xmrig | 9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af

Analysis

max time kernel
131s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
Size

1.1MB
MD5

a82d903091b887d38a05058c502096f5
SHA1

857b937671e2665a5d7d9e05c53c1c835563d101
SHA256

9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af
SHA512

bee88124a594548b2b55adce49f9a183e2c3aa97516aa90487f9534e9d0cb4087af2369742e41b2e906dc59cff8aad5533607f1f6771bc84db5a5e242811b3aa
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/ccJc+7KEdv:GezaTF8FcNkNdfE0pZ9ozttwIRxP7N1

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

Processes:

resource	yara_rule
behavioral2/files/0x0008000000023c8f-4.dat	xmrig
behavioral2/files/0x0007000000023c93-8.dat	xmrig
behavioral2/files/0x0007000000023c94-7.dat	xmrig
behavioral2/files/0x0007000000023c98-76.dat	xmrig
behavioral2/files/0x0007000000023c9f-105.dat	xmrig
behavioral2/files/0x0007000000023ca5-146.dat	xmrig
behavioral2/files/0x0007000000023ca7-169.dat	xmrig
behavioral2/files/0x0007000000023cb5-168.dat	xmrig
behavioral2/files/0x0007000000023cb4-167.dat	xmrig
behavioral2/files/0x0007000000023ca9-164.dat	xmrig
behavioral2/files/0x0007000000023cb3-162.dat	xmrig
behavioral2/files/0x0007000000023cb2-159.dat	xmrig
behavioral2/files/0x0007000000023cb1-158.dat	xmrig
behavioral2/files/0x0007000000023cb0-145.dat	xmrig
behavioral2/files/0x0007000000023caf-144.dat	xmrig
behavioral2/files/0x0007000000023ca4-143.dat	xmrig
behavioral2/files/0x0007000000023cae-142.dat	xmrig
behavioral2/files/0x0007000000023cad-141.dat	xmrig
behavioral2/files/0x0007000000023cac-140.dat	xmrig
behavioral2/files/0x0007000000023ca3-136.dat	xmrig
behavioral2/files/0x0007000000023cab-132.dat	xmrig
behavioral2/files/0x0007000000023ca2-130.dat	xmrig
behavioral2/files/0x0007000000023caa-126.dat	xmrig
behavioral2/files/0x0007000000023c9b-123.dat	xmrig
behavioral2/files/0x0007000000023ca1-114.dat	xmrig
behavioral2/files/0x0007000000023ca8-112.dat	xmrig
behavioral2/files/0x0007000000023c9d-103.dat	xmrig
behavioral2/files/0x0007000000023c9c-92.dat	xmrig
behavioral2/files/0x0007000000023ca0-85.dat	xmrig
behavioral2/files/0x0007000000023c9a-82.dat	xmrig
behavioral2/files/0x0007000000023c99-78.dat	xmrig
behavioral2/files/0x0007000000023c9e-96.dat	xmrig
behavioral2/files/0x0007000000023ca6-86.dat	xmrig
behavioral2/files/0x0007000000023cba-179.dat	xmrig
behavioral2/files/0x0007000000023cb9-178.dat	xmrig
behavioral2/files/0x0007000000023cb8-177.dat	xmrig
behavioral2/files/0x0007000000023cb7-176.dat	xmrig
behavioral2/files/0x0007000000023cb6-174.dat	xmrig
behavioral2/files/0x0007000000023c97-53.dat	xmrig
behavioral2/files/0x0007000000023c96-35.dat	xmrig
behavioral2/files/0x0007000000023c95-24.dat	xmrig

Executes dropped EXE 64 IoCs

Processes:

EJLCuhJ.exesLEKNGp.exeZsYvYJx.execsWllMK.exeLpOvShz.exexAJiKYK.exeanihUCh.exezFTkIVv.exeWrFGcwr.exeFAwGjhN.exejJgImzN.exeinulQrR.exeVxXmTWJ.exexiXrxGI.exeSoKiCwx.exejasZrqt.exeIjHNBSK.exeXZHvuuZ.exeyxVuqDi.exeBDroKNF.exeYTtrHmz.exetVSsRxv.exetROWBtu.exeSvmMPfX.exewgIzuyq.exeXDqiHpW.exehoYTmMv.exeUACuBnY.exeVqcnkyp.exeIzMyaCb.exetLDBDNd.exebhPSLyF.exenYqXQMZ.exeiDZukyd.exefxODBhd.exeoUhRzLQ.exetUocQkk.exeKsSkPzh.exegHmtOhe.exemzHwCvZ.exeJfldZTx.exeKmTKdfV.exegAlNcqf.exephvjxET.exejVcMnOU.exejqiKwet.exeRcwbCGV.exeDKlxHoF.exesAmqvyM.exeVrXQCTt.exeWtSkJGE.exeSfTxdcf.exeoEjhjdC.exeerbNHeD.exehVBfryz.exeeuBmKXw.execpAJRdG.exeSprpSaT.exevPQVmna.exeEbHKbot.exerTAeNzF.exeZStmTQs.exeVdNxAUL.exeJOciuuM.exe

pid	Process
1976	EJLCuhJ.exe
2152	sLEKNGp.exe
3640	ZsYvYJx.exe
440	csWllMK.exe
2816	LpOvShz.exe
3992	xAJiKYK.exe
4460	anihUCh.exe
2988	zFTkIVv.exe
3004	WrFGcwr.exe
3424	FAwGjhN.exe
2380	jJgImzN.exe
1632	inulQrR.exe
424	VxXmTWJ.exe
4888	xiXrxGI.exe
1532	SoKiCwx.exe
2924	jasZrqt.exe
1196	IjHNBSK.exe
3048	XZHvuuZ.exe
5072	yxVuqDi.exe
4112	BDroKNF.exe
2400	YTtrHmz.exe
4220	tVSsRxv.exe
1588	tROWBtu.exe
2124	SvmMPfX.exe
2084	wgIzuyq.exe
3036	XDqiHpW.exe
1520	hoYTmMv.exe
740	UACuBnY.exe
620	Vqcnkyp.exe
4520	IzMyaCb.exe
1592	tLDBDNd.exe
4448	bhPSLyF.exe
1292	nYqXQMZ.exe
988	iDZukyd.exe
708	fxODBhd.exe
4980	oUhRzLQ.exe
1500	tUocQkk.exe
960	KsSkPzh.exe
1864	gHmtOhe.exe
3708	mzHwCvZ.exe
1304	JfldZTx.exe
3432	KmTKdfV.exe
4548	gAlNcqf.exe
2748	phvjxET.exe
1428	jVcMnOU.exe
4824	jqiKwet.exe
1068	RcwbCGV.exe
2676	DKlxHoF.exe
1848	sAmqvyM.exe
672	VrXQCTt.exe
4720	WtSkJGE.exe
2736	SfTxdcf.exe
1236	oEjhjdC.exe
3092	erbNHeD.exe
2240	hVBfryz.exe
2100	euBmKXw.exe
3952	cpAJRdG.exe
1636	SprpSaT.exe
4456	vPQVmna.exe
3928	EbHKbot.exe
4108	rTAeNzF.exe
1644	ZStmTQs.exe
4728	VdNxAUL.exe
3844	JOciuuM.exe

Drops file in Windows directory 64 IoCs

Processes:

9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe

description	ioc	Process
File created	C:\Windows\System\YdbrBHd.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\vgtVRyt.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\RcHVvEg.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\lrSfMTe.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\yNouMXq.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\YtSBEXR.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\NwyCVCN.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\oEujIEM.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\iVzVtFW.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\GtURSWH.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\CQkfDIE.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\yngUgCg.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\soDSFcc.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\esQavHr.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\VxMSIDR.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\ZStmTQs.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\nrmsClz.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\NgKVJQf.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\WnLSDhx.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\novIHqK.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\KmJSDqO.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\HQBoCZU.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\tgKVQEr.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\XiAPnHo.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\MZaPheN.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\PmgOWxx.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\oulkQiX.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\kTrSTBR.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\wOmNUkx.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\PGXTfzj.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\ilURWyD.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\hQaKziw.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\ezTJjYj.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\xAwqiTg.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\UIXvrNm.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\aoQzlJZ.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\nYqXQMZ.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\izVXQeV.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\IujscAR.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\SnDjldw.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\pRICrkm.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\FlMstXJ.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\xGuqKRj.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\yXUkfkp.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\LNnklyD.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\TtyGjHg.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\zFxyslo.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\ZbIdsyi.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\gYsytSU.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\LGDuAoA.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\aRkjUop.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\EDMekGg.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\lFvBCik.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\HhyIIAh.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\ZnJrbal.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\miHcFDN.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\RcwbCGV.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\QsCDDNp.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\SeBvgAm.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\QafFYQW.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\ZgnwpsX.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\JOEzQVh.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\RCdpaBm.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
File created	C:\Windows\System\ttodjoe.exe	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

Processes:

dwm.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

dwm.exe

description	pid	Process
Token: SeCreateGlobalPrivilege	17260	dwm.exe
Token: SeChangeNotifyPrivilege	17260	dwm.exe
Token: 33	17260	dwm.exe
Token: SeIncBasePriorityPrivilege	17260	dwm.exe
Token: SeShutdownPrivilege	17260	dwm.exe
Token: SeCreatePagefilePrivilege	17260	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe

description	pid	Process	procid_target
PID 2172 wrote to memory of 1976	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	84
PID 2172 wrote to memory of 1976	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	84
PID 2172 wrote to memory of 2152	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	85
PID 2172 wrote to memory of 2152	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	85
PID 2172 wrote to memory of 3640	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	86
PID 2172 wrote to memory of 3640	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	86
PID 2172 wrote to memory of 440	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	87
PID 2172 wrote to memory of 440	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	87
PID 2172 wrote to memory of 2816	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	88
PID 2172 wrote to memory of 2816	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	88
PID 2172 wrote to memory of 3992	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	89
PID 2172 wrote to memory of 3992	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	89
PID 2172 wrote to memory of 4460	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	90
PID 2172 wrote to memory of 4460	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	90
PID 2172 wrote to memory of 2988	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	91
PID 2172 wrote to memory of 2988	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	91
PID 2172 wrote to memory of 3004	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	92
PID 2172 wrote to memory of 3004	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	92
PID 2172 wrote to memory of 3424	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	93
PID 2172 wrote to memory of 3424	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	93
PID 2172 wrote to memory of 2380	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	94
PID 2172 wrote to memory of 2380	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	94
PID 2172 wrote to memory of 1632	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	95
PID 2172 wrote to memory of 1632	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	95
PID 2172 wrote to memory of 424	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	96
PID 2172 wrote to memory of 424	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	96
PID 2172 wrote to memory of 4888	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	97
PID 2172 wrote to memory of 4888	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	97
PID 2172 wrote to memory of 1532	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	98
PID 2172 wrote to memory of 1532	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	98
PID 2172 wrote to memory of 2924	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	99
PID 2172 wrote to memory of 2924	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	99
PID 2172 wrote to memory of 1196	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	100
PID 2172 wrote to memory of 1196	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	100
PID 2172 wrote to memory of 3048	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	101
PID 2172 wrote to memory of 3048	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	101
PID 2172 wrote to memory of 5072	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	102
PID 2172 wrote to memory of 5072	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	102
PID 2172 wrote to memory of 4112	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	103
PID 2172 wrote to memory of 4112	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	103
PID 2172 wrote to memory of 2400	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	104
PID 2172 wrote to memory of 2400	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	104
PID 2172 wrote to memory of 4220	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	105
PID 2172 wrote to memory of 4220	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	105
PID 2172 wrote to memory of 1588	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	106
PID 2172 wrote to memory of 1588	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	106
PID 2172 wrote to memory of 2124	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	107
PID 2172 wrote to memory of 2124	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	107
PID 2172 wrote to memory of 2084	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	108
PID 2172 wrote to memory of 2084	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	108
PID 2172 wrote to memory of 3036	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	109
PID 2172 wrote to memory of 3036	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	109
PID 2172 wrote to memory of 1520	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	110
PID 2172 wrote to memory of 1520	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	110
PID 2172 wrote to memory of 740	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	111
PID 2172 wrote to memory of 740	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	111
PID 2172 wrote to memory of 620	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	112
PID 2172 wrote to memory of 620	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	112
PID 2172 wrote to memory of 4520	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	113
PID 2172 wrote to memory of 4520	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	113
PID 2172 wrote to memory of 1592	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	114
PID 2172 wrote to memory of 1592	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	114
PID 2172 wrote to memory of 4448	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	115
PID 2172 wrote to memory of 4448	2172	9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe	115

C:\Users\Admin\AppData\Local\Temp\9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe
"C:\Users\Admin\AppData\Local\Temp\9daf3cc198b061ac4fa20a7046db7911b39bc32fd8c1d22435e252803da741af.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\System\EJLCuhJ.exe
  C:\Windows\System\EJLCuhJ.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\sLEKNGp.exe
  C:\Windows\System\sLEKNGp.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\ZsYvYJx.exe
  C:\Windows\System\ZsYvYJx.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\csWllMK.exe
  C:\Windows\System\csWllMK.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\LpOvShz.exe
  C:\Windows\System\LpOvShz.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\xAJiKYK.exe
  C:\Windows\System\xAJiKYK.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\anihUCh.exe
  C:\Windows\System\anihUCh.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\zFTkIVv.exe
  C:\Windows\System\zFTkIVv.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\WrFGcwr.exe
  C:\Windows\System\WrFGcwr.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\FAwGjhN.exe
  C:\Windows\System\FAwGjhN.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\jJgImzN.exe
  C:\Windows\System\jJgImzN.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\inulQrR.exe
  C:\Windows\System\inulQrR.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\VxXmTWJ.exe
  C:\Windows\System\VxXmTWJ.exe
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Windows\System\xiXrxGI.exe
  C:\Windows\System\xiXrxGI.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\SoKiCwx.exe
  C:\Windows\System\SoKiCwx.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\jasZrqt.exe
  C:\Windows\System\jasZrqt.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\IjHNBSK.exe
  C:\Windows\System\IjHNBSK.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\XZHvuuZ.exe
  C:\Windows\System\XZHvuuZ.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\yxVuqDi.exe
  C:\Windows\System\yxVuqDi.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\BDroKNF.exe
  C:\Windows\System\BDroKNF.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\YTtrHmz.exe
  C:\Windows\System\YTtrHmz.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\tVSsRxv.exe
  C:\Windows\System\tVSsRxv.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\tROWBtu.exe
  C:\Windows\System\tROWBtu.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\SvmMPfX.exe
  C:\Windows\System\SvmMPfX.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\wgIzuyq.exe
  C:\Windows\System\wgIzuyq.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\XDqiHpW.exe
  C:\Windows\System\XDqiHpW.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\hoYTmMv.exe
  C:\Windows\System\hoYTmMv.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\UACuBnY.exe
  C:\Windows\System\UACuBnY.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\Vqcnkyp.exe
  C:\Windows\System\Vqcnkyp.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\IzMyaCb.exe
  C:\Windows\System\IzMyaCb.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\tLDBDNd.exe
  C:\Windows\System\tLDBDNd.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\bhPSLyF.exe
  C:\Windows\System\bhPSLyF.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\nYqXQMZ.exe
  C:\Windows\System\nYqXQMZ.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\iDZukyd.exe
  C:\Windows\System\iDZukyd.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\fxODBhd.exe
  C:\Windows\System\fxODBhd.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\oUhRzLQ.exe
  C:\Windows\System\oUhRzLQ.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\tUocQkk.exe
  C:\Windows\System\tUocQkk.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\KsSkPzh.exe
  C:\Windows\System\KsSkPzh.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\gHmtOhe.exe
  C:\Windows\System\gHmtOhe.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\mzHwCvZ.exe
  C:\Windows\System\mzHwCvZ.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\JfldZTx.exe
  C:\Windows\System\JfldZTx.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\KmTKdfV.exe
  C:\Windows\System\KmTKdfV.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\gAlNcqf.exe
  C:\Windows\System\gAlNcqf.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\phvjxET.exe
  C:\Windows\System\phvjxET.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\jVcMnOU.exe
  C:\Windows\System\jVcMnOU.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\jqiKwet.exe
  C:\Windows\System\jqiKwet.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\RcwbCGV.exe
  C:\Windows\System\RcwbCGV.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\DKlxHoF.exe
  C:\Windows\System\DKlxHoF.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\sAmqvyM.exe
  C:\Windows\System\sAmqvyM.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\VrXQCTt.exe
  C:\Windows\System\VrXQCTt.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\WtSkJGE.exe
  C:\Windows\System\WtSkJGE.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\SfTxdcf.exe
  C:\Windows\System\SfTxdcf.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\oEjhjdC.exe
  C:\Windows\System\oEjhjdC.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\erbNHeD.exe
  C:\Windows\System\erbNHeD.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\hVBfryz.exe
  C:\Windows\System\hVBfryz.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\euBmKXw.exe
  C:\Windows\System\euBmKXw.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\cpAJRdG.exe
  C:\Windows\System\cpAJRdG.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\SprpSaT.exe
  C:\Windows\System\SprpSaT.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\vPQVmna.exe
  C:\Windows\System\vPQVmna.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\EbHKbot.exe
  C:\Windows\System\EbHKbot.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\rTAeNzF.exe
  C:\Windows\System\rTAeNzF.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\ZStmTQs.exe
  C:\Windows\System\ZStmTQs.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\VdNxAUL.exe
  C:\Windows\System\VdNxAUL.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\JOciuuM.exe
  C:\Windows\System\JOciuuM.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\UhWZofG.exe
  C:\Windows\System\UhWZofG.exe
  2⤵
  PID:2992
- C:\Windows\System\KlXevZS.exe
  C:\Windows\System\KlXevZS.exe
  2⤵
  PID:2752
- C:\Windows\System\jXxtkNb.exe
  C:\Windows\System\jXxtkNb.exe
  2⤵
  PID:2928
- C:\Windows\System\izBCLLd.exe
  C:\Windows\System\izBCLLd.exe
  2⤵
  PID:2912
- C:\Windows\System\MjfbIwy.exe
  C:\Windows\System\MjfbIwy.exe
  2⤵
  PID:1964
- C:\Windows\System\NBghjOY.exe
  C:\Windows\System\NBghjOY.exe
  2⤵
  PID:1628
- C:\Windows\System\jJyBaPb.exe
  C:\Windows\System\jJyBaPb.exe
  2⤵
  PID:1944
- C:\Windows\System\mPQGZnS.exe
  C:\Windows\System\mPQGZnS.exe
  2⤵
  PID:376
- C:\Windows\System\zjGTakZ.exe
  C:\Windows\System\zjGTakZ.exe
  2⤵
  PID:1184
- C:\Windows\System\rNMKOCM.exe
  C:\Windows\System\rNMKOCM.exe
  2⤵
  PID:4264
- C:\Windows\System\PDqxAQm.exe
  C:\Windows\System\PDqxAQm.exe
  2⤵
  PID:3108
- C:\Windows\System\FpQwzpC.exe
  C:\Windows\System\FpQwzpC.exe
  2⤵
  PID:1020
- C:\Windows\System\HhTQuda.exe
  C:\Windows\System\HhTQuda.exe
  2⤵
  PID:1516
- C:\Windows\System\YdbrBHd.exe
  C:\Windows\System\YdbrBHd.exe
  2⤵
  PID:2332
- C:\Windows\System\hQaKziw.exe
  C:\Windows\System\hQaKziw.exe
  2⤵
  PID:2128
- C:\Windows\System\yXUkfkp.exe
  C:\Windows\System\yXUkfkp.exe
  2⤵
  PID:4712
- C:\Windows\System\vWAhCti.exe
  C:\Windows\System\vWAhCti.exe
  2⤵
  PID:356
- C:\Windows\System\QsCDDNp.exe
  C:\Windows\System\QsCDDNp.exe
  2⤵
  PID:4744
- C:\Windows\System\JUiLMyd.exe
  C:\Windows\System\JUiLMyd.exe
  2⤵
  PID:4512
- C:\Windows\System\HcqVtRg.exe
  C:\Windows\System\HcqVtRg.exe
  2⤵
  PID:4468
- C:\Windows\System\LGDuAoA.exe
  C:\Windows\System\LGDuAoA.exe
  2⤵
  PID:4696
- C:\Windows\System\LNnklyD.exe
  C:\Windows\System\LNnklyD.exe
  2⤵
  PID:428
- C:\Windows\System\hothshH.exe
  C:\Windows\System\hothshH.exe
  2⤵
  PID:2236
- C:\Windows\System\JDGmzGo.exe
  C:\Windows\System\JDGmzGo.exe
  2⤵
  PID:3580
- C:\Windows\System\REBXlBL.exe
  C:\Windows\System\REBXlBL.exe
  2⤵
  PID:4148
- C:\Windows\System\GmpHyjN.exe
  C:\Windows\System\GmpHyjN.exe
  2⤵
  PID:1900
- C:\Windows\System\NwyCVCN.exe
  C:\Windows\System\NwyCVCN.exe
  2⤵
  PID:2312
- C:\Windows\System\vebkxPk.exe
  C:\Windows\System\vebkxPk.exe
  2⤵
  PID:3388
- C:\Windows\System\WnLSDhx.exe
  C:\Windows\System\WnLSDhx.exe
  2⤵
  PID:4252
- C:\Windows\System\fGLFWpb.exe
  C:\Windows\System\fGLFWpb.exe
  2⤵
  PID:1152
- C:\Windows\System\XSVPrdD.exe
  C:\Windows\System\XSVPrdD.exe
  2⤵
  PID:2456
- C:\Windows\System\VnNgzTc.exe
  C:\Windows\System\VnNgzTc.exe
  2⤵
  PID:4640
- C:\Windows\System\bEvXbfy.exe
  C:\Windows\System\bEvXbfy.exe
  2⤵
  PID:4924
- C:\Windows\System\RrsUAvi.exe
  C:\Windows\System\RrsUAvi.exe
  2⤵
  PID:2796
- C:\Windows\System\SaerLEX.exe
  C:\Windows\System\SaerLEX.exe
  2⤵
  PID:5040
- C:\Windows\System\ZgnwpsX.exe
  C:\Windows\System\ZgnwpsX.exe
  2⤵
  PID:528
- C:\Windows\System\pFCFmnh.exe
  C:\Windows\System\pFCFmnh.exe
  2⤵
  PID:3164
- C:\Windows\System\FtPIZLe.exe
  C:\Windows\System\FtPIZLe.exe
  2⤵
  PID:3644
- C:\Windows\System\LAqwUaM.exe
  C:\Windows\System\LAqwUaM.exe
  2⤵
  PID:3152
- C:\Windows\System\GyTkckH.exe
  C:\Windows\System\GyTkckH.exe
  2⤵
  PID:1172
- C:\Windows\System\TtyGjHg.exe
  C:\Windows\System\TtyGjHg.exe
  2⤵
  PID:2776
- C:\Windows\System\UigiLBi.exe
  C:\Windows\System\UigiLBi.exe
  2⤵
  PID:1192
- C:\Windows\System\bBcvqxr.exe
  C:\Windows\System\bBcvqxr.exe
  2⤵
  PID:5140
- C:\Windows\System\aiWRjed.exe
  C:\Windows\System\aiWRjed.exe
  2⤵
  PID:5168
- C:\Windows\System\aeAcYMG.exe
  C:\Windows\System\aeAcYMG.exe
  2⤵
  PID:5200
- C:\Windows\System\TYOGuRP.exe
  C:\Windows\System\TYOGuRP.exe
  2⤵
  PID:5224
- C:\Windows\System\IkCgcST.exe
  C:\Windows\System\IkCgcST.exe
  2⤵
  PID:5248
- C:\Windows\System\BDGYnbQ.exe
  C:\Windows\System\BDGYnbQ.exe
  2⤵
  PID:5280
- C:\Windows\System\nkyriXM.exe
  C:\Windows\System\nkyriXM.exe
  2⤵
  PID:5312
- C:\Windows\System\bUIyqJN.exe
  C:\Windows\System\bUIyqJN.exe
  2⤵
  PID:5348
- C:\Windows\System\WJSCVfv.exe
  C:\Windows\System\WJSCVfv.exe
  2⤵
  PID:5372
- C:\Windows\System\gRNXNQu.exe
  C:\Windows\System\gRNXNQu.exe
  2⤵
  PID:5404
- C:\Windows\System\WvWMcrp.exe
  C:\Windows\System\WvWMcrp.exe
  2⤵
  PID:5428
- C:\Windows\System\kAOGfgX.exe
  C:\Windows\System\kAOGfgX.exe
  2⤵
  PID:5456
- C:\Windows\System\AucdUSe.exe
  C:\Windows\System\AucdUSe.exe
  2⤵
  PID:5472
- C:\Windows\System\OTkZgAi.exe
  C:\Windows\System\OTkZgAi.exe
  2⤵
  PID:5492
- C:\Windows\System\CbpsnQl.exe
  C:\Windows\System\CbpsnQl.exe
  2⤵
  PID:5524
- C:\Windows\System\vUYWdJZ.exe
  C:\Windows\System\vUYWdJZ.exe
  2⤵
  PID:5556
- C:\Windows\System\KKHXJaS.exe
  C:\Windows\System\KKHXJaS.exe
  2⤵
  PID:5584
- C:\Windows\System\MEGfqce.exe
  C:\Windows\System\MEGfqce.exe
  2⤵
  PID:5608
- C:\Windows\System\VuiOakq.exe
  C:\Windows\System\VuiOakq.exe
  2⤵
  PID:5640
- C:\Windows\System\qkxMSGG.exe
  C:\Windows\System\qkxMSGG.exe
  2⤵
  PID:5664
- C:\Windows\System\XhyhlGx.exe
  C:\Windows\System\XhyhlGx.exe
  2⤵
  PID:5696
- C:\Windows\System\KIrNxPF.exe
  C:\Windows\System\KIrNxPF.exe
  2⤵
  PID:5728
- C:\Windows\System\QWqOEYz.exe
  C:\Windows\System\QWqOEYz.exe
  2⤵
  PID:5756
- C:\Windows\System\uuWGQZz.exe
  C:\Windows\System\uuWGQZz.exe
  2⤵
  PID:5792
- C:\Windows\System\vBhAUCO.exe
  C:\Windows\System\vBhAUCO.exe
  2⤵
  PID:5824
- C:\Windows\System\PkFOquK.exe
  C:\Windows\System\PkFOquK.exe
  2⤵
  PID:5860
- C:\Windows\System\KgJQSAB.exe
  C:\Windows\System\KgJQSAB.exe
  2⤵
  PID:5892
- C:\Windows\System\cHzbRQR.exe
  C:\Windows\System\cHzbRQR.exe
  2⤵
  PID:5916
- C:\Windows\System\ocTDGYf.exe
  C:\Windows\System\ocTDGYf.exe
  2⤵
  PID:5948
- C:\Windows\System\bwnQdft.exe
  C:\Windows\System\bwnQdft.exe
  2⤵
  PID:5980
- C:\Windows\System\bTAOfEp.exe
  C:\Windows\System\bTAOfEp.exe
  2⤵
  PID:6012
- C:\Windows\System\XsHmIUE.exe
  C:\Windows\System\XsHmIUE.exe
  2⤵
  PID:6048
- C:\Windows\System\QfvvKLR.exe
  C:\Windows\System\QfvvKLR.exe
  2⤵
  PID:6072
- C:\Windows\System\cAAOcCZ.exe
  C:\Windows\System\cAAOcCZ.exe
  2⤵
  PID:6108
- C:\Windows\System\SnDjldw.exe
  C:\Windows\System\SnDjldw.exe
  2⤵
  PID:5080
- C:\Windows\System\aaDSDKE.exe
  C:\Windows\System\aaDSDKE.exe
  2⤵
  PID:3044
- C:\Windows\System\zFShxku.exe
  C:\Windows\System\zFShxku.exe
  2⤵
  PID:3956
- C:\Windows\System\novIHqK.exe
  C:\Windows\System\novIHqK.exe
  2⤵
  PID:5152
- C:\Windows\System\mOOrysh.exe
  C:\Windows\System\mOOrysh.exe
  2⤵
  PID:5188
- C:\Windows\System\XPnfpNm.exe
  C:\Windows\System\XPnfpNm.exe
  2⤵
  PID:5240
- C:\Windows\System\iiCLehB.exe
  C:\Windows\System\iiCLehB.exe
  2⤵
  PID:5296
- C:\Windows\System\xCqUBvL.exe
  C:\Windows\System\xCqUBvL.exe
  2⤵
  PID:5216
- C:\Windows\System\EsYuQXF.exe
  C:\Windows\System\EsYuQXF.exe
  2⤵
  PID:5368
- C:\Windows\System\trVDGBr.exe
  C:\Windows\System\trVDGBr.exe
  2⤵
  PID:5444
- C:\Windows\System\OrJesxX.exe
  C:\Windows\System\OrJesxX.exe
  2⤵
  PID:5688
- C:\Windows\System\NFEwHaK.exe
  C:\Windows\System\NFEwHaK.exe
  2⤵
  PID:5628
- C:\Windows\System\lYhFGjr.exe
  C:\Windows\System\lYhFGjr.exe
  2⤵
  PID:5680
- C:\Windows\System\ONHYBOt.exe
  C:\Windows\System\ONHYBOt.exe
  2⤵
  PID:5748
- C:\Windows\System\XbjQUSL.exe
  C:\Windows\System\XbjQUSL.exe
  2⤵
  PID:5808
- C:\Windows\System\dSCEavr.exe
  C:\Windows\System\dSCEavr.exe
  2⤵
  PID:5740
- C:\Windows\System\RbBwOJm.exe
  C:\Windows\System\RbBwOJm.exe
  2⤵
  PID:6020
- C:\Windows\System\lraCwra.exe
  C:\Windows\System\lraCwra.exe
  2⤵
  PID:5992
- C:\Windows\System\RCMDJsY.exe
  C:\Windows\System\RCMDJsY.exe
  2⤵
  PID:6032
- C:\Windows\System\gRWjCmT.exe
  C:\Windows\System\gRWjCmT.exe
  2⤵
  PID:6004
- C:\Windows\System\HNChEtx.exe
  C:\Windows\System\HNChEtx.exe
  2⤵
  PID:5416
- C:\Windows\System\lByufmb.exe
  C:\Windows\System\lByufmb.exe
  2⤵
  PID:5148
- C:\Windows\System\SeBvgAm.exe
  C:\Windows\System\SeBvgAm.exe
  2⤵
  PID:1092
- C:\Windows\System\ORNAxcE.exe
  C:\Windows\System\ORNAxcE.exe
  2⤵
  PID:5512
- C:\Windows\System\Wymxzzu.exe
  C:\Windows\System\Wymxzzu.exe
  2⤵
  PID:5484
- C:\Windows\System\kAkqzOB.exe
  C:\Windows\System\kAkqzOB.exe
  2⤵
  PID:5672
- C:\Windows\System\phjmeSu.exe
  C:\Windows\System\phjmeSu.exe
  2⤵
  PID:5876
- C:\Windows\System\EkWwymH.exe
  C:\Windows\System\EkWwymH.exe
  2⤵
  PID:5908
- C:\Windows\System\RkoIWmh.exe
  C:\Windows\System\RkoIWmh.exe
  2⤵
  PID:5804
- C:\Windows\System\WZMCMnM.exe
  C:\Windows\System\WZMCMnM.exe
  2⤵
  PID:5272
- C:\Windows\System\zZDYMYc.exe
  C:\Windows\System\zZDYMYc.exe
  2⤵
  PID:6164
- C:\Windows\System\uUiqyqC.exe
  C:\Windows\System\uUiqyqC.exe
  2⤵
  PID:6204
- C:\Windows\System\eZLFBCA.exe
  C:\Windows\System\eZLFBCA.exe
  2⤵
  PID:6228
- C:\Windows\System\EfHomIo.exe
  C:\Windows\System\EfHomIo.exe
  2⤵
  PID:6260
- C:\Windows\System\qVdwzpF.exe
  C:\Windows\System\qVdwzpF.exe
  2⤵
  PID:6288
- C:\Windows\System\xTmDzmr.exe
  C:\Windows\System\xTmDzmr.exe
  2⤵
  PID:6320
- C:\Windows\System\JcuKWry.exe
  C:\Windows\System\JcuKWry.exe
  2⤵
  PID:6348
- C:\Windows\System\XRNxwMa.exe
  C:\Windows\System\XRNxwMa.exe
  2⤵
  PID:6384
- C:\Windows\System\TlGpkJj.exe
  C:\Windows\System\TlGpkJj.exe
  2⤵
  PID:6420
- C:\Windows\System\mvDrOAX.exe
  C:\Windows\System\mvDrOAX.exe
  2⤵
  PID:6452
- C:\Windows\System\NcIEYrB.exe
  C:\Windows\System\NcIEYrB.exe
  2⤵
  PID:6492
- C:\Windows\System\OqyKRlq.exe
  C:\Windows\System\OqyKRlq.exe
  2⤵
  PID:6536
- C:\Windows\System\mghEIxT.exe
  C:\Windows\System\mghEIxT.exe
  2⤵
  PID:6564
- C:\Windows\System\vgtVRyt.exe
  C:\Windows\System\vgtVRyt.exe
  2⤵
  PID:6596
- C:\Windows\System\sKKJOqS.exe
  C:\Windows\System\sKKJOqS.exe
  2⤵
  PID:6620
- C:\Windows\System\GyQrHBr.exe
  C:\Windows\System\GyQrHBr.exe
  2⤵
  PID:6644
- C:\Windows\System\TNBCDLL.exe
  C:\Windows\System\TNBCDLL.exe
  2⤵
  PID:6676
- C:\Windows\System\ZqsuKvb.exe
  C:\Windows\System\ZqsuKvb.exe
  2⤵
  PID:6716
- C:\Windows\System\xcwLPvD.exe
  C:\Windows\System\xcwLPvD.exe
  2⤵
  PID:6748
- C:\Windows\System\eDMsLMb.exe
  C:\Windows\System\eDMsLMb.exe
  2⤵
  PID:6776
- C:\Windows\System\kFjSrzN.exe
  C:\Windows\System\kFjSrzN.exe
  2⤵
  PID:6804
- C:\Windows\System\QxJPAmK.exe
  C:\Windows\System\QxJPAmK.exe
  2⤵
  PID:6836
- C:\Windows\System\EwGQare.exe
  C:\Windows\System\EwGQare.exe
  2⤵
  PID:6872
- C:\Windows\System\XOLWUqF.exe
  C:\Windows\System\XOLWUqF.exe
  2⤵
  PID:6904
- C:\Windows\System\kTrSTBR.exe
  C:\Windows\System\kTrSTBR.exe
  2⤵
  PID:6932
- C:\Windows\System\rdWLqPL.exe
  C:\Windows\System\rdWLqPL.exe
  2⤵
  PID:6952
- C:\Windows\System\aQfMblp.exe
  C:\Windows\System\aQfMblp.exe
  2⤵
  PID:6980
- C:\Windows\System\PHHmodg.exe
  C:\Windows\System\PHHmodg.exe
  2⤵
  PID:7004
- C:\Windows\System\UAEIQIW.exe
  C:\Windows\System\UAEIQIW.exe
  2⤵
  PID:7024
- C:\Windows\System\JgBiczc.exe
  C:\Windows\System\JgBiczc.exe
  2⤵
  PID:7056
- C:\Windows\System\nwmINKA.exe
  C:\Windows\System\nwmINKA.exe
  2⤵
  PID:7076
- C:\Windows\System\BDcuVfQ.exe
  C:\Windows\System\BDcuVfQ.exe
  2⤵
  PID:7096
- C:\Windows\System\LXXkQHQ.exe
  C:\Windows\System\LXXkQHQ.exe
  2⤵
  PID:7120
- C:\Windows\System\GtURSWH.exe
  C:\Windows\System\GtURSWH.exe
  2⤵
  PID:7148
- C:\Windows\System\PZxiIvz.exe
  C:\Windows\System\PZxiIvz.exe
  2⤵
  PID:5388
- C:\Windows\System\UncXqMb.exe
  C:\Windows\System\UncXqMb.exe
  2⤵
  PID:5960
- C:\Windows\System\GurKtMP.exe
  C:\Windows\System\GurKtMP.exe
  2⤵
  PID:5220
- C:\Windows\System\Jkkjnaj.exe
  C:\Windows\System\Jkkjnaj.exe
  2⤵
  PID:6188
- C:\Windows\System\MLBozCH.exe
  C:\Windows\System\MLBozCH.exe
  2⤵
  PID:6276
- C:\Windows\System\PhnnNfH.exe
  C:\Windows\System\PhnnNfH.exe
  2⤵
  PID:6340
- C:\Windows\System\ZnJrbal.exe
  C:\Windows\System\ZnJrbal.exe
  2⤵
  PID:6480
- C:\Windows\System\XczhXJs.exe
  C:\Windows\System\XczhXJs.exe
  2⤵
  PID:6444
- C:\Windows\System\OSvlwTf.exe
  C:\Windows\System\OSvlwTf.exe
  2⤵
  PID:6556
- C:\Windows\System\HVTcVUQ.exe
  C:\Windows\System\HVTcVUQ.exe
  2⤵
  PID:6612
- C:\Windows\System\KQGxiUJ.exe
  C:\Windows\System\KQGxiUJ.exe
  2⤵
  PID:6636
- C:\Windows\System\bXwibOR.exe
  C:\Windows\System\bXwibOR.exe
  2⤵
  PID:6704
- C:\Windows\System\QafFYQW.exe
  C:\Windows\System\QafFYQW.exe
  2⤵
  PID:6760
- C:\Windows\System\cWAhYOW.exe
  C:\Windows\System\cWAhYOW.exe
  2⤵
  PID:6844
- C:\Windows\System\uFKXfwS.exe
  C:\Windows\System\uFKXfwS.exe
  2⤵
  PID:6892
- C:\Windows\System\vnlidpB.exe
  C:\Windows\System\vnlidpB.exe
  2⤵
  PID:6960
- C:\Windows\System\VvWzcbo.exe
  C:\Windows\System\VvWzcbo.exe
  2⤵
  PID:6996
- C:\Windows\System\jFOiXgg.exe
  C:\Windows\System\jFOiXgg.exe
  2⤵
  PID:7044
- C:\Windows\System\WLjdwmP.exe
  C:\Windows\System\WLjdwmP.exe
  2⤵
  PID:5972
- C:\Windows\System\tGFdgVC.exe
  C:\Windows\System\tGFdgVC.exe
  2⤵
  PID:5616
- C:\Windows\System\eEohSnb.exe
  C:\Windows\System\eEohSnb.exe
  2⤵
  PID:5660
- C:\Windows\System\vDONVed.exe
  C:\Windows\System\vDONVed.exe
  2⤵
  PID:6220
- C:\Windows\System\cRyYdZW.exe
  C:\Windows\System\cRyYdZW.exe
  2⤵
  PID:6468
- C:\Windows\System\ykwrWzb.exe
  C:\Windows\System\ykwrWzb.exe
  2⤵
  PID:6436
- C:\Windows\System\ZuEtEdU.exe
  C:\Windows\System\ZuEtEdU.exe
  2⤵
  PID:6736
- C:\Windows\System\fIziUcQ.exe
  C:\Windows\System\fIziUcQ.exe
  2⤵
  PID:6764
- C:\Windows\System\nQdpjWu.exe
  C:\Windows\System\nQdpjWu.exe
  2⤵
  PID:6948
- C:\Windows\System\bybkoSv.exe
  C:\Windows\System\bybkoSv.exe
  2⤵
  PID:6724
- C:\Windows\System\vADpHIO.exe
  C:\Windows\System\vADpHIO.exe
  2⤵
  PID:7164
- C:\Windows\System\vvzqWnf.exe
  C:\Windows\System\vvzqWnf.exe
  2⤵
  PID:7136
- C:\Windows\System\xgoatcx.exe
  C:\Windows\System\xgoatcx.exe
  2⤵
  PID:6968
- C:\Windows\System\zTyQsZl.exe
  C:\Windows\System\zTyQsZl.exe
  2⤵
  PID:7188
- C:\Windows\System\khkmJur.exe
  C:\Windows\System\khkmJur.exe
  2⤵
  PID:7216
- C:\Windows\System\rHkAcGE.exe
  C:\Windows\System\rHkAcGE.exe
  2⤵
  PID:7252
- C:\Windows\System\lwpKwXJ.exe
  C:\Windows\System\lwpKwXJ.exe
  2⤵
  PID:7272
- C:\Windows\System\OLNSTDn.exe
  C:\Windows\System\OLNSTDn.exe
  2⤵
  PID:7300
- C:\Windows\System\zyvMAzj.exe
  C:\Windows\System\zyvMAzj.exe
  2⤵
  PID:7328
- C:\Windows\System\sYwjXkY.exe
  C:\Windows\System\sYwjXkY.exe
  2⤵
  PID:7352
- C:\Windows\System\CQkfDIE.exe
  C:\Windows\System\CQkfDIE.exe
  2⤵
  PID:7376
- C:\Windows\System\faWlNcb.exe
  C:\Windows\System\faWlNcb.exe
  2⤵
  PID:7400
- C:\Windows\System\aRkjUop.exe
  C:\Windows\System\aRkjUop.exe
  2⤵
  PID:7416
- C:\Windows\System\ItvMhBL.exe
  C:\Windows\System\ItvMhBL.exe
  2⤵
  PID:7436
- C:\Windows\System\MHZacUG.exe
  C:\Windows\System\MHZacUG.exe
  2⤵
  PID:7464
- C:\Windows\System\afZtXic.exe
  C:\Windows\System\afZtXic.exe
  2⤵
  PID:7492
- C:\Windows\System\tvYovvG.exe
  C:\Windows\System\tvYovvG.exe
  2⤵
  PID:7524
- C:\Windows\System\DPqIyyZ.exe
  C:\Windows\System\DPqIyyZ.exe
  2⤵
  PID:7552
- C:\Windows\System\tfmdmZV.exe
  C:\Windows\System\tfmdmZV.exe
  2⤵
  PID:7588
- C:\Windows\System\JOEzQVh.exe
  C:\Windows\System\JOEzQVh.exe
  2⤵
  PID:7616
- C:\Windows\System\qFIcbEJ.exe
  C:\Windows\System\qFIcbEJ.exe
  2⤵
  PID:7656
- C:\Windows\System\tsNvVlu.exe
  C:\Windows\System\tsNvVlu.exe
  2⤵
  PID:7680
- C:\Windows\System\VvMRzLj.exe
  C:\Windows\System\VvMRzLj.exe
  2⤵
  PID:7708
- C:\Windows\System\UiNhHuw.exe
  C:\Windows\System\UiNhHuw.exe
  2⤵
  PID:7732
- C:\Windows\System\jDsSFST.exe
  C:\Windows\System\jDsSFST.exe
  2⤵
  PID:7756
- C:\Windows\System\SxfytVw.exe
  C:\Windows\System\SxfytVw.exe
  2⤵
  PID:7788
- C:\Windows\System\uHztOQt.exe
  C:\Windows\System\uHztOQt.exe
  2⤵
  PID:7812
- C:\Windows\System\noDjoEG.exe
  C:\Windows\System\noDjoEG.exe
  2⤵
  PID:7836
- C:\Windows\System\QEXdgrx.exe
  C:\Windows\System\QEXdgrx.exe
  2⤵
  PID:7860
- C:\Windows\System\xLkzhZN.exe
  C:\Windows\System\xLkzhZN.exe
  2⤵
  PID:7880
- C:\Windows\System\zSyOzfv.exe
  C:\Windows\System\zSyOzfv.exe
  2⤵
  PID:7904
- C:\Windows\System\lvhwcpl.exe
  C:\Windows\System\lvhwcpl.exe
  2⤵
  PID:7928
- C:\Windows\System\CLRLYEi.exe
  C:\Windows\System\CLRLYEi.exe
  2⤵
  PID:7956
- C:\Windows\System\cRYOuzB.exe
  C:\Windows\System\cRYOuzB.exe
  2⤵
  PID:7976
- C:\Windows\System\UCpupEb.exe
  C:\Windows\System\UCpupEb.exe
  2⤵
  PID:8004
- C:\Windows\System\AywHLhv.exe
  C:\Windows\System\AywHLhv.exe
  2⤵
  PID:8028
- C:\Windows\System\yxREqle.exe
  C:\Windows\System\yxREqle.exe
  2⤵
  PID:8052
- C:\Windows\System\qSCWSqH.exe
  C:\Windows\System\qSCWSqH.exe
  2⤵
  PID:8076
- C:\Windows\System\LFpRjka.exe
  C:\Windows\System\LFpRjka.exe
  2⤵
  PID:8104
- C:\Windows\System\ubIyTIV.exe
  C:\Windows\System\ubIyTIV.exe
  2⤵
  PID:8132
- C:\Windows\System\eSYGdmn.exe
  C:\Windows\System\eSYGdmn.exe
  2⤵
  PID:8160
- C:\Windows\System\WGBkymV.exe
  C:\Windows\System\WGBkymV.exe
  2⤵
  PID:5468
- C:\Windows\System\NnCAUQa.exe
  C:\Windows\System\NnCAUQa.exe
  2⤵
  PID:6672
- C:\Windows\System\AhEIHhH.exe
  C:\Windows\System\AhEIHhH.exe
  2⤵
  PID:7176
- C:\Windows\System\SGQlswC.exe
  C:\Windows\System\SGQlswC.exe
  2⤵
  PID:7236
- C:\Windows\System\MZaPheN.exe
  C:\Windows\System\MZaPheN.exe
  2⤵
  PID:7268
- C:\Windows\System\tiLGuNC.exe
  C:\Windows\System\tiLGuNC.exe
  2⤵
  PID:7408
- C:\Windows\System\bEDQiJt.exe
  C:\Windows\System\bEDQiJt.exe
  2⤵
  PID:7396
- C:\Windows\System\DRRTcpT.exe
  C:\Windows\System\DRRTcpT.exe
  2⤵
  PID:7364
- C:\Windows\System\YjEyasb.exe
  C:\Windows\System\YjEyasb.exe
  2⤵
  PID:7604
- C:\Windows\System\zvgatKO.exe
  C:\Windows\System\zvgatKO.exe
  2⤵
  PID:7432
- C:\Windows\System\ZMhyOLB.exe
  C:\Windows\System\ZMhyOLB.exe
  2⤵
  PID:7612
- C:\Windows\System\nxVaGZL.exe
  C:\Windows\System\nxVaGZL.exe
  2⤵
  PID:7728
- C:\Windows\System\JEHHgNw.exe
  C:\Windows\System\JEHHgNw.exe
  2⤵
  PID:7892
- C:\Windows\System\HhjWxcV.exe
  C:\Windows\System\HhjWxcV.exe
  2⤵
  PID:7676
- C:\Windows\System\ISqfDVO.exe
  C:\Windows\System\ISqfDVO.exe
  2⤵
  PID:7856
- C:\Windows\System\hYETOfc.exe
  C:\Windows\System\hYETOfc.exe
  2⤵
  PID:7876
- C:\Windows\System\XcZPvHc.exe
  C:\Windows\System\XcZPvHc.exe
  2⤵
  PID:7824
- C:\Windows\System\PHagGHq.exe
  C:\Windows\System\PHagGHq.exe
  2⤵
  PID:8184
- C:\Windows\System\qHzkhKe.exe
  C:\Windows\System\qHzkhKe.exe
  2⤵
  PID:7480
- C:\Windows\System\pdmSBrn.exe
  C:\Windows\System\pdmSBrn.exe
  2⤵
  PID:8084
- C:\Windows\System\pUyVCmR.exe
  C:\Windows\System\pUyVCmR.exe
  2⤵
  PID:7348
- C:\Windows\System\pQvLlwU.exe
  C:\Windows\System\pQvLlwU.exe
  2⤵
  PID:7704
- C:\Windows\System\AurEtmn.exe
  C:\Windows\System\AurEtmn.exe
  2⤵
  PID:8176
- C:\Windows\System\AtSjVVI.exe
  C:\Windows\System\AtSjVVI.exe
  2⤵
  PID:6864
- C:\Windows\System\pRICrkm.exe
  C:\Windows\System\pRICrkm.exe
  2⤵
  PID:8060
- C:\Windows\System\EbvICCz.exe
  C:\Windows\System\EbvICCz.exe
  2⤵
  PID:8212
- C:\Windows\System\ezTJjYj.exe
  C:\Windows\System\ezTJjYj.exe
  2⤵
  PID:8236
- C:\Windows\System\nnEGVrT.exe
  C:\Windows\System\nnEGVrT.exe
  2⤵
  PID:8272
- C:\Windows\System\PgyuowW.exe
  C:\Windows\System\PgyuowW.exe
  2⤵
  PID:8296
- C:\Windows\System\inxWKUw.exe
  C:\Windows\System\inxWKUw.exe
  2⤵
  PID:8324
- C:\Windows\System\xGuqKRj.exe
  C:\Windows\System\xGuqKRj.exe
  2⤵
  PID:8348
- C:\Windows\System\ZhdYrNu.exe
  C:\Windows\System\ZhdYrNu.exe
  2⤵
  PID:8380
- C:\Windows\System\HvyVVpq.exe
  C:\Windows\System\HvyVVpq.exe
  2⤵
  PID:8400
- C:\Windows\System\PmgOWxx.exe
  C:\Windows\System\PmgOWxx.exe
  2⤵
  PID:8428
- C:\Windows\System\MbOStSO.exe
  C:\Windows\System\MbOStSO.exe
  2⤵
  PID:8452
- C:\Windows\System\BZbXsSO.exe
  C:\Windows\System\BZbXsSO.exe
  2⤵
  PID:8480
- C:\Windows\System\BxgwGRa.exe
  C:\Windows\System\BxgwGRa.exe
  2⤵
  PID:8504
- C:\Windows\System\BgPqvVF.exe
  C:\Windows\System\BgPqvVF.exe
  2⤵
  PID:8540
- C:\Windows\System\ixbmguM.exe
  C:\Windows\System\ixbmguM.exe
  2⤵
  PID:8560
- C:\Windows\System\eUGBSzN.exe
  C:\Windows\System\eUGBSzN.exe
  2⤵
  PID:8592
- C:\Windows\System\mbSmXAB.exe
  C:\Windows\System\mbSmXAB.exe
  2⤵
  PID:8612
- C:\Windows\System\MEJbcXf.exe
  C:\Windows\System\MEJbcXf.exe
  2⤵
  PID:8640
- C:\Windows\System\Vagvnrn.exe
  C:\Windows\System\Vagvnrn.exe
  2⤵
  PID:8668
- C:\Windows\System\JVylDdI.exe
  C:\Windows\System\JVylDdI.exe
  2⤵
  PID:8696
- C:\Windows\System\RdSbFZc.exe
  C:\Windows\System\RdSbFZc.exe
  2⤵
  PID:8728
- C:\Windows\System\SxzDFaB.exe
  C:\Windows\System\SxzDFaB.exe
  2⤵
  PID:8748
- C:\Windows\System\BJozNLe.exe
  C:\Windows\System\BJozNLe.exe
  2⤵
  PID:8780
- C:\Windows\System\pnRZaRH.exe
  C:\Windows\System\pnRZaRH.exe
  2⤵
  PID:8800
- C:\Windows\System\iDpPRUL.exe
  C:\Windows\System\iDpPRUL.exe
  2⤵
  PID:8828
- C:\Windows\System\WfHDpJR.exe
  C:\Windows\System\WfHDpJR.exe
  2⤵
  PID:8856
- C:\Windows\System\voVREIn.exe
  C:\Windows\System\voVREIn.exe
  2⤵
  PID:8880
- C:\Windows\System\nHtFIum.exe
  C:\Windows\System\nHtFIum.exe
  2⤵
  PID:8896
- C:\Windows\System\jwJbMAa.exe
  C:\Windows\System\jwJbMAa.exe
  2⤵
  PID:8920
- C:\Windows\System\ngxPwRX.exe
  C:\Windows\System\ngxPwRX.exe
  2⤵
  PID:8944
- C:\Windows\System\nxsSOoa.exe
  C:\Windows\System\nxsSOoa.exe
  2⤵
  PID:8972
- C:\Windows\System\RCdpaBm.exe
  C:\Windows\System\RCdpaBm.exe
  2⤵
  PID:8996
- C:\Windows\System\ZiaObFe.exe
  C:\Windows\System\ZiaObFe.exe
  2⤵
  PID:9020
- C:\Windows\System\qnSgSWI.exe
  C:\Windows\System\qnSgSWI.exe
  2⤵
  PID:9040
- C:\Windows\System\WZKHUTv.exe
  C:\Windows\System\WZKHUTv.exe
  2⤵
  PID:9068
- C:\Windows\System\SBgjvJm.exe
  C:\Windows\System\SBgjvJm.exe
  2⤵
  PID:9092
- C:\Windows\System\fukHYXX.exe
  C:\Windows\System\fukHYXX.exe
  2⤵
  PID:9116
- C:\Windows\System\tlAmqDs.exe
  C:\Windows\System\tlAmqDs.exe
  2⤵
  PID:9144
- C:\Windows\System\vSvmSuY.exe
  C:\Windows\System\vSvmSuY.exe
  2⤵
  PID:9172
- C:\Windows\System\QZYrlWF.exe
  C:\Windows\System\QZYrlWF.exe
  2⤵
  PID:9204
- C:\Windows\System\daOUNxL.exe
  C:\Windows\System\daOUNxL.exe
  2⤵
  PID:7508
- C:\Windows\System\uXyddDw.exe
  C:\Windows\System\uXyddDw.exe
  2⤵
  PID:7852
- C:\Windows\System\VOCmgRR.exe
  C:\Windows\System\VOCmgRR.exe
  2⤵
  PID:7996
- C:\Windows\System\ApRZrfJ.exe
  C:\Windows\System\ApRZrfJ.exe
  2⤵
  PID:7448
- C:\Windows\System\RNdAcev.exe
  C:\Windows\System\RNdAcev.exe
  2⤵
  PID:8124
- C:\Windows\System\gVxdjyq.exe
  C:\Windows\System\gVxdjyq.exe
  2⤵
  PID:8372
- C:\Windows\System\YDNOFct.exe
  C:\Windows\System\YDNOFct.exe
  2⤵
  PID:8256
- C:\Windows\System\yZYDigD.exe
  C:\Windows\System\yZYDigD.exe
  2⤵
  PID:8528
- C:\Windows\System\ZvSvzGs.exe
  C:\Windows\System\ZvSvzGs.exe
  2⤵
  PID:8580
- C:\Windows\System\WMcZytD.exe
  C:\Windows\System\WMcZytD.exe
  2⤵
  PID:8424
- C:\Windows\System\fAtREMY.exe
  C:\Windows\System\fAtREMY.exe
  2⤵
  PID:8496
- C:\Windows\System\fzTpkJe.exe
  C:\Windows\System\fzTpkJe.exe
  2⤵
  PID:8768
- C:\Windows\System\KkMzPwn.exe
  C:\Windows\System\KkMzPwn.exe
  2⤵
  PID:8872
- C:\Windows\System\DkUwERu.exe
  C:\Windows\System\DkUwERu.exe
  2⤵
  PID:8476
- C:\Windows\System\URHmhjH.exe
  C:\Windows\System\URHmhjH.exe
  2⤵
  PID:8724
- C:\Windows\System\gYQjAzc.exe
  C:\Windows\System\gYQjAzc.exe
  2⤵
  PID:8792
- C:\Windows\System\MgfSlRk.exe
  C:\Windows\System\MgfSlRk.exe
  2⤵
  PID:8928
- C:\Windows\System\wMBJXyv.exe
  C:\Windows\System\wMBJXyv.exe
  2⤵
  PID:9160
- C:\Windows\System\WjQbSjG.exe
  C:\Windows\System\WjQbSjG.exe
  2⤵
  PID:9188
- C:\Windows\System\HoJzdbj.exe
  C:\Windows\System\HoJzdbj.exe
  2⤵
  PID:7292
- C:\Windows\System\fWthZjM.exe
  C:\Windows\System\fWthZjM.exe
  2⤵
  PID:9052
- C:\Windows\System\qayOYWS.exe
  C:\Windows\System\qayOYWS.exe
  2⤵
  PID:8912
- C:\Windows\System\LGBARTM.exe
  C:\Windows\System\LGBARTM.exe
  2⤵
  PID:8552
- C:\Windows\System\NvagVia.exe
  C:\Windows\System\NvagVia.exe
  2⤵
  PID:8304
- C:\Windows\System\YRvqnyG.exe
  C:\Windows\System\YRvqnyG.exe
  2⤵
  PID:9016
- C:\Windows\System\tYtWbkW.exe
  C:\Windows\System\tYtWbkW.exe
  2⤵
  PID:8964
- C:\Windows\System\iJQYTyH.exe
  C:\Windows\System\iJQYTyH.exe
  2⤵
  PID:9112
- C:\Windows\System\sAqrcJX.exe
  C:\Windows\System\sAqrcJX.exe
  2⤵
  PID:8568
- C:\Windows\System\KuEuZEy.exe
  C:\Windows\System\KuEuZEy.exe
  2⤵
  PID:9244
- C:\Windows\System\owSsikh.exe
  C:\Windows\System\owSsikh.exe
  2⤵
  PID:9276
- C:\Windows\System\lbGJxHw.exe
  C:\Windows\System\lbGJxHw.exe
  2⤵
  PID:9296
- C:\Windows\System\PhrlQmw.exe
  C:\Windows\System\PhrlQmw.exe
  2⤵
  PID:9324
- C:\Windows\System\IgOUTno.exe
  C:\Windows\System\IgOUTno.exe
  2⤵
  PID:9348
- C:\Windows\System\eXsUYWb.exe
  C:\Windows\System\eXsUYWb.exe
  2⤵
  PID:9384
- C:\Windows\System\JhaILTU.exe
  C:\Windows\System\JhaILTU.exe
  2⤵
  PID:9408
- C:\Windows\System\asxCThH.exe
  C:\Windows\System\asxCThH.exe
  2⤵
  PID:9440
- C:\Windows\System\NWOixrY.exe
  C:\Windows\System\NWOixrY.exe
  2⤵
  PID:9472
- C:\Windows\System\CJhFbWO.exe
  C:\Windows\System\CJhFbWO.exe
  2⤵
  PID:9492
- C:\Windows\System\QDkKcss.exe
  C:\Windows\System\QDkKcss.exe
  2⤵
  PID:9516
- C:\Windows\System\jWtdLmm.exe
  C:\Windows\System\jWtdLmm.exe
  2⤵
  PID:9544
- C:\Windows\System\KuqfJHJ.exe
  C:\Windows\System\KuqfJHJ.exe
  2⤵
  PID:9568
- C:\Windows\System\ipzqhby.exe
  C:\Windows\System\ipzqhby.exe
  2⤵
  PID:9596
- C:\Windows\System\IENMETD.exe
  C:\Windows\System\IENMETD.exe
  2⤵
  PID:9624
- C:\Windows\System\aMTWebD.exe
  C:\Windows\System\aMTWebD.exe
  2⤵
  PID:9644
- C:\Windows\System\sEryeMQ.exe
  C:\Windows\System\sEryeMQ.exe
  2⤵
  PID:9668
- C:\Windows\System\eFWDhYR.exe
  C:\Windows\System\eFWDhYR.exe
  2⤵
  PID:9688
- C:\Windows\System\kMamDFK.exe
  C:\Windows\System\kMamDFK.exe
  2⤵
  PID:9720
- C:\Windows\System\kwAOkCy.exe
  C:\Windows\System\kwAOkCy.exe
  2⤵
  PID:9744
- C:\Windows\System\UZmgtpL.exe
  C:\Windows\System\UZmgtpL.exe
  2⤵
  PID:9772
- C:\Windows\System\IiUqTLO.exe
  C:\Windows\System\IiUqTLO.exe
  2⤵
  PID:9800
- C:\Windows\System\jNPhCHP.exe
  C:\Windows\System\jNPhCHP.exe
  2⤵
  PID:9824
- C:\Windows\System\QoeGISY.exe
  C:\Windows\System\QoeGISY.exe
  2⤵
  PID:9852
- C:\Windows\System\RrLxBSE.exe
  C:\Windows\System\RrLxBSE.exe
  2⤵
  PID:9876
- C:\Windows\System\GMUNmvZ.exe
  C:\Windows\System\GMUNmvZ.exe
  2⤵
  PID:9904
- C:\Windows\System\LyikRYj.exe
  C:\Windows\System\LyikRYj.exe
  2⤵
  PID:9924
- C:\Windows\System\fHRFMlN.exe
  C:\Windows\System\fHRFMlN.exe
  2⤵
  PID:9952
- C:\Windows\System\jWryrzo.exe
  C:\Windows\System\jWryrzo.exe
  2⤵
  PID:9972
- C:\Windows\System\ecKiWxB.exe
  C:\Windows\System\ecKiWxB.exe
  2⤵
  PID:10000
- C:\Windows\System\rlLtQsE.exe
  C:\Windows\System\rlLtQsE.exe
  2⤵
  PID:10024
- C:\Windows\System\EAmjBFH.exe
  C:\Windows\System\EAmjBFH.exe
  2⤵
  PID:10048
- C:\Windows\System\geeagHV.exe
  C:\Windows\System\geeagHV.exe
  2⤵
  PID:10076
- C:\Windows\System\WmzRDhd.exe
  C:\Windows\System\WmzRDhd.exe
  2⤵
  PID:10108
- C:\Windows\System\TrMJFFv.exe
  C:\Windows\System\TrMJFFv.exe
  2⤵
  PID:10132
- C:\Windows\System\ReROTVf.exe
  C:\Windows\System\ReROTVf.exe
  2⤵
  PID:10160
- C:\Windows\System\jxhZJqy.exe
  C:\Windows\System\jxhZJqy.exe
  2⤵
  PID:10180
- C:\Windows\System\WpxRBfS.exe
  C:\Windows\System\WpxRBfS.exe
  2⤵
  PID:10208
- C:\Windows\System\xkVRrgS.exe
  C:\Windows\System\xkVRrgS.exe
  2⤵
  PID:10228
- C:\Windows\System\TgnYiep.exe
  C:\Windows\System\TgnYiep.exe
  2⤵
  PID:9032
- C:\Windows\System\izVXQeV.exe
  C:\Windows\System\izVXQeV.exe
  2⤵
  PID:8908
- C:\Windows\System\XpjGSvI.exe
  C:\Windows\System\XpjGSvI.exe
  2⤵
  PID:8868
- C:\Windows\System\jWpFrop.exe
  C:\Windows\System\jWpFrop.exe
  2⤵
  PID:9336
- C:\Windows\System\NqLqRLZ.exe
  C:\Windows\System\NqLqRLZ.exe
  2⤵
  PID:8292
- C:\Windows\System\syTlIan.exe
  C:\Windows\System\syTlIan.exe
  2⤵
  PID:9464
- C:\Windows\System\yngUgCg.exe
  C:\Windows\System\yngUgCg.exe
  2⤵
  PID:9560
- C:\Windows\System\UIGxogd.exe
  C:\Windows\System\UIGxogd.exe
  2⤵
  PID:9284
- C:\Windows\System\YDnkVOx.exe
  C:\Windows\System\YDnkVOx.exe
  2⤵
  PID:9640
- C:\Windows\System\HtCJnbl.exe
  C:\Windows\System\HtCJnbl.exe
  2⤵
  PID:9676
- C:\Windows\System\zFVZcYd.exe
  C:\Windows\System\zFVZcYd.exe
  2⤵
  PID:9760
- C:\Windows\System\RPKMyBV.exe
  C:\Windows\System\RPKMyBV.exe
  2⤵
  PID:9532
- C:\Windows\System\KmJSDqO.exe
  C:\Windows\System\KmJSDqO.exe
  2⤵
  PID:9256
- C:\Windows\System\bTXIzow.exe
  C:\Windows\System\bTXIzow.exe
  2⤵
  PID:9868
- C:\Windows\System\bxOuXTc.exe
  C:\Windows\System\bxOuXTc.exe
  2⤵
  PID:9660
- C:\Windows\System\pZkYksm.exe
  C:\Windows\System\pZkYksm.exe
  2⤵
  PID:9488
- C:\Windows\System\zJAEhAT.exe
  C:\Windows\System\zJAEhAT.exe
  2⤵
  PID:10128
- C:\Windows\System\tdmAryy.exe
  C:\Windows\System\tdmAryy.exe
  2⤵
  PID:10172
- C:\Windows\System\CoeAdDe.exe
  C:\Windows\System\CoeAdDe.exe
  2⤵
  PID:9920
- C:\Windows\System\HRKNKCG.exe
  C:\Windows\System\HRKNKCG.exe
  2⤵
  PID:10256
- C:\Windows\System\JmSzLdm.exe
  C:\Windows\System\JmSzLdm.exe
  2⤵
  PID:10284
- C:\Windows\System\yherXRO.exe
  C:\Windows\System\yherXRO.exe
  2⤵
  PID:10308
- C:\Windows\System\sBmUHIJ.exe
  C:\Windows\System\sBmUHIJ.exe
  2⤵
  PID:10332
- C:\Windows\System\JXWByiG.exe
  C:\Windows\System\JXWByiG.exe
  2⤵
  PID:10356
- C:\Windows\System\HJIVsdI.exe
  C:\Windows\System\HJIVsdI.exe
  2⤵
  PID:10384
- C:\Windows\System\JyncHTy.exe
  C:\Windows\System\JyncHTy.exe
  2⤵
  PID:10404
- C:\Windows\System\UdvkcgB.exe
  C:\Windows\System\UdvkcgB.exe
  2⤵
  PID:10420
- C:\Windows\System\gshxELe.exe
  C:\Windows\System\gshxELe.exe
  2⤵
  PID:10440
- C:\Windows\System\wbuVLzF.exe
  C:\Windows\System\wbuVLzF.exe
  2⤵
  PID:10472
- C:\Windows\System\Sppfweo.exe
  C:\Windows\System\Sppfweo.exe
  2⤵
  PID:10504
- C:\Windows\System\OzOLqpK.exe
  C:\Windows\System\OzOLqpK.exe
  2⤵
  PID:10536
- C:\Windows\System\RcHVvEg.exe
  C:\Windows\System\RcHVvEg.exe
  2⤵
  PID:10560
- C:\Windows\System\kCZmGBa.exe
  C:\Windows\System\kCZmGBa.exe
  2⤵
  PID:10576
- C:\Windows\System\msEuWph.exe
  C:\Windows\System\msEuWph.exe
  2⤵
  PID:10600
- C:\Windows\System\bgcFcxB.exe
  C:\Windows\System\bgcFcxB.exe
  2⤵
  PID:10628
- C:\Windows\System\ULwScDV.exe
  C:\Windows\System\ULwScDV.exe
  2⤵
  PID:10652
- C:\Windows\System\TaBWxEW.exe
  C:\Windows\System\TaBWxEW.exe
  2⤵
  PID:10680
- C:\Windows\System\rZsAWHB.exe
  C:\Windows\System\rZsAWHB.exe
  2⤵
  PID:10708
- C:\Windows\System\ZQnlGIB.exe
  C:\Windows\System\ZQnlGIB.exe
  2⤵
  PID:10732
- C:\Windows\System\XfWsLjq.exe
  C:\Windows\System\XfWsLjq.exe
  2⤵
  PID:10752
- C:\Windows\System\kyfjVTb.exe
  C:\Windows\System\kyfjVTb.exe
  2⤵
  PID:10780
- C:\Windows\System\ukhjlqL.exe
  C:\Windows\System\ukhjlqL.exe
  2⤵
  PID:10808
- C:\Windows\System\mCtcKNL.exe
  C:\Windows\System\mCtcKNL.exe
  2⤵
  PID:10828
- C:\Windows\System\wOmNUkx.exe
  C:\Windows\System\wOmNUkx.exe
  2⤵
  PID:10852
- C:\Windows\System\qLrCoiT.exe
  C:\Windows\System\qLrCoiT.exe
  2⤵
  PID:10872
- C:\Windows\System\gOmoMSb.exe
  C:\Windows\System\gOmoMSb.exe
  2⤵
  PID:10896
- C:\Windows\System\kIpVNWk.exe
  C:\Windows\System\kIpVNWk.exe
  2⤵
  PID:10924
- C:\Windows\System\qTDHhKa.exe
  C:\Windows\System\qTDHhKa.exe
  2⤵
  PID:10944
- C:\Windows\System\LpKzowy.exe
  C:\Windows\System\LpKzowy.exe
  2⤵
  PID:10968
- C:\Windows\System\CKKMrvG.exe
  C:\Windows\System\CKKMrvG.exe
  2⤵
  PID:10992
- C:\Windows\System\oJoqSvO.exe
  C:\Windows\System\oJoqSvO.exe
  2⤵
  PID:11020
- C:\Windows\System\YHCnbRB.exe
  C:\Windows\System\YHCnbRB.exe
  2⤵
  PID:11044
- C:\Windows\System\WBuzlAO.exe
  C:\Windows\System\WBuzlAO.exe
  2⤵
  PID:11072
- C:\Windows\System\PGXTfzj.exe
  C:\Windows\System\PGXTfzj.exe
  2⤵
  PID:11104
- C:\Windows\System\jlcYOhi.exe
  C:\Windows\System\jlcYOhi.exe
  2⤵
  PID:11132
- C:\Windows\System\MaKptgR.exe
  C:\Windows\System\MaKptgR.exe
  2⤵
  PID:11164
- C:\Windows\System\Eyrexrk.exe
  C:\Windows\System\Eyrexrk.exe
  2⤵
  PID:11192
- C:\Windows\System\ElWHWiJ.exe
  C:\Windows\System\ElWHWiJ.exe
  2⤵
  PID:11220
- C:\Windows\System\HhTCtKg.exe
  C:\Windows\System\HhTCtKg.exe
  2⤵
  PID:11244
- C:\Windows\System\MMktnSX.exe
  C:\Windows\System\MMktnSX.exe
  2⤵
  PID:9656
- C:\Windows\System\qAKLXsv.exe
  C:\Windows\System\qAKLXsv.exe
  2⤵
  PID:9988
- C:\Windows\System\KscCwMt.exe
  C:\Windows\System\KscCwMt.exe
  2⤵
  PID:9212
- C:\Windows\System\mDiitUt.exe
  C:\Windows\System\mDiitUt.exe
  2⤵
  PID:9756
- C:\Windows\System\tXsPfuR.exe
  C:\Windows\System\tXsPfuR.exe
  2⤵
  PID:10036
- C:\Windows\System\EBBklvF.exe
  C:\Windows\System\EBBklvF.exe
  2⤵
  PID:9528
- C:\Windows\System\mqaEtJl.exe
  C:\Windows\System\mqaEtJl.exe
  2⤵
  PID:10200
- C:\Windows\System\ayeRuuV.exe
  C:\Windows\System\ayeRuuV.exe
  2⤵
  PID:8396
- C:\Windows\System\XFUrRxj.exe
  C:\Windows\System\XFUrRxj.exe
  2⤵
  PID:10244
- C:\Windows\System\HkrWKZq.exe
  C:\Windows\System\HkrWKZq.exe
  2⤵
  PID:10272
- C:\Windows\System\scamdfB.exe
  C:\Windows\System\scamdfB.exe
  2⤵
  PID:10352
- C:\Windows\System\QudjNHN.exe
  C:\Windows\System\QudjNHN.exe
  2⤵
  PID:10396
- C:\Windows\System\FlMstXJ.exe
  C:\Windows\System\FlMstXJ.exe
  2⤵
  PID:8892
- C:\Windows\System\TTnLmES.exe
  C:\Windows\System\TTnLmES.exe
  2⤵
  PID:10596
- C:\Windows\System\bPNEBth.exe
  C:\Windows\System\bPNEBth.exe
  2⤵
  PID:10304
- C:\Windows\System\jynAurL.exe
  C:\Windows\System\jynAurL.exe
  2⤵
  PID:10400
- C:\Windows\System\NEHPQFv.exe
  C:\Windows\System\NEHPQFv.exe
  2⤵
  PID:10836
- C:\Windows\System\otyKcYK.exe
  C:\Windows\System\otyKcYK.exe
  2⤵
  PID:10864
- C:\Windows\System\vBmjYAl.exe
  C:\Windows\System\vBmjYAl.exe
  2⤵
  PID:10888
- C:\Windows\System\boSXaEW.exe
  C:\Windows\System\boSXaEW.exe
  2⤵
  PID:10932
- C:\Windows\System\QEiHUME.exe
  C:\Windows\System\QEiHUME.exe
  2⤵
  PID:10544
- C:\Windows\System\kFZhxqX.exe
  C:\Windows\System\kFZhxqX.exe
  2⤵
  PID:10612
- C:\Windows\System\eqHtxFD.exe
  C:\Windows\System\eqHtxFD.exe
  2⤵
  PID:10672
- C:\Windows\System\fLyYYPk.exe
  C:\Windows\System\fLyYYPk.exe
  2⤵
  PID:10340
- C:\Windows\System\NzqVOmk.exe
  C:\Windows\System\NzqVOmk.exe
  2⤵
  PID:10480
- C:\Windows\System\JrkMmAx.exe
  C:\Windows\System\JrkMmAx.exe
  2⤵
  PID:9820
- C:\Windows\System\BorDnpT.exe
  C:\Windows\System\BorDnpT.exe
  2⤵
  PID:11272
- C:\Windows\System\QEOyrNt.exe
  C:\Windows\System\QEOyrNt.exe
  2⤵
  PID:11300
- C:\Windows\System\zXhoNao.exe
  C:\Windows\System\zXhoNao.exe
  2⤵
  PID:11336
- C:\Windows\System\XwzuexO.exe
  C:\Windows\System\XwzuexO.exe
  2⤵
  PID:11356
- C:\Windows\System\rmHUEGT.exe
  C:\Windows\System\rmHUEGT.exe
  2⤵
  PID:11392
- C:\Windows\System\ZghrbHb.exe
  C:\Windows\System\ZghrbHb.exe
  2⤵
  PID:11416
- C:\Windows\System\PNyFGsk.exe
  C:\Windows\System\PNyFGsk.exe
  2⤵
  PID:11444
- C:\Windows\System\JBhDHnQ.exe
  C:\Windows\System\JBhDHnQ.exe
  2⤵
  PID:11472
- C:\Windows\System\eRqKZzz.exe
  C:\Windows\System\eRqKZzz.exe
  2⤵
  PID:11492
- C:\Windows\System\rWiyAlR.exe
  C:\Windows\System\rWiyAlR.exe
  2⤵
  PID:11520
- C:\Windows\System\lItvgfv.exe
  C:\Windows\System\lItvgfv.exe
  2⤵
  PID:11548
- C:\Windows\System\EDMekGg.exe
  C:\Windows\System\EDMekGg.exe
  2⤵
  PID:11576
- C:\Windows\System\SUDZcJh.exe
  C:\Windows\System\SUDZcJh.exe
  2⤵
  PID:11592
- C:\Windows\System\THXrsID.exe
  C:\Windows\System\THXrsID.exe
  2⤵
  PID:11612
- C:\Windows\System\lrSfMTe.exe
  C:\Windows\System\lrSfMTe.exe
  2⤵
  PID:11636
- C:\Windows\System\zTRqEVo.exe
  C:\Windows\System\zTRqEVo.exe
  2⤵
  PID:11660
- C:\Windows\System\fGASPZL.exe
  C:\Windows\System\fGASPZL.exe
  2⤵
  PID:11688
- C:\Windows\System\eSytzqR.exe
  C:\Windows\System\eSytzqR.exe
  2⤵
  PID:11712
- C:\Windows\System\BXUKnhr.exe
  C:\Windows\System\BXUKnhr.exe
  2⤵
  PID:11732
- C:\Windows\System\rLeQIvc.exe
  C:\Windows\System\rLeQIvc.exe
  2⤵
  PID:11764
- C:\Windows\System\xAwqiTg.exe
  C:\Windows\System\xAwqiTg.exe
  2⤵
  PID:11792
- C:\Windows\System\NEVQEyp.exe
  C:\Windows\System\NEVQEyp.exe
  2⤵
  PID:11816
- C:\Windows\System\rqtolVS.exe
  C:\Windows\System\rqtolVS.exe
  2⤵
  PID:11848
- C:\Windows\System\rKGraSL.exe
  C:\Windows\System\rKGraSL.exe
  2⤵
  PID:11880
- C:\Windows\System\RtkVTlo.exe
  C:\Windows\System\RtkVTlo.exe
  2⤵
  PID:11916
- C:\Windows\System\dZsImSW.exe
  C:\Windows\System\dZsImSW.exe
  2⤵
  PID:11936
- C:\Windows\System\RqGrqDP.exe
  C:\Windows\System\RqGrqDP.exe
  2⤵
  PID:11964
- C:\Windows\System\bRZoPWp.exe
  C:\Windows\System\bRZoPWp.exe
  2⤵
  PID:11996
- C:\Windows\System\brNqyku.exe
  C:\Windows\System\brNqyku.exe
  2⤵
  PID:12024
- C:\Windows\System\CfpZwrG.exe
  C:\Windows\System\CfpZwrG.exe
  2⤵
  PID:12040
- C:\Windows\System\KSFxJvU.exe
  C:\Windows\System\KSFxJvU.exe
  2⤵
  PID:12068
- C:\Windows\System\cMvLHee.exe
  C:\Windows\System\cMvLHee.exe
  2⤵
  PID:12096
- C:\Windows\System\tkRnvvK.exe
  C:\Windows\System\tkRnvvK.exe
  2⤵
  PID:12128
- C:\Windows\System\eEsmCDg.exe
  C:\Windows\System\eEsmCDg.exe
  2⤵
  PID:12152
- C:\Windows\System\AkNzUow.exe
  C:\Windows\System\AkNzUow.exe
  2⤵
  PID:12176
- C:\Windows\System\dTWhuWl.exe
  C:\Windows\System\dTWhuWl.exe
  2⤵
  PID:12196
- C:\Windows\System\cwyvRog.exe
  C:\Windows\System\cwyvRog.exe
  2⤵
  PID:12216
- C:\Windows\System\nITWVaq.exe
  C:\Windows\System\nITWVaq.exe
  2⤵
  PID:12244
- C:\Windows\System\anTtpro.exe
  C:\Windows\System\anTtpro.exe
  2⤵
  PID:12268
- C:\Windows\System\fqQewdt.exe
  C:\Windows\System\fqQewdt.exe
  2⤵
  PID:7948
- C:\Windows\System\CxhWLbC.exe
  C:\Windows\System\CxhWLbC.exe
  2⤵
  PID:10100
- C:\Windows\System\dIOHELB.exe
  C:\Windows\System\dIOHELB.exe
  2⤵
  PID:10648
- C:\Windows\System\VgkPpjA.exe
  C:\Windows\System\VgkPpjA.exe
  2⤵
  PID:10768
- C:\Windows\System\LydgjZi.exe
  C:\Windows\System\LydgjZi.exe
  2⤵
  PID:11236
- C:\Windows\System\imUYQgo.exe
  C:\Windows\System\imUYQgo.exe
  2⤵
  PID:10144
- C:\Windows\System\oEujIEM.exe
  C:\Windows\System\oEujIEM.exe
  2⤵
  PID:10716
- C:\Windows\System\dWqejYk.exe
  C:\Windows\System\dWqejYk.exe
  2⤵
  PID:9132
- C:\Windows\System\ZbIdsyi.exe
  C:\Windows\System\ZbIdsyi.exe
  2⤵
  PID:9948
- C:\Windows\System\WVYkqVN.exe
  C:\Windows\System\WVYkqVN.exe
  2⤵
  PID:11012
- C:\Windows\System\fwWWNuw.exe
  C:\Windows\System\fwWWNuw.exe
  2⤵
  PID:10060
- C:\Windows\System\ZjqFgBI.exe
  C:\Windows\System\ZjqFgBI.exe
  2⤵
  PID:11144
- C:\Windows\System\wisnePX.exe
  C:\Windows\System\wisnePX.exe
  2⤵
  PID:11456
- C:\Windows\System\DjAapeQ.exe
  C:\Windows\System\DjAapeQ.exe
  2⤵
  PID:11488
- C:\Windows\System\WhlhZdU.exe
  C:\Windows\System\WhlhZdU.exe
  2⤵
  PID:10012
- C:\Windows\System\ypDKsWC.exe
  C:\Windows\System\ypDKsWC.exe
  2⤵
  PID:11040
- C:\Windows\System\paslutW.exe
  C:\Windows\System\paslutW.exe
  2⤵
  PID:11284
- C:\Windows\System\pWjecFq.exe
  C:\Windows\System\pWjecFq.exe
  2⤵
  PID:11364
- C:\Windows\System\dzkcmPV.exe
  C:\Windows\System\dzkcmPV.exe
  2⤵
  PID:11840
- C:\Windows\System\vfwUKLR.exe
  C:\Windows\System\vfwUKLR.exe
  2⤵
  PID:11460
- C:\Windows\System\zFxyslo.exe
  C:\Windows\System\zFxyslo.exe
  2⤵
  PID:12056
- C:\Windows\System\WLoQGPX.exe
  C:\Windows\System\WLoQGPX.exe
  2⤵
  PID:12116
- C:\Windows\System\LwrGhud.exe
  C:\Windows\System\LwrGhud.exe
  2⤵
  PID:12148
- C:\Windows\System\gYsytSU.exe
  C:\Windows\System\gYsytSU.exe
  2⤵
  PID:11280
- C:\Windows\System\lgVnHRK.exe
  C:\Windows\System\lgVnHRK.exe
  2⤵
  PID:11760
- C:\Windows\System\RaqseeF.exe
  C:\Windows\System\RaqseeF.exe
  2⤵
  PID:11808
- C:\Windows\System\aPccHDp.exe
  C:\Windows\System\aPccHDp.exe
  2⤵
  PID:11900
- C:\Windows\System\KLZODts.exe
  C:\Windows\System\KLZODts.exe
  2⤵
  PID:11152
- C:\Windows\System\NvqbNGo.exe
  C:\Windows\System\NvqbNGo.exe
  2⤵
  PID:10524
- C:\Windows\System\RsXnebA.exe
  C:\Windows\System\RsXnebA.exe
  2⤵
  PID:12304
- C:\Windows\System\FAQDcUl.exe
  C:\Windows\System\FAQDcUl.exe
  2⤵
  PID:12324
- C:\Windows\System\xwmpgPP.exe
  C:\Windows\System\xwmpgPP.exe
  2⤵
  PID:12348
- C:\Windows\System\ZUJYhOS.exe
  C:\Windows\System\ZUJYhOS.exe
  2⤵
  PID:12372
- C:\Windows\System\PkHgalk.exe
  C:\Windows\System\PkHgalk.exe
  2⤵
  PID:12400
- C:\Windows\System\TVxpJyt.exe
  C:\Windows\System\TVxpJyt.exe
  2⤵
  PID:12424
- C:\Windows\System\JJHgnWY.exe
  C:\Windows\System\JJHgnWY.exe
  2⤵
  PID:12444
- C:\Windows\System\tLZjmYU.exe
  C:\Windows\System\tLZjmYU.exe
  2⤵
  PID:12464
- C:\Windows\System\iAHFQBb.exe
  C:\Windows\System\iAHFQBb.exe
  2⤵
  PID:12488
- C:\Windows\System\bQLkMKY.exe
  C:\Windows\System\bQLkMKY.exe
  2⤵
  PID:12512
- C:\Windows\System\IujscAR.exe
  C:\Windows\System\IujscAR.exe
  2⤵
  PID:12540
- C:\Windows\System\jtefWql.exe
  C:\Windows\System\jtefWql.exe
  2⤵
  PID:12560
- C:\Windows\System\kbUgDzg.exe
  C:\Windows\System\kbUgDzg.exe
  2⤵
  PID:12592
- C:\Windows\System\sQwYHue.exe
  C:\Windows\System\sQwYHue.exe
  2⤵
  PID:12620
- C:\Windows\System\UMqaVnX.exe
  C:\Windows\System\UMqaVnX.exe
  2⤵
  PID:12656
- C:\Windows\System\ZEHCCFR.exe
  C:\Windows\System\ZEHCCFR.exe
  2⤵
  PID:12684
- C:\Windows\System\OOYnFkl.exe
  C:\Windows\System\OOYnFkl.exe
  2⤵
  PID:12708
- C:\Windows\System\ozCCZpI.exe
  C:\Windows\System\ozCCZpI.exe
  2⤵
  PID:12732
- C:\Windows\System\aSGTSuT.exe
  C:\Windows\System\aSGTSuT.exe
  2⤵
  PID:12756
- C:\Windows\System\tLjjtoy.exe
  C:\Windows\System\tLjjtoy.exe
  2⤵
  PID:12784
- C:\Windows\System\AIxqVle.exe
  C:\Windows\System\AIxqVle.exe
  2⤵
  PID:12804
- C:\Windows\System\MVWXgvl.exe
  C:\Windows\System\MVWXgvl.exe
  2⤵
  PID:12820
- C:\Windows\System\fPXyYfD.exe
  C:\Windows\System\fPXyYfD.exe
  2⤵
  PID:12848
- C:\Windows\System\FAiVyON.exe
  C:\Windows\System\FAiVyON.exe
  2⤵
  PID:12872
- C:\Windows\System\YhZGIHR.exe
  C:\Windows\System\YhZGIHR.exe
  2⤵
  PID:12896
- C:\Windows\System\YyWqDdp.exe
  C:\Windows\System\YyWqDdp.exe
  2⤵
  PID:12916
- C:\Windows\System\PZXouLz.exe
  C:\Windows\System\PZXouLz.exe
  2⤵
  PID:12936
- C:\Windows\System\Fslhfzt.exe
  C:\Windows\System\Fslhfzt.exe
  2⤵
  PID:12960
- C:\Windows\System\UmCYSli.exe
  C:\Windows\System\UmCYSli.exe
  2⤵
  PID:12992
- C:\Windows\System\PeUBhFX.exe
  C:\Windows\System\PeUBhFX.exe
  2⤵
  PID:13012
- C:\Windows\System\wYBgUTp.exe
  C:\Windows\System\wYBgUTp.exe
  2⤵
  PID:13040
- C:\Windows\System\LzfEmCo.exe
  C:\Windows\System\LzfEmCo.exe
  2⤵
  PID:13064
- C:\Windows\System\UcfISdm.exe
  C:\Windows\System\UcfISdm.exe
  2⤵
  PID:13092
- C:\Windows\System\TsYrzNH.exe
  C:\Windows\System\TsYrzNH.exe
  2⤵
  PID:13108
- C:\Windows\System\jSMNqGh.exe
  C:\Windows\System\jSMNqGh.exe
  2⤵
  PID:13132
- C:\Windows\System\nrmsClz.exe
  C:\Windows\System\nrmsClz.exe
  2⤵
  PID:13164
- C:\Windows\System\NWQUFLa.exe
  C:\Windows\System\NWQUFLa.exe
  2⤵
  PID:13184
- C:\Windows\System\hEIAPOl.exe
  C:\Windows\System\hEIAPOl.exe
  2⤵
  PID:13200
- C:\Windows\System\kmVhRvw.exe
  C:\Windows\System\kmVhRvw.exe
  2⤵
  PID:13220
- C:\Windows\System\zecxlIg.exe
  C:\Windows\System\zecxlIg.exe
  2⤵
  PID:13240
- C:\Windows\System\pLKhdFV.exe
  C:\Windows\System\pLKhdFV.exe
  2⤵
  PID:13264
- C:\Windows\System\hnWWIyq.exe
  C:\Windows\System\hnWWIyq.exe
  2⤵
  PID:13288
- C:\Windows\System\FKiMgwT.exe
  C:\Windows\System\FKiMgwT.exe
  2⤵
  PID:11568
- C:\Windows\System\ykZeBOM.exe
  C:\Windows\System\ykZeBOM.exe
  2⤵
  PID:11096
- C:\Windows\System\WtYmWgN.exe
  C:\Windows\System\WtYmWgN.exe
  2⤵
  PID:10008
- C:\Windows\System\kBpeGin.exe
  C:\Windows\System\kBpeGin.exe
  2⤵
  PID:11932
- C:\Windows\System\dnJcRHp.exe
  C:\Windows\System\dnJcRHp.exe
  2⤵
  PID:11632
- C:\Windows\System\eYlGCEY.exe
  C:\Windows\System\eYlGCEY.exe
  2⤵
  PID:10148
- C:\Windows\System\bPAfCeG.exe
  C:\Windows\System\bPAfCeG.exe
  2⤵
  PID:11960
- C:\Windows\System\tJAEfyj.exe
  C:\Windows\System\tJAEfyj.exe
  2⤵
  PID:12008
- C:\Windows\System\YEmxpgN.exe
  C:\Windows\System\YEmxpgN.exe
  2⤵
  PID:9684
- C:\Windows\System\yvvObhY.exe
  C:\Windows\System\yvvObhY.exe
  2⤵
  PID:12368
- C:\Windows\System\BPAdBss.exe
  C:\Windows\System\BPAdBss.exe
  2⤵
  PID:9612
- C:\Windows\System\pBFZQSs.exe
  C:\Windows\System\pBFZQSs.exe
  2⤵
  PID:12480
- C:\Windows\System\VQfkNlM.exe
  C:\Windows\System\VQfkNlM.exe
  2⤵
  PID:12212
- C:\Windows\System\UIXvrNm.exe
  C:\Windows\System\UIXvrNm.exe
  2⤵
  PID:12628
- C:\Windows\System\HtOpEMZ.exe
  C:\Windows\System\HtOpEMZ.exe
  2⤵
  PID:12752
- C:\Windows\System\iuwyTwZ.exe
  C:\Windows\System\iuwyTwZ.exe
  2⤵
  PID:10724
- C:\Windows\System\ZENbwYT.exe
  C:\Windows\System\ZENbwYT.exe
  2⤵
  PID:12952
- C:\Windows\System\gPodyOC.exe
  C:\Windows\System\gPodyOC.exe
  2⤵
  PID:12984
- C:\Windows\System\jrNxZpr.exe
  C:\Windows\System\jrNxZpr.exe
  2⤵
  PID:13340
- C:\Windows\System\VBIHaCe.exe
  C:\Windows\System\VBIHaCe.exe
  2⤵
  PID:13364
- C:\Windows\System\EVpFqkP.exe
  C:\Windows\System\EVpFqkP.exe
  2⤵
  PID:13388
- C:\Windows\System\gZHdfRu.exe
  C:\Windows\System\gZHdfRu.exe
  2⤵
  PID:13412
- C:\Windows\System\yrcoxAj.exe
  C:\Windows\System\yrcoxAj.exe
  2⤵
  PID:13440
- C:\Windows\System\RFnKzJU.exe
  C:\Windows\System\RFnKzJU.exe
  2⤵
  PID:13460
- C:\Windows\System\YuhRNqm.exe
  C:\Windows\System\YuhRNqm.exe
  2⤵
  PID:13484
- C:\Windows\System\lVmeoIL.exe
  C:\Windows\System\lVmeoIL.exe
  2⤵
  PID:13504
- C:\Windows\System\uDlsKTZ.exe
  C:\Windows\System\uDlsKTZ.exe
  2⤵
  PID:13532
- C:\Windows\System\AWftmsB.exe
  C:\Windows\System\AWftmsB.exe
  2⤵
  PID:13552
- C:\Windows\System\YLmbwcs.exe
  C:\Windows\System\YLmbwcs.exe
  2⤵
  PID:13572
- C:\Windows\System\oLpnoEs.exe
  C:\Windows\System\oLpnoEs.exe
  2⤵
  PID:13588
- C:\Windows\System\dqrMWMo.exe
  C:\Windows\System\dqrMWMo.exe
  2⤵
  PID:13604
- C:\Windows\System\XiAPnHo.exe
  C:\Windows\System\XiAPnHo.exe
  2⤵
  PID:13624
- C:\Windows\System\AYHsriv.exe
  C:\Windows\System\AYHsriv.exe
  2⤵
  PID:13648
- C:\Windows\System\aoQzlJZ.exe
  C:\Windows\System\aoQzlJZ.exe
  2⤵
  PID:13676
- C:\Windows\System\mfSWbnn.exe
  C:\Windows\System\mfSWbnn.exe
  2⤵
  PID:13692
- C:\Windows\System\QZwwHGr.exe
  C:\Windows\System\QZwwHGr.exe
  2⤵
  PID:13724
- C:\Windows\System\RmVUUgN.exe
  C:\Windows\System\RmVUUgN.exe
  2⤵
  PID:13744
- C:\Windows\System\grGTYgr.exe
  C:\Windows\System\grGTYgr.exe
  2⤵
  PID:13776
- C:\Windows\System\EmwOkjL.exe
  C:\Windows\System\EmwOkjL.exe
  2⤵
  PID:13800
- C:\Windows\System\XskPbgH.exe
  C:\Windows\System\XskPbgH.exe
  2⤵
  PID:13832
- C:\Windows\System\QyjyiNk.exe
  C:\Windows\System\QyjyiNk.exe
  2⤵
  PID:13864
- C:\Windows\System\ilURWyD.exe
  C:\Windows\System\ilURWyD.exe
  2⤵
  PID:13880
- C:\Windows\System\QaoDPOc.exe
  C:\Windows\System\QaoDPOc.exe
  2⤵
  PID:13900
- C:\Windows\System\oFCKIFV.exe
  C:\Windows\System\oFCKIFV.exe
  2⤵
  PID:13932
- C:\Windows\System\VYciQHa.exe
  C:\Windows\System\VYciQHa.exe
  2⤵
  PID:13952
- C:\Windows\System\MbqrJPh.exe
  C:\Windows\System\MbqrJPh.exe
  2⤵
  PID:13972
- C:\Windows\System\UstRLee.exe
  C:\Windows\System\UstRLee.exe
  2⤵
  PID:14000
- C:\Windows\System\uSDNgbW.exe
  C:\Windows\System\uSDNgbW.exe
  2⤵
  PID:11176
- C:\Windows\System\ROvrXXf.exe
  C:\Windows\System\ROvrXXf.exe
  2⤵
  PID:13104
- C:\Windows\System\yNouMXq.exe
  C:\Windows\System\yNouMXq.exe
  2⤵
  PID:13156
- C:\Windows\System\NqmltAr.exe
  C:\Windows\System\NqmltAr.exe
  2⤵
  PID:12508
- C:\Windows\System\FseHMxa.exe
  C:\Windows\System\FseHMxa.exe
  2⤵
  PID:11004
- C:\Windows\System\AIlmyQJ.exe
  C:\Windows\System\AIlmyQJ.exe
  2⤵
  PID:12720
- C:\Windows\System\MrckGnv.exe
  C:\Windows\System\MrckGnv.exe
  2⤵
  PID:11784
- C:\Windows\System\jBEUwtv.exe
  C:\Windows\System\jBEUwtv.exe
  2⤵
  PID:12360
- C:\Windows\System\vGeDeAC.exe
  C:\Windows\System\vGeDeAC.exe
  2⤵
  PID:12320
- C:\Windows\System\YMQxEqL.exe
  C:\Windows\System\YMQxEqL.exe
  2⤵
  PID:12384
- C:\Windows\System\XoJDflj.exe
  C:\Windows\System\XoJDflj.exe
  2⤵
  PID:13472
- C:\Windows\System\dyyBrdM.exe
  C:\Windows\System\dyyBrdM.exe
  2⤵
  PID:12576
- C:\Windows\System\LTtiSrl.exe
  C:\Windows\System\LTtiSrl.exe
  2⤵
  PID:13660
- C:\Windows\System\XUuVTjE.exe
  C:\Windows\System\XUuVTjE.exe
  2⤵
  PID:11676
- C:\Windows\System\FhJZysH.exe
  C:\Windows\System\FhJZysH.exe
  2⤵
  PID:10268
- C:\Windows\System\wZQFLaV.exe
  C:\Windows\System\wZQFLaV.exe
  2⤵
  PID:12084
- C:\Windows\System\PMHsNmL.exe
  C:\Windows\System\PMHsNmL.exe
  2⤵
  PID:12888
- C:\Windows\System\miZfBUy.exe
  C:\Windows\System\miZfBUy.exe
  2⤵
  PID:12980
- C:\Windows\System\bVPgWhp.exe
  C:\Windows\System\bVPgWhp.exe
  2⤵
  PID:13284
- C:\Windows\System\vZYYusW.exe
  C:\Windows\System\vZYYusW.exe
  2⤵
  PID:13644
- C:\Windows\System\XOaxlvC.exe
  C:\Windows\System\XOaxlvC.exe
  2⤵
  PID:13704
- C:\Windows\System\lYsprDB.exe
  C:\Windows\System\lYsprDB.exe
  2⤵
  PID:13740
- C:\Windows\System\elguypm.exe
  C:\Windows\System\elguypm.exe
  2⤵
  PID:13796
- C:\Windows\System\WpEdBpa.exe
  C:\Windows\System\WpEdBpa.exe
  2⤵
  PID:13916
- C:\Windows\System\HpoVxyZ.exe
  C:\Windows\System\HpoVxyZ.exe
  2⤵
  PID:14348
- C:\Windows\System\VnQcFvt.exe
  C:\Windows\System\VnQcFvt.exe
  2⤵
  PID:14368
- C:\Windows\System\bVKJosA.exe
  C:\Windows\System\bVKJosA.exe
  2⤵
  PID:14384
- C:\Windows\System\qSmoFwz.exe
  C:\Windows\System\qSmoFwz.exe
  2⤵
  PID:14416
- C:\Windows\System\ieBefLI.exe
  C:\Windows\System\ieBefLI.exe
  2⤵
  PID:14448
- C:\Windows\System\TCKldyW.exe
  C:\Windows\System\TCKldyW.exe
  2⤵
  PID:14484
- C:\Windows\System\ahoQRmF.exe
  C:\Windows\System\ahoQRmF.exe
  2⤵
  PID:14504
- C:\Windows\System\vRBAYZa.exe
  C:\Windows\System\vRBAYZa.exe
  2⤵
  PID:14532
- C:\Windows\System\eMjMiyr.exe
  C:\Windows\System\eMjMiyr.exe
  2⤵
  PID:14552
- C:\Windows\System\UEhMbbs.exe
  C:\Windows\System\UEhMbbs.exe
  2⤵
  PID:14568
- C:\Windows\System\XzPsyCp.exe
  C:\Windows\System\XzPsyCp.exe
  2⤵
  PID:14600
- C:\Windows\System\fzhmUUO.exe
  C:\Windows\System\fzhmUUO.exe
  2⤵
  PID:14624
- C:\Windows\System\HqomRKU.exe
  C:\Windows\System\HqomRKU.exe
  2⤵
  PID:14664
- C:\Windows\System\hodjDtJ.exe
  C:\Windows\System\hodjDtJ.exe
  2⤵
  PID:14760
- C:\Windows\System\aGuusJe.exe
  C:\Windows\System\aGuusJe.exe
  2⤵
  PID:14788
- C:\Windows\System\wLaaSMB.exe
  C:\Windows\System\wLaaSMB.exe
  2⤵
  PID:14812
- C:\Windows\System\YnPjfNH.exe
  C:\Windows\System\YnPjfNH.exe
  2⤵
  PID:14844
- C:\Windows\System\oEKViSG.exe
  C:\Windows\System\oEKViSG.exe
  2⤵
  PID:14868
- C:\Windows\System\grPmBBe.exe
  C:\Windows\System\grPmBBe.exe
  2⤵
  PID:14896
- C:\Windows\System\bQLLejX.exe
  C:\Windows\System\bQLLejX.exe
  2⤵
  PID:14920
- C:\Windows\System\ivvoiTW.exe
  C:\Windows\System\ivvoiTW.exe
  2⤵
  PID:14940
- C:\Windows\System\CidEGFD.exe
  C:\Windows\System\CidEGFD.exe
  2⤵
  PID:14956
- C:\Windows\System\ZBMvRQo.exe
  C:\Windows\System\ZBMvRQo.exe
  2⤵
  PID:14976
- C:\Windows\System\ItEJdeX.exe
  C:\Windows\System\ItEJdeX.exe
  2⤵
  PID:15000
- C:\Windows\System\CpRvnnW.exe
  C:\Windows\System\CpRvnnW.exe
  2⤵
  PID:15016
- C:\Windows\System\KNtdGOD.exe
  C:\Windows\System\KNtdGOD.exe
  2⤵
  PID:15036
- C:\Windows\System\NgKVJQf.exe
  C:\Windows\System\NgKVJQf.exe
  2⤵
  PID:15060
- C:\Windows\System\iqyMaUC.exe
  C:\Windows\System\iqyMaUC.exe
  2⤵
  PID:15080
- C:\Windows\System\dJjvfAZ.exe
  C:\Windows\System\dJjvfAZ.exe
  2⤵
  PID:15096
- C:\Windows\System\rVhgScD.exe
  C:\Windows\System\rVhgScD.exe
  2⤵
  PID:15128
- C:\Windows\System\keIdxMC.exe
  C:\Windows\System\keIdxMC.exe
  2⤵
  PID:15152
- C:\Windows\System\ZKNjuuB.exe
  C:\Windows\System\ZKNjuuB.exe
  2⤵
  PID:15176
- C:\Windows\System\WlKZKec.exe
  C:\Windows\System\WlKZKec.exe
  2⤵
  PID:15216
- C:\Windows\System\joJhCIj.exe
  C:\Windows\System\joJhCIj.exe
  2⤵
  PID:15236
- C:\Windows\System\CAhhpXX.exe
  C:\Windows\System\CAhhpXX.exe
  2⤵
  PID:15252
- C:\Windows\System\mLaktQj.exe
  C:\Windows\System\mLaktQj.exe
  2⤵
  PID:15288
- C:\Windows\System\iLFeBZd.exe
  C:\Windows\System\iLFeBZd.exe
  2⤵
  PID:15312
- C:\Windows\System\Lnxdtaf.exe
  C:\Windows\System\Lnxdtaf.exe
  2⤵
  PID:15332
- C:\Windows\System\NYcoXcK.exe
  C:\Windows\System\NYcoXcK.exe
  2⤵
  PID:15348
- C:\Windows\System\kIKFrcW.exe
  C:\Windows\System\kIKFrcW.exe
  2⤵
  PID:11292
- C:\Windows\System\rAWjCcp.exe
  C:\Windows\System\rAWjCcp.exe
  2⤵
  PID:11540
- C:\Windows\System\MHeyMhM.exe
  C:\Windows\System\MHeyMhM.exe
  2⤵
  PID:13196
- C:\Windows\System\DUjYXbW.exe
  C:\Windows\System\DUjYXbW.exe
  2⤵
  PID:10176
- C:\Windows\System\IOgefgI.exe
  C:\Windows\System\IOgefgI.exe
  2⤵
  PID:13332
- C:\Windows\System\VcCmfGv.exe
  C:\Windows\System\VcCmfGv.exe
  2⤵
  PID:13372
- C:\Windows\System\vROLddY.exe
  C:\Windows\System\vROLddY.exe
  2⤵
  PID:12236
- C:\Windows\System\mhDclVn.exe
  C:\Windows\System\mhDclVn.exe
  2⤵
  PID:12252
- C:\Windows\System\aIimwdy.exe
  C:\Windows\System\aIimwdy.exe
  2⤵
  PID:12836
- C:\Windows\System\qFsxTtE.exe
  C:\Windows\System\qFsxTtE.exe
  2⤵
  PID:14184
- C:\Windows\System\YtSBEXR.exe
  C:\Windows\System\YtSBEXR.exe
  2⤵
  PID:12344
- C:\Windows\System\iWhElbZ.exe
  C:\Windows\System\iWhElbZ.exe
  2⤵
  PID:13600
- C:\Windows\System\iZbqRjq.exe
  C:\Windows\System\iZbqRjq.exe
  2⤵
  PID:13668
- C:\Windows\System\CqpvsQz.exe
  C:\Windows\System\CqpvsQz.exe
  2⤵
  PID:10496
- C:\Windows\System\escvmBZ.exe
  C:\Windows\System\escvmBZ.exe
  2⤵
  PID:13892
- C:\Windows\System\srVFTxG.exe
  C:\Windows\System\srVFTxG.exe
  2⤵
  PID:14008
- C:\Windows\System\HZnjvpA.exe
  C:\Windows\System\HZnjvpA.exe
  2⤵
  PID:14144
- C:\Windows\System\oulkQiX.exe
  C:\Windows\System\oulkQiX.exe
  2⤵
  PID:12856
- C:\Windows\System\RVTWlSm.exe
  C:\Windows\System\RVTWlSm.exe
  2⤵
  PID:14252
- C:\Windows\System\gYZGmbJ.exe
  C:\Windows\System\gYZGmbJ.exe
  2⤵
  PID:14540
- C:\Windows\System\OPpyVWH.exe
  C:\Windows\System\OPpyVWH.exe
  2⤵
  PID:14376
- C:\Windows\System\LVfVFhG.exe
  C:\Windows\System\LVfVFhG.exe
  2⤵
  PID:12168
- C:\Windows\System\AREUjHv.exe
  C:\Windows\System\AREUjHv.exe
  2⤵
  PID:13720
- C:\Windows\System\XiFFBYp.exe
  C:\Windows\System\XiFFBYp.exe
  2⤵
  PID:11572
- C:\Windows\System\dMZRdvt.exe
  C:\Windows\System\dMZRdvt.exe
  2⤵
  PID:11428
- C:\Windows\System\OvNpiyx.exe
  C:\Windows\System\OvNpiyx.exe
  2⤵
  PID:13912
- C:\Windows\System\TJsjdQG.exe
  C:\Windows\System\TJsjdQG.exe
  2⤵
  PID:11972
- C:\Windows\System\LBeqArb.exe
  C:\Windows\System\LBeqArb.exe
  2⤵
  PID:14564
- C:\Windows\System\BxIAwkS.exe
  C:\Windows\System\BxIAwkS.exe
  2⤵
  PID:14772
- C:\Windows\System\tCvoFJk.exe
  C:\Windows\System\tCvoFJk.exe
  2⤵
  PID:13544
- C:\Windows\System\sumZweW.exe
  C:\Windows\System\sumZweW.exe
  2⤵
  PID:15012
- C:\Windows\System\qGEuHlk.exe
  C:\Windows\System\qGEuHlk.exe
  2⤵
  PID:14836
- C:\Windows\System\WWQCtYl.exe
  C:\Windows\System\WWQCtYl.exe
  2⤵
  PID:14884
- C:\Windows\System\cQhdsGw.exe
  C:\Windows\System\cQhdsGw.exe
  2⤵
  PID:14916
- C:\Windows\System\JWHNSMo.exe
  C:\Windows\System\JWHNSMo.exe
  2⤵
  PID:14972
- C:\Windows\System\ZcGSglW.exe
  C:\Windows\System\ZcGSglW.exe
  2⤵
  PID:13580
- C:\Windows\System\ULdXaFi.exe
  C:\Windows\System\ULdXaFi.exe
  2⤵
  PID:15148
- C:\Windows\System\ZyyEnwS.exe
  C:\Windows\System\ZyyEnwS.exe
  2⤵
  PID:14080
- C:\Windows\System\qYnXBJh.exe
  C:\Windows\System\qYnXBJh.exe
  2⤵
  PID:14408
- C:\Windows\System\kmdIdBi.exe
  C:\Windows\System\kmdIdBi.exe
  2⤵
  PID:15376
- C:\Windows\System\AQsnhjV.exe
  C:\Windows\System\AQsnhjV.exe
  2⤵
  PID:15420
- C:\Windows\System\YPgChAY.exe
  C:\Windows\System\YPgChAY.exe
  2⤵
  PID:15456
- C:\Windows\System\XIJlXon.exe
  C:\Windows\System\XIJlXon.exe
  2⤵
  PID:15480
- C:\Windows\System\AGtJMpo.exe
  C:\Windows\System\AGtJMpo.exe
  2⤵
  PID:15512
- C:\Windows\System\eMXWlcJ.exe
  C:\Windows\System\eMXWlcJ.exe
  2⤵
  PID:15540
- C:\Windows\System\DHanCXA.exe
  C:\Windows\System\DHanCXA.exe
  2⤵
  PID:15584
- C:\Windows\System\hzZAmpk.exe
  C:\Windows\System\hzZAmpk.exe
  2⤵
  PID:15620
- C:\Windows\System\XDVoOKm.exe
  C:\Windows\System\XDVoOKm.exe
  2⤵
  PID:15656
- C:\Windows\System\ClGQWXd.exe
  C:\Windows\System\ClGQWXd.exe
  2⤵
  PID:15692
- C:\Windows\System\oBDyxuG.exe
  C:\Windows\System\oBDyxuG.exe
  2⤵
  PID:15708
- C:\Windows\System\aJuWEar.exe
  C:\Windows\System\aJuWEar.exe
  2⤵
  PID:15728
- C:\Windows\System\nlVlUqE.exe
  C:\Windows\System\nlVlUqE.exe
  2⤵
  PID:15748
- C:\Windows\System\wcRGqeq.exe
  C:\Windows\System\wcRGqeq.exe
  2⤵
  PID:15780
- C:\Windows\System\BfZnuCf.exe
  C:\Windows\System\BfZnuCf.exe
  2⤵
  PID:16004
- C:\Windows\System\glyawkC.exe
  C:\Windows\System\glyawkC.exe
  2⤵
  PID:16048
- C:\Windows\System\KIdzyZJ.exe
  C:\Windows\System\KIdzyZJ.exe
  2⤵
  PID:16096
- C:\Windows\System\azaTJst.exe
  C:\Windows\System\azaTJst.exe
  2⤵
  PID:16136
- C:\Windows\System\zoIhTjA.exe
  C:\Windows\System\zoIhTjA.exe
  2⤵
  PID:16164
- C:\Windows\System\klnsCNm.exe
  C:\Windows\System\klnsCNm.exe
  2⤵
  PID:16192
- C:\Windows\System\WoPLFvp.exe
  C:\Windows\System\WoPLFvp.exe
  2⤵
  PID:16216
- C:\Windows\System\iYzenkP.exe
  C:\Windows\System\iYzenkP.exe
  2⤵
  PID:16236
- C:\Windows\System\iVzVtFW.exe
  C:\Windows\System\iVzVtFW.exe
  2⤵
  PID:16260
- C:\Windows\System\MLsixcH.exe
  C:\Windows\System\MLsixcH.exe
  2⤵
  PID:16284
- C:\Windows\System\EMlCpfb.exe
  C:\Windows\System\EMlCpfb.exe
  2⤵
  PID:16324
- C:\Windows\System\ntQvdFd.exe
  C:\Windows\System\ntQvdFd.exe
  2⤵
  PID:16360
- C:\Windows\System\bedeDgg.exe
  C:\Windows\System\bedeDgg.exe
  2⤵
  PID:16380
- C:\Windows\System\xjThEcN.exe
  C:\Windows\System\xjThEcN.exe
  2⤵
  PID:13816
- C:\Windows\System\bPrdYyh.exe
  C:\Windows\System\bPrdYyh.exe
  2⤵
  PID:15232
- C:\Windows\System\AZFnZpi.exe
  C:\Windows\System\AZFnZpi.exe
  2⤵
  PID:12668
- C:\Windows\System\bwGVNcj.exe
  C:\Windows\System\bwGVNcj.exe
  2⤵
  PID:13960
- C:\Windows\System\Wcrqmli.exe
  C:\Windows\System\Wcrqmli.exe
  2⤵
  PID:13172
- C:\Windows\System\hHEUMhz.exe
  C:\Windows\System\hHEUMhz.exe
  2⤵
  PID:14828
- C:\Windows\System\hYYOKvI.exe
  C:\Windows\System\hYYOKvI.exe
  2⤵
  PID:14356
- C:\Windows\System\lFvBCik.exe
  C:\Windows\System\lFvBCik.exe
  2⤵
  PID:13480
- C:\Windows\System\tRzplJg.exe
  C:\Windows\System\tRzplJg.exe
  2⤵
  PID:14132
- C:\Windows\System\ZNVAwVa.exe
  C:\Windows\System\ZNVAwVa.exe
  2⤵
  PID:14616
- C:\Windows\System\BHKjqfJ.exe
  C:\Windows\System\BHKjqfJ.exe
  2⤵
  PID:12460
- C:\Windows\System\DrHFuPF.exe
  C:\Windows\System\DrHFuPF.exe
  2⤵
  PID:13052
- C:\Windows\System\clmDanm.exe
  C:\Windows\System\clmDanm.exe
  2⤵
  PID:15740
- C:\Windows\System\VxMSIDR.exe
  C:\Windows\System\VxMSIDR.exe
  2⤵
  PID:15808
- C:\Windows\System\JJPPVop.exe
  C:\Windows\System\JJPPVop.exe
  2⤵
  PID:15372
- C:\Windows\System\oUnWdNM.exe
  C:\Windows\System\oUnWdNM.exe
  2⤵
  PID:15436
- C:\Windows\System\CKvJBdW.exe
  C:\Windows\System\CKvJBdW.exe
  2⤵
  PID:15488
- C:\Windows\System\ooYJfdj.exe
  C:\Windows\System\ooYJfdj.exe
  2⤵
  PID:15528
- C:\Windows\System\HhyIIAh.exe
  C:\Windows\System\HhyIIAh.exe
  2⤵
  PID:15936
- C:\Windows\System\tgKVQEr.exe
  C:\Windows\System\tgKVQEr.exe
  2⤵
  PID:15672
- C:\Windows\System\XwdxJiA.exe
  C:\Windows\System\XwdxJiA.exe
  2⤵
  PID:15024
- C:\Windows\System\CtFJkzJ.exe
  C:\Windows\System\CtFJkzJ.exe
  2⤵
  PID:14776
- C:\Windows\System\zkDMnwC.exe
  C:\Windows\System\zkDMnwC.exe
  2⤵
  PID:16176
- C:\Windows\System\bbmuYYI.exe
  C:\Windows\System\bbmuYYI.exe
  2⤵
  PID:16212
- C:\Windows\System\WqWDwJD.exe
  C:\Windows\System\WqWDwJD.exe
  2⤵
  PID:16304
- C:\Windows\System\DuuBBIJ.exe
  C:\Windows\System\DuuBBIJ.exe
  2⤵
  PID:15160
- C:\Windows\System\WvIHwiW.exe
  C:\Windows\System\WvIHwiW.exe
  2⤵
  PID:15876
- C:\Windows\System\ttodjoe.exe
  C:\Windows\System\ttodjoe.exe
  2⤵
  PID:15952
- C:\Windows\System\BKSLoiq.exe
  C:\Windows\System\BKSLoiq.exe
  2⤵
  PID:16180
- C:\Windows\System\bquHhQM.exe
  C:\Windows\System\bquHhQM.exe
  2⤵
  PID:16292
- C:\Windows\System\qYMhwrX.exe
  C:\Windows\System\qYMhwrX.exe
  2⤵
  PID:15828
- C:\Windows\System\nRNvXek.exe
  C:\Windows\System\nRNvXek.exe
  2⤵
  PID:16388
- C:\Windows\System\Wosmwly.exe
  C:\Windows\System\Wosmwly.exe
  2⤵
  PID:16416
- C:\Windows\System\EGnFPcu.exe
  C:\Windows\System\EGnFPcu.exe
  2⤵
  PID:16436
- C:\Windows\System\XZTwYiK.exe
  C:\Windows\System\XZTwYiK.exe
  2⤵
  PID:16652
- C:\Windows\System\yamPBiR.exe
  C:\Windows\System\yamPBiR.exe
  2⤵
  PID:16668
- C:\Windows\System\TNwYJFT.exe
  C:\Windows\System\TNwYJFT.exe
  2⤵
  PID:16700
- C:\Windows\System\FhxOeny.exe
  C:\Windows\System\FhxOeny.exe
  2⤵
  PID:16728
- C:\Windows\System\NWbiaZQ.exe
  C:\Windows\System\NWbiaZQ.exe
  2⤵
  PID:16772
- C:\Windows\System\ePtjcPY.exe
  C:\Windows\System\ePtjcPY.exe
  2⤵
  PID:16800
- C:\Windows\System\zogGjzJ.exe
  C:\Windows\System\zogGjzJ.exe
  2⤵
  PID:16840
- C:\Windows\System\itUaRYc.exe
  C:\Windows\System\itUaRYc.exe
  2⤵
  PID:16876
- C:\Windows\System\dAdaQXQ.exe
  C:\Windows\System\dAdaQXQ.exe
  2⤵
  PID:16916
- C:\Windows\System\EWUvmdK.exe
  C:\Windows\System\EWUvmdK.exe
  2⤵
  PID:16960
- C:\Windows\System\PECdTQU.exe
  C:\Windows\System\PECdTQU.exe
  2⤵
  PID:17268
- C:\Windows\System\HQBoCZU.exe
  C:\Windows\System\HQBoCZU.exe
  2⤵
  PID:17284
- C:\Windows\System\ACcVMbm.exe
  C:\Windows\System\ACcVMbm.exe
  2⤵
  PID:17304
- C:\Windows\System\jfdTcVB.exe
  C:\Windows\System\jfdTcVB.exe
  2⤵
  PID:17332
- C:\Windows\System\foFwakk.exe
  C:\Windows\System\foFwakk.exe
  2⤵
  PID:17356
- C:\Windows\System\dvUUfXL.exe
  C:\Windows\System\dvUUfXL.exe
  2⤵
  PID:17372
- C:\Windows\System\HBDowtK.exe
  C:\Windows\System\HBDowtK.exe
  2⤵
  PID:17396
- C:\Windows\System\NeBDhSO.exe
  C:\Windows\System\NeBDhSO.exe
  2⤵
  PID:14396
- C:\Windows\System\UHfqlKN.exe
  C:\Windows\System\UHfqlKN.exe
  2⤵
  PID:16028
- C:\Windows\System\KRtlrbR.exe
  C:\Windows\System\KRtlrbR.exe
  2⤵
  PID:14948
- C:\Windows\System\ieQMqlY.exe
  C:\Windows\System\ieQMqlY.exe
  2⤵
  PID:16188
- C:\Windows\System\BAAYmPK.exe
  C:\Windows\System\BAAYmPK.exe
  2⤵
  PID:16248
- C:\Windows\System\miHcFDN.exe
  C:\Windows\System\miHcFDN.exe
  2⤵
  PID:12932
- C:\Windows\System\ORaXvWa.exe
  C:\Windows\System\ORaXvWa.exe
  2⤵
  PID:15116

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BDroKNF.exe

Filesize
1.1MB

MD5
4f3a640f690222e6272e1404f205bc36

SHA1
35cb508ac81ccd4d64c8ba048c8189d30471c4d2

SHA256
3111cfdbce02f118c9f3f9a15a600b48540021061a83fd812e78eb8f5d72f1ff

SHA512
059819f406ea7433a8ac6e5fb1fbad096e2a4370cd852e28cc7a30d7d4177dd945b652f08d530d808f33512dd9030a8070ccc010f619570eb5d67a9f37d53cc9

Download Submit
C:\Windows\System\EJLCuhJ.exe

Filesize
1.1MB

MD5
71e242f2194b2f5ac118b9388e268954

SHA1
fcbbc332bcdc97d5419da27a7855d33a05c6ec08

SHA256
a959e4981ac74cea30ffe26063502a532a772258fea23acf10590af7d0199961

SHA512
aab0507e2bebb1a468c0baa4f5f683ac38db3b70658d3b3915f6096b7220fb03aed9e76cc1d265605ac3221d5359f4ff0d4c381f2330db55434e74235d110f5d

Download Submit
C:\Windows\System\FAwGjhN.exe

Filesize
1.1MB

MD5
0f5945b02e65056a3f554ae29d4ca7ac

SHA1
6e6c7e9e840cf3b2e8ff0822287b06219a61a1bc

SHA256
6273776f4a67e3acab94a41080d087dcf4307777a9404ac3ff198c9a7c14c98c

SHA512
ed67160b5c8909bd59006d93bf07e9b075d9cc43f7257f2840bfb47864eeb2fdf066d76a6c37ba9b399c052a4fefb5bcd20db1105760722a08b82cea3a26345f

Download Submit
C:\Windows\System\IjHNBSK.exe

Filesize
1.1MB

MD5
ffee3554649f8767b95a6d5385a0f389

SHA1
e7c3872eb059f448e0f7a22235e196eeb630230d

SHA256
51bedc3477bc22eaa42c7adcb609b7916c18f91aeceba7ea3ae755ec090b30ef

SHA512
376c00d803baa95594946b67f569b1bdacce2c2fcee592c5216c3eb2c7e3b24c8176a45d079cc7aedf1019c3d9fad24191b3df3ad83e6ab9724fa30f61f6ef8e

Download Submit
C:\Windows\System\IzMyaCb.exe

Filesize
1.1MB

MD5
d7e23c609374f5a17cc7ad98a400fa11

SHA1
96041b1a156d88d06487af68cabf9a34393b2868

SHA256
8839c1a0eeb125e2c1937eec910dce205a50d9c2b7a893b030a7041b54e6d9ca

SHA512
9c75dae8112fcb586aadaf8d10409c10c7a3f791678e9a453c9cb702dd46e7864d6524e800d3783a5bfc5b964128d3f4df7717a700bda077345fc57a30bdd034

Download Submit
C:\Windows\System\JfldZTx.exe

Filesize
1.1MB

MD5
a115cda795c9f25645934f20bb830e29

SHA1
d03085c9fbb656d06d192e68bbf9baba250b8542

SHA256
3cbeca182c185ca27363d13a260f352cb85b9a17004a2fd21711879a9db4c4a2

SHA512
aff99026c951e566277f2dae5426bbd470c6d99fed2eab7c4959e657b729df24bf4ede28f3cbe06b05302117a2ed3393224531fd1231363b0f8e66e9c5975221

Download Submit
C:\Windows\System\KsSkPzh.exe

Filesize
1.1MB

MD5
dd9243b3bc6af72f91e9496b50b287b2

SHA1
6b39aab02279c6c6b317c0bacb6b99411f10aba4

SHA256
4a2275c3c36a70854dd316e12cdbdb98c728fab3828b63e08d3f42fff54255f6

SHA512
f5797f7c11af28da1cbe4b902e36834b76af50d41dfce2aabb8a5100ad7808345a0bc9186c9f102f880b9bac2e624517d580059f44d015a605c2431487d158c7

Download Submit
C:\Windows\System\LpOvShz.exe

Filesize
1.1MB

MD5
0e56ef9e044c9bf9849f6e92cfda7474

SHA1
844f7e53842bca59e9faa341a66de111a6461e08

SHA256
909e0412ca745bdaebe9aab63bcfc2e657321663a11e91ac7d0e34928f1a098e

SHA512
6592592ab32edefd72cd6dee59bd03706a7ca375f6b82b776128da0c55f514ef361215fca6586fd94bd9cff63cee5ad6ff491f9757d8ead0aee2cb00791c0d3c

Download Submit
C:\Windows\System\SoKiCwx.exe

Filesize
1.1MB

MD5
7737c8bd35fc9a3a6a030b2bd0e60100

SHA1
28df0eb47a0568c1b87fbe416985b3586d13bb21

SHA256
307f94dc41d466477b31a4c80f146b50c610b738695d23ca695481085b7a436d

SHA512
7708598d449e743bb4669483a44a96317b35df1e2cb6db2ce82feb3d8b4371d2f92c7ba564eec92f5765b92410a8d705f3799877193f8cc0799c4e627c5271d0

Download Submit
C:\Windows\System\SvmMPfX.exe

Filesize
1.1MB

MD5
e5370770bc1bb9a0c6aa4b5132e26895

SHA1
671501b0ae175a319706022340de2d3e65e59f6c

SHA256
7b1cf68484c5154fd35404fac32ef3fbce8931c882d78e0bddead5441dcdd580

SHA512
b3f87368eb47439bad429ba09befc6bbee7b276d705f488334dc0de0f3942c039298920492c7944f2100f874d15e417fa39cae44e9222bac8199b2798af7200c

Download Submit
C:\Windows\System\UACuBnY.exe

Filesize
1.1MB

MD5
be84ad02f68dfe40368668d3d4af0e01

SHA1
22328c9c6f4a83e8fcdf96d460fd2104b12f6452

SHA256
31336c3740509290d8603abaeb57d1ddc8e3bcbf0a99ea2d3cab2b0b0e7e5b06

SHA512
e47f7d0cb9776bac2a2b7d494874f24b1a4eb08cd0fd72454fcf35f442798278896e97510eb8e4364b592602fae299139be3fe4bf2281e4e151365cfa0b2da3f

Download Submit
C:\Windows\System\Vqcnkyp.exe

Filesize
1.1MB

MD5
d6c2f1ac82daadd5d79d628fcd87aaa0

SHA1
718d20a5fc6706979a4d743c57ff6dc198794ee6

SHA256
2e41ed21cde6408f2df75bd4172cfbaaa5f3a2d705324cec459c47f6c9629811

SHA512
19f19b8c52083ca73ceebf68c28b59dd46527b5be6363068606b801182617e6d0753302bb5217dac904a8d03caf129ed043f35f8b6af158189656b3c23316157

Download Submit
C:\Windows\System\VxXmTWJ.exe

Filesize
1.1MB

MD5
fbff95fc2a42eed2786d9b5be81cb94c

SHA1
d0e2afb066669b8c4ac74681f4ea596ffdd9a438

SHA256
526d84fb085c0277a74014105ee69459b776c65c48e43d7393683e38bd7f584e

SHA512
dc3778599c0ac3a0c5f5de42dab7551eb27a255be66096068e5f2469dc3be98696bfc7c667731bcb8e1c143d5383ffb8ba6d213495b196a23d2b5fecf4b3db26

Download Submit
C:\Windows\System\WrFGcwr.exe

Filesize
1.1MB

MD5
3147ad7409fa4c2c02ad0a75b29ca1ed

SHA1
08acce65120d64e73a875d8a95a691d2910e8f10

SHA256
e55d01b8333de7762bfd120c84389fd4dd282e115bda41b6d42b65bb1af8168a

SHA512
2be2bd96f6c8e6e92f17fda2e99cc8f389ff2cc6f752e432d87cda0b7e90da3a773a9692e51834e23b486c720f4850667aa70114200a6daee346f2acd5d39a69

Download Submit
C:\Windows\System\XDqiHpW.exe

Filesize
1.1MB

MD5
b6f788e27dd9f1155a6008154d08dcb3

SHA1
54d3bfd0a4362dc446368deb3e1b9db7656d9c71

SHA256
700d4e158fbe4728574e327cf458e74d6d2aa915417ffd715408480c20d31709

SHA512
b789af032cd86a8b00d137048f18acdc45143d985562c55d91ddccc8e9f7ca913c9d45ea0f9f545cc89c13bbfb5980e51ef301fd639202313128c7c4feb91082

Download Submit
C:\Windows\System\XZHvuuZ.exe

Filesize
1.1MB

MD5
df0bcb082a2966d00c1b4ba0879d2c14

SHA1
de272d40611c58f9470ba0445102dede113a55ff

SHA256
afe211354a59037ed65cbc343f2b636258a7eec150337b816ffcfecc4f89ce2a

SHA512
21a2e2ada3031838f3d7971dcd93f8f74f9f0ff74841192bd5264bd274903b7a681ccd61805eeff9a0959ea538e1d369248852d7bae03226be1c66c40b93cf28

Download Submit
C:\Windows\System\YTtrHmz.exe

Filesize
1.1MB

MD5
e6bec332f19207bedcd74bc2b084a3d0

SHA1
9d290c8844fccdfc953a5b3b6a7e9c48e48d1e43

SHA256
52fcf26ae1961034af849b2c6846cddf4e6195d7875b4b46b48eedd6fb7390c5

SHA512
462d0ad5cf03fd445161441cd3656c4694a5325be3a2bb040cbee480b91b1b2ed3975c3b226d954adb2736a1b923ed1f1d637ef3e1bf744aabd2767b44176992

Download Submit
C:\Windows\System\ZsYvYJx.exe

Filesize
1.1MB

MD5
e4644d1e9efae0bd807ca551040f5aca

SHA1
364e70efeacbf8ebe0fbe846565723cbfb0610a8

SHA256
01b588694e0240370d800af205fed1bdea3cd29184ff56b432140eebc83aca5a

SHA512
c232dd4e2e1865c043a35450ac6ac32887995b6e546f84dd9eaa5420adae21f108f737b797e5db389e918034c156a77baf38ebee1a6724629aeea1944a522505

Download Submit
C:\Windows\System\anihUCh.exe

Filesize
1.1MB

MD5
33b2f25daf1980004d1b8fd68ea6c0d2

SHA1
4d8288960d05553152efcb46aa3ad7d6613845e2

SHA256
5082b4d8fe117fc27e76736f673c484cd2189f99b703e2eb83dcaef8d97572c1

SHA512
83a7c2c3e5f2b0d764cae2a02e40a2e49957b0a1b59b3557121befd19cfe643e58054b6ea3d5630a6bf413aeb9ef65d8086eaa4bb1581967e4dedba97ad2f09d

Download Submit
C:\Windows\System\bhPSLyF.exe

Filesize
1.1MB

MD5
dce383ee8de89973e6901710870e6255

SHA1
c87497e7a7525596e597cf805cf0d80b966ec649

SHA256
0cc6c1ddb8cd38840ef8ecc2dab0da832f1da05ed2755d18d537ade5fa6166b5

SHA512
481599d63576129ea15cf0aad3ff0c49701d25478e7c6c2ab7297d9c1f607ede21f51aacef6ddbcb7d34aa615574ebc89d9380ebb652a5b249d8137c55c740b4

Download Submit
C:\Windows\System\csWllMK.exe

Filesize
1.1MB

MD5
1f15c387aa6229b13a9ff64020a59aca

SHA1
e1563aab3760acf57ff1a221891f95743beb3744

SHA256
06e93d941c79e2d43685e28a47a77ecffee4710b7ee3c9bdf9b84319791cff68

SHA512
889b1ea19456151002aaa116ba17a7b5404a4a8b4b9d241de37b484d3a1843382c9cb7b14394fbea3e50193a2c5f6e59446a196d08e90e972d938fea68523753

Download Submit
C:\Windows\System\fxODBhd.exe

Filesize
1.1MB

MD5
5a0c0c20be8e1aa854c2fac01db0e5ea

SHA1
cbb0778fe6cd250defc3333a173e59ba13e3b2b7

SHA256
bb0c6adc0ea50054c2807093173b03aa5a8224f680956d94ece42fe94b7943ec

SHA512
6f6bfa5294f310598a6c93227f32a558b869a12fc9e28b30b9a2999c466f2ec7a61e320731f43712dff865e5471499d5ffdf2825607510e26bf3d74af3f4deac

Download Submit
C:\Windows\System\gHmtOhe.exe

Filesize
1.1MB

MD5
419978b60beb035482c313aac5cd910f

SHA1
e962ddb33eaa1a63fdc9eb0e0e8af446907a7664

SHA256
9fe90ba5003129cbda8c9750deb379eecec25fce2bda609bcdeaf937af429566

SHA512
ad197f86e6b0d581c7bd9f253014f2e999ad9825defa634a16c6639459e89a61fb7bc74e2c00331950244fd684afb47c8817b214b8b329bf4c6593f74bf4fb87

Download Submit
C:\Windows\System\hoYTmMv.exe

Filesize
1.1MB

MD5
1d1030ebb8c93a9c2504ae5b8a902a02

SHA1
638dc088016c8019239102c47bce7755bba6384d

SHA256
cc6a7b833938c3d79a48c5545272d1645867293c1c651caee679d2bc5f370b00

SHA512
7c95ba4fd970cdcf8816424525a71c89cec17b26d143156b50724d5d5022ddca9c795c04f6c58e5f6472377f0d214104e72aed41eb45be8dd0d1e23e481b8a11

Download Submit
C:\Windows\System\iDZukyd.exe

Filesize
1.1MB

MD5
68849bb8f817c8b0f3bd47c4877afd3c

SHA1
dc030245b7b9972a9aea6debf2457071ed6202d2

SHA256
73a0b58b7464304890b420c317c43ae87c3ce57786bc8fabc19bb43847bea803

SHA512
1b2b1c27f2ee831eb21d9e5db420e9dea3c546fb3501998bf74b06188ebbd84598e23df26969dbfda50b4fa895eec8678dd3294b80fd1d5ab64b0316a736e6b9

Download Submit
C:\Windows\System\inulQrR.exe

Filesize
1.1MB

MD5
1f3a1eef9b09c0438e4fd850fe8a999d

SHA1
90fb4f721e6a44dabd795724205feafe98197d26

SHA256
9937a5e97c042b49d80feee4378340fdf136c1dc5eaaf8052983df807cea42dd

SHA512
1273628adddf6a43addb1278fe78975fefbe9b4b5b5415e13fd7c3ce3b18e2c3fefa78f0d3bb2f18a84d2e2fd647aced9504dc629f0987af60f3c0b91682ac30

Download Submit
C:\Windows\System\jJgImzN.exe

Filesize
1.1MB

MD5
c14552980974e7105e8ab4738de0dc89

SHA1
6fa2516c866bfc52cce1b594a58e159128b549cd

SHA256
e592c59e3d4578d3b4b3dc47e3b4688ec049e033838704ee94e64fe14e706738

SHA512
c14cb5434617be379f19b37d1f5dedae65100c8720b5774665e1a4c6e03dc9bd99d42822dbcb0a37787dae10bd567d4cdac97be784415afd1032a3c0be4ac298

Download Submit
C:\Windows\System\jasZrqt.exe

Filesize
1.1MB

MD5
5254f5b6ea548c524f2a323f8aa49beb

SHA1
76baad5f54dc6da41b562d08467af6b0eb4196fc

SHA256
8659cda5c17c4eb8d6fa582f5acf12d991b59710cd0d7d592853c2f3b2430542

SHA512
dac9840d3ce81200da673eb191557ccf5023d5c6a69ea0137f5a959dea9cec8d379fbb16358569e623f63465f182b61e021c6263c344b1808b4a9d7b1d62da36

Download Submit
C:\Windows\System\mzHwCvZ.exe

Filesize
1.1MB

MD5
83411545f528f6e5dafb7fa1a6ed197c

SHA1
fbbd6803fdb52554a68f83e060540d4deb14fd18

SHA256
94430a2b82c2bf344df099e1c3c03e199ae419bbe671fe1edbfc67c1b3b93922

SHA512
38fc15136009148a3143cd125f29822ad5b571a3a44c3a30fcac60e1fcf509994a6c015282fd9b103c1ac94b058712be15adabe50bee1bbeea55d3eb305165de

Download Submit
C:\Windows\System\nYqXQMZ.exe

Filesize
1.1MB

MD5
6714a7104ae83d33c76e8ae8bf9911e8

SHA1
3e772d3c5796f080b27355e2e22eec0d49cfb8f5

SHA256
d309962158026e87768eed9879662799ec45db55c2ab2480abde4ddd4d671949

SHA512
20be8042f24b99c9b1e58315dd4583bfab1614cda945f8b350738a7b4812e41e2c24f976f9e844967776f38958f3e41b1d3f0724b69326639cf00e8c9ec7f51a

Download Submit
C:\Windows\System\oUhRzLQ.exe

Filesize
1.1MB

MD5
19c8380784a02f9279cf3698a75ae2bc

SHA1
fc182f835e0ff3b9d216710ea68de6bbcfc5dd02

SHA256
2bfe29046b03d912d0764a9bb7608c22f965cce1f4877c860939c176eb8a7086

SHA512
f2ef1dd103639bfe5cc0f4d3e57839ac20f0ceda9ae8b7da10c624fbd1dc724157e1d52e266bd08c12ffd31814c42e26af8d8a3a16c5545dc984bf674a6f6c66

Download Submit
C:\Windows\System\sLEKNGp.exe

Filesize
1.1MB

MD5
17432ab8fa25fcce67bb127b97354d18

SHA1
1f4a60a3da7b0e7d975a6361f1e012f302a4f0ee

SHA256
4173d78441beada56cf14f1fd217b7f9c15f7a8f8ad1b6d05a9f6ccd181e1798

SHA512
ccb34effee41551b905576ac9c9325f94c3f00f8ac59d2842b20a8dd35d23505a638fe8ba6fcfccf42fff9ca4e14404b1cc4bc5dacfa091187ddb33633bf1c22

Download Submit
C:\Windows\System\tLDBDNd.exe

Filesize
1.1MB

MD5
234d4fad8d6b0fb32a8a5b055b3314ba

SHA1
bbfd9029366b6e7eed9d6a33b8bde7d374a82568

SHA256
cef5dcbfb842ac94787ef7dfe51d7d8b74baebf64be8569ff794c06e000ef116

SHA512
1a7b3357bfb8be71be38e93318d073dcb2bf156cae4412518a77b1fc211719fbb73d776ec7f05ce324e5cf74e564b0f2211fa8f91b4a0bb4268a4a26b66bc7f3

Download Submit
C:\Windows\System\tROWBtu.exe

Filesize
1.1MB

MD5
6359c9f8a6cef84a27022ecc4b297a8b

SHA1
ba62d48bc3c08c2c7bb6c0f681b3dd3c58fa8bce

SHA256
a4fb09bafe105457f2ab647de993e25dde7d95efeea3ab0f38da1baf6c66920c

SHA512
672882c5b0561edea5aaee15d82c7b2ae6309469435896d9dad5ef2e6a8c5dfe505c8a037271e3fa8d207d17d2820173f6a57b10fa45446a657d15ab6d509320

Download Submit
C:\Windows\System\tUocQkk.exe

Filesize
1.1MB

MD5
f6f73129fd935609bb8c7a5ea576d623

SHA1
66d1902e2b625c94842dbfe89dbf82652e929fe2

SHA256
55427c14948e95995de0c413f4837a665b243ebd7c9e3d2dad9c08a03e7827d5

SHA512
d79ae181d0e1b94df2314b2ff2e5ae0085603fde336ce5cb554c389632d94612dc205cbf0a0623545feea1ed713d822a076b46ae95692f196b385bc0aa3d97c4

Download Submit
C:\Windows\System\tVSsRxv.exe

Filesize
1.1MB

MD5
3632a0f67ec5cf026b9231474afe26d3

SHA1
2da9ac1dacc145f316749fb0e510d89b78a31c79

SHA256
c970bd036aef19448d2222d5c46a255d36af4a0890a65b26f6c6314cf3e763e4

SHA512
5ef63a7c62709cf3e9eadb820c9dae136cccc96a1d508d70eacf3007fd43751f49f9adbe4eeb8083b3894d1660b5344855d87653e8dd1065c8a74cb501a0e92f

Download Submit
C:\Windows\System\wgIzuyq.exe

Filesize
1.1MB

MD5
6fbcce516b60130c8b1a7b74a78cd9ad

SHA1
82eb33075be480fa747979a7a353e4a7e374e9e7

SHA256
69b1db04d3861f049b2fc5f210a2d34f8405f781e8bf231ef1ee06c3a0587d89

SHA512
d1c3f3e485f9e77c16391b796796fc1ad20a2568b380238d3089c8ecf38ff59c1dc7e2e490cf7bddf57db0049dfbc2d919b6008ff25018daf04aa8e89666380b

Download Submit
C:\Windows\System\xAJiKYK.exe

Filesize
1.1MB

MD5
9d84eba44edadd0e2346c2ddbec54d2f

SHA1
e8f2d2959843d847f7d0f25d58dca38bebeb9369

SHA256
81f69cadd625e309dca449a9e9de6c50f87706e55ce9856e355d8dfe2712c1ca

SHA512
09681c49842808d863096d71612d7e45be234f12b1915967c9260423f94f6351642b32dcc046f5b49ef754fac9d8d4f7f4df2a4f945a1eeab641f8c512a01c82

Download Submit
C:\Windows\System\xiXrxGI.exe

Filesize
1.1MB

MD5
e7d6925a8933f85c3368bda7a20867bf

SHA1
48a3963d92059f7b61e550024c45c881bf1f1c86

SHA256
f2cbe64200c6e76f80273a31ac861dd38458b6f62a0cc077df8c5824ad1c41c2

SHA512
9a11d667301f78a78142d6ead153028ef1d1cb032b78336ee8804c9cf80d2b5d621f3b6dd73a09384369a18d92679e822ba6aecd407016fa482c50c8b35b82f7

Download Submit
C:\Windows\System\yxVuqDi.exe

Filesize
1.1MB

MD5
49e523fe24e6b8d204e9c4dc9a0f6022

SHA1
fbcc741c1e2a2bdfcebd8e8b96d35d1b1e5045a1

SHA256
80c700f41357d1f9486d94a84871be484a7089f44775daaec1641603c8e2a4bb

SHA512
34f6d341ab56988eb5c005a99e291a438b290b612d44157bdd50aef94cc49a2f64c42e3888636f9e991ed71fc1fd1a304d5295574c2840388df97c22cd480e0a

Download Submit
C:\Windows\System\zFTkIVv.exe

Filesize
1.1MB

MD5
257a1fe879d966aad6a653f1ed3a7b9f

SHA1
6dd7efb2a1881cdd389f01390bc88617640297f6

SHA256
2f9ef13a086072d3c3953d3f9203c983bac68ed053ce6291511a673d07d1908a

SHA512
e734a86e24069ed3001b88e8ed31007c1082ea9fd17cff9f195493ddaa9c7f77f2d2811a78f720451110f7084e125edf3334b5878f10c27f72ee9f4ec2af5030

Download Submit
memory/2172-0-0x0000025E2D650000-0x0000025E2D660000-memory.dmp

Filesize
64KB

Download