xmrig | 9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670

Analysis

max time kernel
121s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
Size

1.2MB
MD5

19a2395533cdb469e6953c15ff63b61f
SHA1

4179502619aefb0fdd92678899882c28ccc2fae1
SHA256

9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670
SHA512

95148f2686090829425cc45471b0feeb19b34a03ddfa5f370d8e07e7c78d1300f37e604b683db8c8ed666ed37b3ea87335c3fd10bbeafda8bff4b685ccff886f
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcx:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c53

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

Processes:

resource	yara_rule
behavioral2/files/0x0008000000023c70-4.dat	xmrig
behavioral2/files/0x0007000000023c77-7.dat	xmrig
behavioral2/files/0x0007000000023c79-24.dat	xmrig
behavioral2/files/0x0007000000023c7a-37.dat	xmrig
behavioral2/files/0x0007000000023c78-45.dat	xmrig
behavioral2/files/0x0007000000023c80-57.dat	xmrig
behavioral2/files/0x0007000000023c7f-65.dat	xmrig
behavioral2/files/0x0007000000023c81-63.dat	xmrig
behavioral2/files/0x0007000000023c7d-61.dat	xmrig
behavioral2/files/0x0007000000023c7c-59.dat	xmrig
behavioral2/files/0x0007000000023c7e-55.dat	xmrig
behavioral2/files/0x0007000000023c7b-51.dat	xmrig
behavioral2/files/0x0008000000023c73-15.dat	xmrig
behavioral2/files/0x0007000000023c83-81.dat	xmrig
behavioral2/files/0x0007000000023c86-109.dat	xmrig
behavioral2/files/0x0007000000023c92-133.dat	xmrig
behavioral2/files/0x0007000000023c93-155.dat	xmrig
behavioral2/files/0x0007000000023c91-151.dat	xmrig
behavioral2/files/0x0007000000023c90-149.dat	xmrig
behavioral2/files/0x0007000000023c8d-147.dat	xmrig
behavioral2/files/0x0007000000023c88-145.dat	xmrig
behavioral2/files/0x0007000000023c8c-143.dat	xmrig
behavioral2/files/0x0007000000023c8f-141.dat	xmrig
behavioral2/files/0x0007000000023c8e-139.dat	xmrig
behavioral2/files/0x0007000000023c8b-137.dat	xmrig
behavioral2/files/0x0007000000023c8a-135.dat	xmrig
behavioral2/files/0x0007000000023c89-128.dat	xmrig
behavioral2/files/0x0007000000023c87-125.dat	xmrig
behavioral2/files/0x0007000000023c85-112.dat	xmrig
behavioral2/files/0x0007000000023c84-87.dat	xmrig
behavioral2/files/0x0007000000023c82-79.dat	xmrig
behavioral2/files/0x0007000000023c94-160.dat	xmrig

Executes dropped EXE 64 IoCs

Processes:

lbyUTyP.exeGOepZTH.exedIpUkdD.exeRoHqMXQ.exemXqkNom.exeadbIHpp.exeDgkuSmp.exetXTBTPT.exeDBbfhMM.exeFqSMERi.exeAAMOtYd.exehkeIxwk.exebzPjhgo.exejVcysHj.exeXociHho.exeQYJJxDf.exeEHDRyvo.exeMfDkXKa.exeKSXZLMP.exemGhYBlT.exefiVDtlj.exeUpwifbg.exevOljWOf.exeyzccHWF.exeVIJWuHq.exehSGPBmr.exeBmLIktb.exerioGBRD.exeNWLARXt.exeHuyMAAq.exeptWralq.exeppyDwQX.exeMnybKhm.exeUgtPgJB.exeLFjpPGi.exePKqixPH.exeNkMhMkA.exeSsNBXiP.exeYBNPTff.exepKfVtQj.exexyftThP.exeuXnVBMZ.exehSYdQlD.exextetYZU.exeBoKRVGg.exeQcTyUog.exeMGtGFXh.exeVUACKlq.exeqsNFsie.exelgmvIWQ.exefUOgxsv.execboyxWH.exelQBqchC.exevNsvCgp.exeQQhefiV.exeVdvAREI.exefJQIFgA.exeHGsJbXN.exeDDHILqS.exeyctUSWf.exeBfCvPPj.exeQtZKanr.exehNSznHL.exeNHoOmyG.exe

pid	Process
3936	lbyUTyP.exe
3592	GOepZTH.exe
2812	dIpUkdD.exe
1724	RoHqMXQ.exe
1408	mXqkNom.exe
724	adbIHpp.exe
1964	DgkuSmp.exe
3868	tXTBTPT.exe
756	DBbfhMM.exe
1020	FqSMERi.exe
3980	AAMOtYd.exe
2284	hkeIxwk.exe
3352	bzPjhgo.exe
4440	jVcysHj.exe
4112	XociHho.exe
3584	QYJJxDf.exe
1064	EHDRyvo.exe
3904	MfDkXKa.exe
4388	KSXZLMP.exe
3664	mGhYBlT.exe
1104	fiVDtlj.exe
4404	Upwifbg.exe
2440	vOljWOf.exe
3088	yzccHWF.exe
2216	VIJWuHq.exe
3600	hSGPBmr.exe
4784	BmLIktb.exe
4908	rioGBRD.exe
2660	NWLARXt.exe
3648	HuyMAAq.exe
892	ptWralq.exe
2492	ppyDwQX.exe
2080	MnybKhm.exe
5040	UgtPgJB.exe
1516	LFjpPGi.exe
1480	PKqixPH.exe
432	NkMhMkA.exe
2432	SsNBXiP.exe
3420	YBNPTff.exe
4380	pKfVtQj.exe
3336	xyftThP.exe
5032	uXnVBMZ.exe
1484	hSYdQlD.exe
4704	xtetYZU.exe
4748	BoKRVGg.exe
3368	QcTyUog.exe
4700	MGtGFXh.exe
1624	VUACKlq.exe
4148	qsNFsie.exe
548	lgmvIWQ.exe
1148	fUOgxsv.exe
1904	cboyxWH.exe
2184	lQBqchC.exe
1428	vNsvCgp.exe
5008	QQhefiV.exe
2008	VdvAREI.exe
3048	fJQIFgA.exe
2944	HGsJbXN.exe
4696	DDHILqS.exe
4128	yctUSWf.exe
2480	BfCvPPj.exe
4032	QtZKanr.exe
4384	hNSznHL.exe
4584	NHoOmyG.exe

Drops file in Windows directory 64 IoCs

Processes:

9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe

description	ioc	Process
File created	C:\Windows\System\rwxlzzF.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\oneedRk.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\JyEwwiX.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\MdYddle.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\KciPqgc.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\wemlPWU.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\aUKZYXw.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\pTmFjoF.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\jvWOfHq.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\QAzhlQP.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\DfNRnhz.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\FfZqotW.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\ptCUQpY.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\zWwZACt.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\dIpUkdD.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\vkMngmO.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\GGxeswa.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\zfXWgIX.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\eCfzVAm.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\zJIuOrJ.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\ZPUAXBh.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\MMECFWR.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\IMaAFGR.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\DJNajUX.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\AxUdCEC.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\DthDJAc.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\BmiPGDX.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\QhzZDmH.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\UWmCggy.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\MQYrgdv.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\MtDniMT.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\pYkNmby.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\qJCluQP.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\SYgqYUj.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\ZnCFAZe.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\mGGqSLh.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\nTSqYEN.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\mDDVceZ.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\dyVhGag.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\oLimwsI.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\ckgrZBT.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\ywDrBRb.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\JJNHFBc.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\AXEgVae.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\DgSWkCM.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\LKsRhRs.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\NBFhvlV.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\QtRjJth.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\efAmJXx.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\JDctHay.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\HGpNcCC.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\zBLWisD.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\Wfbfttp.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\bCqAKdr.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\CFixtTu.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\ZvddUWK.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\CRgdAdS.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\gRDCIOd.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\QpLJkMJ.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\KlZXOGu.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\jgGvqmR.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\zXQGXex.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\nbAjjoX.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
File created	C:\Windows\System\XFhiaHg.exe	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe

description	pid	Process	procid_target
PID 5104 wrote to memory of 3936	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	84
PID 5104 wrote to memory of 3936	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	84
PID 5104 wrote to memory of 3592	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	85
PID 5104 wrote to memory of 3592	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	85
PID 5104 wrote to memory of 2812	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	86
PID 5104 wrote to memory of 2812	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	86
PID 5104 wrote to memory of 1724	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	87
PID 5104 wrote to memory of 1724	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	87
PID 5104 wrote to memory of 1408	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	88
PID 5104 wrote to memory of 1408	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	88
PID 5104 wrote to memory of 724	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	89
PID 5104 wrote to memory of 724	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	89
PID 5104 wrote to memory of 1964	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	90
PID 5104 wrote to memory of 1964	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	90
PID 5104 wrote to memory of 3980	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	91
PID 5104 wrote to memory of 3980	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	91
PID 5104 wrote to memory of 2284	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	92
PID 5104 wrote to memory of 2284	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	92
PID 5104 wrote to memory of 3868	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	93
PID 5104 wrote to memory of 3868	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	93
PID 5104 wrote to memory of 756	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	94
PID 5104 wrote to memory of 756	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	94
PID 5104 wrote to memory of 1020	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	95
PID 5104 wrote to memory of 1020	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	95
PID 5104 wrote to memory of 3352	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	96
PID 5104 wrote to memory of 3352	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	96
PID 5104 wrote to memory of 4440	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	97
PID 5104 wrote to memory of 4440	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	97
PID 5104 wrote to memory of 4112	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	98
PID 5104 wrote to memory of 4112	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	98
PID 5104 wrote to memory of 3584	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	99
PID 5104 wrote to memory of 3584	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	99
PID 5104 wrote to memory of 1064	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	100
PID 5104 wrote to memory of 1064	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	100
PID 5104 wrote to memory of 3904	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	101
PID 5104 wrote to memory of 3904	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	101
PID 5104 wrote to memory of 4388	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	102
PID 5104 wrote to memory of 4388	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	102
PID 5104 wrote to memory of 3664	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	103
PID 5104 wrote to memory of 3664	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	103
PID 5104 wrote to memory of 1104	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	104
PID 5104 wrote to memory of 1104	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	104
PID 5104 wrote to memory of 4404	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	105
PID 5104 wrote to memory of 4404	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	105
PID 5104 wrote to memory of 2440	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	106
PID 5104 wrote to memory of 2440	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	106
PID 5104 wrote to memory of 3088	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	107
PID 5104 wrote to memory of 3088	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	107
PID 5104 wrote to memory of 2216	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	108
PID 5104 wrote to memory of 2216	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	108
PID 5104 wrote to memory of 3600	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	109
PID 5104 wrote to memory of 3600	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	109
PID 5104 wrote to memory of 4784	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	110
PID 5104 wrote to memory of 4784	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	110
PID 5104 wrote to memory of 4908	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	111
PID 5104 wrote to memory of 4908	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	111
PID 5104 wrote to memory of 2660	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	112
PID 5104 wrote to memory of 2660	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	112
PID 5104 wrote to memory of 3648	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	113
PID 5104 wrote to memory of 3648	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	113
PID 5104 wrote to memory of 892	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	114
PID 5104 wrote to memory of 892	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	114
PID 5104 wrote to memory of 2492	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	115
PID 5104 wrote to memory of 2492	5104	9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe	115

C:\Users\Admin\AppData\Local\Temp\9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe
"C:\Users\Admin\AppData\Local\Temp\9906e86bf5186ec7688899f86b25a0ddf0a9a04c16fe254cacac803f1a3c7670.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\System\lbyUTyP.exe
  C:\Windows\System\lbyUTyP.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\GOepZTH.exe
  C:\Windows\System\GOepZTH.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\dIpUkdD.exe
  C:\Windows\System\dIpUkdD.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\RoHqMXQ.exe
  C:\Windows\System\RoHqMXQ.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\mXqkNom.exe
  C:\Windows\System\mXqkNom.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\adbIHpp.exe
  C:\Windows\System\adbIHpp.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\DgkuSmp.exe
  C:\Windows\System\DgkuSmp.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\AAMOtYd.exe
  C:\Windows\System\AAMOtYd.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\hkeIxwk.exe
  C:\Windows\System\hkeIxwk.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\tXTBTPT.exe
  C:\Windows\System\tXTBTPT.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\DBbfhMM.exe
  C:\Windows\System\DBbfhMM.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\FqSMERi.exe
  C:\Windows\System\FqSMERi.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\bzPjhgo.exe
  C:\Windows\System\bzPjhgo.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\jVcysHj.exe
  C:\Windows\System\jVcysHj.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\XociHho.exe
  C:\Windows\System\XociHho.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\QYJJxDf.exe
  C:\Windows\System\QYJJxDf.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\EHDRyvo.exe
  C:\Windows\System\EHDRyvo.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\MfDkXKa.exe
  C:\Windows\System\MfDkXKa.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\KSXZLMP.exe
  C:\Windows\System\KSXZLMP.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\mGhYBlT.exe
  C:\Windows\System\mGhYBlT.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\fiVDtlj.exe
  C:\Windows\System\fiVDtlj.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\Upwifbg.exe
  C:\Windows\System\Upwifbg.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\vOljWOf.exe
  C:\Windows\System\vOljWOf.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\yzccHWF.exe
  C:\Windows\System\yzccHWF.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\VIJWuHq.exe
  C:\Windows\System\VIJWuHq.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\hSGPBmr.exe
  C:\Windows\System\hSGPBmr.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\BmLIktb.exe
  C:\Windows\System\BmLIktb.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\rioGBRD.exe
  C:\Windows\System\rioGBRD.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\NWLARXt.exe
  C:\Windows\System\NWLARXt.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\HuyMAAq.exe
  C:\Windows\System\HuyMAAq.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\ptWralq.exe
  C:\Windows\System\ptWralq.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\ppyDwQX.exe
  C:\Windows\System\ppyDwQX.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\MnybKhm.exe
  C:\Windows\System\MnybKhm.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\UgtPgJB.exe
  C:\Windows\System\UgtPgJB.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\LFjpPGi.exe
  C:\Windows\System\LFjpPGi.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\PKqixPH.exe
  C:\Windows\System\PKqixPH.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\NkMhMkA.exe
  C:\Windows\System\NkMhMkA.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\SsNBXiP.exe
  C:\Windows\System\SsNBXiP.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\YBNPTff.exe
  C:\Windows\System\YBNPTff.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\pKfVtQj.exe
  C:\Windows\System\pKfVtQj.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\xyftThP.exe
  C:\Windows\System\xyftThP.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\uXnVBMZ.exe
  C:\Windows\System\uXnVBMZ.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\hSYdQlD.exe
  C:\Windows\System\hSYdQlD.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\xtetYZU.exe
  C:\Windows\System\xtetYZU.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\BoKRVGg.exe
  C:\Windows\System\BoKRVGg.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\QcTyUog.exe
  C:\Windows\System\QcTyUog.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\MGtGFXh.exe
  C:\Windows\System\MGtGFXh.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\VUACKlq.exe
  C:\Windows\System\VUACKlq.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\qsNFsie.exe
  C:\Windows\System\qsNFsie.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\lgmvIWQ.exe
  C:\Windows\System\lgmvIWQ.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\fUOgxsv.exe
  C:\Windows\System\fUOgxsv.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\cboyxWH.exe
  C:\Windows\System\cboyxWH.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\lQBqchC.exe
  C:\Windows\System\lQBqchC.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\vNsvCgp.exe
  C:\Windows\System\vNsvCgp.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\QQhefiV.exe
  C:\Windows\System\QQhefiV.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\VdvAREI.exe
  C:\Windows\System\VdvAREI.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\fJQIFgA.exe
  C:\Windows\System\fJQIFgA.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\HGsJbXN.exe
  C:\Windows\System\HGsJbXN.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\DDHILqS.exe
  C:\Windows\System\DDHILqS.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\yctUSWf.exe
  C:\Windows\System\yctUSWf.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\BfCvPPj.exe
  C:\Windows\System\BfCvPPj.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\QtZKanr.exe
  C:\Windows\System\QtZKanr.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\hNSznHL.exe
  C:\Windows\System\hNSznHL.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\NHoOmyG.exe
  C:\Windows\System\NHoOmyG.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\KLPgUEV.exe
  C:\Windows\System\KLPgUEV.exe
  2⤵
  PID:4628
- C:\Windows\System\kOdwEFN.exe
  C:\Windows\System\kOdwEFN.exe
  2⤵
  PID:2560
- C:\Windows\System\CPZcfAr.exe
  C:\Windows\System\CPZcfAr.exe
  2⤵
  PID:1852
- C:\Windows\System\tBQkfsm.exe
  C:\Windows\System\tBQkfsm.exe
  2⤵
  PID:2272
- C:\Windows\System\mARHqFI.exe
  C:\Windows\System\mARHqFI.exe
  2⤵
  PID:3156
- C:\Windows\System\amsHCQw.exe
  C:\Windows\System\amsHCQw.exe
  2⤵
  PID:832
- C:\Windows\System\cGfkaSZ.exe
  C:\Windows\System\cGfkaSZ.exe
  2⤵
  PID:2412
- C:\Windows\System\qMEskrW.exe
  C:\Windows\System\qMEskrW.exe
  2⤵
  PID:2668
- C:\Windows\System\arQNMYM.exe
  C:\Windows\System\arQNMYM.exe
  2⤵
  PID:4928
- C:\Windows\System\GdtsoZc.exe
  C:\Windows\System\GdtsoZc.exe
  2⤵
  PID:4752
- C:\Windows\System\rrRNeIU.exe
  C:\Windows\System\rrRNeIU.exe
  2⤵
  PID:1932
- C:\Windows\System\ZQoPmpe.exe
  C:\Windows\System\ZQoPmpe.exe
  2⤵
  PID:1504
- C:\Windows\System\Rmmyyiv.exe
  C:\Windows\System\Rmmyyiv.exe
  2⤵
  PID:3580
- C:\Windows\System\qZhQajD.exe
  C:\Windows\System\qZhQajD.exe
  2⤵
  PID:4560
- C:\Windows\System\nTSqYEN.exe
  C:\Windows\System\nTSqYEN.exe
  2⤵
  PID:4676
- C:\Windows\System\eVhfxiN.exe
  C:\Windows\System\eVhfxiN.exe
  2⤵
  PID:2936
- C:\Windows\System\hkfkaHn.exe
  C:\Windows\System\hkfkaHn.exe
  2⤵
  PID:2232
- C:\Windows\System\tRgbweD.exe
  C:\Windows\System\tRgbweD.exe
  2⤵
  PID:4720
- C:\Windows\System\gBcPtkt.exe
  C:\Windows\System\gBcPtkt.exe
  2⤵
  PID:3836
- C:\Windows\System\BevDVmJ.exe
  C:\Windows\System\BevDVmJ.exe
  2⤵
  PID:4472
- C:\Windows\System\qMUgCEU.exe
  C:\Windows\System\qMUgCEU.exe
  2⤵
  PID:4852
- C:\Windows\System\RkIMGEc.exe
  C:\Windows\System\RkIMGEc.exe
  2⤵
  PID:1092
- C:\Windows\System\SPgYSly.exe
  C:\Windows\System\SPgYSly.exe
  2⤵
  PID:3976
- C:\Windows\System\TRuBAoC.exe
  C:\Windows\System\TRuBAoC.exe
  2⤵
  PID:424
- C:\Windows\System\AicSpOB.exe
  C:\Windows\System\AicSpOB.exe
  2⤵
  PID:1336
- C:\Windows\System\fzSLJYK.exe
  C:\Windows\System\fzSLJYK.exe
  2⤵
  PID:4600
- C:\Windows\System\RDUvoZg.exe
  C:\Windows\System\RDUvoZg.exe
  2⤵
  PID:1572
- C:\Windows\System\pTmFjoF.exe
  C:\Windows\System\pTmFjoF.exe
  2⤵
  PID:4308
- C:\Windows\System\WjgTEDx.exe
  C:\Windows\System\WjgTEDx.exe
  2⤵
  PID:5084
- C:\Windows\System\gsEpSfp.exe
  C:\Windows\System\gsEpSfp.exe
  2⤵
  PID:3524
- C:\Windows\System\CifFCjs.exe
  C:\Windows\System\CifFCjs.exe
  2⤵
  PID:4196
- C:\Windows\System\uAOvItX.exe
  C:\Windows\System\uAOvItX.exe
  2⤵
  PID:4000
- C:\Windows\System\EwGHbll.exe
  C:\Windows\System\EwGHbll.exe
  2⤵
  PID:3764
- C:\Windows\System\iiuzUeg.exe
  C:\Windows\System\iiuzUeg.exe
  2⤵
  PID:3908
- C:\Windows\System\VOwWXko.exe
  C:\Windows\System\VOwWXko.exe
  2⤵
  PID:3344
- C:\Windows\System\vkMngmO.exe
  C:\Windows\System\vkMngmO.exe
  2⤵
  PID:2900
- C:\Windows\System\JhBSQOJ.exe
  C:\Windows\System\JhBSQOJ.exe
  2⤵
  PID:1488
- C:\Windows\System\qCGDcny.exe
  C:\Windows\System\qCGDcny.exe
  2⤵
  PID:2488
- C:\Windows\System\TWySBkX.exe
  C:\Windows\System\TWySBkX.exe
  2⤵
  PID:2964
- C:\Windows\System\MwUreLx.exe
  C:\Windows\System\MwUreLx.exe
  2⤵
  PID:4992
- C:\Windows\System\whUThlH.exe
  C:\Windows\System\whUThlH.exe
  2⤵
  PID:3012
- C:\Windows\System\yFgTugH.exe
  C:\Windows\System\yFgTugH.exe
  2⤵
  PID:3984
- C:\Windows\System\jUKjYXT.exe
  C:\Windows\System\jUKjYXT.exe
  2⤵
  PID:1580
- C:\Windows\System\vmSiBRf.exe
  C:\Windows\System\vmSiBRf.exe
  2⤵
  PID:1444
- C:\Windows\System\AtPOAfq.exe
  C:\Windows\System\AtPOAfq.exe
  2⤵
  PID:5136
- C:\Windows\System\BLeycUH.exe
  C:\Windows\System\BLeycUH.exe
  2⤵
  PID:5164
- C:\Windows\System\zzfJvxj.exe
  C:\Windows\System\zzfJvxj.exe
  2⤵
  PID:5192
- C:\Windows\System\jBnWhaD.exe
  C:\Windows\System\jBnWhaD.exe
  2⤵
  PID:5220
- C:\Windows\System\brlLsIT.exe
  C:\Windows\System\brlLsIT.exe
  2⤵
  PID:5248
- C:\Windows\System\ipAyKmk.exe
  C:\Windows\System\ipAyKmk.exe
  2⤵
  PID:5268
- C:\Windows\System\mJHfNTU.exe
  C:\Windows\System\mJHfNTU.exe
  2⤵
  PID:5296
- C:\Windows\System\LUWkZpZ.exe
  C:\Windows\System\LUWkZpZ.exe
  2⤵
  PID:5332
- C:\Windows\System\qKcCpJC.exe
  C:\Windows\System\qKcCpJC.exe
  2⤵
  PID:5356
- C:\Windows\System\AxUdCEC.exe
  C:\Windows\System\AxUdCEC.exe
  2⤵
  PID:5376
- C:\Windows\System\FEmZtyH.exe
  C:\Windows\System\FEmZtyH.exe
  2⤵
  PID:5404
- C:\Windows\System\HGpNcCC.exe
  C:\Windows\System\HGpNcCC.exe
  2⤵
  PID:5420
- C:\Windows\System\vfEWbQu.exe
  C:\Windows\System\vfEWbQu.exe
  2⤵
  PID:5444
- C:\Windows\System\YHwXrmc.exe
  C:\Windows\System\YHwXrmc.exe
  2⤵
  PID:5476
- C:\Windows\System\GhbaCLf.exe
  C:\Windows\System\GhbaCLf.exe
  2⤵
  PID:5500
- C:\Windows\System\RfhpLJF.exe
  C:\Windows\System\RfhpLJF.exe
  2⤵
  PID:5536
- C:\Windows\System\wndbYfV.exe
  C:\Windows\System\wndbYfV.exe
  2⤵
  PID:5560
- C:\Windows\System\zXQGXex.exe
  C:\Windows\System\zXQGXex.exe
  2⤵
  PID:5596
- C:\Windows\System\mLbWovW.exe
  C:\Windows\System\mLbWovW.exe
  2⤵
  PID:5628
- C:\Windows\System\VRElqlr.exe
  C:\Windows\System\VRElqlr.exe
  2⤵
  PID:5656
- C:\Windows\System\WlwgdXN.exe
  C:\Windows\System\WlwgdXN.exe
  2⤵
  PID:5684
- C:\Windows\System\vHXIBJL.exe
  C:\Windows\System\vHXIBJL.exe
  2⤵
  PID:5712
- C:\Windows\System\BWIeNRc.exe
  C:\Windows\System\BWIeNRc.exe
  2⤵
  PID:5740
- C:\Windows\System\BkSZQdS.exe
  C:\Windows\System\BkSZQdS.exe
  2⤵
  PID:5768
- C:\Windows\System\kZJfpIZ.exe
  C:\Windows\System\kZJfpIZ.exe
  2⤵
  PID:5800
- C:\Windows\System\ZiBpLnZ.exe
  C:\Windows\System\ZiBpLnZ.exe
  2⤵
  PID:5828
- C:\Windows\System\FSqliig.exe
  C:\Windows\System\FSqliig.exe
  2⤵
  PID:5852
- C:\Windows\System\tMPTLmK.exe
  C:\Windows\System\tMPTLmK.exe
  2⤵
  PID:5884
- C:\Windows\System\iVqVFZP.exe
  C:\Windows\System\iVqVFZP.exe
  2⤵
  PID:5908
- C:\Windows\System\lcNmVBR.exe
  C:\Windows\System\lcNmVBR.exe
  2⤵
  PID:5932
- C:\Windows\System\tqKWOXf.exe
  C:\Windows\System\tqKWOXf.exe
  2⤵
  PID:5968
- C:\Windows\System\AseShFw.exe
  C:\Windows\System\AseShFw.exe
  2⤵
  PID:6000
- C:\Windows\System\dhMLbuP.exe
  C:\Windows\System\dhMLbuP.exe
  2⤵
  PID:6024
- C:\Windows\System\lvnSpvd.exe
  C:\Windows\System\lvnSpvd.exe
  2⤵
  PID:6056
- C:\Windows\System\mFoZmlM.exe
  C:\Windows\System\mFoZmlM.exe
  2⤵
  PID:6076
- C:\Windows\System\CbDqbQi.exe
  C:\Windows\System\CbDqbQi.exe
  2⤵
  PID:6104
- C:\Windows\System\CVXTmAZ.exe
  C:\Windows\System\CVXTmAZ.exe
  2⤵
  PID:2744
- C:\Windows\System\rUDXnuN.exe
  C:\Windows\System\rUDXnuN.exe
  2⤵
  PID:5128
- C:\Windows\System\wdGzjyE.exe
  C:\Windows\System\wdGzjyE.exe
  2⤵
  PID:5176
- C:\Windows\System\XlNJGXw.exe
  C:\Windows\System\XlNJGXw.exe
  2⤵
  PID:5236
- C:\Windows\System\mTRvalp.exe
  C:\Windows\System\mTRvalp.exe
  2⤵
  PID:5308
- C:\Windows\System\NREJOai.exe
  C:\Windows\System\NREJOai.exe
  2⤵
  PID:5352
- C:\Windows\System\RufZHxH.exe
  C:\Windows\System\RufZHxH.exe
  2⤵
  PID:5436
- C:\Windows\System\hrZEstu.exe
  C:\Windows\System\hrZEstu.exe
  2⤵
  PID:5516
- C:\Windows\System\yvaqumD.exe
  C:\Windows\System\yvaqumD.exe
  2⤵
  PID:5552
- C:\Windows\System\ZAdpUUY.exe
  C:\Windows\System\ZAdpUUY.exe
  2⤵
  PID:5604
- C:\Windows\System\fFvAiMZ.exe
  C:\Windows\System\fFvAiMZ.exe
  2⤵
  PID:5668
- C:\Windows\System\SykTCgm.exe
  C:\Windows\System\SykTCgm.exe
  2⤵
  PID:5732
- C:\Windows\System\tdDkfyd.exe
  C:\Windows\System\tdDkfyd.exe
  2⤵
  PID:5808
- C:\Windows\System\BhlbdWF.exe
  C:\Windows\System\BhlbdWF.exe
  2⤵
  PID:5892
- C:\Windows\System\dxlgDpl.exe
  C:\Windows\System\dxlgDpl.exe
  2⤵
  PID:5956
- C:\Windows\System\Nblcrpw.exe
  C:\Windows\System\Nblcrpw.exe
  2⤵
  PID:6044
- C:\Windows\System\sUrDJmi.exe
  C:\Windows\System\sUrDJmi.exe
  2⤵
  PID:6124
- C:\Windows\System\RpggjyQ.exe
  C:\Windows\System\RpggjyQ.exe
  2⤵
  PID:6112
- C:\Windows\System\EToBTxv.exe
  C:\Windows\System\EToBTxv.exe
  2⤵
  PID:5188
- C:\Windows\System\GpRsBFz.exe
  C:\Windows\System\GpRsBFz.exe
  2⤵
  PID:5612
- C:\Windows\System\RuZpvzX.exe
  C:\Windows\System\RuZpvzX.exe
  2⤵
  PID:5704
- C:\Windows\System\BWrdlls.exe
  C:\Windows\System\BWrdlls.exe
  2⤵
  PID:5696
- C:\Windows\System\yOjZNhB.exe
  C:\Windows\System\yOjZNhB.exe
  2⤵
  PID:5896
- C:\Windows\System\nXLbOks.exe
  C:\Windows\System\nXLbOks.exe
  2⤵
  PID:6088
- C:\Windows\System\yXEZUOl.exe
  C:\Windows\System\yXEZUOl.exe
  2⤵
  PID:5256
- C:\Windows\System\nILTVOU.exe
  C:\Windows\System\nILTVOU.exe
  2⤵
  PID:5344
- C:\Windows\System\jvWOfHq.exe
  C:\Windows\System\jvWOfHq.exe
  2⤵
  PID:6020
- C:\Windows\System\nmLPGKt.exe
  C:\Windows\System\nmLPGKt.exe
  2⤵
  PID:5440
- C:\Windows\System\AjCIPjs.exe
  C:\Windows\System\AjCIPjs.exe
  2⤵
  PID:5940
- C:\Windows\System\xwCtiVJ.exe
  C:\Windows\System\xwCtiVJ.exe
  2⤵
  PID:6168
- C:\Windows\System\eWthxED.exe
  C:\Windows\System\eWthxED.exe
  2⤵
  PID:6192
- C:\Windows\System\ZPUAXBh.exe
  C:\Windows\System\ZPUAXBh.exe
  2⤵
  PID:6220
- C:\Windows\System\rZpWVnq.exe
  C:\Windows\System\rZpWVnq.exe
  2⤵
  PID:6244
- C:\Windows\System\ViMjPZs.exe
  C:\Windows\System\ViMjPZs.exe
  2⤵
  PID:6264
- C:\Windows\System\STzrsAp.exe
  C:\Windows\System\STzrsAp.exe
  2⤵
  PID:6292
- C:\Windows\System\pdRyrYG.exe
  C:\Windows\System\pdRyrYG.exe
  2⤵
  PID:6320
- C:\Windows\System\lNcXhQL.exe
  C:\Windows\System\lNcXhQL.exe
  2⤵
  PID:6344
- C:\Windows\System\LDQiKQh.exe
  C:\Windows\System\LDQiKQh.exe
  2⤵
  PID:6372
- C:\Windows\System\RqrEBSU.exe
  C:\Windows\System\RqrEBSU.exe
  2⤵
  PID:6396
- C:\Windows\System\aOKUdmB.exe
  C:\Windows\System\aOKUdmB.exe
  2⤵
  PID:6420
- C:\Windows\System\nbAjjoX.exe
  C:\Windows\System\nbAjjoX.exe
  2⤵
  PID:6448
- C:\Windows\System\ZVVsBMe.exe
  C:\Windows\System\ZVVsBMe.exe
  2⤵
  PID:6476
- C:\Windows\System\ujRRInP.exe
  C:\Windows\System\ujRRInP.exe
  2⤵
  PID:6508
- C:\Windows\System\fOGxVpw.exe
  C:\Windows\System\fOGxVpw.exe
  2⤵
  PID:6540
- C:\Windows\System\XjVckBT.exe
  C:\Windows\System\XjVckBT.exe
  2⤵
  PID:6560
- C:\Windows\System\pTHJJit.exe
  C:\Windows\System\pTHJJit.exe
  2⤵
  PID:6592
- C:\Windows\System\ZUUEhYs.exe
  C:\Windows\System\ZUUEhYs.exe
  2⤵
  PID:6616
- C:\Windows\System\yUGhZOT.exe
  C:\Windows\System\yUGhZOT.exe
  2⤵
  PID:6640
- C:\Windows\System\FSVnXqM.exe
  C:\Windows\System\FSVnXqM.exe
  2⤵
  PID:6660
- C:\Windows\System\HwriSIx.exe
  C:\Windows\System\HwriSIx.exe
  2⤵
  PID:6688
- C:\Windows\System\wSFWiVh.exe
  C:\Windows\System\wSFWiVh.exe
  2⤵
  PID:6716
- C:\Windows\System\PyHaRvk.exe
  C:\Windows\System\PyHaRvk.exe
  2⤵
  PID:6744
- C:\Windows\System\rLAxErv.exe
  C:\Windows\System\rLAxErv.exe
  2⤵
  PID:6776
- C:\Windows\System\sQKflXc.exe
  C:\Windows\System\sQKflXc.exe
  2⤵
  PID:6800
- C:\Windows\System\tadGcPJ.exe
  C:\Windows\System\tadGcPJ.exe
  2⤵
  PID:6828
- C:\Windows\System\hdjEkjz.exe
  C:\Windows\System\hdjEkjz.exe
  2⤵
  PID:6852
- C:\Windows\System\ymcMHeg.exe
  C:\Windows\System\ymcMHeg.exe
  2⤵
  PID:6880
- C:\Windows\System\QTnIwBb.exe
  C:\Windows\System\QTnIwBb.exe
  2⤵
  PID:6900
- C:\Windows\System\DthDJAc.exe
  C:\Windows\System\DthDJAc.exe
  2⤵
  PID:6920
- C:\Windows\System\KXskxyB.exe
  C:\Windows\System\KXskxyB.exe
  2⤵
  PID:6948
- C:\Windows\System\GeEOXVL.exe
  C:\Windows\System\GeEOXVL.exe
  2⤵
  PID:6976
- C:\Windows\System\yEwbtoe.exe
  C:\Windows\System\yEwbtoe.exe
  2⤵
  PID:7000
- C:\Windows\System\IKTEVyR.exe
  C:\Windows\System\IKTEVyR.exe
  2⤵
  PID:7028
- C:\Windows\System\jSjSJVE.exe
  C:\Windows\System\jSjSJVE.exe
  2⤵
  PID:7056
- C:\Windows\System\mDDVceZ.exe
  C:\Windows\System\mDDVceZ.exe
  2⤵
  PID:7080
- C:\Windows\System\XbUcWsv.exe
  C:\Windows\System\XbUcWsv.exe
  2⤵
  PID:7108
- C:\Windows\System\ttOIkCb.exe
  C:\Windows\System\ttOIkCb.exe
  2⤵
  PID:7128
- C:\Windows\System\ArQaNdW.exe
  C:\Windows\System\ArQaNdW.exe
  2⤵
  PID:7156
- C:\Windows\System\fmMfixG.exe
  C:\Windows\System\fmMfixG.exe
  2⤵
  PID:6148
- C:\Windows\System\UFwyrYL.exe
  C:\Windows\System\UFwyrYL.exe
  2⤵
  PID:6208
- C:\Windows\System\qcOKhFi.exe
  C:\Windows\System\qcOKhFi.exe
  2⤵
  PID:6284
- C:\Windows\System\ALbAflv.exe
  C:\Windows\System\ALbAflv.exe
  2⤵
  PID:6328
- C:\Windows\System\XWcagqa.exe
  C:\Windows\System\XWcagqa.exe
  2⤵
  PID:6336
- C:\Windows\System\NOyMWzz.exe
  C:\Windows\System\NOyMWzz.exe
  2⤵
  PID:6496
- C:\Windows\System\FfZqotW.exe
  C:\Windows\System\FfZqotW.exe
  2⤵
  PID:6460
- C:\Windows\System\CLaCHch.exe
  C:\Windows\System\CLaCHch.exe
  2⤵
  PID:6624
- C:\Windows\System\FUZuhMh.exe
  C:\Windows\System\FUZuhMh.exe
  2⤵
  PID:6712
- C:\Windows\System\sMbIGrE.exe
  C:\Windows\System\sMbIGrE.exe
  2⤵
  PID:6784
- C:\Windows\System\ssCGepQ.exe
  C:\Windows\System\ssCGepQ.exe
  2⤵
  PID:6628
- C:\Windows\System\IaCbGnB.exe
  C:\Windows\System\IaCbGnB.exe
  2⤵
  PID:6756
- C:\Windows\System\GGxeswa.exe
  C:\Windows\System\GGxeswa.exe
  2⤵
  PID:6992
- C:\Windows\System\WplPSxM.exe
  C:\Windows\System\WplPSxM.exe
  2⤵
  PID:6936
- C:\Windows\System\YtqmBoO.exe
  C:\Windows\System\YtqmBoO.exe
  2⤵
  PID:7140
- C:\Windows\System\kQbJPlK.exe
  C:\Windows\System\kQbJPlK.exe
  2⤵
  PID:6944
- C:\Windows\System\mkLOVjR.exe
  C:\Windows\System\mkLOVjR.exe
  2⤵
  PID:7124
- C:\Windows\System\fKQPjTc.exe
  C:\Windows\System\fKQPjTc.exe
  2⤵
  PID:6064
- C:\Windows\System\vNYoFic.exe
  C:\Windows\System\vNYoFic.exe
  2⤵
  PID:7116
- C:\Windows\System\EidoFNr.exe
  C:\Windows\System\EidoFNr.exe
  2⤵
  PID:6612
- C:\Windows\System\PrMSRkd.exe
  C:\Windows\System\PrMSRkd.exe
  2⤵
  PID:6704
- C:\Windows\System\ZvddUWK.exe
  C:\Windows\System\ZvddUWK.exe
  2⤵
  PID:6520
- C:\Windows\System\EXoSOmj.exe
  C:\Windows\System\EXoSOmj.exe
  2⤵
  PID:6392
- C:\Windows\System\nAvPtzo.exe
  C:\Windows\System\nAvPtzo.exe
  2⤵
  PID:7152
- C:\Windows\System\BtTLkJC.exe
  C:\Windows\System\BtTLkJC.exe
  2⤵
  PID:5488
- C:\Windows\System\swZcMKA.exe
  C:\Windows\System\swZcMKA.exe
  2⤵
  PID:6184
- C:\Windows\System\HYQctbO.exe
  C:\Windows\System\HYQctbO.exe
  2⤵
  PID:7192
- C:\Windows\System\ZagYFjj.exe
  C:\Windows\System\ZagYFjj.exe
  2⤵
  PID:7224
- C:\Windows\System\nBxkjPj.exe
  C:\Windows\System\nBxkjPj.exe
  2⤵
  PID:7256
- C:\Windows\System\JrmqfSA.exe
  C:\Windows\System\JrmqfSA.exe
  2⤵
  PID:7280
- C:\Windows\System\klAhqky.exe
  C:\Windows\System\klAhqky.exe
  2⤵
  PID:7312
- C:\Windows\System\uAjLTpZ.exe
  C:\Windows\System\uAjLTpZ.exe
  2⤵
  PID:7340
- C:\Windows\System\ggKeklk.exe
  C:\Windows\System\ggKeklk.exe
  2⤵
  PID:7364
- C:\Windows\System\SYgqYUj.exe
  C:\Windows\System\SYgqYUj.exe
  2⤵
  PID:7392
- C:\Windows\System\obNXNvG.exe
  C:\Windows\System\obNXNvG.exe
  2⤵
  PID:7424
- C:\Windows\System\OYpFqJA.exe
  C:\Windows\System\OYpFqJA.exe
  2⤵
  PID:7452
- C:\Windows\System\NBFhvlV.exe
  C:\Windows\System\NBFhvlV.exe
  2⤵
  PID:7472
- C:\Windows\System\TUJBDcR.exe
  C:\Windows\System\TUJBDcR.exe
  2⤵
  PID:7496
- C:\Windows\System\MeKaelF.exe
  C:\Windows\System\MeKaelF.exe
  2⤵
  PID:7524
- C:\Windows\System\ZnCFAZe.exe
  C:\Windows\System\ZnCFAZe.exe
  2⤵
  PID:7552
- C:\Windows\System\AcfkMOB.exe
  C:\Windows\System\AcfkMOB.exe
  2⤵
  PID:7580
- C:\Windows\System\OBHEcvj.exe
  C:\Windows\System\OBHEcvj.exe
  2⤵
  PID:7608
- C:\Windows\System\DgSWkCM.exe
  C:\Windows\System\DgSWkCM.exe
  2⤵
  PID:7640
- C:\Windows\System\EMKnPRk.exe
  C:\Windows\System\EMKnPRk.exe
  2⤵
  PID:7664
- C:\Windows\System\oqKGneg.exe
  C:\Windows\System\oqKGneg.exe
  2⤵
  PID:7684
- C:\Windows\System\omoCmuz.exe
  C:\Windows\System\omoCmuz.exe
  2⤵
  PID:7712
- C:\Windows\System\hSMYSMe.exe
  C:\Windows\System\hSMYSMe.exe
  2⤵
  PID:7740
- C:\Windows\System\lndCTRF.exe
  C:\Windows\System\lndCTRF.exe
  2⤵
  PID:7764
- C:\Windows\System\PudYeYl.exe
  C:\Windows\System\PudYeYl.exe
  2⤵
  PID:7792
- C:\Windows\System\NRUhMoV.exe
  C:\Windows\System\NRUhMoV.exe
  2⤵
  PID:7824
- C:\Windows\System\kfgfXhY.exe
  C:\Windows\System\kfgfXhY.exe
  2⤵
  PID:7852
- C:\Windows\System\vHRaFCD.exe
  C:\Windows\System\vHRaFCD.exe
  2⤵
  PID:7884
- C:\Windows\System\MtDniMT.exe
  C:\Windows\System\MtDniMT.exe
  2⤵
  PID:7912
- C:\Windows\System\VWYZXLR.exe
  C:\Windows\System\VWYZXLR.exe
  2⤵
  PID:7936
- C:\Windows\System\vpajjwc.exe
  C:\Windows\System\vpajjwc.exe
  2⤵
  PID:7956
- C:\Windows\System\zBLWisD.exe
  C:\Windows\System\zBLWisD.exe
  2⤵
  PID:7988
- C:\Windows\System\LuOfiyI.exe
  C:\Windows\System\LuOfiyI.exe
  2⤵
  PID:8008
- C:\Windows\System\znyIjys.exe
  C:\Windows\System\znyIjys.exe
  2⤵
  PID:8036
- C:\Windows\System\dFJjdEd.exe
  C:\Windows\System\dFJjdEd.exe
  2⤵
  PID:8064
- C:\Windows\System\WZCcmAu.exe
  C:\Windows\System\WZCcmAu.exe
  2⤵
  PID:8084
- C:\Windows\System\ZBLXDAD.exe
  C:\Windows\System\ZBLXDAD.exe
  2⤵
  PID:8120
- C:\Windows\System\bDTrfoh.exe
  C:\Windows\System\bDTrfoh.exe
  2⤵
  PID:8144
- C:\Windows\System\rtNrzZi.exe
  C:\Windows\System\rtNrzZi.exe
  2⤵
  PID:8164
- C:\Windows\System\NbnAJLu.exe
  C:\Windows\System\NbnAJLu.exe
  2⤵
  PID:6556
- C:\Windows\System\phOdRPW.exe
  C:\Windows\System\phOdRPW.exe
  2⤵
  PID:6316
- C:\Windows\System\efAmJXx.exe
  C:\Windows\System\efAmJXx.exe
  2⤵
  PID:7328
- C:\Windows\System\LgiHQWH.exe
  C:\Windows\System\LgiHQWH.exe
  2⤵
  PID:7252
- C:\Windows\System\xrntGDI.exe
  C:\Windows\System\xrntGDI.exe
  2⤵
  PID:7416
- C:\Windows\System\nIbxYfw.exe
  C:\Windows\System\nIbxYfw.exe
  2⤵
  PID:7380
- C:\Windows\System\CRgdAdS.exe
  C:\Windows\System\CRgdAdS.exe
  2⤵
  PID:7304
- C:\Windows\System\dKgydcb.exe
  C:\Windows\System\dKgydcb.exe
  2⤵
  PID:7576
- C:\Windows\System\dURIgJB.exe
  C:\Windows\System\dURIgJB.exe
  2⤵
  PID:7444
- C:\Windows\System\TrEatAp.exe
  C:\Windows\System\TrEatAp.exe
  2⤵
  PID:7484
- C:\Windows\System\rOQsvHe.exe
  C:\Windows\System\rOQsvHe.exe
  2⤵
  PID:7728
- C:\Windows\System\mRgLJUp.exe
  C:\Windows\System\mRgLJUp.exe
  2⤵
  PID:7548
- C:\Windows\System\MyBUnIm.exe
  C:\Windows\System\MyBUnIm.exe
  2⤵
  PID:7780
- C:\Windows\System\UPSxUyn.exe
  C:\Windows\System\UPSxUyn.exe
  2⤵
  PID:7812
- C:\Windows\System\gtcgXqs.exe
  C:\Windows\System\gtcgXqs.exe
  2⤵
  PID:7876
- C:\Windows\System\JEGYTit.exe
  C:\Windows\System\JEGYTit.exe
  2⤵
  PID:8020
- C:\Windows\System\dyVhGag.exe
  C:\Windows\System\dyVhGag.exe
  2⤵
  PID:8048
- C:\Windows\System\lTjUHFf.exe
  C:\Windows\System\lTjUHFf.exe
  2⤵
  PID:7972
- C:\Windows\System\gcBAHCm.exe
  C:\Windows\System\gcBAHCm.exe
  2⤵
  PID:8140
- C:\Windows\System\IqayyRa.exe
  C:\Windows\System\IqayyRa.exe
  2⤵
  PID:7996
- C:\Windows\System\iKskfjZ.exe
  C:\Windows\System\iKskfjZ.exe
  2⤵
  PID:6728
- C:\Windows\System\CJpbqGz.exe
  C:\Windows\System\CJpbqGz.exe
  2⤵
  PID:7676
- C:\Windows\System\QrEcTlg.exe
  C:\Windows\System\QrEcTlg.exe
  2⤵
  PID:7492
- C:\Windows\System\CzIJQzf.exe
  C:\Windows\System\CzIJQzf.exe
  2⤵
  PID:7968
- C:\Windows\System\yhInBNJ.exe
  C:\Windows\System\yhInBNJ.exe
  2⤵
  PID:7268
- C:\Windows\System\IVuBFas.exe
  C:\Windows\System\IVuBFas.exe
  2⤵
  PID:8220
- C:\Windows\System\HLFCQwK.exe
  C:\Windows\System\HLFCQwK.exe
  2⤵
  PID:8252
- C:\Windows\System\stPimDa.exe
  C:\Windows\System\stPimDa.exe
  2⤵
  PID:8284
- C:\Windows\System\CBhNZwJ.exe
  C:\Windows\System\CBhNZwJ.exe
  2⤵
  PID:8312
- C:\Windows\System\hkeOrYy.exe
  C:\Windows\System\hkeOrYy.exe
  2⤵
  PID:8340
- C:\Windows\System\OaPuquk.exe
  C:\Windows\System\OaPuquk.exe
  2⤵
  PID:8368
- C:\Windows\System\uQodfmn.exe
  C:\Windows\System\uQodfmn.exe
  2⤵
  PID:8392
- C:\Windows\System\eNiIPtC.exe
  C:\Windows\System\eNiIPtC.exe
  2⤵
  PID:8424
- C:\Windows\System\lcLnbxh.exe
  C:\Windows\System\lcLnbxh.exe
  2⤵
  PID:8444
- C:\Windows\System\gMtKDKW.exe
  C:\Windows\System\gMtKDKW.exe
  2⤵
  PID:8468
- C:\Windows\System\bjiRHke.exe
  C:\Windows\System\bjiRHke.exe
  2⤵
  PID:8496
- C:\Windows\System\PmqUOLK.exe
  C:\Windows\System\PmqUOLK.exe
  2⤵
  PID:8524
- C:\Windows\System\fzNuhyG.exe
  C:\Windows\System\fzNuhyG.exe
  2⤵
  PID:8552
- C:\Windows\System\GjzZkHc.exe
  C:\Windows\System\GjzZkHc.exe
  2⤵
  PID:8572
- C:\Windows\System\yJIFaWC.exe
  C:\Windows\System\yJIFaWC.exe
  2⤵
  PID:8600
- C:\Windows\System\SOXloqW.exe
  C:\Windows\System\SOXloqW.exe
  2⤵
  PID:8628
- C:\Windows\System\udssSdH.exe
  C:\Windows\System\udssSdH.exe
  2⤵
  PID:8656
- C:\Windows\System\WeiCUQr.exe
  C:\Windows\System\WeiCUQr.exe
  2⤵
  PID:8700
- C:\Windows\System\ESsvdQW.exe
  C:\Windows\System\ESsvdQW.exe
  2⤵
  PID:8736
- C:\Windows\System\HJcecbJ.exe
  C:\Windows\System\HJcecbJ.exe
  2⤵
  PID:8752
- C:\Windows\System\xRTdrPD.exe
  C:\Windows\System\xRTdrPD.exe
  2⤵
  PID:8780
- C:\Windows\System\qRkIxXd.exe
  C:\Windows\System\qRkIxXd.exe
  2⤵
  PID:8812
- C:\Windows\System\bfpHNJP.exe
  C:\Windows\System\bfpHNJP.exe
  2⤵
  PID:8844
- C:\Windows\System\xyraXwX.exe
  C:\Windows\System\xyraXwX.exe
  2⤵
  PID:8876
- C:\Windows\System\slsOHbf.exe
  C:\Windows\System\slsOHbf.exe
  2⤵
  PID:8908
- C:\Windows\System\uMZaoeo.exe
  C:\Windows\System\uMZaoeo.exe
  2⤵
  PID:8932
- C:\Windows\System\isAPzAV.exe
  C:\Windows\System\isAPzAV.exe
  2⤵
  PID:8948
- C:\Windows\System\pFqqFAE.exe
  C:\Windows\System\pFqqFAE.exe
  2⤵
  PID:8988
- C:\Windows\System\uvZuyiA.exe
  C:\Windows\System\uvZuyiA.exe
  2⤵
  PID:9008
- C:\Windows\System\OPuDMbP.exe
  C:\Windows\System\OPuDMbP.exe
  2⤵
  PID:9036
- C:\Windows\System\LBhEIHQ.exe
  C:\Windows\System\LBhEIHQ.exe
  2⤵
  PID:9064
- C:\Windows\System\fRWQRKL.exe
  C:\Windows\System\fRWQRKL.exe
  2⤵
  PID:9092
- C:\Windows\System\aUKZYXw.exe
  C:\Windows\System\aUKZYXw.exe
  2⤵
  PID:9116
- C:\Windows\System\PBTkVwt.exe
  C:\Windows\System\PBTkVwt.exe
  2⤵
  PID:9144
- C:\Windows\System\JDctHay.exe
  C:\Windows\System\JDctHay.exe
  2⤵
  PID:9168
- C:\Windows\System\dcKsiOA.exe
  C:\Windows\System\dcKsiOA.exe
  2⤵
  PID:9188
- C:\Windows\System\XtUgXfP.exe
  C:\Windows\System\XtUgXfP.exe
  2⤵
  PID:7896
- C:\Windows\System\ZQFUkXv.exe
  C:\Windows\System\ZQFUkXv.exe
  2⤵
  PID:7064
- C:\Windows\System\CTBXWHl.exe
  C:\Windows\System\CTBXWHl.exe
  2⤵
  PID:7536
- C:\Windows\System\AKKpFLw.exe
  C:\Windows\System\AKKpFLw.exe
  2⤵
  PID:7212
- C:\Windows\System\NWGFmlA.exe
  C:\Windows\System\NWGFmlA.exe
  2⤵
  PID:7204
- C:\Windows\System\IMZysju.exe
  C:\Windows\System\IMZysju.exe
  2⤵
  PID:8356
- C:\Windows\System\XHFPhof.exe
  C:\Windows\System\XHFPhof.exe
  2⤵
  PID:8456
- C:\Windows\System\bHBZjMU.exe
  C:\Windows\System\bHBZjMU.exe
  2⤵
  PID:7620
- C:\Windows\System\uVtXkJn.exe
  C:\Windows\System\uVtXkJn.exe
  2⤵
  PID:8408
- C:\Windows\System\UlWbQVo.exe
  C:\Windows\System\UlWbQVo.exe
  2⤵
  PID:8584
- C:\Windows\System\SaqjtfB.exe
  C:\Windows\System\SaqjtfB.exe
  2⤵
  PID:8492
- C:\Windows\System\XHcVjGp.exe
  C:\Windows\System\XHcVjGp.exe
  2⤵
  PID:8536
- C:\Windows\System\tGKLVWq.exe
  C:\Windows\System\tGKLVWq.exe
  2⤵
  PID:8620
- C:\Windows\System\EXKFCBh.exe
  C:\Windows\System\EXKFCBh.exe
  2⤵
  PID:8668
- C:\Windows\System\XQRFaBk.exe
  C:\Windows\System\XQRFaBk.exe
  2⤵
  PID:8804
- C:\Windows\System\CjWGgnT.exe
  C:\Windows\System\CjWGgnT.exe
  2⤵
  PID:8720
- C:\Windows\System\xrvLlVn.exe
  C:\Windows\System\xrvLlVn.exe
  2⤵
  PID:9052
- C:\Windows\System\PapaYJw.exe
  C:\Windows\System\PapaYJw.exe
  2⤵
  PID:8976
- C:\Windows\System\DQEErac.exe
  C:\Windows\System\DQEErac.exe
  2⤵
  PID:9180
- C:\Windows\System\KvDFubr.exe
  C:\Windows\System\KvDFubr.exe
  2⤵
  PID:9156
- C:\Windows\System\hvREXmR.exe
  C:\Windows\System\hvREXmR.exe
  2⤵
  PID:8516
- C:\Windows\System\QhzZDmH.exe
  C:\Windows\System\QhzZDmH.exe
  2⤵
  PID:9076
- C:\Windows\System\PZvklTm.exe
  C:\Windows\System\PZvklTm.exe
  2⤵
  PID:8188
- C:\Windows\System\lDGQFFI.exe
  C:\Windows\System\lDGQFFI.exe
  2⤵
  PID:8744
- C:\Windows\System\SfdoxlL.exe
  C:\Windows\System\SfdoxlL.exe
  2⤵
  PID:7952
- C:\Windows\System\UkmJUDq.exe
  C:\Windows\System\UkmJUDq.exe
  2⤵
  PID:8328
- C:\Windows\System\OwyBArz.exe
  C:\Windows\System\OwyBArz.exe
  2⤵
  PID:9244
- C:\Windows\System\QlcySkd.exe
  C:\Windows\System\QlcySkd.exe
  2⤵
  PID:9284
- C:\Windows\System\LcbMoNH.exe
  C:\Windows\System\LcbMoNH.exe
  2⤵
  PID:9300
- C:\Windows\System\gcdpJii.exe
  C:\Windows\System\gcdpJii.exe
  2⤵
  PID:9316
- C:\Windows\System\oIBEwkB.exe
  C:\Windows\System\oIBEwkB.exe
  2⤵
  PID:9340
- C:\Windows\System\XFdzovP.exe
  C:\Windows\System\XFdzovP.exe
  2⤵
  PID:9364
- C:\Windows\System\nhWLTJH.exe
  C:\Windows\System\nhWLTJH.exe
  2⤵
  PID:9388
- C:\Windows\System\sNODdQo.exe
  C:\Windows\System\sNODdQo.exe
  2⤵
  PID:9404
- C:\Windows\System\qYOOwEI.exe
  C:\Windows\System\qYOOwEI.exe
  2⤵
  PID:9436
- C:\Windows\System\JpJVkbx.exe
  C:\Windows\System\JpJVkbx.exe
  2⤵
  PID:9464
- C:\Windows\System\DheNkfe.exe
  C:\Windows\System\DheNkfe.exe
  2⤵
  PID:9488
- C:\Windows\System\FuRqqYg.exe
  C:\Windows\System\FuRqqYg.exe
  2⤵
  PID:9516
- C:\Windows\System\wFHbaad.exe
  C:\Windows\System\wFHbaad.exe
  2⤵
  PID:9544
- C:\Windows\System\BNRcJnd.exe
  C:\Windows\System\BNRcJnd.exe
  2⤵
  PID:9576
- C:\Windows\System\oLimwsI.exe
  C:\Windows\System\oLimwsI.exe
  2⤵
  PID:9608
- C:\Windows\System\zfXWgIX.exe
  C:\Windows\System\zfXWgIX.exe
  2⤵
  PID:9628
- C:\Windows\System\dJRxOKj.exe
  C:\Windows\System\dJRxOKj.exe
  2⤵
  PID:9664
- C:\Windows\System\tlvRZow.exe
  C:\Windows\System\tlvRZow.exe
  2⤵
  PID:9688
- C:\Windows\System\AjrrPLR.exe
  C:\Windows\System\AjrrPLR.exe
  2⤵
  PID:9716
- C:\Windows\System\lGyIJiC.exe
  C:\Windows\System\lGyIJiC.exe
  2⤵
  PID:9736
- C:\Windows\System\ZztAWTi.exe
  C:\Windows\System\ZztAWTi.exe
  2⤵
  PID:9772
- C:\Windows\System\HKQnQYf.exe
  C:\Windows\System\HKQnQYf.exe
  2⤵
  PID:9788
- C:\Windows\System\BCVvFUk.exe
  C:\Windows\System\BCVvFUk.exe
  2⤵
  PID:9812
- C:\Windows\System\OYffzaz.exe
  C:\Windows\System\OYffzaz.exe
  2⤵
  PID:9832
- C:\Windows\System\CVQkLFQ.exe
  C:\Windows\System\CVQkLFQ.exe
  2⤵
  PID:9856
- C:\Windows\System\NIRifEw.exe
  C:\Windows\System\NIRifEw.exe
  2⤵
  PID:9884
- C:\Windows\System\aZiETZl.exe
  C:\Windows\System\aZiETZl.exe
  2⤵
  PID:9908
- C:\Windows\System\SqHrZMe.exe
  C:\Windows\System\SqHrZMe.exe
  2⤵
  PID:9924
- C:\Windows\System\brMfwXg.exe
  C:\Windows\System\brMfwXg.exe
  2⤵
  PID:9952
- C:\Windows\System\xsQXftR.exe
  C:\Windows\System\xsQXftR.exe
  2⤵
  PID:9980
- C:\Windows\System\ecEdTNT.exe
  C:\Windows\System\ecEdTNT.exe
  2⤵
  PID:10016
- C:\Windows\System\hQDeJmV.exe
  C:\Windows\System\hQDeJmV.exe
  2⤵
  PID:10044
- C:\Windows\System\NKjvxws.exe
  C:\Windows\System\NKjvxws.exe
  2⤵
  PID:10064
- C:\Windows\System\joYhoxW.exe
  C:\Windows\System\joYhoxW.exe
  2⤵
  PID:10096
- C:\Windows\System\LKsRhRs.exe
  C:\Windows\System\LKsRhRs.exe
  2⤵
  PID:10128
- C:\Windows\System\eRlIRDA.exe
  C:\Windows\System\eRlIRDA.exe
  2⤵
  PID:10156
- C:\Windows\System\QEznFJS.exe
  C:\Windows\System\QEznFJS.exe
  2⤵
  PID:10180
- C:\Windows\System\VENuhuS.exe
  C:\Windows\System\VENuhuS.exe
  2⤵
  PID:10200
- C:\Windows\System\VkASEih.exe
  C:\Windows\System\VkASEih.exe
  2⤵
  PID:10216
- C:\Windows\System\gVxvAlG.exe
  C:\Windows\System\gVxvAlG.exe
  2⤵
  PID:4136
- C:\Windows\System\qpomccE.exe
  C:\Windows\System\qpomccE.exe
  2⤵
  PID:9104
- C:\Windows\System\jLBVzGg.exe
  C:\Windows\System\jLBVzGg.exe
  2⤵
  PID:9024
- C:\Windows\System\ZOnGfoN.exe
  C:\Windows\System\ZOnGfoN.exe
  2⤵
  PID:9240
- C:\Windows\System\sImSdHV.exe
  C:\Windows\System\sImSdHV.exe
  2⤵
  PID:9296
- C:\Windows\System\SRdSqCU.exe
  C:\Windows\System\SRdSqCU.exe
  2⤵
  PID:9432
- C:\Windows\System\dApasDd.exe
  C:\Windows\System\dApasDd.exe
  2⤵
  PID:9512
- C:\Windows\System\tIsuRDV.exe
  C:\Windows\System\tIsuRDV.exe
  2⤵
  PID:9600
- C:\Windows\System\DZRHIkz.exe
  C:\Windows\System\DZRHIkz.exe
  2⤵
  PID:9536
- C:\Windows\System\oGaWEQW.exe
  C:\Windows\System\oGaWEQW.exe
  2⤵
  PID:9656
- C:\Windows\System\wIWbbQS.exe
  C:\Windows\System\wIWbbQS.exe
  2⤵
  PID:9724
- C:\Windows\System\UWmCggy.exe
  C:\Windows\System\UWmCggy.exe
  2⤵
  PID:9684
- C:\Windows\System\FuEtSbm.exe
  C:\Windows\System\FuEtSbm.exe
  2⤵
  PID:9920
- C:\Windows\System\PqzKEqF.exe
  C:\Windows\System\PqzKEqF.exe
  2⤵
  PID:9852
- C:\Windows\System\BddSINg.exe
  C:\Windows\System\BddSINg.exe
  2⤵
  PID:9904
- C:\Windows\System\VxxVTlt.exe
  C:\Windows\System\VxxVTlt.exe
  2⤵
  PID:9972
- C:\Windows\System\fXYyUUd.exe
  C:\Windows\System\fXYyUUd.exe
  2⤵
  PID:10028
- C:\Windows\System\TcVSXhD.exe
  C:\Windows\System\TcVSXhD.exe
  2⤵
  PID:10076
- C:\Windows\System\BuxMPRF.exe
  C:\Windows\System\BuxMPRF.exe
  2⤵
  PID:10108
- C:\Windows\System\pjRmLVX.exe
  C:\Windows\System\pjRmLVX.exe
  2⤵
  PID:10196
- C:\Windows\System\MMECFWR.exe
  C:\Windows\System\MMECFWR.exe
  2⤵
  PID:8748
- C:\Windows\System\eYZmJbo.exe
  C:\Windows\System\eYZmJbo.exe
  2⤵
  PID:9396
- C:\Windows\System\lYqbhNH.exe
  C:\Windows\System\lYqbhNH.exe
  2⤵
  PID:9508
- C:\Windows\System\sDCcwEx.exe
  C:\Windows\System\sDCcwEx.exe
  2⤵
  PID:9556
- C:\Windows\System\yZVnowo.exe
  C:\Windows\System\yZVnowo.exe
  2⤵
  PID:10056
- C:\Windows\System\ShmiAeY.exe
  C:\Windows\System\ShmiAeY.exe
  2⤵
  PID:9760
- C:\Windows\System\lnZxgfP.exe
  C:\Windows\System\lnZxgfP.exe
  2⤵
  PID:9292
- C:\Windows\System\sZuIHXl.exe
  C:\Windows\System\sZuIHXl.exe
  2⤵
  PID:10120
- C:\Windows\System\JYpiXOj.exe
  C:\Windows\System\JYpiXOj.exe
  2⤵
  PID:10248
- C:\Windows\System\qysOPlF.exe
  C:\Windows\System\qysOPlF.exe
  2⤵
  PID:10276
- C:\Windows\System\GCGgntC.exe
  C:\Windows\System\GCGgntC.exe
  2⤵
  PID:10304
- C:\Windows\System\gBeMRvu.exe
  C:\Windows\System\gBeMRvu.exe
  2⤵
  PID:10328
- C:\Windows\System\zoCvOtc.exe
  C:\Windows\System\zoCvOtc.exe
  2⤵
  PID:10356
- C:\Windows\System\rwxlzzF.exe
  C:\Windows\System\rwxlzzF.exe
  2⤵
  PID:10380
- C:\Windows\System\zUMlbxi.exe
  C:\Windows\System\zUMlbxi.exe
  2⤵
  PID:10412
- C:\Windows\System\qKGJQkj.exe
  C:\Windows\System\qKGJQkj.exe
  2⤵
  PID:10444
- C:\Windows\System\hbKqvuQ.exe
  C:\Windows\System\hbKqvuQ.exe
  2⤵
  PID:10468
- C:\Windows\System\BORZaVR.exe
  C:\Windows\System\BORZaVR.exe
  2⤵
  PID:10500
- C:\Windows\System\AkeSEOc.exe
  C:\Windows\System\AkeSEOc.exe
  2⤵
  PID:10528
- C:\Windows\System\gRDCIOd.exe
  C:\Windows\System\gRDCIOd.exe
  2⤵
  PID:10556
- C:\Windows\System\VPGBTgC.exe
  C:\Windows\System\VPGBTgC.exe
  2⤵
  PID:10584
- C:\Windows\System\ahsjQAd.exe
  C:\Windows\System\ahsjQAd.exe
  2⤵
  PID:10612
- C:\Windows\System\AKIQnjt.exe
  C:\Windows\System\AKIQnjt.exe
  2⤵
  PID:10652
- C:\Windows\System\cBMzEMw.exe
  C:\Windows\System\cBMzEMw.exe
  2⤵
  PID:10676
- C:\Windows\System\gRCqkYa.exe
  C:\Windows\System\gRCqkYa.exe
  2⤵
  PID:10708
- C:\Windows\System\JjbtkCc.exe
  C:\Windows\System\JjbtkCc.exe
  2⤵
  PID:10732
- C:\Windows\System\sUOevrA.exe
  C:\Windows\System\sUOevrA.exe
  2⤵
  PID:10756
- C:\Windows\System\FFCpgmG.exe
  C:\Windows\System\FFCpgmG.exe
  2⤵
  PID:10784
- C:\Windows\System\CfPotAl.exe
  C:\Windows\System\CfPotAl.exe
  2⤵
  PID:10804
- C:\Windows\System\KniOoTR.exe
  C:\Windows\System\KniOoTR.exe
  2⤵
  PID:11032
- C:\Windows\System\QAzhlQP.exe
  C:\Windows\System\QAzhlQP.exe
  2⤵
  PID:11064
- C:\Windows\System\mBpZiOg.exe
  C:\Windows\System\mBpZiOg.exe
  2⤵
  PID:11092
- C:\Windows\System\NPAvPOV.exe
  C:\Windows\System\NPAvPOV.exe
  2⤵
  PID:11112
- C:\Windows\System\rUDSyHN.exe
  C:\Windows\System\rUDSyHN.exe
  2⤵
  PID:11136
- C:\Windows\System\JopSBdy.exe
  C:\Windows\System\JopSBdy.exe
  2⤵
  PID:11168
- C:\Windows\System\Wfbfttp.exe
  C:\Windows\System\Wfbfttp.exe
  2⤵
  PID:11204
- C:\Windows\System\NlWPZQz.exe
  C:\Windows\System\NlWPZQz.exe
  2⤵
  PID:11228
- C:\Windows\System\QoaLkEZ.exe
  C:\Windows\System\QoaLkEZ.exe
  2⤵
  PID:11244
- C:\Windows\System\OCXidpb.exe
  C:\Windows\System\OCXidpb.exe
  2⤵
  PID:8836
- C:\Windows\System\Ylpauzh.exe
  C:\Windows\System\Ylpauzh.exe
  2⤵
  PID:9356
- C:\Windows\System\YpncVyZ.exe
  C:\Windows\System\YpncVyZ.exe
  2⤵
  PID:9476
- C:\Windows\System\zDuxJNj.exe
  C:\Windows\System\zDuxJNj.exe
  2⤵
  PID:10140
- C:\Windows\System\zByJrFB.exe
  C:\Windows\System\zByJrFB.exe
  2⤵
  PID:9916
- C:\Windows\System\BtxSqem.exe
  C:\Windows\System\BtxSqem.exe
  2⤵
  PID:10424
- C:\Windows\System\MjeHjJY.exe
  C:\Windows\System\MjeHjJY.exe
  2⤵
  PID:10324
- C:\Windows\System\IfppVvX.exe
  C:\Windows\System\IfppVvX.exe
  2⤵
  PID:10636
- C:\Windows\System\pYkNmby.exe
  C:\Windows\System\pYkNmby.exe
  2⤵
  PID:10724
- C:\Windows\System\jIfdrLO.exe
  C:\Windows\System\jIfdrLO.exe
  2⤵
  PID:10484
- C:\Windows\System\QWStuUW.exe
  C:\Windows\System\QWStuUW.exe
  2⤵
  PID:10608
- C:\Windows\System\oJBmFxg.exe
  C:\Windows\System\oJBmFxg.exe
  2⤵
  PID:10700
- C:\Windows\System\JyEwwiX.exe
  C:\Windows\System\JyEwwiX.exe
  2⤵
  PID:10840
- C:\Windows\System\SCnwcGB.exe
  C:\Windows\System\SCnwcGB.exe
  2⤵
  PID:10856
- C:\Windows\System\bCqAKdr.exe
  C:\Windows\System\bCqAKdr.exe
  2⤵
  PID:10880
- C:\Windows\System\jTgPrcn.exe
  C:\Windows\System\jTgPrcn.exe
  2⤵
  PID:10896
- C:\Windows\System\VwFDsfd.exe
  C:\Windows\System\VwFDsfd.exe
  2⤵
  PID:10924
- C:\Windows\System\JvIfHAn.exe
  C:\Windows\System\JvIfHAn.exe
  2⤵
  PID:10940
- C:\Windows\System\xQiIrZe.exe
  C:\Windows\System\xQiIrZe.exe
  2⤵
  PID:10972
- C:\Windows\System\mPdaHQQ.exe
  C:\Windows\System\mPdaHQQ.exe
  2⤵
  PID:10992
- C:\Windows\System\sHDsLSa.exe
  C:\Windows\System\sHDsLSa.exe
  2⤵
  PID:11012
- C:\Windows\System\gCybXRN.exe
  C:\Windows\System\gCybXRN.exe
  2⤵
  PID:11028
- C:\Windows\System\URmEWNd.exe
  C:\Windows\System\URmEWNd.exe
  2⤵
  PID:11088
- C:\Windows\System\roDpGbK.exe
  C:\Windows\System\roDpGbK.exe
  2⤵
  PID:10764
- C:\Windows\System\Urrrdot.exe
  C:\Windows\System\Urrrdot.exe
  2⤵
  PID:10640
- C:\Windows\System\PzslaDW.exe
  C:\Windows\System\PzslaDW.exe
  2⤵
  PID:9456
- C:\Windows\System\iKyyIjZ.exe
  C:\Windows\System\iKyyIjZ.exe
  2⤵
  PID:10452
- C:\Windows\System\kxjjNDx.exe
  C:\Windows\System\kxjjNDx.exe
  2⤵
  PID:8132
- C:\Windows\System\eCfzVAm.exe
  C:\Windows\System\eCfzVAm.exe
  2⤵
  PID:10872
- C:\Windows\System\ptnUdIe.exe
  C:\Windows\System\ptnUdIe.exe
  2⤵
  PID:10272
- C:\Windows\System\YbrrkDq.exe
  C:\Windows\System\YbrrkDq.exe
  2⤵
  PID:10404
- C:\Windows\System\fjhFLzQ.exe
  C:\Windows\System\fjhFLzQ.exe
  2⤵
  PID:11196
- C:\Windows\System\pgygzXr.exe
  C:\Windows\System\pgygzXr.exe
  2⤵
  PID:11160
- C:\Windows\System\mGQeRYo.exe
  C:\Windows\System\mGQeRYo.exe
  2⤵
  PID:11004
- C:\Windows\System\cfFwLZz.exe
  C:\Windows\System\cfFwLZz.exe
  2⤵
  PID:11020
- C:\Windows\System\kbfIzjQ.exe
  C:\Windows\System\kbfIzjQ.exe
  2⤵
  PID:11268
- C:\Windows\System\uTWiFdw.exe
  C:\Windows\System\uTWiFdw.exe
  2⤵
  PID:11292
- C:\Windows\System\AYLBLtc.exe
  C:\Windows\System\AYLBLtc.exe
  2⤵
  PID:11312
- C:\Windows\System\YVpMbph.exe
  C:\Windows\System\YVpMbph.exe
  2⤵
  PID:11336
- C:\Windows\System\FJXCWyS.exe
  C:\Windows\System\FJXCWyS.exe
  2⤵
  PID:11368
- C:\Windows\System\gGXRiUl.exe
  C:\Windows\System\gGXRiUl.exe
  2⤵
  PID:11388
- C:\Windows\System\mgFnkwZ.exe
  C:\Windows\System\mgFnkwZ.exe
  2⤵
  PID:11408
- C:\Windows\System\lLrlqxO.exe
  C:\Windows\System\lLrlqxO.exe
  2⤵
  PID:11440
- C:\Windows\System\oevqvkI.exe
  C:\Windows\System\oevqvkI.exe
  2⤵
  PID:11460
- C:\Windows\System\dIiltnE.exe
  C:\Windows\System\dIiltnE.exe
  2⤵
  PID:11488
- C:\Windows\System\zzAeFSw.exe
  C:\Windows\System\zzAeFSw.exe
  2⤵
  PID:11512
- C:\Windows\System\cESpdbR.exe
  C:\Windows\System\cESpdbR.exe
  2⤵
  PID:11536
- C:\Windows\System\IPlretG.exe
  C:\Windows\System\IPlretG.exe
  2⤵
  PID:11560
- C:\Windows\System\OJpynyj.exe
  C:\Windows\System\OJpynyj.exe
  2⤵
  PID:11580
- C:\Windows\System\yIXAojD.exe
  C:\Windows\System\yIXAojD.exe
  2⤵
  PID:11604
- C:\Windows\System\JGufPLt.exe
  C:\Windows\System\JGufPLt.exe
  2⤵
  PID:11628
- C:\Windows\System\HhdZwyU.exe
  C:\Windows\System\HhdZwyU.exe
  2⤵
  PID:11652
- C:\Windows\System\OafGOlB.exe
  C:\Windows\System\OafGOlB.exe
  2⤵
  PID:11684
- C:\Windows\System\MQYrgdv.exe
  C:\Windows\System\MQYrgdv.exe
  2⤵
  PID:11704
- C:\Windows\System\wcdyJIM.exe
  C:\Windows\System\wcdyJIM.exe
  2⤵
  PID:11724
- C:\Windows\System\TaNyBMS.exe
  C:\Windows\System\TaNyBMS.exe
  2⤵
  PID:11752
- C:\Windows\System\SjtIAhc.exe
  C:\Windows\System\SjtIAhc.exe
  2⤵
  PID:11784
- C:\Windows\System\SeOXpFG.exe
  C:\Windows\System\SeOXpFG.exe
  2⤵
  PID:11804
- C:\Windows\System\zqaLPaH.exe
  C:\Windows\System\zqaLPaH.exe
  2⤵
  PID:11828
- C:\Windows\System\XAjhajU.exe
  C:\Windows\System\XAjhajU.exe
  2⤵
  PID:11852
- C:\Windows\System\zsQXrrQ.exe
  C:\Windows\System\zsQXrrQ.exe
  2⤵
  PID:11880
- C:\Windows\System\ptCUQpY.exe
  C:\Windows\System\ptCUQpY.exe
  2⤵
  PID:11908
- C:\Windows\System\WXfCYkh.exe
  C:\Windows\System\WXfCYkh.exe
  2⤵
  PID:11928
- C:\Windows\System\UmTZzvF.exe
  C:\Windows\System\UmTZzvF.exe
  2⤵
  PID:11948
- C:\Windows\System\jOmXvNW.exe
  C:\Windows\System\jOmXvNW.exe
  2⤵
  PID:11972
- C:\Windows\System\asDdFqy.exe
  C:\Windows\System\asDdFqy.exe
  2⤵
  PID:11996
- C:\Windows\System\VSJzHng.exe
  C:\Windows\System\VSJzHng.exe
  2⤵
  PID:12016
- C:\Windows\System\MJduyZT.exe
  C:\Windows\System\MJduyZT.exe
  2⤵
  PID:12040
- C:\Windows\System\lrNOYDX.exe
  C:\Windows\System\lrNOYDX.exe
  2⤵
  PID:12068
- C:\Windows\System\pVprRfU.exe
  C:\Windows\System\pVprRfU.exe
  2⤵
  PID:12092
- C:\Windows\System\dxKhxkz.exe
  C:\Windows\System\dxKhxkz.exe
  2⤵
  PID:12120
- C:\Windows\System\OWQDCgO.exe
  C:\Windows\System\OWQDCgO.exe
  2⤵
  PID:12136
- C:\Windows\System\OKPZGwL.exe
  C:\Windows\System\OKPZGwL.exe
  2⤵
  PID:12164
- C:\Windows\System\RCZpqEc.exe
  C:\Windows\System\RCZpqEc.exe
  2⤵
  PID:12188
- C:\Windows\System\DDTURyx.exe
  C:\Windows\System\DDTURyx.exe
  2⤵
  PID:12220
- C:\Windows\System\JQIpYFO.exe
  C:\Windows\System\JQIpYFO.exe
  2⤵
  PID:12236
- C:\Windows\System\CgkwHWY.exe
  C:\Windows\System\CgkwHWY.exe
  2⤵
  PID:12260
- C:\Windows\System\LHaBIhb.exe
  C:\Windows\System\LHaBIhb.exe
  2⤵
  PID:10800
- C:\Windows\System\RPhkIlW.exe
  C:\Windows\System\RPhkIlW.exe
  2⤵
  PID:10436
- C:\Windows\System\YMcGMGR.exe
  C:\Windows\System\YMcGMGR.exe
  2⤵
  PID:11048
- C:\Windows\System\oDMcCau.exe
  C:\Windows\System\oDMcCau.exe
  2⤵
  PID:10460
- C:\Windows\System\jZgqIeQ.exe
  C:\Windows\System\jZgqIeQ.exe
  2⤵
  PID:11080
- C:\Windows\System\ckgrZBT.exe
  C:\Windows\System\ckgrZBT.exe
  2⤵
  PID:11144
- C:\Windows\System\UXPCrKJ.exe
  C:\Windows\System\UXPCrKJ.exe
  2⤵
  PID:11348
- C:\Windows\System\VpCjFpb.exe
  C:\Windows\System\VpCjFpb.exe
  2⤵
  PID:11188
- C:\Windows\System\vyYIrSz.exe
  C:\Windows\System\vyYIrSz.exe
  2⤵
  PID:10752
- C:\Windows\System\ughbUFq.exe
  C:\Windows\System\ughbUFq.exe
  2⤵
  PID:11676
- C:\Windows\System\hmsuoPa.exe
  C:\Windows\System\hmsuoPa.exe
  2⤵
  PID:11376
- C:\Windows\System\VIlKFHT.exe
  C:\Windows\System\VIlKFHT.exe
  2⤵
  PID:11416
- C:\Windows\System\GJsSQIA.exe
  C:\Windows\System\GJsSQIA.exe
  2⤵
  PID:9964
- C:\Windows\System\wWYmYZQ.exe
  C:\Windows\System\wWYmYZQ.exe
  2⤵
  PID:11820
- C:\Windows\System\ZEocfUj.exe
  C:\Windows\System\ZEocfUj.exe
  2⤵
  PID:11572
- C:\Windows\System\QxjQzly.exe
  C:\Windows\System\QxjQzly.exe
  2⤵
  PID:11984
- C:\Windows\System\GSkcDhY.exe
  C:\Windows\System\GSkcDhY.exe
  2⤵
  PID:12008
- C:\Windows\System\EirdCZI.exe
  C:\Windows\System\EirdCZI.exe
  2⤵
  PID:12052
- C:\Windows\System\mGGqSLh.exe
  C:\Windows\System\mGGqSLh.exe
  2⤵
  PID:12200
- C:\Windows\System\AfbnDPN.exe
  C:\Windows\System\AfbnDPN.exe
  2⤵
  PID:12324
- C:\Windows\System\RDLOWLb.exe
  C:\Windows\System\RDLOWLb.exe
  2⤵
  PID:12340
- C:\Windows\System\bYRJHCa.exe
  C:\Windows\System\bYRJHCa.exe
  2⤵
  PID:12364
- C:\Windows\System\OOaBgut.exe
  C:\Windows\System\OOaBgut.exe
  2⤵
  PID:12384
- C:\Windows\System\ARMpmIj.exe
  C:\Windows\System\ARMpmIj.exe
  2⤵
  PID:12408
- C:\Windows\System\HlcRPwP.exe
  C:\Windows\System\HlcRPwP.exe
  2⤵
  PID:12428
- C:\Windows\System\VxiGLHV.exe
  C:\Windows\System\VxiGLHV.exe
  2⤵
  PID:12456
- C:\Windows\System\oTrkEzY.exe
  C:\Windows\System\oTrkEzY.exe
  2⤵
  PID:12700
- C:\Windows\System\FSjpnzn.exe
  C:\Windows\System\FSjpnzn.exe
  2⤵
  PID:12720
- C:\Windows\System\cqLavma.exe
  C:\Windows\System\cqLavma.exe
  2⤵
  PID:12740
- C:\Windows\System\XlAUVBC.exe
  C:\Windows\System\XlAUVBC.exe
  2⤵
  PID:12768
- C:\Windows\System\rQFiZQN.exe
  C:\Windows\System\rQFiZQN.exe
  2⤵
  PID:12792
- C:\Windows\System\mpHKFHX.exe
  C:\Windows\System\mpHKFHX.exe
  2⤵
  PID:12812
- C:\Windows\System\VSxybVZ.exe
  C:\Windows\System\VSxybVZ.exe
  2⤵
  PID:12844
- C:\Windows\System\XqQPDkp.exe
  C:\Windows\System\XqQPDkp.exe
  2⤵
  PID:12868
- C:\Windows\System\XsUkzZs.exe
  C:\Windows\System\XsUkzZs.exe
  2⤵
  PID:12912
- C:\Windows\System\XfCRMlz.exe
  C:\Windows\System\XfCRMlz.exe
  2⤵
  PID:12940
- C:\Windows\System\UskvDRJ.exe
  C:\Windows\System\UskvDRJ.exe
  2⤵
  PID:12992
- C:\Windows\System\GKOYMPp.exe
  C:\Windows\System\GKOYMPp.exe
  2⤵
  PID:13020
- C:\Windows\System\NtslcjX.exe
  C:\Windows\System\NtslcjX.exe
  2⤵
  PID:13040
- C:\Windows\System\KFVwMWH.exe
  C:\Windows\System\KFVwMWH.exe
  2⤵
  PID:13084
- C:\Windows\System\itGctwj.exe
  C:\Windows\System\itGctwj.exe
  2⤵
  PID:13264
- C:\Windows\System\fVSWcvu.exe
  C:\Windows\System\fVSWcvu.exe
  2⤵
  PID:13292
- C:\Windows\System\RanoMos.exe
  C:\Windows\System\RanoMos.exe
  2⤵
  PID:11864
- C:\Windows\System\QpnGUqH.exe
  C:\Windows\System\QpnGUqH.exe
  2⤵
  PID:11236
- C:\Windows\System\cwOHirh.exe
  C:\Windows\System\cwOHirh.exe
  2⤵
  PID:11120
- C:\Windows\System\EoMnjWq.exe
  C:\Windows\System\EoMnjWq.exe
  2⤵
  PID:10696
- C:\Windows\System\ZTfAiEy.exe
  C:\Windows\System\ZTfAiEy.exe
  2⤵
  PID:12104
- C:\Windows\System\mFZWbsB.exe
  C:\Windows\System\mFZWbsB.exe
  2⤵
  PID:11764
- C:\Windows\System\vhRmlaC.exe
  C:\Windows\System\vhRmlaC.exe
  2⤵
  PID:11456
- C:\Windows\System\BmiPGDX.exe
  C:\Windows\System\BmiPGDX.exe
  2⤵
  PID:11508
- C:\Windows\System\Bdrxwkq.exe
  C:\Windows\System\Bdrxwkq.exe
  2⤵
  PID:12060
- C:\Windows\System\kxFPRaj.exe
  C:\Windows\System\kxFPRaj.exe
  2⤵
  PID:11400
- C:\Windows\System\uoUqUFb.exe
  C:\Windows\System\uoUqUFb.exe
  2⤵
  PID:11480
- C:\Windows\System\ajbCqbF.exe
  C:\Windows\System\ajbCqbF.exe
  2⤵
  PID:12148
- C:\Windows\System\tlADEeJ.exe
  C:\Windows\System\tlADEeJ.exe
  2⤵
  PID:11596
- C:\Windows\System\BRuAdvO.exe
  C:\Windows\System\BRuAdvO.exe
  2⤵
  PID:12332
- C:\Windows\System\THOPuUd.exe
  C:\Windows\System\THOPuUd.exe
  2⤵
  PID:12436
- C:\Windows\System\LxMkfGp.exe
  C:\Windows\System\LxMkfGp.exe
  2⤵
  PID:12680
- C:\Windows\System\iOVqNpu.exe
  C:\Windows\System\iOVqNpu.exe
  2⤵
  PID:12780
- C:\Windows\System\aMqwwZt.exe
  C:\Windows\System\aMqwwZt.exe
  2⤵
  PID:12892
- C:\Windows\System\hhZzRrR.exe
  C:\Windows\System\hhZzRrR.exe
  2⤵
  PID:13216
- C:\Windows\System\pyQXFoa.exe
  C:\Windows\System\pyQXFoa.exe
  2⤵
  PID:12696
- C:\Windows\System\aeovFBu.exe
  C:\Windows\System\aeovFBu.exe
  2⤵
  PID:13240
- C:\Windows\System\xzbGZOF.exe
  C:\Windows\System\xzbGZOF.exe
  2⤵
  PID:12828
- C:\Windows\System\raVTseD.exe
  C:\Windows\System\raVTseD.exe
  2⤵
  PID:13304
- C:\Windows\System\TJDhZId.exe
  C:\Windows\System\TJDhZId.exe
  2⤵
  PID:13192
- C:\Windows\System\lCyicvD.exe
  C:\Windows\System\lCyicvD.exe
  2⤵
  PID:13036
- C:\Windows\System\PpnQRSW.exe
  C:\Windows\System\PpnQRSW.exe
  2⤵
  PID:12100
- C:\Windows\System\pDmuAfg.exe
  C:\Windows\System\pDmuAfg.exe
  2⤵
  PID:10908
- C:\Windows\System\uPWmUxD.exe
  C:\Windows\System\uPWmUxD.exe
  2⤵
  PID:11916
- C:\Windows\System\ilyygtp.exe
  C:\Windows\System\ilyygtp.exe
  2⤵
  PID:11944
- C:\Windows\System\DJckCfN.exe
  C:\Windows\System\DJckCfN.exe
  2⤵
  PID:12076
- C:\Windows\System\wIaxZHv.exe
  C:\Windows\System\wIaxZHv.exe
  2⤵
  PID:10260
- C:\Windows\System\uXzwNne.exe
  C:\Windows\System\uXzwNne.exe
  2⤵
  PID:12372
- C:\Windows\System\IMaAFGR.exe
  C:\Windows\System\IMaAFGR.exe
  2⤵
  PID:11636
- C:\Windows\System\WjbAFDf.exe
  C:\Windows\System\WjbAFDf.exe
  2⤵
  PID:12736
- C:\Windows\System\LXDEFjj.exe
  C:\Windows\System\LXDEFjj.exe
  2⤵
  PID:12280
- C:\Windows\System\oJyRtDV.exe
  C:\Windows\System\oJyRtDV.exe
  2⤵
  PID:12640
- C:\Windows\System\daewepw.exe
  C:\Windows\System\daewepw.exe
  2⤵
  PID:12776
- C:\Windows\System\AcdPVth.exe
  C:\Windows\System\AcdPVth.exe
  2⤵
  PID:11640
- C:\Windows\System\JedPuKV.exe
  C:\Windows\System\JedPuKV.exe
  2⤵
  PID:13140
- C:\Windows\System\BBdIgpn.exe
  C:\Windows\System\BBdIgpn.exe
  2⤵
  PID:12576
- C:\Windows\System\iBogfWq.exe
  C:\Windows\System\iBogfWq.exe
  2⤵
  PID:13160
- C:\Windows\System\zRAJtNl.exe
  C:\Windows\System\zRAJtNl.exe
  2⤵
  PID:12156
- C:\Windows\System\JKpgWdy.exe
  C:\Windows\System\JKpgWdy.exe
  2⤵
  PID:13324
- C:\Windows\System\RLVKoTy.exe
  C:\Windows\System\RLVKoTy.exe
  2⤵
  PID:13344
- C:\Windows\System\iXKRPdE.exe
  C:\Windows\System\iXKRPdE.exe
  2⤵
  PID:13372
- C:\Windows\System\OTASlBx.exe
  C:\Windows\System\OTASlBx.exe
  2⤵
  PID:13392
- C:\Windows\System\xZVRMnR.exe
  C:\Windows\System\xZVRMnR.exe
  2⤵
  PID:13416
- C:\Windows\System\EHVfxUy.exe
  C:\Windows\System\EHVfxUy.exe
  2⤵
  PID:13444
- C:\Windows\System\EhqMJSN.exe
  C:\Windows\System\EhqMJSN.exe
  2⤵
  PID:13464
- C:\Windows\System\cEKUdvi.exe
  C:\Windows\System\cEKUdvi.exe
  2⤵
  PID:13484
- C:\Windows\System\iqqnpfI.exe
  C:\Windows\System\iqqnpfI.exe
  2⤵
  PID:13512
- C:\Windows\System\xGlaxNt.exe
  C:\Windows\System\xGlaxNt.exe
  2⤵
  PID:13528
- C:\Windows\System\NdbboMY.exe
  C:\Windows\System\NdbboMY.exe
  2⤵
  PID:13560
- C:\Windows\System\lWrhVuO.exe
  C:\Windows\System\lWrhVuO.exe
  2⤵
  PID:13584
- C:\Windows\System\PBetLaA.exe
  C:\Windows\System\PBetLaA.exe
  2⤵
  PID:13612
- C:\Windows\System\FYRfbAI.exe
  C:\Windows\System\FYRfbAI.exe
  2⤵
  PID:13632
- C:\Windows\System\rfxrjbi.exe
  C:\Windows\System\rfxrjbi.exe
  2⤵
  PID:13656
- C:\Windows\System\YcDeBai.exe
  C:\Windows\System\YcDeBai.exe
  2⤵
  PID:13676
- C:\Windows\System\HVLIVKI.exe
  C:\Windows\System\HVLIVKI.exe
  2⤵
  PID:13700
- C:\Windows\System\FArBizk.exe
  C:\Windows\System\FArBizk.exe
  2⤵
  PID:13724
- C:\Windows\System\qJCluQP.exe
  C:\Windows\System\qJCluQP.exe
  2⤵
  PID:13752
- C:\Windows\System\ytCkUFF.exe
  C:\Windows\System\ytCkUFF.exe
  2⤵
  PID:13776
- C:\Windows\System\zAkIXMo.exe
  C:\Windows\System\zAkIXMo.exe
  2⤵
  PID:13808
- C:\Windows\System\XaAYbAN.exe
  C:\Windows\System\XaAYbAN.exe
  2⤵
  PID:13828
- C:\Windows\System\FOLHrCu.exe
  C:\Windows\System\FOLHrCu.exe
  2⤵
  PID:13852
- C:\Windows\System\cNekNYY.exe
  C:\Windows\System\cNekNYY.exe
  2⤵
  PID:13868
- C:\Windows\System\jCgIfIj.exe
  C:\Windows\System\jCgIfIj.exe
  2⤵
  PID:13900
- C:\Windows\System\tsCihqM.exe
  C:\Windows\System\tsCihqM.exe
  2⤵
  PID:14012
- C:\Windows\System\XpniEqF.exe
  C:\Windows\System\XpniEqF.exe
  2⤵
  PID:14040
- C:\Windows\System\mWMOGjO.exe
  C:\Windows\System\mWMOGjO.exe
  2⤵
  PID:14068
- C:\Windows\System\UQsfXEG.exe
  C:\Windows\System\UQsfXEG.exe
  2⤵
  PID:14092
- C:\Windows\System\wSPtjty.exe
  C:\Windows\System\wSPtjty.exe
  2⤵
  PID:14120
- C:\Windows\System\cxtWtoH.exe
  C:\Windows\System\cxtWtoH.exe
  2⤵
  PID:14152
- C:\Windows\System\gqEXxzm.exe
  C:\Windows\System\gqEXxzm.exe
  2⤵
  PID:14180
- C:\Windows\System\iRasauj.exe
  C:\Windows\System\iRasauj.exe
  2⤵
  PID:14204
- C:\Windows\System\FumUiFI.exe
  C:\Windows\System\FumUiFI.exe
  2⤵
  PID:14244
- C:\Windows\System\dcXofPF.exe
  C:\Windows\System\dcXofPF.exe
  2⤵
  PID:14280
- C:\Windows\System\CYRkAWF.exe
  C:\Windows\System\CYRkAWF.exe
  2⤵
  PID:14308
- C:\Windows\System\ptbjjGg.exe
  C:\Windows\System\ptbjjGg.exe
  2⤵
  PID:12228
- C:\Windows\System\SYptXOk.exe
  C:\Windows\System\SYptXOk.exe
  2⤵
  PID:12656
- C:\Windows\System\OOpisYa.exe
  C:\Windows\System\OOpisYa.exe
  2⤵
  PID:11848
- C:\Windows\System\NQarWcC.exe
  C:\Windows\System\NQarWcC.exe
  2⤵
  PID:12628
- C:\Windows\System\SsAzeSX.exe
  C:\Windows\System\SsAzeSX.exe
  2⤵
  PID:13440
- C:\Windows\System\ikFdeaC.exe
  C:\Windows\System\ikFdeaC.exe
  2⤵
  PID:12964
- C:\Windows\System\ZeQJPuU.exe
  C:\Windows\System\ZeQJPuU.exe
  2⤵
  PID:14148
- C:\Windows\System\MfDmmUj.exe
  C:\Windows\System\MfDmmUj.exe
  2⤵
  PID:13804
- C:\Windows\System\eIwHSiV.exe
  C:\Windows\System\eIwHSiV.exe
  2⤵
  PID:14272
- C:\Windows\System\PgfDRVR.exe
  C:\Windows\System\PgfDRVR.exe
  2⤵
  PID:14276
- C:\Windows\System\YpCvcWB.exe
  C:\Windows\System\YpCvcWB.exe
  2⤵
  PID:14108
- C:\Windows\System\VRTYxng.exe
  C:\Windows\System\VRTYxng.exe
  2⤵
  PID:14192
- C:\Windows\System\lSSTgjt.exe
  C:\Windows\System\lSSTgjt.exe
  2⤵
  PID:13432
- C:\Windows\System\rpMcgtJ.exe
  C:\Windows\System\rpMcgtJ.exe
  2⤵
  PID:13428
- C:\Windows\System\CSchGtf.exe
  C:\Windows\System\CSchGtf.exe
  2⤵
  PID:13984
- C:\Windows\System\rFreKYK.exe
  C:\Windows\System\rFreKYK.exe
  2⤵
  PID:13892
- C:\Windows\System\dFEeINx.exe
  C:\Windows\System\dFEeINx.exe
  2⤵
  PID:14104
- C:\Windows\System\uzOqWoj.exe
  C:\Windows\System\uzOqWoj.exe
  2⤵
  PID:14024
- C:\Windows\System\AqXYiAt.exe
  C:\Windows\System\AqXYiAt.exe
  2⤵
  PID:14060
- C:\Windows\System\ONiCLXh.exe
  C:\Windows\System\ONiCLXh.exe
  2⤵
  PID:13600
- C:\Windows\System\MdYddle.exe
  C:\Windows\System\MdYddle.exe
  2⤵
  PID:14256
- C:\Windows\System\YLMoDOM.exe
  C:\Windows\System\YLMoDOM.exe
  2⤵
  PID:14036
- C:\Windows\System\UTBlnDu.exe
  C:\Windows\System\UTBlnDu.exe
  2⤵
  PID:14344
- C:\Windows\System\AgykOwZ.exe
  C:\Windows\System\AgykOwZ.exe
  2⤵
  PID:14368
- C:\Windows\System\gpuSisE.exe
  C:\Windows\System\gpuSisE.exe
  2⤵
  PID:14400
- C:\Windows\System\KJyZNsV.exe
  C:\Windows\System\KJyZNsV.exe
  2⤵
  PID:14420
- C:\Windows\System\jJJsfvb.exe
  C:\Windows\System\jJJsfvb.exe
  2⤵
  PID:14440
- C:\Windows\System\BuKOjOz.exe
  C:\Windows\System\BuKOjOz.exe
  2⤵
  PID:14468
- C:\Windows\System\OBJPGRR.exe
  C:\Windows\System\OBJPGRR.exe
  2⤵
  PID:14484
- C:\Windows\System\aGxmXtw.exe
  C:\Windows\System\aGxmXtw.exe
  2⤵
  PID:14508
- C:\Windows\System\poJGudx.exe
  C:\Windows\System\poJGudx.exe
  2⤵
  PID:14540
- C:\Windows\System\KKTptOI.exe
  C:\Windows\System\KKTptOI.exe
  2⤵
  PID:14560
- C:\Windows\System\KHekGst.exe
  C:\Windows\System\KHekGst.exe
  2⤵
  PID:14584
- C:\Windows\System\UhOMPgH.exe
  C:\Windows\System\UhOMPgH.exe
  2⤵
  PID:14600
- C:\Windows\System\hHuNhpf.exe
  C:\Windows\System\hHuNhpf.exe
  2⤵
  PID:14628
- C:\Windows\System\jSezMgE.exe
  C:\Windows\System\jSezMgE.exe
  2⤵
  PID:14652
- C:\Windows\System\qVraNDq.exe
  C:\Windows\System\qVraNDq.exe
  2⤵
  PID:14676
- C:\Windows\System\VliQzuh.exe
  C:\Windows\System\VliQzuh.exe
  2⤵
  PID:14700
- C:\Windows\System\OQBLZNh.exe
  C:\Windows\System\OQBLZNh.exe
  2⤵
  PID:14740
- C:\Windows\System\dYZRAPW.exe
  C:\Windows\System\dYZRAPW.exe
  2⤵
  PID:14756
- C:\Windows\System\HqvLnvW.exe
  C:\Windows\System\HqvLnvW.exe
  2⤵
  PID:14780
- C:\Windows\System\XnQUfrs.exe
  C:\Windows\System\XnQUfrs.exe
  2⤵
  PID:14808
- C:\Windows\System\AWZLDko.exe
  C:\Windows\System\AWZLDko.exe
  2⤵
  PID:14848
- C:\Windows\System\LrFcQzX.exe
  C:\Windows\System\LrFcQzX.exe
  2⤵
  PID:14880
- C:\Windows\System\gaEjqZr.exe
  C:\Windows\System\gaEjqZr.exe
  2⤵
  PID:14912
- C:\Windows\System\QpLJkMJ.exe
  C:\Windows\System\QpLJkMJ.exe
  2⤵
  PID:14940
- C:\Windows\System\mTgstee.exe
  C:\Windows\System\mTgstee.exe
  2⤵
  PID:14968
- C:\Windows\System\ENIdYbK.exe
  C:\Windows\System\ENIdYbK.exe
  2⤵
  PID:15000
- C:\Windows\System\HeytjgT.exe
  C:\Windows\System\HeytjgT.exe
  2⤵
  PID:15024
- C:\Windows\System\wBxjJNA.exe
  C:\Windows\System\wBxjJNA.exe
  2⤵
  PID:15040
- C:\Windows\System\RTAEJHT.exe
  C:\Windows\System\RTAEJHT.exe
  2⤵
  PID:15056
- C:\Windows\System\kYgmLrP.exe
  C:\Windows\System\kYgmLrP.exe
  2⤵
  PID:15084
- C:\Windows\System\vZkfbrS.exe
  C:\Windows\System\vZkfbrS.exe
  2⤵
  PID:15100
- C:\Windows\System\QPYpHnE.exe
  C:\Windows\System\QPYpHnE.exe
  2⤵
  PID:15132
- C:\Windows\System\MRfcTcD.exe
  C:\Windows\System\MRfcTcD.exe
  2⤵
  PID:15160
- C:\Windows\System\TYCHtNY.exe
  C:\Windows\System\TYCHtNY.exe
  2⤵
  PID:15180
- C:\Windows\System\IOHTJmI.exe
  C:\Windows\System\IOHTJmI.exe
  2⤵
  PID:15208
- C:\Windows\System\YmCEwxB.exe
  C:\Windows\System\YmCEwxB.exe
  2⤵
  PID:15232
- C:\Windows\System\Ltxttzw.exe
  C:\Windows\System\Ltxttzw.exe
  2⤵
  PID:15248
- C:\Windows\System\fGsGrhz.exe
  C:\Windows\System\fGsGrhz.exe
  2⤵
  PID:15268
- C:\Windows\System\cOrgbKJ.exe
  C:\Windows\System\cOrgbKJ.exe
  2⤵
  PID:15288
- C:\Windows\System\EQouDPG.exe
  C:\Windows\System\EQouDPG.exe
  2⤵
  PID:15316
- C:\Windows\System\AGTALBr.exe
  C:\Windows\System\AGTALBr.exe
  2⤵
  PID:15332
- C:\Windows\System\IHuOjcD.exe
  C:\Windows\System\IHuOjcD.exe
  2⤵
  PID:15348
- C:\Windows\System\eYoGyVJ.exe
  C:\Windows\System\eYoGyVJ.exe
  2⤵
  PID:13320
- C:\Windows\System\aNvQTtf.exe
  C:\Windows\System\aNvQTtf.exe
  2⤵
  PID:14296
- C:\Windows\System\cfWpVdJ.exe
  C:\Windows\System\cfWpVdJ.exe
  2⤵
  PID:14376
- C:\Windows\System\fGtiOzF.exe
  C:\Windows\System\fGtiOzF.exe
  2⤵
  PID:14436
- C:\Windows\System\hsMcvyl.exe
  C:\Windows\System\hsMcvyl.exe
  2⤵
  PID:14504
- C:\Windows\System\yBmPYqz.exe
  C:\Windows\System\yBmPYqz.exe
  2⤵
  PID:14428
- C:\Windows\System\IcJjOLM.exe
  C:\Windows\System\IcJjOLM.exe
  2⤵
  PID:14532
- C:\Windows\System\MLCruUQ.exe
  C:\Windows\System\MLCruUQ.exe
  2⤵
  PID:14480
- C:\Windows\System\AwLgRgO.exe
  C:\Windows\System\AwLgRgO.exe
  2⤵
  PID:14764
- C:\Windows\System\gTMzcBF.exe
  C:\Windows\System\gTMzcBF.exe
  2⤵
  PID:14816
- C:\Windows\System\DJNajUX.exe
  C:\Windows\System\DJNajUX.exe
  2⤵
  PID:14576
- C:\Windows\System\KciPqgc.exe
  C:\Windows\System\KciPqgc.exe
  2⤵
  PID:14716
- C:\Windows\System\KlZXOGu.exe
  C:\Windows\System\KlZXOGu.exe
  2⤵
  PID:14752
- C:\Windows\System\kVnieSV.exe
  C:\Windows\System\kVnieSV.exe
  2⤵
  PID:14788
- C:\Windows\System\WRXwOxO.exe
  C:\Windows\System\WRXwOxO.exe
  2⤵
  PID:14864
- C:\Windows\System\XFhiaHg.exe
  C:\Windows\System\XFhiaHg.exe
  2⤵
  PID:15172
- C:\Windows\System\YkWGYAi.exe
  C:\Windows\System\YkWGYAi.exe
  2⤵
  PID:15244
- C:\Windows\System\gckihzA.exe
  C:\Windows\System\gckihzA.exe
  2⤵
  PID:15328
- C:\Windows\System\hBCKtod.exe
  C:\Windows\System\hBCKtod.exe
  2⤵
  PID:15224
- C:\Windows\System\hZBEisB.exe
  C:\Windows\System\hZBEisB.exe
  2⤵
  PID:15256
- C:\Windows\System\ykXyQuI.exe
  C:\Windows\System\ykXyQuI.exe
  2⤵
  PID:15304
- C:\Windows\System\jgGvqmR.exe
  C:\Windows\System\jgGvqmR.exe
  2⤵
  PID:15380
- C:\Windows\System\SyvIEZX.exe
  C:\Windows\System\SyvIEZX.exe
  2⤵
  PID:15396
- C:\Windows\System\OQUbGxQ.exe
  C:\Windows\System\OQUbGxQ.exe
  2⤵
  PID:15424
- C:\Windows\System\SqEEIKp.exe
  C:\Windows\System\SqEEIKp.exe
  2⤵
  PID:15460
- C:\Windows\System\apwfRqA.exe
  C:\Windows\System\apwfRqA.exe
  2⤵
  PID:15480
- C:\Windows\System\ZhUmbbw.exe
  C:\Windows\System\ZhUmbbw.exe
  2⤵
  PID:15508
- C:\Windows\System\NqDcbNv.exe
  C:\Windows\System\NqDcbNv.exe
  2⤵
  PID:15532
- C:\Windows\System\kALXIQs.exe
  C:\Windows\System\kALXIQs.exe
  2⤵
  PID:15556
- C:\Windows\System\KHiGnzh.exe
  C:\Windows\System\KHiGnzh.exe
  2⤵
  PID:15584
- C:\Windows\System\YXRifxc.exe
  C:\Windows\System\YXRifxc.exe
  2⤵
  PID:15616
- C:\Windows\System\eKfCLBL.exe
  C:\Windows\System\eKfCLBL.exe
  2⤵
  PID:15632
- C:\Windows\System\LInbBxX.exe
  C:\Windows\System\LInbBxX.exe
  2⤵
  PID:15652
- C:\Windows\System\RAaoYWM.exe
  C:\Windows\System\RAaoYWM.exe
  2⤵
  PID:15676
- C:\Windows\System\fvctQVN.exe
  C:\Windows\System\fvctQVN.exe
  2⤵
  PID:15700
- C:\Windows\System\hmxhUJg.exe
  C:\Windows\System\hmxhUJg.exe
  2⤵
  PID:15736
- C:\Windows\System\HWiqutk.exe
  C:\Windows\System\HWiqutk.exe
  2⤵
  PID:15760
- C:\Windows\System\dXnShEw.exe
  C:\Windows\System\dXnShEw.exe
  2⤵
  PID:15780
- C:\Windows\System\eaPumDt.exe
  C:\Windows\System\eaPumDt.exe
  2⤵
  PID:15808
- C:\Windows\System\yDMnCHS.exe
  C:\Windows\System\yDMnCHS.exe
  2⤵
  PID:15844
- C:\Windows\System\LKRqhFB.exe
  C:\Windows\System\LKRqhFB.exe
  2⤵
  PID:15864
- C:\Windows\System\uLBHekT.exe
  C:\Windows\System\uLBHekT.exe
  2⤵
  PID:15884
- C:\Windows\System\CFixtTu.exe
  C:\Windows\System\CFixtTu.exe
  2⤵
  PID:15920
- C:\Windows\System\ZROtEQm.exe
  C:\Windows\System\ZROtEQm.exe
  2⤵
  PID:15940
- C:\Windows\System\VDMbOyL.exe
  C:\Windows\System\VDMbOyL.exe
  2⤵
  PID:15960
- C:\Windows\System\SJkxIRU.exe
  C:\Windows\System\SJkxIRU.exe
  2⤵
  PID:16000
- C:\Windows\System\ywDrBRb.exe
  C:\Windows\System\ywDrBRb.exe
  2⤵
  PID:16020
- C:\Windows\System\nWpAvoY.exe
  C:\Windows\System\nWpAvoY.exe
  2⤵
  PID:16052
- C:\Windows\System\eDIhXNl.exe
  C:\Windows\System\eDIhXNl.exe
  2⤵
  PID:16072
- C:\Windows\System\KoYMODf.exe
  C:\Windows\System\KoYMODf.exe
  2⤵
  PID:16100
- C:\Windows\System\zJIuOrJ.exe
  C:\Windows\System\zJIuOrJ.exe
  2⤵
  PID:16120
- C:\Windows\System\iqjQTeU.exe
  C:\Windows\System\iqjQTeU.exe
  2⤵
  PID:16148
- C:\Windows\System\YsKjVRt.exe
  C:\Windows\System\YsKjVRt.exe
  2⤵
  PID:16304
- C:\Windows\System\TZHHrdu.exe
  C:\Windows\System\TZHHrdu.exe
  2⤵
  PID:16320
- C:\Windows\System\UQkdnfv.exe
  C:\Windows\System\UQkdnfv.exe
  2⤵
  PID:16348
- C:\Windows\System\RDJrWlW.exe
  C:\Windows\System\RDJrWlW.exe
  2⤵
  PID:16364
- C:\Windows\System\IbrPZRg.exe
  C:\Windows\System\IbrPZRg.exe
  2⤵
  PID:15340
- C:\Windows\System\iqLSrYf.exe
  C:\Windows\System\iqLSrYf.exe
  2⤵
  PID:14980
- C:\Windows\System\QKrFsIh.exe
  C:\Windows\System\QKrFsIh.exe
  2⤵
  PID:15300
- C:\Windows\System\qlnqlkf.exe
  C:\Windows\System\qlnqlkf.exe
  2⤵
  PID:10576
- C:\Windows\System\zwyJfcu.exe
  C:\Windows\System\zwyJfcu.exe
  2⤵
  PID:13816
- C:\Windows\System\mgLYlJx.exe
  C:\Windows\System\mgLYlJx.exe
  2⤵
  PID:15068
- C:\Windows\System\aauEgUQ.exe
  C:\Windows\System\aauEgUQ.exe
  2⤵
  PID:15724
- C:\Windows\System\LvBpZEa.exe
  C:\Windows\System\LvBpZEa.exe
  2⤵
  PID:14684
- C:\Windows\System\WDJZyIY.exe
  C:\Windows\System\WDJZyIY.exe
  2⤵
  PID:14992
- C:\Windows\System\YSXoheu.exe
  C:\Windows\System\YSXoheu.exe
  2⤵
  PID:15876
- C:\Windows\System\LxxpSlh.exe
  C:\Windows\System\LxxpSlh.exe
  2⤵
  PID:15196
- C:\Windows\System\JMtMeua.exe
  C:\Windows\System\JMtMeua.exe
  2⤵
  PID:15984
- C:\Windows\System\MRHXSSf.exe
  C:\Windows\System\MRHXSSf.exe
  2⤵
  PID:16008
- C:\Windows\System\iQwkDKD.exe
  C:\Windows\System\iQwkDKD.exe
  2⤵
  PID:15768
- C:\Windows\System\BGdJGtH.exe
  C:\Windows\System\BGdJGtH.exe
  2⤵
  PID:15828
- C:\Windows\System\aAjdeQS.exe
  C:\Windows\System\aAjdeQS.exe
  2⤵
  PID:15496
- C:\Windows\System\JfXgByM.exe
  C:\Windows\System\JfXgByM.exe
  2⤵
  PID:15916
- C:\Windows\System\mnYpXUc.exe
  C:\Windows\System\mnYpXUc.exe
  2⤵
  PID:15720
- C:\Windows\System\QtRjJth.exe
  C:\Windows\System\QtRjJth.exe
  2⤵
  PID:16032
- C:\Windows\System\OlCalSB.exe
  C:\Windows\System\OlCalSB.exe
  2⤵
  PID:16088
- C:\Windows\System\MxFToHE.exe
  C:\Windows\System\MxFToHE.exe
  2⤵
  PID:16156
- C:\Windows\System\TcmYEsL.exe
  C:\Windows\System\TcmYEsL.exe
  2⤵
  PID:14176
- C:\Windows\System\FDlLmqU.exe
  C:\Windows\System\FDlLmqU.exe
  2⤵
  PID:13688
- C:\Windows\System\gypsExm.exe
  C:\Windows\System\gypsExm.exe
  2⤵
  PID:16228
- C:\Windows\System\LiMKBrg.exe
  C:\Windows\System\LiMKBrg.exe
  2⤵
  PID:12216
- C:\Windows\System\bpMsDxN.exe
  C:\Windows\System\bpMsDxN.exe
  2⤵
  PID:15096
- C:\Windows\System\XFXRMHJ.exe
  C:\Windows\System\XFXRMHJ.exe
  2⤵
  PID:14948
- C:\Windows\System\bQjZuys.exe
  C:\Windows\System\bQjZuys.exe
  2⤵
  PID:14648
- C:\Windows\System\iMcuXRP.exe
  C:\Windows\System\iMcuXRP.exe
  2⤵
  PID:14356
- C:\Windows\System\GjRdfOo.exe
  C:\Windows\System\GjRdfOo.exe
  2⤵
  PID:15932
- C:\Windows\System\kIpsKlO.exe
  C:\Windows\System\kIpsKlO.exe
  2⤵
  PID:14832
- C:\Windows\System\JJNHFBc.exe
  C:\Windows\System\JJNHFBc.exe
  2⤵
  PID:16404
- C:\Windows\System\rZpqSJo.exe
  C:\Windows\System\rZpqSJo.exe
  2⤵
  PID:16436
- C:\Windows\System\eeALYSz.exe
  C:\Windows\System\eeALYSz.exe
  2⤵
  PID:16464
- C:\Windows\System\QvldmFJ.exe
  C:\Windows\System\QvldmFJ.exe
  2⤵
  PID:16480
- C:\Windows\System\tgNEEgO.exe
  C:\Windows\System\tgNEEgO.exe
  2⤵
  PID:16496
- C:\Windows\System\gIvmKin.exe
  C:\Windows\System\gIvmKin.exe
  2⤵
  PID:16528
- C:\Windows\System\eSnhYaj.exe
  C:\Windows\System\eSnhYaj.exe
  2⤵
  PID:16560
- C:\Windows\System\JIoxFei.exe
  C:\Windows\System\JIoxFei.exe
  2⤵
  PID:16708
- C:\Windows\System\wrBYoqi.exe
  C:\Windows\System\wrBYoqi.exe
  2⤵
  PID:16728
- C:\Windows\System\vkUquqH.exe
  C:\Windows\System\vkUquqH.exe
  2⤵
  PID:16756
- C:\Windows\System\ffDhxzt.exe
  C:\Windows\System\ffDhxzt.exe
  2⤵
  PID:16808
- C:\Windows\System\DfNRnhz.exe
  C:\Windows\System\DfNRnhz.exe
  2⤵
  PID:16856
- C:\Windows\System\yIdPJze.exe
  C:\Windows\System\yIdPJze.exe
  2⤵
  PID:16896
- C:\Windows\System\AXEgVae.exe
  C:\Windows\System\AXEgVae.exe
  2⤵
  PID:16932
- C:\Windows\System\UIArFWc.exe
  C:\Windows\System\UIArFWc.exe
  2⤵
  PID:16960
- C:\Windows\System\RrqOBFO.exe
  C:\Windows\System\RrqOBFO.exe
  2⤵
  PID:16980
- C:\Windows\System\sKuyviB.exe
  C:\Windows\System\sKuyviB.exe
  2⤵
  PID:17016
- C:\Windows\System\WYiYHzn.exe
  C:\Windows\System\WYiYHzn.exe
  2⤵
  PID:17036
- C:\Windows\System\TTQczAf.exe
  C:\Windows\System\TTQczAf.exe
  2⤵
  PID:17052
- C:\Windows\System\OGiteyQ.exe
  C:\Windows\System\OGiteyQ.exe
  2⤵
  PID:17088
- C:\Windows\System\fiMWJGr.exe
  C:\Windows\System\fiMWJGr.exe
  2⤵
  PID:17108
- C:\Windows\System\YmdUJzi.exe
  C:\Windows\System\YmdUJzi.exe
  2⤵
  PID:17124
- C:\Windows\System\Pvsoynd.exe
  C:\Windows\System\Pvsoynd.exe
  2⤵
  PID:17140
- C:\Windows\System\eMbSSmM.exe
  C:\Windows\System\eMbSSmM.exe
  2⤵
  PID:15388
- C:\Windows\System\LFTrVKp.exe
  C:\Windows\System\LFTrVKp.exe
  2⤵
  PID:15552
- C:\Windows\System\aEXUTkm.exe
  C:\Windows\System\aEXUTkm.exe
  2⤵
  PID:15972
- C:\Windows\System\lpQbkGa.exe
  C:\Windows\System\lpQbkGa.exe
  2⤵
  PID:16360
- C:\Windows\System\BeHNBHq.exe
  C:\Windows\System\BeHNBHq.exe
  2⤵
  PID:16488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AAMOtYd.exe

Filesize
1.2MB

MD5
428eb2d5ffad46001307927ed437dc09

SHA1
6ca2022ea6d2efd48780fa4f9ac7f070e41af6cb

SHA256
8393553a891a51d41c439c895dc7da9a7b3865e53526dfedd8211a561a27b56a

SHA512
e25f583a00b88c1a5431e1d900497c351d1e2bb247376c21df6c6cdd25394154fad7240396bc8d017919a1680baded19ad34d2b6784265e520e92693343b8f0c

Download Submit
C:\Windows\System\BmLIktb.exe

Filesize
1.3MB

MD5
de022bbddad540238d7256593f66105e

SHA1
7a677fdaa7afc4cb223bc4bc17ead8d3506efec9

SHA256
66b4cd343c9d9518d38dbb19f3517ee561eb22f4d6305d19963ed59e918cd0d7

SHA512
202df589b26b11586321a9919e35822dac8f3c6ddc119e2dc01e8d4745b6375cd55f82f2f8acc0f1c67bae901c36ae7c5487f2fa0fb5cc223a6b9c8600bcbf1e

Download Submit
C:\Windows\System\DBbfhMM.exe

Filesize
1.2MB

MD5
0dbea48230b1a1bada6a4214111f016d

SHA1
37fb04420fdbc7eaffa73bf86e5ba3e957dfc46e

SHA256
cbc35c3612495b4d963c173c62de5e5c83870d9eb660d278360f34da46630623

SHA512
808354791fd6c0857675569aa6319fccd2f8c6cf1b0120fc5cc204b7793cbf72beb17a9b40e0e4c802e1204b737ae8473a206d80c3d724737b4d8921755acfef

Download Submit
C:\Windows\System\DgkuSmp.exe

Filesize
1.2MB

MD5
a15e41f3445dacdc7f141b90ffecbd48

SHA1
0bc576f565629c9ff3a833dd02c45a54892ede89

SHA256
b63655ed1a0d8a8e72bff31f2924f33802f9493a8332c35c1643ed4b1e133113

SHA512
b352ef9b80841feae88515265ec4685bd07b48045d6b95afbb063b031575010f246c097d9fade02aeb375972e745a7df728676cdb2a15f0ab4b36526fef8938c

Download Submit
C:\Windows\System\EHDRyvo.exe

Filesize
1.2MB

MD5
ee0dacda14cd7309483ce726a4f2de95

SHA1
ade766b19a59b232e8d80b5156e93855a9d2d01a

SHA256
4dbc44b49a83faeaa9349198233e38eee1fec08655d1df0aa658d6eaeef1eadd

SHA512
db5411e7479406bfd18198576a9a34de9b0e9ca0cd649cdd4b11c29baaa686922292003a3b2bfefc102aaf54344026c4581a95c638a14753b5beac17384f4168

Download Submit
C:\Windows\System\FqSMERi.exe

Filesize
1.2MB

MD5
71c2b10513b46797d01041eafaa82af8

SHA1
3e3b306cf8a950f91a0c51529512e7f6af64e3d6

SHA256
70780af21d70d85b61125603cb23bcce2e4d969480cc59ada7c7826dedf71a7a

SHA512
288db134de8d7d91c2a313a3a8762109f5d777f3142d9de0de4bd1b10fb62c36357f6816730d2633c6cd7e8d96075293e733c698aae37fa145d4e1a591ca5c06

Download Submit
C:\Windows\System\GOepZTH.exe

Filesize
1.2MB

MD5
a91d7a09435e8c0207686b4701221408

SHA1
542311062b425f0b9d56c55d511715c8fea5d1a6

SHA256
d471fd8d88611bc0239b2b1b1c30f26c453142f0c23c162920136ab643e4422f

SHA512
a28f80b46a67e92b6d4a520248d7a1f3e6e5fd4fdf02314b0a04eb3427cd97b0c1f4b21a97fb327575a7d7c3587ba3654b61402807579860e42c942e5297425a

Download Submit
C:\Windows\System\HuyMAAq.exe

Filesize
1.3MB

MD5
d6001cfaed240239fb27dda2f3dfaa13

SHA1
8d32601c4a0965be5896f249efdce9d4b7ba533f

SHA256
5425474f2ee56a9cec9c8a38bb01e19ce6040842ddfb43ea8b1072823e423f4e

SHA512
e48be611ff3c64265a42a41e506e7603f94944f170fc5a4912979ee7f4cb5831fbf20c209cfc50d31062b71a7b9dfd44aeb09b393500d948188853f10a67926c

Download Submit
C:\Windows\System\KSXZLMP.exe

Filesize
1.2MB

MD5
aa08afe5d2c6fef1c16617ebbbe6599f

SHA1
226b699f38edaed35026e89451d13d3a4ea74aa6

SHA256
f9913daf4a72b47973a39f0c8b1fc71fb19095d89059a928dedbd650e98e2d02

SHA512
210aee37bba77a379b918ccb8e3790bbbe8aa943c8a5a0e675a0490d09dec42d49e269115d17076439e944043857d5e0aa61f9d2b818251748a046403fcd2b8c

Download Submit
C:\Windows\System\MfDkXKa.exe

Filesize
1.2MB

MD5
57cc5d0f5b120dc11e1176540cac8681

SHA1
3b4f21c3c20302d7596107e258a30ca9f65cd047

SHA256
c12dea2ccbf0d870eafc14f489ebaebc45291943dbd924ea113bba5c11fccd2a

SHA512
c146417327dadcbe5d19519e575734841aec876dd3a2290ee664c1731d121590d4ad18ad543ae2f4615c28cfb1f66b892b6989ca959354140631e9cd987ebf6d

Download Submit
C:\Windows\System\NWLARXt.exe

Filesize
1.3MB

MD5
4996c5bff878ee2d4708c429f046532f

SHA1
a26125e6cd54a9dfd6e18d4c996a2944f3d405cf

SHA256
6a4d9cd2e36cc9f69969f8639814ac2efee0db45f294dde9cab6955beee21ac7

SHA512
51a7a9157bfb0db02de45ba427f81ffc6e60b68f8ca1becb33d7e838e5e8af7a0aac4c15c3233df74beec5ace407931eb43a1a7314a30ce6c53ac96c3fa9be24

Download Submit
C:\Windows\System\QYJJxDf.exe

Filesize
1.2MB

MD5
b7f408cecc1e65bb2a615ab669891cbb

SHA1
bdb227aaf3d7f0072e10ff5bad8df7485696e723

SHA256
71e865d9c8ea67548b13d534b1c5890232ff55e0fc3acf4334368a1280db79ca

SHA512
f62235275f2ceca8e119e2fda0a6dc5f14cb3c2063ffcac5a052676fa70ce11598d71d23db98dbb5ebdb2e9ac2967d7cab35e993e1c492137ba9ab6440577e56

Download Submit
C:\Windows\System\RoHqMXQ.exe

Filesize
1.2MB

MD5
f2d0c229a7f945f5b9b8511c853a7b57

SHA1
3d8c0461ec51ecfc556446831686aa60ac47b20d

SHA256
85a1468e36df94032accf42cc3af1e9308c68c434608ca7e17d2d4d7f1ceb265

SHA512
633a103e14cb0a114466d32e044ef42843f66eca736ac6a482e0b7c95a1939495e26073fb5cf8080afea8474c675a624a912864228b33b039e4f99172ac2b3ba

Download Submit
C:\Windows\System\Upwifbg.exe

Filesize
1.2MB

MD5
23dd59901bb26b8256609f70b530f88b

SHA1
f959a8e2df929a871d4919da037e20e9043983a4

SHA256
7b0c819ee2fee819171ca4fd3b8f1d678e94489acfa9944060ca9a5b9381527d

SHA512
585cd04d4f0ca2f94508e972b58c5746774c4809509837f9aac3030988044375175313d01f7b871d2741beca7b464cf2f1db88e36d60b53e91e88aa95cbf7273

Download Submit
C:\Windows\System\VIJWuHq.exe

Filesize
1.3MB

MD5
be855896259036103b399ac0d4d74c5b

SHA1
1d2fe667ef375c62a56dc9bcdf9819373ff1bc0a

SHA256
82566a043a45cb95e4ccc350af033acd22f9cb044ee5a5b4db4a7064f171dd02

SHA512
ae6d29fe9ef0680e17b54454523324cde2e8ce1d2e0757bff2fbd8e3dbd5245d67abfa08c047010e658d4fb39d92f4128eb02bfe66f130b33d52ed0aee15aa7e

Download Submit
C:\Windows\System\XociHho.exe

Filesize
1.2MB

MD5
81b259d31ea1b4043ce19964bd06376f

SHA1
5bcb590885146984a57a848124bc5ce5bdfaa9d1

SHA256
301e73eac1c45a5094d05b9adb4f942114f846c6f794942cc9f28ee43805e4e6

SHA512
642af56d61374452b910f20d966e6c449ca039a702c65a2736d143bce0a23b8584104ef31e62710acfe1d75b9bddc1d9859cf3096ab1842e4d5a5d0c84f39962

Download Submit
C:\Windows\System\adbIHpp.exe

Filesize
1.2MB

MD5
6703ed1f4750095aa6fc0ec84e073918

SHA1
caef39effd22f069afa33671267e56e9069bcfd8

SHA256
a62095c32240910faf30a65fc31cabeba5249cf7d2c115214ac30e4706ccb26b

SHA512
91affc180dc51604f6e0dd44643cf39ea3dbabe4a299421f68238fd57fe2dce3e3385fe4d194b459bdc7583dc94cde219f9442fb60aaf769c408f4121aed7ee4

Download Submit
C:\Windows\System\bzPjhgo.exe

Filesize
1.2MB

MD5
c09bdb044515baf161c6ccdd13d14bc4

SHA1
bf4c425d503e01f342a1cae04ad4688e060c9aa4

SHA256
5f2017ec9dd8bbbcf70c6724bb043fd3258da564ef4094f99eadcdb1f7ee885a

SHA512
348d7a3fd2425965a8e32fa1483734c991c2a2dd0e0b278e14a555c1a0130867ca202f9864c4ae415d8df3722250693922ad1e2f61206a318dd4b06ed78e4760

Download Submit
C:\Windows\System\dIpUkdD.exe

Filesize
1.2MB

MD5
205dcb8fa78d4acbd6de735cd11f88fb

SHA1
a44dc8c6dbd19a23f67c11db210f14de775bab78

SHA256
4b55939c5d2104c2119376ffdc6dbfee43190f48aede662e440919ed303bbef7

SHA512
1adebdfb2fe979df07c4f42f1579018f05e084d35659a8bdf956b85665e16219e2e15a836bc029b3b069f470ded0935c7c2e3f21a01d2b30216c292bedec4f39

Download Submit
C:\Windows\System\fiVDtlj.exe

Filesize
1.2MB

MD5
91691eec9073b4094190f7cfd8d71b7c

SHA1
1e2044aa64938906170044a9f214a5d3bb2d518b

SHA256
0e207a7c5fe1474ba64b1663b1e3066e3562900f2a4fe07386a011495bccd505

SHA512
591eaef4ffcadf063c4ecf3f8c85c86d5e4267eec5a4410ea01b9dc644fa967b50082601931a2a5a7da51a378d8eab4f5df1dc9d9785a7841ef64158c24c0f09

Download Submit
C:\Windows\System\hSGPBmr.exe

Filesize
1.3MB

MD5
9a63d12dc2c0086681a053d768910d7c

SHA1
72d9317a4c26632b5479a3f4bf834317a193009d

SHA256
2ae4ee13ce50822a0d4164359c3b56308780e135bc2cf368c5359f0789413329

SHA512
556f3a08b318e52e9308ae4d1fedc47ab40cac42c3b7cd797177068fda5b0fb124c2124c50e49b4d4e79d5d0ccdb24497cc49dcf48db912026c99fdd742f44af

Download Submit
C:\Windows\System\hkeIxwk.exe

Filesize
1.2MB

MD5
f69a126b219f0e0d10ff45195e3e330a

SHA1
2c7e8a3bc3c15dfb4c5412b43486a917e6e25adc

SHA256
c30b21dd5faa4dab3e4005367d695c1de9c91f7c5585842b3f8854a0bf184f32

SHA512
86da7aa5e0ec439320a8617eb20d7787ba30b3d7cdfa7ffb33dc2352f7b1c5d778f68560808eb124e6df33f62bcb62faf523c16d9c80c84792a540c72097f269

Download Submit
C:\Windows\System\jVcysHj.exe

Filesize
1.2MB

MD5
2fc0cf58cd715c41fe798d5b55851886

SHA1
803ff31c5e980822336618af67419b9184f75038

SHA256
3b3d858feca95799ce71965cfd09a49bbbd87e2121ff30bb7382cadd6c868273

SHA512
cdd58d698296d95909262cea3c8769f4314eb9d01e31d8130e2f4324843c1c2a4b687fc28b7ec723769ff9caa3b72010f0ec91962ee3c706cd5c3e37d07cb2f4

Download Submit
C:\Windows\System\lbyUTyP.exe

Filesize
1.2MB

MD5
b489e2fcbf65c2dfeec4fcf63ad23640

SHA1
7ca7c229d0ff0dcdcfc0d2e6cb80e0dc820412e9

SHA256
85d419654ff698f2e5f521cb4ebfcaed78c9f15c7f7e7c8702d0a64477b00714

SHA512
18990ce57e675f9e86317563118fb07af58a09f5fc70dbcd6c236677e5b83f0336a95e7b7c390c98f998c8b4af59728bf4cac1c1908435b0dad8b9fba734c067

Download Submit
C:\Windows\System\mGhYBlT.exe

Filesize
1.2MB

MD5
19ef781f3221e1cd59f42fb7617a6119

SHA1
d14df68f6bc23df9a671015c8d3ec23d4c4cd0e2

SHA256
c220430319c6503bfbfe0a868577b31fde26c1768803090741bad9bc3328c96b

SHA512
bfa887794e8827fb539372b3c6c4690c7cb311a3915a26aa15cd1a75c6af6e7bc9ed4f7e8213afb7b9dc22526fff7203d589a6195a7d429bf52c727c60f0d6f1

Download Submit
C:\Windows\System\mXqkNom.exe

Filesize
1.2MB

MD5
2094fff25858e235db70cc43b86d60de

SHA1
029629e43c25380dd78a907483b5a0667a83a747

SHA256
3c189539b7548b94aa55c0a51725f942a0f4ef34f69d1f1a4c660d20349f9711

SHA512
f724fb747759db578ebe1f9b7cc7b80f404e578010422496b78c38017e12e987c1be88049379acaf4ade4e89a889c27b603c9bb73d93ef138611218589f4c516

Download Submit
C:\Windows\System\ppyDwQX.exe

Filesize
1.3MB

MD5
eb3e2d1c028aa30b0e4a362146f99551

SHA1
a11a9b0ca09c79ae7de47dadce9a582d26c159c4

SHA256
644e15cdba05d241578e99c1dd17d78f7a3d354ab4dd21371d183a8e4473e205

SHA512
fdfca4111046f5fd7d7de2bebfa32e0da8d0e86c9baaf6a5552dfe1d27265cfd7c1a881e1593042dff972c44ea4bb0926292e5a99e7bff927ebc58f34ff8dbea

Download Submit
C:\Windows\System\ptWralq.exe

Filesize
1.3MB

MD5
46a351e3e37022890edcb77d0f74a157

SHA1
07512577deb2c0e12b36d4f6470f4886fc2dec5a

SHA256
3a22790003ed0f0752749466ce7ceeed6dc943df291795bca41737ae942ac11a

SHA512
b344bda854c73e19009c9c281116f10a81b885e39b76483fe618bce423a6069b9841bfe64e273b6d2d3670464bf205a59cb77e7bdd0f66287830320701c777d4

Download Submit
C:\Windows\System\rioGBRD.exe

Filesize
1.3MB

MD5
95e04065d5dcea91701ffa05bec52a09

SHA1
01f468291d6f7a635db3483c8446b6c90f8e5cfc

SHA256
5b35d3784c117456dc92c47d305bcc31fbd89eda64b15d40f0889f5a8f19d1e8

SHA512
20e990ba8cbe31f00a1b60fd97644f8ba79f75260f5bb535f3fd81209c13cf802425311d3ca1bbc8e24ad46f7904249fe695eceef782d8a140b7e4aae1769f0b

Download Submit
C:\Windows\System\tXTBTPT.exe

Filesize
1.2MB

MD5
ec4246bd0d57702460d70bb95ae6fc94

SHA1
cabab93aca40b40c2bb50bdbb1d15dc00307d9de

SHA256
51c12c4ec0ce1aee1543c3cda3ee79aba3bed2c2b101b707916a83bd0ea8415c

SHA512
02021f0240f77e4db3e2ed8632406ce4b36a99294dbfe6c55317b2ab6ffb88ebd1e002ebaab0610b0ec021b821c98ee04b0d23067d9c653f3eade0056962c497

Download Submit
C:\Windows\System\vOljWOf.exe

Filesize
1.2MB

MD5
8b2ddae0163d7c09d2144a09a1094350

SHA1
c4c8613d40372fb5c9282286f27d05fef28ebc5e

SHA256
18fc0f7fb23d4575c93050c733d66bcf4d1f1a5d1a6c7884c064865956063559

SHA512
02b9ecc44e7d87c24eeb50d266412eaed5622e9d149ecca3bd16f009460ac73ee2980194ca279db47c5c4f787c5112ace87ef053324f4fc04d6d98e4f01ba6e2

Download Submit
C:\Windows\System\yzccHWF.exe

Filesize
1.3MB

MD5
0e64d4d2cdcd82a870e4cba73e0e81e7

SHA1
a33fa1646428359ccd8ae40c1da1399c9a0c78fd

SHA256
db099c072126427326111109937f3be2d729d8f5fb4114237a074decb6dd63b9

SHA512
fe3460a32fb7f8f4503a2ffa46461e6ab10b3a912dc60abd16133dede63133386699caa5d51b72369275e13fb85264633a0838e0bfd8fc83d6edcf1d13589d01

Download Submit
memory/5104-0-0x0000016F849C0000-0x0000016F849D0000-memory.dmp

Filesize
64KB

Download