xmrig | 92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
Size

1.6MB
MD5

4baf598fc91ead27ff253fe66e99819a
SHA1

25e74dcd299ea4ce72f6e5c31732317eb50c517e
SHA256

92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1
SHA512

f2e7b7717e7683cb2c52483e0f85cfcd9fdd1d1a3bc156b06f052b3aa7bc1fdde3a06b9ef9dc655517e4c66044f78801679265a45da12fb62b518afd88cb7b09
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZlCpP:GemTLkNdfE0pZy0

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b2b-3.dat	xmrig
behavioral2/files/0x000a000000023b7f-7.dat	xmrig
behavioral2/files/0x000b000000023b7b-9.dat	xmrig
behavioral2/files/0x000a000000023b80-20.dat	xmrig
behavioral2/files/0x000a000000023b81-25.dat	xmrig
behavioral2/files/0x000a000000023b83-32.dat	xmrig
behavioral2/files/0x000a000000023b87-52.dat	xmrig
behavioral2/files/0x000a000000023b8a-73.dat	xmrig
behavioral2/files/0x000a000000023b8e-89.dat	xmrig
behavioral2/files/0x000b000000023b92-109.dat	xmrig
behavioral2/files/0x000a000000023b9c-130.dat	xmrig
behavioral2/files/0x0008000000023bbc-162.dat	xmrig
behavioral2/files/0x000e000000023bb7-160.dat	xmrig
behavioral2/files/0x0008000000023bb9-157.dat	xmrig
behavioral2/files/0x0009000000023bb3-155.dat	xmrig
behavioral2/files/0x0009000000023bb2-150.dat	xmrig
behavioral2/files/0x0009000000023bb1-145.dat	xmrig
behavioral2/files/0x0008000000023bac-140.dat	xmrig
behavioral2/files/0x000e000000023ba3-135.dat	xmrig
behavioral2/files/0x000b000000023b94-125.dat	xmrig
behavioral2/files/0x000b000000023b93-120.dat	xmrig
behavioral2/files/0x000a000000023b91-107.dat	xmrig
behavioral2/files/0x000a000000023b90-103.dat	xmrig
behavioral2/files/0x000a000000023b8f-97.dat	xmrig
behavioral2/files/0x000a000000023b8d-87.dat	xmrig
behavioral2/files/0x000a000000023b8c-83.dat	xmrig
behavioral2/files/0x000a000000023b8b-77.dat	xmrig
behavioral2/files/0x000a000000023b89-68.dat	xmrig
behavioral2/files/0x000a000000023b88-63.dat	xmrig
behavioral2/files/0x000a000000023b86-53.dat	xmrig
behavioral2/files/0x000a000000023b85-47.dat	xmrig
behavioral2/files/0x000a000000023b84-43.dat	xmrig
behavioral2/files/0x000a000000023b82-33.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1004	PrpnCga.exe
3396	tMHDRkM.exe
3616	YeKSUOM.exe
1668	GIqmDNj.exe
980	rIINCRD.exe
2856	NNRLvUw.exe
4832	KchQIXs.exe
2348	xnnHvZh.exe
944	VLbuMDG.exe
4608	afoqTfF.exe
4916	wKtbtBM.exe
3076	bvjNtZd.exe
2912	NZBAMlj.exe
3512	eQXKXMk.exe
1476	uwXrjBg.exe
3164	TOThhhY.exe
2456	juSlOHe.exe
2972	wQfYXGp.exe
2760	ZtfPCaS.exe
3708	hTcDtIu.exe
8	iarVrtg.exe
3704	vsoywqY.exe
5036	uDgbQQz.exe
4448	QzbUrRB.exe
4468	vrWEqxt.exe
468	LBJSZKs.exe
1844	NfvTbzV.exe
5116	UEFiYDa.exe
2476	czdaHGc.exe
372	LgkAyMF.exe
3256	DFDnidA.exe
2524	PQVHdcA.exe
2636	RocAYUk.exe
4944	nADwkgK.exe
2284	eIMxaUi.exe
3020	ldGILDS.exe
2932	aupHISc.exe
4892	BRzywXN.exe
3184	rPlKFTm.exe
2880	Wsygkcb.exe
4432	VcQoRey.exe
1804	wxYpNvE.exe
3432	FYXjHEi.exe
3092	UsMAWQI.exe
316	yXcgwEz.exe
3100	YuXIize.exe
3428	WMkRtcN.exe
4380	dAbVqGM.exe
2412	wZryDEc.exe
3660	doCWtdQ.exe
224	SddvEvq.exe
1504	kDjXRne.exe
4476	fFjRLqW.exe
4220	bOQSLJt.exe
4768	eKHcsae.exe
2356	Qwauelo.exe
3964	ExgwVIS.exe
1608	aLYeopm.exe
3136	ASvAeNT.exe
2900	LobaKWb.exe
4012	tGUbUAt.exe
868	AeCtNKM.exe
2520	DHytyBw.exe
3644	DgMAkQQ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VBdjHLC.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\EHnlsEv.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\ufznZxm.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\aQVtOhA.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\nsySIjs.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\QavFtRw.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\PJTSuXv.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\PEblgPf.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\tfqfWQx.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\OZMJikz.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\UVKbimm.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\DgMAkQQ.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\AVdxALb.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\vfNYqkF.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\MdQJsRX.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\JqFLdZH.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\GZMEvXE.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\fetEPVn.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\ZJnmJCn.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\fIGvQyx.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\NfvTbzV.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\FdrmXKD.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\JHPDAFi.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\abwdPfm.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\xHFHnMc.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\zlBqajo.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\cWwVGwN.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\GKGpOTA.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\AZgQYCC.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\SLtpSIV.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\QzbUrRB.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\YJZqtmR.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\SYTFoGA.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\Wsygkcb.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\uqjgUsC.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\qbeRoMk.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\lmKAAKl.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\udwybVV.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\qfTWkcz.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\slAXbrL.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\GxhPQTJ.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\HNwIpkH.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\bzPZYsw.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\vdOdiQk.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\BnIKFtq.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\rntdWrk.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\lDIDpsj.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\QoEvCGk.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\JkqlvRb.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\KtLYjao.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\JOIQVjU.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\fAVzZjf.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\YGvGgPL.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\TzKxmgv.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\eDRwuGJ.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\cVXomLd.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\MctnFWd.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\YSLVoXT.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\KchQIXs.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\wffKzYb.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\tUxnQMJ.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\YKEdcOe.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\PkBrbzV.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
File created	C:\Windows\System\BVbrrpn.exe	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16436	dwm.exe
Token: SeChangeNotifyPrivilege	16436	dwm.exe
Token: 33	16436	dwm.exe
Token: SeIncBasePriorityPrivilege	16436	dwm.exe
Token: SeShutdownPrivilege	16436	dwm.exe
Token: SeCreatePagefilePrivilege	16436	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 1004	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	84
PID 2324 wrote to memory of 1004	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	84
PID 2324 wrote to memory of 3396	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	85
PID 2324 wrote to memory of 3396	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	85
PID 2324 wrote to memory of 3616	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	86
PID 2324 wrote to memory of 3616	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	86
PID 2324 wrote to memory of 1668	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	87
PID 2324 wrote to memory of 1668	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	87
PID 2324 wrote to memory of 980	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	88
PID 2324 wrote to memory of 980	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	88
PID 2324 wrote to memory of 2856	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	89
PID 2324 wrote to memory of 2856	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	89
PID 2324 wrote to memory of 4832	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	90
PID 2324 wrote to memory of 4832	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	90
PID 2324 wrote to memory of 2348	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	91
PID 2324 wrote to memory of 2348	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	91
PID 2324 wrote to memory of 944	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	92
PID 2324 wrote to memory of 944	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	92
PID 2324 wrote to memory of 4608	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	93
PID 2324 wrote to memory of 4608	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	93
PID 2324 wrote to memory of 4916	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	94
PID 2324 wrote to memory of 4916	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	94
PID 2324 wrote to memory of 3076	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	95
PID 2324 wrote to memory of 3076	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	95
PID 2324 wrote to memory of 2912	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	96
PID 2324 wrote to memory of 2912	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	96
PID 2324 wrote to memory of 3512	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	97
PID 2324 wrote to memory of 3512	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	97
PID 2324 wrote to memory of 1476	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	98
PID 2324 wrote to memory of 1476	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	98
PID 2324 wrote to memory of 3164	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	99
PID 2324 wrote to memory of 3164	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	99
PID 2324 wrote to memory of 2456	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	100
PID 2324 wrote to memory of 2456	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	100
PID 2324 wrote to memory of 2972	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	101
PID 2324 wrote to memory of 2972	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	101
PID 2324 wrote to memory of 2760	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	102
PID 2324 wrote to memory of 2760	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	102
PID 2324 wrote to memory of 3708	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	103
PID 2324 wrote to memory of 3708	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	103
PID 2324 wrote to memory of 8	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	104
PID 2324 wrote to memory of 8	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	104
PID 2324 wrote to memory of 3704	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	105
PID 2324 wrote to memory of 3704	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	105
PID 2324 wrote to memory of 5036	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	106
PID 2324 wrote to memory of 5036	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	106
PID 2324 wrote to memory of 4448	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	107
PID 2324 wrote to memory of 4448	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	107
PID 2324 wrote to memory of 4468	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	108
PID 2324 wrote to memory of 4468	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	108
PID 2324 wrote to memory of 468	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	109
PID 2324 wrote to memory of 468	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	109
PID 2324 wrote to memory of 1844	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	110
PID 2324 wrote to memory of 1844	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	110
PID 2324 wrote to memory of 5116	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	111
PID 2324 wrote to memory of 5116	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	111
PID 2324 wrote to memory of 2476	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	112
PID 2324 wrote to memory of 2476	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	112
PID 2324 wrote to memory of 372	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	113
PID 2324 wrote to memory of 372	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	113
PID 2324 wrote to memory of 3256	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	114
PID 2324 wrote to memory of 3256	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	114
PID 2324 wrote to memory of 2524	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	115
PID 2324 wrote to memory of 2524	2324	92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe	115

C:\Users\Admin\AppData\Local\Temp\92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe
"C:\Users\Admin\AppData\Local\Temp\92df645f61885a2f9a9f0c94aaf0c51ab8c30147f3515a7187a28616c23077a1.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\System\PrpnCga.exe
  C:\Windows\System\PrpnCga.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\tMHDRkM.exe
  C:\Windows\System\tMHDRkM.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\YeKSUOM.exe
  C:\Windows\System\YeKSUOM.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\GIqmDNj.exe
  C:\Windows\System\GIqmDNj.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\rIINCRD.exe
  C:\Windows\System\rIINCRD.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\NNRLvUw.exe
  C:\Windows\System\NNRLvUw.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\KchQIXs.exe
  C:\Windows\System\KchQIXs.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\xnnHvZh.exe
  C:\Windows\System\xnnHvZh.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\VLbuMDG.exe
  C:\Windows\System\VLbuMDG.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\afoqTfF.exe
  C:\Windows\System\afoqTfF.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\wKtbtBM.exe
  C:\Windows\System\wKtbtBM.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\bvjNtZd.exe
  C:\Windows\System\bvjNtZd.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\NZBAMlj.exe
  C:\Windows\System\NZBAMlj.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\eQXKXMk.exe
  C:\Windows\System\eQXKXMk.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\uwXrjBg.exe
  C:\Windows\System\uwXrjBg.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\TOThhhY.exe
  C:\Windows\System\TOThhhY.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\juSlOHe.exe
  C:\Windows\System\juSlOHe.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\wQfYXGp.exe
  C:\Windows\System\wQfYXGp.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\ZtfPCaS.exe
  C:\Windows\System\ZtfPCaS.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\hTcDtIu.exe
  C:\Windows\System\hTcDtIu.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\iarVrtg.exe
  C:\Windows\System\iarVrtg.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\vsoywqY.exe
  C:\Windows\System\vsoywqY.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\uDgbQQz.exe
  C:\Windows\System\uDgbQQz.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\QzbUrRB.exe
  C:\Windows\System\QzbUrRB.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\vrWEqxt.exe
  C:\Windows\System\vrWEqxt.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\LBJSZKs.exe
  C:\Windows\System\LBJSZKs.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\NfvTbzV.exe
  C:\Windows\System\NfvTbzV.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\UEFiYDa.exe
  C:\Windows\System\UEFiYDa.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\czdaHGc.exe
  C:\Windows\System\czdaHGc.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\LgkAyMF.exe
  C:\Windows\System\LgkAyMF.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\DFDnidA.exe
  C:\Windows\System\DFDnidA.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\PQVHdcA.exe
  C:\Windows\System\PQVHdcA.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\RocAYUk.exe
  C:\Windows\System\RocAYUk.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\nADwkgK.exe
  C:\Windows\System\nADwkgK.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\eIMxaUi.exe
  C:\Windows\System\eIMxaUi.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\ldGILDS.exe
  C:\Windows\System\ldGILDS.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\aupHISc.exe
  C:\Windows\System\aupHISc.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\BRzywXN.exe
  C:\Windows\System\BRzywXN.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\rPlKFTm.exe
  C:\Windows\System\rPlKFTm.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\Wsygkcb.exe
  C:\Windows\System\Wsygkcb.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\VcQoRey.exe
  C:\Windows\System\VcQoRey.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\wxYpNvE.exe
  C:\Windows\System\wxYpNvE.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\FYXjHEi.exe
  C:\Windows\System\FYXjHEi.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\UsMAWQI.exe
  C:\Windows\System\UsMAWQI.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\yXcgwEz.exe
  C:\Windows\System\yXcgwEz.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\YuXIize.exe
  C:\Windows\System\YuXIize.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\WMkRtcN.exe
  C:\Windows\System\WMkRtcN.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\dAbVqGM.exe
  C:\Windows\System\dAbVqGM.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\wZryDEc.exe
  C:\Windows\System\wZryDEc.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\doCWtdQ.exe
  C:\Windows\System\doCWtdQ.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\SddvEvq.exe
  C:\Windows\System\SddvEvq.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\kDjXRne.exe
  C:\Windows\System\kDjXRne.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\fFjRLqW.exe
  C:\Windows\System\fFjRLqW.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\bOQSLJt.exe
  C:\Windows\System\bOQSLJt.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\eKHcsae.exe
  C:\Windows\System\eKHcsae.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\Qwauelo.exe
  C:\Windows\System\Qwauelo.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\ExgwVIS.exe
  C:\Windows\System\ExgwVIS.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\aLYeopm.exe
  C:\Windows\System\aLYeopm.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\ASvAeNT.exe
  C:\Windows\System\ASvAeNT.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\LobaKWb.exe
  C:\Windows\System\LobaKWb.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\tGUbUAt.exe
  C:\Windows\System\tGUbUAt.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\AeCtNKM.exe
  C:\Windows\System\AeCtNKM.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\DHytyBw.exe
  C:\Windows\System\DHytyBw.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\DgMAkQQ.exe
  C:\Windows\System\DgMAkQQ.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\CuBSxVf.exe
  C:\Windows\System\CuBSxVf.exe
  2⤵
  PID:2000
- C:\Windows\System\clsLEnf.exe
  C:\Windows\System\clsLEnf.exe
  2⤵
  PID:1276
- C:\Windows\System\ZUCGysk.exe
  C:\Windows\System\ZUCGysk.exe
  2⤵
  PID:456
- C:\Windows\System\vCcszyi.exe
  C:\Windows\System\vCcszyi.exe
  2⤵
  PID:2936
- C:\Windows\System\TsuTqpY.exe
  C:\Windows\System\TsuTqpY.exe
  2⤵
  PID:4484
- C:\Windows\System\qfTWkcz.exe
  C:\Windows\System\qfTWkcz.exe
  2⤵
  PID:1200
- C:\Windows\System\iVTNPSk.exe
  C:\Windows\System\iVTNPSk.exe
  2⤵
  PID:2236
- C:\Windows\System\McIdLSK.exe
  C:\Windows\System\McIdLSK.exe
  2⤵
  PID:2268
- C:\Windows\System\Vegpeea.exe
  C:\Windows\System\Vegpeea.exe
  2⤵
  PID:780
- C:\Windows\System\pGXzRyr.exe
  C:\Windows\System\pGXzRyr.exe
  2⤵
  PID:3516
- C:\Windows\System\EHnlsEv.exe
  C:\Windows\System\EHnlsEv.exe
  2⤵
  PID:5144
- C:\Windows\System\ACalAiK.exe
  C:\Windows\System\ACalAiK.exe
  2⤵
  PID:5172
- C:\Windows\System\ufznZxm.exe
  C:\Windows\System\ufznZxm.exe
  2⤵
  PID:5200
- C:\Windows\System\mJFVGZF.exe
  C:\Windows\System\mJFVGZF.exe
  2⤵
  PID:5232
- C:\Windows\System\weYefnU.exe
  C:\Windows\System\weYefnU.exe
  2⤵
  PID:5256
- C:\Windows\System\vwMcNmX.exe
  C:\Windows\System\vwMcNmX.exe
  2⤵
  PID:5284
- C:\Windows\System\jLRPpXZ.exe
  C:\Windows\System\jLRPpXZ.exe
  2⤵
  PID:5316
- C:\Windows\System\mXhIBUs.exe
  C:\Windows\System\mXhIBUs.exe
  2⤵
  PID:5344
- C:\Windows\System\HHSEwYP.exe
  C:\Windows\System\HHSEwYP.exe
  2⤵
  PID:5368
- C:\Windows\System\xtjGqOx.exe
  C:\Windows\System\xtjGqOx.exe
  2⤵
  PID:5400
- C:\Windows\System\IeddsSA.exe
  C:\Windows\System\IeddsSA.exe
  2⤵
  PID:5424
- C:\Windows\System\hTJVzAJ.exe
  C:\Windows\System\hTJVzAJ.exe
  2⤵
  PID:5452
- C:\Windows\System\MHVMnWh.exe
  C:\Windows\System\MHVMnWh.exe
  2⤵
  PID:5480
- C:\Windows\System\iaByRMW.exe
  C:\Windows\System\iaByRMW.exe
  2⤵
  PID:5508
- C:\Windows\System\VwLoRPT.exe
  C:\Windows\System\VwLoRPT.exe
  2⤵
  PID:5536
- C:\Windows\System\mPCTexj.exe
  C:\Windows\System\mPCTexj.exe
  2⤵
  PID:5564
- C:\Windows\System\FnDBaCx.exe
  C:\Windows\System\FnDBaCx.exe
  2⤵
  PID:5592
- C:\Windows\System\rmAWnvJ.exe
  C:\Windows\System\rmAWnvJ.exe
  2⤵
  PID:5624
- C:\Windows\System\dfRwplb.exe
  C:\Windows\System\dfRwplb.exe
  2⤵
  PID:5648
- C:\Windows\System\tfqfWQx.exe
  C:\Windows\System\tfqfWQx.exe
  2⤵
  PID:5676
- C:\Windows\System\nCUsNOh.exe
  C:\Windows\System\nCUsNOh.exe
  2⤵
  PID:5708
- C:\Windows\System\tMOzjCy.exe
  C:\Windows\System\tMOzjCy.exe
  2⤵
  PID:5732
- C:\Windows\System\EZsfsba.exe
  C:\Windows\System\EZsfsba.exe
  2⤵
  PID:5764
- C:\Windows\System\XEhdZrb.exe
  C:\Windows\System\XEhdZrb.exe
  2⤵
  PID:5784
- C:\Windows\System\aQVtOhA.exe
  C:\Windows\System\aQVtOhA.exe
  2⤵
  PID:5820
- C:\Windows\System\yoECcHq.exe
  C:\Windows\System\yoECcHq.exe
  2⤵
  PID:5848
- C:\Windows\System\sCOsDUp.exe
  C:\Windows\System\sCOsDUp.exe
  2⤵
  PID:5876
- C:\Windows\System\eFlpxqq.exe
  C:\Windows\System\eFlpxqq.exe
  2⤵
  PID:5904
- C:\Windows\System\BHJxeuF.exe
  C:\Windows\System\BHJxeuF.exe
  2⤵
  PID:5928
- C:\Windows\System\BDkDWwi.exe
  C:\Windows\System\BDkDWwi.exe
  2⤵
  PID:5992
- C:\Windows\System\btvRCJc.exe
  C:\Windows\System\btvRCJc.exe
  2⤵
  PID:6008
- C:\Windows\System\VAnsfMG.exe
  C:\Windows\System\VAnsfMG.exe
  2⤵
  PID:6024
- C:\Windows\System\bhnrmRR.exe
  C:\Windows\System\bhnrmRR.exe
  2⤵
  PID:6048
- C:\Windows\System\nXJmXBg.exe
  C:\Windows\System\nXJmXBg.exe
  2⤵
  PID:6076
- C:\Windows\System\ALEcLIQ.exe
  C:\Windows\System\ALEcLIQ.exe
  2⤵
  PID:6096
- C:\Windows\System\uqjgUsC.exe
  C:\Windows\System\uqjgUsC.exe
  2⤵
  PID:6120
- C:\Windows\System\EAxPFOq.exe
  C:\Windows\System\EAxPFOq.exe
  2⤵
  PID:4552
- C:\Windows\System\YufKqIa.exe
  C:\Windows\System\YufKqIa.exe
  2⤵
  PID:3160
- C:\Windows\System\AzeMiZU.exe
  C:\Windows\System\AzeMiZU.exe
  2⤵
  PID:4288
- C:\Windows\System\HRFWHix.exe
  C:\Windows\System\HRFWHix.exe
  2⤵
  PID:3896
- C:\Windows\System\YpNNDBd.exe
  C:\Windows\System\YpNNDBd.exe
  2⤵
  PID:4908
- C:\Windows\System\YdfmvDS.exe
  C:\Windows\System\YdfmvDS.exe
  2⤵
  PID:3080
- C:\Windows\System\jKAUaVy.exe
  C:\Windows\System\jKAUaVy.exe
  2⤵
  PID:5132
- C:\Windows\System\MXRsgKA.exe
  C:\Windows\System\MXRsgKA.exe
  2⤵
  PID:5212
- C:\Windows\System\yhfOBBj.exe
  C:\Windows\System\yhfOBBj.exe
  2⤵
  PID:5268
- C:\Windows\System\LxKpSwc.exe
  C:\Windows\System\LxKpSwc.exe
  2⤵
  PID:5332
- C:\Windows\System\oKvZPKv.exe
  C:\Windows\System\oKvZPKv.exe
  2⤵
  PID:5388
- C:\Windows\System\bKkZkJS.exe
  C:\Windows\System\bKkZkJS.exe
  2⤵
  PID:5464
- C:\Windows\System\GPaJUCv.exe
  C:\Windows\System\GPaJUCv.exe
  2⤵
  PID:5524
- C:\Windows\System\vFkYEyd.exe
  C:\Windows\System\vFkYEyd.exe
  2⤵
  PID:5584
- C:\Windows\System\OcZacOa.exe
  C:\Windows\System\OcZacOa.exe
  2⤵
  PID:5644
- C:\Windows\System\IErCHie.exe
  C:\Windows\System\IErCHie.exe
  2⤵
  PID:5716
- C:\Windows\System\GRHiOJT.exe
  C:\Windows\System\GRHiOJT.exe
  2⤵
  PID:5776
- C:\Windows\System\ookEFQC.exe
  C:\Windows\System\ookEFQC.exe
  2⤵
  PID:5840
- C:\Windows\System\dAxtdPK.exe
  C:\Windows\System\dAxtdPK.exe
  2⤵
  PID:5896
- C:\Windows\System\MnDFrAi.exe
  C:\Windows\System\MnDFrAi.exe
  2⤵
  PID:5984
- C:\Windows\System\aCQTuQv.exe
  C:\Windows\System\aCQTuQv.exe
  2⤵
  PID:6040
- C:\Windows\System\QuSuolP.exe
  C:\Windows\System\QuSuolP.exe
  2⤵
  PID:6108
- C:\Windows\System\nsySIjs.exe
  C:\Windows\System\nsySIjs.exe
  2⤵
  PID:884
- C:\Windows\System\aLRapQF.exe
  C:\Windows\System\aLRapQF.exe
  2⤵
  PID:608
- C:\Windows\System\uMJNLSh.exe
  C:\Windows\System\uMJNLSh.exe
  2⤵
  PID:2144
- C:\Windows\System\MBfSDpo.exe
  C:\Windows\System\MBfSDpo.exe
  2⤵
  PID:4008
- C:\Windows\System\ZLRkKCI.exe
  C:\Windows\System\ZLRkKCI.exe
  2⤵
  PID:5300
- C:\Windows\System\UFMFeIS.exe
  C:\Windows\System\UFMFeIS.exe
  2⤵
  PID:5440
- C:\Windows\System\UQrUnKd.exe
  C:\Windows\System\UQrUnKd.exe
  2⤵
  PID:5556
- C:\Windows\System\YPRBYoN.exe
  C:\Windows\System\YPRBYoN.exe
  2⤵
  PID:5688
- C:\Windows\System\ZdondVt.exe
  C:\Windows\System\ZdondVt.exe
  2⤵
  PID:5828
- C:\Windows\System\GUPDOmc.exe
  C:\Windows\System\GUPDOmc.exe
  2⤵
  PID:5960
- C:\Windows\System\usOFwPK.exe
  C:\Windows\System\usOFwPK.exe
  2⤵
  PID:6136
- C:\Windows\System\QDAIdJS.exe
  C:\Windows\System\QDAIdJS.exe
  2⤵
  PID:6164
- C:\Windows\System\XOoFQzi.exe
  C:\Windows\System\XOoFQzi.exe
  2⤵
  PID:6192
- C:\Windows\System\BzxRZgH.exe
  C:\Windows\System\BzxRZgH.exe
  2⤵
  PID:6220
- C:\Windows\System\NtzOYRp.exe
  C:\Windows\System\NtzOYRp.exe
  2⤵
  PID:6248
- C:\Windows\System\gZvFFsR.exe
  C:\Windows\System\gZvFFsR.exe
  2⤵
  PID:6272
- C:\Windows\System\bkRiTvc.exe
  C:\Windows\System\bkRiTvc.exe
  2⤵
  PID:6300
- C:\Windows\System\ONWXIHZ.exe
  C:\Windows\System\ONWXIHZ.exe
  2⤵
  PID:6328
- C:\Windows\System\VpIEDZJ.exe
  C:\Windows\System\VpIEDZJ.exe
  2⤵
  PID:6356
- C:\Windows\System\WuqWnCY.exe
  C:\Windows\System\WuqWnCY.exe
  2⤵
  PID:6384
- C:\Windows\System\yzUrpKT.exe
  C:\Windows\System\yzUrpKT.exe
  2⤵
  PID:6456
- C:\Windows\System\FZCJCOT.exe
  C:\Windows\System\FZCJCOT.exe
  2⤵
  PID:6492
- C:\Windows\System\loqxcsd.exe
  C:\Windows\System\loqxcsd.exe
  2⤵
  PID:6540
- C:\Windows\System\YGvGgPL.exe
  C:\Windows\System\YGvGgPL.exe
  2⤵
  PID:6580
- C:\Windows\System\HgjsXby.exe
  C:\Windows\System\HgjsXby.exe
  2⤵
  PID:6608
- C:\Windows\System\OZMJikz.exe
  C:\Windows\System\OZMJikz.exe
  2⤵
  PID:6636
- C:\Windows\System\mskStAl.exe
  C:\Windows\System\mskStAl.exe
  2⤵
  PID:6664
- C:\Windows\System\okOiTOY.exe
  C:\Windows\System\okOiTOY.exe
  2⤵
  PID:6680
- C:\Windows\System\fzwpEfD.exe
  C:\Windows\System\fzwpEfD.exe
  2⤵
  PID:6716
- C:\Windows\System\foNXWzo.exe
  C:\Windows\System\foNXWzo.exe
  2⤵
  PID:6748
- C:\Windows\System\QVfTUdu.exe
  C:\Windows\System\QVfTUdu.exe
  2⤵
  PID:6764
- C:\Windows\System\GeHEOzY.exe
  C:\Windows\System\GeHEOzY.exe
  2⤵
  PID:6796
- C:\Windows\System\cuVOZMS.exe
  C:\Windows\System\cuVOZMS.exe
  2⤵
  PID:6832
- C:\Windows\System\CWTUXdt.exe
  C:\Windows\System\CWTUXdt.exe
  2⤵
  PID:6864
- C:\Windows\System\WZVXkqB.exe
  C:\Windows\System\WZVXkqB.exe
  2⤵
  PID:6880
- C:\Windows\System\KrsIbGC.exe
  C:\Windows\System\KrsIbGC.exe
  2⤵
  PID:6900
- C:\Windows\System\HKGGFlx.exe
  C:\Windows\System\HKGGFlx.exe
  2⤵
  PID:6924
- C:\Windows\System\fYjJAXp.exe
  C:\Windows\System\fYjJAXp.exe
  2⤵
  PID:6960
- C:\Windows\System\qbeRoMk.exe
  C:\Windows\System\qbeRoMk.exe
  2⤵
  PID:6992
- C:\Windows\System\kDGsyry.exe
  C:\Windows\System\kDGsyry.exe
  2⤵
  PID:7020
- C:\Windows\System\YklBozZ.exe
  C:\Windows\System\YklBozZ.exe
  2⤵
  PID:7060
- C:\Windows\System\HEjFneE.exe
  C:\Windows\System\HEjFneE.exe
  2⤵
  PID:7088
- C:\Windows\System\iqTmvLN.exe
  C:\Windows\System\iqTmvLN.exe
  2⤵
  PID:7104
- C:\Windows\System\nupFdUN.exe
  C:\Windows\System\nupFdUN.exe
  2⤵
  PID:7132
- C:\Windows\System\EnpiOnW.exe
  C:\Windows\System\EnpiOnW.exe
  2⤵
  PID:7160
- C:\Windows\System\HcboBVO.exe
  C:\Windows\System\HcboBVO.exe
  2⤵
  PID:1732
- C:\Windows\System\TJYMtRJ.exe
  C:\Windows\System\TJYMtRJ.exe
  2⤵
  PID:5436
- C:\Windows\System\TzKxmgv.exe
  C:\Windows\System\TzKxmgv.exe
  2⤵
  PID:5552
- C:\Windows\System\NwvURDy.exe
  C:\Windows\System\NwvURDy.exe
  2⤵
  PID:5808
- C:\Windows\System\RaTSZvI.exe
  C:\Windows\System\RaTSZvI.exe
  2⤵
  PID:6072
- C:\Windows\System\dCvYEES.exe
  C:\Windows\System\dCvYEES.exe
  2⤵
  PID:6184
- C:\Windows\System\HfrJklD.exe
  C:\Windows\System\HfrJklD.exe
  2⤵
  PID:6264
- C:\Windows\System\atqdpVG.exe
  C:\Windows\System\atqdpVG.exe
  2⤵
  PID:6380
- C:\Windows\System\BpTbUYF.exe
  C:\Windows\System\BpTbUYF.exe
  2⤵
  PID:1908
- C:\Windows\System\hsPolUD.exe
  C:\Windows\System\hsPolUD.exe
  2⤵
  PID:3376
- C:\Windows\System\HIOyHzu.exe
  C:\Windows\System\HIOyHzu.exe
  2⤵
  PID:3168
- C:\Windows\System\hjYOPoH.exe
  C:\Windows\System\hjYOPoH.exe
  2⤵
  PID:1436
- C:\Windows\System\PJTSuXv.exe
  C:\Windows\System\PJTSuXv.exe
  2⤵
  PID:2068
- C:\Windows\System\BVbrrpn.exe
  C:\Windows\System\BVbrrpn.exe
  2⤵
  PID:6292
- C:\Windows\System\isfhNhk.exe
  C:\Windows\System\isfhNhk.exe
  2⤵
  PID:1840
- C:\Windows\System\jExsGJc.exe
  C:\Windows\System\jExsGJc.exe
  2⤵
  PID:2020
- C:\Windows\System\RlDcdYR.exe
  C:\Windows\System\RlDcdYR.exe
  2⤵
  PID:212
- C:\Windows\System\lJQeajD.exe
  C:\Windows\System\lJQeajD.exe
  2⤵
  PID:2888
- C:\Windows\System\HBBYGDO.exe
  C:\Windows\System\HBBYGDO.exe
  2⤵
  PID:4884
- C:\Windows\System\VJILqll.exe
  C:\Windows\System\VJILqll.exe
  2⤵
  PID:1760
- C:\Windows\System\eGjBoSB.exe
  C:\Windows\System\eGjBoSB.exe
  2⤵
  PID:6480
- C:\Windows\System\luXJvCR.exe
  C:\Windows\System\luXJvCR.exe
  2⤵
  PID:1064
- C:\Windows\System\NfYjNbx.exe
  C:\Windows\System\NfYjNbx.exe
  2⤵
  PID:6524
- C:\Windows\System\PnGDzeY.exe
  C:\Windows\System\PnGDzeY.exe
  2⤵
  PID:6600
- C:\Windows\System\kxDlzUk.exe
  C:\Windows\System\kxDlzUk.exe
  2⤵
  PID:4100
- C:\Windows\System\xGZVtGZ.exe
  C:\Windows\System\xGZVtGZ.exe
  2⤵
  PID:6744
- C:\Windows\System\HrkIFyu.exe
  C:\Windows\System\HrkIFyu.exe
  2⤵
  PID:6780
- C:\Windows\System\ZULJYOU.exe
  C:\Windows\System\ZULJYOU.exe
  2⤵
  PID:6856
- C:\Windows\System\oieRLwW.exe
  C:\Windows\System\oieRLwW.exe
  2⤵
  PID:6892
- C:\Windows\System\bLTnGbi.exe
  C:\Windows\System\bLTnGbi.exe
  2⤵
  PID:6956
- C:\Windows\System\uCJBzql.exe
  C:\Windows\System\uCJBzql.exe
  2⤵
  PID:7072
- C:\Windows\System\uoPatHg.exe
  C:\Windows\System\uoPatHg.exe
  2⤵
  PID:7120
- C:\Windows\System\dLrDRXq.exe
  C:\Windows\System\dLrDRXq.exe
  2⤵
  PID:764
- C:\Windows\System\JZnbExP.exe
  C:\Windows\System\JZnbExP.exe
  2⤵
  PID:4324
- C:\Windows\System\jbOUUns.exe
  C:\Windows\System\jbOUUns.exe
  2⤵
  PID:5804
- C:\Windows\System\bKHyaaH.exe
  C:\Windows\System\bKHyaaH.exe
  2⤵
  PID:6068
- C:\Windows\System\SundKWu.exe
  C:\Windows\System\SundKWu.exe
  2⤵
  PID:6240
- C:\Windows\System\KhOEwxA.exe
  C:\Windows\System\KhOEwxA.exe
  2⤵
  PID:1220
- C:\Windows\System\iGxTjnZ.exe
  C:\Windows\System\iGxTjnZ.exe
  2⤵
  PID:2364
- C:\Windows\System\uOepyNx.exe
  C:\Windows\System\uOepyNx.exe
  2⤵
  PID:936
- C:\Windows\System\WQElRqi.exe
  C:\Windows\System\WQElRqi.exe
  2⤵
  PID:4492
- C:\Windows\System\fdKasIl.exe
  C:\Windows\System\fdKasIl.exe
  2⤵
  PID:6500
- C:\Windows\System\tZDFBNn.exe
  C:\Windows\System\tZDFBNn.exe
  2⤵
  PID:3392
- C:\Windows\System\yZcJPoZ.exe
  C:\Windows\System\yZcJPoZ.exe
  2⤵
  PID:6632
- C:\Windows\System\aNfTzCz.exe
  C:\Windows\System\aNfTzCz.exe
  2⤵
  PID:6712
- C:\Windows\System\vqgHTer.exe
  C:\Windows\System\vqgHTer.exe
  2⤵
  PID:6760
- C:\Windows\System\tAIiiNq.exe
  C:\Windows\System\tAIiiNq.exe
  2⤵
  PID:7012
- C:\Windows\System\wJogusp.exe
  C:\Windows\System\wJogusp.exe
  2⤵
  PID:2328
- C:\Windows\System\lQqrRnx.exe
  C:\Windows\System\lQqrRnx.exe
  2⤵
  PID:6156
- C:\Windows\System\LeYPtLr.exe
  C:\Windows\System\LeYPtLr.exe
  2⤵
  PID:2424
- C:\Windows\System\pCZaMEF.exe
  C:\Windows\System\pCZaMEF.exe
  2⤵
  PID:436
- C:\Windows\System\Mjytzen.exe
  C:\Windows\System\Mjytzen.exe
  2⤵
  PID:4620
- C:\Windows\System\BjJTHsK.exe
  C:\Windows\System\BjJTHsK.exe
  2⤵
  PID:3096
- C:\Windows\System\KDagMuE.exe
  C:\Windows\System\KDagMuE.exe
  2⤵
  PID:6452
- C:\Windows\System\gLDTfQN.exe
  C:\Windows\System\gLDTfQN.exe
  2⤵
  PID:6944
- C:\Windows\System\zVhGQVk.exe
  C:\Windows\System\zVhGQVk.exe
  2⤵
  PID:7116
- C:\Windows\System\WFVgogQ.exe
  C:\Windows\System\WFVgogQ.exe
  2⤵
  PID:4756
- C:\Windows\System\OyjRKWb.exe
  C:\Windows\System\OyjRKWb.exe
  2⤵
  PID:3648
- C:\Windows\System\ZTkBuFG.exe
  C:\Windows\System\ZTkBuFG.exe
  2⤵
  PID:6940
- C:\Windows\System\QGVHMUa.exe
  C:\Windows\System\QGVHMUa.exe
  2⤵
  PID:448
- C:\Windows\System\HhUpmUt.exe
  C:\Windows\System\HhUpmUt.exe
  2⤵
  PID:4660
- C:\Windows\System\Orwcueu.exe
  C:\Windows\System\Orwcueu.exe
  2⤵
  PID:7196
- C:\Windows\System\MxaxDTo.exe
  C:\Windows\System\MxaxDTo.exe
  2⤵
  PID:7224
- C:\Windows\System\iucbEee.exe
  C:\Windows\System\iucbEee.exe
  2⤵
  PID:7252
- C:\Windows\System\QimvzUL.exe
  C:\Windows\System\QimvzUL.exe
  2⤵
  PID:7280
- C:\Windows\System\XjMRmgR.exe
  C:\Windows\System\XjMRmgR.exe
  2⤵
  PID:7296
- C:\Windows\System\BHOLCdf.exe
  C:\Windows\System\BHOLCdf.exe
  2⤵
  PID:7320
- C:\Windows\System\sGVLgnV.exe
  C:\Windows\System\sGVLgnV.exe
  2⤵
  PID:7336
- C:\Windows\System\dZwAwMP.exe
  C:\Windows\System\dZwAwMP.exe
  2⤵
  PID:7392
- C:\Windows\System\rWDCDXP.exe
  C:\Windows\System\rWDCDXP.exe
  2⤵
  PID:7420
- C:\Windows\System\AyzfudX.exe
  C:\Windows\System\AyzfudX.exe
  2⤵
  PID:7436
- C:\Windows\System\gKqCRJo.exe
  C:\Windows\System\gKqCRJo.exe
  2⤵
  PID:7468
- C:\Windows\System\QQYKTFh.exe
  C:\Windows\System\QQYKTFh.exe
  2⤵
  PID:7488
- C:\Windows\System\ttLoVqf.exe
  C:\Windows\System\ttLoVqf.exe
  2⤵
  PID:7516
- C:\Windows\System\VKHLfUF.exe
  C:\Windows\System\VKHLfUF.exe
  2⤵
  PID:7536
- C:\Windows\System\gTSkCzM.exe
  C:\Windows\System\gTSkCzM.exe
  2⤵
  PID:7568
- C:\Windows\System\hFjKCEG.exe
  C:\Windows\System\hFjKCEG.exe
  2⤵
  PID:7596
- C:\Windows\System\uLEAFNW.exe
  C:\Windows\System\uLEAFNW.exe
  2⤵
  PID:7620
- C:\Windows\System\BFAEkua.exe
  C:\Windows\System\BFAEkua.exe
  2⤵
  PID:7636
- C:\Windows\System\xTZKhIX.exe
  C:\Windows\System\xTZKhIX.exe
  2⤵
  PID:7676
- C:\Windows\System\LUOZGbs.exe
  C:\Windows\System\LUOZGbs.exe
  2⤵
  PID:7692
- C:\Windows\System\MUGftpD.exe
  C:\Windows\System\MUGftpD.exe
  2⤵
  PID:7708
- C:\Windows\System\GLAlJTo.exe
  C:\Windows\System\GLAlJTo.exe
  2⤵
  PID:7724
- C:\Windows\System\AywVzMC.exe
  C:\Windows\System\AywVzMC.exe
  2⤵
  PID:7756
- C:\Windows\System\AwNvIrT.exe
  C:\Windows\System\AwNvIrT.exe
  2⤵
  PID:7872
- C:\Windows\System\ffhBVjX.exe
  C:\Windows\System\ffhBVjX.exe
  2⤵
  PID:7900
- C:\Windows\System\LKYOLYL.exe
  C:\Windows\System\LKYOLYL.exe
  2⤵
  PID:7916
- C:\Windows\System\kFUlFPy.exe
  C:\Windows\System\kFUlFPy.exe
  2⤵
  PID:7944
- C:\Windows\System\aiBOWXr.exe
  C:\Windows\System\aiBOWXr.exe
  2⤵
  PID:7972
- C:\Windows\System\wtVTuGk.exe
  C:\Windows\System\wtVTuGk.exe
  2⤵
  PID:8000
- C:\Windows\System\xOgTvUi.exe
  C:\Windows\System\xOgTvUi.exe
  2⤵
  PID:8016
- C:\Windows\System\lgYIeTX.exe
  C:\Windows\System\lgYIeTX.exe
  2⤵
  PID:8060
- C:\Windows\System\iONzlnp.exe
  C:\Windows\System\iONzlnp.exe
  2⤵
  PID:8084
- C:\Windows\System\DmBYFUg.exe
  C:\Windows\System\DmBYFUg.exe
  2⤵
  PID:8112
- C:\Windows\System\dyAhlWg.exe
  C:\Windows\System\dyAhlWg.exe
  2⤵
  PID:8152
- C:\Windows\System\QIqPfwd.exe
  C:\Windows\System\QIqPfwd.exe
  2⤵
  PID:8176
- C:\Windows\System\vgvkTYJ.exe
  C:\Windows\System\vgvkTYJ.exe
  2⤵
  PID:7056
- C:\Windows\System\eUsgbPM.exe
  C:\Windows\System\eUsgbPM.exe
  2⤵
  PID:7220
- C:\Windows\System\YxKuxyJ.exe
  C:\Windows\System\YxKuxyJ.exe
  2⤵
  PID:7272
- C:\Windows\System\slAXbrL.exe
  C:\Windows\System\slAXbrL.exe
  2⤵
  PID:7384
- C:\Windows\System\lmoCSiu.exe
  C:\Windows\System\lmoCSiu.exe
  2⤵
  PID:1640
- C:\Windows\System\CxoLqts.exe
  C:\Windows\System\CxoLqts.exe
  2⤵
  PID:7508
- C:\Windows\System\kXWVqyX.exe
  C:\Windows\System\kXWVqyX.exe
  2⤵
  PID:7512
- C:\Windows\System\JHPDAFi.exe
  C:\Windows\System\JHPDAFi.exe
  2⤵
  PID:7580
- C:\Windows\System\cAczIBK.exe
  C:\Windows\System\cAczIBK.exe
  2⤵
  PID:7664
- C:\Windows\System\WvVZwzJ.exe
  C:\Windows\System\WvVZwzJ.exe
  2⤵
  PID:7832
- C:\Windows\System\lmKAAKl.exe
  C:\Windows\System\lmKAAKl.exe
  2⤵
  PID:7744
- C:\Windows\System\GvyQTnA.exe
  C:\Windows\System\GvyQTnA.exe
  2⤵
  PID:7800
- C:\Windows\System\mcdRazR.exe
  C:\Windows\System\mcdRazR.exe
  2⤵
  PID:7884
- C:\Windows\System\UKtcJZO.exe
  C:\Windows\System\UKtcJZO.exe
  2⤵
  PID:7956
- C:\Windows\System\CBsTZTI.exe
  C:\Windows\System\CBsTZTI.exe
  2⤵
  PID:8008
- C:\Windows\System\VhIdhZW.exe
  C:\Windows\System\VhIdhZW.exe
  2⤵
  PID:8100
- C:\Windows\System\YZmRHla.exe
  C:\Windows\System\YZmRHla.exe
  2⤵
  PID:5248
- C:\Windows\System\sYLkiEl.exe
  C:\Windows\System\sYLkiEl.exe
  2⤵
  PID:7276
- C:\Windows\System\vRoDsCT.exe
  C:\Windows\System\vRoDsCT.exe
  2⤵
  PID:7408
- C:\Windows\System\OdNzzTo.exe
  C:\Windows\System\OdNzzTo.exe
  2⤵
  PID:7528
- C:\Windows\System\fKYhbIp.exe
  C:\Windows\System\fKYhbIp.exe
  2⤵
  PID:7648
- C:\Windows\System\aPmOkAd.exe
  C:\Windows\System\aPmOkAd.exe
  2⤵
  PID:7812
- C:\Windows\System\XsnfuXx.exe
  C:\Windows\System\XsnfuXx.exe
  2⤵
  PID:7864
- C:\Windows\System\efVSoWx.exe
  C:\Windows\System\efVSoWx.exe
  2⤵
  PID:8056
- C:\Windows\System\aSOondm.exe
  C:\Windows\System\aSOondm.exe
  2⤵
  PID:8168
- C:\Windows\System\ThiCPyi.exe
  C:\Windows\System\ThiCPyi.exe
  2⤵
  PID:7820
- C:\Windows\System\JxdaPEh.exe
  C:\Windows\System\JxdaPEh.exe
  2⤵
  PID:7928
- C:\Windows\System\hsvQInz.exe
  C:\Windows\System\hsvQInz.exe
  2⤵
  PID:7588
- C:\Windows\System\GZMEvXE.exe
  C:\Windows\System\GZMEvXE.exe
  2⤵
  PID:8108
- C:\Windows\System\WjSFNpV.exe
  C:\Windows\System\WjSFNpV.exe
  2⤵
  PID:8204
- C:\Windows\System\xywDlcD.exe
  C:\Windows\System\xywDlcD.exe
  2⤵
  PID:8244
- C:\Windows\System\QoEvCGk.exe
  C:\Windows\System\QoEvCGk.exe
  2⤵
  PID:8272
- C:\Windows\System\WSbMTwQ.exe
  C:\Windows\System\WSbMTwQ.exe
  2⤵
  PID:8292
- C:\Windows\System\lBXoyal.exe
  C:\Windows\System\lBXoyal.exe
  2⤵
  PID:8316
- C:\Windows\System\KtWNMLJ.exe
  C:\Windows\System\KtWNMLJ.exe
  2⤵
  PID:8332
- C:\Windows\System\YJZqtmR.exe
  C:\Windows\System\YJZqtmR.exe
  2⤵
  PID:8364
- C:\Windows\System\AVdxALb.exe
  C:\Windows\System\AVdxALb.exe
  2⤵
  PID:8388
- C:\Windows\System\BVMvkcL.exe
  C:\Windows\System\BVMvkcL.exe
  2⤵
  PID:8404
- C:\Windows\System\SVJCvAv.exe
  C:\Windows\System\SVJCvAv.exe
  2⤵
  PID:8436
- C:\Windows\System\NDpiNhI.exe
  C:\Windows\System\NDpiNhI.exe
  2⤵
  PID:8496
- C:\Windows\System\NUXGodB.exe
  C:\Windows\System\NUXGodB.exe
  2⤵
  PID:8524
- C:\Windows\System\KwAFlef.exe
  C:\Windows\System\KwAFlef.exe
  2⤵
  PID:8540
- C:\Windows\System\fPJcMne.exe
  C:\Windows\System\fPJcMne.exe
  2⤵
  PID:8568
- C:\Windows\System\FPpcDSV.exe
  C:\Windows\System\FPpcDSV.exe
  2⤵
  PID:8596
- C:\Windows\System\Srghfzj.exe
  C:\Windows\System\Srghfzj.exe
  2⤵
  PID:8636
- C:\Windows\System\SwchcOb.exe
  C:\Windows\System\SwchcOb.exe
  2⤵
  PID:8664
- C:\Windows\System\NqTUeFc.exe
  C:\Windows\System\NqTUeFc.exe
  2⤵
  PID:8688
- C:\Windows\System\tUxnQMJ.exe
  C:\Windows\System\tUxnQMJ.exe
  2⤵
  PID:8708
- C:\Windows\System\ukDYylv.exe
  C:\Windows\System\ukDYylv.exe
  2⤵
  PID:8748
- C:\Windows\System\JkqlvRb.exe
  C:\Windows\System\JkqlvRb.exe
  2⤵
  PID:8772
- C:\Windows\System\ETnCKbr.exe
  C:\Windows\System\ETnCKbr.exe
  2⤵
  PID:8800
- C:\Windows\System\oQeWLDz.exe
  C:\Windows\System\oQeWLDz.exe
  2⤵
  PID:8832
- C:\Windows\System\iQIxxqr.exe
  C:\Windows\System\iQIxxqr.exe
  2⤵
  PID:8860
- C:\Windows\System\AaEgYtb.exe
  C:\Windows\System\AaEgYtb.exe
  2⤵
  PID:8952
- C:\Windows\System\GxhPQTJ.exe
  C:\Windows\System\GxhPQTJ.exe
  2⤵
  PID:9072
- C:\Windows\System\NaNnAwW.exe
  C:\Windows\System\NaNnAwW.exe
  2⤵
  PID:9088
- C:\Windows\System\FXotNNW.exe
  C:\Windows\System\FXotNNW.exe
  2⤵
  PID:9112
- C:\Windows\System\IZnHvnv.exe
  C:\Windows\System\IZnHvnv.exe
  2⤵
  PID:9168
- C:\Windows\System\PbQmfkb.exe
  C:\Windows\System\PbQmfkb.exe
  2⤵
  PID:9188
- C:\Windows\System\TlLRvSS.exe
  C:\Windows\System\TlLRvSS.exe
  2⤵
  PID:7464
- C:\Windows\System\PpPAsir.exe
  C:\Windows\System\PpPAsir.exe
  2⤵
  PID:8240
- C:\Windows\System\CCbSyRZ.exe
  C:\Windows\System\CCbSyRZ.exe
  2⤵
  PID:8312
- C:\Windows\System\RzeGuZH.exe
  C:\Windows\System\RzeGuZH.exe
  2⤵
  PID:8380
- C:\Windows\System\RDRQaiB.exe
  C:\Windows\System\RDRQaiB.exe
  2⤵
  PID:8424
- C:\Windows\System\VqGptQA.exe
  C:\Windows\System\VqGptQA.exe
  2⤵
  PID:8520
- C:\Windows\System\ccQEpom.exe
  C:\Windows\System\ccQEpom.exe
  2⤵
  PID:8560
- C:\Windows\System\toWwrXQ.exe
  C:\Windows\System\toWwrXQ.exe
  2⤵
  PID:8652
- C:\Windows\System\OUvdUzc.exe
  C:\Windows\System\OUvdUzc.exe
  2⤵
  PID:8700
- C:\Windows\System\cQavGvf.exe
  C:\Windows\System\cQavGvf.exe
  2⤵
  PID:8788
- C:\Windows\System\grTKRFn.exe
  C:\Windows\System\grTKRFn.exe
  2⤵
  PID:8856
- C:\Windows\System\mIlyxIN.exe
  C:\Windows\System\mIlyxIN.exe
  2⤵
  PID:8908
- C:\Windows\System\rOJNMGh.exe
  C:\Windows\System\rOJNMGh.exe
  2⤵
  PID:8936
- C:\Windows\System\zVyDBKC.exe
  C:\Windows\System\zVyDBKC.exe
  2⤵
  PID:8972
- C:\Windows\System\GOdxnwR.exe
  C:\Windows\System\GOdxnwR.exe
  2⤵
  PID:9000
- C:\Windows\System\lWerDpx.exe
  C:\Windows\System\lWerDpx.exe
  2⤵
  PID:9028
- C:\Windows\System\AqfwyQA.exe
  C:\Windows\System\AqfwyQA.exe
  2⤵
  PID:9048
- C:\Windows\System\oukSWWF.exe
  C:\Windows\System\oukSWWF.exe
  2⤵
  PID:9100
- C:\Windows\System\IYiINNo.exe
  C:\Windows\System\IYiINNo.exe
  2⤵
  PID:9184
- C:\Windows\System\BrqzbEi.exe
  C:\Windows\System\BrqzbEi.exe
  2⤵
  PID:9212
- C:\Windows\System\RAoXmbU.exe
  C:\Windows\System\RAoXmbU.exe
  2⤵
  PID:8288
- C:\Windows\System\wTcspKT.exe
  C:\Windows\System\wTcspKT.exe
  2⤵
  PID:8400
- C:\Windows\System\tCxXKob.exe
  C:\Windows\System\tCxXKob.exe
  2⤵
  PID:8592
- C:\Windows\System\oeLEFEw.exe
  C:\Windows\System\oeLEFEw.exe
  2⤵
  PID:8892
- C:\Windows\System\QkeaXvh.exe
  C:\Windows\System\QkeaXvh.exe
  2⤵
  PID:8924
- C:\Windows\System\srKjpJu.exe
  C:\Windows\System\srKjpJu.exe
  2⤵
  PID:8964
- C:\Windows\System\cmqXqCQ.exe
  C:\Windows\System\cmqXqCQ.exe
  2⤵
  PID:9012
- C:\Windows\System\TeGEsqd.exe
  C:\Windows\System\TeGEsqd.exe
  2⤵
  PID:9156
- C:\Windows\System\grxOuww.exe
  C:\Windows\System\grxOuww.exe
  2⤵
  PID:7824
- C:\Windows\System\jjIatHN.exe
  C:\Windows\System\jjIatHN.exe
  2⤵
  PID:8608
- C:\Windows\System\ZxDhChq.exe
  C:\Windows\System\ZxDhChq.exe
  2⤵
  PID:8780
- C:\Windows\System\cBLPggN.exe
  C:\Windows\System\cBLPggN.exe
  2⤵
  PID:2340
- C:\Windows\System\QLIhHeY.exe
  C:\Windows\System\QLIhHeY.exe
  2⤵
  PID:9104
- C:\Windows\System\xTZLlrY.exe
  C:\Windows\System\xTZLlrY.exe
  2⤵
  PID:8956
- C:\Windows\System\lBrCWtX.exe
  C:\Windows\System\lBrCWtX.exe
  2⤵
  PID:8844
- C:\Windows\System\cjRvJwO.exe
  C:\Windows\System\cjRvJwO.exe
  2⤵
  PID:9228
- C:\Windows\System\ddzotqE.exe
  C:\Windows\System\ddzotqE.exe
  2⤵
  PID:9248
- C:\Windows\System\JePTygl.exe
  C:\Windows\System\JePTygl.exe
  2⤵
  PID:9280
- C:\Windows\System\QzwkWmh.exe
  C:\Windows\System\QzwkWmh.exe
  2⤵
  PID:9316
- C:\Windows\System\aaWHKJR.exe
  C:\Windows\System\aaWHKJR.exe
  2⤵
  PID:9348
- C:\Windows\System\RtqsVnu.exe
  C:\Windows\System\RtqsVnu.exe
  2⤵
  PID:9368
- C:\Windows\System\mtvakem.exe
  C:\Windows\System\mtvakem.exe
  2⤵
  PID:9404
- C:\Windows\System\hqAkipc.exe
  C:\Windows\System\hqAkipc.exe
  2⤵
  PID:9420
- C:\Windows\System\ppZjzFC.exe
  C:\Windows\System\ppZjzFC.exe
  2⤵
  PID:9448
- C:\Windows\System\UWhdjOB.exe
  C:\Windows\System\UWhdjOB.exe
  2⤵
  PID:9468
- C:\Windows\System\KZMcxAZ.exe
  C:\Windows\System\KZMcxAZ.exe
  2⤵
  PID:9492
- C:\Windows\System\VbUhMBX.exe
  C:\Windows\System\VbUhMBX.exe
  2⤵
  PID:9512
- C:\Windows\System\nWygatZ.exe
  C:\Windows\System\nWygatZ.exe
  2⤵
  PID:9556
- C:\Windows\System\PEblgPf.exe
  C:\Windows\System\PEblgPf.exe
  2⤵
  PID:9604
- C:\Windows\System\egpEBJP.exe
  C:\Windows\System\egpEBJP.exe
  2⤵
  PID:9632
- C:\Windows\System\KMhtUwG.exe
  C:\Windows\System\KMhtUwG.exe
  2⤵
  PID:9648
- C:\Windows\System\KAQmPfC.exe
  C:\Windows\System\KAQmPfC.exe
  2⤵
  PID:9688
- C:\Windows\System\tIKUdEc.exe
  C:\Windows\System\tIKUdEc.exe
  2⤵
  PID:9708
- C:\Windows\System\TMGMVNa.exe
  C:\Windows\System\TMGMVNa.exe
  2⤵
  PID:9732
- C:\Windows\System\HNwIpkH.exe
  C:\Windows\System\HNwIpkH.exe
  2⤵
  PID:9752
- C:\Windows\System\NCGLHDZ.exe
  C:\Windows\System\NCGLHDZ.exe
  2⤵
  PID:9784
- C:\Windows\System\WrefWAM.exe
  C:\Windows\System\WrefWAM.exe
  2⤵
  PID:9812
- C:\Windows\System\PniXPBK.exe
  C:\Windows\System\PniXPBK.exe
  2⤵
  PID:9840
- C:\Windows\System\AMyrALl.exe
  C:\Windows\System\AMyrALl.exe
  2⤵
  PID:9876
- C:\Windows\System\vdNCgFH.exe
  C:\Windows\System\vdNCgFH.exe
  2⤵
  PID:9908
- C:\Windows\System\QazwsCc.exe
  C:\Windows\System\QazwsCc.exe
  2⤵
  PID:9948
- C:\Windows\System\tdSZXVZ.exe
  C:\Windows\System\tdSZXVZ.exe
  2⤵
  PID:9964
- C:\Windows\System\ANzJSkG.exe
  C:\Windows\System\ANzJSkG.exe
  2⤵
  PID:10000
- C:\Windows\System\nzfwHoX.exe
  C:\Windows\System\nzfwHoX.exe
  2⤵
  PID:10020
- C:\Windows\System\ryIwDoy.exe
  C:\Windows\System\ryIwDoy.exe
  2⤵
  PID:10052
- C:\Windows\System\rSylRKD.exe
  C:\Windows\System\rSylRKD.exe
  2⤵
  PID:10096
- C:\Windows\System\huUrbXk.exe
  C:\Windows\System\huUrbXk.exe
  2⤵
  PID:10112
- C:\Windows\System\zoFUKTK.exe
  C:\Windows\System\zoFUKTK.exe
  2⤵
  PID:10148
- C:\Windows\System\OVpEGpi.exe
  C:\Windows\System\OVpEGpi.exe
  2⤵
  PID:10172
- C:\Windows\System\dgrVWrT.exe
  C:\Windows\System\dgrVWrT.exe
  2⤵
  PID:10196
- C:\Windows\System\jlGleDZ.exe
  C:\Windows\System\jlGleDZ.exe
  2⤵
  PID:10224
- C:\Windows\System\UfSKyfh.exe
  C:\Windows\System\UfSKyfh.exe
  2⤵
  PID:9220
- C:\Windows\System\SYTFoGA.exe
  C:\Windows\System\SYTFoGA.exe
  2⤵
  PID:9292
- C:\Windows\System\egAQbQX.exe
  C:\Windows\System\egAQbQX.exe
  2⤵
  PID:9364
- C:\Windows\System\abZlWfD.exe
  C:\Windows\System\abZlWfD.exe
  2⤵
  PID:9436
- C:\Windows\System\qXyUHAj.exe
  C:\Windows\System\qXyUHAj.exe
  2⤵
  PID:9528
- C:\Windows\System\BJWCwjd.exe
  C:\Windows\System\BJWCwjd.exe
  2⤵
  PID:9596
- C:\Windows\System\reigWKm.exe
  C:\Windows\System\reigWKm.exe
  2⤵
  PID:9640
- C:\Windows\System\fNQTmAe.exe
  C:\Windows\System\fNQTmAe.exe
  2⤵
  PID:9696
- C:\Windows\System\vlKFEwL.exe
  C:\Windows\System\vlKFEwL.exe
  2⤵
  PID:9780
- C:\Windows\System\ShKLElD.exe
  C:\Windows\System\ShKLElD.exe
  2⤵
  PID:9800
- C:\Windows\System\OmPnOtE.exe
  C:\Windows\System\OmPnOtE.exe
  2⤵
  PID:9940
- C:\Windows\System\LxnAqBU.exe
  C:\Windows\System\LxnAqBU.exe
  2⤵
  PID:9828
- C:\Windows\System\EuiEjTA.exe
  C:\Windows\System\EuiEjTA.exe
  2⤵
  PID:10012
- C:\Windows\System\QZNsbGF.exe
  C:\Windows\System\QZNsbGF.exe
  2⤵
  PID:10104
- C:\Windows\System\dOFVyZg.exe
  C:\Windows\System\dOFVyZg.exe
  2⤵
  PID:10160
- C:\Windows\System\AZgQYCC.exe
  C:\Windows\System\AZgQYCC.exe
  2⤵
  PID:10236
- C:\Windows\System\BXGwMnO.exe
  C:\Windows\System\BXGwMnO.exe
  2⤵
  PID:9336
- C:\Windows\System\cPVypuy.exe
  C:\Windows\System\cPVypuy.exe
  2⤵
  PID:9484
- C:\Windows\System\hkRFkKW.exe
  C:\Windows\System\hkRFkKW.exe
  2⤵
  PID:9684
- C:\Windows\System\ObzfkMt.exe
  C:\Windows\System\ObzfkMt.exe
  2⤵
  PID:9668
- C:\Windows\System\cgHcWzN.exe
  C:\Windows\System\cgHcWzN.exe
  2⤵
  PID:9900
- C:\Windows\System\RWIZlbi.exe
  C:\Windows\System\RWIZlbi.exe
  2⤵
  PID:10136
- C:\Windows\System\KNRFetk.exe
  C:\Windows\System\KNRFetk.exe
  2⤵
  PID:8384
- C:\Windows\System\VdfKVnx.exe
  C:\Windows\System\VdfKVnx.exe
  2⤵
  PID:9616
- C:\Windows\System\iIJjkAM.exe
  C:\Windows\System\iIJjkAM.exe
  2⤵
  PID:9864
- C:\Windows\System\wuWBMzW.exe
  C:\Windows\System\wuWBMzW.exe
  2⤵
  PID:9544
- C:\Windows\System\eAaOwTb.exe
  C:\Windows\System\eAaOwTb.exe
  2⤵
  PID:9400
- C:\Windows\System\TalHENf.exe
  C:\Windows\System\TalHENf.exe
  2⤵
  PID:10212
- C:\Windows\System\McYkdvO.exe
  C:\Windows\System\McYkdvO.exe
  2⤵
  PID:10280
- C:\Windows\System\YUbwWXe.exe
  C:\Windows\System\YUbwWXe.exe
  2⤵
  PID:10300
- C:\Windows\System\GqVbFae.exe
  C:\Windows\System\GqVbFae.exe
  2⤵
  PID:10324
- C:\Windows\System\HDyuQhl.exe
  C:\Windows\System\HDyuQhl.exe
  2⤵
  PID:10364
- C:\Windows\System\NiGsBlA.exe
  C:\Windows\System\NiGsBlA.exe
  2⤵
  PID:10392
- C:\Windows\System\XRGTprm.exe
  C:\Windows\System\XRGTprm.exe
  2⤵
  PID:10424
- C:\Windows\System\vnoSKlH.exe
  C:\Windows\System\vnoSKlH.exe
  2⤵
  PID:10440
- C:\Windows\System\VyRBFeo.exe
  C:\Windows\System\VyRBFeo.exe
  2⤵
  PID:10480
- C:\Windows\System\BxAWrRr.exe
  C:\Windows\System\BxAWrRr.exe
  2⤵
  PID:10508
- C:\Windows\System\vfNYqkF.exe
  C:\Windows\System\vfNYqkF.exe
  2⤵
  PID:10524
- C:\Windows\System\pvDgqdt.exe
  C:\Windows\System\pvDgqdt.exe
  2⤵
  PID:10564
- C:\Windows\System\pCuypys.exe
  C:\Windows\System\pCuypys.exe
  2⤵
  PID:10592
- C:\Windows\System\XgckRNK.exe
  C:\Windows\System\XgckRNK.exe
  2⤵
  PID:10620
- C:\Windows\System\KtLYjao.exe
  C:\Windows\System\KtLYjao.exe
  2⤵
  PID:10636
- C:\Windows\System\NQifFFI.exe
  C:\Windows\System\NQifFFI.exe
  2⤵
  PID:10672
- C:\Windows\System\oHuItDz.exe
  C:\Windows\System\oHuItDz.exe
  2⤵
  PID:10704
- C:\Windows\System\wfPuzvg.exe
  C:\Windows\System\wfPuzvg.exe
  2⤵
  PID:10732
- C:\Windows\System\zzWBXRK.exe
  C:\Windows\System\zzWBXRK.exe
  2⤵
  PID:10760
- C:\Windows\System\lxoJHcF.exe
  C:\Windows\System\lxoJHcF.exe
  2⤵
  PID:10776
- C:\Windows\System\GTYGBdX.exe
  C:\Windows\System\GTYGBdX.exe
  2⤵
  PID:10816
- C:\Windows\System\REtjOVg.exe
  C:\Windows\System\REtjOVg.exe
  2⤵
  PID:10832
- C:\Windows\System\cTETsgi.exe
  C:\Windows\System\cTETsgi.exe
  2⤵
  PID:10872
- C:\Windows\System\bpxBGpK.exe
  C:\Windows\System\bpxBGpK.exe
  2⤵
  PID:10900
- C:\Windows\System\HhFtOJR.exe
  C:\Windows\System\HhFtOJR.exe
  2⤵
  PID:10928
- C:\Windows\System\xybOTtV.exe
  C:\Windows\System\xybOTtV.exe
  2⤵
  PID:10956
- C:\Windows\System\XMdNhhp.exe
  C:\Windows\System\XMdNhhp.exe
  2⤵
  PID:10976
- C:\Windows\System\ucJMEcI.exe
  C:\Windows\System\ucJMEcI.exe
  2⤵
  PID:11012
- C:\Windows\System\yqukFbq.exe
  C:\Windows\System\yqukFbq.exe
  2⤵
  PID:11032
- C:\Windows\System\PafihIN.exe
  C:\Windows\System\PafihIN.exe
  2⤵
  PID:11068
- C:\Windows\System\TgkADEF.exe
  C:\Windows\System\TgkADEF.exe
  2⤵
  PID:11084
- C:\Windows\System\eDtOrid.exe
  C:\Windows\System\eDtOrid.exe
  2⤵
  PID:11116
- C:\Windows\System\yYurieU.exe
  C:\Windows\System\yYurieU.exe
  2⤵
  PID:11140
- C:\Windows\System\BWTspPl.exe
  C:\Windows\System\BWTspPl.exe
  2⤵
  PID:11160
- C:\Windows\System\FtkTHct.exe
  C:\Windows\System\FtkTHct.exe
  2⤵
  PID:11200
- C:\Windows\System\iTBOugi.exe
  C:\Windows\System\iTBOugi.exe
  2⤵
  PID:11220
- C:\Windows\System\kDukaVz.exe
  C:\Windows\System\kDukaVz.exe
  2⤵
  PID:10256
- C:\Windows\System\PMOnWBI.exe
  C:\Windows\System\PMOnWBI.exe
  2⤵
  PID:10320
- C:\Windows\System\TsOznLU.exe
  C:\Windows\System\TsOznLU.exe
  2⤵
  PID:10380
- C:\Windows\System\eDRwuGJ.exe
  C:\Windows\System\eDRwuGJ.exe
  2⤵
  PID:10464
- C:\Windows\System\bngPnAe.exe
  C:\Windows\System\bngPnAe.exe
  2⤵
  PID:10504
- C:\Windows\System\rhJbrfh.exe
  C:\Windows\System\rhJbrfh.exe
  2⤵
  PID:10552
- C:\Windows\System\dGUHyxQ.exe
  C:\Windows\System\dGUHyxQ.exe
  2⤵
  PID:10628
- C:\Windows\System\MooORYW.exe
  C:\Windows\System\MooORYW.exe
  2⤵
  PID:10720
- C:\Windows\System\VBdjHLC.exe
  C:\Windows\System\VBdjHLC.exe
  2⤵
  PID:10768
- C:\Windows\System\cuWnWYD.exe
  C:\Windows\System\cuWnWYD.exe
  2⤵
  PID:10864
- C:\Windows\System\OVDeBUT.exe
  C:\Windows\System\OVDeBUT.exe
  2⤵
  PID:10896
- C:\Windows\System\HhiUMRw.exe
  C:\Windows\System\HhiUMRw.exe
  2⤵
  PID:10996
- C:\Windows\System\txsTbSP.exe
  C:\Windows\System\txsTbSP.exe
  2⤵
  PID:11028
- C:\Windows\System\hBkOTwK.exe
  C:\Windows\System\hBkOTwK.exe
  2⤵
  PID:11080
- C:\Windows\System\KZyBFtU.exe
  C:\Windows\System\KZyBFtU.exe
  2⤵
  PID:11192
- C:\Windows\System\vxzEufq.exe
  C:\Windows\System\vxzEufq.exe
  2⤵
  PID:9932
- C:\Windows\System\bpVqmCs.exe
  C:\Windows\System\bpVqmCs.exe
  2⤵
  PID:10388
- C:\Windows\System\wpNcnnX.exe
  C:\Windows\System\wpNcnnX.exe
  2⤵
  PID:10516
- C:\Windows\System\tynpjbj.exe
  C:\Windows\System\tynpjbj.exe
  2⤵
  PID:10604
- C:\Windows\System\wffKzYb.exe
  C:\Windows\System\wffKzYb.exe
  2⤵
  PID:10848
- C:\Windows\System\bvkMATk.exe
  C:\Windows\System\bvkMATk.exe
  2⤵
  PID:10940
- C:\Windows\System\CnxpujJ.exe
  C:\Windows\System\CnxpujJ.exe
  2⤵
  PID:11132
- C:\Windows\System\ODIUJOt.exe
  C:\Windows\System\ODIUJOt.exe
  2⤵
  PID:10360
- C:\Windows\System\hUAGvRc.exe
  C:\Windows\System\hUAGvRc.exe
  2⤵
  PID:10748
- C:\Windows\System\dmMMHDB.exe
  C:\Windows\System\dmMMHDB.exe
  2⤵
  PID:11208
- C:\Windows\System\zKnXwdB.exe
  C:\Windows\System\zKnXwdB.exe
  2⤵
  PID:10852
- C:\Windows\System\IGSKxKL.exe
  C:\Windows\System\IGSKxKL.exe
  2⤵
  PID:10272
- C:\Windows\System\bzPZYsw.exe
  C:\Windows\System\bzPZYsw.exe
  2⤵
  PID:11284
- C:\Windows\System\oRrscSc.exe
  C:\Windows\System\oRrscSc.exe
  2⤵
  PID:11312
- C:\Windows\System\JOMzbNl.exe
  C:\Windows\System\JOMzbNl.exe
  2⤵
  PID:11352
- C:\Windows\System\HlyDMUb.exe
  C:\Windows\System\HlyDMUb.exe
  2⤵
  PID:11368
- C:\Windows\System\rntdWrk.exe
  C:\Windows\System\rntdWrk.exe
  2⤵
  PID:11396
- C:\Windows\System\kaTKGaC.exe
  C:\Windows\System\kaTKGaC.exe
  2⤵
  PID:11436
- C:\Windows\System\vdOdiQk.exe
  C:\Windows\System\vdOdiQk.exe
  2⤵
  PID:11464
- C:\Windows\System\WyMPrae.exe
  C:\Windows\System\WyMPrae.exe
  2⤵
  PID:11484
- C:\Windows\System\TXmaqVC.exe
  C:\Windows\System\TXmaqVC.exe
  2⤵
  PID:11512
- C:\Windows\System\fNmZpFG.exe
  C:\Windows\System\fNmZpFG.exe
  2⤵
  PID:11536
- C:\Windows\System\DygTJTj.exe
  C:\Windows\System\DygTJTj.exe
  2⤵
  PID:11564
- C:\Windows\System\ZcBfeyH.exe
  C:\Windows\System\ZcBfeyH.exe
  2⤵
  PID:11588
- C:\Windows\System\lZhmNEB.exe
  C:\Windows\System\lZhmNEB.exe
  2⤵
  PID:11620
- C:\Windows\System\luqgyWN.exe
  C:\Windows\System\luqgyWN.exe
  2⤵
  PID:11660
- C:\Windows\System\mZCMmZe.exe
  C:\Windows\System\mZCMmZe.exe
  2⤵
  PID:11676
- C:\Windows\System\eMFhCVe.exe
  C:\Windows\System\eMFhCVe.exe
  2⤵
  PID:11716
- C:\Windows\System\QavFtRw.exe
  C:\Windows\System\QavFtRw.exe
  2⤵
  PID:11740
- C:\Windows\System\asfUsGH.exe
  C:\Windows\System\asfUsGH.exe
  2⤵
  PID:11760
- C:\Windows\System\HbpnfWD.exe
  C:\Windows\System\HbpnfWD.exe
  2⤵
  PID:11792
- C:\Windows\System\RYbqKmq.exe
  C:\Windows\System\RYbqKmq.exe
  2⤵
  PID:11816
- C:\Windows\System\TGPhNRR.exe
  C:\Windows\System\TGPhNRR.exe
  2⤵
  PID:11852
- C:\Windows\System\adfhcBY.exe
  C:\Windows\System\adfhcBY.exe
  2⤵
  PID:11872
- C:\Windows\System\cYMjqyy.exe
  C:\Windows\System\cYMjqyy.exe
  2⤵
  PID:11892
- C:\Windows\System\rXxkyiv.exe
  C:\Windows\System\rXxkyiv.exe
  2⤵
  PID:11940
- C:\Windows\System\udwybVV.exe
  C:\Windows\System\udwybVV.exe
  2⤵
  PID:11968
- C:\Windows\System\OQwPwdf.exe
  C:\Windows\System\OQwPwdf.exe
  2⤵
  PID:11996
- C:\Windows\System\zfLURIr.exe
  C:\Windows\System\zfLURIr.exe
  2⤵
  PID:12020
- C:\Windows\System\dBvyLkb.exe
  C:\Windows\System\dBvyLkb.exe
  2⤵
  PID:12040
- C:\Windows\System\YHnwgFT.exe
  C:\Windows\System\YHnwgFT.exe
  2⤵
  PID:12080
- C:\Windows\System\lHyJSkd.exe
  C:\Windows\System\lHyJSkd.exe
  2⤵
  PID:12100
- C:\Windows\System\avjswVB.exe
  C:\Windows\System\avjswVB.exe
  2⤵
  PID:12124
- C:\Windows\System\ouRmZnp.exe
  C:\Windows\System\ouRmZnp.exe
  2⤵
  PID:12156
- C:\Windows\System\sBIShYp.exe
  C:\Windows\System\sBIShYp.exe
  2⤵
  PID:12184
- C:\Windows\System\rhgsqxz.exe
  C:\Windows\System\rhgsqxz.exe
  2⤵
  PID:12204
- C:\Windows\System\FFPCvlR.exe
  C:\Windows\System\FFPCvlR.exe
  2⤵
  PID:12240
- C:\Windows\System\HAALVHD.exe
  C:\Windows\System\HAALVHD.exe
  2⤵
  PID:12280
- C:\Windows\System\gvmhhUu.exe
  C:\Windows\System\gvmhhUu.exe
  2⤵
  PID:10972
- C:\Windows\System\pBcMtKl.exe
  C:\Windows\System\pBcMtKl.exe
  2⤵
  PID:11348
- C:\Windows\System\xAWEzTG.exe
  C:\Windows\System\xAWEzTG.exe
  2⤵
  PID:11380
- C:\Windows\System\kdHndTJ.exe
  C:\Windows\System\kdHndTJ.exe
  2⤵
  PID:11460
- C:\Windows\System\GRToqIx.exe
  C:\Windows\System\GRToqIx.exe
  2⤵
  PID:11492
- C:\Windows\System\QdzJuzf.exe
  C:\Windows\System\QdzJuzf.exe
  2⤵
  PID:11548
- C:\Windows\System\RNTkXdX.exe
  C:\Windows\System\RNTkXdX.exe
  2⤵
  PID:11556
- C:\Windows\System\tRGAQvN.exe
  C:\Windows\System\tRGAQvN.exe
  2⤵
  PID:11732
- C:\Windows\System\vKduAdG.exe
  C:\Windows\System\vKduAdG.exe
  2⤵
  PID:11808
- C:\Windows\System\xucAXUL.exe
  C:\Windows\System\xucAXUL.exe
  2⤵
  PID:11840
- C:\Windows\System\BWqwZwy.exe
  C:\Windows\System\BWqwZwy.exe
  2⤵
  PID:11936
- C:\Windows\System\SRaIJRK.exe
  C:\Windows\System\SRaIJRK.exe
  2⤵
  PID:11980
- C:\Windows\System\fetEPVn.exe
  C:\Windows\System\fetEPVn.exe
  2⤵
  PID:12032
- C:\Windows\System\DIZGHvP.exe
  C:\Windows\System\DIZGHvP.exe
  2⤵
  PID:12072
- C:\Windows\System\zgNyCNx.exe
  C:\Windows\System\zgNyCNx.exe
  2⤵
  PID:12192
- C:\Windows\System\HAaBVBh.exe
  C:\Windows\System\HAaBVBh.exe
  2⤵
  PID:12252
- C:\Windows\System\asrcQkD.exe
  C:\Windows\System\asrcQkD.exe
  2⤵
  PID:11340
- C:\Windows\System\ohhWPya.exe
  C:\Windows\System\ohhWPya.exe
  2⤵
  PID:11448
- C:\Windows\System\rDgwvjy.exe
  C:\Windows\System\rDgwvjy.exe
  2⤵
  PID:11656
- C:\Windows\System\XfeNMOF.exe
  C:\Windows\System\XfeNMOF.exe
  2⤵
  PID:11728
- C:\Windows\System\TQuHwHf.exe
  C:\Windows\System\TQuHwHf.exe
  2⤵
  PID:11864
- C:\Windows\System\HtpfZbq.exe
  C:\Windows\System\HtpfZbq.exe
  2⤵
  PID:12116
- C:\Windows\System\lyWPuVa.exe
  C:\Windows\System\lyWPuVa.exe
  2⤵
  PID:12232
- C:\Windows\System\JsUTJdn.exe
  C:\Windows\System\JsUTJdn.exe
  2⤵
  PID:11424
- C:\Windows\System\uEZtukr.exe
  C:\Windows\System\uEZtukr.exe
  2⤵
  PID:11752
- C:\Windows\System\LcQkpuo.exe
  C:\Windows\System\LcQkpuo.exe
  2⤵
  PID:11272
- C:\Windows\System\PXtKhSk.exe
  C:\Windows\System\PXtKhSk.exe
  2⤵
  PID:11692
- C:\Windows\System\ijNFSJl.exe
  C:\Windows\System\ijNFSJl.exe
  2⤵
  PID:11416
- C:\Windows\System\rlcPCFf.exe
  C:\Windows\System\rlcPCFf.exe
  2⤵
  PID:12320
- C:\Windows\System\MzOwUfM.exe
  C:\Windows\System\MzOwUfM.exe
  2⤵
  PID:12348
- C:\Windows\System\IpfQlxY.exe
  C:\Windows\System\IpfQlxY.exe
  2⤵
  PID:12376
- C:\Windows\System\pZGqruF.exe
  C:\Windows\System\pZGqruF.exe
  2⤵
  PID:12404
- C:\Windows\System\JdHtvax.exe
  C:\Windows\System\JdHtvax.exe
  2⤵
  PID:12420
- C:\Windows\System\GzKLriy.exe
  C:\Windows\System\GzKLriy.exe
  2⤵
  PID:12448
- C:\Windows\System\ZemCcle.exe
  C:\Windows\System\ZemCcle.exe
  2⤵
  PID:12488
- C:\Windows\System\ObMaxbz.exe
  C:\Windows\System\ObMaxbz.exe
  2⤵
  PID:12516
- C:\Windows\System\vOUiWuX.exe
  C:\Windows\System\vOUiWuX.exe
  2⤵
  PID:12544
- C:\Windows\System\lGfFqUZ.exe
  C:\Windows\System\lGfFqUZ.exe
  2⤵
  PID:12572
- C:\Windows\System\FAWleZT.exe
  C:\Windows\System\FAWleZT.exe
  2⤵
  PID:12600
- C:\Windows\System\jOtxohb.exe
  C:\Windows\System\jOtxohb.exe
  2⤵
  PID:12628
- C:\Windows\System\abwdPfm.exe
  C:\Windows\System\abwdPfm.exe
  2⤵
  PID:12644
- C:\Windows\System\PHgESVx.exe
  C:\Windows\System\PHgESVx.exe
  2⤵
  PID:12672
- C:\Windows\System\koADXhb.exe
  C:\Windows\System\koADXhb.exe
  2⤵
  PID:12688
- C:\Windows\System\HudDses.exe
  C:\Windows\System\HudDses.exe
  2⤵
  PID:12708
- C:\Windows\System\NLgTLNN.exe
  C:\Windows\System\NLgTLNN.exe
  2⤵
  PID:12736
- C:\Windows\System\bUwbXpE.exe
  C:\Windows\System\bUwbXpE.exe
  2⤵
  PID:12760
- C:\Windows\System\oPomqYF.exe
  C:\Windows\System\oPomqYF.exe
  2⤵
  PID:12780
- C:\Windows\System\GkUWeds.exe
  C:\Windows\System\GkUWeds.exe
  2⤵
  PID:12840
- C:\Windows\System\LwwqttV.exe
  C:\Windows\System\LwwqttV.exe
  2⤵
  PID:12868
- C:\Windows\System\MjUVbQo.exe
  C:\Windows\System\MjUVbQo.exe
  2⤵
  PID:12896
- C:\Windows\System\yqjPzxO.exe
  C:\Windows\System\yqjPzxO.exe
  2⤵
  PID:12936
- C:\Windows\System\oTPfOPV.exe
  C:\Windows\System\oTPfOPV.exe
  2⤵
  PID:12960
- C:\Windows\System\gITWkmJ.exe
  C:\Windows\System\gITWkmJ.exe
  2⤵
  PID:12984
- C:\Windows\System\TqzZPtQ.exe
  C:\Windows\System\TqzZPtQ.exe
  2⤵
  PID:13008
- C:\Windows\System\XBNneOl.exe
  C:\Windows\System\XBNneOl.exe
  2⤵
  PID:13036
- C:\Windows\System\uYlyfAo.exe
  C:\Windows\System\uYlyfAo.exe
  2⤵
  PID:13068
- C:\Windows\System\HfHJvNv.exe
  C:\Windows\System\HfHJvNv.exe
  2⤵
  PID:13096
- C:\Windows\System\qVhkfVp.exe
  C:\Windows\System\qVhkfVp.exe
  2⤵
  PID:13124
- C:\Windows\System\krfhwrz.exe
  C:\Windows\System\krfhwrz.exe
  2⤵
  PID:13156
- C:\Windows\System\LpRGvsV.exe
  C:\Windows\System\LpRGvsV.exe
  2⤵
  PID:13176
- C:\Windows\System\CvLydVP.exe
  C:\Windows\System\CvLydVP.exe
  2⤵
  PID:13200
- C:\Windows\System\WsHHnxM.exe
  C:\Windows\System\WsHHnxM.exe
  2⤵
  PID:13244
- C:\Windows\System\mwRplbo.exe
  C:\Windows\System\mwRplbo.exe
  2⤵
  PID:13272
- C:\Windows\System\VOwWAYO.exe
  C:\Windows\System\VOwWAYO.exe
  2⤵
  PID:13300
- C:\Windows\System\bDVNPXS.exe
  C:\Windows\System\bDVNPXS.exe
  2⤵
  PID:12312
- C:\Windows\System\YEQiTZA.exe
  C:\Windows\System\YEQiTZA.exe
  2⤵
  PID:12400
- C:\Windows\System\OaykNhB.exe
  C:\Windows\System\OaykNhB.exe
  2⤵
  PID:12440
- C:\Windows\System\bXCEGCF.exe
  C:\Windows\System\bXCEGCF.exe
  2⤵
  PID:12476
- C:\Windows\System\dSZUKTY.exe
  C:\Windows\System\dSZUKTY.exe
  2⤵
  PID:12588
- C:\Windows\System\PZivGCq.exe
  C:\Windows\System\PZivGCq.exe
  2⤵
  PID:12660
- C:\Windows\System\UVKbimm.exe
  C:\Windows\System\UVKbimm.exe
  2⤵
  PID:12684
- C:\Windows\System\fDgosaF.exe
  C:\Windows\System\fDgosaF.exe
  2⤵
  PID:12792
- C:\Windows\System\mZnYaZn.exe
  C:\Windows\System\mZnYaZn.exe
  2⤵
  PID:12836
- C:\Windows\System\xHFHnMc.exe
  C:\Windows\System\xHFHnMc.exe
  2⤵
  PID:12884
- C:\Windows\System\xUeJZpG.exe
  C:\Windows\System\xUeJZpG.exe
  2⤵
  PID:12972
- C:\Windows\System\UnHrtpm.exe
  C:\Windows\System\UnHrtpm.exe
  2⤵
  PID:12216
- C:\Windows\System\KissUWI.exe
  C:\Windows\System\KissUWI.exe
  2⤵
  PID:13060
- C:\Windows\System\rBGVLxi.exe
  C:\Windows\System\rBGVLxi.exe
  2⤵
  PID:13148
- C:\Windows\System\SJfcpgf.exe
  C:\Windows\System\SJfcpgf.exe
  2⤵
  PID:13196
- C:\Windows\System\AJjZaZk.exe
  C:\Windows\System\AJjZaZk.exe
  2⤵
  PID:13240
- C:\Windows\System\qJuOPnl.exe
  C:\Windows\System\qJuOPnl.exe
  2⤵
  PID:12368
- C:\Windows\System\GmLjQEd.exe
  C:\Windows\System\GmLjQEd.exe
  2⤵
  PID:12468
- C:\Windows\System\lDIDpsj.exe
  C:\Windows\System\lDIDpsj.exe
  2⤵
  PID:12732
- C:\Windows\System\Ksoiwtr.exe
  C:\Windows\System\Ksoiwtr.exe
  2⤵
  PID:12856
- C:\Windows\System\VENTSWd.exe
  C:\Windows\System\VENTSWd.exe
  2⤵
  PID:12992
- C:\Windows\System\eaaLbzl.exe
  C:\Windows\System\eaaLbzl.exe
  2⤵
  PID:13120
- C:\Windows\System\ijVsNqC.exe
  C:\Windows\System\ijVsNqC.exe
  2⤵
  PID:13260
- C:\Windows\System\YKEdcOe.exe
  C:\Windows\System\YKEdcOe.exe
  2⤵
  PID:12416
- C:\Windows\System\XQoNJdq.exe
  C:\Windows\System\XQoNJdq.exe
  2⤵
  PID:12776
- C:\Windows\System\eKtxlMg.exe
  C:\Windows\System\eKtxlMg.exe
  2⤵
  PID:13056
- C:\Windows\System\vajFIoN.exe
  C:\Windows\System\vajFIoN.exe
  2⤵
  PID:12932
- C:\Windows\System\ZMONFCf.exe
  C:\Windows\System\ZMONFCf.exe
  2⤵
  PID:13320
- C:\Windows\System\WahgQPB.exe
  C:\Windows\System\WahgQPB.exe
  2⤵
  PID:13344
- C:\Windows\System\fcgbVxG.exe
  C:\Windows\System\fcgbVxG.exe
  2⤵
  PID:13364
- C:\Windows\System\zlBqajo.exe
  C:\Windows\System\zlBqajo.exe
  2⤵
  PID:13388
- C:\Windows\System\DUGhfMa.exe
  C:\Windows\System\DUGhfMa.exe
  2⤵
  PID:13432
- C:\Windows\System\lojyzQv.exe
  C:\Windows\System\lojyzQv.exe
  2⤵
  PID:13448
- C:\Windows\System\hQIqjNL.exe
  C:\Windows\System\hQIqjNL.exe
  2⤵
  PID:13480
- C:\Windows\System\FdrmXKD.exe
  C:\Windows\System\FdrmXKD.exe
  2⤵
  PID:13504
- C:\Windows\System\YZqxyDH.exe
  C:\Windows\System\YZqxyDH.exe
  2⤵
  PID:13544
- C:\Windows\System\NoCZXXX.exe
  C:\Windows\System\NoCZXXX.exe
  2⤵
  PID:13572
- C:\Windows\System\qacYNHM.exe
  C:\Windows\System\qacYNHM.exe
  2⤵
  PID:13588
- C:\Windows\System\ZuvgbED.exe
  C:\Windows\System\ZuvgbED.exe
  2⤵
  PID:13616
- C:\Windows\System\HMtkGkl.exe
  C:\Windows\System\HMtkGkl.exe
  2⤵
  PID:13644
- C:\Windows\System\wfOBRgm.exe
  C:\Windows\System\wfOBRgm.exe
  2⤵
  PID:13660
- C:\Windows\System\qsMeNWC.exe
  C:\Windows\System\qsMeNWC.exe
  2⤵
  PID:13696
- C:\Windows\System\OmWeazn.exe
  C:\Windows\System\OmWeazn.exe
  2⤵
  PID:13740
- C:\Windows\System\hazTVtu.exe
  C:\Windows\System\hazTVtu.exe
  2⤵
  PID:13768
- C:\Windows\System\yeFJqDd.exe
  C:\Windows\System\yeFJqDd.exe
  2⤵
  PID:13792
- C:\Windows\System\PiOVQWY.exe
  C:\Windows\System\PiOVQWY.exe
  2⤵
  PID:13824
- C:\Windows\System\CPWjTsE.exe
  C:\Windows\System\CPWjTsE.exe
  2⤵
  PID:13852
- C:\Windows\System\yKVObHt.exe
  C:\Windows\System\yKVObHt.exe
  2⤵
  PID:13880
- C:\Windows\System\gzoAlvA.exe
  C:\Windows\System\gzoAlvA.exe
  2⤵
  PID:13904
- C:\Windows\System\GeWkpZR.exe
  C:\Windows\System\GeWkpZR.exe
  2⤵
  PID:13924
- C:\Windows\System\bEXqtUw.exe
  C:\Windows\System\bEXqtUw.exe
  2⤵
  PID:13964
- C:\Windows\System\Wgsrivi.exe
  C:\Windows\System\Wgsrivi.exe
  2⤵
  PID:13992
- C:\Windows\System\JdOWrLI.exe
  C:\Windows\System\JdOWrLI.exe
  2⤵
  PID:14008
- C:\Windows\System\EPuikBW.exe
  C:\Windows\System\EPuikBW.exe
  2⤵
  PID:14028
- C:\Windows\System\gXNUeOg.exe
  C:\Windows\System\gXNUeOg.exe
  2⤵
  PID:14056
- C:\Windows\System\SqXGQZu.exe
  C:\Windows\System\SqXGQZu.exe
  2⤵
  PID:14084
- C:\Windows\System\zjKcRQW.exe
  C:\Windows\System\zjKcRQW.exe
  2⤵
  PID:14120
- C:\Windows\System\rnBUjnt.exe
  C:\Windows\System\rnBUjnt.exe
  2⤵
  PID:14148
- C:\Windows\System\ZJnmJCn.exe
  C:\Windows\System\ZJnmJCn.exe
  2⤵
  PID:14176
- C:\Windows\System\WAnfgYZ.exe
  C:\Windows\System\WAnfgYZ.exe
  2⤵
  PID:14208
- C:\Windows\System\SbjZagQ.exe
  C:\Windows\System\SbjZagQ.exe
  2⤵
  PID:14232
- C:\Windows\System\JqFLdZH.exe
  C:\Windows\System\JqFLdZH.exe
  2⤵
  PID:14264
- C:\Windows\System\wsVeFmM.exe
  C:\Windows\System\wsVeFmM.exe
  2⤵
  PID:14296
- C:\Windows\System\WqwhRYw.exe
  C:\Windows\System\WqwhRYw.exe
  2⤵
  PID:14316
- C:\Windows\System\LczTtIZ.exe
  C:\Windows\System\LczTtIZ.exe
  2⤵
  PID:13336
- C:\Windows\System\zDumFTv.exe
  C:\Windows\System\zDumFTv.exe
  2⤵
  PID:13416
- C:\Windows\System\ajjscRr.exe
  C:\Windows\System\ajjscRr.exe
  2⤵
  PID:13472
- C:\Windows\System\fGkXbDS.exe
  C:\Windows\System\fGkXbDS.exe
  2⤵
  PID:13488
- C:\Windows\System\TxnPwXY.exe
  C:\Windows\System\TxnPwXY.exe
  2⤵
  PID:13524
- C:\Windows\System\BIxcDar.exe
  C:\Windows\System\BIxcDar.exe
  2⤵
  PID:13608
- C:\Windows\System\EhMMcJg.exe
  C:\Windows\System\EhMMcJg.exe
  2⤵
  PID:13708
- C:\Windows\System\JIjsxqm.exe
  C:\Windows\System\JIjsxqm.exe
  2⤵
  PID:13784
- C:\Windows\System\TlEkjnD.exe
  C:\Windows\System\TlEkjnD.exe
  2⤵
  PID:13832
- C:\Windows\System\HQVwFeV.exe
  C:\Windows\System\HQVwFeV.exe
  2⤵
  PID:13912
- C:\Windows\System\TZyWrTB.exe
  C:\Windows\System\TZyWrTB.exe
  2⤵
  PID:13988
- C:\Windows\System\jwifzcy.exe
  C:\Windows\System\jwifzcy.exe
  2⤵
  PID:14000
- C:\Windows\System\FtgDljW.exe
  C:\Windows\System\FtgDljW.exe
  2⤵
  PID:14092
- C:\Windows\System\voDoMQa.exe
  C:\Windows\System\voDoMQa.exe
  2⤵
  PID:14156
- C:\Windows\System\eqYHuVm.exe
  C:\Windows\System\eqYHuVm.exe
  2⤵
  PID:14272
- C:\Windows\System\npworWJ.exe
  C:\Windows\System\npworWJ.exe
  2⤵
  PID:14328
- C:\Windows\System\kCTFIJT.exe
  C:\Windows\System\kCTFIJT.exe
  2⤵
  PID:13424
- C:\Windows\System\RwaWHUI.exe
  C:\Windows\System\RwaWHUI.exe
  2⤵
  PID:13520
- C:\Windows\System\epbmQZi.exe
  C:\Windows\System\epbmQZi.exe
  2⤵
  PID:13756
- C:\Windows\System\jJApXhI.exe
  C:\Windows\System\jJApXhI.exe
  2⤵
  PID:13808
- C:\Windows\System\ejpXyCk.exe
  C:\Windows\System\ejpXyCk.exe
  2⤵
  PID:13900
- C:\Windows\System\gafuisL.exe
  C:\Windows\System\gafuisL.exe
  2⤵
  PID:14076
- C:\Windows\System\bfXZnCi.exe
  C:\Windows\System\bfXZnCi.exe
  2⤵
  PID:14304
- C:\Windows\System\lkMrraM.exe
  C:\Windows\System\lkMrraM.exe
  2⤵
  PID:13464
- C:\Windows\System\GhhffhC.exe
  C:\Windows\System\GhhffhC.exe
  2⤵
  PID:13892
- C:\Windows\System\FZtokUM.exe
  C:\Windows\System\FZtokUM.exe
  2⤵
  PID:14140
- C:\Windows\System\FgFUXbw.exe
  C:\Windows\System\FgFUXbw.exe
  2⤵
  PID:14024
- C:\Windows\System\GCkEPJF.exe
  C:\Windows\System\GCkEPJF.exe
  2⤵
  PID:14340
- C:\Windows\System\IdvGYGA.exe
  C:\Windows\System\IdvGYGA.exe
  2⤵
  PID:14380
- C:\Windows\System\pzurIcK.exe
  C:\Windows\System\pzurIcK.exe
  2⤵
  PID:14408
- C:\Windows\System\ftwOiMI.exe
  C:\Windows\System\ftwOiMI.exe
  2⤵
  PID:14436
- C:\Windows\System\zqmEggp.exe
  C:\Windows\System\zqmEggp.exe
  2⤵
  PID:14456
- C:\Windows\System\SLtpSIV.exe
  C:\Windows\System\SLtpSIV.exe
  2⤵
  PID:14488
- C:\Windows\System\eqnGWyn.exe
  C:\Windows\System\eqnGWyn.exe
  2⤵
  PID:14516
- C:\Windows\System\pkvqjTO.exe
  C:\Windows\System\pkvqjTO.exe
  2⤵
  PID:14560
- C:\Windows\System\aMvzaig.exe
  C:\Windows\System\aMvzaig.exe
  2⤵
  PID:14576
- C:\Windows\System\rxEMOJg.exe
  C:\Windows\System\rxEMOJg.exe
  2⤵
  PID:14592
- C:\Windows\System\GcVPwPs.exe
  C:\Windows\System\GcVPwPs.exe
  2⤵
  PID:14644
- C:\Windows\System\GtqFbTE.exe
  C:\Windows\System\GtqFbTE.exe
  2⤵
  PID:14664
- C:\Windows\System\HcZdFQy.exe
  C:\Windows\System\HcZdFQy.exe
  2⤵
  PID:14688
- C:\Windows\System\rrVANrH.exe
  C:\Windows\System\rrVANrH.exe
  2⤵
  PID:14728
- C:\Windows\System\yyvVnCv.exe
  C:\Windows\System\yyvVnCv.exe
  2⤵
  PID:14756
- C:\Windows\System\CKtVuRJ.exe
  C:\Windows\System\CKtVuRJ.exe
  2⤵
  PID:14780
- C:\Windows\System\JOIQVjU.exe
  C:\Windows\System\JOIQVjU.exe
  2⤵
  PID:14804
- C:\Windows\System\eITyywf.exe
  C:\Windows\System\eITyywf.exe
  2⤵
  PID:14828
- C:\Windows\System\WLbwKTd.exe
  C:\Windows\System\WLbwKTd.exe
  2⤵
  PID:14856
- C:\Windows\System\kYulIjX.exe
  C:\Windows\System\kYulIjX.exe
  2⤵
  PID:14880
- C:\Windows\System\hsSRqbj.exe
  C:\Windows\System\hsSRqbj.exe
  2⤵
  PID:14908
- C:\Windows\System\KGitAFk.exe
  C:\Windows\System\KGitAFk.exe
  2⤵
  PID:14932
- C:\Windows\System\uifkGZS.exe
  C:\Windows\System\uifkGZS.exe
  2⤵
  PID:14952
- C:\Windows\System\QgiFcUV.exe
  C:\Windows\System\QgiFcUV.exe
  2⤵
  PID:15008
- C:\Windows\System\NWXZJlw.exe
  C:\Windows\System\NWXZJlw.exe
  2⤵
  PID:15036
- C:\Windows\System\euBqDyJ.exe
  C:\Windows\System\euBqDyJ.exe
  2⤵
  PID:15064
- C:\Windows\System\QyNnmPb.exe
  C:\Windows\System\QyNnmPb.exe
  2⤵
  PID:15088
- C:\Windows\System\eSrfONa.exe
  C:\Windows\System\eSrfONa.exe
  2⤵
  PID:15112
- C:\Windows\System\tnxGBSn.exe
  C:\Windows\System\tnxGBSn.exe
  2⤵
  PID:15132
- C:\Windows\System\hsWhbVi.exe
  C:\Windows\System\hsWhbVi.exe
  2⤵
  PID:15164
- C:\Windows\System\xDQuGxp.exe
  C:\Windows\System\xDQuGxp.exe
  2⤵
  PID:15188
- C:\Windows\System\JuguXZl.exe
  C:\Windows\System\JuguXZl.exe
  2⤵
  PID:15232
- C:\Windows\System\zhrOrnV.exe
  C:\Windows\System\zhrOrnV.exe
  2⤵
  PID:15260
- C:\Windows\System\qiqplvW.exe
  C:\Windows\System\qiqplvW.exe
  2⤵
  PID:15276
- C:\Windows\System\nHjKoqU.exe
  C:\Windows\System\nHjKoqU.exe
  2⤵
  PID:15300
- C:\Windows\System\DQcJpBI.exe
  C:\Windows\System\DQcJpBI.exe
  2⤵
  PID:15340
- C:\Windows\System\utMHfyY.exe
  C:\Windows\System\utMHfyY.exe
  2⤵
  PID:14108
- C:\Windows\System\VtqHBUV.exe
  C:\Windows\System\VtqHBUV.exe
  2⤵
  PID:14372
- C:\Windows\System\YHOXKop.exe
  C:\Windows\System\YHOXKop.exe
  2⤵
  PID:14396
- C:\Windows\System\OLUIhBL.exe
  C:\Windows\System\OLUIhBL.exe
  2⤵
  PID:14444
- C:\Windows\System\MtrPCjD.exe
  C:\Windows\System\MtrPCjD.exe
  2⤵
  PID:14536
- C:\Windows\System\tnJCTrO.exe
  C:\Windows\System\tnJCTrO.exe
  2⤵
  PID:14620
- C:\Windows\System\nGUBZeG.exe
  C:\Windows\System\nGUBZeG.exe
  2⤵
  PID:14588
- C:\Windows\System\KmQCyiX.exe
  C:\Windows\System\KmQCyiX.exe
  2⤵
  PID:14752
- C:\Windows\System\GXxzPCt.exe
  C:\Windows\System\GXxzPCt.exe
  2⤵
  PID:14840
- C:\Windows\System\IRjVDEo.exe
  C:\Windows\System\IRjVDEo.exe
  2⤵
  PID:14904
- C:\Windows\System\JneqbjK.exe
  C:\Windows\System\JneqbjK.exe
  2⤵
  PID:14968
- C:\Windows\System\FVuyFte.exe
  C:\Windows\System\FVuyFte.exe
  2⤵
  PID:15028
- C:\Windows\System\rzUSleW.exe
  C:\Windows\System\rzUSleW.exe
  2⤵
  PID:15124
- C:\Windows\System\mGrOjmb.exe
  C:\Windows\System\mGrOjmb.exe
  2⤵
  PID:15156
- C:\Windows\System\GntuefB.exe
  C:\Windows\System\GntuefB.exe
  2⤵
  PID:15204
- C:\Windows\System\gnzoeud.exe
  C:\Windows\System\gnzoeud.exe
  2⤵
  PID:15296
- C:\Windows\System\qnBQSkF.exe
  C:\Windows\System\qnBQSkF.exe
  2⤵
  PID:15348
- C:\Windows\System\jfNSkyF.exe
  C:\Windows\System\jfNSkyF.exe
  2⤵
  PID:14428
- C:\Windows\System\dWEDVge.exe
  C:\Windows\System\dWEDVge.exe
  2⤵
  PID:14556
- C:\Windows\System\GnDVUrg.exe
  C:\Windows\System\GnDVUrg.exe
  2⤵
  PID:14684
- C:\Windows\System\owquOFO.exe
  C:\Windows\System\owquOFO.exe
  2⤵
  PID:14872
- C:\Windows\System\ORIbaue.exe
  C:\Windows\System\ORIbaue.exe
  2⤵
  PID:15004
- C:\Windows\System\KRwpvGX.exe
  C:\Windows\System\KRwpvGX.exe
  2⤵
  PID:15288
- C:\Windows\System\qFupoYn.exe
  C:\Windows\System\qFupoYn.exe
  2⤵
  PID:13724
- C:\Windows\System\uApcbok.exe
  C:\Windows\System\uApcbok.exe
  2⤵
  PID:14680
- C:\Windows\System\umAakMi.exe
  C:\Windows\System\umAakMi.exe
  2⤵
  PID:14744
- C:\Windows\System\KYzNfTg.exe
  C:\Windows\System\KYzNfTg.exe
  2⤵
  PID:15268
- C:\Windows\System\TsAakXG.exe
  C:\Windows\System\TsAakXG.exe
  2⤵
  PID:15252
- C:\Windows\System\fAVzZjf.exe
  C:\Windows\System\fAVzZjf.exe
  2⤵
  PID:15376
- C:\Windows\System\BnIKFtq.exe
  C:\Windows\System\BnIKFtq.exe
  2⤵
  PID:15392
- C:\Windows\System\nFROAYd.exe
  C:\Windows\System\nFROAYd.exe
  2⤵
  PID:15416
- C:\Windows\System\dZhXywA.exe
  C:\Windows\System\dZhXywA.exe
  2⤵
  PID:15456
- C:\Windows\System\uCiuGgi.exe
  C:\Windows\System\uCiuGgi.exe
  2⤵
  PID:15496
- C:\Windows\System\wOxtMcX.exe
  C:\Windows\System\wOxtMcX.exe
  2⤵
  PID:15528
- C:\Windows\System\TIQlEqc.exe
  C:\Windows\System\TIQlEqc.exe
  2⤵
  PID:15556
- C:\Windows\System\MdQJsRX.exe
  C:\Windows\System\MdQJsRX.exe
  2⤵
  PID:15576
- C:\Windows\System\erladTZ.exe
  C:\Windows\System\erladTZ.exe
  2⤵
  PID:15600
- C:\Windows\System\IsfPJMP.exe
  C:\Windows\System\IsfPJMP.exe
  2⤵
  PID:15640
- C:\Windows\System\ZJeuJce.exe
  C:\Windows\System\ZJeuJce.exe
  2⤵
  PID:15668
- C:\Windows\System\cVXomLd.exe
  C:\Windows\System\cVXomLd.exe
  2⤵
  PID:15696
- C:\Windows\System\tLyTaFU.exe
  C:\Windows\System\tLyTaFU.exe
  2⤵
  PID:15724
- C:\Windows\System\nXfDFqn.exe
  C:\Windows\System\nXfDFqn.exe
  2⤵
  PID:15752
- C:\Windows\System\sNPbFow.exe
  C:\Windows\System\sNPbFow.exe
  2⤵
  PID:15768
- C:\Windows\System\xtzbfzI.exe
  C:\Windows\System\xtzbfzI.exe
  2⤵
  PID:15808
- C:\Windows\System\SfGHIwK.exe
  C:\Windows\System\SfGHIwK.exe
  2⤵
  PID:15836
- C:\Windows\System\dNYLPnT.exe
  C:\Windows\System\dNYLPnT.exe
  2⤵
  PID:15852
- C:\Windows\System\JzdNZgx.exe
  C:\Windows\System\JzdNZgx.exe
  2⤵
  PID:15880
- C:\Windows\System\sikJQlS.exe
  C:\Windows\System\sikJQlS.exe
  2⤵
  PID:15904
- C:\Windows\System\nnPgtzr.exe
  C:\Windows\System\nnPgtzr.exe
  2⤵
  PID:15936
- C:\Windows\System\pSeaJAE.exe
  C:\Windows\System\pSeaJAE.exe
  2⤵
  PID:15964
- C:\Windows\System\OHWJGEK.exe
  C:\Windows\System\OHWJGEK.exe
  2⤵
  PID:15984
- C:\Windows\System\vyOvhQv.exe
  C:\Windows\System\vyOvhQv.exe
  2⤵
  PID:16012
- C:\Windows\System\JlQgqmG.exe
  C:\Windows\System\JlQgqmG.exe
  2⤵
  PID:16036
- C:\Windows\System\lgEekcg.exe
  C:\Windows\System\lgEekcg.exe
  2⤵
  PID:16100
- C:\Windows\System\XHojxNa.exe
  C:\Windows\System\XHojxNa.exe
  2⤵
  PID:16116
- C:\Windows\System\SePHYDp.exe
  C:\Windows\System\SePHYDp.exe
  2⤵
  PID:16132
- C:\Windows\System\EqUlIYO.exe
  C:\Windows\System\EqUlIYO.exe
  2⤵
  PID:16168
- C:\Windows\System\fCIjXNm.exe
  C:\Windows\System\fCIjXNm.exe
  2⤵
  PID:16192
- C:\Windows\System\NyVBkpl.exe
  C:\Windows\System\NyVBkpl.exe
  2⤵
  PID:16232
- C:\Windows\System\gyUmisK.exe
  C:\Windows\System\gyUmisK.exe
  2⤵
  PID:16248
- C:\Windows\System\ZpRLuNd.exe
  C:\Windows\System\ZpRLuNd.exe
  2⤵
  PID:16288
- C:\Windows\System\MbKvIuT.exe
  C:\Windows\System\MbKvIuT.exe
  2⤵
  PID:16316
- C:\Windows\System\guKFEUo.exe
  C:\Windows\System\guKFEUo.exe
  2⤵
  PID:16344
- C:\Windows\System\HRQZkKs.exe
  C:\Windows\System\HRQZkKs.exe
  2⤵
  PID:16372
- C:\Windows\System\hiIhlkW.exe
  C:\Windows\System\hiIhlkW.exe
  2⤵
  PID:15364
- C:\Windows\System\jfXYVrZ.exe
  C:\Windows\System\jfXYVrZ.exe
  2⤵
  PID:15444
- C:\Windows\System\aAxWhPM.exe
  C:\Windows\System\aAxWhPM.exe
  2⤵
  PID:15520
- C:\Windows\System\gZAfjNR.exe
  C:\Windows\System\gZAfjNR.exe
  2⤵
  PID:15584
- C:\Windows\System\vcldxic.exe
  C:\Windows\System\vcldxic.exe
  2⤵
  PID:15628
- C:\Windows\System\pzQcrwf.exe
  C:\Windows\System\pzQcrwf.exe
  2⤵
  PID:15692
- C:\Windows\System\YSLVoXT.exe
  C:\Windows\System\YSLVoXT.exe
  2⤵
  PID:15744
- C:\Windows\System\gsahaCS.exe
  C:\Windows\System\gsahaCS.exe
  2⤵
  PID:15804
- C:\Windows\System\TdDjWLz.exe
  C:\Windows\System\TdDjWLz.exe
  2⤵
  PID:15868
- C:\Windows\System\jGcsfkV.exe
  C:\Windows\System\jGcsfkV.exe
  2⤵
  PID:15944
- C:\Windows\System\lquScDv.exe
  C:\Windows\System\lquScDv.exe
  2⤵
  PID:16020
- C:\Windows\System\ePnicch.exe
  C:\Windows\System\ePnicch.exe
  2⤵
  PID:16108
- C:\Windows\System\AqHSqOH.exe
  C:\Windows\System\AqHSqOH.exe
  2⤵
  PID:16176
- C:\Windows\System\eGPBzQS.exe
  C:\Windows\System\eGPBzQS.exe
  2⤵
  PID:16240
- C:\Windows\System\vsyHaTO.exe
  C:\Windows\System\vsyHaTO.exe
  2⤵
  PID:16308
- C:\Windows\System\GpsbWsY.exe
  C:\Windows\System\GpsbWsY.exe
  2⤵
  PID:16356
- C:\Windows\System\sgyaSmm.exe
  C:\Windows\System\sgyaSmm.exe
  2⤵
  PID:15452
- C:\Windows\System\KtuNMZX.exe
  C:\Windows\System\KtuNMZX.exe
  2⤵
  PID:15708
- C:\Windows\System\ShEVPdh.exe
  C:\Windows\System\ShEVPdh.exe
  2⤵
  PID:15764
- C:\Windows\System\RrPvwmP.exe
  C:\Windows\System\RrPvwmP.exe
  2⤵
  PID:15844
- C:\Windows\System\nWuYnTQ.exe
  C:\Windows\System\nWuYnTQ.exe
  2⤵
  PID:15956
- C:\Windows\System\RJvHXkX.exe
  C:\Windows\System\RJvHXkX.exe
  2⤵
  PID:16032
- C:\Windows\System\qqtnkUw.exe
  C:\Windows\System\qqtnkUw.exe
  2⤵
  PID:16160
- C:\Windows\System\KbPWotQ.exe
  C:\Windows\System\KbPWotQ.exe
  2⤵
  PID:16284
- C:\Windows\System\eOltFyi.exe
  C:\Windows\System\eOltFyi.exe
  2⤵
  PID:16360
- C:\Windows\System\IQWrEJq.exe
  C:\Windows\System\IQWrEJq.exe
  2⤵
  PID:16216
- C:\Windows\System\NZDbxsU.exe
  C:\Windows\System\NZDbxsU.exe
  2⤵
  PID:15488
- C:\Windows\System\UTqgWPt.exe
  C:\Windows\System\UTqgWPt.exe
  2⤵
  PID:16412
- C:\Windows\System\pIERNkS.exe
  C:\Windows\System\pIERNkS.exe
  2⤵
  PID:16444
- C:\Windows\System\JIiDGRB.exe
  C:\Windows\System\JIiDGRB.exe
  2⤵
  PID:16468
- C:\Windows\System\ruTUMMp.exe
  C:\Windows\System\ruTUMMp.exe
  2⤵
  PID:16520
- C:\Windows\System\QLhmsHU.exe
  C:\Windows\System\QLhmsHU.exe
  2⤵
  PID:16548
- C:\Windows\System\dVSktYJ.exe
  C:\Windows\System\dVSktYJ.exe
  2⤵
  PID:16584
- C:\Windows\System\PTwrxBh.exe
  C:\Windows\System\PTwrxBh.exe
  2⤵
  PID:16612
- C:\Windows\System\NTgcJgB.exe
  C:\Windows\System\NTgcJgB.exe
  2⤵
  PID:16648
- C:\Windows\System\OMFgyQW.exe
  C:\Windows\System\OMFgyQW.exe
  2⤵
  PID:16688
- C:\Windows\System\DfCfXTq.exe
  C:\Windows\System\DfCfXTq.exe
  2⤵
  PID:16704
- C:\Windows\System\URdtSTV.exe
  C:\Windows\System\URdtSTV.exe
  2⤵
  PID:16732
- C:\Windows\System\vxswGZe.exe
  C:\Windows\System\vxswGZe.exe
  2⤵
  PID:16768
- C:\Windows\System\rRWlMfR.exe
  C:\Windows\System\rRWlMfR.exe
  2⤵
  PID:16788
- C:\Windows\System\fIGvQyx.exe
  C:\Windows\System\fIGvQyx.exe
  2⤵
  PID:16828
- C:\Windows\System\pILhcfQ.exe
  C:\Windows\System\pILhcfQ.exe
  2⤵
  PID:16860
- C:\Windows\System\uQWtVBW.exe
  C:\Windows\System\uQWtVBW.exe
  2⤵
  PID:16884
- C:\Windows\System\QLmRhWC.exe
  C:\Windows\System\QLmRhWC.exe
  2⤵
  PID:16908
- C:\Windows\System\LYjMLfA.exe
  C:\Windows\System\LYjMLfA.exe
  2⤵
  PID:16928
- C:\Windows\System\zwuTBWF.exe
  C:\Windows\System\zwuTBWF.exe
  2⤵
  PID:16956
- C:\Windows\System\mJKPtOb.exe
  C:\Windows\System\mJKPtOb.exe
  2⤵
  PID:16988
- C:\Windows\System\hVkHTxF.exe
  C:\Windows\System\hVkHTxF.exe
  2⤵
  PID:17016
- C:\Windows\System\xesTKPC.exe
  C:\Windows\System\xesTKPC.exe
  2⤵
  PID:17056
- C:\Windows\System\yisWGPg.exe
  C:\Windows\System\yisWGPg.exe
  2⤵
  PID:17072
- C:\Windows\System\YcLURBD.exe
  C:\Windows\System\YcLURBD.exe
  2⤵
  PID:17104
- C:\Windows\System\GQGtuZg.exe
  C:\Windows\System\GQGtuZg.exe
  2⤵
  PID:17140

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DFDnidA.exe

Filesize
1.6MB

MD5
e7780040d1a8382fc45327de185e4674

SHA1
5c74486aecb1717000744f3bafe8484103b6667c

SHA256
c34a58d499cc443c2e65703e4079d67015ee36b722762dd94fe4bf6714997050

SHA512
4a63c8eafecc48c3e6279780b5e567ae15a9c9cb36bd59e97babec37863e820d6512f80ce7b3f1130368290a257a2df743850913cf4aa899bffb98f5c9fa95b0

Download Submit
C:\Windows\System\GIqmDNj.exe

Filesize
1.6MB

MD5
d461b93f7f6f47406d21e1505c508018

SHA1
34090016b03d6bebed9b54571ee3b816a1bdad13

SHA256
31028c6fa7e44b30f086e5e56756efb3a6711a89fce7eeea50acf6c1cafca093

SHA512
923aa15343fbe258e748517b7cc5727627f9986c4d82614b2e1e23ce9af71e7b73c44ffc923524bc7e40f4a43e5a4ebf703df1ec620588ba4c287c6a3b6087d1

Download Submit
C:\Windows\System\KchQIXs.exe

Filesize
1.6MB

MD5
5ff885ded753ea99dc6bf7dad3720c7e

SHA1
0134efd8bf81366fa95d4dbd44d8b73f941a386f

SHA256
36c7fc2ab0b595cfd540736bb883bbcc1acc773cae248737825d7afe5e857dfb

SHA512
6085bcb60aa89cd01ffcf008faba93f67920fb2927b597d5e8f955e95504b1019c9381ca099d3b8c8be39a8d0e5d7e4070caccc43fa5dc4931c10772f75f59a2

Download Submit
C:\Windows\System\LBJSZKs.exe

Filesize
1.6MB

MD5
d40fb74e7978383e2a422cb832109d14

SHA1
40af6cbaf5f5db0418465557b8302b8c54701904

SHA256
6093f8fbddace7b797eddf9090aaddbdba7f0799cad182c2be868d39e4f20bf6

SHA512
bb978c1daa8016f20d3949caa50f12f0c8366b87235c6fbdbb2f595b1c8883699f1a3684af2bff450310cb1886a520ce2cc3143bce582ac1346492421e1146d8

Download Submit
C:\Windows\System\LgkAyMF.exe

Filesize
1.6MB

MD5
6def1c383d6d53d565e8deaa24ad46be

SHA1
20d2a507e138bbeb671d05698cf7d1c2a0fd3320

SHA256
a01359b7963c441c944973519f11aeba5f1d66f84206860ff2d9fa50e86a1379

SHA512
f72862fc0dc023bbb2d75f0dc924b76be6d14d70beddaf41d47a053b650b2b34ad6f9374d7147fb3f27d1f8b3e8dc08035eea4551f6362da486cca427cb435be

Download Submit
C:\Windows\System\NNRLvUw.exe

Filesize
1.6MB

MD5
d7878d9422143dd7459abad76321eed0

SHA1
c21d26e1c976d93daaa1ae5c4294d1e078791bf5

SHA256
4b7def10a6cc860644511631e2244c2efcbbe0b98114ba3d768bd797c31ec84c

SHA512
66175a44a04870b74ede634e5a30e2d7909435dc2ff2fa13d0180edc1dba81893aacb2dfeb9b830061bdee5954a81098d89dc74151eb82e24f28eaf2f3caa244

Download Submit
C:\Windows\System\NZBAMlj.exe

Filesize
1.6MB

MD5
79079fd2168d0b59169c512b249f2bf2

SHA1
4655fe7b2f8fa9bfebaff3f15c20cf7ca184cf1d

SHA256
5270670533542f8c40585c6d6711af031a4ffdf2ec0b5ac5e025d2bbe46d3834

SHA512
b337dc114b5bcb891ec5567c1add5e63c4f3236d43cd3360cd79016eefaeddf5b662fab422875d822e8d013b788d436eb59833aa8dc69f207bb117ddb64976e9

Download Submit
C:\Windows\System\NfvTbzV.exe

Filesize
1.6MB

MD5
5595fbd6b9ab04f8d749594861cb426a

SHA1
f3579f9b11e382731c8a865572a52165bfa53695

SHA256
67eafdada038abdc3c22175f11d721e284f4a67e75052e6fc1c33028722c03e6

SHA512
a75d602ab46f10c7958e61d4777aa7b2cfded27c46e31a436e79c9e9905293dce656ffc2e533e9a09c6fff3c0680e1944c06482ffd548454b93d7871ebeacfe1

Download Submit
C:\Windows\System\PQVHdcA.exe

Filesize
1.6MB

MD5
e1d9cee9061f9ba063fe875c832f50b8

SHA1
5852a9c9489ecf137a4463cc00c8ae59b546b7b3

SHA256
2d882372d3cb3c5c9a12ee760554fa30de9f8200c1ad53161523c4b6200df39e

SHA512
7ac369441c079526773539b5d8c50568aff900019e54eb78827b6180b4f045138fc23da9b8abe527c2ab43d91ca9fbffd80146d884f0284fdc7b00f0f1bc8ffd

Download Submit
C:\Windows\System\PrpnCga.exe

Filesize
1.6MB

MD5
0b5b5ed176bfdd88a0317ac626b1b62a

SHA1
c2ca8c1c2c10c8f85ad221629dd16d891923d359

SHA256
5836b707e22d983b01b566de9936b266cdcffc467cad485194e0aee8af51c1bb

SHA512
b5f78299204b61a7e437f755de8dff1a2d0b0cd7a90493eef417449042e1fa01f04e51bbfbf7cc32a4d084228a159d08ea4de483476badf85ced8860b34b16d8

Download Submit
C:\Windows\System\QzbUrRB.exe

Filesize
1.6MB

MD5
a435f70d5ac2dcca7f32bea1a605aa56

SHA1
c9f3713032fb899050269da5d152f0fbf3422f0c

SHA256
13b7cf0e21251b79c78f96361a5a30814458fd987a4414d00d7e80c5d4fcb86c

SHA512
d1a3d90fab51d85dea5e98d85c377decab18bf6a4afcab535465f3e72f7958022be6a2d9d12499ed55574ad9d2f68f4be962b066d803c75c865016e9fe7ca165

Download Submit
C:\Windows\System\RocAYUk.exe

Filesize
1.6MB

MD5
034218cacba48c57b014d254aaed754a

SHA1
b606a7b5711f4b3d78ce7aa2320ca4a80af70533

SHA256
2fbebca16585622fd081858c222345a0a3b1696173360a3810777dac8159802a

SHA512
cbe7bc70ebeef7e361beae5f4ee933e06f90cddee69a74fc2fc9c91c1061b99e17594d54b7881b22fecd19ec58f77ac12431fa01be75c354c8733e0c6358dc5f

Download Submit
C:\Windows\System\TOThhhY.exe

Filesize
1.6MB

MD5
41fbb5354e10ea20ae01ead1034bdd98

SHA1
c7831247340336b29a9c905dbf86af48f9d2b229

SHA256
39ed6f9682157626bfb0234967354c87af1b6f885735d4cdaa2059250bf83ff2

SHA512
ac7a46e68ea0b32f675fe06dbcf0d050697e1a91359417e780a52b191abf38fe07ecb0edf49d6eea16250350d1dad08041e8d6b057ff3654f1b95c476d961be1

Download Submit
C:\Windows\System\UEFiYDa.exe

Filesize
1.6MB

MD5
bf60d4185f780dd2b7de7f6ea697d8e4

SHA1
0e721d98784ebd72a7a9468ddeb1eeddccc7b10d

SHA256
0a5f548058281a89ea1b4c7e71f106bb2cc5af402e6dce30a33b49014405bf7f

SHA512
413e513e1fbcc11fbfcd146ab1e7c7839323cb093e16baf840af3213a808086acb2d0d1300e4a62e9938cb11d8f22cfea6a8c268499a2387fee327d4bb59232e

Download Submit
C:\Windows\System\VLbuMDG.exe

Filesize
1.6MB

MD5
a043973bc409c66020c4307115712a27

SHA1
6919e09fc29cb92ffe64e1e6a477fc01e43e44f1

SHA256
f49579260687a2b56daf5d6d96cc0e8d7decba2c1fb0b9f63278a3e31a10d29f

SHA512
aee3125a82bd62a12aa017192ce62bdc070ba24d1c3b980642fcc96b05f7eefc0c807435abf2b63abd7b129cc693a3695bfbce688952dc22cca20a4a57f3e764

Download Submit
C:\Windows\System\YeKSUOM.exe

Filesize
1.6MB

MD5
aa8bff5890da7c179f772edeb6340eca

SHA1
a8e7081393b46647a891789556a54934b68a306e

SHA256
8c947a4f81af63a1e176270633b26cc63162f3ecff267d2feb0435d16f345353

SHA512
25d6f00705e4e84e4351a87c3c1ecc8e76301d5368810befcda2a66fb2dbc47cc8531b2284c62bb5b54697e318b76889fa9d64bca195921c6dcf59dddbd9abc4

Download Submit
C:\Windows\System\ZtfPCaS.exe

Filesize
1.6MB

MD5
9a13fef421234f5eba627fd0836a1dcb

SHA1
a12f567ffbf72c5bf87e312b7db05c07eead1ae2

SHA256
47a0e9c90ede32513a754f5524ff65ee244ef0c404f7860e55539c3c2271dd17

SHA512
ab5070f0bc639ccf15939863b40b353bd596ea9b00e762f37b5ec439a226994f9f4150f13e628928937aa8aba1da3edc750bc9e6a7a8ddbf76528bf3c38c889a

Download Submit
C:\Windows\System\afoqTfF.exe

Filesize
1.6MB

MD5
96590643dae9d136c0775b02f6fd4679

SHA1
312d295be39598d7a66cc73b1e10abe0003b0c1b

SHA256
7cf2e268eea505f33305ceb81e8feb709e8992eabe622a34d769afe6401b96a3

SHA512
e1ebc4c7793423fcb04e0b321db382ae780fa9895a6a4851182ea6d000de61ab658c40451078cd7df4176abb6554b97aff92a9a807933c7c75322f5ef2548afa

Download Submit
C:\Windows\System\bvjNtZd.exe

Filesize
1.6MB

MD5
65b989f6cdd101772a2ab8c34193de98

SHA1
693634a7a4bce03f1f94aa47418890daa48adebd

SHA256
9952249c17aa8ebdb42bd91c188d093f5d9522f917c00f9765f6bb5dddd55d45

SHA512
ea9d731c2d138318bb1b2e55c03e3f21e129606bfafed1b7b3ebbc02f9763c4628b92f577a0dc8ed5c85b8e2b4a91e5840bb221a46bdb3a4cad741a3daf8f7b9

Download Submit
C:\Windows\System\czdaHGc.exe

Filesize
1.6MB

MD5
833c365e909710f0c5c1dda52ada7edd

SHA1
efffb675f4e7d9980b69bd91d5f46f8c843f2819

SHA256
97ba676dc1d3b8d4c88ff7ffa1583680592c0253668d379d8df7ccfd03943e90

SHA512
3af442a0723670fc9360289c4f944019c37fe83e4481fa60236155687809279bf383264e01a3a13aaebeffec399477cdc68a8e69229cb15b7315b3f965db9db0

Download Submit
C:\Windows\System\eQXKXMk.exe

Filesize
1.6MB

MD5
72ce5eac8e36c192ebcd6e02378dd539

SHA1
b1c40b6fd19e34bc1ee609d8e040a2a73048bbb8

SHA256
eaf3c68644f23c3a482c51416cb373d9c0e66d1df5a33dbdf169e208c9a294d3

SHA512
b65a9ded28b44244194998d115066b960b7e570ce09feecac44b640192b64e045d3904fbe95e7626f2f1e7c6dba75a501c220a3e2b553aef1f3f97155ebc8d90

Download Submit
C:\Windows\System\hTcDtIu.exe

Filesize
1.6MB

MD5
7b77a881014dbbe5892d796dda6103db

SHA1
44bfb47faf67cb98a6e588701a588fa7a75e9a33

SHA256
5732d3cf0847d1727548d20667742bc7d86c38f045f4aa503989211e22174290

SHA512
3f24ee55219bcc88495d0ed932a9b1e4188135f70a9f598b71fb03f5b2a42618544d867e5a39088487631e89e033dca1c13d6e977b470aa876d81ad58e638e96

Download Submit
C:\Windows\System\iarVrtg.exe

Filesize
1.6MB

MD5
30383f3df75176099327b28c48ba2dfb

SHA1
9aeaa2ec17fb4100e2ff9a8bb72378cd9040f9d3

SHA256
b08e514fb5fe75a3cb9be8f8f749d2c0b00ecc19099da6b6b7eff64402a23f11

SHA512
fe4f461b230f5a022f0d4368c5191aea0678be00101c779fcdb60c5f35ffd0d0f97b37311010933b86ce97ac71fae082b171f6a73f8dcb3a1f58fa7bf19e434d

Download Submit
C:\Windows\System\juSlOHe.exe

Filesize
1.6MB

MD5
cbddae1ec3bd3e29afeb8ba2a2ea339c

SHA1
65ec96954a057e61566a7343a2146c634eadd391

SHA256
5286424798a53f6328bf31af9551eba57cc0793f9b20b6d4a24372c1f6b859ce

SHA512
fdb15bf6fe723a361128a023fa8f0d1f47dc52114ed5b1a790fe848a7a9ac1466df4eb01e49f49dff18534f7ee65c710de54d84b83fd1b8a144b415992ba65c2

Download Submit
C:\Windows\System\rIINCRD.exe

Filesize
1.6MB

MD5
2ef35fdc4bcf6148c723426bed7978cb

SHA1
7d89893fdc027f12b6bb374738fab513a47a5c6a

SHA256
f2d779991250fa5c7958c8ded8d16a54fdfefb254736edf40e4052851cfaa6aa

SHA512
8f91452f0b41b7e2a38b33627a506dc3be6fc3063af9532b7e0a506faba2ea84023cb87eb4cb260d82279b522ff5cd2266481906c500e458804c02b9201dac50

Download Submit
C:\Windows\System\tMHDRkM.exe

Filesize
1.6MB

MD5
8367631e38b050cedc3432d9f97f7ac0

SHA1
129d9cea5355262d581bee5a9ff517c9eb792655

SHA256
fa73600b101bd71763e53144e801c49b71a038f6a63b30b2ffb2e9f47f500f18

SHA512
8c42a5c3593aff335e98a72c1f0d05f687550a35658ddf5a6c32156130b5f996dd37104f8805de4e58a65a894a8cbac76f8f86a60ab7e083421774c8517f2c53

Download Submit
C:\Windows\System\uDgbQQz.exe

Filesize
1.6MB

MD5
975ddcde8bbc891de354dff2114a7f07

SHA1
c201e5df004a6f7daa5776f14cffd683c1b4412a

SHA256
0c1f473b85801d329614a2b75cfed79a818916a17b86667b06e053e2b64881bc

SHA512
5f977256263629d8b883cbba963933c0553f42abc72d5d63717c6d01a691158d724dc2b7b4d35cbda5b6c767b25e3713f88eed26166deb1ed237062c47535b11

Download Submit
C:\Windows\System\uwXrjBg.exe

Filesize
1.6MB

MD5
997f3c6770b42e3e0eb09d5fe4ec9b24

SHA1
307eb31bd7b434e97b0c9cb9a0bf13175fae458e

SHA256
c6d746488f460d2487da8064bb9151bd8734dd8f4f9918f1a2e1d28ff74f4cb4

SHA512
9fb6db6b7f42136e4394d4b5f4c331933bef521ca40ac9a0a5e21332be22cdd6c46960dfe19394cd2486b41149d358c25f76524bb04dfae06d850b754d843346

Download Submit
C:\Windows\System\vrWEqxt.exe

Filesize
1.6MB

MD5
007517e3ccc6b0177bc17921e07511c6

SHA1
43e8f9d337baee3a618d990a085edfb83b1d176a

SHA256
5a4d91cf7c523c0cbd2a24f28776e6493c52ab1df5939a203d6d0c2872e51b79

SHA512
d98de4dd18e66b78d33ec1e0f2cb5eb8b5edacb42d94945511d02af3df75eda86d28aab98af74fba7cabcdaae68a1ef7613561c6eeed432a06e616f9769b243b

Download Submit
C:\Windows\System\vsoywqY.exe

Filesize
1.6MB

MD5
298bd460cc35d52bf75894e8dd5289ba

SHA1
48057e428c532e0485a0a84abdcca65cee99e20b

SHA256
0e3647ef6766ee4c1ceebe1d73ab26f0dde8b72d971c0d44a9a6c4a9295263f8

SHA512
e2a5a5de96e229d32f6c205dd50b6511f50ca67721a829459f5c3f3c062c185e24b783ba213f4475c2e5aebb74da81379ec83f14f80ba7e287ee50ea2626fe10

Download Submit
C:\Windows\System\wKtbtBM.exe

Filesize
1.6MB

MD5
ad79b6bffe6a118a021a08b0014ad96e

SHA1
96b88e39632d47a269d6b02d6ea13538a2b24a27

SHA256
56cd68bffcad73d911d3b7e95162543ee815e1496fb561c712454f3de5a1fb42

SHA512
a892faab34f91662f798d7ccb3eea7938c707a4a3085b7056ab4eb2720112a34293a607d3780822a4c491fc346564e3f8aeeb19a6fc10c6d2c0519d3461eb3d0

Download Submit
C:\Windows\System\wQfYXGp.exe

Filesize
1.6MB

MD5
c9e73d0b317385ea5ac5afc5a4dc1d07

SHA1
34cb9741fbc7a64f0752135fa33c425519e1f56c

SHA256
1f0f23f71d1b3f833bbd1ded9bc0b4e41cee998d45a70f907d76e3686b81da10

SHA512
9c82711e5abbb9740b0fdf4b3c6c71c45961e5bf72f4a57e2685a20bb80f138e629b96996e322892b5a32527fd461a03faddcf92a7fc4114ae0c444bf1d3a4ea

Download Submit
C:\Windows\System\xnnHvZh.exe

Filesize
1.6MB

MD5
ebc071cd87de205c13c4280b6be1265d

SHA1
ab8eb8326fc5c39f3c0e3c3c1a1791086cdde356

SHA256
af6ad95b5d8c8e43c3710a0db41d3e8af811a8ad8e788ecd94425d69b878e7cd

SHA512
67299c33a9303c913fb5b071b585cab0b3afa96a476a88fe4c048434d685dc7a05a253e08735c6c72a363d0d41a9f7800373db198587c0fb68cdb98768c30374

Download Submit
memory/2324-0-0x000001F807EC0000-0x000001F807ED0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads