xmrig | d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a

Analysis

max time kernel
133s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 05:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
Size

1.3MB
MD5

6c47ec50c69d5f22a826bed16b7cbc5a
SHA1

871a8084e2bd1f02df1762398646095d745b649d
SHA256

d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a
SHA512

c091a37aa183b7469ad7640e3175cb5dd3a17ea4cb1209222ca9f8874f92c084b221e2d23901a335ef1bab2c9c9062dfc4cf2c5e61000a6b5c91f9f21b5978b4
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5QbPrQtOQzT:GezaTF8FcNkNdfE0pZ9ozttwIRx2T9Or

Score

10^/10

xmrig discovery miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0007000000023ca2-5.dat	xmrig
behavioral2/files/0x0008000000023ca1-7.dat	xmrig
behavioral2/files/0x0007000000023ca3-17.dat	xmrig
behavioral2/files/0x0007000000023ca5-29.dat	xmrig
behavioral2/files/0x0007000000023ca6-34.dat	xmrig
behavioral2/files/0x0007000000023cac-62.dat	xmrig
behavioral2/files/0x0007000000023cb2-92.dat	xmrig
behavioral2/files/0x0007000000023cc0-162.dat	xmrig
behavioral2/files/0x0007000000023cbe-160.dat	xmrig
behavioral2/files/0x0007000000023cbf-157.dat	xmrig
behavioral2/files/0x0007000000023cbd-155.dat	xmrig
behavioral2/files/0x0007000000023cbc-150.dat	xmrig
behavioral2/files/0x0007000000023cbb-145.dat	xmrig
behavioral2/files/0x0007000000023cba-140.dat	xmrig
behavioral2/files/0x0007000000023cb9-135.dat	xmrig
behavioral2/files/0x0007000000023cb8-130.dat	xmrig
behavioral2/files/0x0007000000023cb7-125.dat	xmrig
behavioral2/files/0x0007000000023cb6-120.dat	xmrig
behavioral2/files/0x0007000000023cb5-115.dat	xmrig
behavioral2/files/0x0007000000023cb4-110.dat	xmrig
behavioral2/files/0x0007000000023cb3-105.dat	xmrig
behavioral2/files/0x0007000000023cb1-95.dat	xmrig
behavioral2/files/0x0007000000023cb0-90.dat	xmrig
behavioral2/files/0x0007000000023caf-85.dat	xmrig
behavioral2/files/0x0007000000023cae-80.dat	xmrig
behavioral2/files/0x0007000000023cad-75.dat	xmrig
behavioral2/files/0x0007000000023cab-65.dat	xmrig
behavioral2/files/0x0007000000023caa-57.dat	xmrig
behavioral2/files/0x0007000000023ca9-53.dat	xmrig
behavioral2/files/0x0007000000023ca8-48.dat	xmrig
behavioral2/files/0x0007000000023ca7-42.dat	xmrig
behavioral2/files/0x0007000000023ca4-25.dat	xmrig
behavioral2/files/0x0009000000023c95-11.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1204	bAvYvWC.exe
3140	qVmsHEg.exe
5100	DLLinRp.exe
1356	xIHWyRi.exe
516	AXELVtg.exe
1620	IsTZgNK.exe
472	FFBDIhn.exe
1016	ruRihfB.exe
4716	cLmppOy.exe
4712	LHIMHtH.exe
808	gKSKGZB.exe
4128	MkBDrig.exe
2144	mjcwIrD.exe
4112	oqVWMAM.exe
1292	BTmNYcZ.exe
4892	RpvSXfk.exe
4732	UlwPuaP.exe
3692	BNUmBgG.exe
3268	AHLVCKS.exe
1048	YOHofya.exe
2120	NMHrwNA.exe
4152	xsydFoj.exe
2156	knhsLks.exe
3188	QZVzDwV.exe
760	WVjmyZh.exe
1032	DPzFQcR.exe
4420	lDPvsFj.exe
2028	NyUVwQw.exe
3688	yHrWVFK.exe
2760	aauqQBJ.exe
3284	DhZpbFD.exe
4900	KiItIPR.exe
1532	HmPFbow.exe
2092	thBjKYl.exe
4524	GdwSjWL.exe
4348	WzCNUJL.exe
936	hMViLDt.exe
4872	fXjHcMS.exe
3744	WnChJXW.exe
412	ilkRYDl.exe
2480	gQrSeUL.exe
1316	HsiIeMk.exe
2248	OXWQsoT.exe
3612	XgpHgOE.exe
2504	oiurJwH.exe
1280	JELYMCJ.exe
2124	EfVIIYR.exe
2892	cZWQZCi.exe
1744	IocjcLm.exe
4704	RRTIEbH.exe
4012	OdpNeFG.exe
2424	ynHooCk.exe
5076	mXbwHVH.exe
2840	LwqPcFw.exe
1120	zXIuREC.exe
1600	lIlxOZm.exe
3624	mGxBxwo.exe
4388	FReuTRH.exe
2612	pJnKvSn.exe
1760	wrwGTRm.exe
2080	xcZctDf.exe
1436	NOUHPrB.exe
668	dmtLlfo.exe
2944	cMphgJZ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rlUXQYo.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\LZvAUyY.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\dtNNQyh.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\kLKqxmz.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\yhXogQX.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\IacUIFi.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\ZpULeFR.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\kctAtiM.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\TTwwaYI.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\yxouGQN.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\YtjUuvT.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\ECSicbw.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\GhUnTiS.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\cfCEeaT.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\rQlhxnl.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\XLCmydK.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\nAqNqWS.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\DNzQJEn.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\LwqPcFw.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\pXisLpo.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\hGUbtML.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\nzlavNe.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\DVucRSh.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\vTuwxCL.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\KYaUlwF.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\xmaYvMQ.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\JxtIrmh.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\IKTqtcy.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\yIJSjeb.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\OOHOXqq.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\ZBolPiP.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\ToGvOLs.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\uMvwwUF.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\ECkpkOf.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\fjYAutr.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\iTPkpiV.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\TYxcvUF.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\kSRYBnV.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\pEiSmef.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\mXbwHVH.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\qPwvYCc.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\AruZOxA.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\CTLHtlp.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\TMWABjW.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\wrwGTRm.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\SzYRcjw.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\MdSyBVH.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\jqhglHW.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\SCDiUIm.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\oiqlmnl.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\WWHJkUx.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\DVosqbp.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\PRSgsef.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\DZNWHLr.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\NFkaCwL.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\XzmBFws.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\lmZPxCG.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\fVahHYO.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\OxyHIoI.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\pIKNgQL.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\LwfEdcf.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\OOFAcqN.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\phXNJok.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
File created	C:\Windows\System\aVVSBvR.exe	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
9324	PinGVSk.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17368	dwm.exe
Token: SeChangeNotifyPrivilege	17368	dwm.exe
Token: 33	17368	dwm.exe
Token: SeIncBasePriorityPrivilege	17368	dwm.exe
Token: SeShutdownPrivilege	17368	dwm.exe
Token: SeCreatePagefilePrivilege	17368	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 1204	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	84
PID 540 wrote to memory of 1204	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	84
PID 540 wrote to memory of 3140	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	85
PID 540 wrote to memory of 3140	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	85
PID 540 wrote to memory of 5100	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	86
PID 540 wrote to memory of 5100	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	86
PID 540 wrote to memory of 1356	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	87
PID 540 wrote to memory of 1356	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	87
PID 540 wrote to memory of 516	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	88
PID 540 wrote to memory of 516	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	88
PID 540 wrote to memory of 1620	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	89
PID 540 wrote to memory of 1620	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	89
PID 540 wrote to memory of 472	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	90
PID 540 wrote to memory of 472	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	90
PID 540 wrote to memory of 1016	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	91
PID 540 wrote to memory of 1016	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	91
PID 540 wrote to memory of 4716	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	92
PID 540 wrote to memory of 4716	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	92
PID 540 wrote to memory of 4712	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	93
PID 540 wrote to memory of 4712	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	93
PID 540 wrote to memory of 808	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	94
PID 540 wrote to memory of 808	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	94
PID 540 wrote to memory of 4128	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	95
PID 540 wrote to memory of 4128	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	95
PID 540 wrote to memory of 2144	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	96
PID 540 wrote to memory of 2144	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	96
PID 540 wrote to memory of 4112	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	97
PID 540 wrote to memory of 4112	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	97
PID 540 wrote to memory of 1292	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	98
PID 540 wrote to memory of 1292	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	98
PID 540 wrote to memory of 4892	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	99
PID 540 wrote to memory of 4892	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	99
PID 540 wrote to memory of 4732	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	100
PID 540 wrote to memory of 4732	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	100
PID 540 wrote to memory of 3692	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	101
PID 540 wrote to memory of 3692	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	101
PID 540 wrote to memory of 3268	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	102
PID 540 wrote to memory of 3268	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	102
PID 540 wrote to memory of 1048	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	103
PID 540 wrote to memory of 1048	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	103
PID 540 wrote to memory of 2120	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	104
PID 540 wrote to memory of 2120	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	104
PID 540 wrote to memory of 4152	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	105
PID 540 wrote to memory of 4152	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	105
PID 540 wrote to memory of 2156	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	106
PID 540 wrote to memory of 2156	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	106
PID 540 wrote to memory of 3188	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	107
PID 540 wrote to memory of 3188	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	107
PID 540 wrote to memory of 760	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	108
PID 540 wrote to memory of 760	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	108
PID 540 wrote to memory of 1032	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	109
PID 540 wrote to memory of 1032	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	109
PID 540 wrote to memory of 4420	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	110
PID 540 wrote to memory of 4420	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	110
PID 540 wrote to memory of 2028	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	111
PID 540 wrote to memory of 2028	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	111
PID 540 wrote to memory of 3688	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	112
PID 540 wrote to memory of 3688	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	112
PID 540 wrote to memory of 2760	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	113
PID 540 wrote to memory of 2760	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	113
PID 540 wrote to memory of 3284	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	114
PID 540 wrote to memory of 3284	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	114
PID 540 wrote to memory of 4900	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	115
PID 540 wrote to memory of 4900	540	d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe	115

C:\Users\Admin\AppData\Local\Temp\d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe
"C:\Users\Admin\AppData\Local\Temp\d046abb622410c5cbdb0f900fd4eec19f78f43052fade8e5d347c19edf27376a.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\System\bAvYvWC.exe
  C:\Windows\System\bAvYvWC.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\qVmsHEg.exe
  C:\Windows\System\qVmsHEg.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\DLLinRp.exe
  C:\Windows\System\DLLinRp.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\xIHWyRi.exe
  C:\Windows\System\xIHWyRi.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\AXELVtg.exe
  C:\Windows\System\AXELVtg.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\IsTZgNK.exe
  C:\Windows\System\IsTZgNK.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\FFBDIhn.exe
  C:\Windows\System\FFBDIhn.exe
  2⤵
  - Executes dropped EXE
  PID:472
- C:\Windows\System\ruRihfB.exe
  C:\Windows\System\ruRihfB.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\cLmppOy.exe
  C:\Windows\System\cLmppOy.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\LHIMHtH.exe
  C:\Windows\System\LHIMHtH.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\gKSKGZB.exe
  C:\Windows\System\gKSKGZB.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\MkBDrig.exe
  C:\Windows\System\MkBDrig.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\mjcwIrD.exe
  C:\Windows\System\mjcwIrD.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\oqVWMAM.exe
  C:\Windows\System\oqVWMAM.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\BTmNYcZ.exe
  C:\Windows\System\BTmNYcZ.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\RpvSXfk.exe
  C:\Windows\System\RpvSXfk.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\UlwPuaP.exe
  C:\Windows\System\UlwPuaP.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\BNUmBgG.exe
  C:\Windows\System\BNUmBgG.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\AHLVCKS.exe
  C:\Windows\System\AHLVCKS.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\YOHofya.exe
  C:\Windows\System\YOHofya.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\NMHrwNA.exe
  C:\Windows\System\NMHrwNA.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\xsydFoj.exe
  C:\Windows\System\xsydFoj.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\knhsLks.exe
  C:\Windows\System\knhsLks.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\QZVzDwV.exe
  C:\Windows\System\QZVzDwV.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\WVjmyZh.exe
  C:\Windows\System\WVjmyZh.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\DPzFQcR.exe
  C:\Windows\System\DPzFQcR.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\lDPvsFj.exe
  C:\Windows\System\lDPvsFj.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\NyUVwQw.exe
  C:\Windows\System\NyUVwQw.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\yHrWVFK.exe
  C:\Windows\System\yHrWVFK.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\aauqQBJ.exe
  C:\Windows\System\aauqQBJ.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\DhZpbFD.exe
  C:\Windows\System\DhZpbFD.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\KiItIPR.exe
  C:\Windows\System\KiItIPR.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\HmPFbow.exe
  C:\Windows\System\HmPFbow.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\thBjKYl.exe
  C:\Windows\System\thBjKYl.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\GdwSjWL.exe
  C:\Windows\System\GdwSjWL.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\WzCNUJL.exe
  C:\Windows\System\WzCNUJL.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\hMViLDt.exe
  C:\Windows\System\hMViLDt.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\fXjHcMS.exe
  C:\Windows\System\fXjHcMS.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\WnChJXW.exe
  C:\Windows\System\WnChJXW.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\ilkRYDl.exe
  C:\Windows\System\ilkRYDl.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\gQrSeUL.exe
  C:\Windows\System\gQrSeUL.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\HsiIeMk.exe
  C:\Windows\System\HsiIeMk.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\OXWQsoT.exe
  C:\Windows\System\OXWQsoT.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\XgpHgOE.exe
  C:\Windows\System\XgpHgOE.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\oiurJwH.exe
  C:\Windows\System\oiurJwH.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\JELYMCJ.exe
  C:\Windows\System\JELYMCJ.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\EfVIIYR.exe
  C:\Windows\System\EfVIIYR.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\cZWQZCi.exe
  C:\Windows\System\cZWQZCi.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\IocjcLm.exe
  C:\Windows\System\IocjcLm.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\RRTIEbH.exe
  C:\Windows\System\RRTIEbH.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\OdpNeFG.exe
  C:\Windows\System\OdpNeFG.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\ynHooCk.exe
  C:\Windows\System\ynHooCk.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\mXbwHVH.exe
  C:\Windows\System\mXbwHVH.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\LwqPcFw.exe
  C:\Windows\System\LwqPcFw.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\zXIuREC.exe
  C:\Windows\System\zXIuREC.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\lIlxOZm.exe
  C:\Windows\System\lIlxOZm.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\mGxBxwo.exe
  C:\Windows\System\mGxBxwo.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\FReuTRH.exe
  C:\Windows\System\FReuTRH.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\pJnKvSn.exe
  C:\Windows\System\pJnKvSn.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\wrwGTRm.exe
  C:\Windows\System\wrwGTRm.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\xcZctDf.exe
  C:\Windows\System\xcZctDf.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\NOUHPrB.exe
  C:\Windows\System\NOUHPrB.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\dmtLlfo.exe
  C:\Windows\System\dmtLlfo.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\cMphgJZ.exe
  C:\Windows\System\cMphgJZ.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\YPoCkpT.exe
  C:\Windows\System\YPoCkpT.exe
  2⤵
  PID:4444
- C:\Windows\System\UgFEqUU.exe
  C:\Windows\System\UgFEqUU.exe
  2⤵
  PID:5092
- C:\Windows\System\CFOtTEI.exe
  C:\Windows\System\CFOtTEI.exe
  2⤵
  PID:1692
- C:\Windows\System\fVahHYO.exe
  C:\Windows\System\fVahHYO.exe
  2⤵
  PID:3548
- C:\Windows\System\bSgHpcm.exe
  C:\Windows\System\bSgHpcm.exe
  2⤵
  PID:4564
- C:\Windows\System\KqMtxtI.exe
  C:\Windows\System\KqMtxtI.exe
  2⤵
  PID:3556
- C:\Windows\System\eUCNOtm.exe
  C:\Windows\System\eUCNOtm.exe
  2⤵
  PID:5052
- C:\Windows\System\MNnFODr.exe
  C:\Windows\System\MNnFODr.exe
  2⤵
  PID:3272
- C:\Windows\System\SOrHNqc.exe
  C:\Windows\System\SOrHNqc.exe
  2⤵
  PID:4600
- C:\Windows\System\wcnvHQQ.exe
  C:\Windows\System\wcnvHQQ.exe
  2⤵
  PID:928
- C:\Windows\System\YtjUuvT.exe
  C:\Windows\System\YtjUuvT.exe
  2⤵
  PID:4000
- C:\Windows\System\toqClWq.exe
  C:\Windows\System\toqClWq.exe
  2⤵
  PID:1908
- C:\Windows\System\mPdZezG.exe
  C:\Windows\System\mPdZezG.exe
  2⤵
  PID:3236
- C:\Windows\System\vyNuUMl.exe
  C:\Windows\System\vyNuUMl.exe
  2⤵
  PID:4176
- C:\Windows\System\VcxJzUV.exe
  C:\Windows\System\VcxJzUV.exe
  2⤵
  PID:2396
- C:\Windows\System\lMNStzW.exe
  C:\Windows\System\lMNStzW.exe
  2⤵
  PID:1188
- C:\Windows\System\KdHSFss.exe
  C:\Windows\System\KdHSFss.exe
  2⤵
  PID:4036
- C:\Windows\System\MsKZuix.exe
  C:\Windows\System\MsKZuix.exe
  2⤵
  PID:2044
- C:\Windows\System\XLCmydK.exe
  C:\Windows\System\XLCmydK.exe
  2⤵
  PID:3604
- C:\Windows\System\OOHOXqq.exe
  C:\Windows\System\OOHOXqq.exe
  2⤵
  PID:4080
- C:\Windows\System\MOZlEIZ.exe
  C:\Windows\System\MOZlEIZ.exe
  2⤵
  PID:1724
- C:\Windows\System\ECSicbw.exe
  C:\Windows\System\ECSicbw.exe
  2⤵
  PID:2564
- C:\Windows\System\TAFsHcK.exe
  C:\Windows\System\TAFsHcK.exe
  2⤵
  PID:1228
- C:\Windows\System\nAqNqWS.exe
  C:\Windows\System\nAqNqWS.exe
  2⤵
  PID:2604
- C:\Windows\System\SZjeBRj.exe
  C:\Windows\System\SZjeBRj.exe
  2⤵
  PID:368
- C:\Windows\System\jwyofGy.exe
  C:\Windows\System\jwyofGy.exe
  2⤵
  PID:5152
- C:\Windows\System\YXfdvdB.exe
  C:\Windows\System\YXfdvdB.exe
  2⤵
  PID:5176
- C:\Windows\System\gAPdPcG.exe
  C:\Windows\System\gAPdPcG.exe
  2⤵
  PID:5204
- C:\Windows\System\LpfHUnV.exe
  C:\Windows\System\LpfHUnV.exe
  2⤵
  PID:5232
- C:\Windows\System\vkazCBG.exe
  C:\Windows\System\vkazCBG.exe
  2⤵
  PID:5260
- C:\Windows\System\sOfRzze.exe
  C:\Windows\System\sOfRzze.exe
  2⤵
  PID:5284
- C:\Windows\System\nzDTsnh.exe
  C:\Windows\System\nzDTsnh.exe
  2⤵
  PID:5316
- C:\Windows\System\cIPvJnt.exe
  C:\Windows\System\cIPvJnt.exe
  2⤵
  PID:5340
- C:\Windows\System\zdfDvZS.exe
  C:\Windows\System\zdfDvZS.exe
  2⤵
  PID:5368
- C:\Windows\System\TYLyBnH.exe
  C:\Windows\System\TYLyBnH.exe
  2⤵
  PID:5396
- C:\Windows\System\QTzoCgD.exe
  C:\Windows\System\QTzoCgD.exe
  2⤵
  PID:5416
- C:\Windows\System\strwfMS.exe
  C:\Windows\System\strwfMS.exe
  2⤵
  PID:5444
- C:\Windows\System\VkjTigY.exe
  C:\Windows\System\VkjTigY.exe
  2⤵
  PID:5472
- C:\Windows\System\VoLUqlK.exe
  C:\Windows\System\VoLUqlK.exe
  2⤵
  PID:5500
- C:\Windows\System\xmaYvMQ.exe
  C:\Windows\System\xmaYvMQ.exe
  2⤵
  PID:5528
- C:\Windows\System\MkxZSCb.exe
  C:\Windows\System\MkxZSCb.exe
  2⤵
  PID:5556
- C:\Windows\System\nLHiSKD.exe
  C:\Windows\System\nLHiSKD.exe
  2⤵
  PID:5584
- C:\Windows\System\mtVlAdP.exe
  C:\Windows\System\mtVlAdP.exe
  2⤵
  PID:5608
- C:\Windows\System\OeKMhss.exe
  C:\Windows\System\OeKMhss.exe
  2⤵
  PID:5640
- C:\Windows\System\MdSyBVH.exe
  C:\Windows\System\MdSyBVH.exe
  2⤵
  PID:5664
- C:\Windows\System\WJAEjdE.exe
  C:\Windows\System\WJAEjdE.exe
  2⤵
  PID:5696
- C:\Windows\System\QXvLxHa.exe
  C:\Windows\System\QXvLxHa.exe
  2⤵
  PID:5720
- C:\Windows\System\UGGKYZi.exe
  C:\Windows\System\UGGKYZi.exe
  2⤵
  PID:5748
- C:\Windows\System\qTqWkxi.exe
  C:\Windows\System\qTqWkxi.exe
  2⤵
  PID:5780
- C:\Windows\System\BDoXXOI.exe
  C:\Windows\System\BDoXXOI.exe
  2⤵
  PID:5808
- C:\Windows\System\ToMHJdb.exe
  C:\Windows\System\ToMHJdb.exe
  2⤵
  PID:5836
- C:\Windows\System\YGZGBmV.exe
  C:\Windows\System\YGZGBmV.exe
  2⤵
  PID:5868
- C:\Windows\System\prDQQQO.exe
  C:\Windows\System\prDQQQO.exe
  2⤵
  PID:5892
- C:\Windows\System\rlUXQYo.exe
  C:\Windows\System\rlUXQYo.exe
  2⤵
  PID:5920
- C:\Windows\System\cJZzImC.exe
  C:\Windows\System\cJZzImC.exe
  2⤵
  PID:5948
- C:\Windows\System\xLJUwbc.exe
  C:\Windows\System\xLJUwbc.exe
  2⤵
  PID:5976
- C:\Windows\System\sEmaULb.exe
  C:\Windows\System\sEmaULb.exe
  2⤵
  PID:6004
- C:\Windows\System\cAXUDmj.exe
  C:\Windows\System\cAXUDmj.exe
  2⤵
  PID:6032
- C:\Windows\System\cfCEeaT.exe
  C:\Windows\System\cfCEeaT.exe
  2⤵
  PID:6056
- C:\Windows\System\xqRlCvh.exe
  C:\Windows\System\xqRlCvh.exe
  2⤵
  PID:6084
- C:\Windows\System\fyQNXxr.exe
  C:\Windows\System\fyQNXxr.exe
  2⤵
  PID:6116
- C:\Windows\System\kFUBhJM.exe
  C:\Windows\System\kFUBhJM.exe
  2⤵
  PID:6140
- C:\Windows\System\qvtfHCH.exe
  C:\Windows\System\qvtfHCH.exe
  2⤵
  PID:1800
- C:\Windows\System\JraecZU.exe
  C:\Windows\System\JraecZU.exe
  2⤵
  PID:1388
- C:\Windows\System\hxDzXkF.exe
  C:\Windows\System\hxDzXkF.exe
  2⤵
  PID:4428
- C:\Windows\System\MkTZNjS.exe
  C:\Windows\System\MkTZNjS.exe
  2⤵
  PID:4364
- C:\Windows\System\UgBCIiV.exe
  C:\Windows\System\UgBCIiV.exe
  2⤵
  PID:116
- C:\Windows\System\OYqzxfJ.exe
  C:\Windows\System\OYqzxfJ.exe
  2⤵
  PID:4252
- C:\Windows\System\oVsrFdK.exe
  C:\Windows\System\oVsrFdK.exe
  2⤵
  PID:5136
- C:\Windows\System\lpbhBJi.exe
  C:\Windows\System\lpbhBJi.exe
  2⤵
  PID:5200
- C:\Windows\System\zFRWaVw.exe
  C:\Windows\System\zFRWaVw.exe
  2⤵
  PID:5272
- C:\Windows\System\IacUIFi.exe
  C:\Windows\System\IacUIFi.exe
  2⤵
  PID:5332
- C:\Windows\System\wfNdsCl.exe
  C:\Windows\System\wfNdsCl.exe
  2⤵
  PID:5388
- C:\Windows\System\gxNngdS.exe
  C:\Windows\System\gxNngdS.exe
  2⤵
  PID:5456
- C:\Windows\System\DVosqbp.exe
  C:\Windows\System\DVosqbp.exe
  2⤵
  PID:5516
- C:\Windows\System\LyAMsez.exe
  C:\Windows\System\LyAMsez.exe
  2⤵
  PID:5576
- C:\Windows\System\PiSYIcH.exe
  C:\Windows\System\PiSYIcH.exe
  2⤵
  PID:5652
- C:\Windows\System\SZyUHoi.exe
  C:\Windows\System\SZyUHoi.exe
  2⤵
  PID:5688
- C:\Windows\System\aHRslXS.exe
  C:\Windows\System\aHRslXS.exe
  2⤵
  PID:5740
- C:\Windows\System\ArlCUpe.exe
  C:\Windows\System\ArlCUpe.exe
  2⤵
  PID:5800
- C:\Windows\System\YTwcBqU.exe
  C:\Windows\System\YTwcBqU.exe
  2⤵
  PID:5876
- C:\Windows\System\ZbPxfWD.exe
  C:\Windows\System\ZbPxfWD.exe
  2⤵
  PID:5936
- C:\Windows\System\ZGisXbV.exe
  C:\Windows\System\ZGisXbV.exe
  2⤵
  PID:5996
- C:\Windows\System\wPDnlqj.exe
  C:\Windows\System\wPDnlqj.exe
  2⤵
  PID:6052
- C:\Windows\System\fzfkxJL.exe
  C:\Windows\System\fzfkxJL.exe
  2⤵
  PID:6128
- C:\Windows\System\wmnSeOh.exe
  C:\Windows\System\wmnSeOh.exe
  2⤵
  PID:5096
- C:\Windows\System\eHXayEE.exe
  C:\Windows\System\eHXayEE.exe
  2⤵
  PID:316
- C:\Windows\System\YjucWlV.exe
  C:\Windows\System\YjucWlV.exe
  2⤵
  PID:8
- C:\Windows\System\iUVRKVE.exe
  C:\Windows\System\iUVRKVE.exe
  2⤵
  PID:5188
- C:\Windows\System\ltMBHVl.exe
  C:\Windows\System\ltMBHVl.exe
  2⤵
  PID:5360
- C:\Windows\System\lyvNGUk.exe
  C:\Windows\System\lyvNGUk.exe
  2⤵
  PID:5488
- C:\Windows\System\gcwJWxz.exe
  C:\Windows\System\gcwJWxz.exe
  2⤵
  PID:5624
- C:\Windows\System\SjqNNCd.exe
  C:\Windows\System\SjqNNCd.exe
  2⤵
  PID:2920
- C:\Windows\System\gAPjoNy.exe
  C:\Windows\System\gAPjoNy.exe
  2⤵
  PID:5848
- C:\Windows\System\pWOlDqB.exe
  C:\Windows\System\pWOlDqB.exe
  2⤵
  PID:5968
- C:\Windows\System\mkOWESX.exe
  C:\Windows\System\mkOWESX.exe
  2⤵
  PID:6168
- C:\Windows\System\ShIvKCK.exe
  C:\Windows\System\ShIvKCK.exe
  2⤵
  PID:6196
- C:\Windows\System\dFFFEtZ.exe
  C:\Windows\System\dFFFEtZ.exe
  2⤵
  PID:6224
- C:\Windows\System\OOFAcqN.exe
  C:\Windows\System\OOFAcqN.exe
  2⤵
  PID:6252
- C:\Windows\System\nVSeCEa.exe
  C:\Windows\System\nVSeCEa.exe
  2⤵
  PID:6280
- C:\Windows\System\xfdczkA.exe
  C:\Windows\System\xfdczkA.exe
  2⤵
  PID:6308
- C:\Windows\System\AHIiUYt.exe
  C:\Windows\System\AHIiUYt.exe
  2⤵
  PID:6336
- C:\Windows\System\EiTiVLK.exe
  C:\Windows\System\EiTiVLK.exe
  2⤵
  PID:6364
- C:\Windows\System\myvVXfk.exe
  C:\Windows\System\myvVXfk.exe
  2⤵
  PID:6392
- C:\Windows\System\RfsscFX.exe
  C:\Windows\System\RfsscFX.exe
  2⤵
  PID:6420
- C:\Windows\System\CmDdfKN.exe
  C:\Windows\System\CmDdfKN.exe
  2⤵
  PID:6448
- C:\Windows\System\QmfLsAF.exe
  C:\Windows\System\QmfLsAF.exe
  2⤵
  PID:6476
- C:\Windows\System\CONPUqT.exe
  C:\Windows\System\CONPUqT.exe
  2⤵
  PID:6504
- C:\Windows\System\XdXddUN.exe
  C:\Windows\System\XdXddUN.exe
  2⤵
  PID:6532
- C:\Windows\System\nlLkELr.exe
  C:\Windows\System\nlLkELr.exe
  2⤵
  PID:6560
- C:\Windows\System\lVqesLR.exe
  C:\Windows\System\lVqesLR.exe
  2⤵
  PID:6588
- C:\Windows\System\uTQeXqg.exe
  C:\Windows\System\uTQeXqg.exe
  2⤵
  PID:6616
- C:\Windows\System\sYGTujW.exe
  C:\Windows\System\sYGTujW.exe
  2⤵
  PID:6644
- C:\Windows\System\YStoiku.exe
  C:\Windows\System\YStoiku.exe
  2⤵
  PID:6672
- C:\Windows\System\SsEdFbC.exe
  C:\Windows\System\SsEdFbC.exe
  2⤵
  PID:6700
- C:\Windows\System\yKpDsLB.exe
  C:\Windows\System\yKpDsLB.exe
  2⤵
  PID:6728
- C:\Windows\System\eHOSRgj.exe
  C:\Windows\System\eHOSRgj.exe
  2⤵
  PID:6756
- C:\Windows\System\vJoXLXB.exe
  C:\Windows\System\vJoXLXB.exe
  2⤵
  PID:6800
- C:\Windows\System\ZpULeFR.exe
  C:\Windows\System\ZpULeFR.exe
  2⤵
  PID:6860
- C:\Windows\System\MulrCsE.exe
  C:\Windows\System\MulrCsE.exe
  2⤵
  PID:6908
- C:\Windows\System\PcFvIxm.exe
  C:\Windows\System\PcFvIxm.exe
  2⤵
  PID:6960
- C:\Windows\System\pXbvPkM.exe
  C:\Windows\System\pXbvPkM.exe
  2⤵
  PID:6976
- C:\Windows\System\lsQCVTt.exe
  C:\Windows\System\lsQCVTt.exe
  2⤵
  PID:6992
- C:\Windows\System\wrTKkZU.exe
  C:\Windows\System\wrTKkZU.exe
  2⤵
  PID:7028
- C:\Windows\System\wJEsmdA.exe
  C:\Windows\System\wJEsmdA.exe
  2⤵
  PID:7048
- C:\Windows\System\PqiXKHK.exe
  C:\Windows\System\PqiXKHK.exe
  2⤵
  PID:7068
- C:\Windows\System\IeDfXse.exe
  C:\Windows\System\IeDfXse.exe
  2⤵
  PID:7084
- C:\Windows\System\LCbPdWg.exe
  C:\Windows\System\LCbPdWg.exe
  2⤵
  PID:7108
- C:\Windows\System\DsnURLq.exe
  C:\Windows\System\DsnURLq.exe
  2⤵
  PID:7140
- C:\Windows\System\KkxPMDm.exe
  C:\Windows\System\KkxPMDm.exe
  2⤵
  PID:6080
- C:\Windows\System\NXjbCOn.exe
  C:\Windows\System\NXjbCOn.exe
  2⤵
  PID:1472
- C:\Windows\System\RKMZTHR.exe
  C:\Windows\System\RKMZTHR.exe
  2⤵
  PID:228
- C:\Windows\System\phXNJok.exe
  C:\Windows\System\phXNJok.exe
  2⤵
  PID:5428
- C:\Windows\System\IvfbTBP.exe
  C:\Windows\System\IvfbTBP.exe
  2⤵
  PID:3084
- C:\Windows\System\NRJuQyp.exe
  C:\Windows\System\NRJuQyp.exe
  2⤵
  PID:5828
- C:\Windows\System\mOVZOVb.exe
  C:\Windows\System\mOVZOVb.exe
  2⤵
  PID:6184
- C:\Windows\System\jXVVdzb.exe
  C:\Windows\System\jXVVdzb.exe
  2⤵
  PID:6236
- C:\Windows\System\aiHtpES.exe
  C:\Windows\System\aiHtpES.exe
  2⤵
  PID:6292
- C:\Windows\System\NUHwPta.exe
  C:\Windows\System\NUHwPta.exe
  2⤵
  PID:6324
- C:\Windows\System\hrfRLqo.exe
  C:\Windows\System\hrfRLqo.exe
  2⤵
  PID:6380
- C:\Windows\System\ANeIfUi.exe
  C:\Windows\System\ANeIfUi.exe
  2⤵
  PID:6412
- C:\Windows\System\hCSFUVC.exe
  C:\Windows\System\hCSFUVC.exe
  2⤵
  PID:1868
- C:\Windows\System\btzahfx.exe
  C:\Windows\System\btzahfx.exe
  2⤵
  PID:5020
- C:\Windows\System\iuqwQtP.exe
  C:\Windows\System\iuqwQtP.exe
  2⤵
  PID:6552
- C:\Windows\System\XzmBFws.exe
  C:\Windows\System\XzmBFws.exe
  2⤵
  PID:1036
- C:\Windows\System\ZqfHBgS.exe
  C:\Windows\System\ZqfHBgS.exe
  2⤵
  PID:1224
- C:\Windows\System\BidjteR.exe
  C:\Windows\System\BidjteR.exe
  2⤵
  PID:6684
- C:\Windows\System\GbqcSTT.exe
  C:\Windows\System\GbqcSTT.exe
  2⤵
  PID:6712
- C:\Windows\System\cNQUPBH.exe
  C:\Windows\System\cNQUPBH.exe
  2⤵
  PID:6792
- C:\Windows\System\wFuVOhh.exe
  C:\Windows\System\wFuVOhh.exe
  2⤵
  PID:1992
- C:\Windows\System\uMvwwUF.exe
  C:\Windows\System\uMvwwUF.exe
  2⤵
  PID:4488
- C:\Windows\System\cPmlnXJ.exe
  C:\Windows\System\cPmlnXJ.exe
  2⤵
  PID:6816
- C:\Windows\System\HhpzqCF.exe
  C:\Windows\System\HhpzqCF.exe
  2⤵
  PID:6812
- C:\Windows\System\uXOWQvt.exe
  C:\Windows\System\uXOWQvt.exe
  2⤵
  PID:6896
- C:\Windows\System\qKDuucl.exe
  C:\Windows\System\qKDuucl.exe
  2⤵
  PID:6940
- C:\Windows\System\AmHcjhc.exe
  C:\Windows\System\AmHcjhc.exe
  2⤵
  PID:7040
- C:\Windows\System\kyJIigP.exe
  C:\Windows\System\kyJIigP.exe
  2⤵
  PID:7064
- C:\Windows\System\OXSyjuD.exe
  C:\Windows\System\OXSyjuD.exe
  2⤵
  PID:2508
- C:\Windows\System\XIGIVoQ.exe
  C:\Windows\System\XIGIVoQ.exe
  2⤵
  PID:3232
- C:\Windows\System\IdVqpXv.exe
  C:\Windows\System\IdVqpXv.exe
  2⤵
  PID:5604
- C:\Windows\System\EHXPpSn.exe
  C:\Windows\System\EHXPpSn.exe
  2⤵
  PID:6212
- C:\Windows\System\AtjXiCB.exe
  C:\Windows\System\AtjXiCB.exe
  2⤵
  PID:6404
- C:\Windows\System\wZHGQrI.exe
  C:\Windows\System\wZHGQrI.exe
  2⤵
  PID:6516
- C:\Windows\System\XZXLMbN.exe
  C:\Windows\System\XZXLMbN.exe
  2⤵
  PID:1804
- C:\Windows\System\YRScQeV.exe
  C:\Windows\System\YRScQeV.exe
  2⤵
  PID:6548
- C:\Windows\System\MDoszcD.exe
  C:\Windows\System\MDoszcD.exe
  2⤵
  PID:212
- C:\Windows\System\AGwMHSx.exe
  C:\Windows\System\AGwMHSx.exe
  2⤵
  PID:6856
- C:\Windows\System\pqDeENi.exe
  C:\Windows\System\pqDeENi.exe
  2⤵
  PID:6956
- C:\Windows\System\GDNqZvi.exe
  C:\Windows\System\GDNqZvi.exe
  2⤵
  PID:7020
- C:\Windows\System\DNzQJEn.exe
  C:\Windows\System\DNzQJEn.exe
  2⤵
  PID:5568
- C:\Windows\System\lYFCdJk.exe
  C:\Windows\System\lYFCdJk.exe
  2⤵
  PID:2980
- C:\Windows\System\rbBCqUF.exe
  C:\Windows\System\rbBCqUF.exe
  2⤵
  PID:4060
- C:\Windows\System\lUPhmZw.exe
  C:\Windows\System\lUPhmZw.exe
  2⤵
  PID:4972
- C:\Windows\System\tPHvVZJ.exe
  C:\Windows\System\tPHvVZJ.exe
  2⤵
  PID:6716
- C:\Windows\System\mKHTBnl.exe
  C:\Windows\System\mKHTBnl.exe
  2⤵
  PID:312
- C:\Windows\System\TonSTtA.exe
  C:\Windows\System\TonSTtA.exe
  2⤵
  PID:6656
- C:\Windows\System\zfrQvBG.exe
  C:\Windows\System\zfrQvBG.exe
  2⤵
  PID:6464
- C:\Windows\System\GpSmeXa.exe
  C:\Windows\System\GpSmeXa.exe
  2⤵
  PID:7176
- C:\Windows\System\LwfEdcf.exe
  C:\Windows\System\LwfEdcf.exe
  2⤵
  PID:7204
- C:\Windows\System\hleOPHR.exe
  C:\Windows\System\hleOPHR.exe
  2⤵
  PID:7232
- C:\Windows\System\vOeFnvO.exe
  C:\Windows\System\vOeFnvO.exe
  2⤵
  PID:7260
- C:\Windows\System\YyOVYWh.exe
  C:\Windows\System\YyOVYWh.exe
  2⤵
  PID:7288
- C:\Windows\System\jjoyLLB.exe
  C:\Windows\System\jjoyLLB.exe
  2⤵
  PID:7316
- C:\Windows\System\dxJcZfR.exe
  C:\Windows\System\dxJcZfR.exe
  2⤵
  PID:7344
- C:\Windows\System\LiNuoAZ.exe
  C:\Windows\System\LiNuoAZ.exe
  2⤵
  PID:7372
- C:\Windows\System\dnrPMFE.exe
  C:\Windows\System\dnrPMFE.exe
  2⤵
  PID:7400
- C:\Windows\System\oiqlmnl.exe
  C:\Windows\System\oiqlmnl.exe
  2⤵
  PID:7424
- C:\Windows\System\yKiKsPS.exe
  C:\Windows\System\yKiKsPS.exe
  2⤵
  PID:7440
- C:\Windows\System\fPHENYi.exe
  C:\Windows\System\fPHENYi.exe
  2⤵
  PID:7460
- C:\Windows\System\LtGgtGs.exe
  C:\Windows\System\LtGgtGs.exe
  2⤵
  PID:7484
- C:\Windows\System\bjHhzfs.exe
  C:\Windows\System\bjHhzfs.exe
  2⤵
  PID:7508
- C:\Windows\System\dVjmamS.exe
  C:\Windows\System\dVjmamS.exe
  2⤵
  PID:7536
- C:\Windows\System\lmZPxCG.exe
  C:\Windows\System\lmZPxCG.exe
  2⤵
  PID:7568
- C:\Windows\System\boPyFCH.exe
  C:\Windows\System\boPyFCH.exe
  2⤵
  PID:7600
- C:\Windows\System\omxSEAT.exe
  C:\Windows\System\omxSEAT.exe
  2⤵
  PID:7628
- C:\Windows\System\ZBolPiP.exe
  C:\Windows\System\ZBolPiP.exe
  2⤵
  PID:7652
- C:\Windows\System\nJexOZv.exe
  C:\Windows\System\nJexOZv.exe
  2⤵
  PID:7676
- C:\Windows\System\gzZoApM.exe
  C:\Windows\System\gzZoApM.exe
  2⤵
  PID:7708
- C:\Windows\System\DaDdemy.exe
  C:\Windows\System\DaDdemy.exe
  2⤵
  PID:7732
- C:\Windows\System\jqhglHW.exe
  C:\Windows\System\jqhglHW.exe
  2⤵
  PID:7760
- C:\Windows\System\vZHEdbP.exe
  C:\Windows\System\vZHEdbP.exe
  2⤵
  PID:7784
- C:\Windows\System\ybhbfaI.exe
  C:\Windows\System\ybhbfaI.exe
  2⤵
  PID:7808
- C:\Windows\System\dMPmkVk.exe
  C:\Windows\System\dMPmkVk.exe
  2⤵
  PID:7840
- C:\Windows\System\AaIBcDA.exe
  C:\Windows\System\AaIBcDA.exe
  2⤵
  PID:7904
- C:\Windows\System\LBuRafa.exe
  C:\Windows\System\LBuRafa.exe
  2⤵
  PID:7928
- C:\Windows\System\xtjiPFu.exe
  C:\Windows\System\xtjiPFu.exe
  2⤵
  PID:7948
- C:\Windows\System\wgbzUap.exe
  C:\Windows\System\wgbzUap.exe
  2⤵
  PID:7976
- C:\Windows\System\iJWrADJ.exe
  C:\Windows\System\iJWrADJ.exe
  2⤵
  PID:8004
- C:\Windows\System\yRbxzqE.exe
  C:\Windows\System\yRbxzqE.exe
  2⤵
  PID:8032
- C:\Windows\System\YlgNPMC.exe
  C:\Windows\System\YlgNPMC.exe
  2⤵
  PID:8060
- C:\Windows\System\QCcTXoG.exe
  C:\Windows\System\QCcTXoG.exe
  2⤵
  PID:8084
- C:\Windows\System\SBenmgO.exe
  C:\Windows\System\SBenmgO.exe
  2⤵
  PID:8116
- C:\Windows\System\zTitNCo.exe
  C:\Windows\System\zTitNCo.exe
  2⤵
  PID:8152
- C:\Windows\System\hZOThox.exe
  C:\Windows\System\hZOThox.exe
  2⤵
  PID:8176
- C:\Windows\System\uXMhkFn.exe
  C:\Windows\System\uXMhkFn.exe
  2⤵
  PID:6160
- C:\Windows\System\XmJaorL.exe
  C:\Windows\System\XmJaorL.exe
  2⤵
  PID:7216
- C:\Windows\System\lQqxFOa.exe
  C:\Windows\System\lQqxFOa.exe
  2⤵
  PID:7252
- C:\Windows\System\tkolBTH.exe
  C:\Windows\System\tkolBTH.exe
  2⤵
  PID:7304
- C:\Windows\System\lpjgfbQ.exe
  C:\Windows\System\lpjgfbQ.exe
  2⤵
  PID:7436
- C:\Windows\System\digqvdA.exe
  C:\Windows\System\digqvdA.exe
  2⤵
  PID:7456
- C:\Windows\System\doUIrvS.exe
  C:\Windows\System\doUIrvS.exe
  2⤵
  PID:7516
- C:\Windows\System\QvmwOGD.exe
  C:\Windows\System\QvmwOGD.exe
  2⤵
  PID:7620
- C:\Windows\System\OoMapva.exe
  C:\Windows\System\OoMapva.exe
  2⤵
  PID:7748
- C:\Windows\System\NmLXzNs.exe
  C:\Windows\System\NmLXzNs.exe
  2⤵
  PID:7800
- C:\Windows\System\SMguGpg.exe
  C:\Windows\System\SMguGpg.exe
  2⤵
  PID:7860
- C:\Windows\System\jxEboij.exe
  C:\Windows\System\jxEboij.exe
  2⤵
  PID:7888
- C:\Windows\System\VghVFSN.exe
  C:\Windows\System\VghVFSN.exe
  2⤵
  PID:7988
- C:\Windows\System\ToGvOLs.exe
  C:\Windows\System\ToGvOLs.exe
  2⤵
  PID:8048
- C:\Windows\System\SqfqNuj.exe
  C:\Windows\System\SqfqNuj.exe
  2⤵
  PID:8128
- C:\Windows\System\AioVqVH.exe
  C:\Windows\System\AioVqVH.exe
  2⤵
  PID:8164
- C:\Windows\System\JVCAMQs.exe
  C:\Windows\System\JVCAMQs.exe
  2⤵
  PID:7272
- C:\Windows\System\YaHheou.exe
  C:\Windows\System\YaHheou.exe
  2⤵
  PID:7392
- C:\Windows\System\kmDXgiU.exe
  C:\Windows\System\kmDXgiU.exe
  2⤵
  PID:7504
- C:\Windows\System\LVqxUco.exe
  C:\Windows\System\LVqxUco.exe
  2⤵
  PID:7616
- C:\Windows\System\hFWjfYx.exe
  C:\Windows\System\hFWjfYx.exe
  2⤵
  PID:7692
- C:\Windows\System\UHTPqmg.exe
  C:\Windows\System\UHTPqmg.exe
  2⤵
  PID:7868
- C:\Windows\System\BMaLYsN.exe
  C:\Windows\System\BMaLYsN.exe
  2⤵
  PID:8024
- C:\Windows\System\bnFhsML.exe
  C:\Windows\System\bnFhsML.exe
  2⤵
  PID:8184
- C:\Windows\System\UcWcBeA.exe
  C:\Windows\System\UcWcBeA.exe
  2⤵
  PID:7300
- C:\Windows\System\SldcMTW.exe
  C:\Windows\System\SldcMTW.exe
  2⤵
  PID:8080
- C:\Windows\System\DwCYifx.exe
  C:\Windows\System\DwCYifx.exe
  2⤵
  PID:7648
- C:\Windows\System\yoyhTsL.exe
  C:\Windows\System\yoyhTsL.exe
  2⤵
  PID:8216
- C:\Windows\System\rQlhxnl.exe
  C:\Windows\System\rQlhxnl.exe
  2⤵
  PID:8236
- C:\Windows\System\MqptwQY.exe
  C:\Windows\System\MqptwQY.exe
  2⤵
  PID:8284
- C:\Windows\System\KKIFSru.exe
  C:\Windows\System\KKIFSru.exe
  2⤵
  PID:8300
- C:\Windows\System\lRZjkSI.exe
  C:\Windows\System\lRZjkSI.exe
  2⤵
  PID:8336
- C:\Windows\System\KDWpGOn.exe
  C:\Windows\System\KDWpGOn.exe
  2⤵
  PID:8352
- C:\Windows\System\lBEyhYo.exe
  C:\Windows\System\lBEyhYo.exe
  2⤵
  PID:8376
- C:\Windows\System\vqHBmiM.exe
  C:\Windows\System\vqHBmiM.exe
  2⤵
  PID:8400
- C:\Windows\System\kaONKgJ.exe
  C:\Windows\System\kaONKgJ.exe
  2⤵
  PID:8452
- C:\Windows\System\fsbqrYG.exe
  C:\Windows\System\fsbqrYG.exe
  2⤵
  PID:8468
- C:\Windows\System\GfEWTGh.exe
  C:\Windows\System\GfEWTGh.exe
  2⤵
  PID:8496
- C:\Windows\System\FaxZxtH.exe
  C:\Windows\System\FaxZxtH.exe
  2⤵
  PID:8520
- C:\Windows\System\QzjoKIO.exe
  C:\Windows\System\QzjoKIO.exe
  2⤵
  PID:8540
- C:\Windows\System\uCvzQSu.exe
  C:\Windows\System\uCvzQSu.exe
  2⤵
  PID:8568
- C:\Windows\System\pArWQQu.exe
  C:\Windows\System\pArWQQu.exe
  2⤵
  PID:8588
- C:\Windows\System\ECkpkOf.exe
  C:\Windows\System\ECkpkOf.exe
  2⤵
  PID:8620
- C:\Windows\System\XEESNba.exe
  C:\Windows\System\XEESNba.exe
  2⤵
  PID:8664
- C:\Windows\System\qpnaudt.exe
  C:\Windows\System\qpnaudt.exe
  2⤵
  PID:8680
- C:\Windows\System\uqplleO.exe
  C:\Windows\System\uqplleO.exe
  2⤵
  PID:8700
- C:\Windows\System\ZllRIcA.exe
  C:\Windows\System\ZllRIcA.exe
  2⤵
  PID:8728
- C:\Windows\System\dtNNQyh.exe
  C:\Windows\System\dtNNQyh.exe
  2⤵
  PID:8780
- C:\Windows\System\KqObebn.exe
  C:\Windows\System\KqObebn.exe
  2⤵
  PID:8804
- C:\Windows\System\nDdTdzG.exe
  C:\Windows\System\nDdTdzG.exe
  2⤵
  PID:8820
- C:\Windows\System\voOToMk.exe
  C:\Windows\System\voOToMk.exe
  2⤵
  PID:8844
- C:\Windows\System\yZmPOtT.exe
  C:\Windows\System\yZmPOtT.exe
  2⤵
  PID:8880
- C:\Windows\System\cYOVGfs.exe
  C:\Windows\System\cYOVGfs.exe
  2⤵
  PID:8916
- C:\Windows\System\nDXskbE.exe
  C:\Windows\System\nDXskbE.exe
  2⤵
  PID:8956
- C:\Windows\System\Extzbbr.exe
  C:\Windows\System\Extzbbr.exe
  2⤵
  PID:8984
- C:\Windows\System\aWNWaOu.exe
  C:\Windows\System\aWNWaOu.exe
  2⤵
  PID:9012
- C:\Windows\System\rKsHqGM.exe
  C:\Windows\System\rKsHqGM.exe
  2⤵
  PID:9040
- C:\Windows\System\xkivFvJ.exe
  C:\Windows\System\xkivFvJ.exe
  2⤵
  PID:9068
- C:\Windows\System\uVAQABn.exe
  C:\Windows\System\uVAQABn.exe
  2⤵
  PID:9084
- C:\Windows\System\iUUMGDh.exe
  C:\Windows\System\iUUMGDh.exe
  2⤵
  PID:9120
- C:\Windows\System\yiGgmUB.exe
  C:\Windows\System\yiGgmUB.exe
  2⤵
  PID:9140
- C:\Windows\System\RRIdEou.exe
  C:\Windows\System\RRIdEou.exe
  2⤵
  PID:9168
- C:\Windows\System\xlaQcqs.exe
  C:\Windows\System\xlaQcqs.exe
  2⤵
  PID:9208
- C:\Windows\System\bjQxWDE.exe
  C:\Windows\System\bjQxWDE.exe
  2⤵
  PID:7820
- C:\Windows\System\HwDRuBH.exe
  C:\Windows\System\HwDRuBH.exe
  2⤵
  PID:8264
- C:\Windows\System\AacZeZv.exe
  C:\Windows\System\AacZeZv.exe
  2⤵
  PID:8332
- C:\Windows\System\MaABOHP.exe
  C:\Windows\System\MaABOHP.exe
  2⤵
  PID:8388
- C:\Windows\System\blthLsr.exe
  C:\Windows\System\blthLsr.exe
  2⤵
  PID:8432
- C:\Windows\System\OxyHIoI.exe
  C:\Windows\System\OxyHIoI.exe
  2⤵
  PID:8528
- C:\Windows\System\rtirxeA.exe
  C:\Windows\System\rtirxeA.exe
  2⤵
  PID:8636
- C:\Windows\System\AruZOxA.exe
  C:\Windows\System\AruZOxA.exe
  2⤵
  PID:8676
- C:\Windows\System\DlwWPDj.exe
  C:\Windows\System\DlwWPDj.exe
  2⤵
  PID:8720
- C:\Windows\System\qPwvYCc.exe
  C:\Windows\System\qPwvYCc.exe
  2⤵
  PID:8800
- C:\Windows\System\ZjMiZCC.exe
  C:\Windows\System\ZjMiZCC.exe
  2⤵
  PID:8864
- C:\Windows\System\pXisLpo.exe
  C:\Windows\System\pXisLpo.exe
  2⤵
  PID:8904
- C:\Windows\System\stRwoEL.exe
  C:\Windows\System\stRwoEL.exe
  2⤵
  PID:8952
- C:\Windows\System\YDqSSUs.exe
  C:\Windows\System\YDqSSUs.exe
  2⤵
  PID:9000
- C:\Windows\System\kQyedjm.exe
  C:\Windows\System\kQyedjm.exe
  2⤵
  PID:9108
- C:\Windows\System\LAANTRO.exe
  C:\Windows\System\LAANTRO.exe
  2⤵
  PID:9128
- C:\Windows\System\ljrNjdQ.exe
  C:\Windows\System\ljrNjdQ.exe
  2⤵
  PID:7336
- C:\Windows\System\yGLcTzP.exe
  C:\Windows\System\yGLcTzP.exe
  2⤵
  PID:8296
- C:\Windows\System\VzDdcFv.exe
  C:\Windows\System\VzDdcFv.exe
  2⤵
  PID:8480
- C:\Windows\System\fjYAutr.exe
  C:\Windows\System\fjYAutr.exe
  2⤵
  PID:8708
- C:\Windows\System\eEpsvvS.exe
  C:\Windows\System\eEpsvvS.exe
  2⤵
  PID:8900
- C:\Windows\System\PbbEqlI.exe
  C:\Windows\System\PbbEqlI.exe
  2⤵
  PID:9036
- C:\Windows\System\OJzQdxi.exe
  C:\Windows\System\OJzQdxi.exe
  2⤵
  PID:9076
- C:\Windows\System\YsmGOyY.exe
  C:\Windows\System\YsmGOyY.exe
  2⤵
  PID:8244
- C:\Windows\System\OJcrlKU.exe
  C:\Windows\System\OJcrlKU.exe
  2⤵
  PID:8580
- C:\Windows\System\PRSgsef.exe
  C:\Windows\System\PRSgsef.exe
  2⤵
  PID:8936
- C:\Windows\System\gGuKNyF.exe
  C:\Windows\System\gGuKNyF.exe
  2⤵
  PID:9204
- C:\Windows\System\UrCeUmw.exe
  C:\Windows\System\UrCeUmw.exe
  2⤵
  PID:9064
- C:\Windows\System\YkGlcse.exe
  C:\Windows\System\YkGlcse.exe
  2⤵
  PID:9240
- C:\Windows\System\uYYbSfJ.exe
  C:\Windows\System\uYYbSfJ.exe
  2⤵
  PID:9272
- C:\Windows\System\ltmvbFH.exe
  C:\Windows\System\ltmvbFH.exe
  2⤵
  PID:9300
- C:\Windows\System\PinGVSk.exe
  C:\Windows\System\PinGVSk.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:9324
- C:\Windows\System\LvuIPBY.exe
  C:\Windows\System\LvuIPBY.exe
  2⤵
  PID:9340
- C:\Windows\System\uVGaQgi.exe
  C:\Windows\System\uVGaQgi.exe
  2⤵
  PID:9368
- C:\Windows\System\YsvBVPJ.exe
  C:\Windows\System\YsvBVPJ.exe
  2⤵
  PID:9412
- C:\Windows\System\scCzWZi.exe
  C:\Windows\System\scCzWZi.exe
  2⤵
  PID:9440
- C:\Windows\System\VWdDktP.exe
  C:\Windows\System\VWdDktP.exe
  2⤵
  PID:9468
- C:\Windows\System\HlUjcUl.exe
  C:\Windows\System\HlUjcUl.exe
  2⤵
  PID:9504
- C:\Windows\System\GDzAVta.exe
  C:\Windows\System\GDzAVta.exe
  2⤵
  PID:9524
- C:\Windows\System\dQjrFsl.exe
  C:\Windows\System\dQjrFsl.exe
  2⤵
  PID:9540
- C:\Windows\System\dKGnrvw.exe
  C:\Windows\System\dKGnrvw.exe
  2⤵
  PID:9576
- C:\Windows\System\SbyrhUo.exe
  C:\Windows\System\SbyrhUo.exe
  2⤵
  PID:9608
- C:\Windows\System\MDnHyMI.exe
  C:\Windows\System\MDnHyMI.exe
  2⤵
  PID:9636
- C:\Windows\System\DPNriNP.exe
  C:\Windows\System\DPNriNP.exe
  2⤵
  PID:9664
- C:\Windows\System\KEQkDuG.exe
  C:\Windows\System\KEQkDuG.exe
  2⤵
  PID:9684
- C:\Windows\System\mUYvOLE.exe
  C:\Windows\System\mUYvOLE.exe
  2⤵
  PID:9720
- C:\Windows\System\HmwfCCQ.exe
  C:\Windows\System\HmwfCCQ.exe
  2⤵
  PID:9748
- C:\Windows\System\Fxgayhu.exe
  C:\Windows\System\Fxgayhu.exe
  2⤵
  PID:9772
- C:\Windows\System\uJWhyap.exe
  C:\Windows\System\uJWhyap.exe
  2⤵
  PID:9812
- C:\Windows\System\JQHYkAQ.exe
  C:\Windows\System\JQHYkAQ.exe
  2⤵
  PID:9832
- C:\Windows\System\VLNzpqM.exe
  C:\Windows\System\VLNzpqM.exe
  2⤵
  PID:9884
- C:\Windows\System\YmnRVBA.exe
  C:\Windows\System\YmnRVBA.exe
  2⤵
  PID:9900
- C:\Windows\System\cWjUVmc.exe
  C:\Windows\System\cWjUVmc.exe
  2⤵
  PID:9940
- C:\Windows\System\dEVpZjd.exe
  C:\Windows\System\dEVpZjd.exe
  2⤵
  PID:9956
- C:\Windows\System\kKnLCIY.exe
  C:\Windows\System\kKnLCIY.exe
  2⤵
  PID:9996
- C:\Windows\System\woYKzVH.exe
  C:\Windows\System\woYKzVH.exe
  2⤵
  PID:10012
- C:\Windows\System\QtNZzit.exe
  C:\Windows\System\QtNZzit.exe
  2⤵
  PID:10052
- C:\Windows\System\JyHnaWa.exe
  C:\Windows\System\JyHnaWa.exe
  2⤵
  PID:10068
- C:\Windows\System\WfJlnOj.exe
  C:\Windows\System\WfJlnOj.exe
  2⤵
  PID:10084
- C:\Windows\System\zbMinrh.exe
  C:\Windows\System\zbMinrh.exe
  2⤵
  PID:10100
- C:\Windows\System\GfvNSrh.exe
  C:\Windows\System\GfvNSrh.exe
  2⤵
  PID:10124
- C:\Windows\System\maZSaCC.exe
  C:\Windows\System\maZSaCC.exe
  2⤵
  PID:10156
- C:\Windows\System\CTLHtlp.exe
  C:\Windows\System\CTLHtlp.exe
  2⤵
  PID:10184
- C:\Windows\System\qHqwoUg.exe
  C:\Windows\System\qHqwoUg.exe
  2⤵
  PID:10212
- C:\Windows\System\hIUNSPX.exe
  C:\Windows\System\hIUNSPX.exe
  2⤵
  PID:8436
- C:\Windows\System\pPPALeY.exe
  C:\Windows\System\pPPALeY.exe
  2⤵
  PID:9284
- C:\Windows\System\IBzUZBc.exe
  C:\Windows\System\IBzUZBc.exe
  2⤵
  PID:9312
- C:\Windows\System\LxBYCMr.exe
  C:\Windows\System\LxBYCMr.exe
  2⤵
  PID:9408
- C:\Windows\System\ELqipFY.exe
  C:\Windows\System\ELqipFY.exe
  2⤵
  PID:9512
- C:\Windows\System\SFdbiat.exe
  C:\Windows\System\SFdbiat.exe
  2⤵
  PID:9564
- C:\Windows\System\ZxWXWWM.exe
  C:\Windows\System\ZxWXWWM.exe
  2⤵
  PID:9596
- C:\Windows\System\yGYAEBu.exe
  C:\Windows\System\yGYAEBu.exe
  2⤵
  PID:9624
- C:\Windows\System\zmsPCUe.exe
  C:\Windows\System\zmsPCUe.exe
  2⤵
  PID:9692
- C:\Windows\System\KfqzuNK.exe
  C:\Windows\System\KfqzuNK.exe
  2⤵
  PID:9764
- C:\Windows\System\rUuRMlP.exe
  C:\Windows\System\rUuRMlP.exe
  2⤵
  PID:9784
- C:\Windows\System\RAFlyIT.exe
  C:\Windows\System\RAFlyIT.exe
  2⤵
  PID:9892
- C:\Windows\System\cBCSDcA.exe
  C:\Windows\System\cBCSDcA.exe
  2⤵
  PID:9972
- C:\Windows\System\mybnzvQ.exe
  C:\Windows\System\mybnzvQ.exe
  2⤵
  PID:10064
- C:\Windows\System\SzYRcjw.exe
  C:\Windows\System\SzYRcjw.exe
  2⤵
  PID:10136
- C:\Windows\System\naklWls.exe
  C:\Windows\System\naklWls.exe
  2⤵
  PID:10224
- C:\Windows\System\qKLYvhc.exe
  C:\Windows\System\qKLYvhc.exe
  2⤵
  PID:9332
- C:\Windows\System\MNMLZRJ.exe
  C:\Windows\System\MNMLZRJ.exe
  2⤵
  PID:9456
- C:\Windows\System\cQfGatt.exe
  C:\Windows\System\cQfGatt.exe
  2⤵
  PID:9652
- C:\Windows\System\qKVDqMw.exe
  C:\Windows\System\qKVDqMw.exe
  2⤵
  PID:9700
- C:\Windows\System\vUkneEa.exe
  C:\Windows\System\vUkneEa.exe
  2⤵
  PID:9932
- C:\Windows\System\EBgiRFI.exe
  C:\Windows\System\EBgiRFI.exe
  2⤵
  PID:10036
- C:\Windows\System\gVgYesb.exe
  C:\Windows\System\gVgYesb.exe
  2⤵
  PID:10204
- C:\Windows\System\iDRKthM.exe
  C:\Windows\System\iDRKthM.exe
  2⤵
  PID:9516
- C:\Windows\System\eZZXOJh.exe
  C:\Windows\System\eZZXOJh.exe
  2⤵
  PID:9848
- C:\Windows\System\qUQHeSl.exe
  C:\Windows\System\qUQHeSl.exe
  2⤵
  PID:10092
- C:\Windows\System\hUjmjEd.exe
  C:\Windows\System\hUjmjEd.exe
  2⤵
  PID:9320
- C:\Windows\System\dZlYxtn.exe
  C:\Windows\System\dZlYxtn.exe
  2⤵
  PID:9796
- C:\Windows\System\aTVeqZT.exe
  C:\Windows\System\aTVeqZT.exe
  2⤵
  PID:10276
- C:\Windows\System\MgVWACL.exe
  C:\Windows\System\MgVWACL.exe
  2⤵
  PID:10296
- C:\Windows\System\FuEIRyq.exe
  C:\Windows\System\FuEIRyq.exe
  2⤵
  PID:10316
- C:\Windows\System\PGhchzs.exe
  C:\Windows\System\PGhchzs.exe
  2⤵
  PID:10340
- C:\Windows\System\mThUEJf.exe
  C:\Windows\System\mThUEJf.exe
  2⤵
  PID:10364
- C:\Windows\System\aWPfJbo.exe
  C:\Windows\System\aWPfJbo.exe
  2⤵
  PID:10380
- C:\Windows\System\ZgdmiYv.exe
  C:\Windows\System\ZgdmiYv.exe
  2⤵
  PID:10404
- C:\Windows\System\NFMAdos.exe
  C:\Windows\System\NFMAdos.exe
  2⤵
  PID:10452
- C:\Windows\System\VJYDnYH.exe
  C:\Windows\System\VJYDnYH.exe
  2⤵
  PID:10472
- C:\Windows\System\HTEOmiV.exe
  C:\Windows\System\HTEOmiV.exe
  2⤵
  PID:10496
- C:\Windows\System\uhHaljU.exe
  C:\Windows\System\uhHaljU.exe
  2⤵
  PID:10556
- C:\Windows\System\VfNaPhI.exe
  C:\Windows\System\VfNaPhI.exe
  2⤵
  PID:10584
- C:\Windows\System\LAutFKN.exe
  C:\Windows\System\LAutFKN.exe
  2⤵
  PID:10612
- C:\Windows\System\OmaLcgF.exe
  C:\Windows\System\OmaLcgF.exe
  2⤵
  PID:10628
- C:\Windows\System\ljCFheD.exe
  C:\Windows\System\ljCFheD.exe
  2⤵
  PID:10656
- C:\Windows\System\nrDsyhi.exe
  C:\Windows\System\nrDsyhi.exe
  2⤵
  PID:10672
- C:\Windows\System\jtFmZjw.exe
  C:\Windows\System\jtFmZjw.exe
  2⤵
  PID:10696
- C:\Windows\System\lntRaIx.exe
  C:\Windows\System\lntRaIx.exe
  2⤵
  PID:10724
- C:\Windows\System\BXJNCGJ.exe
  C:\Windows\System\BXJNCGJ.exe
  2⤵
  PID:10752
- C:\Windows\System\IdyxFhS.exe
  C:\Windows\System\IdyxFhS.exe
  2⤵
  PID:10780
- C:\Windows\System\fTFULrU.exe
  C:\Windows\System\fTFULrU.exe
  2⤵
  PID:10808
- C:\Windows\System\igSNWcg.exe
  C:\Windows\System\igSNWcg.exe
  2⤵
  PID:10832
- C:\Windows\System\SMwhqzX.exe
  C:\Windows\System\SMwhqzX.exe
  2⤵
  PID:10852
- C:\Windows\System\pGCulGY.exe
  C:\Windows\System\pGCulGY.exe
  2⤵
  PID:10900
- C:\Windows\System\ggAFxyP.exe
  C:\Windows\System\ggAFxyP.exe
  2⤵
  PID:10920
- C:\Windows\System\mMgicmA.exe
  C:\Windows\System\mMgicmA.exe
  2⤵
  PID:10956
- C:\Windows\System\kzZILtH.exe
  C:\Windows\System\kzZILtH.exe
  2⤵
  PID:10976
- C:\Windows\System\jULLtKQ.exe
  C:\Windows\System\jULLtKQ.exe
  2⤵
  PID:11024
- C:\Windows\System\OOrjSXE.exe
  C:\Windows\System\OOrjSXE.exe
  2⤵
  PID:11044
- C:\Windows\System\FgsVtGt.exe
  C:\Windows\System\FgsVtGt.exe
  2⤵
  PID:11076
- C:\Windows\System\GDsDhLT.exe
  C:\Windows\System\GDsDhLT.exe
  2⤵
  PID:11096
- C:\Windows\System\kctAtiM.exe
  C:\Windows\System\kctAtiM.exe
  2⤵
  PID:11136
- C:\Windows\System\wXrbSqC.exe
  C:\Windows\System\wXrbSqC.exe
  2⤵
  PID:11164
- C:\Windows\System\Mmquqiw.exe
  C:\Windows\System\Mmquqiw.exe
  2⤵
  PID:11184
- C:\Windows\System\PbQHUCL.exe
  C:\Windows\System\PbQHUCL.exe
  2⤵
  PID:11212
- C:\Windows\System\SBicUAf.exe
  C:\Windows\System\SBicUAf.exe
  2⤵
  PID:11260
- C:\Windows\System\QXdZJme.exe
  C:\Windows\System\QXdZJme.exe
  2⤵
  PID:10312
- C:\Windows\System\DZNWHLr.exe
  C:\Windows\System\DZNWHLr.exe
  2⤵
  PID:10328
- C:\Windows\System\jxdRYDX.exe
  C:\Windows\System\jxdRYDX.exe
  2⤵
  PID:10396
- C:\Windows\System\GfXbkdC.exe
  C:\Windows\System\GfXbkdC.exe
  2⤵
  PID:10460
- C:\Windows\System\vBmgUDv.exe
  C:\Windows\System\vBmgUDv.exe
  2⤵
  PID:10540
- C:\Windows\System\hZTEtIR.exe
  C:\Windows\System\hZTEtIR.exe
  2⤵
  PID:10620
- C:\Windows\System\sgPiGTL.exe
  C:\Windows\System\sgPiGTL.exe
  2⤵
  PID:10648
- C:\Windows\System\eRmgczD.exe
  C:\Windows\System\eRmgczD.exe
  2⤵
  PID:10748
- C:\Windows\System\nBxGIxR.exe
  C:\Windows\System\nBxGIxR.exe
  2⤵
  PID:10768
- C:\Windows\System\iZJjzID.exe
  C:\Windows\System\iZJjzID.exe
  2⤵
  PID:10908
- C:\Windows\System\ruPajLE.exe
  C:\Windows\System\ruPajLE.exe
  2⤵
  PID:10972
- C:\Windows\System\aXfSHIL.exe
  C:\Windows\System\aXfSHIL.exe
  2⤵
  PID:10968
- C:\Windows\System\mCmJUCb.exe
  C:\Windows\System\mCmJUCb.exe
  2⤵
  PID:11040
- C:\Windows\System\qaAmati.exe
  C:\Windows\System\qaAmati.exe
  2⤵
  PID:11120
- C:\Windows\System\MUXuVfp.exe
  C:\Windows\System\MUXuVfp.exe
  2⤵
  PID:11152
- C:\Windows\System\BpIidom.exe
  C:\Windows\System\BpIidom.exe
  2⤵
  PID:11244
- C:\Windows\System\topntij.exe
  C:\Windows\System\topntij.exe
  2⤵
  PID:10348
- C:\Windows\System\mCYRGIf.exe
  C:\Windows\System\mCYRGIf.exe
  2⤵
  PID:10608
- C:\Windows\System\TMWABjW.exe
  C:\Windows\System\TMWABjW.exe
  2⤵
  PID:10604
- C:\Windows\System\qvtVqzq.exe
  C:\Windows\System\qvtVqzq.exe
  2⤵
  PID:10820
- C:\Windows\System\PrezPiP.exe
  C:\Windows\System\PrezPiP.exe
  2⤵
  PID:11052
- C:\Windows\System\LDYSkCy.exe
  C:\Windows\System\LDYSkCy.exe
  2⤵
  PID:11240
- C:\Windows\System\YvfrjSE.exe
  C:\Windows\System\YvfrjSE.exe
  2⤵
  PID:10740
- C:\Windows\System\eTzjdDu.exe
  C:\Windows\System\eTzjdDu.exe
  2⤵
  PID:11208
- C:\Windows\System\jTELYAG.exe
  C:\Windows\System\jTELYAG.exe
  2⤵
  PID:10744
- C:\Windows\System\WRrFCaX.exe
  C:\Windows\System\WRrFCaX.exe
  2⤵
  PID:740
- C:\Windows\System\wNIvaDs.exe
  C:\Windows\System\wNIvaDs.exe
  2⤵
  PID:10568
- C:\Windows\System\agMtQzR.exe
  C:\Windows\System\agMtQzR.exe
  2⤵
  PID:4944
- C:\Windows\System\CyoktBV.exe
  C:\Windows\System\CyoktBV.exe
  2⤵
  PID:11288
- C:\Windows\System\MQXOjIO.exe
  C:\Windows\System\MQXOjIO.exe
  2⤵
  PID:11304
- C:\Windows\System\PxvcuHw.exe
  C:\Windows\System\PxvcuHw.exe
  2⤵
  PID:11324
- C:\Windows\System\iTPkpiV.exe
  C:\Windows\System\iTPkpiV.exe
  2⤵
  PID:11344
- C:\Windows\System\xMtnQcN.exe
  C:\Windows\System\xMtnQcN.exe
  2⤵
  PID:11364
- C:\Windows\System\eYOjMOC.exe
  C:\Windows\System\eYOjMOC.exe
  2⤵
  PID:11408
- C:\Windows\System\JwjrLrS.exe
  C:\Windows\System\JwjrLrS.exe
  2⤵
  PID:11436
- C:\Windows\System\brmRnfV.exe
  C:\Windows\System\brmRnfV.exe
  2⤵
  PID:11472
- C:\Windows\System\oxSfmZR.exe
  C:\Windows\System\oxSfmZR.exe
  2⤵
  PID:11528
- C:\Windows\System\FdVWVuU.exe
  C:\Windows\System\FdVWVuU.exe
  2⤵
  PID:11556
- C:\Windows\System\sQmvMqR.exe
  C:\Windows\System\sQmvMqR.exe
  2⤵
  PID:11572
- C:\Windows\System\SCDiUIm.exe
  C:\Windows\System\SCDiUIm.exe
  2⤵
  PID:11608
- C:\Windows\System\WMgmLxC.exe
  C:\Windows\System\WMgmLxC.exe
  2⤵
  PID:11624
- C:\Windows\System\fswqmLS.exe
  C:\Windows\System\fswqmLS.exe
  2⤵
  PID:11644
- C:\Windows\System\JmwoxOY.exe
  C:\Windows\System\JmwoxOY.exe
  2⤵
  PID:11680
- C:\Windows\System\Amgohpd.exe
  C:\Windows\System\Amgohpd.exe
  2⤵
  PID:11700
- C:\Windows\System\qpdaUCg.exe
  C:\Windows\System\qpdaUCg.exe
  2⤵
  PID:11720
- C:\Windows\System\jWBRKWk.exe
  C:\Windows\System\jWBRKWk.exe
  2⤵
  PID:11740
- C:\Windows\System\wrvSJqD.exe
  C:\Windows\System\wrvSJqD.exe
  2⤵
  PID:11756
- C:\Windows\System\NpzkJmo.exe
  C:\Windows\System\NpzkJmo.exe
  2⤵
  PID:11784
- C:\Windows\System\KAaOfjQ.exe
  C:\Windows\System\KAaOfjQ.exe
  2⤵
  PID:11852
- C:\Windows\System\iuCIZxb.exe
  C:\Windows\System\iuCIZxb.exe
  2⤵
  PID:11880
- C:\Windows\System\ilPbcBJ.exe
  C:\Windows\System\ilPbcBJ.exe
  2⤵
  PID:11896
- C:\Windows\System\QIyikHz.exe
  C:\Windows\System\QIyikHz.exe
  2⤵
  PID:11924
- C:\Windows\System\AugISkj.exe
  C:\Windows\System\AugISkj.exe
  2⤵
  PID:11952
- C:\Windows\System\MsegUnp.exe
  C:\Windows\System\MsegUnp.exe
  2⤵
  PID:11976
- C:\Windows\System\SytFiFa.exe
  C:\Windows\System\SytFiFa.exe
  2⤵
  PID:12004
- C:\Windows\System\NwFwnwe.exe
  C:\Windows\System\NwFwnwe.exe
  2⤵
  PID:12060
- C:\Windows\System\FVzQsIL.exe
  C:\Windows\System\FVzQsIL.exe
  2⤵
  PID:12092
- C:\Windows\System\VQWTSPS.exe
  C:\Windows\System\VQWTSPS.exe
  2⤵
  PID:12108
- C:\Windows\System\NnzLcOc.exe
  C:\Windows\System\NnzLcOc.exe
  2⤵
  PID:12140
- C:\Windows\System\efbttRK.exe
  C:\Windows\System\efbttRK.exe
  2⤵
  PID:12164
- C:\Windows\System\CWGGrjF.exe
  C:\Windows\System\CWGGrjF.exe
  2⤵
  PID:12188
- C:\Windows\System\yzYunwc.exe
  C:\Windows\System\yzYunwc.exe
  2⤵
  PID:12244
- C:\Windows\System\hFKPHnF.exe
  C:\Windows\System\hFKPHnF.exe
  2⤵
  PID:12272
- C:\Windows\System\kLKqxmz.exe
  C:\Windows\System\kLKqxmz.exe
  2⤵
  PID:11276
- C:\Windows\System\QYwsGGk.exe
  C:\Windows\System\QYwsGGk.exe
  2⤵
  PID:11296
- C:\Windows\System\qINMuEz.exe
  C:\Windows\System\qINMuEz.exe
  2⤵
  PID:11392
- C:\Windows\System\MVbnXDU.exe
  C:\Windows\System\MVbnXDU.exe
  2⤵
  PID:11488
- C:\Windows\System\fmalWmN.exe
  C:\Windows\System\fmalWmN.exe
  2⤵
  PID:11480
- C:\Windows\System\NeenYDc.exe
  C:\Windows\System\NeenYDc.exe
  2⤵
  PID:11616
- C:\Windows\System\rRlbkjy.exe
  C:\Windows\System\rRlbkjy.exe
  2⤵
  PID:11696
- C:\Windows\System\URKlEIm.exe
  C:\Windows\System\URKlEIm.exe
  2⤵
  PID:11688
- C:\Windows\System\NkbIUrp.exe
  C:\Windows\System\NkbIUrp.exe
  2⤵
  PID:11748
- C:\Windows\System\sSkVRSP.exe
  C:\Windows\System\sSkVRSP.exe
  2⤵
  PID:11804
- C:\Windows\System\UiJRKPg.exe
  C:\Windows\System\UiJRKPg.exe
  2⤵
  PID:11872
- C:\Windows\System\zADgTWA.exe
  C:\Windows\System\zADgTWA.exe
  2⤵
  PID:11932
- C:\Windows\System\zceNHQC.exe
  C:\Windows\System\zceNHQC.exe
  2⤵
  PID:11936
- C:\Windows\System\PCuJlnA.exe
  C:\Windows\System\PCuJlnA.exe
  2⤵
  PID:12080
- C:\Windows\System\BdwutAp.exe
  C:\Windows\System\BdwutAp.exe
  2⤵
  PID:12184
- C:\Windows\System\nSALJDG.exe
  C:\Windows\System\nSALJDG.exe
  2⤵
  PID:12268
- C:\Windows\System\qHHoJsT.exe
  C:\Windows\System\qHHoJsT.exe
  2⤵
  PID:11272
- C:\Windows\System\rvsweHe.exe
  C:\Windows\System\rvsweHe.exe
  2⤵
  PID:11604
- C:\Windows\System\aVVSBvR.exe
  C:\Windows\System\aVVSBvR.exe
  2⤵
  PID:11588
- C:\Windows\System\TlVbNjI.exe
  C:\Windows\System\TlVbNjI.exe
  2⤵
  PID:11712
- C:\Windows\System\CyGzzqv.exe
  C:\Windows\System\CyGzzqv.exe
  2⤵
  PID:11780
- C:\Windows\System\CPghLTO.exe
  C:\Windows\System\CPghLTO.exe
  2⤵
  PID:12044
- C:\Windows\System\hVIrpqx.exe
  C:\Windows\System\hVIrpqx.exe
  2⤵
  PID:12120
- C:\Windows\System\TsXpetN.exe
  C:\Windows\System\TsXpetN.exe
  2⤵
  PID:12284
- C:\Windows\System\ZYldhul.exe
  C:\Windows\System\ZYldhul.exe
  2⤵
  PID:11876
- C:\Windows\System\AcAdOfP.exe
  C:\Windows\System\AcAdOfP.exe
  2⤵
  PID:11920
- C:\Windows\System\SglqBXl.exe
  C:\Windows\System\SglqBXl.exe
  2⤵
  PID:12292
- C:\Windows\System\mjdNNJE.exe
  C:\Windows\System\mjdNNJE.exe
  2⤵
  PID:12320
- C:\Windows\System\pGqGOWH.exe
  C:\Windows\System\pGqGOWH.exe
  2⤵
  PID:12348
- C:\Windows\System\wWjYoXJ.exe
  C:\Windows\System\wWjYoXJ.exe
  2⤵
  PID:12396
- C:\Windows\System\WNAbOfX.exe
  C:\Windows\System\WNAbOfX.exe
  2⤵
  PID:12424
- C:\Windows\System\FnlkCou.exe
  C:\Windows\System\FnlkCou.exe
  2⤵
  PID:12456
- C:\Windows\System\TTwwaYI.exe
  C:\Windows\System\TTwwaYI.exe
  2⤵
  PID:12472
- C:\Windows\System\JIWezgb.exe
  C:\Windows\System\JIWezgb.exe
  2⤵
  PID:12500
- C:\Windows\System\gtixWdL.exe
  C:\Windows\System\gtixWdL.exe
  2⤵
  PID:12516
- C:\Windows\System\sgxJlQk.exe
  C:\Windows\System\sgxJlQk.exe
  2⤵
  PID:12532
- C:\Windows\System\ZUDIgyK.exe
  C:\Windows\System\ZUDIgyK.exe
  2⤵
  PID:12548
- C:\Windows\System\lJshKoU.exe
  C:\Windows\System\lJshKoU.exe
  2⤵
  PID:12584
- C:\Windows\System\eAkjERj.exe
  C:\Windows\System\eAkjERj.exe
  2⤵
  PID:12612
- C:\Windows\System\ZuFXRpy.exe
  C:\Windows\System\ZuFXRpy.exe
  2⤵
  PID:12644
- C:\Windows\System\nCgrLJM.exe
  C:\Windows\System\nCgrLJM.exe
  2⤵
  PID:12676
- C:\Windows\System\FOgHbwO.exe
  C:\Windows\System\FOgHbwO.exe
  2⤵
  PID:12724
- C:\Windows\System\VsYciaH.exe
  C:\Windows\System\VsYciaH.exe
  2⤵
  PID:12752
- C:\Windows\System\wCPNZpu.exe
  C:\Windows\System\wCPNZpu.exe
  2⤵
  PID:12768
- C:\Windows\System\iytvPBE.exe
  C:\Windows\System\iytvPBE.exe
  2⤵
  PID:12792
- C:\Windows\System\NWYCvYN.exe
  C:\Windows\System\NWYCvYN.exe
  2⤵
  PID:12824
- C:\Windows\System\XWdNkHw.exe
  C:\Windows\System\XWdNkHw.exe
  2⤵
  PID:12844
- C:\Windows\System\TNDeSCH.exe
  C:\Windows\System\TNDeSCH.exe
  2⤵
  PID:12904
- C:\Windows\System\tKsZpqr.exe
  C:\Windows\System\tKsZpqr.exe
  2⤵
  PID:12924
- C:\Windows\System\hGUbtML.exe
  C:\Windows\System\hGUbtML.exe
  2⤵
  PID:12948
- C:\Windows\System\cawrEKD.exe
  C:\Windows\System\cawrEKD.exe
  2⤵
  PID:12968
- C:\Windows\System\oWKTGKb.exe
  C:\Windows\System\oWKTGKb.exe
  2⤵
  PID:12988
- C:\Windows\System\yIYVZIC.exe
  C:\Windows\System\yIYVZIC.exe
  2⤵
  PID:13012
- C:\Windows\System\GcExvkJ.exe
  C:\Windows\System\GcExvkJ.exe
  2⤵
  PID:13060
- C:\Windows\System\CATbZlf.exe
  C:\Windows\System\CATbZlf.exe
  2⤵
  PID:13088
- C:\Windows\System\IoCpZyR.exe
  C:\Windows\System\IoCpZyR.exe
  2⤵
  PID:13112
- C:\Windows\System\ZVzfJFr.exe
  C:\Windows\System\ZVzfJFr.exe
  2⤵
  PID:13136
- C:\Windows\System\UPUsFlR.exe
  C:\Windows\System\UPUsFlR.exe
  2⤵
  PID:13160
- C:\Windows\System\mSuYCLw.exe
  C:\Windows\System\mSuYCLw.exe
  2⤵
  PID:13184
- C:\Windows\System\eqRzoaT.exe
  C:\Windows\System\eqRzoaT.exe
  2⤵
  PID:13204
- C:\Windows\System\BDUYZMQ.exe
  C:\Windows\System\BDUYZMQ.exe
  2⤵
  PID:13228
- C:\Windows\System\uGMCtVa.exe
  C:\Windows\System\uGMCtVa.exe
  2⤵
  PID:13260
- C:\Windows\System\KPAYoUa.exe
  C:\Windows\System\KPAYoUa.exe
  2⤵
  PID:13292
- C:\Windows\System\biDWfQn.exe
  C:\Windows\System\biDWfQn.exe
  2⤵
  PID:11448
- C:\Windows\System\kaNdiat.exe
  C:\Windows\System\kaNdiat.exe
  2⤵
  PID:12340
- C:\Windows\System\obcOiCC.exe
  C:\Windows\System\obcOiCC.exe
  2⤵
  PID:12408
- C:\Windows\System\Ommwflu.exe
  C:\Windows\System\Ommwflu.exe
  2⤵
  PID:12464
- C:\Windows\System\UNUuUKW.exe
  C:\Windows\System\UNUuUKW.exe
  2⤵
  PID:12508
- C:\Windows\System\TQXiFzk.exe
  C:\Windows\System\TQXiFzk.exe
  2⤵
  PID:12664
- C:\Windows\System\RkKUgdu.exe
  C:\Windows\System\RkKUgdu.exe
  2⤵
  PID:12764
- C:\Windows\System\PBTvXEs.exe
  C:\Windows\System\PBTvXEs.exe
  2⤵
  PID:12864
- C:\Windows\System\AAHWBBg.exe
  C:\Windows\System\AAHWBBg.exe
  2⤵
  PID:12940
- C:\Windows\System\vncGhVA.exe
  C:\Windows\System\vncGhVA.exe
  2⤵
  PID:12984
- C:\Windows\System\hNMbRDl.exe
  C:\Windows\System\hNMbRDl.exe
  2⤵
  PID:13052
- C:\Windows\System\yhIbzDQ.exe
  C:\Windows\System\yhIbzDQ.exe
  2⤵
  PID:13148
- C:\Windows\System\cVjjcrR.exe
  C:\Windows\System\cVjjcrR.exe
  2⤵
  PID:13192
- C:\Windows\System\FbHsykc.exe
  C:\Windows\System\FbHsykc.exe
  2⤵
  PID:13224
- C:\Windows\System\nzlavNe.exe
  C:\Windows\System\nzlavNe.exe
  2⤵
  PID:12308
- C:\Windows\System\jNwDcue.exe
  C:\Windows\System\jNwDcue.exe
  2⤵
  PID:12444
- C:\Windows\System\vLXezPD.exe
  C:\Windows\System\vLXezPD.exe
  2⤵
  PID:12608
- C:\Windows\System\pCuLKTl.exe
  C:\Windows\System\pCuLKTl.exe
  2⤵
  PID:12788
- C:\Windows\System\HFNRVsh.exe
  C:\Windows\System\HFNRVsh.exe
  2⤵
  PID:12892
- C:\Windows\System\FKoKPOO.exe
  C:\Windows\System\FKoKPOO.exe
  2⤵
  PID:13040
- C:\Windows\System\HKjESJf.exe
  C:\Windows\System\HKjESJf.exe
  2⤵
  PID:12316
- C:\Windows\System\vHQEsRU.exe
  C:\Windows\System\vHQEsRU.exe
  2⤵
  PID:12240
- C:\Windows\System\vTuwxCL.exe
  C:\Windows\System\vTuwxCL.exe
  2⤵
  PID:12932
- C:\Windows\System\OQAxFQG.exe
  C:\Windows\System\OQAxFQG.exe
  2⤵
  PID:13196
- C:\Windows\System\gGdzLIZ.exe
  C:\Windows\System\gGdzLIZ.exe
  2⤵
  PID:12860
- C:\Windows\System\GYroSAi.exe
  C:\Windows\System\GYroSAi.exe
  2⤵
  PID:13216
- C:\Windows\System\ZWGHauX.exe
  C:\Windows\System\ZWGHauX.exe
  2⤵
  PID:13336
- C:\Windows\System\fxXTKbW.exe
  C:\Windows\System\fxXTKbW.exe
  2⤵
  PID:13356
- C:\Windows\System\TNtxBZJ.exe
  C:\Windows\System\TNtxBZJ.exe
  2⤵
  PID:13380
- C:\Windows\System\LudpOtc.exe
  C:\Windows\System\LudpOtc.exe
  2⤵
  PID:13404
- C:\Windows\System\uSJoEvn.exe
  C:\Windows\System\uSJoEvn.exe
  2⤵
  PID:13440
- C:\Windows\System\wehtNUu.exe
  C:\Windows\System\wehtNUu.exe
  2⤵
  PID:13492
- C:\Windows\System\PKISUxw.exe
  C:\Windows\System\PKISUxw.exe
  2⤵
  PID:13520
- C:\Windows\System\bgZGIHx.exe
  C:\Windows\System\bgZGIHx.exe
  2⤵
  PID:13552
- C:\Windows\System\pGSrcwR.exe
  C:\Windows\System\pGSrcwR.exe
  2⤵
  PID:13572
- C:\Windows\System\FoZjOYU.exe
  C:\Windows\System\FoZjOYU.exe
  2⤵
  PID:13600
- C:\Windows\System\pIKNgQL.exe
  C:\Windows\System\pIKNgQL.exe
  2⤵
  PID:13624
- C:\Windows\System\RPdOvxX.exe
  C:\Windows\System\RPdOvxX.exe
  2⤵
  PID:13648
- C:\Windows\System\JxtIrmh.exe
  C:\Windows\System\JxtIrmh.exe
  2⤵
  PID:13688
- C:\Windows\System\xaYpRRt.exe
  C:\Windows\System\xaYpRRt.exe
  2⤵
  PID:13712
- C:\Windows\System\IKTqtcy.exe
  C:\Windows\System\IKTqtcy.exe
  2⤵
  PID:13736
- C:\Windows\System\yxouGQN.exe
  C:\Windows\System\yxouGQN.exe
  2⤵
  PID:13752
- C:\Windows\System\xWBWmrW.exe
  C:\Windows\System\xWBWmrW.exe
  2⤵
  PID:13784
- C:\Windows\System\XRBBthf.exe
  C:\Windows\System\XRBBthf.exe
  2⤵
  PID:13820
- C:\Windows\System\pSxaOti.exe
  C:\Windows\System\pSxaOti.exe
  2⤵
  PID:13844
- C:\Windows\System\AgxVzVq.exe
  C:\Windows\System\AgxVzVq.exe
  2⤵
  PID:13872
- C:\Windows\System\tujgfjw.exe
  C:\Windows\System\tujgfjw.exe
  2⤵
  PID:13900
- C:\Windows\System\ytNnqqm.exe
  C:\Windows\System\ytNnqqm.exe
  2⤵
  PID:13920
- C:\Windows\System\bVgaOac.exe
  C:\Windows\System\bVgaOac.exe
  2⤵
  PID:13948
- C:\Windows\System\UqBTKos.exe
  C:\Windows\System\UqBTKos.exe
  2⤵
  PID:13972
- C:\Windows\System\UvsbWtq.exe
  C:\Windows\System\UvsbWtq.exe
  2⤵
  PID:14004
- C:\Windows\System\aMcZFku.exe
  C:\Windows\System\aMcZFku.exe
  2⤵
  PID:14024
- C:\Windows\System\VzMwNtA.exe
  C:\Windows\System\VzMwNtA.exe
  2⤵
  PID:14068
- C:\Windows\System\yTHPsRt.exe
  C:\Windows\System\yTHPsRt.exe
  2⤵
  PID:14116
- C:\Windows\System\muzCVmk.exe
  C:\Windows\System\muzCVmk.exe
  2⤵
  PID:14132
- C:\Windows\System\uENQOGD.exe
  C:\Windows\System\uENQOGD.exe
  2⤵
  PID:14156
- C:\Windows\System\mnlYlPn.exe
  C:\Windows\System\mnlYlPn.exe
  2⤵
  PID:14188
- C:\Windows\System\whhbMoA.exe
  C:\Windows\System\whhbMoA.exe
  2⤵
  PID:14204
- C:\Windows\System\sWvLRWr.exe
  C:\Windows\System\sWvLRWr.exe
  2⤵
  PID:14220
- C:\Windows\System\fqMUFfJ.exe
  C:\Windows\System\fqMUFfJ.exe
  2⤵
  PID:14256
- C:\Windows\System\OazJsBv.exe
  C:\Windows\System\OazJsBv.exe
  2⤵
  PID:14288
- C:\Windows\System\AGFLivJ.exe
  C:\Windows\System\AGFLivJ.exe
  2⤵
  PID:14308
- C:\Windows\System\UqeHzaQ.exe
  C:\Windows\System\UqeHzaQ.exe
  2⤵
  PID:13332
- C:\Windows\System\wEpLqTR.exe
  C:\Windows\System\wEpLqTR.exe
  2⤵
  PID:13396
- C:\Windows\System\WIUwDOA.exe
  C:\Windows\System\WIUwDOA.exe
  2⤵
  PID:13436
- C:\Windows\System\IUYNsxE.exe
  C:\Windows\System\IUYNsxE.exe
  2⤵
  PID:13480
- C:\Windows\System\ZYDXIGc.exe
  C:\Windows\System\ZYDXIGc.exe
  2⤵
  PID:13560
- C:\Windows\System\yalwbmx.exe
  C:\Windows\System\yalwbmx.exe
  2⤵
  PID:13668
- C:\Windows\System\exJepmO.exe
  C:\Windows\System\exJepmO.exe
  2⤵
  PID:13768
- C:\Windows\System\JQeeIpn.exe
  C:\Windows\System\JQeeIpn.exe
  2⤵
  PID:13800
- C:\Windows\System\wOChByK.exe
  C:\Windows\System\wOChByK.exe
  2⤵
  PID:13880
- C:\Windows\System\NCQHoHh.exe
  C:\Windows\System\NCQHoHh.exe
  2⤵
  PID:13868
- C:\Windows\System\FNpvoye.exe
  C:\Windows\System\FNpvoye.exe
  2⤵
  PID:13928
- C:\Windows\System\kvpJqGi.exe
  C:\Windows\System\kvpJqGi.exe
  2⤵
  PID:14052
- C:\Windows\System\XWvkTYr.exe
  C:\Windows\System\XWvkTYr.exe
  2⤵
  PID:14092
- C:\Windows\System\MCvTcuY.exe
  C:\Windows\System\MCvTcuY.exe
  2⤵
  PID:14124
- C:\Windows\System\pzbzpvM.exe
  C:\Windows\System\pzbzpvM.exe
  2⤵
  PID:14264
- C:\Windows\System\PBhRgcG.exe
  C:\Windows\System\PBhRgcG.exe
  2⤵
  PID:12524
- C:\Windows\System\pUcUhia.exe
  C:\Windows\System\pUcUhia.exe
  2⤵
  PID:13420
- C:\Windows\System\LwjhcKp.exe
  C:\Windows\System\LwjhcKp.exe
  2⤵
  PID:13400
- C:\Windows\System\rinhgXH.exe
  C:\Windows\System\rinhgXH.exe
  2⤵
  PID:13776
- C:\Windows\System\TYxcvUF.exe
  C:\Windows\System\TYxcvUF.exe
  2⤵
  PID:13832
- C:\Windows\System\XoklDpk.exe
  C:\Windows\System\XoklDpk.exe
  2⤵
  PID:14048
- C:\Windows\System\yFUGbSC.exe
  C:\Windows\System\yFUGbSC.exe
  2⤵
  PID:14240
- C:\Windows\System\pHtFbRJ.exe
  C:\Windows\System\pHtFbRJ.exe
  2⤵
  PID:14036
- C:\Windows\System\hjMHPMQ.exe
  C:\Windows\System\hjMHPMQ.exe
  2⤵
  PID:13348
- C:\Windows\System\bbTzjjh.exe
  C:\Windows\System\bbTzjjh.exe
  2⤵
  PID:14212
- C:\Windows\System\tmvYLcV.exe
  C:\Windows\System\tmvYLcV.exe
  2⤵
  PID:14268
- C:\Windows\System\VnxPPYh.exe
  C:\Windows\System\VnxPPYh.exe
  2⤵
  PID:13912
- C:\Windows\System\iEEAowp.exe
  C:\Windows\System\iEEAowp.exe
  2⤵
  PID:14348
- C:\Windows\System\QLyQpem.exe
  C:\Windows\System\QLyQpem.exe
  2⤵
  PID:14372
- C:\Windows\System\NFkaCwL.exe
  C:\Windows\System\NFkaCwL.exe
  2⤵
  PID:14396
- C:\Windows\System\ifURNLo.exe
  C:\Windows\System\ifURNLo.exe
  2⤵
  PID:14420
- C:\Windows\System\jQlvtQx.exe
  C:\Windows\System\jQlvtQx.exe
  2⤵
  PID:14468
- C:\Windows\System\OGrGkJm.exe
  C:\Windows\System\OGrGkJm.exe
  2⤵
  PID:14508
- C:\Windows\System\wCRdWAS.exe
  C:\Windows\System\wCRdWAS.exe
  2⤵
  PID:14524
- C:\Windows\System\TsgkUTR.exe
  C:\Windows\System\TsgkUTR.exe
  2⤵
  PID:14552
- C:\Windows\System\CEiQGIX.exe
  C:\Windows\System\CEiQGIX.exe
  2⤵
  PID:14592
- C:\Windows\System\ybXoAUu.exe
  C:\Windows\System\ybXoAUu.exe
  2⤵
  PID:14616
- C:\Windows\System\EVktVPl.exe
  C:\Windows\System\EVktVPl.exe
  2⤵
  PID:14636
- C:\Windows\System\MEfWPBT.exe
  C:\Windows\System\MEfWPBT.exe
  2⤵
  PID:14664
- C:\Windows\System\pkQwINv.exe
  C:\Windows\System\pkQwINv.exe
  2⤵
  PID:14692
- C:\Windows\System\LZvAUyY.exe
  C:\Windows\System\LZvAUyY.exe
  2⤵
  PID:14732
- C:\Windows\System\fNvFZXk.exe
  C:\Windows\System\fNvFZXk.exe
  2⤵
  PID:14748
- C:\Windows\System\HkawknO.exe
  C:\Windows\System\HkawknO.exe
  2⤵
  PID:14764
- C:\Windows\System\wsttaKL.exe
  C:\Windows\System\wsttaKL.exe
  2⤵
  PID:14784
- C:\Windows\System\lkAZvSR.exe
  C:\Windows\System\lkAZvSR.exe
  2⤵
  PID:14816
- C:\Windows\System\apkhLdD.exe
  C:\Windows\System\apkhLdD.exe
  2⤵
  PID:14832
- C:\Windows\System\tGCpEAb.exe
  C:\Windows\System\tGCpEAb.exe
  2⤵
  PID:14856
- C:\Windows\System\qVeuxFg.exe
  C:\Windows\System\qVeuxFg.exe
  2⤵
  PID:14876
- C:\Windows\System\BjivAxd.exe
  C:\Windows\System\BjivAxd.exe
  2⤵
  PID:14940
- C:\Windows\System\YdUxsXe.exe
  C:\Windows\System\YdUxsXe.exe
  2⤵
  PID:14964
- C:\Windows\System\jLHYYrM.exe
  C:\Windows\System\jLHYYrM.exe
  2⤵
  PID:14988
- C:\Windows\System\tnOmQAH.exe
  C:\Windows\System\tnOmQAH.exe
  2⤵
  PID:15008
- C:\Windows\System\tZZOeSI.exe
  C:\Windows\System\tZZOeSI.exe
  2⤵
  PID:15056
- C:\Windows\System\NNdSFRU.exe
  C:\Windows\System\NNdSFRU.exe
  2⤵
  PID:15084
- C:\Windows\System\okCKsya.exe
  C:\Windows\System\okCKsya.exe
  2⤵
  PID:15100
- C:\Windows\System\KvAovvr.exe
  C:\Windows\System\KvAovvr.exe
  2⤵
  PID:15148
- C:\Windows\System\tsWIjKN.exe
  C:\Windows\System\tsWIjKN.exe
  2⤵
  PID:15164
- C:\Windows\System\lxqlElc.exe
  C:\Windows\System\lxqlElc.exe
  2⤵
  PID:15188
- C:\Windows\System\WVxWVtB.exe
  C:\Windows\System\WVxWVtB.exe
  2⤵
  PID:15212
- C:\Windows\System\JJGocFY.exe
  C:\Windows\System\JJGocFY.exe
  2⤵
  PID:15236
- C:\Windows\System\ogvibsZ.exe
  C:\Windows\System\ogvibsZ.exe
  2⤵
  PID:15280
- C:\Windows\System\RhPfWcC.exe
  C:\Windows\System\RhPfWcC.exe
  2⤵
  PID:15308
- C:\Windows\System\kSRYBnV.exe
  C:\Windows\System\kSRYBnV.exe
  2⤵
  PID:15324
- C:\Windows\System\sjZZnGa.exe
  C:\Windows\System\sjZZnGa.exe
  2⤵
  PID:15340
- C:\Windows\System\mGoJpmE.exe
  C:\Windows\System\mGoJpmE.exe
  2⤵
  PID:14172
- C:\Windows\System\iJFrBPS.exe
  C:\Windows\System\iJFrBPS.exe
  2⤵
  PID:14416
- C:\Windows\System\OlsJhnh.exe
  C:\Windows\System\OlsJhnh.exe
  2⤵
  PID:14544
- C:\Windows\System\SrmPThp.exe
  C:\Windows\System\SrmPThp.exe
  2⤵
  PID:14584
- C:\Windows\System\iLKbauF.exe
  C:\Windows\System\iLKbauF.exe
  2⤵
  PID:14604
- C:\Windows\System\jwCaZQA.exe
  C:\Windows\System\jwCaZQA.exe
  2⤵
  PID:14688
- C:\Windows\System\HBSgSdf.exe
  C:\Windows\System\HBSgSdf.exe
  2⤵
  PID:14740
- C:\Windows\System\bSfFxaV.exe
  C:\Windows\System\bSfFxaV.exe
  2⤵
  PID:14828
- C:\Windows\System\ytEYzZk.exe
  C:\Windows\System\ytEYzZk.exe
  2⤵
  PID:14844
- C:\Windows\System\zaJhxpL.exe
  C:\Windows\System\zaJhxpL.exe
  2⤵
  PID:14952
- C:\Windows\System\CkFbqLM.exe
  C:\Windows\System\CkFbqLM.exe
  2⤵
  PID:15000
- C:\Windows\System\PKtqkgV.exe
  C:\Windows\System\PKtqkgV.exe
  2⤵
  PID:15168
- C:\Windows\System\SJaNvpV.exe
  C:\Windows\System\SJaNvpV.exe
  2⤵
  PID:15204
- C:\Windows\System\ztRTXqE.exe
  C:\Windows\System\ztRTXqE.exe
  2⤵
  PID:15232
- C:\Windows\System\gpHorNg.exe
  C:\Windows\System\gpHorNg.exe
  2⤵
  PID:15300
- C:\Windows\System\SEFycYU.exe
  C:\Windows\System\SEFycYU.exe
  2⤵
  PID:15356
- C:\Windows\System\yhXogQX.exe
  C:\Windows\System\yhXogQX.exe
  2⤵
  PID:14404
- C:\Windows\System\KYaUlwF.exe
  C:\Windows\System\KYaUlwF.exe
  2⤵
  PID:14480
- C:\Windows\System\IcJjsYH.exe
  C:\Windows\System\IcJjsYH.exe
  2⤵
  PID:14772
- C:\Windows\System\PXPdtPO.exe
  C:\Windows\System\PXPdtPO.exe
  2⤵
  PID:14892
- C:\Windows\System\jKsAQii.exe
  C:\Windows\System\jKsAQii.exe
  2⤵
  PID:14912
- C:\Windows\System\bvagilz.exe
  C:\Windows\System\bvagilz.exe
  2⤵
  PID:15176
- C:\Windows\System\StvUVPr.exe
  C:\Windows\System\StvUVPr.exe
  2⤵
  PID:15268
- C:\Windows\System\LYyaUAY.exe
  C:\Windows\System\LYyaUAY.exe
  2⤵
  PID:14660
- C:\Windows\System\trkMqmt.exe
  C:\Windows\System\trkMqmt.exe
  2⤵
  PID:14920
- C:\Windows\System\DVucRSh.exe
  C:\Windows\System\DVucRSh.exe
  2⤵
  PID:14608
- C:\Windows\System\WSWbiLh.exe
  C:\Windows\System\WSWbiLh.exe
  2⤵
  PID:15368
- C:\Windows\System\ZllmuCx.exe
  C:\Windows\System\ZllmuCx.exe
  2⤵
  PID:15384
- C:\Windows\System\veLQqRu.exe
  C:\Windows\System\veLQqRu.exe
  2⤵
  PID:15416
- C:\Windows\System\QiSNFYs.exe
  C:\Windows\System\QiSNFYs.exe
  2⤵
  PID:15436
- C:\Windows\System\sRoWSAl.exe
  C:\Windows\System\sRoWSAl.exe
  2⤵
  PID:15464
- C:\Windows\System\nsopXIq.exe
  C:\Windows\System\nsopXIq.exe
  2⤵
  PID:15508
- C:\Windows\System\YuttutL.exe
  C:\Windows\System\YuttutL.exe
  2⤵
  PID:15552
- C:\Windows\System\aXZBDtz.exe
  C:\Windows\System\aXZBDtz.exe
  2⤵
  PID:15572
- C:\Windows\System\rHfRIwi.exe
  C:\Windows\System\rHfRIwi.exe
  2⤵
  PID:15596
- C:\Windows\System\fxuUlYz.exe
  C:\Windows\System\fxuUlYz.exe
  2⤵
  PID:15636
- C:\Windows\System\oNFHqYr.exe
  C:\Windows\System\oNFHqYr.exe
  2⤵
  PID:15664
- C:\Windows\System\fUahLLp.exe
  C:\Windows\System\fUahLLp.exe
  2⤵
  PID:15680
- C:\Windows\System\rcfIHNe.exe
  C:\Windows\System\rcfIHNe.exe
  2⤵
  PID:15700
- C:\Windows\System\RzGVNYX.exe
  C:\Windows\System\RzGVNYX.exe
  2⤵
  PID:15728
- C:\Windows\System\hZjxWDk.exe
  C:\Windows\System\hZjxWDk.exe
  2⤵
  PID:15752
- C:\Windows\System\YrKFzIl.exe
  C:\Windows\System\YrKFzIl.exe
  2⤵
  PID:15772
- C:\Windows\System\TxLSmvh.exe
  C:\Windows\System\TxLSmvh.exe
  2⤵
  PID:15792
- C:\Windows\System\EAxaiNv.exe
  C:\Windows\System\EAxaiNv.exe
  2⤵
  PID:15820
- C:\Windows\System\qgdHvyB.exe
  C:\Windows\System\qgdHvyB.exe
  2⤵
  PID:15848
- C:\Windows\System\BvEFLJa.exe
  C:\Windows\System\BvEFLJa.exe
  2⤵
  PID:15872
- C:\Windows\System\nikhqRX.exe
  C:\Windows\System\nikhqRX.exe
  2⤵
  PID:15892
- C:\Windows\System\SDZKntC.exe
  C:\Windows\System\SDZKntC.exe
  2⤵
  PID:15916
- C:\Windows\System\PkFfpgT.exe
  C:\Windows\System\PkFfpgT.exe
  2⤵
  PID:15940
- C:\Windows\System\AVfxjSL.exe
  C:\Windows\System\AVfxjSL.exe
  2⤵
  PID:15992
- C:\Windows\System\YUkuVTo.exe
  C:\Windows\System\YUkuVTo.exe
  2⤵
  PID:16016
- C:\Windows\System\pEiSmef.exe
  C:\Windows\System\pEiSmef.exe
  2⤵
  PID:16052
- C:\Windows\System\KiopsAy.exe
  C:\Windows\System\KiopsAy.exe
  2⤵
  PID:16100
- C:\Windows\System\cDUOjOG.exe
  C:\Windows\System\cDUOjOG.exe
  2⤵
  PID:16132
- C:\Windows\System\ilrZUWq.exe
  C:\Windows\System\ilrZUWq.exe
  2⤵
  PID:16156
- C:\Windows\System\WWHJkUx.exe
  C:\Windows\System\WWHJkUx.exe
  2⤵
  PID:16176
- C:\Windows\System\HiBkuwo.exe
  C:\Windows\System\HiBkuwo.exe
  2⤵
  PID:16200
- C:\Windows\System\qlegSCD.exe
  C:\Windows\System\qlegSCD.exe
  2⤵
  PID:16240
- C:\Windows\System\GhUnTiS.exe
  C:\Windows\System\GhUnTiS.exe
  2⤵
  PID:16268
- C:\Windows\System\VmbiFkx.exe
  C:\Windows\System\VmbiFkx.exe
  2⤵
  PID:16308
- C:\Windows\System\OAxzfBa.exe
  C:\Windows\System\OAxzfBa.exe
  2⤵
  PID:16336
- C:\Windows\System\YhwtCpq.exe
  C:\Windows\System\YhwtCpq.exe
  2⤵
  PID:16364
- C:\Windows\System\xCKQmWV.exe
  C:\Windows\System\xCKQmWV.exe
  2⤵
  PID:15196
- C:\Windows\System\QmyLila.exe
  C:\Windows\System\QmyLila.exe
  2⤵
  PID:15428
- C:\Windows\System\ZqdglHO.exe
  C:\Windows\System\ZqdglHO.exe
  2⤵
  PID:15444
- C:\Windows\System\BepcsOx.exe
  C:\Windows\System\BepcsOx.exe
  2⤵
  PID:15540
- C:\Windows\System\mQBORBO.exe
  C:\Windows\System\mQBORBO.exe
  2⤵
  PID:15580
- C:\Windows\System\ymApOMI.exe
  C:\Windows\System\ymApOMI.exe
  2⤵
  PID:15672
- C:\Windows\System\McYateS.exe
  C:\Windows\System\McYateS.exe
  2⤵
  PID:15716
- C:\Windows\System\EwssWxG.exe
  C:\Windows\System\EwssWxG.exe
  2⤵
  PID:15780
- C:\Windows\System\HSjGlim.exe
  C:\Windows\System\HSjGlim.exe
  2⤵
  PID:15840
- C:\Windows\System\eOdHgAb.exe
  C:\Windows\System\eOdHgAb.exe
  2⤵
  PID:15868
- C:\Windows\System\DPToZFP.exe
  C:\Windows\System\DPToZFP.exe
  2⤵
  PID:15952
- C:\Windows\System\bTZwGNe.exe
  C:\Windows\System\bTZwGNe.exe
  2⤵
  PID:15980
- C:\Windows\System\IaLKfht.exe
  C:\Windows\System\IaLKfht.exe
  2⤵
  PID:16044
- C:\Windows\System\gmkvfJF.exe
  C:\Windows\System\gmkvfJF.exe
  2⤵
  PID:16120
- C:\Windows\System\JiMALTa.exe
  C:\Windows\System\JiMALTa.exe
  2⤵
  PID:16220
- C:\Windows\System\faEOMSH.exe
  C:\Windows\System\faEOMSH.exe
  2⤵
  PID:16260
- C:\Windows\System\SbKiuAm.exe
  C:\Windows\System\SbKiuAm.exe
  2⤵
  PID:16320
- C:\Windows\System\qCCqjkS.exe
  C:\Windows\System\qCCqjkS.exe
  2⤵
  PID:15380
- C:\Windows\System\ZuNpvpK.exe
  C:\Windows\System\ZuNpvpK.exe
  2⤵
  PID:15516
- C:\Windows\System\DIpILsr.exe
  C:\Windows\System\DIpILsr.exe
  2⤵
  PID:15736
- C:\Windows\System\hTIsKZL.exe
  C:\Windows\System\hTIsKZL.exe
  2⤵
  PID:15904
- C:\Windows\System\XyVUPsJ.exe
  C:\Windows\System\XyVUPsJ.exe
  2⤵
  PID:15976
- C:\Windows\System\kGGmITM.exe
  C:\Windows\System\kGGmITM.exe
  2⤵
  PID:16196
- C:\Windows\System\AmimAVb.exe
  C:\Windows\System\AmimAVb.exe
  2⤵
  PID:16300
- C:\Windows\System\JiILHnE.exe
  C:\Windows\System\JiILHnE.exe
  2⤵
  PID:15456
- C:\Windows\System\iYCIlrs.exe
  C:\Windows\System\iYCIlrs.exe
  2⤵
  PID:15708
- C:\Windows\System\OstuxQH.exe
  C:\Windows\System\OstuxQH.exe
  2⤵
  PID:15908
- C:\Windows\System\YnklcSn.exe
  C:\Windows\System\YnklcSn.exe
  2⤵
  PID:14720
- C:\Windows\System\sWNFnSU.exe
  C:\Windows\System\sWNFnSU.exe
  2⤵
  PID:16396
- C:\Windows\System\SJGgFuz.exe
  C:\Windows\System\SJGgFuz.exe
  2⤵
  PID:16420
- C:\Windows\System\OPNHmZB.exe
  C:\Windows\System\OPNHmZB.exe
  2⤵
  PID:16444
- C:\Windows\System\SSBzaVo.exe
  C:\Windows\System\SSBzaVo.exe
  2⤵
  PID:16464
- C:\Windows\System\cfvRceT.exe
  C:\Windows\System\cfvRceT.exe
  2⤵
  PID:16500
- C:\Windows\System\UusOHLq.exe
  C:\Windows\System\UusOHLq.exe
  2⤵
  PID:16524
- C:\Windows\System\BSaETbu.exe
  C:\Windows\System\BSaETbu.exe
  2⤵
  PID:16556
- C:\Windows\System\XIxXgNH.exe
  C:\Windows\System\XIxXgNH.exe
  2⤵
  PID:16576
- C:\Windows\System\nRDEKKG.exe
  C:\Windows\System\nRDEKKG.exe
  2⤵
  PID:16600
- C:\Windows\System\nuKxpSI.exe
  C:\Windows\System\nuKxpSI.exe
  2⤵
  PID:16624
- C:\Windows\System\KRuqTAE.exe
  C:\Windows\System\KRuqTAE.exe
  2⤵
  PID:16648
- C:\Windows\System\zBVYrOF.exe
  C:\Windows\System\zBVYrOF.exe
  2⤵
  PID:16680
- C:\Windows\System\kxIjHDK.exe
  C:\Windows\System\kxIjHDK.exe
  2⤵
  PID:16704
- C:\Windows\System\qIQhQQf.exe
  C:\Windows\System\qIQhQQf.exe
  2⤵
  PID:16748
- C:\Windows\System\AqMQdre.exe
  C:\Windows\System\AqMQdre.exe
  2⤵
  PID:16772
- C:\Windows\System\facesfT.exe
  C:\Windows\System\facesfT.exe
  2⤵
  PID:16812
- C:\Windows\System\DLVyWKo.exe
  C:\Windows\System\DLVyWKo.exe
  2⤵
  PID:16840
- C:\Windows\System\zPocnrU.exe
  C:\Windows\System\zPocnrU.exe
  2⤵
  PID:16860
- C:\Windows\System\AzbAKhX.exe
  C:\Windows\System\AzbAKhX.exe
  2⤵
  PID:16884
- C:\Windows\System\pwyDeQx.exe
  C:\Windows\System\pwyDeQx.exe
  2⤵
  PID:16904
- C:\Windows\System\YehxRIv.exe
  C:\Windows\System\YehxRIv.exe
  2⤵
  PID:16940
- C:\Windows\System\yIJSjeb.exe
  C:\Windows\System\yIJSjeb.exe
  2⤵
  PID:16960

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AHLVCKS.exe

Filesize
1.4MB

MD5
93febaf4200b8ae3d01e16be643abc0d

SHA1
ddcb7288da0bb7852507559e8a5c9420877b9c84

SHA256
d66baf6bb5e77f6db2eea2f256933649e648efb1edeeca06cf6b8b8eb76e84f2

SHA512
f318789f4cf00d500873d713c223d8f07fc54064f815f894238ccd242764d8fdd9f92fb16c65f480ba0142a0091932928a6be16d64cc073538dd757c2585df90

Download Submit
C:\Windows\System\AXELVtg.exe

Filesize
1.3MB

MD5
a68234c5dded373fbab2d14fabb00b95

SHA1
cb36c9fe3a0d19f21916d238cc2c8c2cc2f870af

SHA256
06baeed3bf7d6974bfd8811ba072ee4e5a3e412ecafa6782a7cd0493b98de792

SHA512
e51a660a0860d5b9c4d9b2787f329b233220bcd3f40bc909878031ed94469e501c9555b1840c5827072e5ecc76371831c4c9261a936330c7c2766291038a4676

Download Submit
C:\Windows\System\BNUmBgG.exe

Filesize
1.4MB

MD5
253ccd6b9b7770eeda73f0a57c7a67e8

SHA1
a1810ee0db3fb1beef9732a39e81455d73b63825

SHA256
ee7dfcf02f1973d15321b19b662ae988e3a1df61b8ec2849eca10d6a6438ebff

SHA512
5c8bf0444861983dc2f84d013a6a0e8a8fbd7aafaae95f06e6acd0145fca3145f659a48b0eea9b54f14d2ac46ce9516052a17c9f7f5fa2ed1d8b88cab347ef9e

Download Submit
C:\Windows\System\BTmNYcZ.exe

Filesize
1.3MB

MD5
cb82a3ceb84085b96713fa4ca95f197e

SHA1
c82bad920e9df5a59230b2fada7af93beaacca12

SHA256
f62ea2418ca05ee408230848a9e8f2d766a2aee648382161e86d41da487b2f35

SHA512
edea5686d1d406643f1d346a99b2c01cc48c430809d48858d4fc37e6f162999477ac0c408c7df3a399065ac013d88b0a9566f3589c61ab0135b83e4fdab5e0ab

Download Submit
C:\Windows\System\DLLinRp.exe

Filesize
1.3MB

MD5
34664c514a87d6266d74b963a9eccd7d

SHA1
836cd373f42a79c0bbfb97b90c586e5af620f505

SHA256
7f3b16927dec3d3876cbbe66437d7606df1dc91cc8f6d04d437a9dbdac610a42

SHA512
842cd95dc6368a0df80ef0f27d8f60f862375f34b7300e76ae1f767678bb6fd2ff7e29a52798cc7528687413e16e24fea41fa914200a880a47aea6939eea32e2

Download Submit
C:\Windows\System\DPzFQcR.exe

Filesize
1.4MB

MD5
f9eae9dcb81a74e6b1f0981f0e529bb9

SHA1
3f4d6f51d7299301c575681cafe12bbbc8ba98d9

SHA256
57e6f0ae4c951063897da1cd4bf0e9c6caaabbdffa2c1d67a59dd95575c04909

SHA512
55539f4c6a6e9b65f428d16dffab36711a4c99a1933e42cb2221e97493ae1cd5f76d431fd39c2966ce02738253b867f592a3bc1137ed1d622780c7f6929e76ab

Download Submit
C:\Windows\System\DhZpbFD.exe

Filesize
1.4MB

MD5
1e4acb5811f522f9cfddd99a8f84d77d

SHA1
3b928fb9a1c20584003c39d4227918b63fe16b93

SHA256
99bf0fab59d02ab6c04e49effa51db9c6ed8818ecbfe27e3ac18f9eee576d7e4

SHA512
915b0b8319c19cc9ed0152b34c8c3d445e16bdd97a7401c4ff9940c68c085e6efd1f19ab2a8f4745cdcd4973ea7e029610e42d3823c8c94cdb37bb29452a2905

Download Submit
C:\Windows\System\FFBDIhn.exe

Filesize
1.3MB

MD5
05aa285d79ca13cbf317ba83c63199a1

SHA1
61b00e992cf27df132d93c70f3ea44147cbe7750

SHA256
5fc088754215550bfbb9474781ae2ddbb58157a8e48b4dbcdbffeab67b24c691

SHA512
4feaed7b56ce29881230ad8874168a5cf497d70e847c2381dee0944cedcd227f580ed4e9a84747ee36c6c6f085d6b42c91427847a3e345d097617336c040f36a

Download Submit
C:\Windows\System\HmPFbow.exe

Filesize
1.4MB

MD5
972d58ba74f387dc307663d4a6dfd4f3

SHA1
2330895679752517ebdd8ea60534ced88a838e02

SHA256
fb8c1394d65b9ebf5e22191717c4616c9df4a6618832f344a19d89b109cbc16c

SHA512
955e469efc84ab15fbc5ca0b71d72caf770096bde37635ec4c506001485915b13eedb9bffeeb834eebac6564cf919dca95c0c3c597115cb409eea18633b5e1b8

Download Submit
C:\Windows\System\IsTZgNK.exe

Filesize
1.3MB

MD5
7357ef238d754ab1b8018f23dea0c727

SHA1
cf84c51e8f43380975c7ccb0db1a266a85a5eb45

SHA256
397588911718bc329983380b5682a9c60f1ee95b04ce9d84d3c5529c8935e3db

SHA512
f234f561c4336f5a76b7fa80ddecf3b76a5be6bb6fd0f4f367f2af7acb1d378e29a73a8388dcfaac1bb72df1cb1b9e163d93f6ab496965ed530448d2e6b2226e

Download Submit
C:\Windows\System\KiItIPR.exe

Filesize
1.4MB

MD5
a461df2e4088862c18f11942b8ea47f6

SHA1
3e09628b474ef2b32058945b60f0c1de41806854

SHA256
1f3a0383828e9df367d409711a180481f96c400a5652672ff215dff5d7c1e372

SHA512
c8a24311921be070e6e32a3cc6bfcbd7e17953b1a347d6a0076681220b7f397fe8e00f7b52356c907c6033e5577eefab29462350a66a72ebacb5c6175d53af93

Download Submit
C:\Windows\System\LHIMHtH.exe

Filesize
1.3MB

MD5
68d367bd690d7585d1b99dfa609882b2

SHA1
4f5529c4558a059c2a9af7e631f95cb5c2433ea1

SHA256
887eecf2251f0169724a57837ab6b6a94f557298e4f12cfb7d0e6c478f9a1303

SHA512
a494cc43a292060a4884219047e99f775a2b923ea77ed8371175450a31cea87f910e402676780b0d5e71ef02c329ae0c59b48f20ce5bc83cccdec85cfa44b6a1

Download Submit
C:\Windows\System\MkBDrig.exe

Filesize
1.3MB

MD5
c66cf5a89dec9fb9d9bfa0b34fb5666f

SHA1
cbd3e3202e84ccccf7951b6fd5ce7b2026b4ba16

SHA256
57ba924e845aa05cb43cd50f02c08d3fdf80730d486fea2247a04737c17ae6da

SHA512
8db248d2ff168457d72af482bdd8e2bb133713435d457f475054587f22c9f8ac39268f539e03bca1f644bc5ec805e494bcbec19d1b226667c1775116cd4f453e

Download Submit
C:\Windows\System\NMHrwNA.exe

Filesize
1.4MB

MD5
9c68968144d5be75240fe5b186015a23

SHA1
93c9915fa0b55898f4a343dbe9ce21e7e4411fc9

SHA256
c40496afd610c9238acea23e16d285cfbc78fe52d5f2d40e9de2b0191e5ddcdf

SHA512
3deedb1046bad4c770f94cf9360a25bafc4991fe820e45adace00188873ef30cb8bee805a8e0975e6c876572b6eba58fdd134ff01640bf3148a5d363726b72bc

Download Submit
C:\Windows\System\NyUVwQw.exe

Filesize
1.4MB

MD5
d4cfb106225dc4f799c6fbd1c71b6e0f

SHA1
e077bc502dbc631914f56d1be437527aef48ff66

SHA256
b762ccca8ebd345e3b3af4fff546e03afeaedc813b5ba9196af1904143cb654f

SHA512
4a5d1d2cc81a49034349cb0dc567d4c9cc786eadcad1e2dbe65d1c98d1847190edd5e121d7523f70a039404722f71c01e19b6407cbf508bab0ac86b419e2bd36

Download Submit
C:\Windows\System\QZVzDwV.exe

Filesize
1.4MB

MD5
944818cad8884d70703dc606db8eedba

SHA1
da59e65ab25f9b0f218bea567ac23781e517ca8d

SHA256
9708e4f3dfe1f5bd430a11cb3b148555d177c084f45e4d776ffd29bfdc035b3b

SHA512
b6498b7420b168eb2359050bae678f89949236a1fcf7c595cd36458630cfb4e98bde8d28e2861dcbee89944f135447b6ecdbba7dbab8c6fc825ef91b0fb2aa35

Download Submit
C:\Windows\System\RpvSXfk.exe

Filesize
1.4MB

MD5
ce99f06fbfdd7358c8b14a8fdf58fe73

SHA1
5764cbfcdb33270af57346bd6fed07d0d5273ccd

SHA256
ad15f6fac70bb1738e6dd130cdd6bf0d85afc587ee849c1fc81d3dea27f74768

SHA512
7abcfa46b8dcdafb9e6f1bfcb02ef9fd8d360dbc5b407c816e0fd43d63fa352d4ff0cc0b28432e9dd04746ba62ee08782e94f40d5da3762787ad5f8bdb1c7fe4

Download Submit
C:\Windows\System\UlwPuaP.exe

Filesize
1.4MB

MD5
1b5c7d41c42114ca26c04a34b979587f

SHA1
900f02783ec70453a4028ee3e26eae67e6471339

SHA256
d4de3048cb73319ac9aa0c711f2dd0c472800b9d9c5a386fd2f0c76dd7adf27a

SHA512
1af63b1758bed73767a3083c56508737f2bb7d0395173639cf5edfe0c4ca9f03e87017e5a6f8199b12039bf38f8f28c45a49c777c7314f8374d044167f6bcc68

Download Submit
C:\Windows\System\WVjmyZh.exe

Filesize
1.4MB

MD5
63740c02a861ad03d0f58041f586ab8a

SHA1
723796479b4d3995c0c20bcf9cae9849a87a94bc

SHA256
17b247312de3b27fe26061563cb867b80bbf260467f669a3263ffffafe23d6bf

SHA512
dbbe9ec9e2ef345c355016e46ca24c3101fecec41563b9a821f4d2e5da3b935f6d6443aedaf86088f7f1fd633ca07d1c035036302c53782796cae486437991cc

Download Submit
C:\Windows\System\YOHofya.exe

Filesize
1.4MB

MD5
cf54c3d74d8c221fcb0bd25d4ec246b7

SHA1
7220474d86114e75833eff04afb8689dff8f06d5

SHA256
30caba94502369afd5377c55406b4b1536240508ab518ebcf5d00c5c6bc66946

SHA512
2e61e263115aef72ce1dadba2c7331f1e89598a80b04497898271f5dff4e87aebaeee0505078832e33aaa89ea023d923937ab9e723df038f3200cccc01fecd1d

Download Submit
C:\Windows\System\aauqQBJ.exe

Filesize
1.4MB

MD5
1c9722ee772edb0b89ed7f285dd4c5b0

SHA1
ba59522789f00db041a12c0d612bf9dcdda51c8a

SHA256
b542bd1e6973df32b9d4145d09b94a4d22097a4a00739e6f775684a7ab8fce43

SHA512
d6f2020c939cd25b61b471f2f407241054d32fd95f029a2f33d503c35e71ffc0a65e4f7796ea79d360c1e8e5a995905820c7ec506cd9f30a9c76b4a50319b79b

Download Submit
C:\Windows\System\bAvYvWC.exe

Filesize
1.3MB

MD5
6d5e0386c9975a146be1e94407022847

SHA1
6dee6b20f29aef147c886a055881167c2a601d0c

SHA256
5626758989336166d503a9c7a12cb626274f1c8ec7265d74d3d4374163511213

SHA512
cd889540a0ccdb9f1649de211916e1cfa45a0c9ec291464b90cd6e510139c341845b242e1d5a05fa65638501dd1e342bbae82dc11dca728dd8f7b30e6f5512bd

Download Submit
C:\Windows\System\cLmppOy.exe

Filesize
1.3MB

MD5
d85439418f42388d44e35be42b33ac32

SHA1
5fc1e57f5224622dc32a2f30c8bb8404c7fa3c82

SHA256
5c0c14c07d813af5ea03170c81b18be083e5792c6248aa9b90908f7d2c32433b

SHA512
6d6c49e5ac3319010896415dea2b178298e096d10933f0e836b7469a73b2db92f2ba466b465dd5c9f7ab47e159b7c0ef8ae73edc4b4ad8c2edadb764a7112eb8

Download Submit
C:\Windows\System\gKSKGZB.exe

Filesize
1.3MB

MD5
66f3efab511390fb93696388ab4b46ac

SHA1
84c133d2769f2203a5bf4b8a00e463a1782fa23d

SHA256
3102b725deb44521b5869e09dfeddc20f394f9da6bf9de41c8e6d5e174157f5a

SHA512
b3903152f5ad052802b404d4ac8a5016fa461e6cc2bc4572d37bd78ab614dd2d09f695af1d6894e71c1932acc7d919b062b83830fcff5d2b3ea7eec1e7318ba6

Download Submit
C:\Windows\System\knhsLks.exe

Filesize
1.4MB

MD5
d319af35f3d1bb526c3e4f42fc5c9026

SHA1
99653bcf40832a92f1c9445c3636b86067b53ca0

SHA256
9d01f0fd573aaf9683f9c6900901a1ebf4a133aab14e94d621caee14aee6f4f1

SHA512
b652a43277c6d3676334c4b07c68077e9ada144a0e71a796bf22b348df118e800417761af39c0960ff8f36334e16d40e451fc02f6cabc694bb38446e1c897a93

Download Submit
C:\Windows\System\lDPvsFj.exe

Filesize
1.4MB

MD5
a105a28d69bffb4a32b8c2a430a11fd6

SHA1
a1be67918ffe7cc3946915867abec3ed8d7d3955

SHA256
754d89a1d3b7176d51090c3960281602ef7fcb8a783a4fb3c621b629654cc53d

SHA512
f6e67fb13a30e0bf601f545a2002f5bd9cdf2bccfe94c47ce1d86c7ecc6cc2fa7364409a8e2f4ce2006e0689c1d290976da02765091ee6470f6798edd88bf5dc

Download Submit
C:\Windows\System\mjcwIrD.exe

Filesize
1.3MB

MD5
1a1b71ddf867a505498d4f55be9c3adb

SHA1
a9c9dfc13ba853af9178070efea360ff0bb45596

SHA256
3eb173344a57671670913f40b84cd9222391c8247cd795a230122e3e4863dfc4

SHA512
7877d60f0a291141a0648d31e476aeb648044a196417f0fe36262f3826c63ad0e91d7ce0070e13e7727e8a8b416fc5795d36fbee67e83d80dd69db5923a01cdc

Download Submit
C:\Windows\System\oqVWMAM.exe

Filesize
1.3MB

MD5
71dc06f50e00855cfca2c53f7e86a602

SHA1
f103619e9dc04f6520e0d6d49d843a5ff89734cd

SHA256
f4575557eaf1cae7a248f54689e9abddcb35b7302a2d20fef4ff4109263c727b

SHA512
20011ef6ce52b6c8006ffd6dc8c5b8a635921c0b3864818ce446f8f30d7d93d7e1e378f25561879270cebb051d17cb4ecb77b4f9772d86bfbbf0f2ccd17c4a7d

Download Submit
C:\Windows\System\qVmsHEg.exe

Filesize
1.3MB

MD5
08802716339b314573d5e1ecbaa15335

SHA1
0953a44429560c726b8562de762725555f2ea3a2

SHA256
50217cb9170fcaaeed2845efc85f942d67d90957b510592a2b90a3b95626246b

SHA512
1e5f48f9de71e51115c6aa69ddbed3e21c2bcc5b261fbce1e3b4f10451af9d0a6af67bbd891fba888d7d5881d50f97923501c9e0f625c0c5b53f4ff0c7fe168d

Download Submit
C:\Windows\System\ruRihfB.exe

Filesize
1.3MB

MD5
4774600f7a7a261a03beb9145508b5ff

SHA1
2cde209b8c3f2e837f7ae9416fcc9c4dfa3bf3fc

SHA256
e850cda7a058fd21d70bb451d547578dd66013f6761a1383745afc7d61c5dc27

SHA512
ae3486d35adc4e106dd98776598f748e75dddaccb98925bc259a8662101b2236a5c0acdcc6e1c55ac474fed871024b174fdf40efdea0fa4aec791eba1956623e

Download Submit
C:\Windows\System\xIHWyRi.exe

Filesize
1.3MB

MD5
a3ce7e8ada48064bf3b44c847d3ffd94

SHA1
045a3a2015a269e569dd1dfa5859fb031b2d78e4

SHA256
bd763d8bbad6c9df06372b1cee138a3c4c4058a7d92cf0ca8afc78b4d9553f29

SHA512
73b5bd1c2ca185412a0fb797469b9b6936342afe82874362fc0fce2001477f386dc411a3b45404956c73eb440a985ee29057c858d799b2a55728ad8d6cffc294

Download Submit
C:\Windows\System\xsydFoj.exe

Filesize
1.4MB

MD5
e3e67fb4f5407f50368cd72a6e63f095

SHA1
ddb288f99d5a1dbfa041a62463c501e3116abdfa

SHA256
75cd92623b07a61da772da949191263886a17e32e663930ff24f37421afe9306

SHA512
d11f5359c9a322221bbdba7dcf7b26e7ea1578ece8aaabafb8328921cc438271168d10bd6f59da142fb7339b10ab49fd5280b72a4e73fd1650e290e0c711f90a

Download Submit
C:\Windows\System\yHrWVFK.exe

Filesize
1.4MB

MD5
29845c1cc8d80736fda5ce7a2f0e5e4a

SHA1
6b90515360b0a760a1a781e2ea100a68e69dcea3

SHA256
f7843ae5dc81ef049114d9fcf5d34d84dfb6777e679fd231b2483499ff1d68ac

SHA512
d1b60e67e176979920e65abd93ece1d697a582a327acfd218c18cd51eb096126d28104ea40eec820a6a6d26192d1867aa960102db82599bcabed2242e2acf02a

Download Submit
memory/540-0-0x000001F4EB4E0000-0x000001F4EB4F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads