xmrig | 0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df

Analysis

max time kernel
135s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2024, 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
Size

1.7MB
MD5

195cda30ce291ca35d54e588696dc0f7
SHA1

35575fb2f0285799f961f1b574887cb09cae272d
SHA256

0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df
SHA512

6e620927e46ed479fa5bfa3c5b2aa6717dee81f39d02153e4af9006c12625bede38d79d2325053b8d3b574d3c701bf7f4b42c6dcd15358793ab8f3770f043a36
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRRvzc26JxS+:GemTLkNdfE0pZy4

Score

10^/10

xmrig miner

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 16840 created 16768	16840	WerFaultSecure.exe	922

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d000000023af9-4.dat	xmrig
behavioral2/files/0x000b000000023b83-10.dat	xmrig
behavioral2/files/0x000a000000023b84-7.dat	xmrig
behavioral2/files/0x000a000000023b87-29.dat	xmrig
behavioral2/files/0x000a000000023b86-22.dat	xmrig
behavioral2/files/0x000a000000023b85-21.dat	xmrig
behavioral2/files/0x000a000000023b88-34.dat	xmrig
behavioral2/files/0x000a000000023b8b-44.dat	xmrig
behavioral2/files/0x000a000000023b8d-62.dat	xmrig
behavioral2/files/0x000b000000023b81-72.dat	xmrig
behavioral2/files/0x000a000000023b8a-61.dat	xmrig
behavioral2/files/0x000a000000023b90-75.dat	xmrig
behavioral2/files/0x000a000000023b91-81.dat	xmrig
behavioral2/files/0x000b000000023b94-97.dat	xmrig
behavioral2/files/0x0008000000023bac-104.dat	xmrig
behavioral2/files/0x000e000000023bb7-131.dat	xmrig
behavioral2/files/0x0008000000023bbf-146.dat	xmrig
behavioral2/files/0x0008000000023bf1-166.dat	xmrig
behavioral2/files/0x0008000000023bf0-165.dat	xmrig
behavioral2/files/0x0008000000023bb9-163.dat	xmrig
behavioral2/files/0x0008000000023bef-162.dat	xmrig
behavioral2/files/0x0009000000023bb3-158.dat	xmrig
behavioral2/files/0x0008000000023bee-157.dat	xmrig
behavioral2/files/0x0009000000023bb2-155.dat	xmrig
behavioral2/files/0x0009000000023bb1-149.dat	xmrig
behavioral2/files/0x0008000000023bbe-145.dat	xmrig
behavioral2/files/0x0008000000023bbd-142.dat	xmrig
behavioral2/files/0x0008000000023bbc-139.dat	xmrig
behavioral2/files/0x000e000000023ba3-124.dat	xmrig
behavioral2/files/0x000b000000023b93-107.dat	xmrig
behavioral2/files/0x000b000000023b92-105.dat	xmrig
behavioral2/files/0x000a000000023b9c-115.dat	xmrig
behavioral2/files/0x000a000000023b8f-78.dat	xmrig
behavioral2/files/0x000a000000023b8c-73.dat	xmrig
behavioral2/files/0x000a000000023b8e-67.dat	xmrig
behavioral2/files/0x000a000000023b89-47.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3588	ULInejZ.exe
4100	ZnDsnLU.exe
5056	ydjjCLT.exe
2136	RtsQRUm.exe
2140	bkyRnFT.exe
3016	uIVkOTB.exe
3152	qkbeJrD.exe
5096	oDuGAIA.exe
1940	rjIKZXz.exe
3156	vOvfuTf.exe
4848	QoNPHcR.exe
4864	vLRUjYn.exe
1652	JBULqhv.exe
1628	igqiswp.exe
1020	lUiYoYS.exe
2632	sEAvgPJ.exe
2348	UfTsGhi.exe
4644	DSmHyqu.exe
3468	nusCiEd.exe
3040	CoKjnSh.exe
4352	lxBVGMH.exe
1808	qnOocIC.exe
4860	Teltpih.exe
2056	pNHafqN.exe
2820	XunEBPD.exe
1948	EjhYwOg.exe
2228	mHXlsAD.exe
2932	VMQQuVL.exe
2912	LEvrVQg.exe
4528	RtgeIrB.exe
312	bqvHXtR.exe
432	ZJeWpzt.exe
4324	SYrSvZw.exe
3024	BIuyBWT.exe
4684	jANHaNR.exe
4784	pCJWxxX.exe
4116	gkvIPmD.exe
4148	jGgALpH.exe
2640	VduTBvl.exe
5052	JfBgFzo.exe
1052	rmnxKgP.exe
3540	uebaiDX.exe
1080	pVJWwTR.exe
4636	VocUuJr.exe
980	iesgvRZ.exe
2212	nNONKQV.exe
4832	xFULwYD.exe
3320	JNCloXn.exe
4752	Ndsdgpm.exe
3376	zoOigJF.exe
4448	oLornvz.exe
1920	ijwInZM.exe
3920	AMBgUlA.exe
4388	KPACKuu.exe
1088	slmyXnu.exe
4464	lnTcMBQ.exe
2564	EplcXfJ.exe
2012	QGXuTdI.exe
1472	OsFfCpe.exe
2720	HxLtpcd.exe
3208	jxQAboC.exe
1516	pIxdFsW.exe
3996	fJnFXGH.exe
3760	neDIyMM.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uNUmfww.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\VmycOCg.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\rwsRPCD.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\mRdPHLa.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\NZFbKuu.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\HTnboIN.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\WNDbAdF.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\aBCAJNn.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\CisYnkI.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\XunEBPD.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\lvBPpQL.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\EYyPyxZ.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\ETLJLlI.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\ZyeAUNG.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\qPebdCy.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\fYJJtru.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\eEsKGUM.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\adHTugh.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\iZPZfMf.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\fQLecHa.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\lvxOZSD.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\XSIBKyM.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\BqoyDkZ.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\BdQqsKb.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\JJWXQie.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\aSVWEsz.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\ozsztQe.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\xgOoPwe.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\oChoDEy.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\hNKVfZR.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\rKnvAHO.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\lpZAlVC.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\BGLSaWC.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\BxGhEKc.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\iRzcQpV.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\cjMMKSj.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\Ndsdgpm.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\LFgWBnc.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\kGSnjld.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\yskRaKk.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\BYsXiTi.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\qIVHuKD.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\ALTMgZV.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\olGvFQe.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\ynEYAru.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\cLkQcYb.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\tOdTRCY.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\FyAFjgR.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\DjPZMOD.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\OwqGNNz.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\QTAuMbk.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\mytwGCn.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\bEecDoj.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\MxKyjBx.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\ynLGhQG.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\nElrjiu.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\itrVINu.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\dtoJDVN.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\EwMXmaD.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\SsZDTDB.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\igqiswp.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\zoOigJF.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\rBhhmqn.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
File created	C:\Windows\System\BLpoiXK.exe	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
16512	WerFaultSecure.exe
16512	WerFaultSecure.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17180	dwm.exe
Token: SeChangeNotifyPrivilege	17180	dwm.exe
Token: 33	17180	dwm.exe
Token: SeIncBasePriorityPrivilege	17180	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 3588	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	86
PID 4972 wrote to memory of 3588	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	86
PID 4972 wrote to memory of 4100	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	87
PID 4972 wrote to memory of 4100	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	87
PID 4972 wrote to memory of 5056	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	88
PID 4972 wrote to memory of 5056	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	88
PID 4972 wrote to memory of 2136	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	89
PID 4972 wrote to memory of 2136	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	89
PID 4972 wrote to memory of 2140	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	90
PID 4972 wrote to memory of 2140	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	90
PID 4972 wrote to memory of 3016	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	91
PID 4972 wrote to memory of 3016	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	91
PID 4972 wrote to memory of 3152	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	92
PID 4972 wrote to memory of 3152	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	92
PID 4972 wrote to memory of 5096	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	93
PID 4972 wrote to memory of 5096	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	93
PID 4972 wrote to memory of 1940	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	94
PID 4972 wrote to memory of 1940	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	94
PID 4972 wrote to memory of 3156	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	95
PID 4972 wrote to memory of 3156	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	95
PID 4972 wrote to memory of 4848	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	96
PID 4972 wrote to memory of 4848	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	96
PID 4972 wrote to memory of 4864	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	97
PID 4972 wrote to memory of 4864	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	97
PID 4972 wrote to memory of 1652	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	98
PID 4972 wrote to memory of 1652	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	98
PID 4972 wrote to memory of 1628	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	99
PID 4972 wrote to memory of 1628	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	99
PID 4972 wrote to memory of 1020	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	100
PID 4972 wrote to memory of 1020	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	100
PID 4972 wrote to memory of 2632	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	101
PID 4972 wrote to memory of 2632	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	101
PID 4972 wrote to memory of 2348	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	102
PID 4972 wrote to memory of 2348	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	102
PID 4972 wrote to memory of 4644	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	103
PID 4972 wrote to memory of 4644	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	103
PID 4972 wrote to memory of 3468	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	104
PID 4972 wrote to memory of 3468	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	104
PID 4972 wrote to memory of 3040	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	105
PID 4972 wrote to memory of 3040	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	105
PID 4972 wrote to memory of 4352	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	106
PID 4972 wrote to memory of 4352	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	106
PID 4972 wrote to memory of 1808	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	107
PID 4972 wrote to memory of 1808	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	107
PID 4972 wrote to memory of 4860	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	108
PID 4972 wrote to memory of 4860	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	108
PID 4972 wrote to memory of 2056	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	109
PID 4972 wrote to memory of 2056	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	109
PID 4972 wrote to memory of 2820	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	110
PID 4972 wrote to memory of 2820	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	110
PID 4972 wrote to memory of 1948	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	111
PID 4972 wrote to memory of 1948	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	111
PID 4972 wrote to memory of 2228	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	112
PID 4972 wrote to memory of 2228	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	112
PID 4972 wrote to memory of 2932	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	113
PID 4972 wrote to memory of 2932	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	113
PID 4972 wrote to memory of 2912	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	114
PID 4972 wrote to memory of 2912	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	114
PID 4972 wrote to memory of 4528	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	115
PID 4972 wrote to memory of 4528	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	115
PID 4972 wrote to memory of 312	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	116
PID 4972 wrote to memory of 312	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	116
PID 4972 wrote to memory of 432	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	117
PID 4972 wrote to memory of 432	4972	0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe	117

C:\Users\Admin\AppData\Local\Temp\0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe
"C:\Users\Admin\AppData\Local\Temp\0f4b98f45023a37630ca9295e0f220d1fde4bff78085e0b34508f06f771d00df.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\System\ULInejZ.exe
  C:\Windows\System\ULInejZ.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\ZnDsnLU.exe
  C:\Windows\System\ZnDsnLU.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\ydjjCLT.exe
  C:\Windows\System\ydjjCLT.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\RtsQRUm.exe
  C:\Windows\System\RtsQRUm.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\bkyRnFT.exe
  C:\Windows\System\bkyRnFT.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\uIVkOTB.exe
  C:\Windows\System\uIVkOTB.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\qkbeJrD.exe
  C:\Windows\System\qkbeJrD.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\oDuGAIA.exe
  C:\Windows\System\oDuGAIA.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\rjIKZXz.exe
  C:\Windows\System\rjIKZXz.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\vOvfuTf.exe
  C:\Windows\System\vOvfuTf.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\QoNPHcR.exe
  C:\Windows\System\QoNPHcR.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\vLRUjYn.exe
  C:\Windows\System\vLRUjYn.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\JBULqhv.exe
  C:\Windows\System\JBULqhv.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\igqiswp.exe
  C:\Windows\System\igqiswp.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\lUiYoYS.exe
  C:\Windows\System\lUiYoYS.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\sEAvgPJ.exe
  C:\Windows\System\sEAvgPJ.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\UfTsGhi.exe
  C:\Windows\System\UfTsGhi.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\DSmHyqu.exe
  C:\Windows\System\DSmHyqu.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\nusCiEd.exe
  C:\Windows\System\nusCiEd.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\CoKjnSh.exe
  C:\Windows\System\CoKjnSh.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\lxBVGMH.exe
  C:\Windows\System\lxBVGMH.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\qnOocIC.exe
  C:\Windows\System\qnOocIC.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\Teltpih.exe
  C:\Windows\System\Teltpih.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\pNHafqN.exe
  C:\Windows\System\pNHafqN.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\XunEBPD.exe
  C:\Windows\System\XunEBPD.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\EjhYwOg.exe
  C:\Windows\System\EjhYwOg.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\mHXlsAD.exe
  C:\Windows\System\mHXlsAD.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\VMQQuVL.exe
  C:\Windows\System\VMQQuVL.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\LEvrVQg.exe
  C:\Windows\System\LEvrVQg.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\RtgeIrB.exe
  C:\Windows\System\RtgeIrB.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\bqvHXtR.exe
  C:\Windows\System\bqvHXtR.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\ZJeWpzt.exe
  C:\Windows\System\ZJeWpzt.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\SYrSvZw.exe
  C:\Windows\System\SYrSvZw.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\BIuyBWT.exe
  C:\Windows\System\BIuyBWT.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\jANHaNR.exe
  C:\Windows\System\jANHaNR.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\pCJWxxX.exe
  C:\Windows\System\pCJWxxX.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\gkvIPmD.exe
  C:\Windows\System\gkvIPmD.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\jGgALpH.exe
  C:\Windows\System\jGgALpH.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\VduTBvl.exe
  C:\Windows\System\VduTBvl.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\JfBgFzo.exe
  C:\Windows\System\JfBgFzo.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\rmnxKgP.exe
  C:\Windows\System\rmnxKgP.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\uebaiDX.exe
  C:\Windows\System\uebaiDX.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\pVJWwTR.exe
  C:\Windows\System\pVJWwTR.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\VocUuJr.exe
  C:\Windows\System\VocUuJr.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\iesgvRZ.exe
  C:\Windows\System\iesgvRZ.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\nNONKQV.exe
  C:\Windows\System\nNONKQV.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\xFULwYD.exe
  C:\Windows\System\xFULwYD.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\JNCloXn.exe
  C:\Windows\System\JNCloXn.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\Ndsdgpm.exe
  C:\Windows\System\Ndsdgpm.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\zoOigJF.exe
  C:\Windows\System\zoOigJF.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\oLornvz.exe
  C:\Windows\System\oLornvz.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\ijwInZM.exe
  C:\Windows\System\ijwInZM.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\AMBgUlA.exe
  C:\Windows\System\AMBgUlA.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\KPACKuu.exe
  C:\Windows\System\KPACKuu.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\slmyXnu.exe
  C:\Windows\System\slmyXnu.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\lnTcMBQ.exe
  C:\Windows\System\lnTcMBQ.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\EplcXfJ.exe
  C:\Windows\System\EplcXfJ.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\QGXuTdI.exe
  C:\Windows\System\QGXuTdI.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\OsFfCpe.exe
  C:\Windows\System\OsFfCpe.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\HxLtpcd.exe
  C:\Windows\System\HxLtpcd.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\jxQAboC.exe
  C:\Windows\System\jxQAboC.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\pIxdFsW.exe
  C:\Windows\System\pIxdFsW.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\fJnFXGH.exe
  C:\Windows\System\fJnFXGH.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\neDIyMM.exe
  C:\Windows\System\neDIyMM.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\fIBmiLD.exe
  C:\Windows\System\fIBmiLD.exe
  2⤵
  PID:4264
- C:\Windows\System\yUpyIfr.exe
  C:\Windows\System\yUpyIfr.exe
  2⤵
  PID:2984
- C:\Windows\System\ZpGECRy.exe
  C:\Windows\System\ZpGECRy.exe
  2⤵
  PID:3444
- C:\Windows\System\oPqxdpw.exe
  C:\Windows\System\oPqxdpw.exe
  2⤵
  PID:3116
- C:\Windows\System\xRnryEO.exe
  C:\Windows\System\xRnryEO.exe
  2⤵
  PID:3704
- C:\Windows\System\oxWGdFh.exe
  C:\Windows\System\oxWGdFh.exe
  2⤵
  PID:4696
- C:\Windows\System\MlwmsER.exe
  C:\Windows\System\MlwmsER.exe
  2⤵
  PID:4012
- C:\Windows\System\RdpwuZm.exe
  C:\Windows\System\RdpwuZm.exe
  2⤵
  PID:4348
- C:\Windows\System\syFbNVY.exe
  C:\Windows\System\syFbNVY.exe
  2⤵
  PID:2184
- C:\Windows\System\HpkDHBo.exe
  C:\Windows\System\HpkDHBo.exe
  2⤵
  PID:4844
- C:\Windows\System\cZEKwPQ.exe
  C:\Windows\System\cZEKwPQ.exe
  2⤵
  PID:2444
- C:\Windows\System\jDyiUXa.exe
  C:\Windows\System\jDyiUXa.exe
  2⤵
  PID:3688
- C:\Windows\System\LFgWBnc.exe
  C:\Windows\System\LFgWBnc.exe
  2⤵
  PID:4004
- C:\Windows\System\KfaEZHr.exe
  C:\Windows\System\KfaEZHr.exe
  2⤵
  PID:4796
- C:\Windows\System\LYaLXZm.exe
  C:\Windows\System\LYaLXZm.exe
  2⤵
  PID:2608
- C:\Windows\System\rBhhmqn.exe
  C:\Windows\System\rBhhmqn.exe
  2⤵
  PID:4440
- C:\Windows\System\bNnHcxg.exe
  C:\Windows\System\bNnHcxg.exe
  2⤵
  PID:1520
- C:\Windows\System\JfxDphr.exe
  C:\Windows\System\JfxDphr.exe
  2⤵
  PID:2416
- C:\Windows\System\RYlCGOs.exe
  C:\Windows\System\RYlCGOs.exe
  2⤵
  PID:2088
- C:\Windows\System\oRutWsm.exe
  C:\Windows\System\oRutWsm.exe
  2⤵
  PID:2816
- C:\Windows\System\UcBsTMO.exe
  C:\Windows\System\UcBsTMO.exe
  2⤵
  PID:116
- C:\Windows\System\MGOhdVT.exe
  C:\Windows\System\MGOhdVT.exe
  2⤵
  PID:3448
- C:\Windows\System\uJPCSUx.exe
  C:\Windows\System\uJPCSUx.exe
  2⤵
  PID:4768
- C:\Windows\System\GrXvOqE.exe
  C:\Windows\System\GrXvOqE.exe
  2⤵
  PID:900
- C:\Windows\System\XEKanZm.exe
  C:\Windows\System\XEKanZm.exe
  2⤵
  PID:4340
- C:\Windows\System\zbMHvDr.exe
  C:\Windows\System\zbMHvDr.exe
  2⤵
  PID:4908
- C:\Windows\System\YcfjtuD.exe
  C:\Windows\System\YcfjtuD.exe
  2⤵
  PID:4196
- C:\Windows\System\WruidIU.exe
  C:\Windows\System\WruidIU.exe
  2⤵
  PID:864
- C:\Windows\System\rMoVrEu.exe
  C:\Windows\System\rMoVrEu.exe
  2⤵
  PID:2480
- C:\Windows\System\LuVeouR.exe
  C:\Windows\System\LuVeouR.exe
  2⤵
  PID:2032
- C:\Windows\System\jwjWoSt.exe
  C:\Windows\System\jwjWoSt.exe
  2⤵
  PID:3088
- C:\Windows\System\dlrOPlz.exe
  C:\Windows\System\dlrOPlz.exe
  2⤵
  PID:1916
- C:\Windows\System\IhqeELV.exe
  C:\Windows\System\IhqeELV.exe
  2⤵
  PID:3980
- C:\Windows\System\DnTSwWL.exe
  C:\Windows\System\DnTSwWL.exe
  2⤵
  PID:4056
- C:\Windows\System\TVPOQuM.exe
  C:\Windows\System\TVPOQuM.exe
  2⤵
  PID:3812
- C:\Windows\System\sZSTlTt.exe
  C:\Windows\System\sZSTlTt.exe
  2⤵
  PID:1660
- C:\Windows\System\ioVCeJI.exe
  C:\Windows\System\ioVCeJI.exe
  2⤵
  PID:2836
- C:\Windows\System\dhHrnkf.exe
  C:\Windows\System\dhHrnkf.exe
  2⤵
  PID:1076
- C:\Windows\System\NcwaCMo.exe
  C:\Windows\System\NcwaCMo.exe
  2⤵
  PID:3528
- C:\Windows\System\ePrIBDq.exe
  C:\Windows\System\ePrIBDq.exe
  2⤵
  PID:956
- C:\Windows\System\DnIhJxN.exe
  C:\Windows\System\DnIhJxN.exe
  2⤵
  PID:1376
- C:\Windows\System\VwWGqFe.exe
  C:\Windows\System\VwWGqFe.exe
  2⤵
  PID:4044
- C:\Windows\System\HWRRtqV.exe
  C:\Windows\System\HWRRtqV.exe
  2⤵
  PID:3176
- C:\Windows\System\LLVtReg.exe
  C:\Windows\System\LLVtReg.exe
  2⤵
  PID:5144
- C:\Windows\System\hsUKMuy.exe
  C:\Windows\System\hsUKMuy.exe
  2⤵
  PID:5184
- C:\Windows\System\hjSLuux.exe
  C:\Windows\System\hjSLuux.exe
  2⤵
  PID:5204
- C:\Windows\System\YuqERnW.exe
  C:\Windows\System\YuqERnW.exe
  2⤵
  PID:5232
- C:\Windows\System\nWFsxkc.exe
  C:\Windows\System\nWFsxkc.exe
  2⤵
  PID:5256
- C:\Windows\System\MIvRSyQ.exe
  C:\Windows\System\MIvRSyQ.exe
  2⤵
  PID:5276
- C:\Windows\System\WvEPkzi.exe
  C:\Windows\System\WvEPkzi.exe
  2⤵
  PID:5308
- C:\Windows\System\kOUNJBO.exe
  C:\Windows\System\kOUNJBO.exe
  2⤵
  PID:5340
- C:\Windows\System\kGSnjld.exe
  C:\Windows\System\kGSnjld.exe
  2⤵
  PID:5376
- C:\Windows\System\inuXsat.exe
  C:\Windows\System\inuXsat.exe
  2⤵
  PID:5416
- C:\Windows\System\RfDhfxS.exe
  C:\Windows\System\RfDhfxS.exe
  2⤵
  PID:5444
- C:\Windows\System\lOhFGFI.exe
  C:\Windows\System\lOhFGFI.exe
  2⤵
  PID:5476
- C:\Windows\System\kmuyaLj.exe
  C:\Windows\System\kmuyaLj.exe
  2⤵
  PID:5516
- C:\Windows\System\dtoJDVN.exe
  C:\Windows\System\dtoJDVN.exe
  2⤵
  PID:5552
- C:\Windows\System\VBnpTSt.exe
  C:\Windows\System\VBnpTSt.exe
  2⤵
  PID:5568
- C:\Windows\System\ntvZKAx.exe
  C:\Windows\System\ntvZKAx.exe
  2⤵
  PID:5600
- C:\Windows\System\mipHKfz.exe
  C:\Windows\System\mipHKfz.exe
  2⤵
  PID:5632
- C:\Windows\System\YchwmjE.exe
  C:\Windows\System\YchwmjE.exe
  2⤵
  PID:5668
- C:\Windows\System\hUjnUTP.exe
  C:\Windows\System\hUjnUTP.exe
  2⤵
  PID:5684
- C:\Windows\System\OwqGNNz.exe
  C:\Windows\System\OwqGNNz.exe
  2⤵
  PID:5720
- C:\Windows\System\ShSQwFh.exe
  C:\Windows\System\ShSQwFh.exe
  2⤵
  PID:5752
- C:\Windows\System\ViWArCA.exe
  C:\Windows\System\ViWArCA.exe
  2⤵
  PID:5780
- C:\Windows\System\YkOXdBH.exe
  C:\Windows\System\YkOXdBH.exe
  2⤵
  PID:5800
- C:\Windows\System\RszlTVy.exe
  C:\Windows\System\RszlTVy.exe
  2⤵
  PID:5856
- C:\Windows\System\TLVEKxy.exe
  C:\Windows\System\TLVEKxy.exe
  2⤵
  PID:5888
- C:\Windows\System\pFCxRrl.exe
  C:\Windows\System\pFCxRrl.exe
  2⤵
  PID:5908
- C:\Windows\System\lAHmuGE.exe
  C:\Windows\System\lAHmuGE.exe
  2⤵
  PID:5932
- C:\Windows\System\ZyeAUNG.exe
  C:\Windows\System\ZyeAUNG.exe
  2⤵
  PID:5964
- C:\Windows\System\fKLXUkI.exe
  C:\Windows\System\fKLXUkI.exe
  2⤵
  PID:5988
- C:\Windows\System\qCfeWKM.exe
  C:\Windows\System\qCfeWKM.exe
  2⤵
  PID:6004
- C:\Windows\System\NfMYPvR.exe
  C:\Windows\System\NfMYPvR.exe
  2⤵
  PID:6040
- C:\Windows\System\utGpiiW.exe
  C:\Windows\System\utGpiiW.exe
  2⤵
  PID:6072
- C:\Windows\System\ehbmKMk.exe
  C:\Windows\System\ehbmKMk.exe
  2⤵
  PID:6100
- C:\Windows\System\AdHOMyJ.exe
  C:\Windows\System\AdHOMyJ.exe
  2⤵
  PID:6128
- C:\Windows\System\qUntdYT.exe
  C:\Windows\System\qUntdYT.exe
  2⤵
  PID:4320
- C:\Windows\System\SaPpJFP.exe
  C:\Windows\System\SaPpJFP.exe
  2⤵
  PID:5136
- C:\Windows\System\UONAiry.exe
  C:\Windows\System\UONAiry.exe
  2⤵
  PID:5252
- C:\Windows\System\WcsozcO.exe
  C:\Windows\System\WcsozcO.exe
  2⤵
  PID:5292
- C:\Windows\System\NbOLrtA.exe
  C:\Windows\System\NbOLrtA.exe
  2⤵
  PID:5392
- C:\Windows\System\ZVtTvmT.exe
  C:\Windows\System\ZVtTvmT.exe
  2⤵
  PID:5492
- C:\Windows\System\WssBLqB.exe
  C:\Windows\System\WssBLqB.exe
  2⤵
  PID:5532
- C:\Windows\System\RmIYqBF.exe
  C:\Windows\System\RmIYqBF.exe
  2⤵
  PID:5588
- C:\Windows\System\fOIhXyi.exe
  C:\Windows\System\fOIhXyi.exe
  2⤵
  PID:5620
- C:\Windows\System\JxnUYdX.exe
  C:\Windows\System\JxnUYdX.exe
  2⤵
  PID:5696
- C:\Windows\System\qIVHuKD.exe
  C:\Windows\System\qIVHuKD.exe
  2⤵
  PID:5772
- C:\Windows\System\iaJBPTD.exe
  C:\Windows\System\iaJBPTD.exe
  2⤵
  PID:4548
- C:\Windows\System\vtxjudf.exe
  C:\Windows\System\vtxjudf.exe
  2⤵
  PID:5844
- C:\Windows\System\cVzZqlg.exe
  C:\Windows\System\cVzZqlg.exe
  2⤵
  PID:5928
- C:\Windows\System\cbMaFOT.exe
  C:\Windows\System\cbMaFOT.exe
  2⤵
  PID:5984
- C:\Windows\System\UoPbMBA.exe
  C:\Windows\System\UoPbMBA.exe
  2⤵
  PID:6020
- C:\Windows\System\ppbHiZr.exe
  C:\Windows\System\ppbHiZr.exe
  2⤵
  PID:6088
- C:\Windows\System\CHMPnSQ.exe
  C:\Windows\System\CHMPnSQ.exe
  2⤵
  PID:5264
- C:\Windows\System\WQDWxzW.exe
  C:\Windows\System\WQDWxzW.exe
  2⤵
  PID:5440
- C:\Windows\System\yTppjUC.exe
  C:\Windows\System\yTppjUC.exe
  2⤵
  PID:5560
- C:\Windows\System\exDeSmL.exe
  C:\Windows\System\exDeSmL.exe
  2⤵
  PID:5664
- C:\Windows\System\UCrBuAB.exe
  C:\Windows\System\UCrBuAB.exe
  2⤵
  PID:5808
- C:\Windows\System\OFrnDha.exe
  C:\Windows\System\OFrnDha.exe
  2⤵
  PID:5884
- C:\Windows\System\VHmdwOp.exe
  C:\Windows\System\VHmdwOp.exe
  2⤵
  PID:1188
- C:\Windows\System\eICkxrt.exe
  C:\Windows\System\eICkxrt.exe
  2⤵
  PID:5332
- C:\Windows\System\fkCQdIi.exe
  C:\Windows\System\fkCQdIi.exe
  2⤵
  PID:5704
- C:\Windows\System\JKwtVwI.exe
  C:\Windows\System\JKwtVwI.exe
  2⤵
  PID:5972
- C:\Windows\System\CyCbtqT.exe
  C:\Windows\System\CyCbtqT.exe
  2⤵
  PID:5764
- C:\Windows\System\adHTugh.exe
  C:\Windows\System\adHTugh.exe
  2⤵
  PID:5504
- C:\Windows\System\kSEczHu.exe
  C:\Windows\System\kSEczHu.exe
  2⤵
  PID:6164
- C:\Windows\System\IfDEanG.exe
  C:\Windows\System\IfDEanG.exe
  2⤵
  PID:6192
- C:\Windows\System\GpGAJQg.exe
  C:\Windows\System\GpGAJQg.exe
  2⤵
  PID:6220
- C:\Windows\System\nCoLITv.exe
  C:\Windows\System\nCoLITv.exe
  2⤵
  PID:6248
- C:\Windows\System\uopzHIf.exe
  C:\Windows\System\uopzHIf.exe
  2⤵
  PID:6268
- C:\Windows\System\viGbyNh.exe
  C:\Windows\System\viGbyNh.exe
  2⤵
  PID:6292
- C:\Windows\System\zPyXmPt.exe
  C:\Windows\System\zPyXmPt.exe
  2⤵
  PID:6324
- C:\Windows\System\rVJxlik.exe
  C:\Windows\System\rVJxlik.exe
  2⤵
  PID:6344
- C:\Windows\System\cIzsrjZ.exe
  C:\Windows\System\cIzsrjZ.exe
  2⤵
  PID:6364
- C:\Windows\System\VZOcMVk.exe
  C:\Windows\System\VZOcMVk.exe
  2⤵
  PID:6412
- C:\Windows\System\FBLLrLr.exe
  C:\Windows\System\FBLLrLr.exe
  2⤵
  PID:6444
- C:\Windows\System\rMeWaEY.exe
  C:\Windows\System\rMeWaEY.exe
  2⤵
  PID:6460
- C:\Windows\System\uphjIqD.exe
  C:\Windows\System\uphjIqD.exe
  2⤵
  PID:6492
- C:\Windows\System\UhMVPPu.exe
  C:\Windows\System\UhMVPPu.exe
  2⤵
  PID:6520
- C:\Windows\System\eGrfavE.exe
  C:\Windows\System\eGrfavE.exe
  2⤵
  PID:6540
- C:\Windows\System\YXuYihn.exe
  C:\Windows\System\YXuYihn.exe
  2⤵
  PID:6560
- C:\Windows\System\KWoTTMA.exe
  C:\Windows\System\KWoTTMA.exe
  2⤵
  PID:6588
- C:\Windows\System\eEsKGUM.exe
  C:\Windows\System\eEsKGUM.exe
  2⤵
  PID:6616
- C:\Windows\System\DdDsZDT.exe
  C:\Windows\System\DdDsZDT.exe
  2⤵
  PID:6644
- C:\Windows\System\AtJEcNy.exe
  C:\Windows\System\AtJEcNy.exe
  2⤵
  PID:6688
- C:\Windows\System\lTKcpWJ.exe
  C:\Windows\System\lTKcpWJ.exe
  2⤵
  PID:6712
- C:\Windows\System\yAXgVIG.exe
  C:\Windows\System\yAXgVIG.exe
  2⤵
  PID:6740
- C:\Windows\System\LxLkfpH.exe
  C:\Windows\System\LxLkfpH.exe
  2⤵
  PID:6768
- C:\Windows\System\sUltRAw.exe
  C:\Windows\System\sUltRAw.exe
  2⤵
  PID:6784
- C:\Windows\System\PLvOTdz.exe
  C:\Windows\System\PLvOTdz.exe
  2⤵
  PID:6816
- C:\Windows\System\dDVhFgB.exe
  C:\Windows\System\dDVhFgB.exe
  2⤵
  PID:6840
- C:\Windows\System\rIcMUIB.exe
  C:\Windows\System\rIcMUIB.exe
  2⤵
  PID:6876
- C:\Windows\System\HcMVwKZ.exe
  C:\Windows\System\HcMVwKZ.exe
  2⤵
  PID:6916
- C:\Windows\System\lpZAlVC.exe
  C:\Windows\System\lpZAlVC.exe
  2⤵
  PID:6936
- C:\Windows\System\ynLGhQG.exe
  C:\Windows\System\ynLGhQG.exe
  2⤵
  PID:6960
- C:\Windows\System\bzGPJSq.exe
  C:\Windows\System\bzGPJSq.exe
  2⤵
  PID:6996
- C:\Windows\System\sseUHTH.exe
  C:\Windows\System\sseUHTH.exe
  2⤵
  PID:7036
- C:\Windows\System\xgOoPwe.exe
  C:\Windows\System\xgOoPwe.exe
  2⤵
  PID:7056
- C:\Windows\System\VXdUZoQ.exe
  C:\Windows\System\VXdUZoQ.exe
  2⤵
  PID:7092
- C:\Windows\System\tEomvWW.exe
  C:\Windows\System\tEomvWW.exe
  2⤵
  PID:7112
- C:\Windows\System\ZZpAyVn.exe
  C:\Windows\System\ZZpAyVn.exe
  2⤵
  PID:7140
- C:\Windows\System\UphdoFc.exe
  C:\Windows\System\UphdoFc.exe
  2⤵
  PID:5360
- C:\Windows\System\nVkrbZV.exe
  C:\Windows\System\nVkrbZV.exe
  2⤵
  PID:6180
- C:\Windows\System\JJWXQie.exe
  C:\Windows\System\JJWXQie.exe
  2⤵
  PID:6276
- C:\Windows\System\qPebdCy.exe
  C:\Windows\System\qPebdCy.exe
  2⤵
  PID:6336
- C:\Windows\System\qVEMDTW.exe
  C:\Windows\System\qVEMDTW.exe
  2⤵
  PID:6380
- C:\Windows\System\DQhsVvQ.exe
  C:\Windows\System\DQhsVvQ.exe
  2⤵
  PID:6484
- C:\Windows\System\joekebp.exe
  C:\Windows\System\joekebp.exe
  2⤵
  PID:6536
- C:\Windows\System\pPqbzSc.exe
  C:\Windows\System\pPqbzSc.exe
  2⤵
  PID:6628
- C:\Windows\System\kqfBgGk.exe
  C:\Windows\System\kqfBgGk.exe
  2⤵
  PID:6632
- C:\Windows\System\PwqIBMe.exe
  C:\Windows\System\PwqIBMe.exe
  2⤵
  PID:6756
- C:\Windows\System\ROYPUIY.exe
  C:\Windows\System\ROYPUIY.exe
  2⤵
  PID:6796
- C:\Windows\System\BzlutUr.exe
  C:\Windows\System\BzlutUr.exe
  2⤵
  PID:6832
- C:\Windows\System\NKJLuRJ.exe
  C:\Windows\System\NKJLuRJ.exe
  2⤵
  PID:6908
- C:\Windows\System\AzbpzTl.exe
  C:\Windows\System\AzbpzTl.exe
  2⤵
  PID:7008
- C:\Windows\System\LHJNswr.exe
  C:\Windows\System\LHJNswr.exe
  2⤵
  PID:7108
- C:\Windows\System\aoCmleg.exe
  C:\Windows\System\aoCmleg.exe
  2⤵
  PID:6160
- C:\Windows\System\gQePIlt.exe
  C:\Windows\System\gQePIlt.exe
  2⤵
  PID:6200
- C:\Windows\System\tqeGCWJ.exe
  C:\Windows\System\tqeGCWJ.exe
  2⤵
  PID:6424
- C:\Windows\System\MLxJjcU.exe
  C:\Windows\System\MLxJjcU.exe
  2⤵
  PID:6548
- C:\Windows\System\XGiWQkQ.exe
  C:\Windows\System\XGiWQkQ.exe
  2⤵
  PID:6636
- C:\Windows\System\nueXocN.exe
  C:\Windows\System\nueXocN.exe
  2⤵
  PID:6868
- C:\Windows\System\ISBBLmx.exe
  C:\Windows\System\ISBBLmx.exe
  2⤵
  PID:7048
- C:\Windows\System\haNIfnE.exe
  C:\Windows\System\haNIfnE.exe
  2⤵
  PID:7128
- C:\Windows\System\XkeocJV.exe
  C:\Windows\System\XkeocJV.exe
  2⤵
  PID:6236
- C:\Windows\System\KllzRnb.exe
  C:\Windows\System\KllzRnb.exe
  2⤵
  PID:6668
- C:\Windows\System\uAIKkST.exe
  C:\Windows\System\uAIKkST.exe
  2⤵
  PID:7124
- C:\Windows\System\JKNbSlO.exe
  C:\Windows\System\JKNbSlO.exe
  2⤵
  PID:7172
- C:\Windows\System\MWmjKZu.exe
  C:\Windows\System\MWmjKZu.exe
  2⤵
  PID:7200
- C:\Windows\System\pRanocM.exe
  C:\Windows\System\pRanocM.exe
  2⤵
  PID:7220
- C:\Windows\System\lElxcXc.exe
  C:\Windows\System\lElxcXc.exe
  2⤵
  PID:7256
- C:\Windows\System\BGLSaWC.exe
  C:\Windows\System\BGLSaWC.exe
  2⤵
  PID:7284
- C:\Windows\System\QhitwTr.exe
  C:\Windows\System\QhitwTr.exe
  2⤵
  PID:7312
- C:\Windows\System\jUZHrlT.exe
  C:\Windows\System\jUZHrlT.exe
  2⤵
  PID:7340
- C:\Windows\System\BVbSmgO.exe
  C:\Windows\System\BVbSmgO.exe
  2⤵
  PID:7368
- C:\Windows\System\RczXIWJ.exe
  C:\Windows\System\RczXIWJ.exe
  2⤵
  PID:7400
- C:\Windows\System\pFQXxhe.exe
  C:\Windows\System\pFQXxhe.exe
  2⤵
  PID:7416
- C:\Windows\System\bOFTNmZ.exe
  C:\Windows\System\bOFTNmZ.exe
  2⤵
  PID:7440
- C:\Windows\System\GhWgXfZ.exe
  C:\Windows\System\GhWgXfZ.exe
  2⤵
  PID:7468
- C:\Windows\System\qzKebux.exe
  C:\Windows\System\qzKebux.exe
  2⤵
  PID:7504
- C:\Windows\System\hNKVfZR.exe
  C:\Windows\System\hNKVfZR.exe
  2⤵
  PID:7532
- C:\Windows\System\nElrjiu.exe
  C:\Windows\System\nElrjiu.exe
  2⤵
  PID:7552
- C:\Windows\System\ynEYAru.exe
  C:\Windows\System\ynEYAru.exe
  2⤵
  PID:7568
- C:\Windows\System\fUngeHS.exe
  C:\Windows\System\fUngeHS.exe
  2⤵
  PID:7596
- C:\Windows\System\VFHMQci.exe
  C:\Windows\System\VFHMQci.exe
  2⤵
  PID:7628
- C:\Windows\System\SlHJftI.exe
  C:\Windows\System\SlHJftI.exe
  2⤵
  PID:7664
- C:\Windows\System\ocfzupb.exe
  C:\Windows\System\ocfzupb.exe
  2⤵
  PID:7720
- C:\Windows\System\PZhczUm.exe
  C:\Windows\System\PZhczUm.exe
  2⤵
  PID:7736
- C:\Windows\System\HTsuuqU.exe
  C:\Windows\System\HTsuuqU.exe
  2⤵
  PID:7752
- C:\Windows\System\wMeoufV.exe
  C:\Windows\System\wMeoufV.exe
  2⤵
  PID:7780
- C:\Windows\System\kmLMHgw.exe
  C:\Windows\System\kmLMHgw.exe
  2⤵
  PID:7820
- C:\Windows\System\ENKOYCR.exe
  C:\Windows\System\ENKOYCR.exe
  2⤵
  PID:7856
- C:\Windows\System\SafDpwF.exe
  C:\Windows\System\SafDpwF.exe
  2⤵
  PID:7888
- C:\Windows\System\nkifmrg.exe
  C:\Windows\System\nkifmrg.exe
  2⤵
  PID:7916
- C:\Windows\System\blZIZfQ.exe
  C:\Windows\System\blZIZfQ.exe
  2⤵
  PID:7936
- C:\Windows\System\zmAveGS.exe
  C:\Windows\System\zmAveGS.exe
  2⤵
  PID:7964
- C:\Windows\System\bFzhUOh.exe
  C:\Windows\System\bFzhUOh.exe
  2⤵
  PID:7996
- C:\Windows\System\lMUHwLY.exe
  C:\Windows\System\lMUHwLY.exe
  2⤵
  PID:8028
- C:\Windows\System\wCGlyIt.exe
  C:\Windows\System\wCGlyIt.exe
  2⤵
  PID:8064
- C:\Windows\System\oulnJxb.exe
  C:\Windows\System\oulnJxb.exe
  2⤵
  PID:8092
- C:\Windows\System\ZczRLYJ.exe
  C:\Windows\System\ZczRLYJ.exe
  2⤵
  PID:8108
- C:\Windows\System\NjRTwOG.exe
  C:\Windows\System\NjRTwOG.exe
  2⤵
  PID:8128
- C:\Windows\System\YvDQjUb.exe
  C:\Windows\System\YvDQjUb.exe
  2⤵
  PID:8160
- C:\Windows\System\lqpmxkJ.exe
  C:\Windows\System\lqpmxkJ.exe
  2⤵
  PID:6572
- C:\Windows\System\UvvNwBA.exe
  C:\Windows\System\UvvNwBA.exe
  2⤵
  PID:7216
- C:\Windows\System\FxbfxTb.exe
  C:\Windows\System\FxbfxTb.exe
  2⤵
  PID:7280
- C:\Windows\System\PISOzFx.exe
  C:\Windows\System\PISOzFx.exe
  2⤵
  PID:7324
- C:\Windows\System\sqMcmfd.exe
  C:\Windows\System\sqMcmfd.exe
  2⤵
  PID:7408
- C:\Windows\System\uNUmfww.exe
  C:\Windows\System\uNUmfww.exe
  2⤵
  PID:7432
- C:\Windows\System\BkpFOxn.exe
  C:\Windows\System\BkpFOxn.exe
  2⤵
  PID:7480
- C:\Windows\System\oNUUFsR.exe
  C:\Windows\System\oNUUFsR.exe
  2⤵
  PID:7656
- C:\Windows\System\DpSjtLK.exe
  C:\Windows\System\DpSjtLK.exe
  2⤵
  PID:7708
- C:\Windows\System\neUjptk.exe
  C:\Windows\System\neUjptk.exe
  2⤵
  PID:7744
- C:\Windows\System\mAPkyFo.exe
  C:\Windows\System\mAPkyFo.exe
  2⤵
  PID:7840
- C:\Windows\System\GoGtEjz.exe
  C:\Windows\System\GoGtEjz.exe
  2⤵
  PID:7864
- C:\Windows\System\YWsLbIu.exe
  C:\Windows\System\YWsLbIu.exe
  2⤵
  PID:7932
- C:\Windows\System\kYsOgFP.exe
  C:\Windows\System\kYsOgFP.exe
  2⤵
  PID:7972
- C:\Windows\System\AtSFVzT.exe
  C:\Windows\System\AtSFVzT.exe
  2⤵
  PID:8056
- C:\Windows\System\VJvWTHV.exe
  C:\Windows\System\VJvWTHV.exe
  2⤵
  PID:8116
- C:\Windows\System\UwiLFIf.exe
  C:\Windows\System\UwiLFIf.exe
  2⤵
  PID:8184
- C:\Windows\System\DJpcOjQ.exe
  C:\Windows\System\DJpcOjQ.exe
  2⤵
  PID:7300
- C:\Windows\System\fBwwePd.exe
  C:\Windows\System\fBwwePd.exe
  2⤵
  PID:7512
- C:\Windows\System\yALejXO.exe
  C:\Windows\System\yALejXO.exe
  2⤵
  PID:7648
- C:\Windows\System\ZvBEZTu.exe
  C:\Windows\System\ZvBEZTu.exe
  2⤵
  PID:7768
- C:\Windows\System\iKjqOqG.exe
  C:\Windows\System\iKjqOqG.exe
  2⤵
  PID:8100
- C:\Windows\System\bRMjlEX.exe
  C:\Windows\System\bRMjlEX.exe
  2⤵
  PID:8172
- C:\Windows\System\OxgFwCO.exe
  C:\Windows\System\OxgFwCO.exe
  2⤵
  PID:7276
- C:\Windows\System\oPfypan.exe
  C:\Windows\System\oPfypan.exe
  2⤵
  PID:7812
- C:\Windows\System\UqDpJJQ.exe
  C:\Windows\System\UqDpJJQ.exe
  2⤵
  PID:7956
- C:\Windows\System\MDBcHlX.exe
  C:\Windows\System\MDBcHlX.exe
  2⤵
  PID:7728
- C:\Windows\System\otWOjuK.exe
  C:\Windows\System\otWOjuK.exe
  2⤵
  PID:8200
- C:\Windows\System\TfgSygh.exe
  C:\Windows\System\TfgSygh.exe
  2⤵
  PID:8220
- C:\Windows\System\YqRYZWu.exe
  C:\Windows\System\YqRYZWu.exe
  2⤵
  PID:8248
- C:\Windows\System\ZTLbcbu.exe
  C:\Windows\System\ZTLbcbu.exe
  2⤵
  PID:8276
- C:\Windows\System\ByQohyg.exe
  C:\Windows\System\ByQohyg.exe
  2⤵
  PID:8304
- C:\Windows\System\VmycOCg.exe
  C:\Windows\System\VmycOCg.exe
  2⤵
  PID:8332
- C:\Windows\System\FuodGzC.exe
  C:\Windows\System\FuodGzC.exe
  2⤵
  PID:8368
- C:\Windows\System\BZyCJFd.exe
  C:\Windows\System\BZyCJFd.exe
  2⤵
  PID:8388
- C:\Windows\System\oXhlCsp.exe
  C:\Windows\System\oXhlCsp.exe
  2⤵
  PID:8416
- C:\Windows\System\AmrqLxf.exe
  C:\Windows\System\AmrqLxf.exe
  2⤵
  PID:8456
- C:\Windows\System\BxGhEKc.exe
  C:\Windows\System\BxGhEKc.exe
  2⤵
  PID:8472
- C:\Windows\System\raeKOfW.exe
  C:\Windows\System\raeKOfW.exe
  2⤵
  PID:8492
- C:\Windows\System\LHKOMZq.exe
  C:\Windows\System\LHKOMZq.exe
  2⤵
  PID:8528
- C:\Windows\System\VHDaBqc.exe
  C:\Windows\System\VHDaBqc.exe
  2⤵
  PID:8560
- C:\Windows\System\iUPydWx.exe
  C:\Windows\System\iUPydWx.exe
  2⤵
  PID:8584
- C:\Windows\System\ThqhHBn.exe
  C:\Windows\System\ThqhHBn.exe
  2⤵
  PID:8600
- C:\Windows\System\WAbLdBH.exe
  C:\Windows\System\WAbLdBH.exe
  2⤵
  PID:8636
- C:\Windows\System\gscvbeu.exe
  C:\Windows\System\gscvbeu.exe
  2⤵
  PID:8656
- C:\Windows\System\fRzUrZl.exe
  C:\Windows\System\fRzUrZl.exe
  2⤵
  PID:8692
- C:\Windows\System\EUtPerg.exe
  C:\Windows\System\EUtPerg.exe
  2⤵
  PID:8724
- C:\Windows\System\XIXLBFR.exe
  C:\Windows\System\XIXLBFR.exe
  2⤵
  PID:8752
- C:\Windows\System\IBREFWy.exe
  C:\Windows\System\IBREFWy.exe
  2⤵
  PID:8780
- C:\Windows\System\yyQbuGF.exe
  C:\Windows\System\yyQbuGF.exe
  2⤵
  PID:8820
- C:\Windows\System\eWWvxzs.exe
  C:\Windows\System\eWWvxzs.exe
  2⤵
  PID:8836
- C:\Windows\System\nHBQLJS.exe
  C:\Windows\System\nHBQLJS.exe
  2⤵
  PID:8868
- C:\Windows\System\KaoWqXK.exe
  C:\Windows\System\KaoWqXK.exe
  2⤵
  PID:8896
- C:\Windows\System\ZcbRAxX.exe
  C:\Windows\System\ZcbRAxX.exe
  2⤵
  PID:8920
- C:\Windows\System\sMrAlOa.exe
  C:\Windows\System\sMrAlOa.exe
  2⤵
  PID:8952
- C:\Windows\System\ZgSxbQo.exe
  C:\Windows\System\ZgSxbQo.exe
  2⤵
  PID:8980
- C:\Windows\System\gTwKcBf.exe
  C:\Windows\System\gTwKcBf.exe
  2⤵
  PID:9004
- C:\Windows\System\IHuMysD.exe
  C:\Windows\System\IHuMysD.exe
  2⤵
  PID:9020
- C:\Windows\System\JJsfRNs.exe
  C:\Windows\System\JJsfRNs.exe
  2⤵
  PID:9044
- C:\Windows\System\ftwTeiJ.exe
  C:\Windows\System\ftwTeiJ.exe
  2⤵
  PID:9072
- C:\Windows\System\shQcTLz.exe
  C:\Windows\System\shQcTLz.exe
  2⤵
  PID:9108
- C:\Windows\System\YXLqyGJ.exe
  C:\Windows\System\YXLqyGJ.exe
  2⤵
  PID:9136
- C:\Windows\System\ggDmcdG.exe
  C:\Windows\System\ggDmcdG.exe
  2⤵
  PID:9160
- C:\Windows\System\WEyyKjE.exe
  C:\Windows\System\WEyyKjE.exe
  2⤵
  PID:9188
- C:\Windows\System\ysfyXug.exe
  C:\Windows\System\ysfyXug.exe
  2⤵
  PID:7608
- C:\Windows\System\TjawUcB.exe
  C:\Windows\System\TjawUcB.exe
  2⤵
  PID:8232
- C:\Windows\System\aSefLAl.exe
  C:\Windows\System\aSefLAl.exe
  2⤵
  PID:8324
- C:\Windows\System\tqiabhi.exe
  C:\Windows\System\tqiabhi.exe
  2⤵
  PID:8380
- C:\Windows\System\eAzgWAa.exe
  C:\Windows\System\eAzgWAa.exe
  2⤵
  PID:8444
- C:\Windows\System\aSVWEsz.exe
  C:\Windows\System\aSVWEsz.exe
  2⤵
  PID:8488
- C:\Windows\System\eexGRYY.exe
  C:\Windows\System\eexGRYY.exe
  2⤵
  PID:8524
- C:\Windows\System\kTObSPQ.exe
  C:\Windows\System\kTObSPQ.exe
  2⤵
  PID:8620
- C:\Windows\System\VBFXMjL.exe
  C:\Windows\System\VBFXMjL.exe
  2⤵
  PID:8668
- C:\Windows\System\UhzhYzP.exe
  C:\Windows\System\UhzhYzP.exe
  2⤵
  PID:8792
- C:\Windows\System\YvUFpgL.exe
  C:\Windows\System\YvUFpgL.exe
  2⤵
  PID:8876
- C:\Windows\System\SCACegc.exe
  C:\Windows\System\SCACegc.exe
  2⤵
  PID:8948
- C:\Windows\System\uodFbPM.exe
  C:\Windows\System\uodFbPM.exe
  2⤵
  PID:9012
- C:\Windows\System\xspmimx.exe
  C:\Windows\System\xspmimx.exe
  2⤵
  PID:9092
- C:\Windows\System\FrhjhFK.exe
  C:\Windows\System\FrhjhFK.exe
  2⤵
  PID:9128
- C:\Windows\System\pgzkYfp.exe
  C:\Windows\System\pgzkYfp.exe
  2⤵
  PID:9200
- C:\Windows\System\XRKJhID.exe
  C:\Windows\System\XRKJhID.exe
  2⤵
  PID:9172
- C:\Windows\System\gPBXhHi.exe
  C:\Windows\System\gPBXhHi.exe
  2⤵
  PID:8384
- C:\Windows\System\ZnrMZdH.exe
  C:\Windows\System\ZnrMZdH.exe
  2⤵
  PID:8516
- C:\Windows\System\EkmWEYe.exe
  C:\Windows\System\EkmWEYe.exe
  2⤵
  PID:8612
- C:\Windows\System\itrVINu.exe
  C:\Windows\System\itrVINu.exe
  2⤵
  PID:8832
- C:\Windows\System\mBrOvaU.exe
  C:\Windows\System\mBrOvaU.exe
  2⤵
  PID:8992
- C:\Windows\System\GPJCyRt.exe
  C:\Windows\System\GPJCyRt.exe
  2⤵
  PID:9124
- C:\Windows\System\XIfrjFu.exe
  C:\Windows\System\XIfrjFu.exe
  2⤵
  PID:8400
- C:\Windows\System\AwfJSNa.exe
  C:\Windows\System\AwfJSNa.exe
  2⤵
  PID:8512
- C:\Windows\System\gxkVHJm.exe
  C:\Windows\System\gxkVHJm.exe
  2⤵
  PID:8976
- C:\Windows\System\iDFInLF.exe
  C:\Windows\System\iDFInLF.exe
  2⤵
  PID:8264
- C:\Windows\System\ktrodGG.exe
  C:\Windows\System\ktrodGG.exe
  2⤵
  PID:9240
- C:\Windows\System\RJgCCeK.exe
  C:\Windows\System\RJgCCeK.exe
  2⤵
  PID:9272
- C:\Windows\System\GVppoFY.exe
  C:\Windows\System\GVppoFY.exe
  2⤵
  PID:9312
- C:\Windows\System\icqWsDB.exe
  C:\Windows\System\icqWsDB.exe
  2⤵
  PID:9328
- C:\Windows\System\JVjRqpr.exe
  C:\Windows\System\JVjRqpr.exe
  2⤵
  PID:9360
- C:\Windows\System\bsQmmzY.exe
  C:\Windows\System\bsQmmzY.exe
  2⤵
  PID:9384
- C:\Windows\System\RJjbhBM.exe
  C:\Windows\System\RJjbhBM.exe
  2⤵
  PID:9404
- C:\Windows\System\JObcYEb.exe
  C:\Windows\System\JObcYEb.exe
  2⤵
  PID:9440
- C:\Windows\System\IgbcNwI.exe
  C:\Windows\System\IgbcNwI.exe
  2⤵
  PID:9468
- C:\Windows\System\lFVeUbj.exe
  C:\Windows\System\lFVeUbj.exe
  2⤵
  PID:9492
- C:\Windows\System\qcuXXck.exe
  C:\Windows\System\qcuXXck.exe
  2⤵
  PID:9512
- C:\Windows\System\QCZBPBH.exe
  C:\Windows\System\QCZBPBH.exe
  2⤵
  PID:9532
- C:\Windows\System\XSIBKyM.exe
  C:\Windows\System\XSIBKyM.exe
  2⤵
  PID:9580
- C:\Windows\System\GGHCgbY.exe
  C:\Windows\System\GGHCgbY.exe
  2⤵
  PID:9596
- C:\Windows\System\kQZBhlL.exe
  C:\Windows\System\kQZBhlL.exe
  2⤵
  PID:9636
- C:\Windows\System\qSfldfv.exe
  C:\Windows\System\qSfldfv.exe
  2⤵
  PID:9664
- C:\Windows\System\rMsWFYI.exe
  C:\Windows\System\rMsWFYI.exe
  2⤵
  PID:9692
- C:\Windows\System\IIxojlQ.exe
  C:\Windows\System\IIxojlQ.exe
  2⤵
  PID:9720
- C:\Windows\System\jhuIoLQ.exe
  C:\Windows\System\jhuIoLQ.exe
  2⤵
  PID:9748
- C:\Windows\System\IWWepeh.exe
  C:\Windows\System\IWWepeh.exe
  2⤵
  PID:9776
- C:\Windows\System\ROMhhAx.exe
  C:\Windows\System\ROMhhAx.exe
  2⤵
  PID:9796
- C:\Windows\System\gPEwbKa.exe
  C:\Windows\System\gPEwbKa.exe
  2⤵
  PID:9820
- C:\Windows\System\MToGrFt.exe
  C:\Windows\System\MToGrFt.exe
  2⤵
  PID:9852
- C:\Windows\System\klsviFK.exe
  C:\Windows\System\klsviFK.exe
  2⤵
  PID:9884
- C:\Windows\System\lXidAfx.exe
  C:\Windows\System\lXidAfx.exe
  2⤵
  PID:9904
- C:\Windows\System\KwcoHOJ.exe
  C:\Windows\System\KwcoHOJ.exe
  2⤵
  PID:9928
- C:\Windows\System\SZGXzEd.exe
  C:\Windows\System\SZGXzEd.exe
  2⤵
  PID:9964
- C:\Windows\System\rYmdAaw.exe
  C:\Windows\System\rYmdAaw.exe
  2⤵
  PID:9996
- C:\Windows\System\CYPkTdM.exe
  C:\Windows\System\CYPkTdM.exe
  2⤵
  PID:10028
- C:\Windows\System\PHhBBGc.exe
  C:\Windows\System\PHhBBGc.exe
  2⤵
  PID:10064
- C:\Windows\System\MrVglpc.exe
  C:\Windows\System\MrVglpc.exe
  2⤵
  PID:10084
- C:\Windows\System\VzZuAyg.exe
  C:\Windows\System\VzZuAyg.exe
  2⤵
  PID:10100
- C:\Windows\System\nnsXupB.exe
  C:\Windows\System\nnsXupB.exe
  2⤵
  PID:10120
- C:\Windows\System\oChoDEy.exe
  C:\Windows\System\oChoDEy.exe
  2⤵
  PID:10140
- C:\Windows\System\kuJKpao.exe
  C:\Windows\System\kuJKpao.exe
  2⤵
  PID:10164
- C:\Windows\System\MRvSwpI.exe
  C:\Windows\System\MRvSwpI.exe
  2⤵
  PID:10192
- C:\Windows\System\MumeuoE.exe
  C:\Windows\System\MumeuoE.exe
  2⤵
  PID:10212
- C:\Windows\System\NIdDNOc.exe
  C:\Windows\System\NIdDNOc.exe
  2⤵
  PID:8964
- C:\Windows\System\FcdBqik.exe
  C:\Windows\System\FcdBqik.exe
  2⤵
  PID:9212
- C:\Windows\System\vVJVHlm.exe
  C:\Windows\System\vVJVHlm.exe
  2⤵
  PID:9340
- C:\Windows\System\pfwJeOP.exe
  C:\Windows\System\pfwJeOP.exe
  2⤵
  PID:9424
- C:\Windows\System\fQLecHa.exe
  C:\Windows\System\fQLecHa.exe
  2⤵
  PID:9504
- C:\Windows\System\lvBPpQL.exe
  C:\Windows\System\lvBPpQL.exe
  2⤵
  PID:9540
- C:\Windows\System\ALTMgZV.exe
  C:\Windows\System\ALTMgZV.exe
  2⤵
  PID:9620
- C:\Windows\System\MnaURZO.exe
  C:\Windows\System\MnaURZO.exe
  2⤵
  PID:9708
- C:\Windows\System\EYyPyxZ.exe
  C:\Windows\System\EYyPyxZ.exe
  2⤵
  PID:9768
- C:\Windows\System\BiPlJgt.exe
  C:\Windows\System\BiPlJgt.exe
  2⤵
  PID:9876
- C:\Windows\System\ljuoGyQ.exe
  C:\Windows\System\ljuoGyQ.exe
  2⤵
  PID:9900
- C:\Windows\System\QEdfVJh.exe
  C:\Windows\System\QEdfVJh.exe
  2⤵
  PID:9916
- C:\Windows\System\sTftiBE.exe
  C:\Windows\System\sTftiBE.exe
  2⤵
  PID:10040
- C:\Windows\System\cjtSfpT.exe
  C:\Windows\System\cjtSfpT.exe
  2⤵
  PID:10092
- C:\Windows\System\odDGcty.exe
  C:\Windows\System\odDGcty.exe
  2⤵
  PID:10180
- C:\Windows\System\RxctLdG.exe
  C:\Windows\System\RxctLdG.exe
  2⤵
  PID:10156
- C:\Windows\System\DyQnwaM.exe
  C:\Windows\System\DyQnwaM.exe
  2⤵
  PID:10208
- C:\Windows\System\kmOFxur.exe
  C:\Windows\System\kmOFxur.exe
  2⤵
  PID:9452
- C:\Windows\System\yfLSTNR.exe
  C:\Windows\System\yfLSTNR.exe
  2⤵
  PID:9520
- C:\Windows\System\EMhngXg.exe
  C:\Windows\System\EMhngXg.exe
  2⤵
  PID:9672
- C:\Windows\System\KksQtec.exe
  C:\Windows\System\KksQtec.exe
  2⤵
  PID:9864
- C:\Windows\System\rXZqALX.exe
  C:\Windows\System\rXZqALX.exe
  2⤵
  PID:10176
- C:\Windows\System\NEwdjks.exe
  C:\Windows\System\NEwdjks.exe
  2⤵
  PID:10200
- C:\Windows\System\MtOQjfh.exe
  C:\Windows\System\MtOQjfh.exe
  2⤵
  PID:8344
- C:\Windows\System\ZcqgYOu.exe
  C:\Windows\System\ZcqgYOu.exe
  2⤵
  PID:9592
- C:\Windows\System\UlaWvMm.exe
  C:\Windows\System\UlaWvMm.exe
  2⤵
  PID:10112
- C:\Windows\System\TDuugcO.exe
  C:\Windows\System\TDuugcO.exe
  2⤵
  PID:9500
- C:\Windows\System\RBuhngz.exe
  C:\Windows\System\RBuhngz.exe
  2⤵
  PID:10272
- C:\Windows\System\fYJJtru.exe
  C:\Windows\System\fYJJtru.exe
  2⤵
  PID:10288
- C:\Windows\System\dXhajJK.exe
  C:\Windows\System\dXhajJK.exe
  2⤵
  PID:10320
- C:\Windows\System\JInqAMp.exe
  C:\Windows\System\JInqAMp.exe
  2⤵
  PID:10348
- C:\Windows\System\xGzZmCc.exe
  C:\Windows\System\xGzZmCc.exe
  2⤵
  PID:10380
- C:\Windows\System\TOJMBes.exe
  C:\Windows\System\TOJMBes.exe
  2⤵
  PID:10416
- C:\Windows\System\ZIrDFLd.exe
  C:\Windows\System\ZIrDFLd.exe
  2⤵
  PID:10440
- C:\Windows\System\apxjZXu.exe
  C:\Windows\System\apxjZXu.exe
  2⤵
  PID:10468
- C:\Windows\System\bBHQxqf.exe
  C:\Windows\System\bBHQxqf.exe
  2⤵
  PID:10492
- C:\Windows\System\rRiNCEn.exe
  C:\Windows\System\rRiNCEn.exe
  2⤵
  PID:10516
- C:\Windows\System\luNhGAw.exe
  C:\Windows\System\luNhGAw.exe
  2⤵
  PID:10540
- C:\Windows\System\vVbdIAZ.exe
  C:\Windows\System\vVbdIAZ.exe
  2⤵
  PID:10572
- C:\Windows\System\PiOXKKu.exe
  C:\Windows\System\PiOXKKu.exe
  2⤵
  PID:10600
- C:\Windows\System\YZyGKRw.exe
  C:\Windows\System\YZyGKRw.exe
  2⤵
  PID:10636
- C:\Windows\System\AKzuKMs.exe
  C:\Windows\System\AKzuKMs.exe
  2⤵
  PID:10652
- C:\Windows\System\JBtLFVR.exe
  C:\Windows\System\JBtLFVR.exe
  2⤵
  PID:10668
- C:\Windows\System\GDwlZsC.exe
  C:\Windows\System\GDwlZsC.exe
  2⤵
  PID:10700
- C:\Windows\System\rKnvAHO.exe
  C:\Windows\System\rKnvAHO.exe
  2⤵
  PID:10736
- C:\Windows\System\BAzoiuI.exe
  C:\Windows\System\BAzoiuI.exe
  2⤵
  PID:10764
- C:\Windows\System\xLRQoaX.exe
  C:\Windows\System\xLRQoaX.exe
  2⤵
  PID:10796
- C:\Windows\System\OVppPKI.exe
  C:\Windows\System\OVppPKI.exe
  2⤵
  PID:10828
- C:\Windows\System\NVhlAWv.exe
  C:\Windows\System\NVhlAWv.exe
  2⤵
  PID:10860
- C:\Windows\System\uUlmuQD.exe
  C:\Windows\System\uUlmuQD.exe
  2⤵
  PID:10880
- C:\Windows\System\hZOKErP.exe
  C:\Windows\System\hZOKErP.exe
  2⤵
  PID:10912
- C:\Windows\System\jTGpMfF.exe
  C:\Windows\System\jTGpMfF.exe
  2⤵
  PID:10936
- C:\Windows\System\TIcUNBj.exe
  C:\Windows\System\TIcUNBj.exe
  2⤵
  PID:10972
- C:\Windows\System\JNUKybg.exe
  C:\Windows\System\JNUKybg.exe
  2⤵
  PID:10992
- C:\Windows\System\sLlCLTv.exe
  C:\Windows\System\sLlCLTv.exe
  2⤵
  PID:11028
- C:\Windows\System\TxpeERm.exe
  C:\Windows\System\TxpeERm.exe
  2⤵
  PID:11060
- C:\Windows\System\XmeQWLL.exe
  C:\Windows\System\XmeQWLL.exe
  2⤵
  PID:11096
- C:\Windows\System\kDODKGY.exe
  C:\Windows\System\kDODKGY.exe
  2⤵
  PID:11116
- C:\Windows\System\UGirwqu.exe
  C:\Windows\System\UGirwqu.exe
  2⤵
  PID:11148
- C:\Windows\System\pPiuOSq.exe
  C:\Windows\System\pPiuOSq.exe
  2⤵
  PID:11180
- C:\Windows\System\XsqdoZz.exe
  C:\Windows\System\XsqdoZz.exe
  2⤵
  PID:11196
- C:\Windows\System\iribbyd.exe
  C:\Windows\System\iribbyd.exe
  2⤵
  PID:11216
- C:\Windows\System\dtKxofx.exe
  C:\Windows\System\dtKxofx.exe
  2⤵
  PID:11236
- C:\Windows\System\JVuhJJn.exe
  C:\Windows\System\JVuhJJn.exe
  2⤵
  PID:10008
- C:\Windows\System\hkdbKjw.exe
  C:\Windows\System\hkdbKjw.exe
  2⤵
  PID:10280
- C:\Windows\System\fdBZGje.exe
  C:\Windows\System\fdBZGje.exe
  2⤵
  PID:10400
- C:\Windows\System\HEhxxhl.exe
  C:\Windows\System\HEhxxhl.exe
  2⤵
  PID:10428
- C:\Windows\System\izWApdl.exe
  C:\Windows\System\izWApdl.exe
  2⤵
  PID:10424
- C:\Windows\System\IpDxPSp.exe
  C:\Windows\System\IpDxPSp.exe
  2⤵
  PID:10480
- C:\Windows\System\EHQPOmT.exe
  C:\Windows\System\EHQPOmT.exe
  2⤵
  PID:10592
- C:\Windows\System\QksheeP.exe
  C:\Windows\System\QksheeP.exe
  2⤵
  PID:10620
- C:\Windows\System\YDuzWrD.exe
  C:\Windows\System\YDuzWrD.exe
  2⤵
  PID:10688
- C:\Windows\System\puSgMfs.exe
  C:\Windows\System\puSgMfs.exe
  2⤵
  PID:10848
- C:\Windows\System\WDDwLtV.exe
  C:\Windows\System\WDDwLtV.exe
  2⤵
  PID:10892
- C:\Windows\System\iYIKxzn.exe
  C:\Windows\System\iYIKxzn.exe
  2⤵
  PID:10896
- C:\Windows\System\AEMAqnv.exe
  C:\Windows\System\AEMAqnv.exe
  2⤵
  PID:11024
- C:\Windows\System\hchLRaT.exe
  C:\Windows\System\hchLRaT.exe
  2⤵
  PID:11044
- C:\Windows\System\ReMilMt.exe
  C:\Windows\System\ReMilMt.exe
  2⤵
  PID:11108
- C:\Windows\System\jJYduaq.exe
  C:\Windows\System\jJYduaq.exe
  2⤵
  PID:11172
- C:\Windows\System\sSOogfj.exe
  C:\Windows\System\sSOogfj.exe
  2⤵
  PID:11256
- C:\Windows\System\VZMWfRZ.exe
  C:\Windows\System\VZMWfRZ.exe
  2⤵
  PID:10304
- C:\Windows\System\IePhbou.exe
  C:\Windows\System\IePhbou.exe
  2⤵
  PID:10500
- C:\Windows\System\YMXZaZs.exe
  C:\Windows\System\YMXZaZs.exe
  2⤵
  PID:10784
- C:\Windows\System\OHuzYrK.exe
  C:\Windows\System\OHuzYrK.exe
  2⤵
  PID:10792
- C:\Windows\System\rIrOAXC.exe
  C:\Windows\System\rIrOAXC.exe
  2⤵
  PID:10984
- C:\Windows\System\vNuWghm.exe
  C:\Windows\System\vNuWghm.exe
  2⤵
  PID:11104
- C:\Windows\System\bEecDoj.exe
  C:\Windows\System\bEecDoj.exe
  2⤵
  PID:9284
- C:\Windows\System\NefCBhr.exe
  C:\Windows\System\NefCBhr.exe
  2⤵
  PID:10344
- C:\Windows\System\cLkQcYb.exe
  C:\Windows\System\cLkQcYb.exe
  2⤵
  PID:10756
- C:\Windows\System\fCMOZuR.exe
  C:\Windows\System\fCMOZuR.exe
  2⤵
  PID:10856
- C:\Windows\System\gJEKDfZ.exe
  C:\Windows\System\gJEKDfZ.exe
  2⤵
  PID:10224
- C:\Windows\System\QTAuMbk.exe
  C:\Windows\System\QTAuMbk.exe
  2⤵
  PID:11304
- C:\Windows\System\wJKSlzU.exe
  C:\Windows\System\wJKSlzU.exe
  2⤵
  PID:11340
- C:\Windows\System\WUnfBud.exe
  C:\Windows\System\WUnfBud.exe
  2⤵
  PID:11372
- C:\Windows\System\hUUdwyJ.exe
  C:\Windows\System\hUUdwyJ.exe
  2⤵
  PID:11400
- C:\Windows\System\QTkqLKR.exe
  C:\Windows\System\QTkqLKR.exe
  2⤵
  PID:11416
- C:\Windows\System\MLUnARY.exe
  C:\Windows\System\MLUnARY.exe
  2⤵
  PID:11436
- C:\Windows\System\JQnKHsw.exe
  C:\Windows\System\JQnKHsw.exe
  2⤵
  PID:11456
- C:\Windows\System\ilDMLMB.exe
  C:\Windows\System\ilDMLMB.exe
  2⤵
  PID:11476
- C:\Windows\System\nsdnLKv.exe
  C:\Windows\System\nsdnLKv.exe
  2⤵
  PID:11496
- C:\Windows\System\kLheOIo.exe
  C:\Windows\System\kLheOIo.exe
  2⤵
  PID:11532
- C:\Windows\System\uELYMMA.exe
  C:\Windows\System\uELYMMA.exe
  2⤵
  PID:11548
- C:\Windows\System\ITfcows.exe
  C:\Windows\System\ITfcows.exe
  2⤵
  PID:11580
- C:\Windows\System\HPAnYRq.exe
  C:\Windows\System\HPAnYRq.exe
  2⤵
  PID:11612
- C:\Windows\System\HTnboIN.exe
  C:\Windows\System\HTnboIN.exe
  2⤵
  PID:11640
- C:\Windows\System\VwhyaeY.exe
  C:\Windows\System\VwhyaeY.exe
  2⤵
  PID:11668
- C:\Windows\System\MRIUOda.exe
  C:\Windows\System\MRIUOda.exe
  2⤵
  PID:11700
- C:\Windows\System\iRzcQpV.exe
  C:\Windows\System\iRzcQpV.exe
  2⤵
  PID:11728
- C:\Windows\System\rZBZeIi.exe
  C:\Windows\System\rZBZeIi.exe
  2⤵
  PID:11760
- C:\Windows\System\oaXEvCp.exe
  C:\Windows\System\oaXEvCp.exe
  2⤵
  PID:11792
- C:\Windows\System\wTnzqkx.exe
  C:\Windows\System\wTnzqkx.exe
  2⤵
  PID:11824
- C:\Windows\System\rtDzeTK.exe
  C:\Windows\System\rtDzeTK.exe
  2⤵
  PID:11848
- C:\Windows\System\XadlRkN.exe
  C:\Windows\System\XadlRkN.exe
  2⤵
  PID:11884
- C:\Windows\System\ETLJLlI.exe
  C:\Windows\System\ETLJLlI.exe
  2⤵
  PID:11908
- C:\Windows\System\yPYzohS.exe
  C:\Windows\System\yPYzohS.exe
  2⤵
  PID:11932
- C:\Windows\System\sxweIfF.exe
  C:\Windows\System\sxweIfF.exe
  2⤵
  PID:11956
- C:\Windows\System\zxFucrE.exe
  C:\Windows\System\zxFucrE.exe
  2⤵
  PID:12000
- C:\Windows\System\dooEggw.exe
  C:\Windows\System\dooEggw.exe
  2⤵
  PID:12020
- C:\Windows\System\aBCAJNn.exe
  C:\Windows\System\aBCAJNn.exe
  2⤵
  PID:12044
- C:\Windows\System\zEohPvT.exe
  C:\Windows\System\zEohPvT.exe
  2⤵
  PID:12072
- C:\Windows\System\NZtrfNG.exe
  C:\Windows\System\NZtrfNG.exe
  2⤵
  PID:12112
- C:\Windows\System\XFmgZey.exe
  C:\Windows\System\XFmgZey.exe
  2⤵
  PID:12152
- C:\Windows\System\jCcimuf.exe
  C:\Windows\System\jCcimuf.exe
  2⤵
  PID:12176
- C:\Windows\System\FfMlCHQ.exe
  C:\Windows\System\FfMlCHQ.exe
  2⤵
  PID:12196
- C:\Windows\System\SbrBvRe.exe
  C:\Windows\System\SbrBvRe.exe
  2⤵
  PID:12220
- C:\Windows\System\GUxxdPu.exe
  C:\Windows\System\GUxxdPu.exe
  2⤵
  PID:12248
- C:\Windows\System\csUhbWg.exe
  C:\Windows\System\csUhbWg.exe
  2⤵
  PID:12272
- C:\Windows\System\GVzBYdx.exe
  C:\Windows\System\GVzBYdx.exe
  2⤵
  PID:10488
- C:\Windows\System\TObknAR.exe
  C:\Windows\System\TObknAR.exe
  2⤵
  PID:11320
- C:\Windows\System\wAumnwO.exe
  C:\Windows\System\wAumnwO.exe
  2⤵
  PID:11392
- C:\Windows\System\TVSMsEW.exe
  C:\Windows\System\TVSMsEW.exe
  2⤵
  PID:11492
- C:\Windows\System\NuCccYH.exe
  C:\Windows\System\NuCccYH.exe
  2⤵
  PID:11576
- C:\Windows\System\VrIvQom.exe
  C:\Windows\System\VrIvQom.exe
  2⤵
  PID:11588
- C:\Windows\System\iFpLGNU.exe
  C:\Windows\System\iFpLGNU.exe
  2⤵
  PID:11708
- C:\Windows\System\unMCYxS.exe
  C:\Windows\System\unMCYxS.exe
  2⤵
  PID:11776
- C:\Windows\System\TNTQkkP.exe
  C:\Windows\System\TNTQkkP.exe
  2⤵
  PID:11772
- C:\Windows\System\bHtcGbb.exe
  C:\Windows\System\bHtcGbb.exe
  2⤵
  PID:11872
- C:\Windows\System\CisYnkI.exe
  C:\Windows\System\CisYnkI.exe
  2⤵
  PID:11924
- C:\Windows\System\zDvZxXe.exe
  C:\Windows\System\zDvZxXe.exe
  2⤵
  PID:11972
- C:\Windows\System\JwuegDa.exe
  C:\Windows\System\JwuegDa.exe
  2⤵
  PID:10716
- C:\Windows\System\ztXoXLY.exe
  C:\Windows\System\ztXoXLY.exe
  2⤵
  PID:12084
- C:\Windows\System\DLBiNBw.exe
  C:\Windows\System\DLBiNBw.exe
  2⤵
  PID:12212
- C:\Windows\System\pFbncoW.exe
  C:\Windows\System\pFbncoW.exe
  2⤵
  PID:12268
- C:\Windows\System\PQcRCcq.exe
  C:\Windows\System\PQcRCcq.exe
  2⤵
  PID:11156
- C:\Windows\System\wLogWWX.exe
  C:\Windows\System\wLogWWX.exe
  2⤵
  PID:11540
- C:\Windows\System\LbpHKpU.exe
  C:\Windows\System\LbpHKpU.exe
  2⤵
  PID:11524
- C:\Windows\System\ZaQPKnH.exe
  C:\Windows\System\ZaQPKnH.exe
  2⤵
  PID:11752
- C:\Windows\System\FdNwDEU.exe
  C:\Windows\System\FdNwDEU.exe
  2⤵
  PID:11868
- C:\Windows\System\mBmFoKG.exe
  C:\Windows\System\mBmFoKG.exe
  2⤵
  PID:12036
- C:\Windows\System\olGvFQe.exe
  C:\Windows\System\olGvFQe.exe
  2⤵
  PID:12188
- C:\Windows\System\CUKoPVL.exe
  C:\Windows\System\CUKoPVL.exe
  2⤵
  PID:11484
- C:\Windows\System\hJYrtNn.exe
  C:\Windows\System\hJYrtNn.exe
  2⤵
  PID:11720
- C:\Windows\System\hFdfdnc.exe
  C:\Windows\System\hFdfdnc.exe
  2⤵
  PID:12104
- C:\Windows\System\KYwcRkH.exe
  C:\Windows\System\KYwcRkH.exe
  2⤵
  PID:11740
- C:\Windows\System\sTeEcSb.exe
  C:\Windows\System\sTeEcSb.exe
  2⤵
  PID:11356
- C:\Windows\System\NZFbKuu.exe
  C:\Windows\System\NZFbKuu.exe
  2⤵
  PID:12296
- C:\Windows\System\hiMoXyV.exe
  C:\Windows\System\hiMoXyV.exe
  2⤵
  PID:12332
- C:\Windows\System\EwgszsA.exe
  C:\Windows\System\EwgszsA.exe
  2⤵
  PID:12348
- C:\Windows\System\nWqNfNC.exe
  C:\Windows\System\nWqNfNC.exe
  2⤵
  PID:12372
- C:\Windows\System\reVChqP.exe
  C:\Windows\System\reVChqP.exe
  2⤵
  PID:12400
- C:\Windows\System\nsaFfVd.exe
  C:\Windows\System\nsaFfVd.exe
  2⤵
  PID:12428
- C:\Windows\System\BqoyDkZ.exe
  C:\Windows\System\BqoyDkZ.exe
  2⤵
  PID:12456
- C:\Windows\System\iriwjRy.exe
  C:\Windows\System\iriwjRy.exe
  2⤵
  PID:12476
- C:\Windows\System\wvHbmyE.exe
  C:\Windows\System\wvHbmyE.exe
  2⤵
  PID:12500
- C:\Windows\System\VNMdUsB.exe
  C:\Windows\System\VNMdUsB.exe
  2⤵
  PID:12524
- C:\Windows\System\ksEmuJt.exe
  C:\Windows\System\ksEmuJt.exe
  2⤵
  PID:12556
- C:\Windows\System\jcyYAtv.exe
  C:\Windows\System\jcyYAtv.exe
  2⤵
  PID:12596
- C:\Windows\System\uZzhnjl.exe
  C:\Windows\System\uZzhnjl.exe
  2⤵
  PID:12632
- C:\Windows\System\ozsztQe.exe
  C:\Windows\System\ozsztQe.exe
  2⤵
  PID:12660
- C:\Windows\System\tXtXejW.exe
  C:\Windows\System\tXtXejW.exe
  2⤵
  PID:12680
- C:\Windows\System\vGvyNJe.exe
  C:\Windows\System\vGvyNJe.exe
  2⤵
  PID:12708
- C:\Windows\System\YSYMcbw.exe
  C:\Windows\System\YSYMcbw.exe
  2⤵
  PID:12736
- C:\Windows\System\hUgUSvA.exe
  C:\Windows\System\hUgUSvA.exe
  2⤵
  PID:12760
- C:\Windows\System\BDFwUYP.exe
  C:\Windows\System\BDFwUYP.exe
  2⤵
  PID:12792
- C:\Windows\System\gvMSIew.exe
  C:\Windows\System\gvMSIew.exe
  2⤵
  PID:12816
- C:\Windows\System\ouhfjwe.exe
  C:\Windows\System\ouhfjwe.exe
  2⤵
  PID:12844
- C:\Windows\System\DaMOOfH.exe
  C:\Windows\System\DaMOOfH.exe
  2⤵
  PID:12888
- C:\Windows\System\lvxOZSD.exe
  C:\Windows\System\lvxOZSD.exe
  2⤵
  PID:12920
- C:\Windows\System\nFPWhFL.exe
  C:\Windows\System\nFPWhFL.exe
  2⤵
  PID:12944
- C:\Windows\System\OutOHAq.exe
  C:\Windows\System\OutOHAq.exe
  2⤵
  PID:12964
- C:\Windows\System\umSDhcT.exe
  C:\Windows\System\umSDhcT.exe
  2⤵
  PID:12988
- C:\Windows\System\DuPqeiw.exe
  C:\Windows\System\DuPqeiw.exe
  2⤵
  PID:13008
- C:\Windows\System\yJdNDxP.exe
  C:\Windows\System\yJdNDxP.exe
  2⤵
  PID:13040
- C:\Windows\System\TTnDzhG.exe
  C:\Windows\System\TTnDzhG.exe
  2⤵
  PID:13076
- C:\Windows\System\pmTLbFm.exe
  C:\Windows\System\pmTLbFm.exe
  2⤵
  PID:13108
- C:\Windows\System\efEnZFf.exe
  C:\Windows\System\efEnZFf.exe
  2⤵
  PID:13144
- C:\Windows\System\NsSzdku.exe
  C:\Windows\System\NsSzdku.exe
  2⤵
  PID:13180
- C:\Windows\System\rzwphhq.exe
  C:\Windows\System\rzwphhq.exe
  2⤵
  PID:13208
- C:\Windows\System\ZjhroLx.exe
  C:\Windows\System\ZjhroLx.exe
  2⤵
  PID:13252
- C:\Windows\System\vAbSfyz.exe
  C:\Windows\System\vAbSfyz.exe
  2⤵
  PID:13268
- C:\Windows\System\JGYFmFv.exe
  C:\Windows\System\JGYFmFv.exe
  2⤵
  PID:13300
- C:\Windows\System\HatwGMx.exe
  C:\Windows\System\HatwGMx.exe
  2⤵
  PID:12320
- C:\Windows\System\XUhEkza.exe
  C:\Windows\System\XUhEkza.exe
  2⤵
  PID:12304
- C:\Windows\System\ysXqBPJ.exe
  C:\Windows\System\ysXqBPJ.exe
  2⤵
  PID:12452
- C:\Windows\System\PHPwxyf.exe
  C:\Windows\System\PHPwxyf.exe
  2⤵
  PID:12488
- C:\Windows\System\FIwYiVa.exe
  C:\Windows\System\FIwYiVa.exe
  2⤵
  PID:12584
- C:\Windows\System\uKWPWVi.exe
  C:\Windows\System\uKWPWVi.exe
  2⤵
  PID:12652
- C:\Windows\System\lPMcmlt.exe
  C:\Windows\System\lPMcmlt.exe
  2⤵
  PID:12732
- C:\Windows\System\dGiIeEW.exe
  C:\Windows\System\dGiIeEW.exe
  2⤵
  PID:12744
- C:\Windows\System\yLUngrl.exe
  C:\Windows\System\yLUngrl.exe
  2⤵
  PID:12784
- C:\Windows\System\vArYbsz.exe
  C:\Windows\System\vArYbsz.exe
  2⤵
  PID:12916
- C:\Windows\System\uaGHgHq.exe
  C:\Windows\System\uaGHgHq.exe
  2⤵
  PID:13000
- C:\Windows\System\LSDLrOH.exe
  C:\Windows\System\LSDLrOH.exe
  2⤵
  PID:12976
- C:\Windows\System\orvnkAy.exe
  C:\Windows\System\orvnkAy.exe
  2⤵
  PID:13036
- C:\Windows\System\TrbSSGw.exe
  C:\Windows\System\TrbSSGw.exe
  2⤵
  PID:13100
- C:\Windows\System\GQwaivs.exe
  C:\Windows\System\GQwaivs.exe
  2⤵
  PID:13172
- C:\Windows\System\EExGObk.exe
  C:\Windows\System\EExGObk.exe
  2⤵
  PID:13284
- C:\Windows\System\WgbMeYL.exe
  C:\Windows\System\WgbMeYL.exe
  2⤵
  PID:12384
- C:\Windows\System\VleTxDW.exe
  C:\Windows\System\VleTxDW.exe
  2⤵
  PID:12344
- C:\Windows\System\WNDbAdF.exe
  C:\Windows\System\WNDbAdF.exe
  2⤵
  PID:12716
- C:\Windows\System\NVuXQxg.exe
  C:\Windows\System\NVuXQxg.exe
  2⤵
  PID:12656
- C:\Windows\System\aukluas.exe
  C:\Windows\System\aukluas.exe
  2⤵
  PID:12896
- C:\Windows\System\OoJXaps.exe
  C:\Windows\System\OoJXaps.exe
  2⤵
  PID:12984
- C:\Windows\System\SVMzgcz.exe
  C:\Windows\System\SVMzgcz.exe
  2⤵
  PID:13308
- C:\Windows\System\KWBAzHY.exe
  C:\Windows\System\KWBAzHY.exe
  2⤵
  PID:12604
- C:\Windows\System\xBlmuda.exe
  C:\Windows\System\xBlmuda.exe
  2⤵
  PID:13320
- C:\Windows\System\AqoSlXK.exe
  C:\Windows\System\AqoSlXK.exe
  2⤵
  PID:13336
- C:\Windows\System\hrHNGoj.exe
  C:\Windows\System\hrHNGoj.exe
  2⤵
  PID:13360
- C:\Windows\System\trxgugP.exe
  C:\Windows\System\trxgugP.exe
  2⤵
  PID:13384
- C:\Windows\System\TFANSDN.exe
  C:\Windows\System\TFANSDN.exe
  2⤵
  PID:13416
- C:\Windows\System\GhXxGEN.exe
  C:\Windows\System\GhXxGEN.exe
  2⤵
  PID:13448
- C:\Windows\System\APbCEvc.exe
  C:\Windows\System\APbCEvc.exe
  2⤵
  PID:13468
- C:\Windows\System\zgMdGSL.exe
  C:\Windows\System\zgMdGSL.exe
  2⤵
  PID:13488
- C:\Windows\System\GWTgyJZ.exe
  C:\Windows\System\GWTgyJZ.exe
  2⤵
  PID:13512
- C:\Windows\System\jLzAVLf.exe
  C:\Windows\System\jLzAVLf.exe
  2⤵
  PID:13532
- C:\Windows\System\PAqtRjK.exe
  C:\Windows\System\PAqtRjK.exe
  2⤵
  PID:13564
- C:\Windows\System\JtGVRUB.exe
  C:\Windows\System\JtGVRUB.exe
  2⤵
  PID:13596
- C:\Windows\System\fVzDETS.exe
  C:\Windows\System\fVzDETS.exe
  2⤵
  PID:13632
- C:\Windows\System\NFcqnmU.exe
  C:\Windows\System\NFcqnmU.exe
  2⤵
  PID:13672
- C:\Windows\System\sDqRwgr.exe
  C:\Windows\System\sDqRwgr.exe
  2⤵
  PID:13700
- C:\Windows\System\rRkbzrv.exe
  C:\Windows\System\rRkbzrv.exe
  2⤵
  PID:13724
- C:\Windows\System\IsPunEm.exe
  C:\Windows\System\IsPunEm.exe
  2⤵
  PID:13752
- C:\Windows\System\rbKIOeA.exe
  C:\Windows\System\rbKIOeA.exe
  2⤵
  PID:13792
- C:\Windows\System\BAJjNfL.exe
  C:\Windows\System\BAJjNfL.exe
  2⤵
  PID:13820
- C:\Windows\System\RcTHOPs.exe
  C:\Windows\System\RcTHOPs.exe
  2⤵
  PID:13856
- C:\Windows\System\cjMMKSj.exe
  C:\Windows\System\cjMMKSj.exe
  2⤵
  PID:13896
- C:\Windows\System\UJUqsPK.exe
  C:\Windows\System\UJUqsPK.exe
  2⤵
  PID:13924
- C:\Windows\System\nbyFket.exe
  C:\Windows\System\nbyFket.exe
  2⤵
  PID:13960
- C:\Windows\System\uhPxquI.exe
  C:\Windows\System\uhPxquI.exe
  2⤵
  PID:13988
- C:\Windows\System\FYEhOTR.exe
  C:\Windows\System\FYEhOTR.exe
  2⤵
  PID:14016
- C:\Windows\System\FNVjqSW.exe
  C:\Windows\System\FNVjqSW.exe
  2⤵
  PID:14044
- C:\Windows\System\iEImlGF.exe
  C:\Windows\System\iEImlGF.exe
  2⤵
  PID:14076
- C:\Windows\System\bVrDoQs.exe
  C:\Windows\System\bVrDoQs.exe
  2⤵
  PID:14112
- C:\Windows\System\tjNfSHo.exe
  C:\Windows\System\tjNfSHo.exe
  2⤵
  PID:14128
- C:\Windows\System\RJwJUQl.exe
  C:\Windows\System\RJwJUQl.exe
  2⤵
  PID:14148
- C:\Windows\System\azxtUcZ.exe
  C:\Windows\System\azxtUcZ.exe
  2⤵
  PID:14172
- C:\Windows\System\jCYPMNU.exe
  C:\Windows\System\jCYPMNU.exe
  2⤵
  PID:14200
- C:\Windows\System\zwXXVLs.exe
  C:\Windows\System\zwXXVLs.exe
  2⤵
  PID:14216
- C:\Windows\System\GHPCjSS.exe
  C:\Windows\System\GHPCjSS.exe
  2⤵
  PID:14248
- C:\Windows\System\cfOAHvD.exe
  C:\Windows\System\cfOAHvD.exe
  2⤵
  PID:14276
- C:\Windows\System\bexqWiM.exe
  C:\Windows\System\bexqWiM.exe
  2⤵
  PID:14304
- C:\Windows\System\yZawzVl.exe
  C:\Windows\System\yZawzVl.exe
  2⤵
  PID:14324
- C:\Windows\System\wQYvCZR.exe
  C:\Windows\System\wQYvCZR.exe
  2⤵
  PID:13020
- C:\Windows\System\qbsrkaG.exe
  C:\Windows\System\qbsrkaG.exe
  2⤵
  PID:12872
- C:\Windows\System\cLftdmf.exe
  C:\Windows\System\cLftdmf.exe
  2⤵
  PID:13444
- C:\Windows\System\bRHFJvD.exe
  C:\Windows\System\bRHFJvD.exe
  2⤵
  PID:13424
- C:\Windows\System\slFNEUg.exe
  C:\Windows\System\slFNEUg.exe
  2⤵
  PID:13528
- C:\Windows\System\mytwGCn.exe
  C:\Windows\System\mytwGCn.exe
  2⤵
  PID:13644
- C:\Windows\System\mRdPHLa.exe
  C:\Windows\System\mRdPHLa.exe
  2⤵
  PID:13684
- C:\Windows\System\vmhksLq.exe
  C:\Windows\System\vmhksLq.exe
  2⤵
  PID:13716
- C:\Windows\System\qGwxTFc.exe
  C:\Windows\System\qGwxTFc.exe
  2⤵
  PID:13852
- C:\Windows\System\yMmpVSH.exe
  C:\Windows\System\yMmpVSH.exe
  2⤵
  PID:13884
- C:\Windows\System\GQrWzFW.exe
  C:\Windows\System\GQrWzFW.exe
  2⤵
  PID:13944
- C:\Windows\System\BDjRdSd.exe
  C:\Windows\System\BDjRdSd.exe
  2⤵
  PID:14032
- C:\Windows\System\djfFIGT.exe
  C:\Windows\System\djfFIGT.exe
  2⤵
  PID:14068
- C:\Windows\System\VPEEARG.exe
  C:\Windows\System\VPEEARG.exe
  2⤵
  PID:14192
- C:\Windows\System\vvXzOkO.exe
  C:\Windows\System\vvXzOkO.exe
  2⤵
  PID:14244
- C:\Windows\System\QJmlZVC.exe
  C:\Windows\System\QJmlZVC.exe
  2⤵
  PID:14264
- C:\Windows\System\InTPiVm.exe
  C:\Windows\System\InTPiVm.exe
  2⤵
  PID:14312
- C:\Windows\System\HYrreup.exe
  C:\Windows\System\HYrreup.exe
  2⤵
  PID:12164
- C:\Windows\System\tWNlYXO.exe
  C:\Windows\System\tWNlYXO.exe
  2⤵
  PID:13460
- C:\Windows\System\gtyyUnE.exe
  C:\Windows\System\gtyyUnE.exe
  2⤵
  PID:13620
- C:\Windows\System\MxKyjBx.exe
  C:\Windows\System\MxKyjBx.exe
  2⤵
  PID:13692
- C:\Windows\System\JFSxOlc.exe
  C:\Windows\System\JFSxOlc.exe
  2⤵
  PID:13972
- C:\Windows\System\BdQqsKb.exe
  C:\Windows\System\BdQqsKb.exe
  2⤵
  PID:14060
- C:\Windows\System\sykyJVb.exe
  C:\Windows\System\sykyJVb.exe
  2⤵
  PID:14164
- C:\Windows\System\Vryierp.exe
  C:\Windows\System\Vryierp.exe
  2⤵
  PID:14288
- C:\Windows\System\SkBEEiw.exe
  C:\Windows\System\SkBEEiw.exe
  2⤵
  PID:13332
- C:\Windows\System\BgivymF.exe
  C:\Windows\System\BgivymF.exe
  2⤵
  PID:13508
- C:\Windows\System\EavSRfP.exe
  C:\Windows\System\EavSRfP.exe
  2⤵
  PID:14208
- C:\Windows\System\IKNylpV.exe
  C:\Windows\System\IKNylpV.exe
  2⤵
  PID:14364
- C:\Windows\System\sHQfkoe.exe
  C:\Windows\System\sHQfkoe.exe
  2⤵
  PID:14392
- C:\Windows\System\wsYeeFX.exe
  C:\Windows\System\wsYeeFX.exe
  2⤵
  PID:14416
- C:\Windows\System\DpGvrpI.exe
  C:\Windows\System\DpGvrpI.exe
  2⤵
  PID:14444
- C:\Windows\System\WtqxLqj.exe
  C:\Windows\System\WtqxLqj.exe
  2⤵
  PID:14480
- C:\Windows\System\yGhThPR.exe
  C:\Windows\System\yGhThPR.exe
  2⤵
  PID:14496
- C:\Windows\System\kVoRAHN.exe
  C:\Windows\System\kVoRAHN.exe
  2⤵
  PID:14524
- C:\Windows\System\YXOgsrw.exe
  C:\Windows\System\YXOgsrw.exe
  2⤵
  PID:14560
- C:\Windows\System\VRWHHmW.exe
  C:\Windows\System\VRWHHmW.exe
  2⤵
  PID:14588
- C:\Windows\System\CIICMRd.exe
  C:\Windows\System\CIICMRd.exe
  2⤵
  PID:14604
- C:\Windows\System\wouBcDA.exe
  C:\Windows\System\wouBcDA.exe
  2⤵
  PID:14628
- C:\Windows\System\oqJTaCo.exe
  C:\Windows\System\oqJTaCo.exe
  2⤵
  PID:14668
- C:\Windows\System\FpFRowW.exe
  C:\Windows\System\FpFRowW.exe
  2⤵
  PID:14692
- C:\Windows\System\OOAspMR.exe
  C:\Windows\System\OOAspMR.exe
  2⤵
  PID:14720
- C:\Windows\System\EwMXmaD.exe
  C:\Windows\System\EwMXmaD.exe
  2⤵
  PID:14744
- C:\Windows\System\TgXsKdC.exe
  C:\Windows\System\TgXsKdC.exe
  2⤵
  PID:14764
- C:\Windows\System\MmnIXgP.exe
  C:\Windows\System\MmnIXgP.exe
  2⤵
  PID:14796
- C:\Windows\System\cNhRVvv.exe
  C:\Windows\System\cNhRVvv.exe
  2⤵
  PID:14820
- C:\Windows\System\XTcWIRl.exe
  C:\Windows\System\XTcWIRl.exe
  2⤵
  PID:14852
- C:\Windows\System\pOrbBag.exe
  C:\Windows\System\pOrbBag.exe
  2⤵
  PID:14872
- C:\Windows\System\uTohoda.exe
  C:\Windows\System\uTohoda.exe
  2⤵
  PID:14916
- C:\Windows\System\DWmRMyo.exe
  C:\Windows\System\DWmRMyo.exe
  2⤵
  PID:14956
- C:\Windows\System\qLZYjqM.exe
  C:\Windows\System\qLZYjqM.exe
  2⤵
  PID:14980
- C:\Windows\System\RjoKOqf.exe
  C:\Windows\System\RjoKOqf.exe
  2⤵
  PID:14996
- C:\Windows\System\BLpoiXK.exe
  C:\Windows\System\BLpoiXK.exe
  2⤵
  PID:15032
- C:\Windows\System\bWTHXxS.exe
  C:\Windows\System\bWTHXxS.exe
  2⤵
  PID:15060
- C:\Windows\System\LFXPxjn.exe
  C:\Windows\System\LFXPxjn.exe
  2⤵
  PID:15092
- C:\Windows\System\DzfYwvO.exe
  C:\Windows\System\DzfYwvO.exe
  2⤵
  PID:15116
- C:\Windows\System\odDuYkt.exe
  C:\Windows\System\odDuYkt.exe
  2⤵
  PID:15148
- C:\Windows\System\PkVMZUX.exe
  C:\Windows\System\PkVMZUX.exe
  2⤵
  PID:15180
- C:\Windows\System\CpVVBnm.exe
  C:\Windows\System\CpVVBnm.exe
  2⤵
  PID:15204
- C:\Windows\System\SNjpZXR.exe
  C:\Windows\System\SNjpZXR.exe
  2⤵
  PID:15220
- C:\Windows\System\FXOarUb.exe
  C:\Windows\System\FXOarUb.exe
  2⤵
  PID:15248
- C:\Windows\System\rEVgScd.exe
  C:\Windows\System\rEVgScd.exe
  2⤵
  PID:15280
- C:\Windows\System\tOdTRCY.exe
  C:\Windows\System\tOdTRCY.exe
  2⤵
  PID:15312
- C:\Windows\System\WGQcKtF.exe
  C:\Windows\System\WGQcKtF.exe
  2⤵
  PID:15344
- C:\Windows\System\OvUiGml.exe
  C:\Windows\System\OvUiGml.exe
  2⤵
  PID:13352
- C:\Windows\System\LRDhFrR.exe
  C:\Windows\System\LRDhFrR.exe
  2⤵
  PID:13712
- C:\Windows\System\QogdTgP.exe
  C:\Windows\System\QogdTgP.exe
  2⤵
  PID:14432
- C:\Windows\System\XIWUeMU.exe
  C:\Windows\System\XIWUeMU.exe
  2⤵
  PID:14412
- C:\Windows\System\LdrufVL.exe
  C:\Windows\System\LdrufVL.exe
  2⤵
  PID:14568
- C:\Windows\System\TEHjPsv.exe
  C:\Windows\System\TEHjPsv.exe
  2⤵
  PID:14620
- C:\Windows\System\pVAgLjj.exe
  C:\Windows\System\pVAgLjj.exe
  2⤵
  PID:14624
- C:\Windows\System\rOFolqe.exe
  C:\Windows\System\rOFolqe.exe
  2⤵
  PID:14704
- C:\Windows\System\aDaxUkZ.exe
  C:\Windows\System\aDaxUkZ.exe
  2⤵
  PID:14816
- C:\Windows\System\UBDhMgy.exe
  C:\Windows\System\UBDhMgy.exe
  2⤵
  PID:14868
- C:\Windows\System\dNuYMzm.exe
  C:\Windows\System\dNuYMzm.exe
  2⤵
  PID:14928
- C:\Windows\System\HcdEoAN.exe
  C:\Windows\System\HcdEoAN.exe
  2⤵
  PID:14988
- C:\Windows\System\sixaAZw.exe
  C:\Windows\System\sixaAZw.exe
  2⤵
  PID:14992
- C:\Windows\System\QCDSVBF.exe
  C:\Windows\System\QCDSVBF.exe
  2⤵
  PID:15016
- C:\Windows\System\fVcMjew.exe
  C:\Windows\System\fVcMjew.exe
  2⤵
  PID:15200
- C:\Windows\System\iCUfFgS.exe
  C:\Windows\System\iCUfFgS.exe
  2⤵
  PID:15188
- C:\Windows\System\QfTqdnU.exe
  C:\Windows\System\QfTqdnU.exe
  2⤵
  PID:15340
- C:\Windows\System\KicryKe.exe
  C:\Windows\System\KicryKe.exe
  2⤵
  PID:13500
- C:\Windows\System\sbskVIk.exe
  C:\Windows\System\sbskVIk.exe
  2⤵
  PID:14400
- C:\Windows\System\WSSJzpr.exe
  C:\Windows\System\WSSJzpr.exe
  2⤵
  PID:14456
- C:\Windows\System\ERFNotp.exe
  C:\Windows\System\ERFNotp.exe
  2⤵
  PID:14576
- C:\Windows\System\TayiDnC.exe
  C:\Windows\System\TayiDnC.exe
  2⤵
  PID:14740
- C:\Windows\System\dKyiaOu.exe
  C:\Windows\System\dKyiaOu.exe
  2⤵
  PID:14976
- C:\Windows\System\slsbYZc.exe
  C:\Windows\System\slsbYZc.exe
  2⤵
  PID:15140
- C:\Windows\System\ULXEbMZ.exe
  C:\Windows\System\ULXEbMZ.exe
  2⤵
  PID:13456
- C:\Windows\System\EeVtbsG.exe
  C:\Windows\System\EeVtbsG.exe
  2⤵
  PID:15196
- C:\Windows\System\VRvLBKj.exe
  C:\Windows\System\VRvLBKj.exe
  2⤵
  PID:14944
- C:\Windows\System\LsaxRtr.exe
  C:\Windows\System\LsaxRtr.exe
  2⤵
  PID:15376
- C:\Windows\System\hlRqcXY.exe
  C:\Windows\System\hlRqcXY.exe
  2⤵
  PID:15404
- C:\Windows\System\OtBjpeT.exe
  C:\Windows\System\OtBjpeT.exe
  2⤵
  PID:15432
- C:\Windows\System\kTcGHNt.exe
  C:\Windows\System\kTcGHNt.exe
  2⤵
  PID:15448
- C:\Windows\System\QsbkrxM.exe
  C:\Windows\System\QsbkrxM.exe
  2⤵
  PID:15472
- C:\Windows\System\muGmemg.exe
  C:\Windows\System\muGmemg.exe
  2⤵
  PID:15508
- C:\Windows\System\NTOVexS.exe
  C:\Windows\System\NTOVexS.exe
  2⤵
  PID:15532
- C:\Windows\System\vsHRuys.exe
  C:\Windows\System\vsHRuys.exe
  2⤵
  PID:15556
- C:\Windows\System\WBxazYn.exe
  C:\Windows\System\WBxazYn.exe
  2⤵
  PID:15584
- C:\Windows\System\xzwmBlN.exe
  C:\Windows\System\xzwmBlN.exe
  2⤵
  PID:15608
- C:\Windows\System\cpXlZSS.exe
  C:\Windows\System\cpXlZSS.exe
  2⤵
  PID:15624
- C:\Windows\System\HVbDZxt.exe
  C:\Windows\System\HVbDZxt.exe
  2⤵
  PID:15652
- C:\Windows\System\nuSnjBK.exe
  C:\Windows\System\nuSnjBK.exe
  2⤵
  PID:15680
- C:\Windows\System\sHWOvAG.exe
  C:\Windows\System\sHWOvAG.exe
  2⤵
  PID:15704
- C:\Windows\System\pEoCSVB.exe
  C:\Windows\System\pEoCSVB.exe
  2⤵
  PID:15740
- C:\Windows\System\crjnNrg.exe
  C:\Windows\System\crjnNrg.exe
  2⤵
  PID:15764
- C:\Windows\System\tGYJipV.exe
  C:\Windows\System\tGYJipV.exe
  2⤵
  PID:15792
- C:\Windows\System\iZPZfMf.exe
  C:\Windows\System\iZPZfMf.exe
  2⤵
  PID:15828
- C:\Windows\System\fkiRjtp.exe
  C:\Windows\System\fkiRjtp.exe
  2⤵
  PID:15848
- C:\Windows\System\MUpnAOo.exe
  C:\Windows\System\MUpnAOo.exe
  2⤵
  PID:15888
- C:\Windows\System\sVczzAV.exe
  C:\Windows\System\sVczzAV.exe
  2⤵
  PID:15908
- C:\Windows\System\IndnlGc.exe
  C:\Windows\System\IndnlGc.exe
  2⤵
  PID:15944
- C:\Windows\System\ZkomQjn.exe
  C:\Windows\System\ZkomQjn.exe
  2⤵
  PID:15976
- C:\Windows\System\bnBvokh.exe
  C:\Windows\System\bnBvokh.exe
  2⤵
  PID:16008
- C:\Windows\System\cDAMAQP.exe
  C:\Windows\System\cDAMAQP.exe
  2⤵
  PID:16036
- C:\Windows\System\WMvVFxC.exe
  C:\Windows\System\WMvVFxC.exe
  2⤵
  PID:16064
- C:\Windows\System\HZTaSDJ.exe
  C:\Windows\System\HZTaSDJ.exe
  2⤵
  PID:16108
- C:\Windows\System\fHoMvAk.exe
  C:\Windows\System\fHoMvAk.exe
  2⤵
  PID:16128
- C:\Windows\System\FyAFjgR.exe
  C:\Windows\System\FyAFjgR.exe
  2⤵
  PID:16160
- C:\Windows\System\LuqBiag.exe
  C:\Windows\System\LuqBiag.exe
  2⤵
  PID:16176
- C:\Windows\System\OHcPNup.exe
  C:\Windows\System\OHcPNup.exe
  2⤵
  PID:16204
- C:\Windows\System\jTwjRKs.exe
  C:\Windows\System\jTwjRKs.exe
  2⤵
  PID:16236
- C:\Windows\System\VowlKKQ.exe
  C:\Windows\System\VowlKKQ.exe
  2⤵
  PID:16260
- C:\Windows\System\dyACKbA.exe
  C:\Windows\System\dyACKbA.exe
  2⤵
  PID:16292
- C:\Windows\System\IGItfQq.exe
  C:\Windows\System\IGItfQq.exe
  2⤵
  PID:16320
- C:\Windows\System\qveXNSL.exe
  C:\Windows\System\qveXNSL.exe
  2⤵
  PID:16360
- C:\Windows\System\JrkQnHx.exe
  C:\Windows\System\JrkQnHx.exe
  2⤵
  PID:14736
- C:\Windows\System\jOcafGH.exe
  C:\Windows\System\jOcafGH.exe
  2⤵
  PID:15300
- C:\Windows\System\tCRnlVU.exe
  C:\Windows\System\tCRnlVU.exe
  2⤵
  PID:15420
- C:\Windows\System\FfUpBoI.exe
  C:\Windows\System\FfUpBoI.exe
  2⤵
  PID:15460
- C:\Windows\System\zRyNQpA.exe
  C:\Windows\System\zRyNQpA.exe
  2⤵
  PID:15444
- C:\Windows\System\fIIDrjK.exe
  C:\Windows\System\fIIDrjK.exe
  2⤵
  PID:15616
- C:\Windows\System\DzjFfUy.exe
  C:\Windows\System\DzjFfUy.exe
  2⤵
  PID:15648
- C:\Windows\System\XvTfxvg.exe
  C:\Windows\System\XvTfxvg.exe
  2⤵
  PID:15692
- C:\Windows\System\QWooumX.exe
  C:\Windows\System\QWooumX.exe
  2⤵
  PID:15808
- C:\Windows\System\pxCYAmN.exe
  C:\Windows\System\pxCYAmN.exe
  2⤵
  PID:15836
- C:\Windows\System\VMrqTUJ.exe
  C:\Windows\System\VMrqTUJ.exe
  2⤵
  PID:15996
- C:\Windows\System\RpFaceY.exe
  C:\Windows\System\RpFaceY.exe
  2⤵
  PID:15900
- C:\Windows\System\tOUulWD.exe
  C:\Windows\System\tOUulWD.exe
  2⤵
  PID:16056
- C:\Windows\System\ZHSCMBW.exe
  C:\Windows\System\ZHSCMBW.exe
  2⤵
  PID:16148
- C:\Windows\System\ntzDbpu.exe
  C:\Windows\System\ntzDbpu.exe
  2⤵
  PID:16140
- C:\Windows\System\SACMGup.exe
  C:\Windows\System\SACMGup.exe
  2⤵
  PID:16216
- C:\Windows\System\irMFNII.exe
  C:\Windows\System\irMFNII.exe
  2⤵
  PID:15292
- C:\Windows\System\LdVCMrn.exe
  C:\Windows\System\LdVCMrn.exe
  2⤵
  PID:15388
- C:\Windows\System\ngPopfL.exe
  C:\Windows\System\ngPopfL.exe
  2⤵
  PID:15440
- C:\Windows\System\QPyUZzb.exe
  C:\Windows\System\QPyUZzb.exe
  2⤵
  PID:15596
- C:\Windows\System\QNDDPSM.exe
  C:\Windows\System\QNDDPSM.exe
  2⤵
  PID:15904
- C:\Windows\System\qkPMtRW.exe
  C:\Windows\System\qkPMtRW.exe
  2⤵
  PID:15932
- C:\Windows\System\xjqccxy.exe
  C:\Windows\System\xjqccxy.exe
  2⤵
  PID:16196
- C:\Windows\System\wUmQFNu.exe
  C:\Windows\System\wUmQFNu.exe
  2⤵
  PID:16200
- C:\Windows\System\aAekeLx.exe
  C:\Windows\System\aAekeLx.exe
  2⤵
  PID:16308
- C:\Windows\System\qNAoigb.exe
  C:\Windows\System\qNAoigb.exe
  2⤵
  PID:15568
- C:\Windows\System\MLraZwk.exe
  C:\Windows\System\MLraZwk.exe
  2⤵
  PID:15824
- C:\Windows\System\SsZDTDB.exe
  C:\Windows\System\SsZDTDB.exe
  2⤵
  PID:16224
- C:\Windows\System\CQGToOG.exe
  C:\Windows\System\CQGToOG.exe
  2⤵
  PID:16048
- C:\Windows\System\pEUqjTo.exe
  C:\Windows\System\pEUqjTo.exe
  2⤵
  PID:16404
- C:\Windows\System\LDSSCQw.exe
  C:\Windows\System\LDSSCQw.exe
  2⤵
  PID:16428
- C:\Windows\System\HuZhWtV.exe
  C:\Windows\System\HuZhWtV.exe
  2⤵
  PID:16456
- C:\Windows\System\HiSSLNQ.exe
  C:\Windows\System\HiSSLNQ.exe
  2⤵
  PID:16476
- C:\Windows\System\mYWVmuP.exe
  C:\Windows\System\mYWVmuP.exe
  2⤵
  PID:16500
- C:\Windows\System\iQNOubY.exe
  C:\Windows\System\iQNOubY.exe
  2⤵
  PID:16528
- C:\Windows\System\rwsRPCD.exe
  C:\Windows\System\rwsRPCD.exe
  2⤵
  PID:16552
- C:\Windows\System\vEtCIYA.exe
  C:\Windows\System\vEtCIYA.exe
  2⤵
  PID:16584
- C:\Windows\System\yskRaKk.exe
  C:\Windows\System\yskRaKk.exe
  2⤵
  PID:16616
- C:\Windows\System\qviSTDG.exe
  C:\Windows\System\qviSTDG.exe
  2⤵
  PID:16648
- C:\Windows\System\ZfsvbGE.exe
  C:\Windows\System\ZfsvbGE.exe
  2⤵
  PID:16668
- C:\Windows\System\HxaDYqa.exe
  C:\Windows\System\HxaDYqa.exe
  2⤵
  PID:16696
- C:\Windows\System\AWzSjgh.exe
  C:\Windows\System\AWzSjgh.exe
  2⤵
  PID:16716
- C:\Windows\System\ChTBDWk.exe
  C:\Windows\System\ChTBDWk.exe
  2⤵
  PID:16732
- C:\Windows\System\RkQDnFa.exe
  C:\Windows\System\RkQDnFa.exe
  2⤵
  PID:16756
- C:\Windows\System\GNSvPXK.exe
  C:\Windows\System\GNSvPXK.exe
  2⤵
  PID:16784
- C:\Windows\System\ZiqOPxH.exe
  C:\Windows\System\ZiqOPxH.exe
  2⤵
  PID:16804
- C:\Windows\System\BYsXiTi.exe
  C:\Windows\System\BYsXiTi.exe
  2⤵
  PID:16824
- C:\Windows\System\JFjGROy.exe
  C:\Windows\System\JFjGROy.exe
  2⤵
  PID:16860
- C:\Windows\System\NDsnUeO.exe
  C:\Windows\System\NDsnUeO.exe
  2⤵
  PID:16884
- C:\Windows\System\FbqXrzF.exe
  C:\Windows\System\FbqXrzF.exe
  2⤵
  PID:16904
- C:\Windows\System\YKpyPAn.exe
  C:\Windows\System\YKpyPAn.exe
  2⤵
  PID:16932
- C:\Windows\System\qHIetbj.exe
  C:\Windows\System\qHIetbj.exe
  2⤵
  PID:16968
- C:\Windows\System\wlxdApK.exe
  C:\Windows\System\wlxdApK.exe
  2⤵
  PID:17000
- C:\Windows\System\sZceotz.exe
  C:\Windows\System\sZceotz.exe
  2⤵
  PID:17024
- C:\Windows\System\SlUkbYr.exe
  C:\Windows\System\SlUkbYr.exe
  2⤵
  PID:17068
- C:\Windows\System\uKSoPho.exe
  C:\Windows\System\uKSoPho.exe
  2⤵
  PID:17092
- C:\Windows\System\usXXYCg.exe
  C:\Windows\System\usXXYCg.exe
  2⤵
  PID:17128
- C:\Windows\System\BQSCqQa.exe
  C:\Windows\System\BQSCqQa.exe
  2⤵
  PID:17168
- C:\Windows\System\KmuyusE.exe
  C:\Windows\System\KmuyusE.exe
  2⤵
  PID:17188

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv 2Y1kdNdNwUGJsnaiabsCSw.0.2
1⤵
PID:16768
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 16768 -s 1016
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:16512

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 16768 -i 16768 -h 444 -j 480 -s 488 -d 16816
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:16840

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BIuyBWT.exe

Filesize
1.7MB

MD5
a296df871c59e4ae371e1556c0742179

SHA1
9dee51ce901b3d8ee58461822576cd674dcb46a1

SHA256
4bcb2206ac038284bbe76eb9d021e641f466d17f5e6687d4b7918fb80bd2ce0c

SHA512
349c6b38eeb6c148bd5f61a604dc39d6c4dad734012c6cfb7b31ab3a0089f5b4656bc2f2f7ad093c769424ee9c71b110ed587a635a0f483c20ec4f99be6aad13

Download Submit
C:\Windows\System\CoKjnSh.exe

Filesize
1.7MB

MD5
d18f5e257d10ed9cdcfd0d2c6439892c

SHA1
08745ab493cc4482d0f5a3d045c402eafbb10c53

SHA256
5fb263223b44d83aaf6f077a17ce0607a643ed7198c23ce137f6f518d7e31590

SHA512
7bee9da3fc0323cefcf31fb821b21785460758671f028bdbd4014b9a2f0a742839adc9057b41e44a7255e21e0bf64928763b7963ac0c3eaa755baa4cf0ec64b7

Download Submit
C:\Windows\System\DSmHyqu.exe

Filesize
1.7MB

MD5
62fb5a127ad20de3634f4b52d7175eb5

SHA1
7cf2304e10f6a4624ceca01a9079cd73db6bd95c

SHA256
0a0518abd10e5ea96181569151d50721b50df619759c0f2464fbdf81411cff45

SHA512
9ea1583e7bca0e631f0cf1d69d7ccd36b8b55b6b370f1370b5faaf2c2db810252e6896907cf65d40ab1fd8db7b4822ac3423a035762a3e150b80aca92e6dd936

Download Submit
C:\Windows\System\EjhYwOg.exe

Filesize
1.7MB

MD5
6bfc540b427a05177e16cee38b742fd8

SHA1
149d1965e426c23f1155101ccb2dc6e36ae31f46

SHA256
7cb317b20e6c05b26135d2c06629feddbc9becc0ba2a4c115e2d0778b6459019

SHA512
283f8bb0f53df17bc99f4dc008d3df80f4d81fcb9a636f4dd733a56cb67d63910f78946099fa34f5a1491e91cb94f53380a93b749e4e00941a384dd82738954f

Download Submit
C:\Windows\System\JBULqhv.exe

Filesize
1.7MB

MD5
9f44a2e89de847eef0974bcff26c693a

SHA1
7564e6ce7d773b031c066bb3db2e814475efe426

SHA256
a9fcbd9e5982986894b2c334043b59b23e569cea56a8d9a7773db5cae0764951

SHA512
a90289e8f92540b0116fcf1dd302d26192f083325843a2051098e04face8319aa7171542ec28614cfe706e36c3b4a74131e6e6bfbb7f703eeb259bd816e759bc

Download Submit
C:\Windows\System\LEvrVQg.exe

Filesize
1.7MB

MD5
0df5a4187fe0a8b2c1ef37c571fa7a5b

SHA1
a8baf1680bc6238d24d19bdadf7d1e07e86c5622

SHA256
5ab7634b8183b8e67d284517730f124a05c93881978de392e805e347bf573ca7

SHA512
b460585dba8569ca39253c9b956e51f51f550a42092fe479a231bec332f9425a5b69d3c0b5afbdd4b19b9aeb46a15bd39237769f5caf6d267265af876ea3cf37

Download Submit
C:\Windows\System\QoNPHcR.exe

Filesize
1.7MB

MD5
de2ddbb086e974bf5552d647d44383bd

SHA1
01140350a480a583aafa33c8cdb85b0f0b82f98e

SHA256
9d1f4cc7b914a25235660935c4ef9ba8ccb90764847810ac9c2d7552e47ecbad

SHA512
a7bb994f152b392ce42877b365896207210de787a476de2f506cbb4cf10466a1fce4a4ee8435d8e4acb6db129012f632d81467981b59acc1eba1172090ec29bf

Download Submit
C:\Windows\System\RtgeIrB.exe

Filesize
1.7MB

MD5
d2042cd36d32a89c3993dbc465078c7f

SHA1
4ae98846bf5c87eff325350a88a6cea6f16ebc62

SHA256
af02adadcef9e8e6029fc8aa75174a08bdafa6b2a6dc089dd42edb8433d3486c

SHA512
31095719b7ad6672ad84a370be9c57178d04f677e55a2bc6a56e4ea2038e248670989ab75848148f21f9c353d3440029a8b56404bcbc4b4cd4ddfda0641d5d68

Download Submit
C:\Windows\System\RtsQRUm.exe

Filesize
1.7MB

MD5
02fde44817361ab053309260110024e1

SHA1
5d9f14c0d67d2cb4c6724bd4c38d8b220cd1c201

SHA256
5b6b4fa5682c1b47ddb445529d136bf8d2ee58afaf733340bf2217d5c6ff7160

SHA512
4bd51808e3aaae3d9cc66c42ffa2da5e861a2ecbd23d6a00c46f00d568a13665d5efcdb3c950d008973ed672a3bbef0584bcedeaf13cbeae8ddb1f80deb1b2bf

Download Submit
C:\Windows\System\SYrSvZw.exe

Filesize
1.7MB

MD5
4da4f8e2f51899ffaaa6a38f8915a6cd

SHA1
1854bf8c81b59888201126bf4c0ee448bd9bbe3d

SHA256
997c2ccd12ced22877b3f4d3547f68d40873c3cfa425c405e17e87e8f666197d

SHA512
67dd674bbcb85c62b8a3882b47ace895ca2456e8f54ce58bf892865942122123929c8b5007b9d8657a59075470b92af2aba9e69ad30ec81067b58bdf1f7ece43

Download Submit
C:\Windows\System\Teltpih.exe

Filesize
1.7MB

MD5
949aaccbe785371e5b27e6d9ee9a96b8

SHA1
bf8ac7d700574b93b361629f02608b11992d094d

SHA256
5571164c553123ad846fd694bee3deb112c90558aceda60d0fb139e0ebc00cf3

SHA512
7ed8762f91db0865401f831bd4977de7d2a2c357545e3da1ea2c04d083a892581bb5b45d117db1897e2f7576dbc35c088b794e636b74a8473aebc5431852ee3a

Download Submit
C:\Windows\System\ULInejZ.exe

Filesize
1.7MB

MD5
252a964f89909d3ac2f7412f39100964

SHA1
92f8db4b99630fa58ab4565e232cba9917747d14

SHA256
7c46acd6a47a507cb0a606eb0fdfdb43eb6c06fd40c871660410aa75f622f0cb

SHA512
5b5cc34aaf698f51d3af1f8a79669d42848713a829e44e31508e99264e904715a506d5b3f8d2768a2ddb0f24587e86481f77103e129ee2f8920b376e3fb9ac61

Download Submit
C:\Windows\System\UfTsGhi.exe

Filesize
1.7MB

MD5
0fe4fdfbf468abc14aa37fba80a8829e

SHA1
0f3d4da1cb2f58664dcd370ca03279dc32ee2eb3

SHA256
94d6398a4985d37b3885f7a386d8885c33666d7019c2bc5c852770f15ec578ff

SHA512
8f4a5a8374fb119c4b3eb7dfa40154ab864131e1c92a97fc0b63dfc71406e08bd6823cb06d5940a6b2e18fbcf55b7217efb1c8576146150830d7bd86b0fce789

Download Submit
C:\Windows\System\VMQQuVL.exe

Filesize
1.7MB

MD5
9476ce24e72d03cd5a974fae6c6ef5b8

SHA1
543cadde4abe2a45861f10835226260d780d860e

SHA256
5e07391eff7b6bc89f84f88156a9b66121c00762d59bea7e343da2f98afee2b9

SHA512
e49bd1e754f181ae7f9777634be426f613b50169e9cbaab7b603ca9e3840c00e879dfa11d0e66863e97baa3ae9262bededea033422b91c27b28ab5438a8af4a4

Download Submit
C:\Windows\System\XunEBPD.exe

Filesize
1.7MB

MD5
78f2a7a649ee04a36e2613b8d03f02a9

SHA1
7d16b164c157078ea317d0c76ca2086819b8d594

SHA256
f85f567322a3d5c8d24744b2d2425c27ad55633f64de6451fba49a5418a9176d

SHA512
e70467e18ce3ae913e91ca9dd709fbb85d8f0b47305b3327a00f7d8a7dc2afad579ea1ac05d4a9578866233aaa5028f9163db16d0af167d8ab4eb84d5dd80937

Download Submit
C:\Windows\System\ZJeWpzt.exe

Filesize
1.7MB

MD5
b5aaa6165ecc1beffe5ae036e50c36c7

SHA1
5cad91919ddbb3e98b0fd613351d8e9ae57330c6

SHA256
ac9923501221d789cee3ffe480b4802da21081b2cf8fd880754a67819fa68f12

SHA512
fc21523c22c757688b8507bccec0285006e162eb567260d5c819b663d98ef579e20f0289598343ec7b0f63a323b1c4ea91459f09180cc72267fac7553c5dd664

Download Submit
C:\Windows\System\ZnDsnLU.exe

Filesize
1.7MB

MD5
e76b57e72712f677b260c82fd281bf18

SHA1
dce9aa755d85b9363b96aecafbab54bad90ea84f

SHA256
b3f41e68cc1afc2caffe2dbcdea3836dc5a46374059ede5c40ba1bb465bb6c2d

SHA512
732a5f6629c93ba035673005991570289e38f0b4f94c4c09f3267b902737fb591865443aaea3ebd0decae1ef7fe8494b956bb7bac807bf8f1cb3a127eb4ac709

Download Submit
C:\Windows\System\bkyRnFT.exe

Filesize
1.7MB

MD5
0200636a1108cf2a5592b943d02b9a85

SHA1
7e1bdd08effc756c0e3a12c2c2d753efc808d727

SHA256
ff21dbe74773fb1c36e430f3508b657b7105a9e9c036a15cdcbcd5caea5a5713

SHA512
9f0d46ffe98e7cd1815123aa4ed14b0ee29563b0762aa5cbcd67c1ef6e2776ae882cae7cc6861f2b6af665af07ca2bb903ea2ef294f7847904c055f860c24c49

Download Submit
C:\Windows\System\bqvHXtR.exe

Filesize
1.7MB

MD5
4d0316de76c5eee048a1a1f21699172a

SHA1
d971d147f1f38a8e09d00c40f78b5bd77aaf4b90

SHA256
0d1af91876d74e143d55b88cb4a7dac722350978ac572e0e91f76b0ebc4d31ec

SHA512
3d8f88800655e0b76b4785eecfa2a0fcfc2b47b7c29ced8302e4c104769fd273aaba5ada015f616cd7be0bf6ce62d060b736bf4dfa46c29108a88c58f39ee73c

Download Submit
C:\Windows\System\igqiswp.exe

Filesize
1.7MB

MD5
5b83a1114ffa42760dbc77f5a519d232

SHA1
f96935caf600e8847c46b6988a6b61217882ce09

SHA256
8b933220862ceb0060bc9ffb32848e4c8e3ba717c6a2e01e84660e0a59fb3a2d

SHA512
ab437638a00a10fead5d2e311399fd73b5ed0c51db863edc670fbcdbad2ae32ba61754989414aa43ff2c88a8e1d32764be7fc644b20d6e6f54fc020d7bd1e606

Download Submit
C:\Windows\System\jANHaNR.exe

Filesize
1.7MB

MD5
1428e3a8ebde0fd7d7af51a27dc821c4

SHA1
0c95708d9437b446ed7aad120c80c2998711357f

SHA256
e494c52b1e10050b80ba86a18552311914eb562c6548041409509f9d63a548ac

SHA512
78d79744df06535263951cf87f3ced5a2a4992f4ffffba044539ec2bcf5781b3b861e6a76a7850e2447d245278fdea5af31fd47dea1bfc92f5be3ae08e033a8f

Download Submit
C:\Windows\System\lUiYoYS.exe

Filesize
1.7MB

MD5
af78945c6f7f6d90e3fabaab83072211

SHA1
f5011a0f696f86354deb8c89e9cdad00fdf4ea0f

SHA256
978c77085d4341cbeb0be59752250ecec722658a675186a951229b81fbb9ea69

SHA512
091728138800cf9947002045a991a627d924bf52c3d02f0ab2163735b66f19a12d9dcc9bb5c07dd8c57470160e58a4400886e9fdff5429091cb055f7424aaaf9

Download Submit
C:\Windows\System\lxBVGMH.exe

Filesize
1.7MB

MD5
4b1c01f89763fc672f1769ff0f0d3ec0

SHA1
19b7265d2c999ab32418accf1da4604541e3b981

SHA256
12f3e129d2e91e501f09aa04c4fc6e1003ab94b6940d5ac059ebcc00af1c2a91

SHA512
27114189348558cf5d56a0af3edbc80cc6f66625d60eabc26b345b30520cab8a966c8143141494d2e2b76a4661d99a078d5db4286f53140a4916f798f02905a5

Download Submit
C:\Windows\System\mHXlsAD.exe

Filesize
1.7MB

MD5
3d5f7c05951551b19dae2f7f7352fd74

SHA1
5132387d368627109acc479a4646244659ccccc6

SHA256
07d3e9763061b43c377451d12c0477fa3b77cb257aab1331a82cca62aa3aeba7

SHA512
4bbf561b9828361bca30135a3445de253e2d5310a4166355ce9749f0bed141b0047ecb67c6cde52660c63ad4c70f91d2c58fcc5ac88c22dedec79cc45bf8bbf2

Download Submit
C:\Windows\System\nusCiEd.exe

Filesize
1.7MB

MD5
d8f73449635c771308ec4bf5304fa01d

SHA1
03d82e3e7f2063eefa76068fd1281e868cbd9e58

SHA256
9ff8620ccb6dd2664e4d4eac50bbfd0905aa2eb90b4e062486ea40f5a94ac95c

SHA512
5126a0a140c1b763dd153f9e1530f3911fa7b107a807cd514abc2eb23d0afbe45d217a0af26ef35aa4a387711bed4c5fbe6529183b6cb97835c88bf25db37867

Download Submit
C:\Windows\System\oDuGAIA.exe

Filesize
1.7MB

MD5
c2da72604a477ef27df4009d3f59d059

SHA1
d436e15516beba1629fa587856013fe18d8023c8

SHA256
84c737dc2b8de0e7827d846c2d65be71c2b679c269262d30e0f47528dd9ec160

SHA512
817a019a5a997eb54c757f05ab171b3005998116577ec37236d138a2f41b633bfb32a1514ecebe1b57d6df40deab5a298669165712b9f5cff211e94760aac06d

Download Submit
C:\Windows\System\pCJWxxX.exe

Filesize
1.7MB

MD5
fdc8988c728a4c8f4d640f261fb079b5

SHA1
61666b5ab74513b721b5245dcce08e85726d6c1f

SHA256
85daeab8b692bae10e6f6b8a2542f340f43bec816918695d565b5c54fc2a9ec8

SHA512
d361d2b1fd5b4e11c53a18a33c6b301db3478fe1b996a44159e94e285eb00621bceb10389c0acb6d6ef9d89e58f767d55b7d9b7a520722f5946c085d8506589e

Download Submit
C:\Windows\System\pNHafqN.exe

Filesize
1.7MB

MD5
80f8beea75916411c9b6112f7ee16af2

SHA1
d2547d425285452747a1ffc6adeaacba974368e9

SHA256
300877b0532cfa441119a7dcb5d9f494610d1884dc7160201a37a003131b74ae

SHA512
c015aadd4c6f53cb498e82cfa467b4f11d11be13ced49fd1a8b469f1f0ad636bd5b0a4b69fd30136def984d82165fe18b87f79e1075db5656c3491c9668314b4

Download Submit
C:\Windows\System\qkbeJrD.exe

Filesize
1.7MB

MD5
b96c3e3092ae10c78d8effd179ee867d

SHA1
c67643fa6720cc4772392f4b0d4dd37008068162

SHA256
c300deba5bdb09680378d00894d42f96a80ff5300e50af3f1073b20fc40adb71

SHA512
8f2b3f1d29d787994e3bfe2d5b7c6abb818824f7ce0ef7e427cd97d1c0c930d6680f0a8aa8baa0a43d520eef8f845a0cba760c8b46539f1c8ba9070a04392272

Download Submit
C:\Windows\System\qnOocIC.exe

Filesize
1.7MB

MD5
3a56001c707ba25bbe7cbc6207263253

SHA1
07655ec6e11cdbfd281c4f39238b0c99098423d3

SHA256
c65a67c42873c7484a96514e92a150badd73b671bee63e884f267018f80151d0

SHA512
e84465fedfadad277d93f54c7431745054c89067ee56d0d03169f756240163a07f74c9c8dbc8da5d434254dc307e5863b20d96bf0104d818ef74068fbf73d3c3

Download Submit
C:\Windows\System\rjIKZXz.exe

Filesize
1.7MB

MD5
98eb416742d7e9e7b74269f960147a95

SHA1
f71eea10576b2e16c182221aee5659ba863bc91a

SHA256
3d5e1f190a60a55ad04b94457eb2e43b02e7006cc2336f0d7478a6a69b6eb857

SHA512
c0efc8b8ddf4c800b20cef42e6e9fee491d1fc5fc90a9025136f050ebc777b72d5884ff3d2705af6bab2c94213a82dc6067079ba340f07b7cbdc7d494e284ecf

Download Submit
C:\Windows\System\sEAvgPJ.exe

Filesize
1.7MB

MD5
a48eb89c6e15179219d36633b0ea6811

SHA1
44ff6e275dc7c0135ce03686672e90f92799226d

SHA256
0523b5ba356d94542ebb200a98a2fb0a9d9ac802361ee91d97dc5df5256c7365

SHA512
54362fa0cbe5de93c1e0194678cec173dbf4249fdb0fa68440cf7336f223f6869cd8fe3f9eb1d103cb89fe8f44b43d63675a5f3f33cd53664afe9dddf7deaa89

Download Submit
C:\Windows\System\uIVkOTB.exe

Filesize
1.7MB

MD5
4f97f3b6d6f9a143e407e8104f528498

SHA1
42953e37dc5c16ed3fb08d6f65703affe5907c6a

SHA256
63ab4a8b2031ff12844f83a52990204c609edf71ef77e174ad73e1b975cc5e6e

SHA512
76490e3c7363a151026e6998ab766fc2173cb51a508fa816a5fc0455a85f9612b1b5b6bd1c976b8c3b2bcc4840249080f4400c23f628a93c14f28434e90d03ab

Download Submit
C:\Windows\System\vLRUjYn.exe

Filesize
1.7MB

MD5
bd1a6c0dd71233e6825f7d9fb945b552

SHA1
618f165f88e27e4a5e449590ff419eeee21f4d6b

SHA256
741004422bd749de5172011a5546717ae5260257465efafbe302e82516c0e983

SHA512
593a9393f99a3e0aebd49fe7da333a84e55b8bf2c2589b0d007463a8ad6e3fa376cfb7eea3634d7dfa3e25d10243fb27fe5888b3eff676b7ed4805faf8206342

Download Submit
C:\Windows\System\vOvfuTf.exe

Filesize
1.7MB

MD5
c62b67d68a2b5f1a9b94b2007b5e7500

SHA1
049fa5c8714c086b4ca6d16c48be863e3eaa3564

SHA256
8e12596ff1b3b1b437e30e22ddbba8af020c232426105c764fe5a34f871e2c66

SHA512
9117476a0b6ad64ed7224493026468f4d1b7b30c3bc1833c31b1f8563121e8e5d5cca0e507b235e3c0d676cfc056a63911a06de8bc2a09d3f8e606d12859f34a

Download Submit
C:\Windows\System\ydjjCLT.exe

Filesize
1.7MB

MD5
e4cac64be42dd3f82da46239ceb45767

SHA1
f3fbe38390ca41647eace72b1fa0042756275c16

SHA256
c71ba30aa1ec64b718c8e3523f494aa8f9590a1f59f5fe40faf682a218a430b7

SHA512
7491462a995d280fa67bc643b4840b7cddd38b5fa3f3eea05dd5b4d05557e062fccd57aded39fd2aef90fb65a33e30cefda280f6f75343545493ad4ffc0ea9a7

Download Submit
memory/4972-0-0x000001CD3E4A0000-0x000001CD3E4B0000-memory.dmp

Filesize
64KB

Download