xmrig | 4bd4ea0781940557d9388fdc558819b1819bd17b3f592f73629bd0acccd98ffe

Analysis

max time kernel
98s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
Size

1.5MB
MD5

58fa3fbb9d9df8e4c55ca096fe0fdcc0
SHA1

3e7719317c8c5a8eeffa2bd847090e9d1f53f4a5
SHA256

4bd4ea0781940557d9388fdc558819b1819bd17b3f592f73629bd0acccd98ffe
SHA512

5982a2d996230a905ad2bd6457eae9e325c3c07e1a24248215b5139911627f8ee36b4ab7f0e3d2dd3907b3d97abaf3777e061d7d8d03ccbfcbc8ba6621c3ffed
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbLS:GemTLkNdfE0pZyH

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/files/0x00090000000234c0-3.dat	xmrig
behavioral2/files/0x00070000000234c5-6.dat	xmrig
behavioral2/files/0x00070000000234c4-7.dat	xmrig
behavioral2/files/0x00070000000234c6-20.dat	xmrig
behavioral2/files/0x00070000000234c7-24.dat	xmrig
behavioral2/files/0x00070000000234c8-28.dat	xmrig
behavioral2/files/0x00070000000234c9-33.dat	xmrig
behavioral2/files/0x00090000000234c1-39.dat	xmrig
behavioral2/files/0x00070000000234cb-65.dat	xmrig
behavioral2/files/0x00070000000234ce-66.dat	xmrig
behavioral2/files/0x00070000000234cc-78.dat	xmrig
behavioral2/files/0x00070000000234da-122.dat	xmrig
behavioral2/files/0x00070000000234e2-146.dat	xmrig
behavioral2/files/0x00070000000234e7-164.dat	xmrig
behavioral2/files/0x00070000000234e4-175.dat	xmrig
behavioral2/files/0x00070000000234e3-172.dat	xmrig
behavioral2/files/0x00070000000234db-169.dat	xmrig
behavioral2/files/0x00070000000234e8-167.dat	xmrig
behavioral2/files/0x00070000000234e6-163.dat	xmrig
behavioral2/files/0x00070000000234d4-157.dat	xmrig
behavioral2/files/0x00070000000234e5-156.dat	xmrig
behavioral2/files/0x00070000000234d7-149.dat	xmrig
behavioral2/files/0x00070000000234e1-145.dat	xmrig
behavioral2/files/0x00070000000234d6-144.dat	xmrig
behavioral2/files/0x00070000000234d5-142.dat	xmrig
behavioral2/files/0x00070000000234e0-141.dat	xmrig
behavioral2/files/0x00070000000234df-137.dat	xmrig
behavioral2/files/0x00070000000234de-136.dat	xmrig
behavioral2/files/0x00070000000234dd-133.dat	xmrig
behavioral2/files/0x00070000000234d9-152.dat	xmrig
behavioral2/files/0x00070000000234dc-131.dat	xmrig
behavioral2/files/0x00070000000234d3-117.dat	xmrig
behavioral2/files/0x00070000000234d2-115.dat	xmrig
behavioral2/files/0x00070000000234d1-113.dat	xmrig
behavioral2/files/0x00070000000234d0-111.dat	xmrig
behavioral2/files/0x00070000000234d8-132.dat	xmrig
behavioral2/files/0x00070000000234cf-97.dat	xmrig
behavioral2/files/0x00070000000234cd-87.dat	xmrig
behavioral2/files/0x00070000000234ca-55.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2644	YwgErpn.exe
4200	fvxjEVQ.exe
3492	EXVoTUX.exe
3812	NWKIbUM.exe
2680	RZpszoW.exe
1876	luJoDxd.exe
1684	fEFosfQ.exe
3948	moahKok.exe
1268	mirgQBx.exe
2656	kmYpukr.exe
736	ysuovwY.exe
4800	rFqRwqf.exe
4440	VwWUZqJ.exe
4724	FCaDGKB.exe
2696	axDmAoA.exe
1996	MwUXVsu.exe
5004	uYAivrf.exe
4960	OozMurP.exe
220	QeiaRaL.exe
5092	PVrpEHw.exe
3412	AcZjgne.exe
3232	WfOrgHM.exe
3128	vwIMwuw.exe
2008	vQPPEer.exe
4188	THZLUbr.exe
548	MDWRyPq.exe
1892	QmkvmXA.exe
2868	IYhQORW.exe
4632	oUgkZlM.exe
968	wTRdjEE.exe
3060	PIHBGZF.exe
3740	QlEWmEv.exe
956	LOGTpGr.exe
3572	KATJrTi.exe
2724	McPvqmm.exe
3452	ZTyXVtn.exe
1120	QYtPBty.exe
1096	PfLrYcv.exe
4296	KqkxcNg.exe
1796	VgNgpoW.exe
1980	XLCwvyi.exe
448	mjEQZzR.exe
396	xpSxjDZ.exe
5016	KImLSkR.exe
1672	JuLLiLF.exe
2804	qdXxtlI.exe
972	KDOYIpW.exe
4004	afsKwyl.exe
1624	UYiFIpU.exe
2888	eeHjvdk.exe
3000	kJaqcXh.exe
4524	lQIzxWU.exe
1520	QOqJcii.exe
4368	DIGBUYp.exe
4364	wDQAycw.exe
2360	noeppuV.exe
4492	FIdzEVc.exe
3468	axhiKyq.exe
5000	lOxlbJE.exe
4128	NDwKxMk.exe
4484	aHDNslr.exe
636	RDLPhWl.exe
4808	KpHOUrs.exe
4952	TOtWiXs.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gFYrFUO.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\OEowODP.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\FJbQaoP.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\FWLafrL.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\IYhQORW.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\fPPIwok.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\QlEWmEv.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\ANLwFTe.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\AWpgArS.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\yULBHqS.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\ezutGwk.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\PwDLVIq.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\dsyBbmC.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\DBBRILb.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\PyEXcuv.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\yQsvJWr.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\IcoqKjH.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\WqSOLbj.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\eertbNK.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\zjSHosE.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\srgybLz.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\BdNVLlD.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\eeHjvdk.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\VbAOVDq.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\JvrOMtQ.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\YUqpWFV.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\WApMqan.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\omwjcnz.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\WuwNIAL.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\nVjhpaC.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\buEzFKp.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\BdFxWKw.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\VZqKezh.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\gUqvOqj.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\cUZRSVN.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\orWShlp.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\SmfQmcg.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\rPzAPOy.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\rFqRwqf.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\KMaoPOn.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\LDKvZbx.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\rEbfAZb.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\OVAXuzM.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\JirCCWv.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\wIsuMPL.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\CKGPTXB.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\DIGBUYp.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\uMbNgOd.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\yooALsg.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\wTRdjEE.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\QoIFBBp.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\HLTRQQJ.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\NgoQjLS.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\mqikhBJ.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\RkyHnnV.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\wuAusCR.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\wyggOMJ.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\EhQvUQy.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\KATJrTi.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\aqhFEKi.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\ndyukpt.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\nCELaqE.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\owqTqBI.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
File created	C:\Windows\System\UCXjrWk.exe	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16592	dwm.exe
Token: SeChangeNotifyPrivilege	16592	dwm.exe
Token: 33	16592	dwm.exe
Token: SeIncBasePriorityPrivilege	16592	dwm.exe
Token: SeCreateGlobalPrivilege	17580	dwm.exe
Token: SeChangeNotifyPrivilege	17580	dwm.exe
Token: 33	17580	dwm.exe
Token: SeIncBasePriorityPrivilege	17580	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2644	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	84
PID 1664 wrote to memory of 2644	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	84
PID 1664 wrote to memory of 4200	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	85
PID 1664 wrote to memory of 4200	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	85
PID 1664 wrote to memory of 3492	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	86
PID 1664 wrote to memory of 3492	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	86
PID 1664 wrote to memory of 3812	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	87
PID 1664 wrote to memory of 3812	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	87
PID 1664 wrote to memory of 2680	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	88
PID 1664 wrote to memory of 2680	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	88
PID 1664 wrote to memory of 1876	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	89
PID 1664 wrote to memory of 1876	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	89
PID 1664 wrote to memory of 1684	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	90
PID 1664 wrote to memory of 1684	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	90
PID 1664 wrote to memory of 3948	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	92
PID 1664 wrote to memory of 3948	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	92
PID 1664 wrote to memory of 1268	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	94
PID 1664 wrote to memory of 1268	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	94
PID 1664 wrote to memory of 2656	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	95
PID 1664 wrote to memory of 2656	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	95
PID 1664 wrote to memory of 736	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	96
PID 1664 wrote to memory of 736	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	96
PID 1664 wrote to memory of 4800	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	97
PID 1664 wrote to memory of 4800	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	97
PID 1664 wrote to memory of 4440	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	98
PID 1664 wrote to memory of 4440	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	98
PID 1664 wrote to memory of 4724	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	99
PID 1664 wrote to memory of 4724	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	99
PID 1664 wrote to memory of 2696	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	100
PID 1664 wrote to memory of 2696	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	100
PID 1664 wrote to memory of 1996	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	101
PID 1664 wrote to memory of 1996	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	101
PID 1664 wrote to memory of 5004	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	102
PID 1664 wrote to memory of 5004	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	102
PID 1664 wrote to memory of 4960	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	103
PID 1664 wrote to memory of 4960	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	103
PID 1664 wrote to memory of 3128	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	104
PID 1664 wrote to memory of 3128	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	104
PID 1664 wrote to memory of 220	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	105
PID 1664 wrote to memory of 220	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	105
PID 1664 wrote to memory of 5092	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	106
PID 1664 wrote to memory of 5092	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	106
PID 1664 wrote to memory of 3412	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	107
PID 1664 wrote to memory of 3412	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	107
PID 1664 wrote to memory of 1892	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	108
PID 1664 wrote to memory of 1892	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	108
PID 1664 wrote to memory of 3232	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	109
PID 1664 wrote to memory of 3232	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	109
PID 1664 wrote to memory of 2008	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	110
PID 1664 wrote to memory of 2008	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	110
PID 1664 wrote to memory of 4188	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	111
PID 1664 wrote to memory of 4188	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	111
PID 1664 wrote to memory of 548	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	112
PID 1664 wrote to memory of 548	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	112
PID 1664 wrote to memory of 2868	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	113
PID 1664 wrote to memory of 2868	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	113
PID 1664 wrote to memory of 4632	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	114
PID 1664 wrote to memory of 4632	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	114
PID 1664 wrote to memory of 968	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	115
PID 1664 wrote to memory of 968	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	115
PID 1664 wrote to memory of 3060	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	116
PID 1664 wrote to memory of 3060	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	116
PID 1664 wrote to memory of 3740	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	117
PID 1664 wrote to memory of 3740	1664	58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe	117

C:\Users\Admin\AppData\Local\Temp\58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe
"C:\Users\Admin\AppData\Local\Temp\58fa3fbb9d9df8e4c55ca096fe0fdcc0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\System\YwgErpn.exe
  C:\Windows\System\YwgErpn.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\fvxjEVQ.exe
  C:\Windows\System\fvxjEVQ.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\EXVoTUX.exe
  C:\Windows\System\EXVoTUX.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\NWKIbUM.exe
  C:\Windows\System\NWKIbUM.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\RZpszoW.exe
  C:\Windows\System\RZpszoW.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\luJoDxd.exe
  C:\Windows\System\luJoDxd.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\fEFosfQ.exe
  C:\Windows\System\fEFosfQ.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\moahKok.exe
  C:\Windows\System\moahKok.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\mirgQBx.exe
  C:\Windows\System\mirgQBx.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\kmYpukr.exe
  C:\Windows\System\kmYpukr.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\ysuovwY.exe
  C:\Windows\System\ysuovwY.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\rFqRwqf.exe
  C:\Windows\System\rFqRwqf.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\VwWUZqJ.exe
  C:\Windows\System\VwWUZqJ.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\FCaDGKB.exe
  C:\Windows\System\FCaDGKB.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\axDmAoA.exe
  C:\Windows\System\axDmAoA.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\MwUXVsu.exe
  C:\Windows\System\MwUXVsu.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\uYAivrf.exe
  C:\Windows\System\uYAivrf.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\OozMurP.exe
  C:\Windows\System\OozMurP.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\vwIMwuw.exe
  C:\Windows\System\vwIMwuw.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\QeiaRaL.exe
  C:\Windows\System\QeiaRaL.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\PVrpEHw.exe
  C:\Windows\System\PVrpEHw.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\AcZjgne.exe
  C:\Windows\System\AcZjgne.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\QmkvmXA.exe
  C:\Windows\System\QmkvmXA.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\WfOrgHM.exe
  C:\Windows\System\WfOrgHM.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\vQPPEer.exe
  C:\Windows\System\vQPPEer.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\THZLUbr.exe
  C:\Windows\System\THZLUbr.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\MDWRyPq.exe
  C:\Windows\System\MDWRyPq.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\IYhQORW.exe
  C:\Windows\System\IYhQORW.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\oUgkZlM.exe
  C:\Windows\System\oUgkZlM.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\wTRdjEE.exe
  C:\Windows\System\wTRdjEE.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\PIHBGZF.exe
  C:\Windows\System\PIHBGZF.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\QlEWmEv.exe
  C:\Windows\System\QlEWmEv.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\LOGTpGr.exe
  C:\Windows\System\LOGTpGr.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\PfLrYcv.exe
  C:\Windows\System\PfLrYcv.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\KqkxcNg.exe
  C:\Windows\System\KqkxcNg.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\KATJrTi.exe
  C:\Windows\System\KATJrTi.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\McPvqmm.exe
  C:\Windows\System\McPvqmm.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\ZTyXVtn.exe
  C:\Windows\System\ZTyXVtn.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\QYtPBty.exe
  C:\Windows\System\QYtPBty.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\VgNgpoW.exe
  C:\Windows\System\VgNgpoW.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\XLCwvyi.exe
  C:\Windows\System\XLCwvyi.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\mjEQZzR.exe
  C:\Windows\System\mjEQZzR.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\xpSxjDZ.exe
  C:\Windows\System\xpSxjDZ.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\KImLSkR.exe
  C:\Windows\System\KImLSkR.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\JuLLiLF.exe
  C:\Windows\System\JuLLiLF.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\qdXxtlI.exe
  C:\Windows\System\qdXxtlI.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\KDOYIpW.exe
  C:\Windows\System\KDOYIpW.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\afsKwyl.exe
  C:\Windows\System\afsKwyl.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\UYiFIpU.exe
  C:\Windows\System\UYiFIpU.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\eeHjvdk.exe
  C:\Windows\System\eeHjvdk.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\kJaqcXh.exe
  C:\Windows\System\kJaqcXh.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\lQIzxWU.exe
  C:\Windows\System\lQIzxWU.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\QOqJcii.exe
  C:\Windows\System\QOqJcii.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\DIGBUYp.exe
  C:\Windows\System\DIGBUYp.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\wDQAycw.exe
  C:\Windows\System\wDQAycw.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\noeppuV.exe
  C:\Windows\System\noeppuV.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\FIdzEVc.exe
  C:\Windows\System\FIdzEVc.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\axhiKyq.exe
  C:\Windows\System\axhiKyq.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\lOxlbJE.exe
  C:\Windows\System\lOxlbJE.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\NDwKxMk.exe
  C:\Windows\System\NDwKxMk.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\aHDNslr.exe
  C:\Windows\System\aHDNslr.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\RDLPhWl.exe
  C:\Windows\System\RDLPhWl.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\KpHOUrs.exe
  C:\Windows\System\KpHOUrs.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\TOtWiXs.exe
  C:\Windows\System\TOtWiXs.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\mtlmZBW.exe
  C:\Windows\System\mtlmZBW.exe
  2⤵
  PID:4008
- C:\Windows\System\yfQGIST.exe
  C:\Windows\System\yfQGIST.exe
  2⤵
  PID:3288
- C:\Windows\System\uPPLGJU.exe
  C:\Windows\System\uPPLGJU.exe
  2⤵
  PID:1444
- C:\Windows\System\OkFZqUQ.exe
  C:\Windows\System\OkFZqUQ.exe
  2⤵
  PID:4444
- C:\Windows\System\vkYtgOi.exe
  C:\Windows\System\vkYtgOi.exe
  2⤵
  PID:4640
- C:\Windows\System\hekdJhh.exe
  C:\Windows\System\hekdJhh.exe
  2⤵
  PID:3272
- C:\Windows\System\iVuojhD.exe
  C:\Windows\System\iVuojhD.exe
  2⤵
  PID:3052
- C:\Windows\System\PUZYahF.exe
  C:\Windows\System\PUZYahF.exe
  2⤵
  PID:4332
- C:\Windows\System\IvUNhIc.exe
  C:\Windows\System\IvUNhIc.exe
  2⤵
  PID:5024
- C:\Windows\System\yQsvJWr.exe
  C:\Windows\System\yQsvJWr.exe
  2⤵
  PID:4924
- C:\Windows\System\KxMIADy.exe
  C:\Windows\System\KxMIADy.exe
  2⤵
  PID:4360
- C:\Windows\System\MVbXuCO.exe
  C:\Windows\System\MVbXuCO.exe
  2⤵
  PID:4092
- C:\Windows\System\JWMhHnR.exe
  C:\Windows\System\JWMhHnR.exe
  2⤵
  PID:3920
- C:\Windows\System\keHKCsU.exe
  C:\Windows\System\keHKCsU.exe
  2⤵
  PID:1160
- C:\Windows\System\DJQoMGx.exe
  C:\Windows\System\DJQoMGx.exe
  2⤵
  PID:4616
- C:\Windows\System\umdBlBT.exe
  C:\Windows\System\umdBlBT.exe
  2⤵
  PID:3104
- C:\Windows\System\scclAPS.exe
  C:\Windows\System\scclAPS.exe
  2⤵
  PID:2052
- C:\Windows\System\cUgDvVZ.exe
  C:\Windows\System\cUgDvVZ.exe
  2⤵
  PID:1168
- C:\Windows\System\GSmSupC.exe
  C:\Windows\System\GSmSupC.exe
  2⤵
  PID:4060
- C:\Windows\System\kJlytPi.exe
  C:\Windows\System\kJlytPi.exe
  2⤵
  PID:2636
- C:\Windows\System\oLqOtRX.exe
  C:\Windows\System\oLqOtRX.exe
  2⤵
  PID:4320
- C:\Windows\System\wjroRnv.exe
  C:\Windows\System\wjroRnv.exe
  2⤵
  PID:3524
- C:\Windows\System\QoIFBBp.exe
  C:\Windows\System\QoIFBBp.exe
  2⤵
  PID:1136
- C:\Windows\System\azDMOwN.exe
  C:\Windows\System\azDMOwN.exe
  2⤵
  PID:1676
- C:\Windows\System\iGPpNGs.exe
  C:\Windows\System\iGPpNGs.exe
  2⤵
  PID:3768
- C:\Windows\System\hiTPwfw.exe
  C:\Windows\System\hiTPwfw.exe
  2⤵
  PID:2676
- C:\Windows\System\lcGrxXB.exe
  C:\Windows\System\lcGrxXB.exe
  2⤵
  PID:1068
- C:\Windows\System\KMaoPOn.exe
  C:\Windows\System\KMaoPOn.exe
  2⤵
  PID:876
- C:\Windows\System\XSfBsRb.exe
  C:\Windows\System\XSfBsRb.exe
  2⤵
  PID:3988
- C:\Windows\System\FrOpfuN.exe
  C:\Windows\System\FrOpfuN.exe
  2⤵
  PID:4476
- C:\Windows\System\wjwTpzv.exe
  C:\Windows\System\wjwTpzv.exe
  2⤵
  PID:332
- C:\Windows\System\UipsKUK.exe
  C:\Windows\System\UipsKUK.exe
  2⤵
  PID:3588
- C:\Windows\System\gDmYGsZ.exe
  C:\Windows\System\gDmYGsZ.exe
  2⤵
  PID:2188
- C:\Windows\System\KtSpcIv.exe
  C:\Windows\System\KtSpcIv.exe
  2⤵
  PID:4412
- C:\Windows\System\LECcAIL.exe
  C:\Windows\System\LECcAIL.exe
  2⤵
  PID:2244
- C:\Windows\System\paJJqsW.exe
  C:\Windows\System\paJJqsW.exe
  2⤵
  PID:700
- C:\Windows\System\wmRWSVx.exe
  C:\Windows\System\wmRWSVx.exe
  2⤵
  PID:3912
- C:\Windows\System\IcoqKjH.exe
  C:\Windows\System\IcoqKjH.exe
  2⤵
  PID:444
- C:\Windows\System\bvXUKGX.exe
  C:\Windows\System\bvXUKGX.exe
  2⤵
  PID:552
- C:\Windows\System\eZMrlzl.exe
  C:\Windows\System\eZMrlzl.exe
  2⤵
  PID:5032
- C:\Windows\System\FLEuGJb.exe
  C:\Windows\System\FLEuGJb.exe
  2⤵
  PID:5076
- C:\Windows\System\exajGax.exe
  C:\Windows\System\exajGax.exe
  2⤵
  PID:5148
- C:\Windows\System\oFqrzmO.exe
  C:\Windows\System\oFqrzmO.exe
  2⤵
  PID:5168
- C:\Windows\System\TiEiOLz.exe
  C:\Windows\System\TiEiOLz.exe
  2⤵
  PID:5196
- C:\Windows\System\EJhLpNK.exe
  C:\Windows\System\EJhLpNK.exe
  2⤵
  PID:5224
- C:\Windows\System\yeGYGeJ.exe
  C:\Windows\System\yeGYGeJ.exe
  2⤵
  PID:5244
- C:\Windows\System\CjqEAEb.exe
  C:\Windows\System\CjqEAEb.exe
  2⤵
  PID:5260
- C:\Windows\System\KBfmzoo.exe
  C:\Windows\System\KBfmzoo.exe
  2⤵
  PID:5288
- C:\Windows\System\lIVqwiL.exe
  C:\Windows\System\lIVqwiL.exe
  2⤵
  PID:5320
- C:\Windows\System\fjfCFVj.exe
  C:\Windows\System\fjfCFVj.exe
  2⤵
  PID:5344
- C:\Windows\System\LZwoXAx.exe
  C:\Windows\System\LZwoXAx.exe
  2⤵
  PID:5364
- C:\Windows\System\TfCeFRS.exe
  C:\Windows\System\TfCeFRS.exe
  2⤵
  PID:5396
- C:\Windows\System\yTrfEQH.exe
  C:\Windows\System\yTrfEQH.exe
  2⤵
  PID:5424
- C:\Windows\System\rDPwJdq.exe
  C:\Windows\System\rDPwJdq.exe
  2⤵
  PID:5444
- C:\Windows\System\hLyWLWb.exe
  C:\Windows\System\hLyWLWb.exe
  2⤵
  PID:5468
- C:\Windows\System\TNTCnxv.exe
  C:\Windows\System\TNTCnxv.exe
  2⤵
  PID:5488
- C:\Windows\System\VsWeKIT.exe
  C:\Windows\System\VsWeKIT.exe
  2⤵
  PID:5512
- C:\Windows\System\hgJDuGu.exe
  C:\Windows\System\hgJDuGu.exe
  2⤵
  PID:5544
- C:\Windows\System\DichxWx.exe
  C:\Windows\System\DichxWx.exe
  2⤵
  PID:5580
- C:\Windows\System\jliiIAY.exe
  C:\Windows\System\jliiIAY.exe
  2⤵
  PID:5608
- C:\Windows\System\EmmDwfM.exe
  C:\Windows\System\EmmDwfM.exe
  2⤵
  PID:5644
- C:\Windows\System\jZdwqAY.exe
  C:\Windows\System\jZdwqAY.exe
  2⤵
  PID:5672
- C:\Windows\System\WUarDyG.exe
  C:\Windows\System\WUarDyG.exe
  2⤵
  PID:5696
- C:\Windows\System\VbAOVDq.exe
  C:\Windows\System\VbAOVDq.exe
  2⤵
  PID:5728
- C:\Windows\System\FLpKWRt.exe
  C:\Windows\System\FLpKWRt.exe
  2⤵
  PID:5768
- C:\Windows\System\YhEUhsA.exe
  C:\Windows\System\YhEUhsA.exe
  2⤵
  PID:5788
- C:\Windows\System\zLSSubg.exe
  C:\Windows\System\zLSSubg.exe
  2⤵
  PID:5812
- C:\Windows\System\AmyYsDH.exe
  C:\Windows\System\AmyYsDH.exe
  2⤵
  PID:5848
- C:\Windows\System\xGUyDqY.exe
  C:\Windows\System\xGUyDqY.exe
  2⤵
  PID:5876
- C:\Windows\System\TbJnijl.exe
  C:\Windows\System\TbJnijl.exe
  2⤵
  PID:5904
- C:\Windows\System\mDpfRBG.exe
  C:\Windows\System\mDpfRBG.exe
  2⤵
  PID:5928
- C:\Windows\System\UXhsjqR.exe
  C:\Windows\System\UXhsjqR.exe
  2⤵
  PID:5956
- C:\Windows\System\uhWgWWr.exe
  C:\Windows\System\uhWgWWr.exe
  2⤵
  PID:5984
- C:\Windows\System\AVwpUNO.exe
  C:\Windows\System\AVwpUNO.exe
  2⤵
  PID:6020
- C:\Windows\System\qYPwykr.exe
  C:\Windows\System\qYPwykr.exe
  2⤵
  PID:6040
- C:\Windows\System\NReDHZm.exe
  C:\Windows\System\NReDHZm.exe
  2⤵
  PID:6064
- C:\Windows\System\xXKVbjH.exe
  C:\Windows\System\xXKVbjH.exe
  2⤵
  PID:6096
- C:\Windows\System\EaiWxIj.exe
  C:\Windows\System\EaiWxIj.exe
  2⤵
  PID:6124
- C:\Windows\System\NVozHzr.exe
  C:\Windows\System\NVozHzr.exe
  2⤵
  PID:2464
- C:\Windows\System\ADyHbmS.exe
  C:\Windows\System\ADyHbmS.exe
  2⤵
  PID:5212
- C:\Windows\System\PxWZkuC.exe
  C:\Windows\System\PxWZkuC.exe
  2⤵
  PID:5232
- C:\Windows\System\BGlalLm.exe
  C:\Windows\System\BGlalLm.exe
  2⤵
  PID:5276
- C:\Windows\System\kTgASRb.exe
  C:\Windows\System\kTgASRb.exe
  2⤵
  PID:5340
- C:\Windows\System\IAbnckx.exe
  C:\Windows\System\IAbnckx.exe
  2⤵
  PID:5332
- C:\Windows\System\XHZiEvz.exe
  C:\Windows\System\XHZiEvz.exe
  2⤵
  PID:5500
- C:\Windows\System\KHaaEtM.exe
  C:\Windows\System\KHaaEtM.exe
  2⤵
  PID:5564
- C:\Windows\System\aOmUHOa.exe
  C:\Windows\System\aOmUHOa.exe
  2⤵
  PID:5524
- C:\Windows\System\iBnQIRQ.exe
  C:\Windows\System\iBnQIRQ.exe
  2⤵
  PID:5752
- C:\Windows\System\eAZJZEB.exe
  C:\Windows\System\eAZJZEB.exe
  2⤵
  PID:5808
- C:\Windows\System\ukpWqrb.exe
  C:\Windows\System\ukpWqrb.exe
  2⤵
  PID:5872
- C:\Windows\System\wgCMqti.exe
  C:\Windows\System\wgCMqti.exe
  2⤵
  PID:5976
- C:\Windows\System\hotBYhF.exe
  C:\Windows\System\hotBYhF.exe
  2⤵
  PID:5948
- C:\Windows\System\NeSTheZ.exe
  C:\Windows\System\NeSTheZ.exe
  2⤵
  PID:6004
- C:\Windows\System\rLkOuLO.exe
  C:\Windows\System\rLkOuLO.exe
  2⤵
  PID:6116
- C:\Windows\System\PeiXbcC.exe
  C:\Windows\System\PeiXbcC.exe
  2⤵
  PID:5188
- C:\Windows\System\rVrWoBE.exe
  C:\Windows\System\rVrWoBE.exe
  2⤵
  PID:5280
- C:\Windows\System\NxZHrwM.exe
  C:\Windows\System\NxZHrwM.exe
  2⤵
  PID:5356
- C:\Windows\System\sUiHasZ.exe
  C:\Windows\System\sUiHasZ.exe
  2⤵
  PID:5508
- C:\Windows\System\IEJTpwL.exe
  C:\Windows\System\IEJTpwL.exe
  2⤵
  PID:5716
- C:\Windows\System\mghPwol.exe
  C:\Windows\System\mghPwol.exe
  2⤵
  PID:5868
- C:\Windows\System\jMOJPRi.exe
  C:\Windows\System\jMOJPRi.exe
  2⤵
  PID:6052
- C:\Windows\System\wRILPOH.exe
  C:\Windows\System\wRILPOH.exe
  2⤵
  PID:5680
- C:\Windows\System\cHPnxSg.exe
  C:\Windows\System\cHPnxSg.exe
  2⤵
  PID:5708
- C:\Windows\System\aJPCbzK.exe
  C:\Windows\System\aJPCbzK.exe
  2⤵
  PID:5352
- C:\Windows\System\QzfagSw.exe
  C:\Windows\System\QzfagSw.exe
  2⤵
  PID:6164
- C:\Windows\System\RhgDMVO.exe
  C:\Windows\System\RhgDMVO.exe
  2⤵
  PID:6180
- C:\Windows\System\VoygYvB.exe
  C:\Windows\System\VoygYvB.exe
  2⤵
  PID:6216
- C:\Windows\System\GwVOwNQ.exe
  C:\Windows\System\GwVOwNQ.exe
  2⤵
  PID:6248
- C:\Windows\System\jsffdIS.exe
  C:\Windows\System\jsffdIS.exe
  2⤵
  PID:6280
- C:\Windows\System\nJWZXlX.exe
  C:\Windows\System\nJWZXlX.exe
  2⤵
  PID:6304
- C:\Windows\System\indaPfN.exe
  C:\Windows\System\indaPfN.exe
  2⤵
  PID:6332
- C:\Windows\System\ZVKejNu.exe
  C:\Windows\System\ZVKejNu.exe
  2⤵
  PID:6356
- C:\Windows\System\TBuhLqX.exe
  C:\Windows\System\TBuhLqX.exe
  2⤵
  PID:6380
- C:\Windows\System\kGgtYGJ.exe
  C:\Windows\System\kGgtYGJ.exe
  2⤵
  PID:6412
- C:\Windows\System\MrBlbSq.exe
  C:\Windows\System\MrBlbSq.exe
  2⤵
  PID:6432
- C:\Windows\System\TqrOHXR.exe
  C:\Windows\System\TqrOHXR.exe
  2⤵
  PID:6464
- C:\Windows\System\DrwStfv.exe
  C:\Windows\System\DrwStfv.exe
  2⤵
  PID:6488
- C:\Windows\System\HcheUFL.exe
  C:\Windows\System\HcheUFL.exe
  2⤵
  PID:6512
- C:\Windows\System\PHRLume.exe
  C:\Windows\System\PHRLume.exe
  2⤵
  PID:6544
- C:\Windows\System\ThHqOhw.exe
  C:\Windows\System\ThHqOhw.exe
  2⤵
  PID:6576
- C:\Windows\System\ixRfcui.exe
  C:\Windows\System\ixRfcui.exe
  2⤵
  PID:6604
- C:\Windows\System\ERpMmyQ.exe
  C:\Windows\System\ERpMmyQ.exe
  2⤵
  PID:6628
- C:\Windows\System\MiKokfl.exe
  C:\Windows\System\MiKokfl.exe
  2⤵
  PID:6664
- C:\Windows\System\PXSwnCv.exe
  C:\Windows\System\PXSwnCv.exe
  2⤵
  PID:6700
- C:\Windows\System\mXJMZin.exe
  C:\Windows\System\mXJMZin.exe
  2⤵
  PID:6720
- C:\Windows\System\NrZrzkb.exe
  C:\Windows\System\NrZrzkb.exe
  2⤵
  PID:6748
- C:\Windows\System\HLTRQQJ.exe
  C:\Windows\System\HLTRQQJ.exe
  2⤵
  PID:6772
- C:\Windows\System\WZglGcL.exe
  C:\Windows\System\WZglGcL.exe
  2⤵
  PID:6796
- C:\Windows\System\JRifKbo.exe
  C:\Windows\System\JRifKbo.exe
  2⤵
  PID:6828
- C:\Windows\System\lOsivDI.exe
  C:\Windows\System\lOsivDI.exe
  2⤵
  PID:6852
- C:\Windows\System\TpIYoph.exe
  C:\Windows\System\TpIYoph.exe
  2⤵
  PID:6880
- C:\Windows\System\cNdxGgD.exe
  C:\Windows\System\cNdxGgD.exe
  2⤵
  PID:6912
- C:\Windows\System\VvDCiCt.exe
  C:\Windows\System\VvDCiCt.exe
  2⤵
  PID:6936
- C:\Windows\System\xtxPmwZ.exe
  C:\Windows\System\xtxPmwZ.exe
  2⤵
  PID:6968
- C:\Windows\System\MBGaGgd.exe
  C:\Windows\System\MBGaGgd.exe
  2⤵
  PID:7000
- C:\Windows\System\IscXawX.exe
  C:\Windows\System\IscXawX.exe
  2⤵
  PID:7020
- C:\Windows\System\aILAVeq.exe
  C:\Windows\System\aILAVeq.exe
  2⤵
  PID:7052
- C:\Windows\System\ABlllBO.exe
  C:\Windows\System\ABlllBO.exe
  2⤵
  PID:7084
- C:\Windows\System\RSpvNEB.exe
  C:\Windows\System\RSpvNEB.exe
  2⤵
  PID:7108
- C:\Windows\System\MpMgXOp.exe
  C:\Windows\System\MpMgXOp.exe
  2⤵
  PID:7144
- C:\Windows\System\LvMlHdX.exe
  C:\Windows\System\LvMlHdX.exe
  2⤵
  PID:5456
- C:\Windows\System\OHkcsXP.exe
  C:\Windows\System\OHkcsXP.exe
  2⤵
  PID:6176
- C:\Windows\System\ZKeLKvU.exe
  C:\Windows\System\ZKeLKvU.exe
  2⤵
  PID:6244
- C:\Windows\System\dCcBhJz.exe
  C:\Windows\System\dCcBhJz.exe
  2⤵
  PID:6236
- C:\Windows\System\sOmfHbu.exe
  C:\Windows\System\sOmfHbu.exe
  2⤵
  PID:6352
- C:\Windows\System\OLudZiF.exe
  C:\Windows\System\OLudZiF.exe
  2⤵
  PID:6440
- C:\Windows\System\oTZVKZi.exe
  C:\Windows\System\oTZVKZi.exe
  2⤵
  PID:6448
- C:\Windows\System\GUOOaLb.exe
  C:\Windows\System\GUOOaLb.exe
  2⤵
  PID:6532
- C:\Windows\System\hmlmozG.exe
  C:\Windows\System\hmlmozG.exe
  2⤵
  PID:6508
- C:\Windows\System\JkMyPBt.exe
  C:\Windows\System\JkMyPBt.exe
  2⤵
  PID:6652
- C:\Windows\System\QAuOYuP.exe
  C:\Windows\System\QAuOYuP.exe
  2⤵
  PID:6672
- C:\Windows\System\peUoQXm.exe
  C:\Windows\System\peUoQXm.exe
  2⤵
  PID:6744
- C:\Windows\System\rLtDcti.exe
  C:\Windows\System\rLtDcti.exe
  2⤵
  PID:6816
- C:\Windows\System\TkUhlgE.exe
  C:\Windows\System\TkUhlgE.exe
  2⤵
  PID:6840
- C:\Windows\System\PrvlDWt.exe
  C:\Windows\System\PrvlDWt.exe
  2⤵
  PID:6924
- C:\Windows\System\tFmLsLG.exe
  C:\Windows\System\tFmLsLG.exe
  2⤵
  PID:7068
- C:\Windows\System\expcnUR.exe
  C:\Windows\System\expcnUR.exe
  2⤵
  PID:7100
- C:\Windows\System\BwxFICo.exe
  C:\Windows\System\BwxFICo.exe
  2⤵
  PID:6204
- C:\Windows\System\SOKMErk.exe
  C:\Windows\System\SOKMErk.exe
  2⤵
  PID:6260
- C:\Windows\System\ajUcHeL.exe
  C:\Windows\System\ajUcHeL.exe
  2⤵
  PID:6396
- C:\Windows\System\MXWvLHj.exe
  C:\Windows\System\MXWvLHj.exe
  2⤵
  PID:6400
- C:\Windows\System\dDiZZxJ.exe
  C:\Windows\System\dDiZZxJ.exe
  2⤵
  PID:6848
- C:\Windows\System\cEoRXpq.exe
  C:\Windows\System\cEoRXpq.exe
  2⤵
  PID:6808
- C:\Windows\System\hLXDdXB.exe
  C:\Windows\System\hLXDdXB.exe
  2⤵
  PID:7132
- C:\Windows\System\lrXHRFl.exe
  C:\Windows\System\lrXHRFl.exe
  2⤵
  PID:6588
- C:\Windows\System\SefiPVD.exe
  C:\Windows\System\SefiPVD.exe
  2⤵
  PID:6524
- C:\Windows\System\GQRAEgm.exe
  C:\Windows\System\GQRAEgm.exe
  2⤵
  PID:6172
- C:\Windows\System\iEDpiLJ.exe
  C:\Windows\System\iEDpiLJ.exe
  2⤵
  PID:7188
- C:\Windows\System\xERzlWN.exe
  C:\Windows\System\xERzlWN.exe
  2⤵
  PID:7212
- C:\Windows\System\jwWxbRC.exe
  C:\Windows\System\jwWxbRC.exe
  2⤵
  PID:7240
- C:\Windows\System\RuXlWEr.exe
  C:\Windows\System\RuXlWEr.exe
  2⤵
  PID:7280
- C:\Windows\System\hPLAqym.exe
  C:\Windows\System\hPLAqym.exe
  2⤵
  PID:7308
- C:\Windows\System\xUSjKcP.exe
  C:\Windows\System\xUSjKcP.exe
  2⤵
  PID:7336
- C:\Windows\System\FEQXrTs.exe
  C:\Windows\System\FEQXrTs.exe
  2⤵
  PID:7360
- C:\Windows\System\oEaaAYq.exe
  C:\Windows\System\oEaaAYq.exe
  2⤵
  PID:7380
- C:\Windows\System\nDiJgoS.exe
  C:\Windows\System\nDiJgoS.exe
  2⤵
  PID:7396
- C:\Windows\System\azduOdP.exe
  C:\Windows\System\azduOdP.exe
  2⤵
  PID:7424
- C:\Windows\System\DMBXobV.exe
  C:\Windows\System\DMBXobV.exe
  2⤵
  PID:7468
- C:\Windows\System\hcDSYBv.exe
  C:\Windows\System\hcDSYBv.exe
  2⤵
  PID:7492
- C:\Windows\System\nXFsJvw.exe
  C:\Windows\System\nXFsJvw.exe
  2⤵
  PID:7516
- C:\Windows\System\PtWsgKR.exe
  C:\Windows\System\PtWsgKR.exe
  2⤵
  PID:7540
- C:\Windows\System\lduxqvN.exe
  C:\Windows\System\lduxqvN.exe
  2⤵
  PID:7572
- C:\Windows\System\moSNdCd.exe
  C:\Windows\System\moSNdCd.exe
  2⤵
  PID:7604
- C:\Windows\System\dTwamJi.exe
  C:\Windows\System\dTwamJi.exe
  2⤵
  PID:7632
- C:\Windows\System\LCeOQOF.exe
  C:\Windows\System\LCeOQOF.exe
  2⤵
  PID:7660
- C:\Windows\System\qlldzzx.exe
  C:\Windows\System\qlldzzx.exe
  2⤵
  PID:7692
- C:\Windows\System\UQJjIez.exe
  C:\Windows\System\UQJjIez.exe
  2⤵
  PID:7724
- C:\Windows\System\cSQnYIP.exe
  C:\Windows\System\cSQnYIP.exe
  2⤵
  PID:7740
- C:\Windows\System\egIhraL.exe
  C:\Windows\System\egIhraL.exe
  2⤵
  PID:7776
- C:\Windows\System\EymCCaL.exe
  C:\Windows\System\EymCCaL.exe
  2⤵
  PID:7804
- C:\Windows\System\xEzVJtI.exe
  C:\Windows\System\xEzVJtI.exe
  2⤵
  PID:7836
- C:\Windows\System\qXrFfWl.exe
  C:\Windows\System\qXrFfWl.exe
  2⤵
  PID:7860
- C:\Windows\System\uwOitDj.exe
  C:\Windows\System\uwOitDj.exe
  2⤵
  PID:7900
- C:\Windows\System\GOsHfGp.exe
  C:\Windows\System\GOsHfGp.exe
  2⤵
  PID:7920
- C:\Windows\System\GRrquUF.exe
  C:\Windows\System\GRrquUF.exe
  2⤵
  PID:7956
- C:\Windows\System\JUWHeQf.exe
  C:\Windows\System\JUWHeQf.exe
  2⤵
  PID:7984
- C:\Windows\System\FWLafrL.exe
  C:\Windows\System\FWLafrL.exe
  2⤵
  PID:8008
- C:\Windows\System\pPyodUd.exe
  C:\Windows\System\pPyodUd.exe
  2⤵
  PID:8032
- C:\Windows\System\qEtAnmB.exe
  C:\Windows\System\qEtAnmB.exe
  2⤵
  PID:8060
- C:\Windows\System\gEANFeH.exe
  C:\Windows\System\gEANFeH.exe
  2⤵
  PID:8080
- C:\Windows\System\EDmWfdm.exe
  C:\Windows\System\EDmWfdm.exe
  2⤵
  PID:8116
- C:\Windows\System\EAhaLVF.exe
  C:\Windows\System\EAhaLVF.exe
  2⤵
  PID:8152
- C:\Windows\System\zjsuBKW.exe
  C:\Windows\System\zjsuBKW.exe
  2⤵
  PID:8180
- C:\Windows\System\YLfyOCp.exe
  C:\Windows\System\YLfyOCp.exe
  2⤵
  PID:7156
- C:\Windows\System\ZFvBxDd.exe
  C:\Windows\System\ZFvBxDd.exe
  2⤵
  PID:7236
- C:\Windows\System\NAvzBwq.exe
  C:\Windows\System\NAvzBwq.exe
  2⤵
  PID:7228
- C:\Windows\System\lbOCPpS.exe
  C:\Windows\System\lbOCPpS.exe
  2⤵
  PID:7320
- C:\Windows\System\IcBaBjW.exe
  C:\Windows\System\IcBaBjW.exe
  2⤵
  PID:7388
- C:\Windows\System\RwoKpgG.exe
  C:\Windows\System\RwoKpgG.exe
  2⤵
  PID:7408
- C:\Windows\System\RfLrleq.exe
  C:\Windows\System\RfLrleq.exe
  2⤵
  PID:7488
- C:\Windows\System\FtbeYqb.exe
  C:\Windows\System\FtbeYqb.exe
  2⤵
  PID:7588
- C:\Windows\System\ZFczgMS.exe
  C:\Windows\System\ZFczgMS.exe
  2⤵
  PID:6460
- C:\Windows\System\Pgsuprv.exe
  C:\Windows\System\Pgsuprv.exe
  2⤵
  PID:7704
- C:\Windows\System\RJUYpla.exe
  C:\Windows\System\RJUYpla.exe
  2⤵
  PID:7644
- C:\Windows\System\kMJgkZZ.exe
  C:\Windows\System\kMJgkZZ.exe
  2⤵
  PID:7816
- C:\Windows\System\buEzFKp.exe
  C:\Windows\System\buEzFKp.exe
  2⤵
  PID:7848
- C:\Windows\System\emMqSBr.exe
  C:\Windows\System\emMqSBr.exe
  2⤵
  PID:7884
- C:\Windows\System\arCANpb.exe
  C:\Windows\System\arCANpb.exe
  2⤵
  PID:7932
- C:\Windows\System\skvKGpa.exe
  C:\Windows\System\skvKGpa.exe
  2⤵
  PID:8020
- C:\Windows\System\rrlDTEE.exe
  C:\Windows\System\rrlDTEE.exe
  2⤵
  PID:8076
- C:\Windows\System\mjlcJCj.exe
  C:\Windows\System\mjlcJCj.exe
  2⤵
  PID:7028
- C:\Windows\System\pqkSBMt.exe
  C:\Windows\System\pqkSBMt.exe
  2⤵
  PID:6300
- C:\Windows\System\vLBPkJr.exe
  C:\Windows\System\vLBPkJr.exe
  2⤵
  PID:7264
- C:\Windows\System\XUxtuEJ.exe
  C:\Windows\System\XUxtuEJ.exe
  2⤵
  PID:7392
- C:\Windows\System\HXIZORC.exe
  C:\Windows\System\HXIZORC.exe
  2⤵
  PID:7716
- C:\Windows\System\lAaalPb.exe
  C:\Windows\System\lAaalPb.exe
  2⤵
  PID:7856
- C:\Windows\System\zVzrKGO.exe
  C:\Windows\System\zVzrKGO.exe
  2⤵
  PID:8068
- C:\Windows\System\wvzcpgZ.exe
  C:\Windows\System\wvzcpgZ.exe
  2⤵
  PID:6292
- C:\Windows\System\aqhFEKi.exe
  C:\Windows\System\aqhFEKi.exe
  2⤵
  PID:7528
- C:\Windows\System\ExHiFqP.exe
  C:\Windows\System\ExHiFqP.exe
  2⤵
  PID:7916
- C:\Windows\System\JqROGhv.exe
  C:\Windows\System\JqROGhv.exe
  2⤵
  PID:7708
- C:\Windows\System\plHbjjG.exe
  C:\Windows\System\plHbjjG.exe
  2⤵
  PID:8024
- C:\Windows\System\ORdqtQr.exe
  C:\Windows\System\ORdqtQr.exe
  2⤵
  PID:8200
- C:\Windows\System\YatcLtU.exe
  C:\Windows\System\YatcLtU.exe
  2⤵
  PID:8240
- C:\Windows\System\VRfNMxu.exe
  C:\Windows\System\VRfNMxu.exe
  2⤵
  PID:8272
- C:\Windows\System\KDIXTpD.exe
  C:\Windows\System\KDIXTpD.exe
  2⤵
  PID:8296
- C:\Windows\System\GoMDspG.exe
  C:\Windows\System\GoMDspG.exe
  2⤵
  PID:8320
- C:\Windows\System\VIcImQm.exe
  C:\Windows\System\VIcImQm.exe
  2⤵
  PID:8344
- C:\Windows\System\bCljRvs.exe
  C:\Windows\System\bCljRvs.exe
  2⤵
  PID:8376
- C:\Windows\System\BVZYKXQ.exe
  C:\Windows\System\BVZYKXQ.exe
  2⤵
  PID:8408
- C:\Windows\System\OerMILD.exe
  C:\Windows\System\OerMILD.exe
  2⤵
  PID:8440
- C:\Windows\System\atqJJBv.exe
  C:\Windows\System\atqJJBv.exe
  2⤵
  PID:8468
- C:\Windows\System\gDxznlF.exe
  C:\Windows\System\gDxznlF.exe
  2⤵
  PID:8504
- C:\Windows\System\gUqvOqj.exe
  C:\Windows\System\gUqvOqj.exe
  2⤵
  PID:8524
- C:\Windows\System\GGnWXLZ.exe
  C:\Windows\System\GGnWXLZ.exe
  2⤵
  PID:8556
- C:\Windows\System\zShlUQC.exe
  C:\Windows\System\zShlUQC.exe
  2⤵
  PID:8580
- C:\Windows\System\yyaAKHt.exe
  C:\Windows\System\yyaAKHt.exe
  2⤵
  PID:8616
- C:\Windows\System\ngBFwmT.exe
  C:\Windows\System\ngBFwmT.exe
  2⤵
  PID:8640
- C:\Windows\System\uDeuABQ.exe
  C:\Windows\System\uDeuABQ.exe
  2⤵
  PID:8672
- C:\Windows\System\Dvmpyxv.exe
  C:\Windows\System\Dvmpyxv.exe
  2⤵
  PID:8696
- C:\Windows\System\DYfhFcY.exe
  C:\Windows\System\DYfhFcY.exe
  2⤵
  PID:8728
- C:\Windows\System\WGYoUjm.exe
  C:\Windows\System\WGYoUjm.exe
  2⤵
  PID:8760
- C:\Windows\System\GDPVaHi.exe
  C:\Windows\System\GDPVaHi.exe
  2⤵
  PID:8780
- C:\Windows\System\hSykxEK.exe
  C:\Windows\System\hSykxEK.exe
  2⤵
  PID:8816
- C:\Windows\System\gFYrFUO.exe
  C:\Windows\System\gFYrFUO.exe
  2⤵
  PID:8856
- C:\Windows\System\BPTgFYu.exe
  C:\Windows\System\BPTgFYu.exe
  2⤵
  PID:8880
- C:\Windows\System\kHAHceG.exe
  C:\Windows\System\kHAHceG.exe
  2⤵
  PID:8904
- C:\Windows\System\mtIsjDw.exe
  C:\Windows\System\mtIsjDw.exe
  2⤵
  PID:8924
- C:\Windows\System\tAOUyMO.exe
  C:\Windows\System\tAOUyMO.exe
  2⤵
  PID:8956
- C:\Windows\System\agtjWXv.exe
  C:\Windows\System\agtjWXv.exe
  2⤵
  PID:8992
- C:\Windows\System\cfKuogT.exe
  C:\Windows\System\cfKuogT.exe
  2⤵
  PID:9024
- C:\Windows\System\KxJrzeV.exe
  C:\Windows\System\KxJrzeV.exe
  2⤵
  PID:9048
- C:\Windows\System\qgOvWuY.exe
  C:\Windows\System\qgOvWuY.exe
  2⤵
  PID:9064
- C:\Windows\System\ezgwOCZ.exe
  C:\Windows\System\ezgwOCZ.exe
  2⤵
  PID:9092
- C:\Windows\System\aXvGZfN.exe
  C:\Windows\System\aXvGZfN.exe
  2⤵
  PID:9116
- C:\Windows\System\vRZiqOq.exe
  C:\Windows\System\vRZiqOq.exe
  2⤵
  PID:9148
- C:\Windows\System\wSqcvXp.exe
  C:\Windows\System\wSqcvXp.exe
  2⤵
  PID:9188
- C:\Windows\System\qVZLwlV.exe
  C:\Windows\System\qVZLwlV.exe
  2⤵
  PID:7248
- C:\Windows\System\ddxEXeK.exe
  C:\Windows\System\ddxEXeK.exe
  2⤵
  PID:8224
- C:\Windows\System\xWkMGYW.exe
  C:\Windows\System\xWkMGYW.exe
  2⤵
  PID:8292
- C:\Windows\System\XhYyQCE.exe
  C:\Windows\System\XhYyQCE.exe
  2⤵
  PID:8308
- C:\Windows\System\bZvXZfz.exe
  C:\Windows\System\bZvXZfz.exe
  2⤵
  PID:8364
- C:\Windows\System\MnJUayq.exe
  C:\Windows\System\MnJUayq.exe
  2⤵
  PID:8448
- C:\Windows\System\cJERDKc.exe
  C:\Windows\System\cJERDKc.exe
  2⤵
  PID:8568
- C:\Windows\System\MiBGjID.exe
  C:\Windows\System\MiBGjID.exe
  2⤵
  PID:8496
- C:\Windows\System\RaEtIwV.exe
  C:\Windows\System\RaEtIwV.exe
  2⤵
  PID:8636
- C:\Windows\System\UMYyvrW.exe
  C:\Windows\System\UMYyvrW.exe
  2⤵
  PID:8684
- C:\Windows\System\rDGwKjM.exe
  C:\Windows\System\rDGwKjM.exe
  2⤵
  PID:8828
- C:\Windows\System\lUyFHly.exe
  C:\Windows\System\lUyFHly.exe
  2⤵
  PID:8788
- C:\Windows\System\okBHTFr.exe
  C:\Windows\System\okBHTFr.exe
  2⤵
  PID:8896
- C:\Windows\System\hWwsTbl.exe
  C:\Windows\System\hWwsTbl.exe
  2⤵
  PID:8984
- C:\Windows\System\JVIiWDV.exe
  C:\Windows\System\JVIiWDV.exe
  2⤵
  PID:9004
- C:\Windows\System\hgUaOMZ.exe
  C:\Windows\System\hgUaOMZ.exe
  2⤵
  PID:9136
- C:\Windows\System\BVapFXK.exe
  C:\Windows\System\BVapFXK.exe
  2⤵
  PID:9108
- C:\Windows\System\qDccVNn.exe
  C:\Windows\System\qDccVNn.exe
  2⤵
  PID:9124
- C:\Windows\System\GEtoCZj.exe
  C:\Windows\System\GEtoCZj.exe
  2⤵
  PID:8384
- C:\Windows\System\cgezvpW.exe
  C:\Windows\System\cgezvpW.exe
  2⤵
  PID:8404
- C:\Windows\System\kHPmXTp.exe
  C:\Windows\System\kHPmXTp.exe
  2⤵
  PID:8608
- C:\Windows\System\YSZQIKx.exe
  C:\Windows\System\YSZQIKx.exe
  2⤵
  PID:8612
- C:\Windows\System\owqTqBI.exe
  C:\Windows\System\owqTqBI.exe
  2⤵
  PID:8948
- C:\Windows\System\FSGgCkl.exe
  C:\Windows\System\FSGgCkl.exe
  2⤵
  PID:8968
- C:\Windows\System\EzxCUcl.exe
  C:\Windows\System\EzxCUcl.exe
  2⤵
  PID:8304
- C:\Windows\System\PeHqwkC.exe
  C:\Windows\System\PeHqwkC.exe
  2⤵
  PID:8284
- C:\Windows\System\PcuoPaw.exe
  C:\Windows\System\PcuoPaw.exe
  2⤵
  PID:8400
- C:\Windows\System\xQPmnhl.exe
  C:\Windows\System\xQPmnhl.exe
  2⤵
  PID:9220
- C:\Windows\System\ndyukpt.exe
  C:\Windows\System\ndyukpt.exe
  2⤵
  PID:9248
- C:\Windows\System\JvrOMtQ.exe
  C:\Windows\System\JvrOMtQ.exe
  2⤵
  PID:9280
- C:\Windows\System\JDbKprY.exe
  C:\Windows\System\JDbKprY.exe
  2⤵
  PID:9316
- C:\Windows\System\TEIRtww.exe
  C:\Windows\System\TEIRtww.exe
  2⤵
  PID:9340
- C:\Windows\System\sHPZuHN.exe
  C:\Windows\System\sHPZuHN.exe
  2⤵
  PID:9372
- C:\Windows\System\uWCqXGo.exe
  C:\Windows\System\uWCqXGo.exe
  2⤵
  PID:9404
- C:\Windows\System\RQrtwvv.exe
  C:\Windows\System\RQrtwvv.exe
  2⤵
  PID:9436
- C:\Windows\System\bViaJxC.exe
  C:\Windows\System\bViaJxC.exe
  2⤵
  PID:9472
- C:\Windows\System\RBVrdbh.exe
  C:\Windows\System\RBVrdbh.exe
  2⤵
  PID:9496
- C:\Windows\System\rpygwzj.exe
  C:\Windows\System\rpygwzj.exe
  2⤵
  PID:9532
- C:\Windows\System\ItwLTsL.exe
  C:\Windows\System\ItwLTsL.exe
  2⤵
  PID:9548
- C:\Windows\System\zVTriNh.exe
  C:\Windows\System\zVTriNh.exe
  2⤵
  PID:9588
- C:\Windows\System\nBNsaDC.exe
  C:\Windows\System\nBNsaDC.exe
  2⤵
  PID:9620
- C:\Windows\System\wOdPgvH.exe
  C:\Windows\System\wOdPgvH.exe
  2⤵
  PID:9644
- C:\Windows\System\noKIxzf.exe
  C:\Windows\System\noKIxzf.exe
  2⤵
  PID:9660
- C:\Windows\System\QggyHPd.exe
  C:\Windows\System\QggyHPd.exe
  2⤵
  PID:9692
- C:\Windows\System\XnFYLsO.exe
  C:\Windows\System\XnFYLsO.exe
  2⤵
  PID:9724
- C:\Windows\System\eWzQTHs.exe
  C:\Windows\System\eWzQTHs.exe
  2⤵
  PID:9752
- C:\Windows\System\XEiJiXs.exe
  C:\Windows\System\XEiJiXs.exe
  2⤵
  PID:9788
- C:\Windows\System\KLinrMq.exe
  C:\Windows\System\KLinrMq.exe
  2⤵
  PID:9824
- C:\Windows\System\FmHbQKa.exe
  C:\Windows\System\FmHbQKa.exe
  2⤵
  PID:9852
- C:\Windows\System\BBDJjEn.exe
  C:\Windows\System\BBDJjEn.exe
  2⤵
  PID:9876
- C:\Windows\System\qLdTDMe.exe
  C:\Windows\System\qLdTDMe.exe
  2⤵
  PID:9908
- C:\Windows\System\wuAusCR.exe
  C:\Windows\System\wuAusCR.exe
  2⤵
  PID:9924
- C:\Windows\System\YJWbhrV.exe
  C:\Windows\System\YJWbhrV.exe
  2⤵
  PID:9952
- C:\Windows\System\UYoZVAB.exe
  C:\Windows\System\UYoZVAB.exe
  2⤵
  PID:9984
- C:\Windows\System\BSZldju.exe
  C:\Windows\System\BSZldju.exe
  2⤵
  PID:10016
- C:\Windows\System\WGZVncO.exe
  C:\Windows\System\WGZVncO.exe
  2⤵
  PID:10048
- C:\Windows\System\tBOtZID.exe
  C:\Windows\System\tBOtZID.exe
  2⤵
  PID:10068
- C:\Windows\System\ifWJTuW.exe
  C:\Windows\System\ifWJTuW.exe
  2⤵
  PID:10096
- C:\Windows\System\ANLwFTe.exe
  C:\Windows\System\ANLwFTe.exe
  2⤵
  PID:10124
- C:\Windows\System\jNFTJFI.exe
  C:\Windows\System\jNFTJFI.exe
  2⤵
  PID:10144
- C:\Windows\System\DobtcZW.exe
  C:\Windows\System\DobtcZW.exe
  2⤵
  PID:10160
- C:\Windows\System\djWjCjQ.exe
  C:\Windows\System\djWjCjQ.exe
  2⤵
  PID:10188
- C:\Windows\System\JMKyyjp.exe
  C:\Windows\System\JMKyyjp.exe
  2⤵
  PID:10204
- C:\Windows\System\AAlSyCl.exe
  C:\Windows\System\AAlSyCl.exe
  2⤵
  PID:10224
- C:\Windows\System\cDlNmKx.exe
  C:\Windows\System\cDlNmKx.exe
  2⤵
  PID:9156
- C:\Windows\System\ZVgHzBQ.exe
  C:\Windows\System\ZVgHzBQ.exe
  2⤵
  PID:9020
- C:\Windows\System\yRcfJGS.exe
  C:\Windows\System\yRcfJGS.exe
  2⤵
  PID:8800
- C:\Windows\System\NUYTvVu.exe
  C:\Windows\System\NUYTvVu.exe
  2⤵
  PID:9360
- C:\Windows\System\NgoQjLS.exe
  C:\Windows\System\NgoQjLS.exe
  2⤵
  PID:9424
- C:\Windows\System\LmnuOoL.exe
  C:\Windows\System\LmnuOoL.exe
  2⤵
  PID:9488
- C:\Windows\System\ddRTyDa.exe
  C:\Windows\System\ddRTyDa.exe
  2⤵
  PID:9544
- C:\Windows\System\yNfCfvw.exe
  C:\Windows\System\yNfCfvw.exe
  2⤵
  PID:9520
- C:\Windows\System\WkNZAfY.exe
  C:\Windows\System\WkNZAfY.exe
  2⤵
  PID:9612
- C:\Windows\System\kHgFyUP.exe
  C:\Windows\System\kHgFyUP.exe
  2⤵
  PID:9700
- C:\Windows\System\ldWZzoZ.exe
  C:\Windows\System\ldWZzoZ.exe
  2⤵
  PID:9816
- C:\Windows\System\DcdHFFk.exe
  C:\Windows\System\DcdHFFk.exe
  2⤵
  PID:9840
- C:\Windows\System\cBCRCtj.exe
  C:\Windows\System\cBCRCtj.exe
  2⤵
  PID:9844
- C:\Windows\System\CDneUkS.exe
  C:\Windows\System\CDneUkS.exe
  2⤵
  PID:9936
- C:\Windows\System\CVXLFiM.exe
  C:\Windows\System\CVXLFiM.exe
  2⤵
  PID:9972
- C:\Windows\System\RjpWjMe.exe
  C:\Windows\System\RjpWjMe.exe
  2⤵
  PID:10112
- C:\Windows\System\xLddiRU.exe
  C:\Windows\System\xLddiRU.exe
  2⤵
  PID:10060
- C:\Windows\System\wyggOMJ.exe
  C:\Windows\System\wyggOMJ.exe
  2⤵
  PID:10200
- C:\Windows\System\tfwQdQN.exe
  C:\Windows\System\tfwQdQN.exe
  2⤵
  PID:9012
- C:\Windows\System\rqEdeBt.exe
  C:\Windows\System\rqEdeBt.exe
  2⤵
  PID:8872
- C:\Windows\System\cpsWWCG.exe
  C:\Windows\System\cpsWWCG.exe
  2⤵
  PID:9580
- C:\Windows\System\ijlWtth.exe
  C:\Windows\System\ijlWtth.exe
  2⤵
  PID:9652
- C:\Windows\System\vibnoka.exe
  C:\Windows\System\vibnoka.exe
  2⤵
  PID:9872
- C:\Windows\System\WhFFrfu.exe
  C:\Windows\System\WhFFrfu.exe
  2⤵
  PID:10088
- C:\Windows\System\elNXXWF.exe
  C:\Windows\System\elNXXWF.exe
  2⤵
  PID:10184
- C:\Windows\System\nCELaqE.exe
  C:\Windows\System\nCELaqE.exe
  2⤵
  PID:9712
- C:\Windows\System\QjyTkgE.exe
  C:\Windows\System\QjyTkgE.exe
  2⤵
  PID:10252
- C:\Windows\System\ODQDzrK.exe
  C:\Windows\System\ODQDzrK.exe
  2⤵
  PID:10272
- C:\Windows\System\QHCfjzX.exe
  C:\Windows\System\QHCfjzX.exe
  2⤵
  PID:10292
- C:\Windows\System\RWHQipe.exe
  C:\Windows\System\RWHQipe.exe
  2⤵
  PID:10316
- C:\Windows\System\wFyvvYS.exe
  C:\Windows\System\wFyvvYS.exe
  2⤵
  PID:10340
- C:\Windows\System\BdFxWKw.exe
  C:\Windows\System\BdFxWKw.exe
  2⤵
  PID:10364
- C:\Windows\System\SwEYlDH.exe
  C:\Windows\System\SwEYlDH.exe
  2⤵
  PID:10396
- C:\Windows\System\ButRrzz.exe
  C:\Windows\System\ButRrzz.exe
  2⤵
  PID:10420
- C:\Windows\System\CxUpxhZ.exe
  C:\Windows\System\CxUpxhZ.exe
  2⤵
  PID:10452
- C:\Windows\System\cUaORao.exe
  C:\Windows\System\cUaORao.exe
  2⤵
  PID:10480
- C:\Windows\System\tTppqnH.exe
  C:\Windows\System\tTppqnH.exe
  2⤵
  PID:10512
- C:\Windows\System\BwUiUFI.exe
  C:\Windows\System\BwUiUFI.exe
  2⤵
  PID:10536
- C:\Windows\System\OfNgHbp.exe
  C:\Windows\System\OfNgHbp.exe
  2⤵
  PID:10568
- C:\Windows\System\deJLnlb.exe
  C:\Windows\System\deJLnlb.exe
  2⤵
  PID:10596
- C:\Windows\System\LDKvZbx.exe
  C:\Windows\System\LDKvZbx.exe
  2⤵
  PID:10624
- C:\Windows\System\ukrcNBT.exe
  C:\Windows\System\ukrcNBT.exe
  2⤵
  PID:10652
- C:\Windows\System\wfyfJFt.exe
  C:\Windows\System\wfyfJFt.exe
  2⤵
  PID:10680
- C:\Windows\System\qHwsHSw.exe
  C:\Windows\System\qHwsHSw.exe
  2⤵
  PID:10708
- C:\Windows\System\rOKbCWP.exe
  C:\Windows\System\rOKbCWP.exe
  2⤵
  PID:10740
- C:\Windows\System\MpLXtTQ.exe
  C:\Windows\System\MpLXtTQ.exe
  2⤵
  PID:10756
- C:\Windows\System\yULBHqS.exe
  C:\Windows\System\yULBHqS.exe
  2⤵
  PID:10788
- C:\Windows\System\DhpZvsK.exe
  C:\Windows\System\DhpZvsK.exe
  2⤵
  PID:10812
- C:\Windows\System\VbTLrjm.exe
  C:\Windows\System\VbTLrjm.exe
  2⤵
  PID:10852
- C:\Windows\System\nFmBMyT.exe
  C:\Windows\System\nFmBMyT.exe
  2⤵
  PID:10872
- C:\Windows\System\tIlIUWi.exe
  C:\Windows\System\tIlIUWi.exe
  2⤵
  PID:10896
- C:\Windows\System\msqnSyg.exe
  C:\Windows\System\msqnSyg.exe
  2⤵
  PID:10932
- C:\Windows\System\FjmhGLK.exe
  C:\Windows\System\FjmhGLK.exe
  2⤵
  PID:10952
- C:\Windows\System\EoqVGAw.exe
  C:\Windows\System\EoqVGAw.exe
  2⤵
  PID:10992
- C:\Windows\System\qpFNzkd.exe
  C:\Windows\System\qpFNzkd.exe
  2⤵
  PID:11016
- C:\Windows\System\TTYmAFQ.exe
  C:\Windows\System\TTYmAFQ.exe
  2⤵
  PID:11040
- C:\Windows\System\dqyoWwD.exe
  C:\Windows\System\dqyoWwD.exe
  2⤵
  PID:11076
- C:\Windows\System\kGGAzBD.exe
  C:\Windows\System\kGGAzBD.exe
  2⤵
  PID:11104
- C:\Windows\System\HsDaiHy.exe
  C:\Windows\System\HsDaiHy.exe
  2⤵
  PID:11136
- C:\Windows\System\ICTWOfs.exe
  C:\Windows\System\ICTWOfs.exe
  2⤵
  PID:11168
- C:\Windows\System\QwTTjGA.exe
  C:\Windows\System\QwTTjGA.exe
  2⤵
  PID:11196
- C:\Windows\System\CYDOGyQ.exe
  C:\Windows\System\CYDOGyQ.exe
  2⤵
  PID:11220
- C:\Windows\System\aWXyvKS.exe
  C:\Windows\System\aWXyvKS.exe
  2⤵
  PID:11248
- C:\Windows\System\PMcbldg.exe
  C:\Windows\System\PMcbldg.exe
  2⤵
  PID:8812
- C:\Windows\System\byDhqKZ.exe
  C:\Windows\System\byDhqKZ.exe
  2⤵
  PID:9812
- C:\Windows\System\YDSewdR.exe
  C:\Windows\System\YDSewdR.exe
  2⤵
  PID:9688
- C:\Windows\System\sAOTgQS.exe
  C:\Windows\System\sAOTgQS.exe
  2⤵
  PID:10084
- C:\Windows\System\FcrbOsE.exe
  C:\Windows\System\FcrbOsE.exe
  2⤵
  PID:10332
- C:\Windows\System\fqGIGoU.exe
  C:\Windows\System\fqGIGoU.exe
  2⤵
  PID:10444
- C:\Windows\System\QKIvyYn.exe
  C:\Windows\System\QKIvyYn.exe
  2⤵
  PID:10388
- C:\Windows\System\iVHgqEh.exe
  C:\Windows\System\iVHgqEh.exe
  2⤵
  PID:10532
- C:\Windows\System\cQaqUOz.exe
  C:\Windows\System\cQaqUOz.exe
  2⤵
  PID:10620
- C:\Windows\System\drlXiAM.exe
  C:\Windows\System\drlXiAM.exe
  2⤵
  PID:10664
- C:\Windows\System\vFrgOie.exe
  C:\Windows\System\vFrgOie.exe
  2⤵
  PID:10584
- C:\Windows\System\MBkYavH.exe
  C:\Windows\System\MBkYavH.exe
  2⤵
  PID:10836
- C:\Windows\System\mlpLbra.exe
  C:\Windows\System\mlpLbra.exe
  2⤵
  PID:10884
- C:\Windows\System\oNzczqR.exe
  C:\Windows\System\oNzczqR.exe
  2⤵
  PID:10808
- C:\Windows\System\QMwmjYg.exe
  C:\Windows\System\QMwmjYg.exe
  2⤵
  PID:11060
- C:\Windows\System\PAKVsxK.exe
  C:\Windows\System\PAKVsxK.exe
  2⤵
  PID:10892
- C:\Windows\System\AwmZNwC.exe
  C:\Windows\System\AwmZNwC.exe
  2⤵
  PID:11072
- C:\Windows\System\prXaatu.exe
  C:\Windows\System\prXaatu.exe
  2⤵
  PID:11008
- C:\Windows\System\CoLsUYl.exe
  C:\Windows\System\CoLsUYl.exe
  2⤵
  PID:11052
- C:\Windows\System\YymewWe.exe
  C:\Windows\System\YymewWe.exe
  2⤵
  PID:11260
- C:\Windows\System\PlpdHuE.exe
  C:\Windows\System\PlpdHuE.exe
  2⤵
  PID:10472
- C:\Windows\System\zeyKtWW.exe
  C:\Windows\System\zeyKtWW.exe
  2⤵
  PID:9836
- C:\Windows\System\JYWIxOw.exe
  C:\Windows\System\JYWIxOw.exe
  2⤵
  PID:10768
- C:\Windows\System\ofrbPIb.exe
  C:\Windows\System\ofrbPIb.exe
  2⤵
  PID:10968
- C:\Windows\System\CbImamR.exe
  C:\Windows\System\CbImamR.exe
  2⤵
  PID:10592
- C:\Windows\System\UeQZcPG.exe
  C:\Windows\System\UeQZcPG.exe
  2⤵
  PID:11188
- C:\Windows\System\FcqIAdH.exe
  C:\Windows\System\FcqIAdH.exe
  2⤵
  PID:11156
- C:\Windows\System\CoFkRBZ.exe
  C:\Windows\System\CoFkRBZ.exe
  2⤵
  PID:10448
- C:\Windows\System\JeOWWAk.exe
  C:\Windows\System\JeOWWAk.exe
  2⤵
  PID:11032
- C:\Windows\System\AISFuOy.exe
  C:\Windows\System\AISFuOy.exe
  2⤵
  PID:11280
- C:\Windows\System\eqlsAjr.exe
  C:\Windows\System\eqlsAjr.exe
  2⤵
  PID:11304
- C:\Windows\System\PDsZHzy.exe
  C:\Windows\System\PDsZHzy.exe
  2⤵
  PID:11328
- C:\Windows\System\CVmlYCS.exe
  C:\Windows\System\CVmlYCS.exe
  2⤵
  PID:11360
- C:\Windows\System\qyfAAWR.exe
  C:\Windows\System\qyfAAWR.exe
  2⤵
  PID:11392
- C:\Windows\System\MOIHxFF.exe
  C:\Windows\System\MOIHxFF.exe
  2⤵
  PID:11416
- C:\Windows\System\JirCCWv.exe
  C:\Windows\System\JirCCWv.exe
  2⤵
  PID:11452
- C:\Windows\System\rPzAPOy.exe
  C:\Windows\System\rPzAPOy.exe
  2⤵
  PID:11484
- C:\Windows\System\TtsbnIs.exe
  C:\Windows\System\TtsbnIs.exe
  2⤵
  PID:11512
- C:\Windows\System\lYwlXXM.exe
  C:\Windows\System\lYwlXXM.exe
  2⤵
  PID:11540
- C:\Windows\System\uDDFnGN.exe
  C:\Windows\System\uDDFnGN.exe
  2⤵
  PID:11576
- C:\Windows\System\mesDwbg.exe
  C:\Windows\System\mesDwbg.exe
  2⤵
  PID:11608
- C:\Windows\System\QapcHCA.exe
  C:\Windows\System\QapcHCA.exe
  2⤵
  PID:11636
- C:\Windows\System\KBtsQfZ.exe
  C:\Windows\System\KBtsQfZ.exe
  2⤵
  PID:11656
- C:\Windows\System\uizZUlP.exe
  C:\Windows\System\uizZUlP.exe
  2⤵
  PID:11684
- C:\Windows\System\ezutGwk.exe
  C:\Windows\System\ezutGwk.exe
  2⤵
  PID:11712
- C:\Windows\System\eertbNK.exe
  C:\Windows\System\eertbNK.exe
  2⤵
  PID:11736
- C:\Windows\System\WApMqan.exe
  C:\Windows\System\WApMqan.exe
  2⤵
  PID:11760
- C:\Windows\System\BascBCz.exe
  C:\Windows\System\BascBCz.exe
  2⤵
  PID:11796
- C:\Windows\System\UiEmEYN.exe
  C:\Windows\System\UiEmEYN.exe
  2⤵
  PID:11816
- C:\Windows\System\KFlJdnu.exe
  C:\Windows\System\KFlJdnu.exe
  2⤵
  PID:11864
- C:\Windows\System\sIiILEA.exe
  C:\Windows\System\sIiILEA.exe
  2⤵
  PID:11896
- C:\Windows\System\ZODTEvO.exe
  C:\Windows\System\ZODTEvO.exe
  2⤵
  PID:11912
- C:\Windows\System\cnKmPtb.exe
  C:\Windows\System\cnKmPtb.exe
  2⤵
  PID:11928
- C:\Windows\System\CiSzvLp.exe
  C:\Windows\System\CiSzvLp.exe
  2⤵
  PID:11948
- C:\Windows\System\OKPzWPg.exe
  C:\Windows\System\OKPzWPg.exe
  2⤵
  PID:11976
- C:\Windows\System\EcKVziD.exe
  C:\Windows\System\EcKVziD.exe
  2⤵
  PID:12008
- C:\Windows\System\XmUGHqE.exe
  C:\Windows\System\XmUGHqE.exe
  2⤵
  PID:12024
- C:\Windows\System\mcrZAGs.exe
  C:\Windows\System\mcrZAGs.exe
  2⤵
  PID:12048
- C:\Windows\System\EEKqYEC.exe
  C:\Windows\System\EEKqYEC.exe
  2⤵
  PID:12064
- C:\Windows\System\ktpetVD.exe
  C:\Windows\System\ktpetVD.exe
  2⤵
  PID:12084
- C:\Windows\System\jfWmbbc.exe
  C:\Windows\System\jfWmbbc.exe
  2⤵
  PID:12112
- C:\Windows\System\QeAwvvB.exe
  C:\Windows\System\QeAwvvB.exe
  2⤵
  PID:12140
- C:\Windows\System\rySGdoA.exe
  C:\Windows\System\rySGdoA.exe
  2⤵
  PID:12160
- C:\Windows\System\aPDxlAp.exe
  C:\Windows\System\aPDxlAp.exe
  2⤵
  PID:12188
- C:\Windows\System\WTDVetK.exe
  C:\Windows\System\WTDVetK.exe
  2⤵
  PID:12220
- C:\Windows\System\ImDuSsR.exe
  C:\Windows\System\ImDuSsR.exe
  2⤵
  PID:12244
- C:\Windows\System\qLFkOVE.exe
  C:\Windows\System\qLFkOVE.exe
  2⤵
  PID:12280
- C:\Windows\System\HMOVOvm.exe
  C:\Windows\System\HMOVOvm.exe
  2⤵
  PID:11212
- C:\Windows\System\aofoAou.exe
  C:\Windows\System\aofoAou.exe
  2⤵
  PID:11208
- C:\Windows\System\rHMwOJn.exe
  C:\Windows\System\rHMwOJn.exe
  2⤵
  PID:11300
- C:\Windows\System\KLvhFGc.exe
  C:\Windows\System\KLvhFGc.exe
  2⤵
  PID:11292
- C:\Windows\System\WXEVriK.exe
  C:\Windows\System\WXEVriK.exe
  2⤵
  PID:10524
- C:\Windows\System\QsUyfhd.exe
  C:\Windows\System\QsUyfhd.exe
  2⤵
  PID:11460
- C:\Windows\System\IujuAUP.exe
  C:\Windows\System\IujuAUP.exe
  2⤵
  PID:11600
- C:\Windows\System\hdnWLYn.exe
  C:\Windows\System\hdnWLYn.exe
  2⤵
  PID:11500
- C:\Windows\System\xYNQBRN.exe
  C:\Windows\System\xYNQBRN.exe
  2⤵
  PID:11624
- C:\Windows\System\CzFQnEo.exe
  C:\Windows\System\CzFQnEo.exe
  2⤵
  PID:11560
- C:\Windows\System\GHMioTZ.exe
  C:\Windows\System\GHMioTZ.exe
  2⤵
  PID:11672
- C:\Windows\System\GankmeG.exe
  C:\Windows\System\GankmeG.exe
  2⤵
  PID:11772
- C:\Windows\System\TCdyBBe.exe
  C:\Windows\System\TCdyBBe.exe
  2⤵
  PID:11876
- C:\Windows\System\zQfIwZs.exe
  C:\Windows\System\zQfIwZs.exe
  2⤵
  PID:11888
- C:\Windows\System\DDPUOkI.exe
  C:\Windows\System\DDPUOkI.exe
  2⤵
  PID:11856
- C:\Windows\System\rEbfAZb.exe
  C:\Windows\System\rEbfAZb.exe
  2⤵
  PID:12076
- C:\Windows\System\luRJNmE.exe
  C:\Windows\System\luRJNmE.exe
  2⤵
  PID:12020
- C:\Windows\System\wIsuMPL.exe
  C:\Windows\System\wIsuMPL.exe
  2⤵
  PID:12148
- C:\Windows\System\RxoyxCF.exe
  C:\Windows\System\RxoyxCF.exe
  2⤵
  PID:9944
- C:\Windows\System\KORZMTo.exe
  C:\Windows\System\KORZMTo.exe
  2⤵
  PID:11344
- C:\Windows\System\BXYvAwe.exe
  C:\Windows\System\BXYvAwe.exe
  2⤵
  PID:12200
- C:\Windows\System\FnzWZuK.exe
  C:\Windows\System\FnzWZuK.exe
  2⤵
  PID:11808
- C:\Windows\System\kQswRPO.exe
  C:\Windows\System\kQswRPO.exe
  2⤵
  PID:11748
- C:\Windows\System\DlQgQpJ.exe
  C:\Windows\System\DlQgQpJ.exe
  2⤵
  PID:10976
- C:\Windows\System\tdurEkS.exe
  C:\Windows\System\tdurEkS.exe
  2⤵
  PID:12108
- C:\Windows\System\EaTTtTK.exe
  C:\Windows\System\EaTTtTK.exe
  2⤵
  PID:11780
- C:\Windows\System\PwLBHRA.exe
  C:\Windows\System\PwLBHRA.exe
  2⤵
  PID:12180
- C:\Windows\System\YWetUsx.exe
  C:\Windows\System\YWetUsx.exe
  2⤵
  PID:12316
- C:\Windows\System\QPDuwiA.exe
  C:\Windows\System\QPDuwiA.exe
  2⤵
  PID:12348
- C:\Windows\System\avzQMiG.exe
  C:\Windows\System\avzQMiG.exe
  2⤵
  PID:12376
- C:\Windows\System\cEsyNcT.exe
  C:\Windows\System\cEsyNcT.exe
  2⤵
  PID:12404
- C:\Windows\System\xHjlHkt.exe
  C:\Windows\System\xHjlHkt.exe
  2⤵
  PID:12432
- C:\Windows\System\ZdPgZVB.exe
  C:\Windows\System\ZdPgZVB.exe
  2⤵
  PID:12456
- C:\Windows\System\CMTAosQ.exe
  C:\Windows\System\CMTAosQ.exe
  2⤵
  PID:12484
- C:\Windows\System\VUABaOG.exe
  C:\Windows\System\VUABaOG.exe
  2⤵
  PID:12516
- C:\Windows\System\VZqKezh.exe
  C:\Windows\System\VZqKezh.exe
  2⤵
  PID:12540
- C:\Windows\System\tTIepfL.exe
  C:\Windows\System\tTIepfL.exe
  2⤵
  PID:12568
- C:\Windows\System\OwyKTBj.exe
  C:\Windows\System\OwyKTBj.exe
  2⤵
  PID:12596
- C:\Windows\System\qqSepvs.exe
  C:\Windows\System\qqSepvs.exe
  2⤵
  PID:12620
- C:\Windows\System\uMbNgOd.exe
  C:\Windows\System\uMbNgOd.exe
  2⤵
  PID:12648
- C:\Windows\System\hWWASBB.exe
  C:\Windows\System\hWWASBB.exe
  2⤵
  PID:12688
- C:\Windows\System\zjSHosE.exe
  C:\Windows\System\zjSHosE.exe
  2⤵
  PID:12716
- C:\Windows\System\cytDpkn.exe
  C:\Windows\System\cytDpkn.exe
  2⤵
  PID:12744
- C:\Windows\System\ZkZLboT.exe
  C:\Windows\System\ZkZLboT.exe
  2⤵
  PID:12768
- C:\Windows\System\KXAfIeG.exe
  C:\Windows\System\KXAfIeG.exe
  2⤵
  PID:12800
- C:\Windows\System\ERDTxKe.exe
  C:\Windows\System\ERDTxKe.exe
  2⤵
  PID:12824
- C:\Windows\System\trGcqlG.exe
  C:\Windows\System\trGcqlG.exe
  2⤵
  PID:12856
- C:\Windows\System\RNqXjrD.exe
  C:\Windows\System\RNqXjrD.exe
  2⤵
  PID:12884
- C:\Windows\System\aUIffHi.exe
  C:\Windows\System\aUIffHi.exe
  2⤵
  PID:12912
- C:\Windows\System\srgybLz.exe
  C:\Windows\System\srgybLz.exe
  2⤵
  PID:12936
- C:\Windows\System\NRiIiYy.exe
  C:\Windows\System\NRiIiYy.exe
  2⤵
  PID:12960
- C:\Windows\System\pclipJI.exe
  C:\Windows\System\pclipJI.exe
  2⤵
  PID:12984
- C:\Windows\System\kBqVMNv.exe
  C:\Windows\System\kBqVMNv.exe
  2⤵
  PID:13008
- C:\Windows\System\SDPyUAm.exe
  C:\Windows\System\SDPyUAm.exe
  2⤵
  PID:13040
- C:\Windows\System\VLvzkzw.exe
  C:\Windows\System\VLvzkzw.exe
  2⤵
  PID:13064
- C:\Windows\System\vwmBOUn.exe
  C:\Windows\System\vwmBOUn.exe
  2⤵
  PID:13092
- C:\Windows\System\tOBYoGc.exe
  C:\Windows\System\tOBYoGc.exe
  2⤵
  PID:13112
- C:\Windows\System\vmEzrag.exe
  C:\Windows\System\vmEzrag.exe
  2⤵
  PID:13144
- C:\Windows\System\yrkllgL.exe
  C:\Windows\System\yrkllgL.exe
  2⤵
  PID:13172
- C:\Windows\System\yooALsg.exe
  C:\Windows\System\yooALsg.exe
  2⤵
  PID:13204
- C:\Windows\System\ODUzcMf.exe
  C:\Windows\System\ODUzcMf.exe
  2⤵
  PID:13224
- C:\Windows\System\LBLJQFF.exe
  C:\Windows\System\LBLJQFF.exe
  2⤵
  PID:13260
- C:\Windows\System\WnBptSV.exe
  C:\Windows\System\WnBptSV.exe
  2⤵
  PID:13288
- C:\Windows\System\HyYiNah.exe
  C:\Windows\System\HyYiNah.exe
  2⤵
  PID:13308
- C:\Windows\System\zkQsPSC.exe
  C:\Windows\System\zkQsPSC.exe
  2⤵
  PID:11536
- C:\Windows\System\IkGmBQE.exe
  C:\Windows\System\IkGmBQE.exe
  2⤵
  PID:11852
- C:\Windows\System\CKGPTXB.exe
  C:\Windows\System\CKGPTXB.exe
  2⤵
  PID:12332
- C:\Windows\System\VsYIaAA.exe
  C:\Windows\System\VsYIaAA.exe
  2⤵
  PID:11412
- C:\Windows\System\djGpJdx.exe
  C:\Windows\System\djGpJdx.exe
  2⤵
  PID:10728
- C:\Windows\System\YUqpWFV.exe
  C:\Windows\System\YUqpWFV.exe
  2⤵
  PID:12296
- C:\Windows\System\tiQbVHD.exe
  C:\Windows\System\tiQbVHD.exe
  2⤵
  PID:12580
- C:\Windows\System\OEowODP.exe
  C:\Windows\System\OEowODP.exe
  2⤵
  PID:12428
- C:\Windows\System\rFLmSxe.exe
  C:\Windows\System\rFLmSxe.exe
  2⤵
  PID:12764
- C:\Windows\System\wuCvbwe.exe
  C:\Windows\System\wuCvbwe.exe
  2⤵
  PID:12396
- C:\Windows\System\UsRTzpr.exe
  C:\Windows\System\UsRTzpr.exe
  2⤵
  PID:12868
- C:\Windows\System\CMYEUnU.exe
  C:\Windows\System\CMYEUnU.exe
  2⤵
  PID:12900
- C:\Windows\System\iCfGONQ.exe
  C:\Windows\System\iCfGONQ.exe
  2⤵
  PID:12952
- C:\Windows\System\omwjcnz.exe
  C:\Windows\System\omwjcnz.exe
  2⤵
  PID:12644
- C:\Windows\System\SLYJUeG.exe
  C:\Windows\System\SLYJUeG.exe
  2⤵
  PID:13056
- C:\Windows\System\CnjBMqU.exe
  C:\Windows\System\CnjBMqU.exe
  2⤵
  PID:13080
- C:\Windows\System\irLWaqr.exe
  C:\Windows\System\irLWaqr.exe
  2⤵
  PID:12948
- C:\Windows\System\LwyZwyq.exe
  C:\Windows\System\LwyZwyq.exe
  2⤵
  PID:13212
- C:\Windows\System\qDelnzB.exe
  C:\Windows\System\qDelnzB.exe
  2⤵
  PID:13284
- C:\Windows\System\joTTPSP.exe
  C:\Windows\System\joTTPSP.exe
  2⤵
  PID:11788
- C:\Windows\System\ENNuJNb.exe
  C:\Windows\System\ENNuJNb.exe
  2⤵
  PID:13160
- C:\Windows\System\gyfSqSZ.exe
  C:\Windows\System\gyfSqSZ.exe
  2⤵
  PID:12216
- C:\Windows\System\RLziEJP.exe
  C:\Windows\System\RLziEJP.exe
  2⤵
  PID:12360
- C:\Windows\System\EkPohNN.exe
  C:\Windows\System\EkPohNN.exe
  2⤵
  PID:11352
- C:\Windows\System\BqxzWDq.exe
  C:\Windows\System\BqxzWDq.exe
  2⤵
  PID:12372
- C:\Windows\System\pSxWaeY.exe
  C:\Windows\System\pSxWaeY.exe
  2⤵
  PID:12500
- C:\Windows\System\VfPmxpL.exe
  C:\Windows\System\VfPmxpL.exe
  2⤵
  PID:12908
- C:\Windows\System\UyYwEcr.exe
  C:\Windows\System\UyYwEcr.exe
  2⤵
  PID:13320
- C:\Windows\System\BKKeGSJ.exe
  C:\Windows\System\BKKeGSJ.exe
  2⤵
  PID:13348
- C:\Windows\System\JdFSkjR.exe
  C:\Windows\System\JdFSkjR.exe
  2⤵
  PID:13372
- C:\Windows\System\OvfCpte.exe
  C:\Windows\System\OvfCpte.exe
  2⤵
  PID:13408
- C:\Windows\System\mUBTDUX.exe
  C:\Windows\System\mUBTDUX.exe
  2⤵
  PID:13436
- C:\Windows\System\SDLdYbv.exe
  C:\Windows\System\SDLdYbv.exe
  2⤵
  PID:13468
- C:\Windows\System\LJJFxEa.exe
  C:\Windows\System\LJJFxEa.exe
  2⤵
  PID:13496
- C:\Windows\System\eXQamsb.exe
  C:\Windows\System\eXQamsb.exe
  2⤵
  PID:13524
- C:\Windows\System\jTeUTRy.exe
  C:\Windows\System\jTeUTRy.exe
  2⤵
  PID:13556
- C:\Windows\System\MtemgsU.exe
  C:\Windows\System\MtemgsU.exe
  2⤵
  PID:13576
- C:\Windows\System\RghdvzI.exe
  C:\Windows\System\RghdvzI.exe
  2⤵
  PID:13612
- C:\Windows\System\BetFtnX.exe
  C:\Windows\System\BetFtnX.exe
  2⤵
  PID:13644
- C:\Windows\System\tnZQxlg.exe
  C:\Windows\System\tnZQxlg.exe
  2⤵
  PID:13672
- C:\Windows\System\JXApzvG.exe
  C:\Windows\System\JXApzvG.exe
  2⤵
  PID:13708
- C:\Windows\System\JMAjhfU.exe
  C:\Windows\System\JMAjhfU.exe
  2⤵
  PID:13816
- C:\Windows\System\xQSgoAe.exe
  C:\Windows\System\xQSgoAe.exe
  2⤵
  PID:13860
- C:\Windows\System\ChrDGAT.exe
  C:\Windows\System\ChrDGAT.exe
  2⤵
  PID:13892
- C:\Windows\System\rmxNEPv.exe
  C:\Windows\System\rmxNEPv.exe
  2⤵
  PID:13936
- C:\Windows\System\fPPIwok.exe
  C:\Windows\System\fPPIwok.exe
  2⤵
  PID:13984
- C:\Windows\System\EyFVuGn.exe
  C:\Windows\System\EyFVuGn.exe
  2⤵
  PID:14008
- C:\Windows\System\UaCuAzx.exe
  C:\Windows\System\UaCuAzx.exe
  2⤵
  PID:14028
- C:\Windows\System\MnaICKW.exe
  C:\Windows\System\MnaICKW.exe
  2⤵
  PID:14044
- C:\Windows\System\FLBzKDO.exe
  C:\Windows\System\FLBzKDO.exe
  2⤵
  PID:14068
- C:\Windows\System\cSmpCZF.exe
  C:\Windows\System\cSmpCZF.exe
  2⤵
  PID:14112
- C:\Windows\System\xiyXzFz.exe
  C:\Windows\System\xiyXzFz.exe
  2⤵
  PID:14136
- C:\Windows\System\LULkakF.exe
  C:\Windows\System\LULkakF.exe
  2⤵
  PID:14160
- C:\Windows\System\wwPCJff.exe
  C:\Windows\System\wwPCJff.exe
  2⤵
  PID:14192
- C:\Windows\System\MOFrDTF.exe
  C:\Windows\System\MOFrDTF.exe
  2⤵
  PID:14212
- C:\Windows\System\aDaGqgq.exe
  C:\Windows\System\aDaGqgq.exe
  2⤵
  PID:14240
- C:\Windows\System\UUvraqR.exe
  C:\Windows\System\UUvraqR.exe
  2⤵
  PID:14268
- C:\Windows\System\lMXeeLA.exe
  C:\Windows\System\lMXeeLA.exe
  2⤵
  PID:14296
- C:\Windows\System\AXIdHuE.exe
  C:\Windows\System\AXIdHuE.exe
  2⤵
  PID:14320
- C:\Windows\System\KrTEgnY.exe
  C:\Windows\System\KrTEgnY.exe
  2⤵
  PID:13076
- C:\Windows\System\IxteNoG.exe
  C:\Windows\System\IxteNoG.exe
  2⤵
  PID:11836
- C:\Windows\System\wSKmvGG.exe
  C:\Windows\System\wSKmvGG.exe
  2⤵
  PID:12996
- C:\Windows\System\cUZRSVN.exe
  C:\Windows\System\cUZRSVN.exe
  2⤵
  PID:13384
- C:\Windows\System\fEfvlQc.exe
  C:\Windows\System\fEfvlQc.exe
  2⤵
  PID:13428
- C:\Windows\System\tSMWHvu.exe
  C:\Windows\System\tSMWHvu.exe
  2⤵
  PID:13488
- C:\Windows\System\bdvitWj.exe
  C:\Windows\System\bdvitWj.exe
  2⤵
  PID:13564
- C:\Windows\System\VIoGeFd.exe
  C:\Windows\System\VIoGeFd.exe
  2⤵
  PID:13368
- C:\Windows\System\aqDRfgp.exe
  C:\Windows\System\aqDRfgp.exe
  2⤵
  PID:13640
- C:\Windows\System\XWYFlcf.exe
  C:\Windows\System\XWYFlcf.exe
  2⤵
  PID:13456
- C:\Windows\System\zqVTDeX.exe
  C:\Windows\System\zqVTDeX.exe
  2⤵
  PID:12368
- C:\Windows\System\qKipNMy.exe
  C:\Windows\System\qKipNMy.exe
  2⤵
  PID:12668
- C:\Windows\System\yBQaZvp.exe
  C:\Windows\System\yBQaZvp.exe
  2⤵
  PID:13544
- C:\Windows\System\aiABrkt.exe
  C:\Windows\System\aiABrkt.exe
  2⤵
  PID:13848
- C:\Windows\System\GRhjiao.exe
  C:\Windows\System\GRhjiao.exe
  2⤵
  PID:13736
- C:\Windows\System\gDrduzv.exe
  C:\Windows\System\gDrduzv.exe
  2⤵
  PID:13880
- C:\Windows\System\IXvlFjK.exe
  C:\Windows\System\IXvlFjK.exe
  2⤵
  PID:13832
- C:\Windows\System\plXTlOY.exe
  C:\Windows\System\plXTlOY.exe
  2⤵
  PID:13968
- C:\Windows\System\orWShlp.exe
  C:\Windows\System\orWShlp.exe
  2⤵
  PID:14224
- C:\Windows\System\GwkbuuF.exe
  C:\Windows\System\GwkbuuF.exe
  2⤵
  PID:14172
- C:\Windows\System\FJbQaoP.exe
  C:\Windows\System\FJbQaoP.exe
  2⤵
  PID:12788
- C:\Windows\System\JISZmbx.exe
  C:\Windows\System\JISZmbx.exe
  2⤵
  PID:13480
- C:\Windows\System\usJNfoy.exe
  C:\Windows\System\usJNfoy.exe
  2⤵
  PID:13236
- C:\Windows\System\vHMYxlH.exe
  C:\Windows\System\vHMYxlH.exe
  2⤵
  PID:13272
- C:\Windows\System\iPmSZLz.exe
  C:\Windows\System\iPmSZLz.exe
  2⤵
  PID:14088
- C:\Windows\System\LWhFUqS.exe
  C:\Windows\System\LWhFUqS.exe
  2⤵
  PID:13976
- C:\Windows\System\qgHeUnz.exe
  C:\Windows\System\qgHeUnz.exe
  2⤵
  PID:14120
- C:\Windows\System\HvQdXuj.exe
  C:\Windows\System\HvQdXuj.exe
  2⤵
  PID:14316
- C:\Windows\System\AulTqeP.exe
  C:\Windows\System\AulTqeP.exe
  2⤵
  PID:14364
- C:\Windows\System\qsqxEDw.exe
  C:\Windows\System\qsqxEDw.exe
  2⤵
  PID:14392
- C:\Windows\System\boqOLSO.exe
  C:\Windows\System\boqOLSO.exe
  2⤵
  PID:14420
- C:\Windows\System\rcnSEpB.exe
  C:\Windows\System\rcnSEpB.exe
  2⤵
  PID:14440
- C:\Windows\System\kgNpnOJ.exe
  C:\Windows\System\kgNpnOJ.exe
  2⤵
  PID:14460
- C:\Windows\System\NUBONKE.exe
  C:\Windows\System\NUBONKE.exe
  2⤵
  PID:14484
- C:\Windows\System\oQOMuIZ.exe
  C:\Windows\System\oQOMuIZ.exe
  2⤵
  PID:14512
- C:\Windows\System\ZCsjBQI.exe
  C:\Windows\System\ZCsjBQI.exe
  2⤵
  PID:14536
- C:\Windows\System\mDdAEsH.exe
  C:\Windows\System\mDdAEsH.exe
  2⤵
  PID:14560
- C:\Windows\System\QHAbtnK.exe
  C:\Windows\System\QHAbtnK.exe
  2⤵
  PID:14580
- C:\Windows\System\gCxIdAJ.exe
  C:\Windows\System\gCxIdAJ.exe
  2⤵
  PID:14608
- C:\Windows\System\WUlnvLO.exe
  C:\Windows\System\WUlnvLO.exe
  2⤵
  PID:14628
- C:\Windows\System\KxQYHPe.exe
  C:\Windows\System\KxQYHPe.exe
  2⤵
  PID:14656
- C:\Windows\System\dhECMhX.exe
  C:\Windows\System\dhECMhX.exe
  2⤵
  PID:14680
- C:\Windows\System\YwTrQam.exe
  C:\Windows\System\YwTrQam.exe
  2⤵
  PID:14712
- C:\Windows\System\NSinByf.exe
  C:\Windows\System\NSinByf.exe
  2⤵
  PID:14736
- C:\Windows\System\jPwsrJN.exe
  C:\Windows\System\jPwsrJN.exe
  2⤵
  PID:14760
- C:\Windows\System\HswDjvV.exe
  C:\Windows\System\HswDjvV.exe
  2⤵
  PID:14784
- C:\Windows\System\QBIYRUh.exe
  C:\Windows\System\QBIYRUh.exe
  2⤵
  PID:14812
- C:\Windows\System\hpsdRpH.exe
  C:\Windows\System\hpsdRpH.exe
  2⤵
  PID:14836
- C:\Windows\System\UDPFZDX.exe
  C:\Windows\System\UDPFZDX.exe
  2⤵
  PID:14872
- C:\Windows\System\PwDLVIq.exe
  C:\Windows\System\PwDLVIq.exe
  2⤵
  PID:14900
- C:\Windows\System\pPCoUGJ.exe
  C:\Windows\System\pPCoUGJ.exe
  2⤵
  PID:14948
- C:\Windows\System\NSGMFKX.exe
  C:\Windows\System\NSGMFKX.exe
  2⤵
  PID:14976
- C:\Windows\System\DkawqHl.exe
  C:\Windows\System\DkawqHl.exe
  2⤵
  PID:15004
- C:\Windows\System\gufMnDf.exe
  C:\Windows\System\gufMnDf.exe
  2⤵
  PID:15036
- C:\Windows\System\TrPzFey.exe
  C:\Windows\System\TrPzFey.exe
  2⤵
  PID:15052
- C:\Windows\System\WqSOLbj.exe
  C:\Windows\System\WqSOLbj.exe
  2⤵
  PID:15084
- C:\Windows\System\WuwNIAL.exe
  C:\Windows\System\WuwNIAL.exe
  2⤵
  PID:15100
- C:\Windows\System\JqoaGMx.exe
  C:\Windows\System\JqoaGMx.exe
  2⤵
  PID:15120
- C:\Windows\System\xrveTml.exe
  C:\Windows\System\xrveTml.exe
  2⤵
  PID:15136
- C:\Windows\System\NaFxJVu.exe
  C:\Windows\System\NaFxJVu.exe
  2⤵
  PID:15156
- C:\Windows\System\YAPsalP.exe
  C:\Windows\System\YAPsalP.exe
  2⤵
  PID:15176
- C:\Windows\System\jurrLEK.exe
  C:\Windows\System\jurrLEK.exe
  2⤵
  PID:15196
- C:\Windows\System\jUFLgXs.exe
  C:\Windows\System\jUFLgXs.exe
  2⤵
  PID:15224
- C:\Windows\System\BdNVLlD.exe
  C:\Windows\System\BdNVLlD.exe
  2⤵
  PID:15252
- C:\Windows\System\bThuQAg.exe
  C:\Windows\System\bThuQAg.exe
  2⤵
  PID:15268
- C:\Windows\System\SmfQmcg.exe
  C:\Windows\System\SmfQmcg.exe
  2⤵
  PID:15300
- C:\Windows\System\IZtyoYm.exe
  C:\Windows\System\IZtyoYm.exe
  2⤵
  PID:15328
- C:\Windows\System\EhQvUQy.exe
  C:\Windows\System\EhQvUQy.exe
  2⤵
  PID:15348
- C:\Windows\System\iNGsWTt.exe
  C:\Windows\System\iNGsWTt.exe
  2⤵
  PID:14280
- C:\Windows\System\jLmwuzu.exe
  C:\Windows\System\jLmwuzu.exe
  2⤵
  PID:14312
- C:\Windows\System\vzKAEuJ.exe
  C:\Windows\System\vzKAEuJ.exe
  2⤵
  PID:12056
- C:\Windows\System\bUSBpNn.exe
  C:\Windows\System\bUSBpNn.exe
  2⤵
  PID:14260
- C:\Windows\System\josIXOu.exe
  C:\Windows\System\josIXOu.exe
  2⤵
  PID:13692
- C:\Windows\System\csyFRcH.exe
  C:\Windows\System\csyFRcH.exe
  2⤵
  PID:14524
- C:\Windows\System\FGYCIIv.exe
  C:\Windows\System\FGYCIIv.exe
  2⤵
  PID:14456
- C:\Windows\System\ZnWRoAG.exe
  C:\Windows\System\ZnWRoAG.exe
  2⤵
  PID:14504
- C:\Windows\System\OVAXuzM.exe
  C:\Windows\System\OVAXuzM.exe
  2⤵
  PID:14452
- C:\Windows\System\OzTfDCn.exe
  C:\Windows\System\OzTfDCn.exe
  2⤵
  PID:14576
- C:\Windows\System\akOiYWC.exe
  C:\Windows\System\akOiYWC.exe
  2⤵
  PID:14892
- C:\Windows\System\gdwSvGO.exe
  C:\Windows\System\gdwSvGO.exe
  2⤵
  PID:14732
- C:\Windows\System\qfAAVhg.exe
  C:\Windows\System\qfAAVhg.exe
  2⤵
  PID:14640
- C:\Windows\System\ueuuhAu.exe
  C:\Windows\System\ueuuhAu.exe
  2⤵
  PID:14864
- C:\Windows\System\IDbLswJ.exe
  C:\Windows\System\IDbLswJ.exe
  2⤵
  PID:14916
- C:\Windows\System\kOCqDZr.exe
  C:\Windows\System\kOCqDZr.exe
  2⤵
  PID:15076
- C:\Windows\System\oNfCgjT.exe
  C:\Windows\System\oNfCgjT.exe
  2⤵
  PID:15188
- C:\Windows\System\xKApZIz.exe
  C:\Windows\System\xKApZIz.exe
  2⤵
  PID:15096
- C:\Windows\System\LNyzNIp.exe
  C:\Windows\System\LNyzNIp.exe
  2⤵
  PID:15312
- C:\Windows\System\aqnThnM.exe
  C:\Windows\System\aqnThnM.exe
  2⤵
  PID:15208
- C:\Windows\System\pHwcBrb.exe
  C:\Windows\System\pHwcBrb.exe
  2⤵
  PID:13340
- C:\Windows\System\pBeUcUj.exe
  C:\Windows\System\pBeUcUj.exe
  2⤵
  PID:14428
- C:\Windows\System\yIapzVm.exe
  C:\Windows\System\yIapzVm.exe
  2⤵
  PID:14652
- C:\Windows\System\qPndViA.exe
  C:\Windows\System\qPndViA.exe
  2⤵
  PID:13760
- C:\Windows\System\IvHbhPE.exe
  C:\Windows\System\IvHbhPE.exe
  2⤵
  PID:14624
- C:\Windows\System\UnlZdjl.exe
  C:\Windows\System\UnlZdjl.exe
  2⤵
  PID:15000
- C:\Windows\System\xhNHaCR.exe
  C:\Windows\System\xhNHaCR.exe
  2⤵
  PID:15372
- C:\Windows\System\QbIyEvx.exe
  C:\Windows\System\QbIyEvx.exe
  2⤵
  PID:15388
- C:\Windows\System\aiUfxmY.exe
  C:\Windows\System\aiUfxmY.exe
  2⤵
  PID:15408
- C:\Windows\System\xMxOFvA.exe
  C:\Windows\System\xMxOFvA.exe
  2⤵
  PID:15428
- C:\Windows\System\xTkWtmY.exe
  C:\Windows\System\xTkWtmY.exe
  2⤵
  PID:15448
- C:\Windows\System\KmwKXFf.exe
  C:\Windows\System\KmwKXFf.exe
  2⤵
  PID:15468
- C:\Windows\System\BhUtKhy.exe
  C:\Windows\System\BhUtKhy.exe
  2⤵
  PID:15488
- C:\Windows\System\TvzCaWA.exe
  C:\Windows\System\TvzCaWA.exe
  2⤵
  PID:15512
- C:\Windows\System\DcftMGg.exe
  C:\Windows\System\DcftMGg.exe
  2⤵
  PID:15536
- C:\Windows\System\OgxYduv.exe
  C:\Windows\System\OgxYduv.exe
  2⤵
  PID:15560
- C:\Windows\System\uMMSLuj.exe
  C:\Windows\System\uMMSLuj.exe
  2⤵
  PID:15588
- C:\Windows\System\KEGtpgL.exe
  C:\Windows\System\KEGtpgL.exe
  2⤵
  PID:15624
- C:\Windows\System\VRuSKSk.exe
  C:\Windows\System\VRuSKSk.exe
  2⤵
  PID:15652
- C:\Windows\System\bUGSEfz.exe
  C:\Windows\System\bUGSEfz.exe
  2⤵
  PID:15684
- C:\Windows\System\EvCvfWX.exe
  C:\Windows\System\EvCvfWX.exe
  2⤵
  PID:15704
- C:\Windows\System\VuRPPGj.exe
  C:\Windows\System\VuRPPGj.exe
  2⤵
  PID:15732
- C:\Windows\System\AvHTBct.exe
  C:\Windows\System\AvHTBct.exe
  2⤵
  PID:15756
- C:\Windows\System\VEdaCmn.exe
  C:\Windows\System\VEdaCmn.exe
  2⤵
  PID:15792
- C:\Windows\System\aZFhfUc.exe
  C:\Windows\System\aZFhfUc.exe
  2⤵
  PID:15816
- C:\Windows\System\SVAFImP.exe
  C:\Windows\System\SVAFImP.exe
  2⤵
  PID:15840
- C:\Windows\System\mqikhBJ.exe
  C:\Windows\System\mqikhBJ.exe
  2⤵
  PID:15868
- C:\Windows\System\XGdRYoc.exe
  C:\Windows\System\XGdRYoc.exe
  2⤵
  PID:15888
- C:\Windows\System\wOmSpkW.exe
  C:\Windows\System\wOmSpkW.exe
  2⤵
  PID:15908
- C:\Windows\System\cnOxIiD.exe
  C:\Windows\System\cnOxIiD.exe
  2⤵
  PID:15940
- C:\Windows\System\mBfYOsF.exe
  C:\Windows\System\mBfYOsF.exe
  2⤵
  PID:15960
- C:\Windows\System\TAOHWmW.exe
  C:\Windows\System\TAOHWmW.exe
  2⤵
  PID:15996
- C:\Windows\System\wyRBgVr.exe
  C:\Windows\System\wyRBgVr.exe
  2⤵
  PID:16016
- C:\Windows\System\DXhBewM.exe
  C:\Windows\System\DXhBewM.exe
  2⤵
  PID:16036
- C:\Windows\System\dsyBbmC.exe
  C:\Windows\System\dsyBbmC.exe
  2⤵
  PID:16064
- C:\Windows\System\qyLgPmW.exe
  C:\Windows\System\qyLgPmW.exe
  2⤵
  PID:16096
- C:\Windows\System\EwbZgHi.exe
  C:\Windows\System\EwbZgHi.exe
  2⤵
  PID:16120
- C:\Windows\System\ENduIJr.exe
  C:\Windows\System\ENduIJr.exe
  2⤵
  PID:16144
- C:\Windows\System\OUFqNet.exe
  C:\Windows\System\OUFqNet.exe
  2⤵
  PID:16164
- C:\Windows\System\lmhRrJY.exe
  C:\Windows\System\lmhRrJY.exe
  2⤵
  PID:16188
- C:\Windows\System\FDRRUYM.exe
  C:\Windows\System\FDRRUYM.exe
  2⤵
  PID:16224
- C:\Windows\System\SZEJhRM.exe
  C:\Windows\System\SZEJhRM.exe
  2⤵
  PID:16240
- C:\Windows\System\DGNWhGH.exe
  C:\Windows\System\DGNWhGH.exe
  2⤵
  PID:16268
- C:\Windows\System\xstXgNC.exe
  C:\Windows\System\xstXgNC.exe
  2⤵
  PID:16132
- C:\Windows\System\BkBtFWd.exe
  C:\Windows\System\BkBtFWd.exe
  2⤵
  PID:16160
- C:\Windows\System\bGWppdf.exe
  C:\Windows\System\bGWppdf.exe
  2⤵
  PID:16204
- C:\Windows\System\UCXjrWk.exe
  C:\Windows\System\UCXjrWk.exe
  2⤵
  PID:15832
- C:\Windows\System\UTNPKAr.exe
  C:\Windows\System\UTNPKAr.exe
  2⤵
  PID:15528
- C:\Windows\System\ZLwFWPL.exe
  C:\Windows\System\ZLwFWPL.exe
  2⤵
  PID:15576
- C:\Windows\System\AFQgjBd.exe
  C:\Windows\System\AFQgjBd.exe
  2⤵
  PID:16328
- C:\Windows\System\GFLjzOx.exe
  C:\Windows\System\GFLjzOx.exe
  2⤵
  PID:16332
- C:\Windows\System\tBljDvi.exe
  C:\Windows\System\tBljDvi.exe
  2⤵
  PID:16056
- C:\Windows\System\AUpoUcG.exe
  C:\Windows\System\AUpoUcG.exe
  2⤵
  PID:16376
- C:\Windows\System\jlIVyDd.exe
  C:\Windows\System\jlIVyDd.exe
  2⤵
  PID:16236
- C:\Windows\System\mRmhBWJ.exe
  C:\Windows\System\mRmhBWJ.exe
  2⤵
  PID:16276
- C:\Windows\System\XpeaBey.exe
  C:\Windows\System\XpeaBey.exe
  2⤵
  PID:15948
- C:\Windows\System\FYXkZNy.exe
  C:\Windows\System\FYXkZNy.exe
  2⤵
  PID:14696
- C:\Windows\System\qmhmuDG.exe
  C:\Windows\System\qmhmuDG.exe
  2⤵
  PID:15508
- C:\Windows\System\DBBRILb.exe
  C:\Windows\System\DBBRILb.exe
  2⤵
  PID:15400
- C:\Windows\System\KpKjnLK.exe
  C:\Windows\System\KpKjnLK.exe
  2⤵
  PID:16116
- C:\Windows\System\xrwXkeq.exe
  C:\Windows\System\xrwXkeq.exe
  2⤵
  PID:15800
- C:\Windows\System\OtoTXzC.exe
  C:\Windows\System\OtoTXzC.exe
  2⤵
  PID:16308
- C:\Windows\System\cjuPmbJ.exe
  C:\Windows\System\cjuPmbJ.exe
  2⤵
  PID:16360
- C:\Windows\System\hMhZCSm.exe
  C:\Windows\System\hMhZCSm.exe
  2⤵
  PID:14688
- C:\Windows\System\ybQCJGT.exe
  C:\Windows\System\ybQCJGT.exe
  2⤵
  PID:13424
- C:\Windows\System\ysIKxLP.exe
  C:\Windows\System\ysIKxLP.exe
  2⤵
  PID:16216
- C:\Windows\System\GvioXfs.exe
  C:\Windows\System\GvioXfs.exe
  2⤵
  PID:14412
- C:\Windows\System\ugQbGYR.exe
  C:\Windows\System\ugQbGYR.exe
  2⤵
  PID:14180
- C:\Windows\System\eCGdipC.exe
  C:\Windows\System\eCGdipC.exe
  2⤵
  PID:16408
- C:\Windows\System\bKzKAli.exe
  C:\Windows\System\bKzKAli.exe
  2⤵
  PID:16432
- C:\Windows\System\xQyGJcz.exe
  C:\Windows\System\xQyGJcz.exe
  2⤵
  PID:16456
- C:\Windows\System\zmJhNAL.exe
  C:\Windows\System\zmJhNAL.exe
  2⤵
  PID:16480
- C:\Windows\System\kIVveGK.exe
  C:\Windows\System\kIVveGK.exe
  2⤵
  PID:16508
- C:\Windows\System\bKIxiAT.exe
  C:\Windows\System\bKIxiAT.exe
  2⤵
  PID:16536
- C:\Windows\System\BUZsxBs.exe
  C:\Windows\System\BUZsxBs.exe
  2⤵
  PID:16560
- C:\Windows\System\rbazpyZ.exe
  C:\Windows\System\rbazpyZ.exe
  2⤵
  PID:16580
- C:\Windows\System\nVjhpaC.exe
  C:\Windows\System\nVjhpaC.exe
  2⤵
  PID:16600
- C:\Windows\System\zAkrKUf.exe
  C:\Windows\System\zAkrKUf.exe
  2⤵
  PID:16616
- C:\Windows\System\fPHnSWS.exe
  C:\Windows\System\fPHnSWS.exe
  2⤵
  PID:16640
- C:\Windows\System\AWpgArS.exe
  C:\Windows\System\AWpgArS.exe
  2⤵
  PID:16672
- C:\Windows\System\HrzpeBh.exe
  C:\Windows\System\HrzpeBh.exe
  2⤵
  PID:16692
- C:\Windows\System\GiMlLTS.exe
  C:\Windows\System\GiMlLTS.exe
  2⤵
  PID:16720
- C:\Windows\System\SGZnGPz.exe
  C:\Windows\System\SGZnGPz.exe
  2⤵
  PID:16744
- C:\Windows\System\FicOCrL.exe
  C:\Windows\System\FicOCrL.exe
  2⤵
  PID:16768
- C:\Windows\System\gNdCvPc.exe
  C:\Windows\System\gNdCvPc.exe
  2⤵
  PID:16796
- C:\Windows\System\VtNNFoR.exe
  C:\Windows\System\VtNNFoR.exe
  2⤵
  PID:16820
- C:\Windows\System\ZiQwoXu.exe
  C:\Windows\System\ZiQwoXu.exe
  2⤵
  PID:16848
- C:\Windows\System\DOPKhUd.exe
  C:\Windows\System\DOPKhUd.exe
  2⤵
  PID:16872
- C:\Windows\System\WvmuHoI.exe
  C:\Windows\System\WvmuHoI.exe
  2⤵
  PID:16900
- C:\Windows\System\YVxOzln.exe
  C:\Windows\System\YVxOzln.exe
  2⤵
  PID:16916
- C:\Windows\System\KABPTpq.exe
  C:\Windows\System\KABPTpq.exe
  2⤵
  PID:16940
- C:\Windows\System\JLWnpZN.exe
  C:\Windows\System\JLWnpZN.exe
  2⤵
  PID:16980
- C:\Windows\System\JGPjFmC.exe
  C:\Windows\System\JGPjFmC.exe
  2⤵
  PID:17000
- C:\Windows\System\mkDPktE.exe
  C:\Windows\System\mkDPktE.exe
  2⤵
  PID:17028
- C:\Windows\System\SbSyrkJ.exe
  C:\Windows\System\SbSyrkJ.exe
  2⤵
  PID:17052
- C:\Windows\System\DpPThFI.exe
  C:\Windows\System\DpPThFI.exe
  2⤵
  PID:17076

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16592

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AcZjgne.exe

Filesize
1.5MB

MD5
c909e79006e9a700c45d6a7cac0e5b38

SHA1
fa7b8d6078690ba8d6834768c535bb09a2796043

SHA256
7e25669d2596484de21a9995030c1d2926f34439f3c96ba0430e15eb72ae2c31

SHA512
91f1dd68d733c21019e1ae5a109a007eb0ee48f61b31ae74349d9026dc27d0c8ae8ade8609694fa206f4d3995e5f879ba1107ea04299329bd62d90c64f248989

Download Submit
C:\Windows\System\EXVoTUX.exe

Filesize
1.5MB

MD5
0ab7c889026c83afbf80167921bd79ef

SHA1
c18dd990dd58defa264834e9dff0daf21871eb18

SHA256
464afe2abe30747a3962d24932ca4ddc7d11005034bc9ad1f1e06b1845af6eb1

SHA512
9ad0c0c394788deeb47e3c184ddecfd5053742a57c3dbb7ad9e295a9d7a2c7a8e2dc20556d75943625d15e7b7162dcfe38b329cd0222170cfb75f0980a2552a6

Download Submit
C:\Windows\System\FCaDGKB.exe

Filesize
1.5MB

MD5
6889693abe6fb5eeb416a0b59c78bf33

SHA1
90bcb7d3220fe80233070221dcaa5f23cc853866

SHA256
75b5f43831a57e40107423948458701dfb832e9b7c31b1bf383cd1c60bdb830a

SHA512
76bbf8420890be46021bec98a625431658f63801acf694d18d14c2a359fc5b9e70acc140531d389336baf6eef65f8695d68df59ac09933fb2bceedee17072479

Download Submit
C:\Windows\System\IYhQORW.exe

Filesize
1.5MB

MD5
49a7031cc60db9ce9a42052102028e77

SHA1
2e708e1dc99390bcc343d0d4226812eb28555d30

SHA256
e7a605fa30db040fc7ce0b5c3016b07f4dc33e237ab2286615c0eea9e039eb03

SHA512
529ff232fb9efef7e689e49eed59193c638faffd4e1ae8edebdcbdc910717016179eb76ed64d54b7a2b5521577bbfaa7fa2cf11fcb2f01429b9873eef908fd0b

Download Submit
C:\Windows\System\KATJrTi.exe

Filesize
1.5MB

MD5
893457e3dcbaa501a7fdd64fd0cf9716

SHA1
dacd43a95a2cc221a52bcc482c0b2e56d194876a

SHA256
f08a0196c0ceef8225af851d1776ebad50abb1af64c10ae3e59a8134c417d0a3

SHA512
d11855b41807fbaf31cf948f9f65c5fe60377f40ed94c11625a61beb7215c609a5c44817eeb6c4c40f10ca6ab386c576cf6787ac5bfbe9195d1f46342b7935ab

Download Submit
C:\Windows\System\KqkxcNg.exe

Filesize
1.5MB

MD5
7afc471845ffd39aecbdcaea183949e8

SHA1
da9e41b145afe7ad303fbb15bdd5e89b32e76079

SHA256
7eb2c9a2d001119166e7bdc551b6844fef9a617ffae8c7cb25f0eab8caabadb5

SHA512
674528063a9d6527ed8b76f292e95d25e0da68043663fc4e33fc45e662fc5da8380b246a01b2b5abc057f747ddda82f488c86ff0e95b0ddfbe805e85f3a08651

Download Submit
C:\Windows\System\LOGTpGr.exe

Filesize
1.5MB

MD5
7b3339bf6a4dc48132936e888fcecf94

SHA1
6391c0d370c47eb019b1768115ba9223307a97b2

SHA256
0d55af158814a299cac83c95c238ce6aa14b07035fc35d2a8381b4b9a99828f7

SHA512
dad327df0e2700dcbbafa1ec36080981af5de5eb82241be8390f53aa73338ad06710250c51f29f3ce8a63a31ae7bef4f8c1fc46d8ac873dbaea525da0fceeaf9

Download Submit
C:\Windows\System\MDWRyPq.exe

Filesize
1.5MB

MD5
4821bda90dc0a1707fb4a85a9f99cb25

SHA1
05e978bf51b09a131cb7cbabe74814e59dda40a3

SHA256
378d6d5d3d75bf2be02a958eb6f9221569679689b2c4fb5e74408417a71e4ae7

SHA512
358f668c03b163f22488b4753100517c068c051a1eea7b6e9baf6c20f02f3fbbcaebccacb0fda0c36e4493ee7ff5eba3f46c439107476e3f20a86900e8def7ea

Download Submit
C:\Windows\System\McPvqmm.exe

Filesize
1.5MB

MD5
d3e85015c02f117f240f255f21c293c9

SHA1
693962d4a8d658d21016ae2ee07d7b6ba7da2c0f

SHA256
fad9445f4f0d6e6c74ab58ed50274e81b04f27e591fe35fb7a718fc883376c35

SHA512
f0fbcf30ef6c78e213563ec3474d706d02ccd31bc18bac7e446f1386f5eb41e1de639e6e542b5b51c4aa2da3e9a14022598e39e745d2bb38e312c131e8207e8e

Download Submit
C:\Windows\System\MwUXVsu.exe

Filesize
1.5MB

MD5
7324dd2fa8e3539e379b5fc075b056ee

SHA1
7480d272e136d48d6e060838e314e7546eb4d930

SHA256
18eab9a50dd5a174946cb15ccf8e5e64049f5cdab183b68e1891b6c316577137

SHA512
54214029d257b75fad558a118a107502e6097f090a1b10ab2b507a5d684c891198b00e1b8ee3c137a9d9360540e88e1278800a30475dc80e88b33482a50d0dea

Download Submit
C:\Windows\System\NWKIbUM.exe

Filesize
1.5MB

MD5
acb58c8030b46b7bc4cdb4734e69bd12

SHA1
6f58a40e1ae35fffdcea835538ccc478f1e28b2e

SHA256
e838f65c3cb37d9c778589ea9b6da2f2b498d559ea9e3842db2d3bbb614355c9

SHA512
27cf824ce01d1bef5d35ae832152a94f8797fd3c34bc3e3557206b47cf13b3e00449dc0ed1401655cee88d6228144f75b936c5a5c4b521ac241a8b8515d64cec

Download Submit
C:\Windows\System\OozMurP.exe

Filesize
1.5MB

MD5
59f70f8ce28920d346d6a0b24c1eeb16

SHA1
f1905df3a9fe51ab57403f8c447e413483efec37

SHA256
3c8b008fe1db0d142fe5861924b04cd8d5a13cadfc9542e4384cccda55a92e43

SHA512
b6246dc3683c2a3052c55c65ff233bc42383a2f2d657ecb8a9dcc2e7588382600b9ac8d10d5be4870f177e5e5f13c18ca25cb4658d3eaf0015e20b2740ce3eab

Download Submit
C:\Windows\System\PIHBGZF.exe

Filesize
1.5MB

MD5
4475702742f55ca88b682aad25f5e926

SHA1
7143e2dfdad418fcd1e65a5f69cce25ef6e34771

SHA256
cb5552b4e8ee3f40f5998b7bf8d2340ddcdd12e31071da6d5f007a72e3d2f754

SHA512
5b1c4c5abbc0fe6405be5f3e520a91bf7ce0e915f2f13273f96d0cff20020042d29b65d185744716a92bddc7cbe1e72863ac441ce189ecad8652460aab6d0f55

Download Submit
C:\Windows\System\PVrpEHw.exe

Filesize
1.5MB

MD5
a49fa7ae570f49a4346854a1c7848a95

SHA1
7f8e0f2b2fde137d6b3d3c05ffc9f3b985d058c7

SHA256
80e4a81c1b8ac1e3ea64fa2ba4d1dc03f8ff2956412e6f334059dbf3568e72ae

SHA512
a7283df5c7000ff239a727014ed9881885a36beba59a4eae53c6ed82a076e444c654fa97620c9f9c159bea7662753792e6964a87643722b6a26dcabba74b304e

Download Submit
C:\Windows\System\PfLrYcv.exe

Filesize
1.5MB

MD5
5037aac31b179693c346bcbbf57ce864

SHA1
8e2d41ccf23977642886f94a0b8691b13f382286

SHA256
6f5e49b17c672a5b6ae1cf48d07df9ef58136c3f64c817aaf656b34b72edd3ac

SHA512
00dff4f7a1402874ec899bb911fc91402e1dbeab19bcd0a5030da415f9c94638a503c8bd55812b871c1c99d66cf7f7a3af6a023ceffa48dca88da7cef42c4b93

Download Submit
C:\Windows\System\QYtPBty.exe

Filesize
1.5MB

MD5
6ab3b75aed4af916c7be40c43a12cbfb

SHA1
dd4b83b04075a61a7856d27c343f6f4c923f0202

SHA256
69479485149e7a9a31e7ca90d97d6b0013f6924bdf1b2f92fda7aa9b1dc1b08d

SHA512
0f92234c784f3203b98ed4c18eaa0f871b6286ff51056937e5990deffb1304203c25de8f773bb073c2a1bde989a13dcd1a92b4146d8e6c1f057013059ca6b81a

Download Submit
C:\Windows\System\QeiaRaL.exe

Filesize
1.5MB

MD5
093f62f7e0d980d304236178c57c59f6

SHA1
b7bb121a0b40b3feb6812495cbd5b2aabf09e187

SHA256
be24bc92bf74c36e14945c8fa957e0c755fc05cfb1ca7b1718eac39bf3fa1e46

SHA512
e2fc1f3f870d068f155b9e97dc5d4150da5577dfab2138840a9915e20d7f4ab36cffdd892f66b8115ab02bd65d147c1cb0c313be4c9132c9c6f45da3cd45673b

Download Submit
C:\Windows\System\QlEWmEv.exe

Filesize
1.5MB

MD5
fbaaa82c6dd0fc79dba040051164711b

SHA1
6f1f5e69d7edd4f8c1bf76ebf370e93f2216f74c

SHA256
f6777f40c6e80712e0029b06e855a81d46644cb82cd77791d71d03127fd6f0aa

SHA512
7228270792a2852d93e60a4c27b3561d10fcbbc13a21de351ad4ad81d47889e72e49034b9b9890d5bc96278186875bc3e15e81c993e314ef36c680296d0e6cb1

Download Submit
C:\Windows\System\QmkvmXA.exe

Filesize
1.5MB

MD5
a1f6350dd04e8d489a312353e050e7a2

SHA1
c59cedeeb008423b7ad977ef398fafd8d030c14d

SHA256
2754f752ead86e5c117630f1168daa41d1675642308a334073d1d698f40a0805

SHA512
4a2eb3139bb23b3b81da9978a65233dd939a1f9e49376d464cc714d2f6de6a47c3e6963ff8afe15520e7ca0701ddbdc5e2bd9ebb0d401db2b5c0e342d552feaf

Download Submit
C:\Windows\System\RZpszoW.exe

Filesize
1.5MB

MD5
47c76d768405204d2348d7f784b686bc

SHA1
3e5e45d3735d3aae99256c15ab380c140d56c023

SHA256
c50ed5682627b7229d1bc437e490be295a0a740a898a41402541ef75a82ee7d3

SHA512
708942276f31d1a3525047cc7fda93cfe22aca2f62a0d24df19c526a94b45a6a47ae9db1da0ac2588677736a949e52a7d97f311db867972b996908b37e69cad6

Download Submit
C:\Windows\System\THZLUbr.exe

Filesize
1.5MB

MD5
7b752057634800b4db8255af48339069

SHA1
6717b8c515457fb12ce47608271505e6fdc45586

SHA256
9a2ab52027b8095e293cbef6cfb07ef5bcf08076a3f02344165c3666459a02f9

SHA512
c047ec65fec8aae573d4da9366270c2553e70e049f293e3d0339e13abfb34099c9932808aedc0d4777c2513468041dd5db5c75ee21e1a58866320c8a7329db9e

Download Submit
C:\Windows\System\VwWUZqJ.exe

Filesize
1.5MB

MD5
2220a1871f060d3366251f9d586a65d2

SHA1
171ddce2f5d0170916483af80e1df4836e462fd1

SHA256
c9a124a346de6369e6e756e9f936a66398a17ac4ed0fa5689565a00be17e98a2

SHA512
0eaeaea03954600bba63a26e61d413d65c19b95341822947da817b134eadcc3837c938e2c9e3e6da6d26625d8f5a0dc5362f63111c1d413391e57f8790ccd144

Download Submit
C:\Windows\System\WfOrgHM.exe

Filesize
1.5MB

MD5
6764fd2268d8ded9fd27c9ff3ed1e878

SHA1
5ec84ca5a8abf86fd8e792d55cd0a9934c9fd89d

SHA256
e637119741a9e15b9ba41bd3f06cdafbdd607b635bac204cbba256ca97fe4701

SHA512
c3d6d8cc5dbc41d862f6f7e586d9f1200ef1459eb0dcb8bf139abab86ed8df8376351794e6c4c3dc81afc5b3054695347cb9b726ef35805247b4c2a4980667c3

Download Submit
C:\Windows\System\YwgErpn.exe

Filesize
1.5MB

MD5
7395b8bd24be7990315feb662eee22a1

SHA1
bae5737fa3d6e5d6565bacfd0732deda7d37f23a

SHA256
5a0c6a1b717477f9a802f7c441c530cede06fcb280f524705c4980ff2b7493ba

SHA512
072067dd949684200b21a20dff141b26ff9276ef8337cb88231d7167df0d6f2f92d90684084dfa4f51781e6232ee648a24bc4383cfd2f9ef7061316c9bd19f83

Download Submit
C:\Windows\System\ZTyXVtn.exe

Filesize
1.5MB

MD5
1bbee9f83817cdc5827f9236e64994b3

SHA1
e42375285b1e6de021029a44d50995062aaf555c

SHA256
01ba22198d4e6deccafe7f8d86c907ce80aa1e0f2f85800be969363c981b72a1

SHA512
63d6cee7410d3f9835213a9bc33694a4146016bb4a41395fb3974c31219d2642218cc086c645fbcd08747583065b56951e39cb01c4bb0b371f0fe7a3bd86d61c

Download Submit
C:\Windows\System\axDmAoA.exe

Filesize
1.5MB

MD5
850ae519fd8bc3cd9f6b6fc2146a1347

SHA1
3afb1ce10054fbaf96f05c03d493c606f26881bb

SHA256
4facd4105bc13f718599afc2fcbdc2746dec530ed75061fabb1d1048af5e0d1d

SHA512
6b9ff09ee2cdd5e782825e94091ba7a4af40a82a5114d4c34734de68953f57938d6b762b1e29f82d4f56c8163f67c88adf2d670094b4de152f80ff46ea998c5e

Download Submit
C:\Windows\System\fEFosfQ.exe

Filesize
1.5MB

MD5
c2417d9194be6488bee3bcc359dba80c

SHA1
f1737bdc94eb755fe59aae4479f29dcadcb129bb

SHA256
224b9d807276795efb66395d9caaf50a4c0847b3e9be0c1dd215320ef41d5310

SHA512
ff5c439a2c62dd90f39c56a7a281962420df2ec2bcb382a0ef3661fd30db28f8634daa69ddcfcc4384a98f88e55a465cdd4f68640309bf46777e428411a6e76d

Download Submit
C:\Windows\System\fvxjEVQ.exe

Filesize
1.5MB

MD5
4537cbef8919741f8661bb0f81d0043c

SHA1
b576dc0d00b8204ccc8fca0de92083f59a34c846

SHA256
30aa3c313aa555fbf157c77812c99a405116253a03c7ce046ef2f04d8a9efcf9

SHA512
0875c50860a9dcc355cbc77d9591b792a14ca2b40d29957492020f268e2c97ae2ea727cbaa9e90e2f8ad1760e5bc27b5ebd2882bfc959b8d8fbf1ad4a71cb5f4

Download Submit
C:\Windows\System\kmYpukr.exe

Filesize
1.5MB

MD5
1f03427a3c9b44558c7c7deb22431352

SHA1
2f1824f1da99b778f183c3b899da54d4d36b9dd0

SHA256
4870caf885669a4bd3ee88759f72ae1ae3bbbd96a55eef0fd1a71156925195bb

SHA512
60cbf43911685602532e0ab9410c9c1dda68c471ff36cfaaf2c2afb5f5cc00093e78d2322ed547f00f6a85a87bdcf5e603f8b1f98dd10581a23f7b78869793af

Download Submit
C:\Windows\System\luJoDxd.exe

Filesize
1.5MB

MD5
bc06b5801c1efbba3faeabc51a1bf7ed

SHA1
50dae5ce01a409db61ff9eaedf94602edc1672d0

SHA256
7f10741dbf385f6eb5699f8676b9a61e929a4a4cefccc5d427932ab5b242de56

SHA512
7a52e0de9bf1213f038792ad5b90e3e41533f487c3ef8750d75ea8f52713fcc58bcff7dbd8e4c87755f78034f69a2bbe35fef22e1472369c68f9c5aec4a201a9

Download Submit
C:\Windows\System\mirgQBx.exe

Filesize
1.5MB

MD5
9fb405eb1cc246a2d522667aaa347fe9

SHA1
def3e9d73d18b48e4176d463e89c441e19439b0b

SHA256
05aff26e2ac2f540f387d269cba3d43a2a6251d130178527768d8a74161a0cb0

SHA512
c100db518b86834ccf66eeb673d706986c9824e4659faaf0225d58ef2d30b58033c17e998726c15f4a78c2eb156f1c83bcfe071eda697840758f289f1cc4c69b

Download Submit
C:\Windows\System\moahKok.exe

Filesize
1.5MB

MD5
33ca0de21f73839b81495a5209abc071

SHA1
10ce07e88ac88f3935134c88369a619ab70817a5

SHA256
4e374445e029a939a3eac2682b66c1d82b5620946563af29d1a0dee5ef76fe72

SHA512
547dfdc8317a9157f10299547708dec5b3c038c1d9bf9ab7c7630a7d3bb229de6252808a55e559fa87121eb96fbfd30bf1985bc4286285fc4d7e2b1ba8ef1ce5

Download Submit
C:\Windows\System\oUgkZlM.exe

Filesize
1.5MB

MD5
b0df944864045cf9538082bb880f97de

SHA1
47dd58f8561a3e89781bb2b42360e97d5f59c9bf

SHA256
26e2da4ed5598fe81628bbefaa19ad833a7d91f9bd6a8c1ff503f5766d6e553b

SHA512
550994fe3c56a10650f8dae0fd109242cca483e5e59cc8540614ceecb0e4a241d74b408df718f20b612ea851653ddea9511f59e535b034e64fe459b9275a866a

Download Submit
C:\Windows\System\rFqRwqf.exe

Filesize
1.5MB

MD5
b45cd42c1e491f30f4706ffd3f97627b

SHA1
7dc9ec38172d95a80340ac672c86b5d0c9639b3e

SHA256
412678368f3554b7e019ab1425601546c80ab20e7a4489e8c9c81d3fa37d15fc

SHA512
39f20df7d71b8a58325f58f40966e82961fc1f4a581aeb2dbfaa8c4ca0581cf99c4f48a78e13f3be1bcde633fcefce60d92b2057c25d48febe09d8848f5ef212

Download Submit
C:\Windows\System\uYAivrf.exe

Filesize
1.5MB

MD5
8340f88dbad2fdea31742e5bf2239f07

SHA1
e95581d88694ca71613f30a5ae1fdc807ae1767c

SHA256
573da24fd7666de7936a5d973498221af74c6fb9372ed59c10551f9b68762811

SHA512
5b9634faa303ea5dcde7b9c77c6e657d8525d6e02ada89112d19bc42a95120547391c0837724e028fb047a4387f745c6302776824f941180e6f0ab025fe161ee

Download Submit
C:\Windows\System\vQPPEer.exe

Filesize
1.5MB

MD5
b6c229d928cb37eb2db3b47115776d42

SHA1
560a2f9323f38967bf40415129293a5059ab4082

SHA256
d666a36ee69a4d6ff2e22526f0248046f010f79fa6504754ec14d473a950c04e

SHA512
0a2c9f42132055bd2204f4d05e8428e615ddbadfa5745dd159726bf96928cdf16f0ec0c8d9e26bca2e4fe9ae1929bbbe2302e7dd4049ae16c520cfe532f9d50e

Download Submit
C:\Windows\System\vwIMwuw.exe

Filesize
1.5MB

MD5
b1b39793adca6ced0a6562c51727e07c

SHA1
a8ecc87e93c30962d60479da52378e112d45b807

SHA256
0f2c9606d18305105f8177ba30c7847f112bb956544de7ae421fa0f74bbd503d

SHA512
63cd0dfe7b10f9f930ca853156a973873bf74f5d09c94f0615bb184891e01dadc5dac27852ae60c0563b3ed457baeb8b59200eac740c89167ee04ed28b0cd637

Download Submit
C:\Windows\System\wTRdjEE.exe

Filesize
1.5MB

MD5
c1910808249119cf84b47ff60436e20e

SHA1
5dadf3a71f6b21f42dfa814742d37a67b9f7bed0

SHA256
2aff5c441684c25099cc608125534d83dac76ab6b048dc792c3dc98e7697c4e7

SHA512
870cdf48c643768c2dd14403f7f13138c5383e49c8d51d1854d607d0c0ef02b439522b5a45699797945b06317e4b652003df717ae91308dcbef475ea0d13b399

Download Submit
C:\Windows\System\ysuovwY.exe

Filesize
1.5MB

MD5
14bded1a3cf8ecf99d2a621cd72470a2

SHA1
5a116197bde407be9055c49ae64800237655e6dc

SHA256
8a64f5a7746deee21646d3728d7d273ab2253742fb9f56b72080598c9b9e2ef8

SHA512
3a2cf731b3b3e71ae1f3622e2d71c2b09e271206c12a10ceb610904370c14126921b023095d90ea2b9c6046ce921d5b4ed2b9dae54dff29905dfd12c624f711a

Download Submit
memory/1664-0-0x00000126350E0000-0x00000126350F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads