xmrig | 7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
Size

1.6MB
MD5

d859e6c44f1a835d44211cc6be291912
SHA1

354d1dc746b4d29cc512b2efbb4027e6b7654347
SHA256

7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd
SHA512

74ee397367a7a061b486d7cb389ce6e19aba85de98c0d5fb8dc74fc10c96872d36c2df9100c7c806dd481b633b2cde5a1261939258be1f205e93805e16373a6b
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRRvzc26c:GemTLkNdfE0pZyJ

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

Processes:

resource	yara_rule
behavioral2/files/0x000a000000023ca3-3.dat	xmrig
behavioral2/files/0x0007000000023cb1-8.dat	xmrig
behavioral2/files/0x0007000000023cb2-17.dat	xmrig
behavioral2/files/0x0007000000023cb3-28.dat	xmrig
behavioral2/files/0x0007000000023cb4-30.dat	xmrig
behavioral2/files/0x0007000000023cb0-12.dat	xmrig
behavioral2/files/0x0007000000023cb5-36.dat	xmrig
behavioral2/files/0x0007000000023cb7-44.dat	xmrig
behavioral2/files/0x0008000000023cad-41.dat	xmrig
behavioral2/files/0x0007000000023cb9-50.dat	xmrig
behavioral2/files/0x0007000000023cb8-52.dat	xmrig
behavioral2/files/0x0007000000023cbb-65.dat	xmrig
behavioral2/files/0x0007000000023cba-60.dat	xmrig
behavioral2/files/0x0007000000023cbc-69.dat	xmrig
behavioral2/files/0x0007000000023cbd-72.dat	xmrig
behavioral2/files/0x0007000000023cbe-79.dat	xmrig
behavioral2/files/0x0007000000023cbf-82.dat	xmrig
behavioral2/files/0x0007000000023cc0-88.dat	xmrig
behavioral2/files/0x0007000000023cc1-95.dat	xmrig
behavioral2/files/0x0007000000023cc2-99.dat	xmrig
behavioral2/files/0x0007000000023cc3-104.dat	xmrig
behavioral2/files/0x0007000000023cc4-105.dat	xmrig
behavioral2/files/0x0007000000023cc7-124.dat	xmrig
behavioral2/files/0x0007000000023cc6-121.dat	xmrig
behavioral2/files/0x0007000000023cc5-120.dat	xmrig
behavioral2/files/0x0007000000023cc8-129.dat	xmrig
behavioral2/files/0x0002000000022ae8-133.dat	xmrig
behavioral2/files/0x0002000000022af2-140.dat	xmrig
behavioral2/files/0x000d000000023b6c-144.dat	xmrig
behavioral2/files/0x000c000000023b71-149.dat	xmrig
behavioral2/files/0x0010000000023b77-158.dat	xmrig
behavioral2/files/0x000d000000023b75-156.dat	xmrig

Executes dropped EXE 64 IoCs

Processes:

xHHEwWB.exeujYIeiU.exeNOPJzQD.exeyIAhQld.exeOeBkkBm.exeUzLwblg.exeLcvPbvO.exesTRbSFo.exeXoSLQsW.exeSgdzMJL.exeMhPxTRH.exeiYUBDLZ.exeRmYGgYC.exeeLlfvwZ.exeZEjyJVr.exegtvmIGF.exeWbSrMNs.exeOpMoAhs.exeOfWemjC.exetLVUJDJ.exeAUOAgmG.exeDJENnLN.exebzkNzlr.exeOHoqwiJ.exeDMhSmmE.exekYVzCfw.exeTWjNVzv.exeomVqmuK.exeWDrmIyz.exeXpNedqZ.exeBFHFMQT.exeIOsURlz.exePAqVrVX.exeVOgQXhl.exeUuPROvR.exeXpaAjoc.exeKXxmXGl.exeKfxXEpd.exeXcRZCcv.exeIKAbZYN.exeIXqJKvo.exeUajXhkD.exerSbQLxj.exeQdruaQc.exeWdfjXqP.execSHdexb.exeSgMUBQL.execDkPeaJ.exeGwIEofW.exeWlxuypv.exeHicnnIT.exeetoErel.exexAKkQRX.exektOoiZf.exeFZafcDW.exefxAHUOM.exeagXdgkK.exeKhqBTKB.exeaWeZNcE.exeaYdrtCd.exetYWNcsn.exevrbAHzh.exeoxDkdtJ.exelTtvzIt.exe

pid	Process
4540	xHHEwWB.exe
1988	ujYIeiU.exe
4848	NOPJzQD.exe
2764	yIAhQld.exe
4244	OeBkkBm.exe
1056	UzLwblg.exe
1768	LcvPbvO.exe
1972	sTRbSFo.exe
1388	XoSLQsW.exe
464	SgdzMJL.exe
4316	MhPxTRH.exe
4868	iYUBDLZ.exe
2588	RmYGgYC.exe
3424	eLlfvwZ.exe
4440	ZEjyJVr.exe
2288	gtvmIGF.exe
4780	WbSrMNs.exe
680	OpMoAhs.exe
4224	OfWemjC.exe
5068	tLVUJDJ.exe
3468	AUOAgmG.exe
4544	DJENnLN.exe
1108	bzkNzlr.exe
2936	OHoqwiJ.exe
3496	DMhSmmE.exe
2432	kYVzCfw.exe
1752	TWjNVzv.exe
2016	omVqmuK.exe
4412	WDrmIyz.exe
2152	XpNedqZ.exe
64	BFHFMQT.exe
3872	IOsURlz.exe
1428	PAqVrVX.exe
2388	VOgQXhl.exe
1516	UuPROvR.exe
1536	XpaAjoc.exe
1484	KXxmXGl.exe
2008	KfxXEpd.exe
3248	XcRZCcv.exe
3240	IKAbZYN.exe
588	IXqJKvo.exe
1528	UajXhkD.exe
4324	rSbQLxj.exe
4308	QdruaQc.exe
1780	WdfjXqP.exe
1948	cSHdexb.exe
2644	SgMUBQL.exe
2484	cDkPeaJ.exe
3088	GwIEofW.exe
1452	Wlxuypv.exe
3956	HicnnIT.exe
1364	etoErel.exe
3708	xAKkQRX.exe
4372	ktOoiZf.exe
2616	FZafcDW.exe
4460	fxAHUOM.exe
1072	agXdgkK.exe
432	KhqBTKB.exe
4456	aWeZNcE.exe
4740	aYdrtCd.exe
5076	tYWNcsn.exe
4952	vrbAHzh.exe
3548	oxDkdtJ.exe
2988	lTtvzIt.exe

Drops file in Windows directory 64 IoCs

Processes:

7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe

description	ioc	Process
File created	C:\Windows\System\fgDlirg.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\zjyqstU.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\XStgoET.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\BnJsmZH.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\fyTlyaN.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\ktwWajA.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\IegTZuc.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\INRIKwb.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\cDrgFyx.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\rmfWYwl.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\jtdHJtw.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\RIVtBFm.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\RNrutEv.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\XIRnySz.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\jtWuMiA.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\YYNWbUe.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\ybeoaDt.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\tALXifT.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\yDiNErA.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\kFgVwCI.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\rqtmLld.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\daCCheM.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\tgGuHTI.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\TtdLXDH.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\YtoRYzR.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\HRtQwWQ.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\NIssNkY.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\fWJoSfP.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\lHEZImz.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\plkOsGV.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\EBPLaWn.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\apkcDRu.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\LKWEtUG.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\GrBlvtX.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\NraKTXH.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\fUIadxR.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\VkjudXN.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\cfMrUkI.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\nahMZXf.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\DeXFXeD.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\DmRmvlP.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\vmZkuKQ.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\QsvjJCX.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\rFIxeFa.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\YmkJzeW.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\oMbjJyB.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\DNOOqQQ.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\UTtnFrS.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\kiGHibf.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\IKAbZYN.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\iRJqdCI.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\VSDwgFT.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\rRgQNVT.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\UtypcUW.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\UeatqgH.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\IvwLdRp.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\omnfcnD.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\HIbPVnC.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\andLBKm.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\oxDkdtJ.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\pJCZlWN.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\rXgtkFj.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\WEkIXnI.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
File created	C:\Windows\System\RDxlZGr.exe	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

Processes:

dwm.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

dwm.exe

description	pid	Process
Token: SeCreateGlobalPrivilege	16956	dwm.exe
Token: SeChangeNotifyPrivilege	16956	dwm.exe
Token: 33	16956	dwm.exe
Token: SeIncBasePriorityPrivilege	16956	dwm.exe
Token: SeShutdownPrivilege	16956	dwm.exe
Token: SeCreatePagefilePrivilege	16956	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe

description	pid	Process	procid_target
PID 4716 wrote to memory of 4540	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	84
PID 4716 wrote to memory of 4540	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	84
PID 4716 wrote to memory of 1988	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	85
PID 4716 wrote to memory of 1988	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	85
PID 4716 wrote to memory of 4848	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	86
PID 4716 wrote to memory of 4848	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	86
PID 4716 wrote to memory of 2764	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	87
PID 4716 wrote to memory of 2764	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	87
PID 4716 wrote to memory of 4244	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	88
PID 4716 wrote to memory of 4244	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	88
PID 4716 wrote to memory of 1056	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	89
PID 4716 wrote to memory of 1056	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	89
PID 4716 wrote to memory of 1768	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	90
PID 4716 wrote to memory of 1768	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	90
PID 4716 wrote to memory of 1972	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	91
PID 4716 wrote to memory of 1972	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	91
PID 4716 wrote to memory of 1388	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	92
PID 4716 wrote to memory of 1388	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	92
PID 4716 wrote to memory of 464	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	93
PID 4716 wrote to memory of 464	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	93
PID 4716 wrote to memory of 4316	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	94
PID 4716 wrote to memory of 4316	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	94
PID 4716 wrote to memory of 4868	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	95
PID 4716 wrote to memory of 4868	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	95
PID 4716 wrote to memory of 2588	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	97
PID 4716 wrote to memory of 2588	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	97
PID 4716 wrote to memory of 3424	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	98
PID 4716 wrote to memory of 3424	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	98
PID 4716 wrote to memory of 4440	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	100
PID 4716 wrote to memory of 4440	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	100
PID 4716 wrote to memory of 2288	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	101
PID 4716 wrote to memory of 2288	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	101
PID 4716 wrote to memory of 4780	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	102
PID 4716 wrote to memory of 4780	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	102
PID 4716 wrote to memory of 680	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	103
PID 4716 wrote to memory of 680	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	103
PID 4716 wrote to memory of 4224	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	104
PID 4716 wrote to memory of 4224	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	104
PID 4716 wrote to memory of 5068	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	106
PID 4716 wrote to memory of 5068	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	106
PID 4716 wrote to memory of 3468	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	107
PID 4716 wrote to memory of 3468	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	107
PID 4716 wrote to memory of 4544	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	108
PID 4716 wrote to memory of 4544	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	108
PID 4716 wrote to memory of 1108	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	109
PID 4716 wrote to memory of 1108	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	109
PID 4716 wrote to memory of 2936	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	110
PID 4716 wrote to memory of 2936	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	110
PID 4716 wrote to memory of 3496	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	111
PID 4716 wrote to memory of 3496	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	111
PID 4716 wrote to memory of 2432	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	112
PID 4716 wrote to memory of 2432	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	112
PID 4716 wrote to memory of 1752	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	113
PID 4716 wrote to memory of 1752	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	113
PID 4716 wrote to memory of 2016	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	114
PID 4716 wrote to memory of 2016	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	114
PID 4716 wrote to memory of 4412	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	115
PID 4716 wrote to memory of 4412	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	115
PID 4716 wrote to memory of 2152	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	116
PID 4716 wrote to memory of 2152	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	116
PID 4716 wrote to memory of 64	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	117
PID 4716 wrote to memory of 64	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	117
PID 4716 wrote to memory of 3872	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	118
PID 4716 wrote to memory of 3872	4716	7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe	118

C:\Users\Admin\AppData\Local\Temp\7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe
"C:\Users\Admin\AppData\Local\Temp\7c461406a866e3e6e4ae329e7e68bdef1cff70ee081e50e9b342868bf47a5dbd.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\System\xHHEwWB.exe
  C:\Windows\System\xHHEwWB.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\ujYIeiU.exe
  C:\Windows\System\ujYIeiU.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\NOPJzQD.exe
  C:\Windows\System\NOPJzQD.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\yIAhQld.exe
  C:\Windows\System\yIAhQld.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\OeBkkBm.exe
  C:\Windows\System\OeBkkBm.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\UzLwblg.exe
  C:\Windows\System\UzLwblg.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\LcvPbvO.exe
  C:\Windows\System\LcvPbvO.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\sTRbSFo.exe
  C:\Windows\System\sTRbSFo.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\XoSLQsW.exe
  C:\Windows\System\XoSLQsW.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\SgdzMJL.exe
  C:\Windows\System\SgdzMJL.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\MhPxTRH.exe
  C:\Windows\System\MhPxTRH.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\iYUBDLZ.exe
  C:\Windows\System\iYUBDLZ.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\RmYGgYC.exe
  C:\Windows\System\RmYGgYC.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\eLlfvwZ.exe
  C:\Windows\System\eLlfvwZ.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\ZEjyJVr.exe
  C:\Windows\System\ZEjyJVr.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\gtvmIGF.exe
  C:\Windows\System\gtvmIGF.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\WbSrMNs.exe
  C:\Windows\System\WbSrMNs.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\OpMoAhs.exe
  C:\Windows\System\OpMoAhs.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\OfWemjC.exe
  C:\Windows\System\OfWemjC.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\tLVUJDJ.exe
  C:\Windows\System\tLVUJDJ.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\AUOAgmG.exe
  C:\Windows\System\AUOAgmG.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\DJENnLN.exe
  C:\Windows\System\DJENnLN.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\bzkNzlr.exe
  C:\Windows\System\bzkNzlr.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\OHoqwiJ.exe
  C:\Windows\System\OHoqwiJ.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\DMhSmmE.exe
  C:\Windows\System\DMhSmmE.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\kYVzCfw.exe
  C:\Windows\System\kYVzCfw.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\TWjNVzv.exe
  C:\Windows\System\TWjNVzv.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\omVqmuK.exe
  C:\Windows\System\omVqmuK.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\WDrmIyz.exe
  C:\Windows\System\WDrmIyz.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\XpNedqZ.exe
  C:\Windows\System\XpNedqZ.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\BFHFMQT.exe
  C:\Windows\System\BFHFMQT.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\IOsURlz.exe
  C:\Windows\System\IOsURlz.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\PAqVrVX.exe
  C:\Windows\System\PAqVrVX.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\VOgQXhl.exe
  C:\Windows\System\VOgQXhl.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\UuPROvR.exe
  C:\Windows\System\UuPROvR.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\XpaAjoc.exe
  C:\Windows\System\XpaAjoc.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\KXxmXGl.exe
  C:\Windows\System\KXxmXGl.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\KfxXEpd.exe
  C:\Windows\System\KfxXEpd.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\XcRZCcv.exe
  C:\Windows\System\XcRZCcv.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\IKAbZYN.exe
  C:\Windows\System\IKAbZYN.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\IXqJKvo.exe
  C:\Windows\System\IXqJKvo.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\UajXhkD.exe
  C:\Windows\System\UajXhkD.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\rSbQLxj.exe
  C:\Windows\System\rSbQLxj.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\QdruaQc.exe
  C:\Windows\System\QdruaQc.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\WdfjXqP.exe
  C:\Windows\System\WdfjXqP.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\cSHdexb.exe
  C:\Windows\System\cSHdexb.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\SgMUBQL.exe
  C:\Windows\System\SgMUBQL.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\cDkPeaJ.exe
  C:\Windows\System\cDkPeaJ.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\GwIEofW.exe
  C:\Windows\System\GwIEofW.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\Wlxuypv.exe
  C:\Windows\System\Wlxuypv.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\HicnnIT.exe
  C:\Windows\System\HicnnIT.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\etoErel.exe
  C:\Windows\System\etoErel.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\xAKkQRX.exe
  C:\Windows\System\xAKkQRX.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\ktOoiZf.exe
  C:\Windows\System\ktOoiZf.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\FZafcDW.exe
  C:\Windows\System\FZafcDW.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\fxAHUOM.exe
  C:\Windows\System\fxAHUOM.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\agXdgkK.exe
  C:\Windows\System\agXdgkK.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\KhqBTKB.exe
  C:\Windows\System\KhqBTKB.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\aWeZNcE.exe
  C:\Windows\System\aWeZNcE.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\aYdrtCd.exe
  C:\Windows\System\aYdrtCd.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\tYWNcsn.exe
  C:\Windows\System\tYWNcsn.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\vrbAHzh.exe
  C:\Windows\System\vrbAHzh.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\oxDkdtJ.exe
  C:\Windows\System\oxDkdtJ.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\lTtvzIt.exe
  C:\Windows\System\lTtvzIt.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\AeJQOin.exe
  C:\Windows\System\AeJQOin.exe
  2⤵
  PID:1784
- C:\Windows\System\omnfcnD.exe
  C:\Windows\System\omnfcnD.exe
  2⤵
  PID:4024
- C:\Windows\System\wkiDBNw.exe
  C:\Windows\System\wkiDBNw.exe
  2⤵
  PID:3272
- C:\Windows\System\THmGXSa.exe
  C:\Windows\System\THmGXSa.exe
  2⤵
  PID:4532
- C:\Windows\System\NEntVQK.exe
  C:\Windows\System\NEntVQK.exe
  2⤵
  PID:4256
- C:\Windows\System\HLskOqB.exe
  C:\Windows\System\HLskOqB.exe
  2⤵
  PID:3964
- C:\Windows\System\nPqVIZu.exe
  C:\Windows\System\nPqVIZu.exe
  2⤵
  PID:4628
- C:\Windows\System\ZOJYOHh.exe
  C:\Windows\System\ZOJYOHh.exe
  2⤵
  PID:4872
- C:\Windows\System\RNrutEv.exe
  C:\Windows\System\RNrutEv.exe
  2⤵
  PID:4328
- C:\Windows\System\PzgLrhH.exe
  C:\Windows\System\PzgLrhH.exe
  2⤵
  PID:116
- C:\Windows\System\dkNhSSU.exe
  C:\Windows\System\dkNhSSU.exe
  2⤵
  PID:1856
- C:\Windows\System\aWMYoNN.exe
  C:\Windows\System\aWMYoNN.exe
  2⤵
  PID:4484
- C:\Windows\System\QRAwOGN.exe
  C:\Windows\System\QRAwOGN.exe
  2⤵
  PID:3212
- C:\Windows\System\IvLvDUZ.exe
  C:\Windows\System\IvLvDUZ.exe
  2⤵
  PID:2572
- C:\Windows\System\CTzznKN.exe
  C:\Windows\System\CTzznKN.exe
  2⤵
  PID:620
- C:\Windows\System\VPhIfGI.exe
  C:\Windows\System\VPhIfGI.exe
  2⤵
  PID:624
- C:\Windows\System\ntZWAsN.exe
  C:\Windows\System\ntZWAsN.exe
  2⤵
  PID:5096
- C:\Windows\System\iebEtWq.exe
  C:\Windows\System\iebEtWq.exe
  2⤵
  PID:2568
- C:\Windows\System\ExKqyFn.exe
  C:\Windows\System\ExKqyFn.exe
  2⤵
  PID:4564
- C:\Windows\System\DuCVINX.exe
  C:\Windows\System\DuCVINX.exe
  2⤵
  PID:1052
- C:\Windows\System\obTsRnA.exe
  C:\Windows\System\obTsRnA.exe
  2⤵
  PID:4516
- C:\Windows\System\qvikUTS.exe
  C:\Windows\System\qvikUTS.exe
  2⤵
  PID:3176
- C:\Windows\System\DOOYnLZ.exe
  C:\Windows\System\DOOYnLZ.exe
  2⤵
  PID:3024
- C:\Windows\System\NIADQoN.exe
  C:\Windows\System\NIADQoN.exe
  2⤵
  PID:4052
- C:\Windows\System\ptMaNCS.exe
  C:\Windows\System\ptMaNCS.exe
  2⤵
  PID:4436
- C:\Windows\System\UmRgCLj.exe
  C:\Windows\System\UmRgCLj.exe
  2⤵
  PID:3568
- C:\Windows\System\DNOOqQQ.exe
  C:\Windows\System\DNOOqQQ.exe
  2⤵
  PID:2904
- C:\Windows\System\MMzwiAb.exe
  C:\Windows\System\MMzwiAb.exe
  2⤵
  PID:2480
- C:\Windows\System\TRXluvK.exe
  C:\Windows\System\TRXluvK.exe
  2⤵
  PID:4284
- C:\Windows\System\tlhGRdT.exe
  C:\Windows\System\tlhGRdT.exe
  2⤵
  PID:3724
- C:\Windows\System\aawRYLG.exe
  C:\Windows\System\aawRYLG.exe
  2⤵
  PID:1380
- C:\Windows\System\KdMYoUU.exe
  C:\Windows\System\KdMYoUU.exe
  2⤵
  PID:5140
- C:\Windows\System\WKFZeYS.exe
  C:\Windows\System\WKFZeYS.exe
  2⤵
  PID:5160
- C:\Windows\System\IEJlfbn.exe
  C:\Windows\System\IEJlfbn.exe
  2⤵
  PID:5188
- C:\Windows\System\oTklPsV.exe
  C:\Windows\System\oTklPsV.exe
  2⤵
  PID:5216
- C:\Windows\System\BWxdgxq.exe
  C:\Windows\System\BWxdgxq.exe
  2⤵
  PID:5252
- C:\Windows\System\EmbzJXn.exe
  C:\Windows\System\EmbzJXn.exe
  2⤵
  PID:5280
- C:\Windows\System\OhvQZhl.exe
  C:\Windows\System\OhvQZhl.exe
  2⤵
  PID:5304
- C:\Windows\System\FvnWakg.exe
  C:\Windows\System\FvnWakg.exe
  2⤵
  PID:5332
- C:\Windows\System\mIbWnDJ.exe
  C:\Windows\System\mIbWnDJ.exe
  2⤵
  PID:5360
- C:\Windows\System\UpiPWot.exe
  C:\Windows\System\UpiPWot.exe
  2⤵
  PID:5388
- C:\Windows\System\YiqfxGU.exe
  C:\Windows\System\YiqfxGU.exe
  2⤵
  PID:5416
- C:\Windows\System\nPlwvAW.exe
  C:\Windows\System\nPlwvAW.exe
  2⤵
  PID:5444
- C:\Windows\System\GkxvWsM.exe
  C:\Windows\System\GkxvWsM.exe
  2⤵
  PID:5472
- C:\Windows\System\EXhnnMe.exe
  C:\Windows\System\EXhnnMe.exe
  2⤵
  PID:5500
- C:\Windows\System\sHkEyGb.exe
  C:\Windows\System\sHkEyGb.exe
  2⤵
  PID:5528
- C:\Windows\System\HyESAsA.exe
  C:\Windows\System\HyESAsA.exe
  2⤵
  PID:5556
- C:\Windows\System\hGZQhlN.exe
  C:\Windows\System\hGZQhlN.exe
  2⤵
  PID:5584
- C:\Windows\System\tgVoqVN.exe
  C:\Windows\System\tgVoqVN.exe
  2⤵
  PID:5612
- C:\Windows\System\oqmjySU.exe
  C:\Windows\System\oqmjySU.exe
  2⤵
  PID:5640
- C:\Windows\System\McyZerE.exe
  C:\Windows\System\McyZerE.exe
  2⤵
  PID:5668
- C:\Windows\System\gCLHPrC.exe
  C:\Windows\System\gCLHPrC.exe
  2⤵
  PID:5700
- C:\Windows\System\UtPkVMq.exe
  C:\Windows\System\UtPkVMq.exe
  2⤵
  PID:5728
- C:\Windows\System\nVxNosj.exe
  C:\Windows\System\nVxNosj.exe
  2⤵
  PID:5756
- C:\Windows\System\IsmgACY.exe
  C:\Windows\System\IsmgACY.exe
  2⤵
  PID:5784
- C:\Windows\System\TheqXgX.exe
  C:\Windows\System\TheqXgX.exe
  2⤵
  PID:5804
- C:\Windows\System\mhhxvtd.exe
  C:\Windows\System\mhhxvtd.exe
  2⤵
  PID:5836
- C:\Windows\System\pAqKopu.exe
  C:\Windows\System\pAqKopu.exe
  2⤵
  PID:5864
- C:\Windows\System\mnueCbq.exe
  C:\Windows\System\mnueCbq.exe
  2⤵
  PID:5892
- C:\Windows\System\QafBtBO.exe
  C:\Windows\System\QafBtBO.exe
  2⤵
  PID:5920
- C:\Windows\System\wJkdhBw.exe
  C:\Windows\System\wJkdhBw.exe
  2⤵
  PID:5948
- C:\Windows\System\YDbzmQO.exe
  C:\Windows\System\YDbzmQO.exe
  2⤵
  PID:5972
- C:\Windows\System\pZdlLji.exe
  C:\Windows\System\pZdlLji.exe
  2⤵
  PID:5996
- C:\Windows\System\DYqLOhT.exe
  C:\Windows\System\DYqLOhT.exe
  2⤵
  PID:6024
- C:\Windows\System\vemxLUk.exe
  C:\Windows\System\vemxLUk.exe
  2⤵
  PID:6044
- C:\Windows\System\FvPKmVs.exe
  C:\Windows\System\FvPKmVs.exe
  2⤵
  PID:6076
- C:\Windows\System\WERlQuD.exe
  C:\Windows\System\WERlQuD.exe
  2⤵
  PID:6108
- C:\Windows\System\xvFYJpO.exe
  C:\Windows\System\xvFYJpO.exe
  2⤵
  PID:5128
- C:\Windows\System\DNRqXLU.exe
  C:\Windows\System\DNRqXLU.exe
  2⤵
  PID:5156
- C:\Windows\System\UTumotv.exe
  C:\Windows\System\UTumotv.exe
  2⤵
  PID:5300
- C:\Windows\System\oTzRhrv.exe
  C:\Windows\System\oTzRhrv.exe
  2⤵
  PID:5376
- C:\Windows\System\uLJRbeg.exe
  C:\Windows\System\uLJRbeg.exe
  2⤵
  PID:5432
- C:\Windows\System\DfiANPs.exe
  C:\Windows\System\DfiANPs.exe
  2⤵
  PID:5488
- C:\Windows\System\zcwHMOl.exe
  C:\Windows\System\zcwHMOl.exe
  2⤵
  PID:5576
- C:\Windows\System\JSvxPzs.exe
  C:\Windows\System\JSvxPzs.exe
  2⤵
  PID:5632
- C:\Windows\System\DtiLkOh.exe
  C:\Windows\System\DtiLkOh.exe
  2⤵
  PID:5688
- C:\Windows\System\EbgOIgX.exe
  C:\Windows\System\EbgOIgX.exe
  2⤵
  PID:5772
- C:\Windows\System\XgnADqW.exe
  C:\Windows\System\XgnADqW.exe
  2⤵
  PID:5852
- C:\Windows\System\RzIZUxw.exe
  C:\Windows\System\RzIZUxw.exe
  2⤵
  PID:6016
- C:\Windows\System\WsGVwnd.exe
  C:\Windows\System\WsGVwnd.exe
  2⤵
  PID:6040
- C:\Windows\System\SvjmTRz.exe
  C:\Windows\System\SvjmTRz.exe
  2⤵
  PID:6140
- C:\Windows\System\RyTzQLR.exe
  C:\Windows\System\RyTzQLR.exe
  2⤵
  PID:5260
- C:\Windows\System\WOXWvkb.exe
  C:\Windows\System\WOXWvkb.exe
  2⤵
  PID:5324
- C:\Windows\System\WyWJxFi.exe
  C:\Windows\System\WyWJxFi.exe
  2⤵
  PID:5540
- C:\Windows\System\zmsvKdc.exe
  C:\Windows\System\zmsvKdc.exe
  2⤵
  PID:5928
- C:\Windows\System\RJCaghs.exe
  C:\Windows\System\RJCaghs.exe
  2⤵
  PID:6104
- C:\Windows\System\INRIKwb.exe
  C:\Windows\System\INRIKwb.exe
  2⤵
  PID:5436
- C:\Windows\System\TMQgpKm.exe
  C:\Windows\System\TMQgpKm.exe
  2⤵
  PID:6160
- C:\Windows\System\dyKQssB.exe
  C:\Windows\System\dyKQssB.exe
  2⤵
  PID:6184
- C:\Windows\System\SbapYgR.exe
  C:\Windows\System\SbapYgR.exe
  2⤵
  PID:6252
- C:\Windows\System\eblLryz.exe
  C:\Windows\System\eblLryz.exe
  2⤵
  PID:6272
- C:\Windows\System\BqXEJll.exe
  C:\Windows\System\BqXEJll.exe
  2⤵
  PID:6300
- C:\Windows\System\ExLiFYK.exe
  C:\Windows\System\ExLiFYK.exe
  2⤵
  PID:6348
- C:\Windows\System\AlMMDTs.exe
  C:\Windows\System\AlMMDTs.exe
  2⤵
  PID:6380
- C:\Windows\System\zkzLftl.exe
  C:\Windows\System\zkzLftl.exe
  2⤵
  PID:6408
- C:\Windows\System\rgBUDzb.exe
  C:\Windows\System\rgBUDzb.exe
  2⤵
  PID:6432
- C:\Windows\System\WYbnBaJ.exe
  C:\Windows\System\WYbnBaJ.exe
  2⤵
  PID:6460
- C:\Windows\System\DInSsab.exe
  C:\Windows\System\DInSsab.exe
  2⤵
  PID:6488
- C:\Windows\System\YvhwUCb.exe
  C:\Windows\System\YvhwUCb.exe
  2⤵
  PID:6508
- C:\Windows\System\fxKsffd.exe
  C:\Windows\System\fxKsffd.exe
  2⤵
  PID:6544
- C:\Windows\System\exZTYFC.exe
  C:\Windows\System\exZTYFC.exe
  2⤵
  PID:6580
- C:\Windows\System\bveDMzg.exe
  C:\Windows\System\bveDMzg.exe
  2⤵
  PID:6600
- C:\Windows\System\UcaJSut.exe
  C:\Windows\System\UcaJSut.exe
  2⤵
  PID:6620
- C:\Windows\System\UBtZPaL.exe
  C:\Windows\System\UBtZPaL.exe
  2⤵
  PID:6656
- C:\Windows\System\qToACIb.exe
  C:\Windows\System\qToACIb.exe
  2⤵
  PID:6680
- C:\Windows\System\YRdKaBb.exe
  C:\Windows\System\YRdKaBb.exe
  2⤵
  PID:6704
- C:\Windows\System\PmfMoEL.exe
  C:\Windows\System\PmfMoEL.exe
  2⤵
  PID:6732
- C:\Windows\System\dvepGao.exe
  C:\Windows\System\dvepGao.exe
  2⤵
  PID:6760
- C:\Windows\System\QsvjJCX.exe
  C:\Windows\System\QsvjJCX.exe
  2⤵
  PID:6784
- C:\Windows\System\lYUwuOk.exe
  C:\Windows\System\lYUwuOk.exe
  2⤵
  PID:6808
- C:\Windows\System\OUGpzSd.exe
  C:\Windows\System\OUGpzSd.exe
  2⤵
  PID:6844
- C:\Windows\System\YgDNGIA.exe
  C:\Windows\System\YgDNGIA.exe
  2⤵
  PID:6868
- C:\Windows\System\MJAJrJV.exe
  C:\Windows\System\MJAJrJV.exe
  2⤵
  PID:6900
- C:\Windows\System\hdgwvsy.exe
  C:\Windows\System\hdgwvsy.exe
  2⤵
  PID:6944
- C:\Windows\System\XIRnySz.exe
  C:\Windows\System\XIRnySz.exe
  2⤵
  PID:6988
- C:\Windows\System\EBPLaWn.exe
  C:\Windows\System\EBPLaWn.exe
  2⤵
  PID:7016
- C:\Windows\System\XZYXfEP.exe
  C:\Windows\System\XZYXfEP.exe
  2⤵
  PID:7036
- C:\Windows\System\cxWnCxy.exe
  C:\Windows\System\cxWnCxy.exe
  2⤵
  PID:7072
- C:\Windows\System\LrRwroi.exe
  C:\Windows\System\LrRwroi.exe
  2⤵
  PID:7096
- C:\Windows\System\fMBkyeX.exe
  C:\Windows\System\fMBkyeX.exe
  2⤵
  PID:7128
- C:\Windows\System\MqWRRMX.exe
  C:\Windows\System\MqWRRMX.exe
  2⤵
  PID:7156
- C:\Windows\System\ovfuSQM.exe
  C:\Windows\System\ovfuSQM.exe
  2⤵
  PID:6180
- C:\Windows\System\kqRvBTz.exe
  C:\Windows\System\kqRvBTz.exe
  2⤵
  PID:6152
- C:\Windows\System\klCATvz.exe
  C:\Windows\System\klCATvz.exe
  2⤵
  PID:6284
- C:\Windows\System\fgDlirg.exe
  C:\Windows\System\fgDlirg.exe
  2⤵
  PID:6364
- C:\Windows\System\ZLlfQnc.exe
  C:\Windows\System\ZLlfQnc.exe
  2⤵
  PID:6420
- C:\Windows\System\HlZPnlm.exe
  C:\Windows\System\HlZPnlm.exe
  2⤵
  PID:6496
- C:\Windows\System\fUOfiOb.exe
  C:\Windows\System\fUOfiOb.exe
  2⤵
  PID:6596
- C:\Windows\System\YPoLwJe.exe
  C:\Windows\System\YPoLwJe.exe
  2⤵
  PID:6636
- C:\Windows\System\yHmFGcX.exe
  C:\Windows\System\yHmFGcX.exe
  2⤵
  PID:6664
- C:\Windows\System\rEcPwtJ.exe
  C:\Windows\System\rEcPwtJ.exe
  2⤵
  PID:6796
- C:\Windows\System\grvvmDI.exe
  C:\Windows\System\grvvmDI.exe
  2⤵
  PID:6856
- C:\Windows\System\wRjaDfh.exe
  C:\Windows\System\wRjaDfh.exe
  2⤵
  PID:6888
- C:\Windows\System\VkjudXN.exe
  C:\Windows\System\VkjudXN.exe
  2⤵
  PID:7004
- C:\Windows\System\uYGnsuU.exe
  C:\Windows\System\uYGnsuU.exe
  2⤵
  PID:7032
- C:\Windows\System\xGJmpGx.exe
  C:\Windows\System\xGJmpGx.exe
  2⤵
  PID:7144
- C:\Windows\System\DJzTAEF.exe
  C:\Windows\System\DJzTAEF.exe
  2⤵
  PID:6212
- C:\Windows\System\uIPSBzt.exe
  C:\Windows\System\uIPSBzt.exe
  2⤵
  PID:6372
- C:\Windows\System\hPVBUlK.exe
  C:\Windows\System\hPVBUlK.exe
  2⤵
  PID:6556
- C:\Windows\System\dduRIid.exe
  C:\Windows\System\dduRIid.exe
  2⤵
  PID:6668
- C:\Windows\System\afdPwLI.exe
  C:\Windows\System\afdPwLI.exe
  2⤵
  PID:6820
- C:\Windows\System\rKhLKje.exe
  C:\Windows\System\rKhLKje.exe
  2⤵
  PID:6960
- C:\Windows\System\cXfthvv.exe
  C:\Windows\System\cXfthvv.exe
  2⤵
  PID:5520
- C:\Windows\System\hPsNBwF.exe
  C:\Windows\System\hPsNBwF.exe
  2⤵
  PID:6528
- C:\Windows\System\GyckZUE.exe
  C:\Windows\System\GyckZUE.exe
  2⤵
  PID:6800
- C:\Windows\System\bhqFMFv.exe
  C:\Windows\System\bhqFMFv.exe
  2⤵
  PID:6344
- C:\Windows\System\PaEVmod.exe
  C:\Windows\System\PaEVmod.exe
  2⤵
  PID:7088
- C:\Windows\System\WLTCSch.exe
  C:\Windows\System\WLTCSch.exe
  2⤵
  PID:7184
- C:\Windows\System\UTtnFrS.exe
  C:\Windows\System\UTtnFrS.exe
  2⤵
  PID:7212
- C:\Windows\System\apkcDRu.exe
  C:\Windows\System\apkcDRu.exe
  2⤵
  PID:7240
- C:\Windows\System\esCGxjR.exe
  C:\Windows\System\esCGxjR.exe
  2⤵
  PID:7268
- C:\Windows\System\YaAcvkC.exe
  C:\Windows\System\YaAcvkC.exe
  2⤵
  PID:7296
- C:\Windows\System\BnJsmZH.exe
  C:\Windows\System\BnJsmZH.exe
  2⤵
  PID:7312
- C:\Windows\System\IbyBnpZ.exe
  C:\Windows\System\IbyBnpZ.exe
  2⤵
  PID:7340
- C:\Windows\System\EDdXuYB.exe
  C:\Windows\System\EDdXuYB.exe
  2⤵
  PID:7380
- C:\Windows\System\Tduurge.exe
  C:\Windows\System\Tduurge.exe
  2⤵
  PID:7408
- C:\Windows\System\cDrgFyx.exe
  C:\Windows\System\cDrgFyx.exe
  2⤵
  PID:7428
- C:\Windows\System\kiNDhEm.exe
  C:\Windows\System\kiNDhEm.exe
  2⤵
  PID:7464
- C:\Windows\System\CPQKVqn.exe
  C:\Windows\System\CPQKVqn.exe
  2⤵
  PID:7492
- C:\Windows\System\HRtQwWQ.exe
  C:\Windows\System\HRtQwWQ.exe
  2⤵
  PID:7520
- C:\Windows\System\vzuGvGx.exe
  C:\Windows\System\vzuGvGx.exe
  2⤵
  PID:7548
- C:\Windows\System\lMNjuJJ.exe
  C:\Windows\System\lMNjuJJ.exe
  2⤵
  PID:7576
- C:\Windows\System\TamgXxU.exe
  C:\Windows\System\TamgXxU.exe
  2⤵
  PID:7600
- C:\Windows\System\XrxQyVR.exe
  C:\Windows\System\XrxQyVR.exe
  2⤵
  PID:7620
- C:\Windows\System\GZXAAjw.exe
  C:\Windows\System\GZXAAjw.exe
  2⤵
  PID:7652
- C:\Windows\System\NTUnrsE.exe
  C:\Windows\System\NTUnrsE.exe
  2⤵
  PID:7676
- C:\Windows\System\JEwyqbW.exe
  C:\Windows\System\JEwyqbW.exe
  2⤵
  PID:7704
- C:\Windows\System\hIvnzCb.exe
  C:\Windows\System\hIvnzCb.exe
  2⤵
  PID:7732
- C:\Windows\System\AqgKIiw.exe
  C:\Windows\System\AqgKIiw.exe
  2⤵
  PID:7772
- C:\Windows\System\fqpeIwF.exe
  C:\Windows\System\fqpeIwF.exe
  2⤵
  PID:7800
- C:\Windows\System\GcSEWsW.exe
  C:\Windows\System\GcSEWsW.exe
  2⤵
  PID:7832
- C:\Windows\System\iDlaBbR.exe
  C:\Windows\System\iDlaBbR.exe
  2⤵
  PID:7860
- C:\Windows\System\sjhujBu.exe
  C:\Windows\System\sjhujBu.exe
  2⤵
  PID:7888
- C:\Windows\System\oSNloEB.exe
  C:\Windows\System\oSNloEB.exe
  2⤵
  PID:7912
- C:\Windows\System\WGfKlMO.exe
  C:\Windows\System\WGfKlMO.exe
  2⤵
  PID:7932
- C:\Windows\System\XBpOErB.exe
  C:\Windows\System\XBpOErB.exe
  2⤵
  PID:7964
- C:\Windows\System\YKFwvsV.exe
  C:\Windows\System\YKFwvsV.exe
  2⤵
  PID:7996
- C:\Windows\System\FnCsSqP.exe
  C:\Windows\System\FnCsSqP.exe
  2⤵
  PID:8016
- C:\Windows\System\pUcQjuI.exe
  C:\Windows\System\pUcQjuI.exe
  2⤵
  PID:8044
- C:\Windows\System\VkOFVNJ.exe
  C:\Windows\System\VkOFVNJ.exe
  2⤵
  PID:8060
- C:\Windows\System\YwFWTZT.exe
  C:\Windows\System\YwFWTZT.exe
  2⤵
  PID:8088
- C:\Windows\System\tbdWOFO.exe
  C:\Windows\System\tbdWOFO.exe
  2⤵
  PID:8140
- C:\Windows\System\oHRcERE.exe
  C:\Windows\System\oHRcERE.exe
  2⤵
  PID:8160
- C:\Windows\System\VOPTDxe.exe
  C:\Windows\System\VOPTDxe.exe
  2⤵
  PID:7172
- C:\Windows\System\PEEQPGh.exe
  C:\Windows\System\PEEQPGh.exe
  2⤵
  PID:7236
- C:\Windows\System\VkjKejh.exe
  C:\Windows\System\VkjKejh.exe
  2⤵
  PID:7304
- C:\Windows\System\SHQUckt.exe
  C:\Windows\System\SHQUckt.exe
  2⤵
  PID:7364
- C:\Windows\System\pUIIFQF.exe
  C:\Windows\System\pUIIFQF.exe
  2⤵
  PID:7424
- C:\Windows\System\QWJgZpp.exe
  C:\Windows\System\QWJgZpp.exe
  2⤵
  PID:7504
- C:\Windows\System\YIottlm.exe
  C:\Windows\System\YIottlm.exe
  2⤵
  PID:7564
- C:\Windows\System\vqLALdj.exe
  C:\Windows\System\vqLALdj.exe
  2⤵
  PID:7636
- C:\Windows\System\rmfWYwl.exe
  C:\Windows\System\rmfWYwl.exe
  2⤵
  PID:7688
- C:\Windows\System\Nslwclj.exe
  C:\Windows\System\Nslwclj.exe
  2⤵
  PID:7784
- C:\Windows\System\immbOot.exe
  C:\Windows\System\immbOot.exe
  2⤵
  PID:7880
- C:\Windows\System\XlrIJEE.exe
  C:\Windows\System\XlrIJEE.exe
  2⤵
  PID:7928
- C:\Windows\System\QREgakx.exe
  C:\Windows\System\QREgakx.exe
  2⤵
  PID:8004
- C:\Windows\System\kHRukcE.exe
  C:\Windows\System\kHRukcE.exe
  2⤵
  PID:7012
- C:\Windows\System\kiGHibf.exe
  C:\Windows\System\kiGHibf.exe
  2⤵
  PID:8128
- C:\Windows\System\hBzCrFq.exe
  C:\Windows\System\hBzCrFq.exe
  2⤵
  PID:7224
- C:\Windows\System\jtWuMiA.exe
  C:\Windows\System\jtWuMiA.exe
  2⤵
  PID:7404
- C:\Windows\System\ttWcyrf.exe
  C:\Windows\System\ttWcyrf.exe
  2⤵
  PID:7536
- C:\Windows\System\BzuFwVn.exe
  C:\Windows\System\BzuFwVn.exe
  2⤵
  PID:7632
- C:\Windows\System\bigEHIm.exe
  C:\Windows\System\bigEHIm.exe
  2⤵
  PID:7904
- C:\Windows\System\omMsGZm.exe
  C:\Windows\System\omMsGZm.exe
  2⤵
  PID:8028
- C:\Windows\System\DFJthCO.exe
  C:\Windows\System\DFJthCO.exe
  2⤵
  PID:7356
- C:\Windows\System\IVurUTb.exe
  C:\Windows\System\IVurUTb.exe
  2⤵
  PID:7768
- C:\Windows\System\lEdTggS.exe
  C:\Windows\System\lEdTggS.exe
  2⤵
  PID:8096
- C:\Windows\System\kRFWoGL.exe
  C:\Windows\System\kRFWoGL.exe
  2⤵
  PID:7592
- C:\Windows\System\PxOITDu.exe
  C:\Windows\System\PxOITDu.exe
  2⤵
  PID:7328
- C:\Windows\System\BGGnFfr.exe
  C:\Windows\System\BGGnFfr.exe
  2⤵
  PID:8220
- C:\Windows\System\jVGcZgG.exe
  C:\Windows\System\jVGcZgG.exe
  2⤵
  PID:8252
- C:\Windows\System\UsDQaZR.exe
  C:\Windows\System\UsDQaZR.exe
  2⤵
  PID:8268
- C:\Windows\System\hvelNqK.exe
  C:\Windows\System\hvelNqK.exe
  2⤵
  PID:8304
- C:\Windows\System\YwRFpEk.exe
  C:\Windows\System\YwRFpEk.exe
  2⤵
  PID:8336
- C:\Windows\System\udOWaiz.exe
  C:\Windows\System\udOWaiz.exe
  2⤵
  PID:8360
- C:\Windows\System\IXFsPgT.exe
  C:\Windows\System\IXFsPgT.exe
  2⤵
  PID:8384
- C:\Windows\System\eNrNzkt.exe
  C:\Windows\System\eNrNzkt.exe
  2⤵
  PID:8420
- C:\Windows\System\dFvxDPm.exe
  C:\Windows\System\dFvxDPm.exe
  2⤵
  PID:8444
- C:\Windows\System\FygYuTh.exe
  C:\Windows\System\FygYuTh.exe
  2⤵
  PID:8468
- C:\Windows\System\mdHqgqM.exe
  C:\Windows\System\mdHqgqM.exe
  2⤵
  PID:8492
- C:\Windows\System\rFIxeFa.exe
  C:\Windows\System\rFIxeFa.exe
  2⤵
  PID:8528
- C:\Windows\System\ZjQgiXr.exe
  C:\Windows\System\ZjQgiXr.exe
  2⤵
  PID:8560
- C:\Windows\System\uqzgype.exe
  C:\Windows\System\uqzgype.exe
  2⤵
  PID:8588
- C:\Windows\System\zIuryKH.exe
  C:\Windows\System\zIuryKH.exe
  2⤵
  PID:8616
- C:\Windows\System\SCkvRVV.exe
  C:\Windows\System\SCkvRVV.exe
  2⤵
  PID:8644
- C:\Windows\System\XqCTqQu.exe
  C:\Windows\System\XqCTqQu.exe
  2⤵
  PID:8672
- C:\Windows\System\gbfPLQz.exe
  C:\Windows\System\gbfPLQz.exe
  2⤵
  PID:8700
- C:\Windows\System\zjyqstU.exe
  C:\Windows\System\zjyqstU.exe
  2⤵
  PID:8728
- C:\Windows\System\yVOzNKk.exe
  C:\Windows\System\yVOzNKk.exe
  2⤵
  PID:8756
- C:\Windows\System\FScZhsE.exe
  C:\Windows\System\FScZhsE.exe
  2⤵
  PID:8784
- C:\Windows\System\vSVIsbX.exe
  C:\Windows\System\vSVIsbX.exe
  2⤵
  PID:8812
- C:\Windows\System\pJCZlWN.exe
  C:\Windows\System\pJCZlWN.exe
  2⤵
  PID:8840
- C:\Windows\System\YtWtCjm.exe
  C:\Windows\System\YtWtCjm.exe
  2⤵
  PID:8868
- C:\Windows\System\giEInss.exe
  C:\Windows\System\giEInss.exe
  2⤵
  PID:8896
- C:\Windows\System\odMDRtP.exe
  C:\Windows\System\odMDRtP.exe
  2⤵
  PID:8924
- C:\Windows\System\DwzjzXF.exe
  C:\Windows\System\DwzjzXF.exe
  2⤵
  PID:8956
- C:\Windows\System\PFEVvRD.exe
  C:\Windows\System\PFEVvRD.exe
  2⤵
  PID:8976
- C:\Windows\System\DBwhtZl.exe
  C:\Windows\System\DBwhtZl.exe
  2⤵
  PID:9000
- C:\Windows\System\ftGdewD.exe
  C:\Windows\System\ftGdewD.exe
  2⤵
  PID:9036
- C:\Windows\System\lAeyHsD.exe
  C:\Windows\System\lAeyHsD.exe
  2⤵
  PID:9056
- C:\Windows\System\avRMqZs.exe
  C:\Windows\System\avRMqZs.exe
  2⤵
  PID:9088
- C:\Windows\System\YkXwJJy.exe
  C:\Windows\System\YkXwJJy.exe
  2⤵
  PID:9112
- C:\Windows\System\jtMNdmX.exe
  C:\Windows\System\jtMNdmX.exe
  2⤵
  PID:9152
- C:\Windows\System\nPyEaVS.exe
  C:\Windows\System\nPyEaVS.exe
  2⤵
  PID:9180
- C:\Windows\System\MRHVDyo.exe
  C:\Windows\System\MRHVDyo.exe
  2⤵
  PID:9208
- C:\Windows\System\LJnIajW.exe
  C:\Windows\System\LJnIajW.exe
  2⤵
  PID:8212
- C:\Windows\System\yMEXRNj.exe
  C:\Windows\System\yMEXRNj.exe
  2⤵
  PID:8292
- C:\Windows\System\LKWEtUG.exe
  C:\Windows\System\LKWEtUG.exe
  2⤵
  PID:8328
- C:\Windows\System\TLdoTXc.exe
  C:\Windows\System\TLdoTXc.exe
  2⤵
  PID:8404
- C:\Windows\System\GfMGGco.exe
  C:\Windows\System\GfMGGco.exe
  2⤵
  PID:8476
- C:\Windows\System\yIIsMpG.exe
  C:\Windows\System\yIIsMpG.exe
  2⤵
  PID:8520
- C:\Windows\System\HIbPVnC.exe
  C:\Windows\System\HIbPVnC.exe
  2⤵
  PID:8580
- C:\Windows\System\hDwLtYp.exe
  C:\Windows\System\hDwLtYp.exe
  2⤵
  PID:8656
- C:\Windows\System\QqehKBb.exe
  C:\Windows\System\QqehKBb.exe
  2⤵
  PID:8720
- C:\Windows\System\DjzuBzU.exe
  C:\Windows\System\DjzuBzU.exe
  2⤵
  PID:8772
- C:\Windows\System\OboVOSl.exe
  C:\Windows\System\OboVOSl.exe
  2⤵
  PID:8828
- C:\Windows\System\gCcCuXN.exe
  C:\Windows\System\gCcCuXN.exe
  2⤵
  PID:8892
- C:\Windows\System\QPeZwkc.exe
  C:\Windows\System\QPeZwkc.exe
  2⤵
  PID:8972
- C:\Windows\System\OiKIDzy.exe
  C:\Windows\System\OiKIDzy.exe
  2⤵
  PID:9020
- C:\Windows\System\hSCzuXu.exe
  C:\Windows\System\hSCzuXu.exe
  2⤵
  PID:9100
- C:\Windows\System\HrwmVxt.exe
  C:\Windows\System\HrwmVxt.exe
  2⤵
  PID:8260
- C:\Windows\System\QQHhRbd.exe
  C:\Windows\System\QQHhRbd.exe
  2⤵
  PID:8236
- C:\Windows\System\VzeXNWz.exe
  C:\Windows\System\VzeXNWz.exe
  2⤵
  PID:8380
- C:\Windows\System\lGfZMat.exe
  C:\Windows\System\lGfZMat.exe
  2⤵
  PID:8516
- C:\Windows\System\jgkWciA.exe
  C:\Windows\System\jgkWciA.exe
  2⤵
  PID:8744
- C:\Windows\System\CkSszPD.exe
  C:\Windows\System\CkSszPD.exe
  2⤵
  PID:8864
- C:\Windows\System\sIeHSoN.exe
  C:\Windows\System\sIeHSoN.exe
  2⤵
  PID:9012
- C:\Windows\System\gDxVwlv.exe
  C:\Windows\System\gDxVwlv.exe
  2⤵
  PID:9200
- C:\Windows\System\jrWtYim.exe
  C:\Windows\System\jrWtYim.exe
  2⤵
  PID:8488
- C:\Windows\System\WokRBRg.exe
  C:\Windows\System\WokRBRg.exe
  2⤵
  PID:8740
- C:\Windows\System\GOBaaHx.exe
  C:\Windows\System\GOBaaHx.exe
  2⤵
  PID:9168
- C:\Windows\System\FafOvRa.exe
  C:\Windows\System\FafOvRa.exe
  2⤵
  PID:8940
- C:\Windows\System\hVCZzgA.exe
  C:\Windows\System\hVCZzgA.exe
  2⤵
  PID:9224
- C:\Windows\System\FqGVPTR.exe
  C:\Windows\System\FqGVPTR.exe
  2⤵
  PID:9240
- C:\Windows\System\aebjyFQ.exe
  C:\Windows\System\aebjyFQ.exe
  2⤵
  PID:9268
- C:\Windows\System\OWBAlZM.exe
  C:\Windows\System\OWBAlZM.exe
  2⤵
  PID:9308
- C:\Windows\System\BRzISpd.exe
  C:\Windows\System\BRzISpd.exe
  2⤵
  PID:9336
- C:\Windows\System\jFzvKuu.exe
  C:\Windows\System\jFzvKuu.exe
  2⤵
  PID:9360
- C:\Windows\System\mGozHCa.exe
  C:\Windows\System\mGozHCa.exe
  2⤵
  PID:9392
- C:\Windows\System\HHekfXr.exe
  C:\Windows\System\HHekfXr.exe
  2⤵
  PID:9420
- C:\Windows\System\RgjMjOI.exe
  C:\Windows\System\RgjMjOI.exe
  2⤵
  PID:9448
- C:\Windows\System\CaXUwpK.exe
  C:\Windows\System\CaXUwpK.exe
  2⤵
  PID:9480
- C:\Windows\System\lgLQzDq.exe
  C:\Windows\System\lgLQzDq.exe
  2⤵
  PID:9508
- C:\Windows\System\SxGvpbh.exe
  C:\Windows\System\SxGvpbh.exe
  2⤵
  PID:9536
- C:\Windows\System\RplWlwx.exe
  C:\Windows\System\RplWlwx.exe
  2⤵
  PID:9564
- C:\Windows\System\kJdPutt.exe
  C:\Windows\System\kJdPutt.exe
  2⤵
  PID:9592
- C:\Windows\System\atoWqbW.exe
  C:\Windows\System\atoWqbW.exe
  2⤵
  PID:9620
- C:\Windows\System\FbHWdjo.exe
  C:\Windows\System\FbHWdjo.exe
  2⤵
  PID:9648
- C:\Windows\System\JnQqRCF.exe
  C:\Windows\System\JnQqRCF.exe
  2⤵
  PID:9676
- C:\Windows\System\XGICKVw.exe
  C:\Windows\System\XGICKVw.exe
  2⤵
  PID:9704
- C:\Windows\System\ZzZdfgD.exe
  C:\Windows\System\ZzZdfgD.exe
  2⤵
  PID:9728
- C:\Windows\System\BnqmdMX.exe
  C:\Windows\System\BnqmdMX.exe
  2⤵
  PID:9760
- C:\Windows\System\dDoLElS.exe
  C:\Windows\System\dDoLElS.exe
  2⤵
  PID:9776
- C:\Windows\System\drKsCTQ.exe
  C:\Windows\System\drKsCTQ.exe
  2⤵
  PID:9816
- C:\Windows\System\RQzPZFR.exe
  C:\Windows\System\RQzPZFR.exe
  2⤵
  PID:9844
- C:\Windows\System\EeojMbl.exe
  C:\Windows\System\EeojMbl.exe
  2⤵
  PID:9872
- C:\Windows\System\RFLmTnj.exe
  C:\Windows\System\RFLmTnj.exe
  2⤵
  PID:9900
- C:\Windows\System\dtEHgJJ.exe
  C:\Windows\System\dtEHgJJ.exe
  2⤵
  PID:9928
- C:\Windows\System\toLmubr.exe
  C:\Windows\System\toLmubr.exe
  2⤵
  PID:9948
- C:\Windows\System\ixuvQNG.exe
  C:\Windows\System\ixuvQNG.exe
  2⤵
  PID:9976
- C:\Windows\System\JGPQUBz.exe
  C:\Windows\System\JGPQUBz.exe
  2⤵
  PID:10012
- C:\Windows\System\sgOyeYu.exe
  C:\Windows\System\sgOyeYu.exe
  2⤵
  PID:10040
- C:\Windows\System\FFiJGaU.exe
  C:\Windows\System\FFiJGaU.exe
  2⤵
  PID:10060
- C:\Windows\System\DSkVEpY.exe
  C:\Windows\System\DSkVEpY.exe
  2⤵
  PID:10096
- C:\Windows\System\FeSbgaA.exe
  C:\Windows\System\FeSbgaA.exe
  2⤵
  PID:10124
- C:\Windows\System\ujpTmtL.exe
  C:\Windows\System\ujpTmtL.exe
  2⤵
  PID:10144
- C:\Windows\System\sKfBAfs.exe
  C:\Windows\System\sKfBAfs.exe
  2⤵
  PID:10180
- C:\Windows\System\GrBlvtX.exe
  C:\Windows\System\GrBlvtX.exe
  2⤵
  PID:10208
- C:\Windows\System\QcgXBnI.exe
  C:\Windows\System\QcgXBnI.exe
  2⤵
  PID:10236
- C:\Windows\System\bYmvhBr.exe
  C:\Windows\System\bYmvhBr.exe
  2⤵
  PID:9300
- C:\Windows\System\BZVTGfx.exe
  C:\Windows\System\BZVTGfx.exe
  2⤵
  PID:9384
- C:\Windows\System\kBUuQhx.exe
  C:\Windows\System\kBUuQhx.exe
  2⤵
  PID:9444
- C:\Windows\System\YmkJzeW.exe
  C:\Windows\System\YmkJzeW.exe
  2⤵
  PID:9524
- C:\Windows\System\xCVlMYN.exe
  C:\Windows\System\xCVlMYN.exe
  2⤵
  PID:9576
- C:\Windows\System\qvPDqHZ.exe
  C:\Windows\System\qvPDqHZ.exe
  2⤵
  PID:9660
- C:\Windows\System\mpNaBhM.exe
  C:\Windows\System\mpNaBhM.exe
  2⤵
  PID:9724
- C:\Windows\System\UeatqgH.exe
  C:\Windows\System\UeatqgH.exe
  2⤵
  PID:9768
- C:\Windows\System\lteeJpJ.exe
  C:\Windows\System\lteeJpJ.exe
  2⤵
  PID:9892
- C:\Windows\System\QRhBjAC.exe
  C:\Windows\System\QRhBjAC.exe
  2⤵
  PID:9944
- C:\Windows\System\wzxUOtY.exe
  C:\Windows\System\wzxUOtY.exe
  2⤵
  PID:9996
- C:\Windows\System\AptxkAH.exe
  C:\Windows\System\AptxkAH.exe
  2⤵
  PID:10056
- C:\Windows\System\uHiDPgF.exe
  C:\Windows\System\uHiDPgF.exe
  2⤵
  PID:10120
- C:\Windows\System\FJGVbDe.exe
  C:\Windows\System\FJGVbDe.exe
  2⤵
  PID:9496
- C:\Windows\System\MVeLoqj.exe
  C:\Windows\System\MVeLoqj.exe
  2⤵
  PID:9688
- C:\Windows\System\yDiNErA.exe
  C:\Windows\System\yDiNErA.exe
  2⤵
  PID:9840
- C:\Windows\System\gbmqMwX.exe
  C:\Windows\System\gbmqMwX.exe
  2⤵
  PID:10088
- C:\Windows\System\LhvRWiQ.exe
  C:\Windows\System\LhvRWiQ.exe
  2⤵
  PID:9284
- C:\Windows\System\BpDdpUZ.exe
  C:\Windows\System\BpDdpUZ.exe
  2⤵
  PID:9812
- C:\Windows\System\uxjKEiy.exe
  C:\Windows\System\uxjKEiy.exe
  2⤵
  PID:10244
- C:\Windows\System\eIWqkOO.exe
  C:\Windows\System\eIWqkOO.exe
  2⤵
  PID:10260
- C:\Windows\System\JZNGHAh.exe
  C:\Windows\System\JZNGHAh.exe
  2⤵
  PID:10292
- C:\Windows\System\dUzHUdX.exe
  C:\Windows\System\dUzHUdX.exe
  2⤵
  PID:10312
- C:\Windows\System\DTaOXXh.exe
  C:\Windows\System\DTaOXXh.exe
  2⤵
  PID:10340
- C:\Windows\System\NvllZiB.exe
  C:\Windows\System\NvllZiB.exe
  2⤵
  PID:10360
- C:\Windows\System\VsjvUBo.exe
  C:\Windows\System\VsjvUBo.exe
  2⤵
  PID:10412
- C:\Windows\System\SVpNAgQ.exe
  C:\Windows\System\SVpNAgQ.exe
  2⤵
  PID:10448
- C:\Windows\System\FeFgvze.exe
  C:\Windows\System\FeFgvze.exe
  2⤵
  PID:10468
- C:\Windows\System\RwqnCXZ.exe
  C:\Windows\System\RwqnCXZ.exe
  2⤵
  PID:10508
- C:\Windows\System\MhodHKQ.exe
  C:\Windows\System\MhodHKQ.exe
  2⤵
  PID:10532
- C:\Windows\System\OocisUz.exe
  C:\Windows\System\OocisUz.exe
  2⤵
  PID:10560
- C:\Windows\System\ZKxKApJ.exe
  C:\Windows\System\ZKxKApJ.exe
  2⤵
  PID:10588
- C:\Windows\System\LaIfyLY.exe
  C:\Windows\System\LaIfyLY.exe
  2⤵
  PID:10608
- C:\Windows\System\AbIOqKk.exe
  C:\Windows\System\AbIOqKk.exe
  2⤵
  PID:10640
- C:\Windows\System\mRObtQR.exe
  C:\Windows\System\mRObtQR.exe
  2⤵
  PID:10672
- C:\Windows\System\gYBsfvj.exe
  C:\Windows\System\gYBsfvj.exe
  2⤵
  PID:10700
- C:\Windows\System\FywcyBc.exe
  C:\Windows\System\FywcyBc.exe
  2⤵
  PID:10728
- C:\Windows\System\xwjPdvW.exe
  C:\Windows\System\xwjPdvW.exe
  2⤵
  PID:10756
- C:\Windows\System\cWaVsmP.exe
  C:\Windows\System\cWaVsmP.exe
  2⤵
  PID:10780
- C:\Windows\System\yPBCsgC.exe
  C:\Windows\System\yPBCsgC.exe
  2⤵
  PID:10812
- C:\Windows\System\vQcDVhX.exe
  C:\Windows\System\vQcDVhX.exe
  2⤵
  PID:10828
- C:\Windows\System\xejrxzZ.exe
  C:\Windows\System\xejrxzZ.exe
  2⤵
  PID:10864
- C:\Windows\System\TXUotEI.exe
  C:\Windows\System\TXUotEI.exe
  2⤵
  PID:10892
- C:\Windows\System\eICCMXp.exe
  C:\Windows\System\eICCMXp.exe
  2⤵
  PID:10928
- C:\Windows\System\GleGEmU.exe
  C:\Windows\System\GleGEmU.exe
  2⤵
  PID:10952
- C:\Windows\System\tNmrJRG.exe
  C:\Windows\System\tNmrJRG.exe
  2⤵
  PID:10976
- C:\Windows\System\AknbNZT.exe
  C:\Windows\System\AknbNZT.exe
  2⤵
  PID:11000
- C:\Windows\System\rLyWnSm.exe
  C:\Windows\System\rLyWnSm.exe
  2⤵
  PID:11024
- C:\Windows\System\usSiusV.exe
  C:\Windows\System\usSiusV.exe
  2⤵
  PID:11056
- C:\Windows\System\tXrZSeW.exe
  C:\Windows\System\tXrZSeW.exe
  2⤵
  PID:11076
- C:\Windows\System\qlTQodg.exe
  C:\Windows\System\qlTQodg.exe
  2⤵
  PID:11112
- C:\Windows\System\nuRdTtx.exe
  C:\Windows\System\nuRdTtx.exe
  2⤵
  PID:11140
- C:\Windows\System\xyAhRWZ.exe
  C:\Windows\System\xyAhRWZ.exe
  2⤵
  PID:11164
- C:\Windows\System\tWZUrtQ.exe
  C:\Windows\System\tWZUrtQ.exe
  2⤵
  PID:11188
- C:\Windows\System\ybvosWf.exe
  C:\Windows\System\ybvosWf.exe
  2⤵
  PID:11208
- C:\Windows\System\iRJqdCI.exe
  C:\Windows\System\iRJqdCI.exe
  2⤵
  PID:11248
- C:\Windows\System\qohceaT.exe
  C:\Windows\System\qohceaT.exe
  2⤵
  PID:9792
- C:\Windows\System\BihLRzF.exe
  C:\Windows\System\BihLRzF.exe
  2⤵
  PID:10320
- C:\Windows\System\fSClJaT.exe
  C:\Windows\System\fSClJaT.exe
  2⤵
  PID:10384
- C:\Windows\System\JJaCxAQ.exe
  C:\Windows\System\JJaCxAQ.exe
  2⤵
  PID:10456
- C:\Windows\System\XBXLApe.exe
  C:\Windows\System\XBXLApe.exe
  2⤵
  PID:10556
- C:\Windows\System\gtadghs.exe
  C:\Windows\System\gtadghs.exe
  2⤵
  PID:10616
- C:\Windows\System\aQWDbbN.exe
  C:\Windows\System\aQWDbbN.exe
  2⤵
  PID:10656
- C:\Windows\System\jbKdQap.exe
  C:\Windows\System\jbKdQap.exe
  2⤵
  PID:10752
- C:\Windows\System\cHcDPID.exe
  C:\Windows\System\cHcDPID.exe
  2⤵
  PID:10776
- C:\Windows\System\tLMxlfQ.exe
  C:\Windows\System\tLMxlfQ.exe
  2⤵
  PID:10872
- C:\Windows\System\wXvjwFK.exe
  C:\Windows\System\wXvjwFK.exe
  2⤵
  PID:10940
- C:\Windows\System\uSFUeod.exe
  C:\Windows\System\uSFUeod.exe
  2⤵
  PID:11044
- C:\Windows\System\EvFsKyk.exe
  C:\Windows\System\EvFsKyk.exe
  2⤵
  PID:11128
- C:\Windows\System\NgTXYCS.exe
  C:\Windows\System\NgTXYCS.exe
  2⤵
  PID:11160
- C:\Windows\System\yahUQyi.exe
  C:\Windows\System\yahUQyi.exe
  2⤵
  PID:11256
- C:\Windows\System\zMZXwMr.exe
  C:\Windows\System\zMZXwMr.exe
  2⤵
  PID:10308
- C:\Windows\System\TExNUqz.exe
  C:\Windows\System\TExNUqz.exe
  2⤵
  PID:10464
- C:\Windows\System\PcKbUcP.exe
  C:\Windows\System\PcKbUcP.exe
  2⤵
  PID:10584
- C:\Windows\System\BtqyKZs.exe
  C:\Windows\System\BtqyKZs.exe
  2⤵
  PID:10712
- C:\Windows\System\lYkOpPd.exe
  C:\Windows\System\lYkOpPd.exe
  2⤵
  PID:10824
- C:\Windows\System\PVCwzCh.exe
  C:\Windows\System\PVCwzCh.exe
  2⤵
  PID:11040
- C:\Windows\System\rDRdPgs.exe
  C:\Windows\System\rDRdPgs.exe
  2⤵
  PID:11196
- C:\Windows\System\TEdZOqx.exe
  C:\Windows\System\TEdZOqx.exe
  2⤵
  PID:10368
- C:\Windows\System\XVJYoNZ.exe
  C:\Windows\System\XVJYoNZ.exe
  2⤵
  PID:10624
- C:\Windows\System\KKfgWth.exe
  C:\Windows\System\KKfgWth.exe
  2⤵
  PID:11096
- C:\Windows\System\RMfiOgO.exe
  C:\Windows\System\RMfiOgO.exe
  2⤵
  PID:10356
- C:\Windows\System\NvwMsKu.exe
  C:\Windows\System\NvwMsKu.exe
  2⤵
  PID:11272
- C:\Windows\System\PeZUAuk.exe
  C:\Windows\System\PeZUAuk.exe
  2⤵
  PID:11300
- C:\Windows\System\qeikuaO.exe
  C:\Windows\System\qeikuaO.exe
  2⤵
  PID:11344
- C:\Windows\System\NIssNkY.exe
  C:\Windows\System\NIssNkY.exe
  2⤵
  PID:11372
- C:\Windows\System\UTzXcXs.exe
  C:\Windows\System\UTzXcXs.exe
  2⤵
  PID:11396
- C:\Windows\System\FNLWPcV.exe
  C:\Windows\System\FNLWPcV.exe
  2⤵
  PID:11420
- C:\Windows\System\eEwzwam.exe
  C:\Windows\System\eEwzwam.exe
  2⤵
  PID:11436
- C:\Windows\System\ZDmyJlH.exe
  C:\Windows\System\ZDmyJlH.exe
  2⤵
  PID:11492
- C:\Windows\System\iuDkaoo.exe
  C:\Windows\System\iuDkaoo.exe
  2⤵
  PID:11512
- C:\Windows\System\FvNVyFw.exe
  C:\Windows\System\FvNVyFw.exe
  2⤵
  PID:11552
- C:\Windows\System\gtyUjfP.exe
  C:\Windows\System\gtyUjfP.exe
  2⤵
  PID:11572
- C:\Windows\System\Cwafewf.exe
  C:\Windows\System\Cwafewf.exe
  2⤵
  PID:11596
- C:\Windows\System\LLedtRr.exe
  C:\Windows\System\LLedtRr.exe
  2⤵
  PID:11624
- C:\Windows\System\TGGwDBE.exe
  C:\Windows\System\TGGwDBE.exe
  2⤵
  PID:11644
- C:\Windows\System\ZzSwOui.exe
  C:\Windows\System\ZzSwOui.exe
  2⤵
  PID:11672
- C:\Windows\System\GNOvJIL.exe
  C:\Windows\System\GNOvJIL.exe
  2⤵
  PID:11700
- C:\Windows\System\HKnWQhp.exe
  C:\Windows\System\HKnWQhp.exe
  2⤵
  PID:11732
- C:\Windows\System\VkxeZGK.exe
  C:\Windows\System\VkxeZGK.exe
  2⤵
  PID:11756
- C:\Windows\System\bUNehAg.exe
  C:\Windows\System\bUNehAg.exe
  2⤵
  PID:11804
- C:\Windows\System\nPTasIU.exe
  C:\Windows\System\nPTasIU.exe
  2⤵
  PID:11832
- C:\Windows\System\voqKKYJ.exe
  C:\Windows\System\voqKKYJ.exe
  2⤵
  PID:11860
- C:\Windows\System\zRSSBIV.exe
  C:\Windows\System\zRSSBIV.exe
  2⤵
  PID:11876
- C:\Windows\System\EIBJvQl.exe
  C:\Windows\System\EIBJvQl.exe
  2⤵
  PID:11916
- C:\Windows\System\wTxpUew.exe
  C:\Windows\System\wTxpUew.exe
  2⤵
  PID:11932
- C:\Windows\System\DfdGWmB.exe
  C:\Windows\System\DfdGWmB.exe
  2⤵
  PID:11960
- C:\Windows\System\jxOwHJl.exe
  C:\Windows\System\jxOwHJl.exe
  2⤵
  PID:11988
- C:\Windows\System\RbFdSXb.exe
  C:\Windows\System\RbFdSXb.exe
  2⤵
  PID:12012
- C:\Windows\System\EekVRej.exe
  C:\Windows\System\EekVRej.exe
  2⤵
  PID:12044
- C:\Windows\System\MFTaYFa.exe
  C:\Windows\System\MFTaYFa.exe
  2⤵
  PID:12072
- C:\Windows\System\wDdUcms.exe
  C:\Windows\System\wDdUcms.exe
  2⤵
  PID:12116
- C:\Windows\System\FmEgabp.exe
  C:\Windows\System\FmEgabp.exe
  2⤵
  PID:12140
- C:\Windows\System\eyigRag.exe
  C:\Windows\System\eyigRag.exe
  2⤵
  PID:12172
- C:\Windows\System\viCBFXo.exe
  C:\Windows\System\viCBFXo.exe
  2⤵
  PID:12200
- C:\Windows\System\eTSiOSf.exe
  C:\Windows\System\eTSiOSf.exe
  2⤵
  PID:12224
- C:\Windows\System\daMaPIn.exe
  C:\Windows\System\daMaPIn.exe
  2⤵
  PID:12256
- C:\Windows\System\sLgGpQM.exe
  C:\Windows\System\sLgGpQM.exe
  2⤵
  PID:12284
- C:\Windows\System\bKPXHdE.exe
  C:\Windows\System\bKPXHdE.exe
  2⤵
  PID:10696
- C:\Windows\System\GTcQkUQ.exe
  C:\Windows\System\GTcQkUQ.exe
  2⤵
  PID:11360
- C:\Windows\System\xZrkJzs.exe
  C:\Windows\System\xZrkJzs.exe
  2⤵
  PID:11412
- C:\Windows\System\NraKTXH.exe
  C:\Windows\System\NraKTXH.exe
  2⤵
  PID:11484
- C:\Windows\System\HBFkLMM.exe
  C:\Windows\System\HBFkLMM.exe
  2⤵
  PID:11568
- C:\Windows\System\SsgsNSc.exe
  C:\Windows\System\SsgsNSc.exe
  2⤵
  PID:11612
- C:\Windows\System\ntySnlv.exe
  C:\Windows\System\ntySnlv.exe
  2⤵
  PID:11688
- C:\Windows\System\TGqBebB.exe
  C:\Windows\System\TGqBebB.exe
  2⤵
  PID:11752
- C:\Windows\System\nKZYOfu.exe
  C:\Windows\System\nKZYOfu.exe
  2⤵
  PID:11852
- C:\Windows\System\lkfWvBt.exe
  C:\Windows\System\lkfWvBt.exe
  2⤵
  PID:11892
- C:\Windows\System\yfkRIHX.exe
  C:\Windows\System\yfkRIHX.exe
  2⤵
  PID:11928
- C:\Windows\System\TqJgfDS.exe
  C:\Windows\System\TqJgfDS.exe
  2⤵
  PID:12004
- C:\Windows\System\XvikizV.exe
  C:\Windows\System\XvikizV.exe
  2⤵
  PID:12084
- C:\Windows\System\aCoJEQE.exe
  C:\Windows\System\aCoJEQE.exe
  2⤵
  PID:12132
- C:\Windows\System\SWOPKIJ.exe
  C:\Windows\System\SWOPKIJ.exe
  2⤵
  PID:12216
- C:\Windows\System\XwfdIZd.exe
  C:\Windows\System\XwfdIZd.exe
  2⤵
  PID:12252
- C:\Windows\System\TQfzStk.exe
  C:\Windows\System\TQfzStk.exe
  2⤵
  PID:11020
- C:\Windows\System\xBMFXkW.exe
  C:\Windows\System\xBMFXkW.exe
  2⤵
  PID:11428
- C:\Windows\System\WARuZvx.exe
  C:\Windows\System\WARuZvx.exe
  2⤵
  PID:11528
- C:\Windows\System\nzkFcGw.exe
  C:\Windows\System\nzkFcGw.exe
  2⤵
  PID:11716
- C:\Windows\System\VSDwgFT.exe
  C:\Windows\System\VSDwgFT.exe
  2⤵
  PID:11800
- C:\Windows\System\YDRRllT.exe
  C:\Windows\System\YDRRllT.exe
  2⤵
  PID:12000
- C:\Windows\System\LOelADj.exe
  C:\Windows\System\LOelADj.exe
  2⤵
  PID:12188
- C:\Windows\System\HXhUNyI.exe
  C:\Windows\System\HXhUNyI.exe
  2⤵
  PID:11504
- C:\Windows\System\cPthHJL.exe
  C:\Windows\System\cPthHJL.exe
  2⤵
  PID:11432
- C:\Windows\System\QdDLJQs.exe
  C:\Windows\System\QdDLJQs.exe
  2⤵
  PID:6068
- C:\Windows\System\SCKfOAU.exe
  C:\Windows\System\SCKfOAU.exe
  2⤵
  PID:12240
- C:\Windows\System\dQEXBFA.exe
  C:\Windows\System\dQEXBFA.exe
  2⤵
  PID:12268
- C:\Windows\System\YYNWbUe.exe
  C:\Windows\System\YYNWbUe.exe
  2⤵
  PID:12312
- C:\Windows\System\wntDToi.exe
  C:\Windows\System\wntDToi.exe
  2⤵
  PID:12332
- C:\Windows\System\FketxeR.exe
  C:\Windows\System\FketxeR.exe
  2⤵
  PID:12360
- C:\Windows\System\MeLGcSc.exe
  C:\Windows\System\MeLGcSc.exe
  2⤵
  PID:12392
- C:\Windows\System\TeGEnQZ.exe
  C:\Windows\System\TeGEnQZ.exe
  2⤵
  PID:12432
- C:\Windows\System\beIBxqk.exe
  C:\Windows\System\beIBxqk.exe
  2⤵
  PID:12460
- C:\Windows\System\fMcybYz.exe
  C:\Windows\System\fMcybYz.exe
  2⤵
  PID:12496
- C:\Windows\System\mmNOcgD.exe
  C:\Windows\System\mmNOcgD.exe
  2⤵
  PID:12512
- C:\Windows\System\RjWbpYK.exe
  C:\Windows\System\RjWbpYK.exe
  2⤵
  PID:12544
- C:\Windows\System\WVQbUSu.exe
  C:\Windows\System\WVQbUSu.exe
  2⤵
  PID:12564
- C:\Windows\System\OVCksYX.exe
  C:\Windows\System\OVCksYX.exe
  2⤵
  PID:12600
- C:\Windows\System\ylDMmbU.exe
  C:\Windows\System\ylDMmbU.exe
  2⤵
  PID:12624
- C:\Windows\System\xTPKqpD.exe
  C:\Windows\System\xTPKqpD.exe
  2⤵
  PID:12652
- C:\Windows\System\oMEVszk.exe
  C:\Windows\System\oMEVszk.exe
  2⤵
  PID:12692
- C:\Windows\System\rpzLkDd.exe
  C:\Windows\System\rpzLkDd.exe
  2⤵
  PID:12720
- C:\Windows\System\CISZbYi.exe
  C:\Windows\System\CISZbYi.exe
  2⤵
  PID:12744
- C:\Windows\System\kOkYLPz.exe
  C:\Windows\System\kOkYLPz.exe
  2⤵
  PID:12760
- C:\Windows\System\XVfyzMN.exe
  C:\Windows\System\XVfyzMN.exe
  2⤵
  PID:12780
- C:\Windows\System\xlytZJf.exe
  C:\Windows\System\xlytZJf.exe
  2⤵
  PID:12796
- C:\Windows\System\FJThBVJ.exe
  C:\Windows\System\FJThBVJ.exe
  2⤵
  PID:12824
- C:\Windows\System\uejMwJX.exe
  C:\Windows\System\uejMwJX.exe
  2⤵
  PID:12848
- C:\Windows\System\yYvFzhi.exe
  C:\Windows\System\yYvFzhi.exe
  2⤵
  PID:12868
- C:\Windows\System\mkQAMuU.exe
  C:\Windows\System\mkQAMuU.exe
  2⤵
  PID:12892
- C:\Windows\System\MQYAtYQ.exe
  C:\Windows\System\MQYAtYQ.exe
  2⤵
  PID:12908
- C:\Windows\System\nZOgEhl.exe
  C:\Windows\System\nZOgEhl.exe
  2⤵
  PID:12928
- C:\Windows\System\SzlQBfJ.exe
  C:\Windows\System\SzlQBfJ.exe
  2⤵
  PID:12944
- C:\Windows\System\DffvyuI.exe
  C:\Windows\System\DffvyuI.exe
  2⤵
  PID:12964
- C:\Windows\System\bJJThkz.exe
  C:\Windows\System\bJJThkz.exe
  2⤵
  PID:12988
- C:\Windows\System\BbhuScm.exe
  C:\Windows\System\BbhuScm.exe
  2⤵
  PID:13004
- C:\Windows\System\YpETtgF.exe
  C:\Windows\System\YpETtgF.exe
  2⤵
  PID:13024
- C:\Windows\System\RstFYWB.exe
  C:\Windows\System\RstFYWB.exe
  2⤵
  PID:13056
- C:\Windows\System\haiYkkm.exe
  C:\Windows\System\haiYkkm.exe
  2⤵
  PID:13080
- C:\Windows\System\MmllXSv.exe
  C:\Windows\System\MmllXSv.exe
  2⤵
  PID:13104
- C:\Windows\System\qBRcBNB.exe
  C:\Windows\System\qBRcBNB.exe
  2⤵
  PID:13128
- C:\Windows\System\jsgEPPW.exe
  C:\Windows\System\jsgEPPW.exe
  2⤵
  PID:13156
- C:\Windows\System\DSfMJoh.exe
  C:\Windows\System\DSfMJoh.exe
  2⤵
  PID:13192
- C:\Windows\System\dxRPuoZ.exe
  C:\Windows\System\dxRPuoZ.exe
  2⤵
  PID:13208
- C:\Windows\System\VvHqweG.exe
  C:\Windows\System\VvHqweG.exe
  2⤵
  PID:13244
- C:\Windows\System\tajqrTO.exe
  C:\Windows\System\tajqrTO.exe
  2⤵
  PID:13260
- C:\Windows\System\jtdHJtw.exe
  C:\Windows\System\jtdHJtw.exe
  2⤵
  PID:13288
- C:\Windows\System\BXnbDfv.exe
  C:\Windows\System\BXnbDfv.exe
  2⤵
  PID:13308
- C:\Windows\System\oMbjJyB.exe
  C:\Windows\System\oMbjJyB.exe
  2⤵
  PID:12300
- C:\Windows\System\zMQgfza.exe
  C:\Windows\System\zMQgfza.exe
  2⤵
  PID:4304
- C:\Windows\System\RLyAMih.exe
  C:\Windows\System\RLyAMih.exe
  2⤵
  PID:12424
- C:\Windows\System\eUflwys.exe
  C:\Windows\System\eUflwys.exe
  2⤵
  PID:12504
- C:\Windows\System\WvRcwcj.exe
  C:\Windows\System\WvRcwcj.exe
  2⤵
  PID:12556
- C:\Windows\System\hPFNocE.exe
  C:\Windows\System\hPFNocE.exe
  2⤵
  PID:12636
- C:\Windows\System\JxEllAV.exe
  C:\Windows\System\JxEllAV.exe
  2⤵
  PID:12684
- C:\Windows\System\BuBIspX.exe
  C:\Windows\System\BuBIspX.exe
  2⤵
  PID:12736
- C:\Windows\System\yfuQxcv.exe
  C:\Windows\System\yfuQxcv.exe
  2⤵
  PID:12752
- C:\Windows\System\jEgVPTF.exe
  C:\Windows\System\jEgVPTF.exe
  2⤵
  PID:12860
- C:\Windows\System\EvjsdQO.exe
  C:\Windows\System\EvjsdQO.exe
  2⤵
  PID:12888
- C:\Windows\System\JmAQMPu.exe
  C:\Windows\System\JmAQMPu.exe
  2⤵
  PID:12972
- C:\Windows\System\SgrPIyO.exe
  C:\Windows\System\SgrPIyO.exe
  2⤵
  PID:13032
- C:\Windows\System\TgjsaWQ.exe
  C:\Windows\System\TgjsaWQ.exe
  2⤵
  PID:13048
- C:\Windows\System\oHRerTW.exe
  C:\Windows\System\oHRerTW.exe
  2⤵
  PID:13092
- C:\Windows\System\JpcSzKn.exe
  C:\Windows\System\JpcSzKn.exe
  2⤵
  PID:13224
- C:\Windows\System\bghhlGC.exe
  C:\Windows\System\bghhlGC.exe
  2⤵
  PID:13256
- C:\Windows\System\DeXFXeD.exe
  C:\Windows\System\DeXFXeD.exe
  2⤵
  PID:13272
- C:\Windows\System\XStgoET.exe
  C:\Windows\System\XStgoET.exe
  2⤵
  PID:13304
- C:\Windows\System\mwMmHnp.exe
  C:\Windows\System\mwMmHnp.exe
  2⤵
  PID:12404
- C:\Windows\System\kxqFosh.exe
  C:\Windows\System\kxqFosh.exe
  2⤵
  PID:12368
- C:\Windows\System\Sjssqpi.exe
  C:\Windows\System\Sjssqpi.exe
  2⤵
  PID:12916
- C:\Windows\System\qoMjngm.exe
  C:\Windows\System\qoMjngm.exe
  2⤵
  PID:13332
- C:\Windows\System\WEOFQsY.exe
  C:\Windows\System\WEOFQsY.exe
  2⤵
  PID:13360
- C:\Windows\System\XRfMNVE.exe
  C:\Windows\System\XRfMNVE.exe
  2⤵
  PID:13384
- C:\Windows\System\bjSmRTi.exe
  C:\Windows\System\bjSmRTi.exe
  2⤵
  PID:13416
- C:\Windows\System\qyiHcYv.exe
  C:\Windows\System\qyiHcYv.exe
  2⤵
  PID:13440
- C:\Windows\System\kFbDtUS.exe
  C:\Windows\System\kFbDtUS.exe
  2⤵
  PID:13472
- C:\Windows\System\oyNVnZF.exe
  C:\Windows\System\oyNVnZF.exe
  2⤵
  PID:13508
- C:\Windows\System\uyjaJkU.exe
  C:\Windows\System\uyjaJkU.exe
  2⤵
  PID:13540
- C:\Windows\System\saRYTKn.exe
  C:\Windows\System\saRYTKn.exe
  2⤵
  PID:13568
- C:\Windows\System\XaMyJNX.exe
  C:\Windows\System\XaMyJNX.exe
  2⤵
  PID:13588
- C:\Windows\System\dzNntto.exe
  C:\Windows\System\dzNntto.exe
  2⤵
  PID:13604
- C:\Windows\System\zffBHit.exe
  C:\Windows\System\zffBHit.exe
  2⤵
  PID:13632
- C:\Windows\System\iAJuvye.exe
  C:\Windows\System\iAJuvye.exe
  2⤵
  PID:13656
- C:\Windows\System\IYNhBAv.exe
  C:\Windows\System\IYNhBAv.exe
  2⤵
  PID:13688
- C:\Windows\System\xFaKthv.exe
  C:\Windows\System\xFaKthv.exe
  2⤵
  PID:13716
- C:\Windows\System\ngaECAI.exe
  C:\Windows\System\ngaECAI.exe
  2⤵
  PID:13804
- C:\Windows\System\rjsBULk.exe
  C:\Windows\System\rjsBULk.exe
  2⤵
  PID:13836
- C:\Windows\System\YQhbcBT.exe
  C:\Windows\System\YQhbcBT.exe
  2⤵
  PID:13872
- C:\Windows\System\iewbbsI.exe
  C:\Windows\System\iewbbsI.exe
  2⤵
  PID:13908
- C:\Windows\System\CsXHPmL.exe
  C:\Windows\System\CsXHPmL.exe
  2⤵
  PID:13948
- C:\Windows\System\OhjnmDX.exe
  C:\Windows\System\OhjnmDX.exe
  2⤵
  PID:13968
- C:\Windows\System\jMOHFoh.exe
  C:\Windows\System\jMOHFoh.exe
  2⤵
  PID:13992
- C:\Windows\System\BbwpubN.exe
  C:\Windows\System\BbwpubN.exe
  2⤵
  PID:14016
- C:\Windows\System\dkypAWS.exe
  C:\Windows\System\dkypAWS.exe
  2⤵
  PID:14056
- C:\Windows\System\dPGKSkj.exe
  C:\Windows\System\dPGKSkj.exe
  2⤵
  PID:14084
- C:\Windows\System\eSIegsz.exe
  C:\Windows\System\eSIegsz.exe
  2⤵
  PID:14104
- C:\Windows\System\uuddhnN.exe
  C:\Windows\System\uuddhnN.exe
  2⤵
  PID:14132
- C:\Windows\System\DmRmvlP.exe
  C:\Windows\System\DmRmvlP.exe
  2⤵
  PID:14152
- C:\Windows\System\UQPcGaI.exe
  C:\Windows\System\UQPcGaI.exe
  2⤵
  PID:14176
- C:\Windows\System\URoYQtq.exe
  C:\Windows\System\URoYQtq.exe
  2⤵
  PID:14200
- C:\Windows\System\HZDsceH.exe
  C:\Windows\System\HZDsceH.exe
  2⤵
  PID:14228
- C:\Windows\System\ZLjLtnC.exe
  C:\Windows\System\ZLjLtnC.exe
  2⤵
  PID:14252
- C:\Windows\System\QGtHGNz.exe
  C:\Windows\System\QGtHGNz.exe
  2⤵
  PID:14316
- C:\Windows\System\jZYZrak.exe
  C:\Windows\System\jZYZrak.exe
  2⤵
  PID:13300
- C:\Windows\System\QgqXqTH.exe
  C:\Windows\System\QgqXqTH.exe
  2⤵
  PID:12856
- C:\Windows\System\kFgVwCI.exe
  C:\Windows\System\kFgVwCI.exe
  2⤵
  PID:13220
- C:\Windows\System\YEmhKAx.exe
  C:\Windows\System\YEmhKAx.exe
  2⤵
  PID:12976
- C:\Windows\System\gFxFwUK.exe
  C:\Windows\System\gFxFwUK.exe
  2⤵
  PID:13236
- C:\Windows\System\gKWnSlq.exe
  C:\Windows\System\gKWnSlq.exe
  2⤵
  PID:13524
- C:\Windows\System\SwluYtv.exe
  C:\Windows\System\SwluYtv.exe
  2⤵
  PID:12420
- C:\Windows\System\xDDepma.exe
  C:\Windows\System\xDDepma.exe
  2⤵
  PID:13620
- C:\Windows\System\vvZZQeV.exe
  C:\Windows\System\vvZZQeV.exe
  2⤵
  PID:13548
- C:\Windows\System\DFhfrFR.exe
  C:\Windows\System\DFhfrFR.exe
  2⤵
  PID:13492
- C:\Windows\System\RqGyUJA.exe
  C:\Windows\System\RqGyUJA.exe
  2⤵
  PID:13740
- C:\Windows\System\aKebkuT.exe
  C:\Windows\System\aKebkuT.exe
  2⤵
  PID:13788
- C:\Windows\System\izKFFwq.exe
  C:\Windows\System\izKFFwq.exe
  2⤵
  PID:13764
- C:\Windows\System\uVroDAD.exe
  C:\Windows\System\uVroDAD.exe
  2⤵
  PID:13888
- C:\Windows\System\tgGuHTI.exe
  C:\Windows\System\tgGuHTI.exe
  2⤵
  PID:13824
- C:\Windows\System\FsRkNhU.exe
  C:\Windows\System\FsRkNhU.exe
  2⤵
  PID:14116
- C:\Windows\System\DnUEsIi.exe
  C:\Windows\System\DnUEsIi.exe
  2⤵
  PID:14028
- C:\Windows\System\QhFgZtu.exe
  C:\Windows\System\QhFgZtu.exe
  2⤵
  PID:13956
- C:\Windows\System\cxpjNeO.exe
  C:\Windows\System\cxpjNeO.exe
  2⤵
  PID:14068
- C:\Windows\System\VJPODdi.exe
  C:\Windows\System\VJPODdi.exe
  2⤵
  PID:14112
- C:\Windows\System\pluSAHQ.exe
  C:\Windows\System\pluSAHQ.exe
  2⤵
  PID:14260
- C:\Windows\System\vGKwFQx.exe
  C:\Windows\System\vGKwFQx.exe
  2⤵
  PID:13072
- C:\Windows\System\EhAUKIi.exe
  C:\Windows\System\EhAUKIi.exe
  2⤵
  PID:14288
- C:\Windows\System\uUEUmjg.exe
  C:\Windows\System\uUEUmjg.exe
  2⤵
  PID:13140
- C:\Windows\System\jzivjvK.exe
  C:\Windows\System\jzivjvK.exe
  2⤵
  PID:12292
- C:\Windows\System\YlmIHhU.exe
  C:\Windows\System\YlmIHhU.exe
  2⤵
  PID:13708
- C:\Windows\System\lILVKdN.exe
  C:\Windows\System\lILVKdN.exe
  2⤵
  PID:13600
- C:\Windows\System\KDlSYqX.exe
  C:\Windows\System\KDlSYqX.exe
  2⤵
  PID:14040
- C:\Windows\System\MYxNmcL.exe
  C:\Windows\System\MYxNmcL.exe
  2⤵
  PID:13964
- C:\Windows\System\rqtmLld.exe
  C:\Windows\System\rqtmLld.exe
  2⤵
  PID:14100
- C:\Windows\System\zgLnBqJ.exe
  C:\Windows\System\zgLnBqJ.exe
  2⤵
  PID:13704
- C:\Windows\System\oJyopbL.exe
  C:\Windows\System\oJyopbL.exe
  2⤵
  PID:14048
- C:\Windows\System\vafnuoj.exe
  C:\Windows\System\vafnuoj.exe
  2⤵
  PID:14220
- C:\Windows\System\vsHCWIy.exe
  C:\Windows\System\vsHCWIy.exe
  2⤵
  PID:14352
- C:\Windows\System\UqWLLAV.exe
  C:\Windows\System\UqWLLAV.exe
  2⤵
  PID:14380
- C:\Windows\System\vmZkuKQ.exe
  C:\Windows\System\vmZkuKQ.exe
  2⤵
  PID:14416
- C:\Windows\System\hhCEGST.exe
  C:\Windows\System\hhCEGST.exe
  2⤵
  PID:14476
- C:\Windows\System\MxjsbAo.exe
  C:\Windows\System\MxjsbAo.exe
  2⤵
  PID:14496
- C:\Windows\System\eoIQxsq.exe
  C:\Windows\System\eoIQxsq.exe
  2⤵
  PID:14520
- C:\Windows\System\HLvQpaS.exe
  C:\Windows\System\HLvQpaS.exe
  2⤵
  PID:14548
- C:\Windows\System\kcKsenR.exe
  C:\Windows\System\kcKsenR.exe
  2⤵
  PID:14564
- C:\Windows\System\ZnMMhjr.exe
  C:\Windows\System\ZnMMhjr.exe
  2⤵
  PID:14592
- C:\Windows\System\zMHdiQC.exe
  C:\Windows\System\zMHdiQC.exe
  2⤵
  PID:14612
- C:\Windows\System\xGbaqST.exe
  C:\Windows\System\xGbaqST.exe
  2⤵
  PID:14636
- C:\Windows\System\EtZFMBT.exe
  C:\Windows\System\EtZFMBT.exe
  2⤵
  PID:14656
- C:\Windows\System\IhYHAbk.exe
  C:\Windows\System\IhYHAbk.exe
  2⤵
  PID:14672
- C:\Windows\System\LEvirHq.exe
  C:\Windows\System\LEvirHq.exe
  2⤵
  PID:14708
- C:\Windows\System\CEgysxP.exe
  C:\Windows\System\CEgysxP.exe
  2⤵
  PID:14728
- C:\Windows\System\OYikzoe.exe
  C:\Windows\System\OYikzoe.exe
  2⤵
  PID:14748
- C:\Windows\System\qEmeXfP.exe
  C:\Windows\System\qEmeXfP.exe
  2⤵
  PID:14776
- C:\Windows\System\tOAchXO.exe
  C:\Windows\System\tOAchXO.exe
  2⤵
  PID:14792
- C:\Windows\System\GHPFFmf.exe
  C:\Windows\System\GHPFFmf.exe
  2⤵
  PID:14816
- C:\Windows\System\VIrlhZv.exe
  C:\Windows\System\VIrlhZv.exe
  2⤵
  PID:14836
- C:\Windows\System\PkRXCpb.exe
  C:\Windows\System\PkRXCpb.exe
  2⤵
  PID:14856
- C:\Windows\System\dulgchw.exe
  C:\Windows\System\dulgchw.exe
  2⤵
  PID:14888
- C:\Windows\System\QKekSzT.exe
  C:\Windows\System\QKekSzT.exe
  2⤵
  PID:14912
- C:\Windows\System\whZnIAz.exe
  C:\Windows\System\whZnIAz.exe
  2⤵
  PID:14936
- C:\Windows\System\jFcIBtG.exe
  C:\Windows\System\jFcIBtG.exe
  2⤵
  PID:14964
- C:\Windows\System\zAALNEM.exe
  C:\Windows\System\zAALNEM.exe
  2⤵
  PID:14980
- C:\Windows\System\tthAJBb.exe
  C:\Windows\System\tthAJBb.exe
  2⤵
  PID:15004
- C:\Windows\System\fticshm.exe
  C:\Windows\System\fticshm.exe
  2⤵
  PID:15028
- C:\Windows\System\uImScEc.exe
  C:\Windows\System\uImScEc.exe
  2⤵
  PID:15048
- C:\Windows\System\TXgeqSP.exe
  C:\Windows\System\TXgeqSP.exe
  2⤵
  PID:15068
- C:\Windows\System\MsWKvJl.exe
  C:\Windows\System\MsWKvJl.exe
  2⤵
  PID:15100
- C:\Windows\System\iGnJXqb.exe
  C:\Windows\System\iGnJXqb.exe
  2⤵
  PID:15120
- C:\Windows\System\WLVdXMJ.exe
  C:\Windows\System\WLVdXMJ.exe
  2⤵
  PID:15164
- C:\Windows\System\tZkheSI.exe
  C:\Windows\System\tZkheSI.exe
  2⤵
  PID:15192
- C:\Windows\System\xgpSIxz.exe
  C:\Windows\System\xgpSIxz.exe
  2⤵
  PID:15216
- C:\Windows\System\YGPJIYz.exe
  C:\Windows\System\YGPJIYz.exe
  2⤵
  PID:15240
- C:\Windows\System\dkunwgw.exe
  C:\Windows\System\dkunwgw.exe
  2⤵
  PID:15268
- C:\Windows\System\YalXYhR.exe
  C:\Windows\System\YalXYhR.exe
  2⤵
  PID:15296
- C:\Windows\System\daCCheM.exe
  C:\Windows\System\daCCheM.exe
  2⤵
  PID:15320
- C:\Windows\System\IegTZuc.exe
  C:\Windows\System\IegTZuc.exe
  2⤵
  PID:15348
- C:\Windows\System\bzpKVya.exe
  C:\Windows\System\bzpKVya.exe
  2⤵
  PID:12612
- C:\Windows\System\fWJoSfP.exe
  C:\Windows\System\fWJoSfP.exe
  2⤵
  PID:13988
- C:\Windows\System\ezCupOD.exe
  C:\Windows\System\ezCupOD.exe
  2⤵
  PID:13556
- C:\Windows\System\KiTmGpE.exe
  C:\Windows\System\KiTmGpE.exe
  2⤵
  PID:14372
- C:\Windows\System\hqdxuFB.exe
  C:\Windows\System\hqdxuFB.exe
  2⤵
  PID:14512
- C:\Windows\System\OWEhtNd.exe
  C:\Windows\System\OWEhtNd.exe
  2⤵
  PID:13724
- C:\Windows\System\WFVUpQb.exe
  C:\Windows\System\WFVUpQb.exe
  2⤵
  PID:14364
- C:\Windows\System\zPAoBLX.exe
  C:\Windows\System\zPAoBLX.exe
  2⤵
  PID:5796
- C:\Windows\System\CbXJRey.exe
  C:\Windows\System\CbXJRey.exe
  2⤵
  PID:14632
- C:\Windows\System\fYygEqu.exe
  C:\Windows\System\fYygEqu.exe
  2⤵
  PID:14652
- C:\Windows\System\sRDEmuv.exe
  C:\Windows\System\sRDEmuv.exe
  2⤵
  PID:14532
- C:\Windows\System\xdaufyi.exe
  C:\Windows\System\xdaufyi.exe
  2⤵
  PID:14576
- C:\Windows\System\uiWUYGZ.exe
  C:\Windows\System\uiWUYGZ.exe
  2⤵
  PID:15024
- C:\Windows\System\HnOdRAB.exe
  C:\Windows\System\HnOdRAB.exe
  2⤵
  PID:14832
- C:\Windows\System\FBJQbRO.exe
  C:\Windows\System\FBJQbRO.exe
  2⤵
  PID:14884
- C:\Windows\System\tMnQAKz.exe
  C:\Windows\System\tMnQAKz.exe
  2⤵
  PID:14740
- C:\Windows\System\FGuHFfn.exe
  C:\Windows\System\FGuHFfn.exe
  2⤵
  PID:14944
- C:\Windows\System\DlsBPBd.exe
  C:\Windows\System\DlsBPBd.exe
  2⤵
  PID:15184
- C:\Windows\System\cXRRRKt.exe
  C:\Windows\System\cXRRRKt.exe
  2⤵
  PID:14976
- C:\Windows\System\oGUtcXZ.exe
  C:\Windows\System\oGUtcXZ.exe
  2⤵
  PID:15260
- C:\Windows\System\lDccsZr.exe
  C:\Windows\System\lDccsZr.exe
  2⤵
  PID:15344
- C:\Windows\System\iCNkcRI.exe
  C:\Windows\System\iCNkcRI.exe
  2⤵
  PID:14952
- C:\Windows\System\HGuaxHq.exe
  C:\Windows\System\HGuaxHq.exe
  2⤵
  PID:14584
- C:\Windows\System\TPtMlYB.exe
  C:\Windows\System\TPtMlYB.exe
  2⤵
  PID:14144
- C:\Windows\System\YEVGqfM.exe
  C:\Windows\System\YEVGqfM.exe
  2⤵
  PID:15372
- C:\Windows\System\MHerpam.exe
  C:\Windows\System\MHerpam.exe
  2⤵
  PID:15392
- C:\Windows\System\rXgtkFj.exe
  C:\Windows\System\rXgtkFj.exe
  2⤵
  PID:15420
- C:\Windows\System\UuzvCSl.exe
  C:\Windows\System\UuzvCSl.exe
  2⤵
  PID:15560
- C:\Windows\System\LCAOQbB.exe
  C:\Windows\System\LCAOQbB.exe
  2⤵
  PID:15576
- C:\Windows\System\rfcoVOf.exe
  C:\Windows\System\rfcoVOf.exe
  2⤵
  PID:15592
- C:\Windows\System\wJgFndK.exe
  C:\Windows\System\wJgFndK.exe
  2⤵
  PID:15616
- C:\Windows\System\RIVtBFm.exe
  C:\Windows\System\RIVtBFm.exe
  2⤵
  PID:15636
- C:\Windows\System\aSFzYcR.exe
  C:\Windows\System\aSFzYcR.exe
  2⤵
  PID:15684
- C:\Windows\System\WEkIXnI.exe
  C:\Windows\System\WEkIXnI.exe
  2⤵
  PID:15712
- C:\Windows\System\andLBKm.exe
  C:\Windows\System\andLBKm.exe
  2⤵
  PID:15736
- C:\Windows\System\VOQPylD.exe
  C:\Windows\System\VOQPylD.exe
  2⤵
  PID:15768
- C:\Windows\System\zHajgGE.exe
  C:\Windows\System\zHajgGE.exe
  2⤵
  PID:16036
- C:\Windows\System\RsXGXMh.exe
  C:\Windows\System\RsXGXMh.exe
  2⤵
  PID:16068
- C:\Windows\System\poLJwGL.exe
  C:\Windows\System\poLJwGL.exe
  2⤵
  PID:16108
- C:\Windows\System\pYASGEm.exe
  C:\Windows\System\pYASGEm.exe
  2⤵
  PID:16136
- C:\Windows\System\EbjGKtq.exe
  C:\Windows\System\EbjGKtq.exe
  2⤵
  PID:16160
- C:\Windows\System\wnqmxWW.exe
  C:\Windows\System\wnqmxWW.exe
  2⤵
  PID:16180
- C:\Windows\System\lRbXkBq.exe
  C:\Windows\System\lRbXkBq.exe
  2⤵
  PID:16196
- C:\Windows\System\NgbPIua.exe
  C:\Windows\System\NgbPIua.exe
  2⤵
  PID:16216
- C:\Windows\System\kUnqXkf.exe
  C:\Windows\System\kUnqXkf.exe
  2⤵
  PID:16236
- C:\Windows\System\KkTUKfj.exe
  C:\Windows\System\KkTUKfj.exe
  2⤵
  PID:16264
- C:\Windows\System\odYNVFT.exe
  C:\Windows\System\odYNVFT.exe
  2⤵
  PID:16284
- C:\Windows\System\hbnTSoB.exe
  C:\Windows\System\hbnTSoB.exe
  2⤵
  PID:16312
- C:\Windows\System\VtMFIra.exe
  C:\Windows\System\VtMFIra.exe
  2⤵
  PID:16368
- C:\Windows\System\akupEkv.exe
  C:\Windows\System\akupEkv.exe
  2⤵
  PID:14240
- C:\Windows\System\goDZcxl.exe
  C:\Windows\System\goDZcxl.exe
  2⤵
  PID:14800
- C:\Windows\System\MMCZkby.exe
  C:\Windows\System\MMCZkby.exe
  2⤵
  PID:14560
- C:\Windows\System\niJjpcS.exe
  C:\Windows\System\niJjpcS.exe
  2⤵
  PID:15428
- C:\Windows\System\ajXwWtQ.exe
  C:\Windows\System\ajXwWtQ.exe
  2⤵
  PID:14348
- C:\Windows\System\SdVADno.exe
  C:\Windows\System\SdVADno.exe
  2⤵
  PID:15152
- C:\Windows\System\EGjoJeg.exe
  C:\Windows\System\EGjoJeg.exe
  2⤵
  PID:15252
- C:\Windows\System\uTakasw.exe
  C:\Windows\System\uTakasw.exe
  2⤵
  PID:14784
- C:\Windows\System\RDxlZGr.exe
  C:\Windows\System\RDxlZGr.exe
  2⤵
  PID:15404
- C:\Windows\System\VnlqvDf.exe
  C:\Windows\System\VnlqvDf.exe
  2⤵
  PID:15464
- C:\Windows\System\KTrCIGw.exe
  C:\Windows\System\KTrCIGw.exe
  2⤵
  PID:15472
- C:\Windows\System\CNpwQJU.exe
  C:\Windows\System\CNpwQJU.exe
  2⤵
  PID:15380
- C:\Windows\System\EZztchW.exe
  C:\Windows\System\EZztchW.exe
  2⤵
  PID:15588
- C:\Windows\System\GCkwjIO.exe
  C:\Windows\System\GCkwjIO.exe
  2⤵
  PID:15604
- C:\Windows\System\EUecEzm.exe
  C:\Windows\System\EUecEzm.exe
  2⤵
  PID:15840
- C:\Windows\System\tdEqKmy.exe
  C:\Windows\System\tdEqKmy.exe
  2⤵
  PID:15764
- C:\Windows\System\EpchGfF.exe
  C:\Windows\System\EpchGfF.exe
  2⤵
  PID:15812
- C:\Windows\System\ybeoaDt.exe
  C:\Windows\System\ybeoaDt.exe
  2⤵
  PID:16092
- C:\Windows\System\weHpdYC.exe
  C:\Windows\System\weHpdYC.exe
  2⤵
  PID:16064
- C:\Windows\System\fyTlyaN.exe
  C:\Windows\System\fyTlyaN.exe
  2⤵
  PID:16172
- C:\Windows\System\oxEWnWG.exe
  C:\Windows\System\oxEWnWG.exe
  2⤵
  PID:16188
- C:\Windows\System\jeOqgeq.exe
  C:\Windows\System\jeOqgeq.exe
  2⤵
  PID:16380
- C:\Windows\System\DGLjarT.exe
  C:\Windows\System\DGLjarT.exe
  2⤵
  PID:16304
- C:\Windows\System\WqHpPJZ.exe
  C:\Windows\System\WqHpPJZ.exe
  2⤵
  PID:14996
- C:\Windows\System\OGwNAvj.exe
  C:\Windows\System\OGwNAvj.exe
  2⤵
  PID:15356
- C:\Windows\System\PkYFXzr.exe
  C:\Windows\System\PkYFXzr.exe
  2⤵
  PID:14012
- C:\Windows\System\vppciYN.exe
  C:\Windows\System\vppciYN.exe
  2⤵
  PID:14924
- C:\Windows\System\sNFMIaQ.exe
  C:\Windows\System\sNFMIaQ.exe
  2⤵
  PID:15796
- C:\Windows\System\vRPIzfn.exe
  C:\Windows\System\vRPIzfn.exe
  2⤵
  PID:15572
- C:\Windows\System\lHEZImz.exe
  C:\Windows\System\lHEZImz.exe
  2⤵
  PID:15212
- C:\Windows\System\FDxACoW.exe
  C:\Windows\System\FDxACoW.exe
  2⤵
  PID:15328
- C:\Windows\System\IVTApMR.exe
  C:\Windows\System\IVTApMR.exe
  2⤵
  PID:15912
- C:\Windows\System\nxUMMRD.exe
  C:\Windows\System\nxUMMRD.exe
  2⤵
  PID:15756
- C:\Windows\System\tSZLnuu.exe
  C:\Windows\System\tSZLnuu.exe
  2⤵
  PID:16328
- C:\Windows\System\KgBzlFj.exe
  C:\Windows\System\KgBzlFj.exe
  2⤵
  PID:15512
- C:\Windows\System\GKzJtbq.exe
  C:\Windows\System\GKzJtbq.exe
  2⤵
  PID:15872
- C:\Windows\System\BRFWVev.exe
  C:\Windows\System\BRFWVev.exe
  2⤵
  PID:16404
- C:\Windows\System\DBkLJbs.exe
  C:\Windows\System\DBkLJbs.exe
  2⤵
  PID:16432
- C:\Windows\System\fiylJFa.exe
  C:\Windows\System\fiylJFa.exe
  2⤵
  PID:16468
- C:\Windows\System\mYFUBjn.exe
  C:\Windows\System\mYFUBjn.exe
  2⤵
  PID:16496
- C:\Windows\System\zWvvtdV.exe
  C:\Windows\System\zWvvtdV.exe
  2⤵
  PID:16520
- C:\Windows\System\GcfpUlE.exe
  C:\Windows\System\GcfpUlE.exe
  2⤵
  PID:16548
- C:\Windows\System\gIWrmmG.exe
  C:\Windows\System\gIWrmmG.exe
  2⤵
  PID:16580
- C:\Windows\System\ilVEWII.exe
  C:\Windows\System\ilVEWII.exe
  2⤵
  PID:16600
- C:\Windows\System\lWlGMed.exe
  C:\Windows\System\lWlGMed.exe
  2⤵
  PID:16620
- C:\Windows\System\NnGHHOa.exe
  C:\Windows\System\NnGHHOa.exe
  2⤵
  PID:16644
- C:\Windows\System\cfMrUkI.exe
  C:\Windows\System\cfMrUkI.exe
  2⤵
  PID:16676
- C:\Windows\System\gbAgnLU.exe
  C:\Windows\System\gbAgnLU.exe
  2⤵
  PID:16704
- C:\Windows\System\ZWdntXF.exe
  C:\Windows\System\ZWdntXF.exe
  2⤵
  PID:16728
- C:\Windows\System\sfvzBfz.exe
  C:\Windows\System\sfvzBfz.exe
  2⤵
  PID:16744
- C:\Windows\System\TtdLXDH.exe
  C:\Windows\System\TtdLXDH.exe
  2⤵
  PID:16772
- C:\Windows\System\NzcPdmd.exe
  C:\Windows\System\NzcPdmd.exe
  2⤵
  PID:16788
- C:\Windows\System\QNkHKYo.exe
  C:\Windows\System\QNkHKYo.exe
  2⤵
  PID:16820
- C:\Windows\System\xeDieNy.exe
  C:\Windows\System\xeDieNy.exe
  2⤵
  PID:16848
- C:\Windows\System\yKtLqQJ.exe
  C:\Windows\System\yKtLqQJ.exe
  2⤵
  PID:16872
- C:\Windows\System\KaOVgZi.exe
  C:\Windows\System\KaOVgZi.exe
  2⤵
  PID:16888
- C:\Windows\System\KWnSeNF.exe
  C:\Windows\System\KWnSeNF.exe
  2⤵
  PID:16920
- C:\Windows\System\rRgQNVT.exe
  C:\Windows\System\rRgQNVT.exe
  2⤵
  PID:16940
- C:\Windows\System\lgVIeNU.exe
  C:\Windows\System\lgVIeNU.exe
  2⤵
  PID:16960
- C:\Windows\System\EuEcNsZ.exe
  C:\Windows\System\EuEcNsZ.exe
  2⤵
  PID:16988
- C:\Windows\System\UaHKMjy.exe
  C:\Windows\System\UaHKMjy.exe
  2⤵
  PID:17012
- C:\Windows\System\URUvrtf.exe
  C:\Windows\System\URUvrtf.exe
  2⤵
  PID:17040
- C:\Windows\System\iwxbdtx.exe
  C:\Windows\System\iwxbdtx.exe
  2⤵
  PID:17064
- C:\Windows\System\hmTfLfP.exe
  C:\Windows\System\hmTfLfP.exe
  2⤵
  PID:17096
- C:\Windows\System\lfRaUFU.exe
  C:\Windows\System\lfRaUFU.exe
  2⤵
  PID:17120
- C:\Windows\System\vixcNxx.exe
  C:\Windows\System\vixcNxx.exe
  2⤵
  PID:17136
- C:\Windows\System\FNxMnku.exe
  C:\Windows\System\FNxMnku.exe
  2⤵
  PID:17152
- C:\Windows\System\UvoErsr.exe
  C:\Windows\System\UvoErsr.exe
  2⤵
  PID:17176
- C:\Windows\System\fUIadxR.exe
  C:\Windows\System\fUIadxR.exe
  2⤵
  PID:17192
- C:\Windows\System\BYOHizK.exe
  C:\Windows\System\BYOHizK.exe
  2⤵
  PID:17208
- C:\Windows\System\tJSfncL.exe
  C:\Windows\System\tJSfncL.exe
  2⤵
  PID:17224
- C:\Windows\System\uvNwhaG.exe
  C:\Windows\System\uvNwhaG.exe
  2⤵
  PID:17240
- C:\Windows\System\ogdpxzz.exe
  C:\Windows\System\ogdpxzz.exe
  2⤵
  PID:17256
- C:\Windows\System\QdIubpe.exe
  C:\Windows\System\QdIubpe.exe
  2⤵
  PID:17272
- C:\Windows\System\kFdhzGK.exe
  C:\Windows\System\kFdhzGK.exe
  2⤵
  PID:17300
- C:\Windows\System\WMZYQNG.exe
  C:\Windows\System\WMZYQNG.exe
  2⤵
  PID:17320
- C:\Windows\System\ktwWajA.exe
  C:\Windows\System\ktwWajA.exe
  2⤵
  PID:17344
- C:\Windows\System\kWTfxlE.exe
  C:\Windows\System\kWTfxlE.exe
  2⤵
  PID:17360
- C:\Windows\System\nENVYIx.exe
  C:\Windows\System\nENVYIx.exe
  2⤵
  PID:16560
- C:\Windows\System\bkILCEH.exe
  C:\Windows\System\bkILCEH.exe
  2⤵
  PID:16616
- C:\Windows\System\AHvqizx.exe
  C:\Windows\System\AHvqizx.exe
  2⤵
  PID:16608
- C:\Windows\System\gWSSZYd.exe
  C:\Windows\System\gWSSZYd.exe
  2⤵
  PID:16632
- C:\Windows\System\nuVZYSB.exe
  C:\Windows\System\nuVZYSB.exe
  2⤵
  PID:16672
- C:\Windows\System\JEdpotf.exe
  C:\Windows\System\JEdpotf.exe
  2⤵
  PID:16700
- C:\Windows\System\osWIAaf.exe
  C:\Windows\System\osWIAaf.exe
  2⤵
  PID:16844
- C:\Windows\System\fbLwYyr.exe
  C:\Windows\System\fbLwYyr.exe
  2⤵
  PID:17316
- C:\Windows\System\HFnCYis.exe
  C:\Windows\System\HFnCYis.exe
  2⤵
  PID:17204
- C:\Windows\System\WEOVOpx.exe
  C:\Windows\System\WEOVOpx.exe
  2⤵
  PID:16400
- C:\Windows\System\jRULgvb.exe
  C:\Windows\System\jRULgvb.exe
  2⤵
  PID:16476
- C:\Windows\System\LupHuBG.exe
  C:\Windows\System\LupHuBG.exe
  2⤵
  PID:228
- C:\Windows\System\SpRYNpf.exe
  C:\Windows\System\SpRYNpf.exe
  2⤵
  PID:16688

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AUOAgmG.exe

Filesize
1.6MB

MD5
b5c035478edd7ce628713cf41c9779f4

SHA1
d583cefa9ca54e9d6111ab5e821b24d07e7253fe

SHA256
e4ddfeac7ae2585a5c7ac296f273e9295cee6afd0fdd82fee7d6c543975878e5

SHA512
1b60bf552e3e965424438691e4beef4d185549eedf1395e7ebb5e7109481773a872fa6b85e5067c49df3d91a6d705aa1fe41e428105c78a9cb00e0a612e4f990

Download Submit
C:\Windows\System\BFHFMQT.exe

Filesize
1.6MB

MD5
8c542a535f0be115a144cc20bb895f20

SHA1
2a825fa4e58e331542b786a7e4fd16d32d62bf09

SHA256
906f9f18b68310ed66c45545c1f4788f826782ff618c4d2fbd2b13c9bc940b95

SHA512
fb18dde1e0f8d50a792c7431be2d76fe180afd0b1b2a116593449b8826839bf44b58470794985563d97d59c1f866c151361f920362115570e9f3484cdd55b6fe

Download Submit
C:\Windows\System\DJENnLN.exe

Filesize
1.6MB

MD5
c0514af7b92ddf7fa8120a314e31964b

SHA1
988a958bd5a556b4d83eb940801c49f579dba82a

SHA256
a8a261c4247302db26f1e30dc7610ed1d557e182917fc5b45b85a1edbef6c43d

SHA512
3c36bec8a7a9d9757d4c0709a4694e23481cce3d230fbb13c28677f9533a7ea67d902e58ef4602ed03d257da996cbc9ec9d138fb5442d0414922c74b4c9eb460

Download Submit
C:\Windows\System\DMhSmmE.exe

Filesize
1.6MB

MD5
f4787aa35fe450ceca0a67d5212cabf3

SHA1
37e38fa68e1c0a6a16d5d8e453b6b450a924ca68

SHA256
968289d4647bb5613048df63cea6e332ae5115f6744c1505f2b4a28b7cd55873

SHA512
848be29851f0495a61ff1c59051b5e5997286ae909f9bdd596362f97d3f70af18856ff19bb30a6a5c9fd3c4c8d629228409dc45c14f8e4e19b6588a252eec104

Download Submit
C:\Windows\System\IOsURlz.exe

Filesize
1.6MB

MD5
0a1bc9ea712657ee1ae8ebab12fd40d4

SHA1
b71d0cfb45eb7a526a4445bf7fd14b422507a310

SHA256
8399dc4c496472b0465cdb7ca8aa4f45182c2cb50d8b577755ee8287a0c5f4dd

SHA512
5818345e41f44de1be7176e1026798fc1fe8114ad9cb13db71707faaa4a5992be1563b3711bc13c71937434e93d059529f772ab577dd079d0c740a83af34f7b8

Download Submit
C:\Windows\System\LcvPbvO.exe

Filesize
1.6MB

MD5
b53cc14dd8c11577180bf0fc23d4079b

SHA1
7de933ecd8f0a00346e4c34e5f1e35e28a41b0ea

SHA256
ba2ff72ebf701f53a120e6dea9de48dd90309ba6f020ffb407367e6e0f6c6374

SHA512
5b7f60b21c0ae4ac1ae3c0ac7af5f8d6857c558f403dba76b5d44647492a760305f5c455e8249edfecff187a79b97effb8a7c6571d3ec573bd1ea1c8b6367d92

Download Submit
C:\Windows\System\MhPxTRH.exe

Filesize
1.6MB

MD5
013742f843b45a2fdbea05f457023444

SHA1
d63fc40c4520ca03f135e5c710849c8041cb5a4c

SHA256
338c2be08b374b4c6d1f78d7f735b13e621b939152c1f83c64a3fbe5b168c9b6

SHA512
9ebc70eaa8cc3080edd3345ffbad3e2a6499c259e3649e62dc4b61d179492b574293c4084f922d1547f06f83a99cb0fb2cfb641b37a0ecdfd5059ab6d7d5cf98

Download Submit
C:\Windows\System\NOPJzQD.exe

Filesize
1.6MB

MD5
6f73c385239bd4a91f418135d16cf756

SHA1
b1c435fe9db81a6c07f560addb7c5a8e7e7eb5a7

SHA256
63ce45d46a1151098924a56d581d1d6d531ae627fc876673338bc72e38053eae

SHA512
efca5fe3477746586ba0ee852721075afd15810cbff1a0c1bf28f6c667c06eb4b312cca858b77b4965cd81c5b49dc7b3ef36a7a8901298fa118d44a6528229dc

Download Submit
C:\Windows\System\OHoqwiJ.exe

Filesize
1.6MB

MD5
971a28aa3162c575869167aca73b8172

SHA1
9e779f1c258e02ad852ddb57f1a368760b9ddaa2

SHA256
aa2601b3b314ccb4aeaab2b1098c0d6b7598df49563568071207749c5611c8cf

SHA512
b06e48615c2113c8e6b49ffedbfa1c1c3b2043d354ea276362acd6740ffe475be85fd103c89acf5e0bf9d65820f841614f41ac1bd4e5f68613d69208bf0464ff

Download Submit
C:\Windows\System\OeBkkBm.exe

Filesize
1.6MB

MD5
ca44887fd6003cb94654691aff611d9d

SHA1
9971b258016fd2d90ef99fce394742ec98f838cc

SHA256
80e308cc785cd9bd0bcc5c076b0edd3db32a55a7bf8042b6b694ff7c18773954

SHA512
400d48f634da2b08a99a7b5f354a49b1b53c73c48ee9e548bf4adad5e3f82c97e7a56f14a6e010f8a4dbd03a2e029f451d81e26af35b7ee0a9767bb9261960ce

Download Submit
C:\Windows\System\OfWemjC.exe

Filesize
1.6MB

MD5
08014bee5e7f4aecddc3de90a5bf641d

SHA1
80abaa6a83250726483ec7e53e15cf3936a3e341

SHA256
bb46df789f909b2c1b83565561e641a190c2da10482c59f424a40bee04e282c2

SHA512
c138ee35b5d6e7fca5b1c6a4b6f71c49e7cbcc65387488ef09879c88977e4fd052b14cf91e480a59eb47d460f678b8ef912c948c174e6574a88495380b8020ec

Download Submit
C:\Windows\System\OpMoAhs.exe

Filesize
1.6MB

MD5
ed7c34907d1170029020d8ba3af2475b

SHA1
ed7d8c0644f45aa5b1ab4d5e093411cd44b3ff69

SHA256
ead501feb6456d0925755059bcb9b25b1f03c6c82c12d89e3a906aa852860dbb

SHA512
e5e424853dd9936f7f6bc1292afdc11bbf2bd49a2712818636904bd7a663dd7dcfb2041cb85571897136264f48835592ec00371fa135744e7ee34fe4eda4eb3d

Download Submit
C:\Windows\System\RmYGgYC.exe

Filesize
1.6MB

MD5
e047b6d86c174d6cd542e9da58bbef08

SHA1
42719a77faca608640620b0774e94b7f55f31799

SHA256
efcad2683f268e217dc54f73371f4998f361beaceb7c4f81a819a2ccc7044c3f

SHA512
d0ab05553dc4ed4c26a8fc4b97bd2e1f663bb010c3632c9e627a1012e7f0a329fae9c694df379d6894e1a0460bea5f7c10ae218b181dcfcfd52fb2d6d7b28e8a

Download Submit
C:\Windows\System\SgdzMJL.exe

Filesize
1.6MB

MD5
b09eac19b96f998fdd1384c5013cc39f

SHA1
44236c92c04f3069e142071ab16ce37bbe936566

SHA256
42a7a71e337ee2f26aa9336c3e47366fdec6b7be8f4b809e0039739d012f77c7

SHA512
88a3e04b402e5f7b405073e532238e43f156bae225ae2b675fa0fa5c5da90757a5b87da267b6f9e0b732c9d91c4b544e3b0676215d857ab72948fc6d73b1a0a9

Download Submit
C:\Windows\System\TWjNVzv.exe

Filesize
1.6MB

MD5
aa3bbb537dcbed31d6425a866eb566c8

SHA1
1efbf67bdffc5dfb14eda03dba67e472cfa4d8ba

SHA256
73021394d85b7fb3d02715b77c45d3a3cc5d7fc95150f263a07a530b29172227

SHA512
4255c2dbea0f7db337c58cf5df5ee73555903b819c633ff9fb01ee49672f7577c874690b1aa615f3a174b3b9d8d6b11f4107f527bf69e61ef1abbd8363cd9d68

Download Submit
C:\Windows\System\UzLwblg.exe

Filesize
1.6MB

MD5
70a97068fbaf942cd0abad7f9a138286

SHA1
ee2700152cf3b242613905148015c3d6592e034e

SHA256
25ec4bb2206f971531f75e37ca6c113a6f253fbccc1e32a9b34c65893234c337

SHA512
32f1864000e8c7e080affcc1feaa01797e5cf1b7e0cfe694611d4754a7aee9266afe0e62859bee9d656bedbd4456360c37149feb33c44c0e2fe80cbff48d8335

Download Submit
C:\Windows\System\WDrmIyz.exe

Filesize
1.6MB

MD5
b9feaee8aec83017c2aa531a08d6006e

SHA1
aa2277d1d32be7e066b3cba52479003663ac56fc

SHA256
dabc5f4ed6fee782131dfc7a7eb933726eb08c3a5c20d453db5d59152815d453

SHA512
b1ca42982bafb9dd99eb154f976f31f0ddfb6239a37642b3b8c959380e2f52fa68e252ed56cb1c175e9e48810f49570c1a5fb23ab2a7948a68a9a12f16a9e1ba

Download Submit
C:\Windows\System\WbSrMNs.exe

Filesize
1.6MB

MD5
6973bbe33f67e988342d36cf21d6b579

SHA1
e0801629a2570601a9365aa85054d11c06af7637

SHA256
32e2a33c9fc0a0d18ecf1ec3872d64ac2c035dc315476e046546f3c31adfd552

SHA512
f879f02b054be0329b815c39a4dd4d25090a43c34d8b74fb67c78930c12f6449ae0d5825ae6a117a5c8fcb5f9cb69387dcf7b598ba5f4533d337f8bbe8374c37

Download Submit
C:\Windows\System\XoSLQsW.exe

Filesize
1.6MB

MD5
2d820c89efe478174f54cdf4701c2ce0

SHA1
5719b530b5b957e3172e6898658d8b9d90c87eed

SHA256
b4f65d919c9a2179f89251a4fee0498eaffa524566fa78c148fb464fbca26409

SHA512
00f747fa1cdbef2288ecc7621f6384ef596b258df19c46d9b2555a85927a06a9ad88a4668dabce8987ffe4dedc5d7b5e261091f7e260a9bcf1348346e537ba9b

Download Submit
C:\Windows\System\XpNedqZ.exe

Filesize
1.6MB

MD5
76b32ef655ba3ee9120d3472cdd61b40

SHA1
f348f04b220e9c0f1e84a0418fa9a05758cd5d57

SHA256
7ce2836be870c050195f2469efbdfabbe8ff7489a0dd479226d4a18174242b85

SHA512
a471c1679b21b427e0352d62c211409e11f68f90228b4b71092c31a86af800785e55119bbcccff8660e3c4bac7250e67715defab8fcf42f2a74c3237d15b9a7f

Download Submit
C:\Windows\System\ZEjyJVr.exe

Filesize
1.6MB

MD5
7ab66dd62fc653360e4d442e70609f7f

SHA1
210ce13a7136a18b98d870ede739498fea2e79f4

SHA256
969a6d18c099c08eebcce0f7e8e1906575cf5a30da4b3d6d68ddad1c8d802cfe

SHA512
c1eb80a858a7548ea186bcddb7e85a69363b6aee1d9d610f4e3b19710628ceadd619173143ef18f81623c8c1daf693db962ab7a54f876a5071d1164aff900e1e

Download Submit
C:\Windows\System\bzkNzlr.exe

Filesize
1.6MB

MD5
6eb11f09bcf47f4b4b542ff383b8ee7f

SHA1
57a87c32f6395843ad190c3a0fd6cde03b19a925

SHA256
46c1bfa360e0800159fa8138784b16415e176b3a7966622aa8ba11c65a99374f

SHA512
f080d30d57c6c96f3a2d3864c84142810588aa4b482b9ea2cc4241e2ad77a78f443af63141b4a4eb504e333ccdbb171d58c0017f2aa62242a26edbb6f9ec233b

Download Submit
C:\Windows\System\eLlfvwZ.exe

Filesize
1.6MB

MD5
d35f3d3f8bd83bcad8acb425ddf6be81

SHA1
d62d1ac8ef70e1df429d7782b134cb431ed272ba

SHA256
db9e140ae0a966a3222bdfdb636567b4219880ed17c826cc907b542de0baa302

SHA512
af05a698ee551874d0c30ba48828a509e3143d66eb6d29622cde1824d161b02bc061c8bf283d27da80fafb379cb4248769df047cc2dd84079a3ec82b1488f00c

Download Submit
C:\Windows\System\gtvmIGF.exe

Filesize
1.6MB

MD5
78ed9a60f2e51beff1c922432781cb3d

SHA1
9a25c464d5e57fa60ea917e061c59e7bea9df2cc

SHA256
db1e764b7523e9688d99f472a0050cd440eda2aeaab6dd7b24b32c511e49de6e

SHA512
c74715309d24c567ef66fa04c8aa6ad1a48cabc3b957ba10af1337b0094199fc71579aa95595dd2e9afd1954bd6f4fa42b907817583d33ec92fef1bd3e20227c

Download Submit
C:\Windows\System\iYUBDLZ.exe

Filesize
1.6MB

MD5
ed22bd7f67b149be5739d361d2c1e17d

SHA1
5809f79d746d1675d74a8c1bae34e3bccde091c3

SHA256
970165c82203e7bad296d810c6fe9770bb0b125bd8d87ebf098700c0baf3c4b0

SHA512
df64122184e52320509b95dab24c6f15621fa1c9d64856d51d384f3c103a07cab9540eb7b137347cc0d6715b8e98dfe364cf397041f99107627991d4d79d5e5c

Download Submit
C:\Windows\System\kYVzCfw.exe

Filesize
1.6MB

MD5
9dc1d7f19fbdbe0b4c471010fa2b8dfc

SHA1
71be5224c805b822dbad6b473607cbb2500accc1

SHA256
d6c22cab40d073174b11c6b9b50a1544e1878b4ab687287b026ad664a1dfc876

SHA512
cf460d4a4c565b1e15a929ccf70b3877f5384124d0bec48abe2d5400310c3d4b81e00e094d1f6015522731a64a08b0833cb6c10ede28bd3568eaa4486adae795

Download Submit
C:\Windows\System\omVqmuK.exe

Filesize
1.6MB

MD5
ed0468a27912a8128d490bd245319aa9

SHA1
531058a81a51a4133cf2f43076e511504885cecf

SHA256
4ec8b65d544fff5c226c2f34753a297fc2961100bfce76d61ac7a046ff197f3f

SHA512
5320e2b86eeea23b08b8b622218d5b0506ed5e56a44f5a87d7e71ad6cc58e4063389c9ee209cc19afba9506125b7098b4b0efb4b31d2b729f54d5e6f4cd77558

Download Submit
C:\Windows\System\sTRbSFo.exe

Filesize
1.6MB

MD5
4b047653308a3dd1e6edf07f5127c920

SHA1
1cad6d04908a95f3fe79b6ffe2b0779329e30c13

SHA256
ba7ae7a44335ef47f4795bba59c21825adbe0d77b9fee8efa19f0c9424fe2675

SHA512
0c486405a7beb7187274e1724a757685814c4dda7645db1c2b5cefd56d23973c39ba8daefeff24498eed4a678847b81df5938e8a0790aadc68e4b42e6a062e40

Download Submit
C:\Windows\System\tLVUJDJ.exe

Filesize
1.6MB

MD5
274dad97a25f4a50704734bb6499b9c1

SHA1
b075d594c718b5316d7890e4c621cb231db0f77c

SHA256
9996dcb61d72736950d2b54cc40cd0dcf9ec857db974b43d28dcbf7ed2cfb53b

SHA512
4436c3cf7d076036a060b412990eb4a3a45cccaf4b2470784a446577fcb69c51ff24f50f55a036245329088f2290afc0a4ba48be5b6fa1ecdd8934d45422597b

Download Submit
C:\Windows\System\ujYIeiU.exe

Filesize
1.6MB

MD5
11598ae5d35e3277e83ce713b4e4539e

SHA1
515d6f85ff264b81463aef565c06d159c055a209

SHA256
1e5e59b0a3c3f61c7701422bea4d6eb53587b32303d0735a74417def2f67aa20

SHA512
bf194c58392f36308cdcf999385e84749dd510c9982b01e728732bd6d62c787e393661750590c8f1883854abd2ef01e03a3f6ca47cd9b998e41d1ad83f420f1e

Download Submit
C:\Windows\System\xHHEwWB.exe

Filesize
1.6MB

MD5
d78c2a387b9057b2b3ef87c47ddc94a5

SHA1
8d2c603f7790d03673e89b34bfbe13d7f77cc7f8

SHA256
3cfea1e61e99a8bd7a7eb1c6cdecde3e2586873c250fe5ecf9c18c985954bcd5

SHA512
eb175d394ea8f3c38d7bec03bae9cc478619dc983d8d1b2e311b28732e3ef008a666751ea3a6056f8f79ce9452acafc32669904244738db9da15df169e3aa087

Download Submit
C:\Windows\System\yIAhQld.exe

Filesize
1.6MB

MD5
71c6a82227a7642b4aaa10bc77d0a6ba

SHA1
35aeddb7fe056585ff147ee4f586ae26b89884dd

SHA256
43e485c81b43bdc9b916e1bfad0919ca5150752d3d9d5e127a54f6a9038dd07a

SHA512
a961a288167c6568204f1ef5bf5f18f5114a6e0171d91052725c8036103ec8019cb8f3b2d82e49c5ea71a1e246ff6ded2c91eeafb201bc577e93fbe0976d0b00

Download Submit
memory/4716-0-0x0000023AAA490000-0x0000023AAA4A0000-memory.dmp

Filesize
64KB

Download