xmrig | a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
Size

1.6MB
MD5

62955c666b3f535ba8c11893f1efaaca
SHA1

bd80bb16a330ce80d89a5a1fe200f697302b472e
SHA256

a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0
SHA512

7627842767953fc49cfb6269b3f813e9f90e47805b8674471ec16cba6661c694ac3f67e87fa7cb9e10fd8909be0a0e054c6f075921d7f7eb01c320f63b37c56b
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnmxZ8zoE:GemTLkNdfE0pZy/

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0032000000023b77-4.dat	xmrig
behavioral2/files/0x000a000000023b7b-9.dat	xmrig
behavioral2/files/0x000a000000023b7c-13.dat	xmrig
behavioral2/files/0x000a000000023b7e-24.dat	xmrig
behavioral2/files/0x000a000000023b82-49.dat	xmrig
behavioral2/files/0x000a000000023b84-57.dat	xmrig
behavioral2/files/0x000a000000023b91-116.dat	xmrig
behavioral2/files/0x000a000000023b95-136.dat	xmrig
behavioral2/files/0x000a000000023b9a-161.dat	xmrig
behavioral2/files/0x000a000000023b98-159.dat	xmrig
behavioral2/files/0x000a000000023b99-156.dat	xmrig
behavioral2/files/0x000a000000023b97-154.dat	xmrig
behavioral2/files/0x000a000000023b96-149.dat	xmrig
behavioral2/files/0x000a000000023b94-139.dat	xmrig
behavioral2/files/0x000a000000023b93-134.dat	xmrig
behavioral2/files/0x000a000000023b92-129.dat	xmrig
behavioral2/files/0x000a000000023b90-119.dat	xmrig
behavioral2/files/0x000a000000023b8f-114.dat	xmrig
behavioral2/files/0x000a000000023b8e-109.dat	xmrig
behavioral2/files/0x000a000000023b8d-101.dat	xmrig
behavioral2/files/0x000a000000023b8c-97.dat	xmrig
behavioral2/files/0x000a000000023b8b-91.dat	xmrig
behavioral2/files/0x000a000000023b8a-87.dat	xmrig
behavioral2/files/0x000a000000023b89-81.dat	xmrig
behavioral2/files/0x000a000000023b88-77.dat	xmrig
behavioral2/files/0x000a000000023b87-71.dat	xmrig
behavioral2/files/0x000a000000023b86-67.dat	xmrig
behavioral2/files/0x000a000000023b85-61.dat	xmrig
behavioral2/files/0x000a000000023b83-54.dat	xmrig
behavioral2/files/0x000a000000023b81-41.dat	xmrig
behavioral2/files/0x000a000000023b80-37.dat	xmrig
behavioral2/files/0x000a000000023b7f-31.dat	xmrig
behavioral2/files/0x000a000000023b7d-20.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3968	RpmKLDY.exe
2560	wWWpXwn.exe
4864	XpOIHTd.exe
4612	xvnMaFQ.exe
2064	RqFVXIN.exe
116	KuEqukY.exe
1796	nCEEkuE.exe
2968	bhrpMEe.exe
4636	hnUenRF.exe
716	VMlIkkz.exe
4120	cohVqEQ.exe
3880	hnLsRcD.exe
4704	tZkKbVq.exe
4592	WPeHFQc.exe
3904	WawylWC.exe
2204	BWmlcZs.exe
1728	FywMwzx.exe
4884	nOQCiAI.exe
3760	EgqbMaP.exe
1864	sgitdVS.exe
2540	IEIVnFX.exe
3828	PfiFNyg.exe
2720	IPmTEfY.exe
4920	ppEwAra.exe
1708	RKjnVRV.exe
944	NBzHiOv.exe
4004	elaSURP.exe
3220	tNmwRtN.exe
2984	gkqlXuv.exe
3856	SVgbpjZ.exe
972	MrHWYXY.exe
3952	dQPOpYa.exe
4628	LMIeYPu.exe
924	xXkRujv.exe
2580	yDCclCY.exe
2316	HFmiaRr.exe
4204	AdbQfQV.exe
1936	AvTvJZb.exe
3480	YmJiQbq.exe
3732	mkMuJMP.exe
4880	nDhYUFO.exe
1380	GpyjEIc.exe
1896	BaswiKn.exe
2900	iWRWeHt.exe
320	ahmDlUH.exe
3912	ONhLdpc.exe
4220	NFfljVo.exe
3864	rOjfgac.exe
4816	rDRBAFf.exe
2884	zmereXA.exe
1372	TWqdwmK.exe
2868	YpFKlYS.exe
4716	nIjQihc.exe
3756	ShdcGOb.exe
1980	EEhamrQ.exe
3464	MjYOagg.exe
4072	szotirv.exe
3924	FYQosAE.exe
3612	yHhQCCK.exe
3416	oQYFiOc.exe
1892	LfDmrFB.exe
1528	CFeVWbH.exe
2272	EwJmtgP.exe
960	UZZcEVj.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\eLVSwCl.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\loWqerP.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\QDqfdsn.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\MOYgNpk.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\PiyFlKx.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\XQnrwJr.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\oIPMENB.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\xFmJOZP.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\YSvijoN.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\hnUenRF.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\HGqPikr.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\xsAZXSp.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\LxnKhuB.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\kJhXIOv.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\JuKAnEJ.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\xXxBCzF.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\cdpkalY.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\OYozYWZ.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\dqTjezn.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\iDgCZtK.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\CcMTUHt.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\opwMJdB.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\uhaRKKs.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\TqsLiky.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\fRJHwoQ.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\zYoXNhp.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\oaPihwG.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\glCNYmV.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\IPhKoCx.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\xRqmeqs.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\JtKzMrH.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\kwVibce.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\jAvULUL.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\ZNOSWLT.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\mvzStkG.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\yHflaoE.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\ccLTqYw.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\yHhQCCK.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\LUIZtBt.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\IdQXvVf.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\cohVqEQ.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\vvVbbeo.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\GxHwMUm.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\pABrkZP.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\WqkoOpH.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\PzwwaKU.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\AbUrTuF.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\TLtyNmY.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\Uzvapow.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\WPeHFQc.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\KicIDnJ.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\GQfRHHg.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\ebpSUSc.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\ERkvvzQ.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\mbQCSsm.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\PwQyIPY.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\tNmwRtN.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\bcgwLiF.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\zBqBxYG.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\GDVIQml.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\TWqdwmK.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\TKYaHir.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\LMIeYPu.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
File created	C:\Windows\System\zKgBFgj.exe	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16356	dwm.exe
Token: SeChangeNotifyPrivilege	16356	dwm.exe
Token: 33	16356	dwm.exe
Token: SeIncBasePriorityPrivilege	16356	dwm.exe
Token: SeShutdownPrivilege	16356	dwm.exe
Token: SeCreatePagefilePrivilege	16356	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 3968	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	84
PID 3816 wrote to memory of 3968	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	84
PID 3816 wrote to memory of 2560	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	85
PID 3816 wrote to memory of 2560	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	85
PID 3816 wrote to memory of 4864	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	86
PID 3816 wrote to memory of 4864	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	86
PID 3816 wrote to memory of 4612	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	87
PID 3816 wrote to memory of 4612	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	87
PID 3816 wrote to memory of 2064	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	88
PID 3816 wrote to memory of 2064	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	88
PID 3816 wrote to memory of 116	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	89
PID 3816 wrote to memory of 116	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	89
PID 3816 wrote to memory of 1796	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	90
PID 3816 wrote to memory of 1796	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	90
PID 3816 wrote to memory of 2968	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	91
PID 3816 wrote to memory of 2968	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	91
PID 3816 wrote to memory of 4636	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	92
PID 3816 wrote to memory of 4636	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	92
PID 3816 wrote to memory of 716	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	93
PID 3816 wrote to memory of 716	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	93
PID 3816 wrote to memory of 4120	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	94
PID 3816 wrote to memory of 4120	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	94
PID 3816 wrote to memory of 3880	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	95
PID 3816 wrote to memory of 3880	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	95
PID 3816 wrote to memory of 4704	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	96
PID 3816 wrote to memory of 4704	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	96
PID 3816 wrote to memory of 4592	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	97
PID 3816 wrote to memory of 4592	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	97
PID 3816 wrote to memory of 3904	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	98
PID 3816 wrote to memory of 3904	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	98
PID 3816 wrote to memory of 2204	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	99
PID 3816 wrote to memory of 2204	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	99
PID 3816 wrote to memory of 1728	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	100
PID 3816 wrote to memory of 1728	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	100
PID 3816 wrote to memory of 4884	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	101
PID 3816 wrote to memory of 4884	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	101
PID 3816 wrote to memory of 3760	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	102
PID 3816 wrote to memory of 3760	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	102
PID 3816 wrote to memory of 1864	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	103
PID 3816 wrote to memory of 1864	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	103
PID 3816 wrote to memory of 2540	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	104
PID 3816 wrote to memory of 2540	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	104
PID 3816 wrote to memory of 3828	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	105
PID 3816 wrote to memory of 3828	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	105
PID 3816 wrote to memory of 2720	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	106
PID 3816 wrote to memory of 2720	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	106
PID 3816 wrote to memory of 4920	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	107
PID 3816 wrote to memory of 4920	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	107
PID 3816 wrote to memory of 1708	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	108
PID 3816 wrote to memory of 1708	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	108
PID 3816 wrote to memory of 944	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	109
PID 3816 wrote to memory of 944	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	109
PID 3816 wrote to memory of 4004	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	110
PID 3816 wrote to memory of 4004	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	110
PID 3816 wrote to memory of 3220	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	111
PID 3816 wrote to memory of 3220	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	111
PID 3816 wrote to memory of 2984	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	112
PID 3816 wrote to memory of 2984	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	112
PID 3816 wrote to memory of 3856	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	113
PID 3816 wrote to memory of 3856	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	113
PID 3816 wrote to memory of 972	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	114
PID 3816 wrote to memory of 972	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	114
PID 3816 wrote to memory of 3952	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	115
PID 3816 wrote to memory of 3952	3816	a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe	115

C:\Users\Admin\AppData\Local\Temp\a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe
"C:\Users\Admin\AppData\Local\Temp\a8b5da539549e399f223efa1911909e611bccedae130a7c4d9b8db68a4a0e7a0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\System\RpmKLDY.exe
  C:\Windows\System\RpmKLDY.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\wWWpXwn.exe
  C:\Windows\System\wWWpXwn.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\XpOIHTd.exe
  C:\Windows\System\XpOIHTd.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\xvnMaFQ.exe
  C:\Windows\System\xvnMaFQ.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\RqFVXIN.exe
  C:\Windows\System\RqFVXIN.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\KuEqukY.exe
  C:\Windows\System\KuEqukY.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\nCEEkuE.exe
  C:\Windows\System\nCEEkuE.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\bhrpMEe.exe
  C:\Windows\System\bhrpMEe.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\hnUenRF.exe
  C:\Windows\System\hnUenRF.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\VMlIkkz.exe
  C:\Windows\System\VMlIkkz.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\cohVqEQ.exe
  C:\Windows\System\cohVqEQ.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\hnLsRcD.exe
  C:\Windows\System\hnLsRcD.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\tZkKbVq.exe
  C:\Windows\System\tZkKbVq.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\WPeHFQc.exe
  C:\Windows\System\WPeHFQc.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\WawylWC.exe
  C:\Windows\System\WawylWC.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\BWmlcZs.exe
  C:\Windows\System\BWmlcZs.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\FywMwzx.exe
  C:\Windows\System\FywMwzx.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\nOQCiAI.exe
  C:\Windows\System\nOQCiAI.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\EgqbMaP.exe
  C:\Windows\System\EgqbMaP.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\sgitdVS.exe
  C:\Windows\System\sgitdVS.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\IEIVnFX.exe
  C:\Windows\System\IEIVnFX.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\PfiFNyg.exe
  C:\Windows\System\PfiFNyg.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\IPmTEfY.exe
  C:\Windows\System\IPmTEfY.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\ppEwAra.exe
  C:\Windows\System\ppEwAra.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\RKjnVRV.exe
  C:\Windows\System\RKjnVRV.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\NBzHiOv.exe
  C:\Windows\System\NBzHiOv.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\elaSURP.exe
  C:\Windows\System\elaSURP.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\tNmwRtN.exe
  C:\Windows\System\tNmwRtN.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\gkqlXuv.exe
  C:\Windows\System\gkqlXuv.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\SVgbpjZ.exe
  C:\Windows\System\SVgbpjZ.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\MrHWYXY.exe
  C:\Windows\System\MrHWYXY.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\dQPOpYa.exe
  C:\Windows\System\dQPOpYa.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\LMIeYPu.exe
  C:\Windows\System\LMIeYPu.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\xXkRujv.exe
  C:\Windows\System\xXkRujv.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\yDCclCY.exe
  C:\Windows\System\yDCclCY.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\HFmiaRr.exe
  C:\Windows\System\HFmiaRr.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\AdbQfQV.exe
  C:\Windows\System\AdbQfQV.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\AvTvJZb.exe
  C:\Windows\System\AvTvJZb.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\YmJiQbq.exe
  C:\Windows\System\YmJiQbq.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\mkMuJMP.exe
  C:\Windows\System\mkMuJMP.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\nDhYUFO.exe
  C:\Windows\System\nDhYUFO.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\GpyjEIc.exe
  C:\Windows\System\GpyjEIc.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\BaswiKn.exe
  C:\Windows\System\BaswiKn.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\iWRWeHt.exe
  C:\Windows\System\iWRWeHt.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\ahmDlUH.exe
  C:\Windows\System\ahmDlUH.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\ONhLdpc.exe
  C:\Windows\System\ONhLdpc.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\NFfljVo.exe
  C:\Windows\System\NFfljVo.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\rOjfgac.exe
  C:\Windows\System\rOjfgac.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\rDRBAFf.exe
  C:\Windows\System\rDRBAFf.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\zmereXA.exe
  C:\Windows\System\zmereXA.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\TWqdwmK.exe
  C:\Windows\System\TWqdwmK.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\YpFKlYS.exe
  C:\Windows\System\YpFKlYS.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\nIjQihc.exe
  C:\Windows\System\nIjQihc.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\ShdcGOb.exe
  C:\Windows\System\ShdcGOb.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\EEhamrQ.exe
  C:\Windows\System\EEhamrQ.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\MjYOagg.exe
  C:\Windows\System\MjYOagg.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\szotirv.exe
  C:\Windows\System\szotirv.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\FYQosAE.exe
  C:\Windows\System\FYQosAE.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\yHhQCCK.exe
  C:\Windows\System\yHhQCCK.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\oQYFiOc.exe
  C:\Windows\System\oQYFiOc.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\LfDmrFB.exe
  C:\Windows\System\LfDmrFB.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\CFeVWbH.exe
  C:\Windows\System\CFeVWbH.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\EwJmtgP.exe
  C:\Windows\System\EwJmtgP.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\UZZcEVj.exe
  C:\Windows\System\UZZcEVj.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\THNKsRt.exe
  C:\Windows\System\THNKsRt.exe
  2⤵
  PID:4692
- C:\Windows\System\BvmgYfP.exe
  C:\Windows\System\BvmgYfP.exe
  2⤵
  PID:4992
- C:\Windows\System\loWqerP.exe
  C:\Windows\System\loWqerP.exe
  2⤵
  PID:1712
- C:\Windows\System\VExUsPb.exe
  C:\Windows\System\VExUsPb.exe
  2⤵
  PID:1140
- C:\Windows\System\opwMJdB.exe
  C:\Windows\System\opwMJdB.exe
  2⤵
  PID:2936
- C:\Windows\System\BPtFiAr.exe
  C:\Windows\System\BPtFiAr.exe
  2⤵
  PID:4916
- C:\Windows\System\uwxzuZz.exe
  C:\Windows\System\uwxzuZz.exe
  2⤵
  PID:4772
- C:\Windows\System\jAvULUL.exe
  C:\Windows\System\jAvULUL.exe
  2⤵
  PID:2028
- C:\Windows\System\hVjvxIN.exe
  C:\Windows\System\hVjvxIN.exe
  2⤵
  PID:3364
- C:\Windows\System\DyMxZur.exe
  C:\Windows\System\DyMxZur.exe
  2⤵
  PID:3432
- C:\Windows\System\UtesphK.exe
  C:\Windows\System\UtesphK.exe
  2⤵
  PID:2220
- C:\Windows\System\IYWOtcT.exe
  C:\Windows\System\IYWOtcT.exe
  2⤵
  PID:1904
- C:\Windows\System\CwPykEO.exe
  C:\Windows\System\CwPykEO.exe
  2⤵
  PID:3200
- C:\Windows\System\nYOsFVl.exe
  C:\Windows\System\nYOsFVl.exe
  2⤵
  PID:3320
- C:\Windows\System\FCbCeAm.exe
  C:\Windows\System\FCbCeAm.exe
  2⤵
  PID:2200
- C:\Windows\System\GYlIlaZ.exe
  C:\Windows\System\GYlIlaZ.exe
  2⤵
  PID:840
- C:\Windows\System\uhYUFUf.exe
  C:\Windows\System\uhYUFUf.exe
  2⤵
  PID:3164
- C:\Windows\System\xSGZsVb.exe
  C:\Windows\System\xSGZsVb.exe
  2⤵
  PID:1336
- C:\Windows\System\cdpkalY.exe
  C:\Windows\System\cdpkalY.exe
  2⤵
  PID:2288
- C:\Windows\System\VMrwRwk.exe
  C:\Windows\System\VMrwRwk.exe
  2⤵
  PID:3500
- C:\Windows\System\LFjrYPz.exe
  C:\Windows\System\LFjrYPz.exe
  2⤵
  PID:2672
- C:\Windows\System\ithFdiQ.exe
  C:\Windows\System\ithFdiQ.exe
  2⤵
  PID:3584
- C:\Windows\System\DmCYLuR.exe
  C:\Windows\System\DmCYLuR.exe
  2⤵
  PID:5132
- C:\Windows\System\ecRvHxW.exe
  C:\Windows\System\ecRvHxW.exe
  2⤵
  PID:5160
- C:\Windows\System\ZyLDAqw.exe
  C:\Windows\System\ZyLDAqw.exe
  2⤵
  PID:5192
- C:\Windows\System\EodkceK.exe
  C:\Windows\System\EodkceK.exe
  2⤵
  PID:5216
- C:\Windows\System\nWpjpWk.exe
  C:\Windows\System\nWpjpWk.exe
  2⤵
  PID:5252
- C:\Windows\System\qsPkKJM.exe
  C:\Windows\System\qsPkKJM.exe
  2⤵
  PID:5272
- C:\Windows\System\YWbEQDR.exe
  C:\Windows\System\YWbEQDR.exe
  2⤵
  PID:5300
- C:\Windows\System\EIGeyEJ.exe
  C:\Windows\System\EIGeyEJ.exe
  2⤵
  PID:5332
- C:\Windows\System\rgjOZcy.exe
  C:\Windows\System\rgjOZcy.exe
  2⤵
  PID:5356
- C:\Windows\System\lsbcCuI.exe
  C:\Windows\System\lsbcCuI.exe
  2⤵
  PID:5388
- C:\Windows\System\xJWSPeU.exe
  C:\Windows\System\xJWSPeU.exe
  2⤵
  PID:5412
- C:\Windows\System\YVVmzsV.exe
  C:\Windows\System\YVVmzsV.exe
  2⤵
  PID:5440
- C:\Windows\System\qomcfsz.exe
  C:\Windows\System\qomcfsz.exe
  2⤵
  PID:5468
- C:\Windows\System\cGMCaAz.exe
  C:\Windows\System\cGMCaAz.exe
  2⤵
  PID:5504
- C:\Windows\System\zKNLtdY.exe
  C:\Windows\System\zKNLtdY.exe
  2⤵
  PID:5524
- C:\Windows\System\pkgDPNf.exe
  C:\Windows\System\pkgDPNf.exe
  2⤵
  PID:5552
- C:\Windows\System\RZhfOYw.exe
  C:\Windows\System\RZhfOYw.exe
  2⤵
  PID:5584
- C:\Windows\System\JsRbLuW.exe
  C:\Windows\System\JsRbLuW.exe
  2⤵
  PID:5608
- C:\Windows\System\WfZEezt.exe
  C:\Windows\System\WfZEezt.exe
  2⤵
  PID:5640
- C:\Windows\System\kiAmeiI.exe
  C:\Windows\System\kiAmeiI.exe
  2⤵
  PID:5664
- C:\Windows\System\NCjnXcZ.exe
  C:\Windows\System\NCjnXcZ.exe
  2⤵
  PID:5688
- C:\Windows\System\xRqmeqs.exe
  C:\Windows\System\xRqmeqs.exe
  2⤵
  PID:5720
- C:\Windows\System\FNaHBkl.exe
  C:\Windows\System\FNaHBkl.exe
  2⤵
  PID:5752
- C:\Windows\System\fcvuJwA.exe
  C:\Windows\System\fcvuJwA.exe
  2⤵
  PID:5776
- C:\Windows\System\JldReAG.exe
  C:\Windows\System\JldReAG.exe
  2⤵
  PID:5808
- C:\Windows\System\sXZlrDE.exe
  C:\Windows\System\sXZlrDE.exe
  2⤵
  PID:5836
- C:\Windows\System\GBkenMO.exe
  C:\Windows\System\GBkenMO.exe
  2⤵
  PID:5864
- C:\Windows\System\vvVbbeo.exe
  C:\Windows\System\vvVbbeo.exe
  2⤵
  PID:5888
- C:\Windows\System\GBifFLh.exe
  C:\Windows\System\GBifFLh.exe
  2⤵
  PID:5908
- C:\Windows\System\DZXdrxZ.exe
  C:\Windows\System\DZXdrxZ.exe
  2⤵
  PID:5936
- C:\Windows\System\WkVGALY.exe
  C:\Windows\System\WkVGALY.exe
  2⤵
  PID:5964
- C:\Windows\System\yTXRxuc.exe
  C:\Windows\System\yTXRxuc.exe
  2⤵
  PID:5992
- C:\Windows\System\eirOlhU.exe
  C:\Windows\System\eirOlhU.exe
  2⤵
  PID:6020
- C:\Windows\System\XzejUcx.exe
  C:\Windows\System\XzejUcx.exe
  2⤵
  PID:6044
- C:\Windows\System\coCUxGE.exe
  C:\Windows\System\coCUxGE.exe
  2⤵
  PID:6072
- C:\Windows\System\lZtpDZv.exe
  C:\Windows\System\lZtpDZv.exe
  2⤵
  PID:6136
- C:\Windows\System\cEuktTY.exe
  C:\Windows\System\cEuktTY.exe
  2⤵
  PID:3916
- C:\Windows\System\zxHkDQh.exe
  C:\Windows\System\zxHkDQh.exe
  2⤵
  PID:2896
- C:\Windows\System\XSwTwDt.exe
  C:\Windows\System\XSwTwDt.exe
  2⤵
  PID:2600
- C:\Windows\System\fmJCjba.exe
  C:\Windows\System\fmJCjba.exe
  2⤵
  PID:2240
- C:\Windows\System\sNtTsbd.exe
  C:\Windows\System\sNtTsbd.exe
  2⤵
  PID:4644
- C:\Windows\System\MVjxSet.exe
  C:\Windows\System\MVjxSet.exe
  2⤵
  PID:4752
- C:\Windows\System\GAEKlyf.exe
  C:\Windows\System\GAEKlyf.exe
  2⤵
  PID:1500
- C:\Windows\System\fVAeViP.exe
  C:\Windows\System\fVAeViP.exe
  2⤵
  PID:3336
- C:\Windows\System\fqHwgSw.exe
  C:\Windows\System\fqHwgSw.exe
  2⤵
  PID:5148
- C:\Windows\System\LhzpTDc.exe
  C:\Windows\System\LhzpTDc.exe
  2⤵
  PID:5212
- C:\Windows\System\UNZPoug.exe
  C:\Windows\System\UNZPoug.exe
  2⤵
  PID:5284
- C:\Windows\System\HVSRnKb.exe
  C:\Windows\System\HVSRnKb.exe
  2⤵
  PID:5348
- C:\Windows\System\nCfnMVE.exe
  C:\Windows\System\nCfnMVE.exe
  2⤵
  PID:5404
- C:\Windows\System\fRJHwoQ.exe
  C:\Windows\System\fRJHwoQ.exe
  2⤵
  PID:5480
- C:\Windows\System\TKYaHir.exe
  C:\Windows\System\TKYaHir.exe
  2⤵
  PID:5540
- C:\Windows\System\hWiQokr.exe
  C:\Windows\System\hWiQokr.exe
  2⤵
  PID:5604
- C:\Windows\System\tcwnUCk.exe
  C:\Windows\System\tcwnUCk.exe
  2⤵
  PID:5672
- C:\Windows\System\zBtZGlw.exe
  C:\Windows\System\zBtZGlw.exe
  2⤵
  PID:5732
- C:\Windows\System\bcgwLiF.exe
  C:\Windows\System\bcgwLiF.exe
  2⤵
  PID:5796
- C:\Windows\System\SARxpfI.exe
  C:\Windows\System\SARxpfI.exe
  2⤵
  PID:5872
- C:\Windows\System\SyqKYsw.exe
  C:\Windows\System\SyqKYsw.exe
  2⤵
  PID:5928
- C:\Windows\System\rVSOleF.exe
  C:\Windows\System\rVSOleF.exe
  2⤵
  PID:5984
- C:\Windows\System\CTzaLQD.exe
  C:\Windows\System\CTzaLQD.exe
  2⤵
  PID:6056
- C:\Windows\System\ighmtWx.exe
  C:\Windows\System\ighmtWx.exe
  2⤵
  PID:6128
- C:\Windows\System\QxtPiUt.exe
  C:\Windows\System\QxtPiUt.exe
  2⤵
  PID:4136
- C:\Windows\System\lEMJSqs.exe
  C:\Windows\System\lEMJSqs.exe
  2⤵
  PID:2712
- C:\Windows\System\ioQAMRQ.exe
  C:\Windows\System\ioQAMRQ.exe
  2⤵
  PID:5100
- C:\Windows\System\PcbHCHW.exe
  C:\Windows\System\PcbHCHW.exe
  2⤵
  PID:5176
- C:\Windows\System\tihefvk.exe
  C:\Windows\System\tihefvk.exe
  2⤵
  PID:5316
- C:\Windows\System\vFkWpol.exe
  C:\Windows\System\vFkWpol.exe
  2⤵
  PID:5456
- C:\Windows\System\MlHgIsQ.exe
  C:\Windows\System\MlHgIsQ.exe
  2⤵
  PID:5648
- C:\Windows\System\IANwtrE.exe
  C:\Windows\System\IANwtrE.exe
  2⤵
  PID:5788
- C:\Windows\System\FFJyVGB.exe
  C:\Windows\System\FFJyVGB.exe
  2⤵
  PID:4392
- C:\Windows\System\kyYVczA.exe
  C:\Windows\System\kyYVczA.exe
  2⤵
  PID:6168
- C:\Windows\System\iudCgDj.exe
  C:\Windows\System\iudCgDj.exe
  2⤵
  PID:6204
- C:\Windows\System\AmPaHTa.exe
  C:\Windows\System\AmPaHTa.exe
  2⤵
  PID:6228
- C:\Windows\System\IZPAHAJ.exe
  C:\Windows\System\IZPAHAJ.exe
  2⤵
  PID:6256
- C:\Windows\System\VrLklrd.exe
  C:\Windows\System\VrLklrd.exe
  2⤵
  PID:6276
- C:\Windows\System\aDZbnrH.exe
  C:\Windows\System\aDZbnrH.exe
  2⤵
  PID:6304
- C:\Windows\System\EYfNKqz.exe
  C:\Windows\System\EYfNKqz.exe
  2⤵
  PID:6332
- C:\Windows\System\bnwHFJp.exe
  C:\Windows\System\bnwHFJp.exe
  2⤵
  PID:6356
- C:\Windows\System\QLuQfFk.exe
  C:\Windows\System\QLuQfFk.exe
  2⤵
  PID:6388
- C:\Windows\System\gKMcWaM.exe
  C:\Windows\System\gKMcWaM.exe
  2⤵
  PID:6416
- C:\Windows\System\outAKQU.exe
  C:\Windows\System\outAKQU.exe
  2⤵
  PID:6444
- C:\Windows\System\JFoeRUv.exe
  C:\Windows\System\JFoeRUv.exe
  2⤵
  PID:6472
- C:\Windows\System\EHHYHtN.exe
  C:\Windows\System\EHHYHtN.exe
  2⤵
  PID:6500
- C:\Windows\System\gCpNpoG.exe
  C:\Windows\System\gCpNpoG.exe
  2⤵
  PID:6528
- C:\Windows\System\XZcZmMH.exe
  C:\Windows\System\XZcZmMH.exe
  2⤵
  PID:6556
- C:\Windows\System\SjMRPNz.exe
  C:\Windows\System\SjMRPNz.exe
  2⤵
  PID:6584
- C:\Windows\System\eEeATKo.exe
  C:\Windows\System\eEeATKo.exe
  2⤵
  PID:6612
- C:\Windows\System\wKHTcNS.exe
  C:\Windows\System\wKHTcNS.exe
  2⤵
  PID:6640
- C:\Windows\System\NWEuqxx.exe
  C:\Windows\System\NWEuqxx.exe
  2⤵
  PID:6672
- C:\Windows\System\YJgOCRc.exe
  C:\Windows\System\YJgOCRc.exe
  2⤵
  PID:6704
- C:\Windows\System\WykToTA.exe
  C:\Windows\System\WykToTA.exe
  2⤵
  PID:6732
- C:\Windows\System\inAwjMG.exe
  C:\Windows\System\inAwjMG.exe
  2⤵
  PID:6760
- C:\Windows\System\LylqLBU.exe
  C:\Windows\System\LylqLBU.exe
  2⤵
  PID:6788
- C:\Windows\System\ERvghEH.exe
  C:\Windows\System\ERvghEH.exe
  2⤵
  PID:6816
- C:\Windows\System\oZsCqwC.exe
  C:\Windows\System\oZsCqwC.exe
  2⤵
  PID:6844
- C:\Windows\System\iCtuZZx.exe
  C:\Windows\System\iCtuZZx.exe
  2⤵
  PID:6872
- C:\Windows\System\dyFfYAq.exe
  C:\Windows\System\dyFfYAq.exe
  2⤵
  PID:6900
- C:\Windows\System\zYoXNhp.exe
  C:\Windows\System\zYoXNhp.exe
  2⤵
  PID:6928
- C:\Windows\System\mZWrREa.exe
  C:\Windows\System\mZWrREa.exe
  2⤵
  PID:6948
- C:\Windows\System\WywrRPT.exe
  C:\Windows\System\WywrRPT.exe
  2⤵
  PID:6976
- C:\Windows\System\RpkFCem.exe
  C:\Windows\System\RpkFCem.exe
  2⤵
  PID:7004
- C:\Windows\System\mCpDivM.exe
  C:\Windows\System\mCpDivM.exe
  2⤵
  PID:7032
- C:\Windows\System\xligVpE.exe
  C:\Windows\System\xligVpE.exe
  2⤵
  PID:7060
- C:\Windows\System\WLDebOU.exe
  C:\Windows\System\WLDebOU.exe
  2⤵
  PID:7088
- C:\Windows\System\TmUlZtu.exe
  C:\Windows\System\TmUlZtu.exe
  2⤵
  PID:7116
- C:\Windows\System\eSFVoAd.exe
  C:\Windows\System\eSFVoAd.exe
  2⤵
  PID:7144
- C:\Windows\System\Mrbejwe.exe
  C:\Windows\System\Mrbejwe.exe
  2⤵
  PID:2444
- C:\Windows\System\hNmwjor.exe
  C:\Windows\System\hNmwjor.exe
  2⤵
  PID:5708
- C:\Windows\System\FKTrPSH.exe
  C:\Windows\System\FKTrPSH.exe
  2⤵
  PID:5844
- C:\Windows\System\iWBxlhc.exe
  C:\Windows\System\iWBxlhc.exe
  2⤵
  PID:5916
- C:\Windows\System\fKhvGCm.exe
  C:\Windows\System\fKhvGCm.exe
  2⤵
  PID:6192
- C:\Windows\System\REjcrTn.exe
  C:\Windows\System\REjcrTn.exe
  2⤵
  PID:6248
- C:\Windows\System\EDDvIdx.exe
  C:\Windows\System\EDDvIdx.exe
  2⤵
  PID:6316
- C:\Windows\System\efYQwIO.exe
  C:\Windows\System\efYQwIO.exe
  2⤵
  PID:6400
- C:\Windows\System\VlYFgkJ.exe
  C:\Windows\System\VlYFgkJ.exe
  2⤵
  PID:6432
- C:\Windows\System\YYSeyFy.exe
  C:\Windows\System\YYSeyFy.exe
  2⤵
  PID:6492
- C:\Windows\System\AEVnqeu.exe
  C:\Windows\System\AEVnqeu.exe
  2⤵
  PID:6540
- C:\Windows\System\mJPxZky.exe
  C:\Windows\System\mJPxZky.exe
  2⤵
  PID:6576
- C:\Windows\System\LyPtvcg.exe
  C:\Windows\System\LyPtvcg.exe
  2⤵
  PID:4500
- C:\Windows\System\xbSRFMw.exe
  C:\Windows\System\xbSRFMw.exe
  2⤵
  PID:396
- C:\Windows\System\UZEkunw.exe
  C:\Windows\System\UZEkunw.exe
  2⤵
  PID:6724
- C:\Windows\System\uecwOan.exe
  C:\Windows\System\uecwOan.exe
  2⤵
  PID:6836
- C:\Windows\System\AbUrTuF.exe
  C:\Windows\System\AbUrTuF.exe
  2⤵
  PID:6888
- C:\Windows\System\gVmNBuA.exe
  C:\Windows\System\gVmNBuA.exe
  2⤵
  PID:4856
- C:\Windows\System\xQGzMzC.exe
  C:\Windows\System\xQGzMzC.exe
  2⤵
  PID:4268
- C:\Windows\System\NarJRDl.exe
  C:\Windows\System\NarJRDl.exe
  2⤵
  PID:3616
- C:\Windows\System\QYxmbCy.exe
  C:\Windows\System\QYxmbCy.exe
  2⤵
  PID:6996
- C:\Windows\System\WRTYubs.exe
  C:\Windows\System\WRTYubs.exe
  2⤵
  PID:3628
- C:\Windows\System\QekWXut.exe
  C:\Windows\System\QekWXut.exe
  2⤵
  PID:7048
- C:\Windows\System\dKAJvDs.exe
  C:\Windows\System\dKAJvDs.exe
  2⤵
  PID:816
- C:\Windows\System\QgVzBCz.exe
  C:\Windows\System\QgVzBCz.exe
  2⤵
  PID:232
- C:\Windows\System\qxLaQgp.exe
  C:\Windows\System\qxLaQgp.exe
  2⤵
  PID:3676
- C:\Windows\System\QDqfdsn.exe
  C:\Windows\System\QDqfdsn.exe
  2⤵
  PID:6104
- C:\Windows\System\bXPVkLy.exe
  C:\Windows\System\bXPVkLy.exe
  2⤵
  PID:1756
- C:\Windows\System\KicIDnJ.exe
  C:\Windows\System\KicIDnJ.exe
  2⤵
  PID:5104
- C:\Windows\System\ERkvvzQ.exe
  C:\Windows\System\ERkvvzQ.exe
  2⤵
  PID:2012
- C:\Windows\System\npgjlAN.exe
  C:\Windows\System\npgjlAN.exe
  2⤵
  PID:6216
- C:\Windows\System\wqqfNyu.exe
  C:\Windows\System\wqqfNyu.exe
  2⤵
  PID:6348
- C:\Windows\System\WEegrda.exe
  C:\Windows\System\WEegrda.exe
  2⤵
  PID:6464
- C:\Windows\System\GQfRHHg.exe
  C:\Windows\System\GQfRHHg.exe
  2⤵
  PID:3276
- C:\Windows\System\NSIXczQ.exe
  C:\Windows\System\NSIXczQ.exe
  2⤵
  PID:6752
- C:\Windows\System\QsfhsGY.exe
  C:\Windows\System\QsfhsGY.exe
  2⤵
  PID:3496
- C:\Windows\System\WJgvAFb.exe
  C:\Windows\System\WJgvAFb.exe
  2⤵
  PID:6960
- C:\Windows\System\YUylagC.exe
  C:\Windows\System\YUylagC.exe
  2⤵
  PID:7052
- C:\Windows\System\OnhmVJr.exe
  C:\Windows\System\OnhmVJr.exe
  2⤵
  PID:7128
- C:\Windows\System\whHdoCc.exe
  C:\Windows\System\whHdoCc.exe
  2⤵
  PID:5248
- C:\Windows\System\vPfbqnw.exe
  C:\Windows\System\vPfbqnw.exe
  2⤵
  PID:6184
- C:\Windows\System\EqoIkTE.exe
  C:\Windows\System\EqoIkTE.exe
  2⤵
  PID:6572
- C:\Windows\System\GOisZiS.exe
  C:\Windows\System\GOisZiS.exe
  2⤵
  PID:6568
- C:\Windows\System\sMmGxDx.exe
  C:\Windows\System\sMmGxDx.exe
  2⤵
  PID:4616
- C:\Windows\System\mvzStkG.exe
  C:\Windows\System\mvzStkG.exe
  2⤵
  PID:4228
- C:\Windows\System\AuGueBr.exe
  C:\Windows\System\AuGueBr.exe
  2⤵
  PID:4600
- C:\Windows\System\HJFsHJJ.exe
  C:\Windows\System\HJFsHJJ.exe
  2⤵
  PID:1116
- C:\Windows\System\NtKISQV.exe
  C:\Windows\System\NtKISQV.exe
  2⤵
  PID:3840
- C:\Windows\System\AQtjzsg.exe
  C:\Windows\System\AQtjzsg.exe
  2⤵
  PID:7184
- C:\Windows\System\GSLgkjk.exe
  C:\Windows\System\GSLgkjk.exe
  2⤵
  PID:7212
- C:\Windows\System\wjGNehP.exe
  C:\Windows\System\wjGNehP.exe
  2⤵
  PID:7240
- C:\Windows\System\IsCATWV.exe
  C:\Windows\System\IsCATWV.exe
  2⤵
  PID:7280
- C:\Windows\System\MOYgNpk.exe
  C:\Windows\System\MOYgNpk.exe
  2⤵
  PID:7296
- C:\Windows\System\GPTuYrM.exe
  C:\Windows\System\GPTuYrM.exe
  2⤵
  PID:7324
- C:\Windows\System\bROmIxv.exe
  C:\Windows\System\bROmIxv.exe
  2⤵
  PID:7340
- C:\Windows\System\rhlBKsd.exe
  C:\Windows\System\rhlBKsd.exe
  2⤵
  PID:7392
- C:\Windows\System\mVImtJS.exe
  C:\Windows\System\mVImtJS.exe
  2⤵
  PID:7408
- C:\Windows\System\nTlkROv.exe
  C:\Windows\System\nTlkROv.exe
  2⤵
  PID:7424
- C:\Windows\System\lLskivg.exe
  C:\Windows\System\lLskivg.exe
  2⤵
  PID:7456
- C:\Windows\System\dPWaeEJ.exe
  C:\Windows\System\dPWaeEJ.exe
  2⤵
  PID:7496
- C:\Windows\System\WDsBwoE.exe
  C:\Windows\System\WDsBwoE.exe
  2⤵
  PID:7516
- C:\Windows\System\zKgBFgj.exe
  C:\Windows\System\zKgBFgj.exe
  2⤵
  PID:7536
- C:\Windows\System\JPXhUww.exe
  C:\Windows\System\JPXhUww.exe
  2⤵
  PID:7564
- C:\Windows\System\PvkshPP.exe
  C:\Windows\System\PvkshPP.exe
  2⤵
  PID:7600
- C:\Windows\System\FzgRClC.exe
  C:\Windows\System\FzgRClC.exe
  2⤵
  PID:7644
- C:\Windows\System\CzAWScc.exe
  C:\Windows\System\CzAWScc.exe
  2⤵
  PID:7664
- C:\Windows\System\kFxzhhG.exe
  C:\Windows\System\kFxzhhG.exe
  2⤵
  PID:7688
- C:\Windows\System\xwhdodQ.exe
  C:\Windows\System\xwhdodQ.exe
  2⤵
  PID:7716
- C:\Windows\System\zzfeZua.exe
  C:\Windows\System\zzfeZua.exe
  2⤵
  PID:7752
- C:\Windows\System\GxHwMUm.exe
  C:\Windows\System\GxHwMUm.exe
  2⤵
  PID:7772
- C:\Windows\System\zsbRibF.exe
  C:\Windows\System\zsbRibF.exe
  2⤵
  PID:7800
- C:\Windows\System\ANleTVi.exe
  C:\Windows\System\ANleTVi.exe
  2⤵
  PID:7840
- C:\Windows\System\DqpyCxG.exe
  C:\Windows\System\DqpyCxG.exe
  2⤵
  PID:7856
- C:\Windows\System\sxTDCTD.exe
  C:\Windows\System\sxTDCTD.exe
  2⤵
  PID:7896
- C:\Windows\System\AkBwaIV.exe
  C:\Windows\System\AkBwaIV.exe
  2⤵
  PID:7912
- C:\Windows\System\YEUSkOv.exe
  C:\Windows\System\YEUSkOv.exe
  2⤵
  PID:7948
- C:\Windows\System\TLtyNmY.exe
  C:\Windows\System\TLtyNmY.exe
  2⤵
  PID:7964
- C:\Windows\System\zsKiGjb.exe
  C:\Windows\System\zsKiGjb.exe
  2⤵
  PID:7996
- C:\Windows\System\xSaUcqO.exe
  C:\Windows\System\xSaUcqO.exe
  2⤵
  PID:8028
- C:\Windows\System\hCuqkfh.exe
  C:\Windows\System\hCuqkfh.exe
  2⤵
  PID:8052
- C:\Windows\System\DskLwXB.exe
  C:\Windows\System\DskLwXB.exe
  2⤵
  PID:8080
- C:\Windows\System\kYZJQRb.exe
  C:\Windows\System\kYZJQRb.exe
  2⤵
  PID:8108
- C:\Windows\System\ITlnqlX.exe
  C:\Windows\System\ITlnqlX.exe
  2⤵
  PID:8148
- C:\Windows\System\DeLfPvd.exe
  C:\Windows\System\DeLfPvd.exe
  2⤵
  PID:8176
- C:\Windows\System\lRBBpUN.exe
  C:\Windows\System\lRBBpUN.exe
  2⤵
  PID:6992
- C:\Windows\System\isIbzBP.exe
  C:\Windows\System\isIbzBP.exe
  2⤵
  PID:7228
- C:\Windows\System\zBqBxYG.exe
  C:\Windows\System\zBqBxYG.exe
  2⤵
  PID:7264
- C:\Windows\System\oaPihwG.exe
  C:\Windows\System\oaPihwG.exe
  2⤵
  PID:7312
- C:\Windows\System\OdDEQAq.exe
  C:\Windows\System\OdDEQAq.exe
  2⤵
  PID:7404
- C:\Windows\System\etupdat.exe
  C:\Windows\System\etupdat.exe
  2⤵
  PID:7476
- C:\Windows\System\FIBavOp.exe
  C:\Windows\System\FIBavOp.exe
  2⤵
  PID:7580
- C:\Windows\System\SuLOhDi.exe
  C:\Windows\System\SuLOhDi.exe
  2⤵
  PID:7588
- C:\Windows\System\SREXKdZ.exe
  C:\Windows\System\SREXKdZ.exe
  2⤵
  PID:7652
- C:\Windows\System\vhugMYR.exe
  C:\Windows\System\vhugMYR.exe
  2⤵
  PID:7700
- C:\Windows\System\cgoFcrt.exe
  C:\Windows\System\cgoFcrt.exe
  2⤵
  PID:7824
- C:\Windows\System\eLVSwCl.exe
  C:\Windows\System\eLVSwCl.exe
  2⤵
  PID:7904
- C:\Windows\System\DHGLUqX.exe
  C:\Windows\System\DHGLUqX.exe
  2⤵
  PID:7976
- C:\Windows\System\QSZAEwC.exe
  C:\Windows\System\QSZAEwC.exe
  2⤵
  PID:7992
- C:\Windows\System\qeSFVoZ.exe
  C:\Windows\System\qeSFVoZ.exe
  2⤵
  PID:8064
- C:\Windows\System\mjkffYd.exe
  C:\Windows\System\mjkffYd.exe
  2⤵
  PID:8136
- C:\Windows\System\qGRqWmE.exe
  C:\Windows\System\qGRqWmE.exe
  2⤵
  PID:7360
- C:\Windows\System\uYwJlBJ.exe
  C:\Windows\System\uYwJlBJ.exe
  2⤵
  PID:7368
- C:\Windows\System\ntJpWEL.exe
  C:\Windows\System\ntJpWEL.exe
  2⤵
  PID:7436
- C:\Windows\System\mFiuBKf.exe
  C:\Windows\System\mFiuBKf.exe
  2⤵
  PID:7768
- C:\Windows\System\cSxmItK.exe
  C:\Windows\System\cSxmItK.exe
  2⤵
  PID:7812
- C:\Windows\System\viDfIgw.exe
  C:\Windows\System\viDfIgw.exe
  2⤵
  PID:8040
- C:\Windows\System\auCFLst.exe
  C:\Windows\System\auCFLst.exe
  2⤵
  PID:7196
- C:\Windows\System\WuCjKZi.exe
  C:\Windows\System\WuCjKZi.exe
  2⤵
  PID:7256
- C:\Windows\System\RazGXJm.exe
  C:\Windows\System\RazGXJm.exe
  2⤵
  PID:7680
- C:\Windows\System\REjBNaM.exe
  C:\Windows\System\REjBNaM.exe
  2⤵
  PID:8072
- C:\Windows\System\rwJqFOt.exe
  C:\Windows\System\rwJqFOt.exe
  2⤵
  PID:8124
- C:\Windows\System\xFovnWX.exe
  C:\Windows\System\xFovnWX.exe
  2⤵
  PID:8208
- C:\Windows\System\WXUvlMH.exe
  C:\Windows\System\WXUvlMH.exe
  2⤵
  PID:8224
- C:\Windows\System\oEugtkg.exe
  C:\Windows\System\oEugtkg.exe
  2⤵
  PID:8264
- C:\Windows\System\NnSKEUC.exe
  C:\Windows\System\NnSKEUC.exe
  2⤵
  PID:8316
- C:\Windows\System\zgGbsPX.exe
  C:\Windows\System\zgGbsPX.exe
  2⤵
  PID:8344
- C:\Windows\System\SSkrWkk.exe
  C:\Windows\System\SSkrWkk.exe
  2⤵
  PID:8368
- C:\Windows\System\uhaRKKs.exe
  C:\Windows\System\uhaRKKs.exe
  2⤵
  PID:8388
- C:\Windows\System\XnnHcnQ.exe
  C:\Windows\System\XnnHcnQ.exe
  2⤵
  PID:8416
- C:\Windows\System\NnJYfYG.exe
  C:\Windows\System\NnJYfYG.exe
  2⤵
  PID:8444
- C:\Windows\System\mzLRvte.exe
  C:\Windows\System\mzLRvte.exe
  2⤵
  PID:8484
- C:\Windows\System\SZeaWga.exe
  C:\Windows\System\SZeaWga.exe
  2⤵
  PID:8508
- C:\Windows\System\KneiOoB.exe
  C:\Windows\System\KneiOoB.exe
  2⤵
  PID:8528
- C:\Windows\System\ctZnpNx.exe
  C:\Windows\System\ctZnpNx.exe
  2⤵
  PID:8544
- C:\Windows\System\ywGDApW.exe
  C:\Windows\System\ywGDApW.exe
  2⤵
  PID:8560
- C:\Windows\System\oIeDBLW.exe
  C:\Windows\System\oIeDBLW.exe
  2⤵
  PID:8580
- C:\Windows\System\qMFdHLv.exe
  C:\Windows\System\qMFdHLv.exe
  2⤵
  PID:8604
- C:\Windows\System\nYqRWIH.exe
  C:\Windows\System\nYqRWIH.exe
  2⤵
  PID:8628
- C:\Windows\System\Xtbrkzf.exe
  C:\Windows\System\Xtbrkzf.exe
  2⤵
  PID:8644
- C:\Windows\System\NIaqhrk.exe
  C:\Windows\System\NIaqhrk.exe
  2⤵
  PID:8668
- C:\Windows\System\DFTqJBR.exe
  C:\Windows\System\DFTqJBR.exe
  2⤵
  PID:8696
- C:\Windows\System\txzIFUA.exe
  C:\Windows\System\txzIFUA.exe
  2⤵
  PID:8752
- C:\Windows\System\RRUPSNP.exe
  C:\Windows\System\RRUPSNP.exe
  2⤵
  PID:8796
- C:\Windows\System\MMdgQKI.exe
  C:\Windows\System\MMdgQKI.exe
  2⤵
  PID:8828
- C:\Windows\System\NGrxEsK.exe
  C:\Windows\System\NGrxEsK.exe
  2⤵
  PID:8876
- C:\Windows\System\VrhFQEr.exe
  C:\Windows\System\VrhFQEr.exe
  2⤵
  PID:8892
- C:\Windows\System\NeXavZS.exe
  C:\Windows\System\NeXavZS.exe
  2⤵
  PID:8920
- C:\Windows\System\ubktufK.exe
  C:\Windows\System\ubktufK.exe
  2⤵
  PID:8952
- C:\Windows\System\Ajjhxik.exe
  C:\Windows\System\Ajjhxik.exe
  2⤵
  PID:8976
- C:\Windows\System\qdreqgc.exe
  C:\Windows\System\qdreqgc.exe
  2⤵
  PID:9004
- C:\Windows\System\RBXlgCz.exe
  C:\Windows\System\RBXlgCz.exe
  2⤵
  PID:9032
- C:\Windows\System\abYqReO.exe
  C:\Windows\System\abYqReO.exe
  2⤵
  PID:9060
- C:\Windows\System\RnZtyui.exe
  C:\Windows\System\RnZtyui.exe
  2⤵
  PID:9088
- C:\Windows\System\HOQOUVL.exe
  C:\Windows\System\HOQOUVL.exe
  2⤵
  PID:9116
- C:\Windows\System\ebpuAMA.exe
  C:\Windows\System\ebpuAMA.exe
  2⤵
  PID:9132
- C:\Windows\System\QzcGfLD.exe
  C:\Windows\System\QzcGfLD.exe
  2⤵
  PID:9164
- C:\Windows\System\knZqHOQ.exe
  C:\Windows\System\knZqHOQ.exe
  2⤵
  PID:9188
- C:\Windows\System\VjgkzaQ.exe
  C:\Windows\System\VjgkzaQ.exe
  2⤵
  PID:7524
- C:\Windows\System\wpRkbdi.exe
  C:\Windows\System\wpRkbdi.exe
  2⤵
  PID:8220
- C:\Windows\System\DeuGqAC.exe
  C:\Windows\System\DeuGqAC.exe
  2⤵
  PID:8284
- C:\Windows\System\MomqoDp.exe
  C:\Windows\System\MomqoDp.exe
  2⤵
  PID:8360
- C:\Windows\System\KqpTyMi.exe
  C:\Windows\System\KqpTyMi.exe
  2⤵
  PID:8472
- C:\Windows\System\hwjcCPU.exe
  C:\Windows\System\hwjcCPU.exe
  2⤵
  PID:8492
- C:\Windows\System\tZBVOTu.exe
  C:\Windows\System\tZBVOTu.exe
  2⤵
  PID:8588
- C:\Windows\System\SLKXcjC.exe
  C:\Windows\System\SLKXcjC.exe
  2⤵
  PID:8600
- C:\Windows\System\SwUjVMC.exe
  C:\Windows\System\SwUjVMC.exe
  2⤵
  PID:8692
- C:\Windows\System\lAAMOtd.exe
  C:\Windows\System\lAAMOtd.exe
  2⤵
  PID:8740
- C:\Windows\System\yfZrEVB.exe
  C:\Windows\System\yfZrEVB.exe
  2⤵
  PID:8816
- C:\Windows\System\lIwVkEk.exe
  C:\Windows\System\lIwVkEk.exe
  2⤵
  PID:8932
- C:\Windows\System\LtfvrIN.exe
  C:\Windows\System\LtfvrIN.exe
  2⤵
  PID:8988
- C:\Windows\System\ddEJPsv.exe
  C:\Windows\System\ddEJPsv.exe
  2⤵
  PID:9016
- C:\Windows\System\xfCYiIS.exe
  C:\Windows\System\xfCYiIS.exe
  2⤵
  PID:9100
- C:\Windows\System\ogdSYWm.exe
  C:\Windows\System\ogdSYWm.exe
  2⤵
  PID:9108
- C:\Windows\System\csvfbub.exe
  C:\Windows\System\csvfbub.exe
  2⤵
  PID:8216
- C:\Windows\System\ecCvASi.exe
  C:\Windows\System\ecCvASi.exe
  2⤵
  PID:8332
- C:\Windows\System\MqVYuCP.exe
  C:\Windows\System\MqVYuCP.exe
  2⤵
  PID:8380
- C:\Windows\System\KzthGZJ.exe
  C:\Windows\System\KzthGZJ.exe
  2⤵
  PID:8568
- C:\Windows\System\CRsslcj.exe
  C:\Windows\System\CRsslcj.exe
  2⤵
  PID:8656
- C:\Windows\System\QWsHwkQ.exe
  C:\Windows\System\QWsHwkQ.exe
  2⤵
  PID:8960
- C:\Windows\System\piqooPJ.exe
  C:\Windows\System\piqooPJ.exe
  2⤵
  PID:9104
- C:\Windows\System\vnfFUTk.exe
  C:\Windows\System\vnfFUTk.exe
  2⤵
  PID:8404
- C:\Windows\System\QSMLhHq.exe
  C:\Windows\System\QSMLhHq.exe
  2⤵
  PID:8540
- C:\Windows\System\HGqPikr.exe
  C:\Windows\System\HGqPikr.exe
  2⤵
  PID:8768
- C:\Windows\System\rkJecyw.exe
  C:\Windows\System\rkJecyw.exe
  2⤵
  PID:7988
- C:\Windows\System\ebpSUSc.exe
  C:\Windows\System\ebpSUSc.exe
  2⤵
  PID:9248
- C:\Windows\System\ctZfVZO.exe
  C:\Windows\System\ctZfVZO.exe
  2⤵
  PID:9280
- C:\Windows\System\FVUmGZj.exe
  C:\Windows\System\FVUmGZj.exe
  2⤵
  PID:9308
- C:\Windows\System\kDwCvrB.exe
  C:\Windows\System\kDwCvrB.exe
  2⤵
  PID:9340
- C:\Windows\System\nAzyIwx.exe
  C:\Windows\System\nAzyIwx.exe
  2⤵
  PID:9364
- C:\Windows\System\ADAhYNR.exe
  C:\Windows\System\ADAhYNR.exe
  2⤵
  PID:9388
- C:\Windows\System\LTQEyBS.exe
  C:\Windows\System\LTQEyBS.exe
  2⤵
  PID:9412
- C:\Windows\System\ICrHzwj.exe
  C:\Windows\System\ICrHzwj.exe
  2⤵
  PID:9476
- C:\Windows\System\mGYgNkg.exe
  C:\Windows\System\mGYgNkg.exe
  2⤵
  PID:9496
- C:\Windows\System\CexURHg.exe
  C:\Windows\System\CexURHg.exe
  2⤵
  PID:9532
- C:\Windows\System\fXDmwqK.exe
  C:\Windows\System\fXDmwqK.exe
  2⤵
  PID:9548
- C:\Windows\System\dHmVwDl.exe
  C:\Windows\System\dHmVwDl.exe
  2⤵
  PID:9576
- C:\Windows\System\kJhXIOv.exe
  C:\Windows\System\kJhXIOv.exe
  2⤵
  PID:9616
- C:\Windows\System\oqlreOY.exe
  C:\Windows\System\oqlreOY.exe
  2⤵
  PID:9632
- C:\Windows\System\olDCQxG.exe
  C:\Windows\System\olDCQxG.exe
  2⤵
  PID:9660
- C:\Windows\System\hLWAtRg.exe
  C:\Windows\System\hLWAtRg.exe
  2⤵
  PID:9680
- C:\Windows\System\xSPTrTQ.exe
  C:\Windows\System\xSPTrTQ.exe
  2⤵
  PID:9708
- C:\Windows\System\ypBecDo.exe
  C:\Windows\System\ypBecDo.exe
  2⤵
  PID:9736
- C:\Windows\System\euoBdlj.exe
  C:\Windows\System\euoBdlj.exe
  2⤵
  PID:9788
- C:\Windows\System\EefzRLA.exe
  C:\Windows\System\EefzRLA.exe
  2⤵
  PID:9804
- C:\Windows\System\MkYAToE.exe
  C:\Windows\System\MkYAToE.exe
  2⤵
  PID:9832
- C:\Windows\System\KTPCZEX.exe
  C:\Windows\System\KTPCZEX.exe
  2⤵
  PID:9856
- C:\Windows\System\FWYkySq.exe
  C:\Windows\System\FWYkySq.exe
  2⤵
  PID:9900
- C:\Windows\System\OhYLmby.exe
  C:\Windows\System\OhYLmby.exe
  2⤵
  PID:9916
- C:\Windows\System\BUTCwip.exe
  C:\Windows\System\BUTCwip.exe
  2⤵
  PID:9944
- C:\Windows\System\FmVmZpO.exe
  C:\Windows\System\FmVmZpO.exe
  2⤵
  PID:9972
- C:\Windows\System\xMMOXiF.exe
  C:\Windows\System\xMMOXiF.exe
  2⤵
  PID:9996
- C:\Windows\System\PNQEfBi.exe
  C:\Windows\System\PNQEfBi.exe
  2⤵
  PID:10040
- C:\Windows\System\lTnRvpO.exe
  C:\Windows\System\lTnRvpO.exe
  2⤵
  PID:10060
- C:\Windows\System\xsAZXSp.exe
  C:\Windows\System\xsAZXSp.exe
  2⤵
  PID:10092
- C:\Windows\System\KigIvbz.exe
  C:\Windows\System\KigIvbz.exe
  2⤵
  PID:10120
- C:\Windows\System\qEvFPwk.exe
  C:\Windows\System\qEvFPwk.exe
  2⤵
  PID:10148
- C:\Windows\System\zxqEZJH.exe
  C:\Windows\System\zxqEZJH.exe
  2⤵
  PID:10176
- C:\Windows\System\jLxjsaM.exe
  C:\Windows\System\jLxjsaM.exe
  2⤵
  PID:10204
- C:\Windows\System\VbINuFr.exe
  C:\Windows\System\VbINuFr.exe
  2⤵
  PID:10220
- C:\Windows\System\lZWQgYi.exe
  C:\Windows\System\lZWQgYi.exe
  2⤵
  PID:8992
- C:\Windows\System\EKXIWUV.exe
  C:\Windows\System\EKXIWUV.exe
  2⤵
  PID:9296
- C:\Windows\System\kLXomSM.exe
  C:\Windows\System\kLXomSM.exe
  2⤵
  PID:9336
- C:\Windows\System\XSlBeHZ.exe
  C:\Windows\System\XSlBeHZ.exe
  2⤵
  PID:9404
- C:\Windows\System\tFhLUOV.exe
  C:\Windows\System\tFhLUOV.exe
  2⤵
  PID:9484
- C:\Windows\System\wPHwPZR.exe
  C:\Windows\System\wPHwPZR.exe
  2⤵
  PID:9540
- C:\Windows\System\GmTaMZg.exe
  C:\Windows\System\GmTaMZg.exe
  2⤵
  PID:9624
- C:\Windows\System\wlwLept.exe
  C:\Windows\System\wlwLept.exe
  2⤵
  PID:9720
- C:\Windows\System\qtbHAVc.exe
  C:\Windows\System\qtbHAVc.exe
  2⤵
  PID:9700
- C:\Windows\System\QUMcXQj.exe
  C:\Windows\System\QUMcXQj.exe
  2⤵
  PID:9796
- C:\Windows\System\iYnTPld.exe
  C:\Windows\System\iYnTPld.exe
  2⤵
  PID:9844
- C:\Windows\System\yHflaoE.exe
  C:\Windows\System\yHflaoE.exe
  2⤵
  PID:9908
- C:\Windows\System\SQJaHNN.exe
  C:\Windows\System\SQJaHNN.exe
  2⤵
  PID:9984
- C:\Windows\System\HXgtkTz.exe
  C:\Windows\System\HXgtkTz.exe
  2⤵
  PID:10016
- C:\Windows\System\PGOaDsr.exe
  C:\Windows\System\PGOaDsr.exe
  2⤵
  PID:10104
- C:\Windows\System\scPrtGX.exe
  C:\Windows\System\scPrtGX.exe
  2⤵
  PID:10196
- C:\Windows\System\RRniwpr.exe
  C:\Windows\System\RRniwpr.exe
  2⤵
  PID:9256
- C:\Windows\System\qEjeywq.exe
  C:\Windows\System\qEjeywq.exe
  2⤵
  PID:8244
- C:\Windows\System\rYjzTTg.exe
  C:\Windows\System\rYjzTTg.exe
  2⤵
  PID:9524
- C:\Windows\System\MxrREUq.exe
  C:\Windows\System\MxrREUq.exe
  2⤵
  PID:9652
- C:\Windows\System\XibfVMl.exe
  C:\Windows\System\XibfVMl.exe
  2⤵
  PID:9880
- C:\Windows\System\wVovkdt.exe
  C:\Windows\System\wVovkdt.exe
  2⤵
  PID:9852
- C:\Windows\System\tVSrHAd.exe
  C:\Windows\System\tVSrHAd.exe
  2⤵
  PID:10140
- C:\Windows\System\ulJwHKx.exe
  C:\Windows\System\ulJwHKx.exe
  2⤵
  PID:10132
- C:\Windows\System\lGMSJEE.exe
  C:\Windows\System\lGMSJEE.exe
  2⤵
  PID:9604
- C:\Windows\System\wrBxvtW.exe
  C:\Windows\System\wrBxvtW.exe
  2⤵
  PID:9780
- C:\Windows\System\EoHRoRP.exe
  C:\Windows\System\EoHRoRP.exe
  2⤵
  PID:9964
- C:\Windows\System\jVVBixC.exe
  C:\Windows\System\jVVBixC.exe
  2⤵
  PID:10164
- C:\Windows\System\xaZCZXo.exe
  C:\Windows\System\xaZCZXo.exe
  2⤵
  PID:10032
- C:\Windows\System\zDBPPsM.exe
  C:\Windows\System\zDBPPsM.exe
  2⤵
  PID:10276
- C:\Windows\System\qeSNDnU.exe
  C:\Windows\System\qeSNDnU.exe
  2⤵
  PID:10320
- C:\Windows\System\pBSwuaB.exe
  C:\Windows\System\pBSwuaB.exe
  2⤵
  PID:10340
- C:\Windows\System\PySUhMo.exe
  C:\Windows\System\PySUhMo.exe
  2⤵
  PID:10368
- C:\Windows\System\igNeWIT.exe
  C:\Windows\System\igNeWIT.exe
  2⤵
  PID:10396
- C:\Windows\System\lAYfefK.exe
  C:\Windows\System\lAYfefK.exe
  2⤵
  PID:10416
- C:\Windows\System\TTnlopp.exe
  C:\Windows\System\TTnlopp.exe
  2⤵
  PID:10464
- C:\Windows\System\eMVkKrx.exe
  C:\Windows\System\eMVkKrx.exe
  2⤵
  PID:10480
- C:\Windows\System\jhsbKnB.exe
  C:\Windows\System\jhsbKnB.exe
  2⤵
  PID:10500
- C:\Windows\System\JsFtsjo.exe
  C:\Windows\System\JsFtsjo.exe
  2⤵
  PID:10528
- C:\Windows\System\FWyPweR.exe
  C:\Windows\System\FWyPweR.exe
  2⤵
  PID:10552
- C:\Windows\System\hZOpelX.exe
  C:\Windows\System\hZOpelX.exe
  2⤵
  PID:10584
- C:\Windows\System\LNOLZnE.exe
  C:\Windows\System\LNOLZnE.exe
  2⤵
  PID:10604
- C:\Windows\System\wFiziHs.exe
  C:\Windows\System\wFiziHs.exe
  2⤵
  PID:10624
- C:\Windows\System\QPcqAOj.exe
  C:\Windows\System\QPcqAOj.exe
  2⤵
  PID:10648
- C:\Windows\System\wpLwnou.exe
  C:\Windows\System\wpLwnou.exe
  2⤵
  PID:10708
- C:\Windows\System\DbgmnxO.exe
  C:\Windows\System\DbgmnxO.exe
  2⤵
  PID:10732
- C:\Windows\System\TvjJOMO.exe
  C:\Windows\System\TvjJOMO.exe
  2⤵
  PID:10764
- C:\Windows\System\tMSugPu.exe
  C:\Windows\System\tMSugPu.exe
  2⤵
  PID:10792
- C:\Windows\System\QwclOyL.exe
  C:\Windows\System\QwclOyL.exe
  2⤵
  PID:10820
- C:\Windows\System\AamyVIG.exe
  C:\Windows\System\AamyVIG.exe
  2⤵
  PID:10848
- C:\Windows\System\AXkDwkW.exe
  C:\Windows\System\AXkDwkW.exe
  2⤵
  PID:10868
- C:\Windows\System\pABrkZP.exe
  C:\Windows\System\pABrkZP.exe
  2⤵
  PID:10892
- C:\Windows\System\aMJVXRU.exe
  C:\Windows\System\aMJVXRU.exe
  2⤵
  PID:10944
- C:\Windows\System\UmCUjiF.exe
  C:\Windows\System\UmCUjiF.exe
  2⤵
  PID:10964
- C:\Windows\System\rklfzdn.exe
  C:\Windows\System\rklfzdn.exe
  2⤵
  PID:10996
- C:\Windows\System\dkZcNmF.exe
  C:\Windows\System\dkZcNmF.exe
  2⤵
  PID:11016
- C:\Windows\System\ScIAgiI.exe
  C:\Windows\System\ScIAgiI.exe
  2⤵
  PID:11044
- C:\Windows\System\TGNAzTQ.exe
  C:\Windows\System\TGNAzTQ.exe
  2⤵
  PID:11072
- C:\Windows\System\JuKAnEJ.exe
  C:\Windows\System\JuKAnEJ.exe
  2⤵
  PID:11100
- C:\Windows\System\ZTJVbbB.exe
  C:\Windows\System\ZTJVbbB.exe
  2⤵
  PID:11140
- C:\Windows\System\TTYPjnq.exe
  C:\Windows\System\TTYPjnq.exe
  2⤵
  PID:11168
- C:\Windows\System\wyMvleK.exe
  C:\Windows\System\wyMvleK.exe
  2⤵
  PID:11196
- C:\Windows\System\pjqlcZe.exe
  C:\Windows\System\pjqlcZe.exe
  2⤵
  PID:11212
- C:\Windows\System\NeFWjeF.exe
  C:\Windows\System\NeFWjeF.exe
  2⤵
  PID:11240
- C:\Windows\System\OYozYWZ.exe
  C:\Windows\System\OYozYWZ.exe
  2⤵
  PID:10256
- C:\Windows\System\VOSZMCN.exe
  C:\Windows\System\VOSZMCN.exe
  2⤵
  PID:9612
- C:\Windows\System\YJsnsyv.exe
  C:\Windows\System\YJsnsyv.exe
  2⤵
  PID:10336
- C:\Windows\System\zHwbGrx.exe
  C:\Windows\System\zHwbGrx.exe
  2⤵
  PID:10424
- C:\Windows\System\LTXoVBc.exe
  C:\Windows\System\LTXoVBc.exe
  2⤵
  PID:10472
- C:\Windows\System\jWXcfVn.exe
  C:\Windows\System\jWXcfVn.exe
  2⤵
  PID:10516
- C:\Windows\System\wPAKbJz.exe
  C:\Windows\System\wPAKbJz.exe
  2⤵
  PID:10564
- C:\Windows\System\gFzZVsW.exe
  C:\Windows\System\gFzZVsW.exe
  2⤵
  PID:10704
- C:\Windows\System\KlleuCB.exe
  C:\Windows\System\KlleuCB.exe
  2⤵
  PID:10748
- C:\Windows\System\TTkcFmU.exe
  C:\Windows\System\TTkcFmU.exe
  2⤵
  PID:10832
- C:\Windows\System\fCXSszk.exe
  C:\Windows\System\fCXSszk.exe
  2⤵
  PID:10836
- C:\Windows\System\WHmcHEI.exe
  C:\Windows\System\WHmcHEI.exe
  2⤵
  PID:10988
- C:\Windows\System\TDIAgap.exe
  C:\Windows\System\TDIAgap.exe
  2⤵
  PID:11028
- C:\Windows\System\BSbDgdp.exe
  C:\Windows\System\BSbDgdp.exe
  2⤵
  PID:11056
- C:\Windows\System\dwnhkbu.exe
  C:\Windows\System\dwnhkbu.exe
  2⤵
  PID:11092
- C:\Windows\System\LiwrykC.exe
  C:\Windows\System\LiwrykC.exe
  2⤵
  PID:11188
- C:\Windows\System\DbQYnZv.exe
  C:\Windows\System\DbQYnZv.exe
  2⤵
  PID:11252
- C:\Windows\System\quBBPWy.exe
  C:\Windows\System\quBBPWy.exe
  2⤵
  PID:10332
- C:\Windows\System\bJdWJFp.exe
  C:\Windows\System\bJdWJFp.exe
  2⤵
  PID:10548
- C:\Windows\System\grnhLkI.exe
  C:\Windows\System\grnhLkI.exe
  2⤵
  PID:10784
- C:\Windows\System\qcXoDmu.exe
  C:\Windows\System\qcXoDmu.exe
  2⤵
  PID:10952
- C:\Windows\System\YzrZuKu.exe
  C:\Windows\System\YzrZuKu.exe
  2⤵
  PID:11032
- C:\Windows\System\aZLDFTM.exe
  C:\Windows\System\aZLDFTM.exe
  2⤵
  PID:10392
- C:\Windows\System\MmcItVj.exe
  C:\Windows\System\MmcItVj.exe
  2⤵
  PID:2744
- C:\Windows\System\sGWlXfp.exe
  C:\Windows\System\sGWlXfp.exe
  2⤵
  PID:1612
- C:\Windows\System\mBivcUf.exe
  C:\Windows\System\mBivcUf.exe
  2⤵
  PID:10088
- C:\Windows\System\ghUnkHP.exe
  C:\Windows\System\ghUnkHP.exe
  2⤵
  PID:10972
- C:\Windows\System\hBYICkL.exe
  C:\Windows\System\hBYICkL.exe
  2⤵
  PID:10916
- C:\Windows\System\Uzvapow.exe
  C:\Windows\System\Uzvapow.exe
  2⤵
  PID:2100
- C:\Windows\System\rqQgbQG.exe
  C:\Windows\System\rqQgbQG.exe
  2⤵
  PID:11284
- C:\Windows\System\dqTjezn.exe
  C:\Windows\System\dqTjezn.exe
  2⤵
  PID:11312
- C:\Windows\System\iHBJUvM.exe
  C:\Windows\System\iHBJUvM.exe
  2⤵
  PID:11340
- C:\Windows\System\Ntzwckh.exe
  C:\Windows\System\Ntzwckh.exe
  2⤵
  PID:11356
- C:\Windows\System\tJaNnXJ.exe
  C:\Windows\System\tJaNnXJ.exe
  2⤵
  PID:11372
- C:\Windows\System\TPRXfhi.exe
  C:\Windows\System\TPRXfhi.exe
  2⤵
  PID:11392
- C:\Windows\System\pkWrWey.exe
  C:\Windows\System\pkWrWey.exe
  2⤵
  PID:11428
- C:\Windows\System\ctdIMhE.exe
  C:\Windows\System\ctdIMhE.exe
  2⤵
  PID:11456
- C:\Windows\System\chUXtgo.exe
  C:\Windows\System\chUXtgo.exe
  2⤵
  PID:11492
- C:\Windows\System\PyVgjqm.exe
  C:\Windows\System\PyVgjqm.exe
  2⤵
  PID:11524
- C:\Windows\System\rGOzirQ.exe
  C:\Windows\System\rGOzirQ.exe
  2⤵
  PID:11544
- C:\Windows\System\lwCaxBu.exe
  C:\Windows\System\lwCaxBu.exe
  2⤵
  PID:11572
- C:\Windows\System\SDhLcxg.exe
  C:\Windows\System\SDhLcxg.exe
  2⤵
  PID:11608
- C:\Windows\System\xShqsYa.exe
  C:\Windows\System\xShqsYa.exe
  2⤵
  PID:11648
- C:\Windows\System\gcNLmWm.exe
  C:\Windows\System\gcNLmWm.exe
  2⤵
  PID:11664
- C:\Windows\System\DdSAjrj.exe
  C:\Windows\System\DdSAjrj.exe
  2⤵
  PID:11692
- C:\Windows\System\cIlGIWi.exe
  C:\Windows\System\cIlGIWi.exe
  2⤵
  PID:11720
- C:\Windows\System\ShYZVoC.exe
  C:\Windows\System\ShYZVoC.exe
  2⤵
  PID:11736
- C:\Windows\System\UBeKGdi.exe
  C:\Windows\System\UBeKGdi.exe
  2⤵
  PID:11764
- C:\Windows\System\cagoXTj.exe
  C:\Windows\System\cagoXTj.exe
  2⤵
  PID:11804
- C:\Windows\System\qtpGUkI.exe
  C:\Windows\System\qtpGUkI.exe
  2⤵
  PID:11844
- C:\Windows\System\tCynegZ.exe
  C:\Windows\System\tCynegZ.exe
  2⤵
  PID:11860
- C:\Windows\System\fGdDuuZ.exe
  C:\Windows\System\fGdDuuZ.exe
  2⤵
  PID:11888
- C:\Windows\System\FNspvbN.exe
  C:\Windows\System\FNspvbN.exe
  2⤵
  PID:11916
- C:\Windows\System\CYxTkxT.exe
  C:\Windows\System\CYxTkxT.exe
  2⤵
  PID:11956
- C:\Windows\System\DecSFON.exe
  C:\Windows\System\DecSFON.exe
  2⤵
  PID:11972
- C:\Windows\System\pmhBaXX.exe
  C:\Windows\System\pmhBaXX.exe
  2⤵
  PID:12000
- C:\Windows\System\cysWGkv.exe
  C:\Windows\System\cysWGkv.exe
  2⤵
  PID:12028
- C:\Windows\System\JvMeqmd.exe
  C:\Windows\System\JvMeqmd.exe
  2⤵
  PID:12056
- C:\Windows\System\pSRtRuJ.exe
  C:\Windows\System\pSRtRuJ.exe
  2⤵
  PID:12072
- C:\Windows\System\bZaKzFc.exe
  C:\Windows\System\bZaKzFc.exe
  2⤵
  PID:12100
- C:\Windows\System\UxiwHuD.exe
  C:\Windows\System\UxiwHuD.exe
  2⤵
  PID:12124
- C:\Windows\System\nrNvhVX.exe
  C:\Windows\System\nrNvhVX.exe
  2⤵
  PID:12160
- C:\Windows\System\iwusVqi.exe
  C:\Windows\System\iwusVqi.exe
  2⤵
  PID:12188
- C:\Windows\System\mTzjebE.exe
  C:\Windows\System\mTzjebE.exe
  2⤵
  PID:12216
- C:\Windows\System\BzJTimD.exe
  C:\Windows\System\BzJTimD.exe
  2⤵
  PID:12240
- C:\Windows\System\mhvtgkZ.exe
  C:\Windows\System\mhvtgkZ.exe
  2⤵
  PID:11204
- C:\Windows\System\glCNYmV.exe
  C:\Windows\System\glCNYmV.exe
  2⤵
  PID:11324
- C:\Windows\System\jQHymqO.exe
  C:\Windows\System\jQHymqO.exe
  2⤵
  PID:11368
- C:\Windows\System\yrGgQoa.exe
  C:\Windows\System\yrGgQoa.exe
  2⤵
  PID:11408
- C:\Windows\System\RVHkDLK.exe
  C:\Windows\System\RVHkDLK.exe
  2⤵
  PID:11516
- C:\Windows\System\qzWDzfP.exe
  C:\Windows\System\qzWDzfP.exe
  2⤵
  PID:11552
- C:\Windows\System\teoTLDj.exe
  C:\Windows\System\teoTLDj.exe
  2⤵
  PID:11592
- C:\Windows\System\xFmJOZP.exe
  C:\Windows\System\xFmJOZP.exe
  2⤵
  PID:11656
- C:\Windows\System\foZXJwY.exe
  C:\Windows\System\foZXJwY.exe
  2⤵
  PID:11748
- C:\Windows\System\ICNBwYX.exe
  C:\Windows\System\ICNBwYX.exe
  2⤵
  PID:11836
- C:\Windows\System\dXRgtnC.exe
  C:\Windows\System\dXRgtnC.exe
  2⤵
  PID:11928
- C:\Windows\System\IQAFIfc.exe
  C:\Windows\System\IQAFIfc.exe
  2⤵
  PID:12012
- C:\Windows\System\xmSBmID.exe
  C:\Windows\System\xmSBmID.exe
  2⤵
  PID:11992
- C:\Windows\System\KeZBinX.exe
  C:\Windows\System\KeZBinX.exe
  2⤵
  PID:12092
- C:\Windows\System\LxnKhuB.exe
  C:\Windows\System\LxnKhuB.exe
  2⤵
  PID:12148
- C:\Windows\System\ENoMPLf.exe
  C:\Windows\System\ENoMPLf.exe
  2⤵
  PID:12224
- C:\Windows\System\NWSraba.exe
  C:\Windows\System\NWSraba.exe
  2⤵
  PID:12284
- C:\Windows\System\DtAkKrB.exe
  C:\Windows\System\DtAkKrB.exe
  2⤵
  PID:11436
- C:\Windows\System\vVqhsuP.exe
  C:\Windows\System\vVqhsuP.exe
  2⤵
  PID:11564
- C:\Windows\System\uMEtAEn.exe
  C:\Windows\System\uMEtAEn.exe
  2⤵
  PID:11700
- C:\Windows\System\PiyFlKx.exe
  C:\Windows\System\PiyFlKx.exe
  2⤵
  PID:11908
- C:\Windows\System\aOMUEXR.exe
  C:\Windows\System\aOMUEXR.exe
  2⤵
  PID:11880
- C:\Windows\System\vhULJQD.exe
  C:\Windows\System\vhULJQD.exe
  2⤵
  PID:12068
- C:\Windows\System\xbTdWMH.exe
  C:\Windows\System\xbTdWMH.exe
  2⤵
  PID:11364
- C:\Windows\System\htAthit.exe
  C:\Windows\System\htAthit.exe
  2⤵
  PID:11304
- C:\Windows\System\QcisEpy.exe
  C:\Windows\System\QcisEpy.exe
  2⤵
  PID:11792
- C:\Windows\System\SYjUPhl.exe
  C:\Windows\System\SYjUPhl.exe
  2⤵
  PID:12064
- C:\Windows\System\bdCUsxH.exe
  C:\Windows\System\bdCUsxH.exe
  2⤵
  PID:11904
- C:\Windows\System\eqHHDWF.exe
  C:\Windows\System\eqHHDWF.exe
  2⤵
  PID:12312
- C:\Windows\System\Yfbbmlb.exe
  C:\Windows\System\Yfbbmlb.exe
  2⤵
  PID:12340
- C:\Windows\System\DPaxpAt.exe
  C:\Windows\System\DPaxpAt.exe
  2⤵
  PID:12368
- C:\Windows\System\mYplMRn.exe
  C:\Windows\System\mYplMRn.exe
  2⤵
  PID:12392
- C:\Windows\System\pZnffbX.exe
  C:\Windows\System\pZnffbX.exe
  2⤵
  PID:12428
- C:\Windows\System\JcEbOrn.exe
  C:\Windows\System\JcEbOrn.exe
  2⤵
  PID:12484
- C:\Windows\System\qFVrcep.exe
  C:\Windows\System\qFVrcep.exe
  2⤵
  PID:12504
- C:\Windows\System\TkPnUAS.exe
  C:\Windows\System\TkPnUAS.exe
  2⤵
  PID:12536
- C:\Windows\System\GwbQzLo.exe
  C:\Windows\System\GwbQzLo.exe
  2⤵
  PID:12560
- C:\Windows\System\UJgPXHS.exe
  C:\Windows\System\UJgPXHS.exe
  2⤵
  PID:12588
- C:\Windows\System\SJrFDsD.exe
  C:\Windows\System\SJrFDsD.exe
  2⤵
  PID:12616
- C:\Windows\System\zemwUDj.exe
  C:\Windows\System\zemwUDj.exe
  2⤵
  PID:12644
- C:\Windows\System\xXxBCzF.exe
  C:\Windows\System\xXxBCzF.exe
  2⤵
  PID:12672
- C:\Windows\System\viuoBSl.exe
  C:\Windows\System\viuoBSl.exe
  2⤵
  PID:12696
- C:\Windows\System\eShqMnf.exe
  C:\Windows\System\eShqMnf.exe
  2⤵
  PID:12728
- C:\Windows\System\WvTGCqc.exe
  C:\Windows\System\WvTGCqc.exe
  2⤵
  PID:12768
- C:\Windows\System\jaKICwg.exe
  C:\Windows\System\jaKICwg.exe
  2⤵
  PID:12784
- C:\Windows\System\cehiFxI.exe
  C:\Windows\System\cehiFxI.exe
  2⤵
  PID:12812
- C:\Windows\System\YfMpOvI.exe
  C:\Windows\System\YfMpOvI.exe
  2⤵
  PID:12840
- C:\Windows\System\CAsotiA.exe
  C:\Windows\System\CAsotiA.exe
  2⤵
  PID:12856
- C:\Windows\System\YSvijoN.exe
  C:\Windows\System\YSvijoN.exe
  2⤵
  PID:12900
- C:\Windows\System\gzHfmkD.exe
  C:\Windows\System\gzHfmkD.exe
  2⤵
  PID:12916
- C:\Windows\System\nYkEhVN.exe
  C:\Windows\System\nYkEhVN.exe
  2⤵
  PID:12948
- C:\Windows\System\Gpkixll.exe
  C:\Windows\System\Gpkixll.exe
  2⤵
  PID:12968
- C:\Windows\System\vXrjJZb.exe
  C:\Windows\System\vXrjJZb.exe
  2⤵
  PID:13020
- C:\Windows\System\PxfuEmF.exe
  C:\Windows\System\PxfuEmF.exe
  2⤵
  PID:13048
- C:\Windows\System\mGpmVoi.exe
  C:\Windows\System\mGpmVoi.exe
  2⤵
  PID:13076
- C:\Windows\System\hoDplkE.exe
  C:\Windows\System\hoDplkE.exe
  2⤵
  PID:13096
- C:\Windows\System\MiNkAhS.exe
  C:\Windows\System\MiNkAhS.exe
  2⤵
  PID:13132
- C:\Windows\System\aTfGJgY.exe
  C:\Windows\System\aTfGJgY.exe
  2⤵
  PID:13160
- C:\Windows\System\QfyBReV.exe
  C:\Windows\System\QfyBReV.exe
  2⤵
  PID:13188
- C:\Windows\System\xALwYBE.exe
  C:\Windows\System\xALwYBE.exe
  2⤵
  PID:13216
- C:\Windows\System\lxNZuqR.exe
  C:\Windows\System\lxNZuqR.exe
  2⤵
  PID:13244
- C:\Windows\System\StmsvJb.exe
  C:\Windows\System\StmsvJb.exe
  2⤵
  PID:13260
- C:\Windows\System\sXnjYQd.exe
  C:\Windows\System\sXnjYQd.exe
  2⤵
  PID:13292
- C:\Windows\System\DSCdMha.exe
  C:\Windows\System\DSCdMha.exe
  2⤵
  PID:12120
- C:\Windows\System\BimZcWY.exe
  C:\Windows\System\BimZcWY.exe
  2⤵
  PID:12200
- C:\Windows\System\kgtWnaL.exe
  C:\Windows\System\kgtWnaL.exe
  2⤵
  PID:12376
- C:\Windows\System\BdJmTPq.exe
  C:\Windows\System\BdJmTPq.exe
  2⤵
  PID:12468
- C:\Windows\System\ZNOSWLT.exe
  C:\Windows\System\ZNOSWLT.exe
  2⤵
  PID:12524
- C:\Windows\System\BtSRBbk.exe
  C:\Windows\System\BtSRBbk.exe
  2⤵
  PID:12628
- C:\Windows\System\qgWRLze.exe
  C:\Windows\System\qgWRLze.exe
  2⤵
  PID:12660
- C:\Windows\System\KuCnTes.exe
  C:\Windows\System\KuCnTes.exe
  2⤵
  PID:12720
- C:\Windows\System\mOcetqm.exe
  C:\Windows\System\mOcetqm.exe
  2⤵
  PID:12776
- C:\Windows\System\LUIZtBt.exe
  C:\Windows\System\LUIZtBt.exe
  2⤵
  PID:12832
- C:\Windows\System\awBGLlV.exe
  C:\Windows\System\awBGLlV.exe
  2⤵
  PID:12892
- C:\Windows\System\OyrVrXx.exe
  C:\Windows\System\OyrVrXx.exe
  2⤵
  PID:12984
- C:\Windows\System\ijZBelv.exe
  C:\Windows\System\ijZBelv.exe
  2⤵
  PID:13060
- C:\Windows\System\vJJxgik.exe
  C:\Windows\System\vJJxgik.exe
  2⤵
  PID:13124
- C:\Windows\System\xParAWi.exe
  C:\Windows\System\xParAWi.exe
  2⤵
  PID:13200
- C:\Windows\System\wTTRSIA.exe
  C:\Windows\System\wTTRSIA.exe
  2⤵
  PID:13252
- C:\Windows\System\vLokzHW.exe
  C:\Windows\System\vLokzHW.exe
  2⤵
  PID:13300
- C:\Windows\System\WdUckCh.exe
  C:\Windows\System\WdUckCh.exe
  2⤵
  PID:12384
- C:\Windows\System\UjGNJhV.exe
  C:\Windows\System\UjGNJhV.exe
  2⤵
  PID:12516
- C:\Windows\System\lrWXRSo.exe
  C:\Windows\System\lrWXRSo.exe
  2⤵
  PID:12636
- C:\Windows\System\fzLogqc.exe
  C:\Windows\System\fzLogqc.exe
  2⤵
  PID:12800
- C:\Windows\System\RswFgbC.exe
  C:\Windows\System\RswFgbC.exe
  2⤵
  PID:12932
- C:\Windows\System\JHtrvas.exe
  C:\Windows\System\JHtrvas.exe
  2⤵
  PID:13084
- C:\Windows\System\aryuonY.exe
  C:\Windows\System\aryuonY.exe
  2⤵
  PID:13228
- C:\Windows\System\xLYGpQb.exe
  C:\Windows\System\xLYGpQb.exe
  2⤵
  PID:12420
- C:\Windows\System\QbLKXJW.exe
  C:\Windows\System\QbLKXJW.exe
  2⤵
  PID:12740
- C:\Windows\System\ysWNeIG.exe
  C:\Windows\System\ysWNeIG.exe
  2⤵
  PID:12908
- C:\Windows\System\OMpOwwQ.exe
  C:\Windows\System\OMpOwwQ.exe
  2⤵
  PID:13272
- C:\Windows\System\jmjilTC.exe
  C:\Windows\System\jmjilTC.exe
  2⤵
  PID:12580
- C:\Windows\System\rFpoQKC.exe
  C:\Windows\System\rFpoQKC.exe
  2⤵
  PID:13344
- C:\Windows\System\JYTcuhB.exe
  C:\Windows\System\JYTcuhB.exe
  2⤵
  PID:13400
- C:\Windows\System\ptZgMWf.exe
  C:\Windows\System\ptZgMWf.exe
  2⤵
  PID:13424
- C:\Windows\System\JDtjgxH.exe
  C:\Windows\System\JDtjgxH.exe
  2⤵
  PID:13460
- C:\Windows\System\BDLgiTs.exe
  C:\Windows\System\BDLgiTs.exe
  2⤵
  PID:13488
- C:\Windows\System\NcFakln.exe
  C:\Windows\System\NcFakln.exe
  2⤵
  PID:13508
- C:\Windows\System\JWzQMUF.exe
  C:\Windows\System\JWzQMUF.exe
  2⤵
  PID:13532
- C:\Windows\System\nBKacbv.exe
  C:\Windows\System\nBKacbv.exe
  2⤵
  PID:13556
- C:\Windows\System\kDPafAG.exe
  C:\Windows\System\kDPafAG.exe
  2⤵
  PID:13580
- C:\Windows\System\fvaETir.exe
  C:\Windows\System\fvaETir.exe
  2⤵
  PID:13616
- C:\Windows\System\uCyvzpp.exe
  C:\Windows\System\uCyvzpp.exe
  2⤵
  PID:13656
- C:\Windows\System\IkFYxjp.exe
  C:\Windows\System\IkFYxjp.exe
  2⤵
  PID:13684
- C:\Windows\System\CWLjGIE.exe
  C:\Windows\System\CWLjGIE.exe
  2⤵
  PID:13712
- C:\Windows\System\lvtwdrX.exe
  C:\Windows\System\lvtwdrX.exe
  2⤵
  PID:13728
- C:\Windows\System\GAtWuPp.exe
  C:\Windows\System\GAtWuPp.exe
  2⤵
  PID:13756
- C:\Windows\System\GDVIQml.exe
  C:\Windows\System\GDVIQml.exe
  2⤵
  PID:13792
- C:\Windows\System\lQDuAtj.exe
  C:\Windows\System\lQDuAtj.exe
  2⤵
  PID:13812
- C:\Windows\System\BMOIxRk.exe
  C:\Windows\System\BMOIxRk.exe
  2⤵
  PID:13840
- C:\Windows\System\hobHFuf.exe
  C:\Windows\System\hobHFuf.exe
  2⤵
  PID:13868
- C:\Windows\System\XWIBQbU.exe
  C:\Windows\System\XWIBQbU.exe
  2⤵
  PID:13888
- C:\Windows\System\uiKhMsa.exe
  C:\Windows\System\uiKhMsa.exe
  2⤵
  PID:13912
- C:\Windows\System\jBZdNMd.exe
  C:\Windows\System\jBZdNMd.exe
  2⤵
  PID:13940
- C:\Windows\System\OivWYGr.exe
  C:\Windows\System\OivWYGr.exe
  2⤵
  PID:13968
- C:\Windows\System\bepNiLG.exe
  C:\Windows\System\bepNiLG.exe
  2⤵
  PID:13988
- C:\Windows\System\adJAOIQ.exe
  C:\Windows\System\adJAOIQ.exe
  2⤵
  PID:14004
- C:\Windows\System\RjOfEvW.exe
  C:\Windows\System\RjOfEvW.exe
  2⤵
  PID:14048
- C:\Windows\System\sIAmvVY.exe
  C:\Windows\System\sIAmvVY.exe
  2⤵
  PID:14084
- C:\Windows\System\sXKMgnj.exe
  C:\Windows\System\sXKMgnj.exe
  2⤵
  PID:14116
- C:\Windows\System\XXTAcIH.exe
  C:\Windows\System\XXTAcIH.exe
  2⤵
  PID:14140
- C:\Windows\System\XHuxJrD.exe
  C:\Windows\System\XHuxJrD.exe
  2⤵
  PID:14188
- C:\Windows\System\ntuZqUP.exe
  C:\Windows\System\ntuZqUP.exe
  2⤵
  PID:14216
- C:\Windows\System\EyMrVBF.exe
  C:\Windows\System\EyMrVBF.exe
  2⤵
  PID:14232
- C:\Windows\System\dTaEHBt.exe
  C:\Windows\System\dTaEHBt.exe
  2⤵
  PID:14288
- C:\Windows\System\laSRqaO.exe
  C:\Windows\System\laSRqaO.exe
  2⤵
  PID:14304
- C:\Windows\System\WIUStJf.exe
  C:\Windows\System\WIUStJf.exe
  2⤵
  PID:12896
- C:\Windows\System\TafQOVK.exe
  C:\Windows\System\TafQOVK.exe
  2⤵
  PID:13236
- C:\Windows\System\HdKzBIb.exe
  C:\Windows\System\HdKzBIb.exe
  2⤵
  PID:13396
- C:\Windows\System\SoXiUvF.exe
  C:\Windows\System\SoXiUvF.exe
  2⤵
  PID:13448
- C:\Windows\System\uKzgNND.exe
  C:\Windows\System\uKzgNND.exe
  2⤵
  PID:13472
- C:\Windows\System\FxkMGmd.exe
  C:\Windows\System\FxkMGmd.exe
  2⤵
  PID:13552
- C:\Windows\System\XgVQGZS.exe
  C:\Windows\System\XgVQGZS.exe
  2⤵
  PID:13596
- C:\Windows\System\oIPMENB.exe
  C:\Windows\System\oIPMENB.exe
  2⤵
  PID:13704
- C:\Windows\System\UkabSlY.exe
  C:\Windows\System\UkabSlY.exe
  2⤵
  PID:13768
- C:\Windows\System\WqkoOpH.exe
  C:\Windows\System\WqkoOpH.exe
  2⤵
  PID:3948
- C:\Windows\System\HeBWzrc.exe
  C:\Windows\System\HeBWzrc.exe
  2⤵
  PID:13908
- C:\Windows\System\JtKzMrH.exe
  C:\Windows\System\JtKzMrH.exe
  2⤵
  PID:13936
- C:\Windows\System\GuFjaiu.exe
  C:\Windows\System\GuFjaiu.exe
  2⤵
  PID:14044
- C:\Windows\System\gQswPqm.exe
  C:\Windows\System\gQswPqm.exe
  2⤵
  PID:14068
- C:\Windows\System\NBTyaZa.exe
  C:\Windows\System\NBTyaZa.exe
  2⤵
  PID:14196
- C:\Windows\System\URSpCKS.exe
  C:\Windows\System\URSpCKS.exe
  2⤵
  PID:14260
- C:\Windows\System\hjRDPjK.exe
  C:\Windows\System\hjRDPjK.exe
  2⤵
  PID:14276
- C:\Windows\System\NKAKnFu.exe
  C:\Windows\System\NKAKnFu.exe
  2⤵
  PID:14316
- C:\Windows\System\rFAMgYE.exe
  C:\Windows\System\rFAMgYE.exe
  2⤵
  PID:13368
- C:\Windows\System\iLApMoh.exe
  C:\Windows\System\iLApMoh.exe
  2⤵
  PID:13568
- C:\Windows\System\GJhtbVa.exe
  C:\Windows\System\GJhtbVa.exe
  2⤵
  PID:13676
- C:\Windows\System\ccLTqYw.exe
  C:\Windows\System\ccLTqYw.exe
  2⤵
  PID:13832
- C:\Windows\System\tPKzYfI.exe
  C:\Windows\System\tPKzYfI.exe
  2⤵
  PID:13964
- C:\Windows\System\ebdynOo.exe
  C:\Windows\System\ebdynOo.exe
  2⤵
  PID:14104
- C:\Windows\System\SqprRWM.exe
  C:\Windows\System\SqprRWM.exe
  2⤵
  PID:14148
- C:\Windows\System\coxgsuE.exe
  C:\Windows\System\coxgsuE.exe
  2⤵
  PID:14228
- C:\Windows\System\DHkSZge.exe
  C:\Windows\System\DHkSZge.exe
  2⤵
  PID:13476
- C:\Windows\System\PzwwaKU.exe
  C:\Windows\System\PzwwaKU.exe
  2⤵
  PID:13804
- C:\Windows\System\JUqQKxC.exe
  C:\Windows\System\JUqQKxC.exe
  2⤵
  PID:14160
- C:\Windows\System\AgaXMsQ.exe
  C:\Windows\System\AgaXMsQ.exe
  2⤵
  PID:14352
- C:\Windows\System\fZflGEV.exe
  C:\Windows\System\fZflGEV.exe
  2⤵
  PID:14376
- C:\Windows\System\tJnhiLp.exe
  C:\Windows\System\tJnhiLp.exe
  2⤵
  PID:14396
- C:\Windows\System\HWhbqPg.exe
  C:\Windows\System\HWhbqPg.exe
  2⤵
  PID:14412
- C:\Windows\System\bSOuVuc.exe
  C:\Windows\System\bSOuVuc.exe
  2⤵
  PID:14436
- C:\Windows\System\TfYkDQZ.exe
  C:\Windows\System\TfYkDQZ.exe
  2⤵
  PID:14480
- C:\Windows\System\YZrQpbK.exe
  C:\Windows\System\YZrQpbK.exe
  2⤵
  PID:14496
- C:\Windows\System\zntSrUP.exe
  C:\Windows\System\zntSrUP.exe
  2⤵
  PID:14540
- C:\Windows\System\MQbftic.exe
  C:\Windows\System\MQbftic.exe
  2⤵
  PID:14564
- C:\Windows\System\gjptPjV.exe
  C:\Windows\System\gjptPjV.exe
  2⤵
  PID:14592
- C:\Windows\System\ZuMmgwu.exe
  C:\Windows\System\ZuMmgwu.exe
  2⤵
  PID:14612
- C:\Windows\System\CRPBZyL.exe
  C:\Windows\System\CRPBZyL.exe
  2⤵
  PID:14640
- C:\Windows\System\DrXIBxh.exe
  C:\Windows\System\DrXIBxh.exe
  2⤵
  PID:14676
- C:\Windows\System\fPLsRWI.exe
  C:\Windows\System\fPLsRWI.exe
  2⤵
  PID:14716
- C:\Windows\System\IyZVzxp.exe
  C:\Windows\System\IyZVzxp.exe
  2⤵
  PID:14736
- C:\Windows\System\FSpOVxN.exe
  C:\Windows\System\FSpOVxN.exe
  2⤵
  PID:14768
- C:\Windows\System\HVxcQtJ.exe
  C:\Windows\System\HVxcQtJ.exe
  2⤵
  PID:14788
- C:\Windows\System\aWeeDAk.exe
  C:\Windows\System\aWeeDAk.exe
  2⤵
  PID:14816
- C:\Windows\System\xyefiHN.exe
  C:\Windows\System\xyefiHN.exe
  2⤵
  PID:14832
- C:\Windows\System\HXroHcN.exe
  C:\Windows\System\HXroHcN.exe
  2⤵
  PID:14856
- C:\Windows\System\aBXszKB.exe
  C:\Windows\System\aBXszKB.exe
  2⤵
  PID:14900
- C:\Windows\System\iUuzgUj.exe
  C:\Windows\System\iUuzgUj.exe
  2⤵
  PID:14936
- C:\Windows\System\TqsLiky.exe
  C:\Windows\System\TqsLiky.exe
  2⤵
  PID:14964
- C:\Windows\System\IEWRseO.exe
  C:\Windows\System\IEWRseO.exe
  2⤵
  PID:14988
- C:\Windows\System\EmlzZhK.exe
  C:\Windows\System\EmlzZhK.exe
  2⤵
  PID:15012
- C:\Windows\System\XQnrwJr.exe
  C:\Windows\System\XQnrwJr.exe
  2⤵
  PID:15036
- C:\Windows\System\pqwJcDN.exe
  C:\Windows\System\pqwJcDN.exe
  2⤵
  PID:15076
- C:\Windows\System\GhItADO.exe
  C:\Windows\System\GhItADO.exe
  2⤵
  PID:15096
- C:\Windows\System\uttxMEv.exe
  C:\Windows\System\uttxMEv.exe
  2⤵
  PID:15136
- C:\Windows\System\wirMnjn.exe
  C:\Windows\System\wirMnjn.exe
  2⤵
  PID:15160
- C:\Windows\System\KVuAfFS.exe
  C:\Windows\System\KVuAfFS.exe
  2⤵
  PID:15180
- C:\Windows\System\pvOKNUA.exe
  C:\Windows\System\pvOKNUA.exe
  2⤵
  PID:15208
- C:\Windows\System\fBUqsEh.exe
  C:\Windows\System\fBUqsEh.exe
  2⤵
  PID:15236
- C:\Windows\System\FVCHBbS.exe
  C:\Windows\System\FVCHBbS.exe
  2⤵
  PID:15252
- C:\Windows\System\ibxAxNa.exe
  C:\Windows\System\ibxAxNa.exe
  2⤵
  PID:15288
- C:\Windows\System\MvEMATY.exe
  C:\Windows\System\MvEMATY.exe
  2⤵
  PID:15316
- C:\Windows\System\iFHjaAx.exe
  C:\Windows\System\iFHjaAx.exe
  2⤵
  PID:15340
- C:\Windows\System\naYZuul.exe
  C:\Windows\System\naYZuul.exe
  2⤵
  PID:14368
- C:\Windows\System\YvOeUbC.exe
  C:\Windows\System\YvOeUbC.exe
  2⤵
  PID:14404
- C:\Windows\System\lXBKDyF.exe
  C:\Windows\System\lXBKDyF.exe
  2⤵
  PID:14464
- C:\Windows\System\iDgCZtK.exe
  C:\Windows\System\iDgCZtK.exe
  2⤵
  PID:14512
- C:\Windows\System\ZEIQNSX.exe
  C:\Windows\System\ZEIQNSX.exe
  2⤵
  PID:14560
- C:\Windows\System\qRjhBeT.exe
  C:\Windows\System\qRjhBeT.exe
  2⤵
  PID:14656
- C:\Windows\System\fMcNPhD.exe
  C:\Windows\System\fMcNPhD.exe
  2⤵
  PID:14764
- C:\Windows\System\BzVvjiS.exe
  C:\Windows\System\BzVvjiS.exe
  2⤵
  PID:14800
- C:\Windows\System\IdQXvVf.exe
  C:\Windows\System\IdQXvVf.exe
  2⤵
  PID:14852
- C:\Windows\System\InRyLwp.exe
  C:\Windows\System\InRyLwp.exe
  2⤵
  PID:14952
- C:\Windows\System\YOSnhDd.exe
  C:\Windows\System\YOSnhDd.exe
  2⤵
  PID:14984
- C:\Windows\System\vTxCvDs.exe
  C:\Windows\System\vTxCvDs.exe
  2⤵
  PID:15084
- C:\Windows\System\gxBklnu.exe
  C:\Windows\System\gxBklnu.exe
  2⤵
  PID:15120
- C:\Windows\System\MrrttVU.exe
  C:\Windows\System\MrrttVU.exe
  2⤵
  PID:15176
- C:\Windows\System\LxZYatA.exe
  C:\Windows\System\LxZYatA.exe
  2⤵
  PID:15200
- C:\Windows\System\OkrttFE.exe
  C:\Windows\System\OkrttFE.exe
  2⤵
  PID:15300
- C:\Windows\System\UsZUDaD.exe
  C:\Windows\System\UsZUDaD.exe
  2⤵
  PID:15352
- C:\Windows\System\IlpcwKQ.exe
  C:\Windows\System\IlpcwKQ.exe
  2⤵
  PID:14424
- C:\Windows\System\RXfttNG.exe
  C:\Windows\System\RXfttNG.exe
  2⤵
  PID:14652
- C:\Windows\System\OiOxnWw.exe
  C:\Windows\System\OiOxnWw.exe
  2⤵
  PID:14928
- C:\Windows\System\kJcKMJA.exe
  C:\Windows\System\kJcKMJA.exe
  2⤵
  PID:14976
- C:\Windows\System\mIxnPhG.exe
  C:\Windows\System\mIxnPhG.exe
  2⤵
  PID:15108
- C:\Windows\System\zAmTZef.exe
  C:\Windows\System\zAmTZef.exe
  2⤵
  PID:14408
- C:\Windows\System\VwyYUxr.exe
  C:\Windows\System\VwyYUxr.exe
  2⤵
  PID:13884
- C:\Windows\System\YJHRlTW.exe
  C:\Windows\System\YJHRlTW.exe
  2⤵
  PID:15024
- C:\Windows\System\GEYOWVX.exe
  C:\Windows\System\GEYOWVX.exe
  2⤵
  PID:14492
- C:\Windows\System\eMYwVBN.exe
  C:\Windows\System\eMYwVBN.exe
  2⤵
  PID:15332
- C:\Windows\System\dVuLHhS.exe
  C:\Windows\System\dVuLHhS.exe
  2⤵
  PID:15368
- C:\Windows\System\apdrUBR.exe
  C:\Windows\System\apdrUBR.exe
  2⤵
  PID:15384
- C:\Windows\System\omusQoq.exe
  C:\Windows\System\omusQoq.exe
  2⤵
  PID:15408
- C:\Windows\System\iAXdPph.exe
  C:\Windows\System\iAXdPph.exe
  2⤵
  PID:15440
- C:\Windows\System\rSmjPyg.exe
  C:\Windows\System\rSmjPyg.exe
  2⤵
  PID:15468
- C:\Windows\System\cGTfSUd.exe
  C:\Windows\System\cGTfSUd.exe
  2⤵
  PID:15496
- C:\Windows\System\hNTdIOd.exe
  C:\Windows\System\hNTdIOd.exe
  2⤵
  PID:15528
- C:\Windows\System\ghPdcCG.exe
  C:\Windows\System\ghPdcCG.exe
  2⤵
  PID:15548
- C:\Windows\System\NeigueZ.exe
  C:\Windows\System\NeigueZ.exe
  2⤵
  PID:15592
- C:\Windows\System\yXEdoRf.exe
  C:\Windows\System\yXEdoRf.exe
  2⤵
  PID:15608
- C:\Windows\System\ShORGzC.exe
  C:\Windows\System\ShORGzC.exe
  2⤵
  PID:15640
- C:\Windows\System\bKdJRMR.exe
  C:\Windows\System\bKdJRMR.exe
  2⤵
  PID:15676
- C:\Windows\System\RCZOXlq.exe
  C:\Windows\System\RCZOXlq.exe
  2⤵
  PID:15692
- C:\Windows\System\QpgzLJX.exe
  C:\Windows\System\QpgzLJX.exe
  2⤵
  PID:15744
- C:\Windows\System\ssfYkSe.exe
  C:\Windows\System\ssfYkSe.exe
  2⤵
  PID:15760
- C:\Windows\System\LcAoptO.exe
  C:\Windows\System\LcAoptO.exe
  2⤵
  PID:15784
- C:\Windows\System\IufInxN.exe
  C:\Windows\System\IufInxN.exe
  2⤵
  PID:15832
- C:\Windows\System\FEyKiZD.exe
  C:\Windows\System\FEyKiZD.exe
  2⤵
  PID:15848
- C:\Windows\System\LBjTkio.exe
  C:\Windows\System\LBjTkio.exe
  2⤵
  PID:15872
- C:\Windows\System\NMSJXzf.exe
  C:\Windows\System\NMSJXzf.exe
  2⤵
  PID:15892
- C:\Windows\System\ovOjGDj.exe
  C:\Windows\System\ovOjGDj.exe
  2⤵
  PID:15920
- C:\Windows\System\izskiJz.exe
  C:\Windows\System\izskiJz.exe
  2⤵
  PID:15972
- C:\Windows\System\IWeIyRb.exe
  C:\Windows\System\IWeIyRb.exe
  2⤵
  PID:15992
- C:\Windows\System\ADYBxjP.exe
  C:\Windows\System\ADYBxjP.exe
  2⤵
  PID:16040
- C:\Windows\System\ekWlfHS.exe
  C:\Windows\System\ekWlfHS.exe
  2⤵
  PID:16056
- C:\Windows\System\zrAmzkk.exe
  C:\Windows\System\zrAmzkk.exe
  2⤵
  PID:16084
- C:\Windows\System\MBOghpO.exe
  C:\Windows\System\MBOghpO.exe
  2⤵
  PID:16112
- C:\Windows\System\ZbKLMEP.exe
  C:\Windows\System\ZbKLMEP.exe
  2⤵
  PID:16132
- C:\Windows\System\nMvLdXV.exe
  C:\Windows\System\nMvLdXV.exe
  2⤵
  PID:16156
- C:\Windows\System\wPNagCj.exe
  C:\Windows\System\wPNagCj.exe
  2⤵
  PID:16184
- C:\Windows\System\UVUerwQ.exe
  C:\Windows\System\UVUerwQ.exe
  2⤵
  PID:16212
- C:\Windows\System\xFJIsTR.exe
  C:\Windows\System\xFJIsTR.exe
  2⤵
  PID:16252
- C:\Windows\System\OHVLhod.exe
  C:\Windows\System\OHVLhod.exe
  2⤵
  PID:16280
- C:\Windows\System\ufNYYOp.exe
  C:\Windows\System\ufNYYOp.exe
  2⤵
  PID:16296
- C:\Windows\System\CcMTUHt.exe
  C:\Windows\System\CcMTUHt.exe
  2⤵
  PID:16324
- C:\Windows\System\YxENCxo.exe
  C:\Windows\System\YxENCxo.exe
  2⤵
  PID:16344
- C:\Windows\System\kFbAtdd.exe
  C:\Windows\System\kFbAtdd.exe
  2⤵
  PID:16364
- C:\Windows\System\XawetJE.exe
  C:\Windows\System\XawetJE.exe
  2⤵
  PID:15416
- C:\Windows\System\yTOQHPz.exe
  C:\Windows\System\yTOQHPz.exe
  2⤵
  PID:15484
- C:\Windows\System\zJyWqNe.exe
  C:\Windows\System\zJyWqNe.exe
  2⤵
  PID:15564
- C:\Windows\System\kwVibce.exe
  C:\Windows\System\kwVibce.exe
  2⤵
  PID:15584
- C:\Windows\System\gsmpgIx.exe
  C:\Windows\System\gsmpgIx.exe
  2⤵
  PID:15652
- C:\Windows\System\durqngq.exe
  C:\Windows\System\durqngq.exe
  2⤵
  PID:15688
- C:\Windows\System\aufbXAr.exe
  C:\Windows\System\aufbXAr.exe
  2⤵
  PID:15808
- C:\Windows\System\OMtQFem.exe
  C:\Windows\System\OMtQFem.exe
  2⤵
  PID:15860
- C:\Windows\System\mbQCSsm.exe
  C:\Windows\System\mbQCSsm.exe
  2⤵
  PID:15952
- C:\Windows\System\AsuJVKC.exe
  C:\Windows\System\AsuJVKC.exe
  2⤵
  PID:15984
- C:\Windows\System\ZqTnZqB.exe
  C:\Windows\System\ZqTnZqB.exe
  2⤵
  PID:16052
- C:\Windows\System\vkXTdJu.exe
  C:\Windows\System\vkXTdJu.exe
  2⤵
  PID:16096
- C:\Windows\System\DtSEBbU.exe
  C:\Windows\System\DtSEBbU.exe
  2⤵
  PID:16128
- C:\Windows\System\oqiWRaQ.exe
  C:\Windows\System\oqiWRaQ.exe
  2⤵
  PID:16196
- C:\Windows\System\dhaLngV.exe
  C:\Windows\System\dhaLngV.exe
  2⤵
  PID:16276
- C:\Windows\System\VTuurUf.exe
  C:\Windows\System\VTuurUf.exe
  2⤵
  PID:16308
- C:\Windows\System\SVUqpJF.exe
  C:\Windows\System\SVUqpJF.exe
  2⤵
  PID:16332
- C:\Windows\System\TNziwxz.exe
  C:\Windows\System\TNziwxz.exe
  2⤵
  PID:15512
- C:\Windows\System\LWBisEQ.exe
  C:\Windows\System\LWBisEQ.exe
  2⤵
  PID:15840
- C:\Windows\System\JrJCywr.exe
  C:\Windows\System\JrJCywr.exe
  2⤵
  PID:15844
- C:\Windows\System\iIxaZVF.exe
  C:\Windows\System\iIxaZVF.exe
  2⤵
  PID:16028
- C:\Windows\System\kVJNUOe.exe
  C:\Windows\System\kVJNUOe.exe
  2⤵
  PID:16180
- C:\Windows\System\QfFfktO.exe
  C:\Windows\System\QfFfktO.exe
  2⤵
  PID:15396
- C:\Windows\System\lxKMJfI.exe
  C:\Windows\System\lxKMJfI.exe
  2⤵
  PID:16380
- C:\Windows\System\JBfTIeG.exe
  C:\Windows\System\JBfTIeG.exe
  2⤵
  PID:16288
- C:\Windows\System\tIFEQkp.exe
  C:\Windows\System\tIFEQkp.exe
  2⤵
  PID:14916
- C:\Windows\System\ushIcDu.exe
  C:\Windows\System\ushIcDu.exe
  2⤵
  PID:15828
- C:\Windows\System\PwQyIPY.exe
  C:\Windows\System\PwQyIPY.exe
  2⤵
  PID:15780
- C:\Windows\System\DVqHznb.exe
  C:\Windows\System\DVqHznb.exe
  2⤵
  PID:16416
- C:\Windows\System\RzRtGah.exe
  C:\Windows\System\RzRtGah.exe
  2⤵
  PID:16444
- C:\Windows\System\OtjBaCZ.exe
  C:\Windows\System\OtjBaCZ.exe
  2⤵
  PID:16468
- C:\Windows\System\qeuEdUI.exe
  C:\Windows\System\qeuEdUI.exe
  2⤵
  PID:16492
- C:\Windows\System\LKjaFdl.exe
  C:\Windows\System\LKjaFdl.exe
  2⤵
  PID:16508
- C:\Windows\System\RakxWME.exe
  C:\Windows\System\RakxWME.exe
  2⤵
  PID:16540
- C:\Windows\System\DSclJeo.exe
  C:\Windows\System\DSclJeo.exe
  2⤵
  PID:16560
- C:\Windows\System\iFGIdlF.exe
  C:\Windows\System\iFGIdlF.exe
  2⤵
  PID:16576
- C:\Windows\System\zCymhcF.exe
  C:\Windows\System\zCymhcF.exe
  2⤵
  PID:16644
- C:\Windows\System\FYoxstM.exe
  C:\Windows\System\FYoxstM.exe
  2⤵
  PID:16668
- C:\Windows\System\cFRUldW.exe
  C:\Windows\System\cFRUldW.exe
  2⤵
  PID:16688
- C:\Windows\System\dtHdNQa.exe
  C:\Windows\System\dtHdNQa.exe
  2⤵
  PID:16728
- C:\Windows\System\vCLXQvK.exe
  C:\Windows\System\vCLXQvK.exe
  2⤵
  PID:16744
- C:\Windows\System\UsyagsX.exe
  C:\Windows\System\UsyagsX.exe
  2⤵
  PID:16784
- C:\Windows\System\gqrHabV.exe
  C:\Windows\System\gqrHabV.exe
  2⤵
  PID:16800
- C:\Windows\System\WUuHFol.exe
  C:\Windows\System\WUuHFol.exe
  2⤵
  PID:16836
- C:\Windows\System\LCBwasP.exe
  C:\Windows\System\LCBwasP.exe
  2⤵
  PID:16856
- C:\Windows\System\sryteos.exe
  C:\Windows\System\sryteos.exe
  2⤵
  PID:16876
- C:\Windows\System\snuMSNs.exe
  C:\Windows\System\snuMSNs.exe
  2⤵
  PID:16904
- C:\Windows\System\pmRUXDj.exe
  C:\Windows\System\pmRUXDj.exe
  2⤵
  PID:16940
- C:\Windows\System\ylAQvdf.exe
  C:\Windows\System\ylAQvdf.exe
  2⤵
  PID:16960

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BWmlcZs.exe

Filesize
1.6MB

MD5
d7022a9d8ebd34ea16781c451132e85d

SHA1
5d757bbca1218c8ba84c98512b18d4ffbc66a19a

SHA256
5703f3891467228c5f1bb7738f542d2e75e8344077a9c117b200831b563db98c

SHA512
8cf4c8235c09618f355758c334b9971f7e9f87fb8c88888caac2e7b82fc4039b74f70ad0926ee4152ad4b530187719af255997d62ce8ffdf71f05a74c47f6bc5

Download Submit
C:\Windows\System\EgqbMaP.exe

Filesize
1.6MB

MD5
97a4eeb2fcf243b2723ce4e332dd30d2

SHA1
28b656fc6099aab003286d187e35187d86567b06

SHA256
dba6376f540fea1ba2f06e6812fd6cc4df30a4db7f44ef8ba660c6de3c89de83

SHA512
63ffacc5128293ba3b99fb8faca47ef89c8b9ff133472d0805d7044b161cdb5fee18b75e99a79a95e372045272df8f4bd72cb04baff7cecd8038b3125d4503b5

Download Submit
C:\Windows\System\FywMwzx.exe

Filesize
1.6MB

MD5
b027a120b449e527ed844a3727096ecb

SHA1
d27763eb5c2b57852fcc7dc7a173afbf1b539c93

SHA256
51e7282a03f08b87d086d41dd5c2a34656ddce81d6101fd066648ef9476e4f70

SHA512
a6c64495f82a5022a2ef63fc6ee8811596b61a987c7ed9a6a9a9a80b94155b56c45e4d2444d50e6a6d9c274d44aa0eee08a3e92d2a26af0b73ead0d4d89d5e25

Download Submit
C:\Windows\System\IEIVnFX.exe

Filesize
1.6MB

MD5
9197831255cce38eb40edc5cef5f5906

SHA1
7936417cc329fa057102c23e907965baa2e03fec

SHA256
9b6bed4aa5fa073f7045cceeb8042ad44f9328474d5ef0245467651b6a4bf9ab

SHA512
11f6bb88b17e1f942112ef4d8ca04eb0c740e07d34b0ec2f34e2c6bfe460189387a89b867d7b564c318aa7964ee2e9d598f6eed1a67d26204514943ddb11a467

Download Submit
C:\Windows\System\IPmTEfY.exe

Filesize
1.6MB

MD5
40b0e1f8e9b3e731f884a473c1051afd

SHA1
4e2e168d39fd3155f6f5452614a7c105b61a819b

SHA256
c15d45d536c4ccc15ddd8a64f92bdf477fed2db63631ddfd9825e11932bde6ef

SHA512
347bd6015cf98a2931dec36a1940d0f225b21f4bfb1d8a80dbf9f837c68c616ebb3067fa7c11fba29b11479071adaa1056cce7f9e056a13e42e61391f683a5a7

Download Submit
C:\Windows\System\KuEqukY.exe

Filesize
1.6MB

MD5
3ee9c1579050355b5f37befeec259541

SHA1
d8a6fad34149e3778f9cb08d4db36df1c07d25a8

SHA256
1eea474fcc21ab4ec860b9a31ab456feaea7f1311f3bec534e7f4aeb453cca56

SHA512
3e6f17c062ee720a4d39c853a4d6f1b8aa6e9963c589a7f54814bcf5f0342809919fa02977b7f3f118725775576f5d62b8c8ab3b4f06c15483c22242ed7abb4a

Download Submit
C:\Windows\System\LMIeYPu.exe

Filesize
1.6MB

MD5
b202da08ef295739b3effd60a5ae6244

SHA1
ea1ae988ea4ebea08bea5638c8e0781f8b7ccd41

SHA256
c9c8ebb3318248dc757705a608bfa7032cd6ff4d457c9b02214ec7a1b21b71fc

SHA512
5ee9036d271d8a46b7292a19dd511b31d211385475127bdf3a0374c5bc98c96bf8dc658bd69a07697879f6bdb0766bed3705edbbb1da366da1af60fdb2167b45

Download Submit
C:\Windows\System\MrHWYXY.exe

Filesize
1.6MB

MD5
6a6c091bd0734cca7d3750f4c20f4984

SHA1
a91586769757446996d2b78032a944a14c782bcd

SHA256
024db21fe9fcd85d3f01f67df896bfde0215b05b285fc68aa0d148d2c85b27ed

SHA512
07ded867ce6585e7cdc74733a7052cdaeb1c64e48c0039ecd5f87fce4c41909d58c825abce62e6fda7903f80a35148d0d3c5ebc2d693d4ae2b255dca21550157

Download Submit
C:\Windows\System\NBzHiOv.exe

Filesize
1.6MB

MD5
94b1772ba4ec2427c2b2928ba8730e76

SHA1
57b6e631015d493bf05c2c0ba1a623d2efe39609

SHA256
7599147b03795c9d52d95c205692f1ada12097ce92aa2aaa68f9f1e373fd115a

SHA512
3fca76521a10ab01950865de77bbee868aa2d4f8dc8521d6a9abfe7bce274b5dc82761cb9c02d66c14f7e5c58d88e4a869a6235d6a89643a6aa26db2fa336b97

Download Submit
C:\Windows\System\PfiFNyg.exe

Filesize
1.6MB

MD5
b490fc7519a0cfe6340b1819844171a9

SHA1
2b20beb4130c102f89dcd30ded8e120a7c1bacf2

SHA256
fc990ab456114fe35da2831a0d8e3cf152c57ce79079f8fe5b659ae5f192fa7b

SHA512
1d408b3389012c3821d00e7c0d13fcdaca4f1d21e53b90792274780bb21cbc0e894174cdf724f1faa93b6585364e0558063d9d1c49649b84d51433c2c11346ee

Download Submit
C:\Windows\System\RKjnVRV.exe

Filesize
1.6MB

MD5
8fa379de4696da16755d34da3b5f8d71

SHA1
ae62598803365daf083d18ff3d8ca4a88fe3580d

SHA256
4e1a523e7a7c870cf47eb7cdce20305ac9f568cbfac73806b2335da682d4dbe3

SHA512
e4cc4a69c3bae69512f013627e3c86251dec7d2b5d8965f9678b410eddca94e9e852588897446b19446a41a27e6307a69ebcc22764b7dc079cfed83f86c932f2

Download Submit
C:\Windows\System\RpmKLDY.exe

Filesize
1.6MB

MD5
8cd3b72ff59df8865471a08585b933af

SHA1
ed078959ce8b0747a4fa1bcd9c6b85686277b29a

SHA256
a14ad21211c456bf305573a845aa440ac161a85286bb5a38f063270e8160bb02

SHA512
07acf42ea7b9bae24eb3fe8c00ef8cd63e1588f4f2f12f4e5d7c6a6bdd7d75d4847dab3ba729b9fd6e4c2e9d24c7ab9ab90137d36fa7f23340438983baf95d7a

Download Submit
C:\Windows\System\RqFVXIN.exe

Filesize
1.6MB

MD5
6aaf7608f76c90d315b8057e2a40bc71

SHA1
b9e1320371906b032f2063c785845bcea9753c04

SHA256
0538abcfa25e13c8a05cbe9a911c6cc68ab070a5b63fcc433bdea8116c4f5cc5

SHA512
a8248a36d7d741cd67f0a661d744d1800d504dbc01303281ca1d2e14da3be073f539bc67d0754fa386d3a78d4c105a7b735211c6aebdd832fdf02e7964638cf8

Download Submit
C:\Windows\System\SVgbpjZ.exe

Filesize
1.6MB

MD5
381898a0d9348492e9d7b82f01f667ff

SHA1
ea1261c35eaf117d6bc064b1a6ee42c7519f08dd

SHA256
731be4e52119fbe6435771fbe7c04fc6844379c3b4e0c650be250212371d766b

SHA512
d5c62da749fba07baa2a9d3bf7b04a865b4688e46e3ea86a558a93da92398c032d073479b6427a5be80cff226a35d22fa716063d89b75ddd0103e13697ba1942

Download Submit
C:\Windows\System\VMlIkkz.exe

Filesize
1.6MB

MD5
6aebe0dd9e4290cdfae1ffc294f86958

SHA1
ea41b4c6be06a552234c8499e7a4fbde40aa8ad0

SHA256
abccb9a65f5f43405e7a8c4c2a9024bff64233372cf96c5f718b936e0b5e201c

SHA512
7fdc25c6468c0a116c6620977867b134c2d9fe8dbc2885e563eb8f1c2dc26a7b4c7418323ac0a0d69772d50210df9f90b5f44014b836921a880be9bea2923896

Download Submit
C:\Windows\System\WPeHFQc.exe

Filesize
1.6MB

MD5
9bdde4351ed949a55349ed89d61b9ad8

SHA1
9dec2739e3542803b49424c2075d24e7eb323b03

SHA256
272b1669bb6a4610b243dbef9c5656953d991922d99c7f0592ca3a1f88bf104f

SHA512
f8848c09fcce09a7594eccebdcaaa545e16d32e4bbb1c5944638d58c7c2cc51786848ac55fb9bf966b594a2f7bd778edbaec5c522b7dce5c1f0bf7f68e6dccd7

Download Submit
C:\Windows\System\WawylWC.exe

Filesize
1.6MB

MD5
778999eda10e7c3fee56d8efe358991d

SHA1
7e0f1758748b3d8fc5918c6ef1e40995f4b21ed6

SHA256
2b474274501c5bf170252bdfbfa3280e4fb34c7262686f24c01ac4a042035aeb

SHA512
813a2b6391361d2e4bae4a8bb38ff8110a6d9a983258168db92750c58339585f70ea569599ca7eb49a0ee1553e9d2c7b523ec06d7cf05de980fa21cfb4fb14e2

Download Submit
C:\Windows\System\XpOIHTd.exe

Filesize
1.6MB

MD5
7fa3cfec040df1031a6f5932bfebe42e

SHA1
fa3c4c6a6e03bc3cede55c651d3d0d33200c5626

SHA256
623ef8adec69dc475e399a98858f1d91480f17fad4df996a04c74783c721b343

SHA512
37f9d080f95776fdb67a536083c20b3a5e03ed75989a73f4dce1aeadae66dd5810a5cc2e4c4b68fc63d81712d8c50831f7dba19d74ad8484b164228567a889ae

Download Submit
C:\Windows\System\bhrpMEe.exe

Filesize
1.6MB

MD5
58eb6e8425b7f08a1a25d486a984fcc2

SHA1
b8961ca2bb4baa19afe0f6c7959503e5a7e8988c

SHA256
beac8b8744a89019786acc909f0397939e2503255401dc2762ba17cc92c592cd

SHA512
bc3e88b378a5a1acb685e2ba428dfe4ccea8a9395ff919116223bd8315a76fd334a230fea455128128e54f182e1738b1bd035585d7936c2f9a41782c9aa02a0d

Download Submit
C:\Windows\System\cohVqEQ.exe

Filesize
1.6MB

MD5
a69d34c98684ef75b1141c29f289cf64

SHA1
45f6c74926db05d50bd1d3e8235a1a573da98ef7

SHA256
63252acae77a0358b5dac5c24428b9736c966d045d63106675f88f84b283873f

SHA512
39079feff762b92780f921e3ffa94f7e19bdcf93a5e164e18c86eb445bb685dabc7cca2768e671d904978545ed33b30d46a33d70e357c44c001dab035a4f9d42

Download Submit
C:\Windows\System\dQPOpYa.exe

Filesize
1.6MB

MD5
3edcaf4d2c2a7ab8ce98e9851e867537

SHA1
47906a8c183860d0021949c1da9f46d431abaae0

SHA256
5e85425fd33ae870bc818897b1e156c4f4f109fbf6c7aa2805610b291920cc10

SHA512
0ddb6ee717a4e76fa3f5af0873e157e56b04702cea24ac6afc540ab3813ade5dbaabeaadecebbf0f9f5848c8338edb38a75e796d702596ff9049024f7dbb5164

Download Submit
C:\Windows\System\elaSURP.exe

Filesize
1.6MB

MD5
4e00c347966c1c894001a5dcd4ce644c

SHA1
7709ca1735d806fd7876a0152db7212f170bf66f

SHA256
3a65a0d734772239ce259700defab80cfea58411e0bca6ded77a0e026a1cee85

SHA512
97f046c4dd6a666da40e627a436e7ee98ede7415b31a7389f18a7b14fd54bfe4e7825fa9c1df35698fceed5a4ba741f714eb8be1b421ec18bde55fad2717f6b0

Download Submit
C:\Windows\System\gkqlXuv.exe

Filesize
1.6MB

MD5
4ac380a2dde864bb0a74fc857c746abb

SHA1
ad00a1792c6377302fd76328d9a1eea0e9c215c1

SHA256
77063e391498accc6afc4c297430c3fd690fd634824006dfd640e5ccae13254d

SHA512
d478d4ac0efd616ad6b447cd3b436bd73a3ccea769707aea261c5b5a54e87ac7d2af0bd53ab8210b1d98065ed7fc1d6b9f2ed29ee4806025aa61cedc647b40c5

Download Submit
C:\Windows\System\hnLsRcD.exe

Filesize
1.6MB

MD5
651e45a18e915c81e760456188271485

SHA1
0a30db32c13383c01839c327459a49f4b9d6cf71

SHA256
630be2157570414f9d92d08359852ee0b1b0691310dd2ba85872f9673bc25cd9

SHA512
f266c11097859e0dee7f7e8c45782b3e43ebe2da4ec14acf8b32c81133c4273ee84321a4b7cc57aa4a4fa257cff52c299935e43d185fd1c90fbf204730917825

Download Submit
C:\Windows\System\hnUenRF.exe

Filesize
1.6MB

MD5
9449e1ea706536e1bf504c1b7ea35a90

SHA1
8286f4f273cc1b71d5cc7405dd9673678f18cd82

SHA256
33938bb71c9dd2421c381de80d41ff1da13e9a3b5ae08c13cc2d6764b87a9e8f

SHA512
6f0b4e63eee8f7876ef1d79a083a45288e1db6e1fa92b51a8c3b934dca0a2835735aa715d04379ba2b2c4be08259eb6571975dfcaad155b0e84fff5a3d522ab7

Download Submit
C:\Windows\System\nCEEkuE.exe

Filesize
1.6MB

MD5
61427885d5b5e3b9092fc69faab735c6

SHA1
1933f885b41948dabbdb9c4d6a223b0b5a8c3d7f

SHA256
5f0621afb1100bb52466732a9a298286128847796c691cb9d6a181e8b0d1c5b0

SHA512
cf07935870dc3c03492f70572285d3491bbde4fe25b8b06536f911d5e2f9bc1eb7564bcdb484b9f522b6b7e41ad3ef78ed61cb06e15cba9abd22c0cb1af1682b

Download Submit
C:\Windows\System\nOQCiAI.exe

Filesize
1.6MB

MD5
a70ab27dbe746a4ab65b266df560a45b

SHA1
2e75d9fee830ca4201333f5039836ece6a32b348

SHA256
cddd15072465a7525f2b61886ab195422ae02d910931bb981bfa42564ad825fb

SHA512
5c29d0fa6a60131dc75f8283f30d10b0589e5f500b1e76cb2606b5586360068c95cde447bd254347ebb94071ed285d03fef2d63b212115725f16cc0d571d75b9

Download Submit
C:\Windows\System\ppEwAra.exe

Filesize
1.6MB

MD5
e7e6eb8529335b906c5d1180373435da

SHA1
e2bc68a0c2d30710c46d15fa6c91885dd62d02c9

SHA256
230e3ec9c17038ad28e51180ec26fb714f874fd99570c285613b7ff0aa4c9a38

SHA512
b152c303ce0cfc34262a366e50618112d7e6d3819a1a9a3c2ef423cc9a8416c7872c9036423b5b569925d8320f473adb67667997aa9765592ab6e767959e8b70

Download Submit
C:\Windows\System\sgitdVS.exe

Filesize
1.6MB

MD5
a4e6fdde77bb14dceea41a26d2fd28c6

SHA1
08cce52d3b9f61b516eda43f18b83f7b0f035c96

SHA256
fdb5a44d7da1233c21aaeb0ad918324fb244ae5e41f3f9c4c2c975625c8d755a

SHA512
8142cde138dc46efe3a47781948a90f3a7a53a7a34d4a274a5cdaa6f87d5dc878909443a2c492be2612d32930d1347cd24023f12b43a8e66c8bc5fab9651dc22

Download Submit
C:\Windows\System\tNmwRtN.exe

Filesize
1.6MB

MD5
480ba4c9fc6254b61153f8dcd8569bc1

SHA1
c687c139ec21322a43c154257dd74134fbbf8030

SHA256
83eedbfcc5742dad1d4133283c5662459c1c4279e1f57e72764f9483ce32fe19

SHA512
7a4b65133700502b231df1de8bfefac0efccc9597c9996889167c7f8b040af6ee47bedc6ee3912f70bbb8e54950014ffddec243d8bf41295452363f559e4b56d

Download Submit
C:\Windows\System\tZkKbVq.exe

Filesize
1.6MB

MD5
574b15fe2d6820069aaa67eeb0ba447e

SHA1
d2b93e241c81d9de1a26a9be70bd4b6e81db33c7

SHA256
4369f8ea2df37ec0a2cb41b7cf531c9a9a6f37b155ce10e7814f92f505518984

SHA512
969662817b1e2ff4f2676b7c7f3d92507699d4675c119fdacd803d80c57f51b26f51c0308bdb6f1f66bf0f05149f9166da1e1b788bf852f3d7f57189b4ea1876

Download Submit
C:\Windows\System\wWWpXwn.exe

Filesize
1.6MB

MD5
a2c66030b5e2f722a43a00363849430c

SHA1
19fa84d322b2b2c32287a79cc44159ee5bf2bb9b

SHA256
e29f89a8ea535ac42fbc00c56119940cddb38b1a961ab304b3501b4a25998a8a

SHA512
c474dde339ca64e5b2ea1fc0b70c6d1e7188960901020a5b62945f1d66b62181ee9d20e23401dec2c8447173e356e517b06482d286a1ad3b29a43c9c515ee67d

Download Submit
C:\Windows\System\xvnMaFQ.exe

Filesize
1.6MB

MD5
355f13afd9482aa08edd2fa6f184dc0c

SHA1
1a04a5cc39206e8b10f7ec6d53b769acb7547cfe

SHA256
f4633c8e944fdb835e856f2f80891b9d3349e3e7ed5d3baf3c37737f3ae0d9fc

SHA512
b65c98f16be47e166d722b28416be4461977fb55500b2d71b38002f6253d5678cad15fc91c56a8b00bbe1774d0c235c5902e2d4f1a82303638ae41bc3beb5af0

Download Submit
memory/3816-0-0x00000246A13D0000-0x00000246A13E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads