfhnpe.exe
        
        C:\Windows\system32\Ejpfhnpe.exe
        11⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Eibfck32.exe
        
        C:\Windows\system32\Eibfck32.exe
        12⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Eaindh32.exe
        
        C:\Windows\system32\Eaindh32.exe
        13⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Eplnpeol.exe
        
        C:\Windows\system32\Eplnpeol.exe
        14⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        15⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        16⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Ejbbmnnb.exe
        
        C:\Windows\system32\Ejbbmnnb.exe
        17⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        18⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Empoiimf.exe
        
        C:\Windows\system32\Empoiimf.exe
        19⤵
        
        PID:8428

C:\Windows\SysWOW64\Edjgfcec.exe
C:\Windows\system32\Edjgfcec.exe
1⤵
PID:8656
- C:\Windows\SysWOW64\Efhcbodf.exe
  C:\Windows\system32\Efhcbodf.exe
  2⤵
  PID:8756
- - C:\Windows\SysWOW64\Ejdocm32.exe
    C:\Windows\system32\Ejdocm32.exe
    3⤵
    PID:8860

C:\Windows\SysWOW64\Eangpgcl.exe
C:\Windows\system32\Eangpgcl.exe
1⤵
PID:9080

C:\Windows\SysWOW64\Ehhpla32.exe
C:\Windows\system32\Ehhpla32.exe
1⤵
PID:8344
- C:\Windows\SysWOW64\Ejflhm32.exe
  C:\Windows\system32\Ejflhm32.exe
  2⤵
  PID:8508
- - C:\Windows\SysWOW64\Eiildjag.exe
    C:\Windows\system32\Eiildjag.exe
    3⤵
    PID:8684
  - - C:\Windows\SysWOW64\Eaqdegaj.exe
      C:\Windows\system32\Eaqdegaj.exe
      4⤵
      PID:8836
    - - C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        5⤵
        
        PID:9000
      - C:\Windows\SysWOW64\Edopabqn.exe
        
        C:\Windows\system32\Edopabqn.exe
        6⤵
        
        PID:9168

C:\Windows\SysWOW64\Fkihnmhj.exe
C:\Windows\system32\Fkihnmhj.exe
1⤵
PID:8640

C:\Windows\SysWOW64\Facqkg32.exe
C:\Windows\system32\Facqkg32.exe
1⤵
PID:9148

C:\Windows\SysWOW64\Fhmigagd.exe
C:\Windows\system32\Fhmigagd.exe
1⤵
PID:8960

C:\Windows\SysWOW64\Fineoi32.exe
C:\Windows\system32\Fineoi32.exe
1⤵
PID:8216
- C:\Windows\SysWOW64\Fmjaphek.exe
  C:\Windows\system32\Fmjaphek.exe
  2⤵
  PID:8444

C:\Windows\SysWOW64\Fdcjlb32.exe
C:\Windows\system32\Fdcjlb32.exe
1⤵
PID:9244

C:\Windows\SysWOW64\Fknbil32.exe
C:\Windows\system32\Fknbil32.exe
1⤵
PID:9336
- C:\Windows\SysWOW64\Fmlneg32.exe
  C:\Windows\system32\Fmlneg32.exe
  2⤵
  PID:9380

C:\Windows\SysWOW64\Fdffbake.exe
C:\Windows\system32\Fdffbake.exe
1⤵
PID:9472
- C:\Windows\SysWOW64\Fhabbp32.exe
  C:\Windows\system32\Fhabbp32.exe
  2⤵
  PID:9520
- - C:\Windows\SysWOW64\Fkpool32.exe
    C:\Windows\system32\Fkpool32.exe
    3⤵
    PID:9564

C:\Windows\SysWOW64\Fmnkkg32.exe
C:\Windows\system32\Fmnkkg32.exe
1⤵
PID:9652
- C:\Windows\SysWOW64\Fpmggb32.exe
  C:\Windows\system32\Fpmggb32.exe
  2⤵
  PID:9700
- - C:\Windows\SysWOW64\Fdhcgaic.exe
    C:\Windows\system32\Fdhcgaic.exe
    3⤵
    PID:9744
  - - C:\Windows\SysWOW64\Fhdohp32.exe
      C:\Windows\system32\Fhdohp32.exe
      4⤵
      PID:9788
    - - C:\Windows\SysWOW64\Fkbkdkpp.exe
        
        C:\Windows\system32\Fkbkdkpp.exe
        5⤵
        
        PID:9836
      - C:\Windows\SysWOW64\Fielph32.exe
        
        C:\Windows\system32\Fielph32.exe
        6⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        7⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Fpodlbng.exe
        
        C:\Windows\system32\Fpodlbng.exe
        8⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        9⤵
        
        PID:10016

C:\Windows\SysWOW64\Gmcdffmq.exe
C:\Windows\system32\Gmcdffmq.exe
1⤵
PID:10108

C:\Windows\SysWOW64\Gdmmbq32.exe
C:\Windows\system32\Gdmmbq32.exe
1⤵
PID:10196

C:\Windows\SysWOW64\Gijekg32.exe
C:\Windows\system32\Gijekg32.exe
1⤵
PID:9348

C:\Windows\SysWOW64\Gpcmga32.exe
C:\Windows\system32\Gpcmga32.exe
1⤵
PID:9484
- C:\Windows\SysWOW64\Gdoihpbk.exe
  C:\Windows\system32\Gdoihpbk.exe
  2⤵
  PID:9552
- - C:\Windows\SysWOW64\Ggnedlao.exe
    C:\Windows\system32\Ggnedlao.exe
    3⤵
    PID:9628

C:\Windows\SysWOW64\Gnhnaf32.exe
C:\Windows\system32\Gnhnaf32.exe
1⤵
PID:9772

C:\Windows\SysWOW64\Gdafnpqh.exe
C:\Windows\system32\Gdafnpqh.exe
1⤵
PID:9892
- C:\Windows\SysWOW64\Ggpbjkpl.exe
  C:\Windows\system32\Ggpbjkpl.exe
  2⤵
  PID:9980
- - C:\Windows\SysWOW64\Ginnfgop.exe
    C:\Windows\system32\Ginnfgop.exe
    3⤵
    PID:10056
  - - C:\Windows\SysWOW64\Gnjjfegi.exe
      C:\Windows\system32\Gnjjfegi.exe
      4⤵
      PID:10128
    - - C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        5⤵
        
        PID:10192

C:\Windows\SysWOW64\Ghpocngo.exe
C:\Windows\system32\Ghpocngo.exe
1⤵
PID:9372
- C:\Windows\SysWOW64\Gknkpjfb.exe
  C:\Windows\system32\Gknkpjfb.exe
  2⤵
  PID:9468

C:\Windows\SysWOW64\Gahcmd32.exe
C:\Windows\system32\Gahcmd32.exe
1⤵
PID:9720

C:\Windows\SysWOW64\Gdfoio32.exe
C:\Windows\system32\Gdfoio32.exe
1⤵
PID:9932

C:\Windows\SysWOW64\Hjchaf32.exe
C:\Windows\system32\Hjchaf32.exe
1⤵
PID:9260
- C:\Windows\SysWOW64\Hajpbckl.exe
  C:\Windows\system32\Hajpbckl.exe
  2⤵
  PID:9424
- - C:\Windows\SysWOW64\Hpmpnp32.exe
    C:\Windows\system32\Hpmpnp32.exe
    3⤵
    PID:9560

C:\Windows\SysWOW64\Hkbdki32.exe
C:\Windows\system32\Hkbdki32.exe
1⤵
PID:9872

C:\Windows\SysWOW64\Hpomcp32.exe
C:\Windows\system32\Hpomcp32.exe
1⤵
PID:9504

C:\Windows\SysWOW64\Hkeaqi32.exe
C:\Windows\system32\Hkeaqi32.exe
1⤵
PID:10188
- C:\Windows\SysWOW64\Hncmmd32.exe
  C:\Windows\system32\Hncmmd32.exe
  2⤵
  PID:9804

C:\Windows\SysWOW64\Hjjnae32.exe
C:\Windows\system32\Hjjnae32.exe
1⤵
PID:10436

C:\Windows\SysWOW64\Hdpbon32.exe
C:\Windows\system32\Hdpbon32.exe
1⤵
PID:10512
- C:\Windows\SysWOW64\Hgnoki32.exe
  C:\Windows\system32\Hgnoki32.exe
  2⤵
  PID:10576
- - C:\Windows\SysWOW64\Hjlkge32.exe
    C:\Windows\system32\Hjlkge32.exe
    3⤵
    PID:10624
  - - C:\Windows\SysWOW64\Hpfcdojl.exe
      C:\Windows\system32\Hpfcdojl.exe
      4⤵
      PID:10688
    - - C:\Windows\SysWOW64\Igqkqiai.exe
        
        C:\Windows\system32\Igqkqiai.exe
        5⤵
        
        PID:10740

C:\Windows\SysWOW64\Iqipio32.exe
C:\Windows\system32\Iqipio32.exe
1⤵
PID:10828
- C:\Windows\SysWOW64\Iddljmpc.exe
  C:\Windows\system32\Iddljmpc.exe
  2⤵
  PID:10860
- - C:\Windows\SysWOW64\Igchfiof.exe
    C:\Windows\system32\Igchfiof.exe
    3⤵
    PID:10912
  - - C:\Windows\SysWOW64\Ijadbdoj.exe
      C:\Windows\system32\Ijadbdoj.exe
      4⤵
      PID:10956
    - - C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        5⤵
        
        PID:11000
      - C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        6⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        7⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        8⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        9⤵
        
        PID:11180

C:\Windows\SysWOW64\Iggaah32.exe
C:\Windows\system32\Iggaah32.exe
1⤵
PID:9780

C:\Windows\SysWOW64\Inainbcn.exe
C:\Windows\system32\Inainbcn.exe
1⤵
PID:10380

C:\Windows\SysWOW64\Idkbkl32.exe
C:\Windows\system32\Idkbkl32.exe
1⤵
PID:10504

C:\Windows\SysWOW64\Ikejgf32.exe
C:\Windows\system32\Ikejgf32.exe
1⤵
PID:10700
- C:\Windows\SysWOW64\Indfca32.exe
  C:\Windows\system32\Indfca32.exe
  2⤵
  PID:10772
- - C:\Windows\SysWOW64\Iqbbpm32.exe
    C:\Windows\system32\Iqbbpm32.exe
    3⤵
    PID:10852

C:\Windows\SysWOW64\Jglklggl.exe
C:\Windows\system32\Jglklggl.exe
1⤵
PID:10924
- C:\Windows\SysWOW64\Jjjghcfp.exe
  C:\Windows\system32\Jjjghcfp.exe
  2⤵
  PID:10996

C:\Windows\SysWOW64\Jhlgfj32.exe
C:\Windows\system32\Jhlgfj32.exe
1⤵
PID:11208

C:\Windows\SysWOW64\Jjmcnbdm.exe
C:\Windows\system32\Jjmcnbdm.exe
1⤵
PID:10364
- C:\Windows\SysWOW64\Jnhpoamf.exe
  C:\Windows\system32\Jnhpoamf.exe
  2⤵
  PID:10452
- - C:\Windows\SysWOW64\Jqglkmlj.exe
    C:\Windows\system32\Jqglkmlj.exe
    3⤵
    PID:10596

C:\Windows\SysWOW64\Jhndljll.exe
C:\Windows\system32\Jhndljll.exe
1⤵
PID:10820

C:\Windows\SysWOW64\Jjopcb32.exe
C:\Windows\system32\Jjopcb32.exe
1⤵
PID:10984

C:\Windows\SysWOW64\Jqiipljg.exe
C:\Windows\system32\Jqiipljg.exe
1⤵
PID:11200

C:\Windows\SysWOW64\Jgcamf32.exe
C:\Windows\system32\Jgcamf32.exe
1⤵
PID:10524

C:\Windows\SysWOW64\Jnmijq32.exe
C:\Windows\system32\Jnmijq32.exe
1⤵
PID:10868
- C:\Windows\SysWOW64\Jqlefl32.exe
  C:\Windows\system32\Jqlefl32.exe
  2⤵
  PID:10968
- - C:\Windows\SysWOW64\Jgenbfoa.exe
    C:\Windows\system32\Jgenbfoa.exe
    3⤵
    PID:11176
  - - C:\Windows\SysWOW64\Jjdjoane.exe
      C:\Windows\system32\Jjdjoane.exe
      4⤵
      PID:10332
    - - C:\Windows\SysWOW64\Kqnbkl32.exe
        
        C:\Windows\system32\Kqnbkl32.exe
        5⤵
        
        PID:10620
      - C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        6⤵
        
        PID:10736

C:\Windows\SysWOW64\Kjffdalb.exe
C:\Windows\system32\Kjffdalb.exe
1⤵
PID:10420
- C:\Windows\SysWOW64\Knbbep32.exe
  C:\Windows\system32\Knbbep32.exe
  2⤵
  PID:10816

C:\Windows\SysWOW64\Kgjgne32.exe
C:\Windows\system32\Kgjgne32.exe
1⤵
PID:10716
- C:\Windows\SysWOW64\Kkfcndce.exe
  C:\Windows\system32\Kkfcndce.exe
  2⤵
  PID:10316

C:\Windows\SysWOW64\Kqbkfkal.exe
C:\Windows\system32\Kqbkfkal.exe
1⤵
PID:11276
- C:\Windows\SysWOW64\Kenggi32.exe
  C:\Windows\system32\Kenggi32.exe
  2⤵
  PID:11316
- - C:\Windows\SysWOW64\Kgmcce32.exe
    C:\Windows\system32\Kgmcce32.exe
    3⤵
    PID:11360

C:\Windows\SysWOW64\Knflpoqf.exe
C:\Windows\system32\Knflpoqf.exe
1⤵
PID:11448
- C:\Windows\SysWOW64\Kaehljpj.exe
  C:\Windows\system32\Kaehljpj.exe
  2⤵
  PID:11492
- - C:\Windows\SysWOW64\Kilpmh32.exe
    C:\Windows\system32\Kilpmh32.exe
    3⤵
    PID:11536
  - - C:\Windows\SysWOW64\Kkjlic32.exe
      C:\Windows\system32\Kkjlic32.exe
      4⤵
      PID:11580
    - - C:\Windows\SysWOW64\Kniieo32.exe
        
        C:\Windows\system32\Kniieo32.exe
        5⤵
        
        PID:11624
      - C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        6⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        7⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Kkmioc32.exe
        
        C:\Windows\system32\Kkmioc32.exe
        8⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Knkekn32.exe
        
        C:\Windows\system32\Knkekn32.exe
        9⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        10⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Lgcjdd32.exe
        
        C:\Windows\system32\Lgcjdd32.exe
        11⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        12⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        13⤵
        
        PID:11972

C:\Windows\SysWOW64\Lgffic32.exe
C:\Windows\system32\Lgffic32.exe
1⤵
PID:12056
- C:\Windows\SysWOW64\Lkabjbih.exe
  C:\Windows\system32\Lkabjbih.exe
  2⤵
  PID:12100
- - C:\Windows\SysWOW64\Lnpofnhk.exe
    C:\Windows\system32\Lnpofnhk.exe
    3⤵
    PID:12144

C:\Windows\SysWOW64\Lejgch32.exe
C:\Windows\system32\Lejgch32.exe
1⤵
PID:12220

C:\Windows\SysWOW64\Lldopb32.exe
C:\Windows\system32\Lldopb32.exe
1⤵
PID:11296

C:\Windows\SysWOW64\Lbngllob.exe
C:\Windows\system32\Lbngllob.exe
1⤵
PID:11436

C:\Windows\SysWOW64\Lgkpdcmi.exe
C:\Windows\system32\Lgkpdcmi.exe
1⤵
PID:11572

C:\Windows\SysWOW64\Lndham32.exe
C:\Windows\system32\Lndham32.exe
1⤵
PID:11700
- C:\Windows\SysWOW64\Lbpdblmo.exe
  C:\Windows\system32\Lbpdblmo.exe
  2⤵
  PID:11752
- - C:\Windows\SysWOW64\Leopnglc.exe
    C:\Windows\system32\Leopnglc.exe
    3⤵
    PID:11812

C:\Windows\SysWOW64\Lhmmjbkf.exe
C:\Windows\system32\Lhmmjbkf.exe
1⤵
PID:11924
- C:\Windows\SysWOW64\Ljkifn32.exe
  C:\Windows\system32\Ljkifn32.exe
  2⤵
  PID:11980
- - C:\Windows\SysWOW64\Mngegmbc.exe
    C:\Windows\system32\Mngegmbc.exe
    3⤵
    PID:12048
  - - C:\Windows\SysWOW64\Maeachag.exe
      C:\Windows\system32\Maeachag.exe
      4⤵
      PID:12108
    - - C:\Windows\SysWOW64\Milidebi.exe
        
        C:\Windows\system32\Milidebi.exe
        5⤵
        
        PID:12168

C:\Windows\SysWOW64\Mjneln32.exe
C:\Windows\system32\Mjneln32.exe
1⤵
PID:11060

C:\Windows\SysWOW64\Mahnhhod.exe
C:\Windows\system32\Mahnhhod.exe
1⤵
PID:11444

C:\Windows\SysWOW64\Miofjepg.exe
C:\Windows\system32\Miofjepg.exe
1⤵
PID:11620
- C:\Windows\SysWOW64\Mjpbam32.exe
  C:\Windows\system32\Mjpbam32.exe
  2⤵
  PID:11708

C:\Windows\SysWOW64\Mhdckaeo.exe
C:\Windows\system32\Mhdckaeo.exe
1⤵
PID:12020

C:\Windows\SysWOW64\Mnnkgl32.exe
C:\Windows\system32\Mnnkgl32.exe
1⤵
PID:12264

C:\Windows\SysWOW64\Mehcdfch.exe
C:\Windows\system32\Mehcdfch.exe
1⤵
PID:11560
- C:\Windows\SysWOW64\Micoed32.exe
  C:\Windows\system32\Micoed32.exe
  2⤵
  PID:11680
- - C:\Windows\SysWOW64\Mlbkap32.exe
    C:\Windows\system32\Mlbkap32.exe
    3⤵
    PID:11852

C:\Windows\SysWOW64\Mblcnj32.exe
C:\Windows\system32\Mblcnj32.exe
1⤵
PID:11524
- C:\Windows\SysWOW64\Mejpje32.exe
  C:\Windows\system32\Mejpje32.exe
  2⤵
  PID:11796
- - C:\Windows\SysWOW64\Mifljdjo.exe
    C:\Windows\system32\Mifljdjo.exe
    3⤵
    PID:12216
  - - C:\Windows\SysWOW64\Mldhfpib.exe
      C:\Windows\system32\Mldhfpib.exe
      4⤵
      PID:11632
    - - C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        5⤵
        
        PID:12208
      - C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        6⤵
        
        PID:11968

C:\Windows\SysWOW64\Njiegl32.exe
C:\Windows\system32\Njiegl32.exe
1⤵
PID:12400
- C:\Windows\SysWOW64\Nbqmiinl.exe
  C:\Windows\system32\Nbqmiinl.exe
  2⤵
  PID:12436

C:\Windows\SysWOW64\Nijeec32.exe
C:\Windows\system32\Nijeec32.exe
1⤵
PID:12512

C:\Windows\SysWOW64\Nognnj32.exe
C:\Windows\system32\Nognnj32.exe
1⤵
PID:12624
- C:\Windows\SysWOW64\Nbcjnilj.exe
  C:\Windows\system32\Nbcjnilj.exe
  2⤵
  PID:12660

C:\Windows\SysWOW64\Nimbkc32.exe
C:\Windows\system32\Nimbkc32.exe
1⤵
PID:12732

C:\Windows\SysWOW64\Nknobkje.exe
C:\Windows\system32\Nknobkje.exe
1⤵
PID:12804

C:\Windows\SysWOW64\Nahgoe32.exe
C:\Windows\system32\Nahgoe32.exe
1⤵
PID:12876

C:\Windows\SysWOW64\Nhbolp32.exe
C:\Windows\system32\Nhbolp32.exe
1⤵
PID:12948
- C:\Windows\SysWOW64\Nkqkhk32.exe
  C:\Windows\system32\Nkqkhk32.exe
  2⤵
  PID:12984

C:\Windows\SysWOW64\Najceeoo.exe
C:\Windows\system32\Najceeoo.exe
1⤵
PID:13056

C:\Windows\SysWOW64\Nlphbnoe.exe
C:\Windows\system32\Nlphbnoe.exe
1⤵
PID:13128

C:\Windows\SysWOW64\Oampjeml.exe
C:\Windows\system32\Oampjeml.exe
1⤵
PID:13236

C:\Windows\SysWOW64\Oidhlb32.exe
C:\Windows\system32\Oidhlb32.exe
1⤵
PID:13308

C:\Windows\SysWOW64\Okedcjcm.exe
C:\Windows\system32\Okedcjcm.exe
1⤵
PID:12464

C:\Windows\SysWOW64\Oaompd32.exe
C:\Windows\system32\Oaompd32.exe
1⤵
PID:12584

C:\Windows\SysWOW64\Ohiemobf.exe
C:\Windows\system32\Ohiemobf.exe
1⤵
PID:12728

C:\Windows\SysWOW64\Oocmii32.exe
C:\Windows\system32\Oocmii32.exe
1⤵
PID:12864

C:\Windows\SysWOW64\Oihagaji.exe
C:\Windows\system32\Oihagaji.exe
1⤵
PID:13048
- C:\Windows\SysWOW64\Ohkbbn32.exe
  C:\Windows\system32\Ohkbbn32.exe
  2⤵
  PID:13112

C:\Windows\SysWOW64\Ooejohhq.exe
C:\Windows\system32\Ooejohhq.exe
1⤵
PID:13232

C:\Windows\SysWOW64\Oeoblb32.exe
C:\Windows\system32\Oeoblb32.exe
1⤵
PID:12480

C:\Windows\SysWOW64\Olijhmgj.exe
C:\Windows\system32\Olijhmgj.exe
1⤵
PID:12720
- C:\Windows\SysWOW64\Oohgdhfn.exe
  C:\Windows\system32\Oohgdhfn.exe
  2⤵
  PID:12836

C:\Windows\SysWOW64\Oeaoab32.exe
C:\Windows\system32\Oeaoab32.exe
1⤵
PID:13064

C:\Windows\SysWOW64\Ohpkmn32.exe
C:\Windows\system32\Ohpkmn32.exe
1⤵
PID:13268

C:\Windows\SysWOW64\Pojcjh32.exe
C:\Windows\system32\Pojcjh32.exe
1⤵
PID:12680

C:\Windows\SysWOW64\Phbhcmjl.exe
C:\Windows\system32\Phbhcmjl.exe
1⤵
PID:13264
- C:\Windows\SysWOW64\Plndcl32.exe
  C:\Windows\system32\Plndcl32.exe
  2⤵
  PID:12576

C:\Windows\SysWOW64\Pchlpfjb.exe
C:\Windows\system32\Pchlpfjb.exe
1⤵
PID:12324

C:\Windows\SysWOW64\Pibdmp32.exe
C:\Windows\system32\Pibdmp32.exe
1⤵
PID:12908

C:\Windows\SysWOW64\Pkcadhgm.exe
C:\Windows\system32\Pkcadhgm.exe
1⤵
PID:13336

C:\Windows\SysWOW64\Pcjiff32.exe
C:\Windows\system32\Pcjiff32.exe
1⤵
PID:13408

C:\Windows\SysWOW64\Phganm32.exe
C:\Windows\system32\Phganm32.exe
1⤵
PID:13516

C:\Windows\SysWOW64\Poajkgnc.exe
C:\Windows\system32\Poajkgnc.exe
1⤵
PID:13588

C:\Windows\SysWOW64\Pekbga32.exe
C:\Windows\system32\Pekbga32.exe
1⤵
PID:13660

C:\Windows\SysWOW64\Pkhjph32.exe
C:\Windows\system32\Pkhjph32.exe
1⤵
PID:13732
- C:\Windows\SysWOW64\Pocfpf32.exe
  C:\Windows\system32\Pocfpf32.exe
  2⤵
  PID:13768

C:\Windows\SysWOW64\Qlggjk32.exe
C:\Windows\system32\Qlggjk32.exe
1⤵
PID:13912

C:\Windows\SysWOW64\Qadoba32.exe
C:\Windows\system32\Qadoba32.exe
1⤵
PID:13984
- C:\Windows\SysWOW64\Qepkbpak.exe
  C:\Windows\system32\Qepkbpak.exe
  2⤵
  PID:14020
- - C:\Windows\SysWOW64\Qhngolpo.exe
    C:\Windows\system32\Qhngolpo.exe
    3⤵
    PID:14056
  - - C:\Windows\SysWOW64\Qkmdkgob.exe
      C:\Windows\system32\Qkmdkgob.exe
      4⤵
      PID:14092
    - - C:\Windows\SysWOW64\Qohpkf32.exe
        
        C:\Windows\system32\Qohpkf32.exe
        5⤵
        
        PID:14128
      - C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        6⤵
        
        PID:14164

C:\Windows\SysWOW64\Allpejfe.exe
C:\Windows\system32\Allpejfe.exe
1⤵
PID:14236
- C:\Windows\SysWOW64\Aojlaeei.exe
  C:\Windows\system32\Aojlaeei.exe
  2⤵
  PID:14272
- - C:\Windows\SysWOW64\Aeddnp32.exe
    C:\Windows\system32\Aeddnp32.exe
    3⤵
    PID:14308
  - - C:\Windows\SysWOW64\Alnmjjdb.exe
      C:\Windows\system32\Alnmjjdb.exe
      4⤵
      PID:13328

C:\Windows\SysWOW64\Afgacokc.exe
C:\Windows\system32\Afgacokc.exe
1⤵
PID:13472

C:\Windows\SysWOW64\Alqjpi32.exe
C:\Windows\system32\Alqjpi32.exe
1⤵
PID:13608
- C:\Windows\SysWOW64\Aoofle32.exe
  C:\Windows\system32\Aoofle32.exe
  2⤵
  PID:13668
- - C:\Windows\SysWOW64\Ackbmcjl.exe
    C:\Windows\system32\Ackbmcjl.exe
    3⤵
    PID:13740
  - - C:\Windows\SysWOW64\Afinioip.exe
      C:\Windows\system32\Afinioip.exe
      4⤵
      PID:13800
    - - C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        5⤵
        
        PID:13872

C:\Windows\SysWOW64\Aoabad32.exe
C:\Windows\system32\Aoabad32.exe
1⤵
PID:13992
- C:\Windows\SysWOW64\Abponp32.exe
  C:\Windows\system32\Abponp32.exe
  2⤵
  PID:14064
- - C:\Windows\SysWOW64\Afkknogn.exe
    C:\Windows\system32\Afkknogn.exe
    3⤵
    PID:14136

C:\Windows\SysWOW64\Akhcfe32.exe
C:\Windows\system32\Akhcfe32.exe
1⤵
PID:14260

C:\Windows\SysWOW64\Bfngdn32.exe
C:\Windows\system32\Bfngdn32.exe
1⤵
PID:13536
- C:\Windows\SysWOW64\Bhldpj32.exe
  C:\Windows\system32\Bhldpj32.exe
  2⤵
  PID:13648

C:\Windows\SysWOW64\Boflmdkk.exe
C:\Windows\system32\Boflmdkk.exe
1⤵
PID:13884
- C:\Windows\SysWOW64\Bcahmb32.exe
  C:\Windows\system32\Bcahmb32.exe
  2⤵
  PID:13464

C:\Windows\SysWOW64\Bhoqeibl.exe
C:\Windows\system32\Bhoqeibl.exe
1⤵
PID:14244

C:\Windows\SysWOW64\Bohibc32.exe
C:\Windows\system32\Bohibc32.exe
1⤵
PID:13572
- C:\Windows\SysWOW64\Bcddcbab.exe
  C:\Windows\system32\Bcddcbab.exe
  2⤵
  PID:13728

C:\Windows\SysWOW64\Bjnmpl32.exe
C:\Windows\system32\Bjnmpl32.exe
1⤵
PID:14304
- C:\Windows\SysWOW64\Bhamkipi.exe
  C:\Windows\system32\Bhamkipi.exe
  2⤵
  PID:13616

C:\Windows\SysWOW64\Bokehc32.exe
C:\Windows\system32\Bokehc32.exe
1⤵
PID:13944

C:\Windows\SysWOW64\Bfendmoc.exe
C:\Windows\system32\Bfendmoc.exe
1⤵
PID:5780

C:\Windows\SysWOW64\Bhcjqinf.exe
C:\Windows\system32\Bhcjqinf.exe
1⤵
PID:14380

C:\Windows\SysWOW64\Bombmcec.exe
C:\Windows\system32\Bombmcec.exe
1⤵
PID:14452
- C:\Windows\SysWOW64\Bcinna32.exe
  C:\Windows\system32\Bcinna32.exe
  2⤵
  PID:14488

C:\Windows\SysWOW64\Bheffh32.exe
C:\Windows\system32\Bheffh32.exe
1⤵
PID:14560

C:\Windows\SysWOW64\Bkdcbd32.exe
C:\Windows\system32\Bkdcbd32.exe
1⤵
PID:14632

C:\Windows\SysWOW64\Cfigpm32.exe
C:\Windows\system32\Cfigpm32.exe
1⤵
PID:14708

C:\Windows\SysWOW64\Cihclh32.exe
C:\Windows\system32\Cihclh32.exe
1⤵
PID:14780
- C:\Windows\SysWOW64\Ckfphc32.exe
  C:\Windows\system32\Ckfphc32.exe
  2⤵
  PID:14816
- - C:\Windows\SysWOW64\Cobkhb32.exe
    C:\Windows\system32\Cobkhb32.exe
    3⤵
    PID:14852

C:\Windows\SysWOW64\Cfldelik.exe
C:\Windows\system32\Cfldelik.exe
1⤵
PID:14924

C:\Windows\SysWOW64\Cmflbf32.exe
C:\Windows\system32\Cmflbf32.exe
1⤵
PID:14996
- C:\Windows\SysWOW64\Codhnb32.exe
  C:\Windows\system32\Codhnb32.exe
  2⤵
  PID:15032
- - C:\Windows\SysWOW64\Cbbdjm32.exe
    C:\Windows\system32\Cbbdjm32.exe
    3⤵
    PID:15068

C:\Windows\SysWOW64\Ckkiccep.exe
C:\Windows\system32\Ckkiccep.exe
1⤵
PID:15140
- C:\Windows\SysWOW64\Cbeapmll.exe
  C:\Windows\system32\Cbeapmll.exe
  2⤵
  PID:15176

C:\Windows\SysWOW64\Cmjemflb.exe
C:\Windows\system32\Cmjemflb.exe
1⤵
PID:15284

C:\Windows\SysWOW64\Ccdnjp32.exe
C:\Windows\system32\Ccdnjp32.exe
1⤵
PID:15356

C:\Windows\SysWOW64\Cjnffjkl.exe
C:\Windows\system32\Cjnffjkl.exe
1⤵
PID:14460

C:\Windows\SysWOW64\Cmmbbejp.exe
C:\Windows\system32\Cmmbbejp.exe
1⤵
PID:14588

C:\Windows\SysWOW64\Dfefkkqp.exe
C:\Windows\system32\Dfefkkqp.exe
1⤵
PID:14800

C:\Windows\SysWOW64\Diccgfpd.exe
C:\Windows\system32\Diccgfpd.exe
1⤵
PID:14912

C:\Windows\SysWOW64\Dpnkdq32.exe
C:\Windows\system32\Dpnkdq32.exe
1⤵
PID:15052

C:\Windows\SysWOW64\Dfgcakon.exe
C:\Windows\system32\Dfgcakon.exe
1⤵
PID:15168
- C:\Windows\SysWOW64\Djcoai32.exe
  C:\Windows\system32\Djcoai32.exe
  2⤵
  PID:15236
- - C:\Windows\SysWOW64\Dmalne32.exe
    C:\Windows\system32\Dmalne32.exe
    3⤵
    PID:15312

C:\Windows\SysWOW64\Dpphjp32.exe
C:\Windows\system32\Dpphjp32.exe
1⤵
PID:14496

C:\Windows\SysWOW64\Dfjpfj32.exe
C:\Windows\system32\Dfjpfj32.exe
1⤵
PID:14700

C:\Windows\SysWOW64\Dmdhcddh.exe
C:\Windows\system32\Dmdhcddh.exe
1⤵
PID:14952
- C:\Windows\SysWOW64\Dpbdopck.exe
  C:\Windows\system32\Dpbdopck.exe
  2⤵
  PID:15060
- - C:\Windows\SysWOW64\Dcnqpo32.exe
    C:\Windows\system32\Dcnqpo32.exe
    3⤵
    PID:15184

C:\Windows\SysWOW64\Djhimica.exe
C:\Windows\system32\Djhimica.exe
1⤵
PID:14448

C:\Windows\SysWOW64\Dlieda32.exe
C:\Windows\system32\Dlieda32.exe
1⤵
PID:14896

C:\Windows\SysWOW64\Dfoiaj32.exe
C:\Windows\system32\Dfoiaj32.exe
1⤵
PID:14584
- C:\Windows\SysWOW64\Dimenegi.exe
  C:\Windows\system32\Dimenegi.exe
  2⤵
  PID:15020
- - C:\Windows\SysWOW64\Dmhand32.exe
    C:\Windows\system32\Dmhand32.exe
    3⤵
    PID:15348

C:\Windows\SysWOW64\Ebejfk32.exe
C:\Windows\system32\Ebejfk32.exe
1⤵
PID:14664

C:\Windows\SysWOW64\Eiobceef.exe
C:\Windows\system32\Eiobceef.exe
1⤵
PID:15416
- C:\Windows\SysWOW64\Emkndc32.exe
  C:\Windows\system32\Emkndc32.exe
  2⤵
  PID:15452
- - C:\Windows\SysWOW64\Epikpo32.exe
    C:\Windows\system32\Epikpo32.exe
    3⤵
    PID:15488
  - - C:\Windows\SysWOW64\Ecefqnel.exe
      C:\Windows\system32\Ecefqnel.exe
      4⤵
      PID:15524

C:\Windows\SysWOW64\Ejoomhmi.exe
C:\Windows\system32\Ejoomhmi.exe
1⤵
PID:15596
- C:\Windows\SysWOW64\Eiaoid32.exe
  C:\Windows\system32\Eiaoid32.exe
  2⤵
  PID:15632

C:\Windows\SysWOW64\Ebjcajjd.exe
C:\Windows\system32\Ebjcajjd.exe
1⤵
PID:15740
- C:\Windows\SysWOW64\Efepbi32.exe
  C:\Windows\system32\Efepbi32.exe
  2⤵
  PID:15776
- - C:\Windows\SysWOW64\Ejalcgkg.exe
    C:\Windows\system32\Ejalcgkg.exe
    3⤵
    PID:15812

C:\Windows\SysWOW64\Elbhjp32.exe
C:\Windows\system32\Elbhjp32.exe
1⤵
PID:15884
- C:\Windows\SysWOW64\Eblpgjha.exe
  C:\Windows\system32\Eblpgjha.exe
  2⤵
  PID:15920

C:\Windows\SysWOW64\Eifhdd32.exe
C:\Windows\system32\Eifhdd32.exe
1⤵
PID:15992
- C:\Windows\SysWOW64\Eppqqn32.exe
  C:\Windows\system32\Eppqqn32.exe
  2⤵
  PID:16028

C:\Windows\SysWOW64\Efjimhnh.exe
C:\Windows\system32\Efjimhnh.exe
1⤵
PID:16100

C:\Windows\SysWOW64\Elgaeolp.exe
C:\Windows\system32\Elgaeolp.exe
1⤵
PID:16172

C:\Windows\SysWOW64\Fcniglmb.exe
C:\Windows\system32\Fcniglmb.exe
1⤵
PID:16248

C:\Windows\SysWOW64\Fikbocki.exe
C:\Windows\system32\Fikbocki.exe
1⤵
PID:16320

C:\Windows\SysWOW64\Fpejlmcf.exe
C:\Windows\system32\Fpejlmcf.exe
1⤵
PID:15372
- C:\Windows\SysWOW64\Fbcfhibj.exe
  C:\Windows\system32\Fbcfhibj.exe
  2⤵
  PID:15460

C:\Windows\SysWOW64\Fimodc32.exe
C:\Windows\system32\Fimodc32.exe
1⤵
PID:5348

C:\Windows\SysWOW64\Fdccbl32.exe
C:\Windows\system32\Fdccbl32.exe
1⤵
PID:15736

C:\Windows\SysWOW64\Ffaong32.exe
C:\Windows\system32\Ffaong32.exe
1⤵
PID:15872

C:\Windows\SysWOW64\Fmkgkapm.exe
C:\Windows\system32\Fmkgkapm.exe
1⤵
PID:16000

C:\Windows\SysWOW64\Fdepgkgj.exe
C:\Windows\system32\Fdepgkgj.exe
1⤵
PID:16124

C:\Windows\SysWOW64\Fjohde32.exe
C:\Windows\system32\Fjohde32.exe
1⤵
PID:16268
- C:\Windows\SysWOW64\Fibhpbea.exe
  C:\Windows\system32\Fibhpbea.exe
  2⤵
  PID:16328
- - C:\Windows\SysWOW64\Flqdlnde.exe
    C:\Windows\system32\Flqdlnde.exe
    3⤵
    PID:15364

C:\Windows\SysWOW64\Fideeaco.exe
C:\Windows\system32\Fideeaco.exe
1⤵
PID:15568

C:\Windows\SysWOW64\Glcaambb.exe
C:\Windows\system32\Glcaambb.exe
1⤵
PID:15688

C:\Windows\SysWOW64\Gbmingjo.exe
C:\Windows\system32\Gbmingjo.exe
1⤵
PID:15796

C:\Windows\SysWOW64\Gigaka32.exe
C:\Windows\system32\Gigaka32.exe
1⤵
PID:16192

C:\Windows\SysWOW64\Glengm32.exe
C:\Windows\system32\Glengm32.exe
1⤵
PID:15440

C:\Windows\SysWOW64\Gfkbde32.exe
C:\Windows\system32\Gfkbde32.exe
1⤵
PID:15784

C:\Windows\SysWOW64\Gmdjapgb.exe
C:\Windows\system32\Gmdjapgb.exe
1⤵
PID:16180
- C:\Windows\SysWOW64\Gpcfmkff.exe
  C:\Windows\system32\Gpcfmkff.exe
  2⤵
  PID:16376

C:\Windows\SysWOW64\Gfmojenc.exe
C:\Windows\system32\Gfmojenc.exe
1⤵
PID:16048

C:\Windows\SysWOW64\Gmggfp32.exe
C:\Windows\system32\Gmggfp32.exe
1⤵
PID:15676

C:\Windows\SysWOW64\Gdaociml.exe
C:\Windows\system32\Gdaociml.exe
1⤵
PID:16276

C:\Windows\SysWOW64\Gkkgpc32.exe
C:\Windows\system32\Gkkgpc32.exe
1⤵
PID:16408
- C:\Windows\SysWOW64\Gingkqkd.exe
  C:\Windows\system32\Gingkqkd.exe
  2⤵
  PID:16444
- - C:\Windows\SysWOW64\Glldgljg.exe
    C:\Windows\system32\Glldgljg.exe
    3⤵
    PID:16480
  - - C:\Windows\SysWOW64\Gbfldf32.exe
      C:\Windows\system32\Gbfldf32.exe
      4⤵
      PID:16528
    - - C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        5⤵
        
        PID:16636

C:\Windows\SysWOW64\Hpjmnjqn.exe
C:\Windows\system32\Hpjmnjqn.exe
1⤵
PID:16712
- C:\Windows\SysWOW64\Hdehni32.exe
  C:\Windows\system32\Hdehni32.exe
  2⤵
  PID:16748
- - C:\Windows\SysWOW64\Hgdejd32.exe
    C:\Windows\system32\Hgdejd32.exe
    3⤵
    PID:16788
  - - C:\Windows\SysWOW64\Hkpqkcpd.exe
      C:\Windows\system32\Hkpqkcpd.exe
      4⤵
      PID:16824

C:\Windows\SysWOW64\Hlambk32.exe
C:\Windows\system32\Hlambk32.exe
1⤵
PID:16896

C:\Windows\SysWOW64\Hdhedh32.exe
C:\Windows\system32\Hdhedh32.exe
1⤵
PID:16968

C:\Windows\SysWOW64\Hkbmqb32.exe
C:\Windows\system32\Hkbmqb32.exe
1⤵
PID:17076

C:\Windows\SysWOW64\Hmpjmn32.exe
C:\Windows\system32\Hmpjmn32.exe
1⤵
PID:17148

C:\Windows\SysWOW64\Hcmbee32.exe
C:\Windows\system32\Hcmbee32.exe
1⤵
PID:17220

C:\Windows\SysWOW64\Hmbfbn32.exe
C:\Windows\system32\Hmbfbn32.exe
1⤵
PID:17328

C:\Windows\SysWOW64\Hpabni32.exe
C:\Windows\system32\Hpabni32.exe
1⤵
PID:17400

C:\Windows\SysWOW64\Hkfglb32.exe
C:\Windows\system32\Hkfglb32.exe
1⤵
PID:16504

C:\Windows\SysWOW64\Hmechmip.exe
C:\Windows\system32\Hmechmip.exe
1⤵
PID:16584

C:\Windows\SysWOW64\Hcblpdgg.exe
C:\Windows\system32\Hcblpdgg.exe
1⤵
PID:16776

C:\Windows\SysWOW64\Hkicaahi.exe
C:\Windows\system32\Hkicaahi.exe
1⤵
PID:16904

C:\Windows\SysWOW64\Iljpij32.exe
C:\Windows\system32\Iljpij32.exe
1⤵
PID:17032

C:\Windows\SysWOW64\Icdheded.exe
C:\Windows\system32\Icdheded.exe
1⤵
PID:17168

C:\Windows\SysWOW64\Iinqbn32.exe
C:\Windows\system32\Iinqbn32.exe
1⤵
PID:17348

C:\Windows\SysWOW64\Iphioh32.exe
C:\Windows\system32\Iphioh32.exe
1⤵
PID:16500

C:\Windows\SysWOW64\Iknmla32.exe
C:\Windows\system32\Iknmla32.exe
1⤵
PID:16772

C:\Windows\SysWOW64\Inlihl32.exe
C:\Windows\system32\Inlihl32.exe
1⤵
PID:17012

C:\Windows\SysWOW64\Idfaefkd.exe
C:\Windows\system32\Idfaefkd.exe
1⤵
PID:17248

C:\Windows\SysWOW64\Ikpjbq32.exe
C:\Windows\system32\Ikpjbq32.exe
1⤵
PID:16620

C:\Windows\SysWOW64\Ilafiihp.exe
C:\Windows\system32\Ilafiihp.exe
1⤵
PID:17108

C:\Windows\SysWOW64\Idhnkf32.exe
C:\Windows\system32\Idhnkf32.exe
1⤵
PID:16568

C:\Windows\SysWOW64\Iggjga32.exe
C:\Windows\system32\Iggjga32.exe
1⤵
PID:17216

C:\Windows\SysWOW64\Ilccoh32.exe
C:\Windows\system32\Ilccoh32.exe
1⤵
PID:17084
- C:\Windows\SysWOW64\Ipoopgnf.exe
  C:\Windows\system32\Ipoopgnf.exe
  2⤵
  PID:17028
- - C:\Windows\SysWOW64\Idkkpf32.exe
    C:\Windows\system32\Idkkpf32.exe
    3⤵
    PID:16852

C:\Windows\SysWOW64\Ikdcmpnl.exe
C:\Windows\system32\Ikdcmpnl.exe
1⤵
PID:17468
- C:\Windows\SysWOW64\Jncoikmp.exe
  C:\Windows\system32\Jncoikmp.exe
  2⤵
  PID:17504

C:\Windows\SysWOW64\Jcphab32.exe
C:\Windows\system32\Jcphab32.exe
1⤵
PID:17616

C:\Windows\SysWOW64\Jjjpnlbd.exe
C:\Windows\system32\Jjjpnlbd.exe
1⤵
PID:17688

C:\Windows\SysWOW64\Jpdhkf32.exe
C:\Windows\system32\Jpdhkf32.exe
1⤵
PID:17796

C:\Windows\SysWOW64\Jgnqgqan.exe
C:\Windows\system32\Jgnqgqan.exe
1⤵
PID:17868

C:\Windows\SysWOW64\Jnhidk32.exe
C:\Windows\system32\Jnhidk32.exe
1⤵
PID:17976

C:\Windows\SysWOW64\Jpfepf32.exe
C:\Windows\system32\Jpfepf32.exe
1⤵
PID:18048
- C:\Windows\SysWOW64\Jcdala32.exe
  C:\Windows\system32\Jcdala32.exe
  2⤵
  PID:18084
- - C:\Windows\SysWOW64\Jgpmmp32.exe
    C:\Windows\system32\Jgpmmp32.exe
    3⤵
    PID:18120

C:\Windows\SysWOW64\Jlmfeg32.exe
C:\Windows\system32\Jlmfeg32.exe
1⤵
PID:18228

C:\Windows\SysWOW64\Jcgnbaeo.exe
C:\Windows\system32\Jcgnbaeo.exe
1⤵
PID:18300

C:\Windows\SysWOW64\Jknfcofa.exe
C:\Windows\system32\Jknfcofa.exe
1⤵
PID:18372

C:\Windows\SysWOW64\Jqknkedi.exe
C:\Windows\system32\Jqknkedi.exe
1⤵
PID:17496

C:\Windows\SysWOW64\Jgeghp32.exe
C:\Windows\system32\Jgeghp32.exe
1⤵
PID:17636

C:\Windows\SysWOW64\Knooej32.exe
C:\Windows\system32\Knooej32.exe
1⤵
PID:17756

C:\Windows\SysWOW64\Kqmkae32.exe
C:\Windows\system32\Kqmkae32.exe
1⤵
PID:17896

C:\Windows\SysWOW64\Kkconn32.exe
C:\Windows\system32\Kkconn32.exe
1⤵
PID:18104

C:\Windows\SysWOW64\Kcndbp32.exe
C:\Windows\system32\Kcndbp32.exe
1⤵
PID:17420

C:\Windows\SysWOW64\Kqbdldnq.exe
C:\Windows\system32\Kqbdldnq.exe
1⤵
PID:17892

C:\Windows\SysWOW64\Kglmio32.exe
C:\Windows\system32\Kglmio32.exe
1⤵
PID:18144
- C:\Windows\SysWOW64\Kjjiej32.exe
  C:\Windows\system32\Kjjiej32.exe
  2⤵
  PID:18220

C:\Windows\SysWOW64\Kqdaadln.exe
C:\Windows\system32\Kqdaadln.exe
1⤵
PID:17680

C:\Windows\SysWOW64\Kkjeomld.exe
C:\Windows\system32\Kkjeomld.exe
1⤵
PID:18152
- C:\Windows\SysWOW64\Knhakh32.exe
  C:\Windows\system32\Knhakh32.exe
  2⤵
  PID:18404

C:\Windows\SysWOW64\Lgqfdnah.exe
C:\Windows\system32\Lgqfdnah.exe
1⤵
PID:18416

C:\Windows\SysWOW64\Lnjnqh32.exe
C:\Windows\system32\Lnjnqh32.exe
1⤵
PID:18440
- C:\Windows\SysWOW64\Lmmolepp.exe
  C:\Windows\system32\Lmmolepp.exe
  2⤵
  PID:18488
- - C:\Windows\SysWOW64\Lddgmbpb.exe
    C:\Windows\system32\Lddgmbpb.exe
    3⤵
    PID:18524

C:\Windows\SysWOW64\Ljaoeini.exe
C:\Windows\system32\Ljaoeini.exe
1⤵
PID:18604

C:\Windows\SysWOW64\Lqkgbcff.exe
C:\Windows\system32\Lqkgbcff.exe
1⤵
PID:18676

C:\Windows\SysWOW64\Lgepom32.exe
C:\Windows\system32\Lgepom32.exe
1⤵
PID:18748

C:\Windows\SysWOW64\Lnohlgep.exe
C:\Windows\system32\Lnohlgep.exe
1⤵
PID:18820

C:\Windows\SysWOW64\Lclpdncg.exe
C:\Windows\system32\Lclpdncg.exe
1⤵
PID:18892

C:\Windows\SysWOW64\Lkchelci.exe
C:\Windows\system32\Lkchelci.exe
1⤵
PID:18964

C:\Windows\SysWOW64\Lmdemd32.exe
C:\Windows\system32\Lmdemd32.exe
1⤵
PID:19036

C:\Windows\SysWOW64\Lcnmin32.exe
C:\Windows\system32\Lcnmin32.exe
1⤵
PID:19108

C:\Windows\SysWOW64\Ljhefhha.exe
C:\Windows\system32\Ljhefhha.exe
1⤵
PID:19180
- C:\Windows\SysWOW64\Lndagg32.exe
  C:\Windows\system32\Lndagg32.exe
  2⤵
  PID:19220

C:\Windows\SysWOW64\Lenicahg.exe
C:\Windows\system32\Lenicahg.exe
1⤵
PID:19292

C:\Windows\SysWOW64\Mkhapk32.exe
C:\Windows\system32\Mkhapk32.exe
1⤵
PID:19364

C:\Windows\SysWOW64\Mminhceb.exe
C:\Windows\system32\Mminhceb.exe
1⤵
PID:19436

C:\Windows\SysWOW64\Mccfdmmo.exe
C:\Windows\system32\Mccfdmmo.exe
1⤵
PID:18520

C:\Windows\SysWOW64\Mjmoag32.exe
C:\Windows\system32\Mjmoag32.exe
1⤵
PID:18632

C:\Windows\SysWOW64\Mebcop32.exe
C:\Windows\system32\Mebcop32.exe
1⤵
PID:18768

C:\Windows\SysWOW64\Mgaokl32.exe
C:\Windows\system32\Mgaokl32.exe
1⤵
PID:18888

C:\Windows\SysWOW64\Mmnhcb32.exe
C:\Windows\system32\Mmnhcb32.exe
1⤵
PID:19020
- C:\Windows\SysWOW64\Maiccajf.exe
  C:\Windows\system32\Maiccajf.exe
  2⤵
  PID:19080

C:\Windows\SysWOW64\Mgclpkac.exe
C:\Windows\system32\Mgclpkac.exe
1⤵
PID:19208

C:\Windows\SysWOW64\Mnmdme32.exe
C:\Windows\system32\Mnmdme32.exe
1⤵
PID:19324

C:\Windows\SysWOW64\Megljppl.exe
C:\Windows\system32\Megljppl.exe
1⤵
PID:17856
- C:\Windows\SysWOW64\Mcjmel32.exe
  C:\Windows\system32\Mcjmel32.exe
  2⤵
  PID:18552
- - C:\Windows\SysWOW64\Mkadfj32.exe
    C:\Windows\system32\Mkadfj32.exe
    3⤵
    PID:18272

C:\Windows\SysWOW64\Mmbanbmg.exe
C:\Windows\system32\Mmbanbmg.exe
1⤵
PID:18876

C:\Windows\SysWOW64\Nclikl32.exe
C:\Windows\system32\Nclikl32.exe
1⤵
PID:19068

C:\Windows\SysWOW64\Njfagf32.exe
C:\Windows\system32\Njfagf32.exe
1⤵
PID:19280

C:\Windows\SysWOW64\Napjdpcn.exe
C:\Windows\system32\Napjdpcn.exe
1⤵
PID:18508

C:\Windows\SysWOW64\Ncofplba.exe
C:\Windows\system32\Ncofplba.exe
1⤵
PID:18884

C:\Windows\SysWOW64\Njinmf32.exe
C:\Windows\system32\Njinmf32.exe
1⤵
PID:19248

C:\Windows\SysWOW64\Ncabfkqo.exe
C:\Windows\system32\Ncabfkqo.exe
1⤵
PID:19200
- C:\Windows\SysWOW64\Nhmofj32.exe
  C:\Windows\system32\Nhmofj32.exe
  2⤵
  PID:18456
- - C:\Windows\SysWOW64\Nlhkgi32.exe
    C:\Windows\system32\Nlhkgi32.exe
    3⤵
    PID:18472

C:\Windows\SysWOW64\Neqopnhb.exe
C:\Windows\system32\Neqopnhb.exe
1⤵
PID:19132

C:\Windows\SysWOW64\Nhokljge.exe
C:\Windows\system32\Nhokljge.exe
1⤵
PID:19516

C:\Windows\SysWOW64\Nmlddqem.exe
C:\Windows\system32\Nmlddqem.exe
1⤵
PID:19624
- C:\Windows\SysWOW64\Nagpeo32.exe
  C:\Windows\system32\Nagpeo32.exe
  2⤵
  PID:19660

C:\Windows\SysWOW64\Nhahaiec.exe
C:\Windows\system32\Nhahaiec.exe
1⤵
PID:19732
- C:\Windows\SysWOW64\Nlmdbh32.exe
  C:\Windows\system32\Nlmdbh32.exe
  2⤵
  PID:19768
- - C:\Windows\SysWOW64\Njpdnedf.exe
    C:\Windows\system32\Njpdnedf.exe
    3⤵
    PID:19804

C:\Windows\SysWOW64\Najmjokc.exe
C:\Windows\system32\Najmjokc.exe
1⤵
PID:19876

C:\Windows\SysWOW64\Ohcegi32.exe
C:\Windows\system32\Ohcegi32.exe
1⤵
PID:19948

C:\Windows\SysWOW64\Ojbacd32.exe
C:\Windows\system32\Ojbacd32.exe
1⤵
PID:20020

C:\Windows\SysWOW64\Oalipoiq.exe
C:\Windows\system32\Oalipoiq.exe
1⤵
PID:20092

C:\Windows\SysWOW64\Olanmgig.exe
C:\Windows\system32\Olanmgig.exe
1⤵
PID:20200

C:\Windows\SysWOW64\Omcjep32.exe
C:\Windows\system32\Omcjep32.exe
1⤵
PID:20308

C:\Windows\SysWOW64\Oejbfmpg.exe
C:\Windows\system32\Oejbfmpg.exe
1⤵
PID:20380
- C:\Windows\SysWOW64\Ohhnbhok.exe
  C:\Windows\system32\Ohhnbhok.exe
  2⤵
  PID:20416

C:\Windows\SysWOW64\Ojgjndno.exe
C:\Windows\system32\Ojgjndno.exe
1⤵
PID:19472

C:\Windows\SysWOW64\Oaqbkn32.exe
C:\Windows\system32\Oaqbkn32.exe
1⤵
PID:19656

C:\Windows\SysWOW64\Ohkkhhmh.exe
C:\Windows\system32\Ohkkhhmh.exe
1⤵
PID:19792

C:\Windows\SysWOW64\Oodcdb32.exe
C:\Windows\system32\Oodcdb32.exe
1⤵
PID:19980

C:\Windows\SysWOW64\Oeokal32.exe
C:\Windows\system32\Oeokal32.exe
1⤵
PID:20116

C:\Windows\SysWOW64\Olicnfco.exe
C:\Windows\system32\Olicnfco.exe
1⤵
PID:20304

C:\Windows\SysWOW64\Omjpeo32.exe
C:\Windows\system32\Omjpeo32.exe
1⤵
PID:20440

C:\Windows\SysWOW64\Phodcg32.exe
C:\Windows\system32\Phodcg32.exe
1⤵
PID:19716

C:\Windows\SysWOW64\Pknqoc32.exe
C:\Windows\system32\Pknqoc32.exe
1⤵
PID:19908

C:\Windows\SysWOW64\Pmlmkn32.exe
C:\Windows\system32\Pmlmkn32.exe
1⤵
PID:20160

C:\Windows\SysWOW64\Pecellgl.exe
C:\Windows\system32\Pecellgl.exe
1⤵
PID:20424

C:\Windows\SysWOW64\Plmmif32.exe
C:\Windows\system32\Plmmif32.exe
1⤵
PID:19976

C:\Windows\SysWOW64\Pmoiqneg.exe
C:\Windows\system32\Pmoiqneg.exe
1⤵
PID:19652

C:\Windows\SysWOW64\Pdhbmh32.exe
C:\Windows\system32\Pdhbmh32.exe
1⤵
PID:20368

C:\Windows\SysWOW64\Pkbjjbda.exe
C:\Windows\system32\Pkbjjbda.exe
1⤵
PID:19584
- C:\Windows\SysWOW64\Ponfka32.exe
  C:\Windows\system32\Ponfka32.exe
  2⤵
  PID:20504
- - C:\Windows\SysWOW64\Palbgl32.exe
    C:\Windows\system32\Palbgl32.exe
    3⤵
    PID:20540

C:\Windows\SysWOW64\Plbfdekd.exe
C:\Windows\system32\Plbfdekd.exe
1⤵
PID:20648

C:\Windows\SysWOW64\Popbpqjh.exe
C:\Windows\system32\Popbpqjh.exe
1⤵
PID:20720

C:\Windows\SysWOW64\Pdmkhgho.exe
C:\Windows\system32\Pdmkhgho.exe
1⤵
PID:20792

C:\Windows\SysWOW64\Pkgcea32.exe
C:\Windows\system32\Pkgcea32.exe
1⤵
PID:20900

C:\Windows\SysWOW64\Qaalblgi.exe
C:\Windows\system32\Qaalblgi.exe
1⤵
PID:20972

C:\Windows\SysWOW64\Qoelkp32.exe
C:\Windows\system32\Qoelkp32.exe
1⤵
PID:21152

C:\Windows\SysWOW64\Qachgk32.exe
C:\Windows\system32\Qachgk32.exe
1⤵
PID:21224

C:\Windows\SysWOW64\Qlimed32.exe
C:\Windows\system32\Qlimed32.exe
1⤵
PID:21332
- C:\Windows\SysWOW64\Qklmpalf.exe
  C:\Windows\system32\Qklmpalf.exe
  2⤵
  PID:21368

C:\Windows\SysWOW64\Aeaanjkl.exe
C:\Windows\system32\Aeaanjkl.exe
1⤵
PID:21476

C:\Windows\SysWOW64\Ahpmjejp.exe
C:\Windows\system32\Ahpmjejp.exe
1⤵
PID:20564

C:\Windows\SysWOW64\Aojefobm.exe
C:\Windows\system32\Aojefobm.exe
1⤵
PID:20692

C:\Windows\SysWOW64\Aednci32.exe
C:\Windows\system32\Aednci32.exe
1⤵
PID:20892

C:\Windows\SysWOW64\Akqfkp32.exe
C:\Windows\system32\Akqfkp32.exe
1⤵
PID:21088

C:\Windows\SysWOW64\Anobgl32.exe
C:\Windows\system32\Anobgl32.exe
1⤵
PID:21216

C:\Windows\SysWOW64\Adikdfna.exe
C:\Windows\system32\Adikdfna.exe
1⤵
PID:21352

C:\Windows\SysWOW64\Akccap32.exe
C:\Windows\system32\Akccap32.exe
1⤵
PID:20548
- C:\Windows\SysWOW64\Anaomkdb.exe
  C:\Windows\system32\Anaomkdb.exe
  2⤵
  PID:20672
- - C:\Windows\SysWOW64\Aamknj32.exe
    C:\Windows\system32\Aamknj32.exe
    3⤵
    PID:20812

C:\Windows\SysWOW64\Adkgje32.exe
C:\Windows\system32\Adkgje32.exe
1⤵
PID:21000

C:\Windows\SysWOW64\Aoalgn32.exe
C:\Windows\system32\Aoalgn32.exe
1⤵
PID:21360

C:\Windows\SysWOW64\Aekddhcb.exe
C:\Windows\system32\Aekddhcb.exe
1⤵
PID:20668

C:\Windows\SysWOW64\Ahippdbe.exe
C:\Windows\system32\Ahippdbe.exe
1⤵
PID:21064

C:\Windows\SysWOW64\Bochmn32.exe
C:\Windows\system32\Bochmn32.exe
1⤵
PID:20992
- C:\Windows\SysWOW64\Bnfihkqm.exe
  C:\Windows\system32\Bnfihkqm.exe
  2⤵
  PID:21340

C:\Windows\SysWOW64\Bhkmec32.exe
C:\Windows\system32\Bhkmec32.exe
1⤵
PID:20492

C:\Windows\SysWOW64\Bkjiao32.exe
C:\Windows\system32\Bkjiao32.exe
1⤵
PID:21560

C:\Windows\SysWOW64\Badanigc.exe
C:\Windows\system32\Badanigc.exe
1⤵
PID:21668

C:\Windows\SysWOW64\Bhnikc32.exe
C:\Windows\system32\Bhnikc32.exe
1⤵
PID:21740

C:\Windows\SysWOW64\Bohbhmfm.exe
C:\Windows\system32\Bohbhmfm.exe
1⤵
PID:21848

C:\Windows\SysWOW64\Bebjdgmj.exe
C:\Windows\system32\Bebjdgmj.exe
1⤵
PID:21920

C:\Windows\SysWOW64\Bhpfqcln.exe
C:\Windows\system32\Bhpfqcln.exe
1⤵
PID:21992

C:\Windows\SysWOW64\Bnmoijje.exe
C:\Windows\system32\Bnmoijje.exe
1⤵
PID:22064

C:\Windows\SysWOW64\Bedgjgkg.exe
C:\Windows\system32\Bedgjgkg.exe
1⤵
PID:22136

C:\Windows\SysWOW64\Bhbcfbjk.exe
C:\Windows\system32\Bhbcfbjk.exe
1⤵
PID:22208

C:\Windows\SysWOW64\Bnoknihb.exe
C:\Windows\system32\Bnoknihb.exe
1⤵
PID:22316

C:\Windows\SysWOW64\Bdickcpo.exe
C:\Windows\system32\Bdickcpo.exe
1⤵
PID:22388

C:\Windows\SysWOW64\Ckclhn32.exe
C:\Windows\system32\Ckclhn32.exe
1⤵
PID:22460

C:\Windows\SysWOW64\Cnahdi32.exe
C:\Windows\system32\Cnahdi32.exe
1⤵
PID:21512

C:\Windows\SysWOW64\Clchbqoo.exe
C:\Windows\system32\Clchbqoo.exe
1⤵
PID:21768
- C:\Windows\SysWOW64\Ckeimm32.exe
  C:\Windows\system32\Ckeimm32.exe
  2⤵
  PID:21836

C:\Windows\SysWOW64\Cbpajgmf.exe
C:\Windows\system32\Cbpajgmf.exe
1⤵
PID:21976

C:\Windows\SysWOW64\Cdnmfclj.exe
C:\Windows\system32\Cdnmfclj.exe
1⤵
PID:22108

C:\Windows\SysWOW64\Cocacl32.exe
C:\Windows\system32\Cocacl32.exe
1⤵
PID:22300

C:\Windows\SysWOW64\Cfnjpfcl.exe
C:\Windows\system32\Cfnjpfcl.exe
1⤵
PID:22416

C:\Windows\SysWOW64\Chlflabp.exe
C:\Windows\system32\Chlflabp.exe
1⤵
PID:21568

C:\Windows\SysWOW64\Cofnik32.exe
C:\Windows\system32\Cofnik32.exe
1⤵
PID:21892

C:\Windows\SysWOW64\Cfpffeaj.exe
C:\Windows\system32\Cfpffeaj.exe
1⤵
PID:22144

C:\Windows\SysWOW64\Cljobphg.exe
C:\Windows\system32\Cljobphg.exe
1⤵
PID:22204

C:\Windows\SysWOW64\Cnkkjh32.exe
C:\Windows\system32\Cnkkjh32.exe
1⤵
PID:21856

C:\Windows\SysWOW64\Cdecgbfa.exe
C:\Windows\system32\Cdecgbfa.exe
1⤵
PID:22336

C:\Windows\SysWOW64\Dmlkhofd.exe
C:\Windows\system32\Dmlkhofd.exe
1⤵
PID:21832

C:\Windows\SysWOW64\Dbicpfdk.exe
C:\Windows\system32\Dbicpfdk.exe
1⤵
PID:22276

C:\Windows\SysWOW64\Dhclmp32.exe
C:\Windows\system32\Dhclmp32.exe
1⤵
PID:22540

C:\Windows\SysWOW64\Dkahilkl.exe
C:\Windows\system32\Dkahilkl.exe
1⤵
PID:22612

C:\Windows\SysWOW64\Dfglfdkb.exe
C:\Windows\system32\Dfglfdkb.exe
1⤵
PID:22720

C:\Windows\SysWOW64\Dheibpje.exe
C:\Windows\system32\Dheibpje.exe
1⤵
PID:22792

C:\Windows\SysWOW64\Dfiildio.exe
C:\Windows\system32\Dfiildio.exe
1⤵
PID:22968

C:\Windows\SysWOW64\Dmcain32.exe
C:\Windows\system32\Dmcain32.exe
1⤵
PID:23040

C:\Windows\SysWOW64\Dndnpf32.exe
C:\Windows\system32\Dndnpf32.exe
1⤵
PID:23168

C:\Windows\SysWOW64\Ddnfmqng.exe
C:\Windows\system32\Ddnfmqng.exe
1⤵
PID:23244

C:\Windows\SysWOW64\Dkhnjk32.exe
C:\Windows\system32\Dkhnjk32.exe
1⤵
PID:23340
- C:\Windows\SysWOW64\Dngjff32.exe
  C:\Windows\system32\Dngjff32.exe
  2⤵
  PID:23384

C:\Windows\SysWOW64\Eiloco32.exe
C:\Windows\system32\Eiloco32.exe
1⤵
PID:23496

C:\Windows\SysWOW64\Eofgpikj.exe
C:\Windows\system32\Eofgpikj.exe
1⤵
PID:22620

C:\Windows\SysWOW64\Eecphp32.exe
C:\Windows\system32\Eecphp32.exe
1⤵
PID:22812

C:\Windows\SysWOW64\Emjgim32.exe
C:\Windows\system32\Emjgim32.exe
1⤵
PID:22924

C:\Windows\SysWOW64\Enkdaepb.exe
C:\Windows\system32\Enkdaepb.exe
1⤵
PID:23064

C:\Windows\SysWOW64\Efblbbqd.exe
C:\Windows\system32\Efblbbqd.exe
1⤵
PID:23216

C:\Windows\SysWOW64\Ekodjiol.exe
C:\Windows\system32\Ekodjiol.exe
1⤵
PID:23440
- C:\Windows\SysWOW64\Eokqkh32.exe
  C:\Windows\system32\Eokqkh32.exe
  2⤵
  PID:23504

C:\Windows\SysWOW64\Efeihb32.exe
C:\Windows\system32\Efeihb32.exe
1⤵
PID:22672

C:\Windows\SysWOW64\Ekaapi32.exe
C:\Windows\system32\Ekaapi32.exe
1⤵
PID:23012

C:\Windows\SysWOW64\Enpmld32.exe
C:\Windows\system32\Enpmld32.exe
1⤵
PID:23188

C:\Windows\SysWOW64\Eifaim32.exe
C:\Windows\system32\Eifaim32.exe
1⤵
PID:23312

C:\Windows\SysWOW64\Ekdnei32.exe
C:\Windows\system32\Ekdnei32.exe
1⤵
PID:4724

C:\Windows\SysWOW64\Ebnfbcbc.exe
C:\Windows\system32\Ebnfbcbc.exe
1⤵
PID:4212

C:\Windows\SysWOW64\Fmcjpl32.exe
C:\Windows\system32\Fmcjpl32.exe
1⤵
PID:23416

C:\Windows\SysWOW64\Fneggdhg.exe
C:\Windows\system32\Fneggdhg.exe
1⤵
PID:22856

C:\Windows\SysWOW64\Feoodn32.exe
C:\Windows\system32\Feoodn32.exe
1⤵
PID:4148

C:\Windows\SysWOW64\Fligqhga.exe
C:\Windows\system32\Fligqhga.exe
1⤵
PID:23576

C:\Windows\SysWOW64\Fngcmcfe.exe
C:\Windows\system32\Fngcmcfe.exe
1⤵
PID:23652

C:\Windows\SysWOW64\Fimhjl32.exe
C:\Windows\system32\Fimhjl32.exe
1⤵
PID:23816

C:\Windows\SysWOW64\Fnipbc32.exe
C:\Windows\system32\Fnipbc32.exe
1⤵
PID:23912

C:\Windows\SysWOW64\Flmqlg32.exe
C:\Windows\system32\Flmqlg32.exe
1⤵
PID:24060

C:\Windows\SysWOW64\Fbgihaji.exe
C:\Windows\system32\Fbgihaji.exe
1⤵
PID:24136
- C:\Windows\SysWOW64\Ffceip32.exe
  C:\Windows\system32\Ffceip32.exe
  2⤵
  PID:24172

C:\Windows\SysWOW64\Fpkibf32.exe
C:\Windows\system32\Fpkibf32.exe
1⤵
PID:24284

C:\Windows\SysWOW64\Gfeaopqo.exe
C:\Windows\system32\Gfeaopqo.exe
1⤵
PID:24356
- C:\Windows\SysWOW64\Gehbjm32.exe
  C:\Windows\system32\Gehbjm32.exe
  2⤵
  PID:24396

C:\Windows\SysWOW64\Gfhndpol.exe
C:\Windows\system32\Gfhndpol.exe
1⤵
PID:23564

C:\Windows\SysWOW64\Gppcmeem.exe
C:\Windows\system32\Gppcmeem.exe
1⤵
PID:23812
- C:\Windows\SysWOW64\Gbnoiqdq.exe
  C:\Windows\system32\Gbnoiqdq.exe
  2⤵
  PID:23752

C:\Windows\SysWOW64\Gemkelcd.exe
C:\Windows\system32\Gemkelcd.exe
1⤵
PID:23860

C:\Windows\SysWOW64\Gpbpbecj.exe
C:\Windows\system32\Gpbpbecj.exe
1⤵
PID:3328

C:\Windows\SysWOW64\Gikdkj32.exe
C:\Windows\system32\Gikdkj32.exe
1⤵
PID:24276

C:\Windows\SysWOW64\Gfodeohd.exe
C:\Windows\system32\Gfodeohd.exe
1⤵
PID:2744

C:\Windows\SysWOW64\Gmimai32.exe
C:\Windows\system32\Gmimai32.exe
1⤵
PID:2856

C:\Windows\SysWOW64\Gbeejp32.exe
C:\Windows\system32\Gbeejp32.exe
1⤵
PID:3812

C:\Windows\SysWOW64\Hedafk32.exe
C:\Windows\system32\Hedafk32.exe
1⤵
PID:23788

C:\Windows\SysWOW64\Hlnjbedi.exe
C:\Windows\system32\Hlnjbedi.exe
1⤵
PID:3444

C:\Windows\SysWOW64\Hefnkkkj.exe
C:\Windows\system32\Hefnkkkj.exe
1⤵
PID:23664

C:\Windows\SysWOW64\Hffken32.exe
C:\Windows\system32\Hffken32.exe
1⤵
PID:24124

C:\Windows\SysWOW64\Hekgfj32.exe
C:\Windows\system32\Hekgfj32.exe
1⤵
PID:1356

C:\Windows\SysWOW64\Hlepcdoa.exe
C:\Windows\system32\Hlepcdoa.exe
1⤵
PID:2644

C:\Windows\SysWOW64\Hbohpn32.exe
C:\Windows\system32\Hbohpn32.exe
1⤵
PID:432

C:\Windows\SysWOW64\Hpchib32.exe
C:\Windows\system32\Hpchib32.exe
1⤵
PID:3984

C:\Windows\SysWOW64\Iikmbh32.exe
C:\Windows\system32\Iikmbh32.exe
1⤵
PID:3352

C:\Windows\SysWOW64\Ipeeobbe.exe
C:\Windows\system32\Ipeeobbe.exe
1⤵
PID:2204

C:\Windows\SysWOW64\Ifomll32.exe
C:\Windows\system32\Ifomll32.exe
1⤵
PID:4172
- C:\Windows\SysWOW64\Iinjhh32.exe
  C:\Windows\system32\Iinjhh32.exe
  2⤵
  PID:4476

C:\Windows\SysWOW64\Iedjmioj.exe
C:\Windows\system32\Iedjmioj.exe
1⤵
PID:24156

C:\Windows\SysWOW64\Iibccgep.exe
C:\Windows\system32\Iibccgep.exe
1⤵
PID:24012

C:\Windows\SysWOW64\Impliekg.exe
C:\Windows\system32\Impliekg.exe
1⤵
PID:1264

C:\Windows\SysWOW64\Jocefm32.exe
C:\Windows\system32\Jocefm32.exe
1⤵
PID:4876

C:\Windows\SysWOW64\Jenmcggo.exe
C:\Windows\system32\Jenmcggo.exe
1⤵
PID:3116

C:\Windows\SysWOW64\Jlgepanl.exe
C:\Windows\system32\Jlgepanl.exe
1⤵
PID:4312

C:\Windows\SysWOW64\Jcanll32.exe
C:\Windows\system32\Jcanll32.exe
1⤵
PID:1572

C:\Windows\SysWOW64\Jilfifme.exe
C:\Windows\system32\Jilfifme.exe
1⤵
PID:4280

C:\Windows\SysWOW64\Jpenfp32.exe
C:\Windows\system32\Jpenfp32.exe
1⤵
PID:4416

C:\Windows\SysWOW64\Jgpfbjlo.exe
C:\Windows\system32\Jgpfbjlo.exe
1⤵
PID:4732

C:\Windows\SysWOW64\Jinboekc.exe
C:\Windows\system32\Jinboekc.exe
1⤵
PID:848

C:\Windows\SysWOW64\Jokkgl32.exe
C:\Windows\system32\Jokkgl32.exe
1⤵
PID:24628

C:\Windows\SysWOW64\Jedccfqg.exe
C:\Windows\system32\Jedccfqg.exe
1⤵
PID:24704

C:\Windows\SysWOW64\Kcidmkpq.exe
C:\Windows\system32\Kcidmkpq.exe
1⤵
PID:24896

C:\Windows\SysWOW64\Kpmdfonj.exe
C:\Windows\system32\Kpmdfonj.exe
1⤵
PID:25084

C:\Windows\SysWOW64\Kckqbj32.exe
C:\Windows\system32\Kckqbj32.exe
1⤵
PID:25156

C:\Windows\SysWOW64\Kjeiodek.exe
C:\Windows\system32\Kjeiodek.exe
1⤵
PID:25232

C:\Windows\SysWOW64\Koaagkcb.exe
C:\Windows\system32\Koaagkcb.exe
1⤵
PID:25344
- C:\Windows\SysWOW64\Kcmmhj32.exe
  C:\Windows\system32\Kcmmhj32.exe
  2⤵
  PID:25380

C:\Windows\SysWOW64\Kncaec32.exe
C:\Windows\system32\Kncaec32.exe
1⤵
PID:25460

C:\Windows\SysWOW64\Kodnmkap.exe
C:\Windows\system32\Kodnmkap.exe
1⤵
PID:25540

C:\Windows\SysWOW64\Lljklo32.exe
C:\Windows\system32\Lljklo32.exe
1⤵
PID:25276

C:\Windows\SysWOW64\Lcdciiec.exe
C:\Windows\system32\Lcdciiec.exe
1⤵
PID:25372

C:\Windows\SysWOW64\Lnjgfb32.exe
C:\Windows\system32\Lnjgfb32.exe
1⤵
PID:25524

C:\Windows\SysWOW64\Lqhdbm32.exe
C:\Windows\system32\Lqhdbm32.exe
1⤵
PID:2980

C:\Windows\SysWOW64\Lfeljd32.exe
C:\Windows\system32\Lfeljd32.exe
1⤵
PID:24828

C:\Windows\SysWOW64\Lomqcjie.exe
C:\Windows\system32\Lomqcjie.exe
1⤵
PID:2432

C:\Windows\SysWOW64\Lfgipd32.exe
C:\Windows\system32\Lfgipd32.exe
1⤵
PID:1280

C:\Windows\SysWOW64\Lqojclne.exe
C:\Windows\system32\Lqojclne.exe
1⤵
PID:2944

C:\Windows\SysWOW64\Lgibpf32.exe
C:\Windows\system32\Lgibpf32.exe
1⤵
PID:4448

C:\Windows\SysWOW64\Modgdicm.exe
C:\Windows\system32\Modgdicm.exe
1⤵
PID:4936

C:\Windows\SysWOW64\Mfnoqc32.exe
C:\Windows\system32\Mfnoqc32.exe
1⤵
PID:1004

C:\Windows\SysWOW64\Mfqlfb32.exe
C:\Windows\system32\Mfqlfb32.exe
1⤵
PID:3156

C:\Windows\SysWOW64\Mmkdcm32.exe
C:\Windows\system32\Mmkdcm32.exe
1⤵
PID:25072

C:\Windows\SysWOW64\Mnmmboed.exe
C:\Windows\system32\Mnmmboed.exe
1⤵
PID:24748

C:\Windows\SysWOW64\Mqkiok32.exe
C:\Windows\system32\Mqkiok32.exe
1⤵
PID:24636

C:\Windows\SysWOW64\Ncnofeof.exe
C:\Windows\system32\Ncnofeof.exe
1⤵
PID:2420

C:\Windows\SysWOW64\Nflkbanj.exe
C:\Windows\system32\Nflkbanj.exe
1⤵
PID:24996

C:\Windows\SysWOW64\Nqbpojnp.exe
C:\Windows\system32\Nqbpojnp.exe
1⤵
PID:5548

C:\Windows\SysWOW64\Nglhld32.exe
C:\Windows\system32\Nglhld32.exe
1⤵
PID:5484

C:\Windows\SysWOW64\Njjdho32.exe
C:\Windows\system32\Njjdho32.exe
1⤵
PID:5568

C:\Windows\SysWOW64\Nfcabp32.exe
C:\Windows\system32\Nfcabp32.exe
1⤵
PID:5892

C:\Windows\SysWOW64\Onmfimga.exe
C:\Windows\system32\Onmfimga.exe
1⤵
PID:5928

C:\Windows\SysWOW64\Opnbae32.exe
C:\Windows\system32\Opnbae32.exe
1⤵
PID:6176

C:\Windows\SysWOW64\Oghghb32.exe
C:\Windows\system32\Oghghb32.exe
1⤵
PID:5068

C:\Windows\SysWOW64\Ocohmc32.exe
C:\Windows\system32\Ocohmc32.exe
1⤵
PID:23192

C:\Windows\SysWOW64\Ohlqcagj.exe
C:\Windows\system32\Ohlqcagj.exe
1⤵
PID:4004

C:\Windows\SysWOW64\Phonha32.exe
C:\Windows\system32\Phonha32.exe
1⤵
PID:6808

C:\Windows\SysWOW64\Pnifekmd.exe
C:\Windows\system32\Pnifekmd.exe
1⤵
PID:5520
- C:\Windows\SysWOW64\Pagbaglh.exe
  C:\Windows\system32\Pagbaglh.exe
  2⤵
  PID:6912

C:\Windows\SysWOW64\Phajna32.exe
C:\Windows\system32\Phajna32.exe
1⤵
PID:7000

C:\Windows\SysWOW64\Pmpolgoi.exe
C:\Windows\system32\Pmpolgoi.exe
1⤵
PID:6264

C:\Windows\SysWOW64\Pdjgha32.exe
C:\Windows\system32\Pdjgha32.exe
1⤵
PID:6780

C:\Windows\SysWOW64\Pfiddm32.exe
C:\Windows\system32\Pfiddm32.exe
1⤵
PID:6936

C:\Windows\SysWOW64\Qhhpop32.exe
C:\Windows\system32\Qhhpop32.exe
1⤵
PID:6512

C:\Windows\SysWOW64\Qobhkjdi.exe
C:\Windows\system32\Qobhkjdi.exe
1⤵
PID:6756

C:\Windows\SysWOW64\Qpcecb32.exe
C:\Windows\system32\Qpcecb32.exe
1⤵
PID:6468

C:\Windows\SysWOW64\Adfgdpmi.exe
C:\Windows\system32\Adfgdpmi.exe
1⤵
PID:25936

C:\Windows\SysWOW64\Ahdpjn32.exe
C:\Windows\system32\Ahdpjn32.exe
1⤵
PID:26148

C:\Windows\SysWOW64\Amqhbe32.exe
C:\Windows\system32\Amqhbe32.exe
1⤵
PID:26268

C:\Windows\SysWOW64\Ahfmpnql.exe
C:\Windows\system32\Ahfmpnql.exe
1⤵
PID:26344

C:\Windows\SysWOW64\Bdojjo32.exe
C:\Windows\system32\Bdojjo32.exe
1⤵
PID:6836

C:\Windows\SysWOW64\Bpkdjofm.exe
C:\Windows\system32\Bpkdjofm.exe
1⤵
PID:7100

C:\Windows\SysWOW64\Bkphhgfc.exe
C:\Windows\system32\Bkphhgfc.exe
1⤵
PID:26368

C:\Windows\SysWOW64\Cdmfllhn.exe
C:\Windows\system32\Cdmfllhn.exe
1⤵
PID:7468

C:\Windows\SysWOW64\Cglbhhga.exe
C:\Windows\system32\Cglbhhga.exe
1⤵
PID:7224

C:\Windows\SysWOW64\Cpfcfmlp.exe
C:\Windows\system32\Cpfcfmlp.exe
1⤵
PID:26264

C:\Windows\SysWOW64\Cgqlcg32.exe
C:\Windows\system32\Cgqlcg32.exe
1⤵
PID:7960

C:\Windows\SysWOW64\Dolmodpi.exe
C:\Windows\system32\Dolmodpi.exe
1⤵
PID:7800

C:\Windows\SysWOW64\Dqnjgl32.exe
C:\Windows\system32\Dqnjgl32.exe
1⤵
PID:6348

C:\Windows\SysWOW64\Dhdbhifj.exe
C:\Windows\system32\Dhdbhifj.exe
1⤵
PID:25720

C:\Windows\SysWOW64\Dkekjdck.exe
C:\Windows\system32\Dkekjdck.exe
1⤵
PID:7020

C:\Windows\SysWOW64\Dglkoeio.exe
C:\Windows\system32\Dglkoeio.exe
1⤵
PID:26372

C:\Windows\SysWOW64\Ekonpckp.exe
C:\Windows\system32\Ekonpckp.exe
1⤵
PID:6812

C:\Windows\SysWOW64\Egened32.exe
C:\Windows\system32\Egened32.exe
1⤵
PID:26392

C:\Windows\SysWOW64\Ekcgkb32.exe
C:\Windows\system32\Ekcgkb32.exe
1⤵
PID:26488

C:\Windows\SysWOW64\Foapaa32.exe
C:\Windows\system32\Foapaa32.exe
1⤵
PID:6560

C:\Windows\SysWOW64\Fdnhih32.exe
C:\Windows\system32\Fdnhih32.exe
1⤵
PID:7584

C:\Windows\SysWOW64\Fgmdec32.exe
C:\Windows\system32\Fgmdec32.exe
1⤵
PID:8352

C:\Windows\SysWOW64\Fbbicl32.exe
C:\Windows\system32\Fbbicl32.exe
1⤵
PID:8908

C:\Windows\SysWOW64\Fofilp32.exe
C:\Windows\system32\Fofilp32.exe
1⤵
PID:8160

C:\Windows\SysWOW64\Fbdehlip.exe
C:\Windows\system32\Fbdehlip.exe
1⤵
PID:5992

C:\Windows\SysWOW64\Gkaclqkk.exe
C:\Windows\system32\Gkaclqkk.exe
1⤵
PID:9400

C:\Windows\SysWOW64\Gihpkd32.exe
C:\Windows\system32\Gihpkd32.exe
1⤵
PID:8416

C:\Windows\SysWOW64\Gpaihooo.exe
C:\Windows\system32\Gpaihooo.exe
1⤵
PID:8232

C:\Windows\SysWOW64\Gbpedjnb.exe
C:\Windows\system32\Gbpedjnb.exe
1⤵
PID:9064

C:\Windows\SysWOW64\Gijmad32.exe
C:\Windows\system32\Gijmad32.exe
1⤵
PID:8748

C:\Windows\SysWOW64\Gngeik32.exe
C:\Windows\system32\Gngeik32.exe
1⤵
PID:10080

C:\Windows\SysWOW64\Hbenoi32.exe
C:\Windows\system32\Hbenoi32.exe
1⤵
PID:8212

C:\Windows\SysWOW64\Hhaggp32.exe
C:\Windows\system32\Hhaggp32.exe
1⤵
PID:8360

C:\Windows\SysWOW64\Hnlodjpa.exe
C:\Windows\system32\Hnlodjpa.exe
1⤵
PID:8268

C:\Windows\SysWOW64\Heegad32.exe
C:\Windows\system32\Heegad32.exe
1⤵
PID:9296

C:\Windows\SysWOW64\Hehdfdek.exe
C:\Windows\system32\Hehdfdek.exe
1⤵
PID:7284

C:\Windows\SysWOW64\Hejqldci.exe
C:\Windows\system32\Hejqldci.exe
1⤵
PID:9168

C:\Windows\SysWOW64\Ilfennic.exe
C:\Windows\system32\Ilfennic.exe
1⤵
PID:6664

C:\Windows\SysWOW64\Ieojgc32.exe
C:\Windows\system32\Ieojgc32.exe
1⤵
PID:8724

C:\Windows\SysWOW64\Iafkld32.exe
C:\Windows\system32\Iafkld32.exe
1⤵
PID:9304

C:\Windows\SysWOW64\Iojkeh32.exe
C:\Windows\system32\Iojkeh32.exe
1⤵
PID:8872

C:\Windows\SysWOW64\Ihbponja.exe
C:\Windows\system32\Ihbponja.exe
1⤵
PID:9912

C:\Windows\SysWOW64\Jhgiim32.exe
C:\Windows\system32\Jhgiim32.exe
1⤵
PID:5168

C:\Windows\SysWOW64\Jekjcaef.exe
C:\Windows\system32\Jekjcaef.exe
1⤵
PID:7592

C:\Windows\SysWOW64\Jocnlg32.exe
C:\Windows\system32\Jocnlg32.exe
1⤵
PID:10084

C:\Windows\SysWOW64\Jlgoek32.exe
C:\Windows\system32\Jlgoek32.exe
1⤵
PID:26340

C:\Windows\SysWOW64\Jbccge32.exe
C:\Windows\system32\Jbccge32.exe
1⤵
PID:10204
- C:\Windows\SysWOW64\Jpgdai32.exe
  C:\Windows\system32\Jpgdai32.exe
  2⤵
  PID:10692
- - C:\Windows\SysWOW64\Kedlip32.exe
    C:\Windows\system32\Kedlip32.exe
    3⤵
    PID:9744

C:\Windows\SysWOW64\Khgbqkhj.exe
C:\Windows\system32\Khgbqkhj.exe
1⤵
PID:10044

C:\Windows\SysWOW64\Kifojnol.exe
C:\Windows\system32\Kifojnol.exe
1⤵
PID:11028

C:\Windows\SysWOW64\Kcoccc32.exe
C:\Windows\system32\Kcoccc32.exe
1⤵
PID:8536

C:\Windows\SysWOW64\Khlklj32.exe
C:\Windows\system32\Khlklj32.exe
1⤵
PID:9108

C:\Windows\SysWOW64\Kadpdp32.exe
C:\Windows\system32\Kadpdp32.exe
1⤵
PID:10928

C:\Windows\SysWOW64\Lohqnd32.exe
C:\Windows\system32\Lohqnd32.exe
1⤵
PID:10548

C:\Windows\SysWOW64\Lebijnak.exe
C:\Windows\system32\Lebijnak.exe
1⤵
PID:10452

C:\Windows\SysWOW64\Lcfidb32.exe
C:\Windows\system32\Lcfidb32.exe
1⤵
PID:26000

C:\Windows\SysWOW64\Llnnmhfe.exe
C:\Windows\system32\Llnnmhfe.exe
1⤵
PID:11216

C:\Windows\SysWOW64\Loacdc32.exe
C:\Windows\system32\Loacdc32.exe
1⤵
PID:10796

C:\Windows\SysWOW64\Mledmg32.exe
C:\Windows\system32\Mledmg32.exe
1⤵
PID:10864

C:\Windows\SysWOW64\Mcoljagj.exe
C:\Windows\system32\Mcoljagj.exe
1⤵
PID:7576

C:\Windows\SysWOW64\Mhldbh32.exe
C:\Windows\system32\Mhldbh32.exe
1⤵
PID:10704

C:\Windows\SysWOW64\Mpclce32.exe
C:\Windows\system32\Mpclce32.exe
1⤵
PID:9868

C:\Windows\SysWOW64\Mljmhflh.exe
C:\Windows\system32\Mljmhflh.exe
1⤵
PID:10976

C:\Windows\SysWOW64\Mohidbkl.exe
C:\Windows\system32\Mohidbkl.exe
1⤵
PID:11688

C:\Windows\SysWOW64\Mjnnbk32.exe
C:\Windows\system32\Mjnnbk32.exe
1⤵
PID:11072

C:\Windows\SysWOW64\Mcfbkpab.exe
C:\Windows\system32\Mcfbkpab.exe
1⤵
PID:10428

C:\Windows\SysWOW64\Mhckcgpj.exe
C:\Windows\system32\Mhckcgpj.exe
1⤵
PID:11908

C:\Windows\SysWOW64\Mqjbddpl.exe
C:\Windows\system32\Mqjbddpl.exe
1⤵
PID:12012

C:\Windows\SysWOW64\Nhegig32.exe
C:\Windows\system32\Nhegig32.exe
1⤵
PID:10960

C:\Windows\SysWOW64\Njedbjej.exe
C:\Windows\system32\Njedbjej.exe
1⤵
PID:4804

C:\Windows\SysWOW64\Nqoloc32.exe
C:\Windows\system32\Nqoloc32.exe
1⤵
PID:9540

C:\Windows\SysWOW64\Nfnamjhk.exe
C:\Windows\system32\Nfnamjhk.exe
1⤵
PID:11120

C:\Windows\SysWOW64\Nimmifgo.exe
C:\Windows\system32\Nimmifgo.exe
1⤵
PID:10848

C:\Windows\SysWOW64\Nofefp32.exe
C:\Windows\system32\Nofefp32.exe
1⤵
PID:12068

C:\Windows\SysWOW64\Njljch32.exe
C:\Windows\system32\Njljch32.exe
1⤵
PID:12196

C:\Windows\SysWOW64\Nmjfodne.exe
C:\Windows\system32\Nmjfodne.exe
1⤵
PID:12116

C:\Windows\SysWOW64\Ocdnln32.exe
C:\Windows\system32\Ocdnln32.exe
1⤵
PID:11564
- C:\Windows\SysWOW64\Ofckhj32.exe
  C:\Windows\system32\Ofckhj32.exe
  2⤵
  PID:11708

C:\Windows\SysWOW64\Ojqcnhkl.exe
C:\Windows\system32\Ojqcnhkl.exe
1⤵
PID:11412

C:\Windows\SysWOW64\Oifppdpd.exe
C:\Windows\system32\Oifppdpd.exe
1⤵
PID:11524

C:\Windows\SysWOW64\Ofjqihnn.exe
C:\Windows\system32\Ofjqihnn.exe
1⤵
PID:12008

C:\Windows\SysWOW64\Ocnabm32.exe
C:\Windows\system32\Ocnabm32.exe
1⤵
PID:12368

C:\Windows\SysWOW64\Pcbkml32.exe
C:\Windows\system32\Pcbkml32.exe
1⤵
PID:13008

C:\Windows\SysWOW64\Pbhgoh32.exe
C:\Windows\system32\Pbhgoh32.exe
1⤵
PID:10908

C:\Windows\SysWOW64\Piapkbeg.exe
C:\Windows\system32\Piapkbeg.exe
1⤵
PID:13000

C:\Windows\SysWOW64\Pfepdg32.exe
C:\Windows\system32\Pfepdg32.exe
1⤵
PID:13304

C:\Windows\SysWOW64\Pciqnk32.exe
C:\Windows\system32\Pciqnk32.exe
1⤵
PID:12596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bacjdbch.exe

Filesize
92KB

MD5
21678fcc1095798b57a77bd4367b71d4

SHA1
cbf87d87db137e2a5ba8e22f7851726d73b7cf6e

SHA256
e911d9321157fc63052c68173a4a2bc880b1541909861dc658132364117c5520

SHA512
54b8e9c4c4b0a67a2b6e437200fef39aa9b57c1b3213a77722a8e5e9de5aa61df967e41e4071580b0e03f9c30a19b828b67b7c7718f4fa45d70d178d24c984e6

Download Submit
C:\Windows\SysWOW64\Bkibgh32.exe

Filesize
96KB

MD5
f04cdb620b56f8ced3c60c42573f39ef

SHA1
d41db80b926bc40fe01bab254612c39968e98ce5

SHA256
54e0ffe14fac2b7d2110308e270e89f8a057775f17086b3d6fc61a8753d508ef

SHA512
9bfe4ffdca3b401d9253d2d154469560260af63d1933bcf6dec4071b56cd644c4e99b829181ef955f70d91ea841897b802a588c6f747981884e5124f050166e7

Download Submit
C:\Windows\SysWOW64\Bogkmgba.exe

Filesize
411KB

MD5
56718607b09bf7a1ce175f9bdd2417bc

SHA1
6583aaab2940ea290602ef8ea5d7a20446baadc0

SHA256
8d3e8bc0edec622e498fed5d79e78077c612dc14185f0642a92deddbe0ee7b99

SHA512
a9c7c59d801fb287571bf9c98e58daf1ef206017e538a14bfed1743cbb111770955109c4dee0d7fdcd7e15168dd9b51a212358fb517803102dd004e94bdce399

Download Submit
C:\Windows\SysWOW64\Cncnob32.exe

Filesize
93KB

MD5
55c8032c719bfcfd6cc58358ebf00e06

SHA1
be40a75e1d9d0f9d21f2cf6994728f8644e71d3b

SHA256
76694925226349e2b401c50113fa6e7b0f39aaa1b01e8ebefad42532b24df669

SHA512
c507a2e4b386017df4659c75b4fe86801f9be08411dd22ef783b22c9d3b618609a73701d51ebf98de23ee30e5c18ce7966b62d70d6faab5750a4f6c11b8e2e69

Download Submit
C:\Windows\SysWOW64\Ddcqedkk.exe

Filesize
448KB

MD5
23ef1b74bdb744bdd1686b658e6cfa8f

SHA1
7a66737db539bbc0194c89909010839a19b3bfc9

SHA256
5429e9e5cd6a8d184b08d7cea03d914283b25c7ec73837a9ecebe92c94697cee

SHA512
83c16eddf81d749df5991888f088d4aca6d3a0af4e35da11469083e160491db90bf8991150d031229f51dd5bb12a1d91f4131c289a3628d6a3374cacc0c5dc4c

Download Submit
C:\Windows\SysWOW64\Dfjgaq32.exe

Filesize
448KB

MD5
6c73ec2572e61567ee68700612c1c31f

SHA1
f98e61a51e80dc8b0ba460e15914c86c06a541c2

SHA256
49a68a23f35b180af78bdd063c25a20c98d167a68c908f1c4fd81409d2535a07

SHA512
c2bad2c74ef0e2578eb0f657454151b3d493156a6cdcc1d4b20455efaaac843a7ebd9d29d6a15aabf305a9b364f256267314a15c2e4f3dc0383d1b93699ce32c

Download Submit
C:\Windows\SysWOW64\Dgcihgaj.exe

Filesize
98KB

MD5
99abda97d171b4ee6bb727b950f3d6ed

SHA1
71234dd9b34a1b71fcb47a9fdb2933a3df5a2108

SHA256
387d0210ade2c1b55d99be62e01673fe6ff8cc24253c253793cc5d03fbd2739b

SHA512
b999e9875110964e7dd183bc0c8559797834645e4032c641d59951cff3aaab81acc41e1ff62bd3c2b24edd793400c27c22b7869bcfbe3ac2deb2793d26165da3

Download Submit
C:\Windows\SysWOW64\Edhakj32.exe

Filesize
448KB

MD5
ae7fbb1d2f50fa450eac95cda8f8bbe3

SHA1
b40266dd4440136bf458c3625fb10d576b76ecd4

SHA256
e824573189feee925a0b4db4f7b89744668be81c5a6c50794b40389d0ccd6b79

SHA512
2beb57ac421a8fc8db04a45fea40c72f158c97c12142ef93c4eefd9cffaf1ce1f396849b3d36ad8464d5f8808a40fb238714f085ebafea2cd3d7e961f9d507f3

Download Submit
C:\Windows\SysWOW64\Edmjfifl.exe

Filesize
448KB

MD5
626bd03b23f1a6a478e72b8e99672a2f

SHA1
15b1bdab9a9d6ac56889928fecd5061b5809a849

SHA256
1c9b90f89e19e70dea68babea9b281fcf5c839d919760d28b7cf5f90af727d9e

SHA512
d0363475ff4517048ad963f491fc8eed1a2d7207411edee4a9ffafe1f5328cf887e87b83ca13c851839718678c8ade142768b580322dbb387d774874a9e8917e

Download Submit
C:\Windows\SysWOW64\Eemgplno.exe

Filesize
448KB

MD5
8c33e1e287daa700dd6db558259274c6

SHA1
8a50e385abbaebc327ac3841e3d37c4b9f62a48d

SHA256
cbfaf3a3475da9bcbd8107a7b95b4320f45731b3e65c42d16dc6f951cff50394

SHA512
75732a07581ec3453c78a807ac98bf19f39b95e3499c2634e2014359bc45b729170a975959554ffa0078785f4223d9afe087615856a5827c9d48fc793e9e74f0

Download Submit
C:\Windows\SysWOW64\Efjbcakl.exe

Filesize
411KB

MD5
2cec95dbb424f7b9edd2c1c21f08d5d7

SHA1
223a85776ca5581cfb89d7c54765ae7c7708a4a8

SHA256
eccd4fcd9fa5e1bda3160f136f8404f6564af585a37bef19b9160d54bac96425

SHA512
b912b5f481ae4698bf67cc7d4f13144f9d1549787ac813514f8f79cca6e0c7a0a5f002cf95f0d7346a4d1d44c1d704e8655ac7f83105866aaa30e3c5af1a3c55

Download Submit
C:\Windows\SysWOW64\Eggmge32.exe

Filesize
448KB

MD5
281089518064d05db3a09a2f5817d65b

SHA1
9c5aa802ee58f2fd90db8b3cecba6e2595da3c09

SHA256
7b472416e341d2baaff2077acc6f51388f39d25332fe7a95524f243f2a21f237

SHA512
55c84a5c4edbc413bbed340908c880a214bf2e552fef8141d6c4291fc1fef9705fc6a4c9de3beca2efba61d5835d24d53b786eaca7ac2c8349bf1b40eb185dec

Download Submit
C:\Windows\SysWOW64\Ekefmc32.exe

Filesize
448KB

MD5
778f0d4076c58b10f3c9b056b8b475b3

SHA1
c71931a7e131b6ec7074c764c276173782d85877

SHA256
af01bb1c727c9c1d26e5c627fcf80cdd96b6138a4042c15c0e1ccdb06bc772bf

SHA512
c355f8ebe479cb11a6672c6571c9d16fdf033331a47a5244742cb237721aea66552add785501b06f6193b4b485cea96eb51e93f813153d9498fa5f60b01a8688

Download Submit
C:\Windows\SysWOW64\Emhldnkj.exe

Filesize
448KB

MD5
5ec32d37c6c7978779ada461c0628477

SHA1
daba6a37418c8dd2db0c8d66a67868636f68de1e

SHA256
e2a6b7818c33af8cc81c89769a7e32aa8beebbf9c161f1a3a11ccf588f667984

SHA512
86ec96b022251e3b2cf7bc9736fcfb65e8d0e2aa9becb536418f7500539857d2cdb0965f3f540b2a559d55c4a9a2ea930a511cb4f32d6f41c2ab7a46fee07438

Download Submit
C:\Windows\SysWOW64\Fafdkmap.exe

Filesize
448KB

MD5
2c408d75f4063ad51be5cbe96290599f

SHA1
61d565cb25bb1f31e9b482c3a1e9de255079b6bf

SHA256
3b07bfef76e3b4db51f10fecdefd4308bf93868baa66d58f7e6bdf5ade04ce0a

SHA512
fa7692d1f819d26f747ee782d5fc9ca2037b0995a4bc80adc511792f08202cb88d49aed4f17607f2a518087fd27d004cb184f7e9e981133fe64141693936df42

Download Submit
C:\Windows\SysWOW64\Fajnfl32.exe

Filesize
448KB

MD5
5d421c01c8930a47d0a6c82b0be67b13

SHA1
eeeb5edcdc2f0e10ffa6732af800089fe78cef00

SHA256
fbacc6bd7bbb82f9495f4c28718da9dcddc2f91e4e4663e2cf22f9776c08db57

SHA512
fa1fb964fd0fa69ee2037e8c508fe8e6f1577873c631ddc63dfab777534e892e64ef77a305a21bab8b1cfc40df1642d2c43906e4ebe166e31ed2c3262c4be857

Download Submit
C:\Windows\SysWOW64\Feapkk32.exe

Filesize
448KB

MD5
b7863abe82c8fb726e0dff31e8bc5b87

SHA1
b05df6e1b65c5781f111abb2244267e7574a44c3

SHA256
073c9ca6b747d6cd39c63fb821430dcba6ae340b087efa95a7e1601f8b96d049

SHA512
96471ee8b3ff12953a57575a9f6419a7538a0dbfb9d4a061025fa288ebef5d7f02f1c90478512e906ee3759740fd4ef12cfe9e69ed3984760139fed0f19d27ec

Download Submit
C:\Windows\SysWOW64\Fehfljca.exe

Filesize
448KB

MD5
4e5cd364f0e55d63111964d62d21a117

SHA1
606558a475d706a69776ef8e9563477df8ffad75

SHA256
ff7d2f95b32312bb8a92ceb97d26a8d12d69f92813fc14cfff381940ce0f99d3

SHA512
cb27cc1c5b8a17a3031c74a4bb439e0eb4e357e28ab11023f3feb3aef8dc4ef86a21e64335e210c0e3a7931417af089bef650b93d90106ff4d8cfb99c8cdd998

Download Submit
C:\Windows\SysWOW64\Fgppmd32.exe

Filesize
448KB

MD5
500abe734dc8bac2ba785f21d2a04ff5

SHA1
a376725fa77284c7cebfa625924537ba02129e49

SHA256
5ddd27dc5926967168c180f81a9567569a7b1048efebc559785356e1ef8c629e

SHA512
01ef84181fbcfc36a869879569922760090ec1586817a6fdf8b62074e5aed6f46de283a04d5db1ea3faa99c799ef4406accff1838f1099d2e21c09a761e391de

Download Submit
C:\Windows\SysWOW64\Fhbimf32.exe

Filesize
448KB

MD5
22f0fcff93cd5cea2738d3609dd76b4f

SHA1
6e4cbe324c23385705f5de62c5f265c8f1129517

SHA256
e6c50862fcb6dc53ab00c595751bdf055d112a6248fb97dc6dc5423cedcd1a2e

SHA512
f56bb7f0ddd46d0a5d3bfb5686995f10104b6e9a1fd9c71e68c2c45f7d466414bcbdbca6788663b8a121a60829aef437843347f3a559727b7d04172e2a8f6e36

Download Submit
C:\Windows\SysWOW64\Fkcboack.exe

Filesize
448KB

MD5
f6f9789bf4caa6c8303e5f1149756c7a

SHA1
f4de77c09329c84585689bec02a4550a6681abca

SHA256
cd7f5b91145d8b976e1ac97fb53d1c57b3a4bec959a02f4c7e593e306780f6bf

SHA512
f9e660973408a67b92ee279f8f8ae686c73add27d92209106d3a0b5cb248300fcbbf32dd68301e1beeb31b8095e71b84bb95e8b1d5a76b6e21b4a5e38343af46

Download Submit
C:\Windows\SysWOW64\Fkeodaai.exe

Filesize
448KB

MD5
f68b9826f4947a0a15febeb2e0e8d0f7

SHA1
065024f74176b20127ab2214ef296d8e43fb1813

SHA256
9198b4400fa594aa9255ca117a09366cd676bbb130df6db5ac38d3f82d6f3dd3

SHA512
7296d5599772720cc38210da0e9e1e42609e3199f7319dcf99826c1df6a2c2a6c7e7ce586b2708dedb55a1fdf04e987a873f671150eeccb5e8f52d1428226b5f

Download Submit
C:\Windows\SysWOW64\Gaadfkgc.exe

Filesize
448KB

MD5
8e34c97965916fd40a6b87458944fec9

SHA1
f81b6fe72614f2d8a4aeebd65c9656411329f9d4

SHA256
284e7496942799a1ca160a8ed9e7115be48452c58713dfb8698b941bd446415b

SHA512
47f9f189b5bf809f4aa9b648fcfbda5042caa47b77e7d84380be2ea89ddc27a6a094c0405ba48b765c94e811ee7af2c47f1f6bdaf8feb276661262e8270ab357

Download Submit
C:\Windows\SysWOW64\Gdgfce32.exe

Filesize
448KB

MD5
da700653d4df66e363bbc4e60dd5ea36

SHA1
b2477e44cc77a4de46dfe255722724e119175362

SHA256
60506dfd1ffabafb81a70ab2e6b6230c55a8e5783505d096c1868a611afe67dc

SHA512
c7cdc5b7bcbd60db5cfbdb6ea59297e4a0a619d102f7a3f4b6fc4c78bde32b5664290616f45dd6a96cdafe3d2ffd6336798bc487d0e08a343c17105d524d55d8

Download Submit
C:\Windows\SysWOW64\Gepmlimi.exe

Filesize
448KB

MD5
1eeef90006024ef6293e2f041f5b53f4

SHA1
5a097551636ad4dc240aa8cea083cb3fef76a52f

SHA256
e6f39549a0a488dfb49a16f30ec3bf22a27f5022665e03d68406f823e338b943

SHA512
67f86394631a2298e090b526d5ba198b53ba00e56784256652cc3699aeff00100104b366a4b3eb57ee9729369183c1858ec9f6df1efcb0a078d320797db95d8d

Download Submit
C:\Windows\SysWOW64\Gfbibikg.exe

Filesize
448KB

MD5
2d10135f809277cc40007eac8cb5d166

SHA1
28c3562ec473b0d12bc038a7dda8791112adda01

SHA256
259d672d943153d5dface91796168ae338f071c62c54739447f78e45d3eba8e5

SHA512
43ba90a2e537119c214ac56c78245b33f46016b96ba98ee5c2b561a2f72b23eb51bbdb90a398ed9e437a2c74b8a32b9a5b796602d952a71a60f9a89bad9415ea

Download Submit
C:\Windows\SysWOW64\Gfdfgiid.exe

Filesize
448KB

MD5
319d8fc352603c6bdb443ac30a82580d

SHA1
c86a08da2ebb68eb45aae4e3afb2806a618539b9

SHA256
06c0147b042e91715b5b045d42d811d4ef4d9230f2bbe2c0396e83760a7c2f0b

SHA512
12cee090a70258f5f46233f21cb627ab6c8988b5013a92f183312db7049b5cfe5b7556d38e15de82118b473a1edeab72e11bb866b51e7e73c5e96bf749540f89

Download Submit
C:\Windows\SysWOW64\Gglpibgm.exe

Filesize
448KB

MD5
837882a1eab625eee7b3c8b9de661931

SHA1
6022d6372cf186b811e058bcff17d1e4fe7be53d

SHA256
9c5766e20ca9ad48c078d7b50ea0b1ba9e9f13d2b313ad4e092c04d4553d2501

SHA512
0e85897669a329d2438fd957bac6f4c325d63bd350ffeda0b8521b7b8db3f5290dfed9cfefd88ec62ebc497eccb573bb6ef5bfe0fd9c395e7e56e5bd9f2e6d82

Download Submit
C:\Windows\SysWOW64\Ggpbjkpl.exe

Filesize
448KB

MD5
ad3aa4152cd9b57710cec17d26183a07

SHA1
bcc66dc70c3d6aa736e8f371f2be062fe10d5959

SHA256
8052db774eb58aaddae4a355cc1b58097eed49b74d0b0184c4bd496c03491516

SHA512
9b1a8aaf91f6f6abcbda43e64f58d7fa6adfdef21fddd7fd43c56aea32410c00cdbf39619367546ba85f87f20d83af47f86bd7d38c9bbf117d663cfb0ed0d006

Download Submit
C:\Windows\SysWOW64\Ggqida32.exe

Filesize
448KB

MD5
79b36c82add2de4e5405ca69c62f692a

SHA1
aecca4c8e4c3afc08942ab3c6ff8a518eea5743f

SHA256
33cb936f1964f562f3ca92b59871623a73f0e3f37b9acd469f1267c5b2ae5923

SHA512
2e905e7ef808ed86d0831fe68e7696b6d423a07097e4e159a61a5ec7e450ca64b2699400bd198f31e24a76cfa9c9ab9831b95a7e152a2169295e2bd1f929836a

Download Submit
C:\Windows\SysWOW64\Ghbbcd32.exe

Filesize
448KB

MD5
16df8c56d4185c965352bff91af2e657

SHA1
4947fcf5e905470647fe370add07ce206aae3d90

SHA256
f7b3826b5ab3d3478858fc353c6fa193f449cbec3476028f6bc1611285b724e8

SHA512
e8c6fdb5f5b0719eead04a9fb468e5b3e88c42c09b2dc2fb9679455c514f2de422fc1209dad11bd5643f0eabe16fee317c3847b1af644895caa2ab0a0902d5ce

Download Submit
C:\Windows\SysWOW64\Ghpendjj.exe

Filesize
448KB

MD5
39e2db12a44c6b6f7c14504208fcbe42

SHA1
a4a16fab36899593fa1ea92d3e77d9fcf0867b2e

SHA256
c1fd3fda02a6dde4ce3122cb58e62fc40b0fadab6d329730fd216996298f5b9c

SHA512
19b77c98be7e97341d6fdf5bd95f6458568f4b3f9be246bd2d9327d147e5ea7606dc89bb3901185c974d4de57947220d4ee7fe2a4c73dcd85247afc98682c1fa

Download Submit
C:\Windows\SysWOW64\Ginnfgop.exe

Filesize
448KB

MD5
3f82415bc33083058d692bd91bd26b19

SHA1
0825a28e8d8375978395f3125881aa165bbba7b4

SHA256
e586e72326a3b4cac2d4a3c4dc36308ab96ce352aa20c5612bf6f3ae12fa6011

SHA512
799d5fce08e9935990536d4e28e0576d5d4e66e2afb57206b11f588742286c8c0c01c1df64c0182858e3186e378ae5d579c590617a89ddd516438c37f5e45de4

Download Submit
C:\Windows\SysWOW64\Gkaopp32.exe

Filesize
448KB

MD5
2cd2907a2496602e4ef6b0332176bf3c

SHA1
37d99d5e2866e7149af629f8bc3063abfa1a4ac4

SHA256
1345ea94db90193b6c1f44d7769335e9fd497c7ded9196b306f78bd581b99041

SHA512
7c081c0d8ac3f8055e3a1699cf011aa992c304689b92c5000fe8ec776e1cd1b087e7651e3747865cb8979b0b1a847dbf45dbc5df168b6bf9a71a08ffe529106f

Download Submit
C:\Windows\SysWOW64\Gkjhoq32.exe

Filesize
448KB

MD5
b8c031fb824f5253a57c8a583852b72b

SHA1
dc114dd92764f81c67a93da8d412442cf286d393

SHA256
4cbbda881d69b8ad55c2214e472742753d00fb1a9b371ff48c92693366a48fee

SHA512
11d7bae092615cc29473dd08698132cfa26ac2a80346af3471d8230c97c26d72966124c726a31bc608052eaf6419072cc1449950ba807b61ef57e7da15345ca6

Download Submit
C:\Windows\SysWOW64\Gnkaalkd.exe

Filesize
448KB

MD5
f8ec7a222ab5d7e85801805608dc50bd

SHA1
5f32e2bf44073256175896f3f40866a286833783

SHA256
3f1255b1ec7db8c4b59d3e9f10d7d273279ddf387ca87ac1c9b65b07b9cada90

SHA512
11376fb6aab01713e8bdf8b07a22bd50580a322fa19f621446f73ba52e063369bb016f28e9fa6e30d8bdbcdd470191c74a0ff456533d485e4ef036eb89bf8cdf

Download Submit
C:\Windows\SysWOW64\Gnmnfkia.exe

Filesize
448KB

MD5
c1a5eb5890ea716aa81c57d63a1966c8

SHA1
4f78d218b7be2ccfd29ecd33022530e2c2d1d1a7

SHA256
5b22da1ac4810bdb18596ba0f9b73145322155109cc637cffd6c64af82335cae

SHA512
55016b0a40d578214c9f6df4dd9f9a4281d35293c414289dfe8a258dc60eb38305db26f70785ef13f6b3ed475947e7e8d6b2b015d4bc8ea3a0c2de7ff975b596

Download Submit
C:\Windows\SysWOW64\Gojnko32.exe

Filesize
448KB

MD5
48ed00170725d5ebe0bc9aee4a044903

SHA1
9a944fe184606952e8391c9f604a6e38fbb73909

SHA256
890d59c903b8c8380e1de05916769f57b9bb6adbe1f6e5fe29a2317f9f389ba7

SHA512
8818fdbdc7d46e2d7369dd02f1809ce11d334262cd3ef2fed06c0c6e5810e88c1672fb495895402e09428fceef6a9353fa79c3fe345f23d7422b827e9286399f

Download Submit
C:\Windows\SysWOW64\Goljqnpd.exe

Filesize
448KB

MD5
88497a15846cb6b98a668df382e66466

SHA1
0d4b868be262d38b5348785b9cfe4ee53cdfb421

SHA256
1de5ced0769e3066c00c0d79785b313fb26f22e3e72dd47c4fc14ca66a1832d0

SHA512
1c881404501f76c9bcc7b488e8c328c92f9232c0848856602a0c03246472cefaafdfa75f88c3107ecf0de38ee17d35cb23b7c0881467f3b225eb4be966378e48

Download Submit
C:\Windows\SysWOW64\Hakgmjoh.exe

Filesize
448KB

MD5
6b0cda791c8998f54a411b90b1601bf6

SHA1
2ee714d872547ffbf1867f30fd25fe822b505a3b

SHA256
79c45f466e639ab4ee886a6247bfa128e1953313c9c893762791d56d051405e3

SHA512
8739cb7d6a7d0c64dd1771daec46ded1069e03fbaa9744a66baf6926467d9a02127ccc53d574f9001bc451585cad56f951e68f18e89500a6ef6c71d86fc17652

Download Submit
C:\Windows\SysWOW64\Hdicienl.exe

Filesize
448KB

MD5
6ffd63051ba09d13f4eedd2925e22780

SHA1
8a61969716e2204161105a366779559ef7295cb6

SHA256
fef7b6d53e2dfc87dfe13be20c1af07d4f2cb55bf3f919a8eded8a016b700f0e

SHA512
f0c01bda4cf48948f115a891683751b313deeb51c5e98354f577934766553f79a36cc0cee39e6a91fe5b0f9e7609f2ea4a5ac9fe100d31ed43b83a5f2d1f635b

Download Submit
C:\Windows\SysWOW64\Hghoeqmp.exe

Filesize
448KB

MD5
643a46b762ddad2298e389436833fbd5

SHA1
f81bd2fcbaea36e07388cdaad5947dd89a67f5c0

SHA256
2b2441628362b0320ed5c6155ff5c3f0183e8fcd182791cd0f6aae62d9fce74e

SHA512
ad8b2412c533c56c0cc6f7cc79989da5712bd567360096938363bbe6ffa85246b0a8739c633cd58cf698cc0d0b97a2436225e2592983ac19f58696d634167f37

Download Submit
C:\Windows\SysWOW64\Hhiajmod.exe

Filesize
448KB

MD5
2f8c9eedde554923c2c8405a082ca073

SHA1
871354066b6a44a01ecc1804f8498875b1259f10

SHA256
5f8c0feb24dcb79e30e78e8cf0b49ae5d5cad9f68918993ae533438ccc7cdb72

SHA512
f0d84bd782b557671172aaf95b6914a05900ee9a49416d7b2a804548a79086ab772f144e642a935c84695d89d37cd9354c53003513814dcb14eaeca2b51eff92

Download Submit
C:\Windows\SysWOW64\Hpjmnjqn.exe

Filesize
448KB

MD5
84b17d76328050e4fd7d3d80981b91a6

SHA1
6780a82e01632532e6c8818ef9d5bd267f74120b

SHA256
69535c585bcc9f7472a7c2cb90233fda243b534c680c0e5d7fa25b8dc8bc5e95

SHA512
282c717dc1d0571557670d4fb7e48a189b7e0a7d35554b1fc4378874cfa596ae1ef62a5a3533a43b167c3aabc30dce39d64c8273604e73e9829ac3660903d4a3

Download Submit
C:\Windows\SysWOW64\Ibpiogmp.exe

Filesize
448KB

MD5
d13ed33cdea46aaa3023c9020e574b9c

SHA1
157d425cb7b1dea4a853c5b9b03a5b9fac0de82d

SHA256
b502cf7e3247723f5d6de182eec6a877da89cdc5b2c08c1e5ba1bd2f7c9c874a

SHA512
7a2d343a0e8a2b481d8a06300de21deb6869065d12ef1425b2696b5e0c8813526be149b7d1e8c2c3f38d825386335997cfe293e0f092f477f49d23c50cf22ff3

Download Submit
C:\Windows\SysWOW64\Ijadbdoj.exe

Filesize
448KB

MD5
d99b6e44fd744ce68a137bd892f1aeb2

SHA1
5ab2cfacbb9c51ac921e0567d35c06180d8db1c2

SHA256
80149fc215e7bb78f27b4566db882eab585697014a5a82ab948fadc2228b8534

SHA512
042d0842d8e5085dee7f07d1dd26c673c384f6fe94f1ff5036e730bc970b70ef4604e8b65fc87043f7c51121ee322079697231c1142da9faf9f23ef637c32537

Download Submit
C:\Windows\SysWOW64\Ipjoja32.exe

Filesize
92KB

MD5
cf3d884637d020e7d9d6d11991b21eaf

SHA1
31fe83e83517832583fd9a05ac10db1312b913b6

SHA256
ae75319824be21179d608595826985d0719f3a8f47f5c510cce406717617f040

SHA512
60010a3e090b76743198679383556e1868121d2f32cf0d0fc3fe8be32e717913f360548064471083d740bd4b9b8f65b9a3e7eb2b6aaf561dd5bab7cd6753191e

Download Submit
C:\Windows\SysWOW64\Jicdap32.exe

Filesize
448KB

MD5
00ecd26936b3ee8efc1a3c2826159035

SHA1
64046b013550f4e50d4244a155153e422c14ea57

SHA256
044efedbd9ee5f1553e5ae85dd5632cfde1bb9c635217d7d1518894963476c47

SHA512
460ee7bf3acf3002a1a15123ce9c839ca1aa5721c9eb007e96f9e3518c5584128c651ed469f9f82a361a22f98b77f59ca024715f03b2a662d5cf84f989668a2f

Download Submit
C:\Windows\SysWOW64\Jngjch32.exe

Filesize
448KB

MD5
7e5b881945f4a0505fcaf52758340000

SHA1
58552b854aed12975a1c8e31cddd8fdb83e99913

SHA256
4a3b7b5bc3ad527bba82cb3d6a77a3d67e7fcd87718bbe22ab9491800cc7cb36

SHA512
889caf99511ce5ee2f736d0b5fdb64bd184f643d728481fbebbc50e248e4db8304d7bd54405ab9bd76c1b921ec9116fbc88343bb64311431563b12a330bf76a8

Download Submit
C:\Windows\SysWOW64\Kechmoil.exe

Filesize
448KB

MD5
559257c6036f4556261daa47a2668302

SHA1
13c6ef830820d750e9abe4dce2dd499eec9f0dff

SHA256
df9aed8881f8a19e7904e279e5cfea6db85ae8eb0ec2cd64dd1a8d2e1dc6b38d

SHA512
8979dc1c420ae2bfd8f0e87e6bd6d3301ab767143ec5b9cbb41a05b346c6e03c3bb15c4b490f3aa1371453d520f9ad52cd6487c1881d1ca4bac2457c663b2ae7

Download Submit
C:\Windows\SysWOW64\Kenggi32.exe

Filesize
448KB

MD5
3c38938868977c9c2c0457c520ca7645

SHA1
fd1a144131ae2132d09dc3139487b3c409564809

SHA256
80150855e7cf1ec56b41be64586504e9001bdeb482b4ae4f8a0f2d415969d2b4

SHA512
17eb6424e9faaa82949466e4c5c2d6fc24a67740429e9a258791558697e7142264ad041ebcd0430d81c7142d67858fdf903563d163dad88fabc1d3642a213d2a

Download Submit
C:\Windows\SysWOW64\Kglmio32.exe

Filesize
448KB

MD5
00d28d998bc7208f7105bc7b12c4f0dc

SHA1
5b1fdb8e0ff186d11bb753a48eb505eb28a6a131

SHA256
8c43547c7001ec07150c324d361ead70a30dfc712579447ff8eac6acd7b5edfb

SHA512
ff6681d0cf9a80531cecc654c6428936fa7968d9476820bec06fa5019c676a9a9b2335a2080d165e7f3e2cef07f03ef1e1a39889fbec395623fcf30e7b928b42

Download Submit
C:\Windows\SysWOW64\Kkeldnpi.exe

Filesize
448KB

MD5
480fe6b571b6630ad7cf98d191fdbbe9

SHA1
9a9fe7624a1e70863e3318f927fc6a078b91147d

SHA256
5f48f4c203ab8492db82b2a8fbe3bc41f891fe480bf83131b721edb3b57c869d

SHA512
776e4d2f919a09847ae109ed3e2136a3a9ba8362b26e851e92e0eeeaf6e760a049417af8358aafe0efda43695ca75a9ed2fd88a23cfcfd872f4203e20053611b

Download Submit
C:\Windows\SysWOW64\Klifnj32.exe

Filesize
448KB

MD5
425a27b650239421d24f33ef960fddd1

SHA1
824ecf64190828fa92745231108c011ebbbf0bd2

SHA256
99f34e23aada93e973ba2fa4857fd1c693edfc1ac124792b08c9194c83cf417f

SHA512
a3e54837286f71db9256836f031134f3c060346733b65b7cbbee26cae629725acf6558ff43bc8849bf14f1108d8f06f77c5426b3207b5fb5f62202dc97d62abb

Download Submit
C:\Windows\SysWOW64\Kqphfe32.exe

Filesize
448KB

MD5
adbbbd830450dbc33eadb2fc3b02e1fe

SHA1
c944b9e570af1830b8e7c722ae6db3f3384a7170

SHA256
47b2a92dd389811969fe43624ef2371c42b567fbfd8b2dba08095b57afe226fb

SHA512
4a74ea0ab050d3c4836dd9680b727e9942e185092f36c3f2c1b5111109024b4bead3b73714b1ac7dd3a37d09494a499895a2d2cd4705f5fa8a1ee69169af8808

Download Submit
C:\Windows\SysWOW64\Lflgmqhd.exe

Filesize
448KB

MD5
a2f4023d3667c2d390a39346073d1324

SHA1
255e9374c56bffd796915bfb799bda4faf7c4285

SHA256
76a1eeba29afdc34d26f319031dd2a1f2a366a6ab0294c2bcc41ed1cbfc8c8fe

SHA512
8721ea086a45c144126a3fa40bd08c3f2892b88e613ab7040e69c228f11e0131aba133109e0bf9617d1d8f6cc27b01cc2666493f54d172ef5b7202fa41994701

Download Submit
C:\Windows\SysWOW64\Lhdqnj32.exe

Filesize
448KB

MD5
d148d23b740744a73a2acc4524ea9987

SHA1
ed5c7cb6234dbcce37679437723cae5e512db9a5

SHA256
df9aff2bfa65194d47590b01a64abe5d70521eada6c5f6ac9e923453e5e94fe2

SHA512
bfff6c120e082d3058b43e1cd717d86423808e1d206acde628e685bd8ce6e4ad07cc97ce6b6e24bd478af14a4bb320af2e3bce0319228a55e7847f5f5523ba0e

Download Submit
C:\Windows\SysWOW64\Mfaqhp32.exe

Filesize
448KB

MD5
608e1eaffd2fb055af826bf6fab8a020

SHA1
2a466c1c2fb0f27d0e7e4b7199f2509584c19fe8

SHA256
3d882127737059a535b36470a335a1245ecf52eebdaada673bde4caf12bc16aa

SHA512
d4d6ad32a0fb3d84be54ad3711e26e3d4d8af46d1a0130361d12ec0c7448f680d8cfa95bd3c9cc91bfb6eed6867ef4212a8db3998d40dc4d797840e939cb9363

Download Submit
C:\Windows\SysWOW64\Miaboe32.exe

Filesize
448KB

MD5
ac65412affdc6497fdb90615524394bc

SHA1
0ee16efd4b9386a0da8f43613a8f34aa7fabcde1

SHA256
793d5729838d624f98547f7a890bdce9bced90a278ffccf34e362ce94f22608a

SHA512
0d02e09679868ed6bdfeeb5be814e2e216de50ec8c134909e2fbfa1c571fde5b5b2d607d487d9d85c092f6b7cf7cd3a811766b2860f6a2139e356153cbb9490e

Download Submit
C:\Windows\SysWOW64\Nceefd32.exe

Filesize
92KB

MD5
48273eda35078b60ecac3108b92c4c12

SHA1
681908966ac5aac1ec637195de64524f02640b75

SHA256
a2c88792acfb1986f96b3f8d81bed4c349f8af7e062438ff0a276646a64a00a9

SHA512
855b631eddc77fbeac7c67c87cdaa55961d8f7cd9fee9251a172234b1d738d78f25c1830fd39a6e00edf106b101794b3b23ab81832cb4d81a6b9225986af5a2f

Download Submit
C:\Windows\SysWOW64\Nhkikq32.exe

Filesize
448KB

MD5
28c2247ee889bf466be008ff5066f9d9

SHA1
c6a579ce3b0d5ea9d1741ecc47fdae810eebae7c

SHA256
50ba9111617b18118a620275f57f3a2d7b8fb440b48ea59fbe143e227ef01f4d

SHA512
d324734d73aae07d9bcb7a8f7db27b8fbf1ff4be92b13eab9f4b892427ddd9bd17d6ce032013b41203b8cab222d86bef4e920e5ec057036adba771745c1f1a0e

Download Submit
C:\Windows\SysWOW64\Ogfcjm32.exe

Filesize
448KB

MD5
9d5a370d74501795a4aacb0b801746a8

SHA1
ff24f8b0144a60d6d9c5a96d80aef74cc8c54ecc

SHA256
2979724a797bfd2d040cd6101a5d7a06277ac07afa52981b7bae4aeda161066c

SHA512
0b5e97906e9894e154050487dd92fba8b2a1d6df40c9854baa44684e99484853d80ab2c9001eabdf405e56c79e35b30a03d632a374032eb935d042c5fb958cfe

Download Submit
C:\Windows\SysWOW64\Opadhb32.exe

Filesize
448KB

MD5
3f2d5ad3d3adb53b2b247769f6db303d

SHA1
a56867dfd1ba52db63ca0d74caa1bc54178c8997

SHA256
725bb8154a0fcc5db9d8913b7f7091a53e045571a202539fa8d330a8fb917821

SHA512
5cb0b00a97e423fef00bd3b113c8e1317c3a465371f1f33c1dcb9715caf1e1a6a07b9f78a7abc24a8db1caa3f4c73ee5d434058e1289410971e69525ba5389bf

Download Submit
C:\Windows\SysWOW64\Ophjiaql.exe

Filesize
448KB

MD5
79b815cc21c2e29919d6f7a43072c5fa

SHA1
b83df3b3d9b0479a7d97d06b1034bb5d0ba8a9a8

SHA256
1e43b1c5cabc216c70cc568fa914939d78ff9146575e5649c69a1cc189bebe0b

SHA512
e6db127ac30fb083918107a199db2802fd86c759ff3eaf029c3a0331d7a4836e8d594a251f8ba0f132c4fe2df584c8a422b379bd3f241d1c2c02b8722ef8b6d1

Download Submit
C:\Windows\SysWOW64\Piocecgj.exe

Filesize
412KB

MD5
2a4e500a338f250c125a2f9541d0859c

SHA1
6e65a9ec32a20d75595a81db7e457823d4273534

SHA256
84eabdf0a011e0a8eea07d8de53db84b0ac9d340bd0133f97229c40acba3dc94

SHA512
c2ecfc76c9825bd70e07bcd19f77e3f3eb4cdd83bb3e565514812e0eeb7bc9767a89a5476b7420cbd906a4fe1269ca21595c2f93b834be4df30c481f97b9f9b1

Download Submit
C:\Windows\SysWOW64\Pkhjph32.exe

Filesize
448KB

MD5
43753b998c85c047300a9d607fe256da

SHA1
301cb9ba5b1d9ea59f9d583b8068fa587936de7c

SHA256
c19b9fb3d9bcfbb9e583169783b0cbf473e8c160a0e8f5e4134e8b439c8cd4a5

SHA512
f60699ef4b32e6955f582e21b8d3fb550a472c4bbf09f1dd718edd1bd91abc00d7c788b98d7705ac67334b20c36edd0faf8eb3a5aea1b27321065e2055319198

Download Submit
C:\Windows\SysWOW64\Pomgjn32.exe

Filesize
448KB

MD5
7b40b5cb437cdf0311b251afb5852044

SHA1
38d3e1a1d50c9d1f66bcbc481047307b84a3c85d

SHA256
4228474120482d9e76cf1c22e15223674670f0b8f5db9f9059a2a4648bf52386

SHA512
c5f6727cb301be88766731de851d24c1abc4bf4e9d6426c98038dc94e25e6899f785cc0aef80e558a29608223f43447b78e497f0becfd89d49ae677c02c0aa41

Download Submit
C:\Windows\SysWOW64\Qhlkilba.exe

Filesize
448KB

MD5
c5b5c67e2d2d1e5d27787a8c46ac3995

SHA1
2bf7813014a4501d53e298d898647194b027b8c2

SHA256
8a084fe7d49d4ad88f2d8c82be2b1be950e717d54c9994e7f835074210e2c4db

SHA512
ede139b17f1893871abc6498c3567c26b691158dd6713d9a1764f88786fec2c32e4cda1c7baa47b319df8a433127099b1910b9a4c3cfa26354dbbaedfc38f19e

Download Submit
C:\Windows\SysWOW64\Qhngolpo.exe

Filesize
448KB

MD5
3402c5c7e6a33dedb1277b00ba111fd0

SHA1
af7d3dbe701dd92467270005b23fd8b3b5106d20

SHA256
807cf2d725ed280c1037538cd9c658e0da8c6ab4ef81e4e7ec2aa102e1e0528d

SHA512
7b373439c991dccd5529d8026833536204d6f6623ea3cefdaa849d51fd59116c6603155e251dc68dfc8da2ee8e1c7bbacd8bfba199d198871a3edefe1b717e31

Download Submit
C:\Windows\SysWOW64\Qkmdkgob.exe

Filesize
448KB

MD5
7d3285db918c42e1b0e1710939173259

SHA1
007d4919cbff7d51140fe818736494e626fb96b6

SHA256
63528dab6229dae83021c3fafc6aaec36b3839f3b60517d83e1fb54f467d57ae

SHA512
a028c82be3864b5a6e24fd2c894923c9d2a53e7d3bd5ab5f79edd87469546b2cf7ed14f834f5a80a0c27f28b62db1f01a0b2b28ec44535c4948514edc875ccb2

Download Submit
memory/32-533-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/208-303-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/232-594-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/232-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/492-483-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/500-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/744-253-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/752-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/812-237-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/976-333-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1076-351-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1248-165-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1264-229-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1356-566-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1356-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1404-461-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1480-213-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1572-375-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1616-173-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1660-285-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1788-291-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1852-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1852-552-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1940-315-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2116-321-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2144-560-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2152-189-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-387-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2228-205-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2320-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2388-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2388-559-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2596-443-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2624-369-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2652-473-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2656-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2832-430-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2940-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/2940-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2940-539-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2952-363-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2980-455-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3024-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3028-345-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3044-509-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3124-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3216-405-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3236-417-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3292-540-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3360-381-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3392-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3428-581-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3508-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3548-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3548-580-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3572-441-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3576-588-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3624-527-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3632-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3632-587-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3652-261-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3696-399-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3740-411-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3764-567-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3824-297-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3904-546-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4004-574-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4008-279-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4064-339-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4084-521-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4136-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4200-327-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4264-491-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4332-424-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4368-197-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4388-393-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4428-267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4476-221-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4528-449-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4664-485-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4676-309-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4720-503-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4808-467-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4828-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4864-357-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4880-497-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4908-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4936-553-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5000-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5004-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5020-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5020-573-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5044-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5052-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5080-515-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5088-181-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads