xmrig | 1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259

Analysis

max time kernel
122s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
Size

1.0MB
MD5

e107d23df3a8cec3af0f2438c851f782
SHA1

13a9510d95156d58eeb2dbcaa8d918a9b1e4e1b5
SHA256

1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259
SHA512

ae649cee44972b209bd27c9e025acaed0ba8efe1a5f18ab8b6b071384cbafc65eaf393c5cc1cabb1f3f2dbf35415d233738229af813d4cdfb00188b76c2fbaa0
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4BAiui1kt:GezaTF8FcNkNdfE0pZ9ozttwIRakGAiA

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c98-4.dat	xmrig
behavioral2/files/0x0008000000023c9c-7.dat	xmrig
behavioral2/files/0x0007000000023ca1-15.dat	xmrig
behavioral2/files/0x0007000000023ca2-20.dat	xmrig
behavioral2/files/0x0007000000023ca4-34.dat	xmrig
behavioral2/files/0x0007000000023ca8-58.dat	xmrig
behavioral2/files/0x0007000000023caf-87.dat	xmrig
behavioral2/files/0x0007000000023cbc-152.dat	xmrig
behavioral2/files/0x0007000000023cbe-162.dat	xmrig
behavioral2/files/0x0007000000023cbd-157.dat	xmrig
behavioral2/files/0x0007000000023cbb-155.dat	xmrig
behavioral2/files/0x0007000000023cba-150.dat	xmrig
behavioral2/files/0x0007000000023cb9-145.dat	xmrig
behavioral2/files/0x0007000000023cb8-140.dat	xmrig
behavioral2/files/0x0007000000023cb7-135.dat	xmrig
behavioral2/files/0x0007000000023cb6-130.dat	xmrig
behavioral2/files/0x0007000000023cb5-125.dat	xmrig
behavioral2/files/0x0007000000023cb4-120.dat	xmrig
behavioral2/files/0x0007000000023cb3-115.dat	xmrig
behavioral2/files/0x0007000000023cb2-110.dat	xmrig
behavioral2/files/0x0007000000023cb1-105.dat	xmrig
behavioral2/files/0x0007000000023cb0-100.dat	xmrig
behavioral2/files/0x0007000000023cae-90.dat	xmrig
behavioral2/files/0x0007000000023cad-82.dat	xmrig
behavioral2/files/0x0007000000023cac-78.dat	xmrig
behavioral2/files/0x0007000000023cab-72.dat	xmrig
behavioral2/files/0x0007000000023caa-68.dat	xmrig
behavioral2/files/0x0007000000023ca9-62.dat	xmrig
behavioral2/files/0x0007000000023ca7-53.dat	xmrig
behavioral2/files/0x0007000000023ca6-47.dat	xmrig
behavioral2/files/0x0007000000023ca5-43.dat	xmrig
behavioral2/files/0x0007000000023ca3-32.dat	xmrig
behavioral2/files/0x0007000000023ca0-16.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4552	vwfWhpA.exe
3504	gbSoBMt.exe
3680	IUdjXAr.exe
4800	mILWKWy.exe
3928	btmlIlq.exe
1120	CPQxjam.exe
4148	cBfkToF.exe
3704	gpSEnKu.exe
4980	tNxIMUo.exe
4908	cglmNMc.exe
1776	aPKNzyj.exe
4736	EWIGdnh.exe
4576	JDTLKtR.exe
4176	amKyIBR.exe
4008	xCeTdqs.exe
1108	rcxHkma.exe
2460	seJOznu.exe
3296	VSxigMS.exe
3980	Outhnrj.exe
4820	svXZrXK.exe
4732	HqizVgl.exe
4804	hlzjLBo.exe
4600	GXxxzML.exe
4472	URwuVwY.exe
1780	smdJOSI.exe
4544	duiLkJd.exe
1492	CrxKGfa.exe
1912	HsSZckK.exe
4328	bdsCiBt.exe
1480	uUXKfZi.exe
1848	yySbEdY.exe
3360	RaToGPo.exe
1312	wmZXehN.exe
1728	uPBuNBp.exe
5036	zxUlnFz.exe
1660	TvbRzGn.exe
4036	OVLRSYw.exe
1924	dwDfpFa.exe
3684	LuIMBll.exe
4032	VHHmeLh.exe
3048	nYcOmjX.exe
2592	YzyBNIX.exe
3720	mfUwCFl.exe
1596	dZPEivV.exe
4692	bGylBPc.exe
3408	VtZOfNX.exe
1272	GCiqeYw.exe
3180	mqeHcTd.exe
3168	GcKfFfs.exe
4768	khWgfwL.exe
724	QbmDCNM.exe
2488	HyDmWVC.exe
2436	rjQUisn.exe
1984	oVcaSrZ.exe
1128	dZMdjDg.exe
3604	jPOHAVD.exe
1324	dkZcQBX.exe
1708	wZPWJNy.exe
2204	ZPMxSLQ.exe
3576	bKicpfC.exe
5008	vntrZPl.exe
4292	GpuOgza.exe
3216	AJPwvyW.exe
616	ZJhRXRT.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LrOrySZ.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\usePtvn.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\expkkpu.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\SeGVkgk.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\wxPfOZB.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\RPpNeNf.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\gTUOAXC.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\lQEYfNu.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\yiCJPok.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\svXZrXK.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\WhtTIRI.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\PvfGLUf.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\nHCbGXd.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\uQVipUh.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\KJbCpjh.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\lebipHM.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\oWakABS.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\LwPwPZs.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\VxtWBzF.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\bmnqfDK.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\YXbyWhh.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\vXnzSNY.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\XsNCoZf.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\owNsbSk.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\ahtXRNV.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\pJzeEjm.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\yYIvOqM.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\dfkSqVw.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\vZhiDJC.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\OZWzcLI.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\RtmuUxG.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\oLwjYxR.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\hSEWsMI.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\RZzIDjp.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\sqtAUxD.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\nbmNZYM.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\dmITgKG.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\OKUDwKt.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\zlErRHj.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\HPGNOlo.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\CZhfArB.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\xCeTdqs.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\wsUqAbq.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\HARbpsP.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\XmrgLga.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\fEUnrDS.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\mVxgEZN.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\hecQHLC.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\jWHzVVe.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\kIRTuzz.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\viVpHrJ.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\WeFiHWU.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\DPShkfn.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\BIjcbVR.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\QDgsixR.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\CFuvekq.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\VNdheMo.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\JrKxcrG.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\SOHtjHU.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\ozmLmDp.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\LypnnZl.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\zIkHUCA.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\UARazHA.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
File created	C:\Windows\System\DwumWKu.exe	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17176	dwm.exe
Token: SeChangeNotifyPrivilege	17176	dwm.exe
Token: 33	17176	dwm.exe
Token: SeIncBasePriorityPrivilege	17176	dwm.exe
Token: SeShutdownPrivilege	17176	dwm.exe
Token: SeCreatePagefilePrivilege	17176	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 4552	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	83
PID 532 wrote to memory of 4552	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	83
PID 532 wrote to memory of 3504	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	84
PID 532 wrote to memory of 3504	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	84
PID 532 wrote to memory of 3680	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	85
PID 532 wrote to memory of 3680	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	85
PID 532 wrote to memory of 4800	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	86
PID 532 wrote to memory of 4800	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	86
PID 532 wrote to memory of 3928	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	87
PID 532 wrote to memory of 3928	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	87
PID 532 wrote to memory of 1120	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	88
PID 532 wrote to memory of 1120	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	88
PID 532 wrote to memory of 4148	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	89
PID 532 wrote to memory of 4148	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	89
PID 532 wrote to memory of 3704	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	90
PID 532 wrote to memory of 3704	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	90
PID 532 wrote to memory of 4980	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	91
PID 532 wrote to memory of 4980	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	91
PID 532 wrote to memory of 4908	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	92
PID 532 wrote to memory of 4908	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	92
PID 532 wrote to memory of 1776	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	93
PID 532 wrote to memory of 1776	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	93
PID 532 wrote to memory of 4736	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	94
PID 532 wrote to memory of 4736	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	94
PID 532 wrote to memory of 4576	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	95
PID 532 wrote to memory of 4576	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	95
PID 532 wrote to memory of 4176	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	96
PID 532 wrote to memory of 4176	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	96
PID 532 wrote to memory of 4008	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	97
PID 532 wrote to memory of 4008	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	97
PID 532 wrote to memory of 1108	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	98
PID 532 wrote to memory of 1108	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	98
PID 532 wrote to memory of 2460	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	99
PID 532 wrote to memory of 2460	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	99
PID 532 wrote to memory of 3296	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	100
PID 532 wrote to memory of 3296	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	100
PID 532 wrote to memory of 3980	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	101
PID 532 wrote to memory of 3980	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	101
PID 532 wrote to memory of 4820	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	102
PID 532 wrote to memory of 4820	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	102
PID 532 wrote to memory of 4732	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	103
PID 532 wrote to memory of 4732	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	103
PID 532 wrote to memory of 4804	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	104
PID 532 wrote to memory of 4804	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	104
PID 532 wrote to memory of 4600	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	105
PID 532 wrote to memory of 4600	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	105
PID 532 wrote to memory of 4472	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	106
PID 532 wrote to memory of 4472	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	106
PID 532 wrote to memory of 1780	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	107
PID 532 wrote to memory of 1780	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	107
PID 532 wrote to memory of 4544	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	108
PID 532 wrote to memory of 4544	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	108
PID 532 wrote to memory of 1492	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	109
PID 532 wrote to memory of 1492	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	109
PID 532 wrote to memory of 1912	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	110
PID 532 wrote to memory of 1912	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	110
PID 532 wrote to memory of 4328	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	111
PID 532 wrote to memory of 4328	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	111
PID 532 wrote to memory of 1480	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	112
PID 532 wrote to memory of 1480	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	112
PID 532 wrote to memory of 1848	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	113
PID 532 wrote to memory of 1848	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	113
PID 532 wrote to memory of 3360	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	114
PID 532 wrote to memory of 3360	532	1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe	114

C:\Users\Admin\AppData\Local\Temp\1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe
"C:\Users\Admin\AppData\Local\Temp\1bfc4d3dcc9c8fa6fb668834e35a459781f66bbca4dbf340a1c2a3cd3f093259.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\System\vwfWhpA.exe
  C:\Windows\System\vwfWhpA.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\gbSoBMt.exe
  C:\Windows\System\gbSoBMt.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\IUdjXAr.exe
  C:\Windows\System\IUdjXAr.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\mILWKWy.exe
  C:\Windows\System\mILWKWy.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\btmlIlq.exe
  C:\Windows\System\btmlIlq.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\CPQxjam.exe
  C:\Windows\System\CPQxjam.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\cBfkToF.exe
  C:\Windows\System\cBfkToF.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\gpSEnKu.exe
  C:\Windows\System\gpSEnKu.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\tNxIMUo.exe
  C:\Windows\System\tNxIMUo.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\cglmNMc.exe
  C:\Windows\System\cglmNMc.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\aPKNzyj.exe
  C:\Windows\System\aPKNzyj.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\EWIGdnh.exe
  C:\Windows\System\EWIGdnh.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\JDTLKtR.exe
  C:\Windows\System\JDTLKtR.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\amKyIBR.exe
  C:\Windows\System\amKyIBR.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\xCeTdqs.exe
  C:\Windows\System\xCeTdqs.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\rcxHkma.exe
  C:\Windows\System\rcxHkma.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\seJOznu.exe
  C:\Windows\System\seJOznu.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\VSxigMS.exe
  C:\Windows\System\VSxigMS.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\Outhnrj.exe
  C:\Windows\System\Outhnrj.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\svXZrXK.exe
  C:\Windows\System\svXZrXK.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\HqizVgl.exe
  C:\Windows\System\HqizVgl.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\hlzjLBo.exe
  C:\Windows\System\hlzjLBo.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\GXxxzML.exe
  C:\Windows\System\GXxxzML.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\URwuVwY.exe
  C:\Windows\System\URwuVwY.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\smdJOSI.exe
  C:\Windows\System\smdJOSI.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\duiLkJd.exe
  C:\Windows\System\duiLkJd.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\CrxKGfa.exe
  C:\Windows\System\CrxKGfa.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\HsSZckK.exe
  C:\Windows\System\HsSZckK.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\bdsCiBt.exe
  C:\Windows\System\bdsCiBt.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\uUXKfZi.exe
  C:\Windows\System\uUXKfZi.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\yySbEdY.exe
  C:\Windows\System\yySbEdY.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\RaToGPo.exe
  C:\Windows\System\RaToGPo.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\wmZXehN.exe
  C:\Windows\System\wmZXehN.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\uPBuNBp.exe
  C:\Windows\System\uPBuNBp.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\zxUlnFz.exe
  C:\Windows\System\zxUlnFz.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\TvbRzGn.exe
  C:\Windows\System\TvbRzGn.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\OVLRSYw.exe
  C:\Windows\System\OVLRSYw.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\dwDfpFa.exe
  C:\Windows\System\dwDfpFa.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\LuIMBll.exe
  C:\Windows\System\LuIMBll.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\VHHmeLh.exe
  C:\Windows\System\VHHmeLh.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\nYcOmjX.exe
  C:\Windows\System\nYcOmjX.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\YzyBNIX.exe
  C:\Windows\System\YzyBNIX.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\mfUwCFl.exe
  C:\Windows\System\mfUwCFl.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\dZPEivV.exe
  C:\Windows\System\dZPEivV.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\bGylBPc.exe
  C:\Windows\System\bGylBPc.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\VtZOfNX.exe
  C:\Windows\System\VtZOfNX.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\GCiqeYw.exe
  C:\Windows\System\GCiqeYw.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\mqeHcTd.exe
  C:\Windows\System\mqeHcTd.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\GcKfFfs.exe
  C:\Windows\System\GcKfFfs.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\khWgfwL.exe
  C:\Windows\System\khWgfwL.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\QbmDCNM.exe
  C:\Windows\System\QbmDCNM.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\HyDmWVC.exe
  C:\Windows\System\HyDmWVC.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\rjQUisn.exe
  C:\Windows\System\rjQUisn.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\oVcaSrZ.exe
  C:\Windows\System\oVcaSrZ.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\dZMdjDg.exe
  C:\Windows\System\dZMdjDg.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\jPOHAVD.exe
  C:\Windows\System\jPOHAVD.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\dkZcQBX.exe
  C:\Windows\System\dkZcQBX.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\wZPWJNy.exe
  C:\Windows\System\wZPWJNy.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\ZPMxSLQ.exe
  C:\Windows\System\ZPMxSLQ.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\bKicpfC.exe
  C:\Windows\System\bKicpfC.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\vntrZPl.exe
  C:\Windows\System\vntrZPl.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\GpuOgza.exe
  C:\Windows\System\GpuOgza.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\AJPwvyW.exe
  C:\Windows\System\AJPwvyW.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\ZJhRXRT.exe
  C:\Windows\System\ZJhRXRT.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\nolieVB.exe
  C:\Windows\System\nolieVB.exe
  2⤵
  PID:5112
- C:\Windows\System\APcsvBE.exe
  C:\Windows\System\APcsvBE.exe
  2⤵
  PID:3596
- C:\Windows\System\XKGpRTS.exe
  C:\Windows\System\XKGpRTS.exe
  2⤵
  PID:2676
- C:\Windows\System\OZWzcLI.exe
  C:\Windows\System\OZWzcLI.exe
  2⤵
  PID:4836
- C:\Windows\System\sQnHSpf.exe
  C:\Windows\System\sQnHSpf.exe
  2⤵
  PID:1528
- C:\Windows\System\lZvDzMy.exe
  C:\Windows\System\lZvDzMy.exe
  2⤵
  PID:2944
- C:\Windows\System\pBYbiho.exe
  C:\Windows\System\pBYbiho.exe
  2⤵
  PID:5096
- C:\Windows\System\VkqRqlc.exe
  C:\Windows\System\VkqRqlc.exe
  2⤵
  PID:4620
- C:\Windows\System\HoSPJrj.exe
  C:\Windows\System\HoSPJrj.exe
  2⤵
  PID:4728
- C:\Windows\System\weBAJVF.exe
  C:\Windows\System\weBAJVF.exe
  2⤵
  PID:3204
- C:\Windows\System\cqJKuRm.exe
  C:\Windows\System\cqJKuRm.exe
  2⤵
  PID:4180
- C:\Windows\System\rmCHaOZ.exe
  C:\Windows\System\rmCHaOZ.exe
  2⤵
  PID:4532
- C:\Windows\System\ltquQpy.exe
  C:\Windows\System\ltquQpy.exe
  2⤵
  PID:3480
- C:\Windows\System\bpjCzGu.exe
  C:\Windows\System\bpjCzGu.exe
  2⤵
  PID:3276
- C:\Windows\System\yjNaajn.exe
  C:\Windows\System\yjNaajn.exe
  2⤵
  PID:4624
- C:\Windows\System\aFZYvtU.exe
  C:\Windows\System\aFZYvtU.exe
  2⤵
  PID:4224
- C:\Windows\System\XiGxloA.exe
  C:\Windows\System\XiGxloA.exe
  2⤵
  PID:1632
- C:\Windows\System\NCkCijY.exe
  C:\Windows\System\NCkCijY.exe
  2⤵
  PID:4772
- C:\Windows\System\MPZWixL.exe
  C:\Windows\System\MPZWixL.exe
  2⤵
  PID:4156
- C:\Windows\System\dqfIzgU.exe
  C:\Windows\System\dqfIzgU.exe
  2⤵
  PID:3428
- C:\Windows\System\MoIUCRF.exe
  C:\Windows\System\MoIUCRF.exe
  2⤵
  PID:632
- C:\Windows\System\KvSCLgd.exe
  C:\Windows\System\KvSCLgd.exe
  2⤵
  PID:3068
- C:\Windows\System\qceZAeo.exe
  C:\Windows\System\qceZAeo.exe
  2⤵
  PID:4424
- C:\Windows\System\mVxgEZN.exe
  C:\Windows\System\mVxgEZN.exe
  2⤵
  PID:4912
- C:\Windows\System\KBOVJzV.exe
  C:\Windows\System\KBOVJzV.exe
  2⤵
  PID:4288
- C:\Windows\System\vSkSoRK.exe
  C:\Windows\System\vSkSoRK.exe
  2⤵
  PID:2644
- C:\Windows\System\OknIJQK.exe
  C:\Windows\System\OknIJQK.exe
  2⤵
  PID:1840
- C:\Windows\System\KOEzDkk.exe
  C:\Windows\System\KOEzDkk.exe
  2⤵
  PID:3828
- C:\Windows\System\wsUqAbq.exe
  C:\Windows\System\wsUqAbq.exe
  2⤵
  PID:5128
- C:\Windows\System\KFVHkwC.exe
  C:\Windows\System\KFVHkwC.exe
  2⤵
  PID:5152
- C:\Windows\System\PvLzKjY.exe
  C:\Windows\System\PvLzKjY.exe
  2⤵
  PID:5180
- C:\Windows\System\sPHxHSg.exe
  C:\Windows\System\sPHxHSg.exe
  2⤵
  PID:5208
- C:\Windows\System\XdzkLYK.exe
  C:\Windows\System\XdzkLYK.exe
  2⤵
  PID:5236
- C:\Windows\System\xOPtFHB.exe
  C:\Windows\System\xOPtFHB.exe
  2⤵
  PID:5264
- C:\Windows\System\WPKJlUb.exe
  C:\Windows\System\WPKJlUb.exe
  2⤵
  PID:5296
- C:\Windows\System\mGefYAl.exe
  C:\Windows\System\mGefYAl.exe
  2⤵
  PID:5320
- C:\Windows\System\WhbbIac.exe
  C:\Windows\System\WhbbIac.exe
  2⤵
  PID:5352
- C:\Windows\System\vcGiZoK.exe
  C:\Windows\System\vcGiZoK.exe
  2⤵
  PID:5380
- C:\Windows\System\EmujKrC.exe
  C:\Windows\System\EmujKrC.exe
  2⤵
  PID:5404
- C:\Windows\System\CCQWnHc.exe
  C:\Windows\System\CCQWnHc.exe
  2⤵
  PID:5432
- C:\Windows\System\qEvwBQZ.exe
  C:\Windows\System\qEvwBQZ.exe
  2⤵
  PID:5456
- C:\Windows\System\pHFasEn.exe
  C:\Windows\System\pHFasEn.exe
  2⤵
  PID:5492
- C:\Windows\System\iIxFITo.exe
  C:\Windows\System\iIxFITo.exe
  2⤵
  PID:5520
- C:\Windows\System\NSWMRDY.exe
  C:\Windows\System\NSWMRDY.exe
  2⤵
  PID:5548
- C:\Windows\System\HARbpsP.exe
  C:\Windows\System\HARbpsP.exe
  2⤵
  PID:5576
- C:\Windows\System\vNdSArz.exe
  C:\Windows\System\vNdSArz.exe
  2⤵
  PID:5600
- C:\Windows\System\HBnPMRz.exe
  C:\Windows\System\HBnPMRz.exe
  2⤵
  PID:5628
- C:\Windows\System\nVRlNUW.exe
  C:\Windows\System\nVRlNUW.exe
  2⤵
  PID:5660
- C:\Windows\System\DyPYPbj.exe
  C:\Windows\System\DyPYPbj.exe
  2⤵
  PID:5684
- C:\Windows\System\AlJuOET.exe
  C:\Windows\System\AlJuOET.exe
  2⤵
  PID:5712
- C:\Windows\System\aAvauHa.exe
  C:\Windows\System\aAvauHa.exe
  2⤵
  PID:5740
- C:\Windows\System\vvKSuto.exe
  C:\Windows\System\vvKSuto.exe
  2⤵
  PID:5768
- C:\Windows\System\HfMRWvm.exe
  C:\Windows\System\HfMRWvm.exe
  2⤵
  PID:5796
- C:\Windows\System\EyCWbvn.exe
  C:\Windows\System\EyCWbvn.exe
  2⤵
  PID:5824
- C:\Windows\System\qjzYSzg.exe
  C:\Windows\System\qjzYSzg.exe
  2⤵
  PID:5856
- C:\Windows\System\dmITgKG.exe
  C:\Windows\System\dmITgKG.exe
  2⤵
  PID:5880
- C:\Windows\System\AVvntsH.exe
  C:\Windows\System\AVvntsH.exe
  2⤵
  PID:5908
- C:\Windows\System\gnwMFQX.exe
  C:\Windows\System\gnwMFQX.exe
  2⤵
  PID:5936
- C:\Windows\System\gCITMLY.exe
  C:\Windows\System\gCITMLY.exe
  2⤵
  PID:5968
- C:\Windows\System\zZtFuVH.exe
  C:\Windows\System\zZtFuVH.exe
  2⤵
  PID:6052
- C:\Windows\System\wmxlwVU.exe
  C:\Windows\System\wmxlwVU.exe
  2⤵
  PID:6068
- C:\Windows\System\fndGrYk.exe
  C:\Windows\System\fndGrYk.exe
  2⤵
  PID:6084
- C:\Windows\System\bFsYihL.exe
  C:\Windows\System\bFsYihL.exe
  2⤵
  PID:6108
- C:\Windows\System\ygsKsSL.exe
  C:\Windows\System\ygsKsSL.exe
  2⤵
  PID:6136
- C:\Windows\System\cFKZTor.exe
  C:\Windows\System\cFKZTor.exe
  2⤵
  PID:4128
- C:\Windows\System\zurBoRq.exe
  C:\Windows\System\zurBoRq.exe
  2⤵
  PID:4348
- C:\Windows\System\OkVAkqb.exe
  C:\Windows\System\OkVAkqb.exe
  2⤵
  PID:2272
- C:\Windows\System\xGIuBRT.exe
  C:\Windows\System\xGIuBRT.exe
  2⤵
  PID:388
- C:\Windows\System\GGqKHDL.exe
  C:\Windows\System\GGqKHDL.exe
  2⤵
  PID:1676
- C:\Windows\System\uPCoLfC.exe
  C:\Windows\System\uPCoLfC.exe
  2⤵
  PID:1760
- C:\Windows\System\wiRgOhP.exe
  C:\Windows\System\wiRgOhP.exe
  2⤵
  PID:2732
- C:\Windows\System\OKUDwKt.exe
  C:\Windows\System\OKUDwKt.exe
  2⤵
  PID:4268
- C:\Windows\System\MgbwaOs.exe
  C:\Windows\System\MgbwaOs.exe
  2⤵
  PID:4796
- C:\Windows\System\kVKtLIY.exe
  C:\Windows\System\kVKtLIY.exe
  2⤵
  PID:5144
- C:\Windows\System\HBNvXVI.exe
  C:\Windows\System\HBNvXVI.exe
  2⤵
  PID:5200
- C:\Windows\System\kMrzDMO.exe
  C:\Windows\System\kMrzDMO.exe
  2⤵
  PID:5276
- C:\Windows\System\xqpmwje.exe
  C:\Windows\System\xqpmwje.exe
  2⤵
  PID:5332
- C:\Windows\System\GiMdSOw.exe
  C:\Windows\System\GiMdSOw.exe
  2⤵
  PID:5400
- C:\Windows\System\HBqNkJf.exe
  C:\Windows\System\HBqNkJf.exe
  2⤵
  PID:4948
- C:\Windows\System\RqqPrYY.exe
  C:\Windows\System\RqqPrYY.exe
  2⤵
  PID:5512
- C:\Windows\System\LwPwPZs.exe
  C:\Windows\System\LwPwPZs.exe
  2⤵
  PID:3556
- C:\Windows\System\aGgkHfO.exe
  C:\Windows\System\aGgkHfO.exe
  2⤵
  PID:5624
- C:\Windows\System\BwXnnge.exe
  C:\Windows\System\BwXnnge.exe
  2⤵
  PID:5700
- C:\Windows\System\gyyJjEK.exe
  C:\Windows\System\gyyJjEK.exe
  2⤵
  PID:5760
- C:\Windows\System\yaCihvM.exe
  C:\Windows\System\yaCihvM.exe
  2⤵
  PID:5836
- C:\Windows\System\eqbPwbr.exe
  C:\Windows\System\eqbPwbr.exe
  2⤵
  PID:5896
- C:\Windows\System\hfmXuYi.exe
  C:\Windows\System\hfmXuYi.exe
  2⤵
  PID:5960
- C:\Windows\System\IcceOvu.exe
  C:\Windows\System\IcceOvu.exe
  2⤵
  PID:6060
- C:\Windows\System\DXuagAU.exe
  C:\Windows\System\DXuagAU.exe
  2⤵
  PID:6104
- C:\Windows\System\JesZnie.exe
  C:\Windows\System\JesZnie.exe
  2⤵
  PID:2336
- C:\Windows\System\DRqSOTR.exe
  C:\Windows\System\DRqSOTR.exe
  2⤵
  PID:4276
- C:\Windows\System\jVknegj.exe
  C:\Windows\System\jVknegj.exe
  2⤵
  PID:1592
- C:\Windows\System\uWougli.exe
  C:\Windows\System\uWougli.exe
  2⤵
  PID:3456
- C:\Windows\System\RXmnJLW.exe
  C:\Windows\System\RXmnJLW.exe
  2⤵
  PID:5168
- C:\Windows\System\BenABSx.exe
  C:\Windows\System\BenABSx.exe
  2⤵
  PID:5312
- C:\Windows\System\PAkaSWb.exe
  C:\Windows\System\PAkaSWb.exe
  2⤵
  PID:5448
- C:\Windows\System\gBAEkIh.exe
  C:\Windows\System\gBAEkIh.exe
  2⤵
  PID:5596
- C:\Windows\System\hJTIGDV.exe
  C:\Windows\System\hJTIGDV.exe
  2⤵
  PID:5728
- C:\Windows\System\JhhbGNe.exe
  C:\Windows\System\JhhbGNe.exe
  2⤵
  PID:6172
- C:\Windows\System\EeQQStl.exe
  C:\Windows\System\EeQQStl.exe
  2⤵
  PID:6200
- C:\Windows\System\tpkyHfj.exe
  C:\Windows\System\tpkyHfj.exe
  2⤵
  PID:6228
- C:\Windows\System\LyIBNqj.exe
  C:\Windows\System\LyIBNqj.exe
  2⤵
  PID:6256
- C:\Windows\System\RIIYsdE.exe
  C:\Windows\System\RIIYsdE.exe
  2⤵
  PID:6284
- C:\Windows\System\QACaiEz.exe
  C:\Windows\System\QACaiEz.exe
  2⤵
  PID:6312
- C:\Windows\System\MgVYwYs.exe
  C:\Windows\System\MgVYwYs.exe
  2⤵
  PID:6340
- C:\Windows\System\DLBIWpO.exe
  C:\Windows\System\DLBIWpO.exe
  2⤵
  PID:6368
- C:\Windows\System\fUcjzDu.exe
  C:\Windows\System\fUcjzDu.exe
  2⤵
  PID:6396
- C:\Windows\System\zlErRHj.exe
  C:\Windows\System\zlErRHj.exe
  2⤵
  PID:6424
- C:\Windows\System\bdttqqd.exe
  C:\Windows\System\bdttqqd.exe
  2⤵
  PID:6452
- C:\Windows\System\HDPMpSb.exe
  C:\Windows\System\HDPMpSb.exe
  2⤵
  PID:6480
- C:\Windows\System\mqYryeo.exe
  C:\Windows\System\mqYryeo.exe
  2⤵
  PID:6508
- C:\Windows\System\QTgwBat.exe
  C:\Windows\System\QTgwBat.exe
  2⤵
  PID:6532
- C:\Windows\System\yquQhkT.exe
  C:\Windows\System\yquQhkT.exe
  2⤵
  PID:6560
- C:\Windows\System\RtmuUxG.exe
  C:\Windows\System\RtmuUxG.exe
  2⤵
  PID:6588
- C:\Windows\System\rZtpgPK.exe
  C:\Windows\System\rZtpgPK.exe
  2⤵
  PID:6620
- C:\Windows\System\RShMTJf.exe
  C:\Windows\System\RShMTJf.exe
  2⤵
  PID:6648
- C:\Windows\System\SaqDowR.exe
  C:\Windows\System\SaqDowR.exe
  2⤵
  PID:6676
- C:\Windows\System\XAPMHWV.exe
  C:\Windows\System\XAPMHWV.exe
  2⤵
  PID:6708
- C:\Windows\System\OrQaKPQ.exe
  C:\Windows\System\OrQaKPQ.exe
  2⤵
  PID:6736
- C:\Windows\System\DVbPqtp.exe
  C:\Windows\System\DVbPqtp.exe
  2⤵
  PID:6768
- C:\Windows\System\KXNwrek.exe
  C:\Windows\System\KXNwrek.exe
  2⤵
  PID:6796
- C:\Windows\System\gBuHXHD.exe
  C:\Windows\System\gBuHXHD.exe
  2⤵
  PID:6820
- C:\Windows\System\XsNCoZf.exe
  C:\Windows\System\XsNCoZf.exe
  2⤵
  PID:6852
- C:\Windows\System\ZybUznp.exe
  C:\Windows\System\ZybUznp.exe
  2⤵
  PID:6880
- C:\Windows\System\twiIZoN.exe
  C:\Windows\System\twiIZoN.exe
  2⤵
  PID:6908
- C:\Windows\System\TmvxOAP.exe
  C:\Windows\System\TmvxOAP.exe
  2⤵
  PID:6936
- C:\Windows\System\JOUTsrM.exe
  C:\Windows\System\JOUTsrM.exe
  2⤵
  PID:6960
- C:\Windows\System\HvAgmNp.exe
  C:\Windows\System\HvAgmNp.exe
  2⤵
  PID:7004
- C:\Windows\System\UIDqETn.exe
  C:\Windows\System\UIDqETn.exe
  2⤵
  PID:7032
- C:\Windows\System\XsTTnRz.exe
  C:\Windows\System\XsTTnRz.exe
  2⤵
  PID:7048
- C:\Windows\System\AeNgiED.exe
  C:\Windows\System\AeNgiED.exe
  2⤵
  PID:7064
- C:\Windows\System\NuxImWk.exe
  C:\Windows\System\NuxImWk.exe
  2⤵
  PID:7080
- C:\Windows\System\LPKhdKu.exe
  C:\Windows\System\LPKhdKu.exe
  2⤵
  PID:7112
- C:\Windows\System\FoIkrRY.exe
  C:\Windows\System\FoIkrRY.exe
  2⤵
  PID:7136
- C:\Windows\System\JJAhBBc.exe
  C:\Windows\System\JJAhBBc.exe
  2⤵
  PID:5808
- C:\Windows\System\DnCGUVB.exe
  C:\Windows\System\DnCGUVB.exe
  2⤵
  PID:2532
- C:\Windows\System\fBqEIYu.exe
  C:\Windows\System\fBqEIYu.exe
  2⤵
  PID:1372
- C:\Windows\System\wOBAwAv.exe
  C:\Windows\System\wOBAwAv.exe
  2⤵
  PID:5372
- C:\Windows\System\GrrNNEW.exe
  C:\Windows\System\GrrNNEW.exe
  2⤵
  PID:5680
- C:\Windows\System\rgDBJiA.exe
  C:\Windows\System\rgDBJiA.exe
  2⤵
  PID:6212
- C:\Windows\System\SAOPPqi.exe
  C:\Windows\System\SAOPPqi.exe
  2⤵
  PID:6248
- C:\Windows\System\bsEWlmD.exe
  C:\Windows\System\bsEWlmD.exe
  2⤵
  PID:4240
- C:\Windows\System\RtHaSqo.exe
  C:\Windows\System\RtHaSqo.exe
  2⤵
  PID:6332
- C:\Windows\System\YqkqmCX.exe
  C:\Windows\System\YqkqmCX.exe
  2⤵
  PID:6380
- C:\Windows\System\RLmItJI.exe
  C:\Windows\System\RLmItJI.exe
  2⤵
  PID:6412
- C:\Windows\System\qhiZtSb.exe
  C:\Windows\System\qhiZtSb.exe
  2⤵
  PID:4956
- C:\Windows\System\XgWVOcM.exe
  C:\Windows\System\XgWVOcM.exe
  2⤵
  PID:6500
- C:\Windows\System\lsYAAIW.exe
  C:\Windows\System\lsYAAIW.exe
  2⤵
  PID:6612
- C:\Windows\System\fAKhiWe.exe
  C:\Windows\System\fAKhiWe.exe
  2⤵
  PID:4832
- C:\Windows\System\THIeNme.exe
  C:\Windows\System\THIeNme.exe
  2⤵
  PID:6724
- C:\Windows\System\pfloHGB.exe
  C:\Windows\System\pfloHGB.exe
  2⤵
  PID:4484
- C:\Windows\System\uCDwJvy.exe
  C:\Windows\System\uCDwJvy.exe
  2⤵
  PID:6808
- C:\Windows\System\RiNbsEE.exe
  C:\Windows\System\RiNbsEE.exe
  2⤵
  PID:6920
- C:\Windows\System\DiUcYku.exe
  C:\Windows\System\DiUcYku.exe
  2⤵
  PID:6840
- C:\Windows\System\kRthCQQ.exe
  C:\Windows\System\kRthCQQ.exe
  2⤵
  PID:6892
- C:\Windows\System\ZjMpJcY.exe
  C:\Windows\System\ZjMpJcY.exe
  2⤵
  PID:4744
- C:\Windows\System\DMSPiKR.exe
  C:\Windows\System\DMSPiKR.exe
  2⤵
  PID:5100
- C:\Windows\System\RPpNeNf.exe
  C:\Windows\System\RPpNeNf.exe
  2⤵
  PID:3308
- C:\Windows\System\SeGVkgk.exe
  C:\Windows\System\SeGVkgk.exe
  2⤵
  PID:4740
- C:\Windows\System\SwbIbUd.exe
  C:\Windows\System\SwbIbUd.exe
  2⤵
  PID:6980
- C:\Windows\System\nCEudut.exe
  C:\Windows\System\nCEudut.exe
  2⤵
  PID:5732
- C:\Windows\System\BrXkOME.exe
  C:\Windows\System\BrXkOME.exe
  2⤵
  PID:5872
- C:\Windows\System\QitsJnc.exe
  C:\Windows\System\QitsJnc.exe
  2⤵
  PID:4384
- C:\Windows\System\oFkzzCy.exe
  C:\Windows\System\oFkzzCy.exe
  2⤵
  PID:5540
- C:\Windows\System\BMiaxdy.exe
  C:\Windows\System\BMiaxdy.exe
  2⤵
  PID:6192
- C:\Windows\System\VxtWBzF.exe
  C:\Windows\System\VxtWBzF.exe
  2⤵
  PID:1952
- C:\Windows\System\LshPiTQ.exe
  C:\Windows\System\LshPiTQ.exe
  2⤵
  PID:6356
- C:\Windows\System\tNAjqEd.exe
  C:\Windows\System\tNAjqEd.exe
  2⤵
  PID:6492
- C:\Windows\System\wzOnoZY.exe
  C:\Windows\System\wzOnoZY.exe
  2⤵
  PID:5084
- C:\Windows\System\JCijtIs.exe
  C:\Windows\System\JCijtIs.exe
  2⤵
  PID:2444
- C:\Windows\System\UwMdVgH.exe
  C:\Windows\System\UwMdVgH.exe
  2⤵
  PID:6780
- C:\Windows\System\beyUgrY.exe
  C:\Windows\System\beyUgrY.exe
  2⤵
  PID:6868
- C:\Windows\System\ACuIOeV.exe
  C:\Windows\System\ACuIOeV.exe
  2⤵
  PID:4456
- C:\Windows\System\xOptyoZ.exe
  C:\Windows\System\xOptyoZ.exe
  2⤵
  PID:3012
- C:\Windows\System\zFlhEfi.exe
  C:\Windows\System\zFlhEfi.exe
  2⤵
  PID:6924
- C:\Windows\System\ROBvnLI.exe
  C:\Windows\System\ROBvnLI.exe
  2⤵
  PID:2024
- C:\Windows\System\UARazHA.exe
  C:\Windows\System\UARazHA.exe
  2⤵
  PID:1844
- C:\Windows\System\eIwSnUV.exe
  C:\Windows\System\eIwSnUV.exe
  2⤵
  PID:6668
- C:\Windows\System\uVhlpEy.exe
  C:\Windows\System\uVhlpEy.exe
  2⤵
  PID:4668
- C:\Windows\System\FPixTNH.exe
  C:\Windows\System\FPixTNH.exe
  2⤵
  PID:6976
- C:\Windows\System\SaYCIGa.exe
  C:\Windows\System\SaYCIGa.exe
  2⤵
  PID:7076
- C:\Windows\System\XAYdMNY.exe
  C:\Windows\System\XAYdMNY.exe
  2⤵
  PID:7180
- C:\Windows\System\notqWOa.exe
  C:\Windows\System\notqWOa.exe
  2⤵
  PID:7212
- C:\Windows\System\dnzFeay.exe
  C:\Windows\System\dnzFeay.exe
  2⤵
  PID:7284
- C:\Windows\System\ZrSLooL.exe
  C:\Windows\System\ZrSLooL.exe
  2⤵
  PID:7308
- C:\Windows\System\guRHHhf.exe
  C:\Windows\System\guRHHhf.exe
  2⤵
  PID:7328
- C:\Windows\System\NbztrJt.exe
  C:\Windows\System\NbztrJt.exe
  2⤵
  PID:7360
- C:\Windows\System\swgOkdE.exe
  C:\Windows\System\swgOkdE.exe
  2⤵
  PID:7380
- C:\Windows\System\XOVjMKC.exe
  C:\Windows\System\XOVjMKC.exe
  2⤵
  PID:7404
- C:\Windows\System\MuYaJgj.exe
  C:\Windows\System\MuYaJgj.exe
  2⤵
  PID:7444
- C:\Windows\System\FWrlnho.exe
  C:\Windows\System\FWrlnho.exe
  2⤵
  PID:7476
- C:\Windows\System\gVJCuCX.exe
  C:\Windows\System\gVJCuCX.exe
  2⤵
  PID:7520
- C:\Windows\System\qcmtuKD.exe
  C:\Windows\System\qcmtuKD.exe
  2⤵
  PID:7544
- C:\Windows\System\KCsFYwf.exe
  C:\Windows\System\KCsFYwf.exe
  2⤵
  PID:7564
- C:\Windows\System\sjlwWXn.exe
  C:\Windows\System\sjlwWXn.exe
  2⤵
  PID:7592
- C:\Windows\System\sTtNYOR.exe
  C:\Windows\System\sTtNYOR.exe
  2⤵
  PID:7628
- C:\Windows\System\ZIzNOLY.exe
  C:\Windows\System\ZIzNOLY.exe
  2⤵
  PID:7648
- C:\Windows\System\GWJvjmz.exe
  C:\Windows\System\GWJvjmz.exe
  2⤵
  PID:7676
- C:\Windows\System\ZGrwxQa.exe
  C:\Windows\System\ZGrwxQa.exe
  2⤵
  PID:7716
- C:\Windows\System\RZltSVh.exe
  C:\Windows\System\RZltSVh.exe
  2⤵
  PID:7740
- C:\Windows\System\IFhWVOQ.exe
  C:\Windows\System\IFhWVOQ.exe
  2⤵
  PID:7764
- C:\Windows\System\kwEHGWt.exe
  C:\Windows\System\kwEHGWt.exe
  2⤵
  PID:7788
- C:\Windows\System\hxpvWwj.exe
  C:\Windows\System\hxpvWwj.exe
  2⤵
  PID:7816
- C:\Windows\System\QiFhKfY.exe
  C:\Windows\System\QiFhKfY.exe
  2⤵
  PID:7832
- C:\Windows\System\uxnYHGM.exe
  C:\Windows\System\uxnYHGM.exe
  2⤵
  PID:7860
- C:\Windows\System\qwQzgew.exe
  C:\Windows\System\qwQzgew.exe
  2⤵
  PID:7892
- C:\Windows\System\JrKxcrG.exe
  C:\Windows\System\JrKxcrG.exe
  2⤵
  PID:7932
- C:\Windows\System\nmXBzlh.exe
  C:\Windows\System\nmXBzlh.exe
  2⤵
  PID:7948
- C:\Windows\System\uPsQMcW.exe
  C:\Windows\System\uPsQMcW.exe
  2⤵
  PID:7968
- C:\Windows\System\bYMwSxz.exe
  C:\Windows\System\bYMwSxz.exe
  2⤵
  PID:7992
- C:\Windows\System\WQiHMDR.exe
  C:\Windows\System\WQiHMDR.exe
  2⤵
  PID:8020
- C:\Windows\System\ozRPNkj.exe
  C:\Windows\System\ozRPNkj.exe
  2⤵
  PID:8044
- C:\Windows\System\xlcsFXT.exe
  C:\Windows\System\xlcsFXT.exe
  2⤵
  PID:8072
- C:\Windows\System\nuXIONy.exe
  C:\Windows\System\nuXIONy.exe
  2⤵
  PID:8100
- C:\Windows\System\MFQItwl.exe
  C:\Windows\System\MFQItwl.exe
  2⤵
  PID:8156
- C:\Windows\System\AdkEKpB.exe
  C:\Windows\System\AdkEKpB.exe
  2⤵
  PID:8172
- C:\Windows\System\eXMKHoh.exe
  C:\Windows\System\eXMKHoh.exe
  2⤵
  PID:2764
- C:\Windows\System\VtSAnZh.exe
  C:\Windows\System\VtSAnZh.exe
  2⤵
  PID:6836
- C:\Windows\System\oBqVjOB.exe
  C:\Windows\System\oBqVjOB.exe
  2⤵
  PID:7204
- C:\Windows\System\SiirlvS.exe
  C:\Windows\System\SiirlvS.exe
  2⤵
  PID:7296
- C:\Windows\System\BKtUGEr.exe
  C:\Windows\System\BKtUGEr.exe
  2⤵
  PID:7368
- C:\Windows\System\IEYyzGa.exe
  C:\Windows\System\IEYyzGa.exe
  2⤵
  PID:7440
- C:\Windows\System\NUJULVE.exe
  C:\Windows\System\NUJULVE.exe
  2⤵
  PID:7472
- C:\Windows\System\JAOzGTW.exe
  C:\Windows\System\JAOzGTW.exe
  2⤵
  PID:7576
- C:\Windows\System\wxPfOZB.exe
  C:\Windows\System\wxPfOZB.exe
  2⤵
  PID:7660
- C:\Windows\System\AltlQMK.exe
  C:\Windows\System\AltlQMK.exe
  2⤵
  PID:7704
- C:\Windows\System\nHCbGXd.exe
  C:\Windows\System\nHCbGXd.exe
  2⤵
  PID:7748
- C:\Windows\System\ahEBhLc.exe
  C:\Windows\System\ahEBhLc.exe
  2⤵
  PID:7800
- C:\Windows\System\VLyKIcw.exe
  C:\Windows\System\VLyKIcw.exe
  2⤵
  PID:7916
- C:\Windows\System\xWOuVRc.exe
  C:\Windows\System\xWOuVRc.exe
  2⤵
  PID:7980
- C:\Windows\System\zCFOrUM.exe
  C:\Windows\System\zCFOrUM.exe
  2⤵
  PID:7964
- C:\Windows\System\GeUkZMZ.exe
  C:\Windows\System\GeUkZMZ.exe
  2⤵
  PID:8140
- C:\Windows\System\HHnxMse.exe
  C:\Windows\System\HHnxMse.exe
  2⤵
  PID:8136
- C:\Windows\System\zaAuHxu.exe
  C:\Windows\System\zaAuHxu.exe
  2⤵
  PID:8164
- C:\Windows\System\RcSEdrg.exe
  C:\Windows\System\RcSEdrg.exe
  2⤵
  PID:6604
- C:\Windows\System\OYWQPuC.exe
  C:\Windows\System\OYWQPuC.exe
  2⤵
  PID:7340
- C:\Windows\System\srRsHfN.exe
  C:\Windows\System\srRsHfN.exe
  2⤵
  PID:7560
- C:\Windows\System\tHVgoNQ.exe
  C:\Windows\System\tHVgoNQ.exe
  2⤵
  PID:7712
- C:\Windows\System\mWkmGoh.exe
  C:\Windows\System\mWkmGoh.exe
  2⤵
  PID:7940
- C:\Windows\System\OvrHywG.exe
  C:\Windows\System\OvrHywG.exe
  2⤵
  PID:8000
- C:\Windows\System\oInWuLC.exe
  C:\Windows\System\oInWuLC.exe
  2⤵
  PID:8188
- C:\Windows\System\rvHeBBC.exe
  C:\Windows\System\rvHeBBC.exe
  2⤵
  PID:7376
- C:\Windows\System\wJBCLkh.exe
  C:\Windows\System\wJBCLkh.exe
  2⤵
  PID:7868
- C:\Windows\System\DxXRksB.exe
  C:\Windows\System\DxXRksB.exe
  2⤵
  PID:7580
- C:\Windows\System\aNoOWSn.exe
  C:\Windows\System\aNoOWSn.exe
  2⤵
  PID:8132
- C:\Windows\System\qtTwJDl.exe
  C:\Windows\System\qtTwJDl.exe
  2⤵
  PID:8204
- C:\Windows\System\rDlZpOd.exe
  C:\Windows\System\rDlZpOd.exe
  2⤵
  PID:8244
- C:\Windows\System\AVNqVYr.exe
  C:\Windows\System\AVNqVYr.exe
  2⤵
  PID:8268
- C:\Windows\System\DwumWKu.exe
  C:\Windows\System\DwumWKu.exe
  2⤵
  PID:8288
- C:\Windows\System\onigNER.exe
  C:\Windows\System\onigNER.exe
  2⤵
  PID:8332
- C:\Windows\System\AEDJjuy.exe
  C:\Windows\System\AEDJjuy.exe
  2⤵
  PID:8348
- C:\Windows\System\yYIvOqM.exe
  C:\Windows\System\yYIvOqM.exe
  2⤵
  PID:8376
- C:\Windows\System\IAoTNtt.exe
  C:\Windows\System\IAoTNtt.exe
  2⤵
  PID:8396
- C:\Windows\System\gNNaIHI.exe
  C:\Windows\System\gNNaIHI.exe
  2⤵
  PID:8416
- C:\Windows\System\budKiiQ.exe
  C:\Windows\System\budKiiQ.exe
  2⤵
  PID:8448
- C:\Windows\System\JXbJwsT.exe
  C:\Windows\System\JXbJwsT.exe
  2⤵
  PID:8472
- C:\Windows\System\nGVcjgo.exe
  C:\Windows\System\nGVcjgo.exe
  2⤵
  PID:8524
- C:\Windows\System\mkKQPAD.exe
  C:\Windows\System\mkKQPAD.exe
  2⤵
  PID:8548
- C:\Windows\System\vUfNMHW.exe
  C:\Windows\System\vUfNMHW.exe
  2⤵
  PID:8572
- C:\Windows\System\NqtEGbU.exe
  C:\Windows\System\NqtEGbU.exe
  2⤵
  PID:8608
- C:\Windows\System\jJIecVt.exe
  C:\Windows\System\jJIecVt.exe
  2⤵
  PID:8624
- C:\Windows\System\xyRszza.exe
  C:\Windows\System\xyRszza.exe
  2⤵
  PID:8648
- C:\Windows\System\OUEpZnZ.exe
  C:\Windows\System\OUEpZnZ.exe
  2⤵
  PID:8672
- C:\Windows\System\muypNeT.exe
  C:\Windows\System\muypNeT.exe
  2⤵
  PID:8692
- C:\Windows\System\nGLPvMY.exe
  C:\Windows\System\nGLPvMY.exe
  2⤵
  PID:8716
- C:\Windows\System\INNCzZS.exe
  C:\Windows\System\INNCzZS.exe
  2⤵
  PID:8768
- C:\Windows\System\sqRPhZW.exe
  C:\Windows\System\sqRPhZW.exe
  2⤵
  PID:8788
- C:\Windows\System\IZklgkQ.exe
  C:\Windows\System\IZklgkQ.exe
  2⤵
  PID:8816
- C:\Windows\System\vJCumBq.exe
  C:\Windows\System\vJCumBq.exe
  2⤵
  PID:8836
- C:\Windows\System\zemxIdB.exe
  C:\Windows\System\zemxIdB.exe
  2⤵
  PID:8856
- C:\Windows\System\bShLWfi.exe
  C:\Windows\System\bShLWfi.exe
  2⤵
  PID:8880
- C:\Windows\System\eycpadn.exe
  C:\Windows\System\eycpadn.exe
  2⤵
  PID:8900
- C:\Windows\System\lamymzV.exe
  C:\Windows\System\lamymzV.exe
  2⤵
  PID:8920
- C:\Windows\System\gTUOAXC.exe
  C:\Windows\System\gTUOAXC.exe
  2⤵
  PID:8964
- C:\Windows\System\YIXWXzW.exe
  C:\Windows\System\YIXWXzW.exe
  2⤵
  PID:9000
- C:\Windows\System\SQhwBvl.exe
  C:\Windows\System\SQhwBvl.exe
  2⤵
  PID:9020
- C:\Windows\System\PVugyGf.exe
  C:\Windows\System\PVugyGf.exe
  2⤵
  PID:9088
- C:\Windows\System\NOSlrnn.exe
  C:\Windows\System\NOSlrnn.exe
  2⤵
  PID:9116
- C:\Windows\System\xplCDxa.exe
  C:\Windows\System\xplCDxa.exe
  2⤵
  PID:9132
- C:\Windows\System\fySMesb.exe
  C:\Windows\System\fySMesb.exe
  2⤵
  PID:9152
- C:\Windows\System\dZZPfbv.exe
  C:\Windows\System\dZZPfbv.exe
  2⤵
  PID:9184
- C:\Windows\System\jshhxDX.exe
  C:\Windows\System\jshhxDX.exe
  2⤵
  PID:7528
- C:\Windows\System\VIYJvaq.exe
  C:\Windows\System\VIYJvaq.exe
  2⤵
  PID:8264
- C:\Windows\System\JisfgmR.exe
  C:\Windows\System\JisfgmR.exe
  2⤵
  PID:8324
- C:\Windows\System\esBqAcE.exe
  C:\Windows\System\esBqAcE.exe
  2⤵
  PID:8364
- C:\Windows\System\hUKNdoZ.exe
  C:\Windows\System\hUKNdoZ.exe
  2⤵
  PID:8412
- C:\Windows\System\qgqOKLw.exe
  C:\Windows\System\qgqOKLw.exe
  2⤵
  PID:8520
- C:\Windows\System\sQneokn.exe
  C:\Windows\System\sQneokn.exe
  2⤵
  PID:8544
- C:\Windows\System\fOVzMfA.exe
  C:\Windows\System\fOVzMfA.exe
  2⤵
  PID:8616
- C:\Windows\System\QTAqZIj.exe
  C:\Windows\System\QTAqZIj.exe
  2⤵
  PID:8688
- C:\Windows\System\uQVipUh.exe
  C:\Windows\System\uQVipUh.exe
  2⤵
  PID:8748
- C:\Windows\System\SOHtjHU.exe
  C:\Windows\System\SOHtjHU.exe
  2⤵
  PID:8848
- C:\Windows\System\dmCjWBl.exe
  C:\Windows\System\dmCjWBl.exe
  2⤵
  PID:8876
- C:\Windows\System\jdqsVWN.exe
  C:\Windows\System\jdqsVWN.exe
  2⤵
  PID:8888
- C:\Windows\System\uZsLJhW.exe
  C:\Windows\System\uZsLJhW.exe
  2⤵
  PID:8980
- C:\Windows\System\ozmLmDp.exe
  C:\Windows\System\ozmLmDp.exe
  2⤵
  PID:9056
- C:\Windows\System\HlChfkw.exe
  C:\Windows\System\HlChfkw.exe
  2⤵
  PID:9124
- C:\Windows\System\KMXKfPG.exe
  C:\Windows\System\KMXKfPG.exe
  2⤵
  PID:9140
- C:\Windows\System\uUsrTzP.exe
  C:\Windows\System\uUsrTzP.exe
  2⤵
  PID:8240
- C:\Windows\System\aYuvLph.exe
  C:\Windows\System\aYuvLph.exe
  2⤵
  PID:8432
- C:\Windows\System\FTQMHCA.exe
  C:\Windows\System\FTQMHCA.exe
  2⤵
  PID:8556
- C:\Windows\System\ACJGxiP.exe
  C:\Windows\System\ACJGxiP.exe
  2⤵
  PID:8744
- C:\Windows\System\cYyJAIB.exe
  C:\Windows\System\cYyJAIB.exe
  2⤵
  PID:8896
- C:\Windows\System\EhWMQwj.exe
  C:\Windows\System\EhWMQwj.exe
  2⤵
  PID:9084
- C:\Windows\System\ZdAWAup.exe
  C:\Windows\System\ZdAWAup.exe
  2⤵
  PID:8360
- C:\Windows\System\wZrwFLn.exe
  C:\Windows\System\wZrwFLn.exe
  2⤵
  PID:8660
- C:\Windows\System\eNXLMsH.exe
  C:\Windows\System\eNXLMsH.exe
  2⤵
  PID:8708
- C:\Windows\System\gNrTVbr.exe
  C:\Windows\System\gNrTVbr.exe
  2⤵
  PID:9160
- C:\Windows\System\Cnlymge.exe
  C:\Windows\System\Cnlymge.exe
  2⤵
  PID:8232
- C:\Windows\System\nwirvtn.exe
  C:\Windows\System\nwirvtn.exe
  2⤵
  PID:9224
- C:\Windows\System\VLwjBNZ.exe
  C:\Windows\System\VLwjBNZ.exe
  2⤵
  PID:9244
- C:\Windows\System\OnXFVQH.exe
  C:\Windows\System\OnXFVQH.exe
  2⤵
  PID:9300
- C:\Windows\System\HsdLUXb.exe
  C:\Windows\System\HsdLUXb.exe
  2⤵
  PID:9324
- C:\Windows\System\dMnNRRi.exe
  C:\Windows\System\dMnNRRi.exe
  2⤵
  PID:9344
- C:\Windows\System\LJjeWgi.exe
  C:\Windows\System\LJjeWgi.exe
  2⤵
  PID:9368
- C:\Windows\System\uZrCrTa.exe
  C:\Windows\System\uZrCrTa.exe
  2⤵
  PID:9396
- C:\Windows\System\WhtTIRI.exe
  C:\Windows\System\WhtTIRI.exe
  2⤵
  PID:9428
- C:\Windows\System\OhtlcnK.exe
  C:\Windows\System\OhtlcnK.exe
  2⤵
  PID:9460
- C:\Windows\System\jNWdNrt.exe
  C:\Windows\System\jNWdNrt.exe
  2⤵
  PID:9484
- C:\Windows\System\OIGVBYn.exe
  C:\Windows\System\OIGVBYn.exe
  2⤵
  PID:9508
- C:\Windows\System\dNnxIGn.exe
  C:\Windows\System\dNnxIGn.exe
  2⤵
  PID:9532
- C:\Windows\System\ahtXRNV.exe
  C:\Windows\System\ahtXRNV.exe
  2⤵
  PID:9564
- C:\Windows\System\ykuWUZv.exe
  C:\Windows\System\ykuWUZv.exe
  2⤵
  PID:9584
- C:\Windows\System\oerKAbg.exe
  C:\Windows\System\oerKAbg.exe
  2⤵
  PID:9620
- C:\Windows\System\xWszBlG.exe
  C:\Windows\System\xWszBlG.exe
  2⤵
  PID:9652
- C:\Windows\System\HfQgTcg.exe
  C:\Windows\System\HfQgTcg.exe
  2⤵
  PID:9676
- C:\Windows\System\OEBiVGd.exe
  C:\Windows\System\OEBiVGd.exe
  2⤵
  PID:9700
- C:\Windows\System\kastAqJ.exe
  C:\Windows\System\kastAqJ.exe
  2⤵
  PID:9764
- C:\Windows\System\Rgonhxt.exe
  C:\Windows\System\Rgonhxt.exe
  2⤵
  PID:9784
- C:\Windows\System\IhevGiu.exe
  C:\Windows\System\IhevGiu.exe
  2⤵
  PID:9820
- C:\Windows\System\rQquWEh.exe
  C:\Windows\System\rQquWEh.exe
  2⤵
  PID:9844
- C:\Windows\System\xqlbxFC.exe
  C:\Windows\System\xqlbxFC.exe
  2⤵
  PID:9864
- C:\Windows\System\wBKNbJG.exe
  C:\Windows\System\wBKNbJG.exe
  2⤵
  PID:9888
- C:\Windows\System\nuLTnYv.exe
  C:\Windows\System\nuLTnYv.exe
  2⤵
  PID:9912
- C:\Windows\System\YvLkcTq.exe
  C:\Windows\System\YvLkcTq.exe
  2⤵
  PID:9936
- C:\Windows\System\adhuLkE.exe
  C:\Windows\System\adhuLkE.exe
  2⤵
  PID:9952
- C:\Windows\System\eaGSJyV.exe
  C:\Windows\System\eaGSJyV.exe
  2⤵
  PID:9992
- C:\Windows\System\RtICpCN.exe
  C:\Windows\System\RtICpCN.exe
  2⤵
  PID:10024
- C:\Windows\System\GgputgV.exe
  C:\Windows\System\GgputgV.exe
  2⤵
  PID:10056
- C:\Windows\System\BPQXaOk.exe
  C:\Windows\System\BPQXaOk.exe
  2⤵
  PID:10076
- C:\Windows\System\FCBMOea.exe
  C:\Windows\System\FCBMOea.exe
  2⤵
  PID:10104
- C:\Windows\System\hsAZYxJ.exe
  C:\Windows\System\hsAZYxJ.exe
  2⤵
  PID:10124
- C:\Windows\System\gCZrdFJ.exe
  C:\Windows\System\gCZrdFJ.exe
  2⤵
  PID:10144
- C:\Windows\System\estcTQt.exe
  C:\Windows\System\estcTQt.exe
  2⤵
  PID:10180
- C:\Windows\System\ppeTLam.exe
  C:\Windows\System\ppeTLam.exe
  2⤵
  PID:8872
- C:\Windows\System\ZnlugOo.exe
  C:\Windows\System\ZnlugOo.exe
  2⤵
  PID:9232
- C:\Windows\System\HPgScQS.exe
  C:\Windows\System\HPgScQS.exe
  2⤵
  PID:9332
- C:\Windows\System\Kwhdock.exe
  C:\Windows\System\Kwhdock.exe
  2⤵
  PID:9416
- C:\Windows\System\slflthp.exe
  C:\Windows\System\slflthp.exe
  2⤵
  PID:9456
- C:\Windows\System\IAgHGoO.exe
  C:\Windows\System\IAgHGoO.exe
  2⤵
  PID:9504
- C:\Windows\System\hljOVvW.exe
  C:\Windows\System\hljOVvW.exe
  2⤵
  PID:9552
- C:\Windows\System\TLBioHK.exe
  C:\Windows\System\TLBioHK.exe
  2⤵
  PID:9612
- C:\Windows\System\cMrddxf.exe
  C:\Windows\System\cMrddxf.exe
  2⤵
  PID:9644
- C:\Windows\System\hwMDHHH.exe
  C:\Windows\System\hwMDHHH.exe
  2⤵
  PID:9776
- C:\Windows\System\mEkGKHt.exe
  C:\Windows\System\mEkGKHt.exe
  2⤵
  PID:9860
- C:\Windows\System\AxtttOc.exe
  C:\Windows\System\AxtttOc.exe
  2⤵
  PID:9876
- C:\Windows\System\lwYpCEd.exe
  C:\Windows\System\lwYpCEd.exe
  2⤵
  PID:10008
- C:\Windows\System\sxVKVGC.exe
  C:\Windows\System\sxVKVGC.exe
  2⤵
  PID:10044
- C:\Windows\System\SVPejOs.exe
  C:\Windows\System\SVPejOs.exe
  2⤵
  PID:10068
- C:\Windows\System\CPkdpvV.exe
  C:\Windows\System\CPkdpvV.exe
  2⤵
  PID:10176
- C:\Windows\System\RAFozfI.exe
  C:\Windows\System\RAFozfI.exe
  2⤵
  PID:10212
- C:\Windows\System\UjDHETe.exe
  C:\Windows\System\UjDHETe.exe
  2⤵
  PID:9236
- C:\Windows\System\PjrInte.exe
  C:\Windows\System\PjrInte.exe
  2⤵
  PID:9440
- C:\Windows\System\hecQHLC.exe
  C:\Windows\System\hecQHLC.exe
  2⤵
  PID:9444
- C:\Windows\System\WjhVNzn.exe
  C:\Windows\System\WjhVNzn.exe
  2⤵
  PID:9572
- C:\Windows\System\QSMXjbU.exe
  C:\Windows\System\QSMXjbU.exe
  2⤵
  PID:9816
- C:\Windows\System\gPszuIe.exe
  C:\Windows\System\gPszuIe.exe
  2⤵
  PID:9932
- C:\Windows\System\BuittVk.exe
  C:\Windows\System\BuittVk.exe
  2⤵
  PID:10040
- C:\Windows\System\lQEYfNu.exe
  C:\Windows\System\lQEYfNu.exe
  2⤵
  PID:9320
- C:\Windows\System\lnkyuPP.exe
  C:\Windows\System\lnkyuPP.exe
  2⤵
  PID:9840
- C:\Windows\System\gkKluXU.exe
  C:\Windows\System\gkKluXU.exe
  2⤵
  PID:10092
- C:\Windows\System\nCiAyqv.exe
  C:\Windows\System\nCiAyqv.exe
  2⤵
  PID:10252
- C:\Windows\System\KJbCpjh.exe
  C:\Windows\System\KJbCpjh.exe
  2⤵
  PID:10272
- C:\Windows\System\uhTXUCy.exe
  C:\Windows\System\uhTXUCy.exe
  2⤵
  PID:10292
- C:\Windows\System\ZpSHpTG.exe
  C:\Windows\System\ZpSHpTG.exe
  2⤵
  PID:10308
- C:\Windows\System\RRPEQJe.exe
  C:\Windows\System\RRPEQJe.exe
  2⤵
  PID:10356
- C:\Windows\System\VUoaBUd.exe
  C:\Windows\System\VUoaBUd.exe
  2⤵
  PID:10384
- C:\Windows\System\BUqOUjj.exe
  C:\Windows\System\BUqOUjj.exe
  2⤵
  PID:10404
- C:\Windows\System\HuZLydV.exe
  C:\Windows\System\HuZLydV.exe
  2⤵
  PID:10440
- C:\Windows\System\xsKgRHg.exe
  C:\Windows\System\xsKgRHg.exe
  2⤵
  PID:10480
- C:\Windows\System\oKbkmXK.exe
  C:\Windows\System\oKbkmXK.exe
  2⤵
  PID:10500
- C:\Windows\System\KuvibpB.exe
  C:\Windows\System\KuvibpB.exe
  2⤵
  PID:10524
- C:\Windows\System\VtWTxYY.exe
  C:\Windows\System\VtWTxYY.exe
  2⤵
  PID:10548
- C:\Windows\System\cJTBoxa.exe
  C:\Windows\System\cJTBoxa.exe
  2⤵
  PID:10572
- C:\Windows\System\tnwMyIr.exe
  C:\Windows\System\tnwMyIr.exe
  2⤵
  PID:10596
- C:\Windows\System\naWncRj.exe
  C:\Windows\System\naWncRj.exe
  2⤵
  PID:10632
- C:\Windows\System\yMqZKNs.exe
  C:\Windows\System\yMqZKNs.exe
  2⤵
  PID:10672
- C:\Windows\System\ZAdGCaF.exe
  C:\Windows\System\ZAdGCaF.exe
  2⤵
  PID:10696
- C:\Windows\System\XWkxADa.exe
  C:\Windows\System\XWkxADa.exe
  2⤵
  PID:10716
- C:\Windows\System\eCHSjFG.exe
  C:\Windows\System\eCHSjFG.exe
  2⤵
  PID:10736
- C:\Windows\System\LNlQxgr.exe
  C:\Windows\System\LNlQxgr.exe
  2⤵
  PID:10760
- C:\Windows\System\WjeScDF.exe
  C:\Windows\System\WjeScDF.exe
  2⤵
  PID:10780
- C:\Windows\System\UcwlDeT.exe
  C:\Windows\System\UcwlDeT.exe
  2⤵
  PID:10800
- C:\Windows\System\RllXfBO.exe
  C:\Windows\System\RllXfBO.exe
  2⤵
  PID:10824
- C:\Windows\System\qUQjVFI.exe
  C:\Windows\System\qUQjVFI.exe
  2⤵
  PID:10856
- C:\Windows\System\lcVbLtR.exe
  C:\Windows\System\lcVbLtR.exe
  2⤵
  PID:10884
- C:\Windows\System\ENjYWWK.exe
  C:\Windows\System\ENjYWWK.exe
  2⤵
  PID:10920
- C:\Windows\System\sLMzPDX.exe
  C:\Windows\System\sLMzPDX.exe
  2⤵
  PID:10940
- C:\Windows\System\nhIryDk.exe
  C:\Windows\System\nhIryDk.exe
  2⤵
  PID:10996
- C:\Windows\System\JcUECoc.exe
  C:\Windows\System\JcUECoc.exe
  2⤵
  PID:11032
- C:\Windows\System\BTyKfJm.exe
  C:\Windows\System\BTyKfJm.exe
  2⤵
  PID:11056
- C:\Windows\System\WPSaUXC.exe
  C:\Windows\System\WPSaUXC.exe
  2⤵
  PID:11100
- C:\Windows\System\dTpyFEY.exe
  C:\Windows\System\dTpyFEY.exe
  2⤵
  PID:11120
- C:\Windows\System\TfrdPow.exe
  C:\Windows\System\TfrdPow.exe
  2⤵
  PID:11148
- C:\Windows\System\TOKxjgw.exe
  C:\Windows\System\TOKxjgw.exe
  2⤵
  PID:11172
- C:\Windows\System\LrOrySZ.exe
  C:\Windows\System\LrOrySZ.exe
  2⤵
  PID:11200
- C:\Windows\System\tdRGXiE.exe
  C:\Windows\System\tdRGXiE.exe
  2⤵
  PID:11228
- C:\Windows\System\ktBmLHB.exe
  C:\Windows\System\ktBmLHB.exe
  2⤵
  PID:9480
- C:\Windows\System\gqCGnNb.exe
  C:\Windows\System\gqCGnNb.exe
  2⤵
  PID:10172
- C:\Windows\System\EBmwBDQ.exe
  C:\Windows\System\EBmwBDQ.exe
  2⤵
  PID:10264
- C:\Windows\System\gCUIEfc.exe
  C:\Windows\System\gCUIEfc.exe
  2⤵
  PID:10368
- C:\Windows\System\BMVPQiK.exe
  C:\Windows\System\BMVPQiK.exe
  2⤵
  PID:10460
- C:\Windows\System\KNFYbQk.exe
  C:\Windows\System\KNFYbQk.exe
  2⤵
  PID:10516
- C:\Windows\System\ZrgcwxA.exe
  C:\Windows\System\ZrgcwxA.exe
  2⤵
  PID:10544
- C:\Windows\System\ekHWkAl.exe
  C:\Windows\System\ekHWkAl.exe
  2⤵
  PID:10592
- C:\Windows\System\jCUndvF.exe
  C:\Windows\System\jCUndvF.exe
  2⤵
  PID:10664
- C:\Windows\System\gArmbyr.exe
  C:\Windows\System\gArmbyr.exe
  2⤵
  PID:10724
- C:\Windows\System\VhtGfPW.exe
  C:\Windows\System\VhtGfPW.exe
  2⤵
  PID:10776
- C:\Windows\System\VUpuFsz.exe
  C:\Windows\System\VUpuFsz.exe
  2⤵
  PID:10844
- C:\Windows\System\EiyuXah.exe
  C:\Windows\System\EiyuXah.exe
  2⤵
  PID:10888
- C:\Windows\System\xWLnIxo.exe
  C:\Windows\System\xWLnIxo.exe
  2⤵
  PID:10992
- C:\Windows\System\uvGJuXh.exe
  C:\Windows\System\uvGJuXh.exe
  2⤵
  PID:11080
- C:\Windows\System\pgwMdyA.exe
  C:\Windows\System\pgwMdyA.exe
  2⤵
  PID:11188
- C:\Windows\System\PsjtPtf.exe
  C:\Windows\System\PsjtPtf.exe
  2⤵
  PID:9984
- C:\Windows\System\mBydbFA.exe
  C:\Windows\System\mBydbFA.exe
  2⤵
  PID:10200
- C:\Windows\System\CZBwgAh.exe
  C:\Windows\System\CZBwgAh.exe
  2⤵
  PID:10436
- C:\Windows\System\wpEIFtb.exe
  C:\Windows\System\wpEIFtb.exe
  2⤵
  PID:10536
- C:\Windows\System\qhSYmxP.exe
  C:\Windows\System\qhSYmxP.exe
  2⤵
  PID:10820
- C:\Windows\System\bbyelaE.exe
  C:\Windows\System\bbyelaE.exe
  2⤵
  PID:10868
- C:\Windows\System\bASCQkb.exe
  C:\Windows\System\bASCQkb.exe
  2⤵
  PID:11020
- C:\Windows\System\pRYwgbM.exe
  C:\Windows\System\pRYwgbM.exe
  2⤵
  PID:11192
- C:\Windows\System\PvfGLUf.exe
  C:\Windows\System\PvfGLUf.exe
  2⤵
  PID:10280
- C:\Windows\System\TQkgSDP.exe
  C:\Windows\System\TQkgSDP.exe
  2⤵
  PID:10584
- C:\Windows\System\ahOcOpy.exe
  C:\Windows\System\ahOcOpy.exe
  2⤵
  PID:10876
- C:\Windows\System\XjOArDx.exe
  C:\Windows\System\XjOArDx.exe
  2⤵
  PID:10936
- C:\Windows\System\DuYzXAM.exe
  C:\Windows\System\DuYzXAM.exe
  2⤵
  PID:10400
- C:\Windows\System\SPCUNIP.exe
  C:\Windows\System\SPCUNIP.exe
  2⤵
  PID:11288
- C:\Windows\System\DHYzJPC.exe
  C:\Windows\System\DHYzJPC.exe
  2⤵
  PID:11312
- C:\Windows\System\wJzedJE.exe
  C:\Windows\System\wJzedJE.exe
  2⤵
  PID:11364
- C:\Windows\System\oxfzNlw.exe
  C:\Windows\System\oxfzNlw.exe
  2⤵
  PID:11380
- C:\Windows\System\pHtYbxo.exe
  C:\Windows\System\pHtYbxo.exe
  2⤵
  PID:11448
- C:\Windows\System\NcSFMDa.exe
  C:\Windows\System\NcSFMDa.exe
  2⤵
  PID:11468
- C:\Windows\System\uDYNtLw.exe
  C:\Windows\System\uDYNtLw.exe
  2⤵
  PID:11488
- C:\Windows\System\dVEBfnc.exe
  C:\Windows\System\dVEBfnc.exe
  2⤵
  PID:11508
- C:\Windows\System\OzGWdjv.exe
  C:\Windows\System\OzGWdjv.exe
  2⤵
  PID:11532
- C:\Windows\System\oWpqDAe.exe
  C:\Windows\System\oWpqDAe.exe
  2⤵
  PID:11568
- C:\Windows\System\ljBTsQH.exe
  C:\Windows\System\ljBTsQH.exe
  2⤵
  PID:11600
- C:\Windows\System\FuYSQVh.exe
  C:\Windows\System\FuYSQVh.exe
  2⤵
  PID:11620
- C:\Windows\System\olQbghs.exe
  C:\Windows\System\olQbghs.exe
  2⤵
  PID:11636
- C:\Windows\System\rzUcGek.exe
  C:\Windows\System\rzUcGek.exe
  2⤵
  PID:11684
- C:\Windows\System\VIYDHnt.exe
  C:\Windows\System\VIYDHnt.exe
  2⤵
  PID:11716
- C:\Windows\System\doitwxP.exe
  C:\Windows\System\doitwxP.exe
  2⤵
  PID:11732
- C:\Windows\System\ZlZXhys.exe
  C:\Windows\System\ZlZXhys.exe
  2⤵
  PID:11752
- C:\Windows\System\oLwjYxR.exe
  C:\Windows\System\oLwjYxR.exe
  2⤵
  PID:11780
- C:\Windows\System\vVsChup.exe
  C:\Windows\System\vVsChup.exe
  2⤵
  PID:11820
- C:\Windows\System\HyyQuNh.exe
  C:\Windows\System\HyyQuNh.exe
  2⤵
  PID:11840
- C:\Windows\System\eanediS.exe
  C:\Windows\System\eanediS.exe
  2⤵
  PID:11860
- C:\Windows\System\dlhdqVg.exe
  C:\Windows\System\dlhdqVg.exe
  2⤵
  PID:11876
- C:\Windows\System\RZzIDjp.exe
  C:\Windows\System\RZzIDjp.exe
  2⤵
  PID:11912
- C:\Windows\System\fAsqhFs.exe
  C:\Windows\System\fAsqhFs.exe
  2⤵
  PID:11960
- C:\Windows\System\yZuInNp.exe
  C:\Windows\System\yZuInNp.exe
  2⤵
  PID:11984
- C:\Windows\System\gZjRjpU.exe
  C:\Windows\System\gZjRjpU.exe
  2⤵
  PID:12008
- C:\Windows\System\DlAmJeT.exe
  C:\Windows\System\DlAmJeT.exe
  2⤵
  PID:12056
- C:\Windows\System\dLQuXpe.exe
  C:\Windows\System\dLQuXpe.exe
  2⤵
  PID:12080
- C:\Windows\System\qfBIaHk.exe
  C:\Windows\System\qfBIaHk.exe
  2⤵
  PID:12096
- C:\Windows\System\oRpbRNX.exe
  C:\Windows\System\oRpbRNX.exe
  2⤵
  PID:12128
- C:\Windows\System\bltjahO.exe
  C:\Windows\System\bltjahO.exe
  2⤵
  PID:12148
- C:\Windows\System\TREWoad.exe
  C:\Windows\System\TREWoad.exe
  2⤵
  PID:12180
- C:\Windows\System\GpHjvIa.exe
  C:\Windows\System\GpHjvIa.exe
  2⤵
  PID:12204
- C:\Windows\System\bgebXLZ.exe
  C:\Windows\System\bgebXLZ.exe
  2⤵
  PID:12228
- C:\Windows\System\JOksBux.exe
  C:\Windows\System\JOksBux.exe
  2⤵
  PID:12252
- C:\Windows\System\XuiAJHN.exe
  C:\Windows\System\XuiAJHN.exe
  2⤵
  PID:11272
- C:\Windows\System\NtxcvbE.exe
  C:\Windows\System\NtxcvbE.exe
  2⤵
  PID:10376
- C:\Windows\System\qaovdyj.exe
  C:\Windows\System\qaovdyj.exe
  2⤵
  PID:11356
- C:\Windows\System\BFZiGEC.exe
  C:\Windows\System\BFZiGEC.exe
  2⤵
  PID:11408
- C:\Windows\System\nutHnkY.exe
  C:\Windows\System\nutHnkY.exe
  2⤵
  PID:11456
- C:\Windows\System\sqtAUxD.exe
  C:\Windows\System\sqtAUxD.exe
  2⤵
  PID:11504
- C:\Windows\System\wTXPVtH.exe
  C:\Windows\System\wTXPVtH.exe
  2⤵
  PID:11584
- C:\Windows\System\CtCnIoB.exe
  C:\Windows\System\CtCnIoB.exe
  2⤵
  PID:11628
- C:\Windows\System\PoEIJli.exe
  C:\Windows\System\PoEIJli.exe
  2⤵
  PID:11724
- C:\Windows\System\lebipHM.exe
  C:\Windows\System\lebipHM.exe
  2⤵
  PID:11832
- C:\Windows\System\FpnVKdw.exe
  C:\Windows\System\FpnVKdw.exe
  2⤵
  PID:11956
- C:\Windows\System\lkTTGKt.exe
  C:\Windows\System\lkTTGKt.exe
  2⤵
  PID:11952
- C:\Windows\System\OwHLltQ.exe
  C:\Windows\System\OwHLltQ.exe
  2⤵
  PID:11980
- C:\Windows\System\RAjSwHG.exe
  C:\Windows\System\RAjSwHG.exe
  2⤵
  PID:12040
- C:\Windows\System\HXkEqTh.exe
  C:\Windows\System\HXkEqTh.exe
  2⤵
  PID:12136
- C:\Windows\System\esRRnmh.exe
  C:\Windows\System\esRRnmh.exe
  2⤵
  PID:12192
- C:\Windows\System\RLMdygk.exe
  C:\Windows\System\RLMdygk.exe
  2⤵
  PID:10756
- C:\Windows\System\UcPlHgy.exe
  C:\Windows\System\UcPlHgy.exe
  2⤵
  PID:11372
- C:\Windows\System\NerizcL.exe
  C:\Windows\System\NerizcL.exe
  2⤵
  PID:11556
- C:\Windows\System\ZjeCWuQ.exe
  C:\Windows\System\ZjeCWuQ.exe
  2⤵
  PID:11704
- C:\Windows\System\peTXinB.exe
  C:\Windows\System\peTXinB.exe
  2⤵
  PID:11848
- C:\Windows\System\MOFgTOE.exe
  C:\Windows\System\MOFgTOE.exe
  2⤵
  PID:12000
- C:\Windows\System\bLHkqUa.exe
  C:\Windows\System\bLHkqUa.exe
  2⤵
  PID:12160
- C:\Windows\System\xYokPKc.exe
  C:\Windows\System\xYokPKc.exe
  2⤵
  PID:11212
- C:\Windows\System\QDGZHsG.exe
  C:\Windows\System\QDGZHsG.exe
  2⤵
  PID:11656
- C:\Windows\System\oWakABS.exe
  C:\Windows\System\oWakABS.exe
  2⤵
  PID:11892
- C:\Windows\System\DqKrFcY.exe
  C:\Windows\System\DqKrFcY.exe
  2⤵
  PID:11336
- C:\Windows\System\uqvvuVY.exe
  C:\Windows\System\uqvvuVY.exe
  2⤵
  PID:11616
- C:\Windows\System\WixdAOy.exe
  C:\Windows\System\WixdAOy.exe
  2⤵
  PID:12072
- C:\Windows\System\GJSqkeU.exe
  C:\Windows\System\GJSqkeU.exe
  2⤵
  PID:12308
- C:\Windows\System\afwZLkr.exe
  C:\Windows\System\afwZLkr.exe
  2⤵
  PID:12348
- C:\Windows\System\QXYvabH.exe
  C:\Windows\System\QXYvabH.exe
  2⤵
  PID:12384
- C:\Windows\System\LypnnZl.exe
  C:\Windows\System\LypnnZl.exe
  2⤵
  PID:12428
- C:\Windows\System\HPGNOlo.exe
  C:\Windows\System\HPGNOlo.exe
  2⤵
  PID:12448
- C:\Windows\System\GYOgzxt.exe
  C:\Windows\System\GYOgzxt.exe
  2⤵
  PID:12488
- C:\Windows\System\xfskGCV.exe
  C:\Windows\System\xfskGCV.exe
  2⤵
  PID:12504
- C:\Windows\System\fnkEVet.exe
  C:\Windows\System\fnkEVet.exe
  2⤵
  PID:12536
- C:\Windows\System\AnCAzhP.exe
  C:\Windows\System\AnCAzhP.exe
  2⤵
  PID:12552
- C:\Windows\System\EuCNHmj.exe
  C:\Windows\System\EuCNHmj.exe
  2⤵
  PID:12580
- C:\Windows\System\MmYiIUc.exe
  C:\Windows\System\MmYiIUc.exe
  2⤵
  PID:12620
- C:\Windows\System\PibQjpe.exe
  C:\Windows\System\PibQjpe.exe
  2⤵
  PID:12636
- C:\Windows\System\dWvzeqJ.exe
  C:\Windows\System\dWvzeqJ.exe
  2⤵
  PID:12676
- C:\Windows\System\nbmNZYM.exe
  C:\Windows\System\nbmNZYM.exe
  2⤵
  PID:12716
- C:\Windows\System\toanNWQ.exe
  C:\Windows\System\toanNWQ.exe
  2⤵
  PID:12732
- C:\Windows\System\CFuvekq.exe
  C:\Windows\System\CFuvekq.exe
  2⤵
  PID:12748
- C:\Windows\System\opomwXa.exe
  C:\Windows\System\opomwXa.exe
  2⤵
  PID:12792
- C:\Windows\System\vRpXYgd.exe
  C:\Windows\System\vRpXYgd.exe
  2⤵
  PID:12816
- C:\Windows\System\lVWiZkZ.exe
  C:\Windows\System\lVWiZkZ.exe
  2⤵
  PID:12844
- C:\Windows\System\hCvXWCI.exe
  C:\Windows\System\hCvXWCI.exe
  2⤵
  PID:12872
- C:\Windows\System\NJCZvyb.exe
  C:\Windows\System\NJCZvyb.exe
  2⤵
  PID:12892
- C:\Windows\System\yFXTPfa.exe
  C:\Windows\System\yFXTPfa.exe
  2⤵
  PID:12916
- C:\Windows\System\NlkGOoZ.exe
  C:\Windows\System\NlkGOoZ.exe
  2⤵
  PID:12940
- C:\Windows\System\XmrgLga.exe
  C:\Windows\System\XmrgLga.exe
  2⤵
  PID:12968
- C:\Windows\System\LMZQyeX.exe
  C:\Windows\System\LMZQyeX.exe
  2⤵
  PID:13012
- C:\Windows\System\thiCbHJ.exe
  C:\Windows\System\thiCbHJ.exe
  2⤵
  PID:13032
- C:\Windows\System\yXnajtT.exe
  C:\Windows\System\yXnajtT.exe
  2⤵
  PID:13056
- C:\Windows\System\BtVUDEs.exe
  C:\Windows\System\BtVUDEs.exe
  2⤵
  PID:13072
- C:\Windows\System\JzncxZz.exe
  C:\Windows\System\JzncxZz.exe
  2⤵
  PID:13092
- C:\Windows\System\JqtMoBb.exe
  C:\Windows\System\JqtMoBb.exe
  2⤵
  PID:13120
- C:\Windows\System\iMTIyLn.exe
  C:\Windows\System\iMTIyLn.exe
  2⤵
  PID:13144
- C:\Windows\System\VNdheMo.exe
  C:\Windows\System\VNdheMo.exe
  2⤵
  PID:13168
- C:\Windows\System\YxqdQBm.exe
  C:\Windows\System\YxqdQBm.exe
  2⤵
  PID:13192
- C:\Windows\System\ZHtzpET.exe
  C:\Windows\System\ZHtzpET.exe
  2⤵
  PID:13212
- C:\Windows\System\CcKJztn.exe
  C:\Windows\System\CcKJztn.exe
  2⤵
  PID:13248
- C:\Windows\System\WqMatIL.exe
  C:\Windows\System\WqMatIL.exe
  2⤵
  PID:13268
- C:\Windows\System\BqbEPZj.exe
  C:\Windows\System\BqbEPZj.exe
  2⤵
  PID:13296
- C:\Windows\System\dUgyvmh.exe
  C:\Windows\System\dUgyvmh.exe
  2⤵
  PID:12296
- C:\Windows\System\zXAxuiU.exe
  C:\Windows\System\zXAxuiU.exe
  2⤵
  PID:12480
- C:\Windows\System\iNLFHeL.exe
  C:\Windows\System\iNLFHeL.exe
  2⤵
  PID:12516
- C:\Windows\System\mOFZrjR.exe
  C:\Windows\System\mOFZrjR.exe
  2⤵
  PID:12588
- C:\Windows\System\BkOJXdX.exe
  C:\Windows\System\BkOJXdX.exe
  2⤵
  PID:12672
- C:\Windows\System\fDUzTcP.exe
  C:\Windows\System\fDUzTcP.exe
  2⤵
  PID:12708
- C:\Windows\System\HLFCfdD.exe
  C:\Windows\System\HLFCfdD.exe
  2⤵
  PID:12800
- C:\Windows\System\NBBgXcL.exe
  C:\Windows\System\NBBgXcL.exe
  2⤵
  PID:12812
- C:\Windows\System\yBGcToO.exe
  C:\Windows\System\yBGcToO.exe
  2⤵
  PID:12888
- C:\Windows\System\VnKViSt.exe
  C:\Windows\System\VnKViSt.exe
  2⤵
  PID:12948
- C:\Windows\System\fkeavrI.exe
  C:\Windows\System\fkeavrI.exe
  2⤵
  PID:13008
- C:\Windows\System\qJkVSyY.exe
  C:\Windows\System\qJkVSyY.exe
  2⤵
  PID:13044
- C:\Windows\System\acoJveq.exe
  C:\Windows\System\acoJveq.exe
  2⤵
  PID:13152
- C:\Windows\System\JdEMGxs.exe
  C:\Windows\System\JdEMGxs.exe
  2⤵
  PID:13180
- C:\Windows\System\TiVRfZd.exe
  C:\Windows\System\TiVRfZd.exe
  2⤵
  PID:13228
- C:\Windows\System\BIjcbVR.exe
  C:\Windows\System\BIjcbVR.exe
  2⤵
  PID:13284
- C:\Windows\System\ckfUvIg.exe
  C:\Windows\System\ckfUvIg.exe
  2⤵
  PID:12416
- C:\Windows\System\PlVYkRo.exe
  C:\Windows\System\PlVYkRo.exe
  2⤵
  PID:12744
- C:\Windows\System\esToOQt.exe
  C:\Windows\System\esToOQt.exe
  2⤵
  PID:12904
- C:\Windows\System\xRNLHHo.exe
  C:\Windows\System\xRNLHHo.exe
  2⤵
  PID:13028
- C:\Windows\System\ywYUQQC.exe
  C:\Windows\System\ywYUQQC.exe
  2⤵
  PID:13188
- C:\Windows\System\zordKxI.exe
  C:\Windows\System\zordKxI.exe
  2⤵
  PID:13220
- C:\Windows\System\GvxoyOT.exe
  C:\Windows\System\GvxoyOT.exe
  2⤵
  PID:12392
- C:\Windows\System\aawZzqu.exe
  C:\Windows\System\aawZzqu.exe
  2⤵
  PID:12788
- C:\Windows\System\hLWjpgu.exe
  C:\Windows\System\hLWjpgu.exe
  2⤵
  PID:13208
- C:\Windows\System\oElnvwP.exe
  C:\Windows\System\oElnvwP.exe
  2⤵
  PID:11596
- C:\Windows\System\XNhmNsN.exe
  C:\Windows\System\XNhmNsN.exe
  2⤵
  PID:13356
- C:\Windows\System\fCropSQ.exe
  C:\Windows\System\fCropSQ.exe
  2⤵
  PID:13380
- C:\Windows\System\zAfphZp.exe
  C:\Windows\System\zAfphZp.exe
  2⤵
  PID:13400
- C:\Windows\System\HaTTGwc.exe
  C:\Windows\System\HaTTGwc.exe
  2⤵
  PID:13424
- C:\Windows\System\GGkUUox.exe
  C:\Windows\System\GGkUUox.exe
  2⤵
  PID:13448
- C:\Windows\System\nslYEdd.exe
  C:\Windows\System\nslYEdd.exe
  2⤵
  PID:13472
- C:\Windows\System\fPEDUEz.exe
  C:\Windows\System\fPEDUEz.exe
  2⤵
  PID:13508
- C:\Windows\System\xTNbBAS.exe
  C:\Windows\System\xTNbBAS.exe
  2⤵
  PID:13528
- C:\Windows\System\sLQqXCT.exe
  C:\Windows\System\sLQqXCT.exe
  2⤵
  PID:13568
- C:\Windows\System\CmTfXUH.exe
  C:\Windows\System\CmTfXUH.exe
  2⤵
  PID:13588
- C:\Windows\System\PVaOfTS.exe
  C:\Windows\System\PVaOfTS.exe
  2⤵
  PID:13608
- C:\Windows\System\cHakDzS.exe
  C:\Windows\System\cHakDzS.exe
  2⤵
  PID:13640
- C:\Windows\System\xKPiAIC.exe
  C:\Windows\System\xKPiAIC.exe
  2⤵
  PID:13660
- C:\Windows\System\PwyvEiV.exe
  C:\Windows\System\PwyvEiV.exe
  2⤵
  PID:13680
- C:\Windows\System\cbqTfEn.exe
  C:\Windows\System\cbqTfEn.exe
  2⤵
  PID:13728
- C:\Windows\System\pniLOzO.exe
  C:\Windows\System\pniLOzO.exe
  2⤵
  PID:13756
- C:\Windows\System\ZYNzciG.exe
  C:\Windows\System\ZYNzciG.exe
  2⤵
  PID:13772
- C:\Windows\System\GwremZj.exe
  C:\Windows\System\GwremZj.exe
  2⤵
  PID:13836
- C:\Windows\System\VRYVdAD.exe
  C:\Windows\System\VRYVdAD.exe
  2⤵
  PID:13852
- C:\Windows\System\BoDphZS.exe
  C:\Windows\System\BoDphZS.exe
  2⤵
  PID:13880
- C:\Windows\System\IVleBvS.exe
  C:\Windows\System\IVleBvS.exe
  2⤵
  PID:13920
- C:\Windows\System\vaDXtiw.exe
  C:\Windows\System\vaDXtiw.exe
  2⤵
  PID:13936
- C:\Windows\System\TotCKXa.exe
  C:\Windows\System\TotCKXa.exe
  2⤵
  PID:13968
- C:\Windows\System\IJRQgRd.exe
  C:\Windows\System\IJRQgRd.exe
  2⤵
  PID:13988
- C:\Windows\System\NFVpdzo.exe
  C:\Windows\System\NFVpdzo.exe
  2⤵
  PID:14004
- C:\Windows\System\EKdtbZo.exe
  C:\Windows\System\EKdtbZo.exe
  2⤵
  PID:14032
- C:\Windows\System\dfkSqVw.exe
  C:\Windows\System\dfkSqVw.exe
  2⤵
  PID:14052
- C:\Windows\System\LLuNeTA.exe
  C:\Windows\System\LLuNeTA.exe
  2⤵
  PID:14104
- C:\Windows\System\ZnDMQVK.exe
  C:\Windows\System\ZnDMQVK.exe
  2⤵
  PID:14124
- C:\Windows\System\WqgPwCv.exe
  C:\Windows\System\WqgPwCv.exe
  2⤵
  PID:14148
- C:\Windows\System\zHSSaKR.exe
  C:\Windows\System\zHSSaKR.exe
  2⤵
  PID:14172
- C:\Windows\System\RKSeRjT.exe
  C:\Windows\System\RKSeRjT.exe
  2⤵
  PID:14216
- C:\Windows\System\ZuVrDFT.exe
  C:\Windows\System\ZuVrDFT.exe
  2⤵
  PID:14232
- C:\Windows\System\HQiIYgW.exe
  C:\Windows\System\HQiIYgW.exe
  2⤵
  PID:14256
- C:\Windows\System\lHUgfAm.exe
  C:\Windows\System\lHUgfAm.exe
  2⤵
  PID:14280
- C:\Windows\System\eAnJmEy.exe
  C:\Windows\System\eAnJmEy.exe
  2⤵
  PID:12984
- C:\Windows\System\yOAVnst.exe
  C:\Windows\System\yOAVnst.exe
  2⤵
  PID:12568
- C:\Windows\System\iVAjfjb.exe
  C:\Windows\System\iVAjfjb.exe
  2⤵
  PID:13368
- C:\Windows\System\gBEGSYn.exe
  C:\Windows\System\gBEGSYn.exe
  2⤵
  PID:13436
- C:\Windows\System\cYUgovw.exe
  C:\Windows\System\cYUgovw.exe
  2⤵
  PID:13504
- C:\Windows\System\kVkacbI.exe
  C:\Windows\System\kVkacbI.exe
  2⤵
  PID:13520
- C:\Windows\System\pJzeEjm.exe
  C:\Windows\System\pJzeEjm.exe
  2⤵
  PID:13596
- C:\Windows\System\VcvlNgQ.exe
  C:\Windows\System\VcvlNgQ.exe
  2⤵
  PID:13692
- C:\Windows\System\XGZmTXJ.exe
  C:\Windows\System\XGZmTXJ.exe
  2⤵
  PID:13784
- C:\Windows\System\WMLojWT.exe
  C:\Windows\System\WMLojWT.exe
  2⤵
  PID:13808
- C:\Windows\System\rqHVJUP.exe
  C:\Windows\System\rqHVJUP.exe
  2⤵
  PID:13876
- C:\Windows\System\KJXciNe.exe
  C:\Windows\System\KJXciNe.exe
  2⤵
  PID:13976
- C:\Windows\System\tuObMUh.exe
  C:\Windows\System\tuObMUh.exe
  2⤵
  PID:14000
- C:\Windows\System\mytgCOR.exe
  C:\Windows\System\mytgCOR.exe
  2⤵
  PID:14084
- C:\Windows\System\yiCJPok.exe
  C:\Windows\System\yiCJPok.exe
  2⤵
  PID:14184
- C:\Windows\System\mSrcwhM.exe
  C:\Windows\System\mSrcwhM.exe
  2⤵
  PID:14268
- C:\Windows\System\GNbGYQH.exe
  C:\Windows\System\GNbGYQH.exe
  2⤵
  PID:14240
- C:\Windows\System\SdYfbwo.exe
  C:\Windows\System\SdYfbwo.exe
  2⤵
  PID:13376
- C:\Windows\System\UmuKgjV.exe
  C:\Windows\System\UmuKgjV.exe
  2⤵
  PID:13372
- C:\Windows\System\nNgLpDU.exe
  C:\Windows\System\nNgLpDU.exe
  2⤵
  PID:13676
- C:\Windows\System\hbhelZb.exe
  C:\Windows\System\hbhelZb.exe
  2⤵
  PID:13716
- C:\Windows\System\xIHXfdG.exe
  C:\Windows\System\xIHXfdG.exe
  2⤵
  PID:13872
- C:\Windows\System\DUCOefT.exe
  C:\Windows\System\DUCOefT.exe
  2⤵
  PID:14200
- C:\Windows\System\TfbEaLo.exe
  C:\Windows\System\TfbEaLo.exe
  2⤵
  PID:13432
- C:\Windows\System\buRGILW.exe
  C:\Windows\System\buRGILW.exe
  2⤵
  PID:13584
- C:\Windows\System\kniDyuo.exe
  C:\Windows\System\kniDyuo.exe
  2⤵
  PID:13740
- C:\Windows\System\OPgenwn.exe
  C:\Windows\System\OPgenwn.exe
  2⤵
  PID:14180
- C:\Windows\System\fEUnrDS.exe
  C:\Windows\System\fEUnrDS.exe
  2⤵
  PID:14308
- C:\Windows\System\nxtbuBs.exe
  C:\Windows\System\nxtbuBs.exe
  2⤵
  PID:14348
- C:\Windows\System\aZgRDZp.exe
  C:\Windows\System\aZgRDZp.exe
  2⤵
  PID:14368
- C:\Windows\System\buWvgoo.exe
  C:\Windows\System\buWvgoo.exe
  2⤵
  PID:14388
- C:\Windows\System\bLFkOtd.exe
  C:\Windows\System\bLFkOtd.exe
  2⤵
  PID:14416
- C:\Windows\System\DeGWTxx.exe
  C:\Windows\System\DeGWTxx.exe
  2⤵
  PID:14440
- C:\Windows\System\hSEWsMI.exe
  C:\Windows\System\hSEWsMI.exe
  2⤵
  PID:14460
- C:\Windows\System\KjgaCkY.exe
  C:\Windows\System\KjgaCkY.exe
  2⤵
  PID:14508
- C:\Windows\System\IqYDrZI.exe
  C:\Windows\System\IqYDrZI.exe
  2⤵
  PID:14540
- C:\Windows\System\xyzeCTW.exe
  C:\Windows\System\xyzeCTW.exe
  2⤵
  PID:14572
- C:\Windows\System\bYHiBkK.exe
  C:\Windows\System\bYHiBkK.exe
  2⤵
  PID:14596
- C:\Windows\System\JKRGFYx.exe
  C:\Windows\System\JKRGFYx.exe
  2⤵
  PID:14624
- C:\Windows\System\vZhiDJC.exe
  C:\Windows\System\vZhiDJC.exe
  2⤵
  PID:14644
- C:\Windows\System\ThGcLPF.exe
  C:\Windows\System\ThGcLPF.exe
  2⤵
  PID:14668
- C:\Windows\System\DqzdsEa.exe
  C:\Windows\System\DqzdsEa.exe
  2⤵
  PID:14700
- C:\Windows\System\sMrdOmt.exe
  C:\Windows\System\sMrdOmt.exe
  2⤵
  PID:14732
- C:\Windows\System\xXjBzmp.exe
  C:\Windows\System\xXjBzmp.exe
  2⤵
  PID:14756
- C:\Windows\System\hNqrsBM.exe
  C:\Windows\System\hNqrsBM.exe
  2⤵
  PID:14800
- C:\Windows\System\rsTSPgb.exe
  C:\Windows\System\rsTSPgb.exe
  2⤵
  PID:14836
- C:\Windows\System\VCMyttT.exe
  C:\Windows\System\VCMyttT.exe
  2⤵
  PID:14852
- C:\Windows\System\VzryeXK.exe
  C:\Windows\System\VzryeXK.exe
  2⤵
  PID:14892
- C:\Windows\System\PoUyKur.exe
  C:\Windows\System\PoUyKur.exe
  2⤵
  PID:14908
- C:\Windows\System\OgZRuXf.exe
  C:\Windows\System\OgZRuXf.exe
  2⤵
  PID:14936
- C:\Windows\System\PNgEDVz.exe
  C:\Windows\System\PNgEDVz.exe
  2⤵
  PID:14972
- C:\Windows\System\guENAUO.exe
  C:\Windows\System\guENAUO.exe
  2⤵
  PID:15000
- C:\Windows\System\UUTrgBb.exe
  C:\Windows\System\UUTrgBb.exe
  2⤵
  PID:15024
- C:\Windows\System\NWlQbOD.exe
  C:\Windows\System\NWlQbOD.exe
  2⤵
  PID:15044
- C:\Windows\System\xVznXZI.exe
  C:\Windows\System\xVznXZI.exe
  2⤵
  PID:15076
- C:\Windows\System\PzpdrmY.exe
  C:\Windows\System\PzpdrmY.exe
  2⤵
  PID:15096
- C:\Windows\System\jIrbhtW.exe
  C:\Windows\System\jIrbhtW.exe
  2⤵
  PID:15120
- C:\Windows\System\lwOckja.exe
  C:\Windows\System\lwOckja.exe
  2⤵
  PID:15148
- C:\Windows\System\iSEJDTt.exe
  C:\Windows\System\iSEJDTt.exe
  2⤵
  PID:15172
- C:\Windows\System\wzMlFKf.exe
  C:\Windows\System\wzMlFKf.exe
  2⤵
  PID:15208
- C:\Windows\System\ETmhtxq.exe
  C:\Windows\System\ETmhtxq.exe
  2⤵
  PID:15228
- C:\Windows\System\bhwcNSE.exe
  C:\Windows\System\bhwcNSE.exe
  2⤵
  PID:15284
- C:\Windows\System\hyXTeVp.exe
  C:\Windows\System\hyXTeVp.exe
  2⤵
  PID:15300
- C:\Windows\System\glZdQoi.exe
  C:\Windows\System\glZdQoi.exe
  2⤵
  PID:15320
- C:\Windows\System\DtvScjS.exe
  C:\Windows\System\DtvScjS.exe
  2⤵
  PID:15348
- C:\Windows\System\RaMhPwu.exe
  C:\Windows\System\RaMhPwu.exe
  2⤵
  PID:13724
- C:\Windows\System\SxJcAQs.exe
  C:\Windows\System\SxJcAQs.exe
  2⤵
  PID:14356
- C:\Windows\System\XtmLcoD.exe
  C:\Windows\System\XtmLcoD.exe
  2⤵
  PID:14412
- C:\Windows\System\qRIhYUH.exe
  C:\Windows\System\qRIhYUH.exe
  2⤵
  PID:14588
- C:\Windows\System\skVyEbR.exe
  C:\Windows\System\skVyEbR.exe
  2⤵
  PID:14616
- C:\Windows\System\vweELUW.exe
  C:\Windows\System\vweELUW.exe
  2⤵
  PID:14664
- C:\Windows\System\ipsUQDO.exe
  C:\Windows\System\ipsUQDO.exe
  2⤵
  PID:14720
- C:\Windows\System\owNsbSk.exe
  C:\Windows\System\owNsbSk.exe
  2⤵
  PID:14832
- C:\Windows\System\jWHzVVe.exe
  C:\Windows\System\jWHzVVe.exe
  2⤵
  PID:14924
- C:\Windows\System\rxsMPsj.exe
  C:\Windows\System\rxsMPsj.exe
  2⤵
  PID:14948
- C:\Windows\System\jIklHsG.exe
  C:\Windows\System\jIklHsG.exe
  2⤵
  PID:15008
- C:\Windows\System\xcPizHY.exe
  C:\Windows\System\xcPizHY.exe
  2⤵
  PID:15092
- C:\Windows\System\adLsAbP.exe
  C:\Windows\System\adLsAbP.exe
  2⤵
  PID:15140
- C:\Windows\System\XelmdPM.exe
  C:\Windows\System\XelmdPM.exe
  2⤵
  PID:15200
- C:\Windows\System\KPZCkEf.exe
  C:\Windows\System\KPZCkEf.exe
  2⤵
  PID:15260
- C:\Windows\System\xRtDXvT.exe
  C:\Windows\System\xRtDXvT.exe
  2⤵
  PID:15308
- C:\Windows\System\koIhRkf.exe
  C:\Windows\System\koIhRkf.exe
  2⤵
  PID:13620
- C:\Windows\System\JZwWogK.exe
  C:\Windows\System\JZwWogK.exe
  2⤵
  PID:14524
- C:\Windows\System\CpmfCPQ.exe
  C:\Windows\System\CpmfCPQ.exe
  2⤵
  PID:14696
- C:\Windows\System\WQGpEXR.exe
  C:\Windows\System\WQGpEXR.exe
  2⤵
  PID:14788
- C:\Windows\System\WeFiHWU.exe
  C:\Windows\System\WeFiHWU.exe
  2⤵
  PID:14928
- C:\Windows\System\wCcGmTM.exe
  C:\Windows\System\wCcGmTM.exe
  2⤵
  PID:15072
- C:\Windows\System\yHyNIiO.exe
  C:\Windows\System\yHyNIiO.exe
  2⤵
  PID:15244
- C:\Windows\System\FmyhPpx.exe
  C:\Windows\System\FmyhPpx.exe
  2⤵
  PID:14636
- C:\Windows\System\mCkIpfY.exe
  C:\Windows\System\mCkIpfY.exe
  2⤵
  PID:14876
- C:\Windows\System\lycViYh.exe
  C:\Windows\System\lycViYh.exe
  2⤵
  PID:14612
- C:\Windows\System\oArwYPl.exe
  C:\Windows\System\oArwYPl.exe
  2⤵
  PID:14780
- C:\Windows\System\ePdggbN.exe
  C:\Windows\System\ePdggbN.exe
  2⤵
  PID:15376
- C:\Windows\System\MOHrISW.exe
  C:\Windows\System\MOHrISW.exe
  2⤵
  PID:15400
- C:\Windows\System\UvRXdzq.exe
  C:\Windows\System\UvRXdzq.exe
  2⤵
  PID:15432
- C:\Windows\System\YEuCwgZ.exe
  C:\Windows\System\YEuCwgZ.exe
  2⤵
  PID:15472
- C:\Windows\System\KILPLyU.exe
  C:\Windows\System\KILPLyU.exe
  2⤵
  PID:15492
- C:\Windows\System\FSpoRtb.exe
  C:\Windows\System\FSpoRtb.exe
  2⤵
  PID:15512
- C:\Windows\System\usePtvn.exe
  C:\Windows\System\usePtvn.exe
  2⤵
  PID:15536
- C:\Windows\System\VUYkIfE.exe
  C:\Windows\System\VUYkIfE.exe
  2⤵
  PID:15556
- C:\Windows\System\YxXXOvt.exe
  C:\Windows\System\YxXXOvt.exe
  2⤵
  PID:15580
- C:\Windows\System\vPNlsHy.exe
  C:\Windows\System\vPNlsHy.exe
  2⤵
  PID:15620
- C:\Windows\System\zxlTpXb.exe
  C:\Windows\System\zxlTpXb.exe
  2⤵
  PID:15640
- C:\Windows\System\uDEkHBj.exe
  C:\Windows\System\uDEkHBj.exe
  2⤵
  PID:15672
- C:\Windows\System\nuKDfNN.exe
  C:\Windows\System\nuKDfNN.exe
  2⤵
  PID:15712
- C:\Windows\System\ZNqcBZQ.exe
  C:\Windows\System\ZNqcBZQ.exe
  2⤵
  PID:15728
- C:\Windows\System\zJoOEGi.exe
  C:\Windows\System\zJoOEGi.exe
  2⤵
  PID:15744
- C:\Windows\System\tCxcBKm.exe
  C:\Windows\System\tCxcBKm.exe
  2⤵
  PID:15780
- C:\Windows\System\JrQsJxs.exe
  C:\Windows\System\JrQsJxs.exe
  2⤵
  PID:15796
- C:\Windows\System\faUcJeS.exe
  C:\Windows\System\faUcJeS.exe
  2⤵
  PID:15856
- C:\Windows\System\IVGXLby.exe
  C:\Windows\System\IVGXLby.exe
  2⤵
  PID:15880
- C:\Windows\System\nCdVzZZ.exe
  C:\Windows\System\nCdVzZZ.exe
  2⤵
  PID:15912
- C:\Windows\System\bmnqfDK.exe
  C:\Windows\System\bmnqfDK.exe
  2⤵
  PID:15948
- C:\Windows\System\oiJBVgX.exe
  C:\Windows\System\oiJBVgX.exe
  2⤵
  PID:15976
- C:\Windows\System\tNrfGQX.exe
  C:\Windows\System\tNrfGQX.exe
  2⤵
  PID:15996
- C:\Windows\System\JFZlnzR.exe
  C:\Windows\System\JFZlnzR.exe
  2⤵
  PID:16028
- C:\Windows\System\YXbyWhh.exe
  C:\Windows\System\YXbyWhh.exe
  2⤵
  PID:16048
- C:\Windows\System\nVlimYn.exe
  C:\Windows\System\nVlimYn.exe
  2⤵
  PID:16080
- C:\Windows\System\DPShkfn.exe
  C:\Windows\System\DPShkfn.exe
  2⤵
  PID:16108
- C:\Windows\System\nUNmHHa.exe
  C:\Windows\System\nUNmHHa.exe
  2⤵
  PID:16128
- C:\Windows\System\siAMUjW.exe
  C:\Windows\System\siAMUjW.exe
  2⤵
  PID:16144
- C:\Windows\System\hNqECgJ.exe
  C:\Windows\System\hNqECgJ.exe
  2⤵
  PID:16168
- C:\Windows\System\zoAlaUr.exe
  C:\Windows\System\zoAlaUr.exe
  2⤵
  PID:16192
- C:\Windows\System\qXwkzyA.exe
  C:\Windows\System\qXwkzyA.exe
  2⤵
  PID:16216
- C:\Windows\System\DETIjcJ.exe
  C:\Windows\System\DETIjcJ.exe
  2⤵
  PID:16296
- C:\Windows\System\UNWPSve.exe
  C:\Windows\System\UNWPSve.exe
  2⤵
  PID:16320
- C:\Windows\System\kIRTuzz.exe
  C:\Windows\System\kIRTuzz.exe
  2⤵
  PID:16372
- C:\Windows\System\dZaEqfL.exe
  C:\Windows\System\dZaEqfL.exe
  2⤵
  PID:15168
- C:\Windows\System\LoKjfxH.exe
  C:\Windows\System\LoKjfxH.exe
  2⤵
  PID:15368
- C:\Windows\System\kJKxhbu.exe
  C:\Windows\System\kJKxhbu.exe
  2⤵
  PID:15456
- C:\Windows\System\bOwMcVm.exe
  C:\Windows\System\bOwMcVm.exe
  2⤵
  PID:15424
- C:\Windows\System\GmZgUlL.exe
  C:\Windows\System\GmZgUlL.exe
  2⤵
  PID:15524
- C:\Windows\System\YqeVXMu.exe
  C:\Windows\System\YqeVXMu.exe
  2⤵
  PID:15520
- C:\Windows\System\mXVcMHQ.exe
  C:\Windows\System\mXVcMHQ.exe
  2⤵
  PID:15592
- C:\Windows\System\ejmWQDZ.exe
  C:\Windows\System\ejmWQDZ.exe
  2⤵
  PID:15756
- C:\Windows\System\KjQeuua.exe
  C:\Windows\System\KjQeuua.exe
  2⤵
  PID:15736
- C:\Windows\System\czxYPVR.exe
  C:\Windows\System\czxYPVR.exe
  2⤵
  PID:15836
- C:\Windows\System\vXnzSNY.exe
  C:\Windows\System\vXnzSNY.exe
  2⤵
  PID:15892
- C:\Windows\System\VhZahQZ.exe
  C:\Windows\System\VhZahQZ.exe
  2⤵
  PID:15972
- C:\Windows\System\cLHLGAp.exe
  C:\Windows\System\cLHLGAp.exe
  2⤵
  PID:16040
- C:\Windows\System\hmJaVbf.exe
  C:\Windows\System\hmJaVbf.exe
  2⤵
  PID:16140
- C:\Windows\System\JObHbNC.exe
  C:\Windows\System\JObHbNC.exe
  2⤵
  PID:16204
- C:\Windows\System\AGKDenb.exe
  C:\Windows\System\AGKDenb.exe
  2⤵
  PID:16304
- C:\Windows\System\DRzfFOg.exe
  C:\Windows\System\DRzfFOg.exe
  2⤵
  PID:16252
- C:\Windows\System\OASuaNB.exe
  C:\Windows\System\OASuaNB.exe
  2⤵
  PID:16328
- C:\Windows\System\KWlfJKR.exe
  C:\Windows\System\KWlfJKR.exe
  2⤵
  PID:3692
- C:\Windows\System\smdoZts.exe
  C:\Windows\System\smdoZts.exe
  2⤵
  PID:14984
- C:\Windows\System\tRtPEly.exe
  C:\Windows\System\tRtPEly.exe
  2⤵
  PID:15420
- C:\Windows\System\MNcpRTm.exe
  C:\Windows\System\MNcpRTm.exe
  2⤵
  PID:15544
- C:\Windows\System\htvHfer.exe
  C:\Windows\System\htvHfer.exe
  2⤵
  PID:15828
- C:\Windows\System\SfwXVeh.exe
  C:\Windows\System\SfwXVeh.exe
  2⤵
  PID:16152
- C:\Windows\System\LtnevMi.exe
  C:\Windows\System\LtnevMi.exe
  2⤵
  PID:16184
- C:\Windows\System\qgCLSjZ.exe
  C:\Windows\System\qgCLSjZ.exe
  2⤵
  PID:4512
- C:\Windows\System\wlWtGWb.exe
  C:\Windows\System\wlWtGWb.exe
  2⤵
  PID:4376
- C:\Windows\System\RLvXtBM.exe
  C:\Windows\System\RLvXtBM.exe
  2⤵
  PID:14888
- C:\Windows\System\aMvWKQE.exe
  C:\Windows\System\aMvWKQE.exe
  2⤵
  PID:15812
- C:\Windows\System\aMnKzsV.exe
  C:\Windows\System\aMnKzsV.exe
  2⤵
  PID:16316
- C:\Windows\System\bqNAyqU.exe
  C:\Windows\System\bqNAyqU.exe
  2⤵
  PID:16280
- C:\Windows\System\pbuYcos.exe
  C:\Windows\System\pbuYcos.exe
  2⤵
  PID:16404
- C:\Windows\System\ozKPLsr.exe
  C:\Windows\System\ozKPLsr.exe
  2⤵
  PID:16432
- C:\Windows\System\zIkHUCA.exe
  C:\Windows\System\zIkHUCA.exe
  2⤵
  PID:16456
- C:\Windows\System\gZPmwto.exe
  C:\Windows\System\gZPmwto.exe
  2⤵
  PID:16476
- C:\Windows\System\xbTyHKI.exe
  C:\Windows\System\xbTyHKI.exe
  2⤵
  PID:16500
- C:\Windows\System\eidObXI.exe
  C:\Windows\System\eidObXI.exe
  2⤵
  PID:16520
- C:\Windows\System\coLgLZX.exe
  C:\Windows\System\coLgLZX.exe
  2⤵
  PID:16540

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CPQxjam.exe

Filesize
1.1MB

MD5
b97341488f3f6d84409a6bf2ccffa02a

SHA1
5cd46cd3dfdaf0744f08a5debabc9c9382a66233

SHA256
c062d22e33fdbe5d92e6d17acacdbe5f6fd2119498fe3f9559a42f92da585c01

SHA512
2cb8e1c7f785cdbb6b553111991e7f615ff0b5b139413eeda4ec27df2b4b2dc7e11810409b9256f52edf3bec8d4b35a097815f8f701c8782864a49d73c6e1f44

Download Submit
C:\Windows\System\CrxKGfa.exe

Filesize
1.1MB

MD5
29f3e9955bb6e21840be9757979255c0

SHA1
687ec3adb5f1e3471dc34b39db9520040ed3e5c0

SHA256
5198de6bc5bd729cc11f8692139aa92f9951d4b1bf3cda49fe7bb4aa7a1dc00d

SHA512
0a28c801e6f07cdf0f2517d25c2d972507b97bad0f791816822b61b67e25a66c586a3d26a658baedfda1f3bba70e7f544f9f67869d6e530c829006a5c29a526c

Download Submit
C:\Windows\System\EWIGdnh.exe

Filesize
1.1MB

MD5
103ba403caa6ba52c476d3c2c770d3bd

SHA1
89d301ddbdca971cfe19f7a35aa2f011c21daa6d

SHA256
0ed578a7dd3853bc80687c258c07e9e3dbad07d5416ec97001ec1353961f1df6

SHA512
0a116c429c6c62e92baf4b21ebf926a6a9d5936d9483a00a5accee27b099dec1c7ff074a3ab807bceb2cf2d0d6aa3beeaabbe2ef96182a8602d1e539c819c69e

Download Submit
C:\Windows\System\GXxxzML.exe

Filesize
1.1MB

MD5
c952c09b369507f396ff08831d226232

SHA1
d60cf3b0a6aa2c177ac03d1b04bc973b59fdb234

SHA256
bce5c3718f469aaffc2fa37c8da78b11b8794b1dd6ba48b6298e0afab318135d

SHA512
fab608f09f51a97f40c563047d0aa97a47e95ae4219c59327e5bbe7c419ddaa3a8c288f9e5713fffe5909dc637a33ef661f0e974fe1442069d427a1d64804518

Download Submit
C:\Windows\System\HqizVgl.exe

Filesize
1.1MB

MD5
1774f021c1c7feab20c1682162bb6b95

SHA1
a1a2501024efb98d97633dd883443696922473e5

SHA256
af425e78f55fd1be540edcfad09f211152fdc53636b43f1491405e3cb22ea0c0

SHA512
68fa2d7b87074fcbba17abff52c108b2f19c181344d4917d7f5e87935366b6a9a1aac447854ea5a99f6b2d3b926c1039f40131da7f8340b1a7f8f3fea26070ad

Download Submit
C:\Windows\System\HsSZckK.exe

Filesize
1.1MB

MD5
6cb0db8aa80908642d6b73959c8a9b13

SHA1
7a542e1fa3ada2eadd60c1069f98bc427d06c7b7

SHA256
3e0a6f2573b7472308f7c65a2cecd65bfe70d442fad817799852fda6efee3168

SHA512
300e141470724997ac68ffe6acfab10be175774e1deec817b200cff93a190055f14b150884568653820544cd6276c9d64285d224a0a2d8a25aa90d6355ed4391

Download Submit
C:\Windows\System\IUdjXAr.exe

Filesize
1.0MB

MD5
ea6f9230cc1c46d68a4541eb4e3d936b

SHA1
3e2eb6e9effe90b55c8def695dd3d3a5da719bc8

SHA256
80f2410ef085642a2437765f0a176410a8c3c6c9f01a0115f5c3384d1b11d93a

SHA512
1888332980c83facb97239845cde3c817f8c0aeeecd6521c4f9e36f7c37a2a224a758968bfa2a0448857d213dc1a5c3a9e5e40a65b5bcf8b3540cf46ab57fb00

Download Submit
C:\Windows\System\JDTLKtR.exe

Filesize
1.1MB

MD5
21a49c0888a62406d7ebf16244fdf468

SHA1
de0adecef8795c887386d77bd3c9ad0d31705ab4

SHA256
420c364d57e3f4dba98a0f0516dd55756653030d3a8f13d687ea311c30a61a41

SHA512
07b3d75db43bd3caf35ebd81fa74b50230040d23a4ca5c524f57c7feb7fed5f6fa4cdf8c67b481fb2b9a0a8454822f9545e804fa9bcc4dd80f07b57739431f83

Download Submit
C:\Windows\System\Outhnrj.exe

Filesize
1.1MB

MD5
45396364f3f69b3bf9745e41862d46bd

SHA1
2fe9cdaece8a441fc2e20dfccae2dfebcac4a6df

SHA256
f071a5a51c9c8d3a0eb3d086e0fdbaaaafa7a33026d0104a2feb5d91d85f3ca8

SHA512
75cd7d8b6cd229bb1db64e1cdce9fa8873c33848be50df8223ef027ffea0c46f0354d329fe7722ad30b397130dc9399ef5d9dab18d82a0f1630605ab0147b0f8

Download Submit
C:\Windows\System\RaToGPo.exe

Filesize
1.1MB

MD5
a609ad2789f60890990f7a20d6bcc800

SHA1
08aa69c378c78d15cd3430fbb8ef82675e42b79a

SHA256
7c89867c3e50437744ad718db32bd6f4f5b84dd4270610a5c9898613cd6bb4eb

SHA512
a6104a4496f187ec39b1c931a10391323b2f15186af03b95552ad4dd7b62a15c51b389f2bc5653e5e33bed5105c4ba7f58001213f885db86a1063a672db62937

Download Submit
C:\Windows\System\URwuVwY.exe

Filesize
1.1MB

MD5
c18bca4b57a8292ecf5d8740d8f66d2a

SHA1
b484c0ed375ea5c118632608d4af2a65f045b19b

SHA256
59a938e25e03f80aaefa3f4704e08aeb6c32e45a024c84feffcdda0ad0ceb7fd

SHA512
725507a27c2d2af6808bad48e81ede790577be876f8b8c66ae2bc4b92a6827e3fed33f4f7c836b42e42bb86b77b2670f310d15774ba1978bdd61e958471c4155

Download Submit
C:\Windows\System\VSxigMS.exe

Filesize
1.1MB

MD5
020b7d1430470eb350f7960e97a264c5

SHA1
6362e65b704b20770fef6375e76aefded82d9c5d

SHA256
a40ec2cf93f591e196f4e191ed1d18797212f13cfaacc8594dcdfd12aa394066

SHA512
3d65d782a280175bcf2049ae93b9bf3822f95b02212f6a8cd72577b9178dc86e736c2fc46ef86cccace8be7a8cd3a0346b0e0a091d32616364a3f7b8f35c8144

Download Submit
C:\Windows\System\aPKNzyj.exe

Filesize
1.1MB

MD5
7f483100d6f4e8e970544c3446180ad7

SHA1
300c58590c999e5401c900e8b6c10488f694118e

SHA256
cce614cc7d1229096d118a3652c9d7fa61ec1e2b5ffee035a1b869e7a1ce9652

SHA512
52234b43aa3d5b881ea6e34dcc0ca60c6f62a7224660c64e0452ee9ce318fc4cdbe97561c4f9dca8906d1ef4a039bcbabd565008e6ac9ff3b58f96c8b5bbc930

Download Submit
C:\Windows\System\amKyIBR.exe

Filesize
1.1MB

MD5
f86dd2eb5102acc0119078c98b4f5674

SHA1
9a3971d3e7e2beeead7569ed0cb700856998b769

SHA256
4d43fffc24c62b9249c31544a5e6c65fed8f8942044cb49cfc6727dc329e39e7

SHA512
0006e5b91b538124fa5ede554924fc96b1c1e5d46ad9f4deead0262d9da1646b9d3fc84c5ae11ee94e15ca54bc362a1646ce7c98321b7578388582d82d2b7579

Download Submit
C:\Windows\System\bdsCiBt.exe

Filesize
1.1MB

MD5
14d83bec9953e48b72fcd29d2d138d95

SHA1
af9a8a86451c64e7a83cc5f7d8487485d0940ac3

SHA256
370560e96ea613e01966238225273c2cc9975ee3f736e32c7825040148a6e373

SHA512
f1844a48f90dc0a5662b67374efec7c7e695d64076e8f2457d843500fa6d49463881f1ca247d543564a5596d5fd3ec283ab173a6794974d54d7c3f7555e7f6a8

Download Submit
C:\Windows\System\btmlIlq.exe

Filesize
1.0MB

MD5
5991b7d0f0f16dd02590857fc66c3b88

SHA1
124749297ef916f328eb2e82d5544cef8745934a

SHA256
8322077a0e5b23c18c3918d5c36df1811eb3691accbfd55f4f89bd08f4d192a5

SHA512
15b2a92b987b71b7dd9fcf40dfc74294ab4c609b5e2c1f21a15acfd74893df4b5b2f49ca3be6580c0137f8d83b4ba0f2061d8479c6e0a584e27979ab073fb1aa

Download Submit
C:\Windows\System\cBfkToF.exe

Filesize
1.1MB

MD5
4776c7e03770b6b2a1757750bf790e7d

SHA1
6c284a98ca18ed9c836a7c637639e98513260227

SHA256
8ae6f591d3047d4f418f90e36981c34cceeea522af07b3becd0b9801ff63cadd

SHA512
0f188aecd2563d46a4cf7f4ed416b3df1f02c3fd3d364a295e1c94baf1d934e22411708503ae9f203879829a64ab64cdd8866ca867a5d62c47dc3e9eb22005e5

Download Submit
C:\Windows\System\cglmNMc.exe

Filesize
1.1MB

MD5
e17798aa3ee8e586ae87b859d20d280c

SHA1
6aece88e32ee7889dfca18d41efdcf084a62a25f

SHA256
8149c42bbeb5bed33167fce95ec2119fbb54b997490e568d6dac766111ba968e

SHA512
84ae4e5bc4c4f9e518788d4719971af2c8430a54d955210811ddec228896063f4f879c37d48897c86699d9befba38f7e02b937226541100ab4e05e17d0ea13c5

Download Submit
C:\Windows\System\duiLkJd.exe

Filesize
1.1MB

MD5
ee2628dc84e171abd85decf8bafe32ee

SHA1
6fcac1649b1a4ffd2cb7d4e92acf3f56c6ed186d

SHA256
4bac9e3b22d64e87db69df3422d3189e4896e527f4122a918ddaef36d4477261

SHA512
a04cf4f44cbf69f5eb3f5e7d154304777adbaf4cca21df77c0bf32b9e771b1a3d68ce690c79feee561146e25e2e20150a04ef57f3755f492dc84b9bf0537a21a

Download Submit
C:\Windows\System\gbSoBMt.exe

Filesize
1.0MB

MD5
0da1c45a20507c188e142a896f09c5c7

SHA1
9916748858d947c18c6b887d610932029b8f5e5d

SHA256
c9154f30906d5914378d0db865ed001ca5a709a2777c65d3bcfb77a201d12a00

SHA512
02edd9a4d56eb5f6922a5a92d27dac7902742fcb024f391eb7872106e13f65402be727616b3c6c839d737c784df58c1221e30f872a1549756ca4d4614d77d9f3

Download Submit
C:\Windows\System\gpSEnKu.exe

Filesize
1.1MB

MD5
f6f6c01f37ec18c14a0e7d2922eac8e9

SHA1
88b4dc5d521523f0ff86a4513aba7cb3a5b1e684

SHA256
2f94d93c4dce8aaec50a93367b59bf8c6c87612b0e59a18cb326ad8ec4eb98d0

SHA512
329b2271dc81029cd34b63331d216ba2b655eff40a466f04dd28d38c5680a05e640b54d4a7bc1e94b41fe3a464fed6d8b5a2daede030172a8e9785388bbb9b58

Download Submit
C:\Windows\System\hlzjLBo.exe

Filesize
1.1MB

MD5
4eb48be5c6a0bed1a4aab630e477a9ae

SHA1
21dd709fb57bcf8abdefb7c72f07f0dd06e3028c

SHA256
16340f00d74b6603006128ee7f7990dfeeccc4044663d4beff64b8cd048dcec7

SHA512
b8bfc1453bcd7bb4bbecf7b27149735012664d66b3f9fd5723ce16764f2f935f1e78baa0a459a3a2602eb30d8584557d2c3380959cbbaf0292687e714de5dded

Download Submit
C:\Windows\System\mILWKWy.exe

Filesize
1.0MB

MD5
d1325623efa966150428e9c8676b56c3

SHA1
181c70847e1ac814ce63d6b99db2689f2724df1a

SHA256
6c35b519316fe5d02eb91f047ca9598f0025431770cc5b64209a9062230b6091

SHA512
e96c35e565e67ede8af930b513659b0c2c188a162f8083257199e597187aa8e6fcc95446e5cd46b342b6090fcd0150e1ce4e13da6ea94f5d5c30c61243a1a3c8

Download Submit
C:\Windows\System\rcxHkma.exe

Filesize
1.1MB

MD5
44a6bd63b54534bdc51f66c500bfad06

SHA1
248f560b6da0fc122e5332a448d25adcec2e89ea

SHA256
eb68453706de4f5cc4caa7558ea9ceee5782c76631612cbb28f51420b936d55d

SHA512
b529d1d22276cdd8eb277d7674eae91b6ce0ad98e1b2934aa177d51b9b6a653b860d6fe52893acbfde96b30ca8146ea2ef7e8f4e622e3be91942e74d33512262

Download Submit
C:\Windows\System\seJOznu.exe

Filesize
1.1MB

MD5
e4ca3ccd82e0763d1d1bd14789bccbdd

SHA1
62c0eae0677beb0aab9dcefd54407be99f947100

SHA256
1ee1984f1fde556be488d9d563f0da5403b6a4f42de012b687b9c57223dcafa2

SHA512
ed8778add7467c2ae7e9feaa893ff5ab3a1852c1ff2c46c09627bdd8968a9192d06c0eb34eaf83dcd0f2760c05baa56795bf3d8f2e228334086b2e1b5154d432

Download Submit
C:\Windows\System\smdJOSI.exe

Filesize
1.1MB

MD5
4cc7f5d938f3b620bf1faa4b4fb253de

SHA1
0080b10a790dcc6e534538c62fed800dc3583c45

SHA256
dbece444b5e7f3c698925c05b85829ca8d1ac536e3c871f78d5bd11be94e2854

SHA512
443089d5a6ce76018a9e31736d11763bbcb7e8dbd6d2212e5fe5315ea48736ce910995a44ab2b0885600cf108defc8ee5435d65fcaf8b8d168340d0393b71f76

Download Submit
C:\Windows\System\svXZrXK.exe

Filesize
1.1MB

MD5
e234605d0b33ad56ccbb14192c23a899

SHA1
b9d3850960a679fad36d972bc272416a77071086

SHA256
6ca048c185106a78bd3e4976e28f8135b8918562897f013ebaf0a46efe9fdbf0

SHA512
b27d81375e86444fe336d2c3643e21d5e344f878adb75487f7146fe132e63ea3a97e31e4bc92268234bf7398b8bba173c8d06f29663fbb7ed216f43405ea7fd0

Download Submit
C:\Windows\System\tNxIMUo.exe

Filesize
1.1MB

MD5
cc4e148399fec60e906be501b9f53157

SHA1
ae4ec778a6e73f5b956bcde9b294dd6e118a28c2

SHA256
1d8e4ba3e885402ec03a9fd94330d9c441541d0df5a3f538626f4b3e933ab081

SHA512
9600acb790173bc5335171dc0b7cba95d79b064294babe46827a94204e91faadf7dc9461a0b1c3d217250d9770577c49cd15aabd923b2d034adeefc983a7a422

Download Submit
C:\Windows\System\uUXKfZi.exe

Filesize
1.1MB

MD5
f01e8de0a33c7279b9b3af0106e9369b

SHA1
dfee20befb2c5742e003e1de148481dcce61201f

SHA256
977bb6c8acf3c25c17fbe35081b4cdad8336127c1889b2775432226477007f3e

SHA512
a45f5a0b5a1ea12acea9b96d8998cb02e2cd088c38d302564d88951855134a5905b45a03c24eb128c4f339f82d35b95d6e12a4f6ae9f386a3c03d59d34cddf85

Download Submit
C:\Windows\System\vwfWhpA.exe

Filesize
1.0MB

MD5
a8e17a1bb1d547fc837a2973f85edac7

SHA1
ed792a84cbc0c5a15a981e2317046e2a2bf58a02

SHA256
bb5f5615deece8f5a75cb6fd6f5808f22c3d16505695d8bf9ef4bc5bdc24973c

SHA512
ef02aa4202ddbd811743143b76960621c483de6604f3f10ee4267df5c280c0ce1a19180891552bac8eb955f76013477f7959b771015cdd57d86faa0c0b034a28

Download Submit
C:\Windows\System\wmZXehN.exe

Filesize
1.1MB

MD5
788c8cbbff23245f3be11495686449a7

SHA1
f44fef88011a648de434008a27e2fa8b3069ae8c

SHA256
874935ac8de6155401081a95f70c8dcb2e099c8200f6437952d2fcebc6ebe15f

SHA512
1c5d6e82e14d647d1c889f75b6de8a4af30033b61fea9baecfb9a7cdc6d2354e1b190cff9b4429866b053e8ff2a8c648847fbaae0e8a8321fd4c01fe7dc7360b

Download Submit
C:\Windows\System\xCeTdqs.exe

Filesize
1.1MB

MD5
8ca7bb81cb1c3aae510cae0b21b311e3

SHA1
a616abe259047dc4e5dde7738a446fbdac33aaf3

SHA256
8c25569d5d01b32d848388f0914bd5ba2c1b745485c9afac9787828bc3522a52

SHA512
5f2fb8d8cf1e096bab613ce81d153918128365647829739be73c0107f33337a70582ab2fc0d71a77d9e356ed5fe5241cb2ea4908fe83e5b6453191cb78ff59c1

Download Submit
C:\Windows\System\yySbEdY.exe

Filesize
1.1MB

MD5
a3846d730336d0aa621a72383420714c

SHA1
6400d6056d11e003e166555f40adfba967bd55f1

SHA256
9eb00355ad13a92b0b34feec628115d1bce2785c3508e972464a91a8d86538f5

SHA512
fa0839fa9441f7dc4ba99abcdfd566cd171f21e27e79061f2ccb5616cb6ea012f5002efd9dc175f86209dd0f4db0c38b8b2ac85c176bca185099e59e1a8814cc

Download Submit
memory/532-0-0x000001F81A8B0000-0x000001F81A8C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads