xmrig | 0527496404d31bf8fb934743b52b4f27d17ef299ab28f0942dbcc045eabb0484

Analysis

max time kernel
90s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 05:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f13711d6edccb74788a35e6cfe223f00N.exe
Size

1.5MB
MD5

f13711d6edccb74788a35e6cfe223f00
SHA1

671e555e2047787ef8eae061e431817a9c8ba7db
SHA256

0527496404d31bf8fb934743b52b4f27d17ef299ab28f0942dbcc045eabb0484
SHA512

e94ccb736bcd9fdb6e2614696e6dbfebe96497f956134d3e11ab66e1538e4177164a536aeffbc95e4a9f4d2665fb471bc0366c1f9d84c622301bc26b9be96b77
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbfk:GemTLkNdfE0pZyB

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023468-4.dat	xmrig
behavioral2/files/0x000800000002346b-9.dat	xmrig
behavioral2/files/0x000700000002346f-8.dat	xmrig
behavioral2/files/0x0007000000023471-24.dat	xmrig
behavioral2/files/0x0007000000023470-22.dat	xmrig
behavioral2/files/0x0007000000023472-29.dat	xmrig
behavioral2/files/0x0007000000023473-33.dat	xmrig
behavioral2/files/0x0007000000023474-39.dat	xmrig
behavioral2/files/0x0007000000023475-45.dat	xmrig
behavioral2/files/0x0007000000023476-49.dat	xmrig
behavioral2/files/0x0007000000023478-55.dat	xmrig
behavioral2/files/0x000800000002346c-59.dat	xmrig
behavioral2/files/0x0007000000023479-63.dat	xmrig
behavioral2/files/0x000700000002347a-70.dat	xmrig
behavioral2/files/0x000500000001db2b-74.dat	xmrig
behavioral2/files/0x000400000001db32-82.dat	xmrig
behavioral2/files/0x000500000001db2f-78.dat	xmrig
behavioral2/files/0x000200000001e69a-92.dat	xmrig
behavioral2/files/0x000600000001db34-95.dat	xmrig
behavioral2/files/0x000200000001e69c-99.dat	xmrig
behavioral2/files/0x0003000000022cc6-105.dat	xmrig
behavioral2/files/0x000700000002347b-112.dat	xmrig
behavioral2/files/0x000700000002347c-110.dat	xmrig
behavioral2/files/0x000700000002347d-122.dat	xmrig
behavioral2/files/0x000700000002347e-123.dat	xmrig
behavioral2/files/0x0007000000023480-132.dat	xmrig
behavioral2/files/0x000700000002347f-133.dat	xmrig
behavioral2/files/0x0007000000023482-144.dat	xmrig
behavioral2/files/0x0007000000023481-139.dat	xmrig
behavioral2/files/0x0007000000023484-151.dat	xmrig
behavioral2/files/0x0007000000023485-157.dat	xmrig
behavioral2/files/0x0007000000023486-160.dat	xmrig
behavioral2/files/0x0007000000023483-155.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2064	agGboFc.exe
2292	UAvyJuo.exe
4964	ayTexJo.exe
4904	spQioZQ.exe
3968	gVUEVwH.exe
3748	FWrOIMT.exe
4072	LIftMmo.exe
4224	BQquqUM.exe
2516	otYDCro.exe
2872	NReFOxF.exe
232	FIrUBTe.exe
1964	KbPolxa.exe
4532	dRaMrAR.exe
2912	ITrTDCh.exe
2568	ndHQhpW.exe
5056	yYJEIzn.exe
4520	VyRXXJw.exe
4472	GVYxjFl.exe
2424	QIwiYVI.exe
4380	PbumlYE.exe
4708	FPddkzz.exe
4988	BhvNgxZ.exe
216	mEFpAeO.exe
4748	UPeaHyI.exe
2156	osvBDQM.exe
1728	XtFoxuP.exe
2332	wpklNLW.exe
1072	ziJRfRM.exe
4596	LqNCjUC.exe
1120	xjdYTVl.exe
2548	gLvRjTQ.exe
3872	odEycKe.exe
4516	wMFNoaB.exe
3544	fdnBhEh.exe
1488	YsiwOgf.exe
4192	OFMSkfj.exe
2256	oqysykL.exe
4624	YhleiaH.exe
2648	kyuKwrW.exe
4232	BUCnKOS.exe
2700	ayuuDdF.exe
2504	ZiXtlCh.exe
4436	bwBmFBL.exe
2592	NJEInwP.exe
2500	dgjybaO.exe
3496	Kebfndg.exe
396	nfbXsBY.exe
2704	vnUfIGs.exe
5088	xVuJacN.exe
3132	vYJOLIo.exe
4104	MKWSQPQ.exe
3412	CwykOtt.exe
2248	FyyWjwX.exe
1764	EyRlZym.exe
3128	NuAjaqE.exe
4084	rGDgDNq.exe
4768	mbNaEmf.exe
4484	LEHlovj.exe
3480	qdHvROD.exe
4808	OKiUAao.exe
2304	zybnjgX.exe
2172	USBFJXn.exe
1036	zUCttVC.exe
3024	nKCdZqf.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qgJlsOK.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\LdEeTZh.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\NGGORIB.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\aOLvcsd.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\GJzbbbl.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\HEAKddL.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\VIfdRMa.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\IlKkKXs.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\sTYXLPX.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\MqyGplC.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\AhNqjAw.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\BmHZHnM.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\giwhuUf.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\BpaGuGE.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\ysBgtIF.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\NHLqxfn.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\SFnJQhS.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\mmpSzGq.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\MXueCnC.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\EsQgTnj.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\TTmryba.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\pcOCkrh.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\eoLtgJH.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\dqqEfNY.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\QFwwBXs.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\pFuuSzo.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\ajwjaXI.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\OWFJKEZ.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\ZCSvUeN.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\zBPbubS.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\ZjWlWYw.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\GuYXeqQ.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\GcFcUsl.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\Kebfndg.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\ynmyMxP.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\lrDaaiZ.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\EbXaWqa.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\wWfGbXs.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\KAEQuyj.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\mUKHLHf.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\fWJlBpp.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\GcDpulR.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\muznJuo.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\PfpxUmk.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\UbBRrrk.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\qQRjaSo.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\ZkNXKUx.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\jEPreyG.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\hoYNidY.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\CIiUiYv.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\UCZqYfj.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\FyJzIuB.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\SQGnwHM.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\DHLxYeN.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\PwVDsIl.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\aSXnBIv.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\UwjcPpR.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\DurpvLg.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\OTexPRO.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\HrpXfJO.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\uiHoYIw.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\vnUEriY.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\NTQQqvB.exe	f13711d6edccb74788a35e6cfe223f00N.exe
File created	C:\Windows\System\xvTBsoH.exe	f13711d6edccb74788a35e6cfe223f00N.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17260	dwm.exe
Token: SeChangeNotifyPrivilege	17260	dwm.exe
Token: 33	17260	dwm.exe
Token: SeIncBasePriorityPrivilege	17260	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2064	1800	f13711d6edccb74788a35e6cfe223f00N.exe	87
PID 1800 wrote to memory of 2064	1800	f13711d6edccb74788a35e6cfe223f00N.exe	87
PID 1800 wrote to memory of 2292	1800	f13711d6edccb74788a35e6cfe223f00N.exe	88
PID 1800 wrote to memory of 2292	1800	f13711d6edccb74788a35e6cfe223f00N.exe	88
PID 1800 wrote to memory of 4964	1800	f13711d6edccb74788a35e6cfe223f00N.exe	89
PID 1800 wrote to memory of 4964	1800	f13711d6edccb74788a35e6cfe223f00N.exe	89
PID 1800 wrote to memory of 4904	1800	f13711d6edccb74788a35e6cfe223f00N.exe	90
PID 1800 wrote to memory of 4904	1800	f13711d6edccb74788a35e6cfe223f00N.exe	90
PID 1800 wrote to memory of 3968	1800	f13711d6edccb74788a35e6cfe223f00N.exe	91
PID 1800 wrote to memory of 3968	1800	f13711d6edccb74788a35e6cfe223f00N.exe	91
PID 1800 wrote to memory of 3748	1800	f13711d6edccb74788a35e6cfe223f00N.exe	92
PID 1800 wrote to memory of 3748	1800	f13711d6edccb74788a35e6cfe223f00N.exe	92
PID 1800 wrote to memory of 4072	1800	f13711d6edccb74788a35e6cfe223f00N.exe	93
PID 1800 wrote to memory of 4072	1800	f13711d6edccb74788a35e6cfe223f00N.exe	93
PID 1800 wrote to memory of 4224	1800	f13711d6edccb74788a35e6cfe223f00N.exe	94
PID 1800 wrote to memory of 4224	1800	f13711d6edccb74788a35e6cfe223f00N.exe	94
PID 1800 wrote to memory of 2516	1800	f13711d6edccb74788a35e6cfe223f00N.exe	95
PID 1800 wrote to memory of 2516	1800	f13711d6edccb74788a35e6cfe223f00N.exe	95
PID 1800 wrote to memory of 2872	1800	f13711d6edccb74788a35e6cfe223f00N.exe	97
PID 1800 wrote to memory of 2872	1800	f13711d6edccb74788a35e6cfe223f00N.exe	97
PID 1800 wrote to memory of 232	1800	f13711d6edccb74788a35e6cfe223f00N.exe	99
PID 1800 wrote to memory of 232	1800	f13711d6edccb74788a35e6cfe223f00N.exe	99
PID 1800 wrote to memory of 1964	1800	f13711d6edccb74788a35e6cfe223f00N.exe	100
PID 1800 wrote to memory of 1964	1800	f13711d6edccb74788a35e6cfe223f00N.exe	100
PID 1800 wrote to memory of 4532	1800	f13711d6edccb74788a35e6cfe223f00N.exe	101
PID 1800 wrote to memory of 4532	1800	f13711d6edccb74788a35e6cfe223f00N.exe	101
PID 1800 wrote to memory of 2912	1800	f13711d6edccb74788a35e6cfe223f00N.exe	102
PID 1800 wrote to memory of 2912	1800	f13711d6edccb74788a35e6cfe223f00N.exe	102
PID 1800 wrote to memory of 2568	1800	f13711d6edccb74788a35e6cfe223f00N.exe	103
PID 1800 wrote to memory of 2568	1800	f13711d6edccb74788a35e6cfe223f00N.exe	103
PID 1800 wrote to memory of 5056	1800	f13711d6edccb74788a35e6cfe223f00N.exe	104
PID 1800 wrote to memory of 5056	1800	f13711d6edccb74788a35e6cfe223f00N.exe	104
PID 1800 wrote to memory of 4520	1800	f13711d6edccb74788a35e6cfe223f00N.exe	105
PID 1800 wrote to memory of 4520	1800	f13711d6edccb74788a35e6cfe223f00N.exe	105
PID 1800 wrote to memory of 2424	1800	f13711d6edccb74788a35e6cfe223f00N.exe	106
PID 1800 wrote to memory of 2424	1800	f13711d6edccb74788a35e6cfe223f00N.exe	106
PID 1800 wrote to memory of 4472	1800	f13711d6edccb74788a35e6cfe223f00N.exe	107
PID 1800 wrote to memory of 4472	1800	f13711d6edccb74788a35e6cfe223f00N.exe	107
PID 1800 wrote to memory of 4380	1800	f13711d6edccb74788a35e6cfe223f00N.exe	108
PID 1800 wrote to memory of 4380	1800	f13711d6edccb74788a35e6cfe223f00N.exe	108
PID 1800 wrote to memory of 4708	1800	f13711d6edccb74788a35e6cfe223f00N.exe	109
PID 1800 wrote to memory of 4708	1800	f13711d6edccb74788a35e6cfe223f00N.exe	109
PID 1800 wrote to memory of 4988	1800	f13711d6edccb74788a35e6cfe223f00N.exe	110
PID 1800 wrote to memory of 4988	1800	f13711d6edccb74788a35e6cfe223f00N.exe	110
PID 1800 wrote to memory of 216	1800	f13711d6edccb74788a35e6cfe223f00N.exe	111
PID 1800 wrote to memory of 216	1800	f13711d6edccb74788a35e6cfe223f00N.exe	111
PID 1800 wrote to memory of 4748	1800	f13711d6edccb74788a35e6cfe223f00N.exe	112
PID 1800 wrote to memory of 4748	1800	f13711d6edccb74788a35e6cfe223f00N.exe	112
PID 1800 wrote to memory of 2156	1800	f13711d6edccb74788a35e6cfe223f00N.exe	113
PID 1800 wrote to memory of 2156	1800	f13711d6edccb74788a35e6cfe223f00N.exe	113
PID 1800 wrote to memory of 1728	1800	f13711d6edccb74788a35e6cfe223f00N.exe	114
PID 1800 wrote to memory of 1728	1800	f13711d6edccb74788a35e6cfe223f00N.exe	114
PID 1800 wrote to memory of 2332	1800	f13711d6edccb74788a35e6cfe223f00N.exe	115
PID 1800 wrote to memory of 2332	1800	f13711d6edccb74788a35e6cfe223f00N.exe	115
PID 1800 wrote to memory of 1072	1800	f13711d6edccb74788a35e6cfe223f00N.exe	116
PID 1800 wrote to memory of 1072	1800	f13711d6edccb74788a35e6cfe223f00N.exe	116
PID 1800 wrote to memory of 4596	1800	f13711d6edccb74788a35e6cfe223f00N.exe	117
PID 1800 wrote to memory of 4596	1800	f13711d6edccb74788a35e6cfe223f00N.exe	117
PID 1800 wrote to memory of 1120	1800	f13711d6edccb74788a35e6cfe223f00N.exe	118
PID 1800 wrote to memory of 1120	1800	f13711d6edccb74788a35e6cfe223f00N.exe	118
PID 1800 wrote to memory of 2548	1800	f13711d6edccb74788a35e6cfe223f00N.exe	119
PID 1800 wrote to memory of 2548	1800	f13711d6edccb74788a35e6cfe223f00N.exe	119
PID 1800 wrote to memory of 3872	1800	f13711d6edccb74788a35e6cfe223f00N.exe	120
PID 1800 wrote to memory of 3872	1800	f13711d6edccb74788a35e6cfe223f00N.exe	120

C:\Users\Admin\AppData\Local\Temp\f13711d6edccb74788a35e6cfe223f00N.exe
"C:\Users\Admin\AppData\Local\Temp\f13711d6edccb74788a35e6cfe223f00N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\System\agGboFc.exe
  C:\Windows\System\agGboFc.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\UAvyJuo.exe
  C:\Windows\System\UAvyJuo.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\ayTexJo.exe
  C:\Windows\System\ayTexJo.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\spQioZQ.exe
  C:\Windows\System\spQioZQ.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\gVUEVwH.exe
  C:\Windows\System\gVUEVwH.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\FWrOIMT.exe
  C:\Windows\System\FWrOIMT.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\LIftMmo.exe
  C:\Windows\System\LIftMmo.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\BQquqUM.exe
  C:\Windows\System\BQquqUM.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\otYDCro.exe
  C:\Windows\System\otYDCro.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\NReFOxF.exe
  C:\Windows\System\NReFOxF.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\FIrUBTe.exe
  C:\Windows\System\FIrUBTe.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\KbPolxa.exe
  C:\Windows\System\KbPolxa.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\dRaMrAR.exe
  C:\Windows\System\dRaMrAR.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\ITrTDCh.exe
  C:\Windows\System\ITrTDCh.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\ndHQhpW.exe
  C:\Windows\System\ndHQhpW.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\yYJEIzn.exe
  C:\Windows\System\yYJEIzn.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\VyRXXJw.exe
  C:\Windows\System\VyRXXJw.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\QIwiYVI.exe
  C:\Windows\System\QIwiYVI.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\GVYxjFl.exe
  C:\Windows\System\GVYxjFl.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\PbumlYE.exe
  C:\Windows\System\PbumlYE.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\FPddkzz.exe
  C:\Windows\System\FPddkzz.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\BhvNgxZ.exe
  C:\Windows\System\BhvNgxZ.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\mEFpAeO.exe
  C:\Windows\System\mEFpAeO.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\UPeaHyI.exe
  C:\Windows\System\UPeaHyI.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\osvBDQM.exe
  C:\Windows\System\osvBDQM.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\XtFoxuP.exe
  C:\Windows\System\XtFoxuP.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\wpklNLW.exe
  C:\Windows\System\wpklNLW.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\ziJRfRM.exe
  C:\Windows\System\ziJRfRM.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\LqNCjUC.exe
  C:\Windows\System\LqNCjUC.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\xjdYTVl.exe
  C:\Windows\System\xjdYTVl.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\gLvRjTQ.exe
  C:\Windows\System\gLvRjTQ.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\odEycKe.exe
  C:\Windows\System\odEycKe.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\wMFNoaB.exe
  C:\Windows\System\wMFNoaB.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\fdnBhEh.exe
  C:\Windows\System\fdnBhEh.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\YsiwOgf.exe
  C:\Windows\System\YsiwOgf.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\OFMSkfj.exe
  C:\Windows\System\OFMSkfj.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\oqysykL.exe
  C:\Windows\System\oqysykL.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\YhleiaH.exe
  C:\Windows\System\YhleiaH.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\kyuKwrW.exe
  C:\Windows\System\kyuKwrW.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\BUCnKOS.exe
  C:\Windows\System\BUCnKOS.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\ayuuDdF.exe
  C:\Windows\System\ayuuDdF.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\ZiXtlCh.exe
  C:\Windows\System\ZiXtlCh.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\bwBmFBL.exe
  C:\Windows\System\bwBmFBL.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\NJEInwP.exe
  C:\Windows\System\NJEInwP.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\dgjybaO.exe
  C:\Windows\System\dgjybaO.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\Kebfndg.exe
  C:\Windows\System\Kebfndg.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\nfbXsBY.exe
  C:\Windows\System\nfbXsBY.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\vnUfIGs.exe
  C:\Windows\System\vnUfIGs.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\xVuJacN.exe
  C:\Windows\System\xVuJacN.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\vYJOLIo.exe
  C:\Windows\System\vYJOLIo.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\MKWSQPQ.exe
  C:\Windows\System\MKWSQPQ.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\CwykOtt.exe
  C:\Windows\System\CwykOtt.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\FyyWjwX.exe
  C:\Windows\System\FyyWjwX.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\EyRlZym.exe
  C:\Windows\System\EyRlZym.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\NuAjaqE.exe
  C:\Windows\System\NuAjaqE.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\rGDgDNq.exe
  C:\Windows\System\rGDgDNq.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\mbNaEmf.exe
  C:\Windows\System\mbNaEmf.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\LEHlovj.exe
  C:\Windows\System\LEHlovj.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\qdHvROD.exe
  C:\Windows\System\qdHvROD.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\OKiUAao.exe
  C:\Windows\System\OKiUAao.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\zybnjgX.exe
  C:\Windows\System\zybnjgX.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\USBFJXn.exe
  C:\Windows\System\USBFJXn.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\zUCttVC.exe
  C:\Windows\System\zUCttVC.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\nKCdZqf.exe
  C:\Windows\System\nKCdZqf.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\IXqojgY.exe
  C:\Windows\System\IXqojgY.exe
  2⤵
  PID:1568
- C:\Windows\System\uQikhGx.exe
  C:\Windows\System\uQikhGx.exe
  2⤵
  PID:4960
- C:\Windows\System\FcgCrUJ.exe
  C:\Windows\System\FcgCrUJ.exe
  2⤵
  PID:3140
- C:\Windows\System\YUbRUmx.exe
  C:\Windows\System\YUbRUmx.exe
  2⤵
  PID:1512
- C:\Windows\System\qJpfmHB.exe
  C:\Windows\System\qJpfmHB.exe
  2⤵
  PID:4032
- C:\Windows\System\nbafCKi.exe
  C:\Windows\System\nbafCKi.exe
  2⤵
  PID:5112
- C:\Windows\System\HrpXfJO.exe
  C:\Windows\System\HrpXfJO.exe
  2⤵
  PID:4588
- C:\Windows\System\uMLaVCW.exe
  C:\Windows\System\uMLaVCW.exe
  2⤵
  PID:4620
- C:\Windows\System\cYoXgNa.exe
  C:\Windows\System\cYoXgNa.exe
  2⤵
  PID:1536
- C:\Windows\System\ZHQDZgW.exe
  C:\Windows\System\ZHQDZgW.exe
  2⤵
  PID:3608
- C:\Windows\System\bwgcgvi.exe
  C:\Windows\System\bwgcgvi.exe
  2⤵
  PID:456
- C:\Windows\System\CKvdDpv.exe
  C:\Windows\System\CKvdDpv.exe
  2⤵
  PID:4088
- C:\Windows\System\xvTBsoH.exe
  C:\Windows\System\xvTBsoH.exe
  2⤵
  PID:4696
- C:\Windows\System\UWuiTGe.exe
  C:\Windows\System\UWuiTGe.exe
  2⤵
  PID:4856
- C:\Windows\System\oSfzJha.exe
  C:\Windows\System\oSfzJha.exe
  2⤵
  PID:2724
- C:\Windows\System\FtMOqih.exe
  C:\Windows\System\FtMOqih.exe
  2⤵
  PID:2684
- C:\Windows\System\HqkXmnH.exe
  C:\Windows\System\HqkXmnH.exe
  2⤵
  PID:3512
- C:\Windows\System\CnrUUON.exe
  C:\Windows\System\CnrUUON.exe
  2⤵
  PID:2272
- C:\Windows\System\vrHRQLh.exe
  C:\Windows\System\vrHRQLh.exe
  2⤵
  PID:3124
- C:\Windows\System\NFSVVyu.exe
  C:\Windows\System\NFSVVyu.exe
  2⤵
  PID:4328
- C:\Windows\System\OdiMKqo.exe
  C:\Windows\System\OdiMKqo.exe
  2⤵
  PID:512
- C:\Windows\System\rmmxXaY.exe
  C:\Windows\System\rmmxXaY.exe
  2⤵
  PID:1228
- C:\Windows\System\zwjLIRB.exe
  C:\Windows\System\zwjLIRB.exe
  2⤵
  PID:1344
- C:\Windows\System\tWDuLGS.exe
  C:\Windows\System\tWDuLGS.exe
  2⤵
  PID:852
- C:\Windows\System\KtPBzef.exe
  C:\Windows\System\KtPBzef.exe
  2⤵
  PID:3256
- C:\Windows\System\JYLgdbq.exe
  C:\Windows\System\JYLgdbq.exe
  2⤵
  PID:400
- C:\Windows\System\wJSXSOL.exe
  C:\Windows\System\wJSXSOL.exe
  2⤵
  PID:3848
- C:\Windows\System\MqyGplC.exe
  C:\Windows\System\MqyGplC.exe
  2⤵
  PID:4880
- C:\Windows\System\guOlCxB.exe
  C:\Windows\System\guOlCxB.exe
  2⤵
  PID:4036
- C:\Windows\System\SYYSVFm.exe
  C:\Windows\System\SYYSVFm.exe
  2⤵
  PID:2812
- C:\Windows\System\ZwDPniG.exe
  C:\Windows\System\ZwDPniG.exe
  2⤵
  PID:2544
- C:\Windows\System\PPuXJhb.exe
  C:\Windows\System\PPuXJhb.exe
  2⤵
  PID:548
- C:\Windows\System\fWJlBpp.exe
  C:\Windows\System\fWJlBpp.exe
  2⤵
  PID:5144
- C:\Windows\System\jUMDoJE.exe
  C:\Windows\System\jUMDoJE.exe
  2⤵
  PID:5172
- C:\Windows\System\hBphggv.exe
  C:\Windows\System\hBphggv.exe
  2⤵
  PID:5200
- C:\Windows\System\oLcsEkS.exe
  C:\Windows\System\oLcsEkS.exe
  2⤵
  PID:5224
- C:\Windows\System\GcDpulR.exe
  C:\Windows\System\GcDpulR.exe
  2⤵
  PID:5256
- C:\Windows\System\QgFaCso.exe
  C:\Windows\System\QgFaCso.exe
  2⤵
  PID:5284
- C:\Windows\System\gqaNYvM.exe
  C:\Windows\System\gqaNYvM.exe
  2⤵
  PID:5312
- C:\Windows\System\lkNXhRu.exe
  C:\Windows\System\lkNXhRu.exe
  2⤵
  PID:5340
- C:\Windows\System\SKxnydi.exe
  C:\Windows\System\SKxnydi.exe
  2⤵
  PID:5368
- C:\Windows\System\CnYeObn.exe
  C:\Windows\System\CnYeObn.exe
  2⤵
  PID:5400
- C:\Windows\System\iGZwBlk.exe
  C:\Windows\System\iGZwBlk.exe
  2⤵
  PID:5428
- C:\Windows\System\RBfrReo.exe
  C:\Windows\System\RBfrReo.exe
  2⤵
  PID:5456
- C:\Windows\System\JZtwVmw.exe
  C:\Windows\System\JZtwVmw.exe
  2⤵
  PID:5480
- C:\Windows\System\meEEXrk.exe
  C:\Windows\System\meEEXrk.exe
  2⤵
  PID:5508
- C:\Windows\System\KSkSwdY.exe
  C:\Windows\System\KSkSwdY.exe
  2⤵
  PID:5528
- C:\Windows\System\UCjuszi.exe
  C:\Windows\System\UCjuszi.exe
  2⤵
  PID:5564
- C:\Windows\System\ZQxQICh.exe
  C:\Windows\System\ZQxQICh.exe
  2⤵
  PID:5596
- C:\Windows\System\fhWRXCz.exe
  C:\Windows\System\fhWRXCz.exe
  2⤵
  PID:5616
- C:\Windows\System\gAmFRVO.exe
  C:\Windows\System\gAmFRVO.exe
  2⤵
  PID:5644
- C:\Windows\System\pcOCkrh.exe
  C:\Windows\System\pcOCkrh.exe
  2⤵
  PID:5668
- C:\Windows\System\bCBvGKY.exe
  C:\Windows\System\bCBvGKY.exe
  2⤵
  PID:5696
- C:\Windows\System\kaQMqum.exe
  C:\Windows\System\kaQMqum.exe
  2⤵
  PID:5716
- C:\Windows\System\mmpSzGq.exe
  C:\Windows\System\mmpSzGq.exe
  2⤵
  PID:5740
- C:\Windows\System\PAFYXyC.exe
  C:\Windows\System\PAFYXyC.exe
  2⤵
  PID:5760
- C:\Windows\System\flPTofl.exe
  C:\Windows\System\flPTofl.exe
  2⤵
  PID:5796
- C:\Windows\System\VQpDaSu.exe
  C:\Windows\System\VQpDaSu.exe
  2⤵
  PID:5816
- C:\Windows\System\jfkHIXA.exe
  C:\Windows\System\jfkHIXA.exe
  2⤵
  PID:5864
- C:\Windows\System\PuVOPrF.exe
  C:\Windows\System\PuVOPrF.exe
  2⤵
  PID:5896
- C:\Windows\System\bipVCVg.exe
  C:\Windows\System\bipVCVg.exe
  2⤵
  PID:5920
- C:\Windows\System\hEHtnoT.exe
  C:\Windows\System\hEHtnoT.exe
  2⤵
  PID:5948
- C:\Windows\System\OnWylIa.exe
  C:\Windows\System\OnWylIa.exe
  2⤵
  PID:5976
- C:\Windows\System\uynYdbl.exe
  C:\Windows\System\uynYdbl.exe
  2⤵
  PID:6008
- C:\Windows\System\JYvkffG.exe
  C:\Windows\System\JYvkffG.exe
  2⤵
  PID:6032
- C:\Windows\System\JKYuQoz.exe
  C:\Windows\System\JKYuQoz.exe
  2⤵
  PID:6048
- C:\Windows\System\RkYnhoQ.exe
  C:\Windows\System\RkYnhoQ.exe
  2⤵
  PID:6068
- C:\Windows\System\bFiSnvx.exe
  C:\Windows\System\bFiSnvx.exe
  2⤵
  PID:6096
- C:\Windows\System\BoGeYLv.exe
  C:\Windows\System\BoGeYLv.exe
  2⤵
  PID:6132
- C:\Windows\System\pFuuSzo.exe
  C:\Windows\System\pFuuSzo.exe
  2⤵
  PID:5136
- C:\Windows\System\LPgsEiA.exe
  C:\Windows\System\LPgsEiA.exe
  2⤵
  PID:5196
- C:\Windows\System\NIzJImg.exe
  C:\Windows\System\NIzJImg.exe
  2⤵
  PID:5308
- C:\Windows\System\QZpaYzG.exe
  C:\Windows\System\QZpaYzG.exe
  2⤵
  PID:5360
- C:\Windows\System\DNQNIgN.exe
  C:\Windows\System\DNQNIgN.exe
  2⤵
  PID:5440
- C:\Windows\System\wYUomlL.exe
  C:\Windows\System\wYUomlL.exe
  2⤵
  PID:5500
- C:\Windows\System\WGJlJgL.exe
  C:\Windows\System\WGJlJgL.exe
  2⤵
  PID:5548
- C:\Windows\System\MAyPJhr.exe
  C:\Windows\System\MAyPJhr.exe
  2⤵
  PID:5608
- C:\Windows\System\IHZMwqB.exe
  C:\Windows\System\IHZMwqB.exe
  2⤵
  PID:5664
- C:\Windows\System\lMcwfMn.exe
  C:\Windows\System\lMcwfMn.exe
  2⤵
  PID:5704
- C:\Windows\System\HBujzhE.exe
  C:\Windows\System\HBujzhE.exe
  2⤵
  PID:5808
- C:\Windows\System\YrnhTVV.exe
  C:\Windows\System\YrnhTVV.exe
  2⤵
  PID:5884
- C:\Windows\System\GsFkkFq.exe
  C:\Windows\System\GsFkkFq.exe
  2⤵
  PID:5940
- C:\Windows\System\RZtwYqV.exe
  C:\Windows\System\RZtwYqV.exe
  2⤵
  PID:6028
- C:\Windows\System\TAGTVPo.exe
  C:\Windows\System\TAGTVPo.exe
  2⤵
  PID:6092
- C:\Windows\System\kilLvjV.exe
  C:\Windows\System\kilLvjV.exe
  2⤵
  PID:6140
- C:\Windows\System\ZoxLuqt.exe
  C:\Windows\System\ZoxLuqt.exe
  2⤵
  PID:5280
- C:\Windows\System\IRmbHCr.exe
  C:\Windows\System\IRmbHCr.exe
  2⤵
  PID:1668
- C:\Windows\System\dcyvXOV.exe
  C:\Windows\System\dcyvXOV.exe
  2⤵
  PID:5520
- C:\Windows\System\DPUiUos.exe
  C:\Windows\System\DPUiUos.exe
  2⤵
  PID:5680
- C:\Windows\System\MBBBCZp.exe
  C:\Windows\System\MBBBCZp.exe
  2⤵
  PID:5832
- C:\Windows\System\ekDheyR.exe
  C:\Windows\System\ekDheyR.exe
  2⤵
  PID:5960
- C:\Windows\System\FjPFlYn.exe
  C:\Windows\System\FjPFlYn.exe
  2⤵
  PID:5188
- C:\Windows\System\jmNAoTZ.exe
  C:\Windows\System\jmNAoTZ.exe
  2⤵
  PID:5492
- C:\Windows\System\ymnDXIG.exe
  C:\Windows\System\ymnDXIG.exe
  2⤵
  PID:5828
- C:\Windows\System\KWnvqzk.exe
  C:\Windows\System\KWnvqzk.exe
  2⤵
  PID:6112
- C:\Windows\System\AJXQbwR.exe
  C:\Windows\System\AJXQbwR.exe
  2⤵
  PID:5712
- C:\Windows\System\aBqQlvp.exe
  C:\Windows\System\aBqQlvp.exe
  2⤵
  PID:6148
- C:\Windows\System\BmHZHnM.exe
  C:\Windows\System\BmHZHnM.exe
  2⤵
  PID:6172
- C:\Windows\System\kZmVFQo.exe
  C:\Windows\System\kZmVFQo.exe
  2⤵
  PID:6204
- C:\Windows\System\NOzxRgb.exe
  C:\Windows\System\NOzxRgb.exe
  2⤵
  PID:6228
- C:\Windows\System\mZXSpsH.exe
  C:\Windows\System\mZXSpsH.exe
  2⤵
  PID:6256
- C:\Windows\System\EJJowdj.exe
  C:\Windows\System\EJJowdj.exe
  2⤵
  PID:6284
- C:\Windows\System\ImPrOaN.exe
  C:\Windows\System\ImPrOaN.exe
  2⤵
  PID:6320
- C:\Windows\System\ynmyMxP.exe
  C:\Windows\System\ynmyMxP.exe
  2⤵
  PID:6352
- C:\Windows\System\aLgnaJe.exe
  C:\Windows\System\aLgnaJe.exe
  2⤵
  PID:6372
- C:\Windows\System\kuYqziG.exe
  C:\Windows\System\kuYqziG.exe
  2⤵
  PID:6396
- C:\Windows\System\PDNWdRJ.exe
  C:\Windows\System\PDNWdRJ.exe
  2⤵
  PID:6436
- C:\Windows\System\dmXrgDb.exe
  C:\Windows\System\dmXrgDb.exe
  2⤵
  PID:6464
- C:\Windows\System\OJGKKYu.exe
  C:\Windows\System\OJGKKYu.exe
  2⤵
  PID:6492
- C:\Windows\System\JkxmVDC.exe
  C:\Windows\System\JkxmVDC.exe
  2⤵
  PID:6524
- C:\Windows\System\VDJDAXv.exe
  C:\Windows\System\VDJDAXv.exe
  2⤵
  PID:6544
- C:\Windows\System\CfslLBN.exe
  C:\Windows\System\CfslLBN.exe
  2⤵
  PID:6576
- C:\Windows\System\UbBRrrk.exe
  C:\Windows\System\UbBRrrk.exe
  2⤵
  PID:6596
- C:\Windows\System\xykYLuT.exe
  C:\Windows\System\xykYLuT.exe
  2⤵
  PID:6636
- C:\Windows\System\ldFtBFJ.exe
  C:\Windows\System\ldFtBFJ.exe
  2⤵
  PID:6656
- C:\Windows\System\lyrDoEg.exe
  C:\Windows\System\lyrDoEg.exe
  2⤵
  PID:6680
- C:\Windows\System\GwwMxpS.exe
  C:\Windows\System\GwwMxpS.exe
  2⤵
  PID:6708
- C:\Windows\System\DHLxYeN.exe
  C:\Windows\System\DHLxYeN.exe
  2⤵
  PID:6724
- C:\Windows\System\PYenCdw.exe
  C:\Windows\System\PYenCdw.exe
  2⤵
  PID:6756
- C:\Windows\System\NmSdCLr.exe
  C:\Windows\System\NmSdCLr.exe
  2⤵
  PID:6780
- C:\Windows\System\IbiSGOd.exe
  C:\Windows\System\IbiSGOd.exe
  2⤵
  PID:6808
- C:\Windows\System\mXOxFXe.exe
  C:\Windows\System\mXOxFXe.exe
  2⤵
  PID:6828
- C:\Windows\System\lUcEhOT.exe
  C:\Windows\System\lUcEhOT.exe
  2⤵
  PID:6872
- C:\Windows\System\PwVDsIl.exe
  C:\Windows\System\PwVDsIl.exe
  2⤵
  PID:6900
- C:\Windows\System\lpKAYoO.exe
  C:\Windows\System\lpKAYoO.exe
  2⤵
  PID:6948
- C:\Windows\System\hmNHqlf.exe
  C:\Windows\System\hmNHqlf.exe
  2⤵
  PID:6976
- C:\Windows\System\pcmZWJN.exe
  C:\Windows\System\pcmZWJN.exe
  2⤵
  PID:7004
- C:\Windows\System\UJjYQJv.exe
  C:\Windows\System\UJjYQJv.exe
  2⤵
  PID:7032
- C:\Windows\System\yiAtqZW.exe
  C:\Windows\System\yiAtqZW.exe
  2⤵
  PID:7060
- C:\Windows\System\BgQwPGF.exe
  C:\Windows\System\BgQwPGF.exe
  2⤵
  PID:7084
- C:\Windows\System\CEnDutn.exe
  C:\Windows\System\CEnDutn.exe
  2⤵
  PID:7104
- C:\Windows\System\qnblvSY.exe
  C:\Windows\System\qnblvSY.exe
  2⤵
  PID:7132
- C:\Windows\System\qHNpdwu.exe
  C:\Windows\System\qHNpdwu.exe
  2⤵
  PID:5908
- C:\Windows\System\GQjknMA.exe
  C:\Windows\System\GQjknMA.exe
  2⤵
  PID:6200
- C:\Windows\System\XsbunDT.exe
  C:\Windows\System\XsbunDT.exe
  2⤵
  PID:6276
- C:\Windows\System\ZyyxqXL.exe
  C:\Windows\System\ZyyxqXL.exe
  2⤵
  PID:6296
- C:\Windows\System\fKuShVZ.exe
  C:\Windows\System\fKuShVZ.exe
  2⤵
  PID:6380
- C:\Windows\System\qWroKJP.exe
  C:\Windows\System\qWroKJP.exe
  2⤵
  PID:6448
- C:\Windows\System\uiHoYIw.exe
  C:\Windows\System\uiHoYIw.exe
  2⤵
  PID:6520
- C:\Windows\System\lrDaaiZ.exe
  C:\Windows\System\lrDaaiZ.exe
  2⤵
  PID:6568
- C:\Windows\System\oUIBuLD.exe
  C:\Windows\System\oUIBuLD.exe
  2⤵
  PID:6644
- C:\Windows\System\zdJXvQL.exe
  C:\Windows\System\zdJXvQL.exe
  2⤵
  PID:6716
- C:\Windows\System\BjOwbOA.exe
  C:\Windows\System\BjOwbOA.exe
  2⤵
  PID:6800
- C:\Windows\System\FsjRsuH.exe
  C:\Windows\System\FsjRsuH.exe
  2⤵
  PID:6844
- C:\Windows\System\dVDJtKd.exe
  C:\Windows\System\dVDJtKd.exe
  2⤵
  PID:6912
- C:\Windows\System\XwdLAFo.exe
  C:\Windows\System\XwdLAFo.exe
  2⤵
  PID:7024
- C:\Windows\System\RWyMgPj.exe
  C:\Windows\System\RWyMgPj.exe
  2⤵
  PID:7056
- C:\Windows\System\UMQOMkI.exe
  C:\Windows\System\UMQOMkI.exe
  2⤵
  PID:7116
- C:\Windows\System\VyLGsUn.exe
  C:\Windows\System\VyLGsUn.exe
  2⤵
  PID:6212
- C:\Windows\System\KrFHsZt.exe
  C:\Windows\System\KrFHsZt.exe
  2⤵
  PID:6308
- C:\Windows\System\trZpnLQ.exe
  C:\Windows\System\trZpnLQ.exe
  2⤵
  PID:6412
- C:\Windows\System\hxwoWlY.exe
  C:\Windows\System\hxwoWlY.exe
  2⤵
  PID:6672
- C:\Windows\System\bSSuqlk.exe
  C:\Windows\System\bSSuqlk.exe
  2⤵
  PID:6792
- C:\Windows\System\FukJOwB.exe
  C:\Windows\System\FukJOwB.exe
  2⤵
  PID:6880
- C:\Windows\System\NaWXmTQ.exe
  C:\Windows\System\NaWXmTQ.exe
  2⤵
  PID:7160
- C:\Windows\System\lmNKneu.exe
  C:\Windows\System\lmNKneu.exe
  2⤵
  PID:6484
- C:\Windows\System\oFjfJrd.exe
  C:\Windows\System\oFjfJrd.exe
  2⤵
  PID:6676
- C:\Windows\System\ehvGUHV.exe
  C:\Windows\System\ehvGUHV.exe
  2⤵
  PID:7044
- C:\Windows\System\aFXhuMo.exe
  C:\Windows\System\aFXhuMo.exe
  2⤵
  PID:6940
- C:\Windows\System\eWiOHlk.exe
  C:\Windows\System\eWiOHlk.exe
  2⤵
  PID:7176
- C:\Windows\System\xenYWNX.exe
  C:\Windows\System\xenYWNX.exe
  2⤵
  PID:7204
- C:\Windows\System\FccEOeg.exe
  C:\Windows\System\FccEOeg.exe
  2⤵
  PID:7240
- C:\Windows\System\cBqBOaZ.exe
  C:\Windows\System\cBqBOaZ.exe
  2⤵
  PID:7260
- C:\Windows\System\WycbMbf.exe
  C:\Windows\System\WycbMbf.exe
  2⤵
  PID:7296
- C:\Windows\System\YhJwosa.exe
  C:\Windows\System\YhJwosa.exe
  2⤵
  PID:7320
- C:\Windows\System\TeuZwJp.exe
  C:\Windows\System\TeuZwJp.exe
  2⤵
  PID:7352
- C:\Windows\System\oQoCehI.exe
  C:\Windows\System\oQoCehI.exe
  2⤵
  PID:7380
- C:\Windows\System\qpGmWjx.exe
  C:\Windows\System\qpGmWjx.exe
  2⤵
  PID:7408
- C:\Windows\System\hOLgsfc.exe
  C:\Windows\System\hOLgsfc.exe
  2⤵
  PID:7436
- C:\Windows\System\xISyHBd.exe
  C:\Windows\System\xISyHBd.exe
  2⤵
  PID:7456
- C:\Windows\System\aXnFBHO.exe
  C:\Windows\System\aXnFBHO.exe
  2⤵
  PID:7488
- C:\Windows\System\QPjiqfx.exe
  C:\Windows\System\QPjiqfx.exe
  2⤵
  PID:7508
- C:\Windows\System\tpCUGGU.exe
  C:\Windows\System\tpCUGGU.exe
  2⤵
  PID:7548
- C:\Windows\System\YesvRsY.exe
  C:\Windows\System\YesvRsY.exe
  2⤵
  PID:7564
- C:\Windows\System\jQrJrhR.exe
  C:\Windows\System\jQrJrhR.exe
  2⤵
  PID:7580
- C:\Windows\System\OoIdywZ.exe
  C:\Windows\System\OoIdywZ.exe
  2⤵
  PID:7596
- C:\Windows\System\mQGwNMq.exe
  C:\Windows\System\mQGwNMq.exe
  2⤵
  PID:7612
- C:\Windows\System\FOGnvSL.exe
  C:\Windows\System\FOGnvSL.exe
  2⤵
  PID:7632
- C:\Windows\System\ryngBaN.exe
  C:\Windows\System\ryngBaN.exe
  2⤵
  PID:7648
- C:\Windows\System\QQRWRgt.exe
  C:\Windows\System\QQRWRgt.exe
  2⤵
  PID:7700
- C:\Windows\System\TypFUJU.exe
  C:\Windows\System\TypFUJU.exe
  2⤵
  PID:7760
- C:\Windows\System\WYHIddu.exe
  C:\Windows\System\WYHIddu.exe
  2⤵
  PID:7776
- C:\Windows\System\frUCrnr.exe
  C:\Windows\System\frUCrnr.exe
  2⤵
  PID:7812
- C:\Windows\System\JSCOhGA.exe
  C:\Windows\System\JSCOhGA.exe
  2⤵
  PID:7832
- C:\Windows\System\MHCjNoh.exe
  C:\Windows\System\MHCjNoh.exe
  2⤵
  PID:7856
- C:\Windows\System\vVpMOIu.exe
  C:\Windows\System\vVpMOIu.exe
  2⤵
  PID:7888
- C:\Windows\System\qkHkPSt.exe
  C:\Windows\System\qkHkPSt.exe
  2⤵
  PID:7916
- C:\Windows\System\PTxFjXH.exe
  C:\Windows\System\PTxFjXH.exe
  2⤵
  PID:7952
- C:\Windows\System\kQxLdEV.exe
  C:\Windows\System\kQxLdEV.exe
  2⤵
  PID:7984
- C:\Windows\System\FOznUxg.exe
  C:\Windows\System\FOznUxg.exe
  2⤵
  PID:8000
- C:\Windows\System\XOrmlVa.exe
  C:\Windows\System\XOrmlVa.exe
  2⤵
  PID:8016
- C:\Windows\System\LHWzORa.exe
  C:\Windows\System\LHWzORa.exe
  2⤵
  PID:8044
- C:\Windows\System\HltRtOq.exe
  C:\Windows\System\HltRtOq.exe
  2⤵
  PID:8072
- C:\Windows\System\PRbzCmL.exe
  C:\Windows\System\PRbzCmL.exe
  2⤵
  PID:8096
- C:\Windows\System\lrkseLb.exe
  C:\Windows\System\lrkseLb.exe
  2⤵
  PID:8128
- C:\Windows\System\JtzuIJF.exe
  C:\Windows\System\JtzuIJF.exe
  2⤵
  PID:8164
- C:\Windows\System\YMrdKDV.exe
  C:\Windows\System\YMrdKDV.exe
  2⤵
  PID:8180
- C:\Windows\System\EoAoxbn.exe
  C:\Windows\System\EoAoxbn.exe
  2⤵
  PID:7224
- C:\Windows\System\bGjLHby.exe
  C:\Windows\System\bGjLHby.exe
  2⤵
  PID:7304
- C:\Windows\System\zDrZIxv.exe
  C:\Windows\System\zDrZIxv.exe
  2⤵
  PID:7420
- C:\Windows\System\HhgNMBX.exe
  C:\Windows\System\HhgNMBX.exe
  2⤵
  PID:7444
- C:\Windows\System\UCZqYfj.exe
  C:\Windows\System\UCZqYfj.exe
  2⤵
  PID:7500
- C:\Windows\System\hEsURIS.exe
  C:\Windows\System\hEsURIS.exe
  2⤵
  PID:7588
- C:\Windows\System\tOtmowP.exe
  C:\Windows\System\tOtmowP.exe
  2⤵
  PID:7668
- C:\Windows\System\qQRjaSo.exe
  C:\Windows\System\qQRjaSo.exe
  2⤵
  PID:6748
- C:\Windows\System\ewOFkmY.exe
  C:\Windows\System\ewOFkmY.exe
  2⤵
  PID:7796
- C:\Windows\System\CfAWkDL.exe
  C:\Windows\System\CfAWkDL.exe
  2⤵
  PID:7852
- C:\Windows\System\OuKeIkz.exe
  C:\Windows\System\OuKeIkz.exe
  2⤵
  PID:7968
- C:\Windows\System\xgUHSZE.exe
  C:\Windows\System\xgUHSZE.exe
  2⤵
  PID:8036
- C:\Windows\System\BQLGYdf.exe
  C:\Windows\System\BQLGYdf.exe
  2⤵
  PID:8084
- C:\Windows\System\nVszcsI.exe
  C:\Windows\System\nVszcsI.exe
  2⤵
  PID:8152
- C:\Windows\System\BymMUTb.exe
  C:\Windows\System\BymMUTb.exe
  2⤵
  PID:7372
- C:\Windows\System\OhzdZDK.exe
  C:\Windows\System\OhzdZDK.exe
  2⤵
  PID:7312
- C:\Windows\System\nrFdPQs.exe
  C:\Windows\System\nrFdPQs.exe
  2⤵
  PID:7504
- C:\Windows\System\tHlOkfz.exe
  C:\Windows\System\tHlOkfz.exe
  2⤵
  PID:7712
- C:\Windows\System\sBdkZkU.exe
  C:\Windows\System\sBdkZkU.exe
  2⤵
  PID:7740
- C:\Windows\System\PqwdCVL.exe
  C:\Windows\System\PqwdCVL.exe
  2⤵
  PID:7904
- C:\Windows\System\YOjOesW.exe
  C:\Windows\System\YOjOesW.exe
  2⤵
  PID:8012
- C:\Windows\System\yogixaz.exe
  C:\Windows\System\yogixaz.exe
  2⤵
  PID:7280
- C:\Windows\System\BFMOLLY.exe
  C:\Windows\System\BFMOLLY.exe
  2⤵
  PID:7748
- C:\Windows\System\ODrKbDa.exe
  C:\Windows\System\ODrKbDa.exe
  2⤵
  PID:7876
- C:\Windows\System\iZsASsu.exe
  C:\Windows\System\iZsASsu.exe
  2⤵
  PID:7824
- C:\Windows\System\aRVZPcX.exe
  C:\Windows\System\aRVZPcX.exe
  2⤵
  PID:8008
- C:\Windows\System\uBUAsjr.exe
  C:\Windows\System\uBUAsjr.exe
  2⤵
  PID:8216
- C:\Windows\System\PnxHgCD.exe
  C:\Windows\System\PnxHgCD.exe
  2⤵
  PID:8248
- C:\Windows\System\GUNuxyJ.exe
  C:\Windows\System\GUNuxyJ.exe
  2⤵
  PID:8276
- C:\Windows\System\KYhWLBT.exe
  C:\Windows\System\KYhWLBT.exe
  2⤵
  PID:8312
- C:\Windows\System\nAlngld.exe
  C:\Windows\System\nAlngld.exe
  2⤵
  PID:8340
- C:\Windows\System\ncOJSVi.exe
  C:\Windows\System\ncOJSVi.exe
  2⤵
  PID:8368
- C:\Windows\System\SZwEykF.exe
  C:\Windows\System\SZwEykF.exe
  2⤵
  PID:8400
- C:\Windows\System\bbroXWK.exe
  C:\Windows\System\bbroXWK.exe
  2⤵
  PID:8420
- C:\Windows\System\GiUWnhn.exe
  C:\Windows\System\GiUWnhn.exe
  2⤵
  PID:8444
- C:\Windows\System\sVsgkVu.exe
  C:\Windows\System\sVsgkVu.exe
  2⤵
  PID:8472
- C:\Windows\System\jmnfGiZ.exe
  C:\Windows\System\jmnfGiZ.exe
  2⤵
  PID:8500
- C:\Windows\System\HmkLolh.exe
  C:\Windows\System\HmkLolh.exe
  2⤵
  PID:8532
- C:\Windows\System\LKAHUuu.exe
  C:\Windows\System\LKAHUuu.exe
  2⤵
  PID:8568
- C:\Windows\System\mIQSfiD.exe
  C:\Windows\System\mIQSfiD.exe
  2⤵
  PID:8584
- C:\Windows\System\DurpvLg.exe
  C:\Windows\System\DurpvLg.exe
  2⤵
  PID:8624
- C:\Windows\System\RLFueRl.exe
  C:\Windows\System\RLFueRl.exe
  2⤵
  PID:8648
- C:\Windows\System\nnvhwtF.exe
  C:\Windows\System\nnvhwtF.exe
  2⤵
  PID:8668
- C:\Windows\System\lurNkTS.exe
  C:\Windows\System\lurNkTS.exe
  2⤵
  PID:8696
- C:\Windows\System\feWzrbQ.exe
  C:\Windows\System\feWzrbQ.exe
  2⤵
  PID:8732
- C:\Windows\System\URLMcgp.exe
  C:\Windows\System\URLMcgp.exe
  2⤵
  PID:8756
- C:\Windows\System\KofywnV.exe
  C:\Windows\System\KofywnV.exe
  2⤵
  PID:8792
- C:\Windows\System\KzBuzuf.exe
  C:\Windows\System\KzBuzuf.exe
  2⤵
  PID:8820
- C:\Windows\System\dLMuTWS.exe
  C:\Windows\System\dLMuTWS.exe
  2⤵
  PID:8848
- C:\Windows\System\TvyompS.exe
  C:\Windows\System\TvyompS.exe
  2⤵
  PID:8876
- C:\Windows\System\qWcbkCz.exe
  C:\Windows\System\qWcbkCz.exe
  2⤵
  PID:8904
- C:\Windows\System\EbXaWqa.exe
  C:\Windows\System\EbXaWqa.exe
  2⤵
  PID:8932
- C:\Windows\System\HTmDYnL.exe
  C:\Windows\System\HTmDYnL.exe
  2⤵
  PID:8948
- C:\Windows\System\DPpUYjt.exe
  C:\Windows\System\DPpUYjt.exe
  2⤵
  PID:8988
- C:\Windows\System\DYitrmt.exe
  C:\Windows\System\DYitrmt.exe
  2⤵
  PID:9016
- C:\Windows\System\VBHmmxo.exe
  C:\Windows\System\VBHmmxo.exe
  2⤵
  PID:9044
- C:\Windows\System\lLuNeYJ.exe
  C:\Windows\System\lLuNeYJ.exe
  2⤵
  PID:9072
- C:\Windows\System\BRpGxVG.exe
  C:\Windows\System\BRpGxVG.exe
  2⤵
  PID:9088
- C:\Windows\System\cdbHhha.exe
  C:\Windows\System\cdbHhha.exe
  2⤵
  PID:9116
- C:\Windows\System\rRPirXn.exe
  C:\Windows\System\rRPirXn.exe
  2⤵
  PID:9144
- C:\Windows\System\nRxRIif.exe
  C:\Windows\System\nRxRIif.exe
  2⤵
  PID:9172
- C:\Windows\System\uqckHXD.exe
  C:\Windows\System\uqckHXD.exe
  2⤵
  PID:9200
- C:\Windows\System\YuxOMPZ.exe
  C:\Windows\System\YuxOMPZ.exe
  2⤵
  PID:7288
- C:\Windows\System\IlbYyuJ.exe
  C:\Windows\System\IlbYyuJ.exe
  2⤵
  PID:8228
- C:\Windows\System\EVOFaWZ.exe
  C:\Windows\System\EVOFaWZ.exe
  2⤵
  PID:8332
- C:\Windows\System\GZLGJiD.exe
  C:\Windows\System\GZLGJiD.exe
  2⤵
  PID:8388
- C:\Windows\System\foTBBMr.exe
  C:\Windows\System\foTBBMr.exe
  2⤵
  PID:8460
- C:\Windows\System\SpHtkwY.exe
  C:\Windows\System\SpHtkwY.exe
  2⤵
  PID:8548
- C:\Windows\System\eRBNteb.exe
  C:\Windows\System\eRBNteb.exe
  2⤵
  PID:8604
- C:\Windows\System\SdcVGuJ.exe
  C:\Windows\System\SdcVGuJ.exe
  2⤵
  PID:8664
- C:\Windows\System\PhUcHQW.exe
  C:\Windows\System\PhUcHQW.exe
  2⤵
  PID:8748
- C:\Windows\System\ZiFNnbV.exe
  C:\Windows\System\ZiFNnbV.exe
  2⤵
  PID:8776
- C:\Windows\System\QgPRavj.exe
  C:\Windows\System\QgPRavj.exe
  2⤵
  PID:8840
- C:\Windows\System\BcvWXvs.exe
  C:\Windows\System\BcvWXvs.exe
  2⤵
  PID:8900
- C:\Windows\System\gDogJTQ.exe
  C:\Windows\System\gDogJTQ.exe
  2⤵
  PID:8940
- C:\Windows\System\lVCLDEt.exe
  C:\Windows\System\lVCLDEt.exe
  2⤵
  PID:9012
- C:\Windows\System\yDFdbTf.exe
  C:\Windows\System\yDFdbTf.exe
  2⤵
  PID:9112
- C:\Windows\System\SQmDDzj.exe
  C:\Windows\System\SQmDDzj.exe
  2⤵
  PID:9196
- C:\Windows\System\pIcghGw.exe
  C:\Windows\System\pIcghGw.exe
  2⤵
  PID:9188
- C:\Windows\System\GQOtVbR.exe
  C:\Windows\System\GQOtVbR.exe
  2⤵
  PID:7348
- C:\Windows\System\wRLtYxZ.exe
  C:\Windows\System\wRLtYxZ.exe
  2⤵
  PID:8496
- C:\Windows\System\xjagjNo.exe
  C:\Windows\System\xjagjNo.exe
  2⤵
  PID:8728
- C:\Windows\System\AhNqjAw.exe
  C:\Windows\System\AhNqjAw.exe
  2⤵
  PID:8872
- C:\Windows\System\XvaFMUI.exe
  C:\Windows\System\XvaFMUI.exe
  2⤵
  PID:9068
- C:\Windows\System\YMHflSX.exe
  C:\Windows\System\YMHflSX.exe
  2⤵
  PID:9100
- C:\Windows\System\hUFIAln.exe
  C:\Windows\System\hUFIAln.exe
  2⤵
  PID:8268
- C:\Windows\System\xyEncMF.exe
  C:\Windows\System\xyEncMF.exe
  2⤵
  PID:8724
- C:\Windows\System\KoGRIxM.exe
  C:\Windows\System\KoGRIxM.exe
  2⤵
  PID:8980
- C:\Windows\System\ivlrJZi.exe
  C:\Windows\System\ivlrJZi.exe
  2⤵
  PID:8260
- C:\Windows\System\iHLUqjQ.exe
  C:\Windows\System\iHLUqjQ.exe
  2⤵
  PID:9232
- C:\Windows\System\kYQRkXL.exe
  C:\Windows\System\kYQRkXL.exe
  2⤵
  PID:9256
- C:\Windows\System\JOYftJe.exe
  C:\Windows\System\JOYftJe.exe
  2⤵
  PID:9284
- C:\Windows\System\EsQgTnj.exe
  C:\Windows\System\EsQgTnj.exe
  2⤵
  PID:9320
- C:\Windows\System\ltCXHFO.exe
  C:\Windows\System\ltCXHFO.exe
  2⤵
  PID:9364
- C:\Windows\System\jmDemvO.exe
  C:\Windows\System\jmDemvO.exe
  2⤵
  PID:9392
- C:\Windows\System\vSOiNzK.exe
  C:\Windows\System\vSOiNzK.exe
  2⤵
  PID:9420
- C:\Windows\System\hNKUJuE.exe
  C:\Windows\System\hNKUJuE.exe
  2⤵
  PID:9440
- C:\Windows\System\eahoNru.exe
  C:\Windows\System\eahoNru.exe
  2⤵
  PID:9464
- C:\Windows\System\BOWehdJ.exe
  C:\Windows\System\BOWehdJ.exe
  2⤵
  PID:9500
- C:\Windows\System\XWdRpSJ.exe
  C:\Windows\System\XWdRpSJ.exe
  2⤵
  PID:9516
- C:\Windows\System\KefkGLl.exe
  C:\Windows\System\KefkGLl.exe
  2⤵
  PID:9532
- C:\Windows\System\hEnWjps.exe
  C:\Windows\System\hEnWjps.exe
  2⤵
  PID:9552
- C:\Windows\System\NGGORIB.exe
  C:\Windows\System\NGGORIB.exe
  2⤵
  PID:9572
- C:\Windows\System\oSgMuDL.exe
  C:\Windows\System\oSgMuDL.exe
  2⤵
  PID:9592
- C:\Windows\System\FKeiSRi.exe
  C:\Windows\System\FKeiSRi.exe
  2⤵
  PID:9628
- C:\Windows\System\TPdlIFI.exe
  C:\Windows\System\TPdlIFI.exe
  2⤵
  PID:9700
- C:\Windows\System\SeoEWKe.exe
  C:\Windows\System\SeoEWKe.exe
  2⤵
  PID:9716
- C:\Windows\System\yJxARGZ.exe
  C:\Windows\System\yJxARGZ.exe
  2⤵
  PID:9744
- C:\Windows\System\CwUOKKq.exe
  C:\Windows\System\CwUOKKq.exe
  2⤵
  PID:9780
- C:\Windows\System\aMWgwUW.exe
  C:\Windows\System\aMWgwUW.exe
  2⤵
  PID:9812
- C:\Windows\System\UBqGAJU.exe
  C:\Windows\System\UBqGAJU.exe
  2⤵
  PID:9840
- C:\Windows\System\qHjAlwb.exe
  C:\Windows\System\qHjAlwb.exe
  2⤵
  PID:9868
- C:\Windows\System\UvVBaTp.exe
  C:\Windows\System\UvVBaTp.exe
  2⤵
  PID:9896
- C:\Windows\System\HMJbWlv.exe
  C:\Windows\System\HMJbWlv.exe
  2⤵
  PID:9916
- C:\Windows\System\NdBUmfR.exe
  C:\Windows\System\NdBUmfR.exe
  2⤵
  PID:9940
- C:\Windows\System\gtIodvX.exe
  C:\Windows\System\gtIodvX.exe
  2⤵
  PID:9964
- C:\Windows\System\IrStNXN.exe
  C:\Windows\System\IrStNXN.exe
  2⤵
  PID:10008
- C:\Windows\System\LBxFZBp.exe
  C:\Windows\System\LBxFZBp.exe
  2⤵
  PID:10032
- C:\Windows\System\CNQQNkY.exe
  C:\Windows\System\CNQQNkY.exe
  2⤵
  PID:10052
- C:\Windows\System\wWfGbXs.exe
  C:\Windows\System\wWfGbXs.exe
  2⤵
  PID:10080
- C:\Windows\System\cdeFzmc.exe
  C:\Windows\System\cdeFzmc.exe
  2⤵
  PID:10104
- C:\Windows\System\GJzbbbl.exe
  C:\Windows\System\GJzbbbl.exe
  2⤵
  PID:10136
- C:\Windows\System\GdLLiLy.exe
  C:\Windows\System\GdLLiLy.exe
  2⤵
  PID:10152
- C:\Windows\System\nuGWmiY.exe
  C:\Windows\System\nuGWmiY.exe
  2⤵
  PID:10192
- C:\Windows\System\pIxgqMr.exe
  C:\Windows\System\pIxgqMr.exe
  2⤵
  PID:10220
- C:\Windows\System\AvTxTTU.exe
  C:\Windows\System\AvTxTTU.exe
  2⤵
  PID:8832
- C:\Windows\System\OXDPAoP.exe
  C:\Windows\System\OXDPAoP.exe
  2⤵
  PID:9268
- C:\Windows\System\pNmsyTW.exe
  C:\Windows\System\pNmsyTW.exe
  2⤵
  PID:9276
- C:\Windows\System\RXhVwIF.exe
  C:\Windows\System\RXhVwIF.exe
  2⤵
  PID:9404
- C:\Windows\System\oKBXEVv.exe
  C:\Windows\System\oKBXEVv.exe
  2⤵
  PID:9448
- C:\Windows\System\oPlNqoQ.exe
  C:\Windows\System\oPlNqoQ.exe
  2⤵
  PID:9540
- C:\Windows\System\UieQODP.exe
  C:\Windows\System\UieQODP.exe
  2⤵
  PID:9624
- C:\Windows\System\vnUEriY.exe
  C:\Windows\System\vnUEriY.exe
  2⤵
  PID:9580
- C:\Windows\System\NVnWTsY.exe
  C:\Windows\System\NVnWTsY.exe
  2⤵
  PID:9740
- C:\Windows\System\WCccJcF.exe
  C:\Windows\System\WCccJcF.exe
  2⤵
  PID:9808
- C:\Windows\System\iTXnmMc.exe
  C:\Windows\System\iTXnmMc.exe
  2⤵
  PID:9824
- C:\Windows\System\ehFqCil.exe
  C:\Windows\System\ehFqCil.exe
  2⤵
  PID:9908
- C:\Windows\System\BCuATfR.exe
  C:\Windows\System\BCuATfR.exe
  2⤵
  PID:9992
- C:\Windows\System\QfgawvB.exe
  C:\Windows\System\QfgawvB.exe
  2⤵
  PID:10048
- C:\Windows\System\JGMRnLB.exe
  C:\Windows\System\JGMRnLB.exe
  2⤵
  PID:10120
- C:\Windows\System\nFlhuvT.exe
  C:\Windows\System\nFlhuvT.exe
  2⤵
  PID:10148
- C:\Windows\System\TTmryba.exe
  C:\Windows\System\TTmryba.exe
  2⤵
  PID:10208
- C:\Windows\System\RjLKoAw.exe
  C:\Windows\System\RjLKoAw.exe
  2⤵
  PID:9348
- C:\Windows\System\XxcQtMR.exe
  C:\Windows\System\XxcQtMR.exe
  2⤵
  PID:9476
- C:\Windows\System\oPAQupl.exe
  C:\Windows\System\oPAQupl.exe
  2⤵
  PID:9612
- C:\Windows\System\VxHlMox.exe
  C:\Windows\System\VxHlMox.exe
  2⤵
  PID:9712
- C:\Windows\System\WrLrdqO.exe
  C:\Windows\System\WrLrdqO.exe
  2⤵
  PID:9832
- C:\Windows\System\GVKDfKn.exe
  C:\Windows\System\GVKDfKn.exe
  2⤵
  PID:9976
- C:\Windows\System\aOLvcsd.exe
  C:\Windows\System\aOLvcsd.exe
  2⤵
  PID:10064
- C:\Windows\System\xQIjfOr.exe
  C:\Windows\System\xQIjfOr.exe
  2⤵
  PID:9272
- C:\Windows\System\YIvLqPc.exe
  C:\Windows\System\YIvLqPc.exe
  2⤵
  PID:8356
- C:\Windows\System\rYYUwMe.exe
  C:\Windows\System\rYYUwMe.exe
  2⤵
  PID:10076
- C:\Windows\System\BxPsvwA.exe
  C:\Windows\System\BxPsvwA.exe
  2⤵
  PID:9508
- C:\Windows\System\dqqEfNY.exe
  C:\Windows\System\dqqEfNY.exe
  2⤵
  PID:9376
- C:\Windows\System\XvMbMLj.exe
  C:\Windows\System\XvMbMLj.exe
  2⤵
  PID:10268
- C:\Windows\System\vaHyCgU.exe
  C:\Windows\System\vaHyCgU.exe
  2⤵
  PID:10312
- C:\Windows\System\FyJzIuB.exe
  C:\Windows\System\FyJzIuB.exe
  2⤵
  PID:10340
- C:\Windows\System\zKKgjaZ.exe
  C:\Windows\System\zKKgjaZ.exe
  2⤵
  PID:10368
- C:\Windows\System\nelqaDK.exe
  C:\Windows\System\nelqaDK.exe
  2⤵
  PID:10396
- C:\Windows\System\KAEQuyj.exe
  C:\Windows\System\KAEQuyj.exe
  2⤵
  PID:10424
- C:\Windows\System\LGFjSLd.exe
  C:\Windows\System\LGFjSLd.exe
  2⤵
  PID:10468
- C:\Windows\System\tTFShvJ.exe
  C:\Windows\System\tTFShvJ.exe
  2⤵
  PID:10492
- C:\Windows\System\lRhWKxp.exe
  C:\Windows\System\lRhWKxp.exe
  2⤵
  PID:10516
- C:\Windows\System\xLuBgqE.exe
  C:\Windows\System\xLuBgqE.exe
  2⤵
  PID:10544
- C:\Windows\System\YiJNAaS.exe
  C:\Windows\System\YiJNAaS.exe
  2⤵
  PID:10584
- C:\Windows\System\cCpoyev.exe
  C:\Windows\System\cCpoyev.exe
  2⤵
  PID:10604
- C:\Windows\System\kTYXfhH.exe
  C:\Windows\System\kTYXfhH.exe
  2⤵
  PID:10644
- C:\Windows\System\kvgvKND.exe
  C:\Windows\System\kvgvKND.exe
  2⤵
  PID:10680
- C:\Windows\System\DoeRCLz.exe
  C:\Windows\System\DoeRCLz.exe
  2⤵
  PID:10708
- C:\Windows\System\ETgefMa.exe
  C:\Windows\System\ETgefMa.exe
  2⤵
  PID:10748
- C:\Windows\System\aQIcwxg.exe
  C:\Windows\System\aQIcwxg.exe
  2⤵
  PID:10764
- C:\Windows\System\gNrSbXT.exe
  C:\Windows\System\gNrSbXT.exe
  2⤵
  PID:10804
- C:\Windows\System\KZqKsCB.exe
  C:\Windows\System\KZqKsCB.exe
  2⤵
  PID:10828
- C:\Windows\System\FtPkacn.exe
  C:\Windows\System\FtPkacn.exe
  2⤵
  PID:10856
- C:\Windows\System\GDtjeuV.exe
  C:\Windows\System\GDtjeuV.exe
  2⤵
  PID:10876
- C:\Windows\System\giwhuUf.exe
  C:\Windows\System\giwhuUf.exe
  2⤵
  PID:10904
- C:\Windows\System\SVTSPPe.exe
  C:\Windows\System\SVTSPPe.exe
  2⤵
  PID:10932
- C:\Windows\System\HShhPVy.exe
  C:\Windows\System\HShhPVy.exe
  2⤵
  PID:10960
- C:\Windows\System\KPQZABF.exe
  C:\Windows\System\KPQZABF.exe
  2⤵
  PID:10992
- C:\Windows\System\rcpnheG.exe
  C:\Windows\System\rcpnheG.exe
  2⤵
  PID:11020
- C:\Windows\System\avdgeEL.exe
  C:\Windows\System\avdgeEL.exe
  2⤵
  PID:11040
- C:\Windows\System\MGfadQG.exe
  C:\Windows\System\MGfadQG.exe
  2⤵
  PID:11060
- C:\Windows\System\hbeNwtn.exe
  C:\Windows\System\hbeNwtn.exe
  2⤵
  PID:11104
- C:\Windows\System\oCCVvXZ.exe
  C:\Windows\System\oCCVvXZ.exe
  2⤵
  PID:11132
- C:\Windows\System\HYGYdjm.exe
  C:\Windows\System\HYGYdjm.exe
  2⤵
  PID:11148
- C:\Windows\System\TGCHrNG.exe
  C:\Windows\System\TGCHrNG.exe
  2⤵
  PID:11188
- C:\Windows\System\eNGjAub.exe
  C:\Windows\System\eNGjAub.exe
  2⤵
  PID:11216
- C:\Windows\System\aoCEioT.exe
  C:\Windows\System\aoCEioT.exe
  2⤵
  PID:11244
- C:\Windows\System\sekunPj.exe
  C:\Windows\System\sekunPj.exe
  2⤵
  PID:9828
- C:\Windows\System\IPMqKVC.exe
  C:\Windows\System\IPMqKVC.exe
  2⤵
  PID:10324
- C:\Windows\System\wZhDzUE.exe
  C:\Windows\System\wZhDzUE.exe
  2⤵
  PID:10408
- C:\Windows\System\hIEreIn.exe
  C:\Windows\System\hIEreIn.exe
  2⤵
  PID:10484
- C:\Windows\System\FXAXXJg.exe
  C:\Windows\System\FXAXXJg.exe
  2⤵
  PID:10576
- C:\Windows\System\nTCGhyh.exe
  C:\Windows\System\nTCGhyh.exe
  2⤵
  PID:10460
- C:\Windows\System\rGWVjNe.exe
  C:\Windows\System\rGWVjNe.exe
  2⤵
  PID:10696
- C:\Windows\System\iwCxSgA.exe
  C:\Windows\System\iwCxSgA.exe
  2⤵
  PID:10760
- C:\Windows\System\lAmDvHx.exe
  C:\Windows\System\lAmDvHx.exe
  2⤵
  PID:10816
- C:\Windows\System\CMIiLso.exe
  C:\Windows\System\CMIiLso.exe
  2⤵
  PID:10892
- C:\Windows\System\XLtnETC.exe
  C:\Windows\System\XLtnETC.exe
  2⤵
  PID:10952
- C:\Windows\System\NofmNja.exe
  C:\Windows\System\NofmNja.exe
  2⤵
  PID:11004
- C:\Windows\System\gXvaThJ.exe
  C:\Windows\System\gXvaThJ.exe
  2⤵
  PID:11112
- C:\Windows\System\AOiwZZE.exe
  C:\Windows\System\AOiwZZE.exe
  2⤵
  PID:11144
- C:\Windows\System\pHAooon.exe
  C:\Windows\System\pHAooon.exe
  2⤵
  PID:11228
- C:\Windows\System\sVaKQgM.exe
  C:\Windows\System\sVaKQgM.exe
  2⤵
  PID:10336
- C:\Windows\System\DevVsfD.exe
  C:\Windows\System\DevVsfD.exe
  2⤵
  PID:11164
- C:\Windows\System\lQlXocG.exe
  C:\Windows\System\lQlXocG.exe
  2⤵
  PID:10360
- C:\Windows\System\xUjLJhD.exe
  C:\Windows\System\xUjLJhD.exe
  2⤵
  PID:10508
- C:\Windows\System\FKoMNmV.exe
  C:\Windows\System\FKoMNmV.exe
  2⤵
  PID:10732
- C:\Windows\System\YvfkqBU.exe
  C:\Windows\System\YvfkqBU.exe
  2⤵
  PID:11232
- C:\Windows\System\csdHfxo.exe
  C:\Windows\System\csdHfxo.exe
  2⤵
  PID:10724
- C:\Windows\System\thoUjcT.exe
  C:\Windows\System\thoUjcT.exe
  2⤵
  PID:10600
- C:\Windows\System\RFOwMMC.exe
  C:\Windows\System\RFOwMMC.exe
  2⤵
  PID:10436
- C:\Windows\System\loxIrUv.exe
  C:\Windows\System\loxIrUv.exe
  2⤵
  PID:10656
- C:\Windows\System\jLimRIg.exe
  C:\Windows\System\jLimRIg.exe
  2⤵
  PID:11032
- C:\Windows\System\zTMNHyC.exe
  C:\Windows\System\zTMNHyC.exe
  2⤵
  PID:11272
- C:\Windows\System\ysBgtIF.exe
  C:\Windows\System\ysBgtIF.exe
  2⤵
  PID:11296
- C:\Windows\System\vtOICrl.exe
  C:\Windows\System\vtOICrl.exe
  2⤵
  PID:11312
- C:\Windows\System\sxJPxzm.exe
  C:\Windows\System\sxJPxzm.exe
  2⤵
  PID:11336
- C:\Windows\System\LoNFXRY.exe
  C:\Windows\System\LoNFXRY.exe
  2⤵
  PID:11364
- C:\Windows\System\AjHvyOt.exe
  C:\Windows\System\AjHvyOt.exe
  2⤵
  PID:11384
- C:\Windows\System\qUiWOxs.exe
  C:\Windows\System\qUiWOxs.exe
  2⤵
  PID:11436
- C:\Windows\System\WWFNCMd.exe
  C:\Windows\System\WWFNCMd.exe
  2⤵
  PID:11456
- C:\Windows\System\nXIpvvU.exe
  C:\Windows\System\nXIpvvU.exe
  2⤵
  PID:11480
- C:\Windows\System\qQBSoih.exe
  C:\Windows\System\qQBSoih.exe
  2⤵
  PID:11520
- C:\Windows\System\NEVMYEm.exe
  C:\Windows\System\NEVMYEm.exe
  2⤵
  PID:11556
- C:\Windows\System\LmpSjCX.exe
  C:\Windows\System\LmpSjCX.exe
  2⤵
  PID:11580
- C:\Windows\System\DPkLWTg.exe
  C:\Windows\System\DPkLWTg.exe
  2⤵
  PID:11608
- C:\Windows\System\neAbkdN.exe
  C:\Windows\System\neAbkdN.exe
  2⤵
  PID:11624
- C:\Windows\System\HlGSrqw.exe
  C:\Windows\System\HlGSrqw.exe
  2⤵
  PID:11676
- C:\Windows\System\SLJjAkQ.exe
  C:\Windows\System\SLJjAkQ.exe
  2⤵
  PID:11708
- C:\Windows\System\NSaqTVj.exe
  C:\Windows\System\NSaqTVj.exe
  2⤵
  PID:11724
- C:\Windows\System\tnGBNEc.exe
  C:\Windows\System\tnGBNEc.exe
  2⤵
  PID:11768
- C:\Windows\System\NHLqxfn.exe
  C:\Windows\System\NHLqxfn.exe
  2⤵
  PID:11792
- C:\Windows\System\JxVhQCi.exe
  C:\Windows\System\JxVhQCi.exe
  2⤵
  PID:11808
- C:\Windows\System\shjRhBG.exe
  C:\Windows\System\shjRhBG.exe
  2⤵
  PID:11836
- C:\Windows\System\FeKJvMv.exe
  C:\Windows\System\FeKJvMv.exe
  2⤵
  PID:11860
- C:\Windows\System\VWOSuWM.exe
  C:\Windows\System\VWOSuWM.exe
  2⤵
  PID:11888
- C:\Windows\System\DWEcJxF.exe
  C:\Windows\System\DWEcJxF.exe
  2⤵
  PID:11948
- C:\Windows\System\YOlWaXV.exe
  C:\Windows\System\YOlWaXV.exe
  2⤵
  PID:11984
- C:\Windows\System\nlQDIUQ.exe
  C:\Windows\System\nlQDIUQ.exe
  2⤵
  PID:12032
- C:\Windows\System\MXueCnC.exe
  C:\Windows\System\MXueCnC.exe
  2⤵
  PID:12048
- C:\Windows\System\mmtpmzd.exe
  C:\Windows\System\mmtpmzd.exe
  2⤵
  PID:12076
- C:\Windows\System\QgSfhYh.exe
  C:\Windows\System\QgSfhYh.exe
  2⤵
  PID:12112
- C:\Windows\System\GUYFbFD.exe
  C:\Windows\System\GUYFbFD.exe
  2⤵
  PID:12164
- C:\Windows\System\zBPbubS.exe
  C:\Windows\System\zBPbubS.exe
  2⤵
  PID:12188
- C:\Windows\System\bboedVr.exe
  C:\Windows\System\bboedVr.exe
  2⤵
  PID:12232
- C:\Windows\System\UDtndFU.exe
  C:\Windows\System\UDtndFU.exe
  2⤵
  PID:11308
- C:\Windows\System\iJcALHu.exe
  C:\Windows\System\iJcALHu.exe
  2⤵
  PID:11348
- C:\Windows\System\dUrktUm.exe
  C:\Windows\System\dUrktUm.exe
  2⤵
  PID:11452
- C:\Windows\System\wwqhECa.exe
  C:\Windows\System\wwqhECa.exe
  2⤵
  PID:11532
- C:\Windows\System\XovrtWA.exe
  C:\Windows\System\XovrtWA.exe
  2⤵
  PID:11564
- C:\Windows\System\dUKshiN.exe
  C:\Windows\System\dUKshiN.exe
  2⤵
  PID:11660
- C:\Windows\System\JnOlUvo.exe
  C:\Windows\System\JnOlUvo.exe
  2⤵
  PID:11720
- C:\Windows\System\ajwjaXI.exe
  C:\Windows\System\ajwjaXI.exe
  2⤵
  PID:11800
- C:\Windows\System\FMQdrgk.exe
  C:\Windows\System\FMQdrgk.exe
  2⤵
  PID:11900
- C:\Windows\System\JqMfZDJ.exe
  C:\Windows\System\JqMfZDJ.exe
  2⤵
  PID:12020
- C:\Windows\System\EbkTYZG.exe
  C:\Windows\System\EbkTYZG.exe
  2⤵
  PID:12072
- C:\Windows\System\NSlXgvK.exe
  C:\Windows\System\NSlXgvK.exe
  2⤵
  PID:12156
- C:\Windows\System\sAWebIU.exe
  C:\Windows\System\sAWebIU.exe
  2⤵
  PID:12228
- C:\Windows\System\oIeMDVJ.exe
  C:\Windows\System\oIeMDVJ.exe
  2⤵
  PID:10944
- C:\Windows\System\RZaqcuH.exe
  C:\Windows\System\RZaqcuH.exe
  2⤵
  PID:12244
- C:\Windows\System\oGQzvQB.exe
  C:\Windows\System\oGQzvQB.exe
  2⤵
  PID:11444
- C:\Windows\System\tqKPABu.exe
  C:\Windows\System\tqKPABu.exe
  2⤵
  PID:11664
- C:\Windows\System\JEjIECp.exe
  C:\Windows\System\JEjIECp.exe
  2⤵
  PID:11968
- C:\Windows\System\ZjWlWYw.exe
  C:\Windows\System\ZjWlWYw.exe
  2⤵
  PID:12128
- C:\Windows\System\yaruEHR.exe
  C:\Windows\System\yaruEHR.exe
  2⤵
  PID:12264
- C:\Windows\System\IllqTSK.exe
  C:\Windows\System\IllqTSK.exe
  2⤵
  PID:11352
- C:\Windows\System\HBeMLwK.exe
  C:\Windows\System\HBeMLwK.exe
  2⤵
  PID:10660
- C:\Windows\System\cCxVGgd.exe
  C:\Windows\System\cCxVGgd.exe
  2⤵
  PID:11604
- C:\Windows\System\JIbjHqq.exe
  C:\Windows\System\JIbjHqq.exe
  2⤵
  PID:12316
- C:\Windows\System\kaHxMpg.exe
  C:\Windows\System\kaHxMpg.exe
  2⤵
  PID:12344
- C:\Windows\System\FeTYUhi.exe
  C:\Windows\System\FeTYUhi.exe
  2⤵
  PID:12380
- C:\Windows\System\ooGvfMF.exe
  C:\Windows\System\ooGvfMF.exe
  2⤵
  PID:12400
- C:\Windows\System\rwoMHFZ.exe
  C:\Windows\System\rwoMHFZ.exe
  2⤵
  PID:12428
- C:\Windows\System\WhfVIMS.exe
  C:\Windows\System\WhfVIMS.exe
  2⤵
  PID:12448
- C:\Windows\System\IWnmHAr.exe
  C:\Windows\System\IWnmHAr.exe
  2⤵
  PID:12476
- C:\Windows\System\vEGBFJq.exe
  C:\Windows\System\vEGBFJq.exe
  2⤵
  PID:12504
- C:\Windows\System\bpmgfvC.exe
  C:\Windows\System\bpmgfvC.exe
  2⤵
  PID:12528
- C:\Windows\System\FfppZfy.exe
  C:\Windows\System\FfppZfy.exe
  2⤵
  PID:12552
- C:\Windows\System\jygDcRc.exe
  C:\Windows\System\jygDcRc.exe
  2⤵
  PID:12612
- C:\Windows\System\RqNdytp.exe
  C:\Windows\System\RqNdytp.exe
  2⤵
  PID:12640
- C:\Windows\System\jaVcCLU.exe
  C:\Windows\System\jaVcCLU.exe
  2⤵
  PID:12656
- C:\Windows\System\mYGIijK.exe
  C:\Windows\System\mYGIijK.exe
  2⤵
  PID:12672
- C:\Windows\System\dJfSzfQ.exe
  C:\Windows\System\dJfSzfQ.exe
  2⤵
  PID:12716
- C:\Windows\System\CxJVrio.exe
  C:\Windows\System\CxJVrio.exe
  2⤵
  PID:12736
- C:\Windows\System\eheyVrS.exe
  C:\Windows\System\eheyVrS.exe
  2⤵
  PID:12768
- C:\Windows\System\GdHSSyx.exe
  C:\Windows\System\GdHSSyx.exe
  2⤵
  PID:12792
- C:\Windows\System\XMpzhAb.exe
  C:\Windows\System\XMpzhAb.exe
  2⤵
  PID:12828
- C:\Windows\System\fPJUsrE.exe
  C:\Windows\System\fPJUsrE.exe
  2⤵
  PID:12876
- C:\Windows\System\EVetzMz.exe
  C:\Windows\System\EVetzMz.exe
  2⤵
  PID:12892
- C:\Windows\System\SlFHWSJ.exe
  C:\Windows\System\SlFHWSJ.exe
  2⤵
  PID:12932
- C:\Windows\System\JyvwOLE.exe
  C:\Windows\System\JyvwOLE.exe
  2⤵
  PID:12960
- C:\Windows\System\zXlvRja.exe
  C:\Windows\System\zXlvRja.exe
  2⤵
  PID:13000
- C:\Windows\System\EuZymHA.exe
  C:\Windows\System\EuZymHA.exe
  2⤵
  PID:13024
- C:\Windows\System\HBSQEVC.exe
  C:\Windows\System\HBSQEVC.exe
  2⤵
  PID:13040
- C:\Windows\System\wOqQQti.exe
  C:\Windows\System\wOqQQti.exe
  2⤵
  PID:13060
- C:\Windows\System\aPFtFXJ.exe
  C:\Windows\System\aPFtFXJ.exe
  2⤵
  PID:13096
- C:\Windows\System\hZKfKPJ.exe
  C:\Windows\System\hZKfKPJ.exe
  2⤵
  PID:13116
- C:\Windows\System\YRslqOt.exe
  C:\Windows\System\YRslqOt.exe
  2⤵
  PID:13132
- C:\Windows\System\GMmbgAJ.exe
  C:\Windows\System\GMmbgAJ.exe
  2⤵
  PID:13152
- C:\Windows\System\VpESIAX.exe
  C:\Windows\System\VpESIAX.exe
  2⤵
  PID:13184
- C:\Windows\System\FmSAjsQ.exe
  C:\Windows\System\FmSAjsQ.exe
  2⤵
  PID:13232
- C:\Windows\System\VauTLbw.exe
  C:\Windows\System\VauTLbw.exe
  2⤵
  PID:13268
- C:\Windows\System\cauBlel.exe
  C:\Windows\System\cauBlel.exe
  2⤵
  PID:13288
- C:\Windows\System\JiZMuNx.exe
  C:\Windows\System\JiZMuNx.exe
  2⤵
  PID:11848
- C:\Windows\System\IiCezpO.exe
  C:\Windows\System\IiCezpO.exe
  2⤵
  PID:12396
- C:\Windows\System\vwnQyIe.exe
  C:\Windows\System\vwnQyIe.exe
  2⤵
  PID:12464
- C:\Windows\System\UFjYqzw.exe
  C:\Windows\System\UFjYqzw.exe
  2⤵
  PID:12492
- C:\Windows\System\hnPWGal.exe
  C:\Windows\System\hnPWGal.exe
  2⤵
  PID:12576
- C:\Windows\System\fCQjVaF.exe
  C:\Windows\System\fCQjVaF.exe
  2⤵
  PID:12628
- C:\Windows\System\OXZUoYw.exe
  C:\Windows\System\OXZUoYw.exe
  2⤵
  PID:12692
- C:\Windows\System\BLMITVT.exe
  C:\Windows\System\BLMITVT.exe
  2⤵
  PID:12752
- C:\Windows\System\nVpDOTG.exe
  C:\Windows\System\nVpDOTG.exe
  2⤵
  PID:12812
- C:\Windows\System\MrGxLic.exe
  C:\Windows\System\MrGxLic.exe
  2⤵
  PID:12872
- C:\Windows\System\PtGziLi.exe
  C:\Windows\System\PtGziLi.exe
  2⤵
  PID:12920
- C:\Windows\System\YoTuBrZ.exe
  C:\Windows\System\YoTuBrZ.exe
  2⤵
  PID:13016
- C:\Windows\System\vESwRlu.exe
  C:\Windows\System\vESwRlu.exe
  2⤵
  PID:13104
- C:\Windows\System\xWCNkbP.exe
  C:\Windows\System\xWCNkbP.exe
  2⤵
  PID:13224
- C:\Windows\System\uhItxKu.exe
  C:\Windows\System\uhItxKu.exe
  2⤵
  PID:13284
- C:\Windows\System\QjvzAfw.exe
  C:\Windows\System\QjvzAfw.exe
  2⤵
  PID:11516
- C:\Windows\System\YJAJvAG.exe
  C:\Windows\System\YJAJvAG.exe
  2⤵
  PID:12420
- C:\Windows\System\iWsXgaV.exe
  C:\Windows\System\iWsXgaV.exe
  2⤵
  PID:12632
- C:\Windows\System\KpIirjn.exe
  C:\Windows\System\KpIirjn.exe
  2⤵
  PID:12808
- C:\Windows\System\JsfBWBg.exe
  C:\Windows\System\JsfBWBg.exe
  2⤵
  PID:12928
- C:\Windows\System\qgJlsOK.exe
  C:\Windows\System\qgJlsOK.exe
  2⤵
  PID:13128
- C:\Windows\System\IPPwnyO.exe
  C:\Windows\System\IPPwnyO.exe
  2⤵
  PID:13280
- C:\Windows\System\ambBaOQ.exe
  C:\Windows\System\ambBaOQ.exe
  2⤵
  PID:12548
- C:\Windows\System\bHhXfTx.exe
  C:\Windows\System\bHhXfTx.exe
  2⤵
  PID:12804
- C:\Windows\System\OTexPRO.exe
  C:\Windows\System\OTexPRO.exe
  2⤵
  PID:12524
- C:\Windows\System\ZkNXKUx.exe
  C:\Windows\System\ZkNXKUx.exe
  2⤵
  PID:13180
- C:\Windows\System\ZbikqqN.exe
  C:\Windows\System\ZbikqqN.exe
  2⤵
  PID:13316
- C:\Windows\System\RVetXgS.exe
  C:\Windows\System\RVetXgS.exe
  2⤵
  PID:13356
- C:\Windows\System\bNQhkDz.exe
  C:\Windows\System\bNQhkDz.exe
  2⤵
  PID:13376
- C:\Windows\System\bYzPMJf.exe
  C:\Windows\System\bYzPMJf.exe
  2⤵
  PID:13400
- C:\Windows\System\rkApUoE.exe
  C:\Windows\System\rkApUoE.exe
  2⤵
  PID:13420
- C:\Windows\System\vlwIetw.exe
  C:\Windows\System\vlwIetw.exe
  2⤵
  PID:13448
- C:\Windows\System\rqhsLKF.exe
  C:\Windows\System\rqhsLKF.exe
  2⤵
  PID:13484
- C:\Windows\System\ytTjwsO.exe
  C:\Windows\System\ytTjwsO.exe
  2⤵
  PID:13524
- C:\Windows\System\gdNLZJR.exe
  C:\Windows\System\gdNLZJR.exe
  2⤵
  PID:13540
- C:\Windows\System\KrMzPYe.exe
  C:\Windows\System\KrMzPYe.exe
  2⤵
  PID:13572
- C:\Windows\System\BTZLrrO.exe
  C:\Windows\System\BTZLrrO.exe
  2⤵
  PID:13604
- C:\Windows\System\gSGzkvI.exe
  C:\Windows\System\gSGzkvI.exe
  2⤵
  PID:13624
- C:\Windows\System\HMHWUwR.exe
  C:\Windows\System\HMHWUwR.exe
  2⤵
  PID:13648
- C:\Windows\System\JMBHwrM.exe
  C:\Windows\System\JMBHwrM.exe
  2⤵
  PID:13680
- C:\Windows\System\PfpxUmk.exe
  C:\Windows\System\PfpxUmk.exe
  2⤵
  PID:13708
- C:\Windows\System\JABPjHL.exe
  C:\Windows\System\JABPjHL.exe
  2⤵
  PID:13740
- C:\Windows\System\qQduZns.exe
  C:\Windows\System\qQduZns.exe
  2⤵
  PID:13768
- C:\Windows\System\lwYkaMt.exe
  C:\Windows\System\lwYkaMt.exe
  2⤵
  PID:13784
- C:\Windows\System\PduAnEE.exe
  C:\Windows\System\PduAnEE.exe
  2⤵
  PID:13824
- C:\Windows\System\EEBjAwL.exe
  C:\Windows\System\EEBjAwL.exe
  2⤵
  PID:13840
- C:\Windows\System\dsvhvod.exe
  C:\Windows\System\dsvhvod.exe
  2⤵
  PID:13876
- C:\Windows\System\PPPBJGa.exe
  C:\Windows\System\PPPBJGa.exe
  2⤵
  PID:13900
- C:\Windows\System\ELtJSii.exe
  C:\Windows\System\ELtJSii.exe
  2⤵
  PID:13916
- C:\Windows\System\SFnJQhS.exe
  C:\Windows\System\SFnJQhS.exe
  2⤵
  PID:13940
- C:\Windows\System\DtoIOiy.exe
  C:\Windows\System\DtoIOiy.exe
  2⤵
  PID:13972
- C:\Windows\System\KjjKqdn.exe
  C:\Windows\System\KjjKqdn.exe
  2⤵
  PID:14020
- C:\Windows\System\lMAQTJJ.exe
  C:\Windows\System\lMAQTJJ.exe
  2⤵
  PID:14060
- C:\Windows\System\NpmhjQu.exe
  C:\Windows\System\NpmhjQu.exe
  2⤵
  PID:14088
- C:\Windows\System\sxSvbTo.exe
  C:\Windows\System\sxSvbTo.exe
  2⤵
  PID:14116
- C:\Windows\System\BpaGuGE.exe
  C:\Windows\System\BpaGuGE.exe
  2⤵
  PID:14132
- C:\Windows\System\jEPreyG.exe
  C:\Windows\System\jEPreyG.exe
  2⤵
  PID:14160
- C:\Windows\System\ttvaKEa.exe
  C:\Windows\System\ttvaKEa.exe
  2⤵
  PID:14200
- C:\Windows\System\CoTdOgV.exe
  C:\Windows\System\CoTdOgV.exe
  2⤵
  PID:14228
- C:\Windows\System\mUKHLHf.exe
  C:\Windows\System\mUKHLHf.exe
  2⤵
  PID:14256
- C:\Windows\System\KEdWyoT.exe
  C:\Windows\System\KEdWyoT.exe
  2⤵
  PID:14272
- C:\Windows\System\ytgEIsj.exe
  C:\Windows\System\ytgEIsj.exe
  2⤵
  PID:14312
- C:\Windows\System\asvruRR.exe
  C:\Windows\System\asvruRR.exe
  2⤵
  PID:13244
- C:\Windows\System\ffHXhxv.exe
  C:\Windows\System\ffHXhxv.exe
  2⤵
  PID:13372
- C:\Windows\System\iPhnciW.exe
  C:\Windows\System\iPhnciW.exe
  2⤵
  PID:13408
- C:\Windows\System\bMTiqeZ.exe
  C:\Windows\System\bMTiqeZ.exe
  2⤵
  PID:13504
- C:\Windows\System\pMSyXyT.exe
  C:\Windows\System\pMSyXyT.exe
  2⤵
  PID:13536
- C:\Windows\System\qoySHJP.exe
  C:\Windows\System\qoySHJP.exe
  2⤵
  PID:13616
- C:\Windows\System\EQKSyad.exe
  C:\Windows\System\EQKSyad.exe
  2⤵
  PID:13696
- C:\Windows\System\tFLkwdg.exe
  C:\Windows\System\tFLkwdg.exe
  2⤵
  PID:13760
- C:\Windows\System\YZtnAbi.exe
  C:\Windows\System\YZtnAbi.exe
  2⤵
  PID:13796
- C:\Windows\System\bIjYGjy.exe
  C:\Windows\System\bIjYGjy.exe
  2⤵
  PID:13884
- C:\Windows\System\hwrMJqz.exe
  C:\Windows\System\hwrMJqz.exe
  2⤵
  PID:13860
- C:\Windows\System\YkbbHRV.exe
  C:\Windows\System\YkbbHRV.exe
  2⤵
  PID:13996
- C:\Windows\System\TfNsSmV.exe
  C:\Windows\System\TfNsSmV.exe
  2⤵
  PID:14056
- C:\Windows\System\GuYXeqQ.exe
  C:\Windows\System\GuYXeqQ.exe
  2⤵
  PID:14176
- C:\Windows\System\PfJjxTA.exe
  C:\Windows\System\PfJjxTA.exe
  2⤵
  PID:14196
- C:\Windows\System\ajbqTAq.exe
  C:\Windows\System\ajbqTAq.exe
  2⤵
  PID:14300
- C:\Windows\System\XnVrgQH.exe
  C:\Windows\System\XnVrgQH.exe
  2⤵
  PID:14332
- C:\Windows\System\QTkzeMn.exe
  C:\Windows\System\QTkzeMn.exe
  2⤵
  PID:13440
- C:\Windows\System\nAxarqV.exe
  C:\Windows\System\nAxarqV.exe
  2⤵
  PID:13584
- C:\Windows\System\nzkIWFM.exe
  C:\Windows\System\nzkIWFM.exe
  2⤵
  PID:13728
- C:\Windows\System\tVJvzsL.exe
  C:\Windows\System\tVJvzsL.exe
  2⤵
  PID:13924
- C:\Windows\System\OWFJKEZ.exe
  C:\Windows\System\OWFJKEZ.exe
  2⤵
  PID:14036
- C:\Windows\System\BXWQnCx.exe
  C:\Windows\System\BXWQnCx.exe
  2⤵
  PID:13352
- C:\Windows\System\hoYNidY.exe
  C:\Windows\System\hoYNidY.exe
  2⤵
  PID:12624
- C:\Windows\System\PHqyyuB.exe
  C:\Windows\System\PHqyyuB.exe
  2⤵
  PID:14044
- C:\Windows\System\WltyZdi.exe
  C:\Windows\System\WltyZdi.exe
  2⤵
  PID:13908
- C:\Windows\System\nxCXlxe.exe
  C:\Windows\System\nxCXlxe.exe
  2⤵
  PID:14356
- C:\Windows\System\LvDBpsI.exe
  C:\Windows\System\LvDBpsI.exe
  2⤵
  PID:14380
- C:\Windows\System\Xglbcat.exe
  C:\Windows\System\Xglbcat.exe
  2⤵
  PID:14408
- C:\Windows\System\QTOMxWQ.exe
  C:\Windows\System\QTOMxWQ.exe
  2⤵
  PID:14436
- C:\Windows\System\DTHNZqB.exe
  C:\Windows\System\DTHNZqB.exe
  2⤵
  PID:14472
- C:\Windows\System\SqhTWJR.exe
  C:\Windows\System\SqhTWJR.exe
  2⤵
  PID:14512
- C:\Windows\System\RUeYaCT.exe
  C:\Windows\System\RUeYaCT.exe
  2⤵
  PID:14536
- C:\Windows\System\frZAhCu.exe
  C:\Windows\System\frZAhCu.exe
  2⤵
  PID:14560
- C:\Windows\System\ydBzTzz.exe
  C:\Windows\System\ydBzTzz.exe
  2⤵
  PID:14588
- C:\Windows\System\MjTUwXs.exe
  C:\Windows\System\MjTUwXs.exe
  2⤵
  PID:14612
- C:\Windows\System\RsuFlnQ.exe
  C:\Windows\System\RsuFlnQ.exe
  2⤵
  PID:14652
- C:\Windows\System\IqqORqN.exe
  C:\Windows\System\IqqORqN.exe
  2⤵
  PID:14672
- C:\Windows\System\uaTIMSP.exe
  C:\Windows\System\uaTIMSP.exe
  2⤵
  PID:14696
- C:\Windows\System\aSXnBIv.exe
  C:\Windows\System\aSXnBIv.exe
  2⤵
  PID:14736
- C:\Windows\System\Zryrxsf.exe
  C:\Windows\System\Zryrxsf.exe
  2⤵
  PID:14752
- C:\Windows\System\hMlXTyl.exe
  C:\Windows\System\hMlXTyl.exe
  2⤵
  PID:14792
- C:\Windows\System\ZCSvUeN.exe
  C:\Windows\System\ZCSvUeN.exe
  2⤵
  PID:14808
- C:\Windows\System\jPysuRe.exe
  C:\Windows\System\jPysuRe.exe
  2⤵
  PID:14848
- C:\Windows\System\oiLUrAz.exe
  C:\Windows\System\oiLUrAz.exe
  2⤵
  PID:14864
- C:\Windows\System\JAqbyfa.exe
  C:\Windows\System\JAqbyfa.exe
  2⤵
  PID:14896
- C:\Windows\System\SQGnwHM.exe
  C:\Windows\System\SQGnwHM.exe
  2⤵
  PID:14920
- C:\Windows\System\AdQxipt.exe
  C:\Windows\System\AdQxipt.exe
  2⤵
  PID:14936
- C:\Windows\System\HEAKddL.exe
  C:\Windows\System\HEAKddL.exe
  2⤵
  PID:14968
- C:\Windows\System\wFADqqy.exe
  C:\Windows\System\wFADqqy.exe
  2⤵
  PID:14996
- C:\Windows\System\UwXUFkq.exe
  C:\Windows\System\UwXUFkq.exe
  2⤵
  PID:15024
- C:\Windows\System\HztYrub.exe
  C:\Windows\System\HztYrub.exe
  2⤵
  PID:15064
- C:\Windows\System\NBLACsc.exe
  C:\Windows\System\NBLACsc.exe
  2⤵
  PID:15080
- C:\Windows\System\uJTyzJr.exe
  C:\Windows\System\uJTyzJr.exe
  2⤵
  PID:15104
- C:\Windows\System\hsMVMhl.exe
  C:\Windows\System\hsMVMhl.exe
  2⤵
  PID:15156
- C:\Windows\System\nbTQIpo.exe
  C:\Windows\System\nbTQIpo.exe
  2⤵
  PID:15180
- C:\Windows\System\ILKNUFc.exe
  C:\Windows\System\ILKNUFc.exe
  2⤵
  PID:15216
- C:\Windows\System\TiYBsZn.exe
  C:\Windows\System\TiYBsZn.exe
  2⤵
  PID:15244
- C:\Windows\System\nepitIK.exe
  C:\Windows\System\nepitIK.exe
  2⤵
  PID:15272
- C:\Windows\System\laWsUvK.exe
  C:\Windows\System\laWsUvK.exe
  2⤵
  PID:15288
- C:\Windows\System\NnuCCXN.exe
  C:\Windows\System\NnuCCXN.exe
  2⤵
  PID:15304
- C:\Windows\System\eoLtgJH.exe
  C:\Windows\System\eoLtgJH.exe
  2⤵
  PID:15328
- C:\Windows\System\WWtGHMs.exe
  C:\Windows\System\WWtGHMs.exe
  2⤵
  PID:13872
- C:\Windows\System\EPgVxFL.exe
  C:\Windows\System\EPgVxFL.exe
  2⤵
  PID:14376
- C:\Windows\System\iqNRTXx.exe
  C:\Windows\System\iqNRTXx.exe
  2⤵
  PID:14448
- C:\Windows\System\zumNxpC.exe
  C:\Windows\System\zumNxpC.exe
  2⤵
  PID:14500
- C:\Windows\System\jsmZQfN.exe
  C:\Windows\System\jsmZQfN.exe
  2⤵
  PID:14608
- C:\Windows\System\VrKdWur.exe
  C:\Windows\System\VrKdWur.exe
  2⤵
  PID:14628
- C:\Windows\System\AeMzPgF.exe
  C:\Windows\System\AeMzPgF.exe
  2⤵
  PID:14724
- C:\Windows\System\wnqWulw.exe
  C:\Windows\System\wnqWulw.exe
  2⤵
  PID:14776
- C:\Windows\System\VIfdRMa.exe
  C:\Windows\System\VIfdRMa.exe
  2⤵
  PID:14856
- C:\Windows\System\kfkenUT.exe
  C:\Windows\System\kfkenUT.exe
  2⤵
  PID:14928
- C:\Windows\System\CIiUiYv.exe
  C:\Windows\System\CIiUiYv.exe
  2⤵
  PID:14984
- C:\Windows\System\JxMAJjt.exe
  C:\Windows\System\JxMAJjt.exe
  2⤵
  PID:15048
- C:\Windows\System\yfuLqsH.exe
  C:\Windows\System\yfuLqsH.exe
  2⤵
  PID:15144
- C:\Windows\System\QKADhnJ.exe
  C:\Windows\System\QKADhnJ.exe
  2⤵
  PID:15204
- C:\Windows\System\CTWkGRM.exe
  C:\Windows\System\CTWkGRM.exe
  2⤵
  PID:15240
- C:\Windows\System\spuJhBC.exe
  C:\Windows\System\spuJhBC.exe
  2⤵
  PID:14304
- C:\Windows\System\saiedOX.exe
  C:\Windows\System\saiedOX.exe
  2⤵
  PID:14368
- C:\Windows\System\hYjrxyG.exe
  C:\Windows\System\hYjrxyG.exe
  2⤵
  PID:14496
- C:\Windows\System\nBCDtUq.exe
  C:\Windows\System\nBCDtUq.exe
  2⤵
  PID:14712
- C:\Windows\System\GThHIKj.exe
  C:\Windows\System\GThHIKj.exe
  2⤵
  PID:14780
- C:\Windows\System\pMrwBXS.exe
  C:\Windows\System\pMrwBXS.exe
  2⤵
  PID:14992
- C:\Windows\System\QFwwBXs.exe
  C:\Windows\System\QFwwBXs.exe
  2⤵
  PID:15060
- C:\Windows\System\fVlwqCj.exe
  C:\Windows\System\fVlwqCj.exe
  2⤵
  PID:15264
- C:\Windows\System\zNTCQCd.exe
  C:\Windows\System\zNTCQCd.exe
  2⤵
  PID:14344
- C:\Windows\System\JRmoeUN.exe
  C:\Windows\System\JRmoeUN.exe
  2⤵
  PID:14748
- C:\Windows\System\oTEOZtS.exe
  C:\Windows\System\oTEOZtS.exe
  2⤵
  PID:14948
- C:\Windows\System\zZYRjht.exe
  C:\Windows\System\zZYRjht.exe
  2⤵
  PID:14824
- C:\Windows\System\giZNnYL.exe
  C:\Windows\System\giZNnYL.exe
  2⤵
  PID:15300
- C:\Windows\System\bMHcRBJ.exe
  C:\Windows\System\bMHcRBJ.exe
  2⤵
  PID:15376
- C:\Windows\System\krhGNzh.exe
  C:\Windows\System\krhGNzh.exe
  2⤵
  PID:15404
- C:\Windows\System\LsStOQl.exe
  C:\Windows\System\LsStOQl.exe
  2⤵
  PID:15432
- C:\Windows\System\VvflZUC.exe
  C:\Windows\System\VvflZUC.exe
  2⤵
  PID:15448
- C:\Windows\System\ZNgBqvc.exe
  C:\Windows\System\ZNgBqvc.exe
  2⤵
  PID:15492
- C:\Windows\System\jcnofGH.exe
  C:\Windows\System\jcnofGH.exe
  2⤵
  PID:15516
- C:\Windows\System\vZARpwc.exe
  C:\Windows\System\vZARpwc.exe
  2⤵
  PID:15556
- C:\Windows\System\UwjcPpR.exe
  C:\Windows\System\UwjcPpR.exe
  2⤵
  PID:15576
- C:\Windows\System\IlKkKXs.exe
  C:\Windows\System\IlKkKXs.exe
  2⤵
  PID:15608
- C:\Windows\System\RzDzBxO.exe
  C:\Windows\System\RzDzBxO.exe
  2⤵
  PID:15628
- C:\Windows\System\amhaxOd.exe
  C:\Windows\System\amhaxOd.exe
  2⤵
  PID:15656
- C:\Windows\System\OasvlAJ.exe
  C:\Windows\System\OasvlAJ.exe
  2⤵
  PID:15684
- C:\Windows\System\ArkJpGk.exe
  C:\Windows\System\ArkJpGk.exe
  2⤵
  PID:15724
- C:\Windows\System\LCQyWiv.exe
  C:\Windows\System\LCQyWiv.exe
  2⤵
  PID:15752
- C:\Windows\System\CeFxQfT.exe
  C:\Windows\System\CeFxQfT.exe
  2⤵
  PID:15780
- C:\Windows\System\vcUnOqC.exe
  C:\Windows\System\vcUnOqC.exe
  2⤵
  PID:15796
- C:\Windows\System\muznJuo.exe
  C:\Windows\System\muznJuo.exe
  2⤵
  PID:15812
- C:\Windows\System\sTYXLPX.exe
  C:\Windows\System\sTYXLPX.exe
  2⤵
  PID:15840
- C:\Windows\System\DcXPNOD.exe
  C:\Windows\System\DcXPNOD.exe
  2⤵
  PID:15868
- C:\Windows\System\JBQVUCF.exe
  C:\Windows\System\JBQVUCF.exe
  2⤵
  PID:15900
- C:\Windows\System\GmBKvTW.exe
  C:\Windows\System\GmBKvTW.exe
  2⤵
  PID:15936
- C:\Windows\System\ZhhOQAj.exe
  C:\Windows\System\ZhhOQAj.exe
  2⤵
  PID:15964
- C:\Windows\System\JCWlAlM.exe
  C:\Windows\System\JCWlAlM.exe
  2⤵
  PID:15992
- C:\Windows\System\OCnCqua.exe
  C:\Windows\System\OCnCqua.exe
  2⤵
  PID:16032
- C:\Windows\System\FrtKidF.exe
  C:\Windows\System\FrtKidF.exe
  2⤵
  PID:16048
- C:\Windows\System\HhEhztf.exe
  C:\Windows\System\HhEhztf.exe
  2⤵
  PID:16068
- C:\Windows\System\CQMZBiK.exe
  C:\Windows\System\CQMZBiK.exe
  2⤵
  PID:16096
- C:\Windows\System\vYDhCVz.exe
  C:\Windows\System\vYDhCVz.exe
  2⤵
  PID:16132
- C:\Windows\System\GAIbZlt.exe
  C:\Windows\System\GAIbZlt.exe
  2⤵
  PID:16164
- C:\Windows\System\PsOwlwb.exe
  C:\Windows\System\PsOwlwb.exe
  2⤵
  PID:16188
- C:\Windows\System\VaEBmKr.exe
  C:\Windows\System\VaEBmKr.exe
  2⤵
  PID:16204
- C:\Windows\System\vDEEaAy.exe
  C:\Windows\System\vDEEaAy.exe
  2⤵
  PID:16256
- C:\Windows\System\PelQmBU.exe
  C:\Windows\System\PelQmBU.exe
  2⤵
  PID:16284
- C:\Windows\System\UVZIDqV.exe
  C:\Windows\System\UVZIDqV.exe
  2⤵
  PID:16312
- C:\Windows\System\VITyuLe.exe
  C:\Windows\System\VITyuLe.exe
  2⤵
  PID:16340
- C:\Windows\System\iWsRzbp.exe
  C:\Windows\System\iWsRzbp.exe
  2⤵
  PID:16360
- C:\Windows\System\evAGzJW.exe
  C:\Windows\System\evAGzJW.exe
  2⤵
  PID:15164
- C:\Windows\System\sAalmrY.exe
  C:\Windows\System\sAalmrY.exe
  2⤵
  PID:15420
- C:\Windows\System\CSMYVoE.exe
  C:\Windows\System\CSMYVoE.exe
  2⤵
  PID:15392
- C:\Windows\System\Nxonxip.exe
  C:\Windows\System\Nxonxip.exe
  2⤵
  PID:15508
- C:\Windows\System\TLvZdrs.exe
  C:\Windows\System\TLvZdrs.exe
  2⤵
  PID:15624
- C:\Windows\System\urURYyM.exe
  C:\Windows\System\urURYyM.exe
  2⤵
  PID:15676
- C:\Windows\System\ocQdDAH.exe
  C:\Windows\System\ocQdDAH.exe
  2⤵
  PID:15744
- C:\Windows\System\hQjsGUc.exe
  C:\Windows\System\hQjsGUc.exe
  2⤵
  PID:15792
- C:\Windows\System\gPztwnX.exe
  C:\Windows\System\gPztwnX.exe
  2⤵
  PID:15856
- C:\Windows\System\mbfzWdv.exe
  C:\Windows\System\mbfzWdv.exe
  2⤵
  PID:15920
- C:\Windows\System\XwTgyFe.exe
  C:\Windows\System\XwTgyFe.exe
  2⤵
  PID:16016
- C:\Windows\System\GcFcUsl.exe
  C:\Windows\System\GcFcUsl.exe
  2⤵
  PID:16056
- C:\Windows\System\LgZoMMe.exe
  C:\Windows\System\LgZoMMe.exe
  2⤵
  PID:16116
- C:\Windows\System\DhahZxj.exe
  C:\Windows\System\DhahZxj.exe
  2⤵
  PID:16172
- C:\Windows\System\CuBFWSU.exe
  C:\Windows\System\CuBFWSU.exe
  2⤵
  PID:16272
- C:\Windows\System\hxRKuTy.exe
  C:\Windows\System\hxRKuTy.exe
  2⤵
  PID:16380
- C:\Windows\System\kgCWFDT.exe
  C:\Windows\System\kgCWFDT.exe
  2⤵
  PID:15372
- C:\Windows\System\JAxVjWn.exe
  C:\Windows\System\JAxVjWn.exe
  2⤵
  PID:15500
- C:\Windows\System\nVMFDYY.exe
  C:\Windows\System\nVMFDYY.exe
  2⤵
  PID:15668
- C:\Windows\System\RFLHyqD.exe
  C:\Windows\System\RFLHyqD.exe
  2⤵
  PID:15824
- C:\Windows\System\rVJJFoW.exe
  C:\Windows\System\rVJJFoW.exe
  2⤵
  PID:15980
- C:\Windows\System\VoJuDwE.exe
  C:\Windows\System\VoJuDwE.exe
  2⤵
  PID:16084
- C:\Windows\System\GTDJJxP.exe
  C:\Windows\System\GTDJJxP.exe
  2⤵
  PID:16376
- C:\Windows\System\fECiYLo.exe
  C:\Windows\System\fECiYLo.exe
  2⤵
  PID:15472
- C:\Windows\System\supTFTp.exe
  C:\Windows\System\supTFTp.exe
  2⤵
  PID:15952
- C:\Windows\System\kuuUrWV.exe
  C:\Windows\System\kuuUrWV.exe
  2⤵
  PID:16328
- C:\Windows\System\XFMNbsX.exe
  C:\Windows\System\XFMNbsX.exe
  2⤵
  PID:16028
- C:\Windows\System\qWeMAth.exe
  C:\Windows\System\qWeMAth.exe
  2⤵
  PID:16044
- C:\Windows\System\bcdKvzP.exe
  C:\Windows\System\bcdKvzP.exe
  2⤵
  PID:16420
- C:\Windows\System\JQIpfBJ.exe
  C:\Windows\System\JQIpfBJ.exe
  2⤵
  PID:16448
- C:\Windows\System\EzHsbPC.exe
  C:\Windows\System\EzHsbPC.exe
  2⤵
  PID:16476
- C:\Windows\System\zXhQupK.exe
  C:\Windows\System\zXhQupK.exe
  2⤵
  PID:16504
- C:\Windows\System\lpsBPtE.exe
  C:\Windows\System\lpsBPtE.exe
  2⤵
  PID:16532
- C:\Windows\System\eJzZvZe.exe
  C:\Windows\System\eJzZvZe.exe
  2⤵
  PID:16548
- C:\Windows\System\hcDfuUg.exe
  C:\Windows\System\hcDfuUg.exe
  2⤵
  PID:16576
- C:\Windows\System\yVBYwMl.exe
  C:\Windows\System\yVBYwMl.exe
  2⤵
  PID:16600
- C:\Windows\System\WPUbGWk.exe
  C:\Windows\System\WPUbGWk.exe
  2⤵
  PID:16628
- C:\Windows\System\zbstzRG.exe
  C:\Windows\System\zbstzRG.exe
  2⤵
  PID:16664
- C:\Windows\System\GjfYlya.exe
  C:\Windows\System\GjfYlya.exe
  2⤵
  PID:16700
- C:\Windows\System\XvDKOhh.exe
  C:\Windows\System\XvDKOhh.exe
  2⤵
  PID:16728
- C:\Windows\System\jkXTOLJ.exe
  C:\Windows\System\jkXTOLJ.exe
  2⤵
  PID:16756
- C:\Windows\System\pYLhGSf.exe
  C:\Windows\System\pYLhGSf.exe
  2⤵
  PID:16784
- C:\Windows\System\HnslRGe.exe
  C:\Windows\System\HnslRGe.exe
  2⤵
  PID:16800
- C:\Windows\System\mPOjEEU.exe
  C:\Windows\System\mPOjEEU.exe
  2⤵
  PID:16824
- C:\Windows\System\fUtRtUi.exe
  C:\Windows\System\fUtRtUi.exe
  2⤵
  PID:16868
- C:\Windows\System\ltHsacr.exe
  C:\Windows\System\ltHsacr.exe
  2⤵
  PID:16884
- C:\Windows\System\oBiZeRT.exe
  C:\Windows\System\oBiZeRT.exe
  2⤵
  PID:16924
- C:\Windows\System\tozIsba.exe
  C:\Windows\System\tozIsba.exe
  2⤵
  PID:16940
- C:\Windows\System\EUOpPQY.exe
  C:\Windows\System\EUOpPQY.exe
  2⤵
  PID:16968
- C:\Windows\System\oVcASge.exe
  C:\Windows\System\oVcASge.exe
  2⤵
  PID:16996
- C:\Windows\System\bIYnKJL.exe
  C:\Windows\System\bIYnKJL.exe
  2⤵
  PID:17036
- C:\Windows\System\OWpEZAP.exe
  C:\Windows\System\OWpEZAP.exe
  2⤵
  PID:17064
- C:\Windows\System\devysZe.exe
  C:\Windows\System\devysZe.exe
  2⤵
  PID:17080
- C:\Windows\System\wBfXFIe.exe
  C:\Windows\System\wBfXFIe.exe
  2⤵
  PID:17108
- C:\Windows\System\ManKDJx.exe
  C:\Windows\System\ManKDJx.exe
  2⤵
  PID:17148
- C:\Windows\System\TtFFnUV.exe
  C:\Windows\System\TtFFnUV.exe
  2⤵
  PID:17180
- C:\Windows\System\RKuFWbe.exe
  C:\Windows\System\RKuFWbe.exe
  2⤵
  PID:17208
- C:\Windows\System\oJcjJwS.exe
  C:\Windows\System\oJcjJwS.exe
  2⤵
  PID:17236
- C:\Windows\System\MeWjCyU.exe
  C:\Windows\System\MeWjCyU.exe
  2⤵
  PID:17264
- C:\Windows\System\hnXbHlX.exe
  C:\Windows\System\hnXbHlX.exe
  2⤵
  PID:17292
- C:\Windows\System\retTpBB.exe
  C:\Windows\System\retTpBB.exe
  2⤵
  PID:17320
- C:\Windows\System\PVgiIES.exe
  C:\Windows\System\PVgiIES.exe
  2⤵
  PID:17348
- C:\Windows\System\AZKvWYj.exe
  C:\Windows\System\AZKvWYj.exe
  2⤵
  PID:17376
- C:\Windows\System\Bhivzva.exe
  C:\Windows\System\Bhivzva.exe
  2⤵
  PID:17404
- C:\Windows\System\BPFmwgw.exe
  C:\Windows\System\BPFmwgw.exe
  2⤵
  PID:16432
- C:\Windows\System\VFwGzqN.exe
  C:\Windows\System\VFwGzqN.exe
  2⤵
  PID:16492
- C:\Windows\System\hjvCRkh.exe
  C:\Windows\System\hjvCRkh.exe
  2⤵
  PID:16528
- C:\Windows\System\MTtmxAF.exe
  C:\Windows\System\MTtmxAF.exe
  2⤵
  PID:16620
- C:\Windows\System\fzNsIOF.exe
  C:\Windows\System\fzNsIOF.exe
  2⤵
  PID:16656
- C:\Windows\System\XUkXjoI.exe
  C:\Windows\System\XUkXjoI.exe
  2⤵
  PID:16752
- C:\Windows\System\ztQjPkT.exe
  C:\Windows\System\ztQjPkT.exe
  2⤵
  PID:16820
- C:\Windows\System\WRZsYzr.exe
  C:\Windows\System\WRZsYzr.exe
  2⤵
  PID:16932
- C:\Windows\System\hhagLbB.exe
  C:\Windows\System\hhagLbB.exe
  2⤵
  PID:16992
- C:\Windows\System\ggCgMro.exe
  C:\Windows\System\ggCgMro.exe
  2⤵
  PID:17140
- C:\Windows\System\sxVhDZx.exe
  C:\Windows\System\sxVhDZx.exe
  2⤵
  PID:17196
- C:\Windows\System\QfLcueh.exe
  C:\Windows\System\QfLcueh.exe
  2⤵
  PID:17232

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BQquqUM.exe

Filesize
1.5MB

MD5
55230da65acec20bb927147b933a97c8

SHA1
ba5562836c524b5c071916ddd70bffd06f3ae91a

SHA256
96cff453529840b5850668fa6f4c366a4e47f04a00d7943204b97b06f2cf445b

SHA512
9491315007017926436e50e5433eb0df50f710f5a51dfa5be119f6a084a446f72e61519dcf87808ec7c8d4bc0fb62078d1c1a35bdbd88dc7e4373de876eef8af

Download Submit
C:\Windows\System\BhvNgxZ.exe

Filesize
1.5MB

MD5
91b0a55fd3687e3b903f2cef7c0cae2d

SHA1
bfac527769ad3439ad9653eafe10352419d1980e

SHA256
f6822c24c78f3c102279d1c722b738b82818a6380958f524a1eccd0185fdceaf

SHA512
2b2b61c05e5ee610726d1e03dbd7743639fe0924fb02cd879ed86b284599d3be380de59e624ff00d97e653bdf983a924c00ecb44812aa84400b5f8f2e5fe7493

Download Submit
C:\Windows\System\FIrUBTe.exe

Filesize
1.5MB

MD5
df31653637749e21bd6d42bdea45f683

SHA1
51922cde92b5840425e580249dcffbdbf4d2c5a4

SHA256
9f33fefe8bb5bf56600d33364abf64ae1aa8a8bd0e3b6f9b6bea3c108838ad64

SHA512
d2012a042b60ee8a726bcb3c44455942a58d8ede19094cd65e7d0cba6bfb139c03853f3dad05af563b648ee6b6cd5472ed8a696f504722f1c51102ccddd54468

Download Submit
C:\Windows\System\FPddkzz.exe

Filesize
1.5MB

MD5
91c3d99e8e65597606bbcbd01a92b211

SHA1
2ce1d3aec73387acddda28a978b28a79afffcf31

SHA256
eebdcae05307d5c623124bfd091af05980f58bc78e9bccdf45ddd1783cc48f5f

SHA512
6c66a89382727ce3bffb0c77727c949bfa32a344eb958a62848fcbf75892ce42ac33b391b07b6cfad60b4424cea26664de75109ff9878da85a0e7e15502e555a

Download Submit
C:\Windows\System\FWrOIMT.exe

Filesize
1.5MB

MD5
4384f86ce942747cf48437fe58bae0e2

SHA1
116cf71361199c81317d9761fb1db1c04c4008a7

SHA256
a6c942f40e65721b304e1e86a1b67c8b66628a0e99180faa1af3562d38f36867

SHA512
6f26642ebc09f09a9047dfe524ecb6ee3beffa0395650b38472da13976e4a6bf110a7500847ecb7994986d1865f1584642a48feac658564baea19f76c04ce6b6

Download Submit
C:\Windows\System\GVYxjFl.exe

Filesize
1.5MB

MD5
07ed795e3db6da2b580db1aa99d3fccf

SHA1
fd676cd3d988527f925f3ad8dd1a85bf4626184a

SHA256
f12f790c147ddc201c64c1440335766c65d02d872b5a7e5cad65d810db76b7f3

SHA512
222590b7b5b05333a649406bb440f5b02e7aeedc4fd330cf864dcd653e28f20266b3cb99b7f5427aa8a3f1cacb186062923600cc602a640bc3f2d0acbbbde6af

Download Submit
C:\Windows\System\ITrTDCh.exe

Filesize
1.5MB

MD5
4d3c7b4b8f6fe43c66d756298cbff5e3

SHA1
72317ddcfc5dc4e3f295f1fa952fbe45ab6ef5cb

SHA256
29b2041733d35405fdd2c6e4fe95af00af9262092f7d17b6df737adc3cffa4bf

SHA512
bd89e9afaab1029120c895925c759749fb9543ae476d95218422e602219e7bdd1b999f65c209e527b58a4956d9d9ddacd5df6b074c175c6101377bcde822c5f8

Download Submit
C:\Windows\System\KbPolxa.exe

Filesize
1.5MB

MD5
72a0fcfa53f4c0d471f35fcef475f326

SHA1
a93a4284ff5449f59cd9f4828af3cd49dd450251

SHA256
3035d5e4af8f93a8117762a702eaaeac42a0fbec9a8b926a21cb14cdabb06ede

SHA512
611db07c351c7b10b42f7a7a5c02d52715cf2dd3d22ce48ef3015d6d65c66d8fb6934dd3d616aca0295379ac8ebde2a14b0d4c3e44d66677de33b2ace2d5549e

Download Submit
C:\Windows\System\LIftMmo.exe

Filesize
1.5MB

MD5
ce692165bf9ad268194683701d290e9a

SHA1
838ed53818c8fb946327005f5b65567c138b8b3a

SHA256
8b73ba01f2eb2436dacb32bdfade854c9fb9d0e63152e9a88ac97c8cd4c4ce51

SHA512
05e6c2dfb8c7ef6d0e0c26de974ff0a318acfdc3c354bd9ef7e5ac4a30d32f7620af6d8801ac866e33e6042bfc862ebc7547de94a30af477aab406c720cdaf47

Download Submit
C:\Windows\System\LqNCjUC.exe

Filesize
1.5MB

MD5
101f9125ebf1b18fc8b4620a6b2c2f1a

SHA1
3a051daee6a3d0a6cfba304a3f9b77424b0aae52

SHA256
12ad215a1582e93e19c781945f2b738081c98c8d9b4fdbab01e701da7b669f20

SHA512
58839cf62fea6d225a16f1d20d750a41ef0bb82b69834974bb957e62c61ce6136128679cc0971b8f422b8786dd72e8fc9959a03b190915ffe130808a3b051fa7

Download Submit
C:\Windows\System\NReFOxF.exe

Filesize
1.5MB

MD5
0d6dac988b586cdc2c4d59b130d1a65b

SHA1
04618531487ccd65400d4687e9701bd01ba5faee

SHA256
f86779d6416c6f45ec82bbf1a337a9df5c0a347836ffe5fb1985f5c8d38653fd

SHA512
a419d430ecc84f162244215bbfe5f989469e6b5219522f4c146aa8f28af16fee440614cae8ab4a9d2ffcd82fdeda2081ee2a3aa38063147c57d4adafecda9acd

Download Submit
C:\Windows\System\PbumlYE.exe

Filesize
1.5MB

MD5
06e8d138a75164a609092e42d6491021

SHA1
9a9c3a85ee304e18c0decae1e47db1eec8a9e0b3

SHA256
4a8305f0a69789906669a6f42ef6a4b75f347133c7ac97a791cc3dfe4b23e612

SHA512
233d5b370ed1351d8b94988287858d9a015c68e0dc71bff353a78e997dd40acbfdeacd6b1c2002efde4d1f61c29e3fbb0ab0674f404d57bce4d121c37227ad74

Download Submit
C:\Windows\System\QIwiYVI.exe

Filesize
1.5MB

MD5
5b92d43c1ff7e76b71a87a8e969039cb

SHA1
e5834eb3c4816a27c4feb3b33ea99766ced48278

SHA256
5dcaa61766f7d4f0c4353d7b11b03fd44a7752cf3863c749bce32f9a461c215d

SHA512
7fbd03620ecf546d62ca01a1c6f2d0de4b63dd3783ab4a2fd4888d9468927d0c10d3d4164490b47a3aac1ce0851356196a8e01d5952be7b281c0a52504c28be0

Download Submit
C:\Windows\System\UAvyJuo.exe

Filesize
1.5MB

MD5
bf84410898812675b25d00d69f0e4aac

SHA1
ff28a7064ee86430b8addb5f347dedb83a93320f

SHA256
3e88cf01a1d2c9af73ab44111c98acff4780ab05626de010ab35cadabd4dc818

SHA512
edef96f4b4c8103f928f2c7add49f7559665bb3ba01f032567b9cf6a16cd72c0c58d76eeb40b80dcd5e8928a9fa77496e325ca99aee795d1231552df1ea97443

Download Submit
C:\Windows\System\UPeaHyI.exe

Filesize
1.5MB

MD5
846e5b04170355064302239238fc1044

SHA1
e1834c209e67a7ff9681f989a2d32b19ec37cde6

SHA256
caf3a780d3bcf0404d002206d37c896a4392e75d86613752cf5be078cbfbc75a

SHA512
874bf6caaa572c25f7b06f13a24a85d2a38400d52cd54d9bb459ab242648ca31aa5667e46b7f105aa584f8eb2175860015ea4656dc7c5dc4a5c5c8eeba1ad398

Download Submit
C:\Windows\System\VyRXXJw.exe

Filesize
1.5MB

MD5
1304de6c866475dfa8bb3f5c1ce23fd5

SHA1
50c935e8d4e7303cf41323f2430b6de321902cb4

SHA256
441d2c6bec644c6862bf5208fb25bede5066f116f574925363e30447913bd483

SHA512
1f5ff021a443f37976e9c97e8c32173a3e02a9bf9b21f839b5a11466a5a8dd4068fe18b202c224e2aac103b2660ee5ab2069053386a1c3d5b139796a2cb715a9

Download Submit
C:\Windows\System\XtFoxuP.exe

Filesize
1.5MB

MD5
f4dda642d66af533493b9929100e3928

SHA1
15cd41ae3c86cee6a85d3a8f572c5674ba53082f

SHA256
d89949a304c09d05e7e267d86733daa71d5bcd7f3ae422342ccb383b6b4f3209

SHA512
e3a3844f9505eea54a1db016ff049075d016f568eecfd9b41b3997df7b9459ee01aae51cfdedffb928630226f501d12f504727c59e288b64c7d6bf339b09e81d

Download Submit
C:\Windows\System\agGboFc.exe

Filesize
1.5MB

MD5
c555b0787c21361c9c064ad6c0a0e76d

SHA1
eff3c08160c4a0569c24b0c00ed2b99320638133

SHA256
374197f69466f6ea88a19a7ad71149f135a52727a1a66275b3a80ed1e1e39aa0

SHA512
10c58521edf7ec4ce81c80a03991f3bb3ea3a3dd6a518fd7ce76a428c5afb351379ea5eec92f06bd3975a62fa69de909acca4652666aa8ec9af58374aa64135e

Download Submit
C:\Windows\System\ayTexJo.exe

Filesize
1.5MB

MD5
0c62ada907fe8bf13362b51469398b2e

SHA1
0e0a021748797a110b2f525ccaf7307f6f9c2b8f

SHA256
296daeca921a62d5ac913f8d321b13946077c3a59b9fd4efb005acc8496cb11d

SHA512
cfce1f51fc5dcfa1484745155bb58b026d683ce366cdbfd531336d7a941f41f78183c3f5679ebd3f6d3e062ede8e42e1cdb8516cf9088a5d2682424050f4ebff

Download Submit
C:\Windows\System\dRaMrAR.exe

Filesize
1.5MB

MD5
24fef55e413d178f9d69d2aa6d7bcdec

SHA1
b4246822653dae376a0eac7b25ea7bee2f3cfa30

SHA256
57a145340241d89b6446502a1d23ff3151d02aa1ee38231990d1d2e0afed040f

SHA512
fb7012e0e413f4009e72dedcd436ecd34bbaae4c669a39c17c5732fdb7a442195b87731194d6d895f3d9f0072c6a902762753932eaa687328cc6e3134e45d508

Download Submit
C:\Windows\System\gLvRjTQ.exe

Filesize
1.5MB

MD5
d3046511ca9202e19e2b08a499015be7

SHA1
909dc32298af74b750d96422fc46308857dcba1f

SHA256
a72db6769e21f9a2d96881ca5a5337ae0ebc6476a0befc58c1e30a04a683c898

SHA512
923140a2ecf16f336fb318eefbea470f355328fcfa8b29303197136f703f7dbe9ec1f62cc5d426629c8c32b3c5cb030cad335ee5bf0c4ac74df28110c7b633e5

Download Submit
C:\Windows\System\gVUEVwH.exe

Filesize
1.5MB

MD5
1f881099cce4a5372d892cb5bba42c60

SHA1
38628432538f2a0c4add04513a6dda515877de76

SHA256
1d6246db88a7dea825da24be4f4acde3c1ce5f13052bc30473fa5a7e69c296c5

SHA512
53bd921bb9c3b07fdf6c3e670ccb39d57ec8521214998b0d55a751f0ae56465f1e39c4a463905993c46f39447753c525066cb85222708c8e0a6add227512ef30

Download Submit
C:\Windows\System\mEFpAeO.exe

Filesize
1.5MB

MD5
749819749d25367b1ae6e47826aeb0b5

SHA1
353a05ef84022869645959de58e8e7ef8c7fccf3

SHA256
3cea4d6e0e187505cac6c00ebff5dcc22b95d277e9e191beaecca867801fcf80

SHA512
5328dcbe9011ada3fa943aea3336566759e1fb9c366879e44a55e68b34e86b23a25b3f23ecc61aa3e4928d16d7de838b1a43ba14db079685c5d3331dfa43e137

Download Submit
C:\Windows\System\ndHQhpW.exe

Filesize
1.5MB

MD5
510788ff003144a616d9500763bf161e

SHA1
ae7497f92b7cb716ca54d5d2b5f8f4ea9310b0ab

SHA256
f1682333c8fdf62c21c51e2c04fc27cf9c6baf3d337766016cf06d6ac8a0a247

SHA512
5033eae801a5a4a2e41721d32b81864d03e4ae92473455c5855eb33ef8499bdfad9349fa81c1e3db66fcf7502d51026ac01824774969fe61a1a35c034b091530

Download Submit
C:\Windows\System\odEycKe.exe

Filesize
1.5MB

MD5
af3afb28e570be8840776085907dbc63

SHA1
4373301f3d342f1e9452f088023e1aabfe1330ee

SHA256
77d2efcc0832abe9ea07826a5d638157471a02057cf7d121240956b8615a2863

SHA512
f96edf37252922451648cc9fb748a5ea02ff676ea40b440768ede6680c382eda4211cedd0543c5063f81d0abb872417c4ca380cbc85112c32ad5dc302f9442f4

Download Submit
C:\Windows\System\osvBDQM.exe

Filesize
1.5MB

MD5
1a1a0d6ea826e89d40b384dc78e138dc

SHA1
617008cddcc251276d8ffd7fee21a7ad8a301301

SHA256
41cfeadc988ca130de322bf5d449f43cc5f986552f5c80a83091d99a307b59fe

SHA512
52832bf41f2c11ddedddc890dfe8283748588f70e6bd4b4f118e044bee50493a5c2543fca7c80acd151977bee47c41939a2a99250f292eb5ce362b89e05237ff

Download Submit
C:\Windows\System\otYDCro.exe

Filesize
1.5MB

MD5
ea84611de60578e761398fd500e853e5

SHA1
c72a53c5fec0f35b204057d3f91836b1b94a5063

SHA256
58711b7fd1e3fa5c11207e19c6e57755467efbe552101eea3de47fa0d5828bec

SHA512
a8d6c2e1ac52e1a1985e615f876a143dbe7772231357eff077a16975956a783c3c7f2ae7cc7c75aeba6ad707a1f513f09a4dbf0c521eb6b34cacb1cb791bd7af

Download Submit
C:\Windows\System\spQioZQ.exe

Filesize
1.5MB

MD5
929cbaf6fa033284fd7ea597f0cfa0b0

SHA1
042029dc88a7f157bc2b934dfe991c133ab1edf0

SHA256
80969722e4727990173e2606bbdeac954c24cd69022a4e1425a74c2d9e4d586e

SHA512
5ff5e96ab2556918d8feca73fa6ec028bf21a2f0af272464caa5e456a06ef9b73b1322ff3e69b6c1a87b07a310fef992718dfb52aaca0fe73dfcd3a6d05d5956

Download Submit
C:\Windows\System\wMFNoaB.exe

Filesize
1.5MB

MD5
30f7cb560abcf8f30519632c90484463

SHA1
78456e2cf2f7cd6a888c3df2790436a0e82959e5

SHA256
ccac6d43bd125720711e32130f7a9dc9fbd0bd67fdd2036cff7e3af6d1da4321

SHA512
d681a892de2840461310c939cece7b5dca6b8b93cd6bf9e57aeaea9498c92a3f30c365fc18722d20e29a19718654db8dd94efbbe6612e4d4ce727a6c5fae3b46

Download Submit
C:\Windows\System\wpklNLW.exe

Filesize
1.5MB

MD5
a9cdce6683370f8b84c8e9511ac288b1

SHA1
04a92a17d446396f80d3504fbce137893b23a897

SHA256
9eb617306aa15ef607291378e3fc7abca6c3775a9cd56f58df4a6f96cb72aa2e

SHA512
05544589b525246ffb6580ee56c64888a6f0c6f2150e26ea2753d6c7a8bf6cab898da7d499defd69893eb7c2e07abcb5113fe585bdba96fb2a9b8bf9595b30f5

Download Submit
C:\Windows\System\xjdYTVl.exe

Filesize
1.5MB

MD5
1cd092f1523f5153d8253aa996aa476c

SHA1
b9d4444db5eaa756f61c6abe3f306e40a5fb0b00

SHA256
80cab0b3f7f7ad6cb5d6a14f8d072b7db3ce2a104c982747a44d8423f351ee7e

SHA512
82d615375266dfe25f92042fde32dd012439a24d496c720667fb3780cf82245d3fbe7c0ac370ae23a9a0ee0c83cbd8c280eb54c4eb82a96bd312c129b85e6c2b

Download Submit
C:\Windows\System\yYJEIzn.exe

Filesize
1.5MB

MD5
c229869e3cc4464eae8bdc034b9be376

SHA1
423daa6e6e8e8c0074dd16917452489dd493db74

SHA256
3938987584f4cc2cacf7f3d3acf7b53cca2522f39566e7c4875a8d81e5c60a1a

SHA512
d85d34951e7c11a0a672ee6cc90148ba40ce7771c6887d52b95da1e35b7935821ce7a8c8a7e9c60168d4e08c673c3f1602e4824ed3978dd721bb88b227d5c1f5

Download Submit
C:\Windows\System\ziJRfRM.exe

Filesize
1.5MB

MD5
d2ebaa62ddf343f3a72015a83c424764

SHA1
6cd76ff0cbbf3fd4ee4e816910049ba4847a17a0

SHA256
cfc85f48c6bb0d2c0540e68bc2bb7d55e349701bce0f8c00d218e55572d2d2ed

SHA512
b100d1ec85059fe75a53f6da965fe55321c73b34ea88c1d15c173d567c23b5b1319b3e7612e43dec9b4e6a25b784c479102fd6ab29bc9a2116394807c8131a81

Download Submit
memory/1800-0-0x000002B24C7C0000-0x000002B24C7D0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads