xmrig | 4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
Size

1.8MB
MD5

af80415bea92d7e0b2d654c9009e8679
SHA1

509ba53ebdb56ff564926f84b085ef27fc97a77b
SHA256

4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969
SHA512

0952cce242c348f674b0e8bb684eb76608672bcc0dc940f813228595ee04070ef14ca661ddde4be9ae6581621f55688386d0c8a254763566d7dc3dd480da34b9
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQb1Y3v9Ey:GemTLkNdfE0pZyD

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023bab-4.dat	xmrig
behavioral2/files/0x0008000000023c9f-7.dat	xmrig
behavioral2/files/0x0007000000023ca3-6.dat	xmrig
behavioral2/files/0x0007000000023ca4-20.dat	xmrig
behavioral2/files/0x0007000000023ca6-32.dat	xmrig
behavioral2/files/0x0007000000023ca7-40.dat	xmrig
behavioral2/files/0x0007000000023ca8-45.dat	xmrig
behavioral2/files/0x0007000000023ca9-50.dat	xmrig
behavioral2/files/0x0007000000023cab-60.dat	xmrig
behavioral2/files/0x0007000000023caf-72.dat	xmrig
behavioral2/files/0x0007000000023cb1-82.dat	xmrig
behavioral2/files/0x0007000000023cb3-100.dat	xmrig
behavioral2/files/0x0007000000023cb9-122.dat	xmrig
behavioral2/files/0x0007000000023cc0-157.dat	xmrig
behavioral2/files/0x0007000000023cc1-162.dat	xmrig
behavioral2/files/0x0007000000023cbf-160.dat	xmrig
behavioral2/files/0x0007000000023cbe-155.dat	xmrig
behavioral2/files/0x0007000000023cbd-150.dat	xmrig
behavioral2/files/0x0007000000023cbc-145.dat	xmrig
behavioral2/files/0x0007000000023cbb-140.dat	xmrig
behavioral2/files/0x0007000000023cba-135.dat	xmrig
behavioral2/files/0x0007000000023cb8-125.dat	xmrig
behavioral2/files/0x0007000000023cb7-120.dat	xmrig
behavioral2/files/0x0007000000023cb6-115.dat	xmrig
behavioral2/files/0x0007000000023cb5-110.dat	xmrig
behavioral2/files/0x0007000000023cb4-105.dat	xmrig
behavioral2/files/0x0007000000023cb2-95.dat	xmrig
behavioral2/files/0x0007000000023cb0-85.dat	xmrig
behavioral2/files/0x0007000000023cae-75.dat	xmrig
behavioral2/files/0x0007000000023cad-70.dat	xmrig
behavioral2/files/0x0007000000023cac-65.dat	xmrig
behavioral2/files/0x0007000000023caa-55.dat	xmrig
behavioral2/files/0x0007000000023ca5-25.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
632	EyYPOQJ.exe
1856	dSYjZkC.exe
1076	bBBYvWL.exe
4884	dnpsBfz.exe
460	aWVxonL.exe
3316	CJeUlOR.exe
852	vgfodoY.exe
1616	zFrgluw.exe
3352	beFPlhO.exe
748	rwXFNrH.exe
4240	ldGFmGv.exe
3592	jInMfbj.exe
3244	UavpiJV.exe
1376	aEHIGVd.exe
4756	xwGooyH.exe
5024	yZDUlTq.exe
4780	evpksha.exe
2592	vtyqlCN.exe
396	Twleuyk.exe
1556	tyZAkgj.exe
4920	LFQSxbd.exe
960	CmAOBLf.exe
3928	SeRsoQP.exe
1440	eYgqIFj.exe
2600	sMBrowB.exe
4984	HyaqNVT.exe
2312	PXrUVBz.exe
3716	atfppwQ.exe
1644	qlmBegx.exe
840	FPbTzXD.exe
4448	jDbMlms.exe
5012	gvJMoZx.exe
504	VNdPPLC.exe
1708	OdCneap.exe
2976	VmTpWnV.exe
1144	CqTuyMO.exe
2060	BIhjdLh.exe
3932	Wohhnbk.exe
2688	yUmWLWx.exe
2252	VDYAEqo.exe
2800	npsFapT.exe
2372	spJBERW.exe
4888	rdEHlBI.exe
4324	EniGlBB.exe
2000	pSwfgpM.exe
736	qEtUimB.exe
4156	wTALnri.exe
3328	uYRzVnj.exe
4712	zxbRgxE.exe
2956	LShCqPR.exe
1820	bmplOmY.exe
1112	DSIdJHQ.exe
2952	SzrVwhL.exe
2732	nhQdRRv.exe
2008	DbrFDro.exe
1356	KqiIwoU.exe
4084	ICBusAr.exe
2288	vyaxFgw.exe
4828	YrWRNlq.exe
536	LqnTStY.exe
2380	VKvnJnZ.exe
2656	snMxjiT.exe
4964	mOmlHlo.exe
4460	sapXnLo.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\aOCKHxl.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\ZUYgpDP.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\wIcwNKS.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\deqFSiH.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\gvJMoZx.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\cZYKOmJ.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\DKWerNh.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\CiobRuF.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\spqyNTC.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\ISJhVoV.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\XNstKIS.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\GNnKuZV.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\UpbIwsa.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\DSIdJHQ.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\tcdvKVK.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\tLwhXya.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\EniGlBB.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\FrccsZA.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\MzpmYOY.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\Wfkfaer.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\vgfodoY.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\VKvnJnZ.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\jPVpdKw.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\hUgxuwp.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\cIqANaO.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\bMuMtiJ.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\sQRBKEb.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\pSwfgpM.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\svFXCDK.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\xEsIgsn.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\WWfRpwX.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\lTATLvy.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\bPORdjY.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\IohghkM.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\dwxYpWA.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\ORJUJrk.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\ikHksvp.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\LMhsVll.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\lBDPYZe.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\NDoIJWB.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\bBCnxxD.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\SgiDbpc.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\eYgqIFj.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\KbBqpEm.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\CdjvSQv.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\MzboPhH.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\boPBqBB.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\SWuNHgL.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\sWivojY.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\GYZsWyk.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\OZDNLRe.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\IwwkNGO.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\matqCXz.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\gNXkriM.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\mQGkMmv.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\snMxjiT.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\IgBfWdU.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\YjlnvuY.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\AcJPvXd.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\XttOgJJ.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\ZDckmLW.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\SOThkLl.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\oJVBzBW.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
File created	C:\Windows\System\uSgjwmf.exe	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16576	dwm.exe
Token: SeChangeNotifyPrivilege	16576	dwm.exe
Token: 33	16576	dwm.exe
Token: SeIncBasePriorityPrivilege	16576	dwm.exe
Token: SeShutdownPrivilege	16576	dwm.exe
Token: SeCreatePagefilePrivilege	16576	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 632	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	85
PID 4244 wrote to memory of 632	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	85
PID 4244 wrote to memory of 1856	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	86
PID 4244 wrote to memory of 1856	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	86
PID 4244 wrote to memory of 1076	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	87
PID 4244 wrote to memory of 1076	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	87
PID 4244 wrote to memory of 4884	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	88
PID 4244 wrote to memory of 4884	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	88
PID 4244 wrote to memory of 460	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	89
PID 4244 wrote to memory of 460	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	89
PID 4244 wrote to memory of 3316	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	91
PID 4244 wrote to memory of 3316	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	91
PID 4244 wrote to memory of 852	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	92
PID 4244 wrote to memory of 852	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	92
PID 4244 wrote to memory of 1616	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	93
PID 4244 wrote to memory of 1616	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	93
PID 4244 wrote to memory of 3352	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	94
PID 4244 wrote to memory of 3352	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	94
PID 4244 wrote to memory of 748	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	95
PID 4244 wrote to memory of 748	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	95
PID 4244 wrote to memory of 4240	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	96
PID 4244 wrote to memory of 4240	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	96
PID 4244 wrote to memory of 3592	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	97
PID 4244 wrote to memory of 3592	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	97
PID 4244 wrote to memory of 3244	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	98
PID 4244 wrote to memory of 3244	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	98
PID 4244 wrote to memory of 1376	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	99
PID 4244 wrote to memory of 1376	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	99
PID 4244 wrote to memory of 4756	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	100
PID 4244 wrote to memory of 4756	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	100
PID 4244 wrote to memory of 5024	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	101
PID 4244 wrote to memory of 5024	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	101
PID 4244 wrote to memory of 4780	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	102
PID 4244 wrote to memory of 4780	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	102
PID 4244 wrote to memory of 2592	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	103
PID 4244 wrote to memory of 2592	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	103
PID 4244 wrote to memory of 396	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	104
PID 4244 wrote to memory of 396	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	104
PID 4244 wrote to memory of 1556	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	105
PID 4244 wrote to memory of 1556	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	105
PID 4244 wrote to memory of 4920	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	106
PID 4244 wrote to memory of 4920	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	106
PID 4244 wrote to memory of 960	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	107
PID 4244 wrote to memory of 960	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	107
PID 4244 wrote to memory of 3928	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	108
PID 4244 wrote to memory of 3928	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	108
PID 4244 wrote to memory of 1440	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	109
PID 4244 wrote to memory of 1440	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	109
PID 4244 wrote to memory of 2600	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	110
PID 4244 wrote to memory of 2600	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	110
PID 4244 wrote to memory of 4984	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	111
PID 4244 wrote to memory of 4984	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	111
PID 4244 wrote to memory of 2312	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	112
PID 4244 wrote to memory of 2312	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	112
PID 4244 wrote to memory of 3716	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	113
PID 4244 wrote to memory of 3716	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	113
PID 4244 wrote to memory of 1644	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	114
PID 4244 wrote to memory of 1644	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	114
PID 4244 wrote to memory of 840	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	115
PID 4244 wrote to memory of 840	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	115
PID 4244 wrote to memory of 4448	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	116
PID 4244 wrote to memory of 4448	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	116
PID 4244 wrote to memory of 5012	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	117
PID 4244 wrote to memory of 5012	4244	4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe	117

C:\Users\Admin\AppData\Local\Temp\4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe
"C:\Users\Admin\AppData\Local\Temp\4dfdf0f4cce7feff2c065c245643ecf5b5484e4f0a82b3fa97207597e5914969.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\System\EyYPOQJ.exe
  C:\Windows\System\EyYPOQJ.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\dSYjZkC.exe
  C:\Windows\System\dSYjZkC.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\bBBYvWL.exe
  C:\Windows\System\bBBYvWL.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\dnpsBfz.exe
  C:\Windows\System\dnpsBfz.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\aWVxonL.exe
  C:\Windows\System\aWVxonL.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\CJeUlOR.exe
  C:\Windows\System\CJeUlOR.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\vgfodoY.exe
  C:\Windows\System\vgfodoY.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\zFrgluw.exe
  C:\Windows\System\zFrgluw.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\beFPlhO.exe
  C:\Windows\System\beFPlhO.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\rwXFNrH.exe
  C:\Windows\System\rwXFNrH.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\ldGFmGv.exe
  C:\Windows\System\ldGFmGv.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\jInMfbj.exe
  C:\Windows\System\jInMfbj.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\UavpiJV.exe
  C:\Windows\System\UavpiJV.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\aEHIGVd.exe
  C:\Windows\System\aEHIGVd.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\xwGooyH.exe
  C:\Windows\System\xwGooyH.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\yZDUlTq.exe
  C:\Windows\System\yZDUlTq.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\evpksha.exe
  C:\Windows\System\evpksha.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\vtyqlCN.exe
  C:\Windows\System\vtyqlCN.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\Twleuyk.exe
  C:\Windows\System\Twleuyk.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\tyZAkgj.exe
  C:\Windows\System\tyZAkgj.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\LFQSxbd.exe
  C:\Windows\System\LFQSxbd.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\CmAOBLf.exe
  C:\Windows\System\CmAOBLf.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\SeRsoQP.exe
  C:\Windows\System\SeRsoQP.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\eYgqIFj.exe
  C:\Windows\System\eYgqIFj.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\sMBrowB.exe
  C:\Windows\System\sMBrowB.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\HyaqNVT.exe
  C:\Windows\System\HyaqNVT.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\PXrUVBz.exe
  C:\Windows\System\PXrUVBz.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\atfppwQ.exe
  C:\Windows\System\atfppwQ.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\qlmBegx.exe
  C:\Windows\System\qlmBegx.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\FPbTzXD.exe
  C:\Windows\System\FPbTzXD.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\jDbMlms.exe
  C:\Windows\System\jDbMlms.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\gvJMoZx.exe
  C:\Windows\System\gvJMoZx.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\VNdPPLC.exe
  C:\Windows\System\VNdPPLC.exe
  2⤵
  - Executes dropped EXE
  PID:504
- C:\Windows\System\OdCneap.exe
  C:\Windows\System\OdCneap.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\VmTpWnV.exe
  C:\Windows\System\VmTpWnV.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\CqTuyMO.exe
  C:\Windows\System\CqTuyMO.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\BIhjdLh.exe
  C:\Windows\System\BIhjdLh.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\Wohhnbk.exe
  C:\Windows\System\Wohhnbk.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\yUmWLWx.exe
  C:\Windows\System\yUmWLWx.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\VDYAEqo.exe
  C:\Windows\System\VDYAEqo.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\npsFapT.exe
  C:\Windows\System\npsFapT.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\spJBERW.exe
  C:\Windows\System\spJBERW.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\rdEHlBI.exe
  C:\Windows\System\rdEHlBI.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\EniGlBB.exe
  C:\Windows\System\EniGlBB.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\pSwfgpM.exe
  C:\Windows\System\pSwfgpM.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\qEtUimB.exe
  C:\Windows\System\qEtUimB.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\wTALnri.exe
  C:\Windows\System\wTALnri.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\uYRzVnj.exe
  C:\Windows\System\uYRzVnj.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\zxbRgxE.exe
  C:\Windows\System\zxbRgxE.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\LShCqPR.exe
  C:\Windows\System\LShCqPR.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\bmplOmY.exe
  C:\Windows\System\bmplOmY.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\DSIdJHQ.exe
  C:\Windows\System\DSIdJHQ.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\SzrVwhL.exe
  C:\Windows\System\SzrVwhL.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\nhQdRRv.exe
  C:\Windows\System\nhQdRRv.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\DbrFDro.exe
  C:\Windows\System\DbrFDro.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\KqiIwoU.exe
  C:\Windows\System\KqiIwoU.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\ICBusAr.exe
  C:\Windows\System\ICBusAr.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\vyaxFgw.exe
  C:\Windows\System\vyaxFgw.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\YrWRNlq.exe
  C:\Windows\System\YrWRNlq.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\LqnTStY.exe
  C:\Windows\System\LqnTStY.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\VKvnJnZ.exe
  C:\Windows\System\VKvnJnZ.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\snMxjiT.exe
  C:\Windows\System\snMxjiT.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\mOmlHlo.exe
  C:\Windows\System\mOmlHlo.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\sapXnLo.exe
  C:\Windows\System\sapXnLo.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\fUljGoO.exe
  C:\Windows\System\fUljGoO.exe
  2⤵
  PID:1476
- C:\Windows\System\tAPZUpT.exe
  C:\Windows\System\tAPZUpT.exe
  2⤵
  PID:3532
- C:\Windows\System\oNIdmxW.exe
  C:\Windows\System\oNIdmxW.exe
  2⤵
  PID:4184
- C:\Windows\System\kOXNFlQ.exe
  C:\Windows\System\kOXNFlQ.exe
  2⤵
  PID:4908
- C:\Windows\System\lTATLvy.exe
  C:\Windows\System\lTATLvy.exe
  2⤵
  PID:2772
- C:\Windows\System\EEesLPK.exe
  C:\Windows\System\EEesLPK.exe
  2⤵
  PID:1344
- C:\Windows\System\JsSQWOQ.exe
  C:\Windows\System\JsSQWOQ.exe
  2⤵
  PID:1684
- C:\Windows\System\OuSiHbV.exe
  C:\Windows\System\OuSiHbV.exe
  2⤵
  PID:224
- C:\Windows\System\lqvBxZA.exe
  C:\Windows\System\lqvBxZA.exe
  2⤵
  PID:2068
- C:\Windows\System\oibFyyd.exe
  C:\Windows\System\oibFyyd.exe
  2⤵
  PID:4064
- C:\Windows\System\OcPPVxA.exe
  C:\Windows\System\OcPPVxA.exe
  2⤵
  PID:3584
- C:\Windows\System\JZXsZcG.exe
  C:\Windows\System\JZXsZcG.exe
  2⤵
  PID:2616
- C:\Windows\System\jxYIssG.exe
  C:\Windows\System\jxYIssG.exe
  2⤵
  PID:3720
- C:\Windows\System\NVvZwMh.exe
  C:\Windows\System\NVvZwMh.exe
  2⤵
  PID:1140
- C:\Windows\System\OZDNLRe.exe
  C:\Windows\System\OZDNLRe.exe
  2⤵
  PID:5136
- C:\Windows\System\QfWSwjf.exe
  C:\Windows\System\QfWSwjf.exe
  2⤵
  PID:5152
- C:\Windows\System\oKulPmm.exe
  C:\Windows\System\oKulPmm.exe
  2⤵
  PID:5180
- C:\Windows\System\ujpAjTK.exe
  C:\Windows\System\ujpAjTK.exe
  2⤵
  PID:5208
- C:\Windows\System\jCKpfZp.exe
  C:\Windows\System\jCKpfZp.exe
  2⤵
  PID:5236
- C:\Windows\System\oVMtxAW.exe
  C:\Windows\System\oVMtxAW.exe
  2⤵
  PID:5264
- C:\Windows\System\rRmUiMt.exe
  C:\Windows\System\rRmUiMt.exe
  2⤵
  PID:5292
- C:\Windows\System\yvErmTU.exe
  C:\Windows\System\yvErmTU.exe
  2⤵
  PID:5320
- C:\Windows\System\zJYDVnE.exe
  C:\Windows\System\zJYDVnE.exe
  2⤵
  PID:5348
- C:\Windows\System\boPBqBB.exe
  C:\Windows\System\boPBqBB.exe
  2⤵
  PID:5372
- C:\Windows\System\AHnEMab.exe
  C:\Windows\System\AHnEMab.exe
  2⤵
  PID:5400
- C:\Windows\System\vVDbubG.exe
  C:\Windows\System\vVDbubG.exe
  2⤵
  PID:5428
- C:\Windows\System\AzZzhMm.exe
  C:\Windows\System\AzZzhMm.exe
  2⤵
  PID:5460
- C:\Windows\System\jUjHLas.exe
  C:\Windows\System\jUjHLas.exe
  2⤵
  PID:5488
- C:\Windows\System\XMSoLKL.exe
  C:\Windows\System\XMSoLKL.exe
  2⤵
  PID:5512
- C:\Windows\System\CeefEfs.exe
  C:\Windows\System\CeefEfs.exe
  2⤵
  PID:5544
- C:\Windows\System\WNvfSWj.exe
  C:\Windows\System\WNvfSWj.exe
  2⤵
  PID:5572
- C:\Windows\System\UsLxOjN.exe
  C:\Windows\System\UsLxOjN.exe
  2⤵
  PID:5600
- C:\Windows\System\HcUQelM.exe
  C:\Windows\System\HcUQelM.exe
  2⤵
  PID:5628
- C:\Windows\System\CNbTxLE.exe
  C:\Windows\System\CNbTxLE.exe
  2⤵
  PID:5656
- C:\Windows\System\IYYQdUL.exe
  C:\Windows\System\IYYQdUL.exe
  2⤵
  PID:5684
- C:\Windows\System\vqmtGUM.exe
  C:\Windows\System\vqmtGUM.exe
  2⤵
  PID:5712
- C:\Windows\System\JZpmyIu.exe
  C:\Windows\System\JZpmyIu.exe
  2⤵
  PID:5740
- C:\Windows\System\yEaPBFC.exe
  C:\Windows\System\yEaPBFC.exe
  2⤵
  PID:5768
- C:\Windows\System\QnXCagV.exe
  C:\Windows\System\QnXCagV.exe
  2⤵
  PID:5792
- C:\Windows\System\matqCXz.exe
  C:\Windows\System\matqCXz.exe
  2⤵
  PID:5820
- C:\Windows\System\xFBnLqY.exe
  C:\Windows\System\xFBnLqY.exe
  2⤵
  PID:5852
- C:\Windows\System\GHxFwxg.exe
  C:\Windows\System\GHxFwxg.exe
  2⤵
  PID:5876
- C:\Windows\System\esgeSpv.exe
  C:\Windows\System\esgeSpv.exe
  2⤵
  PID:5908
- C:\Windows\System\jPVpdKw.exe
  C:\Windows\System\jPVpdKw.exe
  2⤵
  PID:5932
- C:\Windows\System\njGJykY.exe
  C:\Windows\System\njGJykY.exe
  2⤵
  PID:5964
- C:\Windows\System\pQXZdGB.exe
  C:\Windows\System\pQXZdGB.exe
  2⤵
  PID:5992
- C:\Windows\System\LdOOadP.exe
  C:\Windows\System\LdOOadP.exe
  2⤵
  PID:6020
- C:\Windows\System\VaEpzAd.exe
  C:\Windows\System\VaEpzAd.exe
  2⤵
  PID:6048
- C:\Windows\System\vZVIybS.exe
  C:\Windows\System\vZVIybS.exe
  2⤵
  PID:6072
- C:\Windows\System\GqafBmV.exe
  C:\Windows\System\GqafBmV.exe
  2⤵
  PID:6104
- C:\Windows\System\veDrnwg.exe
  C:\Windows\System\veDrnwg.exe
  2⤵
  PID:6132
- C:\Windows\System\ppVkFtt.exe
  C:\Windows\System\ppVkFtt.exe
  2⤵
  PID:1672
- C:\Windows\System\HjVzwzj.exe
  C:\Windows\System\HjVzwzj.exe
  2⤵
  PID:5000
- C:\Windows\System\ZDckmLW.exe
  C:\Windows\System\ZDckmLW.exe
  2⤵
  PID:1772
- C:\Windows\System\sUZQhXN.exe
  C:\Windows\System\sUZQhXN.exe
  2⤵
  PID:1336
- C:\Windows\System\OFDZxfk.exe
  C:\Windows\System\OFDZxfk.exe
  2⤵
  PID:4076
- C:\Windows\System\lcjqVpd.exe
  C:\Windows\System\lcjqVpd.exe
  2⤵
  PID:3420
- C:\Windows\System\QZObtbg.exe
  C:\Windows\System\QZObtbg.exe
  2⤵
  PID:5192
- C:\Windows\System\zrHSbVi.exe
  C:\Windows\System\zrHSbVi.exe
  2⤵
  PID:5252
- C:\Windows\System\tcuVyXk.exe
  C:\Windows\System\tcuVyXk.exe
  2⤵
  PID:5308
- C:\Windows\System\OomZyAO.exe
  C:\Windows\System\OomZyAO.exe
  2⤵
  PID:5388
- C:\Windows\System\hRGZOGo.exe
  C:\Windows\System\hRGZOGo.exe
  2⤵
  PID:5444
- C:\Windows\System\MJnqYLt.exe
  C:\Windows\System\MJnqYLt.exe
  2⤵
  PID:5504
- C:\Windows\System\gEfVvil.exe
  C:\Windows\System\gEfVvil.exe
  2⤵
  PID:5564
- C:\Windows\System\QYRlcpy.exe
  C:\Windows\System\QYRlcpy.exe
  2⤵
  PID:5644
- C:\Windows\System\cCSkwNF.exe
  C:\Windows\System\cCSkwNF.exe
  2⤵
  PID:5704
- C:\Windows\System\CFGLuFP.exe
  C:\Windows\System\CFGLuFP.exe
  2⤵
  PID:5780
- C:\Windows\System\LCDKNGs.exe
  C:\Windows\System\LCDKNGs.exe
  2⤵
  PID:5840
- C:\Windows\System\iUDnnxU.exe
  C:\Windows\System\iUDnnxU.exe
  2⤵
  PID:5900
- C:\Windows\System\CNIjYXC.exe
  C:\Windows\System\CNIjYXC.exe
  2⤵
  PID:5976
- C:\Windows\System\DuWYqcs.exe
  C:\Windows\System\DuWYqcs.exe
  2⤵
  PID:6036
- C:\Windows\System\jflGuHr.exe
  C:\Windows\System\jflGuHr.exe
  2⤵
  PID:6096
- C:\Windows\System\ncbGwyd.exe
  C:\Windows\System\ncbGwyd.exe
  2⤵
  PID:1188
- C:\Windows\System\bgzWBiM.exe
  C:\Windows\System\bgzWBiM.exe
  2⤵
  PID:3916
- C:\Windows\System\LffvBOj.exe
  C:\Windows\System\LffvBOj.exe
  2⤵
  PID:216
- C:\Windows\System\IgBfWdU.exe
  C:\Windows\System\IgBfWdU.exe
  2⤵
  PID:5228
- C:\Windows\System\VEcknRp.exe
  C:\Windows\System\VEcknRp.exe
  2⤵
  PID:5416
- C:\Windows\System\EkgOMvN.exe
  C:\Windows\System\EkgOMvN.exe
  2⤵
  PID:5556
- C:\Windows\System\IDSNgFN.exe
  C:\Windows\System\IDSNgFN.exe
  2⤵
  PID:5732
- C:\Windows\System\FJlphpv.exe
  C:\Windows\System\FJlphpv.exe
  2⤵
  PID:5868
- C:\Windows\System\qfhBkCD.exe
  C:\Windows\System\qfhBkCD.exe
  2⤵
  PID:6004
- C:\Windows\System\UGAAOVN.exe
  C:\Windows\System\UGAAOVN.exe
  2⤵
  PID:6172
- C:\Windows\System\TsOdsbI.exe
  C:\Windows\System\TsOdsbI.exe
  2⤵
  PID:6200
- C:\Windows\System\sNxCdzw.exe
  C:\Windows\System\sNxCdzw.exe
  2⤵
  PID:6224
- C:\Windows\System\KCsfkgh.exe
  C:\Windows\System\KCsfkgh.exe
  2⤵
  PID:6252
- C:\Windows\System\amdANYw.exe
  C:\Windows\System\amdANYw.exe
  2⤵
  PID:6284
- C:\Windows\System\cptKcOF.exe
  C:\Windows\System\cptKcOF.exe
  2⤵
  PID:6312
- C:\Windows\System\jVOlfbw.exe
  C:\Windows\System\jVOlfbw.exe
  2⤵
  PID:6340
- C:\Windows\System\RQUAiTB.exe
  C:\Windows\System\RQUAiTB.exe
  2⤵
  PID:6364
- C:\Windows\System\iAMSZbL.exe
  C:\Windows\System\iAMSZbL.exe
  2⤵
  PID:6392
- C:\Windows\System\UAKwxFO.exe
  C:\Windows\System\UAKwxFO.exe
  2⤵
  PID:6424
- C:\Windows\System\VVpVPMg.exe
  C:\Windows\System\VVpVPMg.exe
  2⤵
  PID:6452
- C:\Windows\System\wUWgpqG.exe
  C:\Windows\System\wUWgpqG.exe
  2⤵
  PID:6480
- C:\Windows\System\wzoOkPF.exe
  C:\Windows\System\wzoOkPF.exe
  2⤵
  PID:6512
- C:\Windows\System\XtBpzGu.exe
  C:\Windows\System\XtBpzGu.exe
  2⤵
  PID:6536
- C:\Windows\System\WZdXhKw.exe
  C:\Windows\System\WZdXhKw.exe
  2⤵
  PID:6564
- C:\Windows\System\xEsIgsn.exe
  C:\Windows\System\xEsIgsn.exe
  2⤵
  PID:6592
- C:\Windows\System\sisFmVp.exe
  C:\Windows\System\sisFmVp.exe
  2⤵
  PID:6620
- C:\Windows\System\iivtCoC.exe
  C:\Windows\System\iivtCoC.exe
  2⤵
  PID:6648
- C:\Windows\System\tUCPRoX.exe
  C:\Windows\System\tUCPRoX.exe
  2⤵
  PID:6676
- C:\Windows\System\cWPCkCI.exe
  C:\Windows\System\cWPCkCI.exe
  2⤵
  PID:6704
- C:\Windows\System\PLUHNso.exe
  C:\Windows\System\PLUHNso.exe
  2⤵
  PID:6732
- C:\Windows\System\aYqeCKh.exe
  C:\Windows\System\aYqeCKh.exe
  2⤵
  PID:6760
- C:\Windows\System\ahpUxSB.exe
  C:\Windows\System\ahpUxSB.exe
  2⤵
  PID:6788
- C:\Windows\System\vacQHKR.exe
  C:\Windows\System\vacQHKR.exe
  2⤵
  PID:6816
- C:\Windows\System\DpcDEHY.exe
  C:\Windows\System\DpcDEHY.exe
  2⤵
  PID:6844
- C:\Windows\System\MsYOMcP.exe
  C:\Windows\System\MsYOMcP.exe
  2⤵
  PID:6868
- C:\Windows\System\qYaovvz.exe
  C:\Windows\System\qYaovvz.exe
  2⤵
  PID:6900
- C:\Windows\System\gdkXpMJ.exe
  C:\Windows\System\gdkXpMJ.exe
  2⤵
  PID:6932
- C:\Windows\System\oGTNSNR.exe
  C:\Windows\System\oGTNSNR.exe
  2⤵
  PID:6956
- C:\Windows\System\gUSUaTr.exe
  C:\Windows\System\gUSUaTr.exe
  2⤵
  PID:6984
- C:\Windows\System\HRWFOIN.exe
  C:\Windows\System\HRWFOIN.exe
  2⤵
  PID:7012
- C:\Windows\System\UAJCuuQ.exe
  C:\Windows\System\UAJCuuQ.exe
  2⤵
  PID:7040
- C:\Windows\System\HGOdYrO.exe
  C:\Windows\System\HGOdYrO.exe
  2⤵
  PID:7068
- C:\Windows\System\KbBqpEm.exe
  C:\Windows\System\KbBqpEm.exe
  2⤵
  PID:7092
- C:\Windows\System\TvSuVrh.exe
  C:\Windows\System\TvSuVrh.exe
  2⤵
  PID:7124
- C:\Windows\System\vUmbozA.exe
  C:\Windows\System\vUmbozA.exe
  2⤵
  PID:7148
- C:\Windows\System\jLeipen.exe
  C:\Windows\System\jLeipen.exe
  2⤵
  PID:6012
- C:\Windows\System\GoxulSJ.exe
  C:\Windows\System\GoxulSJ.exe
  2⤵
  PID:1036
- C:\Windows\System\JwXILIi.exe
  C:\Windows\System\JwXILIi.exe
  2⤵
  PID:5168
- C:\Windows\System\iLGCBfz.exe
  C:\Windows\System\iLGCBfz.exe
  2⤵
  PID:5500
- C:\Windows\System\wVTqOIl.exe
  C:\Windows\System\wVTqOIl.exe
  2⤵
  PID:5812
- C:\Windows\System\EwcrlTD.exe
  C:\Windows\System\EwcrlTD.exe
  2⤵
  PID:6188
- C:\Windows\System\ngHmHFL.exe
  C:\Windows\System\ngHmHFL.exe
  2⤵
  PID:6244
- C:\Windows\System\tNbAwrX.exe
  C:\Windows\System\tNbAwrX.exe
  2⤵
  PID:3408
- C:\Windows\System\gNXkriM.exe
  C:\Windows\System\gNXkriM.exe
  2⤵
  PID:6352
- C:\Windows\System\aOCKHxl.exe
  C:\Windows\System\aOCKHxl.exe
  2⤵
  PID:6388
- C:\Windows\System\EZVsoHJ.exe
  C:\Windows\System\EZVsoHJ.exe
  2⤵
  PID:6468
- C:\Windows\System\MemTSGm.exe
  C:\Windows\System\MemTSGm.exe
  2⤵
  PID:6636
- C:\Windows\System\WUBhxjF.exe
  C:\Windows\System\WUBhxjF.exe
  2⤵
  PID:6672
- C:\Windows\System\MmQWbMN.exe
  C:\Windows\System\MmQWbMN.exe
  2⤵
  PID:6696
- C:\Windows\System\QRwqSsA.exe
  C:\Windows\System\QRwqSsA.exe
  2⤵
  PID:6804
- C:\Windows\System\CqqMXVW.exe
  C:\Windows\System\CqqMXVW.exe
  2⤵
  PID:6864
- C:\Windows\System\UpbIwsa.exe
  C:\Windows\System\UpbIwsa.exe
  2⤵
  PID:6928
- C:\Windows\System\uSgjwmf.exe
  C:\Windows\System\uSgjwmf.exe
  2⤵
  PID:6972
- C:\Windows\System\CQXnNIA.exe
  C:\Windows\System\CQXnNIA.exe
  2⤵
  PID:1632
- C:\Windows\System\GBsjRym.exe
  C:\Windows\System\GBsjRym.exe
  2⤵
  PID:4056
- C:\Windows\System\JuKIbVV.exe
  C:\Windows\System\JuKIbVV.exe
  2⤵
  PID:4992
- C:\Windows\System\WrfLdmY.exe
  C:\Windows\System\WrfLdmY.exe
  2⤵
  PID:7144
- C:\Windows\System\gQcBVer.exe
  C:\Windows\System\gQcBVer.exe
  2⤵
  PID:6088
- C:\Windows\System\hUgxuwp.exe
  C:\Windows\System\hUgxuwp.exe
  2⤵
  PID:1908
- C:\Windows\System\npqBfzM.exe
  C:\Windows\System\npqBfzM.exe
  2⤵
  PID:5364
- C:\Windows\System\KIGdIyX.exe
  C:\Windows\System\KIGdIyX.exe
  2⤵
  PID:1472
- C:\Windows\System\sgnlidf.exe
  C:\Windows\System\sgnlidf.exe
  2⤵
  PID:3012
- C:\Windows\System\Vrltknz.exe
  C:\Windows\System\Vrltknz.exe
  2⤵
  PID:6384
- C:\Windows\System\JIeYyNl.exe
  C:\Windows\System\JIeYyNl.exe
  2⤵
  PID:6436
- C:\Windows\System\dyRjmKZ.exe
  C:\Windows\System\dyRjmKZ.exe
  2⤵
  PID:6532
- C:\Windows\System\xzwmELG.exe
  C:\Windows\System\xzwmELG.exe
  2⤵
  PID:3812
- C:\Windows\System\XWVTSRL.exe
  C:\Windows\System\XWVTSRL.exe
  2⤵
  PID:4528
- C:\Windows\System\vPngUlo.exe
  C:\Windows\System\vPngUlo.exe
  2⤵
  PID:6772
- C:\Windows\System\SsjvhSy.exe
  C:\Windows\System\SsjvhSy.exe
  2⤵
  PID:2320
- C:\Windows\System\dvASWDI.exe
  C:\Windows\System\dvASWDI.exe
  2⤵
  PID:6968
- C:\Windows\System\HblfHlv.exe
  C:\Windows\System\HblfHlv.exe
  2⤵
  PID:7060
- C:\Windows\System\zvENoqJ.exe
  C:\Windows\System\zvENoqJ.exe
  2⤵
  PID:4504
- C:\Windows\System\vEHaxwQ.exe
  C:\Windows\System\vEHaxwQ.exe
  2⤵
  PID:4536
- C:\Windows\System\cxZCmij.exe
  C:\Windows\System\cxZCmij.exe
  2⤵
  PID:956
- C:\Windows\System\XwKFboC.exe
  C:\Windows\System\XwKFboC.exe
  2⤵
  PID:5088
- C:\Windows\System\LjrReMe.exe
  C:\Windows\System\LjrReMe.exe
  2⤵
  PID:6496
- C:\Windows\System\bHNbJiM.exe
  C:\Windows\System\bHNbJiM.exe
  2⤵
  PID:6604
- C:\Windows\System\erGbsUQ.exe
  C:\Windows\System\erGbsUQ.exe
  2⤵
  PID:6860
- C:\Windows\System\FDqHFjh.exe
  C:\Windows\System\FDqHFjh.exe
  2⤵
  PID:6688
- C:\Windows\System\ZecUuCg.exe
  C:\Windows\System\ZecUuCg.exe
  2⤵
  PID:4624
- C:\Windows\System\rkfDyqv.exe
  C:\Windows\System\rkfDyqv.exe
  2⤵
  PID:1944
- C:\Windows\System\DPIdmst.exe
  C:\Windows\System\DPIdmst.exe
  2⤵
  PID:7192
- C:\Windows\System\hDakffo.exe
  C:\Windows\System\hDakffo.exe
  2⤵
  PID:7228
- C:\Windows\System\MDInEXi.exe
  C:\Windows\System\MDInEXi.exe
  2⤵
  PID:7256
- C:\Windows\System\RffQatM.exe
  C:\Windows\System\RffQatM.exe
  2⤵
  PID:7276
- C:\Windows\System\toNvNLc.exe
  C:\Windows\System\toNvNLc.exe
  2⤵
  PID:7308
- C:\Windows\System\CFccezm.exe
  C:\Windows\System\CFccezm.exe
  2⤵
  PID:7340
- C:\Windows\System\mjnGCOi.exe
  C:\Windows\System\mjnGCOi.exe
  2⤵
  PID:7360
- C:\Windows\System\cQwnzUA.exe
  C:\Windows\System\cQwnzUA.exe
  2⤵
  PID:7396
- C:\Windows\System\uEQVwcB.exe
  C:\Windows\System\uEQVwcB.exe
  2⤵
  PID:7424
- C:\Windows\System\MGevoac.exe
  C:\Windows\System\MGevoac.exe
  2⤵
  PID:7440
- C:\Windows\System\sqBUGEk.exe
  C:\Windows\System\sqBUGEk.exe
  2⤵
  PID:7480
- C:\Windows\System\xSXVWBP.exe
  C:\Windows\System\xSXVWBP.exe
  2⤵
  PID:7500
- C:\Windows\System\PTgKJly.exe
  C:\Windows\System\PTgKJly.exe
  2⤵
  PID:7524
- C:\Windows\System\FcaHyhG.exe
  C:\Windows\System\FcaHyhG.exe
  2⤵
  PID:7560
- C:\Windows\System\yLGkYHp.exe
  C:\Windows\System\yLGkYHp.exe
  2⤵
  PID:7592
- C:\Windows\System\zDKuXbl.exe
  C:\Windows\System\zDKuXbl.exe
  2⤵
  PID:7624
- C:\Windows\System\GyCgydZ.exe
  C:\Windows\System\GyCgydZ.exe
  2⤵
  PID:7644
- C:\Windows\System\SwMMkKb.exe
  C:\Windows\System\SwMMkKb.exe
  2⤵
  PID:7680
- C:\Windows\System\ORhMuwR.exe
  C:\Windows\System\ORhMuwR.exe
  2⤵
  PID:7696
- C:\Windows\System\gqKrAlq.exe
  C:\Windows\System\gqKrAlq.exe
  2⤵
  PID:7724
- C:\Windows\System\CUXXOcW.exe
  C:\Windows\System\CUXXOcW.exe
  2⤵
  PID:7748
- C:\Windows\System\sJidLxZ.exe
  C:\Windows\System\sJidLxZ.exe
  2⤵
  PID:7772
- C:\Windows\System\TACKzIc.exe
  C:\Windows\System\TACKzIc.exe
  2⤵
  PID:7800
- C:\Windows\System\wspOsPS.exe
  C:\Windows\System\wspOsPS.exe
  2⤵
  PID:7832
- C:\Windows\System\HrqroPK.exe
  C:\Windows\System\HrqroPK.exe
  2⤵
  PID:7864
- C:\Windows\System\EnBcqIz.exe
  C:\Windows\System\EnBcqIz.exe
  2⤵
  PID:7888
- C:\Windows\System\bwEGiTh.exe
  C:\Windows\System\bwEGiTh.exe
  2⤵
  PID:7920
- C:\Windows\System\hBnEFLF.exe
  C:\Windows\System\hBnEFLF.exe
  2⤵
  PID:7956
- C:\Windows\System\uGSIFyh.exe
  C:\Windows\System\uGSIFyh.exe
  2⤵
  PID:7988
- C:\Windows\System\iuYsNrm.exe
  C:\Windows\System\iuYsNrm.exe
  2⤵
  PID:8016
- C:\Windows\System\CXPiqHf.exe
  C:\Windows\System\CXPiqHf.exe
  2⤵
  PID:8044
- C:\Windows\System\QmtvQVB.exe
  C:\Windows\System\QmtvQVB.exe
  2⤵
  PID:8064
- C:\Windows\System\cWrlLyc.exe
  C:\Windows\System\cWrlLyc.exe
  2⤵
  PID:8088
- C:\Windows\System\UfwCQbX.exe
  C:\Windows\System\UfwCQbX.exe
  2⤵
  PID:8104
- C:\Windows\System\UygOqEh.exe
  C:\Windows\System\UygOqEh.exe
  2⤵
  PID:8136
- C:\Windows\System\RoLVwFO.exe
  C:\Windows\System\RoLVwFO.exe
  2⤵
  PID:8164
- C:\Windows\System\ISJhVoV.exe
  C:\Windows\System\ISJhVoV.exe
  2⤵
  PID:2192
- C:\Windows\System\VnbyBTO.exe
  C:\Windows\System\VnbyBTO.exe
  2⤵
  PID:7240
- C:\Windows\System\ZVYLDiD.exe
  C:\Windows\System\ZVYLDiD.exe
  2⤵
  PID:7272
- C:\Windows\System\zOXhOrK.exe
  C:\Windows\System\zOXhOrK.exe
  2⤵
  PID:7380
- C:\Windows\System\sbJCvLN.exe
  C:\Windows\System\sbJCvLN.exe
  2⤵
  PID:7416
- C:\Windows\System\AALEhij.exe
  C:\Windows\System\AALEhij.exe
  2⤵
  PID:7476
- C:\Windows\System\rQuoYCY.exe
  C:\Windows\System\rQuoYCY.exe
  2⤵
  PID:7556
- C:\Windows\System\qnATfWB.exe
  C:\Windows\System\qnATfWB.exe
  2⤵
  PID:7632
- C:\Windows\System\RGBCccp.exe
  C:\Windows\System\RGBCccp.exe
  2⤵
  PID:7688
- C:\Windows\System\NsDzLMO.exe
  C:\Windows\System\NsDzLMO.exe
  2⤵
  PID:7780
- C:\Windows\System\kHYyegr.exe
  C:\Windows\System\kHYyegr.exe
  2⤵
  PID:7788
- C:\Windows\System\qlxWQzT.exe
  C:\Windows\System\qlxWQzT.exe
  2⤵
  PID:7880
- C:\Windows\System\KPkQhjM.exe
  C:\Windows\System\KPkQhjM.exe
  2⤵
  PID:7944
- C:\Windows\System\PeeUFFr.exe
  C:\Windows\System\PeeUFFr.exe
  2⤵
  PID:8036
- C:\Windows\System\pacjNFr.exe
  C:\Windows\System\pacjNFr.exe
  2⤵
  PID:8060
- C:\Windows\System\gxfkOpy.exe
  C:\Windows\System\gxfkOpy.exe
  2⤵
  PID:8120
- C:\Windows\System\OsOghqO.exe
  C:\Windows\System\OsOghqO.exe
  2⤵
  PID:7252
- C:\Windows\System\SQJKjfU.exe
  C:\Windows\System\SQJKjfU.exe
  2⤵
  PID:7328
- C:\Windows\System\TCzCcCx.exe
  C:\Windows\System\TCzCcCx.exe
  2⤵
  PID:7460
- C:\Windows\System\AtzlGAw.exe
  C:\Windows\System\AtzlGAw.exe
  2⤵
  PID:7620
- C:\Windows\System\jKGGkQe.exe
  C:\Windows\System\jKGGkQe.exe
  2⤵
  PID:7664
- C:\Windows\System\QfZUCwB.exe
  C:\Windows\System\QfZUCwB.exe
  2⤵
  PID:7908
- C:\Windows\System\WZbOXQK.exe
  C:\Windows\System\WZbOXQK.exe
  2⤵
  PID:7980
- C:\Windows\System\BMyvjHZ.exe
  C:\Windows\System\BMyvjHZ.exe
  2⤵
  PID:8032
- C:\Windows\System\GQfjYUO.exe
  C:\Windows\System\GQfjYUO.exe
  2⤵
  PID:7188
- C:\Windows\System\wYpGACq.exe
  C:\Windows\System\wYpGACq.exe
  2⤵
  PID:7408
- C:\Windows\System\FrccsZA.exe
  C:\Windows\System\FrccsZA.exe
  2⤵
  PID:7812
- C:\Windows\System\WHGKgOe.exe
  C:\Windows\System\WHGKgOe.exe
  2⤵
  PID:7316
- C:\Windows\System\XNstKIS.exe
  C:\Windows\System\XNstKIS.exe
  2⤵
  PID:8236
- C:\Windows\System\cZYKOmJ.exe
  C:\Windows\System\cZYKOmJ.exe
  2⤵
  PID:8264
- C:\Windows\System\dSyVKpX.exe
  C:\Windows\System\dSyVKpX.exe
  2⤵
  PID:8292
- C:\Windows\System\pxFCczj.exe
  C:\Windows\System\pxFCczj.exe
  2⤵
  PID:8332
- C:\Windows\System\jctzRqQ.exe
  C:\Windows\System\jctzRqQ.exe
  2⤵
  PID:8360
- C:\Windows\System\SbyvbkG.exe
  C:\Windows\System\SbyvbkG.exe
  2⤵
  PID:8380
- C:\Windows\System\DKWerNh.exe
  C:\Windows\System\DKWerNh.exe
  2⤵
  PID:8404
- C:\Windows\System\fDzWuzr.exe
  C:\Windows\System\fDzWuzr.exe
  2⤵
  PID:8420
- C:\Windows\System\GivyLNe.exe
  C:\Windows\System\GivyLNe.exe
  2⤵
  PID:8440
- C:\Windows\System\ikHksvp.exe
  C:\Windows\System\ikHksvp.exe
  2⤵
  PID:8456
- C:\Windows\System\AwoulEv.exe
  C:\Windows\System\AwoulEv.exe
  2⤵
  PID:8484
- C:\Windows\System\yyqpgLr.exe
  C:\Windows\System\yyqpgLr.exe
  2⤵
  PID:8528
- C:\Windows\System\aquXdNp.exe
  C:\Windows\System\aquXdNp.exe
  2⤵
  PID:8560
- C:\Windows\System\TjtXfYQ.exe
  C:\Windows\System\TjtXfYQ.exe
  2⤵
  PID:8592
- C:\Windows\System\JvetJIm.exe
  C:\Windows\System\JvetJIm.exe
  2⤵
  PID:8632
- C:\Windows\System\vDoXFzn.exe
  C:\Windows\System\vDoXFzn.exe
  2⤵
  PID:8660
- C:\Windows\System\RnbQDDw.exe
  C:\Windows\System\RnbQDDw.exe
  2⤵
  PID:8688
- C:\Windows\System\zhtdiOg.exe
  C:\Windows\System\zhtdiOg.exe
  2⤵
  PID:8712
- C:\Windows\System\GVaYaDS.exe
  C:\Windows\System\GVaYaDS.exe
  2⤵
  PID:8736
- C:\Windows\System\vuEPeFi.exe
  C:\Windows\System\vuEPeFi.exe
  2⤵
  PID:8764
- C:\Windows\System\fbzIBxX.exe
  C:\Windows\System\fbzIBxX.exe
  2⤵
  PID:8812
- C:\Windows\System\HWZakWa.exe
  C:\Windows\System\HWZakWa.exe
  2⤵
  PID:8832
- C:\Windows\System\oLGPlVR.exe
  C:\Windows\System\oLGPlVR.exe
  2⤵
  PID:8868
- C:\Windows\System\HlZBAdu.exe
  C:\Windows\System\HlZBAdu.exe
  2⤵
  PID:8896
- C:\Windows\System\SLCejVh.exe
  C:\Windows\System\SLCejVh.exe
  2⤵
  PID:8920
- C:\Windows\System\pdCxGDg.exe
  C:\Windows\System\pdCxGDg.exe
  2⤵
  PID:8940
- C:\Windows\System\KRAXtHw.exe
  C:\Windows\System\KRAXtHw.exe
  2⤵
  PID:8968
- C:\Windows\System\hXRWaJZ.exe
  C:\Windows\System\hXRWaJZ.exe
  2⤵
  PID:8996
- C:\Windows\System\yETBnrI.exe
  C:\Windows\System\yETBnrI.exe
  2⤵
  PID:9020
- C:\Windows\System\EQgwUMZ.exe
  C:\Windows\System\EQgwUMZ.exe
  2⤵
  PID:9040
- C:\Windows\System\plUdUBW.exe
  C:\Windows\System\plUdUBW.exe
  2⤵
  PID:9080
- C:\Windows\System\qCuEisW.exe
  C:\Windows\System\qCuEisW.exe
  2⤵
  PID:9108
- C:\Windows\System\CdjvSQv.exe
  C:\Windows\System\CdjvSQv.exe
  2⤵
  PID:9136
- C:\Windows\System\JFeZJLJ.exe
  C:\Windows\System\JFeZJLJ.exe
  2⤵
  PID:9176
- C:\Windows\System\IiSaHdw.exe
  C:\Windows\System\IiSaHdw.exe
  2⤵
  PID:9200
- C:\Windows\System\dlkmwkN.exe
  C:\Windows\System\dlkmwkN.exe
  2⤵
  PID:8008
- C:\Windows\System\xPKEdGZ.exe
  C:\Windows\System\xPKEdGZ.exe
  2⤵
  PID:8372
- C:\Windows\System\lkMpggK.exe
  C:\Windows\System\lkMpggK.exe
  2⤵
  PID:8452
- C:\Windows\System\MzboPhH.exe
  C:\Windows\System\MzboPhH.exe
  2⤵
  PID:8468
- C:\Windows\System\UqCwkHy.exe
  C:\Windows\System\UqCwkHy.exe
  2⤵
  PID:8516
- C:\Windows\System\RUfCcBW.exe
  C:\Windows\System\RUfCcBW.exe
  2⤵
  PID:8588
- C:\Windows\System\ZLuHqav.exe
  C:\Windows\System\ZLuHqav.exe
  2⤵
  PID:8640
- C:\Windows\System\MlMaMOe.exe
  C:\Windows\System\MlMaMOe.exe
  2⤵
  PID:8704
- C:\Windows\System\GoIhoyG.exe
  C:\Windows\System\GoIhoyG.exe
  2⤵
  PID:8400
- C:\Windows\System\CpHZKMB.exe
  C:\Windows\System\CpHZKMB.exe
  2⤵
  PID:8472
- C:\Windows\System\hEHZoBO.exe
  C:\Windows\System\hEHZoBO.exe
  2⤵
  PID:8536
- C:\Windows\System\dhRxXQm.exe
  C:\Windows\System\dhRxXQm.exe
  2⤵
  PID:8800
- C:\Windows\System\xXHazjT.exe
  C:\Windows\System\xXHazjT.exe
  2⤵
  PID:8892
- C:\Windows\System\DSKKlrx.exe
  C:\Windows\System\DSKKlrx.exe
  2⤵
  PID:8956
- C:\Windows\System\ifvnJmV.exe
  C:\Windows\System\ifvnJmV.exe
  2⤵
  PID:8984
- C:\Windows\System\bLtRgSS.exe
  C:\Windows\System\bLtRgSS.exe
  2⤵
  PID:9064
- C:\Windows\System\LMhsVll.exe
  C:\Windows\System\LMhsVll.exe
  2⤵
  PID:9156
- C:\Windows\System\xhHzkCq.exe
  C:\Windows\System\xhHzkCq.exe
  2⤵
  PID:9212
- C:\Windows\System\JPanxsR.exe
  C:\Windows\System\JPanxsR.exe
  2⤵
  PID:8544
- C:\Windows\System\qiXPUVL.exe
  C:\Windows\System\qiXPUVL.exe
  2⤵
  PID:8796
- C:\Windows\System\AuvqwAh.exe
  C:\Windows\System\AuvqwAh.exe
  2⤵
  PID:8928
- C:\Windows\System\PmtxIPA.exe
  C:\Windows\System\PmtxIPA.exe
  2⤵
  PID:9060
- C:\Windows\System\NDoIJWB.exe
  C:\Windows\System\NDoIJWB.exe
  2⤵
  PID:8792
- C:\Windows\System\uYqzfJd.exe
  C:\Windows\System\uYqzfJd.exe
  2⤵
  PID:9032
- C:\Windows\System\fiFXvzz.exe
  C:\Windows\System\fiFXvzz.exe
  2⤵
  PID:9224
- C:\Windows\System\YikVoCp.exe
  C:\Windows\System\YikVoCp.exe
  2⤵
  PID:9252
- C:\Windows\System\RgWvqdP.exe
  C:\Windows\System\RgWvqdP.exe
  2⤵
  PID:9280
- C:\Windows\System\fzDxGyS.exe
  C:\Windows\System\fzDxGyS.exe
  2⤵
  PID:9304
- C:\Windows\System\EdtSikm.exe
  C:\Windows\System\EdtSikm.exe
  2⤵
  PID:9324
- C:\Windows\System\CldRYAr.exe
  C:\Windows\System\CldRYAr.exe
  2⤵
  PID:9360
- C:\Windows\System\fWxCKcI.exe
  C:\Windows\System\fWxCKcI.exe
  2⤵
  PID:9388
- C:\Windows\System\jnZnKcg.exe
  C:\Windows\System\jnZnKcg.exe
  2⤵
  PID:9412
- C:\Windows\System\RQZGoCF.exe
  C:\Windows\System\RQZGoCF.exe
  2⤵
  PID:9456
- C:\Windows\System\XbUZWjz.exe
  C:\Windows\System\XbUZWjz.exe
  2⤵
  PID:9488
- C:\Windows\System\GjVBfQC.exe
  C:\Windows\System\GjVBfQC.exe
  2⤵
  PID:9516
- C:\Windows\System\kAYPqJy.exe
  C:\Windows\System\kAYPqJy.exe
  2⤵
  PID:9532
- C:\Windows\System\BjydWvk.exe
  C:\Windows\System\BjydWvk.exe
  2⤵
  PID:9560
- C:\Windows\System\TygKtGQ.exe
  C:\Windows\System\TygKtGQ.exe
  2⤵
  PID:9584
- C:\Windows\System\jOMqZuH.exe
  C:\Windows\System\jOMqZuH.exe
  2⤵
  PID:9604
- C:\Windows\System\ickUuDm.exe
  C:\Windows\System\ickUuDm.exe
  2⤵
  PID:9636
- C:\Windows\System\cIqANaO.exe
  C:\Windows\System\cIqANaO.exe
  2⤵
  PID:9680
- C:\Windows\System\ogcuOOe.exe
  C:\Windows\System\ogcuOOe.exe
  2⤵
  PID:9708
- C:\Windows\System\aPNiQTh.exe
  C:\Windows\System\aPNiQTh.exe
  2⤵
  PID:9732
- C:\Windows\System\xwxWOUg.exe
  C:\Windows\System\xwxWOUg.exe
  2⤵
  PID:9752
- C:\Windows\System\uAEZled.exe
  C:\Windows\System\uAEZled.exe
  2⤵
  PID:9800
- C:\Windows\System\ZPVrKdf.exe
  C:\Windows\System\ZPVrKdf.exe
  2⤵
  PID:9824
- C:\Windows\System\fZpwopa.exe
  C:\Windows\System\fZpwopa.exe
  2⤵
  PID:9864
- C:\Windows\System\yPFMtev.exe
  C:\Windows\System\yPFMtev.exe
  2⤵
  PID:9880
- C:\Windows\System\OYRKydx.exe
  C:\Windows\System\OYRKydx.exe
  2⤵
  PID:9920
- C:\Windows\System\BGeOpZp.exe
  C:\Windows\System\BGeOpZp.exe
  2⤵
  PID:9948
- C:\Windows\System\zkonnQL.exe
  C:\Windows\System\zkonnQL.exe
  2⤵
  PID:9976
- C:\Windows\System\gnlWIRL.exe
  C:\Windows\System\gnlWIRL.exe
  2⤵
  PID:10004
- C:\Windows\System\kuZusBc.exe
  C:\Windows\System\kuZusBc.exe
  2⤵
  PID:10032
- C:\Windows\System\WWfRpwX.exe
  C:\Windows\System\WWfRpwX.exe
  2⤵
  PID:10048
- C:\Windows\System\gXLrZQv.exe
  C:\Windows\System\gXLrZQv.exe
  2⤵
  PID:10080
- C:\Windows\System\mfZTOIU.exe
  C:\Windows\System\mfZTOIU.exe
  2⤵
  PID:10112
- C:\Windows\System\duhLNoQ.exe
  C:\Windows\System\duhLNoQ.exe
  2⤵
  PID:10176
- C:\Windows\System\aOTbGuA.exe
  C:\Windows\System\aOTbGuA.exe
  2⤵
  PID:10204
- C:\Windows\System\rciblVQ.exe
  C:\Windows\System\rciblVQ.exe
  2⤵
  PID:10220
- C:\Windows\System\DMKYCBb.exe
  C:\Windows\System\DMKYCBb.exe
  2⤵
  PID:9244
- C:\Windows\System\YLTXEFe.exe
  C:\Windows\System\YLTXEFe.exe
  2⤵
  PID:9264
- C:\Windows\System\AeJkQii.exe
  C:\Windows\System\AeJkQii.exe
  2⤵
  PID:9344
- C:\Windows\System\dqfZzdd.exe
  C:\Windows\System\dqfZzdd.exe
  2⤵
  PID:9404
- C:\Windows\System\YgSNrqz.exe
  C:\Windows\System\YgSNrqz.exe
  2⤵
  PID:9484
- C:\Windows\System\ifTumqg.exe
  C:\Windows\System\ifTumqg.exe
  2⤵
  PID:9544
- C:\Windows\System\wYXQTKS.exe
  C:\Windows\System\wYXQTKS.exe
  2⤵
  PID:9292
- C:\Windows\System\VTCXtde.exe
  C:\Windows\System\VTCXtde.exe
  2⤵
  PID:9668
- C:\Windows\System\SaJKwXR.exe
  C:\Windows\System\SaJKwXR.exe
  2⤵
  PID:9764
- C:\Windows\System\iWVUKoY.exe
  C:\Windows\System\iWVUKoY.exe
  2⤵
  PID:9820
- C:\Windows\System\GInhjmr.exe
  C:\Windows\System\GInhjmr.exe
  2⤵
  PID:9876
- C:\Windows\System\SnpITPY.exe
  C:\Windows\System\SnpITPY.exe
  2⤵
  PID:9936
- C:\Windows\System\JVoHvBR.exe
  C:\Windows\System\JVoHvBR.exe
  2⤵
  PID:9992
- C:\Windows\System\KPdiQvn.exe
  C:\Windows\System\KPdiQvn.exe
  2⤵
  PID:10060
- C:\Windows\System\ZUYgpDP.exe
  C:\Windows\System\ZUYgpDP.exe
  2⤵
  PID:10164
- C:\Windows\System\SigGEKY.exe
  C:\Windows\System\SigGEKY.exe
  2⤵
  PID:10216
- C:\Windows\System\pEyVNjU.exe
  C:\Windows\System\pEyVNjU.exe
  2⤵
  PID:8344
- C:\Windows\System\TWSrThp.exe
  C:\Windows\System\TWSrThp.exe
  2⤵
  PID:9528
- C:\Windows\System\ibtHLUy.exe
  C:\Windows\System\ibtHLUy.exe
  2⤵
  PID:9656
- C:\Windows\System\HMXyZSo.exe
  C:\Windows\System\HMXyZSo.exe
  2⤵
  PID:9720
- C:\Windows\System\NyhqKbN.exe
  C:\Windows\System\NyhqKbN.exe
  2⤵
  PID:9812
- C:\Windows\System\DFQfWsF.exe
  C:\Windows\System\DFQfWsF.exe
  2⤵
  PID:10000
- C:\Windows\System\PnYspRE.exe
  C:\Windows\System\PnYspRE.exe
  2⤵
  PID:10192
- C:\Windows\System\BkUIeGm.exe
  C:\Windows\System\BkUIeGm.exe
  2⤵
  PID:9508
- C:\Windows\System\nNFuxSG.exe
  C:\Windows\System\nNFuxSG.exe
  2⤵
  PID:9852
- C:\Windows\System\ubzLrVw.exe
  C:\Windows\System\ubzLrVw.exe
  2⤵
  PID:10044
- C:\Windows\System\oXlzTVe.exe
  C:\Windows\System\oXlzTVe.exe
  2⤵
  PID:9988
- C:\Windows\System\fnLVhGq.exe
  C:\Windows\System\fnLVhGq.exe
  2⤵
  PID:10268
- C:\Windows\System\byyftRZ.exe
  C:\Windows\System\byyftRZ.exe
  2⤵
  PID:10296
- C:\Windows\System\dTuJWMA.exe
  C:\Windows\System\dTuJWMA.exe
  2⤵
  PID:10324
- C:\Windows\System\wIcwNKS.exe
  C:\Windows\System\wIcwNKS.exe
  2⤵
  PID:10340
- C:\Windows\System\WdtMOgY.exe
  C:\Windows\System\WdtMOgY.exe
  2⤵
  PID:10360
- C:\Windows\System\kQfbFii.exe
  C:\Windows\System\kQfbFii.exe
  2⤵
  PID:10380
- C:\Windows\System\NIXvhws.exe
  C:\Windows\System\NIXvhws.exe
  2⤵
  PID:10400
- C:\Windows\System\XUkIRgQ.exe
  C:\Windows\System\XUkIRgQ.exe
  2⤵
  PID:10416
- C:\Windows\System\YIjmKvE.exe
  C:\Windows\System\YIjmKvE.exe
  2⤵
  PID:10468
- C:\Windows\System\uleURjh.exe
  C:\Windows\System\uleURjh.exe
  2⤵
  PID:10496
- C:\Windows\System\iyDqItA.exe
  C:\Windows\System\iyDqItA.exe
  2⤵
  PID:10528
- C:\Windows\System\RnnkjOn.exe
  C:\Windows\System\RnnkjOn.exe
  2⤵
  PID:10564
- C:\Windows\System\zkmCBxV.exe
  C:\Windows\System\zkmCBxV.exe
  2⤵
  PID:10592
- C:\Windows\System\bPORdjY.exe
  C:\Windows\System\bPORdjY.exe
  2⤵
  PID:10636
- C:\Windows\System\NXVaveS.exe
  C:\Windows\System\NXVaveS.exe
  2⤵
  PID:10652
- C:\Windows\System\pMHJGQR.exe
  C:\Windows\System\pMHJGQR.exe
  2⤵
  PID:10672
- C:\Windows\System\WkAFKjH.exe
  C:\Windows\System\WkAFKjH.exe
  2⤵
  PID:10712
- C:\Windows\System\PrvYKHg.exe
  C:\Windows\System\PrvYKHg.exe
  2⤵
  PID:10740
- C:\Windows\System\HEUrMgZ.exe
  C:\Windows\System\HEUrMgZ.exe
  2⤵
  PID:10764
- C:\Windows\System\YjlnvuY.exe
  C:\Windows\System\YjlnvuY.exe
  2⤵
  PID:10792
- C:\Windows\System\NiThrvl.exe
  C:\Windows\System\NiThrvl.exe
  2⤵
  PID:10820
- C:\Windows\System\dtAJoyo.exe
  C:\Windows\System\dtAJoyo.exe
  2⤵
  PID:10860
- C:\Windows\System\vRRBtjC.exe
  C:\Windows\System\vRRBtjC.exe
  2⤵
  PID:10880
- C:\Windows\System\xtuKUvy.exe
  C:\Windows\System\xtuKUvy.exe
  2⤵
  PID:10912
- C:\Windows\System\CuhQeOC.exe
  C:\Windows\System\CuhQeOC.exe
  2⤵
  PID:10932
- C:\Windows\System\bMtSztf.exe
  C:\Windows\System\bMtSztf.exe
  2⤵
  PID:10960
- C:\Windows\System\GAnppEo.exe
  C:\Windows\System\GAnppEo.exe
  2⤵
  PID:10984
- C:\Windows\System\bGhlODm.exe
  C:\Windows\System\bGhlODm.exe
  2⤵
  PID:11012
- C:\Windows\System\HsaQuuj.exe
  C:\Windows\System\HsaQuuj.exe
  2⤵
  PID:11036
- C:\Windows\System\vyoFbPr.exe
  C:\Windows\System\vyoFbPr.exe
  2⤵
  PID:11060
- C:\Windows\System\oLVARHk.exe
  C:\Windows\System\oLVARHk.exe
  2⤵
  PID:11092
- C:\Windows\System\jSXbBuN.exe
  C:\Windows\System\jSXbBuN.exe
  2⤵
  PID:11116
- C:\Windows\System\WtHvurj.exe
  C:\Windows\System\WtHvurj.exe
  2⤵
  PID:11164
- C:\Windows\System\TkQaxpr.exe
  C:\Windows\System\TkQaxpr.exe
  2⤵
  PID:11184
- C:\Windows\System\GsqYLmn.exe
  C:\Windows\System\GsqYLmn.exe
  2⤵
  PID:11216
- C:\Windows\System\YfnaGzy.exe
  C:\Windows\System\YfnaGzy.exe
  2⤵
  PID:11252
- C:\Windows\System\CiGNxKr.exe
  C:\Windows\System\CiGNxKr.exe
  2⤵
  PID:10236
- C:\Windows\System\DXeFtQN.exe
  C:\Windows\System\DXeFtQN.exe
  2⤵
  PID:10264
- C:\Windows\System\YovTzIm.exe
  C:\Windows\System\YovTzIm.exe
  2⤵
  PID:10312
- C:\Windows\System\HetxMtl.exe
  C:\Windows\System\HetxMtl.exe
  2⤵
  PID:10368
- C:\Windows\System\voMmCZy.exe
  C:\Windows\System\voMmCZy.exe
  2⤵
  PID:10412
- C:\Windows\System\JgcslPx.exe
  C:\Windows\System\JgcslPx.exe
  2⤵
  PID:10536
- C:\Windows\System\nQEtOBe.exe
  C:\Windows\System\nQEtOBe.exe
  2⤵
  PID:10628
- C:\Windows\System\aKYJwBJ.exe
  C:\Windows\System\aKYJwBJ.exe
  2⤵
  PID:10692
- C:\Windows\System\bMuMtiJ.exe
  C:\Windows\System\bMuMtiJ.exe
  2⤵
  PID:10752
- C:\Windows\System\GEaUJKM.exe
  C:\Windows\System\GEaUJKM.exe
  2⤵
  PID:10804
- C:\Windows\System\AWXetMf.exe
  C:\Windows\System\AWXetMf.exe
  2⤵
  PID:10892
- C:\Windows\System\gRNoloY.exe
  C:\Windows\System\gRNoloY.exe
  2⤵
  PID:10952
- C:\Windows\System\YwDBsnf.exe
  C:\Windows\System\YwDBsnf.exe
  2⤵
  PID:10996
- C:\Windows\System\zWlPkND.exe
  C:\Windows\System\zWlPkND.exe
  2⤵
  PID:11080
- C:\Windows\System\TIMOnXQ.exe
  C:\Windows\System\TIMOnXQ.exe
  2⤵
  PID:11100
- C:\Windows\System\uyVtsDm.exe
  C:\Windows\System\uyVtsDm.exe
  2⤵
  PID:11176
- C:\Windows\System\QRfayYr.exe
  C:\Windows\System\QRfayYr.exe
  2⤵
  PID:11248
- C:\Windows\System\krnCjge.exe
  C:\Windows\System\krnCjge.exe
  2⤵
  PID:10076
- C:\Windows\System\fZQtTUc.exe
  C:\Windows\System\fZQtTUc.exe
  2⤵
  PID:10408
- C:\Windows\System\ApHLMYK.exe
  C:\Windows\System\ApHLMYK.exe
  2⤵
  PID:10664
- C:\Windows\System\PNLjSYx.exe
  C:\Windows\System\PNLjSYx.exe
  2⤵
  PID:10836
- C:\Windows\System\xcCuXEP.exe
  C:\Windows\System\xcCuXEP.exe
  2⤵
  PID:10980
- C:\Windows\System\sQRBKEb.exe
  C:\Windows\System\sQRBKEb.exe
  2⤵
  PID:11136
- C:\Windows\System\kwpROyT.exe
  C:\Windows\System\kwpROyT.exe
  2⤵
  PID:9464
- C:\Windows\System\tcdvKVK.exe
  C:\Windows\System\tcdvKVK.exe
  2⤵
  PID:10644
- C:\Windows\System\DdICSpL.exe
  C:\Windows\System\DdICSpL.exe
  2⤵
  PID:11044
- C:\Windows\System\swKxiQZ.exe
  C:\Windows\System\swKxiQZ.exe
  2⤵
  PID:11244
- C:\Windows\System\RnDcFIY.exe
  C:\Windows\System\RnDcFIY.exe
  2⤵
  PID:11004
- C:\Windows\System\BzJKKUS.exe
  C:\Windows\System\BzJKKUS.exe
  2⤵
  PID:11276
- C:\Windows\System\gyvlGSE.exe
  C:\Windows\System\gyvlGSE.exe
  2⤵
  PID:11304
- C:\Windows\System\ByMLLEk.exe
  C:\Windows\System\ByMLLEk.exe
  2⤵
  PID:11344
- C:\Windows\System\vZwczkA.exe
  C:\Windows\System\vZwczkA.exe
  2⤵
  PID:11368
- C:\Windows\System\IohghkM.exe
  C:\Windows\System\IohghkM.exe
  2⤵
  PID:11396
- C:\Windows\System\ARZnArP.exe
  C:\Windows\System\ARZnArP.exe
  2⤵
  PID:11436
- C:\Windows\System\MzpmYOY.exe
  C:\Windows\System\MzpmYOY.exe
  2⤵
  PID:11452
- C:\Windows\System\gMQyRIo.exe
  C:\Windows\System\gMQyRIo.exe
  2⤵
  PID:11476
- C:\Windows\System\LyYgDoS.exe
  C:\Windows\System\LyYgDoS.exe
  2⤵
  PID:11508
- C:\Windows\System\mmgkuGx.exe
  C:\Windows\System\mmgkuGx.exe
  2⤵
  PID:11536
- C:\Windows\System\UaiFVsB.exe
  C:\Windows\System\UaiFVsB.exe
  2⤵
  PID:11576
- C:\Windows\System\biaIxjI.exe
  C:\Windows\System\biaIxjI.exe
  2⤵
  PID:11592
- C:\Windows\System\AcJPvXd.exe
  C:\Windows\System\AcJPvXd.exe
  2⤵
  PID:11608
- C:\Windows\System\shXYdrV.exe
  C:\Windows\System\shXYdrV.exe
  2⤵
  PID:11640
- C:\Windows\System\EzHAYbe.exe
  C:\Windows\System\EzHAYbe.exe
  2⤵
  PID:11668
- C:\Windows\System\zxcbhWB.exe
  C:\Windows\System\zxcbhWB.exe
  2⤵
  PID:11704
- C:\Windows\System\IyNlMex.exe
  C:\Windows\System\IyNlMex.exe
  2⤵
  PID:11744
- C:\Windows\System\ufXUEvu.exe
  C:\Windows\System\ufXUEvu.exe
  2⤵
  PID:11772
- C:\Windows\System\GmQwmXI.exe
  C:\Windows\System\GmQwmXI.exe
  2⤵
  PID:11808
- C:\Windows\System\TqCsFYw.exe
  C:\Windows\System\TqCsFYw.exe
  2⤵
  PID:11828
- C:\Windows\System\tTrmlCq.exe
  C:\Windows\System\tTrmlCq.exe
  2⤵
  PID:11848
- C:\Windows\System\DCvEbGe.exe
  C:\Windows\System\DCvEbGe.exe
  2⤵
  PID:11872
- C:\Windows\System\nyEqhyf.exe
  C:\Windows\System\nyEqhyf.exe
  2⤵
  PID:11888
- C:\Windows\System\HRIUMuM.exe
  C:\Windows\System\HRIUMuM.exe
  2⤵
  PID:11908
- C:\Windows\System\rzhxBpk.exe
  C:\Windows\System\rzhxBpk.exe
  2⤵
  PID:11932
- C:\Windows\System\NifInIb.exe
  C:\Windows\System\NifInIb.exe
  2⤵
  PID:11952
- C:\Windows\System\fmWPfkT.exe
  C:\Windows\System\fmWPfkT.exe
  2⤵
  PID:11988
- C:\Windows\System\CGntbOo.exe
  C:\Windows\System\CGntbOo.exe
  2⤵
  PID:12016
- C:\Windows\System\bbhjGNj.exe
  C:\Windows\System\bbhjGNj.exe
  2⤵
  PID:12048
- C:\Windows\System\YKqGTnR.exe
  C:\Windows\System\YKqGTnR.exe
  2⤵
  PID:12080
- C:\Windows\System\KAgTqjl.exe
  C:\Windows\System\KAgTqjl.exe
  2⤵
  PID:12112
- C:\Windows\System\lBDPYZe.exe
  C:\Windows\System\lBDPYZe.exe
  2⤵
  PID:12136
- C:\Windows\System\XrLnDNx.exe
  C:\Windows\System\XrLnDNx.exe
  2⤵
  PID:12152
- C:\Windows\System\tLwhXya.exe
  C:\Windows\System\tLwhXya.exe
  2⤵
  PID:12176
- C:\Windows\System\oglXAxF.exe
  C:\Windows\System\oglXAxF.exe
  2⤵
  PID:12208
- C:\Windows\System\otLPmSx.exe
  C:\Windows\System\otLPmSx.exe
  2⤵
  PID:12240
- C:\Windows\System\avTfjcF.exe
  C:\Windows\System\avTfjcF.exe
  2⤵
  PID:12256
- C:\Windows\System\uGHTNIN.exe
  C:\Windows\System\uGHTNIN.exe
  2⤵
  PID:6780
- C:\Windows\System\KBboXad.exe
  C:\Windows\System\KBboXad.exe
  2⤵
  PID:11312
- C:\Windows\System\WDaYnLb.exe
  C:\Windows\System\WDaYnLb.exe
  2⤵
  PID:11364
- C:\Windows\System\ASFQJoV.exe
  C:\Windows\System\ASFQJoV.exe
  2⤵
  PID:11420
- C:\Windows\System\TKLdesH.exe
  C:\Windows\System\TKLdesH.exe
  2⤵
  PID:11528
- C:\Windows\System\hTycFML.exe
  C:\Windows\System\hTycFML.exe
  2⤵
  PID:11604
- C:\Windows\System\XYwfTFt.exe
  C:\Windows\System\XYwfTFt.exe
  2⤵
  PID:11680
- C:\Windows\System\AjXIPrA.exe
  C:\Windows\System\AjXIPrA.exe
  2⤵
  PID:11732
- C:\Windows\System\JbccfvV.exe
  C:\Windows\System\JbccfvV.exe
  2⤵
  PID:11792
- C:\Windows\System\AelcwGo.exe
  C:\Windows\System\AelcwGo.exe
  2⤵
  PID:11856
- C:\Windows\System\bAYSiOU.exe
  C:\Windows\System\bAYSiOU.exe
  2⤵
  PID:11916
- C:\Windows\System\mEZYuVT.exe
  C:\Windows\System\mEZYuVT.exe
  2⤵
  PID:11972
- C:\Windows\System\COsiQFQ.exe
  C:\Windows\System\COsiQFQ.exe
  2⤵
  PID:12040
- C:\Windows\System\FfsxUUg.exe
  C:\Windows\System\FfsxUUg.exe
  2⤵
  PID:12192
- C:\Windows\System\eJqjZiz.exe
  C:\Windows\System\eJqjZiz.exe
  2⤵
  PID:12284
- C:\Windows\System\mHjxLFp.exe
  C:\Windows\System\mHjxLFp.exe
  2⤵
  PID:12268
- C:\Windows\System\WeQYeDP.exe
  C:\Windows\System\WeQYeDP.exe
  2⤵
  PID:11520
- C:\Windows\System\nEOYoyF.exe
  C:\Windows\System\nEOYoyF.exe
  2⤵
  PID:11564
- C:\Windows\System\IORTQYa.exe
  C:\Windows\System\IORTQYa.exe
  2⤵
  PID:11784
- C:\Windows\System\KNTMIQT.exe
  C:\Windows\System\KNTMIQT.exe
  2⤵
  PID:11844
- C:\Windows\System\lvxNedV.exe
  C:\Windows\System\lvxNedV.exe
  2⤵
  PID:11904
- C:\Windows\System\BCDyhwu.exe
  C:\Windows\System\BCDyhwu.exe
  2⤵
  PID:12188
- C:\Windows\System\PylcnRY.exe
  C:\Windows\System\PylcnRY.exe
  2⤵
  PID:11380
- C:\Windows\System\CJnCIHa.exe
  C:\Windows\System\CJnCIHa.exe
  2⤵
  PID:10492
- C:\Windows\System\eBaLEyp.exe
  C:\Windows\System\eBaLEyp.exe
  2⤵
  PID:11984
- C:\Windows\System\bVhVdtP.exe
  C:\Windows\System\bVhVdtP.exe
  2⤵
  PID:11392
- C:\Windows\System\rVTptCR.exe
  C:\Windows\System\rVTptCR.exe
  2⤵
  PID:11880
- C:\Windows\System\JvvejFj.exe
  C:\Windows\System\JvvejFj.exe
  2⤵
  PID:12332
- C:\Windows\System\GsaPdbq.exe
  C:\Windows\System\GsaPdbq.exe
  2⤵
  PID:12352
- C:\Windows\System\EyoMbJV.exe
  C:\Windows\System\EyoMbJV.exe
  2⤵
  PID:12376
- C:\Windows\System\tDvJBxt.exe
  C:\Windows\System\tDvJBxt.exe
  2⤵
  PID:12404
- C:\Windows\System\GKTnfzg.exe
  C:\Windows\System\GKTnfzg.exe
  2⤵
  PID:12432
- C:\Windows\System\SKgrwzy.exe
  C:\Windows\System\SKgrwzy.exe
  2⤵
  PID:12468
- C:\Windows\System\SOThkLl.exe
  C:\Windows\System\SOThkLl.exe
  2⤵
  PID:12500
- C:\Windows\System\eqCrrdI.exe
  C:\Windows\System\eqCrrdI.exe
  2⤵
  PID:12532
- C:\Windows\System\RggvVoG.exe
  C:\Windows\System\RggvVoG.exe
  2⤵
  PID:12560
- C:\Windows\System\KCQLGqV.exe
  C:\Windows\System\KCQLGqV.exe
  2⤵
  PID:12588
- C:\Windows\System\eEXXKnb.exe
  C:\Windows\System\eEXXKnb.exe
  2⤵
  PID:12620
- C:\Windows\System\TGoIQjL.exe
  C:\Windows\System\TGoIQjL.exe
  2⤵
  PID:12648
- C:\Windows\System\fuZmKUP.exe
  C:\Windows\System\fuZmKUP.exe
  2⤵
  PID:12676
- C:\Windows\System\BsMUpCm.exe
  C:\Windows\System\BsMUpCm.exe
  2⤵
  PID:12704
- C:\Windows\System\hTlGyuc.exe
  C:\Windows\System\hTlGyuc.exe
  2⤵
  PID:12732
- C:\Windows\System\CHOAfPZ.exe
  C:\Windows\System\CHOAfPZ.exe
  2⤵
  PID:12760
- C:\Windows\System\hgcmDLs.exe
  C:\Windows\System\hgcmDLs.exe
  2⤵
  PID:12788
- C:\Windows\System\xqEryDz.exe
  C:\Windows\System\xqEryDz.exe
  2⤵
  PID:12808
- C:\Windows\System\qDZBiqq.exe
  C:\Windows\System\qDZBiqq.exe
  2⤵
  PID:12832
- C:\Windows\System\gduyEEm.exe
  C:\Windows\System\gduyEEm.exe
  2⤵
  PID:12864
- C:\Windows\System\CiobRuF.exe
  C:\Windows\System\CiobRuF.exe
  2⤵
  PID:12892
- C:\Windows\System\krdlmwR.exe
  C:\Windows\System\krdlmwR.exe
  2⤵
  PID:12916
- C:\Windows\System\Wfkfaer.exe
  C:\Windows\System\Wfkfaer.exe
  2⤵
  PID:12956
- C:\Windows\System\tzzMbQa.exe
  C:\Windows\System\tzzMbQa.exe
  2⤵
  PID:12988
- C:\Windows\System\nAlbVWn.exe
  C:\Windows\System\nAlbVWn.exe
  2⤵
  PID:13016
- C:\Windows\System\TPnVKvH.exe
  C:\Windows\System\TPnVKvH.exe
  2⤵
  PID:13036
- C:\Windows\System\pmMrbIh.exe
  C:\Windows\System\pmMrbIh.exe
  2⤵
  PID:13060
- C:\Windows\System\lVxSJwv.exe
  C:\Windows\System\lVxSJwv.exe
  2⤵
  PID:13084
- C:\Windows\System\BLeVmLT.exe
  C:\Windows\System\BLeVmLT.exe
  2⤵
  PID:13104
- C:\Windows\System\QuQnfBI.exe
  C:\Windows\System\QuQnfBI.exe
  2⤵
  PID:13128
- C:\Windows\System\rdXnwms.exe
  C:\Windows\System\rdXnwms.exe
  2⤵
  PID:13172
- C:\Windows\System\faKjxgr.exe
  C:\Windows\System\faKjxgr.exe
  2⤵
  PID:13200
- C:\Windows\System\OhjhktJ.exe
  C:\Windows\System\OhjhktJ.exe
  2⤵
  PID:13228
- C:\Windows\System\XJaqMro.exe
  C:\Windows\System\XJaqMro.exe
  2⤵
  PID:13256
- C:\Windows\System\SWuNHgL.exe
  C:\Windows\System\SWuNHgL.exe
  2⤵
  PID:13276
- C:\Windows\System\vjCdSAS.exe
  C:\Windows\System\vjCdSAS.exe
  2⤵
  PID:13296
- C:\Windows\System\fJBzcNL.exe
  C:\Windows\System\fJBzcNL.exe
  2⤵
  PID:11692
- C:\Windows\System\PZfeNjL.exe
  C:\Windows\System\PZfeNjL.exe
  2⤵
  PID:12324
- C:\Windows\System\vGaGkBl.exe
  C:\Windows\System\vGaGkBl.exe
  2⤵
  PID:12416
- C:\Windows\System\iqxzhWx.exe
  C:\Windows\System\iqxzhWx.exe
  2⤵
  PID:12492
- C:\Windows\System\zUBgZsu.exe
  C:\Windows\System\zUBgZsu.exe
  2⤵
  PID:12608
- C:\Windows\System\OmsKpml.exe
  C:\Windows\System\OmsKpml.exe
  2⤵
  PID:12672
- C:\Windows\System\zclZjvI.exe
  C:\Windows\System\zclZjvI.exe
  2⤵
  PID:5072
- C:\Windows\System\eNsPuIb.exe
  C:\Windows\System\eNsPuIb.exe
  2⤵
  PID:12784
- C:\Windows\System\rAGTIlm.exe
  C:\Windows\System\rAGTIlm.exe
  2⤵
  PID:12844
- C:\Windows\System\rCIRyDQ.exe
  C:\Windows\System\rCIRyDQ.exe
  2⤵
  PID:12884
- C:\Windows\System\zyrfRie.exe
  C:\Windows\System\zyrfRie.exe
  2⤵
  PID:13024
- C:\Windows\System\GWxihXE.exe
  C:\Windows\System\GWxihXE.exe
  2⤵
  PID:13068
- C:\Windows\System\qwPwhxZ.exe
  C:\Windows\System\qwPwhxZ.exe
  2⤵
  PID:13144
- C:\Windows\System\JfwpqNC.exe
  C:\Windows\System\JfwpqNC.exe
  2⤵
  PID:13164
- C:\Windows\System\TdOvgBE.exe
  C:\Windows\System\TdOvgBE.exe
  2⤵
  PID:13248
- C:\Windows\System\VgyGyfV.exe
  C:\Windows\System\VgyGyfV.exe
  2⤵
  PID:13264
- C:\Windows\System\oklEfjv.exe
  C:\Windows\System\oklEfjv.exe
  2⤵
  PID:12428
- C:\Windows\System\qpsrRUB.exe
  C:\Windows\System\qpsrRUB.exe
  2⤵
  PID:12580
- C:\Windows\System\ATjktiD.exe
  C:\Windows\System\ATjktiD.exe
  2⤵
  PID:12724
- C:\Windows\System\whitedu.exe
  C:\Windows\System\whitedu.exe
  2⤵
  PID:12872
- C:\Windows\System\fvSPGyj.exe
  C:\Windows\System\fvSPGyj.exe
  2⤵
  PID:1564
- C:\Windows\System\RpdwNTu.exe
  C:\Windows\System\RpdwNTu.exe
  2⤵
  PID:4676
- C:\Windows\System\OxnWfss.exe
  C:\Windows\System\OxnWfss.exe
  2⤵
  PID:13072
- C:\Windows\System\NAtYdGe.exe
  C:\Windows\System\NAtYdGe.exe
  2⤵
  PID:13160
- C:\Windows\System\QRGgkVR.exe
  C:\Windows\System\QRGgkVR.exe
  2⤵
  PID:12480
- C:\Windows\System\PNYeHlx.exe
  C:\Windows\System\PNYeHlx.exe
  2⤵
  PID:12544
- C:\Windows\System\qeAKWVf.exe
  C:\Windows\System\qeAKWVf.exe
  2⤵
  PID:10160
- C:\Windows\System\dZgksVy.exe
  C:\Windows\System\dZgksVy.exe
  2⤵
  PID:13080
- C:\Windows\System\YswWxgh.exe
  C:\Windows\System\YswWxgh.exe
  2⤵
  PID:12388
- C:\Windows\System\koTlckA.exe
  C:\Windows\System\koTlckA.exe
  2⤵
  PID:7612
- C:\Windows\System\tZOMRag.exe
  C:\Windows\System\tZOMRag.exe
  2⤵
  PID:13292
- C:\Windows\System\WuezUXm.exe
  C:\Windows\System\WuezUXm.exe
  2⤵
  PID:13332
- C:\Windows\System\BpStzrQ.exe
  C:\Windows\System\BpStzrQ.exe
  2⤵
  PID:13368
- C:\Windows\System\WDKJpQn.exe
  C:\Windows\System\WDKJpQn.exe
  2⤵
  PID:13388
- C:\Windows\System\etwexhk.exe
  C:\Windows\System\etwexhk.exe
  2⤵
  PID:13424
- C:\Windows\System\MzWLIqE.exe
  C:\Windows\System\MzWLIqE.exe
  2⤵
  PID:13444
- C:\Windows\System\qewfDSs.exe
  C:\Windows\System\qewfDSs.exe
  2⤵
  PID:13468
- C:\Windows\System\bjmFtVQ.exe
  C:\Windows\System\bjmFtVQ.exe
  2⤵
  PID:13496
- C:\Windows\System\dwxYpWA.exe
  C:\Windows\System\dwxYpWA.exe
  2⤵
  PID:13524
- C:\Windows\System\ZymzDcE.exe
  C:\Windows\System\ZymzDcE.exe
  2⤵
  PID:13552
- C:\Windows\System\dbbVxhm.exe
  C:\Windows\System\dbbVxhm.exe
  2⤵
  PID:13568
- C:\Windows\System\PHFaWrO.exe
  C:\Windows\System\PHFaWrO.exe
  2⤵
  PID:13596
- C:\Windows\System\NkzuUrH.exe
  C:\Windows\System\NkzuUrH.exe
  2⤵
  PID:13624
- C:\Windows\System\CsJEgdl.exe
  C:\Windows\System\CsJEgdl.exe
  2⤵
  PID:13668
- C:\Windows\System\ITYZiCp.exe
  C:\Windows\System\ITYZiCp.exe
  2⤵
  PID:13684
- C:\Windows\System\MuXQNzw.exe
  C:\Windows\System\MuXQNzw.exe
  2⤵
  PID:13720
- C:\Windows\System\fZUweZk.exe
  C:\Windows\System\fZUweZk.exe
  2⤵
  PID:13764
- C:\Windows\System\ZYSiLaN.exe
  C:\Windows\System\ZYSiLaN.exe
  2⤵
  PID:13792
- C:\Windows\System\XjvLAFF.exe
  C:\Windows\System\XjvLAFF.exe
  2⤵
  PID:13816
- C:\Windows\System\vYjzFEy.exe
  C:\Windows\System\vYjzFEy.exe
  2⤵
  PID:13840
- C:\Windows\System\voXGwKI.exe
  C:\Windows\System\voXGwKI.exe
  2⤵
  PID:13872
- C:\Windows\System\XDcIBjv.exe
  C:\Windows\System\XDcIBjv.exe
  2⤵
  PID:13916
- C:\Windows\System\FRAzVVQ.exe
  C:\Windows\System\FRAzVVQ.exe
  2⤵
  PID:13932
- C:\Windows\System\aaYJDzC.exe
  C:\Windows\System\aaYJDzC.exe
  2⤵
  PID:13948
- C:\Windows\System\bBCnxxD.exe
  C:\Windows\System\bBCnxxD.exe
  2⤵
  PID:13996
- C:\Windows\System\yZXdoho.exe
  C:\Windows\System\yZXdoho.exe
  2⤵
  PID:14016
- C:\Windows\System\HWUDctO.exe
  C:\Windows\System\HWUDctO.exe
  2⤵
  PID:14044
- C:\Windows\System\zqGmgtt.exe
  C:\Windows\System\zqGmgtt.exe
  2⤵
  PID:14072
- C:\Windows\System\TzNhvbR.exe
  C:\Windows\System\TzNhvbR.exe
  2⤵
  PID:14092
- C:\Windows\System\mROrazY.exe
  C:\Windows\System\mROrazY.exe
  2⤵
  PID:14116
- C:\Windows\System\wPisvOO.exe
  C:\Windows\System\wPisvOO.exe
  2⤵
  PID:14144
- C:\Windows\System\WgSfAEe.exe
  C:\Windows\System\WgSfAEe.exe
  2⤵
  PID:14172
- C:\Windows\System\BCIrFjF.exe
  C:\Windows\System\BCIrFjF.exe
  2⤵
  PID:14200
- C:\Windows\System\lalnEAJ.exe
  C:\Windows\System\lalnEAJ.exe
  2⤵
  PID:14244
- C:\Windows\System\sWivojY.exe
  C:\Windows\System\sWivojY.exe
  2⤵
  PID:14268
- C:\Windows\System\TwDOiwy.exe
  C:\Windows\System\TwDOiwy.exe
  2⤵
  PID:14296
- C:\Windows\System\jPVxgby.exe
  C:\Windows\System\jPVxgby.exe
  2⤵
  PID:14332
- C:\Windows\System\PUuAFYu.exe
  C:\Windows\System\PUuAFYu.exe
  2⤵
  PID:13348
- C:\Windows\System\VGdFWLI.exe
  C:\Windows\System\VGdFWLI.exe
  2⤵
  PID:13400
- C:\Windows\System\ZknGzjq.exe
  C:\Windows\System\ZknGzjq.exe
  2⤵
  PID:13484
- C:\Windows\System\fjLakuR.exe
  C:\Windows\System\fjLakuR.exe
  2⤵
  PID:13464
- C:\Windows\System\QXkARki.exe
  C:\Windows\System\QXkARki.exe
  2⤵
  PID:13560
- C:\Windows\System\ezbtgKl.exe
  C:\Windows\System\ezbtgKl.exe
  2⤵
  PID:13636
- C:\Windows\System\LtprhlI.exe
  C:\Windows\System\LtprhlI.exe
  2⤵
  PID:13620
- C:\Windows\System\wXAYhcG.exe
  C:\Windows\System\wXAYhcG.exe
  2⤵
  PID:13696
- C:\Windows\System\mZzKXRk.exe
  C:\Windows\System\mZzKXRk.exe
  2⤵
  PID:13788
- C:\Windows\System\RAIFwYh.exe
  C:\Windows\System\RAIFwYh.exe
  2⤵
  PID:13832
- C:\Windows\System\hjWqnZf.exe
  C:\Windows\System\hjWqnZf.exe
  2⤵
  PID:13928
- C:\Windows\System\qICNfuE.exe
  C:\Windows\System\qICNfuE.exe
  2⤵
  PID:13976
- C:\Windows\System\XoaazrF.exe
  C:\Windows\System\XoaazrF.exe
  2⤵
  PID:14008
- C:\Windows\System\IixJRZU.exe
  C:\Windows\System\IixJRZU.exe
  2⤵
  PID:14032
- C:\Windows\System\dETkafN.exe
  C:\Windows\System\dETkafN.exe
  2⤵
  PID:14132
- C:\Windows\System\ZegCPMP.exe
  C:\Windows\System\ZegCPMP.exe
  2⤵
  PID:14196
- C:\Windows\System\hrMjLqF.exe
  C:\Windows\System\hrMjLqF.exe
  2⤵
  PID:14232
- C:\Windows\System\DQFvcKF.exe
  C:\Windows\System\DQFvcKF.exe
  2⤵
  PID:14284
- C:\Windows\System\TNztZoT.exe
  C:\Windows\System\TNztZoT.exe
  2⤵
  PID:372
- C:\Windows\System\xzpCjJG.exe
  C:\Windows\System\xzpCjJG.exe
  2⤵
  PID:13432
- C:\Windows\System\haQtMBe.exe
  C:\Windows\System\haQtMBe.exe
  2⤵
  PID:13536
- C:\Windows\System\mvDJIAg.exe
  C:\Windows\System\mvDJIAg.exe
  2⤵
  PID:13716
- C:\Windows\System\nRpJbmj.exe
  C:\Windows\System\nRpJbmj.exe
  2⤵
  PID:13808
- C:\Windows\System\LruQLTc.exe
  C:\Windows\System\LruQLTc.exe
  2⤵
  PID:14012
- C:\Windows\System\JHLPuga.exe
  C:\Windows\System\JHLPuga.exe
  2⤵
  PID:14188
- C:\Windows\System\ZglHgIV.exe
  C:\Windows\System\ZglHgIV.exe
  2⤵
  PID:14312
- C:\Windows\System\zDShYea.exe
  C:\Windows\System\zDShYea.exe
  2⤵
  PID:14328
- C:\Windows\System\CHRbefk.exe
  C:\Windows\System\CHRbefk.exe
  2⤵
  PID:13360
- C:\Windows\System\hApeoYS.exe
  C:\Windows\System\hApeoYS.exe
  2⤵
  PID:13516
- C:\Windows\System\MLPKGGL.exe
  C:\Windows\System\MLPKGGL.exe
  2⤵
  PID:14356
- C:\Windows\System\OtDwiMJ.exe
  C:\Windows\System\OtDwiMJ.exe
  2⤵
  PID:14384
- C:\Windows\System\GYZsWyk.exe
  C:\Windows\System\GYZsWyk.exe
  2⤵
  PID:14400
- C:\Windows\System\bqseYSD.exe
  C:\Windows\System\bqseYSD.exe
  2⤵
  PID:14436
- C:\Windows\System\lIIgGxz.exe
  C:\Windows\System\lIIgGxz.exe
  2⤵
  PID:14468
- C:\Windows\System\MyVbCgb.exe
  C:\Windows\System\MyVbCgb.exe
  2⤵
  PID:14492
- C:\Windows\System\UyBMzdR.exe
  C:\Windows\System\UyBMzdR.exe
  2⤵
  PID:14516
- C:\Windows\System\uCzeTwi.exe
  C:\Windows\System\uCzeTwi.exe
  2⤵
  PID:14536
- C:\Windows\System\xpjPejQ.exe
  C:\Windows\System\xpjPejQ.exe
  2⤵
  PID:14552
- C:\Windows\System\tSxdXSj.exe
  C:\Windows\System\tSxdXSj.exe
  2⤵
  PID:14584
- C:\Windows\System\wokcgOE.exe
  C:\Windows\System\wokcgOE.exe
  2⤵
  PID:14600
- C:\Windows\System\iObEPfd.exe
  C:\Windows\System\iObEPfd.exe
  2⤵
  PID:14624
- C:\Windows\System\ydrcxTk.exe
  C:\Windows\System\ydrcxTk.exe
  2⤵
  PID:14648
- C:\Windows\System\AdIhoXB.exe
  C:\Windows\System\AdIhoXB.exe
  2⤵
  PID:14688
- C:\Windows\System\ICgPEYR.exe
  C:\Windows\System\ICgPEYR.exe
  2⤵
  PID:14704
- C:\Windows\System\HvWiiau.exe
  C:\Windows\System\HvWiiau.exe
  2⤵
  PID:14728
- C:\Windows\System\kTzKtZg.exe
  C:\Windows\System\kTzKtZg.exe
  2⤵
  PID:14752
- C:\Windows\System\qqluCeZ.exe
  C:\Windows\System\qqluCeZ.exe
  2⤵
  PID:14792
- C:\Windows\System\LhSeLrz.exe
  C:\Windows\System\LhSeLrz.exe
  2⤵
  PID:14816
- C:\Windows\System\StbkdSI.exe
  C:\Windows\System\StbkdSI.exe
  2⤵
  PID:14840
- C:\Windows\System\Waazram.exe
  C:\Windows\System\Waazram.exe
  2⤵
  PID:14856
- C:\Windows\System\Wnvsved.exe
  C:\Windows\System\Wnvsved.exe
  2⤵
  PID:14876
- C:\Windows\System\deHSntd.exe
  C:\Windows\System\deHSntd.exe
  2⤵
  PID:14896
- C:\Windows\System\qpQojjz.exe
  C:\Windows\System\qpQojjz.exe
  2⤵
  PID:14924
- C:\Windows\System\JDEjkoB.exe
  C:\Windows\System\JDEjkoB.exe
  2⤵
  PID:14960
- C:\Windows\System\QCDyKUv.exe
  C:\Windows\System\QCDyKUv.exe
  2⤵
  PID:14984
- C:\Windows\System\RgnjKJn.exe
  C:\Windows\System\RgnjKJn.exe
  2⤵
  PID:15008
- C:\Windows\System\pXQdcKg.exe
  C:\Windows\System\pXQdcKg.exe
  2⤵
  PID:15032
- C:\Windows\System\hqRgVaZ.exe
  C:\Windows\System\hqRgVaZ.exe
  2⤵
  PID:15056
- C:\Windows\System\tRPrCpI.exe
  C:\Windows\System\tRPrCpI.exe
  2⤵
  PID:15084
- C:\Windows\System\IwwkNGO.exe
  C:\Windows\System\IwwkNGO.exe
  2⤵
  PID:15120
- C:\Windows\System\dYPzCll.exe
  C:\Windows\System\dYPzCll.exe
  2⤵
  PID:15148
- C:\Windows\System\GNnKuZV.exe
  C:\Windows\System\GNnKuZV.exe
  2⤵
  PID:15172
- C:\Windows\System\mQGkMmv.exe
  C:\Windows\System\mQGkMmv.exe
  2⤵
  PID:15192
- C:\Windows\System\GYURCjl.exe
  C:\Windows\System\GYURCjl.exe
  2⤵
  PID:15220
- C:\Windows\System\kEENknz.exe
  C:\Windows\System\kEENknz.exe
  2⤵
  PID:15236
- C:\Windows\System\SpJWzQs.exe
  C:\Windows\System\SpJWzQs.exe
  2⤵
  PID:15268
- C:\Windows\System\UNDlUtz.exe
  C:\Windows\System\UNDlUtz.exe
  2⤵
  PID:15304
- C:\Windows\System\qYxyHGS.exe
  C:\Windows\System\qYxyHGS.exe
  2⤵
  PID:15324
- C:\Windows\System\cmTxdPA.exe
  C:\Windows\System\cmTxdPA.exe
  2⤵
  PID:13680
- C:\Windows\System\ywyLWQa.exe
  C:\Windows\System\ywyLWQa.exe
  2⤵
  PID:14264
- C:\Windows\System\KABKNFG.exe
  C:\Windows\System\KABKNFG.exe
  2⤵
  PID:14396
- C:\Windows\System\AbtKjgs.exe
  C:\Windows\System\AbtKjgs.exe
  2⤵
  PID:14452
- C:\Windows\System\PPYVArP.exe
  C:\Windows\System\PPYVArP.exe
  2⤵
  PID:14592
- C:\Windows\System\elgPVQe.exe
  C:\Windows\System\elgPVQe.exe
  2⤵
  PID:14368
- C:\Windows\System\GpODfOn.exe
  C:\Windows\System\GpODfOn.exe
  2⤵
  PID:14420
- C:\Windows\System\iyjhMvr.exe
  C:\Windows\System\iyjhMvr.exe
  2⤵
  PID:14716
- C:\Windows\System\XnZfpEv.exe
  C:\Windows\System\XnZfpEv.exe
  2⤵
  PID:14564
- C:\Windows\System\gSyGGml.exe
  C:\Windows\System\gSyGGml.exe
  2⤵
  PID:14780
- C:\Windows\System\SMzxGla.exe
  C:\Windows\System\SMzxGla.exe
  2⤵
  PID:14676
- C:\Windows\System\ExFgSpk.exe
  C:\Windows\System\ExFgSpk.exe
  2⤵
  PID:15044
- C:\Windows\System\SKzDzvg.exe
  C:\Windows\System\SKzDzvg.exe
  2⤵
  PID:15092
- C:\Windows\System\FhAEAFI.exe
  C:\Windows\System\FhAEAFI.exe
  2⤵
  PID:14908
- C:\Windows\System\UPnCJqQ.exe
  C:\Windows\System\UPnCJqQ.exe
  2⤵
  PID:14944
- C:\Windows\System\EWwVONb.exe
  C:\Windows\System\EWwVONb.exe
  2⤵
  PID:14996
- C:\Windows\System\EgPXTyI.exe
  C:\Windows\System\EgPXTyI.exe
  2⤵
  PID:15180
- C:\Windows\System\deqFSiH.exe
  C:\Windows\System\deqFSiH.exe
  2⤵
  PID:15232
- C:\Windows\System\ZhKyDae.exe
  C:\Windows\System\ZhKyDae.exe
  2⤵
  PID:15284
- C:\Windows\System\WVkPYyD.exe
  C:\Windows\System\WVkPYyD.exe
  2⤵
  PID:15340
- C:\Windows\System\cooNCji.exe
  C:\Windows\System\cooNCji.exe
  2⤵
  PID:15140
- C:\Windows\System\VFWhHzX.exe
  C:\Windows\System\VFWhHzX.exe
  2⤵
  PID:15208
- C:\Windows\System\rvewcfY.exe
  C:\Windows\System\rvewcfY.exe
  2⤵
  PID:15256
- C:\Windows\System\cmWtyEr.exe
  C:\Windows\System\cmWtyEr.exe
  2⤵
  PID:14636
- C:\Windows\System\nqkjwbX.exe
  C:\Windows\System\nqkjwbX.exe
  2⤵
  PID:15184
- C:\Windows\System\NPGqomi.exe
  C:\Windows\System\NPGqomi.exe
  2⤵
  PID:15380
- C:\Windows\System\cSAnAes.exe
  C:\Windows\System\cSAnAes.exe
  2⤵
  PID:15404
- C:\Windows\System\frqOota.exe
  C:\Windows\System\frqOota.exe
  2⤵
  PID:15432
- C:\Windows\System\qyndiDa.exe
  C:\Windows\System\qyndiDa.exe
  2⤵
  PID:15452
- C:\Windows\System\sbrrJvv.exe
  C:\Windows\System\sbrrJvv.exe
  2⤵
  PID:15480
- C:\Windows\System\eQGbSoC.exe
  C:\Windows\System\eQGbSoC.exe
  2⤵
  PID:15504
- C:\Windows\System\ESDAXwt.exe
  C:\Windows\System\ESDAXwt.exe
  2⤵
  PID:15532
- C:\Windows\System\GCguQGm.exe
  C:\Windows\System\GCguQGm.exe
  2⤵
  PID:15556
- C:\Windows\System\RRsoBkt.exe
  C:\Windows\System\RRsoBkt.exe
  2⤵
  PID:15584
- C:\Windows\System\lKpcmKe.exe
  C:\Windows\System\lKpcmKe.exe
  2⤵
  PID:15608
- C:\Windows\System\hpdqzPG.exe
  C:\Windows\System\hpdqzPG.exe
  2⤵
  PID:15636
- C:\Windows\System\DruOBlo.exe
  C:\Windows\System\DruOBlo.exe
  2⤵
  PID:15668
- C:\Windows\System\PYRpuLU.exe
  C:\Windows\System\PYRpuLU.exe
  2⤵
  PID:15692
- C:\Windows\System\dKjGhYp.exe
  C:\Windows\System\dKjGhYp.exe
  2⤵
  PID:15712
- C:\Windows\System\uhbtcfi.exe
  C:\Windows\System\uhbtcfi.exe
  2⤵
  PID:15732
- C:\Windows\System\hPVEPso.exe
  C:\Windows\System\hPVEPso.exe
  2⤵
  PID:15752
- C:\Windows\System\XkhUCtX.exe
  C:\Windows\System\XkhUCtX.exe
  2⤵
  PID:15780
- C:\Windows\System\qzKOXvZ.exe
  C:\Windows\System\qzKOXvZ.exe
  2⤵
  PID:15800
- C:\Windows\System\RiVfiWH.exe
  C:\Windows\System\RiVfiWH.exe
  2⤵
  PID:15836
- C:\Windows\System\qRcKAxZ.exe
  C:\Windows\System\qRcKAxZ.exe
  2⤵
  PID:15860
- C:\Windows\System\iYdtUae.exe
  C:\Windows\System\iYdtUae.exe
  2⤵
  PID:15892
- C:\Windows\System\WKLXCKA.exe
  C:\Windows\System\WKLXCKA.exe
  2⤵
  PID:15916
- C:\Windows\System\oJVBzBW.exe
  C:\Windows\System\oJVBzBW.exe
  2⤵
  PID:15944
- C:\Windows\System\gKNFaLo.exe
  C:\Windows\System\gKNFaLo.exe
  2⤵
  PID:15968
- C:\Windows\System\wmajcjv.exe
  C:\Windows\System\wmajcjv.exe
  2⤵
  PID:15988
- C:\Windows\System\besDwUb.exe
  C:\Windows\System\besDwUb.exe
  2⤵
  PID:16004
- C:\Windows\System\OCRzWmb.exe
  C:\Windows\System\OCRzWmb.exe
  2⤵
  PID:16032
- C:\Windows\System\FKrWCFU.exe
  C:\Windows\System\FKrWCFU.exe
  2⤵
  PID:16056
- C:\Windows\System\YtfxFAa.exe
  C:\Windows\System\YtfxFAa.exe
  2⤵
  PID:16076
- C:\Windows\System\pRaqWPF.exe
  C:\Windows\System\pRaqWPF.exe
  2⤵
  PID:16100
- C:\Windows\System\wQWHpZn.exe
  C:\Windows\System\wQWHpZn.exe
  2⤵
  PID:16128
- C:\Windows\System\oKuUwVH.exe
  C:\Windows\System\oKuUwVH.exe
  2⤵
  PID:16152
- C:\Windows\System\deHAfzy.exe
  C:\Windows\System\deHAfzy.exe
  2⤵
  PID:16172
- C:\Windows\System\rDBOurB.exe
  C:\Windows\System\rDBOurB.exe
  2⤵
  PID:16188
- C:\Windows\System\XSyvkYG.exe
  C:\Windows\System\XSyvkYG.exe
  2⤵
  PID:16208
- C:\Windows\System\eOspmOM.exe
  C:\Windows\System\eOspmOM.exe
  2⤵
  PID:16232
- C:\Windows\System\qfQZVXZ.exe
  C:\Windows\System\qfQZVXZ.exe
  2⤵
  PID:16252
- C:\Windows\System\JXprPaL.exe
  C:\Windows\System\JXprPaL.exe
  2⤵
  PID:16276
- C:\Windows\System\PbSVUJi.exe
  C:\Windows\System\PbSVUJi.exe
  2⤵
  PID:16304
- C:\Windows\System\PgyoKsz.exe
  C:\Windows\System\PgyoKsz.exe
  2⤵
  PID:16336
- C:\Windows\System\SgiDbpc.exe
  C:\Windows\System\SgiDbpc.exe
  2⤵
  PID:16368
- C:\Windows\System\DXVPtnG.exe
  C:\Windows\System\DXVPtnG.exe
  2⤵
  PID:14700
- C:\Windows\System\DkSUBLr.exe
  C:\Windows\System\DkSUBLr.exe
  2⤵
  PID:15168
- C:\Windows\System\AHtXzia.exe
  C:\Windows\System\AHtXzia.exe
  2⤵
  PID:14972
- C:\Windows\System\GWBehXh.exe
  C:\Windows\System\GWBehXh.exe
  2⤵
  PID:14644
- C:\Windows\System\LxPmBWf.exe
  C:\Windows\System\LxPmBWf.exe
  2⤵
  PID:13588
- C:\Windows\System\imOFcMW.exe
  C:\Windows\System\imOFcMW.exe
  2⤵
  PID:14632
- C:\Windows\System\NDRVczG.exe
  C:\Windows\System\NDRVczG.exe
  2⤵
  PID:15524
- C:\Windows\System\FJpBhYm.exe
  C:\Windows\System\FJpBhYm.exe
  2⤵
  PID:15428
- C:\Windows\System\uvioYgh.exe
  C:\Windows\System\uvioYgh.exe
  2⤵
  PID:15632
- C:\Windows\System\ORJUJrk.exe
  C:\Windows\System\ORJUJrk.exe
  2⤵
  PID:14668
- C:\Windows\System\AbUTpoz.exe
  C:\Windows\System\AbUTpoz.exe
  2⤵
  PID:15824
- C:\Windows\System\STmmsFd.exe
  C:\Windows\System\STmmsFd.exe
  2⤵
  PID:15908
- C:\Windows\System\HnYSSjd.exe
  C:\Windows\System\HnYSSjd.exe
  2⤵
  PID:15656
- C:\Windows\System\HANuruY.exe
  C:\Windows\System\HANuruY.exe
  2⤵
  PID:15832
- C:\Windows\System\eaqqXaf.exe
  C:\Windows\System\eaqqXaf.exe
  2⤵
  PID:15868
- C:\Windows\System\gASRKld.exe
  C:\Windows\System\gASRKld.exe
  2⤵
  PID:16224
- C:\Windows\System\uBPvfnr.exe
  C:\Windows\System\uBPvfnr.exe
  2⤵
  PID:16272
- C:\Windows\System\lXBveYA.exe
  C:\Windows\System\lXBveYA.exe
  2⤵
  PID:15740
- C:\Windows\System\FCeNxji.exe
  C:\Windows\System\FCeNxji.exe
  2⤵
  PID:16068
- C:\Windows\System\oyyRDIS.exe
  C:\Windows\System\oyyRDIS.exe
  2⤵
  PID:16148
- C:\Windows\System\TGnTCod.exe
  C:\Windows\System\TGnTCod.exe
  2⤵
  PID:15956
- C:\Windows\System\ebcaFFC.exe
  C:\Windows\System\ebcaFFC.exe
  2⤵
  PID:15996
- C:\Windows\System\vdmARMa.exe
  C:\Windows\System\vdmARMa.exe
  2⤵
  PID:16392
- C:\Windows\System\JhGiAeR.exe
  C:\Windows\System\JhGiAeR.exe
  2⤵
  PID:16432
- C:\Windows\System\ZMVEeaS.exe
  C:\Windows\System\ZMVEeaS.exe
  2⤵
  PID:16452
- C:\Windows\System\EfOyfSq.exe
  C:\Windows\System\EfOyfSq.exe
  2⤵
  PID:16484
- C:\Windows\System\rNzWHMs.exe
  C:\Windows\System\rNzWHMs.exe
  2⤵
  PID:16504
- C:\Windows\System\spqyNTC.exe
  C:\Windows\System\spqyNTC.exe
  2⤵
  PID:16520
- C:\Windows\System\pnxvlQE.exe
  C:\Windows\System\pnxvlQE.exe
  2⤵
  PID:16552
- C:\Windows\System\NgWmicR.exe
  C:\Windows\System\NgWmicR.exe
  2⤵
  PID:16568
- C:\Windows\System\wiBnZOA.exe
  C:\Windows\System\wiBnZOA.exe
  2⤵
  PID:16680
- C:\Windows\System\ZMDscKi.exe
  C:\Windows\System\ZMDscKi.exe
  2⤵
  PID:16700
- C:\Windows\System\kNctwCS.exe
  C:\Windows\System\kNctwCS.exe
  2⤵
  PID:16716
- C:\Windows\System\NJRBMXi.exe
  C:\Windows\System\NJRBMXi.exe
  2⤵
  PID:16732
- C:\Windows\System\tWGsJIy.exe
  C:\Windows\System\tWGsJIy.exe
  2⤵
  PID:16760
- C:\Windows\System\GPfzXke.exe
  C:\Windows\System\GPfzXke.exe
  2⤵
  PID:16780
- C:\Windows\System\zVPxoMV.exe
  C:\Windows\System\zVPxoMV.exe
  2⤵
  PID:16816
- C:\Windows\System\JuSDfqD.exe
  C:\Windows\System\JuSDfqD.exe
  2⤵
  PID:16860
- C:\Windows\System\pigbYJF.exe
  C:\Windows\System\pigbYJF.exe
  2⤵
  PID:16884
- C:\Windows\System\eQNtddZ.exe
  C:\Windows\System\eQNtddZ.exe
  2⤵
  PID:16920
- C:\Windows\System\VhWvkpz.exe
  C:\Windows\System\VhWvkpz.exe
  2⤵
  PID:16936
- C:\Windows\System\qwXKVAl.exe
  C:\Windows\System\qwXKVAl.exe
  2⤵
  PID:16972
- C:\Windows\System\uYuDhMC.exe
  C:\Windows\System\uYuDhMC.exe
  2⤵
  PID:17000
- C:\Windows\System\EdLIqzI.exe
  C:\Windows\System\EdLIqzI.exe
  2⤵
  PID:17024
- C:\Windows\System\HLNEzqa.exe
  C:\Windows\System\HLNEzqa.exe
  2⤵
  PID:17056
- C:\Windows\System\YFpyaCP.exe
  C:\Windows\System\YFpyaCP.exe
  2⤵
  PID:17080
- C:\Windows\System\uiGizma.exe
  C:\Windows\System\uiGizma.exe
  2⤵
  PID:17108
- C:\Windows\System\YDVGypZ.exe
  C:\Windows\System\YDVGypZ.exe
  2⤵
  PID:17132
- C:\Windows\System\CGIdvfB.exe
  C:\Windows\System\CGIdvfB.exe
  2⤵
  PID:17168
- C:\Windows\System\eMaPKxx.exe
  C:\Windows\System\eMaPKxx.exe
  2⤵
  PID:14764
- C:\Windows\System\yEYPCsk.exe
  C:\Windows\System\yEYPCsk.exe
  2⤵
  PID:15076
- C:\Windows\System\GHGnRQQ.exe
  C:\Windows\System\GHGnRQQ.exe
  2⤵
  PID:16416
- C:\Windows\System\GyaISUS.exe
  C:\Windows\System\GyaISUS.exe
  2⤵
  PID:16476
- C:\Windows\System\NPBCeUg.exe
  C:\Windows\System\NPBCeUg.exe
  2⤵
  PID:16496
- C:\Windows\System\adPCbrr.exe
  C:\Windows\System\adPCbrr.exe
  2⤵
  PID:15848
- C:\Windows\System\EVYRSFe.exe
  C:\Windows\System\EVYRSFe.exe
  2⤵
  PID:16028
- C:\Windows\System\PrgmpqO.exe
  C:\Windows\System\PrgmpqO.exe
  2⤵
  PID:16020
- C:\Windows\System\yDAJDEl.exe
  C:\Windows\System\yDAJDEl.exe
  2⤵
  PID:16744
- C:\Windows\System\OxjnzBv.exe
  C:\Windows\System\OxjnzBv.exe
  2⤵
  PID:16840

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CJeUlOR.exe

Filesize
1.8MB

MD5
d46bf4bd96e74734a211cbe2332e43ce

SHA1
798d8a0f22cddc78c5a5458c47d59c1dcd908799

SHA256
e62758a3e845f407c8b73fafb4ebf35a403dee30aa1b8efb64bac7004c291af9

SHA512
f7a4b841a3e7919dc486ece92905c62ce5c1d37ca5f8ce40f0027b91c3f9cbbdde84bcd19749e713212064ebdc5e467fbf683e1a6674d9df119743f93a00f85e

Download Submit
C:\Windows\System\CmAOBLf.exe

Filesize
1.8MB

MD5
5cf347d59cedbdbe79e5da7b0e48f778

SHA1
900a72e603bf8491611a5de0d8f018d601b4b808

SHA256
c914e05656358a65fa6e6a60f829f7d5d0f0abf6b7a627a44f25ffac454b55d1

SHA512
2b7bd242e0a94f12c1d9be3e10714db7b42f075ccac7b8705b1174bb98fe19469ac7212975f8eb3767f70fa19b0785d384f959b526f616fef3d6c9ea9af6bdff

Download Submit
C:\Windows\System\EyYPOQJ.exe

Filesize
1.8MB

MD5
2734a9d959ef24fbeb80723b07d19945

SHA1
5e501a5735649d491a16ecfc5ba054cda0162c62

SHA256
58c4c725dbd8d546aa3bfa408f881a4015b10325d94d9799d3d497d02690f39c

SHA512
d0cb544768b525ed72fc43f134cef6ba46afb6c8bd6e5986776a62d9617bee4f6906d173a4375dd5f9fc91bf651a2216c1b5049b36a919ed165016cabcac7fc2

Download Submit
C:\Windows\System\FPbTzXD.exe

Filesize
1.8MB

MD5
c7aa40e456ac90c6ac6ac31d92565c06

SHA1
a7ee9c2ceb7f93b17cfe6b200ffa2ab48c398ecf

SHA256
d705a0bbbf3c9c97fcde45220cb5732ac90297a63120a2910da4150731a460ad

SHA512
2f973eb0d6ec54106ce54f6ead44847d7109468b2d232f3f6694102f77a50ec5dad122640be408882a072d1d01b374e96116a6749cf01465ee7ab2d0d70ff49f

Download Submit
C:\Windows\System\HyaqNVT.exe

Filesize
1.8MB

MD5
35826b67df9369fd0ca1e6abcad4107b

SHA1
53519037015b695bd643cda755062d1f159bfbe0

SHA256
26b06f84249ddeeb62196e95475a305524cef5d5925d6232e7e3346b2d448916

SHA512
5b9cd6ab6716347cf8f26aced4b55609e09ef8117377760b0f474ea9157915d727f69d71c7be4c4b259647091f50869077cac5dfabfd73de2270c01644362db5

Download Submit
C:\Windows\System\LFQSxbd.exe

Filesize
1.8MB

MD5
1d8a7e967e0e7ede3b97c49b04200957

SHA1
9ce5cd373418edc0ece3b58ca3879c8b13359f4d

SHA256
58e390286ac1112e7a46157d8cdab99b14590a7f18e17beb689ad8b0b5c29823

SHA512
769c2e4e1ce85acb4b0a191c93eab15d70712fb7ffa6ad995b4dbc8aad0eb838752f330e758217aac5a3228ba5cc4fd80a8918bca666ae1ef9ed2619baa968f7

Download Submit
C:\Windows\System\PXrUVBz.exe

Filesize
1.8MB

MD5
d4757b29ab122459a8fdd0df8e7f4280

SHA1
ca20cd7d38a5aa163f79113c68b2d29a3fc023fb

SHA256
bd03d14bad22608a8634aecec5406b062721da24fb31bb0ae3ee538ac9376773

SHA512
cb7b1d78029860e25be0995894990a81b02220a2a685498c059f9958f77cefdd5f805b3964c4e42314c18209e270319478db9060a622b70c05bbd179ade6efc8

Download Submit
C:\Windows\System\SeRsoQP.exe

Filesize
1.8MB

MD5
5bd355aee7b2d83ee067f5a8bf06caa6

SHA1
1f14b83f696293f313701e967efbddc6a9fecbe0

SHA256
fea46d53ef4b5de87e754ec9d874419c8ff77e0edb043899b5e6dc70ef7d1f95

SHA512
11154376cdb64b8f594c9105f5dc4b01d8b68f7fa8e26e53ab62aab08430c1e2833dd2158b4c5f8305ba8c7bf7dcf3d3eb84d31844615a3a5065cc48fc44c778

Download Submit
C:\Windows\System\Twleuyk.exe

Filesize
1.8MB

MD5
5b1f1ebc6b267ce32c0fa608ad4288e7

SHA1
7e47f1cdc5659cb32a81e944ff1c289ec088a6b1

SHA256
a4e464189aa76834f5c1cecbdf9d5d070120441f0b5e215b096c50431b664981

SHA512
d19875c7fa94fe7caea313020ae7c065ed694f4be2f7b22d9e2d058cfb4107b203d599c7e30da4a62b5bf7d24f836772e7404bada8ce73839b9c4fa19ff23db2

Download Submit
C:\Windows\System\UavpiJV.exe

Filesize
1.8MB

MD5
2390f3fd1cc817cb7a8a1b7685bdb0c6

SHA1
bb6ecfcafc39a2d8dfbd8392b2a6de3d08cb950e

SHA256
a65669410f104f92cea200a93788c2a278f8010572dd2a69b9240f849bd087b6

SHA512
b0b2285ec550c024ca614b939f956912392064efeaabda9e6cd5dcb59cbb067eed08f6fc5643bf308af24a37ea26751e8f945c628a0dbcb9543869b72671c4d0

Download Submit
C:\Windows\System\VNdPPLC.exe

Filesize
1.8MB

MD5
b06184791cd9f7f05aa3498e2a28936c

SHA1
faab7c7c44632222c085bab9f74f013a6aedcf4c

SHA256
f6444fc9c25e662664f00b49383280daf8572db111695075a155ff71818f094e

SHA512
5613973289486ad00532060dcc6a4980f859dfafa769880d28ce4d0386eae16bd2404169d40c67b55ff78f914ac45018e0a63193c0a687824cc0e73041917438

Download Submit
C:\Windows\System\aEHIGVd.exe

Filesize
1.8MB

MD5
7938b94e7a9a5e58da850d7e669ad3e3

SHA1
bb53e48150924bee0f95dcdc669370528427553b

SHA256
88fef11c5d4d38ab606d14b93cfd502c66023c7375f60657939f19ebeedf78f9

SHA512
bd56fc42bf29319d36320c164e464e91c96c05e001833f9483c03eb5ed7a483462cc74f2ad6c44f3132319f49ab2b8256acd4989ba3079327e65fde558635b68

Download Submit
C:\Windows\System\aWVxonL.exe

Filesize
1.8MB

MD5
ce32e4e5b78e6c0eb685facd594675aa

SHA1
52d157018d47107df525e8776ab16b6e14d01e27

SHA256
3791efa037280f133902645a1dbf72f74f2c6aedfb30d0788c2d6f1fa5cf5103

SHA512
2d2b0be06218f130d0a12f20228e17a5b725c77fefba0b43cc693823873ad882fe4966347d3d9510f924a0f0c19c949b20d8cb0f43433343ab67816e84b0014e

Download Submit
C:\Windows\System\atfppwQ.exe

Filesize
1.8MB

MD5
965154f53f7e01ddf5896c84b586d6c5

SHA1
a9f3bfc88e05e68f95e9d49cc7d67a7db5ad443d

SHA256
f88f8bab2e89a062968f4a443d769771e9068255a7b13cc935cf18faf9e32fc7

SHA512
f7c4f32f27c1a77dc9458cb0d68b2340ca7ceaa0b3b95325574638424d6458380d3ebf3978946389f028c3f993b7f43fbb8db7fe5cb05e131132e4e981d83eae

Download Submit
C:\Windows\System\bBBYvWL.exe

Filesize
1.8MB

MD5
01968eb920590a6b361fd245ad1e761d

SHA1
3a21f0b1a12af7ff1fa8e9419ef1f007ebe82f13

SHA256
23e3e407624eca686f2a1ae140525102ae210256453e6e09ebaba7c28bbe4c1b

SHA512
557211641e6a8c558417e30a960b771befd6c14b42cfa0f5c1d3071f326502369e934329b13f9ef724cdefb88ab176688318c4be1ea91e4e9968a840f0406e67

Download Submit
C:\Windows\System\beFPlhO.exe

Filesize
1.8MB

MD5
d0b0c0666ca74a2a714083972bea2845

SHA1
f98c876526d829d787e1520d4305202c3b4c1143

SHA256
84c6903cacba56e45bc445709a0a80f403e00ace720db92e5b145d4d0b82151c

SHA512
04df498f97fec1c11d20515e5e2f6b1c077c39dc80f193e8439853242d51a92651a481f4be950ac50fb95e739278e65424609889c96e3d174cee7f6b8fcd2dc9

Download Submit
C:\Windows\System\dSYjZkC.exe

Filesize
1.8MB

MD5
f875d087aced0139f23ad8c7ce2abb2a

SHA1
16b33ec69ee419d13efca0de565261557c75a253

SHA256
91d7fa06a33f4721e170d00ce4fa3e3a79ccd6f7aa83104728f6af792b2547e2

SHA512
e763ab2afec8437672959d4442f956fdf7d0aa9dbab0d9e074ecdc258eccb72094c4aafb4b5c8e08d00ee9d491c6c7dd10aabad8c31368402b591e4bebc5f09f

Download Submit
C:\Windows\System\dnpsBfz.exe

Filesize
1.8MB

MD5
b18765f20802f2eacecd771bdf309120

SHA1
41988696c4d6b6a35a918e2f0dbc8ccd903f0c7c

SHA256
5be97b02b177bca6ef5e8609439ed52bc9c368e4bf7beb252a4940d198e7821b

SHA512
2ecd4d54187534e887d6310c9f754de339fedfcaf7dfb2c5641dc02c5fb03ecb7ab7916deb5c500ac804205044fae56312582ab679fe17e68ce6ed41395cc677

Download Submit
C:\Windows\System\eYgqIFj.exe

Filesize
1.8MB

MD5
7eb0e21fbfad4d1b7d779ef943358d35

SHA1
8232f33ad6b58643808e1b8ed21ff7cac60a220d

SHA256
13ff3d3af4644d2ceac58a81b10e4efc68c0d0a2d6d76f123abc35982f30f162

SHA512
a0110c968136052b4aafdac530c5a4befd403f6d26f3e3ef06d680a46cc8e27b992a493df8739e4c4338d9d78f26a25856c073301378cf72bb4d6ba293acd641

Download Submit
C:\Windows\System\evpksha.exe

Filesize
1.8MB

MD5
4ec8290bbb696e9122021b19302ae98f

SHA1
017c86983f2440522a8f0377e4224336d6514356

SHA256
86f60ffdfe907cbff1a037bf8b572d9b977fa4305ac932ae733ee7d3924f0c63

SHA512
554ff6629843dee5fecd2a93c2472849d0a5e36d95cda0b2689e8ef8bc5d66af68af22ee38ef94028805915e293cc8b78f4d6e7e136a35bae504d96e4b68c4bc

Download Submit
C:\Windows\System\gvJMoZx.exe

Filesize
1.8MB

MD5
d847fb712006172693fdbf39653363a9

SHA1
2a80e3ca00679c66376b872c78c0332f96a067d4

SHA256
149fd5cf01d237eac58c061a8dda0925cbc3399b4bb927a8a415e66c97d1e8a0

SHA512
0dddf1eb24401a1452606d993c72363017bc48f4ed0465f276cb786af82ff644298b501bdcac0a15165d4be6706b24ca69110a40a7f479aad2b938628ee45cb2

Download Submit
C:\Windows\System\jDbMlms.exe

Filesize
1.8MB

MD5
fe133f9777f0f1c8b33b29e19cfc8797

SHA1
0d7a1dcbe250be2d06421e19018f12dbc4d558c0

SHA256
4667dbe632360cf754a0d1fec6a5d71f7dd0bb1acc69eaef916db0f927087917

SHA512
bc6c524fa8232c4efec3c132e89ba2ebff83e7c359f1a11b7d027d3fec9f13cd08256e5656c9d46185cac224a06447646176cb5f7038f018852a586631695859

Download Submit
C:\Windows\System\jInMfbj.exe

Filesize
1.8MB

MD5
755dfcec095c2ab30aa2e0d637dd7b71

SHA1
e03b552c15d305c27a565149db21213e92df5ccf

SHA256
58bcdbb377b01eadbbf31e814026e82bd03fdcdea966e26ea7ea3e8203f8cee1

SHA512
db682445cf5d28ab4836e7124adff3f10f50e1a13bcfa05609fdd274860c52a30507544c981045b319dc80308f5f0b7630f0fe89f4aabc1424c5a8e2ca8e6105

Download Submit
C:\Windows\System\ldGFmGv.exe

Filesize
1.8MB

MD5
2494f465eb93596405d4e73af9e9c798

SHA1
a931a951f3ba8e398e2e2225f2c37909e6d995b8

SHA256
81213e3898ade02c4f02b506b47847d1f302618f3ea6bc234981cee91f8139a8

SHA512
6f3ad9962f1646a09ac70db716c12b57229c300cdb13c1c7e9a0d8b86788bb089919f4c53103a3b7652a4aede22e854813b2c67c70e449e64d614522d99b420c

Download Submit
C:\Windows\System\qlmBegx.exe

Filesize
1.8MB

MD5
a0d89ea8d9749efeb51e90a3c9a3d4b0

SHA1
69e2251a96eba32067adf46859bde17956979a0c

SHA256
1caad470926edcfd8c6951adf4e069729b3c45861123079a399c3a394976315f

SHA512
2d8f501c126681d1d53abe3392717cbc61317722aa749eb982101b721b5e1b395e215adf6ff22a3b0c7c3835fd837158eb6c5697450698a0ae345ba9d6bb52b4

Download Submit
C:\Windows\System\rwXFNrH.exe

Filesize
1.8MB

MD5
ef4526ba91e5d98de336904617351de2

SHA1
a0d5248c6ae3ce204a63bf6c7db1b7a68e93e1f5

SHA256
fef81cf7cbbb23b25de22adbdfe26791d0486b2399db25250c4242ca0b530308

SHA512
3ec23c3a0c3845c476e6689a27549b6e8fc83d2da6ec4517047ef38264e19b1fe8b357c3310e0e0752c6930208cefa241dfb51d6db96443e3bcdab5481141520

Download Submit
C:\Windows\System\sMBrowB.exe

Filesize
1.8MB

MD5
c0eacadd47e602509e1939b43a15c1ae

SHA1
8681fc639bb633f990c9f7d8c345f1109cf6d6b4

SHA256
4d775ee13f25291d07425455ca356895cf2baaa7af745fdc31e679d101201b9c

SHA512
f720e03500a616516e0e510d36f825a697f14e3b8d0c95e38c40c6a3611cfeffc327260c778e0ec57a3cb8dcad9870365ee7b8750b7ad870061be30e3ad11497

Download Submit
C:\Windows\System\tyZAkgj.exe

Filesize
1.8MB

MD5
4889092ccbc6d3079483d849e21cdaf3

SHA1
fbfb56b81f7db40d65cf7b68bfa35ec32b867c78

SHA256
eef297b09ec1246a9cf9c7489a5dc3e693cbe1d77a1dfdad764312c60af3501c

SHA512
6fb12ff7259019d85315ee0bb3fc083515a3cbb673366b6d04ac151ac617522227a1cbabe5af9b512e21ca884b56a4065b7bf557992af7d0da1482f781e822d5

Download Submit
C:\Windows\System\vgfodoY.exe

Filesize
1.8MB

MD5
2ffedbc2d894b0c41e9723b7a4df77ba

SHA1
3593964caa52a297bb7117f5251c97ce90e9f302

SHA256
5ea2f50f1f7b9ac383e9a4a573d55571825eea4d781c6167cc6f8c18f9b192b4

SHA512
6c2e37adcc808b3cba4a6bdb1e082ae5626aa9724e835e03f4b77412707e2249a7ae38f07da3230f4c033d0a95b58ebf2525cfa57f42aa6760a1b491c2668850

Download Submit
C:\Windows\System\vtyqlCN.exe

Filesize
1.8MB

MD5
d7ec0b966dca4f411e778d7de93d4706

SHA1
f0cbfed31d35f74f23a234e16f00862ba3b36975

SHA256
be579d05ab05e646d5220786f5bfe8f956175b7b70856000b3c5689183f8ac2f

SHA512
ac4427ad2f25ae42e17aa2878aed7a646bcefac83fef129ecea7a7b872512f190c8cd62706e56e61e1af67cf94fdc40f83892ad624602e4863359fb1eece8244

Download Submit
C:\Windows\System\xwGooyH.exe

Filesize
1.8MB

MD5
d15569a5164a8797f623f9635b1c700a

SHA1
6ef2c6f6dcf324f6745d1fc9081cb14b84dd6cc0

SHA256
edc7f99bdb76bc74f4ace1de8d99546ff3e8fbe5919bb25173a451e20b8d7f97

SHA512
fc046ad43073453d00cdca8c7a5dc9428bf605e610a2ff6a98a78ea03cba0dd7f8df7429c325dfbc3cb44791f4f003a421bb8fb7fef6b87e0e65ebd5c0d119cf

Download Submit
C:\Windows\System\yZDUlTq.exe

Filesize
1.8MB

MD5
fd067ccafe8a158cd67eb75d2534c105

SHA1
b8bc0bad7a8f2fd604fa8eba2d1dbebce7bb7cbd

SHA256
690a22c2714a927a21239c8eb7824237ea5432137791f4d67723a89a1eac0814

SHA512
b8d71f378dc4d9ccc4f1ceab762e17e7e9ac4fef8ca7cc7cf8f1925fa90ef097f66af3389abf86369ec9967d0b86cb1e98048a644f3279fab46eba051235b900

Download Submit
C:\Windows\System\zFrgluw.exe

Filesize
1.8MB

MD5
59eb2662181d4de941d519ce67ab0ef0

SHA1
2151c5653fd336e27e9fbf1df9bafc84b30913be

SHA256
d6ca14e430ade478016d385098bbddf29a1aa7e3a26a92c68ba2cb11789f9478

SHA512
d5c2c2bf379c0095059b0d6792188333a65a5c0af0cbb995ebc56b56e5b0afcc460d829f687e8748f426e381b4fa1b92db28e6de5b4d028a1036ae663cb83bac

Download Submit
memory/4244-0-0x00000227C7120000-0x00000227C7130000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads