xmrig | 50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
Size

1.7MB
MD5

1867f3dfda8561baa0251e6f89c686ce
SHA1

538ca015f4ecd5685778778135f25b32c593dfab
SHA256

50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877
SHA512

d28856ac1cc73ce6568af393ed79e36951a80e3d09fcda358e6bd544bd26b75b5e70da0873e3da1f779ec787d8a907206193ec9dd15932d5d2b39f0c00f9c212
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRRvzc26JxSD:GemTLkNdfE0pZyl

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b35-3.dat	xmrig
behavioral2/files/0x0008000000023bb9-6.dat	xmrig
behavioral2/files/0x000e000000023bb7-10.dat	xmrig
behavioral2/files/0x0008000000023bbd-19.dat	xmrig
behavioral2/files/0x0008000000023bbe-27.dat	xmrig
behavioral2/files/0x0008000000023bbf-36.dat	xmrig
behavioral2/files/0x0008000000023bf9-61.dat	xmrig
behavioral2/files/0x0008000000023bf2-69.dat	xmrig
behavioral2/files/0x0008000000023bfa-80.dat	xmrig
behavioral2/files/0x0008000000023c16-93.dat	xmrig
behavioral2/files/0x0008000000023c17-109.dat	xmrig
behavioral2/files/0x0008000000023c44-129.dat	xmrig
behavioral2/files/0x0008000000023c45-150.dat	xmrig
behavioral2/files/0x0008000000023c46-166.dat	xmrig
behavioral2/files/0x0008000000023c4a-175.dat	xmrig
behavioral2/files/0x0008000000023c49-165.dat	xmrig
behavioral2/files/0x0008000000023c48-161.dat	xmrig
behavioral2/files/0x0008000000023c47-156.dat	xmrig
behavioral2/files/0x0008000000023c43-138.dat	xmrig
behavioral2/files/0x0008000000023c37-136.dat	xmrig
behavioral2/files/0x0008000000023c33-134.dat	xmrig
behavioral2/files/0x0016000000023c2d-132.dat	xmrig
behavioral2/files/0x000b000000023c2c-130.dat	xmrig
behavioral2/files/0x0008000000023c15-105.dat	xmrig
behavioral2/files/0x0008000000023c12-103.dat	xmrig
behavioral2/files/0x0008000000023c14-101.dat	xmrig
behavioral2/files/0x0008000000023c13-99.dat	xmrig
behavioral2/files/0x0008000000023c0c-95.dat	xmrig
behavioral2/files/0x0008000000023bf8-76.dat	xmrig
behavioral2/files/0x0008000000023bf1-64.dat	xmrig
behavioral2/files/0x0008000000023bf3-68.dat	xmrig
behavioral2/files/0x0008000000023bef-50.dat	xmrig
behavioral2/files/0x0008000000023bf0-47.dat	xmrig
behavioral2/files/0x0008000000023bee-41.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3648	fMlsGCP.exe
3116	OtJHPvB.exe
920	FAqwoDJ.exe
2076	HslSZxJ.exe
4936	BTPAlHc.exe
3408	ZWZRFSI.exe
3996	DpeyGnk.exe
1176	jSfQadM.exe
3580	vCfvols.exe
4308	HTErAUb.exe
2252	ZCqguRr.exe
2476	MaYddeG.exe
5004	ZleWZGC.exe
4100	eNtbcJx.exe
2884	xYsqSYO.exe
5016	THTGqjI.exe
3856	KGxpnZc.exe
3668	iPhSFls.exe
4612	LuQpjVK.exe
1556	OkXGiuH.exe
228	wYwKTEi.exe
2560	MbxEYOX.exe
1444	uSrNcgK.exe
1676	eKtlfwY.exe
5088	ifngQvk.exe
4064	ePmnUNl.exe
2956	mpRSXet.exe
4696	dJLJmnb.exe
452	yOatYii.exe
4720	XvNZLJG.exe
3868	OfwWslO.exe
2864	gjKbCzu.exe
3428	YwnBWyf.exe
1160	KsETLMp.exe
3640	WQRhRrW.exe
2552	RPHoxoB.exe
2208	BMQhfoo.exe
1072	UgNpUCo.exe
728	atZbBzD.exe
3964	wtsROmz.exe
1880	ixdaybt.exe
4108	pjxKgEc.exe
2652	HxaeLiG.exe
4192	khjgzPl.exe
3144	XfcnQud.exe
3608	SNykiGc.exe
2404	xLvQUVh.exe
3120	zQUgltJ.exe
1892	UehMrEw.exe
3172	kWChIol.exe
4800	ZdFIkKb.exe
5092	CuuUxfG.exe
2796	OkiaYpc.exe
4092	enQenSq.exe
4580	KXxecJX.exe
320	ModWZVQ.exe
5112	POnDvIt.exe
4384	qOnsjwv.exe
4404	WsIKZFK.exe
4688	TrnImnN.exe
4780	VQKWgSS.exe
1944	nBhVEPC.exe
4748	ogKSuyN.exe
4180	hiFFzhL.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NWhUjCl.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\BXBbBZK.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\FmOVKid.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\eNtbcJx.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\TqXiiiI.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\VmVcjKm.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\IfhqsDg.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\ReSvDNU.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\ISgbMzR.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\DhNLUVK.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\urVSlYk.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\FAqwoDJ.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\dytDOBw.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\ifJgubF.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\QUhQEQA.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\cBkGAWT.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\KDuYFTu.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\IXsGYPQ.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\xwEldIg.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\XStLsIp.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\ERXvUrl.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\nIOrizJ.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\ShTZVCa.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\pUYxchY.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\PyHBmFm.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\wPUhyju.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\PBrfVjF.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\WqRLuyu.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\WmSryxA.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\RBozPuz.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\ezKuwbx.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\fvfdakV.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\WrMAmZK.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\YoColPV.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\DBNnUcw.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\BzDFdaL.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\KXxecJX.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\LACVQDf.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\rPLYvws.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\VtXKIab.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\sUsjDer.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\ZeSFOND.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\iextYTd.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\oWFYibX.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\rQuRFbj.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\SKBBqqs.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\HQalexm.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\XvNZLJG.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\UaxpGDr.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\WSWrFeg.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\RGVYgNq.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\btorZdy.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\bqTnToO.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\OcddDtC.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\sVfapby.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\zubWaSW.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\mCOcJnc.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\BVQbaZl.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\esnRMns.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\ucPnMeh.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\lpWexNZ.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\dZJvdhj.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\KINiOzT.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
File created	C:\Windows\System\mjhuLWJ.exe	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16692	dwm.exe
Token: SeChangeNotifyPrivilege	16692	dwm.exe
Token: 33	16692	dwm.exe
Token: SeIncBasePriorityPrivilege	16692	dwm.exe
Token: SeShutdownPrivilege	16692	dwm.exe
Token: SeCreatePagefilePrivilege	16692	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 3648	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	84
PID 4196 wrote to memory of 3648	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	84
PID 4196 wrote to memory of 3116	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	85
PID 4196 wrote to memory of 3116	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	85
PID 4196 wrote to memory of 920	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	86
PID 4196 wrote to memory of 920	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	86
PID 4196 wrote to memory of 2076	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	87
PID 4196 wrote to memory of 2076	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	87
PID 4196 wrote to memory of 4936	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	88
PID 4196 wrote to memory of 4936	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	88
PID 4196 wrote to memory of 3996	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	89
PID 4196 wrote to memory of 3996	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	89
PID 4196 wrote to memory of 3408	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	90
PID 4196 wrote to memory of 3408	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	90
PID 4196 wrote to memory of 1176	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	91
PID 4196 wrote to memory of 1176	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	91
PID 4196 wrote to memory of 3580	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	92
PID 4196 wrote to memory of 3580	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	92
PID 4196 wrote to memory of 4308	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	93
PID 4196 wrote to memory of 4308	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	93
PID 4196 wrote to memory of 2252	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	94
PID 4196 wrote to memory of 2252	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	94
PID 4196 wrote to memory of 2476	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	95
PID 4196 wrote to memory of 2476	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	95
PID 4196 wrote to memory of 5004	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	96
PID 4196 wrote to memory of 5004	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	96
PID 4196 wrote to memory of 4100	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	97
PID 4196 wrote to memory of 4100	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	97
PID 4196 wrote to memory of 5016	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	98
PID 4196 wrote to memory of 5016	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	98
PID 4196 wrote to memory of 2884	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	99
PID 4196 wrote to memory of 2884	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	99
PID 4196 wrote to memory of 4612	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	100
PID 4196 wrote to memory of 4612	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	100
PID 4196 wrote to memory of 3856	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	101
PID 4196 wrote to memory of 3856	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	101
PID 4196 wrote to memory of 3668	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	102
PID 4196 wrote to memory of 3668	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	102
PID 4196 wrote to memory of 1556	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	103
PID 4196 wrote to memory of 1556	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	103
PID 4196 wrote to memory of 228	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	104
PID 4196 wrote to memory of 228	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	104
PID 4196 wrote to memory of 2560	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	105
PID 4196 wrote to memory of 2560	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	105
PID 4196 wrote to memory of 1444	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	106
PID 4196 wrote to memory of 1444	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	106
PID 4196 wrote to memory of 1676	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	107
PID 4196 wrote to memory of 1676	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	107
PID 4196 wrote to memory of 5088	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	108
PID 4196 wrote to memory of 5088	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	108
PID 4196 wrote to memory of 4064	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	109
PID 4196 wrote to memory of 4064	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	109
PID 4196 wrote to memory of 2956	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	110
PID 4196 wrote to memory of 2956	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	110
PID 4196 wrote to memory of 4696	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	111
PID 4196 wrote to memory of 4696	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	111
PID 4196 wrote to memory of 452	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	112
PID 4196 wrote to memory of 452	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	112
PID 4196 wrote to memory of 4720	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	113
PID 4196 wrote to memory of 4720	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	113
PID 4196 wrote to memory of 3868	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	114
PID 4196 wrote to memory of 3868	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	114
PID 4196 wrote to memory of 2864	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	115
PID 4196 wrote to memory of 2864	4196	50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe	115

C:\Users\Admin\AppData\Local\Temp\50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe
"C:\Users\Admin\AppData\Local\Temp\50367dfa81ac6b3f5d90e0603dfa7c7fe27e3e6c69720f0836b6123fc7a17877.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\System\fMlsGCP.exe
  C:\Windows\System\fMlsGCP.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\OtJHPvB.exe
  C:\Windows\System\OtJHPvB.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\FAqwoDJ.exe
  C:\Windows\System\FAqwoDJ.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\HslSZxJ.exe
  C:\Windows\System\HslSZxJ.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\BTPAlHc.exe
  C:\Windows\System\BTPAlHc.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\DpeyGnk.exe
  C:\Windows\System\DpeyGnk.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\ZWZRFSI.exe
  C:\Windows\System\ZWZRFSI.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\jSfQadM.exe
  C:\Windows\System\jSfQadM.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\vCfvols.exe
  C:\Windows\System\vCfvols.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\HTErAUb.exe
  C:\Windows\System\HTErAUb.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\ZCqguRr.exe
  C:\Windows\System\ZCqguRr.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\MaYddeG.exe
  C:\Windows\System\MaYddeG.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\ZleWZGC.exe
  C:\Windows\System\ZleWZGC.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\eNtbcJx.exe
  C:\Windows\System\eNtbcJx.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\THTGqjI.exe
  C:\Windows\System\THTGqjI.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\xYsqSYO.exe
  C:\Windows\System\xYsqSYO.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\LuQpjVK.exe
  C:\Windows\System\LuQpjVK.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\KGxpnZc.exe
  C:\Windows\System\KGxpnZc.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\iPhSFls.exe
  C:\Windows\System\iPhSFls.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\OkXGiuH.exe
  C:\Windows\System\OkXGiuH.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\wYwKTEi.exe
  C:\Windows\System\wYwKTEi.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\MbxEYOX.exe
  C:\Windows\System\MbxEYOX.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\uSrNcgK.exe
  C:\Windows\System\uSrNcgK.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\eKtlfwY.exe
  C:\Windows\System\eKtlfwY.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\ifngQvk.exe
  C:\Windows\System\ifngQvk.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\ePmnUNl.exe
  C:\Windows\System\ePmnUNl.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\mpRSXet.exe
  C:\Windows\System\mpRSXet.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\dJLJmnb.exe
  C:\Windows\System\dJLJmnb.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\yOatYii.exe
  C:\Windows\System\yOatYii.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\XvNZLJG.exe
  C:\Windows\System\XvNZLJG.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\OfwWslO.exe
  C:\Windows\System\OfwWslO.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\gjKbCzu.exe
  C:\Windows\System\gjKbCzu.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\YwnBWyf.exe
  C:\Windows\System\YwnBWyf.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\KsETLMp.exe
  C:\Windows\System\KsETLMp.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\WQRhRrW.exe
  C:\Windows\System\WQRhRrW.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\RPHoxoB.exe
  C:\Windows\System\RPHoxoB.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\BMQhfoo.exe
  C:\Windows\System\BMQhfoo.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\UgNpUCo.exe
  C:\Windows\System\UgNpUCo.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\atZbBzD.exe
  C:\Windows\System\atZbBzD.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\wtsROmz.exe
  C:\Windows\System\wtsROmz.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\ixdaybt.exe
  C:\Windows\System\ixdaybt.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\pjxKgEc.exe
  C:\Windows\System\pjxKgEc.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\HxaeLiG.exe
  C:\Windows\System\HxaeLiG.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\khjgzPl.exe
  C:\Windows\System\khjgzPl.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\XfcnQud.exe
  C:\Windows\System\XfcnQud.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\SNykiGc.exe
  C:\Windows\System\SNykiGc.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\UehMrEw.exe
  C:\Windows\System\UehMrEw.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\kWChIol.exe
  C:\Windows\System\kWChIol.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\xLvQUVh.exe
  C:\Windows\System\xLvQUVh.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\zQUgltJ.exe
  C:\Windows\System\zQUgltJ.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\ZdFIkKb.exe
  C:\Windows\System\ZdFIkKb.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\CuuUxfG.exe
  C:\Windows\System\CuuUxfG.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\OkiaYpc.exe
  C:\Windows\System\OkiaYpc.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\enQenSq.exe
  C:\Windows\System\enQenSq.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\KXxecJX.exe
  C:\Windows\System\KXxecJX.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\ModWZVQ.exe
  C:\Windows\System\ModWZVQ.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\POnDvIt.exe
  C:\Windows\System\POnDvIt.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\qOnsjwv.exe
  C:\Windows\System\qOnsjwv.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\WsIKZFK.exe
  C:\Windows\System\WsIKZFK.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\TrnImnN.exe
  C:\Windows\System\TrnImnN.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\VQKWgSS.exe
  C:\Windows\System\VQKWgSS.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\nBhVEPC.exe
  C:\Windows\System\nBhVEPC.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\ogKSuyN.exe
  C:\Windows\System\ogKSuyN.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\hiFFzhL.exe
  C:\Windows\System\hiFFzhL.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\kULDGrd.exe
  C:\Windows\System\kULDGrd.exe
  2⤵
  PID:2868
- C:\Windows\System\hwrcXZs.exe
  C:\Windows\System\hwrcXZs.exe
  2⤵
  PID:2988
- C:\Windows\System\mqoKxAp.exe
  C:\Windows\System\mqoKxAp.exe
  2⤵
  PID:3412
- C:\Windows\System\fXOMZZv.exe
  C:\Windows\System\fXOMZZv.exe
  2⤵
  PID:3088
- C:\Windows\System\DhQZlNG.exe
  C:\Windows\System\DhQZlNG.exe
  2⤵
  PID:3440
- C:\Windows\System\ESCqZMS.exe
  C:\Windows\System\ESCqZMS.exe
  2⤵
  PID:908
- C:\Windows\System\RnJSYox.exe
  C:\Windows\System\RnJSYox.exe
  2⤵
  PID:1324
- C:\Windows\System\tjzcpbP.exe
  C:\Windows\System\tjzcpbP.exe
  2⤵
  PID:1292
- C:\Windows\System\ZcvSxbL.exe
  C:\Windows\System\ZcvSxbL.exe
  2⤵
  PID:2352
- C:\Windows\System\fCjGiKt.exe
  C:\Windows\System\fCjGiKt.exe
  2⤵
  PID:1308
- C:\Windows\System\INjLyav.exe
  C:\Windows\System\INjLyav.exe
  2⤵
  PID:5072
- C:\Windows\System\aDsbcae.exe
  C:\Windows\System\aDsbcae.exe
  2⤵
  PID:3764
- C:\Windows\System\JGtYSyU.exe
  C:\Windows\System\JGtYSyU.exe
  2⤵
  PID:2452
- C:\Windows\System\KmOkkWv.exe
  C:\Windows\System\KmOkkWv.exe
  2⤵
  PID:3460
- C:\Windows\System\eLLStII.exe
  C:\Windows\System\eLLStII.exe
  2⤵
  PID:1532
- C:\Windows\System\MfwtmYo.exe
  C:\Windows\System\MfwtmYo.exe
  2⤵
  PID:2068
- C:\Windows\System\cKZOzFE.exe
  C:\Windows\System\cKZOzFE.exe
  2⤵
  PID:5044
- C:\Windows\System\GzkaIIv.exe
  C:\Windows\System\GzkaIIv.exe
  2⤵
  PID:3720
- C:\Windows\System\dHdzhhe.exe
  C:\Windows\System\dHdzhhe.exe
  2⤵
  PID:3556
- C:\Windows\System\AFBFoba.exe
  C:\Windows\System\AFBFoba.exe
  2⤵
  PID:2428
- C:\Windows\System\BETHGun.exe
  C:\Windows\System\BETHGun.exe
  2⤵
  PID:3284
- C:\Windows\System\MgHwziF.exe
  C:\Windows\System\MgHwziF.exe
  2⤵
  PID:4176
- C:\Windows\System\bEHuFZo.exe
  C:\Windows\System\bEHuFZo.exe
  2⤵
  PID:4484
- C:\Windows\System\dpwiHbX.exe
  C:\Windows\System\dpwiHbX.exe
  2⤵
  PID:3132
- C:\Windows\System\pjAviBk.exe
  C:\Windows\System\pjAviBk.exe
  2⤵
  PID:1476
- C:\Windows\System\wqGQgab.exe
  C:\Windows\System\wqGQgab.exe
  2⤵
  PID:3108
- C:\Windows\System\OBSswde.exe
  C:\Windows\System\OBSswde.exe
  2⤵
  PID:1116
- C:\Windows\System\guDzuDT.exe
  C:\Windows\System\guDzuDT.exe
  2⤵
  PID:2544
- C:\Windows\System\CqIkWgH.exe
  C:\Windows\System\CqIkWgH.exe
  2⤵
  PID:2384
- C:\Windows\System\tOeyset.exe
  C:\Windows\System\tOeyset.exe
  2⤵
  PID:392
- C:\Windows\System\torsDFa.exe
  C:\Windows\System\torsDFa.exe
  2⤵
  PID:1692
- C:\Windows\System\KINiOzT.exe
  C:\Windows\System\KINiOzT.exe
  2⤵
  PID:3716
- C:\Windows\System\Pntetrv.exe
  C:\Windows\System\Pntetrv.exe
  2⤵
  PID:4036
- C:\Windows\System\QCAsjfq.exe
  C:\Windows\System\QCAsjfq.exe
  2⤵
  PID:368
- C:\Windows\System\dytDOBw.exe
  C:\Windows\System\dytDOBw.exe
  2⤵
  PID:2004
- C:\Windows\System\nNolMMw.exe
  C:\Windows\System\nNolMMw.exe
  2⤵
  PID:388
- C:\Windows\System\UHVgBce.exe
  C:\Windows\System\UHVgBce.exe
  2⤵
  PID:1832
- C:\Windows\System\fvFlWHg.exe
  C:\Windows\System\fvFlWHg.exe
  2⤵
  PID:3140
- C:\Windows\System\qzjtOSw.exe
  C:\Windows\System\qzjtOSw.exe
  2⤵
  PID:4060
- C:\Windows\System\VZqJpZJ.exe
  C:\Windows\System\VZqJpZJ.exe
  2⤵
  PID:1288
- C:\Windows\System\IXsGYPQ.exe
  C:\Windows\System\IXsGYPQ.exe
  2⤵
  PID:3332
- C:\Windows\System\KwkjYli.exe
  C:\Windows\System\KwkjYli.exe
  2⤵
  PID:2980
- C:\Windows\System\jCRzthe.exe
  C:\Windows\System\jCRzthe.exe
  2⤵
  PID:4372
- C:\Windows\System\WmSryxA.exe
  C:\Windows\System\WmSryxA.exe
  2⤵
  PID:988
- C:\Windows\System\yQUhRPV.exe
  C:\Windows\System\yQUhRPV.exe
  2⤵
  PID:4608
- C:\Windows\System\inhOmZN.exe
  C:\Windows\System\inhOmZN.exe
  2⤵
  PID:632
- C:\Windows\System\sqlLwIx.exe
  C:\Windows\System\sqlLwIx.exe
  2⤵
  PID:3268
- C:\Windows\System\QrWqqSb.exe
  C:\Windows\System\QrWqqSb.exe
  2⤵
  PID:4172
- C:\Windows\System\Uawszpg.exe
  C:\Windows\System\Uawszpg.exe
  2⤵
  PID:5144
- C:\Windows\System\KBgeeRu.exe
  C:\Windows\System\KBgeeRu.exe
  2⤵
  PID:5172
- C:\Windows\System\LACVQDf.exe
  C:\Windows\System\LACVQDf.exe
  2⤵
  PID:5204
- C:\Windows\System\yWkFyvn.exe
  C:\Windows\System\yWkFyvn.exe
  2⤵
  PID:5232
- C:\Windows\System\ZNBBNBN.exe
  C:\Windows\System\ZNBBNBN.exe
  2⤵
  PID:5284
- C:\Windows\System\wSvNShV.exe
  C:\Windows\System\wSvNShV.exe
  2⤵
  PID:5300
- C:\Windows\System\vJUwGop.exe
  C:\Windows\System\vJUwGop.exe
  2⤵
  PID:5328
- C:\Windows\System\pLeuhta.exe
  C:\Windows\System\pLeuhta.exe
  2⤵
  PID:5356
- C:\Windows\System\COafuYJ.exe
  C:\Windows\System\COafuYJ.exe
  2⤵
  PID:5384
- C:\Windows\System\cnWLskK.exe
  C:\Windows\System\cnWLskK.exe
  2⤵
  PID:5412
- C:\Windows\System\rssyxSH.exe
  C:\Windows\System\rssyxSH.exe
  2⤵
  PID:5432
- C:\Windows\System\WqKDTtF.exe
  C:\Windows\System\WqKDTtF.exe
  2⤵
  PID:5456
- C:\Windows\System\gIdNiAi.exe
  C:\Windows\System\gIdNiAi.exe
  2⤵
  PID:5484
- C:\Windows\System\sJwiiOc.exe
  C:\Windows\System\sJwiiOc.exe
  2⤵
  PID:5512
- C:\Windows\System\ojSgQVF.exe
  C:\Windows\System\ojSgQVF.exe
  2⤵
  PID:5540
- C:\Windows\System\AonyosZ.exe
  C:\Windows\System\AonyosZ.exe
  2⤵
  PID:5568
- C:\Windows\System\BVOHTIj.exe
  C:\Windows\System\BVOHTIj.exe
  2⤵
  PID:5600
- C:\Windows\System\aNUwjdU.exe
  C:\Windows\System\aNUwjdU.exe
  2⤵
  PID:5624
- C:\Windows\System\QcxsiaV.exe
  C:\Windows\System\QcxsiaV.exe
  2⤵
  PID:5644
- C:\Windows\System\rPLYvws.exe
  C:\Windows\System\rPLYvws.exe
  2⤵
  PID:5688
- C:\Windows\System\LugSELd.exe
  C:\Windows\System\LugSELd.exe
  2⤵
  PID:5724
- C:\Windows\System\VYCJOID.exe
  C:\Windows\System\VYCJOID.exe
  2⤵
  PID:5740
- C:\Windows\System\VVmxmNJ.exe
  C:\Windows\System\VVmxmNJ.exe
  2⤵
  PID:5772
- C:\Windows\System\pOJbUqv.exe
  C:\Windows\System\pOJbUqv.exe
  2⤵
  PID:5800
- C:\Windows\System\fHgYrVF.exe
  C:\Windows\System\fHgYrVF.exe
  2⤵
  PID:5828
- C:\Windows\System\FJEFPGf.exe
  C:\Windows\System\FJEFPGf.exe
  2⤵
  PID:5864
- C:\Windows\System\lUtzWoX.exe
  C:\Windows\System\lUtzWoX.exe
  2⤵
  PID:5888
- C:\Windows\System\IgRUQKM.exe
  C:\Windows\System\IgRUQKM.exe
  2⤵
  PID:5916
- C:\Windows\System\GrJaDwB.exe
  C:\Windows\System\GrJaDwB.exe
  2⤵
  PID:5948
- C:\Windows\System\nhoutzb.exe
  C:\Windows\System\nhoutzb.exe
  2⤵
  PID:5972
- C:\Windows\System\MNEoxAD.exe
  C:\Windows\System\MNEoxAD.exe
  2⤵
  PID:6000
- C:\Windows\System\cFTgSZX.exe
  C:\Windows\System\cFTgSZX.exe
  2⤵
  PID:6028
- C:\Windows\System\BIHhhoV.exe
  C:\Windows\System\BIHhhoV.exe
  2⤵
  PID:6048
- C:\Windows\System\rDgrZhq.exe
  C:\Windows\System\rDgrZhq.exe
  2⤵
  PID:6076
- C:\Windows\System\eenUlfR.exe
  C:\Windows\System\eenUlfR.exe
  2⤵
  PID:6108
- C:\Windows\System\esnRMns.exe
  C:\Windows\System\esnRMns.exe
  2⤵
  PID:5128
- C:\Windows\System\oGKgRFg.exe
  C:\Windows\System\oGKgRFg.exe
  2⤵
  PID:5192
- C:\Windows\System\JifRtFS.exe
  C:\Windows\System\JifRtFS.exe
  2⤵
  PID:5296
- C:\Windows\System\HLoIgGB.exe
  C:\Windows\System\HLoIgGB.exe
  2⤵
  PID:5340
- C:\Windows\System\hTTKKUc.exe
  C:\Windows\System\hTTKKUc.exe
  2⤵
  PID:5372
- C:\Windows\System\IHNsdTn.exe
  C:\Windows\System\IHNsdTn.exe
  2⤵
  PID:5452
- C:\Windows\System\PcEZPAj.exe
  C:\Windows\System\PcEZPAj.exe
  2⤵
  PID:5528
- C:\Windows\System\cjypCds.exe
  C:\Windows\System\cjypCds.exe
  2⤵
  PID:5592
- C:\Windows\System\TpQjfOf.exe
  C:\Windows\System\TpQjfOf.exe
  2⤵
  PID:5636
- C:\Windows\System\ISgbMzR.exe
  C:\Windows\System\ISgbMzR.exe
  2⤵
  PID:5700
- C:\Windows\System\CKMseye.exe
  C:\Windows\System\CKMseye.exe
  2⤵
  PID:5788
- C:\Windows\System\bGjlIPU.exe
  C:\Windows\System\bGjlIPU.exe
  2⤵
  PID:5884
- C:\Windows\System\iEGKqUV.exe
  C:\Windows\System\iEGKqUV.exe
  2⤵
  PID:5956
- C:\Windows\System\qHoSNbJ.exe
  C:\Windows\System\qHoSNbJ.exe
  2⤵
  PID:5992
- C:\Windows\System\zTeMrHw.exe
  C:\Windows\System\zTeMrHw.exe
  2⤵
  PID:6012
- C:\Windows\System\GgHtakC.exe
  C:\Windows\System\GgHtakC.exe
  2⤵
  PID:5156
- C:\Windows\System\JUpMoey.exe
  C:\Windows\System\JUpMoey.exe
  2⤵
  PID:6124
- C:\Windows\System\xNMjGdB.exe
  C:\Windows\System\xNMjGdB.exe
  2⤵
  PID:5368
- C:\Windows\System\RQNvqTm.exe
  C:\Windows\System\RQNvqTm.exe
  2⤵
  PID:5448
- C:\Windows\System\dZmJwsD.exe
  C:\Windows\System\dZmJwsD.exe
  2⤵
  PID:5616
- C:\Windows\System\Pgawctn.exe
  C:\Windows\System\Pgawctn.exe
  2⤵
  PID:5824
- C:\Windows\System\KXnEnOB.exe
  C:\Windows\System\KXnEnOB.exe
  2⤵
  PID:5840
- C:\Windows\System\gpELTQV.exe
  C:\Windows\System\gpELTQV.exe
  2⤵
  PID:6100
- C:\Windows\System\kCblWmf.exe
  C:\Windows\System\kCblWmf.exe
  2⤵
  PID:5400
- C:\Windows\System\EYRRXTW.exe
  C:\Windows\System\EYRRXTW.exe
  2⤵
  PID:5960
- C:\Windows\System\yIezWBB.exe
  C:\Windows\System\yIezWBB.exe
  2⤵
  PID:6136
- C:\Windows\System\bDtWgvV.exe
  C:\Windows\System\bDtWgvV.exe
  2⤵
  PID:5476
- C:\Windows\System\oSeMTgR.exe
  C:\Windows\System\oSeMTgR.exe
  2⤵
  PID:6156
- C:\Windows\System\VrsgPSy.exe
  C:\Windows\System\VrsgPSy.exe
  2⤵
  PID:6172
- C:\Windows\System\vjOyEXK.exe
  C:\Windows\System\vjOyEXK.exe
  2⤵
  PID:6200
- C:\Windows\System\ZRNrzbM.exe
  C:\Windows\System\ZRNrzbM.exe
  2⤵
  PID:6236
- C:\Windows\System\qruasFk.exe
  C:\Windows\System\qruasFk.exe
  2⤵
  PID:6276
- C:\Windows\System\OPaxISj.exe
  C:\Windows\System\OPaxISj.exe
  2⤵
  PID:6296
- C:\Windows\System\FebAaXT.exe
  C:\Windows\System\FebAaXT.exe
  2⤵
  PID:6324
- C:\Windows\System\zvDZqQX.exe
  C:\Windows\System\zvDZqQX.exe
  2⤵
  PID:6356
- C:\Windows\System\rVzoiCV.exe
  C:\Windows\System\rVzoiCV.exe
  2⤵
  PID:6380
- C:\Windows\System\AduPYCR.exe
  C:\Windows\System\AduPYCR.exe
  2⤵
  PID:6412
- C:\Windows\System\gLhBjuq.exe
  C:\Windows\System\gLhBjuq.exe
  2⤵
  PID:6440
- C:\Windows\System\oDYWBsW.exe
  C:\Windows\System\oDYWBsW.exe
  2⤵
  PID:6484
- C:\Windows\System\qEDaAhd.exe
  C:\Windows\System\qEDaAhd.exe
  2⤵
  PID:6516
- C:\Windows\System\QdOhdaM.exe
  C:\Windows\System\QdOhdaM.exe
  2⤵
  PID:6548
- C:\Windows\System\ZDnAAAS.exe
  C:\Windows\System\ZDnAAAS.exe
  2⤵
  PID:6584
- C:\Windows\System\RFICBzd.exe
  C:\Windows\System\RFICBzd.exe
  2⤵
  PID:6604
- C:\Windows\System\UEukbPV.exe
  C:\Windows\System\UEukbPV.exe
  2⤵
  PID:6636
- C:\Windows\System\lCnkuUX.exe
  C:\Windows\System\lCnkuUX.exe
  2⤵
  PID:6660
- C:\Windows\System\eAxeCXf.exe
  C:\Windows\System\eAxeCXf.exe
  2⤵
  PID:6688
- C:\Windows\System\UiglzFY.exe
  C:\Windows\System\UiglzFY.exe
  2⤵
  PID:6704
- C:\Windows\System\wxwWalC.exe
  C:\Windows\System\wxwWalC.exe
  2⤵
  PID:6736
- C:\Windows\System\acVmSaL.exe
  C:\Windows\System\acVmSaL.exe
  2⤵
  PID:6772
- C:\Windows\System\taqPDro.exe
  C:\Windows\System\taqPDro.exe
  2⤵
  PID:6804
- C:\Windows\System\JDrSJfj.exe
  C:\Windows\System\JDrSJfj.exe
  2⤵
  PID:6836
- C:\Windows\System\AUTmklg.exe
  C:\Windows\System\AUTmklg.exe
  2⤵
  PID:6852
- C:\Windows\System\jBSTSio.exe
  C:\Windows\System\jBSTSio.exe
  2⤵
  PID:6872
- C:\Windows\System\BzmTvdx.exe
  C:\Windows\System\BzmTvdx.exe
  2⤵
  PID:6900
- C:\Windows\System\MnIbYnm.exe
  C:\Windows\System\MnIbYnm.exe
  2⤵
  PID:6940
- C:\Windows\System\PBrfVjF.exe
  C:\Windows\System\PBrfVjF.exe
  2⤵
  PID:6972
- C:\Windows\System\GvPmhYW.exe
  C:\Windows\System\GvPmhYW.exe
  2⤵
  PID:6996
- C:\Windows\System\dSVokic.exe
  C:\Windows\System\dSVokic.exe
  2⤵
  PID:7032
- C:\Windows\System\eZOXXaK.exe
  C:\Windows\System\eZOXXaK.exe
  2⤵
  PID:7052
- C:\Windows\System\WMNUrzE.exe
  C:\Windows\System\WMNUrzE.exe
  2⤵
  PID:7072
- C:\Windows\System\GPIIxbS.exe
  C:\Windows\System\GPIIxbS.exe
  2⤵
  PID:7108
- C:\Windows\System\ezKuwbx.exe
  C:\Windows\System\ezKuwbx.exe
  2⤵
  PID:7140
- C:\Windows\System\BqbJOzz.exe
  C:\Windows\System\BqbJOzz.exe
  2⤵
  PID:7156
- C:\Windows\System\ArhZcNw.exe
  C:\Windows\System\ArhZcNw.exe
  2⤵
  PID:6168
- C:\Windows\System\jbmYuGN.exe
  C:\Windows\System\jbmYuGN.exe
  2⤵
  PID:6244
- C:\Windows\System\JobBkRr.exe
  C:\Windows\System\JobBkRr.exe
  2⤵
  PID:6336
- C:\Windows\System\xBTkozJ.exe
  C:\Windows\System\xBTkozJ.exe
  2⤵
  PID:6372
- C:\Windows\System\rElBwBI.exe
  C:\Windows\System\rElBwBI.exe
  2⤵
  PID:6452
- C:\Windows\System\TZLrWFB.exe
  C:\Windows\System\TZLrWFB.exe
  2⤵
  PID:6504
- C:\Windows\System\yFXLLXY.exe
  C:\Windows\System\yFXLLXY.exe
  2⤵
  PID:6564
- C:\Windows\System\UaxpGDr.exe
  C:\Windows\System\UaxpGDr.exe
  2⤵
  PID:6628
- C:\Windows\System\sUAjvjW.exe
  C:\Windows\System\sUAjvjW.exe
  2⤵
  PID:6680
- C:\Windows\System\mZOZSdF.exe
  C:\Windows\System\mZOZSdF.exe
  2⤵
  PID:6752
- C:\Windows\System\LEDyCTg.exe
  C:\Windows\System\LEDyCTg.exe
  2⤵
  PID:6812
- C:\Windows\System\PHKQepa.exe
  C:\Windows\System\PHKQepa.exe
  2⤵
  PID:6864
- C:\Windows\System\RxDkCVd.exe
  C:\Windows\System\RxDkCVd.exe
  2⤵
  PID:6980
- C:\Windows\System\rQuRFbj.exe
  C:\Windows\System\rQuRFbj.exe
  2⤵
  PID:7040
- C:\Windows\System\ZEIXHWT.exe
  C:\Windows\System\ZEIXHWT.exe
  2⤵
  PID:7080
- C:\Windows\System\IfbJyoP.exe
  C:\Windows\System\IfbJyoP.exe
  2⤵
  PID:6148
- C:\Windows\System\tlkHyfR.exe
  C:\Windows\System\tlkHyfR.exe
  2⤵
  PID:6164
- C:\Windows\System\SrDVWAX.exe
  C:\Windows\System\SrDVWAX.exe
  2⤵
  PID:6320
- C:\Windows\System\LrGyrMp.exe
  C:\Windows\System\LrGyrMp.exe
  2⤵
  PID:6596
- C:\Windows\System\flTLIRv.exe
  C:\Windows\System\flTLIRv.exe
  2⤵
  PID:6652
- C:\Windows\System\IZBbTWx.exe
  C:\Windows\System\IZBbTWx.exe
  2⤵
  PID:6860
- C:\Windows\System\UuAUmpm.exe
  C:\Windows\System\UuAUmpm.exe
  2⤵
  PID:7068
- C:\Windows\System\LsTdYkR.exe
  C:\Windows\System\LsTdYkR.exe
  2⤵
  PID:6268
- C:\Windows\System\YIAgOXU.exe
  C:\Windows\System\YIAgOXU.exe
  2⤵
  PID:6308
- C:\Windows\System\EhYDnzA.exe
  C:\Windows\System\EhYDnzA.exe
  2⤵
  PID:6848
- C:\Windows\System\FXNkiLv.exe
  C:\Windows\System\FXNkiLv.exe
  2⤵
  PID:6480
- C:\Windows\System\fjPJykS.exe
  C:\Windows\System\fjPJykS.exe
  2⤵
  PID:6928
- C:\Windows\System\CDKwbUf.exe
  C:\Windows\System\CDKwbUf.exe
  2⤵
  PID:7180
- C:\Windows\System\wUMgsff.exe
  C:\Windows\System\wUMgsff.exe
  2⤵
  PID:7212
- C:\Windows\System\cGVtQim.exe
  C:\Windows\System\cGVtQim.exe
  2⤵
  PID:7236
- C:\Windows\System\ZgtmiVL.exe
  C:\Windows\System\ZgtmiVL.exe
  2⤵
  PID:7272
- C:\Windows\System\XEudDpP.exe
  C:\Windows\System\XEudDpP.exe
  2⤵
  PID:7296
- C:\Windows\System\zEwfXEp.exe
  C:\Windows\System\zEwfXEp.exe
  2⤵
  PID:7324
- C:\Windows\System\lpWexNZ.exe
  C:\Windows\System\lpWexNZ.exe
  2⤵
  PID:7356
- C:\Windows\System\etjwPNS.exe
  C:\Windows\System\etjwPNS.exe
  2⤵
  PID:7380
- C:\Windows\System\oNbDgyU.exe
  C:\Windows\System\oNbDgyU.exe
  2⤵
  PID:7412
- C:\Windows\System\HiCRPTD.exe
  C:\Windows\System\HiCRPTD.exe
  2⤵
  PID:7428
- C:\Windows\System\ZSQDvoM.exe
  C:\Windows\System\ZSQDvoM.exe
  2⤵
  PID:7448
- C:\Windows\System\qpCVJAv.exe
  C:\Windows\System\qpCVJAv.exe
  2⤵
  PID:7468
- C:\Windows\System\tGAAeWD.exe
  C:\Windows\System\tGAAeWD.exe
  2⤵
  PID:7504
- C:\Windows\System\fnZWrtA.exe
  C:\Windows\System\fnZWrtA.exe
  2⤵
  PID:7524
- C:\Windows\System\rhSslqt.exe
  C:\Windows\System\rhSslqt.exe
  2⤵
  PID:7540
- C:\Windows\System\PVszVYr.exe
  C:\Windows\System\PVszVYr.exe
  2⤵
  PID:7564
- C:\Windows\System\OzRfmoU.exe
  C:\Windows\System\OzRfmoU.exe
  2⤵
  PID:7600
- C:\Windows\System\AOzNMNL.exe
  C:\Windows\System\AOzNMNL.exe
  2⤵
  PID:7636
- C:\Windows\System\nyvNyBl.exe
  C:\Windows\System\nyvNyBl.exe
  2⤵
  PID:7668
- C:\Windows\System\mjhuLWJ.exe
  C:\Windows\System\mjhuLWJ.exe
  2⤵
  PID:7688
- C:\Windows\System\EeWdWbF.exe
  C:\Windows\System\EeWdWbF.exe
  2⤵
  PID:7716
- C:\Windows\System\NhSUuKE.exe
  C:\Windows\System\NhSUuKE.exe
  2⤵
  PID:7752
- C:\Windows\System\RuPGufB.exe
  C:\Windows\System\RuPGufB.exe
  2⤵
  PID:7772
- C:\Windows\System\kNLUxUn.exe
  C:\Windows\System\kNLUxUn.exe
  2⤵
  PID:7808
- C:\Windows\System\tbctVed.exe
  C:\Windows\System\tbctVed.exe
  2⤵
  PID:7844
- C:\Windows\System\zUoRpkF.exe
  C:\Windows\System\zUoRpkF.exe
  2⤵
  PID:7872
- C:\Windows\System\SjSHobl.exe
  C:\Windows\System\SjSHobl.exe
  2⤵
  PID:7904
- C:\Windows\System\mxktVFU.exe
  C:\Windows\System\mxktVFU.exe
  2⤵
  PID:7928
- C:\Windows\System\dIXioda.exe
  C:\Windows\System\dIXioda.exe
  2⤵
  PID:7960
- C:\Windows\System\DaXisPC.exe
  C:\Windows\System\DaXisPC.exe
  2⤵
  PID:7992
- C:\Windows\System\bWFrMCB.exe
  C:\Windows\System\bWFrMCB.exe
  2⤵
  PID:8020
- C:\Windows\System\VtXKIab.exe
  C:\Windows\System\VtXKIab.exe
  2⤵
  PID:8048
- C:\Windows\System\GFVmsJY.exe
  C:\Windows\System\GFVmsJY.exe
  2⤵
  PID:8088
- C:\Windows\System\XBXDmaE.exe
  C:\Windows\System\XBXDmaE.exe
  2⤵
  PID:8104
- C:\Windows\System\iDELIzx.exe
  C:\Windows\System\iDELIzx.exe
  2⤵
  PID:8132
- C:\Windows\System\SWdhdcv.exe
  C:\Windows\System\SWdhdcv.exe
  2⤵
  PID:8152
- C:\Windows\System\ahJbORY.exe
  C:\Windows\System\ahJbORY.exe
  2⤵
  PID:8188
- C:\Windows\System\wssafJj.exe
  C:\Windows\System\wssafJj.exe
  2⤵
  PID:7192
- C:\Windows\System\cYeFJAt.exe
  C:\Windows\System\cYeFJAt.exe
  2⤵
  PID:7284
- C:\Windows\System\khnnbWe.exe
  C:\Windows\System\khnnbWe.exe
  2⤵
  PID:7364
- C:\Windows\System\JlLGxAT.exe
  C:\Windows\System\JlLGxAT.exe
  2⤵
  PID:7396
- C:\Windows\System\TJXIaMu.exe
  C:\Windows\System\TJXIaMu.exe
  2⤵
  PID:7476
- C:\Windows\System\ndPsdwu.exe
  C:\Windows\System\ndPsdwu.exe
  2⤵
  PID:7576
- C:\Windows\System\UXFcyHU.exe
  C:\Windows\System\UXFcyHU.exe
  2⤵
  PID:7556
- C:\Windows\System\KuszAEM.exe
  C:\Windows\System\KuszAEM.exe
  2⤵
  PID:7700
- C:\Windows\System\dZBlDRd.exe
  C:\Windows\System\dZBlDRd.exe
  2⤵
  PID:7732
- C:\Windows\System\YWVNHSV.exe
  C:\Windows\System\YWVNHSV.exe
  2⤵
  PID:7832
- C:\Windows\System\gChRvYT.exe
  C:\Windows\System\gChRvYT.exe
  2⤵
  PID:7836
- C:\Windows\System\DBNnUcw.exe
  C:\Windows\System\DBNnUcw.exe
  2⤵
  PID:7924
- C:\Windows\System\SKBBqqs.exe
  C:\Windows\System\SKBBqqs.exe
  2⤵
  PID:7976
- C:\Windows\System\KadBTOm.exe
  C:\Windows\System\KadBTOm.exe
  2⤵
  PID:8036
- C:\Windows\System\niczeQr.exe
  C:\Windows\System\niczeQr.exe
  2⤵
  PID:8044
- C:\Windows\System\zubWaSW.exe
  C:\Windows\System\zubWaSW.exe
  2⤵
  PID:8160
- C:\Windows\System\tkLFiEJ.exe
  C:\Windows\System\tkLFiEJ.exe
  2⤵
  PID:7196
- C:\Windows\System\HQalexm.exe
  C:\Windows\System\HQalexm.exe
  2⤵
  PID:7404
- C:\Windows\System\TsKyLzR.exe
  C:\Windows\System\TsKyLzR.exe
  2⤵
  PID:7516
- C:\Windows\System\tkMBvrq.exe
  C:\Windows\System\tkMBvrq.exe
  2⤵
  PID:7676
- C:\Windows\System\LCJIBvy.exe
  C:\Windows\System\LCJIBvy.exe
  2⤵
  PID:7892
- C:\Windows\System\OUZggbC.exe
  C:\Windows\System\OUZggbC.exe
  2⤵
  PID:8080
- C:\Windows\System\oecgSZX.exe
  C:\Windows\System\oecgSZX.exe
  2⤵
  PID:8180
- C:\Windows\System\eCqdQzw.exe
  C:\Windows\System\eCqdQzw.exe
  2⤵
  PID:7624
- C:\Windows\System\snUhHSr.exe
  C:\Windows\System\snUhHSr.exe
  2⤵
  PID:7792
- C:\Windows\System\TAmqaKK.exe
  C:\Windows\System\TAmqaKK.exe
  2⤵
  PID:8140
- C:\Windows\System\TpSrCQr.exe
  C:\Windows\System\TpSrCQr.exe
  2⤵
  PID:8200
- C:\Windows\System\ekTEsEw.exe
  C:\Windows\System\ekTEsEw.exe
  2⤵
  PID:8216
- C:\Windows\System\fvfdakV.exe
  C:\Windows\System\fvfdakV.exe
  2⤵
  PID:8236
- C:\Windows\System\kAAXAcC.exe
  C:\Windows\System\kAAXAcC.exe
  2⤵
  PID:8264
- C:\Windows\System\LONYWiH.exe
  C:\Windows\System\LONYWiH.exe
  2⤵
  PID:8296
- C:\Windows\System\CqRHDUO.exe
  C:\Windows\System\CqRHDUO.exe
  2⤵
  PID:8320
- C:\Windows\System\SMxIVsn.exe
  C:\Windows\System\SMxIVsn.exe
  2⤵
  PID:8356
- C:\Windows\System\IESinKO.exe
  C:\Windows\System\IESinKO.exe
  2⤵
  PID:8384
- C:\Windows\System\WYuvzZl.exe
  C:\Windows\System\WYuvzZl.exe
  2⤵
  PID:8412
- C:\Windows\System\qcQoLaX.exe
  C:\Windows\System\qcQoLaX.exe
  2⤵
  PID:8432
- C:\Windows\System\bcaNlUA.exe
  C:\Windows\System\bcaNlUA.exe
  2⤵
  PID:8456
- C:\Windows\System\YyxUmIg.exe
  C:\Windows\System\YyxUmIg.exe
  2⤵
  PID:8488
- C:\Windows\System\okmodKq.exe
  C:\Windows\System\okmodKq.exe
  2⤵
  PID:8528
- C:\Windows\System\xoDAiRU.exe
  C:\Windows\System\xoDAiRU.exe
  2⤵
  PID:8544
- C:\Windows\System\dpxytKX.exe
  C:\Windows\System\dpxytKX.exe
  2⤵
  PID:8572
- C:\Windows\System\xPftGNV.exe
  C:\Windows\System\xPftGNV.exe
  2⤵
  PID:8596
- C:\Windows\System\TqXiiiI.exe
  C:\Windows\System\TqXiiiI.exe
  2⤵
  PID:8628
- C:\Windows\System\CqyLxcm.exe
  C:\Windows\System\CqyLxcm.exe
  2⤵
  PID:8660
- C:\Windows\System\LZshPdk.exe
  C:\Windows\System\LZshPdk.exe
  2⤵
  PID:8676
- C:\Windows\System\naBbbzY.exe
  C:\Windows\System\naBbbzY.exe
  2⤵
  PID:8700
- C:\Windows\System\esRdhEC.exe
  C:\Windows\System\esRdhEC.exe
  2⤵
  PID:8728
- C:\Windows\System\ykPilVy.exe
  C:\Windows\System\ykPilVy.exe
  2⤵
  PID:8760
- C:\Windows\System\MRjCOjm.exe
  C:\Windows\System\MRjCOjm.exe
  2⤵
  PID:8788
- C:\Windows\System\oSiRpgN.exe
  C:\Windows\System\oSiRpgN.exe
  2⤵
  PID:8816
- C:\Windows\System\BbTuwaU.exe
  C:\Windows\System\BbTuwaU.exe
  2⤵
  PID:8852
- C:\Windows\System\YMPqTnm.exe
  C:\Windows\System\YMPqTnm.exe
  2⤵
  PID:8884
- C:\Windows\System\JKLrTuF.exe
  C:\Windows\System\JKLrTuF.exe
  2⤵
  PID:8904
- C:\Windows\System\jEFPaSU.exe
  C:\Windows\System\jEFPaSU.exe
  2⤵
  PID:8920
- C:\Windows\System\GjHZkEi.exe
  C:\Windows\System\GjHZkEi.exe
  2⤵
  PID:8952
- C:\Windows\System\UQZtwwO.exe
  C:\Windows\System\UQZtwwO.exe
  2⤵
  PID:8980
- C:\Windows\System\cayimxx.exe
  C:\Windows\System\cayimxx.exe
  2⤵
  PID:9020
- C:\Windows\System\oXgqxfA.exe
  C:\Windows\System\oXgqxfA.exe
  2⤵
  PID:9044
- C:\Windows\System\UvgcIrP.exe
  C:\Windows\System\UvgcIrP.exe
  2⤵
  PID:9080
- C:\Windows\System\dzokFOE.exe
  C:\Windows\System\dzokFOE.exe
  2⤵
  PID:9112
- C:\Windows\System\oSijHLy.exe
  C:\Windows\System\oSijHLy.exe
  2⤵
  PID:9140
- C:\Windows\System\HHfLirW.exe
  C:\Windows\System\HHfLirW.exe
  2⤵
  PID:9168
- C:\Windows\System\CnpWgRk.exe
  C:\Windows\System\CnpWgRk.exe
  2⤵
  PID:9204
- C:\Windows\System\oDKtuVh.exe
  C:\Windows\System\oDKtuVh.exe
  2⤵
  PID:8212
- C:\Windows\System\KwzIqxI.exe
  C:\Windows\System\KwzIqxI.exe
  2⤵
  PID:8224
- C:\Windows\System\xxqcmhz.exe
  C:\Windows\System\xxqcmhz.exe
  2⤵
  PID:8280
- C:\Windows\System\wVxsFlB.exe
  C:\Windows\System\wVxsFlB.exe
  2⤵
  PID:8344
- C:\Windows\System\YvNWnAg.exe
  C:\Windows\System\YvNWnAg.exe
  2⤵
  PID:8444
- C:\Windows\System\ioZFlSO.exe
  C:\Windows\System\ioZFlSO.exe
  2⤵
  PID:8536
- C:\Windows\System\oJFlrQV.exe
  C:\Windows\System\oJFlrQV.exe
  2⤵
  PID:8592
- C:\Windows\System\WrMAmZK.exe
  C:\Windows\System\WrMAmZK.exe
  2⤵
  PID:8648
- C:\Windows\System\qSjAqxO.exe
  C:\Windows\System\qSjAqxO.exe
  2⤵
  PID:8652
- C:\Windows\System\sRtHMNd.exe
  C:\Windows\System\sRtHMNd.exe
  2⤵
  PID:8748
- C:\Windows\System\OwwEJjw.exe
  C:\Windows\System\OwwEJjw.exe
  2⤵
  PID:8876
- C:\Windows\System\vGVEouD.exe
  C:\Windows\System\vGVEouD.exe
  2⤵
  PID:8872
- C:\Windows\System\TkVozVh.exe
  C:\Windows\System\TkVozVh.exe
  2⤵
  PID:9008
- C:\Windows\System\rniAvae.exe
  C:\Windows\System\rniAvae.exe
  2⤵
  PID:9072
- C:\Windows\System\DTGICDR.exe
  C:\Windows\System\DTGICDR.exe
  2⤵
  PID:9104
- C:\Windows\System\ANphvxx.exe
  C:\Windows\System\ANphvxx.exe
  2⤵
  PID:9180
- C:\Windows\System\DhNLUVK.exe
  C:\Windows\System\DhNLUVK.exe
  2⤵
  PID:8208
- C:\Windows\System\PrFfSay.exe
  C:\Windows\System\PrFfSay.exe
  2⤵
  PID:8308
- C:\Windows\System\MitKjdw.exe
  C:\Windows\System\MitKjdw.exe
  2⤵
  PID:8440
- C:\Windows\System\lMVhrMV.exe
  C:\Windows\System\lMVhrMV.exe
  2⤵
  PID:8636
- C:\Windows\System\GDDhLFg.exe
  C:\Windows\System\GDDhLFg.exe
  2⤵
  PID:8812
- C:\Windows\System\xsWKcOp.exe
  C:\Windows\System\xsWKcOp.exe
  2⤵
  PID:8968
- C:\Windows\System\iwxESyO.exe
  C:\Windows\System\iwxESyO.exe
  2⤵
  PID:9136
- C:\Windows\System\xFxkqeY.exe
  C:\Windows\System\xFxkqeY.exe
  2⤵
  PID:8252
- C:\Windows\System\lIDPOJY.exe
  C:\Windows\System\lIDPOJY.exe
  2⤵
  PID:8776
- C:\Windows\System\DdCTAil.exe
  C:\Windows\System\DdCTAil.exe
  2⤵
  PID:8912
- C:\Windows\System\LlrOzBU.exe
  C:\Windows\System\LlrOzBU.exe
  2⤵
  PID:9100
- C:\Windows\System\sTsliiR.exe
  C:\Windows\System\sTsliiR.exe
  2⤵
  PID:8644
- C:\Windows\System\VjoOjXc.exe
  C:\Windows\System\VjoOjXc.exe
  2⤵
  PID:9248
- C:\Windows\System\eySBmtg.exe
  C:\Windows\System\eySBmtg.exe
  2⤵
  PID:9276
- C:\Windows\System\utaYtni.exe
  C:\Windows\System\utaYtni.exe
  2⤵
  PID:9292
- C:\Windows\System\NWhUjCl.exe
  C:\Windows\System\NWhUjCl.exe
  2⤵
  PID:9312
- C:\Windows\System\bHPpjRe.exe
  C:\Windows\System\bHPpjRe.exe
  2⤵
  PID:9336
- C:\Windows\System\yQNxgxe.exe
  C:\Windows\System\yQNxgxe.exe
  2⤵
  PID:9372
- C:\Windows\System\iQyMeDV.exe
  C:\Windows\System\iQyMeDV.exe
  2⤵
  PID:9392
- C:\Windows\System\bdwPzKd.exe
  C:\Windows\System\bdwPzKd.exe
  2⤵
  PID:9424
- C:\Windows\System\jDuXpCx.exe
  C:\Windows\System\jDuXpCx.exe
  2⤵
  PID:9456
- C:\Windows\System\qcbjybc.exe
  C:\Windows\System\qcbjybc.exe
  2⤵
  PID:9488
- C:\Windows\System\AqcVgkU.exe
  C:\Windows\System\AqcVgkU.exe
  2⤵
  PID:9512
- C:\Windows\System\lxcsayk.exe
  C:\Windows\System\lxcsayk.exe
  2⤵
  PID:9544
- C:\Windows\System\BVQbaZl.exe
  C:\Windows\System\BVQbaZl.exe
  2⤵
  PID:9568
- C:\Windows\System\YLkqjkf.exe
  C:\Windows\System\YLkqjkf.exe
  2⤵
  PID:9604
- C:\Windows\System\auAFFkr.exe
  C:\Windows\System\auAFFkr.exe
  2⤵
  PID:9632
- C:\Windows\System\oiVJPVL.exe
  C:\Windows\System\oiVJPVL.exe
  2⤵
  PID:9660
- C:\Windows\System\uJUdBbC.exe
  C:\Windows\System\uJUdBbC.exe
  2⤵
  PID:9692
- C:\Windows\System\GpTPbRD.exe
  C:\Windows\System\GpTPbRD.exe
  2⤵
  PID:9724
- C:\Windows\System\JBZZrOM.exe
  C:\Windows\System\JBZZrOM.exe
  2⤵
  PID:9744
- C:\Windows\System\OeDyZNq.exe
  C:\Windows\System\OeDyZNq.exe
  2⤵
  PID:9768
- C:\Windows\System\BeqPQFg.exe
  C:\Windows\System\BeqPQFg.exe
  2⤵
  PID:9796
- C:\Windows\System\FTKZlad.exe
  C:\Windows\System\FTKZlad.exe
  2⤵
  PID:9816
- C:\Windows\System\OGmpRnU.exe
  C:\Windows\System\OGmpRnU.exe
  2⤵
  PID:9836
- C:\Windows\System\PhRzBtV.exe
  C:\Windows\System\PhRzBtV.exe
  2⤵
  PID:9868
- C:\Windows\System\zatCXgx.exe
  C:\Windows\System\zatCXgx.exe
  2⤵
  PID:9888
- C:\Windows\System\fMCOjfP.exe
  C:\Windows\System\fMCOjfP.exe
  2⤵
  PID:9924
- C:\Windows\System\VcKfTxC.exe
  C:\Windows\System\VcKfTxC.exe
  2⤵
  PID:9952
- C:\Windows\System\HvXzxOG.exe
  C:\Windows\System\HvXzxOG.exe
  2⤵
  PID:9972
- C:\Windows\System\EThJEoP.exe
  C:\Windows\System\EThJEoP.exe
  2⤵
  PID:10012
- C:\Windows\System\LxPzkfU.exe
  C:\Windows\System\LxPzkfU.exe
  2⤵
  PID:10044
- C:\Windows\System\ERXvUrl.exe
  C:\Windows\System\ERXvUrl.exe
  2⤵
  PID:10076
- C:\Windows\System\PIvejpD.exe
  C:\Windows\System\PIvejpD.exe
  2⤵
  PID:10092
- C:\Windows\System\InUnZfv.exe
  C:\Windows\System\InUnZfv.exe
  2⤵
  PID:10124
- C:\Windows\System\BIVCyPX.exe
  C:\Windows\System\BIVCyPX.exe
  2⤵
  PID:10152
- C:\Windows\System\CWUXstr.exe
  C:\Windows\System\CWUXstr.exe
  2⤵
  PID:10180
- C:\Windows\System\BNlCcoX.exe
  C:\Windows\System\BNlCcoX.exe
  2⤵
  PID:10212
- C:\Windows\System\fTBrdyg.exe
  C:\Windows\System\fTBrdyg.exe
  2⤵
  PID:10236
- C:\Windows\System\lYMNInR.exe
  C:\Windows\System\lYMNInR.exe
  2⤵
  PID:8424
- C:\Windows\System\lAHNEFE.exe
  C:\Windows\System\lAHNEFE.exe
  2⤵
  PID:9304
- C:\Windows\System\GsWWSsJ.exe
  C:\Windows\System\GsWWSsJ.exe
  2⤵
  PID:9344
- C:\Windows\System\PRfYXoj.exe
  C:\Windows\System\PRfYXoj.exe
  2⤵
  PID:9468
- C:\Windows\System\hkQgezu.exe
  C:\Windows\System\hkQgezu.exe
  2⤵
  PID:9552
- C:\Windows\System\DQKWpYr.exe
  C:\Windows\System\DQKWpYr.exe
  2⤵
  PID:9596
- C:\Windows\System\zsAxlDv.exe
  C:\Windows\System\zsAxlDv.exe
  2⤵
  PID:9680
- C:\Windows\System\bJLZszI.exe
  C:\Windows\System\bJLZszI.exe
  2⤵
  PID:9788
- C:\Windows\System\hjnRgZJ.exe
  C:\Windows\System\hjnRgZJ.exe
  2⤵
  PID:9824
- C:\Windows\System\bQLoFby.exe
  C:\Windows\System\bQLoFby.exe
  2⤵
  PID:9936
- C:\Windows\System\TCBEQtM.exe
  C:\Windows\System\TCBEQtM.exe
  2⤵
  PID:9908
- C:\Windows\System\bdxjgiZ.exe
  C:\Windows\System\bdxjgiZ.exe
  2⤵
  PID:10036
- C:\Windows\System\LadZOaf.exe
  C:\Windows\System\LadZOaf.exe
  2⤵
  PID:10088
- C:\Windows\System\hQaUfxh.exe
  C:\Windows\System\hQaUfxh.exe
  2⤵
  PID:10136
- C:\Windows\System\KNaByGC.exe
  C:\Windows\System\KNaByGC.exe
  2⤵
  PID:10164
- C:\Windows\System\NmyMvty.exe
  C:\Windows\System\NmyMvty.exe
  2⤵
  PID:10188
- C:\Windows\System\LBmalpn.exe
  C:\Windows\System\LBmalpn.exe
  2⤵
  PID:9444
- C:\Windows\System\MOlmeIk.exe
  C:\Windows\System\MOlmeIk.exe
  2⤵
  PID:9404
- C:\Windows\System\AirJrqP.exe
  C:\Windows\System\AirJrqP.exe
  2⤵
  PID:9576
- C:\Windows\System\LISLWZB.exe
  C:\Windows\System\LISLWZB.exe
  2⤵
  PID:9792
- C:\Windows\System\jfnDslb.exe
  C:\Windows\System\jfnDslb.exe
  2⤵
  PID:9996
- C:\Windows\System\noQknLf.exe
  C:\Windows\System\noQknLf.exe
  2⤵
  PID:10060
- C:\Windows\System\ZBDXElM.exe
  C:\Windows\System\ZBDXElM.exe
  2⤵
  PID:10232
- C:\Windows\System\eVGMHgC.exe
  C:\Windows\System\eVGMHgC.exe
  2⤵
  PID:9476
- C:\Windows\System\PCjRPfF.exe
  C:\Windows\System\PCjRPfF.exe
  2⤵
  PID:9688
- C:\Windows\System\IQFYjLY.exe
  C:\Windows\System\IQFYjLY.exe
  2⤵
  PID:10260
- C:\Windows\System\ObNopMw.exe
  C:\Windows\System\ObNopMw.exe
  2⤵
  PID:10284
- C:\Windows\System\brnuDuq.exe
  C:\Windows\System\brnuDuq.exe
  2⤵
  PID:10312
- C:\Windows\System\tjNyURn.exe
  C:\Windows\System\tjNyURn.exe
  2⤵
  PID:10340
- C:\Windows\System\uteaoTQ.exe
  C:\Windows\System\uteaoTQ.exe
  2⤵
  PID:10368
- C:\Windows\System\WqRLuyu.exe
  C:\Windows\System\WqRLuyu.exe
  2⤵
  PID:10400
- C:\Windows\System\djsDqWH.exe
  C:\Windows\System\djsDqWH.exe
  2⤵
  PID:10416
- C:\Windows\System\YTzLKAh.exe
  C:\Windows\System\YTzLKAh.exe
  2⤵
  PID:10440
- C:\Windows\System\IqPosHv.exe
  C:\Windows\System\IqPosHv.exe
  2⤵
  PID:10488
- C:\Windows\System\VugeXEi.exe
  C:\Windows\System\VugeXEi.exe
  2⤵
  PID:10520
- C:\Windows\System\spwYXVh.exe
  C:\Windows\System\spwYXVh.exe
  2⤵
  PID:10548
- C:\Windows\System\kstAkmf.exe
  C:\Windows\System\kstAkmf.exe
  2⤵
  PID:10576
- C:\Windows\System\FoGXGBt.exe
  C:\Windows\System\FoGXGBt.exe
  2⤵
  PID:10604
- C:\Windows\System\meGapVk.exe
  C:\Windows\System\meGapVk.exe
  2⤵
  PID:10624
- C:\Windows\System\EqwaxeM.exe
  C:\Windows\System\EqwaxeM.exe
  2⤵
  PID:10648
- C:\Windows\System\urVSlYk.exe
  C:\Windows\System\urVSlYk.exe
  2⤵
  PID:10676
- C:\Windows\System\QiKquFJ.exe
  C:\Windows\System\QiKquFJ.exe
  2⤵
  PID:10716
- C:\Windows\System\fOxdzYi.exe
  C:\Windows\System\fOxdzYi.exe
  2⤵
  PID:10732
- C:\Windows\System\eSLNTNV.exe
  C:\Windows\System\eSLNTNV.exe
  2⤵
  PID:10772
- C:\Windows\System\guVgREt.exe
  C:\Windows\System\guVgREt.exe
  2⤵
  PID:10800
- C:\Windows\System\crEbHGh.exe
  C:\Windows\System\crEbHGh.exe
  2⤵
  PID:10828
- C:\Windows\System\ZMkNPJB.exe
  C:\Windows\System\ZMkNPJB.exe
  2⤵
  PID:10844
- C:\Windows\System\hUYcuGn.exe
  C:\Windows\System\hUYcuGn.exe
  2⤵
  PID:10860
- C:\Windows\System\nNUvkRg.exe
  C:\Windows\System\nNUvkRg.exe
  2⤵
  PID:10884
- C:\Windows\System\EEuwuqi.exe
  C:\Windows\System\EEuwuqi.exe
  2⤵
  PID:10904
- C:\Windows\System\XxWhLFH.exe
  C:\Windows\System\XxWhLFH.exe
  2⤵
  PID:10940
- C:\Windows\System\OhNbcwE.exe
  C:\Windows\System\OhNbcwE.exe
  2⤵
  PID:10976
- C:\Windows\System\hgtAEIs.exe
  C:\Windows\System\hgtAEIs.exe
  2⤵
  PID:11004
- C:\Windows\System\afSjsGN.exe
  C:\Windows\System\afSjsGN.exe
  2⤵
  PID:11040
- C:\Windows\System\nAzXHXq.exe
  C:\Windows\System\nAzXHXq.exe
  2⤵
  PID:11060
- C:\Windows\System\hBHkgVh.exe
  C:\Windows\System\hBHkgVh.exe
  2⤵
  PID:11100
- C:\Windows\System\QPcrWTs.exe
  C:\Windows\System\QPcrWTs.exe
  2⤵
  PID:11128
- C:\Windows\System\ZIEqsrR.exe
  C:\Windows\System\ZIEqsrR.exe
  2⤵
  PID:11160
- C:\Windows\System\psFpuYo.exe
  C:\Windows\System\psFpuYo.exe
  2⤵
  PID:11196
- C:\Windows\System\ifJgubF.exe
  C:\Windows\System\ifJgubF.exe
  2⤵
  PID:11228
- C:\Windows\System\JkdqSLP.exe
  C:\Windows\System\JkdqSLP.exe
  2⤵
  PID:11244
- C:\Windows\System\GgcrCvo.exe
  C:\Windows\System\GgcrCvo.exe
  2⤵
  PID:9256
- C:\Windows\System\YsarCTR.exe
  C:\Windows\System\YsarCTR.exe
  2⤵
  PID:10256
- C:\Windows\System\FfzRNhH.exe
  C:\Windows\System\FfzRNhH.exe
  2⤵
  PID:10328
- C:\Windows\System\BSrPeqm.exe
  C:\Windows\System\BSrPeqm.exe
  2⤵
  PID:10408
- C:\Windows\System\NYcEAYL.exe
  C:\Windows\System\NYcEAYL.exe
  2⤵
  PID:10456
- C:\Windows\System\hKuUUBO.exe
  C:\Windows\System\hKuUUBO.exe
  2⤵
  PID:10512
- C:\Windows\System\ypJPxCo.exe
  C:\Windows\System\ypJPxCo.exe
  2⤵
  PID:10612
- C:\Windows\System\gVQlpUP.exe
  C:\Windows\System\gVQlpUP.exe
  2⤵
  PID:10660
- C:\Windows\System\rSJrfGT.exe
  C:\Windows\System\rSJrfGT.exe
  2⤵
  PID:10700
- C:\Windows\System\kqAccEH.exe
  C:\Windows\System\kqAccEH.exe
  2⤵
  PID:10784
- C:\Windows\System\qXTKpny.exe
  C:\Windows\System\qXTKpny.exe
  2⤵
  PID:10816
- C:\Windows\System\vtDonbC.exe
  C:\Windows\System\vtDonbC.exe
  2⤵
  PID:10852
- C:\Windows\System\sUsjDer.exe
  C:\Windows\System\sUsjDer.exe
  2⤵
  PID:11028
- C:\Windows\System\RdefUmN.exe
  C:\Windows\System\RdefUmN.exe
  2⤵
  PID:11056
- C:\Windows\System\KuWArFL.exe
  C:\Windows\System\KuWArFL.exe
  2⤵
  PID:11092
- C:\Windows\System\YGscDcm.exe
  C:\Windows\System\YGscDcm.exe
  2⤵
  PID:11180
- C:\Windows\System\RkRYlzC.exe
  C:\Windows\System\RkRYlzC.exe
  2⤵
  PID:11204
- C:\Windows\System\nfZHyNO.exe
  C:\Windows\System\nfZHyNO.exe
  2⤵
  PID:10244
- C:\Windows\System\JbJhtnP.exe
  C:\Windows\System\JbJhtnP.exe
  2⤵
  PID:10412
- C:\Windows\System\YuJcMex.exe
  C:\Windows\System\YuJcMex.exe
  2⤵
  PID:10304
- C:\Windows\System\PieTqWT.exe
  C:\Windows\System\PieTqWT.exe
  2⤵
  PID:10564
- C:\Windows\System\JxPMSoB.exe
  C:\Windows\System\JxPMSoB.exe
  2⤵
  PID:10744
- C:\Windows\System\sOOASIt.exe
  C:\Windows\System\sOOASIt.exe
  2⤵
  PID:10820
- C:\Windows\System\AvVqKzr.exe
  C:\Windows\System\AvVqKzr.exe
  2⤵
  PID:11016
- C:\Windows\System\CnRonkx.exe
  C:\Windows\System\CnRonkx.exe
  2⤵
  PID:10956
- C:\Windows\System\wqhAfke.exe
  C:\Windows\System\wqhAfke.exe
  2⤵
  PID:9940
- C:\Windows\System\xwEldIg.exe
  C:\Windows\System\xwEldIg.exe
  2⤵
  PID:10144
- C:\Windows\System\MFmUPxZ.exe
  C:\Windows\System\MFmUPxZ.exe
  2⤵
  PID:10724
- C:\Windows\System\PLbAYjP.exe
  C:\Windows\System\PLbAYjP.exe
  2⤵
  PID:9668
- C:\Windows\System\LrUyEkL.exe
  C:\Windows\System\LrUyEkL.exe
  2⤵
  PID:11268
- C:\Windows\System\xPSFpPP.exe
  C:\Windows\System\xPSFpPP.exe
  2⤵
  PID:11300
- C:\Windows\System\fVdybhk.exe
  C:\Windows\System\fVdybhk.exe
  2⤵
  PID:11328
- C:\Windows\System\XFlEIsR.exe
  C:\Windows\System\XFlEIsR.exe
  2⤵
  PID:11364
- C:\Windows\System\zwbHPER.exe
  C:\Windows\System\zwbHPER.exe
  2⤵
  PID:11396
- C:\Windows\System\NjbVBhk.exe
  C:\Windows\System\NjbVBhk.exe
  2⤵
  PID:11424
- C:\Windows\System\gBYYcPp.exe
  C:\Windows\System\gBYYcPp.exe
  2⤵
  PID:11460
- C:\Windows\System\iERLGOw.exe
  C:\Windows\System\iERLGOw.exe
  2⤵
  PID:11492
- C:\Windows\System\iaTGqvT.exe
  C:\Windows\System\iaTGqvT.exe
  2⤵
  PID:11528
- C:\Windows\System\YnvXUfk.exe
  C:\Windows\System\YnvXUfk.exe
  2⤵
  PID:11560
- C:\Windows\System\nlTGXUg.exe
  C:\Windows\System\nlTGXUg.exe
  2⤵
  PID:11580
- C:\Windows\System\xWnIccX.exe
  C:\Windows\System\xWnIccX.exe
  2⤵
  PID:11612
- C:\Windows\System\rRIDmoX.exe
  C:\Windows\System\rRIDmoX.exe
  2⤵
  PID:11632
- C:\Windows\System\AFPeEIn.exe
  C:\Windows\System\AFPeEIn.exe
  2⤵
  PID:11668
- C:\Windows\System\FOBSKoV.exe
  C:\Windows\System\FOBSKoV.exe
  2⤵
  PID:11700
- C:\Windows\System\oTMGMKY.exe
  C:\Windows\System\oTMGMKY.exe
  2⤵
  PID:11728
- C:\Windows\System\ccAwndV.exe
  C:\Windows\System\ccAwndV.exe
  2⤵
  PID:11756
- C:\Windows\System\JVufafz.exe
  C:\Windows\System\JVufafz.exe
  2⤵
  PID:11776
- C:\Windows\System\CNlSxSC.exe
  C:\Windows\System\CNlSxSC.exe
  2⤵
  PID:11804
- C:\Windows\System\FRGRiUy.exe
  C:\Windows\System\FRGRiUy.exe
  2⤵
  PID:11820
- C:\Windows\System\IgDaqku.exe
  C:\Windows\System\IgDaqku.exe
  2⤵
  PID:11844
- C:\Windows\System\AENSoEX.exe
  C:\Windows\System\AENSoEX.exe
  2⤵
  PID:11872
- C:\Windows\System\HFFuzys.exe
  C:\Windows\System\HFFuzys.exe
  2⤵
  PID:11900
- C:\Windows\System\GXHRmAO.exe
  C:\Windows\System\GXHRmAO.exe
  2⤵
  PID:11932
- C:\Windows\System\tRKfAnN.exe
  C:\Windows\System\tRKfAnN.exe
  2⤵
  PID:11960
- C:\Windows\System\IWpCfnk.exe
  C:\Windows\System\IWpCfnk.exe
  2⤵
  PID:11996
- C:\Windows\System\qJOkTnA.exe
  C:\Windows\System\qJOkTnA.exe
  2⤵
  PID:12024
- C:\Windows\System\rOwzlkN.exe
  C:\Windows\System\rOwzlkN.exe
  2⤵
  PID:12048
- C:\Windows\System\iSfRLEr.exe
  C:\Windows\System\iSfRLEr.exe
  2⤵
  PID:12080
- C:\Windows\System\JDxEbkL.exe
  C:\Windows\System\JDxEbkL.exe
  2⤵
  PID:12096
- C:\Windows\System\jUGLTbo.exe
  C:\Windows\System\jUGLTbo.exe
  2⤵
  PID:12120
- C:\Windows\System\otcXuFj.exe
  C:\Windows\System\otcXuFj.exe
  2⤵
  PID:12156
- C:\Windows\System\YkGgdkm.exe
  C:\Windows\System\YkGgdkm.exe
  2⤵
  PID:12184
- C:\Windows\System\AoiUxOR.exe
  C:\Windows\System\AoiUxOR.exe
  2⤵
  PID:12208
- C:\Windows\System\VoCFEmd.exe
  C:\Windows\System\VoCFEmd.exe
  2⤵
  PID:12228
- C:\Windows\System\ZJjjbnX.exe
  C:\Windows\System\ZJjjbnX.exe
  2⤵
  PID:12248
- C:\Windows\System\btorZdy.exe
  C:\Windows\System\btorZdy.exe
  2⤵
  PID:12276
- C:\Windows\System\bqTnToO.exe
  C:\Windows\System\bqTnToO.exe
  2⤵
  PID:10636
- C:\Windows\System\oDuAnSo.exe
  C:\Windows\System\oDuAnSo.exe
  2⤵
  PID:11348
- C:\Windows\System\IRqZOjp.exe
  C:\Windows\System\IRqZOjp.exe
  2⤵
  PID:11352
- C:\Windows\System\ioUZJOY.exe
  C:\Windows\System\ioUZJOY.exe
  2⤵
  PID:11412
- C:\Windows\System\oqAGQwd.exe
  C:\Windows\System\oqAGQwd.exe
  2⤵
  PID:11484
- C:\Windows\System\SLhFdvE.exe
  C:\Windows\System\SLhFdvE.exe
  2⤵
  PID:11572
- C:\Windows\System\BzDFdaL.exe
  C:\Windows\System\BzDFdaL.exe
  2⤵
  PID:11624
- C:\Windows\System\URRmSQZ.exe
  C:\Windows\System\URRmSQZ.exe
  2⤵
  PID:11720
- C:\Windows\System\jMhcqYa.exe
  C:\Windows\System\jMhcqYa.exe
  2⤵
  PID:11748
- C:\Windows\System\feDemaI.exe
  C:\Windows\System\feDemaI.exe
  2⤵
  PID:11816
- C:\Windows\System\NRMgesW.exe
  C:\Windows\System\NRMgesW.exe
  2⤵
  PID:11884
- C:\Windows\System\cTabQbu.exe
  C:\Windows\System\cTabQbu.exe
  2⤵
  PID:12008
- C:\Windows\System\dRXbzoU.exe
  C:\Windows\System\dRXbzoU.exe
  2⤵
  PID:12060
- C:\Windows\System\IvwhtWc.exe
  C:\Windows\System\IvwhtWc.exe
  2⤵
  PID:12144
- C:\Windows\System\rmGkazY.exe
  C:\Windows\System\rmGkazY.exe
  2⤵
  PID:12180
- C:\Windows\System\UJnHMkc.exe
  C:\Windows\System\UJnHMkc.exe
  2⤵
  PID:12244
- C:\Windows\System\KTAeKmd.exe
  C:\Windows\System\KTAeKmd.exe
  2⤵
  PID:11296
- C:\Windows\System\ziTTWLH.exe
  C:\Windows\System\ziTTWLH.exe
  2⤵
  PID:11384
- C:\Windows\System\HDXrILV.exe
  C:\Windows\System\HDXrILV.exe
  2⤵
  PID:11540
- C:\Windows\System\vWCsJID.exe
  C:\Windows\System\vWCsJID.exe
  2⤵
  PID:11644
- C:\Windows\System\AhunAPT.exe
  C:\Windows\System\AhunAPT.exe
  2⤵
  PID:11788
- C:\Windows\System\dVvuaQi.exe
  C:\Windows\System\dVvuaQi.exe
  2⤵
  PID:11944
- C:\Windows\System\qQkhAKD.exe
  C:\Windows\System\qQkhAKD.exe
  2⤵
  PID:12172
- C:\Windows\System\kppsMqP.exe
  C:\Windows\System\kppsMqP.exe
  2⤵
  PID:11408
- C:\Windows\System\BXBbBZK.exe
  C:\Windows\System\BXBbBZK.exe
  2⤵
  PID:11216
- C:\Windows\System\bEISqtN.exe
  C:\Windows\System\bEISqtN.exe
  2⤵
  PID:12068
- C:\Windows\System\nIOrizJ.exe
  C:\Windows\System\nIOrizJ.exe
  2⤵
  PID:11556
- C:\Windows\System\ZeSFOND.exe
  C:\Windows\System\ZeSFOND.exe
  2⤵
  PID:12304
- C:\Windows\System\LtBdpkv.exe
  C:\Windows\System\LtBdpkv.exe
  2⤵
  PID:12336
- C:\Windows\System\FBuErDP.exe
  C:\Windows\System\FBuErDP.exe
  2⤵
  PID:12368
- C:\Windows\System\OTTnTHk.exe
  C:\Windows\System\OTTnTHk.exe
  2⤵
  PID:12396
- C:\Windows\System\ULFWxin.exe
  C:\Windows\System\ULFWxin.exe
  2⤵
  PID:12428
- C:\Windows\System\HBUHvVK.exe
  C:\Windows\System\HBUHvVK.exe
  2⤵
  PID:12448
- C:\Windows\System\lOkmpMV.exe
  C:\Windows\System\lOkmpMV.exe
  2⤵
  PID:12476
- C:\Windows\System\TIHjXQv.exe
  C:\Windows\System\TIHjXQv.exe
  2⤵
  PID:12504
- C:\Windows\System\LNwWALV.exe
  C:\Windows\System\LNwWALV.exe
  2⤵
  PID:12532
- C:\Windows\System\kaCUGxm.exe
  C:\Windows\System\kaCUGxm.exe
  2⤵
  PID:12560
- C:\Windows\System\RIRCYBD.exe
  C:\Windows\System\RIRCYBD.exe
  2⤵
  PID:12580
- C:\Windows\System\xLadZka.exe
  C:\Windows\System\xLadZka.exe
  2⤵
  PID:12608
- C:\Windows\System\rUsCAxJ.exe
  C:\Windows\System\rUsCAxJ.exe
  2⤵
  PID:12624
- C:\Windows\System\FkEdfjX.exe
  C:\Windows\System\FkEdfjX.exe
  2⤵
  PID:12656
- C:\Windows\System\RBozPuz.exe
  C:\Windows\System\RBozPuz.exe
  2⤵
  PID:12676
- C:\Windows\System\hNUAIiT.exe
  C:\Windows\System\hNUAIiT.exe
  2⤵
  PID:12708
- C:\Windows\System\eaesKYZ.exe
  C:\Windows\System\eaesKYZ.exe
  2⤵
  PID:12728
- C:\Windows\System\PImPjHz.exe
  C:\Windows\System\PImPjHz.exe
  2⤵
  PID:12744
- C:\Windows\System\IAtqCPF.exe
  C:\Windows\System\IAtqCPF.exe
  2⤵
  PID:12768
- C:\Windows\System\HpHXNyo.exe
  C:\Windows\System\HpHXNyo.exe
  2⤵
  PID:12808
- C:\Windows\System\eyadSuV.exe
  C:\Windows\System\eyadSuV.exe
  2⤵
  PID:12832
- C:\Windows\System\cDZbRfD.exe
  C:\Windows\System\cDZbRfD.exe
  2⤵
  PID:12856
- C:\Windows\System\tBYldAJ.exe
  C:\Windows\System\tBYldAJ.exe
  2⤵
  PID:12884
- C:\Windows\System\rXhvPoh.exe
  C:\Windows\System\rXhvPoh.exe
  2⤵
  PID:12908
- C:\Windows\System\MsAZUpA.exe
  C:\Windows\System\MsAZUpA.exe
  2⤵
  PID:12936
- C:\Windows\System\CENEcZM.exe
  C:\Windows\System\CENEcZM.exe
  2⤵
  PID:12976
- C:\Windows\System\bfaOgaC.exe
  C:\Windows\System\bfaOgaC.exe
  2⤵
  PID:13012
- C:\Windows\System\PvNkJHC.exe
  C:\Windows\System\PvNkJHC.exe
  2⤵
  PID:13044
- C:\Windows\System\hRplhfz.exe
  C:\Windows\System\hRplhfz.exe
  2⤵
  PID:13076
- C:\Windows\System\aDVLtTy.exe
  C:\Windows\System\aDVLtTy.exe
  2⤵
  PID:13108
- C:\Windows\System\bJkQwVZ.exe
  C:\Windows\System\bJkQwVZ.exe
  2⤵
  PID:13148
- C:\Windows\System\EKWTVek.exe
  C:\Windows\System\EKWTVek.exe
  2⤵
  PID:13176
- C:\Windows\System\NWhSoWg.exe
  C:\Windows\System\NWhSoWg.exe
  2⤵
  PID:13212
- C:\Windows\System\qPQKdAg.exe
  C:\Windows\System\qPQKdAg.exe
  2⤵
  PID:13248
- C:\Windows\System\lWjiAMu.exe
  C:\Windows\System\lWjiAMu.exe
  2⤵
  PID:13276
- C:\Windows\System\oRYfMwK.exe
  C:\Windows\System\oRYfMwK.exe
  2⤵
  PID:13300
- C:\Windows\System\FmOVKid.exe
  C:\Windows\System\FmOVKid.exe
  2⤵
  PID:12236
- C:\Windows\System\IoKheoa.exe
  C:\Windows\System\IoKheoa.exe
  2⤵
  PID:12348
- C:\Windows\System\gIXaIUr.exe
  C:\Windows\System\gIXaIUr.exe
  2⤵
  PID:12376
- C:\Windows\System\nQdsNIi.exe
  C:\Windows\System\nQdsNIi.exe
  2⤵
  PID:12440
- C:\Windows\System\RwVbVhC.exe
  C:\Windows\System\RwVbVhC.exe
  2⤵
  PID:12456
- C:\Windows\System\eEsmJNE.exe
  C:\Windows\System\eEsmJNE.exe
  2⤵
  PID:12520
- C:\Windows\System\rSCSfWb.exe
  C:\Windows\System\rSCSfWb.exe
  2⤵
  PID:12604
- C:\Windows\System\hQUuWGI.exe
  C:\Windows\System\hQUuWGI.exe
  2⤵
  PID:12596
- C:\Windows\System\QeLSFra.exe
  C:\Windows\System\QeLSFra.exe
  2⤵
  PID:12760
- C:\Windows\System\elVmHOq.exe
  C:\Windows\System\elVmHOq.exe
  2⤵
  PID:12724
- C:\Windows\System\MehlxaG.exe
  C:\Windows\System\MehlxaG.exe
  2⤵
  PID:12876
- C:\Windows\System\FsunOmj.exe
  C:\Windows\System\FsunOmj.exe
  2⤵
  PID:12924
- C:\Windows\System\NgNTjet.exe
  C:\Windows\System\NgNTjet.exe
  2⤵
  PID:12992
- C:\Windows\System\ApxkBWX.exe
  C:\Windows\System\ApxkBWX.exe
  2⤵
  PID:12964
- C:\Windows\System\XZoFlat.exe
  C:\Windows\System\XZoFlat.exe
  2⤵
  PID:13084
- C:\Windows\System\OcddDtC.exe
  C:\Windows\System\OcddDtC.exe
  2⤵
  PID:13168
- C:\Windows\System\Axvdwmx.exe
  C:\Windows\System\Axvdwmx.exe
  2⤵
  PID:13196
- C:\Windows\System\pSYAYlj.exe
  C:\Windows\System\pSYAYlj.exe
  2⤵
  PID:11656
- C:\Windows\System\PecSgqW.exe
  C:\Windows\System\PecSgqW.exe
  2⤵
  PID:12328
- C:\Windows\System\iextYTd.exe
  C:\Windows\System\iextYTd.exe
  2⤵
  PID:12472
- C:\Windows\System\DmHcbdO.exe
  C:\Windows\System\DmHcbdO.exe
  2⤵
  PID:12736
- C:\Windows\System\EZTXLgT.exe
  C:\Windows\System\EZTXLgT.exe
  2⤵
  PID:13052
- C:\Windows\System\aHTubNU.exe
  C:\Windows\System\aHTubNU.exe
  2⤵
  PID:12948
- C:\Windows\System\kSrVICO.exe
  C:\Windows\System\kSrVICO.exe
  2⤵
  PID:13160
- C:\Windows\System\LMshvjr.exe
  C:\Windows\System\LMshvjr.exe
  2⤵
  PID:12492
- C:\Windows\System\HtstuDZ.exe
  C:\Windows\System\HtstuDZ.exe
  2⤵
  PID:12576
- C:\Windows\System\cGVlhJb.exe
  C:\Windows\System\cGVlhJb.exe
  2⤵
  PID:12072
- C:\Windows\System\eqyTqKJ.exe
  C:\Windows\System\eqyTqKJ.exe
  2⤵
  PID:13344
- C:\Windows\System\UsvQhLs.exe
  C:\Windows\System\UsvQhLs.exe
  2⤵
  PID:13380
- C:\Windows\System\JhWcaMZ.exe
  C:\Windows\System\JhWcaMZ.exe
  2⤵
  PID:13412
- C:\Windows\System\CxQQWoa.exe
  C:\Windows\System\CxQQWoa.exe
  2⤵
  PID:13440
- C:\Windows\System\npElWSL.exe
  C:\Windows\System\npElWSL.exe
  2⤵
  PID:13468
- C:\Windows\System\YzPzJCY.exe
  C:\Windows\System\YzPzJCY.exe
  2⤵
  PID:13500
- C:\Windows\System\qLVCueM.exe
  C:\Windows\System\qLVCueM.exe
  2⤵
  PID:13524
- C:\Windows\System\UiaICue.exe
  C:\Windows\System\UiaICue.exe
  2⤵
  PID:13560
- C:\Windows\System\MlaxJpp.exe
  C:\Windows\System\MlaxJpp.exe
  2⤵
  PID:13596
- C:\Windows\System\nfYCHhD.exe
  C:\Windows\System\nfYCHhD.exe
  2⤵
  PID:13628
- C:\Windows\System\cDijiRW.exe
  C:\Windows\System\cDijiRW.exe
  2⤵
  PID:13648
- C:\Windows\System\iIhhPxq.exe
  C:\Windows\System\iIhhPxq.exe
  2⤵
  PID:13672
- C:\Windows\System\wKUTmkJ.exe
  C:\Windows\System\wKUTmkJ.exe
  2⤵
  PID:13696
- C:\Windows\System\TtnvkuF.exe
  C:\Windows\System\TtnvkuF.exe
  2⤵
  PID:13724
- C:\Windows\System\YacBFXj.exe
  C:\Windows\System\YacBFXj.exe
  2⤵
  PID:13756
- C:\Windows\System\onlfwAZ.exe
  C:\Windows\System\onlfwAZ.exe
  2⤵
  PID:13772
- C:\Windows\System\xgXERIU.exe
  C:\Windows\System\xgXERIU.exe
  2⤵
  PID:13796
- C:\Windows\System\KDuYFTu.exe
  C:\Windows\System\KDuYFTu.exe
  2⤵
  PID:13812
- C:\Windows\System\eomFqKO.exe
  C:\Windows\System\eomFqKO.exe
  2⤵
  PID:13848
- C:\Windows\System\FxNddbj.exe
  C:\Windows\System\FxNddbj.exe
  2⤵
  PID:13884
- C:\Windows\System\zAmxwWq.exe
  C:\Windows\System\zAmxwWq.exe
  2⤵
  PID:13908
- C:\Windows\System\gcmLRPM.exe
  C:\Windows\System\gcmLRPM.exe
  2⤵
  PID:13928
- C:\Windows\System\eyPoOwj.exe
  C:\Windows\System\eyPoOwj.exe
  2⤵
  PID:13948
- C:\Windows\System\koKbDHS.exe
  C:\Windows\System\koKbDHS.exe
  2⤵
  PID:13980
- C:\Windows\System\gIHkFwD.exe
  C:\Windows\System\gIHkFwD.exe
  2⤵
  PID:14004
- C:\Windows\System\dZJvdhj.exe
  C:\Windows\System\dZJvdhj.exe
  2⤵
  PID:14040
- C:\Windows\System\oyCgGON.exe
  C:\Windows\System\oyCgGON.exe
  2⤵
  PID:14068
- C:\Windows\System\zKsKWMn.exe
  C:\Windows\System\zKsKWMn.exe
  2⤵
  PID:14100
- C:\Windows\System\scZwhrf.exe
  C:\Windows\System\scZwhrf.exe
  2⤵
  PID:14136
- C:\Windows\System\ItzvcaC.exe
  C:\Windows\System\ItzvcaC.exe
  2⤵
  PID:14176
- C:\Windows\System\cXHrTEZ.exe
  C:\Windows\System\cXHrTEZ.exe
  2⤵
  PID:14208
- C:\Windows\System\UMsdMEr.exe
  C:\Windows\System\UMsdMEr.exe
  2⤵
  PID:14232
- C:\Windows\System\bxcQmTI.exe
  C:\Windows\System\bxcQmTI.exe
  2⤵
  PID:14268
- C:\Windows\System\rYvJCIT.exe
  C:\Windows\System\rYvJCIT.exe
  2⤵
  PID:14292
- C:\Windows\System\zGjJMCS.exe
  C:\Windows\System\zGjJMCS.exe
  2⤵
  PID:14328
- C:\Windows\System\wxFRlNa.exe
  C:\Windows\System\wxFRlNa.exe
  2⤵
  PID:13136
- C:\Windows\System\ucPnMeh.exe
  C:\Windows\System\ucPnMeh.exe
  2⤵
  PID:13328
- C:\Windows\System\rhddRyT.exe
  C:\Windows\System\rhddRyT.exe
  2⤵
  PID:13364
- C:\Windows\System\yagIAGf.exe
  C:\Windows\System\yagIAGf.exe
  2⤵
  PID:13436
- C:\Windows\System\djGYZWH.exe
  C:\Windows\System\djGYZWH.exe
  2⤵
  PID:13520
- C:\Windows\System\OvAiStp.exe
  C:\Windows\System\OvAiStp.exe
  2⤵
  PID:13552
- C:\Windows\System\NcgyVJE.exe
  C:\Windows\System\NcgyVJE.exe
  2⤵
  PID:13636
- C:\Windows\System\jnMMYlZ.exe
  C:\Windows\System\jnMMYlZ.exe
  2⤵
  PID:13692
- C:\Windows\System\dCryrbk.exe
  C:\Windows\System\dCryrbk.exe
  2⤵
  PID:13828
- C:\Windows\System\qrvoPfJ.exe
  C:\Windows\System\qrvoPfJ.exe
  2⤵
  PID:13808
- C:\Windows\System\UThQyeW.exe
  C:\Windows\System\UThQyeW.exe
  2⤵
  PID:13924
- C:\Windows\System\CMNLDJS.exe
  C:\Windows\System\CMNLDJS.exe
  2⤵
  PID:13960
- C:\Windows\System\XStLsIp.exe
  C:\Windows\System\XStLsIp.exe
  2⤵
  PID:14032
- C:\Windows\System\JgcgRmY.exe
  C:\Windows\System\JgcgRmY.exe
  2⤵
  PID:14056
- C:\Windows\System\IlHHeSc.exe
  C:\Windows\System\IlHHeSc.exe
  2⤵
  PID:14188
- C:\Windows\System\KaMDJji.exe
  C:\Windows\System\KaMDJji.exe
  2⤵
  PID:14228
- C:\Windows\System\yEJrvSo.exe
  C:\Windows\System\yEJrvSo.exe
  2⤵
  PID:14320
- C:\Windows\System\HtsRfvY.exe
  C:\Windows\System\HtsRfvY.exe
  2⤵
  PID:13400
- C:\Windows\System\ESDmNrt.exe
  C:\Windows\System\ESDmNrt.exe
  2⤵
  PID:13512
- C:\Windows\System\uwkFUCm.exe
  C:\Windows\System\uwkFUCm.exe
  2⤵
  PID:13616
- C:\Windows\System\tEPJCpW.exe
  C:\Windows\System\tEPJCpW.exe
  2⤵
  PID:13684
- C:\Windows\System\QerlVfM.exe
  C:\Windows\System\QerlVfM.exe
  2⤵
  PID:13860
- C:\Windows\System\xGnkhke.exe
  C:\Windows\System\xGnkhke.exe
  2⤵
  PID:13976
- C:\Windows\System\XjQicNy.exe
  C:\Windows\System\XjQicNy.exe
  2⤵
  PID:14116
- C:\Windows\System\ybGzLYQ.exe
  C:\Windows\System\ybGzLYQ.exe
  2⤵
  PID:14300
- C:\Windows\System\EGIWnzh.exe
  C:\Windows\System\EGIWnzh.exe
  2⤵
  PID:13488
- C:\Windows\System\pBlAbPd.exe
  C:\Windows\System\pBlAbPd.exe
  2⤵
  PID:13736
- C:\Windows\System\ijaOiCR.exe
  C:\Windows\System\ijaOiCR.exe
  2⤵
  PID:14200
- C:\Windows\System\XHoTXjR.exe
  C:\Windows\System\XHoTXjR.exe
  2⤵
  PID:14344
- C:\Windows\System\hJiWIFM.exe
  C:\Windows\System\hJiWIFM.exe
  2⤵
  PID:14364
- C:\Windows\System\tpufqaR.exe
  C:\Windows\System\tpufqaR.exe
  2⤵
  PID:14396
- C:\Windows\System\ShTZVCa.exe
  C:\Windows\System\ShTZVCa.exe
  2⤵
  PID:14412
- C:\Windows\System\HiySSlj.exe
  C:\Windows\System\HiySSlj.exe
  2⤵
  PID:14444
- C:\Windows\System\JmfLEHX.exe
  C:\Windows\System\JmfLEHX.exe
  2⤵
  PID:14468
- C:\Windows\System\oMSKTaD.exe
  C:\Windows\System\oMSKTaD.exe
  2⤵
  PID:14496
- C:\Windows\System\jwoYDMH.exe
  C:\Windows\System\jwoYDMH.exe
  2⤵
  PID:14516
- C:\Windows\System\gpfqONk.exe
  C:\Windows\System\gpfqONk.exe
  2⤵
  PID:14532
- C:\Windows\System\VzqmVVF.exe
  C:\Windows\System\VzqmVVF.exe
  2⤵
  PID:14556
- C:\Windows\System\AEbalTa.exe
  C:\Windows\System\AEbalTa.exe
  2⤵
  PID:14592
- C:\Windows\System\zsrNbtV.exe
  C:\Windows\System\zsrNbtV.exe
  2⤵
  PID:14628
- C:\Windows\System\rRNaIYf.exe
  C:\Windows\System\rRNaIYf.exe
  2⤵
  PID:14656
- C:\Windows\System\UlhxreQ.exe
  C:\Windows\System\UlhxreQ.exe
  2⤵
  PID:14684
- C:\Windows\System\vrsmGKw.exe
  C:\Windows\System\vrsmGKw.exe
  2⤵
  PID:14724
- C:\Windows\System\xrDFHtY.exe
  C:\Windows\System\xrDFHtY.exe
  2⤵
  PID:14748
- C:\Windows\System\QUhQEQA.exe
  C:\Windows\System\QUhQEQA.exe
  2⤵
  PID:14784
- C:\Windows\System\BUYSVyD.exe
  C:\Windows\System\BUYSVyD.exe
  2⤵
  PID:14812
- C:\Windows\System\HDtAcvT.exe
  C:\Windows\System\HDtAcvT.exe
  2⤵
  PID:14840
- C:\Windows\System\omTayJX.exe
  C:\Windows\System\omTayJX.exe
  2⤵
  PID:14864
- C:\Windows\System\aeTqdyI.exe
  C:\Windows\System\aeTqdyI.exe
  2⤵
  PID:14888
- C:\Windows\System\xHTMGbl.exe
  C:\Windows\System\xHTMGbl.exe
  2⤵
  PID:14908
- C:\Windows\System\SPuGpkh.exe
  C:\Windows\System\SPuGpkh.exe
  2⤵
  PID:14932
- C:\Windows\System\VvTmHVU.exe
  C:\Windows\System\VvTmHVU.exe
  2⤵
  PID:14964
- C:\Windows\System\paPOIPA.exe
  C:\Windows\System\paPOIPA.exe
  2⤵
  PID:14992
- C:\Windows\System\ciWwdDz.exe
  C:\Windows\System\ciWwdDz.exe
  2⤵
  PID:15012
- C:\Windows\System\HmkZNWH.exe
  C:\Windows\System\HmkZNWH.exe
  2⤵
  PID:15048
- C:\Windows\System\VyYWhOu.exe
  C:\Windows\System\VyYWhOu.exe
  2⤵
  PID:15068
- C:\Windows\System\PeGQepz.exe
  C:\Windows\System\PeGQepz.exe
  2⤵
  PID:15104
- C:\Windows\System\qDjtEEt.exe
  C:\Windows\System\qDjtEEt.exe
  2⤵
  PID:15132
- C:\Windows\System\mCOcJnc.exe
  C:\Windows\System\mCOcJnc.exe
  2⤵
  PID:15164
- C:\Windows\System\tVFXxad.exe
  C:\Windows\System\tVFXxad.exe
  2⤵
  PID:15200
- C:\Windows\System\UfuBVIF.exe
  C:\Windows\System\UfuBVIF.exe
  2⤵
  PID:15220
- C:\Windows\System\NsukkTW.exe
  C:\Windows\System\NsukkTW.exe
  2⤵
  PID:15252
- C:\Windows\System\DckMDUO.exe
  C:\Windows\System\DckMDUO.exe
  2⤵
  PID:15296
- C:\Windows\System\kLuPTyK.exe
  C:\Windows\System\kLuPTyK.exe
  2⤵
  PID:15320
- C:\Windows\System\nVzbohU.exe
  C:\Windows\System\nVzbohU.exe
  2⤵
  PID:15344
- C:\Windows\System\xuyQMNN.exe
  C:\Windows\System\xuyQMNN.exe
  2⤵
  PID:14052
- C:\Windows\System\BcQLGRM.exe
  C:\Windows\System\BcQLGRM.exe
  2⤵
  PID:14384
- C:\Windows\System\mKQnFZs.exe
  C:\Windows\System\mKQnFZs.exe
  2⤵
  PID:14432
- C:\Windows\System\tGsetVv.exe
  C:\Windows\System\tGsetVv.exe
  2⤵
  PID:14480
- C:\Windows\System\gkAqtFz.exe
  C:\Windows\System\gkAqtFz.exe
  2⤵
  PID:14540
- C:\Windows\System\TjWMFWU.exe
  C:\Windows\System\TjWMFWU.exe
  2⤵
  PID:14620
- C:\Windows\System\gXpNYom.exe
  C:\Windows\System\gXpNYom.exe
  2⤵
  PID:14700
- C:\Windows\System\SHhggch.exe
  C:\Windows\System\SHhggch.exe
  2⤵
  PID:14764
- C:\Windows\System\lahNjir.exe
  C:\Windows\System\lahNjir.exe
  2⤵
  PID:14792
- C:\Windows\System\HuYQszc.exe
  C:\Windows\System\HuYQszc.exe
  2⤵
  PID:14852
- C:\Windows\System\TvCtLFv.exe
  C:\Windows\System\TvCtLFv.exe
  2⤵
  PID:14944
- C:\Windows\System\YkdqiWI.exe
  C:\Windows\System\YkdqiWI.exe
  2⤵
  PID:15056
- C:\Windows\System\YRnLNWf.exe
  C:\Windows\System\YRnLNWf.exe
  2⤵
  PID:15000
- C:\Windows\System\EobLUzj.exe
  C:\Windows\System\EobLUzj.exe
  2⤵
  PID:15116
- C:\Windows\System\cATlSwW.exe
  C:\Windows\System\cATlSwW.exe
  2⤵
  PID:15264
- C:\Windows\System\twreGNy.exe
  C:\Windows\System\twreGNy.exe
  2⤵
  PID:14352
- C:\Windows\System\RFFBrCs.exe
  C:\Windows\System\RFFBrCs.exe
  2⤵
  PID:14424
- C:\Windows\System\PQTcsjX.exe
  C:\Windows\System\PQTcsjX.exe
  2⤵
  PID:14376
- C:\Windows\System\whNPNUy.exe
  C:\Windows\System\whNPNUy.exe
  2⤵
  PID:14760
- C:\Windows\System\VmVcjKm.exe
  C:\Windows\System\VmVcjKm.exe
  2⤵
  PID:14872
- C:\Windows\System\biSzoyp.exe
  C:\Windows\System\biSzoyp.exe
  2⤵
  PID:15044
- C:\Windows\System\AcGBTzn.exe
  C:\Windows\System\AcGBTzn.exe
  2⤵
  PID:15036
- C:\Windows\System\SJmzSdc.exe
  C:\Windows\System\SJmzSdc.exe
  2⤵
  PID:15180
- C:\Windows\System\OTzarPr.exe
  C:\Windows\System\OTzarPr.exe
  2⤵
  PID:15248
- C:\Windows\System\iBrbzkG.exe
  C:\Windows\System\iBrbzkG.exe
  2⤵
  PID:12904
- C:\Windows\System\bziKwGC.exe
  C:\Windows\System\bziKwGC.exe
  2⤵
  PID:14692
- C:\Windows\System\frXoKyF.exe
  C:\Windows\System\frXoKyF.exe
  2⤵
  PID:15028
- C:\Windows\System\XnmOlhn.exe
  C:\Windows\System\XnmOlhn.exe
  2⤵
  PID:15376
- C:\Windows\System\fZfyreu.exe
  C:\Windows\System\fZfyreu.exe
  2⤵
  PID:15400
- C:\Windows\System\cBkGAWT.exe
  C:\Windows\System\cBkGAWT.exe
  2⤵
  PID:15424
- C:\Windows\System\zCoUGUJ.exe
  C:\Windows\System\zCoUGUJ.exe
  2⤵
  PID:15456
- C:\Windows\System\UNxWbwe.exe
  C:\Windows\System\UNxWbwe.exe
  2⤵
  PID:15476
- C:\Windows\System\ByUaiQX.exe
  C:\Windows\System\ByUaiQX.exe
  2⤵
  PID:15508
- C:\Windows\System\fGWTehh.exe
  C:\Windows\System\fGWTehh.exe
  2⤵
  PID:15536
- C:\Windows\System\CMFzlsb.exe
  C:\Windows\System\CMFzlsb.exe
  2⤵
  PID:15568
- C:\Windows\System\ujiQyRj.exe
  C:\Windows\System\ujiQyRj.exe
  2⤵
  PID:15592
- C:\Windows\System\VqChGlc.exe
  C:\Windows\System\VqChGlc.exe
  2⤵
  PID:15624
- C:\Windows\System\LBBSeny.exe
  C:\Windows\System\LBBSeny.exe
  2⤵
  PID:15656
- C:\Windows\System\eLUMGvD.exe
  C:\Windows\System\eLUMGvD.exe
  2⤵
  PID:15684
- C:\Windows\System\EflMqSq.exe
  C:\Windows\System\EflMqSq.exe
  2⤵
  PID:15700
- C:\Windows\System\mzYqHFt.exe
  C:\Windows\System\mzYqHFt.exe
  2⤵
  PID:15724
- C:\Windows\System\OCRbNhx.exe
  C:\Windows\System\OCRbNhx.exe
  2⤵
  PID:15760
- C:\Windows\System\QDsVJsB.exe
  C:\Windows\System\QDsVJsB.exe
  2⤵
  PID:15796
- C:\Windows\System\pUYxchY.exe
  C:\Windows\System\pUYxchY.exe
  2⤵
  PID:15824
- C:\Windows\System\sKtOpPu.exe
  C:\Windows\System\sKtOpPu.exe
  2⤵
  PID:15840
- C:\Windows\System\TqqIStV.exe
  C:\Windows\System\TqqIStV.exe
  2⤵
  PID:15868
- C:\Windows\System\toBIwXL.exe
  C:\Windows\System\toBIwXL.exe
  2⤵
  PID:15888
- C:\Windows\System\DRFdzlb.exe
  C:\Windows\System\DRFdzlb.exe
  2⤵
  PID:15924
- C:\Windows\System\cpwCohs.exe
  C:\Windows\System\cpwCohs.exe
  2⤵
  PID:15952
- C:\Windows\System\TkfECIA.exe
  C:\Windows\System\TkfECIA.exe
  2⤵
  PID:15984
- C:\Windows\System\eAWsXMy.exe
  C:\Windows\System\eAWsXMy.exe
  2⤵
  PID:16016
- C:\Windows\System\wnOKRNn.exe
  C:\Windows\System\wnOKRNn.exe
  2⤵
  PID:16044
- C:\Windows\System\wuJVHaC.exe
  C:\Windows\System\wuJVHaC.exe
  2⤵
  PID:16068
- C:\Windows\System\DXiTUwY.exe
  C:\Windows\System\DXiTUwY.exe
  2⤵
  PID:16092
- C:\Windows\System\SjfGDGV.exe
  C:\Windows\System\SjfGDGV.exe
  2⤵
  PID:16112
- C:\Windows\System\brdkjph.exe
  C:\Windows\System\brdkjph.exe
  2⤵
  PID:16148
- C:\Windows\System\qCwSrHP.exe
  C:\Windows\System\qCwSrHP.exe
  2⤵
  PID:16172
- C:\Windows\System\YoJXskQ.exe
  C:\Windows\System\YoJXskQ.exe
  2⤵
  PID:16204
- C:\Windows\System\vXcLHBa.exe
  C:\Windows\System\vXcLHBa.exe
  2⤵
  PID:16232
- C:\Windows\System\kRzGcpA.exe
  C:\Windows\System\kRzGcpA.exe
  2⤵
  PID:16264
- C:\Windows\System\UNGqNKL.exe
  C:\Windows\System\UNGqNKL.exe
  2⤵
  PID:16292
- C:\Windows\System\xorTApD.exe
  C:\Windows\System\xorTApD.exe
  2⤵
  PID:16320
- C:\Windows\System\dJCPRmF.exe
  C:\Windows\System\dJCPRmF.exe
  2⤵
  PID:16356
- C:\Windows\System\BmiqYsZ.exe
  C:\Windows\System\BmiqYsZ.exe
  2⤵
  PID:16380
- C:\Windows\System\tMHNExO.exe
  C:\Windows\System\tMHNExO.exe
  2⤵
  PID:15088
- C:\Windows\System\ehcvIwX.exe
  C:\Windows\System\ehcvIwX.exe
  2⤵
  PID:15412
- C:\Windows\System\PyHBmFm.exe
  C:\Windows\System\PyHBmFm.exe
  2⤵
  PID:15488
- C:\Windows\System\iQxQlqD.exe
  C:\Windows\System\iQxQlqD.exe
  2⤵
  PID:15532
- C:\Windows\System\GtNfpQr.exe
  C:\Windows\System\GtNfpQr.exe
  2⤵
  PID:15576
- C:\Windows\System\TJPadQw.exe
  C:\Windows\System\TJPadQw.exe
  2⤵
  PID:15588
- C:\Windows\System\NovPpKg.exe
  C:\Windows\System\NovPpKg.exe
  2⤵
  PID:15744
- C:\Windows\System\TiAEncc.exe
  C:\Windows\System\TiAEncc.exe
  2⤵
  PID:15788
- C:\Windows\System\WTOfPdt.exe
  C:\Windows\System\WTOfPdt.exe
  2⤵
  PID:15864
- C:\Windows\System\WpPaEsB.exe
  C:\Windows\System\WpPaEsB.exe
  2⤵
  PID:15936
- C:\Windows\System\zsLveih.exe
  C:\Windows\System\zsLveih.exe
  2⤵
  PID:15980
- C:\Windows\System\ueORrmE.exe
  C:\Windows\System\ueORrmE.exe
  2⤵
  PID:16080
- C:\Windows\System\sTuYGkc.exe
  C:\Windows\System\sTuYGkc.exe
  2⤵
  PID:16056
- C:\Windows\System\SDazypQ.exe
  C:\Windows\System\SDazypQ.exe
  2⤵
  PID:16160
- C:\Windows\System\VfvwIrm.exe
  C:\Windows\System\VfvwIrm.exe
  2⤵
  PID:3724
- C:\Windows\System\zmhcjbL.exe
  C:\Windows\System\zmhcjbL.exe
  2⤵
  PID:16340
- C:\Windows\System\NVkivPX.exe
  C:\Windows\System\NVkivPX.exe
  2⤵
  PID:15124
- C:\Windows\System\KzRBcOk.exe
  C:\Windows\System\KzRBcOk.exe
  2⤵
  PID:15472
- C:\Windows\System\rlGVRrq.exe
  C:\Windows\System\rlGVRrq.exe
  2⤵
  PID:15468
- C:\Windows\System\uuJvgwj.exe
  C:\Windows\System\uuJvgwj.exe
  2⤵
  PID:15640
- C:\Windows\System\YoColPV.exe
  C:\Windows\System\YoColPV.exe
  2⤵
  PID:15832
- C:\Windows\System\JGYVAsQ.exe
  C:\Windows\System\JGYVAsQ.exe
  2⤵
  PID:15964
- C:\Windows\System\JRxuTMl.exe
  C:\Windows\System\JRxuTMl.exe
  2⤵
  PID:16156
- C:\Windows\System\GBIfBQF.exe
  C:\Windows\System\GBIfBQF.exe
  2⤵
  PID:16180
- C:\Windows\System\xDNbFry.exe
  C:\Windows\System\xDNbFry.exe
  2⤵
  PID:16332
- C:\Windows\System\JOPSUtF.exe
  C:\Windows\System\JOPSUtF.exe
  2⤵
  PID:15668
- C:\Windows\System\uGWiloC.exe
  C:\Windows\System\uGWiloC.exe
  2⤵
  PID:15712
- C:\Windows\System\dzOFHFW.exe
  C:\Windows\System\dzOFHFW.exe
  2⤵
  PID:15916
- C:\Windows\System\GPpZkWG.exe
  C:\Windows\System\GPpZkWG.exe
  2⤵
  PID:15452
- C:\Windows\System\EdwdRYZ.exe
  C:\Windows\System\EdwdRYZ.exe
  2⤵
  PID:16400
- C:\Windows\System\flKJgSI.exe
  C:\Windows\System\flKJgSI.exe
  2⤵
  PID:16428
- C:\Windows\System\Ixwtnzg.exe
  C:\Windows\System\Ixwtnzg.exe
  2⤵
  PID:16452
- C:\Windows\System\CBBQbbF.exe
  C:\Windows\System\CBBQbbF.exe
  2⤵
  PID:16488
- C:\Windows\System\OajmPrO.exe
  C:\Windows\System\OajmPrO.exe
  2⤵
  PID:16516
- C:\Windows\System\GfCmycj.exe
  C:\Windows\System\GfCmycj.exe
  2⤵
  PID:16552
- C:\Windows\System\mJUaGuW.exe
  C:\Windows\System\mJUaGuW.exe
  2⤵
  PID:16588
- C:\Windows\System\IyTKtfy.exe
  C:\Windows\System\IyTKtfy.exe
  2⤵
  PID:16612
- C:\Windows\System\DoxbMrC.exe
  C:\Windows\System\DoxbMrC.exe
  2⤵
  PID:16648
- C:\Windows\System\RbGCyhj.exe
  C:\Windows\System\RbGCyhj.exe
  2⤵
  PID:16672
- C:\Windows\System\JKCNZAx.exe
  C:\Windows\System\JKCNZAx.exe
  2⤵
  PID:16700
- C:\Windows\System\NduUzWl.exe
  C:\Windows\System\NduUzWl.exe
  2⤵
  PID:16720
- C:\Windows\System\MXvSCjp.exe
  C:\Windows\System\MXvSCjp.exe
  2⤵
  PID:16752
- C:\Windows\System\UWkBWTv.exe
  C:\Windows\System\UWkBWTv.exe
  2⤵
  PID:16776
- C:\Windows\System\IfhqsDg.exe
  C:\Windows\System\IfhqsDg.exe
  2⤵
  PID:16812
- C:\Windows\System\jIXUEcG.exe
  C:\Windows\System\jIXUEcG.exe
  2⤵
  PID:16844
- C:\Windows\System\bIyAUjk.exe
  C:\Windows\System\bIyAUjk.exe
  2⤵
  PID:16868
- C:\Windows\System\bQzJXsK.exe
  C:\Windows\System\bQzJXsK.exe
  2⤵
  PID:16904
- C:\Windows\System\DJvpfWJ.exe
  C:\Windows\System\DJvpfWJ.exe
  2⤵
  PID:16940
- C:\Windows\System\tizhxwZ.exe
  C:\Windows\System\tizhxwZ.exe
  2⤵
  PID:16968
- C:\Windows\System\UJhHyem.exe
  C:\Windows\System\UJhHyem.exe
  2⤵
  PID:16988
- C:\Windows\System\kQQSzLB.exe
  C:\Windows\System\kQQSzLB.exe
  2⤵
  PID:17016
- C:\Windows\System\wPUhyju.exe
  C:\Windows\System\wPUhyju.exe
  2⤵
  PID:17040
- C:\Windows\System\oWFYibX.exe
  C:\Windows\System\oWFYibX.exe
  2⤵
  PID:17072
- C:\Windows\System\NmjubzW.exe
  C:\Windows\System\NmjubzW.exe
  2⤵
  PID:17104

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BTPAlHc.exe

Filesize
1.7MB

MD5
85becdd5523f621249a694e7a6e710bd

SHA1
fcbf3055b2a381c24c21566af7e29b4826ce32a4

SHA256
d2927bfed1cd6937110922e8a5a1627058c1ca86f555d436d466026fd631eec2

SHA512
f62ecf79046cf286051334250fd4c490907dcd024796db0ccb8e3e5726b3e0feadfacb3ec622c4e76ef23e1d088896fb501f41297e919568d4fa41da742066c1

Download Submit
C:\Windows\System\DpeyGnk.exe

Filesize
1.7MB

MD5
d2516c53e0180bbe32273020646d9021

SHA1
82f8b63bccc6b6ec79f20a6bf9bbfa02dc793ea5

SHA256
eee0d04d82969b70f8c2c47ce5353d412e7939ebb9c664dfce596196c1c94caa

SHA512
f95e96601b68ba38966999ecb07fccc6cdf3322b137581a94cc476504a940416fb96e057a3fa8e3a90355fca86d760ed0980f3e02fb0503e33cacf2f1cf503d9

Download Submit
C:\Windows\System\FAqwoDJ.exe

Filesize
1.7MB

MD5
d7281f11a42dfad07fc740efe0c9158f

SHA1
e3856e9eea43b65b4d16faf10b6df3b586c23f30

SHA256
d01392fe523f559ece8ce08888c02ae108212dbe1bea900b41563f6ae3b4104c

SHA512
ae593826e84f748f07231427887d64b4da6e7ca2caf6820722ea1b13fa3bf4ddacaa1f2cfe72190bde137b22232fba7308d83abdf95aee1698df288aac9e19d7

Download Submit
C:\Windows\System\HTErAUb.exe

Filesize
1.7MB

MD5
cdc901b87add2fdbda57a5cf3e2e5995

SHA1
9a2c9e05274effd65e2b084494b0925c3a85b099

SHA256
2ee34e224196962ff94693a44aa00d37559fa7daa2fc59c3584d4d56db59e998

SHA512
36bf814d0a26c557171b0f9d6fa57f61d50455e1fe52ffb3c463502b7365dbbb1dec3f3884aaf0b994cc81b15152fa301d69dd85ccf82168a7a1ab9c9e5027cf

Download Submit
C:\Windows\System\HslSZxJ.exe

Filesize
1.7MB

MD5
1a6e1c3c04b7bbb424d134c34e617e15

SHA1
07646a63285bf8e6d1a12d31a0aa04b04a85618f

SHA256
8456eb2a904372c11ef8bb559cedf27e941138ec0378baa9c8bd1ad9037469c1

SHA512
26643a79f3a54bd4a32b4822a29af5ad1ea5de3712a7ef7f7c8f8c6e10eec2145d54d194b7888611d389107d627ce0111e847090f92467e8f8ac7cf8960253db

Download Submit
C:\Windows\System\KGxpnZc.exe

Filesize
1.7MB

MD5
281ee4287b071dcf43f13bf38de60aa6

SHA1
b065cbbfe5969fc56a811e2c3f2035f92c3d4370

SHA256
51994413ece8571d030c4d063443a771ada6d6640796bf0ed73458d323b417f3

SHA512
8999ac5395dd6f73a7997bb3894c8de3aab76944048215f85d96d4133febb45bb12e997afd85e463cce57e3051bcf482d90512a2c4d50faf19efd4e74ad4049d

Download Submit
C:\Windows\System\KsETLMp.exe

Filesize
1.7MB

MD5
b0a18aea9ee24c95090ed70f9b281a96

SHA1
8eac7a08e436af336330f51adbf75325d5366963

SHA256
f73f13b429b27a318ba760b8c311f9d4f67b7301ef0df205a52a9471d71c12a2

SHA512
7910607007e726506be208c41dc96a817a07927e59ecb302d05f89ed5a3307cc58232944ed443de2ed4e2ee043028cf061a0722f97a79c40dcfa125d170dbf48

Download Submit
C:\Windows\System\LuQpjVK.exe

Filesize
1.7MB

MD5
39383ef9f7a1a3d434d48c629443b46f

SHA1
cb28209bad80f2cad8591be30f7d87a1fb01745e

SHA256
3395000c5cd07ebce1227966b5841f6930322ec3be046c3c5429b5b40d686534

SHA512
13be0f4932cfe94093f1ca99cab9f44977358dc07188bf2ca72ce4e8abd89dd90ddabaff3c6d18e76bc473d447658e4e0f717f618c72180a262663ec3f9d5476

Download Submit
C:\Windows\System\MaYddeG.exe

Filesize
1.7MB

MD5
d9951a33d2d3ab6538955f3cd0f1ae20

SHA1
b8ba5c847843ea991c86c43dcce76ecf27e6a426

SHA256
718e30aa75f1704bbd2e519dd6ecddfdb963ce76d2791b4880c86a4418fb25dd

SHA512
9c21f5448533e0c7cd66f89a0bf4257fd0169b5a4faf785ee6534df7ed5026ace6775fafbeedb993a71596df200906e504870b8d72d5c914f2445dcce33539b7

Download Submit
C:\Windows\System\MbxEYOX.exe

Filesize
1.7MB

MD5
ccfb80162104062bc3061a4de37fbd0b

SHA1
b12128ecad7a304ddf2f91440110aec87cc443b3

SHA256
fb362a35070406251373b466e3ee4f27bdf733bc1fbe99613fd592d25176fac5

SHA512
231d9ff13c205fa990c5487d8d1d08cdb71700c9f530a21f6fb30935696250d0e93a642fe789e877fc35e160a73b6c6adc168e789f1218e8a54a203bda73557e

Download Submit
C:\Windows\System\OfwWslO.exe

Filesize
1.7MB

MD5
a49849b66370ce1ae6e15bfa829f6891

SHA1
fe7fc37dd96848f3017ed63a57ffe80c5a6d3db2

SHA256
35ffa73e284fc44fe49b7159520ca74804460ad04e3ecb25e749423570d1b790

SHA512
6268fa9a59e6749d76ab2cd65e75164de7d9253eb7ec6abc6c1b533b5b7a194780b3cafa366c75b72e3f84b6ff0e7e70b1acb0dc71d1bdabe3fe7ec02fa6223c

Download Submit
C:\Windows\System\OkXGiuH.exe

Filesize
1.7MB

MD5
cb1362fa92b74f000c68987efb164ff2

SHA1
9c757232bcf631ab699a3af7b3238a634eabd0cd

SHA256
e45c53e8e8f805264a79f185eda6d838dff6700340bb5be2bc2952ba5554b229

SHA512
dca56f85b0392aa3965b6edad2c2021715c8f5a3bdad7f8a6ded6a0d5f0e3f6218ec660fec174660f8463727efd288689f6f512733e023773fffa08986caf4f6

Download Submit
C:\Windows\System\OtJHPvB.exe

Filesize
1.7MB

MD5
a121526d844a0e86aecc7041dfc089fe

SHA1
e5dc15f554e1a989270fe41e09aa6ac22504b470

SHA256
7c2ac539d6ea5901e667982b0389d4f9548fa09335dd474d552e0f5902c8c0c8

SHA512
253e0dad2717713327106d6b70b133fcae30ecdf183e6c0b439d40ed3b998e15896da31deb01bee8e1a0a48f89949d70e8552a97d11ff1053b23ac810130e537

Download Submit
C:\Windows\System\THTGqjI.exe

Filesize
1.7MB

MD5
cbccd3b1172d9d4df4e59b8c710df9ee

SHA1
407866f206996bf4b7d1f8f164a863c2d7716300

SHA256
dc4d91ba6039788add70df01b41160fc2b0eed9dcb7a116e66a599ddc00d44c5

SHA512
165de2a20941fa778d4fc6ce7a0ebef86bd852940b490d30c91f29801a05a039c061e7f1d4400059dccfd20a4dad109c472ab9df82f3347ffb00584e28965801

Download Submit
C:\Windows\System\XvNZLJG.exe

Filesize
1.7MB

MD5
361724b826a452c2ae668d775a594402

SHA1
1af1a68df6997a9da6e2f40b6b5dd88822ff597e

SHA256
a3af9cb84d1183dfdb7af65088478dbf35c90de3628a79755ab2b3901d1ba995

SHA512
46cc44447862e88b32d3410ef4b64dc9254928327d20eb2cb4f6e20ef22d16da7d4cdd7c35f4fba5f8ce9674e2e4907f68d42ee974111b3ef35385c4e300293c

Download Submit
C:\Windows\System\YwnBWyf.exe

Filesize
1.7MB

MD5
cb59edbe66b776d8565decce3d56f2be

SHA1
25af0620bed22e1f29499275ffd2bfb10fa56de8

SHA256
e4283fd61bcf77bffe3d818d0fa0830d583fcdd67a2955a0d8e62e79b66ca7fc

SHA512
1c69a23dc028795722b0ac01341b7a300a127de0fee96b89be0f442e25eb8fe33c00e4f9d3d2fbbacb5dc8d85ba4b3858ef3116edcbee7f10d734e4d7b3641f6

Download Submit
C:\Windows\System\ZCqguRr.exe

Filesize
1.7MB

MD5
1a67f90398ad306a7100ef66cb227ff1

SHA1
32a846275176d36e6a1386408a9f688ac514529a

SHA256
a9eae2c9396597ad727d7bea0488d129cb6bbfcd5721dd059b41ce59d401fb67

SHA512
0cb5bfc87974d72dfff46068538c29089197feb37f5266c941064f72cf6123a659c7c2caacc583e04d6637a40fccfd60bfa65414f4520331bbf6a3f01b705dd7

Download Submit
C:\Windows\System\ZWZRFSI.exe

Filesize
1.7MB

MD5
caf1bba5deab773243c23a8b958a1924

SHA1
be176db069bc4d74b22aa0f05dbb791e3ebcdc3c

SHA256
1de7c405b0ada820f7fe8697b93ee18c5719d58d930d5dc2562573d53f5b9313

SHA512
15a19fd719b5fba64619725fde01907f21ab5c5744841df6d995b6fdc552fa51adf5f4867e6fe74dd2ce7fff492a174dca9b797c9cb3aa3985aeb2735051ed91

Download Submit
C:\Windows\System\ZleWZGC.exe

Filesize
1.7MB

MD5
1f9288ce00f4ce43081225b6a660de98

SHA1
dbeaf6ba9ff93994ba3ee24d45c71915d94c68e3

SHA256
0299933addc30c62964e9d0acdae677e1a85dec9ae883fc7d7a4c2f5b0303f6b

SHA512
05a016190306f8932f2d401239dc275f16329f90a2d90261da15be292672a0263417da839d93b8c45ceefdaf8cd5d1a7c26e8bc76fa72a9e1e0a36a900f8c22a

Download Submit
C:\Windows\System\dJLJmnb.exe

Filesize
1.7MB

MD5
f04a163fb14205ddd93df522fbc1dc6c

SHA1
dcb90a7876db94aaa98e4f6fbf020e0d0cecb01a

SHA256
57e5a79274eb94e6bed20e344dd1fed12b6d3a352813e06a82a290d68427315d

SHA512
33fb06b93d1bc684e193bd3f188deae79f66f4adc8220b2747923ddb52a38b97cf730e22d7577ee2d8689fa3d1bfcc8abeb06cb7e490d32b31ea7bdf5c995bfe

Download Submit
C:\Windows\System\eKtlfwY.exe

Filesize
1.7MB

MD5
0ed3d4e0f0be4edd7d98d42596f40d58

SHA1
049e865e860f0cdcc1eae4c10c14f5d5fa7f6c46

SHA256
fa34bb855c9d1f562b3288a8f573d30f543179e6b17e971c9546ed5bf6842b07

SHA512
41e802075a0cfddfbcaad67b70c6136d96fe1e7701a10d093bd587903dfcff20b9830bff7a2c74dcb9b876d9efc758b2d49972d1546e126bd40c5fc6d5e09ff3

Download Submit
C:\Windows\System\eNtbcJx.exe

Filesize
1.7MB

MD5
e0bae25755fccc5ea487cbcb8017a877

SHA1
cf506eee991a6dff710573d67ab7229dfaaea1bc

SHA256
97b52f8bc0652035da9240746666dbc29984d08a2551c5fd44f06aca34c8e1e3

SHA512
c0180547ff86d120bfcf0691bd98e6aaabdb09ed3ac063ab02ee7970735d927477a2fc42b6f31a8208433d0e2f7b4524d91f7d9bf0c0a8de07012775fa74cec1

Download Submit
C:\Windows\System\ePmnUNl.exe

Filesize
1.7MB

MD5
33935e951f56fa48313de8a1ee3b0ca1

SHA1
7a8cd0fa047f10d8c0a3d5730fbd765f5f2256ac

SHA256
ae99717cf4c1bb777cb610fc855a5a97b768726f2c3464cfaa3f304dfd9e4555

SHA512
cc26abf6f5313ede35fb3a279c3c664f4c9764600102ef34e358d07f2f72f9e86205b4209eb1e04fdcbfb968d6d658f3a3bd246ed1297cb3823e44856ef69e0d

Download Submit
C:\Windows\System\fMlsGCP.exe

Filesize
1.7MB

MD5
0c342b365c2639c5aa9b1ca0c40c74de

SHA1
dc058ef53639296dcdd18bce50c07890483c1745

SHA256
bddc488d0e9415636545928a9c4d310913c906acf39f66612444543cbb2c728c

SHA512
83dae9f1b36f9b6dab4f04d946ccaac5fb267c60861ff6a4d2d3110b5ccba353f22e0dd3a80e944effffdca9ebc80031dc8219605de260d140d810a5e7db104f

Download Submit
C:\Windows\System\gjKbCzu.exe

Filesize
1.7MB

MD5
d5e413ac4a2cf6e109edfd61670dedbb

SHA1
b179fe7992dd0ae4499e08448683f2e61c9a9cb0

SHA256
a0204aaf566676cffa2dc9278e5e095cbd79bb281c21893be91db578a8e57565

SHA512
1896f21a647776da772c66884793fba1b50e0ad14df3fbaa8de15e0fdab56b10841843900c076a967ef7ffd771f325fb03bd4fe916e4345f425ab2fd4576e0e6

Download Submit
C:\Windows\System\iPhSFls.exe

Filesize
1.7MB

MD5
297a0b796658eaf41789ffb8208143ef

SHA1
dd058a56ba4c1d26332f6574c5716095757e6690

SHA256
b6567e2d469e9175890f93c45a3ebdef72f6622bd4f3523a174a1c421319fb2b

SHA512
eb67fd75f8fdc5eaf24cffefd7a8f195ac7116d8578f1a164af6cee38905d50c3e8d4c74209849579926f4de7c5a7e4af45a28f6f766b18d5ac88dc7db227f5e

Download Submit
C:\Windows\System\ifngQvk.exe

Filesize
1.7MB

MD5
0496decfdceb8348ffebc7a7676abf89

SHA1
4203c448c2991a9ac5ae99dc9930fe90af3ea945

SHA256
c1e2cdb748d1a01302eebcafc4129ffd23105f789940dec30f55b73cdd05c91d

SHA512
3a6ce4a26e9409d25921f2549b2314438e2589f01fafcde692b2d191859c7d0b9cf4ba0724ab0463025fd5baef4b83d7ab93f2797701b9064ab85ec015d16e19

Download Submit
C:\Windows\System\jSfQadM.exe

Filesize
1.7MB

MD5
b1dc88a5fcc90e8a975386ce14475b67

SHA1
00e58b79f0051b5be0dcc124e43c73c61aa457a5

SHA256
048307bc602d03b52ad9fa79d0c5824c636235dfd705a870f929f1250bff510e

SHA512
aa89e567efa95a0fb9cd995e1d0950605ddf21ded71219cee5c94ac1cd844498d655572f0c2a75a32854c67564a78a8726fae9bdbab68adfd3e246ab26387cb4

Download Submit
C:\Windows\System\mpRSXet.exe

Filesize
1.7MB

MD5
ca7fbcbe1e79e686671500d7cf12ca2b

SHA1
b27b090d0766116f18d9eebd3097627595b41f43

SHA256
82cb4ce6a5b0365add5cbec1c10782618d1f58fa1f2b22963055150b0d8b7e28

SHA512
ada6f78159c5773331ff11d8c139e351c2a98cf90c920b501bbdd93b5829aaaeddbe7e5a75b644d0d11bb03c3c1d49568d6b8da0ca87d4a52812bf0c5e44c101

Download Submit
C:\Windows\System\uSrNcgK.exe

Filesize
1.7MB

MD5
501f78c5a30e21827edb4ce579193d0d

SHA1
b58770e64b08f9ccec80def67257b4f69f1579f8

SHA256
c4ef6a2eb54cb65e375c822e61282f5b2f6bc3f156a8d4701a17b52298834336

SHA512
d9a8fdf71ee31bb566c3df28c6ca3c0180ed6179cbcf5a35df4b3a5b52f26457c697109332fc5c2613d78b55de744d532027c38def2283287a7c15f76f00b9b9

Download Submit
C:\Windows\System\vCfvols.exe

Filesize
1.7MB

MD5
2c618e8eb43b584f6c07d6d1d4ce3ab4

SHA1
c7211d9ef1c9b18164b576aea286aca2d7accff4

SHA256
cba7bbe268aeb4e746b946885fe3d6b06f9663c6c4d1acd8132907df55f37fdd

SHA512
010fda3f8fdfd41afa4d7bdcaf6f4d3ff00cdbb6198fae42fbfc8041df63b3b01ebbb407687760c1f514e3fe5ae034dbddb58047bcee7840274101b8b051444a

Download Submit
C:\Windows\System\wYwKTEi.exe

Filesize
1.7MB

MD5
aee080662e6a83517164d4e3d80c68df

SHA1
71d4d22ab74d1fecac06fda3f5d48ba87a2a969d

SHA256
73813ac70c8c1b65598eed2ba5019e9a8844ab7a87250ca86da2fc80ad705bb7

SHA512
b4e7eb4c29af6bd4afc7a227015cb249c24b1367f00ddb0c49fe49db16aeaf055c5db62d47e11e956c07bfa384ff77757521b57b34430efd47507a0b04886d08

Download Submit
C:\Windows\System\xYsqSYO.exe

Filesize
1.7MB

MD5
b158838a244a04134525f7a678f34271

SHA1
2ff6fb2dd18b1a7bef509fe65af2c46681e4a38c

SHA256
2bbd77faf2dd177b5623ff9538cae5c2a36967f425e7a709937a80e5f22339f0

SHA512
c84d01c6a96c31b09237d316ee52d7ce87e828d8ef2e5159251eabae2e666be479224f8953ebff90eaa0180aab102a60ad8fe91b3a7d30251648a2fefee9f52d

Download Submit
C:\Windows\System\yOatYii.exe

Filesize
1.7MB

MD5
20c4e65a9b858402e9fe4686c6ea984a

SHA1
7fc5d4b4711873201f3f9030f7cf776161a23de2

SHA256
a019a8aec46a8285f0141c03b11a038e62e2c8bfdac1fad6d6f8fb9576bd3291

SHA512
f48742db6ed8e948731f1091f7aa1c8f5106f794c9f7b5786e76d45555e43e6025aceea515e56054f35ef56043b078889bfca4d5a0c18e1a4a0de9ffa7fcda4c

Download Submit
memory/4196-0-0x000001DC0D940000-0x000001DC0D950000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads