xmrig | a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
Size

1.3MB
MD5

7672be389078411dce3c4e1cd05650f3
SHA1

25c092a6cb45f37d503b697db3bec3d0558ceb70
SHA256

a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da
SHA512

3de04f3705dbc6dd0c7a1064cd10e914e2bbe5ede65df438635b6fde88372c1d86c3977a0fc3818271255573b5d7d5d5f61e9dd261d412ba0da8920237276f68
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph70VwyMRT:GezaTF8FcNkNdfE0pZ9ozttwIRx2VQR

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023c59-4.dat	xmrig
behavioral2/files/0x0007000000023c65-9.dat	xmrig
behavioral2/files/0x0007000000023c66-14.dat	xmrig
behavioral2/files/0x0007000000023c67-19.dat	xmrig
behavioral2/files/0x0007000000023c68-23.dat	xmrig
behavioral2/files/0x0007000000023c69-29.dat	xmrig
behavioral2/files/0x0007000000023c6a-34.dat	xmrig
behavioral2/files/0x0009000000023c5a-37.dat	xmrig
behavioral2/files/0x0007000000023c6b-45.dat	xmrig
behavioral2/files/0x0007000000023c6c-50.dat	xmrig
behavioral2/files/0x0007000000023c6e-54.dat	xmrig
behavioral2/files/0x0007000000023c70-62.dat	xmrig
behavioral2/files/0x0007000000023c71-69.dat	xmrig
behavioral2/files/0x0007000000023c72-77.dat	xmrig
behavioral2/files/0x0007000000023c75-92.dat	xmrig
behavioral2/files/0x0007000000023c79-106.dat	xmrig
behavioral2/files/0x0007000000023c7a-111.dat	xmrig
behavioral2/files/0x0007000000023c7c-127.dat	xmrig
behavioral2/files/0x0007000000023c7f-137.dat	xmrig
behavioral2/files/0x0007000000023c84-162.dat	xmrig
behavioral2/files/0x0007000000023c82-160.dat	xmrig
behavioral2/files/0x0007000000023c83-157.dat	xmrig
behavioral2/files/0x0007000000023c81-155.dat	xmrig
behavioral2/files/0x0007000000023c80-150.dat	xmrig
behavioral2/files/0x0007000000023c7e-140.dat	xmrig
behavioral2/files/0x0007000000023c7d-135.dat	xmrig
behavioral2/files/0x0007000000023c7b-123.dat	xmrig
behavioral2/files/0x0007000000023c78-109.dat	xmrig
behavioral2/files/0x0007000000023c77-104.dat	xmrig
behavioral2/files/0x0007000000023c76-99.dat	xmrig
behavioral2/files/0x0007000000023c74-86.dat	xmrig
behavioral2/files/0x0007000000023c73-82.dat	xmrig
behavioral2/files/0x0007000000023c6f-61.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4584	shrUfCY.exe
4120	NndCOwj.exe
3632	PdplRLd.exe
468	DzESuXB.exe
1048	JWFNlFV.exe
968	tSHLBBn.exe
2672	ETkIbwM.exe
2600	ERxaqIo.exe
4980	hCZfxHU.exe
2376	neBKbWM.exe
3692	ykYWTaG.exe
1788	FaCtBnx.exe
4288	ckHzMiQ.exe
1196	XtBMNES.exe
2284	Ordrplk.exe
3740	YLhwJPy.exe
2456	DSaYtpk.exe
4456	MNlKFMd.exe
3224	rWrTEis.exe
1504	pENdbQo.exe
2920	uSqMkTn.exe
4448	ElhTJIy.exe
4428	yWgCUXK.exe
1696	vCZHOyA.exe
4844	jxrMvMB.exe
4460	NqLHsBx.exe
4972	VZJjJjj.exe
1168	fjEEwWW.exe
4420	AewTUUY.exe
4488	IwOIkLh.exe
3412	kMpLMVR.exe
992	lnoclLt.exe
4196	EfnhlGL.exe
4712	YohPTKH.exe
1952	fBfAlqu.exe
4104	vagMXpp.exe
1424	OgcteWM.exe
1400	ejTqRkN.exe
2236	hPQtkOY.exe
3720	IQSzkFi.exe
2944	LnKnPWj.exe
216	ajdDJmu.exe
4748	UfraXbZ.exe
1324	hhaPMIt.exe
4936	Ozydopw.exe
1076	WDtzMgv.exe
4560	OhLdHpO.exe
4360	HfUwECk.exe
4520	ZJTOqWD.exe
4332	xeyyiDV.exe
3636	eVWxdkR.exe
2204	HEvxizV.exe
3184	IYuodmN.exe
2976	aLGyjQB.exe
1256	EhuWnlT.exe
4000	dfujQQV.exe
1792	kHohNJH.exe
852	ZkvjPXN.exe
3020	QiPynis.exe
1536	LjwrkRC.exe
3488	oCHIvhY.exe
1020	UCLmxzP.exe
4064	yutJoPE.exe
1876	nSTMjNx.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YEcXaJg.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\cTtwYmb.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\vGyiZpB.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\xeKLCAp.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\jyVjfRp.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\EeSBXVV.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\gGLuzRh.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\sLQXmkV.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\KcwSIXP.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\nhLJVDw.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\dAFNuHy.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\hacopSU.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\XbgrhIC.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\BfOTtHR.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\tKTetTZ.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\CLrEZNc.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\pilFxAG.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\gsEANjw.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\GwqZwzD.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\VolDLwb.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\vzyovba.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\UhkiXgT.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\IHDQuhH.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\cjdLdZY.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\RgXCBVM.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\GIzUxvT.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\FnOrHQI.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\MNpgGZl.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\bmTBVoY.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\anTDysp.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\XIvPFQK.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\PAtXTBn.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\YBtNilT.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\FEyjciT.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\WuJCTma.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\rWrTEis.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\eVWxdkR.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\zGknRpe.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\mgVPWRP.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\tgWHTnG.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\RVOIWEz.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\FlWOINb.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\nbJUUjL.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\xMiIgPh.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\xYVQbDp.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\BcWqtyP.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\HLWqQDy.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\CIRJBdZ.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\sPyFtjE.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\gTkQuqX.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\SjWHupn.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\JCBiPuS.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\QYgdbJY.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\GFYurbA.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\OlNXzoQ.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\lNsjONs.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\SMGGlvL.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\JxUDBhS.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\FTYyPXJ.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\WWpKBXs.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\TEpWpIJ.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\WSuTCxY.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\LgzLxIX.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
File created	C:\Windows\System\tYxSWpj.exe	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17104	dwm.exe
Token: SeChangeNotifyPrivilege	17104	dwm.exe
Token: 33	17104	dwm.exe
Token: SeIncBasePriorityPrivilege	17104	dwm.exe
Token: SeShutdownPrivilege	17104	dwm.exe
Token: SeCreatePagefilePrivilege	17104	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 4584	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	84
PID 3552 wrote to memory of 4584	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	84
PID 3552 wrote to memory of 4120	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	85
PID 3552 wrote to memory of 4120	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	85
PID 3552 wrote to memory of 3632	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	86
PID 3552 wrote to memory of 3632	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	86
PID 3552 wrote to memory of 468	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	87
PID 3552 wrote to memory of 468	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	87
PID 3552 wrote to memory of 1048	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	88
PID 3552 wrote to memory of 1048	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	88
PID 3552 wrote to memory of 968	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	89
PID 3552 wrote to memory of 968	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	89
PID 3552 wrote to memory of 2672	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	91
PID 3552 wrote to memory of 2672	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	91
PID 3552 wrote to memory of 2600	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	92
PID 3552 wrote to memory of 2600	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	92
PID 3552 wrote to memory of 4980	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	93
PID 3552 wrote to memory of 4980	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	93
PID 3552 wrote to memory of 2376	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	94
PID 3552 wrote to memory of 2376	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	94
PID 3552 wrote to memory of 3692	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	95
PID 3552 wrote to memory of 3692	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	95
PID 3552 wrote to memory of 1788	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	97
PID 3552 wrote to memory of 1788	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	97
PID 3552 wrote to memory of 4288	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	98
PID 3552 wrote to memory of 4288	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	98
PID 3552 wrote to memory of 1196	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	99
PID 3552 wrote to memory of 1196	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	99
PID 3552 wrote to memory of 2284	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	100
PID 3552 wrote to memory of 2284	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	100
PID 3552 wrote to memory of 3740	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	101
PID 3552 wrote to memory of 3740	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	101
PID 3552 wrote to memory of 2456	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	102
PID 3552 wrote to memory of 2456	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	102
PID 3552 wrote to memory of 4456	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	103
PID 3552 wrote to memory of 4456	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	103
PID 3552 wrote to memory of 3224	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	104
PID 3552 wrote to memory of 3224	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	104
PID 3552 wrote to memory of 1504	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	105
PID 3552 wrote to memory of 1504	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	105
PID 3552 wrote to memory of 2920	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	106
PID 3552 wrote to memory of 2920	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	106
PID 3552 wrote to memory of 4448	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	107
PID 3552 wrote to memory of 4448	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	107
PID 3552 wrote to memory of 4428	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	108
PID 3552 wrote to memory of 4428	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	108
PID 3552 wrote to memory of 1696	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	109
PID 3552 wrote to memory of 1696	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	109
PID 3552 wrote to memory of 4844	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	110
PID 3552 wrote to memory of 4844	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	110
PID 3552 wrote to memory of 4460	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	111
PID 3552 wrote to memory of 4460	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	111
PID 3552 wrote to memory of 4972	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	112
PID 3552 wrote to memory of 4972	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	112
PID 3552 wrote to memory of 1168	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	113
PID 3552 wrote to memory of 1168	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	113
PID 3552 wrote to memory of 4420	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	114
PID 3552 wrote to memory of 4420	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	114
PID 3552 wrote to memory of 4488	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	115
PID 3552 wrote to memory of 4488	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	115
PID 3552 wrote to memory of 3412	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	116
PID 3552 wrote to memory of 3412	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	116
PID 3552 wrote to memory of 992	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	117
PID 3552 wrote to memory of 992	3552	a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe	117

C:\Users\Admin\AppData\Local\Temp\a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe
"C:\Users\Admin\AppData\Local\Temp\a437b088c34793c4c85213ba5a66374196d07a185213ae432230499d969573da.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\System\shrUfCY.exe
  C:\Windows\System\shrUfCY.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\NndCOwj.exe
  C:\Windows\System\NndCOwj.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\PdplRLd.exe
  C:\Windows\System\PdplRLd.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\DzESuXB.exe
  C:\Windows\System\DzESuXB.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\JWFNlFV.exe
  C:\Windows\System\JWFNlFV.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\tSHLBBn.exe
  C:\Windows\System\tSHLBBn.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\ETkIbwM.exe
  C:\Windows\System\ETkIbwM.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\ERxaqIo.exe
  C:\Windows\System\ERxaqIo.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\hCZfxHU.exe
  C:\Windows\System\hCZfxHU.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\neBKbWM.exe
  C:\Windows\System\neBKbWM.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\ykYWTaG.exe
  C:\Windows\System\ykYWTaG.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\FaCtBnx.exe
  C:\Windows\System\FaCtBnx.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\ckHzMiQ.exe
  C:\Windows\System\ckHzMiQ.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\XtBMNES.exe
  C:\Windows\System\XtBMNES.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\Ordrplk.exe
  C:\Windows\System\Ordrplk.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\YLhwJPy.exe
  C:\Windows\System\YLhwJPy.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\DSaYtpk.exe
  C:\Windows\System\DSaYtpk.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\MNlKFMd.exe
  C:\Windows\System\MNlKFMd.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\rWrTEis.exe
  C:\Windows\System\rWrTEis.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\pENdbQo.exe
  C:\Windows\System\pENdbQo.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\uSqMkTn.exe
  C:\Windows\System\uSqMkTn.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\ElhTJIy.exe
  C:\Windows\System\ElhTJIy.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\yWgCUXK.exe
  C:\Windows\System\yWgCUXK.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\vCZHOyA.exe
  C:\Windows\System\vCZHOyA.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\jxrMvMB.exe
  C:\Windows\System\jxrMvMB.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\NqLHsBx.exe
  C:\Windows\System\NqLHsBx.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\VZJjJjj.exe
  C:\Windows\System\VZJjJjj.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\fjEEwWW.exe
  C:\Windows\System\fjEEwWW.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\AewTUUY.exe
  C:\Windows\System\AewTUUY.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\IwOIkLh.exe
  C:\Windows\System\IwOIkLh.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\kMpLMVR.exe
  C:\Windows\System\kMpLMVR.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\lnoclLt.exe
  C:\Windows\System\lnoclLt.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\EfnhlGL.exe
  C:\Windows\System\EfnhlGL.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\YohPTKH.exe
  C:\Windows\System\YohPTKH.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\fBfAlqu.exe
  C:\Windows\System\fBfAlqu.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\vagMXpp.exe
  C:\Windows\System\vagMXpp.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\OgcteWM.exe
  C:\Windows\System\OgcteWM.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\ejTqRkN.exe
  C:\Windows\System\ejTqRkN.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\hPQtkOY.exe
  C:\Windows\System\hPQtkOY.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\IQSzkFi.exe
  C:\Windows\System\IQSzkFi.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\LnKnPWj.exe
  C:\Windows\System\LnKnPWj.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\ajdDJmu.exe
  C:\Windows\System\ajdDJmu.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\UfraXbZ.exe
  C:\Windows\System\UfraXbZ.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\hhaPMIt.exe
  C:\Windows\System\hhaPMIt.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\Ozydopw.exe
  C:\Windows\System\Ozydopw.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\WDtzMgv.exe
  C:\Windows\System\WDtzMgv.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\OhLdHpO.exe
  C:\Windows\System\OhLdHpO.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\HfUwECk.exe
  C:\Windows\System\HfUwECk.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\ZJTOqWD.exe
  C:\Windows\System\ZJTOqWD.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\xeyyiDV.exe
  C:\Windows\System\xeyyiDV.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\eVWxdkR.exe
  C:\Windows\System\eVWxdkR.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\HEvxizV.exe
  C:\Windows\System\HEvxizV.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\IYuodmN.exe
  C:\Windows\System\IYuodmN.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\aLGyjQB.exe
  C:\Windows\System\aLGyjQB.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\EhuWnlT.exe
  C:\Windows\System\EhuWnlT.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\dfujQQV.exe
  C:\Windows\System\dfujQQV.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\kHohNJH.exe
  C:\Windows\System\kHohNJH.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\ZkvjPXN.exe
  C:\Windows\System\ZkvjPXN.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\QiPynis.exe
  C:\Windows\System\QiPynis.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\LjwrkRC.exe
  C:\Windows\System\LjwrkRC.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\oCHIvhY.exe
  C:\Windows\System\oCHIvhY.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\UCLmxzP.exe
  C:\Windows\System\UCLmxzP.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\yutJoPE.exe
  C:\Windows\System\yutJoPE.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\nSTMjNx.exe
  C:\Windows\System\nSTMjNx.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\PTjFokY.exe
  C:\Windows\System\PTjFokY.exe
  2⤵
  PID:2980
- C:\Windows\System\sTMqIDj.exe
  C:\Windows\System\sTMqIDj.exe
  2⤵
  PID:2152
- C:\Windows\System\McXdGpD.exe
  C:\Windows\System\McXdGpD.exe
  2⤵
  PID:3196
- C:\Windows\System\acTMJRf.exe
  C:\Windows\System\acTMJRf.exe
  2⤵
  PID:2808
- C:\Windows\System\LGBrPFD.exe
  C:\Windows\System\LGBrPFD.exe
  2⤵
  PID:3008
- C:\Windows\System\DyTbSuV.exe
  C:\Windows\System\DyTbSuV.exe
  2⤵
  PID:4600
- C:\Windows\System\hcWcoSB.exe
  C:\Windows\System\hcWcoSB.exe
  2⤵
  PID:408
- C:\Windows\System\rRHVsoV.exe
  C:\Windows\System\rRHVsoV.exe
  2⤵
  PID:1600
- C:\Windows\System\cMcOTCo.exe
  C:\Windows\System\cMcOTCo.exe
  2⤵
  PID:552
- C:\Windows\System\rstTwvx.exe
  C:\Windows\System\rstTwvx.exe
  2⤵
  PID:4228
- C:\Windows\System\LyTERzA.exe
  C:\Windows\System\LyTERzA.exe
  2⤵
  PID:3996
- C:\Windows\System\TJaOoPX.exe
  C:\Windows\System\TJaOoPX.exe
  2⤵
  PID:4588
- C:\Windows\System\VJPuHId.exe
  C:\Windows\System\VJPuHId.exe
  2⤵
  PID:2660
- C:\Windows\System\ExFVGAz.exe
  C:\Windows\System\ExFVGAz.exe
  2⤵
  PID:1404
- C:\Windows\System\wHLnVug.exe
  C:\Windows\System\wHLnVug.exe
  2⤵
  PID:1736
- C:\Windows\System\tgWHTnG.exe
  C:\Windows\System\tgWHTnG.exe
  2⤵
  PID:5112
- C:\Windows\System\HYaQVzC.exe
  C:\Windows\System\HYaQVzC.exe
  2⤵
  PID:4984
- C:\Windows\System\hNnOMgX.exe
  C:\Windows\System\hNnOMgX.exe
  2⤵
  PID:4304
- C:\Windows\System\IcxYDHt.exe
  C:\Windows\System\IcxYDHt.exe
  2⤵
  PID:412
- C:\Windows\System\muiUOwm.exe
  C:\Windows\System\muiUOwm.exe
  2⤵
  PID:4840
- C:\Windows\System\lmMQjqZ.exe
  C:\Windows\System\lmMQjqZ.exe
  2⤵
  PID:1396
- C:\Windows\System\GJoSsFT.exe
  C:\Windows\System\GJoSsFT.exe
  2⤵
  PID:4124
- C:\Windows\System\nEgexHj.exe
  C:\Windows\System\nEgexHj.exe
  2⤵
  PID:3948
- C:\Windows\System\knmJWWL.exe
  C:\Windows\System\knmJWWL.exe
  2⤵
  PID:1264
- C:\Windows\System\XIvPFQK.exe
  C:\Windows\System\XIvPFQK.exe
  2⤵
  PID:4800
- C:\Windows\System\pYftaUd.exe
  C:\Windows\System\pYftaUd.exe
  2⤵
  PID:2300
- C:\Windows\System\uEXZJWH.exe
  C:\Windows\System\uEXZJWH.exe
  2⤵
  PID:4960
- C:\Windows\System\OfxtTwQ.exe
  C:\Windows\System\OfxtTwQ.exe
  2⤵
  PID:1960
- C:\Windows\System\woTeMfC.exe
  C:\Windows\System\woTeMfC.exe
  2⤵
  PID:4820
- C:\Windows\System\hVzNQVy.exe
  C:\Windows\System\hVzNQVy.exe
  2⤵
  PID:2524
- C:\Windows\System\yLoavLM.exe
  C:\Windows\System\yLoavLM.exe
  2⤵
  PID:2720
- C:\Windows\System\ArrCjnY.exe
  C:\Windows\System\ArrCjnY.exe
  2⤵
  PID:876
- C:\Windows\System\FuieJyK.exe
  C:\Windows\System\FuieJyK.exe
  2⤵
  PID:1528
- C:\Windows\System\yXgBZBA.exe
  C:\Windows\System\yXgBZBA.exe
  2⤵
  PID:2252
- C:\Windows\System\bLZlqMx.exe
  C:\Windows\System\bLZlqMx.exe
  2⤵
  PID:2972
- C:\Windows\System\gclesOO.exe
  C:\Windows\System\gclesOO.exe
  2⤵
  PID:3852
- C:\Windows\System\RZuqrPx.exe
  C:\Windows\System\RZuqrPx.exe
  2⤵
  PID:1412
- C:\Windows\System\qltecDO.exe
  C:\Windows\System\qltecDO.exe
  2⤵
  PID:3984
- C:\Windows\System\SjWHupn.exe
  C:\Windows\System\SjWHupn.exe
  2⤵
  PID:3960
- C:\Windows\System\efQjCMc.exe
  C:\Windows\System\efQjCMc.exe
  2⤵
  PID:1436
- C:\Windows\System\CBJViuF.exe
  C:\Windows\System\CBJViuF.exe
  2⤵
  PID:456
- C:\Windows\System\XJjXXdp.exe
  C:\Windows\System\XJjXXdp.exe
  2⤵
  PID:5172
- C:\Windows\System\XqvIjxq.exe
  C:\Windows\System\XqvIjxq.exe
  2⤵
  PID:5196
- C:\Windows\System\XPjHcdR.exe
  C:\Windows\System\XPjHcdR.exe
  2⤵
  PID:5228
- C:\Windows\System\Kflxziq.exe
  C:\Windows\System\Kflxziq.exe
  2⤵
  PID:5256
- C:\Windows\System\avpiCpb.exe
  C:\Windows\System\avpiCpb.exe
  2⤵
  PID:5272
- C:\Windows\System\XqMpbZi.exe
  C:\Windows\System\XqMpbZi.exe
  2⤵
  PID:5308
- C:\Windows\System\ulamAke.exe
  C:\Windows\System\ulamAke.exe
  2⤵
  PID:5348
- C:\Windows\System\iYPmBOJ.exe
  C:\Windows\System\iYPmBOJ.exe
  2⤵
  PID:5368
- C:\Windows\System\danPxbk.exe
  C:\Windows\System\danPxbk.exe
  2⤵
  PID:5392
- C:\Windows\System\jhZUQdQ.exe
  C:\Windows\System\jhZUQdQ.exe
  2⤵
  PID:5416
- C:\Windows\System\CAvYJPj.exe
  C:\Windows\System\CAvYJPj.exe
  2⤵
  PID:5440
- C:\Windows\System\toxcRfK.exe
  C:\Windows\System\toxcRfK.exe
  2⤵
  PID:5472
- C:\Windows\System\exYtFEh.exe
  C:\Windows\System\exYtFEh.exe
  2⤵
  PID:5512
- C:\Windows\System\aqOsNVF.exe
  C:\Windows\System\aqOsNVF.exe
  2⤵
  PID:5548
- C:\Windows\System\NubzHQp.exe
  C:\Windows\System\NubzHQp.exe
  2⤵
  PID:5584
- C:\Windows\System\EOsyhBJ.exe
  C:\Windows\System\EOsyhBJ.exe
  2⤵
  PID:5600
- C:\Windows\System\iXsYsoH.exe
  C:\Windows\System\iXsYsoH.exe
  2⤵
  PID:5624
- C:\Windows\System\SqvENnT.exe
  C:\Windows\System\SqvENnT.exe
  2⤵
  PID:5660
- C:\Windows\System\iGSnMEJ.exe
  C:\Windows\System\iGSnMEJ.exe
  2⤵
  PID:5684
- C:\Windows\System\vzyovba.exe
  C:\Windows\System\vzyovba.exe
  2⤵
  PID:5720
- C:\Windows\System\hmhpWxS.exe
  C:\Windows\System\hmhpWxS.exe
  2⤵
  PID:5740
- C:\Windows\System\aDiJazK.exe
  C:\Windows\System\aDiJazK.exe
  2⤵
  PID:5768
- C:\Windows\System\rfTJCTb.exe
  C:\Windows\System\rfTJCTb.exe
  2⤵
  PID:5800
- C:\Windows\System\aABqsPb.exe
  C:\Windows\System\aABqsPb.exe
  2⤵
  PID:5832
- C:\Windows\System\xFSxjuJ.exe
  C:\Windows\System\xFSxjuJ.exe
  2⤵
  PID:5868
- C:\Windows\System\rtEIqXK.exe
  C:\Windows\System\rtEIqXK.exe
  2⤵
  PID:5888
- C:\Windows\System\RgXCBVM.exe
  C:\Windows\System\RgXCBVM.exe
  2⤵
  PID:5928
- C:\Windows\System\XbgrhIC.exe
  C:\Windows\System\XbgrhIC.exe
  2⤵
  PID:5956
- C:\Windows\System\kyvDwoR.exe
  C:\Windows\System\kyvDwoR.exe
  2⤵
  PID:5984
- C:\Windows\System\REhEkel.exe
  C:\Windows\System\REhEkel.exe
  2⤵
  PID:6012
- C:\Windows\System\UbgrufM.exe
  C:\Windows\System\UbgrufM.exe
  2⤵
  PID:6032
- C:\Windows\System\zCHiUSk.exe
  C:\Windows\System\zCHiUSk.exe
  2⤵
  PID:6068
- C:\Windows\System\ZGYrwPz.exe
  C:\Windows\System\ZGYrwPz.exe
  2⤵
  PID:6096
- C:\Windows\System\zBBNjjP.exe
  C:\Windows\System\zBBNjjP.exe
  2⤵
  PID:6124
- C:\Windows\System\CLrEZNc.exe
  C:\Windows\System\CLrEZNc.exe
  2⤵
  PID:3620
- C:\Windows\System\RVOIWEz.exe
  C:\Windows\System\RVOIWEz.exe
  2⤵
  PID:5212
- C:\Windows\System\hYSfMOA.exe
  C:\Windows\System\hYSfMOA.exe
  2⤵
  PID:5268
- C:\Windows\System\eaOAQFf.exe
  C:\Windows\System\eaOAQFf.exe
  2⤵
  PID:5340
- C:\Windows\System\BKeZVaX.exe
  C:\Windows\System\BKeZVaX.exe
  2⤵
  PID:5408
- C:\Windows\System\SYUVcPc.exe
  C:\Windows\System\SYUVcPc.exe
  2⤵
  PID:5432
- C:\Windows\System\RYMBHYu.exe
  C:\Windows\System\RYMBHYu.exe
  2⤵
  PID:5484
- C:\Windows\System\oEYNboE.exe
  C:\Windows\System\oEYNboE.exe
  2⤵
  PID:5532
- C:\Windows\System\AMYMreI.exe
  C:\Windows\System\AMYMreI.exe
  2⤵
  PID:5612
- C:\Windows\System\DDRkdFI.exe
  C:\Windows\System\DDRkdFI.exe
  2⤵
  PID:5676
- C:\Windows\System\wJVBlse.exe
  C:\Windows\System\wJVBlse.exe
  2⤵
  PID:5736
- C:\Windows\System\RFdKYov.exe
  C:\Windows\System\RFdKYov.exe
  2⤵
  PID:5784
- C:\Windows\System\UtqfJeL.exe
  C:\Windows\System\UtqfJeL.exe
  2⤵
  PID:5900
- C:\Windows\System\zGknRpe.exe
  C:\Windows\System\zGknRpe.exe
  2⤵
  PID:5976
- C:\Windows\System\fRalgyB.exe
  C:\Windows\System\fRalgyB.exe
  2⤵
  PID:6040
- C:\Windows\System\xBhHVYd.exe
  C:\Windows\System\xBhHVYd.exe
  2⤵
  PID:6108
- C:\Windows\System\GCIQIfV.exe
  C:\Windows\System\GCIQIfV.exe
  2⤵
  PID:5184
- C:\Windows\System\SoIPMcx.exe
  C:\Windows\System\SoIPMcx.exe
  2⤵
  PID:5496
- C:\Windows\System\HpSPiwj.exe
  C:\Windows\System\HpSPiwj.exe
  2⤵
  PID:5592
- C:\Windows\System\hKXGMbO.exe
  C:\Windows\System\hKXGMbO.exe
  2⤵
  PID:5756
- C:\Windows\System\KFoaJGt.exe
  C:\Windows\System\KFoaJGt.exe
  2⤵
  PID:5704
- C:\Windows\System\SlyUEYp.exe
  C:\Windows\System\SlyUEYp.exe
  2⤵
  PID:6056
- C:\Windows\System\KXdBEQX.exe
  C:\Windows\System\KXdBEQX.exe
  2⤵
  PID:5140
- C:\Windows\System\NLaVWCR.exe
  C:\Windows\System\NLaVWCR.exe
  2⤵
  PID:5320
- C:\Windows\System\lCXdcYn.exe
  C:\Windows\System\lCXdcYn.exe
  2⤵
  PID:5812
- C:\Windows\System\CkfujMS.exe
  C:\Windows\System\CkfujMS.exe
  2⤵
  PID:5640
- C:\Windows\System\OeMfqwe.exe
  C:\Windows\System\OeMfqwe.exe
  2⤵
  PID:5240
- C:\Windows\System\vYiaqyk.exe
  C:\Windows\System\vYiaqyk.exe
  2⤵
  PID:6172
- C:\Windows\System\ukwWEHf.exe
  C:\Windows\System\ukwWEHf.exe
  2⤵
  PID:6200
- C:\Windows\System\FKZPMHW.exe
  C:\Windows\System\FKZPMHW.exe
  2⤵
  PID:6240
- C:\Windows\System\eIUGyTy.exe
  C:\Windows\System\eIUGyTy.exe
  2⤵
  PID:6268
- C:\Windows\System\cqbQTIQ.exe
  C:\Windows\System\cqbQTIQ.exe
  2⤵
  PID:6284
- C:\Windows\System\OlNXzoQ.exe
  C:\Windows\System\OlNXzoQ.exe
  2⤵
  PID:6304
- C:\Windows\System\xVAESfw.exe
  C:\Windows\System\xVAESfw.exe
  2⤵
  PID:6328
- C:\Windows\System\DCvCpQl.exe
  C:\Windows\System\DCvCpQl.exe
  2⤵
  PID:6356
- C:\Windows\System\TjCeIPx.exe
  C:\Windows\System\TjCeIPx.exe
  2⤵
  PID:6384
- C:\Windows\System\LEgkcCB.exe
  C:\Windows\System\LEgkcCB.exe
  2⤵
  PID:6412
- C:\Windows\System\XSLfedO.exe
  C:\Windows\System\XSLfedO.exe
  2⤵
  PID:6436
- C:\Windows\System\QTQkgjb.exe
  C:\Windows\System\QTQkgjb.exe
  2⤵
  PID:6464
- C:\Windows\System\VwWqTpb.exe
  C:\Windows\System\VwWqTpb.exe
  2⤵
  PID:6492
- C:\Windows\System\GsnLFzk.exe
  C:\Windows\System\GsnLFzk.exe
  2⤵
  PID:6516
- C:\Windows\System\ACAPOkI.exe
  C:\Windows\System\ACAPOkI.exe
  2⤵
  PID:6548
- C:\Windows\System\mavtdVk.exe
  C:\Windows\System\mavtdVk.exe
  2⤵
  PID:6576
- C:\Windows\System\QTbrpkD.exe
  C:\Windows\System\QTbrpkD.exe
  2⤵
  PID:6620
- C:\Windows\System\goeRWwG.exe
  C:\Windows\System\goeRWwG.exe
  2⤵
  PID:6644
- C:\Windows\System\AoFNSIv.exe
  C:\Windows\System\AoFNSIv.exe
  2⤵
  PID:6672
- C:\Windows\System\BcRQIIm.exe
  C:\Windows\System\BcRQIIm.exe
  2⤵
  PID:6692
- C:\Windows\System\qIqhvzf.exe
  C:\Windows\System\qIqhvzf.exe
  2⤵
  PID:6720
- C:\Windows\System\yxpMqko.exe
  C:\Windows\System\yxpMqko.exe
  2⤵
  PID:6748
- C:\Windows\System\JmLHHAG.exe
  C:\Windows\System\JmLHHAG.exe
  2⤵
  PID:6784
- C:\Windows\System\TCVZhmd.exe
  C:\Windows\System\TCVZhmd.exe
  2⤵
  PID:6804
- C:\Windows\System\XcstzdM.exe
  C:\Windows\System\XcstzdM.exe
  2⤵
  PID:6820
- C:\Windows\System\NeqNHMb.exe
  C:\Windows\System\NeqNHMb.exe
  2⤵
  PID:6848
- C:\Windows\System\xIjUCAV.exe
  C:\Windows\System\xIjUCAV.exe
  2⤵
  PID:6872
- C:\Windows\System\IxfjZJg.exe
  C:\Windows\System\IxfjZJg.exe
  2⤵
  PID:6908
- C:\Windows\System\cQZZaQj.exe
  C:\Windows\System\cQZZaQj.exe
  2⤵
  PID:6936
- C:\Windows\System\kXrRkKH.exe
  C:\Windows\System\kXrRkKH.exe
  2⤵
  PID:6960
- C:\Windows\System\ebLbwPu.exe
  C:\Windows\System\ebLbwPu.exe
  2⤵
  PID:6992
- C:\Windows\System\nFQkFAF.exe
  C:\Windows\System\nFQkFAF.exe
  2⤵
  PID:7016
- C:\Windows\System\acOdWUw.exe
  C:\Windows\System\acOdWUw.exe
  2⤵
  PID:7064
- C:\Windows\System\nrFXMxs.exe
  C:\Windows\System\nrFXMxs.exe
  2⤵
  PID:7108
- C:\Windows\System\mzELXAH.exe
  C:\Windows\System\mzELXAH.exe
  2⤵
  PID:7132
- C:\Windows\System\uLelEnP.exe
  C:\Windows\System\uLelEnP.exe
  2⤵
  PID:7160
- C:\Windows\System\ZGmkxPU.exe
  C:\Windows\System\ZGmkxPU.exe
  2⤵
  PID:6188
- C:\Windows\System\EFVDRpo.exe
  C:\Windows\System\EFVDRpo.exe
  2⤵
  PID:6260
- C:\Windows\System\XlgEalW.exe
  C:\Windows\System\XlgEalW.exe
  2⤵
  PID:6312
- C:\Windows\System\afNRNmc.exe
  C:\Windows\System\afNRNmc.exe
  2⤵
  PID:6380
- C:\Windows\System\FNPNIGq.exe
  C:\Windows\System\FNPNIGq.exe
  2⤵
  PID:6424
- C:\Windows\System\feZKDCo.exe
  C:\Windows\System\feZKDCo.exe
  2⤵
  PID:6452
- C:\Windows\System\lxbysYs.exe
  C:\Windows\System\lxbysYs.exe
  2⤵
  PID:6512
- C:\Windows\System\TPwHjMX.exe
  C:\Windows\System\TPwHjMX.exe
  2⤵
  PID:6596
- C:\Windows\System\iBVguQI.exe
  C:\Windows\System\iBVguQI.exe
  2⤵
  PID:6668
- C:\Windows\System\RRbwKuE.exe
  C:\Windows\System\RRbwKuE.exe
  2⤵
  PID:6744
- C:\Windows\System\fydqckJ.exe
  C:\Windows\System\fydqckJ.exe
  2⤵
  PID:6780
- C:\Windows\System\eUzFgMh.exe
  C:\Windows\System\eUzFgMh.exe
  2⤵
  PID:6868
- C:\Windows\System\fymPhDi.exe
  C:\Windows\System\fymPhDi.exe
  2⤵
  PID:6972
- C:\Windows\System\yJxzUeI.exe
  C:\Windows\System\yJxzUeI.exe
  2⤵
  PID:6928
- C:\Windows\System\PMlQrZh.exe
  C:\Windows\System\PMlQrZh.exe
  2⤵
  PID:7052
- C:\Windows\System\vKMQvcP.exe
  C:\Windows\System\vKMQvcP.exe
  2⤵
  PID:7096
- C:\Windows\System\uzejuiT.exe
  C:\Windows\System\uzejuiT.exe
  2⤵
  PID:6232
- C:\Windows\System\ZhzvuJV.exe
  C:\Windows\System\ZhzvuJV.exe
  2⤵
  PID:6320
- C:\Windows\System\nFtXoKN.exe
  C:\Windows\System\nFtXoKN.exe
  2⤵
  PID:6428
- C:\Windows\System\JJWdayT.exe
  C:\Windows\System\JJWdayT.exe
  2⤵
  PID:6636
- C:\Windows\System\UhkiXgT.exe
  C:\Windows\System\UhkiXgT.exe
  2⤵
  PID:6840
- C:\Windows\System\NFRFzZn.exe
  C:\Windows\System\NFRFzZn.exe
  2⤵
  PID:6988
- C:\Windows\System\PXAvRgq.exe
  C:\Windows\System\PXAvRgq.exe
  2⤵
  PID:7148
- C:\Windows\System\wJmoSHi.exe
  C:\Windows\System\wJmoSHi.exe
  2⤵
  PID:6568
- C:\Windows\System\VAiQKzS.exe
  C:\Windows\System\VAiQKzS.exe
  2⤵
  PID:7036
- C:\Windows\System\rXDseYC.exe
  C:\Windows\System\rXDseYC.exe
  2⤵
  PID:6924
- C:\Windows\System\awbBwBp.exe
  C:\Windows\System\awbBwBp.exe
  2⤵
  PID:7100
- C:\Windows\System\qvIUNLO.exe
  C:\Windows\System\qvIUNLO.exe
  2⤵
  PID:7188
- C:\Windows\System\ILXlNJF.exe
  C:\Windows\System\ILXlNJF.exe
  2⤵
  PID:7208
- C:\Windows\System\gnwsPNz.exe
  C:\Windows\System\gnwsPNz.exe
  2⤵
  PID:7232
- C:\Windows\System\cDTOgdb.exe
  C:\Windows\System\cDTOgdb.exe
  2⤵
  PID:7260
- C:\Windows\System\guoUMBY.exe
  C:\Windows\System\guoUMBY.exe
  2⤵
  PID:7308
- C:\Windows\System\PAtXTBn.exe
  C:\Windows\System\PAtXTBn.exe
  2⤵
  PID:7340
- C:\Windows\System\ZmMMjku.exe
  C:\Windows\System\ZmMMjku.exe
  2⤵
  PID:7360
- C:\Windows\System\elxuNzc.exe
  C:\Windows\System\elxuNzc.exe
  2⤵
  PID:7384
- C:\Windows\System\YNOHvJj.exe
  C:\Windows\System\YNOHvJj.exe
  2⤵
  PID:7428
- C:\Windows\System\cTtwYmb.exe
  C:\Windows\System\cTtwYmb.exe
  2⤵
  PID:7456
- C:\Windows\System\pxMrEXJ.exe
  C:\Windows\System\pxMrEXJ.exe
  2⤵
  PID:7480
- C:\Windows\System\YBtNilT.exe
  C:\Windows\System\YBtNilT.exe
  2⤵
  PID:7500
- C:\Windows\System\tJLmvHE.exe
  C:\Windows\System\tJLmvHE.exe
  2⤵
  PID:7528
- C:\Windows\System\GPDKfpP.exe
  C:\Windows\System\GPDKfpP.exe
  2⤵
  PID:7552
- C:\Windows\System\VfRsjug.exe
  C:\Windows\System\VfRsjug.exe
  2⤵
  PID:7572
- C:\Windows\System\NSuYXdr.exe
  C:\Windows\System\NSuYXdr.exe
  2⤵
  PID:7592
- C:\Windows\System\aHnivNW.exe
  C:\Windows\System\aHnivNW.exe
  2⤵
  PID:7620
- C:\Windows\System\iACLPcY.exe
  C:\Windows\System\iACLPcY.exe
  2⤵
  PID:7656
- C:\Windows\System\tDZzSXD.exe
  C:\Windows\System\tDZzSXD.exe
  2⤵
  PID:7680
- C:\Windows\System\susUNgH.exe
  C:\Windows\System\susUNgH.exe
  2⤵
  PID:7724
- C:\Windows\System\CXdiNov.exe
  C:\Windows\System\CXdiNov.exe
  2⤵
  PID:7752
- C:\Windows\System\xjolJCl.exe
  C:\Windows\System\xjolJCl.exe
  2⤵
  PID:7784
- C:\Windows\System\BgtJaGy.exe
  C:\Windows\System\BgtJaGy.exe
  2⤵
  PID:7808
- C:\Windows\System\YuTEsRD.exe
  C:\Windows\System\YuTEsRD.exe
  2⤵
  PID:7836
- C:\Windows\System\pqpePwq.exe
  C:\Windows\System\pqpePwq.exe
  2⤵
  PID:7868
- C:\Windows\System\TEnONdl.exe
  C:\Windows\System\TEnONdl.exe
  2⤵
  PID:7888
- C:\Windows\System\RSFfXxv.exe
  C:\Windows\System\RSFfXxv.exe
  2⤵
  PID:7920
- C:\Windows\System\JszjSre.exe
  C:\Windows\System\JszjSre.exe
  2⤵
  PID:7952
- C:\Windows\System\eyDcnAB.exe
  C:\Windows\System\eyDcnAB.exe
  2⤵
  PID:7968
- C:\Windows\System\QwotvZN.exe
  C:\Windows\System\QwotvZN.exe
  2⤵
  PID:7992
- C:\Windows\System\kWpxhpG.exe
  C:\Windows\System\kWpxhpG.exe
  2⤵
  PID:8040
- C:\Windows\System\ackZrFv.exe
  C:\Windows\System\ackZrFv.exe
  2⤵
  PID:8064
- C:\Windows\System\pIHKHdA.exe
  C:\Windows\System\pIHKHdA.exe
  2⤵
  PID:8104
- C:\Windows\System\LgzLxIX.exe
  C:\Windows\System\LgzLxIX.exe
  2⤵
  PID:8132
- C:\Windows\System\NYUSbfx.exe
  C:\Windows\System\NYUSbfx.exe
  2⤵
  PID:8148
- C:\Windows\System\xMiIgPh.exe
  C:\Windows\System\xMiIgPh.exe
  2⤵
  PID:8176
- C:\Windows\System\gVMCpbn.exe
  C:\Windows\System\gVMCpbn.exe
  2⤵
  PID:6796
- C:\Windows\System\pFKKAHd.exe
  C:\Windows\System\pFKKAHd.exe
  2⤵
  PID:7204
- C:\Windows\System\PaAOCeU.exe
  C:\Windows\System\PaAOCeU.exe
  2⤵
  PID:7280
- C:\Windows\System\nkVDBdi.exe
  C:\Windows\System\nkVDBdi.exe
  2⤵
  PID:7328
- C:\Windows\System\OKwcXUM.exe
  C:\Windows\System\OKwcXUM.exe
  2⤵
  PID:7472
- C:\Windows\System\sLonbwz.exe
  C:\Windows\System\sLonbwz.exe
  2⤵
  PID:7496
- C:\Windows\System\PAndhZn.exe
  C:\Windows\System\PAndhZn.exe
  2⤵
  PID:7564
- C:\Windows\System\RposXbU.exe
  C:\Windows\System\RposXbU.exe
  2⤵
  PID:7612
- C:\Windows\System\fBrTGAc.exe
  C:\Windows\System\fBrTGAc.exe
  2⤵
  PID:7672
- C:\Windows\System\GkpiGYl.exe
  C:\Windows\System\GkpiGYl.exe
  2⤵
  PID:7740
- C:\Windows\System\WysMsfY.exe
  C:\Windows\System\WysMsfY.exe
  2⤵
  PID:7816
- C:\Windows\System\JCBiPuS.exe
  C:\Windows\System\JCBiPuS.exe
  2⤵
  PID:7820
- C:\Windows\System\EfaqpWj.exe
  C:\Windows\System\EfaqpWj.exe
  2⤵
  PID:7896
- C:\Windows\System\xOhlQUg.exe
  C:\Windows\System\xOhlQUg.exe
  2⤵
  PID:7940
- C:\Windows\System\CvHZEVq.exe
  C:\Windows\System\CvHZEVq.exe
  2⤵
  PID:8048
- C:\Windows\System\fOFxYRS.exe
  C:\Windows\System\fOFxYRS.exe
  2⤵
  PID:8164
- C:\Windows\System\dmaWiKK.exe
  C:\Windows\System\dmaWiKK.exe
  2⤵
  PID:7180
- C:\Windows\System\mwOSKoX.exe
  C:\Windows\System\mwOSKoX.exe
  2⤵
  PID:7284
- C:\Windows\System\FTYyPXJ.exe
  C:\Windows\System\FTYyPXJ.exe
  2⤵
  PID:7492
- C:\Windows\System\xoNihvH.exe
  C:\Windows\System\xoNihvH.exe
  2⤵
  PID:7568
- C:\Windows\System\zRmgcwG.exe
  C:\Windows\System\zRmgcwG.exe
  2⤵
  PID:7720
- C:\Windows\System\GPaDAyQ.exe
  C:\Windows\System\GPaDAyQ.exe
  2⤵
  PID:7804
- C:\Windows\System\aidjVQG.exe
  C:\Windows\System\aidjVQG.exe
  2⤵
  PID:8016
- C:\Windows\System\FlWOINb.exe
  C:\Windows\System\FlWOINb.exe
  2⤵
  PID:8172
- C:\Windows\System\VNmOkBP.exe
  C:\Windows\System\VNmOkBP.exe
  2⤵
  PID:7316
- C:\Windows\System\UTxRvfc.exe
  C:\Windows\System\UTxRvfc.exe
  2⤵
  PID:8160
- C:\Windows\System\QIDgaCI.exe
  C:\Windows\System\QIDgaCI.exe
  2⤵
  PID:7588
- C:\Windows\System\vGyiZpB.exe
  C:\Windows\System\vGyiZpB.exe
  2⤵
  PID:6704
- C:\Windows\System\agZqvzN.exe
  C:\Windows\System\agZqvzN.exe
  2⤵
  PID:8208
- C:\Windows\System\BXWhqBB.exe
  C:\Windows\System\BXWhqBB.exe
  2⤵
  PID:8236
- C:\Windows\System\tLvpxrh.exe
  C:\Windows\System\tLvpxrh.exe
  2⤵
  PID:8276
- C:\Windows\System\nERJyFv.exe
  C:\Windows\System\nERJyFv.exe
  2⤵
  PID:8304
- C:\Windows\System\LofMHyf.exe
  C:\Windows\System\LofMHyf.exe
  2⤵
  PID:8332
- C:\Windows\System\sQXgjfP.exe
  C:\Windows\System\sQXgjfP.exe
  2⤵
  PID:8348
- C:\Windows\System\TwXaBjP.exe
  C:\Windows\System\TwXaBjP.exe
  2⤵
  PID:8372
- C:\Windows\System\JeGSNjM.exe
  C:\Windows\System\JeGSNjM.exe
  2⤵
  PID:8396
- C:\Windows\System\BfmQHnH.exe
  C:\Windows\System\BfmQHnH.exe
  2⤵
  PID:8424
- C:\Windows\System\NDlqivk.exe
  C:\Windows\System\NDlqivk.exe
  2⤵
  PID:8448
- C:\Windows\System\KcwSIXP.exe
  C:\Windows\System\KcwSIXP.exe
  2⤵
  PID:8492
- C:\Windows\System\yqgTbnK.exe
  C:\Windows\System\yqgTbnK.exe
  2⤵
  PID:8512
- C:\Windows\System\omaYDWe.exe
  C:\Windows\System\omaYDWe.exe
  2⤵
  PID:8544
- C:\Windows\System\VxDdqdB.exe
  C:\Windows\System\VxDdqdB.exe
  2⤵
  PID:8572
- C:\Windows\System\NqQpwGr.exe
  C:\Windows\System\NqQpwGr.exe
  2⤵
  PID:8588
- C:\Windows\System\IXLoXtj.exe
  C:\Windows\System\IXLoXtj.exe
  2⤵
  PID:8624
- C:\Windows\System\zEhLDZE.exe
  C:\Windows\System\zEhLDZE.exe
  2⤵
  PID:8648
- C:\Windows\System\oxZXEtr.exe
  C:\Windows\System\oxZXEtr.exe
  2⤵
  PID:8688
- C:\Windows\System\UbrrVSi.exe
  C:\Windows\System\UbrrVSi.exe
  2⤵
  PID:8716
- C:\Windows\System\VMbXjKv.exe
  C:\Windows\System\VMbXjKv.exe
  2⤵
  PID:8752
- C:\Windows\System\hTkXeTg.exe
  C:\Windows\System\hTkXeTg.exe
  2⤵
  PID:8768
- C:\Windows\System\FEyjciT.exe
  C:\Windows\System\FEyjciT.exe
  2⤵
  PID:8812
- C:\Windows\System\xarPYJy.exe
  C:\Windows\System\xarPYJy.exe
  2⤵
  PID:8828
- C:\Windows\System\ujDkgud.exe
  C:\Windows\System\ujDkgud.exe
  2⤵
  PID:8848
- C:\Windows\System\rKmEabb.exe
  C:\Windows\System\rKmEabb.exe
  2⤵
  PID:8884
- C:\Windows\System\sskbZLF.exe
  C:\Windows\System\sskbZLF.exe
  2⤵
  PID:8900
- C:\Windows\System\wMKgTSZ.exe
  C:\Windows\System\wMKgTSZ.exe
  2⤵
  PID:8924
- C:\Windows\System\QYorkHa.exe
  C:\Windows\System\QYorkHa.exe
  2⤵
  PID:8956
- C:\Windows\System\WInfOye.exe
  C:\Windows\System\WInfOye.exe
  2⤵
  PID:8988
- C:\Windows\System\ZKDIzqb.exe
  C:\Windows\System\ZKDIzqb.exe
  2⤵
  PID:9012
- C:\Windows\System\zNlJwiw.exe
  C:\Windows\System\zNlJwiw.exe
  2⤵
  PID:9036
- C:\Windows\System\ZKNBCba.exe
  C:\Windows\System\ZKNBCba.exe
  2⤵
  PID:9064
- C:\Windows\System\bvbEQBT.exe
  C:\Windows\System\bvbEQBT.exe
  2⤵
  PID:9088
- C:\Windows\System\kTqZDgo.exe
  C:\Windows\System\kTqZDgo.exe
  2⤵
  PID:9116
- C:\Windows\System\IHDQuhH.exe
  C:\Windows\System\IHDQuhH.exe
  2⤵
  PID:9140
- C:\Windows\System\FwBeLQX.exe
  C:\Windows\System\FwBeLQX.exe
  2⤵
  PID:9168
- C:\Windows\System\pYgGCWV.exe
  C:\Windows\System\pYgGCWV.exe
  2⤵
  PID:8196
- C:\Windows\System\fBhLyuk.exe
  C:\Windows\System\fBhLyuk.exe
  2⤵
  PID:8268
- C:\Windows\System\KTdGJVP.exe
  C:\Windows\System\KTdGJVP.exe
  2⤵
  PID:8320
- C:\Windows\System\NYJBFxj.exe
  C:\Windows\System\NYJBFxj.exe
  2⤵
  PID:8380
- C:\Windows\System\QoZXEnG.exe
  C:\Windows\System\QoZXEnG.exe
  2⤵
  PID:8472
- C:\Windows\System\flvBkIk.exe
  C:\Windows\System\flvBkIk.exe
  2⤵
  PID:8480
- C:\Windows\System\hsomgvD.exe
  C:\Windows\System\hsomgvD.exe
  2⤵
  PID:8596
- C:\Windows\System\IJBfXIT.exe
  C:\Windows\System\IJBfXIT.exe
  2⤵
  PID:8620
- C:\Windows\System\doxFOfb.exe
  C:\Windows\System\doxFOfb.exe
  2⤵
  PID:8676
- C:\Windows\System\MogeFrL.exe
  C:\Windows\System\MogeFrL.exe
  2⤵
  PID:8728
- C:\Windows\System\wPpqHOu.exe
  C:\Windows\System\wPpqHOu.exe
  2⤵
  PID:8784
- C:\Windows\System\JsHyZEx.exe
  C:\Windows\System\JsHyZEx.exe
  2⤵
  PID:8872
- C:\Windows\System\GKCbRGI.exe
  C:\Windows\System\GKCbRGI.exe
  2⤵
  PID:8984
- C:\Windows\System\DLZrGyi.exe
  C:\Windows\System\DLZrGyi.exe
  2⤵
  PID:9056
- C:\Windows\System\YuITvPC.exe
  C:\Windows\System\YuITvPC.exe
  2⤵
  PID:9048
- C:\Windows\System\okRHPYg.exe
  C:\Windows\System\okRHPYg.exe
  2⤵
  PID:9128
- C:\Windows\System\dfiaYLG.exe
  C:\Windows\System\dfiaYLG.exe
  2⤵
  PID:8256
- C:\Windows\System\bRZTGBI.exe
  C:\Windows\System\bRZTGBI.exe
  2⤵
  PID:8408
- C:\Windows\System\JhOGiEL.exe
  C:\Windows\System\JhOGiEL.exe
  2⤵
  PID:8528
- C:\Windows\System\GgcfVDp.exe
  C:\Windows\System\GgcfVDp.exe
  2⤵
  PID:7780
- C:\Windows\System\tsIoIBo.exe
  C:\Windows\System\tsIoIBo.exe
  2⤵
  PID:8892
- C:\Windows\System\ZhxZwvP.exe
  C:\Windows\System\ZhxZwvP.exe
  2⤵
  PID:8800
- C:\Windows\System\ihkfwbb.exe
  C:\Windows\System\ihkfwbb.exe
  2⤵
  PID:9044
- C:\Windows\System\CrGqJAP.exe
  C:\Windows\System\CrGqJAP.exe
  2⤵
  PID:9164
- C:\Windows\System\IvVirvB.exe
  C:\Windows\System\IvVirvB.exe
  2⤵
  PID:8500
- C:\Windows\System\UAHdoEz.exe
  C:\Windows\System\UAHdoEz.exe
  2⤵
  PID:9108
- C:\Windows\System\ixVIwRi.exe
  C:\Windows\System\ixVIwRi.exe
  2⤵
  PID:8996
- C:\Windows\System\blYiyVm.exe
  C:\Windows\System\blYiyVm.exe
  2⤵
  PID:9224
- C:\Windows\System\jBsxbta.exe
  C:\Windows\System\jBsxbta.exe
  2⤵
  PID:9240
- C:\Windows\System\WWpKBXs.exe
  C:\Windows\System\WWpKBXs.exe
  2⤵
  PID:9264
- C:\Windows\System\jlWXMNs.exe
  C:\Windows\System\jlWXMNs.exe
  2⤵
  PID:9296
- C:\Windows\System\ugYhWvq.exe
  C:\Windows\System\ugYhWvq.exe
  2⤵
  PID:9316
- C:\Windows\System\ldBbqnU.exe
  C:\Windows\System\ldBbqnU.exe
  2⤵
  PID:9364
- C:\Windows\System\PpEAogo.exe
  C:\Windows\System\PpEAogo.exe
  2⤵
  PID:9392
- C:\Windows\System\mspAuSn.exe
  C:\Windows\System\mspAuSn.exe
  2⤵
  PID:9408
- C:\Windows\System\rNaZdzG.exe
  C:\Windows\System\rNaZdzG.exe
  2⤵
  PID:9424
- C:\Windows\System\WdPWgDL.exe
  C:\Windows\System\WdPWgDL.exe
  2⤵
  PID:9456
- C:\Windows\System\mXCZmKg.exe
  C:\Windows\System\mXCZmKg.exe
  2⤵
  PID:9488
- C:\Windows\System\pcffsEB.exe
  C:\Windows\System\pcffsEB.exe
  2⤵
  PID:9516
- C:\Windows\System\csjGLuw.exe
  C:\Windows\System\csjGLuw.exe
  2⤵
  PID:9548
- C:\Windows\System\SMcsKtx.exe
  C:\Windows\System\SMcsKtx.exe
  2⤵
  PID:9588
- C:\Windows\System\SgGnSIo.exe
  C:\Windows\System\SgGnSIo.exe
  2⤵
  PID:9608
- C:\Windows\System\kVUzeoS.exe
  C:\Windows\System\kVUzeoS.exe
  2⤵
  PID:9636
- C:\Windows\System\VCzPwpU.exe
  C:\Windows\System\VCzPwpU.exe
  2⤵
  PID:9664
- C:\Windows\System\PMQEawY.exe
  C:\Windows\System\PMQEawY.exe
  2⤵
  PID:9688
- C:\Windows\System\CVKDaUS.exe
  C:\Windows\System\CVKDaUS.exe
  2⤵
  PID:9720
- C:\Windows\System\xpslhdO.exe
  C:\Windows\System\xpslhdO.exe
  2⤵
  PID:9736
- C:\Windows\System\lhIAzBJ.exe
  C:\Windows\System\lhIAzBJ.exe
  2⤵
  PID:9764
- C:\Windows\System\CJljuar.exe
  C:\Windows\System\CJljuar.exe
  2⤵
  PID:9792
- C:\Windows\System\gLSHCBb.exe
  C:\Windows\System\gLSHCBb.exe
  2⤵
  PID:9820
- C:\Windows\System\JIFxQei.exe
  C:\Windows\System\JIFxQei.exe
  2⤵
  PID:9844
- C:\Windows\System\SLNPVbU.exe
  C:\Windows\System\SLNPVbU.exe
  2⤵
  PID:9884
- C:\Windows\System\RVJOXlK.exe
  C:\Windows\System\RVJOXlK.exe
  2⤵
  PID:9920
- C:\Windows\System\VQdZDek.exe
  C:\Windows\System\VQdZDek.exe
  2⤵
  PID:9960
- C:\Windows\System\BcTMHew.exe
  C:\Windows\System\BcTMHew.exe
  2⤵
  PID:9976
- C:\Windows\System\QwmvwNJ.exe
  C:\Windows\System\QwmvwNJ.exe
  2⤵
  PID:10016
- C:\Windows\System\TJZowro.exe
  C:\Windows\System\TJZowro.exe
  2⤵
  PID:10044
- C:\Windows\System\ZuFJMCL.exe
  C:\Windows\System\ZuFJMCL.exe
  2⤵
  PID:10072
- C:\Windows\System\jEhilgR.exe
  C:\Windows\System\jEhilgR.exe
  2⤵
  PID:10088
- C:\Windows\System\efhUFpp.exe
  C:\Windows\System\efhUFpp.exe
  2⤵
  PID:10104
- C:\Windows\System\BZEjTJM.exe
  C:\Windows\System\BZEjTJM.exe
  2⤵
  PID:10128
- C:\Windows\System\FKugTfZ.exe
  C:\Windows\System\FKugTfZ.exe
  2⤵
  PID:10148
- C:\Windows\System\akEIYvq.exe
  C:\Windows\System\akEIYvq.exe
  2⤵
  PID:10168
- C:\Windows\System\kQRIQXD.exe
  C:\Windows\System\kQRIQXD.exe
  2⤵
  PID:10188
- C:\Windows\System\wGcYXNo.exe
  C:\Windows\System\wGcYXNo.exe
  2⤵
  PID:10208
- C:\Windows\System\LwcaZVQ.exe
  C:\Windows\System\LwcaZVQ.exe
  2⤵
  PID:10232
- C:\Windows\System\dIqXbmk.exe
  C:\Windows\System\dIqXbmk.exe
  2⤵
  PID:9236
- C:\Windows\System\pilFxAG.exe
  C:\Windows\System\pilFxAG.exe
  2⤵
  PID:9280
- C:\Windows\System\hCqcvTH.exe
  C:\Windows\System\hCqcvTH.exe
  2⤵
  PID:9340
- C:\Windows\System\KOHJriY.exe
  C:\Windows\System\KOHJriY.exe
  2⤵
  PID:9436
- C:\Windows\System\lNsjONs.exe
  C:\Windows\System\lNsjONs.exe
  2⤵
  PID:9528
- C:\Windows\System\AYrqGGB.exe
  C:\Windows\System\AYrqGGB.exe
  2⤵
  PID:9624
- C:\Windows\System\BhLXJxm.exe
  C:\Windows\System\BhLXJxm.exe
  2⤵
  PID:9732
- C:\Windows\System\EWrBdru.exe
  C:\Windows\System\EWrBdru.exe
  2⤵
  PID:9812
- C:\Windows\System\ijEANHA.exe
  C:\Windows\System\ijEANHA.exe
  2⤵
  PID:9880
- C:\Windows\System\PotPcSx.exe
  C:\Windows\System\PotPcSx.exe
  2⤵
  PID:9972
- C:\Windows\System\xEbJuHI.exe
  C:\Windows\System\xEbJuHI.exe
  2⤵
  PID:10040
- C:\Windows\System\FKbShSC.exe
  C:\Windows\System\FKbShSC.exe
  2⤵
  PID:10144
- C:\Windows\System\MPtbXuW.exe
  C:\Windows\System\MPtbXuW.exe
  2⤵
  PID:10140
- C:\Windows\System\ktKSrwE.exe
  C:\Windows\System\ktKSrwE.exe
  2⤵
  PID:10220
- C:\Windows\System\jVStXsz.exe
  C:\Windows\System\jVStXsz.exe
  2⤵
  PID:9232
- C:\Windows\System\TBbTnSG.exe
  C:\Windows\System\TBbTnSG.exe
  2⤵
  PID:9384
- C:\Windows\System\FSxzMKE.exe
  C:\Windows\System\FSxzMKE.exe
  2⤵
  PID:9476
- C:\Windows\System\xeKLCAp.exe
  C:\Windows\System\xeKLCAp.exe
  2⤵
  PID:9728
- C:\Windows\System\rTHoHLB.exe
  C:\Windows\System\rTHoHLB.exe
  2⤵
  PID:9788
- C:\Windows\System\YqprVVS.exe
  C:\Windows\System\YqprVVS.exe
  2⤵
  PID:9876
- C:\Windows\System\sxSKihE.exe
  C:\Windows\System\sxSKihE.exe
  2⤵
  PID:8672
- C:\Windows\System\ssumZJR.exe
  C:\Windows\System\ssumZJR.exe
  2⤵
  PID:9628
- C:\Windows\System\IWHFuIU.exe
  C:\Windows\System\IWHFuIU.exe
  2⤵
  PID:9568
- C:\Windows\System\PLsgZgQ.exe
  C:\Windows\System\PLsgZgQ.exe
  2⤵
  PID:9944
- C:\Windows\System\wdQVcuK.exe
  C:\Windows\System\wdQVcuK.exe
  2⤵
  PID:9684
- C:\Windows\System\xOSEzQc.exe
  C:\Windows\System\xOSEzQc.exe
  2⤵
  PID:10268
- C:\Windows\System\XlrgtZD.exe
  C:\Windows\System\XlrgtZD.exe
  2⤵
  PID:10296
- C:\Windows\System\DQxDySf.exe
  C:\Windows\System\DQxDySf.exe
  2⤵
  PID:10316
- C:\Windows\System\AoLhXuT.exe
  C:\Windows\System\AoLhXuT.exe
  2⤵
  PID:10344
- C:\Windows\System\Cglelbg.exe
  C:\Windows\System\Cglelbg.exe
  2⤵
  PID:10388
- C:\Windows\System\dDOMlcl.exe
  C:\Windows\System\dDOMlcl.exe
  2⤵
  PID:10408
- C:\Windows\System\soALNxz.exe
  C:\Windows\System\soALNxz.exe
  2⤵
  PID:10428
- C:\Windows\System\tlvrhcC.exe
  C:\Windows\System\tlvrhcC.exe
  2⤵
  PID:10460
- C:\Windows\System\yWJvEaR.exe
  C:\Windows\System\yWJvEaR.exe
  2⤵
  PID:10492
- C:\Windows\System\vnOFoQe.exe
  C:\Windows\System\vnOFoQe.exe
  2⤵
  PID:10512
- C:\Windows\System\nbJUUjL.exe
  C:\Windows\System\nbJUUjL.exe
  2⤵
  PID:10544
- C:\Windows\System\HyFilwZ.exe
  C:\Windows\System\HyFilwZ.exe
  2⤵
  PID:10612
- C:\Windows\System\VFQOBnm.exe
  C:\Windows\System\VFQOBnm.exe
  2⤵
  PID:10632
- C:\Windows\System\BXpuSrS.exe
  C:\Windows\System\BXpuSrS.exe
  2⤵
  PID:10648
- C:\Windows\System\RJknqXj.exe
  C:\Windows\System\RJknqXj.exe
  2⤵
  PID:10672
- C:\Windows\System\oLFNTDb.exe
  C:\Windows\System\oLFNTDb.exe
  2⤵
  PID:10688
- C:\Windows\System\UiSoREy.exe
  C:\Windows\System\UiSoREy.exe
  2⤵
  PID:10716
- C:\Windows\System\HkHHCAg.exe
  C:\Windows\System\HkHHCAg.exe
  2⤵
  PID:10752
- C:\Windows\System\QYgdbJY.exe
  C:\Windows\System\QYgdbJY.exe
  2⤵
  PID:10780
- C:\Windows\System\gdkTVPD.exe
  C:\Windows\System\gdkTVPD.exe
  2⤵
  PID:10804
- C:\Windows\System\FimBRKj.exe
  C:\Windows\System\FimBRKj.exe
  2⤵
  PID:10836
- C:\Windows\System\FwDpXhy.exe
  C:\Windows\System\FwDpXhy.exe
  2⤵
  PID:10860
- C:\Windows\System\ZzuTxHf.exe
  C:\Windows\System\ZzuTxHf.exe
  2⤵
  PID:10888
- C:\Windows\System\pdYQuFV.exe
  C:\Windows\System\pdYQuFV.exe
  2⤵
  PID:10920
- C:\Windows\System\fYnsqbo.exe
  C:\Windows\System\fYnsqbo.exe
  2⤵
  PID:10952
- C:\Windows\System\HHgATYJ.exe
  C:\Windows\System\HHgATYJ.exe
  2⤵
  PID:10972
- C:\Windows\System\avYQUvO.exe
  C:\Windows\System\avYQUvO.exe
  2⤵
  PID:10996
- C:\Windows\System\PlGmIyA.exe
  C:\Windows\System\PlGmIyA.exe
  2⤵
  PID:11024
- C:\Windows\System\QDWrjIv.exe
  C:\Windows\System\QDWrjIv.exe
  2⤵
  PID:11080
- C:\Windows\System\fjLtrxo.exe
  C:\Windows\System\fjLtrxo.exe
  2⤵
  PID:11120
- C:\Windows\System\fPBpVmM.exe
  C:\Windows\System\fPBpVmM.exe
  2⤵
  PID:11140
- C:\Windows\System\PaiPwgh.exe
  C:\Windows\System\PaiPwgh.exe
  2⤵
  PID:11164
- C:\Windows\System\VxbicWu.exe
  C:\Windows\System\VxbicWu.exe
  2⤵
  PID:11204
- C:\Windows\System\wbuTYgk.exe
  C:\Windows\System\wbuTYgk.exe
  2⤵
  PID:11232
- C:\Windows\System\HRjXVjd.exe
  C:\Windows\System\HRjXVjd.exe
  2⤵
  PID:11248
- C:\Windows\System\ymFPXwP.exe
  C:\Windows\System\ymFPXwP.exe
  2⤵
  PID:9312
- C:\Windows\System\UAevgbf.exe
  C:\Windows\System\UAevgbf.exe
  2⤵
  PID:10292
- C:\Windows\System\lwzFYAY.exe
  C:\Windows\System\lwzFYAY.exe
  2⤵
  PID:9524
- C:\Windows\System\pLlEfLB.exe
  C:\Windows\System\pLlEfLB.exe
  2⤵
  PID:10380
- C:\Windows\System\YkVUPMV.exe
  C:\Windows\System\YkVUPMV.exe
  2⤵
  PID:10472
- C:\Windows\System\EBLIozh.exe
  C:\Windows\System\EBLIozh.exe
  2⤵
  PID:10568
- C:\Windows\System\aUpIMyQ.exe
  C:\Windows\System\aUpIMyQ.exe
  2⤵
  PID:10620
- C:\Windows\System\RwMMIdH.exe
  C:\Windows\System\RwMMIdH.exe
  2⤵
  PID:10700
- C:\Windows\System\DTEypLb.exe
  C:\Windows\System\DTEypLb.exe
  2⤵
  PID:10664
- C:\Windows\System\cDPOzCe.exe
  C:\Windows\System\cDPOzCe.exe
  2⤵
  PID:10712
- C:\Windows\System\YPnzFvz.exe
  C:\Windows\System\YPnzFvz.exe
  2⤵
  PID:10796
- C:\Windows\System\SmleJBz.exe
  C:\Windows\System\SmleJBz.exe
  2⤵
  PID:10936
- C:\Windows\System\gDTScZV.exe
  C:\Windows\System\gDTScZV.exe
  2⤵
  PID:10960
- C:\Windows\System\gFBsIby.exe
  C:\Windows\System\gFBsIby.exe
  2⤵
  PID:10988
- C:\Windows\System\bBZASmv.exe
  C:\Windows\System\bBZASmv.exe
  2⤵
  PID:11112
- C:\Windows\System\UGVKHge.exe
  C:\Windows\System\UGVKHge.exe
  2⤵
  PID:11196
- C:\Windows\System\KWtFTIU.exe
  C:\Windows\System\KWtFTIU.exe
  2⤵
  PID:11244
- C:\Windows\System\pBoxuef.exe
  C:\Windows\System\pBoxuef.exe
  2⤵
  PID:10328
- C:\Windows\System\cWEiiop.exe
  C:\Windows\System\cWEiiop.exe
  2⤵
  PID:10508
- C:\Windows\System\pKMeoiS.exe
  C:\Windows\System\pKMeoiS.exe
  2⤵
  PID:10608
- C:\Windows\System\pTRMPRJ.exe
  C:\Windows\System\pTRMPRJ.exe
  2⤵
  PID:10644
- C:\Windows\System\GOQGrsK.exe
  C:\Windows\System\GOQGrsK.exe
  2⤵
  PID:10856
- C:\Windows\System\qRPxHLC.exe
  C:\Windows\System\qRPxHLC.exe
  2⤵
  PID:10904
- C:\Windows\System\PHeiNQI.exe
  C:\Windows\System\PHeiNQI.exe
  2⤵
  PID:11136
- C:\Windows\System\XDvopun.exe
  C:\Windows\System\XDvopun.exe
  2⤵
  PID:9968
- C:\Windows\System\ylIPKfX.exe
  C:\Windows\System\ylIPKfX.exe
  2⤵
  PID:10728
- C:\Windows\System\fvlzYVI.exe
  C:\Windows\System\fvlzYVI.exe
  2⤵
  PID:10792
- C:\Windows\System\MjhVmTB.exe
  C:\Windows\System\MjhVmTB.exe
  2⤵
  PID:11020
- C:\Windows\System\NNkfaZS.exe
  C:\Windows\System\NNkfaZS.exe
  2⤵
  PID:10980
- C:\Windows\System\FRiWcfH.exe
  C:\Windows\System\FRiWcfH.exe
  2⤵
  PID:11284
- C:\Windows\System\osUgZWL.exe
  C:\Windows\System\osUgZWL.exe
  2⤵
  PID:11332
- C:\Windows\System\QHfdFDU.exe
  C:\Windows\System\QHfdFDU.exe
  2⤵
  PID:11352
- C:\Windows\System\nhLJVDw.exe
  C:\Windows\System\nhLJVDw.exe
  2⤵
  PID:11376
- C:\Windows\System\tkHENsV.exe
  C:\Windows\System\tkHENsV.exe
  2⤵
  PID:11404
- C:\Windows\System\zSzwEcD.exe
  C:\Windows\System\zSzwEcD.exe
  2⤵
  PID:11436
- C:\Windows\System\vhbcRlK.exe
  C:\Windows\System\vhbcRlK.exe
  2⤵
  PID:11460
- C:\Windows\System\ctSLqrF.exe
  C:\Windows\System\ctSLqrF.exe
  2⤵
  PID:11484
- C:\Windows\System\bEzDERp.exe
  C:\Windows\System\bEzDERp.exe
  2⤵
  PID:11504
- C:\Windows\System\xYVQbDp.exe
  C:\Windows\System\xYVQbDp.exe
  2⤵
  PID:11528
- C:\Windows\System\QyIIkNm.exe
  C:\Windows\System\QyIIkNm.exe
  2⤵
  PID:11560
- C:\Windows\System\yduliPK.exe
  C:\Windows\System\yduliPK.exe
  2⤵
  PID:11588
- C:\Windows\System\XeXWJSX.exe
  C:\Windows\System\XeXWJSX.exe
  2⤵
  PID:11612
- C:\Windows\System\mgVPWRP.exe
  C:\Windows\System\mgVPWRP.exe
  2⤵
  PID:11640
- C:\Windows\System\DLNGWZQ.exe
  C:\Windows\System\DLNGWZQ.exe
  2⤵
  PID:11672
- C:\Windows\System\MxzACsw.exe
  C:\Windows\System\MxzACsw.exe
  2⤵
  PID:11692
- C:\Windows\System\KwkozTG.exe
  C:\Windows\System\KwkozTG.exe
  2⤵
  PID:11728
- C:\Windows\System\wEsOpRP.exe
  C:\Windows\System\wEsOpRP.exe
  2⤵
  PID:11756
- C:\Windows\System\fbqrdQG.exe
  C:\Windows\System\fbqrdQG.exe
  2⤵
  PID:11776
- C:\Windows\System\JCXaFdp.exe
  C:\Windows\System\JCXaFdp.exe
  2⤵
  PID:11796
- C:\Windows\System\qvVqpww.exe
  C:\Windows\System\qvVqpww.exe
  2⤵
  PID:11828
- C:\Windows\System\zRzygPD.exe
  C:\Windows\System\zRzygPD.exe
  2⤵
  PID:11872
- C:\Windows\System\gVtwEiB.exe
  C:\Windows\System\gVtwEiB.exe
  2⤵
  PID:11920
- C:\Windows\System\xudsiuQ.exe
  C:\Windows\System\xudsiuQ.exe
  2⤵
  PID:11944
- C:\Windows\System\POMQzSm.exe
  C:\Windows\System\POMQzSm.exe
  2⤵
  PID:11968
- C:\Windows\System\mixgIgf.exe
  C:\Windows\System\mixgIgf.exe
  2⤵
  PID:11992
- C:\Windows\System\zqMDfxL.exe
  C:\Windows\System\zqMDfxL.exe
  2⤵
  PID:12012
- C:\Windows\System\YAlrRdx.exe
  C:\Windows\System\YAlrRdx.exe
  2⤵
  PID:12036
- C:\Windows\System\EeSBXVV.exe
  C:\Windows\System\EeSBXVV.exe
  2⤵
  PID:12060
- C:\Windows\System\lOUvyux.exe
  C:\Windows\System\lOUvyux.exe
  2⤵
  PID:12104
- C:\Windows\System\zKNjeZT.exe
  C:\Windows\System\zKNjeZT.exe
  2⤵
  PID:12128
- C:\Windows\System\XzVhOVh.exe
  C:\Windows\System\XzVhOVh.exe
  2⤵
  PID:12148
- C:\Windows\System\uMVznfo.exe
  C:\Windows\System\uMVznfo.exe
  2⤵
  PID:12184
- C:\Windows\System\LItPHsg.exe
  C:\Windows\System\LItPHsg.exe
  2⤵
  PID:12212
- C:\Windows\System\cjdLdZY.exe
  C:\Windows\System\cjdLdZY.exe
  2⤵
  PID:12256
- C:\Windows\System\UmxYiAo.exe
  C:\Windows\System\UmxYiAo.exe
  2⤵
  PID:12284
- C:\Windows\System\TIgPJVF.exe
  C:\Windows\System\TIgPJVF.exe
  2⤵
  PID:11272
- C:\Windows\System\QhZUZGh.exe
  C:\Windows\System\QhZUZGh.exe
  2⤵
  PID:11308
- C:\Windows\System\OgWVWuj.exe
  C:\Windows\System\OgWVWuj.exe
  2⤵
  PID:11364
- C:\Windows\System\TEpWpIJ.exe
  C:\Windows\System\TEpWpIJ.exe
  2⤵
  PID:11472
- C:\Windows\System\giJFUiW.exe
  C:\Windows\System\giJFUiW.exe
  2⤵
  PID:11520
- C:\Windows\System\wRFSndY.exe
  C:\Windows\System\wRFSndY.exe
  2⤵
  PID:11584
- C:\Windows\System\YIOBPmB.exe
  C:\Windows\System\YIOBPmB.exe
  2⤵
  PID:11604
- C:\Windows\System\fsXvHoK.exe
  C:\Windows\System\fsXvHoK.exe
  2⤵
  PID:11704
- C:\Windows\System\MqQmGPr.exe
  C:\Windows\System\MqQmGPr.exe
  2⤵
  PID:11792
- C:\Windows\System\wjfhBpd.exe
  C:\Windows\System\wjfhBpd.exe
  2⤵
  PID:11816
- C:\Windows\System\vzNKVUo.exe
  C:\Windows\System\vzNKVUo.exe
  2⤵
  PID:11936
- C:\Windows\System\KfotCZV.exe
  C:\Windows\System\KfotCZV.exe
  2⤵
  PID:12008
- C:\Windows\System\aAdXTgs.exe
  C:\Windows\System\aAdXTgs.exe
  2⤵
  PID:12084
- C:\Windows\System\CjofPeW.exe
  C:\Windows\System\CjofPeW.exe
  2⤵
  PID:12120
- C:\Windows\System\GFYurbA.exe
  C:\Windows\System\GFYurbA.exe
  2⤵
  PID:12196
- C:\Windows\System\CKbiDZb.exe
  C:\Windows\System\CKbiDZb.exe
  2⤵
  PID:12232
- C:\Windows\System\qaAZzxe.exe
  C:\Windows\System\qaAZzxe.exe
  2⤵
  PID:10684
- C:\Windows\System\aoeCFwM.exe
  C:\Windows\System\aoeCFwM.exe
  2⤵
  PID:11392
- C:\Windows\System\hRlXsWC.exe
  C:\Windows\System\hRlXsWC.exe
  2⤵
  PID:11516
- C:\Windows\System\ZUqHgfd.exe
  C:\Windows\System\ZUqHgfd.exe
  2⤵
  PID:11708
- C:\Windows\System\JMsHUjc.exe
  C:\Windows\System\JMsHUjc.exe
  2⤵
  PID:11788
- C:\Windows\System\cDdDuId.exe
  C:\Windows\System\cDdDuId.exe
  2⤵
  PID:11984
- C:\Windows\System\fgAmWpZ.exe
  C:\Windows\System\fgAmWpZ.exe
  2⤵
  PID:12160
- C:\Windows\System\RjcUQnS.exe
  C:\Windows\System\RjcUQnS.exe
  2⤵
  PID:11548
- C:\Windows\System\gtXBWDk.exe
  C:\Windows\System\gtXBWDk.exe
  2⤵
  PID:11976
- C:\Windows\System\MJNXTuJ.exe
  C:\Windows\System\MJNXTuJ.exe
  2⤵
  PID:11928
- C:\Windows\System\zcsNHHc.exe
  C:\Windows\System\zcsNHHc.exe
  2⤵
  PID:11500
- C:\Windows\System\nNROLNR.exe
  C:\Windows\System\nNROLNR.exe
  2⤵
  PID:12300
- C:\Windows\System\nlWpVCk.exe
  C:\Windows\System\nlWpVCk.exe
  2⤵
  PID:12328
- C:\Windows\System\VnBYfJu.exe
  C:\Windows\System\VnBYfJu.exe
  2⤵
  PID:12348
- C:\Windows\System\qtKLeKB.exe
  C:\Windows\System\qtKLeKB.exe
  2⤵
  PID:12368
- C:\Windows\System\cQvYALy.exe
  C:\Windows\System\cQvYALy.exe
  2⤵
  PID:12392
- C:\Windows\System\RbiqATN.exe
  C:\Windows\System\RbiqATN.exe
  2⤵
  PID:12412
- C:\Windows\System\DoeHrwP.exe
  C:\Windows\System\DoeHrwP.exe
  2⤵
  PID:12444
- C:\Windows\System\pDpIepX.exe
  C:\Windows\System\pDpIepX.exe
  2⤵
  PID:12464
- C:\Windows\System\QVaHRDa.exe
  C:\Windows\System\QVaHRDa.exe
  2⤵
  PID:12488
- C:\Windows\System\rbciQjT.exe
  C:\Windows\System\rbciQjT.exe
  2⤵
  PID:12516
- C:\Windows\System\aJqbHcO.exe
  C:\Windows\System\aJqbHcO.exe
  2⤵
  PID:12532
- C:\Windows\System\xAdxykc.exe
  C:\Windows\System\xAdxykc.exe
  2⤵
  PID:12556
- C:\Windows\System\jGSemmw.exe
  C:\Windows\System\jGSemmw.exe
  2⤵
  PID:12584
- C:\Windows\System\tCGrruL.exe
  C:\Windows\System\tCGrruL.exe
  2⤵
  PID:12624
- C:\Windows\System\mnwvCnm.exe
  C:\Windows\System\mnwvCnm.exe
  2⤵
  PID:12648
- C:\Windows\System\yHtLecu.exe
  C:\Windows\System\yHtLecu.exe
  2⤵
  PID:12676
- C:\Windows\System\oaGbrzv.exe
  C:\Windows\System\oaGbrzv.exe
  2⤵
  PID:12744
- C:\Windows\System\JIZiQKb.exe
  C:\Windows\System\JIZiQKb.exe
  2⤵
  PID:12780
- C:\Windows\System\pzeRRMM.exe
  C:\Windows\System\pzeRRMM.exe
  2⤵
  PID:12824
- C:\Windows\System\hKuRKka.exe
  C:\Windows\System\hKuRKka.exe
  2⤵
  PID:12848
- C:\Windows\System\FexZFCR.exe
  C:\Windows\System\FexZFCR.exe
  2⤵
  PID:12864
- C:\Windows\System\jLdILEY.exe
  C:\Windows\System\jLdILEY.exe
  2⤵
  PID:12892
- C:\Windows\System\qIqRWpR.exe
  C:\Windows\System\qIqRWpR.exe
  2⤵
  PID:12912
- C:\Windows\System\xMHReMA.exe
  C:\Windows\System\xMHReMA.exe
  2⤵
  PID:12936
- C:\Windows\System\eKbYRol.exe
  C:\Windows\System\eKbYRol.exe
  2⤵
  PID:12976
- C:\Windows\System\teAXcGo.exe
  C:\Windows\System\teAXcGo.exe
  2⤵
  PID:12992
- C:\Windows\System\kXXQsCk.exe
  C:\Windows\System\kXXQsCk.exe
  2⤵
  PID:13024
- C:\Windows\System\NlkLUZM.exe
  C:\Windows\System\NlkLUZM.exe
  2⤵
  PID:13052
- C:\Windows\System\DpTXVYD.exe
  C:\Windows\System\DpTXVYD.exe
  2⤵
  PID:13068
- C:\Windows\System\QUEfmgy.exe
  C:\Windows\System\QUEfmgy.exe
  2⤵
  PID:13092
- C:\Windows\System\ZTsVRau.exe
  C:\Windows\System\ZTsVRau.exe
  2⤵
  PID:13140
- C:\Windows\System\VGlEfcG.exe
  C:\Windows\System\VGlEfcG.exe
  2⤵
  PID:13164
- C:\Windows\System\bVoUhsP.exe
  C:\Windows\System\bVoUhsP.exe
  2⤵
  PID:13200
- C:\Windows\System\ZpHuqoD.exe
  C:\Windows\System\ZpHuqoD.exe
  2⤵
  PID:13220
- C:\Windows\System\xdtTRNj.exe
  C:\Windows\System\xdtTRNj.exe
  2⤵
  PID:13248
- C:\Windows\System\yBggIRy.exe
  C:\Windows\System\yBggIRy.exe
  2⤵
  PID:13280
- C:\Windows\System\YvcdpFH.exe
  C:\Windows\System\YvcdpFH.exe
  2⤵
  PID:12208
- C:\Windows\System\zzPDdJr.exe
  C:\Windows\System\zzPDdJr.exe
  2⤵
  PID:12344
- C:\Windows\System\JbyKuIz.exe
  C:\Windows\System\JbyKuIz.exe
  2⤵
  PID:12364
- C:\Windows\System\kfVQpfq.exe
  C:\Windows\System\kfVQpfq.exe
  2⤵
  PID:12596
- C:\Windows\System\SDOpVho.exe
  C:\Windows\System\SDOpVho.exe
  2⤵
  PID:12484
- C:\Windows\System\HUiVcss.exe
  C:\Windows\System\HUiVcss.exe
  2⤵
  PID:12564
- C:\Windows\System\dyTIFXD.exe
  C:\Windows\System\dyTIFXD.exe
  2⤵
  PID:12632
- C:\Windows\System\DVFeVAu.exe
  C:\Windows\System\DVFeVAu.exe
  2⤵
  PID:12776
- C:\Windows\System\WlsoSNG.exe
  C:\Windows\System\WlsoSNG.exe
  2⤵
  PID:12756
- C:\Windows\System\gsZnDGi.exe
  C:\Windows\System\gsZnDGi.exe
  2⤵
  PID:12884
- C:\Windows\System\zIhmxHA.exe
  C:\Windows\System\zIhmxHA.exe
  2⤵
  PID:12908
- C:\Windows\System\RydBlKz.exe
  C:\Windows\System\RydBlKz.exe
  2⤵
  PID:13008
- C:\Windows\System\cyitiKR.exe
  C:\Windows\System\cyitiKR.exe
  2⤵
  PID:13064
- C:\Windows\System\vdAlWMn.exe
  C:\Windows\System\vdAlWMn.exe
  2⤵
  PID:13116
- C:\Windows\System\VolDLwb.exe
  C:\Windows\System\VolDLwb.exe
  2⤵
  PID:13124
- C:\Windows\System\xztLAIm.exe
  C:\Windows\System\xztLAIm.exe
  2⤵
  PID:13256
- C:\Windows\System\hsRGfbD.exe
  C:\Windows\System\hsRGfbD.exe
  2⤵
  PID:11900
- C:\Windows\System\yyZZXyj.exe
  C:\Windows\System\yyZZXyj.exe
  2⤵
  PID:12440
- C:\Windows\System\PbXthAx.exe
  C:\Windows\System\PbXthAx.exe
  2⤵
  PID:12644
- C:\Windows\System\DZUXheQ.exe
  C:\Windows\System\DZUXheQ.exe
  2⤵
  PID:12720
- C:\Windows\System\iRoFMxY.exe
  C:\Windows\System\iRoFMxY.exe
  2⤵
  PID:12840
- C:\Windows\System\iHwbtWP.exe
  C:\Windows\System\iHwbtWP.exe
  2⤵
  PID:13044
- C:\Windows\System\ntfpzfc.exe
  C:\Windows\System\ntfpzfc.exe
  2⤵
  PID:13308
- C:\Windows\System\SMMmSUx.exe
  C:\Windows\System\SMMmSUx.exe
  2⤵
  PID:12576
- C:\Windows\System\lAPrKMj.exe
  C:\Windows\System\lAPrKMj.exe
  2⤵
  PID:12688
- C:\Windows\System\qVzDzIB.exe
  C:\Windows\System\qVzDzIB.exe
  2⤵
  PID:13216
- C:\Windows\System\IRBuymA.exe
  C:\Windows\System\IRBuymA.exe
  2⤵
  PID:12724
- C:\Windows\System\QvrnQtY.exe
  C:\Windows\System\QvrnQtY.exe
  2⤵
  PID:13340
- C:\Windows\System\GIzUxvT.exe
  C:\Windows\System\GIzUxvT.exe
  2⤵
  PID:13360
- C:\Windows\System\TDkQOgl.exe
  C:\Windows\System\TDkQOgl.exe
  2⤵
  PID:13388
- C:\Windows\System\ROgZAlR.exe
  C:\Windows\System\ROgZAlR.exe
  2⤵
  PID:13436
- C:\Windows\System\sKBKKKE.exe
  C:\Windows\System\sKBKKKE.exe
  2⤵
  PID:13460
- C:\Windows\System\zESWwIK.exe
  C:\Windows\System\zESWwIK.exe
  2⤵
  PID:13480
- C:\Windows\System\xCegUfE.exe
  C:\Windows\System\xCegUfE.exe
  2⤵
  PID:13496
- C:\Windows\System\pnhVGQo.exe
  C:\Windows\System\pnhVGQo.exe
  2⤵
  PID:13544
- C:\Windows\System\gGLuzRh.exe
  C:\Windows\System\gGLuzRh.exe
  2⤵
  PID:13564
- C:\Windows\System\vYgQmCD.exe
  C:\Windows\System\vYgQmCD.exe
  2⤵
  PID:13596
- C:\Windows\System\ZltvUVx.exe
  C:\Windows\System\ZltvUVx.exe
  2⤵
  PID:13624
- C:\Windows\System\kuIQJya.exe
  C:\Windows\System\kuIQJya.exe
  2⤵
  PID:13648
- C:\Windows\System\WSuTCxY.exe
  C:\Windows\System\WSuTCxY.exe
  2⤵
  PID:13672
- C:\Windows\System\LdpJfhD.exe
  C:\Windows\System\LdpJfhD.exe
  2⤵
  PID:13716
- C:\Windows\System\byyQTQW.exe
  C:\Windows\System\byyQTQW.exe
  2⤵
  PID:13732
- C:\Windows\System\cLzOmgx.exe
  C:\Windows\System\cLzOmgx.exe
  2⤵
  PID:13760
- C:\Windows\System\MNpgGZl.exe
  C:\Windows\System\MNpgGZl.exe
  2⤵
  PID:13808
- C:\Windows\System\ADnXKLW.exe
  C:\Windows\System\ADnXKLW.exe
  2⤵
  PID:13828
- C:\Windows\System\HOqLJEM.exe
  C:\Windows\System\HOqLJEM.exe
  2⤵
  PID:13868
- C:\Windows\System\eKhFkBu.exe
  C:\Windows\System\eKhFkBu.exe
  2⤵
  PID:13896
- C:\Windows\System\ENkshxB.exe
  C:\Windows\System\ENkshxB.exe
  2⤵
  PID:13912
- C:\Windows\System\PeHihTV.exe
  C:\Windows\System\PeHihTV.exe
  2⤵
  PID:13936
- C:\Windows\System\gWKzjSb.exe
  C:\Windows\System\gWKzjSb.exe
  2⤵
  PID:13964
- C:\Windows\System\cwpXHCE.exe
  C:\Windows\System\cwpXHCE.exe
  2⤵
  PID:13984
- C:\Windows\System\ACwYxRI.exe
  C:\Windows\System\ACwYxRI.exe
  2⤵
  PID:14008
- C:\Windows\System\aziVBbl.exe
  C:\Windows\System\aziVBbl.exe
  2⤵
  PID:14040
- C:\Windows\System\qsXEpBY.exe
  C:\Windows\System\qsXEpBY.exe
  2⤵
  PID:14072
- C:\Windows\System\XRecqyU.exe
  C:\Windows\System\XRecqyU.exe
  2⤵
  PID:14104
- C:\Windows\System\KnCTrPH.exe
  C:\Windows\System\KnCTrPH.exe
  2⤵
  PID:14132
- C:\Windows\System\QvABaLm.exe
  C:\Windows\System\QvABaLm.exe
  2⤵
  PID:14160
- C:\Windows\System\gaidvop.exe
  C:\Windows\System\gaidvop.exe
  2⤵
  PID:14188
- C:\Windows\System\HGjpMfx.exe
  C:\Windows\System\HGjpMfx.exe
  2⤵
  PID:14212
- C:\Windows\System\FsbUILK.exe
  C:\Windows\System\FsbUILK.exe
  2⤵
  PID:14228
- C:\Windows\System\jyVjfRp.exe
  C:\Windows\System\jyVjfRp.exe
  2⤵
  PID:14268
- C:\Windows\System\qobXyUn.exe
  C:\Windows\System\qobXyUn.exe
  2⤵
  PID:14312
- C:\Windows\System\EeDhIwY.exe
  C:\Windows\System\EeDhIwY.exe
  2⤵
  PID:14332
- C:\Windows\System\DGtNQiX.exe
  C:\Windows\System\DGtNQiX.exe
  2⤵
  PID:13376
- C:\Windows\System\WqzDkwf.exe
  C:\Windows\System\WqzDkwf.exe
  2⤵
  PID:13408
- C:\Windows\System\zdIQTyM.exe
  C:\Windows\System\zdIQTyM.exe
  2⤵
  PID:13456
- C:\Windows\System\UjPXjNW.exe
  C:\Windows\System\UjPXjNW.exe
  2⤵
  PID:13508
- C:\Windows\System\xccGsxS.exe
  C:\Windows\System\xccGsxS.exe
  2⤵
  PID:13616
- C:\Windows\System\eKIczkb.exe
  C:\Windows\System\eKIczkb.exe
  2⤵
  PID:13632
- C:\Windows\System\kNyoJWC.exe
  C:\Windows\System\kNyoJWC.exe
  2⤵
  PID:13636
- C:\Windows\System\baBfkiB.exe
  C:\Windows\System\baBfkiB.exe
  2⤵
  PID:13816
- C:\Windows\System\bBVTAor.exe
  C:\Windows\System\bBVTAor.exe
  2⤵
  PID:13864
- C:\Windows\System\XdBGxOs.exe
  C:\Windows\System\XdBGxOs.exe
  2⤵
  PID:13952
- C:\Windows\System\AywRWzl.exe
  C:\Windows\System\AywRWzl.exe
  2⤵
  PID:13976
- C:\Windows\System\gcjKhUc.exe
  C:\Windows\System\gcjKhUc.exe
  2⤵
  PID:14096
- C:\Windows\System\GaMbSLi.exe
  C:\Windows\System\GaMbSLi.exe
  2⤵
  PID:14140
- C:\Windows\System\mxxOxNH.exe
  C:\Windows\System\mxxOxNH.exe
  2⤵
  PID:14148
- C:\Windows\System\CbGNWIb.exe
  C:\Windows\System\CbGNWIb.exe
  2⤵
  PID:14184
- C:\Windows\System\MonkZsk.exe
  C:\Windows\System\MonkZsk.exe
  2⤵
  PID:14256
- C:\Windows\System\HKjNcPn.exe
  C:\Windows\System\HKjNcPn.exe
  2⤵
  PID:14328
- C:\Windows\System\CwahLjA.exe
  C:\Windows\System\CwahLjA.exe
  2⤵
  PID:13324
- C:\Windows\System\npreYxA.exe
  C:\Windows\System\npreYxA.exe
  2⤵
  PID:13452
- C:\Windows\System\mAbHAnb.exe
  C:\Windows\System\mAbHAnb.exe
  2⤵
  PID:13580
- C:\Windows\System\zrHReNy.exe
  C:\Windows\System\zrHReNy.exe
  2⤵
  PID:13728
- C:\Windows\System\iRHICWy.exe
  C:\Windows\System\iRHICWy.exe
  2⤵
  PID:13904
- C:\Windows\System\hzCtWpr.exe
  C:\Windows\System\hzCtWpr.exe
  2⤵
  PID:13972
- C:\Windows\System\Ffzwmwa.exe
  C:\Windows\System\Ffzwmwa.exe
  2⤵
  PID:14156
- C:\Windows\System\Fskzopo.exe
  C:\Windows\System\Fskzopo.exe
  2⤵
  PID:14304
- C:\Windows\System\ALKNtdN.exe
  C:\Windows\System\ALKNtdN.exe
  2⤵
  PID:13320
- C:\Windows\System\glJubfk.exe
  C:\Windows\System\glJubfk.exe
  2⤵
  PID:13356
- C:\Windows\System\tnLjpuT.exe
  C:\Windows\System\tnLjpuT.exe
  2⤵
  PID:13772
- C:\Windows\System\XEdEZEZ.exe
  C:\Windows\System\XEdEZEZ.exe
  2⤵
  PID:13552
- C:\Windows\System\MayQaSc.exe
  C:\Windows\System\MayQaSc.exe
  2⤵
  PID:14352
- C:\Windows\System\NrClYKw.exe
  C:\Windows\System\NrClYKw.exe
  2⤵
  PID:14372
- C:\Windows\System\ylgTabu.exe
  C:\Windows\System\ylgTabu.exe
  2⤵
  PID:14396
- C:\Windows\System\hzKmrwX.exe
  C:\Windows\System\hzKmrwX.exe
  2⤵
  PID:14416
- C:\Windows\System\UmTCrDu.exe
  C:\Windows\System\UmTCrDu.exe
  2⤵
  PID:14448
- C:\Windows\System\JsrzDpj.exe
  C:\Windows\System\JsrzDpj.exe
  2⤵
  PID:14480
- C:\Windows\System\Bznxiry.exe
  C:\Windows\System\Bznxiry.exe
  2⤵
  PID:14508
- C:\Windows\System\ScTnkUL.exe
  C:\Windows\System\ScTnkUL.exe
  2⤵
  PID:14528
- C:\Windows\System\nfvhZiv.exe
  C:\Windows\System\nfvhZiv.exe
  2⤵
  PID:14552
- C:\Windows\System\gsEANjw.exe
  C:\Windows\System\gsEANjw.exe
  2⤵
  PID:14568
- C:\Windows\System\WmOxeGe.exe
  C:\Windows\System\WmOxeGe.exe
  2⤵
  PID:14588
- C:\Windows\System\MUZxBII.exe
  C:\Windows\System\MUZxBII.exe
  2⤵
  PID:14608
- C:\Windows\System\JtYzAsv.exe
  C:\Windows\System\JtYzAsv.exe
  2⤵
  PID:14628
- C:\Windows\System\KSomZfE.exe
  C:\Windows\System\KSomZfE.exe
  2⤵
  PID:14644
- C:\Windows\System\XdAfSta.exe
  C:\Windows\System\XdAfSta.exe
  2⤵
  PID:14664
- C:\Windows\System\EEzSLXa.exe
  C:\Windows\System\EEzSLXa.exe
  2⤵
  PID:14680
- C:\Windows\System\RYokbtk.exe
  C:\Windows\System\RYokbtk.exe
  2⤵
  PID:14712
- C:\Windows\System\HoRPnKH.exe
  C:\Windows\System\HoRPnKH.exe
  2⤵
  PID:14728
- C:\Windows\System\bkpGxkm.exe
  C:\Windows\System\bkpGxkm.exe
  2⤵
  PID:14756
- C:\Windows\System\fXKUSBk.exe
  C:\Windows\System\fXKUSBk.exe
  2⤵
  PID:14784
- C:\Windows\System\mdTOpYn.exe
  C:\Windows\System\mdTOpYn.exe
  2⤵
  PID:14808
- C:\Windows\System\RKlidih.exe
  C:\Windows\System\RKlidih.exe
  2⤵
  PID:14840
- C:\Windows\System\cyiYcDY.exe
  C:\Windows\System\cyiYcDY.exe
  2⤵
  PID:14864
- C:\Windows\System\hMkSFSB.exe
  C:\Windows\System\hMkSFSB.exe
  2⤵
  PID:14888
- C:\Windows\System\KTWTAhx.exe
  C:\Windows\System\KTWTAhx.exe
  2⤵
  PID:14912
- C:\Windows\System\MgtXWDl.exe
  C:\Windows\System\MgtXWDl.exe
  2⤵
  PID:14940
- C:\Windows\System\CiWFqLM.exe
  C:\Windows\System\CiWFqLM.exe
  2⤵
  PID:14964
- C:\Windows\System\chRckiW.exe
  C:\Windows\System\chRckiW.exe
  2⤵
  PID:14988
- C:\Windows\System\oisWLyr.exe
  C:\Windows\System\oisWLyr.exe
  2⤵
  PID:15012
- C:\Windows\System\UfSdxew.exe
  C:\Windows\System\UfSdxew.exe
  2⤵
  PID:15052
- C:\Windows\System\UnRcnSZ.exe
  C:\Windows\System\UnRcnSZ.exe
  2⤵
  PID:15076
- C:\Windows\System\foUzWlo.exe
  C:\Windows\System\foUzWlo.exe
  2⤵
  PID:15096
- C:\Windows\System\QqvzXHG.exe
  C:\Windows\System\QqvzXHG.exe
  2⤵
  PID:15124
- C:\Windows\System\RUOAxAI.exe
  C:\Windows\System\RUOAxAI.exe
  2⤵
  PID:15144
- C:\Windows\System\fSdrSFh.exe
  C:\Windows\System\fSdrSFh.exe
  2⤵
  PID:15172
- C:\Windows\System\FnOrHQI.exe
  C:\Windows\System\FnOrHQI.exe
  2⤵
  PID:15192
- C:\Windows\System\GHAxoEj.exe
  C:\Windows\System\GHAxoEj.exe
  2⤵
  PID:15212
- C:\Windows\System\jweerpM.exe
  C:\Windows\System\jweerpM.exe
  2⤵
  PID:15236
- C:\Windows\System\BcWqtyP.exe
  C:\Windows\System\BcWqtyP.exe
  2⤵
  PID:15256
- C:\Windows\System\cWSSDaQ.exe
  C:\Windows\System\cWSSDaQ.exe
  2⤵
  PID:15276
- C:\Windows\System\pJXTfVs.exe
  C:\Windows\System\pJXTfVs.exe
  2⤵
  PID:15296
- C:\Windows\System\rKtWdjP.exe
  C:\Windows\System\rKtWdjP.exe
  2⤵
  PID:15316
- C:\Windows\System\pmQWWPW.exe
  C:\Windows\System\pmQWWPW.exe
  2⤵
  PID:15348
- C:\Windows\System\mNbKmua.exe
  C:\Windows\System\mNbKmua.exe
  2⤵
  PID:13824
- C:\Windows\System\NCdIguX.exe
  C:\Windows\System\NCdIguX.exe
  2⤵
  PID:14324
- C:\Windows\System\YvEfYVW.exe
  C:\Windows\System\YvEfYVW.exe
  2⤵
  PID:13856
- C:\Windows\System\jAUAtoK.exe
  C:\Windows\System\jAUAtoK.exe
  2⤵
  PID:14488
- C:\Windows\System\ZUGrSgP.exe
  C:\Windows\System\ZUGrSgP.exe
  2⤵
  PID:14436
- C:\Windows\System\gHtzxit.exe
  C:\Windows\System\gHtzxit.exe
  2⤵
  PID:14520
- C:\Windows\System\TfPYNoJ.exe
  C:\Windows\System\TfPYNoJ.exe
  2⤵
  PID:14564
- C:\Windows\System\TtFVJdz.exe
  C:\Windows\System\TtFVJdz.exe
  2⤵
  PID:14600
- C:\Windows\System\ykFfTLD.exe
  C:\Windows\System\ykFfTLD.exe
  2⤵
  PID:14744
- C:\Windows\System\wVCCrEW.exe
  C:\Windows\System\wVCCrEW.exe
  2⤵
  PID:14796
- C:\Windows\System\MIZMLVw.exe
  C:\Windows\System\MIZMLVw.exe
  2⤵
  PID:14836
- C:\Windows\System\PjSbsOR.exe
  C:\Windows\System\PjSbsOR.exe
  2⤵
  PID:14692
- C:\Windows\System\RGJGoEe.exe
  C:\Windows\System\RGJGoEe.exe
  2⤵
  PID:14956
- C:\Windows\System\TMIUdwb.exe
  C:\Windows\System\TMIUdwb.exe
  2⤵
  PID:15020
- C:\Windows\System\jNIKEnY.exe
  C:\Windows\System\jNIKEnY.exe
  2⤵
  PID:14800
- C:\Windows\System\wTrkbiG.exe
  C:\Windows\System\wTrkbiG.exe
  2⤵
  PID:14476
- C:\Windows\System\RIicITa.exe
  C:\Windows\System\RIicITa.exe
  2⤵
  PID:14604
- C:\Windows\System\coIJRhs.exe
  C:\Windows\System\coIJRhs.exe
  2⤵
  PID:15272
- C:\Windows\System\LpvFlgi.exe
  C:\Windows\System\LpvFlgi.exe
  2⤵
  PID:13524
- C:\Windows\System\oStLBig.exe
  C:\Windows\System\oStLBig.exe
  2⤵
  PID:15244
- C:\Windows\System\UjWcDez.exe
  C:\Windows\System\UjWcDez.exe
  2⤵
  PID:14724
- C:\Windows\System\alDglDx.exe
  C:\Windows\System\alDglDx.exe
  2⤵
  PID:15364
- C:\Windows\System\CULAhwj.exe
  C:\Windows\System\CULAhwj.exe
  2⤵
  PID:15384
- C:\Windows\System\wXJFTXe.exe
  C:\Windows\System\wXJFTXe.exe
  2⤵
  PID:15420
- C:\Windows\System\zoEiLrR.exe
  C:\Windows\System\zoEiLrR.exe
  2⤵
  PID:15436
- C:\Windows\System\LJwsGjP.exe
  C:\Windows\System\LJwsGjP.exe
  2⤵
  PID:15460
- C:\Windows\System\drdbINg.exe
  C:\Windows\System\drdbINg.exe
  2⤵
  PID:15492
- C:\Windows\System\UVMzByB.exe
  C:\Windows\System\UVMzByB.exe
  2⤵
  PID:15532
- C:\Windows\System\uDPfRHD.exe
  C:\Windows\System\uDPfRHD.exe
  2⤵
  PID:15552
- C:\Windows\System\GlXvGfi.exe
  C:\Windows\System\GlXvGfi.exe
  2⤵
  PID:15584
- C:\Windows\System\eRnuJwx.exe
  C:\Windows\System\eRnuJwx.exe
  2⤵
  PID:15620
- C:\Windows\System\cWKawEs.exe
  C:\Windows\System\cWKawEs.exe
  2⤵
  PID:15644
- C:\Windows\System\uuhPaFv.exe
  C:\Windows\System\uuhPaFv.exe
  2⤵
  PID:15680
- C:\Windows\System\JvZAdis.exe
  C:\Windows\System\JvZAdis.exe
  2⤵
  PID:15708
- C:\Windows\System\MxGlOYd.exe
  C:\Windows\System\MxGlOYd.exe
  2⤵
  PID:15732
- C:\Windows\System\htdPuCY.exe
  C:\Windows\System\htdPuCY.exe
  2⤵
  PID:15756
- C:\Windows\System\ehJsXAf.exe
  C:\Windows\System\ehJsXAf.exe
  2⤵
  PID:15780
- C:\Windows\System\BgPhioh.exe
  C:\Windows\System\BgPhioh.exe
  2⤵
  PID:15812
- C:\Windows\System\pNQNtzz.exe
  C:\Windows\System\pNQNtzz.exe
  2⤵
  PID:15828
- C:\Windows\System\UGXksUp.exe
  C:\Windows\System\UGXksUp.exe
  2⤵
  PID:15856
- C:\Windows\System\OMtdtay.exe
  C:\Windows\System\OMtdtay.exe
  2⤵
  PID:15884
- C:\Windows\System\wkfgaMh.exe
  C:\Windows\System\wkfgaMh.exe
  2⤵
  PID:15908
- C:\Windows\System\OhQKiHn.exe
  C:\Windows\System\OhQKiHn.exe
  2⤵
  PID:15928
- C:\Windows\System\KifnWEm.exe
  C:\Windows\System\KifnWEm.exe
  2⤵
  PID:15948
- C:\Windows\System\IVQOEnA.exe
  C:\Windows\System\IVQOEnA.exe
  2⤵
  PID:15972
- C:\Windows\System\bmTBVoY.exe
  C:\Windows\System\bmTBVoY.exe
  2⤵
  PID:15988
- C:\Windows\System\RNTSoFL.exe
  C:\Windows\System\RNTSoFL.exe
  2⤵
  PID:16008
- C:\Windows\System\xDTzQCS.exe
  C:\Windows\System\xDTzQCS.exe
  2⤵
  PID:16036
- C:\Windows\System\xuSabTs.exe
  C:\Windows\System\xuSabTs.exe
  2⤵
  PID:16056
- C:\Windows\System\RcElBAU.exe
  C:\Windows\System\RcElBAU.exe
  2⤵
  PID:16088
- C:\Windows\System\xxLgGZe.exe
  C:\Windows\System\xxLgGZe.exe
  2⤵
  PID:16116
- C:\Windows\System\CVzxyWf.exe
  C:\Windows\System\CVzxyWf.exe
  2⤵
  PID:16132
- C:\Windows\System\fJFEPDH.exe
  C:\Windows\System\fJFEPDH.exe
  2⤵
  PID:16164
- C:\Windows\System\MGOUlnN.exe
  C:\Windows\System\MGOUlnN.exe
  2⤵
  PID:16288
- C:\Windows\System\vCFLlzq.exe
  C:\Windows\System\vCFLlzq.exe
  2⤵
  PID:16308
- C:\Windows\System\nWRhxcN.exe
  C:\Windows\System\nWRhxcN.exe
  2⤵
  PID:16332
- C:\Windows\System\LMRqUZL.exe
  C:\Windows\System\LMRqUZL.exe
  2⤵
  PID:16364
- C:\Windows\System\QRkJTTJ.exe
  C:\Windows\System\QRkJTTJ.exe
  2⤵
  PID:14384
- C:\Windows\System\bdEAVlX.exe
  C:\Windows\System\bdEAVlX.exe
  2⤵
  PID:14672
- C:\Windows\System\xvIETHE.exe
  C:\Windows\System\xvIETHE.exe
  2⤵
  PID:14444
- C:\Windows\System\FagCLqK.exe
  C:\Windows\System\FagCLqK.exe
  2⤵
  PID:15432
- C:\Windows\System\BYIYGbE.exe
  C:\Windows\System\BYIYGbE.exe
  2⤵
  PID:15472
- C:\Windows\System\QSLiRUM.exe
  C:\Windows\System\QSLiRUM.exe
  2⤵
  PID:15412
- C:\Windows\System\TmZCBxi.exe
  C:\Windows\System\TmZCBxi.exe
  2⤵
  PID:15428
- C:\Windows\System\CIRJBdZ.exe
  C:\Windows\System\CIRJBdZ.exe
  2⤵
  PID:15516
- C:\Windows\System\aZAcwqX.exe
  C:\Windows\System\aZAcwqX.exe
  2⤵
  PID:15808
- C:\Windows\System\JMVCXxf.exe
  C:\Windows\System\JMVCXxf.exe
  2⤵
  PID:15700
- C:\Windows\System\wvBhCRo.exe
  C:\Windows\System\wvBhCRo.exe
  2⤵
  PID:15612
- C:\Windows\System\yAgxnld.exe
  C:\Windows\System\yAgxnld.exe
  2⤵
  PID:15692
- C:\Windows\System\rFucvwR.exe
  C:\Windows\System\rFucvwR.exe
  2⤵
  PID:15772
- C:\Windows\System\qoselfv.exe
  C:\Windows\System\qoselfv.exe
  2⤵
  PID:16204
- C:\Windows\System\CQJLfAS.exe
  C:\Windows\System\CQJLfAS.exe
  2⤵
  PID:15848
- C:\Windows\System\ZltKLtP.exe
  C:\Windows\System\ZltKLtP.exe
  2⤵
  PID:16128
- C:\Windows\System\NYCNUwR.exe
  C:\Windows\System\NYCNUwR.exe
  2⤵
  PID:15924
- C:\Windows\System\WTqSpHL.exe
  C:\Windows\System\WTqSpHL.exe
  2⤵
  PID:16172
- C:\Windows\System\mbtVTJZ.exe
  C:\Windows\System\mbtVTJZ.exe
  2⤵
  PID:16304
- C:\Windows\System\SMGGlvL.exe
  C:\Windows\System\SMGGlvL.exe
  2⤵
  PID:16004
- C:\Windows\System\IsutPoT.exe
  C:\Windows\System\IsutPoT.exe
  2⤵
  PID:15636
- C:\Windows\System\alpupRX.exe
  C:\Windows\System\alpupRX.exe
  2⤵
  PID:4312
- C:\Windows\System\ToxkWCe.exe
  C:\Windows\System\ToxkWCe.exe
  2⤵
  PID:15228
- C:\Windows\System\RbBmfbz.exe
  C:\Windows\System\RbBmfbz.exe
  2⤵
  PID:15840
- C:\Windows\System\OWtMoBc.exe
  C:\Windows\System\OWtMoBc.exe
  2⤵
  PID:15724
- C:\Windows\System\BgOGBaE.exe
  C:\Windows\System\BgOGBaE.exe
  2⤵
  PID:15640
- C:\Windows\System\abaewZO.exe
  C:\Windows\System\abaewZO.exe
  2⤵
  PID:16392
- C:\Windows\System\AbuGskm.exe
  C:\Windows\System\AbuGskm.exe
  2⤵
  PID:16408
- C:\Windows\System\lLMdaeI.exe
  C:\Windows\System\lLMdaeI.exe
  2⤵
  PID:16424
- C:\Windows\System\UHnnrlc.exe
  C:\Windows\System\UHnnrlc.exe
  2⤵
  PID:16448
- C:\Windows\System\RZbwZYu.exe
  C:\Windows\System\RZbwZYu.exe
  2⤵
  PID:16472
- C:\Windows\System\JxUDBhS.exe
  C:\Windows\System\JxUDBhS.exe
  2⤵
  PID:16492
- C:\Windows\System\ZHcqKie.exe
  C:\Windows\System\ZHcqKie.exe
  2⤵
  PID:16520
- C:\Windows\System\NIMQHyV.exe
  C:\Windows\System\NIMQHyV.exe
  2⤵
  PID:16548
- C:\Windows\System\gFwZBMJ.exe
  C:\Windows\System\gFwZBMJ.exe
  2⤵
  PID:16572
- C:\Windows\System\oDZGzRd.exe
  C:\Windows\System\oDZGzRd.exe
  2⤵
  PID:16588
- C:\Windows\System\OYHKqGQ.exe
  C:\Windows\System\OYHKqGQ.exe
  2⤵
  PID:16612
- C:\Windows\System\KHQsaFT.exe
  C:\Windows\System\KHQsaFT.exe
  2⤵
  PID:16636
- C:\Windows\System\eyzJpXC.exe
  C:\Windows\System\eyzJpXC.exe
  2⤵
  PID:16660
- C:\Windows\System\HLWqQDy.exe
  C:\Windows\System\HLWqQDy.exe
  2⤵
  PID:16680
- C:\Windows\System\zziIvjv.exe
  C:\Windows\System\zziIvjv.exe
  2⤵
  PID:16696
- C:\Windows\System\XkKkEbF.exe
  C:\Windows\System\XkKkEbF.exe
  2⤵
  PID:16716
- C:\Windows\System\BqUdruP.exe
  C:\Windows\System\BqUdruP.exe
  2⤵
  PID:16740
- C:\Windows\System\esWAoES.exe
  C:\Windows\System\esWAoES.exe
  2⤵
  PID:16760
- C:\Windows\System\aAvjslB.exe
  C:\Windows\System\aAvjslB.exe
  2⤵
  PID:16776
- C:\Windows\System\trWCKEY.exe
  C:\Windows\System\trWCKEY.exe
  2⤵
  PID:16796
- C:\Windows\System\tYxSWpj.exe
  C:\Windows\System\tYxSWpj.exe
  2⤵
  PID:16820
- C:\Windows\System\lGSufcW.exe
  C:\Windows\System\lGSufcW.exe
  2⤵
  PID:16836
- C:\Windows\System\AmCNSUR.exe
  C:\Windows\System\AmCNSUR.exe
  2⤵
  PID:16856
- C:\Windows\System\HXdfQhn.exe
  C:\Windows\System\HXdfQhn.exe
  2⤵
  PID:16888
- C:\Windows\System\azrBQYg.exe
  C:\Windows\System\azrBQYg.exe
  2⤵
  PID:16912
- C:\Windows\System\CbOdfXb.exe
  C:\Windows\System\CbOdfXb.exe
  2⤵
  PID:16928
- C:\Windows\System\odhsAAu.exe
  C:\Windows\System\odhsAAu.exe
  2⤵
  PID:16964
- C:\Windows\System\vDvnZfm.exe
  C:\Windows\System\vDvnZfm.exe
  2⤵
  PID:16988
- C:\Windows\System\sPyFtjE.exe
  C:\Windows\System\sPyFtjE.exe
  2⤵
  PID:17008
- C:\Windows\System\LLnhseZ.exe
  C:\Windows\System\LLnhseZ.exe
  2⤵
  PID:17040
- C:\Windows\System\MXCTKxH.exe
  C:\Windows\System\MXCTKxH.exe
  2⤵
  PID:17064
- C:\Windows\System\hZtJOGH.exe
  C:\Windows\System\hZtJOGH.exe
  2⤵
  PID:17088
- C:\Windows\System\HzHjArZ.exe
  C:\Windows\System\HzHjArZ.exe
  2⤵
  PID:15800
- C:\Windows\System\wIrEkWG.exe
  C:\Windows\System\wIrEkWG.exe
  2⤵
  PID:16528
- C:\Windows\System\dMMDPql.exe
  C:\Windows\System\dMMDPql.exe
  2⤵
  PID:16672
- C:\Windows\System\egAnmuQ.exe
  C:\Windows\System\egAnmuQ.exe
  2⤵
  PID:16460
- C:\Windows\System\tKTetTZ.exe
  C:\Windows\System\tKTetTZ.exe
  2⤵
  PID:17076
- C:\Windows\System\AoPpHbq.exe
  C:\Windows\System\AoPpHbq.exe
  2⤵
  PID:16784
- C:\Windows\System\fsWCTUO.exe
  C:\Windows\System\fsWCTUO.exe
  2⤵
  PID:16816
- C:\Windows\System\ZbFSDzn.exe
  C:\Windows\System\ZbFSDzn.exe
  2⤵
  PID:16972
- C:\Windows\System\wpegueY.exe
  C:\Windows\System\wpegueY.exe
  2⤵
  PID:17364
- C:\Windows\System\BLbMVdD.exe
  C:\Windows\System\BLbMVdD.exe
  2⤵
  PID:17268
- C:\Windows\System\yZebPtM.exe
  C:\Windows\System\yZebPtM.exe
  2⤵
  PID:17288
- C:\Windows\System\anTDysp.exe
  C:\Windows\System\anTDysp.exe
  2⤵
  PID:16104

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AewTUUY.exe

Filesize
1.3MB

MD5
f767a0718ada3dc57312ed597df4637a

SHA1
da2dc8cc275d1a33d8c7223365a81edf1ef84b3b

SHA256
95b9d248039b34612c49fb7287fbc9139c60e2fdd917bd05803fa059614a2e63

SHA512
cd3e2eea051d4ee45355ecde29e567187238fc77f75767b8a341681f12803c1e37378125f49dbe3db25f2757e804d86b58b677775289eb52d65e162c944f443e

Download Submit
C:\Windows\System\DSaYtpk.exe

Filesize
1.3MB

MD5
023e54c479399664e10befa832b36630

SHA1
30478a67ab94e016d42c25d4e805fc3ade6e64e0

SHA256
6ff89d2a4516b904648fd3b4cde8bbedbadd5053d1db17ec94497f6e33f4efbe

SHA512
d5453180b73b4c0d789c03be7f72909ba9dc7fa29f16e5ae8ebce2ddae1ab8930c16d9aac9379e52f467cec289cc11200e5ad6163d639ef5fbe64ca6858f5fa6

Download Submit
C:\Windows\System\DzESuXB.exe

Filesize
1.3MB

MD5
f4cffe5fde17963503b4bb0a85e41899

SHA1
8ee30a59ce1dee49d48bcaf208582e795cd3ca56

SHA256
7caf10fa954d1e2dde4e7e58339d3285798f8a0c9a7d16307eb686b1676288f3

SHA512
bfb04232d74182e02fd86a557877e32b29007f1310f7f8853713700c5ae15e8ca0c8f70b9a4cd8fa7912089d6e222500c23d51cfbd68fed53bcdf81220d5cc8d

Download Submit
C:\Windows\System\ERxaqIo.exe

Filesize
1.3MB

MD5
4584b3823d194367792840018bb9a4c3

SHA1
84308afcf757117493094cf274ae0db12fc8597d

SHA256
906563b9d10c4a051052af36bb948325d531c76c33878ab450f6e20a93339f62

SHA512
c11b24783d630d7cc04be949e26b5e764251112ee64595eb49269242b47ea0d090aa3dfa5555b9621018343e7224cacec47d81a1da5ee5af5c11870212ad8710

Download Submit
C:\Windows\System\ETkIbwM.exe

Filesize
1.3MB

MD5
08370589706d03be9b05e97538b2e210

SHA1
c5fc56dc1db19be584415b98fccc4995dece7534

SHA256
b32288428dde6185fc897cd2f2a67cd5206f68f04e5620e32ea606cbd85401f2

SHA512
6c16a01251e306a00172c376c45995f00661679c39e9d182657cb5bba42f914965b4a8d2154271aee5dc9c0790d012f25747f1db4076009ed67ddc582159b551

Download Submit
C:\Windows\System\EfnhlGL.exe

Filesize
1.3MB

MD5
ce77d5d1bc2a75481a64187852ea7d85

SHA1
0c31c0339d8d03f81623b8454a95ac4b2a251d51

SHA256
a989feddb9138d3ec5e5a94f2eed027c2741023ddfc5dddcdfd97e3ea7fe8abc

SHA512
be1e348779bb544616f9d97b8fbea5c62c0b5ae01ff69dc638a4b63e6db920dd943804f2ff84540b14b455090823aca89cc636fe75c87b45f05ad6e0059f38b6

Download Submit
C:\Windows\System\ElhTJIy.exe

Filesize
1.3MB

MD5
39c6412a6125a25bbdcafe60a010a4d8

SHA1
0d2629ac3f5ee0e21b846008819cec9ce288b985

SHA256
2b855766bdf7c5b0156434d375e9e2623091e4647cb5daf0c88c703b7d22a6d1

SHA512
42958aa58673983ee571ec314d944b0d88e376057d7eff9c5ecaf7fb6dd73600e0e99aa418eee6471ffce55187ff32cf225fea246ca9531680091418f1df62d2

Download Submit
C:\Windows\System\FaCtBnx.exe

Filesize
1.3MB

MD5
a5d924927e7b814e2fec4a4b60cf1fac

SHA1
1bed4cfd835ff18d572ff43ba12115843db3a7b1

SHA256
dcef9ea074c5dbe2afd7a058abcde4cbd9f9408826d53dac613b6b4bad7f01be

SHA512
366d1cfa6bf861572cacf9050de1573d3d309e326ca370032352a1fb1fd316f15f8f28fe7a35632b3e46324613786a8a3005d03aeeb4a044b7520258993a239c

Download Submit
C:\Windows\System\IwOIkLh.exe

Filesize
1.3MB

MD5
eaea1d77f1f4c2b402584136d62079d0

SHA1
55ad3289a7cd2b6b150b06eb2d4e20603a4b9e13

SHA256
4a800427274e2e2b22277843855642315cfef5a4c68883a49a098c2b6c9a0fe3

SHA512
4252c48d49a61887c60d72e384405c3ddfb840634f6ff877f58e55e85189f3848f8c226be33457a48246d8ec60744a4c983b4ad9ffee0706cd8bd7b9186756bd

Download Submit
C:\Windows\System\JWFNlFV.exe

Filesize
1.3MB

MD5
4eb51a51e29aa6511f2691b5497e798d

SHA1
b069e12a55b4c96ed7856518eb98833980911c83

SHA256
bf8c3d78c3a5f21e96439a89c2a15cc493327174d0f6348058348a502aefd6ce

SHA512
20504f7ba9e731c94f540976789209ad5ed287ce133c63d02098e8bd70fb52ee334e4c439f13d8760a5586203c2e77f7a8ebe6932238b06c805c00a7135354a6

Download Submit
C:\Windows\System\MNlKFMd.exe

Filesize
1.3MB

MD5
11a5eaae5a020f7ff9c72890152e7d50

SHA1
a9ebbdfea7af46d248c3713b08d15e8ca09392b2

SHA256
dcef9d3a7e63d90c9f3eda2a535cc1fbff88085dda197e093e28c161e82723ba

SHA512
b464a94320ba8ea98854568561637617ada26b8caafc33cc3617b1d61f392ece9ab31b2634b963691c28ed3082f7d0a1f84866ba554b8ba032691b69c145924d

Download Submit
C:\Windows\System\NndCOwj.exe

Filesize
1.3MB

MD5
61de494b2f0090a9310797f6cc14c545

SHA1
99f3d3f68ced629ee8fff3bbe1082179722103d6

SHA256
4c1aa66a1c6d9752db5f0c73134518afba2d62ffd2a9c3a6e0a7df6f7b1a46cd

SHA512
935c962bcaa414d7fac84b1f0d40d83186775e86488f0c53dc4398ccf8b2c37b034b1a9a9ab56d7bc7b3152552d793a3b52024e71060f92f9393f99c13b72052

Download Submit
C:\Windows\System\NqLHsBx.exe

Filesize
1.3MB

MD5
d450767ca636a5ee19a9370da8fbcb3a

SHA1
4752aa10a9bb46dca78b219258122cad1b41d1b6

SHA256
0265b50cd1d804bf6bc147b197f92ffab00ff525e37384691bcd1fe52df454eb

SHA512
d589fd0e94e1d7cb965722afa449a79bea26fb1a177015b33dcb8d69d087dd69e8a4daa0536e1857265a73a1b920e7488583cf1bd47b2a035e77b45a2839ae1b

Download Submit
C:\Windows\System\Ordrplk.exe

Filesize
1.3MB

MD5
c7eae52d8a3dd17ac9102ad9f026f25f

SHA1
5afa8f5ec4e5d462053df483cd0d0692647b01fb

SHA256
7b7a7630e5a8593d02b986b29841a800f0f87d7b84f20b517dc6c63378471dc7

SHA512
ec4a974108929e9acba5a9dd73788dfcaedd6043be88fd334a58bfa793f63b4f2111cf7b067f54f96c595160d14983cb750e06895035987c2d11b72145ccd694

Download Submit
C:\Windows\System\PdplRLd.exe

Filesize
1.3MB

MD5
f73ee29efd0b9973e06c458f82db6a0f

SHA1
6b335de73da64258477c3ef90c911622e7428e99

SHA256
eec01dfb59e1c9cfdb61605dbdfc72405f76ed8767a162230eb00e84dec1fadc

SHA512
fea0f56392dc2180d3c76e862eed99b899de793270efec0f1f3e91455953eb145f2059b315e58844c6f211d0f86c683faddcdc58971e2b563dc78430f985d957

Download Submit
C:\Windows\System\VZJjJjj.exe

Filesize
1.3MB

MD5
98f2a1ee23eb404d92d80d704c8facc3

SHA1
726d4524fdfc3d5f13438feb2cc30eab6e5c17c4

SHA256
8a2e7827cdd10da7de4560e1c082e6ec6bc32c95a1b354b680309c1d15cd0217

SHA512
51de0816c7f705a3b1d51329bf18cbff82a5f3523c12ddddc64bb5fbaa3978ffc301bc5667bad524185337ceb0884b346bbb14c31ff9db1be7971b34c1a5f0b2

Download Submit
C:\Windows\System\XtBMNES.exe

Filesize
1.3MB

MD5
f45cba24dca650ef3d447b0ffbf53cd3

SHA1
9d059c4eee90a26ea92d4629d4cce823c4333b22

SHA256
0cdb266295e4003020bc9b32f865f876312ecfd0b8fd152228df35d6c53e4055

SHA512
032d38463fa62b166207b97ab521b9bc0872d694cafb2ca4dfaa73377e64a13eab07d499fbef84adb9e99ada7810c76183a88f6e6bdc9c5a03144a0f38f11cff

Download Submit
C:\Windows\System\YLhwJPy.exe

Filesize
1.3MB

MD5
9b1a8a7f8463bd25b9ae08a7f5de31d9

SHA1
87df77281575c7fa7abc56c8ea0dc76606daf9f8

SHA256
80c40357edf8e23f19b7051019c9044e37e84357bdcfeb8526b029e96018c96b

SHA512
c04f84ab9a73cf1e9e10390dd8551a0e7bc0e36642a523ea4007e4e96816adfca9a9d50ae9cc75585c3e16fbeb265f51ddf6f363e45def1caf7ecb5b4abc77f5

Download Submit
C:\Windows\System\ckHzMiQ.exe

Filesize
1.3MB

MD5
78a217806646d9dd247e72266198c0e9

SHA1
47e0d78294d4635efff62957ddcb6be46adee4b1

SHA256
11937e9d9d4d28e9670cb1cf76a1b1ffb7ebfd814b959a6322899a211b760a12

SHA512
3f67b4494aaa0ac63fe196be5e6ee127ea73fd378bd862bf4d140935f28db09e4758796fa89b11ff76a157f64c4acf168d9efaaefc05de7327824b1542888e3f

Download Submit
C:\Windows\System\fjEEwWW.exe

Filesize
1.3MB

MD5
edf89edd215d59fe7d9f12b00c5d7f85

SHA1
6680c0a32c5b2fe1ec1ab885a86c348058f27951

SHA256
bffb38f509c1107c4a9744fc66cb67c384aae26a0c7b96ec9aabc71a87010285

SHA512
74e264e653a48dbc1b11d36bc0d31506b74f1bafc9299d10eddeb80f9814bc82f89c6a95c21191ea757aeeca84ffe8eae9c61de8f9f01eb971beb99f6cc809e1

Download Submit
C:\Windows\System\hCZfxHU.exe

Filesize
1.3MB

MD5
c4e3dccb71b9e7b4b4ebed82e7265dc6

SHA1
bab3718180fa702d969fdb4644d8d26866da3051

SHA256
6471261a362a40f9bda45f78d60bd044250611f563136c3be3862753c134d382

SHA512
8020e3461fba26a550af49f41a465ef1d8f3590723d472383823f0569213b7bb1c7b7e9bbb44609f8ae4bc9e3fc82279efff756d488709685f0a1fd18cc4fc1f

Download Submit
C:\Windows\System\jxrMvMB.exe

Filesize
1.3MB

MD5
9d594d501d2bc7276971da9f6df0cb4c

SHA1
82a2303158485541fbd3990a2fc213070ca13407

SHA256
49ffccf1e8d0d3bb0c27cc32622ca479996806dbb438d41714bb03476307f497

SHA512
1c486b232bf9bf56fbf9e14e15770d03e94bb30496500bdafdbdd05b40ace7b371449ed7e34e52d01834cb0412aeb9ed0f91d39a795255171337fd1a0ddd3f89

Download Submit
C:\Windows\System\kMpLMVR.exe

Filesize
1.3MB

MD5
80dd0b29683567b9b8a1414651b3cc70

SHA1
b7da54787ed9d1b8c9a8ce41c11bad9689d94727

SHA256
7d945214d77b848b945627aa82fbdb5db84d4895acdd7bbd7214767e0b5d0d04

SHA512
90d424c9c1fcc93254cbea787fcadd3a2221cdcee00463fbcfcc1a54babbd80702fe35b596712ab4d399e87d9e2f561764d94466fdddc9c8786f615568e4197c

Download Submit
C:\Windows\System\lnoclLt.exe

Filesize
1.3MB

MD5
ed42299f79251e22b8124fb88829cf6d

SHA1
ef39156a31c30dc2efb15c3d6bfed0bd3ff43db5

SHA256
3b2f96073487c0e08031d3c0504d7c92bba10c831f5c8649ee5407425227c977

SHA512
206ea77b74fdcdc9b8c3ca2f8d16c6fd5dcb411bf04b2845e59717d0b36fa0307f7a4ce76a6580a38d35c7091871ede45d852ef98fe0985ee2f2624e908798ef

Download Submit
C:\Windows\System\neBKbWM.exe

Filesize
1.3MB

MD5
661326aee35b24dc176846000d480153

SHA1
4763f6e3b4f993fd89031052cf5544da96972672

SHA256
e344df507568502986f513b3fc0a8667f3a3079ec99f0943cdc14b7f8ae5fd07

SHA512
4043572a310ebe9c0d7266842c5ea151c8e03598d0213409e077689e9fbbd3cfd8b7ade2a67034b84c6f7fedc1264232bbf58cee6ec64bdf372424f3d88df49e

Download Submit
C:\Windows\System\pENdbQo.exe

Filesize
1.3MB

MD5
0c79ce5dfdf2cbd6aa935b40a7b51d0b

SHA1
e4dfa72d5e275a6cfea14ad3381b6a67a587ed72

SHA256
7b3bfd9599cd581f51a26877bd877bf6f01cf41233c9bf37435e7c07f3f5abf8

SHA512
1fd1bcaa7922091e9aab4b9e4da33f0246085d173090d317658628bb2ffa085434d4ace1e838023472280964657d1d6259c2ce1888e0205961bbd9009daf49f5

Download Submit
C:\Windows\System\rWrTEis.exe

Filesize
1.3MB

MD5
b7bf0d4d9d74fd5298921113b4f38dec

SHA1
fccdfb09276834aa77df5a95a78ca0606f2de2ee

SHA256
2c01fbcc57ed7ab32b0e629895387536179d3c8c59be87889b8281722feebb08

SHA512
1465dfbc6c983256ea8d4b062e3d6244f235d04b2c9a66e42be8b46e3c12ac631c428357cd62936ed83ae6ca3f2e627b8d16edb2ce04db52fe8053d11083448e

Download Submit
C:\Windows\System\shrUfCY.exe

Filesize
1.3MB

MD5
c360e3471afa7bc2bdaaa334003afde9

SHA1
f70670c874ac36185ac8bf2d0cda852e7ba3ed1e

SHA256
3e5228a0fbe2058e192e792772037ef5ea3dca974f700b60ef9315b4b31ecd94

SHA512
5acabb5d3b0803a0facb9d70740c262409bffdd473cc60182d7196eccaea0e32e7d31e91defa0da0b67157d67b0df726f154511f6c370d91bf5330c56f01c029

Download Submit
C:\Windows\System\tSHLBBn.exe

Filesize
1.3MB

MD5
99ee8c3fc9216be30709e2829a166f49

SHA1
f473b309d4873d067b569bc19b3cf7b40b7dc0ea

SHA256
442fd408d00771afe6cec9a1526c78222fc7494c8cff90d03c7b6ab8e7edfaec

SHA512
111d6633478e9d50c539ad31cdb4bd3bc1c4daddef6f13b6e57642d89d80a405f1064262db27c7032c0a84858e2a1732c99a40f84a99df49f760406e5c9d158b

Download Submit
C:\Windows\System\uSqMkTn.exe

Filesize
1.3MB

MD5
7e9af1c8295d0ec12716c52cdd36224f

SHA1
ea2e10970dc3b7db0041430140ad5d8748ab2a74

SHA256
008f143458f6bd1c7ff8803faf2250916a1d8c2436d082266969aab76706c84d

SHA512
c851278b11d78ec44b57d51013fe4581d55c6ef39fe77d5cc63ecb202cb1d35bf567795cd5a5cd8d6d0f4021eb16f58a738ad0463f50270848f0be0209eff183

Download Submit
C:\Windows\System\vCZHOyA.exe

Filesize
1.3MB

MD5
94783cdd3a84a6d458d0e97bd26d0001

SHA1
230c1041b327fcaea2bb00a913192ef9980ac925

SHA256
27c7d4186703f0aacbef1e18bf44cd971d6b76940bb411485eb33cc2ba13415c

SHA512
7b4aee475ae50de59b2475f6398465d1ff665feac5c96e1625498f42789725febf1583b3e658f63be581d191d5334cd63a6fd8c328dd06e8a5094a2d46f6da43

Download Submit
C:\Windows\System\yWgCUXK.exe

Filesize
1.3MB

MD5
8804b1db7eddeda80adc56479f6f8196

SHA1
361f7521e56aaa55c9bccbd48ddf55d1ee1baf1c

SHA256
3892cf83e980eb9b8771c31be42647eb2d28ac061b67e636c87e8b0fe8850422

SHA512
321622c6cc2db45dc99c8bf307edfca7365e290f230e3cd65c1317095e40f567aaab4ff64c6a3796284500a4d7736e0ffe463947ce09f102453b621e2b230b3f

Download Submit
C:\Windows\System\ykYWTaG.exe

Filesize
1.3MB

MD5
21f914a7e2579e8bcd1f28791c5e68eb

SHA1
cbbd599a3874d3df84f691c5d70a75e958c0b059

SHA256
a33fcf817e91f1ed64cee0a02308654819a74901f0e06a5c66decc40d7c7fa27

SHA512
94ea72187e9e346398f2e639665705faee7ac78640d4aeb3d5d4b4e19586471089c33f595161a5a198b15f0590844f10b109da07f7a6acecd482105694e24ce5

Download Submit
memory/3552-0-0x0000029C7E0D0000-0x0000029C7E0E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads