xmrig | b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
Size

1.1MB
MD5

ec1a8736ea0e7a6443888de901ffed3e
SHA1

da9e506a5b8179307891b055a35db73a5bf0369b
SHA256

b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b
SHA512

e7ff89ed2cbc3b77dc8d0564fd29f57677e5573af28acccf5de692360dd9ccfe690ef6f23f73d88439a5c8edf2ca54ac0e6d6624ccd45f120e96e7c0608c2be2
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMr2Kn7K5:GezaTF8FcNkNdfE0pZ9ozttwIRQCV

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023c65-4.dat	xmrig
behavioral2/files/0x0007000000023c72-11.dat	xmrig
behavioral2/files/0x0007000000023c73-19.dat	xmrig
behavioral2/files/0x0008000000023c69-22.dat	xmrig
behavioral2/files/0x0007000000023c75-27.dat	xmrig
behavioral2/files/0x0007000000023c78-42.dat	xmrig
behavioral2/files/0x0007000000023c7b-57.dat	xmrig
behavioral2/files/0x0007000000023c80-84.dat	xmrig
behavioral2/files/0x0007000000023c8e-160.dat	xmrig
behavioral2/files/0x0007000000023c90-162.dat	xmrig
behavioral2/files/0x0007000000023c8f-157.dat	xmrig
behavioral2/files/0x0007000000023c8d-155.dat	xmrig
behavioral2/files/0x0007000000023c8c-150.dat	xmrig
behavioral2/files/0x0007000000023c8b-145.dat	xmrig
behavioral2/files/0x0007000000023c8a-140.dat	xmrig
behavioral2/files/0x0007000000023c89-135.dat	xmrig
behavioral2/files/0x0007000000023c88-130.dat	xmrig
behavioral2/files/0x0007000000023c87-125.dat	xmrig
behavioral2/files/0x0007000000023c86-120.dat	xmrig
behavioral2/files/0x0007000000023c85-115.dat	xmrig
behavioral2/files/0x0007000000023c84-110.dat	xmrig
behavioral2/files/0x0007000000023c83-105.dat	xmrig
behavioral2/files/0x0007000000023c82-100.dat	xmrig
behavioral2/files/0x0007000000023c81-95.dat	xmrig
behavioral2/files/0x0007000000023c7f-82.dat	xmrig
behavioral2/files/0x0007000000023c7e-78.dat	xmrig
behavioral2/files/0x0007000000023c7d-73.dat	xmrig
behavioral2/files/0x0007000000023c7c-68.dat	xmrig
behavioral2/files/0x0007000000023c7a-58.dat	xmrig
behavioral2/files/0x0007000000023c79-50.dat	xmrig
behavioral2/files/0x0007000000023c77-45.dat	xmrig
behavioral2/files/0x0007000000023c76-40.dat	xmrig
behavioral2/files/0x0007000000023c74-30.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4064	lEsTOyu.exe
2316	UGexjnp.exe
1128	hNiCgav.exe
3996	kUJGSDL.exe
1848	KgYARFz.exe
3460	zePwfiW.exe
2076	oQQOPwV.exe
4360	fHylmHG.exe
4040	ahsnHjV.exe
5044	PDXgYbQ.exe
2448	EOffEhw.exe
3356	HhkilXz.exe
4620	GwLHGAl.exe
3916	bKvhWQF.exe
776	CobrVyE.exe
3332	fIASwCw.exe
4592	OVapAVO.exe
1676	MBNzWIV.exe
4428	UTROnTT.exe
540	zUwKPtE.exe
4616	CpSZpxh.exe
3728	DeqhubE.exe
332	xehAlnO.exe
4320	GvyeMYa.exe
4808	HSJpYtN.exe
4192	qexjpMy.exe
344	GktWYoF.exe
772	jSSNQXY.exe
2136	fswWIpn.exe
1288	JAruudW.exe
804	SPtgikD.exe
3956	YdHdajO.exe
1268	xdBsQXO.exe
4980	JoHikHO.exe
4092	NVaNmiE.exe
880	yOtjdMw.exe
808	gSqKdjT.exe
3380	MhfTGFE.exe
3440	drxIIoc.exe
364	DStWCcM.exe
3824	yJrmgSa.exe
4316	KPyciFV.exe
3600	zLiitOv.exe
5032	ZAwceeI.exe
3864	TzwPYjt.exe
4204	dpfOdMp.exe
728	dMoJGYS.exe
1728	yezUqBL.exe
3192	QktQxgs.exe
2264	fmnPcXv.exe
2892	YRYzxpv.exe
1404	PbJCGdo.exe
116	MdLSsNW.exe
3616	NNhyscX.exe
872	iELcDNl.exe
4508	lMmGmmI.exe
4408	BrzZjkv.exe
3664	cHqpOGz.exe
3216	USSnDxl.exe
1776	vuNfdef.exe
2548	SYqNlpX.exe
3328	EKgpKbT.exe
3968	XGFkVgb.exe
4608	bwJlJHz.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oVNTjtr.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\UMIdLaT.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\NnziLaw.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\MXTMaez.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\fzjrVgn.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\pyKexKX.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\BBIyksU.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\QOnpYxQ.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\DZNGBrX.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\VJiuwmi.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\tFEduEg.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\alvEXFn.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\NXynIpK.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\LWjLcCM.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\EiajPFq.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\GsSuhAw.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\RDJzeEp.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\zmLWJLU.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\EgpBBRY.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\NUNsAOJ.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\adAMchN.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\LcOlKOA.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\XwKxCIx.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\vzZJTWD.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\vfWCMFK.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\BkEEWLQ.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\VfzPzCu.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\SNiEgRN.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\azTgksp.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\RqlAibH.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\mxKxeEn.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\VQVDMPV.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\kkEMxDz.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\UDrKunS.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\TNwTSrN.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\PlBIyhf.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\XkcZKCt.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\IxLbHnU.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\fGopeuc.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\SXcQfdr.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\PNUpKWS.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\YESEbKi.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\aQdWGBh.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\KIPYuSX.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\ACoTqDr.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\YufpUMH.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\tvYXyzi.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\SqfjBAW.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\CobrVyE.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\aVlAPXu.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\HPinrpK.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\MbnhlXa.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\nPCSdbV.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\AwIWTxA.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\hkAOTIk.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\bagZmne.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\xwPOOsz.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\qQGllsD.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\FVwzqwp.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\VpmgdcQ.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\fmnPcXv.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\JAlosNd.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\oBRIiGo.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
File created	C:\Windows\System\vIeGwAA.exe	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17104	dwm.exe
Token: SeChangeNotifyPrivilege	17104	dwm.exe
Token: 33	17104	dwm.exe
Token: SeIncBasePriorityPrivilege	17104	dwm.exe
Token: SeShutdownPrivilege	17104	dwm.exe
Token: SeCreatePagefilePrivilege	17104	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 4064	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	83
PID 1012 wrote to memory of 4064	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	83
PID 1012 wrote to memory of 1128	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	84
PID 1012 wrote to memory of 1128	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	84
PID 1012 wrote to memory of 2316	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	85
PID 1012 wrote to memory of 2316	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	85
PID 1012 wrote to memory of 3996	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	86
PID 1012 wrote to memory of 3996	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	86
PID 1012 wrote to memory of 1848	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	87
PID 1012 wrote to memory of 1848	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	87
PID 1012 wrote to memory of 3460	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	88
PID 1012 wrote to memory of 3460	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	88
PID 1012 wrote to memory of 2076	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	89
PID 1012 wrote to memory of 2076	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	89
PID 1012 wrote to memory of 4360	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	90
PID 1012 wrote to memory of 4360	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	90
PID 1012 wrote to memory of 4040	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	91
PID 1012 wrote to memory of 4040	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	91
PID 1012 wrote to memory of 5044	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	92
PID 1012 wrote to memory of 5044	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	92
PID 1012 wrote to memory of 2448	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	93
PID 1012 wrote to memory of 2448	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	93
PID 1012 wrote to memory of 3356	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	94
PID 1012 wrote to memory of 3356	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	94
PID 1012 wrote to memory of 4620	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	95
PID 1012 wrote to memory of 4620	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	95
PID 1012 wrote to memory of 3916	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	96
PID 1012 wrote to memory of 3916	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	96
PID 1012 wrote to memory of 776	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	97
PID 1012 wrote to memory of 776	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	97
PID 1012 wrote to memory of 3332	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	98
PID 1012 wrote to memory of 3332	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	98
PID 1012 wrote to memory of 4592	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	99
PID 1012 wrote to memory of 4592	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	99
PID 1012 wrote to memory of 1676	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	100
PID 1012 wrote to memory of 1676	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	100
PID 1012 wrote to memory of 4428	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	101
PID 1012 wrote to memory of 4428	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	101
PID 1012 wrote to memory of 540	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	102
PID 1012 wrote to memory of 540	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	102
PID 1012 wrote to memory of 4616	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	103
PID 1012 wrote to memory of 4616	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	103
PID 1012 wrote to memory of 3728	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	104
PID 1012 wrote to memory of 3728	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	104
PID 1012 wrote to memory of 332	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	105
PID 1012 wrote to memory of 332	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	105
PID 1012 wrote to memory of 4320	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	106
PID 1012 wrote to memory of 4320	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	106
PID 1012 wrote to memory of 4808	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	107
PID 1012 wrote to memory of 4808	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	107
PID 1012 wrote to memory of 4192	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	108
PID 1012 wrote to memory of 4192	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	108
PID 1012 wrote to memory of 344	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	109
PID 1012 wrote to memory of 344	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	109
PID 1012 wrote to memory of 772	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	110
PID 1012 wrote to memory of 772	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	110
PID 1012 wrote to memory of 2136	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	111
PID 1012 wrote to memory of 2136	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	111
PID 1012 wrote to memory of 1288	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	112
PID 1012 wrote to memory of 1288	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	112
PID 1012 wrote to memory of 804	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	113
PID 1012 wrote to memory of 804	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	113
PID 1012 wrote to memory of 3956	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	114
PID 1012 wrote to memory of 3956	1012	b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe	114

C:\Users\Admin\AppData\Local\Temp\b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe
"C:\Users\Admin\AppData\Local\Temp\b00a22ac98594b1961aafd9164367a3d9c1c66f56f385bc35d255a6d773c4c8b.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\System\lEsTOyu.exe
  C:\Windows\System\lEsTOyu.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\hNiCgav.exe
  C:\Windows\System\hNiCgav.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\UGexjnp.exe
  C:\Windows\System\UGexjnp.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\kUJGSDL.exe
  C:\Windows\System\kUJGSDL.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\KgYARFz.exe
  C:\Windows\System\KgYARFz.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\zePwfiW.exe
  C:\Windows\System\zePwfiW.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\oQQOPwV.exe
  C:\Windows\System\oQQOPwV.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\fHylmHG.exe
  C:\Windows\System\fHylmHG.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\ahsnHjV.exe
  C:\Windows\System\ahsnHjV.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\PDXgYbQ.exe
  C:\Windows\System\PDXgYbQ.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\EOffEhw.exe
  C:\Windows\System\EOffEhw.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\HhkilXz.exe
  C:\Windows\System\HhkilXz.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\GwLHGAl.exe
  C:\Windows\System\GwLHGAl.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\bKvhWQF.exe
  C:\Windows\System\bKvhWQF.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\CobrVyE.exe
  C:\Windows\System\CobrVyE.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\fIASwCw.exe
  C:\Windows\System\fIASwCw.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\OVapAVO.exe
  C:\Windows\System\OVapAVO.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\MBNzWIV.exe
  C:\Windows\System\MBNzWIV.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\UTROnTT.exe
  C:\Windows\System\UTROnTT.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\zUwKPtE.exe
  C:\Windows\System\zUwKPtE.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\CpSZpxh.exe
  C:\Windows\System\CpSZpxh.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\DeqhubE.exe
  C:\Windows\System\DeqhubE.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\xehAlnO.exe
  C:\Windows\System\xehAlnO.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\GvyeMYa.exe
  C:\Windows\System\GvyeMYa.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\HSJpYtN.exe
  C:\Windows\System\HSJpYtN.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\qexjpMy.exe
  C:\Windows\System\qexjpMy.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\GktWYoF.exe
  C:\Windows\System\GktWYoF.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\jSSNQXY.exe
  C:\Windows\System\jSSNQXY.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\fswWIpn.exe
  C:\Windows\System\fswWIpn.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\JAruudW.exe
  C:\Windows\System\JAruudW.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\SPtgikD.exe
  C:\Windows\System\SPtgikD.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\YdHdajO.exe
  C:\Windows\System\YdHdajO.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\xdBsQXO.exe
  C:\Windows\System\xdBsQXO.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\JoHikHO.exe
  C:\Windows\System\JoHikHO.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\NVaNmiE.exe
  C:\Windows\System\NVaNmiE.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\yOtjdMw.exe
  C:\Windows\System\yOtjdMw.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\gSqKdjT.exe
  C:\Windows\System\gSqKdjT.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\MhfTGFE.exe
  C:\Windows\System\MhfTGFE.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\drxIIoc.exe
  C:\Windows\System\drxIIoc.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\DStWCcM.exe
  C:\Windows\System\DStWCcM.exe
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\System\yJrmgSa.exe
  C:\Windows\System\yJrmgSa.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\KPyciFV.exe
  C:\Windows\System\KPyciFV.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\zLiitOv.exe
  C:\Windows\System\zLiitOv.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\ZAwceeI.exe
  C:\Windows\System\ZAwceeI.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\TzwPYjt.exe
  C:\Windows\System\TzwPYjt.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\dpfOdMp.exe
  C:\Windows\System\dpfOdMp.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\dMoJGYS.exe
  C:\Windows\System\dMoJGYS.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\yezUqBL.exe
  C:\Windows\System\yezUqBL.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\QktQxgs.exe
  C:\Windows\System\QktQxgs.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\fmnPcXv.exe
  C:\Windows\System\fmnPcXv.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\YRYzxpv.exe
  C:\Windows\System\YRYzxpv.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\PbJCGdo.exe
  C:\Windows\System\PbJCGdo.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\MdLSsNW.exe
  C:\Windows\System\MdLSsNW.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\NNhyscX.exe
  C:\Windows\System\NNhyscX.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\iELcDNl.exe
  C:\Windows\System\iELcDNl.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\lMmGmmI.exe
  C:\Windows\System\lMmGmmI.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\BrzZjkv.exe
  C:\Windows\System\BrzZjkv.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\cHqpOGz.exe
  C:\Windows\System\cHqpOGz.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\USSnDxl.exe
  C:\Windows\System\USSnDxl.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\vuNfdef.exe
  C:\Windows\System\vuNfdef.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\SYqNlpX.exe
  C:\Windows\System\SYqNlpX.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\EKgpKbT.exe
  C:\Windows\System\EKgpKbT.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\XGFkVgb.exe
  C:\Windows\System\XGFkVgb.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\bwJlJHz.exe
  C:\Windows\System\bwJlJHz.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\NUVeIxq.exe
  C:\Windows\System\NUVeIxq.exe
  2⤵
  PID:4152
- C:\Windows\System\TkAGVxB.exe
  C:\Windows\System\TkAGVxB.exe
  2⤵
  PID:2084
- C:\Windows\System\rxSVJZb.exe
  C:\Windows\System\rxSVJZb.exe
  2⤵
  PID:4532
- C:\Windows\System\cAxlCSi.exe
  C:\Windows\System\cAxlCSi.exe
  2⤵
  PID:1084
- C:\Windows\System\uIuSsMe.exe
  C:\Windows\System\uIuSsMe.exe
  2⤵
  PID:2572
- C:\Windows\System\RsLTPGh.exe
  C:\Windows\System\RsLTPGh.exe
  2⤵
  PID:4780
- C:\Windows\System\eAcaBcm.exe
  C:\Windows\System\eAcaBcm.exe
  2⤵
  PID:1508
- C:\Windows\System\OVqkVmJ.exe
  C:\Windows\System\OVqkVmJ.exe
  2⤵
  PID:4024
- C:\Windows\System\jFubCis.exe
  C:\Windows\System\jFubCis.exe
  2⤵
  PID:4172
- C:\Windows\System\smxKPgf.exe
  C:\Windows\System\smxKPgf.exe
  2⤵
  PID:1292
- C:\Windows\System\uQQZehC.exe
  C:\Windows\System\uQQZehC.exe
  2⤵
  PID:2972
- C:\Windows\System\OUfuElD.exe
  C:\Windows\System\OUfuElD.exe
  2⤵
  PID:2996
- C:\Windows\System\QmpCfFS.exe
  C:\Windows\System\QmpCfFS.exe
  2⤵
  PID:2796
- C:\Windows\System\Fnvsipf.exe
  C:\Windows\System\Fnvsipf.exe
  2⤵
  PID:2864
- C:\Windows\System\jNSCCeP.exe
  C:\Windows\System\jNSCCeP.exe
  2⤵
  PID:3076
- C:\Windows\System\XevtEZc.exe
  C:\Windows\System\XevtEZc.exe
  2⤵
  PID:1116
- C:\Windows\System\oxPaczv.exe
  C:\Windows\System\oxPaczv.exe
  2⤵
  PID:4256
- C:\Windows\System\ZXAoOEY.exe
  C:\Windows\System\ZXAoOEY.exe
  2⤵
  PID:2296
- C:\Windows\System\vKslpka.exe
  C:\Windows\System\vKslpka.exe
  2⤵
  PID:3712
- C:\Windows\System\uaPxnkC.exe
  C:\Windows\System\uaPxnkC.exe
  2⤵
  PID:1140
- C:\Windows\System\zXhjZRN.exe
  C:\Windows\System\zXhjZRN.exe
  2⤵
  PID:3008
- C:\Windows\System\OkLWUYQ.exe
  C:\Windows\System\OkLWUYQ.exe
  2⤵
  PID:508
- C:\Windows\System\BSnbGpV.exe
  C:\Windows\System\BSnbGpV.exe
  2⤵
  PID:3576
- C:\Windows\System\wvjOyAf.exe
  C:\Windows\System\wvjOyAf.exe
  2⤵
  PID:1856
- C:\Windows\System\HzskCXu.exe
  C:\Windows\System\HzskCXu.exe
  2⤵
  PID:5144
- C:\Windows\System\tgZSUXE.exe
  C:\Windows\System\tgZSUXE.exe
  2⤵
  PID:5180
- C:\Windows\System\rVkppyK.exe
  C:\Windows\System\rVkppyK.exe
  2⤵
  PID:5208
- C:\Windows\System\UqefLwD.exe
  C:\Windows\System\UqefLwD.exe
  2⤵
  PID:5232
- C:\Windows\System\rDjdgOW.exe
  C:\Windows\System\rDjdgOW.exe
  2⤵
  PID:5264
- C:\Windows\System\ehoQyta.exe
  C:\Windows\System\ehoQyta.exe
  2⤵
  PID:5288
- C:\Windows\System\ZAFxVmi.exe
  C:\Windows\System\ZAFxVmi.exe
  2⤵
  PID:5316
- C:\Windows\System\qcqrsRr.exe
  C:\Windows\System\qcqrsRr.exe
  2⤵
  PID:5344
- C:\Windows\System\ObxZoZa.exe
  C:\Windows\System\ObxZoZa.exe
  2⤵
  PID:5372
- C:\Windows\System\KSGdEOF.exe
  C:\Windows\System\KSGdEOF.exe
  2⤵
  PID:5404
- C:\Windows\System\evHsOMU.exe
  C:\Windows\System\evHsOMU.exe
  2⤵
  PID:5428
- C:\Windows\System\ewxsXqM.exe
  C:\Windows\System\ewxsXqM.exe
  2⤵
  PID:5460
- C:\Windows\System\gXWJgxl.exe
  C:\Windows\System\gXWJgxl.exe
  2⤵
  PID:5484
- C:\Windows\System\iFGcErL.exe
  C:\Windows\System\iFGcErL.exe
  2⤵
  PID:5512
- C:\Windows\System\qmCEuAb.exe
  C:\Windows\System\qmCEuAb.exe
  2⤵
  PID:5540
- C:\Windows\System\MLZwfDB.exe
  C:\Windows\System\MLZwfDB.exe
  2⤵
  PID:5568
- C:\Windows\System\yhmevpb.exe
  C:\Windows\System\yhmevpb.exe
  2⤵
  PID:5596
- C:\Windows\System\jSmgTXz.exe
  C:\Windows\System\jSmgTXz.exe
  2⤵
  PID:5628
- C:\Windows\System\pNdpDbF.exe
  C:\Windows\System\pNdpDbF.exe
  2⤵
  PID:5652
- C:\Windows\System\qzULxFG.exe
  C:\Windows\System\qzULxFG.exe
  2⤵
  PID:5680
- C:\Windows\System\XzGVUfD.exe
  C:\Windows\System\XzGVUfD.exe
  2⤵
  PID:5708
- C:\Windows\System\qBAxSpl.exe
  C:\Windows\System\qBAxSpl.exe
  2⤵
  PID:5740
- C:\Windows\System\nPCSdbV.exe
  C:\Windows\System\nPCSdbV.exe
  2⤵
  PID:5764
- C:\Windows\System\OpwgHOL.exe
  C:\Windows\System\OpwgHOL.exe
  2⤵
  PID:5792
- C:\Windows\System\OaizKZd.exe
  C:\Windows\System\OaizKZd.exe
  2⤵
  PID:5820
- C:\Windows\System\lzzCzWA.exe
  C:\Windows\System\lzzCzWA.exe
  2⤵
  PID:5848
- C:\Windows\System\pLvByRL.exe
  C:\Windows\System\pLvByRL.exe
  2⤵
  PID:5876
- C:\Windows\System\bubELvr.exe
  C:\Windows\System\bubELvr.exe
  2⤵
  PID:5900
- C:\Windows\System\hjnlBmp.exe
  C:\Windows\System\hjnlBmp.exe
  2⤵
  PID:5932
- C:\Windows\System\OEaKvgY.exe
  C:\Windows\System\OEaKvgY.exe
  2⤵
  PID:5960
- C:\Windows\System\ZATsfAW.exe
  C:\Windows\System\ZATsfAW.exe
  2⤵
  PID:5988
- C:\Windows\System\IfMtuyK.exe
  C:\Windows\System\IfMtuyK.exe
  2⤵
  PID:6016
- C:\Windows\System\kkEMxDz.exe
  C:\Windows\System\kkEMxDz.exe
  2⤵
  PID:6044
- C:\Windows\System\DJUCiaE.exe
  C:\Windows\System\DJUCiaE.exe
  2⤵
  PID:6072
- C:\Windows\System\RbMIpwJ.exe
  C:\Windows\System\RbMIpwJ.exe
  2⤵
  PID:6100
- C:\Windows\System\jmbdSwn.exe
  C:\Windows\System\jmbdSwn.exe
  2⤵
  PID:6128
- C:\Windows\System\kGZnzVr.exe
  C:\Windows\System\kGZnzVr.exe
  2⤵
  PID:4248
- C:\Windows\System\DDvLesV.exe
  C:\Windows\System\DDvLesV.exe
  2⤵
  PID:928
- C:\Windows\System\KAknqpq.exe
  C:\Windows\System\KAknqpq.exe
  2⤵
  PID:5012
- C:\Windows\System\AUeQrfD.exe
  C:\Windows\System\AUeQrfD.exe
  2⤵
  PID:1524
- C:\Windows\System\XAgxhKW.exe
  C:\Windows\System\XAgxhKW.exe
  2⤵
  PID:3720
- C:\Windows\System\lVIYcqB.exe
  C:\Windows\System\lVIYcqB.exe
  2⤵
  PID:4400
- C:\Windows\System\qOTbdvd.exe
  C:\Windows\System\qOTbdvd.exe
  2⤵
  PID:4612
- C:\Windows\System\pAIIxXm.exe
  C:\Windows\System\pAIIxXm.exe
  2⤵
  PID:2088
- C:\Windows\System\WCZbNrk.exe
  C:\Windows\System\WCZbNrk.exe
  2⤵
  PID:5160
- C:\Windows\System\IFFyiaG.exe
  C:\Windows\System\IFFyiaG.exe
  2⤵
  PID:5216
- C:\Windows\System\Burymsn.exe
  C:\Windows\System\Burymsn.exe
  2⤵
  PID:3156
- C:\Windows\System\FUCalNv.exe
  C:\Windows\System\FUCalNv.exe
  2⤵
  PID:5328
- C:\Windows\System\ikCrZmD.exe
  C:\Windows\System\ikCrZmD.exe
  2⤵
  PID:5388
- C:\Windows\System\ERgGNft.exe
  C:\Windows\System\ERgGNft.exe
  2⤵
  PID:5448
- C:\Windows\System\YbFUFEb.exe
  C:\Windows\System\YbFUFEb.exe
  2⤵
  PID:5524
- C:\Windows\System\SjsBDsc.exe
  C:\Windows\System\SjsBDsc.exe
  2⤵
  PID:5588
- C:\Windows\System\axEbeMm.exe
  C:\Windows\System\axEbeMm.exe
  2⤵
  PID:5648
- C:\Windows\System\RSGLTAJ.exe
  C:\Windows\System\RSGLTAJ.exe
  2⤵
  PID:5700
- C:\Windows\System\mxwVbzK.exe
  C:\Windows\System\mxwVbzK.exe
  2⤵
  PID:5784
- C:\Windows\System\DhmDBjL.exe
  C:\Windows\System\DhmDBjL.exe
  2⤵
  PID:5840
- C:\Windows\System\jJOXHag.exe
  C:\Windows\System\jJOXHag.exe
  2⤵
  PID:5916
- C:\Windows\System\RadqbOO.exe
  C:\Windows\System\RadqbOO.exe
  2⤵
  PID:5976
- C:\Windows\System\GDwmJBb.exe
  C:\Windows\System\GDwmJBb.exe
  2⤵
  PID:6032
- C:\Windows\System\GkYBjdF.exe
  C:\Windows\System\GkYBjdF.exe
  2⤵
  PID:3432
- C:\Windows\System\QtDDfEH.exe
  C:\Windows\System\QtDDfEH.exe
  2⤵
  PID:4820
- C:\Windows\System\PVewSnB.exe
  C:\Windows\System\PVewSnB.exe
  2⤵
  PID:4684
- C:\Windows\System\WuLyWdB.exe
  C:\Windows\System\WuLyWdB.exe
  2⤵
  PID:4456
- C:\Windows\System\gkBAUIW.exe
  C:\Windows\System\gkBAUIW.exe
  2⤵
  PID:32
- C:\Windows\System\cTiDMev.exe
  C:\Windows\System\cTiDMev.exe
  2⤵
  PID:5196
- C:\Windows\System\cXCwNod.exe
  C:\Windows\System\cXCwNod.exe
  2⤵
  PID:5304
- C:\Windows\System\IMILDvZ.exe
  C:\Windows\System\IMILDvZ.exe
  2⤵
  PID:5440
- C:\Windows\System\fupCkSx.exe
  C:\Windows\System\fupCkSx.exe
  2⤵
  PID:5612
- C:\Windows\System\Lwazlyz.exe
  C:\Windows\System\Lwazlyz.exe
  2⤵
  PID:5748
- C:\Windows\System\YKtiNvr.exe
  C:\Windows\System\YKtiNvr.exe
  2⤵
  PID:3992
- C:\Windows\System\RMvaMlX.exe
  C:\Windows\System\RMvaMlX.exe
  2⤵
  PID:1260
- C:\Windows\System\fpyovXj.exe
  C:\Windows\System\fpyovXj.exe
  2⤵
  PID:6120
- C:\Windows\System\AsTivQO.exe
  C:\Windows\System\AsTivQO.exe
  2⤵
  PID:4768
- C:\Windows\System\aNdOODa.exe
  C:\Windows\System\aNdOODa.exe
  2⤵
  PID:2436
- C:\Windows\System\XigNhZX.exe
  C:\Windows\System\XigNhZX.exe
  2⤵
  PID:5252
- C:\Windows\System\QOnpYxQ.exe
  C:\Windows\System\QOnpYxQ.exe
  2⤵
  PID:6204
- C:\Windows\System\kBHzKty.exe
  C:\Windows\System\kBHzKty.exe
  2⤵
  PID:6220
- C:\Windows\System\DDkhSeI.exe
  C:\Windows\System\DDkhSeI.exe
  2⤵
  PID:6236
- C:\Windows\System\cIyJHAb.exe
  C:\Windows\System\cIyJHAb.exe
  2⤵
  PID:6252
- C:\Windows\System\hIGRjdA.exe
  C:\Windows\System\hIGRjdA.exe
  2⤵
  PID:6280
- C:\Windows\System\wwvedFN.exe
  C:\Windows\System\wwvedFN.exe
  2⤵
  PID:6308
- C:\Windows\System\CHjRdhB.exe
  C:\Windows\System\CHjRdhB.exe
  2⤵
  PID:6336
- C:\Windows\System\LlJCPAV.exe
  C:\Windows\System\LlJCPAV.exe
  2⤵
  PID:6400
- C:\Windows\System\BNDfUop.exe
  C:\Windows\System\BNDfUop.exe
  2⤵
  PID:6428
- C:\Windows\System\DkRViCh.exe
  C:\Windows\System\DkRViCh.exe
  2⤵
  PID:6444
- C:\Windows\System\ZQMsOsq.exe
  C:\Windows\System\ZQMsOsq.exe
  2⤵
  PID:6496
- C:\Windows\System\fpnrMOE.exe
  C:\Windows\System\fpnrMOE.exe
  2⤵
  PID:6512
- C:\Windows\System\aQdWGBh.exe
  C:\Windows\System\aQdWGBh.exe
  2⤵
  PID:6532
- C:\Windows\System\egJaXOW.exe
  C:\Windows\System\egJaXOW.exe
  2⤵
  PID:6568
- C:\Windows\System\HUYgDML.exe
  C:\Windows\System\HUYgDML.exe
  2⤵
  PID:6608
- C:\Windows\System\NiLZZhu.exe
  C:\Windows\System\NiLZZhu.exe
  2⤵
  PID:6632
- C:\Windows\System\glgNpLe.exe
  C:\Windows\System\glgNpLe.exe
  2⤵
  PID:6652
- C:\Windows\System\dioGASv.exe
  C:\Windows\System\dioGASv.exe
  2⤵
  PID:6676
- C:\Windows\System\buoZrxV.exe
  C:\Windows\System\buoZrxV.exe
  2⤵
  PID:6708
- C:\Windows\System\hDYHTYB.exe
  C:\Windows\System\hDYHTYB.exe
  2⤵
  PID:6728
- C:\Windows\System\SqCLEZf.exe
  C:\Windows\System\SqCLEZf.exe
  2⤵
  PID:6768
- C:\Windows\System\YsHDbiX.exe
  C:\Windows\System\YsHDbiX.exe
  2⤵
  PID:6792
- C:\Windows\System\tZvBQRA.exe
  C:\Windows\System\tZvBQRA.exe
  2⤵
  PID:6820
- C:\Windows\System\lmOWEzH.exe
  C:\Windows\System\lmOWEzH.exe
  2⤵
  PID:6844
- C:\Windows\System\IVHkgOw.exe
  C:\Windows\System\IVHkgOw.exe
  2⤵
  PID:6864
- C:\Windows\System\hWZIThi.exe
  C:\Windows\System\hWZIThi.exe
  2⤵
  PID:6888
- C:\Windows\System\wDNhheU.exe
  C:\Windows\System\wDNhheU.exe
  2⤵
  PID:6912
- C:\Windows\System\nSWafLj.exe
  C:\Windows\System\nSWafLj.exe
  2⤵
  PID:6936
- C:\Windows\System\hWQKHrC.exe
  C:\Windows\System\hWQKHrC.exe
  2⤵
  PID:6988
- C:\Windows\System\ajyUGoX.exe
  C:\Windows\System\ajyUGoX.exe
  2⤵
  PID:7032
- C:\Windows\System\jnnApTs.exe
  C:\Windows\System\jnnApTs.exe
  2⤵
  PID:7056
- C:\Windows\System\YAJPSwB.exe
  C:\Windows\System\YAJPSwB.exe
  2⤵
  PID:7084
- C:\Windows\System\selPBJO.exe
  C:\Windows\System\selPBJO.exe
  2⤵
  PID:7104
- C:\Windows\System\RQMmrFw.exe
  C:\Windows\System\RQMmrFw.exe
  2⤵
  PID:7124
- C:\Windows\System\BdrhyAu.exe
  C:\Windows\System\BdrhyAu.exe
  2⤵
  PID:7148
- C:\Windows\System\agMnvFi.exe
  C:\Windows\System\agMnvFi.exe
  2⤵
  PID:5552
- C:\Windows\System\ccsqDvz.exe
  C:\Windows\System\ccsqDvz.exe
  2⤵
  PID:5808
- C:\Windows\System\jrpXUqn.exe
  C:\Windows\System\jrpXUqn.exe
  2⤵
  PID:5944
- C:\Windows\System\DWDoDWS.exe
  C:\Windows\System\DWDoDWS.exe
  2⤵
  PID:2184
- C:\Windows\System\BXgClHi.exe
  C:\Windows\System\BXgClHi.exe
  2⤵
  PID:4572
- C:\Windows\System\IFcdFYF.exe
  C:\Windows\System\IFcdFYF.exe
  2⤵
  PID:4444
- C:\Windows\System\AgTjjHY.exe
  C:\Windows\System\AgTjjHY.exe
  2⤵
  PID:6244
- C:\Windows\System\GdbmLnQ.exe
  C:\Windows\System\GdbmLnQ.exe
  2⤵
  PID:6268
- C:\Windows\System\adAMchN.exe
  C:\Windows\System\adAMchN.exe
  2⤵
  PID:3136
- C:\Windows\System\jmGuFcZ.exe
  C:\Windows\System\jmGuFcZ.exe
  2⤵
  PID:2536
- C:\Windows\System\XbxEGCq.exe
  C:\Windows\System\XbxEGCq.exe
  2⤵
  PID:396
- C:\Windows\System\dWmzPUL.exe
  C:\Windows\System\dWmzPUL.exe
  2⤵
  PID:1924
- C:\Windows\System\QJFdHAj.exe
  C:\Windows\System\QJFdHAj.exe
  2⤵
  PID:6464
- C:\Windows\System\VMIAaDV.exe
  C:\Windows\System\VMIAaDV.exe
  2⤵
  PID:6524
- C:\Windows\System\EFjJDdQ.exe
  C:\Windows\System\EFjJDdQ.exe
  2⤵
  PID:6552
- C:\Windows\System\mBUBHHf.exe
  C:\Windows\System\mBUBHHf.exe
  2⤵
  PID:6604
- C:\Windows\System\GIKCCKJ.exe
  C:\Windows\System\GIKCCKJ.exe
  2⤵
  PID:6592
- C:\Windows\System\tCTRpGY.exe
  C:\Windows\System\tCTRpGY.exe
  2⤵
  PID:6668
- C:\Windows\System\DqDmGGx.exe
  C:\Windows\System\DqDmGGx.exe
  2⤵
  PID:6764
- C:\Windows\System\eDHQnJw.exe
  C:\Windows\System\eDHQnJw.exe
  2⤵
  PID:6828
- C:\Windows\System\VHoOzYX.exe
  C:\Windows\System\VHoOzYX.exe
  2⤵
  PID:6968
- C:\Windows\System\HsnMedF.exe
  C:\Windows\System\HsnMedF.exe
  2⤵
  PID:7068
- C:\Windows\System\iGqnNur.exe
  C:\Windows\System\iGqnNur.exe
  2⤵
  PID:7112
- C:\Windows\System\YNItEeI.exe
  C:\Windows\System\YNItEeI.exe
  2⤵
  PID:7144
- C:\Windows\System\yftPnur.exe
  C:\Windows\System\yftPnur.exe
  2⤵
  PID:460
- C:\Windows\System\nzKTXFJ.exe
  C:\Windows\System\nzKTXFJ.exe
  2⤵
  PID:1044
- C:\Windows\System\oFAXuRH.exe
  C:\Windows\System\oFAXuRH.exe
  2⤵
  PID:6320
- C:\Windows\System\CiRtuHr.exe
  C:\Windows\System\CiRtuHr.exe
  2⤵
  PID:2588
- C:\Windows\System\fuxhtKQ.exe
  C:\Windows\System\fuxhtKQ.exe
  2⤵
  PID:4968
- C:\Windows\System\oerjmxk.exe
  C:\Windows\System\oerjmxk.exe
  2⤵
  PID:6624
- C:\Windows\System\PglztFW.exe
  C:\Windows\System\PglztFW.exe
  2⤵
  PID:6664
- C:\Windows\System\ttBLzqh.exe
  C:\Windows\System\ttBLzqh.exe
  2⤵
  PID:6860
- C:\Windows\System\sdBZsyH.exe
  C:\Windows\System\sdBZsyH.exe
  2⤵
  PID:7040
- C:\Windows\System\JLnMzuR.exe
  C:\Windows\System\JLnMzuR.exe
  2⤵
  PID:7136
- C:\Windows\System\MGHOcGX.exe
  C:\Windows\System\MGHOcGX.exe
  2⤵
  PID:5188
- C:\Windows\System\OIYoYtt.exe
  C:\Windows\System\OIYoYtt.exe
  2⤵
  PID:6328
- C:\Windows\System\sGBJUgb.exe
  C:\Windows\System\sGBJUgb.exe
  2⤵
  PID:6540
- C:\Windows\System\OnIrCBc.exe
  C:\Windows\System\OnIrCBc.exe
  2⤵
  PID:6704
- C:\Windows\System\ymVIVgo.exe
  C:\Windows\System\ymVIVgo.exe
  2⤵
  PID:7028
- C:\Windows\System\parrSQz.exe
  C:\Windows\System\parrSQz.exe
  2⤵
  PID:6644
- C:\Windows\System\QaPErDU.exe
  C:\Windows\System\QaPErDU.exe
  2⤵
  PID:6976
- C:\Windows\System\muIqiIm.exe
  C:\Windows\System\muIqiIm.exe
  2⤵
  PID:7184
- C:\Windows\System\DUzxwxs.exe
  C:\Windows\System\DUzxwxs.exe
  2⤵
  PID:7208
- C:\Windows\System\VjJUVdt.exe
  C:\Windows\System\VjJUVdt.exe
  2⤵
  PID:7232
- C:\Windows\System\hjojpNL.exe
  C:\Windows\System\hjojpNL.exe
  2⤵
  PID:7256
- C:\Windows\System\UDrKunS.exe
  C:\Windows\System\UDrKunS.exe
  2⤵
  PID:7304
- C:\Windows\System\BaCFAun.exe
  C:\Windows\System\BaCFAun.exe
  2⤵
  PID:7328
- C:\Windows\System\nUmEyYD.exe
  C:\Windows\System\nUmEyYD.exe
  2⤵
  PID:7384
- C:\Windows\System\oVNTjtr.exe
  C:\Windows\System\oVNTjtr.exe
  2⤵
  PID:7412
- C:\Windows\System\UDMmDjW.exe
  C:\Windows\System\UDMmDjW.exe
  2⤵
  PID:7440
- C:\Windows\System\qDJmYHz.exe
  C:\Windows\System\qDJmYHz.exe
  2⤵
  PID:7464
- C:\Windows\System\ACXVbzH.exe
  C:\Windows\System\ACXVbzH.exe
  2⤵
  PID:7484
- C:\Windows\System\mqEnddw.exe
  C:\Windows\System\mqEnddw.exe
  2⤵
  PID:7512
- C:\Windows\System\zDuDhWG.exe
  C:\Windows\System\zDuDhWG.exe
  2⤵
  PID:7532
- C:\Windows\System\HOKfJYn.exe
  C:\Windows\System\HOKfJYn.exe
  2⤵
  PID:7564
- C:\Windows\System\rOyEPmj.exe
  C:\Windows\System\rOyEPmj.exe
  2⤵
  PID:7588
- C:\Windows\System\OWPVDWU.exe
  C:\Windows\System\OWPVDWU.exe
  2⤵
  PID:7620
- C:\Windows\System\VQDaIFj.exe
  C:\Windows\System\VQDaIFj.exe
  2⤵
  PID:7648
- C:\Windows\System\vdKXiTc.exe
  C:\Windows\System\vdKXiTc.exe
  2⤵
  PID:7672
- C:\Windows\System\RqUOInm.exe
  C:\Windows\System\RqUOInm.exe
  2⤵
  PID:7704
- C:\Windows\System\SyniJQU.exe
  C:\Windows\System\SyniJQU.exe
  2⤵
  PID:7728
- C:\Windows\System\lkVvDkX.exe
  C:\Windows\System\lkVvDkX.exe
  2⤵
  PID:7748
- C:\Windows\System\oYAvbvP.exe
  C:\Windows\System\oYAvbvP.exe
  2⤵
  PID:7796
- C:\Windows\System\IMrlFSI.exe
  C:\Windows\System\IMrlFSI.exe
  2⤵
  PID:7816
- C:\Windows\System\xhYYUQY.exe
  C:\Windows\System\xhYYUQY.exe
  2⤵
  PID:7836
- C:\Windows\System\aVlAPXu.exe
  C:\Windows\System\aVlAPXu.exe
  2⤵
  PID:7876
- C:\Windows\System\tFCPKsY.exe
  C:\Windows\System\tFCPKsY.exe
  2⤵
  PID:7896
- C:\Windows\System\WMuQwNx.exe
  C:\Windows\System\WMuQwNx.exe
  2⤵
  PID:7920
- C:\Windows\System\vIeGwAA.exe
  C:\Windows\System\vIeGwAA.exe
  2⤵
  PID:7940
- C:\Windows\System\QeDtLaD.exe
  C:\Windows\System\QeDtLaD.exe
  2⤵
  PID:7964
- C:\Windows\System\dxaUxVd.exe
  C:\Windows\System\dxaUxVd.exe
  2⤵
  PID:7984
- C:\Windows\System\GvEWGkE.exe
  C:\Windows\System\GvEWGkE.exe
  2⤵
  PID:8012
- C:\Windows\System\kTzowZR.exe
  C:\Windows\System\kTzowZR.exe
  2⤵
  PID:8032
- C:\Windows\System\WrTvChd.exe
  C:\Windows\System\WrTvChd.exe
  2⤵
  PID:8056
- C:\Windows\System\yhKyQbd.exe
  C:\Windows\System\yhKyQbd.exe
  2⤵
  PID:8076
- C:\Windows\System\ArjqAhS.exe
  C:\Windows\System\ArjqAhS.exe
  2⤵
  PID:8104
- C:\Windows\System\eoeiufJ.exe
  C:\Windows\System\eoeiufJ.exe
  2⤵
  PID:8136
- C:\Windows\System\JsrQxil.exe
  C:\Windows\System\JsrQxil.exe
  2⤵
  PID:8164
- C:\Windows\System\EuzeMyQ.exe
  C:\Windows\System\EuzeMyQ.exe
  2⤵
  PID:7196
- C:\Windows\System\egBfgsS.exe
  C:\Windows\System\egBfgsS.exe
  2⤵
  PID:7316
- C:\Windows\System\bagZmne.exe
  C:\Windows\System\bagZmne.exe
  2⤵
  PID:7376
- C:\Windows\System\RiafPwN.exe
  C:\Windows\System\RiafPwN.exe
  2⤵
  PID:7428
- C:\Windows\System\wFatngw.exe
  C:\Windows\System\wFatngw.exe
  2⤵
  PID:7540
- C:\Windows\System\lApmjhu.exe
  C:\Windows\System\lApmjhu.exe
  2⤵
  PID:7556
- C:\Windows\System\VcNEhrb.exe
  C:\Windows\System\VcNEhrb.exe
  2⤵
  PID:7640
- C:\Windows\System\VKbzjGt.exe
  C:\Windows\System\VKbzjGt.exe
  2⤵
  PID:7692
- C:\Windows\System\OqrhlBW.exe
  C:\Windows\System\OqrhlBW.exe
  2⤵
  PID:7784
- C:\Windows\System\mMqXXOK.exe
  C:\Windows\System\mMqXXOK.exe
  2⤵
  PID:7804
- C:\Windows\System\ChEdFQt.exe
  C:\Windows\System\ChEdFQt.exe
  2⤵
  PID:7884
- C:\Windows\System\buTMKxZ.exe
  C:\Windows\System\buTMKxZ.exe
  2⤵
  PID:7892
- C:\Windows\System\ugsRMvF.exe
  C:\Windows\System\ugsRMvF.exe
  2⤵
  PID:7972
- C:\Windows\System\JMqvzbt.exe
  C:\Windows\System\JMqvzbt.exe
  2⤵
  PID:8064
- C:\Windows\System\ukAnzpU.exe
  C:\Windows\System\ukAnzpU.exe
  2⤵
  PID:8048
- C:\Windows\System\Ndrcyjm.exe
  C:\Windows\System\Ndrcyjm.exe
  2⤵
  PID:100
- C:\Windows\System\qkfxVzw.exe
  C:\Windows\System\qkfxVzw.exe
  2⤵
  PID:7248
- C:\Windows\System\cmQQLQC.exe
  C:\Windows\System\cmQQLQC.exe
  2⤵
  PID:7408
- C:\Windows\System\huWSUqF.exe
  C:\Windows\System\huWSUqF.exe
  2⤵
  PID:7524
- C:\Windows\System\hPapiGm.exe
  C:\Windows\System\hPapiGm.exe
  2⤵
  PID:7636
- C:\Windows\System\FHieqVu.exe
  C:\Windows\System\FHieqVu.exe
  2⤵
  PID:7736
- C:\Windows\System\tCytmVH.exe
  C:\Windows\System\tCytmVH.exe
  2⤵
  PID:7928
- C:\Windows\System\dDzOrLQ.exe
  C:\Windows\System\dDzOrLQ.exe
  2⤵
  PID:7952
- C:\Windows\System\QLsjIbZ.exe
  C:\Windows\System\QLsjIbZ.exe
  2⤵
  PID:8156
- C:\Windows\System\patoqWP.exe
  C:\Windows\System\patoqWP.exe
  2⤵
  PID:7496
- C:\Windows\System\DPxOBCR.exe
  C:\Windows\System\DPxOBCR.exe
  2⤵
  PID:7848
- C:\Windows\System\zqROJxV.exe
  C:\Windows\System\zqROJxV.exe
  2⤵
  PID:8204
- C:\Windows\System\BYXJcCV.exe
  C:\Windows\System\BYXJcCV.exe
  2⤵
  PID:8248
- C:\Windows\System\eDLBoVL.exe
  C:\Windows\System\eDLBoVL.exe
  2⤵
  PID:8296
- C:\Windows\System\iTHqtqy.exe
  C:\Windows\System\iTHqtqy.exe
  2⤵
  PID:8320
- C:\Windows\System\RxqfzfK.exe
  C:\Windows\System\RxqfzfK.exe
  2⤵
  PID:8344
- C:\Windows\System\UlNMORC.exe
  C:\Windows\System\UlNMORC.exe
  2⤵
  PID:8364
- C:\Windows\System\JwsDWAO.exe
  C:\Windows\System\JwsDWAO.exe
  2⤵
  PID:8396
- C:\Windows\System\scmwsjy.exe
  C:\Windows\System\scmwsjy.exe
  2⤵
  PID:8420
- C:\Windows\System\PaHeSUL.exe
  C:\Windows\System\PaHeSUL.exe
  2⤵
  PID:8444
- C:\Windows\System\ydoYwQk.exe
  C:\Windows\System\ydoYwQk.exe
  2⤵
  PID:8464
- C:\Windows\System\WpNVFVo.exe
  C:\Windows\System\WpNVFVo.exe
  2⤵
  PID:8492
- C:\Windows\System\JfHsTds.exe
  C:\Windows\System\JfHsTds.exe
  2⤵
  PID:8520
- C:\Windows\System\FzYxgiA.exe
  C:\Windows\System\FzYxgiA.exe
  2⤵
  PID:8540
- C:\Windows\System\AJQqWrE.exe
  C:\Windows\System\AJQqWrE.exe
  2⤵
  PID:8560
- C:\Windows\System\bUTEtir.exe
  C:\Windows\System\bUTEtir.exe
  2⤵
  PID:8632
- C:\Windows\System\EMdaGKX.exe
  C:\Windows\System\EMdaGKX.exe
  2⤵
  PID:8656
- C:\Windows\System\eWuRTrK.exe
  C:\Windows\System\eWuRTrK.exe
  2⤵
  PID:8684
- C:\Windows\System\hrOcgjP.exe
  C:\Windows\System\hrOcgjP.exe
  2⤵
  PID:8700
- C:\Windows\System\ZGVvWDu.exe
  C:\Windows\System\ZGVvWDu.exe
  2⤵
  PID:8736
- C:\Windows\System\imVrUiu.exe
  C:\Windows\System\imVrUiu.exe
  2⤵
  PID:8780
- C:\Windows\System\YepDWnp.exe
  C:\Windows\System\YepDWnp.exe
  2⤵
  PID:8800
- C:\Windows\System\TNwTSrN.exe
  C:\Windows\System\TNwTSrN.exe
  2⤵
  PID:8824
- C:\Windows\System\vMlOEzR.exe
  C:\Windows\System\vMlOEzR.exe
  2⤵
  PID:8848
- C:\Windows\System\FWhtPai.exe
  C:\Windows\System\FWhtPai.exe
  2⤵
  PID:8892
- C:\Windows\System\dRPMYAw.exe
  C:\Windows\System\dRPMYAw.exe
  2⤵
  PID:8920
- C:\Windows\System\LYgQsrE.exe
  C:\Windows\System\LYgQsrE.exe
  2⤵
  PID:8936
- C:\Windows\System\xlKjoPJ.exe
  C:\Windows\System\xlKjoPJ.exe
  2⤵
  PID:8952
- C:\Windows\System\NDvTeCP.exe
  C:\Windows\System\NDvTeCP.exe
  2⤵
  PID:8980
- C:\Windows\System\XPiFoZc.exe
  C:\Windows\System\XPiFoZc.exe
  2⤵
  PID:9008
- C:\Windows\System\JmUMRMt.exe
  C:\Windows\System\JmUMRMt.exe
  2⤵
  PID:9024
- C:\Windows\System\OHHYpmF.exe
  C:\Windows\System\OHHYpmF.exe
  2⤵
  PID:9044
- C:\Windows\System\LcOlKOA.exe
  C:\Windows\System\LcOlKOA.exe
  2⤵
  PID:9064
- C:\Windows\System\YthnUlm.exe
  C:\Windows\System\YthnUlm.exe
  2⤵
  PID:9116
- C:\Windows\System\xmkrxVn.exe
  C:\Windows\System\xmkrxVn.exe
  2⤵
  PID:9148
- C:\Windows\System\ViGLqWA.exe
  C:\Windows\System\ViGLqWA.exe
  2⤵
  PID:9192
- C:\Windows\System\XmVDONg.exe
  C:\Windows\System\XmVDONg.exe
  2⤵
  PID:7436
- C:\Windows\System\fsgZTxO.exe
  C:\Windows\System\fsgZTxO.exe
  2⤵
  PID:8212
- C:\Windows\System\eaoLLjq.exe
  C:\Windows\System\eaoLLjq.exe
  2⤵
  PID:8236
- C:\Windows\System\kwvojKm.exe
  C:\Windows\System\kwvojKm.exe
  2⤵
  PID:8316
- C:\Windows\System\YOQYQeR.exe
  C:\Windows\System\YOQYQeR.exe
  2⤵
  PID:8392
- C:\Windows\System\xbgxlCA.exe
  C:\Windows\System\xbgxlCA.exe
  2⤵
  PID:8384
- C:\Windows\System\kOuEKps.exe
  C:\Windows\System\kOuEKps.exe
  2⤵
  PID:8500
- C:\Windows\System\eaosQmw.exe
  C:\Windows\System\eaosQmw.exe
  2⤵
  PID:8528
- C:\Windows\System\CvEecsa.exe
  C:\Windows\System\CvEecsa.exe
  2⤵
  PID:8592
- C:\Windows\System\YRPrlZn.exe
  C:\Windows\System\YRPrlZn.exe
  2⤵
  PID:8664
- C:\Windows\System\sviqjTx.exe
  C:\Windows\System\sviqjTx.exe
  2⤵
  PID:8748
- C:\Windows\System\kKBlTCL.exe
  C:\Windows\System\kKBlTCL.exe
  2⤵
  PID:8776
- C:\Windows\System\NqmFZrk.exe
  C:\Windows\System\NqmFZrk.exe
  2⤵
  PID:8868
- C:\Windows\System\nmjmPrz.exe
  C:\Windows\System\nmjmPrz.exe
  2⤵
  PID:8944
- C:\Windows\System\zCkDawh.exe
  C:\Windows\System\zCkDawh.exe
  2⤵
  PID:8968
- C:\Windows\System\BbCuuNn.exe
  C:\Windows\System\BbCuuNn.exe
  2⤵
  PID:9060
- C:\Windows\System\MWbSuVz.exe
  C:\Windows\System\MWbSuVz.exe
  2⤵
  PID:9076
- C:\Windows\System\yuPiWsn.exe
  C:\Windows\System\yuPiWsn.exe
  2⤵
  PID:9124
- C:\Windows\System\AwIWTxA.exe
  C:\Windows\System\AwIWTxA.exe
  2⤵
  PID:8052
- C:\Windows\System\gpZxDld.exe
  C:\Windows\System\gpZxDld.exe
  2⤵
  PID:8328
- C:\Windows\System\NBWWsGt.exe
  C:\Windows\System\NBWWsGt.exe
  2⤵
  PID:8484
- C:\Windows\System\sZSXcuq.exe
  C:\Windows\System\sZSXcuq.exe
  2⤵
  PID:8548
- C:\Windows\System\lMwICip.exe
  C:\Windows\System\lMwICip.exe
  2⤵
  PID:8732
- C:\Windows\System\josmDoG.exe
  C:\Windows\System\josmDoG.exe
  2⤵
  PID:8888
- C:\Windows\System\fGVhNko.exe
  C:\Windows\System\fGVhNko.exe
  2⤵
  PID:8916
- C:\Windows\System\GuUdQSg.exe
  C:\Windows\System\GuUdQSg.exe
  2⤵
  PID:9084
- C:\Windows\System\oHqjiid.exe
  C:\Windows\System\oHqjiid.exe
  2⤵
  PID:9204
- C:\Windows\System\oeRrhOs.exe
  C:\Windows\System\oeRrhOs.exe
  2⤵
  PID:8412
- C:\Windows\System\LIhyIcY.exe
  C:\Windows\System\LIhyIcY.exe
  2⤵
  PID:7364
- C:\Windows\System\vVqvrYG.exe
  C:\Windows\System\vVqvrYG.exe
  2⤵
  PID:9232
- C:\Windows\System\DnmKHUz.exe
  C:\Windows\System\DnmKHUz.exe
  2⤵
  PID:9264
- C:\Windows\System\DCKYAOr.exe
  C:\Windows\System\DCKYAOr.exe
  2⤵
  PID:9296
- C:\Windows\System\zMKKXdZ.exe
  C:\Windows\System\zMKKXdZ.exe
  2⤵
  PID:9340
- C:\Windows\System\gcMBLst.exe
  C:\Windows\System\gcMBLst.exe
  2⤵
  PID:9356
- C:\Windows\System\Tduabon.exe
  C:\Windows\System\Tduabon.exe
  2⤵
  PID:9380
- C:\Windows\System\gmfiOKD.exe
  C:\Windows\System\gmfiOKD.exe
  2⤵
  PID:9412
- C:\Windows\System\KscQLQm.exe
  C:\Windows\System\KscQLQm.exe
  2⤵
  PID:9452
- C:\Windows\System\dXVadHL.exe
  C:\Windows\System\dXVadHL.exe
  2⤵
  PID:9480
- C:\Windows\System\wJIjKhV.exe
  C:\Windows\System\wJIjKhV.exe
  2⤵
  PID:9504
- C:\Windows\System\rKZcWgO.exe
  C:\Windows\System\rKZcWgO.exe
  2⤵
  PID:9532
- C:\Windows\System\fGopeuc.exe
  C:\Windows\System\fGopeuc.exe
  2⤵
  PID:9552
- C:\Windows\System\tljyMKL.exe
  C:\Windows\System\tljyMKL.exe
  2⤵
  PID:9592
- C:\Windows\System\elwtKGf.exe
  C:\Windows\System\elwtKGf.exe
  2⤵
  PID:9612
- C:\Windows\System\kTBHuES.exe
  C:\Windows\System\kTBHuES.exe
  2⤵
  PID:9640
- C:\Windows\System\ipalkwo.exe
  C:\Windows\System\ipalkwo.exe
  2⤵
  PID:9660
- C:\Windows\System\MVnpjUE.exe
  C:\Windows\System\MVnpjUE.exe
  2⤵
  PID:9700
- C:\Windows\System\pYqIRkW.exe
  C:\Windows\System\pYqIRkW.exe
  2⤵
  PID:9740
- C:\Windows\System\hbHGyxF.exe
  C:\Windows\System\hbHGyxF.exe
  2⤵
  PID:9760
- C:\Windows\System\XwKxCIx.exe
  C:\Windows\System\XwKxCIx.exe
  2⤵
  PID:9784
- C:\Windows\System\BwABwxx.exe
  C:\Windows\System\BwABwxx.exe
  2⤵
  PID:9800
- C:\Windows\System\nlFGoRv.exe
  C:\Windows\System\nlFGoRv.exe
  2⤵
  PID:9824
- C:\Windows\System\ZaiXDSx.exe
  C:\Windows\System\ZaiXDSx.exe
  2⤵
  PID:9860
- C:\Windows\System\nXXARrM.exe
  C:\Windows\System\nXXARrM.exe
  2⤵
  PID:9888
- C:\Windows\System\zEERkwM.exe
  C:\Windows\System\zEERkwM.exe
  2⤵
  PID:9912
- C:\Windows\System\NnziLaw.exe
  C:\Windows\System\NnziLaw.exe
  2⤵
  PID:9940
- C:\Windows\System\PRFLBor.exe
  C:\Windows\System\PRFLBor.exe
  2⤵
  PID:9984
- C:\Windows\System\cDUTWef.exe
  C:\Windows\System\cDUTWef.exe
  2⤵
  PID:10012
- C:\Windows\System\caGlFlk.exe
  C:\Windows\System\caGlFlk.exe
  2⤵
  PID:10036
- C:\Windows\System\PZsxKzZ.exe
  C:\Windows\System\PZsxKzZ.exe
  2⤵
  PID:10072
- C:\Windows\System\KnIpSer.exe
  C:\Windows\System\KnIpSer.exe
  2⤵
  PID:10092
- C:\Windows\System\dEoUgcR.exe
  C:\Windows\System\dEoUgcR.exe
  2⤵
  PID:10120
- C:\Windows\System\RplbQnk.exe
  C:\Windows\System\RplbQnk.exe
  2⤵
  PID:10140
- C:\Windows\System\kGCBhLF.exe
  C:\Windows\System\kGCBhLF.exe
  2⤵
  PID:10168
- C:\Windows\System\fecFohI.exe
  C:\Windows\System\fecFohI.exe
  2⤵
  PID:10192
- C:\Windows\System\OhYKOcx.exe
  C:\Windows\System\OhYKOcx.exe
  2⤵
  PID:10216
- C:\Windows\System\QGOjqCu.exe
  C:\Windows\System\QGOjqCu.exe
  2⤵
  PID:8904
- C:\Windows\System\BwMrNcL.exe
  C:\Windows\System\BwMrNcL.exe
  2⤵
  PID:9244
- C:\Windows\System\vzZJTWD.exe
  C:\Windows\System\vzZJTWD.exe
  2⤵
  PID:9328
- C:\Windows\System\TriWQZd.exe
  C:\Windows\System\TriWQZd.exe
  2⤵
  PID:9372
- C:\Windows\System\uWbxomq.exe
  C:\Windows\System\uWbxomq.exe
  2⤵
  PID:9496
- C:\Windows\System\QAKzHVm.exe
  C:\Windows\System\QAKzHVm.exe
  2⤵
  PID:9524
- C:\Windows\System\uLMsABg.exe
  C:\Windows\System\uLMsABg.exe
  2⤵
  PID:9600
- C:\Windows\System\ACjkbmJ.exe
  C:\Windows\System\ACjkbmJ.exe
  2⤵
  PID:9648
- C:\Windows\System\rkNVyfM.exe
  C:\Windows\System\rkNVyfM.exe
  2⤵
  PID:9692
- C:\Windows\System\izztcmT.exe
  C:\Windows\System\izztcmT.exe
  2⤵
  PID:9780
- C:\Windows\System\zXvXLrX.exe
  C:\Windows\System\zXvXLrX.exe
  2⤵
  PID:9820
- C:\Windows\System\CGhILdv.exe
  C:\Windows\System\CGhILdv.exe
  2⤵
  PID:9844
- C:\Windows\System\ODgIInB.exe
  C:\Windows\System\ODgIInB.exe
  2⤵
  PID:9956
- C:\Windows\System\PvyIsfj.exe
  C:\Windows\System\PvyIsfj.exe
  2⤵
  PID:9980
- C:\Windows\System\GJTYPRm.exe
  C:\Windows\System\GJTYPRm.exe
  2⤵
  PID:10028
- C:\Windows\System\WCVcrnj.exe
  C:\Windows\System\WCVcrnj.exe
  2⤵
  PID:10112
- C:\Windows\System\RCSoLWI.exe
  C:\Windows\System\RCSoLWI.exe
  2⤵
  PID:10212
- C:\Windows\System\pZFEPZW.exe
  C:\Windows\System\pZFEPZW.exe
  2⤵
  PID:8712
- C:\Windows\System\eLRvbax.exe
  C:\Windows\System\eLRvbax.exe
  2⤵
  PID:9572
- C:\Windows\System\AQzEgGQ.exe
  C:\Windows\System\AQzEgGQ.exe
  2⤵
  PID:9620
- C:\Windows\System\VwdsEnN.exe
  C:\Windows\System\VwdsEnN.exe
  2⤵
  PID:9748
- C:\Windows\System\wiEirNy.exe
  C:\Windows\System\wiEirNy.exe
  2⤵
  PID:9972
- C:\Windows\System\sncSxZi.exe
  C:\Windows\System\sncSxZi.exe
  2⤵
  PID:10180
- C:\Windows\System\CDAfRWU.exe
  C:\Windows\System\CDAfRWU.exe
  2⤵
  PID:10108
- C:\Windows\System\uGjTznr.exe
  C:\Windows\System\uGjTznr.exe
  2⤵
  PID:9468
- C:\Windows\System\SOknrqr.exe
  C:\Windows\System\SOknrqr.exe
  2⤵
  PID:9608
- C:\Windows\System\eMyHhGz.exe
  C:\Windows\System\eMyHhGz.exe
  2⤵
  PID:9852
- C:\Windows\System\UjDlnPX.exe
  C:\Windows\System\UjDlnPX.exe
  2⤵
  PID:10020
- C:\Windows\System\JPexARI.exe
  C:\Windows\System\JPexARI.exe
  2⤵
  PID:10256
- C:\Windows\System\efXUREk.exe
  C:\Windows\System\efXUREk.exe
  2⤵
  PID:10312
- C:\Windows\System\hLsAjIz.exe
  C:\Windows\System\hLsAjIz.exe
  2⤵
  PID:10328
- C:\Windows\System\LGtgqIH.exe
  C:\Windows\System\LGtgqIH.exe
  2⤵
  PID:10352
- C:\Windows\System\vfWCMFK.exe
  C:\Windows\System\vfWCMFK.exe
  2⤵
  PID:10384
- C:\Windows\System\TElAObJ.exe
  C:\Windows\System\TElAObJ.exe
  2⤵
  PID:10424
- C:\Windows\System\PCLsTqs.exe
  C:\Windows\System\PCLsTqs.exe
  2⤵
  PID:10440
- C:\Windows\System\uTlgxiu.exe
  C:\Windows\System\uTlgxiu.exe
  2⤵
  PID:10468
- C:\Windows\System\sWRaswr.exe
  C:\Windows\System\sWRaswr.exe
  2⤵
  PID:10500
- C:\Windows\System\tFEduEg.exe
  C:\Windows\System\tFEduEg.exe
  2⤵
  PID:10520
- C:\Windows\System\RWuAaUF.exe
  C:\Windows\System\RWuAaUF.exe
  2⤵
  PID:10552
- C:\Windows\System\sGZZCxO.exe
  C:\Windows\System\sGZZCxO.exe
  2⤵
  PID:10576
- C:\Windows\System\glMdqNs.exe
  C:\Windows\System\glMdqNs.exe
  2⤵
  PID:10600
- C:\Windows\System\alvEXFn.exe
  C:\Windows\System\alvEXFn.exe
  2⤵
  PID:10632
- C:\Windows\System\wvjZYIv.exe
  C:\Windows\System\wvjZYIv.exe
  2⤵
  PID:10652
- C:\Windows\System\VNvzNyZ.exe
  C:\Windows\System\VNvzNyZ.exe
  2⤵
  PID:10696
- C:\Windows\System\MXTMaez.exe
  C:\Windows\System\MXTMaez.exe
  2⤵
  PID:10720
- C:\Windows\System\EiKTfMr.exe
  C:\Windows\System\EiKTfMr.exe
  2⤵
  PID:10740
- C:\Windows\System\zmLWJLU.exe
  C:\Windows\System\zmLWJLU.exe
  2⤵
  PID:10772
- C:\Windows\System\TOtyteq.exe
  C:\Windows\System\TOtyteq.exe
  2⤵
  PID:10808
- C:\Windows\System\tyoGLSA.exe
  C:\Windows\System\tyoGLSA.exe
  2⤵
  PID:10860
- C:\Windows\System\QANWirK.exe
  C:\Windows\System\QANWirK.exe
  2⤵
  PID:10884
- C:\Windows\System\nJrSIRQ.exe
  C:\Windows\System\nJrSIRQ.exe
  2⤵
  PID:10904
- C:\Windows\System\SUegzJj.exe
  C:\Windows\System\SUegzJj.exe
  2⤵
  PID:10924
- C:\Windows\System\yeYawup.exe
  C:\Windows\System\yeYawup.exe
  2⤵
  PID:10948
- C:\Windows\System\eYLPXNb.exe
  C:\Windows\System\eYLPXNb.exe
  2⤵
  PID:10968
- C:\Windows\System\ucXwmVC.exe
  C:\Windows\System\ucXwmVC.exe
  2⤵
  PID:10992
- C:\Windows\System\SRZmDaC.exe
  C:\Windows\System\SRZmDaC.exe
  2⤵
  PID:11040
- C:\Windows\System\MLPvsEx.exe
  C:\Windows\System\MLPvsEx.exe
  2⤵
  PID:11060
- C:\Windows\System\AsKxbwE.exe
  C:\Windows\System\AsKxbwE.exe
  2⤵
  PID:11088
- C:\Windows\System\abFlhRo.exe
  C:\Windows\System\abFlhRo.exe
  2⤵
  PID:11104
- C:\Windows\System\xHDsDMP.exe
  C:\Windows\System\xHDsDMP.exe
  2⤵
  PID:11156
- C:\Windows\System\klsXvmS.exe
  C:\Windows\System\klsXvmS.exe
  2⤵
  PID:11180
- C:\Windows\System\uXcBjdh.exe
  C:\Windows\System\uXcBjdh.exe
  2⤵
  PID:11200
- C:\Windows\System\SdReZSg.exe
  C:\Windows\System\SdReZSg.exe
  2⤵
  PID:11228
- C:\Windows\System\wKcPoKE.exe
  C:\Windows\System\wKcPoKE.exe
  2⤵
  PID:9792
- C:\Windows\System\VoReaio.exe
  C:\Windows\System\VoReaio.exe
  2⤵
  PID:10088
- C:\Windows\System\WZPHfyh.exe
  C:\Windows\System\WZPHfyh.exe
  2⤵
  PID:10288
- C:\Windows\System\uXbsxMi.exe
  C:\Windows\System\uXbsxMi.exe
  2⤵
  PID:10348
- C:\Windows\System\QHugsex.exe
  C:\Windows\System\QHugsex.exe
  2⤵
  PID:10396
- C:\Windows\System\XhQlach.exe
  C:\Windows\System\XhQlach.exe
  2⤵
  PID:10476
- C:\Windows\System\WfDDSkf.exe
  C:\Windows\System\WfDDSkf.exe
  2⤵
  PID:10620
- C:\Windows\System\UTfvwmJ.exe
  C:\Windows\System\UTfvwmJ.exe
  2⤵
  PID:10596
- C:\Windows\System\dHrUIXz.exe
  C:\Windows\System\dHrUIXz.exe
  2⤵
  PID:10644
- C:\Windows\System\iIMFwUB.exe
  C:\Windows\System\iIMFwUB.exe
  2⤵
  PID:10716
- C:\Windows\System\sezdbOU.exe
  C:\Windows\System\sezdbOU.exe
  2⤵
  PID:10752
- C:\Windows\System\ValglXK.exe
  C:\Windows\System\ValglXK.exe
  2⤵
  PID:10804
- C:\Windows\System\wiPvYoX.exe
  C:\Windows\System\wiPvYoX.exe
  2⤵
  PID:10900
- C:\Windows\System\avzClcI.exe
  C:\Windows\System\avzClcI.exe
  2⤵
  PID:10932
- C:\Windows\System\elREjML.exe
  C:\Windows\System\elREjML.exe
  2⤵
  PID:11056
- C:\Windows\System\ZKDaBKO.exe
  C:\Windows\System\ZKDaBKO.exe
  2⤵
  PID:11132
- C:\Windows\System\xPswhUi.exe
  C:\Windows\System\xPswhUi.exe
  2⤵
  PID:11220
- C:\Windows\System\PLmwhyU.exe
  C:\Windows\System\PLmwhyU.exe
  2⤵
  PID:9288
- C:\Windows\System\vqsSaiV.exe
  C:\Windows\System\vqsSaiV.exe
  2⤵
  PID:10344
- C:\Windows\System\ILlIpSv.exe
  C:\Windows\System\ILlIpSv.exe
  2⤵
  PID:10408
- C:\Windows\System\puqaXGL.exe
  C:\Windows\System\puqaXGL.exe
  2⤵
  PID:10676
- C:\Windows\System\nSCBnGk.exe
  C:\Windows\System\nSCBnGk.exe
  2⤵
  PID:10876
- C:\Windows\System\fFYxaWq.exe
  C:\Windows\System\fFYxaWq.exe
  2⤵
  PID:10796
- C:\Windows\System\qmCjmvj.exe
  C:\Windows\System\qmCjmvj.exe
  2⤵
  PID:10980
- C:\Windows\System\PZQanrm.exe
  C:\Windows\System\PZQanrm.exe
  2⤵
  PID:11172
- C:\Windows\System\BjKiTfI.exe
  C:\Windows\System\BjKiTfI.exe
  2⤵
  PID:11240
- C:\Windows\System\NwLzUDl.exe
  C:\Windows\System\NwLzUDl.exe
  2⤵
  PID:10628
- C:\Windows\System\wXQGbwR.exe
  C:\Windows\System\wXQGbwR.exe
  2⤵
  PID:11136
- C:\Windows\System\DyAxhwX.exe
  C:\Windows\System\DyAxhwX.exe
  2⤵
  PID:11276
- C:\Windows\System\FMETFiK.exe
  C:\Windows\System\FMETFiK.exe
  2⤵
  PID:11308
- C:\Windows\System\INgtDrf.exe
  C:\Windows\System\INgtDrf.exe
  2⤵
  PID:11328
- C:\Windows\System\BkEEWLQ.exe
  C:\Windows\System\BkEEWLQ.exe
  2⤵
  PID:11352
- C:\Windows\System\PlBIyhf.exe
  C:\Windows\System\PlBIyhf.exe
  2⤵
  PID:11372
- C:\Windows\System\KBuAvUB.exe
  C:\Windows\System\KBuAvUB.exe
  2⤵
  PID:11432
- C:\Windows\System\snLCChA.exe
  C:\Windows\System\snLCChA.exe
  2⤵
  PID:11448
- C:\Windows\System\mzHAiCO.exe
  C:\Windows\System\mzHAiCO.exe
  2⤵
  PID:11476
- C:\Windows\System\kAVwWBe.exe
  C:\Windows\System\kAVwWBe.exe
  2⤵
  PID:11504
- C:\Windows\System\QBAiCqs.exe
  C:\Windows\System\QBAiCqs.exe
  2⤵
  PID:11532
- C:\Windows\System\VmBpIfi.exe
  C:\Windows\System\VmBpIfi.exe
  2⤵
  PID:11568
- C:\Windows\System\GhrvGBg.exe
  C:\Windows\System\GhrvGBg.exe
  2⤵
  PID:11592
- C:\Windows\System\ZHPGXkH.exe
  C:\Windows\System\ZHPGXkH.exe
  2⤵
  PID:11620
- C:\Windows\System\DZNGBrX.exe
  C:\Windows\System\DZNGBrX.exe
  2⤵
  PID:11660
- C:\Windows\System\gHcDOVD.exe
  C:\Windows\System\gHcDOVD.exe
  2⤵
  PID:11688
- C:\Windows\System\cIGgRgf.exe
  C:\Windows\System\cIGgRgf.exe
  2⤵
  PID:11704
- C:\Windows\System\LVlKPST.exe
  C:\Windows\System\LVlKPST.exe
  2⤵
  PID:11724
- C:\Windows\System\hFystCu.exe
  C:\Windows\System\hFystCu.exe
  2⤵
  PID:11748
- C:\Windows\System\nVDjTHr.exe
  C:\Windows\System\nVDjTHr.exe
  2⤵
  PID:11776
- C:\Windows\System\apyukjs.exe
  C:\Windows\System\apyukjs.exe
  2⤵
  PID:11800
- C:\Windows\System\DVYpGeO.exe
  C:\Windows\System\DVYpGeO.exe
  2⤵
  PID:11848
- C:\Windows\System\yVRRBHZ.exe
  C:\Windows\System\yVRRBHZ.exe
  2⤵
  PID:11876
- C:\Windows\System\vPreDux.exe
  C:\Windows\System\vPreDux.exe
  2⤵
  PID:11892
- C:\Windows\System\wpKYqfF.exe
  C:\Windows\System\wpKYqfF.exe
  2⤵
  PID:11920
- C:\Windows\System\cgxklkT.exe
  C:\Windows\System\cgxklkT.exe
  2⤵
  PID:11948
- C:\Windows\System\HPinrpK.exe
  C:\Windows\System\HPinrpK.exe
  2⤵
  PID:11964
- C:\Windows\System\aZTFpCI.exe
  C:\Windows\System\aZTFpCI.exe
  2⤵
  PID:11988
- C:\Windows\System\vHzcnbR.exe
  C:\Windows\System\vHzcnbR.exe
  2⤵
  PID:12056
- C:\Windows\System\LXbzCgc.exe
  C:\Windows\System\LXbzCgc.exe
  2⤵
  PID:12084
- C:\Windows\System\LsYElim.exe
  C:\Windows\System\LsYElim.exe
  2⤵
  PID:12100
- C:\Windows\System\GVLtkal.exe
  C:\Windows\System\GVLtkal.exe
  2⤵
  PID:12120
- C:\Windows\System\uQLzOzQ.exe
  C:\Windows\System\uQLzOzQ.exe
  2⤵
  PID:12144
- C:\Windows\System\TFKQVuh.exe
  C:\Windows\System\TFKQVuh.exe
  2⤵
  PID:12172
- C:\Windows\System\UAqmeqx.exe
  C:\Windows\System\UAqmeqx.exe
  2⤵
  PID:12204
- C:\Windows\System\EdwDaKP.exe
  C:\Windows\System\EdwDaKP.exe
  2⤵
  PID:12240
- C:\Windows\System\DYoouIR.exe
  C:\Windows\System\DYoouIR.exe
  2⤵
  PID:12264
- C:\Windows\System\qkIvIfi.exe
  C:\Windows\System\qkIvIfi.exe
  2⤵
  PID:10284
- C:\Windows\System\JAlosNd.exe
  C:\Windows\System\JAlosNd.exe
  2⤵
  PID:11300
- C:\Windows\System\plwvoOM.exe
  C:\Windows\System\plwvoOM.exe
  2⤵
  PID:11360
- C:\Windows\System\EgpBBRY.exe
  C:\Windows\System\EgpBBRY.exe
  2⤵
  PID:11428
- C:\Windows\System\zriuHvC.exe
  C:\Windows\System\zriuHvC.exe
  2⤵
  PID:11464
- C:\Windows\System\jAYdkud.exe
  C:\Windows\System\jAYdkud.exe
  2⤵
  PID:11516
- C:\Windows\System\RzMGLCi.exe
  C:\Windows\System\RzMGLCi.exe
  2⤵
  PID:11576
- C:\Windows\System\jqtvLwu.exe
  C:\Windows\System\jqtvLwu.exe
  2⤵
  PID:11640
- C:\Windows\System\xwPOOsz.exe
  C:\Windows\System\xwPOOsz.exe
  2⤵
  PID:11696
- C:\Windows\System\BhXLEfw.exe
  C:\Windows\System\BhXLEfw.exe
  2⤵
  PID:11812
- C:\Windows\System\VUyADTz.exe
  C:\Windows\System\VUyADTz.exe
  2⤵
  PID:11836
- C:\Windows\System\mKFSYCf.exe
  C:\Windows\System\mKFSYCf.exe
  2⤵
  PID:11912
- C:\Windows\System\oJDlpkb.exe
  C:\Windows\System\oJDlpkb.exe
  2⤵
  PID:11960
- C:\Windows\System\oBRIiGo.exe
  C:\Windows\System\oBRIiGo.exe
  2⤵
  PID:12092
- C:\Windows\System\ZoIhgVX.exe
  C:\Windows\System\ZoIhgVX.exe
  2⤵
  PID:12128
- C:\Windows\System\pqZrxgu.exe
  C:\Windows\System\pqZrxgu.exe
  2⤵
  PID:12168
- C:\Windows\System\qNnmFAf.exe
  C:\Windows\System\qNnmFAf.exe
  2⤵
  PID:12252
- C:\Windows\System\FNbWOKL.exe
  C:\Windows\System\FNbWOKL.exe
  2⤵
  PID:11292
- C:\Windows\System\fGOsJIZ.exe
  C:\Windows\System\fGOsJIZ.exe
  2⤵
  PID:11524
- C:\Windows\System\pvaeISs.exe
  C:\Windows\System\pvaeISs.exe
  2⤵
  PID:11604
- C:\Windows\System\XMUAjgz.exe
  C:\Windows\System\XMUAjgz.exe
  2⤵
  PID:11676
- C:\Windows\System\bLeqCdM.exe
  C:\Windows\System\bLeqCdM.exe
  2⤵
  PID:11788
- C:\Windows\System\JBcDTLV.exe
  C:\Windows\System\JBcDTLV.exe
  2⤵
  PID:12140
- C:\Windows\System\tHzkGOg.exe
  C:\Windows\System\tHzkGOg.exe
  2⤵
  PID:10764
- C:\Windows\System\pAUkTLz.exe
  C:\Windows\System\pAUkTLz.exe
  2⤵
  PID:11400
- C:\Windows\System\FutEYnP.exe
  C:\Windows\System\FutEYnP.exe
  2⤵
  PID:11652
- C:\Windows\System\OFqzMZz.exe
  C:\Windows\System\OFqzMZz.exe
  2⤵
  PID:12012
- C:\Windows\System\VfzPzCu.exe
  C:\Windows\System\VfzPzCu.exe
  2⤵
  PID:12236
- C:\Windows\System\UMIdLaT.exe
  C:\Windows\System\UMIdLaT.exe
  2⤵
  PID:11744
- C:\Windows\System\ytlBSwd.exe
  C:\Windows\System\ytlBSwd.exe
  2⤵
  PID:12308
- C:\Windows\System\NUNsAOJ.exe
  C:\Windows\System\NUNsAOJ.exe
  2⤵
  PID:12336
- C:\Windows\System\fMnExEJ.exe
  C:\Windows\System\fMnExEJ.exe
  2⤵
  PID:12380
- C:\Windows\System\DqtbAOW.exe
  C:\Windows\System\DqtbAOW.exe
  2⤵
  PID:12400
- C:\Windows\System\Urahkno.exe
  C:\Windows\System\Urahkno.exe
  2⤵
  PID:12428
- C:\Windows\System\sJXshnj.exe
  C:\Windows\System\sJXshnj.exe
  2⤵
  PID:12448
- C:\Windows\System\gBoCDFc.exe
  C:\Windows\System\gBoCDFc.exe
  2⤵
  PID:12484
- C:\Windows\System\cZscfpM.exe
  C:\Windows\System\cZscfpM.exe
  2⤵
  PID:12540
- C:\Windows\System\zSFycBy.exe
  C:\Windows\System\zSFycBy.exe
  2⤵
  PID:12568
- C:\Windows\System\iBHTngi.exe
  C:\Windows\System\iBHTngi.exe
  2⤵
  PID:12584
- C:\Windows\System\ckFzxbT.exe
  C:\Windows\System\ckFzxbT.exe
  2⤵
  PID:12600
- C:\Windows\System\piitOOD.exe
  C:\Windows\System\piitOOD.exe
  2⤵
  PID:12624
- C:\Windows\System\ZjvRGIK.exe
  C:\Windows\System\ZjvRGIK.exe
  2⤵
  PID:12672
- C:\Windows\System\XVwTqfs.exe
  C:\Windows\System\XVwTqfs.exe
  2⤵
  PID:12696
- C:\Windows\System\fbipzmi.exe
  C:\Windows\System\fbipzmi.exe
  2⤵
  PID:12732
- C:\Windows\System\msLdbDO.exe
  C:\Windows\System\msLdbDO.exe
  2⤵
  PID:12752
- C:\Windows\System\zJsQYrW.exe
  C:\Windows\System\zJsQYrW.exe
  2⤵
  PID:12776
- C:\Windows\System\qQdGNSO.exe
  C:\Windows\System\qQdGNSO.exe
  2⤵
  PID:12796
- C:\Windows\System\fKIyLDQ.exe
  C:\Windows\System\fKIyLDQ.exe
  2⤵
  PID:12840
- C:\Windows\System\vmvqFmZ.exe
  C:\Windows\System\vmvqFmZ.exe
  2⤵
  PID:12880
- C:\Windows\System\qCuzMqF.exe
  C:\Windows\System\qCuzMqF.exe
  2⤵
  PID:12908
- C:\Windows\System\wIwbMnl.exe
  C:\Windows\System\wIwbMnl.exe
  2⤵
  PID:12936
- C:\Windows\System\BqJTSPG.exe
  C:\Windows\System\BqJTSPG.exe
  2⤵
  PID:12960
- C:\Windows\System\SamBGto.exe
  C:\Windows\System\SamBGto.exe
  2⤵
  PID:12992
- C:\Windows\System\qkjwyJA.exe
  C:\Windows\System\qkjwyJA.exe
  2⤵
  PID:13008
- C:\Windows\System\isMmFid.exe
  C:\Windows\System\isMmFid.exe
  2⤵
  PID:13024
- C:\Windows\System\VMZZXXF.exe
  C:\Windows\System\VMZZXXF.exe
  2⤵
  PID:13064
- C:\Windows\System\xXSybCE.exe
  C:\Windows\System\xXSybCE.exe
  2⤵
  PID:13084
- C:\Windows\System\GfiLInF.exe
  C:\Windows\System\GfiLInF.exe
  2⤵
  PID:13120
- C:\Windows\System\BKXtYNC.exe
  C:\Windows\System\BKXtYNC.exe
  2⤵
  PID:13136
- C:\Windows\System\NXynIpK.exe
  C:\Windows\System\NXynIpK.exe
  2⤵
  PID:13160
- C:\Windows\System\qbjUHon.exe
  C:\Windows\System\qbjUHon.exe
  2⤵
  PID:13200
- C:\Windows\System\TyeWUfQ.exe
  C:\Windows\System\TyeWUfQ.exe
  2⤵
  PID:13228
- C:\Windows\System\FYLLnWw.exe
  C:\Windows\System\FYLLnWw.exe
  2⤵
  PID:13248
- C:\Windows\System\hxrafLr.exe
  C:\Windows\System\hxrafLr.exe
  2⤵
  PID:13268
- C:\Windows\System\njssJDy.exe
  C:\Windows\System\njssJDy.exe
  2⤵
  PID:13304
- C:\Windows\System\ZpBLrrB.exe
  C:\Windows\System\ZpBLrrB.exe
  2⤵
  PID:12096
- C:\Windows\System\ptsHlzX.exe
  C:\Windows\System\ptsHlzX.exe
  2⤵
  PID:12368
- C:\Windows\System\WfoYiax.exe
  C:\Windows\System\WfoYiax.exe
  2⤵
  PID:12392
- C:\Windows\System\TZnAGWw.exe
  C:\Windows\System\TZnAGWw.exe
  2⤵
  PID:12440
- C:\Windows\System\UhLaiNt.exe
  C:\Windows\System\UhLaiNt.exe
  2⤵
  PID:12552
- C:\Windows\System\LQWEdvT.exe
  C:\Windows\System\LQWEdvT.exe
  2⤵
  PID:12648
- C:\Windows\System\gkJnnzU.exe
  C:\Windows\System\gkJnnzU.exe
  2⤵
  PID:12708
- C:\Windows\System\tvYXyzi.exe
  C:\Windows\System\tvYXyzi.exe
  2⤵
  PID:12760
- C:\Windows\System\fXIsiWR.exe
  C:\Windows\System\fXIsiWR.exe
  2⤵
  PID:12820
- C:\Windows\System\XyzzahC.exe
  C:\Windows\System\XyzzahC.exe
  2⤵
  PID:12924
- C:\Windows\System\DHtHdEL.exe
  C:\Windows\System\DHtHdEL.exe
  2⤵
  PID:13004
- C:\Windows\System\GwOUuOI.exe
  C:\Windows\System\GwOUuOI.exe
  2⤵
  PID:13044
- C:\Windows\System\TjOiTtt.exe
  C:\Windows\System\TjOiTtt.exe
  2⤵
  PID:13156
- C:\Windows\System\DBEdKVU.exe
  C:\Windows\System\DBEdKVU.exe
  2⤵
  PID:13296
- C:\Windows\System\ORSxuLf.exe
  C:\Windows\System\ORSxuLf.exe
  2⤵
  PID:11544
- C:\Windows\System\wcvaKTD.exe
  C:\Windows\System\wcvaKTD.exe
  2⤵
  PID:12412
- C:\Windows\System\vIxuTKM.exe
  C:\Windows\System\vIxuTKM.exe
  2⤵
  PID:12536
- C:\Windows\System\FpiGADy.exe
  C:\Windows\System\FpiGADy.exe
  2⤵
  PID:12640
- C:\Windows\System\exfTNAT.exe
  C:\Windows\System\exfTNAT.exe
  2⤵
  PID:12792
- C:\Windows\System\jMwmmDI.exe
  C:\Windows\System\jMwmmDI.exe
  2⤵
  PID:13080
- C:\Windows\System\IHkPdmk.exe
  C:\Windows\System\IHkPdmk.exe
  2⤵
  PID:13224
- C:\Windows\System\fraiSHL.exe
  C:\Windows\System\fraiSHL.exe
  2⤵
  PID:12356
- C:\Windows\System\KIPYuSX.exe
  C:\Windows\System\KIPYuSX.exe
  2⤵
  PID:12532
- C:\Windows\System\aItkEmn.exe
  C:\Windows\System\aItkEmn.exe
  2⤵
  PID:12980
- C:\Windows\System\ENqcTqC.exe
  C:\Windows\System\ENqcTqC.exe
  2⤵
  PID:13336
- C:\Windows\System\ENzAkAT.exe
  C:\Windows\System\ENzAkAT.exe
  2⤵
  PID:13356
- C:\Windows\System\aMeuAHS.exe
  C:\Windows\System\aMeuAHS.exe
  2⤵
  PID:13396
- C:\Windows\System\aZHlRMx.exe
  C:\Windows\System\aZHlRMx.exe
  2⤵
  PID:13416
- C:\Windows\System\FVwzqwp.exe
  C:\Windows\System\FVwzqwp.exe
  2⤵
  PID:13444
- C:\Windows\System\zDLWlnx.exe
  C:\Windows\System\zDLWlnx.exe
  2⤵
  PID:13464
- C:\Windows\System\SXcQfdr.exe
  C:\Windows\System\SXcQfdr.exe
  2⤵
  PID:13492
- C:\Windows\System\ybqrwuI.exe
  C:\Windows\System\ybqrwuI.exe
  2⤵
  PID:13520
- C:\Windows\System\RauTGdF.exe
  C:\Windows\System\RauTGdF.exe
  2⤵
  PID:13552
- C:\Windows\System\VJiuwmi.exe
  C:\Windows\System\VJiuwmi.exe
  2⤵
  PID:13604
- C:\Windows\System\GsSuhAw.exe
  C:\Windows\System\GsSuhAw.exe
  2⤵
  PID:13632
- C:\Windows\System\ByRIUui.exe
  C:\Windows\System\ByRIUui.exe
  2⤵
  PID:13648
- C:\Windows\System\jntzmdx.exe
  C:\Windows\System\jntzmdx.exe
  2⤵
  PID:13664
- C:\Windows\System\ORqjghd.exe
  C:\Windows\System\ORqjghd.exe
  2⤵
  PID:13704
- C:\Windows\System\LWjLcCM.exe
  C:\Windows\System\LWjLcCM.exe
  2⤵
  PID:13740
- C:\Windows\System\RpNfDbh.exe
  C:\Windows\System\RpNfDbh.exe
  2⤵
  PID:13764
- C:\Windows\System\PFBSZBP.exe
  C:\Windows\System\PFBSZBP.exe
  2⤵
  PID:13788
- C:\Windows\System\oSzWoqF.exe
  C:\Windows\System\oSzWoqF.exe
  2⤵
  PID:13808
- C:\Windows\System\KGidCgT.exe
  C:\Windows\System\KGidCgT.exe
  2⤵
  PID:13824
- C:\Windows\System\aVvUglh.exe
  C:\Windows\System\aVvUglh.exe
  2⤵
  PID:13848
- C:\Windows\System\kQEEaZP.exe
  C:\Windows\System\kQEEaZP.exe
  2⤵
  PID:13876
- C:\Windows\System\UqTvMTn.exe
  C:\Windows\System\UqTvMTn.exe
  2⤵
  PID:13944
- C:\Windows\System\KzcGptx.exe
  C:\Windows\System\KzcGptx.exe
  2⤵
  PID:13972
- C:\Windows\System\CYHVBJC.exe
  C:\Windows\System\CYHVBJC.exe
  2⤵
  PID:14000
- C:\Windows\System\JHcykBU.exe
  C:\Windows\System\JHcykBU.exe
  2⤵
  PID:14016
- C:\Windows\System\ihwTJoG.exe
  C:\Windows\System\ihwTJoG.exe
  2⤵
  PID:14044
- C:\Windows\System\KgwVjro.exe
  C:\Windows\System\KgwVjro.exe
  2⤵
  PID:14060
- C:\Windows\System\HcaZimN.exe
  C:\Windows\System\HcaZimN.exe
  2⤵
  PID:14104
- C:\Windows\System\ernicDb.exe
  C:\Windows\System\ernicDb.exe
  2⤵
  PID:14128
- C:\Windows\System\WQKoSin.exe
  C:\Windows\System\WQKoSin.exe
  2⤵
  PID:14156
- C:\Windows\System\BIuSXsR.exe
  C:\Windows\System\BIuSXsR.exe
  2⤵
  PID:14176
- C:\Windows\System\KjGrdbH.exe
  C:\Windows\System\KjGrdbH.exe
  2⤵
  PID:14196
- C:\Windows\System\hjsPknO.exe
  C:\Windows\System\hjsPknO.exe
  2⤵
  PID:14228
- C:\Windows\System\TalekRj.exe
  C:\Windows\System\TalekRj.exe
  2⤵
  PID:14280
- C:\Windows\System\EPSJsdf.exe
  C:\Windows\System\EPSJsdf.exe
  2⤵
  PID:14296
- C:\Windows\System\fbTgkbr.exe
  C:\Windows\System\fbTgkbr.exe
  2⤵
  PID:14324
- C:\Windows\System\GwpLPZM.exe
  C:\Windows\System\GwpLPZM.exe
  2⤵
  PID:12740
- C:\Windows\System\OdYNiBo.exe
  C:\Windows\System\OdYNiBo.exe
  2⤵
  PID:12952
- C:\Windows\System\xmTEfbZ.exe
  C:\Windows\System\xmTEfbZ.exe
  2⤵
  PID:13344
- C:\Windows\System\IDeQvXh.exe
  C:\Windows\System\IDeQvXh.exe
  2⤵
  PID:13404
- C:\Windows\System\JDuVMZX.exe
  C:\Windows\System\JDuVMZX.exe
  2⤵
  PID:13516
- C:\Windows\System\bPqQFFD.exe
  C:\Windows\System\bPqQFFD.exe
  2⤵
  PID:13548
- C:\Windows\System\QqQFVGo.exe
  C:\Windows\System\QqQFVGo.exe
  2⤵
  PID:13644
- C:\Windows\System\tTkflqi.exe
  C:\Windows\System\tTkflqi.exe
  2⤵
  PID:13724
- C:\Windows\System\fBAejma.exe
  C:\Windows\System\fBAejma.exe
  2⤵
  PID:13784
- C:\Windows\System\halbczw.exe
  C:\Windows\System\halbczw.exe
  2⤵
  PID:13832
- C:\Windows\System\udorOqu.exe
  C:\Windows\System\udorOqu.exe
  2⤵
  PID:13864
- C:\Windows\System\NnGNECE.exe
  C:\Windows\System\NnGNECE.exe
  2⤵
  PID:13936
- C:\Windows\System\ZeECqUO.exe
  C:\Windows\System\ZeECqUO.exe
  2⤵
  PID:13988
- C:\Windows\System\SqfjBAW.exe
  C:\Windows\System\SqfjBAW.exe
  2⤵
  PID:14080
- C:\Windows\System\otFNbeF.exe
  C:\Windows\System\otFNbeF.exe
  2⤵
  PID:14124
- C:\Windows\System\SVXDGRW.exe
  C:\Windows\System\SVXDGRW.exe
  2⤵
  PID:14164
- C:\Windows\System\YESEbKi.exe
  C:\Windows\System\YESEbKi.exe
  2⤵
  PID:14252
- C:\Windows\System\VfdvGAt.exe
  C:\Windows\System\VfdvGAt.exe
  2⤵
  PID:14312
- C:\Windows\System\GkxEaoc.exe
  C:\Windows\System\GkxEaoc.exe
  2⤵
  PID:13328
- C:\Windows\System\tlvoFiG.exe
  C:\Windows\System\tlvoFiG.exe
  2⤵
  PID:13488
- C:\Windows\System\hsDxvcw.exe
  C:\Windows\System\hsDxvcw.exe
  2⤵
  PID:13536
- C:\Windows\System\kvRRvfz.exe
  C:\Windows\System\kvRRvfz.exe
  2⤵
  PID:13712
- C:\Windows\System\uQpxXxZ.exe
  C:\Windows\System\uQpxXxZ.exe
  2⤵
  PID:13756
- C:\Windows\System\AAvowjh.exe
  C:\Windows\System\AAvowjh.exe
  2⤵
  PID:13872
- C:\Windows\System\ratFPkt.exe
  C:\Windows\System\ratFPkt.exe
  2⤵
  PID:13960
- C:\Windows\System\FZAIyKn.exe
  C:\Windows\System\FZAIyKn.exe
  2⤵
  PID:14092
- C:\Windows\System\lMaBiTJ.exe
  C:\Windows\System\lMaBiTJ.exe
  2⤵
  PID:14292
- C:\Windows\System\btzeQYt.exe
  C:\Windows\System\btzeQYt.exe
  2⤵
  PID:13572
- C:\Windows\System\DuuewUm.exe
  C:\Windows\System\DuuewUm.exe
  2⤵
  PID:1348
- C:\Windows\System\EUesYVv.exe
  C:\Windows\System\EUesYVv.exe
  2⤵
  PID:14356
- C:\Windows\System\PeaITjQ.exe
  C:\Windows\System\PeaITjQ.exe
  2⤵
  PID:14380
- C:\Windows\System\OtYpKsC.exe
  C:\Windows\System\OtYpKsC.exe
  2⤵
  PID:14408
- C:\Windows\System\qbqNOBJ.exe
  C:\Windows\System\qbqNOBJ.exe
  2⤵
  PID:14440
- C:\Windows\System\zsehpgB.exe
  C:\Windows\System\zsehpgB.exe
  2⤵
  PID:14468
- C:\Windows\System\PpwkBsV.exe
  C:\Windows\System\PpwkBsV.exe
  2⤵
  PID:14492
- C:\Windows\System\dmDWaJA.exe
  C:\Windows\System\dmDWaJA.exe
  2⤵
  PID:14520
- C:\Windows\System\rmcUimU.exe
  C:\Windows\System\rmcUimU.exe
  2⤵
  PID:14548
- C:\Windows\System\PNUpKWS.exe
  C:\Windows\System\PNUpKWS.exe
  2⤵
  PID:14572
- C:\Windows\System\bMIQUZj.exe
  C:\Windows\System\bMIQUZj.exe
  2⤵
  PID:14608
- C:\Windows\System\oVokUBE.exe
  C:\Windows\System\oVokUBE.exe
  2⤵
  PID:14668
- C:\Windows\System\ErkfzWI.exe
  C:\Windows\System\ErkfzWI.exe
  2⤵
  PID:14696
- C:\Windows\System\pFxWOpH.exe
  C:\Windows\System\pFxWOpH.exe
  2⤵
  PID:14716
- C:\Windows\System\RiHjTXY.exe
  C:\Windows\System\RiHjTXY.exe
  2⤵
  PID:14756
- C:\Windows\System\FypvGji.exe
  C:\Windows\System\FypvGji.exe
  2⤵
  PID:14776
- C:\Windows\System\oJgaBlW.exe
  C:\Windows\System\oJgaBlW.exe
  2⤵
  PID:14800
- C:\Windows\System\maMiTtn.exe
  C:\Windows\System\maMiTtn.exe
  2⤵
  PID:14836
- C:\Windows\System\JDLrzdX.exe
  C:\Windows\System\JDLrzdX.exe
  2⤵
  PID:14856
- C:\Windows\System\wimjkEt.exe
  C:\Windows\System\wimjkEt.exe
  2⤵
  PID:14872
- C:\Windows\System\azTgksp.exe
  C:\Windows\System\azTgksp.exe
  2⤵
  PID:14900
- C:\Windows\System\qQGllsD.exe
  C:\Windows\System\qQGllsD.exe
  2⤵
  PID:14960
- C:\Windows\System\OTjivsL.exe
  C:\Windows\System\OTjivsL.exe
  2⤵
  PID:14992
- C:\Windows\System\BDgmvuO.exe
  C:\Windows\System\BDgmvuO.exe
  2⤵
  PID:15008
- C:\Windows\System\JeSTnLd.exe
  C:\Windows\System\JeSTnLd.exe
  2⤵
  PID:15088
- C:\Windows\System\WtbXlvY.exe
  C:\Windows\System\WtbXlvY.exe
  2⤵
  PID:15104
- C:\Windows\System\vcVtTKy.exe
  C:\Windows\System\vcVtTKy.exe
  2⤵
  PID:15128
- C:\Windows\System\plIxbVq.exe
  C:\Windows\System\plIxbVq.exe
  2⤵
  PID:15148
- C:\Windows\System\gylLydq.exe
  C:\Windows\System\gylLydq.exe
  2⤵
  PID:15164
- C:\Windows\System\uVYtRhN.exe
  C:\Windows\System\uVYtRhN.exe
  2⤵
  PID:15180
- C:\Windows\System\fEuTnti.exe
  C:\Windows\System\fEuTnti.exe
  2⤵
  PID:15196
- C:\Windows\System\OpSaJDt.exe
  C:\Windows\System\OpSaJDt.exe
  2⤵
  PID:15228
- C:\Windows\System\EsoypvS.exe
  C:\Windows\System\EsoypvS.exe
  2⤵
  PID:15248
- C:\Windows\System\GACLEWd.exe
  C:\Windows\System\GACLEWd.exe
  2⤵
  PID:15276
- C:\Windows\System\DzmeCNC.exe
  C:\Windows\System\DzmeCNC.exe
  2⤵
  PID:15296
- C:\Windows\System\ePScVED.exe
  C:\Windows\System\ePScVED.exe
  2⤵
  PID:12784
- C:\Windows\System\YYOPQcU.exe
  C:\Windows\System\YYOPQcU.exe
  2⤵
  PID:13912
- C:\Windows\System\LqhVWkn.exe
  C:\Windows\System\LqhVWkn.exe
  2⤵
  PID:14424
- C:\Windows\System\jJzbOEg.exe
  C:\Windows\System\jJzbOEg.exe
  2⤵
  PID:14460
- C:\Windows\System\lArtsFj.exe
  C:\Windows\System\lArtsFj.exe
  2⤵
  PID:14568
- C:\Windows\System\gWfxvhI.exe
  C:\Windows\System\gWfxvhI.exe
  2⤵
  PID:14488
- C:\Windows\System\yoXwiAQ.exe
  C:\Windows\System\yoXwiAQ.exe
  2⤵
  PID:14540
- C:\Windows\System\NvIcWJu.exe
  C:\Windows\System\NvIcWJu.exe
  2⤵
  PID:14736
- C:\Windows\System\JArRTnl.exe
  C:\Windows\System\JArRTnl.exe
  2⤵
  PID:14768
- C:\Windows\System\rVoWMcf.exe
  C:\Windows\System\rVoWMcf.exe
  2⤵
  PID:14844
- C:\Windows\System\eWUoyHT.exe
  C:\Windows\System\eWUoyHT.exe
  2⤵
  PID:14888
- C:\Windows\System\yFVDUwq.exe
  C:\Windows\System\yFVDUwq.exe
  2⤵
  PID:14984
- C:\Windows\System\hkAOTIk.exe
  C:\Windows\System\hkAOTIk.exe
  2⤵
  PID:15004
- C:\Windows\System\CjuinGo.exe
  C:\Windows\System\CjuinGo.exe
  2⤵
  PID:15116
- C:\Windows\System\EiajPFq.exe
  C:\Windows\System\EiajPFq.exe
  2⤵
  PID:15220
- C:\Windows\System\tAvevqe.exe
  C:\Windows\System\tAvevqe.exe
  2⤵
  PID:15284
- C:\Windows\System\zhXXusA.exe
  C:\Windows\System\zhXXusA.exe
  2⤵
  PID:15340
- C:\Windows\System\DUsSSTA.exe
  C:\Windows\System\DUsSSTA.exe
  2⤵
  PID:14348
- C:\Windows\System\aFybESI.exe
  C:\Windows\System\aFybESI.exe
  2⤵
  PID:14448
- C:\Windows\System\XRnqtda.exe
  C:\Windows\System\XRnqtda.exe
  2⤵
  PID:14400
- C:\Windows\System\RqlAibH.exe
  C:\Windows\System\RqlAibH.exe
  2⤵
  PID:14764
- C:\Windows\System\WZZNINO.exe
  C:\Windows\System\WZZNINO.exe
  2⤵
  PID:14656
- C:\Windows\System\hdbjBso.exe
  C:\Windows\System\hdbjBso.exe
  2⤵
  PID:15056
- C:\Windows\System\foDSHCe.exe
  C:\Windows\System\foDSHCe.exe
  2⤵
  PID:15176
- C:\Windows\System\HSVfeAr.exe
  C:\Windows\System\HSVfeAr.exe
  2⤵
  PID:15320
- C:\Windows\System\ksZKlrO.exe
  C:\Windows\System\ksZKlrO.exe
  2⤵
  PID:14692
- C:\Windows\System\SNiEgRN.exe
  C:\Windows\System\SNiEgRN.exe
  2⤵
  PID:15100
- C:\Windows\System\aTPqFGd.exe
  C:\Windows\System\aTPqFGd.exe
  2⤵
  PID:14596
- C:\Windows\System\jvKbYKi.exe
  C:\Windows\System\jvKbYKi.exe
  2⤵
  PID:14620
- C:\Windows\System\lLwuvtC.exe
  C:\Windows\System\lLwuvtC.exe
  2⤵
  PID:15380
- C:\Windows\System\KKFhnPD.exe
  C:\Windows\System\KKFhnPD.exe
  2⤵
  PID:15404
- C:\Windows\System\XuqrznF.exe
  C:\Windows\System\XuqrznF.exe
  2⤵
  PID:15428
- C:\Windows\System\TAglLpN.exe
  C:\Windows\System\TAglLpN.exe
  2⤵
  PID:15448
- C:\Windows\System\wFjsZvi.exe
  C:\Windows\System\wFjsZvi.exe
  2⤵
  PID:15480
- C:\Windows\System\sKZyWwi.exe
  C:\Windows\System\sKZyWwi.exe
  2⤵
  PID:15504
- C:\Windows\System\pCbMTwx.exe
  C:\Windows\System\pCbMTwx.exe
  2⤵
  PID:15532
- C:\Windows\System\AKmDNDD.exe
  C:\Windows\System\AKmDNDD.exe
  2⤵
  PID:15568
- C:\Windows\System\cElvbeC.exe
  C:\Windows\System\cElvbeC.exe
  2⤵
  PID:15592
- C:\Windows\System\bUgzEMz.exe
  C:\Windows\System\bUgzEMz.exe
  2⤵
  PID:15616
- C:\Windows\System\wVCpSVc.exe
  C:\Windows\System\wVCpSVc.exe
  2⤵
  PID:15640
- C:\Windows\System\MvvxcYD.exe
  C:\Windows\System\MvvxcYD.exe
  2⤵
  PID:15660
- C:\Windows\System\nyJIUMv.exe
  C:\Windows\System\nyJIUMv.exe
  2⤵
  PID:15676
- C:\Windows\System\kfkGPkT.exe
  C:\Windows\System\kfkGPkT.exe
  2⤵
  PID:15700
- C:\Windows\System\UiKbtdu.exe
  C:\Windows\System\UiKbtdu.exe
  2⤵
  PID:15720
- C:\Windows\System\YvOASLm.exe
  C:\Windows\System\YvOASLm.exe
  2⤵
  PID:15744
- C:\Windows\System\uqMrznA.exe
  C:\Windows\System\uqMrznA.exe
  2⤵
  PID:15764
- C:\Windows\System\uxsCFKm.exe
  C:\Windows\System\uxsCFKm.exe
  2⤵
  PID:15780
- C:\Windows\System\jAobmRh.exe
  C:\Windows\System\jAobmRh.exe
  2⤵
  PID:15804
- C:\Windows\System\MeDaENW.exe
  C:\Windows\System\MeDaENW.exe
  2⤵
  PID:15820
- C:\Windows\System\ZNoRFEP.exe
  C:\Windows\System\ZNoRFEP.exe
  2⤵
  PID:15840
- C:\Windows\System\PvFaAHt.exe
  C:\Windows\System\PvFaAHt.exe
  2⤵
  PID:15864
- C:\Windows\System\UuMDVQt.exe
  C:\Windows\System\UuMDVQt.exe
  2⤵
  PID:15884
- C:\Windows\System\bLxFaXJ.exe
  C:\Windows\System\bLxFaXJ.exe
  2⤵
  PID:15900
- C:\Windows\System\cGFnCvB.exe
  C:\Windows\System\cGFnCvB.exe
  2⤵
  PID:15916
- C:\Windows\System\PzjwhTG.exe
  C:\Windows\System\PzjwhTG.exe
  2⤵
  PID:15932
- C:\Windows\System\TgZenJe.exe
  C:\Windows\System\TgZenJe.exe
  2⤵
  PID:15948
- C:\Windows\System\ROFajdd.exe
  C:\Windows\System\ROFajdd.exe
  2⤵
  PID:15968
- C:\Windows\System\oESRIhK.exe
  C:\Windows\System\oESRIhK.exe
  2⤵
  PID:15984
- C:\Windows\System\BXrIizl.exe
  C:\Windows\System\BXrIizl.exe
  2⤵
  PID:16008
- C:\Windows\System\izhkmEs.exe
  C:\Windows\System\izhkmEs.exe
  2⤵
  PID:16024
- C:\Windows\System\WMvwWmx.exe
  C:\Windows\System\WMvwWmx.exe
  2⤵
  PID:16048
- C:\Windows\System\qHLPVRx.exe
  C:\Windows\System\qHLPVRx.exe
  2⤵
  PID:16064
- C:\Windows\System\imCTLEo.exe
  C:\Windows\System\imCTLEo.exe
  2⤵
  PID:16080
- C:\Windows\System\VpmgdcQ.exe
  C:\Windows\System\VpmgdcQ.exe
  2⤵
  PID:16108
- C:\Windows\System\OeHYmpg.exe
  C:\Windows\System\OeHYmpg.exe
  2⤵
  PID:16124
- C:\Windows\System\fAazqpW.exe
  C:\Windows\System\fAazqpW.exe
  2⤵
  PID:16148
- C:\Windows\System\rRjIoBA.exe
  C:\Windows\System\rRjIoBA.exe
  2⤵
  PID:16164
- C:\Windows\System\eAZxOvj.exe
  C:\Windows\System\eAZxOvj.exe
  2⤵
  PID:16180
- C:\Windows\System\SKWhBjL.exe
  C:\Windows\System\SKWhBjL.exe
  2⤵
  PID:16200
- C:\Windows\System\ruhvnRf.exe
  C:\Windows\System\ruhvnRf.exe
  2⤵
  PID:16224
- C:\Windows\System\zdPZNMt.exe
  C:\Windows\System\zdPZNMt.exe
  2⤵
  PID:16248
- C:\Windows\System\WtFecTv.exe
  C:\Windows\System\WtFecTv.exe
  2⤵
  PID:16264
- C:\Windows\System\iMQItdg.exe
  C:\Windows\System\iMQItdg.exe
  2⤵
  PID:16292
- C:\Windows\System\pzjLJah.exe
  C:\Windows\System\pzjLJah.exe
  2⤵
  PID:16316
- C:\Windows\System\rioQdlZ.exe
  C:\Windows\System\rioQdlZ.exe
  2⤵
  PID:16340
- C:\Windows\System\QlpbiaG.exe
  C:\Windows\System\QlpbiaG.exe
  2⤵
  PID:16364
- C:\Windows\System\YufpUMH.exe
  C:\Windows\System\YufpUMH.exe
  2⤵
  PID:14352
- C:\Windows\System\vYglJuW.exe
  C:\Windows\System\vYglJuW.exe
  2⤵
  PID:15440
- C:\Windows\System\ndjalqj.exe
  C:\Windows\System\ndjalqj.exe
  2⤵
  PID:15416
- C:\Windows\System\RooFJSa.exe
  C:\Windows\System\RooFJSa.exe
  2⤵
  PID:15496
- C:\Windows\System\FxiONZr.exe
  C:\Windows\System\FxiONZr.exe
  2⤵
  PID:15604
- C:\Windows\System\IoIgyea.exe
  C:\Windows\System\IoIgyea.exe
  2⤵
  PID:15776
- C:\Windows\System\UVMJkTa.exe
  C:\Windows\System\UVMJkTa.exe
  2⤵
  PID:15652
- C:\Windows\System\aWswhwV.exe
  C:\Windows\System\aWswhwV.exe
  2⤵
  PID:15924
- C:\Windows\System\yheaIDL.exe
  C:\Windows\System\yheaIDL.exe
  2⤵
  PID:15852
- C:\Windows\System\mwRUuWn.exe
  C:\Windows\System\mwRUuWn.exe
  2⤵
  PID:15856
- C:\Windows\System\XhPaKuP.exe
  C:\Windows\System\XhPaKuP.exe
  2⤵
  PID:15876
- C:\Windows\System\qljlIWd.exe
  C:\Windows\System\qljlIWd.exe
  2⤵
  PID:16020
- C:\Windows\System\HANSkuS.exe
  C:\Windows\System\HANSkuS.exe
  2⤵
  PID:15928
- C:\Windows\System\vurkqHV.exe
  C:\Windows\System\vurkqHV.exe
  2⤵
  PID:15976
- C:\Windows\System\TxpifKL.exe
  C:\Windows\System\TxpifKL.exe
  2⤵
  PID:16192
- C:\Windows\System\MWjkIBd.exe
  C:\Windows\System\MWjkIBd.exe
  2⤵
  PID:16356
- C:\Windows\System\fjFZynF.exe
  C:\Windows\System\fjFZynF.exe
  2⤵
  PID:16116
- C:\Windows\System\rGSgzZs.exe
  C:\Windows\System\rGSgzZs.exe
  2⤵
  PID:15412
- C:\Windows\System\OUGSCFs.exe
  C:\Windows\System\OUGSCFs.exe
  2⤵
  PID:16216
- C:\Windows\System\burIxhU.exe
  C:\Windows\System\burIxhU.exe
  2⤵
  PID:16260
- C:\Windows\System\qbiyfTs.exe
  C:\Windows\System\qbiyfTs.exe
  2⤵
  PID:16288
- C:\Windows\System\YeXqVWL.exe
  C:\Windows\System\YeXqVWL.exe
  2⤵
  PID:16396
- C:\Windows\System\saxaxzv.exe
  C:\Windows\System\saxaxzv.exe
  2⤵
  PID:16412
- C:\Windows\System\BTMBshQ.exe
  C:\Windows\System\BTMBshQ.exe
  2⤵
  PID:16432
- C:\Windows\System\qLdpGtV.exe
  C:\Windows\System\qLdpGtV.exe
  2⤵
  PID:16456
- C:\Windows\System\gjoAuhz.exe
  C:\Windows\System\gjoAuhz.exe
  2⤵
  PID:16488
- C:\Windows\System\ZHryibV.exe
  C:\Windows\System\ZHryibV.exe
  2⤵
  PID:16516
- C:\Windows\System\VbODpVs.exe
  C:\Windows\System\VbODpVs.exe
  2⤵
  PID:16532
- C:\Windows\System\eNgeQdT.exe
  C:\Windows\System\eNgeQdT.exe
  2⤵
  PID:16568
- C:\Windows\System\cktIADg.exe
  C:\Windows\System\cktIADg.exe
  2⤵
  PID:16600
- C:\Windows\System\fyhtEma.exe
  C:\Windows\System\fyhtEma.exe
  2⤵
  PID:16624
- C:\Windows\System\IxLbHnU.exe
  C:\Windows\System\IxLbHnU.exe
  2⤵
  PID:16644
- C:\Windows\System\zivADpI.exe
  C:\Windows\System\zivADpI.exe
  2⤵
  PID:16680
- C:\Windows\System\eAkXqFN.exe
  C:\Windows\System\eAkXqFN.exe
  2⤵
  PID:16700
- C:\Windows\System\pyKexKX.exe
  C:\Windows\System\pyKexKX.exe
  2⤵
  PID:16888
- C:\Windows\System\flBdIpY.exe
  C:\Windows\System\flBdIpY.exe
  2⤵
  PID:16924
- C:\Windows\System\cbzKzkP.exe
  C:\Windows\System\cbzKzkP.exe
  2⤵
  PID:17132
- C:\Windows\System\ylfjmHX.exe
  C:\Windows\System\ylfjmHX.exe
  2⤵
  PID:17156
- C:\Windows\System\zyjPEeE.exe
  C:\Windows\System\zyjPEeE.exe
  2⤵
  PID:17176
- C:\Windows\System\HsVpRDo.exe
  C:\Windows\System\HsVpRDo.exe
  2⤵
  PID:17208

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CobrVyE.exe

Filesize
1.1MB

MD5
29f73248833dabc81e22ef84806e170a

SHA1
a071d7e11c6ae4e9b54a0ea83ded43a5efc8f7b2

SHA256
1a4512a1da176f522ea10d2c281a07e850cc3568a770c6129ea4a617c4b06e99

SHA512
04d051bfc45ada34e6d1054188cf613b6379e3a341ac1e8947cc0e49ffab4ecb8e56b2f0728c91323e1077978d0adb4c4b8a55f6b84a51f0c5c62e616de57073

Download Submit
C:\Windows\System\CpSZpxh.exe

Filesize
1.1MB

MD5
19a8d9b4cf93d18bbe68bcc7a89f1ef6

SHA1
8a40ef4d90798301ba2024c0b7e9ee193e0e4ade

SHA256
ff1250951152cc1163b3a1072a884cf78bd3c5c087580f5bf9421078c51afbd7

SHA512
485175e22f01c7094c14c66d92443aabeec2172dc27d78d9745e5b88ef4be7648fdb8dc6a731751d26a204b69ccd544024d582b847f3808698d5cb5491b84f80

Download Submit
C:\Windows\System\DeqhubE.exe

Filesize
1.1MB

MD5
ea9fe753f33d22585be4a412c1100492

SHA1
4e6e277e095d598a1c3902cf68a7100e899a3d8a

SHA256
7fe9b42dfbe2abb5ff67f1cc77dc5bf6d2a895f43e3a38fa0688aa3617d3c6b9

SHA512
295509d4d20a4b6a0860cebf1830ba0712971509900203ed164d79475a2f97a9918d605c4915a4a8fd97b53e0c1deab99063fdc7118823ce98d7955a4fe98b16

Download Submit
C:\Windows\System\EOffEhw.exe

Filesize
1.1MB

MD5
3680df93ae1c4f936f17027b927d65ca

SHA1
b4b0acd3e22699f6fbc5eaff1750e32fc0e55414

SHA256
2ce719e3bcbb5de8535206d89d5a8e47dd1e0b816bf8c0f21e6f0985dca48bc3

SHA512
0fd898808ad78e01eded0ab6e176ebbf272f54572fae63b9a842a9542c8b6f9720326e4ee15c02837a2d0ee390b6ed5ff922e55a5e35a468b7fac0c82acde17b

Download Submit
C:\Windows\System\GktWYoF.exe

Filesize
1.1MB

MD5
b693fd7e0f22f23224c0a3ebc40c1bc7

SHA1
e6a1a5c550ef67b8fbdd9562c55ba6c6894fa2c7

SHA256
8fb17f1c949121f24c07a43674207fb93492156eda832e36f30ba2c86b893fda

SHA512
a8a85627a8a52ffa2649703528e973a0ec378b6c1a1a9f3b7322f23bb8daa58859cb7cc337cb864bd1ce8eba60291daa00e5511e8b0b824c06b793fb027ac414

Download Submit
C:\Windows\System\GvyeMYa.exe

Filesize
1.1MB

MD5
d96b744ee6f52d27252508f9a2724a85

SHA1
d531f84fe33da68a2c02e34086a13d6c16f55034

SHA256
2cf3d750cbe12f85dd707258754ea69ecbbd0b2a2fbadbcdd79dc1afd3f2b3bc

SHA512
c9811820e21e60623d423218ac996cad3bb530d5f1decdc5488775362093e56fd6bd240ed7337d4aa6f3014130b88dc8541ce91fedc1b23e0c22fd74a0e39cf5

Download Submit
C:\Windows\System\GwLHGAl.exe

Filesize
1.1MB

MD5
ebf4bde93cf6abb3607d240c118b3cf6

SHA1
06b722a42d41eeb56800e5b720f1c23ce7e08e23

SHA256
2e46009893bf4fe35f5508cd5ee462e5a9e68ce49d3124c4ba4aeae7c75fd900

SHA512
0cca78e6b5a7aeaf8d3b9f5bc9a4ec4145db954475935719106c247907dea480e21b6aa56bb7fdd1398e73e4b1430ad4386a9cb3c2a46d850fa88f6c7b486183

Download Submit
C:\Windows\System\HSJpYtN.exe

Filesize
1.1MB

MD5
e5ac55bcac8059c5baa384a3e42a3b4a

SHA1
d7e48bbc15c5e2f889353033471568f92ba06593

SHA256
d01ff93302b9c7b40d83d575504e5d99c60a966c3f766436770d57cd9fd29478

SHA512
61a3e10c20d4e323ad8fbe4f42f8b12ce9b10e4c7c6e76a71ebb9a14661e423428963bbd83d6930643be9815fed33cbffab5118672c38a6355c00199ab58e213

Download Submit
C:\Windows\System\HhkilXz.exe

Filesize
1.1MB

MD5
b067e9f7b0e6f1d8a0027aef6feec204

SHA1
9f4c55e80500eb9b7f76c816bd6e577c2a4ce842

SHA256
cdb5f772f186fd3206b877afbd9b05d34d86b734b6b855ceea636146e0fb769e

SHA512
0b581a46fa109869bb4401aa31faaff9cd2fbb21e84b798a1076e954516302322d4ee60caf844a1bb1432e5a383841cd6ffdca502ae35ed4ba3d6ded2784ddb6

Download Submit
C:\Windows\System\JAruudW.exe

Filesize
1.1MB

MD5
47905740b96a734763706270906ca9d7

SHA1
228c6bcd9122f524913414fe1d976fb2e067af2d

SHA256
c8088eaa9e93655732c07a3fa130bad1d354b3ed83186b2cb2a29970b7bc8611

SHA512
deb8a3dccd51a7b0c2ec08ddc879a06bbbc43ff596dc14f1d33c19c145e52c44a6e83a25ce3e486f36fd20fb19b011ddb431d7f6a55a244728a17375f3915829

Download Submit
C:\Windows\System\KgYARFz.exe

Filesize
1.1MB

MD5
680ac79c668318ad9dbadd0e91689d35

SHA1
8203f5da5424c63eb52bd45e1062cba9ae2a6c74

SHA256
5eef418cae3adc7b4c29b7ece786e908016f87a322d5211c528a74ab6f56ebdc

SHA512
8c297904e238aa27cff4775d3a0bbf7bc99d605c498063769b259f7eb9596b3f04f0022c2c049760b1c0a49cd4371e5a3d020ee5f13a03b403b63a661ff7a0f5

Download Submit
C:\Windows\System\MBNzWIV.exe

Filesize
1.1MB

MD5
a3cf550c041ec6f1d847b884d78771c3

SHA1
20c2ab41df15d470a665e89c2344b8c48ab88d27

SHA256
0ca6eb6b6bb2df9902c4c61dfaa561ecc3df166b250a8d254e4224db5dc86a03

SHA512
4775f292a4d35083027ff3f3c6eb84d5fd05e5d4570cb9883b8cba71ed1c0d0610a821a59f564e443a3a75db8101a4ca9ffd4d1d920a196823d7c06cf3a20f44

Download Submit
C:\Windows\System\OVapAVO.exe

Filesize
1.1MB

MD5
a587a4513ebb774c441d9ae8b7e43ec9

SHA1
211de1700161ea802014f7ec484f1bc516405788

SHA256
400aef05562fff9bf56dd3c363d10612b201be174250013614958bc7c1221596

SHA512
20810793e41b99e7c2ae10a7028e775c7b7fe526363366a8aae21d190726eb88104c1faf21ee639b964d8b7f4fabc16258f92c5e81710b317b773932340fc742

Download Submit
C:\Windows\System\PDXgYbQ.exe

Filesize
1.1MB

MD5
51660311c4fd1ef673ae7f7839690401

SHA1
1a032cf398ce70fe85361d11b805b0bd7096199c

SHA256
8379cd8d1b0596c409de6b1f9c27a11e569f85ab6e5d1738d7198a2f957cb9f6

SHA512
81b6251c7e0f2d8ff3e1907e9b2434ad534fdb37a333688d59e749d2dd79cd6ef792ea5aeafdef5eeb186fb2e94214f244f6de0ea5827bb2c0b254acf34ea2c7

Download Submit
C:\Windows\System\SPtgikD.exe

Filesize
1.1MB

MD5
7cca68fed2c27d92f4aa34c26468206a

SHA1
5c6c22ddd8a58aad4cb3e6aea3886055791e4711

SHA256
10f973b544b2144495edc23d9c463600ec7f9c6216e3b3e043682787c44c7d3b

SHA512
cc23d8e6c685d2e6ca9b57d822888614776188c42635a900e30fc2104cc41e9044e694ac933b879f7f3728ffd6ac77a2ea2dbd1f6ae1b10ef6ada84d7c702344

Download Submit
C:\Windows\System\UGexjnp.exe

Filesize
1.1MB

MD5
ca7c0e7fd20c7b1e7ddd70904ee54dcd

SHA1
6ad69943cc68fb0515d22bf56db80e465bb74524

SHA256
6b06ddfe932df4bfaab0235b459999a55edc6f4eba7d480187636531d340ea60

SHA512
72ed60cadd28c184e53ff73407c70cf622bca9400a7b69a5c0c7dc64fb3ee8149df8c96ab9912f69a026f218ed2cc019bc42012378af88ee041e3a29d476d8f3

Download Submit
C:\Windows\System\UTROnTT.exe

Filesize
1.1MB

MD5
8291e488c4529109b45c6c15541ff85b

SHA1
5de3bc1fb1ce9f9657364a74c9647abdfc72117b

SHA256
6bf9e426411f67b4e87adbaf8dd962cbba4554e8f752b68f47594b9e6fd76d21

SHA512
ba836539a800fe804339c5ac66f721b59f86650de7a185dd85be5eb1794bd4b1c4912748da2c77eff89b9c7c327860414bbd43a091329dc2a4986a715b887801

Download Submit
C:\Windows\System\YdHdajO.exe

Filesize
1.1MB

MD5
daf3beb7060014b5a37ab1cfaf634336

SHA1
d151869659c6f7dab14cf89afa4cad6661e02e06

SHA256
16fd7a4548d93f518106359a237edb009fd9e00bbec507e144654e57c12b848f

SHA512
e14dc058dc00e666ab3a74785433a0471fc4b80f08a3f8247d33d185113f567e956f128c1dab4e2897dcdc6ae9f41b56145a1fa709c53589bd28a4fd86e3c1fd

Download Submit
C:\Windows\System\ahsnHjV.exe

Filesize
1.1MB

MD5
a221299fe2ec88724a431b6bae7b609c

SHA1
f927059b73a884ee461900a051a8d0a83c01ef74

SHA256
6b0d941112a99a14ba7599736c419a3dff800ddbeb85057fef8dfd88956d4d28

SHA512
45626f8eeded5221b7049958e95c0fe3c08b6d56aa6b6fadd3748c60b09ceef6ef704c0cb0b677e7948f9e89d23a80fc19b114877cb865da36117fd98cead34f

Download Submit
C:\Windows\System\bKvhWQF.exe

Filesize
1.1MB

MD5
76ac17e06dabc809f10d14aff50fb402

SHA1
fcf971c5287c8be8d1145929ce4972b71f097ab8

SHA256
dd6e5942ceca7a4288c49d2afc2016155cd1e8ea3a7b6b8e8f5c09dbecd54a70

SHA512
084edfdc389340fead05455cbe9900181e9c1c3b7c23f3f1d8c650a68f813c877e0eb95e5866c9434695349a84ef28dacefbf37b6f9740b3594081ea1b054c20

Download Submit
C:\Windows\System\fHylmHG.exe

Filesize
1.1MB

MD5
32f620757777921aacbdd55a0f162d1f

SHA1
a897a25dd72102dd56df2874996bdddbc5b6c1af

SHA256
f3f8811c0e68538cd63d3be6901b8c12485afbd2106c4f253d104ac58fd210e7

SHA512
cc3d83fb29141a3ef54a018bc0db0c4cd6fb54c2ff5d1f7224033485217f355cb64893615e4b896b0628d058af80e1ad3b5281bab27d69099a640eeaf5dde12a

Download Submit
C:\Windows\System\fIASwCw.exe

Filesize
1.1MB

MD5
16fe00ae4624cd0ece66f3f626d11128

SHA1
a19cf5aeee82d44914d97b3cb9bfb7e0ba7a4f4a

SHA256
7a0467aae9ce685b4e1781ccdd0e86e31dbf8a92907666eb9e1ced359c635351

SHA512
4c13bdcb7d09892da2b1047cf809a8de4f62eaba8befd5b56022888a85001985f976bc433ddf638a578bd76b2f0a3ec6b00f7f9ff20eb786a1b6a5d55b478a63

Download Submit
C:\Windows\System\fswWIpn.exe

Filesize
1.1MB

MD5
8f1f4af59f88fc3e15da8852dbec5f59

SHA1
8f08650a6505ce6f4f0ddfb7d095b91e6de5d85f

SHA256
6b1ad8d052b6c52c2603609e963ad99d639b40b883e8fe87aa5a1d3c6c30f5fd

SHA512
d7342ccd8055a71dfdc0825adb0def20f517908f5bd0f5f5d153b76f6a24c6dfd557461842d2a0388d18019c443bc0dd98b0eb3120d1c9a676244c486fcb2e92

Download Submit
C:\Windows\System\hNiCgav.exe

Filesize
1.1MB

MD5
42b14e6a1bcc51559deee95f2d075947

SHA1
4f636135afaafbe5fef176b75778744a278966c5

SHA256
5546561ca5a587c88f602c6cdb6119ad3ce98fd942b462894d6f54c197de58f9

SHA512
5febd5429814b1c3c02d934a8db7f253d96cd6711df85c4ca80c9b95830f0bfa2a0790a50a127830d1b6f0795e993ddb8b04e246faee1276bde62e78aefa7788

Download Submit
C:\Windows\System\jSSNQXY.exe

Filesize
1.1MB

MD5
982a1fb148a129c6027aa45a3888e1db

SHA1
1b4a52dc40ab6bd473f9bbc59a61905addeb11b4

SHA256
84677b3088297a524920b0c87fda961992cda781969acc62e3ddf64c22dfd5ad

SHA512
f365a0566e8f7051af564554a0c910888a7b3922c217331c0b38355bb04e6c989471c405a1afe6ca38363763646913e133984ed859ed71d755bd2c30952be6f1

Download Submit
C:\Windows\System\kUJGSDL.exe

Filesize
1.1MB

MD5
1d9f7a63bc8ff8f7fd95b2f4d170d806

SHA1
dcd1c2aa28e41966b053e1bbf8468bec42d19181

SHA256
90074dba2d71e622d3eaf6ce7a43fee12fdcea49ac91c04e9171bcad6fb32bab

SHA512
c21840de399ba299f11b34e8d934aa06db3f476d4f9928609ad5cde6f42935fa161d2713088d03169f72c0ec296fd709bbc8235b0fb0b343ca468ff53579d3d1

Download Submit
C:\Windows\System\lEsTOyu.exe

Filesize
1.1MB

MD5
f16164e60db77eb5cb04bf4fe2b7e1fa

SHA1
c1438e8d35d789e75a7c17d464d27a97f9ff94e2

SHA256
18467dd5a61df6e436bcdafd08a3ec83c2b64219b645ff8a157617ef53124ee8

SHA512
5c468d2e18292cf253b87d0072405bb97e362ac71103ec8e224f678bf7dd3dac8a7658c34a2ac30b1f190e63f6a3b106e8f9ca35f7a3eaf398745b7747163357

Download Submit
C:\Windows\System\oQQOPwV.exe

Filesize
1.1MB

MD5
9380c1734bebac79a94c1fdf5f8c02b9

SHA1
4cc5576558802aeeed11879c984ff5035f5eb8ab

SHA256
ea9eec77397d297dc9989a569765bff5a1926caf7d162ccd3ce2e5066cf90386

SHA512
53564fdb531856e4fbd880a832a0f96c7c8772898c1e171c54e6a007c0f69fc11e3709c278341bf0a4488aa52c82053761cbb35f8d0b802801d57c73d4a14ff7

Download Submit
C:\Windows\System\qexjpMy.exe

Filesize
1.1MB

MD5
a6b1a199376ea7a5daebeaa451845d2b

SHA1
f803a1b1ee7904a7e7b7977310a5b1a917ad8789

SHA256
d7c2cf60cbbba5dfe5096457079f6ab14ff2538b1d6ede9e8a2bbd6f2a2f6e83

SHA512
304d0621611f2fac883a57b6966312f816658eaebe1b406a568ea7765058a15094f4da370d576657238d0a6902bef1145196f838fd9dd4afc21a939e1518ea59

Download Submit
C:\Windows\System\xdBsQXO.exe

Filesize
1.1MB

MD5
dd2c6d0f2a410a39cf58aefd9dacd1bd

SHA1
fb00a787f639f99e7c3915b58e5ef8f4b5c004d8

SHA256
903597babd217401e7a77a3e2e4ba6e8de5d05b10b23e11319e341aa9fb95f5d

SHA512
cf0c3c6625aa7e601d617257d7844a2490ac894974f706d420c63c42f175e306fcf9a5e13cb05ec83de6a7b6ceebdf402d2a13baa96624c4b88474b3e0273ddc

Download Submit
C:\Windows\System\xehAlnO.exe

Filesize
1.1MB

MD5
8326e12756986efd93ecede5e8a7eaba

SHA1
9124728db4c41158b89b4bc32ee94cc767da9ee2

SHA256
82e4d887e78f04e5359e294fbd47f4086507dac34912db9b1312f2247c367c0d

SHA512
1b03dfababeeca2a35e243523706da2dd568302293c1521533872e57ea9eeb3d9aedcf939d53edccab6d5a20b3b0fecbed67d0c5559b9583fdd576a6e737dbf1

Download Submit
C:\Windows\System\zUwKPtE.exe

Filesize
1.1MB

MD5
d7a20a663f5d79639ef6a83f0e5592fa

SHA1
0e34ff0e30a4ac723f9dc419669240cf31148a7a

SHA256
04b184820a5ff25eebaff15659fe300e9377cf1b818f188202f0f1e39c949432

SHA512
f849291845938c31f1c33c2287d628c0ee251780b361cf52910f15a7ac42176d60a73bfbc6726438552be24d6f129030db79fdda9cc5afa2f1bf773df72535d1

Download Submit
C:\Windows\System\zePwfiW.exe

Filesize
1.1MB

MD5
a590072f5a7f39d63762f5512347067b

SHA1
1be3cc0933d3b1a536ee948b159ae6907d2baa35

SHA256
20901eddd41b3c3afcfe29e09e23a8c6a73013871cf20c26ec941015ea66f793

SHA512
cc6850ba7981ade9d6bec131289dd1b9410172c29e51b81fefa08029ec91a8bc9b0976ba2ca346d22618e5eb855a0e7101fef26e921601751603043c5791b10e

Download Submit
memory/1012-0-0x000001EF15180000-0x000001EF15190000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads