xmrig | e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
Size

1.3MB
MD5

0f78c4c75a88f6666e1cb33927373bd7
SHA1

298fb577db42ff299d4bf0cc6486fc8d58b68d66
SHA256

e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714
SHA512

541249b571e22c3672ebef57103072234cc7dccbd08a43a4c1b5620200ad4ffe4bf2ca080359ba12a90f903baef94ce61c41b911ffcc7a5bbb0b6dd97dd64b34
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5p84nes7fDK:GezaTF8FcNkNdfE0pZ9ozttwIRxA1s7G

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b0f-4.dat	xmrig
behavioral2/files/0x000b000000023b6d-9.dat	xmrig
behavioral2/files/0x000a000000023b71-7.dat	xmrig
behavioral2/files/0x000a000000023b72-17.dat	xmrig
behavioral2/files/0x000a000000023b76-37.dat	xmrig
behavioral2/files/0x000a000000023b74-39.dat	xmrig
behavioral2/files/0x000a000000023b77-46.dat	xmrig
behavioral2/files/0x000a000000023b79-59.dat	xmrig
behavioral2/files/0x000a000000023b7c-68.dat	xmrig
behavioral2/files/0x000a000000023b80-86.dat	xmrig
behavioral2/files/0x000a000000023b83-109.dat	xmrig
behavioral2/files/0x000a000000023b87-129.dat	xmrig
behavioral2/files/0x000a000000023b8f-161.dat	xmrig
behavioral2/files/0x000a000000023b8d-159.dat	xmrig
behavioral2/files/0x000a000000023b8e-156.dat	xmrig
behavioral2/files/0x000a000000023b8c-154.dat	xmrig
behavioral2/files/0x000a000000023b8b-149.dat	xmrig
behavioral2/files/0x000a000000023b8a-144.dat	xmrig
behavioral2/files/0x000a000000023b89-139.dat	xmrig
behavioral2/files/0x000a000000023b88-134.dat	xmrig
behavioral2/files/0x000a000000023b86-124.dat	xmrig
behavioral2/files/0x000a000000023b85-119.dat	xmrig
behavioral2/files/0x000a000000023b84-114.dat	xmrig
behavioral2/files/0x000a000000023b82-104.dat	xmrig
behavioral2/files/0x000a000000023b81-99.dat	xmrig
behavioral2/files/0x000a000000023b7f-89.dat	xmrig
behavioral2/files/0x000a000000023b7e-84.dat	xmrig
behavioral2/files/0x000a000000023b7d-79.dat	xmrig
behavioral2/files/0x000a000000023b7b-65.dat	xmrig
behavioral2/files/0x000a000000023b7a-63.dat	xmrig
behavioral2/files/0x000a000000023b78-61.dat	xmrig
behavioral2/files/0x000a000000023b75-40.dat	xmrig
behavioral2/files/0x000a000000023b73-33.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3200	DjtFpNn.exe
4420	uJUoNLp.exe
600	NhMZoWZ.exe
628	fAKtVHM.exe
1416	DdETNKw.exe
4956	sXtpuoH.exe
2208	zIbPTkr.exe
4232	dlufwiB.exe
1084	rzzJKDU.exe
4356	nZdNgpO.exe
2044	icDPqEb.exe
4448	PzZkFMc.exe
1224	vRWzguu.exe
3204	xNDwYlq.exe
3872	PlcMwYi.exe
2448	cXNuSTS.exe
4772	CTxaXyu.exe
4712	SBTGYYJ.exe
4052	IJyduyt.exe
4300	asuGSWy.exe
2368	zUVESzo.exe
2432	aLsxwfe.exe
2612	tcTDVUV.exe
4620	ffOhjwh.exe
2352	lIvEegG.exe
1628	dWGnBDZ.exe
1508	XTYiJIM.exe
3548	DlCYXeZ.exe
828	zEcTPke.exe
2440	szpxndg.exe
3340	EqFlKBd.exe
1620	xoMvFNc.exe
5028	BlCPlUT.exe
996	CfwFBOq.exe
2388	bViknoi.exe
5016	SJplnmR.exe
2540	rNuHtBg.exe
2192	TkDzFrP.exe
3996	xlddofC.exe
932	GFvRFqG.exe
656	wXCIbPo.exe
4324	UgMqdwc.exe
956	SNTcqOW.exe
3300	pTfIvrL.exe
1836	QNWwqfx.exe
4652	RPviKbA.exe
1020	qKtFdVo.exe
4128	IUNXVUH.exe
3148	fVoITFm.exe
4592	iMqtznI.exe
4916	zmUaTEl.exe
1920	SgzrNOz.exe
4068	AkkloNr.exe
228	NcrTeiC.exe
2008	pmNOZcD.exe
4832	RfzJpDQ.exe
1336	GIrhwaO.exe
4388	vTCwefK.exe
2532	rKQbRYC.exe
2884	CRRnWsY.exe
4672	gscxuNz.exe
3644	urlQSQA.exe
4476	LhsCmzO.exe
2764	JBlBuRc.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CCyIeRi.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\zBRsAcQ.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\WwZtzKx.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\etDaFua.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\qDQgiIS.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\BUNykcm.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\rKQbRYC.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\KLPaTEP.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\NxRAszh.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\qVanusm.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\FqGtZUK.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\hWfxjAA.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\ZhvturL.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\bdYSVxd.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\IUNXVUH.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\StoxYHJ.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\ItdsGrO.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\moGDnxh.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\qLLeSVU.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\sVrxhGy.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\HxYxttV.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\hLdhHzn.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\yiqhUIA.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\XBgpMFk.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\PULVWnD.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\NzvxDBI.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\DErVgqS.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\JliYiXF.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\qQhTgmn.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\uvzpEJT.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\VwqViPE.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\teOjXGh.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\zApeKxK.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\TYLCKSS.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\BVutGOb.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\sKbmIEY.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\ugNgJCP.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\bXNUETQ.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\rcZofOO.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\qbgHgmy.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\ZawojxU.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\bLoQcIQ.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\TSFYlvM.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\muqKhPD.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\zxVXHTG.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\ICacTfF.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\DVnrCJP.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\SBbBFKp.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\gIBcDQm.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\rzzJKDU.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\pOzBljf.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\sWPclAM.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\GuAhrUw.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\ikuZFXi.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\jPUDACu.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\ryxNoJb.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\ynWPUDu.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\xjEqtuU.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\sOZTMeI.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\sAplzIX.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\buIEaVq.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\aLsxwfe.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\riJVqmg.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
File created	C:\Windows\System\fySojCC.exe	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17336	dwm.exe
Token: SeChangeNotifyPrivilege	17336	dwm.exe
Token: 33	17336	dwm.exe
Token: SeIncBasePriorityPrivilege	17336	dwm.exe
Token: SeShutdownPrivilege	17336	dwm.exe
Token: SeCreatePagefilePrivilege	17336	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 3200	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	86
PID 5008 wrote to memory of 3200	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	86
PID 5008 wrote to memory of 4420	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	87
PID 5008 wrote to memory of 4420	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	87
PID 5008 wrote to memory of 600	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	88
PID 5008 wrote to memory of 600	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	88
PID 5008 wrote to memory of 628	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	89
PID 5008 wrote to memory of 628	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	89
PID 5008 wrote to memory of 1416	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	90
PID 5008 wrote to memory of 1416	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	90
PID 5008 wrote to memory of 4956	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	91
PID 5008 wrote to memory of 4956	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	91
PID 5008 wrote to memory of 2208	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	92
PID 5008 wrote to memory of 2208	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	92
PID 5008 wrote to memory of 4232	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	93
PID 5008 wrote to memory of 4232	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	93
PID 5008 wrote to memory of 1084	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	94
PID 5008 wrote to memory of 1084	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	94
PID 5008 wrote to memory of 4356	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	95
PID 5008 wrote to memory of 4356	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	95
PID 5008 wrote to memory of 2044	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	96
PID 5008 wrote to memory of 2044	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	96
PID 5008 wrote to memory of 4448	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	97
PID 5008 wrote to memory of 4448	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	97
PID 5008 wrote to memory of 1224	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	98
PID 5008 wrote to memory of 1224	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	98
PID 5008 wrote to memory of 3204	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	99
PID 5008 wrote to memory of 3204	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	99
PID 5008 wrote to memory of 3872	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	100
PID 5008 wrote to memory of 3872	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	100
PID 5008 wrote to memory of 2448	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	101
PID 5008 wrote to memory of 2448	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	101
PID 5008 wrote to memory of 4772	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	102
PID 5008 wrote to memory of 4772	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	102
PID 5008 wrote to memory of 4712	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	103
PID 5008 wrote to memory of 4712	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	103
PID 5008 wrote to memory of 4052	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	104
PID 5008 wrote to memory of 4052	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	104
PID 5008 wrote to memory of 4300	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	105
PID 5008 wrote to memory of 4300	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	105
PID 5008 wrote to memory of 2368	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	106
PID 5008 wrote to memory of 2368	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	106
PID 5008 wrote to memory of 2432	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	107
PID 5008 wrote to memory of 2432	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	107
PID 5008 wrote to memory of 2612	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	108
PID 5008 wrote to memory of 2612	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	108
PID 5008 wrote to memory of 4620	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	109
PID 5008 wrote to memory of 4620	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	109
PID 5008 wrote to memory of 2352	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	110
PID 5008 wrote to memory of 2352	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	110
PID 5008 wrote to memory of 1628	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	111
PID 5008 wrote to memory of 1628	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	111
PID 5008 wrote to memory of 1508	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	112
PID 5008 wrote to memory of 1508	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	112
PID 5008 wrote to memory of 3548	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	113
PID 5008 wrote to memory of 3548	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	113
PID 5008 wrote to memory of 828	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	114
PID 5008 wrote to memory of 828	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	114
PID 5008 wrote to memory of 2440	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	115
PID 5008 wrote to memory of 2440	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	115
PID 5008 wrote to memory of 3340	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	116
PID 5008 wrote to memory of 3340	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	116
PID 5008 wrote to memory of 1620	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	117
PID 5008 wrote to memory of 1620	5008	e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe	117

C:\Users\Admin\AppData\Local\Temp\e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe
"C:\Users\Admin\AppData\Local\Temp\e03fb04487f6a42e32aa37bb372bee75787a0c1dce4ea81650256ed881316714.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\System\DjtFpNn.exe
  C:\Windows\System\DjtFpNn.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\uJUoNLp.exe
  C:\Windows\System\uJUoNLp.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\NhMZoWZ.exe
  C:\Windows\System\NhMZoWZ.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\fAKtVHM.exe
  C:\Windows\System\fAKtVHM.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\DdETNKw.exe
  C:\Windows\System\DdETNKw.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\sXtpuoH.exe
  C:\Windows\System\sXtpuoH.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\zIbPTkr.exe
  C:\Windows\System\zIbPTkr.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\dlufwiB.exe
  C:\Windows\System\dlufwiB.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\rzzJKDU.exe
  C:\Windows\System\rzzJKDU.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\nZdNgpO.exe
  C:\Windows\System\nZdNgpO.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\icDPqEb.exe
  C:\Windows\System\icDPqEb.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\PzZkFMc.exe
  C:\Windows\System\PzZkFMc.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\vRWzguu.exe
  C:\Windows\System\vRWzguu.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\xNDwYlq.exe
  C:\Windows\System\xNDwYlq.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\PlcMwYi.exe
  C:\Windows\System\PlcMwYi.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\cXNuSTS.exe
  C:\Windows\System\cXNuSTS.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\CTxaXyu.exe
  C:\Windows\System\CTxaXyu.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\SBTGYYJ.exe
  C:\Windows\System\SBTGYYJ.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\IJyduyt.exe
  C:\Windows\System\IJyduyt.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\asuGSWy.exe
  C:\Windows\System\asuGSWy.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\zUVESzo.exe
  C:\Windows\System\zUVESzo.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\aLsxwfe.exe
  C:\Windows\System\aLsxwfe.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\tcTDVUV.exe
  C:\Windows\System\tcTDVUV.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\ffOhjwh.exe
  C:\Windows\System\ffOhjwh.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\lIvEegG.exe
  C:\Windows\System\lIvEegG.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\dWGnBDZ.exe
  C:\Windows\System\dWGnBDZ.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\XTYiJIM.exe
  C:\Windows\System\XTYiJIM.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\DlCYXeZ.exe
  C:\Windows\System\DlCYXeZ.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\zEcTPke.exe
  C:\Windows\System\zEcTPke.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\szpxndg.exe
  C:\Windows\System\szpxndg.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\EqFlKBd.exe
  C:\Windows\System\EqFlKBd.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\xoMvFNc.exe
  C:\Windows\System\xoMvFNc.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\BlCPlUT.exe
  C:\Windows\System\BlCPlUT.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\CfwFBOq.exe
  C:\Windows\System\CfwFBOq.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\bViknoi.exe
  C:\Windows\System\bViknoi.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\SJplnmR.exe
  C:\Windows\System\SJplnmR.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\rNuHtBg.exe
  C:\Windows\System\rNuHtBg.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\TkDzFrP.exe
  C:\Windows\System\TkDzFrP.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\xlddofC.exe
  C:\Windows\System\xlddofC.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\GFvRFqG.exe
  C:\Windows\System\GFvRFqG.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\wXCIbPo.exe
  C:\Windows\System\wXCIbPo.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\UgMqdwc.exe
  C:\Windows\System\UgMqdwc.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\SNTcqOW.exe
  C:\Windows\System\SNTcqOW.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\pTfIvrL.exe
  C:\Windows\System\pTfIvrL.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\QNWwqfx.exe
  C:\Windows\System\QNWwqfx.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\RPviKbA.exe
  C:\Windows\System\RPviKbA.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\qKtFdVo.exe
  C:\Windows\System\qKtFdVo.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\IUNXVUH.exe
  C:\Windows\System\IUNXVUH.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\fVoITFm.exe
  C:\Windows\System\fVoITFm.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\iMqtznI.exe
  C:\Windows\System\iMqtznI.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\zmUaTEl.exe
  C:\Windows\System\zmUaTEl.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\SgzrNOz.exe
  C:\Windows\System\SgzrNOz.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\AkkloNr.exe
  C:\Windows\System\AkkloNr.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\NcrTeiC.exe
  C:\Windows\System\NcrTeiC.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\pmNOZcD.exe
  C:\Windows\System\pmNOZcD.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\RfzJpDQ.exe
  C:\Windows\System\RfzJpDQ.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\GIrhwaO.exe
  C:\Windows\System\GIrhwaO.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\vTCwefK.exe
  C:\Windows\System\vTCwefK.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\rKQbRYC.exe
  C:\Windows\System\rKQbRYC.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\CRRnWsY.exe
  C:\Windows\System\CRRnWsY.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\gscxuNz.exe
  C:\Windows\System\gscxuNz.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\urlQSQA.exe
  C:\Windows\System\urlQSQA.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\LhsCmzO.exe
  C:\Windows\System\LhsCmzO.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\JBlBuRc.exe
  C:\Windows\System\JBlBuRc.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\MNMZOFX.exe
  C:\Windows\System\MNMZOFX.exe
  2⤵
  PID:1088
- C:\Windows\System\fTHvuZU.exe
  C:\Windows\System\fTHvuZU.exe
  2⤵
  PID:3028
- C:\Windows\System\CCYfHpD.exe
  C:\Windows\System\CCYfHpD.exe
  2⤵
  PID:1464
- C:\Windows\System\WeEPGhC.exe
  C:\Windows\System\WeEPGhC.exe
  2⤵
  PID:5108
- C:\Windows\System\PKQOKKX.exe
  C:\Windows\System\PKQOKKX.exe
  2⤵
  PID:3320
- C:\Windows\System\rDpuoaH.exe
  C:\Windows\System\rDpuoaH.exe
  2⤵
  PID:4100
- C:\Windows\System\GIWTBaF.exe
  C:\Windows\System\GIWTBaF.exe
  2⤵
  PID:4156
- C:\Windows\System\SYXlCQe.exe
  C:\Windows\System\SYXlCQe.exe
  2⤵
  PID:1680
- C:\Windows\System\nLhwLYe.exe
  C:\Windows\System\nLhwLYe.exe
  2⤵
  PID:3012
- C:\Windows\System\zIVcUzl.exe
  C:\Windows\System\zIVcUzl.exe
  2⤵
  PID:2492
- C:\Windows\System\duaUHXy.exe
  C:\Windows\System\duaUHXy.exe
  2⤵
  PID:912
- C:\Windows\System\nCTMSLZ.exe
  C:\Windows\System\nCTMSLZ.exe
  2⤵
  PID:4728
- C:\Windows\System\jWDQWUJ.exe
  C:\Windows\System\jWDQWUJ.exe
  2⤵
  PID:1772
- C:\Windows\System\qpcbxHy.exe
  C:\Windows\System\qpcbxHy.exe
  2⤵
  PID:4048
- C:\Windows\System\UoURIZE.exe
  C:\Windows\System\UoURIZE.exe
  2⤵
  PID:3664
- C:\Windows\System\NoHVbem.exe
  C:\Windows\System\NoHVbem.exe
  2⤵
  PID:1444
- C:\Windows\System\MJcwepk.exe
  C:\Windows\System\MJcwepk.exe
  2⤵
  PID:4604
- C:\Windows\System\wGreOrl.exe
  C:\Windows\System\wGreOrl.exe
  2⤵
  PID:316
- C:\Windows\System\ZGpdqkf.exe
  C:\Windows\System\ZGpdqkf.exe
  2⤵
  PID:4824
- C:\Windows\System\NYCzTFX.exe
  C:\Windows\System\NYCzTFX.exe
  2⤵
  PID:3176
- C:\Windows\System\PaJqpLw.exe
  C:\Windows\System\PaJqpLw.exe
  2⤵
  PID:4480
- C:\Windows\System\WqkEkHb.exe
  C:\Windows\System\WqkEkHb.exe
  2⤵
  PID:1460
- C:\Windows\System\qNfziyK.exe
  C:\Windows\System\qNfziyK.exe
  2⤵
  PID:1280
- C:\Windows\System\vYcfLWH.exe
  C:\Windows\System\vYcfLWH.exe
  2⤵
  PID:4364
- C:\Windows\System\rdSKmZe.exe
  C:\Windows\System\rdSKmZe.exe
  2⤵
  PID:1504
- C:\Windows\System\csATInH.exe
  C:\Windows\System\csATInH.exe
  2⤵
  PID:2016
- C:\Windows\System\BAtExNS.exe
  C:\Windows\System\BAtExNS.exe
  2⤵
  PID:376
- C:\Windows\System\BZWfgwo.exe
  C:\Windows\System\BZWfgwo.exe
  2⤵
  PID:4996
- C:\Windows\System\xjfRfYL.exe
  C:\Windows\System\xjfRfYL.exe
  2⤵
  PID:1616
- C:\Windows\System\okYfayL.exe
  C:\Windows\System\okYfayL.exe
  2⤵
  PID:3540
- C:\Windows\System\uWKEvtQ.exe
  C:\Windows\System\uWKEvtQ.exe
  2⤵
  PID:320
- C:\Windows\System\yiqhUIA.exe
  C:\Windows\System\yiqhUIA.exe
  2⤵
  PID:2908
- C:\Windows\System\aJoVYsw.exe
  C:\Windows\System\aJoVYsw.exe
  2⤵
  PID:3328
- C:\Windows\System\IYfoMrW.exe
  C:\Windows\System\IYfoMrW.exe
  2⤵
  PID:4848
- C:\Windows\System\eoWsJOl.exe
  C:\Windows\System\eoWsJOl.exe
  2⤵
  PID:4444
- C:\Windows\System\iKnZVzT.exe
  C:\Windows\System\iKnZVzT.exe
  2⤵
  PID:5148
- C:\Windows\System\jPUDACu.exe
  C:\Windows\System\jPUDACu.exe
  2⤵
  PID:5180
- C:\Windows\System\XpmGZLb.exe
  C:\Windows\System\XpmGZLb.exe
  2⤵
  PID:5204
- C:\Windows\System\zRZJNaL.exe
  C:\Windows\System\zRZJNaL.exe
  2⤵
  PID:5236
- C:\Windows\System\CmoGifQ.exe
  C:\Windows\System\CmoGifQ.exe
  2⤵
  PID:5260
- C:\Windows\System\rnFXcdd.exe
  C:\Windows\System\rnFXcdd.exe
  2⤵
  PID:5288
- C:\Windows\System\IXvOerK.exe
  C:\Windows\System\IXvOerK.exe
  2⤵
  PID:5316
- C:\Windows\System\kjoKcGk.exe
  C:\Windows\System\kjoKcGk.exe
  2⤵
  PID:5340
- C:\Windows\System\QbykRqC.exe
  C:\Windows\System\QbykRqC.exe
  2⤵
  PID:5372
- C:\Windows\System\iMsYLZC.exe
  C:\Windows\System\iMsYLZC.exe
  2⤵
  PID:5400
- C:\Windows\System\JvihmBS.exe
  C:\Windows\System\JvihmBS.exe
  2⤵
  PID:5424
- C:\Windows\System\MjUcCdC.exe
  C:\Windows\System\MjUcCdC.exe
  2⤵
  PID:5460
- C:\Windows\System\UKZzXRH.exe
  C:\Windows\System\UKZzXRH.exe
  2⤵
  PID:5484
- C:\Windows\System\KlGkgLU.exe
  C:\Windows\System\KlGkgLU.exe
  2⤵
  PID:5512
- C:\Windows\System\WjOgdtu.exe
  C:\Windows\System\WjOgdtu.exe
  2⤵
  PID:5544
- C:\Windows\System\SxghRNb.exe
  C:\Windows\System\SxghRNb.exe
  2⤵
  PID:5572
- C:\Windows\System\WmbHLHN.exe
  C:\Windows\System\WmbHLHN.exe
  2⤵
  PID:5600
- C:\Windows\System\BLKAsuW.exe
  C:\Windows\System\BLKAsuW.exe
  2⤵
  PID:5624
- C:\Windows\System\CpTkUEL.exe
  C:\Windows\System\CpTkUEL.exe
  2⤵
  PID:5652
- C:\Windows\System\hnKxGfu.exe
  C:\Windows\System\hnKxGfu.exe
  2⤵
  PID:5680
- C:\Windows\System\iHtFgBA.exe
  C:\Windows\System\iHtFgBA.exe
  2⤵
  PID:5708
- C:\Windows\System\QgsXsEl.exe
  C:\Windows\System\QgsXsEl.exe
  2⤵
  PID:5736
- C:\Windows\System\KKylXBz.exe
  C:\Windows\System\KKylXBz.exe
  2⤵
  PID:5764
- C:\Windows\System\sDDSSiT.exe
  C:\Windows\System\sDDSSiT.exe
  2⤵
  PID:5792
- C:\Windows\System\bFniDOF.exe
  C:\Windows\System\bFniDOF.exe
  2⤵
  PID:5820
- C:\Windows\System\oVLiBgV.exe
  C:\Windows\System\oVLiBgV.exe
  2⤵
  PID:5848
- C:\Windows\System\BbKaeNM.exe
  C:\Windows\System\BbKaeNM.exe
  2⤵
  PID:5892
- C:\Windows\System\JKIbtxu.exe
  C:\Windows\System\JKIbtxu.exe
  2⤵
  PID:5912
- C:\Windows\System\TspMquE.exe
  C:\Windows\System\TspMquE.exe
  2⤵
  PID:5976
- C:\Windows\System\iDNODTt.exe
  C:\Windows\System\iDNODTt.exe
  2⤵
  PID:6028
- C:\Windows\System\rjDwweS.exe
  C:\Windows\System\rjDwweS.exe
  2⤵
  PID:6052
- C:\Windows\System\rQcaAfD.exe
  C:\Windows\System\rQcaAfD.exe
  2⤵
  PID:6080
- C:\Windows\System\yQxQOhJ.exe
  C:\Windows\System\yQxQOhJ.exe
  2⤵
  PID:6104
- C:\Windows\System\OAnbplR.exe
  C:\Windows\System\OAnbplR.exe
  2⤵
  PID:6132
- C:\Windows\System\DVnrCJP.exe
  C:\Windows\System\DVnrCJP.exe
  2⤵
  PID:3992
- C:\Windows\System\jfLceuR.exe
  C:\Windows\System\jfLceuR.exe
  2⤵
  PID:512
- C:\Windows\System\kkswFNN.exe
  C:\Windows\System\kkswFNN.exe
  2⤵
  PID:1576
- C:\Windows\System\ICacTfF.exe
  C:\Windows\System\ICacTfF.exe
  2⤵
  PID:3432
- C:\Windows\System\nBCleYW.exe
  C:\Windows\System\nBCleYW.exe
  2⤵
  PID:5116
- C:\Windows\System\zENnxQn.exe
  C:\Windows\System\zENnxQn.exe
  2⤵
  PID:5136
- C:\Windows\System\chEgbzq.exe
  C:\Windows\System\chEgbzq.exe
  2⤵
  PID:5168
- C:\Windows\System\ugNgJCP.exe
  C:\Windows\System\ugNgJCP.exe
  2⤵
  PID:5276
- C:\Windows\System\BUgaxyD.exe
  C:\Windows\System\BUgaxyD.exe
  2⤵
  PID:5308
- C:\Windows\System\KLPaTEP.exe
  C:\Windows\System\KLPaTEP.exe
  2⤵
  PID:5384
- C:\Windows\System\BeNSeMt.exe
  C:\Windows\System\BeNSeMt.exe
  2⤵
  PID:3392
- C:\Windows\System\HSafFdG.exe
  C:\Windows\System\HSafFdG.exe
  2⤵
  PID:5500
- C:\Windows\System\yDjMXZN.exe
  C:\Windows\System\yDjMXZN.exe
  2⤵
  PID:5560
- C:\Windows\System\WcFDDFG.exe
  C:\Windows\System\WcFDDFG.exe
  2⤵
  PID:3492
- C:\Windows\System\tUJxDBF.exe
  C:\Windows\System\tUJxDBF.exe
  2⤵
  PID:5692
- C:\Windows\System\QJBTlei.exe
  C:\Windows\System\QJBTlei.exe
  2⤵
  PID:1008
- C:\Windows\System\AMPHXtp.exe
  C:\Windows\System\AMPHXtp.exe
  2⤵
  PID:5756
- C:\Windows\System\RUCGPhn.exe
  C:\Windows\System\RUCGPhn.exe
  2⤵
  PID:1544
- C:\Windows\System\qrWLRoF.exe
  C:\Windows\System\qrWLRoF.exe
  2⤵
  PID:3244
- C:\Windows\System\vNohZTz.exe
  C:\Windows\System\vNohZTz.exe
  2⤵
  PID:4788
- C:\Windows\System\TYLCKSS.exe
  C:\Windows\System\TYLCKSS.exe
  2⤵
  PID:5880
- C:\Windows\System\llHYqwC.exe
  C:\Windows\System\llHYqwC.exe
  2⤵
  PID:5944
- C:\Windows\System\tphCsHj.exe
  C:\Windows\System\tphCsHj.exe
  2⤵
  PID:6044
- C:\Windows\System\uylxyOn.exe
  C:\Windows\System\uylxyOn.exe
  2⤵
  PID:6068
- C:\Windows\System\lUadBFx.exe
  C:\Windows\System\lUadBFx.exe
  2⤵
  PID:3728
- C:\Windows\System\ZoZbsWU.exe
  C:\Windows\System\ZoZbsWU.exe
  2⤵
  PID:4304
- C:\Windows\System\regNQaI.exe
  C:\Windows\System\regNQaI.exe
  2⤵
  PID:2248
- C:\Windows\System\qUlUvcm.exe
  C:\Windows\System\qUlUvcm.exe
  2⤵
  PID:4756
- C:\Windows\System\WazoxgN.exe
  C:\Windows\System\WazoxgN.exe
  2⤵
  PID:2472
- C:\Windows\System\JZXnUMG.exe
  C:\Windows\System\JZXnUMG.exe
  2⤵
  PID:1448
- C:\Windows\System\fZHVbZu.exe
  C:\Windows\System\fZHVbZu.exe
  2⤵
  PID:1172
- C:\Windows\System\eOKuYXD.exe
  C:\Windows\System\eOKuYXD.exe
  2⤵
  PID:4376
- C:\Windows\System\YhTmoFo.exe
  C:\Windows\System\YhTmoFo.exe
  2⤵
  PID:5196
- C:\Windows\System\yzsiLSl.exe
  C:\Windows\System\yzsiLSl.exe
  2⤵
  PID:5304
- C:\Windows\System\dlmgQEN.exe
  C:\Windows\System\dlmgQEN.exe
  2⤵
  PID:5528
- C:\Windows\System\ferKkUK.exe
  C:\Windows\System\ferKkUK.exe
  2⤵
  PID:4004
- C:\Windows\System\EgyFxCT.exe
  C:\Windows\System\EgyFxCT.exe
  2⤵
  PID:3136
- C:\Windows\System\uORKLJJ.exe
  C:\Windows\System\uORKLJJ.exe
  2⤵
  PID:5808
- C:\Windows\System\ItdsGrO.exe
  C:\Windows\System\ItdsGrO.exe
  2⤵
  PID:5972
- C:\Windows\System\IAKvtGp.exe
  C:\Windows\System\IAKvtGp.exe
  2⤵
  PID:4160
- C:\Windows\System\OVrlaNh.exe
  C:\Windows\System\OVrlaNh.exe
  2⤵
  PID:464
- C:\Windows\System\iHSbbOt.exe
  C:\Windows\System\iHSbbOt.exe
  2⤵
  PID:5132
- C:\Windows\System\wNOJPlV.exe
  C:\Windows\System\wNOJPlV.exe
  2⤵
  PID:5420
- C:\Windows\System\LAEZwNO.exe
  C:\Windows\System\LAEZwNO.exe
  2⤵
  PID:624
- C:\Windows\System\xrHlgja.exe
  C:\Windows\System\xrHlgja.exe
  2⤵
  PID:6008
- C:\Windows\System\tSoSBmE.exe
  C:\Windows\System\tSoSBmE.exe
  2⤵
  PID:5200
- C:\Windows\System\qDerNJX.exe
  C:\Windows\System\qDerNJX.exe
  2⤵
  PID:4380
- C:\Windows\System\xjEqtuU.exe
  C:\Windows\System\xjEqtuU.exe
  2⤵
  PID:4716
- C:\Windows\System\IJNdpMB.exe
  C:\Windows\System\IJNdpMB.exe
  2⤵
  PID:6156
- C:\Windows\System\mKntOCa.exe
  C:\Windows\System\mKntOCa.exe
  2⤵
  PID:6188
- C:\Windows\System\PcAgZiK.exe
  C:\Windows\System\PcAgZiK.exe
  2⤵
  PID:6220
- C:\Windows\System\zgPCnec.exe
  C:\Windows\System\zgPCnec.exe
  2⤵
  PID:6240
- C:\Windows\System\UCDNJmG.exe
  C:\Windows\System\UCDNJmG.exe
  2⤵
  PID:6276
- C:\Windows\System\ZmnzBbq.exe
  C:\Windows\System\ZmnzBbq.exe
  2⤵
  PID:6304
- C:\Windows\System\dlvxLWf.exe
  C:\Windows\System\dlvxLWf.exe
  2⤵
  PID:6328
- C:\Windows\System\TTOVqqi.exe
  C:\Windows\System\TTOVqqi.exe
  2⤵
  PID:6352
- C:\Windows\System\dHBMJQO.exe
  C:\Windows\System\dHBMJQO.exe
  2⤵
  PID:6380
- C:\Windows\System\NGukQRa.exe
  C:\Windows\System\NGukQRa.exe
  2⤵
  PID:6404
- C:\Windows\System\scyNLNn.exe
  C:\Windows\System\scyNLNn.exe
  2⤵
  PID:6432
- C:\Windows\System\qQhTgmn.exe
  C:\Windows\System\qQhTgmn.exe
  2⤵
  PID:6456
- C:\Windows\System\yvLDbCW.exe
  C:\Windows\System\yvLDbCW.exe
  2⤵
  PID:6488
- C:\Windows\System\jDVLqhe.exe
  C:\Windows\System\jDVLqhe.exe
  2⤵
  PID:6520
- C:\Windows\System\wpIaFyw.exe
  C:\Windows\System\wpIaFyw.exe
  2⤵
  PID:6548
- C:\Windows\System\BfwPaDh.exe
  C:\Windows\System\BfwPaDh.exe
  2⤵
  PID:6564
- C:\Windows\System\NzvxDBI.exe
  C:\Windows\System\NzvxDBI.exe
  2⤵
  PID:6628
- C:\Windows\System\VdTwTHR.exe
  C:\Windows\System\VdTwTHR.exe
  2⤵
  PID:6656
- C:\Windows\System\spqdaof.exe
  C:\Windows\System\spqdaof.exe
  2⤵
  PID:6684
- C:\Windows\System\MRFfHbc.exe
  C:\Windows\System\MRFfHbc.exe
  2⤵
  PID:6716
- C:\Windows\System\SKHQihm.exe
  C:\Windows\System\SKHQihm.exe
  2⤵
  PID:6736
- C:\Windows\System\UsdMVVr.exe
  C:\Windows\System\UsdMVVr.exe
  2⤵
  PID:6780
- C:\Windows\System\bLoQcIQ.exe
  C:\Windows\System\bLoQcIQ.exe
  2⤵
  PID:6796
- C:\Windows\System\KSfSrCQ.exe
  C:\Windows\System\KSfSrCQ.exe
  2⤵
  PID:6824
- C:\Windows\System\hiXVRek.exe
  C:\Windows\System\hiXVRek.exe
  2⤵
  PID:6852
- C:\Windows\System\lxUryXW.exe
  C:\Windows\System\lxUryXW.exe
  2⤵
  PID:6884
- C:\Windows\System\NmoAjuG.exe
  C:\Windows\System\NmoAjuG.exe
  2⤵
  PID:6908
- C:\Windows\System\hbrejaR.exe
  C:\Windows\System\hbrejaR.exe
  2⤵
  PID:6928
- C:\Windows\System\gWRfVLD.exe
  C:\Windows\System\gWRfVLD.exe
  2⤵
  PID:6960
- C:\Windows\System\uItOKFZ.exe
  C:\Windows\System\uItOKFZ.exe
  2⤵
  PID:6988
- C:\Windows\System\aGnHiqz.exe
  C:\Windows\System\aGnHiqz.exe
  2⤵
  PID:7012
- C:\Windows\System\wqpqnjg.exe
  C:\Windows\System\wqpqnjg.exe
  2⤵
  PID:7060
- C:\Windows\System\raEzKfn.exe
  C:\Windows\System\raEzKfn.exe
  2⤵
  PID:7088
- C:\Windows\System\tvMpTpd.exe
  C:\Windows\System\tvMpTpd.exe
  2⤵
  PID:7104
- C:\Windows\System\pKZZNwQ.exe
  C:\Windows\System\pKZZNwQ.exe
  2⤵
  PID:7132
- C:\Windows\System\JRlDYOs.exe
  C:\Windows\System\JRlDYOs.exe
  2⤵
  PID:7160
- C:\Windows\System\BkrrBox.exe
  C:\Windows\System\BkrrBox.exe
  2⤵
  PID:1500
- C:\Windows\System\GEtzevM.exe
  C:\Windows\System\GEtzevM.exe
  2⤵
  PID:6216
- C:\Windows\System\LwKqroL.exe
  C:\Windows\System\LwKqroL.exe
  2⤵
  PID:6312
- C:\Windows\System\TnZTFvt.exe
  C:\Windows\System\TnZTFvt.exe
  2⤵
  PID:6360
- C:\Windows\System\ILWToMh.exe
  C:\Windows\System\ILWToMh.exe
  2⤵
  PID:6428
- C:\Windows\System\amvaJcc.exe
  C:\Windows\System\amvaJcc.exe
  2⤵
  PID:6444
- C:\Windows\System\Qzjsizm.exe
  C:\Windows\System\Qzjsizm.exe
  2⤵
  PID:6544
- C:\Windows\System\evgWtJM.exe
  C:\Windows\System\evgWtJM.exe
  2⤵
  PID:6636
- C:\Windows\System\sRrizcT.exe
  C:\Windows\System\sRrizcT.exe
  2⤵
  PID:6676
- C:\Windows\System\jnYTWNv.exe
  C:\Windows\System\jnYTWNv.exe
  2⤵
  PID:6708
- C:\Windows\System\mfVhMUS.exe
  C:\Windows\System\mfVhMUS.exe
  2⤵
  PID:6792
- C:\Windows\System\ZFVCBuf.exe
  C:\Windows\System\ZFVCBuf.exe
  2⤵
  PID:6868
- C:\Windows\System\DwXVbPF.exe
  C:\Windows\System\DwXVbPF.exe
  2⤵
  PID:6944
- C:\Windows\System\jxhScMj.exe
  C:\Windows\System\jxhScMj.exe
  2⤵
  PID:6996
- C:\Windows\System\PwhgUHp.exe
  C:\Windows\System\PwhgUHp.exe
  2⤵
  PID:7084
- C:\Windows\System\BIjOkwb.exe
  C:\Windows\System\BIjOkwb.exe
  2⤵
  PID:7124
- C:\Windows\System\fyRZdUK.exe
  C:\Windows\System\fyRZdUK.exe
  2⤵
  PID:6292
- C:\Windows\System\XWkAgwg.exe
  C:\Windows\System\XWkAgwg.exe
  2⤵
  PID:6424
- C:\Windows\System\aLaZKxu.exe
  C:\Windows\System\aLaZKxu.exe
  2⤵
  PID:6452
- C:\Windows\System\lmogquf.exe
  C:\Windows\System\lmogquf.exe
  2⤵
  PID:6760
- C:\Windows\System\CPrMypF.exe
  C:\Windows\System\CPrMypF.exe
  2⤵
  PID:6864
- C:\Windows\System\vPjWswF.exe
  C:\Windows\System\vPjWswF.exe
  2⤵
  PID:7036
- C:\Windows\System\UtjZVgt.exe
  C:\Windows\System\UtjZVgt.exe
  2⤵
  PID:7148
- C:\Windows\System\tzUmphm.exe
  C:\Windows\System\tzUmphm.exe
  2⤵
  PID:6288
- C:\Windows\System\JdFItYW.exe
  C:\Windows\System\JdFItYW.exe
  2⤵
  PID:6648
- C:\Windows\System\LwsRjNI.exe
  C:\Windows\System\LwsRjNI.exe
  2⤵
  PID:6976
- C:\Windows\System\lTrzKVF.exe
  C:\Windows\System\lTrzKVF.exe
  2⤵
  PID:6140
- C:\Windows\System\hwPmwlt.exe
  C:\Windows\System\hwPmwlt.exe
  2⤵
  PID:7196
- C:\Windows\System\QYlviFb.exe
  C:\Windows\System\QYlviFb.exe
  2⤵
  PID:7216
- C:\Windows\System\WkyQGbO.exe
  C:\Windows\System\WkyQGbO.exe
  2⤵
  PID:7244
- C:\Windows\System\PefZbOz.exe
  C:\Windows\System\PefZbOz.exe
  2⤵
  PID:7272
- C:\Windows\System\rfdoGqk.exe
  C:\Windows\System\rfdoGqk.exe
  2⤵
  PID:7312
- C:\Windows\System\uvBztOc.exe
  C:\Windows\System\uvBztOc.exe
  2⤵
  PID:7340
- C:\Windows\System\ZtnzFbQ.exe
  C:\Windows\System\ZtnzFbQ.exe
  2⤵
  PID:7368
- C:\Windows\System\WHKkGvl.exe
  C:\Windows\System\WHKkGvl.exe
  2⤵
  PID:7420
- C:\Windows\System\ynWPUDu.exe
  C:\Windows\System\ynWPUDu.exe
  2⤵
  PID:7436
- C:\Windows\System\qxyKjsv.exe
  C:\Windows\System\qxyKjsv.exe
  2⤵
  PID:7464
- C:\Windows\System\zRnpLdr.exe
  C:\Windows\System\zRnpLdr.exe
  2⤵
  PID:7492
- C:\Windows\System\huHRCkI.exe
  C:\Windows\System\huHRCkI.exe
  2⤵
  PID:7516
- C:\Windows\System\TILvEmJ.exe
  C:\Windows\System\TILvEmJ.exe
  2⤵
  PID:7544
- C:\Windows\System\SBbBFKp.exe
  C:\Windows\System\SBbBFKp.exe
  2⤵
  PID:7588
- C:\Windows\System\nsbnqZk.exe
  C:\Windows\System\nsbnqZk.exe
  2⤵
  PID:7620
- C:\Windows\System\comIdYE.exe
  C:\Windows\System\comIdYE.exe
  2⤵
  PID:7648
- C:\Windows\System\sUpIVgd.exe
  C:\Windows\System\sUpIVgd.exe
  2⤵
  PID:7668
- C:\Windows\System\FsvnMLK.exe
  C:\Windows\System\FsvnMLK.exe
  2⤵
  PID:7692
- C:\Windows\System\dXmhEdt.exe
  C:\Windows\System\dXmhEdt.exe
  2⤵
  PID:7720
- C:\Windows\System\ZDdhFzw.exe
  C:\Windows\System\ZDdhFzw.exe
  2⤵
  PID:7740
- C:\Windows\System\ZzubDQI.exe
  C:\Windows\System\ZzubDQI.exe
  2⤵
  PID:7772
- C:\Windows\System\pElyjxw.exe
  C:\Windows\System\pElyjxw.exe
  2⤵
  PID:7804
- C:\Windows\System\moGDnxh.exe
  C:\Windows\System\moGDnxh.exe
  2⤵
  PID:7828
- C:\Windows\System\wcWFsCf.exe
  C:\Windows\System\wcWFsCf.exe
  2⤵
  PID:7848
- C:\Windows\System\ZCyauWD.exe
  C:\Windows\System\ZCyauWD.exe
  2⤵
  PID:7876
- C:\Windows\System\vcEtQTy.exe
  C:\Windows\System\vcEtQTy.exe
  2⤵
  PID:7900
- C:\Windows\System\SWDRhIC.exe
  C:\Windows\System\SWDRhIC.exe
  2⤵
  PID:7932
- C:\Windows\System\hybJFym.exe
  C:\Windows\System\hybJFym.exe
  2⤵
  PID:7964
- C:\Windows\System\wXSUFkx.exe
  C:\Windows\System\wXSUFkx.exe
  2⤵
  PID:8000
- C:\Windows\System\pOzBljf.exe
  C:\Windows\System\pOzBljf.exe
  2⤵
  PID:8032
- C:\Windows\System\WEyErgq.exe
  C:\Windows\System\WEyErgq.exe
  2⤵
  PID:8056
- C:\Windows\System\WcshhYa.exe
  C:\Windows\System\WcshhYa.exe
  2⤵
  PID:8084
- C:\Windows\System\LEqnvEP.exe
  C:\Windows\System\LEqnvEP.exe
  2⤵
  PID:8112
- C:\Windows\System\sWoypHu.exe
  C:\Windows\System\sWoypHu.exe
  2⤵
  PID:8144
- C:\Windows\System\flwdjrQ.exe
  C:\Windows\System\flwdjrQ.exe
  2⤵
  PID:8168
- C:\Windows\System\TnBdakT.exe
  C:\Windows\System\TnBdakT.exe
  2⤵
  PID:8188
- C:\Windows\System\ELAGjaS.exe
  C:\Windows\System\ELAGjaS.exe
  2⤵
  PID:6588
- C:\Windows\System\POXGaSa.exe
  C:\Windows\System\POXGaSa.exe
  2⤵
  PID:7232
- C:\Windows\System\SQLjmFJ.exe
  C:\Windows\System\SQLjmFJ.exe
  2⤵
  PID:7324
- C:\Windows\System\uuylbBE.exe
  C:\Windows\System\uuylbBE.exe
  2⤵
  PID:7364
- C:\Windows\System\QeNofEi.exe
  C:\Windows\System\QeNofEi.exe
  2⤵
  PID:7452
- C:\Windows\System\chdWaAV.exe
  C:\Windows\System\chdWaAV.exe
  2⤵
  PID:7508
- C:\Windows\System\BHfCuTJ.exe
  C:\Windows\System\BHfCuTJ.exe
  2⤵
  PID:7556
- C:\Windows\System\BNjQiMK.exe
  C:\Windows\System\BNjQiMK.exe
  2⤵
  PID:7600
- C:\Windows\System\dMuJjQH.exe
  C:\Windows\System\dMuJjQH.exe
  2⤵
  PID:7676
- C:\Windows\System\thMPAnH.exe
  C:\Windows\System\thMPAnH.exe
  2⤵
  PID:7764
- C:\Windows\System\tKyKlZt.exe
  C:\Windows\System\tKyKlZt.exe
  2⤵
  PID:7844
- C:\Windows\System\rVypqFq.exe
  C:\Windows\System\rVypqFq.exe
  2⤵
  PID:7920
- C:\Windows\System\vbwspJy.exe
  C:\Windows\System\vbwspJy.exe
  2⤵
  PID:7996
- C:\Windows\System\rGChNrL.exe
  C:\Windows\System\rGChNrL.exe
  2⤵
  PID:8072
- C:\Windows\System\umpbsGS.exe
  C:\Windows\System\umpbsGS.exe
  2⤵
  PID:8104
- C:\Windows\System\lpUbaRz.exe
  C:\Windows\System\lpUbaRz.exe
  2⤵
  PID:8152
- C:\Windows\System\dBqVEut.exe
  C:\Windows\System\dBqVEut.exe
  2⤵
  PID:6776
- C:\Windows\System\iVqjHWA.exe
  C:\Windows\System\iVqjHWA.exe
  2⤵
  PID:7292
- C:\Windows\System\IfycyBq.exe
  C:\Windows\System\IfycyBq.exe
  2⤵
  PID:7456
- C:\Windows\System\KrOtesn.exe
  C:\Windows\System\KrOtesn.exe
  2⤵
  PID:7552
- C:\Windows\System\NIzjXOb.exe
  C:\Windows\System\NIzjXOb.exe
  2⤵
  PID:7684
- C:\Windows\System\KEOblHF.exe
  C:\Windows\System\KEOblHF.exe
  2⤵
  PID:7980
- C:\Windows\System\VNuKUMZ.exe
  C:\Windows\System\VNuKUMZ.exe
  2⤵
  PID:8128
- C:\Windows\System\sOZTMeI.exe
  C:\Windows\System\sOZTMeI.exe
  2⤵
  PID:7432
- C:\Windows\System\FQWeVOi.exe
  C:\Windows\System\FQWeVOi.exe
  2⤵
  PID:7736
- C:\Windows\System\IrDVEoz.exe
  C:\Windows\System\IrDVEoz.exe
  2⤵
  PID:8052
- C:\Windows\System\dnteqYr.exe
  C:\Windows\System\dnteqYr.exe
  2⤵
  PID:7612
- C:\Windows\System\teOjXGh.exe
  C:\Windows\System\teOjXGh.exe
  2⤵
  PID:8124
- C:\Windows\System\sWPclAM.exe
  C:\Windows\System\sWPclAM.exe
  2⤵
  PID:8220
- C:\Windows\System\uKhlqfe.exe
  C:\Windows\System\uKhlqfe.exe
  2⤵
  PID:8248
- C:\Windows\System\zyXcJRv.exe
  C:\Windows\System\zyXcJRv.exe
  2⤵
  PID:8272
- C:\Windows\System\DVzwrNL.exe
  C:\Windows\System\DVzwrNL.exe
  2⤵
  PID:8304
- C:\Windows\System\pRaTYzc.exe
  C:\Windows\System\pRaTYzc.exe
  2⤵
  PID:8332
- C:\Windows\System\sJkDHtk.exe
  C:\Windows\System\sJkDHtk.exe
  2⤵
  PID:8352
- C:\Windows\System\VNQQuTF.exe
  C:\Windows\System\VNQQuTF.exe
  2⤵
  PID:8376
- C:\Windows\System\cMngNBs.exe
  C:\Windows\System\cMngNBs.exe
  2⤵
  PID:8408
- C:\Windows\System\NgWacbg.exe
  C:\Windows\System\NgWacbg.exe
  2⤵
  PID:8432
- C:\Windows\System\GDnRJtS.exe
  C:\Windows\System\GDnRJtS.exe
  2⤵
  PID:8456
- C:\Windows\System\CvLXVbM.exe
  C:\Windows\System\CvLXVbM.exe
  2⤵
  PID:8496
- C:\Windows\System\VkhKjKI.exe
  C:\Windows\System\VkhKjKI.exe
  2⤵
  PID:8516
- C:\Windows\System\mbZcIDk.exe
  C:\Windows\System\mbZcIDk.exe
  2⤵
  PID:8544
- C:\Windows\System\JfRgQJm.exe
  C:\Windows\System\JfRgQJm.exe
  2⤵
  PID:8564
- C:\Windows\System\zBRsAcQ.exe
  C:\Windows\System\zBRsAcQ.exe
  2⤵
  PID:8584
- C:\Windows\System\ODijnjs.exe
  C:\Windows\System\ODijnjs.exe
  2⤵
  PID:8628
- C:\Windows\System\CRePdMm.exe
  C:\Windows\System\CRePdMm.exe
  2⤵
  PID:8656
- C:\Windows\System\GbdAoBI.exe
  C:\Windows\System\GbdAoBI.exe
  2⤵
  PID:8684
- C:\Windows\System\WTXdVwa.exe
  C:\Windows\System\WTXdVwa.exe
  2⤵
  PID:8732
- C:\Windows\System\RfAPWBM.exe
  C:\Windows\System\RfAPWBM.exe
  2⤵
  PID:8764
- C:\Windows\System\rTLeTmI.exe
  C:\Windows\System\rTLeTmI.exe
  2⤵
  PID:8792
- C:\Windows\System\EYgFaTB.exe
  C:\Windows\System\EYgFaTB.exe
  2⤵
  PID:8812
- C:\Windows\System\rSzUSMq.exe
  C:\Windows\System\rSzUSMq.exe
  2⤵
  PID:8840
- C:\Windows\System\DErVgqS.exe
  C:\Windows\System\DErVgqS.exe
  2⤵
  PID:8876
- C:\Windows\System\zrlUmpF.exe
  C:\Windows\System\zrlUmpF.exe
  2⤵
  PID:8904
- C:\Windows\System\XMUQfRJ.exe
  C:\Windows\System\XMUQfRJ.exe
  2⤵
  PID:8924
- C:\Windows\System\xKSifuO.exe
  C:\Windows\System\xKSifuO.exe
  2⤵
  PID:8952
- C:\Windows\System\IsDJFmc.exe
  C:\Windows\System\IsDJFmc.exe
  2⤵
  PID:8972
- C:\Windows\System\YecjzLR.exe
  C:\Windows\System\YecjzLR.exe
  2⤵
  PID:8996
- C:\Windows\System\avtFiOK.exe
  C:\Windows\System\avtFiOK.exe
  2⤵
  PID:9020
- C:\Windows\System\yqbxJaq.exe
  C:\Windows\System\yqbxJaq.exe
  2⤵
  PID:9056
- C:\Windows\System\jJrYAzS.exe
  C:\Windows\System\jJrYAzS.exe
  2⤵
  PID:9076
- C:\Windows\System\LTkylwq.exe
  C:\Windows\System\LTkylwq.exe
  2⤵
  PID:9124
- C:\Windows\System\LyrCDLl.exe
  C:\Windows\System\LyrCDLl.exe
  2⤵
  PID:9144
- C:\Windows\System\rbzpqdX.exe
  C:\Windows\System\rbzpqdX.exe
  2⤵
  PID:9172
- C:\Windows\System\xISXVns.exe
  C:\Windows\System\xISXVns.exe
  2⤵
  PID:9188
- C:\Windows\System\JliYiXF.exe
  C:\Windows\System\JliYiXF.exe
  2⤵
  PID:9204
- C:\Windows\System\dNAfUKi.exe
  C:\Windows\System\dNAfUKi.exe
  2⤵
  PID:8212
- C:\Windows\System\aJjaFyh.exe
  C:\Windows\System\aJjaFyh.exe
  2⤵
  PID:8324
- C:\Windows\System\PbNZCIu.exe
  C:\Windows\System\PbNZCIu.exe
  2⤵
  PID:8368
- C:\Windows\System\ABpONLV.exe
  C:\Windows\System\ABpONLV.exe
  2⤵
  PID:8484
- C:\Windows\System\KmrQMaK.exe
  C:\Windows\System\KmrQMaK.exe
  2⤵
  PID:8476
- C:\Windows\System\ReShikv.exe
  C:\Windows\System\ReShikv.exe
  2⤵
  PID:8528
- C:\Windows\System\RArfbfx.exe
  C:\Windows\System\RArfbfx.exe
  2⤵
  PID:8604
- C:\Windows\System\gxnApXy.exe
  C:\Windows\System\gxnApXy.exe
  2⤵
  PID:8700
- C:\Windows\System\SjahZyy.exe
  C:\Windows\System\SjahZyy.exe
  2⤵
  PID:8748
- C:\Windows\System\qiUGpIv.exe
  C:\Windows\System\qiUGpIv.exe
  2⤵
  PID:8800
- C:\Windows\System\BVutGOb.exe
  C:\Windows\System\BVutGOb.exe
  2⤵
  PID:8896
- C:\Windows\System\dVQhFrL.exe
  C:\Windows\System\dVQhFrL.exe
  2⤵
  PID:8992
- C:\Windows\System\NcXxoQe.exe
  C:\Windows\System\NcXxoQe.exe
  2⤵
  PID:9072
- C:\Windows\System\aaIYxWC.exe
  C:\Windows\System\aaIYxWC.exe
  2⤵
  PID:9136
- C:\Windows\System\DLHEBzn.exe
  C:\Windows\System\DLHEBzn.exe
  2⤵
  PID:9156
- C:\Windows\System\nxsZfMs.exe
  C:\Windows\System\nxsZfMs.exe
  2⤵
  PID:8292
- C:\Windows\System\wVPsrWo.exe
  C:\Windows\System\wVPsrWo.exe
  2⤵
  PID:8384
- C:\Windows\System\FiaKWmn.exe
  C:\Windows\System\FiaKWmn.exe
  2⤵
  PID:8556
- C:\Windows\System\XTouOQZ.exe
  C:\Windows\System\XTouOQZ.exe
  2⤵
  PID:8720
- C:\Windows\System\SADIvQX.exe
  C:\Windows\System\SADIvQX.exe
  2⤵
  PID:8872
- C:\Windows\System\dITnwie.exe
  C:\Windows\System\dITnwie.exe
  2⤵
  PID:8984
- C:\Windows\System\gbnxUYe.exe
  C:\Windows\System\gbnxUYe.exe
  2⤵
  PID:9092
- C:\Windows\System\bhbHJbO.exe
  C:\Windows\System\bhbHJbO.exe
  2⤵
  PID:8260
- C:\Windows\System\CEvrIwW.exe
  C:\Windows\System\CEvrIwW.exe
  2⤵
  PID:8692
- C:\Windows\System\bXNUETQ.exe
  C:\Windows\System\bXNUETQ.exe
  2⤵
  PID:8964
- C:\Windows\System\qwjVbuk.exe
  C:\Windows\System\qwjVbuk.exe
  2⤵
  PID:8580
- C:\Windows\System\vsljgQB.exe
  C:\Windows\System\vsljgQB.exe
  2⤵
  PID:9240
- C:\Windows\System\TevITdO.exe
  C:\Windows\System\TevITdO.exe
  2⤵
  PID:9268
- C:\Windows\System\evmSqry.exe
  C:\Windows\System\evmSqry.exe
  2⤵
  PID:9304
- C:\Windows\System\dLAYQkZ.exe
  C:\Windows\System\dLAYQkZ.exe
  2⤵
  PID:9328
- C:\Windows\System\HhkCpwW.exe
  C:\Windows\System\HhkCpwW.exe
  2⤵
  PID:9364
- C:\Windows\System\hWlKDkh.exe
  C:\Windows\System\hWlKDkh.exe
  2⤵
  PID:9404
- C:\Windows\System\ZhvturL.exe
  C:\Windows\System\ZhvturL.exe
  2⤵
  PID:9432
- C:\Windows\System\JDyQSpo.exe
  C:\Windows\System\JDyQSpo.exe
  2⤵
  PID:9460
- C:\Windows\System\UJDPopM.exe
  C:\Windows\System\UJDPopM.exe
  2⤵
  PID:9488
- C:\Windows\System\DhfIKGF.exe
  C:\Windows\System\DhfIKGF.exe
  2⤵
  PID:9516
- C:\Windows\System\DUqfTTF.exe
  C:\Windows\System\DUqfTTF.exe
  2⤵
  PID:9544
- C:\Windows\System\rcZofOO.exe
  C:\Windows\System\rcZofOO.exe
  2⤵
  PID:9564
- C:\Windows\System\xoQihrG.exe
  C:\Windows\System\xoQihrG.exe
  2⤵
  PID:9592
- C:\Windows\System\LlQFfxA.exe
  C:\Windows\System\LlQFfxA.exe
  2⤵
  PID:9616
- C:\Windows\System\fLTKMuX.exe
  C:\Windows\System\fLTKMuX.exe
  2⤵
  PID:9656
- C:\Windows\System\KLAYXTu.exe
  C:\Windows\System\KLAYXTu.exe
  2⤵
  PID:9672
- C:\Windows\System\xqlJyHp.exe
  C:\Windows\System\xqlJyHp.exe
  2⤵
  PID:9712
- C:\Windows\System\sAplzIX.exe
  C:\Windows\System\sAplzIX.exe
  2⤵
  PID:9736
- C:\Windows\System\tmJKwxT.exe
  C:\Windows\System\tmJKwxT.exe
  2⤵
  PID:9760
- C:\Windows\System\xTvmJQI.exe
  C:\Windows\System\xTvmJQI.exe
  2⤵
  PID:9792
- C:\Windows\System\oTAKMam.exe
  C:\Windows\System\oTAKMam.exe
  2⤵
  PID:9824
- C:\Windows\System\nfNCKdV.exe
  C:\Windows\System\nfNCKdV.exe
  2⤵
  PID:9856
- C:\Windows\System\mRTzCJJ.exe
  C:\Windows\System\mRTzCJJ.exe
  2⤵
  PID:9884
- C:\Windows\System\fxkrOXa.exe
  C:\Windows\System\fxkrOXa.exe
  2⤵
  PID:9912
- C:\Windows\System\vzDmEWG.exe
  C:\Windows\System\vzDmEWG.exe
  2⤵
  PID:9936
- C:\Windows\System\NxRAszh.exe
  C:\Windows\System\NxRAszh.exe
  2⤵
  PID:9956
- C:\Windows\System\IoHQGxU.exe
  C:\Windows\System\IoHQGxU.exe
  2⤵
  PID:9984
- C:\Windows\System\CxXgFVD.exe
  C:\Windows\System\CxXgFVD.exe
  2⤵
  PID:10016
- C:\Windows\System\fzcGfRV.exe
  C:\Windows\System\fzcGfRV.exe
  2⤵
  PID:10052
- C:\Windows\System\GMgiAke.exe
  C:\Windows\System\GMgiAke.exe
  2⤵
  PID:10080
- C:\Windows\System\itwoJZs.exe
  C:\Windows\System\itwoJZs.exe
  2⤵
  PID:10108
- C:\Windows\System\tdVPUXA.exe
  C:\Windows\System\tdVPUXA.exe
  2⤵
  PID:10136
- C:\Windows\System\NdNiOca.exe
  C:\Windows\System\NdNiOca.exe
  2⤵
  PID:10164
- C:\Windows\System\tLDDgff.exe
  C:\Windows\System\tLDDgff.exe
  2⤵
  PID:10192
- C:\Windows\System\bdYSVxd.exe
  C:\Windows\System\bdYSVxd.exe
  2⤵
  PID:10220
- C:\Windows\System\VjthVRD.exe
  C:\Windows\System\VjthVRD.exe
  2⤵
  PID:8836
- C:\Windows\System\SXbAWtM.exe
  C:\Windows\System\SXbAWtM.exe
  2⤵
  PID:9008
- C:\Windows\System\sNPXIOs.exe
  C:\Windows\System\sNPXIOs.exe
  2⤵
  PID:9256
- C:\Windows\System\mFxeUOs.exe
  C:\Windows\System\mFxeUOs.exe
  2⤵
  PID:9288
- C:\Windows\System\lTbzBCc.exe
  C:\Windows\System\lTbzBCc.exe
  2⤵
  PID:9384
- C:\Windows\System\SjawEMU.exe
  C:\Windows\System\SjawEMU.exe
  2⤵
  PID:9452
- C:\Windows\System\ZRzvOuz.exe
  C:\Windows\System\ZRzvOuz.exe
  2⤵
  PID:9532
- C:\Windows\System\evbnGFb.exe
  C:\Windows\System\evbnGFb.exe
  2⤵
  PID:9580
- C:\Windows\System\nlAxRxh.exe
  C:\Windows\System\nlAxRxh.exe
  2⤵
  PID:9584
- C:\Windows\System\pQYIWev.exe
  C:\Windows\System\pQYIWev.exe
  2⤵
  PID:9664
- C:\Windows\System\qVanusm.exe
  C:\Windows\System\qVanusm.exe
  2⤵
  PID:9728
- C:\Windows\System\elEahvw.exe
  C:\Windows\System\elEahvw.exe
  2⤵
  PID:9812
- C:\Windows\System\ILwFHKj.exe
  C:\Windows\System\ILwFHKj.exe
  2⤵
  PID:9840
- C:\Windows\System\ltISSZQ.exe
  C:\Windows\System\ltISSZQ.exe
  2⤵
  PID:9944
- C:\Windows\System\fAFEIzO.exe
  C:\Windows\System\fAFEIzO.exe
  2⤵
  PID:10008
- C:\Windows\System\pUfFVSl.exe
  C:\Windows\System\pUfFVSl.exe
  2⤵
  PID:10076
- C:\Windows\System\klZJNvi.exe
  C:\Windows\System\klZJNvi.exe
  2⤵
  PID:10132
- C:\Windows\System\tOvLagH.exe
  C:\Windows\System\tOvLagH.exe
  2⤵
  PID:10180
- C:\Windows\System\aJIFOcM.exe
  C:\Windows\System\aJIFOcM.exe
  2⤵
  PID:9064
- C:\Windows\System\SjEHAeT.exe
  C:\Windows\System\SjEHAeT.exe
  2⤵
  PID:9396
- C:\Windows\System\lpeSTqC.exe
  C:\Windows\System\lpeSTqC.exe
  2⤵
  PID:9780
- C:\Windows\System\CGNaudz.exe
  C:\Windows\System\CGNaudz.exe
  2⤵
  PID:9928
- C:\Windows\System\icQrcaI.exe
  C:\Windows\System\icQrcaI.exe
  2⤵
  PID:10096
- C:\Windows\System\Bbfzmef.exe
  C:\Windows\System\Bbfzmef.exe
  2⤵
  PID:10184
- C:\Windows\System\SAkVEyz.exe
  C:\Windows\System\SAkVEyz.exe
  2⤵
  PID:9336
- C:\Windows\System\FcuxfrX.exe
  C:\Windows\System\FcuxfrX.exe
  2⤵
  PID:9752
- C:\Windows\System\VszZTjg.exe
  C:\Windows\System\VszZTjg.exe
  2⤵
  PID:9976
- C:\Windows\System\ZjhBStX.exe
  C:\Windows\System\ZjhBStX.exe
  2⤵
  PID:9772
- C:\Windows\System\HFFmRfb.exe
  C:\Windows\System\HFFmRfb.exe
  2⤵
  PID:9280
- C:\Windows\System\iiuMkzd.exe
  C:\Windows\System\iiuMkzd.exe
  2⤵
  PID:10272
- C:\Windows\System\WiUmTuG.exe
  C:\Windows\System\WiUmTuG.exe
  2⤵
  PID:10292
- C:\Windows\System\XfvoCza.exe
  C:\Windows\System\XfvoCza.exe
  2⤵
  PID:10320
- C:\Windows\System\JnfEvIb.exe
  C:\Windows\System\JnfEvIb.exe
  2⤵
  PID:10360
- C:\Windows\System\ryxNoJb.exe
  C:\Windows\System\ryxNoJb.exe
  2⤵
  PID:10388
- C:\Windows\System\LSrxBfH.exe
  C:\Windows\System\LSrxBfH.exe
  2⤵
  PID:10416
- C:\Windows\System\qeLRWQd.exe
  C:\Windows\System\qeLRWQd.exe
  2⤵
  PID:10432
- C:\Windows\System\sGgeXfV.exe
  C:\Windows\System\sGgeXfV.exe
  2⤵
  PID:10448
- C:\Windows\System\tQCfmJR.exe
  C:\Windows\System\tQCfmJR.exe
  2⤵
  PID:10464
- C:\Windows\System\Bwxrdkg.exe
  C:\Windows\System\Bwxrdkg.exe
  2⤵
  PID:10504
- C:\Windows\System\ZQzuAGJ.exe
  C:\Windows\System\ZQzuAGJ.exe
  2⤵
  PID:10528
- C:\Windows\System\mFuSRul.exe
  C:\Windows\System\mFuSRul.exe
  2⤵
  PID:10556
- C:\Windows\System\lxLQMHb.exe
  C:\Windows\System\lxLQMHb.exe
  2⤵
  PID:10572
- C:\Windows\System\pDjKepd.exe
  C:\Windows\System\pDjKepd.exe
  2⤵
  PID:10592
- C:\Windows\System\VUxhnXt.exe
  C:\Windows\System\VUxhnXt.exe
  2⤵
  PID:10616
- C:\Windows\System\BHIGAxU.exe
  C:\Windows\System\BHIGAxU.exe
  2⤵
  PID:10636
- C:\Windows\System\qXzgUEn.exe
  C:\Windows\System\qXzgUEn.exe
  2⤵
  PID:10660
- C:\Windows\System\aEclSuG.exe
  C:\Windows\System\aEclSuG.exe
  2⤵
  PID:10684
- C:\Windows\System\VpYsYJn.exe
  C:\Windows\System\VpYsYJn.exe
  2⤵
  PID:10720
- C:\Windows\System\OJNzgND.exe
  C:\Windows\System\OJNzgND.exe
  2⤵
  PID:10744
- C:\Windows\System\kJxUAXS.exe
  C:\Windows\System\kJxUAXS.exe
  2⤵
  PID:10792
- C:\Windows\System\pOzClVD.exe
  C:\Windows\System\pOzClVD.exe
  2⤵
  PID:10816
- C:\Windows\System\wDjzROL.exe
  C:\Windows\System\wDjzROL.exe
  2⤵
  PID:10852
- C:\Windows\System\fhvIxYJ.exe
  C:\Windows\System\fhvIxYJ.exe
  2⤵
  PID:10876
- C:\Windows\System\keZLrMv.exe
  C:\Windows\System\keZLrMv.exe
  2⤵
  PID:10900
- C:\Windows\System\XNGucgc.exe
  C:\Windows\System\XNGucgc.exe
  2⤵
  PID:10916
- C:\Windows\System\bGInxhQ.exe
  C:\Windows\System\bGInxhQ.exe
  2⤵
  PID:10964
- C:\Windows\System\cbCZSCd.exe
  C:\Windows\System\cbCZSCd.exe
  2⤵
  PID:11012
- C:\Windows\System\eXNRerN.exe
  C:\Windows\System\eXNRerN.exe
  2⤵
  PID:11044
- C:\Windows\System\ylUyFBs.exe
  C:\Windows\System\ylUyFBs.exe
  2⤵
  PID:11088
- C:\Windows\System\aEwcOXd.exe
  C:\Windows\System\aEwcOXd.exe
  2⤵
  PID:11104
- C:\Windows\System\gFILeEV.exe
  C:\Windows\System\gFILeEV.exe
  2⤵
  PID:11144
- C:\Windows\System\tgNxwxn.exe
  C:\Windows\System\tgNxwxn.exe
  2⤵
  PID:11160
- C:\Windows\System\cUuaNyb.exe
  C:\Windows\System\cUuaNyb.exe
  2⤵
  PID:11176
- C:\Windows\System\xvkOSIS.exe
  C:\Windows\System\xvkOSIS.exe
  2⤵
  PID:11192
- C:\Windows\System\gqpNEdY.exe
  C:\Windows\System\gqpNEdY.exe
  2⤵
  PID:11216
- C:\Windows\System\EjguQWm.exe
  C:\Windows\System\EjguQWm.exe
  2⤵
  PID:11244
- C:\Windows\System\kRqOBJs.exe
  C:\Windows\System\kRqOBJs.exe
  2⤵
  PID:9896
- C:\Windows\System\DaDbxBd.exe
  C:\Windows\System\DaDbxBd.exe
  2⤵
  PID:10288
- C:\Windows\System\xPXNjlh.exe
  C:\Windows\System\xPXNjlh.exe
  2⤵
  PID:10372
- C:\Windows\System\CCyIeRi.exe
  C:\Windows\System\CCyIeRi.exe
  2⤵
  PID:10424
- C:\Windows\System\QjRSUUQ.exe
  C:\Windows\System\QjRSUUQ.exe
  2⤵
  PID:10512
- C:\Windows\System\TaONfYR.exe
  C:\Windows\System\TaONfYR.exe
  2⤵
  PID:10540
- C:\Windows\System\mfIEZss.exe
  C:\Windows\System\mfIEZss.exe
  2⤵
  PID:10624
- C:\Windows\System\UBdnbLb.exe
  C:\Windows\System\UBdnbLb.exe
  2⤵
  PID:10676
- C:\Windows\System\prIjfev.exe
  C:\Windows\System\prIjfev.exe
  2⤵
  PID:10868
- C:\Windows\System\OpfhqDo.exe
  C:\Windows\System\OpfhqDo.exe
  2⤵
  PID:10892
- C:\Windows\System\ghkGHfl.exe
  C:\Windows\System\ghkGHfl.exe
  2⤵
  PID:10912
- C:\Windows\System\zApeKxK.exe
  C:\Windows\System\zApeKxK.exe
  2⤵
  PID:11032
- C:\Windows\System\YECYwMR.exe
  C:\Windows\System\YECYwMR.exe
  2⤵
  PID:11096
- C:\Windows\System\WwZtzKx.exe
  C:\Windows\System\WwZtzKx.exe
  2⤵
  PID:11152
- C:\Windows\System\DzRmUJD.exe
  C:\Windows\System\DzRmUJD.exe
  2⤵
  PID:11212
- C:\Windows\System\GfgUhLR.exe
  C:\Windows\System\GfgUhLR.exe
  2⤵
  PID:10256
- C:\Windows\System\OPHpZZc.exe
  C:\Windows\System\OPHpZZc.exe
  2⤵
  PID:10336
- C:\Windows\System\QdzsHUx.exe
  C:\Windows\System\QdzsHUx.exe
  2⤵
  PID:10492
- C:\Windows\System\FyLJjxj.exe
  C:\Windows\System\FyLJjxj.exe
  2⤵
  PID:10628
- C:\Windows\System\iwMHBbS.exe
  C:\Windows\System\iwMHBbS.exe
  2⤵
  PID:10780
- C:\Windows\System\ZaNgmeh.exe
  C:\Windows\System\ZaNgmeh.exe
  2⤵
  PID:10872
- C:\Windows\System\vSuyRLx.exe
  C:\Windows\System\vSuyRLx.exe
  2⤵
  PID:10936
- C:\Windows\System\UfzZThp.exe
  C:\Windows\System\UfzZThp.exe
  2⤵
  PID:11172
- C:\Windows\System\gtSGTzO.exe
  C:\Windows\System\gtSGTzO.exe
  2⤵
  PID:10456
- C:\Windows\System\qrqOmzK.exe
  C:\Windows\System\qrqOmzK.exe
  2⤵
  PID:11136
- C:\Windows\System\vVxsNqZ.exe
  C:\Windows\System\vVxsNqZ.exe
  2⤵
  PID:10580
- C:\Windows\System\QHsidTy.exe
  C:\Windows\System\QHsidTy.exe
  2⤵
  PID:11284
- C:\Windows\System\bOCgMjm.exe
  C:\Windows\System\bOCgMjm.exe
  2⤵
  PID:11316
- C:\Windows\System\coBuhiJ.exe
  C:\Windows\System\coBuhiJ.exe
  2⤵
  PID:11336
- C:\Windows\System\dDmGREr.exe
  C:\Windows\System\dDmGREr.exe
  2⤵
  PID:11356
- C:\Windows\System\buIEaVq.exe
  C:\Windows\System\buIEaVq.exe
  2⤵
  PID:11372
- C:\Windows\System\etDaFua.exe
  C:\Windows\System\etDaFua.exe
  2⤵
  PID:11436
- C:\Windows\System\WOwMiPZ.exe
  C:\Windows\System\WOwMiPZ.exe
  2⤵
  PID:11464
- C:\Windows\System\PLzYdNt.exe
  C:\Windows\System\PLzYdNt.exe
  2⤵
  PID:11480
- C:\Windows\System\DSLapPS.exe
  C:\Windows\System\DSLapPS.exe
  2⤵
  PID:11516
- C:\Windows\System\MbfbEKy.exe
  C:\Windows\System\MbfbEKy.exe
  2⤵
  PID:11548
- C:\Windows\System\mtThiKL.exe
  C:\Windows\System\mtThiKL.exe
  2⤵
  PID:11568
- C:\Windows\System\dzIxRLh.exe
  C:\Windows\System\dzIxRLh.exe
  2⤵
  PID:11592
- C:\Windows\System\GBaoWfM.exe
  C:\Windows\System\GBaoWfM.exe
  2⤵
  PID:11620
- C:\Windows\System\wTroqub.exe
  C:\Windows\System\wTroqub.exe
  2⤵
  PID:11648
- C:\Windows\System\lbMMxhq.exe
  C:\Windows\System\lbMMxhq.exe
  2⤵
  PID:11672
- C:\Windows\System\fWdDObD.exe
  C:\Windows\System\fWdDObD.exe
  2⤵
  PID:11704
- C:\Windows\System\AQYaHWE.exe
  C:\Windows\System\AQYaHWE.exe
  2⤵
  PID:11732
- C:\Windows\System\QPjyCvt.exe
  C:\Windows\System\QPjyCvt.exe
  2⤵
  PID:11760
- C:\Windows\System\bhLjXUn.exe
  C:\Windows\System\bhLjXUn.exe
  2⤵
  PID:11776
- C:\Windows\System\zGmCXzz.exe
  C:\Windows\System\zGmCXzz.exe
  2⤵
  PID:11804
- C:\Windows\System\AnXoQoa.exe
  C:\Windows\System\AnXoQoa.exe
  2⤵
  PID:11836
- C:\Windows\System\DsmMFWy.exe
  C:\Windows\System\DsmMFWy.exe
  2⤵
  PID:11852
- C:\Windows\System\BQTSjum.exe
  C:\Windows\System\BQTSjum.exe
  2⤵
  PID:11880
- C:\Windows\System\eunhojk.exe
  C:\Windows\System\eunhojk.exe
  2⤵
  PID:11912
- C:\Windows\System\fuqQxMi.exe
  C:\Windows\System\fuqQxMi.exe
  2⤵
  PID:11968
- C:\Windows\System\MrqPCmI.exe
  C:\Windows\System\MrqPCmI.exe
  2⤵
  PID:11992
- C:\Windows\System\khYCmwq.exe
  C:\Windows\System\khYCmwq.exe
  2⤵
  PID:12012
- C:\Windows\System\QowzOrs.exe
  C:\Windows\System\QowzOrs.exe
  2⤵
  PID:12032
- C:\Windows\System\AVFzHzU.exe
  C:\Windows\System\AVFzHzU.exe
  2⤵
  PID:12068
- C:\Windows\System\gcPbvwU.exe
  C:\Windows\System\gcPbvwU.exe
  2⤵
  PID:12108
- C:\Windows\System\vJpZmkG.exe
  C:\Windows\System\vJpZmkG.exe
  2⤵
  PID:12128
- C:\Windows\System\yRwqsTI.exe
  C:\Windows\System\yRwqsTI.exe
  2⤵
  PID:12152
- C:\Windows\System\OePydbx.exe
  C:\Windows\System\OePydbx.exe
  2⤵
  PID:12180
- C:\Windows\System\XCInGoc.exe
  C:\Windows\System\XCInGoc.exe
  2⤵
  PID:12196
- C:\Windows\System\ymNnbvp.exe
  C:\Windows\System\ymNnbvp.exe
  2⤵
  PID:12216
- C:\Windows\System\gUmeQsL.exe
  C:\Windows\System\gUmeQsL.exe
  2⤵
  PID:12256
- C:\Windows\System\sVEdGbt.exe
  C:\Windows\System\sVEdGbt.exe
  2⤵
  PID:12284
- C:\Windows\System\kAbrQuf.exe
  C:\Windows\System\kAbrQuf.exe
  2⤵
  PID:11276
- C:\Windows\System\WwgNHup.exe
  C:\Windows\System\WwgNHup.exe
  2⤵
  PID:11388
- C:\Windows\System\jsaDRnx.exe
  C:\Windows\System\jsaDRnx.exe
  2⤵
  PID:11460
- C:\Windows\System\rjgSOHU.exe
  C:\Windows\System\rjgSOHU.exe
  2⤵
  PID:11524
- C:\Windows\System\vAAAADO.exe
  C:\Windows\System\vAAAADO.exe
  2⤵
  PID:11612
- C:\Windows\System\XGfOMpA.exe
  C:\Windows\System\XGfOMpA.exe
  2⤵
  PID:11640
- C:\Windows\System\CBEYMFs.exe
  C:\Windows\System\CBEYMFs.exe
  2⤵
  PID:11720
- C:\Windows\System\XpTgYng.exe
  C:\Windows\System\XpTgYng.exe
  2⤵
  PID:11748
- C:\Windows\System\XUvsVka.exe
  C:\Windows\System\XUvsVka.exe
  2⤵
  PID:11796
- C:\Windows\System\iJomTBM.exe
  C:\Windows\System\iJomTBM.exe
  2⤵
  PID:11844
- C:\Windows\System\NFCWAPW.exe
  C:\Windows\System\NFCWAPW.exe
  2⤵
  PID:11868
- C:\Windows\System\VwsloEP.exe
  C:\Windows\System\VwsloEP.exe
  2⤵
  PID:12024
- C:\Windows\System\ySdDWmZ.exe
  C:\Windows\System\ySdDWmZ.exe
  2⤵
  PID:12100
- C:\Windows\System\FmAbCju.exe
  C:\Windows\System\FmAbCju.exe
  2⤵
  PID:12116
- C:\Windows\System\ZznZUaZ.exe
  C:\Windows\System\ZznZUaZ.exe
  2⤵
  PID:12208
- C:\Windows\System\wlPfjII.exe
  C:\Windows\System\wlPfjII.exe
  2⤵
  PID:11312
- C:\Windows\System\yEubJCF.exe
  C:\Windows\System\yEubJCF.exe
  2⤵
  PID:11432
- C:\Windows\System\xNgtPPQ.exe
  C:\Windows\System\xNgtPPQ.exe
  2⤵
  PID:11584
- C:\Windows\System\VUxSAal.exe
  C:\Windows\System\VUxSAal.exe
  2⤵
  PID:11816
- C:\Windows\System\FzwxTjk.exe
  C:\Windows\System\FzwxTjk.exe
  2⤵
  PID:11892
- C:\Windows\System\kxnoUqV.exe
  C:\Windows\System\kxnoUqV.exe
  2⤵
  PID:12052
- C:\Windows\System\QBOQqeA.exe
  C:\Windows\System\QBOQqeA.exe
  2⤵
  PID:12172
- C:\Windows\System\qLLeSVU.exe
  C:\Windows\System\qLLeSVU.exe
  2⤵
  PID:11428
- C:\Windows\System\NSAZKtg.exe
  C:\Windows\System\NSAZKtg.exe
  2⤵
  PID:10412
- C:\Windows\System\iSCJhRv.exe
  C:\Windows\System\iSCJhRv.exe
  2⤵
  PID:12104
- C:\Windows\System\sEXnYZg.exe
  C:\Windows\System\sEXnYZg.exe
  2⤵
  PID:11664
- C:\Windows\System\AkyuOWt.exe
  C:\Windows\System\AkyuOWt.exe
  2⤵
  PID:12296
- C:\Windows\System\IjIrvuz.exe
  C:\Windows\System\IjIrvuz.exe
  2⤵
  PID:12316
- C:\Windows\System\GuAhrUw.exe
  C:\Windows\System\GuAhrUw.exe
  2⤵
  PID:12372
- C:\Windows\System\uvzpEJT.exe
  C:\Windows\System\uvzpEJT.exe
  2⤵
  PID:12392
- C:\Windows\System\StoxYHJ.exe
  C:\Windows\System\StoxYHJ.exe
  2⤵
  PID:12416
- C:\Windows\System\XUUMIXt.exe
  C:\Windows\System\XUUMIXt.exe
  2⤵
  PID:12452
- C:\Windows\System\ItuGwyM.exe
  C:\Windows\System\ItuGwyM.exe
  2⤵
  PID:12476
- C:\Windows\System\KQTnnxQ.exe
  C:\Windows\System\KQTnnxQ.exe
  2⤵
  PID:12504
- C:\Windows\System\DaYMxcY.exe
  C:\Windows\System\DaYMxcY.exe
  2⤵
  PID:12548
- C:\Windows\System\BLjQGPJ.exe
  C:\Windows\System\BLjQGPJ.exe
  2⤵
  PID:12576
- C:\Windows\System\YBXnqdL.exe
  C:\Windows\System\YBXnqdL.exe
  2⤵
  PID:12604
- C:\Windows\System\XCKtZqn.exe
  C:\Windows\System\XCKtZqn.exe
  2⤵
  PID:12620
- C:\Windows\System\PdyUGka.exe
  C:\Windows\System\PdyUGka.exe
  2⤵
  PID:12636
- C:\Windows\System\wnASydI.exe
  C:\Windows\System\wnASydI.exe
  2⤵
  PID:12668
- C:\Windows\System\PmzSFpZ.exe
  C:\Windows\System\PmzSFpZ.exe
  2⤵
  PID:12700
- C:\Windows\System\nXsZXfr.exe
  C:\Windows\System\nXsZXfr.exe
  2⤵
  PID:12724
- C:\Windows\System\hSIzcqj.exe
  C:\Windows\System\hSIzcqj.exe
  2⤵
  PID:12760
- C:\Windows\System\eSForuW.exe
  C:\Windows\System\eSForuW.exe
  2⤵
  PID:12792
- C:\Windows\System\gTaJfqw.exe
  C:\Windows\System\gTaJfqw.exe
  2⤵
  PID:12816
- C:\Windows\System\ULfmlII.exe
  C:\Windows\System\ULfmlII.exe
  2⤵
  PID:12848
- C:\Windows\System\jiDUiKs.exe
  C:\Windows\System\jiDUiKs.exe
  2⤵
  PID:12876
- C:\Windows\System\IQedPAl.exe
  C:\Windows\System\IQedPAl.exe
  2⤵
  PID:12908
- C:\Windows\System\RrcPotM.exe
  C:\Windows\System\RrcPotM.exe
  2⤵
  PID:12932
- C:\Windows\System\CSOqBRJ.exe
  C:\Windows\System\CSOqBRJ.exe
  2⤵
  PID:12960
- C:\Windows\System\riJVqmg.exe
  C:\Windows\System\riJVqmg.exe
  2⤵
  PID:13000
- C:\Windows\System\iNRFSox.exe
  C:\Windows\System\iNRFSox.exe
  2⤵
  PID:13016
- C:\Windows\System\ZoScxyi.exe
  C:\Windows\System\ZoScxyi.exe
  2⤵
  PID:13056
- C:\Windows\System\FqGtZUK.exe
  C:\Windows\System\FqGtZUK.exe
  2⤵
  PID:13072
- C:\Windows\System\qhzjomd.exe
  C:\Windows\System\qhzjomd.exe
  2⤵
  PID:13096
- C:\Windows\System\RZFJciL.exe
  C:\Windows\System\RZFJciL.exe
  2⤵
  PID:13128
- C:\Windows\System\FbejBUh.exe
  C:\Windows\System\FbejBUh.exe
  2⤵
  PID:13144
- C:\Windows\System\qheUuQJ.exe
  C:\Windows\System\qheUuQJ.exe
  2⤵
  PID:13172
- C:\Windows\System\VyVnoLZ.exe
  C:\Windows\System\VyVnoLZ.exe
  2⤵
  PID:13192
- C:\Windows\System\ZUTKVaX.exe
  C:\Windows\System\ZUTKVaX.exe
  2⤵
  PID:13216
- C:\Windows\System\HXJqTkW.exe
  C:\Windows\System\HXJqTkW.exe
  2⤵
  PID:13236
- C:\Windows\System\UOqjzYu.exe
  C:\Windows\System\UOqjzYu.exe
  2⤵
  PID:13276
- C:\Windows\System\WAPuQRx.exe
  C:\Windows\System\WAPuQRx.exe
  2⤵
  PID:13304
- C:\Windows\System\HLxRcOr.exe
  C:\Windows\System\HLxRcOr.exe
  2⤵
  PID:12312
- C:\Windows\System\RuuBxRr.exe
  C:\Windows\System\RuuBxRr.exe
  2⤵
  PID:12400
- C:\Windows\System\WSEQLgq.exe
  C:\Windows\System\WSEQLgq.exe
  2⤵
  PID:12448
- C:\Windows\System\jgdkpUz.exe
  C:\Windows\System\jgdkpUz.exe
  2⤵
  PID:12600
- C:\Windows\System\udmCzQH.exe
  C:\Windows\System\udmCzQH.exe
  2⤵
  PID:12612
- C:\Windows\System\nOCMKKK.exe
  C:\Windows\System\nOCMKKK.exe
  2⤵
  PID:12692
- C:\Windows\System\WhqNSNu.exe
  C:\Windows\System\WhqNSNu.exe
  2⤵
  PID:12752
- C:\Windows\System\zfcLAQT.exe
  C:\Windows\System\zfcLAQT.exe
  2⤵
  PID:12840
- C:\Windows\System\uNoYisY.exe
  C:\Windows\System\uNoYisY.exe
  2⤵
  PID:12864
- C:\Windows\System\mvWfREw.exe
  C:\Windows\System\mvWfREw.exe
  2⤵
  PID:12948
- C:\Windows\System\cjHVwpy.exe
  C:\Windows\System\cjHVwpy.exe
  2⤵
  PID:12992
- C:\Windows\System\xPfdJac.exe
  C:\Windows\System\xPfdJac.exe
  2⤵
  PID:13048
- C:\Windows\System\VRFaPbD.exe
  C:\Windows\System\VRFaPbD.exe
  2⤵
  PID:13112
- C:\Windows\System\bbTsREM.exe
  C:\Windows\System\bbTsREM.exe
  2⤵
  PID:13232
- C:\Windows\System\uFaodFl.exe
  C:\Windows\System\uFaodFl.exe
  2⤵
  PID:13288
- C:\Windows\System\ikuZFXi.exe
  C:\Windows\System\ikuZFXi.exe
  2⤵
  PID:13272
- C:\Windows\System\PVgwGcS.exe
  C:\Windows\System\PVgwGcS.exe
  2⤵
  PID:12352
- C:\Windows\System\LmUoPEh.exe
  C:\Windows\System\LmUoPEh.exe
  2⤵
  PID:12628
- C:\Windows\System\cSwllau.exe
  C:\Windows\System\cSwllau.exe
  2⤵
  PID:12780
- C:\Windows\System\CZZomDk.exe
  C:\Windows\System\CZZomDk.exe
  2⤵
  PID:12896
- C:\Windows\System\oOuYCYD.exe
  C:\Windows\System\oOuYCYD.exe
  2⤵
  PID:13212
- C:\Windows\System\wBLZuTB.exe
  C:\Windows\System\wBLZuTB.exe
  2⤵
  PID:13136
- C:\Windows\System\DRlJwFN.exe
  C:\Windows\System\DRlJwFN.exe
  2⤵
  PID:4840
- C:\Windows\System\DcbasEM.exe
  C:\Windows\System\DcbasEM.exe
  2⤵
  PID:12440
- C:\Windows\System\fpYNZKT.exe
  C:\Windows\System\fpYNZKT.exe
  2⤵
  PID:13012
- C:\Windows\System\zdLFALw.exe
  C:\Windows\System\zdLFALw.exe
  2⤵
  PID:13316
- C:\Windows\System\MdqdCXb.exe
  C:\Windows\System\MdqdCXb.exe
  2⤵
  PID:13364
- C:\Windows\System\RsPNZuk.exe
  C:\Windows\System\RsPNZuk.exe
  2⤵
  PID:13396
- C:\Windows\System\AAUHTUS.exe
  C:\Windows\System\AAUHTUS.exe
  2⤵
  PID:13420
- C:\Windows\System\ORZeqKL.exe
  C:\Windows\System\ORZeqKL.exe
  2⤵
  PID:13440
- C:\Windows\System\fHalljz.exe
  C:\Windows\System\fHalljz.exe
  2⤵
  PID:13480
- C:\Windows\System\cPIPzvz.exe
  C:\Windows\System\cPIPzvz.exe
  2⤵
  PID:13508
- C:\Windows\System\gRnAFLu.exe
  C:\Windows\System\gRnAFLu.exe
  2⤵
  PID:13528
- C:\Windows\System\qFhcAEh.exe
  C:\Windows\System\qFhcAEh.exe
  2⤵
  PID:13552
- C:\Windows\System\VqIGEHH.exe
  C:\Windows\System\VqIGEHH.exe
  2⤵
  PID:13596
- C:\Windows\System\PCuzaDS.exe
  C:\Windows\System\PCuzaDS.exe
  2⤵
  PID:13616
- C:\Windows\System\gVfsjuS.exe
  C:\Windows\System\gVfsjuS.exe
  2⤵
  PID:13644
- C:\Windows\System\GadHXxB.exe
  C:\Windows\System\GadHXxB.exe
  2⤵
  PID:13672
- C:\Windows\System\ssVPhSv.exe
  C:\Windows\System\ssVPhSv.exe
  2⤵
  PID:13712
- C:\Windows\System\SiIvGXT.exe
  C:\Windows\System\SiIvGXT.exe
  2⤵
  PID:13732
- C:\Windows\System\ElRoLoA.exe
  C:\Windows\System\ElRoLoA.exe
  2⤵
  PID:13752
- C:\Windows\System\hCwLaqS.exe
  C:\Windows\System\hCwLaqS.exe
  2⤵
  PID:13792
- C:\Windows\System\mZaTdNu.exe
  C:\Windows\System\mZaTdNu.exe
  2⤵
  PID:13812
- C:\Windows\System\KaxFzpN.exe
  C:\Windows\System\KaxFzpN.exe
  2⤵
  PID:13828
- C:\Windows\System\IFuUNxf.exe
  C:\Windows\System\IFuUNxf.exe
  2⤵
  PID:13864
- C:\Windows\System\yhggIXA.exe
  C:\Windows\System\yhggIXA.exe
  2⤵
  PID:13896
- C:\Windows\System\MekRekT.exe
  C:\Windows\System\MekRekT.exe
  2⤵
  PID:13940
- C:\Windows\System\EyeXUyl.exe
  C:\Windows\System\EyeXUyl.exe
  2⤵
  PID:13968
- C:\Windows\System\BkZDxcu.exe
  C:\Windows\System\BkZDxcu.exe
  2⤵
  PID:13988
- C:\Windows\System\XtuDBSg.exe
  C:\Windows\System\XtuDBSg.exe
  2⤵
  PID:14012
- C:\Windows\System\dyPLPlg.exe
  C:\Windows\System\dyPLPlg.exe
  2⤵
  PID:14028
- C:\Windows\System\HTinBUK.exe
  C:\Windows\System\HTinBUK.exe
  2⤵
  PID:14048
- C:\Windows\System\VwqViPE.exe
  C:\Windows\System\VwqViPE.exe
  2⤵
  PID:14072
- C:\Windows\System\bMUWfPo.exe
  C:\Windows\System\bMUWfPo.exe
  2⤵
  PID:14124
- C:\Windows\System\WdMBZSJ.exe
  C:\Windows\System\WdMBZSJ.exe
  2⤵
  PID:14156
- C:\Windows\System\CpQDRKL.exe
  C:\Windows\System\CpQDRKL.exe
  2⤵
  PID:14176
- C:\Windows\System\gtlbIti.exe
  C:\Windows\System\gtlbIti.exe
  2⤵
  PID:14200
- C:\Windows\System\TSFYlvM.exe
  C:\Windows\System\TSFYlvM.exe
  2⤵
  PID:14232
- C:\Windows\System\vvRgqBg.exe
  C:\Windows\System\vvRgqBg.exe
  2⤵
  PID:14256
- C:\Windows\System\sVrxhGy.exe
  C:\Windows\System\sVrxhGy.exe
  2⤵
  PID:14280
- C:\Windows\System\qnYNjws.exe
  C:\Windows\System\qnYNjws.exe
  2⤵
  PID:14308
- C:\Windows\System\oEGdgMx.exe
  C:\Windows\System\oEGdgMx.exe
  2⤵
  PID:13332
- C:\Windows\System\ZqbkRLh.exe
  C:\Windows\System\ZqbkRLh.exe
  2⤵
  PID:13356
- C:\Windows\System\QTXfhMM.exe
  C:\Windows\System\QTXfhMM.exe
  2⤵
  PID:13392
- C:\Windows\System\qvVdhqV.exe
  C:\Windows\System\qvVdhqV.exe
  2⤵
  PID:2036
- C:\Windows\System\RaZCMvF.exe
  C:\Windows\System\RaZCMvF.exe
  2⤵
  PID:11772
- C:\Windows\System\XfTQgfw.exe
  C:\Windows\System\XfTQgfw.exe
  2⤵
  PID:13548
- C:\Windows\System\ToVIYss.exe
  C:\Windows\System\ToVIYss.exe
  2⤵
  PID:13628
- C:\Windows\System\vXYLmhY.exe
  C:\Windows\System\vXYLmhY.exe
  2⤵
  PID:13708
- C:\Windows\System\kuhcLSe.exe
  C:\Windows\System\kuhcLSe.exe
  2⤵
  PID:13740
- C:\Windows\System\pCirVdC.exe
  C:\Windows\System\pCirVdC.exe
  2⤵
  PID:13804
- C:\Windows\System\RQDSgzX.exe
  C:\Windows\System\RQDSgzX.exe
  2⤵
  PID:13848
- C:\Windows\System\uIpwIeZ.exe
  C:\Windows\System\uIpwIeZ.exe
  2⤵
  PID:13952
- C:\Windows\System\YkyZTLM.exe
  C:\Windows\System\YkyZTLM.exe
  2⤵
  PID:14000
- C:\Windows\System\RDpdXzZ.exe
  C:\Windows\System\RDpdXzZ.exe
  2⤵
  PID:14068
- C:\Windows\System\QSLCPHk.exe
  C:\Windows\System\QSLCPHk.exe
  2⤵
  PID:14152
- C:\Windows\System\QmXyMyx.exe
  C:\Windows\System\QmXyMyx.exe
  2⤵
  PID:14188
- C:\Windows\System\dfQVonk.exe
  C:\Windows\System\dfQVonk.exe
  2⤵
  PID:14252
- C:\Windows\System\ScRnuqY.exe
  C:\Windows\System\ScRnuqY.exe
  2⤵
  PID:14332
- C:\Windows\System\welJtCE.exe
  C:\Windows\System\welJtCE.exe
  2⤵
  PID:13380
- C:\Windows\System\HxYxttV.exe
  C:\Windows\System\HxYxttV.exe
  2⤵
  PID:5032
- C:\Windows\System\nqSXaGW.exe
  C:\Windows\System\nqSXaGW.exe
  2⤵
  PID:13588
- C:\Windows\System\eSjaeCc.exe
  C:\Windows\System\eSjaeCc.exe
  2⤵
  PID:13780
- C:\Windows\System\Tnlvyfy.exe
  C:\Windows\System\Tnlvyfy.exe
  2⤵
  PID:13960
- C:\Windows\System\jmYpWgg.exe
  C:\Windows\System\jmYpWgg.exe
  2⤵
  PID:14064
- C:\Windows\System\aAHyQgi.exe
  C:\Windows\System\aAHyQgi.exe
  2⤵
  PID:14228
- C:\Windows\System\OWcdAzK.exe
  C:\Windows\System\OWcdAzK.exe
  2⤵
  PID:14296
- C:\Windows\System\iThKRJc.exe
  C:\Windows\System\iThKRJc.exe
  2⤵
  PID:13800
- C:\Windows\System\fintrgL.exe
  C:\Windows\System\fintrgL.exe
  2⤵
  PID:13516
- C:\Windows\System\sphYlUv.exe
  C:\Windows\System\sphYlUv.exe
  2⤵
  PID:13436
- C:\Windows\System\lthuYTP.exe
  C:\Windows\System\lthuYTP.exe
  2⤵
  PID:13880
- C:\Windows\System\yBNnBBG.exe
  C:\Windows\System\yBNnBBG.exe
  2⤵
  PID:14352
- C:\Windows\System\cixlIao.exe
  C:\Windows\System\cixlIao.exe
  2⤵
  PID:14380
- C:\Windows\System\UXEDdye.exe
  C:\Windows\System\UXEDdye.exe
  2⤵
  PID:14408
- C:\Windows\System\gIBcDQm.exe
  C:\Windows\System\gIBcDQm.exe
  2⤵
  PID:14440
- C:\Windows\System\nAHRhIS.exe
  C:\Windows\System\nAHRhIS.exe
  2⤵
  PID:14464
- C:\Windows\System\eNgofPC.exe
  C:\Windows\System\eNgofPC.exe
  2⤵
  PID:14492
- C:\Windows\System\UrFMmmB.exe
  C:\Windows\System\UrFMmmB.exe
  2⤵
  PID:14536
- C:\Windows\System\UWZVguL.exe
  C:\Windows\System\UWZVguL.exe
  2⤵
  PID:14564
- C:\Windows\System\qDQgiIS.exe
  C:\Windows\System\qDQgiIS.exe
  2⤵
  PID:14588
- C:\Windows\System\tAnWDED.exe
  C:\Windows\System\tAnWDED.exe
  2⤵
  PID:14608
- C:\Windows\System\OuODomE.exe
  C:\Windows\System\OuODomE.exe
  2⤵
  PID:14648
- C:\Windows\System\ZgNDnJh.exe
  C:\Windows\System\ZgNDnJh.exe
  2⤵
  PID:14676
- C:\Windows\System\XToeynO.exe
  C:\Windows\System\XToeynO.exe
  2⤵
  PID:14692
- C:\Windows\System\hyQybtp.exe
  C:\Windows\System\hyQybtp.exe
  2⤵
  PID:14712
- C:\Windows\System\HjWpUjy.exe
  C:\Windows\System\HjWpUjy.exe
  2⤵
  PID:14760
- C:\Windows\System\LbPkHlh.exe
  C:\Windows\System\LbPkHlh.exe
  2⤵
  PID:14776
- C:\Windows\System\mjmmkuT.exe
  C:\Windows\System\mjmmkuT.exe
  2⤵
  PID:14804
- C:\Windows\System\tNUPwff.exe
  C:\Windows\System\tNUPwff.exe
  2⤵
  PID:14832
- C:\Windows\System\xzgDABQ.exe
  C:\Windows\System\xzgDABQ.exe
  2⤵
  PID:14872
- C:\Windows\System\AHKxbLM.exe
  C:\Windows\System\AHKxbLM.exe
  2⤵
  PID:14892
- C:\Windows\System\PULVWnD.exe
  C:\Windows\System\PULVWnD.exe
  2⤵
  PID:14916
- C:\Windows\System\QLaAEav.exe
  C:\Windows\System\QLaAEav.exe
  2⤵
  PID:14948
- C:\Windows\System\hLdhHzn.exe
  C:\Windows\System\hLdhHzn.exe
  2⤵
  PID:14968
- C:\Windows\System\pZLLIZo.exe
  C:\Windows\System\pZLLIZo.exe
  2⤵
  PID:15004
- C:\Windows\System\chhXhqr.exe
  C:\Windows\System\chhXhqr.exe
  2⤵
  PID:15032
- C:\Windows\System\wVHTndl.exe
  C:\Windows\System\wVHTndl.exe
  2⤵
  PID:15056
- C:\Windows\System\fvJHtOv.exe
  C:\Windows\System\fvJHtOv.exe
  2⤵
  PID:15080
- C:\Windows\System\aFLoocf.exe
  C:\Windows\System\aFLoocf.exe
  2⤵
  PID:15128
- C:\Windows\System\XFYgWTt.exe
  C:\Windows\System\XFYgWTt.exe
  2⤵
  PID:15148
- C:\Windows\System\YEPtYqH.exe
  C:\Windows\System\YEPtYqH.exe
  2⤵
  PID:15172
- C:\Windows\System\UjNgLGT.exe
  C:\Windows\System\UjNgLGT.exe
  2⤵
  PID:15212
- C:\Windows\System\NtaspPI.exe
  C:\Windows\System\NtaspPI.exe
  2⤵
  PID:15240
- C:\Windows\System\jNhKkRN.exe
  C:\Windows\System\jNhKkRN.exe
  2⤵
  PID:15256
- C:\Windows\System\QkFWrFL.exe
  C:\Windows\System\QkFWrFL.exe
  2⤵
  PID:15276
- C:\Windows\System\WjowsjE.exe
  C:\Windows\System\WjowsjE.exe
  2⤵
  PID:15300
- C:\Windows\System\yMockmo.exe
  C:\Windows\System\yMockmo.exe
  2⤵
  PID:15324
- C:\Windows\System\BNlnJvz.exe
  C:\Windows\System\BNlnJvz.exe
  2⤵
  PID:15352
- C:\Windows\System\YvMaOzB.exe
  C:\Windows\System\YvMaOzB.exe
  2⤵
  PID:14372
- C:\Windows\System\lyhFZli.exe
  C:\Windows\System\lyhFZli.exe
  2⤵
  PID:14460
- C:\Windows\System\aTFPsnK.exe
  C:\Windows\System\aTFPsnK.exe
  2⤵
  PID:14560
- C:\Windows\System\SuCGQzE.exe
  C:\Windows\System\SuCGQzE.exe
  2⤵
  PID:13584
- C:\Windows\System\FHTWKVT.exe
  C:\Windows\System\FHTWKVT.exe
  2⤵
  PID:14660
- C:\Windows\System\eGsMbsL.exe
  C:\Windows\System\eGsMbsL.exe
  2⤵
  PID:14756
- C:\Windows\System\jIvCVbV.exe
  C:\Windows\System\jIvCVbV.exe
  2⤵
  PID:14772
- C:\Windows\System\REESgbD.exe
  C:\Windows\System\REESgbD.exe
  2⤵
  PID:14824
- C:\Windows\System\QzbdKdK.exe
  C:\Windows\System\QzbdKdK.exe
  2⤵
  PID:14936
- C:\Windows\System\uqmYSeX.exe
  C:\Windows\System\uqmYSeX.exe
  2⤵
  PID:14944
- C:\Windows\System\uydhzBw.exe
  C:\Windows\System\uydhzBw.exe
  2⤵
  PID:14992
- C:\Windows\System\GixRyMa.exe
  C:\Windows\System\GixRyMa.exe
  2⤵
  PID:15052
- C:\Windows\System\wJVPqUC.exe
  C:\Windows\System\wJVPqUC.exe
  2⤵
  PID:15124
- C:\Windows\System\dSLSibE.exe
  C:\Windows\System\dSLSibE.exe
  2⤵
  PID:15196
- C:\Windows\System\ahpJtHY.exe
  C:\Windows\System\ahpJtHY.exe
  2⤵
  PID:15320
- C:\Windows\System\zSWWBCu.exe
  C:\Windows\System\zSWWBCu.exe
  2⤵
  PID:13884
- C:\Windows\System\hfKPvfc.exe
  C:\Windows\System\hfKPvfc.exe
  2⤵
  PID:14480
- C:\Windows\System\yzeBviP.exe
  C:\Windows\System\yzeBviP.exe
  2⤵
  PID:14604
- C:\Windows\System\tNoyjHK.exe
  C:\Windows\System\tNoyjHK.exe
  2⤵
  PID:14708
- C:\Windows\System\fySojCC.exe
  C:\Windows\System\fySojCC.exe
  2⤵
  PID:14912
- C:\Windows\System\VTMYwUw.exe
  C:\Windows\System\VTMYwUw.exe
  2⤵
  PID:15068
- C:\Windows\System\pflHSvD.exe
  C:\Windows\System\pflHSvD.exe
  2⤵
  PID:15312
- C:\Windows\System\YVzDNld.exe
  C:\Windows\System\YVzDNld.exe
  2⤵
  PID:15340
- C:\Windows\System\ueCHRDA.exe
  C:\Windows\System\ueCHRDA.exe
  2⤵
  PID:14748
- C:\Windows\System\oWdpkfo.exe
  C:\Windows\System\oWdpkfo.exe
  2⤵
  PID:14956
- C:\Windows\System\hWfxjAA.exe
  C:\Windows\System\hWfxjAA.exe
  2⤵
  PID:15232
- C:\Windows\System\ExuExLH.exe
  C:\Windows\System\ExuExLH.exe
  2⤵
  PID:15376
- C:\Windows\System\PIPPjSu.exe
  C:\Windows\System\PIPPjSu.exe
  2⤵
  PID:15392
- C:\Windows\System\DdDROKd.exe
  C:\Windows\System\DdDROKd.exe
  2⤵
  PID:15412
- C:\Windows\System\TMeozeR.exe
  C:\Windows\System\TMeozeR.exe
  2⤵
  PID:15440
- C:\Windows\System\BetFnJb.exe
  C:\Windows\System\BetFnJb.exe
  2⤵
  PID:15480
- C:\Windows\System\EABwTOe.exe
  C:\Windows\System\EABwTOe.exe
  2⤵
  PID:15512
- C:\Windows\System\XBgpMFk.exe
  C:\Windows\System\XBgpMFk.exe
  2⤵
  PID:15536
- C:\Windows\System\muqKhPD.exe
  C:\Windows\System\muqKhPD.exe
  2⤵
  PID:15572
- C:\Windows\System\yKwFYLc.exe
  C:\Windows\System\yKwFYLc.exe
  2⤵
  PID:15588
- C:\Windows\System\hxjTrhJ.exe
  C:\Windows\System\hxjTrhJ.exe
  2⤵
  PID:15616
- C:\Windows\System\jYZbUOW.exe
  C:\Windows\System\jYZbUOW.exe
  2⤵
  PID:15636
- C:\Windows\System\wVSMxYw.exe
  C:\Windows\System\wVSMxYw.exe
  2⤵
  PID:15672
- C:\Windows\System\EUSabPR.exe
  C:\Windows\System\EUSabPR.exe
  2⤵
  PID:15688
- C:\Windows\System\GCrtOoY.exe
  C:\Windows\System\GCrtOoY.exe
  2⤵
  PID:15704
- C:\Windows\System\MaOEqmn.exe
  C:\Windows\System\MaOEqmn.exe
  2⤵
  PID:15736
- C:\Windows\System\lRYqoTA.exe
  C:\Windows\System\lRYqoTA.exe
  2⤵
  PID:15764
- C:\Windows\System\yMzeEWc.exe
  C:\Windows\System\yMzeEWc.exe
  2⤵
  PID:15788
- C:\Windows\System\bmUgyjj.exe
  C:\Windows\System\bmUgyjj.exe
  2⤵
  PID:15820
- C:\Windows\System\rePrtEm.exe
  C:\Windows\System\rePrtEm.exe
  2⤵
  PID:15852
- C:\Windows\System\uEHmtHl.exe
  C:\Windows\System\uEHmtHl.exe
  2⤵
  PID:15892
- C:\Windows\System\wQkzfJs.exe
  C:\Windows\System\wQkzfJs.exe
  2⤵
  PID:15936
- C:\Windows\System\wGswEhO.exe
  C:\Windows\System\wGswEhO.exe
  2⤵
  PID:15964
- C:\Windows\System\BBdCdNY.exe
  C:\Windows\System\BBdCdNY.exe
  2⤵
  PID:15992
- C:\Windows\System\PyBOfvt.exe
  C:\Windows\System\PyBOfvt.exe
  2⤵
  PID:16020
- C:\Windows\System\TMGzFbx.exe
  C:\Windows\System\TMGzFbx.exe
  2⤵
  PID:16048
- C:\Windows\System\QFkusbn.exe
  C:\Windows\System\QFkusbn.exe
  2⤵
  PID:16076
- C:\Windows\System\CaYvpuU.exe
  C:\Windows\System\CaYvpuU.exe
  2⤵
  PID:16100
- C:\Windows\System\dZoseND.exe
  C:\Windows\System\dZoseND.exe
  2⤵
  PID:16120
- C:\Windows\System\CuPRYJb.exe
  C:\Windows\System\CuPRYJb.exe
  2⤵
  PID:16136
- C:\Windows\System\mLOAaBs.exe
  C:\Windows\System\mLOAaBs.exe
  2⤵
  PID:16176
- C:\Windows\System\jxIIMEv.exe
  C:\Windows\System\jxIIMEv.exe
  2⤵
  PID:16204
- C:\Windows\System\MQGiCLH.exe
  C:\Windows\System\MQGiCLH.exe
  2⤵
  PID:16232
- C:\Windows\System\lBSzIHR.exe
  C:\Windows\System\lBSzIHR.exe
  2⤵
  PID:16260
- C:\Windows\System\tKIllum.exe
  C:\Windows\System\tKIllum.exe
  2⤵
  PID:16288
- C:\Windows\System\ttvZVdi.exe
  C:\Windows\System\ttvZVdi.exe
  2⤵
  PID:16316
- C:\Windows\System\emCTxKI.exe
  C:\Windows\System\emCTxKI.exe
  2⤵
  PID:16340
- C:\Windows\System\OmSCdYc.exe
  C:\Windows\System\OmSCdYc.exe
  2⤵
  PID:16372
- C:\Windows\System\Lfekkof.exe
  C:\Windows\System\Lfekkof.exe
  2⤵
  PID:14476
- C:\Windows\System\PSVCPdc.exe
  C:\Windows\System\PSVCPdc.exe
  2⤵
  PID:15388
- C:\Windows\System\QICOXWp.exe
  C:\Windows\System\QICOXWp.exe
  2⤵
  PID:15524
- C:\Windows\System\qbljsQd.exe
  C:\Windows\System\qbljsQd.exe
  2⤵
  PID:15564
- C:\Windows\System\hNHKOSq.exe
  C:\Windows\System\hNHKOSq.exe
  2⤵
  PID:15624
- C:\Windows\System\ywrcAnu.exe
  C:\Windows\System\ywrcAnu.exe
  2⤵
  PID:15644
- C:\Windows\System\TBBtAOJ.exe
  C:\Windows\System\TBBtAOJ.exe
  2⤵
  PID:15760
- C:\Windows\System\lXAXsxj.exe
  C:\Windows\System\lXAXsxj.exe
  2⤵
  PID:15816
- C:\Windows\System\inshchB.exe
  C:\Windows\System\inshchB.exe
  2⤵
  PID:15880
- C:\Windows\System\AFxVkBM.exe
  C:\Windows\System\AFxVkBM.exe
  2⤵
  PID:15960
- C:\Windows\System\zBSWWzR.exe
  C:\Windows\System\zBSWWzR.exe
  2⤵
  PID:16040
- C:\Windows\System\CBgBilY.exe
  C:\Windows\System\CBgBilY.exe
  2⤵
  PID:16068
- C:\Windows\System\EzPLnBI.exe
  C:\Windows\System\EzPLnBI.exe
  2⤵
  PID:16112
- C:\Windows\System\WJUvWdO.exe
  C:\Windows\System\WJUvWdO.exe
  2⤵
  PID:16160
- C:\Windows\System\DVGjYRl.exe
  C:\Windows\System\DVGjYRl.exe
  2⤵
  PID:16192
- C:\Windows\System\qXNwRLs.exe
  C:\Windows\System\qXNwRLs.exe
  2⤵
  PID:16284
- C:\Windows\System\VVRXsrl.exe
  C:\Windows\System\VVRXsrl.exe
  2⤵
  PID:16348
- C:\Windows\System\QBbEwDw.exe
  C:\Windows\System\QBbEwDw.exe
  2⤵
  PID:15348
- C:\Windows\System\uluQaZi.exe
  C:\Windows\System\uluQaZi.exe
  2⤵
  PID:15656
- C:\Windows\System\qbgHgmy.exe
  C:\Windows\System\qbgHgmy.exe
  2⤵
  PID:15784
- C:\Windows\System\fOTAKcB.exe
  C:\Windows\System\fOTAKcB.exe
  2⤵
  PID:16008
- C:\Windows\System\jujZHqb.exe
  C:\Windows\System\jujZHqb.exe
  2⤵
  PID:16212
- C:\Windows\System\dASVLjR.exe
  C:\Windows\System\dASVLjR.exe
  2⤵
  PID:16304
- C:\Windows\System\hobjMZC.exe
  C:\Windows\System\hobjMZC.exe
  2⤵
  PID:15424
- C:\Windows\System\gYGjWVO.exe
  C:\Windows\System\gYGjWVO.exe
  2⤵
  PID:16092
- C:\Windows\System\zKZBeot.exe
  C:\Windows\System\zKZBeot.exe
  2⤵
  PID:16280
- C:\Windows\System\ahaEEzw.exe
  C:\Windows\System\ahaEEzw.exe
  2⤵
  PID:15748
- C:\Windows\System\tTdSOJN.exe
  C:\Windows\System\tTdSOJN.exe
  2⤵
  PID:16404
- C:\Windows\System\nzXVXDB.exe
  C:\Windows\System\nzXVXDB.exe
  2⤵
  PID:16428
- C:\Windows\System\pBRDjCd.exe
  C:\Windows\System\pBRDjCd.exe
  2⤵
  PID:16464
- C:\Windows\System\MEvRdYi.exe
  C:\Windows\System\MEvRdYi.exe
  2⤵
  PID:16500
- C:\Windows\System\KxNMVwj.exe
  C:\Windows\System\KxNMVwj.exe
  2⤵
  PID:16520
- C:\Windows\System\jXdHFxO.exe
  C:\Windows\System\jXdHFxO.exe
  2⤵
  PID:16536
- C:\Windows\System\lEjawIe.exe
  C:\Windows\System\lEjawIe.exe
  2⤵
  PID:16560
- C:\Windows\System\HSPWOMA.exe
  C:\Windows\System\HSPWOMA.exe
  2⤵
  PID:16588
- C:\Windows\System\FZNEkxd.exe
  C:\Windows\System\FZNEkxd.exe
  2⤵
  PID:16624
- C:\Windows\System\IlugFZi.exe
  C:\Windows\System\IlugFZi.exe
  2⤵
  PID:16644
- C:\Windows\System\gyLJvCX.exe
  C:\Windows\System\gyLJvCX.exe
  2⤵
  PID:16668
- C:\Windows\System\vIccZLs.exe
  C:\Windows\System\vIccZLs.exe
  2⤵
  PID:16688
- C:\Windows\System\sKbmIEY.exe
  C:\Windows\System\sKbmIEY.exe
  2⤵
  PID:16724
- C:\Windows\System\eVohJec.exe
  C:\Windows\System\eVohJec.exe
  2⤵
  PID:16748
- C:\Windows\System\Yavzuxu.exe
  C:\Windows\System\Yavzuxu.exe
  2⤵
  PID:16764
- C:\Windows\System\GNPUxqV.exe
  C:\Windows\System\GNPUxqV.exe
  2⤵
  PID:16832
- C:\Windows\System\GApsBsg.exe
  C:\Windows\System\GApsBsg.exe
  2⤵
  PID:16864
- C:\Windows\System\jKedmmx.exe
  C:\Windows\System\jKedmmx.exe
  2⤵
  PID:16896
- C:\Windows\System\zNGOYRb.exe
  C:\Windows\System\zNGOYRb.exe
  2⤵
  PID:16916

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BlCPlUT.exe

Filesize
1.3MB

MD5
bf2666d269c05217a9083f4b8086073a

SHA1
cc3b8d8a503a856d9b07ddb90ceaf69bad47e9a8

SHA256
efa744c173a5dc3950be3b65b570bdbc7fd4ed02d62111ec3b0f74d39d23a1e5

SHA512
fbadaaa075d73949f4e1f39c1bc0cf1496c3c2c165445ff1233e4452fc61e55940d7cd4725b5a38a013e044632d55d155258cd3567c869bb34435b0fef054353

Download Submit
C:\Windows\System\CTxaXyu.exe

Filesize
1.3MB

MD5
c9cee378e8224779debc9b7297344b64

SHA1
151bd73536aded22f7a28791bed7ec85a0910e65

SHA256
44e05af6ef2e3ee00c76ae7820a7d1fc456679975735fc7df4ae7b502de55f2f

SHA512
497d37e7248f4ccf14b34c51121f1b51e42bfc7618d167524f21f3c4ab122c482e6d212315062474fae00ebddfa5026b2679643472a3e4ca2584541337e64add

Download Submit
C:\Windows\System\DdETNKw.exe

Filesize
1.3MB

MD5
f0a477d70ec805d048b5a482a6d3e807

SHA1
da2302269b27aa79e6e9599630fcbd68f3ef1294

SHA256
379c1dad3efa9ba7d5d0de32c8589dbcaf03d16e86072f9a5cdd2e67ad32bbd2

SHA512
0fc4cdd20e3a63010b4327e80415a8faebb7a11ce65b337f7da3f0300907ed69b6c6d711092a8b0ec8176b6db26712f92fd72cf297da9f21b7e24c30b6c7e272

Download Submit
C:\Windows\System\DjtFpNn.exe

Filesize
1.3MB

MD5
04a168ae415b66c076395b6430e21ec6

SHA1
0ae396eebbf872828bd498b400e9f42642ee53d9

SHA256
4cf133ade35e720dd730187fa97c6bda9a934b90e13d134f8dff857be299602a

SHA512
8b744987a97c061b1958c8ffe71dec9b11abffe11cede06c30cba6b956721b0517fd3bc08541ce3a4527a629f8b478a633e693868fb858085ab5b15b6c099540

Download Submit
C:\Windows\System\DlCYXeZ.exe

Filesize
1.3MB

MD5
4cfcfa19d20e317ffdf4a5b5d24b3d2e

SHA1
fb530d59a2003b7eaf006c6d105293d0c3d6857e

SHA256
27d23cecea963e2e4571500526e180d9f3b398949d51b13114431446e7ed49f3

SHA512
ca5c969ccf38c0b4ab60aad2619899f85f8535db132e290091494e42d36518639476d65fc1957be5a8414ae2c88dfb644fd541a509f8b186c214d1f9e621a5f6

Download Submit
C:\Windows\System\EqFlKBd.exe

Filesize
1.3MB

MD5
fce5d2b63de442c6e4b25ce1f07bf1b4

SHA1
4421e225b25d31204e7a7880df4ce4f03f9b25cb

SHA256
6c2e7203ae90b10413482ad4d379b1daff212790a9e4a57de398815a9eac44a0

SHA512
6c5a602ef6dbe770cb14732ead077262925c763bb8228860c3728fe56d4a7231921e977eb4bae2e12e78e1fd84f642dfc0ad9b6b7e12efe3b3d399f8cb328f57

Download Submit
C:\Windows\System\IJyduyt.exe

Filesize
1.3MB

MD5
b73d4fbfdf8d7dee8573cda36719493e

SHA1
19e83c118e7d5bc9b74df27767a5843c24be351f

SHA256
a12139f443ac7ba653f1ea2e9934d95e15ee7a4cb78d1f1865196d90ca2465ce

SHA512
1968d5105e0dae01e714b62d7490ddd1d4b5b4e5ed6d27b7777031ab1f49d519ad77188fee9967997bb49bc1c81a2ee7f978b5df06e6afd6d3e18bc533e2602c

Download Submit
C:\Windows\System\NhMZoWZ.exe

Filesize
1.3MB

MD5
ef6b194d0dc61835f082cfb9ab111c36

SHA1
17f969c91676cec979c9a46efa527addee585225

SHA256
378f224b62bdf14083f8541715792c69ea4433cabebd103e972a908fc06d2c33

SHA512
edb0520496cccf3098fd7438c3a71d1e84ccd940e1c47a88341cb2f80bb3fb0897a42d49fb41cd21625f552257d0cffd60f2eb2deee7ed17752f144448c67e68

Download Submit
C:\Windows\System\PlcMwYi.exe

Filesize
1.3MB

MD5
df8aa1a6565f8b546244e8cd56f48e81

SHA1
146993c4ac76530fb6de2caa3b28e3e3001be0fd

SHA256
e8c47764f91f7fc26740c48e7dc488c305e7873e17223507958aae4a72c83bea

SHA512
d5ddb8a08b4fc9c733d95ed86257c59a7f19521bf95a6e854b29a4d35e7b3d83b9527b2c4775e04530cae729af0885283a32134caf237c12414842b01090ec77

Download Submit
C:\Windows\System\PzZkFMc.exe

Filesize
1.3MB

MD5
5ab57850021d28d9c61f28fe6d163b97

SHA1
cebb1aeae2452733c57f8d1bea96c5ed4f7b2d75

SHA256
8d0a583c67137812ecc071022b6ec06fd8cf4fe1fcae24a15021c41c9590225c

SHA512
6ec3d924a8dc68ac4429e58d95907ec73800b8dd159fba6af8f59f66e9897bc5617c34c91fb1066d1635648ddfdbdc6e3d93010f43148d4d4e40f89de69d9d87

Download Submit
C:\Windows\System\SBTGYYJ.exe

Filesize
1.3MB

MD5
e9cbb17cca365bf743829009d2cde5c9

SHA1
74d214306b2acb9ec02bf5652fb1941576a49d17

SHA256
4b37c8b48117fb6b7e823feb094b8bcac3297df7eadb170376fa38d188cf784e

SHA512
0179cb7971f7faead1bbd7fb50b9b7148c3406ab9b0edc965b772ef008767967b0b556ba9b149c8b25fe0f6953df29219340911374e45b9b102e486c42f34ca1

Download Submit
C:\Windows\System\XTYiJIM.exe

Filesize
1.3MB

MD5
92beddb0183c4d038a1f15c1c185532a

SHA1
3a8165838738cb2f502d89ce91a94bf6b3192d50

SHA256
90719d0876a84ace6b5c3d3906fe6443517ef479af244838d96fc1be6cd0be49

SHA512
797c639586aa060ae74a04d4fcd6db11aa82f937f46d3c1524b2e53e365bff199394f4dde208aac86294bcc957f1ee93745bde6b8fdb3d090e11044d8708995c

Download Submit
C:\Windows\System\aLsxwfe.exe

Filesize
1.3MB

MD5
e1b449b0336418b994f7afe926775165

SHA1
4dbacf661f1394d06c928599b653877db72d1768

SHA256
6b842c531083fa4ab254c0c0ad61ad4cfb20cb5651df4e59a58c04af4c81b66e

SHA512
09878ebefd2af5122c8119c4b846269a5842e2838215a434f18dca54f2c850cf53ace3b1caf6166be4f830ebd892a71bd320b6e65a10f0729d8249c6663b2338

Download Submit
C:\Windows\System\asuGSWy.exe

Filesize
1.3MB

MD5
26e9aa2392df2b83fc9c33b4ca665a03

SHA1
8c9e60290f1ca27bc67f96fe70954dc5680ca8cd

SHA256
8a20b3d7a31dacc9ea14f46845d932a87e1ca0bd453e8ad608d0866b3dd0d9d3

SHA512
a51ff3b216053a8190d0c448c0ab2c1212fe03fb253b3eb1e84286dfd28db4ca4c5c51b513e242bc19ef798441d44357bbb380b630e4f247a2766f29f96b4131

Download Submit
C:\Windows\System\cXNuSTS.exe

Filesize
1.3MB

MD5
c2b6cfd0cd9d6f65d7e51e2cf8ad8810

SHA1
efd605350d49697f88bccd9d1d158b34424bcc36

SHA256
c020a8497b03128d750909ad9f25e8664f732e2fbaf791788e298ef27f61771e

SHA512
b9f63d12410211b6b4c84fe55d09869e665d2dbe92a7d75d2e41e3ff8fe96b2f1d0c11e4b17ebe339fd2f51004472ab8970be8bbd949ce805d861cda75638649

Download Submit
C:\Windows\System\dWGnBDZ.exe

Filesize
1.3MB

MD5
2ff5093451becd92a0aa8f14e383f3b8

SHA1
d9bd87a22dd171857c7c146d0331147349b27c05

SHA256
9b29ab0fdd03b7ee6a23a0888298db93a7051ccc6ec9f6bbc9d3ebd766e50185

SHA512
3e96646a65d90e7444c5c6757f92367b07d9ffd07b5f2b565d8cdac02fc6c141d168fb57eb425fa5e7dc78adf7284c488ce675e868a20ba809ab5a9da7bc8052

Download Submit
C:\Windows\System\dlufwiB.exe

Filesize
1.3MB

MD5
ee20675c0ce72f55d90951dfb13fd562

SHA1
8fa7cc7383b9cf0acd41c4f14210fe70bd923c8d

SHA256
fcd11ca2829f2718f39a81ce8b12fce4bad69075f4ad98eb7b6e2937af9bfcc8

SHA512
df1bbcd93ffd183690b10aac74edacf552941453d93e658818f96723fef06eeaaea3d9b57971d90224a216c69b99bc00d9a936708854a3db606fd4da10cc3b8e

Download Submit
C:\Windows\System\fAKtVHM.exe

Filesize
1.3MB

MD5
ddbb43704d9336867838a2dcd0bad11a

SHA1
e63cb4166bf3249bcdd12a0d1fff679c36914913

SHA256
5168bf1abea61dc156d8b7f2e66ec546b00067a754da5648e5c02f09fe75d5f0

SHA512
6a8758eb0cf63b81dbe7bc7daae736bb1ade6afa32e359daca4a396e82af81519b9cf360c0f357bb9bfb14ffd0f6945ed848bcf1dc579ca9c48ef989c5a489bb

Download Submit
C:\Windows\System\ffOhjwh.exe

Filesize
1.3MB

MD5
d0acca850c824ce62b7edd08a779864b

SHA1
6a6e98187c03e9011307be92a75db1050bbb4e52

SHA256
7e2c76f52a36b3ecd9b52464e473e65571723beddee3d5e4b3418c50c4482f8b

SHA512
8ef6116e2460b7ec59efdace6e25ebdf610ed001a2118e653916fc8ca0dc008d45f57038cafdf364b1b0c88a1aa2993aa2658b698b47d848206573069b0930b8

Download Submit
C:\Windows\System\icDPqEb.exe

Filesize
1.3MB

MD5
60e8b7322afe2c751e1e00db95043e4c

SHA1
ce0725f00a15bf01d737f27cfcd83286bc4a7846

SHA256
f7baced987cf594f39e64e8f9c5aa5f5e816e140d03b69fc02d3b8b6aa27c243

SHA512
553b910f8cd652ca1c2a144a3cc510e2ab62abc2f6428da217a3764c93b2b769b66188e7c9f7f125fa7fb59f52724ec6b352fa68f261c7dc03239ffb48328983

Download Submit
C:\Windows\System\lIvEegG.exe

Filesize
1.3MB

MD5
130414673f45210b1f749f99c132f595

SHA1
40de3edf9d2603240f050983acae967fa63167a3

SHA256
83965800766cc61c99fe63fe3482990f105f7721c79dd63ee39741180851b038

SHA512
03b4c7fc25fe2544bf9ed1fa67c039864714279ecc9f5771c747f6fe5c83719761db6dae0d076d3adcd7b99a1f11eaa5f564d993b3087cd294690140d6462c11

Download Submit
C:\Windows\System\nZdNgpO.exe

Filesize
1.3MB

MD5
8c4f4f1569309a32b23439fd81a5ffa1

SHA1
ed990a553f0488a6d3db5edc83c5b7b0c187c179

SHA256
4ac75592ac6bd7bfcafcf3d0503e4b43dedafc1eed9cd9be54d7fd5c525d1fb9

SHA512
80b741326982b1f0b6a2ec9b7d46f7e1d54d848558c6e13acef27f01f1f0e5099f6d596e9ada2b035a67cbe1c9747182b6681d787b076fac5553eb578757da00

Download Submit
C:\Windows\System\rzzJKDU.exe

Filesize
1.3MB

MD5
4db79461d5d6e7a595aed5ff9b9f2581

SHA1
56f3600cc004aa77b85c8008be59914f74c6c18d

SHA256
0cda711cbfc2ef74124ff31ecd7163461020b7c8a50e3b5801a8b0ef1af2ab67

SHA512
2a6add14859ee676114f63d670d3149bdb5b75df4608ad6cb0507846a214e4fef0c72b1d8fb950cf716cb53518406ba867f9749207dfe690b84bf82ab2d5126d

Download Submit
C:\Windows\System\sXtpuoH.exe

Filesize
1.3MB

MD5
d6fa8db137e420d3286bcf58d1e7543c

SHA1
84d826496edb62cec6a318240a5f6209fa037f12

SHA256
d1f7e5a8b4181418d10ab94b6bcf165e9adec2b4af2fe7dcca48a4d2ecd80921

SHA512
0b0230047ac93d0f1d1430cce98c262c675a9e63bdaf8483dc7600da975318ade6275420c63fec484f466fbc2d47d9838d3ec33eda6ea828d2173edf357bc4ae

Download Submit
C:\Windows\System\szpxndg.exe

Filesize
1.3MB

MD5
6ad5c9ceb418da67ad1ce76c279ada37

SHA1
bb65024645223107c7a496c22611c984c8e52649

SHA256
7c6af0e32231f83aec240ca6cfbc0ddd63626119c09d2fc52d8e1fe449bf9c0f

SHA512
d20ca41d76e6a04ae735b452a25ba6c73ebeef9452dfcddbfa87185c8c0a37c8eea3e9597c9a81e6131e3042f6e2acf3b7a5cc7371d53f91c6569a5ff01888ae

Download Submit
C:\Windows\System\tcTDVUV.exe

Filesize
1.3MB

MD5
c739340e8df7cdd15a895d60e6d09bf3

SHA1
a988d126128c6f4d89e044312c4616f40405543b

SHA256
7e10437eb8063a9dcf2fe0041a59f81b62e197af76dfbd798e31dda10cacb433

SHA512
1c5a136f44462fd3b33a0a076ab637a7a8b685f25aa407de4cae6b8fa2d6131ae7944f37b8f0bd877c6f3e146e688896774128f7d6d6503983742c6c05c4e38b

Download Submit
C:\Windows\System\uJUoNLp.exe

Filesize
1.3MB

MD5
04722c4d754eb064a318b0c14ca4410f

SHA1
1844675565c352307b6a4bb2115cadd207fc9ee0

SHA256
7fee04f4b264fcdcc3492a318c7922020737ea2916053823874e763f0b85dafe

SHA512
3fc96ff5ffbad93a1023658125efcc0c481c931a43a769c8588f99778fb10cb49d691b376652ff863c8f5b1c7bcebb9b7e380725d38af3d7e99891296fd85d32

Download Submit
C:\Windows\System\vRWzguu.exe

Filesize
1.3MB

MD5
da8b5bb260b30aa03c3fed1cdaa316d3

SHA1
61306605a680fe555e2d3d87bb540f343226321d

SHA256
2de8d6ca455a4cb5df0ac9254af8f59973231fbc662493bc21986f68179b1ad2

SHA512
26de86ef2893a4ac04cddb2baed954ead35625f47e49f2d83edb8d0beaf0e7e9768f39e73b450b3a09d23a4a7b353d2504d43d5e7ada28079dc2d7c09887be79

Download Submit
C:\Windows\System\xNDwYlq.exe

Filesize
1.3MB

MD5
80990b017adde3f8a7f6ac78432f17fc

SHA1
41b2746dbe39e783fd9e908e9fa93183c5a9b0da

SHA256
762a24922ab2a09fcc1affd78e4aa164c849fd8c119a07ae97647e463957d87b

SHA512
2681ae1fe958bd78d770d911d9845a5ea01ebb6ff906a074f14a216278393b58110155308e830f4bc022e14a4540749e50078577051aa734d28efeb8213f3fa2

Download Submit
C:\Windows\System\xoMvFNc.exe

Filesize
1.3MB

MD5
37eb92b08ea262ebf7e9734fb5a86d33

SHA1
72b84e5f6c6bf06dac13b72886e6fc314266593c

SHA256
a1f40f5964e42de0a6a8861b31eab48b9d2c0841e270f59f0e52c3b2402b9939

SHA512
f2483b7a755e6d5813a5bb372eb17dfc9db54b1d24492c3d14b5bd1d41cd63253f293a994fca30bd459a4931cbcb31675e68465745470e589b6c52b6ae055e83

Download Submit
C:\Windows\System\zEcTPke.exe

Filesize
1.3MB

MD5
63ddd8d83c5af061c780933d3979ace1

SHA1
3ed3246d36a3f94bd95cdc0dc9329725191160fa

SHA256
94885d269b92e1ee18ccf2303384db7247b3668c24430e38754ee58ff9ad72fa

SHA512
cf78284654321b908f69deaedc7b9d0529c755c8e32d845db80fde2bb965ea22aff2a25539d8ccf1eccb3c01cc2f6dc3ef77db3557fffc6c5666041e1e7b9a23

Download Submit
C:\Windows\System\zIbPTkr.exe

Filesize
1.3MB

MD5
a3166d8f89dd2f828295e668cf73b6f1

SHA1
60109a3c8a38797ef94016b4da4037c805c1af31

SHA256
a73659b70b00c6fbec6a3654c5b23955cce4c4fcc5b671c4a025612b232a20ce

SHA512
ea40959c9760a27788043ed144c0ad3759e1585bcf75c6b9cfb1972a5583ddbd580bea15913d289a3b628549da369abd3804bea10d12187492d41c195dfd928d

Download Submit
C:\Windows\System\zUVESzo.exe

Filesize
1.3MB

MD5
500f065a9538b7ace0971d9a7b19ed4d

SHA1
9cb5b047025c12e4db381cb86f241d029927e6c7

SHA256
184124799fac8b010403881b52b742629f6eb523a201581bfac5c169affb88b1

SHA512
7bbd7cdf7bff001e630b41ce76eb1ad24990f27e0f331a4a5fec9f7ad3402acba3c092f659d765d93ebdfbb3754c614eee3f271e120404086dae0caec8b8ed36

Download Submit
memory/5008-0-0x000002C140640000-0x000002C140650000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads