xmrig | 54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916

Analysis

max time kernel
119s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
Size

1.8MB
MD5

24202d395b82d1f9369b2acf03fe6008
SHA1

aa56ef57f37348f9eccd1c5fa8d958f28c19aa85
SHA256

54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916
SHA512

ba5a9b62210bad8e7c603fcc6ccf24d1a4e3bcf76e048830a77783fe90f36e5656a1ea0d39aacc29ebe3f317c9ec6dd7f91ec68e879b9564e5fe5535101da1c9
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnmxZ7eqs2U:GemTLkNdfE0pZyf

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

Processes:

resource	yara_rule
behavioral2/files/0x000d000000023b89-4.dat	xmrig
behavioral2/files/0x000b000000023b92-7.dat	xmrig
behavioral2/files/0x000a000000023b93-6.dat	xmrig
behavioral2/files/0x000a000000023b94-20.dat	xmrig
behavioral2/files/0x000a000000023b95-23.dat	xmrig
behavioral2/files/0x000a000000023b96-32.dat	xmrig
behavioral2/files/0x000a000000023b98-33.dat	xmrig
behavioral2/files/0x000a000000023b99-39.dat	xmrig
behavioral2/files/0x000a000000023b9a-44.dat	xmrig
behavioral2/files/0x000b000000023b90-53.dat	xmrig
behavioral2/files/0x000a000000023b9b-52.dat	xmrig
behavioral2/files/0x000a000000023b9c-59.dat	xmrig
behavioral2/files/0x000b000000023b9d-67.dat	xmrig
behavioral2/files/0x000b000000023b9e-71.dat	xmrig
behavioral2/files/0x000a000000023ba7-77.dat	xmrig
behavioral2/files/0x000e000000023bae-84.dat	xmrig
behavioral2/files/0x0008000000023bb7-87.dat	xmrig
behavioral2/files/0x0009000000023bbc-98.dat	xmrig
behavioral2/files/0x0009000000023bbd-100.dat	xmrig
behavioral2/files/0x0008000000023bc4-107.dat	xmrig
behavioral2/files/0x0008000000023bca-130.dat	xmrig
behavioral2/files/0x0008000000023bc9-128.dat	xmrig
behavioral2/files/0x0008000000023bc8-126.dat	xmrig
behavioral2/files/0x0008000000023bc7-124.dat	xmrig
behavioral2/files/0x0009000000023bbe-112.dat	xmrig
behavioral2/files/0x0008000000023bfc-148.dat	xmrig
behavioral2/files/0x0008000000023bfe-163.dat	xmrig
behavioral2/files/0x0008000000023c03-162.dat	xmrig
behavioral2/files/0x0008000000023bfb-157.dat	xmrig
behavioral2/files/0x0008000000023bfd-151.dat	xmrig
behavioral2/files/0x0008000000023bfa-138.dat	xmrig
behavioral2/files/0x0008000000023bf9-135.dat	xmrig
behavioral2/files/0x000b000000023b9f-74.dat	xmrig

Executes dropped EXE 64 IoCs

Processes:

ddaOoEG.exerBofOrN.exehTOKCLt.exeQzMgCBG.exezTQNDSB.exeMBmIHUy.exeoidgPGQ.exelFAEgbt.exeLdwvRqu.exeWqaXebC.exevWrrOmo.exeJPaevLO.exeyzikHLb.exeZfUqntW.exewRQYWeu.exebeaaOZs.exevwDXVyH.exeitOIRXp.exeeCqjkLL.exeUeaFMmC.exezPLmERU.exeJsUDIli.exeYAUpNyp.exeMPXNCJx.exeVUePBmj.exevnXklza.exefIJZFRK.exeYcVqpfQ.exeTuJaHEg.exeBCYTpxL.exeojizOcJ.exeyaEogKX.exeZDzJFyC.exeLWmklMx.exeMSYCHTQ.exeyAuJvME.exeZSahPNM.exeJSJqWkc.exeiKwYsEl.exeRExmFWE.exeEaPygGt.exeDKdEQXw.exeLhViKuy.exeMfrfVVw.execnkCGoP.exeVxuzhvR.exeFYuyegY.exexUlIGdH.exemTKxqAf.exekObQrPI.exeRXBGFet.exeddmBJfC.exepWnoZqH.exeZONfmdA.exenBXcDhh.exeXRhutMq.exexXnnDMK.exefibajlT.exeuxgxDCH.exemDUDunY.exelyAHxdW.exeFKDLPHs.exeLDSjFmj.exeInwcIhr.exe

pid	Process
3808	ddaOoEG.exe
4560	rBofOrN.exe
2472	hTOKCLt.exe
3412	QzMgCBG.exe
1560	zTQNDSB.exe
1196	MBmIHUy.exe
4628	oidgPGQ.exe
716	lFAEgbt.exe
3616	LdwvRqu.exe
548	WqaXebC.exe
3020	vWrrOmo.exe
3364	JPaevLO.exe
2052	yzikHLb.exe
1220	ZfUqntW.exe
4776	wRQYWeu.exe
2368	beaaOZs.exe
1392	vwDXVyH.exe
1440	itOIRXp.exe
2420	eCqjkLL.exe
2248	UeaFMmC.exe
4864	zPLmERU.exe
1452	JsUDIli.exe
396	YAUpNyp.exe
4660	MPXNCJx.exe
3108	VUePBmj.exe
372	vnXklza.exe
4420	fIJZFRK.exe
1476	YcVqpfQ.exe
2360	TuJaHEg.exe
1340	BCYTpxL.exe
4068	ojizOcJ.exe
1004	yaEogKX.exe
4092	ZDzJFyC.exe
2424	LWmklMx.exe
3596	MSYCHTQ.exe
3424	yAuJvME.exe
1800	ZSahPNM.exe
384	JSJqWkc.exe
4816	iKwYsEl.exe
2624	RExmFWE.exe
1032	EaPygGt.exe
1140	DKdEQXw.exe
3640	LhViKuy.exe
4464	MfrfVVw.exe
3492	cnkCGoP.exe
3920	VxuzhvR.exe
2332	FYuyegY.exe
876	xUlIGdH.exe
1356	mTKxqAf.exe
1596	kObQrPI.exe
3316	RXBGFet.exe
5056	ddmBJfC.exe
2348	pWnoZqH.exe
3428	ZONfmdA.exe
3056	nBXcDhh.exe
2444	XRhutMq.exe
2704	xXnnDMK.exe
2840	fibajlT.exe
464	uxgxDCH.exe
3432	mDUDunY.exe
3208	lyAHxdW.exe
4396	FKDLPHs.exe
116	LDSjFmj.exe
2612	InwcIhr.exe

Drops file in Windows directory 64 IoCs

Processes:

54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe

description	ioc	Process
File created	C:\Windows\System\oncrYBI.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\hIZgcBt.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\guSmPuO.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\lFlKwbV.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\cMLgLtg.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\fpFsoiB.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\BsrIDHA.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\loAwkLm.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\UdjZdZJ.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\TMobpRQ.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\gABOShw.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\jZZUYfP.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\TLqIksl.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\tFVTHjL.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\dYmrZBx.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\AytxepB.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\lNMjhtX.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\ewVwiRZ.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\jJaZdfK.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\RMInZqj.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\KrpKIrI.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\BVwpWhr.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\LWmklMx.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\XLVcqal.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\FUmXTfD.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\NlCDvJd.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\vpdWqPj.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\uCcZDFo.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\OCoPsoG.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\iWMGvGl.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\ngHMSnF.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\pXSjMod.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\HcFbxKM.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\hxIZmXF.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\HRvHPYe.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\ujKiTyd.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\shcVXib.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\BwWMDDs.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\wxUSgjl.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\rBofOrN.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\xfPuLpE.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\vOpkaCp.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\zKRiaxq.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\sZfVWcG.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\aytzfLR.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\KcdHcQE.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\qYuBOif.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\ijXPmln.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\clOLWAr.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\MwCZaje.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\zPEXrAp.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\MQZLFEH.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\CfTkTvh.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\ysgscbJ.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\LhhTsGM.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\QzMgCBG.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\XClXWLG.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\acPSRGj.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\YcvTfxK.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\iwpMNjQ.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\ozcAaWM.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\haHISco.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\BhTPHXN.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
File created	C:\Windows\System\whIqXBh.exe	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

Processes:

dwm.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

dwm.exe

description	pid	Process
Token: SeCreateGlobalPrivilege	16968	dwm.exe
Token: SeChangeNotifyPrivilege	16968	dwm.exe
Token: 33	16968	dwm.exe
Token: SeIncBasePriorityPrivilege	16968	dwm.exe
Token: SeShutdownPrivilege	16968	dwm.exe
Token: SeCreatePagefilePrivilege	16968	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe

description	pid	Process	procid_target
PID 4476 wrote to memory of 3808	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	84
PID 4476 wrote to memory of 3808	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	84
PID 4476 wrote to memory of 4560	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	85
PID 4476 wrote to memory of 4560	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	85
PID 4476 wrote to memory of 2472	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	86
PID 4476 wrote to memory of 2472	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	86
PID 4476 wrote to memory of 3412	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	87
PID 4476 wrote to memory of 3412	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	87
PID 4476 wrote to memory of 1560	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	88
PID 4476 wrote to memory of 1560	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	88
PID 4476 wrote to memory of 1196	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	89
PID 4476 wrote to memory of 1196	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	89
PID 4476 wrote to memory of 4628	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	90
PID 4476 wrote to memory of 4628	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	90
PID 4476 wrote to memory of 716	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	91
PID 4476 wrote to memory of 716	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	91
PID 4476 wrote to memory of 3616	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	92
PID 4476 wrote to memory of 3616	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	92
PID 4476 wrote to memory of 548	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	93
PID 4476 wrote to memory of 548	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	93
PID 4476 wrote to memory of 3020	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	94
PID 4476 wrote to memory of 3020	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	94
PID 4476 wrote to memory of 3364	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	95
PID 4476 wrote to memory of 3364	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	95
PID 4476 wrote to memory of 2052	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	96
PID 4476 wrote to memory of 2052	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	96
PID 4476 wrote to memory of 1220	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	97
PID 4476 wrote to memory of 1220	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	97
PID 4476 wrote to memory of 4776	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	98
PID 4476 wrote to memory of 4776	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	98
PID 4476 wrote to memory of 2368	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	99
PID 4476 wrote to memory of 2368	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	99
PID 4476 wrote to memory of 1392	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	100
PID 4476 wrote to memory of 1392	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	100
PID 4476 wrote to memory of 1440	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	101
PID 4476 wrote to memory of 1440	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	101
PID 4476 wrote to memory of 2420	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	102
PID 4476 wrote to memory of 2420	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	102
PID 4476 wrote to memory of 2248	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	103
PID 4476 wrote to memory of 2248	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	103
PID 4476 wrote to memory of 4864	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	104
PID 4476 wrote to memory of 4864	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	104
PID 4476 wrote to memory of 1452	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	105
PID 4476 wrote to memory of 1452	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	105
PID 4476 wrote to memory of 396	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	106
PID 4476 wrote to memory of 396	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	106
PID 4476 wrote to memory of 4660	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	107
PID 4476 wrote to memory of 4660	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	107
PID 4476 wrote to memory of 3108	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	108
PID 4476 wrote to memory of 3108	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	108
PID 4476 wrote to memory of 372	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	109
PID 4476 wrote to memory of 372	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	109
PID 4476 wrote to memory of 4420	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	110
PID 4476 wrote to memory of 4420	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	110
PID 4476 wrote to memory of 1476	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	111
PID 4476 wrote to memory of 1476	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	111
PID 4476 wrote to memory of 2360	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	112
PID 4476 wrote to memory of 2360	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	112
PID 4476 wrote to memory of 1340	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	113
PID 4476 wrote to memory of 1340	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	113
PID 4476 wrote to memory of 4068	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	114
PID 4476 wrote to memory of 4068	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	114
PID 4476 wrote to memory of 1004	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	115
PID 4476 wrote to memory of 1004	4476	54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe	115

C:\Users\Admin\AppData\Local\Temp\54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe
"C:\Users\Admin\AppData\Local\Temp\54d09e719b570b5527cadc053b44c01aeb42dc89b90853c8e91d192fdb3fe916.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\System\ddaOoEG.exe
  C:\Windows\System\ddaOoEG.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\rBofOrN.exe
  C:\Windows\System\rBofOrN.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\hTOKCLt.exe
  C:\Windows\System\hTOKCLt.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\QzMgCBG.exe
  C:\Windows\System\QzMgCBG.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\zTQNDSB.exe
  C:\Windows\System\zTQNDSB.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\MBmIHUy.exe
  C:\Windows\System\MBmIHUy.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\oidgPGQ.exe
  C:\Windows\System\oidgPGQ.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\lFAEgbt.exe
  C:\Windows\System\lFAEgbt.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\LdwvRqu.exe
  C:\Windows\System\LdwvRqu.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\WqaXebC.exe
  C:\Windows\System\WqaXebC.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\vWrrOmo.exe
  C:\Windows\System\vWrrOmo.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\JPaevLO.exe
  C:\Windows\System\JPaevLO.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\yzikHLb.exe
  C:\Windows\System\yzikHLb.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\ZfUqntW.exe
  C:\Windows\System\ZfUqntW.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\wRQYWeu.exe
  C:\Windows\System\wRQYWeu.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\beaaOZs.exe
  C:\Windows\System\beaaOZs.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\vwDXVyH.exe
  C:\Windows\System\vwDXVyH.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\itOIRXp.exe
  C:\Windows\System\itOIRXp.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\eCqjkLL.exe
  C:\Windows\System\eCqjkLL.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\UeaFMmC.exe
  C:\Windows\System\UeaFMmC.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\zPLmERU.exe
  C:\Windows\System\zPLmERU.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\JsUDIli.exe
  C:\Windows\System\JsUDIli.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\YAUpNyp.exe
  C:\Windows\System\YAUpNyp.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\MPXNCJx.exe
  C:\Windows\System\MPXNCJx.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\VUePBmj.exe
  C:\Windows\System\VUePBmj.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\vnXklza.exe
  C:\Windows\System\vnXklza.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\fIJZFRK.exe
  C:\Windows\System\fIJZFRK.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\YcVqpfQ.exe
  C:\Windows\System\YcVqpfQ.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\TuJaHEg.exe
  C:\Windows\System\TuJaHEg.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\BCYTpxL.exe
  C:\Windows\System\BCYTpxL.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\ojizOcJ.exe
  C:\Windows\System\ojizOcJ.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\yaEogKX.exe
  C:\Windows\System\yaEogKX.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\ZDzJFyC.exe
  C:\Windows\System\ZDzJFyC.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\LWmklMx.exe
  C:\Windows\System\LWmklMx.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\MSYCHTQ.exe
  C:\Windows\System\MSYCHTQ.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\yAuJvME.exe
  C:\Windows\System\yAuJvME.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\ZSahPNM.exe
  C:\Windows\System\ZSahPNM.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\JSJqWkc.exe
  C:\Windows\System\JSJqWkc.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\iKwYsEl.exe
  C:\Windows\System\iKwYsEl.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\RExmFWE.exe
  C:\Windows\System\RExmFWE.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\EaPygGt.exe
  C:\Windows\System\EaPygGt.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\DKdEQXw.exe
  C:\Windows\System\DKdEQXw.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\LhViKuy.exe
  C:\Windows\System\LhViKuy.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\MfrfVVw.exe
  C:\Windows\System\MfrfVVw.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\cnkCGoP.exe
  C:\Windows\System\cnkCGoP.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\VxuzhvR.exe
  C:\Windows\System\VxuzhvR.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\FYuyegY.exe
  C:\Windows\System\FYuyegY.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\xUlIGdH.exe
  C:\Windows\System\xUlIGdH.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\mTKxqAf.exe
  C:\Windows\System\mTKxqAf.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\kObQrPI.exe
  C:\Windows\System\kObQrPI.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\RXBGFet.exe
  C:\Windows\System\RXBGFet.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\ddmBJfC.exe
  C:\Windows\System\ddmBJfC.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\pWnoZqH.exe
  C:\Windows\System\pWnoZqH.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\ZONfmdA.exe
  C:\Windows\System\ZONfmdA.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\nBXcDhh.exe
  C:\Windows\System\nBXcDhh.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\XRhutMq.exe
  C:\Windows\System\XRhutMq.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\xXnnDMK.exe
  C:\Windows\System\xXnnDMK.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\fibajlT.exe
  C:\Windows\System\fibajlT.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\uxgxDCH.exe
  C:\Windows\System\uxgxDCH.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\mDUDunY.exe
  C:\Windows\System\mDUDunY.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\lyAHxdW.exe
  C:\Windows\System\lyAHxdW.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\FKDLPHs.exe
  C:\Windows\System\FKDLPHs.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\LDSjFmj.exe
  C:\Windows\System\LDSjFmj.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\InwcIhr.exe
  C:\Windows\System\InwcIhr.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\gABOShw.exe
  C:\Windows\System\gABOShw.exe
  2⤵
  PID:5064
- C:\Windows\System\ppkMXEM.exe
  C:\Windows\System\ppkMXEM.exe
  2⤵
  PID:4160
- C:\Windows\System\SrbMDlc.exe
  C:\Windows\System\SrbMDlc.exe
  2⤵
  PID:4048
- C:\Windows\System\SYckrFY.exe
  C:\Windows\System\SYckrFY.exe
  2⤵
  PID:668
- C:\Windows\System\wtxHmGN.exe
  C:\Windows\System\wtxHmGN.exe
  2⤵
  PID:4392
- C:\Windows\System\ZOFxjdj.exe
  C:\Windows\System\ZOFxjdj.exe
  2⤵
  PID:4624
- C:\Windows\System\BnSYzHX.exe
  C:\Windows\System\BnSYzHX.exe
  2⤵
  PID:2780
- C:\Windows\System\WFaCybD.exe
  C:\Windows\System\WFaCybD.exe
  2⤵
  PID:1148
- C:\Windows\System\AVPraka.exe
  C:\Windows\System\AVPraka.exe
  2⤵
  PID:532
- C:\Windows\System\rnTFRUB.exe
  C:\Windows\System\rnTFRUB.exe
  2⤵
  PID:2068
- C:\Windows\System\gnbGHwB.exe
  C:\Windows\System\gnbGHwB.exe
  2⤵
  PID:1080
- C:\Windows\System\PYjqAzE.exe
  C:\Windows\System\PYjqAzE.exe
  2⤵
  PID:2956
- C:\Windows\System\ZYJuBZQ.exe
  C:\Windows\System\ZYJuBZQ.exe
  2⤵
  PID:4212
- C:\Windows\System\jriVeWx.exe
  C:\Windows\System\jriVeWx.exe
  2⤵
  PID:1008
- C:\Windows\System\iMLDGRa.exe
  C:\Windows\System\iMLDGRa.exe
  2⤵
  PID:1820
- C:\Windows\System\bIKGauK.exe
  C:\Windows\System\bIKGauK.exe
  2⤵
  PID:3500
- C:\Windows\System\ZGQJDlU.exe
  C:\Windows\System\ZGQJDlU.exe
  2⤵
  PID:2056
- C:\Windows\System\zjQERYI.exe
  C:\Windows\System\zjQERYI.exe
  2⤵
  PID:1636
- C:\Windows\System\sfwzvvP.exe
  C:\Windows\System\sfwzvvP.exe
  2⤵
  PID:4604
- C:\Windows\System\PcyoDGB.exe
  C:\Windows\System\PcyoDGB.exe
  2⤵
  PID:3196
- C:\Windows\System\XClXWLG.exe
  C:\Windows\System\XClXWLG.exe
  2⤵
  PID:3484
- C:\Windows\System\pIWRsMC.exe
  C:\Windows\System\pIWRsMC.exe
  2⤵
  PID:1132
- C:\Windows\System\xNRUpOg.exe
  C:\Windows\System\xNRUpOg.exe
  2⤵
  PID:3496
- C:\Windows\System\dJwCThu.exe
  C:\Windows\System\dJwCThu.exe
  2⤵
  PID:2416
- C:\Windows\System\zwMiiOi.exe
  C:\Windows\System\zwMiiOi.exe
  2⤵
  PID:3456
- C:\Windows\System\YnMLGBK.exe
  C:\Windows\System\YnMLGBK.exe
  2⤵
  PID:3032
- C:\Windows\System\VDZhWoP.exe
  C:\Windows\System\VDZhWoP.exe
  2⤵
  PID:2528
- C:\Windows\System\GWFxGxO.exe
  C:\Windows\System\GWFxGxO.exe
  2⤵
  PID:3552
- C:\Windows\System\rZThlWF.exe
  C:\Windows\System\rZThlWF.exe
  2⤵
  PID:1836
- C:\Windows\System\fAiFLRV.exe
  C:\Windows\System\fAiFLRV.exe
  2⤵
  PID:1872
- C:\Windows\System\BWbIimL.exe
  C:\Windows\System\BWbIimL.exe
  2⤵
  PID:3084
- C:\Windows\System\cNVvTSc.exe
  C:\Windows\System\cNVvTSc.exe
  2⤵
  PID:1504
- C:\Windows\System\cOEiRVM.exe
  C:\Windows\System\cOEiRVM.exe
  2⤵
  PID:1884
- C:\Windows\System\GRhacHp.exe
  C:\Windows\System\GRhacHp.exe
  2⤵
  PID:4484
- C:\Windows\System\OBUuSwb.exe
  C:\Windows\System\OBUuSwb.exe
  2⤵
  PID:2748
- C:\Windows\System\MhseRye.exe
  C:\Windows\System\MhseRye.exe
  2⤵
  PID:3852
- C:\Windows\System\pzUPmlT.exe
  C:\Windows\System\pzUPmlT.exe
  2⤵
  PID:5132
- C:\Windows\System\CfTkTvh.exe
  C:\Windows\System\CfTkTvh.exe
  2⤵
  PID:5164
- C:\Windows\System\VZdwPZG.exe
  C:\Windows\System\VZdwPZG.exe
  2⤵
  PID:5196
- C:\Windows\System\rFeuwoP.exe
  C:\Windows\System\rFeuwoP.exe
  2⤵
  PID:5224
- C:\Windows\System\Lwyazwm.exe
  C:\Windows\System\Lwyazwm.exe
  2⤵
  PID:5260
- C:\Windows\System\iDEWHUu.exe
  C:\Windows\System\iDEWHUu.exe
  2⤵
  PID:5292
- C:\Windows\System\DpbZyxN.exe
  C:\Windows\System\DpbZyxN.exe
  2⤵
  PID:5312
- C:\Windows\System\wvYSJlY.exe
  C:\Windows\System\wvYSJlY.exe
  2⤵
  PID:5340
- C:\Windows\System\diTqKFY.exe
  C:\Windows\System\diTqKFY.exe
  2⤵
  PID:5376
- C:\Windows\System\JpRSCbZ.exe
  C:\Windows\System\JpRSCbZ.exe
  2⤵
  PID:5400
- C:\Windows\System\vJjLnZv.exe
  C:\Windows\System\vJjLnZv.exe
  2⤵
  PID:5432
- C:\Windows\System\niRVunI.exe
  C:\Windows\System\niRVunI.exe
  2⤵
  PID:5480
- C:\Windows\System\kBlndhQ.exe
  C:\Windows\System\kBlndhQ.exe
  2⤵
  PID:5504
- C:\Windows\System\HOhCJiL.exe
  C:\Windows\System\HOhCJiL.exe
  2⤵
  PID:5520
- C:\Windows\System\UNOsJuy.exe
  C:\Windows\System\UNOsJuy.exe
  2⤵
  PID:5552
- C:\Windows\System\AbIWtAs.exe
  C:\Windows\System\AbIWtAs.exe
  2⤵
  PID:5580
- C:\Windows\System\DkauHVg.exe
  C:\Windows\System\DkauHVg.exe
  2⤵
  PID:5604
- C:\Windows\System\ZmRSLew.exe
  C:\Windows\System\ZmRSLew.exe
  2⤵
  PID:5632
- C:\Windows\System\WQICfJh.exe
  C:\Windows\System\WQICfJh.exe
  2⤵
  PID:5652
- C:\Windows\System\VhNyIOV.exe
  C:\Windows\System\VhNyIOV.exe
  2⤵
  PID:5680
- C:\Windows\System\xmNJfNP.exe
  C:\Windows\System\xmNJfNP.exe
  2⤵
  PID:5708
- C:\Windows\System\ftGRvbR.exe
  C:\Windows\System\ftGRvbR.exe
  2⤵
  PID:5728
- C:\Windows\System\XExJZCm.exe
  C:\Windows\System\XExJZCm.exe
  2⤵
  PID:5748
- C:\Windows\System\CPpYKRf.exe
  C:\Windows\System\CPpYKRf.exe
  2⤵
  PID:5772
- C:\Windows\System\hLpoZlr.exe
  C:\Windows\System\hLpoZlr.exe
  2⤵
  PID:5800
- C:\Windows\System\FitwZLk.exe
  C:\Windows\System\FitwZLk.exe
  2⤵
  PID:5828
- C:\Windows\System\IfyBRNB.exe
  C:\Windows\System\IfyBRNB.exe
  2⤵
  PID:5860
- C:\Windows\System\NeXAfCa.exe
  C:\Windows\System\NeXAfCa.exe
  2⤵
  PID:5892
- C:\Windows\System\XLVcqal.exe
  C:\Windows\System\XLVcqal.exe
  2⤵
  PID:5920
- C:\Windows\System\JFnAYSc.exe
  C:\Windows\System\JFnAYSc.exe
  2⤵
  PID:5948
- C:\Windows\System\xfPuLpE.exe
  C:\Windows\System\xfPuLpE.exe
  2⤵
  PID:5968
- C:\Windows\System\clRCaji.exe
  C:\Windows\System\clRCaji.exe
  2⤵
  PID:6000
- C:\Windows\System\TCEOoGy.exe
  C:\Windows\System\TCEOoGy.exe
  2⤵
  PID:6040
- C:\Windows\System\SPKTSFg.exe
  C:\Windows\System\SPKTSFg.exe
  2⤵
  PID:6072
- C:\Windows\System\ysgscbJ.exe
  C:\Windows\System\ysgscbJ.exe
  2⤵
  PID:6096
- C:\Windows\System\FUmXTfD.exe
  C:\Windows\System\FUmXTfD.exe
  2⤵
  PID:6124
- C:\Windows\System\pKaSYVB.exe
  C:\Windows\System\pKaSYVB.exe
  2⤵
  PID:4636
- C:\Windows\System\JMQLBVW.exe
  C:\Windows\System\JMQLBVW.exe
  2⤵
  PID:4224
- C:\Windows\System\HTaiMHv.exe
  C:\Windows\System\HTaiMHv.exe
  2⤵
  PID:5188
- C:\Windows\System\pPFFfeE.exe
  C:\Windows\System\pPFFfeE.exe
  2⤵
  PID:5252
- C:\Windows\System\nxLRPUq.exe
  C:\Windows\System\nxLRPUq.exe
  2⤵
  PID:5328
- C:\Windows\System\JCKXxqf.exe
  C:\Windows\System\JCKXxqf.exe
  2⤵
  PID:5424
- C:\Windows\System\zhWFwgY.exe
  C:\Windows\System\zhWFwgY.exe
  2⤵
  PID:5500
- C:\Windows\System\nlMjxER.exe
  C:\Windows\System\nlMjxER.exe
  2⤵
  PID:5576
- C:\Windows\System\fpaYfzH.exe
  C:\Windows\System\fpaYfzH.exe
  2⤵
  PID:5660
- C:\Windows\System\DwxZWOL.exe
  C:\Windows\System\DwxZWOL.exe
  2⤵
  PID:5716
- C:\Windows\System\ZiQzZdk.exe
  C:\Windows\System\ZiQzZdk.exe
  2⤵
  PID:5696
- C:\Windows\System\yvKqHUn.exe
  C:\Windows\System\yvKqHUn.exe
  2⤵
  PID:5848
- C:\Windows\System\joSxnjF.exe
  C:\Windows\System\joSxnjF.exe
  2⤵
  PID:5928
- C:\Windows\System\hxIZmXF.exe
  C:\Windows\System\hxIZmXF.exe
  2⤵
  PID:6008
- C:\Windows\System\KfqyXll.exe
  C:\Windows\System\KfqyXll.exe
  2⤵
  PID:6064
- C:\Windows\System\bBHocep.exe
  C:\Windows\System\bBHocep.exe
  2⤵
  PID:6084
- C:\Windows\System\cJfsped.exe
  C:\Windows\System\cJfsped.exe
  2⤵
  PID:4616
- C:\Windows\System\LzISKQW.exe
  C:\Windows\System\LzISKQW.exe
  2⤵
  PID:5320
- C:\Windows\System\MiYdMAR.exe
  C:\Windows\System\MiYdMAR.exe
  2⤵
  PID:5384
- C:\Windows\System\YgOuijO.exe
  C:\Windows\System\YgOuijO.exe
  2⤵
  PID:5560
- C:\Windows\System\vbrkPep.exe
  C:\Windows\System\vbrkPep.exe
  2⤵
  PID:5700
- C:\Windows\System\QCACgwm.exe
  C:\Windows\System\QCACgwm.exe
  2⤵
  PID:5912
- C:\Windows\System\NuhzfyM.exe
  C:\Windows\System\NuhzfyM.exe
  2⤵
  PID:6104
- C:\Windows\System\nbRfhjV.exe
  C:\Windows\System\nbRfhjV.exe
  2⤵
  PID:5364
- C:\Windows\System\frSyJfw.exe
  C:\Windows\System\frSyJfw.exe
  2⤵
  PID:5720
- C:\Windows\System\iqulmXe.exe
  C:\Windows\System\iqulmXe.exe
  2⤵
  PID:6060
- C:\Windows\System\WKrGoKn.exe
  C:\Windows\System\WKrGoKn.exe
  2⤵
  PID:5624
- C:\Windows\System\acPSRGj.exe
  C:\Windows\System\acPSRGj.exe
  2⤵
  PID:6152
- C:\Windows\System\eEdydai.exe
  C:\Windows\System\eEdydai.exe
  2⤵
  PID:6180
- C:\Windows\System\XKGPrFQ.exe
  C:\Windows\System\XKGPrFQ.exe
  2⤵
  PID:6208
- C:\Windows\System\ItbyvsZ.exe
  C:\Windows\System\ItbyvsZ.exe
  2⤵
  PID:6224
- C:\Windows\System\TiuJSwz.exe
  C:\Windows\System\TiuJSwz.exe
  2⤵
  PID:6256
- C:\Windows\System\KMtDBtu.exe
  C:\Windows\System\KMtDBtu.exe
  2⤵
  PID:6284
- C:\Windows\System\HbOICfd.exe
  C:\Windows\System\HbOICfd.exe
  2⤵
  PID:6320
- C:\Windows\System\NRjkzYV.exe
  C:\Windows\System\NRjkzYV.exe
  2⤵
  PID:6336
- C:\Windows\System\DsyLDDm.exe
  C:\Windows\System\DsyLDDm.exe
  2⤵
  PID:6368
- C:\Windows\System\joEHqqa.exe
  C:\Windows\System\joEHqqa.exe
  2⤵
  PID:6392
- C:\Windows\System\AisSUvD.exe
  C:\Windows\System\AisSUvD.exe
  2⤵
  PID:6420
- C:\Windows\System\AytxepB.exe
  C:\Windows\System\AytxepB.exe
  2⤵
  PID:6452
- C:\Windows\System\vHFCJxK.exe
  C:\Windows\System\vHFCJxK.exe
  2⤵
  PID:6488
- C:\Windows\System\qVVUZda.exe
  C:\Windows\System\qVVUZda.exe
  2⤵
  PID:6504
- C:\Windows\System\jZZUYfP.exe
  C:\Windows\System\jZZUYfP.exe
  2⤵
  PID:6532
- C:\Windows\System\qaZexGz.exe
  C:\Windows\System\qaZexGz.exe
  2⤵
  PID:6564
- C:\Windows\System\rPjRqEt.exe
  C:\Windows\System\rPjRqEt.exe
  2⤵
  PID:6596
- C:\Windows\System\fpFsoiB.exe
  C:\Windows\System\fpFsoiB.exe
  2⤵
  PID:6616
- C:\Windows\System\wgyvRyi.exe
  C:\Windows\System\wgyvRyi.exe
  2⤵
  PID:6644
- C:\Windows\System\xNlbXXk.exe
  C:\Windows\System\xNlbXXk.exe
  2⤵
  PID:6676
- C:\Windows\System\MHzVyOY.exe
  C:\Windows\System\MHzVyOY.exe
  2⤵
  PID:6704
- C:\Windows\System\AmoKxsH.exe
  C:\Windows\System\AmoKxsH.exe
  2⤵
  PID:6736
- C:\Windows\System\BsrIDHA.exe
  C:\Windows\System\BsrIDHA.exe
  2⤵
  PID:6756
- C:\Windows\System\VKNyevi.exe
  C:\Windows\System\VKNyevi.exe
  2⤵
  PID:6772
- C:\Windows\System\JhmcMng.exe
  C:\Windows\System\JhmcMng.exe
  2⤵
  PID:6800
- C:\Windows\System\eitltvo.exe
  C:\Windows\System\eitltvo.exe
  2⤵
  PID:6824
- C:\Windows\System\ZDPzMdC.exe
  C:\Windows\System\ZDPzMdC.exe
  2⤵
  PID:6856
- C:\Windows\System\gzKxfsN.exe
  C:\Windows\System\gzKxfsN.exe
  2⤵
  PID:6880
- C:\Windows\System\rrooAkq.exe
  C:\Windows\System\rrooAkq.exe
  2⤵
  PID:6908
- C:\Windows\System\xUZgjlR.exe
  C:\Windows\System\xUZgjlR.exe
  2⤵
  PID:6936
- C:\Windows\System\SEAAMwV.exe
  C:\Windows\System\SEAAMwV.exe
  2⤵
  PID:6968
- C:\Windows\System\paBQjGE.exe
  C:\Windows\System\paBQjGE.exe
  2⤵
  PID:6996
- C:\Windows\System\eIaeyxJ.exe
  C:\Windows\System\eIaeyxJ.exe
  2⤵
  PID:7016
- C:\Windows\System\XGCAnwT.exe
  C:\Windows\System\XGCAnwT.exe
  2⤵
  PID:7052
- C:\Windows\System\COXYaBb.exe
  C:\Windows\System\COXYaBb.exe
  2⤵
  PID:7092
- C:\Windows\System\HnTNXSO.exe
  C:\Windows\System\HnTNXSO.exe
  2⤵
  PID:7124
- C:\Windows\System\xuylDtH.exe
  C:\Windows\System\xuylDtH.exe
  2⤵
  PID:7160
- C:\Windows\System\GUObkmS.exe
  C:\Windows\System\GUObkmS.exe
  2⤵
  PID:6172
- C:\Windows\System\FbfmcQH.exe
  C:\Windows\System\FbfmcQH.exe
  2⤵
  PID:6236
- C:\Windows\System\UygBUDl.exe
  C:\Windows\System\UygBUDl.exe
  2⤵
  PID:6292
- C:\Windows\System\OWTNEEo.exe
  C:\Windows\System\OWTNEEo.exe
  2⤵
  PID:6352
- C:\Windows\System\ewPsYUI.exe
  C:\Windows\System\ewPsYUI.exe
  2⤵
  PID:5492
- C:\Windows\System\CtBbXFD.exe
  C:\Windows\System\CtBbXFD.exe
  2⤵
  PID:6448
- C:\Windows\System\QvzhPqZ.exe
  C:\Windows\System\QvzhPqZ.exe
  2⤵
  PID:6528
- C:\Windows\System\aqlAIrN.exe
  C:\Windows\System\aqlAIrN.exe
  2⤵
  PID:6592
- C:\Windows\System\lNESEBN.exe
  C:\Windows\System\lNESEBN.exe
  2⤵
  PID:6636
- C:\Windows\System\QNBRqtb.exe
  C:\Windows\System\QNBRqtb.exe
  2⤵
  PID:6748
- C:\Windows\System\HRvHPYe.exe
  C:\Windows\System\HRvHPYe.exe
  2⤵
  PID:6796
- C:\Windows\System\snsaVaj.exe
  C:\Windows\System\snsaVaj.exe
  2⤵
  PID:6900
- C:\Windows\System\mFurNIE.exe
  C:\Windows\System\mFurNIE.exe
  2⤵
  PID:6932
- C:\Windows\System\QTXPNMD.exe
  C:\Windows\System\QTXPNMD.exe
  2⤵
  PID:7044
- C:\Windows\System\myzhvvm.exe
  C:\Windows\System\myzhvvm.exe
  2⤵
  PID:7036
- C:\Windows\System\PNROscs.exe
  C:\Windows\System\PNROscs.exe
  2⤵
  PID:7108
- C:\Windows\System\IUiviOO.exe
  C:\Windows\System\IUiviOO.exe
  2⤵
  PID:6164
- C:\Windows\System\nBvlyAM.exe
  C:\Windows\System\nBvlyAM.exe
  2⤵
  PID:6312
- C:\Windows\System\VAhudST.exe
  C:\Windows\System\VAhudST.exe
  2⤵
  PID:6548
- C:\Windows\System\ZscYaUZ.exe
  C:\Windows\System\ZscYaUZ.exe
  2⤵
  PID:6604
- C:\Windows\System\CsjzkyH.exe
  C:\Windows\System\CsjzkyH.exe
  2⤵
  PID:6688
- C:\Windows\System\GBXUKuO.exe
  C:\Windows\System\GBXUKuO.exe
  2⤵
  PID:6920
- C:\Windows\System\ozcAaWM.exe
  C:\Windows\System\ozcAaWM.exe
  2⤵
  PID:6992
- C:\Windows\System\AUTnCuw.exe
  C:\Windows\System\AUTnCuw.exe
  2⤵
  PID:6276
- C:\Windows\System\CsNjEkD.exe
  C:\Windows\System\CsNjEkD.exe
  2⤵
  PID:6484
- C:\Windows\System\hCbnMNL.exe
  C:\Windows\System\hCbnMNL.exe
  2⤵
  PID:6984
- C:\Windows\System\nyIytho.exe
  C:\Windows\System\nyIytho.exe
  2⤵
  PID:6384
- C:\Windows\System\fDODKqa.exe
  C:\Windows\System\fDODKqa.exe
  2⤵
  PID:7172
- C:\Windows\System\ZUAVTwq.exe
  C:\Windows\System\ZUAVTwq.exe
  2⤵
  PID:7200
- C:\Windows\System\vldRTKb.exe
  C:\Windows\System\vldRTKb.exe
  2⤵
  PID:7232
- C:\Windows\System\zKeftPf.exe
  C:\Windows\System\zKeftPf.exe
  2⤵
  PID:7264
- C:\Windows\System\UNJtVgH.exe
  C:\Windows\System\UNJtVgH.exe
  2⤵
  PID:7288
- C:\Windows\System\NUFLPId.exe
  C:\Windows\System\NUFLPId.exe
  2⤵
  PID:7320
- C:\Windows\System\WCWrJOx.exe
  C:\Windows\System\WCWrJOx.exe
  2⤵
  PID:7340
- C:\Windows\System\kPuMvBG.exe
  C:\Windows\System\kPuMvBG.exe
  2⤵
  PID:7368
- C:\Windows\System\yKBGSVq.exe
  C:\Windows\System\yKBGSVq.exe
  2⤵
  PID:7396
- C:\Windows\System\zxssZNE.exe
  C:\Windows\System\zxssZNE.exe
  2⤵
  PID:7420
- C:\Windows\System\fPROVyp.exe
  C:\Windows\System\fPROVyp.exe
  2⤵
  PID:7448
- C:\Windows\System\IVQOOBx.exe
  C:\Windows\System\IVQOOBx.exe
  2⤵
  PID:7476
- C:\Windows\System\EKnPDNk.exe
  C:\Windows\System\EKnPDNk.exe
  2⤵
  PID:7508
- C:\Windows\System\PqunnMY.exe
  C:\Windows\System\PqunnMY.exe
  2⤵
  PID:7540
- C:\Windows\System\BcInhtv.exe
  C:\Windows\System\BcInhtv.exe
  2⤵
  PID:7572
- C:\Windows\System\YWLtdko.exe
  C:\Windows\System\YWLtdko.exe
  2⤵
  PID:7600
- C:\Windows\System\FMDuorp.exe
  C:\Windows\System\FMDuorp.exe
  2⤵
  PID:7616
- C:\Windows\System\cmJCpPD.exe
  C:\Windows\System\cmJCpPD.exe
  2⤵
  PID:7652
- C:\Windows\System\fLkeZln.exe
  C:\Windows\System\fLkeZln.exe
  2⤵
  PID:7672
- C:\Windows\System\vqvmplq.exe
  C:\Windows\System\vqvmplq.exe
  2⤵
  PID:7704
- C:\Windows\System\JcBNhyb.exe
  C:\Windows\System\JcBNhyb.exe
  2⤵
  PID:7732
- C:\Windows\System\urLQwbS.exe
  C:\Windows\System\urLQwbS.exe
  2⤵
  PID:7760
- C:\Windows\System\oOTwbTg.exe
  C:\Windows\System\oOTwbTg.exe
  2⤵
  PID:7792
- C:\Windows\System\tHoeHhv.exe
  C:\Windows\System\tHoeHhv.exe
  2⤵
  PID:7820
- C:\Windows\System\sbwewPZ.exe
  C:\Windows\System\sbwewPZ.exe
  2⤵
  PID:7848
- C:\Windows\System\CFwaweS.exe
  C:\Windows\System\CFwaweS.exe
  2⤵
  PID:7888
- C:\Windows\System\wBXNpjr.exe
  C:\Windows\System\wBXNpjr.exe
  2⤵
  PID:7904
- C:\Windows\System\vtysDtI.exe
  C:\Windows\System\vtysDtI.exe
  2⤵
  PID:7936
- C:\Windows\System\qcYseXu.exe
  C:\Windows\System\qcYseXu.exe
  2⤵
  PID:7968
- C:\Windows\System\sSBrvAn.exe
  C:\Windows\System\sSBrvAn.exe
  2⤵
  PID:8000
- C:\Windows\System\KeLxIUX.exe
  C:\Windows\System\KeLxIUX.exe
  2⤵
  PID:8024
- C:\Windows\System\EoJrTwt.exe
  C:\Windows\System\EoJrTwt.exe
  2⤵
  PID:8044
- C:\Windows\System\DoPhNCw.exe
  C:\Windows\System\DoPhNCw.exe
  2⤵
  PID:8072
- C:\Windows\System\wNLvYPN.exe
  C:\Windows\System\wNLvYPN.exe
  2⤵
  PID:8112
- C:\Windows\System\iOcmbHg.exe
  C:\Windows\System\iOcmbHg.exe
  2⤵
  PID:8128
- C:\Windows\System\TLqIksl.exe
  C:\Windows\System\TLqIksl.exe
  2⤵
  PID:8156
- C:\Windows\System\LXUDTYI.exe
  C:\Windows\System\LXUDTYI.exe
  2⤵
  PID:8184
- C:\Windows\System\uEfiClu.exe
  C:\Windows\System\uEfiClu.exe
  2⤵
  PID:7184
- C:\Windows\System\XWVYOIN.exe
  C:\Windows\System\XWVYOIN.exe
  2⤵
  PID:7228
- C:\Windows\System\uUcRsFo.exe
  C:\Windows\System\uUcRsFo.exe
  2⤵
  PID:7284
- C:\Windows\System\LXeTqea.exe
  C:\Windows\System\LXeTqea.exe
  2⤵
  PID:7384
- C:\Windows\System\umCrhBn.exe
  C:\Windows\System\umCrhBn.exe
  2⤵
  PID:7408
- C:\Windows\System\fRSpCMx.exe
  C:\Windows\System\fRSpCMx.exe
  2⤵
  PID:7504
- C:\Windows\System\wnEWNnQ.exe
  C:\Windows\System\wnEWNnQ.exe
  2⤵
  PID:7568
- C:\Windows\System\ClUNWcu.exe
  C:\Windows\System\ClUNWcu.exe
  2⤵
  PID:7612
- C:\Windows\System\qqPOaKK.exe
  C:\Windows\System\qqPOaKK.exe
  2⤵
  PID:7696
- C:\Windows\System\qhjeapY.exe
  C:\Windows\System\qhjeapY.exe
  2⤵
  PID:7780
- C:\Windows\System\GCAfgwg.exe
  C:\Windows\System\GCAfgwg.exe
  2⤵
  PID:7844
- C:\Windows\System\iIpEIbe.exe
  C:\Windows\System\iIpEIbe.exe
  2⤵
  PID:7932
- C:\Windows\System\mFAVFml.exe
  C:\Windows\System\mFAVFml.exe
  2⤵
  PID:8008
- C:\Windows\System\OevXesL.exe
  C:\Windows\System\OevXesL.exe
  2⤵
  PID:8084
- C:\Windows\System\fGhzIEV.exe
  C:\Windows\System\fGhzIEV.exe
  2⤵
  PID:8144
- C:\Windows\System\QYOTorQ.exe
  C:\Windows\System\QYOTorQ.exe
  2⤵
  PID:8172
- C:\Windows\System\JrVcUoO.exe
  C:\Windows\System\JrVcUoO.exe
  2⤵
  PID:7360
- C:\Windows\System\ZKIkRRm.exe
  C:\Windows\System\ZKIkRRm.exe
  2⤵
  PID:7472
- C:\Windows\System\IVFvtAq.exe
  C:\Windows\System\IVFvtAq.exe
  2⤵
  PID:7588
- C:\Windows\System\miGRBcj.exe
  C:\Windows\System\miGRBcj.exe
  2⤵
  PID:7756
- C:\Windows\System\mAYSpYt.exe
  C:\Windows\System\mAYSpYt.exe
  2⤵
  PID:7884
- C:\Windows\System\PGjVJHs.exe
  C:\Windows\System\PGjVJHs.exe
  2⤵
  PID:8040
- C:\Windows\System\wqTYGRu.exe
  C:\Windows\System\wqTYGRu.exe
  2⤵
  PID:8168
- C:\Windows\System\aUhXAyy.exe
  C:\Windows\System\aUhXAyy.exe
  2⤵
  PID:7488
- C:\Windows\System\oncrYBI.exe
  C:\Windows\System\oncrYBI.exe
  2⤵
  PID:7988
- C:\Windows\System\VWSWuzp.exe
  C:\Windows\System\VWSWuzp.exe
  2⤵
  PID:7224
- C:\Windows\System\iWMGvGl.exe
  C:\Windows\System\iWMGvGl.exe
  2⤵
  PID:8196
- C:\Windows\System\MgKHRwH.exe
  C:\Windows\System\MgKHRwH.exe
  2⤵
  PID:8212
- C:\Windows\System\xXioMoC.exe
  C:\Windows\System\xXioMoC.exe
  2⤵
  PID:8248
- C:\Windows\System\COZYCmw.exe
  C:\Windows\System\COZYCmw.exe
  2⤵
  PID:8264
- C:\Windows\System\RhOBQJc.exe
  C:\Windows\System\RhOBQJc.exe
  2⤵
  PID:8292
- C:\Windows\System\bEqZvGQ.exe
  C:\Windows\System\bEqZvGQ.exe
  2⤵
  PID:8324
- C:\Windows\System\XqmlgPG.exe
  C:\Windows\System\XqmlgPG.exe
  2⤵
  PID:8352
- C:\Windows\System\bYehXCt.exe
  C:\Windows\System\bYehXCt.exe
  2⤵
  PID:8380
- C:\Windows\System\VdUPCbX.exe
  C:\Windows\System\VdUPCbX.exe
  2⤵
  PID:8408
- C:\Windows\System\RewQnaO.exe
  C:\Windows\System\RewQnaO.exe
  2⤵
  PID:8432
- C:\Windows\System\IxSKgBg.exe
  C:\Windows\System\IxSKgBg.exe
  2⤵
  PID:8464
- C:\Windows\System\aytzfLR.exe
  C:\Windows\System\aytzfLR.exe
  2⤵
  PID:8488
- C:\Windows\System\RRXRgUo.exe
  C:\Windows\System\RRXRgUo.exe
  2⤵
  PID:8520
- C:\Windows\System\fVwwxqr.exe
  C:\Windows\System\fVwwxqr.exe
  2⤵
  PID:8552
- C:\Windows\System\gTrIiqk.exe
  C:\Windows\System\gTrIiqk.exe
  2⤵
  PID:8584
- C:\Windows\System\EFOGDvY.exe
  C:\Windows\System\EFOGDvY.exe
  2⤵
  PID:8604
- C:\Windows\System\VlIDwKT.exe
  C:\Windows\System\VlIDwKT.exe
  2⤵
  PID:8620
- C:\Windows\System\rFLVZOP.exe
  C:\Windows\System\rFLVZOP.exe
  2⤵
  PID:8648
- C:\Windows\System\vOpkaCp.exe
  C:\Windows\System\vOpkaCp.exe
  2⤵
  PID:8680
- C:\Windows\System\qGavnfr.exe
  C:\Windows\System\qGavnfr.exe
  2⤵
  PID:8720
- C:\Windows\System\FRyqBlW.exe
  C:\Windows\System\FRyqBlW.exe
  2⤵
  PID:8772
- C:\Windows\System\TxcBvML.exe
  C:\Windows\System\TxcBvML.exe
  2⤵
  PID:8800
- C:\Windows\System\oBjtpdP.exe
  C:\Windows\System\oBjtpdP.exe
  2⤵
  PID:8832
- C:\Windows\System\dnGjeJE.exe
  C:\Windows\System\dnGjeJE.exe
  2⤵
  PID:8852
- C:\Windows\System\KcdHcQE.exe
  C:\Windows\System\KcdHcQE.exe
  2⤵
  PID:8880
- C:\Windows\System\HXyiBPn.exe
  C:\Windows\System\HXyiBPn.exe
  2⤵
  PID:8908
- C:\Windows\System\nDRYHqI.exe
  C:\Windows\System\nDRYHqI.exe
  2⤵
  PID:8944
- C:\Windows\System\zwXlDfH.exe
  C:\Windows\System\zwXlDfH.exe
  2⤵
  PID:8972
- C:\Windows\System\awAIcZl.exe
  C:\Windows\System\awAIcZl.exe
  2⤵
  PID:9004
- C:\Windows\System\wnGwfLn.exe
  C:\Windows\System\wnGwfLn.exe
  2⤵
  PID:9024
- C:\Windows\System\xhzToGf.exe
  C:\Windows\System\xhzToGf.exe
  2⤵
  PID:9056
- C:\Windows\System\ujKiTyd.exe
  C:\Windows\System\ujKiTyd.exe
  2⤵
  PID:9084
- C:\Windows\System\HtdJGjv.exe
  C:\Windows\System\HtdJGjv.exe
  2⤵
  PID:9124
- C:\Windows\System\Ihepcrl.exe
  C:\Windows\System\Ihepcrl.exe
  2⤵
  PID:9144
- C:\Windows\System\gcqCGXI.exe
  C:\Windows\System\gcqCGXI.exe
  2⤵
  PID:9176
- C:\Windows\System\xTbPbNM.exe
  C:\Windows\System\xTbPbNM.exe
  2⤵
  PID:9212
- C:\Windows\System\LwxdeuX.exe
  C:\Windows\System\LwxdeuX.exe
  2⤵
  PID:8204
- C:\Windows\System\nUAAfQt.exe
  C:\Windows\System\nUAAfQt.exe
  2⤵
  PID:8300
- C:\Windows\System\CUgbVIZ.exe
  C:\Windows\System\CUgbVIZ.exe
  2⤵
  PID:8368
- C:\Windows\System\SzlqsFr.exe
  C:\Windows\System\SzlqsFr.exe
  2⤵
  PID:8424
- C:\Windows\System\pFbwHzL.exe
  C:\Windows\System\pFbwHzL.exe
  2⤵
  PID:8484
- C:\Windows\System\stGQyqi.exe
  C:\Windows\System\stGQyqi.exe
  2⤵
  PID:8532
- C:\Windows\System\Zgwbyfa.exe
  C:\Windows\System\Zgwbyfa.exe
  2⤵
  PID:8596
- C:\Windows\System\gvnizlH.exe
  C:\Windows\System\gvnizlH.exe
  2⤵
  PID:8704
- C:\Windows\System\pzlanfS.exe
  C:\Windows\System\pzlanfS.exe
  2⤵
  PID:8788
- C:\Windows\System\MHeyExr.exe
  C:\Windows\System\MHeyExr.exe
  2⤵
  PID:8840
- C:\Windows\System\OpaguVV.exe
  C:\Windows\System\OpaguVV.exe
  2⤵
  PID:8892
- C:\Windows\System\uoQqtzV.exe
  C:\Windows\System\uoQqtzV.exe
  2⤵
  PID:8992
- C:\Windows\System\sjMYZSq.exe
  C:\Windows\System\sjMYZSq.exe
  2⤵
  PID:9040
- C:\Windows\System\IDYkybk.exe
  C:\Windows\System\IDYkybk.exe
  2⤵
  PID:9100
- C:\Windows\System\IUxzeeZ.exe
  C:\Windows\System\IUxzeeZ.exe
  2⤵
  PID:9092
- C:\Windows\System\tjwStQa.exe
  C:\Windows\System\tjwStQa.exe
  2⤵
  PID:9156
- C:\Windows\System\yngvWIv.exe
  C:\Windows\System\yngvWIv.exe
  2⤵
  PID:8260
- C:\Windows\System\kmxxMcZ.exe
  C:\Windows\System\kmxxMcZ.exe
  2⤵
  PID:8340
- C:\Windows\System\dIScQFE.exe
  C:\Windows\System\dIScQFE.exe
  2⤵
  PID:8572
- C:\Windows\System\NnhUIvg.exe
  C:\Windows\System\NnhUIvg.exe
  2⤵
  PID:8672
- C:\Windows\System\gNgryMt.exe
  C:\Windows\System\gNgryMt.exe
  2⤵
  PID:8872
- C:\Windows\System\ykdRFPD.exe
  C:\Windows\System\ykdRFPD.exe
  2⤵
  PID:9016
- C:\Windows\System\AcdaaaP.exe
  C:\Windows\System\AcdaaaP.exe
  2⤵
  PID:8312
- C:\Windows\System\ngHMSnF.exe
  C:\Windows\System\ngHMSnF.exe
  2⤵
  PID:8308
- C:\Windows\System\jJaZdfK.exe
  C:\Windows\System\jJaZdfK.exe
  2⤵
  PID:8516
- C:\Windows\System\GzcHIGB.exe
  C:\Windows\System\GzcHIGB.exe
  2⤵
  PID:8988
- C:\Windows\System\haHISco.exe
  C:\Windows\System\haHISco.exe
  2⤵
  PID:9224
- C:\Windows\System\ecnYPLf.exe
  C:\Windows\System\ecnYPLf.exe
  2⤵
  PID:9256
- C:\Windows\System\DsHPQzv.exe
  C:\Windows\System\DsHPQzv.exe
  2⤵
  PID:9280
- C:\Windows\System\JtDAGWA.exe
  C:\Windows\System\JtDAGWA.exe
  2⤵
  PID:9296
- C:\Windows\System\clOLWAr.exe
  C:\Windows\System\clOLWAr.exe
  2⤵
  PID:9320
- C:\Windows\System\yLluyVP.exe
  C:\Windows\System\yLluyVP.exe
  2⤵
  PID:9356
- C:\Windows\System\qYuBOif.exe
  C:\Windows\System\qYuBOif.exe
  2⤵
  PID:9384
- C:\Windows\System\sCCFYIy.exe
  C:\Windows\System\sCCFYIy.exe
  2⤵
  PID:9412
- C:\Windows\System\hBIhSSn.exe
  C:\Windows\System\hBIhSSn.exe
  2⤵
  PID:9448
- C:\Windows\System\RRrwJER.exe
  C:\Windows\System\RRrwJER.exe
  2⤵
  PID:9472
- C:\Windows\System\PhAfZOY.exe
  C:\Windows\System\PhAfZOY.exe
  2⤵
  PID:9504
- C:\Windows\System\jWQESOX.exe
  C:\Windows\System\jWQESOX.exe
  2⤵
  PID:9544
- C:\Windows\System\cYbTbFj.exe
  C:\Windows\System\cYbTbFj.exe
  2⤵
  PID:9580
- C:\Windows\System\VSniaMn.exe
  C:\Windows\System\VSniaMn.exe
  2⤵
  PID:9604
- C:\Windows\System\oljqrxR.exe
  C:\Windows\System\oljqrxR.exe
  2⤵
  PID:9624
- C:\Windows\System\YbHtbUa.exe
  C:\Windows\System\YbHtbUa.exe
  2⤵
  PID:9672
- C:\Windows\System\pOpTPXm.exe
  C:\Windows\System\pOpTPXm.exe
  2⤵
  PID:9712
- C:\Windows\System\NNWgUHu.exe
  C:\Windows\System\NNWgUHu.exe
  2⤵
  PID:9740
- C:\Windows\System\TMbaTqW.exe
  C:\Windows\System\TMbaTqW.exe
  2⤵
  PID:9768
- C:\Windows\System\BAAeXLI.exe
  C:\Windows\System\BAAeXLI.exe
  2⤵
  PID:9796
- C:\Windows\System\wEjKSal.exe
  C:\Windows\System\wEjKSal.exe
  2⤵
  PID:9824
- C:\Windows\System\sXRzLEd.exe
  C:\Windows\System\sXRzLEd.exe
  2⤵
  PID:9840
- C:\Windows\System\rMlJbJx.exe
  C:\Windows\System\rMlJbJx.exe
  2⤵
  PID:9868
- C:\Windows\System\TJbVkrk.exe
  C:\Windows\System\TJbVkrk.exe
  2⤵
  PID:9892
- C:\Windows\System\KUAvQGK.exe
  C:\Windows\System\KUAvQGK.exe
  2⤵
  PID:9928
- C:\Windows\System\zXnyZsJ.exe
  C:\Windows\System\zXnyZsJ.exe
  2⤵
  PID:9956
- C:\Windows\System\BzdccsC.exe
  C:\Windows\System\BzdccsC.exe
  2⤵
  PID:9992
- C:\Windows\System\hIZgcBt.exe
  C:\Windows\System\hIZgcBt.exe
  2⤵
  PID:10024
- C:\Windows\System\xrBNFfD.exe
  C:\Windows\System\xrBNFfD.exe
  2⤵
  PID:10056
- C:\Windows\System\BhTPHXN.exe
  C:\Windows\System\BhTPHXN.exe
  2⤵
  PID:10072
- C:\Windows\System\NlCDvJd.exe
  C:\Windows\System\NlCDvJd.exe
  2⤵
  PID:10100
- C:\Windows\System\PSvtAkR.exe
  C:\Windows\System\PSvtAkR.exe
  2⤵
  PID:10132
- C:\Windows\System\vpdWqPj.exe
  C:\Windows\System\vpdWqPj.exe
  2⤵
  PID:10164
- C:\Windows\System\JrSOOwk.exe
  C:\Windows\System\JrSOOwk.exe
  2⤵
  PID:10196
- C:\Windows\System\tZzYlbJ.exe
  C:\Windows\System\tZzYlbJ.exe
  2⤵
  PID:10212
- C:\Windows\System\kHJwaGQ.exe
  C:\Windows\System\kHJwaGQ.exe
  2⤵
  PID:10232
- C:\Windows\System\JpshHkf.exe
  C:\Windows\System\JpshHkf.exe
  2⤵
  PID:8612
- C:\Windows\System\sNtWcGf.exe
  C:\Windows\System\sNtWcGf.exe
  2⤵
  PID:8956
- C:\Windows\System\DGmlyfA.exe
  C:\Windows\System\DGmlyfA.exe
  2⤵
  PID:9264
- C:\Windows\System\lbbSLVn.exe
  C:\Windows\System\lbbSLVn.exe
  2⤵
  PID:9368
- C:\Windows\System\GGGyOhr.exe
  C:\Windows\System\GGGyOhr.exe
  2⤵
  PID:9404
- C:\Windows\System\TMkNyHT.exe
  C:\Windows\System\TMkNyHT.exe
  2⤵
  PID:9528
- C:\Windows\System\jlNcCPT.exe
  C:\Windows\System\jlNcCPT.exe
  2⤵
  PID:9576
- C:\Windows\System\EMirTVF.exe
  C:\Windows\System\EMirTVF.exe
  2⤵
  PID:9664
- C:\Windows\System\dtQWmbu.exe
  C:\Windows\System\dtQWmbu.exe
  2⤵
  PID:9692
- C:\Windows\System\cRxIpVn.exe
  C:\Windows\System\cRxIpVn.exe
  2⤵
  PID:3904
- C:\Windows\System\QEzEUqD.exe
  C:\Windows\System\QEzEUqD.exe
  2⤵
  PID:9860
- C:\Windows\System\jxTAKAN.exe
  C:\Windows\System\jxTAKAN.exe
  2⤵
  PID:9968
- C:\Windows\System\XAutswj.exe
  C:\Windows\System\XAutswj.exe
  2⤵
  PID:10004
- C:\Windows\System\oOYnYlX.exe
  C:\Windows\System\oOYnYlX.exe
  2⤵
  PID:10068
- C:\Windows\System\mfnguYu.exe
  C:\Windows\System\mfnguYu.exe
  2⤵
  PID:10144
- C:\Windows\System\FKTOAOk.exe
  C:\Windows\System\FKTOAOk.exe
  2⤵
  PID:10188
- C:\Windows\System\DmYVKmj.exe
  C:\Windows\System\DmYVKmj.exe
  2⤵
  PID:9312
- C:\Windows\System\jkNmFGv.exe
  C:\Windows\System\jkNmFGv.exe
  2⤵
  PID:9376
- C:\Windows\System\WVUNPIH.exe
  C:\Windows\System\WVUNPIH.exe
  2⤵
  PID:9612
- C:\Windows\System\YcvTfxK.exe
  C:\Windows\System\YcvTfxK.exe
  2⤵
  PID:9788
- C:\Windows\System\MqLOheN.exe
  C:\Windows\System\MqLOheN.exe
  2⤵
  PID:9948
- C:\Windows\System\OmTnDvf.exe
  C:\Windows\System\OmTnDvf.exe
  2⤵
  PID:10064
- C:\Windows\System\ewVwiRZ.exe
  C:\Windows\System\ewVwiRZ.exe
  2⤵
  PID:10184
- C:\Windows\System\aTceTxK.exe
  C:\Windows\System\aTceTxK.exe
  2⤵
  PID:9500
- C:\Windows\System\PiIVOqP.exe
  C:\Windows\System\PiIVOqP.exe
  2⤵
  PID:10016
- C:\Windows\System\bfMlhyB.exe
  C:\Windows\System\bfMlhyB.exe
  2⤵
  PID:9916
- C:\Windows\System\JyzxcEe.exe
  C:\Windows\System\JyzxcEe.exe
  2⤵
  PID:10244
- C:\Windows\System\IlrwNcx.exe
  C:\Windows\System\IlrwNcx.exe
  2⤵
  PID:10260
- C:\Windows\System\STnwFPv.exe
  C:\Windows\System\STnwFPv.exe
  2⤵
  PID:10288
- C:\Windows\System\WmffQQe.exe
  C:\Windows\System\WmffQQe.exe
  2⤵
  PID:10324
- C:\Windows\System\JaEvIuh.exe
  C:\Windows\System\JaEvIuh.exe
  2⤵
  PID:10352
- C:\Windows\System\loAwkLm.exe
  C:\Windows\System\loAwkLm.exe
  2⤵
  PID:10380
- C:\Windows\System\feBunGI.exe
  C:\Windows\System\feBunGI.exe
  2⤵
  PID:10408
- C:\Windows\System\VODuAUZ.exe
  C:\Windows\System\VODuAUZ.exe
  2⤵
  PID:10436
- C:\Windows\System\gxGQkvB.exe
  C:\Windows\System\gxGQkvB.exe
  2⤵
  PID:10464
- C:\Windows\System\WzApKsU.exe
  C:\Windows\System\WzApKsU.exe
  2⤵
  PID:10492
- C:\Windows\System\aVSgCnV.exe
  C:\Windows\System\aVSgCnV.exe
  2⤵
  PID:10520
- C:\Windows\System\kNDyrfv.exe
  C:\Windows\System\kNDyrfv.exe
  2⤵
  PID:10548
- C:\Windows\System\ohzrcyP.exe
  C:\Windows\System\ohzrcyP.exe
  2⤵
  PID:10568
- C:\Windows\System\JwpZeJc.exe
  C:\Windows\System\JwpZeJc.exe
  2⤵
  PID:10600
- C:\Windows\System\cOjwRzI.exe
  C:\Windows\System\cOjwRzI.exe
  2⤵
  PID:10620
- C:\Windows\System\bHNsLsE.exe
  C:\Windows\System\bHNsLsE.exe
  2⤵
  PID:10644
- C:\Windows\System\QbPFVml.exe
  C:\Windows\System\QbPFVml.exe
  2⤵
  PID:10680
- C:\Windows\System\mUZmhzq.exe
  C:\Windows\System\mUZmhzq.exe
  2⤵
  PID:10708
- C:\Windows\System\RavEWsE.exe
  C:\Windows\System\RavEWsE.exe
  2⤵
  PID:10752
- C:\Windows\System\QZNfpgU.exe
  C:\Windows\System\QZNfpgU.exe
  2⤵
  PID:10772
- C:\Windows\System\DtVQaDZ.exe
  C:\Windows\System\DtVQaDZ.exe
  2⤵
  PID:10796
- C:\Windows\System\mUxtWcA.exe
  C:\Windows\System\mUxtWcA.exe
  2⤵
  PID:10820
- C:\Windows\System\aqAYGDY.exe
  C:\Windows\System\aqAYGDY.exe
  2⤵
  PID:10848
- C:\Windows\System\CVIwwkG.exe
  C:\Windows\System\CVIwwkG.exe
  2⤵
  PID:10864
- C:\Windows\System\cZlmywb.exe
  C:\Windows\System\cZlmywb.exe
  2⤵
  PID:10892
- C:\Windows\System\EbExlzJ.exe
  C:\Windows\System\EbExlzJ.exe
  2⤵
  PID:10932
- C:\Windows\System\nhtQQSx.exe
  C:\Windows\System\nhtQQSx.exe
  2⤵
  PID:10960
- C:\Windows\System\XCbGTUb.exe
  C:\Windows\System\XCbGTUb.exe
  2⤵
  PID:10984
- C:\Windows\System\uCcZDFo.exe
  C:\Windows\System\uCcZDFo.exe
  2⤵
  PID:11012
- C:\Windows\System\LqNldjh.exe
  C:\Windows\System\LqNldjh.exe
  2⤵
  PID:11036
- C:\Windows\System\JszOnme.exe
  C:\Windows\System\JszOnme.exe
  2⤵
  PID:11068
- C:\Windows\System\XqEPguG.exe
  C:\Windows\System\XqEPguG.exe
  2⤵
  PID:11100
- C:\Windows\System\HiZDArM.exe
  C:\Windows\System\HiZDArM.exe
  2⤵
  PID:11132
- C:\Windows\System\TcLRkKL.exe
  C:\Windows\System\TcLRkKL.exe
  2⤵
  PID:11152
- C:\Windows\System\kTXvOXQ.exe
  C:\Windows\System\kTXvOXQ.exe
  2⤵
  PID:11184
- C:\Windows\System\pmSflPz.exe
  C:\Windows\System\pmSflPz.exe
  2⤵
  PID:11220
- C:\Windows\System\IQDKbcA.exe
  C:\Windows\System\IQDKbcA.exe
  2⤵
  PID:11252
- C:\Windows\System\QjshVoS.exe
  C:\Windows\System\QjshVoS.exe
  2⤵
  PID:9464
- C:\Windows\System\zyIhgyv.exe
  C:\Windows\System\zyIhgyv.exe
  2⤵
  PID:10308
- C:\Windows\System\zxhzaOB.exe
  C:\Windows\System\zxhzaOB.exe
  2⤵
  PID:10404
- C:\Windows\System\ONzakOz.exe
  C:\Windows\System\ONzakOz.exe
  2⤵
  PID:10452
- C:\Windows\System\juBJWUp.exe
  C:\Windows\System\juBJWUp.exe
  2⤵
  PID:10484
- C:\Windows\System\RMInZqj.exe
  C:\Windows\System\RMInZqj.exe
  2⤵
  PID:10560
- C:\Windows\System\hMuMfKm.exe
  C:\Windows\System\hMuMfKm.exe
  2⤵
  PID:10696
- C:\Windows\System\SRxYNrv.exe
  C:\Windows\System\SRxYNrv.exe
  2⤵
  PID:10816
- C:\Windows\System\ExTgGAP.exe
  C:\Windows\System\ExTgGAP.exe
  2⤵
  PID:10784
- C:\Windows\System\qVHaOnf.exe
  C:\Windows\System\qVHaOnf.exe
  2⤵
  PID:10912
- C:\Windows\System\UdjZdZJ.exe
  C:\Windows\System\UdjZdZJ.exe
  2⤵
  PID:10944
- C:\Windows\System\ArOMGRq.exe
  C:\Windows\System\ArOMGRq.exe
  2⤵
  PID:11008
- C:\Windows\System\gKiBrPb.exe
  C:\Windows\System\gKiBrPb.exe
  2⤵
  PID:11060
- C:\Windows\System\fZfDsik.exe
  C:\Windows\System\fZfDsik.exe
  2⤵
  PID:11144
- C:\Windows\System\IXiwTth.exe
  C:\Windows\System\IXiwTth.exe
  2⤵
  PID:9700
- C:\Windows\System\nOkxKQJ.exe
  C:\Windows\System\nOkxKQJ.exe
  2⤵
  PID:10420
- C:\Windows\System\uLjqpMX.exe
  C:\Windows\System\uLjqpMX.exe
  2⤵
  PID:10516
- C:\Windows\System\sQWzOvd.exe
  C:\Windows\System\sQWzOvd.exe
  2⤵
  PID:10716
- C:\Windows\System\cLGhzED.exe
  C:\Windows\System\cLGhzED.exe
  2⤵
  PID:10908
- C:\Windows\System\JdgtNCq.exe
  C:\Windows\System\JdgtNCq.exe
  2⤵
  PID:11212
- C:\Windows\System\TgDCesb.exe
  C:\Windows\System\TgDCesb.exe
  2⤵
  PID:10360
- C:\Windows\System\HxMasJp.exe
  C:\Windows\System\HxMasJp.exe
  2⤵
  PID:10536
- C:\Windows\System\VZErVrj.exe
  C:\Windows\System\VZErVrj.exe
  2⤵
  PID:10340
- C:\Windows\System\BeFBBre.exe
  C:\Windows\System\BeFBBre.exe
  2⤵
  PID:11288
- C:\Windows\System\uoMZyTn.exe
  C:\Windows\System\uoMZyTn.exe
  2⤵
  PID:11308
- C:\Windows\System\MwCZaje.exe
  C:\Windows\System\MwCZaje.exe
  2⤵
  PID:11332
- C:\Windows\System\DHNwxpn.exe
  C:\Windows\System\DHNwxpn.exe
  2⤵
  PID:11368
- C:\Windows\System\QQkuuos.exe
  C:\Windows\System\QQkuuos.exe
  2⤵
  PID:11392
- C:\Windows\System\DvcMtHy.exe
  C:\Windows\System\DvcMtHy.exe
  2⤵
  PID:11428
- C:\Windows\System\blMuaNI.exe
  C:\Windows\System\blMuaNI.exe
  2⤵
  PID:11492
- C:\Windows\System\DbyaNeK.exe
  C:\Windows\System\DbyaNeK.exe
  2⤵
  PID:11524
- C:\Windows\System\ZfQYZao.exe
  C:\Windows\System\ZfQYZao.exe
  2⤵
  PID:11560
- C:\Windows\System\VkqmwvM.exe
  C:\Windows\System\VkqmwvM.exe
  2⤵
  PID:11596
- C:\Windows\System\JKrpbxX.exe
  C:\Windows\System\JKrpbxX.exe
  2⤵
  PID:11632
- C:\Windows\System\jmksHxq.exe
  C:\Windows\System\jmksHxq.exe
  2⤵
  PID:11672
- C:\Windows\System\JGjlRai.exe
  C:\Windows\System\JGjlRai.exe
  2⤵
  PID:11708
- C:\Windows\System\OrVRHRz.exe
  C:\Windows\System\OrVRHRz.exe
  2⤵
  PID:11732
- C:\Windows\System\HLYcrzn.exe
  C:\Windows\System\HLYcrzn.exe
  2⤵
  PID:11768
- C:\Windows\System\OVyVciV.exe
  C:\Windows\System\OVyVciV.exe
  2⤵
  PID:11800
- C:\Windows\System\lcUnzbp.exe
  C:\Windows\System\lcUnzbp.exe
  2⤵
  PID:11832
- C:\Windows\System\zjCtQrP.exe
  C:\Windows\System\zjCtQrP.exe
  2⤵
  PID:11880
- C:\Windows\System\roJaPbV.exe
  C:\Windows\System\roJaPbV.exe
  2⤵
  PID:11896
- C:\Windows\System\FyXXGsE.exe
  C:\Windows\System\FyXXGsE.exe
  2⤵
  PID:11924
- C:\Windows\System\DTkKweg.exe
  C:\Windows\System\DTkKweg.exe
  2⤵
  PID:11940
- C:\Windows\System\RZeACEP.exe
  C:\Windows\System\RZeACEP.exe
  2⤵
  PID:11976
- C:\Windows\System\kviMCHz.exe
  C:\Windows\System\kviMCHz.exe
  2⤵
  PID:12008
- C:\Windows\System\YnuOpjD.exe
  C:\Windows\System\YnuOpjD.exe
  2⤵
  PID:12036
- C:\Windows\System\MyCPAlO.exe
  C:\Windows\System\MyCPAlO.exe
  2⤵
  PID:12052
- C:\Windows\System\PuTagfu.exe
  C:\Windows\System\PuTagfu.exe
  2⤵
  PID:12080
- C:\Windows\System\CrnWJtR.exe
  C:\Windows\System\CrnWJtR.exe
  2⤵
  PID:12104
- C:\Windows\System\TkgoSrl.exe
  C:\Windows\System\TkgoSrl.exe
  2⤵
  PID:12128
- C:\Windows\System\VfRqPOj.exe
  C:\Windows\System\VfRqPOj.exe
  2⤵
  PID:12148
- C:\Windows\System\IdgtqQf.exe
  C:\Windows\System\IdgtqQf.exe
  2⤵
  PID:12172
- C:\Windows\System\EiDHBxi.exe
  C:\Windows\System\EiDHBxi.exe
  2⤵
  PID:12196
- C:\Windows\System\NYaGBll.exe
  C:\Windows\System\NYaGBll.exe
  2⤵
  PID:12224
- C:\Windows\System\EENynYP.exe
  C:\Windows\System\EENynYP.exe
  2⤵
  PID:12260
- C:\Windows\System\MdpXjMw.exe
  C:\Windows\System\MdpXjMw.exe
  2⤵
  PID:12280
- C:\Windows\System\XLoUhJL.exe
  C:\Windows\System\XLoUhJL.exe
  2⤵
  PID:9288
- C:\Windows\System\RNKVPwt.exe
  C:\Windows\System\RNKVPwt.exe
  2⤵
  PID:11324
- C:\Windows\System\CEoqSVB.exe
  C:\Windows\System\CEoqSVB.exe
  2⤵
  PID:11328
- C:\Windows\System\hlplcGG.exe
  C:\Windows\System\hlplcGG.exe
  2⤵
  PID:11380
- C:\Windows\System\RliqQTN.exe
  C:\Windows\System\RliqQTN.exe
  2⤵
  PID:11504
- C:\Windows\System\XxQcnID.exe
  C:\Windows\System\XxQcnID.exe
  2⤵
  PID:11568
- C:\Windows\System\BjbNJaL.exe
  C:\Windows\System\BjbNJaL.exe
  2⤵
  PID:11628
- C:\Windows\System\YzMghKD.exe
  C:\Windows\System\YzMghKD.exe
  2⤵
  PID:11688
- C:\Windows\System\cebEwWT.exe
  C:\Windows\System\cebEwWT.exe
  2⤵
  PID:11728
- C:\Windows\System\xdlmCVF.exe
  C:\Windows\System\xdlmCVF.exe
  2⤵
  PID:11816
- C:\Windows\System\whIqXBh.exe
  C:\Windows\System\whIqXBh.exe
  2⤵
  PID:11876
- C:\Windows\System\gjqTovx.exe
  C:\Windows\System\gjqTovx.exe
  2⤵
  PID:11952
- C:\Windows\System\YMXfNqh.exe
  C:\Windows\System\YMXfNqh.exe
  2⤵
  PID:12020
- C:\Windows\System\FvGqIvX.exe
  C:\Windows\System\FvGqIvX.exe
  2⤵
  PID:12088
- C:\Windows\System\CQkIvxl.exe
  C:\Windows\System\CQkIvxl.exe
  2⤵
  PID:12116
- C:\Windows\System\julHjKr.exe
  C:\Windows\System\julHjKr.exe
  2⤵
  PID:12256
- C:\Windows\System\VDtpyNd.exe
  C:\Windows\System\VDtpyNd.exe
  2⤵
  PID:11364
- C:\Windows\System\gOSHakm.exe
  C:\Windows\System\gOSHakm.exe
  2⤵
  PID:11344
- C:\Windows\System\GXSraSg.exe
  C:\Windows\System\GXSraSg.exe
  2⤵
  PID:10364
- C:\Windows\System\OCoPsoG.exe
  C:\Windows\System\OCoPsoG.exe
  2⤵
  PID:11792
- C:\Windows\System\GuMTlDH.exe
  C:\Windows\System\GuMTlDH.exe
  2⤵
  PID:12120
- C:\Windows\System\pryhFCg.exe
  C:\Windows\System\pryhFCg.exe
  2⤵
  PID:11304
- C:\Windows\System\BsEOmUO.exe
  C:\Windows\System\BsEOmUO.exe
  2⤵
  PID:12292
- C:\Windows\System\vdrxzKF.exe
  C:\Windows\System\vdrxzKF.exe
  2⤵
  PID:12324
- C:\Windows\System\DATNxuI.exe
  C:\Windows\System\DATNxuI.exe
  2⤵
  PID:12356
- C:\Windows\System\iLdVapy.exe
  C:\Windows\System\iLdVapy.exe
  2⤵
  PID:12384
- C:\Windows\System\XRZkEQj.exe
  C:\Windows\System\XRZkEQj.exe
  2⤵
  PID:12404
- C:\Windows\System\bHeYJEy.exe
  C:\Windows\System\bHeYJEy.exe
  2⤵
  PID:12432
- C:\Windows\System\ytqIEgP.exe
  C:\Windows\System\ytqIEgP.exe
  2⤵
  PID:12464
- C:\Windows\System\eTcLjhw.exe
  C:\Windows\System\eTcLjhw.exe
  2⤵
  PID:12484
- C:\Windows\System\uLHOYyD.exe
  C:\Windows\System\uLHOYyD.exe
  2⤵
  PID:12528
- C:\Windows\System\tFVTHjL.exe
  C:\Windows\System\tFVTHjL.exe
  2⤵
  PID:12556
- C:\Windows\System\DwaMlBr.exe
  C:\Windows\System\DwaMlBr.exe
  2⤵
  PID:12588
- C:\Windows\System\bofRfSA.exe
  C:\Windows\System\bofRfSA.exe
  2⤵
  PID:12620
- C:\Windows\System\lPhqtzo.exe
  C:\Windows\System\lPhqtzo.exe
  2⤵
  PID:12660
- C:\Windows\System\ofPNhnb.exe
  C:\Windows\System\ofPNhnb.exe
  2⤵
  PID:12688
- C:\Windows\System\oEmGcFY.exe
  C:\Windows\System\oEmGcFY.exe
  2⤵
  PID:12708
- C:\Windows\System\VrUhhtm.exe
  C:\Windows\System\VrUhhtm.exe
  2⤵
  PID:12736
- C:\Windows\System\DXvJAiQ.exe
  C:\Windows\System\DXvJAiQ.exe
  2⤵
  PID:12764
- C:\Windows\System\JdUaByw.exe
  C:\Windows\System\JdUaByw.exe
  2⤵
  PID:12784
- C:\Windows\System\UiohDhF.exe
  C:\Windows\System\UiohDhF.exe
  2⤵
  PID:12816
- C:\Windows\System\lDXUEKp.exe
  C:\Windows\System\lDXUEKp.exe
  2⤵
  PID:12852
- C:\Windows\System\ZdFjrkN.exe
  C:\Windows\System\ZdFjrkN.exe
  2⤵
  PID:12884
- C:\Windows\System\TyRizji.exe
  C:\Windows\System\TyRizji.exe
  2⤵
  PID:12912
- C:\Windows\System\cZYfuLy.exe
  C:\Windows\System\cZYfuLy.exe
  2⤵
  PID:12948
- C:\Windows\System\dIMYhHD.exe
  C:\Windows\System\dIMYhHD.exe
  2⤵
  PID:12980
- C:\Windows\System\VKYjxdh.exe
  C:\Windows\System\VKYjxdh.exe
  2⤵
  PID:13008
- C:\Windows\System\IaYzfkJ.exe
  C:\Windows\System\IaYzfkJ.exe
  2⤵
  PID:13064
- C:\Windows\System\vEOYIrS.exe
  C:\Windows\System\vEOYIrS.exe
  2⤵
  PID:13096
- C:\Windows\System\KVvpOiH.exe
  C:\Windows\System\KVvpOiH.exe
  2⤵
  PID:13124
- C:\Windows\System\SfmOIFR.exe
  C:\Windows\System\SfmOIFR.exe
  2⤵
  PID:13148
- C:\Windows\System\HAVxSJg.exe
  C:\Windows\System\HAVxSJg.exe
  2⤵
  PID:13176
- C:\Windows\System\MKitkmW.exe
  C:\Windows\System\MKitkmW.exe
  2⤵
  PID:13212
- C:\Windows\System\CJilFGa.exe
  C:\Windows\System\CJilFGa.exe
  2⤵
  PID:13228
- C:\Windows\System\zKRiaxq.exe
  C:\Windows\System\zKRiaxq.exe
  2⤵
  PID:13260
- C:\Windows\System\jECiaOT.exe
  C:\Windows\System\jECiaOT.exe
  2⤵
  PID:13296
- C:\Windows\System\jXltEIe.exe
  C:\Windows\System\jXltEIe.exe
  2⤵
  PID:11656
- C:\Windows\System\shcVXib.exe
  C:\Windows\System\shcVXib.exe
  2⤵
  PID:12336
- C:\Windows\System\VPqDtrO.exe
  C:\Windows\System\VPqDtrO.exe
  2⤵
  PID:11780
- C:\Windows\System\guSmPuO.exe
  C:\Windows\System\guSmPuO.exe
  2⤵
  PID:12368
- C:\Windows\System\lduMVDN.exe
  C:\Windows\System\lduMVDN.exe
  2⤵
  PID:12480
- C:\Windows\System\wuDuXXM.exe
  C:\Windows\System\wuDuXXM.exe
  2⤵
  PID:12580
- C:\Windows\System\cVJHSsH.exe
  C:\Windows\System\cVJHSsH.exe
  2⤵
  PID:12604
- C:\Windows\System\JdGgTUR.exe
  C:\Windows\System\JdGgTUR.exe
  2⤵
  PID:12700
- C:\Windows\System\CBHyeOD.exe
  C:\Windows\System\CBHyeOD.exe
  2⤵
  PID:12724
- C:\Windows\System\ucNJotP.exe
  C:\Windows\System\ucNJotP.exe
  2⤵
  PID:12772
- C:\Windows\System\nEQfSeZ.exe
  C:\Windows\System\nEQfSeZ.exe
  2⤵
  PID:12804
- C:\Windows\System\ZhGWUnV.exe
  C:\Windows\System\ZhGWUnV.exe
  2⤵
  PID:12972
- C:\Windows\System\NxqnDhQ.exe
  C:\Windows\System\NxqnDhQ.exe
  2⤵
  PID:13004
- C:\Windows\System\OmdiNFT.exe
  C:\Windows\System\OmdiNFT.exe
  2⤵
  PID:13092
- C:\Windows\System\ncYovej.exe
  C:\Windows\System\ncYovej.exe
  2⤵
  PID:13140
- C:\Windows\System\rJlBADP.exe
  C:\Windows\System\rJlBADP.exe
  2⤵
  PID:13224
- C:\Windows\System\xNlfgyN.exe
  C:\Windows\System\xNlfgyN.exe
  2⤵
  PID:13252
- C:\Windows\System\LDGPwTk.exe
  C:\Windows\System\LDGPwTk.exe
  2⤵
  PID:11388
- C:\Windows\System\HDzQove.exe
  C:\Windows\System\HDzQove.exe
  2⤵
  PID:12300
- C:\Windows\System\uMllzYw.exe
  C:\Windows\System\uMllzYw.exe
  2⤵
  PID:12548
- C:\Windows\System\TxbwLNy.exe
  C:\Windows\System\TxbwLNy.exe
  2⤵
  PID:12684
- C:\Windows\System\vexFZwn.exe
  C:\Windows\System\vexFZwn.exe
  2⤵
  PID:12872
- C:\Windows\System\hhdUVwf.exe
  C:\Windows\System\hhdUVwf.exe
  2⤵
  PID:12996
- C:\Windows\System\iQfgJyr.exe
  C:\Windows\System\iQfgJyr.exe
  2⤵
  PID:13132
- C:\Windows\System\aiJFBAL.exe
  C:\Windows\System\aiJFBAL.exe
  2⤵
  PID:4992
- C:\Windows\System\DYOUmqK.exe
  C:\Windows\System\DYOUmqK.exe
  2⤵
  PID:11932
- C:\Windows\System\tHmTvnV.exe
  C:\Windows\System\tHmTvnV.exe
  2⤵
  PID:12832
- C:\Windows\System\TFNQFWK.exe
  C:\Windows\System\TFNQFWK.exe
  2⤵
  PID:12520
- C:\Windows\System\hFmucDt.exe
  C:\Windows\System\hFmucDt.exe
  2⤵
  PID:13164
- C:\Windows\System\jSyLHAY.exe
  C:\Windows\System\jSyLHAY.exe
  2⤵
  PID:13268
- C:\Windows\System\RemveqT.exe
  C:\Windows\System\RemveqT.exe
  2⤵
  PID:12936
- C:\Windows\System\nrYKqel.exe
  C:\Windows\System\nrYKqel.exe
  2⤵
  PID:13328
- C:\Windows\System\zcuMIKb.exe
  C:\Windows\System\zcuMIKb.exe
  2⤵
  PID:13356
- C:\Windows\System\jznsEZo.exe
  C:\Windows\System\jznsEZo.exe
  2⤵
  PID:13388
- C:\Windows\System\CzKsKlH.exe
  C:\Windows\System\CzKsKlH.exe
  2⤵
  PID:13420
- C:\Windows\System\MmImrUZ.exe
  C:\Windows\System\MmImrUZ.exe
  2⤵
  PID:13452
- C:\Windows\System\MWFkvuU.exe
  C:\Windows\System\MWFkvuU.exe
  2⤵
  PID:13472
- C:\Windows\System\YYHrFIB.exe
  C:\Windows\System\YYHrFIB.exe
  2⤵
  PID:13496
- C:\Windows\System\VwQrXKV.exe
  C:\Windows\System\VwQrXKV.exe
  2⤵
  PID:13536
- C:\Windows\System\EYyWiXK.exe
  C:\Windows\System\EYyWiXK.exe
  2⤵
  PID:13572
- C:\Windows\System\PMFwwIk.exe
  C:\Windows\System\PMFwwIk.exe
  2⤵
  PID:13604
- C:\Windows\System\miGgDPn.exe
  C:\Windows\System\miGgDPn.exe
  2⤵
  PID:13624
- C:\Windows\System\HjXcGZU.exe
  C:\Windows\System\HjXcGZU.exe
  2⤵
  PID:13652
- C:\Windows\System\jrGdoAZ.exe
  C:\Windows\System\jrGdoAZ.exe
  2⤵
  PID:13684
- C:\Windows\System\YMsooNe.exe
  C:\Windows\System\YMsooNe.exe
  2⤵
  PID:13704
- C:\Windows\System\ZyoRhdT.exe
  C:\Windows\System\ZyoRhdT.exe
  2⤵
  PID:13728
- C:\Windows\System\KmYWglw.exe
  C:\Windows\System\KmYWglw.exe
  2⤵
  PID:13744
- C:\Windows\System\gzPEYkv.exe
  C:\Windows\System\gzPEYkv.exe
  2⤵
  PID:13764
- C:\Windows\System\JEqMPeh.exe
  C:\Windows\System\JEqMPeh.exe
  2⤵
  PID:13792
- C:\Windows\System\bBSjSKf.exe
  C:\Windows\System\bBSjSKf.exe
  2⤵
  PID:13812
- C:\Windows\System\dVEcmur.exe
  C:\Windows\System\dVEcmur.exe
  2⤵
  PID:13848
- C:\Windows\System\SRMSnuf.exe
  C:\Windows\System\SRMSnuf.exe
  2⤵
  PID:13872
- C:\Windows\System\cZEjXtJ.exe
  C:\Windows\System\cZEjXtJ.exe
  2⤵
  PID:13908
- C:\Windows\System\lNMjhtX.exe
  C:\Windows\System\lNMjhtX.exe
  2⤵
  PID:13940
- C:\Windows\System\WcHsChd.exe
  C:\Windows\System\WcHsChd.exe
  2⤵
  PID:13964
- C:\Windows\System\pXSjMod.exe
  C:\Windows\System\pXSjMod.exe
  2⤵
  PID:13996
- C:\Windows\System\IgWNxQB.exe
  C:\Windows\System\IgWNxQB.exe
  2⤵
  PID:14024
- C:\Windows\System\vWrdYjs.exe
  C:\Windows\System\vWrdYjs.exe
  2⤵
  PID:14056
- C:\Windows\System\IEQbODl.exe
  C:\Windows\System\IEQbODl.exe
  2⤵
  PID:14080
- C:\Windows\System\qPvDrne.exe
  C:\Windows\System\qPvDrne.exe
  2⤵
  PID:14108
- C:\Windows\System\HBOpIYv.exe
  C:\Windows\System\HBOpIYv.exe
  2⤵
  PID:14144
- C:\Windows\System\xalpxui.exe
  C:\Windows\System\xalpxui.exe
  2⤵
  PID:14180
- C:\Windows\System\vRDxbNc.exe
  C:\Windows\System\vRDxbNc.exe
  2⤵
  PID:14216
- C:\Windows\System\HHtUnoW.exe
  C:\Windows\System\HHtUnoW.exe
  2⤵
  PID:14248
- C:\Windows\System\enibjwb.exe
  C:\Windows\System\enibjwb.exe
  2⤵
  PID:14280
- C:\Windows\System\RiOZpPY.exe
  C:\Windows\System\RiOZpPY.exe
  2⤵
  PID:14304
- C:\Windows\System\lbkXZkT.exe
  C:\Windows\System\lbkXZkT.exe
  2⤵
  PID:14332
- C:\Windows\System\bePWfKl.exe
  C:\Windows\System\bePWfKl.exe
  2⤵
  PID:13340
- C:\Windows\System\VdtvexU.exe
  C:\Windows\System\VdtvexU.exe
  2⤵
  PID:13448
- C:\Windows\System\JGzaNeL.exe
  C:\Windows\System\JGzaNeL.exe
  2⤵
  PID:13504
- C:\Windows\System\dlnoAEz.exe
  C:\Windows\System\dlnoAEz.exe
  2⤵
  PID:13560
- C:\Windows\System\KqEeczh.exe
  C:\Windows\System\KqEeczh.exe
  2⤵
  PID:13692
- C:\Windows\System\fGWEfrt.exe
  C:\Windows\System\fGWEfrt.exe
  2⤵
  PID:13620
- C:\Windows\System\DpInThE.exe
  C:\Windows\System\DpInThE.exe
  2⤵
  PID:13828
- C:\Windows\System\clEqcaY.exe
  C:\Windows\System\clEqcaY.exe
  2⤵
  PID:13864
- C:\Windows\System\OlWbTRm.exe
  C:\Windows\System\OlWbTRm.exe
  2⤵
  PID:13952
- C:\Windows\System\FNTOQvy.exe
  C:\Windows\System\FNTOQvy.exe
  2⤵
  PID:13884
- C:\Windows\System\zPEXrAp.exe
  C:\Windows\System\zPEXrAp.exe
  2⤵
  PID:13984
- C:\Windows\System\LhhTsGM.exe
  C:\Windows\System\LhhTsGM.exe
  2⤵
  PID:13920
- C:\Windows\System\azjEoet.exe
  C:\Windows\System\azjEoet.exe
  2⤵
  PID:14120
- C:\Windows\System\RLNrAQW.exe
  C:\Windows\System\RLNrAQW.exe
  2⤵
  PID:14104
- C:\Windows\System\xSPbnhl.exe
  C:\Windows\System\xSPbnhl.exe
  2⤵
  PID:14212
- C:\Windows\System\pldoSYd.exe
  C:\Windows\System\pldoSYd.exe
  2⤵
  PID:14300
- C:\Windows\System\CQqkRVZ.exe
  C:\Windows\System\CQqkRVZ.exe
  2⤵
  PID:13380
- C:\Windows\System\dTrACzS.exe
  C:\Windows\System\dTrACzS.exe
  2⤵
  PID:13492
- C:\Windows\System\jfmwZrB.exe
  C:\Windows\System\jfmwZrB.exe
  2⤵
  PID:13648
- C:\Windows\System\tKZdCQx.exe
  C:\Windows\System\tKZdCQx.exe
  2⤵
  PID:13860
- C:\Windows\System\ZIOTliY.exe
  C:\Windows\System\ZIOTliY.exe
  2⤵
  PID:13780
- C:\Windows\System\BrIRAgV.exe
  C:\Windows\System\BrIRAgV.exe
  2⤵
  PID:14052
- C:\Windows\System\uHiLyTs.exe
  C:\Windows\System\uHiLyTs.exe
  2⤵
  PID:13376
- C:\Windows\System\LxmymTY.exe
  C:\Windows\System\LxmymTY.exe
  2⤵
  PID:13544
- C:\Windows\System\ADsKBJO.exe
  C:\Windows\System\ADsKBJO.exe
  2⤵
  PID:14208
- C:\Windows\System\YZhPwHZ.exe
  C:\Windows\System\YZhPwHZ.exe
  2⤵
  PID:14340
- C:\Windows\System\IRUcsXh.exe
  C:\Windows\System\IRUcsXh.exe
  2⤵
  PID:14368
- C:\Windows\System\SKbYNtt.exe
  C:\Windows\System\SKbYNtt.exe
  2⤵
  PID:14400
- C:\Windows\System\HLyAwmE.exe
  C:\Windows\System\HLyAwmE.exe
  2⤵
  PID:14424
- C:\Windows\System\xbIXGXX.exe
  C:\Windows\System\xbIXGXX.exe
  2⤵
  PID:14460
- C:\Windows\System\nJfNScI.exe
  C:\Windows\System\nJfNScI.exe
  2⤵
  PID:14496
- C:\Windows\System\ImwDRZa.exe
  C:\Windows\System\ImwDRZa.exe
  2⤵
  PID:14512
- C:\Windows\System\QMkxJSI.exe
  C:\Windows\System\QMkxJSI.exe
  2⤵
  PID:14540
- C:\Windows\System\fhNKCTI.exe
  C:\Windows\System\fhNKCTI.exe
  2⤵
  PID:14564
- C:\Windows\System\UMYDyUv.exe
  C:\Windows\System\UMYDyUv.exe
  2⤵
  PID:14600
- C:\Windows\System\ZHoFhLU.exe
  C:\Windows\System\ZHoFhLU.exe
  2⤵
  PID:14628
- C:\Windows\System\DoQUiZX.exe
  C:\Windows\System\DoQUiZX.exe
  2⤵
  PID:14648
- C:\Windows\System\pHmwfsO.exe
  C:\Windows\System\pHmwfsO.exe
  2⤵
  PID:14672
- C:\Windows\System\lFlKwbV.exe
  C:\Windows\System\lFlKwbV.exe
  2⤵
  PID:14704
- C:\Windows\System\wIqQoTF.exe
  C:\Windows\System\wIqQoTF.exe
  2⤵
  PID:14728
- C:\Windows\System\faLKbfT.exe
  C:\Windows\System\faLKbfT.exe
  2⤵
  PID:14748
- C:\Windows\System\kVbEyVb.exe
  C:\Windows\System\kVbEyVb.exe
  2⤵
  PID:14776
- C:\Windows\System\vYLgQON.exe
  C:\Windows\System\vYLgQON.exe
  2⤵
  PID:14796
- C:\Windows\System\qcwvDwR.exe
  C:\Windows\System\qcwvDwR.exe
  2⤵
  PID:14824
- C:\Windows\System\XCDMNVw.exe
  C:\Windows\System\XCDMNVw.exe
  2⤵
  PID:14860
- C:\Windows\System\PGcAfEF.exe
  C:\Windows\System\PGcAfEF.exe
  2⤵
  PID:14888
- C:\Windows\System\cIeTTpY.exe
  C:\Windows\System\cIeTTpY.exe
  2⤵
  PID:14904
- C:\Windows\System\NGbrYnj.exe
  C:\Windows\System\NGbrYnj.exe
  2⤵
  PID:14932
- C:\Windows\System\zqxvDuP.exe
  C:\Windows\System\zqxvDuP.exe
  2⤵
  PID:14964
- C:\Windows\System\MhsixzS.exe
  C:\Windows\System\MhsixzS.exe
  2⤵
  PID:14992
- C:\Windows\System\XCbCBhf.exe
  C:\Windows\System\XCbCBhf.exe
  2⤵
  PID:15016
- C:\Windows\System\dsQokNC.exe
  C:\Windows\System\dsQokNC.exe
  2⤵
  PID:15044
- C:\Windows\System\VSBeDcI.exe
  C:\Windows\System\VSBeDcI.exe
  2⤵
  PID:15068
- C:\Windows\System\gTIjKPo.exe
  C:\Windows\System\gTIjKPo.exe
  2⤵
  PID:15096
- C:\Windows\System\sjXroYg.exe
  C:\Windows\System\sjXroYg.exe
  2⤵
  PID:15132
- C:\Windows\System\ijXPmln.exe
  C:\Windows\System\ijXPmln.exe
  2⤵
  PID:15152
- C:\Windows\System\qUsRHDR.exe
  C:\Windows\System\qUsRHDR.exe
  2⤵
  PID:15184
- C:\Windows\System\aiLDddr.exe
  C:\Windows\System\aiLDddr.exe
  2⤵
  PID:15212
- C:\Windows\System\buCYAYr.exe
  C:\Windows\System\buCYAYr.exe
  2⤵
  PID:15236
- C:\Windows\System\FPzscui.exe
  C:\Windows\System\FPzscui.exe
  2⤵
  PID:15268
- C:\Windows\System\HcFbxKM.exe
  C:\Windows\System\HcFbxKM.exe
  2⤵
  PID:15296
- C:\Windows\System\bBFudFG.exe
  C:\Windows\System\bBFudFG.exe
  2⤵
  PID:15324
- C:\Windows\System\ZdQjckb.exe
  C:\Windows\System\ZdQjckb.exe
  2⤵
  PID:13368
- C:\Windows\System\BwWMDDs.exe
  C:\Windows\System\BwWMDDs.exe
  2⤵
  PID:14192
- C:\Windows\System\TiHDqql.exe
  C:\Windows\System\TiHDqql.exe
  2⤵
  PID:14396
- C:\Windows\System\xONswdc.exe
  C:\Windows\System\xONswdc.exe
  2⤵
  PID:14448
- C:\Windows\System\UyJSGLH.exe
  C:\Windows\System\UyJSGLH.exe
  2⤵
  PID:14504
- C:\Windows\System\FcYyTuM.exe
  C:\Windows\System\FcYyTuM.exe
  2⤵
  PID:14480
- C:\Windows\System\itOzXlE.exe
  C:\Windows\System\itOzXlE.exe
  2⤵
  PID:14692
- C:\Windows\System\KXGyICD.exe
  C:\Windows\System\KXGyICD.exe
  2⤵
  PID:14756
- C:\Windows\System\frrITRr.exe
  C:\Windows\System\frrITRr.exe
  2⤵
  PID:14644
- C:\Windows\System\FiJbHJZ.exe
  C:\Windows\System\FiJbHJZ.exe
  2⤵
  PID:14764
- C:\Windows\System\tLEUGjC.exe
  C:\Windows\System\tLEUGjC.exe
  2⤵
  PID:14948
- C:\Windows\System\cXsHjXq.exe
  C:\Windows\System\cXsHjXq.exe
  2⤵
  PID:14884
- C:\Windows\System\druMAUX.exe
  C:\Windows\System\druMAUX.exe
  2⤵
  PID:14980
- C:\Windows\System\kdkGNoF.exe
  C:\Windows\System\kdkGNoF.exe
  2⤵
  PID:15032
- C:\Windows\System\xLFNZBN.exe
  C:\Windows\System\xLFNZBN.exe
  2⤵
  PID:15060
- C:\Windows\System\uwcTTup.exe
  C:\Windows\System\uwcTTup.exe
  2⤵
  PID:15116
- C:\Windows\System\WxFYkFd.exe
  C:\Windows\System\WxFYkFd.exe
  2⤵
  PID:3960
- C:\Windows\System\qRRSOBC.exe
  C:\Windows\System\qRRSOBC.exe
  2⤵
  PID:15144
- C:\Windows\System\EnnmOwy.exe
  C:\Windows\System\EnnmOwy.exe
  2⤵
  PID:15312
- C:\Windows\System\bTkGXJZ.exe
  C:\Windows\System\bTkGXJZ.exe
  2⤵
  PID:15344
- C:\Windows\System\UvuYJvb.exe
  C:\Windows\System\UvuYJvb.exe
  2⤵
  PID:14420
- C:\Windows\System\WCMRntQ.exe
  C:\Windows\System\WCMRntQ.exe
  2⤵
  PID:15348
- C:\Windows\System\rtVgmdg.exe
  C:\Windows\System\rtVgmdg.exe
  2⤵
  PID:14444
- C:\Windows\System\JLWxSpM.exe
  C:\Windows\System\JLWxSpM.exe
  2⤵
  PID:14960
- C:\Windows\System\gDboJDJ.exe
  C:\Windows\System\gDboJDJ.exe
  2⤵
  PID:14876
- C:\Windows\System\BIomChO.exe
  C:\Windows\System\BIomChO.exe
  2⤵
  PID:15224
- C:\Windows\System\kkCIUVH.exe
  C:\Windows\System\kkCIUVH.exe
  2⤵
  PID:15280
- C:\Windows\System\HegReVE.exe
  C:\Windows\System\HegReVE.exe
  2⤵
  PID:15372
- C:\Windows\System\eWRtlfm.exe
  C:\Windows\System\eWRtlfm.exe
  2⤵
  PID:15400
- C:\Windows\System\tCzBAxb.exe
  C:\Windows\System\tCzBAxb.exe
  2⤵
  PID:15420
- C:\Windows\System\WskxPgt.exe
  C:\Windows\System\WskxPgt.exe
  2⤵
  PID:15448
- C:\Windows\System\kZtVUtn.exe
  C:\Windows\System\kZtVUtn.exe
  2⤵
  PID:15472
- C:\Windows\System\HszAfHO.exe
  C:\Windows\System\HszAfHO.exe
  2⤵
  PID:15496
- C:\Windows\System\VOnjVQI.exe
  C:\Windows\System\VOnjVQI.exe
  2⤵
  PID:15520
- C:\Windows\System\xxbrmex.exe
  C:\Windows\System\xxbrmex.exe
  2⤵
  PID:15544
- C:\Windows\System\sQBacfO.exe
  C:\Windows\System\sQBacfO.exe
  2⤵
  PID:15576
- C:\Windows\System\tTYPDxF.exe
  C:\Windows\System\tTYPDxF.exe
  2⤵
  PID:15604
- C:\Windows\System\DuqqDNH.exe
  C:\Windows\System\DuqqDNH.exe
  2⤵
  PID:15628
- C:\Windows\System\tZzIkTb.exe
  C:\Windows\System\tZzIkTb.exe
  2⤵
  PID:15664
- C:\Windows\System\kBeQRGA.exe
  C:\Windows\System\kBeQRGA.exe
  2⤵
  PID:15700
- C:\Windows\System\HmNhTOy.exe
  C:\Windows\System\HmNhTOy.exe
  2⤵
  PID:15728
- C:\Windows\System\hfumIQS.exe
  C:\Windows\System\hfumIQS.exe
  2⤵
  PID:15764
- C:\Windows\System\NYCPuii.exe
  C:\Windows\System\NYCPuii.exe
  2⤵
  PID:15792
- C:\Windows\System\ncOCWnH.exe
  C:\Windows\System\ncOCWnH.exe
  2⤵
  PID:15812
- C:\Windows\System\iegwrBb.exe
  C:\Windows\System\iegwrBb.exe
  2⤵
  PID:15840
- C:\Windows\System\pSmweAD.exe
  C:\Windows\System\pSmweAD.exe
  2⤵
  PID:15864
- C:\Windows\System\lTzTXWs.exe
  C:\Windows\System\lTzTXWs.exe
  2⤵
  PID:15900
- C:\Windows\System\XWcgaDe.exe
  C:\Windows\System\XWcgaDe.exe
  2⤵
  PID:15916
- C:\Windows\System\pBKGYjL.exe
  C:\Windows\System\pBKGYjL.exe
  2⤵
  PID:15948
- C:\Windows\System\URzZLea.exe
  C:\Windows\System\URzZLea.exe
  2⤵
  PID:15968
- C:\Windows\System\ZDknSEB.exe
  C:\Windows\System\ZDknSEB.exe
  2⤵
  PID:15992
- C:\Windows\System\wDZzdUa.exe
  C:\Windows\System\wDZzdUa.exe
  2⤵
  PID:16016
- C:\Windows\System\XKIVttf.exe
  C:\Windows\System\XKIVttf.exe
  2⤵
  PID:16044
- C:\Windows\System\NIgIhfT.exe
  C:\Windows\System\NIgIhfT.exe
  2⤵
  PID:16068
- C:\Windows\System\tBNSPjq.exe
  C:\Windows\System\tBNSPjq.exe
  2⤵
  PID:16096
- C:\Windows\System\cUtRSij.exe
  C:\Windows\System\cUtRSij.exe
  2⤵
  PID:16116
- C:\Windows\System\wmcvhsm.exe
  C:\Windows\System\wmcvhsm.exe
  2⤵
  PID:16152
- C:\Windows\System\cyfsTls.exe
  C:\Windows\System\cyfsTls.exe
  2⤵
  PID:16184
- C:\Windows\System\hZTvGUM.exe
  C:\Windows\System\hZTvGUM.exe
  2⤵
  PID:16212
- C:\Windows\System\YfIzYVR.exe
  C:\Windows\System\YfIzYVR.exe
  2⤵
  PID:16240
- C:\Windows\System\RVaEDrg.exe
  C:\Windows\System\RVaEDrg.exe
  2⤵
  PID:16272
- C:\Windows\System\dYmrZBx.exe
  C:\Windows\System\dYmrZBx.exe
  2⤵
  PID:16292
- C:\Windows\System\iFetZud.exe
  C:\Windows\System\iFetZud.exe
  2⤵
  PID:16320
- C:\Windows\System\NDPVTcM.exe
  C:\Windows\System\NDPVTcM.exe
  2⤵
  PID:16344
- C:\Windows\System\tcqTSgR.exe
  C:\Windows\System\tcqTSgR.exe
  2⤵
  PID:16364
- C:\Windows\System\IXVIayG.exe
  C:\Windows\System\IXVIayG.exe
  2⤵
  PID:15148
- C:\Windows\System\pIFTJwm.exe
  C:\Windows\System\pIFTJwm.exe
  2⤵
  PID:15416
- C:\Windows\System\sQtcNJQ.exe
  C:\Windows\System\sQtcNJQ.exe
  2⤵
  PID:15568
- C:\Windows\System\MJPOKFA.exe
  C:\Windows\System\MJPOKFA.exe
  2⤵
  PID:15008
- C:\Windows\System\pSQDUBO.exe
  C:\Windows\System\pSQDUBO.exe
  2⤵
  PID:14720
- C:\Windows\System\SspuwrJ.exe
  C:\Windows\System\SspuwrJ.exe
  2⤵
  PID:15092
- C:\Windows\System\abSsYOO.exe
  C:\Windows\System\abSsYOO.exe
  2⤵
  PID:15640
- C:\Windows\System\HKomoXF.exe
  C:\Windows\System\HKomoXF.exe
  2⤵
  PID:15652
- C:\Windows\System\iFXCDTF.exe
  C:\Windows\System\iFXCDTF.exe
  2⤵
  PID:15532
- C:\Windows\System\eVFxAno.exe
  C:\Windows\System\eVFxAno.exe
  2⤵
  PID:15896
- C:\Windows\System\cOZWHnN.exe
  C:\Windows\System\cOZWHnN.exe
  2⤵
  PID:15676
- C:\Windows\System\GGriNdR.exe
  C:\Windows\System\GGriNdR.exe
  2⤵
  PID:15976
- C:\Windows\System\YXSOqrH.exe
  C:\Windows\System\YXSOqrH.exe
  2⤵
  PID:16144
- C:\Windows\System\zQXJMXx.exe
  C:\Windows\System\zQXJMXx.exe
  2⤵
  PID:16176
- C:\Windows\System\JYlbaeA.exe
  C:\Windows\System\JYlbaeA.exe
  2⤵
  PID:16260
- C:\Windows\System\rmswDBj.exe
  C:\Windows\System\rmswDBj.exe
  2⤵
  PID:16196
- C:\Windows\System\kmdnwcj.exe
  C:\Windows\System\kmdnwcj.exe
  2⤵
  PID:16064
- C:\Windows\System\nKJJDEA.exe
  C:\Windows\System\nKJJDEA.exe
  2⤵
  PID:15336
- C:\Windows\System\cXRSuhy.exe
  C:\Windows\System\cXRSuhy.exe
  2⤵
  PID:15600
- C:\Windows\System\SjZrBQG.exe
  C:\Windows\System\SjZrBQG.exe
  2⤵
  PID:16316
- C:\Windows\System\hhdmcnE.exe
  C:\Windows\System\hhdmcnE.exe
  2⤵
  PID:16380
- C:\Windows\System\patMlUf.exe
  C:\Windows\System\patMlUf.exe
  2⤵
  PID:15480
- C:\Windows\System\avSVUzQ.exe
  C:\Windows\System\avSVUzQ.exe
  2⤵
  PID:15364
- C:\Windows\System\yIwrpuB.exe
  C:\Windows\System\yIwrpuB.exe
  2⤵
  PID:14872
- C:\Windows\System\OVpVwbS.exe
  C:\Windows\System\OVpVwbS.exe
  2⤵
  PID:15944
- C:\Windows\System\JMTyQLE.exe
  C:\Windows\System\JMTyQLE.exe
  2⤵
  PID:16392
- C:\Windows\System\VhsWmTe.exe
  C:\Windows\System\VhsWmTe.exe
  2⤵
  PID:16412
- C:\Windows\System\dvUnioL.exe
  C:\Windows\System\dvUnioL.exe
  2⤵
  PID:16444
- C:\Windows\System\WIpPCGW.exe
  C:\Windows\System\WIpPCGW.exe
  2⤵
  PID:16468
- C:\Windows\System\VfjIzWh.exe
  C:\Windows\System\VfjIzWh.exe
  2⤵
  PID:16488
- C:\Windows\System\amgMqgt.exe
  C:\Windows\System\amgMqgt.exe
  2⤵
  PID:16504
- C:\Windows\System\jVgBBML.exe
  C:\Windows\System\jVgBBML.exe
  2⤵
  PID:16540
- C:\Windows\System\WfSmDuU.exe
  C:\Windows\System\WfSmDuU.exe
  2⤵
  PID:16572
- C:\Windows\System\bdRavGZ.exe
  C:\Windows\System\bdRavGZ.exe
  2⤵
  PID:16600
- C:\Windows\System\ttZdDyf.exe
  C:\Windows\System\ttZdDyf.exe
  2⤵
  PID:16620
- C:\Windows\System\UqmsTPM.exe
  C:\Windows\System\UqmsTPM.exe
  2⤵
  PID:16664
- C:\Windows\System\nUnAxxz.exe
  C:\Windows\System\nUnAxxz.exe
  2⤵
  PID:16700
- C:\Windows\System\zbOeUYO.exe
  C:\Windows\System\zbOeUYO.exe
  2⤵
  PID:16732
- C:\Windows\System\pnZAMkD.exe
  C:\Windows\System\pnZAMkD.exe
  2⤵
  PID:16764
- C:\Windows\System\lwarLUJ.exe
  C:\Windows\System\lwarLUJ.exe
  2⤵
  PID:16784
- C:\Windows\System\hySzNrl.exe
  C:\Windows\System\hySzNrl.exe
  2⤵
  PID:16812
- C:\Windows\System\cRwkIvi.exe
  C:\Windows\System\cRwkIvi.exe
  2⤵
  PID:16848
- C:\Windows\System\aLiHbcd.exe
  C:\Windows\System\aLiHbcd.exe
  2⤵
  PID:16876
- C:\Windows\System\vWgvyIm.exe
  C:\Windows\System\vWgvyIm.exe
  2⤵
  PID:16892
- C:\Windows\System\lybygVR.exe
  C:\Windows\System\lybygVR.exe
  2⤵
  PID:16920
- C:\Windows\System\nEcvzmb.exe
  C:\Windows\System\nEcvzmb.exe
  2⤵
  PID:16952
- C:\Windows\System\IyPQAbD.exe
  C:\Windows\System\IyPQAbD.exe
  2⤵
  PID:16976
- C:\Windows\System\OeLSEgp.exe
  C:\Windows\System\OeLSEgp.exe
  2⤵
  PID:17008
- C:\Windows\System\cMLgLtg.exe
  C:\Windows\System\cMLgLtg.exe
  2⤵
  PID:17028
- C:\Windows\System\dzyMBCv.exe
  C:\Windows\System\dzyMBCv.exe
  2⤵
  PID:17052
- C:\Windows\System\PCHSiEE.exe
  C:\Windows\System\PCHSiEE.exe
  2⤵
  PID:17084
- C:\Windows\System\xRMtYyc.exe
  C:\Windows\System\xRMtYyc.exe
  2⤵
  PID:17180
- C:\Windows\System\PSjRFqt.exe
  C:\Windows\System\PSjRFqt.exe
  2⤵
  PID:17260
- C:\Windows\System\pBVRtQy.exe
  C:\Windows\System\pBVRtQy.exe
  2⤵
  PID:17288
- C:\Windows\System\vNskSPn.exe
  C:\Windows\System\vNskSPn.exe
  2⤵
  PID:17324
- C:\Windows\System\oCaxkHH.exe
  C:\Windows\System\oCaxkHH.exe
  2⤵
  PID:17364
- C:\Windows\System\pfPIaxA.exe
  C:\Windows\System\pfPIaxA.exe
  2⤵
  PID:17384
- C:\Windows\System\YRdZxiU.exe
  C:\Windows\System\YRdZxiU.exe
  2⤵
  PID:16284
- C:\Windows\System\WGXRwMC.exe
  C:\Windows\System\WGXRwMC.exe
  2⤵
  PID:16040
- C:\Windows\System\WAhjqLS.exe
  C:\Windows\System\WAhjqLS.exe
  2⤵
  PID:16248
- C:\Windows\System\TMobpRQ.exe
  C:\Windows\System\TMobpRQ.exe
  2⤵
  PID:15516
- C:\Windows\System\FAPNOhQ.exe
  C:\Windows\System\FAPNOhQ.exe
  2⤵
  PID:16440
- C:\Windows\System\ZbAURso.exe
  C:\Windows\System\ZbAURso.exe
  2⤵
  PID:15688
- C:\Windows\System\JZtKIvV.exe
  C:\Windows\System\JZtKIvV.exe
  2⤵
  PID:16136
- C:\Windows\System\byFeHMw.exe
  C:\Windows\System\byFeHMw.exe
  2⤵
  PID:16428
- C:\Windows\System\MGSQkPf.exe
  C:\Windows\System\MGSQkPf.exe
  2⤵
  PID:16480
- C:\Windows\System\UfKBrAy.exe
  C:\Windows\System\UfKBrAy.exe
  2⤵
  PID:16528
- C:\Windows\System\SXCfKLZ.exe
  C:\Windows\System\SXCfKLZ.exe
  2⤵
  PID:16800
- C:\Windows\System\QzWxWxQ.exe
  C:\Windows\System\QzWxWxQ.exe
  2⤵
  PID:16652
- C:\Windows\System\Otlfqrh.exe
  C:\Windows\System\Otlfqrh.exe
  2⤵
  PID:16696
- C:\Windows\System\wxUSgjl.exe
  C:\Windows\System\wxUSgjl.exe
  2⤵
  PID:17048
- C:\Windows\System\RtySeQV.exe
  C:\Windows\System\RtySeQV.exe
  2⤵
  PID:16844
- C:\Windows\System\MOkVfTq.exe
  C:\Windows\System\MOkVfTq.exe
  2⤵
  PID:16476
- C:\Windows\System\oetPREy.exe
  C:\Windows\System\oetPREy.exe
  2⤵
  PID:16224
- C:\Windows\System\WfLOJrV.exe
  C:\Windows\System\WfLOJrV.exe
  2⤵
  PID:16560
- C:\Windows\System\kqBWXBJ.exe
  C:\Windows\System\kqBWXBJ.exe
  2⤵
  PID:16916

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BCYTpxL.exe

Filesize
1.8MB

MD5
72ff57e787eba9c05b66a0836e16d2b3

SHA1
661c9b41aacf533b33727aa394dab321a9b5563d

SHA256
c0b07647fdcbbd6ff7ec519dbc175f87f3e73e48588b59f44f69f952a549cd67

SHA512
f99faadae82c3927b8509c8bd2da13d2214fd4871cc6d641257e6448c7e152218ba3feb043d57eb9befe653decdad95cb0b7d82a1cd86e10cca0d9c959e44d5d

Download Submit
C:\Windows\System\JPaevLO.exe

Filesize
1.8MB

MD5
2fc6f2baed4295877b05c0a6e79f47bc

SHA1
00fa5725e486c01ed91094ed8608c88cc49f0aa3

SHA256
4d691932d7f2a11c15a79b5f41b0c8557ad69def86541982eec9596746efca40

SHA512
e4712d8feb8ca4ab9947025a03dbc8dea0730da1080f73e9baa67869509e56ae8cb7b80fca4442e692d78b222c5c465713c9c5bbd1250a8609e335c2be22c7ce

Download Submit
C:\Windows\System\JsUDIli.exe

Filesize
1.8MB

MD5
dcb5d9c622e703af2b1c1c312d9a6059

SHA1
2e2b03aa99f8962fc1591be6b4ecaf107201dc5e

SHA256
6cfba5f32d20d4de1e4c539aa076ee879f5a5c0a70b57c6b82e452b86e9930b9

SHA512
b43cc825eca4c78e9c9b457ca58bfecacc3f210bd1b16419c3776a011bd9b11e902d90183a89b5cbeeb750c817eec6b0c44fb570e026789afeb05fb73bf1ea3c

Download Submit
C:\Windows\System\LdwvRqu.exe

Filesize
1.8MB

MD5
d372bb66da074e1f6575da89db84b70b

SHA1
ab22e39d57961fbcc5e46faa027e7b2fdd65b519

SHA256
01838faf0711f21b6fe9129abe64cfd68d437c7ca72fae7f67948b46e890ecae

SHA512
c3325b3a1b775834eb4cf4cc3f5f6095ae881cdf84d428ba4597ab1fdb943463a5886ade605e009b04c90f18549fea915a1def1ef9dd607c3672b44244d80948

Download Submit
C:\Windows\System\MBmIHUy.exe

Filesize
1.8MB

MD5
92b9f2ee056c1992c80813a31a4f2b09

SHA1
6d6a7935673bed591f3c2af5ccccaa052d377a9d

SHA256
90d143ac940ecdcec4371f5c7c0791c803a264520ee33405ab051fb3f8ce6d98

SHA512
038fbd1717debb974d8158f45a4559d7f216c59b9b36f9d3994bffb8c0b9c1bd5b342f737d25e937c7cac63530e9076b532db739e1afdc506a4d7695c44cc0d6

Download Submit
C:\Windows\System\MPXNCJx.exe

Filesize
1.8MB

MD5
04beabff4b9778bca01b36b145d13a41

SHA1
1097240d457babfaed89f84d49f3e27eb8b324ee

SHA256
2ac8b6c7ad56ff801ffb34af51b316ce7aea3adacbac6b93564f3b31f348ffba

SHA512
55c563619322efa61c259ff08f56aeb820d816b4ae2f6c2aad74da2ed8585f1298a28df108780c7aa1e089bd9d22e0d9e195810dbf4c090e7674478e5eb8aac2

Download Submit
C:\Windows\System\QzMgCBG.exe

Filesize
1.8MB

MD5
2d964de25ae3a1bf2c0c32ae41fc1d8f

SHA1
1c62f8f636c3beb03c61a301eeda05a2a7f7c052

SHA256
609b47c4bfd4aa2c058cc60c6011c62a901ba8de5b3cf8269063932a4b4edfa3

SHA512
76d17f981612547040c024bc7266c20651b64c8655df5f9c54c7d47a9a576ef33bffc6a1ddb892549518327f1e2ebd25b27efcc5865f44fdcc2ccb07764ef66e

Download Submit
C:\Windows\System\TuJaHEg.exe

Filesize
1.8MB

MD5
0f0330415bf0cb9f1c12e5048d84ed66

SHA1
bd318b95f70e09c9ea45658dc093a3821749b62a

SHA256
09f5cb023535732dd4b233e970b8007a7bf44bc1125d58d46572c1db6c168d2c

SHA512
68b9646340d84466066c83b1b954b6e563e9752ef35d5fe0c845865deb159e977c55c0e9a8214e907bc4fdd473062a4d55b1a9ad4768dcca3ca0e0127c8497fb

Download Submit
C:\Windows\System\UeaFMmC.exe

Filesize
1.8MB

MD5
c3e53bf0ce40bc761b0460334a6f3cb6

SHA1
fd3c0b86b3934a5f34f9c32e78cdaf985a7a3362

SHA256
e9bcf239d25de21777a0baac1f83f3deca206e6003921033f9c78c90b2a659af

SHA512
884424a8593ad5c2960f44f1ebf44fd9faae0dca3757696cb6ac6414d7113b0ba256eed7d849f2a42e0a6050e81f26595ed47c7f3110ecb4d4ce4f8683221f95

Download Submit
C:\Windows\System\VUePBmj.exe

Filesize
1.8MB

MD5
12feca76ff4cfcdb2bef3357b22a3da4

SHA1
aebc473df27cd891177747152956d30362366c33

SHA256
30fc4f000362ef8218543d2bf7aefc72b001424294a6d8cd6af7e03fc8c065ad

SHA512
b2194268b5893255725ebe15545ef457a2a308da85a356cfd1f36fb7f7b504c3bfe93714c8194a6b2fd7aaa04af68354519644edec6bf2978c7bf34f005fe5ea

Download Submit
C:\Windows\System\WqaXebC.exe

Filesize
1.8MB

MD5
5eba1120dff568fce72c0cb942e758d6

SHA1
c25956fe03fda7886edfa6a1fd9ef6ef9e2f4076

SHA256
5e85e5ed6fbdaf46ef6a76b31ccfcb86fc0837e36b55297185dbda0dd4e1cbe8

SHA512
3fe8ee9e5d90196d797e463c0300d40cb98ec3d6d9f533458687b8fd288c72f3fa92c762ab2605669c79cf6b7f108e0c350ca6133890ec8004722ab184653a8a

Download Submit
C:\Windows\System\YAUpNyp.exe

Filesize
1.8MB

MD5
c78e8cc69e90e8b0bd66c927b4f2ef5f

SHA1
1058a8f98341e6dfe1ab7228bab17d0db626b2dc

SHA256
8b3f41002ffde61256fa1fe74a69e3eeb2458ec057fb49a1bd723c16f8796e09

SHA512
7d03b98faade5124470b9422e8d0d732d31f8ca87e7ee55a747e7b4bb065eb2aeb1e8bb5be56014a7b5d3b7de8089df1dc2184f2028fa0fde4db6bf0d5ebe206

Download Submit
C:\Windows\System\YcVqpfQ.exe

Filesize
1.8MB

MD5
8d0ba56f7664fecc7608879c96e2eaf7

SHA1
752b65b8b9990e89d4063eb2a26fcf2012237228

SHA256
fda6164dd56083188cc0cc84fce9ff4e066269d469c6bf3fd0ca40b0eaae7873

SHA512
1515c87e56539ba536e55ce09c305e0429053d7c6be28c8c91abd39c2d719a6ca10d699da48cc66de1046ef24a53b94ff1fe14f90092adb843c76347b3e5c6e7

Download Submit
C:\Windows\System\ZDzJFyC.exe

Filesize
1.8MB

MD5
2aa181f38c41a13f3c14b7d7b384a95d

SHA1
9579614bb0a7f6ed4fa4def7b3d9ae1c2f724196

SHA256
6c9d6c3cd4111cf5d22b459f6c06e994abf2fa45cdc516513b4e87e490fbf80a

SHA512
77e9657e2b53b6fa704ff8a343467a08186aaaf84adb5a2405659637a80e5c11e3336c28b4f97ed7955da587e52a5e548d1d15b56e3af38f89af81312b92e3a1

Download Submit
C:\Windows\System\ZfUqntW.exe

Filesize
1.8MB

MD5
708dcf603b5236bcb592a44151939dc7

SHA1
afbd2f126a6e5f878c9f26066383e7403b696ca4

SHA256
690fc26d7394026fcc540494cd84965df17dd2e80959b5120c37e4aec7c3463d

SHA512
b16ddc0893fdaf84ba33da09759c77849c1d24bc563e53b6fbe116bcbab5c2533b50ff5f751da3685d7178b0391a9e8d294bed6238c441651d1fb2a111de45b6

Download Submit
C:\Windows\System\beaaOZs.exe

Filesize
1.8MB

MD5
39bce048782542ac148877c5182a8730

SHA1
75673beb0b2edc7e82c370d81e757a0cb84d591d

SHA256
bbede3c85d4ae4a31295bf40853efbf9670fa84d4b7be059ff5d683a95c973c4

SHA512
757b3ed283297ec4db244ea0cc11ba064f7af73353814f6708c03cf1ac8bf0dd96b980a8e865598aee30068873f458b91923eaabc3b164a7beeeb00a0ffda102

Download Submit
C:\Windows\System\ddaOoEG.exe

Filesize
1.8MB

MD5
df2cf9735fc7b8b37a9c5ebb0fff9689

SHA1
4078c3665f46661c2ed8fa77e546ed698c438ec9

SHA256
3d923bed7eb605e766e6d7373d22e4f69369fa45247ae6911db32b224d1bb404

SHA512
0a3a5312e306b123da7aec1a1179120531cd847600d5a9abf3ea351c9f0a61472b653c654308d64b96f2c805dc33aaa4b28e4e4157478b49a619556b507507cd

Download Submit
C:\Windows\System\eCqjkLL.exe

Filesize
1.8MB

MD5
31c361371f2b47741bbdb01224324f90

SHA1
f7e9c0c2acdfd3c7c9939bf8749c12bb893ed250

SHA256
911fe6f8a2d5531622c5f3ec9af68fd8a31f78552961044c8f3fff3813fc6d7d

SHA512
800982a6cf7be797558b97b7056c7e7ba04da578d0242c19dc1431a5133150c5027fad1337b8b9d0e124187f8136468e7e10ea5f451d756014038c76d37d3b12

Download Submit
C:\Windows\System\fIJZFRK.exe

Filesize
1.8MB

MD5
5f9cacfd10d6f279a11f9b3e223826ae

SHA1
082dbb2ba66536ea109ec7706aadb6a4f0006732

SHA256
e19fbc1e0c688b57161665e812b283cb8e27a8fdc769a0d252d9296b41c4b978

SHA512
6a48bcb22900f8159f3652c56e7e5153d83404f370899592ebae55ca473240e3b214c0fa89df865ef613387f4f3441e27446e3f61be89b9a3295f4023419f582

Download Submit
C:\Windows\System\hTOKCLt.exe

Filesize
1.8MB

MD5
7cfe90e769c64e353e1ed2063fc43686

SHA1
7cd3c2fe20c302b98a77e97c07900ce6dafecd81

SHA256
17a61a83c5b852eddcd22356f80b365260e795951f95b5152aad63bb691d279c

SHA512
0b51a4078f42f3d40cdcb6e3e663d9f129edd3d5e9192bf51d2c69e0d552374a7501cf5b83a183d1b50254d60a0746e9891680d179235b2d0c08eded9fa3bbff

Download Submit
C:\Windows\System\itOIRXp.exe

Filesize
1.8MB

MD5
b5c2bdda4950b0ad25e454550b115814

SHA1
9eee4ad4bd6d9ee53286ff9a880a743cf396744b

SHA256
c4ded682f66d1e9402fc28a6c0dcfa00c38d074ce1fe17105057dee34e55b3ef

SHA512
3e164888d11c4b0e704a52bb875043dca06dace0daa343221d1ddbdd34c7e9ef3fbb50028572ad5d458a6a4e64479a66616b7223b354a3f7bdcf7fa24cb0e691

Download Submit
C:\Windows\System\lFAEgbt.exe

Filesize
1.8MB

MD5
d696b6b76b3f34182c3f1cee954a35d8

SHA1
5b0d55e82d974bb4830e692de1ef1966a853bec6

SHA256
4e5b955da2c85d4c510a83b91561b76e4be48ef3fe2367cbb4d538845817eaf7

SHA512
1d3cb2c9030a33e719e379190e97d5cb888c83a3e5abab535a2d47bdcc7529f2985cf6653c50c40597ddf89d30b6fe1400f6c289334e993071d97731601ddbbe

Download Submit
C:\Windows\System\oidgPGQ.exe

Filesize
1.8MB

MD5
70ad463d825874642d22f2f8a2c72ab9

SHA1
5ed120908a0738996ab4abe6c82f3a806873dc6b

SHA256
a5d40affce270d641c9ddbf9fbae3356dd699c79e4ec036bfb1f4898b11ea626

SHA512
c4dc7cc86de3fdd938e08b240bcfbcbc10844c373da7dd60fae1e4ba185809869f0661f277702329df88197b1b67e5dcf612aedc42132a2f96a68b6615405610

Download Submit
C:\Windows\System\ojizOcJ.exe

Filesize
1.8MB

MD5
ec4497afe91838fa230517111f1fae01

SHA1
5b03127ab01d609638d573bfea2bd3938890d60a

SHA256
847f26855cccb9bf9e1e68088808122052f2ca102ffc84d7db9326f511c6341e

SHA512
c7481719f83bd3bd87036130bd106c9ec6496fa7e187b42b5215ee099b0fcd6594fd2a165fd0c3c7f5a8e0892173581b16cd52b5d20b12192b4004fab1e2df40

Download Submit
C:\Windows\System\rBofOrN.exe

Filesize
1.8MB

MD5
4f98323fa7cb65b064a6cad70f5e2208

SHA1
7f2042f4a90699586203605d27b98f6813581021

SHA256
fd1bb6d975bbae9350de9934c86c612f171c223c8b0c45b4866ac84cd1f8769e

SHA512
5fc1a4f2d87ec1fe7f411348a24e11ca1cc8475a5836cd855d71888f926d28719ac47f827b2835c538d612a1d4e427be5dac1c50f36c83a03285da92a41c2511

Download Submit
C:\Windows\System\vWrrOmo.exe

Filesize
1.8MB

MD5
ccfe8fd61594878d7c9a4b9936b864d3

SHA1
f42864b1d3af0d6c3e2ba933ecc0aca13671d874

SHA256
b76517bdb42931ad4c7af371865f3c73d49ab8ce25c5f9f190766ff73e446a19

SHA512
3646fc58e23413342cb83bbf9a464dbf7556c15bea4866a5ab6a7e34292c8379331553b84b2630dcef10a349c76a265150752fdeeb11e4e38e0860135e4163e3

Download Submit
C:\Windows\System\vnXklza.exe

Filesize
1.8MB

MD5
201b5f538f720bce6a6a9149ffb6e4ad

SHA1
fb87eb16d214689357724580e24993f97c6c21b4

SHA256
e66de2bc49d5483af7839b38e517907904c68e26c46fe7de0d49eff9c5e434be

SHA512
328c07ff8c2420912d3af021af7af52e15bc66f1392e1885a13ea7c7a4df32cc77733412e29ca95d811b68d7a90eef0a83935646f5eb030d2137d2dc205c0ffa

Download Submit
C:\Windows\System\vwDXVyH.exe

Filesize
1.8MB

MD5
5b474e65af4f197cdfb177d6096b007e

SHA1
6b474e70e5fe57826b9c8c131a201b5f68164383

SHA256
ab8cd5d337379cc66dcff51b2ac916b40875eadefcc3c4d1be331688d8a95a61

SHA512
e104503f323c71ff3031cc920e9068bfd2597aeaeec7340b77f05059dc9cf8acf18516441753a8e72bf65794a27fd601a0f174171799f3afe0b39a0939aa8ebc

Download Submit
C:\Windows\System\wRQYWeu.exe

Filesize
1.8MB

MD5
6c506dd87a0c7aba2e130173319c98e4

SHA1
ae6d28e429e26f44335689c711a931afe1bd9732

SHA256
7870ea9914ab41412f52cd8901603faafae1b923af335cca3101df38e8aa4a8e

SHA512
5b1000ec467883237ca285242b0b19374bac4e67a7ccafa0e6c6e0683125311bbec188c88b2337d6607c89000a97090964d65a30e75d4fe7de9996e657fd11a8

Download Submit
C:\Windows\System\yaEogKX.exe

Filesize
1.8MB

MD5
5efdd89d6b42f542c7fa337859cec134

SHA1
bbd67f1341fd562deb162c30d5b51d1035dc6be9

SHA256
9a96fe0ad850d3d3e55a5d72cccc76cb596a8e02b033d925eef6e284dcfa0b76

SHA512
fb65678794e8c4a66b66db644c8ad32305efdba9651039aa34cf52ee46f49911c7a0c8d83e22f0e448e7b22923cb05ebe50b7bddbe5f0a9061d2e5c69e54b8ba

Download Submit
C:\Windows\System\yzikHLb.exe

Filesize
1.8MB

MD5
d3266e075a615a4033bd86690bf3c25d

SHA1
37bf6ff0ceb617092844700c9090f8c76d41ce75

SHA256
12d57d818e58cb92a76b50137af8543cd97956ccb13ca481021c17756467b753

SHA512
72530b47f5c9eb6261ee753b467ce91b3ddb920dc9003d4f6cb01283464ff968c0d312a059c1ffa99e422a41293db8e7932b6722d61a4f96ffd091ba55f821a2

Download Submit
C:\Windows\System\zPLmERU.exe

Filesize
1.8MB

MD5
4e5fd82c297533ab06a40e694f8819bf

SHA1
29d61f4a8a215fef0b470a3e0a663091a47187e6

SHA256
c178a17223759fff311c63685f64787eecdbe069f6e7614686cd15a3af600968

SHA512
488a62568e5dc3f5057c919c7bb24e55c3bfaa30f69f77ea30a9e0ae092b8930419a73b4497d699acb8cd61a03724aadfc0e781f2f1801b745886fb33b0629b9

Download Submit
C:\Windows\System\zTQNDSB.exe

Filesize
1.8MB

MD5
ff72a4ddf65d4b0c268340c74fe645a3

SHA1
c0c3db6c6b82c6ebb0c42fe7a39f6316ad14bd13

SHA256
c2d0871b1db6f75b83c8c176b2e092ff422235c2a1d31d81d6cd7a3e3524c30e

SHA512
c6d49708e01e7ca6f9f2fcf71259bb778c0c80d6710a134c0faa6a997afdc4c2343526365ad1a078befeb8244f2780248a51fd9033a6d2ce0a7818225607028e

Download Submit
memory/4476-0-0x000001FC7DBB0000-0x000001FC7DBC0000-memory.dmp

Filesize
64KB

Download