xmrig | 5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5

Analysis

max time kernel
134s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
Size

1.3MB
MD5

81db1195a6f3e1fdd82af947707ff3e1
SHA1

415d11488f7dd16459ec9b020cba804d124689ee
SHA256

5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5
SHA512

0485ffef6ac7a7a362f5141a1ed6f9d7ae155cc123c3fc5cc4733bbb053788211419610cd804a81cd04de279c0d62889288ade5b8c9bd4e28ebf775d74ea4faf
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/51m6PbWZeXA:GezaTF8FcNkNdfE0pZ9ozttwIRx3QZew

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0007000000023c9b-6.dat	xmrig
behavioral2/files/0x0009000000023c94-4.dat	xmrig
behavioral2/files/0x0008000000023c97-10.dat	xmrig
behavioral2/files/0x0007000000023c9c-17.dat	xmrig
behavioral2/files/0x0007000000023c9d-26.dat	xmrig
behavioral2/files/0x0007000000023ca0-37.dat	xmrig
behavioral2/files/0x0007000000023c9f-38.dat	xmrig
behavioral2/files/0x0007000000023c9e-35.dat	xmrig
behavioral2/files/0x0007000000023ca2-47.dat	xmrig
behavioral2/files/0x0007000000023ca1-46.dat	xmrig
behavioral2/files/0x0007000000023ca3-53.dat	xmrig
behavioral2/files/0x0008000000023c98-59.dat	xmrig
behavioral2/files/0x0007000000023ca4-63.dat	xmrig
behavioral2/files/0x0007000000023ca5-69.dat	xmrig
behavioral2/files/0x0007000000023ca6-76.dat	xmrig
behavioral2/files/0x0007000000023ca7-77.dat	xmrig
behavioral2/files/0x0007000000023ca8-80.dat	xmrig
behavioral2/files/0x0007000000023caa-89.dat	xmrig
behavioral2/files/0x0007000000023ca9-96.dat	xmrig
behavioral2/files/0x0007000000023cab-99.dat	xmrig
behavioral2/files/0x0007000000023cac-104.dat	xmrig
behavioral2/files/0x0007000000023cae-111.dat	xmrig
behavioral2/files/0x0007000000023cb1-117.dat	xmrig
behavioral2/files/0x0007000000023caf-112.dat	xmrig
behavioral2/files/0x0007000000023cb2-119.dat	xmrig
behavioral2/files/0x0007000000023cb3-133.dat	xmrig
behavioral2/files/0x0007000000023cb4-135.dat	xmrig
behavioral2/files/0x0007000000023cb5-140.dat	xmrig
behavioral2/files/0x0007000000023cb6-144.dat	xmrig
behavioral2/files/0x0007000000023cb7-152.dat	xmrig
behavioral2/files/0x0007000000023cba-162.dat	xmrig
behavioral2/files/0x0007000000023cb9-161.dat	xmrig
behavioral2/files/0x0007000000023cb8-155.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
556	tcsjRrP.exe
4572	SYumQza.exe
4004	EyYgSLy.exe
876	iEilXlF.exe
644	TSmuKoC.exe
1592	upZwESj.exe
1068	KVJwKIT.exe
1564	ccotPJH.exe
2052	sDgPASd.exe
2728	uEodYOT.exe
4476	XCSDCbf.exe
1840	CUxUbsE.exe
2012	lyVrDvB.exe
2348	XAbJBEF.exe
2328	SpZpNwE.exe
3820	dfRmlKV.exe
3852	UOJLqjf.exe
2804	EMDVcUj.exe
3124	NKrGInr.exe
2624	lQUMFta.exe
4636	RknOSqU.exe
2508	miIfBgq.exe
3604	zXVcvLh.exe
4056	qHrQIXw.exe
2472	dmGyCXT.exe
2576	OFFlVSf.exe
380	BkRxXRx.exe
4632	IBPWWZc.exe
552	qEWauOY.exe
4456	XCkDjEl.exe
4648	PlDbuLS.exe
2568	sgrlVKG.exe
2724	oUGefmP.exe
3444	nupHbue.exe
2692	dvCznsJ.exe
892	GDclOuX.exe
4312	fISLbXs.exe
2304	MOycWUR.exe
3116	RjhRuTE.exe
1140	KwyqhOn.exe
1844	QHzbSaS.exe
1596	HrOrDkX.exe
3652	jADxGWn.exe
1076	pIWjpBA.exe
2744	TpbZdNN.exe
1604	uopQinF.exe
3980	cqRiDOV.exe
2720	HYdYHrC.exe
1496	EwDQiRO.exe
2280	TJeOiGb.exe
1056	czaeVgz.exe
4952	aDfuPdR.exe
4888	TfjGFyA.exe
4228	ZuthKEz.exe
2488	PGyGOcq.exe
2860	OKYqBfX.exe
4824	NmVRIiL.exe
3744	jjcdmsc.exe
1568	sRQNIwH.exe
4376	yIzrgRj.exe
1984	ZWYtbAo.exe
4356	wjYbvFc.exe
776	OoIqmwj.exe
748	zNceRLS.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SRUAAas.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\fIpUYdN.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\WrGGyAt.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\wVmjivT.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\fhVoKld.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\niLWYsD.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\jADxGWn.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\SPQSTZp.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\Txsknew.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\JoLQikk.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\yoAxWJc.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\nHDCTvQ.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\DVdYZTI.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\jreaeAV.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\zRKOurk.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\czaeVgz.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\TkaCZpX.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\jSDCGUe.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\FAOhkGY.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\EwDQiRO.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\dckhHhY.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\RPCHSRC.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\IDWvPSd.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\WBioKTW.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\gKKpPgB.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\EgfZNda.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\Ldwanle.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\FzRNjdD.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\bAZOkiF.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\xIyTrgg.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\zpgRRwf.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\tcpHZBe.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\DRjfsoL.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\mxZNMLc.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\pasitCL.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\EzrmJeh.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\NKrGInr.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\kOZRplN.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\yQItWUB.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\swTpaef.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\yYupBCd.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\RWGPUSR.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\JmvPcYF.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\IFXJiva.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\AqnmDiC.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\uSOLYDx.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\rMXASGT.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\wnpHGvQ.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\nUoJOhE.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\zNceRLS.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\fWahxbc.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\TpbZdNN.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\YnYyvHz.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\xeQVEgn.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\KnlPCNV.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\vYdSLay.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\wVfHfjE.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\mhWrete.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\sgrlVKG.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\TisVKMH.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\IoLjAlp.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\RzfXKDu.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\JPholBw.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
File created	C:\Windows\System\KwDYYGh.exe	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	13244	dwm.exe
Token: SeChangeNotifyPrivilege	13244	dwm.exe
Token: 33	13244	dwm.exe
Token: SeIncBasePriorityPrivilege	13244	dwm.exe
Token: SeShutdownPrivilege	13244	dwm.exe
Token: SeCreatePagefilePrivilege	13244	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 556	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	84
PID 3156 wrote to memory of 556	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	84
PID 3156 wrote to memory of 4572	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	85
PID 3156 wrote to memory of 4572	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	85
PID 3156 wrote to memory of 4004	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	86
PID 3156 wrote to memory of 4004	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	86
PID 3156 wrote to memory of 876	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	87
PID 3156 wrote to memory of 876	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	87
PID 3156 wrote to memory of 644	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	88
PID 3156 wrote to memory of 644	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	88
PID 3156 wrote to memory of 1592	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	89
PID 3156 wrote to memory of 1592	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	89
PID 3156 wrote to memory of 1068	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	90
PID 3156 wrote to memory of 1068	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	90
PID 3156 wrote to memory of 1564	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	91
PID 3156 wrote to memory of 1564	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	91
PID 3156 wrote to memory of 2052	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	92
PID 3156 wrote to memory of 2052	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	92
PID 3156 wrote to memory of 2728	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	93
PID 3156 wrote to memory of 2728	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	93
PID 3156 wrote to memory of 4476	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	94
PID 3156 wrote to memory of 4476	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	94
PID 3156 wrote to memory of 1840	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	95
PID 3156 wrote to memory of 1840	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	95
PID 3156 wrote to memory of 2012	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	96
PID 3156 wrote to memory of 2012	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	96
PID 3156 wrote to memory of 2348	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	97
PID 3156 wrote to memory of 2348	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	97
PID 3156 wrote to memory of 2328	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	98
PID 3156 wrote to memory of 2328	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	98
PID 3156 wrote to memory of 3820	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	100
PID 3156 wrote to memory of 3820	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	100
PID 3156 wrote to memory of 3852	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	101
PID 3156 wrote to memory of 3852	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	101
PID 3156 wrote to memory of 2804	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	102
PID 3156 wrote to memory of 2804	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	102
PID 3156 wrote to memory of 3124	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	103
PID 3156 wrote to memory of 3124	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	103
PID 3156 wrote to memory of 2624	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	104
PID 3156 wrote to memory of 2624	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	104
PID 3156 wrote to memory of 4636	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	105
PID 3156 wrote to memory of 4636	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	105
PID 3156 wrote to memory of 2508	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	107
PID 3156 wrote to memory of 2508	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	107
PID 3156 wrote to memory of 3604	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	108
PID 3156 wrote to memory of 3604	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	108
PID 3156 wrote to memory of 4056	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	109
PID 3156 wrote to memory of 4056	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	109
PID 3156 wrote to memory of 2472	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	110
PID 3156 wrote to memory of 2472	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	110
PID 3156 wrote to memory of 2576	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	111
PID 3156 wrote to memory of 2576	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	111
PID 3156 wrote to memory of 380	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	112
PID 3156 wrote to memory of 380	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	112
PID 3156 wrote to memory of 4632	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	113
PID 3156 wrote to memory of 4632	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	113
PID 3156 wrote to memory of 552	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	115
PID 3156 wrote to memory of 552	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	115
PID 3156 wrote to memory of 4456	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	116
PID 3156 wrote to memory of 4456	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	116
PID 3156 wrote to memory of 4648	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	117
PID 3156 wrote to memory of 4648	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	117
PID 3156 wrote to memory of 2568	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	118
PID 3156 wrote to memory of 2568	3156	5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe	118

C:\Users\Admin\AppData\Local\Temp\5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe
"C:\Users\Admin\AppData\Local\Temp\5d23fefb70a381f48b5288c8727a3a1a5968ef23e17f184b6c094437839328e5.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\System\tcsjRrP.exe
  C:\Windows\System\tcsjRrP.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\SYumQza.exe
  C:\Windows\System\SYumQza.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\EyYgSLy.exe
  C:\Windows\System\EyYgSLy.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\iEilXlF.exe
  C:\Windows\System\iEilXlF.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\TSmuKoC.exe
  C:\Windows\System\TSmuKoC.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\upZwESj.exe
  C:\Windows\System\upZwESj.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\KVJwKIT.exe
  C:\Windows\System\KVJwKIT.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\ccotPJH.exe
  C:\Windows\System\ccotPJH.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\sDgPASd.exe
  C:\Windows\System\sDgPASd.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\uEodYOT.exe
  C:\Windows\System\uEodYOT.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\XCSDCbf.exe
  C:\Windows\System\XCSDCbf.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\CUxUbsE.exe
  C:\Windows\System\CUxUbsE.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\lyVrDvB.exe
  C:\Windows\System\lyVrDvB.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\XAbJBEF.exe
  C:\Windows\System\XAbJBEF.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\SpZpNwE.exe
  C:\Windows\System\SpZpNwE.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\dfRmlKV.exe
  C:\Windows\System\dfRmlKV.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\UOJLqjf.exe
  C:\Windows\System\UOJLqjf.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\EMDVcUj.exe
  C:\Windows\System\EMDVcUj.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\NKrGInr.exe
  C:\Windows\System\NKrGInr.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\lQUMFta.exe
  C:\Windows\System\lQUMFta.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\RknOSqU.exe
  C:\Windows\System\RknOSqU.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\miIfBgq.exe
  C:\Windows\System\miIfBgq.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\zXVcvLh.exe
  C:\Windows\System\zXVcvLh.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\qHrQIXw.exe
  C:\Windows\System\qHrQIXw.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\dmGyCXT.exe
  C:\Windows\System\dmGyCXT.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\OFFlVSf.exe
  C:\Windows\System\OFFlVSf.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\BkRxXRx.exe
  C:\Windows\System\BkRxXRx.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\IBPWWZc.exe
  C:\Windows\System\IBPWWZc.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\qEWauOY.exe
  C:\Windows\System\qEWauOY.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\XCkDjEl.exe
  C:\Windows\System\XCkDjEl.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\PlDbuLS.exe
  C:\Windows\System\PlDbuLS.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\sgrlVKG.exe
  C:\Windows\System\sgrlVKG.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\oUGefmP.exe
  C:\Windows\System\oUGefmP.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\nupHbue.exe
  C:\Windows\System\nupHbue.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\dvCznsJ.exe
  C:\Windows\System\dvCznsJ.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\GDclOuX.exe
  C:\Windows\System\GDclOuX.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\fISLbXs.exe
  C:\Windows\System\fISLbXs.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\MOycWUR.exe
  C:\Windows\System\MOycWUR.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\RjhRuTE.exe
  C:\Windows\System\RjhRuTE.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\KwyqhOn.exe
  C:\Windows\System\KwyqhOn.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\QHzbSaS.exe
  C:\Windows\System\QHzbSaS.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\HrOrDkX.exe
  C:\Windows\System\HrOrDkX.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\jADxGWn.exe
  C:\Windows\System\jADxGWn.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\pIWjpBA.exe
  C:\Windows\System\pIWjpBA.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\TpbZdNN.exe
  C:\Windows\System\TpbZdNN.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\uopQinF.exe
  C:\Windows\System\uopQinF.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\cqRiDOV.exe
  C:\Windows\System\cqRiDOV.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\HYdYHrC.exe
  C:\Windows\System\HYdYHrC.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\EwDQiRO.exe
  C:\Windows\System\EwDQiRO.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\TJeOiGb.exe
  C:\Windows\System\TJeOiGb.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\czaeVgz.exe
  C:\Windows\System\czaeVgz.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\aDfuPdR.exe
  C:\Windows\System\aDfuPdR.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\TfjGFyA.exe
  C:\Windows\System\TfjGFyA.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\ZuthKEz.exe
  C:\Windows\System\ZuthKEz.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\PGyGOcq.exe
  C:\Windows\System\PGyGOcq.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\OKYqBfX.exe
  C:\Windows\System\OKYqBfX.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\NmVRIiL.exe
  C:\Windows\System\NmVRIiL.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\jjcdmsc.exe
  C:\Windows\System\jjcdmsc.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\sRQNIwH.exe
  C:\Windows\System\sRQNIwH.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\yIzrgRj.exe
  C:\Windows\System\yIzrgRj.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\ZWYtbAo.exe
  C:\Windows\System\ZWYtbAo.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\wjYbvFc.exe
  C:\Windows\System\wjYbvFc.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\OoIqmwj.exe
  C:\Windows\System\OoIqmwj.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\zNceRLS.exe
  C:\Windows\System\zNceRLS.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\VlOWyjs.exe
  C:\Windows\System\VlOWyjs.exe
  2⤵
  PID:2512
- C:\Windows\System\JDqslxy.exe
  C:\Windows\System\JDqslxy.exe
  2⤵
  PID:2564
- C:\Windows\System\entLzkx.exe
  C:\Windows\System\entLzkx.exe
  2⤵
  PID:1588
- C:\Windows\System\UwMxepO.exe
  C:\Windows\System\UwMxepO.exe
  2⤵
  PID:1788
- C:\Windows\System\AwmSWAY.exe
  C:\Windows\System\AwmSWAY.exe
  2⤵
  PID:2188
- C:\Windows\System\NWJGFbr.exe
  C:\Windows\System\NWJGFbr.exe
  2⤵
  PID:4912
- C:\Windows\System\JuCXaQR.exe
  C:\Windows\System\JuCXaQR.exe
  2⤵
  PID:4320
- C:\Windows\System\bkRjopI.exe
  C:\Windows\System\bkRjopI.exe
  2⤵
  PID:1852
- C:\Windows\System\rOGuClq.exe
  C:\Windows\System\rOGuClq.exe
  2⤵
  PID:3212
- C:\Windows\System\hNlNTmz.exe
  C:\Windows\System\hNlNTmz.exe
  2⤵
  PID:4008
- C:\Windows\System\Jvbhwol.exe
  C:\Windows\System\Jvbhwol.exe
  2⤵
  PID:1772
- C:\Windows\System\WQkBavF.exe
  C:\Windows\System\WQkBavF.exe
  2⤵
  PID:1488
- C:\Windows\System\mDlKTvJ.exe
  C:\Windows\System\mDlKTvJ.exe
  2⤵
  PID:4164
- C:\Windows\System\srLyyCa.exe
  C:\Windows\System\srLyyCa.exe
  2⤵
  PID:4960
- C:\Windows\System\qidmXkV.exe
  C:\Windows\System\qidmXkV.exe
  2⤵
  PID:1072
- C:\Windows\System\zpgRRwf.exe
  C:\Windows\System\zpgRRwf.exe
  2⤵
  PID:5072
- C:\Windows\System\suqHkzE.exe
  C:\Windows\System\suqHkzE.exe
  2⤵
  PID:3216
- C:\Windows\System\kCEeVpz.exe
  C:\Windows\System\kCEeVpz.exe
  2⤵
  PID:1524
- C:\Windows\System\OlwKGVd.exe
  C:\Windows\System\OlwKGVd.exe
  2⤵
  PID:3492
- C:\Windows\System\jJLkcqO.exe
  C:\Windows\System\jJLkcqO.exe
  2⤵
  PID:4024
- C:\Windows\System\bdgYMqp.exe
  C:\Windows\System\bdgYMqp.exe
  2⤵
  PID:4820
- C:\Windows\System\oqLHcdU.exe
  C:\Windows\System\oqLHcdU.exe
  2⤵
  PID:1448
- C:\Windows\System\KQCydPl.exe
  C:\Windows\System\KQCydPl.exe
  2⤵
  PID:3184
- C:\Windows\System\vCmVZqd.exe
  C:\Windows\System\vCmVZqd.exe
  2⤵
  PID:2536
- C:\Windows\System\FuxYGaP.exe
  C:\Windows\System\FuxYGaP.exe
  2⤵
  PID:4080
- C:\Windows\System\veAhCjo.exe
  C:\Windows\System\veAhCjo.exe
  2⤵
  PID:5060
- C:\Windows\System\NVBzOvl.exe
  C:\Windows\System\NVBzOvl.exe
  2⤵
  PID:1960
- C:\Windows\System\QNaCzRQ.exe
  C:\Windows\System\QNaCzRQ.exe
  2⤵
  PID:60
- C:\Windows\System\bJcAeiV.exe
  C:\Windows\System\bJcAeiV.exe
  2⤵
  PID:2516
- C:\Windows\System\RQNbibQ.exe
  C:\Windows\System\RQNbibQ.exe
  2⤵
  PID:4536
- C:\Windows\System\TdHCOfs.exe
  C:\Windows\System\TdHCOfs.exe
  2⤵
  PID:3640
- C:\Windows\System\iQPnAjX.exe
  C:\Windows\System\iQPnAjX.exe
  2⤵
  PID:2212
- C:\Windows\System\YxIjNXd.exe
  C:\Windows\System\YxIjNXd.exe
  2⤵
  PID:1116
- C:\Windows\System\benIKVV.exe
  C:\Windows\System\benIKVV.exe
  2⤵
  PID:116
- C:\Windows\System\kdtVeiD.exe
  C:\Windows\System\kdtVeiD.exe
  2⤵
  PID:5144
- C:\Windows\System\IDWvPSd.exe
  C:\Windows\System\IDWvPSd.exe
  2⤵
  PID:5168
- C:\Windows\System\IiCxOML.exe
  C:\Windows\System\IiCxOML.exe
  2⤵
  PID:5200
- C:\Windows\System\rjCEpxT.exe
  C:\Windows\System\rjCEpxT.exe
  2⤵
  PID:5224
- C:\Windows\System\iOFcdGJ.exe
  C:\Windows\System\iOFcdGJ.exe
  2⤵
  PID:5256
- C:\Windows\System\CwAccwS.exe
  C:\Windows\System\CwAccwS.exe
  2⤵
  PID:5292
- C:\Windows\System\OAReaPH.exe
  C:\Windows\System\OAReaPH.exe
  2⤵
  PID:5320
- C:\Windows\System\pXuRvAn.exe
  C:\Windows\System\pXuRvAn.exe
  2⤵
  PID:5336
- C:\Windows\System\AcMJMDm.exe
  C:\Windows\System\AcMJMDm.exe
  2⤵
  PID:5364
- C:\Windows\System\wGDQPzt.exe
  C:\Windows\System\wGDQPzt.exe
  2⤵
  PID:5384
- C:\Windows\System\VAcLnbc.exe
  C:\Windows\System\VAcLnbc.exe
  2⤵
  PID:5404
- C:\Windows\System\ZYQVDdI.exe
  C:\Windows\System\ZYQVDdI.exe
  2⤵
  PID:5428
- C:\Windows\System\kfihOTn.exe
  C:\Windows\System\kfihOTn.exe
  2⤵
  PID:5472
- C:\Windows\System\bdIZPUI.exe
  C:\Windows\System\bdIZPUI.exe
  2⤵
  PID:5500
- C:\Windows\System\ogcLFNC.exe
  C:\Windows\System\ogcLFNC.exe
  2⤵
  PID:5532
- C:\Windows\System\Ecdatpd.exe
  C:\Windows\System\Ecdatpd.exe
  2⤵
  PID:5560
- C:\Windows\System\bjVldAg.exe
  C:\Windows\System\bjVldAg.exe
  2⤵
  PID:5588
- C:\Windows\System\hEfNbjf.exe
  C:\Windows\System\hEfNbjf.exe
  2⤵
  PID:5620
- C:\Windows\System\MfgxTqa.exe
  C:\Windows\System\MfgxTqa.exe
  2⤵
  PID:5656
- C:\Windows\System\mKhQiev.exe
  C:\Windows\System\mKhQiev.exe
  2⤵
  PID:5684
- C:\Windows\System\gNGcXni.exe
  C:\Windows\System\gNGcXni.exe
  2⤵
  PID:5712
- C:\Windows\System\sNJKrEi.exe
  C:\Windows\System\sNJKrEi.exe
  2⤵
  PID:5732
- C:\Windows\System\yjyHTfq.exe
  C:\Windows\System\yjyHTfq.exe
  2⤵
  PID:5756
- C:\Windows\System\LvnmfsW.exe
  C:\Windows\System\LvnmfsW.exe
  2⤵
  PID:5792
- C:\Windows\System\YxocLFj.exe
  C:\Windows\System\YxocLFj.exe
  2⤵
  PID:5828
- C:\Windows\System\ZOsUFQL.exe
  C:\Windows\System\ZOsUFQL.exe
  2⤵
  PID:5856
- C:\Windows\System\UIXiJFb.exe
  C:\Windows\System\UIXiJFb.exe
  2⤵
  PID:5884
- C:\Windows\System\bLHUlDb.exe
  C:\Windows\System\bLHUlDb.exe
  2⤵
  PID:5932
- C:\Windows\System\VMYjeMO.exe
  C:\Windows\System\VMYjeMO.exe
  2⤵
  PID:5948
- C:\Windows\System\EEjVMMw.exe
  C:\Windows\System\EEjVMMw.exe
  2⤵
  PID:5968
- C:\Windows\System\CmclBRf.exe
  C:\Windows\System\CmclBRf.exe
  2⤵
  PID:6004
- C:\Windows\System\FzRNjdD.exe
  C:\Windows\System\FzRNjdD.exe
  2⤵
  PID:6032
- C:\Windows\System\yKiYoQF.exe
  C:\Windows\System\yKiYoQF.exe
  2⤵
  PID:6064
- C:\Windows\System\qALiIyC.exe
  C:\Windows\System\qALiIyC.exe
  2⤵
  PID:6092
- C:\Windows\System\vRiFBdv.exe
  C:\Windows\System\vRiFBdv.exe
  2⤵
  PID:6120
- C:\Windows\System\ELeQdKL.exe
  C:\Windows\System\ELeQdKL.exe
  2⤵
  PID:6140
- C:\Windows\System\ZbUmkpu.exe
  C:\Windows\System\ZbUmkpu.exe
  2⤵
  PID:5176
- C:\Windows\System\YtycRIW.exe
  C:\Windows\System\YtycRIW.exe
  2⤵
  PID:5212
- C:\Windows\System\nNOxxZS.exe
  C:\Windows\System\nNOxxZS.exe
  2⤵
  PID:5332
- C:\Windows\System\CAgwOiw.exe
  C:\Windows\System\CAgwOiw.exe
  2⤵
  PID:5400
- C:\Windows\System\lCEyaIZ.exe
  C:\Windows\System\lCEyaIZ.exe
  2⤵
  PID:5452
- C:\Windows\System\HEULgYJ.exe
  C:\Windows\System\HEULgYJ.exe
  2⤵
  PID:5548
- C:\Windows\System\UCovyiP.exe
  C:\Windows\System\UCovyiP.exe
  2⤵
  PID:5580
- C:\Windows\System\NxgjlyV.exe
  C:\Windows\System\NxgjlyV.exe
  2⤵
  PID:5632
- C:\Windows\System\znDwcuo.exe
  C:\Windows\System\znDwcuo.exe
  2⤵
  PID:5724
- C:\Windows\System\WIqcllu.exe
  C:\Windows\System\WIqcllu.exe
  2⤵
  PID:5768
- C:\Windows\System\PWntJUW.exe
  C:\Windows\System\PWntJUW.exe
  2⤵
  PID:5868
- C:\Windows\System\OqJpTON.exe
  C:\Windows\System\OqJpTON.exe
  2⤵
  PID:5944
- C:\Windows\System\iRkcNzg.exe
  C:\Windows\System\iRkcNzg.exe
  2⤵
  PID:5996
- C:\Windows\System\CmjhVYq.exe
  C:\Windows\System\CmjhVYq.exe
  2⤵
  PID:6048
- C:\Windows\System\XElpapk.exe
  C:\Windows\System\XElpapk.exe
  2⤵
  PID:6128
- C:\Windows\System\NyHwJXh.exe
  C:\Windows\System\NyHwJXh.exe
  2⤵
  PID:5232
- C:\Windows\System\BBNBOdt.exe
  C:\Windows\System\BBNBOdt.exe
  2⤵
  PID:5348
- C:\Windows\System\yfoRBpb.exe
  C:\Windows\System\yfoRBpb.exe
  2⤵
  PID:5488
- C:\Windows\System\Zwtmkih.exe
  C:\Windows\System\Zwtmkih.exe
  2⤵
  PID:5700
- C:\Windows\System\WBioKTW.exe
  C:\Windows\System\WBioKTW.exe
  2⤵
  PID:5848
- C:\Windows\System\QQUHFkq.exe
  C:\Windows\System\QQUHFkq.exe
  2⤵
  PID:6132
- C:\Windows\System\RROITSP.exe
  C:\Windows\System\RROITSP.exe
  2⤵
  PID:5280
- C:\Windows\System\TftUVqX.exe
  C:\Windows\System\TftUVqX.exe
  2⤵
  PID:5652
- C:\Windows\System\iizwcsi.exe
  C:\Windows\System\iizwcsi.exe
  2⤵
  PID:5964
- C:\Windows\System\OZcqnQh.exe
  C:\Windows\System\OZcqnQh.exe
  2⤵
  PID:5184
- C:\Windows\System\aZDbzHG.exe
  C:\Windows\System\aZDbzHG.exe
  2⤵
  PID:5556
- C:\Windows\System\xJnMRRO.exe
  C:\Windows\System\xJnMRRO.exe
  2⤵
  PID:6160
- C:\Windows\System\kfzQGYA.exe
  C:\Windows\System\kfzQGYA.exe
  2⤵
  PID:6188
- C:\Windows\System\dpjBtwG.exe
  C:\Windows\System\dpjBtwG.exe
  2⤵
  PID:6212
- C:\Windows\System\OLWqhkn.exe
  C:\Windows\System\OLWqhkn.exe
  2⤵
  PID:6244
- C:\Windows\System\KduuGEG.exe
  C:\Windows\System\KduuGEG.exe
  2⤵
  PID:6264
- C:\Windows\System\yoAxWJc.exe
  C:\Windows\System\yoAxWJc.exe
  2⤵
  PID:6296
- C:\Windows\System\AJpoeuu.exe
  C:\Windows\System\AJpoeuu.exe
  2⤵
  PID:6320
- C:\Windows\System\NmuwvdX.exe
  C:\Windows\System\NmuwvdX.exe
  2⤵
  PID:6352
- C:\Windows\System\MozxhiG.exe
  C:\Windows\System\MozxhiG.exe
  2⤵
  PID:6372
- C:\Windows\System\JtlBGDh.exe
  C:\Windows\System\JtlBGDh.exe
  2⤵
  PID:6388
- C:\Windows\System\DxUnmrK.exe
  C:\Windows\System\DxUnmrK.exe
  2⤵
  PID:6412
- C:\Windows\System\iTSTsnV.exe
  C:\Windows\System\iTSTsnV.exe
  2⤵
  PID:6440
- C:\Windows\System\kwAIJIJ.exe
  C:\Windows\System\kwAIJIJ.exe
  2⤵
  PID:6464
- C:\Windows\System\YcMnpQz.exe
  C:\Windows\System\YcMnpQz.exe
  2⤵
  PID:6504
- C:\Windows\System\dckhHhY.exe
  C:\Windows\System\dckhHhY.exe
  2⤵
  PID:6528
- C:\Windows\System\GfONbKI.exe
  C:\Windows\System\GfONbKI.exe
  2⤵
  PID:6552
- C:\Windows\System\nHDCTvQ.exe
  C:\Windows\System\nHDCTvQ.exe
  2⤵
  PID:6580
- C:\Windows\System\XkscFrp.exe
  C:\Windows\System\XkscFrp.exe
  2⤵
  PID:6608
- C:\Windows\System\jreaeAV.exe
  C:\Windows\System\jreaeAV.exe
  2⤵
  PID:6640
- C:\Windows\System\jpfoJKE.exe
  C:\Windows\System\jpfoJKE.exe
  2⤵
  PID:6672
- C:\Windows\System\XsUnlNC.exe
  C:\Windows\System\XsUnlNC.exe
  2⤵
  PID:6692
- C:\Windows\System\cSqjgwq.exe
  C:\Windows\System\cSqjgwq.exe
  2⤵
  PID:6720
- C:\Windows\System\RzfXKDu.exe
  C:\Windows\System\RzfXKDu.exe
  2⤵
  PID:6744
- C:\Windows\System\ofgZCFL.exe
  C:\Windows\System\ofgZCFL.exe
  2⤵
  PID:6772
- C:\Windows\System\YDpBgnI.exe
  C:\Windows\System\YDpBgnI.exe
  2⤵
  PID:6812
- C:\Windows\System\hpBmjoo.exe
  C:\Windows\System\hpBmjoo.exe
  2⤵
  PID:6860
- C:\Windows\System\FbnqWOJ.exe
  C:\Windows\System\FbnqWOJ.exe
  2⤵
  PID:6888
- C:\Windows\System\bwftgUp.exe
  C:\Windows\System\bwftgUp.exe
  2⤵
  PID:6912
- C:\Windows\System\tDRFjzc.exe
  C:\Windows\System\tDRFjzc.exe
  2⤵
  PID:6928
- C:\Windows\System\ujzFCyw.exe
  C:\Windows\System\ujzFCyw.exe
  2⤵
  PID:6964
- C:\Windows\System\VAqdtul.exe
  C:\Windows\System\VAqdtul.exe
  2⤵
  PID:7004
- C:\Windows\System\fgOusUf.exe
  C:\Windows\System\fgOusUf.exe
  2⤵
  PID:7040
- C:\Windows\System\SWIpWMJ.exe
  C:\Windows\System\SWIpWMJ.exe
  2⤵
  PID:7056
- C:\Windows\System\AdzEQmR.exe
  C:\Windows\System\AdzEQmR.exe
  2⤵
  PID:7084
- C:\Windows\System\AuBopsT.exe
  C:\Windows\System\AuBopsT.exe
  2⤵
  PID:7128
- C:\Windows\System\vETbXhx.exe
  C:\Windows\System\vETbXhx.exe
  2⤵
  PID:7144
- C:\Windows\System\lmhLgJA.exe
  C:\Windows\System\lmhLgJA.exe
  2⤵
  PID:6156
- C:\Windows\System\HXMEbqe.exe
  C:\Windows\System\HXMEbqe.exe
  2⤵
  PID:6224
- C:\Windows\System\QvMmMku.exe
  C:\Windows\System\QvMmMku.exe
  2⤵
  PID:6304
- C:\Windows\System\oURvOLx.exe
  C:\Windows\System\oURvOLx.exe
  2⤵
  PID:6316
- C:\Windows\System\zPvwLDB.exe
  C:\Windows\System\zPvwLDB.exe
  2⤵
  PID:6364
- C:\Windows\System\NsXhSVa.exe
  C:\Windows\System\NsXhSVa.exe
  2⤵
  PID:6460
- C:\Windows\System\LGwFIwq.exe
  C:\Windows\System\LGwFIwq.exe
  2⤵
  PID:6452
- C:\Windows\System\XcFivfQ.exe
  C:\Windows\System\XcFivfQ.exe
  2⤵
  PID:6544
- C:\Windows\System\RPCHSRC.exe
  C:\Windows\System\RPCHSRC.exe
  2⤵
  PID:6656
- C:\Windows\System\SujJyoT.exe
  C:\Windows\System\SujJyoT.exe
  2⤵
  PID:6760
- C:\Windows\System\TwWmqlj.exe
  C:\Windows\System\TwWmqlj.exe
  2⤵
  PID:6800
- C:\Windows\System\IRUhFCz.exe
  C:\Windows\System\IRUhFCz.exe
  2⤵
  PID:6904
- C:\Windows\System\rNWLbvC.exe
  C:\Windows\System\rNWLbvC.exe
  2⤵
  PID:6920
- C:\Windows\System\uvtzYyL.exe
  C:\Windows\System\uvtzYyL.exe
  2⤵
  PID:6976
- C:\Windows\System\TTrsYFr.exe
  C:\Windows\System\TTrsYFr.exe
  2⤵
  PID:7068
- C:\Windows\System\BLMeEAN.exe
  C:\Windows\System\BLMeEAN.exe
  2⤵
  PID:7108
- C:\Windows\System\Nktglgg.exe
  C:\Windows\System\Nktglgg.exe
  2⤵
  PID:6280
- C:\Windows\System\fhJtham.exe
  C:\Windows\System\fhJtham.exe
  2⤵
  PID:6404
- C:\Windows\System\pZloMoo.exe
  C:\Windows\System\pZloMoo.exe
  2⤵
  PID:6540
- C:\Windows\System\XldbugO.exe
  C:\Windows\System\XldbugO.exe
  2⤵
  PID:6756
- C:\Windows\System\VDeNoNz.exe
  C:\Windows\System\VDeNoNz.exe
  2⤵
  PID:6832
- C:\Windows\System\IywtWTZ.exe
  C:\Windows\System\IywtWTZ.exe
  2⤵
  PID:7024
- C:\Windows\System\QZXnItI.exe
  C:\Windows\System\QZXnItI.exe
  2⤵
  PID:6252
- C:\Windows\System\hZTdRxB.exe
  C:\Windows\System\hZTdRxB.exe
  2⤵
  PID:6636
- C:\Windows\System\tcpHZBe.exe
  C:\Windows\System\tcpHZBe.exe
  2⤵
  PID:6020
- C:\Windows\System\DEpNoKP.exe
  C:\Windows\System\DEpNoKP.exe
  2⤵
  PID:6564
- C:\Windows\System\SkOGrzy.exe
  C:\Windows\System\SkOGrzy.exe
  2⤵
  PID:7120
- C:\Windows\System\AYFaKXm.exe
  C:\Windows\System\AYFaKXm.exe
  2⤵
  PID:7192
- C:\Windows\System\OVzyrli.exe
  C:\Windows\System\OVzyrli.exe
  2⤵
  PID:7212
- C:\Windows\System\gRnayuV.exe
  C:\Windows\System\gRnayuV.exe
  2⤵
  PID:7240
- C:\Windows\System\ceMQoCe.exe
  C:\Windows\System\ceMQoCe.exe
  2⤵
  PID:7268
- C:\Windows\System\vDXeuQQ.exe
  C:\Windows\System\vDXeuQQ.exe
  2⤵
  PID:7304
- C:\Windows\System\jFcxVUr.exe
  C:\Windows\System\jFcxVUr.exe
  2⤵
  PID:7324
- C:\Windows\System\BsiboGA.exe
  C:\Windows\System\BsiboGA.exe
  2⤵
  PID:7352
- C:\Windows\System\FDTtBgJ.exe
  C:\Windows\System\FDTtBgJ.exe
  2⤵
  PID:7380
- C:\Windows\System\GenLCNV.exe
  C:\Windows\System\GenLCNV.exe
  2⤵
  PID:7416
- C:\Windows\System\exmZaXJ.exe
  C:\Windows\System\exmZaXJ.exe
  2⤵
  PID:7436
- C:\Windows\System\rMXASGT.exe
  C:\Windows\System\rMXASGT.exe
  2⤵
  PID:7464
- C:\Windows\System\EdjQRuE.exe
  C:\Windows\System\EdjQRuE.exe
  2⤵
  PID:7500
- C:\Windows\System\VZNtGlX.exe
  C:\Windows\System\VZNtGlX.exe
  2⤵
  PID:7532
- C:\Windows\System\iBkcGRK.exe
  C:\Windows\System\iBkcGRK.exe
  2⤵
  PID:7552
- C:\Windows\System\DfVxhgV.exe
  C:\Windows\System\DfVxhgV.exe
  2⤵
  PID:7576
- C:\Windows\System\OYwdbdM.exe
  C:\Windows\System\OYwdbdM.exe
  2⤵
  PID:7604
- C:\Windows\System\zKTosuZ.exe
  C:\Windows\System\zKTosuZ.exe
  2⤵
  PID:7636
- C:\Windows\System\TqGSejS.exe
  C:\Windows\System\TqGSejS.exe
  2⤵
  PID:7660
- C:\Windows\System\sWxVZKC.exe
  C:\Windows\System\sWxVZKC.exe
  2⤵
  PID:7688
- C:\Windows\System\CafOnrb.exe
  C:\Windows\System\CafOnrb.exe
  2⤵
  PID:7716
- C:\Windows\System\aBZYlrt.exe
  C:\Windows\System\aBZYlrt.exe
  2⤵
  PID:7752
- C:\Windows\System\RXngQDe.exe
  C:\Windows\System\RXngQDe.exe
  2⤵
  PID:7776
- C:\Windows\System\vtgKQRo.exe
  C:\Windows\System\vtgKQRo.exe
  2⤵
  PID:7812
- C:\Windows\System\XthTMFQ.exe
  C:\Windows\System\XthTMFQ.exe
  2⤵
  PID:7840
- C:\Windows\System\WivedSx.exe
  C:\Windows\System\WivedSx.exe
  2⤵
  PID:7856
- C:\Windows\System\OnZILAi.exe
  C:\Windows\System\OnZILAi.exe
  2⤵
  PID:7876
- C:\Windows\System\CIissEc.exe
  C:\Windows\System\CIissEc.exe
  2⤵
  PID:7896
- C:\Windows\System\ZClCCPU.exe
  C:\Windows\System\ZClCCPU.exe
  2⤵
  PID:7916
- C:\Windows\System\ytfUduz.exe
  C:\Windows\System\ytfUduz.exe
  2⤵
  PID:7960
- C:\Windows\System\UkbAwkB.exe
  C:\Windows\System\UkbAwkB.exe
  2⤵
  PID:7980
- C:\Windows\System\ZiJiprR.exe
  C:\Windows\System\ZiJiprR.exe
  2⤵
  PID:8024
- C:\Windows\System\JPsQCFP.exe
  C:\Windows\System\JPsQCFP.exe
  2⤵
  PID:8044
- C:\Windows\System\JucCvgH.exe
  C:\Windows\System\JucCvgH.exe
  2⤵
  PID:8068
- C:\Windows\System\DuQJFdD.exe
  C:\Windows\System\DuQJFdD.exe
  2⤵
  PID:8084
- C:\Windows\System\QsMCOeU.exe
  C:\Windows\System\QsMCOeU.exe
  2⤵
  PID:8140
- C:\Windows\System\cEsyWXB.exe
  C:\Windows\System\cEsyWXB.exe
  2⤵
  PID:8176
- C:\Windows\System\ZcIBVBn.exe
  C:\Windows\System\ZcIBVBn.exe
  2⤵
  PID:6792
- C:\Windows\System\JmvPcYF.exe
  C:\Windows\System\JmvPcYF.exe
  2⤵
  PID:7176
- C:\Windows\System\OHHAnkI.exe
  C:\Windows\System\OHHAnkI.exe
  2⤵
  PID:7252
- C:\Windows\System\zjMnSUp.exe
  C:\Windows\System\zjMnSUp.exe
  2⤵
  PID:7320
- C:\Windows\System\iULqLdp.exe
  C:\Windows\System\iULqLdp.exe
  2⤵
  PID:7396
- C:\Windows\System\PtlomKj.exe
  C:\Windows\System\PtlomKj.exe
  2⤵
  PID:7488
- C:\Windows\System\eehhtEB.exe
  C:\Windows\System\eehhtEB.exe
  2⤵
  PID:7524
- C:\Windows\System\QgaTDvs.exe
  C:\Windows\System\QgaTDvs.exe
  2⤵
  PID:7564
- C:\Windows\System\InPRVzb.exe
  C:\Windows\System\InPRVzb.exe
  2⤵
  PID:7600
- C:\Windows\System\jSDCGUe.exe
  C:\Windows\System\jSDCGUe.exe
  2⤵
  PID:7680
- C:\Windows\System\nUHcyDl.exe
  C:\Windows\System\nUHcyDl.exe
  2⤵
  PID:7792
- C:\Windows\System\YsOQqOk.exe
  C:\Windows\System\YsOQqOk.exe
  2⤵
  PID:7824
- C:\Windows\System\LDkRGPo.exe
  C:\Windows\System\LDkRGPo.exe
  2⤵
  PID:7848
- C:\Windows\System\LYSZgfV.exe
  C:\Windows\System\LYSZgfV.exe
  2⤵
  PID:7968
- C:\Windows\System\BSUveOr.exe
  C:\Windows\System\BSUveOr.exe
  2⤵
  PID:8008
- C:\Windows\System\PaSrXOA.exe
  C:\Windows\System\PaSrXOA.exe
  2⤵
  PID:8036
- C:\Windows\System\UTvctin.exe
  C:\Windows\System\UTvctin.exe
  2⤵
  PID:8108
- C:\Windows\System\dqLuDzc.exe
  C:\Windows\System\dqLuDzc.exe
  2⤵
  PID:7180
- C:\Windows\System\ekbbaIh.exe
  C:\Windows\System\ekbbaIh.exe
  2⤵
  PID:7368
- C:\Windows\System\QJVEpdW.exe
  C:\Windows\System\QJVEpdW.exe
  2⤵
  PID:7748
- C:\Windows\System\SFicrqL.exe
  C:\Windows\System\SFicrqL.exe
  2⤵
  PID:7712
- C:\Windows\System\xZgMOgk.exe
  C:\Windows\System\xZgMOgk.exe
  2⤵
  PID:7892
- C:\Windows\System\cskcvje.exe
  C:\Windows\System\cskcvje.exe
  2⤵
  PID:8052
- C:\Windows\System\DLMwHxc.exe
  C:\Windows\System\DLMwHxc.exe
  2⤵
  PID:8112
- C:\Windows\System\SAeIeuK.exe
  C:\Windows\System\SAeIeuK.exe
  2⤵
  PID:7888
- C:\Windows\System\ytQwtkO.exe
  C:\Windows\System\ytQwtkO.exe
  2⤵
  PID:7300
- C:\Windows\System\cxhrKWf.exe
  C:\Windows\System\cxhrKWf.exe
  2⤵
  PID:7944
- C:\Windows\System\GfZTZPp.exe
  C:\Windows\System\GfZTZPp.exe
  2⤵
  PID:8208
- C:\Windows\System\wVmjivT.exe
  C:\Windows\System\wVmjivT.exe
  2⤵
  PID:8228
- C:\Windows\System\fRYVkzF.exe
  C:\Windows\System\fRYVkzF.exe
  2⤵
  PID:8260
- C:\Windows\System\lVSUGoz.exe
  C:\Windows\System\lVSUGoz.exe
  2⤵
  PID:8280
- C:\Windows\System\RVEunXT.exe
  C:\Windows\System\RVEunXT.exe
  2⤵
  PID:8312
- C:\Windows\System\CCoiRpE.exe
  C:\Windows\System\CCoiRpE.exe
  2⤵
  PID:8340
- C:\Windows\System\KQieNPS.exe
  C:\Windows\System\KQieNPS.exe
  2⤵
  PID:8364
- C:\Windows\System\oouZZJM.exe
  C:\Windows\System\oouZZJM.exe
  2⤵
  PID:8392
- C:\Windows\System\zRKOurk.exe
  C:\Windows\System\zRKOurk.exe
  2⤵
  PID:8432
- C:\Windows\System\wPjsFyz.exe
  C:\Windows\System\wPjsFyz.exe
  2⤵
  PID:8460
- C:\Windows\System\YZDSYJH.exe
  C:\Windows\System\YZDSYJH.exe
  2⤵
  PID:8484
- C:\Windows\System\XQJJlRj.exe
  C:\Windows\System\XQJJlRj.exe
  2⤵
  PID:8520
- C:\Windows\System\nFuPPiC.exe
  C:\Windows\System\nFuPPiC.exe
  2⤵
  PID:8552
- C:\Windows\System\gKKpPgB.exe
  C:\Windows\System\gKKpPgB.exe
  2⤵
  PID:8580
- C:\Windows\System\CEfqEqZ.exe
  C:\Windows\System\CEfqEqZ.exe
  2⤵
  PID:8608
- C:\Windows\System\fPrMIOu.exe
  C:\Windows\System\fPrMIOu.exe
  2⤵
  PID:8636
- C:\Windows\System\LEwiprE.exe
  C:\Windows\System\LEwiprE.exe
  2⤵
  PID:8656
- C:\Windows\System\BfDdMro.exe
  C:\Windows\System\BfDdMro.exe
  2⤵
  PID:8692
- C:\Windows\System\DRjfsoL.exe
  C:\Windows\System\DRjfsoL.exe
  2⤵
  PID:8720
- C:\Windows\System\fWahxbc.exe
  C:\Windows\System\fWahxbc.exe
  2⤵
  PID:8748
- C:\Windows\System\DWrYcaj.exe
  C:\Windows\System\DWrYcaj.exe
  2⤵
  PID:8764
- C:\Windows\System\SRUAAas.exe
  C:\Windows\System\SRUAAas.exe
  2⤵
  PID:8804
- C:\Windows\System\IodzfSf.exe
  C:\Windows\System\IodzfSf.exe
  2⤵
  PID:8832
- C:\Windows\System\ZYnzTDJ.exe
  C:\Windows\System\ZYnzTDJ.exe
  2⤵
  PID:8860
- C:\Windows\System\ZnZXXhp.exe
  C:\Windows\System\ZnZXXhp.exe
  2⤵
  PID:8880
- C:\Windows\System\uKtHsSY.exe
  C:\Windows\System\uKtHsSY.exe
  2⤵
  PID:8904
- C:\Windows\System\lzikVKi.exe
  C:\Windows\System\lzikVKi.exe
  2⤵
  PID:8932
- C:\Windows\System\VxiBcId.exe
  C:\Windows\System\VxiBcId.exe
  2⤵
  PID:8960
- C:\Windows\System\zIqVBXo.exe
  C:\Windows\System\zIqVBXo.exe
  2⤵
  PID:8988
- C:\Windows\System\dOkyEKA.exe
  C:\Windows\System\dOkyEKA.exe
  2⤵
  PID:9012
- C:\Windows\System\ifvpmYI.exe
  C:\Windows\System\ifvpmYI.exe
  2⤵
  PID:9052
- C:\Windows\System\BhrYuyd.exe
  C:\Windows\System\BhrYuyd.exe
  2⤵
  PID:9068
- C:\Windows\System\BSMrZjU.exe
  C:\Windows\System\BSMrZjU.exe
  2⤵
  PID:9104
- C:\Windows\System\MZRtSfU.exe
  C:\Windows\System\MZRtSfU.exe
  2⤵
  PID:9128
- C:\Windows\System\gWiuiME.exe
  C:\Windows\System\gWiuiME.exe
  2⤵
  PID:9156
- C:\Windows\System\blUzYiU.exe
  C:\Windows\System\blUzYiU.exe
  2⤵
  PID:9184
- C:\Windows\System\XoqPLmZ.exe
  C:\Windows\System\XoqPLmZ.exe
  2⤵
  PID:9212
- C:\Windows\System\EvvotPl.exe
  C:\Windows\System\EvvotPl.exe
  2⤵
  PID:8216
- C:\Windows\System\KPQKEss.exe
  C:\Windows\System\KPQKEss.exe
  2⤵
  PID:8320
- C:\Windows\System\tHPQxzR.exe
  C:\Windows\System\tHPQxzR.exe
  2⤵
  PID:8380
- C:\Windows\System\LfutGzT.exe
  C:\Windows\System\LfutGzT.exe
  2⤵
  PID:8428
- C:\Windows\System\CqJWIfH.exe
  C:\Windows\System\CqJWIfH.exe
  2⤵
  PID:8504
- C:\Windows\System\MLEBcvI.exe
  C:\Windows\System\MLEBcvI.exe
  2⤵
  PID:8576
- C:\Windows\System\yWmHpul.exe
  C:\Windows\System\yWmHpul.exe
  2⤵
  PID:8652
- C:\Windows\System\uEkcZuP.exe
  C:\Windows\System\uEkcZuP.exe
  2⤵
  PID:8708
- C:\Windows\System\FBWVBBg.exe
  C:\Windows\System\FBWVBBg.exe
  2⤵
  PID:8756
- C:\Windows\System\ICrUmnf.exe
  C:\Windows\System\ICrUmnf.exe
  2⤵
  PID:8796
- C:\Windows\System\hFbXzQm.exe
  C:\Windows\System\hFbXzQm.exe
  2⤵
  PID:8876
- C:\Windows\System\dMbYphF.exe
  C:\Windows\System\dMbYphF.exe
  2⤵
  PID:8980
- C:\Windows\System\VfUbyzb.exe
  C:\Windows\System\VfUbyzb.exe
  2⤵
  PID:9036
- C:\Windows\System\TKXtnFU.exe
  C:\Windows\System\TKXtnFU.exe
  2⤵
  PID:9112
- C:\Windows\System\Ziubcuf.exe
  C:\Windows\System\Ziubcuf.exe
  2⤵
  PID:9124
- C:\Windows\System\RDjtnXm.exe
  C:\Windows\System\RDjtnXm.exe
  2⤵
  PID:9208
- C:\Windows\System\LTSrlKI.exe
  C:\Windows\System\LTSrlKI.exe
  2⤵
  PID:8240
- C:\Windows\System\MxBvyJm.exe
  C:\Windows\System\MxBvyJm.exe
  2⤵
  PID:8508
- C:\Windows\System\gTDaOPI.exe
  C:\Windows\System\gTDaOPI.exe
  2⤵
  PID:8572
- C:\Windows\System\skrlfkz.exe
  C:\Windows\System\skrlfkz.exe
  2⤵
  PID:8716
- C:\Windows\System\reBfYUZ.exe
  C:\Windows\System\reBfYUZ.exe
  2⤵
  PID:8924
- C:\Windows\System\pHkEvCA.exe
  C:\Windows\System\pHkEvCA.exe
  2⤵
  PID:9084
- C:\Windows\System\igoXEuD.exe
  C:\Windows\System\igoXEuD.exe
  2⤵
  PID:8416
- C:\Windows\System\QfdlDZw.exe
  C:\Windows\System\QfdlDZw.exe
  2⤵
  PID:8680
- C:\Windows\System\XmRbshn.exe
  C:\Windows\System\XmRbshn.exe
  2⤵
  PID:8816
- C:\Windows\System\kVasRKL.exe
  C:\Windows\System\kVasRKL.exe
  2⤵
  PID:8480
- C:\Windows\System\qyCaKrD.exe
  C:\Windows\System\qyCaKrD.exe
  2⤵
  PID:8792
- C:\Windows\System\iOxkONg.exe
  C:\Windows\System\iOxkONg.exe
  2⤵
  PID:9236
- C:\Windows\System\XTrXByZ.exe
  C:\Windows\System\XTrXByZ.exe
  2⤵
  PID:9260
- C:\Windows\System\AIqdWLb.exe
  C:\Windows\System\AIqdWLb.exe
  2⤵
  PID:9288
- C:\Windows\System\pLgsmqS.exe
  C:\Windows\System\pLgsmqS.exe
  2⤵
  PID:9316
- C:\Windows\System\NxgCmUy.exe
  C:\Windows\System\NxgCmUy.exe
  2⤵
  PID:9336
- C:\Windows\System\wlvzaID.exe
  C:\Windows\System\wlvzaID.exe
  2⤵
  PID:9368
- C:\Windows\System\bIfKJON.exe
  C:\Windows\System\bIfKJON.exe
  2⤵
  PID:9396
- C:\Windows\System\McXYwVq.exe
  C:\Windows\System\McXYwVq.exe
  2⤵
  PID:9416
- C:\Windows\System\QijkBIS.exe
  C:\Windows\System\QijkBIS.exe
  2⤵
  PID:9436
- C:\Windows\System\dmysMJf.exe
  C:\Windows\System\dmysMJf.exe
  2⤵
  PID:9488
- C:\Windows\System\qIdHBZs.exe
  C:\Windows\System\qIdHBZs.exe
  2⤵
  PID:9520
- C:\Windows\System\mPJxhfo.exe
  C:\Windows\System\mPJxhfo.exe
  2⤵
  PID:9560
- C:\Windows\System\EgfZNda.exe
  C:\Windows\System\EgfZNda.exe
  2⤵
  PID:9580
- C:\Windows\System\jacxuRr.exe
  C:\Windows\System\jacxuRr.exe
  2⤵
  PID:9604
- C:\Windows\System\DJZriiw.exe
  C:\Windows\System\DJZriiw.exe
  2⤵
  PID:9624
- C:\Windows\System\uBPwcWv.exe
  C:\Windows\System\uBPwcWv.exe
  2⤵
  PID:9652
- C:\Windows\System\IEGkkXO.exe
  C:\Windows\System\IEGkkXO.exe
  2⤵
  PID:9676
- C:\Windows\System\SuKMMnH.exe
  C:\Windows\System\SuKMMnH.exe
  2⤵
  PID:9692
- C:\Windows\System\bXMlALH.exe
  C:\Windows\System\bXMlALH.exe
  2⤵
  PID:9712
- C:\Windows\System\JPholBw.exe
  C:\Windows\System\JPholBw.exe
  2⤵
  PID:9752
- C:\Windows\System\RoelKFD.exe
  C:\Windows\System\RoelKFD.exe
  2⤵
  PID:9776
- C:\Windows\System\dZJRgar.exe
  C:\Windows\System\dZJRgar.exe
  2⤵
  PID:9808
- C:\Windows\System\FafJeYi.exe
  C:\Windows\System\FafJeYi.exe
  2⤵
  PID:9848
- C:\Windows\System\DKDsfHu.exe
  C:\Windows\System\DKDsfHu.exe
  2⤵
  PID:9868
- C:\Windows\System\KAREhGO.exe
  C:\Windows\System\KAREhGO.exe
  2⤵
  PID:9896
- C:\Windows\System\FAOhkGY.exe
  C:\Windows\System\FAOhkGY.exe
  2⤵
  PID:9936
- C:\Windows\System\rDgMITW.exe
  C:\Windows\System\rDgMITW.exe
  2⤵
  PID:9968
- C:\Windows\System\mcyVFHL.exe
  C:\Windows\System\mcyVFHL.exe
  2⤵
  PID:9988
- C:\Windows\System\DKGnlXl.exe
  C:\Windows\System\DKGnlXl.exe
  2⤵
  PID:10012
- C:\Windows\System\kaOaGbL.exe
  C:\Windows\System\kaOaGbL.exe
  2⤵
  PID:10044
- C:\Windows\System\pLfIJss.exe
  C:\Windows\System\pLfIJss.exe
  2⤵
  PID:10072
- C:\Windows\System\sEnbRuw.exe
  C:\Windows\System\sEnbRuw.exe
  2⤵
  PID:10100
- C:\Windows\System\ZMljXpF.exe
  C:\Windows\System\ZMljXpF.exe
  2⤵
  PID:10140
- C:\Windows\System\FqtOGur.exe
  C:\Windows\System\FqtOGur.exe
  2⤵
  PID:10168
- C:\Windows\System\VtZECQU.exe
  C:\Windows\System\VtZECQU.exe
  2⤵
  PID:10192
- C:\Windows\System\AMsWyxe.exe
  C:\Windows\System\AMsWyxe.exe
  2⤵
  PID:10212
- C:\Windows\System\zJjHYcq.exe
  C:\Windows\System\zJjHYcq.exe
  2⤵
  PID:9032
- C:\Windows\System\GhKrvPV.exe
  C:\Windows\System\GhKrvPV.exe
  2⤵
  PID:9256
- C:\Windows\System\GuxzMqI.exe
  C:\Windows\System\GuxzMqI.exe
  2⤵
  PID:9280
- C:\Windows\System\kOZRplN.exe
  C:\Windows\System\kOZRplN.exe
  2⤵
  PID:9432
- C:\Windows\System\TGpnASl.exe
  C:\Windows\System\TGpnASl.exe
  2⤵
  PID:9388
- C:\Windows\System\zCaWVRl.exe
  C:\Windows\System\zCaWVRl.exe
  2⤵
  PID:9552
- C:\Windows\System\EMdLcmJ.exe
  C:\Windows\System\EMdLcmJ.exe
  2⤵
  PID:9612
- C:\Windows\System\nzqxJYT.exe
  C:\Windows\System\nzqxJYT.exe
  2⤵
  PID:9660
- C:\Windows\System\uZlvUlL.exe
  C:\Windows\System\uZlvUlL.exe
  2⤵
  PID:9740
- C:\Windows\System\CcPqPhR.exe
  C:\Windows\System\CcPqPhR.exe
  2⤵
  PID:9828
- C:\Windows\System\DbnMSpF.exe
  C:\Windows\System\DbnMSpF.exe
  2⤵
  PID:9888
- C:\Windows\System\bNVrLzR.exe
  C:\Windows\System\bNVrLzR.exe
  2⤵
  PID:9956
- C:\Windows\System\KnlPCNV.exe
  C:\Windows\System\KnlPCNV.exe
  2⤵
  PID:10036
- C:\Windows\System\hYTsHjb.exe
  C:\Windows\System\hYTsHjb.exe
  2⤵
  PID:10032
- C:\Windows\System\fIpUYdN.exe
  C:\Windows\System\fIpUYdN.exe
  2⤵
  PID:10148
- C:\Windows\System\DsTwitF.exe
  C:\Windows\System\DsTwitF.exe
  2⤵
  PID:10176
- C:\Windows\System\FVQBijl.exe
  C:\Windows\System\FVQBijl.exe
  2⤵
  PID:10200
- C:\Windows\System\iPXuefR.exe
  C:\Windows\System\iPXuefR.exe
  2⤵
  PID:9516
- C:\Windows\System\UHWKRHK.exe
  C:\Windows\System\UHWKRHK.exe
  2⤵
  PID:9632
- C:\Windows\System\GlDRfzS.exe
  C:\Windows\System\GlDRfzS.exe
  2⤵
  PID:9788
- C:\Windows\System\kjnKMQL.exe
  C:\Windows\System\kjnKMQL.exe
  2⤵
  PID:9912
- C:\Windows\System\fhLBWaH.exe
  C:\Windows\System\fhLBWaH.exe
  2⤵
  PID:10056
- C:\Windows\System\WQJpFZI.exe
  C:\Windows\System\WQJpFZI.exe
  2⤵
  PID:10136
- C:\Windows\System\mWrrdlS.exe
  C:\Windows\System\mWrrdlS.exe
  2⤵
  PID:10220
- C:\Windows\System\fhVoKld.exe
  C:\Windows\System\fhVoKld.exe
  2⤵
  PID:9588
- C:\Windows\System\sxqfVdK.exe
  C:\Windows\System\sxqfVdK.exe
  2⤵
  PID:9884
- C:\Windows\System\AaDLZUu.exe
  C:\Windows\System\AaDLZUu.exe
  2⤵
  PID:10092
- C:\Windows\System\YSAlkOh.exe
  C:\Windows\System\YSAlkOh.exe
  2⤵
  PID:10264
- C:\Windows\System\GoXSosm.exe
  C:\Windows\System\GoXSosm.exe
  2⤵
  PID:10296
- C:\Windows\System\zXauRsA.exe
  C:\Windows\System\zXauRsA.exe
  2⤵
  PID:10328
- C:\Windows\System\JTiJikB.exe
  C:\Windows\System\JTiJikB.exe
  2⤵
  PID:10352
- C:\Windows\System\DDpKOXy.exe
  C:\Windows\System\DDpKOXy.exe
  2⤵
  PID:10376
- C:\Windows\System\WrGGyAt.exe
  C:\Windows\System\WrGGyAt.exe
  2⤵
  PID:10420
- C:\Windows\System\SoHwNox.exe
  C:\Windows\System\SoHwNox.exe
  2⤵
  PID:10444
- C:\Windows\System\GVjtFxV.exe
  C:\Windows\System\GVjtFxV.exe
  2⤵
  PID:10464
- C:\Windows\System\nrpXSvs.exe
  C:\Windows\System\nrpXSvs.exe
  2⤵
  PID:10496
- C:\Windows\System\mXgGTqT.exe
  C:\Windows\System\mXgGTqT.exe
  2⤵
  PID:10528
- C:\Windows\System\sKMfnxU.exe
  C:\Windows\System\sKMfnxU.exe
  2⤵
  PID:10564
- C:\Windows\System\Jwchcik.exe
  C:\Windows\System\Jwchcik.exe
  2⤵
  PID:10584
- C:\Windows\System\WvJnRxq.exe
  C:\Windows\System\WvJnRxq.exe
  2⤵
  PID:10612
- C:\Windows\System\cckuAbL.exe
  C:\Windows\System\cckuAbL.exe
  2⤵
  PID:10640
- C:\Windows\System\mGzKDjT.exe
  C:\Windows\System\mGzKDjT.exe
  2⤵
  PID:10656
- C:\Windows\System\bkmylWF.exe
  C:\Windows\System\bkmylWF.exe
  2⤵
  PID:10684
- C:\Windows\System\SIbMXji.exe
  C:\Windows\System\SIbMXji.exe
  2⤵
  PID:10732
- C:\Windows\System\NrseWMg.exe
  C:\Windows\System\NrseWMg.exe
  2⤵
  PID:10768
- C:\Windows\System\dKNztnb.exe
  C:\Windows\System\dKNztnb.exe
  2⤵
  PID:10796
- C:\Windows\System\bpXXyjC.exe
  C:\Windows\System\bpXXyjC.exe
  2⤵
  PID:10812
- C:\Windows\System\QeEZJKA.exe
  C:\Windows\System\QeEZJKA.exe
  2⤵
  PID:10828
- C:\Windows\System\GrJtvPJ.exe
  C:\Windows\System\GrJtvPJ.exe
  2⤵
  PID:10856
- C:\Windows\System\wRavrsl.exe
  C:\Windows\System\wRavrsl.exe
  2⤵
  PID:10888
- C:\Windows\System\tyUGVdS.exe
  C:\Windows\System\tyUGVdS.exe
  2⤵
  PID:10924
- C:\Windows\System\yQItWUB.exe
  C:\Windows\System\yQItWUB.exe
  2⤵
  PID:10948
- C:\Windows\System\wtjGZta.exe
  C:\Windows\System\wtjGZta.exe
  2⤵
  PID:10992
- C:\Windows\System\xwqTjVe.exe
  C:\Windows\System\xwqTjVe.exe
  2⤵
  PID:11020
- C:\Windows\System\pyzlmNt.exe
  C:\Windows\System\pyzlmNt.exe
  2⤵
  PID:11040
- C:\Windows\System\hcQfeOP.exe
  C:\Windows\System\hcQfeOP.exe
  2⤵
  PID:11064
- C:\Windows\System\JrlvMeX.exe
  C:\Windows\System\JrlvMeX.exe
  2⤵
  PID:11104
- C:\Windows\System\ralyhmn.exe
  C:\Windows\System\ralyhmn.exe
  2⤵
  PID:11132
- C:\Windows\System\jJCKjAx.exe
  C:\Windows\System\jJCKjAx.exe
  2⤵
  PID:11148
- C:\Windows\System\YWrWaou.exe
  C:\Windows\System\YWrWaou.exe
  2⤵
  PID:11176
- C:\Windows\System\puTPKyk.exe
  C:\Windows\System\puTPKyk.exe
  2⤵
  PID:11208
- C:\Windows\System\xpAmZpH.exe
  C:\Windows\System\xpAmZpH.exe
  2⤵
  PID:11232
- C:\Windows\System\vYdSLay.exe
  C:\Windows\System\vYdSLay.exe
  2⤵
  PID:10188
- C:\Windows\System\rwaggkB.exe
  C:\Windows\System\rwaggkB.exe
  2⤵
  PID:10248
- C:\Windows\System\yIveaaI.exe
  C:\Windows\System\yIveaaI.exe
  2⤵
  PID:10344
- C:\Windows\System\IovnnEh.exe
  C:\Windows\System\IovnnEh.exe
  2⤵
  PID:10400
- C:\Windows\System\cOgoQVZ.exe
  C:\Windows\System\cOgoQVZ.exe
  2⤵
  PID:10460
- C:\Windows\System\wVfHfjE.exe
  C:\Windows\System\wVfHfjE.exe
  2⤵
  PID:10512
- C:\Windows\System\DNJJlQJ.exe
  C:\Windows\System\DNJJlQJ.exe
  2⤵
  PID:10580
- C:\Windows\System\QPuwqeV.exe
  C:\Windows\System\QPuwqeV.exe
  2⤵
  PID:10648
- C:\Windows\System\EVShOWE.exe
  C:\Windows\System\EVShOWE.exe
  2⤵
  PID:10700
- C:\Windows\System\TKJxtCF.exe
  C:\Windows\System\TKJxtCF.exe
  2⤵
  PID:10752
- C:\Windows\System\JMCxijp.exe
  C:\Windows\System\JMCxijp.exe
  2⤵
  PID:10848
- C:\Windows\System\bSsfHyB.exe
  C:\Windows\System\bSsfHyB.exe
  2⤵
  PID:10940
- C:\Windows\System\wnpHGvQ.exe
  C:\Windows\System\wnpHGvQ.exe
  2⤵
  PID:10964
- C:\Windows\System\QNMMkDo.exe
  C:\Windows\System\QNMMkDo.exe
  2⤵
  PID:11036
- C:\Windows\System\zqUQNLg.exe
  C:\Windows\System\zqUQNLg.exe
  2⤵
  PID:11088
- C:\Windows\System\jspILyI.exe
  C:\Windows\System\jspILyI.exe
  2⤵
  PID:11140
- C:\Windows\System\zWRZnSe.exe
  C:\Windows\System\zWRZnSe.exe
  2⤵
  PID:11228
- C:\Windows\System\skExtww.exe
  C:\Windows\System\skExtww.exe
  2⤵
  PID:10288
- C:\Windows\System\zeocpQC.exe
  C:\Windows\System\zeocpQC.exe
  2⤵
  PID:10436
- C:\Windows\System\GKBGeNo.exe
  C:\Windows\System\GKBGeNo.exe
  2⤵
  PID:9428
- C:\Windows\System\DhbkUgi.exe
  C:\Windows\System\DhbkUgi.exe
  2⤵
  PID:10748
- C:\Windows\System\BPBRXJf.exe
  C:\Windows\System\BPBRXJf.exe
  2⤵
  PID:10824
- C:\Windows\System\AyLszCS.exe
  C:\Windows\System\AyLszCS.exe
  2⤵
  PID:10988
- C:\Windows\System\oexyHvL.exe
  C:\Windows\System\oexyHvL.exe
  2⤵
  PID:11028
- C:\Windows\System\adGKOiu.exe
  C:\Windows\System\adGKOiu.exe
  2⤵
  PID:11188
- C:\Windows\System\YJNDmge.exe
  C:\Windows\System\YJNDmge.exe
  2⤵
  PID:10372
- C:\Windows\System\QUQFSQE.exe
  C:\Windows\System\QUQFSQE.exe
  2⤵
  PID:10724
- C:\Windows\System\dDfPjuR.exe
  C:\Windows\System\dDfPjuR.exe
  2⤵
  PID:10572
- C:\Windows\System\jBvBFWi.exe
  C:\Windows\System\jBvBFWi.exe
  2⤵
  PID:10884
- C:\Windows\System\GScccHf.exe
  C:\Windows\System\GScccHf.exe
  2⤵
  PID:11284
- C:\Windows\System\SuSJAaT.exe
  C:\Windows\System\SuSJAaT.exe
  2⤵
  PID:11308
- C:\Windows\System\eRRjojw.exe
  C:\Windows\System\eRRjojw.exe
  2⤵
  PID:11328
- C:\Windows\System\CqPthGR.exe
  C:\Windows\System\CqPthGR.exe
  2⤵
  PID:11356
- C:\Windows\System\LAJDiUD.exe
  C:\Windows\System\LAJDiUD.exe
  2⤵
  PID:11440
- C:\Windows\System\GPEDNUu.exe
  C:\Windows\System\GPEDNUu.exe
  2⤵
  PID:11456
- C:\Windows\System\BaQCGWW.exe
  C:\Windows\System\BaQCGWW.exe
  2⤵
  PID:11484
- C:\Windows\System\HsOvFjP.exe
  C:\Windows\System\HsOvFjP.exe
  2⤵
  PID:11500
- C:\Windows\System\HSIntGt.exe
  C:\Windows\System\HSIntGt.exe
  2⤵
  PID:11528
- C:\Windows\System\swTpaef.exe
  C:\Windows\System\swTpaef.exe
  2⤵
  PID:11572
- C:\Windows\System\ZYKkLce.exe
  C:\Windows\System\ZYKkLce.exe
  2⤵
  PID:11600
- C:\Windows\System\fWQDBFT.exe
  C:\Windows\System\fWQDBFT.exe
  2⤵
  PID:11616
- C:\Windows\System\RcMkZzh.exe
  C:\Windows\System\RcMkZzh.exe
  2⤵
  PID:11640
- C:\Windows\System\tlbxDlt.exe
  C:\Windows\System\tlbxDlt.exe
  2⤵
  PID:11668
- C:\Windows\System\lyXkeHa.exe
  C:\Windows\System\lyXkeHa.exe
  2⤵
  PID:11712
- C:\Windows\System\CgqkTif.exe
  C:\Windows\System\CgqkTif.exe
  2⤵
  PID:11740
- C:\Windows\System\WGEBsKU.exe
  C:\Windows\System\WGEBsKU.exe
  2⤵
  PID:11760
- C:\Windows\System\CeIxKeA.exe
  C:\Windows\System\CeIxKeA.exe
  2⤵
  PID:11784
- C:\Windows\System\HUuPSKJ.exe
  C:\Windows\System\HUuPSKJ.exe
  2⤵
  PID:11824
- C:\Windows\System\QvLSGdc.exe
  C:\Windows\System\QvLSGdc.exe
  2⤵
  PID:11840
- C:\Windows\System\OeWBZKR.exe
  C:\Windows\System\OeWBZKR.exe
  2⤵
  PID:11860
- C:\Windows\System\qYaLdBk.exe
  C:\Windows\System\qYaLdBk.exe
  2⤵
  PID:11888
- C:\Windows\System\AcwFDXy.exe
  C:\Windows\System\AcwFDXy.exe
  2⤵
  PID:11912
- C:\Windows\System\WYTlEjm.exe
  C:\Windows\System\WYTlEjm.exe
  2⤵
  PID:11940
- C:\Windows\System\kCbnnrU.exe
  C:\Windows\System\kCbnnrU.exe
  2⤵
  PID:11960
- C:\Windows\System\SeagTKd.exe
  C:\Windows\System\SeagTKd.exe
  2⤵
  PID:12004
- C:\Windows\System\wipvGAI.exe
  C:\Windows\System\wipvGAI.exe
  2⤵
  PID:12024
- C:\Windows\System\MxnbxYv.exe
  C:\Windows\System\MxnbxYv.exe
  2⤵
  PID:12056
- C:\Windows\System\CSmoTMD.exe
  C:\Windows\System\CSmoTMD.exe
  2⤵
  PID:12080
- C:\Windows\System\FFYesFG.exe
  C:\Windows\System\FFYesFG.exe
  2⤵
  PID:12108
- C:\Windows\System\CeFqXqZ.exe
  C:\Windows\System\CeFqXqZ.exe
  2⤵
  PID:12148
- C:\Windows\System\yFQbtUb.exe
  C:\Windows\System\yFQbtUb.exe
  2⤵
  PID:12164
- C:\Windows\System\kkpDKzj.exe
  C:\Windows\System\kkpDKzj.exe
  2⤵
  PID:12200
- C:\Windows\System\xEmMfou.exe
  C:\Windows\System\xEmMfou.exe
  2⤵
  PID:12232
- C:\Windows\System\DeKNFnf.exe
  C:\Windows\System\DeKNFnf.exe
  2⤵
  PID:12260
- C:\Windows\System\IquFzJd.exe
  C:\Windows\System\IquFzJd.exe
  2⤵
  PID:11268
- C:\Windows\System\AecEPms.exe
  C:\Windows\System\AecEPms.exe
  2⤵
  PID:11300
- C:\Windows\System\WQuqLsL.exe
  C:\Windows\System\WQuqLsL.exe
  2⤵
  PID:11368
- C:\Windows\System\DaQTBzI.exe
  C:\Windows\System\DaQTBzI.exe
  2⤵
  PID:10756
- C:\Windows\System\oUzKAnf.exe
  C:\Windows\System\oUzKAnf.exe
  2⤵
  PID:11496
- C:\Windows\System\wwvljoX.exe
  C:\Windows\System\wwvljoX.exe
  2⤵
  PID:11520
- C:\Windows\System\zYOBPfp.exe
  C:\Windows\System\zYOBPfp.exe
  2⤵
  PID:11612
- C:\Windows\System\emIAErZ.exe
  C:\Windows\System\emIAErZ.exe
  2⤵
  PID:11704
- C:\Windows\System\dylYaIX.exe
  C:\Windows\System\dylYaIX.exe
  2⤵
  PID:11804
- C:\Windows\System\oSknVnR.exe
  C:\Windows\System\oSknVnR.exe
  2⤵
  PID:11852
- C:\Windows\System\mIpaJRj.exe
  C:\Windows\System\mIpaJRj.exe
  2⤵
  PID:11876
- C:\Windows\System\IDPQpVU.exe
  C:\Windows\System\IDPQpVU.exe
  2⤵
  PID:11968
- C:\Windows\System\fgfgDMF.exe
  C:\Windows\System\fgfgDMF.exe
  2⤵
  PID:12052
- C:\Windows\System\KJIFEBe.exe
  C:\Windows\System\KJIFEBe.exe
  2⤵
  PID:12144
- C:\Windows\System\MZlRiqD.exe
  C:\Windows\System\MZlRiqD.exe
  2⤵
  PID:12156
- C:\Windows\System\sseSkRW.exe
  C:\Windows\System\sseSkRW.exe
  2⤵
  PID:12192
- C:\Windows\System\EXpakFS.exe
  C:\Windows\System\EXpakFS.exe
  2⤵
  PID:12252
- C:\Windows\System\DBXkDyE.exe
  C:\Windows\System\DBXkDyE.exe
  2⤵
  PID:11144
- C:\Windows\System\jgzSFjP.exe
  C:\Windows\System\jgzSFjP.exe
  2⤵
  PID:11492
- C:\Windows\System\NFYfDGL.exe
  C:\Windows\System\NFYfDGL.exe
  2⤵
  PID:11776
- C:\Windows\System\nOyAnRr.exe
  C:\Windows\System\nOyAnRr.exe
  2⤵
  PID:11904
- C:\Windows\System\okAdVZf.exe
  C:\Windows\System\okAdVZf.exe
  2⤵
  PID:12020
- C:\Windows\System\sAwSslh.exe
  C:\Windows\System\sAwSslh.exe
  2⤵
  PID:12016
- C:\Windows\System\ooOZFcg.exe
  C:\Windows\System\ooOZFcg.exe
  2⤵
  PID:11384
- C:\Windows\System\LpxEsoP.exe
  C:\Windows\System\LpxEsoP.exe
  2⤵
  PID:11724
- C:\Windows\System\smaNzGv.exe
  C:\Windows\System\smaNzGv.exe
  2⤵
  PID:12076
- C:\Windows\System\vNCNevo.exe
  C:\Windows\System\vNCNevo.exe
  2⤵
  PID:11304
- C:\Windows\System\LUegwpC.exe
  C:\Windows\System\LUegwpC.exe
  2⤵
  PID:11800
- C:\Windows\System\IFXJiva.exe
  C:\Windows\System\IFXJiva.exe
  2⤵
  PID:12304
- C:\Windows\System\HKUZPVs.exe
  C:\Windows\System\HKUZPVs.exe
  2⤵
  PID:12332
- C:\Windows\System\OcZwrkn.exe
  C:\Windows\System\OcZwrkn.exe
  2⤵
  PID:12356
- C:\Windows\System\LkPrwVB.exe
  C:\Windows\System\LkPrwVB.exe
  2⤵
  PID:12388
- C:\Windows\System\sksvynN.exe
  C:\Windows\System\sksvynN.exe
  2⤵
  PID:12428
- C:\Windows\System\GLwPywd.exe
  C:\Windows\System\GLwPywd.exe
  2⤵
  PID:12468
- C:\Windows\System\bYNvZEf.exe
  C:\Windows\System\bYNvZEf.exe
  2⤵
  PID:12496
- C:\Windows\System\rDfRhWK.exe
  C:\Windows\System\rDfRhWK.exe
  2⤵
  PID:12524
- C:\Windows\System\CtMzplV.exe
  C:\Windows\System\CtMzplV.exe
  2⤵
  PID:12552
- C:\Windows\System\iYEwaIl.exe
  C:\Windows\System\iYEwaIl.exe
  2⤵
  PID:12580
- C:\Windows\System\uAiBAwu.exe
  C:\Windows\System\uAiBAwu.exe
  2⤵
  PID:12604
- C:\Windows\System\RomQeXS.exe
  C:\Windows\System\RomQeXS.exe
  2⤵
  PID:12624
- C:\Windows\System\aFtWlmx.exe
  C:\Windows\System\aFtWlmx.exe
  2⤵
  PID:12664
- C:\Windows\System\SzhMVUh.exe
  C:\Windows\System\SzhMVUh.exe
  2⤵
  PID:12680
- C:\Windows\System\ZYmrGnI.exe
  C:\Windows\System\ZYmrGnI.exe
  2⤵
  PID:12708
- C:\Windows\System\ZSISnBJ.exe
  C:\Windows\System\ZSISnBJ.exe
  2⤵
  PID:12736
- C:\Windows\System\SyFRhxq.exe
  C:\Windows\System\SyFRhxq.exe
  2⤵
  PID:12768
- C:\Windows\System\ynbTzrG.exe
  C:\Windows\System\ynbTzrG.exe
  2⤵
  PID:12796
- C:\Windows\System\fsZcESI.exe
  C:\Windows\System\fsZcESI.exe
  2⤵
  PID:12824
- C:\Windows\System\iMXzLxz.exe
  C:\Windows\System\iMXzLxz.exe
  2⤵
  PID:12852
- C:\Windows\System\QsYVMtm.exe
  C:\Windows\System\QsYVMtm.exe
  2⤵
  PID:12880
- C:\Windows\System\mlzfqHU.exe
  C:\Windows\System\mlzfqHU.exe
  2⤵
  PID:12916
- C:\Windows\System\THbgGis.exe
  C:\Windows\System\THbgGis.exe
  2⤵
  PID:12936
- C:\Windows\System\LmsgWpK.exe
  C:\Windows\System\LmsgWpK.exe
  2⤵
  PID:12976
- C:\Windows\System\SDqyHcI.exe
  C:\Windows\System\SDqyHcI.exe
  2⤵
  PID:12992
- C:\Windows\System\bPaGeAu.exe
  C:\Windows\System\bPaGeAu.exe
  2⤵
  PID:13008
- C:\Windows\System\EKmXnMP.exe
  C:\Windows\System\EKmXnMP.exe
  2⤵
  PID:13024
- C:\Windows\System\xJnNKzT.exe
  C:\Windows\System\xJnNKzT.exe
  2⤵
  PID:13064
- C:\Windows\System\PnNRXVY.exe
  C:\Windows\System\PnNRXVY.exe
  2⤵
  PID:13108
- C:\Windows\System\ByGnQyp.exe
  C:\Windows\System\ByGnQyp.exe
  2⤵
  PID:13132
- C:\Windows\System\LYuXosm.exe
  C:\Windows\System\LYuXosm.exe
  2⤵
  PID:13228
- C:\Windows\System\adbjvsS.exe
  C:\Windows\System\adbjvsS.exe
  2⤵
  PID:13260
- C:\Windows\System\Eidywfr.exe
  C:\Windows\System\Eidywfr.exe
  2⤵
  PID:13276
- C:\Windows\System\wJIzbMk.exe
  C:\Windows\System\wJIzbMk.exe
  2⤵
  PID:13304
- C:\Windows\System\FeriDjg.exe
  C:\Windows\System\FeriDjg.exe
  2⤵
  PID:12300
- C:\Windows\System\GAXuVtZ.exe
  C:\Windows\System\GAXuVtZ.exe
  2⤵
  PID:12400
- C:\Windows\System\BoxNRWq.exe
  C:\Windows\System\BoxNRWq.exe
  2⤵
  PID:12440
- C:\Windows\System\cOZDVlZ.exe
  C:\Windows\System\cOZDVlZ.exe
  2⤵
  PID:12516
- C:\Windows\System\pasitCL.exe
  C:\Windows\System\pasitCL.exe
  2⤵
  PID:12564
- C:\Windows\System\JXPkWHG.exe
  C:\Windows\System\JXPkWHG.exe
  2⤵
  PID:12648
- C:\Windows\System\joMAIha.exe
  C:\Windows\System\joMAIha.exe
  2⤵
  PID:12752
- C:\Windows\System\XKMkWik.exe
  C:\Windows\System\XKMkWik.exe
  2⤵
  PID:12840
- C:\Windows\System\jeEdMrr.exe
  C:\Windows\System\jeEdMrr.exe
  2⤵
  PID:12908
- C:\Windows\System\eafoSAr.exe
  C:\Windows\System\eafoSAr.exe
  2⤵
  PID:12948
- C:\Windows\System\OGsvpYZ.exe
  C:\Windows\System\OGsvpYZ.exe
  2⤵
  PID:13016
- C:\Windows\System\gEVAVcq.exe
  C:\Windows\System\gEVAVcq.exe
  2⤵
  PID:13060
- C:\Windows\System\sSDlYzP.exe
  C:\Windows\System\sSDlYzP.exe
  2⤵
  PID:13164
- C:\Windows\System\KlmrtCi.exe
  C:\Windows\System\KlmrtCi.exe
  2⤵
  PID:13248
- C:\Windows\System\ZaQQrFb.exe
  C:\Windows\System\ZaQQrFb.exe
  2⤵
  PID:12324
- C:\Windows\System\IMVjSkv.exe
  C:\Windows\System\IMVjSkv.exe
  2⤵
  PID:12416
- C:\Windows\System\qPOrljI.exe
  C:\Windows\System\qPOrljI.exe
  2⤵
  PID:13288
- C:\Windows\System\eXWLBsN.exe
  C:\Windows\System\eXWLBsN.exe
  2⤵
  PID:12696
- C:\Windows\System\wozoXpF.exe
  C:\Windows\System\wozoXpF.exe
  2⤵
  PID:12816
- C:\Windows\System\kgaKxMF.exe
  C:\Windows\System\kgaKxMF.exe
  2⤵
  PID:12956
- C:\Windows\System\JLVaxbS.exe
  C:\Windows\System\JLVaxbS.exe
  2⤵
  PID:13160
- C:\Windows\System\BbIYzIA.exe
  C:\Windows\System\BbIYzIA.exe
  2⤵
  PID:12480
- C:\Windows\System\KwlrTqa.exe
  C:\Windows\System\KwlrTqa.exe
  2⤵
  PID:12896
- C:\Windows\System\uKEKJib.exe
  C:\Windows\System\uKEKJib.exe
  2⤵
  PID:11556
- C:\Windows\System\AqnmDiC.exe
  C:\Windows\System\AqnmDiC.exe
  2⤵
  PID:13320
- C:\Windows\System\GQCDGFm.exe
  C:\Windows\System\GQCDGFm.exe
  2⤵
  PID:13348
- C:\Windows\System\wSlTxIA.exe
  C:\Windows\System\wSlTxIA.exe
  2⤵
  PID:13364
- C:\Windows\System\akeeIUN.exe
  C:\Windows\System\akeeIUN.exe
  2⤵
  PID:13392
- C:\Windows\System\lHfoWtt.exe
  C:\Windows\System\lHfoWtt.exe
  2⤵
  PID:13420
- C:\Windows\System\ItuFPGP.exe
  C:\Windows\System\ItuFPGP.exe
  2⤵
  PID:13440
- C:\Windows\System\vLNPOwk.exe
  C:\Windows\System\vLNPOwk.exe
  2⤵
  PID:13488
- C:\Windows\System\ZxZGrRM.exe
  C:\Windows\System\ZxZGrRM.exe
  2⤵
  PID:13516
- C:\Windows\System\iJugkJm.exe
  C:\Windows\System\iJugkJm.exe
  2⤵
  PID:13536
- C:\Windows\System\CBYpAvA.exe
  C:\Windows\System\CBYpAvA.exe
  2⤵
  PID:13564
- C:\Windows\System\RijElsU.exe
  C:\Windows\System\RijElsU.exe
  2⤵
  PID:13600
- C:\Windows\System\SXORDQp.exe
  C:\Windows\System\SXORDQp.exe
  2⤵
  PID:13624
- C:\Windows\System\DfsiNHm.exe
  C:\Windows\System\DfsiNHm.exe
  2⤵
  PID:13644
- C:\Windows\System\ClyNuHS.exe
  C:\Windows\System\ClyNuHS.exe
  2⤵
  PID:13672
- C:\Windows\System\zApSxDx.exe
  C:\Windows\System\zApSxDx.exe
  2⤵
  PID:13688
- C:\Windows\System\meeNSWk.exe
  C:\Windows\System\meeNSWk.exe
  2⤵
  PID:13708
- C:\Windows\System\EwPdvQs.exe
  C:\Windows\System\EwPdvQs.exe
  2⤵
  PID:13732
- C:\Windows\System\mhWrete.exe
  C:\Windows\System\mhWrete.exe
  2⤵
  PID:13752
- C:\Windows\System\RbTOOtq.exe
  C:\Windows\System\RbTOOtq.exe
  2⤵
  PID:13776
- C:\Windows\System\IYWzVYG.exe
  C:\Windows\System\IYWzVYG.exe
  2⤵
  PID:13808
- C:\Windows\System\fJILJhs.exe
  C:\Windows\System\fJILJhs.exe
  2⤵
  PID:13844
- C:\Windows\System\EpKELAC.exe
  C:\Windows\System\EpKELAC.exe
  2⤵
  PID:13864
- C:\Windows\System\oZwEMYC.exe
  C:\Windows\System\oZwEMYC.exe
  2⤵
  PID:13900
- C:\Windows\System\aFzxYdr.exe
  C:\Windows\System\aFzxYdr.exe
  2⤵
  PID:13956
- C:\Windows\System\xeQVEgn.exe
  C:\Windows\System\xeQVEgn.exe
  2⤵
  PID:13984
- C:\Windows\System\fhPJjPL.exe
  C:\Windows\System\fhPJjPL.exe
  2⤵
  PID:14004
- C:\Windows\System\hNaZdmm.exe
  C:\Windows\System\hNaZdmm.exe
  2⤵
  PID:14028
- C:\Windows\System\UwfYuHg.exe
  C:\Windows\System\UwfYuHg.exe
  2⤵
  PID:14064
- C:\Windows\System\ivKwMsV.exe
  C:\Windows\System\ivKwMsV.exe
  2⤵
  PID:14084
- C:\Windows\System\jVoXDrl.exe
  C:\Windows\System\jVoXDrl.exe
  2⤵
  PID:14120
- C:\Windows\System\YAAPeEb.exe
  C:\Windows\System\YAAPeEb.exe
  2⤵
  PID:14172
- C:\Windows\System\esTaPem.exe
  C:\Windows\System\esTaPem.exe
  2⤵
  PID:14196
- C:\Windows\System\uqXuprc.exe
  C:\Windows\System\uqXuprc.exe
  2⤵
  PID:14220
- C:\Windows\System\QVtbCJY.exe
  C:\Windows\System\QVtbCJY.exe
  2⤵
  PID:14248
- C:\Windows\System\WNHgDQQ.exe
  C:\Windows\System\WNHgDQQ.exe
  2⤵
  PID:14268
- C:\Windows\System\PnetOQj.exe
  C:\Windows\System\PnetOQj.exe
  2⤵
  PID:14300
- C:\Windows\System\EtmgsCM.exe
  C:\Windows\System\EtmgsCM.exe
  2⤵
  PID:14324
- C:\Windows\System\VEtpxAy.exe
  C:\Windows\System\VEtpxAy.exe
  2⤵
  PID:12344
- C:\Windows\System\cNlgWBn.exe
  C:\Windows\System\cNlgWBn.exe
  2⤵
  PID:13376
- C:\Windows\System\oeEpDvX.exe
  C:\Windows\System\oeEpDvX.exe
  2⤵
  PID:13460
- C:\Windows\System\KrwolJh.exe
  C:\Windows\System\KrwolJh.exe
  2⤵
  PID:13508
- C:\Windows\System\AroGVKw.exe
  C:\Windows\System\AroGVKw.exe
  2⤵
  PID:13584
- C:\Windows\System\fekFlNG.exe
  C:\Windows\System\fekFlNG.exe
  2⤵
  PID:13700
- C:\Windows\System\JnVZwmz.exe
  C:\Windows\System\JnVZwmz.exe
  2⤵
  PID:13796
- C:\Windows\System\uSGszHh.exe
  C:\Windows\System\uSGszHh.exe
  2⤵
  PID:13828
- C:\Windows\System\cojioZH.exe
  C:\Windows\System\cojioZH.exe
  2⤵
  PID:13912
- C:\Windows\System\jdJgQOr.exe
  C:\Windows\System\jdJgQOr.exe
  2⤵
  PID:13924
- C:\Windows\System\zgeMflx.exe
  C:\Windows\System\zgeMflx.exe
  2⤵
  PID:13972
- C:\Windows\System\nnnRSZh.exe
  C:\Windows\System\nnnRSZh.exe
  2⤵
  PID:14076
- C:\Windows\System\ZUICjIe.exe
  C:\Windows\System\ZUICjIe.exe
  2⤵
  PID:14192
- C:\Windows\System\LKVnNdO.exe
  C:\Windows\System\LKVnNdO.exe
  2⤵
  PID:14264
- C:\Windows\System\KkyAZdH.exe
  C:\Windows\System\KkyAZdH.exe
  2⤵
  PID:13344
- C:\Windows\System\RSpfHsw.exe
  C:\Windows\System\RSpfHsw.exe
  2⤵
  PID:13408
- C:\Windows\System\niLWYsD.exe
  C:\Windows\System\niLWYsD.exe
  2⤵
  PID:13668
- C:\Windows\System\oGMbYVF.exe
  C:\Windows\System\oGMbYVF.exe
  2⤵
  PID:14020
- C:\Windows\System\qMEFvxw.exe
  C:\Windows\System\qMEFvxw.exe
  2⤵
  PID:14100
- C:\Windows\System\PtBBOyB.exe
  C:\Windows\System\PtBBOyB.exe
  2⤵
  PID:13524
- C:\Windows\System\SjNmKvh.exe
  C:\Windows\System\SjNmKvh.exe
  2⤵
  PID:13480
- C:\Windows\System\xpaOpPT.exe
  C:\Windows\System\xpaOpPT.exe
  2⤵
  PID:13976
- C:\Windows\System\uBYmMKg.exe
  C:\Windows\System\uBYmMKg.exe
  2⤵
  PID:14360
- C:\Windows\System\yYupBCd.exe
  C:\Windows\System\yYupBCd.exe
  2⤵
  PID:14380
- C:\Windows\System\FeRelLd.exe
  C:\Windows\System\FeRelLd.exe
  2⤵
  PID:14404
- C:\Windows\System\vHONiSt.exe
  C:\Windows\System\vHONiSt.exe
  2⤵
  PID:14424
- C:\Windows\System\hKGIrJx.exe
  C:\Windows\System\hKGIrJx.exe
  2⤵
  PID:14456
- C:\Windows\System\YMyBVkf.exe
  C:\Windows\System\YMyBVkf.exe
  2⤵
  PID:14500
- C:\Windows\System\SJBscNZ.exe
  C:\Windows\System\SJBscNZ.exe
  2⤵
  PID:14520
- C:\Windows\System\ZtCOsZg.exe
  C:\Windows\System\ZtCOsZg.exe
  2⤵
  PID:14568
- C:\Windows\System\LgCllhU.exe
  C:\Windows\System\LgCllhU.exe
  2⤵
  PID:14592
- C:\Windows\System\YPjumsP.exe
  C:\Windows\System\YPjumsP.exe
  2⤵
  PID:14624
- C:\Windows\System\CWTbcxr.exe
  C:\Windows\System\CWTbcxr.exe
  2⤵
  PID:14652
- C:\Windows\System\cPvdXsL.exe
  C:\Windows\System\cPvdXsL.exe
  2⤵
  PID:14672
- C:\Windows\System\gUMvSOX.exe
  C:\Windows\System\gUMvSOX.exe
  2⤵
  PID:14704
- C:\Windows\System\veAVuzQ.exe
  C:\Windows\System\veAVuzQ.exe
  2⤵
  PID:14732
- C:\Windows\System\XLkLUoX.exe
  C:\Windows\System\XLkLUoX.exe
  2⤵
  PID:14760
- C:\Windows\System\fsfPuQR.exe
  C:\Windows\System\fsfPuQR.exe
  2⤵
  PID:14792
- C:\Windows\System\VlkKYkV.exe
  C:\Windows\System\VlkKYkV.exe
  2⤵
  PID:14828
- C:\Windows\System\BbfsIOS.exe
  C:\Windows\System\BbfsIOS.exe
  2⤵
  PID:14856
- C:\Windows\System\VSydWaV.exe
  C:\Windows\System\VSydWaV.exe
  2⤵
  PID:14884
- C:\Windows\System\jcpHKAO.exe
  C:\Windows\System\jcpHKAO.exe
  2⤵
  PID:14920
- C:\Windows\System\WwojsPW.exe
  C:\Windows\System\WwojsPW.exe
  2⤵
  PID:14948
- C:\Windows\System\nYxOJZO.exe
  C:\Windows\System\nYxOJZO.exe
  2⤵
  PID:14980
- C:\Windows\System\GgNAmDz.exe
  C:\Windows\System\GgNAmDz.exe
  2⤵
  PID:15012
- C:\Windows\System\YtbapJv.exe
  C:\Windows\System\YtbapJv.exe
  2⤵
  PID:15052
- C:\Windows\System\pXzEepN.exe
  C:\Windows\System\pXzEepN.exe
  2⤵
  PID:15084
- C:\Windows\System\bAZOkiF.exe
  C:\Windows\System\bAZOkiF.exe
  2⤵
  PID:15108
- C:\Windows\System\obJYoBv.exe
  C:\Windows\System\obJYoBv.exe
  2⤵
  PID:15132
- C:\Windows\System\pOJmzWT.exe
  C:\Windows\System\pOJmzWT.exe
  2⤵
  PID:15172
- C:\Windows\System\qFwUfVG.exe
  C:\Windows\System\qFwUfVG.exe
  2⤵
  PID:15192
- C:\Windows\System\CkrNnwx.exe
  C:\Windows\System\CkrNnwx.exe
  2⤵
  PID:15232
- C:\Windows\System\zkOutmI.exe
  C:\Windows\System\zkOutmI.exe
  2⤵
  PID:15252
- C:\Windows\System\NpFaTNS.exe
  C:\Windows\System\NpFaTNS.exe
  2⤵
  PID:15280
- C:\Windows\System\saDcjiN.exe
  C:\Windows\System\saDcjiN.exe
  2⤵
  PID:15320
- C:\Windows\System\oFxyqwD.exe
  C:\Windows\System\oFxyqwD.exe
  2⤵
  PID:15348
- C:\Windows\System\jCqwess.exe
  C:\Windows\System\jCqwess.exe
  2⤵
  PID:13548
- C:\Windows\System\Aqueqcj.exe
  C:\Windows\System\Aqueqcj.exe
  2⤵
  PID:14436
- C:\Windows\System\lZNKqqq.exe
  C:\Windows\System\lZNKqqq.exe
  2⤵
  PID:14548
- C:\Windows\System\JJJyuBw.exe
  C:\Windows\System\JJJyuBw.exe
  2⤵
  PID:14580
- C:\Windows\System\ZQJWqXW.exe
  C:\Windows\System\ZQJWqXW.exe
  2⤵
  PID:14700
- C:\Windows\System\JrPUFof.exe
  C:\Windows\System\JrPUFof.exe
  2⤵
  PID:14688
- C:\Windows\System\qepqjdn.exe
  C:\Windows\System\qepqjdn.exe
  2⤵
  PID:14800
- C:\Windows\System\qQamoMS.exe
  C:\Windows\System\qQamoMS.exe
  2⤵
  PID:14876
- C:\Windows\System\RvFkpVy.exe
  C:\Windows\System\RvFkpVy.exe
  2⤵
  PID:14996
- C:\Windows\System\eJYVVEV.exe
  C:\Windows\System\eJYVVEV.exe
  2⤵
  PID:14968
- C:\Windows\System\UvJukTW.exe
  C:\Windows\System\UvJukTW.exe
  2⤵
  PID:15068
- C:\Windows\System\qXbftUR.exe
  C:\Windows\System\qXbftUR.exe
  2⤵
  PID:15200
- C:\Windows\System\klsMVXB.exe
  C:\Windows\System\klsMVXB.exe
  2⤵
  PID:15240
- C:\Windows\System\dzBajBK.exe
  C:\Windows\System\dzBajBK.exe
  2⤵
  PID:15304
- C:\Windows\System\tGoVmAi.exe
  C:\Windows\System\tGoVmAi.exe
  2⤵
  PID:14376
- C:\Windows\System\tvaJlXz.exe
  C:\Windows\System\tvaJlXz.exe
  2⤵
  PID:14492
- C:\Windows\System\vBAsZpT.exe
  C:\Windows\System\vBAsZpT.exe
  2⤵
  PID:14620
- C:\Windows\System\SgBbBDM.exe
  C:\Windows\System\SgBbBDM.exe
  2⤵
  PID:14788
- C:\Windows\System\DVdYZTI.exe
  C:\Windows\System\DVdYZTI.exe
  2⤵
  PID:14956
- C:\Windows\System\Ldwanle.exe
  C:\Windows\System\Ldwanle.exe
  2⤵
  PID:15216
- C:\Windows\System\tYYaxIy.exe
  C:\Windows\System\tYYaxIy.exe
  2⤵
  PID:13892
- C:\Windows\System\QuPAQYm.exe
  C:\Windows\System\QuPAQYm.exe
  2⤵
  PID:14864
- C:\Windows\System\CZJCmde.exe
  C:\Windows\System\CZJCmde.exe
  2⤵
  PID:15124
- C:\Windows\System\UvyrjpV.exe
  C:\Windows\System\UvyrjpV.exe
  2⤵
  PID:14684
- C:\Windows\System\FaNekjj.exe
  C:\Windows\System\FaNekjj.exe
  2⤵
  PID:14308
- C:\Windows\System\KwDYYGh.exe
  C:\Windows\System\KwDYYGh.exe
  2⤵
  PID:15368
- C:\Windows\System\xujgZYb.exe
  C:\Windows\System\xujgZYb.exe
  2⤵
  PID:15396
- C:\Windows\System\ZXtMmGI.exe
  C:\Windows\System\ZXtMmGI.exe
  2⤵
  PID:15424
- C:\Windows\System\RogsTJL.exe
  C:\Windows\System\RogsTJL.exe
  2⤵
  PID:15448
- C:\Windows\System\mxZNMLc.exe
  C:\Windows\System\mxZNMLc.exe
  2⤵
  PID:15468
- C:\Windows\System\AjMJLLn.exe
  C:\Windows\System\AjMJLLn.exe
  2⤵
  PID:15512
- C:\Windows\System\onTjJwW.exe
  C:\Windows\System\onTjJwW.exe
  2⤵
  PID:15540
- C:\Windows\System\xLMkVEF.exe
  C:\Windows\System\xLMkVEF.exe
  2⤵
  PID:15560
- C:\Windows\System\WpPlNeO.exe
  C:\Windows\System\WpPlNeO.exe
  2⤵
  PID:15588
- C:\Windows\System\QjwHIKr.exe
  C:\Windows\System\QjwHIKr.exe
  2⤵
  PID:15608
- C:\Windows\System\oxLWAlL.exe
  C:\Windows\System\oxLWAlL.exe
  2⤵
  PID:15660
- C:\Windows\System\kVXLSAG.exe
  C:\Windows\System\kVXLSAG.exe
  2⤵
  PID:15688
- C:\Windows\System\OZsaJJn.exe
  C:\Windows\System\OZsaJJn.exe
  2⤵
  PID:15724
- C:\Windows\System\BqQbHmI.exe
  C:\Windows\System\BqQbHmI.exe
  2⤵
  PID:15744
- C:\Windows\System\eJLGitK.exe
  C:\Windows\System\eJLGitK.exe
  2⤵
  PID:15764
- C:\Windows\System\vDmKjlq.exe
  C:\Windows\System\vDmKjlq.exe
  2⤵
  PID:15792
- C:\Windows\System\LUMAAMr.exe
  C:\Windows\System\LUMAAMr.exe
  2⤵
  PID:15808
- C:\Windows\System\SPQSTZp.exe
  C:\Windows\System\SPQSTZp.exe
  2⤵
  PID:15832
- C:\Windows\System\cmnGPTG.exe
  C:\Windows\System\cmnGPTG.exe
  2⤵
  PID:15864
- C:\Windows\System\Ovvespo.exe
  C:\Windows\System\Ovvespo.exe
  2⤵
  PID:15892
- C:\Windows\System\FRgiVZG.exe
  C:\Windows\System\FRgiVZG.exe
  2⤵
  PID:15924
- C:\Windows\System\hRZmozT.exe
  C:\Windows\System\hRZmozT.exe
  2⤵
  PID:15972
- C:\Windows\System\dKKIYgD.exe
  C:\Windows\System\dKKIYgD.exe
  2⤵
  PID:16024
- C:\Windows\System\syQRAzW.exe
  C:\Windows\System\syQRAzW.exe
  2⤵
  PID:16052
- C:\Windows\System\MhljyRM.exe
  C:\Windows\System\MhljyRM.exe
  2⤵
  PID:16080
- C:\Windows\System\udYarRA.exe
  C:\Windows\System\udYarRA.exe
  2⤵
  PID:16100
- C:\Windows\System\lTIvRPK.exe
  C:\Windows\System\lTIvRPK.exe
  2⤵
  PID:16124
- C:\Windows\System\jRuQOBK.exe
  C:\Windows\System\jRuQOBK.exe
  2⤵
  PID:16180
- C:\Windows\System\DaHXjWX.exe
  C:\Windows\System\DaHXjWX.exe
  2⤵
  PID:16204
- C:\Windows\System\NjWHyZE.exe
  C:\Windows\System\NjWHyZE.exe
  2⤵
  PID:16236
- C:\Windows\System\NACUfaY.exe
  C:\Windows\System\NACUfaY.exe
  2⤵
  PID:16256
- C:\Windows\System\PCCAoLH.exe
  C:\Windows\System\PCCAoLH.exe
  2⤵
  PID:16284
- C:\Windows\System\bVuXVwG.exe
  C:\Windows\System\bVuXVwG.exe
  2⤵
  PID:16300
- C:\Windows\System\uSOLYDx.exe
  C:\Windows\System\uSOLYDx.exe
  2⤵
  PID:16328
- C:\Windows\System\sGXrPBi.exe
  C:\Windows\System\sGXrPBi.exe
  2⤵
  PID:16344
- C:\Windows\System\NMglyIu.exe
  C:\Windows\System\NMglyIu.exe
  2⤵
  PID:16368
- C:\Windows\System\OlWLwCl.exe
  C:\Windows\System\OlWLwCl.exe
  2⤵
  PID:15440
- C:\Windows\System\expektD.exe
  C:\Windows\System\expektD.exe
  2⤵
  PID:15460
- C:\Windows\System\QxbHExa.exe
  C:\Windows\System\QxbHExa.exe
  2⤵
  PID:15524
- C:\Windows\System\HgBgHWd.exe
  C:\Windows\System\HgBgHWd.exe
  2⤵
  PID:15656
- C:\Windows\System\aiWABwd.exe
  C:\Windows\System\aiWABwd.exe
  2⤵
  PID:15780
- C:\Windows\System\IhIfXDy.exe
  C:\Windows\System\IhIfXDy.exe
  2⤵
  PID:15824
- C:\Windows\System\PwgjgYD.exe
  C:\Windows\System\PwgjgYD.exe
  2⤵
  PID:15856
- C:\Windows\System\YwlBKNJ.exe
  C:\Windows\System\YwlBKNJ.exe
  2⤵
  PID:15932
- C:\Windows\System\AUcAxaO.exe
  C:\Windows\System\AUcAxaO.exe
  2⤵
  PID:15956
- C:\Windows\System\ETXNoWs.exe
  C:\Windows\System\ETXNoWs.exe
  2⤵
  PID:16064
- C:\Windows\System\nVdwRaq.exe
  C:\Windows\System\nVdwRaq.exe
  2⤵
  PID:16152
- C:\Windows\System\JdqTfsx.exe
  C:\Windows\System\JdqTfsx.exe
  2⤵
  PID:16188
- C:\Windows\System\enXAAmD.exe
  C:\Windows\System\enXAAmD.exe
  2⤵
  PID:16252
- C:\Windows\System\RscNodw.exe
  C:\Windows\System\RscNodw.exe
  2⤵
  PID:16336
- C:\Windows\System\zgqCXYM.exe
  C:\Windows\System\zgqCXYM.exe
  2⤵
  PID:16340
- C:\Windows\System\XzrRVwW.exe
  C:\Windows\System\XzrRVwW.exe
  2⤵
  PID:15412
- C:\Windows\System\bIuvTrM.exe
  C:\Windows\System\bIuvTrM.exe
  2⤵
  PID:15556
- C:\Windows\System\iSygdBD.exe
  C:\Windows\System\iSygdBD.exe
  2⤵
  PID:15716
- C:\Windows\System\SqOFTgb.exe
  C:\Windows\System\SqOFTgb.exe
  2⤵
  PID:15876
- C:\Windows\System\qqyrTvi.exe
  C:\Windows\System\qqyrTvi.exe
  2⤵
  PID:16116
- C:\Windows\System\qkoEpsT.exe
  C:\Windows\System\qkoEpsT.exe
  2⤵
  PID:16248
- C:\Windows\System\fjpNixb.exe
  C:\Windows\System\fjpNixb.exe
  2⤵
  PID:16360
- C:\Windows\System\gyZISHe.exe
  C:\Windows\System\gyZISHe.exe
  2⤵
  PID:15788
- C:\Windows\System\oFcFTjP.exe
  C:\Windows\System\oFcFTjP.exe
  2⤵
  PID:16232
- C:\Windows\System\pNORoAF.exe
  C:\Windows\System\pNORoAF.exe
  2⤵
  PID:15596
- C:\Windows\System\MIQfixT.exe
  C:\Windows\System\MIQfixT.exe
  2⤵
  PID:16392
- C:\Windows\System\OmxGyCA.exe
  C:\Windows\System\OmxGyCA.exe
  2⤵
  PID:16408
- C:\Windows\System\DekabhP.exe
  C:\Windows\System\DekabhP.exe
  2⤵
  PID:16424
- C:\Windows\System\hEFEVlS.exe
  C:\Windows\System\hEFEVlS.exe
  2⤵
  PID:16472
- C:\Windows\System\DAcMFFq.exe
  C:\Windows\System\DAcMFFq.exe
  2⤵
  PID:16508
- C:\Windows\System\noqcbAP.exe
  C:\Windows\System\noqcbAP.exe
  2⤵
  PID:16544
- C:\Windows\System\awhhkyZ.exe
  C:\Windows\System\awhhkyZ.exe
  2⤵
  PID:16560
- C:\Windows\System\jFOZets.exe
  C:\Windows\System\jFOZets.exe
  2⤵
  PID:16588
- C:\Windows\System\vrcSaQL.exe
  C:\Windows\System\vrcSaQL.exe
  2⤵
  PID:16604
- C:\Windows\System\ljWnJiM.exe
  C:\Windows\System\ljWnJiM.exe
  2⤵
  PID:16628
- C:\Windows\System\FZvfgDU.exe
  C:\Windows\System\FZvfgDU.exe
  2⤵
  PID:16676
- C:\Windows\System\sHzMZOM.exe
  C:\Windows\System\sHzMZOM.exe
  2⤵
  PID:16700
- C:\Windows\System\nDPCqQT.exe
  C:\Windows\System\nDPCqQT.exe
  2⤵
  PID:16740
- C:\Windows\System\diljGTa.exe
  C:\Windows\System\diljGTa.exe
  2⤵
  PID:16756
- C:\Windows\System\MdEhEQD.exe
  C:\Windows\System\MdEhEQD.exe
  2⤵
  PID:16796
- C:\Windows\System\rgoSxil.exe
  C:\Windows\System\rgoSxil.exe
  2⤵
  PID:16812
- C:\Windows\System\ipukgny.exe
  C:\Windows\System\ipukgny.exe
  2⤵
  PID:16840
- C:\Windows\System\VISMHPG.exe
  C:\Windows\System\VISMHPG.exe
  2⤵
  PID:16868
- C:\Windows\System\NPpiQXB.exe
  C:\Windows\System\NPpiQXB.exe
  2⤵
  PID:16896
- C:\Windows\System\ETgPFUN.exe
  C:\Windows\System\ETgPFUN.exe
  2⤵
  PID:16936
- C:\Windows\System\oNtExKK.exe
  C:\Windows\System\oNtExKK.exe
  2⤵
  PID:16964
- C:\Windows\System\JPLwiUC.exe
  C:\Windows\System\JPLwiUC.exe
  2⤵
  PID:16992
- C:\Windows\System\DxitZJO.exe
  C:\Windows\System\DxitZJO.exe
  2⤵
  PID:17020
- C:\Windows\System\nKXOGsL.exe
  C:\Windows\System\nKXOGsL.exe
  2⤵
  PID:17048
- C:\Windows\System\QGsYpCy.exe
  C:\Windows\System\QGsYpCy.exe
  2⤵
  PID:17068
- C:\Windows\System\YNLHlmd.exe
  C:\Windows\System\YNLHlmd.exe
  2⤵
  PID:17092
- C:\Windows\System\rPbGrxb.exe
  C:\Windows\System\rPbGrxb.exe
  2⤵
  PID:17132
- C:\Windows\System\ENMtfpv.exe
  C:\Windows\System\ENMtfpv.exe
  2⤵
  PID:17148
- C:\Windows\System\rmVZlcg.exe
  C:\Windows\System\rmVZlcg.exe
  2⤵
  PID:17172
- C:\Windows\System\wOEBvLK.exe
  C:\Windows\System\wOEBvLK.exe
  2⤵
  PID:17216
- C:\Windows\System\jLLyeeu.exe
  C:\Windows\System\jLLyeeu.exe
  2⤵
  PID:17252
- C:\Windows\System\CDpZbNB.exe
  C:\Windows\System\CDpZbNB.exe
  2⤵
  PID:17308
- C:\Windows\System\WgEuXgd.exe
  C:\Windows\System\WgEuXgd.exe
  2⤵
  PID:17324
- C:\Windows\System\eRVdHjj.exe
  C:\Windows\System\eRVdHjj.exe
  2⤵
  PID:17368
- C:\Windows\System\DsMQmYS.exe
  C:\Windows\System\DsMQmYS.exe
  2⤵
  PID:17384
- C:\Windows\System\Alymoyt.exe
  C:\Windows\System\Alymoyt.exe
  2⤵
  PID:17404
- C:\Windows\System\zaxvIuk.exe
  C:\Windows\System\zaxvIuk.exe
  2⤵
  PID:16400
- C:\Windows\System\ifBtuPb.exe
  C:\Windows\System\ifBtuPb.exe
  2⤵
  PID:16456
- C:\Windows\System\wPJHfxl.exe
  C:\Windows\System\wPJHfxl.exe
  2⤵
  PID:16552
- C:\Windows\System\ThfJDoz.exe
  C:\Windows\System\ThfJDoz.exe
  2⤵
  PID:16576
- C:\Windows\System\qBbToEa.exe
  C:\Windows\System\qBbToEa.exe
  2⤵
  PID:16596
- C:\Windows\System\xGUymFD.exe
  C:\Windows\System\xGUymFD.exe
  2⤵
  PID:16652
- C:\Windows\System\vVhqKdC.exe
  C:\Windows\System\vVhqKdC.exe
  2⤵
  PID:16852
- C:\Windows\System\usdMxDj.exe
  C:\Windows\System\usdMxDj.exe
  2⤵
  PID:16880
- C:\Windows\System\Txsknew.exe
  C:\Windows\System\Txsknew.exe
  2⤵
  PID:16932
- C:\Windows\System\erFcJtK.exe
  C:\Windows\System\erFcJtK.exe
  2⤵
  PID:16984
- C:\Windows\System\dFUiCSV.exe
  C:\Windows\System\dFUiCSV.exe
  2⤵
  PID:17064
- C:\Windows\System\HxdMwmP.exe
  C:\Windows\System\HxdMwmP.exe
  2⤵
  PID:17160
- C:\Windows\System\kpQnSKu.exe
  C:\Windows\System\kpQnSKu.exe
  2⤵
  PID:17264
- C:\Windows\System\qrAEFDr.exe
  C:\Windows\System\qrAEFDr.exe
  2⤵
  PID:17296
- C:\Windows\System\ZPozfNK.exe
  C:\Windows\System\ZPozfNK.exe
  2⤵
  PID:17364
- C:\Windows\System\YnYyvHz.exe
  C:\Windows\System\YnYyvHz.exe
  2⤵
  PID:16492
- C:\Windows\System\JoLQikk.exe
  C:\Windows\System\JoLQikk.exe
  2⤵
  PID:16524

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BkRxXRx.exe

Filesize
1.3MB

MD5
a6fccad2233a4f995f3b06d185defc53

SHA1
ce3206f7251f88a36ad1a258992226789c6b6977

SHA256
0b9f558d072588d44435faa177905f2198fcd77e7e8b7e1a3730c35951b58cbe

SHA512
e2dee801aa4495e5f2cbd7d73fe3c86eedbcb11d22978f46f6778fbf97b0f251e110d7a6054e2015466ebdb3ff14a847a5e4da14c1dc5ee71793a58b59fe6dbf

Download Submit
C:\Windows\System\CUxUbsE.exe

Filesize
1.3MB

MD5
fa3b2335867672eb32c9815a0b2cd822

SHA1
e75272c478fcb1d7bbe62ccab89ace4414ed6872

SHA256
ea627959c590d67051c0105c6bf314c743ed38c078a2ddaf683095735d9bd41a

SHA512
3b0aeaa3d58f9fbffad5cf2f2b131254ba8254eafa7e9516a10132861b75a68506ce82d008f315144550b92ae425a1b381237ef4948a59f72608ed2c68c9a143

Download Submit
C:\Windows\System\EMDVcUj.exe

Filesize
1.3MB

MD5
8003220dde23ee7086107261f60dddb0

SHA1
5544dd853a62fbf3663a9904c01d6b7f5fb9561a

SHA256
f535756563e7f18b971d148366fb6234662c28a32f958a0b544af844fc54bd65

SHA512
b771d42a493c4a622b9bcc3e54a5ec9f6d7b75755d05d0c64f86e8d110cc64f08bbaa48204fec38488cfaf442cf7d5f7ba58a8fb9447effc95d89a8796c772f7

Download Submit
C:\Windows\System\EyYgSLy.exe

Filesize
1.3MB

MD5
201f02d1ec6638ffd4e6c5bad5eee355

SHA1
d34046e8d341bc9a5436d58047cd7525574f26c5

SHA256
d562c6e96313cdc73e1937f3f4ee093cd99d2dc59afd74314412dc555e80f972

SHA512
a0619710add0d69a3e787596cdce6cb214495d6c014ef5bc8ad446d53ae8b42dba4527833da2f933bf121b19e3aae96e277d285b321379bf6ae8e36aedc0dfbe

Download Submit
C:\Windows\System\IBPWWZc.exe

Filesize
1.3MB

MD5
0940a57417b5b87170c5eadc84c6fff4

SHA1
8bc71239636ae2e8d80a45d9f63451d13535cc81

SHA256
658db547513f0edb88f7a9e8102bfc025b47ba1c494fadcb786a5582a93f57be

SHA512
67a910f3f348100b95fa494b89060dcd015cf26763890c50a69243b81d2376deab00e609bc08abdf054300836720cee2d61f997f1fb5171a1df0d2a599334586

Download Submit
C:\Windows\System\KVJwKIT.exe

Filesize
1.3MB

MD5
02570e611d4c9ae67d4aef27a897e431

SHA1
66ed62e506ecf1948a3bc8d965a587a35fac9fd3

SHA256
ad11e9a9c2ed60b21643bfb6ceebc1a877aa89c60ca332549e26b2edf0e6ddd2

SHA512
f75e6633d70df27af024feff0126684e5034cfc4ddbce646eff4dee415e2a77be6a60a30ee1d9e8360a7f7937e2bb132e6b6d2040c014d5f7c6b924b0d8547db

Download Submit
C:\Windows\System\NKrGInr.exe

Filesize
1.3MB

MD5
b5696c7942b98ea3b8c05885b4a3bae0

SHA1
073feed05ddd30566b95e6ad9fdb63f3261f92b4

SHA256
ab84f7e4b09aab98230e8366ef3ed1190e2162cd8860f8d642eea3f4764baf37

SHA512
7d6c9d6d330c8281151e53bbeca0711812501f8f382c0dc69b2f991fbab51546fae467fa5e54d0f0efc721a03ba5dee6fc5ecee560aded5f5e4f7e266ea825b6

Download Submit
C:\Windows\System\OFFlVSf.exe

Filesize
1.3MB

MD5
2dfc13f9ef86dbfa4ae85c748ec54605

SHA1
548f83fab783700ec7fdfd23290c16f9e583db6f

SHA256
a8d36f6b19cf444fc24ce68d56ec53023ae2fe5a4800cc9223c1647ac26176ff

SHA512
e2343b0053b0f1cd014ca69a73e7a1f70104d37e8092e9751207929a074242ee441527bb36e0c7b8bc24132013310fd42fb1f6bb65263d5c4cba6ede55690f81

Download Submit
C:\Windows\System\PlDbuLS.exe

Filesize
1.3MB

MD5
84923d9f575d32441b195d51c0038103

SHA1
22a6ea71f5f6461d8618f6681ebca5a83e87fa3a

SHA256
978f8fcf533594d5024eadf6c78de7d5e286e250a20da442d89a34f5bd5f0a0c

SHA512
015fd832b53702f0f8b84dc0d9bbc0d57aef64f5d4543fe8745620d7b8723c2aff7f9fcd18d47dc10e3e1f8220139a90cd9619374b970d2bd182de8c29edb217

Download Submit
C:\Windows\System\RknOSqU.exe

Filesize
1.3MB

MD5
d23e0f5e8224f685309563206645ebee

SHA1
62a140c8dc184f21814cdfe1e8b49f2d6480b472

SHA256
8c4dee1e6391378355be8986d25c9cdb91d8f97df67f277a8e5df5054a89f9db

SHA512
c975f6158b7e4558e596a7fe400648f6c292573bcc3b0a6424cc5c4ca00d1809a113fa55fa83d2949c3227a6c5896cf2212de58efd5a29f08afa1ded7a04b8aa

Download Submit
C:\Windows\System\SYumQza.exe

Filesize
1.3MB

MD5
361f80793a137b075b4f671c86e8ad1c

SHA1
0492ec215c3e92a5204bbeb96c8a10d34afb58b3

SHA256
2283264b4a6a215dea3c4de4b9f1309f8faf0fda9aec880addd504bb01324f7e

SHA512
a2fc9428ea03733258e2d90308ba7aac0cd80f0f73f671138d228e0300ff1dc55c0064fbf2fbd0e2c979fd1a4f1b7351437518f33a33fd87a1b84edd80d8f84e

Download Submit
C:\Windows\System\SpZpNwE.exe

Filesize
1.3MB

MD5
5fd41c138ffb917d245c045873ab8d92

SHA1
4a605f3b2628dd26090152262936c01d14a4bc8c

SHA256
aa5e2aae3553da8c942f5efcf0d4771a3f7977046b77c0c0c0501562ef2a67bb

SHA512
0162da2eb36b413939825c60bf3ca95b6470b05300cb3f9a0cd0ef8d971d4186d40104fa60117b9a1b4dc94b9c4204309a535e1d58ad3ee94e0f897390c33dd7

Download Submit
C:\Windows\System\TSmuKoC.exe

Filesize
1.3MB

MD5
9e850f4dfb45c4cbc167b4563351229f

SHA1
123ca07bae08b4b49e2bd54a83aa83777bebde85

SHA256
6349a36b7cfa0d77fd6431a410127605bdfe2509dd1b2149b9bc2b265cd516ed

SHA512
cdf20385a81e792d2b11a7ab52448011b4a004fe3672a3cbdd7f9688b41cb79e0597e0f2bee6eeacd2b5dff5b34eec7cf9637ae52467ec6a90ed6550d488fdb6

Download Submit
C:\Windows\System\UOJLqjf.exe

Filesize
1.3MB

MD5
5585cdd29c0eac2b4d3dcca9497d9c5f

SHA1
b8cbd1d74a6dbd963ce548826903ce92d52daea4

SHA256
891223e294a0dbbe5bbe916cc5bb2c9247ae02ff528e45993ef60e9a90149ed6

SHA512
7c1f0de0872b19fd6924fa1cfb889e2a60172f88e106888ee5ce72f46173b33736202f770247d9d2721f16d3621b7589a1db5c63e877e6c9f33ef56c072578b4

Download Submit
C:\Windows\System\XAbJBEF.exe

Filesize
1.3MB

MD5
e893589f6c57e61449207a4b6502bacf

SHA1
ee2b263f7c5b7970374f2d2c3af3deef3949384b

SHA256
c35c701662e18085d1d164334bfdd1a67191fae3925b66deb851c954efb51c98

SHA512
fbc7c2bd871489704c28a9629a862886b54e2bb13af0c21b50fc8c4a4cf3c45d9d52c823a5ab2213f9142a7b812e06fca98d9fc9632246da515df372cfa7ec91

Download Submit
C:\Windows\System\XCSDCbf.exe

Filesize
1.3MB

MD5
79eca6bf3642d77b422b88fd141ee6b6

SHA1
0e7cd7d92f0fef8db9eb95197e421f0c0cb59716

SHA256
4aa856471e983dd6cbf9a20ebf9ae7478a5b1d51dcbd54c2feb6a5d0313091f8

SHA512
1319d33b806049fa83688d7d705131d3a29de2ba875b0e04dd457540fd44ebd19638644c6ed2190f623ba2be0d5c869fc55c3b12ff8e8fd08f0377148d124b52

Download Submit
C:\Windows\System\XCkDjEl.exe

Filesize
1.3MB

MD5
5cbf620cbb75af19673bd2fd8c28db8c

SHA1
11b41e657460cd8326dea6df8d6021a39b962c8f

SHA256
bc5db4290d1c608e5ded9e4840b252eb8974ab91ed7e568a2aedc05c900676e2

SHA512
2bef6d024d9d34c2c9a2f029b81130365ae25fab07d64c18d87b2633c24d57acc63b75cdd4c14561d12a992e623d6f97524f1340f7e1a338f64db3966b3a43ab

Download Submit
C:\Windows\System\ccotPJH.exe

Filesize
1.3MB

MD5
c52d244e2ddfe92015dc2401295b3e1d

SHA1
0361c1a9d2477d4508d39d5ed2f125f7c0a52c7a

SHA256
6f3f9f446e81922da9de76a945df1bd9e87801690a3e0e78260dee8588cd955a

SHA512
32b062e770e6c5b5ad042148081884367613c7e5ba9a689e944eb33792a618c542b119cf7c8266679f3fdd406eb05b5d37dcefedf86ad5d43ab8379839ae0379

Download Submit
C:\Windows\System\dfRmlKV.exe

Filesize
1.3MB

MD5
bb3e0877a548a85f04256643d735fdb5

SHA1
9009787f5173cb3cc25e88e8fb2dc70f5b71be3c

SHA256
377f88f06dac8f8d14addc47c10339126d958ea773706522b52200ff9cc35cd4

SHA512
62e0c900e29ac04480a708f7144fb33f078277c4205318f43ff67d61435ec76827b8649a00f3e25e33ea7d3093453d9e8f92191258a398757c26f68da46f612d

Download Submit
C:\Windows\System\dmGyCXT.exe

Filesize
1.3MB

MD5
8baa15b8c5203f0c4c00a7a404c2cb9b

SHA1
40493d4a2e9dd182072fd3603508fb73879bc88c

SHA256
c63bb27e7652b261004d6cd9843550727f1149071c51cfd9bd16cb2aed9ba6e0

SHA512
ae96dce14cee058ecab82e8a7acc76cf8a44c388cab31322dfd10734f2470dc60ffcd8cf17b647a56add6719b992d2921da9e939e728363ef9cfd6505f8f59d0

Download Submit
C:\Windows\System\iEilXlF.exe

Filesize
1.3MB

MD5
17faa2378be41797f9262f7b7e1efd6b

SHA1
27a64ffe717faa68c9427b10960e56529c22023a

SHA256
1f18806e30448bc1de5e00789ceeba0b5734b8dbd21c89be550e079192817bcc

SHA512
52d4f5ff4e67592ca7b43820351d1e08098c0a2e14f4e65bc1e5a8231b9e6c3f23c03c0c90ad15fc848869e4ce2b67be2f16a1151df7c643f9cd32999eb745c8

Download Submit
C:\Windows\System\lQUMFta.exe

Filesize
1.3MB

MD5
c065f41eda66f9abc1685ae0ca0f1b37

SHA1
79d8f41bb31353db6a1db59dd9824d2c9f5cc7da

SHA256
cc714370b2203fba2f4a17ddfde5578748d6c1453b149ce5bbc086ef527ae402

SHA512
eecf803d85399f35ed6e748ef89dcc1309ad26bcd68f8ce5a60e960eaba6bb14ecfac63d468821f08bdef3a4214226903e4aa4b595dfe55a896b2582dd4299a6

Download Submit
C:\Windows\System\lyVrDvB.exe

Filesize
1.3MB

MD5
179331ae3ed9829d2aa709a2f16e8095

SHA1
e5ec46539af013e1896e6a89dd227b37518ddfa5

SHA256
f12327a0de05a9fa6c118e3440b327461ceff65fd0b1509f3f6b0432803c1b44

SHA512
420548d63be9945019a018837484b7e0062702ea315d9561fdafaab67c021d1dfed346e116b8dbbf78cbde2c84e83d71340df4bde950b1ee3a341d7205c5db96

Download Submit
C:\Windows\System\miIfBgq.exe

Filesize
1.3MB

MD5
3881a89d7d9ea0ac417a11eb601a3a38

SHA1
41bcc02aeb4f84eddc8b6dea4336478b9e854bfe

SHA256
6402b3c4c191037c87eeebb37c510aa1b6b501596e13069fccdbba97dcb97a55

SHA512
8e80ca2ba88aeebd23669b54a5c5667b17049b17e6ae75af4642526191e360da18ad8b0cd9ef5c10ac2a60c965b54284790d968fd83cafd5ad34be5705e96de2

Download Submit
C:\Windows\System\oUGefmP.exe

Filesize
1.3MB

MD5
e8d34507dc572149f534fef31f0dba12

SHA1
9da777122f941548461940736b34da6c0fe5ac87

SHA256
c65a526d1822aa401cf72a027904b8bbc72614f813ecc44ae55be5b92ea703a1

SHA512
0fb60e551ab7ad09e4335b0fdf4bc0bf22490677a43a3450cd66d16efe4f861511feb059d1ab529b9c6e5562a872ecf3511b2d3a290c87af4fe5fa6ba49b9056

Download Submit
C:\Windows\System\qEWauOY.exe

Filesize
1.3MB

MD5
5086c1492a89fd93742129f5594b1950

SHA1
eb07984f3f0d8ce14a2428859e2e9cd7e59d8650

SHA256
6b4e41bce8ebab9d1416fcfc992353da6cce123d2b9b5fe28572166af8313b9f

SHA512
d90321055406ec088696661a60b62f0da4e359dbbb36fb311268cf075a49ac4fd1169cece96e29614d5dd3c7b7e2697354617a788275b76345a2778618ae6e33

Download Submit
C:\Windows\System\qHrQIXw.exe

Filesize
1.3MB

MD5
4ff8ee235b0eb9ecb7741f746437bba8

SHA1
7b755cf57f9243a48c573756de036e0f7588c53f

SHA256
a5da4e3ed728209ce4977e7a884972846f93df43ddc0dc5e02de9b02017812ed

SHA512
51044ec156a183cfebc57dbaaaad774deb2a0701e9260e40a314491e262d4233e766d52bf87e0d9fc643e11b5141439e222945f2147f279b7a87917805b5ccf7

Download Submit
C:\Windows\System\sDgPASd.exe

Filesize
1.3MB

MD5
4eb06b843cd9f8144b3a804eed832a84

SHA1
305db47005c5bd7440ca6191bd61eac7de9a7f44

SHA256
61034cbd6829bbcad0511da7b663fcb856c624658a7ee98191a393d5164653ba

SHA512
42e1b253fd91038176254b32640941e220be9880a717610efe2444d8336cc9ffdb052a45c0c030611b286369f47780c2d74b8c7290ce501cd06e55ada4af0edc

Download Submit
C:\Windows\System\sgrlVKG.exe

Filesize
1.3MB

MD5
2068a5237aa6ea232228c41230565ce7

SHA1
a1f23fad4c8b341907d915f86f790c8ed9e9a0b4

SHA256
b6f822900edc746fcc772a6a5e33d8861fe14ceee8a6d767cb254c261c457596

SHA512
2aa34cc5ecdcadde9c18f35c8ad63952603d5aefff06510d974f184dd4009ef02aca04df367bbd776b867cbb06ac5ea3707e3ebaf10e0c4d4944e4b56ecd2417

Download Submit
C:\Windows\System\tcsjRrP.exe

Filesize
1.3MB

MD5
f124238051efdba009b6a4e2da0d2957

SHA1
0111c6b8c157eb6b6ee4ea682cf515d80557b84d

SHA256
2b86a3808a5d278d4b28ed62cd24c2242daf3cf7b3d88b3d44957ba2c6f8e083

SHA512
c47e644853a84ef1dffe3acb0fdbc231697a764a331457660048ceaff5b3e86d5ee25d839795d6cb087e187c561ac9e7cd312f45c3509cbd2b267574abafbc7e

Download Submit
C:\Windows\System\uEodYOT.exe

Filesize
1.3MB

MD5
96ab3701fa635a5ccdcb7c116ac34076

SHA1
4bf2e694f6236b6141e2408d06c1c6c7f3525359

SHA256
50f1ad44253c64059f829342fa371098c33f54d4e7cc8af85973afc46a113aaf

SHA512
1c01815b1788c6c779c2a0b134acfc8349d69e945bebee0145468fa9b406719f17e91b32cbc81f6e0c3a6f7baad72880ac99eb20ca1de0a016a63ec7ca4242c6

Download Submit
C:\Windows\System\upZwESj.exe

Filesize
1.3MB

MD5
5859f6466bcabafb6c1c04c0149dfb6d

SHA1
3ad7bcbfe8ebf68ff8eee216b0bd08ed21e491be

SHA256
78f3ad38c8b9cac545a8687835a4e0e2f18d95d48e479d1b8c199764ed04d174

SHA512
87bf7204d9fae39d0b078a069c8133cece54d6bdfddbc6400e6b18f20bc17b8290d3239af4e6a1f289aa755dcb930f46dcad01296e6cc7a15569df0d06bd9347

Download Submit
C:\Windows\System\zXVcvLh.exe

Filesize
1.3MB

MD5
c166ddc126152e572db934fc28112ccc

SHA1
8a39d04a994cce5b02378b195251fac24e4721d2

SHA256
d318c872624372312e2b738622ff72fb65f67b5af0ead6866e8147f11da139f6

SHA512
cde1d7fe222e431d73df4518603a680acce8586935586200f33c429e9ff22ef5cfcd7c807caddd3a4636c4498bf49cc1cc25276ee3ad35d248f0143eee19d1fd

Download Submit
memory/3156-0-0x00000259A3E10000-0x00000259A3E20000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads