xmrig | 5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
Size

1.2MB
MD5

cf2ba1a62abbbcce898cc0fce0745af8
SHA1

4978916d1274564443549819f9e739e04a7af06b
SHA256

5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9
SHA512

ca13a04ea7e9ecd1b536b472f90db704b5d73439fee4e8a6a268f8c7ae4972a98eb9aaca2e72896c0e869ca63d70c25ade1a8c4124e6c941cd1410c576b28614
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMr2KiliyL/Fo4U:GezaTF8FcNkNdfE0pZ9ozttwIRQC9fA

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023c59-4.dat	xmrig
behavioral2/files/0x0007000000023c66-7.dat	xmrig
behavioral2/files/0x0007000000023c65-9.dat	xmrig
behavioral2/files/0x0007000000023c67-17.dat	xmrig
behavioral2/files/0x0007000000023c68-24.dat	xmrig
behavioral2/files/0x0007000000023c6c-42.dat	xmrig
behavioral2/files/0x0007000000023c70-62.dat	xmrig
behavioral2/files/0x0007000000023c73-77.dat	xmrig
behavioral2/files/0x0007000000023c76-92.dat	xmrig
behavioral2/files/0x0007000000023c7d-135.dat	xmrig
behavioral2/files/0x0007000000023c84-162.dat	xmrig
behavioral2/files/0x0007000000023c82-160.dat	xmrig
behavioral2/files/0x0007000000023c83-157.dat	xmrig
behavioral2/files/0x0007000000023c81-155.dat	xmrig
behavioral2/files/0x0007000000023c80-150.dat	xmrig
behavioral2/files/0x0007000000023c7f-145.dat	xmrig
behavioral2/files/0x0007000000023c7e-140.dat	xmrig
behavioral2/files/0x0007000000023c7c-130.dat	xmrig
behavioral2/files/0x0007000000023c7b-125.dat	xmrig
behavioral2/files/0x0007000000023c7a-120.dat	xmrig
behavioral2/files/0x0007000000023c79-115.dat	xmrig
behavioral2/files/0x0007000000023c78-110.dat	xmrig
behavioral2/files/0x0007000000023c77-105.dat	xmrig
behavioral2/files/0x0007000000023c75-95.dat	xmrig
behavioral2/files/0x0007000000023c74-90.dat	xmrig
behavioral2/files/0x0007000000023c72-80.dat	xmrig
behavioral2/files/0x0007000000023c71-75.dat	xmrig
behavioral2/files/0x0007000000023c6f-65.dat	xmrig
behavioral2/files/0x0007000000023c6e-60.dat	xmrig
behavioral2/files/0x0007000000023c6d-55.dat	xmrig
behavioral2/files/0x0007000000023c6b-45.dat	xmrig
behavioral2/files/0x0007000000023c6a-40.dat	xmrig
behavioral2/files/0x0007000000023c69-32.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4672	CSgVnhz.exe
3636	jOVuTmZ.exe
4588	vPyotsB.exe
5044	fHgsHzp.exe
2084	JBBhGaZ.exe
4292	EsmuFns.exe
3012	cNrdzvd.exe
2840	WDbGiBL.exe
208	MJYTGKz.exe
4648	cdEtJSv.exe
4700	jysDNzc.exe
3528	SNvTQiK.exe
1376	iYGbEmT.exe
3380	VfXcGzZ.exe
3244	MMgtRgR.exe
3952	HBxPMDB.exe
2792	ibxXGkS.exe
2396	PsqfGLJ.exe
3164	yqRuhvz.exe
4660	sPpUKkW.exe
3684	aLqdeTr.exe
1088	kZZmWmK.exe
2936	licyhEv.exe
1948	tngUHos.exe
1640	bzHAhdq.exe
3512	UPysevf.exe
3828	rYufebv.exe
2108	KrygVaT.exe
4692	BXukiqD.exe
3348	oQBzioB.exe
4460	UhPymxI.exe
4644	vQKoGUr.exe
5072	WvUdprD.exe
2368	yFdBnwe.exe
4244	kkiogqs.exe
3412	BNOXccB.exe
4772	iIuzeBa.exe
5076	NhagODG.exe
5056	qlrPGfv.exe
4712	xuRwepj.exe
1952	pULehtr.exe
3116	NZZOFgf.exe
396	ouBzHpr.exe
1500	vhxDGKA.exe
4540	uSamqQU.exe
4084	acdPvkz.exe
4500	NPRUGSR.exe
2180	agqrYIz.exe
1044	lFiCFsb.exe
1076	DQHyISq.exe
3888	cpPkzsn.exe
4280	eqaKeLN.exe
4228	sQrBVQc.exe
4360	kUDvnyV.exe
3956	oxikRIL.exe
4008	QrgfoRY.exe
3668	KbaOwSC.exe
1336	cQiKCiD.exe
1160	IucFYrp.exe
2672	RUMWnEo.exe
1680	SrvTyan.exe
796	KIKHNZV.exe
3688	dJmQoMC.exe
4464	POXuLHZ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NDqLRjr.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\nkvsyBV.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\kviaNNy.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\MadlBsa.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\AklLrIb.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\yZZaANj.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\vuAWZVM.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\xlHiVhl.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\fMqmXrq.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\qFUJgMX.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\pztjxjL.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\HJpFOZJ.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\RGgcqim.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\zFGvnpF.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\dxpjJxL.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\ANxxmBs.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\YvDHCQm.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\xYHakKT.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\PKYTjQb.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\nuRKCXS.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\rYufebv.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\sdksXbW.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\nnKWmEF.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\dJmQoMC.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\GAqgNcg.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\rfBFxux.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\Lvexrhz.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\JoLiUHZ.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\XjUwWYu.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\eHDambs.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\LmyHXrt.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\FTaGauY.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\UcdbNRm.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\Wudxlzt.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\EFGYTEr.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\vPyotsB.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\WsOsngf.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\nJgLipZ.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\aSDsSDM.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\kNxqnGe.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\mJwLZzJ.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\tMotsuF.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\lRCcmoU.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\fHgsHzp.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\nKDNLzV.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\nqmucYU.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\BkARJXZ.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\XfXfoGr.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\COHiOhu.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\fsqeNrs.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\ehRmRxW.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\VqYKPpN.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\LUwXbJY.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\rhMASHR.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\oQBzioB.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\gaRpwoa.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\kdzJkhu.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\sxjtPPI.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\KxMpygD.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\cpPkzsn.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\KhjPmGZ.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\isixOCj.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\XxFFyeq.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
File created	C:\Windows\System\wAgjTwp.exe	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16740	dwm.exe
Token: SeChangeNotifyPrivilege	16740	dwm.exe
Token: 33	16740	dwm.exe
Token: SeIncBasePriorityPrivilege	16740	dwm.exe
Token: SeShutdownPrivilege	16740	dwm.exe
Token: SeCreatePagefilePrivilege	16740	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 4672	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	84
PID 1000 wrote to memory of 4672	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	84
PID 1000 wrote to memory of 3636	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	85
PID 1000 wrote to memory of 3636	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	85
PID 1000 wrote to memory of 4588	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	86
PID 1000 wrote to memory of 4588	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	86
PID 1000 wrote to memory of 5044	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	87
PID 1000 wrote to memory of 5044	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	87
PID 1000 wrote to memory of 2084	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	88
PID 1000 wrote to memory of 2084	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	88
PID 1000 wrote to memory of 4292	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	89
PID 1000 wrote to memory of 4292	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	89
PID 1000 wrote to memory of 3012	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	90
PID 1000 wrote to memory of 3012	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	90
PID 1000 wrote to memory of 2840	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	91
PID 1000 wrote to memory of 2840	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	91
PID 1000 wrote to memory of 208	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	92
PID 1000 wrote to memory of 208	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	92
PID 1000 wrote to memory of 4648	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	93
PID 1000 wrote to memory of 4648	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	93
PID 1000 wrote to memory of 4700	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	94
PID 1000 wrote to memory of 4700	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	94
PID 1000 wrote to memory of 3528	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	95
PID 1000 wrote to memory of 3528	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	95
PID 1000 wrote to memory of 1376	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	96
PID 1000 wrote to memory of 1376	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	96
PID 1000 wrote to memory of 3380	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	97
PID 1000 wrote to memory of 3380	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	97
PID 1000 wrote to memory of 3244	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	98
PID 1000 wrote to memory of 3244	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	98
PID 1000 wrote to memory of 3952	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	99
PID 1000 wrote to memory of 3952	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	99
PID 1000 wrote to memory of 2792	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	100
PID 1000 wrote to memory of 2792	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	100
PID 1000 wrote to memory of 2396	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	101
PID 1000 wrote to memory of 2396	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	101
PID 1000 wrote to memory of 3164	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	102
PID 1000 wrote to memory of 3164	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	102
PID 1000 wrote to memory of 4660	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	103
PID 1000 wrote to memory of 4660	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	103
PID 1000 wrote to memory of 3684	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	104
PID 1000 wrote to memory of 3684	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	104
PID 1000 wrote to memory of 1088	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	105
PID 1000 wrote to memory of 1088	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	105
PID 1000 wrote to memory of 2936	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	106
PID 1000 wrote to memory of 2936	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	106
PID 1000 wrote to memory of 1948	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	107
PID 1000 wrote to memory of 1948	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	107
PID 1000 wrote to memory of 1640	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	108
PID 1000 wrote to memory of 1640	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	108
PID 1000 wrote to memory of 3512	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	109
PID 1000 wrote to memory of 3512	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	109
PID 1000 wrote to memory of 3828	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	110
PID 1000 wrote to memory of 3828	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	110
PID 1000 wrote to memory of 2108	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	111
PID 1000 wrote to memory of 2108	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	111
PID 1000 wrote to memory of 4692	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	112
PID 1000 wrote to memory of 4692	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	112
PID 1000 wrote to memory of 3348	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	113
PID 1000 wrote to memory of 3348	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	113
PID 1000 wrote to memory of 4460	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	114
PID 1000 wrote to memory of 4460	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	114
PID 1000 wrote to memory of 4644	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	115
PID 1000 wrote to memory of 4644	1000	5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe	115

C:\Users\Admin\AppData\Local\Temp\5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe
"C:\Users\Admin\AppData\Local\Temp\5fdbdbf68c463ac4e8565ae1316a2c3fcbbac43390a84697338b68e21bdd0bf9.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\System\CSgVnhz.exe
  C:\Windows\System\CSgVnhz.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\jOVuTmZ.exe
  C:\Windows\System\jOVuTmZ.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\vPyotsB.exe
  C:\Windows\System\vPyotsB.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\fHgsHzp.exe
  C:\Windows\System\fHgsHzp.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\JBBhGaZ.exe
  C:\Windows\System\JBBhGaZ.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\EsmuFns.exe
  C:\Windows\System\EsmuFns.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\cNrdzvd.exe
  C:\Windows\System\cNrdzvd.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\WDbGiBL.exe
  C:\Windows\System\WDbGiBL.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\MJYTGKz.exe
  C:\Windows\System\MJYTGKz.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\cdEtJSv.exe
  C:\Windows\System\cdEtJSv.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\jysDNzc.exe
  C:\Windows\System\jysDNzc.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\SNvTQiK.exe
  C:\Windows\System\SNvTQiK.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\iYGbEmT.exe
  C:\Windows\System\iYGbEmT.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\VfXcGzZ.exe
  C:\Windows\System\VfXcGzZ.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\MMgtRgR.exe
  C:\Windows\System\MMgtRgR.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\HBxPMDB.exe
  C:\Windows\System\HBxPMDB.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\ibxXGkS.exe
  C:\Windows\System\ibxXGkS.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\PsqfGLJ.exe
  C:\Windows\System\PsqfGLJ.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\yqRuhvz.exe
  C:\Windows\System\yqRuhvz.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\sPpUKkW.exe
  C:\Windows\System\sPpUKkW.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\aLqdeTr.exe
  C:\Windows\System\aLqdeTr.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\kZZmWmK.exe
  C:\Windows\System\kZZmWmK.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\licyhEv.exe
  C:\Windows\System\licyhEv.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\tngUHos.exe
  C:\Windows\System\tngUHos.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\bzHAhdq.exe
  C:\Windows\System\bzHAhdq.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\UPysevf.exe
  C:\Windows\System\UPysevf.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\rYufebv.exe
  C:\Windows\System\rYufebv.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\KrygVaT.exe
  C:\Windows\System\KrygVaT.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\BXukiqD.exe
  C:\Windows\System\BXukiqD.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\oQBzioB.exe
  C:\Windows\System\oQBzioB.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\UhPymxI.exe
  C:\Windows\System\UhPymxI.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\vQKoGUr.exe
  C:\Windows\System\vQKoGUr.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\WvUdprD.exe
  C:\Windows\System\WvUdprD.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\yFdBnwe.exe
  C:\Windows\System\yFdBnwe.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\kkiogqs.exe
  C:\Windows\System\kkiogqs.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\BNOXccB.exe
  C:\Windows\System\BNOXccB.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\iIuzeBa.exe
  C:\Windows\System\iIuzeBa.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\NhagODG.exe
  C:\Windows\System\NhagODG.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\qlrPGfv.exe
  C:\Windows\System\qlrPGfv.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\xuRwepj.exe
  C:\Windows\System\xuRwepj.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\pULehtr.exe
  C:\Windows\System\pULehtr.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\NZZOFgf.exe
  C:\Windows\System\NZZOFgf.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\ouBzHpr.exe
  C:\Windows\System\ouBzHpr.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\vhxDGKA.exe
  C:\Windows\System\vhxDGKA.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\uSamqQU.exe
  C:\Windows\System\uSamqQU.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\acdPvkz.exe
  C:\Windows\System\acdPvkz.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\NPRUGSR.exe
  C:\Windows\System\NPRUGSR.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\agqrYIz.exe
  C:\Windows\System\agqrYIz.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\lFiCFsb.exe
  C:\Windows\System\lFiCFsb.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\DQHyISq.exe
  C:\Windows\System\DQHyISq.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\cpPkzsn.exe
  C:\Windows\System\cpPkzsn.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\eqaKeLN.exe
  C:\Windows\System\eqaKeLN.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\sQrBVQc.exe
  C:\Windows\System\sQrBVQc.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\kUDvnyV.exe
  C:\Windows\System\kUDvnyV.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\oxikRIL.exe
  C:\Windows\System\oxikRIL.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\QrgfoRY.exe
  C:\Windows\System\QrgfoRY.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\KbaOwSC.exe
  C:\Windows\System\KbaOwSC.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\cQiKCiD.exe
  C:\Windows\System\cQiKCiD.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\IucFYrp.exe
  C:\Windows\System\IucFYrp.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\RUMWnEo.exe
  C:\Windows\System\RUMWnEo.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\SrvTyan.exe
  C:\Windows\System\SrvTyan.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\KIKHNZV.exe
  C:\Windows\System\KIKHNZV.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\dJmQoMC.exe
  C:\Windows\System\dJmQoMC.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\POXuLHZ.exe
  C:\Windows\System\POXuLHZ.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\XHAvrhe.exe
  C:\Windows\System\XHAvrhe.exe
  2⤵
  PID:4596
- C:\Windows\System\oLYCsJc.exe
  C:\Windows\System\oLYCsJc.exe
  2⤵
  PID:3260
- C:\Windows\System\LjRXFkM.exe
  C:\Windows\System\LjRXFkM.exe
  2⤵
  PID:2300
- C:\Windows\System\LJhPRoN.exe
  C:\Windows\System\LJhPRoN.exe
  2⤵
  PID:5048
- C:\Windows\System\RkASYds.exe
  C:\Windows\System\RkASYds.exe
  2⤵
  PID:4972
- C:\Windows\System\WSXRFpf.exe
  C:\Windows\System\WSXRFpf.exe
  2⤵
  PID:3500
- C:\Windows\System\QOzVSZQ.exe
  C:\Windows\System\QOzVSZQ.exe
  2⤵
  PID:876
- C:\Windows\System\UatSpeu.exe
  C:\Windows\System\UatSpeu.exe
  2⤵
  PID:4028
- C:\Windows\System\XPrlhLU.exe
  C:\Windows\System\XPrlhLU.exe
  2⤵
  PID:3008
- C:\Windows\System\xUxfrKC.exe
  C:\Windows\System\xUxfrKC.exe
  2⤵
  PID:692
- C:\Windows\System\HEVaxKv.exe
  C:\Windows\System\HEVaxKv.exe
  2⤵
  PID:4840
- C:\Windows\System\fySzLdU.exe
  C:\Windows\System\fySzLdU.exe
  2⤵
  PID:2316
- C:\Windows\System\cshXKjl.exe
  C:\Windows\System\cshXKjl.exe
  2⤵
  PID:4172
- C:\Windows\System\FpdypqJ.exe
  C:\Windows\System\FpdypqJ.exe
  2⤵
  PID:4352
- C:\Windows\System\FXwTZhv.exe
  C:\Windows\System\FXwTZhv.exe
  2⤵
  PID:728
- C:\Windows\System\GQqpxhQ.exe
  C:\Windows\System\GQqpxhQ.exe
  2⤵
  PID:264
- C:\Windows\System\nkvsyBV.exe
  C:\Windows\System\nkvsyBV.exe
  2⤵
  PID:2596
- C:\Windows\System\YVZyOyP.exe
  C:\Windows\System\YVZyOyP.exe
  2⤵
  PID:852
- C:\Windows\System\UwnudCG.exe
  C:\Windows\System\UwnudCG.exe
  2⤵
  PID:5100
- C:\Windows\System\faFkHrJ.exe
  C:\Windows\System\faFkHrJ.exe
  2⤵
  PID:960
- C:\Windows\System\NdggCes.exe
  C:\Windows\System\NdggCes.exe
  2⤵
  PID:5148
- C:\Windows\System\YjUvJUq.exe
  C:\Windows\System\YjUvJUq.exe
  2⤵
  PID:5176
- C:\Windows\System\lXeqlTX.exe
  C:\Windows\System\lXeqlTX.exe
  2⤵
  PID:5200
- C:\Windows\System\DiuQwWj.exe
  C:\Windows\System\DiuQwWj.exe
  2⤵
  PID:5232
- C:\Windows\System\MNMxhAE.exe
  C:\Windows\System\MNMxhAE.exe
  2⤵
  PID:5256
- C:\Windows\System\aGkqDYP.exe
  C:\Windows\System\aGkqDYP.exe
  2⤵
  PID:5288
- C:\Windows\System\AfNaZQu.exe
  C:\Windows\System\AfNaZQu.exe
  2⤵
  PID:5316
- C:\Windows\System\qsYohqu.exe
  C:\Windows\System\qsYohqu.exe
  2⤵
  PID:5344
- C:\Windows\System\vvKWOLk.exe
  C:\Windows\System\vvKWOLk.exe
  2⤵
  PID:5372
- C:\Windows\System\zKmsxfH.exe
  C:\Windows\System\zKmsxfH.exe
  2⤵
  PID:5396
- C:\Windows\System\fzJLShH.exe
  C:\Windows\System\fzJLShH.exe
  2⤵
  PID:5428
- C:\Windows\System\lSqppBU.exe
  C:\Windows\System\lSqppBU.exe
  2⤵
  PID:5452
- C:\Windows\System\sFCafWk.exe
  C:\Windows\System\sFCafWk.exe
  2⤵
  PID:5484
- C:\Windows\System\CEPdvig.exe
  C:\Windows\System\CEPdvig.exe
  2⤵
  PID:5512
- C:\Windows\System\eqYwKOm.exe
  C:\Windows\System\eqYwKOm.exe
  2⤵
  PID:5536
- C:\Windows\System\WEpRpjw.exe
  C:\Windows\System\WEpRpjw.exe
  2⤵
  PID:5568
- C:\Windows\System\afFiGpi.exe
  C:\Windows\System\afFiGpi.exe
  2⤵
  PID:5596
- C:\Windows\System\kgkmbzT.exe
  C:\Windows\System\kgkmbzT.exe
  2⤵
  PID:5620
- C:\Windows\System\SUyxlJe.exe
  C:\Windows\System\SUyxlJe.exe
  2⤵
  PID:5656
- C:\Windows\System\BfWUHlC.exe
  C:\Windows\System\BfWUHlC.exe
  2⤵
  PID:5680
- C:\Windows\System\jlRKtyR.exe
  C:\Windows\System\jlRKtyR.exe
  2⤵
  PID:5704
- C:\Windows\System\qqKyAFt.exe
  C:\Windows\System\qqKyAFt.exe
  2⤵
  PID:5736
- C:\Windows\System\ogTNwlo.exe
  C:\Windows\System\ogTNwlo.exe
  2⤵
  PID:5764
- C:\Windows\System\sgflFZC.exe
  C:\Windows\System\sgflFZC.exe
  2⤵
  PID:5788
- C:\Windows\System\qFQuXcV.exe
  C:\Windows\System\qFQuXcV.exe
  2⤵
  PID:5820
- C:\Windows\System\tkHmiHk.exe
  C:\Windows\System\tkHmiHk.exe
  2⤵
  PID:5844
- C:\Windows\System\kviaNNy.exe
  C:\Windows\System\kviaNNy.exe
  2⤵
  PID:5876
- C:\Windows\System\iIPTujH.exe
  C:\Windows\System\iIPTujH.exe
  2⤵
  PID:5904
- C:\Windows\System\oriRzuQ.exe
  C:\Windows\System\oriRzuQ.exe
  2⤵
  PID:5928
- C:\Windows\System\KbRZLoD.exe
  C:\Windows\System\KbRZLoD.exe
  2⤵
  PID:5960
- C:\Windows\System\xVsRWGO.exe
  C:\Windows\System\xVsRWGO.exe
  2⤵
  PID:5988
- C:\Windows\System\zbUVZoS.exe
  C:\Windows\System\zbUVZoS.exe
  2⤵
  PID:6016
- C:\Windows\System\aeCyKgy.exe
  C:\Windows\System\aeCyKgy.exe
  2⤵
  PID:6044
- C:\Windows\System\euLHxzr.exe
  C:\Windows\System\euLHxzr.exe
  2⤵
  PID:6068
- C:\Windows\System\mIgatvT.exe
  C:\Windows\System\mIgatvT.exe
  2⤵
  PID:6100
- C:\Windows\System\kEALtiH.exe
  C:\Windows\System\kEALtiH.exe
  2⤵
  PID:6128
- C:\Windows\System\utbRIkN.exe
  C:\Windows\System\utbRIkN.exe
  2⤵
  PID:1876
- C:\Windows\System\uLlLlAE.exe
  C:\Windows\System\uLlLlAE.exe
  2⤵
  PID:924
- C:\Windows\System\xlHiVhl.exe
  C:\Windows\System\xlHiVhl.exe
  2⤵
  PID:1852
- C:\Windows\System\sbBoWsM.exe
  C:\Windows\System\sbBoWsM.exe
  2⤵
  PID:228
- C:\Windows\System\ipGuqqY.exe
  C:\Windows\System\ipGuqqY.exe
  2⤵
  PID:1324
- C:\Windows\System\TRvGQMj.exe
  C:\Windows\System\TRvGQMj.exe
  2⤵
  PID:468
- C:\Windows\System\VklEjSz.exe
  C:\Windows\System\VklEjSz.exe
  2⤵
  PID:2400
- C:\Windows\System\xEshnlP.exe
  C:\Windows\System\xEshnlP.exe
  2⤵
  PID:5136
- C:\Windows\System\tOcPaRS.exe
  C:\Windows\System\tOcPaRS.exe
  2⤵
  PID:4752
- C:\Windows\System\KYtqLGG.exe
  C:\Windows\System\KYtqLGG.exe
  2⤵
  PID:5248
- C:\Windows\System\wPufSnZ.exe
  C:\Windows\System\wPufSnZ.exe
  2⤵
  PID:5308
- C:\Windows\System\RRhVgAD.exe
  C:\Windows\System\RRhVgAD.exe
  2⤵
  PID:5388
- C:\Windows\System\RTRjEGV.exe
  C:\Windows\System\RTRjEGV.exe
  2⤵
  PID:5436
- C:\Windows\System\vuXeokD.exe
  C:\Windows\System\vuXeokD.exe
  2⤵
  PID:5520
- C:\Windows\System\HwNRFXj.exe
  C:\Windows\System\HwNRFXj.exe
  2⤵
  PID:5576
- C:\Windows\System\nJgLipZ.exe
  C:\Windows\System\nJgLipZ.exe
  2⤵
  PID:5616
- C:\Windows\System\gaRpwoa.exe
  C:\Windows\System\gaRpwoa.exe
  2⤵
  PID:5688
- C:\Windows\System\vNwRjYR.exe
  C:\Windows\System\vNwRjYR.exe
  2⤵
  PID:5744
- C:\Windows\System\nKDNLzV.exe
  C:\Windows\System\nKDNLzV.exe
  2⤵
  PID:5808
- C:\Windows\System\LrQTtAv.exe
  C:\Windows\System\LrQTtAv.exe
  2⤵
  PID:5896
- C:\Windows\System\eMaXCRz.exe
  C:\Windows\System\eMaXCRz.exe
  2⤵
  PID:5968
- C:\Windows\System\fYrqToG.exe
  C:\Windows\System\fYrqToG.exe
  2⤵
  PID:2120
- C:\Windows\System\lnbdGJT.exe
  C:\Windows\System\lnbdGJT.exe
  2⤵
  PID:6060
- C:\Windows\System\BrdwlId.exe
  C:\Windows\System\BrdwlId.exe
  2⤵
  PID:6120
- C:\Windows\System\gasjRpl.exe
  C:\Windows\System\gasjRpl.exe
  2⤵
  PID:2268
- C:\Windows\System\NmaVvTY.exe
  C:\Windows\System\NmaVvTY.exe
  2⤵
  PID:1984
- C:\Windows\System\LmyHXrt.exe
  C:\Windows\System\LmyHXrt.exe
  2⤵
  PID:3352
- C:\Windows\System\xTxKcaJ.exe
  C:\Windows\System\xTxKcaJ.exe
  2⤵
  PID:5128
- C:\Windows\System\cjYfcKr.exe
  C:\Windows\System\cjYfcKr.exe
  2⤵
  PID:5212
- C:\Windows\System\uqNDdfC.exe
  C:\Windows\System\uqNDdfC.exe
  2⤵
  PID:5352
- C:\Windows\System\iVnhRCg.exe
  C:\Windows\System\iVnhRCg.exe
  2⤵
  PID:1772
- C:\Windows\System\ltJgnxQ.exe
  C:\Windows\System\ltJgnxQ.exe
  2⤵
  PID:5556
- C:\Windows\System\wBtBRVn.exe
  C:\Windows\System\wBtBRVn.exe
  2⤵
  PID:5668
- C:\Windows\System\sdksXbW.exe
  C:\Windows\System\sdksXbW.exe
  2⤵
  PID:5780
- C:\Windows\System\JuNeTWY.exe
  C:\Windows\System\JuNeTWY.exe
  2⤵
  PID:6088
- C:\Windows\System\wmsHsea.exe
  C:\Windows\System\wmsHsea.exe
  2⤵
  PID:3948
- C:\Windows\System\KbvuRWs.exe
  C:\Windows\System\KbvuRWs.exe
  2⤵
  PID:5168
- C:\Windows\System\zafktud.exe
  C:\Windows\System\zafktud.exe
  2⤵
  PID:3672
- C:\Windows\System\onannGT.exe
  C:\Windows\System\onannGT.exe
  2⤵
  PID:1492
- C:\Windows\System\UgQmuUj.exe
  C:\Windows\System\UgQmuUj.exe
  2⤵
  PID:5504
- C:\Windows\System\DNfGksH.exe
  C:\Windows\System\DNfGksH.exe
  2⤵
  PID:4444
- C:\Windows\System\JXKNtxF.exe
  C:\Windows\System\JXKNtxF.exe
  2⤵
  PID:3624
- C:\Windows\System\VDQMnjz.exe
  C:\Windows\System\VDQMnjz.exe
  2⤵
  PID:3224
- C:\Windows\System\JMuOmhg.exe
  C:\Windows\System\JMuOmhg.exe
  2⤵
  PID:4820
- C:\Windows\System\KVeqvDF.exe
  C:\Windows\System\KVeqvDF.exe
  2⤵
  PID:3504
- C:\Windows\System\eViDpQO.exe
  C:\Windows\System\eViDpQO.exe
  2⤵
  PID:2876
- C:\Windows\System\IdwxsfH.exe
  C:\Windows\System\IdwxsfH.exe
  2⤵
  PID:3588
- C:\Windows\System\JorpXSB.exe
  C:\Windows\System\JorpXSB.exe
  2⤵
  PID:5636
- C:\Windows\System\XfXfoGr.exe
  C:\Windows\System\XfXfoGr.exe
  2⤵
  PID:2456
- C:\Windows\System\PAJzVzR.exe
  C:\Windows\System\PAJzVzR.exe
  2⤵
  PID:2880
- C:\Windows\System\gOujfjU.exe
  C:\Windows\System\gOujfjU.exe
  2⤵
  PID:3928
- C:\Windows\System\DYpxvAN.exe
  C:\Windows\System\DYpxvAN.exe
  2⤵
  PID:2124
- C:\Windows\System\COHiOhu.exe
  C:\Windows\System\COHiOhu.exe
  2⤵
  PID:5920
- C:\Windows\System\rDdYcFB.exe
  C:\Windows\System\rDdYcFB.exe
  2⤵
  PID:3032
- C:\Windows\System\IoTHMvI.exe
  C:\Windows\System\IoTHMvI.exe
  2⤵
  PID:6156
- C:\Windows\System\tyCgqHy.exe
  C:\Windows\System\tyCgqHy.exe
  2⤵
  PID:6180
- C:\Windows\System\BKBYUYL.exe
  C:\Windows\System\BKBYUYL.exe
  2⤵
  PID:6196
- C:\Windows\System\qSURPQM.exe
  C:\Windows\System\qSURPQM.exe
  2⤵
  PID:6224
- C:\Windows\System\qICCbxT.exe
  C:\Windows\System\qICCbxT.exe
  2⤵
  PID:6252
- C:\Windows\System\tBNSssp.exe
  C:\Windows\System\tBNSssp.exe
  2⤵
  PID:6272
- C:\Windows\System\dzSIhJD.exe
  C:\Windows\System\dzSIhJD.exe
  2⤵
  PID:6304
- C:\Windows\System\xSnqmTC.exe
  C:\Windows\System\xSnqmTC.exe
  2⤵
  PID:6324
- C:\Windows\System\rpVilhd.exe
  C:\Windows\System\rpVilhd.exe
  2⤵
  PID:6376
- C:\Windows\System\Btyjjgk.exe
  C:\Windows\System\Btyjjgk.exe
  2⤵
  PID:6440
- C:\Windows\System\xLPKEZs.exe
  C:\Windows\System\xLPKEZs.exe
  2⤵
  PID:6464
- C:\Windows\System\ABFPVkE.exe
  C:\Windows\System\ABFPVkE.exe
  2⤵
  PID:6480
- C:\Windows\System\CALEfEN.exe
  C:\Windows\System\CALEfEN.exe
  2⤵
  PID:6500
- C:\Windows\System\GAqgNcg.exe
  C:\Windows\System\GAqgNcg.exe
  2⤵
  PID:6524
- C:\Windows\System\GCCGvQX.exe
  C:\Windows\System\GCCGvQX.exe
  2⤵
  PID:6552
- C:\Windows\System\TPvjIjh.exe
  C:\Windows\System\TPvjIjh.exe
  2⤵
  PID:6568
- C:\Windows\System\TlIDOAZ.exe
  C:\Windows\System\TlIDOAZ.exe
  2⤵
  PID:6592
- C:\Windows\System\QiSsxdI.exe
  C:\Windows\System\QiSsxdI.exe
  2⤵
  PID:6616
- C:\Windows\System\izKWKNT.exe
  C:\Windows\System\izKWKNT.exe
  2⤵
  PID:6636
- C:\Windows\System\wRSPIEj.exe
  C:\Windows\System\wRSPIEj.exe
  2⤵
  PID:6664
- C:\Windows\System\dGkPRbS.exe
  C:\Windows\System\dGkPRbS.exe
  2⤵
  PID:6704
- C:\Windows\System\dKIlLtx.exe
  C:\Windows\System\dKIlLtx.exe
  2⤵
  PID:6732
- C:\Windows\System\VRSZXNW.exe
  C:\Windows\System\VRSZXNW.exe
  2⤵
  PID:6768
- C:\Windows\System\hPOuIqM.exe
  C:\Windows\System\hPOuIqM.exe
  2⤵
  PID:6820
- C:\Windows\System\cnDmgEI.exe
  C:\Windows\System\cnDmgEI.exe
  2⤵
  PID:6852
- C:\Windows\System\BrIMhZg.exe
  C:\Windows\System\BrIMhZg.exe
  2⤵
  PID:6908
- C:\Windows\System\DAjMjtI.exe
  C:\Windows\System\DAjMjtI.exe
  2⤵
  PID:6936
- C:\Windows\System\wjHYxPY.exe
  C:\Windows\System\wjHYxPY.exe
  2⤵
  PID:6964
- C:\Windows\System\LQvVLhX.exe
  C:\Windows\System\LQvVLhX.exe
  2⤵
  PID:6992
- C:\Windows\System\VfOcLuv.exe
  C:\Windows\System\VfOcLuv.exe
  2⤵
  PID:7008
- C:\Windows\System\RXIYIRL.exe
  C:\Windows\System\RXIYIRL.exe
  2⤵
  PID:7048
- C:\Windows\System\TFstSqs.exe
  C:\Windows\System\TFstSqs.exe
  2⤵
  PID:7076
- C:\Windows\System\etNRHZH.exe
  C:\Windows\System\etNRHZH.exe
  2⤵
  PID:7104
- C:\Windows\System\ZSwwOpe.exe
  C:\Windows\System\ZSwwOpe.exe
  2⤵
  PID:7124
- C:\Windows\System\qeMoZhC.exe
  C:\Windows\System\qeMoZhC.exe
  2⤵
  PID:7148
- C:\Windows\System\DvEJLxT.exe
  C:\Windows\System\DvEJLxT.exe
  2⤵
  PID:2772
- C:\Windows\System\yLzxDtC.exe
  C:\Windows\System\yLzxDtC.exe
  2⤵
  PID:6192
- C:\Windows\System\UGozpAS.exe
  C:\Windows\System\UGozpAS.exe
  2⤵
  PID:6292
- C:\Windows\System\joZTQoB.exe
  C:\Windows\System\joZTQoB.exe
  2⤵
  PID:6284
- C:\Windows\System\WPmBlxA.exe
  C:\Windows\System\WPmBlxA.exe
  2⤵
  PID:6356
- C:\Windows\System\JhkGBoa.exe
  C:\Windows\System\JhkGBoa.exe
  2⤵
  PID:6428
- C:\Windows\System\rvKNJax.exe
  C:\Windows\System\rvKNJax.exe
  2⤵
  PID:6408
- C:\Windows\System\WTNciPY.exe
  C:\Windows\System\WTNciPY.exe
  2⤵
  PID:6536
- C:\Windows\System\HflckrU.exe
  C:\Windows\System\HflckrU.exe
  2⤵
  PID:6560
- C:\Windows\System\vlNqGid.exe
  C:\Windows\System\vlNqGid.exe
  2⤵
  PID:6604
- C:\Windows\System\hOBQvpX.exe
  C:\Windows\System\hOBQvpX.exe
  2⤵
  PID:6684
- C:\Windows\System\cmRamuP.exe
  C:\Windows\System\cmRamuP.exe
  2⤵
  PID:6816
- C:\Windows\System\CbDvQZg.exe
  C:\Windows\System\CbDvQZg.exe
  2⤵
  PID:6848
- C:\Windows\System\DduOAlo.exe
  C:\Windows\System\DduOAlo.exe
  2⤵
  PID:6984
- C:\Windows\System\GOKjZoy.exe
  C:\Windows\System\GOKjZoy.exe
  2⤵
  PID:7028
- C:\Windows\System\xPPsyVO.exe
  C:\Windows\System\xPPsyVO.exe
  2⤵
  PID:7132
- C:\Windows\System\ZyqmJOC.exe
  C:\Windows\System\ZyqmJOC.exe
  2⤵
  PID:6172
- C:\Windows\System\YFsYqGz.exe
  C:\Windows\System\YFsYqGz.exe
  2⤵
  PID:6340
- C:\Windows\System\ObnJnje.exe
  C:\Windows\System\ObnJnje.exe
  2⤵
  PID:6372
- C:\Windows\System\uzQCrCv.exe
  C:\Windows\System\uzQCrCv.exe
  2⤵
  PID:6516
- C:\Windows\System\NvHerzW.exe
  C:\Windows\System\NvHerzW.exe
  2⤵
  PID:6564
- C:\Windows\System\EnFQXcM.exe
  C:\Windows\System\EnFQXcM.exe
  2⤵
  PID:6920
- C:\Windows\System\OYaTpxS.exe
  C:\Windows\System\OYaTpxS.exe
  2⤵
  PID:6952
- C:\Windows\System\lrMwnLa.exe
  C:\Windows\System\lrMwnLa.exe
  2⤵
  PID:7064
- C:\Windows\System\dJNQwnZ.exe
  C:\Windows\System\dJNQwnZ.exe
  2⤵
  PID:7112
- C:\Windows\System\gAKxMWq.exe
  C:\Windows\System\gAKxMWq.exe
  2⤵
  PID:6232
- C:\Windows\System\crSIBam.exe
  C:\Windows\System\crSIBam.exe
  2⤵
  PID:6904
- C:\Windows\System\GoIsfAC.exe
  C:\Windows\System\GoIsfAC.exe
  2⤵
  PID:7184
- C:\Windows\System\uKdonOY.exe
  C:\Windows\System\uKdonOY.exe
  2⤵
  PID:7200
- C:\Windows\System\nLTqnUc.exe
  C:\Windows\System\nLTqnUc.exe
  2⤵
  PID:7252
- C:\Windows\System\NNWytcR.exe
  C:\Windows\System\NNWytcR.exe
  2⤵
  PID:7272
- C:\Windows\System\Rbytuij.exe
  C:\Windows\System\Rbytuij.exe
  2⤵
  PID:7292
- C:\Windows\System\JQtlmlz.exe
  C:\Windows\System\JQtlmlz.exe
  2⤵
  PID:7312
- C:\Windows\System\fTZsyKo.exe
  C:\Windows\System\fTZsyKo.exe
  2⤵
  PID:7340
- C:\Windows\System\SMSSHUQ.exe
  C:\Windows\System\SMSSHUQ.exe
  2⤵
  PID:7368
- C:\Windows\System\VsEuacn.exe
  C:\Windows\System\VsEuacn.exe
  2⤵
  PID:7416
- C:\Windows\System\qwpEoXy.exe
  C:\Windows\System\qwpEoXy.exe
  2⤵
  PID:7444
- C:\Windows\System\pgNFOzv.exe
  C:\Windows\System\pgNFOzv.exe
  2⤵
  PID:7480
- C:\Windows\System\VtVgMPY.exe
  C:\Windows\System\VtVgMPY.exe
  2⤵
  PID:7504
- C:\Windows\System\asvShmV.exe
  C:\Windows\System\asvShmV.exe
  2⤵
  PID:7532
- C:\Windows\System\vjyVsxE.exe
  C:\Windows\System\vjyVsxE.exe
  2⤵
  PID:7560
- C:\Windows\System\HqcHMUD.exe
  C:\Windows\System\HqcHMUD.exe
  2⤵
  PID:7580
- C:\Windows\System\FjFnhjq.exe
  C:\Windows\System\FjFnhjq.exe
  2⤵
  PID:7616
- C:\Windows\System\fMqmXrq.exe
  C:\Windows\System\fMqmXrq.exe
  2⤵
  PID:7644
- C:\Windows\System\BgSTDdd.exe
  C:\Windows\System\BgSTDdd.exe
  2⤵
  PID:7668
- C:\Windows\System\rfBFxux.exe
  C:\Windows\System\rfBFxux.exe
  2⤵
  PID:7688
- C:\Windows\System\inFwdWM.exe
  C:\Windows\System\inFwdWM.exe
  2⤵
  PID:7712
- C:\Windows\System\BlQARhl.exe
  C:\Windows\System\BlQARhl.exe
  2⤵
  PID:7740
- C:\Windows\System\NBdwjwL.exe
  C:\Windows\System\NBdwjwL.exe
  2⤵
  PID:7792
- C:\Windows\System\aWMQfQC.exe
  C:\Windows\System\aWMQfQC.exe
  2⤵
  PID:7820
- C:\Windows\System\rFPLzRN.exe
  C:\Windows\System\rFPLzRN.exe
  2⤵
  PID:7844
- C:\Windows\System\xLNIsBC.exe
  C:\Windows\System\xLNIsBC.exe
  2⤵
  PID:7884
- C:\Windows\System\uuoMoQL.exe
  C:\Windows\System\uuoMoQL.exe
  2⤵
  PID:7912
- C:\Windows\System\PQnnLJu.exe
  C:\Windows\System\PQnnLJu.exe
  2⤵
  PID:7932
- C:\Windows\System\DlxaGzZ.exe
  C:\Windows\System\DlxaGzZ.exe
  2⤵
  PID:7956
- C:\Windows\System\MGjyrBR.exe
  C:\Windows\System\MGjyrBR.exe
  2⤵
  PID:7972
- C:\Windows\System\iAYQhgJ.exe
  C:\Windows\System\iAYQhgJ.exe
  2⤵
  PID:7996
- C:\Windows\System\rpLWNFv.exe
  C:\Windows\System\rpLWNFv.exe
  2⤵
  PID:8028
- C:\Windows\System\aoSxGQM.exe
  C:\Windows\System\aoSxGQM.exe
  2⤵
  PID:8080
- C:\Windows\System\rjrxQPG.exe
  C:\Windows\System\rjrxQPG.exe
  2⤵
  PID:8096
- C:\Windows\System\yzULUrY.exe
  C:\Windows\System\yzULUrY.exe
  2⤵
  PID:8124
- C:\Windows\System\SJHbshB.exe
  C:\Windows\System\SJHbshB.exe
  2⤵
  PID:8152
- C:\Windows\System\ZMwvGUm.exe
  C:\Windows\System\ZMwvGUm.exe
  2⤵
  PID:8180
- C:\Windows\System\eMfBMMd.exe
  C:\Windows\System\eMfBMMd.exe
  2⤵
  PID:6700
- C:\Windows\System\pfbZhuW.exe
  C:\Windows\System\pfbZhuW.exe
  2⤵
  PID:7176
- C:\Windows\System\JQAfNlD.exe
  C:\Windows\System\JQAfNlD.exe
  2⤵
  PID:7264
- C:\Windows\System\WDuqyCg.exe
  C:\Windows\System\WDuqyCg.exe
  2⤵
  PID:7304
- C:\Windows\System\aVfkrQv.exe
  C:\Windows\System\aVfkrQv.exe
  2⤵
  PID:7288
- C:\Windows\System\gCCnlWC.exe
  C:\Windows\System\gCCnlWC.exe
  2⤵
  PID:7360
- C:\Windows\System\jDvOmGx.exe
  C:\Windows\System\jDvOmGx.exe
  2⤵
  PID:7572
- C:\Windows\System\mhbKMEZ.exe
  C:\Windows\System\mhbKMEZ.exe
  2⤵
  PID:7612
- C:\Windows\System\ZWYFugR.exe
  C:\Windows\System\ZWYFugR.exe
  2⤵
  PID:7700
- C:\Windows\System\ttesENF.exe
  C:\Windows\System\ttesENF.exe
  2⤵
  PID:7800
- C:\Windows\System\IjDXYzN.exe
  C:\Windows\System\IjDXYzN.exe
  2⤵
  PID:7840
- C:\Windows\System\wXgUDUS.exe
  C:\Windows\System\wXgUDUS.exe
  2⤵
  PID:7868
- C:\Windows\System\qaJisdV.exe
  C:\Windows\System\qaJisdV.exe
  2⤵
  PID:7940
- C:\Windows\System\DGFMYLp.exe
  C:\Windows\System\DGFMYLp.exe
  2⤵
  PID:8008
- C:\Windows\System\UcdbNRm.exe
  C:\Windows\System\UcdbNRm.exe
  2⤵
  PID:8052
- C:\Windows\System\RnGxiyf.exe
  C:\Windows\System\RnGxiyf.exe
  2⤵
  PID:8144
- C:\Windows\System\FiuxArD.exe
  C:\Windows\System\FiuxArD.exe
  2⤵
  PID:8176
- C:\Windows\System\RIToHBO.exe
  C:\Windows\System\RIToHBO.exe
  2⤵
  PID:7180
- C:\Windows\System\cVaGSOa.exe
  C:\Windows\System\cVaGSOa.exe
  2⤵
  PID:7308
- C:\Windows\System\JmrzZNw.exe
  C:\Windows\System\JmrzZNw.exe
  2⤵
  PID:7608
- C:\Windows\System\mJwLZzJ.exe
  C:\Windows\System\mJwLZzJ.exe
  2⤵
  PID:7708
- C:\Windows\System\HLDgpnn.exe
  C:\Windows\System\HLDgpnn.exe
  2⤵
  PID:7872
- C:\Windows\System\yTBSqMO.exe
  C:\Windows\System\yTBSqMO.exe
  2⤵
  PID:7992
- C:\Windows\System\iwxuSuD.exe
  C:\Windows\System\iwxuSuD.exe
  2⤵
  PID:7968
- C:\Windows\System\lVcLPPr.exe
  C:\Windows\System\lVcLPPr.exe
  2⤵
  PID:6976
- C:\Windows\System\uGHjRxs.exe
  C:\Windows\System\uGHjRxs.exe
  2⤵
  PID:7524
- C:\Windows\System\xxnYTTY.exe
  C:\Windows\System\xxnYTTY.exe
  2⤵
  PID:7660
- C:\Windows\System\nqmucYU.exe
  C:\Windows\System\nqmucYU.exe
  2⤵
  PID:8204
- C:\Windows\System\HJpFOZJ.exe
  C:\Windows\System\HJpFOZJ.exe
  2⤵
  PID:8224
- C:\Windows\System\TQNHqjY.exe
  C:\Windows\System\TQNHqjY.exe
  2⤵
  PID:8240
- C:\Windows\System\DjukWqA.exe
  C:\Windows\System\DjukWqA.exe
  2⤵
  PID:8264
- C:\Windows\System\JffwaMG.exe
  C:\Windows\System\JffwaMG.exe
  2⤵
  PID:8292
- C:\Windows\System\WRPoEDI.exe
  C:\Windows\System\WRPoEDI.exe
  2⤵
  PID:8320
- C:\Windows\System\hmiWHkN.exe
  C:\Windows\System\hmiWHkN.exe
  2⤵
  PID:8348
- C:\Windows\System\xWBuzNM.exe
  C:\Windows\System\xWBuzNM.exe
  2⤵
  PID:8372
- C:\Windows\System\ESJNWAl.exe
  C:\Windows\System\ESJNWAl.exe
  2⤵
  PID:8392
- C:\Windows\System\oFmlVAm.exe
  C:\Windows\System\oFmlVAm.exe
  2⤵
  PID:8420
- C:\Windows\System\NPTZuKP.exe
  C:\Windows\System\NPTZuKP.exe
  2⤵
  PID:8436
- C:\Windows\System\WdMiqVb.exe
  C:\Windows\System\WdMiqVb.exe
  2⤵
  PID:8468
- C:\Windows\System\uFhuzVA.exe
  C:\Windows\System\uFhuzVA.exe
  2⤵
  PID:8488
- C:\Windows\System\ZyNVBHH.exe
  C:\Windows\System\ZyNVBHH.exe
  2⤵
  PID:8512
- C:\Windows\System\VhBzBwm.exe
  C:\Windows\System\VhBzBwm.exe
  2⤵
  PID:8536
- C:\Windows\System\NADGnCd.exe
  C:\Windows\System\NADGnCd.exe
  2⤵
  PID:8556
- C:\Windows\System\rHgMQux.exe
  C:\Windows\System\rHgMQux.exe
  2⤵
  PID:8584
- C:\Windows\System\nUEHNMc.exe
  C:\Windows\System\nUEHNMc.exe
  2⤵
  PID:8604
- C:\Windows\System\BVIJvrX.exe
  C:\Windows\System\BVIJvrX.exe
  2⤵
  PID:8632
- C:\Windows\System\tXiegTe.exe
  C:\Windows\System\tXiegTe.exe
  2⤵
  PID:8656
- C:\Windows\System\JUBwrxv.exe
  C:\Windows\System\JUBwrxv.exe
  2⤵
  PID:8712
- C:\Windows\System\ypdIJgA.exe
  C:\Windows\System\ypdIJgA.exe
  2⤵
  PID:8756
- C:\Windows\System\rlRKFVy.exe
  C:\Windows\System\rlRKFVy.exe
  2⤵
  PID:8784
- C:\Windows\System\oQIGnTd.exe
  C:\Windows\System\oQIGnTd.exe
  2⤵
  PID:8816
- C:\Windows\System\feUFGoG.exe
  C:\Windows\System\feUFGoG.exe
  2⤵
  PID:8852
- C:\Windows\System\txFXXPB.exe
  C:\Windows\System\txFXXPB.exe
  2⤵
  PID:8932
- C:\Windows\System\dTOBMVC.exe
  C:\Windows\System\dTOBMVC.exe
  2⤵
  PID:8960
- C:\Windows\System\kzTavCF.exe
  C:\Windows\System\kzTavCF.exe
  2⤵
  PID:8988
- C:\Windows\System\GLLBBvN.exe
  C:\Windows\System\GLLBBvN.exe
  2⤵
  PID:9016
- C:\Windows\System\IruaCJa.exe
  C:\Windows\System\IruaCJa.exe
  2⤵
  PID:9032
- C:\Windows\System\LkqoYWF.exe
  C:\Windows\System\LkqoYWF.exe
  2⤵
  PID:9052
- C:\Windows\System\UiBfqLq.exe
  C:\Windows\System\UiBfqLq.exe
  2⤵
  PID:9084
- C:\Windows\System\czlUIyC.exe
  C:\Windows\System\czlUIyC.exe
  2⤵
  PID:9128
- C:\Windows\System\KhjPmGZ.exe
  C:\Windows\System\KhjPmGZ.exe
  2⤵
  PID:9156
- C:\Windows\System\CfrXngo.exe
  C:\Windows\System\CfrXngo.exe
  2⤵
  PID:9180
- C:\Windows\System\XmXMxsE.exe
  C:\Windows\System\XmXMxsE.exe
  2⤵
  PID:9200
- C:\Windows\System\RaSwscR.exe
  C:\Windows\System\RaSwscR.exe
  2⤵
  PID:7760
- C:\Windows\System\MbOssrs.exe
  C:\Windows\System\MbOssrs.exe
  2⤵
  PID:8196
- C:\Windows\System\XnLPNME.exe
  C:\Windows\System\XnLPNME.exe
  2⤵
  PID:8256
- C:\Windows\System\tljydjS.exe
  C:\Windows\System\tljydjS.exe
  2⤵
  PID:8388
- C:\Windows\System\WZXMnjf.exe
  C:\Windows\System\WZXMnjf.exe
  2⤵
  PID:8452
- C:\Windows\System\SliJbxc.exe
  C:\Windows\System\SliJbxc.exe
  2⤵
  PID:8432
- C:\Windows\System\VqWCZTC.exe
  C:\Windows\System\VqWCZTC.exe
  2⤵
  PID:8600
- C:\Windows\System\bWihWPh.exe
  C:\Windows\System\bWihWPh.exe
  2⤵
  PID:8640
- C:\Windows\System\MLWQKgw.exe
  C:\Windows\System\MLWQKgw.exe
  2⤵
  PID:8504
- C:\Windows\System\Lvexrhz.exe
  C:\Windows\System\Lvexrhz.exe
  2⤵
  PID:8544
- C:\Windows\System\UnBISVl.exe
  C:\Windows\System\UnBISVl.exe
  2⤵
  PID:8744
- C:\Windows\System\yByBoCE.exe
  C:\Windows\System\yByBoCE.exe
  2⤵
  PID:8804
- C:\Windows\System\kqKfGbN.exe
  C:\Windows\System\kqKfGbN.exe
  2⤵
  PID:8908
- C:\Windows\System\lstfhYi.exe
  C:\Windows\System\lstfhYi.exe
  2⤵
  PID:9000
- C:\Windows\System\uizUcpz.exe
  C:\Windows\System\uizUcpz.exe
  2⤵
  PID:9080
- C:\Windows\System\btvvmQp.exe
  C:\Windows\System\btvvmQp.exe
  2⤵
  PID:9152
- C:\Windows\System\wsnEZCM.exe
  C:\Windows\System\wsnEZCM.exe
  2⤵
  PID:9212
- C:\Windows\System\nuYphIV.exe
  C:\Windows\System\nuYphIV.exe
  2⤵
  PID:8284
- C:\Windows\System\lpSqMhc.exe
  C:\Windows\System\lpSqMhc.exe
  2⤵
  PID:8428
- C:\Windows\System\rqVwtoN.exe
  C:\Windows\System\rqVwtoN.exe
  2⤵
  PID:8580
- C:\Windows\System\eIycGSH.exe
  C:\Windows\System\eIycGSH.exe
  2⤵
  PID:8732
- C:\Windows\System\fzwcduh.exe
  C:\Windows\System\fzwcduh.exe
  2⤵
  PID:7496
- C:\Windows\System\LFGkDyh.exe
  C:\Windows\System\LFGkDyh.exe
  2⤵
  PID:9028
- C:\Windows\System\ehRmRxW.exe
  C:\Windows\System\ehRmRxW.exe
  2⤵
  PID:9120
- C:\Windows\System\DPOJEtX.exe
  C:\Windows\System\DPOJEtX.exe
  2⤵
  PID:8532
- C:\Windows\System\YAfQOOx.exe
  C:\Windows\System\YAfQOOx.exe
  2⤵
  PID:8704
- C:\Windows\System\MadlBsa.exe
  C:\Windows\System\MadlBsa.exe
  2⤵
  PID:8980
- C:\Windows\System\ZGpgtpN.exe
  C:\Windows\System\ZGpgtpN.exe
  2⤵
  PID:8044
- C:\Windows\System\UUpGeeq.exe
  C:\Windows\System\UUpGeeq.exe
  2⤵
  PID:9076
- C:\Windows\System\ANgIIbb.exe
  C:\Windows\System\ANgIIbb.exe
  2⤵
  PID:9260
- C:\Windows\System\PjrlRsF.exe
  C:\Windows\System\PjrlRsF.exe
  2⤵
  PID:9276
- C:\Windows\System\GRgIBDh.exe
  C:\Windows\System\GRgIBDh.exe
  2⤵
  PID:9316
- C:\Windows\System\dxpjJxL.exe
  C:\Windows\System\dxpjJxL.exe
  2⤵
  PID:9344
- C:\Windows\System\BBvuKky.exe
  C:\Windows\System\BBvuKky.exe
  2⤵
  PID:9372
- C:\Windows\System\VsVjClL.exe
  C:\Windows\System\VsVjClL.exe
  2⤵
  PID:9400
- C:\Windows\System\ShCRuqU.exe
  C:\Windows\System\ShCRuqU.exe
  2⤵
  PID:9428
- C:\Windows\System\JBkzuLm.exe
  C:\Windows\System\JBkzuLm.exe
  2⤵
  PID:9444
- C:\Windows\System\nxaJzuo.exe
  C:\Windows\System\nxaJzuo.exe
  2⤵
  PID:9476
- C:\Windows\System\LQMIZpC.exe
  C:\Windows\System\LQMIZpC.exe
  2⤵
  PID:9508
- C:\Windows\System\FTaGauY.exe
  C:\Windows\System\FTaGauY.exe
  2⤵
  PID:9524
- C:\Windows\System\WsOsngf.exe
  C:\Windows\System\WsOsngf.exe
  2⤵
  PID:9544
- C:\Windows\System\tlXumYO.exe
  C:\Windows\System\tlXumYO.exe
  2⤵
  PID:9580
- C:\Windows\System\kSoqEls.exe
  C:\Windows\System\kSoqEls.exe
  2⤵
  PID:9604
- C:\Windows\System\qKWSLya.exe
  C:\Windows\System\qKWSLya.exe
  2⤵
  PID:9632
- C:\Windows\System\jduwMId.exe
  C:\Windows\System\jduwMId.exe
  2⤵
  PID:9656
- C:\Windows\System\IFzwJqV.exe
  C:\Windows\System\IFzwJqV.exe
  2⤵
  PID:9684
- C:\Windows\System\zFGvnpF.exe
  C:\Windows\System\zFGvnpF.exe
  2⤵
  PID:9704
- C:\Windows\System\qZaJfAT.exe
  C:\Windows\System\qZaJfAT.exe
  2⤵
  PID:9752
- C:\Windows\System\kdzJkhu.exe
  C:\Windows\System\kdzJkhu.exe
  2⤵
  PID:9776
- C:\Windows\System\FWwrlKR.exe
  C:\Windows\System\FWwrlKR.exe
  2⤵
  PID:9808
- C:\Windows\System\lRmtAcd.exe
  C:\Windows\System\lRmtAcd.exe
  2⤵
  PID:9824
- C:\Windows\System\pntINcn.exe
  C:\Windows\System\pntINcn.exe
  2⤵
  PID:9868
- C:\Windows\System\isdVRbk.exe
  C:\Windows\System\isdVRbk.exe
  2⤵
  PID:9892
- C:\Windows\System\yuCvwLb.exe
  C:\Windows\System\yuCvwLb.exe
  2⤵
  PID:9908
- C:\Windows\System\SdaxkqP.exe
  C:\Windows\System\SdaxkqP.exe
  2⤵
  PID:9932
- C:\Windows\System\Ysawuql.exe
  C:\Windows\System\Ysawuql.exe
  2⤵
  PID:9956
- C:\Windows\System\dYyhWQB.exe
  C:\Windows\System\dYyhWQB.exe
  2⤵
  PID:10052
- C:\Windows\System\NNdlGgo.exe
  C:\Windows\System\NNdlGgo.exe
  2⤵
  PID:10072
- C:\Windows\System\tsoRAap.exe
  C:\Windows\System\tsoRAap.exe
  2⤵
  PID:10100
- C:\Windows\System\hjUVEKd.exe
  C:\Windows\System\hjUVEKd.exe
  2⤵
  PID:10128
- C:\Windows\System\cDMlnbl.exe
  C:\Windows\System\cDMlnbl.exe
  2⤵
  PID:10144
- C:\Windows\System\gYYmvjy.exe
  C:\Windows\System\gYYmvjy.exe
  2⤵
  PID:10172
- C:\Windows\System\xxdimpO.exe
  C:\Windows\System\xxdimpO.exe
  2⤵
  PID:10196
- C:\Windows\System\XhHkafc.exe
  C:\Windows\System\XhHkafc.exe
  2⤵
  PID:10220
- C:\Windows\System\lAlRwSn.exe
  C:\Windows\System\lAlRwSn.exe
  2⤵
  PID:9224
- C:\Windows\System\tMotsuF.exe
  C:\Windows\System\tMotsuF.exe
  2⤵
  PID:9244
- C:\Windows\System\JCcYXzZ.exe
  C:\Windows\System\JCcYXzZ.exe
  2⤵
  PID:9368
- C:\Windows\System\gJyJPGV.exe
  C:\Windows\System\gJyJPGV.exe
  2⤵
  PID:9416
- C:\Windows\System\kZXFRcD.exe
  C:\Windows\System\kZXFRcD.exe
  2⤵
  PID:9456
- C:\Windows\System\BJOrJgD.exe
  C:\Windows\System\BJOrJgD.exe
  2⤵
  PID:9516
- C:\Windows\System\TTkdlYr.exe
  C:\Windows\System\TTkdlYr.exe
  2⤵
  PID:9612
- C:\Windows\System\lbESzUL.exe
  C:\Windows\System\lbESzUL.exe
  2⤵
  PID:9664
- C:\Windows\System\DEZaySn.exe
  C:\Windows\System\DEZaySn.exe
  2⤵
  PID:9768
- C:\Windows\System\LlUIPpH.exe
  C:\Windows\System\LlUIPpH.exe
  2⤵
  PID:9844
- C:\Windows\System\HkpJCjg.exe
  C:\Windows\System\HkpJCjg.exe
  2⤵
  PID:9900
- C:\Windows\System\DnSvaLf.exe
  C:\Windows\System\DnSvaLf.exe
  2⤵
  PID:9948
- C:\Windows\System\bPHwuJi.exe
  C:\Windows\System\bPHwuJi.exe
  2⤵
  PID:3432
- C:\Windows\System\QbLhkSP.exe
  C:\Windows\System\QbLhkSP.exe
  2⤵
  PID:1164
- C:\Windows\System\LAgaYfd.exe
  C:\Windows\System\LAgaYfd.exe
  2⤵
  PID:10084
- C:\Windows\System\RbxljDF.exe
  C:\Windows\System\RbxljDF.exe
  2⤵
  PID:10164
- C:\Windows\System\roFHvbc.exe
  C:\Windows\System\roFHvbc.exe
  2⤵
  PID:8844
- C:\Windows\System\LViLbsw.exe
  C:\Windows\System\LViLbsw.exe
  2⤵
  PID:9392
- C:\Windows\System\hzdRiLS.exe
  C:\Windows\System\hzdRiLS.exe
  2⤵
  PID:9468
- C:\Windows\System\uilCWQu.exe
  C:\Windows\System\uilCWQu.exe
  2⤵
  PID:9556
- C:\Windows\System\yTgbILw.exe
  C:\Windows\System\yTgbILw.exe
  2⤵
  PID:9724
- C:\Windows\System\PAhzLuV.exe
  C:\Windows\System\PAhzLuV.exe
  2⤵
  PID:9920
- C:\Windows\System\ZQAYdRw.exe
  C:\Windows\System\ZQAYdRw.exe
  2⤵
  PID:9988
- C:\Windows\System\VgHhFBP.exe
  C:\Windows\System\VgHhFBP.exe
  2⤵
  PID:10136
- C:\Windows\System\UXkgIJC.exe
  C:\Windows\System\UXkgIJC.exe
  2⤵
  PID:9332
- C:\Windows\System\ANxxmBs.exe
  C:\Windows\System\ANxxmBs.exe
  2⤵
  PID:9504
- C:\Windows\System\iGclSlf.exe
  C:\Windows\System\iGclSlf.exe
  2⤵
  PID:10048
- C:\Windows\System\iSVwAOK.exe
  C:\Windows\System\iSVwAOK.exe
  2⤵
  PID:9640
- C:\Windows\System\wfTJNvy.exe
  C:\Windows\System\wfTJNvy.exe
  2⤵
  PID:10244
- C:\Windows\System\wNMXMfw.exe
  C:\Windows\System\wNMXMfw.exe
  2⤵
  PID:10268
- C:\Windows\System\sPZpYRn.exe
  C:\Windows\System\sPZpYRn.exe
  2⤵
  PID:10292
- C:\Windows\System\HtVLwDI.exe
  C:\Windows\System\HtVLwDI.exe
  2⤵
  PID:10344
- C:\Windows\System\JiBTRnK.exe
  C:\Windows\System\JiBTRnK.exe
  2⤵
  PID:10364
- C:\Windows\System\nnXvkgV.exe
  C:\Windows\System\nnXvkgV.exe
  2⤵
  PID:10412
- C:\Windows\System\VhZOjPk.exe
  C:\Windows\System\VhZOjPk.exe
  2⤵
  PID:10440
- C:\Windows\System\bvIBAgm.exe
  C:\Windows\System\bvIBAgm.exe
  2⤵
  PID:10464
- C:\Windows\System\AJqPVOt.exe
  C:\Windows\System\AJqPVOt.exe
  2⤵
  PID:10488
- C:\Windows\System\HxmdbGN.exe
  C:\Windows\System\HxmdbGN.exe
  2⤵
  PID:10524
- C:\Windows\System\rrHKHER.exe
  C:\Windows\System\rrHKHER.exe
  2⤵
  PID:10552
- C:\Windows\System\KbDtXnG.exe
  C:\Windows\System\KbDtXnG.exe
  2⤵
  PID:10572
- C:\Windows\System\nDIHWMY.exe
  C:\Windows\System\nDIHWMY.exe
  2⤵
  PID:10600
- C:\Windows\System\ZGMKzQm.exe
  C:\Windows\System\ZGMKzQm.exe
  2⤵
  PID:10624
- C:\Windows\System\rzNKpPl.exe
  C:\Windows\System\rzNKpPl.exe
  2⤵
  PID:10672
- C:\Windows\System\YvDHCQm.exe
  C:\Windows\System\YvDHCQm.exe
  2⤵
  PID:10700
- C:\Windows\System\xYHakKT.exe
  C:\Windows\System\xYHakKT.exe
  2⤵
  PID:10728
- C:\Windows\System\RBrWLiN.exe
  C:\Windows\System\RBrWLiN.exe
  2⤵
  PID:10752
- C:\Windows\System\DKeavLA.exe
  C:\Windows\System\DKeavLA.exe
  2⤵
  PID:10772
- C:\Windows\System\QgxrOsa.exe
  C:\Windows\System\QgxrOsa.exe
  2⤵
  PID:10792
- C:\Windows\System\TdtbmLL.exe
  C:\Windows\System\TdtbmLL.exe
  2⤵
  PID:10816
- C:\Windows\System\WerptRG.exe
  C:\Windows\System\WerptRG.exe
  2⤵
  PID:10836
- C:\Windows\System\HccwqxO.exe
  C:\Windows\System\HccwqxO.exe
  2⤵
  PID:10860
- C:\Windows\System\DdkvJLk.exe
  C:\Windows\System\DdkvJLk.exe
  2⤵
  PID:10880
- C:\Windows\System\ywkEFCH.exe
  C:\Windows\System\ywkEFCH.exe
  2⤵
  PID:10908
- C:\Windows\System\yfsTXws.exe
  C:\Windows\System\yfsTXws.exe
  2⤵
  PID:10952
- C:\Windows\System\FJeEtDp.exe
  C:\Windows\System\FJeEtDp.exe
  2⤵
  PID:10984
- C:\Windows\System\RGgcqim.exe
  C:\Windows\System\RGgcqim.exe
  2⤵
  PID:11008
- C:\Windows\System\opXNOXX.exe
  C:\Windows\System\opXNOXX.exe
  2⤵
  PID:11028
- C:\Windows\System\NounGDv.exe
  C:\Windows\System\NounGDv.exe
  2⤵
  PID:11052
- C:\Windows\System\jYUPDUH.exe
  C:\Windows\System\jYUPDUH.exe
  2⤵
  PID:11096
- C:\Windows\System\NrEAZPL.exe
  C:\Windows\System\NrEAZPL.exe
  2⤵
  PID:11112
- C:\Windows\System\XdmtaoG.exe
  C:\Windows\System\XdmtaoG.exe
  2⤵
  PID:11136
- C:\Windows\System\vKLlCav.exe
  C:\Windows\System\vKLlCav.exe
  2⤵
  PID:11188
- C:\Windows\System\isfrJpM.exe
  C:\Windows\System\isfrJpM.exe
  2⤵
  PID:11216
- C:\Windows\System\dqWqzxN.exe
  C:\Windows\System\dqWqzxN.exe
  2⤵
  PID:11236
- C:\Windows\System\ZZRXStI.exe
  C:\Windows\System\ZZRXStI.exe
  2⤵
  PID:11256
- C:\Windows\System\PjoRIkP.exe
  C:\Windows\System\PjoRIkP.exe
  2⤵
  PID:10320
- C:\Windows\System\XxbrnMC.exe
  C:\Windows\System\XxbrnMC.exe
  2⤵
  PID:10408
- C:\Windows\System\MFPpMTP.exe
  C:\Windows\System\MFPpMTP.exe
  2⤵
  PID:10472
- C:\Windows\System\IqnkSRR.exe
  C:\Windows\System\IqnkSRR.exe
  2⤵
  PID:10504
- C:\Windows\System\FdPmywW.exe
  C:\Windows\System\FdPmywW.exe
  2⤵
  PID:10584
- C:\Windows\System\MTuqFdJ.exe
  C:\Windows\System\MTuqFdJ.exe
  2⤵
  PID:10632
- C:\Windows\System\VqYKPpN.exe
  C:\Windows\System\VqYKPpN.exe
  2⤵
  PID:10716
- C:\Windows\System\uZqNYaw.exe
  C:\Windows\System\uZqNYaw.exe
  2⤵
  PID:10760
- C:\Windows\System\dhglwVo.exe
  C:\Windows\System\dhglwVo.exe
  2⤵
  PID:10828
- C:\Windows\System\CEDPQSv.exe
  C:\Windows\System\CEDPQSv.exe
  2⤵
  PID:10848
- C:\Windows\System\VwXCGFk.exe
  C:\Windows\System\VwXCGFk.exe
  2⤵
  PID:10940
- C:\Windows\System\IJsMmPY.exe
  C:\Windows\System\IJsMmPY.exe
  2⤵
  PID:11080
- C:\Windows\System\PYhgpBe.exe
  C:\Windows\System\PYhgpBe.exe
  2⤵
  PID:11124
- C:\Windows\System\qckzMYx.exe
  C:\Windows\System\qckzMYx.exe
  2⤵
  PID:11152
- C:\Windows\System\YbpSFhz.exe
  C:\Windows\System\YbpSFhz.exe
  2⤵
  PID:11196
- C:\Windows\System\qMcnKOj.exe
  C:\Windows\System\qMcnKOj.exe
  2⤵
  PID:10316
- C:\Windows\System\lRCcmoU.exe
  C:\Windows\System\lRCcmoU.exe
  2⤵
  PID:10392
- C:\Windows\System\lAWJTCL.exe
  C:\Windows\System\lAWJTCL.exe
  2⤵
  PID:10568
- C:\Windows\System\eySxpJD.exe
  C:\Windows\System\eySxpJD.exe
  2⤵
  PID:10808
- C:\Windows\System\jcRNZoV.exe
  C:\Windows\System\jcRNZoV.exe
  2⤵
  PID:10844
- C:\Windows\System\cIgRPon.exe
  C:\Windows\System\cIgRPon.exe
  2⤵
  PID:10996
- C:\Windows\System\CQJxXnY.exe
  C:\Windows\System\CQJxXnY.exe
  2⤵
  PID:11168
- C:\Windows\System\pddXVUg.exe
  C:\Windows\System\pddXVUg.exe
  2⤵
  PID:10308
- C:\Windows\System\sxjtPPI.exe
  C:\Windows\System\sxjtPPI.exe
  2⤵
  PID:10540
- C:\Windows\System\bnajmoT.exe
  C:\Windows\System\bnajmoT.exe
  2⤵
  PID:10868
- C:\Windows\System\kShAabP.exe
  C:\Windows\System\kShAabP.exe
  2⤵
  PID:10804
- C:\Windows\System\rStJWfp.exe
  C:\Windows\System\rStJWfp.exe
  2⤵
  PID:11280
- C:\Windows\System\VQYrMMP.exe
  C:\Windows\System\VQYrMMP.exe
  2⤵
  PID:11308
- C:\Windows\System\VddOJEY.exe
  C:\Windows\System\VddOJEY.exe
  2⤵
  PID:11332
- C:\Windows\System\sBCEnZO.exe
  C:\Windows\System\sBCEnZO.exe
  2⤵
  PID:11352
- C:\Windows\System\CfdpkIc.exe
  C:\Windows\System\CfdpkIc.exe
  2⤵
  PID:11376
- C:\Windows\System\xPRLtMx.exe
  C:\Windows\System\xPRLtMx.exe
  2⤵
  PID:11428
- C:\Windows\System\raZPSoK.exe
  C:\Windows\System\raZPSoK.exe
  2⤵
  PID:11452
- C:\Windows\System\iKOouno.exe
  C:\Windows\System\iKOouno.exe
  2⤵
  PID:11480
- C:\Windows\System\JUsZMTc.exe
  C:\Windows\System\JUsZMTc.exe
  2⤵
  PID:11496
- C:\Windows\System\ZPntlpd.exe
  C:\Windows\System\ZPntlpd.exe
  2⤵
  PID:11520
- C:\Windows\System\aNQmIni.exe
  C:\Windows\System\aNQmIni.exe
  2⤵
  PID:11556
- C:\Windows\System\gTietuG.exe
  C:\Windows\System\gTietuG.exe
  2⤵
  PID:11576
- C:\Windows\System\JoLiUHZ.exe
  C:\Windows\System\JoLiUHZ.exe
  2⤵
  PID:11624
- C:\Windows\System\UaDuACh.exe
  C:\Windows\System\UaDuACh.exe
  2⤵
  PID:11652
- C:\Windows\System\qFUJgMX.exe
  C:\Windows\System\qFUJgMX.exe
  2⤵
  PID:11676
- C:\Windows\System\eQnWMPl.exe
  C:\Windows\System\eQnWMPl.exe
  2⤵
  PID:11696
- C:\Windows\System\moVgwrp.exe
  C:\Windows\System\moVgwrp.exe
  2⤵
  PID:11720
- C:\Windows\System\VqnYwYt.exe
  C:\Windows\System\VqnYwYt.exe
  2⤵
  PID:11748
- C:\Windows\System\KRRtncc.exe
  C:\Windows\System\KRRtncc.exe
  2⤵
  PID:11776
- C:\Windows\System\pMWpjUN.exe
  C:\Windows\System\pMWpjUN.exe
  2⤵
  PID:11796
- C:\Windows\System\RpTDeBe.exe
  C:\Windows\System\RpTDeBe.exe
  2⤵
  PID:11844
- C:\Windows\System\nJFBvjo.exe
  C:\Windows\System\nJFBvjo.exe
  2⤵
  PID:11860
- C:\Windows\System\dKGdZXt.exe
  C:\Windows\System\dKGdZXt.exe
  2⤵
  PID:11884
- C:\Windows\System\GyXclHL.exe
  C:\Windows\System\GyXclHL.exe
  2⤵
  PID:11916
- C:\Windows\System\waoSvvA.exe
  C:\Windows\System\waoSvvA.exe
  2⤵
  PID:11932
- C:\Windows\System\RinZNMz.exe
  C:\Windows\System\RinZNMz.exe
  2⤵
  PID:11956
- C:\Windows\System\jLTZcSA.exe
  C:\Windows\System\jLTZcSA.exe
  2⤵
  PID:11976
- C:\Windows\System\PetphDs.exe
  C:\Windows\System\PetphDs.exe
  2⤵
  PID:12004
- C:\Windows\System\hexPZdt.exe
  C:\Windows\System\hexPZdt.exe
  2⤵
  PID:12032
- C:\Windows\System\qyRZQIR.exe
  C:\Windows\System\qyRZQIR.exe
  2⤵
  PID:12060
- C:\Windows\System\HiPLieA.exe
  C:\Windows\System\HiPLieA.exe
  2⤵
  PID:12104
- C:\Windows\System\ZYlFkbx.exe
  C:\Windows\System\ZYlFkbx.exe
  2⤵
  PID:12164
- C:\Windows\System\qvxbrWw.exe
  C:\Windows\System\qvxbrWw.exe
  2⤵
  PID:12188
- C:\Windows\System\DMvghln.exe
  C:\Windows\System\DMvghln.exe
  2⤵
  PID:12204
- C:\Windows\System\isixOCj.exe
  C:\Windows\System\isixOCj.exe
  2⤵
  PID:12224
- C:\Windows\System\kibDYpw.exe
  C:\Windows\System\kibDYpw.exe
  2⤵
  PID:12248
- C:\Windows\System\xAbjNTb.exe
  C:\Windows\System\xAbjNTb.exe
  2⤵
  PID:12280
- C:\Windows\System\hmmOWyZ.exe
  C:\Windows\System\hmmOWyZ.exe
  2⤵
  PID:11248
- C:\Windows\System\QLsgASe.exe
  C:\Windows\System\QLsgASe.exe
  2⤵
  PID:11328
- C:\Windows\System\tsOqRbZ.exe
  C:\Windows\System\tsOqRbZ.exe
  2⤵
  PID:11344
- C:\Windows\System\vFdqHZw.exe
  C:\Windows\System\vFdqHZw.exe
  2⤵
  PID:11416
- C:\Windows\System\yZZaANj.exe
  C:\Windows\System\yZZaANj.exe
  2⤵
  PID:11632
- C:\Windows\System\MEuZteQ.exe
  C:\Windows\System\MEuZteQ.exe
  2⤵
  PID:11664
- C:\Windows\System\LUuOGhk.exe
  C:\Windows\System\LUuOGhk.exe
  2⤵
  PID:11716
- C:\Windows\System\rmYRkVB.exe
  C:\Windows\System\rmYRkVB.exe
  2⤵
  PID:11736
- C:\Windows\System\dSUNQvZ.exe
  C:\Windows\System\dSUNQvZ.exe
  2⤵
  PID:11820
- C:\Windows\System\WDwhNct.exe
  C:\Windows\System\WDwhNct.exe
  2⤵
  PID:11904
- C:\Windows\System\RpRdJys.exe
  C:\Windows\System\RpRdJys.exe
  2⤵
  PID:11948
- C:\Windows\System\bUOhcpF.exe
  C:\Windows\System\bUOhcpF.exe
  2⤵
  PID:12020
- C:\Windows\System\stUGWhq.exe
  C:\Windows\System\stUGWhq.exe
  2⤵
  PID:12152
- C:\Windows\System\mCxfVxZ.exe
  C:\Windows\System\mCxfVxZ.exe
  2⤵
  PID:12140
- C:\Windows\System\sqMzkRe.exe
  C:\Windows\System\sqMzkRe.exe
  2⤵
  PID:12172
- C:\Windows\System\OlNqiHJ.exe
  C:\Windows\System\OlNqiHJ.exe
  2⤵
  PID:12244
- C:\Windows\System\hMwgQmt.exe
  C:\Windows\System\hMwgQmt.exe
  2⤵
  PID:11300
- C:\Windows\System\ViGDksx.exe
  C:\Windows\System\ViGDksx.exe
  2⤵
  PID:11532
- C:\Windows\System\JMbxSwk.exe
  C:\Windows\System\JMbxSwk.exe
  2⤵
  PID:11768
- C:\Windows\System\KxMpygD.exe
  C:\Windows\System\KxMpygD.exe
  2⤵
  PID:11852
- C:\Windows\System\vCFiHkY.exe
  C:\Windows\System\vCFiHkY.exe
  2⤵
  PID:11928
- C:\Windows\System\BkARJXZ.exe
  C:\Windows\System\BkARJXZ.exe
  2⤵
  PID:12048
- C:\Windows\System\QnNaWpC.exe
  C:\Windows\System\QnNaWpC.exe
  2⤵
  PID:11200
- C:\Windows\System\sMyPoHb.exe
  C:\Windows\System\sMyPoHb.exe
  2⤵
  PID:11436
- C:\Windows\System\lgnKAOK.exe
  C:\Windows\System\lgnKAOK.exe
  2⤵
  PID:11760
- C:\Windows\System\gviRqPd.exe
  C:\Windows\System\gviRqPd.exe
  2⤵
  PID:11108
- C:\Windows\System\CRCBoLa.exe
  C:\Windows\System\CRCBoLa.exe
  2⤵
  PID:11668
- C:\Windows\System\IynXBDP.exe
  C:\Windows\System\IynXBDP.exe
  2⤵
  PID:12308
- C:\Windows\System\RKZHPEG.exe
  C:\Windows\System\RKZHPEG.exe
  2⤵
  PID:12324
- C:\Windows\System\SRDCNDs.exe
  C:\Windows\System\SRDCNDs.exe
  2⤵
  PID:12360
- C:\Windows\System\WlGtOla.exe
  C:\Windows\System\WlGtOla.exe
  2⤵
  PID:12400
- C:\Windows\System\juAtPMF.exe
  C:\Windows\System\juAtPMF.exe
  2⤵
  PID:12420
- C:\Windows\System\ZAPrCJf.exe
  C:\Windows\System\ZAPrCJf.exe
  2⤵
  PID:12440
- C:\Windows\System\cTapQAf.exe
  C:\Windows\System\cTapQAf.exe
  2⤵
  PID:12476
- C:\Windows\System\GSEsIIn.exe
  C:\Windows\System\GSEsIIn.exe
  2⤵
  PID:12516
- C:\Windows\System\vuAWZVM.exe
  C:\Windows\System\vuAWZVM.exe
  2⤵
  PID:12532
- C:\Windows\System\dLrWlny.exe
  C:\Windows\System\dLrWlny.exe
  2⤵
  PID:12556
- C:\Windows\System\aAHMMiK.exe
  C:\Windows\System\aAHMMiK.exe
  2⤵
  PID:12596
- C:\Windows\System\MJRFUoI.exe
  C:\Windows\System\MJRFUoI.exe
  2⤵
  PID:12640
- C:\Windows\System\mPDWYnB.exe
  C:\Windows\System\mPDWYnB.exe
  2⤵
  PID:12656
- C:\Windows\System\tAUizyC.exe
  C:\Windows\System\tAUizyC.exe
  2⤵
  PID:12696
- C:\Windows\System\ZGLWBPC.exe
  C:\Windows\System\ZGLWBPC.exe
  2⤵
  PID:12724
- C:\Windows\System\hcSqycM.exe
  C:\Windows\System\hcSqycM.exe
  2⤵
  PID:12744
- C:\Windows\System\sBXqrMP.exe
  C:\Windows\System\sBXqrMP.exe
  2⤵
  PID:12768
- C:\Windows\System\LsibgdQ.exe
  C:\Windows\System\LsibgdQ.exe
  2⤵
  PID:12808
- C:\Windows\System\PgnJaQq.exe
  C:\Windows\System\PgnJaQq.exe
  2⤵
  PID:12824
- C:\Windows\System\OgxGsgC.exe
  C:\Windows\System\OgxGsgC.exe
  2⤵
  PID:12840
- C:\Windows\System\PfQiysb.exe
  C:\Windows\System\PfQiysb.exe
  2⤵
  PID:12856
- C:\Windows\System\ShOIRYA.exe
  C:\Windows\System\ShOIRYA.exe
  2⤵
  PID:12888
- C:\Windows\System\mtrzRcA.exe
  C:\Windows\System\mtrzRcA.exe
  2⤵
  PID:12916
- C:\Windows\System\YZrsvXO.exe
  C:\Windows\System\YZrsvXO.exe
  2⤵
  PID:12936
- C:\Windows\System\qrQiHVL.exe
  C:\Windows\System\qrQiHVL.exe
  2⤵
  PID:12960
- C:\Windows\System\ONRhwLN.exe
  C:\Windows\System\ONRhwLN.exe
  2⤵
  PID:13000
- C:\Windows\System\cTDKDnH.exe
  C:\Windows\System\cTDKDnH.exe
  2⤵
  PID:13048
- C:\Windows\System\aSDsSDM.exe
  C:\Windows\System\aSDsSDM.exe
  2⤵
  PID:13088
- C:\Windows\System\TPuchUk.exe
  C:\Windows\System\TPuchUk.exe
  2⤵
  PID:13108
- C:\Windows\System\auLCzWa.exe
  C:\Windows\System\auLCzWa.exe
  2⤵
  PID:13144
- C:\Windows\System\WIbuqYq.exe
  C:\Windows\System\WIbuqYq.exe
  2⤵
  PID:13160
- C:\Windows\System\XjUwWYu.exe
  C:\Windows\System\XjUwWYu.exe
  2⤵
  PID:13180
- C:\Windows\System\fGTjQyc.exe
  C:\Windows\System\fGTjQyc.exe
  2⤵
  PID:13200
- C:\Windows\System\mFPKQBm.exe
  C:\Windows\System\mFPKQBm.exe
  2⤵
  PID:13224
- C:\Windows\System\hdLqNgW.exe
  C:\Windows\System\hdLqNgW.exe
  2⤵
  PID:13264
- C:\Windows\System\tkruwMV.exe
  C:\Windows\System\tkruwMV.exe
  2⤵
  PID:13296
- C:\Windows\System\YIgnLRz.exe
  C:\Windows\System\YIgnLRz.exe
  2⤵
  PID:12200
- C:\Windows\System\dqMRAZc.exe
  C:\Windows\System\dqMRAZc.exe
  2⤵
  PID:12320
- C:\Windows\System\vpLlJfi.exe
  C:\Windows\System\vpLlJfi.exe
  2⤵
  PID:12452
- C:\Windows\System\ACvShXs.exe
  C:\Windows\System\ACvShXs.exe
  2⤵
  PID:12508
- C:\Windows\System\LUwXbJY.exe
  C:\Windows\System\LUwXbJY.exe
  2⤵
  PID:12580
- C:\Windows\System\uuvWaFX.exe
  C:\Windows\System\uuvWaFX.exe
  2⤵
  PID:12616
- C:\Windows\System\sHdFSOh.exe
  C:\Windows\System\sHdFSOh.exe
  2⤵
  PID:12648
- C:\Windows\System\weKQDxw.exe
  C:\Windows\System\weKQDxw.exe
  2⤵
  PID:12684
- C:\Windows\System\PgPSttu.exe
  C:\Windows\System\PgPSttu.exe
  2⤵
  PID:12736
- C:\Windows\System\IiXmHtM.exe
  C:\Windows\System\IiXmHtM.exe
  2⤵
  PID:12760
- C:\Windows\System\cambmQI.exe
  C:\Windows\System\cambmQI.exe
  2⤵
  PID:12816
- C:\Windows\System\sBlNLNJ.exe
  C:\Windows\System\sBlNLNJ.exe
  2⤵
  PID:12848
- C:\Windows\System\xFpZsnh.exe
  C:\Windows\System\xFpZsnh.exe
  2⤵
  PID:12996
- C:\Windows\System\JfqjKCD.exe
  C:\Windows\System\JfqjKCD.exe
  2⤵
  PID:13044
- C:\Windows\System\tzGDGfH.exe
  C:\Windows\System\tzGDGfH.exe
  2⤵
  PID:13156
- C:\Windows\System\rlSehdZ.exe
  C:\Windows\System\rlSehdZ.exe
  2⤵
  PID:13232
- C:\Windows\System\JoMAYZx.exe
  C:\Windows\System\JoMAYZx.exe
  2⤵
  PID:13256
- C:\Windows\System\pvapcUX.exe
  C:\Windows\System\pvapcUX.exe
  2⤵
  PID:12468
- C:\Windows\System\EiRtizD.exe
  C:\Windows\System\EiRtizD.exe
  2⤵
  PID:12528
- C:\Windows\System\yMmKXin.exe
  C:\Windows\System\yMmKXin.exe
  2⤵
  PID:12880
- C:\Windows\System\ZgUVaxO.exe
  C:\Windows\System\ZgUVaxO.exe
  2⤵
  PID:12896
- C:\Windows\System\daRZBsg.exe
  C:\Windows\System\daRZBsg.exe
  2⤵
  PID:13064
- C:\Windows\System\FQldmJm.exe
  C:\Windows\System\FQldmJm.exe
  2⤵
  PID:13188
- C:\Windows\System\RvJtVTE.exe
  C:\Windows\System\RvJtVTE.exe
  2⤵
  PID:12436
- C:\Windows\System\JUuyYuj.exe
  C:\Windows\System\JUuyYuj.exe
  2⤵
  PID:12752
- C:\Windows\System\nypzGLy.exe
  C:\Windows\System\nypzGLy.exe
  2⤵
  PID:13084
- C:\Windows\System\rpCpmtn.exe
  C:\Windows\System\rpCpmtn.exe
  2⤵
  PID:11944
- C:\Windows\System\Qgpqohl.exe
  C:\Windows\System\Qgpqohl.exe
  2⤵
  PID:12956
- C:\Windows\System\pFOhLYt.exe
  C:\Windows\System\pFOhLYt.exe
  2⤵
  PID:13328
- C:\Windows\System\fuwhyst.exe
  C:\Windows\System\fuwhyst.exe
  2⤵
  PID:13344
- C:\Windows\System\TsqjzUa.exe
  C:\Windows\System\TsqjzUa.exe
  2⤵
  PID:13392
- C:\Windows\System\qLhNJMU.exe
  C:\Windows\System\qLhNJMU.exe
  2⤵
  PID:13428
- C:\Windows\System\embwvXm.exe
  C:\Windows\System\embwvXm.exe
  2⤵
  PID:13488
- C:\Windows\System\NUhNtpU.exe
  C:\Windows\System\NUhNtpU.exe
  2⤵
  PID:13508
- C:\Windows\System\IyrJajC.exe
  C:\Windows\System\IyrJajC.exe
  2⤵
  PID:13528
- C:\Windows\System\GmvEDrh.exe
  C:\Windows\System\GmvEDrh.exe
  2⤵
  PID:13552
- C:\Windows\System\ZDuUhUs.exe
  C:\Windows\System\ZDuUhUs.exe
  2⤵
  PID:13592
- C:\Windows\System\ylyyoEU.exe
  C:\Windows\System\ylyyoEU.exe
  2⤵
  PID:13608
- C:\Windows\System\eHDambs.exe
  C:\Windows\System\eHDambs.exe
  2⤵
  PID:13648
- C:\Windows\System\GgWnWOG.exe
  C:\Windows\System\GgWnWOG.exe
  2⤵
  PID:13676
- C:\Windows\System\VMyppXT.exe
  C:\Windows\System\VMyppXT.exe
  2⤵
  PID:13696
- C:\Windows\System\mOlDwUR.exe
  C:\Windows\System\mOlDwUR.exe
  2⤵
  PID:13728
- C:\Windows\System\vIZemqd.exe
  C:\Windows\System\vIZemqd.exe
  2⤵
  PID:13752
- C:\Windows\System\sYqMZbO.exe
  C:\Windows\System\sYqMZbO.exe
  2⤵
  PID:13776
- C:\Windows\System\ypnUUGl.exe
  C:\Windows\System\ypnUUGl.exe
  2⤵
  PID:13808
- C:\Windows\System\IZEasmN.exe
  C:\Windows\System\IZEasmN.exe
  2⤵
  PID:13828
- C:\Windows\System\MjShiZb.exe
  C:\Windows\System\MjShiZb.exe
  2⤵
  PID:13844
- C:\Windows\System\YOPyQwp.exe
  C:\Windows\System\YOPyQwp.exe
  2⤵
  PID:13864
- C:\Windows\System\MrMAFsm.exe
  C:\Windows\System\MrMAFsm.exe
  2⤵
  PID:13884
- C:\Windows\System\tgwvibm.exe
  C:\Windows\System\tgwvibm.exe
  2⤵
  PID:13904
- C:\Windows\System\eZbxytt.exe
  C:\Windows\System\eZbxytt.exe
  2⤵
  PID:13924
- C:\Windows\System\GLZuLFh.exe
  C:\Windows\System\GLZuLFh.exe
  2⤵
  PID:13952
- C:\Windows\System\cQyrCUu.exe
  C:\Windows\System\cQyrCUu.exe
  2⤵
  PID:13972
- C:\Windows\System\VCCrkwX.exe
  C:\Windows\System\VCCrkwX.exe
  2⤵
  PID:13988
- C:\Windows\System\tjYNFhq.exe
  C:\Windows\System\tjYNFhq.exe
  2⤵
  PID:14008
- C:\Windows\System\sigrayl.exe
  C:\Windows\System\sigrayl.exe
  2⤵
  PID:14028
- C:\Windows\System\Wudxlzt.exe
  C:\Windows\System\Wudxlzt.exe
  2⤵
  PID:14048
- C:\Windows\System\tOzAFmW.exe
  C:\Windows\System\tOzAFmW.exe
  2⤵
  PID:14068
- C:\Windows\System\AtiHemw.exe
  C:\Windows\System\AtiHemw.exe
  2⤵
  PID:14092
- C:\Windows\System\lmTgPaK.exe
  C:\Windows\System\lmTgPaK.exe
  2⤵
  PID:14120
- C:\Windows\System\EFGYTEr.exe
  C:\Windows\System\EFGYTEr.exe
  2⤵
  PID:14144
- C:\Windows\System\PseOPhO.exe
  C:\Windows\System\PseOPhO.exe
  2⤵
  PID:14176
- C:\Windows\System\QqhXWfM.exe
  C:\Windows\System\QqhXWfM.exe
  2⤵
  PID:14208
- C:\Windows\System\AklLrIb.exe
  C:\Windows\System\AklLrIb.exe
  2⤵
  PID:14224
- C:\Windows\System\QdAFgGT.exe
  C:\Windows\System\QdAFgGT.exe
  2⤵
  PID:14252
- C:\Windows\System\imnMxBH.exe
  C:\Windows\System\imnMxBH.exe
  2⤵
  PID:14280
- C:\Windows\System\UcOhloT.exe
  C:\Windows\System\UcOhloT.exe
  2⤵
  PID:14304
- C:\Windows\System\SgsWglh.exe
  C:\Windows\System\SgsWglh.exe
  2⤵
  PID:14324
- C:\Windows\System\zzhNGbX.exe
  C:\Windows\System\zzhNGbX.exe
  2⤵
  PID:12796
- C:\Windows\System\gEAukdg.exe
  C:\Windows\System\gEAukdg.exe
  2⤵
  PID:13356
- C:\Windows\System\gmiqFIq.exe
  C:\Windows\System\gmiqFIq.exe
  2⤵
  PID:13400
- C:\Windows\System\DWRxXIO.exe
  C:\Windows\System\DWRxXIO.exe
  2⤵
  PID:13444
- C:\Windows\System\xfSquxc.exe
  C:\Windows\System\xfSquxc.exe
  2⤵
  PID:13536
- C:\Windows\System\LOTzTBD.exe
  C:\Windows\System\LOTzTBD.exe
  2⤵
  PID:13584
- C:\Windows\System\pHcQoaI.exe
  C:\Windows\System\pHcQoaI.exe
  2⤵
  PID:13668
- C:\Windows\System\XgRMkUp.exe
  C:\Windows\System\XgRMkUp.exe
  2⤵
  PID:13744
- C:\Windows\System\zlySvuD.exe
  C:\Windows\System\zlySvuD.exe
  2⤵
  PID:13764
- C:\Windows\System\MawrSfg.exe
  C:\Windows\System\MawrSfg.exe
  2⤵
  PID:13836
- C:\Windows\System\YMgHOLA.exe
  C:\Windows\System\YMgHOLA.exe
  2⤵
  PID:13872
- C:\Windows\System\thzXZNs.exe
  C:\Windows\System\thzXZNs.exe
  2⤵
  PID:13948
- C:\Windows\System\XxFFyeq.exe
  C:\Windows\System\XxFFyeq.exe
  2⤵
  PID:14004
- C:\Windows\System\kKwDSQH.exe
  C:\Windows\System\kKwDSQH.exe
  2⤵
  PID:13916
- C:\Windows\System\kujSZuv.exe
  C:\Windows\System\kujSZuv.exe
  2⤵
  PID:14188
- C:\Windows\System\KMeDGDd.exe
  C:\Windows\System\KMeDGDd.exe
  2⤵
  PID:14132
- C:\Windows\System\dvsqzvg.exe
  C:\Windows\System\dvsqzvg.exe
  2⤵
  PID:14056
- C:\Windows\System\pUrPrjV.exe
  C:\Windows\System\pUrPrjV.exe
  2⤵
  PID:13340
- C:\Windows\System\CAuJInG.exe
  C:\Windows\System\CAuJInG.exe
  2⤵
  PID:14292
- C:\Windows\System\PoHCjMI.exe
  C:\Windows\System\PoHCjMI.exe
  2⤵
  PID:13364
- C:\Windows\System\YiRYoVF.exe
  C:\Windows\System\YiRYoVF.exe
  2⤵
  PID:13784
- C:\Windows\System\scHBvye.exe
  C:\Windows\System\scHBvye.exe
  2⤵
  PID:13964
- C:\Windows\System\wssgCny.exe
  C:\Windows\System\wssgCny.exe
  2⤵
  PID:13980
- C:\Windows\System\qLlImcu.exe
  C:\Windows\System\qLlImcu.exe
  2⤵
  PID:14084
- C:\Windows\System\iwdkjeK.exe
  C:\Windows\System\iwdkjeK.exe
  2⤵
  PID:14344
- C:\Windows\System\DkTDmAd.exe
  C:\Windows\System\DkTDmAd.exe
  2⤵
  PID:14376
- C:\Windows\System\hnbRnSI.exe
  C:\Windows\System\hnbRnSI.exe
  2⤵
  PID:14404
- C:\Windows\System\ECzcBra.exe
  C:\Windows\System\ECzcBra.exe
  2⤵
  PID:14432
- C:\Windows\System\kNxqnGe.exe
  C:\Windows\System\kNxqnGe.exe
  2⤵
  PID:14448
- C:\Windows\System\mwxrniw.exe
  C:\Windows\System\mwxrniw.exe
  2⤵
  PID:14468
- C:\Windows\System\iGnJpeZ.exe
  C:\Windows\System\iGnJpeZ.exe
  2⤵
  PID:14488
- C:\Windows\System\XujYlUa.exe
  C:\Windows\System\XujYlUa.exe
  2⤵
  PID:14516
- C:\Windows\System\zjheTQX.exe
  C:\Windows\System\zjheTQX.exe
  2⤵
  PID:14536
- C:\Windows\System\hkYxcuk.exe
  C:\Windows\System\hkYxcuk.exe
  2⤵
  PID:14556
- C:\Windows\System\ulllahm.exe
  C:\Windows\System\ulllahm.exe
  2⤵
  PID:14596
- C:\Windows\System\ixOrJnm.exe
  C:\Windows\System\ixOrJnm.exe
  2⤵
  PID:14612
- C:\Windows\System\bCPaWuV.exe
  C:\Windows\System\bCPaWuV.exe
  2⤵
  PID:14704
- C:\Windows\System\EgAcUHP.exe
  C:\Windows\System\EgAcUHP.exe
  2⤵
  PID:14728
- C:\Windows\System\CXLkbxK.exe
  C:\Windows\System\CXLkbxK.exe
  2⤵
  PID:14748
- C:\Windows\System\MPzqPgs.exe
  C:\Windows\System\MPzqPgs.exe
  2⤵
  PID:14772
- C:\Windows\System\MRFDMCV.exe
  C:\Windows\System\MRFDMCV.exe
  2⤵
  PID:14804
- C:\Windows\System\eXivALf.exe
  C:\Windows\System\eXivALf.exe
  2⤵
  PID:14848
- C:\Windows\System\VmXhZbw.exe
  C:\Windows\System\VmXhZbw.exe
  2⤵
  PID:14876
- C:\Windows\System\NWcsEQZ.exe
  C:\Windows\System\NWcsEQZ.exe
  2⤵
  PID:14900
- C:\Windows\System\vpnMFDB.exe
  C:\Windows\System\vpnMFDB.exe
  2⤵
  PID:14924
- C:\Windows\System\drDUJvA.exe
  C:\Windows\System\drDUJvA.exe
  2⤵
  PID:14944
- C:\Windows\System\PSXByuX.exe
  C:\Windows\System\PSXByuX.exe
  2⤵
  PID:14972
- C:\Windows\System\dkTPlUr.exe
  C:\Windows\System\dkTPlUr.exe
  2⤵
  PID:15000
- C:\Windows\System\WJlkCRQ.exe
  C:\Windows\System\WJlkCRQ.exe
  2⤵
  PID:15024
- C:\Windows\System\GsScUpH.exe
  C:\Windows\System\GsScUpH.exe
  2⤵
  PID:15052
- C:\Windows\System\yTLMZsI.exe
  C:\Windows\System\yTLMZsI.exe
  2⤵
  PID:15076
- C:\Windows\System\jhsjLtz.exe
  C:\Windows\System\jhsjLtz.exe
  2⤵
  PID:15104
- C:\Windows\System\YrsbBtn.exe
  C:\Windows\System\YrsbBtn.exe
  2⤵
  PID:15128
- C:\Windows\System\UiwzpPZ.exe
  C:\Windows\System\UiwzpPZ.exe
  2⤵
  PID:15156
- C:\Windows\System\FrYrDPk.exe
  C:\Windows\System\FrYrDPk.exe
  2⤵
  PID:15172
- C:\Windows\System\UQLIXeZ.exe
  C:\Windows\System\UQLIXeZ.exe
  2⤵
  PID:15204
- C:\Windows\System\KETdEPF.exe
  C:\Windows\System\KETdEPF.exe
  2⤵
  PID:15228
- C:\Windows\System\mVktuln.exe
  C:\Windows\System\mVktuln.exe
  2⤵
  PID:15252
- C:\Windows\System\ISIJxwO.exe
  C:\Windows\System\ISIJxwO.exe
  2⤵
  PID:15276
- C:\Windows\System\ySnXPaG.exe
  C:\Windows\System\ySnXPaG.exe
  2⤵
  PID:15292
- C:\Windows\System\qAImKLN.exe
  C:\Windows\System\qAImKLN.exe
  2⤵
  PID:15316
- C:\Windows\System\OKIBLLx.exe
  C:\Windows\System\OKIBLLx.exe
  2⤵
  PID:15344
- C:\Windows\System\PJLIqxF.exe
  C:\Windows\System\PJLIqxF.exe
  2⤵
  PID:13440
- C:\Windows\System\xtHbRZy.exe
  C:\Windows\System\xtHbRZy.exe
  2⤵
  PID:13800
- C:\Windows\System\rxufnCy.exe
  C:\Windows\System\rxufnCy.exe
  2⤵
  PID:13568
- C:\Windows\System\xwsbaQR.exe
  C:\Windows\System\xwsbaQR.exe
  2⤵
  PID:14268
- C:\Windows\System\QQwbGjN.exe
  C:\Windows\System\QQwbGjN.exe
  2⤵
  PID:14524
- C:\Windows\System\AwrEEjs.exe
  C:\Windows\System\AwrEEjs.exe
  2⤵
  PID:14340
- C:\Windows\System\usPYTUf.exe
  C:\Windows\System\usPYTUf.exe
  2⤵
  PID:14416
- C:\Windows\System\rhMASHR.exe
  C:\Windows\System\rhMASHR.exe
  2⤵
  PID:13220
- C:\Windows\System\DNZUJBO.exe
  C:\Windows\System\DNZUJBO.exe
  2⤵
  PID:14484
- C:\Windows\System\eULYqOP.exe
  C:\Windows\System\eULYqOP.exe
  2⤵
  PID:14648
- C:\Windows\System\yUEzjDW.exe
  C:\Windows\System\yUEzjDW.exe
  2⤵
  PID:14372
- C:\Windows\System\CXpNrLS.exe
  C:\Windows\System\CXpNrLS.exe
  2⤵
  PID:14400
- C:\Windows\System\XYHorJw.exe
  C:\Windows\System\XYHorJw.exe
  2⤵
  PID:14464
- C:\Windows\System\VUEiiJY.exe
  C:\Windows\System\VUEiiJY.exe
  2⤵
  PID:14840
- C:\Windows\System\HDecrLo.exe
  C:\Windows\System\HDecrLo.exe
  2⤵
  PID:14604
- C:\Windows\System\kJsFulq.exe
  C:\Windows\System\kJsFulq.exe
  2⤵
  PID:14720
- C:\Windows\System\fNQJDxX.exe
  C:\Windows\System\fNQJDxX.exe
  2⤵
  PID:15036
- C:\Windows\System\fwrGHpL.exe
  C:\Windows\System\fwrGHpL.exe
  2⤵
  PID:15144
- C:\Windows\System\ZZekLqV.exe
  C:\Windows\System\ZZekLqV.exe
  2⤵
  PID:15212
- C:\Windows\System\LvtvBjb.exe
  C:\Windows\System\LvtvBjb.exe
  2⤵
  PID:14968
- C:\Windows\System\MDCDlcS.exe
  C:\Windows\System\MDCDlcS.exe
  2⤵
  PID:15012
- C:\Windows\System\ssJiOZp.exe
  C:\Windows\System\ssJiOZp.exe
  2⤵
  PID:15328
- C:\Windows\System\phvckPv.exe
  C:\Windows\System\phvckPv.exe
  2⤵
  PID:15236
- C:\Windows\System\ZJTgmik.exe
  C:\Windows\System\ZJTgmik.exe
  2⤵
  PID:13540
- C:\Windows\System\HhWpvAP.exe
  C:\Windows\System\HhWpvAP.exe
  2⤵
  PID:15068
- C:\Windows\System\hBmGChX.exe
  C:\Windows\System\hBmGChX.exe
  2⤵
  PID:14672
- C:\Windows\System\buivlyS.exe
  C:\Windows\System\buivlyS.exe
  2⤵
  PID:15168
- C:\Windows\System\pztjxjL.exe
  C:\Windows\System\pztjxjL.exe
  2⤵
  PID:13424
- C:\Windows\System\exEjpON.exe
  C:\Windows\System\exEjpON.exe
  2⤵
  PID:15300
- C:\Windows\System\EethAeG.exe
  C:\Windows\System\EethAeG.exe
  2⤵
  PID:14872
- C:\Windows\System\zNxqXlG.exe
  C:\Windows\System\zNxqXlG.exe
  2⤵
  PID:15376
- C:\Windows\System\LIiRqls.exe
  C:\Windows\System\LIiRqls.exe
  2⤵
  PID:15392
- C:\Windows\System\zMGPYBS.exe
  C:\Windows\System\zMGPYBS.exe
  2⤵
  PID:15428
- C:\Windows\System\YeRaQyq.exe
  C:\Windows\System\YeRaQyq.exe
  2⤵
  PID:15452
- C:\Windows\System\pAodzOh.exe
  C:\Windows\System\pAodzOh.exe
  2⤵
  PID:15476
- C:\Windows\System\fsqeNrs.exe
  C:\Windows\System\fsqeNrs.exe
  2⤵
  PID:15504
- C:\Windows\System\mHXMUxr.exe
  C:\Windows\System\mHXMUxr.exe
  2⤵
  PID:15528
- C:\Windows\System\FMiCIgH.exe
  C:\Windows\System\FMiCIgH.exe
  2⤵
  PID:15556
- C:\Windows\System\SWMdLhl.exe
  C:\Windows\System\SWMdLhl.exe
  2⤵
  PID:15716
- C:\Windows\System\FhcSVTZ.exe
  C:\Windows\System\FhcSVTZ.exe
  2⤵
  PID:15732
- C:\Windows\System\QRjJFfU.exe
  C:\Windows\System\QRjJFfU.exe
  2⤵
  PID:15748
- C:\Windows\System\jCVMyGs.exe
  C:\Windows\System\jCVMyGs.exe
  2⤵
  PID:15768
- C:\Windows\System\PYXblYJ.exe
  C:\Windows\System\PYXblYJ.exe
  2⤵
  PID:15784
- C:\Windows\System\PSHnlHW.exe
  C:\Windows\System\PSHnlHW.exe
  2⤵
  PID:15820
- C:\Windows\System\GopOCEs.exe
  C:\Windows\System\GopOCEs.exe
  2⤵
  PID:15864
- C:\Windows\System\cjExVwm.exe
  C:\Windows\System\cjExVwm.exe
  2⤵
  PID:15892
- C:\Windows\System\MwafVqN.exe
  C:\Windows\System\MwafVqN.exe
  2⤵
  PID:15932
- C:\Windows\System\hdvIuJZ.exe
  C:\Windows\System\hdvIuJZ.exe
  2⤵
  PID:15964
- C:\Windows\System\nSRPXvv.exe
  C:\Windows\System\nSRPXvv.exe
  2⤵
  PID:16080
- C:\Windows\System\QyDqCVo.exe
  C:\Windows\System\QyDqCVo.exe
  2⤵
  PID:16112
- C:\Windows\System\wVOqNXg.exe
  C:\Windows\System\wVOqNXg.exe
  2⤵
  PID:16136
- C:\Windows\System\dFlkVub.exe
  C:\Windows\System\dFlkVub.exe
  2⤵
  PID:16160
- C:\Windows\System\HNKnyuM.exe
  C:\Windows\System\HNKnyuM.exe
  2⤵
  PID:16180
- C:\Windows\System\JRrzwUm.exe
  C:\Windows\System\JRrzwUm.exe
  2⤵
  PID:16200
- C:\Windows\System\AlhhGfe.exe
  C:\Windows\System\AlhhGfe.exe
  2⤵
  PID:16252
- C:\Windows\System\AheqTur.exe
  C:\Windows\System\AheqTur.exe
  2⤵
  PID:16288
- C:\Windows\System\TjVqDxd.exe
  C:\Windows\System\TjVqDxd.exe
  2⤵
  PID:16316
- C:\Windows\System\imVMgkf.exe
  C:\Windows\System\imVMgkf.exe
  2⤵
  PID:16344
- C:\Windows\System\PKYTjQb.exe
  C:\Windows\System\PKYTjQb.exe
  2⤵
  PID:16364
- C:\Windows\System\nnKWmEF.exe
  C:\Windows\System\nnKWmEF.exe
  2⤵
  PID:13384
- C:\Windows\System\HWELrXy.exe
  C:\Windows\System\HWELrXy.exe
  2⤵
  PID:14384
- C:\Windows\System\RugKCJy.exe
  C:\Windows\System\RugKCJy.exe
  2⤵
  PID:15072
- C:\Windows\System\HZGmgYA.exe
  C:\Windows\System\HZGmgYA.exe
  2⤵
  PID:14796
- C:\Windows\System\jhhKEXN.exe
  C:\Windows\System\jhhKEXN.exe
  2⤵
  PID:14624
- C:\Windows\System\ForRiJl.exe
  C:\Windows\System\ForRiJl.exe
  2⤵
  PID:15416
- C:\Windows\System\EXrpXyq.exe
  C:\Windows\System\EXrpXyq.exe
  2⤵
  PID:4656
- C:\Windows\System\DPsWTTH.exe
  C:\Windows\System\DPsWTTH.exe
  2⤵
  PID:15608
- C:\Windows\System\EVzcojQ.exe
  C:\Windows\System\EVzcojQ.exe
  2⤵
  PID:15440
- C:\Windows\System\QajMxnM.exe
  C:\Windows\System\QajMxnM.exe
  2⤵
  PID:15816
- C:\Windows\System\kwkvNWA.exe
  C:\Windows\System\kwkvNWA.exe
  2⤵
  PID:15900
- C:\Windows\System\ALfdsbT.exe
  C:\Windows\System\ALfdsbT.exe
  2⤵
  PID:14964
- C:\Windows\System\KkfLSvu.exe
  C:\Windows\System\KkfLSvu.exe
  2⤵
  PID:15460
- C:\Windows\System\gylGKPs.exe
  C:\Windows\System\gylGKPs.exe
  2⤵
  PID:15496
- C:\Windows\System\KrGtPhO.exe
  C:\Windows\System\KrGtPhO.exe
  2⤵
  PID:15536
- C:\Windows\System\wzOBaJb.exe
  C:\Windows\System\wzOBaJb.exe
  2⤵
  PID:15564
- C:\Windows\System\iZuOvfN.exe
  C:\Windows\System\iZuOvfN.exe
  2⤵
  PID:15780
- C:\Windows\System\XVIlzQb.exe
  C:\Windows\System\XVIlzQb.exe
  2⤵
  PID:16100
- C:\Windows\System\qsAYbUC.exe
  C:\Windows\System\qsAYbUC.exe
  2⤵
  PID:15760
- C:\Windows\System\NDqLRjr.exe
  C:\Windows\System\NDqLRjr.exe
  2⤵
  PID:15792
- C:\Windows\System\vLpZAgN.exe
  C:\Windows\System\vLpZAgN.exe
  2⤵
  PID:16220
- C:\Windows\System\oFUTOvt.exe
  C:\Windows\System\oFUTOvt.exe
  2⤵
  PID:16032
- C:\Windows\System\ovSImIQ.exe
  C:\Windows\System\ovSImIQ.exe
  2⤵
  PID:15972
- C:\Windows\System\ezluwAR.exe
  C:\Windows\System\ezluwAR.exe
  2⤵
  PID:14700
- C:\Windows\System\jIqTPJD.exe
  C:\Windows\System\jIqTPJD.exe
  2⤵
  PID:15008
- C:\Windows\System\dOGpoiA.exe
  C:\Windows\System\dOGpoiA.exe
  2⤵
  PID:16296
- C:\Windows\System\zpGlxmr.exe
  C:\Windows\System\zpGlxmr.exe
  2⤵
  PID:16356
- C:\Windows\System\gqUfRAu.exe
  C:\Windows\System\gqUfRAu.exe
  2⤵
  PID:16328
- C:\Windows\System\HabYsYO.exe
  C:\Windows\System\HabYsYO.exe
  2⤵
  PID:15860
- C:\Windows\System\okjZrhE.exe
  C:\Windows\System\okjZrhE.exe
  2⤵
  PID:15888
- C:\Windows\System\PDQKkEr.exe
  C:\Windows\System\PDQKkEr.exe
  2⤵
  PID:15040
- C:\Windows\System\NspDhMo.exe
  C:\Windows\System\NspDhMo.exe
  2⤵
  PID:14396
- C:\Windows\System\JAqGwOy.exe
  C:\Windows\System\JAqGwOy.exe
  2⤵
  PID:16064
- C:\Windows\System\cPLimLB.exe
  C:\Windows\System\cPLimLB.exe
  2⤵
  PID:16396
- C:\Windows\System\jFFdYMD.exe
  C:\Windows\System\jFFdYMD.exe
  2⤵
  PID:16424
- C:\Windows\System\RalRrvD.exe
  C:\Windows\System\RalRrvD.exe
  2⤵
  PID:16472
- C:\Windows\System\jXsFQZW.exe
  C:\Windows\System\jXsFQZW.exe
  2⤵
  PID:16496
- C:\Windows\System\pwwrKbA.exe
  C:\Windows\System\pwwrKbA.exe
  2⤵
  PID:16512
- C:\Windows\System\dljImuu.exe
  C:\Windows\System\dljImuu.exe
  2⤵
  PID:16536
- C:\Windows\System\DPGENeW.exe
  C:\Windows\System\DPGENeW.exe
  2⤵
  PID:16568
- C:\Windows\System\nXGqBfm.exe
  C:\Windows\System\nXGqBfm.exe
  2⤵
  PID:16592
- C:\Windows\System\zVCsxaf.exe
  C:\Windows\System\zVCsxaf.exe
  2⤵
  PID:16608
- C:\Windows\System\dUxbPwy.exe
  C:\Windows\System\dUxbPwy.exe
  2⤵
  PID:16636
- C:\Windows\System\ATMwJEx.exe
  C:\Windows\System\ATMwJEx.exe
  2⤵
  PID:16672
- C:\Windows\System\nOVlNmZ.exe
  C:\Windows\System\nOVlNmZ.exe
  2⤵
  PID:16692
- C:\Windows\System\kMvBudX.exe
  C:\Windows\System\kMvBudX.exe
  2⤵
  PID:16724
- C:\Windows\System\zFtUIOw.exe
  C:\Windows\System\zFtUIOw.exe
  2⤵
  PID:16760
- C:\Windows\System\ZHSPVXf.exe
  C:\Windows\System\ZHSPVXf.exe
  2⤵
  PID:16788
- C:\Windows\System\awGJZLh.exe
  C:\Windows\System\awGJZLh.exe
  2⤵
  PID:16804
- C:\Windows\System\YacAcKa.exe
  C:\Windows\System\YacAcKa.exe
  2⤵
  PID:16840
- C:\Windows\System\pOPJCHA.exe
  C:\Windows\System\pOPJCHA.exe
  2⤵
  PID:16868
- C:\Windows\System\DVIMtAD.exe
  C:\Windows\System\DVIMtAD.exe
  2⤵
  PID:16896
- C:\Windows\System\IfZWyRC.exe
  C:\Windows\System\IfZWyRC.exe
  2⤵
  PID:16920
- C:\Windows\System\RDHtszD.exe
  C:\Windows\System\RDHtszD.exe
  2⤵
  PID:16936
- C:\Windows\System\vDQxcrp.exe
  C:\Windows\System\vDQxcrp.exe
  2⤵
  PID:16960

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BXukiqD.exe

Filesize
1.2MB

MD5
11c92e0a50f51ac73172317db6879893

SHA1
79de3dcc8a2c4829eb7596fd412e89914229cf13

SHA256
89521b1218195a84d79c36f92e64f014405ac481516413763cb7b9577893c5ba

SHA512
d3b60723883a04b84e0afbcb234b49740c427e495928dff71ea6950d1a26e8fd22374ea80ff3358ff60f93b4401c9879573bb339897c6e1afc68de063d306d65

Download Submit
C:\Windows\System\CSgVnhz.exe

Filesize
1.2MB

MD5
a71c7cc5e61369b6a646196da49a14b9

SHA1
52ee173d631c035e3860aef04bdf71174fa3dba6

SHA256
91f087f5e495b74350d21cd323ce38f0d657dd36e85ac0b653bd81c0fdd35f4f

SHA512
77f12ae8dd53800d36d9d760ebb612e8a597ca78dad4732d68684b6f37119ed0797a4a43c11dcd68a4fce638233462dd32a58ea60f50d7a80d8f724efd72c237

Download Submit
C:\Windows\System\EsmuFns.exe

Filesize
1.2MB

MD5
b5a61db7f72790167af7301c79edc5b3

SHA1
128ff18c6398859a4e33b92cdeb31e29100c31b7

SHA256
cb759b6b6daec94989ef7f1a9fba2f7484b7efee6bfdadb4162dc35174fd11f0

SHA512
877e26a7430f2532dc459e3355fbb625e49cdbc6e299b5c3062242c8bc2230cd8cab530be6feb0ce01e992ba673cd8e24ffcebbfde1aa09d94294a8f3c1ef9ca

Download Submit
C:\Windows\System\HBxPMDB.exe

Filesize
1.2MB

MD5
ee6e70cb56820ee9ea4e14486cf4e3e4

SHA1
cc39751d677de8b2c35f2ab3cbe567a2725fdc7e

SHA256
82affb51b81d8c6840130ca1ba9c6a180dc1fecfc6182cc7e5ad04cccdaa9653

SHA512
20bec3b5686f57f3a9a9daf8c010a486ce453406b1651e51f6c9a68233d970d45b20dc03da75cbfdb1e5c116dda60672ff37831a9275cf72a276e43f212b1252

Download Submit
C:\Windows\System\JBBhGaZ.exe

Filesize
1.2MB

MD5
2522bffdc3ff1b9716e2e7115600533b

SHA1
028cf24c0b11a532c13d93d4a073051c8f6e9b07

SHA256
dbe13f0e798a589ef9f149ca819adee9437bf8d2e687c14f4a1a5a4854290907

SHA512
bd8601524369ade8f59a5bfaa392de2cb4e7ebd1c9bb1448c60ce0e16dc373d397b9d235f557ee50c0deff7d3f662f17142f7d51d17fdadea11996bf973467b3

Download Submit
C:\Windows\System\KrygVaT.exe

Filesize
1.2MB

MD5
d652a7911378ba3b6de62ff33decde1c

SHA1
05f1ee84d2c3ea8a6bff921c8e4f0613d7a97d77

SHA256
6c2c6e5036e4efc5aba5d05c6aafae15bed4eafab16e26a142f21cdf1d1d72d6

SHA512
5e8ae304bd002d5837978b08f2f012dfc77ce1b6103b0436f76d72b5530ac9da7c1797ac3812fed852dde9febbe60399992708a4675f365a888a4507f7e92b69

Download Submit
C:\Windows\System\MJYTGKz.exe

Filesize
1.2MB

MD5
7817dd31faaa722f40adf4eaac5a9fdd

SHA1
ba87c0c22a641364828f2fa4930ee567841bbb8b

SHA256
f11bb8a957a7f6832d4016449e9f5058d183818c864919b84c0498cdc6a37c86

SHA512
1a5d09768c064cd4543c7d94351b3b2afebe41a9d858af71bf29ffa056e52a11998e7284062fd61967d1c63507b717f782bd67f106a774cd44fd6287630a7439

Download Submit
C:\Windows\System\MMgtRgR.exe

Filesize
1.2MB

MD5
5517fe7de4ceefd17f8619f83312b427

SHA1
7cf9dacbb11ee35dc4de23281f5e2a05b0f5bf3a

SHA256
691faeeb65fc1fbe6b32e38b6e55b43b4525c948e9234b1fa1243be08fadbf15

SHA512
52ba9ff027ac820d4db33ac14a7f3f3eb6c986ed1f86d27866d7fa238e379fb6719732bc4eda798a921c10a53c2c0a8e9d6d5bab8187744bf448bf0b0360cfea

Download Submit
C:\Windows\System\PsqfGLJ.exe

Filesize
1.2MB

MD5
598a1d8625daae4a652ebd7fa2b8a742

SHA1
69d04942c7738d3c907aebf1f1a1947d1ebc6289

SHA256
d66d2f28fc84f9cefc96c3edac3b9ab7b3d7573fc3988b621bcfd1f5f196abb9

SHA512
d7df10b66ecd1f6201ebc6e3c32c67a0f446660b5fd2e488c0ecd338dfbddaade08fe3a96a026c03974de4d979a258c3162248748981c78d4bc6b80ab2ed4bdd

Download Submit
C:\Windows\System\SNvTQiK.exe

Filesize
1.2MB

MD5
02a9c214f30946d5e10a5d3636c1c414

SHA1
44b4dd3f3c3ebb5e7dd0f50a3ca7cccb11eb8920

SHA256
8c8dceac64f46b53f6fb7cb2411ffe9768d11e359241097c14543152cf01170f

SHA512
f9406580d9a03a881797e41cebc2eff12b91e0aab6c55c5fbcc41684e59e5a30bb5c0a65f9a1c97aa8d1e717a2cb1157adbe83321848ed7c4c1a7aaa6f4e5e30

Download Submit
C:\Windows\System\UPysevf.exe

Filesize
1.2MB

MD5
0ab6788e2d58007bbc4135b3a42e93bd

SHA1
b750158221aedf1b69a8c161a990e896d546212c

SHA256
2760e4a40f8a283b9c86042b2798d5adca3470b2b495f5e2b651c77430160282

SHA512
f1896348f7f94810740ca09967c4c3f10a950006658011aa423efa1ffb70ca6a54bb768c8ed0e85ac0449010fb0733dc4cf9929856dfd7f9805a671ac445cdde

Download Submit
C:\Windows\System\UhPymxI.exe

Filesize
1.2MB

MD5
e66e27578d67c59fd1e7aaeb3991bd5d

SHA1
c4c498807b7159c47544eae97c2c7dbdd09cd2af

SHA256
12d244d4f8b573f3238089cb1546056610611a3fd70fee1f5d1c32a017953bcc

SHA512
c065e05d3945a687c701cfb79f97b6bb39b003e43e018fc34b994eed5883d2429de058df237b01abe5b8cb31cb6495dcec58451e9858bf1aa43f129472c4e752

Download Submit
C:\Windows\System\VfXcGzZ.exe

Filesize
1.2MB

MD5
28d1b9c6e9a0e305ac056d7b07090f34

SHA1
03816f893b84ba406c51763d5df59c0d6e652298

SHA256
18518e1de81e1ad4e42827e6a96af5aac548c049b081eb3698f7df7bd199c571

SHA512
cdddf9ac639d8c701e6ed752aac872161f64d61f7ea050eac83cea8aba8cb228f15903be40b9d38313b131b7eca9ed61178c568df50992a842ee43633d7355a2

Download Submit
C:\Windows\System\WDbGiBL.exe

Filesize
1.2MB

MD5
8535f4b7419ce35bc1940e34497b7bf2

SHA1
4458148d75574db4c58bc84b0c786135af4a0862

SHA256
cf7d945b7310aa8aab9028f704f4a904f86d5847154167deac438f4bbefca634

SHA512
b969aed008dcc4eb822f2d725c6c442f9a9fd70e691ac1e1ac76bd2a63d100023fe303cc9cf53563e64ae54821bdf647539420b95dc6974a74d86d4d725cc1d5

Download Submit
C:\Windows\System\WvUdprD.exe

Filesize
1.2MB

MD5
9e37acd1f6ec9293eaa48b5c1dd3df41

SHA1
fc40080c425b18035b2826ddcb35127985f875eb

SHA256
71b5f3686d2bf03ed28cc776d0e80ae0b7d97c93bc765b097a0be68c7210b48d

SHA512
357faa56fc5a568eaebd5e11c98e4ff79dfe5dd6b9e1af68ae81335651ecd06b163bc10c13f193aae64bceeeaabf3322d8251ae407c3cb121742a035246e1152

Download Submit
C:\Windows\System\aLqdeTr.exe

Filesize
1.2MB

MD5
46de4bd6f161913978a28c46eaf7d177

SHA1
3dd7b051cb9dc998523560334ddbdbf4154b1b91

SHA256
bd18fab524539864fb9196eee639ad8a63f816c2cfc178a251c933a431d8342e

SHA512
6f40a28f51072c90ec443581598490c35273d72e86b0c09b9716780a20215cb233fbaf0ede1227dd5f4699a2961319b2fe01b33df4b470f7884b699ee28915aa

Download Submit
C:\Windows\System\bzHAhdq.exe

Filesize
1.2MB

MD5
d34955df3aabffe88439870e95132c7c

SHA1
40e1822b2054a167890a50577fd8ec8cf2b6196b

SHA256
b814692091186111386fff79b6ed344d945309138a125b260be71ae5562c9568

SHA512
2580abfa916d1ebf584ed320ce38b6557604c16abb355d3eaece05720b74f3f0a9107ff3e37e75214490ba2ea6a2db836cc62592e65c2417f97eded0f20d9a3d

Download Submit
C:\Windows\System\cNrdzvd.exe

Filesize
1.2MB

MD5
361da59b71d92b7db8e4dd04f03960e4

SHA1
e3d7ee67d79d41cc1e2005c8c0787fca5dbc16b6

SHA256
b801a3cb41d3462dfd8b20a4d700cdf6ee36e70b03275d0fb8656da42a771513

SHA512
94e286e7ae1aede07fb697c87c616c10dd16cf8a212a49a42a9aaa46945368e90e6cbebff68c3a1ab12dd958df00f8c2b5692c7042a0ac0b8906c0aa0a3963d4

Download Submit
C:\Windows\System\cdEtJSv.exe

Filesize
1.2MB

MD5
0e47f4914368844cab40ef6a22c7e153

SHA1
96a7755955183aec98db3acdb937d7f38978ed2d

SHA256
50be6a13585bfea79e70271ab147aae89bf9c763e6ebd8323f8a35de16144ccc

SHA512
4ceb488bf563a1c1e7c75205b95e71ee78f23ee198427cd0629e13d3750159ec6cf3decb5bd558ce8f69d87d1f4ae23e4247d784ceb5a77bdd33495b898558c1

Download Submit
C:\Windows\System\fHgsHzp.exe

Filesize
1.2MB

MD5
3fd228605861765b82e4ae64d4657f92

SHA1
ae3be822f87d80a38e25ffa0769c99ba99cf92bb

SHA256
f9c6aa81e5547e148e76e3a48cb0aca17d0bf89a040a9a5fcc57174ce94f2332

SHA512
964d0b96e3162aceb285e3d7a2ebec0a04770bfdb23cb40aec990e153f5edb2f732f6c4fa026f5447f4bc1aee7403a72c5ddf0d4cd02ad2dfde624efbd2bc4e9

Download Submit
C:\Windows\System\iYGbEmT.exe

Filesize
1.2MB

MD5
087ab3ca61c2c5a68038ebcfa68d788a

SHA1
705255c38cb907f0d2237d407838b9b4a75961aa

SHA256
9d849bff23571ccbd91e7da89f8bc088731137e092d25159e93624372f7aa7cf

SHA512
2d1202af6f59951fde3472ba422f2397498495851eb5e71935b5ba8ab74b7700bb7c8bf26dfbac541c6ffa31e774be09c47b52ad512a9cc521f4a9fe1ffdeef9

Download Submit
C:\Windows\System\ibxXGkS.exe

Filesize
1.2MB

MD5
1558bc8be0430e971e429bf267d10d31

SHA1
5949c5608e3d790987d96c96170f5cae4c244e13

SHA256
95a05116046f25bf91baa816c062bf7302270d1361a17422d4f7aabfeba3061e

SHA512
995d80bc8f9bce096630fb897b9353c65ccfb23fdec44138e12e355bbc3e54898de0db8636d146dd70fcb524d833333a2dcc00f94f66ea26813c8aa25469c114

Download Submit
C:\Windows\System\jOVuTmZ.exe

Filesize
1.2MB

MD5
806498590ad661c09193e21da7c0d511

SHA1
6f56610af5a645dc01b019fa76aa307669762d8f

SHA256
b9bbee893863bb68c71b2663b85265b4ca1b55448689c047876a40ac45f3f207

SHA512
ab994b4fa819192ce3f51ca0a02fd110c96dd2fca00381a0e94b7f9bf9e9aafe37b57874424c791af7f4b1d60bac7a9bd000ea27a80f6b1fced2f937b657a24b

Download Submit
C:\Windows\System\jysDNzc.exe

Filesize
1.2MB

MD5
36c8f46b35842f34aa41631dcefbd59a

SHA1
8cde1dbca7e787a5254b7045e865de19a5652641

SHA256
5b1c0f7962e0608e9fc31d833ecc1bec3e1d8fff310c86b04dd116ad59a1b112

SHA512
96fa2d759965d8207d4d8353c4a8802d9863cb7b597bc5eb34bc37b1dad84179020cf662c4d46efc2a5d200aab2518532b88330afe81d3912c8735ac4d4b35a3

Download Submit
C:\Windows\System\kZZmWmK.exe

Filesize
1.2MB

MD5
452326342973a2c3d05cd5b9180ee51d

SHA1
9b4d313566ab7507e709b6e4cf9cbe55a9ef5ecb

SHA256
ac9894b59a795c524f0fce19f90c4730a0af6d18cb9efa8818afbb17c402ca11

SHA512
d802b43c85efebac3dca8fbdaf30c8ff2c447378ba8d2a9efca4b128e9cd1742f2464823d8d4dc828ae4d5ff14de4d96a6557b765046851ee9bb38dafef2beff

Download Submit
C:\Windows\System\licyhEv.exe

Filesize
1.2MB

MD5
87580c95606b19a1c1c4db8e74616651

SHA1
e2ca23206956526682c3525a5dbaebe5772d7cd4

SHA256
316e60564d55bded655748455c98e167f22393d92e64c695823ac3b6ea581073

SHA512
845c342fe181d184f1b42a5e834be8dbd6542fe40f395fd2ac99dc86ae793bd7301c3a3170108e05cbe2025bce3cb6ddcddb744e57dfc27e17d577ebd71278d4

Download Submit
C:\Windows\System\oQBzioB.exe

Filesize
1.2MB

MD5
fe593d7d7a8b820feaab74291ee2421d

SHA1
fb4a104bcc3a7f275fe5a8297e2c288ca56f0ad1

SHA256
f1cd5a5415bb03aafec81882a7fd4b9ad7da1209ea6e3fe3f43a53afe24e8c4a

SHA512
68a1206e46afe610c28b23042025206b5f6bddee5cc0af60db237ee62f6a85c381ac2c093b2ef730c72466cc0b3a87b15b81e4472d74df287c5d2ead2fe6df36

Download Submit
C:\Windows\System\rYufebv.exe

Filesize
1.2MB

MD5
a31e2733585edcc2cef68d223904b6bd

SHA1
bfa1a41c96455f801069fc3f5bac84b7a9f08081

SHA256
c98b26fccd255e003f27262b0598fa094e448ee675549a7ee0699b8136236d77

SHA512
af91a2b702842d4b93d754c3a64ac2183883485d2cc64b72f8966469b94117d344cd45a07fb66d9135f50f71e63f266d2da2cde2dcb037959dbc37c172330a40

Download Submit
C:\Windows\System\sPpUKkW.exe

Filesize
1.2MB

MD5
7f6a8bac43eff1e82362e3fc57d0f40e

SHA1
b314e4d1ba47df06530755757808b1579b291a61

SHA256
68c2e3b719c8aa25f6d7770f6a8d3dae8d51b52d71cb2339fbb7b3891c941d6d

SHA512
579eda03c87c92296b0e1e4c3f824d4dfa55ab8625002e8f68fe7572fc45dd4b03df866391522e3d78b1dfdb7a135ee2d8dd5938891157e6c9968014dda2b668

Download Submit
C:\Windows\System\tngUHos.exe

Filesize
1.2MB

MD5
91f5f611c64badfeb209ea3de513fd45

SHA1
7320f79c57a4a2975eeee03badbf3ded6ca85864

SHA256
66a6ebbfd2d34f17af17f74d91ce1c173c7acd5923bdbd8b596b3c23f0dabffd

SHA512
930af8c5339b3d49ab9670401d6c82c63c7dcfea19e033c977351a85a4234ec431223b67eac743a722c1ebb3da8ea330bc3225136d92592cced6940ff2c2cbf2

Download Submit
C:\Windows\System\vPyotsB.exe

Filesize
1.2MB

MD5
60620bd86288228f9ac01534f7a371b9

SHA1
96c0bf7ea27b3aa4e2dceebbd0fae3527397a6fd

SHA256
c7d35c9d70281987c03e174bf88c1051828cffa4b09d3932e6c0e569686267c9

SHA512
3aebb42b9f606235031e3230c029029bbd6788d57f897d438155380580e5ebaedb29996c6ff0b090f0ded084fef6b9706cf2afaf8a62ef8774212788ba868a8b

Download Submit
C:\Windows\System\vQKoGUr.exe

Filesize
1.2MB

MD5
4adf10e398c05a129a0e061faf9ce76f

SHA1
5554ab8d1554764084905ea6e7ec9c620ecfdc21

SHA256
b20c31df468b4adc0286897e71c765af00955702fa493e074eb382d523b3161d

SHA512
6acb5aca6fdb287621aff002542a6f946e67a02b280f082a121064917751e24cc19856d63ee9692bc134bb942081fa0ecdfd6104f190a4ceb0480c6f0d2a6a20

Download Submit
C:\Windows\System\yqRuhvz.exe

Filesize
1.2MB

MD5
c8e9b960e2a314de1018fdbc0a767dfa

SHA1
926a11599450b7413c150d73f5bba05d86e64a04

SHA256
9705d6884f1e46c654dcbe6ef2c5ec6dbe201253ee93b76f72035ae67fc777f2

SHA512
23df7a460d880501faa8dd590565318dd553937aeba8869b10a90e52709466d1e72a251185ffe6ab3dcf19ae3a32314245729785ca18e137665c1ab67bd2399a

Download Submit
memory/1000-0-0x000001EEC0E90000-0x000001EEC0EA0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads