xmrig | 2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a

Analysis

max time kernel
134s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
Size

1.7MB
MD5

deda8fec956f9674f63f1dfdbdb31259
SHA1

24c1dc49427b0b516a8e2a6e189bc734befa3811
SHA256

2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a
SHA512

69b24d4d0fe852441a6bd169abf5dff2b9fb8925b609908b054f540cafe3ee99a79020eacb8f36cb34013681f97beca6328949f37d25f5015bb84463a3617d4c
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnmxZ7pHX:GemTLkNdfE0pZy4

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

Processes:

resource	yara_rule
C:\Windows\System\MDtKJZH.exe	xmrig
C:\Windows\System\jkWOPEr.exe	xmrig
C:\Windows\System\mhTdhox.exe	xmrig
C:\Windows\System\lKwHiAR.exe	xmrig
C:\Windows\System\XNpqAsJ.exe	xmrig
C:\Windows\System\zxJuRuB.exe	xmrig
C:\Windows\System\finYbYS.exe	xmrig
C:\Windows\System\YyquUyM.exe	xmrig
C:\Windows\System\BtyDTsQ.exe	xmrig
C:\Windows\System\SVQLxTM.exe	xmrig
C:\Windows\System\atMtjbz.exe	xmrig
C:\Windows\System\fTqHFJm.exe	xmrig
C:\Windows\System\hXOXIex.exe	xmrig
C:\Windows\System\npajMSS.exe	xmrig
C:\Windows\System\YbvnXsg.exe	xmrig
C:\Windows\System\kMGoNlv.exe	xmrig
C:\Windows\System\YOgRiSA.exe	xmrig
C:\Windows\System\wKExMhJ.exe	xmrig
C:\Windows\System\QPajAPH.exe	xmrig
C:\Windows\System\ZdOkenU.exe	xmrig
C:\Windows\System\LoUPYMm.exe	xmrig
C:\Windows\System\WSejCqB.exe	xmrig
C:\Windows\System\NBiZxdt.exe	xmrig
C:\Windows\System\JfiuqGh.exe	xmrig
C:\Windows\System\xEXEWaI.exe	xmrig
C:\Windows\System\fduKxPH.exe	xmrig
C:\Windows\System\JdMKktI.exe	xmrig
C:\Windows\System\NtRyxbk.exe	xmrig
C:\Windows\System\eMSXoSL.exe	xmrig
C:\Windows\System\tsnFLbu.exe	xmrig
C:\Windows\System\ACKhDXx.exe	xmrig
C:\Windows\System\BxcMQBq.exe	xmrig
C:\Windows\System\rtiBBip.exe	xmrig
C:\Windows\System\uisBLFO.exe	xmrig

Executes dropped EXE 64 IoCs

Processes:

MDtKJZH.exemhTdhox.exejkWOPEr.exelKwHiAR.exeXNpqAsJ.exezxJuRuB.exekMGoNlv.exefinYbYS.exeYbvnXsg.exeYyquUyM.exeBtyDTsQ.exeSVQLxTM.exehXOXIex.exenpajMSS.exefTqHFJm.exeatMtjbz.exeYOgRiSA.exewKExMhJ.exertiBBip.exeuisBLFO.exeBxcMQBq.exefduKxPH.exeQPajAPH.exeeMSXoSL.exeACKhDXx.exeZdOkenU.exetsnFLbu.exeJfiuqGh.exeLoUPYMm.exeNtRyxbk.exeJdMKktI.exexEXEWaI.exeWSejCqB.exeNBiZxdt.exexEtDBGi.exeARJxKzh.exeZdnUtoQ.exedlosktk.exeLJcVncN.exeZFUVICM.exeYfPRlJx.exenfDyaok.exeLAzRhKs.exedVTGpWf.exeKVvhhJk.exeMCFlyxS.exeysIDiDE.exesYkQJtf.exeYaaanxz.execfroEPM.exeYSNEYis.exeGgYOmpJ.exeycefelt.exegHnCSeB.exelcRHmOB.exeWLZWyEE.exejDcDDyE.exeKwHYFzz.exeQhrHaFg.exekHDSUSa.exeQxjNJRy.exemQbnyHS.exeExFUjAh.exeeDncKBk.exe

pid	process
1780	MDtKJZH.exe
2788	mhTdhox.exe
4408	jkWOPEr.exe
824	lKwHiAR.exe
60	XNpqAsJ.exe
2812	zxJuRuB.exe
1632	kMGoNlv.exe
4776	finYbYS.exe
1532	YbvnXsg.exe
1556	YyquUyM.exe
4996	BtyDTsQ.exe
1444	SVQLxTM.exe
524	hXOXIex.exe
2072	npajMSS.exe
2032	fTqHFJm.exe
2744	atMtjbz.exe
3492	YOgRiSA.exe
1732	wKExMhJ.exe
1216	rtiBBip.exe
4448	uisBLFO.exe
1628	BxcMQBq.exe
708	fduKxPH.exe
4944	QPajAPH.exe
4428	eMSXoSL.exe
4020	ACKhDXx.exe
1864	ZdOkenU.exe
4664	tsnFLbu.exe
4512	JfiuqGh.exe
1304	LoUPYMm.exe
2664	NtRyxbk.exe
3708	JdMKktI.exe
1516	xEXEWaI.exe
4824	WSejCqB.exe
2300	NBiZxdt.exe
3324	xEtDBGi.exe
4208	ARJxKzh.exe
3096	ZdnUtoQ.exe
3548	dlosktk.exe
1540	LJcVncN.exe
3564	ZFUVICM.exe
3288	YfPRlJx.exe
1984	nfDyaok.exe
1976	LAzRhKs.exe
2532	dVTGpWf.exe
3404	KVvhhJk.exe
3388	MCFlyxS.exe
1396	ysIDiDE.exe
304	sYkQJtf.exe
2096	Yaaanxz.exe
2056	cfroEPM.exe
2288	YSNEYis.exe
4588	GgYOmpJ.exe
620	ycefelt.exe
3052	gHnCSeB.exe
4884	lcRHmOB.exe
2440	WLZWyEE.exe
1500	jDcDDyE.exe
1964	KwHYFzz.exe
1020	QhrHaFg.exe
2748	kHDSUSa.exe
4304	QxjNJRy.exe
2620	mQbnyHS.exe
2804	ExFUjAh.exe
4572	eDncKBk.exe

Drops file in Windows directory 64 IoCs

Processes:

2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe

description	ioc	process
File created	C:\Windows\System\eDncKBk.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\KaKnfny.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\JdoZIfs.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\RyRgiHa.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\UqhZLfO.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\tMhkTMF.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\aSHrLCm.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\MCnhhIQ.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\pCqiEUy.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\YCJIiwH.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\xxeBLZZ.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\xVvRLPb.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\LkVKBAV.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\ygDQrWw.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\yfoxdMn.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\UXwPjhb.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\jZITlQI.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\cqvjkWy.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\SELenAz.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\WtwGWfK.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\KegcPbe.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\JksZxXD.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\HpMaEzy.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\FZniDUF.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\VOjtUiL.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\NjXgPLb.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\Bjilotg.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\aChCODp.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\BuSyOrF.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\akKSWkV.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\EeWRFwa.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\ZCYcrKV.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\YbvnXsg.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\vaRuhTn.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\nIffZZr.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\KYREcjF.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\RzTSXDU.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\HLFfiXT.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\sYkQJtf.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\WodUYiR.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\SyJhQLI.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\GOLcZEk.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\OIXsEcF.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\LUMpOCI.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\xiNPNAj.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\UwFrvqo.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\wjJLMxi.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\yERNtII.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\dudIJeJ.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\tcDQNAL.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\rLhVHln.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\omwiqDM.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\ZubESkt.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\voaAZCJ.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\XkAgCOD.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\ybwndwN.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\PklbvnY.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\GNXlytO.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\tWGXfXB.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\KwHYFzz.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\RdyYmOi.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\kiYWRav.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\ZhMwmpJ.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
File created	C:\Windows\System\RmZhyGV.exe	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

Processes:

dwm.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Modifies registry class 1 IoCs

Processes:

StartMenuExperienceHost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

dwm.exedwm.exe

description	pid	process
Token: SeCreateGlobalPrivilege	17340	dwm.exe
Token: SeChangeNotifyPrivilege	17340	dwm.exe
Token: 33	17340	dwm.exe
Token: SeIncBasePriorityPrivilege	17340	dwm.exe
Token: SeCreateGlobalPrivilege	17240	dwm.exe
Token: SeChangeNotifyPrivilege	17240	dwm.exe
Token: 33	17240	dwm.exe
Token: SeIncBasePriorityPrivilege	17240	dwm.exe
Token: SeShutdownPrivilege	17240	dwm.exe
Token: SeCreatePagefilePrivilege	17240	dwm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

StartMenuExperienceHost.exe

pid process

2488 StartMenuExperienceHost.exe

pid	process
2488	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe

description	pid	process	target process
PID 2172 wrote to memory of 1780	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	MDtKJZH.exe
PID 2172 wrote to memory of 1780	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	MDtKJZH.exe
PID 2172 wrote to memory of 2788	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	mhTdhox.exe
PID 2172 wrote to memory of 2788	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	mhTdhox.exe
PID 2172 wrote to memory of 4408	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	jkWOPEr.exe
PID 2172 wrote to memory of 4408	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	jkWOPEr.exe
PID 2172 wrote to memory of 824	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	lKwHiAR.exe
PID 2172 wrote to memory of 824	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	lKwHiAR.exe
PID 2172 wrote to memory of 60	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	XNpqAsJ.exe
PID 2172 wrote to memory of 60	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	XNpqAsJ.exe
PID 2172 wrote to memory of 2812	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	zxJuRuB.exe
PID 2172 wrote to memory of 2812	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	zxJuRuB.exe
PID 2172 wrote to memory of 1632	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	kMGoNlv.exe
PID 2172 wrote to memory of 1632	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	kMGoNlv.exe
PID 2172 wrote to memory of 4776	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	finYbYS.exe
PID 2172 wrote to memory of 4776	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	finYbYS.exe
PID 2172 wrote to memory of 1532	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	YbvnXsg.exe
PID 2172 wrote to memory of 1532	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	YbvnXsg.exe
PID 2172 wrote to memory of 1556	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	YyquUyM.exe
PID 2172 wrote to memory of 1556	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	YyquUyM.exe
PID 2172 wrote to memory of 4996	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	BtyDTsQ.exe
PID 2172 wrote to memory of 4996	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	BtyDTsQ.exe
PID 2172 wrote to memory of 1444	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	SVQLxTM.exe
PID 2172 wrote to memory of 1444	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	SVQLxTM.exe
PID 2172 wrote to memory of 524	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	hXOXIex.exe
PID 2172 wrote to memory of 524	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	hXOXIex.exe
PID 2172 wrote to memory of 2072	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	npajMSS.exe
PID 2172 wrote to memory of 2072	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	npajMSS.exe
PID 2172 wrote to memory of 2032	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	fTqHFJm.exe
PID 2172 wrote to memory of 2032	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	fTqHFJm.exe
PID 2172 wrote to memory of 2744	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	atMtjbz.exe
PID 2172 wrote to memory of 2744	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	atMtjbz.exe
PID 2172 wrote to memory of 3492	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	YOgRiSA.exe
PID 2172 wrote to memory of 3492	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	YOgRiSA.exe
PID 2172 wrote to memory of 1732	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	wKExMhJ.exe
PID 2172 wrote to memory of 1732	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	wKExMhJ.exe
PID 2172 wrote to memory of 1216	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	rtiBBip.exe
PID 2172 wrote to memory of 1216	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	rtiBBip.exe
PID 2172 wrote to memory of 4448	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	uisBLFO.exe
PID 2172 wrote to memory of 4448	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	uisBLFO.exe
PID 2172 wrote to memory of 1628	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	BxcMQBq.exe
PID 2172 wrote to memory of 1628	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	BxcMQBq.exe
PID 2172 wrote to memory of 708	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	fduKxPH.exe
PID 2172 wrote to memory of 708	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	fduKxPH.exe
PID 2172 wrote to memory of 4944	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	QPajAPH.exe
PID 2172 wrote to memory of 4944	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	QPajAPH.exe
PID 2172 wrote to memory of 4428	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	eMSXoSL.exe
PID 2172 wrote to memory of 4428	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	eMSXoSL.exe
PID 2172 wrote to memory of 4020	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	ACKhDXx.exe
PID 2172 wrote to memory of 4020	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	ACKhDXx.exe
PID 2172 wrote to memory of 1864	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	ZdOkenU.exe
PID 2172 wrote to memory of 1864	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	ZdOkenU.exe
PID 2172 wrote to memory of 4664	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	tsnFLbu.exe
PID 2172 wrote to memory of 4664	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	tsnFLbu.exe
PID 2172 wrote to memory of 4512	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	JfiuqGh.exe
PID 2172 wrote to memory of 4512	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	JfiuqGh.exe
PID 2172 wrote to memory of 3708	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	JdMKktI.exe
PID 2172 wrote to memory of 3708	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	JdMKktI.exe
PID 2172 wrote to memory of 1304	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	LoUPYMm.exe
PID 2172 wrote to memory of 1304	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	LoUPYMm.exe
PID 2172 wrote to memory of 2664	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	NtRyxbk.exe
PID 2172 wrote to memory of 2664	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	NtRyxbk.exe
PID 2172 wrote to memory of 1516	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	xEXEWaI.exe
PID 2172 wrote to memory of 1516	2172	2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe	xEXEWaI.exe

C:\Users\Admin\AppData\Local\Temp\2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe
"C:\Users\Admin\AppData\Local\Temp\2bf8c959c20d0448b11507207dcc8c1569723f71022367887d5a901d4b916d0a.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\System\MDtKJZH.exe
  C:\Windows\System\MDtKJZH.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\mhTdhox.exe
  C:\Windows\System\mhTdhox.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\jkWOPEr.exe
  C:\Windows\System\jkWOPEr.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\lKwHiAR.exe
  C:\Windows\System\lKwHiAR.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\XNpqAsJ.exe
  C:\Windows\System\XNpqAsJ.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\zxJuRuB.exe
  C:\Windows\System\zxJuRuB.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\kMGoNlv.exe
  C:\Windows\System\kMGoNlv.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\finYbYS.exe
  C:\Windows\System\finYbYS.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\YbvnXsg.exe
  C:\Windows\System\YbvnXsg.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\YyquUyM.exe
  C:\Windows\System\YyquUyM.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\BtyDTsQ.exe
  C:\Windows\System\BtyDTsQ.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\SVQLxTM.exe
  C:\Windows\System\SVQLxTM.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\hXOXIex.exe
  C:\Windows\System\hXOXIex.exe
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\System\npajMSS.exe
  C:\Windows\System\npajMSS.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\fTqHFJm.exe
  C:\Windows\System\fTqHFJm.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\atMtjbz.exe
  C:\Windows\System\atMtjbz.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\YOgRiSA.exe
  C:\Windows\System\YOgRiSA.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\wKExMhJ.exe
  C:\Windows\System\wKExMhJ.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\rtiBBip.exe
  C:\Windows\System\rtiBBip.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\uisBLFO.exe
  C:\Windows\System\uisBLFO.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\BxcMQBq.exe
  C:\Windows\System\BxcMQBq.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\fduKxPH.exe
  C:\Windows\System\fduKxPH.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\QPajAPH.exe
  C:\Windows\System\QPajAPH.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\eMSXoSL.exe
  C:\Windows\System\eMSXoSL.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\ACKhDXx.exe
  C:\Windows\System\ACKhDXx.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\ZdOkenU.exe
  C:\Windows\System\ZdOkenU.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\tsnFLbu.exe
  C:\Windows\System\tsnFLbu.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\JfiuqGh.exe
  C:\Windows\System\JfiuqGh.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\JdMKktI.exe
  C:\Windows\System\JdMKktI.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\LoUPYMm.exe
  C:\Windows\System\LoUPYMm.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\NtRyxbk.exe
  C:\Windows\System\NtRyxbk.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\xEXEWaI.exe
  C:\Windows\System\xEXEWaI.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\WSejCqB.exe
  C:\Windows\System\WSejCqB.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\NBiZxdt.exe
  C:\Windows\System\NBiZxdt.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\xEtDBGi.exe
  C:\Windows\System\xEtDBGi.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\ARJxKzh.exe
  C:\Windows\System\ARJxKzh.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\ZdnUtoQ.exe
  C:\Windows\System\ZdnUtoQ.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\dlosktk.exe
  C:\Windows\System\dlosktk.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\LJcVncN.exe
  C:\Windows\System\LJcVncN.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\ZFUVICM.exe
  C:\Windows\System\ZFUVICM.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\YfPRlJx.exe
  C:\Windows\System\YfPRlJx.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\nfDyaok.exe
  C:\Windows\System\nfDyaok.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\LAzRhKs.exe
  C:\Windows\System\LAzRhKs.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\dVTGpWf.exe
  C:\Windows\System\dVTGpWf.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\KVvhhJk.exe
  C:\Windows\System\KVvhhJk.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\MCFlyxS.exe
  C:\Windows\System\MCFlyxS.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\ysIDiDE.exe
  C:\Windows\System\ysIDiDE.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\sYkQJtf.exe
  C:\Windows\System\sYkQJtf.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\cfroEPM.exe
  C:\Windows\System\cfroEPM.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\Yaaanxz.exe
  C:\Windows\System\Yaaanxz.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\YSNEYis.exe
  C:\Windows\System\YSNEYis.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\GgYOmpJ.exe
  C:\Windows\System\GgYOmpJ.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\ycefelt.exe
  C:\Windows\System\ycefelt.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\gHnCSeB.exe
  C:\Windows\System\gHnCSeB.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\lcRHmOB.exe
  C:\Windows\System\lcRHmOB.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\WLZWyEE.exe
  C:\Windows\System\WLZWyEE.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\jDcDDyE.exe
  C:\Windows\System\jDcDDyE.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\KwHYFzz.exe
  C:\Windows\System\KwHYFzz.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\QhrHaFg.exe
  C:\Windows\System\QhrHaFg.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\kHDSUSa.exe
  C:\Windows\System\kHDSUSa.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\QxjNJRy.exe
  C:\Windows\System\QxjNJRy.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\mQbnyHS.exe
  C:\Windows\System\mQbnyHS.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\ExFUjAh.exe
  C:\Windows\System\ExFUjAh.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\eDncKBk.exe
  C:\Windows\System\eDncKBk.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\qecpamJ.exe
  C:\Windows\System\qecpamJ.exe
  2⤵
  PID:1192
- C:\Windows\System\rZDgeLa.exe
  C:\Windows\System\rZDgeLa.exe
  2⤵
  PID:1544
- C:\Windows\System\MneUvbI.exe
  C:\Windows\System\MneUvbI.exe
  2⤵
  PID:3472
- C:\Windows\System\jazjDej.exe
  C:\Windows\System\jazjDej.exe
  2⤵
  PID:1364
- C:\Windows\System\KntNhyP.exe
  C:\Windows\System\KntNhyP.exe
  2⤵
  PID:4108
- C:\Windows\System\yBIObwB.exe
  C:\Windows\System\yBIObwB.exe
  2⤵
  PID:440
- C:\Windows\System\tfhPsiL.exe
  C:\Windows\System\tfhPsiL.exe
  2⤵
  PID:3040
- C:\Windows\System\ByUoQrL.exe
  C:\Windows\System\ByUoQrL.exe
  2⤵
  PID:2992
- C:\Windows\System\nGgNsbg.exe
  C:\Windows\System\nGgNsbg.exe
  2⤵
  PID:4220
- C:\Windows\System\AEYfRBA.exe
  C:\Windows\System\AEYfRBA.exe
  2⤵
  PID:376
- C:\Windows\System\XalSbCA.exe
  C:\Windows\System\XalSbCA.exe
  2⤵
  PID:1812
- C:\Windows\System\HxxNkbN.exe
  C:\Windows\System\HxxNkbN.exe
  2⤵
  PID:2264
- C:\Windows\System\QqZfubG.exe
  C:\Windows\System\QqZfubG.exe
  2⤵
  PID:768
- C:\Windows\System\qURhNxQ.exe
  C:\Windows\System\qURhNxQ.exe
  2⤵
  PID:1892
- C:\Windows\System\UpFKBah.exe
  C:\Windows\System\UpFKBah.exe
  2⤵
  PID:1196
- C:\Windows\System\jMzNNWi.exe
  C:\Windows\System\jMzNNWi.exe
  2⤵
  PID:2604
- C:\Windows\System\GftvExA.exe
  C:\Windows\System\GftvExA.exe
  2⤵
  PID:4452
- C:\Windows\System\CbLlWGV.exe
  C:\Windows\System\CbLlWGV.exe
  2⤵
  PID:3520
- C:\Windows\System\IQiKRuP.exe
  C:\Windows\System\IQiKRuP.exe
  2⤵
  PID:2736
- C:\Windows\System\HuTlcjE.exe
  C:\Windows\System\HuTlcjE.exe
  2⤵
  PID:2200
- C:\Windows\System\hHefBxH.exe
  C:\Windows\System\hHefBxH.exe
  2⤵
  PID:4284
- C:\Windows\System\bnvEIVS.exe
  C:\Windows\System\bnvEIVS.exe
  2⤵
  PID:1916
- C:\Windows\System\vihJNSW.exe
  C:\Windows\System\vihJNSW.exe
  2⤵
  PID:1168
- C:\Windows\System\CpecoUM.exe
  C:\Windows\System\CpecoUM.exe
  2⤵
  PID:1468
- C:\Windows\System\QYaGiEI.exe
  C:\Windows\System\QYaGiEI.exe
  2⤵
  PID:1524
- C:\Windows\System\vpUXHJr.exe
  C:\Windows\System\vpUXHJr.exe
  2⤵
  PID:908
- C:\Windows\System\lbRuehq.exe
  C:\Windows\System\lbRuehq.exe
  2⤵
  PID:4056
- C:\Windows\System\sKLwCfe.exe
  C:\Windows\System\sKLwCfe.exe
  2⤵
  PID:1172
- C:\Windows\System\yUVOdJE.exe
  C:\Windows\System\yUVOdJE.exe
  2⤵
  PID:5132
- C:\Windows\System\UHuYrlL.exe
  C:\Windows\System\UHuYrlL.exe
  2⤵
  PID:5164
- C:\Windows\System\GaKwaZi.exe
  C:\Windows\System\GaKwaZi.exe
  2⤵
  PID:5240
- C:\Windows\System\OLbbGgp.exe
  C:\Windows\System\OLbbGgp.exe
  2⤵
  PID:5272
- C:\Windows\System\nzHVHWa.exe
  C:\Windows\System\nzHVHWa.exe
  2⤵
  PID:5300
- C:\Windows\System\WhhsDMO.exe
  C:\Windows\System\WhhsDMO.exe
  2⤵
  PID:5316
- C:\Windows\System\HaUxGOP.exe
  C:\Windows\System\HaUxGOP.exe
  2⤵
  PID:5344
- C:\Windows\System\WjRPkVq.exe
  C:\Windows\System\WjRPkVq.exe
  2⤵
  PID:5372
- C:\Windows\System\mgIxkJU.exe
  C:\Windows\System\mgIxkJU.exe
  2⤵
  PID:5400
- C:\Windows\System\LmsOiCQ.exe
  C:\Windows\System\LmsOiCQ.exe
  2⤵
  PID:5428
- C:\Windows\System\OtnxoWd.exe
  C:\Windows\System\OtnxoWd.exe
  2⤵
  PID:5460
- C:\Windows\System\oUcwnoC.exe
  C:\Windows\System\oUcwnoC.exe
  2⤵
  PID:5484
- C:\Windows\System\IrfzPeq.exe
  C:\Windows\System\IrfzPeq.exe
  2⤵
  PID:5512
- C:\Windows\System\uaaBLQG.exe
  C:\Windows\System\uaaBLQG.exe
  2⤵
  PID:5528
- C:\Windows\System\bifOsOy.exe
  C:\Windows\System\bifOsOy.exe
  2⤵
  PID:5560
- C:\Windows\System\UNwlyrp.exe
  C:\Windows\System\UNwlyrp.exe
  2⤵
  PID:5596
- C:\Windows\System\eCtdBiJ.exe
  C:\Windows\System\eCtdBiJ.exe
  2⤵
  PID:5628
- C:\Windows\System\EhAnJFg.exe
  C:\Windows\System\EhAnJFg.exe
  2⤵
  PID:5652
- C:\Windows\System\WtMlePi.exe
  C:\Windows\System\WtMlePi.exe
  2⤵
  PID:5692
- C:\Windows\System\rtTmfDY.exe
  C:\Windows\System\rtTmfDY.exe
  2⤵
  PID:5720
- C:\Windows\System\yCKsOwU.exe
  C:\Windows\System\yCKsOwU.exe
  2⤵
  PID:5736
- C:\Windows\System\eCPNjnv.exe
  C:\Windows\System\eCPNjnv.exe
  2⤵
  PID:5768
- C:\Windows\System\dHXNhOR.exe
  C:\Windows\System\dHXNhOR.exe
  2⤵
  PID:5796
- C:\Windows\System\yWIArNW.exe
  C:\Windows\System\yWIArNW.exe
  2⤵
  PID:5828
- C:\Windows\System\YCJIiwH.exe
  C:\Windows\System\YCJIiwH.exe
  2⤵
  PID:5848
- C:\Windows\System\vaRuhTn.exe
  C:\Windows\System\vaRuhTn.exe
  2⤵
  PID:5872
- C:\Windows\System\mKrKJmx.exe
  C:\Windows\System\mKrKJmx.exe
  2⤵
  PID:5908
- C:\Windows\System\WCQWyKF.exe
  C:\Windows\System\WCQWyKF.exe
  2⤵
  PID:5936
- C:\Windows\System\JKHRwYY.exe
  C:\Windows\System\JKHRwYY.exe
  2⤵
  PID:5960
- C:\Windows\System\TRRpoTo.exe
  C:\Windows\System\TRRpoTo.exe
  2⤵
  PID:5992
- C:\Windows\System\jZmyzBO.exe
  C:\Windows\System\jZmyzBO.exe
  2⤵
  PID:6024
- C:\Windows\System\oCowjNM.exe
  C:\Windows\System\oCowjNM.exe
  2⤵
  PID:6072
- C:\Windows\System\NfPpzlW.exe
  C:\Windows\System\NfPpzlW.exe
  2⤵
  PID:6092
- C:\Windows\System\MWtBDIs.exe
  C:\Windows\System\MWtBDIs.exe
  2⤵
  PID:6116
- C:\Windows\System\EsYExRJ.exe
  C:\Windows\System\EsYExRJ.exe
  2⤵
  PID:1784
- C:\Windows\System\yfoxdMn.exe
  C:\Windows\System\yfoxdMn.exe
  2⤵
  PID:4704
- C:\Windows\System\XcuNEaA.exe
  C:\Windows\System\XcuNEaA.exe
  2⤵
  PID:5124
- C:\Windows\System\FgwzgCT.exe
  C:\Windows\System\FgwzgCT.exe
  2⤵
  PID:5220
- C:\Windows\System\GZflKCY.exe
  C:\Windows\System\GZflKCY.exe
  2⤵
  PID:5296
- C:\Windows\System\RyRgiHa.exe
  C:\Windows\System\RyRgiHa.exe
  2⤵
  PID:5364
- C:\Windows\System\CjrfAZJ.exe
  C:\Windows\System\CjrfAZJ.exe
  2⤵
  PID:5440
- C:\Windows\System\LZiPWzA.exe
  C:\Windows\System\LZiPWzA.exe
  2⤵
  PID:5452
- C:\Windows\System\JHETLNM.exe
  C:\Windows\System\JHETLNM.exe
  2⤵
  PID:5584
- C:\Windows\System\ccPzpiI.exe
  C:\Windows\System\ccPzpiI.exe
  2⤵
  PID:5608
- C:\Windows\System\dxEAtJO.exe
  C:\Windows\System\dxEAtJO.exe
  2⤵
  PID:5680
- C:\Windows\System\FhbryfO.exe
  C:\Windows\System\FhbryfO.exe
  2⤵
  PID:5760
- C:\Windows\System\CxKVVQc.exe
  C:\Windows\System\CxKVVQc.exe
  2⤵
  PID:5816
- C:\Windows\System\DZPBnVM.exe
  C:\Windows\System\DZPBnVM.exe
  2⤵
  PID:5896
- C:\Windows\System\QiVGIbu.exe
  C:\Windows\System\QiVGIbu.exe
  2⤵
  PID:5944
- C:\Windows\System\XkAgCOD.exe
  C:\Windows\System\XkAgCOD.exe
  2⤵
  PID:5980
- C:\Windows\System\nIffZZr.exe
  C:\Windows\System\nIffZZr.exe
  2⤵
  PID:6108
- C:\Windows\System\dWvLTOp.exe
  C:\Windows\System\dWvLTOp.exe
  2⤵
  PID:6136
- C:\Windows\System\svepfle.exe
  C:\Windows\System\svepfle.exe
  2⤵
  PID:5148
- C:\Windows\System\ZubESkt.exe
  C:\Windows\System\ZubESkt.exe
  2⤵
  PID:5268
- C:\Windows\System\FcsWYKM.exe
  C:\Windows\System\FcsWYKM.exe
  2⤵
  PID:5500
- C:\Windows\System\zNxDlmI.exe
  C:\Windows\System\zNxDlmI.exe
  2⤵
  PID:5508
- C:\Windows\System\FWZGlqP.exe
  C:\Windows\System\FWZGlqP.exe
  2⤵
  PID:5552
- C:\Windows\System\AZrgomf.exe
  C:\Windows\System\AZrgomf.exe
  2⤵
  PID:5928
- C:\Windows\System\RdyYmOi.exe
  C:\Windows\System\RdyYmOi.exe
  2⤵
  PID:5264
- C:\Windows\System\STbwtqg.exe
  C:\Windows\System\STbwtqg.exe
  2⤵
  PID:5544
- C:\Windows\System\obFopjN.exe
  C:\Windows\System\obFopjN.exe
  2⤵
  PID:5640
- C:\Windows\System\Snbdazy.exe
  C:\Windows\System\Snbdazy.exe
  2⤵
  PID:5916
- C:\Windows\System\aLFHCXC.exe
  C:\Windows\System\aLFHCXC.exe
  2⤵
  PID:6152
- C:\Windows\System\xZbyUXE.exe
  C:\Windows\System\xZbyUXE.exe
  2⤵
  PID:6172
- C:\Windows\System\nBEiMcI.exe
  C:\Windows\System\nBEiMcI.exe
  2⤵
  PID:6204
- C:\Windows\System\rdIqeLS.exe
  C:\Windows\System\rdIqeLS.exe
  2⤵
  PID:6236
- C:\Windows\System\qjSmPQq.exe
  C:\Windows\System\qjSmPQq.exe
  2⤵
  PID:6272
- C:\Windows\System\MdxqUJJ.exe
  C:\Windows\System\MdxqUJJ.exe
  2⤵
  PID:6296
- C:\Windows\System\vjTgFRw.exe
  C:\Windows\System\vjTgFRw.exe
  2⤵
  PID:6324
- C:\Windows\System\UqhZLfO.exe
  C:\Windows\System\UqhZLfO.exe
  2⤵
  PID:6356
- C:\Windows\System\ajwFXFr.exe
  C:\Windows\System\ajwFXFr.exe
  2⤵
  PID:6384
- C:\Windows\System\XJZDzlM.exe
  C:\Windows\System\XJZDzlM.exe
  2⤵
  PID:6420
- C:\Windows\System\FRzVXaM.exe
  C:\Windows\System\FRzVXaM.exe
  2⤵
  PID:6452
- C:\Windows\System\rIASxtZ.exe
  C:\Windows\System\rIASxtZ.exe
  2⤵
  PID:6472
- C:\Windows\System\zBJdpXH.exe
  C:\Windows\System\zBJdpXH.exe
  2⤵
  PID:6504
- C:\Windows\System\zGuThLb.exe
  C:\Windows\System\zGuThLb.exe
  2⤵
  PID:6540
- C:\Windows\System\XqnvTQc.exe
  C:\Windows\System\XqnvTQc.exe
  2⤵
  PID:6572
- C:\Windows\System\pMrXPsC.exe
  C:\Windows\System\pMrXPsC.exe
  2⤵
  PID:6608
- C:\Windows\System\lzJjJDg.exe
  C:\Windows\System\lzJjJDg.exe
  2⤵
  PID:6636
- C:\Windows\System\VxNxHGc.exe
  C:\Windows\System\VxNxHGc.exe
  2⤵
  PID:6668
- C:\Windows\System\KegcPbe.exe
  C:\Windows\System\KegcPbe.exe
  2⤵
  PID:6708
- C:\Windows\System\bFCSIDU.exe
  C:\Windows\System\bFCSIDU.exe
  2⤵
  PID:6736
- C:\Windows\System\FuJEvNK.exe
  C:\Windows\System\FuJEvNK.exe
  2⤵
  PID:6760
- C:\Windows\System\wEROIAE.exe
  C:\Windows\System\wEROIAE.exe
  2⤵
  PID:6788
- C:\Windows\System\nIJZVjw.exe
  C:\Windows\System\nIJZVjw.exe
  2⤵
  PID:6816
- C:\Windows\System\lgWooZW.exe
  C:\Windows\System\lgWooZW.exe
  2⤵
  PID:6852
- C:\Windows\System\byoQRnC.exe
  C:\Windows\System\byoQRnC.exe
  2⤵
  PID:6880
- C:\Windows\System\dAsEZcx.exe
  C:\Windows\System\dAsEZcx.exe
  2⤵
  PID:6912
- C:\Windows\System\DvxkODt.exe
  C:\Windows\System\DvxkODt.exe
  2⤵
  PID:6948
- C:\Windows\System\gePcdWK.exe
  C:\Windows\System\gePcdWK.exe
  2⤵
  PID:6968
- C:\Windows\System\VVExALu.exe
  C:\Windows\System\VVExALu.exe
  2⤵
  PID:7004
- C:\Windows\System\LUUChIt.exe
  C:\Windows\System\LUUChIt.exe
  2⤵
  PID:7044
- C:\Windows\System\dYicNNC.exe
  C:\Windows\System\dYicNNC.exe
  2⤵
  PID:7068
- C:\Windows\System\tMhkTMF.exe
  C:\Windows\System\tMhkTMF.exe
  2⤵
  PID:7100
- C:\Windows\System\nfiQjBQ.exe
  C:\Windows\System\nfiQjBQ.exe
  2⤵
  PID:7132
- C:\Windows\System\naIrqeL.exe
  C:\Windows\System\naIrqeL.exe
  2⤵
  PID:7164
- C:\Windows\System\bgpxDkR.exe
  C:\Windows\System\bgpxDkR.exe
  2⤵
  PID:5416
- C:\Windows\System\UZbDQAT.exe
  C:\Windows\System\UZbDQAT.exe
  2⤵
  PID:6264
- C:\Windows\System\jaSCuwI.exe
  C:\Windows\System\jaSCuwI.exe
  2⤵
  PID:6280
- C:\Windows\System\uJOFSMB.exe
  C:\Windows\System\uJOFSMB.exe
  2⤵
  PID:6372
- C:\Windows\System\OnRzGIJ.exe
  C:\Windows\System\OnRzGIJ.exe
  2⤵
  PID:6528
- C:\Windows\System\DFUMClL.exe
  C:\Windows\System\DFUMClL.exe
  2⤵
  PID:6600
- C:\Windows\System\RBaCgWA.exe
  C:\Windows\System\RBaCgWA.exe
  2⤵
  PID:6628
- C:\Windows\System\cdnHwCX.exe
  C:\Windows\System\cdnHwCX.exe
  2⤵
  PID:6732
- C:\Windows\System\XOzhmMH.exe
  C:\Windows\System\XOzhmMH.exe
  2⤵
  PID:6800
- C:\Windows\System\XVMVFdT.exe
  C:\Windows\System\XVMVFdT.exe
  2⤵
  PID:6924
- C:\Windows\System\kLfEbCr.exe
  C:\Windows\System\kLfEbCr.exe
  2⤵
  PID:6992
- C:\Windows\System\gEAZPhx.exe
  C:\Windows\System\gEAZPhx.exe
  2⤵
  PID:7056
- C:\Windows\System\ZhMwmpJ.exe
  C:\Windows\System\ZhMwmpJ.exe
  2⤵
  PID:7140
- C:\Windows\System\jINbZZN.exe
  C:\Windows\System\jINbZZN.exe
  2⤵
  PID:6344
- C:\Windows\System\WnELCig.exe
  C:\Windows\System\WnELCig.exe
  2⤵
  PID:6484
- C:\Windows\System\RhYxGhh.exe
  C:\Windows\System\RhYxGhh.exe
  2⤵
  PID:6688
- C:\Windows\System\ZxcBEEn.exe
  C:\Windows\System\ZxcBEEn.exe
  2⤵
  PID:6864
- C:\Windows\System\zAvYDds.exe
  C:\Windows\System\zAvYDds.exe
  2⤵
  PID:7096
- C:\Windows\System\RmZhyGV.exe
  C:\Windows\System\RmZhyGV.exe
  2⤵
  PID:6396
- C:\Windows\System\XWRlrxL.exe
  C:\Windows\System\XWRlrxL.exe
  2⤵
  PID:6680
- C:\Windows\System\EsSFGHO.exe
  C:\Windows\System\EsSFGHO.exe
  2⤵
  PID:6720
- C:\Windows\System\cUxCVig.exe
  C:\Windows\System\cUxCVig.exe
  2⤵
  PID:6964
- C:\Windows\System\vOHNpPh.exe
  C:\Windows\System\vOHNpPh.exe
  2⤵
  PID:7188
- C:\Windows\System\NdmRDbZ.exe
  C:\Windows\System\NdmRDbZ.exe
  2⤵
  PID:7212
- C:\Windows\System\OkLHcPK.exe
  C:\Windows\System\OkLHcPK.exe
  2⤵
  PID:7236
- C:\Windows\System\lbTcBEt.exe
  C:\Windows\System\lbTcBEt.exe
  2⤵
  PID:7260
- C:\Windows\System\lUotMZQ.exe
  C:\Windows\System\lUotMZQ.exe
  2⤵
  PID:7284
- C:\Windows\System\DcebmMz.exe
  C:\Windows\System\DcebmMz.exe
  2⤵
  PID:7308
- C:\Windows\System\qtMYEBb.exe
  C:\Windows\System\qtMYEBb.exe
  2⤵
  PID:7324
- C:\Windows\System\iLUqvdN.exe
  C:\Windows\System\iLUqvdN.exe
  2⤵
  PID:7348
- C:\Windows\System\MmCjqmV.exe
  C:\Windows\System\MmCjqmV.exe
  2⤵
  PID:7372
- C:\Windows\System\FQTCWtI.exe
  C:\Windows\System\FQTCWtI.exe
  2⤵
  PID:7392
- C:\Windows\System\xMtJFsT.exe
  C:\Windows\System\xMtJFsT.exe
  2⤵
  PID:7416
- C:\Windows\System\QkqdRXG.exe
  C:\Windows\System\QkqdRXG.exe
  2⤵
  PID:7448
- C:\Windows\System\tTGTOWP.exe
  C:\Windows\System\tTGTOWP.exe
  2⤵
  PID:7476
- C:\Windows\System\PcErYzm.exe
  C:\Windows\System\PcErYzm.exe
  2⤵
  PID:7512
- C:\Windows\System\VMXIYek.exe
  C:\Windows\System\VMXIYek.exe
  2⤵
  PID:7540
- C:\Windows\System\HyAueKe.exe
  C:\Windows\System\HyAueKe.exe
  2⤵
  PID:7568
- C:\Windows\System\RuNJShz.exe
  C:\Windows\System\RuNJShz.exe
  2⤵
  PID:7596
- C:\Windows\System\KjBkCTc.exe
  C:\Windows\System\KjBkCTc.exe
  2⤵
  PID:7628
- C:\Windows\System\YxkUszT.exe
  C:\Windows\System\YxkUszT.exe
  2⤵
  PID:7660
- C:\Windows\System\WSoyJyX.exe
  C:\Windows\System\WSoyJyX.exe
  2⤵
  PID:7696
- C:\Windows\System\kVwunBb.exe
  C:\Windows\System\kVwunBb.exe
  2⤵
  PID:7724
- C:\Windows\System\zlBlxKT.exe
  C:\Windows\System\zlBlxKT.exe
  2⤵
  PID:7748
- C:\Windows\System\VGTYLdU.exe
  C:\Windows\System\VGTYLdU.exe
  2⤵
  PID:7780
- C:\Windows\System\RsVwhJS.exe
  C:\Windows\System\RsVwhJS.exe
  2⤵
  PID:7808
- C:\Windows\System\PtcWpbl.exe
  C:\Windows\System\PtcWpbl.exe
  2⤵
  PID:7840
- C:\Windows\System\BZSaVLq.exe
  C:\Windows\System\BZSaVLq.exe
  2⤵
  PID:7868
- C:\Windows\System\LslBlLi.exe
  C:\Windows\System\LslBlLi.exe
  2⤵
  PID:7892
- C:\Windows\System\gMtfczu.exe
  C:\Windows\System\gMtfczu.exe
  2⤵
  PID:7908
- C:\Windows\System\KiZNwpE.exe
  C:\Windows\System\KiZNwpE.exe
  2⤵
  PID:7928
- C:\Windows\System\gxHFLWF.exe
  C:\Windows\System\gxHFLWF.exe
  2⤵
  PID:7960
- C:\Windows\System\evrYBcP.exe
  C:\Windows\System\evrYBcP.exe
  2⤵
  PID:7992
- C:\Windows\System\BFbuNkF.exe
  C:\Windows\System\BFbuNkF.exe
  2⤵
  PID:8012
- C:\Windows\System\VsabUzf.exe
  C:\Windows\System\VsabUzf.exe
  2⤵
  PID:8040
- C:\Windows\System\jWgxHEl.exe
  C:\Windows\System\jWgxHEl.exe
  2⤵
  PID:8068
- C:\Windows\System\aSHrLCm.exe
  C:\Windows\System\aSHrLCm.exe
  2⤵
  PID:8092
- C:\Windows\System\UCBfCQv.exe
  C:\Windows\System\UCBfCQv.exe
  2⤵
  PID:8124
- C:\Windows\System\HMxypXJ.exe
  C:\Windows\System\HMxypXJ.exe
  2⤵
  PID:8152
- C:\Windows\System\ssRwLmA.exe
  C:\Windows\System\ssRwLmA.exe
  2⤵
  PID:8180
- C:\Windows\System\JjZQvTR.exe
  C:\Windows\System\JjZQvTR.exe
  2⤵
  PID:7172
- C:\Windows\System\HRTvUEp.exe
  C:\Windows\System\HRTvUEp.exe
  2⤵
  PID:7180
- C:\Windows\System\PjFGuBx.exe
  C:\Windows\System\PjFGuBx.exe
  2⤵
  PID:7304
- C:\Windows\System\UBrkiBb.exe
  C:\Windows\System\UBrkiBb.exe
  2⤵
  PID:7276
- C:\Windows\System\JGYjeIQ.exe
  C:\Windows\System\JGYjeIQ.exe
  2⤵
  PID:7388
- C:\Windows\System\HvkTyZE.exe
  C:\Windows\System\HvkTyZE.exe
  2⤵
  PID:7500
- C:\Windows\System\VtwZBcv.exe
  C:\Windows\System\VtwZBcv.exe
  2⤵
  PID:7496
- C:\Windows\System\nqagCTP.exe
  C:\Windows\System\nqagCTP.exe
  2⤵
  PID:7648
- C:\Windows\System\MCnhhIQ.exe
  C:\Windows\System\MCnhhIQ.exe
  2⤵
  PID:7744
- C:\Windows\System\ezxAKcv.exe
  C:\Windows\System\ezxAKcv.exe
  2⤵
  PID:7852
- C:\Windows\System\lrONQCv.exe
  C:\Windows\System\lrONQCv.exe
  2⤵
  PID:7740
- C:\Windows\System\HpMaEzy.exe
  C:\Windows\System\HpMaEzy.exe
  2⤵
  PID:7968
- C:\Windows\System\omwiqDM.exe
  C:\Windows\System\omwiqDM.exe
  2⤵
  PID:7944
- C:\Windows\System\FxpNVhZ.exe
  C:\Windows\System\FxpNVhZ.exe
  2⤵
  PID:8000
- C:\Windows\System\yPRGjqj.exe
  C:\Windows\System\yPRGjqj.exe
  2⤵
  PID:8140
- C:\Windows\System\gzSmxIN.exe
  C:\Windows\System\gzSmxIN.exe
  2⤵
  PID:6596
- C:\Windows\System\YFkyIjZ.exe
  C:\Windows\System\YFkyIjZ.exe
  2⤵
  PID:7300
- C:\Windows\System\RwINjoj.exe
  C:\Windows\System\RwINjoj.exe
  2⤵
  PID:7620
- C:\Windows\System\SmUANlH.exe
  C:\Windows\System\SmUANlH.exe
  2⤵
  PID:7736
- C:\Windows\System\aaIjrYH.exe
  C:\Windows\System\aaIjrYH.exe
  2⤵
  PID:7880
- C:\Windows\System\quDmqZv.exe
  C:\Windows\System\quDmqZv.exe
  2⤵
  PID:8164
- C:\Windows\System\CbNRFKC.exe
  C:\Windows\System\CbNRFKC.exe
  2⤵
  PID:7904
- C:\Windows\System\hxHMQqO.exe
  C:\Windows\System\hxHMQqO.exe
  2⤵
  PID:8116
- C:\Windows\System\rwIytFx.exe
  C:\Windows\System\rwIytFx.exe
  2⤵
  PID:7924
- C:\Windows\System\WhmeSvP.exe
  C:\Windows\System\WhmeSvP.exe
  2⤵
  PID:8208
- C:\Windows\System\UXwPjhb.exe
  C:\Windows\System\UXwPjhb.exe
  2⤵
  PID:8240
- C:\Windows\System\ybwndwN.exe
  C:\Windows\System\ybwndwN.exe
  2⤵
  PID:8280
- C:\Windows\System\zlwBSDo.exe
  C:\Windows\System\zlwBSDo.exe
  2⤵
  PID:8308
- C:\Windows\System\rgFjtMZ.exe
  C:\Windows\System\rgFjtMZ.exe
  2⤵
  PID:8340
- C:\Windows\System\sJCVSlx.exe
  C:\Windows\System\sJCVSlx.exe
  2⤵
  PID:8368
- C:\Windows\System\IbFGfOE.exe
  C:\Windows\System\IbFGfOE.exe
  2⤵
  PID:8404
- C:\Windows\System\xbuhlCX.exe
  C:\Windows\System\xbuhlCX.exe
  2⤵
  PID:8432
- C:\Windows\System\msqlRYH.exe
  C:\Windows\System\msqlRYH.exe
  2⤵
  PID:8460
- C:\Windows\System\TOejEQn.exe
  C:\Windows\System\TOejEQn.exe
  2⤵
  PID:8496
- C:\Windows\System\XQGlQUs.exe
  C:\Windows\System\XQGlQUs.exe
  2⤵
  PID:8528
- C:\Windows\System\kHubsJZ.exe
  C:\Windows\System\kHubsJZ.exe
  2⤵
  PID:8544
- C:\Windows\System\nOHHywh.exe
  C:\Windows\System\nOHHywh.exe
  2⤵
  PID:8576
- C:\Windows\System\QTjyGuM.exe
  C:\Windows\System\QTjyGuM.exe
  2⤵
  PID:8600
- C:\Windows\System\WsqQFWG.exe
  C:\Windows\System\WsqQFWG.exe
  2⤵
  PID:8628
- C:\Windows\System\WKBYkpu.exe
  C:\Windows\System\WKBYkpu.exe
  2⤵
  PID:8652
- C:\Windows\System\XFvxTBq.exe
  C:\Windows\System\XFvxTBq.exe
  2⤵
  PID:8672
- C:\Windows\System\uYLCXtq.exe
  C:\Windows\System\uYLCXtq.exe
  2⤵
  PID:8692
- C:\Windows\System\BnkgfRa.exe
  C:\Windows\System\BnkgfRa.exe
  2⤵
  PID:8716
- C:\Windows\System\slctKnl.exe
  C:\Windows\System\slctKnl.exe
  2⤵
  PID:8748
- C:\Windows\System\QKSOQoy.exe
  C:\Windows\System\QKSOQoy.exe
  2⤵
  PID:8780
- C:\Windows\System\UUDYddQ.exe
  C:\Windows\System\UUDYddQ.exe
  2⤵
  PID:8812
- C:\Windows\System\uRStCVU.exe
  C:\Windows\System\uRStCVU.exe
  2⤵
  PID:8836
- C:\Windows\System\ASKuEFr.exe
  C:\Windows\System\ASKuEFr.exe
  2⤵
  PID:8864
- C:\Windows\System\FZniDUF.exe
  C:\Windows\System\FZniDUF.exe
  2⤵
  PID:8884
- C:\Windows\System\CedUSZS.exe
  C:\Windows\System\CedUSZS.exe
  2⤵
  PID:8916
- C:\Windows\System\xWIVUXe.exe
  C:\Windows\System\xWIVUXe.exe
  2⤵
  PID:8940
- C:\Windows\System\viuwAHA.exe
  C:\Windows\System\viuwAHA.exe
  2⤵
  PID:8968
- C:\Windows\System\tsnOsoZ.exe
  C:\Windows\System\tsnOsoZ.exe
  2⤵
  PID:8996
- C:\Windows\System\kQPJAdJ.exe
  C:\Windows\System\kQPJAdJ.exe
  2⤵
  PID:9024
- C:\Windows\System\eLIqWkv.exe
  C:\Windows\System\eLIqWkv.exe
  2⤵
  PID:9052
- C:\Windows\System\mIwQVkB.exe
  C:\Windows\System\mIwQVkB.exe
  2⤵
  PID:9076
- C:\Windows\System\gOYbZoL.exe
  C:\Windows\System\gOYbZoL.exe
  2⤵
  PID:9104
- C:\Windows\System\RPNqECU.exe
  C:\Windows\System\RPNqECU.exe
  2⤵
  PID:9128
- C:\Windows\System\YwthNsD.exe
  C:\Windows\System\YwthNsD.exe
  2⤵
  PID:9160
- C:\Windows\System\AULDOnr.exe
  C:\Windows\System\AULDOnr.exe
  2⤵
  PID:9188
- C:\Windows\System\yLOVoaD.exe
  C:\Windows\System\yLOVoaD.exe
  2⤵
  PID:7888
- C:\Windows\System\KaKnfny.exe
  C:\Windows\System\KaKnfny.exe
  2⤵
  PID:7320
- C:\Windows\System\TQmEqpy.exe
  C:\Windows\System\TQmEqpy.exe
  2⤵
  PID:8268
- C:\Windows\System\ymUmsIv.exe
  C:\Windows\System\ymUmsIv.exe
  2⤵
  PID:8336
- C:\Windows\System\XxoNmUq.exe
  C:\Windows\System\XxoNmUq.exe
  2⤵
  PID:8400
- C:\Windows\System\xxeBLZZ.exe
  C:\Windows\System\xxeBLZZ.exe
  2⤵
  PID:8492
- C:\Windows\System\oBVCDOi.exe
  C:\Windows\System\oBVCDOi.exe
  2⤵
  PID:8556
- C:\Windows\System\EQTpjKS.exe
  C:\Windows\System\EQTpjKS.exe
  2⤵
  PID:8648
- C:\Windows\System\PzZpwgP.exe
  C:\Windows\System\PzZpwgP.exe
  2⤵
  PID:8688
- C:\Windows\System\kGpcJJD.exe
  C:\Windows\System\kGpcJJD.exe
  2⤵
  PID:8768
- C:\Windows\System\KYREcjF.exe
  C:\Windows\System\KYREcjF.exe
  2⤵
  PID:8844
- C:\Windows\System\RoAnxbF.exe
  C:\Windows\System\RoAnxbF.exe
  2⤵
  PID:8900
- C:\Windows\System\dBQJpuV.exe
  C:\Windows\System\dBQJpuV.exe
  2⤵
  PID:8976
- C:\Windows\System\mQbktYr.exe
  C:\Windows\System\mQbktYr.exe
  2⤵
  PID:9060
- C:\Windows\System\xrgDXWG.exe
  C:\Windows\System\xrgDXWG.exe
  2⤵
  PID:9100
- C:\Windows\System\oKJOcCO.exe
  C:\Windows\System\oKJOcCO.exe
  2⤵
  PID:9184
- C:\Windows\System\GtnNxad.exe
  C:\Windows\System\GtnNxad.exe
  2⤵
  PID:7296
- C:\Windows\System\vpOlVPQ.exe
  C:\Windows\System\vpOlVPQ.exe
  2⤵
  PID:8316
- C:\Windows\System\mTPZsrJ.exe
  C:\Windows\System\mTPZsrJ.exe
  2⤵
  PID:8512
- C:\Windows\System\ZYZrdvh.exe
  C:\Windows\System\ZYZrdvh.exe
  2⤵
  PID:8712
- C:\Windows\System\mYHUXjY.exe
  C:\Windows\System\mYHUXjY.exe
  2⤵
  PID:8860
- C:\Windows\System\cHIXnil.exe
  C:\Windows\System\cHIXnil.exe
  2⤵
  PID:9096
- C:\Windows\System\XUBkvDS.exe
  C:\Windows\System\XUBkvDS.exe
  2⤵
  PID:8388
- C:\Windows\System\WixqgRq.exe
  C:\Windows\System\WixqgRq.exe
  2⤵
  PID:8680
- C:\Windows\System\MNdGXCm.exe
  C:\Windows\System\MNdGXCm.exe
  2⤵
  PID:8932
- C:\Windows\System\PjGHQJe.exe
  C:\Windows\System\PjGHQJe.exe
  2⤵
  PID:8960
- C:\Windows\System\AUVYqPc.exe
  C:\Windows\System\AUVYqPc.exe
  2⤵
  PID:9220
- C:\Windows\System\uYRuqBf.exe
  C:\Windows\System\uYRuqBf.exe
  2⤵
  PID:9244
- C:\Windows\System\PuqAriq.exe
  C:\Windows\System\PuqAriq.exe
  2⤵
  PID:9272
- C:\Windows\System\dENvwjh.exe
  C:\Windows\System\dENvwjh.exe
  2⤵
  PID:9308
- C:\Windows\System\RuGMjcx.exe
  C:\Windows\System\RuGMjcx.exe
  2⤵
  PID:9332
- C:\Windows\System\uadlJkp.exe
  C:\Windows\System\uadlJkp.exe
  2⤵
  PID:9364
- C:\Windows\System\VWdzZus.exe
  C:\Windows\System\VWdzZus.exe
  2⤵
  PID:9392
- C:\Windows\System\mrNgbTi.exe
  C:\Windows\System\mrNgbTi.exe
  2⤵
  PID:9408
- C:\Windows\System\SGuQWFV.exe
  C:\Windows\System\SGuQWFV.exe
  2⤵
  PID:9436
- C:\Windows\System\XsoKLAS.exe
  C:\Windows\System\XsoKLAS.exe
  2⤵
  PID:9464
- C:\Windows\System\ijJTmCB.exe
  C:\Windows\System\ijJTmCB.exe
  2⤵
  PID:9480
- C:\Windows\System\IWaSTSg.exe
  C:\Windows\System\IWaSTSg.exe
  2⤵
  PID:9504
- C:\Windows\System\qzzDsHv.exe
  C:\Windows\System\qzzDsHv.exe
  2⤵
  PID:9536
- C:\Windows\System\NbhpDPA.exe
  C:\Windows\System\NbhpDPA.exe
  2⤵
  PID:9552
- C:\Windows\System\SlXpogo.exe
  C:\Windows\System\SlXpogo.exe
  2⤵
  PID:9580
- C:\Windows\System\XGLrTrv.exe
  C:\Windows\System\XGLrTrv.exe
  2⤵
  PID:9608
- C:\Windows\System\elOOkQG.exe
  C:\Windows\System\elOOkQG.exe
  2⤵
  PID:9644
- C:\Windows\System\upnQlnx.exe
  C:\Windows\System\upnQlnx.exe
  2⤵
  PID:9720
- C:\Windows\System\yKrTPGV.exe
  C:\Windows\System\yKrTPGV.exe
  2⤵
  PID:9748
- C:\Windows\System\KIZRbYh.exe
  C:\Windows\System\KIZRbYh.exe
  2⤵
  PID:9776
- C:\Windows\System\NTlGoEh.exe
  C:\Windows\System\NTlGoEh.exe
  2⤵
  PID:9796
- C:\Windows\System\QzLYuJs.exe
  C:\Windows\System\QzLYuJs.exe
  2⤵
  PID:9820
- C:\Windows\System\IKBUSqR.exe
  C:\Windows\System\IKBUSqR.exe
  2⤵
  PID:9856
- C:\Windows\System\Nnqbume.exe
  C:\Windows\System\Nnqbume.exe
  2⤵
  PID:9876
- C:\Windows\System\QiDlxcP.exe
  C:\Windows\System\QiDlxcP.exe
  2⤵
  PID:9904
- C:\Windows\System\ZaoWFAv.exe
  C:\Windows\System\ZaoWFAv.exe
  2⤵
  PID:9924
- C:\Windows\System\oZGtIpl.exe
  C:\Windows\System\oZGtIpl.exe
  2⤵
  PID:9944
- C:\Windows\System\PqaXCSO.exe
  C:\Windows\System\PqaXCSO.exe
  2⤵
  PID:9964
- C:\Windows\System\NBmPZwH.exe
  C:\Windows\System\NBmPZwH.exe
  2⤵
  PID:10008
- C:\Windows\System\MGignZB.exe
  C:\Windows\System\MGignZB.exe
  2⤵
  PID:10036
- C:\Windows\System\vOLGfZF.exe
  C:\Windows\System\vOLGfZF.exe
  2⤵
  PID:10060
- C:\Windows\System\yMgflda.exe
  C:\Windows\System\yMgflda.exe
  2⤵
  PID:10128
- C:\Windows\System\JwgZVUg.exe
  C:\Windows\System\JwgZVUg.exe
  2⤵
  PID:10148
- C:\Windows\System\MFltJKM.exe
  C:\Windows\System\MFltJKM.exe
  2⤵
  PID:10164
- C:\Windows\System\AlyPyKk.exe
  C:\Windows\System\AlyPyKk.exe
  2⤵
  PID:10188
- C:\Windows\System\iIFaWsa.exe
  C:\Windows\System\iIFaWsa.exe
  2⤵
  PID:10208
- C:\Windows\System\Exuaptf.exe
  C:\Windows\System\Exuaptf.exe
  2⤵
  PID:10232
- C:\Windows\System\DiRXezu.exe
  C:\Windows\System\DiRXezu.exe
  2⤵
  PID:9240
- C:\Windows\System\GeDmLlY.exe
  C:\Windows\System\GeDmLlY.exe
  2⤵
  PID:9300
- C:\Windows\System\THDktFe.exe
  C:\Windows\System\THDktFe.exe
  2⤵
  PID:9352
- C:\Windows\System\avHfrBw.exe
  C:\Windows\System\avHfrBw.exe
  2⤵
  PID:9400
- C:\Windows\System\UuFrTCy.exe
  C:\Windows\System\UuFrTCy.exe
  2⤵
  PID:9452
- C:\Windows\System\voaAZCJ.exe
  C:\Windows\System\voaAZCJ.exe
  2⤵
  PID:9492
- C:\Windows\System\ZyHSOtc.exe
  C:\Windows\System\ZyHSOtc.exe
  2⤵
  PID:9548
- C:\Windows\System\xVvRLPb.exe
  C:\Windows\System\xVvRLPb.exe
  2⤵
  PID:9624
- C:\Windows\System\TgOwpZS.exe
  C:\Windows\System\TgOwpZS.exe
  2⤵
  PID:9656
- C:\Windows\System\fBgGswR.exe
  C:\Windows\System\fBgGswR.exe
  2⤵
  PID:9764
- C:\Windows\System\dJVaszH.exe
  C:\Windows\System\dJVaszH.exe
  2⤵
  PID:9832
- C:\Windows\System\drnlgBY.exe
  C:\Windows\System\drnlgBY.exe
  2⤵
  PID:9940
- C:\Windows\System\PFfgWvz.exe
  C:\Windows\System\PFfgWvz.exe
  2⤵
  PID:9980
- C:\Windows\System\YwuGRSz.exe
  C:\Windows\System\YwuGRSz.exe
  2⤵
  PID:10024
- C:\Windows\System\CvkbGHy.exe
  C:\Windows\System\CvkbGHy.exe
  2⤵
  PID:10124
- C:\Windows\System\eFkJBdZ.exe
  C:\Windows\System\eFkJBdZ.exe
  2⤵
  PID:10180
- C:\Windows\System\YSKQxvY.exe
  C:\Windows\System\YSKQxvY.exe
  2⤵
  PID:10228
- C:\Windows\System\FdAInqx.exe
  C:\Windows\System\FdAInqx.exe
  2⤵
  PID:9380
- C:\Windows\System\yJnSqQR.exe
  C:\Windows\System\yJnSqQR.exe
  2⤵
  PID:9424
- C:\Windows\System\UsQhqbt.exe
  C:\Windows\System\UsQhqbt.exe
  2⤵
  PID:9568
- C:\Windows\System\bWLLIqV.exe
  C:\Windows\System\bWLLIqV.exe
  2⤵
  PID:9896
- C:\Windows\System\GsiADFs.exe
  C:\Windows\System\GsiADFs.exe
  2⤵
  PID:10072
- C:\Windows\System\vlqQKJq.exe
  C:\Windows\System\vlqQKJq.exe
  2⤵
  PID:10144
- C:\Windows\System\BIIYLGk.exe
  C:\Windows\System\BIIYLGk.exe
  2⤵
  PID:9372
- C:\Windows\System\UDEiFXI.exe
  C:\Windows\System\UDEiFXI.exe
  2⤵
  PID:9884
- C:\Windows\System\CacanfF.exe
  C:\Windows\System\CacanfF.exe
  2⤵
  PID:9712
- C:\Windows\System\TfgqHKc.exe
  C:\Windows\System\TfgqHKc.exe
  2⤵
  PID:10244
- C:\Windows\System\yUaBlXn.exe
  C:\Windows\System\yUaBlXn.exe
  2⤵
  PID:10276
- C:\Windows\System\necdaRo.exe
  C:\Windows\System\necdaRo.exe
  2⤵
  PID:10316
- C:\Windows\System\TTRzIny.exe
  C:\Windows\System\TTRzIny.exe
  2⤵
  PID:10336
- C:\Windows\System\CEwLTSb.exe
  C:\Windows\System\CEwLTSb.exe
  2⤵
  PID:10360
- C:\Windows\System\NOyFVVB.exe
  C:\Windows\System\NOyFVVB.exe
  2⤵
  PID:10388
- C:\Windows\System\xiNPNAj.exe
  C:\Windows\System\xiNPNAj.exe
  2⤵
  PID:10416
- C:\Windows\System\YavubDi.exe
  C:\Windows\System\YavubDi.exe
  2⤵
  PID:10440
- C:\Windows\System\GNbIBoJ.exe
  C:\Windows\System\GNbIBoJ.exe
  2⤵
  PID:10472
- C:\Windows\System\LmCIVus.exe
  C:\Windows\System\LmCIVus.exe
  2⤵
  PID:10496
- C:\Windows\System\FQADLuU.exe
  C:\Windows\System\FQADLuU.exe
  2⤵
  PID:10532
- C:\Windows\System\fiTizFx.exe
  C:\Windows\System\fiTizFx.exe
  2⤵
  PID:10564
- C:\Windows\System\FlgFkBq.exe
  C:\Windows\System\FlgFkBq.exe
  2⤵
  PID:10596
- C:\Windows\System\WodUYiR.exe
  C:\Windows\System\WodUYiR.exe
  2⤵
  PID:10624
- C:\Windows\System\RmcVLLt.exe
  C:\Windows\System\RmcVLLt.exe
  2⤵
  PID:10652
- C:\Windows\System\eTYNGIW.exe
  C:\Windows\System\eTYNGIW.exe
  2⤵
  PID:10688
- C:\Windows\System\VVISYps.exe
  C:\Windows\System\VVISYps.exe
  2⤵
  PID:10708
- C:\Windows\System\QGhWIgA.exe
  C:\Windows\System\QGhWIgA.exe
  2⤵
  PID:10744
- C:\Windows\System\XDPDGhB.exe
  C:\Windows\System\XDPDGhB.exe
  2⤵
  PID:10772
- C:\Windows\System\FTaartW.exe
  C:\Windows\System\FTaartW.exe
  2⤵
  PID:10796
- C:\Windows\System\GikUqgc.exe
  C:\Windows\System\GikUqgc.exe
  2⤵
  PID:10828
- C:\Windows\System\mMPgWIj.exe
  C:\Windows\System\mMPgWIj.exe
  2⤵
  PID:10856
- C:\Windows\System\TWVBDdV.exe
  C:\Windows\System\TWVBDdV.exe
  2⤵
  PID:10884
- C:\Windows\System\NjXgPLb.exe
  C:\Windows\System\NjXgPLb.exe
  2⤵
  PID:10908
- C:\Windows\System\wxxbvpB.exe
  C:\Windows\System\wxxbvpB.exe
  2⤵
  PID:10944
- C:\Windows\System\QOAqBlX.exe
  C:\Windows\System\QOAqBlX.exe
  2⤵
  PID:10964
- C:\Windows\System\nAgFBgD.exe
  C:\Windows\System\nAgFBgD.exe
  2⤵
  PID:10996
- C:\Windows\System\dVlhSlt.exe
  C:\Windows\System\dVlhSlt.exe
  2⤵
  PID:11032
- C:\Windows\System\hkVagfN.exe
  C:\Windows\System\hkVagfN.exe
  2⤵
  PID:11060
- C:\Windows\System\ciebpJv.exe
  C:\Windows\System\ciebpJv.exe
  2⤵
  PID:11080
- C:\Windows\System\YjywrEn.exe
  C:\Windows\System\YjywrEn.exe
  2⤵
  PID:11104
- C:\Windows\System\SyJhQLI.exe
  C:\Windows\System\SyJhQLI.exe
  2⤵
  PID:11132
- C:\Windows\System\PklbvnY.exe
  C:\Windows\System\PklbvnY.exe
  2⤵
  PID:11160
- C:\Windows\System\iuLoYnG.exe
  C:\Windows\System\iuLoYnG.exe
  2⤵
  PID:11200
- C:\Windows\System\zYVexgD.exe
  C:\Windows\System\zYVexgD.exe
  2⤵
  PID:11232
- C:\Windows\System\rMbVolY.exe
  C:\Windows\System\rMbVolY.exe
  2⤵
  PID:9520
- C:\Windows\System\cWGhqng.exe
  C:\Windows\System\cWGhqng.exe
  2⤵
  PID:10264
- C:\Windows\System\IBRazqW.exe
  C:\Windows\System\IBRazqW.exe
  2⤵
  PID:9972
- C:\Windows\System\IxMjGCv.exe
  C:\Windows\System\IxMjGCv.exe
  2⤵
  PID:10356
- C:\Windows\System\nziKdIs.exe
  C:\Windows\System\nziKdIs.exe
  2⤵
  PID:10432
- C:\Windows\System\nnHnUJk.exe
  C:\Windows\System\nnHnUJk.exe
  2⤵
  PID:10556
- C:\Windows\System\sOzPJAE.exe
  C:\Windows\System\sOzPJAE.exe
  2⤵
  PID:10592
- C:\Windows\System\jZITlQI.exe
  C:\Windows\System\jZITlQI.exe
  2⤵
  PID:10576
- C:\Windows\System\irnzhDx.exe
  C:\Windows\System\irnzhDx.exe
  2⤵
  PID:10728
- C:\Windows\System\RSxefmf.exe
  C:\Windows\System\RSxefmf.exe
  2⤵
  PID:10700
- C:\Windows\System\rYioSDb.exe
  C:\Windows\System\rYioSDb.exe
  2⤵
  PID:10848
- C:\Windows\System\kXAELSP.exe
  C:\Windows\System\kXAELSP.exe
  2⤵
  PID:10932
- C:\Windows\System\nqEOiQP.exe
  C:\Windows\System\nqEOiQP.exe
  2⤵
  PID:10960
- C:\Windows\System\ncqiQDd.exe
  C:\Windows\System\ncqiQDd.exe
  2⤵
  PID:11016
- C:\Windows\System\rfsrIgx.exe
  C:\Windows\System\rfsrIgx.exe
  2⤵
  PID:11120
- C:\Windows\System\KgoJWwU.exe
  C:\Windows\System\KgoJWwU.exe
  2⤵
  PID:11188
- C:\Windows\System\GTLEBgq.exe
  C:\Windows\System\GTLEBgq.exe
  2⤵
  PID:9704
- C:\Windows\System\mdSgezF.exe
  C:\Windows\System\mdSgezF.exe
  2⤵
  PID:9852
- C:\Windows\System\HiVulFv.exe
  C:\Windows\System\HiVulFv.exe
  2⤵
  PID:10428
- C:\Windows\System\KSeHavr.exe
  C:\Windows\System\KSeHavr.exe
  2⤵
  PID:10672
- C:\Windows\System\EoKGbhV.exe
  C:\Windows\System\EoKGbhV.exe
  2⤵
  PID:10808
- C:\Windows\System\VOjtUiL.exe
  C:\Windows\System\VOjtUiL.exe
  2⤵
  PID:10900
- C:\Windows\System\mgFSEpG.exe
  C:\Windows\System\mgFSEpG.exe
  2⤵
  PID:11096
- C:\Windows\System\VHOpROs.exe
  C:\Windows\System\VHOpROs.exe
  2⤵
  PID:10296
- C:\Windows\System\hwtxDJx.exe
  C:\Windows\System\hwtxDJx.exe
  2⤵
  PID:10424
- C:\Windows\System\fkuQfIr.exe
  C:\Windows\System\fkuQfIr.exe
  2⤵
  PID:10976
- C:\Windows\System\bOlqvdW.exe
  C:\Windows\System\bOlqvdW.exe
  2⤵
  PID:10980
- C:\Windows\System\JjgbAsr.exe
  C:\Windows\System\JjgbAsr.exe
  2⤵
  PID:11284
- C:\Windows\System\NdgNuQQ.exe
  C:\Windows\System\NdgNuQQ.exe
  2⤵
  PID:11316
- C:\Windows\System\ZsZvQZb.exe
  C:\Windows\System\ZsZvQZb.exe
  2⤵
  PID:11344
- C:\Windows\System\TXHnJFo.exe
  C:\Windows\System\TXHnJFo.exe
  2⤵
  PID:11372
- C:\Windows\System\MjgQRRt.exe
  C:\Windows\System\MjgQRRt.exe
  2⤵
  PID:11396
- C:\Windows\System\ackzaas.exe
  C:\Windows\System\ackzaas.exe
  2⤵
  PID:11420
- C:\Windows\System\UakCYIp.exe
  C:\Windows\System\UakCYIp.exe
  2⤵
  PID:11444
- C:\Windows\System\RhokIDQ.exe
  C:\Windows\System\RhokIDQ.exe
  2⤵
  PID:11468
- C:\Windows\System\SStKFCH.exe
  C:\Windows\System\SStKFCH.exe
  2⤵
  PID:11500
- C:\Windows\System\cNPPklU.exe
  C:\Windows\System\cNPPklU.exe
  2⤵
  PID:11532
- C:\Windows\System\BoyZYfS.exe
  C:\Windows\System\BoyZYfS.exe
  2⤵
  PID:11564
- C:\Windows\System\WlSJCmN.exe
  C:\Windows\System\WlSJCmN.exe
  2⤵
  PID:11580
- C:\Windows\System\txZquJm.exe
  C:\Windows\System\txZquJm.exe
  2⤵
  PID:11608
- C:\Windows\System\YlgyGbu.exe
  C:\Windows\System\YlgyGbu.exe
  2⤵
  PID:11636
- C:\Windows\System\fOHvZwG.exe
  C:\Windows\System\fOHvZwG.exe
  2⤵
  PID:11656
- C:\Windows\System\ykNNyEb.exe
  C:\Windows\System\ykNNyEb.exe
  2⤵
  PID:11684
- C:\Windows\System\UKmVfmv.exe
  C:\Windows\System\UKmVfmv.exe
  2⤵
  PID:11704
- C:\Windows\System\irrgmEQ.exe
  C:\Windows\System\irrgmEQ.exe
  2⤵
  PID:11736
- C:\Windows\System\FUPOumP.exe
  C:\Windows\System\FUPOumP.exe
  2⤵
  PID:11756
- C:\Windows\System\lInaVzY.exe
  C:\Windows\System\lInaVzY.exe
  2⤵
  PID:11784
- C:\Windows\System\EzFRRPQ.exe
  C:\Windows\System\EzFRRPQ.exe
  2⤵
  PID:11808
- C:\Windows\System\ecYPMeY.exe
  C:\Windows\System\ecYPMeY.exe
  2⤵
  PID:11880
- C:\Windows\System\nOBZrUf.exe
  C:\Windows\System\nOBZrUf.exe
  2⤵
  PID:11900
- C:\Windows\System\sDgUUFB.exe
  C:\Windows\System\sDgUUFB.exe
  2⤵
  PID:11948
- C:\Windows\System\dsDSFMj.exe
  C:\Windows\System\dsDSFMj.exe
  2⤵
  PID:11984
- C:\Windows\System\mXWQHZh.exe
  C:\Windows\System\mXWQHZh.exe
  2⤵
  PID:12012
- C:\Windows\System\FLvQFXW.exe
  C:\Windows\System\FLvQFXW.exe
  2⤵
  PID:12040
- C:\Windows\System\WrxIGXF.exe
  C:\Windows\System\WrxIGXF.exe
  2⤵
  PID:12084
- C:\Windows\System\usmHkbC.exe
  C:\Windows\System\usmHkbC.exe
  2⤵
  PID:12112
- C:\Windows\System\hZTLYqE.exe
  C:\Windows\System\hZTLYqE.exe
  2⤵
  PID:12140
- C:\Windows\System\zcKDVsc.exe
  C:\Windows\System\zcKDVsc.exe
  2⤵
  PID:12168
- C:\Windows\System\FZwncKr.exe
  C:\Windows\System\FZwncKr.exe
  2⤵
  PID:12196
- C:\Windows\System\ScRyjOz.exe
  C:\Windows\System\ScRyjOz.exe
  2⤵
  PID:12228
- C:\Windows\System\tQJUgwG.exe
  C:\Windows\System\tQJUgwG.exe
  2⤵
  PID:12256
- C:\Windows\System\fVOcdcA.exe
  C:\Windows\System\fVOcdcA.exe
  2⤵
  PID:12284
- C:\Windows\System\ZDJtYsm.exe
  C:\Windows\System\ZDJtYsm.exe
  2⤵
  PID:11332
- C:\Windows\System\eSOymua.exe
  C:\Windows\System\eSOymua.exe
  2⤵
  PID:11276
- C:\Windows\System\JAXIqDM.exe
  C:\Windows\System\JAXIqDM.exe
  2⤵
  PID:11460
- C:\Windows\System\aThEFqi.exe
  C:\Windows\System\aThEFqi.exe
  2⤵
  PID:11576
- C:\Windows\System\RbCVczV.exe
  C:\Windows\System\RbCVczV.exe
  2⤵
  PID:11524
- C:\Windows\System\hbqRDDy.exe
  C:\Windows\System\hbqRDDy.exe
  2⤵
  PID:11720
- C:\Windows\System\BbqGBIP.exe
  C:\Windows\System\BbqGBIP.exe
  2⤵
  PID:11692
- C:\Windows\System\RzTSXDU.exe
  C:\Windows\System\RzTSXDU.exe
  2⤵
  PID:11936
- C:\Windows\System\IKzEYUx.exe
  C:\Windows\System\IKzEYUx.exe
  2⤵
  PID:11796
- C:\Windows\System\PhImZPy.exe
  C:\Windows\System\PhImZPy.exe
  2⤵
  PID:11844
- C:\Windows\System\keRUduf.exe
  C:\Windows\System\keRUduf.exe
  2⤵
  PID:11920
- C:\Windows\System\hYdiOrm.exe
  C:\Windows\System\hYdiOrm.exe
  2⤵
  PID:12008
- C:\Windows\System\ukbaXEe.exe
  C:\Windows\System\ukbaXEe.exe
  2⤵
  PID:12128
- C:\Windows\System\EnWVhCq.exe
  C:\Windows\System\EnWVhCq.exe
  2⤵
  PID:12280
- C:\Windows\System\jlOhgRs.exe
  C:\Windows\System\jlOhgRs.exe
  2⤵
  PID:11304
- C:\Windows\System\hoViAFd.exe
  C:\Windows\System\hoViAFd.exe
  2⤵
  PID:12248
- C:\Windows\System\TuYCtFz.exe
  C:\Windows\System\TuYCtFz.exe
  2⤵
  PID:11488
- C:\Windows\System\hJPcUgQ.exe
  C:\Windows\System\hJPcUgQ.exe
  2⤵
  PID:11388
- C:\Windows\System\aOvzPsM.exe
  C:\Windows\System\aOvzPsM.exe
  2⤵
  PID:11752
- C:\Windows\System\gsVJBOD.exe
  C:\Windows\System\gsVJBOD.exe
  2⤵
  PID:11676
- C:\Windows\System\lIwiUqp.exe
  C:\Windows\System\lIwiUqp.exe
  2⤵
  PID:11540
- C:\Windows\System\fbmWokx.exe
  C:\Windows\System\fbmWokx.exe
  2⤵
  PID:12036
- C:\Windows\System\YxycqxN.exe
  C:\Windows\System\YxycqxN.exe
  2⤵
  PID:12156
- C:\Windows\System\aCzVinr.exe
  C:\Windows\System\aCzVinr.exe
  2⤵
  PID:12312
- C:\Windows\System\qdSlXxl.exe
  C:\Windows\System\qdSlXxl.exe
  2⤵
  PID:12340
- C:\Windows\System\MSSPVRL.exe
  C:\Windows\System\MSSPVRL.exe
  2⤵
  PID:12356
- C:\Windows\System\nQfjTLJ.exe
  C:\Windows\System\nQfjTLJ.exe
  2⤵
  PID:12380
- C:\Windows\System\gpYHoLw.exe
  C:\Windows\System\gpYHoLw.exe
  2⤵
  PID:12412
- C:\Windows\System\GOLcZEk.exe
  C:\Windows\System\GOLcZEk.exe
  2⤵
  PID:12440
- C:\Windows\System\tgnVqPL.exe
  C:\Windows\System\tgnVqPL.exe
  2⤵
  PID:12464
- C:\Windows\System\FnGSvmi.exe
  C:\Windows\System\FnGSvmi.exe
  2⤵
  PID:12488
- C:\Windows\System\OoREcbY.exe
  C:\Windows\System\OoREcbY.exe
  2⤵
  PID:12512
- C:\Windows\System\WiLHVcz.exe
  C:\Windows\System\WiLHVcz.exe
  2⤵
  PID:12540
- C:\Windows\System\JpuRuCO.exe
  C:\Windows\System\JpuRuCO.exe
  2⤵
  PID:12568
- C:\Windows\System\zCWYEqw.exe
  C:\Windows\System\zCWYEqw.exe
  2⤵
  PID:12596
- C:\Windows\System\PuGXAfy.exe
  C:\Windows\System\PuGXAfy.exe
  2⤵
  PID:12632
- C:\Windows\System\iynTDYz.exe
  C:\Windows\System\iynTDYz.exe
  2⤵
  PID:12664
- C:\Windows\System\xTFyvSU.exe
  C:\Windows\System\xTFyvSU.exe
  2⤵
  PID:12688
- C:\Windows\System\UdoooCS.exe
  C:\Windows\System\UdoooCS.exe
  2⤵
  PID:12724
- C:\Windows\System\TKXTcII.exe
  C:\Windows\System\TKXTcII.exe
  2⤵
  PID:12776
- C:\Windows\System\PVNrTfP.exe
  C:\Windows\System\PVNrTfP.exe
  2⤵
  PID:12816
- C:\Windows\System\JdoZIfs.exe
  C:\Windows\System\JdoZIfs.exe
  2⤵
  PID:12852
- C:\Windows\System\DsNjULM.exe
  C:\Windows\System\DsNjULM.exe
  2⤵
  PID:12884
- C:\Windows\System\mdMYXPL.exe
  C:\Windows\System\mdMYXPL.exe
  2⤵
  PID:12920
- C:\Windows\System\TRTUKDh.exe
  C:\Windows\System\TRTUKDh.exe
  2⤵
  PID:12944
- C:\Windows\System\JCwnASD.exe
  C:\Windows\System\JCwnASD.exe
  2⤵
  PID:12976
- C:\Windows\System\DVIvFhV.exe
  C:\Windows\System\DVIvFhV.exe
  2⤵
  PID:13004
- C:\Windows\System\EfTKBpP.exe
  C:\Windows\System\EfTKBpP.exe
  2⤵
  PID:13036
- C:\Windows\System\JtCIKjt.exe
  C:\Windows\System\JtCIKjt.exe
  2⤵
  PID:13064
- C:\Windows\System\SNFKLJa.exe
  C:\Windows\System\SNFKLJa.exe
  2⤵
  PID:13088
- C:\Windows\System\yOrYKiU.exe
  C:\Windows\System\yOrYKiU.exe
  2⤵
  PID:13120
- C:\Windows\System\RVLuXzN.exe
  C:\Windows\System\RVLuXzN.exe
  2⤵
  PID:13144
- C:\Windows\System\qBJfcBb.exe
  C:\Windows\System\qBJfcBb.exe
  2⤵
  PID:13176
- C:\Windows\System\lnJkkwn.exe
  C:\Windows\System\lnJkkwn.exe
  2⤵
  PID:13200
- C:\Windows\System\ppeKxWK.exe
  C:\Windows\System\ppeKxWK.exe
  2⤵
  PID:13236
- C:\Windows\System\GCQTMut.exe
  C:\Windows\System\GCQTMut.exe
  2⤵
  PID:13264
- C:\Windows\System\gzKDPkR.exe
  C:\Windows\System\gzKDPkR.exe
  2⤵
  PID:13292
- C:\Windows\System\huuJBzg.exe
  C:\Windows\System\huuJBzg.exe
  2⤵
  PID:12076
- C:\Windows\System\gtxpPeg.exe
  C:\Windows\System\gtxpPeg.exe
  2⤵
  PID:11312
- C:\Windows\System\eHcYIVq.exe
  C:\Windows\System\eHcYIVq.exe
  2⤵
  PID:11856
- C:\Windows\System\yGvLNHO.exe
  C:\Windows\System\yGvLNHO.exe
  2⤵
  PID:12460
- C:\Windows\System\HRkpFOc.exe
  C:\Windows\System\HRkpFOc.exe
  2⤵
  PID:12524
- C:\Windows\System\NluFqRo.exe
  C:\Windows\System\NluFqRo.exe
  2⤵
  PID:12372
- C:\Windows\System\mxzXoPe.exe
  C:\Windows\System\mxzXoPe.exe
  2⤵
  PID:12480
- C:\Windows\System\cQvLkPw.exe
  C:\Windows\System\cQvLkPw.exe
  2⤵
  PID:12580
- C:\Windows\System\SxZpnMg.exe
  C:\Windows\System\SxZpnMg.exe
  2⤵
  PID:12796
- C:\Windows\System\WTwABjT.exe
  C:\Windows\System\WTwABjT.exe
  2⤵
  PID:12828
- C:\Windows\System\NamVjUf.exe
  C:\Windows\System\NamVjUf.exe
  2⤵
  PID:12808
- C:\Windows\System\iPgbAoQ.exe
  C:\Windows\System\iPgbAoQ.exe
  2⤵
  PID:12880
- C:\Windows\System\cqvjkWy.exe
  C:\Windows\System\cqvjkWy.exe
  2⤵
  PID:13016
- C:\Windows\System\vEYcMcj.exe
  C:\Windows\System\vEYcMcj.exe
  2⤵
  PID:13112
- C:\Windows\System\aYrXHvx.exe
  C:\Windows\System\aYrXHvx.exe
  2⤵
  PID:13156
- C:\Windows\System\nqabbqM.exe
  C:\Windows\System\nqabbqM.exe
  2⤵
  PID:13104
- C:\Windows\System\boeokWs.exe
  C:\Windows\System\boeokWs.exe
  2⤵
  PID:13196
- C:\Windows\System\RdCSjnW.exe
  C:\Windows\System\RdCSjnW.exe
  2⤵
  PID:12472
- C:\Windows\System\OIXsEcF.exe
  C:\Windows\System\OIXsEcF.exe
  2⤵
  PID:11992
- C:\Windows\System\FrdnDxe.exe
  C:\Windows\System\FrdnDxe.exe
  2⤵
  PID:12648
- C:\Windows\System\fvwvpbf.exe
  C:\Windows\System\fvwvpbf.exe
  2⤵
  PID:12712
- C:\Windows\System\UOJjEJZ.exe
  C:\Windows\System\UOJjEJZ.exe
  2⤵
  PID:13032
- C:\Windows\System\pLJjhtC.exe
  C:\Windows\System\pLJjhtC.exe
  2⤵
  PID:13084
- C:\Windows\System\SNIfjJn.exe
  C:\Windows\System\SNIfjJn.exe
  2⤵
  PID:13224
- C:\Windows\System\yQDLtMB.exe
  C:\Windows\System\yQDLtMB.exe
  2⤵
  PID:13300
- C:\Windows\System\dGTvFbm.exe
  C:\Windows\System\dGTvFbm.exe
  2⤵
  PID:11292
- C:\Windows\System\eJaGmKZ.exe
  C:\Windows\System\eJaGmKZ.exe
  2⤵
  PID:12968
- C:\Windows\System\sFAdlev.exe
  C:\Windows\System\sFAdlev.exe
  2⤵
  PID:13188
- C:\Windows\System\nodXXYz.exe
  C:\Windows\System\nodXXYz.exe
  2⤵
  PID:13336
- C:\Windows\System\kUXkkxU.exe
  C:\Windows\System\kUXkkxU.exe
  2⤵
  PID:13364
- C:\Windows\System\JfzexRA.exe
  C:\Windows\System\JfzexRA.exe
  2⤵
  PID:13388
- C:\Windows\System\gSeNObB.exe
  C:\Windows\System\gSeNObB.exe
  2⤵
  PID:13412
- C:\Windows\System\QzAgUpW.exe
  C:\Windows\System\QzAgUpW.exe
  2⤵
  PID:13432
- C:\Windows\System\LkVKBAV.exe
  C:\Windows\System\LkVKBAV.exe
  2⤵
  PID:13460
- C:\Windows\System\NtHJiWo.exe
  C:\Windows\System\NtHJiWo.exe
  2⤵
  PID:13504
- C:\Windows\System\pkHolHN.exe
  C:\Windows\System\pkHolHN.exe
  2⤵
  PID:13536
- C:\Windows\System\bdOIewx.exe
  C:\Windows\System\bdOIewx.exe
  2⤵
  PID:13552
- C:\Windows\System\taGLurM.exe
  C:\Windows\System\taGLurM.exe
  2⤵
  PID:13576
- C:\Windows\System\ikyjFrj.exe
  C:\Windows\System\ikyjFrj.exe
  2⤵
  PID:13600
- C:\Windows\System\zCzfOWg.exe
  C:\Windows\System\zCzfOWg.exe
  2⤵
  PID:13632
- C:\Windows\System\cSGiBWy.exe
  C:\Windows\System\cSGiBWy.exe
  2⤵
  PID:13660
- C:\Windows\System\mrIXICJ.exe
  C:\Windows\System\mrIXICJ.exe
  2⤵
  PID:13684
- C:\Windows\System\qEiwPyL.exe
  C:\Windows\System\qEiwPyL.exe
  2⤵
  PID:13716
- C:\Windows\System\kqwpchF.exe
  C:\Windows\System\kqwpchF.exe
  2⤵
  PID:13744
- C:\Windows\System\okNwMUY.exe
  C:\Windows\System\okNwMUY.exe
  2⤵
  PID:13836
- C:\Windows\System\gUHwSQX.exe
  C:\Windows\System\gUHwSQX.exe
  2⤵
  PID:13852
- C:\Windows\System\jRVuADI.exe
  C:\Windows\System\jRVuADI.exe
  2⤵
  PID:13868
- C:\Windows\System\bhNlduT.exe
  C:\Windows\System\bhNlduT.exe
  2⤵
  PID:13900
- C:\Windows\System\tCtLgSZ.exe
  C:\Windows\System\tCtLgSZ.exe
  2⤵
  PID:13928
- C:\Windows\System\Bjilotg.exe
  C:\Windows\System\Bjilotg.exe
  2⤵
  PID:13960
- C:\Windows\System\eyqIlav.exe
  C:\Windows\System\eyqIlav.exe
  2⤵
  PID:13980
- C:\Windows\System\khWqtaK.exe
  C:\Windows\System\khWqtaK.exe
  2⤵
  PID:14008
- C:\Windows\System\ZuKhqlx.exe
  C:\Windows\System\ZuKhqlx.exe
  2⤵
  PID:14036
- C:\Windows\System\odSlmBa.exe
  C:\Windows\System\odSlmBa.exe
  2⤵
  PID:14060
- C:\Windows\System\RjCkljx.exe
  C:\Windows\System\RjCkljx.exe
  2⤵
  PID:14092
- C:\Windows\System\fPXfAWY.exe
  C:\Windows\System\fPXfAWY.exe
  2⤵
  PID:14120
- C:\Windows\System\sdizHAo.exe
  C:\Windows\System\sdizHAo.exe
  2⤵
  PID:14148
- C:\Windows\System\EzJrcUe.exe
  C:\Windows\System\EzJrcUe.exe
  2⤵
  PID:14176
- C:\Windows\System\XNHhtzX.exe
  C:\Windows\System\XNHhtzX.exe
  2⤵
  PID:14196
- C:\Windows\System\dtYCLxV.exe
  C:\Windows\System\dtYCLxV.exe
  2⤵
  PID:14236
- C:\Windows\System\AhWYqbV.exe
  C:\Windows\System\AhWYqbV.exe
  2⤵
  PID:14268
- C:\Windows\System\XRUIqUL.exe
  C:\Windows\System\XRUIqUL.exe
  2⤵
  PID:14288
- C:\Windows\System\ZNiePYx.exe
  C:\Windows\System\ZNiePYx.exe
  2⤵
  PID:14316
- C:\Windows\System\UsSXdnC.exe
  C:\Windows\System\UsSXdnC.exe
  2⤵
  PID:14332
- C:\Windows\System\IqrFZvj.exe
  C:\Windows\System\IqrFZvj.exe
  2⤵
  PID:13360
- C:\Windows\System\eiLRXjR.exe
  C:\Windows\System\eiLRXjR.exe
  2⤵
  PID:13376
- C:\Windows\System\STUcmaA.exe
  C:\Windows\System\STUcmaA.exe
  2⤵
  PID:13428
- C:\Windows\System\EhgFtQt.exe
  C:\Windows\System\EhgFtQt.exe
  2⤵
  PID:13520
- C:\Windows\System\aybRWlb.exe
  C:\Windows\System\aybRWlb.exe
  2⤵
  PID:13544
- C:\Windows\System\qUQKPHS.exe
  C:\Windows\System\qUQKPHS.exe
  2⤵
  PID:13648
- C:\Windows\System\HZTmUPx.exe
  C:\Windows\System\HZTmUPx.exe
  2⤵
  PID:13676
- C:\Windows\System\heRueoH.exe
  C:\Windows\System\heRueoH.exe
  2⤵
  PID:13764
- C:\Windows\System\HLFfiXT.exe
  C:\Windows\System\HLFfiXT.exe
  2⤵
  PID:13772
- C:\Windows\System\lqzxENT.exe
  C:\Windows\System\lqzxENT.exe
  2⤵
  PID:13920
- C:\Windows\System\tzVpDLT.exe
  C:\Windows\System\tzVpDLT.exe
  2⤵
  PID:13976
- C:\Windows\System\YSXwKWi.exe
  C:\Windows\System\YSXwKWi.exe
  2⤵
  PID:14020
- C:\Windows\System\FwxPjrw.exe
  C:\Windows\System\FwxPjrw.exe
  2⤵
  PID:14056
- C:\Windows\System\KgsiJfG.exe
  C:\Windows\System\KgsiJfG.exe
  2⤵
  PID:14160
- C:\Windows\System\OleUXlY.exe
  C:\Windows\System\OleUXlY.exe
  2⤵
  PID:14224
- C:\Windows\System\NqNOzfJ.exe
  C:\Windows\System\NqNOzfJ.exe
  2⤵
  PID:14284
- C:\Windows\System\gsZlNIt.exe
  C:\Windows\System\gsZlNIt.exe
  2⤵
  PID:14300
- C:\Windows\System\AhGtEqj.exe
  C:\Windows\System\AhGtEqj.exe
  2⤵
  PID:13320
- C:\Windows\System\MeOKFVm.exe
  C:\Windows\System\MeOKFVm.exe
  2⤵
  PID:13480
- C:\Windows\System\ZsZXBvx.exe
  C:\Windows\System\ZsZXBvx.exe
  2⤵
  PID:13620
- C:\Windows\System\QTOeMvl.exe
  C:\Windows\System\QTOeMvl.exe
  2⤵
  PID:13832
- C:\Windows\System\elygviy.exe
  C:\Windows\System\elygviy.exe
  2⤵
  PID:13908
- C:\Windows\System\UTMKzzV.exe
  C:\Windows\System\UTMKzzV.exe
  2⤵
  PID:14076
- C:\Windows\System\sRgsFSt.exe
  C:\Windows\System\sRgsFSt.exe
  2⤵
  PID:12592
- C:\Windows\System\alZJpdd.exe
  C:\Windows\System\alZJpdd.exe
  2⤵
  PID:13548
- C:\Windows\System\LaHIPgX.exe
  C:\Windows\System\LaHIPgX.exe
  2⤵
  PID:13888
- C:\Windows\System\lNdtSqn.exe
  C:\Windows\System\lNdtSqn.exe
  2⤵
  PID:14244
- C:\Windows\System\XMarNOY.exe
  C:\Windows\System\XMarNOY.exe
  2⤵
  PID:14352
- C:\Windows\System\BEMdyVI.exe
  C:\Windows\System\BEMdyVI.exe
  2⤵
  PID:14368
- C:\Windows\System\atmrgcn.exe
  C:\Windows\System\atmrgcn.exe
  2⤵
  PID:14400
- C:\Windows\System\AcGIZeI.exe
  C:\Windows\System\AcGIZeI.exe
  2⤵
  PID:14440
- C:\Windows\System\evKxvvr.exe
  C:\Windows\System\evKxvvr.exe
  2⤵
  PID:14476
- C:\Windows\System\YSMYBdY.exe
  C:\Windows\System\YSMYBdY.exe
  2⤵
  PID:14504
- C:\Windows\System\FdmSrjs.exe
  C:\Windows\System\FdmSrjs.exe
  2⤵
  PID:14528
- C:\Windows\System\TCkDwlc.exe
  C:\Windows\System\TCkDwlc.exe
  2⤵
  PID:14556
- C:\Windows\System\dsJUISO.exe
  C:\Windows\System\dsJUISO.exe
  2⤵
  PID:14580
- C:\Windows\System\QOIxmDl.exe
  C:\Windows\System\QOIxmDl.exe
  2⤵
  PID:14608
- C:\Windows\System\msIbltO.exe
  C:\Windows\System\msIbltO.exe
  2⤵
  PID:14624
- C:\Windows\System\ghqPHov.exe
  C:\Windows\System\ghqPHov.exe
  2⤵
  PID:14652
- C:\Windows\System\sVaVjPK.exe
  C:\Windows\System\sVaVjPK.exe
  2⤵
  PID:14680
- C:\Windows\System\nFLCQbW.exe
  C:\Windows\System\nFLCQbW.exe
  2⤵
  PID:14716
- C:\Windows\System\tdeKTvA.exe
  C:\Windows\System\tdeKTvA.exe
  2⤵
  PID:14736
- C:\Windows\System\aMrQpRE.exe
  C:\Windows\System\aMrQpRE.exe
  2⤵
  PID:14752
- C:\Windows\System\LvSSwbH.exe
  C:\Windows\System\LvSSwbH.exe
  2⤵
  PID:14776
- C:\Windows\System\NggWvkQ.exe
  C:\Windows\System\NggWvkQ.exe
  2⤵
  PID:14808
- C:\Windows\System\ygDQrWw.exe
  C:\Windows\System\ygDQrWw.exe
  2⤵
  PID:14836
- C:\Windows\System\eoOWVVu.exe
  C:\Windows\System\eoOWVVu.exe
  2⤵
  PID:14864
- C:\Windows\System\yhfqrkt.exe
  C:\Windows\System\yhfqrkt.exe
  2⤵
  PID:14896
- C:\Windows\System\vunUPtD.exe
  C:\Windows\System\vunUPtD.exe
  2⤵
  PID:14920
- C:\Windows\System\xKuBINK.exe
  C:\Windows\System\xKuBINK.exe
  2⤵
  PID:14948
- C:\Windows\System\CdeHlVT.exe
  C:\Windows\System\CdeHlVT.exe
  2⤵
  PID:14976
- C:\Windows\System\vrfwjiD.exe
  C:\Windows\System\vrfwjiD.exe
  2⤵
  PID:15000
- C:\Windows\System\kCzlUCE.exe
  C:\Windows\System\kCzlUCE.exe
  2⤵
  PID:15028
- C:\Windows\System\uPGueSS.exe
  C:\Windows\System\uPGueSS.exe
  2⤵
  PID:15056
- C:\Windows\System\dudIJeJ.exe
  C:\Windows\System\dudIJeJ.exe
  2⤵
  PID:15084
- C:\Windows\System\UwFrvqo.exe
  C:\Windows\System\UwFrvqo.exe
  2⤵
  PID:15124
- C:\Windows\System\vHQuunO.exe
  C:\Windows\System\vHQuunO.exe
  2⤵
  PID:15144
- C:\Windows\System\FFCrXjZ.exe
  C:\Windows\System\FFCrXjZ.exe
  2⤵
  PID:15172
- C:\Windows\System\ukMoTTI.exe
  C:\Windows\System\ukMoTTI.exe
  2⤵
  PID:15192
- C:\Windows\System\ZbdQAyC.exe
  C:\Windows\System\ZbdQAyC.exe
  2⤵
  PID:15220
- C:\Windows\System\usnsGQo.exe
  C:\Windows\System\usnsGQo.exe
  2⤵
  PID:15252
- C:\Windows\System\LUMpOCI.exe
  C:\Windows\System\LUMpOCI.exe
  2⤵
  PID:15276
- C:\Windows\System\SELenAz.exe
  C:\Windows\System\SELenAz.exe
  2⤵
  PID:15312
- C:\Windows\System\KJmMbZR.exe
  C:\Windows\System\KJmMbZR.exe
  2⤵
  PID:15332
- C:\Windows\System\BIxFout.exe
  C:\Windows\System\BIxFout.exe
  2⤵
  PID:13496
- C:\Windows\System\miotPXt.exe
  C:\Windows\System\miotPXt.exe
  2⤵
  PID:13864
- C:\Windows\System\Kyxinri.exe
  C:\Windows\System\Kyxinri.exe
  2⤵
  PID:14392
- C:\Windows\System\iOmWXpk.exe
  C:\Windows\System\iOmWXpk.exe
  2⤵
  PID:14464
- C:\Windows\System\YfZSVRk.exe
  C:\Windows\System\YfZSVRk.exe
  2⤵
  PID:14544
- C:\Windows\System\DkVNrlM.exe
  C:\Windows\System\DkVNrlM.exe
  2⤵
  PID:14596
- C:\Windows\System\SmqGIeO.exe
  C:\Windows\System\SmqGIeO.exe
  2⤵
  PID:14648
- C:\Windows\System\QITzbjc.exe
  C:\Windows\System\QITzbjc.exe
  2⤵
  PID:14668
- C:\Windows\System\sTUVjWU.exe
  C:\Windows\System\sTUVjWU.exe
  2⤵
  PID:14744
- C:\Windows\System\KWXHlGR.exe
  C:\Windows\System\KWXHlGR.exe
  2⤵
  PID:14832
- C:\Windows\System\lGNxaOU.exe
  C:\Windows\System\lGNxaOU.exe
  2⤵
  PID:14908
- C:\Windows\System\TOJBLnM.exe
  C:\Windows\System\TOJBLnM.exe
  2⤵
  PID:15020
- C:\Windows\System\uzpstTM.exe
  C:\Windows\System\uzpstTM.exe
  2⤵
  PID:14996
- C:\Windows\System\aChCODp.exe
  C:\Windows\System\aChCODp.exe
  2⤵
  PID:15136
- C:\Windows\System\sqFvgeE.exe
  C:\Windows\System\sqFvgeE.exe
  2⤵
  PID:15232
- C:\Windows\System\RqIbUOP.exe
  C:\Windows\System\RqIbUOP.exe
  2⤵
  PID:15284
- C:\Windows\System\aPOGybm.exe
  C:\Windows\System\aPOGybm.exe
  2⤵
  PID:15328
- C:\Windows\System\pIapHHO.exe
  C:\Windows\System\pIapHHO.exe
  2⤵
  PID:14364
- C:\Windows\System\baDegnc.exe
  C:\Windows\System\baDegnc.exe
  2⤵
  PID:14420
- C:\Windows\System\tSnemYM.exe
  C:\Windows\System\tSnemYM.exe
  2⤵
  PID:14636
- C:\Windows\System\ojXyZlZ.exe
  C:\Windows\System\ojXyZlZ.exe
  2⤵
  PID:14860
- C:\Windows\System\IyNZEGL.exe
  C:\Windows\System\IyNZEGL.exe
  2⤵
  PID:15040
- C:\Windows\System\BuSyOrF.exe
  C:\Windows\System\BuSyOrF.exe
  2⤵
  PID:15116
- C:\Windows\System\kVLrYyQ.exe
  C:\Windows\System\kVLrYyQ.exe
  2⤵
  PID:14452
- C:\Windows\System\MgcmfZY.exe
  C:\Windows\System\MgcmfZY.exe
  2⤵
  PID:14380
- C:\Windows\System\jNSTTWZ.exe
  C:\Windows\System\jNSTTWZ.exe
  2⤵
  PID:14968
- C:\Windows\System\YvlfASQ.exe
  C:\Windows\System\YvlfASQ.exe
  2⤵
  PID:15160
- C:\Windows\System\XpuYEfp.exe
  C:\Windows\System\XpuYEfp.exe
  2⤵
  PID:14592
- C:\Windows\System\GNXlytO.exe
  C:\Windows\System\GNXlytO.exe
  2⤵
  PID:15372
- C:\Windows\System\TNDGzUC.exe
  C:\Windows\System\TNDGzUC.exe
  2⤵
  PID:15404
- C:\Windows\System\AddblBw.exe
  C:\Windows\System\AddblBw.exe
  2⤵
  PID:15420
- C:\Windows\System\RMNzbFv.exe
  C:\Windows\System\RMNzbFv.exe
  2⤵
  PID:15460
- C:\Windows\System\wMqPpEC.exe
  C:\Windows\System\wMqPpEC.exe
  2⤵
  PID:15484
- C:\Windows\System\HNfPNsQ.exe
  C:\Windows\System\HNfPNsQ.exe
  2⤵
  PID:15508
- C:\Windows\System\aOOfUwH.exe
  C:\Windows\System\aOOfUwH.exe
  2⤵
  PID:15528
- C:\Windows\System\GLgPeFT.exe
  C:\Windows\System\GLgPeFT.exe
  2⤵
  PID:15548
- C:\Windows\System\DzqGDdD.exe
  C:\Windows\System\DzqGDdD.exe
  2⤵
  PID:15576
- C:\Windows\System\wEfTKif.exe
  C:\Windows\System\wEfTKif.exe
  2⤵
  PID:15616
- C:\Windows\System\VhBsCAJ.exe
  C:\Windows\System\VhBsCAJ.exe
  2⤵
  PID:15644
- C:\Windows\System\jtWwBth.exe
  C:\Windows\System\jtWwBth.exe
  2⤵
  PID:15672
- C:\Windows\System\KymQRzF.exe
  C:\Windows\System\KymQRzF.exe
  2⤵
  PID:15692
- C:\Windows\System\lfTfoGt.exe
  C:\Windows\System\lfTfoGt.exe
  2⤵
  PID:15716
- C:\Windows\System\WyiHpwU.exe
  C:\Windows\System\WyiHpwU.exe
  2⤵
  PID:15760
- C:\Windows\System\amnaisl.exe
  C:\Windows\System\amnaisl.exe
  2⤵
  PID:15796
- C:\Windows\System\IBmJyfD.exe
  C:\Windows\System\IBmJyfD.exe
  2⤵
  PID:15828
- C:\Windows\System\PvdCWsY.exe
  C:\Windows\System\PvdCWsY.exe
  2⤵
  PID:15860
- C:\Windows\System\QDrICEt.exe
  C:\Windows\System\QDrICEt.exe
  2⤵
  PID:15900
- C:\Windows\System\AJiPCII.exe
  C:\Windows\System\AJiPCII.exe
  2⤵
  PID:15924
- C:\Windows\System\tcDQNAL.exe
  C:\Windows\System\tcDQNAL.exe
  2⤵
  PID:15940
- C:\Windows\System\EeWRFwa.exe
  C:\Windows\System\EeWRFwa.exe
  2⤵
  PID:15964
- C:\Windows\System\nKYNMRy.exe
  C:\Windows\System\nKYNMRy.exe
  2⤵
  PID:15992
- C:\Windows\System\lfiprJH.exe
  C:\Windows\System\lfiprJH.exe
  2⤵
  PID:16020
- C:\Windows\System\pGkuXwt.exe
  C:\Windows\System\pGkuXwt.exe
  2⤵
  PID:16056
- C:\Windows\System\JnHuETL.exe
  C:\Windows\System\JnHuETL.exe
  2⤵
  PID:16080
- C:\Windows\System\nqXsNju.exe
  C:\Windows\System\nqXsNju.exe
  2⤵
  PID:16096
- C:\Windows\System\seakWRm.exe
  C:\Windows\System\seakWRm.exe
  2⤵
  PID:16128
- C:\Windows\System\DUFpYFv.exe
  C:\Windows\System\DUFpYFv.exe
  2⤵
  PID:16152
- C:\Windows\System\oDzEjlW.exe
  C:\Windows\System\oDzEjlW.exe
  2⤵
  PID:16184
- C:\Windows\System\WtwGWfK.exe
  C:\Windows\System\WtwGWfK.exe
  2⤵
  PID:16208
- C:\Windows\System\JDQVEya.exe
  C:\Windows\System\JDQVEya.exe
  2⤵
  PID:16232
- C:\Windows\System\WfYqSGV.exe
  C:\Windows\System\WfYqSGV.exe
  2⤵
  PID:16260
- C:\Windows\System\DwShIMY.exe
  C:\Windows\System\DwShIMY.exe
  2⤵
  PID:16292
- C:\Windows\System\yyPUXeX.exe
  C:\Windows\System\yyPUXeX.exe
  2⤵
  PID:16324
- C:\Windows\System\PqZrCwi.exe
  C:\Windows\System\PqZrCwi.exe
  2⤵
  PID:16348
- C:\Windows\System\yRpMxWS.exe
  C:\Windows\System\yRpMxWS.exe
  2⤵
  PID:16380
- C:\Windows\System\wjJLMxi.exe
  C:\Windows\System\wjJLMxi.exe
  2⤵
  PID:15364
- C:\Windows\System\vnJhCob.exe
  C:\Windows\System\vnJhCob.exe
  2⤵
  PID:15384
- C:\Windows\System\BCSLErC.exe
  C:\Windows\System\BCSLErC.exe
  2⤵
  PID:15448
- C:\Windows\System\JQrgsXC.exe
  C:\Windows\System\JQrgsXC.exe
  2⤵
  PID:15568
- C:\Windows\System\xXfUdeN.exe
  C:\Windows\System\xXfUdeN.exe
  2⤵
  PID:15600
- C:\Windows\System\tPmoZTt.exe
  C:\Windows\System\tPmoZTt.exe
  2⤵
  PID:15636
- C:\Windows\System\flgISoO.exe
  C:\Windows\System\flgISoO.exe
  2⤵
  PID:15744
- C:\Windows\System\itrVAEV.exe
  C:\Windows\System\itrVAEV.exe
  2⤵
  PID:2092
- C:\Windows\System\aCOWRQc.exe
  C:\Windows\System\aCOWRQc.exe
  2⤵
  PID:15936
- C:\Windows\System\lrOgLJU.exe
  C:\Windows\System\lrOgLJU.exe
  2⤵
  PID:15976
- C:\Windows\System\qAkYXFG.exe
  C:\Windows\System\qAkYXFG.exe
  2⤵
  PID:16008
- C:\Windows\System\IyauBkp.exe
  C:\Windows\System\IyauBkp.exe
  2⤵
  PID:16108
- C:\Windows\System\ShAmMfn.exe
  C:\Windows\System\ShAmMfn.exe
  2⤵
  PID:16164
- C:\Windows\System\pTHzSwW.exe
  C:\Windows\System\pTHzSwW.exe
  2⤵
  PID:16180
- C:\Windows\System\gWeBtfj.exe
  C:\Windows\System\gWeBtfj.exe
  2⤵
  PID:16284
- C:\Windows\System\Qghdoqq.exe
  C:\Windows\System\Qghdoqq.exe
  2⤵
  PID:14944
- C:\Windows\System\qICGOnK.exe
  C:\Windows\System\qICGOnK.exe
  2⤵
  PID:16364
- C:\Windows\System\akKSWkV.exe
  C:\Windows\System\akKSWkV.exe
  2⤵
  PID:15632
- C:\Windows\System\HzDsWRu.exe
  C:\Windows\System\HzDsWRu.exe
  2⤵
  PID:15736
- C:\Windows\System\yjzEuBD.exe
  C:\Windows\System\yjzEuBD.exe
  2⤵
  PID:15712
- C:\Windows\System\XWFQcLv.exe
  C:\Windows\System\XWFQcLv.exe
  2⤵
  PID:15876
- C:\Windows\System\NCcSxqv.exe
  C:\Windows\System\NCcSxqv.exe
  2⤵
  PID:16148
- C:\Windows\System\rJCSQAN.exe
  C:\Windows\System\rJCSQAN.exe
  2⤵
  PID:16276
- C:\Windows\System\OOVWIav.exe
  C:\Windows\System\OOVWIav.exe
  2⤵
  PID:16224
- C:\Windows\System\qRJqTjl.exe
  C:\Windows\System\qRJqTjl.exe
  2⤵
  PID:14428
- C:\Windows\System\gevVtSV.exe
  C:\Windows\System\gevVtSV.exe
  2⤵
  PID:15684
- C:\Windows\System\nIbBlAx.exe
  C:\Windows\System\nIbBlAx.exe
  2⤵
  PID:16076
- C:\Windows\System\ByOxbXl.exe
  C:\Windows\System\ByOxbXl.exe
  2⤵
  PID:16404
- C:\Windows\System\qqNYIdE.exe
  C:\Windows\System\qqNYIdE.exe
  2⤵
  PID:16428
- C:\Windows\System\YSPLWOX.exe
  C:\Windows\System\YSPLWOX.exe
  2⤵
  PID:16460
- C:\Windows\System\kJsyJFs.exe
  C:\Windows\System\kJsyJFs.exe
  2⤵
  PID:16480
- C:\Windows\System\CvZajAn.exe
  C:\Windows\System\CvZajAn.exe
  2⤵
  PID:16508
- C:\Windows\System\PqcWwSm.exe
  C:\Windows\System\PqcWwSm.exe
  2⤵
  PID:16528
- C:\Windows\System\ZQyDKEm.exe
  C:\Windows\System\ZQyDKEm.exe
  2⤵
  PID:16568
- C:\Windows\System\PzdxmZD.exe
  C:\Windows\System\PzdxmZD.exe
  2⤵
  PID:16592
- C:\Windows\System\dRAlwce.exe
  C:\Windows\System\dRAlwce.exe
  2⤵
  PID:16616
- C:\Windows\System\CuoNxIM.exe
  C:\Windows\System\CuoNxIM.exe
  2⤵
  PID:16636
- C:\Windows\System\dKEmpKo.exe
  C:\Windows\System\dKEmpKo.exe
  2⤵
  PID:16672
- C:\Windows\System\wlhAEhL.exe
  C:\Windows\System\wlhAEhL.exe
  2⤵
  PID:16692
- C:\Windows\System\OdLGMUU.exe
  C:\Windows\System\OdLGMUU.exe
  2⤵
  PID:16732
- C:\Windows\System\JksZxXD.exe
  C:\Windows\System\JksZxXD.exe
  2⤵
  PID:16756
- C:\Windows\System\bKamIfE.exe
  C:\Windows\System\bKamIfE.exe
  2⤵
  PID:16780
- C:\Windows\System\lcANvCr.exe
  C:\Windows\System\lcANvCr.exe
  2⤵
  PID:16808
- C:\Windows\System\uCNeWHz.exe
  C:\Windows\System\uCNeWHz.exe
  2⤵
  PID:16840
- C:\Windows\System\Ospbgio.exe
  C:\Windows\System\Ospbgio.exe
  2⤵
  PID:16868
- C:\Windows\System\QWjCIeS.exe
  C:\Windows\System\QWjCIeS.exe
  2⤵
  PID:16900
- C:\Windows\System\gxUJxyJ.exe
  C:\Windows\System\gxUJxyJ.exe
  2⤵
  PID:16940
- C:\Windows\System\nQsDVDr.exe
  C:\Windows\System\nQsDVDr.exe
  2⤵
  PID:16960
- C:\Windows\System\ySGneIP.exe
  C:\Windows\System\ySGneIP.exe
  2⤵
  PID:16992
- C:\Windows\System\QBIelsB.exe
  C:\Windows\System\QBIelsB.exe
  2⤵
  PID:17008
- C:\Windows\System\pxuduNX.exe
  C:\Windows\System\pxuduNX.exe
  2⤵
  PID:17048
- C:\Windows\System\gjtYnRn.exe
  C:\Windows\System\gjtYnRn.exe
  2⤵
  PID:17076
- C:\Windows\System\gyWNqAu.exe
  C:\Windows\System\gyWNqAu.exe
  2⤵
  PID:17096
- C:\Windows\System\tSpFfrV.exe
  C:\Windows\System\tSpFfrV.exe
  2⤵
  PID:17120
- C:\Windows\System\SknaqiO.exe
  C:\Windows\System\SknaqiO.exe
  2⤵
  PID:17152
- C:\Windows\System\DaPXcow.exe
  C:\Windows\System\DaPXcow.exe
  2⤵
  PID:17184
- C:\Windows\System\vxImXNh.exe
  C:\Windows\System\vxImXNh.exe
  2⤵
  PID:17212
- C:\Windows\System\SUpXtYK.exe
  C:\Windows\System\SUpXtYK.exe
  2⤵
  PID:17248
- C:\Windows\System\WZodfbD.exe
  C:\Windows\System\WZodfbD.exe
  2⤵
  PID:17276
- C:\Windows\System\lCMNnPv.exe
  C:\Windows\System\lCMNnPv.exe
  2⤵
  PID:17312
- C:\Windows\System\UOlJFaU.exe
  C:\Windows\System\UOlJFaU.exe
  2⤵
  PID:17352
- C:\Windows\System\ROoTtGo.exe
  C:\Windows\System\ROoTtGo.exe
  2⤵
  PID:17380
- C:\Windows\System\HHoKWdg.exe
  C:\Windows\System\HHoKWdg.exe
  2⤵
  PID:16388
- C:\Windows\System\IjjShHo.exe
  C:\Windows\System\IjjShHo.exe
  2⤵
  PID:7000
- C:\Windows\System\SLhGWRU.exe
  C:\Windows\System\SLhGWRU.exe
  2⤵
  PID:16416
- C:\Windows\System\xlxOgqs.exe
  C:\Windows\System\xlxOgqs.exe
  2⤵
  PID:16556
- C:\Windows\System\NnASMwA.exe
  C:\Windows\System\NnASMwA.exe
  2⤵
  PID:16544
- C:\Windows\System\UxsfLkG.exe
  C:\Windows\System\UxsfLkG.exe
  2⤵
  PID:16684
- C:\Windows\System\vkeuSst.exe
  C:\Windows\System\vkeuSst.exe
  2⤵
  PID:16744
- C:\Windows\System\loJPyOt.exe
  C:\Windows\System\loJPyOt.exe
  2⤵
  PID:16724
- C:\Windows\System\TbAPJwD.exe
  C:\Windows\System\TbAPJwD.exe
  2⤵
  PID:16816
- C:\Windows\System\khRxmfu.exe
  C:\Windows\System\khRxmfu.exe
  2⤵
  PID:16924
- C:\Windows\System\KlhXUKS.exe
  C:\Windows\System\KlhXUKS.exe
  2⤵
  PID:17324
- C:\Windows\System\MwfVYnM.exe
  C:\Windows\System\MwfVYnM.exe
  2⤵
  PID:17304
- C:\Windows\System\GKVFNdY.exe
  C:\Windows\System\GKVFNdY.exe
  2⤵
  PID:15524
- C:\Windows\System\rtxYKvC.exe
  C:\Windows\System\rtxYKvC.exe
  2⤵
  PID:15932
- C:\Windows\System\faGXLDY.exe
  C:\Windows\System\faGXLDY.exe
  2⤵
  PID:16504
- C:\Windows\System\ibAmBri.exe
  C:\Windows\System\ibAmBri.exe
  2⤵
  PID:16648
- C:\Windows\System\FhkSGwr.exe
  C:\Windows\System\FhkSGwr.exe
  2⤵
  PID:6928
- C:\Windows\System\dyfeAPj.exe
  C:\Windows\System\dyfeAPj.exe
  2⤵
  PID:16856
- C:\Windows\System\RDFFjeE.exe
  C:\Windows\System\RDFFjeE.exe
  2⤵
  PID:16952
- C:\Windows\System\hwQGsxa.exe
  C:\Windows\System\hwQGsxa.exe
  2⤵
  PID:1080

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:17340

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17240

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ACKhDXx.exe

Filesize
1.7MB

MD5
2999cd98142409eac3f5c69a40cc33d8

SHA1
a072fc675ab178c627abf32d0a86cd26306a4dff

SHA256
746bdb3af25f773673c1f85f1660c0fdf40c15e43ce59962703b0bfee772efb2

SHA512
f6455c225bfc1c04eedc5f4483c7a78181ca0b5082da96e1b0a1cc7254b325a81502b738375aa4025f57aaf220ad2a2a50f37bdbd41dbe30cfead5164f9abdee

Download Submit
C:\Windows\System\BtyDTsQ.exe

Filesize
1.7MB

MD5
8a2553168f803cfb485a0463f60a95f4

SHA1
8db8c392476cbecdb1d5899b476ad470de8385da

SHA256
e22831c924ccfc495c787e6d6cf6de4a1b22c238e070bbb799a8c8990c227a71

SHA512
8c14f482d2f1d4972222511ec14a2d41905eb9e4514eb9d1bdbf7830a97acd1cb9c850f92902044be413b817636af081dcf3882f8edcf9cf49ee6638856adb99

Download Submit
C:\Windows\System\BxcMQBq.exe

Filesize
1.7MB

MD5
f130f56aa86efbe67916f20c3a9ba649

SHA1
5abfc44ff98ba46c89383ce848f2e9be17d7d506

SHA256
0cc2ea3cae967d32fd6034292f8248255f490f45cd94117bbe7bb2c9d06ad459

SHA512
11567f1606d551347e77d88fe217b888258fd37b784806125bab5e033f6809d16ffefca4b1be59acc9260176cdacdff990f1e48fc8ef08a872a92177eb6fe46f

Download Submit
C:\Windows\System\JdMKktI.exe

Filesize
1.7MB

MD5
f6b64fbdcb6581538e9c1210976ca8a2

SHA1
77f715e2f27454dca0c45a62407912af8a8030f3

SHA256
33427ca47a9a75e792de9f61c06d43221aeedc00a0bf5e2859bc0b7f246360cb

SHA512
242992e3bf4592a887cb58ca9af5917402c7689a46c874b7f9d03066241efd846c3b42a0cdb62f85261c2de83e88b76c1f1ef79d925a8fc1657fc1f3ba38e2a3

Download Submit
C:\Windows\System\JfiuqGh.exe

Filesize
1.7MB

MD5
1b7d63a2bd8d0c632969dba4a77959a6

SHA1
471a5dd8df98b3afd9fa0610a0c9e9b81a86c9c5

SHA256
2f15f325c51568f8581160c03d933bb6281a3c6e487f58848dd8a5db0619b0d3

SHA512
a06599019bd0448ddd56d22e436ed16b94b19435ea549c585b6e7159b4257ae475c6beec7157dee19c125382eeacba75e4f1e3afdc2c613fa9bd52502c8017fa

Download Submit
C:\Windows\System\LoUPYMm.exe

Filesize
1.7MB

MD5
5c3a8e483c63023372caf8802a7ef3e2

SHA1
66b89d414401af45525da22b4ecd3ee350c81ae8

SHA256
5bfcaa31c4a4498de51f649b752a4e8499ed3bd7006fd5049a3ab1c807b2f9ea

SHA512
e476a8c855fd051bef200065d73646c528fb095680ed3f817b21f26226eb5214b72c46c583777335de34346c89846472e7fcc54858af90898b9d66ee4bf06d43

Download Submit
C:\Windows\System\MDtKJZH.exe

Filesize
1.7MB

MD5
0c719dc30f85d762ee28f074f90eb786

SHA1
61ebf1ca4ba0f46bcfedcf8be2f2416d5f0822f1

SHA256
c53f021bb989bd6e48f85ca04ce73ea9942d7647d4e5712863680f2106c9c42f

SHA512
b7085d577ddeba70a011b3d5522145f06cac6840291c2e008fb9ca880e4136a65a3e85d8cbcd3173ca2fca78d6c9310c5a459a3a35110adb0958eafd5309ae53

Download Submit
C:\Windows\System\NBiZxdt.exe

Filesize
1.7MB

MD5
c7c085c1e163f53932d0b5ca2becf9bb

SHA1
c88b9be1d47f208775a05000210ac0cce07a6e99

SHA256
3e635122c7170b751c188164d532a60137f7c9eed8850b58b1e23732da7967d7

SHA512
586b880435e2618904a4a07fc1e70e168c090af7c9d2af8a269160761164dc4ddd75dc4a4e24ed3ad0a33c5209fe755e645b7a4ad6bcfb9ad4cafc33364cfa6f

Download Submit
C:\Windows\System\NtRyxbk.exe

Filesize
1.7MB

MD5
04e3163dec3e16a767af6f696f90c646

SHA1
b3b1e642956c15bfd9ff7dd734d7137ea3b23d40

SHA256
760143a94d641831937cc37a41c352990a1d0ab9e65a90711bf27fa2d8d5b2d2

SHA512
39cb7b60091abdaba84a72f5fcd9ef35b291989384b7a722ee9a1ef84373e856ce8eeeb3df4a0e67f88abe969ac7e19fa75602cd5780fe9d3f6aef4baa76af74

Download Submit
C:\Windows\System\QPajAPH.exe

Filesize
1.7MB

MD5
aea2469dd02bfa073f7f0c729b8fd672

SHA1
4c4e1234e4b081b489e799de4b64375f769de303

SHA256
09579a6631e120bc377e3514d6ae091b0e4677dd18f5d71fb868f760c8180fd6

SHA512
f1207d1cad0c4c7bfdf6e881e09b311776f9fd4cd3dd7a15a25513df3968096901bbfb5923208e0e41a424dd621cb8a79c3b1085f97f3afc906e95d4f7c33035

Download Submit
C:\Windows\System\SVQLxTM.exe

Filesize
1.7MB

MD5
5134de27290702c35bf1efbaaf50b662

SHA1
c7942ee1541eb4686247dc2dde4d7649738d905e

SHA256
0b1f8f20d339f06d374382cb0d570151634db87534d5defa6fdadac4fa8b19df

SHA512
e703e3b3590e94c59339f5138371080960a182bebcd32a7f1e32e7e974dc2e7d7972ab49d1b18663559e8e488cbd4f3cfb1872e0f99e0787af96e3fec1b31a7d

Download Submit
C:\Windows\System\WSejCqB.exe

Filesize
1.7MB

MD5
14cb100ee4456a1194624a0365fb829a

SHA1
fd1d4a850ab342d936b2c0df8b09092a3b1ac256

SHA256
d9398967c7a36ee24420b364212f4dc25a5da77f8205254c6ee7eda2a652cf15

SHA512
9f6fa35b51d2c361ad38dda0951c4407455715255093e26e4ba18985e01769291566dff9d410aed20b1b533a7457bf66fc3bce8d60ab529608f0c80c75bb832d

Download Submit
C:\Windows\System\XNpqAsJ.exe

Filesize
1.7MB

MD5
2d3243803839ababe90d84aa1637d37f

SHA1
37c318387a0eeb8b00a8787781678a3417f45eb5

SHA256
cdc1766fd95e642d84f93d5edd9253e43c29ab809a3f60fcf0ba44420e0bd762

SHA512
51120c20ceec5503507a8448f95d05497e49dfd633f6435c79a2305dac3c029f7cb31583b66e4ab22e564352b28ca31f7a372fbb6e330ba65dc2860db03a0fdc

Download Submit
C:\Windows\System\YOgRiSA.exe

Filesize
1.7MB

MD5
2812173e95c472de7cf9b6f0be525c1b

SHA1
44f2114058935526b83fe70341845853705546d2

SHA256
1b5371dcd1a8dec1b724ea6e98aba4dc7c142ee9bd77fd8940bd160285fdd5b9

SHA512
2d0f1b009a8a0ce5e73fb6445f2e2971806f75971aec1b0f36f8c92cec668a36adfcade3193d21e0d4af6cfb5e6628568453fb472bfb55273ac5d649b4095b7b

Download Submit
C:\Windows\System\YbvnXsg.exe

Filesize
1.7MB

MD5
a70bce3c013efe27223a31e9fce5758e

SHA1
edc2c9ca5b3106280087c918e406492fbf25482f

SHA256
b36004bdf473997bc39245ec515b175facbb938db53a31d81f8de213d8c75e78

SHA512
b33e73e32380f78d557963f4f50ffcac521c05f3a1e590fa29f55bdd61705d945e37de744189ea942f20d54f3a801ceb57dd464c558723f8898e9c50001d7183

Download Submit
C:\Windows\System\YyquUyM.exe

Filesize
1.7MB

MD5
ff807bd19aa7b2970007a167c3111259

SHA1
77d5b92d0b337cf1d01d2f82de0060f946f143fd

SHA256
a9116b880b7315a07a7f401c444e42436b8d0681e961162bc31916cfc02e645b

SHA512
7c81647699578155cee1df2b31b2453819f641010aae0094041ecdeb5956c17f2dd211ee2769ba226ab9cc926e68b8db095981b8aedc610b513bc7becb8fa6b5

Download Submit
C:\Windows\System\ZdOkenU.exe

Filesize
1.7MB

MD5
d05f75005add2001bfb68d6a0c7f758a

SHA1
319461b1663ea8b76a7728d102402f1de4b419ce

SHA256
e07ea416082d95914cb83219a72df94ba3ce8f78e33b5d2f47d7b281cd519f35

SHA512
8d3e1ed759632795037a7f42b8067960387a16278dc6bc2702675e3b442ff4a3b82c17435ab373c7d3c3981b6031b029d245fd7c047018fb006107767d042a70

Download Submit
C:\Windows\System\atMtjbz.exe

Filesize
1.7MB

MD5
666323f0067186aa2c1c6c5bf8467458

SHA1
185d30b3a97efab039d74c1ffb2993942febab31

SHA256
e77ab4a6e83b143edac9c4fb6f31eb73c2d5a3feb9215c8fcf5b3628d07dbd0d

SHA512
4bab554b11cead93f84b61c83f6f06228488661b9688c447f15846603ce31926f7b0f7e8c31447d33d0a92c0ca5012c3816c91cd094e420bb70f06e22cc6c9e2

Download Submit
C:\Windows\System\eMSXoSL.exe

Filesize
1.7MB

MD5
b27011665bffbccd796aee63f7df5042

SHA1
4f114d5a46e8627e68dab32ab6ec5ea920086ebe

SHA256
03a9bd61440f414bb9718e340168809779280dcbddd8de56927dadc3f181c7e8

SHA512
4e1bbc4335224ac80e0030f5244ea8d6b6a4f51cd0cf619b109a607bb85cab303770ca4c08134b65a7f735573551553a0f6ebde8aca128e10a8aadf3283ee7bd

Download Submit
C:\Windows\System\fTqHFJm.exe

Filesize
1.7MB

MD5
834fb25e0243758440197befdd103622

SHA1
8bd8b39a84890f30e84a46d07a3026eaca6b9c1a

SHA256
4dd95c22217adb47e2afabb1a36b63cfbe66b3699d7f942b1cd523ff1a688250

SHA512
4b65d5ea43d2cc5989e1c617b9108a5a358db21426701f15434fdbce1acdf53e39d8588fef1beb788ccc698a83db0b58723f73317183120d42645386740939c5

Download Submit
C:\Windows\System\fduKxPH.exe

Filesize
1.7MB

MD5
7af99f1c4dcebf6c37646d36e429d4a0

SHA1
9200badbf57f846784a76f6cd4c08fbac8f6836b

SHA256
281580b84cd00d46983f9fc70eb8c2de8e52d2e87fa34ebb075f08a1cc5a94c6

SHA512
8f443ee58a23959ed501cd5700d5869b43d8623b983fbe9f8dbc6d28d5a3f465e4751f2faed1273be8f0fe51d5f0762429b2b9c1aa4b8d073c464b98aadee4e2

Download Submit
C:\Windows\System\finYbYS.exe

Filesize
1.7MB

MD5
d45631ca54407e619973e9f28ea4ddae

SHA1
975ab4b500d74d95e98bd8e22a6932327d94389e

SHA256
4c5f3b0bf5dfc8378227e1ae084dc08ad01faf7f9fe0e30a32093abf1006bfbe

SHA512
0f360e4fa9a892bd787800461dc9a34b9068b4f0cd80adc2a16b53f21d17afbdbadd0d36ee8f1429ba520c23eee8ac567680d4664dc8b6b19d724a738448a530

Download Submit
C:\Windows\System\hXOXIex.exe

Filesize
1.7MB

MD5
91693d8ea95106f4011af0734cf3be14

SHA1
a54fe79f359621e4a39ccc598dc8a5ced8627944

SHA256
1e217813b0c5fa7d9e410e38d8164e620412a97f3049cf4d30fa370e3c230723

SHA512
0d62e342d6ee47a3bbcf27071cf5590350a2ddfc883e350990d753d2ea038496e2e16d7ee5fddb163cb768c3836c4c58dafb163f1b45306512599cab8131d761

Download Submit
C:\Windows\System\jkWOPEr.exe

Filesize
1.7MB

MD5
1e6d22b54db968046784f1f3a5e7384b

SHA1
e961744e3aa256271f7805944e52a0f4a54daf4b

SHA256
1ddb2ad44f37edc89672010c1544dd3bfa004ab11485a7747af43d685fe15b87

SHA512
3a1a4abb1cf7ae427dbfa859fcf57d2f31f0c6c1c19fb6eaed976b56ffe9b77fecad39eaef85e70769bc9b733705b52e5d1a5728881eed964512bcf0d2bdfebc

Download Submit
C:\Windows\System\kMGoNlv.exe

Filesize
1.7MB

MD5
adad93c47c86052641d0e4ba15aa71d8

SHA1
54fc63493c1212dec50c34e97b8944ac96c10152

SHA256
907e2bd7d4102f38d03ec3316d8d36065ce7de0c47cd93f72ed833bdaf58cdf3

SHA512
f6367cc1327ffd89b71a538a6c59b96e768c1038896e13135040943ac3b6bf96004e2fd9e215f5fd89718fb980b8c592934890cdc334a3222705ce57eee99dff

Download Submit
C:\Windows\System\lKwHiAR.exe

Filesize
1.7MB

MD5
236982881248fc938d34c72659501b44

SHA1
a8c81074d7e238a62e4b4cd55082bb8ffe950521

SHA256
52b00b3a4bf5941bac1f1e896a42179cc9caa49b971d46a0aede268e10bc3575

SHA512
fbf899726a2dfbb93c687bf1ccba4643c8c07c8545b4b873ecf86492bb39f0f24c23d0a3165d1dffac7aaa11dfdc2c344c70e0aad6d4a5e29a14719efd543967

Download Submit
C:\Windows\System\mhTdhox.exe

Filesize
1.7MB

MD5
0e2c4d7a9c591ca6754f6f94aebcff49

SHA1
0e11189fc7c120798edb9d979f67b6e49562a831

SHA256
da9f7ca734e42acfe67bcb0466765a318e60a0b506f1a5087ee8408da7031f56

SHA512
080b06f7b982e87a5a474f555c9d25c5023c31e78e8211f625fea11a936687f7ce70645ec9ad841d5694591b2cecd08b247c9b0947fd892480a7b83c412af612

Download Submit
C:\Windows\System\npajMSS.exe

Filesize
1.7MB

MD5
4186ce2f74692c8a9b33bd47b4bf6482

SHA1
1bf501bf2b4bec310ccb69576b999de3e7082515

SHA256
05ca8a710c9c58f3097d18fab8526638e22fc1b44540573722623828d42ca04e

SHA512
e08c34d51b6c66ce02920c9c3119065daf402da31827771cd24161769c3331baee2ee0f1863e165ae05df0fb749c567c7fb609ada20879ddc30ba08cc4e70646

Download Submit
C:\Windows\System\rtiBBip.exe

Filesize
1.7MB

MD5
e4ade9848581436356c621595f786a91

SHA1
dde474452c6a315e7460b8cd417c1ddd458aef57

SHA256
f375e9989dd60f96f1917a5bb183b0276f4b684e1f86e0001cc7071e1c63579c

SHA512
2d0971c1150ff7e9978ca156d0e9a5bfba3269d126eafdf33a651258e651408321a1215a62356f26f3cd214591a92283618fa3cd6c809deab5abaf17edd7601a

Download Submit
C:\Windows\System\tsnFLbu.exe

Filesize
1.7MB

MD5
02a00367c5deb443c2851f0e03c29d81

SHA1
93f60fddb47e8ad4bb4efcd20c5aac9dc8c99343

SHA256
d5fb283a583fd4a3a2a5bc76cd7f54b06e6e331ef2aa265f7b16dd37e744b5e8

SHA512
c40c9291d8b94e4e2ca2af3e7ec25535aabefb72977ddb0777666c2fc1371c66f681d2101958b1965fff04829c6a4f6405d474237dcfa28df76b299eaf3341e1

Download Submit
C:\Windows\System\uisBLFO.exe

Filesize
1.7MB

MD5
a3ca06c653da88928019fc8f6fbb1cac

SHA1
c2cb4dc2f543cec289ec7a68e0706f7239768f6d

SHA256
3cc24fd99ae7f8e14ce37df02e7f93a0eb018295041fd9b7a6691264ccf82c82

SHA512
28620c0c7ea502149a93ad7dc81cd45e659fa52ad11fd2ac0bca6da14f146bff8960126336c6a2367d11da206cdf03f3ee5bf6957cc6345a6740c53793e3354d

Download Submit
C:\Windows\System\wKExMhJ.exe

Filesize
1.7MB

MD5
40065066adf9f81e069aee44adbf5a84

SHA1
c670787e8c5997252d6034652db0ddb1a6943082

SHA256
00549d9cf16e1bf0bc0477467d4d7db007e76f5ce76537ed7b48de75bb9bca03

SHA512
ab65ede4e97a1177bd187276247341edcaac3928c533c31be0f91ab0110171c8e9ad699264bbb8bb01285bfde1faeb07e79cd6d52382ddfa6e07203d49c62539

Download Submit
C:\Windows\System\xEXEWaI.exe

Filesize
1.7MB

MD5
c96a1d61f82e33721560c38f453956ed

SHA1
8c30c72e31b54fc5d20457d624ed9ec8307ea34a

SHA256
e67442ee94287d09ec8cc4448d24de50add05be9bbbd719062b983ca51517cb6

SHA512
fb316830054f3660d86d25ba31044753d14ca6bfd0389f89dc69465c17d04857528323aa691c049eb78b2e39952ceeb699476750917420332458950407d81455

Download Submit
C:\Windows\System\zxJuRuB.exe

Filesize
1.7MB

MD5
3fb19f06b0831f97c250f72487d7309c

SHA1
0bc776ab6fa2907b42f16692254750b4eaa98d3e

SHA256
16acd7fa24eab47432701aa4ae738f05e07391f49dcc24d06cfe14919e5c7aba

SHA512
45a95f3e38d7029de05a172e838a1b80d17e814dc9eb48417da4f9de62ce7ae84eaf6b30d105b5f9d2dccb333a645189697337d442b34d35df37fa21d7a1a3c1

Download Submit
memory/2172-0-0x00000148AA050000-0x00000148AA060000-memory.dmp

Filesize
64KB

Download