xmrig | 66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca

Analysis

max time kernel
128s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
Size

1.3MB
MD5

0c49701d23bdee6d35d7f3357864431d
SHA1

9a30551b4a1941ac79a3f80a3ced9644b6bbe0d6
SHA256

66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca
SHA512

0c88f9c3f1d215e9571edebdc2d12fc90ac0c5f18e84bc4ef9ecde8e7a17817dd151e6678b73e64d14e69c83afb9759a3635435613158796357905f2f2532895
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcZ:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5f

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

Processes:

resource	yara_rule
behavioral2/files/0x000d000000023b69-4.dat	xmrig
behavioral2/files/0x000b000000023b95-7.dat	xmrig
behavioral2/files/0x000a000000023b96-15.dat	xmrig
behavioral2/files/0x000a000000023b97-20.dat	xmrig
behavioral2/files/0x000a000000023b98-23.dat	xmrig
behavioral2/files/0x000a000000023b99-28.dat	xmrig
behavioral2/files/0x000b000000023b9d-47.dat	xmrig
behavioral2/files/0x0009000000023bbc-74.dat	xmrig
behavioral2/files/0x0009000000023bbd-85.dat	xmrig
behavioral2/files/0x0008000000023bb7-81.dat	xmrig
behavioral2/files/0x000e000000023bae-79.dat	xmrig
behavioral2/files/0x000a000000023ba7-73.dat	xmrig
behavioral2/files/0x000b000000023b9f-71.dat	xmrig
behavioral2/files/0x000b000000023b9e-56.dat	xmrig
behavioral2/files/0x000a000000023b9c-50.dat	xmrig
behavioral2/files/0x000a000000023b9b-43.dat	xmrig
behavioral2/files/0x000a000000023b9a-37.dat	xmrig
behavioral2/files/0x0009000000023bbe-89.dat	xmrig
behavioral2/files/0x0011000000023ae4-100.dat	xmrig
behavioral2/files/0x000d000000023ae3-101.dat	xmrig
behavioral2/files/0x000f000000023ae7-109.dat	xmrig
behavioral2/files/0x0008000000023bc7-119.dat	xmrig
behavioral2/files/0x0008000000023bc8-122.dat	xmrig
behavioral2/files/0x0008000000023bf9-143.dat	xmrig
behavioral2/files/0x0008000000023bfd-152.dat	xmrig
behavioral2/files/0x0008000000023bfc-148.dat	xmrig
behavioral2/files/0x0008000000023bfb-147.dat	xmrig
behavioral2/files/0x0008000000023bca-146.dat	xmrig
behavioral2/files/0x0008000000023bc9-145.dat	xmrig
behavioral2/files/0x0008000000023bfa-144.dat	xmrig
behavioral2/files/0x000b000000023b93-140.dat	xmrig
behavioral2/files/0x000e000000023ae0-99.dat	xmrig

Executes dropped EXE 64 IoCs

Processes:

CYYQyHe.exedyAmgmS.exeMacJfnH.exeAdxwqUM.exeFTTziDe.exeVFIqDjI.exetuGPLOe.exeVABxcrY.exeAonQqLI.exerTQqMgY.exexRWCEZJ.exeCEbvzaU.exeKMixnKk.exeKGMyYUF.exeWXKBbDC.exesjEGtLD.exejqcbKzr.exezhAWBKR.exehEwiifj.exembFExOs.exeuAJWitp.exeVqbjCiy.exeLcmFHtO.exeVfnlzCK.exeElooTCn.exeWXUJSro.exeDQCqrLK.exeQQXcdRK.exealboRUY.exejHTjaeQ.exewENXeIf.exeUmDpGIs.exeEJfgdua.exeQncJnku.exetgaWPsw.exeknuvvBK.exexahEImt.exedXehgrZ.exeemlqAwy.exeeWxMKbD.exeXzxSsiC.exeooSEQQi.exedmJgvRM.exebhacIiX.exevvMoJqz.exevjthzWb.exejLWQlxf.exeuwhIjTd.exeTxAlOOh.exeTXXTMcQ.exeUsZhkzx.exexwAxUsy.exebCSWfNn.exebWGvUCB.exebWSzuuF.exeLWlhxlw.exebnioMqO.exerYaTtgA.exeuAQFTbB.exeVwIpTHi.exeSrjdXfA.exeGgBcDLh.exeTKSLkNy.exeWJbFQUI.exe

pid	Process
4376	CYYQyHe.exe
4840	dyAmgmS.exe
3972	MacJfnH.exe
4024	AdxwqUM.exe
4608	FTTziDe.exe
3980	VFIqDjI.exe
2196	tuGPLOe.exe
4740	VABxcrY.exe
3268	AonQqLI.exe
1408	rTQqMgY.exe
3656	xRWCEZJ.exe
2288	CEbvzaU.exe
4844	KMixnKk.exe
452	KGMyYUF.exe
220	WXKBbDC.exe
4552	sjEGtLD.exe
4788	jqcbKzr.exe
1628	zhAWBKR.exe
5068	hEwiifj.exe
3932	mbFExOs.exe
3104	uAJWitp.exe
3868	VqbjCiy.exe
4688	LcmFHtO.exe
1008	VfnlzCK.exe
3520	ElooTCn.exe
3128	WXUJSro.exe
4256	DQCqrLK.exe
3676	QQXcdRK.exe
4804	alboRUY.exe
1184	jHTjaeQ.exe
468	wENXeIf.exe
4000	UmDpGIs.exe
2996	EJfgdua.exe
4868	QncJnku.exe
2640	tgaWPsw.exe
2484	knuvvBK.exe
4008	xahEImt.exe
4732	dXehgrZ.exe
4900	emlqAwy.exe
3652	eWxMKbD.exe
2592	XzxSsiC.exe
3592	ooSEQQi.exe
4760	dmJgvRM.exe
3132	bhacIiX.exe
2348	vvMoJqz.exe
464	vjthzWb.exe
1108	jLWQlxf.exe
2396	uwhIjTd.exe
4120	TxAlOOh.exe
3160	TXXTMcQ.exe
4200	UsZhkzx.exe
212	xwAxUsy.exe
632	bCSWfNn.exe
2352	bWGvUCB.exe
1824	bWSzuuF.exe
2988	LWlhxlw.exe
4068	bnioMqO.exe
2948	rYaTtgA.exe
3388	uAQFTbB.exe
1124	VwIpTHi.exe
948	SrjdXfA.exe
2172	GgBcDLh.exe
4112	TKSLkNy.exe
1444	WJbFQUI.exe

Drops file in Windows directory 64 IoCs

Processes:

66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe

description	ioc	Process
File created	C:\Windows\System\GxXxqrs.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\kpoGTSx.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\uSLJJmY.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\yWRnQds.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\OcXkwSU.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\nWrxNqg.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\flQhEyJ.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\UidycYH.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\cxXKERv.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\LcmFHtO.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\knuvvBK.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\bWSzuuF.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\gwyMwbd.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\vFcYUMp.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\vRfUsbh.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\YbfLXOR.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\UjpOuRt.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\igjTUtG.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\FSEvcOC.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\HPcpTOv.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\IuguGwD.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\KaVrTwL.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\qLuQsde.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\yIiwBcb.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\ICzKYWR.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\XeVcQbu.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\SdxREqt.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\rYaTtgA.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\bvYGmOj.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\rZiqIsW.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\HjcfFHt.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\xVyUWtj.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\hzqzNRC.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\SscrDOB.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\FhgjhGi.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\VljhwPB.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\cNRIdXP.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\kOtYbEd.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\GdgYlnc.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\slyYqUo.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\wHfcgle.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\snrmUUu.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\HghIsKc.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\VkXAksT.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\QUMbUJM.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\RrICCQm.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\nDNTTEn.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\DDeNrvG.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\ZvzAqpN.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\DQCqrLK.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\ylsbjLr.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\HPngKpJ.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\IWLDgmb.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\QnsbSCM.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\tuGPLOe.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\wUWmOdC.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\DWakrJe.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\WwmobjR.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\yhGBbQf.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\Mniuckl.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\lQkyVcy.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\ljxJgGJ.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\pOSuAeL.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
File created	C:\Windows\System\aDkQDYw.exe	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

Processes:

dwm.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

dwm.exe

description	pid	Process
Token: SeCreateGlobalPrivilege	16024	dwm.exe
Token: SeChangeNotifyPrivilege	16024	dwm.exe
Token: 33	16024	dwm.exe
Token: SeIncBasePriorityPrivilege	16024	dwm.exe
Token: SeShutdownPrivilege	16024	dwm.exe
Token: SeCreatePagefilePrivilege	16024	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe

description	pid	Process	procid_target
PID 1092 wrote to memory of 4376	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	84
PID 1092 wrote to memory of 4376	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	84
PID 1092 wrote to memory of 4840	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	85
PID 1092 wrote to memory of 4840	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	85
PID 1092 wrote to memory of 3972	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	86
PID 1092 wrote to memory of 3972	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	86
PID 1092 wrote to memory of 4024	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	87
PID 1092 wrote to memory of 4024	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	87
PID 1092 wrote to memory of 4608	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	88
PID 1092 wrote to memory of 4608	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	88
PID 1092 wrote to memory of 3980	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	89
PID 1092 wrote to memory of 3980	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	89
PID 1092 wrote to memory of 2196	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	90
PID 1092 wrote to memory of 2196	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	90
PID 1092 wrote to memory of 4740	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	91
PID 1092 wrote to memory of 4740	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	91
PID 1092 wrote to memory of 3268	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	92
PID 1092 wrote to memory of 3268	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	92
PID 1092 wrote to memory of 1408	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	93
PID 1092 wrote to memory of 1408	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	93
PID 1092 wrote to memory of 3656	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	94
PID 1092 wrote to memory of 3656	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	94
PID 1092 wrote to memory of 2288	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	95
PID 1092 wrote to memory of 2288	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	95
PID 1092 wrote to memory of 4844	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	96
PID 1092 wrote to memory of 4844	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	96
PID 1092 wrote to memory of 452	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	97
PID 1092 wrote to memory of 452	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	97
PID 1092 wrote to memory of 220	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	98
PID 1092 wrote to memory of 220	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	98
PID 1092 wrote to memory of 4552	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	99
PID 1092 wrote to memory of 4552	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	99
PID 1092 wrote to memory of 4788	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	100
PID 1092 wrote to memory of 4788	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	100
PID 1092 wrote to memory of 1628	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	104
PID 1092 wrote to memory of 1628	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	104
PID 1092 wrote to memory of 5068	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	105
PID 1092 wrote to memory of 5068	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	105
PID 1092 wrote to memory of 3932	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	106
PID 1092 wrote to memory of 3932	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	106
PID 1092 wrote to memory of 3104	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	107
PID 1092 wrote to memory of 3104	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	107
PID 1092 wrote to memory of 3868	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	108
PID 1092 wrote to memory of 3868	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	108
PID 1092 wrote to memory of 4688	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	109
PID 1092 wrote to memory of 4688	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	109
PID 1092 wrote to memory of 1008	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	110
PID 1092 wrote to memory of 1008	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	110
PID 1092 wrote to memory of 3520	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	111
PID 1092 wrote to memory of 3520	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	111
PID 1092 wrote to memory of 4804	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	112
PID 1092 wrote to memory of 4804	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	112
PID 1092 wrote to memory of 3128	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	113
PID 1092 wrote to memory of 3128	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	113
PID 1092 wrote to memory of 4256	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	114
PID 1092 wrote to memory of 4256	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	114
PID 1092 wrote to memory of 3676	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	115
PID 1092 wrote to memory of 3676	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	115
PID 1092 wrote to memory of 1184	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	116
PID 1092 wrote to memory of 1184	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	116
PID 1092 wrote to memory of 468	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	117
PID 1092 wrote to memory of 468	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	117
PID 1092 wrote to memory of 4000	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	118
PID 1092 wrote to memory of 4000	1092	66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe	118

C:\Users\Admin\AppData\Local\Temp\66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe
"C:\Users\Admin\AppData\Local\Temp\66f94c73c71e23f27fb1de9dcee2186c407c831ca06209b80213dae47de011ca.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\System\CYYQyHe.exe
  C:\Windows\System\CYYQyHe.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\dyAmgmS.exe
  C:\Windows\System\dyAmgmS.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\MacJfnH.exe
  C:\Windows\System\MacJfnH.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\AdxwqUM.exe
  C:\Windows\System\AdxwqUM.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\FTTziDe.exe
  C:\Windows\System\FTTziDe.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\VFIqDjI.exe
  C:\Windows\System\VFIqDjI.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\tuGPLOe.exe
  C:\Windows\System\tuGPLOe.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\VABxcrY.exe
  C:\Windows\System\VABxcrY.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\AonQqLI.exe
  C:\Windows\System\AonQqLI.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\rTQqMgY.exe
  C:\Windows\System\rTQqMgY.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\xRWCEZJ.exe
  C:\Windows\System\xRWCEZJ.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\CEbvzaU.exe
  C:\Windows\System\CEbvzaU.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\KMixnKk.exe
  C:\Windows\System\KMixnKk.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\KGMyYUF.exe
  C:\Windows\System\KGMyYUF.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\WXKBbDC.exe
  C:\Windows\System\WXKBbDC.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\sjEGtLD.exe
  C:\Windows\System\sjEGtLD.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\jqcbKzr.exe
  C:\Windows\System\jqcbKzr.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\zhAWBKR.exe
  C:\Windows\System\zhAWBKR.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\hEwiifj.exe
  C:\Windows\System\hEwiifj.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\mbFExOs.exe
  C:\Windows\System\mbFExOs.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\uAJWitp.exe
  C:\Windows\System\uAJWitp.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\VqbjCiy.exe
  C:\Windows\System\VqbjCiy.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\LcmFHtO.exe
  C:\Windows\System\LcmFHtO.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\VfnlzCK.exe
  C:\Windows\System\VfnlzCK.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\ElooTCn.exe
  C:\Windows\System\ElooTCn.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\alboRUY.exe
  C:\Windows\System\alboRUY.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\WXUJSro.exe
  C:\Windows\System\WXUJSro.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\DQCqrLK.exe
  C:\Windows\System\DQCqrLK.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\QQXcdRK.exe
  C:\Windows\System\QQXcdRK.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\jHTjaeQ.exe
  C:\Windows\System\jHTjaeQ.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\wENXeIf.exe
  C:\Windows\System\wENXeIf.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\UmDpGIs.exe
  C:\Windows\System\UmDpGIs.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\EJfgdua.exe
  C:\Windows\System\EJfgdua.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\QncJnku.exe
  C:\Windows\System\QncJnku.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\tgaWPsw.exe
  C:\Windows\System\tgaWPsw.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\knuvvBK.exe
  C:\Windows\System\knuvvBK.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\xahEImt.exe
  C:\Windows\System\xahEImt.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\dXehgrZ.exe
  C:\Windows\System\dXehgrZ.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\emlqAwy.exe
  C:\Windows\System\emlqAwy.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\eWxMKbD.exe
  C:\Windows\System\eWxMKbD.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\XzxSsiC.exe
  C:\Windows\System\XzxSsiC.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\ooSEQQi.exe
  C:\Windows\System\ooSEQQi.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\dmJgvRM.exe
  C:\Windows\System\dmJgvRM.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\bhacIiX.exe
  C:\Windows\System\bhacIiX.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\vvMoJqz.exe
  C:\Windows\System\vvMoJqz.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\vjthzWb.exe
  C:\Windows\System\vjthzWb.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\jLWQlxf.exe
  C:\Windows\System\jLWQlxf.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\uwhIjTd.exe
  C:\Windows\System\uwhIjTd.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\TxAlOOh.exe
  C:\Windows\System\TxAlOOh.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\TXXTMcQ.exe
  C:\Windows\System\TXXTMcQ.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\UsZhkzx.exe
  C:\Windows\System\UsZhkzx.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\xwAxUsy.exe
  C:\Windows\System\xwAxUsy.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\bCSWfNn.exe
  C:\Windows\System\bCSWfNn.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\bWGvUCB.exe
  C:\Windows\System\bWGvUCB.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\bWSzuuF.exe
  C:\Windows\System\bWSzuuF.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\LWlhxlw.exe
  C:\Windows\System\LWlhxlw.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\bnioMqO.exe
  C:\Windows\System\bnioMqO.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\rYaTtgA.exe
  C:\Windows\System\rYaTtgA.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\uAQFTbB.exe
  C:\Windows\System\uAQFTbB.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\VwIpTHi.exe
  C:\Windows\System\VwIpTHi.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\SrjdXfA.exe
  C:\Windows\System\SrjdXfA.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\GgBcDLh.exe
  C:\Windows\System\GgBcDLh.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\TKSLkNy.exe
  C:\Windows\System\TKSLkNy.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\WJbFQUI.exe
  C:\Windows\System\WJbFQUI.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\HghIsKc.exe
  C:\Windows\System\HghIsKc.exe
  2⤵
  PID:5104
- C:\Windows\System\LbSJbih.exe
  C:\Windows\System\LbSJbih.exe
  2⤵
  PID:3524
- C:\Windows\System\pomiNHm.exe
  C:\Windows\System\pomiNHm.exe
  2⤵
  PID:656
- C:\Windows\System\tCqWsVq.exe
  C:\Windows\System\tCqWsVq.exe
  2⤵
  PID:440
- C:\Windows\System\brFIZIm.exe
  C:\Windows\System\brFIZIm.exe
  2⤵
  PID:1900
- C:\Windows\System\qvTTYBg.exe
  C:\Windows\System\qvTTYBg.exe
  2⤵
  PID:4004
- C:\Windows\System\ATyvjYo.exe
  C:\Windows\System\ATyvjYo.exe
  2⤵
  PID:536
- C:\Windows\System\AAkZvPE.exe
  C:\Windows\System\AAkZvPE.exe
  2⤵
  PID:4944
- C:\Windows\System\AgsUqkX.exe
  C:\Windows\System\AgsUqkX.exe
  2⤵
  PID:4500
- C:\Windows\System\ixzyQFC.exe
  C:\Windows\System\ixzyQFC.exe
  2⤵
  PID:2188
- C:\Windows\System\XHJpTYm.exe
  C:\Windows\System\XHJpTYm.exe
  2⤵
  PID:1492
- C:\Windows\System\YWszfGj.exe
  C:\Windows\System\YWszfGj.exe
  2⤵
  PID:792
- C:\Windows\System\oIfzFRZ.exe
  C:\Windows\System\oIfzFRZ.exe
  2⤵
  PID:4396
- C:\Windows\System\xHqTbHI.exe
  C:\Windows\System\xHqTbHI.exe
  2⤵
  PID:2168
- C:\Windows\System\iXnUnOb.exe
  C:\Windows\System\iXnUnOb.exe
  2⤵
  PID:4488
- C:\Windows\System\HFVbPnn.exe
  C:\Windows\System\HFVbPnn.exe
  2⤵
  PID:4124
- C:\Windows\System\xMdXDxr.exe
  C:\Windows\System\xMdXDxr.exe
  2⤵
  PID:4228
- C:\Windows\System\NtJVrKt.exe
  C:\Windows\System\NtJVrKt.exe
  2⤵
  PID:4724
- C:\Windows\System\wPSBpZd.exe
  C:\Windows\System\wPSBpZd.exe
  2⤵
  PID:4920
- C:\Windows\System\LtoLxrL.exe
  C:\Windows\System\LtoLxrL.exe
  2⤵
  PID:4968
- C:\Windows\System\UjpOuRt.exe
  C:\Windows\System\UjpOuRt.exe
  2⤵
  PID:3156
- C:\Windows\System\YKKscvA.exe
  C:\Windows\System\YKKscvA.exe
  2⤵
  PID:4992
- C:\Windows\System\JySmBLj.exe
  C:\Windows\System\JySmBLj.exe
  2⤵
  PID:5092
- C:\Windows\System\wHMdhyX.exe
  C:\Windows\System\wHMdhyX.exe
  2⤵
  PID:760
- C:\Windows\System\ytaZozh.exe
  C:\Windows\System\ytaZozh.exe
  2⤵
  PID:4828
- C:\Windows\System\KEmxNlj.exe
  C:\Windows\System\KEmxNlj.exe
  2⤵
  PID:408
- C:\Windows\System\eVWiQSb.exe
  C:\Windows\System\eVWiQSb.exe
  2⤵
  PID:4864
- C:\Windows\System\RGHHXPt.exe
  C:\Windows\System\RGHHXPt.exe
  2⤵
  PID:3296
- C:\Windows\System\mvnnqnU.exe
  C:\Windows\System\mvnnqnU.exe
  2⤵
  PID:4312
- C:\Windows\System\IbZIupr.exe
  C:\Windows\System\IbZIupr.exe
  2⤵
  PID:4568
- C:\Windows\System\eyeauRz.exe
  C:\Windows\System\eyeauRz.exe
  2⤵
  PID:920
- C:\Windows\System\mimpuaY.exe
  C:\Windows\System\mimpuaY.exe
  2⤵
  PID:2724
- C:\Windows\System\LsaGREn.exe
  C:\Windows\System\LsaGREn.exe
  2⤵
  PID:5132
- C:\Windows\System\FERrOuF.exe
  C:\Windows\System\FERrOuF.exe
  2⤵
  PID:5164
- C:\Windows\System\RLnZEdT.exe
  C:\Windows\System\RLnZEdT.exe
  2⤵
  PID:5204
- C:\Windows\System\aDlvMeY.exe
  C:\Windows\System\aDlvMeY.exe
  2⤵
  PID:5228
- C:\Windows\System\vGZmkTX.exe
  C:\Windows\System\vGZmkTX.exe
  2⤵
  PID:5244
- C:\Windows\System\IYLbYZE.exe
  C:\Windows\System\IYLbYZE.exe
  2⤵
  PID:5264
- C:\Windows\System\hhJSAgW.exe
  C:\Windows\System\hhJSAgW.exe
  2⤵
  PID:5288
- C:\Windows\System\sGnXEkr.exe
  C:\Windows\System\sGnXEkr.exe
  2⤵
  PID:5312
- C:\Windows\System\GUmeoZa.exe
  C:\Windows\System\GUmeoZa.exe
  2⤵
  PID:5336
- C:\Windows\System\EGvhygK.exe
  C:\Windows\System\EGvhygK.exe
  2⤵
  PID:5380
- C:\Windows\System\kmVBTvf.exe
  C:\Windows\System\kmVBTvf.exe
  2⤵
  PID:5436
- C:\Windows\System\VkXAksT.exe
  C:\Windows\System\VkXAksT.exe
  2⤵
  PID:5468
- C:\Windows\System\gXoxTSE.exe
  C:\Windows\System\gXoxTSE.exe
  2⤵
  PID:5488
- C:\Windows\System\GxXxqrs.exe
  C:\Windows\System\GxXxqrs.exe
  2⤵
  PID:5552
- C:\Windows\System\ICBVjjX.exe
  C:\Windows\System\ICBVjjX.exe
  2⤵
  PID:5576
- C:\Windows\System\hMUSaCH.exe
  C:\Windows\System\hMUSaCH.exe
  2⤵
  PID:5604
- C:\Windows\System\fDfKyjA.exe
  C:\Windows\System\fDfKyjA.exe
  2⤵
  PID:5640
- C:\Windows\System\zjnxpxY.exe
  C:\Windows\System\zjnxpxY.exe
  2⤵
  PID:5696
- C:\Windows\System\GHPTWnY.exe
  C:\Windows\System\GHPTWnY.exe
  2⤵
  PID:5764
- C:\Windows\System\LNpzfKQ.exe
  C:\Windows\System\LNpzfKQ.exe
  2⤵
  PID:5800
- C:\Windows\System\pranJUF.exe
  C:\Windows\System\pranJUF.exe
  2⤵
  PID:5816
- C:\Windows\System\YpzioDC.exe
  C:\Windows\System\YpzioDC.exe
  2⤵
  PID:5844
- C:\Windows\System\lYqkgrI.exe
  C:\Windows\System\lYqkgrI.exe
  2⤵
  PID:5872
- C:\Windows\System\JKJRDRO.exe
  C:\Windows\System\JKJRDRO.exe
  2⤵
  PID:5896
- C:\Windows\System\pcsxChd.exe
  C:\Windows\System\pcsxChd.exe
  2⤵
  PID:5920
- C:\Windows\System\UZqpzEW.exe
  C:\Windows\System\UZqpzEW.exe
  2⤵
  PID:5956
- C:\Windows\System\itnzLZu.exe
  C:\Windows\System\itnzLZu.exe
  2⤵
  PID:5992
- C:\Windows\System\arSGEGC.exe
  C:\Windows\System\arSGEGC.exe
  2⤵
  PID:6072
- C:\Windows\System\zSWaIzi.exe
  C:\Windows\System\zSWaIzi.exe
  2⤵
  PID:6112
- C:\Windows\System\DyAGvQZ.exe
  C:\Windows\System\DyAGvQZ.exe
  2⤵
  PID:3372
- C:\Windows\System\WwmobjR.exe
  C:\Windows\System\WwmobjR.exe
  2⤵
  PID:4544
- C:\Windows\System\YgXGtma.exe
  C:\Windows\System\YgXGtma.exe
  2⤵
  PID:5124
- C:\Windows\System\HiufGtr.exe
  C:\Windows\System\HiufGtr.exe
  2⤵
  PID:3140
- C:\Windows\System\SYedeJc.exe
  C:\Windows\System\SYedeJc.exe
  2⤵
  PID:5184
- C:\Windows\System\wTmsaeB.exe
  C:\Windows\System\wTmsaeB.exe
  2⤵
  PID:3948
- C:\Windows\System\MFIvjtv.exe
  C:\Windows\System\MFIvjtv.exe
  2⤵
  PID:5172
- C:\Windows\System\qhpiQEr.exe
  C:\Windows\System\qhpiQEr.exe
  2⤵
  PID:5220
- C:\Windows\System\rzWPbbd.exe
  C:\Windows\System\rzWPbbd.exe
  2⤵
  PID:5272
- C:\Windows\System\GsJDQWU.exe
  C:\Windows\System\GsJDQWU.exe
  2⤵
  PID:5352
- C:\Windows\System\tFVCRGk.exe
  C:\Windows\System\tFVCRGk.exe
  2⤵
  PID:5448
- C:\Windows\System\XfEsiRz.exe
  C:\Windows\System\XfEsiRz.exe
  2⤵
  PID:5496
- C:\Windows\System\HJhEngf.exe
  C:\Windows\System\HJhEngf.exe
  2⤵
  PID:5544
- C:\Windows\System\XyJGcJr.exe
  C:\Windows\System\XyJGcJr.exe
  2⤵
  PID:5624
- C:\Windows\System\OHwfDvc.exe
  C:\Windows\System\OHwfDvc.exe
  2⤵
  PID:5572
- C:\Windows\System\TMTaTGL.exe
  C:\Windows\System\TMTaTGL.exe
  2⤵
  PID:5864
- C:\Windows\System\jiMfSSi.exe
  C:\Windows\System\jiMfSSi.exe
  2⤵
  PID:5812
- C:\Windows\System\tJxSYJD.exe
  C:\Windows\System\tJxSYJD.exe
  2⤵
  PID:5936
- C:\Windows\System\vPRVkdr.exe
  C:\Windows\System\vPRVkdr.exe
  2⤵
  PID:5912
- C:\Windows\System\fBqeCXF.exe
  C:\Windows\System\fBqeCXF.exe
  2⤵
  PID:1576
- C:\Windows\System\wlEaYwF.exe
  C:\Windows\System\wlEaYwF.exe
  2⤵
  PID:6044
- C:\Windows\System\FjPmfao.exe
  C:\Windows\System\FjPmfao.exe
  2⤵
  PID:6136
- C:\Windows\System\eloDSFl.exe
  C:\Windows\System\eloDSFl.exe
  2⤵
  PID:6128
- C:\Windows\System\WzugmPm.exe
  C:\Windows\System\WzugmPm.exe
  2⤵
  PID:3660
- C:\Windows\System\jZlYugY.exe
  C:\Windows\System\jZlYugY.exe
  2⤵
  PID:4480
- C:\Windows\System\KmjfzKn.exe
  C:\Windows\System\KmjfzKn.exe
  2⤵
  PID:5148
- C:\Windows\System\VHMLSsk.exe
  C:\Windows\System\VHMLSsk.exe
  2⤵
  PID:5300
- C:\Windows\System\ojgGyMN.exe
  C:\Windows\System\ojgGyMN.exe
  2⤵
  PID:5364
- C:\Windows\System\UbvDwlv.exe
  C:\Windows\System\UbvDwlv.exe
  2⤵
  PID:5652
- C:\Windows\System\jEiUGQi.exe
  C:\Windows\System\jEiUGQi.exe
  2⤵
  PID:5756
- C:\Windows\System\FDpYJsK.exe
  C:\Windows\System\FDpYJsK.exe
  2⤵
  PID:5984
- C:\Windows\System\KaVrTwL.exe
  C:\Windows\System\KaVrTwL.exe
  2⤵
  PID:2292
- C:\Windows\System\dKIxugs.exe
  C:\Windows\System\dKIxugs.exe
  2⤵
  PID:4604
- C:\Windows\System\SLUAwcV.exe
  C:\Windows\System\SLUAwcV.exe
  2⤵
  PID:5280
- C:\Windows\System\tbQaVcY.exe
  C:\Windows\System\tbQaVcY.exe
  2⤵
  PID:5772
- C:\Windows\System\gmxDCzB.exe
  C:\Windows\System\gmxDCzB.exe
  2⤵
  PID:6052
- C:\Windows\System\yBVKgGM.exe
  C:\Windows\System\yBVKgGM.exe
  2⤵
  PID:3708
- C:\Windows\System\WyqTRSz.exe
  C:\Windows\System\WyqTRSz.exe
  2⤵
  PID:5972
- C:\Windows\System\jhluBDE.exe
  C:\Windows\System\jhluBDE.exe
  2⤵
  PID:6156
- C:\Windows\System\bZiRIjt.exe
  C:\Windows\System\bZiRIjt.exe
  2⤵
  PID:6184
- C:\Windows\System\iDlOtfg.exe
  C:\Windows\System\iDlOtfg.exe
  2⤵
  PID:6212
- C:\Windows\System\bvYGmOj.exe
  C:\Windows\System\bvYGmOj.exe
  2⤵
  PID:6232
- C:\Windows\System\XfnPCow.exe
  C:\Windows\System\XfnPCow.exe
  2⤵
  PID:6272
- C:\Windows\System\ssbeREA.exe
  C:\Windows\System\ssbeREA.exe
  2⤵
  PID:6300
- C:\Windows\System\GDhzjTZ.exe
  C:\Windows\System\GDhzjTZ.exe
  2⤵
  PID:6336
- C:\Windows\System\pfOWakW.exe
  C:\Windows\System\pfOWakW.exe
  2⤵
  PID:6364
- C:\Windows\System\ePfzInW.exe
  C:\Windows\System\ePfzInW.exe
  2⤵
  PID:6396
- C:\Windows\System\uQPLdwV.exe
  C:\Windows\System\uQPLdwV.exe
  2⤵
  PID:6424
- C:\Windows\System\baxxaka.exe
  C:\Windows\System\baxxaka.exe
  2⤵
  PID:6452
- C:\Windows\System\AsxlrbW.exe
  C:\Windows\System\AsxlrbW.exe
  2⤵
  PID:6480
- C:\Windows\System\VZZFBsZ.exe
  C:\Windows\System\VZZFBsZ.exe
  2⤵
  PID:6508
- C:\Windows\System\CHSjTCd.exe
  C:\Windows\System\CHSjTCd.exe
  2⤵
  PID:6524
- C:\Windows\System\BfNYGkN.exe
  C:\Windows\System\BfNYGkN.exe
  2⤵
  PID:6540
- C:\Windows\System\igjTUtG.exe
  C:\Windows\System\igjTUtG.exe
  2⤵
  PID:6556
- C:\Windows\System\DgPsTlE.exe
  C:\Windows\System\DgPsTlE.exe
  2⤵
  PID:6572
- C:\Windows\System\LRRJnKs.exe
  C:\Windows\System\LRRJnKs.exe
  2⤵
  PID:6588
- C:\Windows\System\wAMgmVd.exe
  C:\Windows\System\wAMgmVd.exe
  2⤵
  PID:6608
- C:\Windows\System\xiDZHcB.exe
  C:\Windows\System\xiDZHcB.exe
  2⤵
  PID:6640
- C:\Windows\System\wWAqXhb.exe
  C:\Windows\System\wWAqXhb.exe
  2⤵
  PID:6660
- C:\Windows\System\GDSKUUK.exe
  C:\Windows\System\GDSKUUK.exe
  2⤵
  PID:6692
- C:\Windows\System\zXIkPMH.exe
  C:\Windows\System\zXIkPMH.exe
  2⤵
  PID:6712
- C:\Windows\System\AWoePOn.exe
  C:\Windows\System\AWoePOn.exe
  2⤵
  PID:6744
- C:\Windows\System\GJQKGNg.exe
  C:\Windows\System\GJQKGNg.exe
  2⤵
  PID:6780
- C:\Windows\System\qaDZphV.exe
  C:\Windows\System\qaDZphV.exe
  2⤵
  PID:6812
- C:\Windows\System\fODGQuL.exe
  C:\Windows\System\fODGQuL.exe
  2⤵
  PID:6840
- C:\Windows\System\osZErCm.exe
  C:\Windows\System\osZErCm.exe
  2⤵
  PID:6868
- C:\Windows\System\kPhxhvA.exe
  C:\Windows\System\kPhxhvA.exe
  2⤵
  PID:6896
- C:\Windows\System\ekzmmQt.exe
  C:\Windows\System\ekzmmQt.exe
  2⤵
  PID:6932
- C:\Windows\System\eNhzvOE.exe
  C:\Windows\System\eNhzvOE.exe
  2⤵
  PID:6964
- C:\Windows\System\YjkYqgo.exe
  C:\Windows\System\YjkYqgo.exe
  2⤵
  PID:6996
- C:\Windows\System\HfhhTvu.exe
  C:\Windows\System\HfhhTvu.exe
  2⤵
  PID:7024
- C:\Windows\System\mrHqlTP.exe
  C:\Windows\System\mrHqlTP.exe
  2⤵
  PID:7056
- C:\Windows\System\iGmbDZV.exe
  C:\Windows\System\iGmbDZV.exe
  2⤵
  PID:7088
- C:\Windows\System\vuhruSr.exe
  C:\Windows\System\vuhruSr.exe
  2⤵
  PID:7104
- C:\Windows\System\qeBGnjJ.exe
  C:\Windows\System\qeBGnjJ.exe
  2⤵
  PID:7124
- C:\Windows\System\UAlcAne.exe
  C:\Windows\System\UAlcAne.exe
  2⤵
  PID:7148
- C:\Windows\System\VZQzaGB.exe
  C:\Windows\System\VZQzaGB.exe
  2⤵
  PID:5892
- C:\Windows\System\gJgRZFc.exe
  C:\Windows\System\gJgRZFc.exe
  2⤵
  PID:6196
- C:\Windows\System\SvBWAkc.exe
  C:\Windows\System\SvBWAkc.exe
  2⤵
  PID:6280
- C:\Windows\System\shtcAuI.exe
  C:\Windows\System\shtcAuI.exe
  2⤵
  PID:6344
- C:\Windows\System\NsSyfSh.exe
  C:\Windows\System\NsSyfSh.exe
  2⤵
  PID:6408
- C:\Windows\System\SSWwHZI.exe
  C:\Windows\System\SSWwHZI.exe
  2⤵
  PID:6500
- C:\Windows\System\byDxAPX.exe
  C:\Windows\System\byDxAPX.exe
  2⤵
  PID:6552
- C:\Windows\System\sVvpGRN.exe
  C:\Windows\System\sVvpGRN.exe
  2⤵
  PID:6620
- C:\Windows\System\QGNYYVi.exe
  C:\Windows\System\QGNYYVi.exe
  2⤵
  PID:6756
- C:\Windows\System\fAydsVO.exe
  C:\Windows\System\fAydsVO.exe
  2⤵
  PID:6860
- C:\Windows\System\gHTCcEk.exe
  C:\Windows\System\gHTCcEk.exe
  2⤵
  PID:6880
- C:\Windows\System\VXyjxBq.exe
  C:\Windows\System\VXyjxBq.exe
  2⤵
  PID:6948
- C:\Windows\System\gCYkWVa.exe
  C:\Windows\System\gCYkWVa.exe
  2⤵
  PID:6988
- C:\Windows\System\SscrDOB.exe
  C:\Windows\System\SscrDOB.exe
  2⤵
  PID:7036
- C:\Windows\System\rzePmRS.exe
  C:\Windows\System\rzePmRS.exe
  2⤵
  PID:7140
- C:\Windows\System\MkmjwqQ.exe
  C:\Windows\System\MkmjwqQ.exe
  2⤵
  PID:6172
- C:\Windows\System\MYuofgH.exe
  C:\Windows\System\MYuofgH.exe
  2⤵
  PID:6384
- C:\Windows\System\NDQoeYd.exe
  C:\Windows\System\NDQoeYd.exe
  2⤵
  PID:6356
- C:\Windows\System\UCXojGZ.exe
  C:\Windows\System\UCXojGZ.exe
  2⤵
  PID:6708
- C:\Windows\System\bGJoSLR.exe
  C:\Windows\System\bGJoSLR.exe
  2⤵
  PID:6772
- C:\Windows\System\VLTWMBf.exe
  C:\Windows\System\VLTWMBf.exe
  2⤵
  PID:6980
- C:\Windows\System\SjtGKmR.exe
  C:\Windows\System\SjtGKmR.exe
  2⤵
  PID:7096
- C:\Windows\System\hUnlLTA.exe
  C:\Windows\System\hUnlLTA.exe
  2⤵
  PID:6268
- C:\Windows\System\FzAIRvm.exe
  C:\Windows\System\FzAIRvm.exe
  2⤵
  PID:6516
- C:\Windows\System\RnGHQBj.exe
  C:\Windows\System\RnGHQBj.exe
  2⤵
  PID:6724
- C:\Windows\System\gyHVdxu.exe
  C:\Windows\System\gyHVdxu.exe
  2⤵
  PID:7176
- C:\Windows\System\PfIdLdS.exe
  C:\Windows\System\PfIdLdS.exe
  2⤵
  PID:7200
- C:\Windows\System\AitZjBs.exe
  C:\Windows\System\AitZjBs.exe
  2⤵
  PID:7228
- C:\Windows\System\LhSLzCf.exe
  C:\Windows\System\LhSLzCf.exe
  2⤵
  PID:7256
- C:\Windows\System\vrAFJnT.exe
  C:\Windows\System\vrAFJnT.exe
  2⤵
  PID:7292
- C:\Windows\System\ndmtHeY.exe
  C:\Windows\System\ndmtHeY.exe
  2⤵
  PID:7308
- C:\Windows\System\eGouLhn.exe
  C:\Windows\System\eGouLhn.exe
  2⤵
  PID:7336
- C:\Windows\System\cueHXQl.exe
  C:\Windows\System\cueHXQl.exe
  2⤵
  PID:7368
- C:\Windows\System\uhSGpPx.exe
  C:\Windows\System\uhSGpPx.exe
  2⤵
  PID:7392
- C:\Windows\System\qUgvyvW.exe
  C:\Windows\System\qUgvyvW.exe
  2⤵
  PID:7420
- C:\Windows\System\FhgjhGi.exe
  C:\Windows\System\FhgjhGi.exe
  2⤵
  PID:7448
- C:\Windows\System\YlvAnrT.exe
  C:\Windows\System\YlvAnrT.exe
  2⤵
  PID:7476
- C:\Windows\System\YgQpMjO.exe
  C:\Windows\System\YgQpMjO.exe
  2⤵
  PID:7504
- C:\Windows\System\CzsBaNb.exe
  C:\Windows\System\CzsBaNb.exe
  2⤵
  PID:7532
- C:\Windows\System\RiKoSBh.exe
  C:\Windows\System\RiKoSBh.exe
  2⤵
  PID:7560
- C:\Windows\System\ctZeOnR.exe
  C:\Windows\System\ctZeOnR.exe
  2⤵
  PID:7596
- C:\Windows\System\KlYUUCs.exe
  C:\Windows\System\KlYUUCs.exe
  2⤵
  PID:7624
- C:\Windows\System\TiUxvMv.exe
  C:\Windows\System\TiUxvMv.exe
  2⤵
  PID:7652
- C:\Windows\System\jcOxnfC.exe
  C:\Windows\System\jcOxnfC.exe
  2⤵
  PID:7680
- C:\Windows\System\XQtRsDv.exe
  C:\Windows\System\XQtRsDv.exe
  2⤵
  PID:7708
- C:\Windows\System\pCoVLOs.exe
  C:\Windows\System\pCoVLOs.exe
  2⤵
  PID:7740
- C:\Windows\System\svhovLp.exe
  C:\Windows\System\svhovLp.exe
  2⤵
  PID:7776
- C:\Windows\System\qaIKDZa.exe
  C:\Windows\System\qaIKDZa.exe
  2⤵
  PID:7804
- C:\Windows\System\fxYuTWp.exe
  C:\Windows\System\fxYuTWp.exe
  2⤵
  PID:7824
- C:\Windows\System\vwrvliQ.exe
  C:\Windows\System\vwrvliQ.exe
  2⤵
  PID:7860
- C:\Windows\System\VZRepJA.exe
  C:\Windows\System\VZRepJA.exe
  2⤵
  PID:7876
- C:\Windows\System\JiHlomX.exe
  C:\Windows\System\JiHlomX.exe
  2⤵
  PID:7908
- C:\Windows\System\XRKnSYj.exe
  C:\Windows\System\XRKnSYj.exe
  2⤵
  PID:7932
- C:\Windows\System\JfZAIlJ.exe
  C:\Windows\System\JfZAIlJ.exe
  2⤵
  PID:7972
- C:\Windows\System\kaqJVev.exe
  C:\Windows\System\kaqJVev.exe
  2⤵
  PID:8000
- C:\Windows\System\AvwIrBV.exe
  C:\Windows\System\AvwIrBV.exe
  2⤵
  PID:8032
- C:\Windows\System\DwBboqH.exe
  C:\Windows\System\DwBboqH.exe
  2⤵
  PID:8060
- C:\Windows\System\sDEeNEE.exe
  C:\Windows\System\sDEeNEE.exe
  2⤵
  PID:8076
- C:\Windows\System\kQvlslP.exe
  C:\Windows\System\kQvlslP.exe
  2⤵
  PID:8104
- C:\Windows\System\HasbNUg.exe
  C:\Windows\System\HasbNUg.exe
  2⤵
  PID:8124
- C:\Windows\System\dPRnbIX.exe
  C:\Windows\System\dPRnbIX.exe
  2⤵
  PID:8160
- C:\Windows\System\TMFySyP.exe
  C:\Windows\System\TMFySyP.exe
  2⤵
  PID:8188
- C:\Windows\System\hkSHsWh.exe
  C:\Windows\System\hkSHsWh.exe
  2⤵
  PID:6328
- C:\Windows\System\FYCTCZv.exe
  C:\Windows\System\FYCTCZv.exe
  2⤵
  PID:7192
- C:\Windows\System\kBqzHCP.exe
  C:\Windows\System\kBqzHCP.exe
  2⤵
  PID:7276
- C:\Windows\System\ntUFdLx.exe
  C:\Windows\System\ntUFdLx.exe
  2⤵
  PID:7320
- C:\Windows\System\SdmBvGp.exe
  C:\Windows\System\SdmBvGp.exe
  2⤵
  PID:7404
- C:\Windows\System\GbkKMoB.exe
  C:\Windows\System\GbkKMoB.exe
  2⤵
  PID:7456
- C:\Windows\System\xYcqISv.exe
  C:\Windows\System\xYcqISv.exe
  2⤵
  PID:7520
- C:\Windows\System\XOkiGhg.exe
  C:\Windows\System\XOkiGhg.exe
  2⤵
  PID:7580
- C:\Windows\System\RujCTuY.exe
  C:\Windows\System\RujCTuY.exe
  2⤵
  PID:7648
- C:\Windows\System\cflgPRI.exe
  C:\Windows\System\cflgPRI.exe
  2⤵
  PID:7696
- C:\Windows\System\VbsIXBG.exe
  C:\Windows\System\VbsIXBG.exe
  2⤵
  PID:7760
- C:\Windows\System\GtapwjU.exe
  C:\Windows\System\GtapwjU.exe
  2⤵
  PID:7800
- C:\Windows\System\VljhwPB.exe
  C:\Windows\System\VljhwPB.exe
  2⤵
  PID:7856
- C:\Windows\System\ycskUxX.exe
  C:\Windows\System\ycskUxX.exe
  2⤵
  PID:7892
- C:\Windows\System\YSDMDcH.exe
  C:\Windows\System\YSDMDcH.exe
  2⤵
  PID:7952
- C:\Windows\System\hGYXEOd.exe
  C:\Windows\System\hGYXEOd.exe
  2⤵
  PID:8016
- C:\Windows\System\dgyUKgv.exe
  C:\Windows\System\dgyUKgv.exe
  2⤵
  PID:8088
- C:\Windows\System\QUMbUJM.exe
  C:\Windows\System\QUMbUJM.exe
  2⤵
  PID:8132
- C:\Windows\System\UMrqMZG.exe
  C:\Windows\System\UMrqMZG.exe
  2⤵
  PID:7224
- C:\Windows\System\lLVyiXM.exe
  C:\Windows\System\lLVyiXM.exe
  2⤵
  PID:7360
- C:\Windows\System\jooobgi.exe
  C:\Windows\System\jooobgi.exe
  2⤵
  PID:7664
- C:\Windows\System\prcwBtz.exe
  C:\Windows\System\prcwBtz.exe
  2⤵
  PID:7548
- C:\Windows\System\cvyyvxM.exe
  C:\Windows\System\cvyyvxM.exe
  2⤵
  PID:7616
- C:\Windows\System\VlbIWOD.exe
  C:\Windows\System\VlbIWOD.exe
  2⤵
  PID:8052
- C:\Windows\System\OaZiYWM.exe
  C:\Windows\System\OaZiYWM.exe
  2⤵
  PID:7188
- C:\Windows\System\FCHwQYd.exe
  C:\Windows\System\FCHwQYd.exe
  2⤵
  PID:8100
- C:\Windows\System\weCmhSX.exe
  C:\Windows\System\weCmhSX.exe
  2⤵
  PID:7676
- C:\Windows\System\QeDqIrN.exe
  C:\Windows\System\QeDqIrN.exe
  2⤵
  PID:7668
- C:\Windows\System\qnssfwq.exe
  C:\Windows\System\qnssfwq.exe
  2⤵
  PID:8200
- C:\Windows\System\hHjPRZO.exe
  C:\Windows\System\hHjPRZO.exe
  2⤵
  PID:8228
- C:\Windows\System\nKrhPFY.exe
  C:\Windows\System\nKrhPFY.exe
  2⤵
  PID:8256
- C:\Windows\System\PaMYRRI.exe
  C:\Windows\System\PaMYRRI.exe
  2⤵
  PID:8284
- C:\Windows\System\ELOZkrZ.exe
  C:\Windows\System\ELOZkrZ.exe
  2⤵
  PID:8308
- C:\Windows\System\ichxOVN.exe
  C:\Windows\System\ichxOVN.exe
  2⤵
  PID:8336
- C:\Windows\System\YwsICEt.exe
  C:\Windows\System\YwsICEt.exe
  2⤵
  PID:8360
- C:\Windows\System\xjYDTlk.exe
  C:\Windows\System\xjYDTlk.exe
  2⤵
  PID:8388
- C:\Windows\System\uzRpprR.exe
  C:\Windows\System\uzRpprR.exe
  2⤵
  PID:8412
- C:\Windows\System\VzPtRhs.exe
  C:\Windows\System\VzPtRhs.exe
  2⤵
  PID:8440
- C:\Windows\System\UDFblti.exe
  C:\Windows\System\UDFblti.exe
  2⤵
  PID:8468
- C:\Windows\System\KPcQGzR.exe
  C:\Windows\System\KPcQGzR.exe
  2⤵
  PID:8488
- C:\Windows\System\hNlwboS.exe
  C:\Windows\System\hNlwboS.exe
  2⤵
  PID:8516
- C:\Windows\System\uMNgBFO.exe
  C:\Windows\System\uMNgBFO.exe
  2⤵
  PID:8532
- C:\Windows\System\IunRcsu.exe
  C:\Windows\System\IunRcsu.exe
  2⤵
  PID:8564
- C:\Windows\System\MSkrIhL.exe
  C:\Windows\System\MSkrIhL.exe
  2⤵
  PID:8588
- C:\Windows\System\qzqBxfQ.exe
  C:\Windows\System\qzqBxfQ.exe
  2⤵
  PID:8620
- C:\Windows\System\MjJffmN.exe
  C:\Windows\System\MjJffmN.exe
  2⤵
  PID:8648
- C:\Windows\System\lUPbMxW.exe
  C:\Windows\System\lUPbMxW.exe
  2⤵
  PID:8680
- C:\Windows\System\LMBVUAR.exe
  C:\Windows\System\LMBVUAR.exe
  2⤵
  PID:8712
- C:\Windows\System\eUAMejm.exe
  C:\Windows\System\eUAMejm.exe
  2⤵
  PID:8744
- C:\Windows\System\pOSuAeL.exe
  C:\Windows\System\pOSuAeL.exe
  2⤵
  PID:8772
- C:\Windows\System\fAeIWWP.exe
  C:\Windows\System\fAeIWWP.exe
  2⤵
  PID:8800
- C:\Windows\System\HWRdSFt.exe
  C:\Windows\System\HWRdSFt.exe
  2⤵
  PID:8828
- C:\Windows\System\jRLilie.exe
  C:\Windows\System\jRLilie.exe
  2⤵
  PID:8860
- C:\Windows\System\efYniFR.exe
  C:\Windows\System\efYniFR.exe
  2⤵
  PID:8884
- C:\Windows\System\mihPGLq.exe
  C:\Windows\System\mihPGLq.exe
  2⤵
  PID:8908
- C:\Windows\System\FlEjbti.exe
  C:\Windows\System\FlEjbti.exe
  2⤵
  PID:8936
- C:\Windows\System\mjgajjF.exe
  C:\Windows\System\mjgajjF.exe
  2⤵
  PID:8968
- C:\Windows\System\qaSfItj.exe
  C:\Windows\System\qaSfItj.exe
  2⤵
  PID:8996
- C:\Windows\System\tXowvRr.exe
  C:\Windows\System\tXowvRr.exe
  2⤵
  PID:9024
- C:\Windows\System\uPbtoTf.exe
  C:\Windows\System\uPbtoTf.exe
  2⤵
  PID:9056
- C:\Windows\System\RrICCQm.exe
  C:\Windows\System\RrICCQm.exe
  2⤵
  PID:9084
- C:\Windows\System\ahWulgw.exe
  C:\Windows\System\ahWulgw.exe
  2⤵
  PID:9108
- C:\Windows\System\bjcmdUr.exe
  C:\Windows\System\bjcmdUr.exe
  2⤵
  PID:9132
- C:\Windows\System\HYBcLOW.exe
  C:\Windows\System\HYBcLOW.exe
  2⤵
  PID:9160
- C:\Windows\System\YLqZTti.exe
  C:\Windows\System\YLqZTti.exe
  2⤵
  PID:9192
- C:\Windows\System\heQiWdu.exe
  C:\Windows\System\heQiWdu.exe
  2⤵
  PID:7988
- C:\Windows\System\QzyZMus.exe
  C:\Windows\System\QzyZMus.exe
  2⤵
  PID:7960
- C:\Windows\System\WinDMkC.exe
  C:\Windows\System\WinDMkC.exe
  2⤵
  PID:8236
- C:\Windows\System\lWrcKVV.exe
  C:\Windows\System\lWrcKVV.exe
  2⤵
  PID:8280
- C:\Windows\System\cpLHLRj.exe
  C:\Windows\System\cpLHLRj.exe
  2⤵
  PID:8352
- C:\Windows\System\ccGdXMH.exe
  C:\Windows\System\ccGdXMH.exe
  2⤵
  PID:8480
- C:\Windows\System\MIRDHuN.exe
  C:\Windows\System\MIRDHuN.exe
  2⤵
  PID:8424
- C:\Windows\System\cbNpexA.exe
  C:\Windows\System\cbNpexA.exe
  2⤵
  PID:8504
- C:\Windows\System\vgSidJU.exe
  C:\Windows\System\vgSidJU.exe
  2⤵
  PID:8724
- C:\Windows\System\IdRKtnv.exe
  C:\Windows\System\IdRKtnv.exe
  2⤵
  PID:8600
- C:\Windows\System\nDNTTEn.exe
  C:\Windows\System\nDNTTEn.exe
  2⤵
  PID:8672
- C:\Windows\System\WVGTcTh.exe
  C:\Windows\System\WVGTcTh.exe
  2⤵
  PID:8696
- C:\Windows\System\HFAipDg.exe
  C:\Windows\System\HFAipDg.exe
  2⤵
  PID:8836
- C:\Windows\System\QprPJHd.exe
  C:\Windows\System\QprPJHd.exe
  2⤵
  PID:8872
- C:\Windows\System\vJNGZqk.exe
  C:\Windows\System\vJNGZqk.exe
  2⤵
  PID:8932
- C:\Windows\System\ZCMDAih.exe
  C:\Windows\System\ZCMDAih.exe
  2⤵
  PID:9012
- C:\Windows\System\HCmXJMf.exe
  C:\Windows\System\HCmXJMf.exe
  2⤵
  PID:9152
- C:\Windows\System\hyaitNG.exe
  C:\Windows\System\hyaitNG.exe
  2⤵
  PID:9208
- C:\Windows\System\xULRxlr.exe
  C:\Windows\System\xULRxlr.exe
  2⤵
  PID:8544
- C:\Windows\System\gwyMwbd.exe
  C:\Windows\System\gwyMwbd.exe
  2⤵
  PID:8556
- C:\Windows\System\swoAvue.exe
  C:\Windows\System\swoAvue.exe
  2⤵
  PID:8500
- C:\Windows\System\XCmqTLg.exe
  C:\Windows\System\XCmqTLg.exe
  2⤵
  PID:8616
- C:\Windows\System\TKZpfyz.exe
  C:\Windows\System\TKZpfyz.exe
  2⤵
  PID:8780
- C:\Windows\System\gkAJUHl.exe
  C:\Windows\System\gkAJUHl.exe
  2⤵
  PID:8760
- C:\Windows\System\wHfcgle.exe
  C:\Windows\System\wHfcgle.exe
  2⤵
  PID:9156
- C:\Windows\System\ZRIyIej.exe
  C:\Windows\System\ZRIyIej.exe
  2⤵
  PID:8924
- C:\Windows\System\kfYweXJ.exe
  C:\Windows\System\kfYweXJ.exe
  2⤵
  PID:8980
- C:\Windows\System\IFgSozI.exe
  C:\Windows\System\IFgSozI.exe
  2⤵
  PID:9236
- C:\Windows\System\McuzyUd.exe
  C:\Windows\System\McuzyUd.exe
  2⤵
  PID:9268
- C:\Windows\System\vqxObZn.exe
  C:\Windows\System\vqxObZn.exe
  2⤵
  PID:9296
- C:\Windows\System\WvgmyIQ.exe
  C:\Windows\System\WvgmyIQ.exe
  2⤵
  PID:9328
- C:\Windows\System\aCJHnzR.exe
  C:\Windows\System\aCJHnzR.exe
  2⤵
  PID:9348
- C:\Windows\System\CfeLKrN.exe
  C:\Windows\System\CfeLKrN.exe
  2⤵
  PID:9376
- C:\Windows\System\kIVfVzt.exe
  C:\Windows\System\kIVfVzt.exe
  2⤵
  PID:9404
- C:\Windows\System\pmMBXFb.exe
  C:\Windows\System\pmMBXFb.exe
  2⤵
  PID:9436
- C:\Windows\System\EVSkmkh.exe
  C:\Windows\System\EVSkmkh.exe
  2⤵
  PID:9460
- C:\Windows\System\vFcYUMp.exe
  C:\Windows\System\vFcYUMp.exe
  2⤵
  PID:9488
- C:\Windows\System\TfreBJr.exe
  C:\Windows\System\TfreBJr.exe
  2⤵
  PID:9520
- C:\Windows\System\cVcbRFm.exe
  C:\Windows\System\cVcbRFm.exe
  2⤵
  PID:9548
- C:\Windows\System\UUArbZk.exe
  C:\Windows\System\UUArbZk.exe
  2⤵
  PID:9584
- C:\Windows\System\LwIgylq.exe
  C:\Windows\System\LwIgylq.exe
  2⤵
  PID:9620
- C:\Windows\System\VJrlyPC.exe
  C:\Windows\System\VJrlyPC.exe
  2⤵
  PID:9648
- C:\Windows\System\XkyIfDt.exe
  C:\Windows\System\XkyIfDt.exe
  2⤵
  PID:9668
- C:\Windows\System\MqIlMnW.exe
  C:\Windows\System\MqIlMnW.exe
  2⤵
  PID:9704
- C:\Windows\System\fTKyGQU.exe
  C:\Windows\System\fTKyGQU.exe
  2⤵
  PID:9728
- C:\Windows\System\mCUsEZE.exe
  C:\Windows\System\mCUsEZE.exe
  2⤵
  PID:9756
- C:\Windows\System\NRyETsl.exe
  C:\Windows\System\NRyETsl.exe
  2⤵
  PID:9784
- C:\Windows\System\YWeiMPI.exe
  C:\Windows\System\YWeiMPI.exe
  2⤵
  PID:9816
- C:\Windows\System\UugmhjT.exe
  C:\Windows\System\UugmhjT.exe
  2⤵
  PID:9848
- C:\Windows\System\ZovBYZt.exe
  C:\Windows\System\ZovBYZt.exe
  2⤵
  PID:9880
- C:\Windows\System\AdYNXKm.exe
  C:\Windows\System\AdYNXKm.exe
  2⤵
  PID:9912
- C:\Windows\System\oqptDnq.exe
  C:\Windows\System\oqptDnq.exe
  2⤵
  PID:9948
- C:\Windows\System\LhIXgTI.exe
  C:\Windows\System\LhIXgTI.exe
  2⤵
  PID:9984
- C:\Windows\System\EfAuHTC.exe
  C:\Windows\System\EfAuHTC.exe
  2⤵
  PID:10012
- C:\Windows\System\xhwyCVO.exe
  C:\Windows\System\xhwyCVO.exe
  2⤵
  PID:10040
- C:\Windows\System\VkRpFkM.exe
  C:\Windows\System\VkRpFkM.exe
  2⤵
  PID:10072
- C:\Windows\System\aHvMfzH.exe
  C:\Windows\System\aHvMfzH.exe
  2⤵
  PID:10100
- C:\Windows\System\wGtPiSb.exe
  C:\Windows\System\wGtPiSb.exe
  2⤵
  PID:10128
- C:\Windows\System\xhLyqlL.exe
  C:\Windows\System\xhLyqlL.exe
  2⤵
  PID:10152
- C:\Windows\System\lVCqNjD.exe
  C:\Windows\System\lVCqNjD.exe
  2⤵
  PID:10180
- C:\Windows\System\RpffzDN.exe
  C:\Windows\System\RpffzDN.exe
  2⤵
  PID:10204
- C:\Windows\System\kGwlMNZ.exe
  C:\Windows\System\kGwlMNZ.exe
  2⤵
  PID:10232
- C:\Windows\System\xrNKAoL.exe
  C:\Windows\System\xrNKAoL.exe
  2⤵
  PID:8376
- C:\Windows\System\ZWwdmBD.exe
  C:\Windows\System\ZWwdmBD.exe
  2⤵
  PID:9128
- C:\Windows\System\oDhVfon.exe
  C:\Windows\System\oDhVfon.exe
  2⤵
  PID:9224
- C:\Windows\System\dZXxQEi.exe
  C:\Windows\System\dZXxQEi.exe
  2⤵
  PID:9284
- C:\Windows\System\CfMObks.exe
  C:\Windows\System\CfMObks.exe
  2⤵
  PID:9320
- C:\Windows\System\DxoyvYj.exe
  C:\Windows\System\DxoyvYj.exe
  2⤵
  PID:9344
- C:\Windows\System\oErNSRw.exe
  C:\Windows\System\oErNSRw.exe
  2⤵
  PID:9416
- C:\Windows\System\PZMDHtl.exe
  C:\Windows\System\PZMDHtl.exe
  2⤵
  PID:9456
- C:\Windows\System\vRfUsbh.exe
  C:\Windows\System\vRfUsbh.exe
  2⤵
  PID:9564
- C:\Windows\System\QcdOXuh.exe
  C:\Windows\System\QcdOXuh.exe
  2⤵
  PID:9604
- C:\Windows\System\KgMDZhj.exe
  C:\Windows\System\KgMDZhj.exe
  2⤵
  PID:9592
- C:\Windows\System\HcZxzsU.exe
  C:\Windows\System\HcZxzsU.exe
  2⤵
  PID:9636
- C:\Windows\System\MmyyinG.exe
  C:\Windows\System\MmyyinG.exe
  2⤵
  PID:9724
- C:\Windows\System\GbaJawT.exe
  C:\Windows\System\GbaJawT.exe
  2⤵
  PID:9872
- C:\Windows\System\WjOedgg.exe
  C:\Windows\System\WjOedgg.exe
  2⤵
  PID:9896
- C:\Windows\System\TaGtJnW.exe
  C:\Windows\System\TaGtJnW.exe
  2⤵
  PID:10000
- C:\Windows\System\hAmlUIM.exe
  C:\Windows\System\hAmlUIM.exe
  2⤵
  PID:10112
- C:\Windows\System\SoZkeuf.exe
  C:\Windows\System\SoZkeuf.exe
  2⤵
  PID:10144
- C:\Windows\System\ImZesMT.exe
  C:\Windows\System\ImZesMT.exe
  2⤵
  PID:10196
- C:\Windows\System\YcsLMsi.exe
  C:\Windows\System\YcsLMsi.exe
  2⤵
  PID:10220
- C:\Windows\System\rVUmPuP.exe
  C:\Windows\System\rVUmPuP.exe
  2⤵
  PID:9228
- C:\Windows\System\VzUXyGG.exe
  C:\Windows\System\VzUXyGG.exe
  2⤵
  PID:9400
- C:\Windows\System\QeTzEpQ.exe
  C:\Windows\System\QeTzEpQ.exe
  2⤵
  PID:9688
- C:\Windows\System\cwxtUJx.exe
  C:\Windows\System\cwxtUJx.exe
  2⤵
  PID:9856
- C:\Windows\System\rKHCZze.exe
  C:\Windows\System\rKHCZze.exe
  2⤵
  PID:10228
- C:\Windows\System\gkeFjid.exe
  C:\Windows\System\gkeFjid.exe
  2⤵
  PID:9836
- C:\Windows\System\uULIODZ.exe
  C:\Windows\System\uULIODZ.exe
  2⤵
  PID:10124
- C:\Windows\System\jtMXWYy.exe
  C:\Windows\System\jtMXWYy.exe
  2⤵
  PID:9640
- C:\Windows\System\yFwgjGV.exe
  C:\Windows\System\yFwgjGV.exe
  2⤵
  PID:10264
- C:\Windows\System\qGUgSCo.exe
  C:\Windows\System\qGUgSCo.exe
  2⤵
  PID:10300
- C:\Windows\System\ELgVSGg.exe
  C:\Windows\System\ELgVSGg.exe
  2⤵
  PID:10324
- C:\Windows\System\RHGSFaM.exe
  C:\Windows\System\RHGSFaM.exe
  2⤵
  PID:10360
- C:\Windows\System\MrMotYe.exe
  C:\Windows\System\MrMotYe.exe
  2⤵
  PID:10392
- C:\Windows\System\RmuuZRC.exe
  C:\Windows\System\RmuuZRC.exe
  2⤵
  PID:10416
- C:\Windows\System\ZeIycxw.exe
  C:\Windows\System\ZeIycxw.exe
  2⤵
  PID:10444
- C:\Windows\System\WgQcCQp.exe
  C:\Windows\System\WgQcCQp.exe
  2⤵
  PID:10472
- C:\Windows\System\yhGBbQf.exe
  C:\Windows\System\yhGBbQf.exe
  2⤵
  PID:10496
- C:\Windows\System\CeDWzOs.exe
  C:\Windows\System\CeDWzOs.exe
  2⤵
  PID:10520
- C:\Windows\System\VQnpJkD.exe
  C:\Windows\System\VQnpJkD.exe
  2⤵
  PID:10540
- C:\Windows\System\ZqxUVxS.exe
  C:\Windows\System\ZqxUVxS.exe
  2⤵
  PID:10572
- C:\Windows\System\olgytaN.exe
  C:\Windows\System\olgytaN.exe
  2⤵
  PID:10604
- C:\Windows\System\FrRheCT.exe
  C:\Windows\System\FrRheCT.exe
  2⤵
  PID:10628
- C:\Windows\System\HPocAyz.exe
  C:\Windows\System\HPocAyz.exe
  2⤵
  PID:10664
- C:\Windows\System\rIijnef.exe
  C:\Windows\System\rIijnef.exe
  2⤵
  PID:10688
- C:\Windows\System\SbKWtjI.exe
  C:\Windows\System\SbKWtjI.exe
  2⤵
  PID:10720
- C:\Windows\System\ukqdBQj.exe
  C:\Windows\System\ukqdBQj.exe
  2⤵
  PID:10744
- C:\Windows\System\SnRjUda.exe
  C:\Windows\System\SnRjUda.exe
  2⤵
  PID:10772
- C:\Windows\System\ymacedP.exe
  C:\Windows\System\ymacedP.exe
  2⤵
  PID:10796
- C:\Windows\System\qRfLqXW.exe
  C:\Windows\System\qRfLqXW.exe
  2⤵
  PID:10824
- C:\Windows\System\sVphWNe.exe
  C:\Windows\System\sVphWNe.exe
  2⤵
  PID:10844
- C:\Windows\System\lcDloOU.exe
  C:\Windows\System\lcDloOU.exe
  2⤵
  PID:10868
- C:\Windows\System\UNtrZLT.exe
  C:\Windows\System\UNtrZLT.exe
  2⤵
  PID:10892
- C:\Windows\System\aFGXWNs.exe
  C:\Windows\System\aFGXWNs.exe
  2⤵
  PID:10924
- C:\Windows\System\cPsMxYp.exe
  C:\Windows\System\cPsMxYp.exe
  2⤵
  PID:10948
- C:\Windows\System\GXewIAH.exe
  C:\Windows\System\GXewIAH.exe
  2⤵
  PID:10984
- C:\Windows\System\MhQWcDV.exe
  C:\Windows\System\MhQWcDV.exe
  2⤵
  PID:11004
- C:\Windows\System\LgQljCX.exe
  C:\Windows\System\LgQljCX.exe
  2⤵
  PID:11036
- C:\Windows\System\xlQKKXK.exe
  C:\Windows\System\xlQKKXK.exe
  2⤵
  PID:11060
- C:\Windows\System\ueFugJt.exe
  C:\Windows\System\ueFugJt.exe
  2⤵
  PID:11088
- C:\Windows\System\FSEvcOC.exe
  C:\Windows\System\FSEvcOC.exe
  2⤵
  PID:11116
- C:\Windows\System\GjeNeZT.exe
  C:\Windows\System\GjeNeZT.exe
  2⤵
  PID:11144
- C:\Windows\System\MlQRGPf.exe
  C:\Windows\System\MlQRGPf.exe
  2⤵
  PID:11168
- C:\Windows\System\GmlZlMW.exe
  C:\Windows\System\GmlZlMW.exe
  2⤵
  PID:11200
- C:\Windows\System\cfkXoeR.exe
  C:\Windows\System\cfkXoeR.exe
  2⤵
  PID:11228
- C:\Windows\System\LwtkDFm.exe
  C:\Windows\System\LwtkDFm.exe
  2⤵
  PID:11256
- C:\Windows\System\buUTcBU.exe
  C:\Windows\System\buUTcBU.exe
  2⤵
  PID:9576
- C:\Windows\System\PXqbJxG.exe
  C:\Windows\System\PXqbJxG.exe
  2⤵
  PID:9508
- C:\Windows\System\bTnPrwE.exe
  C:\Windows\System\bTnPrwE.exe
  2⤵
  PID:10216
- C:\Windows\System\ARsLwup.exe
  C:\Windows\System\ARsLwup.exe
  2⤵
  PID:10068
- C:\Windows\System\sTBsJQa.exe
  C:\Windows\System\sTBsJQa.exe
  2⤵
  PID:10436
- C:\Windows\System\JTlxPnS.exe
  C:\Windows\System\JTlxPnS.exe
  2⤵
  PID:10284
- C:\Windows\System\dKHZUQV.exe
  C:\Windows\System\dKHZUQV.exe
  2⤵
  PID:10384
- C:\Windows\System\JlVtnaj.exe
  C:\Windows\System\JlVtnaj.exe
  2⤵
  PID:10424
- C:\Windows\System\mBUYYBK.exe
  C:\Windows\System\mBUYYBK.exe
  2⤵
  PID:10492
- C:\Windows\System\fKiNtrI.exe
  C:\Windows\System\fKiNtrI.exe
  2⤵
  PID:10584
- C:\Windows\System\Mniuckl.exe
  C:\Windows\System\Mniuckl.exe
  2⤵
  PID:10636
- C:\Windows\System\OJmTXtI.exe
  C:\Windows\System\OJmTXtI.exe
  2⤵
  PID:10616
- C:\Windows\System\MkiSBJr.exe
  C:\Windows\System\MkiSBJr.exe
  2⤵
  PID:10652
- C:\Windows\System\uubwJcR.exe
  C:\Windows\System\uubwJcR.exe
  2⤵
  PID:10672
- C:\Windows\System\JWCoRvk.exe
  C:\Windows\System\JWCoRvk.exe
  2⤵
  PID:10780
- C:\Windows\System\tpYoBeP.exe
  C:\Windows\System\tpYoBeP.exe
  2⤵
  PID:10944
- C:\Windows\System\snTGvtl.exe
  C:\Windows\System\snTGvtl.exe
  2⤵
  PID:10900
- C:\Windows\System\eeXZnty.exe
  C:\Windows\System\eeXZnty.exe
  2⤵
  PID:11076
- C:\Windows\System\TuTKrBO.exe
  C:\Windows\System\TuTKrBO.exe
  2⤵
  PID:11024
- C:\Windows\System\CzyMoNi.exe
  C:\Windows\System\CzyMoNi.exe
  2⤵
  PID:9928
- C:\Windows\System\tVLGtSm.exe
  C:\Windows\System\tVLGtSm.exe
  2⤵
  PID:11220
- C:\Windows\System\lBgbErz.exe
  C:\Windows\System\lBgbErz.exe
  2⤵
  PID:9480
- C:\Windows\System\NAYMDXt.exe
  C:\Windows\System\NAYMDXt.exe
  2⤵
  PID:10308
- C:\Windows\System\IMNWssW.exe
  C:\Windows\System\IMNWssW.exe
  2⤵
  PID:10832
- C:\Windows\System\wUWmOdC.exe
  C:\Windows\System\wUWmOdC.exe
  2⤵
  PID:10432
- C:\Windows\System\zWuHNJv.exe
  C:\Windows\System\zWuHNJv.exe
  2⤵
  PID:10600
- C:\Windows\System\yumnrCW.exe
  C:\Windows\System\yumnrCW.exe
  2⤵
  PID:10624
- C:\Windows\System\xrFprzh.exe
  C:\Windows\System\xrFprzh.exe
  2⤵
  PID:10972
- C:\Windows\System\uecKxnT.exe
  C:\Windows\System\uecKxnT.exe
  2⤵
  PID:11288
- C:\Windows\System\qqUkRvT.exe
  C:\Windows\System\qqUkRvT.exe
  2⤵
  PID:11316
- C:\Windows\System\nQMjTUb.exe
  C:\Windows\System\nQMjTUb.exe
  2⤵
  PID:11348
- C:\Windows\System\GyIycMq.exe
  C:\Windows\System\GyIycMq.exe
  2⤵
  PID:11372
- C:\Windows\System\SqVSTOj.exe
  C:\Windows\System\SqVSTOj.exe
  2⤵
  PID:11400
- C:\Windows\System\eXhEqYI.exe
  C:\Windows\System\eXhEqYI.exe
  2⤵
  PID:11432
- C:\Windows\System\NFxKjUt.exe
  C:\Windows\System\NFxKjUt.exe
  2⤵
  PID:11472
- C:\Windows\System\EhaTCKi.exe
  C:\Windows\System\EhaTCKi.exe
  2⤵
  PID:11496
- C:\Windows\System\mtpohAR.exe
  C:\Windows\System\mtpohAR.exe
  2⤵
  PID:11520
- C:\Windows\System\tIAICkB.exe
  C:\Windows\System\tIAICkB.exe
  2⤵
  PID:11540
- C:\Windows\System\WQMmPqH.exe
  C:\Windows\System\WQMmPqH.exe
  2⤵
  PID:11568
- C:\Windows\System\kYIlaJa.exe
  C:\Windows\System\kYIlaJa.exe
  2⤵
  PID:11596
- C:\Windows\System\PHZIswx.exe
  C:\Windows\System\PHZIswx.exe
  2⤵
  PID:11616
- C:\Windows\System\ylsbjLr.exe
  C:\Windows\System\ylsbjLr.exe
  2⤵
  PID:11636
- C:\Windows\System\uzmDMGo.exe
  C:\Windows\System\uzmDMGo.exe
  2⤵
  PID:11664
- C:\Windows\System\IjgGafj.exe
  C:\Windows\System\IjgGafj.exe
  2⤵
  PID:11696
- C:\Windows\System\GQEZCqC.exe
  C:\Windows\System\GQEZCqC.exe
  2⤵
  PID:11716
- C:\Windows\System\DMPJdYV.exe
  C:\Windows\System\DMPJdYV.exe
  2⤵
  PID:11744
- C:\Windows\System\SBAsdVh.exe
  C:\Windows\System\SBAsdVh.exe
  2⤵
  PID:11772
- C:\Windows\System\iPANboC.exe
  C:\Windows\System\iPANboC.exe
  2⤵
  PID:11792
- C:\Windows\System\woqfulY.exe
  C:\Windows\System\woqfulY.exe
  2⤵
  PID:11816
- C:\Windows\System\GotwkFI.exe
  C:\Windows\System\GotwkFI.exe
  2⤵
  PID:11836
- C:\Windows\System\lFyDeMh.exe
  C:\Windows\System\lFyDeMh.exe
  2⤵
  PID:11864
- C:\Windows\System\mpmSRoV.exe
  C:\Windows\System\mpmSRoV.exe
  2⤵
  PID:11880
- C:\Windows\System\siuzVTh.exe
  C:\Windows\System\siuzVTh.exe
  2⤵
  PID:11904
- C:\Windows\System\aqpzIjJ.exe
  C:\Windows\System\aqpzIjJ.exe
  2⤵
  PID:11928
- C:\Windows\System\ZrvArEy.exe
  C:\Windows\System\ZrvArEy.exe
  2⤵
  PID:11948
- C:\Windows\System\xFYfYkD.exe
  C:\Windows\System\xFYfYkD.exe
  2⤵
  PID:11976
- C:\Windows\System\SXhRGAZ.exe
  C:\Windows\System\SXhRGAZ.exe
  2⤵
  PID:12004
- C:\Windows\System\RgzbBQu.exe
  C:\Windows\System\RgzbBQu.exe
  2⤵
  PID:12028
- C:\Windows\System\urZmRYe.exe
  C:\Windows\System\urZmRYe.exe
  2⤵
  PID:12048
- C:\Windows\System\rRmJSgT.exe
  C:\Windows\System\rRmJSgT.exe
  2⤵
  PID:12064
- C:\Windows\System\WxOhDMk.exe
  C:\Windows\System\WxOhDMk.exe
  2⤵
  PID:12084
- C:\Windows\System\wnmBqff.exe
  C:\Windows\System\wnmBqff.exe
  2⤵
  PID:12112
- C:\Windows\System\HbHdKkL.exe
  C:\Windows\System\HbHdKkL.exe
  2⤵
  PID:12136
- C:\Windows\System\YlRSzon.exe
  C:\Windows\System\YlRSzon.exe
  2⤵
  PID:12164
- C:\Windows\System\mSyvtzB.exe
  C:\Windows\System\mSyvtzB.exe
  2⤵
  PID:12188
- C:\Windows\System\wdkxgiU.exe
  C:\Windows\System\wdkxgiU.exe
  2⤵
  PID:12220
- C:\Windows\System\PaaipXj.exe
  C:\Windows\System\PaaipXj.exe
  2⤵
  PID:12252
- C:\Windows\System\nXlqFzj.exe
  C:\Windows\System\nXlqFzj.exe
  2⤵
  PID:12272
- C:\Windows\System\xEmhIpY.exe
  C:\Windows\System\xEmhIpY.exe
  2⤵
  PID:11128
- C:\Windows\System\nvtusII.exe
  C:\Windows\System\nvtusII.exe
  2⤵
  PID:10380
- C:\Windows\System\KpdjSzM.exe
  C:\Windows\System\KpdjSzM.exe
  2⤵
  PID:10480
- C:\Windows\System\uPLlXgb.exe
  C:\Windows\System\uPLlXgb.exe
  2⤵
  PID:11016
- C:\Windows\System\QYQcQnC.exe
  C:\Windows\System\QYQcQnC.exe
  2⤵
  PID:10940
- C:\Windows\System\MXbGyUK.exe
  C:\Windows\System\MXbGyUK.exe
  2⤵
  PID:11416
- C:\Windows\System\yTONHiu.exe
  C:\Windows\System\yTONHiu.exe
  2⤵
  PID:9444
- C:\Windows\System\OkDGYdf.exe
  C:\Windows\System\OkDGYdf.exe
  2⤵
  PID:11528
- C:\Windows\System\qIiwdbl.exe
  C:\Windows\System\qIiwdbl.exe
  2⤵
  PID:11324
- C:\Windows\System\TCNnIjX.exe
  C:\Windows\System\TCNnIjX.exe
  2⤵
  PID:11480
- C:\Windows\System\Cdmijsh.exe
  C:\Windows\System\Cdmijsh.exe
  2⤵
  PID:11552
- C:\Windows\System\dJZjmQH.exe
  C:\Windows\System\dJZjmQH.exe
  2⤵
  PID:11408
- C:\Windows\System\gPryDjD.exe
  C:\Windows\System\gPryDjD.exe
  2⤵
  PID:11452
- C:\Windows\System\qUCwPyL.exe
  C:\Windows\System\qUCwPyL.exe
  2⤵
  PID:11876
- C:\Windows\System\oyZShMf.exe
  C:\Windows\System\oyZShMf.exe
  2⤵
  PID:11680
- C:\Windows\System\CaTcJyK.exe
  C:\Windows\System\CaTcJyK.exe
  2⤵
  PID:11584
- C:\Windows\System\cNRIdXP.exe
  C:\Windows\System\cNRIdXP.exe
  2⤵
  PID:11852
- C:\Windows\System\kkTJcHi.exe
  C:\Windows\System\kkTJcHi.exe
  2⤵
  PID:12108
- C:\Windows\System\oyMjCWD.exe
  C:\Windows\System\oyMjCWD.exe
  2⤵
  PID:11784
- C:\Windows\System\rwriwWx.exe
  C:\Windows\System\rwriwWx.exe
  2⤵
  PID:12240
- C:\Windows\System\CMgKzlr.exe
  C:\Windows\System\CMgKzlr.exe
  2⤵
  PID:11244
- C:\Windows\System\LgSyscK.exe
  C:\Windows\System\LgSyscK.exe
  2⤵
  PID:9040
- C:\Windows\System\qLuQsde.exe
  C:\Windows\System\qLuQsde.exe
  2⤵
  PID:11940
- C:\Windows\System\kOtYbEd.exe
  C:\Windows\System\kOtYbEd.exe
  2⤵
  PID:12284
- C:\Windows\System\ClkTdYj.exe
  C:\Windows\System\ClkTdYj.exe
  2⤵
  PID:12308
- C:\Windows\System\MFOIMSe.exe
  C:\Windows\System\MFOIMSe.exe
  2⤵
  PID:12340
- C:\Windows\System\ArKjbGJ.exe
  C:\Windows\System\ArKjbGJ.exe
  2⤵
  PID:12356
- C:\Windows\System\uMVzdVU.exe
  C:\Windows\System\uMVzdVU.exe
  2⤵
  PID:12384
- C:\Windows\System\TfKNUlo.exe
  C:\Windows\System\TfKNUlo.exe
  2⤵
  PID:12404
- C:\Windows\System\zaXlGba.exe
  C:\Windows\System\zaXlGba.exe
  2⤵
  PID:12428
- C:\Windows\System\FSIKWKF.exe
  C:\Windows\System\FSIKWKF.exe
  2⤵
  PID:12452
- C:\Windows\System\XmovMOy.exe
  C:\Windows\System\XmovMOy.exe
  2⤵
  PID:12476
- C:\Windows\System\ajmJheU.exe
  C:\Windows\System\ajmJheU.exe
  2⤵
  PID:12500
- C:\Windows\System\ptcgbaL.exe
  C:\Windows\System\ptcgbaL.exe
  2⤵
  PID:12524
- C:\Windows\System\bEGMCTH.exe
  C:\Windows\System\bEGMCTH.exe
  2⤵
  PID:12552
- C:\Windows\System\jFUjtAZ.exe
  C:\Windows\System\jFUjtAZ.exe
  2⤵
  PID:12580
- C:\Windows\System\ysClGeo.exe
  C:\Windows\System\ysClGeo.exe
  2⤵
  PID:12600
- C:\Windows\System\kpoGTSx.exe
  C:\Windows\System\kpoGTSx.exe
  2⤵
  PID:12632
- C:\Windows\System\Xspgbyx.exe
  C:\Windows\System\Xspgbyx.exe
  2⤵
  PID:12656
- C:\Windows\System\OXxzmtK.exe
  C:\Windows\System\OXxzmtK.exe
  2⤵
  PID:12684
- C:\Windows\System\RISwMof.exe
  C:\Windows\System\RISwMof.exe
  2⤵
  PID:12708
- C:\Windows\System\QWWlxtt.exe
  C:\Windows\System\QWWlxtt.exe
  2⤵
  PID:12732
- C:\Windows\System\wTxIxaJ.exe
  C:\Windows\System\wTxIxaJ.exe
  2⤵
  PID:12760
- C:\Windows\System\RFqkNQD.exe
  C:\Windows\System\RFqkNQD.exe
  2⤵
  PID:12784
- C:\Windows\System\ecqltkC.exe
  C:\Windows\System\ecqltkC.exe
  2⤵
  PID:12812
- C:\Windows\System\lQkyVcy.exe
  C:\Windows\System\lQkyVcy.exe
  2⤵
  PID:12828
- C:\Windows\System\CDFgJzH.exe
  C:\Windows\System\CDFgJzH.exe
  2⤵
  PID:12848
- C:\Windows\System\yyfXTcz.exe
  C:\Windows\System\yyfXTcz.exe
  2⤵
  PID:12864
- C:\Windows\System\CAMBOCQ.exe
  C:\Windows\System\CAMBOCQ.exe
  2⤵
  PID:12892
- C:\Windows\System\DKnkjRw.exe
  C:\Windows\System\DKnkjRw.exe
  2⤵
  PID:12920
- C:\Windows\System\YbfLXOR.exe
  C:\Windows\System\YbfLXOR.exe
  2⤵
  PID:12944
- C:\Windows\System\OtQtjmR.exe
  C:\Windows\System\OtQtjmR.exe
  2⤵
  PID:12964
- C:\Windows\System\kqMxFAU.exe
  C:\Windows\System\kqMxFAU.exe
  2⤵
  PID:12988
- C:\Windows\System\fhBUrjM.exe
  C:\Windows\System\fhBUrjM.exe
  2⤵
  PID:13016
- C:\Windows\System\NUIlZtu.exe
  C:\Windows\System\NUIlZtu.exe
  2⤵
  PID:13032
- C:\Windows\System\xEdrNaX.exe
  C:\Windows\System\xEdrNaX.exe
  2⤵
  PID:13056
- C:\Windows\System\TCkwGdc.exe
  C:\Windows\System\TCkwGdc.exe
  2⤵
  PID:13080
- C:\Windows\System\CdBaGaQ.exe
  C:\Windows\System\CdBaGaQ.exe
  2⤵
  PID:13112
- C:\Windows\System\dtzzQec.exe
  C:\Windows\System\dtzzQec.exe
  2⤵
  PID:13140
- C:\Windows\System\kPanUHO.exe
  C:\Windows\System\kPanUHO.exe
  2⤵
  PID:13160
- C:\Windows\System\SPKoCQK.exe
  C:\Windows\System\SPKoCQK.exe
  2⤵
  PID:13188
- C:\Windows\System\JKKKwXT.exe
  C:\Windows\System\JKKKwXT.exe
  2⤵
  PID:13220
- C:\Windows\System\jOezOhV.exe
  C:\Windows\System\jOezOhV.exe
  2⤵
  PID:13236
- C:\Windows\System\yWYCIjl.exe
  C:\Windows\System\yWYCIjl.exe
  2⤵
  PID:13264
- C:\Windows\System\gvMScSZ.exe
  C:\Windows\System\gvMScSZ.exe
  2⤵
  PID:13296
- C:\Windows\System\vYgVrXm.exe
  C:\Windows\System\vYgVrXm.exe
  2⤵
  PID:12060
- C:\Windows\System\SikJNPk.exe
  C:\Windows\System\SikJNPk.exe
  2⤵
  PID:11368
- C:\Windows\System\jketIAm.exe
  C:\Windows\System\jketIAm.exe
  2⤵
  PID:12044
- C:\Windows\System\IbrGPIn.exe
  C:\Windows\System\IbrGPIn.exe
  2⤵
  PID:12176
- C:\Windows\System\jnlqJTz.exe
  C:\Windows\System\jnlqJTz.exe
  2⤵
  PID:11052
- C:\Windows\System\hcYJKjj.exe
  C:\Windows\System\hcYJKjj.exe
  2⤵
  PID:11536
- C:\Windows\System\rZiqIsW.exe
  C:\Windows\System\rZiqIsW.exe
  2⤵
  PID:12352
- C:\Windows\System\HPngKpJ.exe
  C:\Windows\System\HPngKpJ.exe
  2⤵
  PID:12416
- C:\Windows\System\pSKIRcg.exe
  C:\Windows\System\pSKIRcg.exe
  2⤵
  PID:11808
- C:\Windows\System\OimPNFI.exe
  C:\Windows\System\OimPNFI.exe
  2⤵
  PID:10920
- C:\Windows\System\TDrxscy.exe
  C:\Windows\System\TDrxscy.exe
  2⤵
  PID:12320
- C:\Windows\System\IvOkmgF.exe
  C:\Windows\System\IvOkmgF.exe
  2⤵
  PID:11492
- C:\Windows\System\VAoKlIC.exe
  C:\Windows\System\VAoKlIC.exe
  2⤵
  PID:12704
- C:\Windows\System\yCpcmHn.exe
  C:\Windows\System\yCpcmHn.exe
  2⤵
  PID:12512
- C:\Windows\System\PhOOQKm.exe
  C:\Windows\System\PhOOQKm.exe
  2⤵
  PID:12296
- C:\Windows\System\yoYurgv.exe
  C:\Windows\System\yoYurgv.exe
  2⤵
  PID:13000
- C:\Windows\System\XogMyXF.exe
  C:\Windows\System\XogMyXF.exe
  2⤵
  PID:12368
- C:\Windows\System\HPcpTOv.exe
  C:\Windows\System\HPcpTOv.exe
  2⤵
  PID:13092
- C:\Windows\System\NAlOlou.exe
  C:\Windows\System\NAlOlou.exe
  2⤵
  PID:12448
- C:\Windows\System\RhELQRQ.exe
  C:\Windows\System\RhELQRQ.exe
  2⤵
  PID:12464
- C:\Windows\System\PEaoZYs.exe
  C:\Windows\System\PEaoZYs.exe
  2⤵
  PID:13168
- C:\Windows\System\PEUaoUz.exe
  C:\Windows\System\PEUaoUz.exe
  2⤵
  PID:12836
- C:\Windows\System\lJrxtSZ.exe
  C:\Windows\System\lJrxtSZ.exe
  2⤵
  PID:13204
- C:\Windows\System\VuMIaNW.exe
  C:\Windows\System\VuMIaNW.exe
  2⤵
  PID:12888
- C:\Windows\System\jVSvVst.exe
  C:\Windows\System\jVSvVst.exe
  2⤵
  PID:12616
- C:\Windows\System\ABYGkwM.exe
  C:\Windows\System\ABYGkwM.exe
  2⤵
  PID:13332
- C:\Windows\System\tkZwCqE.exe
  C:\Windows\System\tkZwCqE.exe
  2⤵
  PID:13360
- C:\Windows\System\uUNUzze.exe
  C:\Windows\System\uUNUzze.exe
  2⤵
  PID:13376
- C:\Windows\System\PFlnrnn.exe
  C:\Windows\System\PFlnrnn.exe
  2⤵
  PID:13404
- C:\Windows\System\SBOwpfi.exe
  C:\Windows\System\SBOwpfi.exe
  2⤵
  PID:13424
- C:\Windows\System\grpoBFW.exe
  C:\Windows\System\grpoBFW.exe
  2⤵
  PID:13464
- C:\Windows\System\RIvaeOF.exe
  C:\Windows\System\RIvaeOF.exe
  2⤵
  PID:13488
- C:\Windows\System\rVxNejt.exe
  C:\Windows\System\rVxNejt.exe
  2⤵
  PID:13508
- C:\Windows\System\uvZpxxQ.exe
  C:\Windows\System\uvZpxxQ.exe
  2⤵
  PID:13528
- C:\Windows\System\OuYoQYW.exe
  C:\Windows\System\OuYoQYW.exe
  2⤵
  PID:13544
- C:\Windows\System\SFSLSWH.exe
  C:\Windows\System\SFSLSWH.exe
  2⤵
  PID:13560
- C:\Windows\System\tssEQQt.exe
  C:\Windows\System\tssEQQt.exe
  2⤵
  PID:13584
- C:\Windows\System\IUqntMy.exe
  C:\Windows\System\IUqntMy.exe
  2⤵
  PID:13608
- C:\Windows\System\hjPudVN.exe
  C:\Windows\System\hjPudVN.exe
  2⤵
  PID:13632
- C:\Windows\System\YpQmELK.exe
  C:\Windows\System\YpQmELK.exe
  2⤵
  PID:13656
- C:\Windows\System\LoorcKY.exe
  C:\Windows\System\LoorcKY.exe
  2⤵
  PID:13684
- C:\Windows\System\escMTwT.exe
  C:\Windows\System\escMTwT.exe
  2⤵
  PID:13724
- C:\Windows\System\bIjhwWr.exe
  C:\Windows\System\bIjhwWr.exe
  2⤵
  PID:13752
- C:\Windows\System\lxwKsyo.exe
  C:\Windows\System\lxwKsyo.exe
  2⤵
  PID:13780
- C:\Windows\System\MWvtbsC.exe
  C:\Windows\System\MWvtbsC.exe
  2⤵
  PID:13800
- C:\Windows\System\khhjIEi.exe
  C:\Windows\System\khhjIEi.exe
  2⤵
  PID:13824
- C:\Windows\System\UvrhQot.exe
  C:\Windows\System\UvrhQot.exe
  2⤵
  PID:13848
- C:\Windows\System\sAPTUFo.exe
  C:\Windows\System\sAPTUFo.exe
  2⤵
  PID:13880
- C:\Windows\System\lGTGddX.exe
  C:\Windows\System\lGTGddX.exe
  2⤵
  PID:13900
- C:\Windows\System\SVblgUa.exe
  C:\Windows\System\SVblgUa.exe
  2⤵
  PID:13928
- C:\Windows\System\ywBKXxs.exe
  C:\Windows\System\ywBKXxs.exe
  2⤵
  PID:13948
- C:\Windows\System\sNJfzPT.exe
  C:\Windows\System\sNJfzPT.exe
  2⤵
  PID:13976
- C:\Windows\System\YBPMfDp.exe
  C:\Windows\System\YBPMfDp.exe
  2⤵
  PID:14000
- C:\Windows\System\JPGbcdn.exe
  C:\Windows\System\JPGbcdn.exe
  2⤵
  PID:14020
- C:\Windows\System\lUGaHeH.exe
  C:\Windows\System\lUGaHeH.exe
  2⤵
  PID:14052
- C:\Windows\System\IHXqmHC.exe
  C:\Windows\System\IHXqmHC.exe
  2⤵
  PID:14076
- C:\Windows\System\XLSRdPy.exe
  C:\Windows\System\XLSRdPy.exe
  2⤵
  PID:14100
- C:\Windows\System\rfXsDVK.exe
  C:\Windows\System\rfXsDVK.exe
  2⤵
  PID:14132
- C:\Windows\System\LYfwrTj.exe
  C:\Windows\System\LYfwrTj.exe
  2⤵
  PID:14156
- C:\Windows\System\bNsKpLH.exe
  C:\Windows\System\bNsKpLH.exe
  2⤵
  PID:14180
- C:\Windows\System\QycrWCR.exe
  C:\Windows\System\QycrWCR.exe
  2⤵
  PID:14212
- C:\Windows\System\NicxTZg.exe
  C:\Windows\System\NicxTZg.exe
  2⤵
  PID:14248
- C:\Windows\System\DWakrJe.exe
  C:\Windows\System\DWakrJe.exe
  2⤵
  PID:14264
- C:\Windows\System\mtRjJDD.exe
  C:\Windows\System\mtRjJDD.exe
  2⤵
  PID:14304
- C:\Windows\System\XtYhuxY.exe
  C:\Windows\System\XtYhuxY.exe
  2⤵
  PID:14324
- C:\Windows\System\pGDiCzX.exe
  C:\Windows\System\pGDiCzX.exe
  2⤵
  PID:12396
- C:\Windows\System\PfkEGIS.exe
  C:\Windows\System\PfkEGIS.exe
  2⤵
  PID:13072
- C:\Windows\System\YmMxZMM.exe
  C:\Windows\System\YmMxZMM.exe
  2⤵
  PID:11724
- C:\Windows\System\uhHDtuf.exe
  C:\Windows\System\uhHDtuf.exe
  2⤵
  PID:12772
- C:\Windows\System\dpUXoqQ.exe
  C:\Windows\System\dpUXoqQ.exe
  2⤵
  PID:13280
- C:\Windows\System\EKAcbWO.exe
  C:\Windows\System\EKAcbWO.exe
  2⤵
  PID:10816
- C:\Windows\System\LwjFMQn.exe
  C:\Windows\System\LwjFMQn.exe
  2⤵
  PID:13328
- C:\Windows\System\tmkqGEV.exe
  C:\Windows\System\tmkqGEV.exe
  2⤵
  PID:11208
- C:\Windows\System\ZOGxJXN.exe
  C:\Windows\System\ZOGxJXN.exe
  2⤵
  PID:12000
- C:\Windows\System\REAaUsz.exe
  C:\Windows\System\REAaUsz.exe
  2⤵
  PID:12624
- C:\Windows\System\icPjsjo.exe
  C:\Windows\System\icPjsjo.exe
  2⤵
  PID:13520
- C:\Windows\System\bvnIEuH.exe
  C:\Windows\System\bvnIEuH.exe
  2⤵
  PID:13576
- C:\Windows\System\pmXEesI.exe
  C:\Windows\System\pmXEesI.exe
  2⤵
  PID:13620
- C:\Windows\System\RRzFmhe.exe
  C:\Windows\System\RRzFmhe.exe
  2⤵
  PID:12544
- C:\Windows\System\kyiQVCB.exe
  C:\Windows\System\kyiQVCB.exe
  2⤵
  PID:13744
- C:\Windows\System\IgLRUEw.exe
  C:\Windows\System\IgLRUEw.exe
  2⤵
  PID:13836
- C:\Windows\System\RjcTALB.exe
  C:\Windows\System\RjcTALB.exe
  2⤵
  PID:13888
- C:\Windows\System\PebSoEl.exe
  C:\Windows\System\PebSoEl.exe
  2⤵
  PID:13968
- C:\Windows\System\Vrnhwnd.exe
  C:\Windows\System\Vrnhwnd.exe
  2⤵
  PID:12776
- C:\Windows\System\JvmGHsD.exe
  C:\Windows\System\JvmGHsD.exe
  2⤵
  PID:13644
- C:\Windows\System\ivFbbBv.exe
  C:\Windows\System\ivFbbBv.exe
  2⤵
  PID:13700
- C:\Windows\System\AlnDPkB.exe
  C:\Windows\System\AlnDPkB.exe
  2⤵
  PID:13344
- C:\Windows\System\jNQwxID.exe
  C:\Windows\System\jNQwxID.exe
  2⤵
  PID:14332
- C:\Windows\System\keczSol.exe
  C:\Windows\System\keczSol.exe
  2⤵
  PID:14364
- C:\Windows\System\LWKRqUK.exe
  C:\Windows\System\LWKRqUK.exe
  2⤵
  PID:14392
- C:\Windows\System\UqaJZon.exe
  C:\Windows\System\UqaJZon.exe
  2⤵
  PID:14412
- C:\Windows\System\mGeqmoH.exe
  C:\Windows\System\mGeqmoH.exe
  2⤵
  PID:14436
- C:\Windows\System\rdKvtoO.exe
  C:\Windows\System\rdKvtoO.exe
  2⤵
  PID:14456
- C:\Windows\System\MbtbrXy.exe
  C:\Windows\System\MbtbrXy.exe
  2⤵
  PID:14488
- C:\Windows\System\ZZrbWCS.exe
  C:\Windows\System\ZZrbWCS.exe
  2⤵
  PID:14504
- C:\Windows\System\DXdiTSR.exe
  C:\Windows\System\DXdiTSR.exe
  2⤵
  PID:14532
- C:\Windows\System\SrRFIHD.exe
  C:\Windows\System\SrRFIHD.exe
  2⤵
  PID:14552
- C:\Windows\System\RYcuKIU.exe
  C:\Windows\System\RYcuKIU.exe
  2⤵
  PID:14584
- C:\Windows\System\XwNFdgx.exe
  C:\Windows\System\XwNFdgx.exe
  2⤵
  PID:14608
- C:\Windows\System\nDsXCZb.exe
  C:\Windows\System\nDsXCZb.exe
  2⤵
  PID:14632
- C:\Windows\System\axQufwL.exe
  C:\Windows\System\axQufwL.exe
  2⤵
  PID:14656
- C:\Windows\System\TidEDpI.exe
  C:\Windows\System\TidEDpI.exe
  2⤵
  PID:14680
- C:\Windows\System\BVAnIkU.exe
  C:\Windows\System\BVAnIkU.exe
  2⤵
  PID:14712
- C:\Windows\System\uSLJJmY.exe
  C:\Windows\System\uSLJJmY.exe
  2⤵
  PID:14740
- C:\Windows\System\vbLCjdj.exe
  C:\Windows\System\vbLCjdj.exe
  2⤵
  PID:14764
- C:\Windows\System\znmHJrD.exe
  C:\Windows\System\znmHJrD.exe
  2⤵
  PID:14788
- C:\Windows\System\dSRfMoR.exe
  C:\Windows\System\dSRfMoR.exe
  2⤵
  PID:14820
- C:\Windows\System\JuIHmOP.exe
  C:\Windows\System\JuIHmOP.exe
  2⤵
  PID:14840
- C:\Windows\System\imiimJl.exe
  C:\Windows\System\imiimJl.exe
  2⤵
  PID:14872
- C:\Windows\System\EUQImlU.exe
  C:\Windows\System\EUQImlU.exe
  2⤵
  PID:14892
- C:\Windows\System\DxqyIOD.exe
  C:\Windows\System\DxqyIOD.exe
  2⤵
  PID:14920
- C:\Windows\System\RjKUPhb.exe
  C:\Windows\System\RjKUPhb.exe
  2⤵
  PID:14956
- C:\Windows\System\AreOmwD.exe
  C:\Windows\System\AreOmwD.exe
  2⤵
  PID:14984
- C:\Windows\System\PWDDnzt.exe
  C:\Windows\System\PWDDnzt.exe
  2⤵
  PID:15008
- C:\Windows\System\xBNkwMi.exe
  C:\Windows\System\xBNkwMi.exe
  2⤵
  PID:15028
- C:\Windows\System\khFqBxe.exe
  C:\Windows\System\khFqBxe.exe
  2⤵
  PID:15056
- C:\Windows\System\cLpUHcA.exe
  C:\Windows\System\cLpUHcA.exe
  2⤵
  PID:15084
- C:\Windows\System\KlRqnYb.exe
  C:\Windows\System\KlRqnYb.exe
  2⤵
  PID:15104
- C:\Windows\System\ddCrFpH.exe
  C:\Windows\System\ddCrFpH.exe
  2⤵
  PID:15132
- C:\Windows\System\rGNYfqS.exe
  C:\Windows\System\rGNYfqS.exe
  2⤵
  PID:15152
- C:\Windows\System\EuquAnT.exe
  C:\Windows\System\EuquAnT.exe
  2⤵
  PID:15176
- C:\Windows\System\naQhwVL.exe
  C:\Windows\System\naQhwVL.exe
  2⤵
  PID:15200
- C:\Windows\System\pMTAibv.exe
  C:\Windows\System\pMTAibv.exe
  2⤵
  PID:15224
- C:\Windows\System\SXAfHtp.exe
  C:\Windows\System\SXAfHtp.exe
  2⤵
  PID:15256
- C:\Windows\System\rERQENN.exe
  C:\Windows\System\rERQENN.exe
  2⤵
  PID:15276
- C:\Windows\System\EfNBCkK.exe
  C:\Windows\System\EfNBCkK.exe
  2⤵
  PID:15300
- C:\Windows\System\ZuBglKB.exe
  C:\Windows\System\ZuBglKB.exe
  2⤵
  PID:15336
- C:\Windows\System\IWLDgmb.exe
  C:\Windows\System\IWLDgmb.exe
  2⤵
  PID:11360
- C:\Windows\System\JrHkUSG.exe
  C:\Windows\System\JrHkUSG.exe
  2⤵
  PID:13892
- C:\Windows\System\XFOiTAn.exe
  C:\Windows\System\XFOiTAn.exe
  2⤵
  PID:13124
- C:\Windows\System\qpmPJcc.exe
  C:\Windows\System\qpmPJcc.exe
  2⤵
  PID:14072
- C:\Windows\System\KezWSiC.exe
  C:\Windows\System\KezWSiC.exe
  2⤵
  PID:13648
- C:\Windows\System\YOaeymk.exe
  C:\Windows\System\YOaeymk.exe
  2⤵
  PID:14244
- C:\Windows\System\GPqSSAB.exe
  C:\Windows\System\GPqSSAB.exe
  2⤵
  PID:14016
- C:\Windows\System\HjcfFHt.exe
  C:\Windows\System\HjcfFHt.exe
  2⤵
  PID:13024
- C:\Windows\System\DTrBPkg.exe
  C:\Windows\System\DTrBPkg.exe
  2⤵
  PID:13956
- C:\Windows\System\JTJvKOT.exe
  C:\Windows\System\JTJvKOT.exe
  2⤵
  PID:12196
- C:\Windows\System\vISBiOQ.exe
  C:\Windows\System\vISBiOQ.exe
  2⤵
  PID:13444
- C:\Windows\System\msGoNUi.exe
  C:\Windows\System\msGoNUi.exe
  2⤵
  PID:14664
- C:\Windows\System\YqGAFwa.exe
  C:\Windows\System\YqGAFwa.exe
  2⤵
  PID:14148
- C:\Windows\System\tBSePdP.exe
  C:\Windows\System\tBSePdP.exe
  2⤵
  PID:13844
- C:\Windows\System\RbTKSjA.exe
  C:\Windows\System\RbTKSjA.exe
  2⤵
  PID:14224
- C:\Windows\System\FFqawPC.exe
  C:\Windows\System\FFqawPC.exe
  2⤵
  PID:12820
- C:\Windows\System\oqRRpsc.exe
  C:\Windows\System\oqRRpsc.exe
  2⤵
  PID:12728
- C:\Windows\System\uJkUIdn.exe
  C:\Windows\System\uJkUIdn.exe
  2⤵
  PID:14408
- C:\Windows\System\GGIlvMV.exe
  C:\Windows\System\GGIlvMV.exe
  2⤵
  PID:11632
- C:\Windows\System\DDeNrvG.exe
  C:\Windows\System\DDeNrvG.exe
  2⤵
  PID:11656
- C:\Windows\System\CNTByMq.exe
  C:\Windows\System\CNTByMq.exe
  2⤵
  PID:13436
- C:\Windows\System\XALgLFB.exe
  C:\Windows\System\XALgLFB.exe
  2⤵
  PID:14696
- C:\Windows\System\JCPcIhj.exe
  C:\Windows\System\JCPcIhj.exe
  2⤵
  PID:15508
- C:\Windows\System\nKtzcgN.exe
  C:\Windows\System\nKtzcgN.exe
  2⤵
  PID:15576
- C:\Windows\System\AAtYcWy.exe
  C:\Windows\System\AAtYcWy.exe
  2⤵
  PID:15616
- C:\Windows\System\eboEGfc.exe
  C:\Windows\System\eboEGfc.exe
  2⤵
  PID:15656
- C:\Windows\System\JRIopMu.exe
  C:\Windows\System\JRIopMu.exe
  2⤵
  PID:15704
- C:\Windows\System\aznhZHD.exe
  C:\Windows\System\aznhZHD.exe
  2⤵
  PID:15736
- C:\Windows\System\LtuForV.exe
  C:\Windows\System\LtuForV.exe
  2⤵
  PID:15768
- C:\Windows\System\dBwcQxS.exe
  C:\Windows\System\dBwcQxS.exe
  2⤵
  PID:15796
- C:\Windows\System\cDvwYdP.exe
  C:\Windows\System\cDvwYdP.exe
  2⤵
  PID:15828
- C:\Windows\System\MoUzNjW.exe
  C:\Windows\System\MoUzNjW.exe
  2⤵
  PID:15860
- C:\Windows\System\VZTHazG.exe
  C:\Windows\System\VZTHazG.exe
  2⤵
  PID:15888
- C:\Windows\System\iJHyWRt.exe
  C:\Windows\System\iJHyWRt.exe
  2⤵
  PID:15928
- C:\Windows\System\LFnykrF.exe
  C:\Windows\System\LFnykrF.exe
  2⤵
  PID:15964
- C:\Windows\System\bKxyPZD.exe
  C:\Windows\System\bKxyPZD.exe
  2⤵
  PID:16004
- C:\Windows\System\hxcNsym.exe
  C:\Windows\System\hxcNsym.exe
  2⤵
  PID:16040
- C:\Windows\System\xKQMWgM.exe
  C:\Windows\System\xKQMWgM.exe
  2⤵
  PID:16068
- C:\Windows\System\bQqyEQF.exe
  C:\Windows\System\bQqyEQF.exe
  2⤵
  PID:16112
- C:\Windows\System\nWrxNqg.exe
  C:\Windows\System\nWrxNqg.exe
  2⤵
  PID:16128
- C:\Windows\System\uBtazyL.exe
  C:\Windows\System\uBtazyL.exe
  2⤵
  PID:16188
- C:\Windows\System\QnRjlHz.exe
  C:\Windows\System\QnRjlHz.exe
  2⤵
  PID:16208
- C:\Windows\System\flQhEyJ.exe
  C:\Windows\System\flQhEyJ.exe
  2⤵
  PID:16228
- C:\Windows\System\lzvMRTx.exe
  C:\Windows\System\lzvMRTx.exe
  2⤵
  PID:16248
- C:\Windows\System\fMCLqRt.exe
  C:\Windows\System\fMCLqRt.exe
  2⤵
  PID:16264
- C:\Windows\System\bJJYDqt.exe
  C:\Windows\System\bJJYDqt.exe
  2⤵
  PID:16284
- C:\Windows\System\McGuaIv.exe
  C:\Windows\System\McGuaIv.exe
  2⤵
  PID:16300
- C:\Windows\System\nMCXHnZ.exe
  C:\Windows\System\nMCXHnZ.exe
  2⤵
  PID:16324
- C:\Windows\System\JIAubKM.exe
  C:\Windows\System\JIAubKM.exe
  2⤵
  PID:16340
- C:\Windows\System\doqPWyS.exe
  C:\Windows\System\doqPWyS.exe
  2⤵
  PID:16360
- C:\Windows\System\UOHgqSC.exe
  C:\Windows\System\UOHgqSC.exe
  2⤵
  PID:16376
- C:\Windows\System\vBqUeFG.exe
  C:\Windows\System\vBqUeFG.exe
  2⤵
  PID:13476
- C:\Windows\System\iuevdBt.exe
  C:\Windows\System\iuevdBt.exe
  2⤵
  PID:13916
- C:\Windows\System\XMHMBpc.exe
  C:\Windows\System\XMHMBpc.exe
  2⤵
  PID:13388
- C:\Windows\System\cxXKERv.exe
  C:\Windows\System\cxXKERv.exe
  2⤵
  PID:15684
- C:\Windows\System\bmzGdef.exe
  C:\Windows\System\bmzGdef.exe
  2⤵
  PID:15712
- C:\Windows\System\CTcyttM.exe
  C:\Windows\System\CTcyttM.exe
  2⤵
  PID:15804
- C:\Windows\System\WezstRZ.exe
  C:\Windows\System\WezstRZ.exe
  2⤵
  PID:15824
- C:\Windows\System\zNEqetG.exe
  C:\Windows\System\zNEqetG.exe
  2⤵
  PID:15996
- C:\Windows\System\aDkQDYw.exe
  C:\Windows\System\aDkQDYw.exe
  2⤵
  PID:12080
- C:\Windows\System\ZuHZByC.exe
  C:\Windows\System\ZuHZByC.exe
  2⤵
  PID:16048
- C:\Windows\System\lNAwgcn.exe
  C:\Windows\System\lNAwgcn.exe
  2⤵
  PID:16080
- C:\Windows\System\IhjDdqN.exe
  C:\Windows\System\IhjDdqN.exe
  2⤵
  PID:15532
- C:\Windows\System\VbnNOpn.exe
  C:\Windows\System\VbnNOpn.exe
  2⤵
  PID:15608
- C:\Windows\System\lpNzLRO.exe
  C:\Windows\System\lpNzLRO.exe
  2⤵
  PID:15632
- C:\Windows\System\DyQghWw.exe
  C:\Windows\System\DyQghWw.exe
  2⤵
  PID:15680
- C:\Windows\System\kXZXGhS.exe
  C:\Windows\System\kXZXGhS.exe
  2⤵
  PID:16272
- C:\Windows\System\wKtqamJ.exe
  C:\Windows\System\wKtqamJ.exe
  2⤵
  PID:15784
- C:\Windows\System\NnwMibv.exe
  C:\Windows\System\NnwMibv.exe
  2⤵
  PID:15960
- C:\Windows\System\BVMCUGL.exe
  C:\Windows\System\BVMCUGL.exe
  2⤵
  PID:13996
- C:\Windows\System\xVyUWtj.exe
  C:\Windows\System\xVyUWtj.exe
  2⤵
  PID:16392
- C:\Windows\System\EiJwqao.exe
  C:\Windows\System\EiJwqao.exe
  2⤵
  PID:16436
- C:\Windows\System\ZyUxjsa.exe
  C:\Windows\System\ZyUxjsa.exe
  2⤵
  PID:16456
- C:\Windows\System\Pxskajk.exe
  C:\Windows\System\Pxskajk.exe
  2⤵
  PID:16488
- C:\Windows\System\FlPisBW.exe
  C:\Windows\System\FlPisBW.exe
  2⤵
  PID:16512
- C:\Windows\System\KSggiZH.exe
  C:\Windows\System\KSggiZH.exe
  2⤵
  PID:16532
- C:\Windows\System\gUTqitZ.exe
  C:\Windows\System\gUTqitZ.exe
  2⤵
  PID:16560
- C:\Windows\System\yWRnQds.exe
  C:\Windows\System\yWRnQds.exe
  2⤵
  PID:16584
- C:\Windows\System\SdxREqt.exe
  C:\Windows\System\SdxREqt.exe
  2⤵
  PID:16608
- C:\Windows\System\teslRrS.exe
  C:\Windows\System\teslRrS.exe
  2⤵
  PID:16636
- C:\Windows\System\gxEmerq.exe
  C:\Windows\System\gxEmerq.exe
  2⤵
  PID:16660
- C:\Windows\System\pPwgQUn.exe
  C:\Windows\System\pPwgQUn.exe
  2⤵
  PID:16680
- C:\Windows\System\OrAyzFg.exe
  C:\Windows\System\OrAyzFg.exe
  2⤵
  PID:16704
- C:\Windows\System\TWdvcsJ.exe
  C:\Windows\System\TWdvcsJ.exe
  2⤵
  PID:16732
- C:\Windows\System\kgWrkvI.exe
  C:\Windows\System\kgWrkvI.exe
  2⤵
  PID:16756
- C:\Windows\System\YMfeLvZ.exe
  C:\Windows\System\YMfeLvZ.exe
  2⤵
  PID:16776
- C:\Windows\System\GdgYlnc.exe
  C:\Windows\System\GdgYlnc.exe
  2⤵
  PID:16804
- C:\Windows\System\XwuNorO.exe
  C:\Windows\System\XwuNorO.exe
  2⤵
  PID:16828
- C:\Windows\System\ElJXZWf.exe
  C:\Windows\System\ElJXZWf.exe
  2⤵
  PID:16864
- C:\Windows\System\ctTLlRc.exe
  C:\Windows\System\ctTLlRc.exe
  2⤵
  PID:16892
- C:\Windows\System\WiXOKQb.exe
  C:\Windows\System\WiXOKQb.exe
  2⤵
  PID:16920
- C:\Windows\System\XLwNeKy.exe
  C:\Windows\System\XLwNeKy.exe
  2⤵
  PID:16948
- C:\Windows\System\dYzSaxG.exe
  C:\Windows\System\dYzSaxG.exe
  2⤵
  PID:16984
- C:\Windows\System\qXjgorV.exe
  C:\Windows\System\qXjgorV.exe
  2⤵
  PID:17012
- C:\Windows\System\ECmOsSc.exe
  C:\Windows\System\ECmOsSc.exe
  2⤵
  PID:17036
- C:\Windows\System\knjNQlW.exe
  C:\Windows\System\knjNQlW.exe
  2⤵
  PID:17060
- C:\Windows\System\JKxuOEK.exe
  C:\Windows\System\JKxuOEK.exe
  2⤵
  PID:17076
- C:\Windows\System\rwzJqxv.exe
  C:\Windows\System\rwzJqxv.exe
  2⤵
  PID:17100
- C:\Windows\System\wHyLcXp.exe
  C:\Windows\System\wHyLcXp.exe
  2⤵
  PID:17124
- C:\Windows\System\HRuHOrH.exe
  C:\Windows\System\HRuHOrH.exe
  2⤵
  PID:17156
- C:\Windows\System\JMeQWap.exe
  C:\Windows\System\JMeQWap.exe
  2⤵
  PID:17184
- C:\Windows\System\oUxtnFC.exe
  C:\Windows\System\oUxtnFC.exe
  2⤵
  PID:17212
- C:\Windows\System\AvpOQqv.exe
  C:\Windows\System\AvpOQqv.exe
  2⤵
  PID:17228
- C:\Windows\System\CJANiCj.exe
  C:\Windows\System\CJANiCj.exe
  2⤵
  PID:15720
- C:\Windows\System\mawoqHh.exe
  C:\Windows\System\mawoqHh.exe
  2⤵
  PID:16032
- C:\Windows\System\mnJaxzT.exe
  C:\Windows\System\mnJaxzT.exe
  2⤵
  PID:16276
- C:\Windows\System\KtuMVRa.exe
  C:\Windows\System\KtuMVRa.exe
  2⤵
  PID:15884
- C:\Windows\System\FXtdEOP.exe
  C:\Windows\System\FXtdEOP.exe
  2⤵
  PID:15908
- C:\Windows\System\ZSOYCTA.exe
  C:\Windows\System\ZSOYCTA.exe
  2⤵
  PID:15924
- C:\Windows\System\czIFIMk.exe
  C:\Windows\System\czIFIMk.exe
  2⤵
  PID:16292
- C:\Windows\System\aQhSaFC.exe
  C:\Windows\System\aQhSaFC.exe
  2⤵
  PID:16028
- C:\Windows\System\QnsbSCM.exe
  C:\Windows\System\QnsbSCM.exe
  2⤵
  PID:14092
- C:\Windows\System\AFnOhgb.exe
  C:\Windows\System\AFnOhgb.exe
  2⤵
  PID:15700
- C:\Windows\System\eqdaWqZ.exe
  C:\Windows\System\eqdaWqZ.exe
  2⤵
  PID:15692
- C:\Windows\System\UdvhyuK.exe
  C:\Windows\System\UdvhyuK.exe
  2⤵
  PID:15640
- C:\Windows\System\cUGdRlB.exe
  C:\Windows\System\cUGdRlB.exe
  2⤵
  PID:13604
- C:\Windows\System\RXWClDV.exe
  C:\Windows\System\RXWClDV.exe
  2⤵
  PID:16784
- C:\Windows\System\hrKbQTv.exe
  C:\Windows\System\hrKbQTv.exe
  2⤵
  PID:17028
- C:\Windows\System\TIKFloE.exe
  C:\Windows\System\TIKFloE.exe
  2⤵
  PID:17220
- C:\Windows\System\qMajMeA.exe
  C:\Windows\System\qMajMeA.exe
  2⤵
  PID:16768
- C:\Windows\System\RgvfFVj.exe
  C:\Windows\System\RgvfFVj.exe
  2⤵
  PID:16420
- C:\Windows\System\aPEtYos.exe
  C:\Windows\System\aPEtYos.exe
  2⤵
  PID:15916
- C:\Windows\System\stryyfB.exe
  C:\Windows\System\stryyfB.exe
  2⤵
  PID:15984
- C:\Windows\System\AnhPbiR.exe
  C:\Windows\System\AnhPbiR.exe
  2⤵
  PID:15816
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 15816 -s 248
    3⤵
    PID:17348
- C:\Windows\System\tBILOrj.exe
  C:\Windows\System\tBILOrj.exe
  2⤵
  PID:15676
- C:\Windows\System\TPwcNAZ.exe
  C:\Windows\System\TPwcNAZ.exe
  2⤵
  PID:16752
- C:\Windows\System\KcxXiQX.exe
  C:\Windows\System\KcxXiQX.exe
  2⤵
  PID:16888
- C:\Windows\System\lrsKdwU.exe
  C:\Windows\System\lrsKdwU.exe
  2⤵
  PID:17136
- C:\Windows\System\ICzKYWR.exe
  C:\Windows\System\ICzKYWR.exe
  2⤵
  PID:16856
- C:\Windows\System\GsQdlLs.exe
  C:\Windows\System\GsQdlLs.exe
  2⤵
  PID:16928
- C:\Windows\System\GcNMjGs.exe
  C:\Windows\System\GcNMjGs.exe
  2⤵
  PID:16880
- C:\Windows\System\oPjquHm.exe
  C:\Windows\System\oPjquHm.exe
  2⤵
  PID:16720
- C:\Windows\System\sBuHFqQ.exe
  C:\Windows\System\sBuHFqQ.exe
  2⤵
  PID:16668

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AdxwqUM.exe

Filesize
1.3MB

MD5
c3a27fb078cb9f1dc0b897bf7d526935

SHA1
56b66d4e69ece81aee08c73e3ed027defe356b95

SHA256
27f6785501b87e1adf1d5b5b1d296f7c5f1b3674a7c7790f56ef5432eb5d1ebb

SHA512
a3c544fa54f14447bcfe0ade710686f35d426e3fe149a6e09a2d6174005b0c811ad61cc10496c004631f8aaf24edd37f7844071f637842f5cfb56785ce5b3e5a

Download Submit
C:\Windows\System\AonQqLI.exe

Filesize
1.3MB

MD5
66a24bd2d2ab59c1c736f2320b5f74e0

SHA1
04da4f9e08241e12fe19c4b651656264290611b3

SHA256
efb2a7fa7d311839c679adff9a39d63cf5776b3559152fec5b70c76d6a712899

SHA512
32d1872e6834f620fe7de5cb3ca40635d47f8264eb13e9e5265c137e3356de6c54e062e4fce109111f70db310f10f918be1b910359c7c5ff075834bcb0524bd9

Download Submit
C:\Windows\System\CEbvzaU.exe

Filesize
1.3MB

MD5
b82b71aa903a9aca206d8f689abc492b

SHA1
c2438bdab338371737fc6ad2003ee9090f3bb181

SHA256
e9decc8df7016cc0dd83b296b3792990f65e0d405c02b09a45fba4672cf3bbf7

SHA512
6a66ca4fe579c685d4fd7bb1bf5b528ead188fad1656144318126432575e095f6ff15521aed5ec5acc6cd4daa4cae3df43ec9439c2e1336dd5c23d7c67147da0

Download Submit
C:\Windows\System\CYYQyHe.exe

Filesize
1.3MB

MD5
e08aab8a3f95b5d1819f4946438fb22f

SHA1
d7320c1e3ebaf9d050471b3cf7fb199408bb5d46

SHA256
70f8a755387b4be220608d27e13bd8ecdf7502a8a3faee9f5b7f0e69e05c680e

SHA512
de4d5dc350df2d06536d79a9c5d5ae44ce4a2771a575c0a29287a47c41b2ea6fabbfeae6a7b48413c9d5e2715998bd54ec7cacd4c55de9b8be9b0ba0eb0e4726

Download Submit
C:\Windows\System\DQCqrLK.exe

Filesize
1.3MB

MD5
fe12fa5a4869cc60857169bccbf7b485

SHA1
f1fd89ad6d44485cefcd540e6de222794106e8d5

SHA256
552fa111466e8e8311f076685707d08bff209443c08f328d6dd01e5faa9b6e1c

SHA512
55b5e205a4dcbbe7385e205d95b1fb7ef3899405e645a85a646a3270453791b01430347ff002e77faf3c823efbede780424821820772765e398f3a3fcd33cabc

Download Submit
C:\Windows\System\ElooTCn.exe

Filesize
1.3MB

MD5
6361e844ef1dc423c5b30b00addc34cf

SHA1
031877b181060c28c2ffc411056df16a24a388e0

SHA256
e7509c0b333a079440678cf53b274eef5132ba0cfa77af7655c7dd0eeabe98e8

SHA512
6afc39eef3411b210d5a2cca2bf5071961c403f701b4cb6f179cc65826bc7bfe578094577f4ecf8bacc742aeb917831913827b7861c6e092bce8cdec4ae5435a

Download Submit
C:\Windows\System\FTTziDe.exe

Filesize
1.3MB

MD5
3814b480044a67e03bc26aa47c896e54

SHA1
57edc15610b17ae98f8463ca778a20088029cc62

SHA256
e1776331cb69e67dd326100313fc2e10b8e1b0acab4c3550aaec04e23701f1f2

SHA512
a55f3c2d65fca62d1fdc7966495877ab933d2e42565db7e43c007529411a0251a5db5db30d20acc8b81a44fd3f877d865f629503af38409017c3614f05c1c7d1

Download Submit
C:\Windows\System\KGMyYUF.exe

Filesize
1.3MB

MD5
4d3a89e63a085724e6153bb10b7a6896

SHA1
baa9ee9eec5595ca821056967c2162f09be1e9b1

SHA256
7bd0c296b14fdf409820f2cafbe89872e33b1318107bc0f99c0fd66b17b5a20b

SHA512
b85ea5d219b658278f9079d3946991ba6db6c1c9d065d57383eaac252f8d2a6250c484e88a1c6b50f0f0732799d104ff45afe9fe43ca9ba70c74e86bfdb60941

Download Submit
C:\Windows\System\KMixnKk.exe

Filesize
1.3MB

MD5
78332ddb2aba404f4904ac73fbb7a074

SHA1
7c326996f561701cab7d2f2c29800b3c70727022

SHA256
e5111ee8ceb0717bcdfce38788662c0df5969a741e429402398fb5d4c09e5bd4

SHA512
4b3c0867e69060d75fa2726accefb2cdf480f396060c183ccbe6d6af594a5979566cb5803e7685df078e3df21d5a28947eb793854fb04aefe8fd917c57865239

Download Submit
C:\Windows\System\LcmFHtO.exe

Filesize
1.3MB

MD5
54e296f97246a62eb880a6f6ff8be098

SHA1
ab3d991157dd15eddad896a2f2e662fe8a257611

SHA256
52e6f5682db8d174e9bbf6f2bd9c70197cdffa930b99119b8a588025a79e3ec9

SHA512
66393a214c724bfcd5ba9d4be8dff50ece16d8d14347055de0047d87be80e810789695d7426983629e7d524f3bd41cf700b7fa4e4e792444cf1bd79fbe8ab2fb

Download Submit
C:\Windows\System\MacJfnH.exe

Filesize
1.3MB

MD5
3592fa660409c00dff109cb1ed5bf797

SHA1
597700a51064fd1da4a69d25843b82d0195ca3c6

SHA256
3ecf006f5e3e8f30f436eacb478a4914174ecdae3702720b11b1099816e13138

SHA512
b9d7bc45c86bbcd2bcf076e135d44f1b9a99540c5fa93d4c1992a215bd573fa9155249badcf512c1af063bd50a24bf838631dde775a826da3aa9963d82fc5b86

Download Submit
C:\Windows\System\QQXcdRK.exe

Filesize
1.3MB

MD5
216243ed2f29400e9290ba36b9fe91c0

SHA1
d0f3128bfae200f06aa3d1a7c4c7afafda4cf3e8

SHA256
6d234e9d5866d87b33f290add7858f1ee7e70cb852b0e304bbb01f10d562e446

SHA512
ab6482e58cc797885df3cf9606d1fcca6053340e88bb9dd89bef01f907cd0e5e903a468545178c58836f4a3565da28d42a7602df8a46a025cc61f05bfe415ab8

Download Submit
C:\Windows\System\UmDpGIs.exe

Filesize
1.3MB

MD5
04fb9e3c8437a5a1405cd8c39e2e1953

SHA1
3489424507289577c9c58cd62b026f2812017437

SHA256
6990a7593d4429a3cd883cd99d3f1de5e9c30bc30c0111ccde89c48b52ee0669

SHA512
4ff1560ff31fbd8faecd80ca0f04f58c9bff935ac759d378e819bec0413883438c35bb4b45142ed25783c1e22f52e1525d470b29996b8633e13ff12992e5cace

Download Submit
C:\Windows\System\VABxcrY.exe

Filesize
1.3MB

MD5
fe9ae9ccbb56c19f33e96dcf043dffd4

SHA1
908a29f1d7e265c078b56b60588726087151b1ee

SHA256
0c87a2f4e192c5b1c8312e552dd6da587bc65a0c69a3b8990583d782be89a850

SHA512
2ab0c6b707fd8abfb98de2fd4e32f962b51b00ff073cc1397bd9bfb68dcfd9e1d376f6698626411f686b2e5fce20aa532307dccd85db50a295c92ed6e501be3c

Download Submit
C:\Windows\System\VFIqDjI.exe

Filesize
1.3MB

MD5
bad5d743bbbf6a63555cc11e14a9f534

SHA1
364b9f6fae272909c947d1da97de0cc287f8ebb8

SHA256
088539444614bf1157e263c1293a7a184c129b915d9cec93888d491efae69ec2

SHA512
fc9bbaae463cf9d6f86550c4812ca4b2e94864d904f87bda854b7e847fae3bcdf12000f999d86334cd3a4a36af5ca85489fbfd0fa74c37c67ef018d76e9676c1

Download Submit
C:\Windows\System\VfnlzCK.exe

Filesize
1.3MB

MD5
139b3aa71e817e4463d6964b553eba4f

SHA1
50de4b1e3c77165f72217d8ec116ba71d6f1e4ad

SHA256
e84f882550aaf2f2c7704cedca248fc1c8830ce37c1df06907e9bfe035d96ba9

SHA512
657fae64cf9241ea889314f1515f6884cd2de804928d0a9bc37e3b025ee593e8dd68982485f67b36ab99cfc94a7721b588b5aed1ca8f4d666599e0bc5c0ca5ae

Download Submit
C:\Windows\System\VqbjCiy.exe

Filesize
1.3MB

MD5
592f41a5c12750ae58d87c5710056b38

SHA1
8ebdeee20f1657fb2ab03c1e0109882fae7fd0c1

SHA256
61162f034602a3d6a49dcbc9c8f0cc98b6d8a8d063cc498f6329c511021398ba

SHA512
5ddaab35a4614aa193660323524396ea1e8eb0774ab429b573348c247470496462cc9ed1c46eaf4acc40d99b7edbd31a72e8b465722857c6cbc7cfe8e1e19bfc

Download Submit
C:\Windows\System\WXKBbDC.exe

Filesize
1.3MB

MD5
133869114fe322c9cfd243c42065b113

SHA1
e599839eda8bb342a12330445c761a258fee75de

SHA256
5ef8ea41d342016c4f71e31330be610727853bebabda8c196b81ca263700ddb0

SHA512
0b254b959e3e4a623e0a5f57da4657759b25036f4d220e8d352f19e0b38af49a977cde37d0dfeb707a236856909e9d397e837e07d1db5394a23ccdccbd530edf

Download Submit
C:\Windows\System\WXUJSro.exe

Filesize
1.3MB

MD5
37459b49a6592fa5c3de7a123982da79

SHA1
e45633c5c05190c68045f6e7f76e8f2011eabe12

SHA256
73aae41a92bd8b6826b2dd7d72aeaad50fcc920112734e53f69cd6ce1a63e56e

SHA512
271a14a6b06f00ac55c283ebc811799e7eb54c5fb4e766e2b219307569c49ab8a0baed238956485a30669a7fbadd5d1292713cfe520b178382fe259ef4bd3b9f

Download Submit
C:\Windows\System\alboRUY.exe

Filesize
1.3MB

MD5
d452228f9e5180fa75c631f20ee3604f

SHA1
09dea2ddf644791c8c00b7928e66229d51fc0a49

SHA256
e8e7c8d9cf4c96aa7877ba310bfa3346a573bf282a9918fbf1aad5056e47a637

SHA512
cce1d756a5f95ebf8cf40b046f6d483f785637a2d60c84229598975da5bccab892d0c647f41b123f511603602b7c0df342ca5dda67db0eb88cc4be0fc0ae137e

Download Submit
C:\Windows\System\dyAmgmS.exe

Filesize
1.3MB

MD5
562ed61b99c4b75dc438c1a7ffc5a366

SHA1
28259dbe74ba893a7945342fefc01b705cf5b24e

SHA256
3053950c82966a2ced8ed870209e093e2b98b15da2dc8edc580c4276a9c86295

SHA512
461a97a2fb12acf6b2a11a1603f97d4d57b5bdea1e9875aa105960c912034e55648b7cf816841da4e916d8f4eafbee175e3962eae94e753c07ccf4922d381439

Download Submit
C:\Windows\System\hEwiifj.exe

Filesize
1.3MB

MD5
b52459ff30467f386cd749a1eca6bc5d

SHA1
10e3551a4f2048e6d45998fcc68b87e8973bb821

SHA256
6d899ffdbb934721fd2a67832490aaee7d983929b45435d7fd01ee4f360659e9

SHA512
d21821b957b78c2be5267aa5a06891d8bca27e283f8142eab026503d9efded6d672029730300236dccbde2c578602851a99a67e9376dc83428edcf24564b0cb9

Download Submit
C:\Windows\System\jHTjaeQ.exe

Filesize
1.3MB

MD5
2503df3221cfd4741ab53f782bd800a4

SHA1
541a98764a564c40d258ceadbdcdf8446a8a43a4

SHA256
dc28037a90b3646d2e518c6e21191ee719a214a2d6bcb216e2aec5e23116ebdf

SHA512
b68c8e964d86aa747506cc12bf62b0ebbaabee95d00b89bfea85935dc5bf80081db92af2e1c9f9e05965887f1ec303af85946b1477bd05c33132bc5798ffcb06

Download Submit
C:\Windows\System\jqcbKzr.exe

Filesize
1.3MB

MD5
882000b7e2f453fda10ad2f64b3a3246

SHA1
348a9620c1c35760349e2d6e3256562adad2543d

SHA256
4897cb9c72ede5d2cd6b43781b8501ce27e3074a3bb88fa67e307cb643144d40

SHA512
edea21ca2d897aeee4c6ec91c753e3f3f7f89bb4384ed5943023c289d6c2c4daaa4fff785c6c222d5d007de38a3588fe37befdcec5a8dc705391c8e761e875b7

Download Submit
C:\Windows\System\mbFExOs.exe

Filesize
1.3MB

MD5
c8c6787e43a429f437992e394bd8058d

SHA1
69e6e2ce6d958088d35945b664030134b4802249

SHA256
c8d1fbdd1a6009314d3efb27e1d3878081332d7caf1ad5c1c998745536d1bf2f

SHA512
5830391d0dd1bcbec3afaede6cd93855601ad7423e07d9bccd91f906538c85df596b2b1c08351685de64b6e1fa5efcb291801f2585da1370f6f8b5164662c4d4

Download Submit
C:\Windows\System\rTQqMgY.exe

Filesize
1.3MB

MD5
dc1f31518d9b6b5fdfc2aa83435b7aa8

SHA1
099aa71fa22c7f9dc1a5dccb2dae7722b643f76c

SHA256
b6cf4cec7185b28e004efe0d6e341147c510fb5fd77bf0a76454c663dc3c0830

SHA512
3e9ecf879b91d473cafd0a4e0942099923c11eef84da2ac144cda861a76051eee67a60e4375c183c6ab4670280015881cf2baa6e20435925e48adc8eddb3ecc3

Download Submit
C:\Windows\System\sjEGtLD.exe

Filesize
1.3MB

MD5
88903e663dfa6b26d052b4f668370c71

SHA1
60c978241b32a46d93eca9a1423dca6dcc987977

SHA256
3a301ca9a56f862d34e20a21015e7e727085dbc4f79ac0eda902fd7d4c1d408a

SHA512
a93a4572fe7d2ed4f46c0e3a30b766c591e1066194feb150a802e39cef77bb66ad0b019a143c83a42f82c50c40f43e977dda03831f69d1ebaf75803f3e4d42d2

Download Submit
C:\Windows\System\tuGPLOe.exe

Filesize
1.3MB

MD5
587f0cdd34b22301571ca3c8e8d1493e

SHA1
a35acfb581d88a8ab5b937915831a3d58ad96692

SHA256
e93f2296cea8e5fff3ea7ae4bdd799fe3038108ee5c0fb96b89fffabdb33012f

SHA512
fadce6b0b88c632285c9840d820ce67feb53488348aa94346eaf6c30dbfd0402730cd6c99eaf68eafa08869e7bb61ae609950f94bc1b1c4cb37f790d918b3553

Download Submit
C:\Windows\System\uAJWitp.exe

Filesize
1.3MB

MD5
c115d67ae49eaef1c0e81b92bfe448d9

SHA1
ee78449319634e24b0f33fdeb9c52871d0690115

SHA256
0640e6700062474613ad6fd6722e416761c2d670eb25f93854189e757950b4d6

SHA512
8dcad7caf6e8b21fd3aea9573a71f68e8ce5525bf4a871493b16381339579f67acf3a4ad462b8684da7326f00acbce59b4f2d91ec1b81e1eb2af38a14feff20b

Download Submit
C:\Windows\System\wENXeIf.exe

Filesize
1.3MB

MD5
145a1446d366de22893bf0da14e8fecf

SHA1
ce01c223a4be47dc1c4bf5c1679e7181688f1847

SHA256
a05631ac0698e8c9f75289560185143ef0ea34b551991bd1c5416d5d9724479f

SHA512
364fa59f04c66286d27101ab8c85871a3592ab5584ad69810b447a67425c996b4b505434bdfe19af93a15640c2e79635c9612748e2a7c88c387f980cd10e0aa7

Download Submit
C:\Windows\System\xRWCEZJ.exe

Filesize
1.3MB

MD5
20892a33c2398cf67ef8bc1c13453202

SHA1
48bd7c99f27d1b16be4a1a13c3524ec6c6343f28

SHA256
24e0ada816761e15b78a60ee37890c8571338f499a6d191db0c1a7400d20a23f

SHA512
bd223476b1dc46aa747b9964ad93aa4f979802ddaed8a1e5a8019a89d8f6ddfe09e02b1768ca3ec648b621d7c6e8cfa8bdad056cdbcc4c278bcb096ba952ac0d

Download Submit
C:\Windows\System\zhAWBKR.exe

Filesize
1.3MB

MD5
f6ddbc0f8f675c6e39f090dfecffb0a6

SHA1
68abc2d54016b70a66487872a7540f19003288aa

SHA256
a14dcfa2ac2023bb463ac17cad62b07ec330f896ba999bdb5a274574356bd316

SHA512
9cae3349235c95bd95287337a698ee21702082bf522da033463d8fae134e3969a4bb729ba778e72570f7ad68a1ef7f5a1d7bbbf995bdd705fe837e0ad34c002e

Download Submit
memory/1092-0-0x000001BA97CA0000-0x000001BA97CB0000-memory.dmp

Filesize
64KB

Download