xmrig | b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2024, 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
Size

1.1MB
MD5

d58e892e5ddef7bc27d3a787d635afec
SHA1

20f6a86214f0e233d93a17521c40c3851f4171d9
SHA256

b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624
SHA512

957f23ff057365c58ab5d7a2dea7bb68341f3ff23756f4d1068a008af8e8d97447ae4ca4ec13abe90ffd27c63228a83d855520bb713065dbd9b01884aa21bc90
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/ccJ0HVuf6:GezaTF8FcNkNdfE0pZ9ozttwIRxfi

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b8e-4.dat	xmrig
behavioral2/files/0x0007000000023c87-26.dat	xmrig
behavioral2/files/0x0007000000023c8d-37.dat	xmrig
behavioral2/files/0x0007000000023c90-57.dat	xmrig
behavioral2/files/0x0007000000023c95-95.dat	xmrig
behavioral2/files/0x0007000000023c99-105.dat	xmrig
behavioral2/files/0x0007000000023c9a-110.dat	xmrig
behavioral2/files/0x0007000000023c9d-142.dat	xmrig
behavioral2/files/0x0007000000023ca3-154.dat	xmrig
behavioral2/files/0x0007000000023ca2-152.dat	xmrig
behavioral2/files/0x0007000000023ca1-150.dat	xmrig
behavioral2/files/0x0007000000023ca0-148.dat	xmrig
behavioral2/files/0x0007000000023c9f-146.dat	xmrig
behavioral2/files/0x0007000000023c9e-144.dat	xmrig
behavioral2/files/0x0007000000023c9c-140.dat	xmrig
behavioral2/files/0x0007000000023c9b-138.dat	xmrig
behavioral2/files/0x0007000000023c93-103.dat	xmrig
behavioral2/files/0x0007000000023c98-101.dat	xmrig
behavioral2/files/0x0007000000023c97-99.dat	xmrig
behavioral2/files/0x0007000000023c94-97.dat	xmrig
behavioral2/files/0x0007000000023c91-93.dat	xmrig
behavioral2/files/0x0007000000023c8f-86.dat	xmrig
behavioral2/files/0x0007000000023c96-80.dat	xmrig
behavioral2/files/0x0007000000023c92-74.dat	xmrig
behavioral2/files/0x0007000000023c8c-72.dat	xmrig
behavioral2/files/0x0007000000023c8e-62.dat	xmrig
behavioral2/files/0x0007000000023c8a-58.dat	xmrig
behavioral2/files/0x0007000000023c89-36.dat	xmrig
behavioral2/files/0x0007000000023c88-34.dat	xmrig
behavioral2/files/0x0007000000023c8b-46.dat	xmrig
behavioral2/files/0x0009000000023c83-17.dat	xmrig
behavioral2/files/0x0007000000023ca4-159.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1864	tsDsoWK.exe
2792	OsEkpiG.exe
3332	IGoTVZl.exe
5096	SUZjjCV.exe
4852	hOYaYGy.exe
1096	SOWBkHM.exe
2400	jicjTnt.exe
2448	OcLYHSP.exe
4180	YSmwPBl.exe
2500	DjMTMwQ.exe
2644	HDwqCxj.exe
840	NbUTOiI.exe
1504	OUDsWmL.exe
2180	BpgVKSS.exe
3468	raFAQYy.exe
4616	vZSvmjJ.exe
4436	uIeiCCs.exe
2236	lnVqJlH.exe
2560	NWRXCsQ.exe
3840	YRqylsa.exe
2988	iQxChPq.exe
1156	bGelKhd.exe
3060	UJxcAZy.exe
952	yNVzbLh.exe
2460	zYuTcaJ.exe
4012	QSHeTVE.exe
1728	wppkREp.exe
4688	EfuosTE.exe
3104	BQtWkQF.exe
2488	vqfLxQZ.exe
4244	PvwXvjr.exe
112	ydvILPP.exe
4068	GkQljrg.exe
2772	jCcGDZj.exe
3100	LKLuoDc.exe
4796	JQkJZeT.exe
2028	xgcxYvr.exe
3952	IXefalX.exe
1980	NLYeWrS.exe
784	XibxIJO.exe
3440	eNGGbPU.exe
4568	JyFjJex.exe
1936	DCeRLOo.exe
652	PDaxKcO.exe
556	RmcEsak.exe
4100	hGVpVDn.exe
3264	MMgBkJA.exe
984	NnRCKdA.exe
2392	NjLyeif.exe
384	MCicRUf.exe
4404	HcQteBF.exe
2260	GMiDZyH.exe
2848	ARgoQLW.exe
388	eMvRohQ.exe
3176	dZFesPk.exe
1384	VaBLzyI.exe
2008	CqSGtQd.exe
1380	wkdYgmx.exe
1048	vWlERKW.exe
2184	vlcfauV.exe
3336	NNlRIpY.exe
4492	EnRTNPf.exe
3416	IyCwHEZ.exe
5068	gZXxFCz.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CSpYwxJ.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\GjEfOhu.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\jDsRAcB.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\addDzXS.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\GfRUYGz.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\aELsset.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\KvtXFtj.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\vgmhpOu.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\WGObFYz.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\FZiSoZf.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\HRaJKQu.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\eMOqVJY.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\ZwLaFyI.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\CBNjink.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\vPGRvum.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\nFaxmLz.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\lmoOydm.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\xUDQzaY.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\LpqDyxv.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\VwuTsLD.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\OqHMSrC.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\sbDnIaN.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\THNBsMH.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\VuILIfc.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\NYDvkhV.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\vqJtGet.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\pWWtuPR.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\IyCwHEZ.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\XPbPzzJ.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\NfgjcGw.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\TlIwaBR.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\LHnuOpD.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\bXqBRMF.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\pajcSPM.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\tNrHMeK.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\qdpfwzo.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\bPBzLNB.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\XFTWoPY.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\aTtlsFv.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\VaBLzyI.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\vmOtOXf.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\RLxgGYF.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\PVoJAgK.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\IqPGneu.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\DZcQIBL.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\IGeXjxH.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\OeAECzd.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\hDUJkYa.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\kOXhfRO.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\rOqFxLg.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\zmtZrly.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\LXnMpLL.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\OsEkpiG.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\AzKHIJR.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\MkcijzD.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\FcOTpPQ.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\fXimYfF.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\iwxJAKg.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\FQKdBtO.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\VSgjeWb.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\caeLtDN.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\SkmVlwF.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\KWUbvVo.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
File created	C:\Windows\System\HQRZwCq.exe	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16352	dwm.exe
Token: SeChangeNotifyPrivilege	16352	dwm.exe
Token: 33	16352	dwm.exe
Token: SeIncBasePriorityPrivilege	16352	dwm.exe
Token: SeManageVolumePrivilege	1236	svchost.exe
Token: SeShutdownPrivilege	16352	dwm.exe
Token: SeCreatePagefilePrivilege	16352	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 1864	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	85
PID 3008 wrote to memory of 1864	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	85
PID 3008 wrote to memory of 2792	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	86
PID 3008 wrote to memory of 2792	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	86
PID 3008 wrote to memory of 3332	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	87
PID 3008 wrote to memory of 3332	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	87
PID 3008 wrote to memory of 5096	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	88
PID 3008 wrote to memory of 5096	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	88
PID 3008 wrote to memory of 4852	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	89
PID 3008 wrote to memory of 4852	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	89
PID 3008 wrote to memory of 2448	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	90
PID 3008 wrote to memory of 2448	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	90
PID 3008 wrote to memory of 1096	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	91
PID 3008 wrote to memory of 1096	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	91
PID 3008 wrote to memory of 2400	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	92
PID 3008 wrote to memory of 2400	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	92
PID 3008 wrote to memory of 4180	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	93
PID 3008 wrote to memory of 4180	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	93
PID 3008 wrote to memory of 2500	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	94
PID 3008 wrote to memory of 2500	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	94
PID 3008 wrote to memory of 2644	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	95
PID 3008 wrote to memory of 2644	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	95
PID 3008 wrote to memory of 840	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	96
PID 3008 wrote to memory of 840	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	96
PID 3008 wrote to memory of 1504	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	97
PID 3008 wrote to memory of 1504	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	97
PID 3008 wrote to memory of 2180	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	98
PID 3008 wrote to memory of 2180	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	98
PID 3008 wrote to memory of 3468	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	99
PID 3008 wrote to memory of 3468	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	99
PID 3008 wrote to memory of 4616	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	100
PID 3008 wrote to memory of 4616	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	100
PID 3008 wrote to memory of 4436	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	101
PID 3008 wrote to memory of 4436	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	101
PID 3008 wrote to memory of 2236	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	102
PID 3008 wrote to memory of 2236	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	102
PID 3008 wrote to memory of 2560	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	103
PID 3008 wrote to memory of 2560	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	103
PID 3008 wrote to memory of 3840	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	104
PID 3008 wrote to memory of 3840	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	104
PID 3008 wrote to memory of 2988	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	105
PID 3008 wrote to memory of 2988	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	105
PID 3008 wrote to memory of 1156	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	106
PID 3008 wrote to memory of 1156	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	106
PID 3008 wrote to memory of 3060	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	107
PID 3008 wrote to memory of 3060	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	107
PID 3008 wrote to memory of 952	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	108
PID 3008 wrote to memory of 952	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	108
PID 3008 wrote to memory of 2460	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	109
PID 3008 wrote to memory of 2460	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	109
PID 3008 wrote to memory of 4012	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	110
PID 3008 wrote to memory of 4012	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	110
PID 3008 wrote to memory of 1728	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	111
PID 3008 wrote to memory of 1728	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	111
PID 3008 wrote to memory of 4688	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	112
PID 3008 wrote to memory of 4688	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	112
PID 3008 wrote to memory of 3104	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	113
PID 3008 wrote to memory of 3104	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	113
PID 3008 wrote to memory of 2488	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	114
PID 3008 wrote to memory of 2488	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	114
PID 3008 wrote to memory of 4244	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	115
PID 3008 wrote to memory of 4244	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	115
PID 3008 wrote to memory of 112	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	116
PID 3008 wrote to memory of 112	3008	b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe	116

C:\Users\Admin\AppData\Local\Temp\b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe
"C:\Users\Admin\AppData\Local\Temp\b0431c9113a61208b69af3a79b815a7c0ec677b44cfb8932efd4bf62f0f64624.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\System\tsDsoWK.exe
  C:\Windows\System\tsDsoWK.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\OsEkpiG.exe
  C:\Windows\System\OsEkpiG.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\IGoTVZl.exe
  C:\Windows\System\IGoTVZl.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\SUZjjCV.exe
  C:\Windows\System\SUZjjCV.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\hOYaYGy.exe
  C:\Windows\System\hOYaYGy.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\OcLYHSP.exe
  C:\Windows\System\OcLYHSP.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\SOWBkHM.exe
  C:\Windows\System\SOWBkHM.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\jicjTnt.exe
  C:\Windows\System\jicjTnt.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\YSmwPBl.exe
  C:\Windows\System\YSmwPBl.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\DjMTMwQ.exe
  C:\Windows\System\DjMTMwQ.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\HDwqCxj.exe
  C:\Windows\System\HDwqCxj.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\NbUTOiI.exe
  C:\Windows\System\NbUTOiI.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\OUDsWmL.exe
  C:\Windows\System\OUDsWmL.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\BpgVKSS.exe
  C:\Windows\System\BpgVKSS.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\raFAQYy.exe
  C:\Windows\System\raFAQYy.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\vZSvmjJ.exe
  C:\Windows\System\vZSvmjJ.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\uIeiCCs.exe
  C:\Windows\System\uIeiCCs.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\lnVqJlH.exe
  C:\Windows\System\lnVqJlH.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\NWRXCsQ.exe
  C:\Windows\System\NWRXCsQ.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\YRqylsa.exe
  C:\Windows\System\YRqylsa.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\iQxChPq.exe
  C:\Windows\System\iQxChPq.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\bGelKhd.exe
  C:\Windows\System\bGelKhd.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\UJxcAZy.exe
  C:\Windows\System\UJxcAZy.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\yNVzbLh.exe
  C:\Windows\System\yNVzbLh.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\zYuTcaJ.exe
  C:\Windows\System\zYuTcaJ.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\QSHeTVE.exe
  C:\Windows\System\QSHeTVE.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\wppkREp.exe
  C:\Windows\System\wppkREp.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\EfuosTE.exe
  C:\Windows\System\EfuosTE.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\BQtWkQF.exe
  C:\Windows\System\BQtWkQF.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\vqfLxQZ.exe
  C:\Windows\System\vqfLxQZ.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\PvwXvjr.exe
  C:\Windows\System\PvwXvjr.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\ydvILPP.exe
  C:\Windows\System\ydvILPP.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\GkQljrg.exe
  C:\Windows\System\GkQljrg.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\jCcGDZj.exe
  C:\Windows\System\jCcGDZj.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\LKLuoDc.exe
  C:\Windows\System\LKLuoDc.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\xgcxYvr.exe
  C:\Windows\System\xgcxYvr.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\JQkJZeT.exe
  C:\Windows\System\JQkJZeT.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\IXefalX.exe
  C:\Windows\System\IXefalX.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\NLYeWrS.exe
  C:\Windows\System\NLYeWrS.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\XibxIJO.exe
  C:\Windows\System\XibxIJO.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\eNGGbPU.exe
  C:\Windows\System\eNGGbPU.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\JyFjJex.exe
  C:\Windows\System\JyFjJex.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\DCeRLOo.exe
  C:\Windows\System\DCeRLOo.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\MMgBkJA.exe
  C:\Windows\System\MMgBkJA.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\PDaxKcO.exe
  C:\Windows\System\PDaxKcO.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\RmcEsak.exe
  C:\Windows\System\RmcEsak.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\hGVpVDn.exe
  C:\Windows\System\hGVpVDn.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\NnRCKdA.exe
  C:\Windows\System\NnRCKdA.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\GMiDZyH.exe
  C:\Windows\System\GMiDZyH.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\NjLyeif.exe
  C:\Windows\System\NjLyeif.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\MCicRUf.exe
  C:\Windows\System\MCicRUf.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\HcQteBF.exe
  C:\Windows\System\HcQteBF.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\eMvRohQ.exe
  C:\Windows\System\eMvRohQ.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\ARgoQLW.exe
  C:\Windows\System\ARgoQLW.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\dZFesPk.exe
  C:\Windows\System\dZFesPk.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\VaBLzyI.exe
  C:\Windows\System\VaBLzyI.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\wkdYgmx.exe
  C:\Windows\System\wkdYgmx.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\CqSGtQd.exe
  C:\Windows\System\CqSGtQd.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\vlcfauV.exe
  C:\Windows\System\vlcfauV.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\vWlERKW.exe
  C:\Windows\System\vWlERKW.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\NNlRIpY.exe
  C:\Windows\System\NNlRIpY.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\EnRTNPf.exe
  C:\Windows\System\EnRTNPf.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\IyCwHEZ.exe
  C:\Windows\System\IyCwHEZ.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\gZXxFCz.exe
  C:\Windows\System\gZXxFCz.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\ylOrenF.exe
  C:\Windows\System\ylOrenF.exe
  2⤵
  PID:5000
- C:\Windows\System\zWTMJAr.exe
  C:\Windows\System\zWTMJAr.exe
  2⤵
  PID:2688
- C:\Windows\System\SRJpbZy.exe
  C:\Windows\System\SRJpbZy.exe
  2⤵
  PID:2824
- C:\Windows\System\neQBxOD.exe
  C:\Windows\System\neQBxOD.exe
  2⤵
  PID:4552
- C:\Windows\System\mjCidSH.exe
  C:\Windows\System\mjCidSH.exe
  2⤵
  PID:3780
- C:\Windows\System\srzIJim.exe
  C:\Windows\System\srzIJim.exe
  2⤵
  PID:4872
- C:\Windows\System\iWzpCXG.exe
  C:\Windows\System\iWzpCXG.exe
  2⤵
  PID:4732
- C:\Windows\System\phaZvcU.exe
  C:\Windows\System\phaZvcU.exe
  2⤵
  PID:392
- C:\Windows\System\MHuKoZT.exe
  C:\Windows\System\MHuKoZT.exe
  2⤵
  PID:1624
- C:\Windows\System\rQKAQey.exe
  C:\Windows\System\rQKAQey.exe
  2⤵
  PID:936
- C:\Windows\System\OtBcEbj.exe
  C:\Windows\System\OtBcEbj.exe
  2⤵
  PID:2312
- C:\Windows\System\mYpXEhK.exe
  C:\Windows\System\mYpXEhK.exe
  2⤵
  PID:4952
- C:\Windows\System\XPbPzzJ.exe
  C:\Windows\System\XPbPzzJ.exe
  2⤵
  PID:1052
- C:\Windows\System\dHPzyBj.exe
  C:\Windows\System\dHPzyBj.exe
  2⤵
  PID:2476
- C:\Windows\System\TkZJIRs.exe
  C:\Windows\System\TkZJIRs.exe
  2⤵
  PID:3868
- C:\Windows\System\rcauAgT.exe
  C:\Windows\System\rcauAgT.exe
  2⤵
  PID:5088
- C:\Windows\System\zOFrNGj.exe
  C:\Windows\System\zOFrNGj.exe
  2⤵
  PID:2436
- C:\Windows\System\nLtcGVc.exe
  C:\Windows\System\nLtcGVc.exe
  2⤵
  PID:4416
- C:\Windows\System\FyYICXP.exe
  C:\Windows\System\FyYICXP.exe
  2⤵
  PID:4964
- C:\Windows\System\aliAdtd.exe
  C:\Windows\System\aliAdtd.exe
  2⤵
  PID:4256
- C:\Windows\System\acpmzgb.exe
  C:\Windows\System\acpmzgb.exe
  2⤵
  PID:3544
- C:\Windows\System\qydzYlw.exe
  C:\Windows\System\qydzYlw.exe
  2⤵
  PID:2860
- C:\Windows\System\BGfvANZ.exe
  C:\Windows\System\BGfvANZ.exe
  2⤵
  PID:1364
- C:\Windows\System\kCLmDtj.exe
  C:\Windows\System\kCLmDtj.exe
  2⤵
  PID:3640
- C:\Windows\System\EXqBDyr.exe
  C:\Windows\System\EXqBDyr.exe
  2⤵
  PID:4036
- C:\Windows\System\XLmlhZz.exe
  C:\Windows\System\XLmlhZz.exe
  2⤵
  PID:1720
- C:\Windows\System\jrTnthq.exe
  C:\Windows\System\jrTnthq.exe
  2⤵
  PID:1644
- C:\Windows\System\mqTvnRz.exe
  C:\Windows\System\mqTvnRz.exe
  2⤵
  PID:1196
- C:\Windows\System\uipiGTg.exe
  C:\Windows\System\uipiGTg.exe
  2⤵
  PID:2124
- C:\Windows\System\AWboXiz.exe
  C:\Windows\System\AWboXiz.exe
  2⤵
  PID:2804
- C:\Windows\System\TxLDvLJ.exe
  C:\Windows\System\TxLDvLJ.exe
  2⤵
  PID:3496
- C:\Windows\System\JatMmsh.exe
  C:\Windows\System\JatMmsh.exe
  2⤵
  PID:2136
- C:\Windows\System\FwvnQsA.exe
  C:\Windows\System\FwvnQsA.exe
  2⤵
  PID:4652
- C:\Windows\System\HEZSjwG.exe
  C:\Windows\System\HEZSjwG.exe
  2⤵
  PID:2680
- C:\Windows\System\oVBUhUv.exe
  C:\Windows\System\oVBUhUv.exe
  2⤵
  PID:1584
- C:\Windows\System\jovecam.exe
  C:\Windows\System\jovecam.exe
  2⤵
  PID:4168
- C:\Windows\System\GnBvEld.exe
  C:\Windows\System\GnBvEld.exe
  2⤵
  PID:2156
- C:\Windows\System\YJmWvBU.exe
  C:\Windows\System\YJmWvBU.exe
  2⤵
  PID:4016
- C:\Windows\System\lsMDFJU.exe
  C:\Windows\System\lsMDFJU.exe
  2⤵
  PID:3672
- C:\Windows\System\ksCHvCe.exe
  C:\Windows\System\ksCHvCe.exe
  2⤵
  PID:3620
- C:\Windows\System\CqkxOdZ.exe
  C:\Windows\System\CqkxOdZ.exe
  2⤵
  PID:5156
- C:\Windows\System\SMzZDWr.exe
  C:\Windows\System\SMzZDWr.exe
  2⤵
  PID:5180
- C:\Windows\System\GlGpDfY.exe
  C:\Windows\System\GlGpDfY.exe
  2⤵
  PID:5208
- C:\Windows\System\lmoOydm.exe
  C:\Windows\System\lmoOydm.exe
  2⤵
  PID:5228
- C:\Windows\System\epcVvqP.exe
  C:\Windows\System\epcVvqP.exe
  2⤵
  PID:5256
- C:\Windows\System\pJNnxWp.exe
  C:\Windows\System\pJNnxWp.exe
  2⤵
  PID:5296
- C:\Windows\System\THNBsMH.exe
  C:\Windows\System\THNBsMH.exe
  2⤵
  PID:5320
- C:\Windows\System\WoIoawf.exe
  C:\Windows\System\WoIoawf.exe
  2⤵
  PID:5344
- C:\Windows\System\JgIXiOT.exe
  C:\Windows\System\JgIXiOT.exe
  2⤵
  PID:5388
- C:\Windows\System\vMDwTiL.exe
  C:\Windows\System\vMDwTiL.exe
  2⤵
  PID:5424
- C:\Windows\System\PGaNlRd.exe
  C:\Windows\System\PGaNlRd.exe
  2⤵
  PID:5448
- C:\Windows\System\HDRixxS.exe
  C:\Windows\System\HDRixxS.exe
  2⤵
  PID:5472
- C:\Windows\System\XhSYTgl.exe
  C:\Windows\System\XhSYTgl.exe
  2⤵
  PID:5504
- C:\Windows\System\cfjWSeb.exe
  C:\Windows\System\cfjWSeb.exe
  2⤵
  PID:5540
- C:\Windows\System\BYhHxta.exe
  C:\Windows\System\BYhHxta.exe
  2⤵
  PID:5556
- C:\Windows\System\CXfWrlR.exe
  C:\Windows\System\CXfWrlR.exe
  2⤵
  PID:5576
- C:\Windows\System\dDzWQLz.exe
  C:\Windows\System\dDzWQLz.exe
  2⤵
  PID:5612
- C:\Windows\System\tpEXkpo.exe
  C:\Windows\System\tpEXkpo.exe
  2⤵
  PID:5644
- C:\Windows\System\goRpwxm.exe
  C:\Windows\System\goRpwxm.exe
  2⤵
  PID:5680
- C:\Windows\System\wZsFNSY.exe
  C:\Windows\System\wZsFNSY.exe
  2⤵
  PID:5696
- C:\Windows\System\MDalqEh.exe
  C:\Windows\System\MDalqEh.exe
  2⤵
  PID:5720
- C:\Windows\System\lnSKXrV.exe
  C:\Windows\System\lnSKXrV.exe
  2⤵
  PID:5752
- C:\Windows\System\CLFLuso.exe
  C:\Windows\System\CLFLuso.exe
  2⤵
  PID:5780
- C:\Windows\System\Acdnxqd.exe
  C:\Windows\System\Acdnxqd.exe
  2⤵
  PID:5820
- C:\Windows\System\vLagiHm.exe
  C:\Windows\System\vLagiHm.exe
  2⤵
  PID:5848
- C:\Windows\System\XDuZhUN.exe
  C:\Windows\System\XDuZhUN.exe
  2⤵
  PID:5868
- C:\Windows\System\NfgjcGw.exe
  C:\Windows\System\NfgjcGw.exe
  2⤵
  PID:5896
- C:\Windows\System\DZcQIBL.exe
  C:\Windows\System\DZcQIBL.exe
  2⤵
  PID:5932
- C:\Windows\System\tMWTaEx.exe
  C:\Windows\System\tMWTaEx.exe
  2⤵
  PID:5952
- C:\Windows\System\TzIRhaE.exe
  C:\Windows\System\TzIRhaE.exe
  2⤵
  PID:5980
- C:\Windows\System\iUNbLHP.exe
  C:\Windows\System\iUNbLHP.exe
  2⤵
  PID:6020
- C:\Windows\System\MqeTuWC.exe
  C:\Windows\System\MqeTuWC.exe
  2⤵
  PID:6048
- C:\Windows\System\kGemjBX.exe
  C:\Windows\System\kGemjBX.exe
  2⤵
  PID:6068
- C:\Windows\System\OYzcDoJ.exe
  C:\Windows\System\OYzcDoJ.exe
  2⤵
  PID:6096
- C:\Windows\System\ZCJdVzf.exe
  C:\Windows\System\ZCJdVzf.exe
  2⤵
  PID:6124
- C:\Windows\System\qzDubvD.exe
  C:\Windows\System\qzDubvD.exe
  2⤵
  PID:5132
- C:\Windows\System\pOiSouE.exe
  C:\Windows\System\pOiSouE.exe
  2⤵
  PID:5172
- C:\Windows\System\RCLOoKD.exe
  C:\Windows\System\RCLOoKD.exe
  2⤵
  PID:5236
- C:\Windows\System\ovWMNum.exe
  C:\Windows\System\ovWMNum.exe
  2⤵
  PID:5400
- C:\Windows\System\JLlmauX.exe
  C:\Windows\System\JLlmauX.exe
  2⤵
  PID:5436
- C:\Windows\System\fYMGhRQ.exe
  C:\Windows\System\fYMGhRQ.exe
  2⤵
  PID:5484
- C:\Windows\System\bPHxPOm.exe
  C:\Windows\System\bPHxPOm.exe
  2⤵
  PID:5512
- C:\Windows\System\TtRtGkT.exe
  C:\Windows\System\TtRtGkT.exe
  2⤵
  PID:5600
- C:\Windows\System\kHrAatT.exe
  C:\Windows\System\kHrAatT.exe
  2⤵
  PID:5596
- C:\Windows\System\oiQfguI.exe
  C:\Windows\System\oiQfguI.exe
  2⤵
  PID:5676
- C:\Windows\System\oupsRje.exe
  C:\Windows\System\oupsRje.exe
  2⤵
  PID:5740
- C:\Windows\System\CRRdCsK.exe
  C:\Windows\System\CRRdCsK.exe
  2⤵
  PID:5804
- C:\Windows\System\kOXhfRO.exe
  C:\Windows\System\kOXhfRO.exe
  2⤵
  PID:5876
- C:\Windows\System\wKmUPlE.exe
  C:\Windows\System\wKmUPlE.exe
  2⤵
  PID:5976
- C:\Windows\System\qXsLGNv.exe
  C:\Windows\System\qXsLGNv.exe
  2⤵
  PID:6000
- C:\Windows\System\hsPnUHz.exe
  C:\Windows\System\hsPnUHz.exe
  2⤵
  PID:6064
- C:\Windows\System\DlRhfiM.exe
  C:\Windows\System\DlRhfiM.exe
  2⤵
  PID:6140
- C:\Windows\System\AMEOsnz.exe
  C:\Windows\System\AMEOsnz.exe
  2⤵
  PID:5284
- C:\Windows\System\ZuPMeok.exe
  C:\Windows\System\ZuPMeok.exe
  2⤵
  PID:5336
- C:\Windows\System\oVipFfe.exe
  C:\Windows\System\oVipFfe.exe
  2⤵
  PID:5496
- C:\Windows\System\SGfsfab.exe
  C:\Windows\System\SGfsfab.exe
  2⤵
  PID:5708
- C:\Windows\System\IxwPTUz.exe
  C:\Windows\System\IxwPTUz.exe
  2⤵
  PID:5632
- C:\Windows\System\CQxPXNa.exe
  C:\Windows\System\CQxPXNa.exe
  2⤵
  PID:5728
- C:\Windows\System\SfmWOOo.exe
  C:\Windows\System\SfmWOOo.exe
  2⤵
  PID:5972
- C:\Windows\System\xWAAihU.exe
  C:\Windows\System\xWAAihU.exe
  2⤵
  PID:5272
- C:\Windows\System\WawWLZP.exe
  C:\Windows\System\WawWLZP.exe
  2⤵
  PID:5308
- C:\Windows\System\IovvmJw.exe
  C:\Windows\System\IovvmJw.exe
  2⤵
  PID:5808
- C:\Windows\System\pigGzVQ.exe
  C:\Windows\System\pigGzVQ.exe
  2⤵
  PID:6172
- C:\Windows\System\yxUxups.exe
  C:\Windows\System\yxUxups.exe
  2⤵
  PID:6204
- C:\Windows\System\dBjdBGU.exe
  C:\Windows\System\dBjdBGU.exe
  2⤵
  PID:6224
- C:\Windows\System\uWHowvy.exe
  C:\Windows\System\uWHowvy.exe
  2⤵
  PID:6240
- C:\Windows\System\ncFlLVk.exe
  C:\Windows\System\ncFlLVk.exe
  2⤵
  PID:6264
- C:\Windows\System\hJcpmlt.exe
  C:\Windows\System\hJcpmlt.exe
  2⤵
  PID:6292
- C:\Windows\System\XjokEZZ.exe
  C:\Windows\System\XjokEZZ.exe
  2⤵
  PID:6320
- C:\Windows\System\xUDQzaY.exe
  C:\Windows\System\xUDQzaY.exe
  2⤵
  PID:6336
- C:\Windows\System\txefowx.exe
  C:\Windows\System\txefowx.exe
  2⤵
  PID:6368
- C:\Windows\System\UAWWmlC.exe
  C:\Windows\System\UAWWmlC.exe
  2⤵
  PID:6396
- C:\Windows\System\fJklqsx.exe
  C:\Windows\System\fJklqsx.exe
  2⤵
  PID:6420
- C:\Windows\System\ZnblEwD.exe
  C:\Windows\System\ZnblEwD.exe
  2⤵
  PID:6452
- C:\Windows\System\gQJqFuv.exe
  C:\Windows\System\gQJqFuv.exe
  2⤵
  PID:6480
- C:\Windows\System\bXqBRMF.exe
  C:\Windows\System\bXqBRMF.exe
  2⤵
  PID:6508
- C:\Windows\System\CWEKJxy.exe
  C:\Windows\System\CWEKJxy.exe
  2⤵
  PID:6524
- C:\Windows\System\EnXJdgu.exe
  C:\Windows\System\EnXJdgu.exe
  2⤵
  PID:6552
- C:\Windows\System\ODtBMRC.exe
  C:\Windows\System\ODtBMRC.exe
  2⤵
  PID:6576
- C:\Windows\System\JvZZrtr.exe
  C:\Windows\System\JvZZrtr.exe
  2⤵
  PID:6612
- C:\Windows\System\pbOKZAj.exe
  C:\Windows\System\pbOKZAj.exe
  2⤵
  PID:6632
- C:\Windows\System\iydTzFE.exe
  C:\Windows\System\iydTzFE.exe
  2⤵
  PID:6656
- C:\Windows\System\yCpCGlc.exe
  C:\Windows\System\yCpCGlc.exe
  2⤵
  PID:6684
- C:\Windows\System\FaNfeVs.exe
  C:\Windows\System\FaNfeVs.exe
  2⤵
  PID:6708
- C:\Windows\System\ecvtcIe.exe
  C:\Windows\System\ecvtcIe.exe
  2⤵
  PID:6740
- C:\Windows\System\iAharGk.exe
  C:\Windows\System\iAharGk.exe
  2⤵
  PID:6776
- C:\Windows\System\sNhQjXm.exe
  C:\Windows\System\sNhQjXm.exe
  2⤵
  PID:6800
- C:\Windows\System\mJqtNzk.exe
  C:\Windows\System\mJqtNzk.exe
  2⤵
  PID:6828
- C:\Windows\System\EKTzEvS.exe
  C:\Windows\System\EKTzEvS.exe
  2⤵
  PID:6848
- C:\Windows\System\krvxNNX.exe
  C:\Windows\System\krvxNNX.exe
  2⤵
  PID:6876
- C:\Windows\System\ucalcdv.exe
  C:\Windows\System\ucalcdv.exe
  2⤵
  PID:6896
- C:\Windows\System\DiFGUjC.exe
  C:\Windows\System\DiFGUjC.exe
  2⤵
  PID:6932
- C:\Windows\System\VAcMPmP.exe
  C:\Windows\System\VAcMPmP.exe
  2⤵
  PID:6956
- C:\Windows\System\dYFFSRp.exe
  C:\Windows\System\dYFFSRp.exe
  2⤵
  PID:6972
- C:\Windows\System\teQvdBu.exe
  C:\Windows\System\teQvdBu.exe
  2⤵
  PID:6996
- C:\Windows\System\NriJxem.exe
  C:\Windows\System\NriJxem.exe
  2⤵
  PID:7020
- C:\Windows\System\bVDkkPi.exe
  C:\Windows\System\bVDkkPi.exe
  2⤵
  PID:7044
- C:\Windows\System\KPbxFPs.exe
  C:\Windows\System\KPbxFPs.exe
  2⤵
  PID:7072
- C:\Windows\System\ruLPjjQ.exe
  C:\Windows\System\ruLPjjQ.exe
  2⤵
  PID:7096
- C:\Windows\System\KOZyArq.exe
  C:\Windows\System\KOZyArq.exe
  2⤵
  PID:7124
- C:\Windows\System\MvoicZI.exe
  C:\Windows\System\MvoicZI.exe
  2⤵
  PID:7144
- C:\Windows\System\tXDsHzl.exe
  C:\Windows\System\tXDsHzl.exe
  2⤵
  PID:5140
- C:\Windows\System\goLNkNZ.exe
  C:\Windows\System\goLNkNZ.exe
  2⤵
  PID:6156
- C:\Windows\System\sMaOzdG.exe
  C:\Windows\System\sMaOzdG.exe
  2⤵
  PID:6220
- C:\Windows\System\EIscgnY.exe
  C:\Windows\System\EIscgnY.exe
  2⤵
  PID:6260
- C:\Windows\System\VeTPvUZ.exe
  C:\Windows\System\VeTPvUZ.exe
  2⤵
  PID:6312
- C:\Windows\System\iLNCGyY.exe
  C:\Windows\System\iLNCGyY.exe
  2⤵
  PID:6360
- C:\Windows\System\qBdqtEU.exe
  C:\Windows\System\qBdqtEU.exe
  2⤵
  PID:6436
- C:\Windows\System\oghvUFd.exe
  C:\Windows\System\oghvUFd.exe
  2⤵
  PID:6624
- C:\Windows\System\ykNmPJa.exe
  C:\Windows\System\ykNmPJa.exe
  2⤵
  PID:6700
- C:\Windows\System\iRAAGuC.exe
  C:\Windows\System\iRAAGuC.exe
  2⤵
  PID:6640
- C:\Windows\System\RWBpXpu.exe
  C:\Windows\System\RWBpXpu.exe
  2⤵
  PID:6588
- C:\Windows\System\cazVRoD.exe
  C:\Windows\System\cazVRoD.exe
  2⤵
  PID:6652
- C:\Windows\System\wKkyCDw.exe
  C:\Windows\System\wKkyCDw.exe
  2⤵
  PID:6892
- C:\Windows\System\AzKHIJR.exe
  C:\Windows\System\AzKHIJR.exe
  2⤵
  PID:6824
- C:\Windows\System\gakIyLM.exe
  C:\Windows\System\gakIyLM.exe
  2⤵
  PID:7008
- C:\Windows\System\gIqHhQL.exe
  C:\Windows\System\gIqHhQL.exe
  2⤵
  PID:7136
- C:\Windows\System\WEMFbBP.exe
  C:\Windows\System\WEMFbBP.exe
  2⤵
  PID:7036
- C:\Windows\System\UZeEUZa.exe
  C:\Windows\System\UZeEUZa.exe
  2⤵
  PID:6060
- C:\Windows\System\ZRqkJSa.exe
  C:\Windows\System\ZRqkJSa.exe
  2⤵
  PID:6332
- C:\Windows\System\yPgRgrk.exe
  C:\Windows\System\yPgRgrk.exe
  2⤵
  PID:7012
- C:\Windows\System\qkHkmif.exe
  C:\Windows\System\qkHkmif.exe
  2⤵
  PID:7112
- C:\Windows\System\uMpgaRN.exe
  C:\Windows\System\uMpgaRN.exe
  2⤵
  PID:5672
- C:\Windows\System\PNsZVPQ.exe
  C:\Windows\System\PNsZVPQ.exe
  2⤵
  PID:6820
- C:\Windows\System\fzmMybN.exe
  C:\Windows\System\fzmMybN.exe
  2⤵
  PID:6908
- C:\Windows\System\ssRGuzy.exe
  C:\Windows\System\ssRGuzy.exe
  2⤵
  PID:6888
- C:\Windows\System\URtExNO.exe
  C:\Windows\System\URtExNO.exe
  2⤵
  PID:6964
- C:\Windows\System\dJQEBxu.exe
  C:\Windows\System\dJQEBxu.exe
  2⤵
  PID:6404
- C:\Windows\System\spaYzbi.exe
  C:\Windows\System\spaYzbi.exe
  2⤵
  PID:7176
- C:\Windows\System\TXafUZC.exe
  C:\Windows\System\TXafUZC.exe
  2⤵
  PID:7200
- C:\Windows\System\lJbEqoO.exe
  C:\Windows\System\lJbEqoO.exe
  2⤵
  PID:7232
- C:\Windows\System\VuILIfc.exe
  C:\Windows\System\VuILIfc.exe
  2⤵
  PID:7252
- C:\Windows\System\tNrHMeK.exe
  C:\Windows\System\tNrHMeK.exe
  2⤵
  PID:7276
- C:\Windows\System\dVqnUgq.exe
  C:\Windows\System\dVqnUgq.exe
  2⤵
  PID:7296
- C:\Windows\System\PQEPCDO.exe
  C:\Windows\System\PQEPCDO.exe
  2⤵
  PID:7324
- C:\Windows\System\MfKENzL.exe
  C:\Windows\System\MfKENzL.exe
  2⤵
  PID:7356
- C:\Windows\System\hPMOHKO.exe
  C:\Windows\System\hPMOHKO.exe
  2⤵
  PID:7376
- C:\Windows\System\qdpfwzo.exe
  C:\Windows\System\qdpfwzo.exe
  2⤵
  PID:7396
- C:\Windows\System\qOuLwdW.exe
  C:\Windows\System\qOuLwdW.exe
  2⤵
  PID:7420
- C:\Windows\System\akASCvD.exe
  C:\Windows\System\akASCvD.exe
  2⤵
  PID:7452
- C:\Windows\System\aZNFwKU.exe
  C:\Windows\System\aZNFwKU.exe
  2⤵
  PID:7472
- C:\Windows\System\krYLeRA.exe
  C:\Windows\System\krYLeRA.exe
  2⤵
  PID:7504
- C:\Windows\System\yDHWUhy.exe
  C:\Windows\System\yDHWUhy.exe
  2⤵
  PID:7536
- C:\Windows\System\VqJQXSh.exe
  C:\Windows\System\VqJQXSh.exe
  2⤵
  PID:7568
- C:\Windows\System\FwqZQwZ.exe
  C:\Windows\System\FwqZQwZ.exe
  2⤵
  PID:7592
- C:\Windows\System\QPIwJhZ.exe
  C:\Windows\System\QPIwJhZ.exe
  2⤵
  PID:7616
- C:\Windows\System\awbsbjf.exe
  C:\Windows\System\awbsbjf.exe
  2⤵
  PID:7640
- C:\Windows\System\ijuIhLn.exe
  C:\Windows\System\ijuIhLn.exe
  2⤵
  PID:7668
- C:\Windows\System\UYdiVeQ.exe
  C:\Windows\System\UYdiVeQ.exe
  2⤵
  PID:7696
- C:\Windows\System\POEJlAn.exe
  C:\Windows\System\POEJlAn.exe
  2⤵
  PID:7732
- C:\Windows\System\KpaStpP.exe
  C:\Windows\System\KpaStpP.exe
  2⤵
  PID:7756
- C:\Windows\System\qKpnMFz.exe
  C:\Windows\System\qKpnMFz.exe
  2⤵
  PID:7776
- C:\Windows\System\MjYwfRB.exe
  C:\Windows\System\MjYwfRB.exe
  2⤵
  PID:7808
- C:\Windows\System\fjGyIHa.exe
  C:\Windows\System\fjGyIHa.exe
  2⤵
  PID:7832
- C:\Windows\System\dpLnBtK.exe
  C:\Windows\System\dpLnBtK.exe
  2⤵
  PID:7856
- C:\Windows\System\mnCuqQI.exe
  C:\Windows\System\mnCuqQI.exe
  2⤵
  PID:7880
- C:\Windows\System\jrCIDWq.exe
  C:\Windows\System\jrCIDWq.exe
  2⤵
  PID:7904
- C:\Windows\System\CfPctnV.exe
  C:\Windows\System\CfPctnV.exe
  2⤵
  PID:7924
- C:\Windows\System\QykdYPo.exe
  C:\Windows\System\QykdYPo.exe
  2⤵
  PID:7952
- C:\Windows\System\DTLgHua.exe
  C:\Windows\System\DTLgHua.exe
  2⤵
  PID:7976
- C:\Windows\System\NRIIOVz.exe
  C:\Windows\System\NRIIOVz.exe
  2⤵
  PID:8004
- C:\Windows\System\cSlmYoo.exe
  C:\Windows\System\cSlmYoo.exe
  2⤵
  PID:8032
- C:\Windows\System\ydQtkVK.exe
  C:\Windows\System\ydQtkVK.exe
  2⤵
  PID:8056
- C:\Windows\System\hfEgPHH.exe
  C:\Windows\System\hfEgPHH.exe
  2⤵
  PID:8080
- C:\Windows\System\iwxJAKg.exe
  C:\Windows\System\iwxJAKg.exe
  2⤵
  PID:8112
- C:\Windows\System\AMIRggq.exe
  C:\Windows\System\AMIRggq.exe
  2⤵
  PID:8136
- C:\Windows\System\DJFkpIk.exe
  C:\Windows\System\DJFkpIk.exe
  2⤵
  PID:8160
- C:\Windows\System\FZiSoZf.exe
  C:\Windows\System\FZiSoZf.exe
  2⤵
  PID:6520
- C:\Windows\System\oUUzDpu.exe
  C:\Windows\System\oUUzDpu.exe
  2⤵
  PID:6944
- C:\Windows\System\EEeBrUc.exe
  C:\Windows\System\EEeBrUc.exe
  2⤵
  PID:7212
- C:\Windows\System\HhrvVhB.exe
  C:\Windows\System\HhrvVhB.exe
  2⤵
  PID:7248
- C:\Windows\System\bVkSBeD.exe
  C:\Windows\System\bVkSBeD.exe
  2⤵
  PID:7088
- C:\Windows\System\VthYwRP.exe
  C:\Windows\System\VthYwRP.exe
  2⤵
  PID:7352
- C:\Windows\System\rfeHKyy.exe
  C:\Windows\System\rfeHKyy.exe
  2⤵
  PID:7464
- C:\Windows\System\KyouDrl.exe
  C:\Windows\System\KyouDrl.exe
  2⤵
  PID:7544
- C:\Windows\System\ItXUKXC.exe
  C:\Windows\System\ItXUKXC.exe
  2⤵
  PID:7564
- C:\Windows\System\ooJpxpd.exe
  C:\Windows\System\ooJpxpd.exe
  2⤵
  PID:7632
- C:\Windows\System\PsziPuZ.exe
  C:\Windows\System\PsziPuZ.exe
  2⤵
  PID:7408
- C:\Windows\System\oWcbjxU.exe
  C:\Windows\System\oWcbjxU.exe
  2⤵
  PID:7708
- C:\Windows\System\oRzuFzO.exe
  C:\Windows\System\oRzuFzO.exe
  2⤵
  PID:7520
- C:\Windows\System\WjqDeqr.exe
  C:\Windows\System\WjqDeqr.exe
  2⤵
  PID:7628
- C:\Windows\System\yWFleVw.exe
  C:\Windows\System\yWFleVw.exe
  2⤵
  PID:7368
- C:\Windows\System\zXTaNCY.exe
  C:\Windows\System\zXTaNCY.exe
  2⤵
  PID:7940
- C:\Windows\System\NIlgSmq.exe
  C:\Windows\System\NIlgSmq.exe
  2⤵
  PID:8000
- C:\Windows\System\EyGVaFg.exe
  C:\Windows\System\EyGVaFg.exe
  2⤵
  PID:7868
- C:\Windows\System\jbswRZh.exe
  C:\Windows\System\jbswRZh.exe
  2⤵
  PID:6676
- C:\Windows\System\TYsKGNi.exe
  C:\Windows\System\TYsKGNi.exe
  2⤵
  PID:8044
- C:\Windows\System\YpusinD.exe
  C:\Windows\System\YpusinD.exe
  2⤵
  PID:7844
- C:\Windows\System\NYDvkhV.exe
  C:\Windows\System\NYDvkhV.exe
  2⤵
  PID:8172
- C:\Windows\System\sBrTIRT.exe
  C:\Windows\System\sBrTIRT.exe
  2⤵
  PID:8208
- C:\Windows\System\OtHPeYM.exe
  C:\Windows\System\OtHPeYM.exe
  2⤵
  PID:8244
- C:\Windows\System\PNzCTiQ.exe
  C:\Windows\System\PNzCTiQ.exe
  2⤵
  PID:8272
- C:\Windows\System\zayKqyv.exe
  C:\Windows\System\zayKqyv.exe
  2⤵
  PID:8300
- C:\Windows\System\lvAScYu.exe
  C:\Windows\System\lvAScYu.exe
  2⤵
  PID:8328
- C:\Windows\System\tGTwNYo.exe
  C:\Windows\System\tGTwNYo.exe
  2⤵
  PID:8368
- C:\Windows\System\YzKSDZd.exe
  C:\Windows\System\YzKSDZd.exe
  2⤵
  PID:8392
- C:\Windows\System\pJdvoPp.exe
  C:\Windows\System\pJdvoPp.exe
  2⤵
  PID:8408
- C:\Windows\System\MTWgiSC.exe
  C:\Windows\System\MTWgiSC.exe
  2⤵
  PID:8428
- C:\Windows\System\FQKdBtO.exe
  C:\Windows\System\FQKdBtO.exe
  2⤵
  PID:8460
- C:\Windows\System\ixpSwZs.exe
  C:\Windows\System\ixpSwZs.exe
  2⤵
  PID:8492
- C:\Windows\System\HLcVFPm.exe
  C:\Windows\System\HLcVFPm.exe
  2⤵
  PID:8516
- C:\Windows\System\EThZMDy.exe
  C:\Windows\System\EThZMDy.exe
  2⤵
  PID:8544
- C:\Windows\System\qPtYfIu.exe
  C:\Windows\System\qPtYfIu.exe
  2⤵
  PID:8564
- C:\Windows\System\dzLqSNE.exe
  C:\Windows\System\dzLqSNE.exe
  2⤵
  PID:8584
- C:\Windows\System\wLMciZG.exe
  C:\Windows\System\wLMciZG.exe
  2⤵
  PID:8612
- C:\Windows\System\AwdaAmU.exe
  C:\Windows\System\AwdaAmU.exe
  2⤵
  PID:8636
- C:\Windows\System\ydAdOUs.exe
  C:\Windows\System\ydAdOUs.exe
  2⤵
  PID:8660
- C:\Windows\System\btnQWkH.exe
  C:\Windows\System\btnQWkH.exe
  2⤵
  PID:8692
- C:\Windows\System\UWlWIjL.exe
  C:\Windows\System\UWlWIjL.exe
  2⤵
  PID:8720
- C:\Windows\System\sDGGzib.exe
  C:\Windows\System\sDGGzib.exe
  2⤵
  PID:8744
- C:\Windows\System\zssOTpK.exe
  C:\Windows\System\zssOTpK.exe
  2⤵
  PID:8776
- C:\Windows\System\yOTnaxR.exe
  C:\Windows\System\yOTnaxR.exe
  2⤵
  PID:8808
- C:\Windows\System\ZjGnhgf.exe
  C:\Windows\System\ZjGnhgf.exe
  2⤵
  PID:8840
- C:\Windows\System\PFvmxiE.exe
  C:\Windows\System\PFvmxiE.exe
  2⤵
  PID:8860
- C:\Windows\System\zJfnRWP.exe
  C:\Windows\System\zJfnRWP.exe
  2⤵
  PID:8888
- C:\Windows\System\LqDJCsP.exe
  C:\Windows\System\LqDJCsP.exe
  2⤵
  PID:8916
- C:\Windows\System\TIuDwfe.exe
  C:\Windows\System\TIuDwfe.exe
  2⤵
  PID:8944
- C:\Windows\System\fNsbWHi.exe
  C:\Windows\System\fNsbWHi.exe
  2⤵
  PID:8968
- C:\Windows\System\xlHxAqy.exe
  C:\Windows\System\xlHxAqy.exe
  2⤵
  PID:9000
- C:\Windows\System\hSoQGtQ.exe
  C:\Windows\System\hSoQGtQ.exe
  2⤵
  PID:9024
- C:\Windows\System\yRlJfPJ.exe
  C:\Windows\System\yRlJfPJ.exe
  2⤵
  PID:9048
- C:\Windows\System\IPxYCQv.exe
  C:\Windows\System\IPxYCQv.exe
  2⤵
  PID:9076
- C:\Windows\System\bfsqujx.exe
  C:\Windows\System\bfsqujx.exe
  2⤵
  PID:9108
- C:\Windows\System\beEKlEH.exe
  C:\Windows\System\beEKlEH.exe
  2⤵
  PID:9132
- C:\Windows\System\cneyCmv.exe
  C:\Windows\System\cneyCmv.exe
  2⤵
  PID:9160
- C:\Windows\System\rHSYutN.exe
  C:\Windows\System\rHSYutN.exe
  2⤵
  PID:9180
- C:\Windows\System\DgIDEHw.exe
  C:\Windows\System\DgIDEHw.exe
  2⤵
  PID:9208
- C:\Windows\System\hJgsbKg.exe
  C:\Windows\System\hJgsbKg.exe
  2⤵
  PID:7512
- C:\Windows\System\dovxrgx.exe
  C:\Windows\System\dovxrgx.exe
  2⤵
  PID:8092
- C:\Windows\System\zPuznnG.exe
  C:\Windows\System\zPuznnG.exe
  2⤵
  PID:7992
- C:\Windows\System\fULOPSF.exe
  C:\Windows\System\fULOPSF.exe
  2⤵
  PID:7220
- C:\Windows\System\wkAjNXk.exe
  C:\Windows\System\wkAjNXk.exe
  2⤵
  PID:8224
- C:\Windows\System\vORZRRL.exe
  C:\Windows\System\vORZRRL.exe
  2⤵
  PID:6544
- C:\Windows\System\pSgPjEM.exe
  C:\Windows\System\pSgPjEM.exe
  2⤵
  PID:8312
- C:\Windows\System\OxwkUBr.exe
  C:\Windows\System\OxwkUBr.exe
  2⤵
  PID:8344
- C:\Windows\System\UOLRMXZ.exe
  C:\Windows\System\UOLRMXZ.exe
  2⤵
  PID:7528
- C:\Windows\System\QtjdsGi.exe
  C:\Windows\System\QtjdsGi.exe
  2⤵
  PID:8404
- C:\Windows\System\hrAWfWn.exe
  C:\Windows\System\hrAWfWn.exe
  2⤵
  PID:8468
- C:\Windows\System\dUsSVwq.exe
  C:\Windows\System\dUsSVwq.exe
  2⤵
  PID:8260
- C:\Windows\System\BXLbxSj.exe
  C:\Windows\System\BXLbxSj.exe
  2⤵
  PID:8436
- C:\Windows\System\jnbHWSa.exe
  C:\Windows\System\jnbHWSa.exe
  2⤵
  PID:8504
- C:\Windows\System\UiglCiL.exe
  C:\Windows\System\UiglCiL.exe
  2⤵
  PID:8552
- C:\Windows\System\uNozJyb.exe
  C:\Windows\System\uNozJyb.exe
  2⤵
  PID:8652
- C:\Windows\System\QIvmbFj.exe
  C:\Windows\System\QIvmbFj.exe
  2⤵
  PID:8712
- C:\Windows\System\VOoQCVQ.exe
  C:\Windows\System\VOoQCVQ.exe
  2⤵
  PID:8988
- C:\Windows\System\mmTbOEt.exe
  C:\Windows\System\mmTbOEt.exe
  2⤵
  PID:8784
- C:\Windows\System\SeZWQvh.exe
  C:\Windows\System\SeZWQvh.exe
  2⤵
  PID:9064
- C:\Windows\System\HRaJKQu.exe
  C:\Windows\System\HRaJKQu.exe
  2⤵
  PID:8848
- C:\Windows\System\VSgjeWb.exe
  C:\Windows\System\VSgjeWb.exe
  2⤵
  PID:9176
- C:\Windows\System\ihzVYVj.exe
  C:\Windows\System\ihzVYVj.exe
  2⤵
  PID:7716
- C:\Windows\System\CbckinA.exe
  C:\Windows\System\CbckinA.exe
  2⤵
  PID:8912
- C:\Windows\System\pegBxvw.exe
  C:\Windows\System\pegBxvw.exe
  2⤵
  PID:9152
- C:\Windows\System\eMOqVJY.exe
  C:\Windows\System\eMOqVJY.exe
  2⤵
  PID:8280
- C:\Windows\System\fTCishe.exe
  C:\Windows\System\fTCishe.exe
  2⤵
  PID:9228
- C:\Windows\System\xXZBwbz.exe
  C:\Windows\System\xXZBwbz.exe
  2⤵
  PID:9260
- C:\Windows\System\CLxNhQn.exe
  C:\Windows\System\CLxNhQn.exe
  2⤵
  PID:9280
- C:\Windows\System\FoWBPcO.exe
  C:\Windows\System\FoWBPcO.exe
  2⤵
  PID:9304
- C:\Windows\System\NKMSsUD.exe
  C:\Windows\System\NKMSsUD.exe
  2⤵
  PID:9336
- C:\Windows\System\raSITCa.exe
  C:\Windows\System\raSITCa.exe
  2⤵
  PID:9368
- C:\Windows\System\zZQEElw.exe
  C:\Windows\System\zZQEElw.exe
  2⤵
  PID:9392
- C:\Windows\System\zcZzjhk.exe
  C:\Windows\System\zcZzjhk.exe
  2⤵
  PID:9424
- C:\Windows\System\HKesJbp.exe
  C:\Windows\System\HKesJbp.exe
  2⤵
  PID:9448
- C:\Windows\System\ehgiOuJ.exe
  C:\Windows\System\ehgiOuJ.exe
  2⤵
  PID:9476
- C:\Windows\System\iCDkKJV.exe
  C:\Windows\System\iCDkKJV.exe
  2⤵
  PID:9496
- C:\Windows\System\ErOptPQ.exe
  C:\Windows\System\ErOptPQ.exe
  2⤵
  PID:9524
- C:\Windows\System\fMADMow.exe
  C:\Windows\System\fMADMow.exe
  2⤵
  PID:9552
- C:\Windows\System\DDcaWhC.exe
  C:\Windows\System\DDcaWhC.exe
  2⤵
  PID:9580
- C:\Windows\System\IGeXjxH.exe
  C:\Windows\System\IGeXjxH.exe
  2⤵
  PID:9612
- C:\Windows\System\cxGDbFe.exe
  C:\Windows\System\cxGDbFe.exe
  2⤵
  PID:9640
- C:\Windows\System\DLrIYdr.exe
  C:\Windows\System\DLrIYdr.exe
  2⤵
  PID:9660
- C:\Windows\System\ZwLaFyI.exe
  C:\Windows\System\ZwLaFyI.exe
  2⤵
  PID:9692
- C:\Windows\System\eilDsUj.exe
  C:\Windows\System\eilDsUj.exe
  2⤵
  PID:9724
- C:\Windows\System\fuKwqpv.exe
  C:\Windows\System\fuKwqpv.exe
  2⤵
  PID:9744
- C:\Windows\System\ChbjtFt.exe
  C:\Windows\System\ChbjtFt.exe
  2⤵
  PID:9772
- C:\Windows\System\SsDUAJp.exe
  C:\Windows\System\SsDUAJp.exe
  2⤵
  PID:9804
- C:\Windows\System\CSpYwxJ.exe
  C:\Windows\System\CSpYwxJ.exe
  2⤵
  PID:9832
- C:\Windows\System\vhmTicC.exe
  C:\Windows\System\vhmTicC.exe
  2⤵
  PID:9856
- C:\Windows\System\mingZSg.exe
  C:\Windows\System\mingZSg.exe
  2⤵
  PID:9872
- C:\Windows\System\svpeOCh.exe
  C:\Windows\System\svpeOCh.exe
  2⤵
  PID:9896
- C:\Windows\System\eRzvBQc.exe
  C:\Windows\System\eRzvBQc.exe
  2⤵
  PID:9928
- C:\Windows\System\KDIpecK.exe
  C:\Windows\System\KDIpecK.exe
  2⤵
  PID:9956
- C:\Windows\System\VXZcxTb.exe
  C:\Windows\System\VXZcxTb.exe
  2⤵
  PID:9988
- C:\Windows\System\TMJMUEK.exe
  C:\Windows\System\TMJMUEK.exe
  2⤵
  PID:10012
- C:\Windows\System\spOcTUD.exe
  C:\Windows\System\spOcTUD.exe
  2⤵
  PID:10044
- C:\Windows\System\DLsuqFa.exe
  C:\Windows\System\DLsuqFa.exe
  2⤵
  PID:10060
- C:\Windows\System\twMmNcc.exe
  C:\Windows\System\twMmNcc.exe
  2⤵
  PID:10084
- C:\Windows\System\ttYgBrE.exe
  C:\Windows\System\ttYgBrE.exe
  2⤵
  PID:10112
- C:\Windows\System\NsbRruZ.exe
  C:\Windows\System\NsbRruZ.exe
  2⤵
  PID:10144
- C:\Windows\System\SZFucKt.exe
  C:\Windows\System\SZFucKt.exe
  2⤵
  PID:10168
- C:\Windows\System\kkJNvAC.exe
  C:\Windows\System\kkJNvAC.exe
  2⤵
  PID:10188
- C:\Windows\System\BZWRVfu.exe
  C:\Windows\System\BZWRVfu.exe
  2⤵
  PID:10216
- C:\Windows\System\bwIPdNj.exe
  C:\Windows\System\bwIPdNj.exe
  2⤵
  PID:10236
- C:\Windows\System\NjlxTXb.exe
  C:\Windows\System\NjlxTXb.exe
  2⤵
  PID:8964
- C:\Windows\System\KWUbvVo.exe
  C:\Windows\System\KWUbvVo.exe
  2⤵
  PID:9092
- C:\Windows\System\KMSRTfx.exe
  C:\Windows\System\KMSRTfx.exe
  2⤵
  PID:6492
- C:\Windows\System\YHNfhNS.exe
  C:\Windows\System\YHNfhNS.exe
  2⤵
  PID:9128
- C:\Windows\System\iBCxMRb.exe
  C:\Windows\System\iBCxMRb.exe
  2⤵
  PID:7440
- C:\Windows\System\vqJtGet.exe
  C:\Windows\System\vqJtGet.exe
  2⤵
  PID:8960
- C:\Windows\System\edsFGHS.exe
  C:\Windows\System\edsFGHS.exe
  2⤵
  PID:9360
- C:\Windows\System\BYmBnXK.exe
  C:\Windows\System\BYmBnXK.exe
  2⤵
  PID:9400
- C:\Windows\System\IwEaDNF.exe
  C:\Windows\System\IwEaDNF.exe
  2⤵
  PID:9444
- C:\Windows\System\pcOKuVI.exe
  C:\Windows\System\pcOKuVI.exe
  2⤵
  PID:8884
- C:\Windows\System\ETlweju.exe
  C:\Windows\System\ETlweju.exe
  2⤵
  PID:8336
- C:\Windows\System\TUNzwKx.exe
  C:\Windows\System\TUNzwKx.exe
  2⤵
  PID:9576
- C:\Windows\System\WTWzBOx.exe
  C:\Windows\System\WTWzBOx.exe
  2⤵
  PID:9256
- C:\Windows\System\OeAECzd.exe
  C:\Windows\System\OeAECzd.exe
  2⤵
  PID:9764
- C:\Windows\System\KCnvLBz.exe
  C:\Windows\System\KCnvLBz.exe
  2⤵
  PID:9508
- C:\Windows\System\EQfMOzT.exe
  C:\Windows\System\EQfMOzT.exe
  2⤵
  PID:9236
- C:\Windows\System\esRNvNq.exe
  C:\Windows\System\esRNvNq.exe
  2⤵
  PID:9684
- C:\Windows\System\JnZXoqU.exe
  C:\Windows\System\JnZXoqU.exe
  2⤵
  PID:9712
- C:\Windows\System\xCHYszM.exe
  C:\Windows\System\xCHYszM.exe
  2⤵
  PID:10128
- C:\Windows\System\vmOtOXf.exe
  C:\Windows\System\vmOtOXf.exe
  2⤵
  PID:9912
- C:\Windows\System\Grrvnnw.exe
  C:\Windows\System\Grrvnnw.exe
  2⤵
  PID:9592
- C:\Windows\System\jGSzeRS.exe
  C:\Windows\System\jGSzeRS.exe
  2⤵
  PID:10004
- C:\Windows\System\PuUjVFX.exe
  C:\Windows\System\PuUjVFX.exe
  2⤵
  PID:10052
- C:\Windows\System\ZsTsBnN.exe
  C:\Windows\System\ZsTsBnN.exe
  2⤵
  PID:10096
- C:\Windows\System\wDIJOhJ.exe
  C:\Windows\System\wDIJOhJ.exe
  2⤵
  PID:10244
- C:\Windows\System\NPZMdBY.exe
  C:\Windows\System\NPZMdBY.exe
  2⤵
  PID:10260
- C:\Windows\System\jFgMwYC.exe
  C:\Windows\System\jFgMwYC.exe
  2⤵
  PID:10284
- C:\Windows\System\ShxLivf.exe
  C:\Windows\System\ShxLivf.exe
  2⤵
  PID:10312
- C:\Windows\System\DjXKlaA.exe
  C:\Windows\System\DjXKlaA.exe
  2⤵
  PID:10344
- C:\Windows\System\vsqdDtp.exe
  C:\Windows\System\vsqdDtp.exe
  2⤵
  PID:10364
- C:\Windows\System\GdHlFsp.exe
  C:\Windows\System\GdHlFsp.exe
  2⤵
  PID:10384
- C:\Windows\System\CVyDbdz.exe
  C:\Windows\System\CVyDbdz.exe
  2⤵
  PID:10404
- C:\Windows\System\GvEKWdI.exe
  C:\Windows\System\GvEKWdI.exe
  2⤵
  PID:10420
- C:\Windows\System\trudSXP.exe
  C:\Windows\System\trudSXP.exe
  2⤵
  PID:10460
- C:\Windows\System\WskYJPa.exe
  C:\Windows\System\WskYJPa.exe
  2⤵
  PID:10484
- C:\Windows\System\brLvdTX.exe
  C:\Windows\System\brLvdTX.exe
  2⤵
  PID:10512
- C:\Windows\System\VFvQruh.exe
  C:\Windows\System\VFvQruh.exe
  2⤵
  PID:10540
- C:\Windows\System\ooaRvyz.exe
  C:\Windows\System\ooaRvyz.exe
  2⤵
  PID:10556
- C:\Windows\System\aaZvgnv.exe
  C:\Windows\System\aaZvgnv.exe
  2⤵
  PID:10588
- C:\Windows\System\KreXZBB.exe
  C:\Windows\System\KreXZBB.exe
  2⤵
  PID:10608
- C:\Windows\System\tuuuAOR.exe
  C:\Windows\System\tuuuAOR.exe
  2⤵
  PID:10644
- C:\Windows\System\RLxgGYF.exe
  C:\Windows\System\RLxgGYF.exe
  2⤵
  PID:11024
- C:\Windows\System\MzaNmLj.exe
  C:\Windows\System\MzaNmLj.exe
  2⤵
  PID:11040
- C:\Windows\System\HXVjfgb.exe
  C:\Windows\System\HXVjfgb.exe
  2⤵
  PID:11056
- C:\Windows\System\eGrtWzF.exe
  C:\Windows\System\eGrtWzF.exe
  2⤵
  PID:11080
- C:\Windows\System\VHfEuEf.exe
  C:\Windows\System\VHfEuEf.exe
  2⤵
  PID:11104
- C:\Windows\System\KHSuoOt.exe
  C:\Windows\System\KHSuoOt.exe
  2⤵
  PID:11136
- C:\Windows\System\mbcXEVM.exe
  C:\Windows\System\mbcXEVM.exe
  2⤵
  PID:11152
- C:\Windows\System\TCFwdJK.exe
  C:\Windows\System\TCFwdJK.exe
  2⤵
  PID:11172
- C:\Windows\System\SnsJECW.exe
  C:\Windows\System\SnsJECW.exe
  2⤵
  PID:11200
- C:\Windows\System\NxbzFpu.exe
  C:\Windows\System\NxbzFpu.exe
  2⤵
  PID:11228
- C:\Windows\System\qzuGvRR.exe
  C:\Windows\System\qzuGvRR.exe
  2⤵
  PID:11256
- C:\Windows\System\ZvzkTAB.exe
  C:\Windows\System\ZvzkTAB.exe
  2⤵
  PID:9892
- C:\Windows\System\RbtFPAs.exe
  C:\Windows\System\RbtFPAs.exe
  2⤵
  PID:9976
- C:\Windows\System\ChVaDTn.exe
  C:\Windows\System\ChVaDTn.exe
  2⤵
  PID:9100
- C:\Windows\System\SSuqubx.exe
  C:\Windows\System\SSuqubx.exe
  2⤵
  PID:9272
- C:\Windows\System\KvtXFtj.exe
  C:\Windows\System\KvtXFtj.exe
  2⤵
  PID:9388
- C:\Windows\System\htMrlYX.exe
  C:\Windows\System\htMrlYX.exe
  2⤵
  PID:10164
- C:\Windows\System\vgmhpOu.exe
  C:\Windows\System\vgmhpOu.exe
  2⤵
  PID:9756
- C:\Windows\System\VSwEQuv.exe
  C:\Windows\System\VSwEQuv.exe
  2⤵
  PID:8820
- C:\Windows\System\DNQhrtP.exe
  C:\Windows\System\DNQhrtP.exe
  2⤵
  PID:9548
- C:\Windows\System\SITuAQQ.exe
  C:\Windows\System\SITuAQQ.exe
  2⤵
  PID:10300
- C:\Windows\System\BSzDokS.exe
  C:\Windows\System\BSzDokS.exe
  2⤵
  PID:10380
- C:\Windows\System\mgFwASo.exe
  C:\Windows\System\mgFwASo.exe
  2⤵
  PID:9348
- C:\Windows\System\bFdAtbl.exe
  C:\Windows\System\bFdAtbl.exe
  2⤵
  PID:9656
- C:\Windows\System\IrfmBDd.exe
  C:\Windows\System\IrfmBDd.exe
  2⤵
  PID:10760
- C:\Windows\System\klZTgzr.exe
  C:\Windows\System\klZTgzr.exe
  2⤵
  PID:10804
- C:\Windows\System\KVRkxNA.exe
  C:\Windows\System\KVRkxNA.exe
  2⤵
  PID:10356
- C:\Windows\System\tNhfckZ.exe
  C:\Windows\System\tNhfckZ.exe
  2⤵
  PID:10440
- C:\Windows\System\TpwPZZe.exe
  C:\Windows\System\TpwPZZe.exe
  2⤵
  PID:10496
- C:\Windows\System\kLefABB.exe
  C:\Windows\System\kLefABB.exe
  2⤵
  PID:10552
- C:\Windows\System\lbuIJLl.exe
  C:\Windows\System\lbuIJLl.exe
  2⤵
  PID:10600
- C:\Windows\System\aSAXWEd.exe
  C:\Windows\System\aSAXWEd.exe
  2⤵
  PID:10840
- C:\Windows\System\yuRFPvT.exe
  C:\Windows\System\yuRFPvT.exe
  2⤵
  PID:10908
- C:\Windows\System\DkGcEGw.exe
  C:\Windows\System\DkGcEGw.exe
  2⤵
  PID:10852
- C:\Windows\System\zULjyDr.exe
  C:\Windows\System\zULjyDr.exe
  2⤵
  PID:11180
- C:\Windows\System\AUCphpD.exe
  C:\Windows\System\AUCphpD.exe
  2⤵
  PID:8532
- C:\Windows\System\GanUttk.exe
  C:\Windows\System\GanUttk.exe
  2⤵
  PID:9852
- C:\Windows\System\HioPNUQ.exe
  C:\Windows\System\HioPNUQ.exe
  2⤵
  PID:11048
- C:\Windows\System\fKcdXRd.exe
  C:\Windows\System\fKcdXRd.exe
  2⤵
  PID:11196
- C:\Windows\System\BVxeOSs.exe
  C:\Windows\System\BVxeOSs.exe
  2⤵
  PID:9380
- C:\Windows\System\QBYlXbF.exe
  C:\Windows\System\QBYlXbF.exe
  2⤵
  PID:10376
- C:\Windows\System\cYCQuhW.exe
  C:\Windows\System\cYCQuhW.exe
  2⤵
  PID:9788
- C:\Windows\System\oyIyWXR.exe
  C:\Windows\System\oyIyWXR.exe
  2⤵
  PID:9140
- C:\Windows\System\nymGiiU.exe
  C:\Windows\System\nymGiiU.exe
  2⤵
  PID:7416
- C:\Windows\System\eWawwwN.exe
  C:\Windows\System\eWawwwN.exe
  2⤵
  PID:10604
- C:\Windows\System\tjClwhb.exe
  C:\Windows\System\tjClwhb.exe
  2⤵
  PID:10252
- C:\Windows\System\pkOpnhv.exe
  C:\Windows\System\pkOpnhv.exe
  2⤵
  PID:11248
- C:\Windows\System\bFAEnLu.exe
  C:\Windows\System\bFAEnLu.exe
  2⤵
  PID:11272
- C:\Windows\System\snpbQUR.exe
  C:\Windows\System\snpbQUR.exe
  2⤵
  PID:11300
- C:\Windows\System\EhgyRAD.exe
  C:\Windows\System\EhgyRAD.exe
  2⤵
  PID:11328
- C:\Windows\System\EGQCvUE.exe
  C:\Windows\System\EGQCvUE.exe
  2⤵
  PID:11356
- C:\Windows\System\wjtCxWJ.exe
  C:\Windows\System\wjtCxWJ.exe
  2⤵
  PID:11384
- C:\Windows\System\SKEpKUX.exe
  C:\Windows\System\SKEpKUX.exe
  2⤵
  PID:11404
- C:\Windows\System\DbPxPcx.exe
  C:\Windows\System\DbPxPcx.exe
  2⤵
  PID:11432
- C:\Windows\System\kWaJvwg.exe
  C:\Windows\System\kWaJvwg.exe
  2⤵
  PID:11448
- C:\Windows\System\vJhOxex.exe
  C:\Windows\System\vJhOxex.exe
  2⤵
  PID:11476
- C:\Windows\System\PEoZFmr.exe
  C:\Windows\System\PEoZFmr.exe
  2⤵
  PID:11512
- C:\Windows\System\rToRpSR.exe
  C:\Windows\System\rToRpSR.exe
  2⤵
  PID:11536
- C:\Windows\System\ByuxCxK.exe
  C:\Windows\System\ByuxCxK.exe
  2⤵
  PID:11560
- C:\Windows\System\WnuJexJ.exe
  C:\Windows\System\WnuJexJ.exe
  2⤵
  PID:11588
- C:\Windows\System\fbenJtO.exe
  C:\Windows\System\fbenJtO.exe
  2⤵
  PID:11632
- C:\Windows\System\zEFFKKF.exe
  C:\Windows\System\zEFFKKF.exe
  2⤵
  PID:11648
- C:\Windows\System\wwfdtIa.exe
  C:\Windows\System\wwfdtIa.exe
  2⤵
  PID:11676
- C:\Windows\System\oRWpVse.exe
  C:\Windows\System\oRWpVse.exe
  2⤵
  PID:11700
- C:\Windows\System\PjluVqp.exe
  C:\Windows\System\PjluVqp.exe
  2⤵
  PID:11724
- C:\Windows\System\WoOaFzx.exe
  C:\Windows\System\WoOaFzx.exe
  2⤵
  PID:11752
- C:\Windows\System\KaLfRev.exe
  C:\Windows\System\KaLfRev.exe
  2⤵
  PID:11780
- C:\Windows\System\IkBYbXi.exe
  C:\Windows\System\IkBYbXi.exe
  2⤵
  PID:11804
- C:\Windows\System\mBFCLRH.exe
  C:\Windows\System\mBFCLRH.exe
  2⤵
  PID:11832
- C:\Windows\System\hZapTMW.exe
  C:\Windows\System\hZapTMW.exe
  2⤵
  PID:11856
- C:\Windows\System\xtPQaTC.exe
  C:\Windows\System\xtPQaTC.exe
  2⤵
  PID:11876
- C:\Windows\System\cDGplnX.exe
  C:\Windows\System\cDGplnX.exe
  2⤵
  PID:11896
- C:\Windows\System\tSapExP.exe
  C:\Windows\System\tSapExP.exe
  2⤵
  PID:11920
- C:\Windows\System\ZdKTuHZ.exe
  C:\Windows\System\ZdKTuHZ.exe
  2⤵
  PID:11956
- C:\Windows\System\YpwMpkj.exe
  C:\Windows\System\YpwMpkj.exe
  2⤵
  PID:11984
- C:\Windows\System\UorKErO.exe
  C:\Windows\System\UorKErO.exe
  2⤵
  PID:12016
- C:\Windows\System\mHbWQjN.exe
  C:\Windows\System\mHbWQjN.exe
  2⤵
  PID:12044
- C:\Windows\System\rrpBCPh.exe
  C:\Windows\System\rrpBCPh.exe
  2⤵
  PID:12072
- C:\Windows\System\sEJGjBx.exe
  C:\Windows\System\sEJGjBx.exe
  2⤵
  PID:12100
- C:\Windows\System\ujxtYJU.exe
  C:\Windows\System\ujxtYJU.exe
  2⤵
  PID:12128
- C:\Windows\System\JhwRiSV.exe
  C:\Windows\System\JhwRiSV.exe
  2⤵
  PID:12156
- C:\Windows\System\sYzfrcW.exe
  C:\Windows\System\sYzfrcW.exe
  2⤵
  PID:12172
- C:\Windows\System\SyczhTK.exe
  C:\Windows\System\SyczhTK.exe
  2⤵
  PID:12196
- C:\Windows\System\ZuQpDba.exe
  C:\Windows\System\ZuQpDba.exe
  2⤵
  PID:12220
- C:\Windows\System\zfcAdFS.exe
  C:\Windows\System\zfcAdFS.exe
  2⤵
  PID:12248
- C:\Windows\System\juuyofa.exe
  C:\Windows\System\juuyofa.exe
  2⤵
  PID:12264
- C:\Windows\System\cKXLZWB.exe
  C:\Windows\System\cKXLZWB.exe
  2⤵
  PID:10632
- C:\Windows\System\HiUsgUA.exe
  C:\Windows\System\HiUsgUA.exe
  2⤵
  PID:9868
- C:\Windows\System\adbuZPl.exe
  C:\Windows\System\adbuZPl.exe
  2⤵
  PID:9560
- C:\Windows\System\GPGToKs.exe
  C:\Windows\System\GPGToKs.exe
  2⤵
  PID:11224
- C:\Windows\System\BeTIRyU.exe
  C:\Windows\System\BeTIRyU.exe
  2⤵
  PID:9940
- C:\Windows\System\YvLbCJG.exe
  C:\Windows\System\YvLbCJG.exe
  2⤵
  PID:10352
- C:\Windows\System\VsOhQpk.exe
  C:\Windows\System\VsOhQpk.exe
  2⤵
  PID:11392
- C:\Windows\System\sxrRiJB.exe
  C:\Windows\System\sxrRiJB.exe
  2⤵
  PID:11368
- C:\Windows\System\dHLlAhT.exe
  C:\Windows\System\dHLlAhT.exe
  2⤵
  PID:11460
- C:\Windows\System\qjbdZNO.exe
  C:\Windows\System\qjbdZNO.exe
  2⤵
  PID:11520
- C:\Windows\System\eaYTJUR.exe
  C:\Windows\System\eaYTJUR.exe
  2⤵
  PID:11576
- C:\Windows\System\xBETzMS.exe
  C:\Windows\System\xBETzMS.exe
  2⤵
  PID:10276
- C:\Windows\System\oLnvLRG.exe
  C:\Windows\System\oLnvLRG.exe
  2⤵
  PID:11444
- C:\Windows\System\TOKhgPj.exe
  C:\Windows\System\TOKhgPj.exe
  2⤵
  PID:11532
- C:\Windows\System\AYwfMUE.exe
  C:\Windows\System\AYwfMUE.exe
  2⤵
  PID:11928
- C:\Windows\System\WqszGoV.exe
  C:\Windows\System\WqszGoV.exe
  2⤵
  PID:11968
- C:\Windows\System\igqLBpi.exe
  C:\Windows\System\igqLBpi.exe
  2⤵
  PID:12108
- C:\Windows\System\ZdIDilD.exe
  C:\Windows\System\ZdIDilD.exe
  2⤵
  PID:12192
- C:\Windows\System\PVoJAgK.exe
  C:\Windows\System\PVoJAgK.exe
  2⤵
  PID:11864
- C:\Windows\System\ymNTtXz.exe
  C:\Windows\System\ymNTtXz.exe
  2⤵
  PID:11788
- C:\Windows\System\HUtqGMb.exe
  C:\Windows\System\HUtqGMb.exe
  2⤵
  PID:11888
- C:\Windows\System\LpqDyxv.exe
  C:\Windows\System\LpqDyxv.exe
  2⤵
  PID:10280
- C:\Windows\System\OWiBZrB.exe
  C:\Windows\System\OWiBZrB.exe
  2⤵
  PID:10472
- C:\Windows\System\ZQSILeD.exe
  C:\Windows\System\ZQSILeD.exe
  2⤵
  PID:11164
- C:\Windows\System\BQWdqeJ.exe
  C:\Windows\System\BQWdqeJ.exe
  2⤵
  PID:12144
- C:\Windows\System\EGjoEyE.exe
  C:\Windows\System\EGjoEyE.exe
  2⤵
  PID:11556
- C:\Windows\System\KxSVcOU.exe
  C:\Windows\System\KxSVcOU.exe
  2⤵
  PID:12296
- C:\Windows\System\CVkOwsb.exe
  C:\Windows\System\CVkOwsb.exe
  2⤵
  PID:12320
- C:\Windows\System\MKtpAtZ.exe
  C:\Windows\System\MKtpAtZ.exe
  2⤵
  PID:12340
- C:\Windows\System\RVHPCOo.exe
  C:\Windows\System\RVHPCOo.exe
  2⤵
  PID:12360
- C:\Windows\System\TCYMBXG.exe
  C:\Windows\System\TCYMBXG.exe
  2⤵
  PID:12384
- C:\Windows\System\BNSdkxx.exe
  C:\Windows\System\BNSdkxx.exe
  2⤵
  PID:12400
- C:\Windows\System\qMNhhuv.exe
  C:\Windows\System\qMNhhuv.exe
  2⤵
  PID:12424
- C:\Windows\System\addDzXS.exe
  C:\Windows\System\addDzXS.exe
  2⤵
  PID:12448
- C:\Windows\System\lraaiQK.exe
  C:\Windows\System\lraaiQK.exe
  2⤵
  PID:12468
- C:\Windows\System\fskETBM.exe
  C:\Windows\System\fskETBM.exe
  2⤵
  PID:12504
- C:\Windows\System\OVwQEgN.exe
  C:\Windows\System\OVwQEgN.exe
  2⤵
  PID:12528
- C:\Windows\System\GfRUYGz.exe
  C:\Windows\System\GfRUYGz.exe
  2⤵
  PID:12556
- C:\Windows\System\sllyoGr.exe
  C:\Windows\System\sllyoGr.exe
  2⤵
  PID:12580
- C:\Windows\System\GajuDaf.exe
  C:\Windows\System\GajuDaf.exe
  2⤵
  PID:12608
- C:\Windows\System\KrsRnmF.exe
  C:\Windows\System\KrsRnmF.exe
  2⤵
  PID:12636
- C:\Windows\System\dMfJynr.exe
  C:\Windows\System\dMfJynr.exe
  2⤵
  PID:12656
- C:\Windows\System\dVoKSWk.exe
  C:\Windows\System\dVoKSWk.exe
  2⤵
  PID:12680
- C:\Windows\System\ACyCmDm.exe
  C:\Windows\System\ACyCmDm.exe
  2⤵
  PID:12712
- C:\Windows\System\uFgfaZg.exe
  C:\Windows\System\uFgfaZg.exe
  2⤵
  PID:12728
- C:\Windows\System\qOryCXC.exe
  C:\Windows\System\qOryCXC.exe
  2⤵
  PID:12748
- C:\Windows\System\MxxDwfb.exe
  C:\Windows\System\MxxDwfb.exe
  2⤵
  PID:12772
- C:\Windows\System\QmWTCHY.exe
  C:\Windows\System\QmWTCHY.exe
  2⤵
  PID:12792
- C:\Windows\System\YkDwxlO.exe
  C:\Windows\System\YkDwxlO.exe
  2⤵
  PID:12816
- C:\Windows\System\vuGukGM.exe
  C:\Windows\System\vuGukGM.exe
  2⤵
  PID:12844
- C:\Windows\System\bKgSKXW.exe
  C:\Windows\System\bKgSKXW.exe
  2⤵
  PID:12872
- C:\Windows\System\BqGEktj.exe
  C:\Windows\System\BqGEktj.exe
  2⤵
  PID:12904
- C:\Windows\System\whIPCox.exe
  C:\Windows\System\whIPCox.exe
  2⤵
  PID:12928
- C:\Windows\System\muPFYdm.exe
  C:\Windows\System\muPFYdm.exe
  2⤵
  PID:12956
- C:\Windows\System\pajcSPM.exe
  C:\Windows\System\pajcSPM.exe
  2⤵
  PID:12984
- C:\Windows\System\GrnvgsD.exe
  C:\Windows\System\GrnvgsD.exe
  2⤵
  PID:13016
- C:\Windows\System\NDGdZRk.exe
  C:\Windows\System\NDGdZRk.exe
  2⤵
  PID:13040
- C:\Windows\System\IqPGneu.exe
  C:\Windows\System\IqPGneu.exe
  2⤵
  PID:13064
- C:\Windows\System\hJFqSIG.exe
  C:\Windows\System\hJFqSIG.exe
  2⤵
  PID:13088
- C:\Windows\System\plGEnpl.exe
  C:\Windows\System\plGEnpl.exe
  2⤵
  PID:13104
- C:\Windows\System\QmTiBlZ.exe
  C:\Windows\System\QmTiBlZ.exe
  2⤵
  PID:13120
- C:\Windows\System\tgpoOwd.exe
  C:\Windows\System\tgpoOwd.exe
  2⤵
  PID:13144
- C:\Windows\System\EZrquXR.exe
  C:\Windows\System\EZrquXR.exe
  2⤵
  PID:13164
- C:\Windows\System\qAAsLGH.exe
  C:\Windows\System\qAAsLGH.exe
  2⤵
  PID:13180
- C:\Windows\System\iEJUkmf.exe
  C:\Windows\System\iEJUkmf.exe
  2⤵
  PID:13196
- C:\Windows\System\YqSBqDD.exe
  C:\Windows\System\YqSBqDD.exe
  2⤵
  PID:13228
- C:\Windows\System\fUnlCjH.exe
  C:\Windows\System\fUnlCjH.exe
  2⤵
  PID:13252
- C:\Windows\System\QmvdEUA.exe
  C:\Windows\System\QmvdEUA.exe
  2⤵
  PID:13272
- C:\Windows\System\KqwFEkb.exe
  C:\Windows\System\KqwFEkb.exe
  2⤵
  PID:13304
- C:\Windows\System\CVzhWOd.exe
  C:\Windows\System\CVzhWOd.exe
  2⤵
  PID:11692
- C:\Windows\System\gmeMeuu.exe
  C:\Windows\System\gmeMeuu.exe
  2⤵
  PID:11148
- C:\Windows\System\RGPSXtS.exe
  C:\Windows\System\RGPSXtS.exe
  2⤵
  PID:11944
- C:\Windows\System\osNMUDf.exe
  C:\Windows\System\osNMUDf.exe
  2⤵
  PID:11904
- C:\Windows\System\MkcijzD.exe
  C:\Windows\System\MkcijzD.exe
  2⤵
  PID:11420
- C:\Windows\System\OOgKYgV.exe
  C:\Windows\System\OOgKYgV.exe
  2⤵
  PID:11620
- C:\Windows\System\XoTDkxN.exe
  C:\Windows\System\XoTDkxN.exe
  2⤵
  PID:12392
- C:\Windows\System\PVFXJge.exe
  C:\Windows\System\PVFXJge.exe
  2⤵
  PID:1688
- C:\Windows\System\EZqjfsH.exe
  C:\Windows\System\EZqjfsH.exe
  2⤵
  PID:11976
- C:\Windows\System\fyIPeJk.exe
  C:\Windows\System\fyIPeJk.exe
  2⤵
  PID:12604
- C:\Windows\System\jwbwjOL.exe
  C:\Windows\System\jwbwjOL.exe
  2⤵
  PID:12336
- C:\Windows\System\NQYTlYh.exe
  C:\Windows\System\NQYTlYh.exe
  2⤵
  PID:12832
- C:\Windows\System\bABoxlv.exe
  C:\Windows\System\bABoxlv.exe
  2⤵
  PID:12976
- C:\Windows\System\xtxTrvF.exe
  C:\Windows\System\xtxTrvF.exe
  2⤵
  PID:12632
- C:\Windows\System\rVhTjku.exe
  C:\Windows\System\rVhTjku.exe
  2⤵
  PID:13116
- C:\Windows\System\ASATpyK.exe
  C:\Windows\System\ASATpyK.exe
  2⤵
  PID:13172
- C:\Windows\System\rOqFxLg.exe
  C:\Windows\System\rOqFxLg.exe
  2⤵
  PID:13328
- C:\Windows\System\HIUDCXF.exe
  C:\Windows\System\HIUDCXF.exe
  2⤵
  PID:13352
- C:\Windows\System\XbKLRAn.exe
  C:\Windows\System\XbKLRAn.exe
  2⤵
  PID:13384
- C:\Windows\System\kanWzjl.exe
  C:\Windows\System\kanWzjl.exe
  2⤵
  PID:13404
- C:\Windows\System\naNrQuC.exe
  C:\Windows\System\naNrQuC.exe
  2⤵
  PID:13432
- C:\Windows\System\HYHVyrG.exe
  C:\Windows\System\HYHVyrG.exe
  2⤵
  PID:13460
- C:\Windows\System\qfpYJPZ.exe
  C:\Windows\System\qfpYJPZ.exe
  2⤵
  PID:13488
- C:\Windows\System\eJOcIAi.exe
  C:\Windows\System\eJOcIAi.exe
  2⤵
  PID:13536
- C:\Windows\System\yPujaha.exe
  C:\Windows\System\yPujaha.exe
  2⤵
  PID:13568
- C:\Windows\System\iqGILAB.exe
  C:\Windows\System\iqGILAB.exe
  2⤵
  PID:13592
- C:\Windows\System\JVUulei.exe
  C:\Windows\System\JVUulei.exe
  2⤵
  PID:13620
- C:\Windows\System\vbazlTd.exe
  C:\Windows\System\vbazlTd.exe
  2⤵
  PID:13640
- C:\Windows\System\SlgnVmo.exe
  C:\Windows\System\SlgnVmo.exe
  2⤵
  PID:13664
- C:\Windows\System\yCYOoVk.exe
  C:\Windows\System\yCYOoVk.exe
  2⤵
  PID:13688
- C:\Windows\System\OSdRjTp.exe
  C:\Windows\System\OSdRjTp.exe
  2⤵
  PID:13708
- C:\Windows\System\nbkrRJJ.exe
  C:\Windows\System\nbkrRJJ.exe
  2⤵
  PID:13748
- C:\Windows\System\WEluizo.exe
  C:\Windows\System\WEluizo.exe
  2⤵
  PID:13772
- C:\Windows\System\aGTIOAX.exe
  C:\Windows\System\aGTIOAX.exe
  2⤵
  PID:13792
- C:\Windows\System\mqIIwze.exe
  C:\Windows\System\mqIIwze.exe
  2⤵
  PID:13832
- C:\Windows\System\jvKbXQS.exe
  C:\Windows\System\jvKbXQS.exe
  2⤵
  PID:13856
- C:\Windows\System\HWooKbs.exe
  C:\Windows\System\HWooKbs.exe
  2⤵
  PID:13884
- C:\Windows\System\HQRZwCq.exe
  C:\Windows\System\HQRZwCq.exe
  2⤵
  PID:13908
- C:\Windows\System\KdjPUBl.exe
  C:\Windows\System\KdjPUBl.exe
  2⤵
  PID:13928
- C:\Windows\System\sTQzfIq.exe
  C:\Windows\System\sTQzfIq.exe
  2⤵
  PID:13956
- C:\Windows\System\sGPNPJt.exe
  C:\Windows\System\sGPNPJt.exe
  2⤵
  PID:13976
- C:\Windows\System\UAYRASr.exe
  C:\Windows\System\UAYRASr.exe
  2⤵
  PID:14004
- C:\Windows\System\SWEeRvy.exe
  C:\Windows\System\SWEeRvy.exe
  2⤵
  PID:14040
- C:\Windows\System\qoYteSx.exe
  C:\Windows\System\qoYteSx.exe
  2⤵
  PID:14068
- C:\Windows\System\wtgQvmO.exe
  C:\Windows\System\wtgQvmO.exe
  2⤵
  PID:14084
- C:\Windows\System\yrLtiks.exe
  C:\Windows\System\yrLtiks.exe
  2⤵
  PID:14108
- C:\Windows\System\sMqIgSE.exe
  C:\Windows\System\sMqIgSE.exe
  2⤵
  PID:14136
- C:\Windows\System\RNLWrIp.exe
  C:\Windows\System\RNLWrIp.exe
  2⤵
  PID:14164
- C:\Windows\System\QRArNmU.exe
  C:\Windows\System\QRArNmU.exe
  2⤵
  PID:14180
- C:\Windows\System\VknlnkL.exe
  C:\Windows\System\VknlnkL.exe
  2⤵
  PID:14208
- C:\Windows\System\PGTCinC.exe
  C:\Windows\System\PGTCinC.exe
  2⤵
  PID:14244
- C:\Windows\System\KDLxNqp.exe
  C:\Windows\System\KDLxNqp.exe
  2⤵
  PID:14272
- C:\Windows\System\IbkDdlF.exe
  C:\Windows\System\IbkDdlF.exe
  2⤵
  PID:14300
- C:\Windows\System\UWPRbgJ.exe
  C:\Windows\System\UWPRbgJ.exe
  2⤵
  PID:14316
- C:\Windows\System\igBHRRL.exe
  C:\Windows\System\igBHRRL.exe
  2⤵
  PID:13208
- C:\Windows\System\tUNRVEJ.exe
  C:\Windows\System\tUNRVEJ.exe
  2⤵
  PID:13244
- C:\Windows\System\qzWtalW.exe
  C:\Windows\System\qzWtalW.exe
  2⤵
  PID:12276
- C:\Windows\System\UydHCGx.exe
  C:\Windows\System\UydHCGx.exe
  2⤵
  PID:11916
- C:\Windows\System\DmFvKSI.exe
  C:\Windows\System\DmFvKSI.exe
  2⤵
  PID:7364
- C:\Windows\System\PoEvUlN.exe
  C:\Windows\System\PoEvUlN.exe
  2⤵
  PID:12024
- C:\Windows\System\TCqtzGX.exe
  C:\Windows\System\TCqtzGX.exe
  2⤵
  PID:12368
- C:\Windows\System\EAAWhWw.exe
  C:\Windows\System\EAAWhWw.exe
  2⤵
  PID:12572
- C:\Windows\System\hOItXeS.exe
  C:\Windows\System\hOItXeS.exe
  2⤵
  PID:13152
- C:\Windows\System\dKEefTM.exe
  C:\Windows\System\dKEefTM.exe
  2⤵
  PID:13368
- C:\Windows\System\XFTWoPY.exe
  C:\Windows\System\XFTWoPY.exe
  2⤵
  PID:12884
- C:\Windows\System\FnNLbcJ.exe
  C:\Windows\System\FnNLbcJ.exe
  2⤵
  PID:13428
- C:\Windows\System\wahwMDH.exe
  C:\Windows\System\wahwMDH.exe
  2⤵
  PID:13760
- C:\Windows\System\bDrVSwK.exe
  C:\Windows\System\bDrVSwK.exe
  2⤵
  PID:13852
- C:\Windows\System\zYLfhVh.exe
  C:\Windows\System\zYLfhVh.exe
  2⤵
  PID:13532
- C:\Windows\System\lgpvGAw.exe
  C:\Windows\System\lgpvGAw.exe
  2⤵
  PID:14076
- C:\Windows\System\tLqerJY.exe
  C:\Windows\System\tLqerJY.exe
  2⤵
  PID:14124
- C:\Windows\System\UnmXeRm.exe
  C:\Windows\System\UnmXeRm.exe
  2⤵
  PID:13840
- C:\Windows\System\CZAHVkg.exe
  C:\Windows\System\CZAHVkg.exe
  2⤵
  PID:14216
- C:\Windows\System\sbDnIaN.exe
  C:\Windows\System\sbDnIaN.exe
  2⤵
  PID:13900
- C:\Windows\System\pKgkYJh.exe
  C:\Windows\System\pKgkYJh.exe
  2⤵
  PID:13444
- C:\Windows\System\vhTqHfz.exe
  C:\Windows\System\vhTqHfz.exe
  2⤵
  PID:11376
- C:\Windows\System\ySlpThv.exe
  C:\Windows\System\ySlpThv.exe
  2⤵
  PID:14048
- C:\Windows\System\PKOczWa.exe
  C:\Windows\System\PKOczWa.exe
  2⤵
  PID:13072
- C:\Windows\System\BSqSxlg.exe
  C:\Windows\System\BSqSxlg.exe
  2⤵
  PID:13188
- C:\Windows\System\aELsset.exe
  C:\Windows\System\aELsset.exe
  2⤵
  PID:13360
- C:\Windows\System\PfIKtoo.exe
  C:\Windows\System\PfIKtoo.exe
  2⤵
  PID:14356
- C:\Windows\System\jWscfEr.exe
  C:\Windows\System\jWscfEr.exe
  2⤵
  PID:14384
- C:\Windows\System\GanyPnt.exe
  C:\Windows\System\GanyPnt.exe
  2⤵
  PID:14412
- C:\Windows\System\DIMiWWU.exe
  C:\Windows\System\DIMiWWU.exe
  2⤵
  PID:14452
- C:\Windows\System\HBlTIvt.exe
  C:\Windows\System\HBlTIvt.exe
  2⤵
  PID:14476
- C:\Windows\System\dEdHuEP.exe
  C:\Windows\System\dEdHuEP.exe
  2⤵
  PID:14504
- C:\Windows\System\PKycrpW.exe
  C:\Windows\System\PKycrpW.exe
  2⤵
  PID:14532
- C:\Windows\System\tHMDgHl.exe
  C:\Windows\System\tHMDgHl.exe
  2⤵
  PID:14568
- C:\Windows\System\CjSNqzG.exe
  C:\Windows\System\CjSNqzG.exe
  2⤵
  PID:14588
- C:\Windows\System\aFDcVip.exe
  C:\Windows\System\aFDcVip.exe
  2⤵
  PID:14608
- C:\Windows\System\fwfSxFE.exe
  C:\Windows\System\fwfSxFE.exe
  2⤵
  PID:14636
- C:\Windows\System\EbvPyjG.exe
  C:\Windows\System\EbvPyjG.exe
  2⤵
  PID:14668
- C:\Windows\System\UkyvueO.exe
  C:\Windows\System\UkyvueO.exe
  2⤵
  PID:14768
- C:\Windows\System\fbbILCo.exe
  C:\Windows\System\fbbILCo.exe
  2⤵
  PID:14788
- C:\Windows\System\NFTsgwM.exe
  C:\Windows\System\NFTsgwM.exe
  2⤵
  PID:14804
- C:\Windows\System\TwjixWS.exe
  C:\Windows\System\TwjixWS.exe
  2⤵
  PID:14828
- C:\Windows\System\xihBWeU.exe
  C:\Windows\System\xihBWeU.exe
  2⤵
  PID:14864
- C:\Windows\System\JXTnbmB.exe
  C:\Windows\System\JXTnbmB.exe
  2⤵
  PID:14888
- C:\Windows\System\HiziVxt.exe
  C:\Windows\System\HiziVxt.exe
  2⤵
  PID:14924
- C:\Windows\System\IcwjQEf.exe
  C:\Windows\System\IcwjQEf.exe
  2⤵
  PID:14964
- C:\Windows\System\fcnMpxy.exe
  C:\Windows\System\fcnMpxy.exe
  2⤵
  PID:15000
- C:\Windows\System\YUCVANu.exe
  C:\Windows\System\YUCVANu.exe
  2⤵
  PID:15036
- C:\Windows\System\wudzHzC.exe
  C:\Windows\System\wudzHzC.exe
  2⤵
  PID:15076
- C:\Windows\System\PMbDslB.exe
  C:\Windows\System\PMbDslB.exe
  2⤵
  PID:15092
- C:\Windows\System\pXaWxfu.exe
  C:\Windows\System\pXaWxfu.exe
  2⤵
  PID:15108
- C:\Windows\System\OrezEOB.exe
  C:\Windows\System\OrezEOB.exe
  2⤵
  PID:15132
- C:\Windows\System\dRsIrUp.exe
  C:\Windows\System\dRsIrUp.exe
  2⤵
  PID:15164
- C:\Windows\System\UWFlNii.exe
  C:\Windows\System\UWFlNii.exe
  2⤵
  PID:15200
- C:\Windows\System\ivlpVPF.exe
  C:\Windows\System\ivlpVPF.exe
  2⤵
  PID:15220
- C:\Windows\System\LpCLrAh.exe
  C:\Windows\System\LpCLrAh.exe
  2⤵
  PID:15264
- C:\Windows\System\IrzdGFX.exe
  C:\Windows\System\IrzdGFX.exe
  2⤵
  PID:15288
- C:\Windows\System\QbMhzGI.exe
  C:\Windows\System\QbMhzGI.exe
  2⤵
  PID:15312
- C:\Windows\System\dtqLgfy.exe
  C:\Windows\System\dtqLgfy.exe
  2⤵
  PID:15332
- C:\Windows\System\XtpPrya.exe
  C:\Windows\System\XtpPrya.exe
  2⤵
  PID:15348
- C:\Windows\System\dUiJIfa.exe
  C:\Windows\System\dUiJIfa.exe
  2⤵
  PID:14312
- C:\Windows\System\TlIwaBR.exe
  C:\Windows\System\TlIwaBR.exe
  2⤵
  PID:10564
- C:\Windows\System\hcIVqZA.exe
  C:\Windows\System\hcIVqZA.exe
  2⤵
  PID:13648
- C:\Windows\System\XhxCFoP.exe
  C:\Windows\System\XhxCFoP.exe
  2⤵
  PID:11496
- C:\Windows\System\aTtlsFv.exe
  C:\Windows\System\aTtlsFv.exe
  2⤵
  PID:12620
- C:\Windows\System\WaVopdB.exe
  C:\Windows\System\WaVopdB.exe
  2⤵
  PID:13600
- C:\Windows\System\CLkITIC.exe
  C:\Windows\System\CLkITIC.exe
  2⤵
  PID:14176
- C:\Windows\System\pWWtuPR.exe
  C:\Windows\System\pWWtuPR.exe
  2⤵
  PID:14368
- C:\Windows\System\hDUJkYa.exe
  C:\Windows\System\hDUJkYa.exe
  2⤵
  PID:14528
- C:\Windows\System\McnASyN.exe
  C:\Windows\System\McnASyN.exe
  2⤵
  PID:14080
- C:\Windows\System\kIspZnY.exe
  C:\Windows\System\kIspZnY.exe
  2⤵
  PID:14632
- C:\Windows\System\lyuJukb.exe
  C:\Windows\System\lyuJukb.exe
  2⤵
  PID:14396
- C:\Windows\System\aQWHbin.exe
  C:\Windows\System\aQWHbin.exe
  2⤵
  PID:14552
- C:\Windows\System\FcOTpPQ.exe
  C:\Windows\System\FcOTpPQ.exe
  2⤵
  PID:14436
- C:\Windows\System\xlYwjqs.exe
  C:\Windows\System\xlYwjqs.exe
  2⤵
  PID:14952
- C:\Windows\System\zfDJJnF.exe
  C:\Windows\System\zfDJJnF.exe
  2⤵
  PID:15028
- C:\Windows\System\oNOecqN.exe
  C:\Windows\System\oNOecqN.exe
  2⤵
  PID:14684
- C:\Windows\System\KiOQOUk.exe
  C:\Windows\System\KiOQOUk.exe
  2⤵
  PID:14844
- C:\Windows\System\HOixPZo.exe
  C:\Windows\System\HOixPZo.exe
  2⤵
  PID:15228
- C:\Windows\System\caeLtDN.exe
  C:\Windows\System\caeLtDN.exe
  2⤵
  PID:15020
- C:\Windows\System\mkmSgQx.exe
  C:\Windows\System\mkmSgQx.exe
  2⤵
  PID:15320
- C:\Windows\System\KHibqez.exe
  C:\Windows\System\KHibqez.exe
  2⤵
  PID:14940
- C:\Windows\System\fXimYfF.exe
  C:\Windows\System\fXimYfF.exe
  2⤵
  PID:12916
- C:\Windows\System\GjEfOhu.exe
  C:\Windows\System\GjEfOhu.exe
  2⤵
  PID:8604
- C:\Windows\System\NzstQAQ.exe
  C:\Windows\System\NzstQAQ.exe
  2⤵
  PID:15304
- C:\Windows\System\lrbbCcI.exe
  C:\Windows\System\lrbbCcI.exe
  2⤵
  PID:14308
- C:\Windows\System\zzLfpPA.exe
  C:\Windows\System\zzLfpPA.exe
  2⤵
  PID:13608
- C:\Windows\System\tJHaBou.exe
  C:\Windows\System\tJHaBou.exe
  2⤵
  PID:14620
- C:\Windows\System\ZkHimEs.exe
  C:\Windows\System\ZkHimEs.exe
  2⤵
  PID:14424
- C:\Windows\System\VsPBKmC.exe
  C:\Windows\System\VsPBKmC.exe
  2⤵
  PID:12624
- C:\Windows\System\iOuNuEy.exe
  C:\Windows\System\iOuNuEy.exe
  2⤵
  PID:14584
- C:\Windows\System\MLESvnR.exe
  C:\Windows\System\MLESvnR.exe
  2⤵
  PID:14896
- C:\Windows\System\TogNAju.exe
  C:\Windows\System\TogNAju.exe
  2⤵
  PID:13780
- C:\Windows\System\WwWbqFh.exe
  C:\Windows\System\WwWbqFh.exe
  2⤵
  PID:15296
- C:\Windows\System\tEUivtR.exe
  C:\Windows\System\tEUivtR.exe
  2⤵
  PID:13240
- C:\Windows\System\pZPfkDC.exe
  C:\Windows\System\pZPfkDC.exe
  2⤵
  PID:15388
- C:\Windows\System\PqleveG.exe
  C:\Windows\System\PqleveG.exe
  2⤵
  PID:15412
- C:\Windows\System\ZNSHUET.exe
  C:\Windows\System\ZNSHUET.exe
  2⤵
  PID:15460
- C:\Windows\System\SkmVlwF.exe
  C:\Windows\System\SkmVlwF.exe
  2⤵
  PID:15488
- C:\Windows\System\QDHczpa.exe
  C:\Windows\System\QDHczpa.exe
  2⤵
  PID:15508
- C:\Windows\System\yPGvZZm.exe
  C:\Windows\System\yPGvZZm.exe
  2⤵
  PID:15536
- C:\Windows\System\RYhxovR.exe
  C:\Windows\System\RYhxovR.exe
  2⤵
  PID:15552
- C:\Windows\System\zqWgfLJ.exe
  C:\Windows\System\zqWgfLJ.exe
  2⤵
  PID:15580
- C:\Windows\System\fRvcZJO.exe
  C:\Windows\System\fRvcZJO.exe
  2⤵
  PID:15604
- C:\Windows\System\MptJzcv.exe
  C:\Windows\System\MptJzcv.exe
  2⤵
  PID:15640
- C:\Windows\System\EkIZedL.exe
  C:\Windows\System\EkIZedL.exe
  2⤵
  PID:15664
- C:\Windows\System\dZSnohq.exe
  C:\Windows\System\dZSnohq.exe
  2⤵
  PID:15688
- C:\Windows\System\XKCmcyD.exe
  C:\Windows\System\XKCmcyD.exe
  2⤵
  PID:15720
- C:\Windows\System\ulZsJpR.exe
  C:\Windows\System\ulZsJpR.exe
  2⤵
  PID:15748
- C:\Windows\System\EqTFeXy.exe
  C:\Windows\System\EqTFeXy.exe
  2⤵
  PID:15784
- C:\Windows\System\IUgIxbl.exe
  C:\Windows\System\IUgIxbl.exe
  2⤵
  PID:15804
- C:\Windows\System\VKncWsh.exe
  C:\Windows\System\VKncWsh.exe
  2⤵
  PID:15828
- C:\Windows\System\pLjJovz.exe
  C:\Windows\System\pLjJovz.exe
  2⤵
  PID:15856
- C:\Windows\System\YMIIhcA.exe
  C:\Windows\System\YMIIhcA.exe
  2⤵
  PID:15872
- C:\Windows\System\mhHOFYx.exe
  C:\Windows\System\mhHOFYx.exe
  2⤵
  PID:15900
- C:\Windows\System\BFXxjXi.exe
  C:\Windows\System\BFXxjXi.exe
  2⤵
  PID:15920
- C:\Windows\System\OfXzFOY.exe
  C:\Windows\System\OfXzFOY.exe
  2⤵
  PID:15944
- C:\Windows\System\iobXtlS.exe
  C:\Windows\System\iobXtlS.exe
  2⤵
  PID:15968
- C:\Windows\System\akBGbOI.exe
  C:\Windows\System\akBGbOI.exe
  2⤵
  PID:16004
- C:\Windows\System\pUqGhAh.exe
  C:\Windows\System\pUqGhAh.exe
  2⤵
  PID:16028
- C:\Windows\System\eEtNNQx.exe
  C:\Windows\System\eEtNNQx.exe
  2⤵
  PID:16056
- C:\Windows\System\hlgoXpZ.exe
  C:\Windows\System\hlgoXpZ.exe
  2⤵
  PID:16072
- C:\Windows\System\SPEtUSl.exe
  C:\Windows\System\SPEtUSl.exe
  2⤵
  PID:16104
- C:\Windows\System\zmtZrly.exe
  C:\Windows\System\zmtZrly.exe
  2⤵
  PID:16128
- C:\Windows\System\ACMEZzG.exe
  C:\Windows\System\ACMEZzG.exe
  2⤵
  PID:16144
- C:\Windows\System\jvGBxjI.exe
  C:\Windows\System\jvGBxjI.exe
  2⤵
  PID:16160
- C:\Windows\System\koSjvaA.exe
  C:\Windows\System\koSjvaA.exe
  2⤵
  PID:16180
- C:\Windows\System\CQoxlzf.exe
  C:\Windows\System\CQoxlzf.exe
  2⤵
  PID:16200
- C:\Windows\System\qsxQQzy.exe
  C:\Windows\System\qsxQQzy.exe
  2⤵
  PID:16220
- C:\Windows\System\SjzXsyb.exe
  C:\Windows\System\SjzXsyb.exe
  2⤵
  PID:16244
- C:\Windows\System\CMLhXnI.exe
  C:\Windows\System\CMLhXnI.exe
  2⤵
  PID:16264
- C:\Windows\System\ISdXZIK.exe
  C:\Windows\System\ISdXZIK.exe
  2⤵
  PID:16308
- C:\Windows\System\JgGgKWg.exe
  C:\Windows\System\JgGgKWg.exe
  2⤵
  PID:16324
- C:\Windows\System\AuvjNPw.exe
  C:\Windows\System\AuvjNPw.exe
  2⤵
  PID:16344
- C:\Windows\System\KiaCeUN.exe
  C:\Windows\System\KiaCeUN.exe
  2⤵
  PID:16360
- C:\Windows\System\GkoyMht.exe
  C:\Windows\System\GkoyMht.exe
  2⤵
  PID:14992
- C:\Windows\System\fHdDAmz.exe
  C:\Windows\System\fHdDAmz.exe
  2⤵
  PID:15248
- C:\Windows\System\HiLUjMu.exe
  C:\Windows\System\HiLUjMu.exe
  2⤵
  PID:15280
- C:\Windows\System\xHRRzkQ.exe
  C:\Windows\System\xHRRzkQ.exe
  2⤵
  PID:15384
- C:\Windows\System\TKLMOvZ.exe
  C:\Windows\System\TKLMOvZ.exe
  2⤵
  PID:15408
- C:\Windows\System\iMdYMGL.exe
  C:\Windows\System\iMdYMGL.exe
  2⤵
  PID:14292
- C:\Windows\System\ADhqgfY.exe
  C:\Windows\System\ADhqgfY.exe
  2⤵
  PID:15124
- C:\Windows\System\VwuTsLD.exe
  C:\Windows\System\VwuTsLD.exe
  2⤵
  PID:15448
- C:\Windows\System\OisQZoN.exe
  C:\Windows\System\OisQZoN.exe
  2⤵
  PID:15500
- C:\Windows\System\DWjFaCQ.exe
  C:\Windows\System\DWjFaCQ.exe
  2⤵
  PID:15732
- C:\Windows\System\SLEUXpo.exe
  C:\Windows\System\SLEUXpo.exe
  2⤵
  PID:15616
- C:\Windows\System\LSEKZSM.exe
  C:\Windows\System\LSEKZSM.exe
  2⤵
  PID:15868
- C:\Windows\System\CfknzJA.exe
  C:\Windows\System\CfknzJA.exe
  2⤵
  PID:15712
- C:\Windows\System\zTXyYRA.exe
  C:\Windows\System\zTXyYRA.exe
  2⤵
  PID:15960
- C:\Windows\System\iOLWjFU.exe
  C:\Windows\System\iOLWjFU.exe
  2⤵
  PID:15572
- C:\Windows\System\SUYMLiZ.exe
  C:\Windows\System\SUYMLiZ.exe
  2⤵
  PID:15652
- C:\Windows\System\KJmHkth.exe
  C:\Windows\System\KJmHkth.exe
  2⤵
  PID:16212
- C:\Windows\System\GnFFUSE.exe
  C:\Windows\System\GnFFUSE.exe
  2⤵
  PID:16016
- C:\Windows\System\bPviIwG.exe
  C:\Windows\System\bPviIwG.exe
  2⤵
  PID:16652
- C:\Windows\System\VSYmFzL.exe
  C:\Windows\System\VSYmFzL.exe
  2⤵
  PID:16672
- C:\Windows\System\GmCYLzf.exe
  C:\Windows\System\GmCYLzf.exe
  2⤵
  PID:16688
- C:\Windows\System\dGPUtcx.exe
  C:\Windows\System\dGPUtcx.exe
  2⤵
  PID:16704
- C:\Windows\System\gVxjEnF.exe
  C:\Windows\System\gVxjEnF.exe
  2⤵
  PID:16728
- C:\Windows\System\RqCauNl.exe
  C:\Windows\System\RqCauNl.exe
  2⤵
  PID:16748
- C:\Windows\System\ODWZDeI.exe
  C:\Windows\System\ODWZDeI.exe
  2⤵
  PID:16776
- C:\Windows\System\bUvSsCc.exe
  C:\Windows\System\bUvSsCc.exe
  2⤵
  PID:16792
- C:\Windows\System\IdiSnCL.exe
  C:\Windows\System\IdiSnCL.exe
  2⤵
  PID:16808
- C:\Windows\System\lRLnRZz.exe
  C:\Windows\System\lRLnRZz.exe
  2⤵
  PID:16824
- C:\Windows\System\MoSgMpX.exe
  C:\Windows\System\MoSgMpX.exe
  2⤵
  PID:16840
- C:\Windows\System\DBropXJ.exe
  C:\Windows\System\DBropXJ.exe
  2⤵
  PID:16856
- C:\Windows\System\RmHeZJT.exe
  C:\Windows\System\RmHeZJT.exe
  2⤵
  PID:16872
- C:\Windows\System\lsoMYGB.exe
  C:\Windows\System\lsoMYGB.exe
  2⤵
  PID:16888
- C:\Windows\System\UkImPQk.exe
  C:\Windows\System\UkImPQk.exe
  2⤵
  PID:16904
- C:\Windows\System\XmZdLjH.exe
  C:\Windows\System\XmZdLjH.exe
  2⤵
  PID:16932
- C:\Windows\System\rPdAxFx.exe
  C:\Windows\System\rPdAxFx.exe
  2⤵
  PID:16956
- C:\Windows\System\fuMWUvy.exe
  C:\Windows\System\fuMWUvy.exe
  2⤵
  PID:16972
- C:\Windows\System\mBMEtHN.exe
  C:\Windows\System\mBMEtHN.exe
  2⤵
  PID:16996
- C:\Windows\System\HTGOdFi.exe
  C:\Windows\System\HTGOdFi.exe
  2⤵
  PID:17012
- C:\Windows\System\BpXCPKb.exe
  C:\Windows\System\BpXCPKb.exe
  2⤵
  PID:17028
- C:\Windows\System\rXAzMPB.exe
  C:\Windows\System\rXAzMPB.exe
  2⤵
  PID:17052
- C:\Windows\System\pQmoetb.exe
  C:\Windows\System\pQmoetb.exe
  2⤵
  PID:17068
- C:\Windows\System\lCmAvTq.exe
  C:\Windows\System\lCmAvTq.exe
  2⤵
  PID:17084
- C:\Windows\System\LXnMpLL.exe
  C:\Windows\System\LXnMpLL.exe
  2⤵
  PID:17100
- C:\Windows\System\yYvcCkY.exe
  C:\Windows\System\yYvcCkY.exe
  2⤵
  PID:17124
- C:\Windows\System\OBaPeRV.exe
  C:\Windows\System\OBaPeRV.exe
  2⤵
  PID:17140
- C:\Windows\System\QxNmnSc.exe
  C:\Windows\System\QxNmnSc.exe
  2⤵
  PID:17156
- C:\Windows\System\fIyfmHN.exe
  C:\Windows\System\fIyfmHN.exe
  2⤵
  PID:17172
- C:\Windows\System\HALoFBg.exe
  C:\Windows\System\HALoFBg.exe
  2⤵
  PID:17188
- C:\Windows\System\GwyEKmn.exe
  C:\Windows\System\GwyEKmn.exe
  2⤵
  PID:17212
- C:\Windows\System\BdHjKOR.exe
  C:\Windows\System\BdHjKOR.exe
  2⤵
  PID:17228
- C:\Windows\System\WfDqXwZ.exe
  C:\Windows\System\WfDqXwZ.exe
  2⤵
  PID:14464
- C:\Windows\System\uvUVbQH.exe
  C:\Windows\System\uvUVbQH.exe
  2⤵
  PID:16152
- C:\Windows\System\spwKCRv.exe
  C:\Windows\System\spwKCRv.exe
  2⤵
  PID:16640
- C:\Windows\System\USAXqan.exe
  C:\Windows\System\USAXqan.exe
  2⤵
  PID:17356

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16352

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
1⤵
PID:15812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 8ca95a256d52faa0c6e8f30ad067afe9 IAQv0fMyXk6S3PGgMPCv0w.0.1.0.0.0
1⤵
PID:17028
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:17012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:17140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BQtWkQF.exe

Filesize
1.1MB

MD5
daba7a62cd47a70812bd0a7570a0f230

SHA1
4081d74b2c50835b39f89af9a90d759396466b86

SHA256
bb678d0ed15de1f6b46b67950483abb7783443820fb8807428188c523b2e45ef

SHA512
c3b07e4ce9810ca32666dcbac982fe66d50dea0ccd0545e100f53167a6d55f811699b44c7a174a66b400cd71c7021a4e6a072a2970eee373449230f87df3aee3

Download Submit
C:\Windows\System\BpgVKSS.exe

Filesize
1.1MB

MD5
baf3efb48b58e42e9c42d5b45470bd69

SHA1
599b68e0bd86a14aa3732f78f7e742adefc376e4

SHA256
b9d72822494945512fdf83b97ebed222926fddf2063b4a6bb45772ddf2ac6cbb

SHA512
856fc2081189fa04e77de8388b5674eee4915044be5c0943950dfdd5ddd6856ab1d7d92f41ca3b570a91a7868144cf70147010dae4ab04e927615c70d39d205a

Download Submit
C:\Windows\System\DjMTMwQ.exe

Filesize
1.1MB

MD5
8b304720d1fe6997c47c500b51e9f57b

SHA1
bcd3b60711df66915c021238776a051eb6958bc0

SHA256
936658368331f270a87434884a70ae0c108200618bc45c2626bde9f8ab8a85da

SHA512
7702d00f0a82e733c9cd7a734c0265716bc5c89d88059709475ef599538f279c6be1fb9b651deef29c71f75bd59d29fdcfe318aab7e7c54bab082a9e1d858e1e

Download Submit
C:\Windows\System\EfuosTE.exe

Filesize
1.1MB

MD5
b4d277868474dc111c26c6b7e293410b

SHA1
5f098120607323e58de33723c39404c7be0f071f

SHA256
f763b581c76d9d9a6ce59d5af0f1b82c4ba63f86f7c7ce4bcf30ad55b6dea15e

SHA512
22e45c9a5e652196c320eeb5fdea2fbff14829be6ea0d8f49dbedac5e9e8f057df90b415921306231dd0078817e13a9e0839cd26d17bfa59d61addedca5065ab

Download Submit
C:\Windows\System\HDwqCxj.exe

Filesize
1.1MB

MD5
e96437d2a6b51e0b8d576238aeb3094c

SHA1
c51fcb79d67ededd4ed43f2c54aee90c0c332555

SHA256
f683fb7048608bf3a1c9796b6ee867dab4099d584da73e3c9c7079bdec917368

SHA512
3d43b907336c7ec65b0cfec16fa63194e1ae5c87ff2eceac593a1cec90e9960f14bddd9391c6d7e4bf2ed4654d04bc5740c52abc3eece7b8855b9ce7aac196ce

Download Submit
C:\Windows\System\IGoTVZl.exe

Filesize
1.1MB

MD5
ebbb4105ed242548a5c0066cc874d613

SHA1
e0727933915a82e0ffd5172a68cfdc9a0e7a0019

SHA256
0d8ba87cbeaf6c9f35cf28c54debc4e7ac7efcfe0b8974f462e7d9e0721db1a6

SHA512
a4895f7620604bd8ddd9e8acd96cba3043367a9f585534aea4c2ec767ce8350fff743c73158a72e6248774e7699a745de604fdb931c22558e1e82189ca940b24

Download Submit
C:\Windows\System\NWRXCsQ.exe

Filesize
1.1MB

MD5
28c1c84e26ca8d5e1d1bf30026a309f6

SHA1
331e11c228ba92c77d75b89d542f3d1b8a3d21ec

SHA256
deca2248e23a2b91a6e0116fc66f1f75f8b2a8e23b7b67fb317e5ccd6e53cd7c

SHA512
11b99e8f5e8de52dc28eb8bf0eed2170a07275d104b0fd23abf4af0b166b40111fe2ce77e07ec05d453b8cef36bd6d4799b032b664974f6400f63e1f6bccaa4e

Download Submit
C:\Windows\System\NbUTOiI.exe

Filesize
1.1MB

MD5
57e397a545aadf764c15eca63819cae8

SHA1
20e1921758a54195b9cb1a15020a681968ca30f5

SHA256
2b98a0fb4e6bb15eb39475ecf206139090f715ff91ed35a83c8c1a2d939be0e3

SHA512
4f0ef36801c7e851b3b7a08650d23bbde5d9a263da84f17d3df2ed539776bde320bc3b95e080446e18cbd7e6eae5c4cef5ea2745a6b7334f10a87adf8a1c1183

Download Submit
C:\Windows\System\OUDsWmL.exe

Filesize
1.1MB

MD5
b0291cbde4cd1f169e86cc41644662b9

SHA1
f5b1106017051a08aa2c4efd11eed4dee95ebe1f

SHA256
3d651a8eefd1381220d3a20d3413f555720fcf866eeae07047dc8980f046cfb8

SHA512
43d5e7245e872d4ccc483f3890860f187c3a5fe5d4200c9a3d585f19aaaa59a89cba3810c93cd0cd2a9d91a8ff7abcd1afa871f58cc4f414070b5543095053e8

Download Submit
C:\Windows\System\OcLYHSP.exe

Filesize
1.1MB

MD5
aa515a0b57a2222df74b0a517f2fa848

SHA1
56df0f86f25761864aa0affc8ab45f88e1331c5f

SHA256
568f0c9d7b3c206a7cf320ac1b41790387767574c729be4e76aa7cff491e2bd4

SHA512
68fd58d1281ccfe7802318ad4e7d45893b5e1db39d50c32ef400a89f8609749cf01e1299afb301244dfa7e4c7e6d1329bdc5b7e11738c375c264c0afdd0f45a6

Download Submit
C:\Windows\System\OsEkpiG.exe

Filesize
1.1MB

MD5
15df6a66e956c67cc0b3c5b029bdd4a8

SHA1
c79df038e9f4acadffeeea6a1d81c4f4b4ca4b6e

SHA256
3d8fc13e99e1c075a005a43ccd4d8e47a13daf7b0440b18e58caff65bf33e028

SHA512
d748cd45795f31eb3d1aa34a043da5c82ee2b9db5605438d4c5c6ddcbb012063f660225cd792a6eb1b4e432fca2a444517be5e113b940fa6d904e4406a28b54f

Download Submit
C:\Windows\System\PvwXvjr.exe

Filesize
1.1MB

MD5
4328e601981d1d443b2cc2afaa14965a

SHA1
57a784c2ed411dd7c08f9afdf19832be9beb4da8

SHA256
f5343626f5c1f74956b68bdf0cad3be00bff987dce90905816c9f8430715afb2

SHA512
ff96b9484a1a63dda2099d0c44fca6733b9e5ea25e2937056201cc1b33045ab4720c7f10a148abdf84fd4b63d18559ff89fc9eb7293f60958b38dd09bf517769

Download Submit
C:\Windows\System\QSHeTVE.exe

Filesize
1.1MB

MD5
0c1a41629ad75387a49ef2f64425578b

SHA1
e6a8b1dd8c44d11573c76138337722669bc7017f

SHA256
d83ddca5a415720b7d2e4b94cb0329ead711b19797b126e8b12618a326b7797d

SHA512
813a50fe94db92d75b885a26cdba76174a5c1b865f0db0d51fc0fe53ce7a6c2acda94845ba7d889ed1cbd1355cf46c065f7c0e99f70eadd83430b32d575cb6d3

Download Submit
C:\Windows\System\SOWBkHM.exe

Filesize
1.1MB

MD5
50302848a6d5e58103842d2058177f67

SHA1
d0e59a3e94ceb1ed154260529356b2567172f2ba

SHA256
a1a5ebed2ee309ae3389d36d8c21fab4066f2a4fd6f8d898cb764bf84a712b26

SHA512
ec865e062548bb8ae303b2d035ae890530c61ffeba874ca9863979c52da609ffa222b4ed7532d0b19f72e58d3a289190ae9d750ef3f49ba93b2301e510ff47dc

Download Submit
C:\Windows\System\SUZjjCV.exe

Filesize
1.1MB

MD5
1593375a2b2116c541c3c2a7714249e7

SHA1
1cc4a7eec710570236f18506a62f74ef29925cb7

SHA256
02c6d9451205a1e1077a2bfa445c16d5b7315169c823d28ce19ff99e9ffe36e6

SHA512
4f33abd09339a19a6430b60331769d4cb4730863746771d0114e79c6c036dffc75e4e30f3b789ac929b57e49afefc310f649e98fc39300eddcd0aa73228ee26a

Download Submit
C:\Windows\System\UJxcAZy.exe

Filesize
1.1MB

MD5
ee09b78290c6a956ed5dd377a93da891

SHA1
125f2601fd8871a5c8c1255a4cedb6d9ad99df23

SHA256
a50193c83c52ef682d81597540444711085a4eb15fea69c0f8f0d37bd6582694

SHA512
e8f7828dd5d18e4f5702522d18e9a6dc3be77b19a974e5f6beb6d4109fa8b9052215400b55c9848332ceb28edee0c00abc2f73e50bb1c03ba17f5a3521077b64

Download Submit
C:\Windows\System\YRqylsa.exe

Filesize
1.1MB

MD5
17ed5e0f4dbb063bcedb9a055d38f4c0

SHA1
1a2cce232318975e8b13e24f0766c2407084e54c

SHA256
f85e2fffe6a90eaa81b23de5a13851f3b9531ec2fabd0e9cbed67a930299e1da

SHA512
816ac50b5cefb81b26b42b5dc3be1a13e00c50312a4d543da1258ea6d8e8935b6341e3c170fe10099b1b89a9b8b83a488b1452926c8a03a4ce0860d444b33cc2

Download Submit
C:\Windows\System\YSmwPBl.exe

Filesize
1.1MB

MD5
44c1d7cf4a12c53b48e4e7fcd37d7ec9

SHA1
e8ce43a77eea33cbfd43bb4e33a2c9e7718c400e

SHA256
585e78b1f3712c57a9ddde1a1999cec65552b0e908e16d17572d18f0c7f569cc

SHA512
4821faf3815c8d470a8329003bf1b98734945453563a10d1289fa54ed2260022c02eaa304ca1b2f48751f46b1ececc6a9ddb941db271564a66de30d0cb2c7e1d

Download Submit
C:\Windows\System\bGelKhd.exe

Filesize
1.1MB

MD5
d4b2e9dda2beb7267bb3dab7a559a99b

SHA1
17cb1ecfcd2ab5eaaceaf0c364ddeceb661f56dd

SHA256
d5c9d539a4a382dd25838c757d862a9d6eb7fa1b6c7b63952da5588ed3cd540c

SHA512
074f06a8e126a864639928af3088c9ffefeba43dd271c692ccc71d14818c09df0200e48109141dfe7eeffd5ee2299f9f2a4d8eddfd4a35f87750fccbcf2057c1

Download Submit
C:\Windows\System\hOYaYGy.exe

Filesize
1.1MB

MD5
1241bd20fc3841eee746976b820f9e55

SHA1
942011f70a0e8faa998d1992d8c74239f6c6f859

SHA256
e2d373d628887242f018e74430d42c2a7c27d1f40107007915e8eb89b53aae90

SHA512
e1ad192eda1e03bcd7487d0d1dd94edc8b8062deb37da6caf111a30375f18017703ed5edcc9263d57f3d3493ada7613bea5621f60ae93d6369e02a90752ee7ed

Download Submit
C:\Windows\System\iQxChPq.exe

Filesize
1.1MB

MD5
4dc1263cfe749973f21565941b15e7d3

SHA1
d5b626dfaaac1d171591af0c541f9338fc3bc7f9

SHA256
68b8126e7231dd821cc2eb8aa643ac5ec68dee1318fbcb2d02dc8da6b6e8a10e

SHA512
a566ed55c0e4f38bdb38229254662963b7ad717e1b5907097937b6de61cec71291ba56a3eab5f9b4d8526ff72bfdbc99a987be101a5e2ef2f3bca2510d271ba0

Download Submit
C:\Windows\System\jicjTnt.exe

Filesize
1.1MB

MD5
486cdaffe6b49cff21c59d3e74d77c83

SHA1
5675ec18bb8a6f574ce7fe5584903e7accd92c3b

SHA256
61cf9c6b1eba665b036c89eea3855c798bfc4a90e65d2cb9086ad14629c25121

SHA512
02efb1d41f98b1e77e58dacbf3e73e5376e3f43f3f1bc4dc1e3a99923b6965f5e383a7881f43f964a4adc9f43313a8e3f9b24abe22cc5525c0f35a2442b55e43

Download Submit
C:\Windows\System\lnVqJlH.exe

Filesize
1.1MB

MD5
caf9afb6c7e86b8e0fb4dde6d8480f0a

SHA1
18cf8814b2e5773cde47f76d9c649dcfea370071

SHA256
308270459df3dc03bd28d63fe5bb85707df3946ff331d6dadad3cf8b92dd728c

SHA512
8ac6f3265bd53eb671c8177a9cb55560a7ffbeffe6abebad3f3d27d8694c92f14ba43a689abb6d593456cf07248fb905ad489653ec42bd6895a238e1ab6062bc

Download Submit
C:\Windows\System\raFAQYy.exe

Filesize
1.1MB

MD5
d8e0aec6747c5d1177e6d1408f7332ca

SHA1
7dd74fe30289ff70797400ad1d0efe247829c0cb

SHA256
6317abea0b1d9d60e528bfe08b96dc30e6dc4fe61ab969f789772c4ddc8f80fa

SHA512
42dd200ea9748229977298626b42776f43db8f27c4d53e5a1acf4f7fc2c8977e4e05694bdb11e51bbd09e16ab271dc687f1bafef1b703f2f6e1d59bcbed36e8d

Download Submit
C:\Windows\System\tsDsoWK.exe

Filesize
1.1MB

MD5
c15ed6f4176f5946c73f5a52e284582f

SHA1
13874c731e3d6feb8c4c9e0fe859bc9205b98308

SHA256
4475d5cc9e25675d669d411125767264b74ae4ee8936a33a62a1a5fe3a7e306a

SHA512
fd7f392ed1193ef11ae4b6c9b3331100841fa1f48e9b01131f33a11ade0c2ac07165fbce3af64879321e83dc4912aba01937fb81f50690e12ff7dff81e14b6be

Download Submit
C:\Windows\System\uIeiCCs.exe

Filesize
1.1MB

MD5
f4355ffcc339ae0a55754b5511aad58e

SHA1
620da33e363c511f17a2e1b26e398a816062edff

SHA256
a9721e92562c4305c37e19708df5b52aa3835f1babda83d83c792e70bd1569b9

SHA512
dea1c3ebbb52f0c62dfdb2c2116167bd0693104073292cae545a7c0f280fcfb66ba6d35f107cc01fe7c9c4766617fe4985d1e2e6f6dfdb36216195a586c7cd08

Download Submit
C:\Windows\System\vZSvmjJ.exe

Filesize
1.1MB

MD5
d49b9326c72ef90a34eeada311979fc5

SHA1
28188f783f7d25458f290123764cf2b19de3f6b1

SHA256
54429509834291b538888f42a148fd92aa79a250856d8966a43b144b8ab6ee57

SHA512
35e3ce267bd6e7b9143289f2f47fc58cc8e72bfd88780c785f4a94f268f3d5707b9feb769ab5896bb34b881a61a9eedd1b5813b12df7eb7d19e779238f80ff2b

Download Submit
C:\Windows\System\vqfLxQZ.exe

Filesize
1.1MB

MD5
44abbcdebb4298cc0999dc0388f53a59

SHA1
033b0c3bea6929c4905ea8a688e8e79273f40ada

SHA256
30642688cd371e60d3b4428c3e5f10f4ef275c4d9aafbaab9156ff7aece7d704

SHA512
2775914352fea7bccf683066288c1812e2adf59a7c4514851d3701b2be0d9d693dcaf0eac9e6be928000cde2bc0ed9cb0b696ad7af92ef9b1303e167df5edfe7

Download Submit
C:\Windows\System\wppkREp.exe

Filesize
1.1MB

MD5
021e16f590308d796647c1ad7ee1f2a8

SHA1
e6992ac6bb32914ef05e96d408ad96f88fadb8db

SHA256
140db1cbd5d096f2e9a77d374b3e0e3da9cdd79d6aad886e732db045a4845d1f

SHA512
e6bc081738ca173cb2c707030ac8e7b8a07d66498db99543b25cd244128435f21d05c0b059e199aa60f1be8f40db35eacb9b59ea242b5b1d8a52b13a36e590dc

Download Submit
C:\Windows\System\yNVzbLh.exe

Filesize
1.1MB

MD5
4b7f37b52cbf33669fd791c70bf57c60

SHA1
cf9b1e3553db0f8e8961631b669f2141c48e5813

SHA256
8964ca6f9a08b2c23875007a85f05166c3987e21d021a885b3341693549bab57

SHA512
b1620689f2e908186606784781269118b228b78b2aba1bebb3b5253ad97b8164e13c2f3074d2463ff9be03c2ef1e4bccd2ae093942f16a261c4f272a4897f36a

Download Submit
C:\Windows\System\ydvILPP.exe

Filesize
1.1MB

MD5
0083b51e5350e9ca891b7256975f2650

SHA1
6ef691073bfd745144ec4257f3b0ff235b7a661a

SHA256
46abf8d3e5ce4432e0ce195cdb6d294e36a19c460f19f25f49879671a6368de0

SHA512
180966b86ea4eb7e036d43e833ca862c3cdb329cc3b511711265e4432a54935e2014bbdbba67cbe737562e325d37c376796a628688fe1a53fd0a92a1246ece77

Download Submit
C:\Windows\System\zYuTcaJ.exe

Filesize
1.1MB

MD5
166de7439d3a55d5e5a664a976490645

SHA1
e5f016ba3e055f3d0c501a1b4918756817824e22

SHA256
f58571ba4b315b8c5d7585f4462ded626e732f52d61017e2a464ec6e19a791e8

SHA512
d33001f55f20c2cfc571d0197ac860af1f4c646ab65a9e755133f767060e110d3726d003c128c7c82e441106151c93a540ba621db9379d3fe25dd9861ec8c0a1

Download Submit
memory/3008-0-0x00000214B4590000-0x00000214B45A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads