xmrig | b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340

Analysis

max time kernel
146s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
Size

1.7MB
MD5

530d24101aadd5b3ed01ddf4c79e2c00
SHA1

9c28b628d3585171f827b458d9d2173a3719065d
SHA256

b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340
SHA512

e36f49a9d89d5627353219ef87b92491a80dd4375324497ee64135c2674e94b7842bd8dffd7d61230d05f5eca26bc499e762d6341ea3c84ffcf445031b2ed41d
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZlCC:GemTLkNdfE0pZyd

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b2d-4.dat	xmrig
behavioral2/files/0x000d000000023b79-10.dat	xmrig
behavioral2/files/0x000b000000023b87-15.dat	xmrig
behavioral2/files/0x000a000000023b8b-18.dat	xmrig
behavioral2/files/0x000a000000023b8e-32.dat	xmrig
behavioral2/files/0x000a000000023b8c-30.dat	xmrig
behavioral2/files/0x000a000000023b91-48.dat	xmrig
behavioral2/files/0x000a000000023b93-53.dat	xmrig
behavioral2/files/0x000a000000023b96-67.dat	xmrig
behavioral2/files/0x000a000000023b97-83.dat	xmrig
behavioral2/files/0x000a000000023b98-85.dat	xmrig
behavioral2/files/0x000a000000023b9a-96.dat	xmrig
behavioral2/files/0x000a000000023b9b-114.dat	xmrig
behavioral2/files/0x000a000000023b9f-135.dat	xmrig
behavioral2/files/0x000a000000023ba3-145.dat	xmrig
behavioral2/files/0x000a000000023ba2-143.dat	xmrig
behavioral2/files/0x000a000000023ba1-141.dat	xmrig
behavioral2/files/0x000a000000023ba0-139.dat	xmrig
behavioral2/files/0x000c000000023b7e-137.dat	xmrig
behavioral2/files/0x000a000000023b9e-130.dat	xmrig
behavioral2/files/0x000a000000023b9d-126.dat	xmrig
behavioral2/files/0x000a000000023b9c-121.dat	xmrig
behavioral2/files/0x000a000000023b99-92.dat	xmrig
behavioral2/files/0x000a000000023b95-72.dat	xmrig
behavioral2/files/0x000a000000023b94-70.dat	xmrig
behavioral2/files/0x000a000000023b90-58.dat	xmrig
behavioral2/files/0x000a000000023b92-56.dat	xmrig
behavioral2/files/0x000a000000023b8f-45.dat	xmrig
behavioral2/files/0x000a000000023b8d-34.dat	xmrig
behavioral2/files/0x000a000000023ba5-153.dat	xmrig
behavioral2/files/0x000a000000023ba7-160.dat	xmrig
behavioral2/files/0x000a000000023ba4-155.dat	xmrig
behavioral2/files/0x000a000000023ba6-154.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4680	bfEUOJI.exe
2796	euyeeqj.exe
3604	wmDaJvb.exe
4940	rjXYFJh.exe
724	aLkuhuf.exe
1172	COyYGZx.exe
3608	afJwoAB.exe
888	tPnwGNz.exe
2348	dNwvNEP.exe
1448	ZViVlhA.exe
4760	jFRVwWY.exe
2868	oUkjaJV.exe
1976	XKrVtiD.exe
4208	xQucYVr.exe
3040	qQShbIC.exe
3068	nhInyWk.exe
3724	rVPUIpL.exe
4600	dPNxnZK.exe
2284	JuYvUhW.exe
4072	hkykDOu.exe
404	hFqTqer.exe
1200	PqZUYAI.exe
4488	rNLWTru.exe
1760	bbbvWpd.exe
1072	iekzqYW.exe
2876	UaBzljq.exe
1352	VGozpdH.exe
952	fCNOtmw.exe
2736	aVRZbkG.exe
3348	JYDKJQc.exe
1812	teOHbAy.exe
1916	OknAIxf.exe
4048	LxELrdx.exe
3940	ONTjfsY.exe
4700	RfTMWGE.exe
1800	RKDBWhQ.exe
1692	qnHEsmh.exe
1716	bbkketq.exe
4384	WHTNWOh.exe
2572	RwRQySq.exe
3636	srFXCbK.exe
1092	MBJskne.exe
2972	yYcGoxb.exe
3828	evzXPBU.exe
2468	gkqaDmh.exe
2248	HYNTiZz.exe
1408	lpUxHzT.exe
4148	PjakxyT.exe
4512	YDrEKwo.exe
4872	KaJcdjM.exe
3984	ihNWQtN.exe
1356	ZswSXiC.exe
2964	QkVzEIY.exe
2140	xnruWQv.exe
5080	YMFsVMB.exe
2056	QXYxDUV.exe
1520	wGiHFMJ.exe
848	hLIDfOq.exe
1028	mHLtjlI.exe
4732	OoKOFYL.exe
212	UrXAGPV.exe
2276	koNHndo.exe
1156	ZpVbjmt.exe
396	RWFiqpL.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\veNAxTA.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\hhvNtIt.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\IxWMTzp.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\EFecLPB.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\KWVGcLK.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\umGSrYn.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\RQoCMyj.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\vSXfgql.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\JOAcudA.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\gMTpBQs.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\otoxBQu.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\RQSzaKA.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\UTEuenm.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\Wdkpmkz.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\lMciQdA.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\FsmVRbC.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\MHRXyID.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\qkNsbUs.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\SKPyNWl.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\HAEutHo.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\OcTIhwS.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\gZgFPUL.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\XjOEftV.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\jkRTBJu.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\RaTEtkJ.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\XiJhQfG.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\DwaWIOk.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\FNfsyeK.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\tBdWJby.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\AaPEQVA.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\ACTMYfY.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\nJrSumV.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\ZjsUJqS.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\XUlZaLK.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\HkQZEaP.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\gpJlgUG.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\yGJtBDo.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\oBuLuAe.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\HyoSdwD.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\Ngipspn.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\MaRuLlr.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\JtMGfvC.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\RjPajXq.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\HYucLDz.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\rRFfvMi.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\fjHqkDS.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\BxdzaLk.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\PGyCtPZ.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\jMiGnNS.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\bbkketq.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\gHizczy.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\RFBcZiC.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\dnnDvcj.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\pVdryAK.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\cQfwFNM.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\dNQUTFP.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\UuTXaKZ.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\qoLVQiI.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\GDIfoWE.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\ViAYYZL.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\RKRMIAp.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\fShXRyW.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\ycLTVvM.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
File created	C:\Windows\System\DyCMfoH.exe	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16996	dwm.exe
Token: SeChangeNotifyPrivilege	16996	dwm.exe
Token: 33	16996	dwm.exe
Token: SeIncBasePriorityPrivilege	16996	dwm.exe
Token: SeShutdownPrivilege	16996	dwm.exe
Token: SeCreatePagefilePrivilege	16996	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 4680	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	84
PID 216 wrote to memory of 4680	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	84
PID 216 wrote to memory of 2796	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	85
PID 216 wrote to memory of 2796	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	85
PID 216 wrote to memory of 3604	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	86
PID 216 wrote to memory of 3604	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	86
PID 216 wrote to memory of 4940	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	87
PID 216 wrote to memory of 4940	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	87
PID 216 wrote to memory of 724	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	88
PID 216 wrote to memory of 724	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	88
PID 216 wrote to memory of 1172	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	89
PID 216 wrote to memory of 1172	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	89
PID 216 wrote to memory of 3608	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	90
PID 216 wrote to memory of 3608	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	90
PID 216 wrote to memory of 888	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	91
PID 216 wrote to memory of 888	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	91
PID 216 wrote to memory of 2348	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	92
PID 216 wrote to memory of 2348	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	92
PID 216 wrote to memory of 1448	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	93
PID 216 wrote to memory of 1448	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	93
PID 216 wrote to memory of 4760	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	94
PID 216 wrote to memory of 4760	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	94
PID 216 wrote to memory of 2868	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	95
PID 216 wrote to memory of 2868	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	95
PID 216 wrote to memory of 1976	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	96
PID 216 wrote to memory of 1976	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	96
PID 216 wrote to memory of 4208	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	97
PID 216 wrote to memory of 4208	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	97
PID 216 wrote to memory of 3040	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	98
PID 216 wrote to memory of 3040	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	98
PID 216 wrote to memory of 3068	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	100
PID 216 wrote to memory of 3068	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	100
PID 216 wrote to memory of 3724	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	101
PID 216 wrote to memory of 3724	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	101
PID 216 wrote to memory of 4600	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	102
PID 216 wrote to memory of 4600	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	102
PID 216 wrote to memory of 2284	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	103
PID 216 wrote to memory of 2284	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	103
PID 216 wrote to memory of 4072	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	104
PID 216 wrote to memory of 4072	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	104
PID 216 wrote to memory of 404	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	105
PID 216 wrote to memory of 404	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	105
PID 216 wrote to memory of 1200	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	106
PID 216 wrote to memory of 1200	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	106
PID 216 wrote to memory of 4488	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	107
PID 216 wrote to memory of 4488	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	107
PID 216 wrote to memory of 1760	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	108
PID 216 wrote to memory of 1760	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	108
PID 216 wrote to memory of 1072	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	109
PID 216 wrote to memory of 1072	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	109
PID 216 wrote to memory of 2876	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	110
PID 216 wrote to memory of 2876	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	110
PID 216 wrote to memory of 1352	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	111
PID 216 wrote to memory of 1352	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	111
PID 216 wrote to memory of 952	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	112
PID 216 wrote to memory of 952	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	112
PID 216 wrote to memory of 2736	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	113
PID 216 wrote to memory of 2736	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	113
PID 216 wrote to memory of 1916	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	114
PID 216 wrote to memory of 1916	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	114
PID 216 wrote to memory of 3348	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	116
PID 216 wrote to memory of 3348	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	116
PID 216 wrote to memory of 1812	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	117
PID 216 wrote to memory of 1812	216	b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe	117

C:\Users\Admin\AppData\Local\Temp\b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe
"C:\Users\Admin\AppData\Local\Temp\b489508680871567b64b4f2511308faa687c1600beb4bf9c5a9d478cf91c6340.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\System\bfEUOJI.exe
  C:\Windows\System\bfEUOJI.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\euyeeqj.exe
  C:\Windows\System\euyeeqj.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\wmDaJvb.exe
  C:\Windows\System\wmDaJvb.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\rjXYFJh.exe
  C:\Windows\System\rjXYFJh.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\aLkuhuf.exe
  C:\Windows\System\aLkuhuf.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\COyYGZx.exe
  C:\Windows\System\COyYGZx.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\afJwoAB.exe
  C:\Windows\System\afJwoAB.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\tPnwGNz.exe
  C:\Windows\System\tPnwGNz.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\dNwvNEP.exe
  C:\Windows\System\dNwvNEP.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\ZViVlhA.exe
  C:\Windows\System\ZViVlhA.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\jFRVwWY.exe
  C:\Windows\System\jFRVwWY.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\oUkjaJV.exe
  C:\Windows\System\oUkjaJV.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\XKrVtiD.exe
  C:\Windows\System\XKrVtiD.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\xQucYVr.exe
  C:\Windows\System\xQucYVr.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\qQShbIC.exe
  C:\Windows\System\qQShbIC.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\nhInyWk.exe
  C:\Windows\System\nhInyWk.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\rVPUIpL.exe
  C:\Windows\System\rVPUIpL.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\dPNxnZK.exe
  C:\Windows\System\dPNxnZK.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\JuYvUhW.exe
  C:\Windows\System\JuYvUhW.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\hkykDOu.exe
  C:\Windows\System\hkykDOu.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\hFqTqer.exe
  C:\Windows\System\hFqTqer.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\PqZUYAI.exe
  C:\Windows\System\PqZUYAI.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\rNLWTru.exe
  C:\Windows\System\rNLWTru.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\bbbvWpd.exe
  C:\Windows\System\bbbvWpd.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\iekzqYW.exe
  C:\Windows\System\iekzqYW.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\UaBzljq.exe
  C:\Windows\System\UaBzljq.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\VGozpdH.exe
  C:\Windows\System\VGozpdH.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\fCNOtmw.exe
  C:\Windows\System\fCNOtmw.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\aVRZbkG.exe
  C:\Windows\System\aVRZbkG.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\OknAIxf.exe
  C:\Windows\System\OknAIxf.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\JYDKJQc.exe
  C:\Windows\System\JYDKJQc.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\teOHbAy.exe
  C:\Windows\System\teOHbAy.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\LxELrdx.exe
  C:\Windows\System\LxELrdx.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\RfTMWGE.exe
  C:\Windows\System\RfTMWGE.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\ONTjfsY.exe
  C:\Windows\System\ONTjfsY.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\RKDBWhQ.exe
  C:\Windows\System\RKDBWhQ.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\qnHEsmh.exe
  C:\Windows\System\qnHEsmh.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\WHTNWOh.exe
  C:\Windows\System\WHTNWOh.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\bbkketq.exe
  C:\Windows\System\bbkketq.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\RwRQySq.exe
  C:\Windows\System\RwRQySq.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\srFXCbK.exe
  C:\Windows\System\srFXCbK.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\MBJskne.exe
  C:\Windows\System\MBJskne.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\yYcGoxb.exe
  C:\Windows\System\yYcGoxb.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\evzXPBU.exe
  C:\Windows\System\evzXPBU.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\gkqaDmh.exe
  C:\Windows\System\gkqaDmh.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\HYNTiZz.exe
  C:\Windows\System\HYNTiZz.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\lpUxHzT.exe
  C:\Windows\System\lpUxHzT.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\PjakxyT.exe
  C:\Windows\System\PjakxyT.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\YDrEKwo.exe
  C:\Windows\System\YDrEKwo.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\KaJcdjM.exe
  C:\Windows\System\KaJcdjM.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\ihNWQtN.exe
  C:\Windows\System\ihNWQtN.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\ZswSXiC.exe
  C:\Windows\System\ZswSXiC.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\QkVzEIY.exe
  C:\Windows\System\QkVzEIY.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\xnruWQv.exe
  C:\Windows\System\xnruWQv.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\YMFsVMB.exe
  C:\Windows\System\YMFsVMB.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\QXYxDUV.exe
  C:\Windows\System\QXYxDUV.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\wGiHFMJ.exe
  C:\Windows\System\wGiHFMJ.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\hLIDfOq.exe
  C:\Windows\System\hLIDfOq.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\mHLtjlI.exe
  C:\Windows\System\mHLtjlI.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\OoKOFYL.exe
  C:\Windows\System\OoKOFYL.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\UrXAGPV.exe
  C:\Windows\System\UrXAGPV.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\koNHndo.exe
  C:\Windows\System\koNHndo.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\ZpVbjmt.exe
  C:\Windows\System\ZpVbjmt.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\RWFiqpL.exe
  C:\Windows\System\RWFiqpL.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\yUnAbHq.exe
  C:\Windows\System\yUnAbHq.exe
  2⤵
  PID:3144
- C:\Windows\System\diPeDkk.exe
  C:\Windows\System\diPeDkk.exe
  2⤵
  PID:4280
- C:\Windows\System\ZPfFhzN.exe
  C:\Windows\System\ZPfFhzN.exe
  2⤵
  PID:792
- C:\Windows\System\CxLYMII.exe
  C:\Windows\System\CxLYMII.exe
  2⤵
  PID:1040
- C:\Windows\System\JtMGfvC.exe
  C:\Windows\System\JtMGfvC.exe
  2⤵
  PID:1220
- C:\Windows\System\ysbdjCs.exe
  C:\Windows\System\ysbdjCs.exe
  2⤵
  PID:3816
- C:\Windows\System\vWhSfcy.exe
  C:\Windows\System\vWhSfcy.exe
  2⤵
  PID:1516
- C:\Windows\System\fShXRyW.exe
  C:\Windows\System\fShXRyW.exe
  2⤵
  PID:1256
- C:\Windows\System\gruLzZK.exe
  C:\Windows\System\gruLzZK.exe
  2⤵
  PID:2952
- C:\Windows\System\lVwyonp.exe
  C:\Windows\System\lVwyonp.exe
  2⤵
  PID:5056
- C:\Windows\System\QBDHDpe.exe
  C:\Windows\System\QBDHDpe.exe
  2⤵
  PID:3956
- C:\Windows\System\KWVGcLK.exe
  C:\Windows\System\KWVGcLK.exe
  2⤵
  PID:1832
- C:\Windows\System\lehZNQq.exe
  C:\Windows\System\lehZNQq.exe
  2⤵
  PID:3384
- C:\Windows\System\Wdkpmkz.exe
  C:\Windows\System\Wdkpmkz.exe
  2⤵
  PID:2216
- C:\Windows\System\GwqyNOe.exe
  C:\Windows\System\GwqyNOe.exe
  2⤵
  PID:3656
- C:\Windows\System\hFasBku.exe
  C:\Windows\System\hFasBku.exe
  2⤵
  PID:4748
- C:\Windows\System\vsxkeXm.exe
  C:\Windows\System\vsxkeXm.exe
  2⤵
  PID:4808
- C:\Windows\System\NXHDeqk.exe
  C:\Windows\System\NXHDeqk.exe
  2⤵
  PID:3464
- C:\Windows\System\lFCZsRn.exe
  C:\Windows\System\lFCZsRn.exe
  2⤵
  PID:1620
- C:\Windows\System\jqgpdTz.exe
  C:\Windows\System\jqgpdTz.exe
  2⤵
  PID:4964
- C:\Windows\System\xKllEpL.exe
  C:\Windows\System\xKllEpL.exe
  2⤵
  PID:4088
- C:\Windows\System\IdeVCxE.exe
  C:\Windows\System\IdeVCxE.exe
  2⤵
  PID:3016
- C:\Windows\System\yNfFIsl.exe
  C:\Windows\System\yNfFIsl.exe
  2⤵
  PID:3496
- C:\Windows\System\qqNESJN.exe
  C:\Windows\System\qqNESJN.exe
  2⤵
  PID:4896
- C:\Windows\System\odSwDWy.exe
  C:\Windows\System\odSwDWy.exe
  2⤵
  PID:2688
- C:\Windows\System\uXpPQcp.exe
  C:\Windows\System\uXpPQcp.exe
  2⤵
  PID:3044
- C:\Windows\System\UrgVbbL.exe
  C:\Windows\System\UrgVbbL.exe
  2⤵
  PID:4044
- C:\Windows\System\HKWhVGX.exe
  C:\Windows\System\HKWhVGX.exe
  2⤵
  PID:5108
- C:\Windows\System\hBzrsJu.exe
  C:\Windows\System\hBzrsJu.exe
  2⤵
  PID:2088
- C:\Windows\System\BzqhMKQ.exe
  C:\Windows\System\BzqhMKQ.exe
  2⤵
  PID:4792
- C:\Windows\System\SKPyNWl.exe
  C:\Windows\System\SKPyNWl.exe
  2⤵
  PID:64
- C:\Windows\System\EcsJUfU.exe
  C:\Windows\System\EcsJUfU.exe
  2⤵
  PID:2956
- C:\Windows\System\FDVcsku.exe
  C:\Windows\System\FDVcsku.exe
  2⤵
  PID:2496
- C:\Windows\System\pYLSlkF.exe
  C:\Windows\System\pYLSlkF.exe
  2⤵
  PID:5140
- C:\Windows\System\cvyzVDR.exe
  C:\Windows\System\cvyzVDR.exe
  2⤵
  PID:5164
- C:\Windows\System\kVKBOWP.exe
  C:\Windows\System\kVKBOWP.exe
  2⤵
  PID:5192
- C:\Windows\System\otoxBQu.exe
  C:\Windows\System\otoxBQu.exe
  2⤵
  PID:5220
- C:\Windows\System\bZukIgH.exe
  C:\Windows\System\bZukIgH.exe
  2⤵
  PID:5252
- C:\Windows\System\lMciQdA.exe
  C:\Windows\System\lMciQdA.exe
  2⤵
  PID:5276
- C:\Windows\System\rYiBiht.exe
  C:\Windows\System\rYiBiht.exe
  2⤵
  PID:5312
- C:\Windows\System\RjPajXq.exe
  C:\Windows\System\RjPajXq.exe
  2⤵
  PID:5332
- C:\Windows\System\DQUBrZh.exe
  C:\Windows\System\DQUBrZh.exe
  2⤵
  PID:5360
- C:\Windows\System\twERfEU.exe
  C:\Windows\System\twERfEU.exe
  2⤵
  PID:5388
- C:\Windows\System\hUsBkDr.exe
  C:\Windows\System\hUsBkDr.exe
  2⤵
  PID:5444
- C:\Windows\System\CGLcoUY.exe
  C:\Windows\System\CGLcoUY.exe
  2⤵
  PID:5460
- C:\Windows\System\mUYuTsb.exe
  C:\Windows\System\mUYuTsb.exe
  2⤵
  PID:5492
- C:\Windows\System\QSOKCrC.exe
  C:\Windows\System\QSOKCrC.exe
  2⤵
  PID:5516
- C:\Windows\System\hKKtgcv.exe
  C:\Windows\System\hKKtgcv.exe
  2⤵
  PID:5544
- C:\Windows\System\znxFhvt.exe
  C:\Windows\System\znxFhvt.exe
  2⤵
  PID:5576
- C:\Windows\System\HYucLDz.exe
  C:\Windows\System\HYucLDz.exe
  2⤵
  PID:5604
- C:\Windows\System\bdCfile.exe
  C:\Windows\System\bdCfile.exe
  2⤵
  PID:5628
- C:\Windows\System\bORUyNf.exe
  C:\Windows\System\bORUyNf.exe
  2⤵
  PID:5660
- C:\Windows\System\HgOJyTO.exe
  C:\Windows\System\HgOJyTO.exe
  2⤵
  PID:5692
- C:\Windows\System\KWaNVyi.exe
  C:\Windows\System\KWaNVyi.exe
  2⤵
  PID:5724
- C:\Windows\System\BsOStpl.exe
  C:\Windows\System\BsOStpl.exe
  2⤵
  PID:5748
- C:\Windows\System\gLuzxeK.exe
  C:\Windows\System\gLuzxeK.exe
  2⤵
  PID:5776
- C:\Windows\System\DURuJSb.exe
  C:\Windows\System\DURuJSb.exe
  2⤵
  PID:5808
- C:\Windows\System\OztDhvb.exe
  C:\Windows\System\OztDhvb.exe
  2⤵
  PID:5836
- C:\Windows\System\HToHpMX.exe
  C:\Windows\System\HToHpMX.exe
  2⤵
  PID:5856
- C:\Windows\System\ACTMYfY.exe
  C:\Windows\System\ACTMYfY.exe
  2⤵
  PID:5884
- C:\Windows\System\QMNgdSx.exe
  C:\Windows\System\QMNgdSx.exe
  2⤵
  PID:5908
- C:\Windows\System\hqtHtwS.exe
  C:\Windows\System\hqtHtwS.exe
  2⤵
  PID:5940
- C:\Windows\System\afUAPpd.exe
  C:\Windows\System\afUAPpd.exe
  2⤵
  PID:5980
- C:\Windows\System\DIVQecz.exe
  C:\Windows\System\DIVQecz.exe
  2⤵
  PID:6004
- C:\Windows\System\IfmDikK.exe
  C:\Windows\System\IfmDikK.exe
  2⤵
  PID:6036
- C:\Windows\System\hBbiIIb.exe
  C:\Windows\System\hBbiIIb.exe
  2⤵
  PID:6060
- C:\Windows\System\cTBvZdu.exe
  C:\Windows\System\cTBvZdu.exe
  2⤵
  PID:6108
- C:\Windows\System\JIjVAzR.exe
  C:\Windows\System\JIjVAzR.exe
  2⤵
  PID:6124
- C:\Windows\System\uvjLrBq.exe
  C:\Windows\System\uvjLrBq.exe
  2⤵
  PID:5128
- C:\Windows\System\DDcRpeq.exe
  C:\Windows\System\DDcRpeq.exe
  2⤵
  PID:5184
- C:\Windows\System\rRFfvMi.exe
  C:\Windows\System\rRFfvMi.exe
  2⤵
  PID:5244
- C:\Windows\System\aoZBmYC.exe
  C:\Windows\System\aoZBmYC.exe
  2⤵
  PID:5284
- C:\Windows\System\wRIRPCr.exe
  C:\Windows\System\wRIRPCr.exe
  2⤵
  PID:5368
- C:\Windows\System\DohmnSy.exe
  C:\Windows\System\DohmnSy.exe
  2⤵
  PID:5432
- C:\Windows\System\ZBbiOxF.exe
  C:\Windows\System\ZBbiOxF.exe
  2⤵
  PID:5508
- C:\Windows\System\UVeqDNn.exe
  C:\Windows\System\UVeqDNn.exe
  2⤵
  PID:5564
- C:\Windows\System\gpJlgUG.exe
  C:\Windows\System\gpJlgUG.exe
  2⤵
  PID:5612
- C:\Windows\System\ycLTVvM.exe
  C:\Windows\System\ycLTVvM.exe
  2⤵
  PID:5656
- C:\Windows\System\RaTEtkJ.exe
  C:\Windows\System\RaTEtkJ.exe
  2⤵
  PID:5716
- C:\Windows\System\pjXUEOV.exe
  C:\Windows\System\pjXUEOV.exe
  2⤵
  PID:5796
- C:\Windows\System\lsZieze.exe
  C:\Windows\System\lsZieze.exe
  2⤵
  PID:5848
- C:\Windows\System\CaHZyAg.exe
  C:\Windows\System\CaHZyAg.exe
  2⤵
  PID:5928
- C:\Windows\System\zXznLzk.exe
  C:\Windows\System\zXznLzk.exe
  2⤵
  PID:6024
- C:\Windows\System\pYnwtEw.exe
  C:\Windows\System\pYnwtEw.exe
  2⤵
  PID:6092
- C:\Windows\System\fuQGWYy.exe
  C:\Windows\System\fuQGWYy.exe
  2⤵
  PID:6120
- C:\Windows\System\RVHQedG.exe
  C:\Windows\System\RVHQedG.exe
  2⤵
  PID:5260
- C:\Windows\System\cnoaDZi.exe
  C:\Windows\System\cnoaDZi.exe
  2⤵
  PID:5416
- C:\Windows\System\uLmgtZO.exe
  C:\Windows\System\uLmgtZO.exe
  2⤵
  PID:5540
- C:\Windows\System\hPymOvZ.exe
  C:\Windows\System\hPymOvZ.exe
  2⤵
  PID:5640
- C:\Windows\System\yaDjOiF.exe
  C:\Windows\System\yaDjOiF.exe
  2⤵
  PID:5968
- C:\Windows\System\IjayNyz.exe
  C:\Windows\System\IjayNyz.exe
  2⤵
  PID:6052
- C:\Windows\System\GTQXLwd.exe
  C:\Windows\System\GTQXLwd.exe
  2⤵
  PID:5212
- C:\Windows\System\RgQwNTa.exe
  C:\Windows\System\RgQwNTa.exe
  2⤵
  PID:5684
- C:\Windows\System\foCbqFz.exe
  C:\Windows\System\foCbqFz.exe
  2⤵
  PID:5892
- C:\Windows\System\elwsOTk.exe
  C:\Windows\System\elwsOTk.exe
  2⤵
  PID:5476
- C:\Windows\System\RqYbQme.exe
  C:\Windows\System\RqYbQme.exe
  2⤵
  PID:5772
- C:\Windows\System\vqLAcil.exe
  C:\Windows\System\vqLAcil.exe
  2⤵
  PID:6172
- C:\Windows\System\WxakQug.exe
  C:\Windows\System\WxakQug.exe
  2⤵
  PID:6200
- C:\Windows\System\sdHDmcv.exe
  C:\Windows\System\sdHDmcv.exe
  2⤵
  PID:6224
- C:\Windows\System\vYwMnLw.exe
  C:\Windows\System\vYwMnLw.exe
  2⤵
  PID:6248
- C:\Windows\System\Eqcldrk.exe
  C:\Windows\System\Eqcldrk.exe
  2⤵
  PID:6276
- C:\Windows\System\rkRJLqg.exe
  C:\Windows\System\rkRJLqg.exe
  2⤵
  PID:6364
- C:\Windows\System\beMSLcl.exe
  C:\Windows\System\beMSLcl.exe
  2⤵
  PID:6388
- C:\Windows\System\McuhiGt.exe
  C:\Windows\System\McuhiGt.exe
  2⤵
  PID:6404
- C:\Windows\System\WdJXmDQ.exe
  C:\Windows\System\WdJXmDQ.exe
  2⤵
  PID:6424
- C:\Windows\System\LzPuWYN.exe
  C:\Windows\System\LzPuWYN.exe
  2⤵
  PID:6448
- C:\Windows\System\JbOHRNV.exe
  C:\Windows\System\JbOHRNV.exe
  2⤵
  PID:6488
- C:\Windows\System\NldtqJJ.exe
  C:\Windows\System\NldtqJJ.exe
  2⤵
  PID:6520
- C:\Windows\System\qnHqJeH.exe
  C:\Windows\System\qnHqJeH.exe
  2⤵
  PID:6548
- C:\Windows\System\YFXfUGi.exe
  C:\Windows\System\YFXfUGi.exe
  2⤵
  PID:6584
- C:\Windows\System\AlNyCKY.exe
  C:\Windows\System\AlNyCKY.exe
  2⤵
  PID:6608
- C:\Windows\System\MosSnqL.exe
  C:\Windows\System\MosSnqL.exe
  2⤵
  PID:6632
- C:\Windows\System\WreoVdl.exe
  C:\Windows\System\WreoVdl.exe
  2⤵
  PID:6668
- C:\Windows\System\ZgGIUUu.exe
  C:\Windows\System\ZgGIUUu.exe
  2⤵
  PID:6692
- C:\Windows\System\StafLtj.exe
  C:\Windows\System\StafLtj.exe
  2⤵
  PID:6720
- C:\Windows\System\EYCtajL.exe
  C:\Windows\System\EYCtajL.exe
  2⤵
  PID:6744
- C:\Windows\System\joeuDko.exe
  C:\Windows\System\joeuDko.exe
  2⤵
  PID:6776
- C:\Windows\System\bDapxAQ.exe
  C:\Windows\System\bDapxAQ.exe
  2⤵
  PID:6816
- C:\Windows\System\hsniOJA.exe
  C:\Windows\System\hsniOJA.exe
  2⤵
  PID:6844
- C:\Windows\System\ZmaOfpH.exe
  C:\Windows\System\ZmaOfpH.exe
  2⤵
  PID:6872
- C:\Windows\System\SABIKbT.exe
  C:\Windows\System\SABIKbT.exe
  2⤵
  PID:6900
- C:\Windows\System\pvpzONh.exe
  C:\Windows\System\pvpzONh.exe
  2⤵
  PID:6924
- C:\Windows\System\OzgQCQG.exe
  C:\Windows\System\OzgQCQG.exe
  2⤵
  PID:6960
- C:\Windows\System\FqidQVj.exe
  C:\Windows\System\FqidQVj.exe
  2⤵
  PID:6980
- C:\Windows\System\lxdEkzm.exe
  C:\Windows\System\lxdEkzm.exe
  2⤵
  PID:7012
- C:\Windows\System\JViNdLb.exe
  C:\Windows\System\JViNdLb.exe
  2⤵
  PID:7040
- C:\Windows\System\OLTLNgY.exe
  C:\Windows\System\OLTLNgY.exe
  2⤵
  PID:7068
- C:\Windows\System\KFimFQk.exe
  C:\Windows\System\KFimFQk.exe
  2⤵
  PID:7092
- C:\Windows\System\VOOMugp.exe
  C:\Windows\System\VOOMugp.exe
  2⤵
  PID:7120
- C:\Windows\System\ncJmlNZ.exe
  C:\Windows\System\ncJmlNZ.exe
  2⤵
  PID:7148
- C:\Windows\System\YOBpIcR.exe
  C:\Windows\System\YOBpIcR.exe
  2⤵
  PID:5596
- C:\Windows\System\EwZlqdq.exe
  C:\Windows\System\EwZlqdq.exe
  2⤵
  PID:6244
- C:\Windows\System\FLUAMJS.exe
  C:\Windows\System\FLUAMJS.exe
  2⤵
  PID:6292
- C:\Windows\System\jmuTRxi.exe
  C:\Windows\System\jmuTRxi.exe
  2⤵
  PID:6348
- C:\Windows\System\fSVCxTI.exe
  C:\Windows\System\fSVCxTI.exe
  2⤵
  PID:6380
- C:\Windows\System\PsccsLy.exe
  C:\Windows\System\PsccsLy.exe
  2⤵
  PID:6440
- C:\Windows\System\uVyVNhr.exe
  C:\Windows\System\uVyVNhr.exe
  2⤵
  PID:6496
- C:\Windows\System\CaZDSyR.exe
  C:\Windows\System\CaZDSyR.exe
  2⤵
  PID:6576
- C:\Windows\System\VfnZFOo.exe
  C:\Windows\System\VfnZFOo.exe
  2⤵
  PID:6628
- C:\Windows\System\ZJrtISO.exe
  C:\Windows\System\ZJrtISO.exe
  2⤵
  PID:6688
- C:\Windows\System\MsABWNW.exe
  C:\Windows\System\MsABWNW.exe
  2⤵
  PID:6740
- C:\Windows\System\XTzPVUR.exe
  C:\Windows\System\XTzPVUR.exe
  2⤵
  PID:6788
- C:\Windows\System\EtUYKcO.exe
  C:\Windows\System\EtUYKcO.exe
  2⤵
  PID:6908
- C:\Windows\System\fdexrVs.exe
  C:\Windows\System\fdexrVs.exe
  2⤵
  PID:6940
- C:\Windows\System\QwNHfLG.exe
  C:\Windows\System\QwNHfLG.exe
  2⤵
  PID:7028
- C:\Windows\System\qAmbozL.exe
  C:\Windows\System\qAmbozL.exe
  2⤵
  PID:7080
- C:\Windows\System\rgPeaGZ.exe
  C:\Windows\System\rgPeaGZ.exe
  2⤵
  PID:7160
- C:\Windows\System\WzSOKLj.exe
  C:\Windows\System\WzSOKLj.exe
  2⤵
  PID:6220
- C:\Windows\System\WtEAPRP.exe
  C:\Windows\System\WtEAPRP.exe
  2⤵
  PID:6400
- C:\Windows\System\umGSrYn.exe
  C:\Windows\System\umGSrYn.exe
  2⤵
  PID:6600
- C:\Windows\System\KemWrce.exe
  C:\Windows\System\KemWrce.exe
  2⤵
  PID:6712
- C:\Windows\System\tkCtFKP.exe
  C:\Windows\System\tkCtFKP.exe
  2⤵
  PID:6920
- C:\Windows\System\yhuvWUz.exe
  C:\Windows\System\yhuvWUz.exe
  2⤵
  PID:7004
- C:\Windows\System\chNzDJV.exe
  C:\Windows\System\chNzDJV.exe
  2⤵
  PID:6304
- C:\Windows\System\GnzYeDR.exe
  C:\Windows\System\GnzYeDR.exe
  2⤵
  PID:4976
- C:\Windows\System\NGHGGSu.exe
  C:\Windows\System\NGHGGSu.exe
  2⤵
  PID:6968
- C:\Windows\System\Ezkipyj.exe
  C:\Windows\System\Ezkipyj.exe
  2⤵
  PID:7104
- C:\Windows\System\tpLYtPV.exe
  C:\Windows\System\tpLYtPV.exe
  2⤵
  PID:6532
- C:\Windows\System\KxxoJvv.exe
  C:\Windows\System\KxxoJvv.exe
  2⤵
  PID:7172
- C:\Windows\System\befhLXJ.exe
  C:\Windows\System\befhLXJ.exe
  2⤵
  PID:7204
- C:\Windows\System\UGNKhkj.exe
  C:\Windows\System\UGNKhkj.exe
  2⤵
  PID:7232
- C:\Windows\System\kFcmzdX.exe
  C:\Windows\System\kFcmzdX.exe
  2⤵
  PID:7248
- C:\Windows\System\FKrAThS.exe
  C:\Windows\System\FKrAThS.exe
  2⤵
  PID:7276
- C:\Windows\System\FtoFJGL.exe
  C:\Windows\System\FtoFJGL.exe
  2⤵
  PID:7320
- C:\Windows\System\KKbiOrj.exe
  C:\Windows\System\KKbiOrj.exe
  2⤵
  PID:7352
- C:\Windows\System\mNqAoGM.exe
  C:\Windows\System\mNqAoGM.exe
  2⤵
  PID:7384
- C:\Windows\System\RFNETPx.exe
  C:\Windows\System\RFNETPx.exe
  2⤵
  PID:7404
- C:\Windows\System\VmISloi.exe
  C:\Windows\System\VmISloi.exe
  2⤵
  PID:7428
- C:\Windows\System\zXEvuHa.exe
  C:\Windows\System\zXEvuHa.exe
  2⤵
  PID:7456
- C:\Windows\System\NgjvMNN.exe
  C:\Windows\System\NgjvMNN.exe
  2⤵
  PID:7476
- C:\Windows\System\UtOGErG.exe
  C:\Windows\System\UtOGErG.exe
  2⤵
  PID:7512
- C:\Windows\System\wsfThNh.exe
  C:\Windows\System\wsfThNh.exe
  2⤵
  PID:7540
- C:\Windows\System\bLdUtFc.exe
  C:\Windows\System\bLdUtFc.exe
  2⤵
  PID:7572
- C:\Windows\System\WWDekzg.exe
  C:\Windows\System\WWDekzg.exe
  2⤵
  PID:7600
- C:\Windows\System\rkhjFHd.exe
  C:\Windows\System\rkhjFHd.exe
  2⤵
  PID:7636
- C:\Windows\System\waZPVbB.exe
  C:\Windows\System\waZPVbB.exe
  2⤵
  PID:7664
- C:\Windows\System\kcRaAyA.exe
  C:\Windows\System\kcRaAyA.exe
  2⤵
  PID:7680
- C:\Windows\System\RccNIpr.exe
  C:\Windows\System\RccNIpr.exe
  2⤵
  PID:7708
- C:\Windows\System\Lcdbozp.exe
  C:\Windows\System\Lcdbozp.exe
  2⤵
  PID:7740
- C:\Windows\System\eYMHJsp.exe
  C:\Windows\System\eYMHJsp.exe
  2⤵
  PID:7764
- C:\Windows\System\FTsQwlD.exe
  C:\Windows\System\FTsQwlD.exe
  2⤵
  PID:7792
- C:\Windows\System\TIqHgoY.exe
  C:\Windows\System\TIqHgoY.exe
  2⤵
  PID:7820
- C:\Windows\System\splJNkd.exe
  C:\Windows\System\splJNkd.exe
  2⤵
  PID:7852
- C:\Windows\System\wktxEBY.exe
  C:\Windows\System\wktxEBY.exe
  2⤵
  PID:7876
- C:\Windows\System\RFBcZiC.exe
  C:\Windows\System\RFBcZiC.exe
  2⤵
  PID:7908
- C:\Windows\System\eJPrsRw.exe
  C:\Windows\System\eJPrsRw.exe
  2⤵
  PID:7944
- C:\Windows\System\faWqHwx.exe
  C:\Windows\System\faWqHwx.exe
  2⤵
  PID:7972
- C:\Windows\System\ijJfOCp.exe
  C:\Windows\System\ijJfOCp.exe
  2⤵
  PID:7992
- C:\Windows\System\QJsgGNH.exe
  C:\Windows\System\QJsgGNH.exe
  2⤵
  PID:8024
- C:\Windows\System\xNXJzZe.exe
  C:\Windows\System\xNXJzZe.exe
  2⤵
  PID:8056
- C:\Windows\System\ykLoNSd.exe
  C:\Windows\System\ykLoNSd.exe
  2⤵
  PID:8084
- C:\Windows\System\HeDYNWe.exe
  C:\Windows\System\HeDYNWe.exe
  2⤵
  PID:8100
- C:\Windows\System\fjHqkDS.exe
  C:\Windows\System\fjHqkDS.exe
  2⤵
  PID:8128
- C:\Windows\System\mFajGDZ.exe
  C:\Windows\System\mFajGDZ.exe
  2⤵
  PID:8156
- C:\Windows\System\SYhwDnM.exe
  C:\Windows\System\SYhwDnM.exe
  2⤵
  PID:528
- C:\Windows\System\ytSvpyh.exe
  C:\Windows\System\ytSvpyh.exe
  2⤵
  PID:6936
- C:\Windows\System\ViAYYZL.exe
  C:\Windows\System\ViAYYZL.exe
  2⤵
  PID:7244
- C:\Windows\System\ubsrbrt.exe
  C:\Windows\System\ubsrbrt.exe
  2⤵
  PID:7288
- C:\Windows\System\GoinpkB.exe
  C:\Windows\System\GoinpkB.exe
  2⤵
  PID:7308
- C:\Windows\System\ekdrVnD.exe
  C:\Windows\System\ekdrVnD.exe
  2⤵
  PID:7372
- C:\Windows\System\VGCAQMp.exe
  C:\Windows\System\VGCAQMp.exe
  2⤵
  PID:7440
- C:\Windows\System\rPPUcqf.exe
  C:\Windows\System\rPPUcqf.exe
  2⤵
  PID:7484
- C:\Windows\System\iZsPrAM.exe
  C:\Windows\System\iZsPrAM.exe
  2⤵
  PID:7564
- C:\Windows\System\uGtGyWX.exe
  C:\Windows\System\uGtGyWX.exe
  2⤵
  PID:7632
- C:\Windows\System\XiJhQfG.exe
  C:\Windows\System\XiJhQfG.exe
  2⤵
  PID:7696
- C:\Windows\System\ijjlUtA.exe
  C:\Windows\System\ijjlUtA.exe
  2⤵
  PID:7780
- C:\Windows\System\HuuHdke.exe
  C:\Windows\System\HuuHdke.exe
  2⤵
  PID:7840
- C:\Windows\System\vaICNGT.exe
  C:\Windows\System\vaICNGT.exe
  2⤵
  PID:7932
- C:\Windows\System\KiOtjOU.exe
  C:\Windows\System\KiOtjOU.exe
  2⤵
  PID:7980
- C:\Windows\System\mJcFvTU.exe
  C:\Windows\System\mJcFvTU.exe
  2⤵
  PID:8044
- C:\Windows\System\JIFMpib.exe
  C:\Windows\System\JIFMpib.exe
  2⤵
  PID:8116
- C:\Windows\System\nwetZyN.exe
  C:\Windows\System\nwetZyN.exe
  2⤵
  PID:8140
- C:\Windows\System\mUAOEXk.exe
  C:\Windows\System\mUAOEXk.exe
  2⤵
  PID:6264
- C:\Windows\System\XBYxrVL.exe
  C:\Windows\System\XBYxrVL.exe
  2⤵
  PID:7360
- C:\Windows\System\jCMTFTl.exe
  C:\Windows\System\jCMTFTl.exe
  2⤵
  PID:7272
- C:\Windows\System\xwoOcZx.exe
  C:\Windows\System\xwoOcZx.exe
  2⤵
  PID:2636
- C:\Windows\System\ycyKXXL.exe
  C:\Windows\System\ycyKXXL.exe
  2⤵
  PID:7704
- C:\Windows\System\fHcDMRW.exe
  C:\Windows\System\fHcDMRW.exe
  2⤵
  PID:7848
- C:\Windows\System\JtmeDQD.exe
  C:\Windows\System\JtmeDQD.exe
  2⤵
  PID:8016
- C:\Windows\System\IxWMTzp.exe
  C:\Windows\System\IxWMTzp.exe
  2⤵
  PID:8168
- C:\Windows\System\nouVdGR.exe
  C:\Windows\System\nouVdGR.exe
  2⤵
  PID:7344
- C:\Windows\System\jkRTBJu.exe
  C:\Windows\System\jkRTBJu.exe
  2⤵
  PID:4784
- C:\Windows\System\SXDKBPX.exe
  C:\Windows\System\SXDKBPX.exe
  2⤵
  PID:8112
- C:\Windows\System\LCVzuRJ.exe
  C:\Windows\System\LCVzuRJ.exe
  2⤵
  PID:7652
- C:\Windows\System\JvEWPYw.exe
  C:\Windows\System\JvEWPYw.exe
  2⤵
  PID:8224
- C:\Windows\System\kUwNNOj.exe
  C:\Windows\System\kUwNNOj.exe
  2⤵
  PID:8256
- C:\Windows\System\gqqRIPJ.exe
  C:\Windows\System\gqqRIPJ.exe
  2⤵
  PID:8284
- C:\Windows\System\fCgAmAS.exe
  C:\Windows\System\fCgAmAS.exe
  2⤵
  PID:8320
- C:\Windows\System\tFAjREW.exe
  C:\Windows\System\tFAjREW.exe
  2⤵
  PID:8344
- C:\Windows\System\KmeRXqm.exe
  C:\Windows\System\KmeRXqm.exe
  2⤵
  PID:8368
- C:\Windows\System\rCGcusL.exe
  C:\Windows\System\rCGcusL.exe
  2⤵
  PID:8384
- C:\Windows\System\FgtTwaX.exe
  C:\Windows\System\FgtTwaX.exe
  2⤵
  PID:8404
- C:\Windows\System\jvokUBd.exe
  C:\Windows\System\jvokUBd.exe
  2⤵
  PID:8424
- C:\Windows\System\FNfsyeK.exe
  C:\Windows\System\FNfsyeK.exe
  2⤵
  PID:8460
- C:\Windows\System\zyxNSdE.exe
  C:\Windows\System\zyxNSdE.exe
  2⤵
  PID:8492
- C:\Windows\System\uLWrzFE.exe
  C:\Windows\System\uLWrzFE.exe
  2⤵
  PID:8520
- C:\Windows\System\ynRKRaJ.exe
  C:\Windows\System\ynRKRaJ.exe
  2⤵
  PID:8552
- C:\Windows\System\DpgQlPk.exe
  C:\Windows\System\DpgQlPk.exe
  2⤵
  PID:8576
- C:\Windows\System\xhxvMEQ.exe
  C:\Windows\System\xhxvMEQ.exe
  2⤵
  PID:8604
- C:\Windows\System\OrAAbEv.exe
  C:\Windows\System\OrAAbEv.exe
  2⤵
  PID:8632
- C:\Windows\System\OfIVoyt.exe
  C:\Windows\System\OfIVoyt.exe
  2⤵
  PID:8672
- C:\Windows\System\WzdRskv.exe
  C:\Windows\System\WzdRskv.exe
  2⤵
  PID:8688
- C:\Windows\System\lhywVNH.exe
  C:\Windows\System\lhywVNH.exe
  2⤵
  PID:8708
- C:\Windows\System\mpasMku.exe
  C:\Windows\System\mpasMku.exe
  2⤵
  PID:8740
- C:\Windows\System\tBdWJby.exe
  C:\Windows\System\tBdWJby.exe
  2⤵
  PID:8772
- C:\Windows\System\ULzgYgz.exe
  C:\Windows\System\ULzgYgz.exe
  2⤵
  PID:8792
- C:\Windows\System\MwUReyt.exe
  C:\Windows\System\MwUReyt.exe
  2⤵
  PID:8844
- C:\Windows\System\lOjIFar.exe
  C:\Windows\System\lOjIFar.exe
  2⤵
  PID:8864
- C:\Windows\System\nDOWtxP.exe
  C:\Windows\System\nDOWtxP.exe
  2⤵
  PID:8888
- C:\Windows\System\MCYnFKr.exe
  C:\Windows\System\MCYnFKr.exe
  2⤵
  PID:8904
- C:\Windows\System\BsfQQLd.exe
  C:\Windows\System\BsfQQLd.exe
  2⤵
  PID:8932
- C:\Windows\System\PFkUKzC.exe
  C:\Windows\System\PFkUKzC.exe
  2⤵
  PID:8964
- C:\Windows\System\xwZMkrx.exe
  C:\Windows\System\xwZMkrx.exe
  2⤵
  PID:8992
- C:\Windows\System\sCFHfPM.exe
  C:\Windows\System\sCFHfPM.exe
  2⤵
  PID:9032
- C:\Windows\System\tKbjOWh.exe
  C:\Windows\System\tKbjOWh.exe
  2⤵
  PID:9056
- C:\Windows\System\GNGmIwM.exe
  C:\Windows\System\GNGmIwM.exe
  2⤵
  PID:9092
- C:\Windows\System\gMAbvZG.exe
  C:\Windows\System\gMAbvZG.exe
  2⤵
  PID:9128
- C:\Windows\System\DCKPKml.exe
  C:\Windows\System\DCKPKml.exe
  2⤵
  PID:9156
- C:\Windows\System\WCrCKwn.exe
  C:\Windows\System\WCrCKwn.exe
  2⤵
  PID:9192
- C:\Windows\System\YANvbya.exe
  C:\Windows\System\YANvbya.exe
  2⤵
  PID:9212
- C:\Windows\System\DtbprDY.exe
  C:\Windows\System\DtbprDY.exe
  2⤵
  PID:8072
- C:\Windows\System\pRQdXUz.exe
  C:\Windows\System\pRQdXUz.exe
  2⤵
  PID:8264
- C:\Windows\System\eTsCSZs.exe
  C:\Windows\System\eTsCSZs.exe
  2⤵
  PID:8312
- C:\Windows\System\qYmWiVx.exe
  C:\Windows\System\qYmWiVx.exe
  2⤵
  PID:8396
- C:\Windows\System\LECwtCW.exe
  C:\Windows\System\LECwtCW.exe
  2⤵
  PID:8416
- C:\Windows\System\RfvimUP.exe
  C:\Windows\System\RfvimUP.exe
  2⤵
  PID:8512
- C:\Windows\System\MFdecfw.exe
  C:\Windows\System\MFdecfw.exe
  2⤵
  PID:8508
- C:\Windows\System\agMRixz.exe
  C:\Windows\System\agMRixz.exe
  2⤵
  PID:8596
- C:\Windows\System\LTJpCqY.exe
  C:\Windows\System\LTJpCqY.exe
  2⤵
  PID:8660
- C:\Windows\System\SdcWvZG.exe
  C:\Windows\System\SdcWvZG.exe
  2⤵
  PID:8720
- C:\Windows\System\xHZXSuV.exe
  C:\Windows\System\xHZXSuV.exe
  2⤵
  PID:8812
- C:\Windows\System\ULNgrAU.exe
  C:\Windows\System\ULNgrAU.exe
  2⤵
  PID:8880
- C:\Windows\System\YxTWAYh.exe
  C:\Windows\System\YxTWAYh.exe
  2⤵
  PID:8944
- C:\Windows\System\VpsQpZx.exe
  C:\Windows\System\VpsQpZx.exe
  2⤵
  PID:9068
- C:\Windows\System\szpbvou.exe
  C:\Windows\System\szpbvou.exe
  2⤵
  PID:9148
- C:\Windows\System\IVLvesV.exe
  C:\Windows\System\IVLvesV.exe
  2⤵
  PID:9176
- C:\Windows\System\RNikIax.exe
  C:\Windows\System\RNikIax.exe
  2⤵
  PID:2384
- C:\Windows\System\XUkzzzh.exe
  C:\Windows\System\XUkzzzh.exe
  2⤵
  PID:7500
- C:\Windows\System\BDrnJtm.exe
  C:\Windows\System\BDrnJtm.exe
  2⤵
  PID:8420
- C:\Windows\System\qjxjmgc.exe
  C:\Windows\System\qjxjmgc.exe
  2⤵
  PID:8448
- C:\Windows\System\GRvXHOq.exe
  C:\Windows\System\GRvXHOq.exe
  2⤵
  PID:8680
- C:\Windows\System\ocTrFLj.exe
  C:\Windows\System\ocTrFLj.exe
  2⤵
  PID:8924
- C:\Windows\System\mesAITd.exe
  C:\Windows\System\mesAITd.exe
  2⤵
  PID:8988
- C:\Windows\System\OWuTerj.exe
  C:\Windows\System\OWuTerj.exe
  2⤵
  PID:412
- C:\Windows\System\JpKrFEo.exe
  C:\Windows\System\JpKrFEo.exe
  2⤵
  PID:8276
- C:\Windows\System\cUjwPeB.exe
  C:\Windows\System\cUjwPeB.exe
  2⤵
  PID:8592
- C:\Windows\System\BZqqXBX.exe
  C:\Windows\System\BZqqXBX.exe
  2⤵
  PID:8836
- C:\Windows\System\wxqlBMq.exe
  C:\Windows\System\wxqlBMq.exe
  2⤵
  PID:9064
- C:\Windows\System\qqLQMof.exe
  C:\Windows\System\qqLQMof.exe
  2⤵
  PID:8896
- C:\Windows\System\WyrfXwz.exe
  C:\Windows\System\WyrfXwz.exe
  2⤵
  PID:8352
- C:\Windows\System\IRrlcTN.exe
  C:\Windows\System\IRrlcTN.exe
  2⤵
  PID:9244
- C:\Windows\System\QBdNomD.exe
  C:\Windows\System\QBdNomD.exe
  2⤵
  PID:9276
- C:\Windows\System\ZjsUJqS.exe
  C:\Windows\System\ZjsUJqS.exe
  2⤵
  PID:9300
- C:\Windows\System\dNQUTFP.exe
  C:\Windows\System\dNQUTFP.exe
  2⤵
  PID:9316
- C:\Windows\System\ELIiaZk.exe
  C:\Windows\System\ELIiaZk.exe
  2⤵
  PID:9356
- C:\Windows\System\yYocSKk.exe
  C:\Windows\System\yYocSKk.exe
  2⤵
  PID:9384
- C:\Windows\System\PfYQUKo.exe
  C:\Windows\System\PfYQUKo.exe
  2⤵
  PID:9408
- C:\Windows\System\GddxUhY.exe
  C:\Windows\System\GddxUhY.exe
  2⤵
  PID:9440
- C:\Windows\System\BSXInpz.exe
  C:\Windows\System\BSXInpz.exe
  2⤵
  PID:9472
- C:\Windows\System\xApRWPa.exe
  C:\Windows\System\xApRWPa.exe
  2⤵
  PID:9496
- C:\Windows\System\TxVZFLi.exe
  C:\Windows\System\TxVZFLi.exe
  2⤵
  PID:9524
- C:\Windows\System\RpZgTTH.exe
  C:\Windows\System\RpZgTTH.exe
  2⤵
  PID:9560
- C:\Windows\System\Qzisydi.exe
  C:\Windows\System\Qzisydi.exe
  2⤵
  PID:9588
- C:\Windows\System\CjbZpeB.exe
  C:\Windows\System\CjbZpeB.exe
  2⤵
  PID:9608
- C:\Windows\System\UuTXaKZ.exe
  C:\Windows\System\UuTXaKZ.exe
  2⤵
  PID:9628
- C:\Windows\System\lVNCkkt.exe
  C:\Windows\System\lVNCkkt.exe
  2⤵
  PID:9652
- C:\Windows\System\xSiZtpH.exe
  C:\Windows\System\xSiZtpH.exe
  2⤵
  PID:9684
- C:\Windows\System\nYZaWAB.exe
  C:\Windows\System\nYZaWAB.exe
  2⤵
  PID:9712
- C:\Windows\System\mykgFXS.exe
  C:\Windows\System\mykgFXS.exe
  2⤵
  PID:9740
- C:\Windows\System\AzBulGR.exe
  C:\Windows\System\AzBulGR.exe
  2⤵
  PID:9760
- C:\Windows\System\GUnsNfP.exe
  C:\Windows\System\GUnsNfP.exe
  2⤵
  PID:9788
- C:\Windows\System\nSTvZUC.exe
  C:\Windows\System\nSTvZUC.exe
  2⤵
  PID:9820
- C:\Windows\System\hmzyfkD.exe
  C:\Windows\System\hmzyfkD.exe
  2⤵
  PID:9836
- C:\Windows\System\rbkktQz.exe
  C:\Windows\System\rbkktQz.exe
  2⤵
  PID:9860
- C:\Windows\System\VJbiNWe.exe
  C:\Windows\System\VJbiNWe.exe
  2⤵
  PID:9892
- C:\Windows\System\rcRiXCN.exe
  C:\Windows\System\rcRiXCN.exe
  2⤵
  PID:9932
- C:\Windows\System\veNAxTA.exe
  C:\Windows\System\veNAxTA.exe
  2⤵
  PID:9964
- C:\Windows\System\TUzDMXp.exe
  C:\Windows\System\TUzDMXp.exe
  2⤵
  PID:10004
- C:\Windows\System\ddAYtiw.exe
  C:\Windows\System\ddAYtiw.exe
  2⤵
  PID:10028
- C:\Windows\System\OYwZmsj.exe
  C:\Windows\System\OYwZmsj.exe
  2⤵
  PID:10056
- C:\Windows\System\wvmLwuZ.exe
  C:\Windows\System\wvmLwuZ.exe
  2⤵
  PID:10084
- C:\Windows\System\GmIMeid.exe
  C:\Windows\System\GmIMeid.exe
  2⤵
  PID:10112
- C:\Windows\System\PnHFgjz.exe
  C:\Windows\System\PnHFgjz.exe
  2⤵
  PID:10136
- C:\Windows\System\VfcORZz.exe
  C:\Windows\System\VfcORZz.exe
  2⤵
  PID:10168
- C:\Windows\System\fLYbOmO.exe
  C:\Windows\System\fLYbOmO.exe
  2⤵
  PID:10188
- C:\Windows\System\QFLRgFP.exe
  C:\Windows\System\QFLRgFP.exe
  2⤵
  PID:10224
- C:\Windows\System\ULnfdyb.exe
  C:\Windows\System\ULnfdyb.exe
  2⤵
  PID:9232
- C:\Windows\System\MeklGbD.exe
  C:\Windows\System\MeklGbD.exe
  2⤵
  PID:9272
- C:\Windows\System\NoWPQiG.exe
  C:\Windows\System\NoWPQiG.exe
  2⤵
  PID:9308
- C:\Windows\System\dnnDvcj.exe
  C:\Windows\System\dnnDvcj.exe
  2⤵
  PID:9376
- C:\Windows\System\pZsFWwh.exe
  C:\Windows\System\pZsFWwh.exe
  2⤵
  PID:9456
- C:\Windows\System\aEMvIjK.exe
  C:\Windows\System\aEMvIjK.exe
  2⤵
  PID:9512
- C:\Windows\System\AWUFQeu.exe
  C:\Windows\System\AWUFQeu.exe
  2⤵
  PID:9572
- C:\Windows\System\tbWJpky.exe
  C:\Windows\System\tbWJpky.exe
  2⤵
  PID:9624
- C:\Windows\System\zFIKcwG.exe
  C:\Windows\System\zFIKcwG.exe
  2⤵
  PID:9676
- C:\Windows\System\yGJtBDo.exe
  C:\Windows\System\yGJtBDo.exe
  2⤵
  PID:9748
- C:\Windows\System\FSJMKxM.exe
  C:\Windows\System\FSJMKxM.exe
  2⤵
  PID:9808
- C:\Windows\System\llbaGjv.exe
  C:\Windows\System\llbaGjv.exe
  2⤵
  PID:9832
- C:\Windows\System\RyMShGp.exe
  C:\Windows\System\RyMShGp.exe
  2⤵
  PID:9944
- C:\Windows\System\MsQyAsE.exe
  C:\Windows\System\MsQyAsE.exe
  2⤵
  PID:10020
- C:\Windows\System\NOfCEqU.exe
  C:\Windows\System\NOfCEqU.exe
  2⤵
  PID:10100
- C:\Windows\System\CoXyajG.exe
  C:\Windows\System\CoXyajG.exe
  2⤵
  PID:10132
- C:\Windows\System\puHJSxe.exe
  C:\Windows\System\puHJSxe.exe
  2⤵
  PID:10220
- C:\Windows\System\xZwwJBv.exe
  C:\Windows\System\xZwwJBv.exe
  2⤵
  PID:9372
- C:\Windows\System\yuZPYPP.exe
  C:\Windows\System\yuZPYPP.exe
  2⤵
  PID:9492
- C:\Windows\System\CwYwJpe.exe
  C:\Windows\System\CwYwJpe.exe
  2⤵
  PID:9728
- C:\Windows\System\FztSwbV.exe
  C:\Windows\System\FztSwbV.exe
  2⤵
  PID:9600
- C:\Windows\System\sfrxmuL.exe
  C:\Windows\System\sfrxmuL.exe
  2⤵
  PID:8704
- C:\Windows\System\HMKJUqz.exe
  C:\Windows\System\HMKJUqz.exe
  2⤵
  PID:10160
- C:\Windows\System\BdGrbaz.exe
  C:\Windows\System\BdGrbaz.exe
  2⤵
  PID:9288
- C:\Windows\System\EFecLPB.exe
  C:\Windows\System\EFecLPB.exe
  2⤵
  PID:9804
- C:\Windows\System\jAdkQIj.exe
  C:\Windows\System\jAdkQIj.exe
  2⤵
  PID:9856
- C:\Windows\System\adzURHp.exe
  C:\Windows\System\adzURHp.exe
  2⤵
  PID:10044
- C:\Windows\System\poVKpjQ.exe
  C:\Windows\System\poVKpjQ.exe
  2⤵
  PID:10144
- C:\Windows\System\mLbaUby.exe
  C:\Windows\System\mLbaUby.exe
  2⤵
  PID:10252
- C:\Windows\System\JFegLqO.exe
  C:\Windows\System\JFegLqO.exe
  2⤵
  PID:10288
- C:\Windows\System\wsqlgSq.exe
  C:\Windows\System\wsqlgSq.exe
  2⤵
  PID:10308
- C:\Windows\System\PJGhdrT.exe
  C:\Windows\System\PJGhdrT.exe
  2⤵
  PID:10344
- C:\Windows\System\oOXCHkA.exe
  C:\Windows\System\oOXCHkA.exe
  2⤵
  PID:10376
- C:\Windows\System\YkKFJXn.exe
  C:\Windows\System\YkKFJXn.exe
  2⤵
  PID:10400
- C:\Windows\System\jNlGdfN.exe
  C:\Windows\System\jNlGdfN.exe
  2⤵
  PID:10432
- C:\Windows\System\hQqftxW.exe
  C:\Windows\System\hQqftxW.exe
  2⤵
  PID:10460
- C:\Windows\System\ciIfsuK.exe
  C:\Windows\System\ciIfsuK.exe
  2⤵
  PID:10488
- C:\Windows\System\miEJqRS.exe
  C:\Windows\System\miEJqRS.exe
  2⤵
  PID:10520
- C:\Windows\System\VnTrUaJ.exe
  C:\Windows\System\VnTrUaJ.exe
  2⤵
  PID:10540
- C:\Windows\System\RnHVkFp.exe
  C:\Windows\System\RnHVkFp.exe
  2⤵
  PID:10560
- C:\Windows\System\tiksJkX.exe
  C:\Windows\System\tiksJkX.exe
  2⤵
  PID:10600
- C:\Windows\System\UJbvCZF.exe
  C:\Windows\System\UJbvCZF.exe
  2⤵
  PID:10632
- C:\Windows\System\NjompJw.exe
  C:\Windows\System\NjompJw.exe
  2⤵
  PID:10656
- C:\Windows\System\iSrycpT.exe
  C:\Windows\System\iSrycpT.exe
  2⤵
  PID:10684
- C:\Windows\System\uiEqFCS.exe
  C:\Windows\System\uiEqFCS.exe
  2⤵
  PID:10720
- C:\Windows\System\rrkPxSk.exe
  C:\Windows\System\rrkPxSk.exe
  2⤵
  PID:10744
- C:\Windows\System\NayCxby.exe
  C:\Windows\System\NayCxby.exe
  2⤵
  PID:10776
- C:\Windows\System\jEzvZoJ.exe
  C:\Windows\System\jEzvZoJ.exe
  2⤵
  PID:10792
- C:\Windows\System\hhvNtIt.exe
  C:\Windows\System\hhvNtIt.exe
  2⤵
  PID:10824
- C:\Windows\System\PGyCtPZ.exe
  C:\Windows\System\PGyCtPZ.exe
  2⤵
  PID:10856
- C:\Windows\System\iSlUXJu.exe
  C:\Windows\System\iSlUXJu.exe
  2⤵
  PID:10880
- C:\Windows\System\Ufmkxbb.exe
  C:\Windows\System\Ufmkxbb.exe
  2⤵
  PID:10912
- C:\Windows\System\iBNgleI.exe
  C:\Windows\System\iBNgleI.exe
  2⤵
  PID:10948
- C:\Windows\System\iAWHiVP.exe
  C:\Windows\System\iAWHiVP.exe
  2⤵
  PID:10976
- C:\Windows\System\zrYZKUs.exe
  C:\Windows\System\zrYZKUs.exe
  2⤵
  PID:10992
- C:\Windows\System\qgqhuWY.exe
  C:\Windows\System\qgqhuWY.exe
  2⤵
  PID:11020
- C:\Windows\System\PVqnBOJ.exe
  C:\Windows\System\PVqnBOJ.exe
  2⤵
  PID:11056
- C:\Windows\System\gVgvpwO.exe
  C:\Windows\System\gVgvpwO.exe
  2⤵
  PID:11076
- C:\Windows\System\UHoMLeO.exe
  C:\Windows\System\UHoMLeO.exe
  2⤵
  PID:11104
- C:\Windows\System\aMZFFEH.exe
  C:\Windows\System\aMZFFEH.exe
  2⤵
  PID:11132
- C:\Windows\System\CCGYROg.exe
  C:\Windows\System\CCGYROg.exe
  2⤵
  PID:11164
- C:\Windows\System\KsMeezh.exe
  C:\Windows\System\KsMeezh.exe
  2⤵
  PID:11192
- C:\Windows\System\cQXQlWh.exe
  C:\Windows\System\cQXQlWh.exe
  2⤵
  PID:11216
- C:\Windows\System\ShIPiIu.exe
  C:\Windows\System\ShIPiIu.exe
  2⤵
  PID:11244
- C:\Windows\System\nkubBNQ.exe
  C:\Windows\System\nkubBNQ.exe
  2⤵
  PID:856
- C:\Windows\System\DLOEyzx.exe
  C:\Windows\System\DLOEyzx.exe
  2⤵
  PID:10248
- C:\Windows\System\ugIownI.exe
  C:\Windows\System\ugIownI.exe
  2⤵
  PID:10320
- C:\Windows\System\XNJgAgL.exe
  C:\Windows\System\XNJgAgL.exe
  2⤵
  PID:10360
- C:\Windows\System\iQGhLRT.exe
  C:\Windows\System\iQGhLRT.exe
  2⤵
  PID:10388
- C:\Windows\System\ecQmwxs.exe
  C:\Windows\System\ecQmwxs.exe
  2⤵
  PID:10500
- C:\Windows\System\PlBShjE.exe
  C:\Windows\System\PlBShjE.exe
  2⤵
  PID:10552
- C:\Windows\System\nzohION.exe
  C:\Windows\System\nzohION.exe
  2⤵
  PID:10608
- C:\Windows\System\dBUjkJm.exe
  C:\Windows\System\dBUjkJm.exe
  2⤵
  PID:10680
- C:\Windows\System\XpXmSnu.exe
  C:\Windows\System\XpXmSnu.exe
  2⤵
  PID:10788
- C:\Windows\System\zfflOtS.exe
  C:\Windows\System\zfflOtS.exe
  2⤵
  PID:10820
- C:\Windows\System\CIBdUXp.exe
  C:\Windows\System\CIBdUXp.exe
  2⤵
  PID:10872
- C:\Windows\System\PfyVjyt.exe
  C:\Windows\System\PfyVjyt.exe
  2⤵
  PID:10960
- C:\Windows\System\YwOwUMZ.exe
  C:\Windows\System\YwOwUMZ.exe
  2⤵
  PID:11036
- C:\Windows\System\CxKwQLb.exe
  C:\Windows\System\CxKwQLb.exe
  2⤵
  PID:11124
- C:\Windows\System\CWMUCaa.exe
  C:\Windows\System\CWMUCaa.exe
  2⤵
  PID:11172
- C:\Windows\System\KBLRxJw.exe
  C:\Windows\System\KBLRxJw.exe
  2⤵
  PID:10272
- C:\Windows\System\iiTJPPz.exe
  C:\Windows\System\iiTJPPz.exe
  2⤵
  PID:10300
- C:\Windows\System\BNXUScL.exe
  C:\Windows\System\BNXUScL.exe
  2⤵
  PID:10420
- C:\Windows\System\efosZpI.exe
  C:\Windows\System\efosZpI.exe
  2⤵
  PID:10556
- C:\Windows\System\ZTtokQg.exe
  C:\Windows\System\ZTtokQg.exe
  2⤵
  PID:10152
- C:\Windows\System\GekFEQC.exe
  C:\Windows\System\GekFEQC.exe
  2⤵
  PID:10808
- C:\Windows\System\MnoknWD.exe
  C:\Windows\System\MnoknWD.exe
  2⤵
  PID:4880
- C:\Windows\System\aDFVlNE.exe
  C:\Windows\System\aDFVlNE.exe
  2⤵
  PID:11160
- C:\Windows\System\aSKRgbx.exe
  C:\Windows\System\aSKRgbx.exe
  2⤵
  PID:11260
- C:\Windows\System\EFqCKpw.exe
  C:\Windows\System\EFqCKpw.exe
  2⤵
  PID:10424
- C:\Windows\System\uikepRG.exe
  C:\Windows\System\uikepRG.exe
  2⤵
  PID:11100
- C:\Windows\System\ikhseTK.exe
  C:\Windows\System\ikhseTK.exe
  2⤵
  PID:10472
- C:\Windows\System\GYRzkdj.exe
  C:\Windows\System\GYRzkdj.exe
  2⤵
  PID:11116
- C:\Windows\System\uPUWFyc.exe
  C:\Windows\System\uPUWFyc.exe
  2⤵
  PID:11296
- C:\Windows\System\ARjOHCz.exe
  C:\Windows\System\ARjOHCz.exe
  2⤵
  PID:11328
- C:\Windows\System\RKRMIAp.exe
  C:\Windows\System\RKRMIAp.exe
  2⤵
  PID:11356
- C:\Windows\System\dZGVXjO.exe
  C:\Windows\System\dZGVXjO.exe
  2⤵
  PID:11388
- C:\Windows\System\EXjWShi.exe
  C:\Windows\System\EXjWShi.exe
  2⤵
  PID:11416
- C:\Windows\System\qoLVQiI.exe
  C:\Windows\System\qoLVQiI.exe
  2⤵
  PID:11440
- C:\Windows\System\CaBomWJ.exe
  C:\Windows\System\CaBomWJ.exe
  2⤵
  PID:11468
- C:\Windows\System\kAnqFxq.exe
  C:\Windows\System\kAnqFxq.exe
  2⤵
  PID:11500
- C:\Windows\System\kBRAMqk.exe
  C:\Windows\System\kBRAMqk.exe
  2⤵
  PID:11524
- C:\Windows\System\pPgtbaM.exe
  C:\Windows\System\pPgtbaM.exe
  2⤵
  PID:11552
- C:\Windows\System\elahWHd.exe
  C:\Windows\System\elahWHd.exe
  2⤵
  PID:11568
- C:\Windows\System\HCKmSyy.exe
  C:\Windows\System\HCKmSyy.exe
  2⤵
  PID:11604
- C:\Windows\System\rQnMves.exe
  C:\Windows\System\rQnMves.exe
  2⤵
  PID:11628
- C:\Windows\System\KtMoKiF.exe
  C:\Windows\System\KtMoKiF.exe
  2⤵
  PID:11652
- C:\Windows\System\tmUDHkG.exe
  C:\Windows\System\tmUDHkG.exe
  2⤵
  PID:11688
- C:\Windows\System\ahmLUcv.exe
  C:\Windows\System\ahmLUcv.exe
  2⤵
  PID:11712
- C:\Windows\System\DXdONEI.exe
  C:\Windows\System\DXdONEI.exe
  2⤵
  PID:11748
- C:\Windows\System\xlHwxZI.exe
  C:\Windows\System\xlHwxZI.exe
  2⤵
  PID:11776
- C:\Windows\System\WKeyqFc.exe
  C:\Windows\System\WKeyqFc.exe
  2⤵
  PID:11804
- C:\Windows\System\rPTsOPg.exe
  C:\Windows\System\rPTsOPg.exe
  2⤵
  PID:11820
- C:\Windows\System\JYzVlMp.exe
  C:\Windows\System\JYzVlMp.exe
  2⤵
  PID:11856
- C:\Windows\System\fXodFVf.exe
  C:\Windows\System\fXodFVf.exe
  2⤵
  PID:11888
- C:\Windows\System\zCTBlTo.exe
  C:\Windows\System\zCTBlTo.exe
  2⤵
  PID:11916
- C:\Windows\System\aYtqMEe.exe
  C:\Windows\System\aYtqMEe.exe
  2⤵
  PID:11944
- C:\Windows\System\Ohrmrmn.exe
  C:\Windows\System\Ohrmrmn.exe
  2⤵
  PID:11984
- C:\Windows\System\EghenSU.exe
  C:\Windows\System\EghenSU.exe
  2⤵
  PID:12012
- C:\Windows\System\oFqeHdO.exe
  C:\Windows\System\oFqeHdO.exe
  2⤵
  PID:12028
- C:\Windows\System\SrQBsoh.exe
  C:\Windows\System\SrQBsoh.exe
  2⤵
  PID:12044
- C:\Windows\System\vGvprKi.exe
  C:\Windows\System\vGvprKi.exe
  2⤵
  PID:12068
- C:\Windows\System\MdfXLOq.exe
  C:\Windows\System\MdfXLOq.exe
  2⤵
  PID:12100
- C:\Windows\System\QuNNUyh.exe
  C:\Windows\System\QuNNUyh.exe
  2⤵
  PID:12140
- C:\Windows\System\zJIjPGC.exe
  C:\Windows\System\zJIjPGC.exe
  2⤵
  PID:12172
- C:\Windows\System\eeYEMor.exe
  C:\Windows\System\eeYEMor.exe
  2⤵
  PID:12188
- C:\Windows\System\jUylkTY.exe
  C:\Windows\System\jUylkTY.exe
  2⤵
  PID:12212
- C:\Windows\System\UzxgrbD.exe
  C:\Windows\System\UzxgrbD.exe
  2⤵
  PID:12244
- C:\Windows\System\hilMTTX.exe
  C:\Windows\System\hilMTTX.exe
  2⤵
  PID:12280
- C:\Windows\System\QcevSzt.exe
  C:\Windows\System\QcevSzt.exe
  2⤵
  PID:11048
- C:\Windows\System\rGyXmut.exe
  C:\Windows\System\rGyXmut.exe
  2⤵
  PID:11280
- C:\Windows\System\ivmKlxw.exe
  C:\Windows\System\ivmKlxw.exe
  2⤵
  PID:11368
- C:\Windows\System\SSKknIV.exe
  C:\Windows\System\SSKknIV.exe
  2⤵
  PID:11404
- C:\Windows\System\pOMvxJs.exe
  C:\Windows\System\pOMvxJs.exe
  2⤵
  PID:11496
- C:\Windows\System\okdORiX.exe
  C:\Windows\System\okdORiX.exe
  2⤵
  PID:11544
- C:\Windows\System\NcXMZgG.exe
  C:\Windows\System\NcXMZgG.exe
  2⤵
  PID:11596
- C:\Windows\System\qdtGKBQ.exe
  C:\Windows\System\qdtGKBQ.exe
  2⤵
  PID:11720
- C:\Windows\System\taPIDYE.exe
  C:\Windows\System\taPIDYE.exe
  2⤵
  PID:11756
- C:\Windows\System\zhnAYoW.exe
  C:\Windows\System\zhnAYoW.exe
  2⤵
  PID:11832
- C:\Windows\System\CtBohUA.exe
  C:\Windows\System\CtBohUA.exe
  2⤵
  PID:11912
- C:\Windows\System\vsTMgOK.exe
  C:\Windows\System\vsTMgOK.exe
  2⤵
  PID:11996
- C:\Windows\System\DtoMJkZ.exe
  C:\Windows\System\DtoMJkZ.exe
  2⤵
  PID:12064
- C:\Windows\System\VogzItO.exe
  C:\Windows\System\VogzItO.exe
  2⤵
  PID:12088
- C:\Windows\System\FlVMwxc.exe
  C:\Windows\System\FlVMwxc.exe
  2⤵
  PID:12124
- C:\Windows\System\uScnxNx.exe
  C:\Windows\System\uScnxNx.exe
  2⤵
  PID:12228
- C:\Windows\System\AmTqASE.exe
  C:\Windows\System\AmTqASE.exe
  2⤵
  PID:12264
- C:\Windows\System\oBuLuAe.exe
  C:\Windows\System\oBuLuAe.exe
  2⤵
  PID:11384
- C:\Windows\System\wOKBxNk.exe
  C:\Windows\System\wOKBxNk.exe
  2⤵
  PID:11488
- C:\Windows\System\DNnjTqZ.exe
  C:\Windows\System\DNnjTqZ.exe
  2⤵
  PID:11740
- C:\Windows\System\TeenjZg.exe
  C:\Windows\System\TeenjZg.exe
  2⤵
  PID:11972
- C:\Windows\System\CVEWGmX.exe
  C:\Windows\System\CVEWGmX.exe
  2⤵
  PID:12040
- C:\Windows\System\KClEUvz.exe
  C:\Windows\System\KClEUvz.exe
  2⤵
  PID:12224
- C:\Windows\System\dAybXLE.exe
  C:\Windows\System\dAybXLE.exe
  2⤵
  PID:11308
- C:\Windows\System\mZzRHAz.exe
  C:\Windows\System\mZzRHAz.exe
  2⤵
  PID:11796
- C:\Windows\System\acNzeGV.exe
  C:\Windows\System\acNzeGV.exe
  2⤵
  PID:12080
- C:\Windows\System\hoUTXwM.exe
  C:\Windows\System\hoUTXwM.exe
  2⤵
  PID:11612
- C:\Windows\System\kBnUrop.exe
  C:\Windows\System\kBnUrop.exe
  2⤵
  PID:12312
- C:\Windows\System\zNXNwVd.exe
  C:\Windows\System\zNXNwVd.exe
  2⤵
  PID:12340
- C:\Windows\System\RJPMRwt.exe
  C:\Windows\System\RJPMRwt.exe
  2⤵
  PID:12360
- C:\Windows\System\PYgelMC.exe
  C:\Windows\System\PYgelMC.exe
  2⤵
  PID:12388
- C:\Windows\System\oyOprtz.exe
  C:\Windows\System\oyOprtz.exe
  2⤵
  PID:12424
- C:\Windows\System\mhyoUdK.exe
  C:\Windows\System\mhyoUdK.exe
  2⤵
  PID:12440
- C:\Windows\System\RsdPFBH.exe
  C:\Windows\System\RsdPFBH.exe
  2⤵
  PID:12464
- C:\Windows\System\YzXiKcF.exe
  C:\Windows\System\YzXiKcF.exe
  2⤵
  PID:12492
- C:\Windows\System\HyoSdwD.exe
  C:\Windows\System\HyoSdwD.exe
  2⤵
  PID:12536
- C:\Windows\System\VVCoYea.exe
  C:\Windows\System\VVCoYea.exe
  2⤵
  PID:12564
- C:\Windows\System\HjjUZPf.exe
  C:\Windows\System\HjjUZPf.exe
  2⤵
  PID:12592
- C:\Windows\System\SElzVQI.exe
  C:\Windows\System\SElzVQI.exe
  2⤵
  PID:12620
- C:\Windows\System\ErNuoYo.exe
  C:\Windows\System\ErNuoYo.exe
  2⤵
  PID:12640
- C:\Windows\System\YlhKksZ.exe
  C:\Windows\System\YlhKksZ.exe
  2⤵
  PID:12676
- C:\Windows\System\mUaMoXt.exe
  C:\Windows\System\mUaMoXt.exe
  2⤵
  PID:12704
- C:\Windows\System\ZJcsRHh.exe
  C:\Windows\System\ZJcsRHh.exe
  2⤵
  PID:12736
- C:\Windows\System\mvtwbbU.exe
  C:\Windows\System\mvtwbbU.exe
  2⤵
  PID:12764
- C:\Windows\System\etJfMoU.exe
  C:\Windows\System\etJfMoU.exe
  2⤵
  PID:12788
- C:\Windows\System\rXKroMe.exe
  C:\Windows\System\rXKroMe.exe
  2⤵
  PID:12808
- C:\Windows\System\dCuvIZx.exe
  C:\Windows\System\dCuvIZx.exe
  2⤵
  PID:12840
- C:\Windows\System\xewxamn.exe
  C:\Windows\System\xewxamn.exe
  2⤵
  PID:12864
- C:\Windows\System\UyLdUpO.exe
  C:\Windows\System\UyLdUpO.exe
  2⤵
  PID:12888
- C:\Windows\System\oFHbENb.exe
  C:\Windows\System\oFHbENb.exe
  2⤵
  PID:12924
- C:\Windows\System\gQbpwIe.exe
  C:\Windows\System\gQbpwIe.exe
  2⤵
  PID:12948
- C:\Windows\System\SqZRQSB.exe
  C:\Windows\System\SqZRQSB.exe
  2⤵
  PID:12980
- C:\Windows\System\pYVrRDO.exe
  C:\Windows\System\pYVrRDO.exe
  2⤵
  PID:13012
- C:\Windows\System\vXtSsSo.exe
  C:\Windows\System\vXtSsSo.exe
  2⤵
  PID:13032
- C:\Windows\System\OCaYxKH.exe
  C:\Windows\System\OCaYxKH.exe
  2⤵
  PID:13056
- C:\Windows\System\ktrYzJP.exe
  C:\Windows\System\ktrYzJP.exe
  2⤵
  PID:13076
- C:\Windows\System\NiJwcFP.exe
  C:\Windows\System\NiJwcFP.exe
  2⤵
  PID:13100
- C:\Windows\System\nHXpths.exe
  C:\Windows\System\nHXpths.exe
  2⤵
  PID:13132
- C:\Windows\System\bTTqrSj.exe
  C:\Windows\System\bTTqrSj.exe
  2⤵
  PID:13164
- C:\Windows\System\JLhCIQY.exe
  C:\Windows\System\JLhCIQY.exe
  2⤵
  PID:13188
- C:\Windows\System\XgtNURf.exe
  C:\Windows\System\XgtNURf.exe
  2⤵
  PID:13220
- C:\Windows\System\HXLHCZU.exe
  C:\Windows\System\HXLHCZU.exe
  2⤵
  PID:13244
- C:\Windows\System\CNaucJY.exe
  C:\Windows\System\CNaucJY.exe
  2⤵
  PID:13280
- C:\Windows\System\DWqoLFN.exe
  C:\Windows\System\DWqoLFN.exe
  2⤵
  PID:11620
- C:\Windows\System\HLRHBNx.exe
  C:\Windows\System\HLRHBNx.exe
  2⤵
  PID:12180
- C:\Windows\System\MMcchMB.exe
  C:\Windows\System\MMcchMB.exe
  2⤵
  PID:12400
- C:\Windows\System\rHRMxkq.exe
  C:\Windows\System\rHRMxkq.exe
  2⤵
  PID:12436
- C:\Windows\System\LnRzAko.exe
  C:\Windows\System\LnRzAko.exe
  2⤵
  PID:12488
- C:\Windows\System\QsOfXde.exe
  C:\Windows\System\QsOfXde.exe
  2⤵
  PID:12584
- C:\Windows\System\alsLmFP.exe
  C:\Windows\System\alsLmFP.exe
  2⤵
  PID:12652
- C:\Windows\System\XSnVfEr.exe
  C:\Windows\System\XSnVfEr.exe
  2⤵
  PID:12660
- C:\Windows\System\nPenNwm.exe
  C:\Windows\System\nPenNwm.exe
  2⤵
  PID:12748
- C:\Windows\System\obLmHiX.exe
  C:\Windows\System\obLmHiX.exe
  2⤵
  PID:12828
- C:\Windows\System\odeJjrx.exe
  C:\Windows\System\odeJjrx.exe
  2⤵
  PID:12884
- C:\Windows\System\mCMvJmE.exe
  C:\Windows\System\mCMvJmE.exe
  2⤵
  PID:12916
- C:\Windows\System\csaPlMT.exe
  C:\Windows\System\csaPlMT.exe
  2⤵
  PID:13048
- C:\Windows\System\GDIfoWE.exe
  C:\Windows\System\GDIfoWE.exe
  2⤵
  PID:13072
- C:\Windows\System\iOBRrBO.exe
  C:\Windows\System\iOBRrBO.exe
  2⤵
  PID:13144
- C:\Windows\System\ThzKbmF.exe
  C:\Windows\System\ThzKbmF.exe
  2⤵
  PID:13208
- C:\Windows\System\JHBvTXZ.exe
  C:\Windows\System\JHBvTXZ.exe
  2⤵
  PID:13276
- C:\Windows\System\FlbclSt.exe
  C:\Windows\System\FlbclSt.exe
  2⤵
  PID:12348
- C:\Windows\System\DKStwbr.exe
  C:\Windows\System\DKStwbr.exe
  2⤵
  PID:12608
- C:\Windows\System\bzTmULM.exe
  C:\Windows\System\bzTmULM.exe
  2⤵
  PID:12780
- C:\Windows\System\nnXFyJC.exe
  C:\Windows\System\nnXFyJC.exe
  2⤵
  PID:12800
- C:\Windows\System\QbADUVt.exe
  C:\Windows\System\QbADUVt.exe
  2⤵
  PID:13008
- C:\Windows\System\CSARUUA.exe
  C:\Windows\System\CSARUUA.exe
  2⤵
  PID:13172
- C:\Windows\System\RGOGVcB.exe
  C:\Windows\System\RGOGVcB.exe
  2⤵
  PID:13240
- C:\Windows\System\Cfwsseu.exe
  C:\Windows\System\Cfwsseu.exe
  2⤵
  PID:12504
- C:\Windows\System\KphcFHe.exe
  C:\Windows\System\KphcFHe.exe
  2⤵
  PID:12852
- C:\Windows\System\tSvBhWL.exe
  C:\Windows\System\tSvBhWL.exe
  2⤵
  PID:13272
- C:\Windows\System\FSaCjiT.exe
  C:\Windows\System\FSaCjiT.exe
  2⤵
  PID:12556
- C:\Windows\System\CouhysT.exe
  C:\Windows\System\CouhysT.exe
  2⤵
  PID:13336
- C:\Windows\System\Lsarobh.exe
  C:\Windows\System\Lsarobh.exe
  2⤵
  PID:13352
- C:\Windows\System\dflJHmj.exe
  C:\Windows\System\dflJHmj.exe
  2⤵
  PID:13376
- C:\Windows\System\hnYNEYZ.exe
  C:\Windows\System\hnYNEYZ.exe
  2⤵
  PID:13408
- C:\Windows\System\MMfsqCG.exe
  C:\Windows\System\MMfsqCG.exe
  2⤵
  PID:13432
- C:\Windows\System\yGktRNi.exe
  C:\Windows\System\yGktRNi.exe
  2⤵
  PID:13460
- C:\Windows\System\bWEDfzE.exe
  C:\Windows\System\bWEDfzE.exe
  2⤵
  PID:13492
- C:\Windows\System\rbzsejx.exe
  C:\Windows\System\rbzsejx.exe
  2⤵
  PID:13520
- C:\Windows\System\bOhJWsA.exe
  C:\Windows\System\bOhJWsA.exe
  2⤵
  PID:13544
- C:\Windows\System\uTHHKFe.exe
  C:\Windows\System\uTHHKFe.exe
  2⤵
  PID:13568
- C:\Windows\System\CmtjLtf.exe
  C:\Windows\System\CmtjLtf.exe
  2⤵
  PID:13596
- C:\Windows\System\pVdryAK.exe
  C:\Windows\System\pVdryAK.exe
  2⤵
  PID:13624
- C:\Windows\System\lCUggxJ.exe
  C:\Windows\System\lCUggxJ.exe
  2⤵
  PID:13652
- C:\Windows\System\GBhHoCq.exe
  C:\Windows\System\GBhHoCq.exe
  2⤵
  PID:13692
- C:\Windows\System\HAEutHo.exe
  C:\Windows\System\HAEutHo.exe
  2⤵
  PID:13744
- C:\Windows\System\GEKJoPt.exe
  C:\Windows\System\GEKJoPt.exe
  2⤵
  PID:13768
- C:\Windows\System\FZkJaYd.exe
  C:\Windows\System\FZkJaYd.exe
  2⤵
  PID:13788
- C:\Windows\System\FAnSEYm.exe
  C:\Windows\System\FAnSEYm.exe
  2⤵
  PID:13816
- C:\Windows\System\TZsxfYI.exe
  C:\Windows\System\TZsxfYI.exe
  2⤵
  PID:13848
- C:\Windows\System\veOqgEW.exe
  C:\Windows\System\veOqgEW.exe
  2⤵
  PID:13936
- C:\Windows\System\WuOgaEs.exe
  C:\Windows\System\WuOgaEs.exe
  2⤵
  PID:13968
- C:\Windows\System\dTiAHUH.exe
  C:\Windows\System\dTiAHUH.exe
  2⤵
  PID:13996
- C:\Windows\System\kVvsIjG.exe
  C:\Windows\System\kVvsIjG.exe
  2⤵
  PID:14012
- C:\Windows\System\mdZKrLE.exe
  C:\Windows\System\mdZKrLE.exe
  2⤵
  PID:14044
- C:\Windows\System\pwjrPeQ.exe
  C:\Windows\System\pwjrPeQ.exe
  2⤵
  PID:14064
- C:\Windows\System\gPEvNnM.exe
  C:\Windows\System\gPEvNnM.exe
  2⤵
  PID:14084
- C:\Windows\System\AyYvcie.exe
  C:\Windows\System\AyYvcie.exe
  2⤵
  PID:14112
- C:\Windows\System\YRbhkfu.exe
  C:\Windows\System\YRbhkfu.exe
  2⤵
  PID:14140
- C:\Windows\System\VVzSVqV.exe
  C:\Windows\System\VVzSVqV.exe
  2⤵
  PID:14176
- C:\Windows\System\jtdnNJM.exe
  C:\Windows\System\jtdnNJM.exe
  2⤵
  PID:14196
- C:\Windows\System\PSjENiR.exe
  C:\Windows\System\PSjENiR.exe
  2⤵
  PID:14212
- C:\Windows\System\MwQDlHS.exe
  C:\Windows\System\MwQDlHS.exe
  2⤵
  PID:14240
- C:\Windows\System\RQoCMyj.exe
  C:\Windows\System\RQoCMyj.exe
  2⤵
  PID:14276
- C:\Windows\System\OcTIhwS.exe
  C:\Windows\System\OcTIhwS.exe
  2⤵
  PID:14300
- C:\Windows\System\BlHwosV.exe
  C:\Windows\System\BlHwosV.exe
  2⤵
  PID:14324
- C:\Windows\System\vVBvoyK.exe
  C:\Windows\System\vVBvoyK.exe
  2⤵
  PID:12988
- C:\Windows\System\sOHJcRa.exe
  C:\Windows\System\sOHJcRa.exe
  2⤵
  PID:13348
- C:\Windows\System\reeiMcJ.exe
  C:\Windows\System\reeiMcJ.exe
  2⤵
  PID:13360
- C:\Windows\System\UAfjWVz.exe
  C:\Windows\System\UAfjWVz.exe
  2⤵
  PID:13504
- C:\Windows\System\JTTixUB.exe
  C:\Windows\System\JTTixUB.exe
  2⤵
  PID:13588
- C:\Windows\System\OvvjzBg.exe
  C:\Windows\System\OvvjzBg.exe
  2⤵
  PID:13668
- C:\Windows\System\HULJLDE.exe
  C:\Windows\System\HULJLDE.exe
  2⤵
  PID:13764
- C:\Windows\System\iFFomOg.exe
  C:\Windows\System\iFFomOg.exe
  2⤵
  PID:13756
- C:\Windows\System\lRDRjAZ.exe
  C:\Windows\System\lRDRjAZ.exe
  2⤵
  PID:13900
- C:\Windows\System\UiMeNCt.exe
  C:\Windows\System\UiMeNCt.exe
  2⤵
  PID:14008
- C:\Windows\System\ajsvndO.exe
  C:\Windows\System\ajsvndO.exe
  2⤵
  PID:14028
- C:\Windows\System\rizMEMH.exe
  C:\Windows\System\rizMEMH.exe
  2⤵
  PID:14124
- C:\Windows\System\ZuhmFVM.exe
  C:\Windows\System\ZuhmFVM.exe
  2⤵
  PID:14272
- C:\Windows\System\MXnuWnt.exe
  C:\Windows\System\MXnuWnt.exe
  2⤵
  PID:14232
- C:\Windows\System\pezPNbm.exe
  C:\Windows\System\pezPNbm.exe
  2⤵
  PID:13448
- C:\Windows\System\VfgINiv.exe
  C:\Windows\System\VfgINiv.exe
  2⤵
  PID:13304
- C:\Windows\System\BiBuczY.exe
  C:\Windows\System\BiBuczY.exe
  2⤵
  PID:13616
- C:\Windows\System\YCrFnUb.exe
  C:\Windows\System\YCrFnUb.exe
  2⤵
  PID:13808
- C:\Windows\System\ecdlyTm.exe
  C:\Windows\System\ecdlyTm.exe
  2⤵
  PID:13876
- C:\Windows\System\Ngipspn.exe
  C:\Windows\System\Ngipspn.exe
  2⤵
  PID:14160
- C:\Windows\System\YUmHnqc.exe
  C:\Windows\System\YUmHnqc.exe
  2⤵
  PID:13320
- C:\Windows\System\cQfwFNM.exe
  C:\Windows\System\cQfwFNM.exe
  2⤵
  PID:13420
- C:\Windows\System\stUpfZI.exe
  C:\Windows\System\stUpfZI.exe
  2⤵
  PID:13620
- C:\Windows\System\HadQGvG.exe
  C:\Windows\System\HadQGvG.exe
  2⤵
  PID:13840
- C:\Windows\System\lTrVzkd.exe
  C:\Windows\System\lTrVzkd.exe
  2⤵
  PID:12376
- C:\Windows\System\MHRXyID.exe
  C:\Windows\System\MHRXyID.exe
  2⤵
  PID:14348
- C:\Windows\System\kLzuWEB.exe
  C:\Windows\System\kLzuWEB.exe
  2⤵
  PID:14372
- C:\Windows\System\gOSqdlz.exe
  C:\Windows\System\gOSqdlz.exe
  2⤵
  PID:14412
- C:\Windows\System\jMiGnNS.exe
  C:\Windows\System\jMiGnNS.exe
  2⤵
  PID:14444
- C:\Windows\System\fXxfIdS.exe
  C:\Windows\System\fXxfIdS.exe
  2⤵
  PID:14464
- C:\Windows\System\exyfiUT.exe
  C:\Windows\System\exyfiUT.exe
  2⤵
  PID:14484
- C:\Windows\System\uVeHwau.exe
  C:\Windows\System\uVeHwau.exe
  2⤵
  PID:14516
- C:\Windows\System\ijxfwmX.exe
  C:\Windows\System\ijxfwmX.exe
  2⤵
  PID:14560
- C:\Windows\System\brkdaWs.exe
  C:\Windows\System\brkdaWs.exe
  2⤵
  PID:14588
- C:\Windows\System\PqVrNvP.exe
  C:\Windows\System\PqVrNvP.exe
  2⤵
  PID:14604
- C:\Windows\System\NMzSTcb.exe
  C:\Windows\System\NMzSTcb.exe
  2⤵
  PID:14628
- C:\Windows\System\BfnWiLa.exe
  C:\Windows\System\BfnWiLa.exe
  2⤵
  PID:14668
- C:\Windows\System\oWUplaO.exe
  C:\Windows\System\oWUplaO.exe
  2⤵
  PID:14688
- C:\Windows\System\qlOgFTo.exe
  C:\Windows\System\qlOgFTo.exe
  2⤵
  PID:14716
- C:\Windows\System\nwBKpAo.exe
  C:\Windows\System\nwBKpAo.exe
  2⤵
  PID:14748
- C:\Windows\System\hrBxxjK.exe
  C:\Windows\System\hrBxxjK.exe
  2⤵
  PID:14772
- C:\Windows\System\BFcFRUk.exe
  C:\Windows\System\BFcFRUk.exe
  2⤵
  PID:14788
- C:\Windows\System\ygAFUuw.exe
  C:\Windows\System\ygAFUuw.exe
  2⤵
  PID:14816
- C:\Windows\System\yJXzeaV.exe
  C:\Windows\System\yJXzeaV.exe
  2⤵
  PID:14848
- C:\Windows\System\aprKita.exe
  C:\Windows\System\aprKita.exe
  2⤵
  PID:14872
- C:\Windows\System\NdRjFBn.exe
  C:\Windows\System\NdRjFBn.exe
  2⤵
  PID:14896
- C:\Windows\System\TvJEVff.exe
  C:\Windows\System\TvJEVff.exe
  2⤵
  PID:14928
- C:\Windows\System\IhJUBhT.exe
  C:\Windows\System\IhJUBhT.exe
  2⤵
  PID:14952
- C:\Windows\System\RQSzaKA.exe
  C:\Windows\System\RQSzaKA.exe
  2⤵
  PID:14992
- C:\Windows\System\TDdxJFo.exe
  C:\Windows\System\TDdxJFo.exe
  2⤵
  PID:15020
- C:\Windows\System\QDzAGgS.exe
  C:\Windows\System\QDzAGgS.exe
  2⤵
  PID:15044
- C:\Windows\System\gWAPSNP.exe
  C:\Windows\System\gWAPSNP.exe
  2⤵
  PID:15068
- C:\Windows\System\KVCjWmH.exe
  C:\Windows\System\KVCjWmH.exe
  2⤵
  PID:15084
- C:\Windows\System\xlLSRzQ.exe
  C:\Windows\System\xlLSRzQ.exe
  2⤵
  PID:15100
- C:\Windows\System\SkXAWSI.exe
  C:\Windows\System\SkXAWSI.exe
  2⤵
  PID:15128
- C:\Windows\System\qkNsbUs.exe
  C:\Windows\System\qkNsbUs.exe
  2⤵
  PID:15148
- C:\Windows\System\JFNXpPY.exe
  C:\Windows\System\JFNXpPY.exe
  2⤵
  PID:15168
- C:\Windows\System\DODiYNo.exe
  C:\Windows\System\DODiYNo.exe
  2⤵
  PID:15204
- C:\Windows\System\UTEuenm.exe
  C:\Windows\System\UTEuenm.exe
  2⤵
  PID:15228
- C:\Windows\System\tLAqSfh.exe
  C:\Windows\System\tLAqSfh.exe
  2⤵
  PID:15268
- C:\Windows\System\HzjJHpG.exe
  C:\Windows\System\HzjJHpG.exe
  2⤵
  PID:15304
- C:\Windows\System\aJZVFGC.exe
  C:\Windows\System\aJZVFGC.exe
  2⤵
  PID:15332
- C:\Windows\System\uJJhAfn.exe
  C:\Windows\System\uJJhAfn.exe
  2⤵
  PID:13424
- C:\Windows\System\tDJCppW.exe
  C:\Windows\System\tDJCppW.exe
  2⤵
  PID:14364
- C:\Windows\System\AKEKpao.exe
  C:\Windows\System\AKEKpao.exe
  2⤵
  PID:14400
- C:\Windows\System\lYMxzRJ.exe
  C:\Windows\System\lYMxzRJ.exe
  2⤵
  PID:14452
- C:\Windows\System\pkieCci.exe
  C:\Windows\System\pkieCci.exe
  2⤵
  PID:14492
- C:\Windows\System\kdXMxOA.exe
  C:\Windows\System\kdXMxOA.exe
  2⤵
  PID:14500
- C:\Windows\System\KqXcJYE.exe
  C:\Windows\System\KqXcJYE.exe
  2⤵
  PID:14680
- C:\Windows\System\eDzTjvY.exe
  C:\Windows\System\eDzTjvY.exe
  2⤵
  PID:14764
- C:\Windows\System\BRyhxlQ.exe
  C:\Windows\System\BRyhxlQ.exe
  2⤵
  PID:14744
- C:\Windows\System\UpxxlYp.exe
  C:\Windows\System\UpxxlYp.exe
  2⤵
  PID:14812
- C:\Windows\System\aBbSdSn.exe
  C:\Windows\System\aBbSdSn.exe
  2⤵
  PID:14892
- C:\Windows\System\UWaQQzI.exe
  C:\Windows\System\UWaQQzI.exe
  2⤵
  PID:14948
- C:\Windows\System\AKRRjSO.exe
  C:\Windows\System\AKRRjSO.exe
  2⤵
  PID:15008
- C:\Windows\System\XjEFDtc.exe
  C:\Windows\System\XjEFDtc.exe
  2⤵
  PID:15096
- C:\Windows\System\RRahFll.exe
  C:\Windows\System\RRahFll.exe
  2⤵
  PID:15164
- C:\Windows\System\IVEOyXI.exe
  C:\Windows\System\IVEOyXI.exe
  2⤵
  PID:15260
- C:\Windows\System\DbEVwMK.exe
  C:\Windows\System\DbEVwMK.exe
  2⤵
  PID:15296
- C:\Windows\System\VruvYzU.exe
  C:\Windows\System\VruvYzU.exe
  2⤵
  PID:15348
- C:\Windows\System\XUlZaLK.exe
  C:\Windows\System\XUlZaLK.exe
  2⤵
  PID:15352
- C:\Windows\System\nOmlEtI.exe
  C:\Windows\System\nOmlEtI.exe
  2⤵
  PID:14804
- C:\Windows\System\hZpfuOB.exe
  C:\Windows\System\hZpfuOB.exe
  2⤵
  PID:14760
- C:\Windows\System\HXXCVjd.exe
  C:\Windows\System\HXXCVjd.exe
  2⤵
  PID:14940
- C:\Windows\System\vYoIlqO.exe
  C:\Windows\System\vYoIlqO.exe
  2⤵
  PID:15124
- C:\Windows\System\DpFOXGy.exe
  C:\Windows\System\DpFOXGy.exe
  2⤵
  PID:14424
- C:\Windows\System\oUzqbMR.exe
  C:\Windows\System\oUzqbMR.exe
  2⤵
  PID:14384
- C:\Windows\System\uuGHHnU.exe
  C:\Windows\System\uuGHHnU.exe
  2⤵
  PID:14740
- C:\Windows\System\cCNHjcg.exe
  C:\Windows\System\cCNHjcg.exe
  2⤵
  PID:14708
- C:\Windows\System\RoYoqxm.exe
  C:\Windows\System\RoYoqxm.exe
  2⤵
  PID:14936
- C:\Windows\System\LFjFyWl.exe
  C:\Windows\System\LFjFyWl.exe
  2⤵
  PID:15380
- C:\Windows\System\ePVZDgD.exe
  C:\Windows\System\ePVZDgD.exe
  2⤵
  PID:15412
- C:\Windows\System\flMFTGy.exe
  C:\Windows\System\flMFTGy.exe
  2⤵
  PID:15448
- C:\Windows\System\ZVmUOUq.exe
  C:\Windows\System\ZVmUOUq.exe
  2⤵
  PID:15480
- C:\Windows\System\qevVeFT.exe
  C:\Windows\System\qevVeFT.exe
  2⤵
  PID:15516
- C:\Windows\System\siCVejS.exe
  C:\Windows\System\siCVejS.exe
  2⤵
  PID:15540
- C:\Windows\System\ihaHiws.exe
  C:\Windows\System\ihaHiws.exe
  2⤵
  PID:15564
- C:\Windows\System\WDOzMVd.exe
  C:\Windows\System\WDOzMVd.exe
  2⤵
  PID:15588
- C:\Windows\System\JOAcudA.exe
  C:\Windows\System\JOAcudA.exe
  2⤵
  PID:15612
- C:\Windows\System\XjjykAB.exe
  C:\Windows\System\XjjykAB.exe
  2⤵
  PID:15652
- C:\Windows\System\wlgoOQj.exe
  C:\Windows\System\wlgoOQj.exe
  2⤵
  PID:15680
- C:\Windows\System\zxNgIYx.exe
  C:\Windows\System\zxNgIYx.exe
  2⤵
  PID:15712
- C:\Windows\System\iJZjZFO.exe
  C:\Windows\System\iJZjZFO.exe
  2⤵
  PID:15740
- C:\Windows\System\aFcxWNR.exe
  C:\Windows\System\aFcxWNR.exe
  2⤵
  PID:15768
- C:\Windows\System\AhmKCxh.exe
  C:\Windows\System\AhmKCxh.exe
  2⤵
  PID:15800
- C:\Windows\System\VqNjhjB.exe
  C:\Windows\System\VqNjhjB.exe
  2⤵
  PID:15832
- C:\Windows\System\gHizczy.exe
  C:\Windows\System\gHizczy.exe
  2⤵
  PID:15848
- C:\Windows\System\qUChmBM.exe
  C:\Windows\System\qUChmBM.exe
  2⤵
  PID:15880
- C:\Windows\System\DyCMfoH.exe
  C:\Windows\System\DyCMfoH.exe
  2⤵
  PID:15904
- C:\Windows\System\ippsjgW.exe
  C:\Windows\System\ippsjgW.exe
  2⤵
  PID:15928
- C:\Windows\System\uscTUtO.exe
  C:\Windows\System\uscTUtO.exe
  2⤵
  PID:15956
- C:\Windows\System\fNQbsPD.exe
  C:\Windows\System\fNQbsPD.exe
  2⤵
  PID:15996
- C:\Windows\System\bWcfNQO.exe
  C:\Windows\System\bWcfNQO.exe
  2⤵
  PID:16032
- C:\Windows\System\EOIplly.exe
  C:\Windows\System\EOIplly.exe
  2⤵
  PID:16048
- C:\Windows\System\AaPEQVA.exe
  C:\Windows\System\AaPEQVA.exe
  2⤵
  PID:16072
- C:\Windows\System\snpUKaf.exe
  C:\Windows\System\snpUKaf.exe
  2⤵
  PID:16096
- C:\Windows\System\XwaQwbP.exe
  C:\Windows\System\XwaQwbP.exe
  2⤵
  PID:16124
- C:\Windows\System\CgvBbZt.exe
  C:\Windows\System\CgvBbZt.exe
  2⤵
  PID:16164
- C:\Windows\System\QSDflFv.exe
  C:\Windows\System\QSDflFv.exe
  2⤵
  PID:16192
- C:\Windows\System\qhJprCu.exe
  C:\Windows\System\qhJprCu.exe
  2⤵
  PID:16212
- C:\Windows\System\WqPkguE.exe
  C:\Windows\System\WqPkguE.exe
  2⤵
  PID:16244
- C:\Windows\System\rvsMogT.exe
  C:\Windows\System\rvsMogT.exe
  2⤵
  PID:16260
- C:\Windows\System\StxhGJo.exe
  C:\Windows\System\StxhGJo.exe
  2⤵
  PID:16288
- C:\Windows\System\PkmalHg.exe
  C:\Windows\System\PkmalHg.exe
  2⤵
  PID:16308
- C:\Windows\System\HOFmUIm.exe
  C:\Windows\System\HOFmUIm.exe
  2⤵
  PID:16340
- C:\Windows\System\FsmVRbC.exe
  C:\Windows\System\FsmVRbC.exe
  2⤵
  PID:16368
- C:\Windows\System\dgIosRz.exe
  C:\Windows\System\dgIosRz.exe
  2⤵
  PID:15076
- C:\Windows\System\SDCcuac.exe
  C:\Windows\System\SDCcuac.exe
  2⤵
  PID:15200
- C:\Windows\System\pYDPMVs.exe
  C:\Windows\System\pYDPMVs.exe
  2⤵
  PID:15492
- C:\Windows\System\CLqTUET.exe
  C:\Windows\System\CLqTUET.exe
  2⤵
  PID:15552
- C:\Windows\System\wtUSomA.exe
  C:\Windows\System\wtUSomA.exe
  2⤵
  PID:15584
- C:\Windows\System\ffjTdGL.exe
  C:\Windows\System\ffjTdGL.exe
  2⤵
  PID:15704
- C:\Windows\System\DwaWIOk.exe
  C:\Windows\System\DwaWIOk.exe
  2⤵
  PID:15632
- C:\Windows\System\AZayyiR.exe
  C:\Windows\System\AZayyiR.exe
  2⤵
  PID:15764
- C:\Windows\System\mPxfZSm.exe
  C:\Windows\System\mPxfZSm.exe
  2⤵
  PID:15924
- C:\Windows\System\XELuMfW.exe
  C:\Windows\System\XELuMfW.exe
  2⤵
  PID:15980
- C:\Windows\System\ujNFEMn.exe
  C:\Windows\System\ujNFEMn.exe
  2⤵
  PID:16020
- C:\Windows\System\YLpzIQZ.exe
  C:\Windows\System\YLpzIQZ.exe
  2⤵
  PID:16040
- C:\Windows\System\NgcXqnb.exe
  C:\Windows\System\NgcXqnb.exe
  2⤵
  PID:16120
- C:\Windows\System\CGyRTxz.exe
  C:\Windows\System\CGyRTxz.exe
  2⤵
  PID:16232
- C:\Windows\System\HkQZEaP.exe
  C:\Windows\System\HkQZEaP.exe
  2⤵
  PID:16272
- C:\Windows\System\LKTZCIb.exe
  C:\Windows\System\LKTZCIb.exe
  2⤵
  PID:16252
- C:\Windows\System\dwpOPPs.exe
  C:\Windows\System\dwpOPPs.exe
  2⤵
  PID:16360
- C:\Windows\System\LHzNVeS.exe
  C:\Windows\System\LHzNVeS.exe
  2⤵
  PID:16332
- C:\Windows\System\YngZzOf.exe
  C:\Windows\System\YngZzOf.exe
  2⤵
  PID:15668
- C:\Windows\System\ODVcncc.exe
  C:\Windows\System\ODVcncc.exe
  2⤵
  PID:14528
- C:\Windows\System\eColqZk.exe
  C:\Windows\System\eColqZk.exe
  2⤵
  PID:15604
- C:\Windows\System\kTRSvTi.exe
  C:\Windows\System\kTRSvTi.exe
  2⤵
  PID:15796
- C:\Windows\System\XHpBfkP.exe
  C:\Windows\System\XHpBfkP.exe
  2⤵
  PID:15900
- C:\Windows\System\zEFphxd.exe
  C:\Windows\System\zEFphxd.exe
  2⤵
  PID:16236
- C:\Windows\System\YlIUBld.exe
  C:\Windows\System\YlIUBld.exe
  2⤵
  PID:15840
- C:\Windows\System\zERGhRr.exe
  C:\Windows\System\zERGhRr.exe
  2⤵
  PID:16400
- C:\Windows\System\OqYzdCW.exe
  C:\Windows\System\OqYzdCW.exe
  2⤵
  PID:16432
- C:\Windows\System\eznnTxH.exe
  C:\Windows\System\eznnTxH.exe
  2⤵
  PID:16456
- C:\Windows\System\MCiUmIm.exe
  C:\Windows\System\MCiUmIm.exe
  2⤵
  PID:16488
- C:\Windows\System\IOdGTOY.exe
  C:\Windows\System\IOdGTOY.exe
  2⤵
  PID:16520
- C:\Windows\System\sBqkGbT.exe
  C:\Windows\System\sBqkGbT.exe
  2⤵
  PID:16552
- C:\Windows\System\heVSwHS.exe
  C:\Windows\System\heVSwHS.exe
  2⤵
  PID:16572
- C:\Windows\System\gZgFPUL.exe
  C:\Windows\System\gZgFPUL.exe
  2⤵
  PID:16600
- C:\Windows\System\YiIjCFe.exe
  C:\Windows\System\YiIjCFe.exe
  2⤵
  PID:16624
- C:\Windows\System\zPEhalz.exe
  C:\Windows\System\zPEhalz.exe
  2⤵
  PID:16656
- C:\Windows\System\MdpxzAk.exe
  C:\Windows\System\MdpxzAk.exe
  2⤵
  PID:16680
- C:\Windows\System\qwOSSNG.exe
  C:\Windows\System\qwOSSNG.exe
  2⤵
  PID:16700
- C:\Windows\System\UwskvLu.exe
  C:\Windows\System\UwskvLu.exe
  2⤵
  PID:16732
- C:\Windows\System\MPVeRrF.exe
  C:\Windows\System\MPVeRrF.exe
  2⤵
  PID:16752
- C:\Windows\System\gnKwjgY.exe
  C:\Windows\System\gnKwjgY.exe
  2⤵
  PID:16780
- C:\Windows\System\uFYkkNG.exe
  C:\Windows\System\uFYkkNG.exe
  2⤵
  PID:16812
- C:\Windows\System\WVKwzKP.exe
  C:\Windows\System\WVKwzKP.exe
  2⤵
  PID:16840
- C:\Windows\System\WxwEEXW.exe
  C:\Windows\System\WxwEEXW.exe
  2⤵
  PID:16876
- C:\Windows\System\lTqsZFO.exe
  C:\Windows\System\lTqsZFO.exe
  2⤵
  PID:16900
- C:\Windows\System\HhvRTWp.exe
  C:\Windows\System\HhvRTWp.exe
  2⤵
  PID:16920
- C:\Windows\System\BDqNDqb.exe
  C:\Windows\System\BDqNDqb.exe
  2⤵
  PID:16952
- C:\Windows\System\JGIhsYJ.exe
  C:\Windows\System\JGIhsYJ.exe
  2⤵
  PID:16976
- C:\Windows\System\eQvukju.exe
  C:\Windows\System\eQvukju.exe
  2⤵
  PID:17012
- C:\Windows\System\PWLFNGw.exe
  C:\Windows\System\PWLFNGw.exe
  2⤵
  PID:17040
- C:\Windows\System\wAyyFXX.exe
  C:\Windows\System\wAyyFXX.exe
  2⤵
  PID:17068
- C:\Windows\System\ImycKoO.exe
  C:\Windows\System\ImycKoO.exe
  2⤵
  PID:17092
- C:\Windows\System\IVTizoz.exe
  C:\Windows\System\IVTizoz.exe
  2⤵
  PID:17124
- C:\Windows\System\BxdzaLk.exe
  C:\Windows\System\BxdzaLk.exe
  2⤵
  PID:17152
- C:\Windows\System\vSXfgql.exe
  C:\Windows\System\vSXfgql.exe
  2⤵
  PID:17188
- C:\Windows\System\ersZStD.exe
  C:\Windows\System\ersZStD.exe
  2⤵
  PID:17212
- C:\Windows\System\FrlgtEa.exe
  C:\Windows\System\FrlgtEa.exe
  2⤵
  PID:17244
- C:\Windows\System\BhYZmaw.exe
  C:\Windows\System\BhYZmaw.exe
  2⤵
  PID:17288
- C:\Windows\System\nJrSumV.exe
  C:\Windows\System\nJrSumV.exe
  2⤵
  PID:17308
- C:\Windows\System\ecmzFUb.exe
  C:\Windows\System\ecmzFUb.exe
  2⤵
  PID:17336

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\COyYGZx.exe

Filesize
1.7MB

MD5
617a34f3725523e1477ee30b224343d2

SHA1
5c59d58f85ced7800204c147edc8c2adf1cc50da

SHA256
747adae6d2c3361c47a649b5b8861d479c0cf635c02701c0c0bc2429b47fe20d

SHA512
4f503b6f308a44e78cdb5049bd72a4b2b7d27ef237c078675506bde835af9907b4b9a9dbcf3e6387cdeaa7b0c005d140e5c1f6bfa8c67bf54443d54f590d0b48

Download Submit
C:\Windows\System\JYDKJQc.exe

Filesize
1.7MB

MD5
5853bbe89f612d6431c76594a86cca35

SHA1
6bed6baf5e10204596efda2c817365ce4c44be38

SHA256
827f6e67b3ef66800167e8ac0e726f09ee54e856eae61050dae53435d34a3e89

SHA512
3a4ac90f97c294ce103a07afe4d0a660c2e5a4ba164ddaf04afec00d5884396c882b35fbed84938a5973b56b0a253030cf7819090b6f2882561952496b68261c

Download Submit
C:\Windows\System\JuYvUhW.exe

Filesize
1.7MB

MD5
da263cb4c76573408d5c967908de407d

SHA1
dca0e228cf21e514f7cce8ef1e71dcd6eb741aa9

SHA256
482cbe24200ece8f9e3b9549b1cea53dcface77cde85e029a87c39b721818b9c

SHA512
6e364588a8e9937a97a318eae293f7dfbd253c3e3bc27cc04fe80582238b08698063cf8ae7ddda6eb2151759bd2dd8d3b44102509bc01b470e89d6bccf027da0

Download Submit
C:\Windows\System\LxELrdx.exe

Filesize
1.7MB

MD5
c33b7d917b5e24f5bf5319146e26cc24

SHA1
7f48f26a7f72126925556367a999aef94c0e1305

SHA256
27a3f72bffdeea1535dcb6efca1019dbfed636b64bda2dae0b7db0eea085f076

SHA512
0b99fe1bb2ab809cc2b8ebbe8e4d2656aa1639f9251c77dc22da77dca2f80dfaebbbd9e1d3c0e930a92fcbed90f6d714f1a8f0184484bb2a59ad1ee1acb4cef8

Download Submit
C:\Windows\System\OknAIxf.exe

Filesize
1.7MB

MD5
c6e900e4c7e889d84a379d47dce2539f

SHA1
7a691ab0fa987399fe8343539c6b6d749960f938

SHA256
d78eea5c2e1f518a8ae8aa4b0170e55ef7e242c253640ee101f5037e386174a9

SHA512
93c2d5aea187a8f390be418e4c42e1d1d68307da55f5dcaa745717d5e473de5915d7236cd1294449dc6946b4c1472ee28a93d9e4af16e4b0ae45d7ae188013d6

Download Submit
C:\Windows\System\PqZUYAI.exe

Filesize
1.7MB

MD5
f3c8f41c236911f58354b8487fc4b569

SHA1
81296b05b3142a42c7696fe41de0765e20df4ee3

SHA256
ba3adb7907a6e37f6b94255f37acb2b422b1e4a579c3158ec0dcaa6b1b19e80b

SHA512
b2395e02024cb412b2b5ae3811abb1d089628f70c352de6b3ac3a6f535b953334b64f95334ab22a6b7856d76b893d172d08be318b46bc409a7f75494b8aa664a

Download Submit
C:\Windows\System\UaBzljq.exe

Filesize
1.7MB

MD5
02b3553ec8f1e5051673a51cb2617db8

SHA1
6b46cb31f8c1f7e834a8504124d41bb21b9158f7

SHA256
ef01bfe31875afe3e8074b94ab59fca669d27c3f6cc24e90b01ce9ae2b7da401

SHA512
9c8ca990e91e4a8358165c21a3d99e2a61f3367f51b6306ceeefb2d7dfc65a94faf6f7f1e376862eefd3762581a53494bb9ea9aac6ac836a59212a63d9513769

Download Submit
C:\Windows\System\VGozpdH.exe

Filesize
1.7MB

MD5
c87b6e9b8c8bf51e4e745bace8ca7c35

SHA1
7f0dbb579794ae316d24a3393f08184d3bee5030

SHA256
e0d71df19a57097ac5ead7655dc89a4f730158d9c4cac0892f54f66d5d6c63ab

SHA512
6a9f3bea893c197639e194b96a67ccb135d02141185b78cdd4000c7986553114292052ff695dfcf38920cb39e439a9c1667aeeec6a67627aafeafb26b268c374

Download Submit
C:\Windows\System\XKrVtiD.exe

Filesize
1.7MB

MD5
8435514b33ca62f3d827d81f7f6e5d13

SHA1
79770548bc2425270cb65b4b36a30680f1182b27

SHA256
808d210489bc40a238bc5956f0196cb627aa0b46ff67ea2c5c9cbfeee1031176

SHA512
48757cdef9b0f3c2cd42d2d83bdcf444950913fd3aa2de2269cc5514e721bb0bc2f2cf879f2377fb647aed868d01c0ea06d4734a3206912197a6e3b3d402d927

Download Submit
C:\Windows\System\ZViVlhA.exe

Filesize
1.7MB

MD5
5dbf3789ff71cf3205ac3bd9868767f6

SHA1
81d3acca23d8b7dff874ba4225b3b11db0ec5bff

SHA256
a7fef45e8f7accee109782380fe6f30219d87bfdaa52e2398f1488c6757edc67

SHA512
aa16979e97d0c46b96c131980533f304535dbadb4e6862ca8540bad88c96bded9cad1307aa50ea4665c93e3fbedcc1cc128f0976c6a2282ee349ba20dc870f1a

Download Submit
C:\Windows\System\aLkuhuf.exe

Filesize
1.7MB

MD5
706dcdbffb23c06c16840841f5912148

SHA1
d15d8b79e4ecbaef391e4d7695956d0ea7cddcdd

SHA256
4309025fa81af1a9e6d385224fa7a5ffba720b9106e736f5b8e18b26a1436b5a

SHA512
b7dd1b5e43b384bb37562b404fc13ba8cb3a5a05b594f97cbfe465f1e5858fc3e3ae197cc89ba7760a6bc8a96232ff806c12756088ed100ef73f72666c5b1723

Download Submit
C:\Windows\System\aVRZbkG.exe

Filesize
1.7MB

MD5
a71f93934996aa90f83d0df113c19a3a

SHA1
b0d2bdd0933dabc54f7907a1d3fc39b4197613fd

SHA256
eef29e84ce124ee3b3df309f29aaf05f5672af49f5ccdef52fa8f2405d6bee1d

SHA512
d4f48baacc03f2b6a754a179f95b703fa1b3522d1e6fc2069aa7e6c011ad8df0def4b22a0d22f4d2476f216e00f71852b762de26586e6686299a234301cea960

Download Submit
C:\Windows\System\afJwoAB.exe

Filesize
1.7MB

MD5
5439b4859e7267bac6e924ab667f10a3

SHA1
8b23d0a69258d6320f841a282a6dc23942c5d207

SHA256
434a9ea6b6f697c65094b976a2b6e6d1456912f428b14b3b5ef5949ff6591416

SHA512
5913c9239f45a8ca10d4beeacb181768bf163986948b3fd8545d6265c71d037661502be4169ffb0d109056146474d390b83dd80ff74b6f35886186a92a4fc6ab

Download Submit
C:\Windows\System\bbbvWpd.exe

Filesize
1.7MB

MD5
4ea814e688581b64df1ecb1250b0645a

SHA1
f6eb84ae500a7c2434b012bb36225197149b7fbb

SHA256
81b21cd62ecb738af20c99f6c456aa4310bf8ef75e00913650d1e889add0064a

SHA512
5b5071fd4a851cad967c2c943809e9ca5abdfbdc628338c921dac228812853a36c98b77b3fb34ef61eec6df424299c9c7eafb63792cb76f1806138f812b7a1ca

Download Submit
C:\Windows\System\bfEUOJI.exe

Filesize
1.7MB

MD5
92bd64d6d23a9840bb33dc34c8a13c47

SHA1
4259c4b7f09b8081fd95d2cb7f95ccffcc5861be

SHA256
26914042cab9bc4517bb16cee8b10cbddccf812226112bd616310b43adc90b13

SHA512
bb40c29ca7945db41583f2ed0ba4e56189ca37049f2d349cf8073ece032fbe01816e26d58710d8453df08dfc02b8d78551ede8c46e15f76f9f3b5d42e67338df

Download Submit
C:\Windows\System\dNwvNEP.exe

Filesize
1.7MB

MD5
03156690aa33c7e3aafde277d0d06a83

SHA1
7d5da0d2270adf25db25f7a11b618e3052aca6a4

SHA256
21fd5424fb0751f04a807dfb9ce5b753d9619e2ee0f1b5f5d42bbe015274563e

SHA512
f847055841c7a8911fe2057e1e03c1d8470b4ad4d3f6c681802cfd5ba0edfac05d2da4c9cb81abd39414739a92f9221547093059fb22e453fed1738022b33b66

Download Submit
C:\Windows\System\dPNxnZK.exe

Filesize
1.7MB

MD5
f169f1a0a42512baeebe61fbacccbd73

SHA1
2c732871d42fcd494d4184d70dfe61ade8517d59

SHA256
1d4ee27a33e4606c5319c5a44ba7e29ce13fd48fecdebae3b814a5d2747c7aae

SHA512
d35016db7e0c3a8b833ea579b651354ce76b7ffe2ee662f79db51688aa3a733ef87bb0338909ea6d49f9a103b3bd4d0676de68e691194723ba9f8fb1a5bc0905

Download Submit
C:\Windows\System\euyeeqj.exe

Filesize
1.7MB

MD5
b22af3f1eceefc109ba862faf9f60bec

SHA1
1d08485b52f4c9fc09a13156ca8e3ff596150193

SHA256
164bf1987f5414d4fdec169c2a3feeb59073d9f294b1beba877a0b5caacd1f2e

SHA512
2fb322912d695942b8c60cf1fed418fd9a34f2b5a94cf7bd59a3eb61d22f9a05545b1809473166c31a7f7d4b15f2bd12c9a2e3c88f705419014f438da1f517bb

Download Submit
C:\Windows\System\fCNOtmw.exe

Filesize
1.7MB

MD5
6354d27af4cbda1de7945b019c3a38b5

SHA1
830ef196d2a48f98714b617d82335ba6694e482d

SHA256
307de7c0123bdf558322247452f8841773872845229c4ed8a561e16ab3c46060

SHA512
e831aaebb0069b8ba1dd4b24914c54146cd8b40b5760a40bfca57fabeba59e549764a963639faa43e66e7064778ea7d3329b0d3eb93c28eb1f4b656eb50f60ea

Download Submit
C:\Windows\System\hFqTqer.exe

Filesize
1.7MB

MD5
8bd1177209b86498514d07ab4417e7ff

SHA1
35b332892621b2505cd120f6ec316717aee5bcf1

SHA256
1ce8f12400d772d5dcde5936fd1e95c0ba10816d25ab2b6c8d81de137f6fe89d

SHA512
4fcf72b80049493ec8796d11f9d4a5b1aa96070104b8bb80f7045dbcc2c7015d162dc79627c44e96411888e829dd1a867efabc4a34d6ea9f65bbc8787e4731a4

Download Submit
C:\Windows\System\hkykDOu.exe

Filesize
1.7MB

MD5
344616cbd3028994c036427aae43b7d6

SHA1
0ea07a01a5dddf31e99cfdbaadf3a61a3e239c98

SHA256
f33bf3621d4b5b1bc51e3e59aa610e2571eb07c7f7c3e307fd903d9945857204

SHA512
0dd42613d4232c3788905cfe81d86efbaba2329c0ff605f74b61fd668df413a9059a4d233ebab8f7cf45abcbe1c32c7254945dc98e39447c7b905ef9f272c7db

Download Submit
C:\Windows\System\iekzqYW.exe

Filesize
1.7MB

MD5
191d14532cb2a5490e902927ecda414a

SHA1
8e0fa2d715f2e726be1039ded8d4dcc89b0483cc

SHA256
a2a7798de9a91bfd5bcc5fafecdd1f05093d7541eea056955e4903a291d7fc73

SHA512
0425a7a4ae2cac2fbfa765a92c2b82f9c25031ac0ad4e4dfda760c39409d05b84165204c7935c076899cb356a13cf3fc4d6821d4c7877511125bc7a96686cb61

Download Submit
C:\Windows\System\jFRVwWY.exe

Filesize
1.7MB

MD5
c8d8da14f8d9bc5e14b3e504654e3af2

SHA1
03d4e6fa3f064b8dc75ec9c61ed5fbffa95bf0dd

SHA256
ef0d9ef4a7c51b235a24be7af84330eff475300ecfae08c0dbfc4ea923836d68

SHA512
d90735fc3c7b59f1bb6f32a3bd56983d5085802f80b98be892eb476e443b8ec29810abb0f56fa7518bf91270cf2c94963944db87d0b08a140122968ef7146211

Download Submit
C:\Windows\System\nhInyWk.exe

Filesize
1.7MB

MD5
6acb3d91fae3c91f2826755d4c4b49ab

SHA1
d79afbdb364484060fa4a167fd97020ecc49dad8

SHA256
2245dd32b4e5258c900d83a0741f23c0e4bbbde726a51ab805a226cd11cf1d20

SHA512
86a08cb08d3862efe28144997b59c6032432f33dd712091927e1330ec9520c89042e650d30694aca3aaf499fcc626f2e5ace269efd3283efc20379498a29d11b

Download Submit
C:\Windows\System\oUkjaJV.exe

Filesize
1.7MB

MD5
2e6b32fa4efe12371d9befe035a9eb11

SHA1
6ea2ff482eee450b94ee723b56edb22201a55e44

SHA256
ce91f30e40bd3a335346539ffb5751c30973a29106eb8d9a1119d335794ae79b

SHA512
f406d941db90b376f03b389bf49cf159f49f34e3f5c40ae12a6d58f9a8d94e3a0e8b340c73e88ef032f01b97955bef73126a3618d69905be68562262922d6d8d

Download Submit
C:\Windows\System\qQShbIC.exe

Filesize
1.7MB

MD5
f565a3dab0fbb8fa430bb201f81f29e3

SHA1
0eaede4e4b7741930bb8a0a9c96db257bf67478e

SHA256
d47b85025f7b6ac500c0e19e5883a4c8877ce715f6406b2f51adbe64a0ca1519

SHA512
1f6f7c21d68b6e0fc930c2f65695b14c87dcd1ec2072b187b84789d13efbccaf3a63e5f77a539d3c3911b61d5e9c76f1ff33e6bc9d3db5c1e66e8aab859424d5

Download Submit
C:\Windows\System\rNLWTru.exe

Filesize
1.7MB

MD5
e8700ac0d5c4c1e5ef16a4816c906954

SHA1
a0665cf28d9967845d453daad3ec004ac03de652

SHA256
1698e9fb0e54ce914f33ea9befc38aab7204cb6aabf8b698f3055faf2a1fb292

SHA512
7041e9033b84e273debd234ba11b4802c1062e5a09ca8c35d751e00d3bdbeb53985d946f07845ba01573a35622d42c6d7ed4ada8b7c1e8733457d8b96148fac8

Download Submit
C:\Windows\System\rVPUIpL.exe

Filesize
1.7MB

MD5
72185f4bf6e93a8b5ab8b8e2a212be83

SHA1
81d4236147f318b8ea2a8237dfe2a8fcf8bcd37f

SHA256
647a1f9f31849a7e21cbccac7fb2d9e164a80fa1366a790a0a5877a425eb5daf

SHA512
c6a68e942692a2095e879f81c860c40cd43375e595b1151f6fb1468a3389fb475246634bbea4b6a0bcdd740a55421314f837d588a5672ea7450c080f8e3e6660

Download Submit
C:\Windows\System\rjXYFJh.exe

Filesize
1.7MB

MD5
598bbebe74aa97f8e35fdccd653012c0

SHA1
3bdc622aa627ae4db7dae8841842e8817f80afa0

SHA256
719a93d8d4ec4ad79c7bf0fb31a7da6651c3120bcd04ddfeb13b7c12dcf79207

SHA512
bd2ab941defa6eb5cba048ae0f047268c56b7dbfa8637d625dc60ef48eb8fcc63cfbbe778140f4eed046bb9a1dc41cddd75c26c72a1cf23cab3736115cc658eb

Download Submit
C:\Windows\System\tPnwGNz.exe

Filesize
1.7MB

MD5
6bce86157de80a806fe7a33556db981c

SHA1
1605b59ca112b1b3e145c6c6f35aa3a0e2c2674c

SHA256
72a6fe32a00782db8156cea54745939374b0f1f6212d722b6f23f75c8d55b2ba

SHA512
a6b0c9125524596a7069ae05a3e474c7f3529e4b9c67f0f27b5f56321ce8cfcf75372a70523c1acf249777899c45565ab1df1d6b6e419a82223517498d6373bb

Download Submit
C:\Windows\System\teOHbAy.exe

Filesize
1.7MB

MD5
6345c1e0dbb12ee6157edde788aeea14

SHA1
e3ccf1312a298913ffb81369053b3c2a5021faee

SHA256
11017973e44d096f20a5c8ddead4023c21bfc9f160f571899513042ac793a5e4

SHA512
256d4a428b76aea7a167ac569f3f4b8aef27f21acfcdb02cf89edae9e8a9736a85c4689a3ce6e5b6978879b0de4d30f2530df70f8f9cfe67f8d352ca6fc33db9

Download Submit
C:\Windows\System\wmDaJvb.exe

Filesize
1.7MB

MD5
c488cee8f70f82d03475e5198860e58d

SHA1
75a945fca9301b7a856269a8eff0c289f32f8dd4

SHA256
0863c9d77e288f32ef44aa77cce2247c50a1bd827dc45241cc531c1846132f89

SHA512
9922b77b4a8c3d9c3ff4d3154cfa8208b44a09533a390215254941bfbc15e90d3f9ca896d8939b0025982f1d3121a8f582d04b5d3ee64e0688b1878614c39c74

Download Submit
C:\Windows\System\xQucYVr.exe

Filesize
1.7MB

MD5
cb726745de68d1339396d2e141556978

SHA1
e0ea236e9105a05fda1b8d68ea63084dcf8d28b7

SHA256
4c79b80b91f6831aa8fd99dfca904c04925fc925b1b2b408c416e2d900b6afc0

SHA512
b16326193d58d625113b8b0705a15654a13e3f6a3a356222d7b1d616f3eddc53f2075793fcbd8225ca930a803958cdc71fbdbd55554ceb252fa0da36a7839d6e

Download Submit
memory/216-0-0x0000013246AF0000-0x0000013246B00000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads