xmrig | 9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053

Analysis

max time kernel
109s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
Size

1.1MB
MD5

9c490f698f3376fb4af963792e6dec23
SHA1

982c75f223ed2069844bcbc5c81f24447195c50d
SHA256

9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053
SHA512

5e9e60075b3b65147b9ab21b26bc55ed0ce9c54bcb530f6da2b255b9766e36085ff1d123ccf172e45feccebcdc6ca0b1b933bede9af986583b0ebceed6dc4495
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4Buaq9Nd4:GezaTF8FcNkNdfE0pZ9ozttwIRakGXY8

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023bbd-3.dat	xmrig
behavioral2/files/0x0008000000023c8d-8.dat	xmrig
behavioral2/files/0x0007000000023c91-7.dat	xmrig
behavioral2/files/0x0007000000023c93-21.dat	xmrig
behavioral2/files/0x0007000000023c94-28.dat	xmrig
behavioral2/files/0x0007000000023c92-22.dat	xmrig
behavioral2/files/0x0007000000023c96-44.dat	xmrig
behavioral2/files/0x0007000000023c97-43.dat	xmrig
behavioral2/files/0x0007000000023c99-48.dat	xmrig
behavioral2/files/0x0007000000023c98-50.dat	xmrig
behavioral2/files/0x0007000000023c95-39.dat	xmrig
behavioral2/files/0x0007000000023c9a-59.dat	xmrig
behavioral2/files/0x0007000000023c9b-63.dat	xmrig
behavioral2/files/0x0007000000023c9c-73.dat	xmrig
behavioral2/files/0x0007000000023c9d-75.dat	xmrig
behavioral2/files/0x0007000000023ca1-89.dat	xmrig
behavioral2/files/0x0007000000023ca4-96.dat	xmrig
behavioral2/files/0x0007000000023ca2-98.dat	xmrig
behavioral2/files/0x0007000000023ca3-103.dat	xmrig
behavioral2/files/0x0007000000023ca0-97.dat	xmrig
behavioral2/files/0x0007000000023c9e-80.dat	xmrig
behavioral2/files/0x0007000000023ca5-109.dat	xmrig
behavioral2/files/0x0007000000023ca7-116.dat	xmrig
behavioral2/files/0x0007000000023ca6-114.dat	xmrig
behavioral2/files/0x0007000000023cab-136.dat	xmrig
behavioral2/files/0x0007000000023cad-144.dat	xmrig
behavioral2/files/0x0007000000023cae-155.dat	xmrig
behavioral2/files/0x0007000000023cac-153.dat	xmrig
behavioral2/files/0x0007000000023ca9-142.dat	xmrig
behavioral2/files/0x0007000000023caa-135.dat	xmrig
behavioral2/files/0x0007000000023ca8-128.dat	xmrig
behavioral2/files/0x0007000000023caf-160.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3148	rAPNLoB.exe
3260	ykVUdpt.exe
5116	kiuIUrh.exe
4240	CwpfakO.exe
3652	cIdUASt.exe
1400	UsxKjGx.exe
2780	SZHAapH.exe
3692	WAyyuXv.exe
3632	Gwotxlq.exe
5044	djiMqfP.exe
5088	kvxgKii.exe
4296	tGAtWMC.exe
2800	iMAuFxS.exe
4380	hOKPgyF.exe
2984	GrSiBuu.exe
3668	ijxJwhQ.exe
4808	kaelxDd.exe
4484	EGBcxEm.exe
4056	SDRFSdv.exe
4960	XIrLTIq.exe
2420	nEmMDgR.exe
2164	uIpVQQn.exe
3372	bahzayn.exe
2280	SbdyKsN.exe
1772	rEDYgNs.exe
4376	iVIbnBL.exe
4716	KfPEzjr.exe
5004	AWLTobh.exe
4508	DDqHJUT.exe
4488	wcLuFPH.exe
1128	NNtEDug.exe
3048	bNldVLK.exe
5036	VApcbSx.exe
5056	CxLoFYI.exe
5060	IIRasVD.exe
4188	igrNFxX.exe
2288	etMhvEe.exe
2680	uvjqxTx.exe
4412	RshsEPA.exe
112	gozFnku.exe
3568	fRIAdlz.exe
1576	zwMhSzw.exe
408	YDEHTPG.exe
3068	SmtwabP.exe
632	UhoXyNm.exe
2976	vrBQuzf.exe
1344	bumsUmg.exe
2224	hDtudsr.exe
3936	FPpppbK.exe
3868	IOoZwbf.exe
1924	bMaxyXI.exe
2624	KmnvYox.exe
4244	TzkhKoN.exe
5096	lhgvbgA.exe
3956	XyPcPfY.exe
3856	BpRmDWH.exe
3336	sMyfMsO.exe
3436	bYLakOp.exe
3928	tKQjaim.exe
1940	dCyRRsz.exe
1140	HwIXZWA.exe
3112	mislqsA.exe
3576	oAeTPsw.exe
1628	MegWmcj.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SyDKOgw.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\lJWHtxA.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\pwjgIry.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\XsMACnx.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\fhcfiNx.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\KUtQWKk.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\TljbLip.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\glbLrhX.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\UHLLrMY.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\WuZxIgi.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\FjiEnlu.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\LbOTtUo.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\KqfoPcJ.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\CLCuiRy.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\xRABKnd.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\ULwlBbi.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\GqgWBLd.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\jnqaCQy.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\gozFnku.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\PhRmogG.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\TguFGPb.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\RyrYQRi.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\kkMSIgt.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\nmidKxv.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\xVwdbXa.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\hjIFYmn.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\IBmStNW.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\rERrdjh.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\JuWiLWH.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\CocJHnZ.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\RDxAyLe.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\TUFEQZa.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\opEgsnN.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\TmqgjDM.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\ypGzTHX.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\XyPcPfY.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\fzpFpBs.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\XTbFiuX.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\UqSWybD.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\tKQjaim.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\hKuduBi.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\CKdOuPU.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\agOeVOP.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\BvOdegV.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\XINoTGT.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\yTqfHBY.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\hcRfPVi.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\VSWoqrI.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\ntyMBAJ.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\kQqNfBW.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\FqirMcC.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\XIrLTIq.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\oAeTPsw.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\SmkBtQN.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\DDqHJUT.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\depMlid.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\iaILujq.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\jYGnaze.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\osGvYKd.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\hFlMJMk.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\QuiUSic.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\CTIvyBe.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\hPWoybW.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
File created	C:\Windows\System\kOsJnxy.exe	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16560	dwm.exe
Token: SeChangeNotifyPrivilege	16560	dwm.exe
Token: 33	16560	dwm.exe
Token: SeIncBasePriorityPrivilege	16560	dwm.exe
Token: SeShutdownPrivilege	16560	dwm.exe
Token: SeCreatePagefilePrivilege	16560	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 3148	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	84
PID 2644 wrote to memory of 3148	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	84
PID 2644 wrote to memory of 3260	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	85
PID 2644 wrote to memory of 3260	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	85
PID 2644 wrote to memory of 5116	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	86
PID 2644 wrote to memory of 5116	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	86
PID 2644 wrote to memory of 4240	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	87
PID 2644 wrote to memory of 4240	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	87
PID 2644 wrote to memory of 3652	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	88
PID 2644 wrote to memory of 3652	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	88
PID 2644 wrote to memory of 1400	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	89
PID 2644 wrote to memory of 1400	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	89
PID 2644 wrote to memory of 2780	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	90
PID 2644 wrote to memory of 2780	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	90
PID 2644 wrote to memory of 3632	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	91
PID 2644 wrote to memory of 3632	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	91
PID 2644 wrote to memory of 3692	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	92
PID 2644 wrote to memory of 3692	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	92
PID 2644 wrote to memory of 5044	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	93
PID 2644 wrote to memory of 5044	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	93
PID 2644 wrote to memory of 5088	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	94
PID 2644 wrote to memory of 5088	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	94
PID 2644 wrote to memory of 4296	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	95
PID 2644 wrote to memory of 4296	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	95
PID 2644 wrote to memory of 2800	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	96
PID 2644 wrote to memory of 2800	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	96
PID 2644 wrote to memory of 4380	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	97
PID 2644 wrote to memory of 4380	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	97
PID 2644 wrote to memory of 2984	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	98
PID 2644 wrote to memory of 2984	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	98
PID 2644 wrote to memory of 3668	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	99
PID 2644 wrote to memory of 3668	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	99
PID 2644 wrote to memory of 4808	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	100
PID 2644 wrote to memory of 4808	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	100
PID 2644 wrote to memory of 4484	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	101
PID 2644 wrote to memory of 4484	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	101
PID 2644 wrote to memory of 4056	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	102
PID 2644 wrote to memory of 4056	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	102
PID 2644 wrote to memory of 4960	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	103
PID 2644 wrote to memory of 4960	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	103
PID 2644 wrote to memory of 2420	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	104
PID 2644 wrote to memory of 2420	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	104
PID 2644 wrote to memory of 2164	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	105
PID 2644 wrote to memory of 2164	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	105
PID 2644 wrote to memory of 3372	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	108
PID 2644 wrote to memory of 3372	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	108
PID 2644 wrote to memory of 2280	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	109
PID 2644 wrote to memory of 2280	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	109
PID 2644 wrote to memory of 1772	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	110
PID 2644 wrote to memory of 1772	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	110
PID 2644 wrote to memory of 4376	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	112
PID 2644 wrote to memory of 4376	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	112
PID 2644 wrote to memory of 4716	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	113
PID 2644 wrote to memory of 4716	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	113
PID 2644 wrote to memory of 5004	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	114
PID 2644 wrote to memory of 5004	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	114
PID 2644 wrote to memory of 4488	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	115
PID 2644 wrote to memory of 4488	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	115
PID 2644 wrote to memory of 4508	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	116
PID 2644 wrote to memory of 4508	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	116
PID 2644 wrote to memory of 1128	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	117
PID 2644 wrote to memory of 1128	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	117
PID 2644 wrote to memory of 3048	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	118
PID 2644 wrote to memory of 3048	2644	9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe	118

C:\Users\Admin\AppData\Local\Temp\9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe
"C:\Users\Admin\AppData\Local\Temp\9919e74de745164a2cfe4f210406999e6931a0a3450dd53e0b8c94f7f1a88053.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\System\rAPNLoB.exe
  C:\Windows\System\rAPNLoB.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\ykVUdpt.exe
  C:\Windows\System\ykVUdpt.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\kiuIUrh.exe
  C:\Windows\System\kiuIUrh.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\CwpfakO.exe
  C:\Windows\System\CwpfakO.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\cIdUASt.exe
  C:\Windows\System\cIdUASt.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\UsxKjGx.exe
  C:\Windows\System\UsxKjGx.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\SZHAapH.exe
  C:\Windows\System\SZHAapH.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\Gwotxlq.exe
  C:\Windows\System\Gwotxlq.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\WAyyuXv.exe
  C:\Windows\System\WAyyuXv.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\djiMqfP.exe
  C:\Windows\System\djiMqfP.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\kvxgKii.exe
  C:\Windows\System\kvxgKii.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\tGAtWMC.exe
  C:\Windows\System\tGAtWMC.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\iMAuFxS.exe
  C:\Windows\System\iMAuFxS.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\hOKPgyF.exe
  C:\Windows\System\hOKPgyF.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\GrSiBuu.exe
  C:\Windows\System\GrSiBuu.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\ijxJwhQ.exe
  C:\Windows\System\ijxJwhQ.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\kaelxDd.exe
  C:\Windows\System\kaelxDd.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\EGBcxEm.exe
  C:\Windows\System\EGBcxEm.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\SDRFSdv.exe
  C:\Windows\System\SDRFSdv.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\XIrLTIq.exe
  C:\Windows\System\XIrLTIq.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\nEmMDgR.exe
  C:\Windows\System\nEmMDgR.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\uIpVQQn.exe
  C:\Windows\System\uIpVQQn.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\bahzayn.exe
  C:\Windows\System\bahzayn.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\SbdyKsN.exe
  C:\Windows\System\SbdyKsN.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\rEDYgNs.exe
  C:\Windows\System\rEDYgNs.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\iVIbnBL.exe
  C:\Windows\System\iVIbnBL.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\KfPEzjr.exe
  C:\Windows\System\KfPEzjr.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\AWLTobh.exe
  C:\Windows\System\AWLTobh.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\wcLuFPH.exe
  C:\Windows\System\wcLuFPH.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\DDqHJUT.exe
  C:\Windows\System\DDqHJUT.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\NNtEDug.exe
  C:\Windows\System\NNtEDug.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\bNldVLK.exe
  C:\Windows\System\bNldVLK.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\VApcbSx.exe
  C:\Windows\System\VApcbSx.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\CxLoFYI.exe
  C:\Windows\System\CxLoFYI.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\IIRasVD.exe
  C:\Windows\System\IIRasVD.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\igrNFxX.exe
  C:\Windows\System\igrNFxX.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\etMhvEe.exe
  C:\Windows\System\etMhvEe.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\uvjqxTx.exe
  C:\Windows\System\uvjqxTx.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\RshsEPA.exe
  C:\Windows\System\RshsEPA.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\gozFnku.exe
  C:\Windows\System\gozFnku.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\fRIAdlz.exe
  C:\Windows\System\fRIAdlz.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\zwMhSzw.exe
  C:\Windows\System\zwMhSzw.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\YDEHTPG.exe
  C:\Windows\System\YDEHTPG.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\SmtwabP.exe
  C:\Windows\System\SmtwabP.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\UhoXyNm.exe
  C:\Windows\System\UhoXyNm.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\vrBQuzf.exe
  C:\Windows\System\vrBQuzf.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\bumsUmg.exe
  C:\Windows\System\bumsUmg.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\hDtudsr.exe
  C:\Windows\System\hDtudsr.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\FPpppbK.exe
  C:\Windows\System\FPpppbK.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\IOoZwbf.exe
  C:\Windows\System\IOoZwbf.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\bMaxyXI.exe
  C:\Windows\System\bMaxyXI.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\KmnvYox.exe
  C:\Windows\System\KmnvYox.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\TzkhKoN.exe
  C:\Windows\System\TzkhKoN.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\lhgvbgA.exe
  C:\Windows\System\lhgvbgA.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\XyPcPfY.exe
  C:\Windows\System\XyPcPfY.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\BpRmDWH.exe
  C:\Windows\System\BpRmDWH.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\sMyfMsO.exe
  C:\Windows\System\sMyfMsO.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\tKQjaim.exe
  C:\Windows\System\tKQjaim.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\bYLakOp.exe
  C:\Windows\System\bYLakOp.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\dCyRRsz.exe
  C:\Windows\System\dCyRRsz.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\HwIXZWA.exe
  C:\Windows\System\HwIXZWA.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\mislqsA.exe
  C:\Windows\System\mislqsA.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\oAeTPsw.exe
  C:\Windows\System\oAeTPsw.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\MegWmcj.exe
  C:\Windows\System\MegWmcj.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\NHWlWeM.exe
  C:\Windows\System\NHWlWeM.exe
  2⤵
  PID:1268
- C:\Windows\System\YYcnETz.exe
  C:\Windows\System\YYcnETz.exe
  2⤵
  PID:4300
- C:\Windows\System\CPHhGTA.exe
  C:\Windows\System\CPHhGTA.exe
  2⤵
  PID:2084
- C:\Windows\System\wnMWeDL.exe
  C:\Windows\System\wnMWeDL.exe
  2⤵
  PID:2312
- C:\Windows\System\FqirMcC.exe
  C:\Windows\System\FqirMcC.exe
  2⤵
  PID:5064
- C:\Windows\System\RCMOpaU.exe
  C:\Windows\System\RCMOpaU.exe
  2⤵
  PID:2928
- C:\Windows\System\ZxhyLWj.exe
  C:\Windows\System\ZxhyLWj.exe
  2⤵
  PID:1224
- C:\Windows\System\azTkiIs.exe
  C:\Windows\System\azTkiIs.exe
  2⤵
  PID:2900
- C:\Windows\System\YmZTjxD.exe
  C:\Windows\System\YmZTjxD.exe
  2⤵
  PID:2892
- C:\Windows\System\gsuxSMS.exe
  C:\Windows\System\gsuxSMS.exe
  2⤵
  PID:4360
- C:\Windows\System\VUgOqDx.exe
  C:\Windows\System\VUgOqDx.exe
  2⤵
  PID:3592
- C:\Windows\System\NxlaqDN.exe
  C:\Windows\System\NxlaqDN.exe
  2⤵
  PID:1484
- C:\Windows\System\pJDaGsx.exe
  C:\Windows\System\pJDaGsx.exe
  2⤵
  PID:4600
- C:\Windows\System\MvgozrQ.exe
  C:\Windows\System\MvgozrQ.exe
  2⤵
  PID:3416
- C:\Windows\System\TljbLip.exe
  C:\Windows\System\TljbLip.exe
  2⤵
  PID:556
- C:\Windows\System\kVJmuTz.exe
  C:\Windows\System\kVJmuTz.exe
  2⤵
  PID:4952
- C:\Windows\System\NVVuqWM.exe
  C:\Windows\System\NVVuqWM.exe
  2⤵
  PID:2076
- C:\Windows\System\kkMSIgt.exe
  C:\Windows\System\kkMSIgt.exe
  2⤵
  PID:3860
- C:\Windows\System\VoVYaMq.exe
  C:\Windows\System\VoVYaMq.exe
  2⤵
  PID:3236
- C:\Windows\System\SmkBtQN.exe
  C:\Windows\System\SmkBtQN.exe
  2⤵
  PID:640
- C:\Windows\System\DMDBVaa.exe
  C:\Windows\System\DMDBVaa.exe
  2⤵
  PID:2404
- C:\Windows\System\dqcGWgS.exe
  C:\Windows\System\dqcGWgS.exe
  2⤵
  PID:4732
- C:\Windows\System\arYyMzx.exe
  C:\Windows\System\arYyMzx.exe
  2⤵
  PID:4680
- C:\Windows\System\GVlcHAg.exe
  C:\Windows\System\GVlcHAg.exe
  2⤵
  PID:2168
- C:\Windows\System\BXfrhXe.exe
  C:\Windows\System\BXfrhXe.exe
  2⤵
  PID:4008
- C:\Windows\System\mpuMLXU.exe
  C:\Windows\System\mpuMLXU.exe
  2⤵
  PID:3564
- C:\Windows\System\YfsSYuv.exe
  C:\Windows\System\YfsSYuv.exe
  2⤵
  PID:4328
- C:\Windows\System\oiRUcSS.exe
  C:\Windows\System\oiRUcSS.exe
  2⤵
  PID:4956
- C:\Windows\System\nzGsNWa.exe
  C:\Windows\System\nzGsNWa.exe
  2⤵
  PID:3164
- C:\Windows\System\yuFBxoA.exe
  C:\Windows\System\yuFBxoA.exe
  2⤵
  PID:1944
- C:\Windows\System\tjmmskn.exe
  C:\Windows\System\tjmmskn.exe
  2⤵
  PID:2112
- C:\Windows\System\LkEUZJc.exe
  C:\Windows\System\LkEUZJc.exe
  2⤵
  PID:316
- C:\Windows\System\eBiKqeX.exe
  C:\Windows\System\eBiKqeX.exe
  2⤵
  PID:4912
- C:\Windows\System\koYTGqK.exe
  C:\Windows\System\koYTGqK.exe
  2⤵
  PID:4728
- C:\Windows\System\hcRfPVi.exe
  C:\Windows\System\hcRfPVi.exe
  2⤵
  PID:5136
- C:\Windows\System\gKMTxLi.exe
  C:\Windows\System\gKMTxLi.exe
  2⤵
  PID:5164
- C:\Windows\System\Vbfeqzl.exe
  C:\Windows\System\Vbfeqzl.exe
  2⤵
  PID:5192
- C:\Windows\System\tswVwTb.exe
  C:\Windows\System\tswVwTb.exe
  2⤵
  PID:5216
- C:\Windows\System\ZRjywJB.exe
  C:\Windows\System\ZRjywJB.exe
  2⤵
  PID:5248
- C:\Windows\System\IbtXOyP.exe
  C:\Windows\System\IbtXOyP.exe
  2⤵
  PID:5276
- C:\Windows\System\TnvDcEw.exe
  C:\Windows\System\TnvDcEw.exe
  2⤵
  PID:5292
- C:\Windows\System\depMlid.exe
  C:\Windows\System\depMlid.exe
  2⤵
  PID:5324
- C:\Windows\System\gdIWqPq.exe
  C:\Windows\System\gdIWqPq.exe
  2⤵
  PID:5364
- C:\Windows\System\IBGNgQq.exe
  C:\Windows\System\IBGNgQq.exe
  2⤵
  PID:5392
- C:\Windows\System\UWiuQfU.exe
  C:\Windows\System\UWiuQfU.exe
  2⤵
  PID:5420
- C:\Windows\System\IUTZktP.exe
  C:\Windows\System\IUTZktP.exe
  2⤵
  PID:5436
- C:\Windows\System\zChIOZq.exe
  C:\Windows\System\zChIOZq.exe
  2⤵
  PID:5468
- C:\Windows\System\VutFmov.exe
  C:\Windows\System\VutFmov.exe
  2⤵
  PID:5496
- C:\Windows\System\YgKATuc.exe
  C:\Windows\System\YgKATuc.exe
  2⤵
  PID:5520
- C:\Windows\System\pbCzIDN.exe
  C:\Windows\System\pbCzIDN.exe
  2⤵
  PID:5556
- C:\Windows\System\yItPKmu.exe
  C:\Windows\System\yItPKmu.exe
  2⤵
  PID:5588
- C:\Windows\System\tWxfeXL.exe
  C:\Windows\System\tWxfeXL.exe
  2⤵
  PID:5616
- C:\Windows\System\JvCcjgE.exe
  C:\Windows\System\JvCcjgE.exe
  2⤵
  PID:5644
- C:\Windows\System\AxQdFna.exe
  C:\Windows\System\AxQdFna.exe
  2⤵
  PID:5664
- C:\Windows\System\vcqgjRe.exe
  C:\Windows\System\vcqgjRe.exe
  2⤵
  PID:5688
- C:\Windows\System\sSYLOVd.exe
  C:\Windows\System\sSYLOVd.exe
  2⤵
  PID:5728
- C:\Windows\System\nIaqrOM.exe
  C:\Windows\System\nIaqrOM.exe
  2⤵
  PID:5756
- C:\Windows\System\MYWduXR.exe
  C:\Windows\System\MYWduXR.exe
  2⤵
  PID:5784
- C:\Windows\System\DxdeDIP.exe
  C:\Windows\System\DxdeDIP.exe
  2⤵
  PID:5800
- C:\Windows\System\KqfoPcJ.exe
  C:\Windows\System\KqfoPcJ.exe
  2⤵
  PID:5840
- C:\Windows\System\nmidKxv.exe
  C:\Windows\System\nmidKxv.exe
  2⤵
  PID:5868
- C:\Windows\System\eMjLoNq.exe
  C:\Windows\System\eMjLoNq.exe
  2⤵
  PID:5888
- C:\Windows\System\TwJMIWW.exe
  C:\Windows\System\TwJMIWW.exe
  2⤵
  PID:5912
- C:\Windows\System\DTLXets.exe
  C:\Windows\System\DTLXets.exe
  2⤵
  PID:5936
- C:\Windows\System\liMPphB.exe
  C:\Windows\System\liMPphB.exe
  2⤵
  PID:5972
- C:\Windows\System\GqMCaOd.exe
  C:\Windows\System\GqMCaOd.exe
  2⤵
  PID:5992
- C:\Windows\System\UqSWybD.exe
  C:\Windows\System\UqSWybD.exe
  2⤵
  PID:6016
- C:\Windows\System\CPianEx.exe
  C:\Windows\System\CPianEx.exe
  2⤵
  PID:6056
- C:\Windows\System\SpxuyGv.exe
  C:\Windows\System\SpxuyGv.exe
  2⤵
  PID:6096
- C:\Windows\System\QUWDUJl.exe
  C:\Windows\System\QUWDUJl.exe
  2⤵
  PID:6120
- C:\Windows\System\SqrpNdJ.exe
  C:\Windows\System\SqrpNdJ.exe
  2⤵
  PID:6140
- C:\Windows\System\eNcmmvR.exe
  C:\Windows\System\eNcmmvR.exe
  2⤵
  PID:5160
- C:\Windows\System\ItULpSl.exe
  C:\Windows\System\ItULpSl.exe
  2⤵
  PID:5232
- C:\Windows\System\hmfFkVN.exe
  C:\Windows\System\hmfFkVN.exe
  2⤵
  PID:5288
- C:\Windows\System\rTWYARm.exe
  C:\Windows\System\rTWYARm.exe
  2⤵
  PID:5356
- C:\Windows\System\obFTnBS.exe
  C:\Windows\System\obFTnBS.exe
  2⤵
  PID:5452
- C:\Windows\System\CQcsxvj.exe
  C:\Windows\System\CQcsxvj.exe
  2⤵
  PID:5488
- C:\Windows\System\OAOerWp.exe
  C:\Windows\System\OAOerWp.exe
  2⤵
  PID:5572
- C:\Windows\System\mjzKJUx.exe
  C:\Windows\System\mjzKJUx.exe
  2⤵
  PID:5632
- C:\Windows\System\qFOzmGx.exe
  C:\Windows\System\qFOzmGx.exe
  2⤵
  PID:5704
- C:\Windows\System\gTMzkEx.exe
  C:\Windows\System\gTMzkEx.exe
  2⤵
  PID:5832
- C:\Windows\System\hFlMJMk.exe
  C:\Windows\System\hFlMJMk.exe
  2⤵
  PID:5852
- C:\Windows\System\UDutMnA.exe
  C:\Windows\System\UDutMnA.exe
  2⤵
  PID:5900
- C:\Windows\System\oXwLvKe.exe
  C:\Windows\System\oXwLvKe.exe
  2⤵
  PID:5948
- C:\Windows\System\yJOueMW.exe
  C:\Windows\System\yJOueMW.exe
  2⤵
  PID:5988
- C:\Windows\System\uNyfodD.exe
  C:\Windows\System\uNyfodD.exe
  2⤵
  PID:6036
- C:\Windows\System\DsLqWJo.exe
  C:\Windows\System\DsLqWJo.exe
  2⤵
  PID:6136
- C:\Windows\System\dNeMrPW.exe
  C:\Windows\System\dNeMrPW.exe
  2⤵
  PID:5184
- C:\Windows\System\FnrEzfF.exe
  C:\Windows\System\FnrEzfF.exe
  2⤵
  PID:5380
- C:\Windows\System\CLIHymZ.exe
  C:\Windows\System\CLIHymZ.exe
  2⤵
  PID:5604
- C:\Windows\System\WeXALSH.exe
  C:\Windows\System\WeXALSH.exe
  2⤵
  PID:5676
- C:\Windows\System\XyajRwE.exe
  C:\Windows\System\XyajRwE.exe
  2⤵
  PID:5740
- C:\Windows\System\mlzBsyG.exe
  C:\Windows\System\mlzBsyG.exe
  2⤵
  PID:5984
- C:\Windows\System\YAkkVqK.exe
  C:\Windows\System\YAkkVqK.exe
  2⤵
  PID:5312
- C:\Windows\System\fpDdNFk.exe
  C:\Windows\System\fpDdNFk.exe
  2⤵
  PID:5260
- C:\Windows\System\biBGkEO.exe
  C:\Windows\System\biBGkEO.exe
  2⤵
  PID:5716
- C:\Windows\System\aZeqJlH.exe
  C:\Windows\System\aZeqJlH.exe
  2⤵
  PID:5776
- C:\Windows\System\WZXStdU.exe
  C:\Windows\System\WZXStdU.exe
  2⤵
  PID:6092
- C:\Windows\System\QtqDIlh.exe
  C:\Windows\System\QtqDIlh.exe
  2⤵
  PID:6188
- C:\Windows\System\xjoiiDz.exe
  C:\Windows\System\xjoiiDz.exe
  2⤵
  PID:6212
- C:\Windows\System\JYbDrvP.exe
  C:\Windows\System\JYbDrvP.exe
  2⤵
  PID:6240
- C:\Windows\System\kYYgXhC.exe
  C:\Windows\System\kYYgXhC.exe
  2⤵
  PID:6296
- C:\Windows\System\spRqwdD.exe
  C:\Windows\System\spRqwdD.exe
  2⤵
  PID:6312
- C:\Windows\System\RncIwBh.exe
  C:\Windows\System\RncIwBh.exe
  2⤵
  PID:6332
- C:\Windows\System\lCOKQui.exe
  C:\Windows\System\lCOKQui.exe
  2⤵
  PID:6356
- C:\Windows\System\vGTtydK.exe
  C:\Windows\System\vGTtydK.exe
  2⤵
  PID:6384
- C:\Windows\System\YJOVoWi.exe
  C:\Windows\System\YJOVoWi.exe
  2⤵
  PID:6412
- C:\Windows\System\cYDHPzk.exe
  C:\Windows\System\cYDHPzk.exe
  2⤵
  PID:6436
- C:\Windows\System\dEBsoqe.exe
  C:\Windows\System\dEBsoqe.exe
  2⤵
  PID:6456
- C:\Windows\System\TRlfmFI.exe
  C:\Windows\System\TRlfmFI.exe
  2⤵
  PID:6476
- C:\Windows\System\CGDFsyO.exe
  C:\Windows\System\CGDFsyO.exe
  2⤵
  PID:6504
- C:\Windows\System\anDHmEf.exe
  C:\Windows\System\anDHmEf.exe
  2⤵
  PID:6532
- C:\Windows\System\XcCcKag.exe
  C:\Windows\System\XcCcKag.exe
  2⤵
  PID:6584
- C:\Windows\System\KidETSo.exe
  C:\Windows\System\KidETSo.exe
  2⤵
  PID:6624
- C:\Windows\System\hOQQNpE.exe
  C:\Windows\System\hOQQNpE.exe
  2⤵
  PID:6648
- C:\Windows\System\CKAFAMG.exe
  C:\Windows\System\CKAFAMG.exe
  2⤵
  PID:6676
- C:\Windows\System\PhRmogG.exe
  C:\Windows\System\PhRmogG.exe
  2⤵
  PID:6704
- C:\Windows\System\xVwdbXa.exe
  C:\Windows\System\xVwdbXa.exe
  2⤵
  PID:6732
- C:\Windows\System\xRQVTcS.exe
  C:\Windows\System\xRQVTcS.exe
  2⤵
  PID:6760
- C:\Windows\System\glbLrhX.exe
  C:\Windows\System\glbLrhX.exe
  2⤵
  PID:6784
- C:\Windows\System\hrmPTLo.exe
  C:\Windows\System\hrmPTLo.exe
  2⤵
  PID:6820
- C:\Windows\System\qnRCcYo.exe
  C:\Windows\System\qnRCcYo.exe
  2⤵
  PID:6844
- C:\Windows\System\PRkYWVI.exe
  C:\Windows\System\PRkYWVI.exe
  2⤵
  PID:6872
- C:\Windows\System\aGVnOuH.exe
  C:\Windows\System\aGVnOuH.exe
  2⤵
  PID:6896
- C:\Windows\System\CLCuiRy.exe
  C:\Windows\System\CLCuiRy.exe
  2⤵
  PID:6936
- C:\Windows\System\iaWPTUk.exe
  C:\Windows\System\iaWPTUk.exe
  2⤵
  PID:6956
- C:\Windows\System\JwfJFtR.exe
  C:\Windows\System\JwfJFtR.exe
  2⤵
  PID:6996
- C:\Windows\System\CSkyoZw.exe
  C:\Windows\System\CSkyoZw.exe
  2⤵
  PID:7036
- C:\Windows\System\NIuxQmk.exe
  C:\Windows\System\NIuxQmk.exe
  2⤵
  PID:7064
- C:\Windows\System\gRqfuQS.exe
  C:\Windows\System\gRqfuQS.exe
  2⤵
  PID:7096
- C:\Windows\System\uaOOxTO.exe
  C:\Windows\System\uaOOxTO.exe
  2⤵
  PID:7120
- C:\Windows\System\OzgckHB.exe
  C:\Windows\System\OzgckHB.exe
  2⤵
  PID:7148
- C:\Windows\System\NTOsXEH.exe
  C:\Windows\System\NTOsXEH.exe
  2⤵
  PID:5268
- C:\Windows\System\hjIFYmn.exe
  C:\Windows\System\hjIFYmn.exe
  2⤵
  PID:5956
- C:\Windows\System\vKFVEis.exe
  C:\Windows\System\vKFVEis.exe
  2⤵
  PID:6184
- C:\Windows\System\IBmStNW.exe
  C:\Windows\System\IBmStNW.exe
  2⤵
  PID:6252
- C:\Windows\System\UHLLrMY.exe
  C:\Windows\System\UHLLrMY.exe
  2⤵
  PID:6328
- C:\Windows\System\lrKQJiQ.exe
  C:\Windows\System\lrKQJiQ.exe
  2⤵
  PID:6308
- C:\Windows\System\iwcgdzw.exe
  C:\Windows\System\iwcgdzw.exe
  2⤵
  PID:6364
- C:\Windows\System\VfamspQ.exe
  C:\Windows\System\VfamspQ.exe
  2⤵
  PID:6472
- C:\Windows\System\Lhaynap.exe
  C:\Windows\System\Lhaynap.exe
  2⤵
  PID:6448
- C:\Windows\System\nOPdsTT.exe
  C:\Windows\System\nOPdsTT.exe
  2⤵
  PID:6528
- C:\Windows\System\MdgeMwj.exe
  C:\Windows\System\MdgeMwj.exe
  2⤵
  PID:6724
- C:\Windows\System\BnJeVIb.exe
  C:\Windows\System\BnJeVIb.exe
  2⤵
  PID:6816
- C:\Windows\System\ueeerQg.exe
  C:\Windows\System\ueeerQg.exe
  2⤵
  PID:6856
- C:\Windows\System\DbvwFnq.exe
  C:\Windows\System\DbvwFnq.exe
  2⤵
  PID:6948
- C:\Windows\System\jVwOYeW.exe
  C:\Windows\System\jVwOYeW.exe
  2⤵
  PID:7016
- C:\Windows\System\EVErpRs.exe
  C:\Windows\System\EVErpRs.exe
  2⤵
  PID:7032
- C:\Windows\System\XgiOJGf.exe
  C:\Windows\System\XgiOJGf.exe
  2⤵
  PID:7140
- C:\Windows\System\HTXtaRW.exe
  C:\Windows\System\HTXtaRW.exe
  2⤵
  PID:5816
- C:\Windows\System\rCijgWw.exe
  C:\Windows\System\rCijgWw.exe
  2⤵
  PID:6236
- C:\Windows\System\eLMICDk.exe
  C:\Windows\System\eLMICDk.exe
  2⤵
  PID:6468
- C:\Windows\System\gWXthoK.exe
  C:\Windows\System\gWXthoK.exe
  2⤵
  PID:6552
- C:\Windows\System\rLkunlp.exe
  C:\Windows\System\rLkunlp.exe
  2⤵
  PID:6692
- C:\Windows\System\cjDsoKa.exe
  C:\Windows\System\cjDsoKa.exe
  2⤵
  PID:6944
- C:\Windows\System\cOjbzzj.exe
  C:\Windows\System\cOjbzzj.exe
  2⤵
  PID:7116
- C:\Windows\System\ntSqyOV.exe
  C:\Windows\System\ntSqyOV.exe
  2⤵
  PID:6324
- C:\Windows\System\QyScaHO.exe
  C:\Windows\System\QyScaHO.exe
  2⤵
  PID:6496
- C:\Windows\System\wXXVvnK.exe
  C:\Windows\System\wXXVvnK.exe
  2⤵
  PID:6772
- C:\Windows\System\RWLYKqU.exe
  C:\Windows\System\RWLYKqU.exe
  2⤵
  PID:6672
- C:\Windows\System\taqjZJQ.exe
  C:\Windows\System\taqjZJQ.exe
  2⤵
  PID:7028
- C:\Windows\System\FAAfagh.exe
  C:\Windows\System\FAAfagh.exe
  2⤵
  PID:7200
- C:\Windows\System\jxhDcpY.exe
  C:\Windows\System\jxhDcpY.exe
  2⤵
  PID:7224
- C:\Windows\System\QdgZwFq.exe
  C:\Windows\System\QdgZwFq.exe
  2⤵
  PID:7248
- C:\Windows\System\dDAWMwO.exe
  C:\Windows\System\dDAWMwO.exe
  2⤵
  PID:7276
- C:\Windows\System\VhvtDJn.exe
  C:\Windows\System\VhvtDJn.exe
  2⤵
  PID:7308
- C:\Windows\System\aNSStTT.exe
  C:\Windows\System\aNSStTT.exe
  2⤵
  PID:7328
- C:\Windows\System\WuZxIgi.exe
  C:\Windows\System\WuZxIgi.exe
  2⤵
  PID:7348
- C:\Windows\System\ZhIrcJX.exe
  C:\Windows\System\ZhIrcJX.exe
  2⤵
  PID:7376
- C:\Windows\System\joihPMi.exe
  C:\Windows\System\joihPMi.exe
  2⤵
  PID:7404
- C:\Windows\System\gMFzAWd.exe
  C:\Windows\System\gMFzAWd.exe
  2⤵
  PID:7424
- C:\Windows\System\rnHvTsb.exe
  C:\Windows\System\rnHvTsb.exe
  2⤵
  PID:7448
- C:\Windows\System\OsqxYdI.exe
  C:\Windows\System\OsqxYdI.exe
  2⤵
  PID:7468
- C:\Windows\System\huyvBDL.exe
  C:\Windows\System\huyvBDL.exe
  2⤵
  PID:7492
- C:\Windows\System\zWZMTtT.exe
  C:\Windows\System\zWZMTtT.exe
  2⤵
  PID:7520
- C:\Windows\System\rKaoYRX.exe
  C:\Windows\System\rKaoYRX.exe
  2⤵
  PID:7548
- C:\Windows\System\sdihZFe.exe
  C:\Windows\System\sdihZFe.exe
  2⤵
  PID:7572
- C:\Windows\System\sMCUISu.exe
  C:\Windows\System\sMCUISu.exe
  2⤵
  PID:7596
- C:\Windows\System\hDGYHQN.exe
  C:\Windows\System\hDGYHQN.exe
  2⤵
  PID:7648
- C:\Windows\System\aWBTnLH.exe
  C:\Windows\System\aWBTnLH.exe
  2⤵
  PID:7676
- C:\Windows\System\OuTMCso.exe
  C:\Windows\System\OuTMCso.exe
  2⤵
  PID:7704
- C:\Windows\System\MekuamD.exe
  C:\Windows\System\MekuamD.exe
  2⤵
  PID:7740
- C:\Windows\System\XSbHoKP.exe
  C:\Windows\System\XSbHoKP.exe
  2⤵
  PID:7784
- C:\Windows\System\dHtOPFx.exe
  C:\Windows\System\dHtOPFx.exe
  2⤵
  PID:7812
- C:\Windows\System\RrmpgCG.exe
  C:\Windows\System\RrmpgCG.exe
  2⤵
  PID:7828
- C:\Windows\System\Scauxtm.exe
  C:\Windows\System\Scauxtm.exe
  2⤵
  PID:7856
- C:\Windows\System\obNizLZ.exe
  C:\Windows\System\obNizLZ.exe
  2⤵
  PID:7896
- C:\Windows\System\QuiUSic.exe
  C:\Windows\System\QuiUSic.exe
  2⤵
  PID:7916
- C:\Windows\System\rWEWlJp.exe
  C:\Windows\System\rWEWlJp.exe
  2⤵
  PID:7944
- C:\Windows\System\DsETSiR.exe
  C:\Windows\System\DsETSiR.exe
  2⤵
  PID:7976
- C:\Windows\System\VQRMzPL.exe
  C:\Windows\System\VQRMzPL.exe
  2⤵
  PID:8000
- C:\Windows\System\FqfFRqX.exe
  C:\Windows\System\FqfFRqX.exe
  2⤵
  PID:8032
- C:\Windows\System\LnkclCw.exe
  C:\Windows\System\LnkclCw.exe
  2⤵
  PID:8052
- C:\Windows\System\rzBUpjX.exe
  C:\Windows\System\rzBUpjX.exe
  2⤵
  PID:8068
- C:\Windows\System\xRABKnd.exe
  C:\Windows\System\xRABKnd.exe
  2⤵
  PID:8096
- C:\Windows\System\MnumGVa.exe
  C:\Windows\System\MnumGVa.exe
  2⤵
  PID:8136
- C:\Windows\System\DfphWGj.exe
  C:\Windows\System\DfphWGj.exe
  2⤵
  PID:8180
- C:\Windows\System\WKRUoJb.exe
  C:\Windows\System\WKRUoJb.exe
  2⤵
  PID:7180
- C:\Windows\System\diGSLNh.exe
  C:\Windows\System\diGSLNh.exe
  2⤵
  PID:7208
- C:\Windows\System\BnaePsL.exe
  C:\Windows\System\BnaePsL.exe
  2⤵
  PID:7296
- C:\Windows\System\GWycdlh.exe
  C:\Windows\System\GWycdlh.exe
  2⤵
  PID:7368
- C:\Windows\System\XmjOobe.exe
  C:\Windows\System\XmjOobe.exe
  2⤵
  PID:7444
- C:\Windows\System\NQAYVAx.exe
  C:\Windows\System\NQAYVAx.exe
  2⤵
  PID:7464
- C:\Windows\System\ZKeaKPs.exe
  C:\Windows\System\ZKeaKPs.exe
  2⤵
  PID:7488
- C:\Windows\System\cRyWDRz.exe
  C:\Windows\System\cRyWDRz.exe
  2⤵
  PID:7560
- C:\Windows\System\iPVRiqn.exe
  C:\Windows\System\iPVRiqn.exe
  2⤵
  PID:7728
- C:\Windows\System\pgbjHSf.exe
  C:\Windows\System\pgbjHSf.exe
  2⤵
  PID:7796
- C:\Windows\System\dopJbXI.exe
  C:\Windows\System\dopJbXI.exe
  2⤵
  PID:7868
- C:\Windows\System\qxDBDiM.exe
  C:\Windows\System\qxDBDiM.exe
  2⤵
  PID:7884
- C:\Windows\System\NkDoQTA.exe
  C:\Windows\System\NkDoQTA.exe
  2⤵
  PID:7968
- C:\Windows\System\UwtyXRf.exe
  C:\Windows\System\UwtyXRf.exe
  2⤵
  PID:8044
- C:\Windows\System\gHgcAbc.exe
  C:\Windows\System\gHgcAbc.exe
  2⤵
  PID:8088
- C:\Windows\System\QeQMLkW.exe
  C:\Windows\System\QeQMLkW.exe
  2⤵
  PID:8160
- C:\Windows\System\OaxMWGm.exe
  C:\Windows\System\OaxMWGm.exe
  2⤵
  PID:7244
- C:\Windows\System\BbMKslH.exe
  C:\Windows\System\BbMKslH.exe
  2⤵
  PID:7336
- C:\Windows\System\bgxPfzm.exe
  C:\Windows\System\bgxPfzm.exe
  2⤵
  PID:7436
- C:\Windows\System\yGSQQBk.exe
  C:\Windows\System\yGSQQBk.exe
  2⤵
  PID:7760
- C:\Windows\System\lSOQDkt.exe
  C:\Windows\System\lSOQDkt.exe
  2⤵
  PID:7888
- C:\Windows\System\fSQvFlh.exe
  C:\Windows\System\fSQvFlh.exe
  2⤵
  PID:8016
- C:\Windows\System\LukYhol.exe
  C:\Windows\System\LukYhol.exe
  2⤵
  PID:8148
- C:\Windows\System\vfCpuGD.exe
  C:\Windows\System\vfCpuGD.exe
  2⤵
  PID:7440
- C:\Windows\System\LBAxQmj.exe
  C:\Windows\System\LBAxQmj.exe
  2⤵
  PID:7712
- C:\Windows\System\rlbemkf.exe
  C:\Windows\System\rlbemkf.exe
  2⤵
  PID:7460
- C:\Windows\System\rQCQqtZ.exe
  C:\Windows\System\rQCQqtZ.exe
  2⤵
  PID:7820
- C:\Windows\System\qXNZuUT.exe
  C:\Windows\System\qXNZuUT.exe
  2⤵
  PID:8216
- C:\Windows\System\ENOnaby.exe
  C:\Windows\System\ENOnaby.exe
  2⤵
  PID:8236
- C:\Windows\System\ereFbdi.exe
  C:\Windows\System\ereFbdi.exe
  2⤵
  PID:8264
- C:\Windows\System\CTHGvSu.exe
  C:\Windows\System\CTHGvSu.exe
  2⤵
  PID:8288
- C:\Windows\System\TccZOof.exe
  C:\Windows\System\TccZOof.exe
  2⤵
  PID:8308
- C:\Windows\System\UWKOXzW.exe
  C:\Windows\System\UWKOXzW.exe
  2⤵
  PID:8336
- C:\Windows\System\iivceLt.exe
  C:\Windows\System\iivceLt.exe
  2⤵
  PID:8360
- C:\Windows\System\BXkUrvG.exe
  C:\Windows\System\BXkUrvG.exe
  2⤵
  PID:8380
- C:\Windows\System\AfnRNjA.exe
  C:\Windows\System\AfnRNjA.exe
  2⤵
  PID:8404
- C:\Windows\System\uUIZxbW.exe
  C:\Windows\System\uUIZxbW.exe
  2⤵
  PID:8476
- C:\Windows\System\mAGpXOs.exe
  C:\Windows\System\mAGpXOs.exe
  2⤵
  PID:8508
- C:\Windows\System\QmOLzOf.exe
  C:\Windows\System\QmOLzOf.exe
  2⤵
  PID:8540
- C:\Windows\System\ojhNRwi.exe
  C:\Windows\System\ojhNRwi.exe
  2⤵
  PID:8564
- C:\Windows\System\qEvDxTs.exe
  C:\Windows\System\qEvDxTs.exe
  2⤵
  PID:8584
- C:\Windows\System\LOnbPOR.exe
  C:\Windows\System\LOnbPOR.exe
  2⤵
  PID:8604
- C:\Windows\System\NwYINKq.exe
  C:\Windows\System\NwYINKq.exe
  2⤵
  PID:8628
- C:\Windows\System\sKVzNPl.exe
  C:\Windows\System\sKVzNPl.exe
  2⤵
  PID:8668
- C:\Windows\System\nnNXUms.exe
  C:\Windows\System\nnNXUms.exe
  2⤵
  PID:8696
- C:\Windows\System\CxNvIzX.exe
  C:\Windows\System\CxNvIzX.exe
  2⤵
  PID:8724
- C:\Windows\System\ZGXOmUe.exe
  C:\Windows\System\ZGXOmUe.exe
  2⤵
  PID:8764
- C:\Windows\System\tIJgExu.exe
  C:\Windows\System\tIJgExu.exe
  2⤵
  PID:8784
- C:\Windows\System\DTjQBbP.exe
  C:\Windows\System\DTjQBbP.exe
  2⤵
  PID:8808
- C:\Windows\System\GIoqqOq.exe
  C:\Windows\System\GIoqqOq.exe
  2⤵
  PID:8836
- C:\Windows\System\uqoBFhb.exe
  C:\Windows\System\uqoBFhb.exe
  2⤵
  PID:8852
- C:\Windows\System\MfNYFLt.exe
  C:\Windows\System\MfNYFLt.exe
  2⤵
  PID:8916
- C:\Windows\System\SotukzI.exe
  C:\Windows\System\SotukzI.exe
  2⤵
  PID:8936
- C:\Windows\System\CTIvyBe.exe
  C:\Windows\System\CTIvyBe.exe
  2⤵
  PID:8956
- C:\Windows\System\hKuduBi.exe
  C:\Windows\System\hKuduBi.exe
  2⤵
  PID:8980
- C:\Windows\System\kXjdHVL.exe
  C:\Windows\System\kXjdHVL.exe
  2⤵
  PID:9004
- C:\Windows\System\wvKNmar.exe
  C:\Windows\System\wvKNmar.exe
  2⤵
  PID:9024
- C:\Windows\System\ExzAyjW.exe
  C:\Windows\System\ExzAyjW.exe
  2⤵
  PID:9076
- C:\Windows\System\NpwHoLG.exe
  C:\Windows\System\NpwHoLG.exe
  2⤵
  PID:9092
- C:\Windows\System\bmtNefF.exe
  C:\Windows\System\bmtNefF.exe
  2⤵
  PID:9124
- C:\Windows\System\PYDsGqQ.exe
  C:\Windows\System\PYDsGqQ.exe
  2⤵
  PID:9144
- C:\Windows\System\NqrDvbX.exe
  C:\Windows\System\NqrDvbX.exe
  2⤵
  PID:9164
- C:\Windows\System\ZXnaZUB.exe
  C:\Windows\System\ZXnaZUB.exe
  2⤵
  PID:8060
- C:\Windows\System\TtVVMwG.exe
  C:\Windows\System\TtVVMwG.exe
  2⤵
  PID:8228
- C:\Windows\System\hEeodnB.exe
  C:\Windows\System\hEeodnB.exe
  2⤵
  PID:8256
- C:\Windows\System\OHHoHWf.exe
  C:\Windows\System\OHHoHWf.exe
  2⤵
  PID:8304
- C:\Windows\System\YXLqnjn.exe
  C:\Windows\System\YXLqnjn.exe
  2⤵
  PID:8392
- C:\Windows\System\iZwiUvg.exe
  C:\Windows\System\iZwiUvg.exe
  2⤵
  PID:8436
- C:\Windows\System\ZTpTiIw.exe
  C:\Windows\System\ZTpTiIw.exe
  2⤵
  PID:8472
- C:\Windows\System\IBuSHWK.exe
  C:\Windows\System\IBuSHWK.exe
  2⤵
  PID:8504
- C:\Windows\System\ElVfJLt.exe
  C:\Windows\System\ElVfJLt.exe
  2⤵
  PID:8592
- C:\Windows\System\zToWiYM.exe
  C:\Windows\System\zToWiYM.exe
  2⤵
  PID:8680
- C:\Windows\System\cFNiwzx.exe
  C:\Windows\System\cFNiwzx.exe
  2⤵
  PID:8792
- C:\Windows\System\FmvZnOt.exe
  C:\Windows\System\FmvZnOt.exe
  2⤵
  PID:8868
- C:\Windows\System\Zqrrvyh.exe
  C:\Windows\System\Zqrrvyh.exe
  2⤵
  PID:8900
- C:\Windows\System\hgImDya.exe
  C:\Windows\System\hgImDya.exe
  2⤵
  PID:8972
- C:\Windows\System\wWZXBzN.exe
  C:\Windows\System\wWZXBzN.exe
  2⤵
  PID:9020
- C:\Windows\System\dmDpxMQ.exe
  C:\Windows\System\dmDpxMQ.exe
  2⤵
  PID:9068
- C:\Windows\System\pVzKQrR.exe
  C:\Windows\System\pVzKQrR.exe
  2⤵
  PID:9112
- C:\Windows\System\NVXWMiK.exe
  C:\Windows\System\NVXWMiK.exe
  2⤵
  PID:9196
- C:\Windows\System\nJqhJmk.exe
  C:\Windows\System\nJqhJmk.exe
  2⤵
  PID:8252
- C:\Windows\System\yFNNHaf.exe
  C:\Windows\System\yFNNHaf.exe
  2⤵
  PID:8356
- C:\Windows\System\IeacDvP.exe
  C:\Windows\System\IeacDvP.exe
  2⤵
  PID:8664
- C:\Windows\System\WGlvXTA.exe
  C:\Windows\System\WGlvXTA.exe
  2⤵
  PID:8804
- C:\Windows\System\PneZiQl.exe
  C:\Windows\System\PneZiQl.exe
  2⤵
  PID:8908
- C:\Windows\System\nDMqLtM.exe
  C:\Windows\System\nDMqLtM.exe
  2⤵
  PID:9088
- C:\Windows\System\iewrvEw.exe
  C:\Windows\System\iewrvEw.exe
  2⤵
  PID:7320
- C:\Windows\System\dvMcRWZ.exe
  C:\Windows\System\dvMcRWZ.exe
  2⤵
  PID:8492
- C:\Windows\System\hPWoybW.exe
  C:\Windows\System\hPWoybW.exe
  2⤵
  PID:8708
- C:\Windows\System\ZLetlLB.exe
  C:\Windows\System\ZLetlLB.exe
  2⤵
  PID:8376
- C:\Windows\System\xAADxUa.exe
  C:\Windows\System\xAADxUa.exe
  2⤵
  PID:8660
- C:\Windows\System\iUpMzwL.exe
  C:\Windows\System\iUpMzwL.exe
  2⤵
  PID:9256
- C:\Windows\System\Ewqztyq.exe
  C:\Windows\System\Ewqztyq.exe
  2⤵
  PID:9280
- C:\Windows\System\WvQXJNc.exe
  C:\Windows\System\WvQXJNc.exe
  2⤵
  PID:9296
- C:\Windows\System\eVWxJMM.exe
  C:\Windows\System\eVWxJMM.exe
  2⤵
  PID:9348
- C:\Windows\System\IzJWkwZ.exe
  C:\Windows\System\IzJWkwZ.exe
  2⤵
  PID:9376
- C:\Windows\System\XWhBAAz.exe
  C:\Windows\System\XWhBAAz.exe
  2⤵
  PID:9404
- C:\Windows\System\EmYPAaI.exe
  C:\Windows\System\EmYPAaI.exe
  2⤵
  PID:9420
- C:\Windows\System\HCMDIKm.exe
  C:\Windows\System\HCMDIKm.exe
  2⤵
  PID:9448
- C:\Windows\System\mWloLik.exe
  C:\Windows\System\mWloLik.exe
  2⤵
  PID:9464
- C:\Windows\System\DOLErmu.exe
  C:\Windows\System\DOLErmu.exe
  2⤵
  PID:9496
- C:\Windows\System\EXtZNGz.exe
  C:\Windows\System\EXtZNGz.exe
  2⤵
  PID:9516
- C:\Windows\System\UimxEIq.exe
  C:\Windows\System\UimxEIq.exe
  2⤵
  PID:9540
- C:\Windows\System\TguFGPb.exe
  C:\Windows\System\TguFGPb.exe
  2⤵
  PID:9568
- C:\Windows\System\hJQFSSC.exe
  C:\Windows\System\hJQFSSC.exe
  2⤵
  PID:9596
- C:\Windows\System\CnsIzKd.exe
  C:\Windows\System\CnsIzKd.exe
  2⤵
  PID:9616
- C:\Windows\System\YPmwZvt.exe
  C:\Windows\System\YPmwZvt.exe
  2⤵
  PID:9636
- C:\Windows\System\unUqRuq.exe
  C:\Windows\System\unUqRuq.exe
  2⤵
  PID:9712
- C:\Windows\System\mdmySKV.exe
  C:\Windows\System\mdmySKV.exe
  2⤵
  PID:9728
- C:\Windows\System\vKaCrGr.exe
  C:\Windows\System\vKaCrGr.exe
  2⤵
  PID:9760
- C:\Windows\System\iaILujq.exe
  C:\Windows\System\iaILujq.exe
  2⤵
  PID:9796
- C:\Windows\System\FJKvEhn.exe
  C:\Windows\System\FJKvEhn.exe
  2⤵
  PID:9824
- C:\Windows\System\fEyniGg.exe
  C:\Windows\System\fEyniGg.exe
  2⤵
  PID:9856
- C:\Windows\System\saSekgH.exe
  C:\Windows\System\saSekgH.exe
  2⤵
  PID:9872
- C:\Windows\System\wsQanpE.exe
  C:\Windows\System\wsQanpE.exe
  2⤵
  PID:9900
- C:\Windows\System\pbIZuPK.exe
  C:\Windows\System\pbIZuPK.exe
  2⤵
  PID:9928
- C:\Windows\System\qydcGcd.exe
  C:\Windows\System\qydcGcd.exe
  2⤵
  PID:9948
- C:\Windows\System\glkXYDT.exe
  C:\Windows\System\glkXYDT.exe
  2⤵
  PID:9984
- C:\Windows\System\FjiEnlu.exe
  C:\Windows\System\FjiEnlu.exe
  2⤵
  PID:10000
- C:\Windows\System\SLMrjxx.exe
  C:\Windows\System\SLMrjxx.exe
  2⤵
  PID:10028
- C:\Windows\System\CqfszwL.exe
  C:\Windows\System\CqfszwL.exe
  2⤵
  PID:10056
- C:\Windows\System\VBsNCtv.exe
  C:\Windows\System\VBsNCtv.exe
  2⤵
  PID:10080
- C:\Windows\System\eHqAvEF.exe
  C:\Windows\System\eHqAvEF.exe
  2⤵
  PID:10100
- C:\Windows\System\uKSmTHs.exe
  C:\Windows\System\uKSmTHs.exe
  2⤵
  PID:10128
- C:\Windows\System\TGZTHpA.exe
  C:\Windows\System\TGZTHpA.exe
  2⤵
  PID:10152
- C:\Windows\System\KJAAtPI.exe
  C:\Windows\System\KJAAtPI.exe
  2⤵
  PID:10212
- C:\Windows\System\tzonUyy.exe
  C:\Windows\System\tzonUyy.exe
  2⤵
  PID:10236
- C:\Windows\System\LyvwxLC.exe
  C:\Windows\System\LyvwxLC.exe
  2⤵
  PID:9248
- C:\Windows\System\SPLtWao.exe
  C:\Windows\System\SPLtWao.exe
  2⤵
  PID:9272
- C:\Windows\System\ugbcfaT.exe
  C:\Windows\System\ugbcfaT.exe
  2⤵
  PID:9368
- C:\Windows\System\DFDAqDP.exe
  C:\Windows\System\DFDAqDP.exe
  2⤵
  PID:9436
- C:\Windows\System\FARWswQ.exe
  C:\Windows\System\FARWswQ.exe
  2⤵
  PID:9484
- C:\Windows\System\UXVbjlV.exe
  C:\Windows\System\UXVbjlV.exe
  2⤵
  PID:9584
- C:\Windows\System\oNmYwsy.exe
  C:\Windows\System\oNmYwsy.exe
  2⤵
  PID:9660
- C:\Windows\System\FpYpgBl.exe
  C:\Windows\System\FpYpgBl.exe
  2⤵
  PID:9656
- C:\Windows\System\SebFAHB.exe
  C:\Windows\System\SebFAHB.exe
  2⤵
  PID:9744
- C:\Windows\System\VSWoqrI.exe
  C:\Windows\System\VSWoqrI.exe
  2⤵
  PID:9808
- C:\Windows\System\vgWQslg.exe
  C:\Windows\System\vgWQslg.exe
  2⤵
  PID:9888
- C:\Windows\System\yzGryJC.exe
  C:\Windows\System\yzGryJC.exe
  2⤵
  PID:9968
- C:\Windows\System\TUFEQZa.exe
  C:\Windows\System\TUFEQZa.exe
  2⤵
  PID:10040
- C:\Windows\System\ULwlBbi.exe
  C:\Windows\System\ULwlBbi.exe
  2⤵
  PID:10068
- C:\Windows\System\OByjBrx.exe
  C:\Windows\System\OByjBrx.exe
  2⤵
  PID:10136
- C:\Windows\System\OgORxmQ.exe
  C:\Windows\System\OgORxmQ.exe
  2⤵
  PID:10184
- C:\Windows\System\DjgXzlx.exe
  C:\Windows\System\DjgXzlx.exe
  2⤵
  PID:9388
- C:\Windows\System\fgyHmIA.exe
  C:\Windows\System\fgyHmIA.exe
  2⤵
  PID:9432
- C:\Windows\System\mivWUFc.exe
  C:\Windows\System\mivWUFc.exe
  2⤵
  PID:9576
- C:\Windows\System\LHGhJLg.exe
  C:\Windows\System\LHGhJLg.exe
  2⤵
  PID:9696
- C:\Windows\System\JuMgrTm.exe
  C:\Windows\System\JuMgrTm.exe
  2⤵
  PID:9884
- C:\Windows\System\CJDBcfc.exe
  C:\Windows\System\CJDBcfc.exe
  2⤵
  PID:10016
- C:\Windows\System\YSFIVle.exe
  C:\Windows\System\YSFIVle.exe
  2⤵
  PID:10076
- C:\Windows\System\nvQqWyg.exe
  C:\Windows\System\nvQqWyg.exe
  2⤵
  PID:10180
- C:\Windows\System\DZURaaj.exe
  C:\Windows\System\DZURaaj.exe
  2⤵
  PID:9740
- C:\Windows\System\FyvXtei.exe
  C:\Windows\System\FyvXtei.exe
  2⤵
  PID:10072
- C:\Windows\System\eqFAxcg.exe
  C:\Windows\System\eqFAxcg.exe
  2⤵
  PID:9788
- C:\Windows\System\kaTSCjr.exe
  C:\Windows\System\kaTSCjr.exe
  2⤵
  PID:10248
- C:\Windows\System\QmnYdvB.exe
  C:\Windows\System\QmnYdvB.exe
  2⤵
  PID:10284
- C:\Windows\System\RtwSXFC.exe
  C:\Windows\System\RtwSXFC.exe
  2⤵
  PID:10308
- C:\Windows\System\fBYUFdB.exe
  C:\Windows\System\fBYUFdB.exe
  2⤵
  PID:10328
- C:\Windows\System\BEpkNRb.exe
  C:\Windows\System\BEpkNRb.exe
  2⤵
  PID:10360
- C:\Windows\System\TRrnsBC.exe
  C:\Windows\System\TRrnsBC.exe
  2⤵
  PID:10400
- C:\Windows\System\fLsBWil.exe
  C:\Windows\System\fLsBWil.exe
  2⤵
  PID:10420
- C:\Windows\System\tTIHbeR.exe
  C:\Windows\System\tTIHbeR.exe
  2⤵
  PID:10460
- C:\Windows\System\HvKdoZm.exe
  C:\Windows\System\HvKdoZm.exe
  2⤵
  PID:10488
- C:\Windows\System\ntyMBAJ.exe
  C:\Windows\System\ntyMBAJ.exe
  2⤵
  PID:10504
- C:\Windows\System\YCrxnKR.exe
  C:\Windows\System\YCrxnKR.exe
  2⤵
  PID:10520
- C:\Windows\System\yvZQBKh.exe
  C:\Windows\System\yvZQBKh.exe
  2⤵
  PID:10548
- C:\Windows\System\zhBnNbC.exe
  C:\Windows\System\zhBnNbC.exe
  2⤵
  PID:10600
- C:\Windows\System\mPELlvT.exe
  C:\Windows\System\mPELlvT.exe
  2⤵
  PID:10616
- C:\Windows\System\jrgQzaC.exe
  C:\Windows\System\jrgQzaC.exe
  2⤵
  PID:10632
- C:\Windows\System\TnZmYPH.exe
  C:\Windows\System\TnZmYPH.exe
  2⤵
  PID:10652
- C:\Windows\System\TdbuDcv.exe
  C:\Windows\System\TdbuDcv.exe
  2⤵
  PID:10672
- C:\Windows\System\whfLaDo.exe
  C:\Windows\System\whfLaDo.exe
  2⤵
  PID:10692
- C:\Windows\System\iFwbvvi.exe
  C:\Windows\System\iFwbvvi.exe
  2⤵
  PID:10744
- C:\Windows\System\JBkXJqA.exe
  C:\Windows\System\JBkXJqA.exe
  2⤵
  PID:10772
- C:\Windows\System\JWIAnoY.exe
  C:\Windows\System\JWIAnoY.exe
  2⤵
  PID:10828
- C:\Windows\System\hIUGbFk.exe
  C:\Windows\System\hIUGbFk.exe
  2⤵
  PID:10852
- C:\Windows\System\DVQPKby.exe
  C:\Windows\System\DVQPKby.exe
  2⤵
  PID:10872
- C:\Windows\System\FzPnnsp.exe
  C:\Windows\System\FzPnnsp.exe
  2⤵
  PID:10896
- C:\Windows\System\LAnDOWI.exe
  C:\Windows\System\LAnDOWI.exe
  2⤵
  PID:10916
- C:\Windows\System\hniqRMQ.exe
  C:\Windows\System\hniqRMQ.exe
  2⤵
  PID:10936
- C:\Windows\System\jaTejpW.exe
  C:\Windows\System\jaTejpW.exe
  2⤵
  PID:10968
- C:\Windows\System\WByjFVr.exe
  C:\Windows\System\WByjFVr.exe
  2⤵
  PID:11024
- C:\Windows\System\nTyUpYz.exe
  C:\Windows\System\nTyUpYz.exe
  2⤵
  PID:11052
- C:\Windows\System\cQeACGH.exe
  C:\Windows\System\cQeACGH.exe
  2⤵
  PID:11080
- C:\Windows\System\cwlAgIY.exe
  C:\Windows\System\cwlAgIY.exe
  2⤵
  PID:11096
- C:\Windows\System\xCNDCht.exe
  C:\Windows\System\xCNDCht.exe
  2⤵
  PID:11128
- C:\Windows\System\HaClHhr.exe
  C:\Windows\System\HaClHhr.exe
  2⤵
  PID:11152
- C:\Windows\System\YxzdRVJ.exe
  C:\Windows\System\YxzdRVJ.exe
  2⤵
  PID:11172
- C:\Windows\System\ROKKdBU.exe
  C:\Windows\System\ROKKdBU.exe
  2⤵
  PID:11204
- C:\Windows\System\PnLBrky.exe
  C:\Windows\System\PnLBrky.exe
  2⤵
  PID:11248
- C:\Windows\System\LvBlwCs.exe
  C:\Windows\System\LvBlwCs.exe
  2⤵
  PID:9396
- C:\Windows\System\wwyvoao.exe
  C:\Windows\System\wwyvoao.exe
  2⤵
  PID:10272
- C:\Windows\System\WWsggYZ.exe
  C:\Windows\System\WWsggYZ.exe
  2⤵
  PID:10336
- C:\Windows\System\RxLkMPl.exe
  C:\Windows\System\RxLkMPl.exe
  2⤵
  PID:10412
- C:\Windows\System\zdPxPGH.exe
  C:\Windows\System\zdPxPGH.exe
  2⤵
  PID:10452
- C:\Windows\System\THrHFnu.exe
  C:\Windows\System\THrHFnu.exe
  2⤵
  PID:10532
- C:\Windows\System\jYGnaze.exe
  C:\Windows\System\jYGnaze.exe
  2⤵
  PID:10568
- C:\Windows\System\JffxTSK.exe
  C:\Windows\System\JffxTSK.exe
  2⤵
  PID:10628
- C:\Windows\System\FwXUrNB.exe
  C:\Windows\System\FwXUrNB.exe
  2⤵
  PID:10688
- C:\Windows\System\JkAHgeW.exe
  C:\Windows\System\JkAHgeW.exe
  2⤵
  PID:10800
- C:\Windows\System\gceMmgF.exe
  C:\Windows\System\gceMmgF.exe
  2⤵
  PID:10844
- C:\Windows\System\fzpFpBs.exe
  C:\Windows\System\fzpFpBs.exe
  2⤵
  PID:10904
- C:\Windows\System\cqHXHUC.exe
  C:\Windows\System\cqHXHUC.exe
  2⤵
  PID:10984
- C:\Windows\System\sfOzNBL.exe
  C:\Windows\System\sfOzNBL.exe
  2⤵
  PID:11044
- C:\Windows\System\IaVSLcf.exe
  C:\Windows\System\IaVSLcf.exe
  2⤵
  PID:11088
- C:\Windows\System\BLrwQrp.exe
  C:\Windows\System\BLrwQrp.exe
  2⤵
  PID:11148
- C:\Windows\System\dKcReWF.exe
  C:\Windows\System\dKcReWF.exe
  2⤵
  PID:11180
- C:\Windows\System\ufzgpDc.exe
  C:\Windows\System\ufzgpDc.exe
  2⤵
  PID:11260
- C:\Windows\System\OzDFPwB.exe
  C:\Windows\System\OzDFPwB.exe
  2⤵
  PID:10496
- C:\Windows\System\YEPMZSL.exe
  C:\Windows\System\YEPMZSL.exe
  2⤵
  PID:10624
- C:\Windows\System\SyDKOgw.exe
  C:\Windows\System\SyDKOgw.exe
  2⤵
  PID:10816
- C:\Windows\System\GGqSkpJ.exe
  C:\Windows\System\GGqSkpJ.exe
  2⤵
  PID:10964
- C:\Windows\System\OGGoAbL.exe
  C:\Windows\System\OGGoAbL.exe
  2⤵
  PID:11108
- C:\Windows\System\tXPgFyE.exe
  C:\Windows\System\tXPgFyE.exe
  2⤵
  PID:11192
- C:\Windows\System\WgkXudK.exe
  C:\Windows\System\WgkXudK.exe
  2⤵
  PID:10440
- C:\Windows\System\CKdOuPU.exe
  C:\Windows\System\CKdOuPU.exe
  2⤵
  PID:10956
- C:\Windows\System\opEgsnN.exe
  C:\Windows\System\opEgsnN.exe
  2⤵
  PID:10668
- C:\Windows\System\xlEtxPV.exe
  C:\Windows\System\xlEtxPV.exe
  2⤵
  PID:11228
- C:\Windows\System\QaDUGur.exe
  C:\Windows\System\QaDUGur.exe
  2⤵
  PID:11268
- C:\Windows\System\JfOtIYp.exe
  C:\Windows\System\JfOtIYp.exe
  2⤵
  PID:11296
- C:\Windows\System\CdTnLcq.exe
  C:\Windows\System\CdTnLcq.exe
  2⤵
  PID:11332
- C:\Windows\System\gSWoDKe.exe
  C:\Windows\System\gSWoDKe.exe
  2⤵
  PID:11348
- C:\Windows\System\PKoghEM.exe
  C:\Windows\System\PKoghEM.exe
  2⤵
  PID:11368
- C:\Windows\System\KITTKRK.exe
  C:\Windows\System\KITTKRK.exe
  2⤵
  PID:11396
- C:\Windows\System\bRGKQzU.exe
  C:\Windows\System\bRGKQzU.exe
  2⤵
  PID:11428
- C:\Windows\System\ZwAwupk.exe
  C:\Windows\System\ZwAwupk.exe
  2⤵
  PID:11484
- C:\Windows\System\jjGNrpd.exe
  C:\Windows\System\jjGNrpd.exe
  2⤵
  PID:11500
- C:\Windows\System\WorhEkL.exe
  C:\Windows\System\WorhEkL.exe
  2⤵
  PID:11516
- C:\Windows\System\ehNCFpI.exe
  C:\Windows\System\ehNCFpI.exe
  2⤵
  PID:11572
- C:\Windows\System\WqLvwOf.exe
  C:\Windows\System\WqLvwOf.exe
  2⤵
  PID:11600
- C:\Windows\System\MJHLLUf.exe
  C:\Windows\System\MJHLLUf.exe
  2⤵
  PID:11616
- C:\Windows\System\yXTpPiI.exe
  C:\Windows\System\yXTpPiI.exe
  2⤵
  PID:11668
- C:\Windows\System\cxQgchU.exe
  C:\Windows\System\cxQgchU.exe
  2⤵
  PID:11692
- C:\Windows\System\TYZRqjr.exe
  C:\Windows\System\TYZRqjr.exe
  2⤵
  PID:11724
- C:\Windows\System\HxFcYRl.exe
  C:\Windows\System\HxFcYRl.exe
  2⤵
  PID:11768
- C:\Windows\System\PqtNcTY.exe
  C:\Windows\System\PqtNcTY.exe
  2⤵
  PID:11796
- C:\Windows\System\SPDInnu.exe
  C:\Windows\System\SPDInnu.exe
  2⤵
  PID:11816
- C:\Windows\System\gVYQlhI.exe
  C:\Windows\System\gVYQlhI.exe
  2⤵
  PID:11848
- C:\Windows\System\MrBvsPz.exe
  C:\Windows\System\MrBvsPz.exe
  2⤵
  PID:11868
- C:\Windows\System\WZnEMyo.exe
  C:\Windows\System\WZnEMyo.exe
  2⤵
  PID:11912
- C:\Windows\System\RWixgia.exe
  C:\Windows\System\RWixgia.exe
  2⤵
  PID:11940
- C:\Windows\System\NtsdaWV.exe
  C:\Windows\System\NtsdaWV.exe
  2⤵
  PID:11964
- C:\Windows\System\yJnmpuJ.exe
  C:\Windows\System\yJnmpuJ.exe
  2⤵
  PID:11988
- C:\Windows\System\kbkRkHI.exe
  C:\Windows\System\kbkRkHI.exe
  2⤵
  PID:12020
- C:\Windows\System\hcXHaXX.exe
  C:\Windows\System\hcXHaXX.exe
  2⤵
  PID:12044
- C:\Windows\System\eohtpLf.exe
  C:\Windows\System\eohtpLf.exe
  2⤵
  PID:12064
- C:\Windows\System\kQqNfBW.exe
  C:\Windows\System\kQqNfBW.exe
  2⤵
  PID:12096
- C:\Windows\System\DbmoHic.exe
  C:\Windows\System\DbmoHic.exe
  2⤵
  PID:12136
- C:\Windows\System\wbtOWOX.exe
  C:\Windows\System\wbtOWOX.exe
  2⤵
  PID:12152
- C:\Windows\System\QGJObfN.exe
  C:\Windows\System\QGJObfN.exe
  2⤵
  PID:12192
- C:\Windows\System\xfjADqF.exe
  C:\Windows\System\xfjADqF.exe
  2⤵
  PID:12212
- C:\Windows\System\cEXNApI.exe
  C:\Windows\System\cEXNApI.exe
  2⤵
  PID:12248
- C:\Windows\System\SNQfLIb.exe
  C:\Windows\System\SNQfLIb.exe
  2⤵
  PID:12276
- C:\Windows\System\YqbgHwf.exe
  C:\Windows\System\YqbgHwf.exe
  2⤵
  PID:11324
- C:\Windows\System\QsxARYA.exe
  C:\Windows\System\QsxARYA.exe
  2⤵
  PID:11356
- C:\Windows\System\RNPwmsb.exe
  C:\Windows\System\RNPwmsb.exe
  2⤵
  PID:11420
- C:\Windows\System\ZSXUXzj.exe
  C:\Windows\System\ZSXUXzj.exe
  2⤵
  PID:11012
- C:\Windows\System\GKXCZDw.exe
  C:\Windows\System\GKXCZDw.exe
  2⤵
  PID:11564
- C:\Windows\System\fcmabdW.exe
  C:\Windows\System\fcmabdW.exe
  2⤵
  PID:11560
- C:\Windows\System\IOTQWIJ.exe
  C:\Windows\System\IOTQWIJ.exe
  2⤵
  PID:11664
- C:\Windows\System\fgZVsJD.exe
  C:\Windows\System\fgZVsJD.exe
  2⤵
  PID:11788
- C:\Windows\System\XbuupJu.exe
  C:\Windows\System\XbuupJu.exe
  2⤵
  PID:11856
- C:\Windows\System\EQdJIME.exe
  C:\Windows\System\EQdJIME.exe
  2⤵
  PID:11932
- C:\Windows\System\NMekgeK.exe
  C:\Windows\System\NMekgeK.exe
  2⤵
  PID:11976
- C:\Windows\System\mOxAqoz.exe
  C:\Windows\System\mOxAqoz.exe
  2⤵
  PID:12040
- C:\Windows\System\ierKLsX.exe
  C:\Windows\System\ierKLsX.exe
  2⤵
  PID:12124
- C:\Windows\System\OTSrPPi.exe
  C:\Windows\System\OTSrPPi.exe
  2⤵
  PID:12184
- C:\Windows\System\rKqbPUi.exe
  C:\Windows\System\rKqbPUi.exe
  2⤵
  PID:12232
- C:\Windows\System\pjjmUkr.exe
  C:\Windows\System\pjjmUkr.exe
  2⤵
  PID:11340
- C:\Windows\System\rXicOiN.exe
  C:\Windows\System\rXicOiN.exe
  2⤵
  PID:11452
- C:\Windows\System\ucyeDoT.exe
  C:\Windows\System\ucyeDoT.exe
  2⤵
  PID:11608
- C:\Windows\System\WVsbKOO.exe
  C:\Windows\System\WVsbKOO.exe
  2⤵
  PID:11764
- C:\Windows\System\AyzdRzY.exe
  C:\Windows\System\AyzdRzY.exe
  2⤵
  PID:11928
- C:\Windows\System\FeYzHBc.exe
  C:\Windows\System\FeYzHBc.exe
  2⤵
  PID:12028
- C:\Windows\System\BvOdegV.exe
  C:\Windows\System\BvOdegV.exe
  2⤵
  PID:12264
- C:\Windows\System\TeEtNuu.exe
  C:\Windows\System\TeEtNuu.exe
  2⤵
  PID:11444
- C:\Windows\System\WNCyKKi.exe
  C:\Windows\System\WNCyKKi.exe
  2⤵
  PID:11544
- C:\Windows\System\ybPIMWu.exe
  C:\Windows\System\ybPIMWu.exe
  2⤵
  PID:11956
- C:\Windows\System\VMvobze.exe
  C:\Windows\System\VMvobze.exe
  2⤵
  PID:11316
- C:\Windows\System\hMISRvx.exe
  C:\Windows\System\hMISRvx.exe
  2⤵
  PID:12292
- C:\Windows\System\lkVKsWA.exe
  C:\Windows\System\lkVKsWA.exe
  2⤵
  PID:12332
- C:\Windows\System\zbyriYM.exe
  C:\Windows\System\zbyriYM.exe
  2⤵
  PID:12364
- C:\Windows\System\sdRZVtq.exe
  C:\Windows\System\sdRZVtq.exe
  2⤵
  PID:12392
- C:\Windows\System\ZdIsHjG.exe
  C:\Windows\System\ZdIsHjG.exe
  2⤵
  PID:12420
- C:\Windows\System\YWYUlEZ.exe
  C:\Windows\System\YWYUlEZ.exe
  2⤵
  PID:12448
- C:\Windows\System\OYRbdmr.exe
  C:\Windows\System\OYRbdmr.exe
  2⤵
  PID:12480
- C:\Windows\System\bAmKmlz.exe
  C:\Windows\System\bAmKmlz.exe
  2⤵
  PID:12508
- C:\Windows\System\FWpWYSS.exe
  C:\Windows\System\FWpWYSS.exe
  2⤵
  PID:12528
- C:\Windows\System\xKYETua.exe
  C:\Windows\System\xKYETua.exe
  2⤵
  PID:12552
- C:\Windows\System\sBzyayk.exe
  C:\Windows\System\sBzyayk.exe
  2⤵
  PID:12596
- C:\Windows\System\sEHKcEc.exe
  C:\Windows\System\sEHKcEc.exe
  2⤵
  PID:12628
- C:\Windows\System\gEIonOI.exe
  C:\Windows\System\gEIonOI.exe
  2⤵
  PID:12656
- C:\Windows\System\kNRLvND.exe
  C:\Windows\System\kNRLvND.exe
  2⤵
  PID:12700
- C:\Windows\System\dXvFNuM.exe
  C:\Windows\System\dXvFNuM.exe
  2⤵
  PID:12728
- C:\Windows\System\sNlkacS.exe
  C:\Windows\System\sNlkacS.exe
  2⤵
  PID:12748
- C:\Windows\System\bfMdrJU.exe
  C:\Windows\System\bfMdrJU.exe
  2⤵
  PID:12772
- C:\Windows\System\XTbFiuX.exe
  C:\Windows\System\XTbFiuX.exe
  2⤵
  PID:12792
- C:\Windows\System\iNFRshc.exe
  C:\Windows\System\iNFRshc.exe
  2⤵
  PID:12828
- C:\Windows\System\gbUULKT.exe
  C:\Windows\System\gbUULKT.exe
  2⤵
  PID:12856
- C:\Windows\System\mUPriwW.exe
  C:\Windows\System\mUPriwW.exe
  2⤵
  PID:12888
- C:\Windows\System\LTZTdbu.exe
  C:\Windows\System\LTZTdbu.exe
  2⤵
  PID:12928
- C:\Windows\System\jURIARj.exe
  C:\Windows\System\jURIARj.exe
  2⤵
  PID:12948
- C:\Windows\System\lThHjho.exe
  C:\Windows\System\lThHjho.exe
  2⤵
  PID:12972
- C:\Windows\System\oMwhgTM.exe
  C:\Windows\System\oMwhgTM.exe
  2⤵
  PID:12992
- C:\Windows\System\WfgbuPk.exe
  C:\Windows\System\WfgbuPk.exe
  2⤵
  PID:13028
- C:\Windows\System\nboFqKL.exe
  C:\Windows\System\nboFqKL.exe
  2⤵
  PID:13076
- C:\Windows\System\aBINWPU.exe
  C:\Windows\System\aBINWPU.exe
  2⤵
  PID:13100
- C:\Windows\System\SrOAQBu.exe
  C:\Windows\System\SrOAQBu.exe
  2⤵
  PID:13132
- C:\Windows\System\okEbYBX.exe
  C:\Windows\System\okEbYBX.exe
  2⤵
  PID:13156
- C:\Windows\System\OQamHKa.exe
  C:\Windows\System\OQamHKa.exe
  2⤵
  PID:13188
- C:\Windows\System\wVNsyYe.exe
  C:\Windows\System\wVNsyYe.exe
  2⤵
  PID:13208
- C:\Windows\System\fJIovnF.exe
  C:\Windows\System\fJIovnF.exe
  2⤵
  PID:13232
- C:\Windows\System\reawQyA.exe
  C:\Windows\System\reawQyA.exe
  2⤵
  PID:13284
- C:\Windows\System\RbxnYHi.exe
  C:\Windows\System\RbxnYHi.exe
  2⤵
  PID:11960
- C:\Windows\System\UzOWtbH.exe
  C:\Windows\System\UzOWtbH.exe
  2⤵
  PID:12016
- C:\Windows\System\vQbCMvs.exe
  C:\Windows\System\vQbCMvs.exe
  2⤵
  PID:12328
- C:\Windows\System\dFkQjLG.exe
  C:\Windows\System\dFkQjLG.exe
  2⤵
  PID:12476
- C:\Windows\System\HAZfhlP.exe
  C:\Windows\System\HAZfhlP.exe
  2⤵
  PID:12472
- C:\Windows\System\oIFUWAN.exe
  C:\Windows\System\oIFUWAN.exe
  2⤵
  PID:12516
- C:\Windows\System\TjKdjjd.exe
  C:\Windows\System\TjKdjjd.exe
  2⤵
  PID:12616
- C:\Windows\System\CVTkiJX.exe
  C:\Windows\System\CVTkiJX.exe
  2⤵
  PID:12712
- C:\Windows\System\mbywcNh.exe
  C:\Windows\System\mbywcNh.exe
  2⤵
  PID:12804
- C:\Windows\System\kseViNh.exe
  C:\Windows\System\kseViNh.exe
  2⤵
  PID:12864
- C:\Windows\System\XtcrojG.exe
  C:\Windows\System\XtcrojG.exe
  2⤵
  PID:12936
- C:\Windows\System\EZqPFqb.exe
  C:\Windows\System\EZqPFqb.exe
  2⤵
  PID:12960
- C:\Windows\System\hVCBuzF.exe
  C:\Windows\System\hVCBuzF.exe
  2⤵
  PID:13092
- C:\Windows\System\RAXWpII.exe
  C:\Windows\System\RAXWpII.exe
  2⤵
  PID:13244
- C:\Windows\System\muiANtR.exe
  C:\Windows\System\muiANtR.exe
  2⤵
  PID:13304
- C:\Windows\System\iwxOOSD.exe
  C:\Windows\System\iwxOOSD.exe
  2⤵
  PID:12408
- C:\Windows\System\YdptKRL.exe
  C:\Windows\System\YdptKRL.exe
  2⤵
  PID:12592
- C:\Windows\System\ZWrdGCJ.exe
  C:\Windows\System\ZWrdGCJ.exe
  2⤵
  PID:12840
- C:\Windows\System\wWWhqEf.exe
  C:\Windows\System\wWWhqEf.exe
  2⤵
  PID:12900
- C:\Windows\System\yyHFIJv.exe
  C:\Windows\System\yyHFIJv.exe
  2⤵
  PID:13264
- C:\Windows\System\DBSgayQ.exe
  C:\Windows\System\DBSgayQ.exe
  2⤵
  PID:12620
- C:\Windows\System\fbMQCBb.exe
  C:\Windows\System\fbMQCBb.exe
  2⤵
  PID:13316
- C:\Windows\System\mJytxNQ.exe
  C:\Windows\System\mJytxNQ.exe
  2⤵
  PID:13340
- C:\Windows\System\MFSiLXV.exe
  C:\Windows\System\MFSiLXV.exe
  2⤵
  PID:13364
- C:\Windows\System\AMEzhmO.exe
  C:\Windows\System\AMEzhmO.exe
  2⤵
  PID:13384
- C:\Windows\System\daqTIJI.exe
  C:\Windows\System\daqTIJI.exe
  2⤵
  PID:13424
- C:\Windows\System\VidFjVQ.exe
  C:\Windows\System\VidFjVQ.exe
  2⤵
  PID:13452
- C:\Windows\System\bqocHic.exe
  C:\Windows\System\bqocHic.exe
  2⤵
  PID:13476
- C:\Windows\System\pcJTFWD.exe
  C:\Windows\System\pcJTFWD.exe
  2⤵
  PID:13496
- C:\Windows\System\aFmToDD.exe
  C:\Windows\System\aFmToDD.exe
  2⤵
  PID:13536
- C:\Windows\System\dRdZCku.exe
  C:\Windows\System\dRdZCku.exe
  2⤵
  PID:13564
- C:\Windows\System\FbltVTa.exe
  C:\Windows\System\FbltVTa.exe
  2⤵
  PID:13612
- C:\Windows\System\kOQCYYw.exe
  C:\Windows\System\kOQCYYw.exe
  2⤵
  PID:13636
- C:\Windows\System\RttdqpG.exe
  C:\Windows\System\RttdqpG.exe
  2⤵
  PID:13660
- C:\Windows\System\TmNnrMh.exe
  C:\Windows\System\TmNnrMh.exe
  2⤵
  PID:13688
- C:\Windows\System\TmqgjDM.exe
  C:\Windows\System\TmqgjDM.exe
  2⤵
  PID:13724
- C:\Windows\System\pRNVJrn.exe
  C:\Windows\System\pRNVJrn.exe
  2⤵
  PID:13744
- C:\Windows\System\WTrZkMH.exe
  C:\Windows\System\WTrZkMH.exe
  2⤵
  PID:13776
- C:\Windows\System\qVVsPvu.exe
  C:\Windows\System\qVVsPvu.exe
  2⤵
  PID:13792
- C:\Windows\System\CrJcDGI.exe
  C:\Windows\System\CrJcDGI.exe
  2⤵
  PID:13808
- C:\Windows\System\FqydTRx.exe
  C:\Windows\System\FqydTRx.exe
  2⤵
  PID:13828
- C:\Windows\System\FwOdkwf.exe
  C:\Windows\System\FwOdkwf.exe
  2⤵
  PID:13860
- C:\Windows\System\IPATMmx.exe
  C:\Windows\System\IPATMmx.exe
  2⤵
  PID:13900
- C:\Windows\System\rwGOTxN.exe
  C:\Windows\System\rwGOTxN.exe
  2⤵
  PID:13916
- C:\Windows\System\GqgWBLd.exe
  C:\Windows\System\GqgWBLd.exe
  2⤵
  PID:13948
- C:\Windows\System\fRveVZT.exe
  C:\Windows\System\fRveVZT.exe
  2⤵
  PID:14012
- C:\Windows\System\cIXxWlf.exe
  C:\Windows\System\cIXxWlf.exe
  2⤵
  PID:14048
- C:\Windows\System\lJWHtxA.exe
  C:\Windows\System\lJWHtxA.exe
  2⤵
  PID:14068
- C:\Windows\System\LuBWLJv.exe
  C:\Windows\System\LuBWLJv.exe
  2⤵
  PID:14108
- C:\Windows\System\dLhgdwU.exe
  C:\Windows\System\dLhgdwU.exe
  2⤵
  PID:14128
- C:\Windows\System\DJJfdsN.exe
  C:\Windows\System\DJJfdsN.exe
  2⤵
  PID:14156
- C:\Windows\System\pBDyCgi.exe
  C:\Windows\System\pBDyCgi.exe
  2⤵
  PID:14212
- C:\Windows\System\rVYvVdD.exe
  C:\Windows\System\rVYvVdD.exe
  2⤵
  PID:14232
- C:\Windows\System\sUQwhMn.exe
  C:\Windows\System\sUQwhMn.exe
  2⤵
  PID:14256
- C:\Windows\System\LZzJGYw.exe
  C:\Windows\System\LZzJGYw.exe
  2⤵
  PID:14284
- C:\Windows\System\xpZbZOz.exe
  C:\Windows\System\xpZbZOz.exe
  2⤵
  PID:14308
- C:\Windows\System\kOsJnxy.exe
  C:\Windows\System\kOsJnxy.exe
  2⤵
  PID:14332
- C:\Windows\System\rzfjtzA.exe
  C:\Windows\System\rzfjtzA.exe
  2⤵
  PID:13372
- C:\Windows\System\GQnNkhB.exe
  C:\Windows\System\GQnNkhB.exe
  2⤵
  PID:13440
- C:\Windows\System\zeHydzz.exe
  C:\Windows\System\zeHydzz.exe
  2⤵
  PID:13484
- C:\Windows\System\OvNbfEt.exe
  C:\Windows\System\OvNbfEt.exe
  2⤵
  PID:13552
- C:\Windows\System\OiMfNdl.exe
  C:\Windows\System\OiMfNdl.exe
  2⤵
  PID:13676
- C:\Windows\System\TtvCCbB.exe
  C:\Windows\System\TtvCCbB.exe
  2⤵
  PID:13684
- C:\Windows\System\giaffxi.exe
  C:\Windows\System\giaffxi.exe
  2⤵
  PID:13736
- C:\Windows\System\JsNwyiB.exe
  C:\Windows\System\JsNwyiB.exe
  2⤵
  PID:13816
- C:\Windows\System\bIjgmlg.exe
  C:\Windows\System\bIjgmlg.exe
  2⤵
  PID:13892
- C:\Windows\System\pwjgIry.exe
  C:\Windows\System\pwjgIry.exe
  2⤵
  PID:14000
- C:\Windows\System\rERrdjh.exe
  C:\Windows\System\rERrdjh.exe
  2⤵
  PID:13972
- C:\Windows\System\CjtFemT.exe
  C:\Windows\System\CjtFemT.exe
  2⤵
  PID:14148
- C:\Windows\System\yRspUKJ.exe
  C:\Windows\System\yRspUKJ.exe
  2⤵
  PID:14220
- C:\Windows\System\qkyFKuy.exe
  C:\Windows\System\qkyFKuy.exe
  2⤵
  PID:14300
- C:\Windows\System\nMWeWRJ.exe
  C:\Windows\System\nMWeWRJ.exe
  2⤵
  PID:13324
- C:\Windows\System\AoVMzlI.exe
  C:\Windows\System\AoVMzlI.exe
  2⤵
  PID:13412
- C:\Windows\System\WvDwDtz.exe
  C:\Windows\System\WvDwDtz.exe
  2⤵
  PID:13632
- C:\Windows\System\UlwTCwB.exe
  C:\Windows\System\UlwTCwB.exe
  2⤵
  PID:13768
- C:\Windows\System\ZBgrgoH.exe
  C:\Windows\System\ZBgrgoH.exe
  2⤵
  PID:13928
- C:\Windows\System\UpYLxGU.exe
  C:\Windows\System\UpYLxGU.exe
  2⤵
  PID:14188
- C:\Windows\System\RApRqvx.exe
  C:\Windows\System\RApRqvx.exe
  2⤵
  PID:14252
- C:\Windows\System\HnUUVNV.exe
  C:\Windows\System\HnUUVNV.exe
  2⤵
  PID:13524
- C:\Windows\System\OWQxjiN.exe
  C:\Windows\System\OWQxjiN.exe
  2⤵
  PID:14124
- C:\Windows\System\BQKFJsk.exe
  C:\Windows\System\BQKFJsk.exe
  2⤵
  PID:13436
- C:\Windows\System\kDxaMKE.exe
  C:\Windows\System\kDxaMKE.exe
  2⤵
  PID:14344
- C:\Windows\System\dmJnZvh.exe
  C:\Windows\System\dmJnZvh.exe
  2⤵
  PID:14396
- C:\Windows\System\ELdDqdz.exe
  C:\Windows\System\ELdDqdz.exe
  2⤵
  PID:14420
- C:\Windows\System\zlgmJin.exe
  C:\Windows\System\zlgmJin.exe
  2⤵
  PID:14448
- C:\Windows\System\iSFgFbR.exe
  C:\Windows\System\iSFgFbR.exe
  2⤵
  PID:14464
- C:\Windows\System\rsdPbMl.exe
  C:\Windows\System\rsdPbMl.exe
  2⤵
  PID:14492
- C:\Windows\System\KdRAqBD.exe
  C:\Windows\System\KdRAqBD.exe
  2⤵
  PID:14520
- C:\Windows\System\OnAQkCK.exe
  C:\Windows\System\OnAQkCK.exe
  2⤵
  PID:14540
- C:\Windows\System\aHcdRas.exe
  C:\Windows\System\aHcdRas.exe
  2⤵
  PID:14560
- C:\Windows\System\PTSbyVE.exe
  C:\Windows\System\PTSbyVE.exe
  2⤵
  PID:14592
- C:\Windows\System\cGQQjKS.exe
  C:\Windows\System\cGQQjKS.exe
  2⤵
  PID:14620
- C:\Windows\System\sYFGZno.exe
  C:\Windows\System\sYFGZno.exe
  2⤵
  PID:14648
- C:\Windows\System\BWZXidS.exe
  C:\Windows\System\BWZXidS.exe
  2⤵
  PID:14672
- C:\Windows\System\lsDjipe.exe
  C:\Windows\System\lsDjipe.exe
  2⤵
  PID:14696
- C:\Windows\System\saZJWnV.exe
  C:\Windows\System\saZJWnV.exe
  2⤵
  PID:14712
- C:\Windows\System\rZFWiRm.exe
  C:\Windows\System\rZFWiRm.exe
  2⤵
  PID:14728
- C:\Windows\System\PQjwSIh.exe
  C:\Windows\System\PQjwSIh.exe
  2⤵
  PID:14752
- C:\Windows\System\IETsbwK.exe
  C:\Windows\System\IETsbwK.exe
  2⤵
  PID:14812
- C:\Windows\System\qsPMXDO.exe
  C:\Windows\System\qsPMXDO.exe
  2⤵
  PID:14844
- C:\Windows\System\wPkOvkz.exe
  C:\Windows\System\wPkOvkz.exe
  2⤵
  PID:14860
- C:\Windows\System\Ymwoath.exe
  C:\Windows\System\Ymwoath.exe
  2⤵
  PID:14880
- C:\Windows\System\jnqaCQy.exe
  C:\Windows\System\jnqaCQy.exe
  2⤵
  PID:14928
- C:\Windows\System\lhqkfdV.exe
  C:\Windows\System\lhqkfdV.exe
  2⤵
  PID:14976
- C:\Windows\System\BjZqsaR.exe
  C:\Windows\System\BjZqsaR.exe
  2⤵
  PID:15004
- C:\Windows\System\XJOLXAx.exe
  C:\Windows\System\XJOLXAx.exe
  2⤵
  PID:15028
- C:\Windows\System\zvsEgtN.exe
  C:\Windows\System\zvsEgtN.exe
  2⤵
  PID:15068
- C:\Windows\System\qZCsltO.exe
  C:\Windows\System\qZCsltO.exe
  2⤵
  PID:15096
- C:\Windows\System\DADSMTG.exe
  C:\Windows\System\DADSMTG.exe
  2⤵
  PID:15112
- C:\Windows\System\ExdpVdO.exe
  C:\Windows\System\ExdpVdO.exe
  2⤵
  PID:15148
- C:\Windows\System\xXEcMVy.exe
  C:\Windows\System\xXEcMVy.exe
  2⤵
  PID:15164
- C:\Windows\System\VPRuZuX.exe
  C:\Windows\System\VPRuZuX.exe
  2⤵
  PID:15188
- C:\Windows\System\TrZpnDj.exe
  C:\Windows\System\TrZpnDj.exe
  2⤵
  PID:15212
- C:\Windows\System\fhcfiNx.exe
  C:\Windows\System\fhcfiNx.exe
  2⤵
  PID:15244
- C:\Windows\System\CrKYNyO.exe
  C:\Windows\System\CrKYNyO.exe
  2⤵
  PID:15260
- C:\Windows\System\YVAEetG.exe
  C:\Windows\System\YVAEetG.exe
  2⤵
  PID:15292
- C:\Windows\System\blVlSoy.exe
  C:\Windows\System\blVlSoy.exe
  2⤵
  PID:15352
- C:\Windows\System\vlnSkSU.exe
  C:\Windows\System\vlnSkSU.exe
  2⤵
  PID:14356
- C:\Windows\System\qJQcvNk.exe
  C:\Windows\System\qJQcvNk.exe
  2⤵
  PID:14416
- C:\Windows\System\XKCrMsM.exe
  C:\Windows\System\XKCrMsM.exe
  2⤵
  PID:14460
- C:\Windows\System\TosjINH.exe
  C:\Windows\System\TosjINH.exe
  2⤵
  PID:14484
- C:\Windows\System\sckcEED.exe
  C:\Windows\System\sckcEED.exe
  2⤵
  PID:14552
- C:\Windows\System\Qwwfxji.exe
  C:\Windows\System\Qwwfxji.exe
  2⤵
  PID:14616
- C:\Windows\System\benMYEn.exe
  C:\Windows\System\benMYEn.exe
  2⤵
  PID:14660
- C:\Windows\System\MbJrjjM.exe
  C:\Windows\System\MbJrjjM.exe
  2⤵
  PID:14708
- C:\Windows\System\LbOTtUo.exe
  C:\Windows\System\LbOTtUo.exe
  2⤵
  PID:14824
- C:\Windows\System\AfMwnQJ.exe
  C:\Windows\System\AfMwnQJ.exe
  2⤵
  PID:14876
- C:\Windows\System\pxxUTxy.exe
  C:\Windows\System\pxxUTxy.exe
  2⤵
  PID:14872
- C:\Windows\System\LVoPdei.exe
  C:\Windows\System\LVoPdei.exe
  2⤵
  PID:14964
- C:\Windows\System\TMtxRqV.exe
  C:\Windows\System\TMtxRqV.exe
  2⤵
  PID:15012
- C:\Windows\System\VfGfUCR.exe
  C:\Windows\System\VfGfUCR.exe
  2⤵
  PID:15176
- C:\Windows\System\rlYSTXn.exe
  C:\Windows\System\rlYSTXn.exe
  2⤵
  PID:15288
- C:\Windows\System\xFKqCWv.exe
  C:\Windows\System\xFKqCWv.exe
  2⤵
  PID:15252
- C:\Windows\System\XObTiSJ.exe
  C:\Windows\System\XObTiSJ.exe
  2⤵
  PID:15328
- C:\Windows\System\Rfcgwdc.exe
  C:\Windows\System\Rfcgwdc.exe
  2⤵
  PID:14436
- C:\Windows\System\hshZKro.exe
  C:\Windows\System\hshZKro.exe
  2⤵
  PID:14572
- C:\Windows\System\pJjFSrY.exe
  C:\Windows\System\pJjFSrY.exe
  2⤵
  PID:14724
- C:\Windows\System\YDKirxt.exe
  C:\Windows\System\YDKirxt.exe
  2⤵
  PID:14808
- C:\Windows\System\posYFQl.exe
  C:\Windows\System\posYFQl.exe
  2⤵
  PID:14900
- C:\Windows\System\XfgPqSH.exe
  C:\Windows\System\XfgPqSH.exe
  2⤵
  PID:15108
- C:\Windows\System\XjQJrkT.exe
  C:\Windows\System\XjQJrkT.exe
  2⤵
  PID:15332
- C:\Windows\System\XcGAFbA.exe
  C:\Windows\System\XcGAFbA.exe
  2⤵
  PID:14644
- C:\Windows\System\WBDWIRA.exe
  C:\Windows\System\WBDWIRA.exe
  2⤵
  PID:14688
- C:\Windows\System\rNOwxEo.exe
  C:\Windows\System\rNOwxEo.exe
  2⤵
  PID:14628
- C:\Windows\System\UDISxJf.exe
  C:\Windows\System\UDISxJf.exe
  2⤵
  PID:15368
- C:\Windows\System\IukPodn.exe
  C:\Windows\System\IukPodn.exe
  2⤵
  PID:15384
- C:\Windows\System\DBcjZEZ.exe
  C:\Windows\System\DBcjZEZ.exe
  2⤵
  PID:15424
- C:\Windows\System\TvQZHqW.exe
  C:\Windows\System\TvQZHqW.exe
  2⤵
  PID:15456
- C:\Windows\System\MgUonFm.exe
  C:\Windows\System\MgUonFm.exe
  2⤵
  PID:15480
- C:\Windows\System\ztCdIUY.exe
  C:\Windows\System\ztCdIUY.exe
  2⤵
  PID:15508
- C:\Windows\System\sQDIfzn.exe
  C:\Windows\System\sQDIfzn.exe
  2⤵
  PID:15528
- C:\Windows\System\gQkkaaj.exe
  C:\Windows\System\gQkkaaj.exe
  2⤵
  PID:15552
- C:\Windows\System\HpvCYzE.exe
  C:\Windows\System\HpvCYzE.exe
  2⤵
  PID:15576
- C:\Windows\System\nSIVxiT.exe
  C:\Windows\System\nSIVxiT.exe
  2⤵
  PID:15616
- C:\Windows\System\HELdtEm.exe
  C:\Windows\System\HELdtEm.exe
  2⤵
  PID:15680
- C:\Windows\System\SXdsSuf.exe
  C:\Windows\System\SXdsSuf.exe
  2⤵
  PID:15696
- C:\Windows\System\zCqfcIg.exe
  C:\Windows\System\zCqfcIg.exe
  2⤵
  PID:15720
- C:\Windows\System\XTjwMSj.exe
  C:\Windows\System\XTjwMSj.exe
  2⤵
  PID:15756
- C:\Windows\System\HlGVISC.exe
  C:\Windows\System\HlGVISC.exe
  2⤵
  PID:15796
- C:\Windows\System\aWMWQEy.exe
  C:\Windows\System\aWMWQEy.exe
  2⤵
  PID:15820
- C:\Windows\System\NwCXhxa.exe
  C:\Windows\System\NwCXhxa.exe
  2⤵
  PID:15852
- C:\Windows\System\hZKKVcQ.exe
  C:\Windows\System\hZKKVcQ.exe
  2⤵
  PID:15876
- C:\Windows\System\gWvusVs.exe
  C:\Windows\System\gWvusVs.exe
  2⤵
  PID:15904
- C:\Windows\System\WgYSNDQ.exe
  C:\Windows\System\WgYSNDQ.exe
  2⤵
  PID:15944
- C:\Windows\System\gEETMdL.exe
  C:\Windows\System\gEETMdL.exe
  2⤵
  PID:15968
- C:\Windows\System\kxVdNYx.exe
  C:\Windows\System\kxVdNYx.exe
  2⤵
  PID:15992
- C:\Windows\System\AfUqrNl.exe
  C:\Windows\System\AfUqrNl.exe
  2⤵
  PID:16016
- C:\Windows\System\jSjSYnb.exe
  C:\Windows\System\jSjSYnb.exe
  2⤵
  PID:16040
- C:\Windows\System\PVLDxZO.exe
  C:\Windows\System\PVLDxZO.exe
  2⤵
  PID:16064
- C:\Windows\System\xhUEYjz.exe
  C:\Windows\System\xhUEYjz.exe
  2⤵
  PID:16096
- C:\Windows\System\dWcJmpq.exe
  C:\Windows\System\dWcJmpq.exe
  2⤵
  PID:16140
- C:\Windows\System\rciNKpE.exe
  C:\Windows\System\rciNKpE.exe
  2⤵
  PID:16164
- C:\Windows\System\pvrBVAm.exe
  C:\Windows\System\pvrBVAm.exe
  2⤵
  PID:16180
- C:\Windows\System\kVWmOXu.exe
  C:\Windows\System\kVWmOXu.exe
  2⤵
  PID:16212
- C:\Windows\System\UZiuUJF.exe
  C:\Windows\System\UZiuUJF.exe
  2⤵
  PID:16248
- C:\Windows\System\kevTdJT.exe
  C:\Windows\System\kevTdJT.exe
  2⤵
  PID:16268
- C:\Windows\System\hgcsnLJ.exe
  C:\Windows\System\hgcsnLJ.exe
  2⤵
  PID:16316
- C:\Windows\System\dlxRZru.exe
  C:\Windows\System\dlxRZru.exe
  2⤵
  PID:16344
- C:\Windows\System\IBnuJSl.exe
  C:\Windows\System\IBnuJSl.exe
  2⤵
  PID:16364
- C:\Windows\System\PkmNMNp.exe
  C:\Windows\System\PkmNMNp.exe
  2⤵
  PID:14508
- C:\Windows\System\wSIGkQc.exe
  C:\Windows\System\wSIGkQc.exe
  2⤵
  PID:15376
- C:\Windows\System\ASCJEyK.exe
  C:\Windows\System\ASCJEyK.exe
  2⤵
  PID:15452
- C:\Windows\System\JuWiLWH.exe
  C:\Windows\System\JuWiLWH.exe
  2⤵
  PID:15500
- C:\Windows\System\cYPdYoX.exe
  C:\Windows\System\cYPdYoX.exe
  2⤵
  PID:15524
- C:\Windows\System\VWDKqAZ.exe
  C:\Windows\System\VWDKqAZ.exe
  2⤵
  PID:15676
- C:\Windows\System\RyrYQRi.exe
  C:\Windows\System\RyrYQRi.exe
  2⤵
  PID:15712
- C:\Windows\System\OBMeCvo.exe
  C:\Windows\System\OBMeCvo.exe
  2⤵
  PID:15832
- C:\Windows\System\rFRZCXq.exe
  C:\Windows\System\rFRZCXq.exe
  2⤵
  PID:15848
- C:\Windows\System\mKraYSu.exe
  C:\Windows\System\mKraYSu.exe
  2⤵
  PID:14868
- C:\Windows\System\icEZqqy.exe
  C:\Windows\System\icEZqqy.exe
  2⤵
  PID:16032
- C:\Windows\System\ZjaZHpl.exe
  C:\Windows\System\ZjaZHpl.exe
  2⤵
  PID:16104
- C:\Windows\System\bgxaXIA.exe
  C:\Windows\System\bgxaXIA.exe
  2⤵
  PID:16160
- C:\Windows\System\oWLKIhJ.exe
  C:\Windows\System\oWLKIhJ.exe
  2⤵
  PID:16232
- C:\Windows\System\oOZtLoF.exe
  C:\Windows\System\oOZtLoF.exe
  2⤵
  PID:16288
- C:\Windows\System\wjMUCOe.exe
  C:\Windows\System\wjMUCOe.exe
  2⤵
  PID:16340
- C:\Windows\System\XsMACnx.exe
  C:\Windows\System\XsMACnx.exe
  2⤵
  PID:15184
- C:\Windows\System\hVZiVPv.exe
  C:\Windows\System\hVZiVPv.exe
  2⤵
  PID:15492
- C:\Windows\System\THGfJIY.exe
  C:\Windows\System\THGfJIY.exe
  2⤵
  PID:15708
- C:\Windows\System\RkXWUgp.exe
  C:\Windows\System\RkXWUgp.exe
  2⤵
  PID:15804
- C:\Windows\System\CocJHnZ.exe
  C:\Windows\System\CocJHnZ.exe
  2⤵
  PID:15872
- C:\Windows\System\RDxAyLe.exe
  C:\Windows\System\RDxAyLe.exe
  2⤵
  PID:15988
- C:\Windows\System\XWPryAz.exe
  C:\Windows\System\XWPryAz.exe
  2⤵
  PID:16256
- C:\Windows\System\cAzTZFX.exe
  C:\Windows\System\cAzTZFX.exe
  2⤵
  PID:16372
- C:\Windows\System\tfJCmAi.exe
  C:\Windows\System\tfJCmAi.exe
  2⤵
  PID:15632
- C:\Windows\System\XLpRErl.exe
  C:\Windows\System\XLpRErl.exe
  2⤵
  PID:15868
- C:\Windows\System\pAvZgup.exe
  C:\Windows\System\pAvZgup.exe
  2⤵
  PID:15560
- C:\Windows\System\AyQQGVm.exe
  C:\Windows\System\AyQQGVm.exe
  2⤵
  PID:16024
- C:\Windows\System\EDgpgIF.exe
  C:\Windows\System\EDgpgIF.exe
  2⤵
  PID:16412
- C:\Windows\System\eqsMpgA.exe
  C:\Windows\System\eqsMpgA.exe
  2⤵
  PID:16448
- C:\Windows\System\ZjGOydd.exe
  C:\Windows\System\ZjGOydd.exe
  2⤵
  PID:16468
- C:\Windows\System\phbzlna.exe
  C:\Windows\System\phbzlna.exe
  2⤵
  PID:16500
- C:\Windows\System\uQVWqPN.exe
  C:\Windows\System\uQVWqPN.exe
  2⤵
  PID:16528
- C:\Windows\System\pMBEDKs.exe
  C:\Windows\System\pMBEDKs.exe
  2⤵
  PID:16552
- C:\Windows\System\jsnmErZ.exe
  C:\Windows\System\jsnmErZ.exe
  2⤵
  PID:16572
- C:\Windows\System\eLdnHOv.exe
  C:\Windows\System\eLdnHOv.exe
  2⤵
  PID:16592
- C:\Windows\System\sgOEqhs.exe
  C:\Windows\System\sgOEqhs.exe
  2⤵
  PID:16616
- C:\Windows\System\KIumATT.exe
  C:\Windows\System\KIumATT.exe
  2⤵
  PID:16636
- C:\Windows\System\RUFBffF.exe
  C:\Windows\System\RUFBffF.exe
  2⤵
  PID:16688
- C:\Windows\System\lozdZJJ.exe
  C:\Windows\System\lozdZJJ.exe
  2⤵
  PID:16716
- C:\Windows\System\hXMvzqg.exe
  C:\Windows\System\hXMvzqg.exe
  2⤵
  PID:16764
- C:\Windows\System\nqIXVYY.exe
  C:\Windows\System\nqIXVYY.exe
  2⤵
  PID:16784
- C:\Windows\System\sAVufcJ.exe
  C:\Windows\System\sAVufcJ.exe
  2⤵
  PID:16804
- C:\Windows\System\gIcJyLW.exe
  C:\Windows\System\gIcJyLW.exe
  2⤵
  PID:16832
- C:\Windows\System\yFHELYk.exe
  C:\Windows\System\yFHELYk.exe
  2⤵
  PID:16860
- C:\Windows\System\VgjhdHX.exe
  C:\Windows\System\VgjhdHX.exe
  2⤵
  PID:16888
- C:\Windows\System\AwCEufq.exe
  C:\Windows\System\AwCEufq.exe
  2⤵
  PID:16920
- C:\Windows\System\akYNSJE.exe
  C:\Windows\System\akYNSJE.exe
  2⤵
  PID:16960
- C:\Windows\System\qKgzajW.exe
  C:\Windows\System\qKgzajW.exe
  2⤵
  PID:16980
- C:\Windows\System\RjVOAee.exe
  C:\Windows\System\RjVOAee.exe
  2⤵
  PID:17016
- C:\Windows\System\vYeHkim.exe
  C:\Windows\System\vYeHkim.exe
  2⤵
  PID:17060
- C:\Windows\System\GNVSLev.exe
  C:\Windows\System\GNVSLev.exe
  2⤵
  PID:17088
- C:\Windows\System\kAzElyL.exe
  C:\Windows\System\kAzElyL.exe
  2⤵
  PID:17116
- C:\Windows\System\cGdKYaR.exe
  C:\Windows\System\cGdKYaR.exe
  2⤵
  PID:17136
- C:\Windows\System\VPstUTs.exe
  C:\Windows\System\VPstUTs.exe
  2⤵
  PID:17160
- C:\Windows\System\NCPsoIZ.exe
  C:\Windows\System\NCPsoIZ.exe
  2⤵
  PID:17188
- C:\Windows\System\LtlSuRB.exe
  C:\Windows\System\LtlSuRB.exe
  2⤵
  PID:17220
- C:\Windows\System\rwhzVJa.exe
  C:\Windows\System\rwhzVJa.exe
  2⤵
  PID:17240
- C:\Windows\System\ypGzTHX.exe
  C:\Windows\System\ypGzTHX.exe
  2⤵
  PID:17264
- C:\Windows\System\HUKHzBw.exe
  C:\Windows\System\HUKHzBw.exe
  2⤵
  PID:17284
- C:\Windows\System\KUtQWKk.exe
  C:\Windows\System\KUtQWKk.exe
  2⤵
  PID:17328
- C:\Windows\System\aBOdfJl.exe
  C:\Windows\System\aBOdfJl.exe
  2⤵
  PID:17360
- C:\Windows\System\MwPePxG.exe
  C:\Windows\System\MwPePxG.exe
  2⤵
  PID:17380
- C:\Windows\System\hTHRGcZ.exe
  C:\Windows\System\hTHRGcZ.exe
  2⤵
  PID:15788
- C:\Windows\System\agOeVOP.exe
  C:\Windows\System\agOeVOP.exe
  2⤵
  PID:15964
- C:\Windows\System\SCgTmFm.exe
  C:\Windows\System\SCgTmFm.exe
  2⤵
  PID:16456
- C:\Windows\System\PjQJhIV.exe
  C:\Windows\System\PjQJhIV.exe
  2⤵
  PID:16544
- C:\Windows\System\mOZTyrt.exe
  C:\Windows\System\mOZTyrt.exe
  2⤵
  PID:16660
- C:\Windows\System\XWbMNBn.exe
  C:\Windows\System\XWbMNBn.exe
  2⤵
  PID:16700
- C:\Windows\System\qVGaNNZ.exe
  C:\Windows\System\qVGaNNZ.exe
  2⤵
  PID:16756
- C:\Windows\System\QXLsYqQ.exe
  C:\Windows\System\QXLsYqQ.exe
  2⤵
  PID:16772
- C:\Windows\System\BOwWAVN.exe
  C:\Windows\System\BOwWAVN.exe
  2⤵
  PID:16900
- C:\Windows\System\sFBFqFB.exe
  C:\Windows\System\sFBFqFB.exe
  2⤵
  PID:16940
- C:\Windows\System\MjSoJYo.exe
  C:\Windows\System\MjSoJYo.exe
  2⤵
  PID:17044
- C:\Windows\System\kRGojBB.exe
  C:\Windows\System\kRGojBB.exe
  2⤵
  PID:17112

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AWLTobh.exe

Filesize
1.1MB

MD5
f969e0402dd4f8dafcc210e146424876

SHA1
ed594f2126cbbb2c6b0eb363f2b7314869a706ef

SHA256
320eadf1c9252fe8d846b1137dd3ec8f5ae64eca6e297086ad2019534d63591d

SHA512
7c363cf4ec8455f3ee6d0fb096aa6607613eb805ce1f4b7f6109f56715194b4c4b828553ac446f85dbd755ff49e7cd5924572f81ac1ee799d364c9e99f8c0e86

Download Submit
C:\Windows\System\CwpfakO.exe

Filesize
1.1MB

MD5
51f8e6eb51ed862843e61e6e65c9e775

SHA1
85a23817dcf761e5ee420708308751c4646e2dc7

SHA256
d6d7aa16cb8d6216f4e189e0d6484cf4122835deed670146b9df5d24c672afe6

SHA512
21f60a40d2451df727749be4f5ffdb14d97825962131804ee5e2d913ff1591143e62c000f7ac79a4b61544a7ccc84410f759e664abbc1fa7db876a84dada7b3c

Download Submit
C:\Windows\System\DDqHJUT.exe

Filesize
1.1MB

MD5
8b4b57f2b2c3d852b6520a2a89d04786

SHA1
039a8b6afbfd55bd8a856b2f0c184170569f7e52

SHA256
9b025123b53f00c97f1ea40e506b72abb6f7a6f8bd94bbf8e34da26b6b9c1f6e

SHA512
77b1c3ba2f124b4e7b183091199d4f6f5656387f8a977a3e3040289ded8a2016997761f5ba156cbf8f8b5339b945e282ac05668a98afc3c5b8249035bd950a14

Download Submit
C:\Windows\System\EGBcxEm.exe

Filesize
1.1MB

MD5
9f4c32f0ce93354bddc560fcbb728afd

SHA1
e5a06df9faa4e57c5aad77cf6b6a5d56e49d3dc8

SHA256
3d291a5dc2c60a95cad84ab167353f134ce783e72e76b8f0ce6f88084fe1e2b6

SHA512
9ec7f7f4f79d24728798a401d26bf003d7c90955a2738f7875c45f46eb10ada09e7d30b5fbf674e99b0eb2ac4e05cf64dea7f6075dd6dba645c7c21a52fa959d

Download Submit
C:\Windows\System\GrSiBuu.exe

Filesize
1.1MB

MD5
a2b20ab3f6ccaa97b6226f75bf59d02f

SHA1
7798afe59db7b0ce3082b2ddc120a23afe11dac1

SHA256
782fcf843c0b68e8bdfc93fabcf6e93505a97f124925cbff44673b9fee8ee4f5

SHA512
effd57d792d4f15dbb647132004e06a97cdbe0239010f057846d457371286e9cfc052b10e89f4b5f4495fe9d12bbb72f0b651ecb58c6c5f02cddea737c9d2435

Download Submit
C:\Windows\System\Gwotxlq.exe

Filesize
1.1MB

MD5
b9d5a6075c27362d25c62e9bc9bda73c

SHA1
021fdadfa177b19343f35451704d40b38b18c826

SHA256
f66e6a298c0aa43c3baabbfdc04b635e238eac696bc95ffefc41a05c4c2fb915

SHA512
55cf26fba79c51687f302deafb00b55c9ce591f687d336d6263aeba34ff523afd8b00d28520e79476f7f2d8f886cb697d4b3241effd79fdece30356024f8bed9

Download Submit
C:\Windows\System\KfPEzjr.exe

Filesize
1.1MB

MD5
4a15bda99ee9c0a8f5581c86e5ef22c2

SHA1
75248aa6abfe3b0722a1b8d2241fed75e2a302f2

SHA256
e7e7929f8018cc80f0c1d7ff66c3dbc49f3dd8c1db2ce2442498dfc8a5465bf8

SHA512
67b115f2e42ae4e8e60669f6a0202a7e15534ef89676c6cbb56e3d6048fb67fde08f97d499e949e9aff1cbdc92531536ed210af6f4f937693b0e566be0e1d2fc

Download Submit
C:\Windows\System\NNtEDug.exe

Filesize
1.1MB

MD5
44779636d47962add32585b1171bec9c

SHA1
920f8a958072d8b6e85562ada6796e39d6eccbf1

SHA256
60fb1cc738f318bca2f5885a5610795a147ebe81ea793e618df0bbfc46f18818

SHA512
0c59e69b21c7b890b68f166783829e35dde7fe3a4f9dfa97cdfefa5ab867353319e8871223bcad17eeff93719a269f4c8fda753b888c3a270311b5095af2b39d

Download Submit
C:\Windows\System\SDRFSdv.exe

Filesize
1.1MB

MD5
45d2c2177deaf33c776f14623eee6ee7

SHA1
71cdbfa5e3416fedac74053500e1a87a223a2d99

SHA256
b5803d2737e961793d2354ae6713a9a2572caed12fb6cc793aed0aac29499cd6

SHA512
1d147d956c9eefb73aae2eac6a5371def3d3e672ee297eb21ab3daff12ddb1ba531ec9d19ccb3df15fc3afaed4f5ff1a4d891d04f24afe9b19f3f93712d66c70

Download Submit
C:\Windows\System\SZHAapH.exe

Filesize
1.1MB

MD5
5d4b7866a802751fca454804cb959e9a

SHA1
edd3b64c1cfea7fb51f2984e903fa0a8b9c62ae0

SHA256
e1061899908a05b2f76c579b667c29cc569077a15728bc3af8d91f88c31bb439

SHA512
b44007472c10f0985bcc34f09485ad22d300ff09036f77253370bb7298056e93423f74e3ae52e381bbebbd37c0d63d80f5ca7443c1a2c97b3cff892edc8e0d63

Download Submit
C:\Windows\System\SbdyKsN.exe

Filesize
1.1MB

MD5
3bf636c3c073ef94c09bd3eb8cec2c43

SHA1
aec2c5608857051da7701cbeb6c7e40b7c33452f

SHA256
e395036449cc4e37d3a626286a274fe539d08bbefb9558908e13550b8ed98e0e

SHA512
bc86411383143ce38d6e455c2633ad2ed4d22868e556009791daf5d9e42c80ef1c1b6edfe519b148a12d678866c7b1ca09756588da1d2c7008a4d3c22f84844b

Download Submit
C:\Windows\System\UsxKjGx.exe

Filesize
1.1MB

MD5
073e5127cedf1b9660f4e7127ce4fda9

SHA1
13bf88d8de71c8ff5542fa6159da44a83028a4d1

SHA256
bdcdba987bb6cac25e2b13d31256e08747336af513629ec40e2213680d638831

SHA512
1202f5d37a298ded3995bfa446937cfb2e8c1e9cfafdaadab1b5e261ceafc49580a509fad07fef25215bd78db0cc62f0b96ba5352f591bf73dbe0d2b5525ecbf

Download Submit
C:\Windows\System\WAyyuXv.exe

Filesize
1.1MB

MD5
aa51aa4b66c1d3a1fc47e8dfd0551965

SHA1
6cc638e31270353da3ac36ad8b1dbeaa50fae77c

SHA256
1c390033f94ab4a19115992f69de7a0e81ffb4eee9b56999618c24bef05ff633

SHA512
fcc62d70b3c0cf92c070f31ebd6da4d8cfc222b6400ea838f8fe01c8cef923df1cc0bc19c366609e2b2340d1e4d52963486538c7b8a6096b70ee1ee224d72f04

Download Submit
C:\Windows\System\XIrLTIq.exe

Filesize
1.1MB

MD5
69fe03439a841c9f547b0c8f324577f8

SHA1
d57a3469d5c71cd5cccd3c9881afb9863f4e05f3

SHA256
33510ec238c7faeb96705baa3bfa5a51239aa519290d4264124c8b98b787d7ee

SHA512
35a169aa82687fa046149d64e9b13364409db354a11b5cce789806c51c927443874a94a17f45764de8bff46fc41d0771eeaa5183535a92fef12e38eaa76fb833

Download Submit
C:\Windows\System\bNldVLK.exe

Filesize
1.1MB

MD5
14ae1aec65ab6d4884737c01187842d6

SHA1
6a77f8c3ae0167e8fdfa703c094a052e421f90f9

SHA256
eb00ab581cc984e649d175e214dd389e01e2940e283129f3d7e7a78fe1d16602

SHA512
b25ebf45392fbbd8a35f2f089be07a66b74c4e1ee5ed5e8c9c833486d8bba3796cc8fa98bdc844d34cffafd384a659842712f5bfad2977839eb91837acfb3149

Download Submit
C:\Windows\System\bahzayn.exe

Filesize
1.1MB

MD5
26149e3251019aa0d0fb08d9fae0495c

SHA1
9f989002745d3f6459c685dcfef607d213807157

SHA256
cd7b028e1efa536b4948f1907c41a8d6368e2bbaa7de8d30e2ee2326c192e9c5

SHA512
1a133d1fac4d993351ce39ba32903fd68202b03d615bf5841d116e13c28a3c29e976435b7f9551148a9497cb4d51f1cf2d5b0637a2a3abff810c33c7456c56d3

Download Submit
C:\Windows\System\cIdUASt.exe

Filesize
1.1MB

MD5
b3f7fd61b709fbd1c1578704bb9a861a

SHA1
7d192378cc56744e4c311055922bea47370a0c50

SHA256
c1ac8d9dcac404f2774a24a8a7c2724033bb3fb8daf2dc97432afc42b43a5553

SHA512
d7f0d8f7be80151d1114c40fc2621e51a3c83e62170f57133446b5ba2c1f5d981eefa9b5c84330055165eb9d1af0e2526e659c35979ff6fc9304ae0448db2e36

Download Submit
C:\Windows\System\djiMqfP.exe

Filesize
1.1MB

MD5
a507de3804e7fd2596d7694b658a04c2

SHA1
b1211d982553888e2119b1554f3c37e7e9695e97

SHA256
185d2c82aee56b9939c1d83dcf175fe0b8b2a940375e8561849743c9cae1a920

SHA512
1d9395fba0f57f2469141ed99e17ecb8573d3f5b67756b6564a2571baee5fbbda83cbdec34ed141af68711494ee0abe51c927c0946fbf82eb5e891092e1d774c

Download Submit
C:\Windows\System\hOKPgyF.exe

Filesize
1.1MB

MD5
48d3dddc66db8c13f460b57f7c8835cf

SHA1
ac9863ba4074377e89bcfa930e1f4ecce9e134d0

SHA256
ef57a832198f23bfdd062e9d1304d2273c099ab60911ff8326a84ae66f7d0af9

SHA512
0bb4464cf0982abb09e63fbf6a5e28fa3e8b6c0644f412e6c5ca9b8982458485ffc67aa224bc7540564dd5794efb5767a01c8f3655c7e5fc03dd473fe092678c

Download Submit
C:\Windows\System\iMAuFxS.exe

Filesize
1.1MB

MD5
38d24a80ce21642b347122bce96ce4c5

SHA1
48fae14c600e1bdbcb6892c451fc10ec88956dd2

SHA256
c88253917374dbeadbfc08ac339775ded2819240d3be0b5d920d1a3f389c5554

SHA512
1e02748cc96381c0f2362c8802a07812e781999a74fc9cf0da85a243bd573a8c07ec1205ffafa1d8fee73cd3b438d7e69bd24e9bbc6f3aa318b30223b99c3bb9

Download Submit
C:\Windows\System\iVIbnBL.exe

Filesize
1.1MB

MD5
3c9b4e1fdfb2060e2a712d5fdd85cb54

SHA1
cc1988ed500ebb0ef28b90081dc87d3069f22fe8

SHA256
d8675e22d78e2652a33e568f83169aa0def8e569d9f44948df3dbf3916ef278d

SHA512
c686558bac91f4a94b856ab82dc40f019d81c24b3dea894832fb767fb64394dbb7b193726767ea9d121ece6289402380d1685be1fe0798c14e083a0b3dce9929

Download Submit
C:\Windows\System\ijxJwhQ.exe

Filesize
1.1MB

MD5
8c507a923262fc66f489a1ea47bc7d12

SHA1
909b78acef5556493995a374040be2e1dae382ac

SHA256
4483777a1d627556ec388196aafcd2ababdd97c9cd6fa15d098b75cfde9d68f0

SHA512
6465a819f9a75f2ffb631960d7e5efac0baa17c1ecd462d102c49f638ee7d03ef0e2da44715b98749af686ab7b19803d6f2ff95854daa9f092517c0e3f6debfb

Download Submit
C:\Windows\System\kaelxDd.exe

Filesize
1.1MB

MD5
9b49ba856abea8043167896140e52c5d

SHA1
f952f930b09a53fd0170fbe72a016fc3b460a2d0

SHA256
82738813fa12a771398a1263f59578c6628fb22f22cfd2474a84ea4a721671f5

SHA512
4741fa263c6bf43926301386371814987b346c9ef4c379366c02a4a60c3264cdcb48cb9653500c556a3ab3f2c24641f84711e21a0ee5b1415955365b0d6239b3

Download Submit
C:\Windows\System\kiuIUrh.exe

Filesize
1.1MB

MD5
12979a768560cc28f98000147dc09f09

SHA1
d19d07664e65bbb5ccce35c6ecd34f134eb9efae

SHA256
1d75d749a46b8d0375193e05b3a90fcdfe0a076b0b15db54c338c45a78f54990

SHA512
ad17d9586d070da249d5709c35cf4259fc9baa62c3e3e5c350261cd2c0a12b376f91fccf628f2f942c509bed207417a6597fd4c0398fccd3be16b7a598785c51

Download Submit
C:\Windows\System\kvxgKii.exe

Filesize
1.1MB

MD5
6cae7aa89c0075386de191eaaa62e263

SHA1
0b86312daa860c928924694b376b374425d5c89c

SHA256
54a3c42dc014cf048c24bdbe5aec5b65bcf9ab38a9f5a52be78abab6bcf90795

SHA512
89683fcfc675095f13be98604f17c768a3fc2b97a531c84be3b2d8bc8374ad8b4b0d704203ad22be8a3149c4ebe416f700ab70057401470091fea7fd435acf3e

Download Submit
C:\Windows\System\nEmMDgR.exe

Filesize
1.1MB

MD5
d8c0234eeb3ba39357cc07f49a1afa28

SHA1
6486bb00bdc168474148bc3f8b61fc8c6cd173ba

SHA256
28609cbac1a7a93ab8dc369a9f60ed50eb677e9152d10065a60d02851595d96a

SHA512
8e49d31af8efdf734f2bff90ec86794a4e82f8c0f00229f1f232e74b0ea4975156243da62396c8a26c0568045416f4098aece5d7a59fc49c9f2c6b593d24f106

Download Submit
C:\Windows\System\rAPNLoB.exe

Filesize
1.1MB

MD5
f827623309afdba9ca2641dbe8de73da

SHA1
fbe1c1db222803cc6962d88c8346a705474d0a4d

SHA256
bd9b961f39b74faf41884dfd5f30004b9f74faf8e4df81575e787731a0cf5d74

SHA512
64ffc9eb9c746f7e352d8df839e5f0dc250aa868aeab00e45017de8a9a7bcd8b308dadb03a4f7855bab384ad83294a372284e3a7964e60ca247cda2e62623de4

Download Submit
C:\Windows\System\rEDYgNs.exe

Filesize
1.1MB

MD5
d78acd404997386eaaba523b9e4aa45a

SHA1
85dda0c9c8dad092a221a3e1dcef4659776d8b02

SHA256
3181dc60540fdaafcf964f47986b9a07f4c159d695189f6779d824dd86ea8771

SHA512
f103beb0c9df631c0d18f02b55af1df63c81fef23657b61f6e59699929c0d53b08fc527ed3c9516b88e37bd1ec68678bfc37b550a0f2f1bbe02a2318747168ed

Download Submit
C:\Windows\System\tGAtWMC.exe

Filesize
1.1MB

MD5
ae2170bc322dcf735ded38eb75ad09d0

SHA1
3211aaa3d42248f16fa1fef6047a10dfff5127b7

SHA256
462b4fefdfe6655ca079faf288c820901aa7a008bdacb9b1871e5efa6248423f

SHA512
a11727ba6c388d06041ae0b784195c46c5e92dcefbed6269962722f6ee5edc00cdfec73034ce8bb8f6461b5e2f5cd28b62677974d0659ebfd57d09254fd6f101

Download Submit
C:\Windows\System\uIpVQQn.exe

Filesize
1.1MB

MD5
0ac18873e65213c808315b7be49148f0

SHA1
fd472b317c5674a2c2c9dfb6ea7e71b71f9f4967

SHA256
677cb90b1079046db6dcdf8ccd5e91c1a64384b8307fb81e7eb6625996585998

SHA512
bdf24ca0765f0a0101dbf881db1b68db302e9fc942521caab7a8fab7f5e408ce04858edbabc314e28df28b84843b74a9ca23ebdaef4cc72505ab5f950753f32f

Download Submit
C:\Windows\System\wcLuFPH.exe

Filesize
1.1MB

MD5
06b55fbd9cc6398dead0faaa8b8a0759

SHA1
2feff8b966aee373f22cb16240d64969c329d6cb

SHA256
18c40b97c329d85d9b53da9b5a2073322d97244ecdc177745e17c028bbf57497

SHA512
a42598bdcf3d6f24f537b86423ea3e386056efc6ce1c973321049f5a5d06bc00a2a0faee3eb040294540d0ac01bb13f191486b792aa222136e1d7088863ba87d

Download Submit
C:\Windows\System\ykVUdpt.exe

Filesize
1.1MB

MD5
2e2ee8e1c99911c7f62a6956b90ac832

SHA1
bf1764df31bb62e46c815420bbe32b904bb81936

SHA256
5be76b168a1b958f87ab277abb80489ad0d65d912a967fc8d6e86703e9252208

SHA512
563fd3803f8b32c4c973dc19210b826292ac9c03bd63b00c6c887b56d2bc08bb66bb1ec82195c174bc4290f5bd4127ca6420ec9590ec45ae293f5126251fd54e

Download Submit
memory/2644-0-0x0000019499060000-0x0000019499070000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads