xmrig | 5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
Size

1.6MB
MD5

5cb78bde5a2a1299f02c4b28fc67381b
SHA1

30990523c267075e669360740e7d9c0d05711af9
SHA256

5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc
SHA512

3f3484559b953dab7bc1f192fa68a0e7bcfccde247466ba617eafeae64683a26e4e90a36c8c0bfc8ea516492c5a8d49c2c945c14c882f3539cd97f23a6eb7ec2
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRakGNrNHGfDvM:GemTLkNdfE0pZy0

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023ba0-3.dat	xmrig
behavioral2/files/0x000a000000023ba8-11.dat	xmrig
behavioral2/files/0x000a000000023baa-17.dat	xmrig
behavioral2/files/0x0008000000023c63-110.dat	xmrig
behavioral2/files/0x0008000000023c65-165.dat	xmrig
behavioral2/files/0x0008000000023c14-170.dat	xmrig
behavioral2/files/0x0008000000023c0c-169.dat	xmrig
behavioral2/files/0x000e000000023bbf-168.dat	xmrig
behavioral2/files/0x000a000000023bac-164.dat	xmrig
behavioral2/files/0x0008000000023c62-163.dat	xmrig
behavioral2/files/0x0008000000023c61-162.dat	xmrig
behavioral2/files/0x0008000000023c60-161.dat	xmrig
behavioral2/files/0x0008000000023c5f-160.dat	xmrig
behavioral2/files/0x0008000000023c53-159.dat	xmrig
behavioral2/files/0x0008000000023c4f-157.dat	xmrig
behavioral2/files/0x0016000000023c49-156.dat	xmrig
behavioral2/files/0x000b000000023c48-155.dat	xmrig
behavioral2/files/0x0008000000023c2e-154.dat	xmrig
behavioral2/files/0x0008000000023c33-153.dat	xmrig
behavioral2/files/0x0008000000023c32-152.dat	xmrig
behavioral2/files/0x0008000000023c31-151.dat	xmrig
behavioral2/files/0x0008000000023c30-150.dat	xmrig
behavioral2/files/0x0008000000023c2f-149.dat	xmrig
behavioral2/files/0x0008000000023c28-146.dat	xmrig
behavioral2/files/0x0008000000023c15-172.dat	xmrig
behavioral2/files/0x0008000000023c16-145.dat	xmrig
behavioral2/files/0x0008000000023c0b-143.dat	xmrig
behavioral2/files/0x0008000000023c0f-141.dat	xmrig
behavioral2/files/0x0008000000023c0d-139.dat	xmrig
behavioral2/files/0x0008000000023c0a-136.dat	xmrig
behavioral2/files/0x0008000000023bdb-134.dat	xmrig
behavioral2/files/0x0008000000023bda-133.dat	xmrig
behavioral2/files/0x0008000000023bd9-132.dat	xmrig
behavioral2/files/0x0008000000023bd8-131.dat	xmrig
behavioral2/files/0x0008000000023bc8-130.dat	xmrig
behavioral2/files/0x0008000000023bd5-129.dat	xmrig
behavioral2/files/0x000e000000023bd3-128.dat	xmrig
behavioral2/files/0x0009000000023bcf-127.dat	xmrig
behavioral2/files/0x0009000000023bce-126.dat	xmrig
behavioral2/files/0x0009000000023bcd-124.dat	xmrig
behavioral2/files/0x000a000000023bb8-121.dat	xmrig
behavioral2/files/0x000b000000023baf-120.dat	xmrig
behavioral2/files/0x000b000000023bb0-119.dat	xmrig
behavioral2/files/0x000a000000023bad-115.dat	xmrig
behavioral2/files/0x000a000000023bab-114.dat	xmrig
behavioral2/files/0x0008000000023c64-113.dat	xmrig
behavioral2/files/0x0008000000023c0e-140.dat	xmrig
behavioral2/files/0x000b000000023bae-117.dat	xmrig
behavioral2/files/0x000a000000023ba9-14.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4032	lLFVjhb.exe
4088	wTAWgDE.exe
4052	kYGntCJ.exe
2948	jwJoRAq.exe
3868	LjCPOFe.exe
4628	RDQToZf.exe
2268	jTPgikK.exe
4720	vWSnzqe.exe
1484	oPLfeax.exe
60	dJyrADK.exe
4804	CtEQWYS.exe
4592	mYmaRQO.exe
3480	KTGfvOZ.exe
4556	camaYuz.exe
3324	buBQmfK.exe
3356	fgAiorG.exe
3816	DHJxYnT.exe
1800	SUwOrem.exe
4440	GFIOriy.exe
3348	ACrwQLk.exe
1036	dzofqDA.exe
1844	AmPRcuG.exe
3208	JMiKQaz.exe
1416	UauRVkX.exe
1856	BQZbkQE.exe
2816	PRQnELL.exe
2036	kmhMZBB.exe
4752	rMaGPal.exe
3064	rFoDmiG.exe
4908	LhDdRjE.exe
2156	PGUPhwU.exe
2404	BuGLDHX.exe
4076	AmjkRWD.exe
4400	pkvOasg.exe
2292	jzfVIZY.exe
2240	nZmqJGO.exe
2648	tAvdnnE.exe
3540	SceZxfQ.exe
3448	kGyycAf.exe
2016	XGktBVV.exe
1436	fTEquoZ.exe
856	CmQXmLv.exe
3864	gDfDbPd.exe
4976	RFwhCaQ.exe
1172	kwCJJXq.exe
3500	XTPYzEa.exe
1804	QXQqXcK.exe
668	PnSnXda.exe
3912	PFTMdWe.exe
4168	XPmSJNq.exe
1600	zKfRfEy.exe
3184	osEptcd.exe
4304	vKpINSX.exe
2592	JxCRbwh.exe
2052	IadvquI.exe
3104	qruTkqN.exe
3140	QquQnhv.exe
4124	EHdCZNe.exe
4248	QvsVKqQ.exe
3200	BPaXXsi.exe
3452	hVkcFlA.exe
3808	jIXcaLH.exe
2952	fCvJBeL.exe
2272	MSSpqxN.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BPaXXsi.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\tKZrWiZ.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\IroEJms.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\juDNTUu.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\dtHgkUK.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\ILcbjwg.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\PFVKDwh.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\vAgJMfA.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\UHskfoL.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\vkOIpen.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\ubWKpAW.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\dnCqCJk.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\zcPmAwl.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\zttffHU.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\VOFcPhe.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\zBmHSap.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\EYYHwmg.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\ReNfvVP.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\YOdsLXQ.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\xdsWHBM.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\UhBwbvM.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\OgeIPAE.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\yoZCOdz.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\tHMWxcD.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\sKVBGcb.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\hFNjFgb.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\zNgLKIn.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\MXkGIaT.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\QvsVKqQ.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\GSaqxkv.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\luABtpZ.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\HVawuDd.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\zUFcTLc.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\zDubLWy.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\kfBNLbk.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\TpNPeCB.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\XPmSJNq.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\mpDalHM.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\MPZDzAq.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\eIuACZk.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\aIbqkGn.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\cJnlmLH.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\yxXcCqx.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\JeJawWB.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\RRJvGgS.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\GVKBbkw.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\eQwTeZu.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\jHLjUfu.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\rHIYmPO.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\qWTNpwr.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\UHGMvRH.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\UogDeLi.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\GXEPkEX.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\oBKcTXN.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\Rkorkae.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\pgxHwgM.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\JNxyXlD.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\eUTgckw.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\lmDmGvy.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\KaNgGTe.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\wrvwUjD.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\aiGHOom.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\yKzRzgI.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
File created	C:\Windows\System\KWeboft.exe	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17044	dwm.exe
Token: SeChangeNotifyPrivilege	17044	dwm.exe
Token: 33	17044	dwm.exe
Token: SeIncBasePriorityPrivilege	17044	dwm.exe
Token: SeCreateGlobalPrivilege	16536	dwm.exe
Token: SeChangeNotifyPrivilege	16536	dwm.exe
Token: 33	16536	dwm.exe
Token: SeIncBasePriorityPrivilege	16536	dwm.exe
Token: SeShutdownPrivilege	16536	dwm.exe
Token: SeCreatePagefilePrivilege	16536	dwm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
15476	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 4032	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	84
PID 3408 wrote to memory of 4032	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	84
PID 3408 wrote to memory of 4088	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	85
PID 3408 wrote to memory of 4088	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	85
PID 3408 wrote to memory of 4052	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	86
PID 3408 wrote to memory of 4052	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	86
PID 3408 wrote to memory of 2948	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	87
PID 3408 wrote to memory of 2948	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	87
PID 3408 wrote to memory of 3868	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	88
PID 3408 wrote to memory of 3868	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	88
PID 3408 wrote to memory of 668	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	89
PID 3408 wrote to memory of 668	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	89
PID 3408 wrote to memory of 4720	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	90
PID 3408 wrote to memory of 4720	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	90
PID 3408 wrote to memory of 1484	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	91
PID 3408 wrote to memory of 1484	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	91
PID 3408 wrote to memory of 60	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	92
PID 3408 wrote to memory of 60	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	92
PID 3408 wrote to memory of 4804	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	93
PID 3408 wrote to memory of 4804	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	93
PID 3408 wrote to memory of 4592	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	94
PID 3408 wrote to memory of 4592	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	94
PID 3408 wrote to memory of 3480	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	95
PID 3408 wrote to memory of 3480	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	95
PID 3408 wrote to memory of 4556	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	96
PID 3408 wrote to memory of 4556	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	96
PID 3408 wrote to memory of 3324	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	97
PID 3408 wrote to memory of 3324	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	97
PID 3408 wrote to memory of 3356	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	98
PID 3408 wrote to memory of 3356	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	98
PID 3408 wrote to memory of 3816	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	99
PID 3408 wrote to memory of 3816	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	99
PID 3408 wrote to memory of 1800	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	100
PID 3408 wrote to memory of 1800	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	100
PID 3408 wrote to memory of 4440	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	101
PID 3408 wrote to memory of 4440	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	101
PID 3408 wrote to memory of 3348	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	102
PID 3408 wrote to memory of 3348	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	102
PID 3408 wrote to memory of 1036	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	103
PID 3408 wrote to memory of 1036	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	103
PID 3408 wrote to memory of 1844	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	104
PID 3408 wrote to memory of 1844	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	104
PID 3408 wrote to memory of 3208	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	105
PID 3408 wrote to memory of 3208	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	105
PID 3408 wrote to memory of 1416	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	106
PID 3408 wrote to memory of 1416	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	106
PID 3408 wrote to memory of 1856	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	107
PID 3408 wrote to memory of 1856	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	107
PID 3408 wrote to memory of 2816	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	108
PID 3408 wrote to memory of 2816	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	108
PID 3408 wrote to memory of 2036	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	109
PID 3408 wrote to memory of 2036	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	109
PID 3408 wrote to memory of 4752	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	110
PID 3408 wrote to memory of 4752	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	110
PID 3408 wrote to memory of 3064	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	111
PID 3408 wrote to memory of 3064	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	111
PID 3408 wrote to memory of 4908	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	112
PID 3408 wrote to memory of 4908	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	112
PID 3408 wrote to memory of 2156	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	113
PID 3408 wrote to memory of 2156	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	113
PID 3408 wrote to memory of 2404	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	114
PID 3408 wrote to memory of 2404	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	114
PID 3408 wrote to memory of 4076	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	115
PID 3408 wrote to memory of 4076	3408	5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe	115

C:\Users\Admin\AppData\Local\Temp\5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe
"C:\Users\Admin\AppData\Local\Temp\5987ca9ec8f1237481eb01dfbb087af65e76fb9561424c30b37ef2da44b68fdc.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\System\lLFVjhb.exe
  C:\Windows\System\lLFVjhb.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\wTAWgDE.exe
  C:\Windows\System\wTAWgDE.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\kYGntCJ.exe
  C:\Windows\System\kYGntCJ.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\jwJoRAq.exe
  C:\Windows\System\jwJoRAq.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\LjCPOFe.exe
  C:\Windows\System\LjCPOFe.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\PnSnXda.exe
  C:\Windows\System\PnSnXda.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\vWSnzqe.exe
  C:\Windows\System\vWSnzqe.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\oPLfeax.exe
  C:\Windows\System\oPLfeax.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\dJyrADK.exe
  C:\Windows\System\dJyrADK.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\CtEQWYS.exe
  C:\Windows\System\CtEQWYS.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\mYmaRQO.exe
  C:\Windows\System\mYmaRQO.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\KTGfvOZ.exe
  C:\Windows\System\KTGfvOZ.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\camaYuz.exe
  C:\Windows\System\camaYuz.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\buBQmfK.exe
  C:\Windows\System\buBQmfK.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\fgAiorG.exe
  C:\Windows\System\fgAiorG.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\DHJxYnT.exe
  C:\Windows\System\DHJxYnT.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\SUwOrem.exe
  C:\Windows\System\SUwOrem.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\GFIOriy.exe
  C:\Windows\System\GFIOriy.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\ACrwQLk.exe
  C:\Windows\System\ACrwQLk.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\dzofqDA.exe
  C:\Windows\System\dzofqDA.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\AmPRcuG.exe
  C:\Windows\System\AmPRcuG.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\JMiKQaz.exe
  C:\Windows\System\JMiKQaz.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\UauRVkX.exe
  C:\Windows\System\UauRVkX.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\BQZbkQE.exe
  C:\Windows\System\BQZbkQE.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\PRQnELL.exe
  C:\Windows\System\PRQnELL.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\kmhMZBB.exe
  C:\Windows\System\kmhMZBB.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\rMaGPal.exe
  C:\Windows\System\rMaGPal.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\rFoDmiG.exe
  C:\Windows\System\rFoDmiG.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\LhDdRjE.exe
  C:\Windows\System\LhDdRjE.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\PGUPhwU.exe
  C:\Windows\System\PGUPhwU.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\BuGLDHX.exe
  C:\Windows\System\BuGLDHX.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\AmjkRWD.exe
  C:\Windows\System\AmjkRWD.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\pkvOasg.exe
  C:\Windows\System\pkvOasg.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\jzfVIZY.exe
  C:\Windows\System\jzfVIZY.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\nZmqJGO.exe
  C:\Windows\System\nZmqJGO.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\tAvdnnE.exe
  C:\Windows\System\tAvdnnE.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\SceZxfQ.exe
  C:\Windows\System\SceZxfQ.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\kGyycAf.exe
  C:\Windows\System\kGyycAf.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\XGktBVV.exe
  C:\Windows\System\XGktBVV.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\fTEquoZ.exe
  C:\Windows\System\fTEquoZ.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\CmQXmLv.exe
  C:\Windows\System\CmQXmLv.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\gDfDbPd.exe
  C:\Windows\System\gDfDbPd.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\RFwhCaQ.exe
  C:\Windows\System\RFwhCaQ.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\kwCJJXq.exe
  C:\Windows\System\kwCJJXq.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\XTPYzEa.exe
  C:\Windows\System\XTPYzEa.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\QXQqXcK.exe
  C:\Windows\System\QXQqXcK.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\RDQToZf.exe
  C:\Windows\System\RDQToZf.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\jTPgikK.exe
  C:\Windows\System\jTPgikK.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\PFTMdWe.exe
  C:\Windows\System\PFTMdWe.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\XPmSJNq.exe
  C:\Windows\System\XPmSJNq.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\zKfRfEy.exe
  C:\Windows\System\zKfRfEy.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\osEptcd.exe
  C:\Windows\System\osEptcd.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\vKpINSX.exe
  C:\Windows\System\vKpINSX.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\fCvJBeL.exe
  C:\Windows\System\fCvJBeL.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\JxCRbwh.exe
  C:\Windows\System\JxCRbwh.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\IadvquI.exe
  C:\Windows\System\IadvquI.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\qruTkqN.exe
  C:\Windows\System\qruTkqN.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\QquQnhv.exe
  C:\Windows\System\QquQnhv.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\EHdCZNe.exe
  C:\Windows\System\EHdCZNe.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\QvsVKqQ.exe
  C:\Windows\System\QvsVKqQ.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\BPaXXsi.exe
  C:\Windows\System\BPaXXsi.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\hVkcFlA.exe
  C:\Windows\System\hVkcFlA.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\jIXcaLH.exe
  C:\Windows\System\jIXcaLH.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\MSSpqxN.exe
  C:\Windows\System\MSSpqxN.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\zdVSoUY.exe
  C:\Windows\System\zdVSoUY.exe
  2⤵
  PID:4728
- C:\Windows\System\tIgqmZR.exe
  C:\Windows\System\tIgqmZR.exe
  2⤵
  PID:2212
- C:\Windows\System\xfIgqXw.exe
  C:\Windows\System\xfIgqXw.exe
  2⤵
  PID:4252
- C:\Windows\System\EYYHwmg.exe
  C:\Windows\System\EYYHwmg.exe
  2⤵
  PID:3204
- C:\Windows\System\MkvURCi.exe
  C:\Windows\System\MkvURCi.exe
  2⤵
  PID:4920
- C:\Windows\System\bJpWGKm.exe
  C:\Windows\System\bJpWGKm.exe
  2⤵
  PID:4320
- C:\Windows\System\DmBSWkp.exe
  C:\Windows\System\DmBSWkp.exe
  2⤵
  PID:4704
- C:\Windows\System\IKmhylc.exe
  C:\Windows\System\IKmhylc.exe
  2⤵
  PID:4508
- C:\Windows\System\FhSgNdE.exe
  C:\Windows\System\FhSgNdE.exe
  2⤵
  PID:4760
- C:\Windows\System\viBNzwi.exe
  C:\Windows\System\viBNzwi.exe
  2⤵
  PID:780
- C:\Windows\System\HJsNogD.exe
  C:\Windows\System\HJsNogD.exe
  2⤵
  PID:2008
- C:\Windows\System\CRdTjNI.exe
  C:\Windows\System\CRdTjNI.exe
  2⤵
  PID:2528
- C:\Windows\System\RILTpWA.exe
  C:\Windows\System\RILTpWA.exe
  2⤵
  PID:4008
- C:\Windows\System\TVTeUTa.exe
  C:\Windows\System\TVTeUTa.exe
  2⤵
  PID:2704
- C:\Windows\System\WIBwOag.exe
  C:\Windows\System\WIBwOag.exe
  2⤵
  PID:1212
- C:\Windows\System\YJHOYnG.exe
  C:\Windows\System\YJHOYnG.exe
  2⤵
  PID:944
- C:\Windows\System\zcFdZGe.exe
  C:\Windows\System\zcFdZGe.exe
  2⤵
  PID:4476
- C:\Windows\System\HXQVYbJ.exe
  C:\Windows\System\HXQVYbJ.exe
  2⤵
  PID:1880
- C:\Windows\System\EdqKWEz.exe
  C:\Windows\System\EdqKWEz.exe
  2⤵
  PID:5072
- C:\Windows\System\GSaqxkv.exe
  C:\Windows\System\GSaqxkv.exe
  2⤵
  PID:216
- C:\Windows\System\OESvlUC.exe
  C:\Windows\System\OESvlUC.exe
  2⤵
  PID:4968
- C:\Windows\System\gWhHYVz.exe
  C:\Windows\System\gWhHYVz.exe
  2⤵
  PID:3528
- C:\Windows\System\gdSoxNq.exe
  C:\Windows\System\gdSoxNq.exe
  2⤵
  PID:1244
- C:\Windows\System\KtjgCdJ.exe
  C:\Windows\System\KtjgCdJ.exe
  2⤵
  PID:3096
- C:\Windows\System\OgeIPAE.exe
  C:\Windows\System\OgeIPAE.exe
  2⤵
  PID:2304
- C:\Windows\System\iJfgLNj.exe
  C:\Windows\System\iJfgLNj.exe
  2⤵
  PID:5136
- C:\Windows\System\ZIoNPFZ.exe
  C:\Windows\System\ZIoNPFZ.exe
  2⤵
  PID:5372
- C:\Windows\System\HutinMh.exe
  C:\Windows\System\HutinMh.exe
  2⤵
  PID:5388
- C:\Windows\System\EMeFaxb.exe
  C:\Windows\System\EMeFaxb.exe
  2⤵
  PID:5404
- C:\Windows\System\KjDJtCh.exe
  C:\Windows\System\KjDJtCh.exe
  2⤵
  PID:5420
- C:\Windows\System\zTDCZnh.exe
  C:\Windows\System\zTDCZnh.exe
  2⤵
  PID:5436
- C:\Windows\System\RhCKUPq.exe
  C:\Windows\System\RhCKUPq.exe
  2⤵
  PID:5452
- C:\Windows\System\rrnKXoV.exe
  C:\Windows\System\rrnKXoV.exe
  2⤵
  PID:5468
- C:\Windows\System\OewVjti.exe
  C:\Windows\System\OewVjti.exe
  2⤵
  PID:5488
- C:\Windows\System\TuoTOFa.exe
  C:\Windows\System\TuoTOFa.exe
  2⤵
  PID:5504
- C:\Windows\System\YkOqqCy.exe
  C:\Windows\System\YkOqqCy.exe
  2⤵
  PID:5524
- C:\Windows\System\xVtTfRf.exe
  C:\Windows\System\xVtTfRf.exe
  2⤵
  PID:5540
- C:\Windows\System\vsbsriA.exe
  C:\Windows\System\vsbsriA.exe
  2⤵
  PID:5556
- C:\Windows\System\odEVWiy.exe
  C:\Windows\System\odEVWiy.exe
  2⤵
  PID:5576
- C:\Windows\System\GnHveph.exe
  C:\Windows\System\GnHveph.exe
  2⤵
  PID:5592
- C:\Windows\System\ONBsVRT.exe
  C:\Windows\System\ONBsVRT.exe
  2⤵
  PID:5608
- C:\Windows\System\yKzRzgI.exe
  C:\Windows\System\yKzRzgI.exe
  2⤵
  PID:5624
- C:\Windows\System\nldWIOc.exe
  C:\Windows\System\nldWIOc.exe
  2⤵
  PID:5640
- C:\Windows\System\ZJjynKD.exe
  C:\Windows\System\ZJjynKD.exe
  2⤵
  PID:5856
- C:\Windows\System\rdIJlqs.exe
  C:\Windows\System\rdIJlqs.exe
  2⤵
  PID:5872
- C:\Windows\System\xXWomvF.exe
  C:\Windows\System\xXWomvF.exe
  2⤵
  PID:5888
- C:\Windows\System\bPXTJWG.exe
  C:\Windows\System\bPXTJWG.exe
  2⤵
  PID:5904
- C:\Windows\System\eYCfpRg.exe
  C:\Windows\System\eYCfpRg.exe
  2⤵
  PID:5920
- C:\Windows\System\WFHSCEJ.exe
  C:\Windows\System\WFHSCEJ.exe
  2⤵
  PID:5936
- C:\Windows\System\MbZdsUe.exe
  C:\Windows\System\MbZdsUe.exe
  2⤵
  PID:5952
- C:\Windows\System\jTOnhXG.exe
  C:\Windows\System\jTOnhXG.exe
  2⤵
  PID:5968
- C:\Windows\System\wryDnro.exe
  C:\Windows\System\wryDnro.exe
  2⤵
  PID:5984
- C:\Windows\System\CHmJptL.exe
  C:\Windows\System\CHmJptL.exe
  2⤵
  PID:6000
- C:\Windows\System\QZBlEeD.exe
  C:\Windows\System\QZBlEeD.exe
  2⤵
  PID:6016
- C:\Windows\System\lavRtva.exe
  C:\Windows\System\lavRtva.exe
  2⤵
  PID:6032
- C:\Windows\System\jAHTFdl.exe
  C:\Windows\System\jAHTFdl.exe
  2⤵
  PID:4012
- C:\Windows\System\WXFtRKV.exe
  C:\Windows\System\WXFtRKV.exe
  2⤵
  PID:4328
- C:\Windows\System\jYlekEc.exe
  C:\Windows\System\jYlekEc.exe
  2⤵
  PID:1400
- C:\Windows\System\QWWbjgB.exe
  C:\Windows\System\QWWbjgB.exe
  2⤵
  PID:3328
- C:\Windows\System\daqJJTl.exe
  C:\Windows\System\daqJJTl.exe
  2⤵
  PID:2640
- C:\Windows\System\icazQpW.exe
  C:\Windows\System\icazQpW.exe
  2⤵
  PID:3472
- C:\Windows\System\IroijTH.exe
  C:\Windows\System\IroijTH.exe
  2⤵
  PID:2176
- C:\Windows\System\EWbGXVY.exe
  C:\Windows\System\EWbGXVY.exe
  2⤵
  PID:4640
- C:\Windows\System\ecoFXmn.exe
  C:\Windows\System\ecoFXmn.exe
  2⤵
  PID:2204
- C:\Windows\System\HZoMxNI.exe
  C:\Windows\System\HZoMxNI.exe
  2⤵
  PID:4724
- C:\Windows\System\EktuGTw.exe
  C:\Windows\System\EktuGTw.exe
  2⤵
  PID:5444
- C:\Windows\System\pemVgkB.exe
  C:\Windows\System\pemVgkB.exe
  2⤵
  PID:2692
- C:\Windows\System\tIybUea.exe
  C:\Windows\System\tIybUea.exe
  2⤵
  PID:4860
- C:\Windows\System\tUroKEY.exe
  C:\Windows\System\tUroKEY.exe
  2⤵
  PID:5144
- C:\Windows\System\InZPUOH.exe
  C:\Windows\System\InZPUOH.exe
  2⤵
  PID:5188
- C:\Windows\System\pgxHwgM.exe
  C:\Windows\System\pgxHwgM.exe
  2⤵
  PID:5236
- C:\Windows\System\yvEyCVc.exe
  C:\Windows\System\yvEyCVc.exe
  2⤵
  PID:5292
- C:\Windows\System\tKZrWiZ.exe
  C:\Windows\System\tKZrWiZ.exe
  2⤵
  PID:5380
- C:\Windows\System\WBzdidE.exe
  C:\Windows\System\WBzdidE.exe
  2⤵
  PID:5428
- C:\Windows\System\OkvcZUO.exe
  C:\Windows\System\OkvcZUO.exe
  2⤵
  PID:5460
- C:\Windows\System\UZzZdeH.exe
  C:\Windows\System\UZzZdeH.exe
  2⤵
  PID:5548
- C:\Windows\System\cIzUvOQ.exe
  C:\Windows\System\cIzUvOQ.exe
  2⤵
  PID:4756
- C:\Windows\System\QnWllNv.exe
  C:\Windows\System\QnWllNv.exe
  2⤵
  PID:5728
- C:\Windows\System\XJkaCYr.exe
  C:\Windows\System\XJkaCYr.exe
  2⤵
  PID:5668
- C:\Windows\System\kWgmaUr.exe
  C:\Windows\System\kWgmaUr.exe
  2⤵
  PID:5600
- C:\Windows\System\JAcjuVd.exe
  C:\Windows\System\JAcjuVd.exe
  2⤵
  PID:5752
- C:\Windows\System\nBLYTYO.exe
  C:\Windows\System\nBLYTYO.exe
  2⤵
  PID:5808
- C:\Windows\System\rHxgRRX.exe
  C:\Windows\System\rHxgRRX.exe
  2⤵
  PID:5896
- C:\Windows\System\kuLbPdG.exe
  C:\Windows\System\kuLbPdG.exe
  2⤵
  PID:5960
- C:\Windows\System\ugtZccZ.exe
  C:\Windows\System\ugtZccZ.exe
  2⤵
  PID:6008
- C:\Windows\System\rqmaPSz.exe
  C:\Windows\System\rqmaPSz.exe
  2⤵
  PID:6048
- C:\Windows\System\pJsclAO.exe
  C:\Windows\System\pJsclAO.exe
  2⤵
  PID:2680
- C:\Windows\System\RMBLOrL.exe
  C:\Windows\System\RMBLOrL.exe
  2⤵
  PID:672
- C:\Windows\System\yWmmBMq.exe
  C:\Windows\System\yWmmBMq.exe
  2⤵
  PID:2360
- C:\Windows\System\nTRQKUQ.exe
  C:\Windows\System\nTRQKUQ.exe
  2⤵
  PID:3676
- C:\Windows\System\zqjXcRb.exe
  C:\Windows\System\zqjXcRb.exe
  2⤵
  PID:3560
- C:\Windows\System\ILcbjwg.exe
  C:\Windows\System\ILcbjwg.exe
  2⤵
  PID:1348
- C:\Windows\System\JGedHkX.exe
  C:\Windows\System\JGedHkX.exe
  2⤵
  PID:4956
- C:\Windows\System\jHLjUfu.exe
  C:\Windows\System\jHLjUfu.exe
  2⤵
  PID:2984
- C:\Windows\System\WJCbWPy.exe
  C:\Windows\System\WJCbWPy.exe
  2⤵
  PID:3708
- C:\Windows\System\RiaNfas.exe
  C:\Windows\System\RiaNfas.exe
  2⤵
  PID:2024
- C:\Windows\System\tukEqnF.exe
  C:\Windows\System\tukEqnF.exe
  2⤵
  PID:4768
- C:\Windows\System\FfYFzrH.exe
  C:\Windows\System\FfYFzrH.exe
  2⤵
  PID:4388
- C:\Windows\System\XuqEIMg.exe
  C:\Windows\System\XuqEIMg.exe
  2⤵
  PID:5256
- C:\Windows\System\EdWhpgc.exe
  C:\Windows\System\EdWhpgc.exe
  2⤵
  PID:5480
- C:\Windows\System\IYjlqfU.exe
  C:\Windows\System\IYjlqfU.exe
  2⤵
  PID:5448
- C:\Windows\System\KWeboft.exe
  C:\Windows\System\KWeboft.exe
  2⤵
  PID:5692
- C:\Windows\System\eFJWCeQ.exe
  C:\Windows\System\eFJWCeQ.exe
  2⤵
  PID:5616
- C:\Windows\System\gGeITff.exe
  C:\Windows\System\gGeITff.exe
  2⤵
  PID:5880
- C:\Windows\System\nUpUbBf.exe
  C:\Windows\System\nUpUbBf.exe
  2⤵
  PID:6028
- C:\Windows\System\rJDvtZh.exe
  C:\Windows\System\rJDvtZh.exe
  2⤵
  PID:3928
- C:\Windows\System\hIaarTX.exe
  C:\Windows\System\hIaarTX.exe
  2⤵
  PID:1640
- C:\Windows\System\snJwruM.exe
  C:\Windows\System\snJwruM.exe
  2⤵
  PID:2736
- C:\Windows\System\yrsdroM.exe
  C:\Windows\System\yrsdroM.exe
  2⤵
  PID:2788
- C:\Windows\System\OgvNRpo.exe
  C:\Windows\System\OgvNRpo.exe
  2⤵
  PID:1260
- C:\Windows\System\CwlVctM.exe
  C:\Windows\System\CwlVctM.exe
  2⤵
  PID:2000
- C:\Windows\System\HsWltyL.exe
  C:\Windows\System\HsWltyL.exe
  2⤵
  PID:5148
- C:\Windows\System\PCOyfZJ.exe
  C:\Windows\System\PCOyfZJ.exe
  2⤵
  PID:5016
- C:\Windows\System\zttffHU.exe
  C:\Windows\System\zttffHU.exe
  2⤵
  PID:5124
- C:\Windows\System\hiUclOs.exe
  C:\Windows\System\hiUclOs.exe
  2⤵
  PID:3052
- C:\Windows\System\svxOwxc.exe
  C:\Windows\System\svxOwxc.exe
  2⤵
  PID:2628
- C:\Windows\System\EDvwSkJ.exe
  C:\Windows\System\EDvwSkJ.exe
  2⤵
  PID:5676
- C:\Windows\System\JNxyXlD.exe
  C:\Windows\System\JNxyXlD.exe
  2⤵
  PID:6172
- C:\Windows\System\bgyiKGw.exe
  C:\Windows\System\bgyiKGw.exe
  2⤵
  PID:6208
- C:\Windows\System\CVpaehZ.exe
  C:\Windows\System\CVpaehZ.exe
  2⤵
  PID:6236
- C:\Windows\System\iMewApI.exe
  C:\Windows\System\iMewApI.exe
  2⤵
  PID:6256
- C:\Windows\System\WphwmQb.exe
  C:\Windows\System\WphwmQb.exe
  2⤵
  PID:6272
- C:\Windows\System\fzDTjEG.exe
  C:\Windows\System\fzDTjEG.exe
  2⤵
  PID:6300
- C:\Windows\System\SmCPHXu.exe
  C:\Windows\System\SmCPHXu.exe
  2⤵
  PID:6332
- C:\Windows\System\OrCOaez.exe
  C:\Windows\System\OrCOaez.exe
  2⤵
  PID:6364
- C:\Windows\System\RHatnLu.exe
  C:\Windows\System\RHatnLu.exe
  2⤵
  PID:6396
- C:\Windows\System\xUNuQOW.exe
  C:\Windows\System\xUNuQOW.exe
  2⤵
  PID:6428
- C:\Windows\System\QQxOxtc.exe
  C:\Windows\System\QQxOxtc.exe
  2⤵
  PID:6464
- C:\Windows\System\IkslghI.exe
  C:\Windows\System\IkslghI.exe
  2⤵
  PID:6492
- C:\Windows\System\ieKefHy.exe
  C:\Windows\System\ieKefHy.exe
  2⤵
  PID:6520
- C:\Windows\System\JWgxXaY.exe
  C:\Windows\System\JWgxXaY.exe
  2⤵
  PID:6548
- C:\Windows\System\gSegKNo.exe
  C:\Windows\System\gSegKNo.exe
  2⤵
  PID:6580
- C:\Windows\System\ljMLbzE.exe
  C:\Windows\System\ljMLbzE.exe
  2⤵
  PID:6616
- C:\Windows\System\uuHxNUg.exe
  C:\Windows\System\uuHxNUg.exe
  2⤵
  PID:6644
- C:\Windows\System\wKsilPA.exe
  C:\Windows\System\wKsilPA.exe
  2⤵
  PID:6672
- C:\Windows\System\kMfCEZL.exe
  C:\Windows\System\kMfCEZL.exe
  2⤵
  PID:6696
- C:\Windows\System\PnaHxeT.exe
  C:\Windows\System\PnaHxeT.exe
  2⤵
  PID:6728
- C:\Windows\System\tPtpHqz.exe
  C:\Windows\System\tPtpHqz.exe
  2⤵
  PID:6744
- C:\Windows\System\lqdqvpz.exe
  C:\Windows\System\lqdqvpz.exe
  2⤵
  PID:6772
- C:\Windows\System\slaATyS.exe
  C:\Windows\System\slaATyS.exe
  2⤵
  PID:6800
- C:\Windows\System\XGgguwp.exe
  C:\Windows\System\XGgguwp.exe
  2⤵
  PID:6836
- C:\Windows\System\eXAGNWM.exe
  C:\Windows\System\eXAGNWM.exe
  2⤵
  PID:6868
- C:\Windows\System\BGoXNhG.exe
  C:\Windows\System\BGoXNhG.exe
  2⤵
  PID:6896
- C:\Windows\System\AFKvEem.exe
  C:\Windows\System\AFKvEem.exe
  2⤵
  PID:6916
- C:\Windows\System\INJhWvY.exe
  C:\Windows\System\INJhWvY.exe
  2⤵
  PID:6932
- C:\Windows\System\WUTnfdt.exe
  C:\Windows\System\WUTnfdt.exe
  2⤵
  PID:6960
- C:\Windows\System\ZwwhBHm.exe
  C:\Windows\System\ZwwhBHm.exe
  2⤵
  PID:6980
- C:\Windows\System\naphwPF.exe
  C:\Windows\System\naphwPF.exe
  2⤵
  PID:7008
- C:\Windows\System\abwHrzu.exe
  C:\Windows\System\abwHrzu.exe
  2⤵
  PID:7036
- C:\Windows\System\reRSpaz.exe
  C:\Windows\System\reRSpaz.exe
  2⤵
  PID:7060
- C:\Windows\System\zFwiUxx.exe
  C:\Windows\System\zFwiUxx.exe
  2⤵
  PID:7088
- C:\Windows\System\YOLrHhL.exe
  C:\Windows\System\YOLrHhL.exe
  2⤵
  PID:7124
- C:\Windows\System\jqcavWg.exe
  C:\Windows\System\jqcavWg.exe
  2⤵
  PID:7152
- C:\Windows\System\wMbIjpy.exe
  C:\Windows\System\wMbIjpy.exe
  2⤵
  PID:5768
- C:\Windows\System\AWZRuZm.exe
  C:\Windows\System\AWZRuZm.exe
  2⤵
  PID:6188
- C:\Windows\System\HplGfvX.exe
  C:\Windows\System\HplGfvX.exe
  2⤵
  PID:6252
- C:\Windows\System\UGOclzO.exe
  C:\Windows\System\UGOclzO.exe
  2⤵
  PID:6316
- C:\Windows\System\sRiAuCv.exe
  C:\Windows\System\sRiAuCv.exe
  2⤵
  PID:6360
- C:\Windows\System\KfEqShI.exe
  C:\Windows\System\KfEqShI.exe
  2⤵
  PID:6476
- C:\Windows\System\deeLUcP.exe
  C:\Windows\System\deeLUcP.exe
  2⤵
  PID:6504
- C:\Windows\System\gjsvuMC.exe
  C:\Windows\System\gjsvuMC.exe
  2⤵
  PID:6600
- C:\Windows\System\TOhMJIN.exe
  C:\Windows\System\TOhMJIN.exe
  2⤵
  PID:6632
- C:\Windows\System\CgIdYch.exe
  C:\Windows\System\CgIdYch.exe
  2⤵
  PID:6668
- C:\Windows\System\dSlxqMe.exe
  C:\Windows\System\dSlxqMe.exe
  2⤵
  PID:6716
- C:\Windows\System\haKTtXY.exe
  C:\Windows\System\haKTtXY.exe
  2⤵
  PID:6764
- C:\Windows\System\fyAkpWt.exe
  C:\Windows\System\fyAkpWt.exe
  2⤵
  PID:6796
- C:\Windows\System\WBFSUwJ.exe
  C:\Windows\System\WBFSUwJ.exe
  2⤵
  PID:6852
- C:\Windows\System\uYtQROS.exe
  C:\Windows\System\uYtQROS.exe
  2⤵
  PID:6888
- C:\Windows\System\ZPTZUkC.exe
  C:\Windows\System\ZPTZUkC.exe
  2⤵
  PID:6948
- C:\Windows\System\DGWdHOg.exe
  C:\Windows\System\DGWdHOg.exe
  2⤵
  PID:7028
- C:\Windows\System\VtmCLIz.exe
  C:\Windows\System\VtmCLIz.exe
  2⤵
  PID:6976
- C:\Windows\System\QZSxSep.exe
  C:\Windows\System\QZSxSep.exe
  2⤵
  PID:7052
- C:\Windows\System\caVmzAu.exe
  C:\Windows\System\caVmzAu.exe
  2⤵
  PID:7104
- C:\Windows\System\ReNfvVP.exe
  C:\Windows\System\ReNfvVP.exe
  2⤵
  PID:7148
- C:\Windows\System\OqVUnTz.exe
  C:\Windows\System\OqVUnTz.exe
  2⤵
  PID:6268
- C:\Windows\System\QvmXLQp.exe
  C:\Windows\System\QvmXLQp.exe
  2⤵
  PID:6248
- C:\Windows\System\FTKkTIo.exe
  C:\Windows\System\FTKkTIo.exe
  2⤵
  PID:6420
- C:\Windows\System\CuteIXQ.exe
  C:\Windows\System\CuteIXQ.exe
  2⤵
  PID:6904
- C:\Windows\System\zsUievn.exe
  C:\Windows\System\zsUievn.exe
  2⤵
  PID:6856
- C:\Windows\System\uIjDBhX.exe
  C:\Windows\System\uIjDBhX.exe
  2⤵
  PID:6788
- C:\Windows\System\tiQggRw.exe
  C:\Windows\System\tiQggRw.exe
  2⤵
  PID:6612
- C:\Windows\System\kdXiYez.exe
  C:\Windows\System\kdXiYez.exe
  2⤵
  PID:7184
- C:\Windows\System\trrArLu.exe
  C:\Windows\System\trrArLu.exe
  2⤵
  PID:7220
- C:\Windows\System\sgLyzKa.exe
  C:\Windows\System\sgLyzKa.exe
  2⤵
  PID:7252
- C:\Windows\System\YOdsLXQ.exe
  C:\Windows\System\YOdsLXQ.exe
  2⤵
  PID:7284
- C:\Windows\System\MdRFhVJ.exe
  C:\Windows\System\MdRFhVJ.exe
  2⤵
  PID:7324
- C:\Windows\System\NDDvAsZ.exe
  C:\Windows\System\NDDvAsZ.exe
  2⤵
  PID:7356
- C:\Windows\System\RaUXApX.exe
  C:\Windows\System\RaUXApX.exe
  2⤵
  PID:7388
- C:\Windows\System\NYRiBrz.exe
  C:\Windows\System\NYRiBrz.exe
  2⤵
  PID:7416
- C:\Windows\System\rqObTFl.exe
  C:\Windows\System\rqObTFl.exe
  2⤵
  PID:7440
- C:\Windows\System\AKKYnBw.exe
  C:\Windows\System\AKKYnBw.exe
  2⤵
  PID:7476
- C:\Windows\System\IHLStEC.exe
  C:\Windows\System\IHLStEC.exe
  2⤵
  PID:7500
- C:\Windows\System\eJPnjMl.exe
  C:\Windows\System\eJPnjMl.exe
  2⤵
  PID:7532
- C:\Windows\System\UHaFlXx.exe
  C:\Windows\System\UHaFlXx.exe
  2⤵
  PID:7564
- C:\Windows\System\bOCSbAW.exe
  C:\Windows\System\bOCSbAW.exe
  2⤵
  PID:7600
- C:\Windows\System\InAMXDz.exe
  C:\Windows\System\InAMXDz.exe
  2⤵
  PID:7624
- C:\Windows\System\sIBrNKn.exe
  C:\Windows\System\sIBrNKn.exe
  2⤵
  PID:7656
- C:\Windows\System\luABtpZ.exe
  C:\Windows\System\luABtpZ.exe
  2⤵
  PID:7688
- C:\Windows\System\EElGqRE.exe
  C:\Windows\System\EElGqRE.exe
  2⤵
  PID:7712
- C:\Windows\System\NCfOzWQ.exe
  C:\Windows\System\NCfOzWQ.exe
  2⤵
  PID:7748
- C:\Windows\System\OFIxkcl.exe
  C:\Windows\System\OFIxkcl.exe
  2⤵
  PID:7776
- C:\Windows\System\anDwwkF.exe
  C:\Windows\System\anDwwkF.exe
  2⤵
  PID:7812
- C:\Windows\System\rHIYmPO.exe
  C:\Windows\System\rHIYmPO.exe
  2⤵
  PID:7844
- C:\Windows\System\khcdsVh.exe
  C:\Windows\System\khcdsVh.exe
  2⤵
  PID:7876
- C:\Windows\System\lThZuRY.exe
  C:\Windows\System\lThZuRY.exe
  2⤵
  PID:7900
- C:\Windows\System\BrLJVxe.exe
  C:\Windows\System\BrLJVxe.exe
  2⤵
  PID:7928
- C:\Windows\System\kMPVzsp.exe
  C:\Windows\System\kMPVzsp.exe
  2⤵
  PID:7964
- C:\Windows\System\GXEPkEX.exe
  C:\Windows\System\GXEPkEX.exe
  2⤵
  PID:7992
- C:\Windows\System\JvsytTA.exe
  C:\Windows\System\JvsytTA.exe
  2⤵
  PID:8028
- C:\Windows\System\InzZYfK.exe
  C:\Windows\System\InzZYfK.exe
  2⤵
  PID:8064
- C:\Windows\System\qvnGnGv.exe
  C:\Windows\System\qvnGnGv.exe
  2⤵
  PID:8092
- C:\Windows\System\XXWZENF.exe
  C:\Windows\System\XXWZENF.exe
  2⤵
  PID:8124
- C:\Windows\System\ZZXEgAt.exe
  C:\Windows\System\ZZXEgAt.exe
  2⤵
  PID:8148
- C:\Windows\System\NjuBOxn.exe
  C:\Windows\System\NjuBOxn.exe
  2⤵
  PID:8180
- C:\Windows\System\ulPpeuN.exe
  C:\Windows\System\ulPpeuN.exe
  2⤵
  PID:4864
- C:\Windows\System\RTFCSgK.exe
  C:\Windows\System\RTFCSgK.exe
  2⤵
  PID:6312
- C:\Windows\System\FetTrnZ.exe
  C:\Windows\System\FetTrnZ.exe
  2⤵
  PID:7244
- C:\Windows\System\fbtgUOj.exe
  C:\Windows\System\fbtgUOj.exe
  2⤵
  PID:6944
- C:\Windows\System\XGAXdCU.exe
  C:\Windows\System\XGAXdCU.exe
  2⤵
  PID:7264
- C:\Windows\System\eoUCeEq.exe
  C:\Windows\System\eoUCeEq.exe
  2⤵
  PID:7436
- C:\Windows\System\PBlbRjL.exe
  C:\Windows\System\PBlbRjL.exe
  2⤵
  PID:7340
- C:\Windows\System\KjEyjQY.exe
  C:\Windows\System\KjEyjQY.exe
  2⤵
  PID:7488
- C:\Windows\System\XijfBKe.exe
  C:\Windows\System\XijfBKe.exe
  2⤵
  PID:7612
- C:\Windows\System\ncqNCAh.exe
  C:\Windows\System\ncqNCAh.exe
  2⤵
  PID:7700
- C:\Windows\System\ZkSkkIu.exe
  C:\Windows\System\ZkSkkIu.exe
  2⤵
  PID:7672
- C:\Windows\System\MBezTHu.exe
  C:\Windows\System\MBezTHu.exe
  2⤵
  PID:7768
- C:\Windows\System\sxitQtH.exe
  C:\Windows\System\sxitQtH.exe
  2⤵
  PID:7860
- C:\Windows\System\oBKcTXN.exe
  C:\Windows\System\oBKcTXN.exe
  2⤵
  PID:7960
- C:\Windows\System\KSGgmmB.exe
  C:\Windows\System\KSGgmmB.exe
  2⤵
  PID:7948
- C:\Windows\System\FyLfFBi.exe
  C:\Windows\System\FyLfFBi.exe
  2⤵
  PID:8020
- C:\Windows\System\ieHaaBH.exe
  C:\Windows\System\ieHaaBH.exe
  2⤵
  PID:8084
- C:\Windows\System\eAIoRhp.exe
  C:\Windows\System\eAIoRhp.exe
  2⤵
  PID:8116
- C:\Windows\System\hrzYZmi.exe
  C:\Windows\System\hrzYZmi.exe
  2⤵
  PID:6828
- C:\Windows\System\uazqPEJ.exe
  C:\Windows\System\uazqPEJ.exe
  2⤵
  PID:7344
- C:\Windows\System\oZfilep.exe
  C:\Windows\System\oZfilep.exe
  2⤵
  PID:6968
- C:\Windows\System\wMAKhci.exe
  C:\Windows\System\wMAKhci.exe
  2⤵
  PID:7276
- C:\Windows\System\BVCJkAb.exe
  C:\Windows\System\BVCJkAb.exe
  2⤵
  PID:7496
- C:\Windows\System\IAWaAbf.exe
  C:\Windows\System\IAWaAbf.exe
  2⤵
  PID:7792
- C:\Windows\System\wkTFZDO.exe
  C:\Windows\System\wkTFZDO.exe
  2⤵
  PID:8016
- C:\Windows\System\xMNtlWG.exe
  C:\Windows\System\xMNtlWG.exe
  2⤵
  PID:7888
- C:\Windows\System\wJIbaxA.exe
  C:\Windows\System\wJIbaxA.exe
  2⤵
  PID:8108
- C:\Windows\System\gygsdTm.exe
  C:\Windows\System\gygsdTm.exe
  2⤵
  PID:6988
- C:\Windows\System\zsPSwwF.exe
  C:\Windows\System\zsPSwwF.exe
  2⤵
  PID:7620
- C:\Windows\System\AxKWBfK.exe
  C:\Windows\System\AxKWBfK.exe
  2⤵
  PID:7732
- C:\Windows\System\afxTbdq.exe
  C:\Windows\System\afxTbdq.exe
  2⤵
  PID:8160
- C:\Windows\System\hPzPVOL.exe
  C:\Windows\System\hPzPVOL.exe
  2⤵
  PID:8212
- C:\Windows\System\VqjdDSf.exe
  C:\Windows\System\VqjdDSf.exe
  2⤵
  PID:8232
- C:\Windows\System\KaNgGTe.exe
  C:\Windows\System\KaNgGTe.exe
  2⤵
  PID:8260
- C:\Windows\System\mpDalHM.exe
  C:\Windows\System\mpDalHM.exe
  2⤵
  PID:8292
- C:\Windows\System\ZchPtek.exe
  C:\Windows\System\ZchPtek.exe
  2⤵
  PID:8324
- C:\Windows\System\qmUCVSG.exe
  C:\Windows\System\qmUCVSG.exe
  2⤵
  PID:8356
- C:\Windows\System\aDsUAKg.exe
  C:\Windows\System\aDsUAKg.exe
  2⤵
  PID:8384
- C:\Windows\System\fsRYJdl.exe
  C:\Windows\System\fsRYJdl.exe
  2⤵
  PID:8416
- C:\Windows\System\SDkOOjw.exe
  C:\Windows\System\SDkOOjw.exe
  2⤵
  PID:8444
- C:\Windows\System\sisfiky.exe
  C:\Windows\System\sisfiky.exe
  2⤵
  PID:8488
- C:\Windows\System\QttFNDX.exe
  C:\Windows\System\QttFNDX.exe
  2⤵
  PID:8512
- C:\Windows\System\FmweMJa.exe
  C:\Windows\System\FmweMJa.exe
  2⤵
  PID:8532
- C:\Windows\System\wrvwUjD.exe
  C:\Windows\System\wrvwUjD.exe
  2⤵
  PID:8564
- C:\Windows\System\csEFgnp.exe
  C:\Windows\System\csEFgnp.exe
  2⤵
  PID:8604
- C:\Windows\System\JishTPV.exe
  C:\Windows\System\JishTPV.exe
  2⤵
  PID:8628
- C:\Windows\System\OMrOZOL.exe
  C:\Windows\System\OMrOZOL.exe
  2⤵
  PID:8656
- C:\Windows\System\iqjGsZG.exe
  C:\Windows\System\iqjGsZG.exe
  2⤵
  PID:8684
- C:\Windows\System\lzAvJxH.exe
  C:\Windows\System\lzAvJxH.exe
  2⤵
  PID:8704
- C:\Windows\System\pMCCzvn.exe
  C:\Windows\System\pMCCzvn.exe
  2⤵
  PID:8732
- C:\Windows\System\enRtGdH.exe
  C:\Windows\System\enRtGdH.exe
  2⤵
  PID:8764
- C:\Windows\System\jmFLaSe.exe
  C:\Windows\System\jmFLaSe.exe
  2⤵
  PID:8796
- C:\Windows\System\EyHpitA.exe
  C:\Windows\System\EyHpitA.exe
  2⤵
  PID:8828
- C:\Windows\System\NjDkYTQ.exe
  C:\Windows\System\NjDkYTQ.exe
  2⤵
  PID:8868
- C:\Windows\System\OXWQkgy.exe
  C:\Windows\System\OXWQkgy.exe
  2⤵
  PID:8900
- C:\Windows\System\SvhVPjD.exe
  C:\Windows\System\SvhVPjD.exe
  2⤵
  PID:8920
- C:\Windows\System\IroEJms.exe
  C:\Windows\System\IroEJms.exe
  2⤵
  PID:8964
- C:\Windows\System\IPiSlPu.exe
  C:\Windows\System\IPiSlPu.exe
  2⤵
  PID:8992
- C:\Windows\System\OtaAQCY.exe
  C:\Windows\System\OtaAQCY.exe
  2⤵
  PID:9024
- C:\Windows\System\KcGiqix.exe
  C:\Windows\System\KcGiqix.exe
  2⤵
  PID:9052
- C:\Windows\System\yxSTxNC.exe
  C:\Windows\System\yxSTxNC.exe
  2⤵
  PID:9068
- C:\Windows\System\xdsWHBM.exe
  C:\Windows\System\xdsWHBM.exe
  2⤵
  PID:9088
- C:\Windows\System\PmKlOJm.exe
  C:\Windows\System\PmKlOJm.exe
  2⤵
  PID:9108
- C:\Windows\System\AAxwaSD.exe
  C:\Windows\System\AAxwaSD.exe
  2⤵
  PID:9128
- C:\Windows\System\LbjqEgN.exe
  C:\Windows\System\LbjqEgN.exe
  2⤵
  PID:9148
- C:\Windows\System\qWTNpwr.exe
  C:\Windows\System\qWTNpwr.exe
  2⤵
  PID:9184
- C:\Windows\System\MSzqPTj.exe
  C:\Windows\System\MSzqPTj.exe
  2⤵
  PID:9208
- C:\Windows\System\akjmLzd.exe
  C:\Windows\System\akjmLzd.exe
  2⤵
  PID:8196
- C:\Windows\System\iffVRrI.exe
  C:\Windows\System\iffVRrI.exe
  2⤵
  PID:8280
- C:\Windows\System\nYRAjMZ.exe
  C:\Windows\System\nYRAjMZ.exe
  2⤵
  PID:8272
- C:\Windows\System\gGdKOXq.exe
  C:\Windows\System\gGdKOXq.exe
  2⤵
  PID:8308
- C:\Windows\System\GiPeblx.exe
  C:\Windows\System\GiPeblx.exe
  2⤵
  PID:8436
- C:\Windows\System\pSgVjWI.exe
  C:\Windows\System\pSgVjWI.exe
  2⤵
  PID:8472
- C:\Windows\System\YGOaiPs.exe
  C:\Windows\System\YGOaiPs.exe
  2⤵
  PID:8576
- C:\Windows\System\HROKJnb.exe
  C:\Windows\System\HROKJnb.exe
  2⤵
  PID:8644
- C:\Windows\System\EJnyyxI.exe
  C:\Windows\System\EJnyyxI.exe
  2⤵
  PID:8700
- C:\Windows\System\dkxYGuo.exe
  C:\Windows\System\dkxYGuo.exe
  2⤵
  PID:8756
- C:\Windows\System\LvCUPxH.exe
  C:\Windows\System\LvCUPxH.exe
  2⤵
  PID:8788
- C:\Windows\System\KlNNMjt.exe
  C:\Windows\System\KlNNMjt.exe
  2⤵
  PID:8884
- C:\Windows\System\ACtDUxs.exe
  C:\Windows\System\ACtDUxs.exe
  2⤵
  PID:8948
- C:\Windows\System\YwjBjol.exe
  C:\Windows\System\YwjBjol.exe
  2⤵
  PID:9036
- C:\Windows\System\uTfMNMt.exe
  C:\Windows\System\uTfMNMt.exe
  2⤵
  PID:9116
- C:\Windows\System\lopMQOC.exe
  C:\Windows\System\lopMQOC.exe
  2⤵
  PID:9124
- C:\Windows\System\NILPEjU.exe
  C:\Windows\System\NILPEjU.exe
  2⤵
  PID:9196
- C:\Windows\System\zXsJkBa.exe
  C:\Windows\System\zXsJkBa.exe
  2⤵
  PID:8372
- C:\Windows\System\yoZCOdz.exe
  C:\Windows\System\yoZCOdz.exe
  2⤵
  PID:8440
- C:\Windows\System\aqPxOBJ.exe
  C:\Windows\System\aqPxOBJ.exe
  2⤵
  PID:8456
- C:\Windows\System\ljcvwNi.exe
  C:\Windows\System\ljcvwNi.exe
  2⤵
  PID:8588
- C:\Windows\System\GzjzKTt.exe
  C:\Windows\System\GzjzKTt.exe
  2⤵
  PID:9000
- C:\Windows\System\gcSSMxw.exe
  C:\Windows\System\gcSSMxw.exe
  2⤵
  PID:9096
- C:\Windows\System\ccZsshw.exe
  C:\Windows\System\ccZsshw.exe
  2⤵
  PID:7824
- C:\Windows\System\xJQBIUS.exe
  C:\Windows\System\xJQBIUS.exe
  2⤵
  PID:8228
- C:\Windows\System\jgqPPJN.exe
  C:\Windows\System\jgqPPJN.exe
  2⤵
  PID:8752
- C:\Windows\System\UfAmDlW.exe
  C:\Windows\System\UfAmDlW.exe
  2⤵
  PID:9220
- C:\Windows\System\ZSSOXrW.exe
  C:\Windows\System\ZSSOXrW.exe
  2⤵
  PID:9252
- C:\Windows\System\mQxxUUH.exe
  C:\Windows\System\mQxxUUH.exe
  2⤵
  PID:9280
- C:\Windows\System\KZsrFgd.exe
  C:\Windows\System\KZsrFgd.exe
  2⤵
  PID:9308
- C:\Windows\System\KuXnOJg.exe
  C:\Windows\System\KuXnOJg.exe
  2⤵
  PID:9340
- C:\Windows\System\WXyyziU.exe
  C:\Windows\System\WXyyziU.exe
  2⤵
  PID:9372
- C:\Windows\System\RRJvGgS.exe
  C:\Windows\System\RRJvGgS.exe
  2⤵
  PID:9408
- C:\Windows\System\bnOqcPV.exe
  C:\Windows\System\bnOqcPV.exe
  2⤵
  PID:9428
- C:\Windows\System\zpymEBm.exe
  C:\Windows\System\zpymEBm.exe
  2⤵
  PID:9448
- C:\Windows\System\MbpPyAR.exe
  C:\Windows\System\MbpPyAR.exe
  2⤵
  PID:9484
- C:\Windows\System\KcwivXw.exe
  C:\Windows\System\KcwivXw.exe
  2⤵
  PID:9504
- C:\Windows\System\EmUooIo.exe
  C:\Windows\System\EmUooIo.exe
  2⤵
  PID:9532
- C:\Windows\System\juDNTUu.exe
  C:\Windows\System\juDNTUu.exe
  2⤵
  PID:9556
- C:\Windows\System\xwvHBpG.exe
  C:\Windows\System\xwvHBpG.exe
  2⤵
  PID:9576
- C:\Windows\System\kREOwpP.exe
  C:\Windows\System\kREOwpP.exe
  2⤵
  PID:9608
- C:\Windows\System\JpnBCfT.exe
  C:\Windows\System\JpnBCfT.exe
  2⤵
  PID:9640
- C:\Windows\System\LdbcDKY.exe
  C:\Windows\System\LdbcDKY.exe
  2⤵
  PID:9668
- C:\Windows\System\MGUMhXW.exe
  C:\Windows\System\MGUMhXW.exe
  2⤵
  PID:9692
- C:\Windows\System\frrVXjn.exe
  C:\Windows\System\frrVXjn.exe
  2⤵
  PID:9728
- C:\Windows\System\LjJHYwz.exe
  C:\Windows\System\LjJHYwz.exe
  2⤵
  PID:9768
- C:\Windows\System\MAFactR.exe
  C:\Windows\System\MAFactR.exe
  2⤵
  PID:9784
- C:\Windows\System\zepCvZR.exe
  C:\Windows\System\zepCvZR.exe
  2⤵
  PID:9808
- C:\Windows\System\XoriCSs.exe
  C:\Windows\System\XoriCSs.exe
  2⤵
  PID:9836
- C:\Windows\System\RoemzkA.exe
  C:\Windows\System\RoemzkA.exe
  2⤵
  PID:9876
- C:\Windows\System\UhBwbvM.exe
  C:\Windows\System\UhBwbvM.exe
  2⤵
  PID:9904
- C:\Windows\System\qybgGbN.exe
  C:\Windows\System\qybgGbN.exe
  2⤵
  PID:9932
- C:\Windows\System\rgJnVMk.exe
  C:\Windows\System\rgJnVMk.exe
  2⤵
  PID:9952
- C:\Windows\System\tyzCSyT.exe
  C:\Windows\System\tyzCSyT.exe
  2⤵
  PID:9980
- C:\Windows\System\FiAdfeL.exe
  C:\Windows\System\FiAdfeL.exe
  2⤵
  PID:10008
- C:\Windows\System\wkaziYU.exe
  C:\Windows\System\wkaziYU.exe
  2⤵
  PID:10040
- C:\Windows\System\GgaceRi.exe
  C:\Windows\System\GgaceRi.exe
  2⤵
  PID:10068
- C:\Windows\System\KlKnpsr.exe
  C:\Windows\System\KlKnpsr.exe
  2⤵
  PID:10096
- C:\Windows\System\vzhtBbI.exe
  C:\Windows\System\vzhtBbI.exe
  2⤵
  PID:10124
- C:\Windows\System\AdxRZLp.exe
  C:\Windows\System\AdxRZLp.exe
  2⤵
  PID:10148
- C:\Windows\System\HSDedhf.exe
  C:\Windows\System\HSDedhf.exe
  2⤵
  PID:10176
- C:\Windows\System\ElGNwiF.exe
  C:\Windows\System\ElGNwiF.exe
  2⤵
  PID:10212
- C:\Windows\System\aXWblox.exe
  C:\Windows\System\aXWblox.exe
  2⤵
  PID:8344
- C:\Windows\System\pEQieBt.exe
  C:\Windows\System\pEQieBt.exe
  2⤵
  PID:9144
- C:\Windows\System\zNVBrhG.exe
  C:\Windows\System\zNVBrhG.exe
  2⤵
  PID:9288
- C:\Windows\System\YAjWvtS.exe
  C:\Windows\System\YAjWvtS.exe
  2⤵
  PID:9352
- C:\Windows\System\VgEvkLR.exe
  C:\Windows\System\VgEvkLR.exe
  2⤵
  PID:9360
- C:\Windows\System\ZXBMfUH.exe
  C:\Windows\System\ZXBMfUH.exe
  2⤵
  PID:9424
- C:\Windows\System\zNgLKIn.exe
  C:\Windows\System\zNgLKIn.exe
  2⤵
  PID:9476
- C:\Windows\System\tKwoBkn.exe
  C:\Windows\System\tKwoBkn.exe
  2⤵
  PID:9548
- C:\Windows\System\tZCgKYG.exe
  C:\Windows\System\tZCgKYG.exe
  2⤵
  PID:9652
- C:\Windows\System\hvYuFsI.exe
  C:\Windows\System\hvYuFsI.exe
  2⤵
  PID:9704
- C:\Windows\System\IdoADBV.exe
  C:\Windows\System\IdoADBV.exe
  2⤵
  PID:9748
- C:\Windows\System\hWLXZIC.exe
  C:\Windows\System\hWLXZIC.exe
  2⤵
  PID:9832
- C:\Windows\System\YXrtelG.exe
  C:\Windows\System\YXrtelG.exe
  2⤵
  PID:9864
- C:\Windows\System\FLIZILm.exe
  C:\Windows\System\FLIZILm.exe
  2⤵
  PID:9944
- C:\Windows\System\UwJBGZp.exe
  C:\Windows\System\UwJBGZp.exe
  2⤵
  PID:10020
- C:\Windows\System\rGpFbnT.exe
  C:\Windows\System\rGpFbnT.exe
  2⤵
  PID:10088
- C:\Windows\System\ZcDjrlr.exe
  C:\Windows\System\ZcDjrlr.exe
  2⤵
  PID:10168
- C:\Windows\System\XKBeLZG.exe
  C:\Windows\System\XKBeLZG.exe
  2⤵
  PID:10200
- C:\Windows\System\yxXcCqx.exe
  C:\Windows\System\yxXcCqx.exe
  2⤵
  PID:9240
- C:\Windows\System\pwewPUZ.exe
  C:\Windows\System\pwewPUZ.exe
  2⤵
  PID:9420
- C:\Windows\System\iAIWfcd.exe
  C:\Windows\System\iAIWfcd.exe
  2⤵
  PID:9464
- C:\Windows\System\FWMIxuq.exe
  C:\Windows\System\FWMIxuq.exe
  2⤵
  PID:9720
- C:\Windows\System\jrRKftC.exe
  C:\Windows\System\jrRKftC.exe
  2⤵
  PID:9796
- C:\Windows\System\aexbbEp.exe
  C:\Windows\System\aexbbEp.exe
  2⤵
  PID:10000
- C:\Windows\System\uSynVVU.exe
  C:\Windows\System\uSynVVU.exe
  2⤵
  PID:10032
- C:\Windows\System\tHMWxcD.exe
  C:\Windows\System\tHMWxcD.exe
  2⤵
  PID:9292
- C:\Windows\System\JeJawWB.exe
  C:\Windows\System\JeJawWB.exe
  2⤵
  PID:9568
- C:\Windows\System\ydyXHrE.exe
  C:\Windows\System\ydyXHrE.exe
  2⤵
  PID:10232
- C:\Windows\System\tFIYJxa.exe
  C:\Windows\System\tFIYJxa.exe
  2⤵
  PID:9444
- C:\Windows\System\gVLUBVx.exe
  C:\Windows\System\gVLUBVx.exe
  2⤵
  PID:10260
- C:\Windows\System\kLGKXtT.exe
  C:\Windows\System\kLGKXtT.exe
  2⤵
  PID:10296
- C:\Windows\System\odIKTBv.exe
  C:\Windows\System\odIKTBv.exe
  2⤵
  PID:10312
- C:\Windows\System\GVKBbkw.exe
  C:\Windows\System\GVKBbkw.exe
  2⤵
  PID:10336
- C:\Windows\System\zPArPnA.exe
  C:\Windows\System\zPArPnA.exe
  2⤵
  PID:10368
- C:\Windows\System\oNmkRHy.exe
  C:\Windows\System\oNmkRHy.exe
  2⤵
  PID:10392
- C:\Windows\System\aujowiO.exe
  C:\Windows\System\aujowiO.exe
  2⤵
  PID:10424
- C:\Windows\System\xsXvyjj.exe
  C:\Windows\System\xsXvyjj.exe
  2⤵
  PID:10456
- C:\Windows\System\IZShdok.exe
  C:\Windows\System\IZShdok.exe
  2⤵
  PID:10472
- C:\Windows\System\zGTckmP.exe
  C:\Windows\System\zGTckmP.exe
  2⤵
  PID:10500
- C:\Windows\System\qCjOVAH.exe
  C:\Windows\System\qCjOVAH.exe
  2⤵
  PID:10520
- C:\Windows\System\FpxXqhK.exe
  C:\Windows\System\FpxXqhK.exe
  2⤵
  PID:10548
- C:\Windows\System\TCpOtrz.exe
  C:\Windows\System\TCpOtrz.exe
  2⤵
  PID:10572
- C:\Windows\System\PGJQBHU.exe
  C:\Windows\System\PGJQBHU.exe
  2⤵
  PID:10600
- C:\Windows\System\BAJgCDz.exe
  C:\Windows\System\BAJgCDz.exe
  2⤵
  PID:10628
- C:\Windows\System\aJPsNsO.exe
  C:\Windows\System\aJPsNsO.exe
  2⤵
  PID:10648
- C:\Windows\System\MPZDzAq.exe
  C:\Windows\System\MPZDzAq.exe
  2⤵
  PID:10680
- C:\Windows\System\akmCkDk.exe
  C:\Windows\System\akmCkDk.exe
  2⤵
  PID:10708
- C:\Windows\System\GcEAlJL.exe
  C:\Windows\System\GcEAlJL.exe
  2⤵
  PID:10748
- C:\Windows\System\HHhZmEY.exe
  C:\Windows\System\HHhZmEY.exe
  2⤵
  PID:10780
- C:\Windows\System\NeCdvvv.exe
  C:\Windows\System\NeCdvvv.exe
  2⤵
  PID:10808
- C:\Windows\System\eIuACZk.exe
  C:\Windows\System\eIuACZk.exe
  2⤵
  PID:10832
- C:\Windows\System\osuXtYd.exe
  C:\Windows\System\osuXtYd.exe
  2⤵
  PID:10856
- C:\Windows\System\UbNmJxT.exe
  C:\Windows\System\UbNmJxT.exe
  2⤵
  PID:10884
- C:\Windows\System\xbAjyuT.exe
  C:\Windows\System\xbAjyuT.exe
  2⤵
  PID:10908
- C:\Windows\System\OGHXSXm.exe
  C:\Windows\System\OGHXSXm.exe
  2⤵
  PID:10936
- C:\Windows\System\fZEhSBy.exe
  C:\Windows\System\fZEhSBy.exe
  2⤵
  PID:10968
- C:\Windows\System\IQCsOWL.exe
  C:\Windows\System\IQCsOWL.exe
  2⤵
  PID:11008
- C:\Windows\System\MUfVSYv.exe
  C:\Windows\System\MUfVSYv.exe
  2⤵
  PID:11040
- C:\Windows\System\yPPhKFp.exe
  C:\Windows\System\yPPhKFp.exe
  2⤵
  PID:11068
- C:\Windows\System\MohfZpX.exe
  C:\Windows\System\MohfZpX.exe
  2⤵
  PID:11104
- C:\Windows\System\bCUqbZA.exe
  C:\Windows\System\bCUqbZA.exe
  2⤵
  PID:11140
- C:\Windows\System\gqBGZhK.exe
  C:\Windows\System\gqBGZhK.exe
  2⤵
  PID:11168
- C:\Windows\System\cRqxrMf.exe
  C:\Windows\System\cRqxrMf.exe
  2⤵
  PID:11196
- C:\Windows\System\XfzpbaZ.exe
  C:\Windows\System\XfzpbaZ.exe
  2⤵
  PID:11220
- C:\Windows\System\xIoBnNq.exe
  C:\Windows\System\xIoBnNq.exe
  2⤵
  PID:11248
- C:\Windows\System\OyHRPxs.exe
  C:\Windows\System\OyHRPxs.exe
  2⤵
  PID:9480
- C:\Windows\System\cgQTkEd.exe
  C:\Windows\System\cgQTkEd.exe
  2⤵
  PID:9736
- C:\Windows\System\pnCixIH.exe
  C:\Windows\System\pnCixIH.exe
  2⤵
  PID:10272
- C:\Windows\System\oQWEUUo.exe
  C:\Windows\System\oQWEUUo.exe
  2⤵
  PID:10352
- C:\Windows\System\RtOSCqz.exe
  C:\Windows\System\RtOSCqz.exe
  2⤵
  PID:10328
- C:\Windows\System\QpkWNaJ.exe
  C:\Windows\System\QpkWNaJ.exe
  2⤵
  PID:10468
- C:\Windows\System\RLWylAl.exe
  C:\Windows\System\RLWylAl.exe
  2⤵
  PID:10496
- C:\Windows\System\JkSofBO.exe
  C:\Windows\System\JkSofBO.exe
  2⤵
  PID:10556
- C:\Windows\System\VmkoFIp.exe
  C:\Windows\System\VmkoFIp.exe
  2⤵
  PID:10660
- C:\Windows\System\eTBexNc.exe
  C:\Windows\System\eTBexNc.exe
  2⤵
  PID:10672
- C:\Windows\System\crlaBLb.exe
  C:\Windows\System\crlaBLb.exe
  2⤵
  PID:10732
- C:\Windows\System\WDeYMMh.exe
  C:\Windows\System\WDeYMMh.exe
  2⤵
  PID:10844
- C:\Windows\System\PrkVAZO.exe
  C:\Windows\System\PrkVAZO.exe
  2⤵
  PID:10828
- C:\Windows\System\RdLkfLm.exe
  C:\Windows\System\RdLkfLm.exe
  2⤵
  PID:10924
- C:\Windows\System\jspjezF.exe
  C:\Windows\System\jspjezF.exe
  2⤵
  PID:10896
- C:\Windows\System\SwauqKU.exe
  C:\Windows\System\SwauqKU.exe
  2⤵
  PID:11000
- C:\Windows\System\aIbqkGn.exe
  C:\Windows\System\aIbqkGn.exe
  2⤵
  PID:11052
- C:\Windows\System\XBIkVOJ.exe
  C:\Windows\System\XBIkVOJ.exe
  2⤵
  PID:11184
- C:\Windows\System\uMffMQG.exe
  C:\Windows\System\uMffMQG.exe
  2⤵
  PID:11164
- C:\Windows\System\etJpfuS.exe
  C:\Windows\System\etJpfuS.exe
  2⤵
  PID:9920
- C:\Windows\System\wANPBoh.exe
  C:\Windows\System\wANPBoh.exe
  2⤵
  PID:10248
- C:\Windows\System\mDsOhPR.exe
  C:\Windows\System\mDsOhPR.exe
  2⤵
  PID:10464
- C:\Windows\System\jXBJSBE.exe
  C:\Windows\System\jXBJSBE.exe
  2⤵
  PID:10696
- C:\Windows\System\UHGMvRH.exe
  C:\Windows\System\UHGMvRH.exe
  2⤵
  PID:10640
- C:\Windows\System\bzUWpCb.exe
  C:\Windows\System\bzUWpCb.exe
  2⤵
  PID:10872
- C:\Windows\System\IyNnpwZ.exe
  C:\Windows\System\IyNnpwZ.exe
  2⤵
  PID:10820
- C:\Windows\System\QSZXgus.exe
  C:\Windows\System\QSZXgus.exe
  2⤵
  PID:11256
- C:\Windows\System\HVawuDd.exe
  C:\Windows\System\HVawuDd.exe
  2⤵
  PID:10532
- C:\Windows\System\OyxGgYJ.exe
  C:\Windows\System\OyxGgYJ.exe
  2⤵
  PID:11112
- C:\Windows\System\EmwwZtY.exe
  C:\Windows\System\EmwwZtY.exe
  2⤵
  PID:11292
- C:\Windows\System\rimTMZt.exe
  C:\Windows\System\rimTMZt.exe
  2⤵
  PID:11320
- C:\Windows\System\oLlfVTG.exe
  C:\Windows\System\oLlfVTG.exe
  2⤵
  PID:11352
- C:\Windows\System\BnMGzjU.exe
  C:\Windows\System\BnMGzjU.exe
  2⤵
  PID:11368
- C:\Windows\System\DXSUECk.exe
  C:\Windows\System\DXSUECk.exe
  2⤵
  PID:11384
- C:\Windows\System\hpYrZZd.exe
  C:\Windows\System\hpYrZZd.exe
  2⤵
  PID:11416
- C:\Windows\System\FjhVYIp.exe
  C:\Windows\System\FjhVYIp.exe
  2⤵
  PID:11448
- C:\Windows\System\IluzQAE.exe
  C:\Windows\System\IluzQAE.exe
  2⤵
  PID:11476
- C:\Windows\System\qAvYIDT.exe
  C:\Windows\System\qAvYIDT.exe
  2⤵
  PID:11500
- C:\Windows\System\VQEeFyR.exe
  C:\Windows\System\VQEeFyR.exe
  2⤵
  PID:11520
- C:\Windows\System\LfcKqqN.exe
  C:\Windows\System\LfcKqqN.exe
  2⤵
  PID:11548
- C:\Windows\System\VtcjYtk.exe
  C:\Windows\System\VtcjYtk.exe
  2⤵
  PID:11580
- C:\Windows\System\ltLGXhg.exe
  C:\Windows\System\ltLGXhg.exe
  2⤵
  PID:11600
- C:\Windows\System\wqsCaUI.exe
  C:\Windows\System\wqsCaUI.exe
  2⤵
  PID:11628
- C:\Windows\System\PFVKDwh.exe
  C:\Windows\System\PFVKDwh.exe
  2⤵
  PID:11660
- C:\Windows\System\MnXZSqJ.exe
  C:\Windows\System\MnXZSqJ.exe
  2⤵
  PID:11688
- C:\Windows\System\eXPQZXa.exe
  C:\Windows\System\eXPQZXa.exe
  2⤵
  PID:11712
- C:\Windows\System\HlZOCtM.exe
  C:\Windows\System\HlZOCtM.exe
  2⤵
  PID:11740
- C:\Windows\System\UogDeLi.exe
  C:\Windows\System\UogDeLi.exe
  2⤵
  PID:11776
- C:\Windows\System\tTVZynN.exe
  C:\Windows\System\tTVZynN.exe
  2⤵
  PID:11808
- C:\Windows\System\MXkGIaT.exe
  C:\Windows\System\MXkGIaT.exe
  2⤵
  PID:11832
- C:\Windows\System\DDlstAZ.exe
  C:\Windows\System\DDlstAZ.exe
  2⤵
  PID:11856
- C:\Windows\System\oiLxvTH.exe
  C:\Windows\System\oiLxvTH.exe
  2⤵
  PID:11888
- C:\Windows\System\LbxFeGP.exe
  C:\Windows\System\LbxFeGP.exe
  2⤵
  PID:11920
- C:\Windows\System\tBTUZZQ.exe
  C:\Windows\System\tBTUZZQ.exe
  2⤵
  PID:11952
- C:\Windows\System\WKoFIPq.exe
  C:\Windows\System\WKoFIPq.exe
  2⤵
  PID:11976
- C:\Windows\System\EdBmvjI.exe
  C:\Windows\System\EdBmvjI.exe
  2⤵
  PID:12008
- C:\Windows\System\hwLvKaQ.exe
  C:\Windows\System\hwLvKaQ.exe
  2⤵
  PID:12032
- C:\Windows\System\FEnmkez.exe
  C:\Windows\System\FEnmkez.exe
  2⤵
  PID:12064
- C:\Windows\System\eiVrjCQ.exe
  C:\Windows\System\eiVrjCQ.exe
  2⤵
  PID:12092
- C:\Windows\System\PpRMLMT.exe
  C:\Windows\System\PpRMLMT.exe
  2⤵
  PID:12120
- C:\Windows\System\MnAhywF.exe
  C:\Windows\System\MnAhywF.exe
  2⤵
  PID:12148
- C:\Windows\System\CUEKJlc.exe
  C:\Windows\System\CUEKJlc.exe
  2⤵
  PID:12176
- C:\Windows\System\CzZjCRZ.exe
  C:\Windows\System\CzZjCRZ.exe
  2⤵
  PID:12204
- C:\Windows\System\PXjDFSF.exe
  C:\Windows\System\PXjDFSF.exe
  2⤵
  PID:12236
- C:\Windows\System\NkkMQdG.exe
  C:\Windows\System\NkkMQdG.exe
  2⤵
  PID:12264
- C:\Windows\System\AFOpykq.exe
  C:\Windows\System\AFOpykq.exe
  2⤵
  PID:11160
- C:\Windows\System\WhRSFMd.exe
  C:\Windows\System\WhRSFMd.exe
  2⤵
  PID:11056
- C:\Windows\System\gWdbUEU.exe
  C:\Windows\System\gWdbUEU.exe
  2⤵
  PID:10244
- C:\Windows\System\UvKHaMc.exe
  C:\Windows\System\UvKHaMc.exe
  2⤵
  PID:11472
- C:\Windows\System\XGdvTTK.exe
  C:\Windows\System\XGdvTTK.exe
  2⤵
  PID:11424
- C:\Windows\System\XZmJNgH.exe
  C:\Windows\System\XZmJNgH.exe
  2⤵
  PID:11396
- C:\Windows\System\blqNefA.exe
  C:\Windows\System\blqNefA.exe
  2⤵
  PID:11572
- C:\Windows\System\SVbfoOK.exe
  C:\Windows\System\SVbfoOK.exe
  2⤵
  PID:11696
- C:\Windows\System\MUmMQWp.exe
  C:\Windows\System\MUmMQWp.exe
  2⤵
  PID:11536
- C:\Windows\System\bOIdyOK.exe
  C:\Windows\System\bOIdyOK.exe
  2⤵
  PID:11576
- C:\Windows\System\hvwhylE.exe
  C:\Windows\System\hvwhylE.exe
  2⤵
  PID:11736
- C:\Windows\System\oWvJdDo.exe
  C:\Windows\System\oWvJdDo.exe
  2⤵
  PID:11788
- C:\Windows\System\ccXJDDA.exe
  C:\Windows\System\ccXJDDA.exe
  2⤵
  PID:11728
- C:\Windows\System\MEcaxnX.exe
  C:\Windows\System\MEcaxnX.exe
  2⤵
  PID:11904
- C:\Windows\System\XPaRWbC.exe
  C:\Windows\System\XPaRWbC.exe
  2⤵
  PID:12076
- C:\Windows\System\WjMHZOr.exe
  C:\Windows\System\WjMHZOr.exe
  2⤵
  PID:12116
- C:\Windows\System\WnUzaTC.exe
  C:\Windows\System\WnUzaTC.exe
  2⤵
  PID:12160
- C:\Windows\System\iKYRecd.exe
  C:\Windows\System\iKYRecd.exe
  2⤵
  PID:12080
- C:\Windows\System\jTwdmfs.exe
  C:\Windows\System\jTwdmfs.exe
  2⤵
  PID:12228
- C:\Windows\System\qtHlGWO.exe
  C:\Windows\System\qtHlGWO.exe
  2⤵
  PID:11348
- C:\Windows\System\TQOEWlJ.exe
  C:\Windows\System\TQOEWlJ.exe
  2⤵
  PID:12260
- C:\Windows\System\BHQwNIc.exe
  C:\Windows\System\BHQwNIc.exe
  2⤵
  PID:11364
- C:\Windows\System\IDiwKCP.exe
  C:\Windows\System\IDiwKCP.exe
  2⤵
  PID:11672
- C:\Windows\System\GjfMhac.exe
  C:\Windows\System\GjfMhac.exe
  2⤵
  PID:11656
- C:\Windows\System\zUFcTLc.exe
  C:\Windows\System\zUFcTLc.exe
  2⤵
  PID:12320
- C:\Windows\System\dMtiyBC.exe
  C:\Windows\System\dMtiyBC.exe
  2⤵
  PID:12344
- C:\Windows\System\DMGRKAt.exe
  C:\Windows\System\DMGRKAt.exe
  2⤵
  PID:12388
- C:\Windows\System\DFCgTLP.exe
  C:\Windows\System\DFCgTLP.exe
  2⤵
  PID:12416
- C:\Windows\System\YFFTWPE.exe
  C:\Windows\System\YFFTWPE.exe
  2⤵
  PID:12440
- C:\Windows\System\cIOeAjU.exe
  C:\Windows\System\cIOeAjU.exe
  2⤵
  PID:12464
- C:\Windows\System\GHTosDa.exe
  C:\Windows\System\GHTosDa.exe
  2⤵
  PID:12488
- C:\Windows\System\tomDBGZ.exe
  C:\Windows\System\tomDBGZ.exe
  2⤵
  PID:12512
- C:\Windows\System\oMfDNas.exe
  C:\Windows\System\oMfDNas.exe
  2⤵
  PID:12532
- C:\Windows\System\PuWVAEH.exe
  C:\Windows\System\PuWVAEH.exe
  2⤵
  PID:12556
- C:\Windows\System\VmGUsDi.exe
  C:\Windows\System\VmGUsDi.exe
  2⤵
  PID:12576
- C:\Windows\System\ePeodoC.exe
  C:\Windows\System\ePeodoC.exe
  2⤵
  PID:12608
- C:\Windows\System\lDmaQPr.exe
  C:\Windows\System\lDmaQPr.exe
  2⤵
  PID:12648
- C:\Windows\System\uqLsxWo.exe
  C:\Windows\System\uqLsxWo.exe
  2⤵
  PID:12672
- C:\Windows\System\brSojYv.exe
  C:\Windows\System\brSojYv.exe
  2⤵
  PID:12708
- C:\Windows\System\RJFFDEZ.exe
  C:\Windows\System\RJFFDEZ.exe
  2⤵
  PID:12732
- C:\Windows\System\aXwTjML.exe
  C:\Windows\System\aXwTjML.exe
  2⤵
  PID:12768
- C:\Windows\System\FTrtopE.exe
  C:\Windows\System\FTrtopE.exe
  2⤵
  PID:12792
- C:\Windows\System\oiCFofU.exe
  C:\Windows\System\oiCFofU.exe
  2⤵
  PID:12828
- C:\Windows\System\nVVOyFq.exe
  C:\Windows\System\nVVOyFq.exe
  2⤵
  PID:12860
- C:\Windows\System\zZLExZc.exe
  C:\Windows\System\zZLExZc.exe
  2⤵
  PID:12880
- C:\Windows\System\deteGwM.exe
  C:\Windows\System\deteGwM.exe
  2⤵
  PID:12908
- C:\Windows\System\NIYKybJ.exe
  C:\Windows\System\NIYKybJ.exe
  2⤵
  PID:12940
- C:\Windows\System\xkHrpHU.exe
  C:\Windows\System\xkHrpHU.exe
  2⤵
  PID:12956
- C:\Windows\System\qRrYbnT.exe
  C:\Windows\System\qRrYbnT.exe
  2⤵
  PID:12980
- C:\Windows\System\QdFXdtz.exe
  C:\Windows\System\QdFXdtz.exe
  2⤵
  PID:13004
- C:\Windows\System\eGnybya.exe
  C:\Windows\System\eGnybya.exe
  2⤵
  PID:13032
- C:\Windows\System\oBHPgzd.exe
  C:\Windows\System\oBHPgzd.exe
  2⤵
  PID:13056
- C:\Windows\System\uApTUCm.exe
  C:\Windows\System\uApTUCm.exe
  2⤵
  PID:13080
- C:\Windows\System\fnxbnnF.exe
  C:\Windows\System\fnxbnnF.exe
  2⤵
  PID:13108
- C:\Windows\System\eUTgckw.exe
  C:\Windows\System\eUTgckw.exe
  2⤵
  PID:13124
- C:\Windows\System\nxZwhEU.exe
  C:\Windows\System\nxZwhEU.exe
  2⤵
  PID:13152
- C:\Windows\System\PrraPvP.exe
  C:\Windows\System\PrraPvP.exe
  2⤵
  PID:13188
- C:\Windows\System\feheiQD.exe
  C:\Windows\System\feheiQD.exe
  2⤵
  PID:13216
- C:\Windows\System\pZEMDPr.exe
  C:\Windows\System\pZEMDPr.exe
  2⤵
  PID:13252
- C:\Windows\System\iqMZUML.exe
  C:\Windows\System\iqMZUML.exe
  2⤵
  PID:13284
- C:\Windows\System\yADIlQc.exe
  C:\Windows\System\yADIlQc.exe
  2⤵
  PID:11032
- C:\Windows\System\PGaHYSd.exe
  C:\Windows\System\PGaHYSd.exe
  2⤵
  PID:11844
- C:\Windows\System\FYCwpoD.exe
  C:\Windows\System\FYCwpoD.exe
  2⤵
  PID:11616
- C:\Windows\System\xzrepjI.exe
  C:\Windows\System\xzrepjI.exe
  2⤵
  PID:10544
- C:\Windows\System\neZLZsB.exe
  C:\Windows\System\neZLZsB.exe
  2⤵
  PID:12332
- C:\Windows\System\BxtSiwm.exe
  C:\Windows\System\BxtSiwm.exe
  2⤵
  PID:12052
- C:\Windows\System\dgrQyDQ.exe
  C:\Windows\System\dgrQyDQ.exe
  2⤵
  PID:12424
- C:\Windows\System\ibGccvH.exe
  C:\Windows\System\ibGccvH.exe
  2⤵
  PID:11400
- C:\Windows\System\AbhdjWw.exe
  C:\Windows\System\AbhdjWw.exe
  2⤵
  PID:12448
- C:\Windows\System\arQpMaK.exe
  C:\Windows\System\arQpMaK.exe
  2⤵
  PID:12636
- C:\Windows\System\BZLAmJI.exe
  C:\Windows\System\BZLAmJI.exe
  2⤵
  PID:12720
- C:\Windows\System\cZTQVzD.exe
  C:\Windows\System\cZTQVzD.exe
  2⤵
  PID:12624
- C:\Windows\System\BDEFMfA.exe
  C:\Windows\System\BDEFMfA.exe
  2⤵
  PID:12664
- C:\Windows\System\gAjPMmb.exe
  C:\Windows\System\gAjPMmb.exe
  2⤵
  PID:12824
- C:\Windows\System\BFMXGyn.exe
  C:\Windows\System\BFMXGyn.exe
  2⤵
  PID:12876
- C:\Windows\System\goDowas.exe
  C:\Windows\System\goDowas.exe
  2⤵
  PID:12872
- C:\Windows\System\rrOUWLd.exe
  C:\Windows\System\rrOUWLd.exe
  2⤵
  PID:12932
- C:\Windows\System\eQwTeZu.exe
  C:\Windows\System\eQwTeZu.exe
  2⤵
  PID:12892
- C:\Windows\System\DgubPSn.exe
  C:\Windows\System\DgubPSn.exe
  2⤵
  PID:13144
- C:\Windows\System\HeqaNJL.exe
  C:\Windows\System\HeqaNJL.exe
  2⤵
  PID:13272
- C:\Windows\System\FsVfPki.exe
  C:\Windows\System\FsVfPki.exe
  2⤵
  PID:13240
- C:\Windows\System\triLxmq.exe
  C:\Windows\System\triLxmq.exe
  2⤵
  PID:13120
- C:\Windows\System\mJFncSe.exe
  C:\Windows\System\mJFncSe.exe
  2⤵
  PID:13176
- C:\Windows\System\jBgTdRh.exe
  C:\Windows\System\jBgTdRh.exe
  2⤵
  PID:13204
- C:\Windows\System\AtdMzcp.exe
  C:\Windows\System\AtdMzcp.exe
  2⤵
  PID:12460
- C:\Windows\System\MhMFuFH.exe
  C:\Windows\System\MhMFuFH.exe
  2⤵
  PID:12692
- C:\Windows\System\khPMikC.exe
  C:\Windows\System\khPMikC.exe
  2⤵
  PID:13000
- C:\Windows\System\zdsfshc.exe
  C:\Windows\System\zdsfshc.exe
  2⤵
  PID:12408
- C:\Windows\System\wRuIiXM.exe
  C:\Windows\System\wRuIiXM.exe
  2⤵
  PID:11944
- C:\Windows\System\GeZlGxv.exe
  C:\Windows\System\GeZlGxv.exe
  2⤵
  PID:12592
- C:\Windows\System\zJUnZAN.exe
  C:\Windows\System\zJUnZAN.exe
  2⤵
  PID:13336
- C:\Windows\System\vAgJMfA.exe
  C:\Windows\System\vAgJMfA.exe
  2⤵
  PID:13356
- C:\Windows\System\CqkIqAV.exe
  C:\Windows\System\CqkIqAV.exe
  2⤵
  PID:13384
- C:\Windows\System\ZicuITG.exe
  C:\Windows\System\ZicuITG.exe
  2⤵
  PID:13408
- C:\Windows\System\byGZNHU.exe
  C:\Windows\System\byGZNHU.exe
  2⤵
  PID:13436
- C:\Windows\System\xWWNfDF.exe
  C:\Windows\System\xWWNfDF.exe
  2⤵
  PID:13468
- C:\Windows\System\xfYLuyi.exe
  C:\Windows\System\xfYLuyi.exe
  2⤵
  PID:13496
- C:\Windows\System\oiPnHNe.exe
  C:\Windows\System\oiPnHNe.exe
  2⤵
  PID:13528
- C:\Windows\System\XGhtgBI.exe
  C:\Windows\System\XGhtgBI.exe
  2⤵
  PID:13556
- C:\Windows\System\EBvFTKX.exe
  C:\Windows\System\EBvFTKX.exe
  2⤵
  PID:13588
- C:\Windows\System\mKjBWZX.exe
  C:\Windows\System\mKjBWZX.exe
  2⤵
  PID:13608
- C:\Windows\System\TEwELCS.exe
  C:\Windows\System\TEwELCS.exe
  2⤵
  PID:13636
- C:\Windows\System\TyNWRLa.exe
  C:\Windows\System\TyNWRLa.exe
  2⤵
  PID:13668
- C:\Windows\System\mZpkIjb.exe
  C:\Windows\System\mZpkIjb.exe
  2⤵
  PID:13692
- C:\Windows\System\PUdAbUz.exe
  C:\Windows\System\PUdAbUz.exe
  2⤵
  PID:13724
- C:\Windows\System\DOJvbjj.exe
  C:\Windows\System\DOJvbjj.exe
  2⤵
  PID:13748
- C:\Windows\System\DvxyAJX.exe
  C:\Windows\System\DvxyAJX.exe
  2⤵
  PID:13776
- C:\Windows\System\NKyHTYB.exe
  C:\Windows\System\NKyHTYB.exe
  2⤵
  PID:13808
- C:\Windows\System\ddIBkpx.exe
  C:\Windows\System\ddIBkpx.exe
  2⤵
  PID:13824
- C:\Windows\System\HJKsNZc.exe
  C:\Windows\System\HJKsNZc.exe
  2⤵
  PID:13864
- C:\Windows\System\YKsEooT.exe
  C:\Windows\System\YKsEooT.exe
  2⤵
  PID:13900
- C:\Windows\System\zFSzWta.exe
  C:\Windows\System\zFSzWta.exe
  2⤵
  PID:13920
- C:\Windows\System\KRadrgC.exe
  C:\Windows\System\KRadrgC.exe
  2⤵
  PID:13952
- C:\Windows\System\pJgDPmf.exe
  C:\Windows\System\pJgDPmf.exe
  2⤵
  PID:13968
- C:\Windows\System\JqJkvFe.exe
  C:\Windows\System\JqJkvFe.exe
  2⤵
  PID:14000
- C:\Windows\System\tigpHhJ.exe
  C:\Windows\System\tigpHhJ.exe
  2⤵
  PID:14020
- C:\Windows\System\IctImFE.exe
  C:\Windows\System\IctImFE.exe
  2⤵
  PID:14052
- C:\Windows\System\Expzsqh.exe
  C:\Windows\System\Expzsqh.exe
  2⤵
  PID:14088
- C:\Windows\System\bduieGq.exe
  C:\Windows\System\bduieGq.exe
  2⤵
  PID:14104
- C:\Windows\System\mSZmrMw.exe
  C:\Windows\System\mSZmrMw.exe
  2⤵
  PID:14128
- C:\Windows\System\kOgeXVE.exe
  C:\Windows\System\kOgeXVE.exe
  2⤵
  PID:14148
- C:\Windows\System\KhRZiGx.exe
  C:\Windows\System\KhRZiGx.exe
  2⤵
  PID:14164
- C:\Windows\System\kaeOSEj.exe
  C:\Windows\System\kaeOSEj.exe
  2⤵
  PID:14188
- C:\Windows\System\UHskfoL.exe
  C:\Windows\System\UHskfoL.exe
  2⤵
  PID:14216
- C:\Windows\System\KRtkVTl.exe
  C:\Windows\System\KRtkVTl.exe
  2⤵
  PID:14256
- C:\Windows\System\tbBUkuO.exe
  C:\Windows\System\tbBUkuO.exe
  2⤵
  PID:14292
- C:\Windows\System\JwEtuXm.exe
  C:\Windows\System\JwEtuXm.exe
  2⤵
  PID:14312
- C:\Windows\System\dfYVkYb.exe
  C:\Windows\System\dfYVkYb.exe
  2⤵
  PID:14332
- C:\Windows\System\VBoIlFv.exe
  C:\Windows\System\VBoIlFv.exe
  2⤵
  PID:12480
- C:\Windows\System\kABWsQQ.exe
  C:\Windows\System\kABWsQQ.exe
  2⤵
  PID:12868
- C:\Windows\System\LCPCvEw.exe
  C:\Windows\System\LCPCvEw.exe
  2⤵
  PID:13116
- C:\Windows\System\ExLZmXt.exe
  C:\Windows\System\ExLZmXt.exe
  2⤵
  PID:11020
- C:\Windows\System\lxnxzIO.exe
  C:\Windows\System\lxnxzIO.exe
  2⤵
  PID:12788
- C:\Windows\System\yKsXuON.exe
  C:\Windows\System\yKsXuON.exe
  2⤵
  PID:13368
- C:\Windows\System\TXIEeYz.exe
  C:\Windows\System\TXIEeYz.exe
  2⤵
  PID:13316
- C:\Windows\System\oKiWSTI.exe
  C:\Windows\System\oKiWSTI.exe
  2⤵
  PID:13740
- C:\Windows\System\kRJeJWm.exe
  C:\Windows\System\kRJeJWm.exe
  2⤵
  PID:13768
- C:\Windows\System\JMeIQaG.exe
  C:\Windows\System\JMeIQaG.exe
  2⤵
  PID:13628
- C:\Windows\System\aiGHOom.exe
  C:\Windows\System\aiGHOom.exe
  2⤵
  PID:13520
- C:\Windows\System\kIbzUZa.exe
  C:\Windows\System\kIbzUZa.exe
  2⤵
  PID:13548
- C:\Windows\System\cbCwldT.exe
  C:\Windows\System\cbCwldT.exe
  2⤵
  PID:13804
- C:\Windows\System\lIXurds.exe
  C:\Windows\System\lIXurds.exe
  2⤵
  PID:13992
- C:\Windows\System\roukhxu.exe
  C:\Windows\System\roukhxu.exe
  2⤵
  PID:14080
- C:\Windows\System\JavKEqE.exe
  C:\Windows\System\JavKEqE.exe
  2⤵
  PID:13844
- C:\Windows\System\zsuGCew.exe
  C:\Windows\System\zsuGCew.exe
  2⤵
  PID:14076
- C:\Windows\System\bzocKPp.exe
  C:\Windows\System\bzocKPp.exe
  2⤵
  PID:14228
- C:\Windows\System\JnoCBMI.exe
  C:\Windows\System\JnoCBMI.exe
  2⤵
  PID:14036
- C:\Windows\System\vLqVgRC.exe
  C:\Windows\System\vLqVgRC.exe
  2⤵
  PID:11532
- C:\Windows\System\mbiZHrN.exe
  C:\Windows\System\mbiZHrN.exe
  2⤵
  PID:12400
- C:\Windows\System\QvrUXWP.exe
  C:\Windows\System\QvrUXWP.exe
  2⤵
  PID:14112
- C:\Windows\System\nacDXiT.exe
  C:\Windows\System\nacDXiT.exe
  2⤵
  PID:14308
- C:\Windows\System\MGgIpCw.exe
  C:\Windows\System\MGgIpCw.exe
  2⤵
  PID:14160
- C:\Windows\System\tVubvDP.exe
  C:\Windows\System\tVubvDP.exe
  2⤵
  PID:14324
- C:\Windows\System\ditsLSa.exe
  C:\Windows\System\ditsLSa.exe
  2⤵
  PID:13516
- C:\Windows\System\QCNEIvq.exe
  C:\Windows\System\QCNEIvq.exe
  2⤵
  PID:13688
- C:\Windows\System\GRuWaYH.exe
  C:\Windows\System\GRuWaYH.exe
  2⤵
  PID:14140
- C:\Windows\System\tCtDKgu.exe
  C:\Windows\System\tCtDKgu.exe
  2⤵
  PID:14348
- C:\Windows\System\gNIcWHx.exe
  C:\Windows\System\gNIcWHx.exe
  2⤵
  PID:14368
- C:\Windows\System\nHtqSMo.exe
  C:\Windows\System\nHtqSMo.exe
  2⤵
  PID:14400
- C:\Windows\System\GMMtcHK.exe
  C:\Windows\System\GMMtcHK.exe
  2⤵
  PID:14424
- C:\Windows\System\xeFupvC.exe
  C:\Windows\System\xeFupvC.exe
  2⤵
  PID:14464
- C:\Windows\System\MMRQAOc.exe
  C:\Windows\System\MMRQAOc.exe
  2⤵
  PID:14492
- C:\Windows\System\ejmELNu.exe
  C:\Windows\System\ejmELNu.exe
  2⤵
  PID:14524
- C:\Windows\System\BdzRdMi.exe
  C:\Windows\System\BdzRdMi.exe
  2⤵
  PID:14560
- C:\Windows\System\szSFHib.exe
  C:\Windows\System\szSFHib.exe
  2⤵
  PID:14588
- C:\Windows\System\ZHnNpkV.exe
  C:\Windows\System\ZHnNpkV.exe
  2⤵
  PID:14616
- C:\Windows\System\FXnLpSn.exe
  C:\Windows\System\FXnLpSn.exe
  2⤵
  PID:14640
- C:\Windows\System\jSDCtwk.exe
  C:\Windows\System\jSDCtwk.exe
  2⤵
  PID:14676
- C:\Windows\System\SLbdNAN.exe
  C:\Windows\System\SLbdNAN.exe
  2⤵
  PID:14708
- C:\Windows\System\ncoUbqb.exe
  C:\Windows\System\ncoUbqb.exe
  2⤵
  PID:14736
- C:\Windows\System\nWGFLVK.exe
  C:\Windows\System\nWGFLVK.exe
  2⤵
  PID:14760
- C:\Windows\System\yqsoZnz.exe
  C:\Windows\System\yqsoZnz.exe
  2⤵
  PID:14784
- C:\Windows\System\wpfISZv.exe
  C:\Windows\System\wpfISZv.exe
  2⤵
  PID:14808
- C:\Windows\System\jUOUXtJ.exe
  C:\Windows\System\jUOUXtJ.exe
  2⤵
  PID:14836
- C:\Windows\System\zMAdnhD.exe
  C:\Windows\System\zMAdnhD.exe
  2⤵
  PID:14860
- C:\Windows\System\yHQIfpx.exe
  C:\Windows\System\yHQIfpx.exe
  2⤵
  PID:14888
- C:\Windows\System\dklmAKT.exe
  C:\Windows\System\dklmAKT.exe
  2⤵
  PID:14908
- C:\Windows\System\NYwCeku.exe
  C:\Windows\System\NYwCeku.exe
  2⤵
  PID:14936
- C:\Windows\System\NPutmaC.exe
  C:\Windows\System\NPutmaC.exe
  2⤵
  PID:14972
- C:\Windows\System\gyufYXb.exe
  C:\Windows\System\gyufYXb.exe
  2⤵
  PID:14988
- C:\Windows\System\zIYKAvG.exe
  C:\Windows\System\zIYKAvG.exe
  2⤵
  PID:15016
- C:\Windows\System\DrOMsId.exe
  C:\Windows\System\DrOMsId.exe
  2⤵
  PID:15032
- C:\Windows\System\DBBXGwh.exe
  C:\Windows\System\DBBXGwh.exe
  2⤵
  PID:15056
- C:\Windows\System\mccaFbF.exe
  C:\Windows\System\mccaFbF.exe
  2⤵
  PID:15096
- C:\Windows\System\snptIME.exe
  C:\Windows\System\snptIME.exe
  2⤵
  PID:15120
- C:\Windows\System\lKdbnJR.exe
  C:\Windows\System\lKdbnJR.exe
  2⤵
  PID:15144
- C:\Windows\System\MAxJcUY.exe
  C:\Windows\System\MAxJcUY.exe
  2⤵
  PID:15168
- C:\Windows\System\FrsOohw.exe
  C:\Windows\System\FrsOohw.exe
  2⤵
  PID:15192
- C:\Windows\System\riRZsEy.exe
  C:\Windows\System\riRZsEy.exe
  2⤵
  PID:15228
- C:\Windows\System\FAjTcdH.exe
  C:\Windows\System\FAjTcdH.exe
  2⤵
  PID:15252
- C:\Windows\System\gDfNUaD.exe
  C:\Windows\System\gDfNUaD.exe
  2⤵
  PID:15280
- C:\Windows\System\LAPqmjC.exe
  C:\Windows\System\LAPqmjC.exe
  2⤵
  PID:15304
- C:\Windows\System\HWnMOSC.exe
  C:\Windows\System\HWnMOSC.exe
  2⤵
  PID:15340
- C:\Windows\System\RxAVnFR.exe
  C:\Windows\System\RxAVnFR.exe
  2⤵
  PID:12312
- C:\Windows\System\DhFlEcw.exe
  C:\Windows\System\DhFlEcw.exe
  2⤵
  PID:13460
- C:\Windows\System\QjoZZLt.exe
  C:\Windows\System\QjoZZLt.exe
  2⤵
  PID:14340
- C:\Windows\System\zrnqmow.exe
  C:\Windows\System\zrnqmow.exe
  2⤵
  PID:14476
- C:\Windows\System\PFOLXhc.exe
  C:\Windows\System\PFOLXhc.exe
  2⤵
  PID:14556
- C:\Windows\System\PYMDgMz.exe
  C:\Windows\System\PYMDgMz.exe
  2⤵
  PID:13964
- C:\Windows\System\objbupe.exe
  C:\Windows\System\objbupe.exe
  2⤵
  PID:14364
- C:\Windows\System\rSjarIl.exe
  C:\Windows\System\rSjarIl.exe
  2⤵
  PID:14436
- C:\Windows\System\lExukbM.exe
  C:\Windows\System\lExukbM.exe
  2⤵
  PID:14688
- C:\Windows\System\sRalwKJ.exe
  C:\Windows\System\sRalwKJ.exe
  2⤵
  PID:14488
- C:\Windows\System\CHLmISD.exe
  C:\Windows\System\CHLmISD.exe
  2⤵
  PID:13376
- C:\Windows\System\dHEevFB.exe
  C:\Windows\System\dHEevFB.exe
  2⤵
  PID:14820
- C:\Windows\System\xCMSHJn.exe
  C:\Windows\System\xCMSHJn.exe
  2⤵
  PID:14412
- C:\Windows\System\VSuSQIT.exe
  C:\Windows\System\VSuSQIT.exe
  2⤵
  PID:14652
- C:\Windows\System\QSuYaSN.exe
  C:\Windows\System\QSuYaSN.exe
  2⤵
  PID:15004
- C:\Windows\System\sqzkZBk.exe
  C:\Windows\System\sqzkZBk.exe
  2⤵
  PID:15080
- C:\Windows\System\JRtFTWW.exe
  C:\Windows\System\JRtFTWW.exe
  2⤵
  PID:14876
- C:\Windows\System\SDivBka.exe
  C:\Windows\System\SDivBka.exe
  2⤵
  PID:14964
- C:\Windows\System\GEIqJaV.exe
  C:\Windows\System\GEIqJaV.exe
  2⤵
  PID:14272
- C:\Windows\System\GOKQZAB.exe
  C:\Windows\System\GOKQZAB.exe
  2⤵
  PID:15116
- C:\Windows\System\dtngbUD.exe
  C:\Windows\System\dtngbUD.exe
  2⤵
  PID:14668
- C:\Windows\System\ZGwGhVy.exe
  C:\Windows\System\ZGwGhVy.exe
  2⤵
  PID:14448
- C:\Windows\System\TpNPeCB.exe
  C:\Windows\System\TpNPeCB.exe
  2⤵
  PID:15044
- C:\Windows\System\BvnTsoc.exe
  C:\Windows\System\BvnTsoc.exe
  2⤵
  PID:13788
- C:\Windows\System\wJBCgXj.exe
  C:\Windows\System\wJBCgXj.exe
  2⤵
  PID:14880
- C:\Windows\System\XzDGdkC.exe
  C:\Windows\System\XzDGdkC.exe
  2⤵
  PID:13300
- C:\Windows\System\osoOpZE.exe
  C:\Windows\System\osoOpZE.exe
  2⤵
  PID:15384
- C:\Windows\System\Rkorkae.exe
  C:\Windows\System\Rkorkae.exe
  2⤵
  PID:15408
- C:\Windows\System\HEaQEFX.exe
  C:\Windows\System\HEaQEFX.exe
  2⤵
  PID:15424
- C:\Windows\System\KccWFKj.exe
  C:\Windows\System\KccWFKj.exe
  2⤵
  PID:15448
- C:\Windows\System\lKgHcqX.exe
  C:\Windows\System\lKgHcqX.exe
  2⤵
  PID:15464
- C:\Windows\System\biWEhJl.exe
  C:\Windows\System\biWEhJl.exe
  2⤵
  PID:15500
- C:\Windows\System\nxDJJXM.exe
  C:\Windows\System\nxDJJXM.exe
  2⤵
  PID:15520
- C:\Windows\System\SpJhpAU.exe
  C:\Windows\System\SpJhpAU.exe
  2⤵
  PID:15548
- C:\Windows\System\lPIBxeL.exe
  C:\Windows\System\lPIBxeL.exe
  2⤵
  PID:15572
- C:\Windows\System\brLkcev.exe
  C:\Windows\System\brLkcev.exe
  2⤵
  PID:15604
- C:\Windows\System\RLQDdsg.exe
  C:\Windows\System\RLQDdsg.exe
  2⤵
  PID:15636
- C:\Windows\System\vkOIpen.exe
  C:\Windows\System\vkOIpen.exe
  2⤵
  PID:15660
- C:\Windows\System\aEuRUPu.exe
  C:\Windows\System\aEuRUPu.exe
  2⤵
  PID:15684
- C:\Windows\System\NRZZAVS.exe
  C:\Windows\System\NRZZAVS.exe
  2⤵
  PID:15704
- C:\Windows\System\msYJUNB.exe
  C:\Windows\System\msYJUNB.exe
  2⤵
  PID:15748
- C:\Windows\System\nsJiljO.exe
  C:\Windows\System\nsJiljO.exe
  2⤵
  PID:15772
- C:\Windows\System\SoKIlUq.exe
  C:\Windows\System\SoKIlUq.exe
  2⤵
  PID:15800
- C:\Windows\System\IttlPGh.exe
  C:\Windows\System\IttlPGh.exe
  2⤵
  PID:15820
- C:\Windows\System\ADApxEK.exe
  C:\Windows\System\ADApxEK.exe
  2⤵
  PID:15860
- C:\Windows\System\FfYqPjN.exe
  C:\Windows\System\FfYqPjN.exe
  2⤵
  PID:15884
- C:\Windows\System\tisLTNI.exe
  C:\Windows\System\tisLTNI.exe
  2⤵
  PID:15924
- C:\Windows\System\YqYaKlG.exe
  C:\Windows\System\YqYaKlG.exe
  2⤵
  PID:15948
- C:\Windows\System\AOMlKPW.exe
  C:\Windows\System\AOMlKPW.exe
  2⤵
  PID:15984
- C:\Windows\System\DtsHsOi.exe
  C:\Windows\System\DtsHsOi.exe
  2⤵
  PID:16012
- C:\Windows\System\HAkAhZA.exe
  C:\Windows\System\HAkAhZA.exe
  2⤵
  PID:16044
- C:\Windows\System\rtgFwXk.exe
  C:\Windows\System\rtgFwXk.exe
  2⤵
  PID:16072
- C:\Windows\System\zCSTXsN.exe
  C:\Windows\System\zCSTXsN.exe
  2⤵
  PID:16100
- C:\Windows\System\vQLgTcQ.exe
  C:\Windows\System\vQLgTcQ.exe
  2⤵
  PID:16124
- C:\Windows\System\LTMXVoB.exe
  C:\Windows\System\LTMXVoB.exe
  2⤵
  PID:16148
- C:\Windows\System\TqBAyLe.exe
  C:\Windows\System\TqBAyLe.exe
  2⤵
  PID:16172
- C:\Windows\System\sKVBGcb.exe
  C:\Windows\System\sKVBGcb.exe
  2⤵
  PID:16196
- C:\Windows\System\ZOzKpWQ.exe
  C:\Windows\System\ZOzKpWQ.exe
  2⤵
  PID:16220
- C:\Windows\System\NqEdOrw.exe
  C:\Windows\System\NqEdOrw.exe
  2⤵
  PID:16244
- C:\Windows\System\OkzEWHH.exe
  C:\Windows\System\OkzEWHH.exe
  2⤵
  PID:16264
- C:\Windows\System\FCKsbaP.exe
  C:\Windows\System\FCKsbaP.exe
  2⤵
  PID:16292
- C:\Windows\System\PBTpvyP.exe
  C:\Windows\System\PBTpvyP.exe
  2⤵
  PID:16316
- C:\Windows\System\rVMggxN.exe
  C:\Windows\System\rVMggxN.exe
  2⤵
  PID:16348
- C:\Windows\System\PaKBlAE.exe
  C:\Windows\System\PaKBlAE.exe
  2⤵
  PID:16364
- C:\Windows\System\iGswbbw.exe
  C:\Windows\System\iGswbbw.exe
  2⤵
  PID:14872
- C:\Windows\System\TRBXgyk.exe
  C:\Windows\System\TRBXgyk.exe
  2⤵
  PID:15296
- C:\Windows\System\Qqhlqwf.exe
  C:\Windows\System\Qqhlqwf.exe
  2⤵
  PID:15000
- C:\Windows\System\bHlFYgX.exe
  C:\Windows\System\bHlFYgX.exe
  2⤵
  PID:4588
- C:\Windows\System\BJKlvTD.exe
  C:\Windows\System\BJKlvTD.exe
  2⤵
  PID:15416
- C:\Windows\System\anpmvge.exe
  C:\Windows\System\anpmvge.exe
  2⤵
  PID:15460
- C:\Windows\System\upaICOD.exe
  C:\Windows\System\upaICOD.exe
  2⤵
  PID:15596
- C:\Windows\System\plZyfgf.exe
  C:\Windows\System\plZyfgf.exe
  2⤵
  PID:15712
- C:\Windows\System\PVAfitT.exe
  C:\Windows\System\PVAfitT.exe
  2⤵
  PID:15732
- C:\Windows\System\sokkCSA.exe
  C:\Windows\System\sokkCSA.exe
  2⤵
  PID:15496
- C:\Windows\System\wwvMGCR.exe
  C:\Windows\System\wwvMGCR.exe
  2⤵
  PID:15916
- C:\Windows\System\soNqXQb.exe
  C:\Windows\System\soNqXQb.exe
  2⤵
  PID:15972
- C:\Windows\System\vECUeLK.exe
  C:\Windows\System\vECUeLK.exe
  2⤵
  PID:15652
- C:\Windows\System\WjOPdEG.exe
  C:\Windows\System\WjOPdEG.exe
  2⤵
  PID:15436
- C:\Windows\System\hETkgVm.exe
  C:\Windows\System\hETkgVm.exe
  2⤵
  PID:15532
- C:\Windows\System\RzAjSIi.exe
  C:\Windows\System\RzAjSIi.exe
  2⤵
  PID:16304
- C:\Windows\System\dOTeNVG.exe
  C:\Windows\System\dOTeNVG.exe
  2⤵
  PID:15628
- C:\Windows\System\kzSaxXE.exe
  C:\Windows\System\kzSaxXE.exe
  2⤵
  PID:15676
- C:\Windows\System\sYGDjXf.exe
  C:\Windows\System\sYGDjXf.exe
  2⤵
  PID:15780
- C:\Windows\System\jlrBrYh.exe
  C:\Windows\System\jlrBrYh.exe
  2⤵
  PID:15844
- C:\Windows\System\oMSqCWP.exe
  C:\Windows\System\oMSqCWP.exe
  2⤵
  PID:16308
- C:\Windows\System\ikldMMr.exe
  C:\Windows\System\ikldMMr.exe
  2⤵
  PID:16380
- C:\Windows\System\TUMvOdd.exe
  C:\Windows\System\TUMvOdd.exe
  2⤵
  PID:16392
- C:\Windows\System\AQsOLdX.exe
  C:\Windows\System\AQsOLdX.exe
  2⤵
  PID:16852
- C:\Windows\System\VOFcPhe.exe
  C:\Windows\System\VOFcPhe.exe
  2⤵
  PID:16868
- C:\Windows\System\XiIpyru.exe
  C:\Windows\System\XiIpyru.exe
  2⤵
  PID:16888
- C:\Windows\System\eSKWpXb.exe
  C:\Windows\System\eSKWpXb.exe
  2⤵
  PID:16904
- C:\Windows\System\GyRxGHY.exe
  C:\Windows\System\GyRxGHY.exe
  2⤵
  PID:16932
- C:\Windows\System\owjFgpG.exe
  C:\Windows\System\owjFgpG.exe
  2⤵
  PID:16956
- C:\Windows\System\IunKEcD.exe
  C:\Windows\System\IunKEcD.exe
  2⤵
  PID:16980
- C:\Windows\System\VqbGHXQ.exe
  C:\Windows\System\VqbGHXQ.exe
  2⤵
  PID:17008
- C:\Windows\System\lmDmGvy.exe
  C:\Windows\System\lmDmGvy.exe
  2⤵
  PID:17032
- C:\Windows\System\ygZRkpK.exe
  C:\Windows\System\ygZRkpK.exe
  2⤵
  PID:17056
- C:\Windows\System\zDubLWy.exe
  C:\Windows\System\zDubLWy.exe
  2⤵
  PID:17092
- C:\Windows\System\wAFZSta.exe
  C:\Windows\System\wAFZSta.exe
  2⤵
  PID:17116
- C:\Windows\System\jhGkQpb.exe
  C:\Windows\System\jhGkQpb.exe
  2⤵
  PID:17136
- C:\Windows\System\yPoLZHv.exe
  C:\Windows\System\yPoLZHv.exe
  2⤵
  PID:17160
- C:\Windows\System\kfBNLbk.exe
  C:\Windows\System\kfBNLbk.exe
  2⤵
  PID:17188
- C:\Windows\System\qyYdjSz.exe
  C:\Windows\System\qyYdjSz.exe
  2⤵
  PID:17220
- C:\Windows\System\uGvJwDY.exe
  C:\Windows\System\uGvJwDY.exe
  2⤵
  PID:17236
- C:\Windows\System\Rbruqpu.exe
  C:\Windows\System\Rbruqpu.exe
  2⤵
  PID:17264
- C:\Windows\System\eMikjVB.exe
  C:\Windows\System\eMikjVB.exe
  2⤵
  PID:17284
- C:\Windows\System\RskwZxL.exe
  C:\Windows\System\RskwZxL.exe
  2⤵
  PID:17308
- C:\Windows\System\KbZcLbX.exe
  C:\Windows\System\KbZcLbX.exe
  2⤵
  PID:17324
- C:\Windows\System\SzELZNC.exe
  C:\Windows\System\SzELZNC.exe
  2⤵
  PID:17344
- C:\Windows\System\meQXAZp.exe
  C:\Windows\System\meQXAZp.exe
  2⤵
  PID:17364
- C:\Windows\System\eOmIiGH.exe
  C:\Windows\System\eOmIiGH.exe
  2⤵
  PID:17392
- C:\Windows\System\ymreNFb.exe
  C:\Windows\System\ymreNFb.exe
  2⤵
  PID:14748
- C:\Windows\System\QFygoZi.exe
  C:\Windows\System\QFygoZi.exe
  2⤵
  PID:15368
- C:\Windows\System\dnCqCJk.exe
  C:\Windows\System\dnCqCJk.exe
  2⤵
  PID:12456
- C:\Windows\System\xgJBPCK.exe
  C:\Windows\System\xgJBPCK.exe
  2⤵
  PID:17104
- C:\Windows\System\FNomGUL.exe
  C:\Windows\System\FNomGUL.exe
  2⤵
  PID:17052
- C:\Windows\System\rbqpQtv.exe
  C:\Windows\System\rbqpQtv.exe
  2⤵
  PID:17148
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 17148 -s 248
    3⤵
    PID:16588
- C:\Windows\System\oqRQXyd.exe
  C:\Windows\System\oqRQXyd.exe
  2⤵
  PID:17144
- C:\Windows\System\IFXqdlg.exe
  C:\Windows\System\IFXqdlg.exe
  2⤵
  PID:17248
- C:\Windows\System\EICfjUL.exe
  C:\Windows\System\EICfjUL.exe
  2⤵
  PID:17300
- C:\Windows\System\dtHgkUK.exe
  C:\Windows\System\dtHgkUK.exe
  2⤵
  PID:17404

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:17044

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16536

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:15476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ACrwQLk.exe

Filesize
1.6MB

MD5
951a357fc655ba95a7665336480cdac1

SHA1
8a4ff20236723c747ba9f57d31f05dbefe00ad09

SHA256
0163bd49f6705e4cbc57d3d891e8acd6296483be453979582cf3004b780e939e

SHA512
c8dbb085feb77da5bb6bbbb0feafb41f1bc475502faebe490ff43c5f9ac1b9769d248294ca4a11be9e27a4327f494b8dd036ae306d0e1c0a0ce6209a94322332

Download Submit
C:\Windows\System\AmPRcuG.exe

Filesize
1.6MB

MD5
45da2585ed65f213890bf4e0b71b69f3

SHA1
0a3fac8871160166b7085a6a01bf2648188fed03

SHA256
65bbdbdd779bb4b3fe633eef6dba4cf83be16dcadb6cff48bda7527320f0e681

SHA512
0a872534949768f505e155dc4636b2dae8010d74be074cd0c97815494c11e608feb97a91a32666ba3ac016f8f9c0dc674c33ccfc5b3e398293185106c71896c6

Download Submit
C:\Windows\System\AmjkRWD.exe

Filesize
1.6MB

MD5
6f04c3c699d12be83d26a2f99a2375d9

SHA1
80d9e12622e7c456d5a548aef89174b88c1b53fd

SHA256
afe5f40fc76674bbab8ed8a898036335173527ec1951941f445273926e3f5954

SHA512
61e1bf54e936392c0ac5a5b92da71249efa3530ee0efe94f2d644f2e1039d69aa39bf772e6010c2350624f2596f660b990161bd0295eefe39c433ea579784c4f

Download Submit
C:\Windows\System\BQZbkQE.exe

Filesize
1.6MB

MD5
f20b1271f069b1eb39fb99da445f84fc

SHA1
2110927aba39ab0c32613c1eb4857041986ef720

SHA256
7df2bd5a097c5f00067d31ef0015c0e0d3a2f882f4bcc8a120513e7157b40508

SHA512
b80e931022e19e9439226e139b1f20f8a51f71db9759e2ef1d14a8611e893f38cb0ac420202b435629adaab22c54b548e2b23c6fa62a21aecfecbbf930674701

Download Submit
C:\Windows\System\BuGLDHX.exe

Filesize
1.6MB

MD5
9dbae44633cc0460d95483f44abc89c6

SHA1
b33fa1cdd53337bf2198600733dfc9b5fce6b338

SHA256
d0c91a345eb6ee033495ca06117de1b08044fb1ad5678d75f80988426e7a1590

SHA512
ab334b19feff81470ec819a07434bc6d0089e38f3d2b25ba75c221afad78faf819496bf5cd747ad7ccce7dacec48daf5ff9b5b6b4a969562c1e78f645178aca0

Download Submit
C:\Windows\System\CmQXmLv.exe

Filesize
1.6MB

MD5
d1ad63392114cef37d2df88defa50062

SHA1
ff9c284ecb4011a5678cba714947b91870dfce73

SHA256
62668c4c9352c52481181dc7061db414f47e02d72648911fb034762e746ade2d

SHA512
3c2dd407a721ce3c31be08bdd20bb4f93d13e71effc370be533061fa8bab727a3c1d3f80a3b4fd43b8cf3eed7f9b6a1db24f96b948dc0595d3744eb8ae0b8c57

Download Submit
C:\Windows\System\CtEQWYS.exe

Filesize
1.6MB

MD5
5b203e82c3e81847e169ab098a667613

SHA1
8308ec2dc650d4d4fa2cc147b3314da99426f689

SHA256
98f5bbf378eee2fd821ace2ab3d16ddaca9ec0c17deeab03c07a240fddc3ffb2

SHA512
f0b8aabb12c1e1de1e9da53d54c37c1bc3d71cf41cb1756ece54ed88714adcb60ab38554b2eb553a4bd93369f6d44e20e2a7c90c964c17ae66ef98585ebef323

Download Submit
C:\Windows\System\DHJxYnT.exe

Filesize
1.6MB

MD5
5fd5e5496b5e9fa3751649589aee6e8e

SHA1
347c137d2ddcfaa79c17222cb174d0942ec2c01c

SHA256
84a5884ba52f0c84a6760fe2347264e325fca16415654fbc822aaf51b4fd1d9b

SHA512
16edbdef6b8ce53f7e3702d17b0062bffc2c869b3772061d8c394766d30c6fdef7d9fb49e3a153c129943022265d0138db585fe33884747da2643081b5463f58

Download Submit
C:\Windows\System\GFIOriy.exe

Filesize
1.6MB

MD5
2ee26cd3b99ecc8c151fc855a77ccbda

SHA1
277a10a870317dfece5b823914c1f0d74bfdc82a

SHA256
37d5d5b726efa3958643ebf5bcda8f9401cfd5deaca7ce4f70a28e19f2acd233

SHA512
16eabe79237431ceed81e61b9c806c323503b374ae7340e47df5e5ef03a6481ae49d9008e933f2338e70647c6278d556a3ea72d0607f44c7bf0f7abfc817988f

Download Submit
C:\Windows\System\JMiKQaz.exe

Filesize
1.6MB

MD5
fa3fa0c5259f470fc4d205b5ce4348a2

SHA1
ae4a9a793127f03ea5a5511582bea54d8eee6e48

SHA256
10faf1b61c1dd5fca449111fe78ea3182ea8f39da0daaafc3f1c650f7b20ed31

SHA512
4e983630c74e8e8aee0f8dc3c23d514623dc80cfac32b0333aec6efbab881cbbf446add24fd66096ee06d369dce9e1777c773650c9439372e05d71c7a9815aef

Download Submit
C:\Windows\System\KTGfvOZ.exe

Filesize
1.6MB

MD5
4bba8d1b85f13dc1e8b6305ea0aaca4d

SHA1
a7fb1c6075420bc9d2f7a26dfe2d415d4cda343a

SHA256
729a9771f4d3e9e94655525e5d33273721c19c3abd60c9ba9e0883e75ba8133c

SHA512
442ebce51233003151daf51b655f0a5e504cdd05d45e39813d05b56bf553b0089b2e4f6f9fd4714eae863a91e70ab6a45027601dd2929a7e823a2f701d970b5a

Download Submit
C:\Windows\System\LhDdRjE.exe

Filesize
1.6MB

MD5
b53e9586d72cb12095bb2ab0404b304f

SHA1
5b0a2f054e558d23fa025c3d3c70c4c8f730a3b8

SHA256
626a79e349bd6fb63866b04dab51c20e1ab63dc8cf3a3499f751124b78e27e55

SHA512
b464a7def7d64d17151c693152075e66bf795edc4469deed211b80aa8c3a59fb71cedbd9b3da6a3755c33b583e8d544da450891cc6cc5114cfaa2eddf0dc1767

Download Submit
C:\Windows\System\LjCPOFe.exe

Filesize
1.6MB

MD5
bb668eb063b5ffc0cf253c03d807a219

SHA1
a7bea4a3e82acb7d2987d6790178c83948cd1a87

SHA256
5a66b8f632043a94c1e511cdff32c0872e0dea2242da5d6e36619443c70c434a

SHA512
b2bdf1a1f8349d688eba55b1318938cd5caafe627441c7341c5cf1ddbb559fea472350eb1f21fd0efdc7626292aef6da24dc518535efe43b4ee3d022aa729413

Download Submit
C:\Windows\System\PFTMdWe.exe

Filesize
1.6MB

MD5
783ad0d5427ecb3a3c537db31d26916c

SHA1
d6d4f0800ca073a268b01c9f2cff012d374021a7

SHA256
be843e65c778d307649283b240f010475f262b4812a14f29c554612bee531b37

SHA512
616fdb6012f8053fd2e4356ef7656fa1a93899d5f6fc262b71b011803e392e4959de7143bbdf6f67e055692f0e872b562dd974423c77e29966a39a300d9cf4ec

Download Submit
C:\Windows\System\PGUPhwU.exe

Filesize
1.6MB

MD5
13a9b033081e4f4e7a2cab59182c0f81

SHA1
a3f6aac934d56c2868538fd4a86faf8875a49498

SHA256
9418020395ecc8210dfe2a7882b654c4b6cd8b4d5fecd0ebe58fadbee2a90f63

SHA512
e9ccf7be3271021784d1ae65f43ae5d855612b7e959d2b5ba921576136b9b64c056ba8d0f135b26cf67dc360475822efacf9dd14890aec3cb3d8f75804fcef53

Download Submit
C:\Windows\System\PRQnELL.exe

Filesize
1.6MB

MD5
b338f916c898b582eaff7fd40d79107c

SHA1
b721e6c99f1245551f0a64c614fc65b2ff9efd73

SHA256
01b7083e57702778a53cd3ab8707d8be680540893d497643cd57c9d50be76caf

SHA512
b00c496cb54f90c03a471e52a6b7ee459234a2e39071b014ecbdeb9db54a0cf909973f8c79cff7340d1ea6e16e5c8199fff39621ce2c9c390fca37c659177a72

Download Submit
C:\Windows\System\PnSnXda.exe

Filesize
1.6MB

MD5
e9168b83f6871d4a99b49f43bc96ef41

SHA1
9bfb4b00028b3a7db4b6524b1231d205dcc7b513

SHA256
12cfee9b4f5e296b1eb6dff4fc75fc4316fc6af8f2a993b9c746ea5274b13cb9

SHA512
071bd0f86140e6cbd7f76b2f12437023b3c39b8acee2edc7e19684c620ab858bbfc83e738469e4ff7014af81c33bc2419b5300f4defd606479a7f3f93a69399c

Download Submit
C:\Windows\System\QXQqXcK.exe

Filesize
1.6MB

MD5
ac249f0b36751f706629dd059fd267c4

SHA1
1157802789a387a88989f641edf121598af098ff

SHA256
40f64da51d40f238dfb7fa4ef7a4089c557f07dbbef3bff4526c3f0f789eb50c

SHA512
c6c7c74946f6ed6d808d78bb084710a29162e9c59c2dd9282191b7147ef65f69eae8e2287b3732fbdbbf89ef995afb947863a93cee5fc437eee70beacb0d9afa

Download Submit
C:\Windows\System\RDQToZf.exe

Filesize
1.6MB

MD5
84ae1a25cb3221fa0ce4d8211c313a26

SHA1
209999c3129d14fad328b73ab84584c1017ba575

SHA256
54eb1f0ab02b1ad7ef765a1a69fd51932b9d7882b5db6aa756582a80d01de3e5

SHA512
dea2de8f75dc71e33df5ac896b8b31b663eeb5244bffaf2c87a9df9ab96694cb0f43ebebb643f8cce5caeb5af7a10b6c60249ecf9c795ee992684c854b629989

Download Submit
C:\Windows\System\RFwhCaQ.exe

Filesize
1.6MB

MD5
8f68921accf7be290558ed97aa76929e

SHA1
326c36823b8600f7863aa1698ce7989b35623e49

SHA256
6bce321ba62b2fa7e809a97945a87adf24147636ecf2093316bb573c88aa7510

SHA512
62661e1bb4b823f54f9b4d2a683ecda6486fd785a812a2827c3ebe72c01d35511a1498136cc9c29a14b798e2013680e8d12a49f729a7fa0cb5d302ba49e6f8c0

Download Submit
C:\Windows\System\SUwOrem.exe

Filesize
1.6MB

MD5
9c575b61fd0112c630b4aea45a2db473

SHA1
81ca71ae3777502f7b6825c643b111e7f46c1326

SHA256
1f9a00bb0725388d353838d59017657439323ce14ba58435e97e363e40cd5889

SHA512
9335c2d01ed1a0bd0126132861afe6595015537efabb86354d63496df09f3786ba10df0534f75d59bc411323eac14774d0f293e3c0fc0abc6908842359776f51

Download Submit
C:\Windows\System\SceZxfQ.exe

Filesize
1.6MB

MD5
c22326dc3c04c236e4149430ddc5855d

SHA1
93bfbce7b35d27b952918324213c80a3d2ab1cfc

SHA256
f64e072076f66ba7d8a14ccd7e917ca7c39a83498481479fd1c799e5991a1cf3

SHA512
262042516e97156f5fc404e5399a8ffa75f801a5dae1510cfda69f3236aa73c418a225fbd704c2bda171c7ff96f7d04f270188c431bd0aaf553f4877cc01261e

Download Submit
C:\Windows\System\UauRVkX.exe

Filesize
1.6MB

MD5
daa86ac70e54fa36dca45480ed4967ae

SHA1
f6b56f020544814aa12d36c53af0fc09c5eff4fa

SHA256
ee275dcae967151b1fc695c850f2a376efa23070da7a976366886a331ff66bea

SHA512
ca5c177f23901ba9241fdd9ceaea53086ac3dad5e36dc3cdca92e1d211573150f3ce616ebf91db7eca9d64160b4b241ebe4b94bcf45ce9b1a3117f44fb43be8f

Download Submit
C:\Windows\System\XGktBVV.exe

Filesize
1.6MB

MD5
66643c0fcdb1ea3008991b5fa3bf683f

SHA1
1f6aab2cf34a01736b94b22efdc0c346f3ee3e8f

SHA256
62d9283daa74695e97ab2cb486e8a68364b4ad92c2d7de5907cb1c8d55387e2f

SHA512
b6d4352e1234f0293bb537dc882f824bc05842cd72fd30ce8c169ac3ee69963aea11012664676e838e3cd8ad9091831da65f54e83d18c4156db7fb054ba5d17e

Download Submit
C:\Windows\System\XTPYzEa.exe

Filesize
1.6MB

MD5
1e2303d414395b6647692be9d3989c2f

SHA1
204014b6f344459b819bce5b38f339a6bf0bcbe4

SHA256
70d74118b55dd1856ac4d8380e1c9d65cfead7b306be77db53601dc2b7af9ce0

SHA512
884096224553d7a841e771f4738f6ab757e762dbc4689b292b04841667dfda998c8d70521130a2d11f215138ae6bab941d4e3fe6124fef32a981b67ff26d57e3

Download Submit
C:\Windows\System\buBQmfK.exe

Filesize
1.6MB

MD5
7f06068031ce5e48c2ebccacf651d7c3

SHA1
e2e1f9f03420c44225ffb0655badf23360da69dc

SHA256
c9541f564696ea35b0de54e57bffdf4e0a735c4dc693f689c2773feb3a6316c6

SHA512
242742421dfa0b7d0035ce5979a33e1408e7c5450302799ba7e3a780c407d4a4477bbac5dc49bc697d4ec7b5beab217f6fdb39a1bb3eb86edcae2403af9c03d6

Download Submit
C:\Windows\System\camaYuz.exe

Filesize
1.6MB

MD5
fe5116bf44a261256c46c1af1727bb7b

SHA1
bfcc879e63de2beb7ce25a4a900aa4830b73a1d4

SHA256
45f0e9279671b9dd51bfc025ed045796cb676d1a7bf3d02fff63a0f8cf7597a8

SHA512
01527a3377b21216d3f581a332fd8ccdcd4bd7dd3976777affce3a4aaff723c460676c744db915516f63631aff96c9bbdd726441fd4d228f8acd8479bfe4c818

Download Submit
C:\Windows\System\dJyrADK.exe

Filesize
1.6MB

MD5
8a0f5a5403f0cff9cd2feecb303353fa

SHA1
cb1dac2a14636ac75b23643716222ba1b80eaf57

SHA256
ef9d1fec4f55b0b4cc4151473c03b8c0502ad0f7c4052f79209307cd7d37029f

SHA512
ff5cfe7dc5f7bcfeb95aafdd66547c086066016385a475da104a33e4f267ea60de0e5a2599fc8c867d1593e79b3438b30483dee216d637a8504d4947144d1cec

Download Submit
C:\Windows\System\dzofqDA.exe

Filesize
1.6MB

MD5
4a848b4b38f5cbde2ad37407e1d18e8d

SHA1
b2cdb021823266a23846e40ea3b3ef6130269f76

SHA256
7764ccb007c9d2fd3b17dd7ea6bf263a875032669c76778a6a75764329bdbc71

SHA512
f4d1dd0a3df7e84690f8168417d98c0139143b7ff5d6a6de3a9e9d7de884aa78baae7dd6ce00f678ee63309c40bb02c87d69950186e1d7071cd6731b5ec8a0da

Download Submit
C:\Windows\System\fTEquoZ.exe

Filesize
1.6MB

MD5
08ee5868c563e37328c8b168af2fe8bf

SHA1
6bfbf8a333211d1352fa06ad8049d8e063e0410c

SHA256
bc2db866797040ba3f6849f0ea4ffc56ac54446f90e49fec3bdeffaf0ec36809

SHA512
23696cd51a11ba667134de43de48aec52becceb820ccec5e8a8bef79d18da5247f55013b05c51b3c9c998d12034f0292be81814464cdb1f7b5f12f8f393b493f

Download Submit
C:\Windows\System\fgAiorG.exe

Filesize
1.6MB

MD5
7eb33893300628fd4b87a01f4e797397

SHA1
4fb73d46284ddc45ced67ce404be1457e213e2ab

SHA256
15f70280f2a65d2c5eedac7ffc64fe3b4f76025cdf30213d85c86ed0838c558d

SHA512
ff8510d952bf27ad2fdfd0d2acd5c17f9273a68b8319aba7371f8ee126f337380cafe396b70c522e66763766469a7ae6cc3b74952c02f473c2f03a5e39dce82e

Download Submit
C:\Windows\System\gDfDbPd.exe

Filesize
1.6MB

MD5
905d64a91252bd84fa2a5a4ab0b223d7

SHA1
54a4adc567c8e6fac2b4961adf0402705265d89a

SHA256
85a8b7b5e86a3c4f0b3388dc16ccafc6ace7c1d6a97870c239bb6a006a8deaca

SHA512
72d2ffa71b7af2de04733049c929976e8d3d5b5600a7e194aba09ddeb9de1f4286a0798c07611b7827d14286814fde59a802eded418e4fc5674d1511a2794ffe

Download Submit
C:\Windows\System\jTPgikK.exe

Filesize
1.6MB

MD5
6e877da899f25044cc00059e5b195bef

SHA1
0bfb7eada4c60bf34afc30229182c4931e61bac9

SHA256
85fc3b1864a1bc83aa54550d2a02562670a56d4a27578073d376714fd1df964d

SHA512
f1634b4bc4947291b38b3fa6e5703cdcc1751f5c1c5efa44b75530729f1c536f918289c2792701a72f1cf847b16f31d2caeaf743585b80ccb87413f2ed58fb42

Download Submit
C:\Windows\System\jwJoRAq.exe

Filesize
1.6MB

MD5
251cea49b4f93478b62c090b04755c32

SHA1
95da326f199a623f17b9d634d26550982909096c

SHA256
22d976fe1e5a95b784fdb9ba87274efead824ea3b8bc2d3d9e751680682b6c6f

SHA512
3a864719446f484092653865385865a1fefc59b23c2d1e4a8c16e464129df9c7ead0c9ed45979ded5dfe75df059f0b84254fd670afcd9803ef2f5defe3c600ec

Download Submit
C:\Windows\System\jzfVIZY.exe

Filesize
1.6MB

MD5
510ab64b06a141a0ec3db764d7bc3052

SHA1
94cd33611b42eb7124539edb8710efd346ac1eda

SHA256
64d74fe590905e217a92cc9bc33637906bb309f54e60d80a86d0f46c1d874c96

SHA512
03f69475aa8a5cedc59fdd2dbf21c80e682cf846c91bc976e6925700128ea6de149620c467e29f453170c3aaacf9d6f28f3a5815d7e1c5d91571ac8f9c74da63

Download Submit
C:\Windows\System\kGyycAf.exe

Filesize
1.6MB

MD5
b61ad2cf1d7b4a0cb01ec0f4a9920529

SHA1
bb40a6aedc086d5c614df0c59b63745194d7fb0e

SHA256
b988215eb902e6f59558dd65ac23f80ea100a57c81412f3108d4c1d172ef480e

SHA512
eeb35ea310a2c4e1effdf374b3c28d19eedcae49500ada11dcdd421bdc05717cb09d236479b2d75701b651261450f3c6814eff105c92b4ebaca07cb1da731815

Download Submit
C:\Windows\System\kYGntCJ.exe

Filesize
1.6MB

MD5
3bb1976cccbfaa361a6543220eeb7ad0

SHA1
7458fc01d6841940a4a6c61b4e81a30a139095ed

SHA256
839e875451f387d1c5ee759fa76b875b442186f35f09daf8ff93492ebbf45020

SHA512
d36d63fc28f3b8e04d3fc8f51d93803d634fd686af90611852f77a3e9cbe391490eccb942b9bac2ffce8488188e99f6ccc7527cdac3245803abdb69fd0c904c1

Download Submit
C:\Windows\System\kmhMZBB.exe

Filesize
1.6MB

MD5
68c669f05c94176afbffa0192bc58ce7

SHA1
516d41472bb680bbd0c8ba5bf62522859f5e3280

SHA256
47e6e544375cdec0c8a6b2cfd8ba7b9f9c15f7f925c8cddbb3d6d7301255a3a3

SHA512
717167562e10262136151f718d89733a92a6733cc88afa2f4add8ac165f3370fc99a92adb7b2ff4f816cd629f6eb7138c1d3c5fb743509f3946939cc0feb6278

Download Submit
C:\Windows\System\kwCJJXq.exe

Filesize
1.6MB

MD5
22271c232ea205afea0aa6bf10f2db14

SHA1
b0023b0ce6d0e1a2f3e69c4a6d0b0dadbb441332

SHA256
68b952cfa1f89325dd54f1df5efb8ac75c5f6a985df7dc2141c61a2695c8858b

SHA512
f405cbc8ff8c1d69c8ead0a19cb0ef12d57570cfcd5b102d30bd2e5201430b7d979c951f660312907c618cd1b3c24429ce4759f6d72c745c16a93084dd1f0bb9

Download Submit
C:\Windows\System\lLFVjhb.exe

Filesize
1.6MB

MD5
129569e65d2221fc2ce8ecd10726d72b

SHA1
31c3f95d57e22e34b1b71116cf9b70bd6cd7b5ba

SHA256
83e55c2c03efdc2ec36259ee8395b69fd576c8c5e9dd6921420d1ac11cc4641d

SHA512
f5ffd38ce27e438db8849432ad801d0556499f99c4e76efcd1f2683286897270d2547921c110fe823a36eb8eeaa90cd70c0db2094c29581d1564a422bbe752c3

Download Submit
C:\Windows\System\mYmaRQO.exe

Filesize
1.6MB

MD5
5f99d9efdfa1a2669216adf1c5683f9e

SHA1
ca267230525a3a3b7fbe15c47f535ee9dcae7f94

SHA256
29e501433d53e2caf63556f8bb7349959f29f8743f51f5f282a17b596671ddd9

SHA512
ca66ead45c0f40e6c527bde960064e97fcc8df646c2d7ae4577b47a9949e1d5197dd41a0d59cffbafe06fe0862375c22b354b96599a844d4feda6810acb4f17e

Download Submit
C:\Windows\System\nZmqJGO.exe

Filesize
1.6MB

MD5
5ddac512ffc988f58fdd4c81e7e1f696

SHA1
329591d053b1c7a6bd4fe868af893900aa3cdda4

SHA256
d8b42e3312956677e680d6fcedb38041921e136eeb204c5652f76ccc47904d3d

SHA512
22b71510a7e8fc02ae8b1cb6ccbd0bda5d83ffb94e9c6331cbab1020aa11458f400af7294c78b3899dd8bc3e39364b8a7bd99fdcdb36f4e9c662f35ea8eadaae

Download Submit
C:\Windows\System\oPLfeax.exe

Filesize
1.6MB

MD5
4a543a242f7510a073f709463c791dd8

SHA1
b41f9a0af5530d699e8b73fc510f3a3fb9a7577c

SHA256
37a5b7f1d1cdffc4a25ed06081d3432f5a77c160578f87996cedea486888de65

SHA512
d3c9b188ec1da26b6947f1a892218c06ee5a60acf7e780798be850fe841ba583bd423557fe92cc9a9a5499d9b950548623a693e5458a925c282dd5647f04c5ea

Download Submit
C:\Windows\System\pkvOasg.exe

Filesize
1.6MB

MD5
8183df026050223946d2d6ba20e5c548

SHA1
b02488381de59e448e05dfe61fecf197fbc17563

SHA256
a00b2107aeb7e74faa99aa8cef035782ec0ae98146ee3165b810140475562879

SHA512
c877b8c6a52924cde587ce575ccd75ec1edd0153e8b2c07de499ed77dc0c1e7c2f03adb832982a878b7860481e62cda0eedc70a3b90cbc93431d775443ca9370

Download Submit
C:\Windows\System\rFoDmiG.exe

Filesize
1.6MB

MD5
5541c600f88ff30eb7fdcd22c86ce57b

SHA1
f002705f3dd54bc7795f833f7ba4f028832421cd

SHA256
985e657baf9cdcb2bfa323387d0d0c41726fbab0ce5912d141bc00c227481787

SHA512
8d9b26d6f43acac85ebbead06b2d1d6469a7257eef6ceec9abb8c0833b542394a971255047ca8a17a6fe668bcad06af171e04846a411d6e26147d10d1417c191

Download Submit
C:\Windows\System\rMaGPal.exe

Filesize
1.6MB

MD5
91d2389b93cfd023948a853604bd77cf

SHA1
1f357541e92ae398c5ced1fd34a36c2b5c57fdd6

SHA256
d90f3ace527ee6600b82b3e6d239e2c2a0dc8095511445c3344fd926bbfcd499

SHA512
1d72a31359794c838e3f897fb40bb9129c2df90585e9fbcf68a332b3078667b09cb65612bdaf84714174f8ba18549478d3f3f286a7d84b11d2fb300fd0887b0b

Download Submit
C:\Windows\System\tAvdnnE.exe

Filesize
1.6MB

MD5
2ad5ee3e6a362ee2f8e0ea64e2df501b

SHA1
bd1bab279c80c4f603604cd57f39b0566a094153

SHA256
14beaf16d64ab44212ec81b0c26e4dc7bc58c36879e047516f9d9d7bbb66453f

SHA512
a1d46209f433ebcad2d062449eab2c35ed0d4bcc46b3d2a6cad5f06656e9b87affbab895400538df8252e74c3ff316f49f8f21f347acb747c64f6bf4707e4c88

Download Submit
C:\Windows\System\vWSnzqe.exe

Filesize
1.6MB

MD5
e3493fde47614516f472d4ed89601c46

SHA1
fa5fc9044d013d133814c0f3cbfe21966d3c8456

SHA256
05804027eddd9dc53e0220a61db99a8afee27598339a8283f06f82d9ef34e6df

SHA512
2cb28c74d28b770de74731f7f2d122dcd5e72fa6ab700f9591c3d852b6709eb7009e92b077dfeece745763f1fade181da05aa968f655eab739d2cd026f52eecc

Download Submit
C:\Windows\System\wTAWgDE.exe

Filesize
1.6MB

MD5
b9d9ece980157b0167e3376fc601d7bd

SHA1
3461113b3c577cde5da5649bf3e4012facc2a5eb

SHA256
0e73b08a3a5da09d178111075c72f95c8dba62b99e56f2770d51ee89db2900e0

SHA512
68fbda1beff6b1de01f618822bb8c348dcdc7385a985a50ff104f616ae2ab1b00cc887aa5560f250eee0255cc40e443ed59939035683f79619bfee04de93c4f8

Download Submit
memory/3408-0-0x000001619C030000-0x000001619C040000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads