xmrig | 482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24

Analysis

max time kernel
130s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
Size

1.5MB
MD5

5c47ca6588822b963b864747b41667bc
SHA1

3aae59deb528dc3a439116eebc3cb8b495a08367
SHA256

482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24
SHA512

51a601ab2f3878f35b28c720e972c731c011106a75562c8d8af99e6c4bb593b0301ecc56f5a23acd74be55cb0310b0845a1b1cfe815af2836d226ba0928440f9
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPf:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8W

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023c7f-3.dat	xmrig
behavioral2/files/0x0007000000023c98-9.dat	xmrig
behavioral2/files/0x0007000000023c99-8.dat	xmrig
behavioral2/files/0x0007000000023c9a-18.dat	xmrig
behavioral2/files/0x0007000000023c9d-29.dat	xmrig
behavioral2/files/0x0007000000023c9e-40.dat	xmrig
behavioral2/files/0x0007000000023c9c-37.dat	xmrig
behavioral2/files/0x0007000000023c9b-31.dat	xmrig
behavioral2/files/0x0007000000023c9f-44.dat	xmrig
behavioral2/files/0x0007000000023ca0-49.dat	xmrig
behavioral2/files/0x0008000000023c95-55.dat	xmrig
behavioral2/files/0x0007000000023ca1-60.dat	xmrig
behavioral2/files/0x0007000000023ca2-63.dat	xmrig
behavioral2/files/0x0007000000023ca3-70.dat	xmrig
behavioral2/files/0x0007000000023ca6-77.dat	xmrig
behavioral2/files/0x0007000000023ca9-86.dat	xmrig
behavioral2/files/0x0007000000023caa-89.dat	xmrig
behavioral2/files/0x0007000000023caf-125.dat	xmrig
behavioral2/files/0x0007000000023cb1-138.dat	xmrig
behavioral2/files/0x0007000000023cb9-174.dat	xmrig
behavioral2/files/0x0007000000023cb8-173.dat	xmrig
behavioral2/files/0x0007000000023cb3-164.dat	xmrig
behavioral2/files/0x0007000000023cb2-162.dat	xmrig
behavioral2/files/0x0007000000023cb7-160.dat	xmrig
behavioral2/files/0x0007000000023cb6-151.dat	xmrig
behavioral2/files/0x0007000000023cb5-150.dat	xmrig
behavioral2/files/0x0007000000023cb4-147.dat	xmrig
behavioral2/files/0x0007000000023cb0-130.dat	xmrig
behavioral2/files/0x0007000000023cae-123.dat	xmrig
behavioral2/files/0x0007000000023cad-121.dat	xmrig
behavioral2/files/0x0007000000023cac-119.dat	xmrig
behavioral2/files/0x0007000000023cab-117.dat	xmrig
behavioral2/files/0x0007000000023ca7-106.dat	xmrig
behavioral2/files/0x0007000000023ca4-105.dat	xmrig
behavioral2/files/0x0007000000023ca8-85.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3328	BHMruSO.exe
8	fZAcXDN.exe
2188	QQzSuyc.exe
1884	oFUYSsn.exe
1748	iFWmJDd.exe
3444	IOAHDQj.exe
3076	JUVLPEe.exe
1780	ZWlpcQB.exe
2768	xYHlFYm.exe
4424	vwTQhiL.exe
808	IhxZQrQ.exe
3488	fdUFOMX.exe
2260	qTuLhfg.exe
3324	asupEpd.exe
548	OHEcbdO.exe
1512	AOpwVRi.exe
4336	ljNqCGA.exe
2860	rVTytkA.exe
1552	zrXUkXZ.exe
3404	sApLBHI.exe
3420	UPagXhT.exe
4684	RTnjhDU.exe
1524	rDEQUvh.exe
64	NNrxVrQ.exe
2092	UPSFHcy.exe
1920	tkdXJOS.exe
3504	mIRlDbS.exe
1508	MxfiVjo.exe
3776	dLwGRHL.exe
2408	SHjTcfZ.exe
1624	jZVgIlA.exe
916	AoUyzEC.exe
2116	jrkpHTb.exe
2168	pmvExsW.exe
1572	NCjZWJt.exe
2900	yrkUMmV.exe
60	uawBVBx.exe
1020	jHufqfl.exe
2916	qpAuGGh.exe
3344	wEguFQI.exe
2744	wzeqkGK.exe
2656	GqiqHEn.exe
3572	WJMQQQF.exe
3660	GHGuQnh.exe
4752	SNXKjHO.exe
632	ZjdOyLG.exe
4112	WhHZarq.exe
4240	lqhaeEl.exe
1904	wvhSGgn.exe
628	XyxVvNj.exe
4880	MDaHxoR.exe
4120	xQGyeyy.exe
1708	SGeAlyN.exe
536	tQAdLel.exe
2864	WDbwacP.exe
4732	HPliNEk.exe
4716	UPeQkUo.exe
1668	SUlOdVu.exe
644	iViwdFz.exe
3356	zbkhQHg.exe
4528	bCClmsA.exe
2552	HAmIAEZ.exe
3852	RjMqajH.exe
3128	zOWpABe.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WYDDpPb.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\HAmIAEZ.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\fDgfnQt.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\LbNJuiq.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\vmziQjq.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\kIrNEuO.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\wEguFQI.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\UCjgbNI.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\SYESLwu.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\SiQiIaR.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\kKhKVrX.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\KGscGDx.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\wzeqkGK.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\nfPENfn.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\ygXXCsV.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\vNOvSAM.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\UlXBmmX.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\OkmeLem.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\aXXJkMX.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\tvBZDLG.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\pHpBLAr.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\dpulEpy.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\mfteKIC.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\inXWFVV.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\ahjGtnx.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\QJMpfnY.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\cVvLCrk.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\nsMHBVT.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\cRgKkwQ.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\eBuRlZe.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\IJzyWNk.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\jODKpEs.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\TJGbisR.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\GHGuQnh.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\XwmbDuc.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\WUUksTb.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\MDaHxoR.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\DgzotwL.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\WVNBkNI.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\WDbwacP.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\YmJEkGN.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\rcWoWjV.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\sbcjkAZ.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\OfmUqVp.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\dEmMpBH.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\wKMOTxt.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\BSZmOoY.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\gBAHhxV.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\dBSdfom.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\avuEIDk.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\pkbsnPz.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\VTKcwDT.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\pAKeFZv.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\RHkaifd.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\YujdLnz.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\HXrjgdh.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\fzaeKnm.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\boskSdj.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\gpaJYwh.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\OoczbsA.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\LNrsNKT.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\slowmVt.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\SkLxWaJ.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
File created	C:\Windows\System\OenWWAj.exe	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17252	dwm.exe
Token: SeChangeNotifyPrivilege	17252	dwm.exe
Token: 33	17252	dwm.exe
Token: SeIncBasePriorityPrivilege	17252	dwm.exe
Token: SeShutdownPrivilege	17252	dwm.exe
Token: SeCreatePagefilePrivilege	17252	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 3328	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	84
PID 864 wrote to memory of 3328	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	84
PID 864 wrote to memory of 8	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	85
PID 864 wrote to memory of 8	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	85
PID 864 wrote to memory of 2188	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	86
PID 864 wrote to memory of 2188	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	86
PID 864 wrote to memory of 1884	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	87
PID 864 wrote to memory of 1884	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	87
PID 864 wrote to memory of 1748	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	88
PID 864 wrote to memory of 1748	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	88
PID 864 wrote to memory of 3444	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	89
PID 864 wrote to memory of 3444	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	89
PID 864 wrote to memory of 3076	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	90
PID 864 wrote to memory of 3076	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	90
PID 864 wrote to memory of 1780	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	91
PID 864 wrote to memory of 1780	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	91
PID 864 wrote to memory of 2768	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	92
PID 864 wrote to memory of 2768	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	92
PID 864 wrote to memory of 4424	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	95
PID 864 wrote to memory of 4424	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	95
PID 864 wrote to memory of 808	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	96
PID 864 wrote to memory of 808	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	96
PID 864 wrote to memory of 3488	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	97
PID 864 wrote to memory of 3488	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	97
PID 864 wrote to memory of 2260	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	98
PID 864 wrote to memory of 2260	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	98
PID 864 wrote to memory of 3324	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	99
PID 864 wrote to memory of 3324	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	99
PID 864 wrote to memory of 548	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	101
PID 864 wrote to memory of 548	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	101
PID 864 wrote to memory of 1512	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	102
PID 864 wrote to memory of 1512	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	102
PID 864 wrote to memory of 4336	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	103
PID 864 wrote to memory of 4336	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	103
PID 864 wrote to memory of 2860	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	104
PID 864 wrote to memory of 2860	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	104
PID 864 wrote to memory of 1552	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	105
PID 864 wrote to memory of 1552	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	105
PID 864 wrote to memory of 3404	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	106
PID 864 wrote to memory of 3404	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	106
PID 864 wrote to memory of 3420	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	107
PID 864 wrote to memory of 3420	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	107
PID 864 wrote to memory of 4684	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	108
PID 864 wrote to memory of 4684	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	108
PID 864 wrote to memory of 1524	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	109
PID 864 wrote to memory of 1524	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	109
PID 864 wrote to memory of 64	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	110
PID 864 wrote to memory of 64	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	110
PID 864 wrote to memory of 2092	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	111
PID 864 wrote to memory of 2092	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	111
PID 864 wrote to memory of 1920	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	112
PID 864 wrote to memory of 1920	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	112
PID 864 wrote to memory of 3504	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	113
PID 864 wrote to memory of 3504	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	113
PID 864 wrote to memory of 1508	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	114
PID 864 wrote to memory of 1508	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	114
PID 864 wrote to memory of 3776	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	115
PID 864 wrote to memory of 3776	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	115
PID 864 wrote to memory of 2408	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	116
PID 864 wrote to memory of 2408	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	116
PID 864 wrote to memory of 1624	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	117
PID 864 wrote to memory of 1624	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	117
PID 864 wrote to memory of 916	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	118
PID 864 wrote to memory of 916	864	482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe	118

C:\Users\Admin\AppData\Local\Temp\482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe
"C:\Users\Admin\AppData\Local\Temp\482dbeff333acc4f74f93ff7f100748ce2c91ec65657eff824305672b48efd24.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\System\BHMruSO.exe
  C:\Windows\System\BHMruSO.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\fZAcXDN.exe
  C:\Windows\System\fZAcXDN.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\QQzSuyc.exe
  C:\Windows\System\QQzSuyc.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\oFUYSsn.exe
  C:\Windows\System\oFUYSsn.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\iFWmJDd.exe
  C:\Windows\System\iFWmJDd.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\IOAHDQj.exe
  C:\Windows\System\IOAHDQj.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\JUVLPEe.exe
  C:\Windows\System\JUVLPEe.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\ZWlpcQB.exe
  C:\Windows\System\ZWlpcQB.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\xYHlFYm.exe
  C:\Windows\System\xYHlFYm.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\vwTQhiL.exe
  C:\Windows\System\vwTQhiL.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\IhxZQrQ.exe
  C:\Windows\System\IhxZQrQ.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\fdUFOMX.exe
  C:\Windows\System\fdUFOMX.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\qTuLhfg.exe
  C:\Windows\System\qTuLhfg.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\asupEpd.exe
  C:\Windows\System\asupEpd.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\OHEcbdO.exe
  C:\Windows\System\OHEcbdO.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\AOpwVRi.exe
  C:\Windows\System\AOpwVRi.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\ljNqCGA.exe
  C:\Windows\System\ljNqCGA.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\rVTytkA.exe
  C:\Windows\System\rVTytkA.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\zrXUkXZ.exe
  C:\Windows\System\zrXUkXZ.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\sApLBHI.exe
  C:\Windows\System\sApLBHI.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\UPagXhT.exe
  C:\Windows\System\UPagXhT.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\RTnjhDU.exe
  C:\Windows\System\RTnjhDU.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\rDEQUvh.exe
  C:\Windows\System\rDEQUvh.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\NNrxVrQ.exe
  C:\Windows\System\NNrxVrQ.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\UPSFHcy.exe
  C:\Windows\System\UPSFHcy.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\tkdXJOS.exe
  C:\Windows\System\tkdXJOS.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\mIRlDbS.exe
  C:\Windows\System\mIRlDbS.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\MxfiVjo.exe
  C:\Windows\System\MxfiVjo.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\dLwGRHL.exe
  C:\Windows\System\dLwGRHL.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\SHjTcfZ.exe
  C:\Windows\System\SHjTcfZ.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\jZVgIlA.exe
  C:\Windows\System\jZVgIlA.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\AoUyzEC.exe
  C:\Windows\System\AoUyzEC.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\jrkpHTb.exe
  C:\Windows\System\jrkpHTb.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\pmvExsW.exe
  C:\Windows\System\pmvExsW.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\NCjZWJt.exe
  C:\Windows\System\NCjZWJt.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\yrkUMmV.exe
  C:\Windows\System\yrkUMmV.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\uawBVBx.exe
  C:\Windows\System\uawBVBx.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\jHufqfl.exe
  C:\Windows\System\jHufqfl.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\qpAuGGh.exe
  C:\Windows\System\qpAuGGh.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\wEguFQI.exe
  C:\Windows\System\wEguFQI.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\wzeqkGK.exe
  C:\Windows\System\wzeqkGK.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\GqiqHEn.exe
  C:\Windows\System\GqiqHEn.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\WJMQQQF.exe
  C:\Windows\System\WJMQQQF.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\GHGuQnh.exe
  C:\Windows\System\GHGuQnh.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\SNXKjHO.exe
  C:\Windows\System\SNXKjHO.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\ZjdOyLG.exe
  C:\Windows\System\ZjdOyLG.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\WhHZarq.exe
  C:\Windows\System\WhHZarq.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\lqhaeEl.exe
  C:\Windows\System\lqhaeEl.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\wvhSGgn.exe
  C:\Windows\System\wvhSGgn.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\XyxVvNj.exe
  C:\Windows\System\XyxVvNj.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\MDaHxoR.exe
  C:\Windows\System\MDaHxoR.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\xQGyeyy.exe
  C:\Windows\System\xQGyeyy.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\SGeAlyN.exe
  C:\Windows\System\SGeAlyN.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\tQAdLel.exe
  C:\Windows\System\tQAdLel.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\WDbwacP.exe
  C:\Windows\System\WDbwacP.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\HPliNEk.exe
  C:\Windows\System\HPliNEk.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\UPeQkUo.exe
  C:\Windows\System\UPeQkUo.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\SUlOdVu.exe
  C:\Windows\System\SUlOdVu.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\iViwdFz.exe
  C:\Windows\System\iViwdFz.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\zbkhQHg.exe
  C:\Windows\System\zbkhQHg.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\bCClmsA.exe
  C:\Windows\System\bCClmsA.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\HAmIAEZ.exe
  C:\Windows\System\HAmIAEZ.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\RjMqajH.exe
  C:\Windows\System\RjMqajH.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\zOWpABe.exe
  C:\Windows\System\zOWpABe.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\IoZfeiS.exe
  C:\Windows\System\IoZfeiS.exe
  2⤵
  PID:4224
- C:\Windows\System\IQyAnSD.exe
  C:\Windows\System\IQyAnSD.exe
  2⤵
  PID:4800
- C:\Windows\System\VWQhzLC.exe
  C:\Windows\System\VWQhzLC.exe
  2⤵
  PID:3552
- C:\Windows\System\hfQZnGG.exe
  C:\Windows\System\hfQZnGG.exe
  2⤵
  PID:2968
- C:\Windows\System\HXrjgdh.exe
  C:\Windows\System\HXrjgdh.exe
  2⤵
  PID:2896
- C:\Windows\System\duwgQXG.exe
  C:\Windows\System\duwgQXG.exe
  2⤵
  PID:4436
- C:\Windows\System\BHadGBF.exe
  C:\Windows\System\BHadGBF.exe
  2⤵
  PID:2712
- C:\Windows\System\fynpwRZ.exe
  C:\Windows\System\fynpwRZ.exe
  2⤵
  PID:2088
- C:\Windows\System\oJktPMq.exe
  C:\Windows\System\oJktPMq.exe
  2⤵
  PID:4520
- C:\Windows\System\VTlyDaI.exe
  C:\Windows\System\VTlyDaI.exe
  2⤵
  PID:1208
- C:\Windows\System\WRpXzSB.exe
  C:\Windows\System\WRpXzSB.exe
  2⤵
  PID:388
- C:\Windows\System\cRgKkwQ.exe
  C:\Windows\System\cRgKkwQ.exe
  2⤵
  PID:3548
- C:\Windows\System\LqtWlyC.exe
  C:\Windows\System\LqtWlyC.exe
  2⤵
  PID:4736
- C:\Windows\System\hPVhmfq.exe
  C:\Windows\System\hPVhmfq.exe
  2⤵
  PID:1888
- C:\Windows\System\UDsAVln.exe
  C:\Windows\System\UDsAVln.exe
  2⤵
  PID:4024
- C:\Windows\System\hxwdpma.exe
  C:\Windows\System\hxwdpma.exe
  2⤵
  PID:2884
- C:\Windows\System\ZSvcORP.exe
  C:\Windows\System\ZSvcORP.exe
  2⤵
  PID:3332
- C:\Windows\System\XnEkWmg.exe
  C:\Windows\System\XnEkWmg.exe
  2⤵
  PID:3992
- C:\Windows\System\VmtqoRo.exe
  C:\Windows\System\VmtqoRo.exe
  2⤵
  PID:4940
- C:\Windows\System\wXkvvqI.exe
  C:\Windows\System\wXkvvqI.exe
  2⤵
  PID:432
- C:\Windows\System\zLBKWeV.exe
  C:\Windows\System\zLBKWeV.exe
  2⤵
  PID:816
- C:\Windows\System\eVwGFdr.exe
  C:\Windows\System\eVwGFdr.exe
  2⤵
  PID:4404
- C:\Windows\System\tdvtPFE.exe
  C:\Windows\System\tdvtPFE.exe
  2⤵
  PID:5124
- C:\Windows\System\KnJXGjl.exe
  C:\Windows\System\KnJXGjl.exe
  2⤵
  PID:5180
- C:\Windows\System\dXVHtdi.exe
  C:\Windows\System\dXVHtdi.exe
  2⤵
  PID:5200
- C:\Windows\System\TsWgRuO.exe
  C:\Windows\System\TsWgRuO.exe
  2⤵
  PID:5228
- C:\Windows\System\NslKMiW.exe
  C:\Windows\System\NslKMiW.exe
  2⤵
  PID:5244
- C:\Windows\System\GkZiHqq.exe
  C:\Windows\System\GkZiHqq.exe
  2⤵
  PID:5260
- C:\Windows\System\ZhpLCiz.exe
  C:\Windows\System\ZhpLCiz.exe
  2⤵
  PID:5300
- C:\Windows\System\jtIpxtX.exe
  C:\Windows\System\jtIpxtX.exe
  2⤵
  PID:5328
- C:\Windows\System\SbWRtnM.exe
  C:\Windows\System\SbWRtnM.exe
  2⤵
  PID:5348
- C:\Windows\System\rFFpYcW.exe
  C:\Windows\System\rFFpYcW.exe
  2⤵
  PID:5376
- C:\Windows\System\RjBWcjv.exe
  C:\Windows\System\RjBWcjv.exe
  2⤵
  PID:5408
- C:\Windows\System\almeVvC.exe
  C:\Windows\System\almeVvC.exe
  2⤵
  PID:5432
- C:\Windows\System\jcdqUHN.exe
  C:\Windows\System\jcdqUHN.exe
  2⤵
  PID:5460
- C:\Windows\System\ewECdrE.exe
  C:\Windows\System\ewECdrE.exe
  2⤵
  PID:5496
- C:\Windows\System\tOHyCjF.exe
  C:\Windows\System\tOHyCjF.exe
  2⤵
  PID:5544
- C:\Windows\System\zyihPNR.exe
  C:\Windows\System\zyihPNR.exe
  2⤵
  PID:5568
- C:\Windows\System\btzXbKn.exe
  C:\Windows\System\btzXbKn.exe
  2⤵
  PID:5604
- C:\Windows\System\OLXUeOM.exe
  C:\Windows\System\OLXUeOM.exe
  2⤵
  PID:5624
- C:\Windows\System\gRAxsJR.exe
  C:\Windows\System\gRAxsJR.exe
  2⤵
  PID:5656
- C:\Windows\System\avuEIDk.exe
  C:\Windows\System\avuEIDk.exe
  2⤵
  PID:5684
- C:\Windows\System\inXWFVV.exe
  C:\Windows\System\inXWFVV.exe
  2⤵
  PID:5740
- C:\Windows\System\sbcjkAZ.exe
  C:\Windows\System\sbcjkAZ.exe
  2⤵
  PID:5764
- C:\Windows\System\rFmnrEW.exe
  C:\Windows\System\rFmnrEW.exe
  2⤵
  PID:5792
- C:\Windows\System\CmGBRKy.exe
  C:\Windows\System\CmGBRKy.exe
  2⤵
  PID:5812
- C:\Windows\System\vwDVAro.exe
  C:\Windows\System\vwDVAro.exe
  2⤵
  PID:5840
- C:\Windows\System\MTifRgc.exe
  C:\Windows\System\MTifRgc.exe
  2⤵
  PID:5868
- C:\Windows\System\LNrsNKT.exe
  C:\Windows\System\LNrsNKT.exe
  2⤵
  PID:5888
- C:\Windows\System\PQreZgQ.exe
  C:\Windows\System\PQreZgQ.exe
  2⤵
  PID:5916
- C:\Windows\System\eapkGDl.exe
  C:\Windows\System\eapkGDl.exe
  2⤵
  PID:5952
- C:\Windows\System\kFxIcVz.exe
  C:\Windows\System\kFxIcVz.exe
  2⤵
  PID:5988
- C:\Windows\System\fMDyYtm.exe
  C:\Windows\System\fMDyYtm.exe
  2⤵
  PID:6020
- C:\Windows\System\JNdJjoo.exe
  C:\Windows\System\JNdJjoo.exe
  2⤵
  PID:6044
- C:\Windows\System\whIkTkB.exe
  C:\Windows\System\whIkTkB.exe
  2⤵
  PID:6064
- C:\Windows\System\oJLKkxv.exe
  C:\Windows\System\oJLKkxv.exe
  2⤵
  PID:6088
- C:\Windows\System\pkzloWu.exe
  C:\Windows\System\pkzloWu.exe
  2⤵
  PID:6120
- C:\Windows\System\epJnxca.exe
  C:\Windows\System\epJnxca.exe
  2⤵
  PID:5136
- C:\Windows\System\aKtdRzS.exe
  C:\Windows\System\aKtdRzS.exe
  2⤵
  PID:5196
- C:\Windows\System\uLXJoMo.exe
  C:\Windows\System\uLXJoMo.exe
  2⤵
  PID:5236
- C:\Windows\System\Pchcssh.exe
  C:\Windows\System\Pchcssh.exe
  2⤵
  PID:5320
- C:\Windows\System\tvBZDLG.exe
  C:\Windows\System\tvBZDLG.exe
  2⤵
  PID:5340
- C:\Windows\System\iFgwnij.exe
  C:\Windows\System\iFgwnij.exe
  2⤵
  PID:5424
- C:\Windows\System\MZNcjMS.exe
  C:\Windows\System\MZNcjMS.exe
  2⤵
  PID:5468
- C:\Windows\System\ejdqHyf.exe
  C:\Windows\System\ejdqHyf.exe
  2⤵
  PID:5508
- C:\Windows\System\hndJMLZ.exe
  C:\Windows\System\hndJMLZ.exe
  2⤵
  PID:5560
- C:\Windows\System\fIzwixc.exe
  C:\Windows\System\fIzwixc.exe
  2⤵
  PID:5652
- C:\Windows\System\kjnsVTq.exe
  C:\Windows\System\kjnsVTq.exe
  2⤵
  PID:5720
- C:\Windows\System\YmJEkGN.exe
  C:\Windows\System\YmJEkGN.exe
  2⤵
  PID:5780
- C:\Windows\System\AvofpRr.exe
  C:\Windows\System\AvofpRr.exe
  2⤵
  PID:5852
- C:\Windows\System\DLfNxnq.exe
  C:\Windows\System\DLfNxnq.exe
  2⤵
  PID:5940
- C:\Windows\System\NNSWGQz.exe
  C:\Windows\System\NNSWGQz.exe
  2⤵
  PID:6004
- C:\Windows\System\tMhDxgX.exe
  C:\Windows\System\tMhDxgX.exe
  2⤵
  PID:6076
- C:\Windows\System\jmTYzrV.exe
  C:\Windows\System\jmTYzrV.exe
  2⤵
  PID:6096
- C:\Windows\System\ERuVPql.exe
  C:\Windows\System\ERuVPql.exe
  2⤵
  PID:5212
- C:\Windows\System\jmTzuOf.exe
  C:\Windows\System\jmTzuOf.exe
  2⤵
  PID:5344
- C:\Windows\System\Yhdifge.exe
  C:\Windows\System\Yhdifge.exe
  2⤵
  PID:5556
- C:\Windows\System\fDgfnQt.exe
  C:\Windows\System\fDgfnQt.exe
  2⤵
  PID:5772
- C:\Windows\System\IJTKXwB.exe
  C:\Windows\System\IJTKXwB.exe
  2⤵
  PID:5948
- C:\Windows\System\KrEDnFk.exe
  C:\Windows\System\KrEDnFk.exe
  2⤵
  PID:5960
- C:\Windows\System\uUQQZMz.exe
  C:\Windows\System\uUQQZMz.exe
  2⤵
  PID:5552
- C:\Windows\System\flyXJKc.exe
  C:\Windows\System\flyXJKc.exe
  2⤵
  PID:5876
- C:\Windows\System\Ddhyzdx.exe
  C:\Windows\System\Ddhyzdx.exe
  2⤵
  PID:5280
- C:\Windows\System\pHruWUR.exe
  C:\Windows\System\pHruWUR.exe
  2⤵
  PID:6136
- C:\Windows\System\bMdRrkp.exe
  C:\Windows\System\bMdRrkp.exe
  2⤵
  PID:6148
- C:\Windows\System\tksDxiD.exe
  C:\Windows\System\tksDxiD.exe
  2⤵
  PID:6176
- C:\Windows\System\EICoiKV.exe
  C:\Windows\System\EICoiKV.exe
  2⤵
  PID:6208
- C:\Windows\System\DJLyOWK.exe
  C:\Windows\System\DJLyOWK.exe
  2⤵
  PID:6236
- C:\Windows\System\cCvAoZb.exe
  C:\Windows\System\cCvAoZb.exe
  2⤵
  PID:6272
- C:\Windows\System\GjVCMXZ.exe
  C:\Windows\System\GjVCMXZ.exe
  2⤵
  PID:6300
- C:\Windows\System\PUDLUXc.exe
  C:\Windows\System\PUDLUXc.exe
  2⤵
  PID:6336
- C:\Windows\System\eBuRlZe.exe
  C:\Windows\System\eBuRlZe.exe
  2⤵
  PID:6376
- C:\Windows\System\RXwxVXN.exe
  C:\Windows\System\RXwxVXN.exe
  2⤵
  PID:6400
- C:\Windows\System\SdoyeiP.exe
  C:\Windows\System\SdoyeiP.exe
  2⤵
  PID:6428
- C:\Windows\System\LEhZDep.exe
  C:\Windows\System\LEhZDep.exe
  2⤵
  PID:6452
- C:\Windows\System\WmTgaFJ.exe
  C:\Windows\System\WmTgaFJ.exe
  2⤵
  PID:6484
- C:\Windows\System\yhAytjp.exe
  C:\Windows\System\yhAytjp.exe
  2⤵
  PID:6508
- C:\Windows\System\arpBEFN.exe
  C:\Windows\System\arpBEFN.exe
  2⤵
  PID:6532
- C:\Windows\System\IavvUSg.exe
  C:\Windows\System\IavvUSg.exe
  2⤵
  PID:6568
- C:\Windows\System\VPHTHIh.exe
  C:\Windows\System\VPHTHIh.exe
  2⤵
  PID:6600
- C:\Windows\System\dmnDGat.exe
  C:\Windows\System\dmnDGat.exe
  2⤵
  PID:6628
- C:\Windows\System\seNaJvK.exe
  C:\Windows\System\seNaJvK.exe
  2⤵
  PID:6652
- C:\Windows\System\qpdLhdW.exe
  C:\Windows\System\qpdLhdW.exe
  2⤵
  PID:6680
- C:\Windows\System\IKSLliM.exe
  C:\Windows\System\IKSLliM.exe
  2⤵
  PID:6708
- C:\Windows\System\qtGqRCw.exe
  C:\Windows\System\qtGqRCw.exe
  2⤵
  PID:6740
- C:\Windows\System\jUrXcjb.exe
  C:\Windows\System\jUrXcjb.exe
  2⤵
  PID:6760
- C:\Windows\System\vkXlBIE.exe
  C:\Windows\System\vkXlBIE.exe
  2⤵
  PID:6780
- C:\Windows\System\MeEStZD.exe
  C:\Windows\System\MeEStZD.exe
  2⤵
  PID:6816
- C:\Windows\System\sHCtGeI.exe
  C:\Windows\System\sHCtGeI.exe
  2⤵
  PID:6836
- C:\Windows\System\lrymgao.exe
  C:\Windows\System\lrymgao.exe
  2⤵
  PID:6864
- C:\Windows\System\zRlBmOy.exe
  C:\Windows\System\zRlBmOy.exe
  2⤵
  PID:6900
- C:\Windows\System\LbNJuiq.exe
  C:\Windows\System\LbNJuiq.exe
  2⤵
  PID:6920
- C:\Windows\System\IJzyWNk.exe
  C:\Windows\System\IJzyWNk.exe
  2⤵
  PID:6944
- C:\Windows\System\XBiHRFx.exe
  C:\Windows\System\XBiHRFx.exe
  2⤵
  PID:6972
- C:\Windows\System\tNdSlDY.exe
  C:\Windows\System\tNdSlDY.exe
  2⤵
  PID:6992
- C:\Windows\System\hhekPvx.exe
  C:\Windows\System\hhekPvx.exe
  2⤵
  PID:7020
- C:\Windows\System\NyapIPC.exe
  C:\Windows\System\NyapIPC.exe
  2⤵
  PID:7048
- C:\Windows\System\vLhATpB.exe
  C:\Windows\System\vLhATpB.exe
  2⤵
  PID:7096
- C:\Windows\System\VmICgvh.exe
  C:\Windows\System\VmICgvh.exe
  2⤵
  PID:7124
- C:\Windows\System\dLZTFtJ.exe
  C:\Windows\System\dLZTFtJ.exe
  2⤵
  PID:7152
- C:\Windows\System\RPqWMst.exe
  C:\Windows\System\RPqWMst.exe
  2⤵
  PID:6168
- C:\Windows\System\yJKRLEE.exe
  C:\Windows\System\yJKRLEE.exe
  2⤵
  PID:6248
- C:\Windows\System\PYhLAjM.exe
  C:\Windows\System\PYhLAjM.exe
  2⤵
  PID:6260
- C:\Windows\System\PlCTRhW.exe
  C:\Windows\System\PlCTRhW.exe
  2⤵
  PID:6312
- C:\Windows\System\nmAQwOF.exe
  C:\Windows\System\nmAQwOF.exe
  2⤵
  PID:6384
- C:\Windows\System\FrbFbCk.exe
  C:\Windows\System\FrbFbCk.exe
  2⤵
  PID:6444
- C:\Windows\System\yYnScEF.exe
  C:\Windows\System\yYnScEF.exe
  2⤵
  PID:6520
- C:\Windows\System\FrirdMh.exe
  C:\Windows\System\FrirdMh.exe
  2⤵
  PID:6592
- C:\Windows\System\ZIIDMxl.exe
  C:\Windows\System\ZIIDMxl.exe
  2⤵
  PID:6648
- C:\Windows\System\KxZGARK.exe
  C:\Windows\System\KxZGARK.exe
  2⤵
  PID:6724
- C:\Windows\System\EGesDZB.exe
  C:\Windows\System\EGesDZB.exe
  2⤵
  PID:6792
- C:\Windows\System\pZeeaUr.exe
  C:\Windows\System\pZeeaUr.exe
  2⤵
  PID:6872
- C:\Windows\System\GErWbAE.exe
  C:\Windows\System\GErWbAE.exe
  2⤵
  PID:6916
- C:\Windows\System\BaCFGvA.exe
  C:\Windows\System\BaCFGvA.exe
  2⤵
  PID:6940
- C:\Windows\System\DgzotwL.exe
  C:\Windows\System\DgzotwL.exe
  2⤵
  PID:7044
- C:\Windows\System\TbSLyxU.exe
  C:\Windows\System\TbSLyxU.exe
  2⤵
  PID:7092
- C:\Windows\System\EQwwTwM.exe
  C:\Windows\System\EQwwTwM.exe
  2⤵
  PID:5808
- C:\Windows\System\RpDTaug.exe
  C:\Windows\System\RpDTaug.exe
  2⤵
  PID:6316
- C:\Windows\System\OUJRioU.exe
  C:\Windows\System\OUJRioU.exe
  2⤵
  PID:6460
- C:\Windows\System\nRluUtY.exe
  C:\Windows\System\nRluUtY.exe
  2⤵
  PID:6624
- C:\Windows\System\qINmOTe.exe
  C:\Windows\System\qINmOTe.exe
  2⤵
  PID:6696
- C:\Windows\System\jNVLcWm.exe
  C:\Windows\System\jNVLcWm.exe
  2⤵
  PID:6964
- C:\Windows\System\rwdiSPA.exe
  C:\Windows\System\rwdiSPA.exe
  2⤵
  PID:7108
- C:\Windows\System\rFdyTWS.exe
  C:\Windows\System\rFdyTWS.exe
  2⤵
  PID:5172
- C:\Windows\System\eKMjCml.exe
  C:\Windows\System\eKMjCml.exe
  2⤵
  PID:6752
- C:\Windows\System\XyaOfIS.exe
  C:\Windows\System\XyaOfIS.exe
  2⤵
  PID:7016
- C:\Windows\System\OkmeLem.exe
  C:\Windows\System\OkmeLem.exe
  2⤵
  PID:7004
- C:\Windows\System\tJAgAVE.exe
  C:\Windows\System\tJAgAVE.exe
  2⤵
  PID:7204
- C:\Windows\System\OfmUqVp.exe
  C:\Windows\System\OfmUqVp.exe
  2⤵
  PID:7236
- C:\Windows\System\rWLvFzs.exe
  C:\Windows\System\rWLvFzs.exe
  2⤵
  PID:7268
- C:\Windows\System\GZDaNDX.exe
  C:\Windows\System\GZDaNDX.exe
  2⤵
  PID:7284
- C:\Windows\System\JOiJgSh.exe
  C:\Windows\System\JOiJgSh.exe
  2⤵
  PID:7308
- C:\Windows\System\pFAfOAJ.exe
  C:\Windows\System\pFAfOAJ.exe
  2⤵
  PID:7336
- C:\Windows\System\kdVcpKX.exe
  C:\Windows\System\kdVcpKX.exe
  2⤵
  PID:7364
- C:\Windows\System\xrqWtNq.exe
  C:\Windows\System\xrqWtNq.exe
  2⤵
  PID:7388
- C:\Windows\System\sIaXTDC.exe
  C:\Windows\System\sIaXTDC.exe
  2⤵
  PID:7428
- C:\Windows\System\CZIPaVH.exe
  C:\Windows\System\CZIPaVH.exe
  2⤵
  PID:7468
- C:\Windows\System\rewlwXf.exe
  C:\Windows\System\rewlwXf.exe
  2⤵
  PID:7492
- C:\Windows\System\lGArAgI.exe
  C:\Windows\System\lGArAgI.exe
  2⤵
  PID:7528
- C:\Windows\System\FqCvvIg.exe
  C:\Windows\System\FqCvvIg.exe
  2⤵
  PID:7556
- C:\Windows\System\QUncWas.exe
  C:\Windows\System\QUncWas.exe
  2⤵
  PID:7572
- C:\Windows\System\weWBton.exe
  C:\Windows\System\weWBton.exe
  2⤵
  PID:7604
- C:\Windows\System\mcIOKzj.exe
  C:\Windows\System\mcIOKzj.exe
  2⤵
  PID:7636
- C:\Windows\System\RYpmQxv.exe
  C:\Windows\System\RYpmQxv.exe
  2⤵
  PID:7660
- C:\Windows\System\YWhdEjX.exe
  C:\Windows\System\YWhdEjX.exe
  2⤵
  PID:7684
- C:\Windows\System\wwPZaBl.exe
  C:\Windows\System\wwPZaBl.exe
  2⤵
  PID:7712
- C:\Windows\System\vgnBSPu.exe
  C:\Windows\System\vgnBSPu.exe
  2⤵
  PID:7740
- C:\Windows\System\TkLmyEf.exe
  C:\Windows\System\TkLmyEf.exe
  2⤵
  PID:7768
- C:\Windows\System\jODKpEs.exe
  C:\Windows\System\jODKpEs.exe
  2⤵
  PID:7800
- C:\Windows\System\jtdSNoe.exe
  C:\Windows\System\jtdSNoe.exe
  2⤵
  PID:7832
- C:\Windows\System\fJAAjtD.exe
  C:\Windows\System\fJAAjtD.exe
  2⤵
  PID:7852
- C:\Windows\System\KmsVddO.exe
  C:\Windows\System\KmsVddO.exe
  2⤵
  PID:7872
- C:\Windows\System\ZabwfeV.exe
  C:\Windows\System\ZabwfeV.exe
  2⤵
  PID:7900
- C:\Windows\System\mmtiYoL.exe
  C:\Windows\System\mmtiYoL.exe
  2⤵
  PID:7940
- C:\Windows\System\ULWrBVC.exe
  C:\Windows\System\ULWrBVC.exe
  2⤵
  PID:7972
- C:\Windows\System\WLAUStr.exe
  C:\Windows\System\WLAUStr.exe
  2⤵
  PID:8000
- C:\Windows\System\fzaeKnm.exe
  C:\Windows\System\fzaeKnm.exe
  2⤵
  PID:8092
- C:\Windows\System\PXStDPC.exe
  C:\Windows\System\PXStDPC.exe
  2⤵
  PID:8108
- C:\Windows\System\fPLBHxj.exe
  C:\Windows\System\fPLBHxj.exe
  2⤵
  PID:8132
- C:\Windows\System\rFzHCYE.exe
  C:\Windows\System\rFzHCYE.exe
  2⤵
  PID:8152
- C:\Windows\System\jkqoGmZ.exe
  C:\Windows\System\jkqoGmZ.exe
  2⤵
  PID:8172
- C:\Windows\System\UYcBrNT.exe
  C:\Windows\System\UYcBrNT.exe
  2⤵
  PID:6476
- C:\Windows\System\gffHtFh.exe
  C:\Windows\System\gffHtFh.exe
  2⤵
  PID:7216
- C:\Windows\System\zYRMIqe.exe
  C:\Windows\System\zYRMIqe.exe
  2⤵
  PID:7300
- C:\Windows\System\XMdgdJG.exe
  C:\Windows\System\XMdgdJG.exe
  2⤵
  PID:7276
- C:\Windows\System\fKUXamm.exe
  C:\Windows\System\fKUXamm.exe
  2⤵
  PID:7416
- C:\Windows\System\TpOuIIS.exe
  C:\Windows\System\TpOuIIS.exe
  2⤵
  PID:7480
- C:\Windows\System\SZPIBNZ.exe
  C:\Windows\System\SZPIBNZ.exe
  2⤵
  PID:7552
- C:\Windows\System\svddzdE.exe
  C:\Windows\System\svddzdE.exe
  2⤵
  PID:7592
- C:\Windows\System\YRoMqpn.exe
  C:\Windows\System\YRoMqpn.exe
  2⤵
  PID:7676
- C:\Windows\System\clpdqeA.exe
  C:\Windows\System\clpdqeA.exe
  2⤵
  PID:7764
- C:\Windows\System\aVonNeH.exe
  C:\Windows\System\aVonNeH.exe
  2⤵
  PID:7780
- C:\Windows\System\umquBEV.exe
  C:\Windows\System\umquBEV.exe
  2⤵
  PID:7920
- C:\Windows\System\HsiwqxC.exe
  C:\Windows\System\HsiwqxC.exe
  2⤵
  PID:7888
- C:\Windows\System\ObPcOjl.exe
  C:\Windows\System\ObPcOjl.exe
  2⤵
  PID:8044
- C:\Windows\System\oEXnwIJ.exe
  C:\Windows\System\oEXnwIJ.exe
  2⤵
  PID:8084
- C:\Windows\System\cNrlUbS.exe
  C:\Windows\System\cNrlUbS.exe
  2⤵
  PID:8148
- C:\Windows\System\ErYusxL.exe
  C:\Windows\System\ErYusxL.exe
  2⤵
  PID:7172
- C:\Windows\System\CbaKgkq.exe
  C:\Windows\System\CbaKgkq.exe
  2⤵
  PID:7372
- C:\Windows\System\epQotnh.exe
  C:\Windows\System\epQotnh.exe
  2⤵
  PID:7456
- C:\Windows\System\WuyTyHr.exe
  C:\Windows\System\WuyTyHr.exe
  2⤵
  PID:7384
- C:\Windows\System\AbTbiOv.exe
  C:\Windows\System\AbTbiOv.exe
  2⤵
  PID:7656
- C:\Windows\System\pbUovHC.exe
  C:\Windows\System\pbUovHC.exe
  2⤵
  PID:7864
- C:\Windows\System\aKucTTd.exe
  C:\Windows\System\aKucTTd.exe
  2⤵
  PID:8080
- C:\Windows\System\HOrDojF.exe
  C:\Windows\System\HOrDojF.exe
  2⤵
  PID:6960
- C:\Windows\System\VxuHeaX.exe
  C:\Windows\System\VxuHeaX.exe
  2⤵
  PID:8200
- C:\Windows\System\HiamsmQ.exe
  C:\Windows\System\HiamsmQ.exe
  2⤵
  PID:8228
- C:\Windows\System\cDPRScr.exe
  C:\Windows\System\cDPRScr.exe
  2⤵
  PID:8248
- C:\Windows\System\oTHMqgA.exe
  C:\Windows\System\oTHMqgA.exe
  2⤵
  PID:8276
- C:\Windows\System\PfqKGfo.exe
  C:\Windows\System\PfqKGfo.exe
  2⤵
  PID:8304
- C:\Windows\System\RyAmtVm.exe
  C:\Windows\System\RyAmtVm.exe
  2⤵
  PID:8336
- C:\Windows\System\nZEAjro.exe
  C:\Windows\System\nZEAjro.exe
  2⤵
  PID:8364
- C:\Windows\System\uPkrUrb.exe
  C:\Windows\System\uPkrUrb.exe
  2⤵
  PID:8384
- C:\Windows\System\WdmVJjO.exe
  C:\Windows\System\WdmVJjO.exe
  2⤵
  PID:8404
- C:\Windows\System\isoWMbj.exe
  C:\Windows\System\isoWMbj.exe
  2⤵
  PID:8432
- C:\Windows\System\GXbZYUv.exe
  C:\Windows\System\GXbZYUv.exe
  2⤵
  PID:8464
- C:\Windows\System\cXIZUbw.exe
  C:\Windows\System\cXIZUbw.exe
  2⤵
  PID:8496
- C:\Windows\System\qLejMzB.exe
  C:\Windows\System\qLejMzB.exe
  2⤵
  PID:8516
- C:\Windows\System\YSadllr.exe
  C:\Windows\System\YSadllr.exe
  2⤵
  PID:8552
- C:\Windows\System\dABTuBM.exe
  C:\Windows\System\dABTuBM.exe
  2⤵
  PID:8576
- C:\Windows\System\mKNGyFY.exe
  C:\Windows\System\mKNGyFY.exe
  2⤵
  PID:8608
- C:\Windows\System\TJGbisR.exe
  C:\Windows\System\TJGbisR.exe
  2⤵
  PID:8636
- C:\Windows\System\CNmkeaX.exe
  C:\Windows\System\CNmkeaX.exe
  2⤵
  PID:8652
- C:\Windows\System\VhDLmdZ.exe
  C:\Windows\System\VhDLmdZ.exe
  2⤵
  PID:8668
- C:\Windows\System\xJVhjdg.exe
  C:\Windows\System\xJVhjdg.exe
  2⤵
  PID:8704
- C:\Windows\System\NXQxsNp.exe
  C:\Windows\System\NXQxsNp.exe
  2⤵
  PID:8720
- C:\Windows\System\QhdIuxY.exe
  C:\Windows\System\QhdIuxY.exe
  2⤵
  PID:8744
- C:\Windows\System\viiAuNu.exe
  C:\Windows\System\viiAuNu.exe
  2⤵
  PID:8764
- C:\Windows\System\IJLoUxY.exe
  C:\Windows\System\IJLoUxY.exe
  2⤵
  PID:8796
- C:\Windows\System\iLszfSs.exe
  C:\Windows\System\iLszfSs.exe
  2⤵
  PID:8832
- C:\Windows\System\XIHKzSU.exe
  C:\Windows\System\XIHKzSU.exe
  2⤵
  PID:8856
- C:\Windows\System\hORWiXm.exe
  C:\Windows\System\hORWiXm.exe
  2⤵
  PID:8888
- C:\Windows\System\xVLJRhK.exe
  C:\Windows\System\xVLJRhK.exe
  2⤵
  PID:8920
- C:\Windows\System\HFsOgzt.exe
  C:\Windows\System\HFsOgzt.exe
  2⤵
  PID:8948
- C:\Windows\System\cuWtrfp.exe
  C:\Windows\System\cuWtrfp.exe
  2⤵
  PID:8976
- C:\Windows\System\CjnWKRB.exe
  C:\Windows\System\CjnWKRB.exe
  2⤵
  PID:9008
- C:\Windows\System\jwGPuXe.exe
  C:\Windows\System\jwGPuXe.exe
  2⤵
  PID:9032
- C:\Windows\System\VaLZzPG.exe
  C:\Windows\System\VaLZzPG.exe
  2⤵
  PID:9060
- C:\Windows\System\QzTfkPD.exe
  C:\Windows\System\QzTfkPD.exe
  2⤵
  PID:9092
- C:\Windows\System\hOZDLms.exe
  C:\Windows\System\hOZDLms.exe
  2⤵
  PID:9124
- C:\Windows\System\guFVGpi.exe
  C:\Windows\System\guFVGpi.exe
  2⤵
  PID:9156
- C:\Windows\System\MfjvYgx.exe
  C:\Windows\System\MfjvYgx.exe
  2⤵
  PID:9188
- C:\Windows\System\axlfvFg.exe
  C:\Windows\System\axlfvFg.exe
  2⤵
  PID:9212
- C:\Windows\System\sAvQFFg.exe
  C:\Windows\System\sAvQFFg.exe
  2⤵
  PID:7644
- C:\Windows\System\MNfIDTv.exe
  C:\Windows\System\MNfIDTv.exe
  2⤵
  PID:8212
- C:\Windows\System\OmZAoCR.exe
  C:\Windows\System\OmZAoCR.exe
  2⤵
  PID:8236
- C:\Windows\System\ZnNniMH.exe
  C:\Windows\System\ZnNniMH.exe
  2⤵
  PID:8324
- C:\Windows\System\AhXLNgW.exe
  C:\Windows\System\AhXLNgW.exe
  2⤵
  PID:8400
- C:\Windows\System\reKCpKk.exe
  C:\Windows\System\reKCpKk.exe
  2⤵
  PID:8452
- C:\Windows\System\rCYfQpn.exe
  C:\Windows\System\rCYfQpn.exe
  2⤵
  PID:8456
- C:\Windows\System\AuQxvSu.exe
  C:\Windows\System\AuQxvSu.exe
  2⤵
  PID:8572
- C:\Windows\System\slowmVt.exe
  C:\Windows\System\slowmVt.exe
  2⤵
  PID:8632
- C:\Windows\System\skWyctm.exe
  C:\Windows\System\skWyctm.exe
  2⤵
  PID:8716
- C:\Windows\System\MpoJKIX.exe
  C:\Windows\System\MpoJKIX.exe
  2⤵
  PID:8760
- C:\Windows\System\ELTDQfk.exe
  C:\Windows\System\ELTDQfk.exe
  2⤵
  PID:8812
- C:\Windows\System\UCjgbNI.exe
  C:\Windows\System\UCjgbNI.exe
  2⤵
  PID:8848
- C:\Windows\System\CKvdDzt.exe
  C:\Windows\System\CKvdDzt.exe
  2⤵
  PID:8960
- C:\Windows\System\EVULSXh.exe
  C:\Windows\System\EVULSXh.exe
  2⤵
  PID:9016
- C:\Windows\System\IktRbic.exe
  C:\Windows\System\IktRbic.exe
  2⤵
  PID:9084
- C:\Windows\System\mdEGWEN.exe
  C:\Windows\System\mdEGWEN.exe
  2⤵
  PID:9108
- C:\Windows\System\BSFIvQn.exe
  C:\Windows\System\BSFIvQn.exe
  2⤵
  PID:9140
- C:\Windows\System\RdIRBKX.exe
  C:\Windows\System\RdIRBKX.exe
  2⤵
  PID:7628
- C:\Windows\System\SYESLwu.exe
  C:\Windows\System\SYESLwu.exe
  2⤵
  PID:8260
- C:\Windows\System\pnmnJfl.exe
  C:\Windows\System\pnmnJfl.exe
  2⤵
  PID:8476
- C:\Windows\System\dOohIaD.exe
  C:\Windows\System\dOohIaD.exe
  2⤵
  PID:8396
- C:\Windows\System\uNhPQEc.exe
  C:\Windows\System\uNhPQEc.exe
  2⤵
  PID:8620
- C:\Windows\System\raxVCgX.exe
  C:\Windows\System\raxVCgX.exe
  2⤵
  PID:8692
- C:\Windows\System\TYjklVv.exe
  C:\Windows\System\TYjklVv.exe
  2⤵
  PID:8904
- C:\Windows\System\dEmMpBH.exe
  C:\Windows\System\dEmMpBH.exe
  2⤵
  PID:9024
- C:\Windows\System\BmmVsfx.exe
  C:\Windows\System\BmmVsfx.exe
  2⤵
  PID:9148
- C:\Windows\System\qQCgXRR.exe
  C:\Windows\System\qQCgXRR.exe
  2⤵
  PID:9200
- C:\Windows\System\tROImwD.exe
  C:\Windows\System\tROImwD.exe
  2⤵
  PID:9072
- C:\Windows\System\EVZYqtI.exe
  C:\Windows\System\EVZYqtI.exe
  2⤵
  PID:8700
- C:\Windows\System\wssjsgJ.exe
  C:\Windows\System\wssjsgJ.exe
  2⤵
  PID:9228
- C:\Windows\System\QgjMyhx.exe
  C:\Windows\System\QgjMyhx.exe
  2⤵
  PID:9244
- C:\Windows\System\jKgruwQ.exe
  C:\Windows\System\jKgruwQ.exe
  2⤵
  PID:9268
- C:\Windows\System\iSozUGx.exe
  C:\Windows\System\iSozUGx.exe
  2⤵
  PID:9296
- C:\Windows\System\MOjqKEJ.exe
  C:\Windows\System\MOjqKEJ.exe
  2⤵
  PID:9328
- C:\Windows\System\wUclsfr.exe
  C:\Windows\System\wUclsfr.exe
  2⤵
  PID:9360
- C:\Windows\System\gMJJOnR.exe
  C:\Windows\System\gMJJOnR.exe
  2⤵
  PID:9388
- C:\Windows\System\ZmDiPSF.exe
  C:\Windows\System\ZmDiPSF.exe
  2⤵
  PID:9420
- C:\Windows\System\BlIqNBV.exe
  C:\Windows\System\BlIqNBV.exe
  2⤵
  PID:9448
- C:\Windows\System\akbMCLX.exe
  C:\Windows\System\akbMCLX.exe
  2⤵
  PID:9480
- C:\Windows\System\vmziQjq.exe
  C:\Windows\System\vmziQjq.exe
  2⤵
  PID:9504
- C:\Windows\System\LTwasKA.exe
  C:\Windows\System\LTwasKA.exe
  2⤵
  PID:9524
- C:\Windows\System\AukTHAT.exe
  C:\Windows\System\AukTHAT.exe
  2⤵
  PID:9580
- C:\Windows\System\OSbAzbg.exe
  C:\Windows\System\OSbAzbg.exe
  2⤵
  PID:9600
- C:\Windows\System\IJowXHi.exe
  C:\Windows\System\IJowXHi.exe
  2⤵
  PID:9632
- C:\Windows\System\XXetYfR.exe
  C:\Windows\System\XXetYfR.exe
  2⤵
  PID:9664
- C:\Windows\System\ahjGtnx.exe
  C:\Windows\System\ahjGtnx.exe
  2⤵
  PID:9696
- C:\Windows\System\qVXokFh.exe
  C:\Windows\System\qVXokFh.exe
  2⤵
  PID:9724
- C:\Windows\System\gKShopq.exe
  C:\Windows\System\gKShopq.exe
  2⤵
  PID:9752
- C:\Windows\System\kAvkSxB.exe
  C:\Windows\System\kAvkSxB.exe
  2⤵
  PID:9780
- C:\Windows\System\uUIAZrh.exe
  C:\Windows\System\uUIAZrh.exe
  2⤵
  PID:9812
- C:\Windows\System\cFbONQu.exe
  C:\Windows\System\cFbONQu.exe
  2⤵
  PID:9840
- C:\Windows\System\YTEPDsn.exe
  C:\Windows\System\YTEPDsn.exe
  2⤵
  PID:9868
- C:\Windows\System\KlGOihQ.exe
  C:\Windows\System\KlGOihQ.exe
  2⤵
  PID:9900
- C:\Windows\System\YVNreAG.exe
  C:\Windows\System\YVNreAG.exe
  2⤵
  PID:9932
- C:\Windows\System\MjpFBjx.exe
  C:\Windows\System\MjpFBjx.exe
  2⤵
  PID:9956
- C:\Windows\System\kKBpiVy.exe
  C:\Windows\System\kKBpiVy.exe
  2⤵
  PID:9984
- C:\Windows\System\RxhPnKG.exe
  C:\Windows\System\RxhPnKG.exe
  2⤵
  PID:10008
- C:\Windows\System\WolGvNr.exe
  C:\Windows\System\WolGvNr.exe
  2⤵
  PID:10036
- C:\Windows\System\VdfTael.exe
  C:\Windows\System\VdfTael.exe
  2⤵
  PID:10076
- C:\Windows\System\xOzrftj.exe
  C:\Windows\System\xOzrftj.exe
  2⤵
  PID:10100
- C:\Windows\System\frHGqWO.exe
  C:\Windows\System\frHGqWO.exe
  2⤵
  PID:10120
- C:\Windows\System\MkRemZf.exe
  C:\Windows\System\MkRemZf.exe
  2⤵
  PID:10152
- C:\Windows\System\tmNnAaQ.exe
  C:\Windows\System\tmNnAaQ.exe
  2⤵
  PID:10180
- C:\Windows\System\wIilLWp.exe
  C:\Windows\System\wIilLWp.exe
  2⤵
  PID:10200
- C:\Windows\System\SOgdyph.exe
  C:\Windows\System\SOgdyph.exe
  2⤵
  PID:10228
- C:\Windows\System\jNvzgdR.exe
  C:\Windows\System\jNvzgdR.exe
  2⤵
  PID:9048
- C:\Windows\System\kIrNEuO.exe
  C:\Windows\System\kIrNEuO.exe
  2⤵
  PID:8360
- C:\Windows\System\qNVFYgZ.exe
  C:\Windows\System\qNVFYgZ.exe
  2⤵
  PID:9208
- C:\Windows\System\xGnhaLH.exe
  C:\Windows\System\xGnhaLH.exe
  2⤵
  PID:9372
- C:\Windows\System\kKhKVrX.exe
  C:\Windows\System\kKhKVrX.exe
  2⤵
  PID:9276
- C:\Windows\System\IuMFnzi.exe
  C:\Windows\System\IuMFnzi.exe
  2⤵
  PID:9472
- C:\Windows\System\QUrSKML.exe
  C:\Windows\System\QUrSKML.exe
  2⤵
  PID:9596
- C:\Windows\System\xtdQWYQ.exe
  C:\Windows\System\xtdQWYQ.exe
  2⤵
  PID:9652
- C:\Windows\System\zPrluuN.exe
  C:\Windows\System\zPrluuN.exe
  2⤵
  PID:9720
- C:\Windows\System\aDLMlYV.exe
  C:\Windows\System\aDLMlYV.exe
  2⤵
  PID:9768
- C:\Windows\System\RYjVzOo.exe
  C:\Windows\System\RYjVzOo.exe
  2⤵
  PID:9684
- C:\Windows\System\wjAKItb.exe
  C:\Windows\System\wjAKItb.exe
  2⤵
  PID:9820
- C:\Windows\System\OPcuIWX.exe
  C:\Windows\System\OPcuIWX.exe
  2⤵
  PID:9996
- C:\Windows\System\CtUbCya.exe
  C:\Windows\System\CtUbCya.exe
  2⤵
  PID:9948
- C:\Windows\System\qwIMAEt.exe
  C:\Windows\System\qwIMAEt.exe
  2⤵
  PID:10056
- C:\Windows\System\nfPENfn.exe
  C:\Windows\System\nfPENfn.exe
  2⤵
  PID:9980
- C:\Windows\System\AtgLPHB.exe
  C:\Windows\System\AtgLPHB.exe
  2⤵
  PID:10212
- C:\Windows\System\pHpBLAr.exe
  C:\Windows\System\pHpBLAr.exe
  2⤵
  PID:7408
- C:\Windows\System\PseasNU.exe
  C:\Windows\System\PseasNU.exe
  2⤵
  PID:9280
- C:\Windows\System\bzcOvgc.exe
  C:\Windows\System\bzcOvgc.exe
  2⤵
  PID:9444
- C:\Windows\System\NbUEJPN.exe
  C:\Windows\System\NbUEJPN.exe
  2⤵
  PID:7936
- C:\Windows\System\qkLqsrL.exe
  C:\Windows\System\qkLqsrL.exe
  2⤵
  PID:9500
- C:\Windows\System\CIGngGv.exe
  C:\Windows\System\CIGngGv.exe
  2⤵
  PID:9796
- C:\Windows\System\qVuezZp.exe
  C:\Windows\System\qVuezZp.exe
  2⤵
  PID:10108
- C:\Windows\System\zVphezp.exe
  C:\Windows\System\zVphezp.exe
  2⤵
  PID:10088
- C:\Windows\System\SNtYqrg.exe
  C:\Windows\System\SNtYqrg.exe
  2⤵
  PID:10260
- C:\Windows\System\jyPQZiG.exe
  C:\Windows\System\jyPQZiG.exe
  2⤵
  PID:10284
- C:\Windows\System\PheXHDt.exe
  C:\Windows\System\PheXHDt.exe
  2⤵
  PID:10324
- C:\Windows\System\kITsPvt.exe
  C:\Windows\System\kITsPvt.exe
  2⤵
  PID:10360
- C:\Windows\System\vJvSZbD.exe
  C:\Windows\System\vJvSZbD.exe
  2⤵
  PID:10392
- C:\Windows\System\hlHxJUy.exe
  C:\Windows\System\hlHxJUy.exe
  2⤵
  PID:10416
- C:\Windows\System\eJgEpLu.exe
  C:\Windows\System\eJgEpLu.exe
  2⤵
  PID:10452
- C:\Windows\System\cwkOarO.exe
  C:\Windows\System\cwkOarO.exe
  2⤵
  PID:10476
- C:\Windows\System\lWDXzjk.exe
  C:\Windows\System\lWDXzjk.exe
  2⤵
  PID:10504
- C:\Windows\System\ygXXCsV.exe
  C:\Windows\System\ygXXCsV.exe
  2⤵
  PID:10532
- C:\Windows\System\kjuFagq.exe
  C:\Windows\System\kjuFagq.exe
  2⤵
  PID:10564
- C:\Windows\System\YfLKAtN.exe
  C:\Windows\System\YfLKAtN.exe
  2⤵
  PID:10592
- C:\Windows\System\FDRxauC.exe
  C:\Windows\System\FDRxauC.exe
  2⤵
  PID:10608
- C:\Windows\System\ElgArcS.exe
  C:\Windows\System\ElgArcS.exe
  2⤵
  PID:10632
- C:\Windows\System\XLXuXmP.exe
  C:\Windows\System\XLXuXmP.exe
  2⤵
  PID:10656
- C:\Windows\System\EgNXJEn.exe
  C:\Windows\System\EgNXJEn.exe
  2⤵
  PID:10684
- C:\Windows\System\HVbWBAC.exe
  C:\Windows\System\HVbWBAC.exe
  2⤵
  PID:10708
- C:\Windows\System\DYzSabm.exe
  C:\Windows\System\DYzSabm.exe
  2⤵
  PID:10732
- C:\Windows\System\EMePeNb.exe
  C:\Windows\System\EMePeNb.exe
  2⤵
  PID:10756
- C:\Windows\System\jajfoHx.exe
  C:\Windows\System\jajfoHx.exe
  2⤵
  PID:10792
- C:\Windows\System\wenMYKl.exe
  C:\Windows\System\wenMYKl.exe
  2⤵
  PID:10824
- C:\Windows\System\zDKwOUb.exe
  C:\Windows\System\zDKwOUb.exe
  2⤵
  PID:10848
- C:\Windows\System\YrkUHDF.exe
  C:\Windows\System\YrkUHDF.exe
  2⤵
  PID:10876
- C:\Windows\System\dDoPCgb.exe
  C:\Windows\System\dDoPCgb.exe
  2⤵
  PID:10900
- C:\Windows\System\gJOcSpG.exe
  C:\Windows\System\gJOcSpG.exe
  2⤵
  PID:10936
- C:\Windows\System\XhgULyv.exe
  C:\Windows\System\XhgULyv.exe
  2⤵
  PID:10968
- C:\Windows\System\JjQKLWQ.exe
  C:\Windows\System\JjQKLWQ.exe
  2⤵
  PID:10996
- C:\Windows\System\RkGQSWy.exe
  C:\Windows\System\RkGQSWy.exe
  2⤵
  PID:11016
- C:\Windows\System\FfRHiAh.exe
  C:\Windows\System\FfRHiAh.exe
  2⤵
  PID:11048
- C:\Windows\System\IvOoDQs.exe
  C:\Windows\System\IvOoDQs.exe
  2⤵
  PID:11080
- C:\Windows\System\CHufryM.exe
  C:\Windows\System\CHufryM.exe
  2⤵
  PID:11112
- C:\Windows\System\BIZOHnG.exe
  C:\Windows\System\BIZOHnG.exe
  2⤵
  PID:11132
- C:\Windows\System\hsCMxHU.exe
  C:\Windows\System\hsCMxHU.exe
  2⤵
  PID:11152
- C:\Windows\System\YheQNJO.exe
  C:\Windows\System\YheQNJO.exe
  2⤵
  PID:11176
- C:\Windows\System\QGkCTjI.exe
  C:\Windows\System\QGkCTjI.exe
  2⤵
  PID:11200
- C:\Windows\System\wgsJXJJ.exe
  C:\Windows\System\wgsJXJJ.exe
  2⤵
  PID:11228
- C:\Windows\System\Qkmvoxs.exe
  C:\Windows\System\Qkmvoxs.exe
  2⤵
  PID:11248
- C:\Windows\System\FiBnPuU.exe
  C:\Windows\System\FiBnPuU.exe
  2⤵
  PID:9240
- C:\Windows\System\wKMOTxt.exe
  C:\Windows\System\wKMOTxt.exe
  2⤵
  PID:9708
- C:\Windows\System\uaXUNdq.exe
  C:\Windows\System\uaXUNdq.exe
  2⤵
  PID:9304
- C:\Windows\System\iGrWmjC.exe
  C:\Windows\System\iGrWmjC.exe
  2⤵
  PID:10312
- C:\Windows\System\UhYhtWv.exe
  C:\Windows\System\UhYhtWv.exe
  2⤵
  PID:10248
- C:\Windows\System\CsDonvb.exe
  C:\Windows\System\CsDonvb.exe
  2⤵
  PID:10500
- C:\Windows\System\YlaXHxm.exe
  C:\Windows\System\YlaXHxm.exe
  2⤵
  PID:10436
- C:\Windows\System\BSZmOoY.exe
  C:\Windows\System\BSZmOoY.exe
  2⤵
  PID:10600
- C:\Windows\System\ZomfzTF.exe
  C:\Windows\System\ZomfzTF.exe
  2⤵
  PID:10672
- C:\Windows\System\mFFfTUo.exe
  C:\Windows\System\mFFfTUo.exe
  2⤵
  PID:10700
- C:\Windows\System\wulAuUn.exe
  C:\Windows\System\wulAuUn.exe
  2⤵
  PID:10860
- C:\Windows\System\HBfUXZc.exe
  C:\Windows\System\HBfUXZc.exe
  2⤵
  PID:10868
- C:\Windows\System\rUcLxVP.exe
  C:\Windows\System\rUcLxVP.exe
  2⤵
  PID:11072
- C:\Windows\System\ImQGmje.exe
  C:\Windows\System\ImQGmje.exe
  2⤵
  PID:11168
- C:\Windows\System\vQIeUes.exe
  C:\Windows\System\vQIeUes.exe
  2⤵
  PID:10928
- C:\Windows\System\ctcGHhQ.exe
  C:\Windows\System\ctcGHhQ.exe
  2⤵
  PID:11240
- C:\Windows\System\fsnoGHP.exe
  C:\Windows\System\fsnoGHP.exe
  2⤵
  PID:11012
- C:\Windows\System\BrSgUoC.exe
  C:\Windows\System\BrSgUoC.exe
  2⤵
  PID:11220
- C:\Windows\System\tWnogLj.exe
  C:\Windows\System\tWnogLj.exe
  2⤵
  PID:9740
- C:\Windows\System\iLBLTwe.exe
  C:\Windows\System\iLBLTwe.exe
  2⤵
  PID:10776
- C:\Windows\System\eBaxNIu.exe
  C:\Windows\System\eBaxNIu.exe
  2⤵
  PID:10552
- C:\Windows\System\LqcNSSH.exe
  C:\Windows\System\LqcNSSH.exe
  2⤵
  PID:10724
- C:\Windows\System\UwUysBV.exe
  C:\Windows\System\UwUysBV.exe
  2⤵
  PID:11288
- C:\Windows\System\VmqQnrT.exe
  C:\Windows\System\VmqQnrT.exe
  2⤵
  PID:11308
- C:\Windows\System\kCJcrvT.exe
  C:\Windows\System\kCJcrvT.exe
  2⤵
  PID:11332
- C:\Windows\System\cqwZvWV.exe
  C:\Windows\System\cqwZvWV.exe
  2⤵
  PID:11364
- C:\Windows\System\zWLgMiy.exe
  C:\Windows\System\zWLgMiy.exe
  2⤵
  PID:11384
- C:\Windows\System\VzYLJsI.exe
  C:\Windows\System\VzYLJsI.exe
  2⤵
  PID:11420
- C:\Windows\System\ZaslapY.exe
  C:\Windows\System\ZaslapY.exe
  2⤵
  PID:11448
- C:\Windows\System\jKnsHvj.exe
  C:\Windows\System\jKnsHvj.exe
  2⤵
  PID:11472
- C:\Windows\System\JEKuJTA.exe
  C:\Windows\System\JEKuJTA.exe
  2⤵
  PID:11496
- C:\Windows\System\imtAurs.exe
  C:\Windows\System\imtAurs.exe
  2⤵
  PID:11528
- C:\Windows\System\CGIJkIh.exe
  C:\Windows\System\CGIJkIh.exe
  2⤵
  PID:11548
- C:\Windows\System\yneuBCO.exe
  C:\Windows\System\yneuBCO.exe
  2⤵
  PID:11576
- C:\Windows\System\pkbsnPz.exe
  C:\Windows\System\pkbsnPz.exe
  2⤵
  PID:11604
- C:\Windows\System\rxJXjer.exe
  C:\Windows\System\rxJXjer.exe
  2⤵
  PID:11628
- C:\Windows\System\swPYoaR.exe
  C:\Windows\System\swPYoaR.exe
  2⤵
  PID:11644
- C:\Windows\System\utPXBmM.exe
  C:\Windows\System\utPXBmM.exe
  2⤵
  PID:11676
- C:\Windows\System\WYDDpPb.exe
  C:\Windows\System\WYDDpPb.exe
  2⤵
  PID:11696
- C:\Windows\System\ksoFAzM.exe
  C:\Windows\System\ksoFAzM.exe
  2⤵
  PID:11728
- C:\Windows\System\zCRAiFT.exe
  C:\Windows\System\zCRAiFT.exe
  2⤵
  PID:11756
- C:\Windows\System\wPcPdWx.exe
  C:\Windows\System\wPcPdWx.exe
  2⤵
  PID:11792
- C:\Windows\System\GoVMfwA.exe
  C:\Windows\System\GoVMfwA.exe
  2⤵
  PID:11824
- C:\Windows\System\qOCnTEE.exe
  C:\Windows\System\qOCnTEE.exe
  2⤵
  PID:11844
- C:\Windows\System\bKnQUQN.exe
  C:\Windows\System\bKnQUQN.exe
  2⤵
  PID:11876
- C:\Windows\System\HldgMnz.exe
  C:\Windows\System\HldgMnz.exe
  2⤵
  PID:11904
- C:\Windows\System\lvQttQQ.exe
  C:\Windows\System\lvQttQQ.exe
  2⤵
  PID:11928
- C:\Windows\System\SeTdLyM.exe
  C:\Windows\System\SeTdLyM.exe
  2⤵
  PID:11956
- C:\Windows\System\ASoGYrO.exe
  C:\Windows\System\ASoGYrO.exe
  2⤵
  PID:11992
- C:\Windows\System\MVyoJGv.exe
  C:\Windows\System\MVyoJGv.exe
  2⤵
  PID:12012
- C:\Windows\System\FryBwQV.exe
  C:\Windows\System\FryBwQV.exe
  2⤵
  PID:12048
- C:\Windows\System\mlnxoXz.exe
  C:\Windows\System\mlnxoXz.exe
  2⤵
  PID:12072
- C:\Windows\System\upRaNqT.exe
  C:\Windows\System\upRaNqT.exe
  2⤵
  PID:12096
- C:\Windows\System\WrtFUiN.exe
  C:\Windows\System\WrtFUiN.exe
  2⤵
  PID:12120
- C:\Windows\System\lbFmQaO.exe
  C:\Windows\System\lbFmQaO.exe
  2⤵
  PID:12152
- C:\Windows\System\WqDBAIY.exe
  C:\Windows\System\WqDBAIY.exe
  2⤵
  PID:12172
- C:\Windows\System\CZOZkXA.exe
  C:\Windows\System\CZOZkXA.exe
  2⤵
  PID:12200
- C:\Windows\System\goUYkVW.exe
  C:\Windows\System\goUYkVW.exe
  2⤵
  PID:12220
- C:\Windows\System\aVJcHsB.exe
  C:\Windows\System\aVJcHsB.exe
  2⤵
  PID:12252
- C:\Windows\System\fpMxAhk.exe
  C:\Windows\System\fpMxAhk.exe
  2⤵
  PID:12280
- C:\Windows\System\szeJELY.exe
  C:\Windows\System\szeJELY.exe
  2⤵
  PID:10980
- C:\Windows\System\QOHpvoy.exe
  C:\Windows\System\QOHpvoy.exe
  2⤵
  PID:11192
- C:\Windows\System\pwlemqR.exe
  C:\Windows\System\pwlemqR.exe
  2⤵
  PID:11272
- C:\Windows\System\gRgkyWj.exe
  C:\Windows\System\gRgkyWj.exe
  2⤵
  PID:11340
- C:\Windows\System\IFGtSKX.exe
  C:\Windows\System\IFGtSKX.exe
  2⤵
  PID:10744
- C:\Windows\System\KGscGDx.exe
  C:\Windows\System\KGscGDx.exe
  2⤵
  PID:11444
- C:\Windows\System\vNOvSAM.exe
  C:\Windows\System\vNOvSAM.exe
  2⤵
  PID:11376
- C:\Windows\System\NTvaPEL.exe
  C:\Windows\System\NTvaPEL.exe
  2⤵
  PID:11640
- C:\Windows\System\WVNBkNI.exe
  C:\Windows\System\WVNBkNI.exe
  2⤵
  PID:11316
- C:\Windows\System\MHqRMLY.exe
  C:\Windows\System\MHqRMLY.exe
  2⤵
  PID:11784
- C:\Windows\System\xgxgDOc.exe
  C:\Windows\System\xgxgDOc.exe
  2⤵
  PID:11620
- C:\Windows\System\SOeLnQm.exe
  C:\Windows\System\SOeLnQm.exe
  2⤵
  PID:11944
- C:\Windows\System\pWcHcmB.exe
  C:\Windows\System\pWcHcmB.exe
  2⤵
  PID:11808
- C:\Windows\System\DpqSWhE.exe
  C:\Windows\System\DpqSWhE.exe
  2⤵
  PID:11688
- C:\Windows\System\DqTZKVS.exe
  C:\Windows\System\DqTZKVS.exe
  2⤵
  PID:12028
- C:\Windows\System\pAKeFZv.exe
  C:\Windows\System\pAKeFZv.exe
  2⤵
  PID:12168
- C:\Windows\System\QJHZCdi.exe
  C:\Windows\System\QJHZCdi.exe
  2⤵
  PID:11892
- C:\Windows\System\eWmEPAG.exe
  C:\Windows\System\eWmEPAG.exe
  2⤵
  PID:12244
- C:\Windows\System\JgumrNw.exe
  C:\Windows\System\JgumrNw.exe
  2⤵
  PID:12132
- C:\Windows\System\mptpHls.exe
  C:\Windows\System\mptpHls.exe
  2⤵
  PID:12008
- C:\Windows\System\HFdEIGu.exe
  C:\Windows\System\HFdEIGu.exe
  2⤵
  PID:10772
- C:\Windows\System\ULjBpqx.exe
  C:\Windows\System\ULjBpqx.exe
  2⤵
  PID:12184
- C:\Windows\System\NhpXyna.exe
  C:\Windows\System\NhpXyna.exe
  2⤵
  PID:11148
- C:\Windows\System\RxhTqnx.exe
  C:\Windows\System\RxhTqnx.exe
  2⤵
  PID:10308
- C:\Windows\System\xKAdIsz.exe
  C:\Windows\System\xKAdIsz.exe
  2⤵
  PID:11488
- C:\Windows\System\pLHDNEq.exe
  C:\Windows\System\pLHDNEq.exe
  2⤵
  PID:11572
- C:\Windows\System\GVFApvY.exe
  C:\Windows\System\GVFApvY.exe
  2⤵
  PID:12192
- C:\Windows\System\EAWKRFi.exe
  C:\Windows\System\EAWKRFi.exe
  2⤵
  PID:12300
- C:\Windows\System\TlHwKjd.exe
  C:\Windows\System\TlHwKjd.exe
  2⤵
  PID:12332
- C:\Windows\System\SvWkytx.exe
  C:\Windows\System\SvWkytx.exe
  2⤵
  PID:12364
- C:\Windows\System\OcwiGZf.exe
  C:\Windows\System\OcwiGZf.exe
  2⤵
  PID:12384
- C:\Windows\System\yaddsJU.exe
  C:\Windows\System\yaddsJU.exe
  2⤵
  PID:12416
- C:\Windows\System\ajnrlBJ.exe
  C:\Windows\System\ajnrlBJ.exe
  2⤵
  PID:12448
- C:\Windows\System\CJyEwQG.exe
  C:\Windows\System\CJyEwQG.exe
  2⤵
  PID:12476
- C:\Windows\System\BvvoZNi.exe
  C:\Windows\System\BvvoZNi.exe
  2⤵
  PID:12500
- C:\Windows\System\dbfDNhY.exe
  C:\Windows\System\dbfDNhY.exe
  2⤵
  PID:12516
- C:\Windows\System\cUhjrkx.exe
  C:\Windows\System\cUhjrkx.exe
  2⤵
  PID:12548
- C:\Windows\System\SNJcfzh.exe
  C:\Windows\System\SNJcfzh.exe
  2⤵
  PID:12572
- C:\Windows\System\dpulEpy.exe
  C:\Windows\System\dpulEpy.exe
  2⤵
  PID:12596
- C:\Windows\System\riKqfVK.exe
  C:\Windows\System\riKqfVK.exe
  2⤵
  PID:12616
- C:\Windows\System\GDcvZDg.exe
  C:\Windows\System\GDcvZDg.exe
  2⤵
  PID:12640
- C:\Windows\System\pRAnMIw.exe
  C:\Windows\System\pRAnMIw.exe
  2⤵
  PID:12656
- C:\Windows\System\JlUhlqh.exe
  C:\Windows\System\JlUhlqh.exe
  2⤵
  PID:12672
- C:\Windows\System\DywnoRC.exe
  C:\Windows\System\DywnoRC.exe
  2⤵
  PID:12704
- C:\Windows\System\gBAHhxV.exe
  C:\Windows\System\gBAHhxV.exe
  2⤵
  PID:12740
- C:\Windows\System\RXBYZxK.exe
  C:\Windows\System\RXBYZxK.exe
  2⤵
  PID:12764
- C:\Windows\System\Kpkphbu.exe
  C:\Windows\System\Kpkphbu.exe
  2⤵
  PID:12784
- C:\Windows\System\coBadow.exe
  C:\Windows\System\coBadow.exe
  2⤵
  PID:12816
- C:\Windows\System\DEcKTDb.exe
  C:\Windows\System\DEcKTDb.exe
  2⤵
  PID:12832
- C:\Windows\System\kdbclYD.exe
  C:\Windows\System\kdbclYD.exe
  2⤵
  PID:12848
- C:\Windows\System\TvqMFQa.exe
  C:\Windows\System\TvqMFQa.exe
  2⤵
  PID:12864
- C:\Windows\System\UZJWbaa.exe
  C:\Windows\System\UZJWbaa.exe
  2⤵
  PID:12888
- C:\Windows\System\LqOOSWN.exe
  C:\Windows\System\LqOOSWN.exe
  2⤵
  PID:12916
- C:\Windows\System\EzleBzJ.exe
  C:\Windows\System\EzleBzJ.exe
  2⤵
  PID:12940
- C:\Windows\System\UZwaGwt.exe
  C:\Windows\System\UZwaGwt.exe
  2⤵
  PID:12956
- C:\Windows\System\uIAxacN.exe
  C:\Windows\System\uIAxacN.exe
  2⤵
  PID:12988
- C:\Windows\System\xOvotrm.exe
  C:\Windows\System\xOvotrm.exe
  2⤵
  PID:13012
- C:\Windows\System\NECehVv.exe
  C:\Windows\System\NECehVv.exe
  2⤵
  PID:13036
- C:\Windows\System\OyIEPkE.exe
  C:\Windows\System\OyIEPkE.exe
  2⤵
  PID:13080
- C:\Windows\System\TyiHdIP.exe
  C:\Windows\System\TyiHdIP.exe
  2⤵
  PID:13100
- C:\Windows\System\vCaMxFs.exe
  C:\Windows\System\vCaMxFs.exe
  2⤵
  PID:13124
- C:\Windows\System\iQnaccX.exe
  C:\Windows\System\iQnaccX.exe
  2⤵
  PID:13144
- C:\Windows\System\ucUKXRx.exe
  C:\Windows\System\ucUKXRx.exe
  2⤵
  PID:13172
- C:\Windows\System\zzRgfSx.exe
  C:\Windows\System\zzRgfSx.exe
  2⤵
  PID:13192
- C:\Windows\System\cVvLCrk.exe
  C:\Windows\System\cVvLCrk.exe
  2⤵
  PID:13220
- C:\Windows\System\lcPWkoO.exe
  C:\Windows\System\lcPWkoO.exe
  2⤵
  PID:13256
- C:\Windows\System\CbCefQJ.exe
  C:\Windows\System\CbCefQJ.exe
  2⤵
  PID:13280
- C:\Windows\System\HRvOako.exe
  C:\Windows\System\HRvOako.exe
  2⤵
  PID:13308
- C:\Windows\System\aaGNpeY.exe
  C:\Windows\System\aaGNpeY.exe
  2⤵
  PID:11588
- C:\Windows\System\heZWPiv.exe
  C:\Windows\System\heZWPiv.exe
  2⤵
  PID:10988
- C:\Windows\System\ipIBbXM.exe
  C:\Windows\System\ipIBbXM.exe
  2⤵
  PID:12276
- C:\Windows\System\KlKoBdt.exe
  C:\Windows\System\KlKoBdt.exe
  2⤵
  PID:11888
- C:\Windows\System\gQqWWax.exe
  C:\Windows\System\gQqWWax.exe
  2⤵
  PID:10272
- C:\Windows\System\pvkdVeK.exe
  C:\Windows\System\pvkdVeK.exe
  2⤵
  PID:9884
- C:\Windows\System\uiZdSou.exe
  C:\Windows\System\uiZdSou.exe
  2⤵
  PID:12484
- C:\Windows\System\vlZZitL.exe
  C:\Windows\System\vlZZitL.exe
  2⤵
  PID:12540
- C:\Windows\System\jOZtVIN.exe
  C:\Windows\System\jOZtVIN.exe
  2⤵
  PID:12320
- C:\Windows\System\oMVaPFD.exe
  C:\Windows\System\oMVaPFD.exe
  2⤵
  PID:12856
- C:\Windows\System\UlXBmmX.exe
  C:\Windows\System\UlXBmmX.exe
  2⤵
  PID:12440
- C:\Windows\System\ehzrkZc.exe
  C:\Windows\System\ehzrkZc.exe
  2⤵
  PID:12948
- C:\Windows\System\OBKUMPb.exe
  C:\Windows\System\OBKUMPb.exe
  2⤵
  PID:12508
- C:\Windows\System\aNUBpOv.exe
  C:\Windows\System\aNUBpOv.exe
  2⤵
  PID:13140
- C:\Windows\System\DwVbTZA.exe
  C:\Windows\System\DwVbTZA.exe
  2⤵
  PID:12700
- C:\Windows\System\AIzcQDQ.exe
  C:\Windows\System\AIzcQDQ.exe
  2⤵
  PID:12900
- C:\Windows\System\dBSdfom.exe
  C:\Windows\System\dBSdfom.exe
  2⤵
  PID:13204
- C:\Windows\System\yLkvBBy.exe
  C:\Windows\System\yLkvBBy.exe
  2⤵
  PID:13160
- C:\Windows\System\aCOBwvD.exe
  C:\Windows\System\aCOBwvD.exe
  2⤵
  PID:12632
- C:\Windows\System\mcfCOtF.exe
  C:\Windows\System\mcfCOtF.exe
  2⤵
  PID:13276
- C:\Windows\System\cKfCRfD.exe
  C:\Windows\System\cKfCRfD.exe
  2⤵
  PID:13336
- C:\Windows\System\tdVPYlX.exe
  C:\Windows\System\tdVPYlX.exe
  2⤵
  PID:13356
- C:\Windows\System\VNLXMoG.exe
  C:\Windows\System\VNLXMoG.exe
  2⤵
  PID:13372
- C:\Windows\System\PhXhEtz.exe
  C:\Windows\System\PhXhEtz.exe
  2⤵
  PID:13396
- C:\Windows\System\NCfjBgs.exe
  C:\Windows\System\NCfjBgs.exe
  2⤵
  PID:13412
- C:\Windows\System\kPmkSqv.exe
  C:\Windows\System\kPmkSqv.exe
  2⤵
  PID:13432
- C:\Windows\System\XnsTYYa.exe
  C:\Windows\System\XnsTYYa.exe
  2⤵
  PID:13468
- C:\Windows\System\dUOWrqG.exe
  C:\Windows\System\dUOWrqG.exe
  2⤵
  PID:13492
- C:\Windows\System\AvLZmMd.exe
  C:\Windows\System\AvLZmMd.exe
  2⤵
  PID:13520
- C:\Windows\System\CSFfdMn.exe
  C:\Windows\System\CSFfdMn.exe
  2⤵
  PID:13544
- C:\Windows\System\mWyUzIv.exe
  C:\Windows\System\mWyUzIv.exe
  2⤵
  PID:13568
- C:\Windows\System\VPfPqwf.exe
  C:\Windows\System\VPfPqwf.exe
  2⤵
  PID:13604
- C:\Windows\System\xUxNXjj.exe
  C:\Windows\System\xUxNXjj.exe
  2⤵
  PID:13628
- C:\Windows\System\uONnDBY.exe
  C:\Windows\System\uONnDBY.exe
  2⤵
  PID:13648
- C:\Windows\System\QpIZtMO.exe
  C:\Windows\System\QpIZtMO.exe
  2⤵
  PID:13676
- C:\Windows\System\aNKDjkj.exe
  C:\Windows\System\aNKDjkj.exe
  2⤵
  PID:13704
- C:\Windows\System\YziCrEq.exe
  C:\Windows\System\YziCrEq.exe
  2⤵
  PID:13724
- C:\Windows\System\jekOrBB.exe
  C:\Windows\System\jekOrBB.exe
  2⤵
  PID:13744
- C:\Windows\System\gpzjinS.exe
  C:\Windows\System\gpzjinS.exe
  2⤵
  PID:13764
- C:\Windows\System\eTmJitq.exe
  C:\Windows\System\eTmJitq.exe
  2⤵
  PID:13792
- C:\Windows\System\fJnhcSc.exe
  C:\Windows\System\fJnhcSc.exe
  2⤵
  PID:13816
- C:\Windows\System\iGYaUhT.exe
  C:\Windows\System\iGYaUhT.exe
  2⤵
  PID:13844
- C:\Windows\System\gxaQUmB.exe
  C:\Windows\System\gxaQUmB.exe
  2⤵
  PID:13868
- C:\Windows\System\LPaIEEm.exe
  C:\Windows\System\LPaIEEm.exe
  2⤵
  PID:13900
- C:\Windows\System\feWiZAE.exe
  C:\Windows\System\feWiZAE.exe
  2⤵
  PID:13928
- C:\Windows\System\nmRaXVN.exe
  C:\Windows\System\nmRaXVN.exe
  2⤵
  PID:13948
- C:\Windows\System\RLizacj.exe
  C:\Windows\System\RLizacj.exe
  2⤵
  PID:13976
- C:\Windows\System\boskSdj.exe
  C:\Windows\System\boskSdj.exe
  2⤵
  PID:13996
- C:\Windows\System\IRbddce.exe
  C:\Windows\System\IRbddce.exe
  2⤵
  PID:14016
- C:\Windows\System\hclYsNa.exe
  C:\Windows\System\hclYsNa.exe
  2⤵
  PID:14040
- C:\Windows\System\gRldsnG.exe
  C:\Windows\System\gRldsnG.exe
  2⤵
  PID:14064
- C:\Windows\System\okhHgUI.exe
  C:\Windows\System\okhHgUI.exe
  2⤵
  PID:14088
- C:\Windows\System\wmPXDjz.exe
  C:\Windows\System\wmPXDjz.exe
  2⤵
  PID:14112
- C:\Windows\System\mfteKIC.exe
  C:\Windows\System\mfteKIC.exe
  2⤵
  PID:14144
- C:\Windows\System\oMlTqDK.exe
  C:\Windows\System\oMlTqDK.exe
  2⤵
  PID:14168
- C:\Windows\System\klJfnPY.exe
  C:\Windows\System\klJfnPY.exe
  2⤵
  PID:14188
- C:\Windows\System\RHkaifd.exe
  C:\Windows\System\RHkaifd.exe
  2⤵
  PID:14220
- C:\Windows\System\IcTkhig.exe
  C:\Windows\System\IcTkhig.exe
  2⤵
  PID:14256
- C:\Windows\System\cJihQyn.exe
  C:\Windows\System\cJihQyn.exe
  2⤵
  PID:14280
- C:\Windows\System\tDJSbvE.exe
  C:\Windows\System\tDJSbvE.exe
  2⤵
  PID:14300
- C:\Windows\System\cHVRfAk.exe
  C:\Windows\System\cHVRfAk.exe
  2⤵
  PID:14328
- C:\Windows\System\xDJKlsP.exe
  C:\Windows\System\xDJKlsP.exe
  2⤵
  PID:12528
- C:\Windows\System\LqFMGks.exe
  C:\Windows\System\LqFMGks.exe
  2⤵
  PID:13348
- C:\Windows\System\mpzgMId.exe
  C:\Windows\System\mpzgMId.exe
  2⤵
  PID:13456
- C:\Windows\System\NFKwMZK.exe
  C:\Windows\System\NFKwMZK.exe
  2⤵
  PID:13480
- C:\Windows\System\PNYyevh.exe
  C:\Windows\System\PNYyevh.exe
  2⤵
  PID:13516
- C:\Windows\System\nnmqwdQ.exe
  C:\Windows\System\nnmqwdQ.exe
  2⤵
  PID:13556
- C:\Windows\System\CsoRjFE.exe
  C:\Windows\System\CsoRjFE.exe
  2⤵
  PID:13600
- C:\Windows\System\inJrFBk.exe
  C:\Windows\System\inJrFBk.exe
  2⤵
  PID:13752
- C:\Windows\System\bKOkalJ.exe
  C:\Windows\System\bKOkalJ.exe
  2⤵
  PID:13812
- C:\Windows\System\rsmIGTG.exe
  C:\Windows\System\rsmIGTG.exe
  2⤵
  PID:13736
- C:\Windows\System\NUZnoAv.exe
  C:\Windows\System\NUZnoAv.exe
  2⤵
  PID:13888
- C:\Windows\System\LnaCemr.exe
  C:\Windows\System\LnaCemr.exe
  2⤵
  PID:13920
- C:\Windows\System\BvYaCJZ.exe
  C:\Windows\System\BvYaCJZ.exe
  2⤵
  PID:13964
- C:\Windows\System\jRbLqOB.exe
  C:\Windows\System\jRbLqOB.exe
  2⤵
  PID:14140
- C:\Windows\System\wbQuWZC.exe
  C:\Windows\System\wbQuWZC.exe
  2⤵
  PID:14204
- C:\Windows\System\kYHIdPs.exe
  C:\Windows\System\kYHIdPs.exe
  2⤵
  PID:14080
- C:\Windows\System\gkBYDiJ.exe
  C:\Windows\System\gkBYDiJ.exe
  2⤵
  PID:14236
- C:\Windows\System\JUNdGOv.exe
  C:\Windows\System\JUNdGOv.exe
  2⤵
  PID:14036
- C:\Windows\System\DnDwMWT.exe
  C:\Windows\System\DnDwMWT.exe
  2⤵
  PID:14244
- C:\Windows\System\dGTKpeD.exe
  C:\Windows\System\dGTKpeD.exe
  2⤵
  PID:13488
- C:\Windows\System\YujdLnz.exe
  C:\Windows\System\YujdLnz.exe
  2⤵
  PID:13540
- C:\Windows\System\mtTpqiA.exe
  C:\Windows\System\mtTpqiA.exe
  2⤵
  PID:9848
- C:\Windows\System\JVlcjcT.exe
  C:\Windows\System\JVlcjcT.exe
  2⤵
  PID:13500
- C:\Windows\System\TefYkbz.exe
  C:\Windows\System\TefYkbz.exe
  2⤵
  PID:13588
- C:\Windows\System\HEOKXOc.exe
  C:\Windows\System\HEOKXOc.exe
  2⤵
  PID:13428
- C:\Windows\System\BNiulGv.exe
  C:\Windows\System\BNiulGv.exe
  2⤵
  PID:14352
- C:\Windows\System\ythZCyM.exe
  C:\Windows\System\ythZCyM.exe
  2⤵
  PID:14368
- C:\Windows\System\UNDdAbQ.exe
  C:\Windows\System\UNDdAbQ.exe
  2⤵
  PID:14392
- C:\Windows\System\uDOBRkZ.exe
  C:\Windows\System\uDOBRkZ.exe
  2⤵
  PID:14412
- C:\Windows\System\RVUeKHe.exe
  C:\Windows\System\RVUeKHe.exe
  2⤵
  PID:14440
- C:\Windows\System\GHGRSTN.exe
  C:\Windows\System\GHGRSTN.exe
  2⤵
  PID:14464
- C:\Windows\System\SScgJkd.exe
  C:\Windows\System\SScgJkd.exe
  2⤵
  PID:14504
- C:\Windows\System\hsHkiIo.exe
  C:\Windows\System\hsHkiIo.exe
  2⤵
  PID:14536
- C:\Windows\System\DphLXRX.exe
  C:\Windows\System\DphLXRX.exe
  2⤵
  PID:14568
- C:\Windows\System\wPzTNwS.exe
  C:\Windows\System\wPzTNwS.exe
  2⤵
  PID:14592
- C:\Windows\System\vBspmaN.exe
  C:\Windows\System\vBspmaN.exe
  2⤵
  PID:14608
- C:\Windows\System\HnuWiRF.exe
  C:\Windows\System\HnuWiRF.exe
  2⤵
  PID:14624
- C:\Windows\System\gthHuGO.exe
  C:\Windows\System\gthHuGO.exe
  2⤵
  PID:14640
- C:\Windows\System\jmOkDSt.exe
  C:\Windows\System\jmOkDSt.exe
  2⤵
  PID:14664
- C:\Windows\System\OJSFcsP.exe
  C:\Windows\System\OJSFcsP.exe
  2⤵
  PID:14756
- C:\Windows\System\Hensuuv.exe
  C:\Windows\System\Hensuuv.exe
  2⤵
  PID:14788
- C:\Windows\System\QxeFShi.exe
  C:\Windows\System\QxeFShi.exe
  2⤵
  PID:14812
- C:\Windows\System\avIUqWi.exe
  C:\Windows\System\avIUqWi.exe
  2⤵
  PID:14840
- C:\Windows\System\wnRlDZB.exe
  C:\Windows\System\wnRlDZB.exe
  2⤵
  PID:14856
- C:\Windows\System\vpkFUCa.exe
  C:\Windows\System\vpkFUCa.exe
  2⤵
  PID:14884
- C:\Windows\System\NZHiiwS.exe
  C:\Windows\System\NZHiiwS.exe
  2⤵
  PID:14916
- C:\Windows\System\BlLxKUM.exe
  C:\Windows\System\BlLxKUM.exe
  2⤵
  PID:14944
- C:\Windows\System\bPVasPo.exe
  C:\Windows\System\bPVasPo.exe
  2⤵
  PID:14980
- C:\Windows\System\MwpHVeo.exe
  C:\Windows\System\MwpHVeo.exe
  2⤵
  PID:15000
- C:\Windows\System\HfiPSfL.exe
  C:\Windows\System\HfiPSfL.exe
  2⤵
  PID:15036
- C:\Windows\System\xTAmvFz.exe
  C:\Windows\System\xTAmvFz.exe
  2⤵
  PID:15056
- C:\Windows\System\DNjjnWP.exe
  C:\Windows\System\DNjjnWP.exe
  2⤵
  PID:15076
- C:\Windows\System\ZpiCRdn.exe
  C:\Windows\System\ZpiCRdn.exe
  2⤵
  PID:15096
- C:\Windows\System\XaVbmqh.exe
  C:\Windows\System\XaVbmqh.exe
  2⤵
  PID:15132
- C:\Windows\System\YOEUuAU.exe
  C:\Windows\System\YOEUuAU.exe
  2⤵
  PID:15180
- C:\Windows\System\bZPXTco.exe
  C:\Windows\System\bZPXTco.exe
  2⤵
  PID:15208
- C:\Windows\System\JUIYvfO.exe
  C:\Windows\System\JUIYvfO.exe
  2⤵
  PID:15228
- C:\Windows\System\NqbPeYX.exe
  C:\Windows\System\NqbPeYX.exe
  2⤵
  PID:15256
- C:\Windows\System\qjqHIPQ.exe
  C:\Windows\System\qjqHIPQ.exe
  2⤵
  PID:15272
- C:\Windows\System\mjuTntQ.exe
  C:\Windows\System\mjuTntQ.exe
  2⤵
  PID:15312
- C:\Windows\System\nsMHBVT.exe
  C:\Windows\System\nsMHBVT.exe
  2⤵
  PID:15340
- C:\Windows\System\nHLAIKl.exe
  C:\Windows\System\nHLAIKl.exe
  2⤵
  PID:15356
- C:\Windows\System\lZsGeHX.exe
  C:\Windows\System\lZsGeHX.exe
  2⤵
  PID:14100
- C:\Windows\System\IAlwJTf.exe
  C:\Windows\System\IAlwJTf.exe
  2⤵
  PID:13832
- C:\Windows\System\rcWoWjV.exe
  C:\Windows\System\rcWoWjV.exe
  2⤵
  PID:14076
- C:\Windows\System\AMxuDeS.exe
  C:\Windows\System\AMxuDeS.exe
  2⤵
  PID:13988
- C:\Windows\System\OdQKlVh.exe
  C:\Windows\System\OdQKlVh.exe
  2⤵
  PID:14548
- C:\Windows\System\bZBBwgF.exe
  C:\Windows\System\bZBBwgF.exe
  2⤵
  PID:13536
- C:\Windows\System\iIfpvFu.exe
  C:\Windows\System\iIfpvFu.exe
  2⤵
  PID:14688
- C:\Windows\System\SHbexnB.exe
  C:\Windows\System\SHbexnB.exe
  2⤵
  PID:14528
- C:\Windows\System\sZJIytt.exe
  C:\Windows\System\sZJIytt.exe
  2⤵
  PID:14232
- C:\Windows\System\weVJLFz.exe
  C:\Windows\System\weVJLFz.exe
  2⤵
  PID:14620
- C:\Windows\System\MqmtHkK.exe
  C:\Windows\System\MqmtHkK.exe
  2⤵
  PID:14768
- C:\Windows\System\pikLZpK.exe
  C:\Windows\System\pikLZpK.exe
  2⤵
  PID:14388
- C:\Windows\System\KSOqfsb.exe
  C:\Windows\System\KSOqfsb.exe
  2⤵
  PID:14940
- C:\Windows\System\elJRYDK.exe
  C:\Windows\System\elJRYDK.exe
  2⤵
  PID:14784
- C:\Windows\System\SeUngke.exe
  C:\Windows\System\SeUngke.exe
  2⤵
  PID:14932
- C:\Windows\System\kOuQXbU.exe
  C:\Windows\System\kOuQXbU.exe
  2⤵
  PID:15092
- C:\Windows\System\lrFgUAJ.exe
  C:\Windows\System\lrFgUAJ.exe
  2⤵
  PID:14752
- C:\Windows\System\eUdMIkI.exe
  C:\Windows\System\eUdMIkI.exe
  2⤵
  PID:14776
- C:\Windows\System\MudGNbN.exe
  C:\Windows\System\MudGNbN.exe
  2⤵
  PID:15296
- C:\Windows\System\XwmbDuc.exe
  C:\Windows\System\XwmbDuc.exe
  2⤵
  PID:15168
- C:\Windows\System\SyfRGjw.exe
  C:\Windows\System\SyfRGjw.exe
  2⤵
  PID:13784
- C:\Windows\System\gpaJYwh.exe
  C:\Windows\System\gpaJYwh.exe
  2⤵
  PID:14488
- C:\Windows\System\PRDMfJC.exe
  C:\Windows\System\PRDMfJC.exe
  2⤵
  PID:14680
- C:\Windows\System\ohKdkJj.exe
  C:\Windows\System\ohKdkJj.exe
  2⤵
  PID:14600
- C:\Windows\System\KPewHqq.exe
  C:\Windows\System\KPewHqq.exe
  2⤵
  PID:14176
- C:\Windows\System\XpEOVpF.exe
  C:\Windows\System\XpEOVpF.exe
  2⤵
  PID:15328
- C:\Windows\System\EGaIuHj.exe
  C:\Windows\System\EGaIuHj.exe
  2⤵
  PID:15384
- C:\Windows\System\gVvGEeQ.exe
  C:\Windows\System\gVvGEeQ.exe
  2⤵
  PID:15416
- C:\Windows\System\amtliRo.exe
  C:\Windows\System\amtliRo.exe
  2⤵
  PID:15432
- C:\Windows\System\SprhYLJ.exe
  C:\Windows\System\SprhYLJ.exe
  2⤵
  PID:15452
- C:\Windows\System\FfEeyYK.exe
  C:\Windows\System\FfEeyYK.exe
  2⤵
  PID:15476
- C:\Windows\System\SgSvRBL.exe
  C:\Windows\System\SgSvRBL.exe
  2⤵
  PID:15508
- C:\Windows\System\izheCrh.exe
  C:\Windows\System\izheCrh.exe
  2⤵
  PID:15540
- C:\Windows\System\QNyzSZk.exe
  C:\Windows\System\QNyzSZk.exe
  2⤵
  PID:15556
- C:\Windows\System\CwfgPjX.exe
  C:\Windows\System\CwfgPjX.exe
  2⤵
  PID:15584
- C:\Windows\System\woRsGwr.exe
  C:\Windows\System\woRsGwr.exe
  2⤵
  PID:15608
- C:\Windows\System\cjBZfTA.exe
  C:\Windows\System\cjBZfTA.exe
  2⤵
  PID:15624
- C:\Windows\System\EgXjOZB.exe
  C:\Windows\System\EgXjOZB.exe
  2⤵
  PID:15656
- C:\Windows\System\XMMeOal.exe
  C:\Windows\System\XMMeOal.exe
  2⤵
  PID:15676
- C:\Windows\System\uQqzXst.exe
  C:\Windows\System\uQqzXst.exe
  2⤵
  PID:15704
- C:\Windows\System\KHgSXYA.exe
  C:\Windows\System\KHgSXYA.exe
  2⤵
  PID:15728
- C:\Windows\System\wcuJPdg.exe
  C:\Windows\System\wcuJPdg.exe
  2⤵
  PID:15748
- C:\Windows\System\UeNZFiG.exe
  C:\Windows\System\UeNZFiG.exe
  2⤵
  PID:15764
- C:\Windows\System\bAfUgZF.exe
  C:\Windows\System\bAfUgZF.exe
  2⤵
  PID:15792
- C:\Windows\System\FYYvdSN.exe
  C:\Windows\System\FYYvdSN.exe
  2⤵
  PID:15816
- C:\Windows\System\oCaTrdu.exe
  C:\Windows\System\oCaTrdu.exe
  2⤵
  PID:15844
- C:\Windows\System\ZbhYaSZ.exe
  C:\Windows\System\ZbhYaSZ.exe
  2⤵
  PID:15860
- C:\Windows\System\XMnmIqb.exe
  C:\Windows\System\XMnmIqb.exe
  2⤵
  PID:15888
- C:\Windows\System\ZwyIIjj.exe
  C:\Windows\System\ZwyIIjj.exe
  2⤵
  PID:15920
- C:\Windows\System\nRVGSLA.exe
  C:\Windows\System\nRVGSLA.exe
  2⤵
  PID:15940
- C:\Windows\System\shhSbuo.exe
  C:\Windows\System\shhSbuo.exe
  2⤵
  PID:15968
- C:\Windows\System\xmcQwvm.exe
  C:\Windows\System\xmcQwvm.exe
  2⤵
  PID:15996
- C:\Windows\System\wGxOuLT.exe
  C:\Windows\System\wGxOuLT.exe
  2⤵
  PID:16024
- C:\Windows\System\gSeTeUS.exe
  C:\Windows\System\gSeTeUS.exe
  2⤵
  PID:16044
- C:\Windows\System\WiRRAHC.exe
  C:\Windows\System\WiRRAHC.exe
  2⤵
  PID:16060
- C:\Windows\System\kJcnEpU.exe
  C:\Windows\System\kJcnEpU.exe
  2⤵
  PID:16084
- C:\Windows\System\HxePQUx.exe
  C:\Windows\System\HxePQUx.exe
  2⤵
  PID:16120
- C:\Windows\System\eldvKqY.exe
  C:\Windows\System\eldvKqY.exe
  2⤵
  PID:16136
- C:\Windows\System\TSqxAxv.exe
  C:\Windows\System\TSqxAxv.exe
  2⤵
  PID:16156
- C:\Windows\System\WDekMzL.exe
  C:\Windows\System\WDekMzL.exe
  2⤵
  PID:16180
- C:\Windows\System\DNMrPUQ.exe
  C:\Windows\System\DNMrPUQ.exe
  2⤵
  PID:16204
- C:\Windows\System\NrKSxiE.exe
  C:\Windows\System\NrKSxiE.exe
  2⤵
  PID:16232
- C:\Windows\System\Vvefryd.exe
  C:\Windows\System\Vvefryd.exe
  2⤵
  PID:16260
- C:\Windows\System\tnTVkiR.exe
  C:\Windows\System\tnTVkiR.exe
  2⤵
  PID:16288
- C:\Windows\System\kcPBCbo.exe
  C:\Windows\System\kcPBCbo.exe
  2⤵
  PID:16308
- C:\Windows\System\EBZcNry.exe
  C:\Windows\System\EBZcNry.exe
  2⤵
  PID:16328
- C:\Windows\System\fTjSrCd.exe
  C:\Windows\System\fTjSrCd.exe
  2⤵
  PID:16356
- C:\Windows\System\tDeNyin.exe
  C:\Windows\System\tDeNyin.exe
  2⤵
  PID:16380
- C:\Windows\System\SEumLcB.exe
  C:\Windows\System\SEumLcB.exe
  2⤵
  PID:14380
- C:\Windows\System\HzfBQKR.exe
  C:\Windows\System\HzfBQKR.exe
  2⤵
  PID:13960
- C:\Windows\System\QLwCbKa.exe
  C:\Windows\System\QLwCbKa.exe
  2⤵
  PID:15264
- C:\Windows\System\UEuUidM.exe
  C:\Windows\System\UEuUidM.exe
  2⤵
  PID:14656
- C:\Windows\System\YsxSctL.exe
  C:\Windows\System\YsxSctL.exe
  2⤵
  PID:15396
- C:\Windows\System\jYSDDLp.exe
  C:\Windows\System\jYSDDLp.exe
  2⤵
  PID:14084
- C:\Windows\System\nMSMMOb.exe
  C:\Windows\System\nMSMMOb.exe
  2⤵
  PID:14796
- C:\Windows\System\egwOKgE.exe
  C:\Windows\System\egwOKgE.exe
  2⤵
  PID:15528
- C:\Windows\System\fAxekKZ.exe
  C:\Windows\System\fAxekKZ.exe
  2⤵
  PID:15600
- C:\Windows\System\aGXnlZu.exe
  C:\Windows\System\aGXnlZu.exe
  2⤵
  PID:15244
- C:\Windows\System\QYaRDAy.exe
  C:\Windows\System\QYaRDAy.exe
  2⤵
  PID:15236
- C:\Windows\System\IJIgjmI.exe
  C:\Windows\System\IJIgjmI.exe
  2⤵
  PID:15900
- C:\Windows\System\QJMpfnY.exe
  C:\Windows\System\QJMpfnY.exe
  2⤵
  PID:14780
- C:\Windows\System\xCrxkzn.exe
  C:\Windows\System\xCrxkzn.exe
  2⤵
  PID:15688
- C:\Windows\System\PNRXDrl.exe
  C:\Windows\System\PNRXDrl.exe
  2⤵
  PID:16076
- C:\Windows\System\VrImuzd.exe
  C:\Windows\System\VrImuzd.exe
  2⤵
  PID:15756
- C:\Windows\System\IUVXqFh.exe
  C:\Windows\System\IUVXqFh.exe
  2⤵
  PID:15856
- C:\Windows\System\gBVayKV.exe
  C:\Windows\System\gBVayKV.exe
  2⤵
  PID:16276
- C:\Windows\System\yUgrJeJ.exe
  C:\Windows\System\yUgrJeJ.exe
  2⤵
  PID:16304
- C:\Windows\System\oGlGTrj.exe
  C:\Windows\System\oGlGTrj.exe
  2⤵
  PID:15644
- C:\Windows\System\CIuiTfS.exe
  C:\Windows\System\CIuiTfS.exe
  2⤵
  PID:14820
- C:\Windows\System\WgCYVQP.exe
  C:\Windows\System\WgCYVQP.exe
  2⤵
  PID:14268
- C:\Windows\System\SRuQOLT.exe
  C:\Windows\System\SRuQOLT.exe
  2⤵
  PID:14636
- C:\Windows\System\fgwnSTP.exe
  C:\Windows\System\fgwnSTP.exe
  2⤵
  PID:15828
- C:\Windows\System\dypKUpD.exe
  C:\Windows\System\dypKUpD.exe
  2⤵
  PID:15376
- C:\Windows\System\CblfXyD.exe
  C:\Windows\System\CblfXyD.exe
  2⤵
  PID:16400
- C:\Windows\System\PmXsBiC.exe
  C:\Windows\System\PmXsBiC.exe
  2⤵
  PID:16424
- C:\Windows\System\FEwoTbO.exe
  C:\Windows\System\FEwoTbO.exe
  2⤵
  PID:16452
- C:\Windows\System\rZXnlTr.exe
  C:\Windows\System\rZXnlTr.exe
  2⤵
  PID:16492
- C:\Windows\System\zAZPeNl.exe
  C:\Windows\System\zAZPeNl.exe
  2⤵
  PID:16508
- C:\Windows\System\lhDOoSj.exe
  C:\Windows\System\lhDOoSj.exe
  2⤵
  PID:16528
- C:\Windows\System\lCrxiQy.exe
  C:\Windows\System\lCrxiQy.exe
  2⤵
  PID:16552
- C:\Windows\System\giYeOzU.exe
  C:\Windows\System\giYeOzU.exe
  2⤵
  PID:16580
- C:\Windows\System\rBQpyfd.exe
  C:\Windows\System\rBQpyfd.exe
  2⤵
  PID:16604
- C:\Windows\System\cNnLRZl.exe
  C:\Windows\System\cNnLRZl.exe
  2⤵
  PID:16628
- C:\Windows\System\LINnFiI.exe
  C:\Windows\System\LINnFiI.exe
  2⤵
  PID:16648
- C:\Windows\System\jDWMvFA.exe
  C:\Windows\System\jDWMvFA.exe
  2⤵
  PID:16668
- C:\Windows\System\rSkGQEb.exe
  C:\Windows\System\rSkGQEb.exe
  2⤵
  PID:16684
- C:\Windows\System\gBegxLS.exe
  C:\Windows\System\gBegxLS.exe
  2⤵
  PID:16720
- C:\Windows\System\OMVQwLg.exe
  C:\Windows\System\OMVQwLg.exe
  2⤵
  PID:16740
- C:\Windows\System\VDVnpXf.exe
  C:\Windows\System\VDVnpXf.exe
  2⤵
  PID:16768
- C:\Windows\System\hnCpSMp.exe
  C:\Windows\System\hnCpSMp.exe
  2⤵
  PID:16800
- C:\Windows\System\ClHknrT.exe
  C:\Windows\System\ClHknrT.exe
  2⤵
  PID:16832
- C:\Windows\System\TYPNjwW.exe
  C:\Windows\System\TYPNjwW.exe
  2⤵
  PID:16860
- C:\Windows\System\TYFmLRY.exe
  C:\Windows\System\TYFmLRY.exe
  2⤵
  PID:16876
- C:\Windows\System\DtHXiMO.exe
  C:\Windows\System\DtHXiMO.exe
  2⤵
  PID:16900
- C:\Windows\System\JzUdpGJ.exe
  C:\Windows\System\JzUdpGJ.exe
  2⤵
  PID:16924
- C:\Windows\System\bpeBEll.exe
  C:\Windows\System\bpeBEll.exe
  2⤵
  PID:16948
- C:\Windows\System\zEDRHCZ.exe
  C:\Windows\System\zEDRHCZ.exe
  2⤵
  PID:16980
- C:\Windows\System\QhwWVNS.exe
  C:\Windows\System\QhwWVNS.exe
  2⤵
  PID:16996
- C:\Windows\System\eeEBViw.exe
  C:\Windows\System\eeEBViw.exe
  2⤵
  PID:17028
- C:\Windows\System\fZyWzcY.exe
  C:\Windows\System\fZyWzcY.exe
  2⤵
  PID:17048
- C:\Windows\System\XikdHTI.exe
  C:\Windows\System\XikdHTI.exe
  2⤵
  PID:17080
- C:\Windows\System\GYYVuSc.exe
  C:\Windows\System\GYYVuSc.exe
  2⤵
  PID:17104
- C:\Windows\System\OqPtCjm.exe
  C:\Windows\System\OqPtCjm.exe
  2⤵
  PID:17136
- C:\Windows\System\IIWxhHO.exe
  C:\Windows\System\IIWxhHO.exe
  2⤵
  PID:17164
- C:\Windows\System\RnrIsgT.exe
  C:\Windows\System\RnrIsgT.exe
  2⤵
  PID:17180
- C:\Windows\System\oYtcyMo.exe
  C:\Windows\System\oYtcyMo.exe
  2⤵
  PID:15648
- C:\Windows\System\LreobHH.exe
  C:\Windows\System\LreobHH.exe
  2⤵
  PID:15672
- C:\Windows\System\gNiYKeM.exe
  C:\Windows\System\gNiYKeM.exe
  2⤵
  PID:16240
- C:\Windows\System\HxpvFSm.exe
  C:\Windows\System\HxpvFSm.exe
  2⤵
  PID:16700
- C:\Windows\System\dvoSpSS.exe
  C:\Windows\System\dvoSpSS.exe
  2⤵
  PID:17288
- C:\Windows\System\nvdHgsq.exe
  C:\Windows\System\nvdHgsq.exe
  2⤵
  PID:16868
- C:\Windows\System\qtBmGwj.exe
  C:\Windows\System\qtBmGwj.exe
  2⤵
  PID:16936
- C:\Windows\System\ODETtJZ.exe
  C:\Windows\System\ODETtJZ.exe
  2⤵
  PID:17020
- C:\Windows\System\XfxkSXN.exe
  C:\Windows\System\XfxkSXN.exe
  2⤵
  PID:16636
- C:\Windows\System\Donldlv.exe
  C:\Windows\System\Donldlv.exe
  2⤵
  PID:16820
- C:\Windows\System\uFeRmbW.exe
  C:\Windows\System\uFeRmbW.exe
  2⤵
  PID:16892
- C:\Windows\System\mKUQWFe.exe
  C:\Windows\System\mKUQWFe.exe
  2⤵
  PID:16916
- C:\Windows\System\LNJBcgo.exe
  C:\Windows\System\LNJBcgo.exe
  2⤵
  PID:17012
- C:\Windows\System\uuQcugJ.exe
  C:\Windows\System\uuQcugJ.exe
  2⤵
  PID:17068
- C:\Windows\System\wKWbrVv.exe
  C:\Windows\System\wKWbrVv.exe
  2⤵
  PID:15240
- C:\Windows\System\XZAXldO.exe
  C:\Windows\System\XZAXldO.exe
  2⤵
  PID:15072

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AOpwVRi.exe

Filesize
1.5MB

MD5
c748bc7b41f33caae1a30fb5fa2aa867

SHA1
9f5d7fcf88fb415a0f2ac1694a9bf5136ee1f862

SHA256
ed27a8611140f4a1287480369128a8956355dbf0f039244d94586df821ba14e8

SHA512
002050e2156ca95fb17a8acb50c7c73eaf791c3652964620fae8c43d14a22aaf00510eb6fc616fe5fd4c8826b1c8957445329e7efb06b291d8a961a6253e0951

Download Submit
C:\Windows\System\AoUyzEC.exe

Filesize
1.5MB

MD5
158220216711bb7195f1a3d4835a6c1c

SHA1
01e0fc0f4e6933d756b73e2018056a5dad66375e

SHA256
4fcab16af34a93280072e594be958d9384037c746c9f671da6a6493b53cf06e2

SHA512
39f0f3894d479a71d84b6094413b831f99000dee24d115c5c0decb6e74a84c9bbdf39d6245232fad512811ba08e4cd6edfb101a62ee7b4038436919a62f1eb51

Download Submit
C:\Windows\System\BHMruSO.exe

Filesize
1.5MB

MD5
e13ef3234ea0784612bdcef4bcfd7a67

SHA1
e18afad8f16b858d240ac5184275b703b280cf0a

SHA256
78fc50b187130ca0119d655d14f042e7cf6ab7aaa93b0e52b79918f56b011ebe

SHA512
a2df34d518ce8538098d4b465e9dbbf716a96c20981c301eadb1d4348222a80a6231320dd315373243d61cc2dfffdf1a99a5f4739fe3f3f1bcacb4411c4d621d

Download Submit
C:\Windows\System\IOAHDQj.exe

Filesize
1.5MB

MD5
f5b26bf045630e4e0c7436942ea426ab

SHA1
a8103806590d6a32240ade0b5e7faa3c058e930b

SHA256
9be965895bb3fcdc81cda87c84b3cef139dc60ca08aa05761745507af1bb61c0

SHA512
aa0171576067dc1949f904dce0f1dbaeb8ee5197f5bb64ab79172fe7129522d0beb406c1bc784f6dd656346d8df6590427e6a129b0e3e93532bb69eef5fe95b7

Download Submit
C:\Windows\System\IhxZQrQ.exe

Filesize
1.5MB

MD5
9c8f7cb4060e2ec4e049bf4fb04e9b10

SHA1
c1c4a2515e78a16e8bfc1fca0560b654e81d72d1

SHA256
df772139f1b598336388c27f583f63e1ce279954f9a62a76b48de29a1cb7f262

SHA512
60548e0d38a01d46af2edf072da1ddd9d3fb43d97aeb2a1eec31a0f0ad73db1dee829e25f2ee107a5fb849b078e90f573d1a08e2008de7235d5efafa3fe0b151

Download Submit
C:\Windows\System\JUVLPEe.exe

Filesize
1.5MB

MD5
7ed0306129bf70de5122893054a16615

SHA1
9e75844b306513ae95857ffbabad2f3f753e4cf0

SHA256
9b8bb93d3fd4d11ab07b199697ce22aa970f7be1c9ebf3bf1dc5d44f6ccdac1e

SHA512
71726279a7a43815b2613337b16fd94d756eb45c5726100a3005844fd30abc8d8c05dcc1f65cdecfca44f0db0eabb3956920c2a8045f05193264a574973d09e3

Download Submit
C:\Windows\System\MxfiVjo.exe

Filesize
1.5MB

MD5
bc2d26ef3c0018a1a7adc50f99443560

SHA1
18d4154bc95209f92ca6c7f11c5050a9d689d20d

SHA256
eee328292cb7df1e5140c963007faff7e8ea2168f0799cfb4e7afb6b2c98ddf5

SHA512
16048872f9d5d7160c1ed36d61bee463fd6c5f7bb7dbedd5da241ebdbab1d5c6a1dc4fe34d8d1eab874ea74933c1a4135603e68dce24daccf9359bdb7f1c63c8

Download Submit
C:\Windows\System\NCjZWJt.exe

Filesize
1.5MB

MD5
af83f9700e3b3b1a441e17fb32975137

SHA1
6cbde7f03456ed80adb3a8232a4bf9ad6ec2fb78

SHA256
07a13ec80b8a7b17531e06c81b8c2222d734b8fc2f967c6c52e204fd8bb5a157

SHA512
58d15f86f9effb8e6ba1c938d83be8cda77d76f87d0057d8806baa20e536de53a4d32a56a09172afe7e9bd6957df1a118f4d65c874233fff57ea4c5024b17fce

Download Submit
C:\Windows\System\NNrxVrQ.exe

Filesize
1.5MB

MD5
5100822811b64cfc2a8d7d1853e6cc48

SHA1
90a05a69d4386dbb66d44a3fe97b3e1b744498c9

SHA256
9eebf02534f5beb61506fb947d2e57945e5d468658e20419e651b71fba4928d0

SHA512
0ec39c670f596a25b123a20430a4a86d48a7c3cadaff86025cb0f77a39e096d9624d045cd973c0c5be72832bff42105eb80bd3f518e14c4e863b1108d4862a28

Download Submit
C:\Windows\System\OHEcbdO.exe

Filesize
1.5MB

MD5
3f32e3bf16ffa222c3d3d59f9596399d

SHA1
0bc8517f2e975c78ba73401ad0edcbab48839762

SHA256
bb7d0e10bdeddebdf6b31f0cd8e21e957720f14cfb27368bbf3da9f43200d764

SHA512
411b5e3c3607ac239d4a8dc7c6844429a6a9679ce4f799fd13175e02288acbba7fe4353a457e5ca7b9a68f3ac096f291d6c8a298e7313557c986ccb8e105e244

Download Submit
C:\Windows\System\QQzSuyc.exe

Filesize
1.5MB

MD5
4a3c35d321fc3123a1dc7c50b073757d

SHA1
0f67b91121cc57d2beb572f359b1f1540e7eadc3

SHA256
1c84a3c839a82a4b5694ca146272d30b5d022e6ba3adce1c3b5f3ced72eba295

SHA512
9f9cdab05422fc08efc818c51483f0efa1d85f3e28efe7c772ac467bf3c645aa9557ac8271c7b50ffd6766c808d7218060f3d27aafced92bcf035b3b8aee674f

Download Submit
C:\Windows\System\RTnjhDU.exe

Filesize
1.5MB

MD5
fc4f0509eca63d7ce70ba566f7bd0ca5

SHA1
1074b13c39bc3172261420bc142bd2db65fa6b45

SHA256
07fa74cf3fbdcb9e5f174a710d79cf51e6b1b339fae165391e0d7dda15162778

SHA512
95a9d3e227b7927a2c305cc7aa7fd05ad25243b3c658090034fd4115950b8df8c3179e6969b2f54c467874bab97fa986a7b55530a8e254a25638f2e4762b97df

Download Submit
C:\Windows\System\SHjTcfZ.exe

Filesize
1.5MB

MD5
b528470ef13818b1c2eac42a49957938

SHA1
522c5ff2f680d69c91c7de58b1fd850575a64dce

SHA256
ad9f878f88961e349c293c1c1075e3d4d4eb8a55fa68f6135a4afc975984474c

SHA512
3a5504275e34ebf9ab75ad7ef4e87c717a5e26bbfb0a77302ff0129fcb9d1e30bb8ff0e4fcc21566a82cdc31c77e29f8b4ba2e210762588d325c569bd68d228b

Download Submit
C:\Windows\System\UPSFHcy.exe

Filesize
1.5MB

MD5
2d93c519fb25f16078c65833204c04cb

SHA1
3783f549e1cfa30894ed968282c263b1785e0d7d

SHA256
59a2468f2584336899789691eb3a201f9bc4b0f70b85cfdb94716049c7fcc0bf

SHA512
ad05760f35727fbcaf605c0c2c09599afe5fb14d58a142779cffbd1b755ccb8183e92ce415c01d0c6ce848cd8597d7acce3b5b733c66e56a80528ec60aa8dbd8

Download Submit
C:\Windows\System\UPagXhT.exe

Filesize
1.5MB

MD5
40ba75856f1782c48c3de4b1bcc38dff

SHA1
6441a5fb2bf525250a87834ab172037446ccddea

SHA256
c7ad862c162662d70c213b249fa49c3160f406a8831220e6781b77f0f987aa5b

SHA512
2f37467de511d411a5eda7fd80416125425977982563d6c14e131bf7b9853dd4164aaf4504de8178341dedb7e58373d839cdbcc9f1c45c514946b82921343966

Download Submit
C:\Windows\System\ZWlpcQB.exe

Filesize
1.5MB

MD5
2a09eadc002c381471f4d704cbed7928

SHA1
cae817ee16c0af0fb080c5a2ccfe8bcb73f86549

SHA256
2e2bb358a823b51d84b472082b362067ac2a6b3b27d0bce37a3b08e9bced00ea

SHA512
5246af3d41735ad1075a422d449f9d4a26d45b5c43a1dcc17c4d584910716332b71072d7fde53baaf9924f1b366bf15fc8b9570894ddfee05eb4ae3d692ab2b4

Download Submit
C:\Windows\System\asupEpd.exe

Filesize
1.5MB

MD5
56e7c6bc4d8da32c3532f6ed2fd110a6

SHA1
810e7ee7d84549ad7d46eb0e05669bb2cace183f

SHA256
d9836f1bc9b15c1e2f238b76c6fb3025b7f9bdc96195b80cad3f828a3a8b66b3

SHA512
bccad00b027b4f10526ae60da1799c700e7ef98117eaab58f427c950ed9db65a16e22e0eec75ec1e66b1698559f14b70f213975f6f9953125a8b32ecfcd77d74

Download Submit
C:\Windows\System\dLwGRHL.exe

Filesize
1.5MB

MD5
2bf1c54fb65573d0d61401219bfd51a1

SHA1
40f9decd00dcda8e271bb64ad452d3f7a9fcc067

SHA256
06705c9b8ab0a4bdd8400c3536b99c8cc2a3c8ae674202b1b7c15c06854fc787

SHA512
ffa5ebd8ad872a1ec38281f2674cf3b560134d90fce55b81c4647f67758e73c4717743bc201e2a48119b42257f28a11e3c8a214c45ea886544558f02eeee5b57

Download Submit
C:\Windows\System\fZAcXDN.exe

Filesize
1.5MB

MD5
db66a4f47089e713765b71daf4db53e0

SHA1
26f1f6bce34ce31143f60aa09cf1769f58cdcd8f

SHA256
3eb0c2414abe4d2d6deb87bc53de328e1340af2578f1c0885f33b4d83f0f8980

SHA512
634e79d63845f5bf99ffbcfc68b733f7bd5b9e1a9a9237bec66f06f3a628d229123989be22e04c09fd45205b836da32f92efd6a9b7cc8f6b2cbd9b545597337d

Download Submit
C:\Windows\System\fdUFOMX.exe

Filesize
1.5MB

MD5
fc195f63503e87b4af6d02dbde1c09cc

SHA1
f4b9a61e79bddbbd15365cc2527f08c9747ec8c0

SHA256
c08dd234ae1f2b576669bba811343f6aa4df7f57f1df660396f3d459f7f8d3ad

SHA512
14699d2a8da1f2c1143fc1cc12036a86de8beb6d1ff54c636bc71bae9da9a342711ed6a59d82a6a884695daeee3ce2fdbfe9c83cd9401dfe85a54fdf1f780e43

Download Submit
C:\Windows\System\iFWmJDd.exe

Filesize
1.5MB

MD5
5f34fbc09155952a1481f66e8884d404

SHA1
9771d42cff90f0a378e23a3fb0af81c47cca575c

SHA256
c6a77e8ac7c67fd0c0649b08b1cd0026d462a84cb66cd42c599a8c8a04a24bde

SHA512
105b58108bfd9b398cefa116ada186320d0a76b58f95cc10389492aa34468bb159b3cf76fa91842cc006ecf5771e20ff833f9db7b4299650ace1e4566649739d

Download Submit
C:\Windows\System\jZVgIlA.exe

Filesize
1.5MB

MD5
39fceb6e03c2b52d5a4072889e840edc

SHA1
f7d7b253d549a2969f0c09183e9c8278a969d0c9

SHA256
f22ee37e96d10faa86f0adcfad19bc4c91139b143032285f7e929fd8ffd48eef

SHA512
10292af7c3f12291fd1752d664386cbb396066c0d9bb992196873a1f2f83371431ee928830fbddb556e9611cc83e1604654726ba06d492e809c90ac77196b2bb

Download Submit
C:\Windows\System\jrkpHTb.exe

Filesize
1.5MB

MD5
912dc43b8d93cd7bc649b38f879e29b6

SHA1
c3912d786e18d1137faf059cfb538aa2c0f8968e

SHA256
c21120a784c3ffdc4bd2ed44853a6dd3ed01159451ac5c37e22f878d5a1f35a0

SHA512
4cc3bb3672e251cc0d4343f651a28130df8eb39cdfb8d840e38df747f19e8bb5395b23fd2f95234fbe2f8fba3013eae511875a82a68fe19561ebebf123b56320

Download Submit
C:\Windows\System\ljNqCGA.exe

Filesize
1.5MB

MD5
bf867ebb01b0e46917e4108abcb9b443

SHA1
786e3389f79b444998b763e6d32dde1ef0d9a292

SHA256
ba798c646013b7de7f3d2dbb914368552b6851fc5c2735cc14fb901ac8e63008

SHA512
77bc5ff83f79329042680a2a408cd64882b3bfaa55bc7a064bfb18b8778373e7257540a3238249f96fb1596592269e426ca6f039c8deb3fc4ca2991cbcad77c3

Download Submit
C:\Windows\System\mIRlDbS.exe

Filesize
1.5MB

MD5
d9dc46bd803b83d14c29a1031a1b8511

SHA1
4d9223d9f6bf7f0ac7c0b4786023d1f23e3394fa

SHA256
d077a9ab1ff6c55a75c01db4b34f6f67ddbb3f418e7b099dd1019fe0d381e029

SHA512
2f14447d4607cd2bbae8266de577a5a73f81d07285a907f4b49f443c795c191cf1e68a7f9a9a42a096ab1668bc742d669f42511d527ce43320b618bab84f85d8

Download Submit
C:\Windows\System\oFUYSsn.exe

Filesize
1.5MB

MD5
a95aff0333a34381358c5136dcd9b4c9

SHA1
4a8b354cc93756d61af9e7a0c990e564b2eab624

SHA256
5d709d0192c50e68137f6f2c1f27c69c6d42d9131802ee486bfa37f861c9ff78

SHA512
195eb47a52009cd0b19c45fb098451566b6e6e4c78e1e42dd6ea969aa9f7bdfdf5405f2a6f43e1509ae32d85ba7b5f78135596cfeaba83ab603594f42c4dfa58

Download Submit
C:\Windows\System\pmvExsW.exe

Filesize
1.5MB

MD5
f710aacf00de59704ee5add972d7c7dc

SHA1
90c24aa930010ce89301a2b945e0306bb9f5721d

SHA256
92951c24ce53247f36e8fe8d10d2f2c08225f895c185986defd9db93fb1e2d75

SHA512
9b0e8ee6b0471022961c24125124906d537b7a62aa65a74087d134b0b9604eac4ff9647267c88cdda226687ee211421ba7679ad44a769aeb948e03c886e87b79

Download Submit
C:\Windows\System\qTuLhfg.exe

Filesize
1.5MB

MD5
d1693d5bd9e501336874fd9b6cb0cd2f

SHA1
4f58694eb4dadfdc231afe6381c925a5d9bb3f63

SHA256
74ff8db78ae5a44422c1e81252acf722c9ea0f76d1c3a19d92f355464ccd95d7

SHA512
603b3d4d98b6b688a97ad7241e08a12fc076b4c21de76e9216ba02492bf0236d795557cf6139ad586b194678829a9b4260ee770705468a5bbca937ceccc6492e

Download Submit
C:\Windows\System\rDEQUvh.exe

Filesize
1.5MB

MD5
61c6f27bba077ce22b10052db85bd694

SHA1
2b15f0ca7cb1057da1e2e57d1fae591a452aab5d

SHA256
343c013e34a3e83e5f3749996a0c7f3c32235d15d26d15db584c6f75e148ee29

SHA512
ed02577529a0e57f4fcaffae93d213c69566a7fa12007b62e4f992d6563de4bf6ff4181247c632095b5e786f4bb23ed156ea5ed30653e9d70173e814f56c950d

Download Submit
C:\Windows\System\rVTytkA.exe

Filesize
1.5MB

MD5
5565890a7c78c8674774a7bf3d0c8258

SHA1
68d2a7650d037e73aab5f330d3da5fbc6732018d

SHA256
8e2fa29fdac8a5cb9b857276b0ddb6c8f457876cc0aeab25e7a4d21e7950bcef

SHA512
84c7ecaf28058f8468ae679958eaa0ae9ed8c354be60d799d908a1db28e679132915f277c4b108508d0b9eb59bb7162f2d3717dba70c062efc47c8ad0668d9a1

Download Submit
C:\Windows\System\sApLBHI.exe

Filesize
1.5MB

MD5
d2f775990fb3937823af4a455f8c77c9

SHA1
72f4803aed93b021a477a4a6ec4bdb0ff764cc48

SHA256
a48efe442a76605fa1958f777af32dd0a2dab643d8b7b5ec3550f595d2661e19

SHA512
d9f2176ae426fc020e53610119105a7016be8562d31517ae902e7ca521b536e55e9f3fd52461d3aa3ab42dacaa9c0176d0cf2904e69a4204857381246cd157d8

Download Submit
C:\Windows\System\tkdXJOS.exe

Filesize
1.5MB

MD5
17f94fe4237406a643438564f526dfbf

SHA1
93f53df7d549f5daaf9a6270215321a495e7cea3

SHA256
331bda25c8ac14a7cf9bc904b44c638c77b51d8f23c4816912591e38624d939f

SHA512
f59455cd95527822a89a07045de2627b529586091f8cfa1494a76c4d2d53c0a1a3cec306998798580525fe27840af11c9e9829f636d9d22b01c28a9bef9a21d5

Download Submit
C:\Windows\System\vwTQhiL.exe

Filesize
1.5MB

MD5
15caed62b257b07f68d2b0c6153e27c7

SHA1
db1ef175c8d7afc0c554ae2821fffbbbbeaf101d

SHA256
7811bdc9e5408ab0114cd0936ef397a77c13031a149ba8807261fc39e202273f

SHA512
5bfa589558674d3110379b5886414205c3770f4f20e4239a5b30164034334839aa87c573da49e69a126494389ce61bd3b6a2d2fdf81193a4a8d97e0e32228702

Download Submit
C:\Windows\System\xYHlFYm.exe

Filesize
1.5MB

MD5
b4f4efe2580ad2382cd025f3352437b7

SHA1
b905feefb8d8e1196ab7634b247345d6854d242e

SHA256
47f96f6bc2eef6b329a198c19b2b5125f7c441eabbdb5a4542f6c0c180900098

SHA512
fa6e87cbfad41a84a753604c46d9b50f8688c1208e4772f95e490207cecb0c4ba1afa554591386541eb898e88decea02b61d2d363816c2a6fe9da12eec66dbe1

Download Submit
C:\Windows\System\zrXUkXZ.exe

Filesize
1.5MB

MD5
83d41611bc43cf9dd44e0a844e8c00e2

SHA1
e86671b02c9bf9704e9615003de4df50b46722b7

SHA256
2f812a8ab3ccb76dfdf19904f0ea1dda3b5e62ebf3cc2baa8db6643103487097

SHA512
feb5a0ec4433c6592b6ffe807606ccac442e86c5b00908820e001b23e78ac0f41f3e969d3e259d5f90be0b578a063f8167fc044b1a3ba2d529f10368f44f6226

Download Submit
memory/864-0-0x000001AB32AC0000-0x000001AB32AD0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads