xmrig | ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 04:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
Size

1.6MB
MD5

2c40b55907efd9557aed703041a437ce
SHA1

dacd65cb3fbea15ae0f67fb045ed25699faf2451
SHA256

ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849
SHA512

bdb69e8bb9f589e6d4029f6fc56dfd755c07487c504ec3a878709d43dbc1a3b2680b2c48008be3693af20f28607691875f062579c512c97d3d7dfc60fa3aac31
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8r7+9/ShKmlC5yx:GemTLkNdfE0pZyn

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b23-3.dat	xmrig
behavioral2/files/0x000b000000023b79-9.dat	xmrig
behavioral2/files/0x000a000000023b7d-16.dat	xmrig
behavioral2/files/0x000a000000023b7f-23.dat	xmrig
behavioral2/files/0x000a000000023b80-28.dat	xmrig
behavioral2/files/0x000a000000023b7e-25.dat	xmrig
behavioral2/files/0x000a000000023b81-34.dat	xmrig
behavioral2/files/0x000a000000023b83-39.dat	xmrig
behavioral2/files/0x000a000000023b84-47.dat	xmrig
behavioral2/files/0x000a000000023b86-55.dat	xmrig
behavioral2/files/0x000a000000023b85-48.dat	xmrig
behavioral2/files/0x000a000000023b8b-82.dat	xmrig
behavioral2/files/0x000a000000023b8c-88.dat	xmrig
behavioral2/files/0x000a000000023b8d-99.dat	xmrig
behavioral2/files/0x000a000000023b90-109.dat	xmrig
behavioral2/files/0x000b000000023b92-123.dat	xmrig
behavioral2/files/0x000b000000023b93-125.dat	xmrig
behavioral2/files/0x000a000000023b91-121.dat	xmrig
behavioral2/files/0x000a000000023b8e-108.dat	xmrig
behavioral2/files/0x000a000000023b8f-105.dat	xmrig
behavioral2/files/0x000a000000023b8a-83.dat	xmrig
behavioral2/files/0x000a000000023b9c-133.dat	xmrig
behavioral2/files/0x0009000000023bb1-149.dat	xmrig
behavioral2/files/0x0009000000023bb2-155.dat	xmrig
behavioral2/files/0x000e000000023bb7-162.dat	xmrig
behavioral2/files/0x0009000000023bb3-157.dat	xmrig
behavioral2/files/0x0008000000023bac-145.dat	xmrig
behavioral2/files/0x000e000000023ba3-139.dat	xmrig
behavioral2/files/0x000b000000023b94-130.dat	xmrig
behavioral2/files/0x000a000000023b89-75.dat	xmrig
behavioral2/files/0x000a000000023b88-70.dat	xmrig
behavioral2/files/0x000b000000023b7a-65.dat	xmrig
behavioral2/files/0x000a000000023b87-60.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2200	dbFLdfw.exe
3748	jVLDVeO.exe
4932	zVgwtpo.exe
4884	JYMqkmn.exe
3472	PAsfsis.exe
2128	XBEjYjP.exe
2056	lUcRzCv.exe
4796	yhvIrgZ.exe
4468	nioWJaJ.exe
4324	dzHqoqR.exe
2248	KPDzxOv.exe
2780	rxFkuhw.exe
3444	BEsMcpS.exe
4956	navqSrT.exe
4432	FhREfWi.exe
4036	cndSfVa.exe
4756	DMzDdyb.exe
4512	nfrMmGL.exe
3032	vCOsamQ.exe
1064	tiiAhVr.exe
4228	qFVePcP.exe
1760	SeMTfRR.exe
3740	NeluELp.exe
1400	DwZnVkD.exe
3744	VSeWFWg.exe
924	hRQNMGq.exe
736	fuVAcYB.exe
4872	UBdqMLz.exe
4172	dNHVQtX.exe
3036	uSvtNnl.exe
3688	vJcnWIx.exe
4288	WZWeLpD.exe
2916	AQNvWfG.exe
3692	ZzIiwNs.exe
1664	cTrDKND.exe
2304	QJOrfmF.exe
2032	elIsWHw.exe
3896	mrxaLTm.exe
3924	mdawHBs.exe
1384	SaCtybF.exe
8	MRrjgCB.exe
2316	FQicsYh.exe
2668	aVmAIiq.exe
4760	wxTvgJd.exe
1564	lQQHqkI.exe
1276	caoRuKh.exe
2188	hmjlojq.exe
2236	wdMuBpE.exe
3808	xZaEFzm.exe
4352	YthCNSM.exe
1428	UcJBPhJ.exe
1516	KMmYHSf.exe
3908	cJdcyLy.exe
1408	goCQCCu.exe
4160	kgyRtwa.exe
1716	KsmpXxM.exe
4464	sLaEMHX.exe
848	ewBxutw.exe
3124	iKHnbEl.exe
4972	lfgzQZy.exe
2788	QAioJGJ.exe
3728	ERzTSNI.exe
2360	GhSWiij.exe
2008	alTfBok.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GeBMGuN.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\DjoUTEF.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\MFXsXeH.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\UVYLMkA.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\QzWsQgs.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\vkGHNEy.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\aGGLmbt.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\EznTQNw.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\MjKGvIg.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\KwIWseg.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\nfrMmGL.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\TBKJqMS.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\IOKMNPv.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\xZaEFzm.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\wjefDVY.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\xqWVvII.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\LmRFRsp.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\NBZyXiJ.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\SOQSmYM.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\bzPpVgZ.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\VXwGdhg.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\tYvHLfw.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\dNHVQtX.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\SzYWSfp.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\lAoaTmW.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\YKAlamz.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\PbUIJaD.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\XMGxbYr.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\jBesrCl.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\ZLChNqg.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\KaWKLwt.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\nwhaeax.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\EUfDrWl.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\maOffTz.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\hwrEtzo.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\IdGNoUJ.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\bPiuSNN.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\jgXpcZU.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\GqPAKDa.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\WODTDtG.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\JPyMpnZ.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\mFNZEPC.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\yBXpkDG.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\ahDgdEp.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\YcsEZOV.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\vAZwMIP.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\GZpxdza.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\COtUjxZ.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\QhavXfe.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\SVnEsim.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\XzTJxQK.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\ooqFryv.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\SaCtybF.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\YthCNSM.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\cNODQJv.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\KsDSkLk.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\ROyJnTB.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\dLUcFNt.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\TQIthCj.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\HszfNYC.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\LMqnfXB.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\qBNxCeJ.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\rekXZBV.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
File created	C:\Windows\System\SLxLota.exe	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16968	dwm.exe
Token: SeChangeNotifyPrivilege	16968	dwm.exe
Token: 33	16968	dwm.exe
Token: SeIncBasePriorityPrivilege	16968	dwm.exe
Token: SeShutdownPrivilege	16968	dwm.exe
Token: SeCreatePagefilePrivilege	16968	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 2200	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	86
PID 4380 wrote to memory of 2200	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	86
PID 4380 wrote to memory of 3748	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	87
PID 4380 wrote to memory of 3748	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	87
PID 4380 wrote to memory of 4932	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	88
PID 4380 wrote to memory of 4932	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	88
PID 4380 wrote to memory of 3472	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	89
PID 4380 wrote to memory of 3472	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	89
PID 4380 wrote to memory of 4884	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	90
PID 4380 wrote to memory of 4884	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	90
PID 4380 wrote to memory of 2128	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	91
PID 4380 wrote to memory of 2128	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	91
PID 4380 wrote to memory of 2056	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	92
PID 4380 wrote to memory of 2056	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	92
PID 4380 wrote to memory of 4796	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	93
PID 4380 wrote to memory of 4796	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	93
PID 4380 wrote to memory of 4324	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	94
PID 4380 wrote to memory of 4324	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	94
PID 4380 wrote to memory of 4468	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	95
PID 4380 wrote to memory of 4468	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	95
PID 4380 wrote to memory of 2248	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	96
PID 4380 wrote to memory of 2248	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	96
PID 4380 wrote to memory of 2780	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	97
PID 4380 wrote to memory of 2780	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	97
PID 4380 wrote to memory of 3444	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	98
PID 4380 wrote to memory of 3444	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	98
PID 4380 wrote to memory of 4956	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	99
PID 4380 wrote to memory of 4956	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	99
PID 4380 wrote to memory of 4432	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	100
PID 4380 wrote to memory of 4432	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	100
PID 4380 wrote to memory of 4036	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	101
PID 4380 wrote to memory of 4036	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	101
PID 4380 wrote to memory of 4756	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	102
PID 4380 wrote to memory of 4756	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	102
PID 4380 wrote to memory of 4512	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	103
PID 4380 wrote to memory of 4512	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	103
PID 4380 wrote to memory of 3032	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	104
PID 4380 wrote to memory of 3032	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	104
PID 4380 wrote to memory of 1064	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	105
PID 4380 wrote to memory of 1064	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	105
PID 4380 wrote to memory of 4228	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	106
PID 4380 wrote to memory of 4228	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	106
PID 4380 wrote to memory of 1760	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	107
PID 4380 wrote to memory of 1760	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	107
PID 4380 wrote to memory of 3740	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	108
PID 4380 wrote to memory of 3740	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	108
PID 4380 wrote to memory of 1400	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	109
PID 4380 wrote to memory of 1400	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	109
PID 4380 wrote to memory of 3744	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	110
PID 4380 wrote to memory of 3744	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	110
PID 4380 wrote to memory of 924	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	111
PID 4380 wrote to memory of 924	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	111
PID 4380 wrote to memory of 736	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	112
PID 4380 wrote to memory of 736	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	112
PID 4380 wrote to memory of 4872	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	113
PID 4380 wrote to memory of 4872	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	113
PID 4380 wrote to memory of 4172	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	114
PID 4380 wrote to memory of 4172	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	114
PID 4380 wrote to memory of 3036	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	115
PID 4380 wrote to memory of 3036	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	115
PID 4380 wrote to memory of 3688	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	116
PID 4380 wrote to memory of 3688	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	116
PID 4380 wrote to memory of 4288	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	117
PID 4380 wrote to memory of 4288	4380	ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe	117

C:\Users\Admin\AppData\Local\Temp\ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe
"C:\Users\Admin\AppData\Local\Temp\ba9775a0170a15ed971b50cc9cbd77793fd5d0810fcbee16378be22d3618a849.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\System\dbFLdfw.exe
  C:\Windows\System\dbFLdfw.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\jVLDVeO.exe
  C:\Windows\System\jVLDVeO.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\zVgwtpo.exe
  C:\Windows\System\zVgwtpo.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\PAsfsis.exe
  C:\Windows\System\PAsfsis.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\JYMqkmn.exe
  C:\Windows\System\JYMqkmn.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\XBEjYjP.exe
  C:\Windows\System\XBEjYjP.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\lUcRzCv.exe
  C:\Windows\System\lUcRzCv.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\yhvIrgZ.exe
  C:\Windows\System\yhvIrgZ.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\dzHqoqR.exe
  C:\Windows\System\dzHqoqR.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\nioWJaJ.exe
  C:\Windows\System\nioWJaJ.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\KPDzxOv.exe
  C:\Windows\System\KPDzxOv.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\rxFkuhw.exe
  C:\Windows\System\rxFkuhw.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\BEsMcpS.exe
  C:\Windows\System\BEsMcpS.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\navqSrT.exe
  C:\Windows\System\navqSrT.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\FhREfWi.exe
  C:\Windows\System\FhREfWi.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\cndSfVa.exe
  C:\Windows\System\cndSfVa.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\DMzDdyb.exe
  C:\Windows\System\DMzDdyb.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\nfrMmGL.exe
  C:\Windows\System\nfrMmGL.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\vCOsamQ.exe
  C:\Windows\System\vCOsamQ.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\tiiAhVr.exe
  C:\Windows\System\tiiAhVr.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\qFVePcP.exe
  C:\Windows\System\qFVePcP.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\SeMTfRR.exe
  C:\Windows\System\SeMTfRR.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\NeluELp.exe
  C:\Windows\System\NeluELp.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\DwZnVkD.exe
  C:\Windows\System\DwZnVkD.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\VSeWFWg.exe
  C:\Windows\System\VSeWFWg.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\hRQNMGq.exe
  C:\Windows\System\hRQNMGq.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\fuVAcYB.exe
  C:\Windows\System\fuVAcYB.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\UBdqMLz.exe
  C:\Windows\System\UBdqMLz.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\dNHVQtX.exe
  C:\Windows\System\dNHVQtX.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\uSvtNnl.exe
  C:\Windows\System\uSvtNnl.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\vJcnWIx.exe
  C:\Windows\System\vJcnWIx.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\WZWeLpD.exe
  C:\Windows\System\WZWeLpD.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\AQNvWfG.exe
  C:\Windows\System\AQNvWfG.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\ZzIiwNs.exe
  C:\Windows\System\ZzIiwNs.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\cTrDKND.exe
  C:\Windows\System\cTrDKND.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\QJOrfmF.exe
  C:\Windows\System\QJOrfmF.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\elIsWHw.exe
  C:\Windows\System\elIsWHw.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\mrxaLTm.exe
  C:\Windows\System\mrxaLTm.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\mdawHBs.exe
  C:\Windows\System\mdawHBs.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\SaCtybF.exe
  C:\Windows\System\SaCtybF.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\MRrjgCB.exe
  C:\Windows\System\MRrjgCB.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\FQicsYh.exe
  C:\Windows\System\FQicsYh.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\aVmAIiq.exe
  C:\Windows\System\aVmAIiq.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\wxTvgJd.exe
  C:\Windows\System\wxTvgJd.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\lQQHqkI.exe
  C:\Windows\System\lQQHqkI.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\caoRuKh.exe
  C:\Windows\System\caoRuKh.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\hmjlojq.exe
  C:\Windows\System\hmjlojq.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\wdMuBpE.exe
  C:\Windows\System\wdMuBpE.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\YthCNSM.exe
  C:\Windows\System\YthCNSM.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\xZaEFzm.exe
  C:\Windows\System\xZaEFzm.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\UcJBPhJ.exe
  C:\Windows\System\UcJBPhJ.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\KMmYHSf.exe
  C:\Windows\System\KMmYHSf.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\cJdcyLy.exe
  C:\Windows\System\cJdcyLy.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\kgyRtwa.exe
  C:\Windows\System\kgyRtwa.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\goCQCCu.exe
  C:\Windows\System\goCQCCu.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\KsmpXxM.exe
  C:\Windows\System\KsmpXxM.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\sLaEMHX.exe
  C:\Windows\System\sLaEMHX.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\ewBxutw.exe
  C:\Windows\System\ewBxutw.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\iKHnbEl.exe
  C:\Windows\System\iKHnbEl.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\lfgzQZy.exe
  C:\Windows\System\lfgzQZy.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\QAioJGJ.exe
  C:\Windows\System\QAioJGJ.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\ERzTSNI.exe
  C:\Windows\System\ERzTSNI.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\alTfBok.exe
  C:\Windows\System\alTfBok.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\GhSWiij.exe
  C:\Windows\System\GhSWiij.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\slIOrfT.exe
  C:\Windows\System\slIOrfT.exe
  2⤵
  PID:3544
- C:\Windows\System\vBmCvek.exe
  C:\Windows\System\vBmCvek.exe
  2⤵
  PID:3360
- C:\Windows\System\tsAIOGY.exe
  C:\Windows\System\tsAIOGY.exe
  2⤵
  PID:1860
- C:\Windows\System\sDOWopE.exe
  C:\Windows\System\sDOWopE.exe
  2⤵
  PID:1944
- C:\Windows\System\BUdvDIa.exe
  C:\Windows\System\BUdvDIa.exe
  2⤵
  PID:3340
- C:\Windows\System\vWBEtff.exe
  C:\Windows\System\vWBEtff.exe
  2⤵
  PID:3228
- C:\Windows\System\SiNMQzh.exe
  C:\Windows\System\SiNMQzh.exe
  2⤵
  PID:2672
- C:\Windows\System\nwhaeax.exe
  C:\Windows\System\nwhaeax.exe
  2⤵
  PID:4988
- C:\Windows\System\PiMHcuA.exe
  C:\Windows\System\PiMHcuA.exe
  2⤵
  PID:5104
- C:\Windows\System\eaPxjRF.exe
  C:\Windows\System\eaPxjRF.exe
  2⤵
  PID:1344
- C:\Windows\System\YOBKSyC.exe
  C:\Windows\System\YOBKSyC.exe
  2⤵
  PID:4516
- C:\Windows\System\HImIbXa.exe
  C:\Windows\System\HImIbXa.exe
  2⤵
  PID:3028
- C:\Windows\System\wjefDVY.exe
  C:\Windows\System\wjefDVY.exe
  2⤵
  PID:968
- C:\Windows\System\EWkIlye.exe
  C:\Windows\System\EWkIlye.exe
  2⤵
  PID:2108
- C:\Windows\System\yFFvuxS.exe
  C:\Windows\System\yFFvuxS.exe
  2⤵
  PID:4412
- C:\Windows\System\rfqcsrN.exe
  C:\Windows\System\rfqcsrN.exe
  2⤵
  PID:4144
- C:\Windows\System\qhBKWPF.exe
  C:\Windows\System\qhBKWPF.exe
  2⤵
  PID:4696
- C:\Windows\System\zzdLRBw.exe
  C:\Windows\System\zzdLRBw.exe
  2⤵
  PID:3476
- C:\Windows\System\bzPpVgZ.exe
  C:\Windows\System\bzPpVgZ.exe
  2⤵
  PID:4320
- C:\Windows\System\DZxlzHM.exe
  C:\Windows\System\DZxlzHM.exe
  2⤵
  PID:1028
- C:\Windows\System\dpVRmBd.exe
  C:\Windows\System\dpVRmBd.exe
  2⤵
  PID:1296
- C:\Windows\System\NMXocRs.exe
  C:\Windows\System\NMXocRs.exe
  2⤵
  PID:2332
- C:\Windows\System\OvRyrJH.exe
  C:\Windows\System\OvRyrJH.exe
  2⤵
  PID:4208
- C:\Windows\System\QzWsQgs.exe
  C:\Windows\System\QzWsQgs.exe
  2⤵
  PID:2448
- C:\Windows\System\XgPESjj.exe
  C:\Windows\System\XgPESjj.exe
  2⤵
  PID:3160
- C:\Windows\System\UOvHDxr.exe
  C:\Windows\System\UOvHDxr.exe
  2⤵
  PID:1008
- C:\Windows\System\JeHGHTx.exe
  C:\Windows\System\JeHGHTx.exe
  2⤵
  PID:2872
- C:\Windows\System\JPyMpnZ.exe
  C:\Windows\System\JPyMpnZ.exe
  2⤵
  PID:2936
- C:\Windows\System\MIYyQwU.exe
  C:\Windows\System\MIYyQwU.exe
  2⤵
  PID:5056
- C:\Windows\System\AgwkRSY.exe
  C:\Windows\System\AgwkRSY.exe
  2⤵
  PID:2004
- C:\Windows\System\IrLuMHR.exe
  C:\Windows\System\IrLuMHR.exe
  2⤵
  PID:5060
- C:\Windows\System\rMyeMNY.exe
  C:\Windows\System\rMyeMNY.exe
  2⤵
  PID:1208
- C:\Windows\System\MQoQKiN.exe
  C:\Windows\System\MQoQKiN.exe
  2⤵
  PID:3320
- C:\Windows\System\TBKJqMS.exe
  C:\Windows\System\TBKJqMS.exe
  2⤵
  PID:4256
- C:\Windows\System\cdTjiln.exe
  C:\Windows\System\cdTjiln.exe
  2⤵
  PID:488
- C:\Windows\System\BtXUNzR.exe
  C:\Windows\System\BtXUNzR.exe
  2⤵
  PID:3180
- C:\Windows\System\OOYvmnK.exe
  C:\Windows\System\OOYvmnK.exe
  2⤵
  PID:1016
- C:\Windows\System\zFlJrdi.exe
  C:\Windows\System\zFlJrdi.exe
  2⤵
  PID:3764
- C:\Windows\System\ubAzAmw.exe
  C:\Windows\System\ubAzAmw.exe
  2⤵
  PID:4016
- C:\Windows\System\oTwKQcO.exe
  C:\Windows\System\oTwKQcO.exe
  2⤵
  PID:1348
- C:\Windows\System\VcJcEzG.exe
  C:\Windows\System\VcJcEzG.exe
  2⤵
  PID:952
- C:\Windows\System\Xsfcmtg.exe
  C:\Windows\System\Xsfcmtg.exe
  2⤵
  PID:2728
- C:\Windows\System\kUeAjDQ.exe
  C:\Windows\System\kUeAjDQ.exe
  2⤵
  PID:3792
- C:\Windows\System\jzGUYgt.exe
  C:\Windows\System\jzGUYgt.exe
  2⤵
  PID:4284
- C:\Windows\System\ehCIgoD.exe
  C:\Windows\System\ehCIgoD.exe
  2⤵
  PID:5140
- C:\Windows\System\cNDLFVG.exe
  C:\Windows\System\cNDLFVG.exe
  2⤵
  PID:5156
- C:\Windows\System\vkHCsjr.exe
  C:\Windows\System\vkHCsjr.exe
  2⤵
  PID:5184
- C:\Windows\System\CiYhYBd.exe
  C:\Windows\System\CiYhYBd.exe
  2⤵
  PID:5212
- C:\Windows\System\IXujoZq.exe
  C:\Windows\System\IXujoZq.exe
  2⤵
  PID:5240
- C:\Windows\System\eTIFLeE.exe
  C:\Windows\System\eTIFLeE.exe
  2⤵
  PID:5268
- C:\Windows\System\GMWddKz.exe
  C:\Windows\System\GMWddKz.exe
  2⤵
  PID:5296
- C:\Windows\System\EUfDrWl.exe
  C:\Windows\System\EUfDrWl.exe
  2⤵
  PID:5324
- C:\Windows\System\LJngyBb.exe
  C:\Windows\System\LJngyBb.exe
  2⤵
  PID:5352
- C:\Windows\System\QHctISF.exe
  C:\Windows\System\QHctISF.exe
  2⤵
  PID:5380
- C:\Windows\System\sErAEUn.exe
  C:\Windows\System\sErAEUn.exe
  2⤵
  PID:5408
- C:\Windows\System\IZvRxJW.exe
  C:\Windows\System\IZvRxJW.exe
  2⤵
  PID:5444
- C:\Windows\System\NEtGtRZ.exe
  C:\Windows\System\NEtGtRZ.exe
  2⤵
  PID:5472
- C:\Windows\System\JZmpKOg.exe
  C:\Windows\System\JZmpKOg.exe
  2⤵
  PID:5500
- C:\Windows\System\xDrDXBl.exe
  C:\Windows\System\xDrDXBl.exe
  2⤵
  PID:5528
- C:\Windows\System\csCYhSj.exe
  C:\Windows\System\csCYhSj.exe
  2⤵
  PID:5556
- C:\Windows\System\FpDcjBg.exe
  C:\Windows\System\FpDcjBg.exe
  2⤵
  PID:5584
- C:\Windows\System\VXCTGJp.exe
  C:\Windows\System\VXCTGJp.exe
  2⤵
  PID:5612
- C:\Windows\System\AdhspRg.exe
  C:\Windows\System\AdhspRg.exe
  2⤵
  PID:5640
- C:\Windows\System\HdUfYgT.exe
  C:\Windows\System\HdUfYgT.exe
  2⤵
  PID:5668
- C:\Windows\System\lzmJkkK.exe
  C:\Windows\System\lzmJkkK.exe
  2⤵
  PID:5696
- C:\Windows\System\mFtAvhs.exe
  C:\Windows\System\mFtAvhs.exe
  2⤵
  PID:5724
- C:\Windows\System\iRdvNei.exe
  C:\Windows\System\iRdvNei.exe
  2⤵
  PID:5752
- C:\Windows\System\FVSOAlA.exe
  C:\Windows\System\FVSOAlA.exe
  2⤵
  PID:5780
- C:\Windows\System\QiPCQeU.exe
  C:\Windows\System\QiPCQeU.exe
  2⤵
  PID:5808
- C:\Windows\System\JxkdOvr.exe
  C:\Windows\System\JxkdOvr.exe
  2⤵
  PID:5836
- C:\Windows\System\IjcXJsU.exe
  C:\Windows\System\IjcXJsU.exe
  2⤵
  PID:5864
- C:\Windows\System\zjbuzrc.exe
  C:\Windows\System\zjbuzrc.exe
  2⤵
  PID:5892
- C:\Windows\System\KQYkgHw.exe
  C:\Windows\System\KQYkgHw.exe
  2⤵
  PID:5924
- C:\Windows\System\IivyWcr.exe
  C:\Windows\System\IivyWcr.exe
  2⤵
  PID:5960
- C:\Windows\System\CSUnmdc.exe
  C:\Windows\System\CSUnmdc.exe
  2⤵
  PID:5980
- C:\Windows\System\NWWNnrV.exe
  C:\Windows\System\NWWNnrV.exe
  2⤵
  PID:6008
- C:\Windows\System\zbQXzFs.exe
  C:\Windows\System\zbQXzFs.exe
  2⤵
  PID:6032
- C:\Windows\System\DpdaMFZ.exe
  C:\Windows\System\DpdaMFZ.exe
  2⤵
  PID:6064
- C:\Windows\System\lxtSvQD.exe
  C:\Windows\System\lxtSvQD.exe
  2⤵
  PID:6092
- C:\Windows\System\JUdlMtW.exe
  C:\Windows\System\JUdlMtW.exe
  2⤵
  PID:6120
- C:\Windows\System\CUSBDAL.exe
  C:\Windows\System\CUSBDAL.exe
  2⤵
  PID:1424
- C:\Windows\System\ikcPCrk.exe
  C:\Windows\System\ikcPCrk.exe
  2⤵
  PID:5204
- C:\Windows\System\COtUjxZ.exe
  C:\Windows\System\COtUjxZ.exe
  2⤵
  PID:5264
- C:\Windows\System\OmVjdFW.exe
  C:\Windows\System\OmVjdFW.exe
  2⤵
  PID:5316
- C:\Windows\System\AKZtqcx.exe
  C:\Windows\System\AKZtqcx.exe
  2⤵
  PID:5372
- C:\Windows\System\GVFiJdP.exe
  C:\Windows\System\GVFiJdP.exe
  2⤵
  PID:5404
- C:\Windows\System\pzQCxbq.exe
  C:\Windows\System\pzQCxbq.exe
  2⤵
  PID:5484
- C:\Windows\System\rHfHqsO.exe
  C:\Windows\System\rHfHqsO.exe
  2⤵
  PID:5524
- C:\Windows\System\HBLWjpD.exe
  C:\Windows\System\HBLWjpD.exe
  2⤵
  PID:5552
- C:\Windows\System\obrTPDy.exe
  C:\Windows\System\obrTPDy.exe
  2⤵
  PID:5608
- C:\Windows\System\MMaTMmE.exe
  C:\Windows\System\MMaTMmE.exe
  2⤵
  PID:5660
- C:\Windows\System\TLRFKoA.exe
  C:\Windows\System\TLRFKoA.exe
  2⤵
  PID:5720
- C:\Windows\System\XEOBMWM.exe
  C:\Windows\System\XEOBMWM.exe
  2⤵
  PID:5804
- C:\Windows\System\TSMrQzo.exe
  C:\Windows\System\TSMrQzo.exe
  2⤵
  PID:5888
- C:\Windows\System\qBNxCeJ.exe
  C:\Windows\System\qBNxCeJ.exe
  2⤵
  PID:5972
- C:\Windows\System\cMCwPoA.exe
  C:\Windows\System\cMCwPoA.exe
  2⤵
  PID:6052
- C:\Windows\System\yrhtlxN.exe
  C:\Windows\System\yrhtlxN.exe
  2⤵
  PID:6132
- C:\Windows\System\xFaBxnI.exe
  C:\Windows\System\xFaBxnI.exe
  2⤵
  PID:5196
- C:\Windows\System\LEUFfFf.exe
  C:\Windows\System\LEUFfFf.exe
  2⤵
  PID:5344
- C:\Windows\System\shfquqS.exe
  C:\Windows\System\shfquqS.exe
  2⤵
  PID:5456
- C:\Windows\System\NUkXUmb.exe
  C:\Windows\System\NUkXUmb.exe
  2⤵
  PID:5548
- C:\Windows\System\VGYZBcW.exe
  C:\Windows\System\VGYZBcW.exe
  2⤵
  PID:5920
- C:\Windows\System\LcgSRUh.exe
  C:\Windows\System\LcgSRUh.exe
  2⤵
  PID:6004
- C:\Windows\System\SdbdshH.exe
  C:\Windows\System\SdbdshH.exe
  2⤵
  PID:5168
- C:\Windows\System\PKKUgck.exe
  C:\Windows\System\PKKUgck.exe
  2⤵
  PID:5512
- C:\Windows\System\tpxCqRW.exe
  C:\Windows\System\tpxCqRW.exe
  2⤵
  PID:5968
- C:\Windows\System\JpTybPa.exe
  C:\Windows\System\JpTybPa.exe
  2⤵
  PID:5792
- C:\Windows\System\kImsjst.exe
  C:\Windows\System\kImsjst.exe
  2⤵
  PID:6164
- C:\Windows\System\nIxIbbo.exe
  C:\Windows\System\nIxIbbo.exe
  2⤵
  PID:6192
- C:\Windows\System\lwJZTxI.exe
  C:\Windows\System\lwJZTxI.exe
  2⤵
  PID:6220
- C:\Windows\System\fxurIFQ.exe
  C:\Windows\System\fxurIFQ.exe
  2⤵
  PID:6244
- C:\Windows\System\svdfMUm.exe
  C:\Windows\System\svdfMUm.exe
  2⤵
  PID:6276
- C:\Windows\System\ZQdpPVl.exe
  C:\Windows\System\ZQdpPVl.exe
  2⤵
  PID:6304
- C:\Windows\System\sbLcmfZ.exe
  C:\Windows\System\sbLcmfZ.exe
  2⤵
  PID:6332
- C:\Windows\System\vekrFbQ.exe
  C:\Windows\System\vekrFbQ.exe
  2⤵
  PID:6360
- C:\Windows\System\AvPvfzj.exe
  C:\Windows\System\AvPvfzj.exe
  2⤵
  PID:6392
- C:\Windows\System\VzlBDCG.exe
  C:\Windows\System\VzlBDCG.exe
  2⤵
  PID:6428
- C:\Windows\System\JueoXSl.exe
  C:\Windows\System\JueoXSl.exe
  2⤵
  PID:6448
- C:\Windows\System\ynvQdXM.exe
  C:\Windows\System\ynvQdXM.exe
  2⤵
  PID:6484
- C:\Windows\System\GUJGyUq.exe
  C:\Windows\System\GUJGyUq.exe
  2⤵
  PID:6508
- C:\Windows\System\npFcqsv.exe
  C:\Windows\System\npFcqsv.exe
  2⤵
  PID:6532
- C:\Windows\System\gMEGzFu.exe
  C:\Windows\System\gMEGzFu.exe
  2⤵
  PID:6560
- C:\Windows\System\npcxFxz.exe
  C:\Windows\System\npcxFxz.exe
  2⤵
  PID:6584
- C:\Windows\System\REfKKfw.exe
  C:\Windows\System\REfKKfw.exe
  2⤵
  PID:6608
- C:\Windows\System\OQVqLLZ.exe
  C:\Windows\System\OQVqLLZ.exe
  2⤵
  PID:6640
- C:\Windows\System\fFDqlfT.exe
  C:\Windows\System\fFDqlfT.exe
  2⤵
  PID:6664
- C:\Windows\System\TwKldjA.exe
  C:\Windows\System\TwKldjA.exe
  2⤵
  PID:6692
- C:\Windows\System\EqqGMpX.exe
  C:\Windows\System\EqqGMpX.exe
  2⤵
  PID:6724
- C:\Windows\System\kTiAlCS.exe
  C:\Windows\System\kTiAlCS.exe
  2⤵
  PID:6752
- C:\Windows\System\aHtshna.exe
  C:\Windows\System\aHtshna.exe
  2⤵
  PID:6788
- C:\Windows\System\Lruotie.exe
  C:\Windows\System\Lruotie.exe
  2⤵
  PID:6808
- C:\Windows\System\tKRFzjy.exe
  C:\Windows\System\tKRFzjy.exe
  2⤵
  PID:6824
- C:\Windows\System\YxiknbM.exe
  C:\Windows\System\YxiknbM.exe
  2⤵
  PID:6852
- C:\Windows\System\oYunnVs.exe
  C:\Windows\System\oYunnVs.exe
  2⤵
  PID:6868
- C:\Windows\System\YUZvqSX.exe
  C:\Windows\System\YUZvqSX.exe
  2⤵
  PID:6904
- C:\Windows\System\KIucSvy.exe
  C:\Windows\System\KIucSvy.exe
  2⤵
  PID:6932
- C:\Windows\System\fBftPRE.exe
  C:\Windows\System\fBftPRE.exe
  2⤵
  PID:6964
- C:\Windows\System\WkrECBE.exe
  C:\Windows\System\WkrECBE.exe
  2⤵
  PID:6992
- C:\Windows\System\fTfGuTx.exe
  C:\Windows\System\fTfGuTx.exe
  2⤵
  PID:7028
- C:\Windows\System\cHEqics.exe
  C:\Windows\System\cHEqics.exe
  2⤵
  PID:7056
- C:\Windows\System\FwEuJvz.exe
  C:\Windows\System\FwEuJvz.exe
  2⤵
  PID:7076
- C:\Windows\System\bEQYSZG.exe
  C:\Windows\System\bEQYSZG.exe
  2⤵
  PID:7116
- C:\Windows\System\hUWtdkZ.exe
  C:\Windows\System\hUWtdkZ.exe
  2⤵
  PID:7140
- C:\Windows\System\XewYRNy.exe
  C:\Windows\System\XewYRNy.exe
  2⤵
  PID:5580
- C:\Windows\System\AepJMyL.exe
  C:\Windows\System\AepJMyL.exe
  2⤵
  PID:6180
- C:\Windows\System\CmzJcgG.exe
  C:\Windows\System\CmzJcgG.exe
  2⤵
  PID:6232
- C:\Windows\System\BaISdJz.exe
  C:\Windows\System\BaISdJz.exe
  2⤵
  PID:6320
- C:\Windows\System\PjtgSBY.exe
  C:\Windows\System\PjtgSBY.exe
  2⤵
  PID:6380
- C:\Windows\System\ugdQYHT.exe
  C:\Windows\System\ugdQYHT.exe
  2⤵
  PID:6440
- C:\Windows\System\NBGASHz.exe
  C:\Windows\System\NBGASHz.exe
  2⤵
  PID:6492
- C:\Windows\System\aGGLmbt.exe
  C:\Windows\System\aGGLmbt.exe
  2⤵
  PID:6596
- C:\Windows\System\zwVUZCc.exe
  C:\Windows\System\zwVUZCc.exe
  2⤵
  PID:6720
- C:\Windows\System\dBpwbJr.exe
  C:\Windows\System\dBpwbJr.exe
  2⤵
  PID:6744
- C:\Windows\System\mHLqJMU.exe
  C:\Windows\System\mHLqJMU.exe
  2⤵
  PID:6780
- C:\Windows\System\qqtdecl.exe
  C:\Windows\System\qqtdecl.exe
  2⤵
  PID:6920
- C:\Windows\System\PXHLyqz.exe
  C:\Windows\System\PXHLyqz.exe
  2⤵
  PID:6912
- C:\Windows\System\uxFrjXT.exe
  C:\Windows\System\uxFrjXT.exe
  2⤵
  PID:6976
- C:\Windows\System\EznTQNw.exe
  C:\Windows\System\EznTQNw.exe
  2⤵
  PID:7104
- C:\Windows\System\GZFcPXR.exe
  C:\Windows\System\GZFcPXR.exe
  2⤵
  PID:7096
- C:\Windows\System\hukVXGr.exe
  C:\Windows\System\hukVXGr.exe
  2⤵
  PID:5400
- C:\Windows\System\NBZyXiJ.exe
  C:\Windows\System\NBZyXiJ.exe
  2⤵
  PID:6340
- C:\Windows\System\ONyQVRv.exe
  C:\Windows\System\ONyQVRv.exe
  2⤵
  PID:6548
- C:\Windows\System\CMSgLUs.exe
  C:\Windows\System\CMSgLUs.exe
  2⤵
  PID:6740
- C:\Windows\System\MrJTXGg.exe
  C:\Windows\System\MrJTXGg.exe
  2⤵
  PID:6864
- C:\Windows\System\ILdVzAO.exe
  C:\Windows\System\ILdVzAO.exe
  2⤵
  PID:6888
- C:\Windows\System\hyFYgEf.exe
  C:\Windows\System\hyFYgEf.exe
  2⤵
  PID:7088
- C:\Windows\System\KrzpdLm.exe
  C:\Windows\System\KrzpdLm.exe
  2⤵
  PID:6288
- C:\Windows\System\vkGHNEy.exe
  C:\Windows\System\vkGHNEy.exe
  2⤵
  PID:6716
- C:\Windows\System\rbiCLnr.exe
  C:\Windows\System\rbiCLnr.exe
  2⤵
  PID:6860
- C:\Windows\System\LDAuPUO.exe
  C:\Windows\System\LDAuPUO.exe
  2⤵
  PID:6844
- C:\Windows\System\SXQWIHu.exe
  C:\Windows\System\SXQWIHu.exe
  2⤵
  PID:7176
- C:\Windows\System\WlalnWD.exe
  C:\Windows\System\WlalnWD.exe
  2⤵
  PID:7212
- C:\Windows\System\HjtOIRV.exe
  C:\Windows\System\HjtOIRV.exe
  2⤵
  PID:7240
- C:\Windows\System\ptJQFeS.exe
  C:\Windows\System\ptJQFeS.exe
  2⤵
  PID:7268
- C:\Windows\System\gyDoTMq.exe
  C:\Windows\System\gyDoTMq.exe
  2⤵
  PID:7304
- C:\Windows\System\OOGTOeB.exe
  C:\Windows\System\OOGTOeB.exe
  2⤵
  PID:7324
- C:\Windows\System\MgYyRGM.exe
  C:\Windows\System\MgYyRGM.exe
  2⤵
  PID:7352
- C:\Windows\System\MjKGvIg.exe
  C:\Windows\System\MjKGvIg.exe
  2⤵
  PID:7384
- C:\Windows\System\vgPIfun.exe
  C:\Windows\System\vgPIfun.exe
  2⤵
  PID:7412
- C:\Windows\System\eqSeCBW.exe
  C:\Windows\System\eqSeCBW.exe
  2⤵
  PID:7436
- C:\Windows\System\PJIBKak.exe
  C:\Windows\System\PJIBKak.exe
  2⤵
  PID:7464
- C:\Windows\System\sAesVyl.exe
  C:\Windows\System\sAesVyl.exe
  2⤵
  PID:7480
- C:\Windows\System\ROyJnTB.exe
  C:\Windows\System\ROyJnTB.exe
  2⤵
  PID:7516
- C:\Windows\System\TnYSPCQ.exe
  C:\Windows\System\TnYSPCQ.exe
  2⤵
  PID:7536
- C:\Windows\System\MwtaaQt.exe
  C:\Windows\System\MwtaaQt.exe
  2⤵
  PID:7564
- C:\Windows\System\PTHmiwv.exe
  C:\Windows\System\PTHmiwv.exe
  2⤵
  PID:7592
- C:\Windows\System\BUdpsZj.exe
  C:\Windows\System\BUdpsZj.exe
  2⤵
  PID:7624
- C:\Windows\System\IgCICKN.exe
  C:\Windows\System\IgCICKN.exe
  2⤵
  PID:7648
- C:\Windows\System\ikovULp.exe
  C:\Windows\System\ikovULp.exe
  2⤵
  PID:7676
- C:\Windows\System\uBTKIBO.exe
  C:\Windows\System\uBTKIBO.exe
  2⤵
  PID:7692
- C:\Windows\System\YrOGouV.exe
  C:\Windows\System\YrOGouV.exe
  2⤵
  PID:7724
- C:\Windows\System\MUGgRtc.exe
  C:\Windows\System\MUGgRtc.exe
  2⤵
  PID:7760
- C:\Windows\System\sfFIVxC.exe
  C:\Windows\System\sfFIVxC.exe
  2⤵
  PID:7792
- C:\Windows\System\AiaqklH.exe
  C:\Windows\System\AiaqklH.exe
  2⤵
  PID:7820
- C:\Windows\System\XFQDPAl.exe
  C:\Windows\System\XFQDPAl.exe
  2⤵
  PID:7856
- C:\Windows\System\GeCkOBc.exe
  C:\Windows\System\GeCkOBc.exe
  2⤵
  PID:7876
- C:\Windows\System\HkNPrPq.exe
  C:\Windows\System\HkNPrPq.exe
  2⤵
  PID:7900
- C:\Windows\System\wFzBLzl.exe
  C:\Windows\System\wFzBLzl.exe
  2⤵
  PID:7920
- C:\Windows\System\WHyCmyD.exe
  C:\Windows\System\WHyCmyD.exe
  2⤵
  PID:7960
- C:\Windows\System\NiOdCiy.exe
  C:\Windows\System\NiOdCiy.exe
  2⤵
  PID:7988
- C:\Windows\System\KmIaXFh.exe
  C:\Windows\System\KmIaXFh.exe
  2⤵
  PID:8024
- C:\Windows\System\EjIWhiE.exe
  C:\Windows\System\EjIWhiE.exe
  2⤵
  PID:8044
- C:\Windows\System\Tdyjxow.exe
  C:\Windows\System\Tdyjxow.exe
  2⤵
  PID:8080
- C:\Windows\System\NvpOtKr.exe
  C:\Windows\System\NvpOtKr.exe
  2⤵
  PID:8120
- C:\Windows\System\rekXZBV.exe
  C:\Windows\System\rekXZBV.exe
  2⤵
  PID:8148
- C:\Windows\System\RZtDEPa.exe
  C:\Windows\System\RZtDEPa.exe
  2⤵
  PID:8164
- C:\Windows\System\wWPgiWb.exe
  C:\Windows\System\wWPgiWb.exe
  2⤵
  PID:6300
- C:\Windows\System\YuzFLxI.exe
  C:\Windows\System\YuzFLxI.exe
  2⤵
  PID:7232
- C:\Windows\System\koTswuy.exe
  C:\Windows\System\koTswuy.exe
  2⤵
  PID:7228
- C:\Windows\System\cqWeIAj.exe
  C:\Windows\System\cqWeIAj.exe
  2⤵
  PID:7312
- C:\Windows\System\LrPxiYA.exe
  C:\Windows\System\LrPxiYA.exe
  2⤵
  PID:7424
- C:\Windows\System\eTvxveX.exe
  C:\Windows\System\eTvxveX.exe
  2⤵
  PID:7492
- C:\Windows\System\sPydoMJ.exe
  C:\Windows\System\sPydoMJ.exe
  2⤵
  PID:7588
- C:\Windows\System\xZFZOCP.exe
  C:\Windows\System\xZFZOCP.exe
  2⤵
  PID:7612
- C:\Windows\System\EMyDjUJ.exe
  C:\Windows\System\EMyDjUJ.exe
  2⤵
  PID:7604
- C:\Windows\System\KaojdAg.exe
  C:\Windows\System\KaojdAg.exe
  2⤵
  PID:7684
- C:\Windows\System\YEqiThw.exe
  C:\Windows\System\YEqiThw.exe
  2⤵
  PID:7780
- C:\Windows\System\VXwGdhg.exe
  C:\Windows\System\VXwGdhg.exe
  2⤵
  PID:7852
- C:\Windows\System\UCZuuQd.exe
  C:\Windows\System\UCZuuQd.exe
  2⤵
  PID:7908
- C:\Windows\System\wWAdmub.exe
  C:\Windows\System\wWAdmub.exe
  2⤵
  PID:7984
- C:\Windows\System\cYkunrU.exe
  C:\Windows\System\cYkunrU.exe
  2⤵
  PID:8060
- C:\Windows\System\SzYWSfp.exe
  C:\Windows\System\SzYWSfp.exe
  2⤵
  PID:8104
- C:\Windows\System\stBTAgf.exe
  C:\Windows\System\stBTAgf.exe
  2⤵
  PID:6796
- C:\Windows\System\JphDFkY.exe
  C:\Windows\System\JphDFkY.exe
  2⤵
  PID:7256
- C:\Windows\System\uCrYVEO.exe
  C:\Windows\System\uCrYVEO.exe
  2⤵
  PID:7408
- C:\Windows\System\KjjefmK.exe
  C:\Windows\System\KjjefmK.exe
  2⤵
  PID:7528
- C:\Windows\System\UKkKPGF.exe
  C:\Windows\System\UKkKPGF.exe
  2⤵
  PID:7636
- C:\Windows\System\mFNZEPC.exe
  C:\Windows\System\mFNZEPC.exe
  2⤵
  PID:7864
- C:\Windows\System\DcWGIOE.exe
  C:\Windows\System\DcWGIOE.exe
  2⤵
  PID:8040
- C:\Windows\System\qtpgqep.exe
  C:\Windows\System\qtpgqep.exe
  2⤵
  PID:8144
- C:\Windows\System\zGZRlXo.exe
  C:\Windows\System\zGZRlXo.exe
  2⤵
  PID:7252
- C:\Windows\System\YZyWkng.exe
  C:\Windows\System\YZyWkng.exe
  2⤵
  PID:7668
- C:\Windows\System\gHNzWzm.exe
  C:\Windows\System\gHNzWzm.exe
  2⤵
  PID:8020
- C:\Windows\System\AXXMmye.exe
  C:\Windows\System\AXXMmye.exe
  2⤵
  PID:7472
- C:\Windows\System\ryqtsCA.exe
  C:\Windows\System\ryqtsCA.exe
  2⤵
  PID:8004
- C:\Windows\System\WNQqGAh.exe
  C:\Windows\System\WNQqGAh.exe
  2⤵
  PID:8220
- C:\Windows\System\fQByuiM.exe
  C:\Windows\System\fQByuiM.exe
  2⤵
  PID:8244
- C:\Windows\System\GCUiDEF.exe
  C:\Windows\System\GCUiDEF.exe
  2⤵
  PID:8272
- C:\Windows\System\TpnZSkA.exe
  C:\Windows\System\TpnZSkA.exe
  2⤵
  PID:8300
- C:\Windows\System\buAFZbP.exe
  C:\Windows\System\buAFZbP.exe
  2⤵
  PID:8328
- C:\Windows\System\FjNLUAo.exe
  C:\Windows\System\FjNLUAo.exe
  2⤵
  PID:8356
- C:\Windows\System\dBSqmEv.exe
  C:\Windows\System\dBSqmEv.exe
  2⤵
  PID:8396
- C:\Windows\System\cQCyqRV.exe
  C:\Windows\System\cQCyqRV.exe
  2⤵
  PID:8428
- C:\Windows\System\qTvWgoR.exe
  C:\Windows\System\qTvWgoR.exe
  2⤵
  PID:8452
- C:\Windows\System\lZILmVp.exe
  C:\Windows\System\lZILmVp.exe
  2⤵
  PID:8468
- C:\Windows\System\VpQMfEu.exe
  C:\Windows\System\VpQMfEu.exe
  2⤵
  PID:8488
- C:\Windows\System\GIgtkxQ.exe
  C:\Windows\System\GIgtkxQ.exe
  2⤵
  PID:8512
- C:\Windows\System\cIzsXEW.exe
  C:\Windows\System\cIzsXEW.exe
  2⤵
  PID:8544
- C:\Windows\System\lrTQyRt.exe
  C:\Windows\System\lrTQyRt.exe
  2⤵
  PID:8576
- C:\Windows\System\hQyrraT.exe
  C:\Windows\System\hQyrraT.exe
  2⤵
  PID:8604
- C:\Windows\System\OEMacXb.exe
  C:\Windows\System\OEMacXb.exe
  2⤵
  PID:8624
- C:\Windows\System\YKAlamz.exe
  C:\Windows\System\YKAlamz.exe
  2⤵
  PID:8656
- C:\Windows\System\mJfpfLg.exe
  C:\Windows\System\mJfpfLg.exe
  2⤵
  PID:8696
- C:\Windows\System\MlSZPgZ.exe
  C:\Windows\System\MlSZPgZ.exe
  2⤵
  PID:8728
- C:\Windows\System\eEdrvKz.exe
  C:\Windows\System\eEdrvKz.exe
  2⤵
  PID:8760
- C:\Windows\System\ovqHQEN.exe
  C:\Windows\System\ovqHQEN.exe
  2⤵
  PID:8776
- C:\Windows\System\SebDFes.exe
  C:\Windows\System\SebDFes.exe
  2⤵
  PID:8804
- C:\Windows\System\XmbWJVL.exe
  C:\Windows\System\XmbWJVL.exe
  2⤵
  PID:8828
- C:\Windows\System\MFXsXeH.exe
  C:\Windows\System\MFXsXeH.exe
  2⤵
  PID:8864
- C:\Windows\System\xVagxVy.exe
  C:\Windows\System\xVagxVy.exe
  2⤵
  PID:8888
- C:\Windows\System\pRoRhGf.exe
  C:\Windows\System\pRoRhGf.exe
  2⤵
  PID:8912
- C:\Windows\System\maOffTz.exe
  C:\Windows\System\maOffTz.exe
  2⤵
  PID:8932
- C:\Windows\System\JhlWCHT.exe
  C:\Windows\System\JhlWCHT.exe
  2⤵
  PID:8952
- C:\Windows\System\oxubIoB.exe
  C:\Windows\System\oxubIoB.exe
  2⤵
  PID:8988
- C:\Windows\System\CKkrNBC.exe
  C:\Windows\System\CKkrNBC.exe
  2⤵
  PID:9020
- C:\Windows\System\dvZBRVL.exe
  C:\Windows\System\dvZBRVL.exe
  2⤵
  PID:9040
- C:\Windows\System\EUjbVkm.exe
  C:\Windows\System\EUjbVkm.exe
  2⤵
  PID:9076
- C:\Windows\System\kqEvwVk.exe
  C:\Windows\System\kqEvwVk.exe
  2⤵
  PID:9100
- C:\Windows\System\RpoaKJZ.exe
  C:\Windows\System\RpoaKJZ.exe
  2⤵
  PID:9128
- C:\Windows\System\ddiaWCU.exe
  C:\Windows\System\ddiaWCU.exe
  2⤵
  PID:9160
- C:\Windows\System\bLyHuce.exe
  C:\Windows\System\bLyHuce.exe
  2⤵
  PID:9192
- C:\Windows\System\JmLosMd.exe
  C:\Windows\System\JmLosMd.exe
  2⤵
  PID:7720
- C:\Windows\System\xBzEkXe.exe
  C:\Windows\System\xBzEkXe.exe
  2⤵
  PID:8212
- C:\Windows\System\raOxVjj.exe
  C:\Windows\System\raOxVjj.exe
  2⤵
  PID:8316
- C:\Windows\System\JiqqoSE.exe
  C:\Windows\System\JiqqoSE.exe
  2⤵
  PID:8412
- C:\Windows\System\iunPzQD.exe
  C:\Windows\System\iunPzQD.exe
  2⤵
  PID:8440
- C:\Windows\System\dLUcFNt.exe
  C:\Windows\System\dLUcFNt.exe
  2⤵
  PID:8536
- C:\Windows\System\SHjvaqx.exe
  C:\Windows\System\SHjvaqx.exe
  2⤵
  PID:8532
- C:\Windows\System\wtcooya.exe
  C:\Windows\System\wtcooya.exe
  2⤵
  PID:8668
- C:\Windows\System\VFYwHVe.exe
  C:\Windows\System\VFYwHVe.exe
  2⤵
  PID:8672
- C:\Windows\System\lapoXfK.exe
  C:\Windows\System\lapoXfK.exe
  2⤵
  PID:8800
- C:\Windows\System\XMGxbYr.exe
  C:\Windows\System\XMGxbYr.exe
  2⤵
  PID:8856
- C:\Windows\System\lqdxXkg.exe
  C:\Windows\System\lqdxXkg.exe
  2⤵
  PID:8924
- C:\Windows\System\TQHeiKj.exe
  C:\Windows\System\TQHeiKj.exe
  2⤵
  PID:9012
- C:\Windows\System\JEbIxDI.exe
  C:\Windows\System\JEbIxDI.exe
  2⤵
  PID:9032
- C:\Windows\System\GeImNfq.exe
  C:\Windows\System\GeImNfq.exe
  2⤵
  PID:9116
- C:\Windows\System\LkWigbF.exe
  C:\Windows\System\LkWigbF.exe
  2⤵
  PID:9156
- C:\Windows\System\lkjUNgr.exe
  C:\Windows\System\lkjUNgr.exe
  2⤵
  PID:9148
- C:\Windows\System\tTMVrLT.exe
  C:\Windows\System\tTMVrLT.exe
  2⤵
  PID:8232
- C:\Windows\System\bRERXOT.exe
  C:\Windows\System\bRERXOT.exe
  2⤵
  PID:8636
- C:\Windows\System\esnuSDA.exe
  C:\Windows\System\esnuSDA.exe
  2⤵
  PID:8596
- C:\Windows\System\eqwOhxt.exe
  C:\Windows\System\eqwOhxt.exe
  2⤵
  PID:8792
- C:\Windows\System\RJoszXx.exe
  C:\Windows\System\RJoszXx.exe
  2⤵
  PID:8980
- C:\Windows\System\pkIYUUn.exe
  C:\Windows\System\pkIYUUn.exe
  2⤵
  PID:9068
- C:\Windows\System\VMFAxwL.exe
  C:\Windows\System\VMFAxwL.exe
  2⤵
  PID:8448
- C:\Windows\System\hDrgpZs.exe
  C:\Windows\System\hDrgpZs.exe
  2⤵
  PID:8496
- C:\Windows\System\DqqUJnG.exe
  C:\Windows\System\DqqUJnG.exe
  2⤵
  PID:8948
- C:\Windows\System\xMHUnLb.exe
  C:\Windows\System\xMHUnLb.exe
  2⤵
  PID:8320
- C:\Windows\System\jqxtdTx.exe
  C:\Windows\System\jqxtdTx.exe
  2⤵
  PID:9252
- C:\Windows\System\osJDAQz.exe
  C:\Windows\System\osJDAQz.exe
  2⤵
  PID:9284
- C:\Windows\System\GeBMGuN.exe
  C:\Windows\System\GeBMGuN.exe
  2⤵
  PID:9320
- C:\Windows\System\cOeJZkV.exe
  C:\Windows\System\cOeJZkV.exe
  2⤵
  PID:9356
- C:\Windows\System\YkxGwNP.exe
  C:\Windows\System\YkxGwNP.exe
  2⤵
  PID:9380
- C:\Windows\System\YjWFWfv.exe
  C:\Windows\System\YjWFWfv.exe
  2⤵
  PID:9408
- C:\Windows\System\fZYJlvV.exe
  C:\Windows\System\fZYJlvV.exe
  2⤵
  PID:9432
- C:\Windows\System\REvviDj.exe
  C:\Windows\System\REvviDj.exe
  2⤵
  PID:9460
- C:\Windows\System\QhavXfe.exe
  C:\Windows\System\QhavXfe.exe
  2⤵
  PID:9480
- C:\Windows\System\vHHKfpV.exe
  C:\Windows\System\vHHKfpV.exe
  2⤵
  PID:9508
- C:\Windows\System\GaIUMcM.exe
  C:\Windows\System\GaIUMcM.exe
  2⤵
  PID:9544
- C:\Windows\System\wJJYxGf.exe
  C:\Windows\System\wJJYxGf.exe
  2⤵
  PID:9572
- C:\Windows\System\VgUGhnP.exe
  C:\Windows\System\VgUGhnP.exe
  2⤵
  PID:9600
- C:\Windows\System\ASXRsoO.exe
  C:\Windows\System\ASXRsoO.exe
  2⤵
  PID:9616
- C:\Windows\System\BZAzFTh.exe
  C:\Windows\System\BZAzFTh.exe
  2⤵
  PID:9652
- C:\Windows\System\nKKrljp.exe
  C:\Windows\System\nKKrljp.exe
  2⤵
  PID:9676
- C:\Windows\System\rhiPzVQ.exe
  C:\Windows\System\rhiPzVQ.exe
  2⤵
  PID:9716
- C:\Windows\System\WkBneiW.exe
  C:\Windows\System\WkBneiW.exe
  2⤵
  PID:9744
- C:\Windows\System\xnvqbWt.exe
  C:\Windows\System\xnvqbWt.exe
  2⤵
  PID:9768
- C:\Windows\System\TrPNFdx.exe
  C:\Windows\System\TrPNFdx.exe
  2⤵
  PID:9800
- C:\Windows\System\GJitpAF.exe
  C:\Windows\System\GJitpAF.exe
  2⤵
  PID:9828
- C:\Windows\System\gEGJQys.exe
  C:\Windows\System\gEGJQys.exe
  2⤵
  PID:9848
- C:\Windows\System\mMrHFvl.exe
  C:\Windows\System\mMrHFvl.exe
  2⤵
  PID:9876
- C:\Windows\System\tsslwdu.exe
  C:\Windows\System\tsslwdu.exe
  2⤵
  PID:9904
- C:\Windows\System\PaOjIyQ.exe
  C:\Windows\System\PaOjIyQ.exe
  2⤵
  PID:9928
- C:\Windows\System\djRgXuR.exe
  C:\Windows\System\djRgXuR.exe
  2⤵
  PID:9956
- C:\Windows\System\vAZwMIP.exe
  C:\Windows\System\vAZwMIP.exe
  2⤵
  PID:9972
- C:\Windows\System\Omspbwe.exe
  C:\Windows\System\Omspbwe.exe
  2⤵
  PID:10000
- C:\Windows\System\mDOpawI.exe
  C:\Windows\System\mDOpawI.exe
  2⤵
  PID:10032
- C:\Windows\System\LtLcbRz.exe
  C:\Windows\System\LtLcbRz.exe
  2⤵
  PID:10052
- C:\Windows\System\oAKdMGM.exe
  C:\Windows\System\oAKdMGM.exe
  2⤵
  PID:10080
- C:\Windows\System\eMvmKwc.exe
  C:\Windows\System\eMvmKwc.exe
  2⤵
  PID:10108
- C:\Windows\System\QtkgvXW.exe
  C:\Windows\System\QtkgvXW.exe
  2⤵
  PID:10136
- C:\Windows\System\cRrILpd.exe
  C:\Windows\System\cRrILpd.exe
  2⤵
  PID:10168
- C:\Windows\System\fiprNdc.exe
  C:\Windows\System\fiprNdc.exe
  2⤵
  PID:10200
- C:\Windows\System\CJxkLiK.exe
  C:\Windows\System\CJxkLiK.exe
  2⤵
  PID:10220
- C:\Windows\System\BDEvrsN.exe
  C:\Windows\System\BDEvrsN.exe
  2⤵
  PID:8288
- C:\Windows\System\CcohJCN.exe
  C:\Windows\System\CcohJCN.exe
  2⤵
  PID:8900
- C:\Windows\System\cNODQJv.exe
  C:\Windows\System\cNODQJv.exe
  2⤵
  PID:9268
- C:\Windows\System\JYXdYCd.exe
  C:\Windows\System\JYXdYCd.exe
  2⤵
  PID:9364
- C:\Windows\System\TdXuHYu.exe
  C:\Windows\System\TdXuHYu.exe
  2⤵
  PID:9404
- C:\Windows\System\okydnPP.exe
  C:\Windows\System\okydnPP.exe
  2⤵
  PID:9488
- C:\Windows\System\WZDBYhr.exe
  C:\Windows\System\WZDBYhr.exe
  2⤵
  PID:9556
- C:\Windows\System\ZRzdFMy.exe
  C:\Windows\System\ZRzdFMy.exe
  2⤵
  PID:9628
- C:\Windows\System\leFctNb.exe
  C:\Windows\System\leFctNb.exe
  2⤵
  PID:9672
- C:\Windows\System\HusvblL.exe
  C:\Windows\System\HusvblL.exe
  2⤵
  PID:9684
- C:\Windows\System\TIPjqOg.exe
  C:\Windows\System\TIPjqOg.exe
  2⤵
  PID:9788
- C:\Windows\System\haQCWrN.exe
  C:\Windows\System\haQCWrN.exe
  2⤵
  PID:9840
- C:\Windows\System\iQDaajV.exe
  C:\Windows\System\iQDaajV.exe
  2⤵
  PID:9896
- C:\Windows\System\UONtNfQ.exe
  C:\Windows\System\UONtNfQ.exe
  2⤵
  PID:9912
- C:\Windows\System\eYHjsqL.exe
  C:\Windows\System\eYHjsqL.exe
  2⤵
  PID:10024
- C:\Windows\System\IRTSLYM.exe
  C:\Windows\System\IRTSLYM.exe
  2⤵
  PID:10100
- C:\Windows\System\AaPSAzH.exe
  C:\Windows\System\AaPSAzH.exe
  2⤵
  PID:10072
- C:\Windows\System\VxKzCYW.exe
  C:\Windows\System\VxKzCYW.exe
  2⤵
  PID:10192
- C:\Windows\System\VjATRvq.exe
  C:\Windows\System\VjATRvq.exe
  2⤵
  PID:10180
- C:\Windows\System\uJGCIhT.exe
  C:\Windows\System\uJGCIhT.exe
  2⤵
  PID:9312
- C:\Windows\System\kIbcOLO.exe
  C:\Windows\System\kIbcOLO.exe
  2⤵
  PID:9428
- C:\Windows\System\DVKUJJY.exe
  C:\Windows\System\DVKUJJY.exe
  2⤵
  PID:9700
- C:\Windows\System\rwWhzuU.exe
  C:\Windows\System\rwWhzuU.exe
  2⤵
  PID:9816
- C:\Windows\System\ultEhby.exe
  C:\Windows\System\ultEhby.exe
  2⤵
  PID:9884
- C:\Windows\System\hSMgFHm.exe
  C:\Windows\System\hSMgFHm.exe
  2⤵
  PID:10096
- C:\Windows\System\RxkUPyP.exe
  C:\Windows\System\RxkUPyP.exe
  2⤵
  PID:9640
- C:\Windows\System\kAhqnSG.exe
  C:\Windows\System\kAhqnSG.exe
  2⤵
  PID:9140
- C:\Windows\System\GZDPmsM.exe
  C:\Windows\System\GZDPmsM.exe
  2⤵
  PID:10256
- C:\Windows\System\DjoUTEF.exe
  C:\Windows\System\DjoUTEF.exe
  2⤵
  PID:10288
- C:\Windows\System\DqNAbdj.exe
  C:\Windows\System\DqNAbdj.exe
  2⤵
  PID:10308
- C:\Windows\System\SVnEsim.exe
  C:\Windows\System\SVnEsim.exe
  2⤵
  PID:10336
- C:\Windows\System\AdegqEZ.exe
  C:\Windows\System\AdegqEZ.exe
  2⤵
  PID:10368
- C:\Windows\System\iiWEagT.exe
  C:\Windows\System\iiWEagT.exe
  2⤵
  PID:10400
- C:\Windows\System\wRJLxPi.exe
  C:\Windows\System\wRJLxPi.exe
  2⤵
  PID:10440
- C:\Windows\System\SDfDvvy.exe
  C:\Windows\System\SDfDvvy.exe
  2⤵
  PID:10476
- C:\Windows\System\dwobsJv.exe
  C:\Windows\System\dwobsJv.exe
  2⤵
  PID:10512
- C:\Windows\System\XzTJxQK.exe
  C:\Windows\System\XzTJxQK.exe
  2⤵
  PID:10536
- C:\Windows\System\pHyVtWh.exe
  C:\Windows\System\pHyVtWh.exe
  2⤵
  PID:10556
- C:\Windows\System\fgtOsda.exe
  C:\Windows\System\fgtOsda.exe
  2⤵
  PID:10588
- C:\Windows\System\QUZgqOC.exe
  C:\Windows\System\QUZgqOC.exe
  2⤵
  PID:10616
- C:\Windows\System\lsWrJTO.exe
  C:\Windows\System\lsWrJTO.exe
  2⤵
  PID:10648
- C:\Windows\System\BlTXmoo.exe
  C:\Windows\System\BlTXmoo.exe
  2⤵
  PID:10680
- C:\Windows\System\GufhsWd.exe
  C:\Windows\System\GufhsWd.exe
  2⤵
  PID:10704
- C:\Windows\System\otftRPm.exe
  C:\Windows\System\otftRPm.exe
  2⤵
  PID:10740
- C:\Windows\System\MwmpzFp.exe
  C:\Windows\System\MwmpzFp.exe
  2⤵
  PID:10772
- C:\Windows\System\OVoaRRZ.exe
  C:\Windows\System\OVoaRRZ.exe
  2⤵
  PID:10796
- C:\Windows\System\UTExKdd.exe
  C:\Windows\System\UTExKdd.exe
  2⤵
  PID:10832
- C:\Windows\System\TpHNXmR.exe
  C:\Windows\System\TpHNXmR.exe
  2⤵
  PID:10860
- C:\Windows\System\MsFOfOo.exe
  C:\Windows\System\MsFOfOo.exe
  2⤵
  PID:10892
- C:\Windows\System\zRcRyXh.exe
  C:\Windows\System\zRcRyXh.exe
  2⤵
  PID:10920
- C:\Windows\System\LqOagqA.exe
  C:\Windows\System\LqOagqA.exe
  2⤵
  PID:10944
- C:\Windows\System\PqrFscP.exe
  C:\Windows\System\PqrFscP.exe
  2⤵
  PID:10976
- C:\Windows\System\LtpMTCr.exe
  C:\Windows\System\LtpMTCr.exe
  2⤵
  PID:11008
- C:\Windows\System\bFOoRLZ.exe
  C:\Windows\System\bFOoRLZ.exe
  2⤵
  PID:11036
- C:\Windows\System\VvNORRy.exe
  C:\Windows\System\VvNORRy.exe
  2⤵
  PID:11064
- C:\Windows\System\YlsPmyB.exe
  C:\Windows\System\YlsPmyB.exe
  2⤵
  PID:11088
- C:\Windows\System\psXxBne.exe
  C:\Windows\System\psXxBne.exe
  2⤵
  PID:11108
- C:\Windows\System\hTpDQuX.exe
  C:\Windows\System\hTpDQuX.exe
  2⤵
  PID:11156
- C:\Windows\System\EiHWaJX.exe
  C:\Windows\System\EiHWaJX.exe
  2⤵
  PID:11172
- C:\Windows\System\yeuVxqz.exe
  C:\Windows\System\yeuVxqz.exe
  2⤵
  PID:11192
- C:\Windows\System\nbJIyeW.exe
  C:\Windows\System\nbJIyeW.exe
  2⤵
  PID:11240
- C:\Windows\System\uKXNBaq.exe
  C:\Windows\System\uKXNBaq.exe
  2⤵
  PID:11256
- C:\Windows\System\LgXbWYm.exe
  C:\Windows\System\LgXbWYm.exe
  2⤵
  PID:9400
- C:\Windows\System\lfOTIfg.exe
  C:\Windows\System\lfOTIfg.exe
  2⤵
  PID:8748
- C:\Windows\System\UDkSGRh.exe
  C:\Windows\System\UDkSGRh.exe
  2⤵
  PID:10276
- C:\Windows\System\eftkNLj.exe
  C:\Windows\System\eftkNLj.exe
  2⤵
  PID:10268
- C:\Windows\System\FMvrDIh.exe
  C:\Windows\System\FMvrDIh.exe
  2⤵
  PID:10456
- C:\Windows\System\CKJcdjJ.exe
  C:\Windows\System\CKJcdjJ.exe
  2⤵
  PID:10496
- C:\Windows\System\AuscpEy.exe
  C:\Windows\System\AuscpEy.exe
  2⤵
  PID:10552
- C:\Windows\System\TtcLDvg.exe
  C:\Windows\System\TtcLDvg.exe
  2⤵
  PID:10608
- C:\Windows\System\fvORIQM.exe
  C:\Windows\System\fvORIQM.exe
  2⤵
  PID:10696
- C:\Windows\System\CKqHQux.exe
  C:\Windows\System\CKqHQux.exe
  2⤵
  PID:10692
- C:\Windows\System\cZJJxtl.exe
  C:\Windows\System\cZJJxtl.exe
  2⤵
  PID:10804
- C:\Windows\System\poRwdQD.exe
  C:\Windows\System\poRwdQD.exe
  2⤵
  PID:10856
- C:\Windows\System\TQIthCj.exe
  C:\Windows\System\TQIthCj.exe
  2⤵
  PID:10940
- C:\Windows\System\KiTRSdV.exe
  C:\Windows\System\KiTRSdV.exe
  2⤵
  PID:11004
- C:\Windows\System\GbsqLqh.exe
  C:\Windows\System\GbsqLqh.exe
  2⤵
  PID:11076
- C:\Windows\System\rWtjYCW.exe
  C:\Windows\System\rWtjYCW.exe
  2⤵
  PID:11140
- C:\Windows\System\ryYdBTA.exe
  C:\Windows\System\ryYdBTA.exe
  2⤵
  PID:11208
- C:\Windows\System\UmcudTb.exe
  C:\Windows\System\UmcudTb.exe
  2⤵
  PID:10248
- C:\Windows\System\aPmNQAW.exe
  C:\Windows\System\aPmNQAW.exe
  2⤵
  PID:9992
- C:\Windows\System\cXmYNDv.exe
  C:\Windows\System\cXmYNDv.exe
  2⤵
  PID:10380
- C:\Windows\System\PxWNKQA.exe
  C:\Windows\System\PxWNKQA.exe
  2⤵
  PID:10420
- C:\Windows\System\iqxCEgV.exe
  C:\Windows\System\iqxCEgV.exe
  2⤵
  PID:10724
- C:\Windows\System\lxHtkHO.exe
  C:\Windows\System\lxHtkHO.exe
  2⤵
  PID:10844
- C:\Windows\System\ukvGsdA.exe
  C:\Windows\System\ukvGsdA.exe
  2⤵
  PID:10936
- C:\Windows\System\dIyoBxK.exe
  C:\Windows\System\dIyoBxK.exe
  2⤵
  PID:11024
- C:\Windows\System\oGNMiYS.exe
  C:\Windows\System\oGNMiYS.exe
  2⤵
  PID:11104
- C:\Windows\System\KSeIISK.exe
  C:\Windows\System\KSeIISK.exe
  2⤵
  PID:10040
- C:\Windows\System\pJGFnuY.exe
  C:\Windows\System\pJGFnuY.exe
  2⤵
  PID:10644
- C:\Windows\System\iaUDcpL.exe
  C:\Windows\System\iaUDcpL.exe
  2⤵
  PID:10972
- C:\Windows\System\CQgHxDX.exe
  C:\Windows\System\CQgHxDX.exe
  2⤵
  PID:11304
- C:\Windows\System\uhEpPoM.exe
  C:\Windows\System\uhEpPoM.exe
  2⤵
  PID:11332
- C:\Windows\System\zvjNhHr.exe
  C:\Windows\System\zvjNhHr.exe
  2⤵
  PID:11364
- C:\Windows\System\ARljLcF.exe
  C:\Windows\System\ARljLcF.exe
  2⤵
  PID:11392
- C:\Windows\System\uTZbyNK.exe
  C:\Windows\System\uTZbyNK.exe
  2⤵
  PID:11420
- C:\Windows\System\mTuGYXr.exe
  C:\Windows\System\mTuGYXr.exe
  2⤵
  PID:11444
- C:\Windows\System\kgFYJxU.exe
  C:\Windows\System\kgFYJxU.exe
  2⤵
  PID:11472
- C:\Windows\System\MLoYsdg.exe
  C:\Windows\System\MLoYsdg.exe
  2⤵
  PID:11488
- C:\Windows\System\oCKdXeh.exe
  C:\Windows\System\oCKdXeh.exe
  2⤵
  PID:11516
- C:\Windows\System\SOQSmYM.exe
  C:\Windows\System\SOQSmYM.exe
  2⤵
  PID:11540
- C:\Windows\System\ZmftChj.exe
  C:\Windows\System\ZmftChj.exe
  2⤵
  PID:11576
- C:\Windows\System\THSaBOu.exe
  C:\Windows\System\THSaBOu.exe
  2⤵
  PID:11596
- C:\Windows\System\JyXAHnk.exe
  C:\Windows\System\JyXAHnk.exe
  2⤵
  PID:11616
- C:\Windows\System\HszfNYC.exe
  C:\Windows\System\HszfNYC.exe
  2⤵
  PID:11648
- C:\Windows\System\klcvSDd.exe
  C:\Windows\System\klcvSDd.exe
  2⤵
  PID:11668
- C:\Windows\System\NSRsDru.exe
  C:\Windows\System\NSRsDru.exe
  2⤵
  PID:11700
- C:\Windows\System\pVgFuzm.exe
  C:\Windows\System\pVgFuzm.exe
  2⤵
  PID:11728
- C:\Windows\System\YXOhAlY.exe
  C:\Windows\System\YXOhAlY.exe
  2⤵
  PID:11760
- C:\Windows\System\XJFYUIO.exe
  C:\Windows\System\XJFYUIO.exe
  2⤵
  PID:11784
- C:\Windows\System\fbtJtiE.exe
  C:\Windows\System\fbtJtiE.exe
  2⤵
  PID:11816
- C:\Windows\System\leCRlFW.exe
  C:\Windows\System\leCRlFW.exe
  2⤵
  PID:11848
- C:\Windows\System\PbUIJaD.exe
  C:\Windows\System\PbUIJaD.exe
  2⤵
  PID:11880
- C:\Windows\System\OEBDmou.exe
  C:\Windows\System\OEBDmou.exe
  2⤵
  PID:11912
- C:\Windows\System\NubOXGf.exe
  C:\Windows\System\NubOXGf.exe
  2⤵
  PID:11944
- C:\Windows\System\wtuMyyW.exe
  C:\Windows\System\wtuMyyW.exe
  2⤵
  PID:11976
- C:\Windows\System\OgKjQts.exe
  C:\Windows\System\OgKjQts.exe
  2⤵
  PID:12000
- C:\Windows\System\jBesrCl.exe
  C:\Windows\System\jBesrCl.exe
  2⤵
  PID:12028
- C:\Windows\System\qvrKMaL.exe
  C:\Windows\System\qvrKMaL.exe
  2⤵
  PID:12068
- C:\Windows\System\DXThlFZ.exe
  C:\Windows\System\DXThlFZ.exe
  2⤵
  PID:12096
- C:\Windows\System\JoeNkXw.exe
  C:\Windows\System\JoeNkXw.exe
  2⤵
  PID:12120
- C:\Windows\System\mxzczlS.exe
  C:\Windows\System\mxzczlS.exe
  2⤵
  PID:12148
- C:\Windows\System\BffszlT.exe
  C:\Windows\System\BffszlT.exe
  2⤵
  PID:12180
- C:\Windows\System\OeBbifi.exe
  C:\Windows\System\OeBbifi.exe
  2⤵
  PID:12196
- C:\Windows\System\nxkenPP.exe
  C:\Windows\System\nxkenPP.exe
  2⤵
  PID:12224
- C:\Windows\System\anXvaBU.exe
  C:\Windows\System\anXvaBU.exe
  2⤵
  PID:12252
- C:\Windows\System\QOpYcmG.exe
  C:\Windows\System\QOpYcmG.exe
  2⤵
  PID:12280
- C:\Windows\System\qJiawNI.exe
  C:\Windows\System\qJiawNI.exe
  2⤵
  PID:11292
- C:\Windows\System\AdzCujC.exe
  C:\Windows\System\AdzCujC.exe
  2⤵
  PID:11324
- C:\Windows\System\aqPqSjU.exe
  C:\Windows\System\aqPqSjU.exe
  2⤵
  PID:11352
- C:\Windows\System\HCYzawL.exe
  C:\Windows\System\HCYzawL.exe
  2⤵
  PID:11356
- C:\Windows\System\PiLNbgd.exe
  C:\Windows\System\PiLNbgd.exe
  2⤵
  PID:11432
- C:\Windows\System\NHNYYoW.exe
  C:\Windows\System\NHNYYoW.exe
  2⤵
  PID:11560
- C:\Windows\System\AlpBjNZ.exe
  C:\Windows\System\AlpBjNZ.exe
  2⤵
  PID:11584
- C:\Windows\System\THJKqfE.exe
  C:\Windows\System\THJKqfE.exe
  2⤵
  PID:11684
- C:\Windows\System\tisevto.exe
  C:\Windows\System\tisevto.exe
  2⤵
  PID:11780
- C:\Windows\System\pEcidfn.exe
  C:\Windows\System\pEcidfn.exe
  2⤵
  PID:11712
- C:\Windows\System\jeKoATi.exe
  C:\Windows\System\jeKoATi.exe
  2⤵
  PID:11900
- C:\Windows\System\ccHQfrr.exe
  C:\Windows\System\ccHQfrr.exe
  2⤵
  PID:11836
- C:\Windows\System\ffaSUZk.exe
  C:\Windows\System\ffaSUZk.exe
  2⤵
  PID:11988
- C:\Windows\System\qLvjqHj.exe
  C:\Windows\System\qLvjqHj.exe
  2⤵
  PID:12044
- C:\Windows\System\DhQNfuQ.exe
  C:\Windows\System\DhQNfuQ.exe
  2⤵
  PID:12020
- C:\Windows\System\gZydjQA.exe
  C:\Windows\System\gZydjQA.exe
  2⤵
  PID:12172
- C:\Windows\System\UPUuCef.exe
  C:\Windows\System\UPUuCef.exe
  2⤵
  PID:12220
- C:\Windows\System\iTbhUTW.exe
  C:\Windows\System\iTbhUTW.exe
  2⤵
  PID:12244
- C:\Windows\System\nueHpZS.exe
  C:\Windows\System\nueHpZS.exe
  2⤵
  PID:12276
- C:\Windows\System\anPPrjE.exe
  C:\Windows\System\anPPrjE.exe
  2⤵
  PID:11388
- C:\Windows\System\RMITkhW.exe
  C:\Windows\System\RMITkhW.exe
  2⤵
  PID:11464
- C:\Windows\System\WXfHLtN.exe
  C:\Windows\System\WXfHLtN.exe
  2⤵
  PID:11696
- C:\Windows\System\OHawAfp.exe
  C:\Windows\System\OHawAfp.exe
  2⤵
  PID:11720
- C:\Windows\System\GZpxdza.exe
  C:\Windows\System\GZpxdza.exe
  2⤵
  PID:11796
- C:\Windows\System\AxzZWqe.exe
  C:\Windows\System\AxzZWqe.exe
  2⤵
  PID:12108
- C:\Windows\System\xBKQijH.exe
  C:\Windows\System\xBKQijH.exe
  2⤵
  PID:12164
- C:\Windows\System\lqsJkZg.exe
  C:\Windows\System\lqsJkZg.exe
  2⤵
  PID:11572
- C:\Windows\System\GOxViZJ.exe
  C:\Windows\System\GOxViZJ.exe
  2⤵
  PID:11508
- C:\Windows\System\asKijCM.exe
  C:\Windows\System\asKijCM.exe
  2⤵
  PID:12304
- C:\Windows\System\Jsgoxjd.exe
  C:\Windows\System\Jsgoxjd.exe
  2⤵
  PID:12328
- C:\Windows\System\yPjSCOL.exe
  C:\Windows\System\yPjSCOL.exe
  2⤵
  PID:12360
- C:\Windows\System\LjkbACS.exe
  C:\Windows\System\LjkbACS.exe
  2⤵
  PID:12384
- C:\Windows\System\NRaGXcY.exe
  C:\Windows\System\NRaGXcY.exe
  2⤵
  PID:12412
- C:\Windows\System\zfEjJgc.exe
  C:\Windows\System\zfEjJgc.exe
  2⤵
  PID:12436
- C:\Windows\System\UFlavng.exe
  C:\Windows\System\UFlavng.exe
  2⤵
  PID:12468
- C:\Windows\System\vbTakwy.exe
  C:\Windows\System\vbTakwy.exe
  2⤵
  PID:12496
- C:\Windows\System\roodIyx.exe
  C:\Windows\System\roodIyx.exe
  2⤵
  PID:12524
- C:\Windows\System\xqWVvII.exe
  C:\Windows\System\xqWVvII.exe
  2⤵
  PID:12540
- C:\Windows\System\jgXpcZU.exe
  C:\Windows\System\jgXpcZU.exe
  2⤵
  PID:12572
- C:\Windows\System\rPcNkCp.exe
  C:\Windows\System\rPcNkCp.exe
  2⤵
  PID:12608
- C:\Windows\System\ZwNQApQ.exe
  C:\Windows\System\ZwNQApQ.exe
  2⤵
  PID:12640
- C:\Windows\System\KSDAguX.exe
  C:\Windows\System\KSDAguX.exe
  2⤵
  PID:12668
- C:\Windows\System\EnWqkVp.exe
  C:\Windows\System\EnWqkVp.exe
  2⤵
  PID:12688
- C:\Windows\System\ROqmpcw.exe
  C:\Windows\System\ROqmpcw.exe
  2⤵
  PID:12720
- C:\Windows\System\SWuPNBA.exe
  C:\Windows\System\SWuPNBA.exe
  2⤵
  PID:12748
- C:\Windows\System\osHnvoW.exe
  C:\Windows\System\osHnvoW.exe
  2⤵
  PID:12776
- C:\Windows\System\OAiemIe.exe
  C:\Windows\System\OAiemIe.exe
  2⤵
  PID:12800
- C:\Windows\System\FRXxTeB.exe
  C:\Windows\System\FRXxTeB.exe
  2⤵
  PID:12828
- C:\Windows\System\BqfRmRo.exe
  C:\Windows\System\BqfRmRo.exe
  2⤵
  PID:12860
- C:\Windows\System\sdsSKXj.exe
  C:\Windows\System\sdsSKXj.exe
  2⤵
  PID:12876
- C:\Windows\System\ZnkTzbR.exe
  C:\Windows\System\ZnkTzbR.exe
  2⤵
  PID:12912
- C:\Windows\System\WFgelbW.exe
  C:\Windows\System\WFgelbW.exe
  2⤵
  PID:12940
- C:\Windows\System\ZiZQmrR.exe
  C:\Windows\System\ZiZQmrR.exe
  2⤵
  PID:12972
- C:\Windows\System\BxPRmLt.exe
  C:\Windows\System\BxPRmLt.exe
  2⤵
  PID:13000
- C:\Windows\System\oRogUjS.exe
  C:\Windows\System\oRogUjS.exe
  2⤵
  PID:13024
- C:\Windows\System\bElsENf.exe
  C:\Windows\System\bElsENf.exe
  2⤵
  PID:13052
- C:\Windows\System\swFznOR.exe
  C:\Windows\System\swFznOR.exe
  2⤵
  PID:13080
- C:\Windows\System\XTrxiBD.exe
  C:\Windows\System\XTrxiBD.exe
  2⤵
  PID:13108
- C:\Windows\System\MFOfXcL.exe
  C:\Windows\System\MFOfXcL.exe
  2⤵
  PID:13136
- C:\Windows\System\cHROgKH.exe
  C:\Windows\System\cHROgKH.exe
  2⤵
  PID:13152
- C:\Windows\System\SCpztTy.exe
  C:\Windows\System\SCpztTy.exe
  2⤵
  PID:13184
- C:\Windows\System\iRKyagQ.exe
  C:\Windows\System\iRKyagQ.exe
  2⤵
  PID:13212
- C:\Windows\System\DXtQEQP.exe
  C:\Windows\System\DXtQEQP.exe
  2⤵
  PID:13248
- C:\Windows\System\MqIYIsR.exe
  C:\Windows\System\MqIYIsR.exe
  2⤵
  PID:13280
- C:\Windows\System\MORVpIr.exe
  C:\Windows\System\MORVpIr.exe
  2⤵
  PID:13308
- C:\Windows\System\XzAmhKb.exe
  C:\Windows\System\XzAmhKb.exe
  2⤵
  PID:10424
- C:\Windows\System\ZLChNqg.exe
  C:\Windows\System\ZLChNqg.exe
  2⤵
  PID:12340
- C:\Windows\System\nzuLcVO.exe
  C:\Windows\System\nzuLcVO.exe
  2⤵
  PID:12372
- C:\Windows\System\MPSNPEr.exe
  C:\Windows\System\MPSNPEr.exe
  2⤵
  PID:12216
- C:\Windows\System\KGLysXg.exe
  C:\Windows\System\KGLysXg.exe
  2⤵
  PID:12376
- C:\Windows\System\DlYzCLI.exe
  C:\Windows\System\DlYzCLI.exe
  2⤵
  PID:12512
- C:\Windows\System\rkmiaMe.exe
  C:\Windows\System\rkmiaMe.exe
  2⤵
  PID:12532
- C:\Windows\System\ZxVIpes.exe
  C:\Windows\System\ZxVIpes.exe
  2⤵
  PID:12624
- C:\Windows\System\TGdbchi.exe
  C:\Windows\System\TGdbchi.exe
  2⤵
  PID:12712
- C:\Windows\System\EGYdowf.exe
  C:\Windows\System\EGYdowf.exe
  2⤵
  PID:12768
- C:\Windows\System\grtjhlP.exe
  C:\Windows\System\grtjhlP.exe
  2⤵
  PID:12824
- C:\Windows\System\LYGNAVS.exe
  C:\Windows\System\LYGNAVS.exe
  2⤵
  PID:12960
- C:\Windows\System\CAiGGcw.exe
  C:\Windows\System\CAiGGcw.exe
  2⤵
  PID:13020
- C:\Windows\System\AoavJLn.exe
  C:\Windows\System\AoavJLn.exe
  2⤵
  PID:12988
- C:\Windows\System\oRYXzYX.exe
  C:\Windows\System\oRYXzYX.exe
  2⤵
  PID:13120
- C:\Windows\System\TeuezXX.exe
  C:\Windows\System\TeuezXX.exe
  2⤵
  PID:13016
- C:\Windows\System\ojbdnqK.exe
  C:\Windows\System\ojbdnqK.exe
  2⤵
  PID:13224
- C:\Windows\System\NCvADeM.exe
  C:\Windows\System\NCvADeM.exe
  2⤵
  PID:13272
- C:\Windows\System\ooqFryv.exe
  C:\Windows\System\ooqFryv.exe
  2⤵
  PID:13204
- C:\Windows\System\EToPueS.exe
  C:\Windows\System\EToPueS.exe
  2⤵
  PID:12208
- C:\Windows\System\qmRQIXX.exe
  C:\Windows\System\qmRQIXX.exe
  2⤵
  PID:12592
- C:\Windows\System\lAoaTmW.exe
  C:\Windows\System\lAoaTmW.exe
  2⤵
  PID:11992
- C:\Windows\System\PHGAmQt.exe
  C:\Windows\System\PHGAmQt.exe
  2⤵
  PID:12488
- C:\Windows\System\WYERfhX.exe
  C:\Windows\System\WYERfhX.exe
  2⤵
  PID:12556
- C:\Windows\System\WwhkIZM.exe
  C:\Windows\System\WwhkIZM.exe
  2⤵
  PID:12808
- C:\Windows\System\EATQHPL.exe
  C:\Windows\System\EATQHPL.exe
  2⤵
  PID:12736
- C:\Windows\System\IqkjbuT.exe
  C:\Windows\System\IqkjbuT.exe
  2⤵
  PID:13012
- C:\Windows\System\lZQaCYE.exe
  C:\Windows\System\lZQaCYE.exe
  2⤵
  PID:13324
- C:\Windows\System\cRChJKc.exe
  C:\Windows\System\cRChJKc.exe
  2⤵
  PID:13352
- C:\Windows\System\OXLoruQ.exe
  C:\Windows\System\OXLoruQ.exe
  2⤵
  PID:13384
- C:\Windows\System\hpjSPnu.exe
  C:\Windows\System\hpjSPnu.exe
  2⤵
  PID:13416
- C:\Windows\System\uxXtasy.exe
  C:\Windows\System\uxXtasy.exe
  2⤵
  PID:13440
- C:\Windows\System\DGNRuBy.exe
  C:\Windows\System\DGNRuBy.exe
  2⤵
  PID:13464
- C:\Windows\System\LuqTDoH.exe
  C:\Windows\System\LuqTDoH.exe
  2⤵
  PID:13492
- C:\Windows\System\HaRZREq.exe
  C:\Windows\System\HaRZREq.exe
  2⤵
  PID:13528
- C:\Windows\System\ybXUPdh.exe
  C:\Windows\System\ybXUPdh.exe
  2⤵
  PID:13560
- C:\Windows\System\XHFavGI.exe
  C:\Windows\System\XHFavGI.exe
  2⤵
  PID:13588
- C:\Windows\System\HBZiMCL.exe
  C:\Windows\System\HBZiMCL.exe
  2⤵
  PID:13624
- C:\Windows\System\HorpwRH.exe
  C:\Windows\System\HorpwRH.exe
  2⤵
  PID:13640
- C:\Windows\System\idwZsEE.exe
  C:\Windows\System\idwZsEE.exe
  2⤵
  PID:13680
- C:\Windows\System\TXuOfFU.exe
  C:\Windows\System\TXuOfFU.exe
  2⤵
  PID:13844
- C:\Windows\System\vpMrgKk.exe
  C:\Windows\System\vpMrgKk.exe
  2⤵
  PID:13860
- C:\Windows\System\LgFVHfj.exe
  C:\Windows\System\LgFVHfj.exe
  2⤵
  PID:13888
- C:\Windows\System\SpkbSHh.exe
  C:\Windows\System\SpkbSHh.exe
  2⤵
  PID:13904
- C:\Windows\System\INsMcSS.exe
  C:\Windows\System\INsMcSS.exe
  2⤵
  PID:13928
- C:\Windows\System\yeRFgRP.exe
  C:\Windows\System\yeRFgRP.exe
  2⤵
  PID:13960
- C:\Windows\System\TrBKmit.exe
  C:\Windows\System\TrBKmit.exe
  2⤵
  PID:13988
- C:\Windows\System\nyitfGi.exe
  C:\Windows\System\nyitfGi.exe
  2⤵
  PID:14004
- C:\Windows\System\OykLbBc.exe
  C:\Windows\System\OykLbBc.exe
  2⤵
  PID:14052
- C:\Windows\System\vIHdWqO.exe
  C:\Windows\System\vIHdWqO.exe
  2⤵
  PID:14072
- C:\Windows\System\EMqCrND.exe
  C:\Windows\System\EMqCrND.exe
  2⤵
  PID:14100
- C:\Windows\System\Wsivrja.exe
  C:\Windows\System\Wsivrja.exe
  2⤵
  PID:14128
- C:\Windows\System\XKZUuwk.exe
  C:\Windows\System\XKZUuwk.exe
  2⤵
  PID:14144
- C:\Windows\System\rwBMAkY.exe
  C:\Windows\System\rwBMAkY.exe
  2⤵
  PID:14180
- C:\Windows\System\sHkgqYh.exe
  C:\Windows\System\sHkgqYh.exe
  2⤵
  PID:14196
- C:\Windows\System\yhhaJbv.exe
  C:\Windows\System\yhhaJbv.exe
  2⤵
  PID:14216
- C:\Windows\System\yBXpkDG.exe
  C:\Windows\System\yBXpkDG.exe
  2⤵
  PID:14244
- C:\Windows\System\NJZEpaQ.exe
  C:\Windows\System\NJZEpaQ.exe
  2⤵
  PID:14276
- C:\Windows\System\IOKMNPv.exe
  C:\Windows\System\IOKMNPv.exe
  2⤵
  PID:14300
- C:\Windows\System\NUStBfm.exe
  C:\Windows\System\NUStBfm.exe
  2⤵
  PID:14316
- C:\Windows\System\gCycSkv.exe
  C:\Windows\System\gCycSkv.exe
  2⤵
  PID:12508
- C:\Windows\System\yWFKBNa.exe
  C:\Windows\System\yWFKBNa.exe
  2⤵
  PID:12424
- C:\Windows\System\sjUxdAa.exe
  C:\Windows\System\sjUxdAa.exe
  2⤵
  PID:13320
- C:\Windows\System\EyzlUQA.exe
  C:\Windows\System\EyzlUQA.exe
  2⤵
  PID:13372
- C:\Windows\System\vghmIqx.exe
  C:\Windows\System\vghmIqx.exe
  2⤵
  PID:13072
- C:\Windows\System\RlhDJVi.exe
  C:\Windows\System\RlhDJVi.exe
  2⤵
  PID:13452
- C:\Windows\System\krIPijt.exe
  C:\Windows\System\krIPijt.exe
  2⤵
  PID:13412
- C:\Windows\System\dFJqcHT.exe
  C:\Windows\System\dFJqcHT.exe
  2⤵
  PID:13672
- C:\Windows\System\iGiKeVg.exe
  C:\Windows\System\iGiKeVg.exe
  2⤵
  PID:13620
- C:\Windows\System\HIalkfG.exe
  C:\Windows\System\HIalkfG.exe
  2⤵
  PID:13736
- C:\Windows\System\vRbIXND.exe
  C:\Windows\System\vRbIXND.exe
  2⤵
  PID:13840
- C:\Windows\System\fXIvfIY.exe
  C:\Windows\System\fXIvfIY.exe
  2⤵
  PID:13924
- C:\Windows\System\Tqlczdi.exe
  C:\Windows\System\Tqlczdi.exe
  2⤵
  PID:13980
- C:\Windows\System\pnShHJv.exe
  C:\Windows\System\pnShHJv.exe
  2⤵
  PID:14068
- C:\Windows\System\IlVWTgg.exe
  C:\Windows\System\IlVWTgg.exe
  2⤵
  PID:14116
- C:\Windows\System\MrnCege.exe
  C:\Windows\System\MrnCege.exe
  2⤵
  PID:14156
- C:\Windows\System\SntQvrY.exe
  C:\Windows\System\SntQvrY.exe
  2⤵
  PID:14240
- C:\Windows\System\bSCWXEz.exe
  C:\Windows\System\bSCWXEz.exe
  2⤵
  PID:14288
- C:\Windows\System\wXDcFDU.exe
  C:\Windows\System\wXDcFDU.exe
  2⤵
  PID:13264
- C:\Windows\System\DNXmsYH.exe
  C:\Windows\System\DNXmsYH.exe
  2⤵
  PID:13344
- C:\Windows\System\zxKBFnD.exe
  C:\Windows\System\zxKBFnD.exe
  2⤵
  PID:13480
- C:\Windows\System\XgwTnyN.exe
  C:\Windows\System\XgwTnyN.exe
  2⤵
  PID:13556
- C:\Windows\System\ackvbXc.exe
  C:\Windows\System\ackvbXc.exe
  2⤵
  PID:13704
- C:\Windows\System\yIFheKg.exe
  C:\Windows\System\yIFheKg.exe
  2⤵
  PID:13776
- C:\Windows\System\SaPGrrn.exe
  C:\Windows\System\SaPGrrn.exe
  2⤵
  PID:14020
- C:\Windows\System\QwwJlWA.exe
  C:\Windows\System\QwwJlWA.exe
  2⤵
  PID:11824
- C:\Windows\System\fWXpFlD.exe
  C:\Windows\System\fWXpFlD.exe
  2⤵
  PID:14228
- C:\Windows\System\NKoGzZo.exe
  C:\Windows\System\NKoGzZo.exe
  2⤵
  PID:13700
- C:\Windows\System\kCiYCPe.exe
  C:\Windows\System\kCiYCPe.exe
  2⤵
  PID:13616
- C:\Windows\System\KMDMkUN.exe
  C:\Windows\System\KMDMkUN.exe
  2⤵
  PID:13524
- C:\Windows\System\bxShsNS.exe
  C:\Windows\System\bxShsNS.exe
  2⤵
  PID:14340
- C:\Windows\System\ZHDRzkf.exe
  C:\Windows\System\ZHDRzkf.exe
  2⤵
  PID:14368
- C:\Windows\System\aGvkOnH.exe
  C:\Windows\System\aGvkOnH.exe
  2⤵
  PID:14388
- C:\Windows\System\EZFVQDq.exe
  C:\Windows\System\EZFVQDq.exe
  2⤵
  PID:14416
- C:\Windows\System\GkTrXbZ.exe
  C:\Windows\System\GkTrXbZ.exe
  2⤵
  PID:14452
- C:\Windows\System\tZRoiFR.exe
  C:\Windows\System\tZRoiFR.exe
  2⤵
  PID:14488
- C:\Windows\System\DAsHbQY.exe
  C:\Windows\System\DAsHbQY.exe
  2⤵
  PID:14516
- C:\Windows\System\mlcOAAE.exe
  C:\Windows\System\mlcOAAE.exe
  2⤵
  PID:14536
- C:\Windows\System\xAaHgoZ.exe
  C:\Windows\System\xAaHgoZ.exe
  2⤵
  PID:14564
- C:\Windows\System\sobQnkP.exe
  C:\Windows\System\sobQnkP.exe
  2⤵
  PID:14596
- C:\Windows\System\RKcVUMK.exe
  C:\Windows\System\RKcVUMK.exe
  2⤵
  PID:14616
- C:\Windows\System\IRuixwi.exe
  C:\Windows\System\IRuixwi.exe
  2⤵
  PID:14656
- C:\Windows\System\eruYOTD.exe
  C:\Windows\System\eruYOTD.exe
  2⤵
  PID:14680
- C:\Windows\System\QgDGgpk.exe
  C:\Windows\System\QgDGgpk.exe
  2⤵
  PID:14708
- C:\Windows\System\uUzzqJO.exe
  C:\Windows\System\uUzzqJO.exe
  2⤵
  PID:14728
- C:\Windows\System\FwLtlmB.exe
  C:\Windows\System\FwLtlmB.exe
  2⤵
  PID:14760
- C:\Windows\System\fifspbu.exe
  C:\Windows\System\fifspbu.exe
  2⤵
  PID:14780
- C:\Windows\System\KsDSkLk.exe
  C:\Windows\System\KsDSkLk.exe
  2⤵
  PID:14800
- C:\Windows\System\LMqnfXB.exe
  C:\Windows\System\LMqnfXB.exe
  2⤵
  PID:14824
- C:\Windows\System\YXCnqkl.exe
  C:\Windows\System\YXCnqkl.exe
  2⤵
  PID:14848
- C:\Windows\System\ljcJidH.exe
  C:\Windows\System\ljcJidH.exe
  2⤵
  PID:14876
- C:\Windows\System\CUlNjoh.exe
  C:\Windows\System\CUlNjoh.exe
  2⤵
  PID:14908
- C:\Windows\System\iCytbwt.exe
  C:\Windows\System\iCytbwt.exe
  2⤵
  PID:14940
- C:\Windows\System\RebhnEG.exe
  C:\Windows\System\RebhnEG.exe
  2⤵
  PID:14968
- C:\Windows\System\bOETtAY.exe
  C:\Windows\System\bOETtAY.exe
  2⤵
  PID:15008
- C:\Windows\System\mzSkdGx.exe
  C:\Windows\System\mzSkdGx.exe
  2⤵
  PID:15036
- C:\Windows\System\hRnqDNh.exe
  C:\Windows\System\hRnqDNh.exe
  2⤵
  PID:15072
- C:\Windows\System\sKhgpOG.exe
  C:\Windows\System\sKhgpOG.exe
  2⤵
  PID:15100
- C:\Windows\System\MbvTiOy.exe
  C:\Windows\System\MbvTiOy.exe
  2⤵
  PID:15136
- C:\Windows\System\KIkVzmE.exe
  C:\Windows\System\KIkVzmE.exe
  2⤵
  PID:15152
- C:\Windows\System\PmeRGar.exe
  C:\Windows\System\PmeRGar.exe
  2⤵
  PID:15176
- C:\Windows\System\dTBXtrS.exe
  C:\Windows\System\dTBXtrS.exe
  2⤵
  PID:15208
- C:\Windows\System\WJBmeng.exe
  C:\Windows\System\WJBmeng.exe
  2⤵
  PID:15232
- C:\Windows\System\kvrkSNU.exe
  C:\Windows\System\kvrkSNU.exe
  2⤵
  PID:15252
- C:\Windows\System\esiAUPk.exe
  C:\Windows\System\esiAUPk.exe
  2⤵
  PID:15276
- C:\Windows\System\rkJzhrL.exe
  C:\Windows\System\rkJzhrL.exe
  2⤵
  PID:15292
- C:\Windows\System\IlkVcTC.exe
  C:\Windows\System\IlkVcTC.exe
  2⤵
  PID:15316
- C:\Windows\System\xFjwsud.exe
  C:\Windows\System\xFjwsud.exe
  2⤵
  PID:15348
- C:\Windows\System\ognuiPD.exe
  C:\Windows\System\ognuiPD.exe
  2⤵
  PID:13872
- C:\Windows\System\XBBHjai.exe
  C:\Windows\System\XBBHjai.exe
  2⤵
  PID:14424
- C:\Windows\System\jncXUTd.exe
  C:\Windows\System\jncXUTd.exe
  2⤵
  PID:14500
- C:\Windows\System\VARFEhv.exe
  C:\Windows\System\VARFEhv.exe
  2⤵
  PID:14532
- C:\Windows\System\erpMuKT.exe
  C:\Windows\System\erpMuKT.exe
  2⤵
  PID:14584
- C:\Windows\System\FReEuPO.exe
  C:\Windows\System\FReEuPO.exe
  2⤵
  PID:13568
- C:\Windows\System\OAkjiMj.exe
  C:\Windows\System\OAkjiMj.exe
  2⤵
  PID:14704
- C:\Windows\System\WIVlFfB.exe
  C:\Windows\System\WIVlFfB.exe
  2⤵
  PID:14820
- C:\Windows\System\UmLBdhu.exe
  C:\Windows\System\UmLBdhu.exe
  2⤵
  PID:14864
- C:\Windows\System\BFiHDsx.exe
  C:\Windows\System\BFiHDsx.exe
  2⤵
  PID:14836
- C:\Windows\System\LmRFRsp.exe
  C:\Windows\System\LmRFRsp.exe
  2⤵
  PID:14960
- C:\Windows\System\bvISFrB.exe
  C:\Windows\System\bvISFrB.exe
  2⤵
  PID:15060
- C:\Windows\System\timQuGS.exe
  C:\Windows\System\timQuGS.exe
  2⤵
  PID:15084
- C:\Windows\System\QDhhUAb.exe
  C:\Windows\System\QDhhUAb.exe
  2⤵
  PID:15148
- C:\Windows\System\bhSexGr.exe
  C:\Windows\System\bhSexGr.exe
  2⤵
  PID:15240
- C:\Windows\System\RznDonN.exe
  C:\Windows\System\RznDonN.exe
  2⤵
  PID:15264
- C:\Windows\System\gDMdskx.exe
  C:\Windows\System\gDMdskx.exe
  2⤵
  PID:15312
- C:\Windows\System\RmOwJax.exe
  C:\Windows\System\RmOwJax.exe
  2⤵
  PID:14404
- C:\Windows\System\TYpleZp.exe
  C:\Windows\System\TYpleZp.exe
  2⤵
  PID:14644
- C:\Windows\System\IdGNoUJ.exe
  C:\Windows\System\IdGNoUJ.exe
  2⤵
  PID:14480
- C:\Windows\System\eftPTjW.exe
  C:\Windows\System\eftPTjW.exe
  2⤵
  PID:14872
- C:\Windows\System\CoTXvjC.exe
  C:\Windows\System\CoTXvjC.exe
  2⤵
  PID:14840
- C:\Windows\System\XGdldAb.exe
  C:\Windows\System\XGdldAb.exe
  2⤵
  PID:15224
- C:\Windows\System\CHCyCKf.exe
  C:\Windows\System\CHCyCKf.exe
  2⤵
  PID:15188
- C:\Windows\System\YKqRsPs.exe
  C:\Windows\System\YKqRsPs.exe
  2⤵
  PID:15172
- C:\Windows\System\BQsKyBx.exe
  C:\Windows\System\BQsKyBx.exe
  2⤵
  PID:14576
- C:\Windows\System\MqLjcBy.exe
  C:\Windows\System\MqLjcBy.exe
  2⤵
  PID:15372
- C:\Windows\System\bPiuSNN.exe
  C:\Windows\System\bPiuSNN.exe
  2⤵
  PID:15400
- C:\Windows\System\ktWloEg.exe
  C:\Windows\System\ktWloEg.exe
  2⤵
  PID:15432
- C:\Windows\System\fHBfINw.exe
  C:\Windows\System\fHBfINw.exe
  2⤵
  PID:15456
- C:\Windows\System\AhLKJGy.exe
  C:\Windows\System\AhLKJGy.exe
  2⤵
  PID:15476
- C:\Windows\System\hwrEtzo.exe
  C:\Windows\System\hwrEtzo.exe
  2⤵
  PID:15500
- C:\Windows\System\KGGFrkD.exe
  C:\Windows\System\KGGFrkD.exe
  2⤵
  PID:15524
- C:\Windows\System\FVOnPDI.exe
  C:\Windows\System\FVOnPDI.exe
  2⤵
  PID:15544
- C:\Windows\System\JptZEGW.exe
  C:\Windows\System\JptZEGW.exe
  2⤵
  PID:15580
- C:\Windows\System\GSXHtKb.exe
  C:\Windows\System\GSXHtKb.exe
  2⤵
  PID:15604
- C:\Windows\System\rFTKWsG.exe
  C:\Windows\System\rFTKWsG.exe
  2⤵
  PID:15632
- C:\Windows\System\HgOqBou.exe
  C:\Windows\System\HgOqBou.exe
  2⤵
  PID:15664
- C:\Windows\System\FGSFuQW.exe
  C:\Windows\System\FGSFuQW.exe
  2⤵
  PID:15700
- C:\Windows\System\RLjCnCq.exe
  C:\Windows\System\RLjCnCq.exe
  2⤵
  PID:15732
- C:\Windows\System\SHGsVul.exe
  C:\Windows\System\SHGsVul.exe
  2⤵
  PID:15756
- C:\Windows\System\wBSCwlw.exe
  C:\Windows\System\wBSCwlw.exe
  2⤵
  PID:15784
- C:\Windows\System\MCjzWIh.exe
  C:\Windows\System\MCjzWIh.exe
  2⤵
  PID:15812
- C:\Windows\System\iNHOwfH.exe
  C:\Windows\System\iNHOwfH.exe
  2⤵
  PID:15844
- C:\Windows\System\qsUIvvb.exe
  C:\Windows\System\qsUIvvb.exe
  2⤵
  PID:15872
- C:\Windows\System\EIbqXog.exe
  C:\Windows\System\EIbqXog.exe
  2⤵
  PID:15892
- C:\Windows\System\KwIWseg.exe
  C:\Windows\System\KwIWseg.exe
  2⤵
  PID:15928
- C:\Windows\System\KaWKLwt.exe
  C:\Windows\System\KaWKLwt.exe
  2⤵
  PID:15952
- C:\Windows\System\UVTQfkX.exe
  C:\Windows\System\UVTQfkX.exe
  2⤵
  PID:15984
- C:\Windows\System\ahDgdEp.exe
  C:\Windows\System\ahDgdEp.exe
  2⤵
  PID:16012
- C:\Windows\System\pyQPrlh.exe
  C:\Windows\System\pyQPrlh.exe
  2⤵
  PID:16040
- C:\Windows\System\WjgzCZv.exe
  C:\Windows\System\WjgzCZv.exe
  2⤵
  PID:16064
- C:\Windows\System\eZSWKMN.exe
  C:\Windows\System\eZSWKMN.exe
  2⤵
  PID:16096
- C:\Windows\System\WTThZWJ.exe
  C:\Windows\System\WTThZWJ.exe
  2⤵
  PID:16120
- C:\Windows\System\YwnfzLO.exe
  C:\Windows\System\YwnfzLO.exe
  2⤵
  PID:16144
- C:\Windows\System\cDmPQlv.exe
  C:\Windows\System\cDmPQlv.exe
  2⤵
  PID:16176
- C:\Windows\System\SqzyLfH.exe
  C:\Windows\System\SqzyLfH.exe
  2⤵
  PID:16204
- C:\Windows\System\xmilaTE.exe
  C:\Windows\System\xmilaTE.exe
  2⤵
  PID:16240
- C:\Windows\System\GqPAKDa.exe
  C:\Windows\System\GqPAKDa.exe
  2⤵
  PID:16264
- C:\Windows\System\WvVTaXV.exe
  C:\Windows\System\WvVTaXV.exe
  2⤵
  PID:16296
- C:\Windows\System\cMbTHRR.exe
  C:\Windows\System\cMbTHRR.exe
  2⤵
  PID:16320
- C:\Windows\System\ZFDdRuf.exe
  C:\Windows\System\ZFDdRuf.exe
  2⤵
  PID:16336
- C:\Windows\System\fMlHtCl.exe
  C:\Windows\System\fMlHtCl.exe
  2⤵
  PID:16364
- C:\Windows\System\hkpsDob.exe
  C:\Windows\System\hkpsDob.exe
  2⤵
  PID:15304
- C:\Windows\System\rvxGEKm.exe
  C:\Windows\System\rvxGEKm.exe
  2⤵
  PID:15052
- C:\Windows\System\GlKdfnu.exe
  C:\Windows\System\GlKdfnu.exe
  2⤵
  PID:14384
- C:\Windows\System\EJnsFbK.exe
  C:\Windows\System\EJnsFbK.exe
  2⤵
  PID:15492
- C:\Windows\System\thGTUGE.exe
  C:\Windows\System\thGTUGE.exe
  2⤵
  PID:15424
- C:\Windows\System\RRVIUKp.exe
  C:\Windows\System\RRVIUKp.exe
  2⤵
  PID:15624
- C:\Windows\System\ROVaEpu.exe
  C:\Windows\System\ROVaEpu.exe
  2⤵
  PID:15620
- C:\Windows\System\pQaFHfp.exe
  C:\Windows\System\pQaFHfp.exe
  2⤵
  PID:15684
- C:\Windows\System\DNxMmrT.exe
  C:\Windows\System\DNxMmrT.exe
  2⤵
  PID:15796
- C:\Windows\System\LuMbUvH.exe
  C:\Windows\System\LuMbUvH.exe
  2⤵
  PID:15856
- C:\Windows\System\RUBvMji.exe
  C:\Windows\System\RUBvMji.exe
  2⤵
  PID:15884
- C:\Windows\System\nGWsmaz.exe
  C:\Windows\System\nGWsmaz.exe
  2⤵
  PID:15996
- C:\Windows\System\zlmTZEm.exe
  C:\Windows\System\zlmTZEm.exe
  2⤵
  PID:16056
- C:\Windows\System\zDiCjUb.exe
  C:\Windows\System\zDiCjUb.exe
  2⤵
  PID:16104
- C:\Windows\System\HPrfJAU.exe
  C:\Windows\System\HPrfJAU.exe
  2⤵
  PID:16052
- C:\Windows\System\qUCeWLi.exe
  C:\Windows\System\qUCeWLi.exe
  2⤵
  PID:16276
- C:\Windows\System\ZQBDoHS.exe
  C:\Windows\System\ZQBDoHS.exe
  2⤵
  PID:16352
- C:\Windows\System\rsoFKrr.exe
  C:\Windows\System\rsoFKrr.exe
  2⤵
  PID:16376
- C:\Windows\System\CyxsgQf.exe
  C:\Windows\System\CyxsgQf.exe
  2⤵
  PID:15612
- C:\Windows\System\leUoiIP.exe
  C:\Windows\System\leUoiIP.exe
  2⤵
  PID:14640
- C:\Windows\System\esUfDeJ.exe
  C:\Windows\System\esUfDeJ.exe
  2⤵
  PID:15600
- C:\Windows\System\pqYiFmv.exe
  C:\Windows\System\pqYiFmv.exe
  2⤵
  PID:15968
- C:\Windows\System\paNiRZO.exe
  C:\Windows\System\paNiRZO.exe
  2⤵
  PID:15908
- C:\Windows\System\zbfGzPq.exe
  C:\Windows\System\zbfGzPq.exe
  2⤵
  PID:16348
- C:\Windows\System\AnrHREl.exe
  C:\Windows\System\AnrHREl.exe
  2⤵
  PID:16252
- C:\Windows\System\hKNJZFj.exe
  C:\Windows\System\hKNJZFj.exe
  2⤵
  PID:16388
- C:\Windows\System\ftRPKwn.exe
  C:\Windows\System\ftRPKwn.exe
  2⤵
  PID:16412
- C:\Windows\System\jHelUhi.exe
  C:\Windows\System\jHelUhi.exe
  2⤵
  PID:16440
- C:\Windows\System\SfuFewZ.exe
  C:\Windows\System\SfuFewZ.exe
  2⤵
  PID:16468
- C:\Windows\System\adBNtLf.exe
  C:\Windows\System\adBNtLf.exe
  2⤵
  PID:16492
- C:\Windows\System\gjhNgdz.exe
  C:\Windows\System\gjhNgdz.exe
  2⤵
  PID:16520
- C:\Windows\System\BXsjooC.exe
  C:\Windows\System\BXsjooC.exe
  2⤵
  PID:16548
- C:\Windows\System\rdjbISE.exe
  C:\Windows\System\rdjbISE.exe
  2⤵
  PID:16588
- C:\Windows\System\WODTDtG.exe
  C:\Windows\System\WODTDtG.exe
  2⤵
  PID:16616
- C:\Windows\System\PCFKLpP.exe
  C:\Windows\System\PCFKLpP.exe
  2⤵
  PID:16640
- C:\Windows\System\fdvQLWv.exe
  C:\Windows\System\fdvQLWv.exe
  2⤵
  PID:16680
- C:\Windows\System\YRsndOi.exe
  C:\Windows\System\YRsndOi.exe
  2⤵
  PID:16708
- C:\Windows\System\wusGmwp.exe
  C:\Windows\System\wusGmwp.exe
  2⤵
  PID:16732
- C:\Windows\System\XrsDBIK.exe
  C:\Windows\System\XrsDBIK.exe
  2⤵
  PID:16756
- C:\Windows\System\YXCcEEA.exe
  C:\Windows\System\YXCcEEA.exe
  2⤵
  PID:16788
- C:\Windows\System\OtLTewE.exe
  C:\Windows\System\OtLTewE.exe
  2⤵
  PID:16804
- C:\Windows\System\ceBeTFE.exe
  C:\Windows\System\ceBeTFE.exe
  2⤵
  PID:16836
- C:\Windows\System\SrjFgrj.exe
  C:\Windows\System\SrjFgrj.exe
  2⤵
  PID:16864
- C:\Windows\System\PCqbzCa.exe
  C:\Windows\System\PCqbzCa.exe
  2⤵
  PID:16892
- C:\Windows\System\hrvpNGj.exe
  C:\Windows\System\hrvpNGj.exe
  2⤵
  PID:16916
- C:\Windows\System\cxAucrv.exe
  C:\Windows\System\cxAucrv.exe
  2⤵
  PID:16948
- C:\Windows\System\tvmNwUD.exe
  C:\Windows\System\tvmNwUD.exe
  2⤵
  PID:16976
- C:\Windows\System\DCcCgrg.exe
  C:\Windows\System\DCcCgrg.exe
  2⤵
  PID:17012
- C:\Windows\System\NOyezYF.exe
  C:\Windows\System\NOyezYF.exe
  2⤵
  PID:17044
- C:\Windows\System\EHGKzpi.exe
  C:\Windows\System\EHGKzpi.exe
  2⤵
  PID:17076
- C:\Windows\System\ARcIRte.exe
  C:\Windows\System\ARcIRte.exe
  2⤵
  PID:17108
- C:\Windows\System\DCSEUuL.exe
  C:\Windows\System\DCSEUuL.exe
  2⤵
  PID:17136
- C:\Windows\System\BwOUkOo.exe
  C:\Windows\System\BwOUkOo.exe
  2⤵
  PID:17168
- C:\Windows\System\LCZMXfc.exe
  C:\Windows\System\LCZMXfc.exe
  2⤵
  PID:17196
- C:\Windows\System\CLQuwPY.exe
  C:\Windows\System\CLQuwPY.exe
  2⤵
  PID:17232
- C:\Windows\System\gaIWpXE.exe
  C:\Windows\System\gaIWpXE.exe
  2⤵
  PID:17256
- C:\Windows\System\XVyKtGG.exe
  C:\Windows\System\XVyKtGG.exe
  2⤵
  PID:17284

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AQNvWfG.exe

Filesize
1.6MB

MD5
6957e7454293413909f050bc876d5102

SHA1
5f2bc7ce0e6d653ff9d6bc3c3bba7b043cce57c9

SHA256
4fb60edbe3ba03c219cb28c2dfc1578db646a378291d2c8ef0e4f12dc147733b

SHA512
8f5e3241df34f213ba50ef126a7317920ec70fa63cc6997ae42fff40ab19ae8264c3f9d682f7d1cac8a4c23ce29663a85bfd6c29afef6a9f6038252d223c50bb

Download Submit
C:\Windows\System\BEsMcpS.exe

Filesize
1.6MB

MD5
9f721e446bab948c663f39ae2b1bd060

SHA1
c981ff74ab1359ca7a98cf3dde9cc2daf46f3cb9

SHA256
d0b2cdc8a69f1cdba87c6926d09a1458dc6cdf27316752d24acccdfe18d71ed5

SHA512
8d9525a76cc980c5fbf98b8d9d40aa65ff0af69732a35edd772f09ff8e3be8011cd0d58b724a977585b9f1a812e5c3d8033fe256ee43c3b80d99397542f91200

Download Submit
C:\Windows\System\DMzDdyb.exe

Filesize
1.6MB

MD5
d7ce31de30d7ad1039be60446361c466

SHA1
fc47c9a7861b7ec926e630c94e644761f3fe439f

SHA256
b4d9fe1cc9911a55fe65ffbb2094eccc229a2cb71f4e5442429747fde29a370e

SHA512
147d01c6066620372e809ea8876b04a6691786ce024530ee0c99a219a8cb5b77cf0120d56fb0b57bacfec31e3f6ef4e9661e8f09da35d05645cddf1cd77c3510

Download Submit
C:\Windows\System\DwZnVkD.exe

Filesize
1.6MB

MD5
d1fe47b516ab7053f91c13923809dda1

SHA1
b4d052c01b90b9a04091f087063371da30903deb

SHA256
87f3865664fd199311a9d2623b642851e34b9e156395df8b375224b176b16805

SHA512
b88c2222c24af54d1aed3044b93910ae9a4d53e1adcf2a69e8459866d23cc1519d03ec75b633ecb4c4deab0c46deafacac5333c6b8027ae8c2ee26d70b8c103b

Download Submit
C:\Windows\System\FhREfWi.exe

Filesize
1.6MB

MD5
f1ae26be681d32d9db6839f635f01176

SHA1
9495b01d1899c309d6ef34d0e58f53de47264a16

SHA256
539607e211df28ec5e5894fdc42011086478740fb97779bba3d571bc5da5e961

SHA512
16496b16eeab8e7518f5b368ec21a38c48330035cc50383884a031e49d1bf4eb39af1376a579da5abf9f97588236e6bad58282cc944d13c2ad3ba87b28a8b035

Download Submit
C:\Windows\System\JYMqkmn.exe

Filesize
1.6MB

MD5
622b7bc18e8d92bed873b9f2da1f173d

SHA1
41ca41cd806b0d11639d704d89b0369390ce21e0

SHA256
441854974693e362c368ad2788eede5745c6fdf31d7edb77bf7e5f9225769cbc

SHA512
cb10db905b743c224a41e4919a012c64a01afee19f578f9bceb01ef4bcb27da427190ea16af023a47d4ac6ff885ff64d4a0566219d071873fe7cf92705ef6525

Download Submit
C:\Windows\System\KPDzxOv.exe

Filesize
1.6MB

MD5
c031ed8654980225d81013750b38e93b

SHA1
e0341acf407ce69e4798a2c1344f1b4d5a56e816

SHA256
97c87bcad7e1987908df3a041b2939ef24040d0aa06d8445ceb6f8b035fe834a

SHA512
691457e27cdeddca9b3a926ed2574d0dc6ae1d33686e5bdbeabf2e62252faac387dc0d8c555e39c476f064084e16c0ba51e5d01591ae8856311ef5b67588d5ed

Download Submit
C:\Windows\System\NeluELp.exe

Filesize
1.6MB

MD5
0601cdac67188e53b3733675a8e4d511

SHA1
62401850ff8ce7c7b2620f684d5e36f99483f12f

SHA256
164d947cb83e7895c4237b74d735bf0e4ec62081a87aabdcf31635100a5bb928

SHA512
3e8bfcb4b2978948bd7834f3dbf0c5465ab889eddcce1b02ffe4c5c97b3ae4a1f8d230fcbfdd623e09637942237d5226e5aefaa4eb09cb7b4358b615777fd805

Download Submit
C:\Windows\System\PAsfsis.exe

Filesize
1.6MB

MD5
cc8cf66e5bd0cb27120b8f73853250c8

SHA1
eba990d955efd54f2ed26f7ac08eaad0242d3afb

SHA256
e9386db1bdd539a763896d2478d12b06bab6dd73953d8e1641af5b3f17ee0d1f

SHA512
9ac1e2b4e51856a15d345bb70da3c78205efb8943d86abf979fdbc09fc44f8a08a37925db6bd89a10a7fbff16e3e8df9eb560976ab6ad0221d34d69ce3fcce73

Download Submit
C:\Windows\System\SeMTfRR.exe

Filesize
1.6MB

MD5
fca18ed8e40cf5611a598a712ab8bee2

SHA1
38c74490d585dc04fea067401e9f8fe8f4d9c657

SHA256
33fa0f933fbaf989c3cd15058562f2518fb3c33a843c630b40a968222b03a7b7

SHA512
a950b99f945818f5377c5391a86618cf0456e6b68584c22b2956a09cf8f8ada189a365e8e1b37cc29e74258240f1d1c310dc5d83b5cd5bef80f709e938e6d38c

Download Submit
C:\Windows\System\UBdqMLz.exe

Filesize
1.6MB

MD5
47cf941530c1f2fd03a43a9d7e568c3a

SHA1
6a933ac4aa9c33f5e37594e1f4da9a1a22fd0b06

SHA256
d3378fd3ae1b3b16635b89755d6bc424b82167690899b574ae9bc15950c7468d

SHA512
c1579faf4984d0243bb4a815f8ee035d37290144d1505bf9d0a8da5cfff11ed6132e7b3b98afcc00ce45b0807573cc4687a33672598bf2eecd42d9699841091d

Download Submit
C:\Windows\System\VSeWFWg.exe

Filesize
1.6MB

MD5
461c049ae030358cdba68b3f46d66fca

SHA1
19d2894d6a4ce5b0510cc43044824a46059f1703

SHA256
4032ae8baa1fe2ab7c4c19090eaf7b0a07f0685bb1d1826189cac11038145f2b

SHA512
d5e5c26813c1ce09089ec5df5013c311d0e65726a7cd2057b1e350524c17f319dde1bec2a2587b392e2292098e508c7d68017d19b40f44c0a2f5fddee2de32a8

Download Submit
C:\Windows\System\WZWeLpD.exe

Filesize
1.6MB

MD5
426cf19b5ccfa0cd2191d3ff3e7d4300

SHA1
dd5aa024b8fda0efd51344778a2943a0baa2581c

SHA256
201eee19fa21bba785d44356f725575720209c55bc12b3c7c8990ca74fa2f548

SHA512
7faf230974e516a94ff89afc19b1e762784fea82f1f027fb8eea5f343936510fb7c52b2a1059b8f5366b72cdf18d632f2b4a30e9c39e81a5b0921ace7e6f3312

Download Submit
C:\Windows\System\XBEjYjP.exe

Filesize
1.6MB

MD5
bcb9e5d172af540ca6fb26f3a85c636b

SHA1
2b47d9ee15ad24fa8121ae400a4d8440d3ceadf4

SHA256
fe11229a838dcbcc6b653ae8a5e0b43bf4d3552196a6454cd37035ee3766cea4

SHA512
045171cd735e9d02573ed103dfeb8b280e2d0111b9c048d7ec6c3c58e10770f1d26fe2701d98b5a4102e24c9f5f2a8a8f530e6b74aa8f95361d2997317c0a4b0

Download Submit
C:\Windows\System\cndSfVa.exe

Filesize
1.6MB

MD5
0f99b2e5003f60128099f81cf5b148e5

SHA1
f026ff9149a0f39eec5c481a1b0665e7b5313ea3

SHA256
9c861383a48d028e642c1f65aa29116e7eb5ac26535788f65251b146ec941718

SHA512
dc989f5c8de28bd3f2db9ed1549da8e07716d78cd7053db1aa96c891538a3c205219795b246bbaa31684bc14daa151a04f22a15b5ee2c8c09a76e0522944d6cf

Download Submit
C:\Windows\System\dNHVQtX.exe

Filesize
1.6MB

MD5
ace9a4676dfb5367f1a915f91a75022d

SHA1
f75faa42d6d359e52553dfafa57e83353c569502

SHA256
eade8da333aaca52d7778c919311a249856552593a4a356606fea9f99827eadb

SHA512
1da7348a6c53dd570fb5e2e2e568b6f933022ddf44b4242871e941a6bd95c058555e308d1c3b640b17fa4392e46d7a21655325f9cae80123ebaf5a455afe2ca7

Download Submit
C:\Windows\System\dbFLdfw.exe

Filesize
1.6MB

MD5
ec1792a24a07661945956f9b58a6bc74

SHA1
4ec39f4193ad77fba0fb898d0010ac6ecf665cfc

SHA256
a4464d985f26c88e83fc7ebc9b7d4113d86c3854b4d4534a1ba0aadf2a2dcac7

SHA512
3cbf7ebabc75b89d222c5c2a7292273c8fb79eadea32de03c687257f068ebc0fd3be0731908c8c52cf1ad9d9a95b7cd3a6d19be93edddb60188f4eae3d484fc8

Download Submit
C:\Windows\System\dzHqoqR.exe

Filesize
1.6MB

MD5
92dd5ebffa9746a944b6c064599017cf

SHA1
01d8a3e8994788a404d02dee129bb17c6a1719d6

SHA256
1baca25cbc19c5616d5aacf06899fe0abadf3d35ad201397531c26f8944a0fee

SHA512
5cdc6f4514f12b4135b161ab3d275c784f69351e13fe98c07e2dbb33a76641cb737e399ea5317f14395e88d6c4a7308f32685bbdffe3bae6a8b7abb422e6e948

Download Submit
C:\Windows\System\fuVAcYB.exe

Filesize
1.6MB

MD5
4b86f09d3cb7588a8974c4f718a589f4

SHA1
387d393c219949a1b0105e8638b5a2d96ab5804e

SHA256
9d894b479668db9d52c8216741fcdcfdad6f70a28c7ca87a396c8ffea0a79478

SHA512
a7a03c01c0a57d39771259d9c2335d030602ea5ffd14313f11e051e79ea83b4aed5120f3c5130074a8b286504d60cb67fa9667c92ffc16a14a53b15b3bfba69a

Download Submit
C:\Windows\System\hRQNMGq.exe

Filesize
1.6MB

MD5
ced841d48441a89068596cd82a080198

SHA1
54d074cc058748a1adb373a16c74eb80b5c0dce6

SHA256
c32744ea5c01ae2a6bcc82c4972baf1d0615a4b218b6ed70f990b90f99aee803

SHA512
b4d004dd5bf5d2dfa4e402c91e6ba8487736efd937bb8ec0f2b17ffb67a26202963f1f6bb6bf287d3b697071b60f9b80c453756a5b99a3499cb4af714bd0d0cd

Download Submit
C:\Windows\System\jVLDVeO.exe

Filesize
1.6MB

MD5
940ed3348894b99859b926e304bcb833

SHA1
b7ff9da3f8ef832c92c24135c10c653726be9214

SHA256
c2a8520cda4c705cf5d02de0cf33662849fc9465112ee7495606dae83099a5af

SHA512
978e43a15396991a92fcbbe5a19297e839a975fef3bdf92efb08ed175990ffd8dead02b986048bcfb7c442c886ba4e717a243bf5f02a8883f18d9c4bac5d4cd1

Download Submit
C:\Windows\System\lUcRzCv.exe

Filesize
1.6MB

MD5
f2ca2af19ac1d1f58cf309e3b49e8e03

SHA1
3fc7385248b9379440a7693f8eb323ac6187a2bb

SHA256
6b85407f04e07a9b1086e629d7c642f887639de05679517a5316ac1bf9b6f2d0

SHA512
c16e0fd50b4d9d6b764dbcc6d63ed62fa81d99383a426439c53634c775bde539b9961af0bac4af593177f73347418ce62e42cb88e81af246cea4926763b25b59

Download Submit
C:\Windows\System\navqSrT.exe

Filesize
1.6MB

MD5
1b64e16891a658a11e0e8f6dbdcd7bc4

SHA1
3b4e58c598ec6f7bec0979a152822751e53f989c

SHA256
a6edf94b9ca9550f10ccee8883a476665575e40d5ea9d15abec2bfb190314c7a

SHA512
770c42ae3ef3c819bac8430832bec5a5d009b0658de4ffc04e6d99f1e01fee5c1709b5ec9f03afd1a1cf22be815561685295699814220ea6c9420798fe72b0dc

Download Submit
C:\Windows\System\nfrMmGL.exe

Filesize
1.6MB

MD5
89cc8f87955a02cc8b2d51821092c428

SHA1
4bec21ce19aabbb95c3406c0668ad5437fffe722

SHA256
3a84731a628866aad691725a8d6f5dfae2495e59ad28da85a6f533b90e615b4f

SHA512
91c5471eb1599296b193e67e4f61f14e03af8c6c04c2e395ad2d551d07b01cc66cf9fa5ff3c5e08f925163f14f21f3e7225e5aa8bce887bbb22db97f3ac20d07

Download Submit
C:\Windows\System\nioWJaJ.exe

Filesize
1.6MB

MD5
29099e22ece88d8baf0ef33730b1123f

SHA1
c0ed9d08a6d18f0813226114684671a65447bb1a

SHA256
b50299e22c3ec4a3af779a626af941eca06f49ad0024716ad14494a8ebf21e8d

SHA512
af791e920c1faa0b032a289081b6b5bf64acf5c38c838d1560ef7c727f8b38bac7937adf2e7370c2e107a50b90fe262dc25fec4769366f0750b01cd11190cec8

Download Submit
C:\Windows\System\qFVePcP.exe

Filesize
1.6MB

MD5
b808d90198516044c4a78e514e7699f3

SHA1
2a1cab465bf0f312304e38040185b6ce5975abf2

SHA256
c25b0d3d77395fcf62d368ab41c36ed167eb00ead6578ecbda8b9c259066241b

SHA512
2ee397dc8afa224d70ffeb0e445d56bd785367c7bd114bff81770b61091a479f47d5ddd3512859f342f82f38600a7df15d0d8bce41933ecab0ac9ac83a2f3735

Download Submit
C:\Windows\System\rxFkuhw.exe

Filesize
1.6MB

MD5
f106a8146e7e13947442974fab4b8ff4

SHA1
0e5385b546f639570119c4fb522d81de2774ca67

SHA256
82034b3d097b32f7af3fb9d83a8ad27b39afe392a181e655b26aeb6c9900e17f

SHA512
59f8268c2e82bda98757d477464dbfea4b788274defe7253e15912b72712a6d7ea67684b441d796bb604c8e09947ed8b1e1691bd25a60ce85ab3f612de64064b

Download Submit
C:\Windows\System\tiiAhVr.exe

Filesize
1.6MB

MD5
34b6c92e91e464a3629fc96da22dd5f4

SHA1
8e3d572ab39501e425e61b6369780a7563f1286c

SHA256
216caf62a3bfc483a3758135222886051c90384131b7d81359902ba0ee8c3f46

SHA512
82c0064f1b862d6a15080142b68ef56d1afd26e2724b983211a87a4e04209f223113bedce30ef809353d2bcd44aeb4a6af20d9c675c210d4cbf9d66cd2d9dc96

Download Submit
C:\Windows\System\uSvtNnl.exe

Filesize
1.6MB

MD5
3762c6f86c783e3fb619fd604de9c747

SHA1
ce26161f00c98bc323b6c1447ef3049480834d63

SHA256
0ebf373a210ddd0e748c994732c05fd4d70af305618a91709aa892a2938d5981

SHA512
462e9dc95020bf15b517cc3283635e43f1dd571adfce183d1063a32c5ba0ded6cc41bdd46c1b61fa5ecda6cc749d95a110fcc4bbbf213377a21492ee6e70ccea

Download Submit
C:\Windows\System\vCOsamQ.exe

Filesize
1.6MB

MD5
281aca7f76a158f44079f8be93b5d647

SHA1
dc18940e9620334c50db8b9bd91cd1c973b232ca

SHA256
270261075a5fca0ccb48356fea3587f3b78b948e3a33669ed10242cce92a4b45

SHA512
3ffacdc6777718a92f6db79e6540185da4c7ddca036f14d32a3efec316c28cd6cf4fd3cace6b19731ba6bdbf4f1452f39ad89852fbd80a4f6ba8ba6907e9bbec

Download Submit
C:\Windows\System\vJcnWIx.exe

Filesize
1.6MB

MD5
b8697c911550264ed3bb9f9c65acb94f

SHA1
92b160bad20f72bbe9deb8d8053e50876d2323f2

SHA256
ab037be027ac201632cdc95d8edf5a89a61600574b9caf1755f878f8ee02b369

SHA512
34dd6a4c864dbe649c6fd6c11302eb623dfe8940394a71daaac0af0fc418860841c92117351ffce7d14aa432cc340e155e5e67b7202451e5ecfcf4f7e25310ef

Download Submit
C:\Windows\System\yhvIrgZ.exe

Filesize
1.6MB

MD5
3b0f571b9054fe69124ef5630411cdcb

SHA1
225a38e55c51093e5b0d1a9e0515ea6c32289c28

SHA256
79cafaea6f7e754edc58dcf0ab786a05e6e5eea40d01ca00387e3d318c7e766a

SHA512
14b5679b1113607f0c1dda88951a04e53b7bab580b7821b2a8f07a29038bbeab01bca07efc96d27b6425d7f65bba5cc8e257d6d5edd136eab382bc65a2565b4d

Download Submit
C:\Windows\System\zVgwtpo.exe

Filesize
1.6MB

MD5
953f6a31fb9b3350dabdb9bc7d560a3c

SHA1
b325819dae69a8121020376ceaab3d683ad62149

SHA256
1c1812f43707e6601e27956426655b10a6b538d4ade6361bc4c3b1b07e7dbb13

SHA512
e782f1e3e3cab9b8d035a8b357b9b20ae2c727ebc87b12ce541e35b66ec6a948fc57226d184d55f53afa5be6d96c7efec107dd9bf8a4298406274e3b66589ae6

Download Submit
memory/4380-0-0x0000021BA7090000-0x0000021BA70A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads