xmrig | 9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
Size

1.4MB
MD5

7f164cfecf91db9e0a1df2e316c57e24
SHA1

ce8964d4e045dddb025cfdd68fc9f0d8b4b30a6e
SHA256

9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3
SHA512

1631d54f7e85ea3ccbec0703b122157bfe766dc732daa9c7bd32fce613546088c4ffec386a3756b51c734f897e5b2fcc4b28176d9dc1baf17f59e8f7d8186b2f
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbce:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5c

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023bab-4.dat	xmrig
behavioral2/files/0x0007000000023ca3-6.dat	xmrig
behavioral2/files/0x0008000000023c9f-8.dat	xmrig
behavioral2/files/0x0007000000023ca9-42.dat	xmrig
behavioral2/files/0x0007000000023caf-72.dat	xmrig
behavioral2/files/0x0007000000023cb1-82.dat	xmrig
behavioral2/files/0x0007000000023cb9-128.dat	xmrig
behavioral2/files/0x0007000000023cc0-157.dat	xmrig
behavioral2/files/0x0007000000023cc1-162.dat	xmrig
behavioral2/files/0x0007000000023cbf-158.dat	xmrig
behavioral2/files/0x0007000000023cbe-152.dat	xmrig
behavioral2/files/0x0007000000023cbd-148.dat	xmrig
behavioral2/files/0x0007000000023cbc-142.dat	xmrig
behavioral2/files/0x0007000000023cbb-138.dat	xmrig
behavioral2/files/0x0007000000023cba-132.dat	xmrig
behavioral2/files/0x0007000000023cb8-123.dat	xmrig
behavioral2/files/0x0007000000023cb7-117.dat	xmrig
behavioral2/files/0x0007000000023cb6-113.dat	xmrig
behavioral2/files/0x0007000000023cb5-110.dat	xmrig
behavioral2/files/0x0007000000023cb4-105.dat	xmrig
behavioral2/files/0x0007000000023cb3-100.dat	xmrig
behavioral2/files/0x0007000000023cb2-95.dat	xmrig
behavioral2/files/0x0007000000023cb0-85.dat	xmrig
behavioral2/files/0x0007000000023cae-75.dat	xmrig
behavioral2/files/0x0007000000023cad-70.dat	xmrig
behavioral2/files/0x0007000000023cac-65.dat	xmrig
behavioral2/files/0x0007000000023cab-60.dat	xmrig
behavioral2/files/0x0007000000023caa-55.dat	xmrig
behavioral2/files/0x0007000000023ca8-45.dat	xmrig
behavioral2/files/0x0007000000023ca7-40.dat	xmrig
behavioral2/files/0x0007000000023ca6-35.dat	xmrig
behavioral2/files/0x0007000000023ca5-27.dat	xmrig
behavioral2/files/0x0007000000023ca4-23.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2932	skfapMU.exe
4664	gfsAOVD.exe
632	zVEzPpe.exe
1040	YeQoZQz.exe
1140	eJZFiLc.exe
368	nVOdAyT.exe
4044	wqhiAjX.exe
1172	lhdAfFc.exe
3376	NuLKIUt.exe
3548	NBIISQu.exe
852	YnLwYCC.exe
3740	xpMvXFR.exe
4116	GKPdZdQ.exe
2296	NCOxeup.exe
3536	XzRmgUa.exe
2500	jazlbPv.exe
2792	UOxYxVH.exe
2280	rdFudju.exe
112	AXRglkb.exe
4396	IOaCpGK.exe
1908	BFnlaNy.exe
4904	puFYOgN.exe
4892	NTjjerH.exe
4920	OUtdRLb.exe
2172	ZzbaTov.exe
4624	HlJoScB.exe
1472	wGYpeXW.exe
956	vDRcaAo.exe
1952	fkZRYvB.exe
4068	BOSbEXk.exe
2840	dafUlUq.exe
1496	UtTqerJ.exe
4020	xXQUlCv.exe
2248	miAbzhS.exe
4040	MndecCU.exe
756	ETinIOp.exe
504	TBIcuRT.exe
4080	cdVuDrz.exe
1724	XhUvzbx.exe
3064	ppgLwFQ.exe
1672	qOJAIpe.exe
3604	DKTqUOW.exe
1188	htpJjOn.exe
4284	xYXyKfE.exe
5056	daIbkat.exe
2352	NVinUXi.exe
5000	wlwKhTj.exe
1956	NTgfgyg.exe
4156	JaSpsnw.exe
720	BPwPsVo.exe
1360	petGBQF.exe
4652	kFHDJdY.exe
2828	kSuYLWz.exe
4292	SLMqcFX.exe
636	hmXQxpX.exe
3256	VsXCxsv.exe
1388	AhAfIkU.exe
2824	yaAUwQy.exe
4344	OIChNVN.exe
4052	uFrxTuU.exe
2320	OIUgaNJ.exe
2216	NRLSFBI.exe
4236	FwjJdna.exe
4212	rPOQodR.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PTiGAsx.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\ozCrhHw.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\OJAFHUl.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\ETinIOp.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\xDJpXzM.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\linnxhI.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\TkcKExX.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\IDwOczs.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\finRQwZ.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\wGLvNpP.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\LsHUQbh.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\PoGtVxz.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\azBbZRy.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\UVFaqev.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\qvyqKhs.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\keVvviX.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\YeQoZQz.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\GKPdZdQ.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\XujcvlX.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\CRCoPiK.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\LPWWsbh.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\Stpbbbn.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\fjCsNVN.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\ECFBtNA.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\RZokeFH.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\jPFFSii.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\znSuPrQ.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\rPOQodR.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\myXhTRI.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\GecqXlw.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\RPRomKx.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\ZybdTyC.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\LATNAfJ.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\oLfdLaH.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\yRgLeyJ.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\LXSRaYf.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\eONGRAp.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\skfapMU.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\luiNHwr.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\lJqBJCK.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\usRbZpw.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\LwiiAjm.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\pxxnXha.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\HALaBAP.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\BdVkGEO.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\DQReHbM.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\vjYTXLj.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\NTjjerH.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\MndecCU.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\HsVTAUe.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\kDaQtbe.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\miAbzhS.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\TBIcuRT.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\rECZJGm.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\imOqjiO.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\cppNJzP.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\wDhxThq.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\qOJAIpe.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\KqdAsFi.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\jDZDvVS.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\ZqBbHzC.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\XJlTpMP.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\aWuPmPw.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
File created	C:\Windows\System\WuVneCU.exe	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16816	dwm.exe
Token: SeChangeNotifyPrivilege	16816	dwm.exe
Token: 33	16816	dwm.exe
Token: SeIncBasePriorityPrivilege	16816	dwm.exe
Token: SeShutdownPrivilege	16816	dwm.exe
Token: SeCreatePagefilePrivilege	16816	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 2932	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	85
PID 5008 wrote to memory of 2932	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	85
PID 5008 wrote to memory of 4664	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	86
PID 5008 wrote to memory of 4664	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	86
PID 5008 wrote to memory of 632	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	87
PID 5008 wrote to memory of 632	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	87
PID 5008 wrote to memory of 1040	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	88
PID 5008 wrote to memory of 1040	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	88
PID 5008 wrote to memory of 1140	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	89
PID 5008 wrote to memory of 1140	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	89
PID 5008 wrote to memory of 368	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	90
PID 5008 wrote to memory of 368	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	90
PID 5008 wrote to memory of 4044	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	91
PID 5008 wrote to memory of 4044	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	91
PID 5008 wrote to memory of 1172	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	92
PID 5008 wrote to memory of 1172	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	92
PID 5008 wrote to memory of 3376	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	93
PID 5008 wrote to memory of 3376	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	93
PID 5008 wrote to memory of 3548	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	94
PID 5008 wrote to memory of 3548	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	94
PID 5008 wrote to memory of 852	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	95
PID 5008 wrote to memory of 852	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	95
PID 5008 wrote to memory of 3740	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	96
PID 5008 wrote to memory of 3740	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	96
PID 5008 wrote to memory of 4116	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	97
PID 5008 wrote to memory of 4116	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	97
PID 5008 wrote to memory of 2296	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	98
PID 5008 wrote to memory of 2296	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	98
PID 5008 wrote to memory of 3536	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	99
PID 5008 wrote to memory of 3536	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	99
PID 5008 wrote to memory of 2500	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	100
PID 5008 wrote to memory of 2500	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	100
PID 5008 wrote to memory of 2792	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	101
PID 5008 wrote to memory of 2792	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	101
PID 5008 wrote to memory of 2280	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	102
PID 5008 wrote to memory of 2280	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	102
PID 5008 wrote to memory of 112	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	103
PID 5008 wrote to memory of 112	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	103
PID 5008 wrote to memory of 4396	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	104
PID 5008 wrote to memory of 4396	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	104
PID 5008 wrote to memory of 1908	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	105
PID 5008 wrote to memory of 1908	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	105
PID 5008 wrote to memory of 4904	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	106
PID 5008 wrote to memory of 4904	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	106
PID 5008 wrote to memory of 4892	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	107
PID 5008 wrote to memory of 4892	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	107
PID 5008 wrote to memory of 4920	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	108
PID 5008 wrote to memory of 4920	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	108
PID 5008 wrote to memory of 2172	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	109
PID 5008 wrote to memory of 2172	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	109
PID 5008 wrote to memory of 4624	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	110
PID 5008 wrote to memory of 4624	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	110
PID 5008 wrote to memory of 1472	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	111
PID 5008 wrote to memory of 1472	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	111
PID 5008 wrote to memory of 956	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	112
PID 5008 wrote to memory of 956	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	112
PID 5008 wrote to memory of 1952	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	113
PID 5008 wrote to memory of 1952	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	113
PID 5008 wrote to memory of 4068	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	114
PID 5008 wrote to memory of 4068	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	114
PID 5008 wrote to memory of 2840	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	115
PID 5008 wrote to memory of 2840	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	115
PID 5008 wrote to memory of 1496	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	116
PID 5008 wrote to memory of 1496	5008	9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe	116

C:\Users\Admin\AppData\Local\Temp\9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe
"C:\Users\Admin\AppData\Local\Temp\9f59abccf26c9e8b065c2ac258138aaf9198c231cc9d68cbbf42b84e9428a6f3.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\System\skfapMU.exe
  C:\Windows\System\skfapMU.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\gfsAOVD.exe
  C:\Windows\System\gfsAOVD.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\zVEzPpe.exe
  C:\Windows\System\zVEzPpe.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\YeQoZQz.exe
  C:\Windows\System\YeQoZQz.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\eJZFiLc.exe
  C:\Windows\System\eJZFiLc.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\nVOdAyT.exe
  C:\Windows\System\nVOdAyT.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\wqhiAjX.exe
  C:\Windows\System\wqhiAjX.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\lhdAfFc.exe
  C:\Windows\System\lhdAfFc.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\NuLKIUt.exe
  C:\Windows\System\NuLKIUt.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\NBIISQu.exe
  C:\Windows\System\NBIISQu.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\YnLwYCC.exe
  C:\Windows\System\YnLwYCC.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\xpMvXFR.exe
  C:\Windows\System\xpMvXFR.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\GKPdZdQ.exe
  C:\Windows\System\GKPdZdQ.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\NCOxeup.exe
  C:\Windows\System\NCOxeup.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\XzRmgUa.exe
  C:\Windows\System\XzRmgUa.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\jazlbPv.exe
  C:\Windows\System\jazlbPv.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\UOxYxVH.exe
  C:\Windows\System\UOxYxVH.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\rdFudju.exe
  C:\Windows\System\rdFudju.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\AXRglkb.exe
  C:\Windows\System\AXRglkb.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\IOaCpGK.exe
  C:\Windows\System\IOaCpGK.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\BFnlaNy.exe
  C:\Windows\System\BFnlaNy.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\puFYOgN.exe
  C:\Windows\System\puFYOgN.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\NTjjerH.exe
  C:\Windows\System\NTjjerH.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\OUtdRLb.exe
  C:\Windows\System\OUtdRLb.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\ZzbaTov.exe
  C:\Windows\System\ZzbaTov.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\HlJoScB.exe
  C:\Windows\System\HlJoScB.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\wGYpeXW.exe
  C:\Windows\System\wGYpeXW.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\vDRcaAo.exe
  C:\Windows\System\vDRcaAo.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\fkZRYvB.exe
  C:\Windows\System\fkZRYvB.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\BOSbEXk.exe
  C:\Windows\System\BOSbEXk.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\dafUlUq.exe
  C:\Windows\System\dafUlUq.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\UtTqerJ.exe
  C:\Windows\System\UtTqerJ.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\xXQUlCv.exe
  C:\Windows\System\xXQUlCv.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\miAbzhS.exe
  C:\Windows\System\miAbzhS.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\MndecCU.exe
  C:\Windows\System\MndecCU.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\ETinIOp.exe
  C:\Windows\System\ETinIOp.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\TBIcuRT.exe
  C:\Windows\System\TBIcuRT.exe
  2⤵
  - Executes dropped EXE
  PID:504
- C:\Windows\System\cdVuDrz.exe
  C:\Windows\System\cdVuDrz.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\XhUvzbx.exe
  C:\Windows\System\XhUvzbx.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\ppgLwFQ.exe
  C:\Windows\System\ppgLwFQ.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\qOJAIpe.exe
  C:\Windows\System\qOJAIpe.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\DKTqUOW.exe
  C:\Windows\System\DKTqUOW.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\htpJjOn.exe
  C:\Windows\System\htpJjOn.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\xYXyKfE.exe
  C:\Windows\System\xYXyKfE.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\daIbkat.exe
  C:\Windows\System\daIbkat.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\NVinUXi.exe
  C:\Windows\System\NVinUXi.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\wlwKhTj.exe
  C:\Windows\System\wlwKhTj.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\NTgfgyg.exe
  C:\Windows\System\NTgfgyg.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\JaSpsnw.exe
  C:\Windows\System\JaSpsnw.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\BPwPsVo.exe
  C:\Windows\System\BPwPsVo.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\petGBQF.exe
  C:\Windows\System\petGBQF.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\kFHDJdY.exe
  C:\Windows\System\kFHDJdY.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\kSuYLWz.exe
  C:\Windows\System\kSuYLWz.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\SLMqcFX.exe
  C:\Windows\System\SLMqcFX.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\hmXQxpX.exe
  C:\Windows\System\hmXQxpX.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\VsXCxsv.exe
  C:\Windows\System\VsXCxsv.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\AhAfIkU.exe
  C:\Windows\System\AhAfIkU.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\yaAUwQy.exe
  C:\Windows\System\yaAUwQy.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\OIChNVN.exe
  C:\Windows\System\OIChNVN.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\uFrxTuU.exe
  C:\Windows\System\uFrxTuU.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\OIUgaNJ.exe
  C:\Windows\System\OIUgaNJ.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\NRLSFBI.exe
  C:\Windows\System\NRLSFBI.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\FwjJdna.exe
  C:\Windows\System\FwjJdna.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\rPOQodR.exe
  C:\Windows\System\rPOQodR.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\rlDzIUb.exe
  C:\Windows\System\rlDzIUb.exe
  2⤵
  PID:3004
- C:\Windows\System\wUaeVGc.exe
  C:\Windows\System\wUaeVGc.exe
  2⤵
  PID:4124
- C:\Windows\System\kFoarnl.exe
  C:\Windows\System\kFoarnl.exe
  2⤵
  PID:4248
- C:\Windows\System\Ygjimol.exe
  C:\Windows\System\Ygjimol.exe
  2⤵
  PID:3796
- C:\Windows\System\icmOpJM.exe
  C:\Windows\System\icmOpJM.exe
  2⤵
  PID:4784
- C:\Windows\System\BlaINcf.exe
  C:\Windows\System\BlaINcf.exe
  2⤵
  PID:4468
- C:\Windows\System\KqdAsFi.exe
  C:\Windows\System\KqdAsFi.exe
  2⤵
  PID:4092
- C:\Windows\System\dsvJeqL.exe
  C:\Windows\System\dsvJeqL.exe
  2⤵
  PID:1588
- C:\Windows\System\UiXNTma.exe
  C:\Windows\System\UiXNTma.exe
  2⤵
  PID:3400
- C:\Windows\System\NzPlIAO.exe
  C:\Windows\System\NzPlIAO.exe
  2⤵
  PID:3200
- C:\Windows\System\gSXOHFD.exe
  C:\Windows\System\gSXOHFD.exe
  2⤵
  PID:1400
- C:\Windows\System\Zqbcrgk.exe
  C:\Windows\System\Zqbcrgk.exe
  2⤵
  PID:1676
- C:\Windows\System\YiHRxDA.exe
  C:\Windows\System\YiHRxDA.exe
  2⤵
  PID:1684
- C:\Windows\System\eohjZBd.exe
  C:\Windows\System\eohjZBd.exe
  2⤵
  PID:4308
- C:\Windows\System\TITfqNI.exe
  C:\Windows\System\TITfqNI.exe
  2⤵
  PID:2528
- C:\Windows\System\lpTUTWB.exe
  C:\Windows\System\lpTUTWB.exe
  2⤵
  PID:2100
- C:\Windows\System\cvIjgGh.exe
  C:\Windows\System\cvIjgGh.exe
  2⤵
  PID:3076
- C:\Windows\System\fCCHOZc.exe
  C:\Windows\System\fCCHOZc.exe
  2⤵
  PID:3292
- C:\Windows\System\fmsTNZQ.exe
  C:\Windows\System\fmsTNZQ.exe
  2⤵
  PID:1572
- C:\Windows\System\nVArpNo.exe
  C:\Windows\System\nVArpNo.exe
  2⤵
  PID:5148
- C:\Windows\System\fPoITHA.exe
  C:\Windows\System\fPoITHA.exe
  2⤵
  PID:5176
- C:\Windows\System\tacnfbr.exe
  C:\Windows\System\tacnfbr.exe
  2⤵
  PID:5204
- C:\Windows\System\eIILrzB.exe
  C:\Windows\System\eIILrzB.exe
  2⤵
  PID:5232
- C:\Windows\System\vsegXtS.exe
  C:\Windows\System\vsegXtS.exe
  2⤵
  PID:5260
- C:\Windows\System\fhrQTXa.exe
  C:\Windows\System\fhrQTXa.exe
  2⤵
  PID:5284
- C:\Windows\System\LorDXGl.exe
  C:\Windows\System\LorDXGl.exe
  2⤵
  PID:5312
- C:\Windows\System\QejuHIU.exe
  C:\Windows\System\QejuHIU.exe
  2⤵
  PID:5340
- C:\Windows\System\mmkzLMu.exe
  C:\Windows\System\mmkzLMu.exe
  2⤵
  PID:5368
- C:\Windows\System\ZZyjHSm.exe
  C:\Windows\System\ZZyjHSm.exe
  2⤵
  PID:5400
- C:\Windows\System\kpdwEbc.exe
  C:\Windows\System\kpdwEbc.exe
  2⤵
  PID:5424
- C:\Windows\System\jDZDvVS.exe
  C:\Windows\System\jDZDvVS.exe
  2⤵
  PID:5456
- C:\Windows\System\sUxGOCD.exe
  C:\Windows\System\sUxGOCD.exe
  2⤵
  PID:5484
- C:\Windows\System\lnxfyRt.exe
  C:\Windows\System\lnxfyRt.exe
  2⤵
  PID:5512
- C:\Windows\System\glIPgya.exe
  C:\Windows\System\glIPgya.exe
  2⤵
  PID:5536
- C:\Windows\System\menzPwq.exe
  C:\Windows\System\menzPwq.exe
  2⤵
  PID:5564
- C:\Windows\System\BrnerSq.exe
  C:\Windows\System\BrnerSq.exe
  2⤵
  PID:5640
- C:\Windows\System\XlIRdFj.exe
  C:\Windows\System\XlIRdFj.exe
  2⤵
  PID:5656
- C:\Windows\System\jrCNWtB.exe
  C:\Windows\System\jrCNWtB.exe
  2⤵
  PID:5676
- C:\Windows\System\YBwIjiI.exe
  C:\Windows\System\YBwIjiI.exe
  2⤵
  PID:5692
- C:\Windows\System\boleOVy.exe
  C:\Windows\System\boleOVy.exe
  2⤵
  PID:5720
- C:\Windows\System\YfsuGHz.exe
  C:\Windows\System\YfsuGHz.exe
  2⤵
  PID:5752
- C:\Windows\System\mNuqSYG.exe
  C:\Windows\System\mNuqSYG.exe
  2⤵
  PID:5776
- C:\Windows\System\cNhTjzh.exe
  C:\Windows\System\cNhTjzh.exe
  2⤵
  PID:5804
- C:\Windows\System\IKhaywv.exe
  C:\Windows\System\IKhaywv.exe
  2⤵
  PID:5836
- C:\Windows\System\luiNHwr.exe
  C:\Windows\System\luiNHwr.exe
  2⤵
  PID:5860
- C:\Windows\System\ZbrBXXG.exe
  C:\Windows\System\ZbrBXXG.exe
  2⤵
  PID:5884
- C:\Windows\System\tsfrUAr.exe
  C:\Windows\System\tsfrUAr.exe
  2⤵
  PID:5916
- C:\Windows\System\mYROQTf.exe
  C:\Windows\System\mYROQTf.exe
  2⤵
  PID:5944
- C:\Windows\System\BujdVfU.exe
  C:\Windows\System\BujdVfU.exe
  2⤵
  PID:5972
- C:\Windows\System\DDSaPvB.exe
  C:\Windows\System\DDSaPvB.exe
  2⤵
  PID:6000
- C:\Windows\System\ZYjjYRl.exe
  C:\Windows\System\ZYjjYRl.exe
  2⤵
  PID:6028
- C:\Windows\System\YDJROfU.exe
  C:\Windows\System\YDJROfU.exe
  2⤵
  PID:6056
- C:\Windows\System\OmoGUCH.exe
  C:\Windows\System\OmoGUCH.exe
  2⤵
  PID:6084
- C:\Windows\System\Stpbbbn.exe
  C:\Windows\System\Stpbbbn.exe
  2⤵
  PID:6112
- C:\Windows\System\kbTTtBd.exe
  C:\Windows\System\kbTTtBd.exe
  2⤵
  PID:6140
- C:\Windows\System\vvynxSx.exe
  C:\Windows\System\vvynxSx.exe
  2⤵
  PID:3984
- C:\Windows\System\sLHAXNw.exe
  C:\Windows\System\sLHAXNw.exe
  2⤵
  PID:2512
- C:\Windows\System\KeODeYw.exe
  C:\Windows\System\KeODeYw.exe
  2⤵
  PID:1656
- C:\Windows\System\alylAQI.exe
  C:\Windows\System\alylAQI.exe
  2⤵
  PID:4500
- C:\Windows\System\HsVTAUe.exe
  C:\Windows\System\HsVTAUe.exe
  2⤵
  PID:2204
- C:\Windows\System\FQgsPUY.exe
  C:\Windows\System\FQgsPUY.exe
  2⤵
  PID:460
- C:\Windows\System\nYxmtLb.exe
  C:\Windows\System\nYxmtLb.exe
  2⤵
  PID:1556
- C:\Windows\System\YYdxYow.exe
  C:\Windows\System\YYdxYow.exe
  2⤵
  PID:5168
- C:\Windows\System\sAkrlCf.exe
  C:\Windows\System\sAkrlCf.exe
  2⤵
  PID:5220
- C:\Windows\System\PjuXTLr.exe
  C:\Windows\System\PjuXTLr.exe
  2⤵
  PID:5280
- C:\Windows\System\DrQppDM.exe
  C:\Windows\System\DrQppDM.exe
  2⤵
  PID:5352
- C:\Windows\System\sQwUsGe.exe
  C:\Windows\System\sQwUsGe.exe
  2⤵
  PID:5412
- C:\Windows\System\pxVOnrY.exe
  C:\Windows\System\pxVOnrY.exe
  2⤵
  PID:5492
- C:\Windows\System\ddKkxol.exe
  C:\Windows\System\ddKkxol.exe
  2⤵
  PID:5552
- C:\Windows\System\YNgrRtY.exe
  C:\Windows\System\YNgrRtY.exe
  2⤵
  PID:5620
- C:\Windows\System\JqUjHBt.exe
  C:\Windows\System\JqUjHBt.exe
  2⤵
  PID:5684
- C:\Windows\System\RJCqSbQ.exe
  C:\Windows\System\RJCqSbQ.exe
  2⤵
  PID:5760
- C:\Windows\System\FXJyJqO.exe
  C:\Windows\System\FXJyJqO.exe
  2⤵
  PID:5820
- C:\Windows\System\ULaZjhD.exe
  C:\Windows\System\ULaZjhD.exe
  2⤵
  PID:5880
- C:\Windows\System\HPInbkF.exe
  C:\Windows\System\HPInbkF.exe
  2⤵
  PID:5956
- C:\Windows\System\eQQbrym.exe
  C:\Windows\System\eQQbrym.exe
  2⤵
  PID:6012
- C:\Windows\System\NRehKFu.exe
  C:\Windows\System\NRehKFu.exe
  2⤵
  PID:6068
- C:\Windows\System\ZihAAKV.exe
  C:\Windows\System\ZihAAKV.exe
  2⤵
  PID:6132
- C:\Windows\System\BJTOnMV.exe
  C:\Windows\System\BJTOnMV.exe
  2⤵
  PID:4864
- C:\Windows\System\HPtqbmi.exe
  C:\Windows\System\HPtqbmi.exe
  2⤵
  PID:2820
- C:\Windows\System\hGOgXSX.exe
  C:\Windows\System\hGOgXSX.exe
  2⤵
  PID:4392
- C:\Windows\System\bqqPkco.exe
  C:\Windows\System\bqqPkco.exe
  2⤵
  PID:5212
- C:\Windows\System\xDJpXzM.exe
  C:\Windows\System\xDJpXzM.exe
  2⤵
  PID:5384
- C:\Windows\System\sFPOHDf.exe
  C:\Windows\System\sFPOHDf.exe
  2⤵
  PID:5472
- C:\Windows\System\JEFuAKN.exe
  C:\Windows\System\JEFuAKN.exe
  2⤵
  PID:5652
- C:\Windows\System\FiaAbFu.exe
  C:\Windows\System\FiaAbFu.exe
  2⤵
  PID:5736
- C:\Windows\System\XujcvlX.exe
  C:\Windows\System\XujcvlX.exe
  2⤵
  PID:5908
- C:\Windows\System\bmzLNTU.exe
  C:\Windows\System\bmzLNTU.exe
  2⤵
  PID:6148
- C:\Windows\System\azBbZRy.exe
  C:\Windows\System\azBbZRy.exe
  2⤵
  PID:6176
- C:\Windows\System\Telzhxw.exe
  C:\Windows\System\Telzhxw.exe
  2⤵
  PID:6200
- C:\Windows\System\QhWrGiI.exe
  C:\Windows\System\QhWrGiI.exe
  2⤵
  PID:6228
- C:\Windows\System\BBeYMgo.exe
  C:\Windows\System\BBeYMgo.exe
  2⤵
  PID:6260
- C:\Windows\System\ClMwHpg.exe
  C:\Windows\System\ClMwHpg.exe
  2⤵
  PID:6288
- C:\Windows\System\VFmzMZj.exe
  C:\Windows\System\VFmzMZj.exe
  2⤵
  PID:6316
- C:\Windows\System\hIcXkJG.exe
  C:\Windows\System\hIcXkJG.exe
  2⤵
  PID:6348
- C:\Windows\System\oWDxYuH.exe
  C:\Windows\System\oWDxYuH.exe
  2⤵
  PID:6376
- C:\Windows\System\pPxrOoj.exe
  C:\Windows\System\pPxrOoj.exe
  2⤵
  PID:6408
- C:\Windows\System\pgdADsB.exe
  C:\Windows\System\pgdADsB.exe
  2⤵
  PID:6432
- C:\Windows\System\kRZXjji.exe
  C:\Windows\System\kRZXjji.exe
  2⤵
  PID:6464
- C:\Windows\System\XfiSGUy.exe
  C:\Windows\System\XfiSGUy.exe
  2⤵
  PID:6492
- C:\Windows\System\VwUnmJG.exe
  C:\Windows\System\VwUnmJG.exe
  2⤵
  PID:6520
- C:\Windows\System\GecqXlw.exe
  C:\Windows\System\GecqXlw.exe
  2⤵
  PID:6548
- C:\Windows\System\WyFyiXz.exe
  C:\Windows\System\WyFyiXz.exe
  2⤵
  PID:6576
- C:\Windows\System\lJqBJCK.exe
  C:\Windows\System\lJqBJCK.exe
  2⤵
  PID:6604
- C:\Windows\System\bYdusBz.exe
  C:\Windows\System\bYdusBz.exe
  2⤵
  PID:6632
- C:\Windows\System\telCWTQ.exe
  C:\Windows\System\telCWTQ.exe
  2⤵
  PID:6660
- C:\Windows\System\XYCwXNI.exe
  C:\Windows\System\XYCwXNI.exe
  2⤵
  PID:6688
- C:\Windows\System\bhBHqPm.exe
  C:\Windows\System\bhBHqPm.exe
  2⤵
  PID:6716
- C:\Windows\System\AUfqzao.exe
  C:\Windows\System\AUfqzao.exe
  2⤵
  PID:6740
- C:\Windows\System\GZXMlVb.exe
  C:\Windows\System\GZXMlVb.exe
  2⤵
  PID:6772
- C:\Windows\System\fEgTbzj.exe
  C:\Windows\System\fEgTbzj.exe
  2⤵
  PID:6800
- C:\Windows\System\fjCsNVN.exe
  C:\Windows\System\fjCsNVN.exe
  2⤵
  PID:6828
- C:\Windows\System\PqiWRqM.exe
  C:\Windows\System\PqiWRqM.exe
  2⤵
  PID:6856
- C:\Windows\System\IydoYes.exe
  C:\Windows\System\IydoYes.exe
  2⤵
  PID:6888
- C:\Windows\System\BNxnZfY.exe
  C:\Windows\System\BNxnZfY.exe
  2⤵
  PID:6912
- C:\Windows\System\JxqBSwZ.exe
  C:\Windows\System\JxqBSwZ.exe
  2⤵
  PID:6948
- C:\Windows\System\wMldCfx.exe
  C:\Windows\System\wMldCfx.exe
  2⤵
  PID:6980
- C:\Windows\System\aMfpwsM.exe
  C:\Windows\System\aMfpwsM.exe
  2⤵
  PID:7008
- C:\Windows\System\wBFfVBj.exe
  C:\Windows\System\wBFfVBj.exe
  2⤵
  PID:7036
- C:\Windows\System\BdVkGEO.exe
  C:\Windows\System\BdVkGEO.exe
  2⤵
  PID:7068
- C:\Windows\System\mlFyKIM.exe
  C:\Windows\System\mlFyKIM.exe
  2⤵
  PID:7096
- C:\Windows\System\ydESNNc.exe
  C:\Windows\System\ydESNNc.exe
  2⤵
  PID:7124
- C:\Windows\System\qqlunUN.exe
  C:\Windows\System\qqlunUN.exe
  2⤵
  PID:6044
- C:\Windows\System\lHGOkos.exe
  C:\Windows\System\lHGOkos.exe
  2⤵
  PID:6124
- C:\Windows\System\cTzntcC.exe
  C:\Windows\System\cTzntcC.exe
  2⤵
  PID:5140
- C:\Windows\System\aIFXwjn.exe
  C:\Windows\System\aIFXwjn.exe
  2⤵
  PID:5324
- C:\Windows\System\TsaRufW.exe
  C:\Windows\System\TsaRufW.exe
  2⤵
  PID:3056
- C:\Windows\System\PTiGAsx.exe
  C:\Windows\System\PTiGAsx.exe
  2⤵
  PID:5732
- C:\Windows\System\kGqswEH.exe
  C:\Windows\System\kGqswEH.exe
  2⤵
  PID:5984
- C:\Windows\System\SlfrmlV.exe
  C:\Windows\System\SlfrmlV.exe
  2⤵
  PID:6168
- C:\Windows\System\HNYCvpV.exe
  C:\Windows\System\HNYCvpV.exe
  2⤵
  PID:6220
- C:\Windows\System\AsCvjBi.exe
  C:\Windows\System\AsCvjBi.exe
  2⤵
  PID:6276
- C:\Windows\System\HlPxfbB.exe
  C:\Windows\System\HlPxfbB.exe
  2⤵
  PID:6304
- C:\Windows\System\QqoVcNw.exe
  C:\Windows\System\QqoVcNw.exe
  2⤵
  PID:6444
- C:\Windows\System\ywAsOQF.exe
  C:\Windows\System\ywAsOQF.exe
  2⤵
  PID:1464
- C:\Windows\System\xylXfQz.exe
  C:\Windows\System\xylXfQz.exe
  2⤵
  PID:6644
- C:\Windows\System\bFZYvIH.exe
  C:\Windows\System\bFZYvIH.exe
  2⤵
  PID:4716
- C:\Windows\System\miSxrKu.exe
  C:\Windows\System\miSxrKu.exe
  2⤵
  PID:3284
- C:\Windows\System\hrolbki.exe
  C:\Windows\System\hrolbki.exe
  2⤵
  PID:6812
- C:\Windows\System\sPvrOyB.exe
  C:\Windows\System\sPvrOyB.exe
  2⤵
  PID:6884
- C:\Windows\System\NrOAVoq.exe
  C:\Windows\System\NrOAVoq.exe
  2⤵
  PID:4756
- C:\Windows\System\ABAlWSm.exe
  C:\Windows\System\ABAlWSm.exe
  2⤵
  PID:3544
- C:\Windows\System\sMtOLuD.exe
  C:\Windows\System\sMtOLuD.exe
  2⤵
  PID:1008
- C:\Windows\System\zUuYJKU.exe
  C:\Windows\System\zUuYJKU.exe
  2⤵
  PID:7052
- C:\Windows\System\QIKyEYN.exe
  C:\Windows\System\QIKyEYN.exe
  2⤵
  PID:372
- C:\Windows\System\JUrLIvS.exe
  C:\Windows\System\JUrLIvS.exe
  2⤵
  PID:4440
- C:\Windows\System\xcJrehB.exe
  C:\Windows\System\xcJrehB.exe
  2⤵
  PID:7080
- C:\Windows\System\pWZSpHC.exe
  C:\Windows\System\pWZSpHC.exe
  2⤵
  PID:312
- C:\Windows\System\qEfgaZY.exe
  C:\Windows\System\qEfgaZY.exe
  2⤵
  PID:3716
- C:\Windows\System\qUVPetE.exe
  C:\Windows\System\qUVPetE.exe
  2⤵
  PID:3780
- C:\Windows\System\yRgLeyJ.exe
  C:\Windows\System\yRgLeyJ.exe
  2⤵
  PID:5192
- C:\Windows\System\OTYiZBD.exe
  C:\Windows\System\OTYiZBD.exe
  2⤵
  PID:388
- C:\Windows\System\RZSEghu.exe
  C:\Windows\System\RZSEghu.exe
  2⤵
  PID:6216
- C:\Windows\System\efXJtZZ.exe
  C:\Windows\System\efXJtZZ.exe
  2⤵
  PID:6416
- C:\Windows\System\PveznsG.exe
  C:\Windows\System\PveznsG.exe
  2⤵
  PID:6560
- C:\Windows\System\GNZeMxC.exe
  C:\Windows\System\GNZeMxC.exe
  2⤵
  PID:6672
- C:\Windows\System\yjKxwtV.exe
  C:\Windows\System\yjKxwtV.exe
  2⤵
  PID:3404
- C:\Windows\System\LJtDyjy.exe
  C:\Windows\System\LJtDyjy.exe
  2⤵
  PID:6872
- C:\Windows\System\iTikLIC.exe
  C:\Windows\System\iTikLIC.exe
  2⤵
  PID:3492
- C:\Windows\System\zKOAvuR.exe
  C:\Windows\System\zKOAvuR.exe
  2⤵
  PID:4372
- C:\Windows\System\LEWxVwp.exe
  C:\Windows\System\LEWxVwp.exe
  2⤵
  PID:4032
- C:\Windows\System\FlNPSmB.exe
  C:\Windows\System\FlNPSmB.exe
  2⤵
  PID:5712
- C:\Windows\System\QpvrAKA.exe
  C:\Windows\System\QpvrAKA.exe
  2⤵
  PID:6272
- C:\Windows\System\tUnovZj.exe
  C:\Windows\System\tUnovZj.exe
  2⤵
  PID:6540
- C:\Windows\System\bZlvIXG.exe
  C:\Windows\System\bZlvIXG.exe
  2⤵
  PID:4668
- C:\Windows\System\zqiEsYW.exe
  C:\Windows\System\zqiEsYW.exe
  2⤵
  PID:6996
- C:\Windows\System\ZIRZQQe.exe
  C:\Windows\System\ZIRZQQe.exe
  2⤵
  PID:2160
- C:\Windows\System\lUrUtgt.exe
  C:\Windows\System\lUrUtgt.exe
  2⤵
  PID:5088
- C:\Windows\System\vOsfJEc.exe
  C:\Windows\System\vOsfJEc.exe
  2⤵
  PID:6160
- C:\Windows\System\HGEKSnt.exe
  C:\Windows\System\HGEKSnt.exe
  2⤵
  PID:864
- C:\Windows\System\BlulYPu.exe
  C:\Windows\System\BlulYPu.exe
  2⤵
  PID:7216
- C:\Windows\System\oAnqVQp.exe
  C:\Windows\System\oAnqVQp.exe
  2⤵
  PID:7232
- C:\Windows\System\FVJfwZf.exe
  C:\Windows\System\FVJfwZf.exe
  2⤵
  PID:7260
- C:\Windows\System\QpQMjqn.exe
  C:\Windows\System\QpQMjqn.exe
  2⤵
  PID:7288
- C:\Windows\System\voDgsQD.exe
  C:\Windows\System\voDgsQD.exe
  2⤵
  PID:7312
- C:\Windows\System\XiHmEUY.exe
  C:\Windows\System\XiHmEUY.exe
  2⤵
  PID:7344
- C:\Windows\System\PvPhwIo.exe
  C:\Windows\System\PvPhwIo.exe
  2⤵
  PID:7376
- C:\Windows\System\nwHmWal.exe
  C:\Windows\System\nwHmWal.exe
  2⤵
  PID:7400
- C:\Windows\System\zojCWux.exe
  C:\Windows\System\zojCWux.exe
  2⤵
  PID:7448
- C:\Windows\System\MAYydcC.exe
  C:\Windows\System\MAYydcC.exe
  2⤵
  PID:7476
- C:\Windows\System\UBjiFot.exe
  C:\Windows\System\UBjiFot.exe
  2⤵
  PID:7504
- C:\Windows\System\wkkUlwQ.exe
  C:\Windows\System\wkkUlwQ.exe
  2⤵
  PID:7532
- C:\Windows\System\xgSloTF.exe
  C:\Windows\System\xgSloTF.exe
  2⤵
  PID:7560
- C:\Windows\System\tVABtDM.exe
  C:\Windows\System\tVABtDM.exe
  2⤵
  PID:7576
- C:\Windows\System\UAdJLZX.exe
  C:\Windows\System\UAdJLZX.exe
  2⤵
  PID:7612
- C:\Windows\System\kDaQtbe.exe
  C:\Windows\System\kDaQtbe.exe
  2⤵
  PID:7632
- C:\Windows\System\glhSYIQ.exe
  C:\Windows\System\glhSYIQ.exe
  2⤵
  PID:7660
- C:\Windows\System\QMFUADi.exe
  C:\Windows\System\QMFUADi.exe
  2⤵
  PID:7688
- C:\Windows\System\dVPiFAx.exe
  C:\Windows\System\dVPiFAx.exe
  2⤵
  PID:7716
- C:\Windows\System\GsfCWFC.exe
  C:\Windows\System\GsfCWFC.exe
  2⤵
  PID:7744
- C:\Windows\System\AsRQoBc.exe
  C:\Windows\System\AsRQoBc.exe
  2⤵
  PID:7776
- C:\Windows\System\uZhprHk.exe
  C:\Windows\System\uZhprHk.exe
  2⤵
  PID:7800
- C:\Windows\System\vZVmxsD.exe
  C:\Windows\System\vZVmxsD.exe
  2⤵
  PID:7828
- C:\Windows\System\oJxVMsF.exe
  C:\Windows\System\oJxVMsF.exe
  2⤵
  PID:7856
- C:\Windows\System\ZdowTce.exe
  C:\Windows\System\ZdowTce.exe
  2⤵
  PID:7872
- C:\Windows\System\PHwaaZR.exe
  C:\Windows\System\PHwaaZR.exe
  2⤵
  PID:7924
- C:\Windows\System\RUnGhmW.exe
  C:\Windows\System\RUnGhmW.exe
  2⤵
  PID:7940
- C:\Windows\System\xEmArbF.exe
  C:\Windows\System\xEmArbF.exe
  2⤵
  PID:7976
- C:\Windows\System\fOHqDuQ.exe
  C:\Windows\System\fOHqDuQ.exe
  2⤵
  PID:7996
- C:\Windows\System\jscniyA.exe
  C:\Windows\System\jscniyA.exe
  2⤵
  PID:8024
- C:\Windows\System\RLrIThU.exe
  C:\Windows\System\RLrIThU.exe
  2⤵
  PID:8044
- C:\Windows\System\fDBIoEA.exe
  C:\Windows\System\fDBIoEA.exe
  2⤵
  PID:8072
- C:\Windows\System\muNSBxh.exe
  C:\Windows\System\muNSBxh.exe
  2⤵
  PID:8096
- C:\Windows\System\ECFBtNA.exe
  C:\Windows\System\ECFBtNA.exe
  2⤵
  PID:8112
- C:\Windows\System\ozCrhHw.exe
  C:\Windows\System\ozCrhHw.exe
  2⤵
  PID:8136
- C:\Windows\System\BxIlbIG.exe
  C:\Windows\System\BxIlbIG.exe
  2⤵
  PID:8164
- C:\Windows\System\wCxMOzu.exe
  C:\Windows\System\wCxMOzu.exe
  2⤵
  PID:7196
- C:\Windows\System\ykndMvJ.exe
  C:\Windows\System\ykndMvJ.exe
  2⤵
  PID:7248
- C:\Windows\System\AAgaxZT.exe
  C:\Windows\System\AAgaxZT.exe
  2⤵
  PID:7284
- C:\Windows\System\vRnjQbC.exe
  C:\Windows\System\vRnjQbC.exe
  2⤵
  PID:7356
- C:\Windows\System\NuFhhgp.exe
  C:\Windows\System\NuFhhgp.exe
  2⤵
  PID:7440
- C:\Windows\System\MPtFiuV.exe
  C:\Windows\System\MPtFiuV.exe
  2⤵
  PID:7520
- C:\Windows\System\iOdKeRG.exe
  C:\Windows\System\iOdKeRG.exe
  2⤵
  PID:7544
- C:\Windows\System\VWjYYAr.exe
  C:\Windows\System\VWjYYAr.exe
  2⤵
  PID:7600
- C:\Windows\System\iQvENlw.exe
  C:\Windows\System\iQvENlw.exe
  2⤵
  PID:7652
- C:\Windows\System\wONMCBt.exe
  C:\Windows\System\wONMCBt.exe
  2⤵
  PID:7732
- C:\Windows\System\bhpyNwp.exe
  C:\Windows\System\bhpyNwp.exe
  2⤵
  PID:7816
- C:\Windows\System\EGVIdhM.exe
  C:\Windows\System\EGVIdhM.exe
  2⤵
  PID:7896
- C:\Windows\System\prlqQSX.exe
  C:\Windows\System\prlqQSX.exe
  2⤵
  PID:7972
- C:\Windows\System\nuvjfGU.exe
  C:\Windows\System\nuvjfGU.exe
  2⤵
  PID:7984
- C:\Windows\System\REQCCmT.exe
  C:\Windows\System\REQCCmT.exe
  2⤵
  PID:8056
- C:\Windows\System\yiqdIzC.exe
  C:\Windows\System\yiqdIzC.exe
  2⤵
  PID:8148
- C:\Windows\System\PhKrbOO.exe
  C:\Windows\System\PhKrbOO.exe
  2⤵
  PID:7244
- C:\Windows\System\mioWPHJ.exe
  C:\Windows\System\mioWPHJ.exe
  2⤵
  PID:7332
- C:\Windows\System\qWKQkgP.exe
  C:\Windows\System\qWKQkgP.exe
  2⤵
  PID:7468
- C:\Windows\System\FcOrzNA.exe
  C:\Windows\System\FcOrzNA.exe
  2⤵
  PID:7700
- C:\Windows\System\UJiuGyk.exe
  C:\Windows\System\UJiuGyk.exe
  2⤵
  PID:7820
- C:\Windows\System\ltToQlo.exe
  C:\Windows\System\ltToQlo.exe
  2⤵
  PID:8012
- C:\Windows\System\MxVkaFd.exe
  C:\Windows\System\MxVkaFd.exe
  2⤵
  PID:8032
- C:\Windows\System\FWFQgGV.exe
  C:\Windows\System\FWFQgGV.exe
  2⤵
  PID:7204
- C:\Windows\System\FmDeZTu.exe
  C:\Windows\System\FmDeZTu.exe
  2⤵
  PID:7772
- C:\Windows\System\JeciSWt.exe
  C:\Windows\System\JeciSWt.exe
  2⤵
  PID:7992
- C:\Windows\System\NsiCVbJ.exe
  C:\Windows\System\NsiCVbJ.exe
  2⤵
  PID:7604
- C:\Windows\System\oZsBsvw.exe
  C:\Windows\System\oZsBsvw.exe
  2⤵
  PID:7848
- C:\Windows\System\RFHiPWy.exe
  C:\Windows\System\RFHiPWy.exe
  2⤵
  PID:8220
- C:\Windows\System\OjcTuYw.exe
  C:\Windows\System\OjcTuYw.exe
  2⤵
  PID:8248
- C:\Windows\System\SkbQmBN.exe
  C:\Windows\System\SkbQmBN.exe
  2⤵
  PID:8276
- C:\Windows\System\PNIfTuA.exe
  C:\Windows\System\PNIfTuA.exe
  2⤵
  PID:8292
- C:\Windows\System\HdAmtEL.exe
  C:\Windows\System\HdAmtEL.exe
  2⤵
  PID:8320
- C:\Windows\System\ZqBbHzC.exe
  C:\Windows\System\ZqBbHzC.exe
  2⤵
  PID:8348
- C:\Windows\System\PNqqicg.exe
  C:\Windows\System\PNqqicg.exe
  2⤵
  PID:8376
- C:\Windows\System\nwuPJms.exe
  C:\Windows\System\nwuPJms.exe
  2⤵
  PID:8404
- C:\Windows\System\duSuoBb.exe
  C:\Windows\System\duSuoBb.exe
  2⤵
  PID:8432
- C:\Windows\System\DftVgeb.exe
  C:\Windows\System\DftVgeb.exe
  2⤵
  PID:8460
- C:\Windows\System\EpkkByj.exe
  C:\Windows\System\EpkkByj.exe
  2⤵
  PID:8488
- C:\Windows\System\jcGZpSB.exe
  C:\Windows\System\jcGZpSB.exe
  2⤵
  PID:8516
- C:\Windows\System\vPwwaQU.exe
  C:\Windows\System\vPwwaQU.exe
  2⤵
  PID:8532
- C:\Windows\System\twzRIzF.exe
  C:\Windows\System\twzRIzF.exe
  2⤵
  PID:8560
- C:\Windows\System\ofqWwNT.exe
  C:\Windows\System\ofqWwNT.exe
  2⤵
  PID:8592
- C:\Windows\System\OvhHWye.exe
  C:\Windows\System\OvhHWye.exe
  2⤵
  PID:8616
- C:\Windows\System\yuYxORm.exe
  C:\Windows\System\yuYxORm.exe
  2⤵
  PID:8644
- C:\Windows\System\QgVfOlw.exe
  C:\Windows\System\QgVfOlw.exe
  2⤵
  PID:8676
- C:\Windows\System\mtHtlRz.exe
  C:\Windows\System\mtHtlRz.exe
  2⤵
  PID:8700
- C:\Windows\System\MpXfsju.exe
  C:\Windows\System\MpXfsju.exe
  2⤵
  PID:8736
- C:\Windows\System\GSGoYmK.exe
  C:\Windows\System\GSGoYmK.exe
  2⤵
  PID:8776
- C:\Windows\System\DFfLMex.exe
  C:\Windows\System\DFfLMex.exe
  2⤵
  PID:8796
- C:\Windows\System\eFqKFjQ.exe
  C:\Windows\System\eFqKFjQ.exe
  2⤵
  PID:8836
- C:\Windows\System\VkYmUfK.exe
  C:\Windows\System\VkYmUfK.exe
  2⤵
  PID:8864
- C:\Windows\System\SYNNTBy.exe
  C:\Windows\System\SYNNTBy.exe
  2⤵
  PID:8880
- C:\Windows\System\MrQGEsw.exe
  C:\Windows\System\MrQGEsw.exe
  2⤵
  PID:8896
- C:\Windows\System\ZxkWEmq.exe
  C:\Windows\System\ZxkWEmq.exe
  2⤵
  PID:8912
- C:\Windows\System\MSWwUIC.exe
  C:\Windows\System\MSWwUIC.exe
  2⤵
  PID:8964
- C:\Windows\System\GgIOkWQ.exe
  C:\Windows\System\GgIOkWQ.exe
  2⤵
  PID:8988
- C:\Windows\System\YGPLtBL.exe
  C:\Windows\System\YGPLtBL.exe
  2⤵
  PID:9008
- C:\Windows\System\FBHiflN.exe
  C:\Windows\System\FBHiflN.exe
  2⤵
  PID:9032
- C:\Windows\System\kLdfmzY.exe
  C:\Windows\System\kLdfmzY.exe
  2⤵
  PID:9076
- C:\Windows\System\Gbpylye.exe
  C:\Windows\System\Gbpylye.exe
  2⤵
  PID:9104
- C:\Windows\System\Ubckemw.exe
  C:\Windows\System\Ubckemw.exe
  2⤵
  PID:9132
- C:\Windows\System\XKCOBDx.exe
  C:\Windows\System\XKCOBDx.exe
  2⤵
  PID:9172
- C:\Windows\System\bdfSTNX.exe
  C:\Windows\System\bdfSTNX.exe
  2⤵
  PID:9196
- C:\Windows\System\ZywDpfU.exe
  C:\Windows\System\ZywDpfU.exe
  2⤵
  PID:7500
- C:\Windows\System\tugakIY.exe
  C:\Windows\System\tugakIY.exe
  2⤵
  PID:8244
- C:\Windows\System\sUJcVcR.exe
  C:\Windows\System\sUJcVcR.exe
  2⤵
  PID:8308
- C:\Windows\System\LlwKyXU.exe
  C:\Windows\System\LlwKyXU.exe
  2⤵
  PID:8368
- C:\Windows\System\UwaGuMv.exe
  C:\Windows\System\UwaGuMv.exe
  2⤵
  PID:8424
- C:\Windows\System\EtDUisE.exe
  C:\Windows\System\EtDUisE.exe
  2⤵
  PID:8456
- C:\Windows\System\hDaLzdp.exe
  C:\Windows\System\hDaLzdp.exe
  2⤵
  PID:8976
- C:\Windows\System\EYLOitW.exe
  C:\Windows\System\EYLOitW.exe
  2⤵
  PID:9052
- C:\Windows\System\LPkaeLK.exe
  C:\Windows\System\LPkaeLK.exe
  2⤵
  PID:9120
- C:\Windows\System\BcWuHdp.exe
  C:\Windows\System\BcWuHdp.exe
  2⤵
  PID:8236
- C:\Windows\System\tgxmhtt.exe
  C:\Windows\System\tgxmhtt.exe
  2⤵
  PID:8396
- C:\Windows\System\SPIWnuy.exe
  C:\Windows\System\SPIWnuy.exe
  2⤵
  PID:8580
- C:\Windows\System\ympCqqd.exe
  C:\Windows\System\ympCqqd.exe
  2⤵
  PID:8692
- C:\Windows\System\ObjUFtO.exe
  C:\Windows\System\ObjUFtO.exe
  2⤵
  PID:8604
- C:\Windows\System\cPKjZfE.exe
  C:\Windows\System\cPKjZfE.exe
  2⤵
  PID:8760
- C:\Windows\System\iLaclda.exe
  C:\Windows\System\iLaclda.exe
  2⤵
  PID:8656
- C:\Windows\System\ZFwkRqj.exe
  C:\Windows\System\ZFwkRqj.exe
  2⤵
  PID:8924
- C:\Windows\System\rLqkNpY.exe
  C:\Windows\System\rLqkNpY.exe
  2⤵
  PID:8956
- C:\Windows\System\OwMNNSJ.exe
  C:\Windows\System\OwMNNSJ.exe
  2⤵
  PID:8832
- C:\Windows\System\jLvqxlt.exe
  C:\Windows\System\jLvqxlt.exe
  2⤵
  PID:9028
- C:\Windows\System\nrIJODn.exe
  C:\Windows\System\nrIJODn.exe
  2⤵
  PID:9184
- C:\Windows\System\LbkhEDR.exe
  C:\Windows\System\LbkhEDR.exe
  2⤵
  PID:8448
- C:\Windows\System\YoCkGve.exe
  C:\Windows\System\YoCkGve.exe
  2⤵
  PID:8444
- C:\Windows\System\PeSlDeU.exe
  C:\Windows\System\PeSlDeU.exe
  2⤵
  PID:8972
- C:\Windows\System\KFXNplp.exe
  C:\Windows\System\KFXNplp.exe
  2⤵
  PID:9092
- C:\Windows\System\YnNIMtf.exe
  C:\Windows\System\YnNIMtf.exe
  2⤵
  PID:8848
- C:\Windows\System\HTRnUga.exe
  C:\Windows\System\HTRnUga.exe
  2⤵
  PID:9128
- C:\Windows\System\wOHEzgE.exe
  C:\Windows\System\wOHEzgE.exe
  2⤵
  PID:9236
- C:\Windows\System\lUIGPNs.exe
  C:\Windows\System\lUIGPNs.exe
  2⤵
  PID:9256
- C:\Windows\System\NsKZbrX.exe
  C:\Windows\System\NsKZbrX.exe
  2⤵
  PID:9280
- C:\Windows\System\OPZUipY.exe
  C:\Windows\System\OPZUipY.exe
  2⤵
  PID:9308
- C:\Windows\System\HteHDgw.exe
  C:\Windows\System\HteHDgw.exe
  2⤵
  PID:9336
- C:\Windows\System\lrQORHf.exe
  C:\Windows\System\lrQORHf.exe
  2⤵
  PID:9356
- C:\Windows\System\wemknfe.exe
  C:\Windows\System\wemknfe.exe
  2⤵
  PID:9396
- C:\Windows\System\oEUwkap.exe
  C:\Windows\System\oEUwkap.exe
  2⤵
  PID:9416
- C:\Windows\System\RPRomKx.exe
  C:\Windows\System\RPRomKx.exe
  2⤵
  PID:9436
- C:\Windows\System\NXApcRw.exe
  C:\Windows\System\NXApcRw.exe
  2⤵
  PID:9460
- C:\Windows\System\noQWRzo.exe
  C:\Windows\System\noQWRzo.exe
  2⤵
  PID:9492
- C:\Windows\System\PfWJCZj.exe
  C:\Windows\System\PfWJCZj.exe
  2⤵
  PID:9548
- C:\Windows\System\YtbMczO.exe
  C:\Windows\System\YtbMczO.exe
  2⤵
  PID:9572
- C:\Windows\System\THgpPPe.exe
  C:\Windows\System\THgpPPe.exe
  2⤵
  PID:9608
- C:\Windows\System\HhOkMvw.exe
  C:\Windows\System\HhOkMvw.exe
  2⤵
  PID:9636
- C:\Windows\System\RsOlcQk.exe
  C:\Windows\System\RsOlcQk.exe
  2⤵
  PID:9668
- C:\Windows\System\vefMYpw.exe
  C:\Windows\System\vefMYpw.exe
  2⤵
  PID:9692
- C:\Windows\System\vzQYdXB.exe
  C:\Windows\System\vzQYdXB.exe
  2⤵
  PID:9724
- C:\Windows\System\FioLQBi.exe
  C:\Windows\System\FioLQBi.exe
  2⤵
  PID:9744
- C:\Windows\System\CgrHXnL.exe
  C:\Windows\System\CgrHXnL.exe
  2⤵
  PID:9768
- C:\Windows\System\bzatEDW.exe
  C:\Windows\System\bzatEDW.exe
  2⤵
  PID:9796
- C:\Windows\System\xfIZsJs.exe
  C:\Windows\System\xfIZsJs.exe
  2⤵
  PID:9824
- C:\Windows\System\EMCFOGp.exe
  C:\Windows\System\EMCFOGp.exe
  2⤵
  PID:9852
- C:\Windows\System\XCNUQAQ.exe
  C:\Windows\System\XCNUQAQ.exe
  2⤵
  PID:9872
- C:\Windows\System\tdbjoXy.exe
  C:\Windows\System\tdbjoXy.exe
  2⤵
  PID:9900
- C:\Windows\System\XNtCpyz.exe
  C:\Windows\System\XNtCpyz.exe
  2⤵
  PID:9940
- C:\Windows\System\uLPgytr.exe
  C:\Windows\System\uLPgytr.exe
  2⤵
  PID:9960
- C:\Windows\System\UdtetnA.exe
  C:\Windows\System\UdtetnA.exe
  2⤵
  PID:9992
- C:\Windows\System\XJlTpMP.exe
  C:\Windows\System\XJlTpMP.exe
  2⤵
  PID:10008
- C:\Windows\System\SzzLYVb.exe
  C:\Windows\System\SzzLYVb.exe
  2⤵
  PID:10040
- C:\Windows\System\JKXHeIF.exe
  C:\Windows\System\JKXHeIF.exe
  2⤵
  PID:10064
- C:\Windows\System\apexNAe.exe
  C:\Windows\System\apexNAe.exe
  2⤵
  PID:10080
- C:\Windows\System\MmUKqOO.exe
  C:\Windows\System\MmUKqOO.exe
  2⤵
  PID:10108
- C:\Windows\System\mTGiZAB.exe
  C:\Windows\System\mTGiZAB.exe
  2⤵
  PID:10136
- C:\Windows\System\OnuBriD.exe
  C:\Windows\System\OnuBriD.exe
  2⤵
  PID:10160
- C:\Windows\System\NLGoLwr.exe
  C:\Windows\System\NLGoLwr.exe
  2⤵
  PID:10188
- C:\Windows\System\iSURbQE.exe
  C:\Windows\System\iSURbQE.exe
  2⤵
  PID:10220
- C:\Windows\System\TOoUORq.exe
  C:\Windows\System\TOoUORq.exe
  2⤵
  PID:9276
- C:\Windows\System\KSijJrl.exe
  C:\Windows\System\KSijJrl.exe
  2⤵
  PID:9364
- C:\Windows\System\KJLfLGz.exe
  C:\Windows\System\KJLfLGz.exe
  2⤵
  PID:9376
- C:\Windows\System\DvpdtQw.exe
  C:\Windows\System\DvpdtQw.exe
  2⤵
  PID:9456
- C:\Windows\System\XUqHFYT.exe
  C:\Windows\System\XUqHFYT.exe
  2⤵
  PID:9520
- C:\Windows\System\xrTmVsL.exe
  C:\Windows\System\xrTmVsL.exe
  2⤵
  PID:9596
- C:\Windows\System\ITYQUeq.exe
  C:\Windows\System\ITYQUeq.exe
  2⤵
  PID:9628
- C:\Windows\System\lPRNuat.exe
  C:\Windows\System\lPRNuat.exe
  2⤵
  PID:9716
- C:\Windows\System\pkcensh.exe
  C:\Windows\System\pkcensh.exe
  2⤵
  PID:9752
- C:\Windows\System\RZokeFH.exe
  C:\Windows\System\RZokeFH.exe
  2⤵
  PID:9836
- C:\Windows\System\ElsYBpS.exe
  C:\Windows\System\ElsYBpS.exe
  2⤵
  PID:9936
- C:\Windows\System\SAbHRbV.exe
  C:\Windows\System\SAbHRbV.exe
  2⤵
  PID:10024
- C:\Windows\System\zEBhaiO.exe
  C:\Windows\System\zEBhaiO.exe
  2⤵
  PID:10028
- C:\Windows\System\qlpcPzN.exe
  C:\Windows\System\qlpcPzN.exe
  2⤵
  PID:10120
- C:\Windows\System\JqADRVb.exe
  C:\Windows\System\JqADRVb.exe
  2⤵
  PID:10148
- C:\Windows\System\DZDqtum.exe
  C:\Windows\System\DZDqtum.exe
  2⤵
  PID:10212
- C:\Windows\System\hlArmlH.exe
  C:\Windows\System\hlArmlH.exe
  2⤵
  PID:9268
- C:\Windows\System\DQReHbM.exe
  C:\Windows\System\DQReHbM.exe
  2⤵
  PID:9408
- C:\Windows\System\PjIoGjU.exe
  C:\Windows\System\PjIoGjU.exe
  2⤵
  PID:9056
- C:\Windows\System\RwgVYNA.exe
  C:\Windows\System\RwgVYNA.exe
  2⤵
  PID:9764
- C:\Windows\System\NfrQmgf.exe
  C:\Windows\System\NfrQmgf.exe
  2⤵
  PID:9932
- C:\Windows\System\VqwUrMS.exe
  C:\Windows\System\VqwUrMS.exe
  2⤵
  PID:8216
- C:\Windows\System\LVXsUul.exe
  C:\Windows\System\LVXsUul.exe
  2⤵
  PID:9264
- C:\Windows\System\Moqdylr.exe
  C:\Windows\System\Moqdylr.exe
  2⤵
  PID:9344
- C:\Windows\System\BctJdZZ.exe
  C:\Windows\System\BctJdZZ.exe
  2⤵
  PID:9712
- C:\Windows\System\myXhTRI.exe
  C:\Windows\System\myXhTRI.exe
  2⤵
  PID:10092
- C:\Windows\System\LXSRaYf.exe
  C:\Windows\System\LXSRaYf.exe
  2⤵
  PID:10248
- C:\Windows\System\nOXqTCP.exe
  C:\Windows\System\nOXqTCP.exe
  2⤵
  PID:10264
- C:\Windows\System\AJEmvGQ.exe
  C:\Windows\System\AJEmvGQ.exe
  2⤵
  PID:10280
- C:\Windows\System\NprprET.exe
  C:\Windows\System\NprprET.exe
  2⤵
  PID:10308
- C:\Windows\System\uTnAyKu.exe
  C:\Windows\System\uTnAyKu.exe
  2⤵
  PID:10328
- C:\Windows\System\NKmMWNh.exe
  C:\Windows\System\NKmMWNh.exe
  2⤵
  PID:10368
- C:\Windows\System\nVZwQwE.exe
  C:\Windows\System\nVZwQwE.exe
  2⤵
  PID:10392
- C:\Windows\System\ZHMBJbE.exe
  C:\Windows\System\ZHMBJbE.exe
  2⤵
  PID:10432
- C:\Windows\System\nDnEAwl.exe
  C:\Windows\System\nDnEAwl.exe
  2⤵
  PID:10472
- C:\Windows\System\OJAFHUl.exe
  C:\Windows\System\OJAFHUl.exe
  2⤵
  PID:10492
- C:\Windows\System\linnxhI.exe
  C:\Windows\System\linnxhI.exe
  2⤵
  PID:10508
- C:\Windows\System\hYJseyN.exe
  C:\Windows\System\hYJseyN.exe
  2⤵
  PID:10528
- C:\Windows\System\NEgGJQC.exe
  C:\Windows\System\NEgGJQC.exe
  2⤵
  PID:10556
- C:\Windows\System\NjCpyyr.exe
  C:\Windows\System\NjCpyyr.exe
  2⤵
  PID:10592
- C:\Windows\System\MIfkndJ.exe
  C:\Windows\System\MIfkndJ.exe
  2⤵
  PID:10608
- C:\Windows\System\Zxqcisx.exe
  C:\Windows\System\Zxqcisx.exe
  2⤵
  PID:10664
- C:\Windows\System\bgoCPGA.exe
  C:\Windows\System\bgoCPGA.exe
  2⤵
  PID:10696
- C:\Windows\System\boGiDUx.exe
  C:\Windows\System\boGiDUx.exe
  2⤵
  PID:10736
- C:\Windows\System\DpcnVlD.exe
  C:\Windows\System\DpcnVlD.exe
  2⤵
  PID:10780
- C:\Windows\System\ogFyRVh.exe
  C:\Windows\System\ogFyRVh.exe
  2⤵
  PID:10800
- C:\Windows\System\FBbdmlp.exe
  C:\Windows\System\FBbdmlp.exe
  2⤵
  PID:10824
- C:\Windows\System\SZqFcFB.exe
  C:\Windows\System\SZqFcFB.exe
  2⤵
  PID:10840
- C:\Windows\System\BKSELvD.exe
  C:\Windows\System\BKSELvD.exe
  2⤵
  PID:10856
- C:\Windows\System\MyofxDG.exe
  C:\Windows\System\MyofxDG.exe
  2⤵
  PID:10876
- C:\Windows\System\QbCAqgQ.exe
  C:\Windows\System\QbCAqgQ.exe
  2⤵
  PID:10900
- C:\Windows\System\QpykWbg.exe
  C:\Windows\System\QpykWbg.exe
  2⤵
  PID:10948
- C:\Windows\System\GlODAjH.exe
  C:\Windows\System\GlODAjH.exe
  2⤵
  PID:10968
- C:\Windows\System\QULkqiS.exe
  C:\Windows\System\QULkqiS.exe
  2⤵
  PID:10984
- C:\Windows\System\XEmurVs.exe
  C:\Windows\System\XEmurVs.exe
  2⤵
  PID:11000
- C:\Windows\System\wlpXlKk.exe
  C:\Windows\System\wlpXlKk.exe
  2⤵
  PID:11032
- C:\Windows\System\vjYTXLj.exe
  C:\Windows\System\vjYTXLj.exe
  2⤵
  PID:11084
- C:\Windows\System\MxGmskQ.exe
  C:\Windows\System\MxGmskQ.exe
  2⤵
  PID:11132
- C:\Windows\System\EBueDdz.exe
  C:\Windows\System\EBueDdz.exe
  2⤵
  PID:11160
- C:\Windows\System\qnIoOKe.exe
  C:\Windows\System\qnIoOKe.exe
  2⤵
  PID:11184
- C:\Windows\System\JCTOKeq.exe
  C:\Windows\System\JCTOKeq.exe
  2⤵
  PID:11216
- C:\Windows\System\sIhcGtK.exe
  C:\Windows\System\sIhcGtK.exe
  2⤵
  PID:11236
- C:\Windows\System\qvyqKhs.exe
  C:\Windows\System\qvyqKhs.exe
  2⤵
  PID:11260
- C:\Windows\System\aXfBpjh.exe
  C:\Windows\System\aXfBpjh.exe
  2⤵
  PID:10056
- C:\Windows\System\eqPzLxp.exe
  C:\Windows\System\eqPzLxp.exe
  2⤵
  PID:10292
- C:\Windows\System\PtkkLNc.exe
  C:\Windows\System\PtkkLNc.exe
  2⤵
  PID:10456
- C:\Windows\System\tKMwpXm.exe
  C:\Windows\System\tKMwpXm.exe
  2⤵
  PID:10440
- C:\Windows\System\usGAdmr.exe
  C:\Windows\System\usGAdmr.exe
  2⤵
  PID:10536
- C:\Windows\System\ImLHMRR.exe
  C:\Windows\System\ImLHMRR.exe
  2⤵
  PID:10544
- C:\Windows\System\PiFxbTu.exe
  C:\Windows\System\PiFxbTu.exe
  2⤵
  PID:10624
- C:\Windows\System\FJytHsS.exe
  C:\Windows\System\FJytHsS.exe
  2⤵
  PID:10660
- C:\Windows\System\XzlDygU.exe
  C:\Windows\System\XzlDygU.exe
  2⤵
  PID:10820
- C:\Windows\System\IFacLbU.exe
  C:\Windows\System\IFacLbU.exe
  2⤵
  PID:10788
- C:\Windows\System\EpZJfin.exe
  C:\Windows\System\EpZJfin.exe
  2⤵
  PID:10936
- C:\Windows\System\NuhPXgS.exe
  C:\Windows\System\NuhPXgS.exe
  2⤵
  PID:10980
- C:\Windows\System\iTpcxlr.exe
  C:\Windows\System\iTpcxlr.exe
  2⤵
  PID:11060
- C:\Windows\System\KsxrquY.exe
  C:\Windows\System\KsxrquY.exe
  2⤵
  PID:11024
- C:\Windows\System\jrhlfjP.exe
  C:\Windows\System\jrhlfjP.exe
  2⤵
  PID:11128
- C:\Windows\System\aWuPmPw.exe
  C:\Windows\System\aWuPmPw.exe
  2⤵
  PID:11172
- C:\Windows\System\hATUkqF.exe
  C:\Windows\System\hATUkqF.exe
  2⤵
  PID:10260
- C:\Windows\System\deyfqyH.exe
  C:\Windows\System\deyfqyH.exe
  2⤵
  PID:10376
- C:\Windows\System\HOUPPWX.exe
  C:\Windows\System\HOUPPWX.exe
  2⤵
  PID:10524
- C:\Windows\System\WaSUVue.exe
  C:\Windows\System\WaSUVue.exe
  2⤵
  PID:10552
- C:\Windows\System\dnRzQCx.exe
  C:\Windows\System\dnRzQCx.exe
  2⤵
  PID:10832
- C:\Windows\System\SDKaTWC.exe
  C:\Windows\System\SDKaTWC.exe
  2⤵
  PID:10960
- C:\Windows\System\cppNJzP.exe
  C:\Windows\System\cppNJzP.exe
  2⤵
  PID:11204
- C:\Windows\System\NxITOmq.exe
  C:\Windows\System\NxITOmq.exe
  2⤵
  PID:11232
- C:\Windows\System\ZybdTyC.exe
  C:\Windows\System\ZybdTyC.exe
  2⤵
  PID:10564
- C:\Windows\System\EIFLHIR.exe
  C:\Windows\System\EIFLHIR.exe
  2⤵
  PID:11072
- C:\Windows\System\TkcKExX.exe
  C:\Windows\System\TkcKExX.exe
  2⤵
  PID:10452
- C:\Windows\System\njGEgOF.exe
  C:\Windows\System\njGEgOF.exe
  2⤵
  PID:11276
- C:\Windows\System\RZjosYE.exe
  C:\Windows\System\RZjosYE.exe
  2⤵
  PID:11296
- C:\Windows\System\PNpmBWu.exe
  C:\Windows\System\PNpmBWu.exe
  2⤵
  PID:11340
- C:\Windows\System\LydeboG.exe
  C:\Windows\System\LydeboG.exe
  2⤵
  PID:11360
- C:\Windows\System\UDKcwcF.exe
  C:\Windows\System\UDKcwcF.exe
  2⤵
  PID:11384
- C:\Windows\System\nMYzQZW.exe
  C:\Windows\System\nMYzQZW.exe
  2⤵
  PID:11400
- C:\Windows\System\PkRMKQk.exe
  C:\Windows\System\PkRMKQk.exe
  2⤵
  PID:11428
- C:\Windows\System\RsetMpQ.exe
  C:\Windows\System\RsetMpQ.exe
  2⤵
  PID:11492
- C:\Windows\System\CKpKfoq.exe
  C:\Windows\System\CKpKfoq.exe
  2⤵
  PID:11512
- C:\Windows\System\flDFmCW.exe
  C:\Windows\System\flDFmCW.exe
  2⤵
  PID:11548
- C:\Windows\System\MUGCuGp.exe
  C:\Windows\System\MUGCuGp.exe
  2⤵
  PID:11576
- C:\Windows\System\QahUWwa.exe
  C:\Windows\System\QahUWwa.exe
  2⤵
  PID:11604
- C:\Windows\System\yvuqQsD.exe
  C:\Windows\System\yvuqQsD.exe
  2⤵
  PID:11632
- C:\Windows\System\blnzTsd.exe
  C:\Windows\System\blnzTsd.exe
  2⤵
  PID:11660
- C:\Windows\System\RxkVKFs.exe
  C:\Windows\System\RxkVKFs.exe
  2⤵
  PID:11676
- C:\Windows\System\usRbZpw.exe
  C:\Windows\System\usRbZpw.exe
  2⤵
  PID:11692
- C:\Windows\System\qecIFmA.exe
  C:\Windows\System\qecIFmA.exe
  2⤵
  PID:11708
- C:\Windows\System\yQxjLBD.exe
  C:\Windows\System\yQxjLBD.exe
  2⤵
  PID:11724
- C:\Windows\System\WjsOqUP.exe
  C:\Windows\System\WjsOqUP.exe
  2⤵
  PID:11756
- C:\Windows\System\bPNlFCb.exe
  C:\Windows\System\bPNlFCb.exe
  2⤵
  PID:11780
- C:\Windows\System\vVcjGEh.exe
  C:\Windows\System\vVcjGEh.exe
  2⤵
  PID:11808
- C:\Windows\System\vQtvfKa.exe
  C:\Windows\System\vQtvfKa.exe
  2⤵
  PID:11840
- C:\Windows\System\SNtBBEt.exe
  C:\Windows\System\SNtBBEt.exe
  2⤵
  PID:11872
- C:\Windows\System\fSjslUe.exe
  C:\Windows\System\fSjslUe.exe
  2⤵
  PID:11900
- C:\Windows\System\PFFxMDp.exe
  C:\Windows\System\PFFxMDp.exe
  2⤵
  PID:11932
- C:\Windows\System\qMpYVsI.exe
  C:\Windows\System\qMpYVsI.exe
  2⤵
  PID:11956
- C:\Windows\System\lAnPQaZ.exe
  C:\Windows\System\lAnPQaZ.exe
  2⤵
  PID:11980
- C:\Windows\System\YWOFKAd.exe
  C:\Windows\System\YWOFKAd.exe
  2⤵
  PID:12020
- C:\Windows\System\plnZVHu.exe
  C:\Windows\System\plnZVHu.exe
  2⤵
  PID:12068
- C:\Windows\System\CBgAoru.exe
  C:\Windows\System\CBgAoru.exe
  2⤵
  PID:12088
- C:\Windows\System\dUPLdHz.exe
  C:\Windows\System\dUPLdHz.exe
  2⤵
  PID:12112
- C:\Windows\System\jeqFjxC.exe
  C:\Windows\System\jeqFjxC.exe
  2⤵
  PID:12140
- C:\Windows\System\wtpYcoY.exe
  C:\Windows\System\wtpYcoY.exe
  2⤵
  PID:12196
- C:\Windows\System\IDwOczs.exe
  C:\Windows\System\IDwOczs.exe
  2⤵
  PID:12220
- C:\Windows\System\GPkltpl.exe
  C:\Windows\System\GPkltpl.exe
  2⤵
  PID:12248
- C:\Windows\System\ImPQlKS.exe
  C:\Windows\System\ImPQlKS.exe
  2⤵
  PID:12280
- C:\Windows\System\ZyGfXLi.exe
  C:\Windows\System\ZyGfXLi.exe
  2⤵
  PID:11292
- C:\Windows\System\zBcbTjW.exe
  C:\Windows\System\zBcbTjW.exe
  2⤵
  PID:11348
- C:\Windows\System\vELHTxH.exe
  C:\Windows\System\vELHTxH.exe
  2⤵
  PID:11416
- C:\Windows\System\rXmsPxx.exe
  C:\Windows\System\rXmsPxx.exe
  2⤵
  PID:11460
- C:\Windows\System\CgObmmN.exe
  C:\Windows\System\CgObmmN.exe
  2⤵
  PID:11532
- C:\Windows\System\EYHqWQT.exe
  C:\Windows\System\EYHqWQT.exe
  2⤵
  PID:11568
- C:\Windows\System\MPYzkaW.exe
  C:\Windows\System\MPYzkaW.exe
  2⤵
  PID:11652
- C:\Windows\System\eONGRAp.exe
  C:\Windows\System\eONGRAp.exe
  2⤵
  PID:11704
- C:\Windows\System\CCMVfac.exe
  C:\Windows\System\CCMVfac.exe
  2⤵
  PID:11788
- C:\Windows\System\CQPuNGY.exe
  C:\Windows\System\CQPuNGY.exe
  2⤵
  PID:11828
- C:\Windows\System\wmdflZy.exe
  C:\Windows\System\wmdflZy.exe
  2⤵
  PID:11868
- C:\Windows\System\finRQwZ.exe
  C:\Windows\System\finRQwZ.exe
  2⤵
  PID:11884
- C:\Windows\System\mQBwJya.exe
  C:\Windows\System\mQBwJya.exe
  2⤵
  PID:12004
- C:\Windows\System\sEYhmou.exe
  C:\Windows\System\sEYhmou.exe
  2⤵
  PID:12052
- C:\Windows\System\xDdqgzB.exe
  C:\Windows\System\xDdqgzB.exe
  2⤵
  PID:12076
- C:\Windows\System\tCMfGiq.exe
  C:\Windows\System\tCMfGiq.exe
  2⤵
  PID:12108
- C:\Windows\System\peQKRir.exe
  C:\Windows\System\peQKRir.exe
  2⤵
  PID:12172
- C:\Windows\System\wDhxThq.exe
  C:\Windows\System\wDhxThq.exe
  2⤵
  PID:11396
- C:\Windows\System\HDWsmSU.exe
  C:\Windows\System\HDWsmSU.exe
  2⤵
  PID:11564
- C:\Windows\System\hInkvGk.exe
  C:\Windows\System\hInkvGk.exe
  2⤵
  PID:11716
- C:\Windows\System\BqWmAId.exe
  C:\Windows\System\BqWmAId.exe
  2⤵
  PID:11912
- C:\Windows\System\ZZeVKDA.exe
  C:\Windows\System\ZZeVKDA.exe
  2⤵
  PID:11988
- C:\Windows\System\aMwEeRP.exe
  C:\Windows\System\aMwEeRP.exe
  2⤵
  PID:12104
- C:\Windows\System\NBJTOpB.exe
  C:\Windows\System\NBJTOpB.exe
  2⤵
  PID:11328
- C:\Windows\System\XXdGJvV.exe
  C:\Windows\System\XXdGJvV.exe
  2⤵
  PID:10652
- C:\Windows\System\PgzkzuW.exe
  C:\Windows\System\PgzkzuW.exe
  2⤵
  PID:11528
- C:\Windows\System\lxPfptx.exe
  C:\Windows\System\lxPfptx.exe
  2⤵
  PID:12084
- C:\Windows\System\TNejBOL.exe
  C:\Windows\System\TNejBOL.exe
  2⤵
  PID:12320
- C:\Windows\System\FgYOwnC.exe
  C:\Windows\System\FgYOwnC.exe
  2⤵
  PID:12348
- C:\Windows\System\HSDyqDr.exe
  C:\Windows\System\HSDyqDr.exe
  2⤵
  PID:12364
- C:\Windows\System\AvLdIEH.exe
  C:\Windows\System\AvLdIEH.exe
  2⤵
  PID:12400
- C:\Windows\System\BpCVhbq.exe
  C:\Windows\System\BpCVhbq.exe
  2⤵
  PID:12420
- C:\Windows\System\iBQvTif.exe
  C:\Windows\System\iBQvTif.exe
  2⤵
  PID:12448
- C:\Windows\System\rCUwRDP.exe
  C:\Windows\System\rCUwRDP.exe
  2⤵
  PID:12464
- C:\Windows\System\McHdAfV.exe
  C:\Windows\System\McHdAfV.exe
  2⤵
  PID:12488
- C:\Windows\System\MTUFAeP.exe
  C:\Windows\System\MTUFAeP.exe
  2⤵
  PID:12524
- C:\Windows\System\jPFFSii.exe
  C:\Windows\System\jPFFSii.exe
  2⤵
  PID:12552
- C:\Windows\System\aYiNZYu.exe
  C:\Windows\System\aYiNZYu.exe
  2⤵
  PID:12588
- C:\Windows\System\SkVYNIQ.exe
  C:\Windows\System\SkVYNIQ.exe
  2⤵
  PID:12612
- C:\Windows\System\DomqVlz.exe
  C:\Windows\System\DomqVlz.exe
  2⤵
  PID:12640
- C:\Windows\System\SJcKBlV.exe
  C:\Windows\System\SJcKBlV.exe
  2⤵
  PID:12684
- C:\Windows\System\nAfjDpy.exe
  C:\Windows\System\nAfjDpy.exe
  2⤵
  PID:12712
- C:\Windows\System\sbjPlBj.exe
  C:\Windows\System\sbjPlBj.exe
  2⤵
  PID:12744
- C:\Windows\System\yZZhEji.exe
  C:\Windows\System\yZZhEji.exe
  2⤵
  PID:12760
- C:\Windows\System\KMXUCMk.exe
  C:\Windows\System\KMXUCMk.exe
  2⤵
  PID:12776
- C:\Windows\System\oLsIhmw.exe
  C:\Windows\System\oLsIhmw.exe
  2⤵
  PID:12828
- C:\Windows\System\cPkUgkR.exe
  C:\Windows\System\cPkUgkR.exe
  2⤵
  PID:12844
- C:\Windows\System\QmSHUyq.exe
  C:\Windows\System\QmSHUyq.exe
  2⤵
  PID:12872
- C:\Windows\System\MMsgfDn.exe
  C:\Windows\System\MMsgfDn.exe
  2⤵
  PID:12912
- C:\Windows\System\ZwKCdCq.exe
  C:\Windows\System\ZwKCdCq.exe
  2⤵
  PID:12928
- C:\Windows\System\EJKYKDw.exe
  C:\Windows\System\EJKYKDw.exe
  2⤵
  PID:12972
- C:\Windows\System\JFOxWCE.exe
  C:\Windows\System\JFOxWCE.exe
  2⤵
  PID:13000
- C:\Windows\System\vDWrgsa.exe
  C:\Windows\System\vDWrgsa.exe
  2⤵
  PID:13040
- C:\Windows\System\PmYYoOv.exe
  C:\Windows\System\PmYYoOv.exe
  2⤵
  PID:13080
- C:\Windows\System\KljTlsV.exe
  C:\Windows\System\KljTlsV.exe
  2⤵
  PID:13108
- C:\Windows\System\GszsZyh.exe
  C:\Windows\System\GszsZyh.exe
  2⤵
  PID:13132
- C:\Windows\System\iwkQJKj.exe
  C:\Windows\System\iwkQJKj.exe
  2⤵
  PID:13188
- C:\Windows\System\lyBfWWz.exe
  C:\Windows\System\lyBfWWz.exe
  2⤵
  PID:13212
- C:\Windows\System\UVFaqev.exe
  C:\Windows\System\UVFaqev.exe
  2⤵
  PID:13244
- C:\Windows\System\ZuZEzGq.exe
  C:\Windows\System\ZuZEzGq.exe
  2⤵
  PID:13272
- C:\Windows\System\UzmgEba.exe
  C:\Windows\System\UzmgEba.exe
  2⤵
  PID:13288
- C:\Windows\System\pRMUjcA.exe
  C:\Windows\System\pRMUjcA.exe
  2⤵
  PID:12012
- C:\Windows\System\rXBUMlT.exe
  C:\Windows\System\rXBUMlT.exe
  2⤵
  PID:12300
- C:\Windows\System\BhvSjyO.exe
  C:\Windows\System\BhvSjyO.exe
  2⤵
  PID:12380
- C:\Windows\System\pPPsQab.exe
  C:\Windows\System\pPPsQab.exe
  2⤵
  PID:12436
- C:\Windows\System\howLrbr.exe
  C:\Windows\System\howLrbr.exe
  2⤵
  PID:12548
- C:\Windows\System\wNWJanG.exe
  C:\Windows\System\wNWJanG.exe
  2⤵
  PID:12516
- C:\Windows\System\aYPvvtF.exe
  C:\Windows\System\aYPvvtF.exe
  2⤵
  PID:12608
- C:\Windows\System\LKTbzkP.exe
  C:\Windows\System\LKTbzkP.exe
  2⤵
  PID:12736
- C:\Windows\System\JicMoTi.exe
  C:\Windows\System\JicMoTi.exe
  2⤵
  PID:12812
- C:\Windows\System\obFjOcc.exe
  C:\Windows\System\obFjOcc.exe
  2⤵
  PID:12856
- C:\Windows\System\HvzAFsl.exe
  C:\Windows\System\HvzAFsl.exe
  2⤵
  PID:12920
- C:\Windows\System\FlyhFpD.exe
  C:\Windows\System\FlyhFpD.exe
  2⤵
  PID:13016
- C:\Windows\System\GBjCueT.exe
  C:\Windows\System\GBjCueT.exe
  2⤵
  PID:13096
- C:\Windows\System\hYnkbRJ.exe
  C:\Windows\System\hYnkbRJ.exe
  2⤵
  PID:13172
- C:\Windows\System\EXgaqSK.exe
  C:\Windows\System\EXgaqSK.exe
  2⤵
  PID:13260
- C:\Windows\System\pWOXqir.exe
  C:\Windows\System\pWOXqir.exe
  2⤵
  PID:13300
- C:\Windows\System\GkvKEbY.exe
  C:\Windows\System\GkvKEbY.exe
  2⤵
  PID:12508
- C:\Windows\System\acRIPxg.exe
  C:\Windows\System\acRIPxg.exe
  2⤵
  PID:12500
- C:\Windows\System\EaYIZoY.exe
  C:\Windows\System\EaYIZoY.exe
  2⤵
  PID:12756
- C:\Windows\System\Isrpoeh.exe
  C:\Windows\System\Isrpoeh.exe
  2⤵
  PID:12948
- C:\Windows\System\RfADsCq.exe
  C:\Windows\System\RfADsCq.exe
  2⤵
  PID:13064
- C:\Windows\System\qptcQMx.exe
  C:\Windows\System\qptcQMx.exe
  2⤵
  PID:13228
- C:\Windows\System\rECZJGm.exe
  C:\Windows\System\rECZJGm.exe
  2⤵
  PID:10388
- C:\Windows\System\KLgpecs.exe
  C:\Windows\System\KLgpecs.exe
  2⤵
  PID:12660
- C:\Windows\System\UCvXgRR.exe
  C:\Windows\System\UCvXgRR.exe
  2⤵
  PID:12892
- C:\Windows\System\WljWygu.exe
  C:\Windows\System\WljWygu.exe
  2⤵
  PID:13152
- C:\Windows\System\OCzCeCy.exe
  C:\Windows\System\OCzCeCy.exe
  2⤵
  PID:13344
- C:\Windows\System\LELpqsu.exe
  C:\Windows\System\LELpqsu.exe
  2⤵
  PID:13368
- C:\Windows\System\KztkTxt.exe
  C:\Windows\System\KztkTxt.exe
  2⤵
  PID:13392
- C:\Windows\System\KaAAKFp.exe
  C:\Windows\System\KaAAKFp.exe
  2⤵
  PID:13436
- C:\Windows\System\TkcfUkO.exe
  C:\Windows\System\TkcfUkO.exe
  2⤵
  PID:13464
- C:\Windows\System\MqoFIfQ.exe
  C:\Windows\System\MqoFIfQ.exe
  2⤵
  PID:13492
- C:\Windows\System\XCHoCiB.exe
  C:\Windows\System\XCHoCiB.exe
  2⤵
  PID:13520
- C:\Windows\System\IhEHoKl.exe
  C:\Windows\System\IhEHoKl.exe
  2⤵
  PID:13548
- C:\Windows\System\hPFSGgl.exe
  C:\Windows\System\hPFSGgl.exe
  2⤵
  PID:13576
- C:\Windows\System\WNjGaxb.exe
  C:\Windows\System\WNjGaxb.exe
  2⤵
  PID:13604
- C:\Windows\System\UizrNkJ.exe
  C:\Windows\System\UizrNkJ.exe
  2⤵
  PID:13620
- C:\Windows\System\akPHkQu.exe
  C:\Windows\System\akPHkQu.exe
  2⤵
  PID:13652
- C:\Windows\System\XxOkJdr.exe
  C:\Windows\System\XxOkJdr.exe
  2⤵
  PID:13676
- C:\Windows\System\JnKawUT.exe
  C:\Windows\System\JnKawUT.exe
  2⤵
  PID:13704
- C:\Windows\System\pNBdiAA.exe
  C:\Windows\System\pNBdiAA.exe
  2⤵
  PID:13728
- C:\Windows\System\zAwFleG.exe
  C:\Windows\System\zAwFleG.exe
  2⤵
  PID:13756
- C:\Windows\System\ErJNvph.exe
  C:\Windows\System\ErJNvph.exe
  2⤵
  PID:13788
- C:\Windows\System\FivJLmW.exe
  C:\Windows\System\FivJLmW.exe
  2⤵
  PID:13816
- C:\Windows\System\QzkUGAT.exe
  C:\Windows\System\QzkUGAT.exe
  2⤵
  PID:13832
- C:\Windows\System\UCAyqyW.exe
  C:\Windows\System\UCAyqyW.exe
  2⤵
  PID:13868
- C:\Windows\System\dhljNGt.exe
  C:\Windows\System\dhljNGt.exe
  2⤵
  PID:13900
- C:\Windows\System\rXDdvKZ.exe
  C:\Windows\System\rXDdvKZ.exe
  2⤵
  PID:13936
- C:\Windows\System\mkvEcPn.exe
  C:\Windows\System\mkvEcPn.exe
  2⤵
  PID:13956
- C:\Windows\System\tqUloUN.exe
  C:\Windows\System\tqUloUN.exe
  2⤵
  PID:13996
- C:\Windows\System\uaFuiRt.exe
  C:\Windows\System\uaFuiRt.exe
  2⤵
  PID:14024
- C:\Windows\System\ZVZVdHo.exe
  C:\Windows\System\ZVZVdHo.exe
  2⤵
  PID:14044
- C:\Windows\System\AIBHekS.exe
  C:\Windows\System\AIBHekS.exe
  2⤵
  PID:14068
- C:\Windows\System\zhSsGtv.exe
  C:\Windows\System\zhSsGtv.exe
  2⤵
  PID:14088
- C:\Windows\System\nCdpcZo.exe
  C:\Windows\System\nCdpcZo.exe
  2⤵
  PID:14112
- C:\Windows\System\NmZMXsf.exe
  C:\Windows\System\NmZMXsf.exe
  2⤵
  PID:14152
- C:\Windows\System\wGLvNpP.exe
  C:\Windows\System\wGLvNpP.exe
  2⤵
  PID:14168
- C:\Windows\System\jBgygYf.exe
  C:\Windows\System\jBgygYf.exe
  2⤵
  PID:14212
- C:\Windows\System\AjaxeiQ.exe
  C:\Windows\System\AjaxeiQ.exe
  2⤵
  PID:14236
- C:\Windows\System\CfVmehV.exe
  C:\Windows\System\CfVmehV.exe
  2⤵
  PID:14260
- C:\Windows\System\xgTMvYc.exe
  C:\Windows\System\xgTMvYc.exe
  2⤵
  PID:14304
- C:\Windows\System\MGIGvLH.exe
  C:\Windows\System\MGIGvLH.exe
  2⤵
  PID:14320
- C:\Windows\System\SsBqYIY.exe
  C:\Windows\System\SsBqYIY.exe
  2⤵
  PID:13232
- C:\Windows\System\WFdmnEX.exe
  C:\Windows\System\WFdmnEX.exe
  2⤵
  PID:13336
- C:\Windows\System\JDgVHpW.exe
  C:\Windows\System\JDgVHpW.exe
  2⤵
  PID:13420
- C:\Windows\System\vheDpNy.exe
  C:\Windows\System\vheDpNy.exe
  2⤵
  PID:13460
- C:\Windows\System\PghRUNh.exe
  C:\Windows\System\PghRUNh.exe
  2⤵
  PID:13536
- C:\Windows\System\vnjVOFi.exe
  C:\Windows\System\vnjVOFi.exe
  2⤵
  PID:13600
- C:\Windows\System\YHRsHNg.exe
  C:\Windows\System\YHRsHNg.exe
  2⤵
  PID:13688
- C:\Windows\System\LsHUQbh.exe
  C:\Windows\System\LsHUQbh.exe
  2⤵
  PID:13724
- C:\Windows\System\sryPFOy.exe
  C:\Windows\System\sryPFOy.exe
  2⤵
  PID:13824
- C:\Windows\System\VmmkGZu.exe
  C:\Windows\System\VmmkGZu.exe
  2⤵
  PID:13852
- C:\Windows\System\JuKNfSn.exe
  C:\Windows\System\JuKNfSn.exe
  2⤵
  PID:13912
- C:\Windows\System\jOSmwPF.exe
  C:\Windows\System\jOSmwPF.exe
  2⤵
  PID:13968
- C:\Windows\System\wwsYJXY.exe
  C:\Windows\System\wwsYJXY.exe
  2⤵
  PID:14012
- C:\Windows\System\kjNIjRF.exe
  C:\Windows\System\kjNIjRF.exe
  2⤵
  PID:14104
- C:\Windows\System\LWegfkT.exe
  C:\Windows\System\LWegfkT.exe
  2⤵
  PID:14140
- C:\Windows\System\sTzWJQJ.exe
  C:\Windows\System\sTzWJQJ.exe
  2⤵
  PID:14288
- C:\Windows\System\dyGOONM.exe
  C:\Windows\System\dyGOONM.exe
  2⤵
  PID:12860
- C:\Windows\System\RRhPOMv.exe
  C:\Windows\System\RRhPOMv.exe
  2⤵
  PID:13432
- C:\Windows\System\znSuPrQ.exe
  C:\Windows\System\znSuPrQ.exe
  2⤵
  PID:12360
- C:\Windows\System\XAutnYd.exe
  C:\Windows\System\XAutnYd.exe
  2⤵
  PID:13700
- C:\Windows\System\RzTGPgT.exe
  C:\Windows\System\RzTGPgT.exe
  2⤵
  PID:13800
- C:\Windows\System\mUejtKU.exe
  C:\Windows\System\mUejtKU.exe
  2⤵
  PID:13928
- C:\Windows\System\HniKpKK.exe
  C:\Windows\System\HniKpKK.exe
  2⤵
  PID:14228
- C:\Windows\System\qYpsCOW.exe
  C:\Windows\System\qYpsCOW.exe
  2⤵
  PID:14276
- C:\Windows\System\ArlFsjf.exe
  C:\Windows\System\ArlFsjf.exe
  2⤵
  PID:13504
- C:\Windows\System\QANHjAe.exe
  C:\Windows\System\QANHjAe.exe
  2⤵
  PID:14164
- C:\Windows\System\GtZEUMs.exe
  C:\Windows\System\GtZEUMs.exe
  2⤵
  PID:13356
- C:\Windows\System\kUvDTYz.exe
  C:\Windows\System\kUvDTYz.exe
  2⤵
  PID:14160
- C:\Windows\System\VHfUFNM.exe
  C:\Windows\System\VHfUFNM.exe
  2⤵
  PID:14076
- C:\Windows\System\HcArDxa.exe
  C:\Windows\System\HcArDxa.exe
  2⤵
  PID:14364
- C:\Windows\System\DbVBGKd.exe
  C:\Windows\System\DbVBGKd.exe
  2⤵
  PID:14392
- C:\Windows\System\JcGbpMN.exe
  C:\Windows\System\JcGbpMN.exe
  2⤵
  PID:14416
- C:\Windows\System\RqVXMiL.exe
  C:\Windows\System\RqVXMiL.exe
  2⤵
  PID:14448
- C:\Windows\System\AUtdKVp.exe
  C:\Windows\System\AUtdKVp.exe
  2⤵
  PID:14464
- C:\Windows\System\LULtaGo.exe
  C:\Windows\System\LULtaGo.exe
  2⤵
  PID:14508
- C:\Windows\System\skpiugW.exe
  C:\Windows\System\skpiugW.exe
  2⤵
  PID:14532
- C:\Windows\System\pjCcTAx.exe
  C:\Windows\System\pjCcTAx.exe
  2⤵
  PID:14560
- C:\Windows\System\mNRJDtB.exe
  C:\Windows\System\mNRJDtB.exe
  2⤵
  PID:14588
- C:\Windows\System\KhnnRji.exe
  C:\Windows\System\KhnnRji.exe
  2⤵
  PID:14608
- C:\Windows\System\hlBEEYb.exe
  C:\Windows\System\hlBEEYb.exe
  2⤵
  PID:14628
- C:\Windows\System\tuAzbsO.exe
  C:\Windows\System\tuAzbsO.exe
  2⤵
  PID:14660
- C:\Windows\System\UBWBtgE.exe
  C:\Windows\System\UBWBtgE.exe
  2⤵
  PID:14700
- C:\Windows\System\nxxQsDI.exe
  C:\Windows\System\nxxQsDI.exe
  2⤵
  PID:14716
- C:\Windows\System\XJPavpl.exe
  C:\Windows\System\XJPavpl.exe
  2⤵
  PID:14736
- C:\Windows\System\aCDeAem.exe
  C:\Windows\System\aCDeAem.exe
  2⤵
  PID:14764
- C:\Windows\System\PBFZWgh.exe
  C:\Windows\System\PBFZWgh.exe
  2⤵
  PID:14804
- C:\Windows\System\mLYzFSN.exe
  C:\Windows\System\mLYzFSN.exe
  2⤵
  PID:14840
- C:\Windows\System\dBbMLfx.exe
  C:\Windows\System\dBbMLfx.exe
  2⤵
  PID:14856
- C:\Windows\System\ALZNLhD.exe
  C:\Windows\System\ALZNLhD.exe
  2⤵
  PID:14900
- C:\Windows\System\lCNoOdi.exe
  C:\Windows\System\lCNoOdi.exe
  2⤵
  PID:14924
- C:\Windows\System\qgqkLhM.exe
  C:\Windows\System\qgqkLhM.exe
  2⤵
  PID:14940
- C:\Windows\System\dftLkdf.exe
  C:\Windows\System\dftLkdf.exe
  2⤵
  PID:14980
- C:\Windows\System\tfbDbfQ.exe
  C:\Windows\System\tfbDbfQ.exe
  2⤵
  PID:15020
- C:\Windows\System\EtxpsQa.exe
  C:\Windows\System\EtxpsQa.exe
  2⤵
  PID:15036
- C:\Windows\System\kZyJWlS.exe
  C:\Windows\System\kZyJWlS.exe
  2⤵
  PID:15052
- C:\Windows\System\smbSROK.exe
  C:\Windows\System\smbSROK.exe
  2⤵
  PID:15068
- C:\Windows\System\HigFYkW.exe
  C:\Windows\System\HigFYkW.exe
  2⤵
  PID:15120
- C:\Windows\System\buzaSbj.exe
  C:\Windows\System\buzaSbj.exe
  2⤵
  PID:15144
- C:\Windows\System\vwzycwd.exe
  C:\Windows\System\vwzycwd.exe
  2⤵
  PID:15172
- C:\Windows\System\DfOVngL.exe
  C:\Windows\System\DfOVngL.exe
  2⤵
  PID:15192
- C:\Windows\System\fSfzvAg.exe
  C:\Windows\System\fSfzvAg.exe
  2⤵
  PID:15244
- C:\Windows\System\tMTAsZR.exe
  C:\Windows\System\tMTAsZR.exe
  2⤵
  PID:15260
- C:\Windows\System\maxPfxi.exe
  C:\Windows\System\maxPfxi.exe
  2⤵
  PID:15280
- C:\Windows\System\ylKfOIL.exe
  C:\Windows\System\ylKfOIL.exe
  2⤵
  PID:15308
- C:\Windows\System\WuVneCU.exe
  C:\Windows\System\WuVneCU.exe
  2⤵
  PID:15324
- C:\Windows\System\wXOmGnh.exe
  C:\Windows\System\wXOmGnh.exe
  2⤵
  PID:15356
- C:\Windows\System\RucCgkj.exe
  C:\Windows\System\RucCgkj.exe
  2⤵
  PID:14376
- C:\Windows\System\LCgNLSE.exe
  C:\Windows\System\LCgNLSE.exe
  2⤵
  PID:14460
- C:\Windows\System\rgdTgGF.exe
  C:\Windows\System\rgdTgGF.exe
  2⤵
  PID:14516
- C:\Windows\System\AKkNmZP.exe
  C:\Windows\System\AKkNmZP.exe
  2⤵
  PID:14548
- C:\Windows\System\hvdbymy.exe
  C:\Windows\System\hvdbymy.exe
  2⤵
  PID:14732
- C:\Windows\System\zvGpRec.exe
  C:\Windows\System\zvGpRec.exe
  2⤵
  PID:14788
- C:\Windows\System\VdUaEve.exe
  C:\Windows\System\VdUaEve.exe
  2⤵
  PID:14892
- C:\Windows\System\ltvkYcJ.exe
  C:\Windows\System\ltvkYcJ.exe
  2⤵
  PID:14888
- C:\Windows\System\FqbiQHK.exe
  C:\Windows\System\FqbiQHK.exe
  2⤵
  PID:14976
- C:\Windows\System\orTRUGv.exe
  C:\Windows\System\orTRUGv.exe
  2⤵
  PID:15028
- C:\Windows\System\HRymkYU.exe
  C:\Windows\System\HRymkYU.exe
  2⤵
  PID:15136
- C:\Windows\System\yQPPKVJ.exe
  C:\Windows\System\yQPPKVJ.exe
  2⤵
  PID:15204
- C:\Windows\System\CRCoPiK.exe
  C:\Windows\System\CRCoPiK.exe
  2⤵
  PID:15240
- C:\Windows\System\cXleZWg.exe
  C:\Windows\System\cXleZWg.exe
  2⤵
  PID:15276
- C:\Windows\System\FostOBR.exe
  C:\Windows\System\FostOBR.exe
  2⤵
  PID:14400
- C:\Windows\System\ONHJBlY.exe
  C:\Windows\System\ONHJBlY.exe
  2⤵
  PID:14348
- C:\Windows\System\LwiiAjm.exe
  C:\Windows\System\LwiiAjm.exe
  2⤵
  PID:14576
- C:\Windows\System\LPWWsbh.exe
  C:\Windows\System\LPWWsbh.exe
  2⤵
  PID:14760
- C:\Windows\System\GbbBkrS.exe
  C:\Windows\System\GbbBkrS.exe
  2⤵
  PID:14824
- C:\Windows\System\zgEirDS.exe
  C:\Windows\System\zgEirDS.exe
  2⤵
  PID:15092
- C:\Windows\System\RhisNAf.exe
  C:\Windows\System\RhisNAf.exe
  2⤵
  PID:15188
- C:\Windows\System\vTIDHpj.exe
  C:\Windows\System\vTIDHpj.exe
  2⤵
  PID:14492
- C:\Windows\System\UQURocD.exe
  C:\Windows\System\UQURocD.exe
  2⤵
  PID:14580
- C:\Windows\System\GWMhkSa.exe
  C:\Windows\System\GWMhkSa.exe
  2⤵
  PID:14812
- C:\Windows\System\vfepZnq.exe
  C:\Windows\System\vfepZnq.exe
  2⤵
  PID:14876
- C:\Windows\System\qSiMRke.exe
  C:\Windows\System\qSiMRke.exe
  2⤵
  PID:15380
- C:\Windows\System\xhZzIPV.exe
  C:\Windows\System\xhZzIPV.exe
  2⤵
  PID:15400
- C:\Windows\System\hmJRaQY.exe
  C:\Windows\System\hmJRaQY.exe
  2⤵
  PID:15428
- C:\Windows\System\JQDQcGQ.exe
  C:\Windows\System\JQDQcGQ.exe
  2⤵
  PID:15472
- C:\Windows\System\trzbxmN.exe
  C:\Windows\System\trzbxmN.exe
  2⤵
  PID:15488
- C:\Windows\System\vfDrttK.exe
  C:\Windows\System\vfDrttK.exe
  2⤵
  PID:15516
- C:\Windows\System\miWTIyL.exe
  C:\Windows\System\miWTIyL.exe
  2⤵
  PID:15556
- C:\Windows\System\SVPJYPK.exe
  C:\Windows\System\SVPJYPK.exe
  2⤵
  PID:15572
- C:\Windows\System\rzDkAMk.exe
  C:\Windows\System\rzDkAMk.exe
  2⤵
  PID:15604
- C:\Windows\System\HvdkHTZ.exe
  C:\Windows\System\HvdkHTZ.exe
  2⤵
  PID:15632
- C:\Windows\System\lfkTiVF.exe
  C:\Windows\System\lfkTiVF.exe
  2⤵
  PID:15656
- C:\Windows\System\FlGYvlf.exe
  C:\Windows\System\FlGYvlf.exe
  2⤵
  PID:15680
- C:\Windows\System\aSZeCOU.exe
  C:\Windows\System\aSZeCOU.exe
  2⤵
  PID:15728
- C:\Windows\System\lJmCWrG.exe
  C:\Windows\System\lJmCWrG.exe
  2⤵
  PID:15752
- C:\Windows\System\cnIxlel.exe
  C:\Windows\System\cnIxlel.exe
  2⤵
  PID:15776
- C:\Windows\System\ogMnvUK.exe
  C:\Windows\System\ogMnvUK.exe
  2⤵
  PID:15820
- C:\Windows\System\OSmPFJz.exe
  C:\Windows\System\OSmPFJz.exe
  2⤵
  PID:15836
- C:\Windows\System\SuvkYLE.exe
  C:\Windows\System\SuvkYLE.exe
  2⤵
  PID:15856
- C:\Windows\System\JzQnqym.exe
  C:\Windows\System\JzQnqym.exe
  2⤵
  PID:15876
- C:\Windows\System\kIhkTnz.exe
  C:\Windows\System\kIhkTnz.exe
  2⤵
  PID:15904
- C:\Windows\System\nxQiDeR.exe
  C:\Windows\System\nxQiDeR.exe
  2⤵
  PID:15952
- C:\Windows\System\pxxnXha.exe
  C:\Windows\System\pxxnXha.exe
  2⤵
  PID:15988
- C:\Windows\System\lqaRpkr.exe
  C:\Windows\System\lqaRpkr.exe
  2⤵
  PID:16004
- C:\Windows\System\CvdHMcL.exe
  C:\Windows\System\CvdHMcL.exe
  2⤵
  PID:16032
- C:\Windows\System\JThIGiL.exe
  C:\Windows\System\JThIGiL.exe
  2⤵
  PID:16056
- C:\Windows\System\BQzVQrD.exe
  C:\Windows\System\BQzVQrD.exe
  2⤵
  PID:16112
- C:\Windows\System\PoGtVxz.exe
  C:\Windows\System\PoGtVxz.exe
  2⤵
  PID:16128
- C:\Windows\System\yGtxZtr.exe
  C:\Windows\System\yGtxZtr.exe
  2⤵
  PID:16148
- C:\Windows\System\SQbhANF.exe
  C:\Windows\System\SQbhANF.exe
  2⤵
  PID:16176
- C:\Windows\System\zdHlQou.exe
  C:\Windows\System\zdHlQou.exe
  2⤵
  PID:16200
- C:\Windows\System\iebFoop.exe
  C:\Windows\System\iebFoop.exe
  2⤵
  PID:16216
- C:\Windows\System\SWWtTLq.exe
  C:\Windows\System\SWWtTLq.exe
  2⤵
  PID:16256
- C:\Windows\System\TonwsBt.exe
  C:\Windows\System\TonwsBt.exe
  2⤵
  PID:16296
- C:\Windows\System\USOXLGI.exe
  C:\Windows\System\USOXLGI.exe
  2⤵
  PID:16324
- C:\Windows\System\rPUWAek.exe
  C:\Windows\System\rPUWAek.exe
  2⤵
  PID:16340
- C:\Windows\System\cVczTIY.exe
  C:\Windows\System\cVczTIY.exe
  2⤵
  PID:16368
- C:\Windows\System\kvGvlCf.exe
  C:\Windows\System\kvGvlCf.exe
  2⤵
  PID:15012
- C:\Windows\System\hdZdCZy.exe
  C:\Windows\System\hdZdCZy.exe
  2⤵
  PID:15396
- C:\Windows\System\keVvviX.exe
  C:\Windows\System\keVvviX.exe
  2⤵
  PID:15460
- C:\Windows\System\ntQWCjl.exe
  C:\Windows\System\ntQWCjl.exe
  2⤵
  PID:15504
- C:\Windows\System\NyNzWYk.exe
  C:\Windows\System\NyNzWYk.exe
  2⤵
  PID:15624
- C:\Windows\System\rAbtHyt.exe
  C:\Windows\System\rAbtHyt.exe
  2⤵
  PID:15668
- C:\Windows\System\IjVJbRK.exe
  C:\Windows\System\IjVJbRK.exe
  2⤵
  PID:15720
- C:\Windows\System\ukOrctj.exe
  C:\Windows\System\ukOrctj.exe
  2⤵
  PID:15828
- C:\Windows\System\jPMMtoT.exe
  C:\Windows\System\jPMMtoT.exe
  2⤵
  PID:15848
- C:\Windows\System\OZqkjFX.exe
  C:\Windows\System\OZqkjFX.exe
  2⤵
  PID:15900
- C:\Windows\System\yKqZiqA.exe
  C:\Windows\System\yKqZiqA.exe
  2⤵
  PID:16016
- C:\Windows\System\HAZXRrz.exe
  C:\Windows\System\HAZXRrz.exe
  2⤵
  PID:16072
- C:\Windows\System\ZvQcdGA.exe
  C:\Windows\System\ZvQcdGA.exe
  2⤵
  PID:14680
- C:\Windows\System\nXXVJUs.exe
  C:\Windows\System\nXXVJUs.exe
  2⤵
  PID:16136
- C:\Windows\System\rruenVs.exe
  C:\Windows\System\rruenVs.exe
  2⤵
  PID:16228
- C:\Windows\System\dktyfGC.exe
  C:\Windows\System\dktyfGC.exe
  2⤵
  PID:16252
- C:\Windows\System\RHqoEmf.exe
  C:\Windows\System\RHqoEmf.exe
  2⤵
  PID:2852
- C:\Windows\System\MBqVclk.exe
  C:\Windows\System\MBqVclk.exe
  2⤵
  PID:16360
- C:\Windows\System\UtbQbBZ.exe
  C:\Windows\System\UtbQbBZ.exe
  2⤵
  PID:15420
- C:\Windows\System\GIptFYG.exe
  C:\Windows\System\GIptFYG.exe
  2⤵
  PID:15496
- C:\Windows\System\Gobbyje.exe
  C:\Windows\System\Gobbyje.exe
  2⤵
  PID:15768
- C:\Windows\System\tliWIYl.exe
  C:\Windows\System\tliWIYl.exe
  2⤵
  PID:15832
- C:\Windows\System\ENDwGVN.exe
  C:\Windows\System\ENDwGVN.exe
  2⤵
  PID:15972
- C:\Windows\System\tuhyXxr.exe
  C:\Windows\System\tuhyXxr.exe
  2⤵
  PID:16184
- C:\Windows\System\xXVnTAE.exe
  C:\Windows\System\xXVnTAE.exe
  2⤵
  PID:16280
- C:\Windows\System\HETEdWM.exe
  C:\Windows\System\HETEdWM.exe
  2⤵
  PID:532
- C:\Windows\System\ulUSPeN.exe
  C:\Windows\System\ulUSPeN.exe
  2⤵
  PID:15480
- C:\Windows\System\MkQGmze.exe
  C:\Windows\System\MkQGmze.exe
  2⤵
  PID:15872
- C:\Windows\System\eSZgQtg.exe
  C:\Windows\System\eSZgQtg.exe
  2⤵
  PID:16192
- C:\Windows\System\SnuzOYP.exe
  C:\Windows\System\SnuzOYP.exe
  2⤵
  PID:15540
- C:\Windows\System\jzjDuLj.exe
  C:\Windows\System\jzjDuLj.exe
  2⤵
  PID:16400
- C:\Windows\System\HRjllZo.exe
  C:\Windows\System\HRjllZo.exe
  2⤵
  PID:16420
- C:\Windows\System\imOqjiO.exe
  C:\Windows\System\imOqjiO.exe
  2⤵
  PID:16480
- C:\Windows\System\YWCqDcs.exe
  C:\Windows\System\YWCqDcs.exe
  2⤵
  PID:16504
- C:\Windows\System\gWMfFSZ.exe
  C:\Windows\System\gWMfFSZ.exe
  2⤵
  PID:16532
- C:\Windows\System\ApYlycZ.exe
  C:\Windows\System\ApYlycZ.exe
  2⤵
  PID:16548
- C:\Windows\System\NgsGwbx.exe
  C:\Windows\System\NgsGwbx.exe
  2⤵
  PID:16588
- C:\Windows\System\ygrKBwN.exe
  C:\Windows\System\ygrKBwN.exe
  2⤵
  PID:16604
- C:\Windows\System\Lrjhhyv.exe
  C:\Windows\System\Lrjhhyv.exe
  2⤵
  PID:16648
- C:\Windows\System\hSCoBid.exe
  C:\Windows\System\hSCoBid.exe
  2⤵
  PID:16672
- C:\Windows\System\LATNAfJ.exe
  C:\Windows\System\LATNAfJ.exe
  2⤵
  PID:16700
- C:\Windows\System\RCooTHF.exe
  C:\Windows\System\RCooTHF.exe
  2⤵
  PID:16716
- C:\Windows\System\JiVjcfO.exe
  C:\Windows\System\JiVjcfO.exe
  2⤵
  PID:16756
- C:\Windows\System\oxgJTNO.exe
  C:\Windows\System\oxgJTNO.exe
  2⤵
  PID:16780
- C:\Windows\System\lFhzAxL.exe
  C:\Windows\System\lFhzAxL.exe
  2⤵
  PID:16800
- C:\Windows\System\OiQwUCi.exe
  C:\Windows\System\OiQwUCi.exe
  2⤵
  PID:16820
- C:\Windows\System\JsKSvGG.exe
  C:\Windows\System\JsKSvGG.exe
  2⤵
  PID:16844
- C:\Windows\System\dBlmLuJ.exe
  C:\Windows\System\dBlmLuJ.exe
  2⤵
  PID:16864
- C:\Windows\System\btjvqcY.exe
  C:\Windows\System\btjvqcY.exe
  2⤵
  PID:16892
- C:\Windows\System\yINsrek.exe
  C:\Windows\System\yINsrek.exe
  2⤵
  PID:16916
- C:\Windows\System\abBTnZA.exe
  C:\Windows\System\abBTnZA.exe
  2⤵
  PID:16980
- C:\Windows\System\sEhSGQI.exe
  C:\Windows\System\sEhSGQI.exe
  2⤵
  PID:17004
- C:\Windows\System\fiGQFYV.exe
  C:\Windows\System\fiGQFYV.exe
  2⤵
  PID:17024
- C:\Windows\System\iOZhPGO.exe
  C:\Windows\System\iOZhPGO.exe
  2⤵
  PID:17048
- C:\Windows\System\VZbJurK.exe
  C:\Windows\System\VZbJurK.exe
  2⤵
  PID:17084
- C:\Windows\System\oUyPzTX.exe
  C:\Windows\System\oUyPzTX.exe
  2⤵
  PID:17132
- C:\Windows\System\QqJulPo.exe
  C:\Windows\System\QqJulPo.exe
  2⤵
  PID:17160
- C:\Windows\System\ayTwSYo.exe
  C:\Windows\System\ayTwSYo.exe
  2⤵
  PID:17176
- C:\Windows\System\PjQntkS.exe
  C:\Windows\System\PjQntkS.exe
  2⤵
  PID:17216
- C:\Windows\System\UOuYnLt.exe
  C:\Windows\System\UOuYnLt.exe
  2⤵
  PID:17232
- C:\Windows\System\MSJqRaK.exe
  C:\Windows\System\MSJqRaK.exe
  2⤵
  PID:17300

C:\Windows\system32\WerFaultSecure.exe
C:\Windows\system32\WerFaultSecure.exe -u -p 3568 -s 1940
1⤵
PID:16712

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AXRglkb.exe

Filesize
1.4MB

MD5
504c7e4e83da8c617e6f3e6998051018

SHA1
bc5c50fa6ec69531c6c8655a09e8219a0b4fed20

SHA256
5834d6ea4e765761501dd5db1e7c5db92ebe2a59b224c74a55dd6dbad178e96e

SHA512
958d830e70aac23c8a80c56b502784bf6a5a3a0b8a3106f39b878cfd6b5a06a058113cf21c9c19e0ed747957d203455a4a806236d08d91045a796f0076084f31

Download Submit
C:\Windows\System\BFnlaNy.exe

Filesize
1.4MB

MD5
59c69f120af9360f3ff97a8130b6c46d

SHA1
ce201a451ee82276167e84d7997687b10c5c3064

SHA256
b02d5213b9d47cf9881deb47d59e13cae7f75031559e0704a26e7b23cfb43f6b

SHA512
ca61f5e535bd88765275220a2d69dd6152fff064d0871ac235bfa7850eff4fd67c9e63bbb5c8eae90383024f51556a9735f57532ed1b021f247a1f88474b469f

Download Submit
C:\Windows\System\BOSbEXk.exe

Filesize
1.4MB

MD5
88abf78b3c78bf2be82f844c738e2d63

SHA1
69ef9737371d66555bc7f0b63fc4535775ec2b2d

SHA256
70fa13565099e10feabc8ca8609b676fc2f43537ee15ef96bf4d8d0dedc908c8

SHA512
71f40b80370054fdc31085f398cb5b19e2e078c691432be62b784f61dbc2619251438366f7b67401eb96c93e82a7af4ab9c09346a749ac0bc3fd74670b3ae57a

Download Submit
C:\Windows\System\GKPdZdQ.exe

Filesize
1.4MB

MD5
00f76d5696e97672b7c0951a0d78facd

SHA1
d37836bac03dc627de4975f1a3738ccde856ff6a

SHA256
1f8d316390f82ef1513c3f48dbb1eaa2bf54b5de6f82e9596a2dbaf94c6c3c3d

SHA512
ed4c758fdfbadc4d2f5bb877248152d74262d9ed93102b401cbe80b2a2d164dd488b9f75081d60a5d1a34ed3474413881b1f3c6e8b80b3e8ac4e87075f90099a

Download Submit
C:\Windows\System\HlJoScB.exe

Filesize
1.4MB

MD5
f57cc53a3c02bc7e633b1bc92576164a

SHA1
a15f25d4f507752c259f10987f05f84bf2787837

SHA256
7ad330ae908245d377295d1bbe0dcce921b040187a0c0dd41bbb2a5c9d251d1d

SHA512
027e002ae52511a0ee2a723d864944b68b1255ac21818bb0342052439de12a54e31ad47d0769527ae79e9a5e8f80d7cffc456380d724135b7b9dcea12f5d08e7

Download Submit
C:\Windows\System\IOaCpGK.exe

Filesize
1.4MB

MD5
c778a40567727cda37eecc8ad3258653

SHA1
b70f76dbf867388da1ade7adbabb8a283e696fc0

SHA256
147a82e89b7b7a6e96c4304b916c6fa0268c7228d05af59535d20f84e8fe14af

SHA512
427e329345d70191e35647b139c6135ae23a61222d284e9cfa93289e2e19217a24bce5d7bd14c4ef869fa15b63f0489f22ede1f0c1188adbe6347b2de1adf309

Download Submit
C:\Windows\System\NBIISQu.exe

Filesize
1.4MB

MD5
f3241ced9f65c6d936890b4bdc6772fc

SHA1
1bc3f1e331306503c4e0bc76dd5da025a7e34527

SHA256
4de5651adbcf6b1f7d03ecba62a41b89cdbf0c1b5117afaaa752fffc4bcddf8d

SHA512
49d77a7598b7c64b3ca14cfafa96edde1566c78eb927f77ee828fa0524683a93714b4b52a539ba2ce666737cb79555e60dac8dd1f599500a93654cc76c99e8a4

Download Submit
C:\Windows\System\NCOxeup.exe

Filesize
1.4MB

MD5
2f4921cd76c2ad17d60c4cf3322fc1b5

SHA1
065a4c8369b08253de9eb560389a84444cbf62a9

SHA256
f3ce8c8cbf2d453db2cf22e0b1eb362713ee0b0ba98c279013fb40711e49e01b

SHA512
1c79ee92ae3a603bad8254a4a50213d31fb23a940ff40907b68bf127fba4e90d0cc9a4f5fe24bab66bb2031cb21e6a939fcc5b95876484e3fa8fb4322dfd233a

Download Submit
C:\Windows\System\NTjjerH.exe

Filesize
1.4MB

MD5
1a7168cff28b38f9072dd860b146878e

SHA1
d10e71b85949aaef654dc30cfe2a2d115c6ea942

SHA256
59683fb55b171299b523c2ceb05a27dadfa24a295cd61db502da350040600109

SHA512
e26386f1da54895402d35a65d24fbf13269f975cd182b8bea1b9eafc862e243d19d95574a13a8917498562cee9e94d125dc0e4a5167135897cf5a3adc97d4783

Download Submit
C:\Windows\System\NuLKIUt.exe

Filesize
1.4MB

MD5
01dafa65bad4b06162817300f5e7dc33

SHA1
6ed0eba4abf2921e009a4b60fc629dc862b30e5d

SHA256
760ff6aeb0746fe733f4d0af98c033cbc44af099f15fc8efa93bffda5726154d

SHA512
2906ddc1892b690ab8234c8ea04c38652661f6f17aaf06ca60df46139727766bf685764e4f58b55a97e0fdbaf7891e4287b21f90d8516b94c03aea47ef937d90

Download Submit
C:\Windows\System\OUtdRLb.exe

Filesize
1.4MB

MD5
d8ffd70998b65aad5c40729c4c525a05

SHA1
a0c3f2da81e98334f995eed5ddfa2c717353a0b6

SHA256
9a155c54805954028512d8c2574ffa0a34d3b22980d32d51ab49806eb3f872c4

SHA512
18108f70c1db05212badce996f560791c344c9ff3a14b905182d38598df288f647405c5d271236b1eaded30a94a902b6f44a85244126c2b7357448ae23edd830

Download Submit
C:\Windows\System\UOxYxVH.exe

Filesize
1.4MB

MD5
5ec0de3a52db7466b75ef1f4ac4317e5

SHA1
d33b559e33ea5a046177f0eea222bd190b39c20b

SHA256
4e5373046df8084bb6704174019a86b2a2d47aee3822c8b52e3b684352f40ecf

SHA512
8a45a69c7506c0c872721a402ed02008eb80c095bff7640e06c958af1b23a641bcd8d1dfa82fe41fc4d499c1d2a18c2bd17320fb219a454a113d21bc14995313

Download Submit
C:\Windows\System\UtTqerJ.exe

Filesize
1.4MB

MD5
69a69a366494b3aece07f2e02bb0f4f5

SHA1
2e1199f5d5ffbd4fa0aa190a911b9dd1e832e62c

SHA256
cceddc2c8417286d1f9b38b670add2926a002cd30ac6b13d33a17891666d230a

SHA512
98efa58a0a945443090b06150236820c6c6c4f7c8f29847aed0235eb954cf22dd6fab0bcc4a48cd8f7da7b2e09686b93eadffebab08e51bdc3a661293d76b3ad

Download Submit
C:\Windows\System\XzRmgUa.exe

Filesize
1.4MB

MD5
db65e8a5a3a9593fc7d015c4f97d6c08

SHA1
364aef91779364c150d2cd2cb5ceb2d095855341

SHA256
2a038a23a763818d99bd6ba4053b39d1ebf38f3d5406a02d3a0bb028d7e847e4

SHA512
45fcae1bf52a8e5813b46a9404f289cc0898d8fb63c0ffd3ddd40b8b2fe65dabd5a7ee180440d4b74ea742f50ca6e99565f837c2669542081093f45bf37a2c84

Download Submit
C:\Windows\System\YeQoZQz.exe

Filesize
1.4MB

MD5
4f61b2d6d5d0b140aa431d42d0091689

SHA1
d5c06e8b9d544c4b30d17797fe87be53a3ac5063

SHA256
0f33954cdd5efab8221bc2f003642737b95c681c58fbe70f54c1327356fb8818

SHA512
9317469b512677a953edc3c52c0ac454037ea212805624201981cffe015ff69a0f8967b28e63e373b883aef8c8fa143cedd377b36eefeb80f7951505671f8b8a

Download Submit
C:\Windows\System\YnLwYCC.exe

Filesize
1.4MB

MD5
1eb0221f9c043dcf0588799a930f2b7a

SHA1
2b6d277336ffaa4c7c9c4c7d18227ad3169d1b1c

SHA256
029ddf4212c983c29a9d004ee76352ece6926c8eb671a7d7720c0d27cb570eaf

SHA512
feaed780eca7ccd2221d8a3ba32c9e0e9f2cedab92e671432663935960ab55b462beaf26f34e4900bbb559a81441765367047168105b3cbd9c204ef9719b65d2

Download Submit
C:\Windows\System\ZzbaTov.exe

Filesize
1.4MB

MD5
fad396bed0800b8734c9603a2eb469f7

SHA1
c81461632464170ef9e07465eca57f4765169239

SHA256
22ba3844c6205cfc3f20772b3008a5ded70e049f333564108db7a34cf07e109f

SHA512
f60bc6086542991e5b16e224f3e0185b977552d565aa68c332f4b92a0bd8008b9e741fd0c1af6617684fe1feac29fe90f4f5d99e228ed6ec3e16b4d6ae690a7d

Download Submit
C:\Windows\System\dafUlUq.exe

Filesize
1.4MB

MD5
e4611ac95e9dd081145f488eb205b6a9

SHA1
6be3c5417a8c965d8d00125443242ae34265233b

SHA256
7d56f566d3015347681fd3e27cc257369100623c073217c9586782c73f66e9e7

SHA512
c853dcf0cf122b3d0fad403f73ae7dd226ab64b6dcba56f030c1cf044eeb9ca112ed863e9c8db5646d822d3fe650784cff5ad5fee7a1f84bacccf7bb7eb5f75d

Download Submit
C:\Windows\System\eJZFiLc.exe

Filesize
1.4MB

MD5
9bc77a72a1953e645755dd53a1796b5c

SHA1
052dce9f20066b60fbe9520a7e24f0b05c1a2006

SHA256
b81ff61143a4a7a1192292945273d21e2aa086fe165a4329a75c1c5e2958050d

SHA512
b79a07bf75c118e90e194988cf24d7501346e100ac6c341525b61797652f95d976896bbe797ebe364bf1a8f0e022aca6c2962511fc545f0964c1f0be0983ece9

Download Submit
C:\Windows\System\fkZRYvB.exe

Filesize
1.4MB

MD5
9cf439db70826b31374ba9c5668deeec

SHA1
23e8e0445af5eb45d2caf51fd506a46e5b3cf5af

SHA256
199055df3295c1dedd00bef88139cb38192a63402075ae7bcce9e58061e9e720

SHA512
3aea901b910d8c9953901795063076365fb265c9b4decae50dfec869928468d17ee97f5bd95b218d047bb5149ad74ce136405d4c782fe68fa9f944f32969ff37

Download Submit
C:\Windows\System\gfsAOVD.exe

Filesize
1.4MB

MD5
ad11235a52d376595ae1474a4f2611bf

SHA1
bbc390931b749a2ad395375972a6e2c265bab2bf

SHA256
7469b82065bc941c9972a028124ab8ca4b7b9bed350f3aec37a1dfbefb26ccf7

SHA512
1e19b5d6c1ae3761785846162d1f255c4dc5a0257cc57b941ee9bc661d366f9549d14ee4331c8aa6dd23d825a76be37552e8a3f9bb14b3431a37ee0daaa4d13a

Download Submit
C:\Windows\System\jazlbPv.exe

Filesize
1.4MB

MD5
4a5eea05a86ab1742a06154e96b527ee

SHA1
2c6655c8edc75ecb3fa2e6782b88ba74e39f8b27

SHA256
e089ea309b633732474bb9c94d3115a486e471644c19da7ba58d5b38d89cd3f1

SHA512
67c813e1ad0e6db04d304e6f6d7d6082465f34189a6af2f4348dda2370be72a57234b664808f0fcbb7d61ba927035bbed4ea4890baa73c08ce0b1dbc7011f799

Download Submit
C:\Windows\System\lhdAfFc.exe

Filesize
1.4MB

MD5
b10d9a128eb06a80896f309912830226

SHA1
edb6153e8b3125f3c2575b7d342b5b81217d81c4

SHA256
ee850a9d4b45be3d7ea85bc2d73b018ac785b85e67e0fb3a96d30d806f991981

SHA512
09a59edca8553a009bba40cddc2f171c66e8689ea8ff06362780fb5d076eaebd3601ee38bbcd184bab443b4af7447b4b9c8622819ba35d8a3178f99ee0a2ea18

Download Submit
C:\Windows\System\nVOdAyT.exe

Filesize
1.4MB

MD5
3ee14b4a4fbd219811ca3948e8ce8bbf

SHA1
09bf3856b4b666988e7bee3179fe6bb4ffe38467

SHA256
5952afbd046b684b16c10e833580387f0d0e8d9b0624b0bf2313e44f317d9265

SHA512
51dd6a00978e7ba09f2e7f6a233a19119f4983e5abe734256def4f12523ab5c93f0f42c2d765f969721d32d5d7d757aa2c23c8dd4738fe935fe691943e0e2f48

Download Submit
C:\Windows\System\puFYOgN.exe

Filesize
1.4MB

MD5
d0147fed303e459b12794c77eaad705d

SHA1
bdacc6ed29d8e64598dd81f607dad373e1303775

SHA256
aaf55924455bbfce8a4b18e606a62b3e4295344593f7592408fc7056966dd4b8

SHA512
793282c7932b6f8adc7b4b31f97a12f6d01ed497a605b8a636b9516e6cd4c3f35c5de09adc94b6852f4906e3a6a9311b47af0181ca54d1fbf43aed19e0cc3dd7

Download Submit
C:\Windows\System\rdFudju.exe

Filesize
1.4MB

MD5
0cbbc02a0fdbeda891e5db523f7b2ea4

SHA1
4224b7012adb87ef4a34ea9eff0a1b7164b40151

SHA256
7ce66c9c0f4e48b170b434515ffd1cc32c4b59e8e8a6b0356e25735060d0ece0

SHA512
cab0f8b37ec0b84148b5b4ca778481a7307c4f538e53f3c75853a83290d06a85d969a5f5e41fabb149621f0f207a68f8627370f010b2c9f8fd06f08b13a108f9

Download Submit
C:\Windows\System\skfapMU.exe

Filesize
1.4MB

MD5
602bb87e1c62e11ff7b2601c1a8d6f2f

SHA1
db67295cea8a823d8bb31f4fbfc057d4a07c1296

SHA256
75184254b095724448e6c96239eb0998d1e5c6b35bdc55fff15870077e850b5c

SHA512
b3323e49f5df14627c9c2fde44bbeb476436c6fe21d7188de6f9e9de3b240bbc5f5c0f38b0fae854fe58f19f3cc3c43d0640fcee848b5a3e7ddd587d10fe15dc

Download Submit
C:\Windows\System\vDRcaAo.exe

Filesize
1.4MB

MD5
4078ae812c6a41cd0ecf36af6f34b722

SHA1
1a8cf35cf95603eb5996b8638d8f658e878b3724

SHA256
c9dbcca4e8831f6b049d0b422cf0c16df933bdff5129c37d67568aa651b2d932

SHA512
19f903dc5e633ba775d031a3634d65b224e8a9c20ddde0d301b3f72baf2eea1743a6d24ae659f41a0c273691d8fbeaaa7d07688fca50d81d7dc6b30bb3398797

Download Submit
C:\Windows\System\wGYpeXW.exe

Filesize
1.4MB

MD5
8823dc519d07f78865eb2752d6a7778f

SHA1
29a95baf5f2a2dd8b7bbaf86e841477cdb216c75

SHA256
a12c5ac1c0ec691fc5907bbd2181208e67422b79a9c0437568757fe5666d3cdb

SHA512
6e82f429e795cd97254fb119964ac61cc2f8b188be877f89f6fa1afd810c9d9a0895e6f66381df924f8c365cc54f641fecd1c44877fb7e92d6f70c157158e669

Download Submit
C:\Windows\System\wqhiAjX.exe

Filesize
1.4MB

MD5
c0cc7ff05ce5c1434a3c5b72c1a66edd

SHA1
0c4d539d13b874b1a34d797f7b7416f63e1e1545

SHA256
f9f9c63b27fb65d141d4c32d51094f3752dca220adf5b896b533c3e0184a244b

SHA512
66d866cea1a0fa85cbc07b370f9c51774d8161185bdb715c6aad0d9ed588aad82a2a6ca34f6960aed691512023a91302da8312afb9aa145934dea9ff9c81f3e1

Download Submit
C:\Windows\System\xXQUlCv.exe

Filesize
1.4MB

MD5
6028ea16de414565ca4230fa9448cffb

SHA1
c59a8aa31da9e45b9d4d37ecda0aae276b344e7b

SHA256
98e978c841d9bd560c9888d9b7226fb8357827a711fbe064321ba54d896aca46

SHA512
517428fcce2c1f49d02ecc3dd89afbbd6754c6c15ca0dc4d0c8e62d651a13ff0a641f719ba752364a9f4aba60b7c6555a94a85e765cbe5390b670da24072a665

Download Submit
C:\Windows\System\xpMvXFR.exe

Filesize
1.4MB

MD5
849c2f0e0a0a8cc5752832460152c3ef

SHA1
36cc30641236d3eccd5778bc2ab5933991f4a69e

SHA256
01fe0b7ad7fb8c493f2d442683a334976936fae4c69e300bec159c5a607f2f95

SHA512
7b0dbdf8134703cb0a3e5ed3e82464985ff27f21972c1d83b181a739ff8579504823e4aa51e73c223952d88b79ae6c71e30b582562fe69996f3814e6315c3973

Download Submit
C:\Windows\System\zVEzPpe.exe

Filesize
1.4MB

MD5
676ed223a2b8ef8ecb13b8028f26a44e

SHA1
083cd5b0400fe70d9d5c66302888ba90dc370d00

SHA256
8ad3501434302f3e2ec165f283162829acdb13fa1d6ef28099823b08ceb2062a

SHA512
85f4177db79a24cc9f0787d4fe28afafc9aecf8d4684728dc36cf93551e2be65d53b69c2a42a0a1bf52585bef81954872789d51f248f473e52361f20944f4eff

Download Submit
memory/5008-0-0x0000019C3A5F0000-0x0000019C3A600000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads