xmrig | 04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4

Analysis

max time kernel
146s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
Size

1.5MB
MD5

3e97b096db60d6ebd509752a7e25dd95
SHA1

2b91f0c21ec0caeaf6799b97ad0d52448ae7cce0
SHA256

04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4
SHA512

712ab3316988a5a6bc47333be1edf6c1eb19f0f3255c8d67cd870c2f9545217556e67b927ee2943912efd2ea38f912e8b15c7dfa26742082e649e08902f298f2
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5pbkTPLIyfr:GezaTF8FcNkNdfE0pZ9ozttwIRxe9xh

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d000000023b0d-4.dat	xmrig
behavioral2/files/0x000b000000023b72-12.dat	xmrig
behavioral2/files/0x000a000000023b73-15.dat	xmrig
behavioral2/files/0x000a000000023b74-22.dat	xmrig
behavioral2/files/0x000a000000023b75-21.dat	xmrig
behavioral2/files/0x000a000000023b78-39.dat	xmrig
behavioral2/files/0x000a000000023b79-50.dat	xmrig
behavioral2/files/0x000a000000023b7d-70.dat	xmrig
behavioral2/files/0x000a000000023b86-115.dat	xmrig
behavioral2/files/0x000a000000023b8b-140.dat	xmrig
behavioral2/files/0x000a000000023b8f-160.dat	xmrig
behavioral2/files/0x000a000000023b91-162.dat	xmrig
behavioral2/files/0x000a000000023b90-157.dat	xmrig
behavioral2/files/0x000a000000023b8e-155.dat	xmrig
behavioral2/files/0x000a000000023b8d-150.dat	xmrig
behavioral2/files/0x000a000000023b8c-145.dat	xmrig
behavioral2/files/0x000a000000023b8a-135.dat	xmrig
behavioral2/files/0x000a000000023b89-130.dat	xmrig
behavioral2/files/0x000a000000023b88-125.dat	xmrig
behavioral2/files/0x000a000000023b87-120.dat	xmrig
behavioral2/files/0x000a000000023b85-110.dat	xmrig
behavioral2/files/0x000a000000023b84-105.dat	xmrig
behavioral2/files/0x000a000000023b83-100.dat	xmrig
behavioral2/files/0x000a000000023b82-95.dat	xmrig
behavioral2/files/0x000a000000023b81-87.dat	xmrig
behavioral2/files/0x000a000000023b80-83.dat	xmrig
behavioral2/files/0x000a000000023b7f-80.dat	xmrig
behavioral2/files/0x000a000000023b7e-75.dat	xmrig
behavioral2/files/0x000a000000023b7c-65.dat	xmrig
behavioral2/files/0x000a000000023b7b-60.dat	xmrig
behavioral2/files/0x000a000000023b7a-55.dat	xmrig
behavioral2/files/0x000a000000023b77-37.dat	xmrig
behavioral2/files/0x000a000000023b76-33.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4640	DFUwpQH.exe
2196	ClmVmUY.exe
4468	ZPffKTL.exe
3880	PmZeFhT.exe
1360	BWWcFRe.exe
4688	hQqoPXX.exe
1168	MZGjVqY.exe
3628	yPHmAcO.exe
448	MLnwvet.exe
912	iqUiOvn.exe
2732	fUXtNUy.exe
1200	BOABrwR.exe
3028	CiiGFPk.exe
2296	kkrhsbm.exe
2920	DGYvAHi.exe
3140	joddvoc.exe
2532	ZsAghtm.exe
1464	XDnzPZc.exe
3732	YQwcdnW.exe
4952	YFGNqHT.exe
3800	yJWdjYi.exe
3412	UPaVPsJ.exe
3584	LwDsQFB.exe
1840	HyNfKlR.exe
2280	xdkozZr.exe
3076	MZonmKV.exe
4556	vWhQCkb.exe
2416	cxZPlLJ.exe
1240	bbqGnOQ.exe
2172	TsDzKzx.exe
2872	ztpQdaX.exe
2684	BEcoiFU.exe
4116	QDqgCMd.exe
2848	zOYAZLY.exe
396	MmqXAKl.exe
5004	lcAsEtq.exe
432	AFzykFq.exe
4932	ftcSlEa.exe
676	UxIJtnC.exe
4408	JjkrBIU.exe
876	CQInseO.exe
4316	OfZFyXQ.exe
2208	oBZwivZ.exe
4376	etOHkXn.exe
2992	zCvyXSG.exe
1752	huOEEje.exe
1960	idaBxyh.exe
1628	lnGnXdP.exe
2152	zgxhpQg.exe
404	byAcXkP.exe
2200	rHtyRfx.exe
4944	gyuNxDv.exe
2092	dWFINgk.exe
4528	rtkEVnY.exe
216	StGcVFp.exe
2180	hEKhkiC.exe
4192	xpJGzih.exe
2892	gXlccFL.exe
3960	fFkTclH.exe
3088	ugXgxzA.exe
4828	SejzDVe.exe
4576	nYpsLzT.exe
2404	rynMJPB.exe
2104	opSapGJ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sNZinao.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\WfFBLhG.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\dPCcaJB.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\gjRtuRV.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\bktAAoJ.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\QnumHeb.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\YVXcXZe.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\sXaFJWQ.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\QuybaHX.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\LwDsQFB.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\pzxCAlb.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\bGzDkbD.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\jwOtiRU.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\tyZKkxT.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\uUbunkp.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\znLRfZb.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\hdGdIoD.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\PXWgSHq.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\EqlHhbs.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\EoVGryn.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\tjtHDKo.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\yzrjqiW.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\PgBHvXr.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\JDcFFtl.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\opSapGJ.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\cFyVFik.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\lYdMcYu.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\tctGEhL.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\suWkEkE.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\CLmuomG.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\EpWLFsA.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\AQiNWNd.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\EKgCMsd.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\VtosKEo.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\EadQVrK.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\jwORTai.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\WkvbrsL.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\QEABpOI.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\UTysPEH.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\gBUQbbq.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\rLExrjx.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\yEYCeWy.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\ickLXdP.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\SgjBRQE.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\WNicIdv.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\EjwVbgW.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\silxOFx.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\tqIsUln.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\hJEYMDe.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\ViQaUSw.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\VMhcBGS.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\YCXhfaL.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\XwQjvCG.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\VbeTHZS.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\XFlgNvH.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\SfXimOn.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\dAXYKFq.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\MscKyOk.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\HsOrQGt.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\rfAzsZO.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\vQTDtdl.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\pHcGNSH.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\rWlukNH.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
File created	C:\Windows\System\DVRfMVn.exe	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
17320	WerFaultSecure.exe
17320	WerFaultSecure.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17388	dwm.exe
Token: SeChangeNotifyPrivilege	17388	dwm.exe
Token: 33	17388	dwm.exe
Token: SeIncBasePriorityPrivilege	17388	dwm.exe
Token: SeShutdownPrivilege	17388	dwm.exe
Token: SeCreatePagefilePrivilege	17388	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 4640	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	84
PID 4048 wrote to memory of 4640	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	84
PID 4048 wrote to memory of 2196	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	85
PID 4048 wrote to memory of 2196	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	85
PID 4048 wrote to memory of 4468	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	86
PID 4048 wrote to memory of 4468	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	86
PID 4048 wrote to memory of 3880	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	87
PID 4048 wrote to memory of 3880	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	87
PID 4048 wrote to memory of 1360	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	88
PID 4048 wrote to memory of 1360	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	88
PID 4048 wrote to memory of 4688	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	89
PID 4048 wrote to memory of 4688	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	89
PID 4048 wrote to memory of 1168	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	90
PID 4048 wrote to memory of 1168	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	90
PID 4048 wrote to memory of 3628	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	91
PID 4048 wrote to memory of 3628	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	91
PID 4048 wrote to memory of 448	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	92
PID 4048 wrote to memory of 448	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	92
PID 4048 wrote to memory of 912	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	93
PID 4048 wrote to memory of 912	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	93
PID 4048 wrote to memory of 2732	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	94
PID 4048 wrote to memory of 2732	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	94
PID 4048 wrote to memory of 1200	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	95
PID 4048 wrote to memory of 1200	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	95
PID 4048 wrote to memory of 3028	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	96
PID 4048 wrote to memory of 3028	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	96
PID 4048 wrote to memory of 2296	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	97
PID 4048 wrote to memory of 2296	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	97
PID 4048 wrote to memory of 2920	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	98
PID 4048 wrote to memory of 2920	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	98
PID 4048 wrote to memory of 3140	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	99
PID 4048 wrote to memory of 3140	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	99
PID 4048 wrote to memory of 2532	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	100
PID 4048 wrote to memory of 2532	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	100
PID 4048 wrote to memory of 1464	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	101
PID 4048 wrote to memory of 1464	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	101
PID 4048 wrote to memory of 3732	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	102
PID 4048 wrote to memory of 3732	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	102
PID 4048 wrote to memory of 4952	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	103
PID 4048 wrote to memory of 4952	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	103
PID 4048 wrote to memory of 3800	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	104
PID 4048 wrote to memory of 3800	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	104
PID 4048 wrote to memory of 3412	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	105
PID 4048 wrote to memory of 3412	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	105
PID 4048 wrote to memory of 3584	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	106
PID 4048 wrote to memory of 3584	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	106
PID 4048 wrote to memory of 1840	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	107
PID 4048 wrote to memory of 1840	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	107
PID 4048 wrote to memory of 2280	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	108
PID 4048 wrote to memory of 2280	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	108
PID 4048 wrote to memory of 3076	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	109
PID 4048 wrote to memory of 3076	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	109
PID 4048 wrote to memory of 4556	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	110
PID 4048 wrote to memory of 4556	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	110
PID 4048 wrote to memory of 2416	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	111
PID 4048 wrote to memory of 2416	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	111
PID 4048 wrote to memory of 1240	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	112
PID 4048 wrote to memory of 1240	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	112
PID 4048 wrote to memory of 2172	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	113
PID 4048 wrote to memory of 2172	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	113
PID 4048 wrote to memory of 2872	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	114
PID 4048 wrote to memory of 2872	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	114
PID 4048 wrote to memory of 2684	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	115
PID 4048 wrote to memory of 2684	4048	04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe	115

C:\Users\Admin\AppData\Local\Temp\04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe
"C:\Users\Admin\AppData\Local\Temp\04265d9dcc5f1822b4c2bfcedd91eddf899cd28d226040db1f715448aabe79a4.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\System\DFUwpQH.exe
  C:\Windows\System\DFUwpQH.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\ClmVmUY.exe
  C:\Windows\System\ClmVmUY.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\ZPffKTL.exe
  C:\Windows\System\ZPffKTL.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\PmZeFhT.exe
  C:\Windows\System\PmZeFhT.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\BWWcFRe.exe
  C:\Windows\System\BWWcFRe.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\hQqoPXX.exe
  C:\Windows\System\hQqoPXX.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\MZGjVqY.exe
  C:\Windows\System\MZGjVqY.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\yPHmAcO.exe
  C:\Windows\System\yPHmAcO.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\MLnwvet.exe
  C:\Windows\System\MLnwvet.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\iqUiOvn.exe
  C:\Windows\System\iqUiOvn.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\fUXtNUy.exe
  C:\Windows\System\fUXtNUy.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\BOABrwR.exe
  C:\Windows\System\BOABrwR.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\CiiGFPk.exe
  C:\Windows\System\CiiGFPk.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\kkrhsbm.exe
  C:\Windows\System\kkrhsbm.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\DGYvAHi.exe
  C:\Windows\System\DGYvAHi.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\joddvoc.exe
  C:\Windows\System\joddvoc.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\ZsAghtm.exe
  C:\Windows\System\ZsAghtm.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\XDnzPZc.exe
  C:\Windows\System\XDnzPZc.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\YQwcdnW.exe
  C:\Windows\System\YQwcdnW.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\YFGNqHT.exe
  C:\Windows\System\YFGNqHT.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\yJWdjYi.exe
  C:\Windows\System\yJWdjYi.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\UPaVPsJ.exe
  C:\Windows\System\UPaVPsJ.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\LwDsQFB.exe
  C:\Windows\System\LwDsQFB.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\HyNfKlR.exe
  C:\Windows\System\HyNfKlR.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\xdkozZr.exe
  C:\Windows\System\xdkozZr.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\MZonmKV.exe
  C:\Windows\System\MZonmKV.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\vWhQCkb.exe
  C:\Windows\System\vWhQCkb.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\cxZPlLJ.exe
  C:\Windows\System\cxZPlLJ.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\bbqGnOQ.exe
  C:\Windows\System\bbqGnOQ.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\TsDzKzx.exe
  C:\Windows\System\TsDzKzx.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\ztpQdaX.exe
  C:\Windows\System\ztpQdaX.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\BEcoiFU.exe
  C:\Windows\System\BEcoiFU.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\QDqgCMd.exe
  C:\Windows\System\QDqgCMd.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\zOYAZLY.exe
  C:\Windows\System\zOYAZLY.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\MmqXAKl.exe
  C:\Windows\System\MmqXAKl.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\lcAsEtq.exe
  C:\Windows\System\lcAsEtq.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\AFzykFq.exe
  C:\Windows\System\AFzykFq.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\ftcSlEa.exe
  C:\Windows\System\ftcSlEa.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\UxIJtnC.exe
  C:\Windows\System\UxIJtnC.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\JjkrBIU.exe
  C:\Windows\System\JjkrBIU.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\CQInseO.exe
  C:\Windows\System\CQInseO.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\OfZFyXQ.exe
  C:\Windows\System\OfZFyXQ.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\oBZwivZ.exe
  C:\Windows\System\oBZwivZ.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\etOHkXn.exe
  C:\Windows\System\etOHkXn.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\zCvyXSG.exe
  C:\Windows\System\zCvyXSG.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\huOEEje.exe
  C:\Windows\System\huOEEje.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\idaBxyh.exe
  C:\Windows\System\idaBxyh.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\lnGnXdP.exe
  C:\Windows\System\lnGnXdP.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\zgxhpQg.exe
  C:\Windows\System\zgxhpQg.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\byAcXkP.exe
  C:\Windows\System\byAcXkP.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\rHtyRfx.exe
  C:\Windows\System\rHtyRfx.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\gyuNxDv.exe
  C:\Windows\System\gyuNxDv.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\dWFINgk.exe
  C:\Windows\System\dWFINgk.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\rtkEVnY.exe
  C:\Windows\System\rtkEVnY.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\StGcVFp.exe
  C:\Windows\System\StGcVFp.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\hEKhkiC.exe
  C:\Windows\System\hEKhkiC.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\xpJGzih.exe
  C:\Windows\System\xpJGzih.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\gXlccFL.exe
  C:\Windows\System\gXlccFL.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\fFkTclH.exe
  C:\Windows\System\fFkTclH.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\ugXgxzA.exe
  C:\Windows\System\ugXgxzA.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\SejzDVe.exe
  C:\Windows\System\SejzDVe.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\nYpsLzT.exe
  C:\Windows\System\nYpsLzT.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\rynMJPB.exe
  C:\Windows\System\rynMJPB.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\opSapGJ.exe
  C:\Windows\System\opSapGJ.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\UuvIieM.exe
  C:\Windows\System\UuvIieM.exe
  2⤵
  PID:552
- C:\Windows\System\DBibHbF.exe
  C:\Windows\System\DBibHbF.exe
  2⤵
  PID:2492
- C:\Windows\System\PTailOU.exe
  C:\Windows\System\PTailOU.exe
  2⤵
  PID:1072
- C:\Windows\System\uLDKjnW.exe
  C:\Windows\System\uLDKjnW.exe
  2⤵
  PID:2160
- C:\Windows\System\MxRrOKq.exe
  C:\Windows\System\MxRrOKq.exe
  2⤵
  PID:2224
- C:\Windows\System\YCHwXDi.exe
  C:\Windows\System\YCHwXDi.exe
  2⤵
  PID:4124
- C:\Windows\System\uvMWXdz.exe
  C:\Windows\System\uvMWXdz.exe
  2⤵
  PID:116
- C:\Windows\System\KLLqvMU.exe
  C:\Windows\System\KLLqvMU.exe
  2⤵
  PID:960
- C:\Windows\System\EluyldN.exe
  C:\Windows\System\EluyldN.exe
  2⤵
  PID:1544
- C:\Windows\System\PbUrSYv.exe
  C:\Windows\System\PbUrSYv.exe
  2⤵
  PID:2720
- C:\Windows\System\rIHEthR.exe
  C:\Windows\System\rIHEthR.exe
  2⤵
  PID:3416
- C:\Windows\System\dHDbXXh.exe
  C:\Windows\System\dHDbXXh.exe
  2⤵
  PID:3652
- C:\Windows\System\nJVhKVU.exe
  C:\Windows\System\nJVhKVU.exe
  2⤵
  PID:2264
- C:\Windows\System\hZzNcrb.exe
  C:\Windows\System\hZzNcrb.exe
  2⤵
  PID:3716
- C:\Windows\System\iWHywBj.exe
  C:\Windows\System\iWHywBj.exe
  2⤵
  PID:3112
- C:\Windows\System\cysAkcg.exe
  C:\Windows\System\cysAkcg.exe
  2⤵
  PID:5148
- C:\Windows\System\KGwQKrk.exe
  C:\Windows\System\KGwQKrk.exe
  2⤵
  PID:5176
- C:\Windows\System\cjMOVfG.exe
  C:\Windows\System\cjMOVfG.exe
  2⤵
  PID:5204
- C:\Windows\System\YCXhfaL.exe
  C:\Windows\System\YCXhfaL.exe
  2⤵
  PID:5228
- C:\Windows\System\hRDgqPZ.exe
  C:\Windows\System\hRDgqPZ.exe
  2⤵
  PID:5292
- C:\Windows\System\taunPOD.exe
  C:\Windows\System\taunPOD.exe
  2⤵
  PID:5308
- C:\Windows\System\TBVyHbZ.exe
  C:\Windows\System\TBVyHbZ.exe
  2⤵
  PID:5324
- C:\Windows\System\CAuBLYj.exe
  C:\Windows\System\CAuBLYj.exe
  2⤵
  PID:5348
- C:\Windows\System\zxPexXs.exe
  C:\Windows\System\zxPexXs.exe
  2⤵
  PID:5380
- C:\Windows\System\aMdrGtW.exe
  C:\Windows\System\aMdrGtW.exe
  2⤵
  PID:5404
- C:\Windows\System\PzaIcDU.exe
  C:\Windows\System\PzaIcDU.exe
  2⤵
  PID:5424
- C:\Windows\System\cPcJrgY.exe
  C:\Windows\System\cPcJrgY.exe
  2⤵
  PID:5456
- C:\Windows\System\AECTeqA.exe
  C:\Windows\System\AECTeqA.exe
  2⤵
  PID:5492
- C:\Windows\System\DJepEOW.exe
  C:\Windows\System\DJepEOW.exe
  2⤵
  PID:5520
- C:\Windows\System\MXZCHcp.exe
  C:\Windows\System\MXZCHcp.exe
  2⤵
  PID:5552
- C:\Windows\System\GmhRqfI.exe
  C:\Windows\System\GmhRqfI.exe
  2⤵
  PID:5576
- C:\Windows\System\BUvaHem.exe
  C:\Windows\System\BUvaHem.exe
  2⤵
  PID:5604
- C:\Windows\System\XFlgNvH.exe
  C:\Windows\System\XFlgNvH.exe
  2⤵
  PID:5628
- C:\Windows\System\WfZhJYi.exe
  C:\Windows\System\WfZhJYi.exe
  2⤵
  PID:5656
- C:\Windows\System\ovqnKnQ.exe
  C:\Windows\System\ovqnKnQ.exe
  2⤵
  PID:5684
- C:\Windows\System\aRicYsa.exe
  C:\Windows\System\aRicYsa.exe
  2⤵
  PID:5712
- C:\Windows\System\vaZNaGq.exe
  C:\Windows\System\vaZNaGq.exe
  2⤵
  PID:5740
- C:\Windows\System\gWGCTdG.exe
  C:\Windows\System\gWGCTdG.exe
  2⤵
  PID:5768
- C:\Windows\System\mcYzrUo.exe
  C:\Windows\System\mcYzrUo.exe
  2⤵
  PID:5800
- C:\Windows\System\snRtTin.exe
  C:\Windows\System\snRtTin.exe
  2⤵
  PID:5828
- C:\Windows\System\pHovqJp.exe
  C:\Windows\System\pHovqJp.exe
  2⤵
  PID:5856
- C:\Windows\System\JscZAoA.exe
  C:\Windows\System\JscZAoA.exe
  2⤵
  PID:5880
- C:\Windows\System\chwnPMI.exe
  C:\Windows\System\chwnPMI.exe
  2⤵
  PID:5908
- C:\Windows\System\NbLbwBW.exe
  C:\Windows\System\NbLbwBW.exe
  2⤵
  PID:5936
- C:\Windows\System\OGjvwuc.exe
  C:\Windows\System\OGjvwuc.exe
  2⤵
  PID:5964
- C:\Windows\System\hNwkkmS.exe
  C:\Windows\System\hNwkkmS.exe
  2⤵
  PID:5992
- C:\Windows\System\eVRpFVO.exe
  C:\Windows\System\eVRpFVO.exe
  2⤵
  PID:6024
- C:\Windows\System\qZvhaKw.exe
  C:\Windows\System\qZvhaKw.exe
  2⤵
  PID:6052
- C:\Windows\System\NqQeEiX.exe
  C:\Windows\System\NqQeEiX.exe
  2⤵
  PID:6080
- C:\Windows\System\bLDIUAE.exe
  C:\Windows\System\bLDIUAE.exe
  2⤵
  PID:6108
- C:\Windows\System\VtosKEo.exe
  C:\Windows\System\VtosKEo.exe
  2⤵
  PID:6136
- C:\Windows\System\umfxgjS.exe
  C:\Windows\System\umfxgjS.exe
  2⤵
  PID:4272
- C:\Windows\System\EiQinOw.exe
  C:\Windows\System\EiQinOw.exe
  2⤵
  PID:3464
- C:\Windows\System\YjPdvnp.exe
  C:\Windows\System\YjPdvnp.exe
  2⤵
  PID:3336
- C:\Windows\System\BjYEQLR.exe
  C:\Windows\System\BjYEQLR.exe
  2⤵
  PID:3052
- C:\Windows\System\EIgyein.exe
  C:\Windows\System\EIgyein.exe
  2⤵
  PID:5104
- C:\Windows\System\MybMzFW.exe
  C:\Windows\System\MybMzFW.exe
  2⤵
  PID:400
- C:\Windows\System\ohGRvdZ.exe
  C:\Windows\System\ohGRvdZ.exe
  2⤵
  PID:5128
- C:\Windows\System\hlOCrRk.exe
  C:\Windows\System\hlOCrRk.exe
  2⤵
  PID:5192
- C:\Windows\System\uNCTjeh.exe
  C:\Windows\System\uNCTjeh.exe
  2⤵
  PID:5260
- C:\Windows\System\WZQsAbt.exe
  C:\Windows\System\WZQsAbt.exe
  2⤵
  PID:5320
- C:\Windows\System\jVwSVbe.exe
  C:\Windows\System\jVwSVbe.exe
  2⤵
  PID:5392
- C:\Windows\System\LjbBVmM.exe
  C:\Windows\System\LjbBVmM.exe
  2⤵
  PID:5448
- C:\Windows\System\gBUQbbq.exe
  C:\Windows\System\gBUQbbq.exe
  2⤵
  PID:5532
- C:\Windows\System\wzGkwGu.exe
  C:\Windows\System\wzGkwGu.exe
  2⤵
  PID:5592
- C:\Windows\System\tQExnyV.exe
  C:\Windows\System\tQExnyV.exe
  2⤵
  PID:5652
- C:\Windows\System\BFLHHBt.exe
  C:\Windows\System\BFLHHBt.exe
  2⤵
  PID:5728
- C:\Windows\System\AICvlMb.exe
  C:\Windows\System\AICvlMb.exe
  2⤵
  PID:5788
- C:\Windows\System\wlRBinG.exe
  C:\Windows\System\wlRBinG.exe
  2⤵
  PID:5848
- C:\Windows\System\CTckTRW.exe
  C:\Windows\System\CTckTRW.exe
  2⤵
  PID:5924
- C:\Windows\System\PRSCylM.exe
  C:\Windows\System\PRSCylM.exe
  2⤵
  PID:5984
- C:\Windows\System\bktAAoJ.exe
  C:\Windows\System\bktAAoJ.exe
  2⤵
  PID:6040
- C:\Windows\System\GOEFrzX.exe
  C:\Windows\System\GOEFrzX.exe
  2⤵
  PID:6100
- C:\Windows\System\avZWWen.exe
  C:\Windows\System\avZWWen.exe
  2⤵
  PID:2440
- C:\Windows\System\zHhvTjT.exe
  C:\Windows\System\zHhvTjT.exe
  2⤵
  PID:4328
- C:\Windows\System\rneqDwe.exe
  C:\Windows\System\rneqDwe.exe
  2⤵
  PID:1696
- C:\Windows\System\EpWLFsA.exe
  C:\Windows\System\EpWLFsA.exe
  2⤵
  PID:5224
- C:\Windows\System\JduHURq.exe
  C:\Windows\System\JduHURq.exe
  2⤵
  PID:5368
- C:\Windows\System\HCCHSFt.exe
  C:\Windows\System\HCCHSFt.exe
  2⤵
  PID:5560
- C:\Windows\System\RrsygRp.exe
  C:\Windows\System\RrsygRp.exe
  2⤵
  PID:5644
- C:\Windows\System\lkLizSA.exe
  C:\Windows\System\lkLizSA.exe
  2⤵
  PID:5816
- C:\Windows\System\idkThMQ.exe
  C:\Windows\System\idkThMQ.exe
  2⤵
  PID:5900
- C:\Windows\System\MxYIjio.exe
  C:\Windows\System\MxYIjio.exe
  2⤵
  PID:6068
- C:\Windows\System\BlYQalh.exe
  C:\Windows\System\BlYQalh.exe
  2⤵
  PID:6148
- C:\Windows\System\YNrsXkX.exe
  C:\Windows\System\YNrsXkX.exe
  2⤵
  PID:6172
- C:\Windows\System\xwnjYof.exe
  C:\Windows\System\xwnjYof.exe
  2⤵
  PID:6204
- C:\Windows\System\LXWnqRC.exe
  C:\Windows\System\LXWnqRC.exe
  2⤵
  PID:6228
- C:\Windows\System\shypjhH.exe
  C:\Windows\System\shypjhH.exe
  2⤵
  PID:6256
- C:\Windows\System\FAAsFfW.exe
  C:\Windows\System\FAAsFfW.exe
  2⤵
  PID:6288
- C:\Windows\System\uouwNoT.exe
  C:\Windows\System\uouwNoT.exe
  2⤵
  PID:6312
- C:\Windows\System\iLEkzNt.exe
  C:\Windows\System\iLEkzNt.exe
  2⤵
  PID:6340
- C:\Windows\System\DbnwUkA.exe
  C:\Windows\System\DbnwUkA.exe
  2⤵
  PID:6372
- C:\Windows\System\FREvQLr.exe
  C:\Windows\System\FREvQLr.exe
  2⤵
  PID:6396
- C:\Windows\System\oqyicnq.exe
  C:\Windows\System\oqyicnq.exe
  2⤵
  PID:6424
- C:\Windows\System\PXFKzHI.exe
  C:\Windows\System\PXFKzHI.exe
  2⤵
  PID:6452
- C:\Windows\System\BLszSUL.exe
  C:\Windows\System\BLszSUL.exe
  2⤵
  PID:6484
- C:\Windows\System\AivAdYi.exe
  C:\Windows\System\AivAdYi.exe
  2⤵
  PID:6512
- C:\Windows\System\ezcURFQ.exe
  C:\Windows\System\ezcURFQ.exe
  2⤵
  PID:6540
- C:\Windows\System\ZysqHwf.exe
  C:\Windows\System\ZysqHwf.exe
  2⤵
  PID:6568
- C:\Windows\System\pHcGNSH.exe
  C:\Windows\System\pHcGNSH.exe
  2⤵
  PID:6596
- C:\Windows\System\oaZjDnJ.exe
  C:\Windows\System\oaZjDnJ.exe
  2⤵
  PID:6624
- C:\Windows\System\PQCaODj.exe
  C:\Windows\System\PQCaODj.exe
  2⤵
  PID:6652
- C:\Windows\System\awzpKof.exe
  C:\Windows\System\awzpKof.exe
  2⤵
  PID:6680
- C:\Windows\System\PtLJvMu.exe
  C:\Windows\System\PtLJvMu.exe
  2⤵
  PID:6708
- C:\Windows\System\TjEYwNS.exe
  C:\Windows\System\TjEYwNS.exe
  2⤵
  PID:6736
- C:\Windows\System\jHgUIyY.exe
  C:\Windows\System\jHgUIyY.exe
  2⤵
  PID:6764
- C:\Windows\System\ZHZJPCG.exe
  C:\Windows\System\ZHZJPCG.exe
  2⤵
  PID:6792
- C:\Windows\System\XqskNNO.exe
  C:\Windows\System\XqskNNO.exe
  2⤵
  PID:6820
- C:\Windows\System\xfVrmWl.exe
  C:\Windows\System\xfVrmWl.exe
  2⤵
  PID:6848
- C:\Windows\System\YHdYZXj.exe
  C:\Windows\System\YHdYZXj.exe
  2⤵
  PID:6876
- C:\Windows\System\RBgmESF.exe
  C:\Windows\System\RBgmESF.exe
  2⤵
  PID:6904
- C:\Windows\System\oYTDfiA.exe
  C:\Windows\System\oYTDfiA.exe
  2⤵
  PID:6932
- C:\Windows\System\WcAAsjj.exe
  C:\Windows\System\WcAAsjj.exe
  2⤵
  PID:6960
- C:\Windows\System\bGzDkbD.exe
  C:\Windows\System\bGzDkbD.exe
  2⤵
  PID:6984
- C:\Windows\System\cGhdCuL.exe
  C:\Windows\System\cGhdCuL.exe
  2⤵
  PID:7012
- C:\Windows\System\wfomXef.exe
  C:\Windows\System\wfomXef.exe
  2⤵
  PID:7044
- C:\Windows\System\oYoOkUM.exe
  C:\Windows\System\oYoOkUM.exe
  2⤵
  PID:7068
- C:\Windows\System\LysUWJn.exe
  C:\Windows\System\LysUWJn.exe
  2⤵
  PID:7096
- C:\Windows\System\CRFBNfX.exe
  C:\Windows\System\CRFBNfX.exe
  2⤵
  PID:7128
- C:\Windows\System\vKYujCE.exe
  C:\Windows\System\vKYujCE.exe
  2⤵
  PID:7160
- C:\Windows\System\DglQaSt.exe
  C:\Windows\System\DglQaSt.exe
  2⤵
  PID:3396
- C:\Windows\System\DBRNZeI.exe
  C:\Windows\System\DBRNZeI.exe
  2⤵
  PID:5304
- C:\Windows\System\vQBmMOJ.exe
  C:\Windows\System\vQBmMOJ.exe
  2⤵
  PID:6528
- C:\Windows\System\EqlHhbs.exe
  C:\Windows\System\EqlHhbs.exe
  2⤵
  PID:6560
- C:\Windows\System\dWnQfFF.exe
  C:\Windows\System\dWnQfFF.exe
  2⤵
  PID:1340
- C:\Windows\System\PZLkeRS.exe
  C:\Windows\System\PZLkeRS.exe
  2⤵
  PID:6720
- C:\Windows\System\CESwBbk.exe
  C:\Windows\System\CESwBbk.exe
  2⤵
  PID:4044
- C:\Windows\System\MTIIYJD.exe
  C:\Windows\System\MTIIYJD.exe
  2⤵
  PID:6832
- C:\Windows\System\SdcZugW.exe
  C:\Windows\System\SdcZugW.exe
  2⤵
  PID:2232
- C:\Windows\System\vwAKixw.exe
  C:\Windows\System\vwAKixw.exe
  2⤵
  PID:6916
- C:\Windows\System\UZhUDZd.exe
  C:\Windows\System\UZhUDZd.exe
  2⤵
  PID:3480
- C:\Windows\System\JljJQqR.exe
  C:\Windows\System\JljJQqR.exe
  2⤵
  PID:6980
- C:\Windows\System\NoMWwUZ.exe
  C:\Windows\System\NoMWwUZ.exe
  2⤵
  PID:7028
- C:\Windows\System\nBlhwlY.exe
  C:\Windows\System\nBlhwlY.exe
  2⤵
  PID:7064
- C:\Windows\System\OGLHxYG.exe
  C:\Windows\System\OGLHxYG.exe
  2⤵
  PID:7084
- C:\Windows\System\AXwGkwy.exe
  C:\Windows\System\AXwGkwy.exe
  2⤵
  PID:7112
- C:\Windows\System\rEddmXW.exe
  C:\Windows\System\rEddmXW.exe
  2⤵
  PID:7140
- C:\Windows\System\pWQFbcu.exe
  C:\Windows\System\pWQFbcu.exe
  2⤵
  PID:388
- C:\Windows\System\tIltstk.exe
  C:\Windows\System\tIltstk.exe
  2⤵
  PID:2984
- C:\Windows\System\ssYGdAC.exe
  C:\Windows\System\ssYGdAC.exe
  2⤵
  PID:2748
- C:\Windows\System\ikENTmz.exe
  C:\Windows\System\ikENTmz.exe
  2⤵
  PID:3308
- C:\Windows\System\fatiydq.exe
  C:\Windows\System\fatiydq.exe
  2⤵
  PID:2024
- C:\Windows\System\UOgksvo.exe
  C:\Windows\System\UOgksvo.exe
  2⤵
  PID:4276
- C:\Windows\System\CpyDixl.exe
  C:\Windows\System\CpyDixl.exe
  2⤵
  PID:1388
- C:\Windows\System\rLyZiYB.exe
  C:\Windows\System\rLyZiYB.exe
  2⤵
  PID:4476
- C:\Windows\System\hhRQtJW.exe
  C:\Windows\System\hhRQtJW.exe
  2⤵
  PID:4436
- C:\Windows\System\ZrermdI.exe
  C:\Windows\System\ZrermdI.exe
  2⤵
  PID:2704
- C:\Windows\System\rWlukNH.exe
  C:\Windows\System\rWlukNH.exe
  2⤵
  PID:6192
- C:\Windows\System\kjWwxKf.exe
  C:\Windows\System\kjWwxKf.exe
  2⤵
  PID:6128
- C:\Windows\System\ZWgSBLW.exe
  C:\Windows\System\ZWgSBLW.exe
  2⤵
  PID:1268
- C:\Windows\System\oXFzrNe.exe
  C:\Windows\System\oXFzrNe.exe
  2⤵
  PID:6364
- C:\Windows\System\FECDPUy.exe
  C:\Windows\System\FECDPUy.exe
  2⤵
  PID:6220
- C:\Windows\System\qHIDlzn.exe
  C:\Windows\System\qHIDlzn.exe
  2⤵
  PID:6420
- C:\Windows\System\DXLPhBZ.exe
  C:\Windows\System\DXLPhBZ.exe
  2⤵
  PID:6608
- C:\Windows\System\IceTGBO.exe
  C:\Windows\System\IceTGBO.exe
  2⤵
  PID:6300
- C:\Windows\System\tOniqQh.exe
  C:\Windows\System\tOniqQh.exe
  2⤵
  PID:6308
- C:\Windows\System\rLExrjx.exe
  C:\Windows\System\rLExrjx.exe
  2⤵
  PID:6808
- C:\Windows\System\XcrbjMh.exe
  C:\Windows\System\XcrbjMh.exe
  2⤵
  PID:6888
- C:\Windows\System\Tcshxpt.exe
  C:\Windows\System\Tcshxpt.exe
  2⤵
  PID:7056
- C:\Windows\System\qwHDYlQ.exe
  C:\Windows\System\qwHDYlQ.exe
  2⤵
  PID:4332
- C:\Windows\System\vbVuGzz.exe
  C:\Windows\System\vbVuGzz.exe
  2⤵
  PID:7120
- C:\Windows\System\XwQjvCG.exe
  C:\Windows\System\XwQjvCG.exe
  2⤵
  PID:4912
- C:\Windows\System\uTfYzSF.exe
  C:\Windows\System\uTfYzSF.exe
  2⤵
  PID:3444
- C:\Windows\System\vsKkqRP.exe
  C:\Windows\System\vsKkqRP.exe
  2⤵
  PID:4776
- C:\Windows\System\QPmwXYs.exe
  C:\Windows\System\QPmwXYs.exe
  2⤵
  PID:2624
- C:\Windows\System\phvgyYO.exe
  C:\Windows\System\phvgyYO.exe
  2⤵
  PID:4104
- C:\Windows\System\hAqRWyY.exe
  C:\Windows\System\hAqRWyY.exe
  2⤵
  PID:6472
- C:\Windows\System\yiHQajN.exe
  C:\Windows\System\yiHQajN.exe
  2⤵
  PID:6556
- C:\Windows\System\bePmMEs.exe
  C:\Windows\System\bePmMEs.exe
  2⤵
  PID:4732
- C:\Windows\System\fISuTwb.exe
  C:\Windows\System\fISuTwb.exe
  2⤵
  PID:6360
- C:\Windows\System\OXDbVjn.exe
  C:\Windows\System\OXDbVjn.exe
  2⤵
  PID:1984
- C:\Windows\System\nxYzfUE.exe
  C:\Windows\System\nxYzfUE.exe
  2⤵
  PID:3572
- C:\Windows\System\ZXIukHy.exe
  C:\Windows\System\ZXIukHy.exe
  2⤵
  PID:6216
- C:\Windows\System\xqmBeHq.exe
  C:\Windows\System\xqmBeHq.exe
  2⤵
  PID:6272
- C:\Windows\System\DZqYVtm.exe
  C:\Windows\System\DZqYVtm.exe
  2⤵
  PID:6672
- C:\Windows\System\uCIHWDQ.exe
  C:\Windows\System\uCIHWDQ.exe
  2⤵
  PID:6160
- C:\Windows\System\hDHvBuB.exe
  C:\Windows\System\hDHvBuB.exe
  2⤵
  PID:6944
- C:\Windows\System\EoVGryn.exe
  C:\Windows\System\EoVGryn.exe
  2⤵
  PID:7036
- C:\Windows\System\LYohMvZ.exe
  C:\Windows\System\LYohMvZ.exe
  2⤵
  PID:7180
- C:\Windows\System\zHUYCPR.exe
  C:\Windows\System\zHUYCPR.exe
  2⤵
  PID:7200
- C:\Windows\System\sNZinao.exe
  C:\Windows\System\sNZinao.exe
  2⤵
  PID:7240
- C:\Windows\System\oFaveKn.exe
  C:\Windows\System\oFaveKn.exe
  2⤵
  PID:7276
- C:\Windows\System\pPGKByP.exe
  C:\Windows\System\pPGKByP.exe
  2⤵
  PID:7304
- C:\Windows\System\DWdWjCF.exe
  C:\Windows\System\DWdWjCF.exe
  2⤵
  PID:7332
- C:\Windows\System\vOKRHSp.exe
  C:\Windows\System\vOKRHSp.exe
  2⤵
  PID:7348
- C:\Windows\System\gOFQCgO.exe
  C:\Windows\System\gOFQCgO.exe
  2⤵
  PID:7388
- C:\Windows\System\FwlQUfJ.exe
  C:\Windows\System\FwlQUfJ.exe
  2⤵
  PID:7404
- C:\Windows\System\NjfLMuI.exe
  C:\Windows\System\NjfLMuI.exe
  2⤵
  PID:7440
- C:\Windows\System\WVkiZgY.exe
  C:\Windows\System\WVkiZgY.exe
  2⤵
  PID:7464
- C:\Windows\System\NKWIRhz.exe
  C:\Windows\System\NKWIRhz.exe
  2⤵
  PID:7488
- C:\Windows\System\HtxLtCG.exe
  C:\Windows\System\HtxLtCG.exe
  2⤵
  PID:7516
- C:\Windows\System\tjtHDKo.exe
  C:\Windows\System\tjtHDKo.exe
  2⤵
  PID:7544
- C:\Windows\System\PaGEBAk.exe
  C:\Windows\System\PaGEBAk.exe
  2⤵
  PID:7572
- C:\Windows\System\SPRafRA.exe
  C:\Windows\System\SPRafRA.exe
  2⤵
  PID:7600
- C:\Windows\System\PbuMGQp.exe
  C:\Windows\System\PbuMGQp.exe
  2⤵
  PID:7628
- C:\Windows\System\ofJAALF.exe
  C:\Windows\System\ofJAALF.exe
  2⤵
  PID:7656
- C:\Windows\System\mhErtRD.exe
  C:\Windows\System\mhErtRD.exe
  2⤵
  PID:7684
- C:\Windows\System\umlYCeY.exe
  C:\Windows\System\umlYCeY.exe
  2⤵
  PID:7712
- C:\Windows\System\JosGRZV.exe
  C:\Windows\System\JosGRZV.exe
  2⤵
  PID:7752
- C:\Windows\System\ilNHGAa.exe
  C:\Windows\System\ilNHGAa.exe
  2⤵
  PID:7780
- C:\Windows\System\GCeWZRv.exe
  C:\Windows\System\GCeWZRv.exe
  2⤵
  PID:7808
- C:\Windows\System\BiVKoHB.exe
  C:\Windows\System\BiVKoHB.exe
  2⤵
  PID:7836
- C:\Windows\System\CLmuomG.exe
  C:\Windows\System\CLmuomG.exe
  2⤵
  PID:7852
- C:\Windows\System\MuCzDZu.exe
  C:\Windows\System\MuCzDZu.exe
  2⤵
  PID:7880
- C:\Windows\System\YlMBkdG.exe
  C:\Windows\System\YlMBkdG.exe
  2⤵
  PID:7908
- C:\Windows\System\AfvqTgY.exe
  C:\Windows\System\AfvqTgY.exe
  2⤵
  PID:7936
- C:\Windows\System\GyKXfEN.exe
  C:\Windows\System\GyKXfEN.exe
  2⤵
  PID:7964
- C:\Windows\System\FuWHvuE.exe
  C:\Windows\System\FuWHvuE.exe
  2⤵
  PID:7992
- C:\Windows\System\EZVYVMA.exe
  C:\Windows\System\EZVYVMA.exe
  2⤵
  PID:8020
- C:\Windows\System\szfYXST.exe
  C:\Windows\System\szfYXST.exe
  2⤵
  PID:8048
- C:\Windows\System\DOhkUko.exe
  C:\Windows\System\DOhkUko.exe
  2⤵
  PID:8080
- C:\Windows\System\EadQVrK.exe
  C:\Windows\System\EadQVrK.exe
  2⤵
  PID:8104
- C:\Windows\System\sGOQCwv.exe
  C:\Windows\System\sGOQCwv.exe
  2⤵
  PID:8144
- C:\Windows\System\AxpKPVX.exe
  C:\Windows\System\AxpKPVX.exe
  2⤵
  PID:8160
- C:\Windows\System\yzDvUig.exe
  C:\Windows\System\yzDvUig.exe
  2⤵
  PID:7188
- C:\Windows\System\LtxrOec.exe
  C:\Windows\System\LtxrOec.exe
  2⤵
  PID:7236
- C:\Windows\System\SfXimOn.exe
  C:\Windows\System\SfXimOn.exe
  2⤵
  PID:7316
- C:\Windows\System\QnumHeb.exe
  C:\Windows\System\QnumHeb.exe
  2⤵
  PID:7368
- C:\Windows\System\jwORTai.exe
  C:\Windows\System\jwORTai.exe
  2⤵
  PID:7420
- C:\Windows\System\xFXiJCF.exe
  C:\Windows\System\xFXiJCF.exe
  2⤵
  PID:7528
- C:\Windows\System\OERZsop.exe
  C:\Windows\System\OERZsop.exe
  2⤵
  PID:7564
- C:\Windows\System\hrDZRjl.exe
  C:\Windows\System\hrDZRjl.exe
  2⤵
  PID:7644
- C:\Windows\System\hiDFwhD.exe
  C:\Windows\System\hiDFwhD.exe
  2⤵
  PID:7708
- C:\Windows\System\TTrqRjM.exe
  C:\Windows\System\TTrqRjM.exe
  2⤵
  PID:7748
- C:\Windows\System\mNLibop.exe
  C:\Windows\System\mNLibop.exe
  2⤵
  PID:7848
- C:\Windows\System\IIyMYUz.exe
  C:\Windows\System\IIyMYUz.exe
  2⤵
  PID:7896
- C:\Windows\System\EGIWxDX.exe
  C:\Windows\System\EGIWxDX.exe
  2⤵
  PID:7976
- C:\Windows\System\oJDgsDb.exe
  C:\Windows\System\oJDgsDb.exe
  2⤵
  PID:8012
- C:\Windows\System\evZQOOL.exe
  C:\Windows\System\evZQOOL.exe
  2⤵
  PID:8060
- C:\Windows\System\mzvwejK.exe
  C:\Windows\System\mzvwejK.exe
  2⤵
  PID:8120
- C:\Windows\System\yEYCeWy.exe
  C:\Windows\System\yEYCeWy.exe
  2⤵
  PID:8180
- C:\Windows\System\DVRfMVn.exe
  C:\Windows\System\DVRfMVn.exe
  2⤵
  PID:7360
- C:\Windows\System\iSaebZo.exe
  C:\Windows\System\iSaebZo.exe
  2⤵
  PID:7476
- C:\Windows\System\TvBHdfO.exe
  C:\Windows\System\TvBHdfO.exe
  2⤵
  PID:7680
- C:\Windows\System\YhHfeBk.exe
  C:\Windows\System\YhHfeBk.exe
  2⤵
  PID:7828
- C:\Windows\System\iFETZUc.exe
  C:\Windows\System\iFETZUc.exe
  2⤵
  PID:7956
- C:\Windows\System\etdUgXT.exe
  C:\Windows\System\etdUgXT.exe
  2⤵
  PID:8156
- C:\Windows\System\dNugYgj.exe
  C:\Windows\System\dNugYgj.exe
  2⤵
  PID:7396
- C:\Windows\System\zdMvOPM.exe
  C:\Windows\System\zdMvOPM.exe
  2⤵
  PID:7868
- C:\Windows\System\YRirxPv.exe
  C:\Windows\System\YRirxPv.exe
  2⤵
  PID:7232
- C:\Windows\System\baysqnF.exe
  C:\Windows\System\baysqnF.exe
  2⤵
  PID:8140
- C:\Windows\System\ljATcai.exe
  C:\Windows\System\ljATcai.exe
  2⤵
  PID:8200
- C:\Windows\System\rBFkpVD.exe
  C:\Windows\System\rBFkpVD.exe
  2⤵
  PID:8228
- C:\Windows\System\CDIbqqp.exe
  C:\Windows\System\CDIbqqp.exe
  2⤵
  PID:8252
- C:\Windows\System\lnVhtcz.exe
  C:\Windows\System\lnVhtcz.exe
  2⤵
  PID:8276
- C:\Windows\System\gDjbuIh.exe
  C:\Windows\System\gDjbuIh.exe
  2⤵
  PID:8316
- C:\Windows\System\PFmyfaP.exe
  C:\Windows\System\PFmyfaP.exe
  2⤵
  PID:8332
- C:\Windows\System\bUEghPt.exe
  C:\Windows\System\bUEghPt.exe
  2⤵
  PID:8360
- C:\Windows\System\TcHWAnQ.exe
  C:\Windows\System\TcHWAnQ.exe
  2⤵
  PID:8400
- C:\Windows\System\lmzmuFI.exe
  C:\Windows\System\lmzmuFI.exe
  2⤵
  PID:8428
- C:\Windows\System\hzUdGrV.exe
  C:\Windows\System\hzUdGrV.exe
  2⤵
  PID:8456
- C:\Windows\System\oIpFjTK.exe
  C:\Windows\System\oIpFjTK.exe
  2⤵
  PID:8476
- C:\Windows\System\PXWgSHq.exe
  C:\Windows\System\PXWgSHq.exe
  2⤵
  PID:8496
- C:\Windows\System\SEwhEvH.exe
  C:\Windows\System\SEwhEvH.exe
  2⤵
  PID:8520
- C:\Windows\System\eWQTGLB.exe
  C:\Windows\System\eWQTGLB.exe
  2⤵
  PID:8544
- C:\Windows\System\XZgeNYo.exe
  C:\Windows\System\XZgeNYo.exe
  2⤵
  PID:8568
- C:\Windows\System\TkAUorD.exe
  C:\Windows\System\TkAUorD.exe
  2⤵
  PID:8596
- C:\Windows\System\JswJvkr.exe
  C:\Windows\System\JswJvkr.exe
  2⤵
  PID:8628
- C:\Windows\System\HzUnMIR.exe
  C:\Windows\System\HzUnMIR.exe
  2⤵
  PID:8644
- C:\Windows\System\qwmdgtG.exe
  C:\Windows\System\qwmdgtG.exe
  2⤵
  PID:8668
- C:\Windows\System\IAxSpqa.exe
  C:\Windows\System\IAxSpqa.exe
  2⤵
  PID:8736
- C:\Windows\System\ksNINfp.exe
  C:\Windows\System\ksNINfp.exe
  2⤵
  PID:8752
- C:\Windows\System\ZOcBhAn.exe
  C:\Windows\System\ZOcBhAn.exe
  2⤵
  PID:8768
- C:\Windows\System\YVXcXZe.exe
  C:\Windows\System\YVXcXZe.exe
  2⤵
  PID:8788
- C:\Windows\System\dAXYKFq.exe
  C:\Windows\System\dAXYKFq.exe
  2⤵
  PID:8832
- C:\Windows\System\lIDjDVQ.exe
  C:\Windows\System\lIDjDVQ.exe
  2⤵
  PID:8864
- C:\Windows\System\JpheCQe.exe
  C:\Windows\System\JpheCQe.exe
  2⤵
  PID:8880
- C:\Windows\System\mTsStdx.exe
  C:\Windows\System\mTsStdx.exe
  2⤵
  PID:8908
- C:\Windows\System\osKhLfg.exe
  C:\Windows\System\osKhLfg.exe
  2⤵
  PID:8936
- C:\Windows\System\TIBnJgA.exe
  C:\Windows\System\TIBnJgA.exe
  2⤵
  PID:8956
- C:\Windows\System\EiTemms.exe
  C:\Windows\System\EiTemms.exe
  2⤵
  PID:8980
- C:\Windows\System\oMMTHzw.exe
  C:\Windows\System\oMMTHzw.exe
  2⤵
  PID:9004
- C:\Windows\System\HIMRYSc.exe
  C:\Windows\System\HIMRYSc.exe
  2⤵
  PID:9036
- C:\Windows\System\rYfvEIA.exe
  C:\Windows\System\rYfvEIA.exe
  2⤵
  PID:9084
- C:\Windows\System\ZcGVMMk.exe
  C:\Windows\System\ZcGVMMk.exe
  2⤵
  PID:9112
- C:\Windows\System\YzJswHv.exe
  C:\Windows\System\YzJswHv.exe
  2⤵
  PID:9144
- C:\Windows\System\ZUQKRvC.exe
  C:\Windows\System\ZUQKRvC.exe
  2⤵
  PID:9184
- C:\Windows\System\WkCLCcO.exe
  C:\Windows\System\WkCLCcO.exe
  2⤵
  PID:9204
- C:\Windows\System\sXaFJWQ.exe
  C:\Windows\System\sXaFJWQ.exe
  2⤵
  PID:8248
- C:\Windows\System\KtkjIBW.exe
  C:\Windows\System\KtkjIBW.exe
  2⤵
  PID:8312
- C:\Windows\System\drOWTWc.exe
  C:\Windows\System\drOWTWc.exe
  2⤵
  PID:8344
- C:\Windows\System\ROnwDLs.exe
  C:\Windows\System\ROnwDLs.exe
  2⤵
  PID:8420
- C:\Windows\System\aifhvDO.exe
  C:\Windows\System\aifhvDO.exe
  2⤵
  PID:8484
- C:\Windows\System\TsDGxLd.exe
  C:\Windows\System\TsDGxLd.exe
  2⤵
  PID:8536
- C:\Windows\System\VScdkEm.exe
  C:\Windows\System\VScdkEm.exe
  2⤵
  PID:8636
- C:\Windows\System\ZnbApYL.exe
  C:\Windows\System\ZnbApYL.exe
  2⤵
  PID:8640
- C:\Windows\System\KnNSgPU.exe
  C:\Windows\System\KnNSgPU.exe
  2⤵
  PID:8732
- C:\Windows\System\NERgsBo.exe
  C:\Windows\System\NERgsBo.exe
  2⤵
  PID:8716
- C:\Windows\System\PzwCswt.exe
  C:\Windows\System\PzwCswt.exe
  2⤵
  PID:8848
- C:\Windows\System\mGCNbaX.exe
  C:\Windows\System\mGCNbaX.exe
  2⤵
  PID:8892
- C:\Windows\System\GHLWmxs.exe
  C:\Windows\System\GHLWmxs.exe
  2⤵
  PID:9060
- C:\Windows\System\HnQlTSC.exe
  C:\Windows\System\HnQlTSC.exe
  2⤵
  PID:9096
- C:\Windows\System\UlNTbXF.exe
  C:\Windows\System\UlNTbXF.exe
  2⤵
  PID:9172
- C:\Windows\System\pVXsTQE.exe
  C:\Windows\System\pVXsTQE.exe
  2⤵
  PID:8240
- C:\Windows\System\WkvbrsL.exe
  C:\Windows\System\WkvbrsL.exe
  2⤵
  PID:8396
- C:\Windows\System\YxYxkYZ.exe
  C:\Windows\System\YxYxkYZ.exe
  2⤵
  PID:8580
- C:\Windows\System\HKNrIMZ.exe
  C:\Windows\System\HKNrIMZ.exe
  2⤵
  PID:8700
- C:\Windows\System\glGrxZk.exe
  C:\Windows\System\glGrxZk.exe
  2⤵
  PID:8708
- C:\Windows\System\PmRjNTJ.exe
  C:\Windows\System\PmRjNTJ.exe
  2⤵
  PID:8872
- C:\Windows\System\LsvQYTt.exe
  C:\Windows\System\LsvQYTt.exe
  2⤵
  PID:8992
- C:\Windows\System\QZXRecn.exe
  C:\Windows\System\QZXRecn.exe
  2⤵
  PID:8296
- C:\Windows\System\kZWXHAC.exe
  C:\Windows\System\kZWXHAC.exe
  2⤵
  PID:8616
- C:\Windows\System\GFJQbmf.exe
  C:\Windows\System\GFJQbmf.exe
  2⤵
  PID:8996
- C:\Windows\System\nTCGdIu.exe
  C:\Windows\System\nTCGdIu.exe
  2⤵
  PID:8324
- C:\Windows\System\AEcJoiK.exe
  C:\Windows\System\AEcJoiK.exe
  2⤵
  PID:9220
- C:\Windows\System\rVVYQlE.exe
  C:\Windows\System\rVVYQlE.exe
  2⤵
  PID:9236
- C:\Windows\System\MInCpCA.exe
  C:\Windows\System\MInCpCA.exe
  2⤵
  PID:9264
- C:\Windows\System\HckfPkX.exe
  C:\Windows\System\HckfPkX.exe
  2⤵
  PID:9292
- C:\Windows\System\SMljKnq.exe
  C:\Windows\System\SMljKnq.exe
  2⤵
  PID:9308
- C:\Windows\System\PufFjtp.exe
  C:\Windows\System\PufFjtp.exe
  2⤵
  PID:9336
- C:\Windows\System\ojKSpBa.exe
  C:\Windows\System\ojKSpBa.exe
  2⤵
  PID:9368
- C:\Windows\System\AsFRCrV.exe
  C:\Windows\System\AsFRCrV.exe
  2⤵
  PID:9400
- C:\Windows\System\dGvRlvr.exe
  C:\Windows\System\dGvRlvr.exe
  2⤵
  PID:9424
- C:\Windows\System\HsOrQGt.exe
  C:\Windows\System\HsOrQGt.exe
  2⤵
  PID:9452
- C:\Windows\System\IAYagch.exe
  C:\Windows\System\IAYagch.exe
  2⤵
  PID:9492
- C:\Windows\System\CRuhjey.exe
  C:\Windows\System\CRuhjey.exe
  2⤵
  PID:9520
- C:\Windows\System\MKeRVNA.exe
  C:\Windows\System\MKeRVNA.exe
  2⤵
  PID:9536
- C:\Windows\System\VBCjMHD.exe
  C:\Windows\System\VBCjMHD.exe
  2⤵
  PID:9596
- C:\Windows\System\pkyJICG.exe
  C:\Windows\System\pkyJICG.exe
  2⤵
  PID:9624
- C:\Windows\System\GJxjyyc.exe
  C:\Windows\System\GJxjyyc.exe
  2⤵
  PID:9656
- C:\Windows\System\ZtBQkbj.exe
  C:\Windows\System\ZtBQkbj.exe
  2⤵
  PID:9688
- C:\Windows\System\FfkLKUV.exe
  C:\Windows\System\FfkLKUV.exe
  2⤵
  PID:9704
- C:\Windows\System\ApTVUfA.exe
  C:\Windows\System\ApTVUfA.exe
  2⤵
  PID:9724
- C:\Windows\System\XiyqRSV.exe
  C:\Windows\System\XiyqRSV.exe
  2⤵
  PID:9752
- C:\Windows\System\jNlpTwc.exe
  C:\Windows\System\jNlpTwc.exe
  2⤵
  PID:9784
- C:\Windows\System\ZmNQQBA.exe
  C:\Windows\System\ZmNQQBA.exe
  2⤵
  PID:9808
- C:\Windows\System\NBQtSRC.exe
  C:\Windows\System\NBQtSRC.exe
  2⤵
  PID:9832
- C:\Windows\System\ECHHvZe.exe
  C:\Windows\System\ECHHvZe.exe
  2⤵
  PID:9848
- C:\Windows\System\purfSzO.exe
  C:\Windows\System\purfSzO.exe
  2⤵
  PID:9884
- C:\Windows\System\WRTPRTG.exe
  C:\Windows\System\WRTPRTG.exe
  2⤵
  PID:9944
- C:\Windows\System\cwZhzKD.exe
  C:\Windows\System\cwZhzKD.exe
  2⤵
  PID:9960
- C:\Windows\System\eghVNvt.exe
  C:\Windows\System\eghVNvt.exe
  2⤵
  PID:9988
- C:\Windows\System\fxlMFCT.exe
  C:\Windows\System\fxlMFCT.exe
  2⤵
  PID:10016
- C:\Windows\System\hWnNEfl.exe
  C:\Windows\System\hWnNEfl.exe
  2⤵
  PID:10044
- C:\Windows\System\UjtTGXF.exe
  C:\Windows\System\UjtTGXF.exe
  2⤵
  PID:10064
- C:\Windows\System\TdjxRvq.exe
  C:\Windows\System\TdjxRvq.exe
  2⤵
  PID:10092
- C:\Windows\System\RnOQceT.exe
  C:\Windows\System\RnOQceT.exe
  2⤵
  PID:10124
- C:\Windows\System\IutZPOU.exe
  C:\Windows\System\IutZPOU.exe
  2⤵
  PID:10160
- C:\Windows\System\QINhXMP.exe
  C:\Windows\System\QINhXMP.exe
  2⤵
  PID:10176
- C:\Windows\System\WfFBLhG.exe
  C:\Windows\System\WfFBLhG.exe
  2⤵
  PID:10200
- C:\Windows\System\zbwgrNB.exe
  C:\Windows\System\zbwgrNB.exe
  2⤵
  PID:9228
- C:\Windows\System\eHPNFOK.exe
  C:\Windows\System\eHPNFOK.exe
  2⤵
  PID:9252
- C:\Windows\System\cPccEvp.exe
  C:\Windows\System\cPccEvp.exe
  2⤵
  PID:9320
- C:\Windows\System\WSimQPY.exe
  C:\Windows\System\WSimQPY.exe
  2⤵
  PID:9412
- C:\Windows\System\vnsIhdu.exe
  C:\Windows\System\vnsIhdu.exe
  2⤵
  PID:9508
- C:\Windows\System\TctMvlO.exe
  C:\Windows\System\TctMvlO.exe
  2⤵
  PID:9580
- C:\Windows\System\HyiFlsN.exe
  C:\Windows\System\HyiFlsN.exe
  2⤵
  PID:9668
- C:\Windows\System\RkmACdk.exe
  C:\Windows\System\RkmACdk.exe
  2⤵
  PID:9716
- C:\Windows\System\JHNvDNe.exe
  C:\Windows\System\JHNvDNe.exe
  2⤵
  PID:9800
- C:\Windows\System\wKDtdLn.exe
  C:\Windows\System\wKDtdLn.exe
  2⤵
  PID:9820
- C:\Windows\System\icHQgXN.exe
  C:\Windows\System\icHQgXN.exe
  2⤵
  PID:8904
- C:\Windows\System\MYYFaro.exe
  C:\Windows\System\MYYFaro.exe
  2⤵
  PID:9940
- C:\Windows\System\CwJzTNS.exe
  C:\Windows\System\CwJzTNS.exe
  2⤵
  PID:10004
- C:\Windows\System\kOTVRTI.exe
  C:\Windows\System\kOTVRTI.exe
  2⤵
  PID:10080
- C:\Windows\System\xiLimbp.exe
  C:\Windows\System\xiLimbp.exe
  2⤵
  PID:10152
- C:\Windows\System\tUBriAZ.exe
  C:\Windows\System\tUBriAZ.exe
  2⤵
  PID:10212
- C:\Windows\System\TyDNeta.exe
  C:\Windows\System\TyDNeta.exe
  2⤵
  PID:9356
- C:\Windows\System\nDWJQMM.exe
  C:\Windows\System\nDWJQMM.exe
  2⤵
  PID:9380
- C:\Windows\System\lwQmEYQ.exe
  C:\Windows\System\lwQmEYQ.exe
  2⤵
  PID:9648
- C:\Windows\System\FQVivGy.exe
  C:\Windows\System\FQVivGy.exe
  2⤵
  PID:9776
- C:\Windows\System\zOLQJBE.exe
  C:\Windows\System\zOLQJBE.exe
  2⤵
  PID:9976
- C:\Windows\System\pYZTsIO.exe
  C:\Windows\System\pYZTsIO.exe
  2⤵
  PID:10076
- C:\Windows\System\XcgCvBZ.exe
  C:\Windows\System\XcgCvBZ.exe
  2⤵
  PID:7268
- C:\Windows\System\zLmabAc.exe
  C:\Windows\System\zLmabAc.exe
  2⤵
  PID:9392
- C:\Windows\System\yLjuTdb.exe
  C:\Windows\System\yLjuTdb.exe
  2⤵
  PID:9676
- C:\Windows\System\iUhcuei.exe
  C:\Windows\System\iUhcuei.exe
  2⤵
  PID:10168
- C:\Windows\System\TaqRWQg.exe
  C:\Windows\System\TaqRWQg.exe
  2⤵
  PID:9916
- C:\Windows\System\LzogJlF.exe
  C:\Windows\System\LzogJlF.exe
  2⤵
  PID:10252
- C:\Windows\System\fjuQuXt.exe
  C:\Windows\System\fjuQuXt.exe
  2⤵
  PID:10280
- C:\Windows\System\ickLXdP.exe
  C:\Windows\System\ickLXdP.exe
  2⤵
  PID:10296
- C:\Windows\System\hVSUfkB.exe
  C:\Windows\System\hVSUfkB.exe
  2⤵
  PID:10336
- C:\Windows\System\yxXxgny.exe
  C:\Windows\System\yxXxgny.exe
  2⤵
  PID:10352
- C:\Windows\System\oWsQdBR.exe
  C:\Windows\System\oWsQdBR.exe
  2⤵
  PID:10372
- C:\Windows\System\xhYvRoO.exe
  C:\Windows\System\xhYvRoO.exe
  2⤵
  PID:10408
- C:\Windows\System\wRWzLau.exe
  C:\Windows\System\wRWzLau.exe
  2⤵
  PID:10452
- C:\Windows\System\muTKmAk.exe
  C:\Windows\System\muTKmAk.exe
  2⤵
  PID:10476
- C:\Windows\System\OYHtEIN.exe
  C:\Windows\System\OYHtEIN.exe
  2⤵
  PID:10496
- C:\Windows\System\CcjnoEe.exe
  C:\Windows\System\CcjnoEe.exe
  2⤵
  PID:10524
- C:\Windows\System\hXaRzKM.exe
  C:\Windows\System\hXaRzKM.exe
  2⤵
  PID:10548
- C:\Windows\System\LLLxkvz.exe
  C:\Windows\System\LLLxkvz.exe
  2⤵
  PID:10568
- C:\Windows\System\LUDurQS.exe
  C:\Windows\System\LUDurQS.exe
  2⤵
  PID:10612
- C:\Windows\System\oqrWEdq.exe
  C:\Windows\System\oqrWEdq.exe
  2⤵
  PID:10648
- C:\Windows\System\qpoIzDZ.exe
  C:\Windows\System\qpoIzDZ.exe
  2⤵
  PID:10676
- C:\Windows\System\VIHQJUA.exe
  C:\Windows\System\VIHQJUA.exe
  2⤵
  PID:10704
- C:\Windows\System\KvOqBam.exe
  C:\Windows\System\KvOqBam.exe
  2⤵
  PID:10732
- C:\Windows\System\ygulngj.exe
  C:\Windows\System\ygulngj.exe
  2⤵
  PID:10760
- C:\Windows\System\ZCkKDnn.exe
  C:\Windows\System\ZCkKDnn.exe
  2⤵
  PID:10788
- C:\Windows\System\WvLZfhC.exe
  C:\Windows\System\WvLZfhC.exe
  2⤵
  PID:10816
- C:\Windows\System\qgibkWl.exe
  C:\Windows\System\qgibkWl.exe
  2⤵
  PID:10844
- C:\Windows\System\IgomodQ.exe
  C:\Windows\System\IgomodQ.exe
  2⤵
  PID:10860
- C:\Windows\System\rfAzsZO.exe
  C:\Windows\System\rfAzsZO.exe
  2⤵
  PID:10888
- C:\Windows\System\wGlVFCJ.exe
  C:\Windows\System\wGlVFCJ.exe
  2⤵
  PID:10916
- C:\Windows\System\BUAXAzQ.exe
  C:\Windows\System\BUAXAzQ.exe
  2⤵
  PID:10952
- C:\Windows\System\cQYWBeo.exe
  C:\Windows\System\cQYWBeo.exe
  2⤵
  PID:10972
- C:\Windows\System\XlfYKsv.exe
  C:\Windows\System\XlfYKsv.exe
  2⤵
  PID:11004
- C:\Windows\System\SuKGErL.exe
  C:\Windows\System\SuKGErL.exe
  2⤵
  PID:11028
- C:\Windows\System\kcuWdtA.exe
  C:\Windows\System\kcuWdtA.exe
  2⤵
  PID:11060
- C:\Windows\System\SPxUQYc.exe
  C:\Windows\System\SPxUQYc.exe
  2⤵
  PID:11088
- C:\Windows\System\eHFxCGL.exe
  C:\Windows\System\eHFxCGL.exe
  2⤵
  PID:11108
- C:\Windows\System\PADbCUd.exe
  C:\Windows\System\PADbCUd.exe
  2⤵
  PID:11136
- C:\Windows\System\GmQfxYq.exe
  C:\Windows\System\GmQfxYq.exe
  2⤵
  PID:11188
- C:\Windows\System\dvhuJro.exe
  C:\Windows\System\dvhuJro.exe
  2⤵
  PID:11204
- C:\Windows\System\nyaoYgu.exe
  C:\Windows\System\nyaoYgu.exe
  2⤵
  PID:11232
- C:\Windows\System\vMEDPKi.exe
  C:\Windows\System\vMEDPKi.exe
  2⤵
  PID:11260
- C:\Windows\System\RJpQEsP.exe
  C:\Windows\System\RJpQEsP.exe
  2⤵
  PID:10292
- C:\Windows\System\MGrwFOU.exe
  C:\Windows\System\MGrwFOU.exe
  2⤵
  PID:10348
- C:\Windows\System\fsBUfvw.exe
  C:\Windows\System\fsBUfvw.exe
  2⤵
  PID:10432
- C:\Windows\System\aJxFvSx.exe
  C:\Windows\System\aJxFvSx.exe
  2⤵
  PID:10468
- C:\Windows\System\zviWMRn.exe
  C:\Windows\System\zviWMRn.exe
  2⤵
  PID:10512
- C:\Windows\System\ybpQpCy.exe
  C:\Windows\System\ybpQpCy.exe
  2⤵
  PID:10588
- C:\Windows\System\jwOtiRU.exe
  C:\Windows\System\jwOtiRU.exe
  2⤵
  PID:10660
- C:\Windows\System\hXJLzVo.exe
  C:\Windows\System\hXJLzVo.exe
  2⤵
  PID:10772
- C:\Windows\System\KCXFYmy.exe
  C:\Windows\System\KCXFYmy.exe
  2⤵
  PID:10808
- C:\Windows\System\NZCGepA.exe
  C:\Windows\System\NZCGepA.exe
  2⤵
  PID:10856
- C:\Windows\System\oaVroat.exe
  C:\Windows\System\oaVroat.exe
  2⤵
  PID:10904
- C:\Windows\System\ndVpzdM.exe
  C:\Windows\System\ndVpzdM.exe
  2⤵
  PID:10988
- C:\Windows\System\gOiWmly.exe
  C:\Windows\System\gOiWmly.exe
  2⤵
  PID:11072
- C:\Windows\System\DtSQVBI.exe
  C:\Windows\System\DtSQVBI.exe
  2⤵
  PID:11116
- C:\Windows\System\ZwthAVS.exe
  C:\Windows\System\ZwthAVS.exe
  2⤵
  PID:11184
- C:\Windows\System\iONraAj.exe
  C:\Windows\System\iONraAj.exe
  2⤵
  PID:11248
- C:\Windows\System\isvuETE.exe
  C:\Windows\System\isvuETE.exe
  2⤵
  PID:4560
- C:\Windows\System\rZFkapx.exe
  C:\Windows\System\rZFkapx.exe
  2⤵
  PID:10428
- C:\Windows\System\GFSDKno.exe
  C:\Windows\System\GFSDKno.exe
  2⤵
  PID:10560
- C:\Windows\System\rhfSNVD.exe
  C:\Windows\System\rhfSNVD.exe
  2⤵
  PID:10636
- C:\Windows\System\SqRfTQt.exe
  C:\Windows\System\SqRfTQt.exe
  2⤵
  PID:10800
- C:\Windows\System\LWVtSms.exe
  C:\Windows\System\LWVtSms.exe
  2⤵
  PID:10872
- C:\Windows\System\rdpbALt.exe
  C:\Windows\System\rdpbALt.exe
  2⤵
  PID:11084
- C:\Windows\System\ajdFQvl.exe
  C:\Windows\System\ajdFQvl.exe
  2⤵
  PID:892
- C:\Windows\System\NTNVHSz.exe
  C:\Windows\System\NTNVHSz.exe
  2⤵
  PID:10728
- C:\Windows\System\iXRCOKA.exe
  C:\Windows\System\iXRCOKA.exe
  2⤵
  PID:10968
- C:\Windows\System\XLzIYQX.exe
  C:\Windows\System\XLzIYQX.exe
  2⤵
  PID:10884
- C:\Windows\System\QtYBbej.exe
  C:\Windows\System\QtYBbej.exe
  2⤵
  PID:11128
- C:\Windows\System\BCrYZSu.exe
  C:\Windows\System\BCrYZSu.exe
  2⤵
  PID:11304
- C:\Windows\System\VOYuMNV.exe
  C:\Windows\System\VOYuMNV.exe
  2⤵
  PID:11320
- C:\Windows\System\PEgQgyK.exe
  C:\Windows\System\PEgQgyK.exe
  2⤵
  PID:11348
- C:\Windows\System\cWqnyFv.exe
  C:\Windows\System\cWqnyFv.exe
  2⤵
  PID:11388
- C:\Windows\System\uHosvAL.exe
  C:\Windows\System\uHosvAL.exe
  2⤵
  PID:11416
- C:\Windows\System\xxsnrNg.exe
  C:\Windows\System\xxsnrNg.exe
  2⤵
  PID:11444
- C:\Windows\System\anRlWIY.exe
  C:\Windows\System\anRlWIY.exe
  2⤵
  PID:11472
- C:\Windows\System\AfXCgdT.exe
  C:\Windows\System\AfXCgdT.exe
  2⤵
  PID:11492
- C:\Windows\System\NiPXPAg.exe
  C:\Windows\System\NiPXPAg.exe
  2⤵
  PID:11516
- C:\Windows\System\lvSnIZn.exe
  C:\Windows\System\lvSnIZn.exe
  2⤵
  PID:11556
- C:\Windows\System\eoFsqLb.exe
  C:\Windows\System\eoFsqLb.exe
  2⤵
  PID:11584
- C:\Windows\System\edsetHu.exe
  C:\Windows\System\edsetHu.exe
  2⤵
  PID:11612
- C:\Windows\System\SkGdvDw.exe
  C:\Windows\System\SkGdvDw.exe
  2⤵
  PID:11640
- C:\Windows\System\wAomlya.exe
  C:\Windows\System\wAomlya.exe
  2⤵
  PID:11668
- C:\Windows\System\lHyrqTZ.exe
  C:\Windows\System\lHyrqTZ.exe
  2⤵
  PID:11696
- C:\Windows\System\MgTMXOL.exe
  C:\Windows\System\MgTMXOL.exe
  2⤵
  PID:11716
- C:\Windows\System\RNCauDO.exe
  C:\Windows\System\RNCauDO.exe
  2⤵
  PID:11752
- C:\Windows\System\QHOVvgZ.exe
  C:\Windows\System\QHOVvgZ.exe
  2⤵
  PID:11772
- C:\Windows\System\bkPadHq.exe
  C:\Windows\System\bkPadHq.exe
  2⤵
  PID:11796
- C:\Windows\System\sZjVZyg.exe
  C:\Windows\System\sZjVZyg.exe
  2⤵
  PID:11816
- C:\Windows\System\hJEYMDe.exe
  C:\Windows\System\hJEYMDe.exe
  2⤵
  PID:11844
- C:\Windows\System\WqvZoIy.exe
  C:\Windows\System\WqvZoIy.exe
  2⤵
  PID:11872
- C:\Windows\System\wBnqWiN.exe
  C:\Windows\System\wBnqWiN.exe
  2⤵
  PID:11904
- C:\Windows\System\kscXCPc.exe
  C:\Windows\System\kscXCPc.exe
  2⤵
  PID:11932
- C:\Windows\System\jiLpeJr.exe
  C:\Windows\System\jiLpeJr.exe
  2⤵
  PID:11980
- C:\Windows\System\GUXgwYJ.exe
  C:\Windows\System\GUXgwYJ.exe
  2⤵
  PID:12004
- C:\Windows\System\wBTZBjv.exe
  C:\Windows\System\wBTZBjv.exe
  2⤵
  PID:12032
- C:\Windows\System\APDDFFO.exe
  C:\Windows\System\APDDFFO.exe
  2⤵
  PID:12064
- C:\Windows\System\tRoDdoK.exe
  C:\Windows\System\tRoDdoK.exe
  2⤵
  PID:12092
- C:\Windows\System\VxGNczp.exe
  C:\Windows\System\VxGNczp.exe
  2⤵
  PID:12108
- C:\Windows\System\AQyYgvW.exe
  C:\Windows\System\AQyYgvW.exe
  2⤵
  PID:12132
- C:\Windows\System\IxijJOb.exe
  C:\Windows\System\IxijJOb.exe
  2⤵
  PID:12164
- C:\Windows\System\NJhfGgU.exe
  C:\Windows\System\NJhfGgU.exe
  2⤵
  PID:12192
- C:\Windows\System\eGWLFZw.exe
  C:\Windows\System\eGWLFZw.exe
  2⤵
  PID:12224
- C:\Windows\System\UOoeZEs.exe
  C:\Windows\System\UOoeZEs.exe
  2⤵
  PID:12248
- C:\Windows\System\rJnCvoP.exe
  C:\Windows\System\rJnCvoP.exe
  2⤵
  PID:12276
- C:\Windows\System\cFEIjLh.exe
  C:\Windows\System\cFEIjLh.exe
  2⤵
  PID:11288
- C:\Windows\System\GlyleMH.exe
  C:\Windows\System\GlyleMH.exe
  2⤵
  PID:11332
- C:\Windows\System\AQiNWNd.exe
  C:\Windows\System\AQiNWNd.exe
  2⤵
  PID:11408
- C:\Windows\System\WvKCxJa.exe
  C:\Windows\System\WvKCxJa.exe
  2⤵
  PID:11456
- C:\Windows\System\uUbunkp.exe
  C:\Windows\System\uUbunkp.exe
  2⤵
  PID:11512
- C:\Windows\System\BsXHdwX.exe
  C:\Windows\System\BsXHdwX.exe
  2⤵
  PID:11552
- C:\Windows\System\RUVzeyT.exe
  C:\Windows\System\RUVzeyT.exe
  2⤵
  PID:11632
- C:\Windows\System\DPYbYUS.exe
  C:\Windows\System\DPYbYUS.exe
  2⤵
  PID:11740
- C:\Windows\System\HLDeEzF.exe
  C:\Windows\System\HLDeEzF.exe
  2⤵
  PID:11824
- C:\Windows\System\FlJJLcH.exe
  C:\Windows\System\FlJJLcH.exe
  2⤵
  PID:11812
- C:\Windows\System\VMHYWuS.exe
  C:\Windows\System\VMHYWuS.exe
  2⤵
  PID:11948
- C:\Windows\System\LpolarX.exe
  C:\Windows\System\LpolarX.exe
  2⤵
  PID:11992
- C:\Windows\System\pEWiVze.exe
  C:\Windows\System\pEWiVze.exe
  2⤵
  PID:12056
- C:\Windows\System\DpiWtDD.exe
  C:\Windows\System\DpiWtDD.exe
  2⤵
  PID:12104
- C:\Windows\System\ZEJXpDT.exe
  C:\Windows\System\ZEJXpDT.exe
  2⤵
  PID:12176
- C:\Windows\System\pwADHau.exe
  C:\Windows\System\pwADHau.exe
  2⤵
  PID:12244
- C:\Windows\System\OosXJgl.exe
  C:\Windows\System\OosXJgl.exe
  2⤵
  PID:11244
- C:\Windows\System\SEEvZhE.exe
  C:\Windows\System\SEEvZhE.exe
  2⤵
  PID:11372
- C:\Windows\System\SBnQpbt.exe
  C:\Windows\System\SBnQpbt.exe
  2⤵
  PID:11532
- C:\Windows\System\SgjBRQE.exe
  C:\Windows\System\SgjBRQE.exe
  2⤵
  PID:11664
- C:\Windows\System\IbWDdir.exe
  C:\Windows\System\IbWDdir.exe
  2⤵
  PID:11780
- C:\Windows\System\ByXTett.exe
  C:\Windows\System\ByXTett.exe
  2⤵
  PID:11924
- C:\Windows\System\bbMkkSJ.exe
  C:\Windows\System\bbMkkSJ.exe
  2⤵
  PID:11312
- C:\Windows\System\DvwZUof.exe
  C:\Windows\System\DvwZUof.exe
  2⤵
  PID:11292
- C:\Windows\System\kmwMyfu.exe
  C:\Windows\System\kmwMyfu.exe
  2⤵
  PID:11580
- C:\Windows\System\kjDdWMj.exe
  C:\Windows\System\kjDdWMj.exe
  2⤵
  PID:11836
- C:\Windows\System\FTbDQCE.exe
  C:\Windows\System\FTbDQCE.exe
  2⤵
  PID:12184
- C:\Windows\System\NlZpUDp.exe
  C:\Windows\System\NlZpUDp.exe
  2⤵
  PID:12216
- C:\Windows\System\NlRlJLs.exe
  C:\Windows\System\NlRlJLs.exe
  2⤵
  PID:12292
- C:\Windows\System\tyiMsZS.exe
  C:\Windows\System\tyiMsZS.exe
  2⤵
  PID:12316
- C:\Windows\System\dZHYnYK.exe
  C:\Windows\System\dZHYnYK.exe
  2⤵
  PID:12360
- C:\Windows\System\BClHFMe.exe
  C:\Windows\System\BClHFMe.exe
  2⤵
  PID:12376
- C:\Windows\System\KiiTAfZ.exe
  C:\Windows\System\KiiTAfZ.exe
  2⤵
  PID:12404
- C:\Windows\System\AQLMOUZ.exe
  C:\Windows\System\AQLMOUZ.exe
  2⤵
  PID:12432
- C:\Windows\System\KKUVuxw.exe
  C:\Windows\System\KKUVuxw.exe
  2⤵
  PID:12460
- C:\Windows\System\TOJJRiC.exe
  C:\Windows\System\TOJJRiC.exe
  2⤵
  PID:12484
- C:\Windows\System\nAXdKSt.exe
  C:\Windows\System\nAXdKSt.exe
  2⤵
  PID:12528
- C:\Windows\System\YfKdejL.exe
  C:\Windows\System\YfKdejL.exe
  2⤵
  PID:12556
- C:\Windows\System\onaKDcl.exe
  C:\Windows\System\onaKDcl.exe
  2⤵
  PID:12584
- C:\Windows\System\ESkVPJr.exe
  C:\Windows\System\ESkVPJr.exe
  2⤵
  PID:12604
- C:\Windows\System\JSXzWSp.exe
  C:\Windows\System\JSXzWSp.exe
  2⤵
  PID:12640
- C:\Windows\System\DpRrHAs.exe
  C:\Windows\System\DpRrHAs.exe
  2⤵
  PID:12656
- C:\Windows\System\IovMZMT.exe
  C:\Windows\System\IovMZMT.exe
  2⤵
  PID:12696
- C:\Windows\System\xbMPbQm.exe
  C:\Windows\System\xbMPbQm.exe
  2⤵
  PID:12720
- C:\Windows\System\MHKqYOL.exe
  C:\Windows\System\MHKqYOL.exe
  2⤵
  PID:12744
- C:\Windows\System\iVDJaMX.exe
  C:\Windows\System\iVDJaMX.exe
  2⤵
  PID:12780
- C:\Windows\System\mhzqlfo.exe
  C:\Windows\System\mhzqlfo.exe
  2⤵
  PID:12796
- C:\Windows\System\FLOxTZI.exe
  C:\Windows\System\FLOxTZI.exe
  2⤵
  PID:12836
- C:\Windows\System\SJwkaZX.exe
  C:\Windows\System\SJwkaZX.exe
  2⤵
  PID:12856
- C:\Windows\System\SBNWlwu.exe
  C:\Windows\System\SBNWlwu.exe
  2⤵
  PID:12884
- C:\Windows\System\XAqNJSx.exe
  C:\Windows\System\XAqNJSx.exe
  2⤵
  PID:12912
- C:\Windows\System\hdhbxEz.exe
  C:\Windows\System\hdhbxEz.exe
  2⤵
  PID:12928
- C:\Windows\System\cVSflWQ.exe
  C:\Windows\System\cVSflWQ.exe
  2⤵
  PID:12952
- C:\Windows\System\NDsCRjL.exe
  C:\Windows\System\NDsCRjL.exe
  2⤵
  PID:12968
- C:\Windows\System\xbYmVBW.exe
  C:\Windows\System\xbYmVBW.exe
  2⤵
  PID:12996
- C:\Windows\System\spHCWtL.exe
  C:\Windows\System\spHCWtL.exe
  2⤵
  PID:13036
- C:\Windows\System\udcDunj.exe
  C:\Windows\System\udcDunj.exe
  2⤵
  PID:13072
- C:\Windows\System\DmaqdkD.exe
  C:\Windows\System\DmaqdkD.exe
  2⤵
  PID:13100
- C:\Windows\System\cFyVFik.exe
  C:\Windows\System\cFyVFik.exe
  2⤵
  PID:13120
- C:\Windows\System\GMpffnV.exe
  C:\Windows\System\GMpffnV.exe
  2⤵
  PID:13180
- C:\Windows\System\OMyFsPL.exe
  C:\Windows\System\OMyFsPL.exe
  2⤵
  PID:13200
- C:\Windows\System\snkmArL.exe
  C:\Windows\System\snkmArL.exe
  2⤵
  PID:13224
- C:\Windows\System\wsEfPYS.exe
  C:\Windows\System\wsEfPYS.exe
  2⤵
  PID:13244
- C:\Windows\System\tyZKkxT.exe
  C:\Windows\System\tyZKkxT.exe
  2⤵
  PID:13292
- C:\Windows\System\jnFfhKH.exe
  C:\Windows\System\jnFfhKH.exe
  2⤵
  PID:12300
- C:\Windows\System\adKGHgQ.exe
  C:\Windows\System\adKGHgQ.exe
  2⤵
  PID:12332
- C:\Windows\System\sZHTahT.exe
  C:\Windows\System\sZHTahT.exe
  2⤵
  PID:12416
- C:\Windows\System\vbQapUa.exe
  C:\Windows\System\vbQapUa.exe
  2⤵
  PID:12452
- C:\Windows\System\HkdrHtU.exe
  C:\Windows\System\HkdrHtU.exe
  2⤵
  PID:12512
- C:\Windows\System\xQSFMif.exe
  C:\Windows\System\xQSFMif.exe
  2⤵
  PID:12572
- C:\Windows\System\DaskIAx.exe
  C:\Windows\System\DaskIAx.exe
  2⤵
  PID:12648
- C:\Windows\System\dPCcaJB.exe
  C:\Windows\System\dPCcaJB.exe
  2⤵
  PID:12716
- C:\Windows\System\NWdmCsM.exe
  C:\Windows\System\NWdmCsM.exe
  2⤵
  PID:12768
- C:\Windows\System\QEABpOI.exe
  C:\Windows\System\QEABpOI.exe
  2⤵
  PID:12844
- C:\Windows\System\hxkRwht.exe
  C:\Windows\System\hxkRwht.exe
  2⤵
  PID:12920
- C:\Windows\System\svYLbxB.exe
  C:\Windows\System\svYLbxB.exe
  2⤵
  PID:12984
- C:\Windows\System\FvGeVTd.exe
  C:\Windows\System\FvGeVTd.exe
  2⤵
  PID:13048
- C:\Windows\System\TLMXWdr.exe
  C:\Windows\System\TLMXWdr.exe
  2⤵
  PID:13112
- C:\Windows\System\WNicIdv.exe
  C:\Windows\System\WNicIdv.exe
  2⤵
  PID:13148
- C:\Windows\System\vKkUwTz.exe
  C:\Windows\System\vKkUwTz.exe
  2⤵
  PID:13232
- C:\Windows\System\rTjjVKh.exe
  C:\Windows\System\rTjjVKh.exe
  2⤵
  PID:12156
- C:\Windows\System\kyOkImg.exe
  C:\Windows\System\kyOkImg.exe
  2⤵
  PID:12368
- C:\Windows\System\ViQaUSw.exe
  C:\Windows\System\ViQaUSw.exe
  2⤵
  PID:12480
- C:\Windows\System\FiBHIjg.exe
  C:\Windows\System\FiBHIjg.exe
  2⤵
  PID:12580
- C:\Windows\System\QXMVgJD.exe
  C:\Windows\System\QXMVgJD.exe
  2⤵
  PID:11868
- C:\Windows\System\MEuwBQe.exe
  C:\Windows\System\MEuwBQe.exe
  2⤵
  PID:12868
- C:\Windows\System\gscBGoQ.exe
  C:\Windows\System\gscBGoQ.exe
  2⤵
  PID:13272
- C:\Windows\System\HTWSKDr.exe
  C:\Windows\System\HTWSKDr.exe
  2⤵
  PID:12632
- C:\Windows\System\YWZWvQt.exe
  C:\Windows\System\YWZWvQt.exe
  2⤵
  PID:12688
- C:\Windows\System\uHuBYss.exe
  C:\Windows\System\uHuBYss.exe
  2⤵
  PID:13172
- C:\Windows\System\nUHIwmi.exe
  C:\Windows\System\nUHIwmi.exe
  2⤵
  PID:13084
- C:\Windows\System\znLRfZb.exe
  C:\Windows\System\znLRfZb.exe
  2⤵
  PID:13320
- C:\Windows\System\ogZzBzQ.exe
  C:\Windows\System\ogZzBzQ.exe
  2⤵
  PID:13348
- C:\Windows\System\NcNxGdr.exe
  C:\Windows\System\NcNxGdr.exe
  2⤵
  PID:13376
- C:\Windows\System\UkXTFOi.exe
  C:\Windows\System\UkXTFOi.exe
  2⤵
  PID:13400
- C:\Windows\System\JcnAMyO.exe
  C:\Windows\System\JcnAMyO.exe
  2⤵
  PID:13432
- C:\Windows\System\hfNCLGf.exe
  C:\Windows\System\hfNCLGf.exe
  2⤵
  PID:13460
- C:\Windows\System\RXeKhhL.exe
  C:\Windows\System\RXeKhhL.exe
  2⤵
  PID:13488
- C:\Windows\System\iwTCrtp.exe
  C:\Windows\System\iwTCrtp.exe
  2⤵
  PID:13516
- C:\Windows\System\LqAzBfM.exe
  C:\Windows\System\LqAzBfM.exe
  2⤵
  PID:13540
- C:\Windows\System\gXqgaKj.exe
  C:\Windows\System\gXqgaKj.exe
  2⤵
  PID:13564
- C:\Windows\System\BiMDmpn.exe
  C:\Windows\System\BiMDmpn.exe
  2⤵
  PID:13600
- C:\Windows\System\Ggsnzer.exe
  C:\Windows\System\Ggsnzer.exe
  2⤵
  PID:13624
- C:\Windows\System\hwoESIh.exe
  C:\Windows\System\hwoESIh.exe
  2⤵
  PID:13652
- C:\Windows\System\ZuRRYqS.exe
  C:\Windows\System\ZuRRYqS.exe
  2⤵
  PID:13688
- C:\Windows\System\dzpSNdz.exe
  C:\Windows\System\dzpSNdz.exe
  2⤵
  PID:13708
- C:\Windows\System\RmkiiEn.exe
  C:\Windows\System\RmkiiEn.exe
  2⤵
  PID:13740
- C:\Windows\System\JwPFeec.exe
  C:\Windows\System\JwPFeec.exe
  2⤵
  PID:13784
- C:\Windows\System\QuybaHX.exe
  C:\Windows\System\QuybaHX.exe
  2⤵
  PID:13812
- C:\Windows\System\UkWcjgE.exe
  C:\Windows\System\UkWcjgE.exe
  2⤵
  PID:13828
- C:\Windows\System\lYdMcYu.exe
  C:\Windows\System\lYdMcYu.exe
  2⤵
  PID:13856
- C:\Windows\System\AlBbzzC.exe
  C:\Windows\System\AlBbzzC.exe
  2⤵
  PID:13872
- C:\Windows\System\naWbDPf.exe
  C:\Windows\System\naWbDPf.exe
  2⤵
  PID:13904
- C:\Windows\System\ZPnLenz.exe
  C:\Windows\System\ZPnLenz.exe
  2⤵
  PID:13924
- C:\Windows\System\NyImNba.exe
  C:\Windows\System\NyImNba.exe
  2⤵
  PID:13964
- C:\Windows\System\LHQvoFd.exe
  C:\Windows\System\LHQvoFd.exe
  2⤵
  PID:14000
- C:\Windows\System\HnpjYQX.exe
  C:\Windows\System\HnpjYQX.exe
  2⤵
  PID:14016
- C:\Windows\System\IsmimWn.exe
  C:\Windows\System\IsmimWn.exe
  2⤵
  PID:14032
- C:\Windows\System\ajzNVvp.exe
  C:\Windows\System\ajzNVvp.exe
  2⤵
  PID:14080
- C:\Windows\System\jLTiMDe.exe
  C:\Windows\System\jLTiMDe.exe
  2⤵
  PID:14112
- C:\Windows\System\pWKbHLT.exe
  C:\Windows\System\pWKbHLT.exe
  2⤵
  PID:14128
- C:\Windows\System\ooiNCza.exe
  C:\Windows\System\ooiNCza.exe
  2⤵
  PID:14180
- C:\Windows\System\KayyYHL.exe
  C:\Windows\System\KayyYHL.exe
  2⤵
  PID:14200
- C:\Windows\System\syvKAMC.exe
  C:\Windows\System\syvKAMC.exe
  2⤵
  PID:14236
- C:\Windows\System\vrLPbgk.exe
  C:\Windows\System\vrLPbgk.exe
  2⤵
  PID:14256
- C:\Windows\System\PKBBqOy.exe
  C:\Windows\System\PKBBqOy.exe
  2⤵
  PID:14280
- C:\Windows\System\ahZjFUQ.exe
  C:\Windows\System\ahZjFUQ.exe
  2⤵
  PID:14320
- C:\Windows\System\lDTPJck.exe
  C:\Windows\System\lDTPJck.exe
  2⤵
  PID:12312
- C:\Windows\System\bXnRpJg.exe
  C:\Windows\System\bXnRpJg.exe
  2⤵
  PID:13368
- C:\Windows\System\xohdBOn.exe
  C:\Windows\System\xohdBOn.exe
  2⤵
  PID:13396
- C:\Windows\System\PhAybrv.exe
  C:\Windows\System\PhAybrv.exe
  2⤵
  PID:13420
- C:\Windows\System\dVsCozC.exe
  C:\Windows\System\dVsCozC.exe
  2⤵
  PID:13448
- C:\Windows\System\fJZdPYB.exe
  C:\Windows\System\fJZdPYB.exe
  2⤵
  PID:13560
- C:\Windows\System\axrqisW.exe
  C:\Windows\System\axrqisW.exe
  2⤵
  PID:13648
- C:\Windows\System\eeGlhxj.exe
  C:\Windows\System\eeGlhxj.exe
  2⤵
  PID:13704
- C:\Windows\System\QfwudkO.exe
  C:\Windows\System\QfwudkO.exe
  2⤵
  PID:13796
- C:\Windows\System\HrYBnyC.exe
  C:\Windows\System\HrYBnyC.exe
  2⤵
  PID:13844
- C:\Windows\System\JgWqAye.exe
  C:\Windows\System\JgWqAye.exe
  2⤵
  PID:13972
- C:\Windows\System\zvQUeNF.exe
  C:\Windows\System\zvQUeNF.exe
  2⤵
  PID:13996
- C:\Windows\System\xHmRwUL.exe
  C:\Windows\System\xHmRwUL.exe
  2⤵
  PID:14024
- C:\Windows\System\TpWMydd.exe
  C:\Windows\System\TpWMydd.exe
  2⤵
  PID:14060
- C:\Windows\System\EAYXTnV.exe
  C:\Windows\System\EAYXTnV.exe
  2⤵
  PID:14140
- C:\Windows\System\nFRQmXa.exe
  C:\Windows\System\nFRQmXa.exe
  2⤵
  PID:14228
- C:\Windows\System\vQTDtdl.exe
  C:\Windows\System\vQTDtdl.exe
  2⤵
  PID:14316
- C:\Windows\System\EjwVbgW.exe
  C:\Windows\System\EjwVbgW.exe
  2⤵
  PID:13392
- C:\Windows\System\sBQCoSf.exe
  C:\Windows\System\sBQCoSf.exe
  2⤵
  PID:13504
- C:\Windows\System\qmQWgig.exe
  C:\Windows\System\qmQWgig.exe
  2⤵
  PID:13616
- C:\Windows\System\dVAUVuo.exe
  C:\Windows\System\dVAUVuo.exe
  2⤵
  PID:13804
- C:\Windows\System\SQoTkHs.exe
  C:\Windows\System\SQoTkHs.exe
  2⤵
  PID:13864
- C:\Windows\System\cwkQzPH.exe
  C:\Windows\System\cwkQzPH.exe
  2⤵
  PID:14292
- C:\Windows\System\uvyYGrr.exe
  C:\Windows\System\uvyYGrr.exe
  2⤵
  PID:13328
- C:\Windows\System\pyLVEBc.exe
  C:\Windows\System\pyLVEBc.exe
  2⤵
  PID:13572
- C:\Windows\System\thfjymX.exe
  C:\Windows\System\thfjymX.exe
  2⤵
  PID:14008
- C:\Windows\System\lWUqhSj.exe
  C:\Windows\System\lWUqhSj.exe
  2⤵
  PID:14252
- C:\Windows\System\qJiSRAC.exe
  C:\Windows\System\qJiSRAC.exe
  2⤵
  PID:13532
- C:\Windows\System\pkkvVWw.exe
  C:\Windows\System\pkkvVWw.exe
  2⤵
  PID:14108
- C:\Windows\System\asKSeBJ.exe
  C:\Windows\System\asKSeBJ.exe
  2⤵
  PID:14380
- C:\Windows\System\KIClvho.exe
  C:\Windows\System\KIClvho.exe
  2⤵
  PID:14396
- C:\Windows\System\silxOFx.exe
  C:\Windows\System\silxOFx.exe
  2⤵
  PID:14448
- C:\Windows\System\LpROwqM.exe
  C:\Windows\System\LpROwqM.exe
  2⤵
  PID:14464
- C:\Windows\System\SWafEJI.exe
  C:\Windows\System\SWafEJI.exe
  2⤵
  PID:14488
- C:\Windows\System\hrNBVcO.exe
  C:\Windows\System\hrNBVcO.exe
  2⤵
  PID:14512
- C:\Windows\System\DzlTUeX.exe
  C:\Windows\System\DzlTUeX.exe
  2⤵
  PID:14540
- C:\Windows\System\zlFgnkS.exe
  C:\Windows\System\zlFgnkS.exe
  2⤵
  PID:14572
- C:\Windows\System\bFcljgf.exe
  C:\Windows\System\bFcljgf.exe
  2⤵
  PID:14592
- C:\Windows\System\SicoZDe.exe
  C:\Windows\System\SicoZDe.exe
  2⤵
  PID:14640
- C:\Windows\System\dUEfFrx.exe
  C:\Windows\System\dUEfFrx.exe
  2⤵
  PID:14660
- C:\Windows\System\oyotVax.exe
  C:\Windows\System\oyotVax.exe
  2⤵
  PID:14688
- C:\Windows\System\eMxucFe.exe
  C:\Windows\System\eMxucFe.exe
  2⤵
  PID:14708
- C:\Windows\System\GNRpgEQ.exe
  C:\Windows\System\GNRpgEQ.exe
  2⤵
  PID:14732
- C:\Windows\System\MscKyOk.exe
  C:\Windows\System\MscKyOk.exe
  2⤵
  PID:14772
- C:\Windows\System\LnovYZq.exe
  C:\Windows\System\LnovYZq.exe
  2⤵
  PID:14800
- C:\Windows\System\csxiFWQ.exe
  C:\Windows\System\csxiFWQ.exe
  2⤵
  PID:14816
- C:\Windows\System\oCeyHUA.exe
  C:\Windows\System\oCeyHUA.exe
  2⤵
  PID:14848
- C:\Windows\System\ppNCtIX.exe
  C:\Windows\System\ppNCtIX.exe
  2⤵
  PID:14880
- C:\Windows\System\eMojPGB.exe
  C:\Windows\System\eMojPGB.exe
  2⤵
  PID:14920
- C:\Windows\System\wqFRCqA.exe
  C:\Windows\System\wqFRCqA.exe
  2⤵
  PID:14936
- C:\Windows\System\HOlZZkC.exe
  C:\Windows\System\HOlZZkC.exe
  2⤵
  PID:14980
- C:\Windows\System\pNvwNnp.exe
  C:\Windows\System\pNvwNnp.exe
  2⤵
  PID:15008
- C:\Windows\System\FnIOomT.exe
  C:\Windows\System\FnIOomT.exe
  2⤵
  PID:15028
- C:\Windows\System\tqIsUln.exe
  C:\Windows\System\tqIsUln.exe
  2⤵
  PID:15052
- C:\Windows\System\QsSuExc.exe
  C:\Windows\System\QsSuExc.exe
  2⤵
  PID:15072
- C:\Windows\System\QNfIHiE.exe
  C:\Windows\System\QNfIHiE.exe
  2⤵
  PID:15108
- C:\Windows\System\dJHLWUq.exe
  C:\Windows\System\dJHLWUq.exe
  2⤵
  PID:15148
- C:\Windows\System\cSRJKqI.exe
  C:\Windows\System\cSRJKqI.exe
  2⤵
  PID:15176
- C:\Windows\System\nKitIhI.exe
  C:\Windows\System\nKitIhI.exe
  2⤵
  PID:15208
- C:\Windows\System\vvZcbyf.exe
  C:\Windows\System\vvZcbyf.exe
  2⤵
  PID:15224
- C:\Windows\System\OhWsXqv.exe
  C:\Windows\System\OhWsXqv.exe
  2⤵
  PID:15252
- C:\Windows\System\yzrjqiW.exe
  C:\Windows\System\yzrjqiW.exe
  2⤵
  PID:15292
- C:\Windows\System\bXjGXQN.exe
  C:\Windows\System\bXjGXQN.exe
  2⤵
  PID:15308
- C:\Windows\System\IzkPVQm.exe
  C:\Windows\System\IzkPVQm.exe
  2⤵
  PID:15336
- C:\Windows\System\tctGEhL.exe
  C:\Windows\System\tctGEhL.exe
  2⤵
  PID:15352
- C:\Windows\System\ghPiocp.exe
  C:\Windows\System\ghPiocp.exe
  2⤵
  PID:13780
- C:\Windows\System\WYHAbvY.exe
  C:\Windows\System\WYHAbvY.exe
  2⤵
  PID:14484
- C:\Windows\System\EKgCMsd.exe
  C:\Windows\System\EKgCMsd.exe
  2⤵
  PID:14508
- C:\Windows\System\cxiVBOG.exe
  C:\Windows\System\cxiVBOG.exe
  2⤵
  PID:14548
- C:\Windows\System\eRKMxuI.exe
  C:\Windows\System\eRKMxuI.exe
  2⤵
  PID:14588
- C:\Windows\System\XZFXTmC.exe
  C:\Windows\System\XZFXTmC.exe
  2⤵
  PID:14636
- C:\Windows\System\ldlAdrt.exe
  C:\Windows\System\ldlAdrt.exe
  2⤵
  PID:14656
- C:\Windows\System\DPBmdBZ.exe
  C:\Windows\System\DPBmdBZ.exe
  2⤵
  PID:14760
- C:\Windows\System\iOQLbrc.exe
  C:\Windows\System\iOQLbrc.exe
  2⤵
  PID:14912
- C:\Windows\System\VIkIbzy.exe
  C:\Windows\System\VIkIbzy.exe
  2⤵
  PID:14944
- C:\Windows\System\ENEUKUL.exe
  C:\Windows\System\ENEUKUL.exe
  2⤵
  PID:14968
- C:\Windows\System\DweyDOV.exe
  C:\Windows\System\DweyDOV.exe
  2⤵
  PID:15024
- C:\Windows\System\fztDHmr.exe
  C:\Windows\System\fztDHmr.exe
  2⤵
  PID:15144
- C:\Windows\System\evNnGao.exe
  C:\Windows\System\evNnGao.exe
  2⤵
  PID:15216
- C:\Windows\System\qjFHXWx.exe
  C:\Windows\System\qjFHXWx.exe
  2⤵
  PID:15304
- C:\Windows\System\CHBHQhd.exe
  C:\Windows\System\CHBHQhd.exe
  2⤵
  PID:15328
- C:\Windows\System\WaWzkHR.exe
  C:\Windows\System\WaWzkHR.exe
  2⤵
  PID:14428
- C:\Windows\System\nXZlFUi.exe
  C:\Windows\System\nXZlFUi.exe
  2⤵
  PID:14536
- C:\Windows\System\OHMqtZO.exe
  C:\Windows\System\OHMqtZO.exe
  2⤵
  PID:14740
- C:\Windows\System\GOSFdio.exe
  C:\Windows\System\GOSFdio.exe
  2⤵
  PID:14932
- C:\Windows\System\zVFacbT.exe
  C:\Windows\System\zVFacbT.exe
  2⤵
  PID:14976
- C:\Windows\System\FWyTXiv.exe
  C:\Windows\System\FWyTXiv.exe
  2⤵
  PID:15196
- C:\Windows\System\xkhWeFh.exe
  C:\Windows\System\xkhWeFh.exe
  2⤵
  PID:15280
- C:\Windows\System\HTJsDgP.exe
  C:\Windows\System\HTJsDgP.exe
  2⤵
  PID:14648
- C:\Windows\System\qijDlbR.exe
  C:\Windows\System\qijDlbR.exe
  2⤵
  PID:14724
- C:\Windows\System\IeOZYrX.exe
  C:\Windows\System\IeOZYrX.exe
  2⤵
  PID:15244
- C:\Windows\System\lmSRuJv.exe
  C:\Windows\System\lmSRuJv.exe
  2⤵
  PID:14352
- C:\Windows\System\EmKpOwd.exe
  C:\Windows\System\EmKpOwd.exe
  2⤵
  PID:15068
- C:\Windows\System\qraOswF.exe
  C:\Windows\System\qraOswF.exe
  2⤵
  PID:15420
- C:\Windows\System\QaBIDak.exe
  C:\Windows\System\QaBIDak.exe
  2⤵
  PID:15436
- C:\Windows\System\cJJqRfd.exe
  C:\Windows\System\cJJqRfd.exe
  2⤵
  PID:15452
- C:\Windows\System\USrdkML.exe
  C:\Windows\System\USrdkML.exe
  2⤵
  PID:15468
- C:\Windows\System\DIxExwN.exe
  C:\Windows\System\DIxExwN.exe
  2⤵
  PID:15492
- C:\Windows\System\TPwuWSX.exe
  C:\Windows\System\TPwuWSX.exe
  2⤵
  PID:15516
- C:\Windows\System\oenahlg.exe
  C:\Windows\System\oenahlg.exe
  2⤵
  PID:15556
- C:\Windows\System\cyjYHqj.exe
  C:\Windows\System\cyjYHqj.exe
  2⤵
  PID:15608
- C:\Windows\System\NYTLgRM.exe
  C:\Windows\System\NYTLgRM.exe
  2⤵
  PID:15624
- C:\Windows\System\PFhYTdB.exe
  C:\Windows\System\PFhYTdB.exe
  2⤵
  PID:15640
- C:\Windows\System\dlSmyZn.exe
  C:\Windows\System\dlSmyZn.exe
  2⤵
  PID:15680
- C:\Windows\System\aofHpmK.exe
  C:\Windows\System\aofHpmK.exe
  2⤵
  PID:15700
- C:\Windows\System\PoKSTUq.exe
  C:\Windows\System\PoKSTUq.exe
  2⤵
  PID:15728
- C:\Windows\System\pzxCAlb.exe
  C:\Windows\System\pzxCAlb.exe
  2⤵
  PID:15756
- C:\Windows\System\GLUmMFz.exe
  C:\Windows\System\GLUmMFz.exe
  2⤵
  PID:15772
- C:\Windows\System\JgiXoDQ.exe
  C:\Windows\System\JgiXoDQ.exe
  2⤵
  PID:15800
- C:\Windows\System\GnARZAm.exe
  C:\Windows\System\GnARZAm.exe
  2⤵
  PID:15832
- C:\Windows\System\jKVnlQZ.exe
  C:\Windows\System\jKVnlQZ.exe
  2⤵
  PID:15856
- C:\Windows\System\NIqHVgc.exe
  C:\Windows\System\NIqHVgc.exe
  2⤵
  PID:15872
- C:\Windows\System\eKOPoky.exe
  C:\Windows\System\eKOPoky.exe
  2⤵
  PID:15928
- C:\Windows\System\KAGzgYj.exe
  C:\Windows\System\KAGzgYj.exe
  2⤵
  PID:15964
- C:\Windows\System\rhetELj.exe
  C:\Windows\System\rhetELj.exe
  2⤵
  PID:15988
- C:\Windows\System\hcUAKZq.exe
  C:\Windows\System\hcUAKZq.exe
  2⤵
  PID:16008
- C:\Windows\System\suWkEkE.exe
  C:\Windows\System\suWkEkE.exe
  2⤵
  PID:16036
- C:\Windows\System\mcOWIod.exe
  C:\Windows\System\mcOWIod.exe
  2⤵
  PID:16068
- C:\Windows\System\pJQQeMA.exe
  C:\Windows\System\pJQQeMA.exe
  2⤵
  PID:16108
- C:\Windows\System\DZyOHlW.exe
  C:\Windows\System\DZyOHlW.exe
  2⤵
  PID:16132
- C:\Windows\System\CLyBFeU.exe
  C:\Windows\System\CLyBFeU.exe
  2⤵
  PID:16156
- C:\Windows\System\vMmHDpb.exe
  C:\Windows\System\vMmHDpb.exe
  2⤵
  PID:16176
- C:\Windows\System\RkWufYH.exe
  C:\Windows\System\RkWufYH.exe
  2⤵
  PID:16216
- C:\Windows\System\LUEkDsh.exe
  C:\Windows\System\LUEkDsh.exe
  2⤵
  PID:16256
- C:\Windows\System\WTrZNrg.exe
  C:\Windows\System\WTrZNrg.exe
  2⤵
  PID:16284
- C:\Windows\System\wWjIefm.exe
  C:\Windows\System\wWjIefm.exe
  2⤵
  PID:16300
- C:\Windows\System\PqujSGL.exe
  C:\Windows\System\PqujSGL.exe
  2⤵
  PID:16316
- C:\Windows\System\SwRmvRb.exe
  C:\Windows\System\SwRmvRb.exe
  2⤵
  PID:16368
- C:\Windows\System\veiVKwb.exe
  C:\Windows\System\veiVKwb.exe
  2⤵
  PID:15384
- C:\Windows\System\aJMquby.exe
  C:\Windows\System\aJMquby.exe
  2⤵
  PID:15428
- C:\Windows\System\ScmpWNi.exe
  C:\Windows\System\ScmpWNi.exe
  2⤵
  PID:15512
- C:\Windows\System\oDTouSk.exe
  C:\Windows\System\oDTouSk.exe
  2⤵
  PID:15524
- C:\Windows\System\jblOxyl.exe
  C:\Windows\System\jblOxyl.exe
  2⤵
  PID:15616
- C:\Windows\System\TKCtCNk.exe
  C:\Windows\System\TKCtCNk.exe
  2⤵
  PID:15660
- C:\Windows\System\VvZaucx.exe
  C:\Windows\System\VvZaucx.exe
  2⤵
  PID:15740
- C:\Windows\System\JixLHhm.exe
  C:\Windows\System\JixLHhm.exe
  2⤵
  PID:15864
- C:\Windows\System\wvOalgt.exe
  C:\Windows\System\wvOalgt.exe
  2⤵
  PID:15904
- C:\Windows\System\SLzRpZa.exe
  C:\Windows\System\SLzRpZa.exe
  2⤵
  PID:15920
- C:\Windows\System\PgBHvXr.exe
  C:\Windows\System\PgBHvXr.exe
  2⤵
  PID:15984
- C:\Windows\System\PkgdBBf.exe
  C:\Windows\System\PkgdBBf.exe
  2⤵
  PID:16084
- C:\Windows\System\dFrqchf.exe
  C:\Windows\System\dFrqchf.exe
  2⤵
  PID:16172
- C:\Windows\System\XGgDZEi.exe
  C:\Windows\System\XGgDZEi.exe
  2⤵
  PID:16200
- C:\Windows\System\gckCYoe.exe
  C:\Windows\System\gckCYoe.exe
  2⤵
  PID:16232
- C:\Windows\System\sLzRmgo.exe
  C:\Windows\System\sLzRmgo.exe
  2⤵
  PID:16308
- C:\Windows\System\QVkrrQT.exe
  C:\Windows\System\QVkrrQT.exe
  2⤵
  PID:16376
- C:\Windows\System\NPKMnxd.exe
  C:\Windows\System\NPKMnxd.exe
  2⤵
  PID:15444
- C:\Windows\System\FmXRCAM.exe
  C:\Windows\System\FmXRCAM.exe
  2⤵
  PID:15664
- C:\Windows\System\toUwySN.exe
  C:\Windows\System\toUwySN.exe
  2⤵
  PID:15812
- C:\Windows\System\jaYYERn.exe
  C:\Windows\System\jaYYERn.exe
  2⤵
  PID:15884
- C:\Windows\System\bVBfNNk.exe
  C:\Windows\System\bVBfNNk.exe
  2⤵
  PID:16104
- C:\Windows\System\OTjRmNn.exe
  C:\Windows\System\OTjRmNn.exe
  2⤵
  PID:16268
- C:\Windows\System\UTysPEH.exe
  C:\Windows\System\UTysPEH.exe
  2⤵
  PID:15460
- C:\Windows\System\yPupeOs.exe
  C:\Windows\System\yPupeOs.exe
  2⤵
  PID:15768
- C:\Windows\System\URBOCpb.exe
  C:\Windows\System\URBOCpb.exe
  2⤵
  PID:15996
- C:\Windows\System\lyrIDBt.exe
  C:\Windows\System\lyrIDBt.exe
  2⤵
  PID:16360
- C:\Windows\System\WokFwPy.exe
  C:\Windows\System\WokFwPy.exe
  2⤵
  PID:15620
- C:\Windows\System\ojRiZxd.exe
  C:\Windows\System\ojRiZxd.exe
  2⤵
  PID:16452
- C:\Windows\System\FjuciGl.exe
  C:\Windows\System\FjuciGl.exe
  2⤵
  PID:16468
- C:\Windows\System\KLiXGaE.exe
  C:\Windows\System\KLiXGaE.exe
  2⤵
  PID:16496
- C:\Windows\System\NPzqXGb.exe
  C:\Windows\System\NPzqXGb.exe
  2⤵
  PID:16536
- C:\Windows\System\jkkZCgV.exe
  C:\Windows\System\jkkZCgV.exe
  2⤵
  PID:16556
- C:\Windows\System\hvFMwcd.exe
  C:\Windows\System\hvFMwcd.exe
  2⤵
  PID:16580
- C:\Windows\System\VbeTHZS.exe
  C:\Windows\System\VbeTHZS.exe
  2⤵
  PID:16608
- C:\Windows\System\rJpigfS.exe
  C:\Windows\System\rJpigfS.exe
  2⤵
  PID:16640
- C:\Windows\System\FJHMbnM.exe
  C:\Windows\System\FJHMbnM.exe
  2⤵
  PID:16676
- C:\Windows\System\OTAmOno.exe
  C:\Windows\System\OTAmOno.exe
  2⤵
  PID:16692
- C:\Windows\System\VKQPnrY.exe
  C:\Windows\System\VKQPnrY.exe
  2⤵
  PID:16720
- C:\Windows\System\tFNsRrI.exe
  C:\Windows\System\tFNsRrI.exe
  2⤵
  PID:16736
- C:\Windows\System\yeWOxox.exe
  C:\Windows\System\yeWOxox.exe
  2⤵
  PID:16756
- C:\Windows\System\VHSRlMh.exe
  C:\Windows\System\VHSRlMh.exe
  2⤵
  PID:16792
- C:\Windows\System\XxoMwQr.exe
  C:\Windows\System\XxoMwQr.exe
  2⤵
  PID:16844
- C:\Windows\System\bxIraQL.exe
  C:\Windows\System\bxIraQL.exe
  2⤵
  PID:16868
- C:\Windows\System\wzGaHWx.exe
  C:\Windows\System\wzGaHWx.exe
  2⤵
  PID:16892
- C:\Windows\System\ChbChXm.exe
  C:\Windows\System\ChbChXm.exe
  2⤵
  PID:16916

C:\Windows\system32\WerFaultSecure.exe
C:\Windows\system32\WerFaultSecure.exe -u -p 436 -s 2108
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:17320

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BEcoiFU.exe

Filesize
1.5MB

MD5
a0573d0afd5440dd90ea7d0005c273ae

SHA1
d31bd6606b4ca604c2205fe274d998ad90b5a8a5

SHA256
9bd102c740073df9434612b8adebd7196b931bbc6f50008bc9e8558f80e7b135

SHA512
f2ffd1c16b7d9bd1c721fb0ebfccfc1160513dbfd390d83f23fe8b92d92eba7c486d4fa7184977dc69d712fb4aa3806e819fc54df547beed4af9b5ba3b262b1c

Download Submit
C:\Windows\System\BOABrwR.exe

Filesize
1.5MB

MD5
a46717469f27d48d648a3b3fd9839923

SHA1
90f64f0ae132bf7bb18de38e7131a57d14bd495a

SHA256
e906cd5655d05c959a33896b02a323724d39f27d6d2774403bbbf852130bc1fa

SHA512
e1dd10e0661b6e4db2e34d62f054079576db553734e5a0225f9900c63974baba867ccda334bd20286783626f1ba46beace5ae0559cb0298a5d0a2dd26ae614a4

Download Submit
C:\Windows\System\BWWcFRe.exe

Filesize
1.5MB

MD5
55cedf336a0a6ab0301294fece2d8d30

SHA1
60f4a13b589604bb831e68c5d19a6cd72dea8d25

SHA256
b425371df4749499bfa85db18156751f9a1a27f24da64a60097d45da1c0dc5c1

SHA512
6ed4b5620084ff67ade91e454e896ce4e68df6a9f7cb6402398a7f432e3d51c7b9bab0182a3f80351f745a57af4d035958fa359be5fdbef9ee58ed9a6547c567

Download Submit
C:\Windows\System\CiiGFPk.exe

Filesize
1.5MB

MD5
b05b54c0dc5696c6165bb7ba207f7060

SHA1
84ae6efe88d2941c2a0ad6bda8c2000f7ed2c904

SHA256
2a1df2cddf6b556cd7f455614eeebc97de82aeb623fdbe15923adb746af10eb0

SHA512
4e84cc4dd45aca7a4f01b7d20007e69f6e039d73fa2508c5307e8adfb7e8a545b7bee4614d47135f5d0828b875acdf1495848b13e85462d92220dc95ae97945f

Download Submit
C:\Windows\System\ClmVmUY.exe

Filesize
1.5MB

MD5
fa5c5485c27940f152824afef0e30719

SHA1
47cb9bc347afdec523e9a895ffa170083d663528

SHA256
b16ea34c64b4a7e5049b4f37951de0773a33ca6906424a069eaf605d56686306

SHA512
aadcf5e47c000fa338bfc20d707a1152185b7aa532c4dcb2cb2fee2a5903cf972d4e6ec0aa2264f7166e535d63e8a912021fdaa350948b59768e08e95fa16027

Download Submit
C:\Windows\System\DFUwpQH.exe

Filesize
1.5MB

MD5
fe4239c4175bf683a7c0d85d1f11c61d

SHA1
0cfc9bdcb561886f0800ac671810f47672174c73

SHA256
033aa9bb747ee0159eb09712f3affb35477e90718fb84f2b7a5018e1f9534116

SHA512
48be48dafa6cd50fe5fbfe69bf0dfae87e870e9341e9046f91d8edc1b823ecf260d0fc389f86575112c6005a79baeff08f9b896f29bc5ee9852a6b5f0fb00069

Download Submit
C:\Windows\System\DGYvAHi.exe

Filesize
1.5MB

MD5
ab8e6ddae27eed6c1d7b62de94685982

SHA1
33a9333ec2a4f4a805786434a4c6ed2fd88b4af9

SHA256
849585f853ca446d16d721f223049d8cb86aa12e1eb5438ca057569f00fcf65b

SHA512
49b8e9d95d8d01654ba474dad08ab20287ced98613509db9ed1ff85f43f459eab97f454031be17dc46971e23e1c0bfd0112012076b0a3df445b1a1441213f8cd

Download Submit
C:\Windows\System\HyNfKlR.exe

Filesize
1.5MB

MD5
5a609abe65759a5a3e586d23e74cdeba

SHA1
492bdf57392a2409de48be773b9ff73f234d6ce4

SHA256
6a693b487437fac0aa1db927d12973b01aebd5c82910b66ff9731617819f180b

SHA512
85e9a38e09d7b06a2bfb6693cfa4ca4dd1fb56a89f64d38231650718a6643d8ddaf87758194abf5b3820c7fc9b69ac2fb1d25d288be9bf655e6cbb34645fc69d

Download Submit
C:\Windows\System\LwDsQFB.exe

Filesize
1.5MB

MD5
e1dc9ffa629410a0375ee268251c26a1

SHA1
aead7d43f319073673bbc519b053ac465f27bba9

SHA256
955ebd4620ffb36fa715026a0b310833070a1d056da6c20478b92cf84cdad5b5

SHA512
b5df39c8f018f5a666436d8f5aaea9ce0b0bbaa3c6a544ee4e696e3217a757bb0259006329d138124e8d24e43e215b61c25721c865defbce0610d72ea32f2d0f

Download Submit
C:\Windows\System\MLnwvet.exe

Filesize
1.5MB

MD5
1bbc0ac639f21ea06783814ef717a6e8

SHA1
29f831981a0a8fd22e9d5c92246ca8820cf25242

SHA256
8d0e13892bded1ed63ae903b0d3c3de8d3370cff567b4cf2896aa08cf4d32a54

SHA512
0ba64ddbc5f8888affcf6b8210c2668f06834b27f7fc3589e11c08d3afc469ac6f8bda5af3b8b4d917c73ed2e6ece5a1fbef3ecc60145b042f7a90581acc9aa0

Download Submit
C:\Windows\System\MZGjVqY.exe

Filesize
1.5MB

MD5
77d535a30c88426e0118e98b1b28fcb2

SHA1
bfca1b237ba39175d590f4c3a22c0dc3c68ee73f

SHA256
00a7e1e23d14dfe8d8f0b0361a0a783d3bc5585205f8397b2378b371a6d14ca3

SHA512
6870139e5b244265d9833fded5f2fb2516adc22b3e8738d34fa93f53fa6e341ed37b9eb5c59c0de7adc18a45dc49105d6a22b5fc8aebf089666274885689d8a4

Download Submit
C:\Windows\System\MZonmKV.exe

Filesize
1.5MB

MD5
e362882dd100ec6f59e54efafe3d4f8e

SHA1
1732ddac71c73531e886478716fc821224c15bb1

SHA256
d8e189727d477b64ad2c9e583dc3185c2d962c52194f42b6ad89ee1d57e062a3

SHA512
0738c3fb4a07e276ccce870a3d61b5e46325ab2904bf68add76569e5e8debb97df7d212fa91e61d51d9971a3a5f0fa3592ccbe99a8b609511fb63af565771612

Download Submit
C:\Windows\System\PmZeFhT.exe

Filesize
1.5MB

MD5
ce82f7be1fab6274d362e66fb816af57

SHA1
18a0e3d37a419403452a6a785223f4a4cad7f4a4

SHA256
ecfddee83d7e4a26223c15afc1f6581941d81bd6db9e0a1f57cb6e4e07985d99

SHA512
600d69e03131bbdb7f00c7fecd773e1dce0d18d58834c7ac6985cdc82037ff860d4bd1958c7bfc609e3dfc7ced9e3f2d4bb165f1eff02ed3d37b87ce396f4707

Download Submit
C:\Windows\System\QDqgCMd.exe

Filesize
1.5MB

MD5
6fe3364bbb45c6e56cd13536a2389805

SHA1
877c2820ab3abcf94fc38aa77b92a34dd2b667df

SHA256
8e178853ceb6241f3bb41183fd6abd87d0cf208a1d32917f096ff616aff1d804

SHA512
09fd68836253e678bde9b00f81d20e2b1428937a8c40bf0be3b2977ecc42efbcd9d4edb32d1f2778a63002156a609a6cd412eb19fd8a8e867cb3bd38b7136465

Download Submit
C:\Windows\System\TsDzKzx.exe

Filesize
1.5MB

MD5
7205b72fc5231854778b6849ebdcca68

SHA1
2c8f60a508babc433604defeaada7736a670ea06

SHA256
3180c9b2e39d4ff3a3279ec918bb70bbe29a4e3cd92565f1e9378cfd13afab52

SHA512
f5fbd29200a6a985a6b3aab24dd132ef074ce87428c450e553e424fcaa94cecb20e6214abc0c0f35f56b5b2e69e8dcdae86a365c29ece8dc4bed17fea383f620

Download Submit
C:\Windows\System\UPaVPsJ.exe

Filesize
1.5MB

MD5
459ee4934491f63cb2bd885eca6a849a

SHA1
e47641f39db435260ea1a3d0ceaf8c7dae23cc11

SHA256
37ffa506cfdb5dc21d8aceb50ba07d266d77a228521acfb4799fac923266ebb1

SHA512
b8237ef7f548cf3dc730017986a7486327d6e0eafaaa281d391a146b857af41a2284be5fb124f76dd9a66ac3011840bfdf0450dec2b235712d584b8414e51b13

Download Submit
C:\Windows\System\XDnzPZc.exe

Filesize
1.5MB

MD5
5f2f5984f7298b2c6a64d5aca4c0eff6

SHA1
2e7cccfb9bf28d236c66cc25ee188854f5c3deed

SHA256
52f1c508000d7e26f93764487cc5759f6ee938d99c1c4247e73a5e84dbe4305a

SHA512
e4810c2f4cbcaef1bfc5cc54fbfd5adb294c965e659e736ceb43f098ee186e842e8628d627226cfe5ff1042813fd3e9d8b1505494431adece5756edc2815e55c

Download Submit
C:\Windows\System\YFGNqHT.exe

Filesize
1.5MB

MD5
1c31bc67c3cfbb305480ebe787452742

SHA1
01c4649ddeb4b7a5fcfade92d34e95fe79b04978

SHA256
57d0f8d05f5863ae241e4431dcb33bc20f6baafc852f5ce5502330e6bcc4849f

SHA512
5f2d1bb7292ca7e5f67ffed5f0fe6b63f1569bf6d6d7f5d494bdfc77e9cf4cf9038b46f7f8e6b04ce4c8aafa6f88ae5b737b8be5f6454959df1854ee25e65a9f

Download Submit
C:\Windows\System\YQwcdnW.exe

Filesize
1.5MB

MD5
bb7f61ba169079dc57715fca5025944f

SHA1
ce8ce412d13aeab8995dd32303d35cda66fecd0d

SHA256
1283ba569be22325cf9a579ae9bb1f5062df2b94b611e4882d5bd480297232cc

SHA512
b08751caad3573fd9dee3e2ae7d75ea99cba2a164b4527a7d9e468a32e8970dac1935b5fb46114cc1e5889b02344f98448b76aea641ce0e447e28c86992c6a84

Download Submit
C:\Windows\System\ZPffKTL.exe

Filesize
1.5MB

MD5
9b134f05d12f6bfe66f8f200be4f7cf1

SHA1
fb9195ed3d2ca1109b25f99cac4289d82a453bab

SHA256
cef0362f3b987f252ea546a652b4ed4149d7e0a7e8d57b231154aa69af38a628

SHA512
c85827ad26f5ca1cc479e2846c9dd71552f5a8637651536f95e3e1d1751c6fd64341905758b0c3a5c97bb161abb92f268358a095f2c31b7a19b1a74b4050c187

Download Submit
C:\Windows\System\ZsAghtm.exe

Filesize
1.5MB

MD5
fc34405d6bfc4fdcdffdca9ec7d8f04b

SHA1
4d804241f8acecffcef353a5ed417973c00a1c54

SHA256
8d973393f8f4479823dfabe4ab3f812691011d37571bbcfc887606e2bdde8b43

SHA512
e954043284f5f26c155d0b71c86daf1b19c1cea61858025a6ad9df0f501d20c9d66584a3b232cf08e33e47bc4463f7f5fcdc7058481b5e57a97612baef474baa

Download Submit
C:\Windows\System\bbqGnOQ.exe

Filesize
1.5MB

MD5
1fb230317fcc085b931bd2532978e119

SHA1
b4057e0933d6027f1eb71fc2f9b7373e69235366

SHA256
f8a8219a3b3ba8eceafa6a23a0afcc2a60bc4a615ce508ed2279dddb053307a5

SHA512
922ee1db7e7e50b6e7311af6a25528bab8d925ca863394ec488fd1fc39bf371781dc71f5f9eb2289d5ada72e28dd7f3b6b95278e8da80b98163eb9f3ef0553ff

Download Submit
C:\Windows\System\cxZPlLJ.exe

Filesize
1.5MB

MD5
0e57c6baff7b982cba6b871e6d51401b

SHA1
36bb36191b689cc81444c7c0e86b0d3cddafeabf

SHA256
bc0d31a202f74896299fe846f511bb5894c665d7751cbed1553b6523c9a6c7c6

SHA512
c5ee3142b5ed449eda117776558f35a84969c0a40493199ad4bbcf8f9c24c14500408ffb5ece1d20efb7f1f87ee1203b0d76a58d344977b446f02a3d8242a6fd

Download Submit
C:\Windows\System\fUXtNUy.exe

Filesize
1.5MB

MD5
fda32246b36bb9c45caa012fd1b2e0b7

SHA1
d64addf3cd09272ac644cbb71410bc45f3d71461

SHA256
e09ce4339142426598dc639d3737731dd97bffe1e1324f7594d0345852ab817d

SHA512
08c9d611aa873a0580565f097ff43254b42ce56af33219443acb9c7780ec249b4f35a32d0884ce9cc420905eb05dbfa3d945f704f67a214d33e171470921c7d4

Download Submit
C:\Windows\System\hQqoPXX.exe

Filesize
1.5MB

MD5
7919b1d96cde5e477962814289ca2c07

SHA1
1e06be9cb83aab0484f7b61610b0b9a98d0c339f

SHA256
fa5d6b3e60df30c1d9bd71c43956d697eb8f990d24b2e529f948f1ca72ecdf52

SHA512
bef736326b37c2c33d69aca42923c2ed0d831e3a5b8f7ff4b5c93f0dd7a00b3b0d86ab3064e22c148a58c68eb44d08b41348243913ddaa1804f098f4917338b7

Download Submit
C:\Windows\System\iqUiOvn.exe

Filesize
1.5MB

MD5
f83f5467721920ab63396a2c3108eada

SHA1
abd81047683e18d06beee1a35981a00181f3b904

SHA256
eb7595a719ec1a6aead0eff8e05430b1961cbe43d3bff6019c4ea0c374b1801c

SHA512
99bcc37ac0cd0f8f389b5f00b81c363a0534877aad7550fc3fc6f284aecf5df6b275fc810e5f7d17ca6dff64fd0731241f7aa00b7310886838f278dc2bf2e75c

Download Submit
C:\Windows\System\joddvoc.exe

Filesize
1.5MB

MD5
4614f9a4f0b13edba92159232edc30c3

SHA1
cba8ea588bcf4c85360f32f3d67bb21f638989f8

SHA256
7271a85ccc7f6776ab6e3ee662e03bc1ae05e2282578e76eae1cc1187903e0bd

SHA512
2256b9b4c8e33274aad0bef097a2ca3c98e58ebc4fb499a2d07e4349184f047cdda75154db2cc08515a063344add6960be4cef34d219559e918837f00f9adc15

Download Submit
C:\Windows\System\kkrhsbm.exe

Filesize
1.5MB

MD5
2b2d9b57a7af1cc19e98b37e1ced6b19

SHA1
503ebe6cf4b7634975f26b2751e0cd6ce466121d

SHA256
bc956fa9ef2066b720aba169caab6499fc31a9c8d1f674a6906595af3c43601e

SHA512
2508c5db57b15d7c9de4d47566fe5215e76a175de874937647b331f19fc676dbdb99c6688726dbe4278059a5821bec59ac117d1824d908278bd8d87035b58dd7

Download Submit
C:\Windows\System\vWhQCkb.exe

Filesize
1.5MB

MD5
bfbb67e252a0744f114264834eb9878c

SHA1
1101351f063e3a689569c669c99f1f48e54acc62

SHA256
0fd3852a72ef6c200f7cfb121870011e032b40b07db753bd37327ccb9bebd081

SHA512
dd0db5c6840f91259fe499d986f4196ea58756f966969dff46222fb28e4ca231dad53a5a0a07059d1c65e2b3ce2cf945f44b3c17262cdb3f9e8b04d8368c8a2f

Download Submit
C:\Windows\System\xdkozZr.exe

Filesize
1.5MB

MD5
ff24d6c66eff9e55eb4c9687bdd480a6

SHA1
ae3786380cd7a95b4cc048de058704b71a3bc970

SHA256
7a56d80d34e137f133d3b073962d50b521925d65a8f678cfb1e84f95e8956e67

SHA512
f5219c0e74c456616a36db9d75331b8e670a5ef5c2fba6238d4973c9dfd6ad03b2ff8d87bb7c12512fa86400ade5af2a0a1b1c05d5933e29510cad0d1267dbdb

Download Submit
C:\Windows\System\yJWdjYi.exe

Filesize
1.5MB

MD5
afe5c4a407849326151c2236c8a48249

SHA1
fbade35a304162f50ad1c6ff092ebaf714c9ff98

SHA256
120565eec68de295939c6cdc13002a18a4f60f53a4f53986c8b8c4d6aa8a07b3

SHA512
8af1f2eed7b010b26da1a80c544071073dd0dece88410a7585ff2b4d2c9a060aad61b76d69e930dd30dbef399bbff725b0613787ec5b699646711e26ab51138b

Download Submit
C:\Windows\System\yPHmAcO.exe

Filesize
1.5MB

MD5
b46efbf23ca5ac4eaf1c6bc2a418bb37

SHA1
cf8c95490506f88fe377c38b8aaa4ea0ea48ac0b

SHA256
e5aac213a63ee574aa8ead25c77e58911b7fd5caebae94f31821a5d3c529bf15

SHA512
b8e82dd8758c389dd21780e836bc84551ca6a0a1e0cf371daef504934e434d408fbca6ef7cb38ef0e3e33eaf06cf8d07c325a4adcd127ba3a25b8166c6b648dc

Download Submit
C:\Windows\System\ztpQdaX.exe

Filesize
1.5MB

MD5
ba356fd1f839855386aa6089d771d2a0

SHA1
581ba42823bb81c84c6887f56361838f0c889a64

SHA256
978686b251dc4bb9d05c0f09ea20e7bba4ca5b5d67759a554db7cc56686b3e5e

SHA512
4073e219e69f3df267412a4c3b7633fa906ee38634c6836106bb4ed08673643fcb5d2376c56f5ff627c8aa3cb39869e8c42af14413b80ae7cfaac4de833a8aa0

Download Submit
memory/4048-0-0x00000275B9DE0000-0x00000275B9DF0000-memory.dmp

Filesize
64KB

Download