xmrig | ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
Size

1.6MB
MD5

634d621875304ac5cdcefd4e8ce16e98
SHA1

a8355dc20e8b971ebf14f1efaf71eb62316bbab5
SHA256

ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b
SHA512

2e34582cdd48e11c3fe31a054ce2b2960cf7ac82808f736e97622cf387175ca199705ba1bb6f022b21b06cd6fafa12c7dba342cd70802d22e5d0625c35fc763a
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5ybqOH:GemTLkNdfE0pZys

Score

10^/10

xmrig miner

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 16980 created 17128	16980	WerFaultSecure.exe	915

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b7e-4.dat	xmrig
behavioral2/files/0x0008000000023c69-6.dat	xmrig
behavioral2/files/0x0007000000023c72-17.dat	xmrig
behavioral2/files/0x0009000000023c65-11.dat	xmrig
behavioral2/files/0x0007000000023c73-24.dat	xmrig
behavioral2/files/0x0007000000023c74-29.dat	xmrig
behavioral2/files/0x0007000000023c76-38.dat	xmrig
behavioral2/files/0x0007000000023c75-37.dat	xmrig
behavioral2/files/0x0007000000023c77-46.dat	xmrig
behavioral2/files/0x0007000000023c7c-58.dat	xmrig
behavioral2/files/0x0007000000023c7d-70.dat	xmrig
behavioral2/files/0x0007000000023c7e-75.dat	xmrig
behavioral2/files/0x0007000000023c7f-80.dat	xmrig
behavioral2/files/0x0007000000023c7a-65.dat	xmrig
behavioral2/files/0x0009000000023c66-63.dat	xmrig
behavioral2/files/0x0007000000023c7b-60.dat	xmrig
behavioral2/files/0x0007000000023c81-90.dat	xmrig
behavioral2/files/0x0007000000023c82-95.dat	xmrig
behavioral2/files/0x0007000000023c83-100.dat	xmrig
behavioral2/files/0x0007000000023c84-105.dat	xmrig
behavioral2/files/0x0007000000023c80-85.dat	xmrig
behavioral2/files/0x0007000000023c86-112.dat	xmrig
behavioral2/files/0x0007000000023c85-113.dat	xmrig
behavioral2/files/0x0007000000023c87-118.dat	xmrig
behavioral2/files/0x0007000000023c88-125.dat	xmrig
behavioral2/files/0x0007000000023c8a-133.dat	xmrig
behavioral2/files/0x0007000000023c8b-140.dat	xmrig
behavioral2/files/0x0007000000023c89-130.dat	xmrig
behavioral2/files/0x0007000000023c8d-150.dat	xmrig
behavioral2/files/0x0007000000023c8e-154.dat	xmrig
behavioral2/files/0x0007000000023c8f-160.dat	xmrig
behavioral2/files/0x0007000000023c8c-144.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2920	SoPkidB.exe
3552	eltXvJr.exe
3592	mfQWuIj.exe
3528	ORoHPaO.exe
3904	PbbBLxX.exe
2464	NHagxHe.exe
3432	HbrGHUT.exe
1140	YVRKDUA.exe
1412	yhmsSmv.exe
2964	inwBkQW.exe
4376	WYwXUYX.exe
3160	iaQhFeD.exe
3296	apZVzOM.exe
4496	SuHWXuV.exe
3332	ogOqrOM.exe
2484	hzAzQTK.exe
3696	xpGYtvz.exe
2932	zHKhnGy.exe
3576	IwiAyGS.exe
1072	HOoaMAf.exe
2156	EjvyLHm.exe
736	dInVzrU.exe
1048	FsQTJCA.exe
4912	RvfpKOW.exe
2680	aiLpSlz.exe
4132	JGrqsxP.exe
860	GPolNYP.exe
4044	BykAWNi.exe
4928	wtPlTJP.exe
4820	MvOCVYQ.exe
1192	IUoPbVG.exe
880	zkUODgA.exe
4148	QByFpJj.exe
3380	EldbmSx.exe
4704	bduIVCh.exe
4420	tawVMFp.exe
3824	CNsXNyw.exe
4316	ycUCCLL.exe
4896	sifAwbd.exe
744	JukPALm.exe
1708	KJjurku.exe
4864	UFFHOgl.exe
2360	TCxHSDi.exe
3448	LYJcSMO.exe
3108	vHLbDun.exe
588	YTIRXpH.exe
4164	lEPXkqt.exe
4544	MFYjBgF.exe
1116	eQsZera.exe
3364	YHSXhxR.exe
4988	BLJgQLO.exe
4368	mFAegvH.exe
2344	pCIjGcA.exe
4456	dbrUnTS.exe
3764	uTTkRIb.exe
3504	pcqbEXt.exe
3928	nJVUxME.exe
856	kBCSLEm.exe
3500	UKrnbqc.exe
4468	caOYoIv.exe
4976	AwShNbM.exe
4108	mlUjcab.exe
1800	IJvJoJy.exe
3704	sHvQJoo.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yieiPtF.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\OXMIeZM.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\dxNinuK.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\QoWUHsC.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\iCVXXoq.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\CNsXNyw.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\IyblpTm.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\tDgPBEF.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\dXKYVBz.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\yCLowqZ.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\dXftQcL.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\FJqUoFz.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\hzAzQTK.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\ZLJAxqt.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\YhtjVhh.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\jlsZVBH.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\oBqciSt.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\KJjurku.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\xqfstpV.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\hbuwlKy.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\KbPJjcU.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\GTqtkiq.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\KoTBxQm.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\OzuOntl.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\xVazHxd.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\iaQhFeD.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\LNCMNMi.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\yIoiXXv.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\lIiWulS.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\TTqxcof.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\azprvXT.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\YqcLkOe.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\NqkzKlX.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\QSpPwxr.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\scMFRpq.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\PZGfSNQ.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\MvOCVYQ.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\pOjsQhI.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\lJeWtts.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\ANnhOeh.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\ELQIAVg.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\rgPczqo.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\aVCkcmU.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\CFEREKL.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\XEOYdrp.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\VlqXlgR.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\awCPtcq.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\nCtzVMq.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\WTJOMwn.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\iThCwVz.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\cyXdADm.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\hjOWwwq.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\hfsohNJ.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\XegsMWn.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\nnJIjci.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\jxwShlr.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\AjpBIez.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\VzvIjuv.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\TaLVfBk.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\bPZvLhb.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\auJokiq.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\PecUjwL.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\JublCjJ.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
File created	C:\Windows\System\gIPzNfY.exe	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
17216	WerFaultSecure.exe
17216	WerFaultSecure.exe
16996	WerFaultSecure.exe
16996	WerFaultSecure.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17280	dwm.exe
Token: SeChangeNotifyPrivilege	17280	dwm.exe
Token: 33	17280	dwm.exe
Token: SeIncBasePriorityPrivilege	17280	dwm.exe
Token: SeShutdownPrivilege	17280	dwm.exe
Token: SeCreatePagefilePrivilege	17280	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2920	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	83
PID 2560 wrote to memory of 2920	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	83
PID 2560 wrote to memory of 3552	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	84
PID 2560 wrote to memory of 3552	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	84
PID 2560 wrote to memory of 3592	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	85
PID 2560 wrote to memory of 3592	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	85
PID 2560 wrote to memory of 3528	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	86
PID 2560 wrote to memory of 3528	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	86
PID 2560 wrote to memory of 3904	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	87
PID 2560 wrote to memory of 3904	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	87
PID 2560 wrote to memory of 2464	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	88
PID 2560 wrote to memory of 2464	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	88
PID 2560 wrote to memory of 3432	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	89
PID 2560 wrote to memory of 3432	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	89
PID 2560 wrote to memory of 1140	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	90
PID 2560 wrote to memory of 1140	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	90
PID 2560 wrote to memory of 1412	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	91
PID 2560 wrote to memory of 1412	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	91
PID 2560 wrote to memory of 2964	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	92
PID 2560 wrote to memory of 2964	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	92
PID 2560 wrote to memory of 4376	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	93
PID 2560 wrote to memory of 4376	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	93
PID 2560 wrote to memory of 3160	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	94
PID 2560 wrote to memory of 3160	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	94
PID 2560 wrote to memory of 3296	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	95
PID 2560 wrote to memory of 3296	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	95
PID 2560 wrote to memory of 4496	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	96
PID 2560 wrote to memory of 4496	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	96
PID 2560 wrote to memory of 3332	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	97
PID 2560 wrote to memory of 3332	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	97
PID 2560 wrote to memory of 2484	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	98
PID 2560 wrote to memory of 2484	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	98
PID 2560 wrote to memory of 3696	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	100
PID 2560 wrote to memory of 3696	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	100
PID 2560 wrote to memory of 2932	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	101
PID 2560 wrote to memory of 2932	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	101
PID 2560 wrote to memory of 3576	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	102
PID 2560 wrote to memory of 3576	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	102
PID 2560 wrote to memory of 1072	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	103
PID 2560 wrote to memory of 1072	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	103
PID 2560 wrote to memory of 2156	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	104
PID 2560 wrote to memory of 2156	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	104
PID 2560 wrote to memory of 736	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	105
PID 2560 wrote to memory of 736	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	105
PID 2560 wrote to memory of 1048	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	106
PID 2560 wrote to memory of 1048	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	106
PID 2560 wrote to memory of 4912	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	107
PID 2560 wrote to memory of 4912	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	107
PID 2560 wrote to memory of 2680	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	108
PID 2560 wrote to memory of 2680	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	108
PID 2560 wrote to memory of 4132	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	109
PID 2560 wrote to memory of 4132	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	109
PID 2560 wrote to memory of 860	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	110
PID 2560 wrote to memory of 860	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	110
PID 2560 wrote to memory of 4044	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	111
PID 2560 wrote to memory of 4044	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	111
PID 2560 wrote to memory of 4928	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	112
PID 2560 wrote to memory of 4928	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	112
PID 2560 wrote to memory of 4820	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	113
PID 2560 wrote to memory of 4820	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	113
PID 2560 wrote to memory of 1192	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	114
PID 2560 wrote to memory of 1192	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	114
PID 2560 wrote to memory of 880	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	115
PID 2560 wrote to memory of 880	2560	ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe	115

C:\Users\Admin\AppData\Local\Temp\ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe
"C:\Users\Admin\AppData\Local\Temp\ad3b5a4ce91f8d93fbf85f968d6fa51f96737a52e29f11d50de109938da7731b.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\System\SoPkidB.exe
  C:\Windows\System\SoPkidB.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\eltXvJr.exe
  C:\Windows\System\eltXvJr.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\mfQWuIj.exe
  C:\Windows\System\mfQWuIj.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\ORoHPaO.exe
  C:\Windows\System\ORoHPaO.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\PbbBLxX.exe
  C:\Windows\System\PbbBLxX.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\NHagxHe.exe
  C:\Windows\System\NHagxHe.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\HbrGHUT.exe
  C:\Windows\System\HbrGHUT.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\YVRKDUA.exe
  C:\Windows\System\YVRKDUA.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\yhmsSmv.exe
  C:\Windows\System\yhmsSmv.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\inwBkQW.exe
  C:\Windows\System\inwBkQW.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\WYwXUYX.exe
  C:\Windows\System\WYwXUYX.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\iaQhFeD.exe
  C:\Windows\System\iaQhFeD.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\apZVzOM.exe
  C:\Windows\System\apZVzOM.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\SuHWXuV.exe
  C:\Windows\System\SuHWXuV.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\ogOqrOM.exe
  C:\Windows\System\ogOqrOM.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\hzAzQTK.exe
  C:\Windows\System\hzAzQTK.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\xpGYtvz.exe
  C:\Windows\System\xpGYtvz.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\zHKhnGy.exe
  C:\Windows\System\zHKhnGy.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\IwiAyGS.exe
  C:\Windows\System\IwiAyGS.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\HOoaMAf.exe
  C:\Windows\System\HOoaMAf.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\EjvyLHm.exe
  C:\Windows\System\EjvyLHm.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\dInVzrU.exe
  C:\Windows\System\dInVzrU.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\FsQTJCA.exe
  C:\Windows\System\FsQTJCA.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\RvfpKOW.exe
  C:\Windows\System\RvfpKOW.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\aiLpSlz.exe
  C:\Windows\System\aiLpSlz.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\JGrqsxP.exe
  C:\Windows\System\JGrqsxP.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\GPolNYP.exe
  C:\Windows\System\GPolNYP.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\BykAWNi.exe
  C:\Windows\System\BykAWNi.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\wtPlTJP.exe
  C:\Windows\System\wtPlTJP.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\MvOCVYQ.exe
  C:\Windows\System\MvOCVYQ.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\IUoPbVG.exe
  C:\Windows\System\IUoPbVG.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\zkUODgA.exe
  C:\Windows\System\zkUODgA.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\QByFpJj.exe
  C:\Windows\System\QByFpJj.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\EldbmSx.exe
  C:\Windows\System\EldbmSx.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\bduIVCh.exe
  C:\Windows\System\bduIVCh.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\tawVMFp.exe
  C:\Windows\System\tawVMFp.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\CNsXNyw.exe
  C:\Windows\System\CNsXNyw.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\ycUCCLL.exe
  C:\Windows\System\ycUCCLL.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\sifAwbd.exe
  C:\Windows\System\sifAwbd.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\JukPALm.exe
  C:\Windows\System\JukPALm.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\KJjurku.exe
  C:\Windows\System\KJjurku.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\UFFHOgl.exe
  C:\Windows\System\UFFHOgl.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\TCxHSDi.exe
  C:\Windows\System\TCxHSDi.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\LYJcSMO.exe
  C:\Windows\System\LYJcSMO.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\YTIRXpH.exe
  C:\Windows\System\YTIRXpH.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\vHLbDun.exe
  C:\Windows\System\vHLbDun.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\lEPXkqt.exe
  C:\Windows\System\lEPXkqt.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\MFYjBgF.exe
  C:\Windows\System\MFYjBgF.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\eQsZera.exe
  C:\Windows\System\eQsZera.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\YHSXhxR.exe
  C:\Windows\System\YHSXhxR.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\BLJgQLO.exe
  C:\Windows\System\BLJgQLO.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\mFAegvH.exe
  C:\Windows\System\mFAegvH.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\pCIjGcA.exe
  C:\Windows\System\pCIjGcA.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\dbrUnTS.exe
  C:\Windows\System\dbrUnTS.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\uTTkRIb.exe
  C:\Windows\System\uTTkRIb.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\pcqbEXt.exe
  C:\Windows\System\pcqbEXt.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\nJVUxME.exe
  C:\Windows\System\nJVUxME.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\kBCSLEm.exe
  C:\Windows\System\kBCSLEm.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\UKrnbqc.exe
  C:\Windows\System\UKrnbqc.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\caOYoIv.exe
  C:\Windows\System\caOYoIv.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\AwShNbM.exe
  C:\Windows\System\AwShNbM.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\mlUjcab.exe
  C:\Windows\System\mlUjcab.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\IJvJoJy.exe
  C:\Windows\System\IJvJoJy.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\sHvQJoo.exe
  C:\Windows\System\sHvQJoo.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\qXDMafO.exe
  C:\Windows\System\qXDMafO.exe
  2⤵
  PID:3744
- C:\Windows\System\BKJTrwO.exe
  C:\Windows\System\BKJTrwO.exe
  2⤵
  PID:3008
- C:\Windows\System\qlYpAKq.exe
  C:\Windows\System\qlYpAKq.exe
  2⤵
  PID:1148
- C:\Windows\System\TvulXYB.exe
  C:\Windows\System\TvulXYB.exe
  2⤵
  PID:2140
- C:\Windows\System\HzxmrVc.exe
  C:\Windows\System\HzxmrVc.exe
  2⤵
  PID:2756
- C:\Windows\System\iNcPNjh.exe
  C:\Windows\System\iNcPNjh.exe
  2⤵
  PID:2060
- C:\Windows\System\sMdvVLz.exe
  C:\Windows\System\sMdvVLz.exe
  2⤵
  PID:4016
- C:\Windows\System\vaOQoBB.exe
  C:\Windows\System\vaOQoBB.exe
  2⤵
  PID:4500
- C:\Windows\System\STDvwpm.exe
  C:\Windows\System\STDvwpm.exe
  2⤵
  PID:1384
- C:\Windows\System\JublCjJ.exe
  C:\Windows\System\JublCjJ.exe
  2⤵
  PID:1508
- C:\Windows\System\mhCpnva.exe
  C:\Windows\System\mhCpnva.exe
  2⤵
  PID:2588
- C:\Windows\System\flbFMvM.exe
  C:\Windows\System\flbFMvM.exe
  2⤵
  PID:1952
- C:\Windows\System\PjzDzKe.exe
  C:\Windows\System\PjzDzKe.exe
  2⤵
  PID:4632
- C:\Windows\System\ySVEKLC.exe
  C:\Windows\System\ySVEKLC.exe
  2⤵
  PID:4828
- C:\Windows\System\nvkZbdM.exe
  C:\Windows\System\nvkZbdM.exe
  2⤵
  PID:2972
- C:\Windows\System\NBRFAAJ.exe
  C:\Windows\System\NBRFAAJ.exe
  2⤵
  PID:1548
- C:\Windows\System\dxNinuK.exe
  C:\Windows\System\dxNinuK.exe
  2⤵
  PID:4392
- C:\Windows\System\JuAZRLg.exe
  C:\Windows\System\JuAZRLg.exe
  2⤵
  PID:3164
- C:\Windows\System\SGuxckA.exe
  C:\Windows\System\SGuxckA.exe
  2⤵
  PID:4584
- C:\Windows\System\jbvtdFW.exe
  C:\Windows\System\jbvtdFW.exe
  2⤵
  PID:3880
- C:\Windows\System\WvmKHke.exe
  C:\Windows\System\WvmKHke.exe
  2⤵
  PID:916
- C:\Windows\System\LkwALJN.exe
  C:\Windows\System\LkwALJN.exe
  2⤵
  PID:4472
- C:\Windows\System\boqcQhi.exe
  C:\Windows\System\boqcQhi.exe
  2⤵
  PID:4396
- C:\Windows\System\QSpPwxr.exe
  C:\Windows\System\QSpPwxr.exe
  2⤵
  PID:4520
- C:\Windows\System\UPwcZQB.exe
  C:\Windows\System\UPwcZQB.exe
  2⤵
  PID:1660
- C:\Windows\System\YctzNov.exe
  C:\Windows\System\YctzNov.exe
  2⤵
  PID:2392
- C:\Windows\System\ZTMjjrG.exe
  C:\Windows\System\ZTMjjrG.exe
  2⤵
  PID:3748
- C:\Windows\System\vbjsNxG.exe
  C:\Windows\System\vbjsNxG.exe
  2⤵
  PID:776
- C:\Windows\System\ltnfRgO.exe
  C:\Windows\System\ltnfRgO.exe
  2⤵
  PID:32
- C:\Windows\System\abkBQAY.exe
  C:\Windows\System\abkBQAY.exe
  2⤵
  PID:1608
- C:\Windows\System\sANBSGH.exe
  C:\Windows\System\sANBSGH.exe
  2⤵
  PID:4916
- C:\Windows\System\BbxjIme.exe
  C:\Windows\System\BbxjIme.exe
  2⤵
  PID:2160
- C:\Windows\System\ghSIshG.exe
  C:\Windows\System\ghSIshG.exe
  2⤵
  PID:2504
- C:\Windows\System\YsCcrkl.exe
  C:\Windows\System\YsCcrkl.exe
  2⤵
  PID:4776
- C:\Windows\System\XVqZcvK.exe
  C:\Windows\System\XVqZcvK.exe
  2⤵
  PID:4556
- C:\Windows\System\VlqXlgR.exe
  C:\Windows\System\VlqXlgR.exe
  2⤵
  PID:2996
- C:\Windows\System\ZVRTAIN.exe
  C:\Windows\System\ZVRTAIN.exe
  2⤵
  PID:972
- C:\Windows\System\TLaCjJE.exe
  C:\Windows\System\TLaCjJE.exe
  2⤵
  PID:1424
- C:\Windows\System\OaXGhCA.exe
  C:\Windows\System\OaXGhCA.exe
  2⤵
  PID:2540
- C:\Windows\System\thWKyjd.exe
  C:\Windows\System\thWKyjd.exe
  2⤵
  PID:2448
- C:\Windows\System\jDuHkLV.exe
  C:\Windows\System\jDuHkLV.exe
  2⤵
  PID:5004
- C:\Windows\System\JsfbANI.exe
  C:\Windows\System\JsfbANI.exe
  2⤵
  PID:3124
- C:\Windows\System\trqwRAN.exe
  C:\Windows\System\trqwRAN.exe
  2⤵
  PID:804
- C:\Windows\System\BOKHPRe.exe
  C:\Windows\System\BOKHPRe.exe
  2⤵
  PID:4292
- C:\Windows\System\mzrwRBQ.exe
  C:\Windows\System\mzrwRBQ.exe
  2⤵
  PID:5020
- C:\Windows\System\xrPQpvv.exe
  C:\Windows\System\xrPQpvv.exe
  2⤵
  PID:224
- C:\Windows\System\PggCZHG.exe
  C:\Windows\System\PggCZHG.exe
  2⤵
  PID:3044
- C:\Windows\System\GgQQxSw.exe
  C:\Windows\System\GgQQxSw.exe
  2⤵
  PID:4892
- C:\Windows\System\GhPLZBF.exe
  C:\Windows\System\GhPLZBF.exe
  2⤵
  PID:5136
- C:\Windows\System\acpTDKN.exe
  C:\Windows\System\acpTDKN.exe
  2⤵
  PID:5152
- C:\Windows\System\XgpWrNG.exe
  C:\Windows\System\XgpWrNG.exe
  2⤵
  PID:5176
- C:\Windows\System\mkftiPH.exe
  C:\Windows\System\mkftiPH.exe
  2⤵
  PID:5196
- C:\Windows\System\abtVCTM.exe
  C:\Windows\System\abtVCTM.exe
  2⤵
  PID:5232
- C:\Windows\System\LjIvLnE.exe
  C:\Windows\System\LjIvLnE.exe
  2⤵
  PID:5260
- C:\Windows\System\SyvmyTE.exe
  C:\Windows\System\SyvmyTE.exe
  2⤵
  PID:5280
- C:\Windows\System\MmhNElI.exe
  C:\Windows\System\MmhNElI.exe
  2⤵
  PID:5312
- C:\Windows\System\jxBVinx.exe
  C:\Windows\System\jxBVinx.exe
  2⤵
  PID:5348
- C:\Windows\System\VUvCXsh.exe
  C:\Windows\System\VUvCXsh.exe
  2⤵
  PID:5376
- C:\Windows\System\yWCzhKg.exe
  C:\Windows\System\yWCzhKg.exe
  2⤵
  PID:5392
- C:\Windows\System\cDEKywK.exe
  C:\Windows\System\cDEKywK.exe
  2⤵
  PID:5420
- C:\Windows\System\xqfstpV.exe
  C:\Windows\System\xqfstpV.exe
  2⤵
  PID:5452
- C:\Windows\System\ZIBvGip.exe
  C:\Windows\System\ZIBvGip.exe
  2⤵
  PID:5480
- C:\Windows\System\DToXDcV.exe
  C:\Windows\System\DToXDcV.exe
  2⤵
  PID:5508
- C:\Windows\System\wPbbWca.exe
  C:\Windows\System\wPbbWca.exe
  2⤵
  PID:5540
- C:\Windows\System\tgXCmAx.exe
  C:\Windows\System\tgXCmAx.exe
  2⤵
  PID:5564
- C:\Windows\System\ZcoUdaI.exe
  C:\Windows\System\ZcoUdaI.exe
  2⤵
  PID:5596
- C:\Windows\System\fPpCYeq.exe
  C:\Windows\System\fPpCYeq.exe
  2⤵
  PID:5624
- C:\Windows\System\ovtfBuS.exe
  C:\Windows\System\ovtfBuS.exe
  2⤵
  PID:5652
- C:\Windows\System\svYeuXU.exe
  C:\Windows\System\svYeuXU.exe
  2⤵
  PID:5676
- C:\Windows\System\DFWvDgT.exe
  C:\Windows\System\DFWvDgT.exe
  2⤵
  PID:5708
- C:\Windows\System\HMHzZWg.exe
  C:\Windows\System\HMHzZWg.exe
  2⤵
  PID:5732
- C:\Windows\System\nnJIjci.exe
  C:\Windows\System\nnJIjci.exe
  2⤵
  PID:5760
- C:\Windows\System\hsoKoMo.exe
  C:\Windows\System\hsoKoMo.exe
  2⤵
  PID:5800
- C:\Windows\System\AhIvkZv.exe
  C:\Windows\System\AhIvkZv.exe
  2⤵
  PID:5816
- C:\Windows\System\uqFsCdZ.exe
  C:\Windows\System\uqFsCdZ.exe
  2⤵
  PID:5844
- C:\Windows\System\TTqxcof.exe
  C:\Windows\System\TTqxcof.exe
  2⤵
  PID:5876
- C:\Windows\System\ClEbTqp.exe
  C:\Windows\System\ClEbTqp.exe
  2⤵
  PID:5896
- C:\Windows\System\xhQXWAa.exe
  C:\Windows\System\xhQXWAa.exe
  2⤵
  PID:5924
- C:\Windows\System\ZMxXYwK.exe
  C:\Windows\System\ZMxXYwK.exe
  2⤵
  PID:5956
- C:\Windows\System\esYJEXA.exe
  C:\Windows\System\esYJEXA.exe
  2⤵
  PID:5992
- C:\Windows\System\pAwgTWf.exe
  C:\Windows\System\pAwgTWf.exe
  2⤵
  PID:6012
- C:\Windows\System\kSACxof.exe
  C:\Windows\System\kSACxof.exe
  2⤵
  PID:6040
- C:\Windows\System\sUvUgZx.exe
  C:\Windows\System\sUvUgZx.exe
  2⤵
  PID:6064
- C:\Windows\System\WLLcTsj.exe
  C:\Windows\System\WLLcTsj.exe
  2⤵
  PID:6096
- C:\Windows\System\RhKYOhR.exe
  C:\Windows\System\RhKYOhR.exe
  2⤵
  PID:6124
- C:\Windows\System\gmteUoh.exe
  C:\Windows\System\gmteUoh.exe
  2⤵
  PID:5132
- C:\Windows\System\xuAUIfP.exe
  C:\Windows\System\xuAUIfP.exe
  2⤵
  PID:5240
- C:\Windows\System\TGSKVHx.exe
  C:\Windows\System\TGSKVHx.exe
  2⤵
  PID:5252
- C:\Windows\System\ITqnlup.exe
  C:\Windows\System\ITqnlup.exe
  2⤵
  PID:5344
- C:\Windows\System\fLoCBpW.exe
  C:\Windows\System\fLoCBpW.exe
  2⤵
  PID:5416
- C:\Windows\System\awCPtcq.exe
  C:\Windows\System\awCPtcq.exe
  2⤵
  PID:5464
- C:\Windows\System\lYfAZir.exe
  C:\Windows\System\lYfAZir.exe
  2⤵
  PID:5548
- C:\Windows\System\uelKfeZ.exe
  C:\Windows\System\uelKfeZ.exe
  2⤵
  PID:5604
- C:\Windows\System\LgaLAhC.exe
  C:\Windows\System\LgaLAhC.exe
  2⤵
  PID:5660
- C:\Windows\System\azprvXT.exe
  C:\Windows\System\azprvXT.exe
  2⤵
  PID:5688
- C:\Windows\System\NTdNcCf.exe
  C:\Windows\System\NTdNcCf.exe
  2⤵
  PID:5812
- C:\Windows\System\iUOTpRC.exe
  C:\Windows\System\iUOTpRC.exe
  2⤵
  PID:5884
- C:\Windows\System\YEaLoJS.exe
  C:\Windows\System\YEaLoJS.exe
  2⤵
  PID:5940
- C:\Windows\System\FSdXKDM.exe
  C:\Windows\System\FSdXKDM.exe
  2⤵
  PID:6008
- C:\Windows\System\liVBWVI.exe
  C:\Windows\System\liVBWVI.exe
  2⤵
  PID:6052
- C:\Windows\System\UVcdHYq.exe
  C:\Windows\System\UVcdHYq.exe
  2⤵
  PID:6108
- C:\Windows\System\bxYthIb.exe
  C:\Windows\System\bxYthIb.exe
  2⤵
  PID:5244
- C:\Windows\System\nRrUjWM.exe
  C:\Windows\System\nRrUjWM.exe
  2⤵
  PID:5388
- C:\Windows\System\xVazHxd.exe
  C:\Windows\System\xVazHxd.exe
  2⤵
  PID:5524
- C:\Windows\System\UbZACrh.exe
  C:\Windows\System\UbZACrh.exe
  2⤵
  PID:5664
- C:\Windows\System\bQrbpMP.exe
  C:\Windows\System\bQrbpMP.exe
  2⤵
  PID:5776
- C:\Windows\System\opNWffQ.exe
  C:\Windows\System\opNWffQ.exe
  2⤵
  PID:6000
- C:\Windows\System\PfsYmHs.exe
  C:\Windows\System\PfsYmHs.exe
  2⤵
  PID:5208
- C:\Windows\System\NgNZKIx.exe
  C:\Windows\System\NgNZKIx.exe
  2⤵
  PID:5292
- C:\Windows\System\iRTIHMV.exe
  C:\Windows\System\iRTIHMV.exe
  2⤵
  PID:5756
- C:\Windows\System\gqmQqJJ.exe
  C:\Windows\System\gqmQqJJ.exe
  2⤵
  PID:6056
- C:\Windows\System\NTKXYmr.exe
  C:\Windows\System\NTKXYmr.exe
  2⤵
  PID:5976
- C:\Windows\System\imGZFbr.exe
  C:\Windows\System\imGZFbr.exe
  2⤵
  PID:5556
- C:\Windows\System\amKlFVa.exe
  C:\Windows\System\amKlFVa.exe
  2⤵
  PID:6164
- C:\Windows\System\qgrdJhe.exe
  C:\Windows\System\qgrdJhe.exe
  2⤵
  PID:6204
- C:\Windows\System\dhTYpLB.exe
  C:\Windows\System\dhTYpLB.exe
  2⤵
  PID:6220
- C:\Windows\System\jxwShlr.exe
  C:\Windows\System\jxwShlr.exe
  2⤵
  PID:6248
- C:\Windows\System\ELGZBIg.exe
  C:\Windows\System\ELGZBIg.exe
  2⤵
  PID:6276
- C:\Windows\System\tADggWH.exe
  C:\Windows\System\tADggWH.exe
  2⤵
  PID:6296
- C:\Windows\System\cjblTvA.exe
  C:\Windows\System\cjblTvA.exe
  2⤵
  PID:6332
- C:\Windows\System\hoIZlmF.exe
  C:\Windows\System\hoIZlmF.exe
  2⤵
  PID:6352
- C:\Windows\System\XbGLfrh.exe
  C:\Windows\System\XbGLfrh.exe
  2⤵
  PID:6380
- C:\Windows\System\pfcCGhM.exe
  C:\Windows\System\pfcCGhM.exe
  2⤵
  PID:6412
- C:\Windows\System\DyBkZRi.exe
  C:\Windows\System\DyBkZRi.exe
  2⤵
  PID:6436
- C:\Windows\System\AlixEfK.exe
  C:\Windows\System\AlixEfK.exe
  2⤵
  PID:6468
- C:\Windows\System\wZRcNnq.exe
  C:\Windows\System\wZRcNnq.exe
  2⤵
  PID:6500
- C:\Windows\System\hngggkd.exe
  C:\Windows\System\hngggkd.exe
  2⤵
  PID:6548
- C:\Windows\System\CzahWyD.exe
  C:\Windows\System\CzahWyD.exe
  2⤵
  PID:6568
- C:\Windows\System\TMjlvfH.exe
  C:\Windows\System\TMjlvfH.exe
  2⤵
  PID:6596
- C:\Windows\System\KGNTXef.exe
  C:\Windows\System\KGNTXef.exe
  2⤵
  PID:6624
- C:\Windows\System\eixhYRi.exe
  C:\Windows\System\eixhYRi.exe
  2⤵
  PID:6648
- C:\Windows\System\fanVPNp.exe
  C:\Windows\System\fanVPNp.exe
  2⤵
  PID:6680
- C:\Windows\System\SgCqLNh.exe
  C:\Windows\System\SgCqLNh.exe
  2⤵
  PID:6708
- C:\Windows\System\qVoZWxH.exe
  C:\Windows\System\qVoZWxH.exe
  2⤵
  PID:6736
- C:\Windows\System\CaFTCqw.exe
  C:\Windows\System\CaFTCqw.exe
  2⤵
  PID:6776
- C:\Windows\System\gVWyyiA.exe
  C:\Windows\System\gVWyyiA.exe
  2⤵
  PID:6792
- C:\Windows\System\ccSRYMU.exe
  C:\Windows\System\ccSRYMU.exe
  2⤵
  PID:6820
- C:\Windows\System\VtgzQZG.exe
  C:\Windows\System\VtgzQZG.exe
  2⤵
  PID:6864
- C:\Windows\System\HobhMpg.exe
  C:\Windows\System\HobhMpg.exe
  2⤵
  PID:6880
- C:\Windows\System\KfOABCh.exe
  C:\Windows\System\KfOABCh.exe
  2⤵
  PID:6908
- C:\Windows\System\KxvhmHI.exe
  C:\Windows\System\KxvhmHI.exe
  2⤵
  PID:6936
- C:\Windows\System\wHuxPuX.exe
  C:\Windows\System\wHuxPuX.exe
  2⤵
  PID:6976
- C:\Windows\System\msOpGQe.exe
  C:\Windows\System\msOpGQe.exe
  2⤵
  PID:7004
- C:\Windows\System\wzqDXUC.exe
  C:\Windows\System\wzqDXUC.exe
  2⤵
  PID:7032
- C:\Windows\System\cyXdADm.exe
  C:\Windows\System\cyXdADm.exe
  2⤵
  PID:7060
- C:\Windows\System\IyblpTm.exe
  C:\Windows\System\IyblpTm.exe
  2⤵
  PID:7088
- C:\Windows\System\AbqUghj.exe
  C:\Windows\System\AbqUghj.exe
  2⤵
  PID:7104
- C:\Windows\System\VyOvDSx.exe
  C:\Windows\System\VyOvDSx.exe
  2⤵
  PID:7132
- C:\Windows\System\tDgPBEF.exe
  C:\Windows\System\tDgPBEF.exe
  2⤵
  PID:7160
- C:\Windows\System\RzigOzu.exe
  C:\Windows\System\RzigOzu.exe
  2⤵
  PID:6216
- C:\Windows\System\ZbaoVPx.exe
  C:\Windows\System\ZbaoVPx.exe
  2⤵
  PID:6264
- C:\Windows\System\nCtzVMq.exe
  C:\Windows\System\nCtzVMq.exe
  2⤵
  PID:6320
- C:\Windows\System\AxfVSqw.exe
  C:\Windows\System\AxfVSqw.exe
  2⤵
  PID:6368
- C:\Windows\System\UqqSYRS.exe
  C:\Windows\System\UqqSYRS.exe
  2⤵
  PID:6492
- C:\Windows\System\fVnERxq.exe
  C:\Windows\System\fVnERxq.exe
  2⤵
  PID:6520
- C:\Windows\System\WiijPLz.exe
  C:\Windows\System\WiijPLz.exe
  2⤵
  PID:6588
- C:\Windows\System\SPGYoXs.exe
  C:\Windows\System\SPGYoXs.exe
  2⤵
  PID:6636
- C:\Windows\System\wpBVqSC.exe
  C:\Windows\System\wpBVqSC.exe
  2⤵
  PID:6692
- C:\Windows\System\UcdAQil.exe
  C:\Windows\System\UcdAQil.exe
  2⤵
  PID:6764
- C:\Windows\System\pTrVcVV.exe
  C:\Windows\System\pTrVcVV.exe
  2⤵
  PID:6828
- C:\Windows\System\MFmVziE.exe
  C:\Windows\System\MFmVziE.exe
  2⤵
  PID:6896
- C:\Windows\System\Ghsvblj.exe
  C:\Windows\System\Ghsvblj.exe
  2⤵
  PID:6960
- C:\Windows\System\lzCavFO.exe
  C:\Windows\System\lzCavFO.exe
  2⤵
  PID:7020
- C:\Windows\System\NuUTxek.exe
  C:\Windows\System\NuUTxek.exe
  2⤵
  PID:7056
- C:\Windows\System\AjpBIez.exe
  C:\Windows\System\AjpBIez.exe
  2⤵
  PID:7156
- C:\Windows\System\CBiggrs.exe
  C:\Windows\System\CBiggrs.exe
  2⤵
  PID:6236
- C:\Windows\System\QiAmGPL.exe
  C:\Windows\System\QiAmGPL.exe
  2⤵
  PID:6376
- C:\Windows\System\zxdVHzY.exe
  C:\Windows\System\zxdVHzY.exe
  2⤵
  PID:6496
- C:\Windows\System\IDZhGMA.exe
  C:\Windows\System\IDZhGMA.exe
  2⤵
  PID:6660
- C:\Windows\System\SUiCpRJ.exe
  C:\Windows\System\SUiCpRJ.exe
  2⤵
  PID:6756
- C:\Windows\System\IgexFFv.exe
  C:\Windows\System\IgexFFv.exe
  2⤵
  PID:6948
- C:\Windows\System\MmBNWdt.exe
  C:\Windows\System\MmBNWdt.exe
  2⤵
  PID:7096
- C:\Windows\System\JqhwzJa.exe
  C:\Windows\System\JqhwzJa.exe
  2⤵
  PID:6348
- C:\Windows\System\yWEorHm.exe
  C:\Windows\System\yWEorHm.exe
  2⤵
  PID:6644
- C:\Windows\System\BTDiRnK.exe
  C:\Windows\System\BTDiRnK.exe
  2⤵
  PID:6312
- C:\Windows\System\WqjvnJW.exe
  C:\Windows\System\WqjvnJW.exe
  2⤵
  PID:6988
- C:\Windows\System\cZNWuCf.exe
  C:\Windows\System\cZNWuCf.exe
  2⤵
  PID:7184
- C:\Windows\System\jZaUvHX.exe
  C:\Windows\System\jZaUvHX.exe
  2⤵
  PID:7204
- C:\Windows\System\CCUDOga.exe
  C:\Windows\System\CCUDOga.exe
  2⤵
  PID:7232
- C:\Windows\System\GZqiVBp.exe
  C:\Windows\System\GZqiVBp.exe
  2⤵
  PID:7260
- C:\Windows\System\ePaYTVr.exe
  C:\Windows\System\ePaYTVr.exe
  2⤵
  PID:7300
- C:\Windows\System\nFreDiv.exe
  C:\Windows\System\nFreDiv.exe
  2⤵
  PID:7316
- C:\Windows\System\DIIOEGU.exe
  C:\Windows\System\DIIOEGU.exe
  2⤵
  PID:7352
- C:\Windows\System\hGjnZWo.exe
  C:\Windows\System\hGjnZWo.exe
  2⤵
  PID:7376
- C:\Windows\System\rmHSgmm.exe
  C:\Windows\System\rmHSgmm.exe
  2⤵
  PID:7424
- C:\Windows\System\OKSWeoJ.exe
  C:\Windows\System\OKSWeoJ.exe
  2⤵
  PID:7448
- C:\Windows\System\JVDurXI.exe
  C:\Windows\System\JVDurXI.exe
  2⤵
  PID:7468
- C:\Windows\System\isKZMXx.exe
  C:\Windows\System\isKZMXx.exe
  2⤵
  PID:7488
- C:\Windows\System\LhULGmb.exe
  C:\Windows\System\LhULGmb.exe
  2⤵
  PID:7516
- C:\Windows\System\ewSDhtp.exe
  C:\Windows\System\ewSDhtp.exe
  2⤵
  PID:7544
- C:\Windows\System\KKltmAo.exe
  C:\Windows\System\KKltmAo.exe
  2⤵
  PID:7576
- C:\Windows\System\pIfzVul.exe
  C:\Windows\System\pIfzVul.exe
  2⤵
  PID:7600
- C:\Windows\System\tLTzuuq.exe
  C:\Windows\System\tLTzuuq.exe
  2⤵
  PID:7620
- C:\Windows\System\cBcEkdq.exe
  C:\Windows\System\cBcEkdq.exe
  2⤵
  PID:7648
- C:\Windows\System\lNjWDHF.exe
  C:\Windows\System\lNjWDHF.exe
  2⤵
  PID:7680
- C:\Windows\System\eYeOysb.exe
  C:\Windows\System\eYeOysb.exe
  2⤵
  PID:7728
- C:\Windows\System\xNGhwtO.exe
  C:\Windows\System\xNGhwtO.exe
  2⤵
  PID:7760
- C:\Windows\System\pKysBvx.exe
  C:\Windows\System\pKysBvx.exe
  2⤵
  PID:7788
- C:\Windows\System\kOnKUXe.exe
  C:\Windows\System\kOnKUXe.exe
  2⤵
  PID:7804
- C:\Windows\System\OUeVjfK.exe
  C:\Windows\System\OUeVjfK.exe
  2⤵
  PID:7832
- C:\Windows\System\BbXHaly.exe
  C:\Windows\System\BbXHaly.exe
  2⤵
  PID:7872
- C:\Windows\System\GGNUrwB.exe
  C:\Windows\System\GGNUrwB.exe
  2⤵
  PID:7900
- C:\Windows\System\qHPnSEr.exe
  C:\Windows\System\qHPnSEr.exe
  2⤵
  PID:7928
- C:\Windows\System\QJRbbtc.exe
  C:\Windows\System\QJRbbtc.exe
  2⤵
  PID:7956
- C:\Windows\System\HsQlAII.exe
  C:\Windows\System\HsQlAII.exe
  2⤵
  PID:7972
- C:\Windows\System\GfxLWtj.exe
  C:\Windows\System\GfxLWtj.exe
  2⤵
  PID:8012
- C:\Windows\System\uSEfNhV.exe
  C:\Windows\System\uSEfNhV.exe
  2⤵
  PID:8028
- C:\Windows\System\TTluggV.exe
  C:\Windows\System\TTluggV.exe
  2⤵
  PID:8056
- C:\Windows\System\OPuGhgn.exe
  C:\Windows\System\OPuGhgn.exe
  2⤵
  PID:8084
- C:\Windows\System\WDzZjYZ.exe
  C:\Windows\System\WDzZjYZ.exe
  2⤵
  PID:8104
- C:\Windows\System\ZfIaPjp.exe
  C:\Windows\System\ZfIaPjp.exe
  2⤵
  PID:8132
- C:\Windows\System\GTqtkiq.exe
  C:\Windows\System\GTqtkiq.exe
  2⤵
  PID:8164
- C:\Windows\System\eyBAbdF.exe
  C:\Windows\System\eyBAbdF.exe
  2⤵
  PID:8188
- C:\Windows\System\IuMNNXi.exe
  C:\Windows\System\IuMNNXi.exe
  2⤵
  PID:7284
- C:\Windows\System\NuQjjnV.exe
  C:\Windows\System\NuQjjnV.exe
  2⤵
  PID:7332
- C:\Windows\System\FLyWZPU.exe
  C:\Windows\System\FLyWZPU.exe
  2⤵
  PID:7372
- C:\Windows\System\MWsnkGo.exe
  C:\Windows\System\MWsnkGo.exe
  2⤵
  PID:7456
- C:\Windows\System\quCnXsO.exe
  C:\Windows\System\quCnXsO.exe
  2⤵
  PID:7484
- C:\Windows\System\SvBTVXD.exe
  C:\Windows\System\SvBTVXD.exe
  2⤵
  PID:7528
- C:\Windows\System\WEiiRNR.exe
  C:\Windows\System\WEiiRNR.exe
  2⤵
  PID:7596
- C:\Windows\System\qBsCrSz.exe
  C:\Windows\System\qBsCrSz.exe
  2⤵
  PID:7712
- C:\Windows\System\PoDnhAg.exe
  C:\Windows\System\PoDnhAg.exe
  2⤵
  PID:7776
- C:\Windows\System\VkmQvoQ.exe
  C:\Windows\System\VkmQvoQ.exe
  2⤵
  PID:7816
- C:\Windows\System\GVjrCLz.exe
  C:\Windows\System\GVjrCLz.exe
  2⤵
  PID:7888
- C:\Windows\System\peiHGjF.exe
  C:\Windows\System\peiHGjF.exe
  2⤵
  PID:7964
- C:\Windows\System\NGYwRvQ.exe
  C:\Windows\System\NGYwRvQ.exe
  2⤵
  PID:8044
- C:\Windows\System\tZBQwqA.exe
  C:\Windows\System\tZBQwqA.exe
  2⤵
  PID:8092
- C:\Windows\System\LNCMNMi.exe
  C:\Windows\System\LNCMNMi.exe
  2⤵
  PID:8124
- C:\Windows\System\yYsacfs.exe
  C:\Windows\System\yYsacfs.exe
  2⤵
  PID:7200
- C:\Windows\System\AcFuJHT.exe
  C:\Windows\System\AcFuJHT.exe
  2⤵
  PID:7360
- C:\Windows\System\bGMMTok.exe
  C:\Windows\System\bGMMTok.exe
  2⤵
  PID:7464
- C:\Windows\System\eKtNKHg.exe
  C:\Windows\System\eKtNKHg.exe
  2⤵
  PID:7588
- C:\Windows\System\rsQlWFp.exe
  C:\Windows\System\rsQlWFp.exe
  2⤵
  PID:7796
- C:\Windows\System\Wdiqkpw.exe
  C:\Windows\System\Wdiqkpw.exe
  2⤵
  PID:7948
- C:\Windows\System\tztfOVe.exe
  C:\Windows\System\tztfOVe.exe
  2⤵
  PID:8068
- C:\Windows\System\wgXeWJz.exe
  C:\Windows\System\wgXeWJz.exe
  2⤵
  PID:7248
- C:\Windows\System\PYnwChI.exe
  C:\Windows\System\PYnwChI.exe
  2⤵
  PID:7532
- C:\Windows\System\GGcUkeN.exe
  C:\Windows\System\GGcUkeN.exe
  2⤵
  PID:7848
- C:\Windows\System\ZLJAxqt.exe
  C:\Windows\System\ZLJAxqt.exe
  2⤵
  PID:7408
- C:\Windows\System\sbZtsGt.exe
  C:\Windows\System\sbZtsGt.exe
  2⤵
  PID:7244
- C:\Windows\System\SfEWdlx.exe
  C:\Windows\System\SfEWdlx.exe
  2⤵
  PID:8200
- C:\Windows\System\hwHqzEY.exe
  C:\Windows\System\hwHqzEY.exe
  2⤵
  PID:8224
- C:\Windows\System\YoGNmZW.exe
  C:\Windows\System\YoGNmZW.exe
  2⤵
  PID:8248
- C:\Windows\System\DUysmjT.exe
  C:\Windows\System\DUysmjT.exe
  2⤵
  PID:8288
- C:\Windows\System\iyVoEkT.exe
  C:\Windows\System\iyVoEkT.exe
  2⤵
  PID:8316
- C:\Windows\System\aOUcvET.exe
  C:\Windows\System\aOUcvET.exe
  2⤵
  PID:8344
- C:\Windows\System\AasXtGU.exe
  C:\Windows\System\AasXtGU.exe
  2⤵
  PID:8360
- C:\Windows\System\DhhDWBL.exe
  C:\Windows\System\DhhDWBL.exe
  2⤵
  PID:8380
- C:\Windows\System\TSDepuu.exe
  C:\Windows\System\TSDepuu.exe
  2⤵
  PID:8416
- C:\Windows\System\fmdGAkZ.exe
  C:\Windows\System\fmdGAkZ.exe
  2⤵
  PID:8456
- C:\Windows\System\arVYyvR.exe
  C:\Windows\System\arVYyvR.exe
  2⤵
  PID:8484
- C:\Windows\System\jdYWuFO.exe
  C:\Windows\System\jdYWuFO.exe
  2⤵
  PID:8504
- C:\Windows\System\EFfGHJs.exe
  C:\Windows\System\EFfGHJs.exe
  2⤵
  PID:8528
- C:\Windows\System\XjenWrn.exe
  C:\Windows\System\XjenWrn.exe
  2⤵
  PID:8568
- C:\Windows\System\DzZGtaR.exe
  C:\Windows\System\DzZGtaR.exe
  2⤵
  PID:8596
- C:\Windows\System\xFegrxj.exe
  C:\Windows\System\xFegrxj.exe
  2⤵
  PID:8624
- C:\Windows\System\tVoAldM.exe
  C:\Windows\System\tVoAldM.exe
  2⤵
  PID:8652
- C:\Windows\System\ckZTUzR.exe
  C:\Windows\System\ckZTUzR.exe
  2⤵
  PID:8680
- C:\Windows\System\OVDkRjx.exe
  C:\Windows\System\OVDkRjx.exe
  2⤵
  PID:8700
- C:\Windows\System\LsNfnou.exe
  C:\Windows\System\LsNfnou.exe
  2⤵
  PID:8724
- C:\Windows\System\dgspcLP.exe
  C:\Windows\System\dgspcLP.exe
  2⤵
  PID:8740
- C:\Windows\System\zvVeuxp.exe
  C:\Windows\System\zvVeuxp.exe
  2⤵
  PID:8768
- C:\Windows\System\leeCPxq.exe
  C:\Windows\System\leeCPxq.exe
  2⤵
  PID:8792
- C:\Windows\System\uzriciz.exe
  C:\Windows\System\uzriciz.exe
  2⤵
  PID:8820
- C:\Windows\System\SrwtJXW.exe
  C:\Windows\System\SrwtJXW.exe
  2⤵
  PID:8868
- C:\Windows\System\ZvZDmNP.exe
  C:\Windows\System\ZvZDmNP.exe
  2⤵
  PID:8892
- C:\Windows\System\ejNDOiG.exe
  C:\Windows\System\ejNDOiG.exe
  2⤵
  PID:8912
- C:\Windows\System\iDxWvAa.exe
  C:\Windows\System\iDxWvAa.exe
  2⤵
  PID:8940
- C:\Windows\System\hFHSRTn.exe
  C:\Windows\System\hFHSRTn.exe
  2⤵
  PID:8972
- C:\Windows\System\vGHMRUY.exe
  C:\Windows\System\vGHMRUY.exe
  2⤵
  PID:9016
- C:\Windows\System\RjapVat.exe
  C:\Windows\System\RjapVat.exe
  2⤵
  PID:9032
- C:\Windows\System\gIPzNfY.exe
  C:\Windows\System\gIPzNfY.exe
  2⤵
  PID:9060
- C:\Windows\System\PWGXIeu.exe
  C:\Windows\System\PWGXIeu.exe
  2⤵
  PID:9088
- C:\Windows\System\tNaPtcY.exe
  C:\Windows\System\tNaPtcY.exe
  2⤵
  PID:9108
- C:\Windows\System\bTfZhQb.exe
  C:\Windows\System\bTfZhQb.exe
  2⤵
  PID:9136
- C:\Windows\System\HbenZSV.exe
  C:\Windows\System\HbenZSV.exe
  2⤵
  PID:9164
- C:\Windows\System\NRLXjJN.exe
  C:\Windows\System\NRLXjJN.exe
  2⤵
  PID:9196
- C:\Windows\System\XsFqlMw.exe
  C:\Windows\System\XsFqlMw.exe
  2⤵
  PID:8232
- C:\Windows\System\YIzqOAs.exe
  C:\Windows\System\YIzqOAs.exe
  2⤵
  PID:8284
- C:\Windows\System\IUZWLpm.exe
  C:\Windows\System\IUZWLpm.exe
  2⤵
  PID:8356
- C:\Windows\System\qiCVLuH.exe
  C:\Windows\System\qiCVLuH.exe
  2⤵
  PID:8448
- C:\Windows\System\lrITIhV.exe
  C:\Windows\System\lrITIhV.exe
  2⤵
  PID:8500
- C:\Windows\System\OuCsEVv.exe
  C:\Windows\System\OuCsEVv.exe
  2⤵
  PID:8544
- C:\Windows\System\NchxZDt.exe
  C:\Windows\System\NchxZDt.exe
  2⤵
  PID:8584
- C:\Windows\System\zklbePa.exe
  C:\Windows\System\zklbePa.exe
  2⤵
  PID:8644
- C:\Windows\System\aVCkcmU.exe
  C:\Windows\System\aVCkcmU.exe
  2⤵
  PID:8720
- C:\Windows\System\lSTNmwm.exe
  C:\Windows\System\lSTNmwm.exe
  2⤵
  PID:8764
- C:\Windows\System\xitagwh.exe
  C:\Windows\System\xitagwh.exe
  2⤵
  PID:8812
- C:\Windows\System\xMnIeVE.exe
  C:\Windows\System\xMnIeVE.exe
  2⤵
  PID:8924
- C:\Windows\System\xgmUboB.exe
  C:\Windows\System\xgmUboB.exe
  2⤵
  PID:8996
- C:\Windows\System\eHCzkpm.exe
  C:\Windows\System\eHCzkpm.exe
  2⤵
  PID:9044
- C:\Windows\System\ovpxCGz.exe
  C:\Windows\System\ovpxCGz.exe
  2⤵
  PID:9076
- C:\Windows\System\pztxUrJ.exe
  C:\Windows\System\pztxUrJ.exe
  2⤵
  PID:9188
- C:\Windows\System\hqnYeQQ.exe
  C:\Windows\System\hqnYeQQ.exe
  2⤵
  PID:8272
- C:\Windows\System\CFEREKL.exe
  C:\Windows\System\CFEREKL.exe
  2⤵
  PID:8404
- C:\Windows\System\ysgnxxY.exe
  C:\Windows\System\ysgnxxY.exe
  2⤵
  PID:8548
- C:\Windows\System\hYAsMvN.exe
  C:\Windows\System\hYAsMvN.exe
  2⤵
  PID:8620
- C:\Windows\System\PzZUmET.exe
  C:\Windows\System\PzZUmET.exe
  2⤵
  PID:8884
- C:\Windows\System\PfSSqAB.exe
  C:\Windows\System\PfSSqAB.exe
  2⤵
  PID:9052
- C:\Windows\System\OZUnUoI.exe
  C:\Windows\System\OZUnUoI.exe
  2⤵
  PID:8196
- C:\Windows\System\dDLSBrB.exe
  C:\Windows\System\dDLSBrB.exe
  2⤵
  PID:8472
- C:\Windows\System\EQZLKpt.exe
  C:\Windows\System\EQZLKpt.exe
  2⤵
  PID:8780
- C:\Windows\System\LtHxKCH.exe
  C:\Windows\System\LtHxKCH.exe
  2⤵
  PID:9176
- C:\Windows\System\zMKNons.exe
  C:\Windows\System\zMKNons.exe
  2⤵
  PID:8480
- C:\Windows\System\enLHMlp.exe
  C:\Windows\System\enLHMlp.exe
  2⤵
  PID:9260
- C:\Windows\System\McjMGQV.exe
  C:\Windows\System\McjMGQV.exe
  2⤵
  PID:9288
- C:\Windows\System\vWDSOCq.exe
  C:\Windows\System\vWDSOCq.exe
  2⤵
  PID:9304
- C:\Windows\System\HZCGlNf.exe
  C:\Windows\System\HZCGlNf.exe
  2⤵
  PID:9324
- C:\Windows\System\jebBoZH.exe
  C:\Windows\System\jebBoZH.exe
  2⤵
  PID:9360
- C:\Windows\System\kNOQMDm.exe
  C:\Windows\System\kNOQMDm.exe
  2⤵
  PID:9392
- C:\Windows\System\NYUErft.exe
  C:\Windows\System\NYUErft.exe
  2⤵
  PID:9416
- C:\Windows\System\elhwGeX.exe
  C:\Windows\System\elhwGeX.exe
  2⤵
  PID:9444
- C:\Windows\System\HxmhXTQ.exe
  C:\Windows\System\HxmhXTQ.exe
  2⤵
  PID:9472
- C:\Windows\System\ofblBCo.exe
  C:\Windows\System\ofblBCo.exe
  2⤵
  PID:9488
- C:\Windows\System\lGxXRZV.exe
  C:\Windows\System\lGxXRZV.exe
  2⤵
  PID:9540
- C:\Windows\System\sYeqIsx.exe
  C:\Windows\System\sYeqIsx.exe
  2⤵
  PID:9564
- C:\Windows\System\auJokiq.exe
  C:\Windows\System\auJokiq.exe
  2⤵
  PID:9596
- C:\Windows\System\svHiwWq.exe
  C:\Windows\System\svHiwWq.exe
  2⤵
  PID:9612
- C:\Windows\System\OjqSOvQ.exe
  C:\Windows\System\OjqSOvQ.exe
  2⤵
  PID:9640
- C:\Windows\System\yzLiEnm.exe
  C:\Windows\System\yzLiEnm.exe
  2⤵
  PID:9668
- C:\Windows\System\ohASGSE.exe
  C:\Windows\System\ohASGSE.exe
  2⤵
  PID:9708
- C:\Windows\System\QNYjTTR.exe
  C:\Windows\System\QNYjTTR.exe
  2⤵
  PID:9736
- C:\Windows\System\cWycPam.exe
  C:\Windows\System\cWycPam.exe
  2⤵
  PID:9752
- C:\Windows\System\ELQIAVg.exe
  C:\Windows\System\ELQIAVg.exe
  2⤵
  PID:9780
- C:\Windows\System\metTrAc.exe
  C:\Windows\System\metTrAc.exe
  2⤵
  PID:9812
- C:\Windows\System\jGTQRkY.exe
  C:\Windows\System\jGTQRkY.exe
  2⤵
  PID:9848
- C:\Windows\System\ZAokTLU.exe
  C:\Windows\System\ZAokTLU.exe
  2⤵
  PID:9864
- C:\Windows\System\unXAYAl.exe
  C:\Windows\System\unXAYAl.exe
  2⤵
  PID:9884
- C:\Windows\System\JLKyiNY.exe
  C:\Windows\System\JLKyiNY.exe
  2⤵
  PID:9908
- C:\Windows\System\BZWQsWq.exe
  C:\Windows\System\BZWQsWq.exe
  2⤵
  PID:9932
- C:\Windows\System\qrCBZrK.exe
  C:\Windows\System\qrCBZrK.exe
  2⤵
  PID:9960
- C:\Windows\System\yXFkjMV.exe
  C:\Windows\System\yXFkjMV.exe
  2⤵
  PID:9992
- C:\Windows\System\oqopaRG.exe
  C:\Windows\System\oqopaRG.exe
  2⤵
  PID:10024
- C:\Windows\System\XIuROsU.exe
  C:\Windows\System\XIuROsU.exe
  2⤵
  PID:10052
- C:\Windows\System\LGTGzAo.exe
  C:\Windows\System\LGTGzAo.exe
  2⤵
  PID:10084
- C:\Windows\System\lJeWtts.exe
  C:\Windows\System\lJeWtts.exe
  2⤵
  PID:10132
- C:\Windows\System\LXJnUUX.exe
  C:\Windows\System\LXJnUUX.exe
  2⤵
  PID:10160
- C:\Windows\System\obWqyDw.exe
  C:\Windows\System\obWqyDw.exe
  2⤵
  PID:10188
- C:\Windows\System\WQRCSDF.exe
  C:\Windows\System\WQRCSDF.exe
  2⤵
  PID:10216
- C:\Windows\System\OyyNkTy.exe
  C:\Windows\System\OyyNkTy.exe
  2⤵
  PID:10232
- C:\Windows\System\cVwjLUa.exe
  C:\Windows\System\cVwjLUa.exe
  2⤵
  PID:9252
- C:\Windows\System\gBzHbpL.exe
  C:\Windows\System\gBzHbpL.exe
  2⤵
  PID:9312
- C:\Windows\System\qlFlWpg.exe
  C:\Windows\System\qlFlWpg.exe
  2⤵
  PID:9372
- C:\Windows\System\DXusBVg.exe
  C:\Windows\System\DXusBVg.exe
  2⤵
  PID:9404
- C:\Windows\System\fwcCEjE.exe
  C:\Windows\System\fwcCEjE.exe
  2⤵
  PID:9484
- C:\Windows\System\lAQsVta.exe
  C:\Windows\System\lAQsVta.exe
  2⤵
  PID:9580
- C:\Windows\System\bhVafpf.exe
  C:\Windows\System\bhVafpf.exe
  2⤵
  PID:9624
- C:\Windows\System\QmxLWLT.exe
  C:\Windows\System\QmxLWLT.exe
  2⤵
  PID:9664
- C:\Windows\System\RnQtkUu.exe
  C:\Windows\System\RnQtkUu.exe
  2⤵
  PID:9732
- C:\Windows\System\AtVNVhH.exe
  C:\Windows\System\AtVNVhH.exe
  2⤵
  PID:9796
- C:\Windows\System\AMwonkD.exe
  C:\Windows\System\AMwonkD.exe
  2⤵
  PID:9856
- C:\Windows\System\BZlvBrE.exe
  C:\Windows\System\BZlvBrE.exe
  2⤵
  PID:9900
- C:\Windows\System\kafxYPk.exe
  C:\Windows\System\kafxYPk.exe
  2⤵
  PID:9944
- C:\Windows\System\ieqNMvL.exe
  C:\Windows\System\ieqNMvL.exe
  2⤵
  PID:10044
- C:\Windows\System\xGpzuko.exe
  C:\Windows\System\xGpzuko.exe
  2⤵
  PID:10148
- C:\Windows\System\cXglcFm.exe
  C:\Windows\System\cXglcFm.exe
  2⤵
  PID:10200
- C:\Windows\System\YOIWrqC.exe
  C:\Windows\System\YOIWrqC.exe
  2⤵
  PID:10228
- C:\Windows\System\heuiZqg.exe
  C:\Windows\System\heuiZqg.exe
  2⤵
  PID:9244
- C:\Windows\System\UmxhfUY.exe
  C:\Windows\System\UmxhfUY.exe
  2⤵
  PID:9464
- C:\Windows\System\fOEWGmQ.exe
  C:\Windows\System\fOEWGmQ.exe
  2⤵
  PID:9704
- C:\Windows\System\yXIjfNK.exe
  C:\Windows\System\yXIjfNK.exe
  2⤵
  PID:9840
- C:\Windows\System\SNJLLGi.exe
  C:\Windows\System\SNJLLGi.exe
  2⤵
  PID:9968
- C:\Windows\System\jjtWoid.exe
  C:\Windows\System\jjtWoid.exe
  2⤵
  PID:10144
- C:\Windows\System\FkmnnUe.exe
  C:\Windows\System\FkmnnUe.exe
  2⤵
  PID:9356
- C:\Windows\System\pWqSHEz.exe
  C:\Windows\System\pWqSHEz.exe
  2⤵
  PID:9748
- C:\Windows\System\elySpZw.exe
  C:\Windows\System\elySpZw.exe
  2⤵
  PID:10108
- C:\Windows\System\BGMewuP.exe
  C:\Windows\System\BGMewuP.exe
  2⤵
  PID:9348
- C:\Windows\System\vdkqYNj.exe
  C:\Windows\System\vdkqYNj.exe
  2⤵
  PID:9300
- C:\Windows\System\SOvjROc.exe
  C:\Windows\System\SOvjROc.exe
  2⤵
  PID:10248
- C:\Windows\System\tRQxpKv.exe
  C:\Windows\System\tRQxpKv.exe
  2⤵
  PID:10272
- C:\Windows\System\eZSEwcW.exe
  C:\Windows\System\eZSEwcW.exe
  2⤵
  PID:10296
- C:\Windows\System\TdenUkx.exe
  C:\Windows\System\TdenUkx.exe
  2⤵
  PID:10340
- C:\Windows\System\pOjsQhI.exe
  C:\Windows\System\pOjsQhI.exe
  2⤵
  PID:10368
- C:\Windows\System\CHnxCev.exe
  C:\Windows\System\CHnxCev.exe
  2⤵
  PID:10400
- C:\Windows\System\YgFhWxt.exe
  C:\Windows\System\YgFhWxt.exe
  2⤵
  PID:10420
- C:\Windows\System\XlnXVmD.exe
  C:\Windows\System\XlnXVmD.exe
  2⤵
  PID:10448
- C:\Windows\System\OryEiEz.exe
  C:\Windows\System\OryEiEz.exe
  2⤵
  PID:10472
- C:\Windows\System\XEOYdrp.exe
  C:\Windows\System\XEOYdrp.exe
  2⤵
  PID:10496
- C:\Windows\System\pqqoevq.exe
  C:\Windows\System\pqqoevq.exe
  2⤵
  PID:10524
- C:\Windows\System\UuDWjPL.exe
  C:\Windows\System\UuDWjPL.exe
  2⤵
  PID:10564
- C:\Windows\System\ZARTglr.exe
  C:\Windows\System\ZARTglr.exe
  2⤵
  PID:10620
- C:\Windows\System\TLIBvBD.exe
  C:\Windows\System\TLIBvBD.exe
  2⤵
  PID:10636
- C:\Windows\System\FVDtPyR.exe
  C:\Windows\System\FVDtPyR.exe
  2⤵
  PID:10652
- C:\Windows\System\YeiuBro.exe
  C:\Windows\System\YeiuBro.exe
  2⤵
  PID:10668
- C:\Windows\System\rTBCIyG.exe
  C:\Windows\System\rTBCIyG.exe
  2⤵
  PID:10696
- C:\Windows\System\iFplhZM.exe
  C:\Windows\System\iFplhZM.exe
  2⤵
  PID:10724
- C:\Windows\System\zzCVXHG.exe
  C:\Windows\System\zzCVXHG.exe
  2⤵
  PID:10760
- C:\Windows\System\kEjMXWo.exe
  C:\Windows\System\kEjMXWo.exe
  2⤵
  PID:10788
- C:\Windows\System\cCPuSou.exe
  C:\Windows\System\cCPuSou.exe
  2⤵
  PID:10812
- C:\Windows\System\HLuREIc.exe
  C:\Windows\System\HLuREIc.exe
  2⤵
  PID:10856
- C:\Windows\System\FcHvAOA.exe
  C:\Windows\System\FcHvAOA.exe
  2⤵
  PID:10872
- C:\Windows\System\QoZVrkb.exe
  C:\Windows\System\QoZVrkb.exe
  2⤵
  PID:10904
- C:\Windows\System\ohMfDkd.exe
  C:\Windows\System\ohMfDkd.exe
  2⤵
  PID:10936
- C:\Windows\System\iMOCFAu.exe
  C:\Windows\System\iMOCFAu.exe
  2⤵
  PID:10960
- C:\Windows\System\AvUssKZ.exe
  C:\Windows\System\AvUssKZ.exe
  2⤵
  PID:11000
- C:\Windows\System\KBkulFH.exe
  C:\Windows\System\KBkulFH.exe
  2⤵
  PID:11020
- C:\Windows\System\scMFRpq.exe
  C:\Windows\System\scMFRpq.exe
  2⤵
  PID:11044
- C:\Windows\System\CohaDlS.exe
  C:\Windows\System\CohaDlS.exe
  2⤵
  PID:11080
- C:\Windows\System\lhhKFzw.exe
  C:\Windows\System\lhhKFzw.exe
  2⤵
  PID:11100
- C:\Windows\System\ETcOphf.exe
  C:\Windows\System\ETcOphf.exe
  2⤵
  PID:11128
- C:\Windows\System\vwhHCzD.exe
  C:\Windows\System\vwhHCzD.exe
  2⤵
  PID:11152
- C:\Windows\System\RChzqsT.exe
  C:\Windows\System\RChzqsT.exe
  2⤵
  PID:11180
- C:\Windows\System\LupJCRU.exe
  C:\Windows\System\LupJCRU.exe
  2⤵
  PID:11220
- C:\Windows\System\hjOWwwq.exe
  C:\Windows\System\hjOWwwq.exe
  2⤵
  PID:11248
- C:\Windows\System\ZNzpKlW.exe
  C:\Windows\System\ZNzpKlW.exe
  2⤵
  PID:10280
- C:\Windows\System\pYQLNvR.exe
  C:\Windows\System\pYQLNvR.exe
  2⤵
  PID:10356
- C:\Windows\System\PMALkzb.exe
  C:\Windows\System\PMALkzb.exe
  2⤵
  PID:10412
- C:\Windows\System\wlJMSMy.exe
  C:\Windows\System\wlJMSMy.exe
  2⤵
  PID:10480
- C:\Windows\System\gliLFRv.exe
  C:\Windows\System\gliLFRv.exe
  2⤵
  PID:10516
- C:\Windows\System\GhzqsbK.exe
  C:\Windows\System\GhzqsbK.exe
  2⤵
  PID:10628
- C:\Windows\System\FpKVsfg.exe
  C:\Windows\System\FpKVsfg.exe
  2⤵
  PID:10660
- C:\Windows\System\pHZFcmM.exe
  C:\Windows\System\pHZFcmM.exe
  2⤵
  PID:10748
- C:\Windows\System\VDNtRLV.exe
  C:\Windows\System\VDNtRLV.exe
  2⤵
  PID:10836
- C:\Windows\System\lkQVDBj.exe
  C:\Windows\System\lkQVDBj.exe
  2⤵
  PID:10888
- C:\Windows\System\mTdEpJl.exe
  C:\Windows\System\mTdEpJl.exe
  2⤵
  PID:10924
- C:\Windows\System\NsjqxJO.exe
  C:\Windows\System\NsjqxJO.exe
  2⤵
  PID:10988
- C:\Windows\System\Seguyjr.exe
  C:\Windows\System\Seguyjr.exe
  2⤵
  PID:11068
- C:\Windows\System\MhtfcRM.exe
  C:\Windows\System\MhtfcRM.exe
  2⤵
  PID:11168
- C:\Windows\System\kGfBwgK.exe
  C:\Windows\System\kGfBwgK.exe
  2⤵
  PID:11208
- C:\Windows\System\AyvpYsS.exe
  C:\Windows\System\AyvpYsS.exe
  2⤵
  PID:10256
- C:\Windows\System\Nyuoovv.exe
  C:\Windows\System\Nyuoovv.exe
  2⤵
  PID:10392
- C:\Windows\System\JlxDhAN.exe
  C:\Windows\System\JlxDhAN.exe
  2⤵
  PID:10484
- C:\Windows\System\FWOxLrn.exe
  C:\Windows\System\FWOxLrn.exe
  2⤵
  PID:10708
- C:\Windows\System\NFPXviQ.exe
  C:\Windows\System\NFPXviQ.exe
  2⤵
  PID:10956
- C:\Windows\System\SFzmeMt.exe
  C:\Windows\System\SFzmeMt.exe
  2⤵
  PID:11036
- C:\Windows\System\RUgsICV.exe
  C:\Windows\System\RUgsICV.exe
  2⤵
  PID:11236
- C:\Windows\System\rgPczqo.exe
  C:\Windows\System\rgPczqo.exe
  2⤵
  PID:10288
- C:\Windows\System\OGQbQpf.exe
  C:\Windows\System\OGQbQpf.exe
  2⤵
  PID:10832
- C:\Windows\System\iyyTkYk.exe
  C:\Windows\System\iyyTkYk.exe
  2⤵
  PID:11016
- C:\Windows\System\SoHkleN.exe
  C:\Windows\System\SoHkleN.exe
  2⤵
  PID:11240
- C:\Windows\System\mCaKHvA.exe
  C:\Windows\System\mCaKHvA.exe
  2⤵
  PID:11276
- C:\Windows\System\EvhFffn.exe
  C:\Windows\System\EvhFffn.exe
  2⤵
  PID:11320
- C:\Windows\System\toHWjHY.exe
  C:\Windows\System\toHWjHY.exe
  2⤵
  PID:11348
- C:\Windows\System\yOUDaqU.exe
  C:\Windows\System\yOUDaqU.exe
  2⤵
  PID:11364
- C:\Windows\System\rVDHiiu.exe
  C:\Windows\System\rVDHiiu.exe
  2⤵
  PID:11388
- C:\Windows\System\ZjaglcF.exe
  C:\Windows\System\ZjaglcF.exe
  2⤵
  PID:11416
- C:\Windows\System\wfNhTsE.exe
  C:\Windows\System\wfNhTsE.exe
  2⤵
  PID:11448
- C:\Windows\System\aHNNxri.exe
  C:\Windows\System\aHNNxri.exe
  2⤵
  PID:11472
- C:\Windows\System\HSqdyPv.exe
  C:\Windows\System\HSqdyPv.exe
  2⤵
  PID:11492
- C:\Windows\System\MCELLBk.exe
  C:\Windows\System\MCELLBk.exe
  2⤵
  PID:11512
- C:\Windows\System\QfOzSzV.exe
  C:\Windows\System\QfOzSzV.exe
  2⤵
  PID:11540
- C:\Windows\System\XTjSkDZ.exe
  C:\Windows\System\XTjSkDZ.exe
  2⤵
  PID:11560
- C:\Windows\System\VGmiPXG.exe
  C:\Windows\System\VGmiPXG.exe
  2⤵
  PID:11616
- C:\Windows\System\TOVuEnC.exe
  C:\Windows\System\TOVuEnC.exe
  2⤵
  PID:11640
- C:\Windows\System\pyfnqwN.exe
  C:\Windows\System\pyfnqwN.exe
  2⤵
  PID:11672
- C:\Windows\System\NpZngVr.exe
  C:\Windows\System\NpZngVr.exe
  2⤵
  PID:11692
- C:\Windows\System\vWkthdd.exe
  C:\Windows\System\vWkthdd.exe
  2⤵
  PID:11720
- C:\Windows\System\YqcLkOe.exe
  C:\Windows\System\YqcLkOe.exe
  2⤵
  PID:11768
- C:\Windows\System\xFpXnMC.exe
  C:\Windows\System\xFpXnMC.exe
  2⤵
  PID:11796
- C:\Windows\System\QvEgHvj.exe
  C:\Windows\System\QvEgHvj.exe
  2⤵
  PID:11812
- C:\Windows\System\bNgEfrG.exe
  C:\Windows\System\bNgEfrG.exe
  2⤵
  PID:11840
- C:\Windows\System\QoWUHsC.exe
  C:\Windows\System\QoWUHsC.exe
  2⤵
  PID:11880
- C:\Windows\System\MSATbOr.exe
  C:\Windows\System\MSATbOr.exe
  2⤵
  PID:11908
- C:\Windows\System\WTJOMwn.exe
  C:\Windows\System\WTJOMwn.exe
  2⤵
  PID:11928
- C:\Windows\System\bkylCBS.exe
  C:\Windows\System\bkylCBS.exe
  2⤵
  PID:11956
- C:\Windows\System\fRAuFTe.exe
  C:\Windows\System\fRAuFTe.exe
  2⤵
  PID:11984
- C:\Windows\System\SWqAFDn.exe
  C:\Windows\System\SWqAFDn.exe
  2⤵
  PID:12008
- C:\Windows\System\cDwyFKN.exe
  C:\Windows\System\cDwyFKN.exe
  2⤵
  PID:12024
- C:\Windows\System\zVlBdTx.exe
  C:\Windows\System\zVlBdTx.exe
  2⤵
  PID:12052
- C:\Windows\System\xGYwEWX.exe
  C:\Windows\System\xGYwEWX.exe
  2⤵
  PID:12092
- C:\Windows\System\iCVXXoq.exe
  C:\Windows\System\iCVXXoq.exe
  2⤵
  PID:12140
- C:\Windows\System\IrsmKKy.exe
  C:\Windows\System\IrsmKKy.exe
  2⤵
  PID:12156
- C:\Windows\System\lBwqFKn.exe
  C:\Windows\System\lBwqFKn.exe
  2⤵
  PID:12196
- C:\Windows\System\PKwLDLS.exe
  C:\Windows\System\PKwLDLS.exe
  2⤵
  PID:12224
- C:\Windows\System\hbMWgvs.exe
  C:\Windows\System\hbMWgvs.exe
  2⤵
  PID:12256
- C:\Windows\System\nqOKpMa.exe
  C:\Windows\System\nqOKpMa.exe
  2⤵
  PID:12272
- C:\Windows\System\wcDORSq.exe
  C:\Windows\System\wcDORSq.exe
  2⤵
  PID:11032
- C:\Windows\System\fqefGmj.exe
  C:\Windows\System\fqefGmj.exe
  2⤵
  PID:11304
- C:\Windows\System\nuoAIdq.exe
  C:\Windows\System\nuoAIdq.exe
  2⤵
  PID:11356
- C:\Windows\System\JSGnVlV.exe
  C:\Windows\System\JSGnVlV.exe
  2⤵
  PID:11428
- C:\Windows\System\TaLVfBk.exe
  C:\Windows\System\TaLVfBk.exe
  2⤵
  PID:11508
- C:\Windows\System\GtTJGew.exe
  C:\Windows\System\GtTJGew.exe
  2⤵
  PID:11596
- C:\Windows\System\UFQkQIc.exe
  C:\Windows\System\UFQkQIc.exe
  2⤵
  PID:11636
- C:\Windows\System\pkvzLYy.exe
  C:\Windows\System\pkvzLYy.exe
  2⤵
  PID:11748
- C:\Windows\System\NRpnctw.exe
  C:\Windows\System\NRpnctw.exe
  2⤵
  PID:11780
- C:\Windows\System\qbNmLrC.exe
  C:\Windows\System\qbNmLrC.exe
  2⤵
  PID:11828
- C:\Windows\System\KscWKgV.exe
  C:\Windows\System\KscWKgV.exe
  2⤵
  PID:11892
- C:\Windows\System\tuHKyZG.exe
  C:\Windows\System\tuHKyZG.exe
  2⤵
  PID:11916
- C:\Windows\System\zuaPkaN.exe
  C:\Windows\System\zuaPkaN.exe
  2⤵
  PID:12044
- C:\Windows\System\PAEmklh.exe
  C:\Windows\System\PAEmklh.exe
  2⤵
  PID:12088
- C:\Windows\System\DYFKKes.exe
  C:\Windows\System\DYFKKes.exe
  2⤵
  PID:12152
- C:\Windows\System\nVxHLKG.exe
  C:\Windows\System\nVxHLKG.exe
  2⤵
  PID:12208
- C:\Windows\System\BOedNwN.exe
  C:\Windows\System\BOedNwN.exe
  2⤵
  PID:12284
- C:\Windows\System\HrLBklF.exe
  C:\Windows\System\HrLBklF.exe
  2⤵
  PID:11336
- C:\Windows\System\PCtAFOd.exe
  C:\Windows\System\PCtAFOd.exe
  2⤵
  PID:11576
- C:\Windows\System\UznkOKp.exe
  C:\Windows\System\UznkOKp.exe
  2⤵
  PID:11680
- C:\Windows\System\BJvdAnN.exe
  C:\Windows\System\BJvdAnN.exe
  2⤵
  PID:11900
- C:\Windows\System\EYwySwY.exe
  C:\Windows\System\EYwySwY.exe
  2⤵
  PID:11972
- C:\Windows\System\mBzFzwj.exe
  C:\Windows\System\mBzFzwj.exe
  2⤵
  PID:12128
- C:\Windows\System\yUZfgZd.exe
  C:\Windows\System\yUZfgZd.exe
  2⤵
  PID:12244
- C:\Windows\System\hqCQEhY.exe
  C:\Windows\System\hqCQEhY.exe
  2⤵
  PID:11484
- C:\Windows\System\yKayJnW.exe
  C:\Windows\System\yKayJnW.exe
  2⤵
  PID:11940
- C:\Windows\System\QrBigCC.exe
  C:\Windows\System\QrBigCC.exe
  2⤵
  PID:11520
- C:\Windows\System\SvkSago.exe
  C:\Windows\System\SvkSago.exe
  2⤵
  PID:12148
- C:\Windows\System\CMJWoNc.exe
  C:\Windows\System\CMJWoNc.exe
  2⤵
  PID:12312
- C:\Windows\System\Giwppfu.exe
  C:\Windows\System\Giwppfu.exe
  2⤵
  PID:12352
- C:\Windows\System\DQGSZRz.exe
  C:\Windows\System\DQGSZRz.exe
  2⤵
  PID:12380
- C:\Windows\System\lUuiTOy.exe
  C:\Windows\System\lUuiTOy.exe
  2⤵
  PID:12408
- C:\Windows\System\piygzKv.exe
  C:\Windows\System\piygzKv.exe
  2⤵
  PID:12424
- C:\Windows\System\TMbpPgc.exe
  C:\Windows\System\TMbpPgc.exe
  2⤵
  PID:12464
- C:\Windows\System\ZIpDQdR.exe
  C:\Windows\System\ZIpDQdR.exe
  2⤵
  PID:12492
- C:\Windows\System\BnTptHj.exe
  C:\Windows\System\BnTptHj.exe
  2⤵
  PID:12520
- C:\Windows\System\VzvIjuv.exe
  C:\Windows\System\VzvIjuv.exe
  2⤵
  PID:12548
- C:\Windows\System\vsKFxqw.exe
  C:\Windows\System\vsKFxqw.exe
  2⤵
  PID:12564
- C:\Windows\System\yieiPtF.exe
  C:\Windows\System\yieiPtF.exe
  2⤵
  PID:12604
- C:\Windows\System\ANnhOeh.exe
  C:\Windows\System\ANnhOeh.exe
  2⤵
  PID:12628
- C:\Windows\System\bPZvLhb.exe
  C:\Windows\System\bPZvLhb.exe
  2⤵
  PID:12648
- C:\Windows\System\lWzBRgT.exe
  C:\Windows\System\lWzBRgT.exe
  2⤵
  PID:12676
- C:\Windows\System\OsTqIlD.exe
  C:\Windows\System\OsTqIlD.exe
  2⤵
  PID:12704
- C:\Windows\System\vuKhVqM.exe
  C:\Windows\System\vuKhVqM.exe
  2⤵
  PID:12732
- C:\Windows\System\AWtIZFa.exe
  C:\Windows\System\AWtIZFa.exe
  2⤵
  PID:12760
- C:\Windows\System\cSjKzkx.exe
  C:\Windows\System\cSjKzkx.exe
  2⤵
  PID:12800
- C:\Windows\System\SIGDzCQ.exe
  C:\Windows\System\SIGDzCQ.exe
  2⤵
  PID:12828
- C:\Windows\System\ApOhrLn.exe
  C:\Windows\System\ApOhrLn.exe
  2⤵
  PID:12844
- C:\Windows\System\NwhdRiT.exe
  C:\Windows\System\NwhdRiT.exe
  2⤵
  PID:12872
- C:\Windows\System\qvRcYGC.exe
  C:\Windows\System\qvRcYGC.exe
  2⤵
  PID:12912
- C:\Windows\System\UyyqgrF.exe
  C:\Windows\System\UyyqgrF.exe
  2⤵
  PID:12940
- C:\Windows\System\NqkzKlX.exe
  C:\Windows\System\NqkzKlX.exe
  2⤵
  PID:12968
- C:\Windows\System\pxxiiRn.exe
  C:\Windows\System\pxxiiRn.exe
  2⤵
  PID:12992
- C:\Windows\System\HzaCiJk.exe
  C:\Windows\System\HzaCiJk.exe
  2⤵
  PID:13016
- C:\Windows\System\HagEpzk.exe
  C:\Windows\System\HagEpzk.exe
  2⤵
  PID:13040
- C:\Windows\System\jvYrAeA.exe
  C:\Windows\System\jvYrAeA.exe
  2⤵
  PID:13080
- C:\Windows\System\AHbgGTh.exe
  C:\Windows\System\AHbgGTh.exe
  2⤵
  PID:13096
- C:\Windows\System\qCtpQMB.exe
  C:\Windows\System\qCtpQMB.exe
  2⤵
  PID:13124
- C:\Windows\System\YhtjVhh.exe
  C:\Windows\System\YhtjVhh.exe
  2⤵
  PID:13168
- C:\Windows\System\tUXmOQo.exe
  C:\Windows\System\tUXmOQo.exe
  2⤵
  PID:13184
- C:\Windows\System\RxKGmqI.exe
  C:\Windows\System\RxKGmqI.exe
  2⤵
  PID:13208
- C:\Windows\System\wRiHsZe.exe
  C:\Windows\System\wRiHsZe.exe
  2⤵
  PID:13236
- C:\Windows\System\XUUJTzY.exe
  C:\Windows\System\XUUJTzY.exe
  2⤵
  PID:13280
- C:\Windows\System\yapvkDi.exe
  C:\Windows\System\yapvkDi.exe
  2⤵
  PID:13308
- C:\Windows\System\LfTgYRk.exe
  C:\Windows\System\LfTgYRk.exe
  2⤵
  PID:11528
- C:\Windows\System\MJLXspf.exe
  C:\Windows\System\MJLXspf.exe
  2⤵
  PID:12300
- C:\Windows\System\KsbRWMz.exe
  C:\Windows\System\KsbRWMz.exe
  2⤵
  PID:12364
- C:\Windows\System\gOMfCIA.exe
  C:\Windows\System\gOMfCIA.exe
  2⤵
  PID:12508
- C:\Windows\System\jSajehr.exe
  C:\Windows\System\jSajehr.exe
  2⤵
  PID:12536
- C:\Windows\System\lByIhXP.exe
  C:\Windows\System\lByIhXP.exe
  2⤵
  PID:12620
- C:\Windows\System\eXaQcDH.exe
  C:\Windows\System\eXaQcDH.exe
  2⤵
  PID:12664
- C:\Windows\System\YDSpFkW.exe
  C:\Windows\System\YDSpFkW.exe
  2⤵
  PID:12744
- C:\Windows\System\demWMFh.exe
  C:\Windows\System\demWMFh.exe
  2⤵
  PID:12756
- C:\Windows\System\NiBzrYD.exe
  C:\Windows\System\NiBzrYD.exe
  2⤵
  PID:12816
- C:\Windows\System\DdpZVBt.exe
  C:\Windows\System\DdpZVBt.exe
  2⤵
  PID:12928
- C:\Windows\System\AqaFmCD.exe
  C:\Windows\System\AqaFmCD.exe
  2⤵
  PID:12112
- C:\Windows\System\kbbOwgw.exe
  C:\Windows\System\kbbOwgw.exe
  2⤵
  PID:13032
- C:\Windows\System\KcCoSoH.exe
  C:\Windows\System\KcCoSoH.exe
  2⤵
  PID:13136
- C:\Windows\System\chVKuXX.exe
  C:\Windows\System\chVKuXX.exe
  2⤵
  PID:13200
- C:\Windows\System\jlsZVBH.exe
  C:\Windows\System\jlsZVBH.exe
  2⤵
  PID:13264
- C:\Windows\System\PzAHuuf.exe
  C:\Windows\System\PzAHuuf.exe
  2⤵
  PID:13296
- C:\Windows\System\NfeMaVy.exe
  C:\Windows\System\NfeMaVy.exe
  2⤵
  PID:12392
- C:\Windows\System\LDHmlFW.exe
  C:\Windows\System\LDHmlFW.exe
  2⤵
  PID:12532
- C:\Windows\System\RnmkMJz.exe
  C:\Windows\System\RnmkMJz.exe
  2⤵
  PID:12796
- C:\Windows\System\guwZKPY.exe
  C:\Windows\System\guwZKPY.exe
  2⤵
  PID:12964
- C:\Windows\System\BhruBRp.exe
  C:\Windows\System\BhruBRp.exe
  2⤵
  PID:13112
- C:\Windows\System\QAMDdgb.exe
  C:\Windows\System\QAMDdgb.exe
  2⤵
  PID:13196
- C:\Windows\System\wMMTSWA.exe
  C:\Windows\System\wMMTSWA.exe
  2⤵
  PID:12348
- C:\Windows\System\AAMVYeI.exe
  C:\Windows\System\AAMVYeI.exe
  2⤵
  PID:12644
- C:\Windows\System\GVIhjhD.exe
  C:\Windows\System\GVIhjhD.exe
  2⤵
  PID:13012
- C:\Windows\System\XQxWvrc.exe
  C:\Windows\System\XQxWvrc.exe
  2⤵
  PID:13292
- C:\Windows\System\hbuwlKy.exe
  C:\Windows\System\hbuwlKy.exe
  2⤵
  PID:13316
- C:\Windows\System\WgbmVPC.exe
  C:\Windows\System\WgbmVPC.exe
  2⤵
  PID:13332
- C:\Windows\System\BOJUmFi.exe
  C:\Windows\System\BOJUmFi.exe
  2⤵
  PID:13368
- C:\Windows\System\AzukRcL.exe
  C:\Windows\System\AzukRcL.exe
  2⤵
  PID:13388
- C:\Windows\System\YamfbIH.exe
  C:\Windows\System\YamfbIH.exe
  2⤵
  PID:13416
- C:\Windows\System\kLnnXYH.exe
  C:\Windows\System\kLnnXYH.exe
  2⤵
  PID:13444
- C:\Windows\System\HMDddFY.exe
  C:\Windows\System\HMDddFY.exe
  2⤵
  PID:13484
- C:\Windows\System\SebHJVV.exe
  C:\Windows\System\SebHJVV.exe
  2⤵
  PID:13524
- C:\Windows\System\MQFUvBL.exe
  C:\Windows\System\MQFUvBL.exe
  2⤵
  PID:13540
- C:\Windows\System\hfsohNJ.exe
  C:\Windows\System\hfsohNJ.exe
  2⤵
  PID:13556
- C:\Windows\System\mqvpBVM.exe
  C:\Windows\System\mqvpBVM.exe
  2⤵
  PID:13580
- C:\Windows\System\eTqwWRc.exe
  C:\Windows\System\eTqwWRc.exe
  2⤵
  PID:13600
- C:\Windows\System\KogqkDu.exe
  C:\Windows\System\KogqkDu.exe
  2⤵
  PID:13640
- C:\Windows\System\WMxcKLM.exe
  C:\Windows\System\WMxcKLM.exe
  2⤵
  PID:13660
- C:\Windows\System\ijGMoFv.exe
  C:\Windows\System\ijGMoFv.exe
  2⤵
  PID:13688
- C:\Windows\System\NktFFEV.exe
  C:\Windows\System\NktFFEV.exe
  2⤵
  PID:13712
- C:\Windows\System\IFgPgbc.exe
  C:\Windows\System\IFgPgbc.exe
  2⤵
  PID:13764
- C:\Windows\System\chreWBq.exe
  C:\Windows\System\chreWBq.exe
  2⤵
  PID:13780
- C:\Windows\System\OedLZwA.exe
  C:\Windows\System\OedLZwA.exe
  2⤵
  PID:13800
- C:\Windows\System\ijjzgFI.exe
  C:\Windows\System\ijjzgFI.exe
  2⤵
  PID:13844
- C:\Windows\System\FDmovZH.exe
  C:\Windows\System\FDmovZH.exe
  2⤵
  PID:13864
- C:\Windows\System\zbsnDjf.exe
  C:\Windows\System\zbsnDjf.exe
  2⤵
  PID:13884
- C:\Windows\System\fURzSKQ.exe
  C:\Windows\System\fURzSKQ.exe
  2⤵
  PID:13912
- C:\Windows\System\OMDynzu.exe
  C:\Windows\System\OMDynzu.exe
  2⤵
  PID:13928
- C:\Windows\System\WUffoHO.exe
  C:\Windows\System\WUffoHO.exe
  2⤵
  PID:13984
- C:\Windows\System\ZikAzih.exe
  C:\Windows\System\ZikAzih.exe
  2⤵
  PID:14008
- C:\Windows\System\EFDrrRu.exe
  C:\Windows\System\EFDrrRu.exe
  2⤵
  PID:14028
- C:\Windows\System\vgekhbH.exe
  C:\Windows\System\vgekhbH.exe
  2⤵
  PID:14056
- C:\Windows\System\jrGSmJU.exe
  C:\Windows\System\jrGSmJU.exe
  2⤵
  PID:14084
- C:\Windows\System\xVAgaaF.exe
  C:\Windows\System\xVAgaaF.exe
  2⤵
  PID:14108
- C:\Windows\System\rtVSRyR.exe
  C:\Windows\System\rtVSRyR.exe
  2⤵
  PID:14152
- C:\Windows\System\oBqciSt.exe
  C:\Windows\System\oBqciSt.exe
  2⤵
  PID:14176
- C:\Windows\System\mAbBLyt.exe
  C:\Windows\System\mAbBLyt.exe
  2⤵
  PID:14196
- C:\Windows\System\ovUeEzH.exe
  C:\Windows\System\ovUeEzH.exe
  2⤵
  PID:14240
- C:\Windows\System\GtuYFhu.exe
  C:\Windows\System\GtuYFhu.exe
  2⤵
  PID:14264
- C:\Windows\System\sIcYAMO.exe
  C:\Windows\System\sIcYAMO.exe
  2⤵
  PID:14284
- C:\Windows\System\qyyZZIW.exe
  C:\Windows\System\qyyZZIW.exe
  2⤵
  PID:14332
- C:\Windows\System\CuOzhLz.exe
  C:\Windows\System\CuOzhLz.exe
  2⤵
  PID:13360
- C:\Windows\System\ganTnkQ.exe
  C:\Windows\System\ganTnkQ.exe
  2⤵
  PID:13384
- C:\Windows\System\CLxwalc.exe
  C:\Windows\System\CLxwalc.exe
  2⤵
  PID:13480
- C:\Windows\System\GNyycgA.exe
  C:\Windows\System\GNyycgA.exe
  2⤵
  PID:13504
- C:\Windows\System\VWRUzws.exe
  C:\Windows\System\VWRUzws.exe
  2⤵
  PID:13548
- C:\Windows\System\qVkMjKJ.exe
  C:\Windows\System\qVkMjKJ.exe
  2⤵
  PID:13668
- C:\Windows\System\QQQgRzQ.exe
  C:\Windows\System\QQQgRzQ.exe
  2⤵
  PID:13708
- C:\Windows\System\hqiQaeb.exe
  C:\Windows\System\hqiQaeb.exe
  2⤵
  PID:13808
- C:\Windows\System\TMJqqPa.exe
  C:\Windows\System\TMJqqPa.exe
  2⤵
  PID:13860
- C:\Windows\System\wLhgYVd.exe
  C:\Windows\System\wLhgYVd.exe
  2⤵
  PID:13920
- C:\Windows\System\uSIuwrp.exe
  C:\Windows\System\uSIuwrp.exe
  2⤵
  PID:14000
- C:\Windows\System\WAeBYYh.exe
  C:\Windows\System\WAeBYYh.exe
  2⤵
  PID:14052
- C:\Windows\System\bbgsGTI.exe
  C:\Windows\System\bbgsGTI.exe
  2⤵
  PID:14068
- C:\Windows\System\rZXLTdm.exe
  C:\Windows\System\rZXLTdm.exe
  2⤵
  PID:14136
- C:\Windows\System\fVWeAEd.exe
  C:\Windows\System\fVWeAEd.exe
  2⤵
  PID:14272
- C:\Windows\System\RKMBSzF.exe
  C:\Windows\System\RKMBSzF.exe
  2⤵
  PID:14324
- C:\Windows\System\WFweJKO.exe
  C:\Windows\System\WFweJKO.exe
  2⤵
  PID:13496
- C:\Windows\System\KmebxvC.exe
  C:\Windows\System\KmebxvC.exe
  2⤵
  PID:13568
- C:\Windows\System\rgLVtWk.exe
  C:\Windows\System\rgLVtWk.exe
  2⤵
  PID:13796
- C:\Windows\System\OpaMTxW.exe
  C:\Windows\System\OpaMTxW.exe
  2⤵
  PID:13856
- C:\Windows\System\aGNARcK.exe
  C:\Windows\System\aGNARcK.exe
  2⤵
  PID:13964
- C:\Windows\System\nZkQblx.exe
  C:\Windows\System\nZkQblx.exe
  2⤵
  PID:14172
- C:\Windows\System\mdsZxBw.exe
  C:\Windows\System\mdsZxBw.exe
  2⤵
  PID:13376
- C:\Windows\System\ihRRESo.exe
  C:\Windows\System\ihRRESo.exe
  2⤵
  PID:13520
- C:\Windows\System\LXgIgjc.exe
  C:\Windows\System\LXgIgjc.exe
  2⤵
  PID:13992
- C:\Windows\System\kHSwrIf.exe
  C:\Windows\System\kHSwrIf.exe
  2⤵
  PID:14236
- C:\Windows\System\LSMUZSe.exe
  C:\Windows\System\LSMUZSe.exe
  2⤵
  PID:13772
- C:\Windows\System\nfHtocZ.exe
  C:\Windows\System\nfHtocZ.exe
  2⤵
  PID:14040
- C:\Windows\System\QMdFgtj.exe
  C:\Windows\System\QMdFgtj.exe
  2⤵
  PID:14352
- C:\Windows\System\eOtzemW.exe
  C:\Windows\System\eOtzemW.exe
  2⤵
  PID:14408
- C:\Windows\System\JoCveDG.exe
  C:\Windows\System\JoCveDG.exe
  2⤵
  PID:14436
- C:\Windows\System\JCAaych.exe
  C:\Windows\System\JCAaych.exe
  2⤵
  PID:14456
- C:\Windows\System\BMPIiao.exe
  C:\Windows\System\BMPIiao.exe
  2⤵
  PID:14484
- C:\Windows\System\zqkxRnD.exe
  C:\Windows\System\zqkxRnD.exe
  2⤵
  PID:14508
- C:\Windows\System\xFrJVge.exe
  C:\Windows\System\xFrJVge.exe
  2⤵
  PID:14536
- C:\Windows\System\StPPlbA.exe
  C:\Windows\System\StPPlbA.exe
  2⤵
  PID:14564
- C:\Windows\System\xKhTtZN.exe
  C:\Windows\System\xKhTtZN.exe
  2⤵
  PID:14592
- C:\Windows\System\jRqWJAZ.exe
  C:\Windows\System\jRqWJAZ.exe
  2⤵
  PID:14620
- C:\Windows\System\lnmtBho.exe
  C:\Windows\System\lnmtBho.exe
  2⤵
  PID:14648
- C:\Windows\System\lYUssCW.exe
  C:\Windows\System\lYUssCW.exe
  2⤵
  PID:14664
- C:\Windows\System\yCLowqZ.exe
  C:\Windows\System\yCLowqZ.exe
  2⤵
  PID:14692
- C:\Windows\System\roAHcvV.exe
  C:\Windows\System\roAHcvV.exe
  2⤵
  PID:14712
- C:\Windows\System\UYJXZOP.exe
  C:\Windows\System\UYJXZOP.exe
  2⤵
  PID:14748
- C:\Windows\System\zzdYEhS.exe
  C:\Windows\System\zzdYEhS.exe
  2⤵
  PID:14776
- C:\Windows\System\XegsMWn.exe
  C:\Windows\System\XegsMWn.exe
  2⤵
  PID:14796
- C:\Windows\System\NHtluvS.exe
  C:\Windows\System\NHtluvS.exe
  2⤵
  PID:14824
- C:\Windows\System\hooqXUC.exe
  C:\Windows\System\hooqXUC.exe
  2⤵
  PID:14872
- C:\Windows\System\LvrMGKj.exe
  C:\Windows\System\LvrMGKj.exe
  2⤵
  PID:14892
- C:\Windows\System\ffFLkzE.exe
  C:\Windows\System\ffFLkzE.exe
  2⤵
  PID:14916
- C:\Windows\System\QQcOtFI.exe
  C:\Windows\System\QQcOtFI.exe
  2⤵
  PID:14940
- C:\Windows\System\JRywuRY.exe
  C:\Windows\System\JRywuRY.exe
  2⤵
  PID:14980
- C:\Windows\System\WIyHQNv.exe
  C:\Windows\System\WIyHQNv.exe
  2⤵
  PID:15000
- C:\Windows\System\lBjZEjW.exe
  C:\Windows\System\lBjZEjW.exe
  2⤵
  PID:15028
- C:\Windows\System\yAxWaol.exe
  C:\Windows\System\yAxWaol.exe
  2⤵
  PID:15080
- C:\Windows\System\WpwcTpM.exe
  C:\Windows\System\WpwcTpM.exe
  2⤵
  PID:15108
- C:\Windows\System\ZYCrEGb.exe
  C:\Windows\System\ZYCrEGb.exe
  2⤵
  PID:15124
- C:\Windows\System\joHqFoJ.exe
  C:\Windows\System\joHqFoJ.exe
  2⤵
  PID:15144
- C:\Windows\System\oSVaTdf.exe
  C:\Windows\System\oSVaTdf.exe
  2⤵
  PID:15172
- C:\Windows\System\VxCzOIt.exe
  C:\Windows\System\VxCzOIt.exe
  2⤵
  PID:15204
- C:\Windows\System\dXKYVBz.exe
  C:\Windows\System\dXKYVBz.exe
  2⤵
  PID:15228
- C:\Windows\System\KbPJjcU.exe
  C:\Windows\System\KbPJjcU.exe
  2⤵
  PID:15252
- C:\Windows\System\FdMygHe.exe
  C:\Windows\System\FdMygHe.exe
  2⤵
  PID:15280
- C:\Windows\System\sfweFGB.exe
  C:\Windows\System\sfweFGB.exe
  2⤵
  PID:15308
- C:\Windows\System\AgRwdEu.exe
  C:\Windows\System\AgRwdEu.exe
  2⤵
  PID:15340
- C:\Windows\System\jmCVCEK.exe
  C:\Windows\System\jmCVCEK.exe
  2⤵
  PID:14380
- C:\Windows\System\TZUrIEM.exe
  C:\Windows\System\TZUrIEM.exe
  2⤵
  PID:14452
- C:\Windows\System\HyoUeFQ.exe
  C:\Windows\System\HyoUeFQ.exe
  2⤵
  PID:14500
- C:\Windows\System\HfxVvtf.exe
  C:\Windows\System\HfxVvtf.exe
  2⤵
  PID:14588
- C:\Windows\System\zvMJtRv.exe
  C:\Windows\System\zvMJtRv.exe
  2⤵
  PID:14632
- C:\Windows\System\HGMqwHo.exe
  C:\Windows\System\HGMqwHo.exe
  2⤵
  PID:14732
- C:\Windows\System\NzObLPw.exe
  C:\Windows\System\NzObLPw.exe
  2⤵
  PID:14812
- C:\Windows\System\HPJlGro.exe
  C:\Windows\System\HPJlGro.exe
  2⤵
  PID:14928
- C:\Windows\System\dXftQcL.exe
  C:\Windows\System\dXftQcL.exe
  2⤵
  PID:14936
- C:\Windows\System\uuWwDXi.exe
  C:\Windows\System\uuWwDXi.exe
  2⤵
  PID:15056
- C:\Windows\System\eZRgBdB.exe
  C:\Windows\System\eZRgBdB.exe
  2⤵
  PID:15076
- C:\Windows\System\XmBQqyy.exe
  C:\Windows\System\XmBQqyy.exe
  2⤵
  PID:15152
- C:\Windows\System\StSWQSr.exe
  C:\Windows\System\StSWQSr.exe
  2⤵
  PID:15236
- C:\Windows\System\ECWMkSF.exe
  C:\Windows\System\ECWMkSF.exe
  2⤵
  PID:15276
- C:\Windows\System\yAMVrSk.exe
  C:\Windows\System\yAMVrSk.exe
  2⤵
  PID:15332
- C:\Windows\System\okzaqYD.exe
  C:\Windows\System\okzaqYD.exe
  2⤵
  PID:14528
- C:\Windows\System\OzuOntl.exe
  C:\Windows\System\OzuOntl.exe
  2⤵
  PID:14640
- C:\Windows\System\iThCwVz.exe
  C:\Windows\System\iThCwVz.exe
  2⤵
  PID:14884
- C:\Windows\System\wnwdPti.exe
  C:\Windows\System\wnwdPti.exe
  2⤵
  PID:15012
- C:\Windows\System\WDJAIOc.exe
  C:\Windows\System\WDJAIOc.exe
  2⤵
  PID:15304
- C:\Windows\System\DwmHViW.exe
  C:\Windows\System\DwmHViW.exe
  2⤵
  PID:15328
- C:\Windows\System\tLwncnq.exe
  C:\Windows\System\tLwncnq.exe
  2⤵
  PID:14420
- C:\Windows\System\vNoeduM.exe
  C:\Windows\System\vNoeduM.exe
  2⤵
  PID:14964
- C:\Windows\System\SOtVREb.exe
  C:\Windows\System\SOtVREb.exe
  2⤵
  PID:15168
- C:\Windows\System\IeCFitg.exe
  C:\Windows\System\IeCFitg.exe
  2⤵
  PID:15264
- C:\Windows\System\CQpmoXc.exe
  C:\Windows\System\CQpmoXc.exe
  2⤵
  PID:15380
- C:\Windows\System\cBdcvUc.exe
  C:\Windows\System\cBdcvUc.exe
  2⤵
  PID:15404
- C:\Windows\System\sVIqRQn.exe
  C:\Windows\System\sVIqRQn.exe
  2⤵
  PID:15432
- C:\Windows\System\xyckvFZ.exe
  C:\Windows\System\xyckvFZ.exe
  2⤵
  PID:15472
- C:\Windows\System\HLOldqW.exe
  C:\Windows\System\HLOldqW.exe
  2⤵
  PID:15504
- C:\Windows\System\YkWttrj.exe
  C:\Windows\System\YkWttrj.exe
  2⤵
  PID:15524
- C:\Windows\System\rZFLgnf.exe
  C:\Windows\System\rZFLgnf.exe
  2⤵
  PID:15552
- C:\Windows\System\CXcCgxN.exe
  C:\Windows\System\CXcCgxN.exe
  2⤵
  PID:15584
- C:\Windows\System\OXMIeZM.exe
  C:\Windows\System\OXMIeZM.exe
  2⤵
  PID:15604
- C:\Windows\System\coiEsNv.exe
  C:\Windows\System\coiEsNv.exe
  2⤵
  PID:15624
- C:\Windows\System\KgmuRhw.exe
  C:\Windows\System\KgmuRhw.exe
  2⤵
  PID:15644
- C:\Windows\System\JbiyZOD.exe
  C:\Windows\System\JbiyZOD.exe
  2⤵
  PID:15700
- C:\Windows\System\VdahMhN.exe
  C:\Windows\System\VdahMhN.exe
  2⤵
  PID:15728
- C:\Windows\System\YyHzmdH.exe
  C:\Windows\System\YyHzmdH.exe
  2⤵
  PID:15768
- C:\Windows\System\FJqUoFz.exe
  C:\Windows\System\FJqUoFz.exe
  2⤵
  PID:15796
- C:\Windows\System\wRIhSBy.exe
  C:\Windows\System\wRIhSBy.exe
  2⤵
  PID:15824
- C:\Windows\System\qbadZSV.exe
  C:\Windows\System\qbadZSV.exe
  2⤵
  PID:15840
- C:\Windows\System\BpwCgTN.exe
  C:\Windows\System\BpwCgTN.exe
  2⤵
  PID:15868
- C:\Windows\System\SkHZtzi.exe
  C:\Windows\System\SkHZtzi.exe
  2⤵
  PID:15884
- C:\Windows\System\hBGaXfn.exe
  C:\Windows\System\hBGaXfn.exe
  2⤵
  PID:15912
- C:\Windows\System\dReJqdJ.exe
  C:\Windows\System\dReJqdJ.exe
  2⤵
  PID:15956
- C:\Windows\System\DYxFuEv.exe
  C:\Windows\System\DYxFuEv.exe
  2⤵
  PID:15980
- C:\Windows\System\SOvmLGj.exe
  C:\Windows\System\SOvmLGj.exe
  2⤵
  PID:15996
- C:\Windows\System\bsoUARZ.exe
  C:\Windows\System\bsoUARZ.exe
  2⤵
  PID:16016
- C:\Windows\System\rbEoiey.exe
  C:\Windows\System\rbEoiey.exe
  2⤵
  PID:16036
- C:\Windows\System\BMLoAaC.exe
  C:\Windows\System\BMLoAaC.exe
  2⤵
  PID:16076
- C:\Windows\System\KzuPNUu.exe
  C:\Windows\System\KzuPNUu.exe
  2⤵
  PID:16096
- C:\Windows\System\kLeRLll.exe
  C:\Windows\System\kLeRLll.exe
  2⤵
  PID:16140
- C:\Windows\System\ZkhmdSA.exe
  C:\Windows\System\ZkhmdSA.exe
  2⤵
  PID:16176
- C:\Windows\System\hUHTSmn.exe
  C:\Windows\System\hUHTSmn.exe
  2⤵
  PID:16200
- C:\Windows\System\XOVhAOX.exe
  C:\Windows\System\XOVhAOX.exe
  2⤵
  PID:16224
- C:\Windows\System\nUAJjIJ.exe
  C:\Windows\System\nUAJjIJ.exe
  2⤵
  PID:16244
- C:\Windows\System\PZGfSNQ.exe
  C:\Windows\System\PZGfSNQ.exe
  2⤵
  PID:16272
- C:\Windows\System\quoDVau.exe
  C:\Windows\System\quoDVau.exe
  2⤵
  PID:16320
- C:\Windows\System\UEmPcNs.exe
  C:\Windows\System\UEmPcNs.exe
  2⤵
  PID:16340
- C:\Windows\System\fLtEUhc.exe
  C:\Windows\System\fLtEUhc.exe
  2⤵
  PID:16360
- C:\Windows\System\lGBfDsq.exe
  C:\Windows\System\lGBfDsq.exe
  2⤵
  PID:15396
- C:\Windows\System\rNcwMcr.exe
  C:\Windows\System\rNcwMcr.exe
  2⤵
  PID:15484
- C:\Windows\System\OGXilaO.exe
  C:\Windows\System\OGXilaO.exe
  2⤵
  PID:15548
- C:\Windows\System\BrtghTt.exe
  C:\Windows\System\BrtghTt.exe
  2⤵
  PID:15544
- C:\Windows\System\eslaJJG.exe
  C:\Windows\System\eslaJJG.exe
  2⤵
  PID:15696
- C:\Windows\System\NxFisQp.exe
  C:\Windows\System\NxFisQp.exe
  2⤵
  PID:15744
- C:\Windows\System\gzjPPNn.exe
  C:\Windows\System\gzjPPNn.exe
  2⤵
  PID:15792
- C:\Windows\System\bYQNYiA.exe
  C:\Windows\System\bYQNYiA.exe
  2⤵
  PID:15852
- C:\Windows\System\qQymQXK.exe
  C:\Windows\System\qQymQXK.exe
  2⤵
  PID:15896
- C:\Windows\System\ZpBLesd.exe
  C:\Windows\System\ZpBLesd.exe
  2⤵
  PID:15924
- C:\Windows\System\BTuUmjs.exe
  C:\Windows\System\BTuUmjs.exe
  2⤵
  PID:15992
- C:\Windows\System\NmuwNcg.exe
  C:\Windows\System\NmuwNcg.exe
  2⤵
  PID:16084
- C:\Windows\System\XBuoiGR.exe
  C:\Windows\System\XBuoiGR.exe
  2⤵
  PID:16152
- C:\Windows\System\AcRIKNV.exe
  C:\Windows\System\AcRIKNV.exe
  2⤵
  PID:16188
- C:\Windows\System\caRSaRq.exe
  C:\Windows\System\caRSaRq.exe
  2⤵
  PID:16256
- C:\Windows\System\gqQsDOI.exe
  C:\Windows\System\gqQsDOI.exe
  2⤵
  PID:16312
- C:\Windows\System\qIbfHEI.exe
  C:\Windows\System\qIbfHEI.exe
  2⤵
  PID:15372
- C:\Windows\System\QppQPAa.exe
  C:\Windows\System\QppQPAa.exe
  2⤵
  PID:15580
- C:\Windows\System\fKMAGHd.exe
  C:\Windows\System\fKMAGHd.exe
  2⤵
  PID:15720
- C:\Windows\System\ruKFpfs.exe
  C:\Windows\System\ruKFpfs.exe
  2⤵
  PID:15904
- C:\Windows\System\hXRoxwW.exe
  C:\Windows\System\hXRoxwW.exe
  2⤵
  PID:16104
- C:\Windows\System\nNlYMPY.exe
  C:\Windows\System\nNlYMPY.exe
  2⤵
  PID:3496
- C:\Windows\System\xzAjRrN.exe
  C:\Windows\System\xzAjRrN.exe
  2⤵
  PID:16240
- C:\Windows\System\cdnlDEk.exe
  C:\Windows\System\cdnlDEk.exe
  2⤵
  PID:720
- C:\Windows\System\pRBFMMf.exe
  C:\Windows\System\pRBFMMf.exe
  2⤵
  PID:15788
- C:\Windows\System\XMtruBi.exe
  C:\Windows\System\XMtruBi.exe
  2⤵
  PID:16048
- C:\Windows\System\kkSOlSv.exe
  C:\Windows\System\kkSOlSv.exe
  2⤵
  PID:16316
- C:\Windows\System\naSTsDA.exe
  C:\Windows\System\naSTsDA.exe
  2⤵
  PID:16172
- C:\Windows\System\HDLwJrr.exe
  C:\Windows\System\HDLwJrr.exe
  2⤵
  PID:16392
- C:\Windows\System\nAwhvdi.exe
  C:\Windows\System\nAwhvdi.exe
  2⤵
  PID:16408
- C:\Windows\System\NlaDHMK.exe
  C:\Windows\System\NlaDHMK.exe
  2⤵
  PID:16432
- C:\Windows\System\eqSjQpx.exe
  C:\Windows\System\eqSjQpx.exe
  2⤵
  PID:16464
- C:\Windows\System\aclwztm.exe
  C:\Windows\System\aclwztm.exe
  2⤵
  PID:16484
- C:\Windows\System\LLTLcoi.exe
  C:\Windows\System\LLTLcoi.exe
  2⤵
  PID:16520
- C:\Windows\System\yWrBNVh.exe
  C:\Windows\System\yWrBNVh.exe
  2⤵
  PID:16548
- C:\Windows\System\tyYmucS.exe
  C:\Windows\System\tyYmucS.exe
  2⤵
  PID:16564
- C:\Windows\System\ADNkpkH.exe
  C:\Windows\System\ADNkpkH.exe
  2⤵
  PID:16592
- C:\Windows\System\NECoGho.exe
  C:\Windows\System\NECoGho.exe
  2⤵
  PID:16644
- C:\Windows\System\qWccKRJ.exe
  C:\Windows\System\qWccKRJ.exe
  2⤵
  PID:16672
- C:\Windows\System\PecUjwL.exe
  C:\Windows\System\PecUjwL.exe
  2⤵
  PID:16688
- C:\Windows\System\spRZeMO.exe
  C:\Windows\System\spRZeMO.exe
  2⤵
  PID:16716
- C:\Windows\System\CvPTsDb.exe
  C:\Windows\System\CvPTsDb.exe
  2⤵
  PID:16744
- C:\Windows\System\XWmpHdc.exe
  C:\Windows\System\XWmpHdc.exe
  2⤵
  PID:16760
- C:\Windows\System\CkmIWub.exe
  C:\Windows\System\CkmIWub.exe
  2⤵
  PID:16800
- C:\Windows\System\NMVLfBD.exe
  C:\Windows\System\NMVLfBD.exe
  2⤵
  PID:16840
- C:\Windows\System\LWRPnKz.exe
  C:\Windows\System\LWRPnKz.exe
  2⤵
  PID:16868
- C:\Windows\System\AXMpnqA.exe
  C:\Windows\System\AXMpnqA.exe
  2⤵
  PID:16884

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv Md0dy2tjmEeJakK8IoDetA.0.2
1⤵
PID:17128
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 17128 -s 1244
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:16996

C:\Windows\system32\WerFaultSecure.exe
C:\Windows\system32\WerFaultSecure.exe -u -p 1436 -s 2124
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:17216

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17280

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 17128 -i 17128 -h 460 -j 464 -s 472 -d 16940
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:16980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BykAWNi.exe

Filesize
1.6MB

MD5
458ae7f8e8e78b044d17e0ad46d0b796

SHA1
e995a9e9729440a934fa9c8a27c97ab9e947de85

SHA256
874652ca2b11bfccde0e3c9f134df8b078d24ab979d1d2062d8b79f2ac90b321

SHA512
26d62aa0f880325f51b3b7c01eb37f77e6295c4f75603d39a6f7410e8e8d56dc339ed2b11d888cb906faed1e9ee4c401678d4ed28225e9c34c581488bb765913

Download Submit
C:\Windows\System\EjvyLHm.exe

Filesize
1.6MB

MD5
624486000a80080595f81969823cd07e

SHA1
330bcb317d4297b82ca0ab4f10cba6a9cd2ef738

SHA256
4d23eb6e918f19e248da7362d741408dbf4b0352ef3f2d3d62f8476e302eb529

SHA512
2f005a6b9787d4ce26702428c9341694d9df4b3f0be41a4043b72afb6518de41322e2a191f57906a9e3c28d0f25f1dfbdf232ba56626fe1e9b16bbc3256a7f02

Download Submit
C:\Windows\System\FsQTJCA.exe

Filesize
1.6MB

MD5
c5b7ec5bc6dac5e7a7c0fb2a92666bbc

SHA1
058c60e103ff7843e687fb8a1668ce7c180d74c0

SHA256
baf0e866b91b56fdce97969a203a4dd184013eed130649f24004e29a5b957584

SHA512
68c82149dc5a49dc350a1ff46a570a83a282118b93b50dd90dadabac81808a42472abc275066ef22514567ff4dcec7f78d79dbaf50ff71995478de0202f200f8

Download Submit
C:\Windows\System\GPolNYP.exe

Filesize
1.6MB

MD5
fab6bffce5d9b655e91e80c59bb66760

SHA1
23c07b4bf3ca69edcc9720e27249144c6fbecfa1

SHA256
8f6cb15ad0aec1119e741bbe5a6e39f61d2381494024248757e08f2502a579f4

SHA512
b75d0586520a5a47645b8ca6d537fab53938c33651b52f8f79b9ea86e93aa21505afea3b48ce79d60d306a691abf399d0dce901f5dde9d17a2c923196040921f

Download Submit
C:\Windows\System\HOoaMAf.exe

Filesize
1.6MB

MD5
614ff36268c59ff6666b9c147948ab69

SHA1
45b3d52446332a64ed3b5966e738afa52b9b4393

SHA256
2a1c01c78f88e6674f96e55efa45b895659ca765445785b328c920446dc2338a

SHA512
97fed45b55fc0922e6a5c99cbdf15a2e04694dd83d7c58fdea51796da00d26b79199789bf21a99c2d499afeb3ecedb4a4ac2d430855de431f66bee097d3cb623

Download Submit
C:\Windows\System\HbrGHUT.exe

Filesize
1.6MB

MD5
747f6714b766faa57c02afa22818b495

SHA1
cf81b260ce2768b898a8a8b2f3d637908c313db5

SHA256
a8d3252fbdabc16d53de459086759f249b0b3f1b6f9c34ac7babfe70e45363f1

SHA512
6c4b29f48095df126d1bfb2dac062ffcdeac871667c50df4faf8db1aa20f2d946b05c59482c52cf2f71f3b5bb2d12d33597f118baa37c4126c5e0ffcba8d168d

Download Submit
C:\Windows\System\IUoPbVG.exe

Filesize
1.6MB

MD5
c80dc8d76de870fd24df0f8725b69de0

SHA1
5eab7bf59d639fb7ab620a2b60d6b6bc98af71ef

SHA256
424b91f74326d6dc26206eecf77a8d847c22ab7ac685cdd961ab9b520c23c561

SHA512
b9406977f08e8f9617956ced88284482866a7a538073c9cddd5cbdefa5b907b96690a0667dc4cfa71d7c924076fa1b6dba65d42799bc91edd0e31f1f39672793

Download Submit
C:\Windows\System\IwiAyGS.exe

Filesize
1.6MB

MD5
573b9b7cc8bf239ffb8ad671853a5262

SHA1
f6c91613fc7eee23cff40577980630fef6bd8a65

SHA256
a9e680d31eb7136f9f38571860f403db1f82ccd6ea5fb919b66ed79635b527af

SHA512
89429c5e6af8a47fb53eaa8ce99421e375aae0dde1878ce811bce02be49c1c0694a16a0a6e334ad64f94aef315480987c70304f4ebbd291b73e5457a66c60a38

Download Submit
C:\Windows\System\JGrqsxP.exe

Filesize
1.6MB

MD5
658233d3c804b5f7aba5c53acffbcba3

SHA1
c0fc86a48ef1645c92d0348ee420016c58251e12

SHA256
99190d9abed0508cae2093f70c1c183744eb193e2f638d1658200b2f8271509d

SHA512
26a72443d2183dd3b6bf7e6e6460269c16035b5b71f73ab71458eafc4b9b09c0d753520e3470ed2139713eb4a56fd2c9c255c3d913c4b460e9c823ee4cd75609

Download Submit
C:\Windows\System\MvOCVYQ.exe

Filesize
1.6MB

MD5
7f678367d2351cb4f13533b6b3ae9529

SHA1
e405f8e4f5486950301e3c5502f5cf33ef3d915c

SHA256
665b9db50c14335811fcb033acf8f49ea7023025accd83a15a06ffc3e790b4a3

SHA512
5ce78c2bacde74149a076184f4095e5e19246baf95f0e6762a8b0242e65ed2010e7839140dac0e341e49957873152cfca150ab54c9674fa264c4a87815b7bd00

Download Submit
C:\Windows\System\NHagxHe.exe

Filesize
1.6MB

MD5
cfaa30f81b15ba00ce2a82a2b0286eb7

SHA1
ed6592931f898816a595898fbde91f9d8824a577

SHA256
f632d0f752af801de5b4ec4c4835baa747897733b938d51522c2cd6ba451bf1f

SHA512
f4480801d2ae4c28e4453aeea04f35616e15887dbfeaa404a30b9923755a5283dc83ce21f8e667b00e094b4570940da416eacee82cfcc81e4f6e428b8b889b27

Download Submit
C:\Windows\System\ORoHPaO.exe

Filesize
1.6MB

MD5
0ceb38a79c2ff7f3a71ab83b4808d93b

SHA1
e2c6f00855579c178e255cbd3c1bcbdf39e6f648

SHA256
07e8344a44f42df6a9f6188722bb123cf14ee9ec25ecaac6d7d919f08d6f2f22

SHA512
a132a8565fa6871dd1b6e4e0a9e0428d74edd56240da2b2489929440cbe545c33c17d1ba79a856672e61cc0c3eff689b79de00da9ac7bb183aa155f72e69d866

Download Submit
C:\Windows\System\PbbBLxX.exe

Filesize
1.6MB

MD5
255fee2b3b66014aba658f0a44a7dd27

SHA1
c20d4cb46685f1fb8ff705d81fe967afc1d24fa2

SHA256
542adc0c67752ce2032a381c286f2d5cd8dbe3b84d1890053849e4316b8f65a2

SHA512
637c03267085e24bacc4a75ad9f8bbb75fd898a43db9b8319f86e94587a093fc34e285ed46d1a7762b00be5cc3022fc799a61622851bba2553a17e494b02e7ae

Download Submit
C:\Windows\System\RvfpKOW.exe

Filesize
1.6MB

MD5
4a61c469e16dbf2c02a6807d171aaf10

SHA1
b348d185f3fa069f56873388c4c4acd66288f23a

SHA256
0dda2a3c69ca6d7d8212e7a5e502dbb123c3377a3759c2345ca60d1c7d58c3b2

SHA512
cc1ae177700f1eb253e99085750bbbd8921d6d140852673ab1b03a874dfb3229d94b3086eb0de75e2101d4fd0835c5f2e1688340d8a71bd2b8e3c4de95615b6c

Download Submit
C:\Windows\System\SoPkidB.exe

Filesize
1.6MB

MD5
ee2d172b6c01ef58e3641fbd92f3b005

SHA1
62b56d5a3aa6aa97dc46a9da92ffe36441aaa7b4

SHA256
a4af37dc8ed4cba26b1b68bcef316efcb0f3329e0290f1195039eed9eb77bcfd

SHA512
28ea21b0192dc1d9c8b8e5aa830ea0210e0837a87af9750c0642edf6ffc5c1dc2cc0fafac9f66035acb255c86bc11331124b1c7391f977e0e7079b3331e7f168

Download Submit
C:\Windows\System\SuHWXuV.exe

Filesize
1.6MB

MD5
f86f9f98f2c86359738548f7922d7276

SHA1
b3d6532564b8830fc85f4b7bc758dbceb4da1ce8

SHA256
c03d3d9cdbe1832c1548551b7c4e1a5b1f19ebc325d9714d0c1aad9b791a58be

SHA512
92aa952759c4dfda1757c046d4f5cd046c8e46efb4807197356d4c1afc5b36f6508bb597cf6b1e32660f136686652c8b3f297d4d31d9e8d832d8dd1b80fbd849

Download Submit
C:\Windows\System\WYwXUYX.exe

Filesize
1.6MB

MD5
3c1027cf6d1bf5aed9f0dcb50b692116

SHA1
655ebd8ab790728205f21c06e70acb8c3cf64dc3

SHA256
6d282df0af14e1ae1564385e75ba17c5759bb6b3ecb115bc681363eb195737dd

SHA512
4cd37dd24c52ba0830807d1303d5d07fcc311cde9e866ca0066f632e8bfce798dd07402a981c251eb68c01b72721b36635ed432d069a6e51da08801de62d5876

Download Submit
C:\Windows\System\YVRKDUA.exe

Filesize
1.6MB

MD5
31e3eba9cf634bcc4b8dbca4237bcf50

SHA1
79741a02617694e4be3d9e1d0bd3037f49d62b19

SHA256
a59ae941323585b825c9a6d3c1bdb85a5889f1a79524e37f29e32b8fcbb85a1b

SHA512
8a699e270d4f580d110b0cac443083fc4fe5c30ef70ee2e84f846d86ea2f3a8f73f296d9b4df46882dba6481acfb5d8ddfa8db0a031b4a21c23bc5017c2b1540

Download Submit
C:\Windows\System\aiLpSlz.exe

Filesize
1.6MB

MD5
6f3d71cc13a8e88c228386c8c759a35a

SHA1
67ec2b81d701dec192144852fe3a0519c892abc7

SHA256
3b855c67e55ef88136a2ff0da885ed849c0c53dbe980aa5728c25b255cce31fd

SHA512
fb1bd69afc1ba405cd8c162a3121cc3996f5607503c01d6eaa3b8236c1d6db9ddaca47ad643d01e37898bec116e3d01d5ca191b4c343d0c984c159a13f44a806

Download Submit
C:\Windows\System\apZVzOM.exe

Filesize
1.6MB

MD5
41d3f04204e74001f71a1bf0a9778ceb

SHA1
31e8a38134c78f82a8a76e58f9ac5624adce8449

SHA256
3519aefbded40a0f263c5b0be0b3d92acf88e8a29d4c3eb634c73c8e4a309be1

SHA512
3fe8125c88b593e77d8ec74f53b8d050ecef825af57bed0058ea4df4c53c767397377f369e782fca3dbd71a02110c1da63a5d1412adb02e994dd4a90e1736ffe

Download Submit
C:\Windows\System\dInVzrU.exe

Filesize
1.6MB

MD5
e8e11953e8ab731fb1c1b5180bbd9a73

SHA1
83c6585dc8e4d0a5b2c950f5f439c86b78385e1c

SHA256
32bf9258342a5ff2c1e8025411cb5bcc4dc31ecbdc614e087e6da21eafef9785

SHA512
d8ebdfba6b7cdbe446fad8560c0a0e8c8251276742bd3b35e1bb9cc2ca07f8d93b585e794e892d32baba33f8839bed3639f22125829d5327879617d08788bd14

Download Submit
C:\Windows\System\eltXvJr.exe

Filesize
1.6MB

MD5
0fed65ef4202ec89d8331af76bec395a

SHA1
9cecfe527f490dd59bf1f938dcaf99708669a7b0

SHA256
c768eb3f8ec1a1c3268dad901881a7d24a04f1f2bb49a527bcd47da71d45684d

SHA512
8c3d24c7564f8326fc24ef6abbb17dd559ba022c5947becea87af91355d71370cad0fecc26592ec91a506479b6f0151096855d3ddd8e5cda3951cab9d2a0e8ef

Download Submit
C:\Windows\System\hzAzQTK.exe

Filesize
1.6MB

MD5
b7f8239afa1ca890b20d7d99b9a6597e

SHA1
44af15c68f251d093993b16c86fd8c18726ea233

SHA256
da8c410a1c546c65b178f631b5951ab30f4537efab440646a3f0faa06db853d6

SHA512
a7483bf9605b2b47b1843bcd4a253480c29b46515cc10717c385a9b01d5699f5fd07e2b2cba27b3ce99287787d84489d2f312bb26bf4efff7d9b042a1af410b8

Download Submit
C:\Windows\System\iaQhFeD.exe

Filesize
1.6MB

MD5
899914b6b24dbc0581a8bebe3466898b

SHA1
465694f6cecafe13e6897f7ba6ea575d111a8cfb

SHA256
6aa631ede1536def21790ff8809115ab94dd4b381f3845e333d61ce849e59cf0

SHA512
2ee797f0241253b6b9af20a07e2a663b60973ec3cdbbf7890935dc6cb6b413b3c5e7ebd4812bc5b2912dbbcba2feadbeb9632ed0d9040d11b0243ec0aead9407

Download Submit
C:\Windows\System\inwBkQW.exe

Filesize
1.6MB

MD5
7a5b560eafcb605543eea7eaac2e7f8b

SHA1
4b2a5023d574b87555cd1672949d14ade41b5bd8

SHA256
9e20dbdc8577936c39a7138d7dd62a351901f14c356d3e978260572d42bd17c9

SHA512
c4ae6d75eff7b86efb4836b19be7dd4458a148529a0e497881bf2d9a2e703b86f10423cd997f92ddaa41957cb241f47a6e5805ef405085c8ee6a9307ab60cb1c

Download Submit
C:\Windows\System\mfQWuIj.exe

Filesize
1.6MB

MD5
49272d54122a7f4bc3ac4ba191127630

SHA1
bc6653d849e81ff59f47996662fc905174f52d5e

SHA256
82c0b460403c76f6025cc0a2ec91c1cbce03deaa38978290604873020d680e88

SHA512
03a87dba72f856bc2068d4ad49fe2dc6841fa3128454538bb607451277e86fdfb2d6fd24a253f939a2d0db68b843a0b957264bd2c12e5fc4a5efbd7ebe86a233

Download Submit
C:\Windows\System\ogOqrOM.exe

Filesize
1.6MB

MD5
5b6b7bcb1635f47a0dfb798ea70275d5

SHA1
c0da80ee375221afdb75583147e22562458fb738

SHA256
917187dc58ad6dfa964aeb312a716ad8d5736d021faa00ecff42a55991b4e772

SHA512
f6f408f5582bbb9c6f51201fc766eadc1aaeab6cba45c1d4da121750dc6dedf1834998f63d7a07002ae03da3a91ccc6815c99bfe4c8ab54af3e59222c3f37cf7

Download Submit
C:\Windows\System\wtPlTJP.exe

Filesize
1.6MB

MD5
6834afb15fbc0fd4bdb334760e980b63

SHA1
6393490ecd35230e5289cae7287dda2ddab046c6

SHA256
52cf338df9d2c807e127d40d106029f2b23bd05cb04e1ab15ee49c8a710504db

SHA512
a6da7f464a99da5caf53bf3fd672b5522b63c56f0cc20ad4e28b1122071bb1f21894c7d307b5c3d489485561844944fc0884cabee452f1852f0b2bc0a7c15ac8

Download Submit
C:\Windows\System\xpGYtvz.exe

Filesize
1.6MB

MD5
19d1f7ef3ab6183d61f4dddb08522c52

SHA1
34a7ee72ccc25bf1122c4a4a03d17d28e9d19ed6

SHA256
fce0f53eca4618197ec26d371ea1647f3a5c5aa04ce7c5c393918ceaa9d9ee09

SHA512
542bffaf2603f634aded354cfe577d24d3c7822bae17e7929985430ed0319f139a6c21ce3920d8e70dcc8836766a85583b26ff89edbe60069c6964c264b7b51e

Download Submit
C:\Windows\System\yhmsSmv.exe

Filesize
1.6MB

MD5
1d7570e76b01bf4388c2111d9d8b32f0

SHA1
e4d9c45dba3cb94a40181aaa3a0f7e3189d8680e

SHA256
8687004b3968131f87ff61a8709ad6324df25f2a217ef3d67926c4d62311ef9e

SHA512
157bf92702a74d4ad3d148ba65ba3a725eb5f18cbc5b857df4254fcf299d5c7d5bf89909cb9048db9cc16c067ed2d2b761a652c5c4be055fc9395bdd4a0154e4

Download Submit
C:\Windows\System\zHKhnGy.exe

Filesize
1.6MB

MD5
fa4ff1685c9b66b81a6f843ed9c8e9a1

SHA1
265f8109318c5fbc29491343179fe60095eb2eb5

SHA256
67f8ce479baa9df763de6650a1a4f88271f0f25c17c4e495e4a680345b8843c3

SHA512
0015965c808e15436f197e7925b33297de9d7d165f7c114a2b46a2bf185f616fa8ae61a41011771783ea980b3f79440c4995bb5f500462c6f5aa7bce698066e2

Download Submit
C:\Windows\System\zkUODgA.exe

Filesize
1.6MB

MD5
09c1b6aa09b96ab78bbe321dc0d51003

SHA1
b0a9b98f5041a848a7f97a8d1a194fffd50a45a3

SHA256
806465101d95eea1a8c6e43c5c4843271c800da5b9b082988236d3bfe0ba07b9

SHA512
7458aa9ba0250e0ad198f343db291e680153b190581246dd2e87bc33580d514a0a3bfbe5b32898a5b3b897eabc6a6d97fb54a1cb7bbf5d34809591afa72d6aca

Download Submit
memory/2560-0-0x00000241561C0000-0x00000241561D0000-memory.dmp

Filesize
64KB

Download