xmrig | dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
Size

1.8MB
MD5

3fdd8ace333564e724b2dd2f671b5b01
SHA1

bbd60d8bcf6a74bb2c49070c2cb71c6dff6d6156
SHA256

dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009
SHA512

226694b322dcd4cf0af4566de612c9e979e95834799c65821ad4c5fba493170a6c3e2a011806d3eadd0ef908be317f6a959ea9f2a1487ef405fbe4e5428e4360
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5y2PF6fRXzsL3:GemTLkNdfE0pZyj

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023bba-4.dat	xmrig
behavioral2/files/0x0007000000023cab-6.dat	xmrig
behavioral2/files/0x0009000000023ca4-19.dat	xmrig
behavioral2/files/0x0007000000023caf-37.dat	xmrig
behavioral2/files/0x0007000000023cae-46.dat	xmrig
behavioral2/files/0x0007000000023cb7-80.dat	xmrig
behavioral2/files/0x0007000000023cb9-98.dat	xmrig
behavioral2/files/0x0007000000023cbe-110.dat	xmrig
behavioral2/files/0x0007000000023cbd-108.dat	xmrig
behavioral2/files/0x0007000000023cbc-106.dat	xmrig
behavioral2/files/0x0007000000023cb6-104.dat	xmrig
behavioral2/files/0x0007000000023cbb-102.dat	xmrig
behavioral2/files/0x0007000000023cba-100.dat	xmrig
behavioral2/files/0x0007000000023cb8-96.dat	xmrig
behavioral2/files/0x0007000000023cb5-92.dat	xmrig
behavioral2/files/0x0007000000023cb3-74.dat	xmrig
behavioral2/files/0x0007000000023cb4-70.dat	xmrig
behavioral2/files/0x0007000000023cb1-62.dat	xmrig
behavioral2/files/0x0007000000023cb0-44.dat	xmrig
behavioral2/files/0x0007000000023cb2-42.dat	xmrig
behavioral2/files/0x0007000000023cac-33.dat	xmrig
behavioral2/files/0x0007000000023cad-32.dat	xmrig
behavioral2/files/0x0009000000023ca5-116.dat	xmrig
behavioral2/files/0x0007000000023cc2-120.dat	xmrig
behavioral2/files/0x0007000000023cc3-127.dat	xmrig
behavioral2/files/0x0007000000023cc4-144.dat	xmrig
behavioral2/files/0x0007000000023cca-160.dat	xmrig
behavioral2/files/0x0007000000023ccb-163.dat	xmrig
behavioral2/files/0x0007000000023cc6-161.dat	xmrig
behavioral2/files/0x0007000000023cc9-159.dat	xmrig
behavioral2/files/0x0007000000023cc7-157.dat	xmrig
behavioral2/files/0x0007000000023cc8-155.dat	xmrig
behavioral2/files/0x0007000000023cc5-150.dat	xmrig
behavioral2/files/0x0007000000023cbf-130.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5080	jsFHBBJ.exe
4964	FFHIKhy.exe
2984	ePmprGX.exe
1056	CqIahUc.exe
1936	DudVVRS.exe
3796	HPiZKyT.exe
4740	JvcySLk.exe
1908	uxRFclH.exe
5000	AfKKyFd.exe
3496	rZMJiMO.exe
3080	AGbQGbM.exe
1092	WlRPARs.exe
3640	ZLeYJRu.exe
3024	QRlyxUI.exe
4868	RIOqgIW.exe
2884	yehpgcZ.exe
2924	eVKygDZ.exe
2860	CkbcXDk.exe
2112	Ehglvdg.exe
952	XqExeeZ.exe
4580	xsPGyPy.exe
1516	xAQNCzh.exe
540	enpwomU.exe
4936	AJJFJCO.exe
2300	SoxxOmi.exe
3376	QlQkuZt.exe
1132	vPhXBXr.exe
3896	fGjJsLF.exe
4060	QMUunyb.exe
436	LnuxaJD.exe
2012	VEjxUCg.exe
116	POEpQBR.exe
2460	dCSBDqY.exe
4768	GwhFrum.exe
3472	AXaRobu.exe
1064	TVsGyGD.exe
4812	ldelIdy.exe
548	AbgHYXx.exe
3672	IuotqNj.exe
3748	pSUYqKO.exe
4244	rUcZkkV.exe
3764	cheNvyc.exe
3828	uxxWPKO.exe
5004	bMJWoBh.exe
4348	DhaUsRa.exe
1220	UAgGbLX.exe
5104	fucXbOZ.exe
1308	HDBjPPB.exe
2440	pDQhPMZ.exe
1844	YbpjayT.exe
2620	usUhvrK.exe
4048	NtDxoLF.exe
4456	VkdFbsG.exe
4800	RXYRhgX.exe
2076	SgEbIDj.exe
2352	NahCjtU.exe
4744	OgKNNxm.exe
4516	xbIHgHp.exe
1796	pHggQSA.exe
1332	lbMOhMP.exe
2988	CRcpvUM.exe
3404	ZyPSAPZ.exe
2384	QsbUOCK.exe
5032	wnMWliT.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dWpKEKs.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\tPywHRh.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\gOyjZkb.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\sqGutZT.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\OusXUPt.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\zHBKYdN.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\sxRLbXU.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\tODZfVV.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\xbuvqbl.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\eErnzdM.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\CyhnulJ.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\lcyyheP.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\jCVypkW.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\nbLmgPV.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\smHBXWb.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\iQaHOqB.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\WDAXQyo.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\lmEWdjw.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\xHhFCrd.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\LmdeYhP.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\oRlNHtF.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\IrTstum.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\cbBLnaZ.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\vkOogND.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\XnbScPN.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\lKRTwyE.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\ihFbwna.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\yNpQajt.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\pFsuzfX.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\pEGCUQJ.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\NRAciwp.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\wkrpvar.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\ymNivKd.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\rUNoQTJ.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\hTprJMp.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\ajJELCL.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\DOfmLIb.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\lNrVYcJ.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\JgvzNFH.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\IlhCbTr.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\cheNvyc.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\dvqeyRO.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\jIWdqVL.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\bBrouqv.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\jmhofLm.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\FIVFvFM.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\VMNQJGy.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\QMTQJFF.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\TJaTHYc.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\JXKbcIX.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\RqBNDUu.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\UwbZqYc.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\INbafgp.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\AmaneBh.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\AcbAuOb.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\drSVbgm.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\okrLBZl.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\CpeVUXq.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\AfKKyFd.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\DhaUsRa.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\PtMtqDx.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\lxCNmcB.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\QDhaovP.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
File created	C:\Windows\System\heMTLeI.exe	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16264	dwm.exe
Token: SeChangeNotifyPrivilege	16264	dwm.exe
Token: 33	16264	dwm.exe
Token: SeIncBasePriorityPrivilege	16264	dwm.exe
Token: SeShutdownPrivilege	16264	dwm.exe
Token: SeCreatePagefilePrivilege	16264	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 5080	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	84
PID 4468 wrote to memory of 5080	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	84
PID 4468 wrote to memory of 4964	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	85
PID 4468 wrote to memory of 4964	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	85
PID 4468 wrote to memory of 2984	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	86
PID 4468 wrote to memory of 2984	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	86
PID 4468 wrote to memory of 1056	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	87
PID 4468 wrote to memory of 1056	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	87
PID 4468 wrote to memory of 1936	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	88
PID 4468 wrote to memory of 1936	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	88
PID 4468 wrote to memory of 3796	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	89
PID 4468 wrote to memory of 3796	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	89
PID 4468 wrote to memory of 4740	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	90
PID 4468 wrote to memory of 4740	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	90
PID 4468 wrote to memory of 1908	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	91
PID 4468 wrote to memory of 1908	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	91
PID 4468 wrote to memory of 5000	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	92
PID 4468 wrote to memory of 5000	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	92
PID 4468 wrote to memory of 3496	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	93
PID 4468 wrote to memory of 3496	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	93
PID 4468 wrote to memory of 3080	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	94
PID 4468 wrote to memory of 3080	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	94
PID 4468 wrote to memory of 1092	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	95
PID 4468 wrote to memory of 1092	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	95
PID 4468 wrote to memory of 3640	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	96
PID 4468 wrote to memory of 3640	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	96
PID 4468 wrote to memory of 2112	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	97
PID 4468 wrote to memory of 2112	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	97
PID 4468 wrote to memory of 3024	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	98
PID 4468 wrote to memory of 3024	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	98
PID 4468 wrote to memory of 4868	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	99
PID 4468 wrote to memory of 4868	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	99
PID 4468 wrote to memory of 2884	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	100
PID 4468 wrote to memory of 2884	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	100
PID 4468 wrote to memory of 2924	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	101
PID 4468 wrote to memory of 2924	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	101
PID 4468 wrote to memory of 2860	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	102
PID 4468 wrote to memory of 2860	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	102
PID 4468 wrote to memory of 952	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	103
PID 4468 wrote to memory of 952	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	103
PID 4468 wrote to memory of 4580	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	104
PID 4468 wrote to memory of 4580	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	104
PID 4468 wrote to memory of 1516	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	105
PID 4468 wrote to memory of 1516	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	105
PID 4468 wrote to memory of 4936	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	106
PID 4468 wrote to memory of 4936	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	106
PID 4468 wrote to memory of 540	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	107
PID 4468 wrote to memory of 540	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	107
PID 4468 wrote to memory of 2300	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	108
PID 4468 wrote to memory of 2300	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	108
PID 4468 wrote to memory of 3376	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	109
PID 4468 wrote to memory of 3376	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	109
PID 4468 wrote to memory of 1132	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	110
PID 4468 wrote to memory of 1132	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	110
PID 4468 wrote to memory of 3896	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	111
PID 4468 wrote to memory of 3896	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	111
PID 4468 wrote to memory of 4060	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	112
PID 4468 wrote to memory of 4060	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	112
PID 4468 wrote to memory of 436	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	113
PID 4468 wrote to memory of 436	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	113
PID 4468 wrote to memory of 2012	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	114
PID 4468 wrote to memory of 2012	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	114
PID 4468 wrote to memory of 116	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	115
PID 4468 wrote to memory of 116	4468	dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe	115

C:\Users\Admin\AppData\Local\Temp\dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe
"C:\Users\Admin\AppData\Local\Temp\dea2fd684c67905737dbb8414788afb01b077e0edc70f11a0b1bb08e3f6e4009.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\System\jsFHBBJ.exe
  C:\Windows\System\jsFHBBJ.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\FFHIKhy.exe
  C:\Windows\System\FFHIKhy.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\ePmprGX.exe
  C:\Windows\System\ePmprGX.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\CqIahUc.exe
  C:\Windows\System\CqIahUc.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\DudVVRS.exe
  C:\Windows\System\DudVVRS.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\HPiZKyT.exe
  C:\Windows\System\HPiZKyT.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\JvcySLk.exe
  C:\Windows\System\JvcySLk.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\uxRFclH.exe
  C:\Windows\System\uxRFclH.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\AfKKyFd.exe
  C:\Windows\System\AfKKyFd.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\rZMJiMO.exe
  C:\Windows\System\rZMJiMO.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\AGbQGbM.exe
  C:\Windows\System\AGbQGbM.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\WlRPARs.exe
  C:\Windows\System\WlRPARs.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\ZLeYJRu.exe
  C:\Windows\System\ZLeYJRu.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\Ehglvdg.exe
  C:\Windows\System\Ehglvdg.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\QRlyxUI.exe
  C:\Windows\System\QRlyxUI.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\RIOqgIW.exe
  C:\Windows\System\RIOqgIW.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\yehpgcZ.exe
  C:\Windows\System\yehpgcZ.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\eVKygDZ.exe
  C:\Windows\System\eVKygDZ.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\CkbcXDk.exe
  C:\Windows\System\CkbcXDk.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\XqExeeZ.exe
  C:\Windows\System\XqExeeZ.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\xsPGyPy.exe
  C:\Windows\System\xsPGyPy.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\xAQNCzh.exe
  C:\Windows\System\xAQNCzh.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\AJJFJCO.exe
  C:\Windows\System\AJJFJCO.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\enpwomU.exe
  C:\Windows\System\enpwomU.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\SoxxOmi.exe
  C:\Windows\System\SoxxOmi.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\QlQkuZt.exe
  C:\Windows\System\QlQkuZt.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\vPhXBXr.exe
  C:\Windows\System\vPhXBXr.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\fGjJsLF.exe
  C:\Windows\System\fGjJsLF.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\QMUunyb.exe
  C:\Windows\System\QMUunyb.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\LnuxaJD.exe
  C:\Windows\System\LnuxaJD.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\VEjxUCg.exe
  C:\Windows\System\VEjxUCg.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\POEpQBR.exe
  C:\Windows\System\POEpQBR.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\dCSBDqY.exe
  C:\Windows\System\dCSBDqY.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\GwhFrum.exe
  C:\Windows\System\GwhFrum.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\AXaRobu.exe
  C:\Windows\System\AXaRobu.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\TVsGyGD.exe
  C:\Windows\System\TVsGyGD.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\ldelIdy.exe
  C:\Windows\System\ldelIdy.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\AbgHYXx.exe
  C:\Windows\System\AbgHYXx.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\IuotqNj.exe
  C:\Windows\System\IuotqNj.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\pSUYqKO.exe
  C:\Windows\System\pSUYqKO.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\rUcZkkV.exe
  C:\Windows\System\rUcZkkV.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\cheNvyc.exe
  C:\Windows\System\cheNvyc.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\uxxWPKO.exe
  C:\Windows\System\uxxWPKO.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\bMJWoBh.exe
  C:\Windows\System\bMJWoBh.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\DhaUsRa.exe
  C:\Windows\System\DhaUsRa.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\UAgGbLX.exe
  C:\Windows\System\UAgGbLX.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\fucXbOZ.exe
  C:\Windows\System\fucXbOZ.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\HDBjPPB.exe
  C:\Windows\System\HDBjPPB.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\pDQhPMZ.exe
  C:\Windows\System\pDQhPMZ.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\YbpjayT.exe
  C:\Windows\System\YbpjayT.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\usUhvrK.exe
  C:\Windows\System\usUhvrK.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\NtDxoLF.exe
  C:\Windows\System\NtDxoLF.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\VkdFbsG.exe
  C:\Windows\System\VkdFbsG.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\RXYRhgX.exe
  C:\Windows\System\RXYRhgX.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\SgEbIDj.exe
  C:\Windows\System\SgEbIDj.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\NahCjtU.exe
  C:\Windows\System\NahCjtU.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\OgKNNxm.exe
  C:\Windows\System\OgKNNxm.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\xbIHgHp.exe
  C:\Windows\System\xbIHgHp.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\pHggQSA.exe
  C:\Windows\System\pHggQSA.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\lbMOhMP.exe
  C:\Windows\System\lbMOhMP.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\CRcpvUM.exe
  C:\Windows\System\CRcpvUM.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\ZyPSAPZ.exe
  C:\Windows\System\ZyPSAPZ.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\QsbUOCK.exe
  C:\Windows\System\QsbUOCK.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\wnMWliT.exe
  C:\Windows\System\wnMWliT.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\McYeXmB.exe
  C:\Windows\System\McYeXmB.exe
  2⤵
  PID:2456
- C:\Windows\System\FJwqPoQ.exe
  C:\Windows\System\FJwqPoQ.exe
  2⤵
  PID:384
- C:\Windows\System\IqDaFlm.exe
  C:\Windows\System\IqDaFlm.exe
  2⤵
  PID:4604
- C:\Windows\System\cTxlISH.exe
  C:\Windows\System\cTxlISH.exe
  2⤵
  PID:3320
- C:\Windows\System\IMnQopW.exe
  C:\Windows\System\IMnQopW.exe
  2⤵
  PID:4340
- C:\Windows\System\Wzujhzg.exe
  C:\Windows\System\Wzujhzg.exe
  2⤵
  PID:904
- C:\Windows\System\dUDITkK.exe
  C:\Windows\System\dUDITkK.exe
  2⤵
  PID:4236
- C:\Windows\System\PyXhxBM.exe
  C:\Windows\System\PyXhxBM.exe
  2⤵
  PID:4528
- C:\Windows\System\lDtmJOi.exe
  C:\Windows\System\lDtmJOi.exe
  2⤵
  PID:4852
- C:\Windows\System\foLiMis.exe
  C:\Windows\System\foLiMis.exe
  2⤵
  PID:216
- C:\Windows\System\wMPMqoR.exe
  C:\Windows\System\wMPMqoR.exe
  2⤵
  PID:3152
- C:\Windows\System\JSwTVGu.exe
  C:\Windows\System\JSwTVGu.exe
  2⤵
  PID:2992
- C:\Windows\System\LCmwNNn.exe
  C:\Windows\System\LCmwNNn.exe
  2⤵
  PID:664
- C:\Windows\System\eAXrWRh.exe
  C:\Windows\System\eAXrWRh.exe
  2⤵
  PID:1756
- C:\Windows\System\BVJvEHu.exe
  C:\Windows\System\BVJvEHu.exe
  2⤵
  PID:552
- C:\Windows\System\ROayxhC.exe
  C:\Windows\System\ROayxhC.exe
  2⤵
  PID:2900
- C:\Windows\System\aGCuekn.exe
  C:\Windows\System\aGCuekn.exe
  2⤵
  PID:1852
- C:\Windows\System\pgOiZQV.exe
  C:\Windows\System\pgOiZQV.exe
  2⤵
  PID:3224
- C:\Windows\System\FIVFvFM.exe
  C:\Windows\System\FIVFvFM.exe
  2⤵
  PID:872
- C:\Windows\System\CKlxCZk.exe
  C:\Windows\System\CKlxCZk.exe
  2⤵
  PID:3412
- C:\Windows\System\YLilvHw.exe
  C:\Windows\System\YLilvHw.exe
  2⤵
  PID:932
- C:\Windows\System\RRXaMsU.exe
  C:\Windows\System\RRXaMsU.exe
  2⤵
  PID:4880
- C:\Windows\System\vcCbOUr.exe
  C:\Windows\System\vcCbOUr.exe
  2⤵
  PID:3128
- C:\Windows\System\mrmaJQv.exe
  C:\Windows\System\mrmaJQv.exe
  2⤵
  PID:5088
- C:\Windows\System\TqnNgib.exe
  C:\Windows\System\TqnNgib.exe
  2⤵
  PID:1972
- C:\Windows\System\EVTgMhW.exe
  C:\Windows\System\EVTgMhW.exe
  2⤵
  PID:456
- C:\Windows\System\iBhOizH.exe
  C:\Windows\System\iBhOizH.exe
  2⤵
  PID:3732
- C:\Windows\System\xgYlBUX.exe
  C:\Windows\System\xgYlBUX.exe
  2⤵
  PID:4560
- C:\Windows\System\tDSbHEW.exe
  C:\Windows\System\tDSbHEW.exe
  2⤵
  PID:3108
- C:\Windows\System\HsEIQxv.exe
  C:\Windows\System\HsEIQxv.exe
  2⤵
  PID:1004
- C:\Windows\System\VkNxSUl.exe
  C:\Windows\System\VkNxSUl.exe
  2⤵
  PID:1644
- C:\Windows\System\yGZevie.exe
  C:\Windows\System\yGZevie.exe
  2⤵
  PID:3704
- C:\Windows\System\JazMRka.exe
  C:\Windows\System\JazMRka.exe
  2⤵
  PID:4032
- C:\Windows\System\SFdEKKb.exe
  C:\Windows\System\SFdEKKb.exe
  2⤵
  PID:3416
- C:\Windows\System\WTqoPzM.exe
  C:\Windows\System\WTqoPzM.exe
  2⤵
  PID:4632
- C:\Windows\System\LmruMsN.exe
  C:\Windows\System\LmruMsN.exe
  2⤵
  PID:2324
- C:\Windows\System\AhwmKkf.exe
  C:\Windows\System\AhwmKkf.exe
  2⤵
  PID:3608
- C:\Windows\System\BTWJzqM.exe
  C:\Windows\System\BTWJzqM.exe
  2⤵
  PID:2264
- C:\Windows\System\dxhNRVO.exe
  C:\Windows\System\dxhNRVO.exe
  2⤵
  PID:1424
- C:\Windows\System\JvZZszN.exe
  C:\Windows\System\JvZZszN.exe
  2⤵
  PID:2492
- C:\Windows\System\ZCLnxjm.exe
  C:\Windows\System\ZCLnxjm.exe
  2⤵
  PID:4776
- C:\Windows\System\ijuRIjL.exe
  C:\Windows\System\ijuRIjL.exe
  2⤵
  PID:3228
- C:\Windows\System\jJaBSaE.exe
  C:\Windows\System\jJaBSaE.exe
  2⤵
  PID:5064
- C:\Windows\System\XSWtrZj.exe
  C:\Windows\System\XSWtrZj.exe
  2⤵
  PID:1224
- C:\Windows\System\wFUMgnK.exe
  C:\Windows\System\wFUMgnK.exe
  2⤵
  PID:3852
- C:\Windows\System\mxPzvOt.exe
  C:\Windows\System\mxPzvOt.exe
  2⤵
  PID:3112
- C:\Windows\System\LFVoGdy.exe
  C:\Windows\System\LFVoGdy.exe
  2⤵
  PID:1328
- C:\Windows\System\qsRzTIq.exe
  C:\Windows\System\qsRzTIq.exe
  2⤵
  PID:1792
- C:\Windows\System\DHWLYpB.exe
  C:\Windows\System\DHWLYpB.exe
  2⤵
  PID:5128
- C:\Windows\System\CSzEcor.exe
  C:\Windows\System\CSzEcor.exe
  2⤵
  PID:5160
- C:\Windows\System\UtoTjKx.exe
  C:\Windows\System\UtoTjKx.exe
  2⤵
  PID:5192
- C:\Windows\System\alpGUfC.exe
  C:\Windows\System\alpGUfC.exe
  2⤵
  PID:5220
- C:\Windows\System\ZWVzTQt.exe
  C:\Windows\System\ZWVzTQt.exe
  2⤵
  PID:5252
- C:\Windows\System\poIjnpM.exe
  C:\Windows\System\poIjnpM.exe
  2⤵
  PID:5272
- C:\Windows\System\GdhHXEF.exe
  C:\Windows\System\GdhHXEF.exe
  2⤵
  PID:5304
- C:\Windows\System\xnsBZUX.exe
  C:\Windows\System\xnsBZUX.exe
  2⤵
  PID:5336
- C:\Windows\System\cnjnJpL.exe
  C:\Windows\System\cnjnJpL.exe
  2⤵
  PID:5376
- C:\Windows\System\fBmFlDI.exe
  C:\Windows\System\fBmFlDI.exe
  2⤵
  PID:5396
- C:\Windows\System\vnAVnJt.exe
  C:\Windows\System\vnAVnJt.exe
  2⤵
  PID:5424
- C:\Windows\System\dnNkEAt.exe
  C:\Windows\System\dnNkEAt.exe
  2⤵
  PID:5440
- C:\Windows\System\bEYbvAj.exe
  C:\Windows\System\bEYbvAj.exe
  2⤵
  PID:5468
- C:\Windows\System\mtAPcWa.exe
  C:\Windows\System\mtAPcWa.exe
  2⤵
  PID:5500
- C:\Windows\System\ncKxEcF.exe
  C:\Windows\System\ncKxEcF.exe
  2⤵
  PID:5536
- C:\Windows\System\oSWeHiq.exe
  C:\Windows\System\oSWeHiq.exe
  2⤵
  PID:5552
- C:\Windows\System\YraQFcZ.exe
  C:\Windows\System\YraQFcZ.exe
  2⤵
  PID:5580
- C:\Windows\System\deDXWaA.exe
  C:\Windows\System\deDXWaA.exe
  2⤵
  PID:5612
- C:\Windows\System\dWpKEKs.exe
  C:\Windows\System\dWpKEKs.exe
  2⤵
  PID:5636
- C:\Windows\System\YIVVrRb.exe
  C:\Windows\System\YIVVrRb.exe
  2⤵
  PID:5664
- C:\Windows\System\lvpsNjN.exe
  C:\Windows\System\lvpsNjN.exe
  2⤵
  PID:5692
- C:\Windows\System\SCBpEOh.exe
  C:\Windows\System\SCBpEOh.exe
  2⤵
  PID:5712
- C:\Windows\System\mhLmbmh.exe
  C:\Windows\System\mhLmbmh.exe
  2⤵
  PID:5744
- C:\Windows\System\HgWvvZX.exe
  C:\Windows\System\HgWvvZX.exe
  2⤵
  PID:5776
- C:\Windows\System\AaWSHrQ.exe
  C:\Windows\System\AaWSHrQ.exe
  2⤵
  PID:5796
- C:\Windows\System\fUrlzWQ.exe
  C:\Windows\System\fUrlzWQ.exe
  2⤵
  PID:5820
- C:\Windows\System\jHYZLwo.exe
  C:\Windows\System\jHYZLwo.exe
  2⤵
  PID:5856
- C:\Windows\System\CyhnulJ.exe
  C:\Windows\System\CyhnulJ.exe
  2⤵
  PID:5876
- C:\Windows\System\EzzZqRn.exe
  C:\Windows\System\EzzZqRn.exe
  2⤵
  PID:5908
- C:\Windows\System\xXkmYmf.exe
  C:\Windows\System\xXkmYmf.exe
  2⤵
  PID:5944
- C:\Windows\System\ArsxbHF.exe
  C:\Windows\System\ArsxbHF.exe
  2⤵
  PID:5980
- C:\Windows\System\xVmZQsh.exe
  C:\Windows\System\xVmZQsh.exe
  2⤵
  PID:5996
- C:\Windows\System\waxUnSN.exe
  C:\Windows\System\waxUnSN.exe
  2⤵
  PID:6028
- C:\Windows\System\EBbNAPE.exe
  C:\Windows\System\EBbNAPE.exe
  2⤵
  PID:6056
- C:\Windows\System\bOywQWG.exe
  C:\Windows\System\bOywQWG.exe
  2⤵
  PID:6092
- C:\Windows\System\yqFeqOM.exe
  C:\Windows\System\yqFeqOM.exe
  2⤵
  PID:6112
- C:\Windows\System\ioGGCCR.exe
  C:\Windows\System\ioGGCCR.exe
  2⤵
  PID:6132
- C:\Windows\System\YJfDaOj.exe
  C:\Windows\System\YJfDaOj.exe
  2⤵
  PID:5184
- C:\Windows\System\MORRafR.exe
  C:\Windows\System\MORRafR.exe
  2⤵
  PID:5228
- C:\Windows\System\JJrZXps.exe
  C:\Windows\System\JJrZXps.exe
  2⤵
  PID:5288
- C:\Windows\System\VHbZfkM.exe
  C:\Windows\System\VHbZfkM.exe
  2⤵
  PID:5356
- C:\Windows\System\TySKoMS.exe
  C:\Windows\System\TySKoMS.exe
  2⤵
  PID:5420
- C:\Windows\System\FBxmQVO.exe
  C:\Windows\System\FBxmQVO.exe
  2⤵
  PID:5488
- C:\Windows\System\aSYSevp.exe
  C:\Windows\System\aSYSevp.exe
  2⤵
  PID:5568
- C:\Windows\System\dSFeIWY.exe
  C:\Windows\System\dSFeIWY.exe
  2⤵
  PID:5620
- C:\Windows\System\WtUOefR.exe
  C:\Windows\System\WtUOefR.exe
  2⤵
  PID:5688
- C:\Windows\System\vUNiELW.exe
  C:\Windows\System\vUNiELW.exe
  2⤵
  PID:5772
- C:\Windows\System\UnSZYfy.exe
  C:\Windows\System\UnSZYfy.exe
  2⤵
  PID:5816
- C:\Windows\System\LAyHfGV.exe
  C:\Windows\System\LAyHfGV.exe
  2⤵
  PID:5888
- C:\Windows\System\FixKamT.exe
  C:\Windows\System\FixKamT.exe
  2⤵
  PID:5956
- C:\Windows\System\zcJYMax.exe
  C:\Windows\System\zcJYMax.exe
  2⤵
  PID:6012
- C:\Windows\System\GeMpbAf.exe
  C:\Windows\System\GeMpbAf.exe
  2⤵
  PID:6108
- C:\Windows\System\iuPihWs.exe
  C:\Windows\System\iuPihWs.exe
  2⤵
  PID:6104
- C:\Windows\System\MmCTuxL.exe
  C:\Windows\System\MmCTuxL.exe
  2⤵
  PID:5148
- C:\Windows\System\HztRLWx.exe
  C:\Windows\System\HztRLWx.exe
  2⤵
  PID:5388
- C:\Windows\System\yeGcXlQ.exe
  C:\Windows\System\yeGcXlQ.exe
  2⤵
  PID:5460
- C:\Windows\System\ZPrNdHc.exe
  C:\Windows\System\ZPrNdHc.exe
  2⤵
  PID:5632
- C:\Windows\System\rWWjyrE.exe
  C:\Windows\System\rWWjyrE.exe
  2⤵
  PID:5736
- C:\Windows\System\IfLFmxp.exe
  C:\Windows\System\IfLFmxp.exe
  2⤵
  PID:5936
- C:\Windows\System\VwjPNCf.exe
  C:\Windows\System\VwjPNCf.exe
  2⤵
  PID:6044
- C:\Windows\System\OaLnTsl.exe
  C:\Windows\System\OaLnTsl.exe
  2⤵
  PID:5212
- C:\Windows\System\qZkvbib.exe
  C:\Windows\System\qZkvbib.exe
  2⤵
  PID:5528
- C:\Windows\System\tXpBERL.exe
  C:\Windows\System\tXpBERL.exe
  2⤵
  PID:5868
- C:\Windows\System\IxOoUfG.exe
  C:\Windows\System\IxOoUfG.exe
  2⤵
  PID:5596
- C:\Windows\System\kOHZJHx.exe
  C:\Windows\System\kOHZJHx.exe
  2⤵
  PID:6176
- C:\Windows\System\tPywHRh.exe
  C:\Windows\System\tPywHRh.exe
  2⤵
  PID:6192
- C:\Windows\System\mzsjBty.exe
  C:\Windows\System\mzsjBty.exe
  2⤵
  PID:6232
- C:\Windows\System\pEGCUQJ.exe
  C:\Windows\System\pEGCUQJ.exe
  2⤵
  PID:6260
- C:\Windows\System\yKNXBKT.exe
  C:\Windows\System\yKNXBKT.exe
  2⤵
  PID:6288
- C:\Windows\System\uYmkRAy.exe
  C:\Windows\System\uYmkRAy.exe
  2⤵
  PID:6320
- C:\Windows\System\csrrllo.exe
  C:\Windows\System\csrrllo.exe
  2⤵
  PID:6352
- C:\Windows\System\IxLuYfQ.exe
  C:\Windows\System\IxLuYfQ.exe
  2⤵
  PID:6372
- C:\Windows\System\HhylVVF.exe
  C:\Windows\System\HhylVVF.exe
  2⤵
  PID:6388
- C:\Windows\System\RQCKsOV.exe
  C:\Windows\System\RQCKsOV.exe
  2⤵
  PID:6404
- C:\Windows\System\DVwQIDu.exe
  C:\Windows\System\DVwQIDu.exe
  2⤵
  PID:6436
- C:\Windows\System\uSEWONr.exe
  C:\Windows\System\uSEWONr.exe
  2⤵
  PID:6460
- C:\Windows\System\vNiDBTV.exe
  C:\Windows\System\vNiDBTV.exe
  2⤵
  PID:6484
- C:\Windows\System\uHkjsej.exe
  C:\Windows\System\uHkjsej.exe
  2⤵
  PID:6516
- C:\Windows\System\sfIBRko.exe
  C:\Windows\System\sfIBRko.exe
  2⤵
  PID:6544
- C:\Windows\System\oKzwvub.exe
  C:\Windows\System\oKzwvub.exe
  2⤵
  PID:6584
- C:\Windows\System\gJfLrXq.exe
  C:\Windows\System\gJfLrXq.exe
  2⤵
  PID:6612
- C:\Windows\System\UhtyDWL.exe
  C:\Windows\System\UhtyDWL.exe
  2⤵
  PID:6652
- C:\Windows\System\agvsNfg.exe
  C:\Windows\System\agvsNfg.exe
  2⤵
  PID:6688
- C:\Windows\System\hjwIpKT.exe
  C:\Windows\System\hjwIpKT.exe
  2⤵
  PID:6724
- C:\Windows\System\ZCxzfJP.exe
  C:\Windows\System\ZCxzfJP.exe
  2⤵
  PID:6740
- C:\Windows\System\bBrouqv.exe
  C:\Windows\System\bBrouqv.exe
  2⤵
  PID:6768
- C:\Windows\System\NAvYMeR.exe
  C:\Windows\System\NAvYMeR.exe
  2⤵
  PID:6800
- C:\Windows\System\UICswnA.exe
  C:\Windows\System\UICswnA.exe
  2⤵
  PID:6824
- C:\Windows\System\lcyyheP.exe
  C:\Windows\System\lcyyheP.exe
  2⤵
  PID:6852
- C:\Windows\System\mukXhmL.exe
  C:\Windows\System\mukXhmL.exe
  2⤵
  PID:6892
- C:\Windows\System\eYSBmaS.exe
  C:\Windows\System\eYSBmaS.exe
  2⤵
  PID:6912
- C:\Windows\System\NRAciwp.exe
  C:\Windows\System\NRAciwp.exe
  2⤵
  PID:6936
- C:\Windows\System\BMpZSId.exe
  C:\Windows\System\BMpZSId.exe
  2⤵
  PID:6964
- C:\Windows\System\tINwytK.exe
  C:\Windows\System\tINwytK.exe
  2⤵
  PID:6992
- C:\Windows\System\VxZOesw.exe
  C:\Windows\System\VxZOesw.exe
  2⤵
  PID:7016
- C:\Windows\System\tNTVoHG.exe
  C:\Windows\System\tNTVoHG.exe
  2⤵
  PID:7048
- C:\Windows\System\PoHCjMI.exe
  C:\Windows\System\PoHCjMI.exe
  2⤵
  PID:7076
- C:\Windows\System\CiQhcyW.exe
  C:\Windows\System\CiQhcyW.exe
  2⤵
  PID:7104
- C:\Windows\System\FJVhHrn.exe
  C:\Windows\System\FJVhHrn.exe
  2⤵
  PID:7136
- C:\Windows\System\YkTHxrQ.exe
  C:\Windows\System\YkTHxrQ.exe
  2⤵
  PID:5788
- C:\Windows\System\geSxTdw.exe
  C:\Windows\System\geSxTdw.exe
  2⤵
  PID:6168
- C:\Windows\System\wkrpvar.exe
  C:\Windows\System\wkrpvar.exe
  2⤵
  PID:6220
- C:\Windows\System\OUvjXDQ.exe
  C:\Windows\System\OUvjXDQ.exe
  2⤵
  PID:6280
- C:\Windows\System\cbBLnaZ.exe
  C:\Windows\System\cbBLnaZ.exe
  2⤵
  PID:6368
- C:\Windows\System\RbGuYfm.exe
  C:\Windows\System\RbGuYfm.exe
  2⤵
  PID:6432
- C:\Windows\System\vomiKLt.exe
  C:\Windows\System\vomiKLt.exe
  2⤵
  PID:6416
- C:\Windows\System\ANmYDTw.exe
  C:\Windows\System\ANmYDTw.exe
  2⤵
  PID:6540
- C:\Windows\System\QLyGWyU.exe
  C:\Windows\System\QLyGWyU.exe
  2⤵
  PID:6636
- C:\Windows\System\tXdnSaJ.exe
  C:\Windows\System\tXdnSaJ.exe
  2⤵
  PID:6668
- C:\Windows\System\SgHNEtS.exe
  C:\Windows\System\SgHNEtS.exe
  2⤵
  PID:6732
- C:\Windows\System\WeXCdnz.exe
  C:\Windows\System\WeXCdnz.exe
  2⤵
  PID:6816
- C:\Windows\System\ymNivKd.exe
  C:\Windows\System\ymNivKd.exe
  2⤵
  PID:6880
- C:\Windows\System\ziECZWU.exe
  C:\Windows\System\ziECZWU.exe
  2⤵
  PID:6900
- C:\Windows\System\INbafgp.exe
  C:\Windows\System\INbafgp.exe
  2⤵
  PID:6984
- C:\Windows\System\AmaneBh.exe
  C:\Windows\System\AmaneBh.exe
  2⤵
  PID:7060
- C:\Windows\System\yxQNlFh.exe
  C:\Windows\System\yxQNlFh.exe
  2⤵
  PID:7132
- C:\Windows\System\sgCAOvr.exe
  C:\Windows\System\sgCAOvr.exe
  2⤵
  PID:6156
- C:\Windows\System\QUxOUVE.exe
  C:\Windows\System\QUxOUVE.exe
  2⤵
  PID:6216
- C:\Windows\System\PcMtVwB.exe
  C:\Windows\System\PcMtVwB.exe
  2⤵
  PID:6300
- C:\Windows\System\JGgSYZV.exe
  C:\Windows\System\JGgSYZV.exe
  2⤵
  PID:6624
- C:\Windows\System\fmTHtMz.exe
  C:\Windows\System\fmTHtMz.exe
  2⤵
  PID:6736
- C:\Windows\System\cWXwbCt.exe
  C:\Windows\System\cWXwbCt.exe
  2⤵
  PID:6836
- C:\Windows\System\AShkQsU.exe
  C:\Windows\System\AShkQsU.exe
  2⤵
  PID:7036
- C:\Windows\System\FdWtzzH.exe
  C:\Windows\System\FdWtzzH.exe
  2⤵
  PID:7160
- C:\Windows\System\OYHQfIK.exe
  C:\Windows\System\OYHQfIK.exe
  2⤵
  PID:6532
- C:\Windows\System\HALQbbG.exe
  C:\Windows\System\HALQbbG.exe
  2⤵
  PID:6820
- C:\Windows\System\hhDLTfZ.exe
  C:\Windows\System\hhDLTfZ.exe
  2⤵
  PID:6932
- C:\Windows\System\hUTrvRd.exe
  C:\Windows\System\hUTrvRd.exe
  2⤵
  PID:7176
- C:\Windows\System\WxHjeCO.exe
  C:\Windows\System\WxHjeCO.exe
  2⤵
  PID:7212
- C:\Windows\System\ytxpNVG.exe
  C:\Windows\System\ytxpNVG.exe
  2⤵
  PID:7236
- C:\Windows\System\kiFRYPn.exe
  C:\Windows\System\kiFRYPn.exe
  2⤵
  PID:7264
- C:\Windows\System\mGObHPb.exe
  C:\Windows\System\mGObHPb.exe
  2⤵
  PID:7280
- C:\Windows\System\qyOxhoT.exe
  C:\Windows\System\qyOxhoT.exe
  2⤵
  PID:7312
- C:\Windows\System\ZnqlWws.exe
  C:\Windows\System\ZnqlWws.exe
  2⤵
  PID:7340
- C:\Windows\System\Pkxfnfj.exe
  C:\Windows\System\Pkxfnfj.exe
  2⤵
  PID:7376
- C:\Windows\System\bMsdkxz.exe
  C:\Windows\System\bMsdkxz.exe
  2⤵
  PID:7392
- C:\Windows\System\MvEDFqj.exe
  C:\Windows\System\MvEDFqj.exe
  2⤵
  PID:7420
- C:\Windows\System\CBeBBYZ.exe
  C:\Windows\System\CBeBBYZ.exe
  2⤵
  PID:7464
- C:\Windows\System\gRxhuMA.exe
  C:\Windows\System\gRxhuMA.exe
  2⤵
  PID:7500
- C:\Windows\System\VFJxAnr.exe
  C:\Windows\System\VFJxAnr.exe
  2⤵
  PID:7528
- C:\Windows\System\rScKAZl.exe
  C:\Windows\System\rScKAZl.exe
  2⤵
  PID:7556
- C:\Windows\System\KoKIgfV.exe
  C:\Windows\System\KoKIgfV.exe
  2⤵
  PID:7588
- C:\Windows\System\KtQNvJs.exe
  C:\Windows\System\KtQNvJs.exe
  2⤵
  PID:7620
- C:\Windows\System\cXeowOo.exe
  C:\Windows\System\cXeowOo.exe
  2⤵
  PID:7640
- C:\Windows\System\vWGSAoj.exe
  C:\Windows\System\vWGSAoj.exe
  2⤵
  PID:7668
- C:\Windows\System\HsFLemM.exe
  C:\Windows\System\HsFLemM.exe
  2⤵
  PID:7696
- C:\Windows\System\LOefcTH.exe
  C:\Windows\System\LOefcTH.exe
  2⤵
  PID:7724
- C:\Windows\System\sSFkfHk.exe
  C:\Windows\System\sSFkfHk.exe
  2⤵
  PID:7764
- C:\Windows\System\drYwfyL.exe
  C:\Windows\System\drYwfyL.exe
  2⤵
  PID:7780
- C:\Windows\System\nbLmgPV.exe
  C:\Windows\System\nbLmgPV.exe
  2⤵
  PID:7808
- C:\Windows\System\hbVaILt.exe
  C:\Windows\System\hbVaILt.exe
  2⤵
  PID:7836
- C:\Windows\System\vYmSRRk.exe
  C:\Windows\System\vYmSRRk.exe
  2⤵
  PID:7864
- C:\Windows\System\LRtXPmi.exe
  C:\Windows\System\LRtXPmi.exe
  2⤵
  PID:7892
- C:\Windows\System\hxpiMEN.exe
  C:\Windows\System\hxpiMEN.exe
  2⤵
  PID:7920
- C:\Windows\System\stULroD.exe
  C:\Windows\System\stULroD.exe
  2⤵
  PID:7948
- C:\Windows\System\FDDEpAV.exe
  C:\Windows\System\FDDEpAV.exe
  2⤵
  PID:7984
- C:\Windows\System\WrzjfmG.exe
  C:\Windows\System\WrzjfmG.exe
  2⤵
  PID:8004
- C:\Windows\System\otXbzoN.exe
  C:\Windows\System\otXbzoN.exe
  2⤵
  PID:8032
- C:\Windows\System\wSMLIOA.exe
  C:\Windows\System\wSMLIOA.exe
  2⤵
  PID:8060
- C:\Windows\System\oGdcCly.exe
  C:\Windows\System\oGdcCly.exe
  2⤵
  PID:8092
- C:\Windows\System\oSMUoAw.exe
  C:\Windows\System\oSMUoAw.exe
  2⤵
  PID:8108
- C:\Windows\System\nlVoCgi.exe
  C:\Windows\System\nlVoCgi.exe
  2⤵
  PID:8128
- C:\Windows\System\TEQQnXS.exe
  C:\Windows\System\TEQQnXS.exe
  2⤵
  PID:8152
- C:\Windows\System\bNsAwGq.exe
  C:\Windows\System\bNsAwGq.exe
  2⤵
  PID:8184
- C:\Windows\System\ONvjhOu.exe
  C:\Windows\System\ONvjhOu.exe
  2⤵
  PID:6380
- C:\Windows\System\KLRmMKY.exe
  C:\Windows\System\KLRmMKY.exe
  2⤵
  PID:7256
- C:\Windows\System\eQkVWgb.exe
  C:\Windows\System\eQkVWgb.exe
  2⤵
  PID:7324
- C:\Windows\System\PnLTEhM.exe
  C:\Windows\System\PnLTEhM.exe
  2⤵
  PID:7352
- C:\Windows\System\DebOqXM.exe
  C:\Windows\System\DebOqXM.exe
  2⤵
  PID:7436
- C:\Windows\System\FXLIFAe.exe
  C:\Windows\System\FXLIFAe.exe
  2⤵
  PID:7512
- C:\Windows\System\ezPIpsM.exe
  C:\Windows\System\ezPIpsM.exe
  2⤵
  PID:7584
- C:\Windows\System\cYnvdzL.exe
  C:\Windows\System\cYnvdzL.exe
  2⤵
  PID:7660
- C:\Windows\System\AduGfqh.exe
  C:\Windows\System\AduGfqh.exe
  2⤵
  PID:7752
- C:\Windows\System\ffcctRB.exe
  C:\Windows\System\ffcctRB.exe
  2⤵
  PID:7800
- C:\Windows\System\zEVTyRO.exe
  C:\Windows\System\zEVTyRO.exe
  2⤵
  PID:7848
- C:\Windows\System\bBTdHpf.exe
  C:\Windows\System\bBTdHpf.exe
  2⤵
  PID:7904
- C:\Windows\System\siwZyXf.exe
  C:\Windows\System\siwZyXf.exe
  2⤵
  PID:7976
- C:\Windows\System\jRQsXWd.exe
  C:\Windows\System\jRQsXWd.exe
  2⤵
  PID:8080
- C:\Windows\System\shfEZWX.exe
  C:\Windows\System\shfEZWX.exe
  2⤵
  PID:8104
- C:\Windows\System\kXXpHLB.exe
  C:\Windows\System\kXXpHLB.exe
  2⤵
  PID:8120
- C:\Windows\System\uoPkJww.exe
  C:\Windows\System\uoPkJww.exe
  2⤵
  PID:6796
- C:\Windows\System\ytzwurA.exe
  C:\Windows\System\ytzwurA.exe
  2⤵
  PID:7272
- C:\Windows\System\chCdDjt.exe
  C:\Windows\System\chCdDjt.exe
  2⤵
  PID:7492
- C:\Windows\System\xjPBTwo.exe
  C:\Windows\System\xjPBTwo.exe
  2⤵
  PID:7628
- C:\Windows\System\SdhFQrb.exe
  C:\Windows\System\SdhFQrb.exe
  2⤵
  PID:7744
- C:\Windows\System\hntyQYf.exe
  C:\Windows\System\hntyQYf.exe
  2⤵
  PID:7936
- C:\Windows\System\JGAVsBi.exe
  C:\Windows\System\JGAVsBi.exe
  2⤵
  PID:8136
- C:\Windows\System\mtPspiv.exe
  C:\Windows\System\mtPspiv.exe
  2⤵
  PID:7304
- C:\Windows\System\bMsPZkj.exe
  C:\Windows\System\bMsPZkj.exe
  2⤵
  PID:7596
- C:\Windows\System\GjJxeJO.exe
  C:\Windows\System\GjJxeJO.exe
  2⤵
  PID:8020
- C:\Windows\System\yZcEFOT.exe
  C:\Windows\System\yZcEFOT.exe
  2⤵
  PID:6684
- C:\Windows\System\iEtFgzO.exe
  C:\Windows\System\iEtFgzO.exe
  2⤵
  PID:8204
- C:\Windows\System\WiVhqyg.exe
  C:\Windows\System\WiVhqyg.exe
  2⤵
  PID:8232
- C:\Windows\System\oRlNHtF.exe
  C:\Windows\System\oRlNHtF.exe
  2⤵
  PID:8260
- C:\Windows\System\dvqeyRO.exe
  C:\Windows\System\dvqeyRO.exe
  2⤵
  PID:8288
- C:\Windows\System\APYwtGP.exe
  C:\Windows\System\APYwtGP.exe
  2⤵
  PID:8320
- C:\Windows\System\ZcfGytX.exe
  C:\Windows\System\ZcfGytX.exe
  2⤵
  PID:8344
- C:\Windows\System\pBqPrEb.exe
  C:\Windows\System\pBqPrEb.exe
  2⤵
  PID:8372
- C:\Windows\System\MaFbtru.exe
  C:\Windows\System\MaFbtru.exe
  2⤵
  PID:8396
- C:\Windows\System\pssyeGe.exe
  C:\Windows\System\pssyeGe.exe
  2⤵
  PID:8428
- C:\Windows\System\zHBKYdN.exe
  C:\Windows\System\zHBKYdN.exe
  2⤵
  PID:8456
- C:\Windows\System\mmzSPdQ.exe
  C:\Windows\System\mmzSPdQ.exe
  2⤵
  PID:8480
- C:\Windows\System\QlzleZO.exe
  C:\Windows\System\QlzleZO.exe
  2⤵
  PID:8524
- C:\Windows\System\BTiYxau.exe
  C:\Windows\System\BTiYxau.exe
  2⤵
  PID:8540
- C:\Windows\System\iROCxOQ.exe
  C:\Windows\System\iROCxOQ.exe
  2⤵
  PID:8556
- C:\Windows\System\NMrBrVA.exe
  C:\Windows\System\NMrBrVA.exe
  2⤵
  PID:8580
- C:\Windows\System\VLiinHt.exe
  C:\Windows\System\VLiinHt.exe
  2⤵
  PID:8600
- C:\Windows\System\PdRWnYq.exe
  C:\Windows\System\PdRWnYq.exe
  2⤵
  PID:8628
- C:\Windows\System\becONJl.exe
  C:\Windows\System\becONJl.exe
  2⤵
  PID:8664
- C:\Windows\System\xApCOio.exe
  C:\Windows\System\xApCOio.exe
  2⤵
  PID:8684
- C:\Windows\System\LaaNpyY.exe
  C:\Windows\System\LaaNpyY.exe
  2⤵
  PID:8704
- C:\Windows\System\VMNQJGy.exe
  C:\Windows\System\VMNQJGy.exe
  2⤵
  PID:8728
- C:\Windows\System\QFpfQSO.exe
  C:\Windows\System\QFpfQSO.exe
  2⤵
  PID:8756
- C:\Windows\System\PsSNKZg.exe
  C:\Windows\System\PsSNKZg.exe
  2⤵
  PID:8784
- C:\Windows\System\IBWVLRO.exe
  C:\Windows\System\IBWVLRO.exe
  2⤵
  PID:8812
- C:\Windows\System\fqTTdWT.exe
  C:\Windows\System\fqTTdWT.exe
  2⤵
  PID:8840
- C:\Windows\System\zmqbgnG.exe
  C:\Windows\System\zmqbgnG.exe
  2⤵
  PID:8876
- C:\Windows\System\UtHkQWZ.exe
  C:\Windows\System\UtHkQWZ.exe
  2⤵
  PID:8892
- C:\Windows\System\ywfPeai.exe
  C:\Windows\System\ywfPeai.exe
  2⤵
  PID:8928
- C:\Windows\System\PhcJZKa.exe
  C:\Windows\System\PhcJZKa.exe
  2⤵
  PID:8956
- C:\Windows\System\qrGvxLB.exe
  C:\Windows\System\qrGvxLB.exe
  2⤵
  PID:8976
- C:\Windows\System\zlBqIRJ.exe
  C:\Windows\System\zlBqIRJ.exe
  2⤵
  PID:9004
- C:\Windows\System\EOfheRZ.exe
  C:\Windows\System\EOfheRZ.exe
  2⤵
  PID:9024
- C:\Windows\System\rtPgFes.exe
  C:\Windows\System\rtPgFes.exe
  2⤵
  PID:9056
- C:\Windows\System\LrYCgxA.exe
  C:\Windows\System\LrYCgxA.exe
  2⤵
  PID:9096
- C:\Windows\System\UJgIlFl.exe
  C:\Windows\System\UJgIlFl.exe
  2⤵
  PID:9124
- C:\Windows\System\wRjCBxB.exe
  C:\Windows\System\wRjCBxB.exe
  2⤵
  PID:9160
- C:\Windows\System\smHBXWb.exe
  C:\Windows\System\smHBXWb.exe
  2⤵
  PID:9180
- C:\Windows\System\YuxeZne.exe
  C:\Windows\System\YuxeZne.exe
  2⤵
  PID:9204
- C:\Windows\System\lgpMxTd.exe
  C:\Windows\System\lgpMxTd.exe
  2⤵
  PID:8168
- C:\Windows\System\AcbAuOb.exe
  C:\Windows\System\AcbAuOb.exe
  2⤵
  PID:8284
- C:\Windows\System\pYfqLMx.exe
  C:\Windows\System\pYfqLMx.exe
  2⤵
  PID:8328
- C:\Windows\System\LwvuzAX.exe
  C:\Windows\System\LwvuzAX.exe
  2⤵
  PID:8412
- C:\Windows\System\MzwcmRW.exe
  C:\Windows\System\MzwcmRW.exe
  2⤵
  PID:8508
- C:\Windows\System\gqpLULv.exe
  C:\Windows\System\gqpLULv.exe
  2⤵
  PID:8548
- C:\Windows\System\tHuYsRY.exe
  C:\Windows\System\tHuYsRY.exe
  2⤵
  PID:8596
- C:\Windows\System\DAfMQNH.exe
  C:\Windows\System\DAfMQNH.exe
  2⤵
  PID:8620
- C:\Windows\System\LFhzmaE.exe
  C:\Windows\System\LFhzmaE.exe
  2⤵
  PID:8740
- C:\Windows\System\xFVTHLR.exe
  C:\Windows\System\xFVTHLR.exe
  2⤵
  PID:8836
- C:\Windows\System\cCbKJDv.exe
  C:\Windows\System\cCbKJDv.exe
  2⤵
  PID:8912
- C:\Windows\System\DqDYPBc.exe
  C:\Windows\System\DqDYPBc.exe
  2⤵
  PID:8888
- C:\Windows\System\VODUUKh.exe
  C:\Windows\System\VODUUKh.exe
  2⤵
  PID:8992
- C:\Windows\System\sxRLbXU.exe
  C:\Windows\System\sxRLbXU.exe
  2⤵
  PID:9068
- C:\Windows\System\HpARIeJ.exe
  C:\Windows\System\HpARIeJ.exe
  2⤵
  PID:9132
- C:\Windows\System\TIXSdzw.exe
  C:\Windows\System\TIXSdzw.exe
  2⤵
  PID:8224
- C:\Windows\System\OCnTQiC.exe
  C:\Windows\System\OCnTQiC.exe
  2⤵
  PID:7476
- C:\Windows\System\rcKqQMb.exe
  C:\Windows\System\rcKqQMb.exe
  2⤵
  PID:8576
- C:\Windows\System\EJSPvKS.exe
  C:\Windows\System\EJSPvKS.exe
  2⤵
  PID:8692
- C:\Windows\System\XfZAzWv.exe
  C:\Windows\System\XfZAzWv.exe
  2⤵
  PID:8768
- C:\Windows\System\ddfLMyt.exe
  C:\Windows\System\ddfLMyt.exe
  2⤵
  PID:8884
- C:\Windows\System\IrTstum.exe
  C:\Windows\System\IrTstum.exe
  2⤵
  PID:9112
- C:\Windows\System\pIoLaSZ.exe
  C:\Windows\System\pIoLaSZ.exe
  2⤵
  PID:8332
- C:\Windows\System\rUNoQTJ.exe
  C:\Windows\System\rUNoQTJ.exe
  2⤵
  PID:8672
- C:\Windows\System\zQGiVki.exe
  C:\Windows\System\zQGiVki.exe
  2⤵
  PID:9196
- C:\Windows\System\hJYeupi.exe
  C:\Windows\System\hJYeupi.exe
  2⤵
  PID:8420
- C:\Windows\System\PtMtqDx.exe
  C:\Windows\System\PtMtqDx.exe
  2⤵
  PID:9220
- C:\Windows\System\nnFYpLD.exe
  C:\Windows\System\nnFYpLD.exe
  2⤵
  PID:9252
- C:\Windows\System\lptzYLf.exe
  C:\Windows\System\lptzYLf.exe
  2⤵
  PID:9288
- C:\Windows\System\OwIZsZj.exe
  C:\Windows\System\OwIZsZj.exe
  2⤵
  PID:9316
- C:\Windows\System\PXlBMWf.exe
  C:\Windows\System\PXlBMWf.exe
  2⤵
  PID:9344
- C:\Windows\System\xXJMomo.exe
  C:\Windows\System\xXJMomo.exe
  2⤵
  PID:9384
- C:\Windows\System\UOAprGC.exe
  C:\Windows\System\UOAprGC.exe
  2⤵
  PID:9420
- C:\Windows\System\STsLCoP.exe
  C:\Windows\System\STsLCoP.exe
  2⤵
  PID:9448
- C:\Windows\System\jqWlyfi.exe
  C:\Windows\System\jqWlyfi.exe
  2⤵
  PID:9464
- C:\Windows\System\HzMUPpx.exe
  C:\Windows\System\HzMUPpx.exe
  2⤵
  PID:9492
- C:\Windows\System\KJQlTBZ.exe
  C:\Windows\System\KJQlTBZ.exe
  2⤵
  PID:9520
- C:\Windows\System\QmFfQwC.exe
  C:\Windows\System\QmFfQwC.exe
  2⤵
  PID:9548
- C:\Windows\System\MwdPSzP.exe
  C:\Windows\System\MwdPSzP.exe
  2⤵
  PID:9576
- C:\Windows\System\ZcyxMGx.exe
  C:\Windows\System\ZcyxMGx.exe
  2⤵
  PID:9592
- C:\Windows\System\tYeaKok.exe
  C:\Windows\System\tYeaKok.exe
  2⤵
  PID:9624
- C:\Windows\System\PDQewKO.exe
  C:\Windows\System\PDQewKO.exe
  2⤵
  PID:9648
- C:\Windows\System\WEJuENc.exe
  C:\Windows\System\WEJuENc.exe
  2⤵
  PID:9676
- C:\Windows\System\NiAtmkE.exe
  C:\Windows\System\NiAtmkE.exe
  2⤵
  PID:9700
- C:\Windows\System\LOafEor.exe
  C:\Windows\System\LOafEor.exe
  2⤵
  PID:9720
- C:\Windows\System\HXCCnEl.exe
  C:\Windows\System\HXCCnEl.exe
  2⤵
  PID:9748
- C:\Windows\System\rNQEiRw.exe
  C:\Windows\System\rNQEiRw.exe
  2⤵
  PID:9772
- C:\Windows\System\vkOogND.exe
  C:\Windows\System\vkOogND.exe
  2⤵
  PID:9800
- C:\Windows\System\iEQTAAw.exe
  C:\Windows\System\iEQTAAw.exe
  2⤵
  PID:9820
- C:\Windows\System\rONLykz.exe
  C:\Windows\System\rONLykz.exe
  2⤵
  PID:9844
- C:\Windows\System\GYtamaV.exe
  C:\Windows\System\GYtamaV.exe
  2⤵
  PID:9876
- C:\Windows\System\JBywldq.exe
  C:\Windows\System\JBywldq.exe
  2⤵
  PID:9916
- C:\Windows\System\iyWkivI.exe
  C:\Windows\System\iyWkivI.exe
  2⤵
  PID:9944
- C:\Windows\System\sLHlqar.exe
  C:\Windows\System\sLHlqar.exe
  2⤵
  PID:9968
- C:\Windows\System\TivSUkU.exe
  C:\Windows\System\TivSUkU.exe
  2⤵
  PID:10000
- C:\Windows\System\SoZhhHz.exe
  C:\Windows\System\SoZhhHz.exe
  2⤵
  PID:10032
- C:\Windows\System\hsdpVKh.exe
  C:\Windows\System\hsdpVKh.exe
  2⤵
  PID:10064
- C:\Windows\System\WFMnzOj.exe
  C:\Windows\System\WFMnzOj.exe
  2⤵
  PID:10096
- C:\Windows\System\iQaHOqB.exe
  C:\Windows\System\iQaHOqB.exe
  2⤵
  PID:10124
- C:\Windows\System\bIKNnLp.exe
  C:\Windows\System\bIKNnLp.exe
  2⤵
  PID:10152
- C:\Windows\System\BFqruJS.exe
  C:\Windows\System\BFqruJS.exe
  2⤵
  PID:10188
- C:\Windows\System\tvsaQXx.exe
  C:\Windows\System\tvsaQXx.exe
  2⤵
  PID:10212
- C:\Windows\System\auBOlbO.exe
  C:\Windows\System\auBOlbO.exe
  2⤵
  PID:10236
- C:\Windows\System\BPfIHXF.exe
  C:\Windows\System\BPfIHXF.exe
  2⤵
  PID:9272
- C:\Windows\System\yltFhav.exe
  C:\Windows\System\yltFhav.exe
  2⤵
  PID:9340
- C:\Windows\System\DflClhY.exe
  C:\Windows\System\DflClhY.exe
  2⤵
  PID:9432
- C:\Windows\System\XKKKLKB.exe
  C:\Windows\System\XKKKLKB.exe
  2⤵
  PID:9480
- C:\Windows\System\YtCXQub.exe
  C:\Windows\System\YtCXQub.exe
  2⤵
  PID:9540
- C:\Windows\System\eglWlMs.exe
  C:\Windows\System\eglWlMs.exe
  2⤵
  PID:9584
- C:\Windows\System\amMEkPg.exe
  C:\Windows\System\amMEkPg.exe
  2⤵
  PID:9708
- C:\Windows\System\cBhgvMs.exe
  C:\Windows\System\cBhgvMs.exe
  2⤵
  PID:9744
- C:\Windows\System\edgAAHT.exe
  C:\Windows\System\edgAAHT.exe
  2⤵
  PID:9812
- C:\Windows\System\bZgaGcL.exe
  C:\Windows\System\bZgaGcL.exe
  2⤵
  PID:9940
- C:\Windows\System\CJjMnvA.exe
  C:\Windows\System\CJjMnvA.exe
  2⤵
  PID:9884
- C:\Windows\System\ggjldkJ.exe
  C:\Windows\System\ggjldkJ.exe
  2⤵
  PID:10024
- C:\Windows\System\EBtETAp.exe
  C:\Windows\System\EBtETAp.exe
  2⤵
  PID:10084
- C:\Windows\System\DIiXSWn.exe
  C:\Windows\System\DIiXSWn.exe
  2⤵
  PID:10104
- C:\Windows\System\wODUqmf.exe
  C:\Windows\System\wODUqmf.exe
  2⤵
  PID:10176
- C:\Windows\System\kFYlCPB.exe
  C:\Windows\System\kFYlCPB.exe
  2⤵
  PID:9232
- C:\Windows\System\UmFuXCP.exe
  C:\Windows\System\UmFuXCP.exe
  2⤵
  PID:9336
- C:\Windows\System\vBqelFE.exe
  C:\Windows\System\vBqelFE.exe
  2⤵
  PID:9604
- C:\Windows\System\UDUCZpQ.exe
  C:\Windows\System\UDUCZpQ.exe
  2⤵
  PID:9664
- C:\Windows\System\nImjBgz.exe
  C:\Windows\System\nImjBgz.exe
  2⤵
  PID:9872
- C:\Windows\System\akNCyvE.exe
  C:\Windows\System\akNCyvE.exe
  2⤵
  PID:9980
- C:\Windows\System\tteCZOd.exe
  C:\Windows\System\tteCZOd.exe
  2⤵
  PID:9236
- C:\Windows\System\oxaWsCZ.exe
  C:\Windows\System\oxaWsCZ.exe
  2⤵
  PID:9300
- C:\Windows\System\FumuTMb.exe
  C:\Windows\System\FumuTMb.exe
  2⤵
  PID:9832
- C:\Windows\System\aCTztsT.exe
  C:\Windows\System\aCTztsT.exe
  2⤵
  PID:9760
- C:\Windows\System\xtCPjAX.exe
  C:\Windows\System\xtCPjAX.exe
  2⤵
  PID:9456
- C:\Windows\System\yXqUnCq.exe
  C:\Windows\System\yXqUnCq.exe
  2⤵
  PID:9992
- C:\Windows\System\UjPvyDM.exe
  C:\Windows\System\UjPvyDM.exe
  2⤵
  PID:10272
- C:\Windows\System\SmRyJyq.exe
  C:\Windows\System\SmRyJyq.exe
  2⤵
  PID:10296
- C:\Windows\System\aObyCFI.exe
  C:\Windows\System\aObyCFI.exe
  2⤵
  PID:10324
- C:\Windows\System\TTPRZMz.exe
  C:\Windows\System\TTPRZMz.exe
  2⤵
  PID:10352
- C:\Windows\System\FfAKukw.exe
  C:\Windows\System\FfAKukw.exe
  2⤵
  PID:10376
- C:\Windows\System\DzwZptJ.exe
  C:\Windows\System\DzwZptJ.exe
  2⤵
  PID:10412
- C:\Windows\System\XqoqDSf.exe
  C:\Windows\System\XqoqDSf.exe
  2⤵
  PID:10432
- C:\Windows\System\mblsfGw.exe
  C:\Windows\System\mblsfGw.exe
  2⤵
  PID:10464
- C:\Windows\System\VIYXHmG.exe
  C:\Windows\System\VIYXHmG.exe
  2⤵
  PID:10508
- C:\Windows\System\heqLlmp.exe
  C:\Windows\System\heqLlmp.exe
  2⤵
  PID:10544
- C:\Windows\System\yFKrIso.exe
  C:\Windows\System\yFKrIso.exe
  2⤵
  PID:10576
- C:\Windows\System\DNMibHB.exe
  C:\Windows\System\DNMibHB.exe
  2⤵
  PID:10620
- C:\Windows\System\jcWhzAA.exe
  C:\Windows\System\jcWhzAA.exe
  2⤵
  PID:10664
- C:\Windows\System\fhSlsyF.exe
  C:\Windows\System\fhSlsyF.exe
  2⤵
  PID:10684
- C:\Windows\System\faYTwxg.exe
  C:\Windows\System\faYTwxg.exe
  2⤵
  PID:10712
- C:\Windows\System\GDwroGQ.exe
  C:\Windows\System\GDwroGQ.exe
  2⤵
  PID:10728
- C:\Windows\System\wgJICSI.exe
  C:\Windows\System\wgJICSI.exe
  2⤵
  PID:10760
- C:\Windows\System\EQXUirj.exe
  C:\Windows\System\EQXUirj.exe
  2⤵
  PID:10792
- C:\Windows\System\EZzjzVw.exe
  C:\Windows\System\EZzjzVw.exe
  2⤵
  PID:10812
- C:\Windows\System\bJCAPpv.exe
  C:\Windows\System\bJCAPpv.exe
  2⤵
  PID:10840
- C:\Windows\System\LhZQDur.exe
  C:\Windows\System\LhZQDur.exe
  2⤵
  PID:10864
- C:\Windows\System\aJMDYzX.exe
  C:\Windows\System\aJMDYzX.exe
  2⤵
  PID:10908
- C:\Windows\System\qnEeZNo.exe
  C:\Windows\System\qnEeZNo.exe
  2⤵
  PID:10940
- C:\Windows\System\pKHORwe.exe
  C:\Windows\System\pKHORwe.exe
  2⤵
  PID:10964
- C:\Windows\System\okrLBZl.exe
  C:\Windows\System\okrLBZl.exe
  2⤵
  PID:10996
- C:\Windows\System\IohEJon.exe
  C:\Windows\System\IohEJon.exe
  2⤵
  PID:11028
- C:\Windows\System\kYZmaTZ.exe
  C:\Windows\System\kYZmaTZ.exe
  2⤵
  PID:11048
- C:\Windows\System\hgbZgBE.exe
  C:\Windows\System\hgbZgBE.exe
  2⤵
  PID:11076
- C:\Windows\System\gxlnOYq.exe
  C:\Windows\System\gxlnOYq.exe
  2⤵
  PID:11104
- C:\Windows\System\ZWFtriU.exe
  C:\Windows\System\ZWFtriU.exe
  2⤵
  PID:11144
- C:\Windows\System\oLoUtJm.exe
  C:\Windows\System\oLoUtJm.exe
  2⤵
  PID:11160
- C:\Windows\System\ZsnRkPE.exe
  C:\Windows\System\ZsnRkPE.exe
  2⤵
  PID:11192
- C:\Windows\System\QtqcJFN.exe
  C:\Windows\System\QtqcJFN.exe
  2⤵
  PID:11212
- C:\Windows\System\IvePmOi.exe
  C:\Windows\System\IvePmOi.exe
  2⤵
  PID:11240
- C:\Windows\System\KjaEpgC.exe
  C:\Windows\System\KjaEpgC.exe
  2⤵
  PID:11260
- C:\Windows\System\hTprJMp.exe
  C:\Windows\System\hTprJMp.exe
  2⤵
  PID:10260
- C:\Windows\System\jpSfTtR.exe
  C:\Windows\System\jpSfTtR.exe
  2⤵
  PID:10292
- C:\Windows\System\VeGUGdf.exe
  C:\Windows\System\VeGUGdf.exe
  2⤵
  PID:10344
- C:\Windows\System\wBSnpat.exe
  C:\Windows\System\wBSnpat.exe
  2⤵
  PID:10420
- C:\Windows\System\YlyFApl.exe
  C:\Windows\System\YlyFApl.exe
  2⤵
  PID:10448
- C:\Windows\System\MNPMSTw.exe
  C:\Windows\System\MNPMSTw.exe
  2⤵
  PID:10588
- C:\Windows\System\LCzkgev.exe
  C:\Windows\System\LCzkgev.exe
  2⤵
  PID:10704
- C:\Windows\System\EWQDxTp.exe
  C:\Windows\System\EWQDxTp.exe
  2⤵
  PID:10696
- C:\Windows\System\DPHuKRg.exe
  C:\Windows\System\DPHuKRg.exe
  2⤵
  PID:10832
- C:\Windows\System\lnFBSQK.exe
  C:\Windows\System\lnFBSQK.exe
  2⤵
  PID:10824
- C:\Windows\System\sKehdUH.exe
  C:\Windows\System\sKehdUH.exe
  2⤵
  PID:10920
- C:\Windows\System\WtBlavE.exe
  C:\Windows\System\WtBlavE.exe
  2⤵
  PID:10956
- C:\Windows\System\XQkRboM.exe
  C:\Windows\System\XQkRboM.exe
  2⤵
  PID:11072
- C:\Windows\System\kjEruEL.exe
  C:\Windows\System\kjEruEL.exe
  2⤵
  PID:11152
- C:\Windows\System\eniXLFe.exe
  C:\Windows\System\eniXLFe.exe
  2⤵
  PID:11252
- C:\Windows\System\EHKDOxc.exe
  C:\Windows\System\EHKDOxc.exe
  2⤵
  PID:8796
- C:\Windows\System\DFTYWhp.exe
  C:\Windows\System\DFTYWhp.exe
  2⤵
  PID:10392
- C:\Windows\System\rNOOuEG.exe
  C:\Windows\System\rNOOuEG.exe
  2⤵
  PID:10700
- C:\Windows\System\RtfwzQM.exe
  C:\Windows\System\RtfwzQM.exe
  2⤵
  PID:10524
- C:\Windows\System\aYHQuOy.exe
  C:\Windows\System\aYHQuOy.exe
  2⤵
  PID:10952
- C:\Windows\System\GUNXWsH.exe
  C:\Windows\System\GUNXWsH.exe
  2⤵
  PID:11096
- C:\Windows\System\NUXlVlK.exe
  C:\Windows\System\NUXlVlK.exe
  2⤵
  PID:11200
- C:\Windows\System\SsbNMYt.exe
  C:\Windows\System\SsbNMYt.exe
  2⤵
  PID:10636
- C:\Windows\System\lmWnnuw.exe
  C:\Windows\System\lmWnnuw.exe
  2⤵
  PID:10672
- C:\Windows\System\LtbRJZL.exe
  C:\Windows\System\LtbRJZL.exe
  2⤵
  PID:10444
- C:\Windows\System\DLwlHGJ.exe
  C:\Windows\System\DLwlHGJ.exe
  2⤵
  PID:10368
- C:\Windows\System\CYJsvFn.exe
  C:\Windows\System\CYJsvFn.exe
  2⤵
  PID:11296
- C:\Windows\System\xNAQxxs.exe
  C:\Windows\System\xNAQxxs.exe
  2⤵
  PID:11320
- C:\Windows\System\MVTtAMW.exe
  C:\Windows\System\MVTtAMW.exe
  2⤵
  PID:11344
- C:\Windows\System\EuHbsCV.exe
  C:\Windows\System\EuHbsCV.exe
  2⤵
  PID:11368
- C:\Windows\System\KRrgMRm.exe
  C:\Windows\System\KRrgMRm.exe
  2⤵
  PID:11392
- C:\Windows\System\Gtgkhif.exe
  C:\Windows\System\Gtgkhif.exe
  2⤵
  PID:11428
- C:\Windows\System\nTKIbnu.exe
  C:\Windows\System\nTKIbnu.exe
  2⤵
  PID:11452
- C:\Windows\System\cdOgDTZ.exe
  C:\Windows\System\cdOgDTZ.exe
  2⤵
  PID:11484
- C:\Windows\System\mcbsjEY.exe
  C:\Windows\System\mcbsjEY.exe
  2⤵
  PID:11512
- C:\Windows\System\FOrwzyL.exe
  C:\Windows\System\FOrwzyL.exe
  2⤵
  PID:11540
- C:\Windows\System\MrxZLBJ.exe
  C:\Windows\System\MrxZLBJ.exe
  2⤵
  PID:11568
- C:\Windows\System\OgPmesI.exe
  C:\Windows\System\OgPmesI.exe
  2⤵
  PID:11588
- C:\Windows\System\IUziQEZ.exe
  C:\Windows\System\IUziQEZ.exe
  2⤵
  PID:11620
- C:\Windows\System\aWVqDyb.exe
  C:\Windows\System\aWVqDyb.exe
  2⤵
  PID:11660
- C:\Windows\System\eQQQAkm.exe
  C:\Windows\System\eQQQAkm.exe
  2⤵
  PID:11684
- C:\Windows\System\ZredrnC.exe
  C:\Windows\System\ZredrnC.exe
  2⤵
  PID:11716
- C:\Windows\System\trWcitY.exe
  C:\Windows\System\trWcitY.exe
  2⤵
  PID:11740
- C:\Windows\System\GEtEues.exe
  C:\Windows\System\GEtEues.exe
  2⤵
  PID:11764
- C:\Windows\System\KdycAXy.exe
  C:\Windows\System\KdycAXy.exe
  2⤵
  PID:11800
- C:\Windows\System\qWCxGJW.exe
  C:\Windows\System\qWCxGJW.exe
  2⤵
  PID:11824
- C:\Windows\System\lyFYGQD.exe
  C:\Windows\System\lyFYGQD.exe
  2⤵
  PID:11860
- C:\Windows\System\SUhYwqw.exe
  C:\Windows\System\SUhYwqw.exe
  2⤵
  PID:11896
- C:\Windows\System\qEoQsOt.exe
  C:\Windows\System\qEoQsOt.exe
  2⤵
  PID:11920
- C:\Windows\System\AkopPMT.exe
  C:\Windows\System\AkopPMT.exe
  2⤵
  PID:11944
- C:\Windows\System\laiFDIq.exe
  C:\Windows\System\laiFDIq.exe
  2⤵
  PID:11980
- C:\Windows\System\EVHVtmd.exe
  C:\Windows\System\EVHVtmd.exe
  2⤵
  PID:12016
- C:\Windows\System\wtMFEVY.exe
  C:\Windows\System\wtMFEVY.exe
  2⤵
  PID:12040
- C:\Windows\System\KhyGJLQ.exe
  C:\Windows\System\KhyGJLQ.exe
  2⤵
  PID:12072
- C:\Windows\System\lxCNmcB.exe
  C:\Windows\System\lxCNmcB.exe
  2⤵
  PID:12100
- C:\Windows\System\tPtuImN.exe
  C:\Windows\System\tPtuImN.exe
  2⤵
  PID:12128
- C:\Windows\System\GincjAv.exe
  C:\Windows\System\GincjAv.exe
  2⤵
  PID:12156
- C:\Windows\System\DAagglR.exe
  C:\Windows\System\DAagglR.exe
  2⤵
  PID:12184
- C:\Windows\System\ARaYiJj.exe
  C:\Windows\System\ARaYiJj.exe
  2⤵
  PID:12216
- C:\Windows\System\ZANLRlA.exe
  C:\Windows\System\ZANLRlA.exe
  2⤵
  PID:12244
- C:\Windows\System\ShFKdeD.exe
  C:\Windows\System\ShFKdeD.exe
  2⤵
  PID:12264
- C:\Windows\System\CbKHJEL.exe
  C:\Windows\System\CbKHJEL.exe
  2⤵
  PID:12284
- C:\Windows\System\AtyWJyg.exe
  C:\Windows\System\AtyWJyg.exe
  2⤵
  PID:11064
- C:\Windows\System\qDGTeyl.exe
  C:\Windows\System\qDGTeyl.exe
  2⤵
  PID:11304
- C:\Windows\System\JXKbcIX.exe
  C:\Windows\System\JXKbcIX.exe
  2⤵
  PID:11380
- C:\Windows\System\QDZgEhU.exe
  C:\Windows\System\QDZgEhU.exe
  2⤵
  PID:11500
- C:\Windows\System\WVGOfHg.exe
  C:\Windows\System\WVGOfHg.exe
  2⤵
  PID:11564
- C:\Windows\System\gcfZlOx.exe
  C:\Windows\System\gcfZlOx.exe
  2⤵
  PID:11584
- C:\Windows\System\euVMqrX.exe
  C:\Windows\System\euVMqrX.exe
  2⤵
  PID:11692
- C:\Windows\System\KJsBdTZ.exe
  C:\Windows\System\KJsBdTZ.exe
  2⤵
  PID:11728
- C:\Windows\System\DNXQAaM.exe
  C:\Windows\System\DNXQAaM.exe
  2⤵
  PID:11752
- C:\Windows\System\tODZfVV.exe
  C:\Windows\System\tODZfVV.exe
  2⤵
  PID:11840
- C:\Windows\System\kFjfWmX.exe
  C:\Windows\System\kFjfWmX.exe
  2⤵
  PID:11892
- C:\Windows\System\bDRnkps.exe
  C:\Windows\System\bDRnkps.exe
  2⤵
  PID:12004
- C:\Windows\System\CllpksJ.exe
  C:\Windows\System\CllpksJ.exe
  2⤵
  PID:12060
- C:\Windows\System\yNpQajt.exe
  C:\Windows\System\yNpQajt.exe
  2⤵
  PID:12116
- C:\Windows\System\fqcWyCN.exe
  C:\Windows\System\fqcWyCN.exe
  2⤵
  PID:12172
- C:\Windows\System\QDhaovP.exe
  C:\Windows\System\QDhaovP.exe
  2⤵
  PID:12280
- C:\Windows\System\igVTTiI.exe
  C:\Windows\System\igVTTiI.exe
  2⤵
  PID:11332
- C:\Windows\System\BEmawzf.exe
  C:\Windows\System\BEmawzf.exe
  2⤵
  PID:11292
- C:\Windows\System\CpeVUXq.exe
  C:\Windows\System\CpeVUXq.exe
  2⤵
  PID:11528
- C:\Windows\System\zoLSnfQ.exe
  C:\Windows\System\zoLSnfQ.exe
  2⤵
  PID:11556
- C:\Windows\System\JROpgMJ.exe
  C:\Windows\System\JROpgMJ.exe
  2⤵
  PID:11644
- C:\Windows\System\fGIMnQK.exe
  C:\Windows\System\fGIMnQK.exe
  2⤵
  PID:11932
- C:\Windows\System\ypZLyUm.exe
  C:\Windows\System\ypZLyUm.exe
  2⤵
  PID:12096
- C:\Windows\System\bOIpuFo.exe
  C:\Windows\System\bOIpuFo.exe
  2⤵
  PID:12276
- C:\Windows\System\jYbUKrz.exe
  C:\Windows\System\jYbUKrz.exe
  2⤵
  PID:11632
- C:\Windows\System\QXWiAQd.exe
  C:\Windows\System\QXWiAQd.exe
  2⤵
  PID:11760
- C:\Windows\System\pFsuzfX.exe
  C:\Windows\System\pFsuzfX.exe
  2⤵
  PID:11176
- C:\Windows\System\HQAIrBg.exe
  C:\Windows\System\HQAIrBg.exe
  2⤵
  PID:12296
- C:\Windows\System\hQgQYZB.exe
  C:\Windows\System\hQgQYZB.exe
  2⤵
  PID:12328
- C:\Windows\System\nkBJXMS.exe
  C:\Windows\System\nkBJXMS.exe
  2⤵
  PID:12352
- C:\Windows\System\gOyjZkb.exe
  C:\Windows\System\gOyjZkb.exe
  2⤵
  PID:12376
- C:\Windows\System\szbtrQI.exe
  C:\Windows\System\szbtrQI.exe
  2⤵
  PID:12396
- C:\Windows\System\BvPPuai.exe
  C:\Windows\System\BvPPuai.exe
  2⤵
  PID:12420
- C:\Windows\System\yJzEaVR.exe
  C:\Windows\System\yJzEaVR.exe
  2⤵
  PID:12456
- C:\Windows\System\jIWdqVL.exe
  C:\Windows\System\jIWdqVL.exe
  2⤵
  PID:12500
- C:\Windows\System\BDHRdXb.exe
  C:\Windows\System\BDHRdXb.exe
  2⤵
  PID:12524
- C:\Windows\System\gejZXBu.exe
  C:\Windows\System\gejZXBu.exe
  2⤵
  PID:12552
- C:\Windows\System\UkNafLx.exe
  C:\Windows\System\UkNafLx.exe
  2⤵
  PID:12584
- C:\Windows\System\vNLtExk.exe
  C:\Windows\System\vNLtExk.exe
  2⤵
  PID:12608
- C:\Windows\System\nEKoTuV.exe
  C:\Windows\System\nEKoTuV.exe
  2⤵
  PID:12640
- C:\Windows\System\GVOoxvC.exe
  C:\Windows\System\GVOoxvC.exe
  2⤵
  PID:12664
- C:\Windows\System\RkUQsAI.exe
  C:\Windows\System\RkUQsAI.exe
  2⤵
  PID:12688
- C:\Windows\System\INwknxW.exe
  C:\Windows\System\INwknxW.exe
  2⤵
  PID:12716
- C:\Windows\System\EdJoPCA.exe
  C:\Windows\System\EdJoPCA.exe
  2⤵
  PID:12748
- C:\Windows\System\DOXFeWN.exe
  C:\Windows\System\DOXFeWN.exe
  2⤵
  PID:12772
- C:\Windows\System\bsxtPtF.exe
  C:\Windows\System\bsxtPtF.exe
  2⤵
  PID:12800
- C:\Windows\System\lzzVPeh.exe
  C:\Windows\System\lzzVPeh.exe
  2⤵
  PID:12820
- C:\Windows\System\spYEMAE.exe
  C:\Windows\System\spYEMAE.exe
  2⤵
  PID:12836
- C:\Windows\System\oWhPGan.exe
  C:\Windows\System\oWhPGan.exe
  2⤵
  PID:12872
- C:\Windows\System\HpwEfBv.exe
  C:\Windows\System\HpwEfBv.exe
  2⤵
  PID:12900
- C:\Windows\System\NAWHjZJ.exe
  C:\Windows\System\NAWHjZJ.exe
  2⤵
  PID:12928
- C:\Windows\System\DbvZsXb.exe
  C:\Windows\System\DbvZsXb.exe
  2⤵
  PID:12952
- C:\Windows\System\fgZQPog.exe
  C:\Windows\System\fgZQPog.exe
  2⤵
  PID:12976
- C:\Windows\System\PKZwiZH.exe
  C:\Windows\System\PKZwiZH.exe
  2⤵
  PID:13016
- C:\Windows\System\tQXnOjo.exe
  C:\Windows\System\tQXnOjo.exe
  2⤵
  PID:13052
- C:\Windows\System\YvpbPhl.exe
  C:\Windows\System\YvpbPhl.exe
  2⤵
  PID:13080
- C:\Windows\System\sqGutZT.exe
  C:\Windows\System\sqGutZT.exe
  2⤵
  PID:13108
- C:\Windows\System\GnxsHQM.exe
  C:\Windows\System\GnxsHQM.exe
  2⤵
  PID:13128
- C:\Windows\System\yNdwgNQ.exe
  C:\Windows\System\yNdwgNQ.exe
  2⤵
  PID:13160
- C:\Windows\System\EqGNOvI.exe
  C:\Windows\System\EqGNOvI.exe
  2⤵
  PID:13188
- C:\Windows\System\HyXEvSl.exe
  C:\Windows\System\HyXEvSl.exe
  2⤵
  PID:13224
- C:\Windows\System\boNOwKL.exe
  C:\Windows\System\boNOwKL.exe
  2⤵
  PID:13248
- C:\Windows\System\FyuplGG.exe
  C:\Windows\System\FyuplGG.exe
  2⤵
  PID:13284
- C:\Windows\System\UKnEbVQ.exe
  C:\Windows\System\UKnEbVQ.exe
  2⤵
  PID:11476
- C:\Windows\System\FToQDHz.exe
  C:\Windows\System\FToQDHz.exe
  2⤵
  PID:11472
- C:\Windows\System\ePzwAga.exe
  C:\Windows\System\ePzwAga.exe
  2⤵
  PID:12312
- C:\Windows\System\ZswJxIk.exe
  C:\Windows\System\ZswJxIk.exe
  2⤵
  PID:12388
- C:\Windows\System\cQfuNxd.exe
  C:\Windows\System\cQfuNxd.exe
  2⤵
  PID:12512
- C:\Windows\System\FeeqlNL.exe
  C:\Windows\System\FeeqlNL.exe
  2⤵
  PID:12540
- C:\Windows\System\KWyXUkY.exe
  C:\Windows\System\KWyXUkY.exe
  2⤵
  PID:12628
- C:\Windows\System\SWPuoWW.exe
  C:\Windows\System\SWPuoWW.exe
  2⤵
  PID:12700
- C:\Windows\System\CqdEvuN.exe
  C:\Windows\System\CqdEvuN.exe
  2⤵
  PID:12676
- C:\Windows\System\BkxhMAt.exe
  C:\Windows\System\BkxhMAt.exe
  2⤵
  PID:12792
- C:\Windows\System\eraWeer.exe
  C:\Windows\System\eraWeer.exe
  2⤵
  PID:12880
- C:\Windows\System\URDWjeY.exe
  C:\Windows\System\URDWjeY.exe
  2⤵
  PID:12852
- C:\Windows\System\nXnUKXa.exe
  C:\Windows\System\nXnUKXa.exe
  2⤵
  PID:13008
- C:\Windows\System\MgdToPJ.exe
  C:\Windows\System\MgdToPJ.exe
  2⤵
  PID:13000
- C:\Windows\System\sXQrOpu.exe
  C:\Windows\System\sXQrOpu.exe
  2⤵
  PID:12988
- C:\Windows\System\MQnrSti.exe
  C:\Windows\System\MQnrSti.exe
  2⤵
  PID:13152
- C:\Windows\System\QMTQJFF.exe
  C:\Windows\System\QMTQJFF.exe
  2⤵
  PID:13140
- C:\Windows\System\DEKamFj.exe
  C:\Windows\System\DEKamFj.exe
  2⤵
  PID:13216
- C:\Windows\System\CtvOEkN.exe
  C:\Windows\System\CtvOEkN.exe
  2⤵
  PID:12232
- C:\Windows\System\lNrVYcJ.exe
  C:\Windows\System\lNrVYcJ.exe
  2⤵
  PID:12448
- C:\Windows\System\VaTeaef.exe
  C:\Windows\System\VaTeaef.exe
  2⤵
  PID:12368
- C:\Windows\System\NKFvXwL.exe
  C:\Windows\System\NKFvXwL.exe
  2⤵
  PID:12788
- C:\Windows\System\pbyzvEd.exe
  C:\Windows\System\pbyzvEd.exe
  2⤵
  PID:12736
- C:\Windows\System\cVUQGZi.exe
  C:\Windows\System\cVUQGZi.exe
  2⤵
  PID:12860
- C:\Windows\System\xMqHhst.exe
  C:\Windows\System\xMqHhst.exe
  2⤵
  PID:13272
- C:\Windows\System\PSaHDDm.exe
  C:\Windows\System\PSaHDDm.exe
  2⤵
  PID:13240
- C:\Windows\System\jCTbliV.exe
  C:\Windows\System\jCTbliV.exe
  2⤵
  PID:12428
- C:\Windows\System\wrGOKIK.exe
  C:\Windows\System\wrGOKIK.exe
  2⤵
  PID:12968
- C:\Windows\System\gzHnzao.exe
  C:\Windows\System\gzHnzao.exe
  2⤵
  PID:13340
- C:\Windows\System\blIptYj.exe
  C:\Windows\System\blIptYj.exe
  2⤵
  PID:13364
- C:\Windows\System\OusXUPt.exe
  C:\Windows\System\OusXUPt.exe
  2⤵
  PID:13392
- C:\Windows\System\VDVyBsd.exe
  C:\Windows\System\VDVyBsd.exe
  2⤵
  PID:13424
- C:\Windows\System\fQQFohf.exe
  C:\Windows\System\fQQFohf.exe
  2⤵
  PID:13452
- C:\Windows\System\cAXGEAD.exe
  C:\Windows\System\cAXGEAD.exe
  2⤵
  PID:13476
- C:\Windows\System\ttmTFQe.exe
  C:\Windows\System\ttmTFQe.exe
  2⤵
  PID:13504
- C:\Windows\System\vaiYfGb.exe
  C:\Windows\System\vaiYfGb.exe
  2⤵
  PID:13536
- C:\Windows\System\PfybBMm.exe
  C:\Windows\System\PfybBMm.exe
  2⤵
  PID:13568
- C:\Windows\System\CBjEsCC.exe
  C:\Windows\System\CBjEsCC.exe
  2⤵
  PID:13604
- C:\Windows\System\wSuYCyL.exe
  C:\Windows\System\wSuYCyL.exe
  2⤵
  PID:13624
- C:\Windows\System\APBSjiq.exe
  C:\Windows\System\APBSjiq.exe
  2⤵
  PID:13656
- C:\Windows\System\gyGslHI.exe
  C:\Windows\System\gyGslHI.exe
  2⤵
  PID:13688
- C:\Windows\System\wZsXrnw.exe
  C:\Windows\System\wZsXrnw.exe
  2⤵
  PID:13720
- C:\Windows\System\ozYEmor.exe
  C:\Windows\System\ozYEmor.exe
  2⤵
  PID:13740
- C:\Windows\System\LvVGjdJ.exe
  C:\Windows\System\LvVGjdJ.exe
  2⤵
  PID:13776
- C:\Windows\System\ZCGzHPr.exe
  C:\Windows\System\ZCGzHPr.exe
  2⤵
  PID:13800
- C:\Windows\System\FLRwLfx.exe
  C:\Windows\System\FLRwLfx.exe
  2⤵
  PID:13824
- C:\Windows\System\JgvzNFH.exe
  C:\Windows\System\JgvzNFH.exe
  2⤵
  PID:13852
- C:\Windows\System\pAXCehB.exe
  C:\Windows\System\pAXCehB.exe
  2⤵
  PID:13880
- C:\Windows\System\FYCMfGg.exe
  C:\Windows\System\FYCMfGg.exe
  2⤵
  PID:13912
- C:\Windows\System\cqoDJpo.exe
  C:\Windows\System\cqoDJpo.exe
  2⤵
  PID:13940
- C:\Windows\System\DwvifMU.exe
  C:\Windows\System\DwvifMU.exe
  2⤵
  PID:13964
- C:\Windows\System\rpMvMcP.exe
  C:\Windows\System\rpMvMcP.exe
  2⤵
  PID:13988
- C:\Windows\System\YMQKTsP.exe
  C:\Windows\System\YMQKTsP.exe
  2⤵
  PID:14012
- C:\Windows\System\UERuMYA.exe
  C:\Windows\System\UERuMYA.exe
  2⤵
  PID:14040
- C:\Windows\System\QnNvWpV.exe
  C:\Windows\System\QnNvWpV.exe
  2⤵
  PID:14060
- C:\Windows\System\bRhubfw.exe
  C:\Windows\System\bRhubfw.exe
  2⤵
  PID:14084
- C:\Windows\System\yaZWfdt.exe
  C:\Windows\System\yaZWfdt.exe
  2⤵
  PID:14116
- C:\Windows\System\MCkDxYa.exe
  C:\Windows\System\MCkDxYa.exe
  2⤵
  PID:14136
- C:\Windows\System\jFOgIyJ.exe
  C:\Windows\System\jFOgIyJ.exe
  2⤵
  PID:14176
- C:\Windows\System\yVPDyKt.exe
  C:\Windows\System\yVPDyKt.exe
  2⤵
  PID:14204
- C:\Windows\System\WDAXQyo.exe
  C:\Windows\System\WDAXQyo.exe
  2⤵
  PID:14232
- C:\Windows\System\VjpXSXK.exe
  C:\Windows\System\VjpXSXK.exe
  2⤵
  PID:14260
- C:\Windows\System\bUEirAe.exe
  C:\Windows\System\bUEirAe.exe
  2⤵
  PID:14296
- C:\Windows\System\FtCrBrG.exe
  C:\Windows\System\FtCrBrG.exe
  2⤵
  PID:14324
- C:\Windows\System\heMTLeI.exe
  C:\Windows\System\heMTLeI.exe
  2⤵
  PID:12576
- C:\Windows\System\LjELxhC.exe
  C:\Windows\System\LjELxhC.exe
  2⤵
  PID:13236
- C:\Windows\System\pIUAvIu.exe
  C:\Windows\System\pIUAvIu.exe
  2⤵
  PID:12684
- C:\Windows\System\YXbBrir.exe
  C:\Windows\System\YXbBrir.exe
  2⤵
  PID:13448
- C:\Windows\System\pIYriqG.exe
  C:\Windows\System\pIYriqG.exe
  2⤵
  PID:13516
- C:\Windows\System\tYDcGls.exe
  C:\Windows\System\tYDcGls.exe
  2⤵
  PID:13492
- C:\Windows\System\SPgurfp.exe
  C:\Windows\System\SPgurfp.exe
  2⤵
  PID:13652
- C:\Windows\System\Qpghith.exe
  C:\Windows\System\Qpghith.exe
  2⤵
  PID:13544
- C:\Windows\System\nNLYyEA.exe
  C:\Windows\System\nNLYyEA.exe
  2⤵
  PID:13732
- C:\Windows\System\ISqLzDL.exe
  C:\Windows\System\ISqLzDL.exe
  2⤵
  PID:13836
- C:\Windows\System\DADBgqc.exe
  C:\Windows\System\DADBgqc.exe
  2⤵
  PID:13904
- C:\Windows\System\gZIESCg.exe
  C:\Windows\System\gZIESCg.exe
  2⤵
  PID:13996
- C:\Windows\System\RSgJHnZ.exe
  C:\Windows\System\RSgJHnZ.exe
  2⤵
  PID:13952
- C:\Windows\System\RlVsGWV.exe
  C:\Windows\System\RlVsGWV.exe
  2⤵
  PID:14028
- C:\Windows\System\rUJnxDk.exe
  C:\Windows\System\rUJnxDk.exe
  2⤵
  PID:14128
- C:\Windows\System\nsUwIFk.exe
  C:\Windows\System\nsUwIFk.exe
  2⤵
  PID:14108
- C:\Windows\System\jmhofLm.exe
  C:\Windows\System\jmhofLm.exe
  2⤵
  PID:14272
- C:\Windows\System\SYGShoH.exe
  C:\Windows\System\SYGShoH.exe
  2⤵
  PID:14320
- C:\Windows\System\aIYNtVp.exe
  C:\Windows\System\aIYNtVp.exe
  2⤵
  PID:14276
- C:\Windows\System\TrHaasX.exe
  C:\Windows\System\TrHaasX.exe
  2⤵
  PID:13564
- C:\Windows\System\IrlnyjW.exe
  C:\Windows\System\IrlnyjW.exe
  2⤵
  PID:13440
- C:\Windows\System\swRojjF.exe
  C:\Windows\System\swRojjF.exe
  2⤵
  PID:13616
- C:\Windows\System\tLcqiQO.exe
  C:\Windows\System\tLcqiQO.exe
  2⤵
  PID:13844
- C:\Windows\System\fMJlODq.exe
  C:\Windows\System\fMJlODq.exe
  2⤵
  PID:13864
- C:\Windows\System\mUcANOQ.exe
  C:\Windows\System\mUcANOQ.exe
  2⤵
  PID:14024
- C:\Windows\System\YgQyJMt.exe
  C:\Windows\System\YgQyJMt.exe
  2⤵
  PID:14280
- C:\Windows\System\lmEWdjw.exe
  C:\Windows\System\lmEWdjw.exe
  2⤵
  PID:14168
- C:\Windows\System\WBoEAIs.exe
  C:\Windows\System\WBoEAIs.exe
  2⤵
  PID:13528
- C:\Windows\System\fyoHKUA.exe
  C:\Windows\System\fyoHKUA.exe
  2⤵
  PID:13488
- C:\Windows\System\VXYNhei.exe
  C:\Windows\System\VXYNhei.exe
  2⤵
  PID:14348
- C:\Windows\System\HPCAtwE.exe
  C:\Windows\System\HPCAtwE.exe
  2⤵
  PID:14380
- C:\Windows\System\QutEYZT.exe
  C:\Windows\System\QutEYZT.exe
  2⤵
  PID:14404
- C:\Windows\System\mLuLaJr.exe
  C:\Windows\System\mLuLaJr.exe
  2⤵
  PID:14436
- C:\Windows\System\ysdhyrA.exe
  C:\Windows\System\ysdhyrA.exe
  2⤵
  PID:14460
- C:\Windows\System\xbuvqbl.exe
  C:\Windows\System\xbuvqbl.exe
  2⤵
  PID:14604
- C:\Windows\System\alnVutS.exe
  C:\Windows\System\alnVutS.exe
  2⤵
  PID:14636
- C:\Windows\System\jXowCWN.exe
  C:\Windows\System\jXowCWN.exe
  2⤵
  PID:14680
- C:\Windows\System\vmARbaN.exe
  C:\Windows\System\vmARbaN.exe
  2⤵
  PID:14696
- C:\Windows\System\iLJTQRt.exe
  C:\Windows\System\iLJTQRt.exe
  2⤵
  PID:14724
- C:\Windows\System\eksHncC.exe
  C:\Windows\System\eksHncC.exe
  2⤵
  PID:14748
- C:\Windows\System\wlqyRDi.exe
  C:\Windows\System\wlqyRDi.exe
  2⤵
  PID:14772
- C:\Windows\System\FxAfoUn.exe
  C:\Windows\System\FxAfoUn.exe
  2⤵
  PID:14796
- C:\Windows\System\mLxSmsm.exe
  C:\Windows\System\mLxSmsm.exe
  2⤵
  PID:14820
- C:\Windows\System\AaSaRYK.exe
  C:\Windows\System\AaSaRYK.exe
  2⤵
  PID:14848
- C:\Windows\System\nXSqSZm.exe
  C:\Windows\System\nXSqSZm.exe
  2⤵
  PID:14876
- C:\Windows\System\SYMtObc.exe
  C:\Windows\System\SYMtObc.exe
  2⤵
  PID:14896
- C:\Windows\System\KjPUpCi.exe
  C:\Windows\System\KjPUpCi.exe
  2⤵
  PID:14912
- C:\Windows\System\GEdoVGl.exe
  C:\Windows\System\GEdoVGl.exe
  2⤵
  PID:14944
- C:\Windows\System\ihFbwna.exe
  C:\Windows\System\ihFbwna.exe
  2⤵
  PID:14984
- C:\Windows\System\eRxrTWe.exe
  C:\Windows\System\eRxrTWe.exe
  2⤵
  PID:15012
- C:\Windows\System\rXvJRyo.exe
  C:\Windows\System\rXvJRyo.exe
  2⤵
  PID:15044
- C:\Windows\System\pTQmmBl.exe
  C:\Windows\System\pTQmmBl.exe
  2⤵
  PID:15068
- C:\Windows\System\ihDOHtp.exe
  C:\Windows\System\ihDOHtp.exe
  2⤵
  PID:15100
- C:\Windows\System\OxRyQfS.exe
  C:\Windows\System\OxRyQfS.exe
  2⤵
  PID:15124
- C:\Windows\System\zyHvhOc.exe
  C:\Windows\System\zyHvhOc.exe
  2⤵
  PID:15160
- C:\Windows\System\LWdJJYc.exe
  C:\Windows\System\LWdJJYc.exe
  2⤵
  PID:15184
- C:\Windows\System\bKSIEZw.exe
  C:\Windows\System\bKSIEZw.exe
  2⤵
  PID:15212
- C:\Windows\System\iCqovoG.exe
  C:\Windows\System\iCqovoG.exe
  2⤵
  PID:15232
- C:\Windows\System\zbwaOul.exe
  C:\Windows\System\zbwaOul.exe
  2⤵
  PID:15256
- C:\Windows\System\ajJELCL.exe
  C:\Windows\System\ajJELCL.exe
  2⤵
  PID:15280
- C:\Windows\System\FgwABKJ.exe
  C:\Windows\System\FgwABKJ.exe
  2⤵
  PID:15300
- C:\Windows\System\raMMqrV.exe
  C:\Windows\System\raMMqrV.exe
  2⤵
  PID:15328
- C:\Windows\System\xHhFCrd.exe
  C:\Windows\System\xHhFCrd.exe
  2⤵
  PID:15356
- C:\Windows\System\roUZsRH.exe
  C:\Windows\System\roUZsRH.exe
  2⤵
  PID:14216
- C:\Windows\System\GXqBMyu.exe
  C:\Windows\System\GXqBMyu.exe
  2⤵
  PID:13436
- C:\Windows\System\MzXaPRK.exe
  C:\Windows\System\MzXaPRK.exe
  2⤵
  PID:14112
- C:\Windows\System\sbKVEQs.exe
  C:\Windows\System\sbKVEQs.exe
  2⤵
  PID:14432
- C:\Windows\System\rzaomsJ.exe
  C:\Windows\System\rzaomsJ.exe
  2⤵
  PID:14452
- C:\Windows\System\worBOFD.exe
  C:\Windows\System\worBOFD.exe
  2⤵
  PID:14576
- C:\Windows\System\kbIYHQU.exe
  C:\Windows\System\kbIYHQU.exe
  2⤵
  PID:14624
- C:\Windows\System\nwocBIq.exe
  C:\Windows\System\nwocBIq.exe
  2⤵
  PID:14716
- C:\Windows\System\DMXsvSl.exe
  C:\Windows\System\DMXsvSl.exe
  2⤵
  PID:14840
- C:\Windows\System\rQOHbal.exe
  C:\Windows\System\rQOHbal.exe
  2⤵
  PID:14960
- C:\Windows\System\eDiAyrW.exe
  C:\Windows\System\eDiAyrW.exe
  2⤵
  PID:14968
- C:\Windows\System\vHnmOiM.exe
  C:\Windows\System\vHnmOiM.exe
  2⤵
  PID:15028
- C:\Windows\System\cTuLXpy.exe
  C:\Windows\System\cTuLXpy.exe
  2⤵
  PID:15080
- C:\Windows\System\wgrzUHF.exe
  C:\Windows\System\wgrzUHF.exe
  2⤵
  PID:15116
- C:\Windows\System\uLyqSjG.exe
  C:\Windows\System\uLyqSjG.exe
  2⤵
  PID:15196
- C:\Windows\System\IlhCbTr.exe
  C:\Windows\System\IlhCbTr.exe
  2⤵
  PID:15324
- C:\Windows\System\fsQxTir.exe
  C:\Windows\System\fsQxTir.exe
  2⤵
  PID:15316
- C:\Windows\System\BCdOvra.exe
  C:\Windows\System\BCdOvra.exe
  2⤵
  PID:14376
- C:\Windows\System\LmdeYhP.exe
  C:\Windows\System\LmdeYhP.exe
  2⤵
  PID:14468
- C:\Windows\System\WYvCTQM.exe
  C:\Windows\System\WYvCTQM.exe
  2⤵
  PID:14780
- C:\Windows\System\dKpaFjA.exe
  C:\Windows\System\dKpaFjA.exe
  2⤵
  PID:14616
- C:\Windows\System\FzqIhBt.exe
  C:\Windows\System\FzqIhBt.exe
  2⤵
  PID:13408
- C:\Windows\System\vfdDuGs.exe
  C:\Windows\System\vfdDuGs.exe
  2⤵
  PID:15000
- C:\Windows\System\WSUJahj.exe
  C:\Windows\System\WSUJahj.exe
  2⤵
  PID:15180
- C:\Windows\System\PDRyxqX.exe
  C:\Windows\System\PDRyxqX.exe
  2⤵
  PID:14048
- C:\Windows\System\LBDGsPm.exe
  C:\Windows\System\LBDGsPm.exe
  2⤵
  PID:14080
- C:\Windows\System\WgVVtOR.exe
  C:\Windows\System\WgVVtOR.exe
  2⤵
  PID:15372
- C:\Windows\System\QIKEuvl.exe
  C:\Windows\System\QIKEuvl.exe
  2⤵
  PID:15400
- C:\Windows\System\LxHbPQw.exe
  C:\Windows\System\LxHbPQw.exe
  2⤵
  PID:15432
- C:\Windows\System\IMsSpvd.exe
  C:\Windows\System\IMsSpvd.exe
  2⤵
  PID:15464
- C:\Windows\System\fvxzKAd.exe
  C:\Windows\System\fvxzKAd.exe
  2⤵
  PID:15492
- C:\Windows\System\pvbKGCw.exe
  C:\Windows\System\pvbKGCw.exe
  2⤵
  PID:15524
- C:\Windows\System\REJqMkO.exe
  C:\Windows\System\REJqMkO.exe
  2⤵
  PID:15548
- C:\Windows\System\gmsEacf.exe
  C:\Windows\System\gmsEacf.exe
  2⤵
  PID:15580
- C:\Windows\System\FcVsoTX.exe
  C:\Windows\System\FcVsoTX.exe
  2⤵
  PID:15604
- C:\Windows\System\reetYsr.exe
  C:\Windows\System\reetYsr.exe
  2⤵
  PID:15628
- C:\Windows\System\YJpFPVv.exe
  C:\Windows\System\YJpFPVv.exe
  2⤵
  PID:15656
- C:\Windows\System\kGNWKJl.exe
  C:\Windows\System\kGNWKJl.exe
  2⤵
  PID:15684
- C:\Windows\System\AfuozVv.exe
  C:\Windows\System\AfuozVv.exe
  2⤵
  PID:15708
- C:\Windows\System\KPyBOiV.exe
  C:\Windows\System\KPyBOiV.exe
  2⤵
  PID:15736
- C:\Windows\System\XkTJaIO.exe
  C:\Windows\System\XkTJaIO.exe
  2⤵
  PID:15768
- C:\Windows\System\LlXObii.exe
  C:\Windows\System\LlXObii.exe
  2⤵
  PID:15796
- C:\Windows\System\bzbmdve.exe
  C:\Windows\System\bzbmdve.exe
  2⤵
  PID:15832
- C:\Windows\System\UNypUrj.exe
  C:\Windows\System\UNypUrj.exe
  2⤵
  PID:15852
- C:\Windows\System\qaExQHW.exe
  C:\Windows\System\qaExQHW.exe
  2⤵
  PID:15884
- C:\Windows\System\jCVypkW.exe
  C:\Windows\System\jCVypkW.exe
  2⤵
  PID:15908
- C:\Windows\System\iyjRGyx.exe
  C:\Windows\System\iyjRGyx.exe
  2⤵
  PID:15936
- C:\Windows\System\PFDGCEN.exe
  C:\Windows\System\PFDGCEN.exe
  2⤵
  PID:15960
- C:\Windows\System\drSVbgm.exe
  C:\Windows\System\drSVbgm.exe
  2⤵
  PID:15988
- C:\Windows\System\SDIgCfL.exe
  C:\Windows\System\SDIgCfL.exe
  2⤵
  PID:16020
- C:\Windows\System\xLyPCHw.exe
  C:\Windows\System\xLyPCHw.exe
  2⤵
  PID:16040
- C:\Windows\System\vTjHMPq.exe
  C:\Windows\System\vTjHMPq.exe
  2⤵
  PID:16072
- C:\Windows\System\jDUjuit.exe
  C:\Windows\System\jDUjuit.exe
  2⤵
  PID:16108
- C:\Windows\System\idGTusn.exe
  C:\Windows\System\idGTusn.exe
  2⤵
  PID:16124
- C:\Windows\System\uferZoX.exe
  C:\Windows\System\uferZoX.exe
  2⤵
  PID:16140
- C:\Windows\System\bpJOYIH.exe
  C:\Windows\System\bpJOYIH.exe
  2⤵
  PID:16168
- C:\Windows\System\USgtyJy.exe
  C:\Windows\System\USgtyJy.exe
  2⤵
  PID:16200
- C:\Windows\System\HUnTvod.exe
  C:\Windows\System\HUnTvod.exe
  2⤵
  PID:16220
- C:\Windows\System\VsdqSMa.exe
  C:\Windows\System\VsdqSMa.exe
  2⤵
  PID:16256
- C:\Windows\System\PLyHaWP.exe
  C:\Windows\System\PLyHaWP.exe
  2⤵
  PID:16284
- C:\Windows\System\lFozcZh.exe
  C:\Windows\System\lFozcZh.exe
  2⤵
  PID:16304
- C:\Windows\System\jHsmeMO.exe
  C:\Windows\System\jHsmeMO.exe
  2⤵
  PID:16324
- C:\Windows\System\dabikVj.exe
  C:\Windows\System\dabikVj.exe
  2⤵
  PID:16348
- C:\Windows\System\cpNpcQV.exe
  C:\Windows\System\cpNpcQV.exe
  2⤵
  PID:16372
- C:\Windows\System\LSAAnQs.exe
  C:\Windows\System\LSAAnQs.exe
  2⤵
  PID:14592
- C:\Windows\System\mRlkbVv.exe
  C:\Windows\System\mRlkbVv.exe
  2⤵
  PID:14940
- C:\Windows\System\SWdFkWi.exe
  C:\Windows\System\SWdFkWi.exe
  2⤵
  PID:15448
- C:\Windows\System\vedIvfd.exe
  C:\Windows\System\vedIvfd.exe
  2⤵
  PID:14708
- C:\Windows\System\KYPEsoR.exe
  C:\Windows\System\KYPEsoR.exe
  2⤵
  PID:14692
- C:\Windows\System\QexPSpR.exe
  C:\Windows\System\QexPSpR.exe
  2⤵
  PID:15444
- C:\Windows\System\nzSqLnf.exe
  C:\Windows\System\nzSqLnf.exe
  2⤵
  PID:15648
- C:\Windows\System\prXerNT.exe
  C:\Windows\System\prXerNT.exe
  2⤵
  PID:15704
- C:\Windows\System\kFhIAgZ.exe
  C:\Windows\System\kFhIAgZ.exe
  2⤵
  PID:15700
- C:\Windows\System\qFWIxOx.exe
  C:\Windows\System\qFWIxOx.exe
  2⤵
  PID:15784
- C:\Windows\System\MTdNYIh.exe
  C:\Windows\System\MTdNYIh.exe
  2⤵
  PID:15932
- C:\Windows\System\TflJXoC.exe
  C:\Windows\System\TflJXoC.exe
  2⤵
  PID:15844
- C:\Windows\System\XVpYtuX.exe
  C:\Windows\System\XVpYtuX.exe
  2⤵
  PID:16056
- C:\Windows\System\plVkRNG.exe
  C:\Windows\System\plVkRNG.exe
  2⤵
  PID:16116
- C:\Windows\System\DOfmLIb.exe
  C:\Windows\System\DOfmLIb.exe
  2⤵
  PID:16212
- C:\Windows\System\ngAGlzj.exe
  C:\Windows\System\ngAGlzj.exe
  2⤵
  PID:16236
- C:\Windows\System\tOiLBQy.exe
  C:\Windows\System\tOiLBQy.exe
  2⤵
  PID:16132
- C:\Windows\System\YSUuUTF.exe
  C:\Windows\System\YSUuUTF.exe
  2⤵
  PID:14612
- C:\Windows\System\xEbKWvv.exe
  C:\Windows\System\xEbKWvv.exe
  2⤵
  PID:14932
- C:\Windows\System\eRhVIvu.exe
  C:\Windows\System\eRhVIvu.exe
  2⤵
  PID:15616
- C:\Windows\System\nWLEhOD.exe
  C:\Windows\System\nWLEhOD.exe
  2⤵
  PID:15840
- C:\Windows\System\MKWdEwK.exe
  C:\Windows\System\MKWdEwK.exe
  2⤵
  PID:16052
- C:\Windows\System\GErEJbH.exe
  C:\Windows\System\GErEJbH.exe
  2⤵
  PID:15724
- C:\Windows\System\NMeFlox.exe
  C:\Windows\System\NMeFlox.exe
  2⤵
  PID:16356
- C:\Windows\System\OgXsbWt.exe
  C:\Windows\System\OgXsbWt.exe
  2⤵
  PID:16036
- C:\Windows\System\cDfnnnf.exe
  C:\Windows\System\cDfnnnf.exe
  2⤵
  PID:16396
- C:\Windows\System\fowpWOa.exe
  C:\Windows\System\fowpWOa.exe
  2⤵
  PID:16424
- C:\Windows\System\JOVQteN.exe
  C:\Windows\System\JOVQteN.exe
  2⤵
  PID:16456
- C:\Windows\System\ICalYar.exe
  C:\Windows\System\ICalYar.exe
  2⤵
  PID:16484
- C:\Windows\System\GJfmHfn.exe
  C:\Windows\System\GJfmHfn.exe
  2⤵
  PID:16504
- C:\Windows\System\cjvPpYq.exe
  C:\Windows\System\cjvPpYq.exe
  2⤵
  PID:16532
- C:\Windows\System\dzKreRF.exe
  C:\Windows\System\dzKreRF.exe
  2⤵
  PID:16556
- C:\Windows\System\HmTRHIh.exe
  C:\Windows\System\HmTRHIh.exe
  2⤵
  PID:16584
- C:\Windows\System\XnbScPN.exe
  C:\Windows\System\XnbScPN.exe
  2⤵
  PID:16612
- C:\Windows\System\mGordIJ.exe
  C:\Windows\System\mGordIJ.exe
  2⤵
  PID:16632
- C:\Windows\System\CLreXwr.exe
  C:\Windows\System\CLreXwr.exe
  2⤵
  PID:16664
- C:\Windows\System\LyPShfP.exe
  C:\Windows\System\LyPShfP.exe
  2⤵
  PID:16692
- C:\Windows\System\HsAgiBl.exe
  C:\Windows\System\HsAgiBl.exe
  2⤵
  PID:16720
- C:\Windows\System\taMGpHn.exe
  C:\Windows\System\taMGpHn.exe
  2⤵
  PID:16752
- C:\Windows\System\IKXwYsJ.exe
  C:\Windows\System\IKXwYsJ.exe
  2⤵
  PID:16776
- C:\Windows\System\ozgmYQr.exe
  C:\Windows\System\ozgmYQr.exe
  2⤵
  PID:16808
- C:\Windows\System\jHFYWca.exe
  C:\Windows\System\jHFYWca.exe
  2⤵
  PID:16828
- C:\Windows\System\WhpRpKF.exe
  C:\Windows\System\WhpRpKF.exe
  2⤵
  PID:16856
- C:\Windows\System\aXUYTdi.exe
  C:\Windows\System\aXUYTdi.exe
  2⤵
  PID:16888
- C:\Windows\System\XMfFBEg.exe
  C:\Windows\System\XMfFBEg.exe
  2⤵
  PID:16916
- C:\Windows\System\FtOeDRv.exe
  C:\Windows\System\FtOeDRv.exe
  2⤵
  PID:16936
- C:\Windows\System\vOWawwx.exe
  C:\Windows\System\vOWawwx.exe
  2⤵
  PID:16964
- C:\Windows\System\nmAweXB.exe
  C:\Windows\System\nmAweXB.exe
  2⤵
  PID:16992
- C:\Windows\System\qJCnJbM.exe
  C:\Windows\System\qJCnJbM.exe
  2⤵
  PID:17016
- C:\Windows\System\SWJffez.exe
  C:\Windows\System\SWJffez.exe
  2⤵
  PID:17036
- C:\Windows\System\yNkLkSL.exe
  C:\Windows\System\yNkLkSL.exe
  2⤵
  PID:17068
- C:\Windows\System\atNgVbY.exe
  C:\Windows\System\atNgVbY.exe
  2⤵
  PID:17096
- C:\Windows\System\ckMmDqv.exe
  C:\Windows\System\ckMmDqv.exe
  2⤵
  PID:17128
- C:\Windows\System\rgGsQvt.exe
  C:\Windows\System\rgGsQvt.exe
  2⤵
  PID:17156
- C:\Windows\System\LaALvFf.exe
  C:\Windows\System\LaALvFf.exe
  2⤵
  PID:17184
- C:\Windows\System\lkTEAIv.exe
  C:\Windows\System\lkTEAIv.exe
  2⤵
  PID:17388
- C:\Windows\System\mIdTSUZ.exe
  C:\Windows\System\mIdTSUZ.exe
  2⤵
  PID:15924
- C:\Windows\System\KQOuyLO.exe
  C:\Windows\System\KQOuyLO.exe
  2⤵
  PID:14572
- C:\Windows\System\RrhfPjB.exe
  C:\Windows\System\RrhfPjB.exe
  2⤵
  PID:15344
- C:\Windows\System\SLWgGQO.exe
  C:\Windows\System\SLWgGQO.exe
  2⤵
  PID:15956
- C:\Windows\System\BklKGHr.exe
  C:\Windows\System\BklKGHr.exe
  2⤵
  PID:16120
- C:\Windows\System\WMgGbaJ.exe
  C:\Windows\System\WMgGbaJ.exe
  2⤵
  PID:16524
- C:\Windows\System\KnpMiDh.exe
  C:\Windows\System\KnpMiDh.exe
  2⤵
  PID:16404

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AGbQGbM.exe

Filesize
1.8MB

MD5
2cb3b1cd6fcf6159be89ab193aa6386c

SHA1
e2385614b357655d3c24bd0417f128971ba19be1

SHA256
91590e443d0aa53cd9f173adb251699f6a4c996cc7c6f42c7483078bc94f7533

SHA512
5b0e7ce816934bbfe6364bc71b5c6cab8e9f1d0be577899cae0b952f9f39acd38573a061c6b5004813f63ffc405b9ce94d1639a78b7d5a37727ab566b65cf142

Download Submit
C:\Windows\System\AJJFJCO.exe

Filesize
1.8MB

MD5
3a2dc2f9bd58598d9a016b1b84e3e145

SHA1
cece99139424e3247c61815f85b84647b4b64223

SHA256
117296335af9bc2051ebcf6768f52948cefaa137eb62fad2edffae95455343bf

SHA512
1774cb4e3fc73b5529f30a6170152b38f6c276094692b004f5ac209d2cb87ec78abc479eb69bd1e27a1d641238fdb1ba3584affdda216f8b4be761984fbab6b8

Download Submit
C:\Windows\System\AfKKyFd.exe

Filesize
1.8MB

MD5
809111f7b328f35e0c55d8d6f2bcfb99

SHA1
09a5b09e8be83377319d4cd0db2ddd9788bb1f5a

SHA256
c0edf73d3623c09905a97609eec4e1d972686107501efe524a33d2fcec75a195

SHA512
16209c741fa19858fcf70ec95b83a4ad8017b083ea2579e9e4ff48512e913904ad96d7b1f07cc6c6af6475a81259d025ea9957a865f7d7026024a83790c8f196

Download Submit
C:\Windows\System\CkbcXDk.exe

Filesize
1.8MB

MD5
8e3608f0bcf18b5c1a81c049edad2b71

SHA1
b58276fc09057e55d35fa52ce091bd7e866a4c8f

SHA256
06437e595bcd3a56baf32829782084efc6656c4945ba211e2787b1442f8acd2c

SHA512
069cd0fea7550eed28fb853521abd7fe479bc32b819ca3d4ea17603609eb238b82a111c4bd9b2293c747d831715b1f3e48059590bc827e6edb89e828f9f93c71

Download Submit
C:\Windows\System\CqIahUc.exe

Filesize
1.8MB

MD5
7344d08ef9b9d7c2c4da33d50fbc69ee

SHA1
e23a4d33ab7fda4e757dda11c3a0c31d63d63bae

SHA256
82b260c2e679c4e28604e08f23b1172ae98b8059183d2ccaf84e63e3cb47416b

SHA512
9151e9541395ab7c6610c05993f932b687cb4f48e2eff6d0c411ae8fb3730d7edfcdc39eadb0a75ebe448f55711930ec16571c2c32bf643b7749fb1e56194f14

Download Submit
C:\Windows\System\DudVVRS.exe

Filesize
1.8MB

MD5
c34c5a89a8c78337c9f17c39448f6c7c

SHA1
c22739a4b8008c2f7b9a2620f86a63ba189b4eb4

SHA256
e35b7df457a91c6afdc726607f9fa29bd6ad53f6009d95f908643f852b72a54b

SHA512
1952e9ad05fdd38bb6765327cd81e0fd545b9cffe5c7a8a29e81701469ea55a1fbf1aa9a40bbd0c2c1e663b51d8a1849ef90828baa7402f5753e3eebf9e248a3

Download Submit
C:\Windows\System\Ehglvdg.exe

Filesize
1.8MB

MD5
1ae46dbfe7e11cd053d699880763b9bb

SHA1
144968271d681f1a1bebc6a09da1d5765d6bb65c

SHA256
07f166cf1222b9e0812018dcf99da0a41e033b331697361ec4e5feb2b9816da8

SHA512
e3450a163910b83f8501c873ec37321a09b7fdf63afdc12ce371a6c3000732f9933fcf00f25eb361faecf0e7ab1e7aaed6029a903fc177485f204db50132f699

Download Submit
C:\Windows\System\FFHIKhy.exe

Filesize
1.8MB

MD5
af977babfaa2eb484ad81545ad536376

SHA1
32dbebb3acb0cc5b1f22f43e57b514cbe3371443

SHA256
04f1b3b8f018e3aa55cfed4d137123e7df1259c0d022402b938e7e63a6437945

SHA512
b22d5488a4a3ea02fdea7a671876c8da830d54482288053eb204840d3bf9c12758fc581f7ed1a21660ef21d44c6730b3dd64cc964cd0129160eee4cff057819e

Download Submit
C:\Windows\System\GwhFrum.exe

Filesize
1.8MB

MD5
993a49e816a124c09d3bbc70339cfea0

SHA1
3b3fd4ff6e76a7083f41de6cb03829dbf60a2500

SHA256
71bfadb4992a3690bebf1da5d5432c879f3449850a0e015cf01b96deb141bea7

SHA512
f0cfd3d5e0de7095b41df66b80f96d89ee66baf3c504c7d984066123d9ae04392c8af5d7708db8b4e157770e9cc4d007d4632617c245d0db05beb12fe4874735

Download Submit
C:\Windows\System\HPiZKyT.exe

Filesize
1.8MB

MD5
a36259b9efe35a52ab677dcc683aef8f

SHA1
d3fc39dd6133fc9182829260448442e1ee3ce1fd

SHA256
d280b2ddad7def6ba54fc176fd0707e5c4654a16da231ff6852685e973224a77

SHA512
45a992b07a7ddf7684304673516284d831f7c823e7796c9f0135f2f0e4990b9e073c0cd73c398249fbe4389f7a4d13ad0330141e3885a4c7a6242a1db5c513bf

Download Submit
C:\Windows\System\JvcySLk.exe

Filesize
1.8MB

MD5
89ccc4ae34ebded389983962e36930de

SHA1
e522338da1e7e47e426f450fd9237c8b41c4e863

SHA256
d99a9677e474fc26b0cb2cd127d5f5ec6f7e5f34eb5805aa8fa35ecc8b217256

SHA512
3ebfad12225f8f0fa487b57f9e712e606272479a104f485b2ec2bf2de390de31d84a03cb505bd7dceb181c42b9e5382ed4c8d9a8f32411406199fb9cf12d7f22

Download Submit
C:\Windows\System\LnuxaJD.exe

Filesize
1.8MB

MD5
750f0a0f2c5af855cf139235685aff62

SHA1
c7eca25cd26833e040455d6fec2ea3d215ee8164

SHA256
aacaeb9439a61a24b1d1938e8fcb5dcbf44f462e5e16f61a061fb196cf7e0697

SHA512
10483b5e819df46e278d0a7ad7d2355f1ca38c5d45139260c89ccdf0963bee6daa3c53848c7cb1264e39e4bd46227ffd14d3571bc2f8f595d4e9794e35bcb5a8

Download Submit
C:\Windows\System\POEpQBR.exe

Filesize
1.8MB

MD5
189936e585d4d44c4398b87829fbffa2

SHA1
0da91759adb773e946d5afd25c0c658e1435e39e

SHA256
e0f65aeb78dc15bc87351e7a1621d8d63dda07aa284df7a1c804127026597a78

SHA512
8d796669b5a69e1cc18be5f3fe92ced5a3a84c6ac02e5737b6980addc3509750bd467e003bf19cef115eb634b5043f6f52a49b369b406f0985b0716b19c2ca7f

Download Submit
C:\Windows\System\QMUunyb.exe

Filesize
1.8MB

MD5
3eca73de6fe0c8550e68bcb3ee9b87b7

SHA1
38d9568d2ec27fa5af710ca3dda4153553ba61d9

SHA256
6b57f8a85fccf2e937b2d98027f9d04106420276f81c5d7b4a33e2402ec6c220

SHA512
6a67b40b0ab2d5e5656cbbddaaaf9af4067897afce5c7f920bc0f5373127e818906a5e6f92a78b8316f707e6f76491908dca780fe9355e9e96168569b9ebc76c

Download Submit
C:\Windows\System\QRlyxUI.exe

Filesize
1.8MB

MD5
24eac76c77f7cbeaed20d0e68546227f

SHA1
6cd2f8734083d9e85384f8d24bde8820d003002e

SHA256
c7d2546027602d333ab8cd31ae5bd56b4b76ca2ee364da369dbdeb0983088707

SHA512
0014fa5d4ea55199383ba4126e9f744e69c9c207869d51746562ad0fcaed5cc3f141fdf7ba45aa4b117582e835a55fd09c1c16409671ac1e66fe349ace8916c7

Download Submit
C:\Windows\System\QlQkuZt.exe

Filesize
1.8MB

MD5
76080cb93ad91199392f4983bdd4ea4d

SHA1
d134fa92389a7208d695b00f6df642e6cd655312

SHA256
13bfb829c56e9550c0d051bf3db25790fdfdf41d8d8c87e26b6d10c9754221f5

SHA512
23329682afa23996176f54c2702bcdd0ae480e9aecaa9b8b860a328c26e26b0b7722d2eb8895d02fbc3a053f7c2dada79feb7aca1ef07b5a8300019c383d756a

Download Submit
C:\Windows\System\RIOqgIW.exe

Filesize
1.8MB

MD5
64f70b305ced0d4a0f0ed990b546285f

SHA1
96b611c37f24dfff738bd2edaacb5ef964f31534

SHA256
068e47461784a45df59f71eb31493f9015f96d8d6cd5e8593ab6066bb536817b

SHA512
541cec2734370226ad0197f2b18cfd063f4f0080f85abc4c5e6f003634f1279cb1a89d0ce1f8d464b0048b29eff6a9bf8538fbea4d20d66c78e00ef413e2a1b2

Download Submit
C:\Windows\System\SoxxOmi.exe

Filesize
1.8MB

MD5
70da40e98daa5faac26a40e4d55b942a

SHA1
dc8ebf21ad7867c4f658cb1035ca741c136a427b

SHA256
be6ae00241b359da5dc03047ad3fcdb5500a9ce003e9b0e1cb95132a8de67280

SHA512
190dd128012b452413b1d55767e56b888984ff432a671dbe90b0ec484de97df2237e227951b024ad55871d902f208c9eb71a401a4bed3220014c50b2f12264a1

Download Submit
C:\Windows\System\VEjxUCg.exe

Filesize
1.8MB

MD5
5e56078028f419c854bc78c89f3422e8

SHA1
7938a2559f38639636641888b4c0962cd6c1514a

SHA256
b4e9f98af486469217de3e0f418dcc3be65d72d49235ea185a0f0246d63940e9

SHA512
5ba2e8ea88d863b202c32bb245477540f95d633f5176779b457b68672d4eb3615acaa4b38b9a57c3ce6a7bb4cfba40c67b3795170034ea51914451797c6bbba5

Download Submit
C:\Windows\System\WlRPARs.exe

Filesize
1.8MB

MD5
587899f1c2333590a5226f6c8493b104

SHA1
7432952f61f25bca585297da66162f81096a439f

SHA256
375d6fcf01d54c8735da98cba1ee5fa3c4daf1317058a999f4b536a361bc9c46

SHA512
9c8543259c9921f0760fdc0701fd30d9754080d8adea87a2c90c7943c0ea991cbd0170868accc17081b479a1abd0e834f5a6c17d324d30072dbc6f4358f39d17

Download Submit
C:\Windows\System\XqExeeZ.exe

Filesize
1.8MB

MD5
476de58191add4c9e421f6186a648fd7

SHA1
c35fa4c8c8de3af1f04af5327d7acdb4dfdc5290

SHA256
002286782e6ddafd26034f0b3faf291ee117400a6003e6f6643e7f38f928c7f8

SHA512
315d5af6138b10b7cfb680e0a5d90a4f2f3b9857d446f6157a8349d50c0476c4fab445db0c3913fcf907e1af477112714e6e07210c490fd75ce358fffb9c6359

Download Submit
C:\Windows\System\ZLeYJRu.exe

Filesize
1.8MB

MD5
0176d31e139935d567b9b4c9b050c04a

SHA1
ec6e85eae24fe628c2c708eb55b1ef88c2770753

SHA256
ecd0e84a65d5a95729213e00dda16c5630188c23452c8180783fc80ad843951e

SHA512
9b2260f23f1a5fd5f83575a63105bd6336cecbc43f27e2c37afd97a9c214d2f9a2fcfec7c63c8c84cb7c37b952b8df2bbb7f9411bb0db1e125253249277fbe93

Download Submit
C:\Windows\System\dCSBDqY.exe

Filesize
1.8MB

MD5
9969a72c793264f06d33a583d132b3ff

SHA1
de77f67d3e3576ef7dba80548d5c91cd193938d4

SHA256
6c25276d8ac8636a0f1cccb33122071ec170c8382b0329c4a69c85f5aa5a8421

SHA512
84e5ffaac58bcba09161aa90b5f1ee0d26c62c949c438fd944ed3c26b5c099060e512b75bda39041a6058576db514ac87210819f90bb0854dd48e09fff0f1320

Download Submit
C:\Windows\System\ePmprGX.exe

Filesize
1.8MB

MD5
bc33e8984fa7f018e7274059d0a8785a

SHA1
dccb2959f3ecf30735693f5156855a0d47756d54

SHA256
f121e2e216817bb24d5b960470937a77900c6d9ec803225313657c3d504b74ff

SHA512
375037ba9cb9db901be7305914c52b5943278ba345ee5f8a715db1703ae615d272b880b7ba1e872c17d6eb921585dcfdfaee3713c25c2d63de881a5345edc06f

Download Submit
C:\Windows\System\eVKygDZ.exe

Filesize
1.8MB

MD5
c2342a2b89933270b7a9d057746b5251

SHA1
1a51becfef51e5a92acf1fe53f076e4485827a61

SHA256
16b9e8458cd79fc6096cd33fb82d2d2b950011956613ba748ec9f7a949fbe00e

SHA512
f5c847880edceb6fa0795394301eb11fa07f19bbf16fa321b0be7cf15893a558425a4edf858c063dcfa066d78c37d6b76e80d4b8f801fc02487233d30eb89d85

Download Submit
C:\Windows\System\enpwomU.exe

Filesize
1.8MB

MD5
a47ec745675ef2506729801602cd74aa

SHA1
b0baf4b0304545273df38c6d86e66087a32183e9

SHA256
d1aa1a4c54e241d37255469176c855e862820dc29fd29ad208e60d57303fd49b

SHA512
cf823b6c6e215e9b70c8fb976356d8b341af939a8209c9479f4bad760cfb08063efac1f0ee8727a76f32aca1980864286f36e3bbd5d862f9479494a808f2bf7c

Download Submit
C:\Windows\System\fGjJsLF.exe

Filesize
1.8MB

MD5
c8021223b3f95d9c45395b8c1cd76cf8

SHA1
7673233da1fa3325185efea3754599cc39fe75ea

SHA256
e09ce0f424330e117e2ca996c06f51cc13a7632f7b672da4af4ff95c00a76db2

SHA512
05cbd3690b07070552821d7371d9e6ac568acf3bca803474786ad2d09b88ecfd2a776661530ebddcfeb1aafa40f6b597dbf36912b270163d4d96d16445e24535

Download Submit
C:\Windows\System\jsFHBBJ.exe

Filesize
1.8MB

MD5
4ea3dd638bc2d7de407feab6b0e71206

SHA1
5e1760b4441d9e4fcc27f4ec6d34d0cba807b12c

SHA256
84f22511c0ac41a5660fe34ec88b53b438ebd89f4c72648dfe5611a0f008e4fd

SHA512
3d8a59668a58679f9d9b84b110474bd055582ce8fb92159330474d87e79d2d5ad4eade45c8a41b6177f7f17888cc7a420a1f7cf847bcab01b357b361b3035bfb

Download Submit
C:\Windows\System\rZMJiMO.exe

Filesize
1.8MB

MD5
c4bff8f2eea1fd349b0d8f3d88a4e211

SHA1
f957807b8a539852ccc2ac4f35d7d9fe282b21ae

SHA256
a0196e91a2061d74d27df4eb91d8934c3e20bc17663efa137bd847730a705d0b

SHA512
43525aacbed533924dd1f38a2e559b9c294bd38e6a33ebb77c029482fc7fbb2829f0889780a14979f614d7dd22f94a6dcdfa4b6592ade16b00d4d87b5392c2e9

Download Submit
C:\Windows\System\uxRFclH.exe

Filesize
1.8MB

MD5
745d17e6608a66fa3323a243794b2dce

SHA1
31a0ff73c119feedd58308b537159a95004b7dbf

SHA256
85a4423cf82d5f990502a152f24ccdf380c14a417c1f97726579cf51934b992a

SHA512
ec0c1ae98dcdd19b9a980d2dcd221e612b9bf5187735892df7ca71ba5d4c7145e09faebf124c6f93bdb015505c797664b871c2c83f208da0c46185cf742d2dd8

Download Submit
C:\Windows\System\vPhXBXr.exe

Filesize
1.8MB

MD5
84446599ad013f650c4f94f7d7b09af4

SHA1
0656ffe68ee4fde7c468a7ba9b326119c7489745

SHA256
2f745286fd414ee52413fc50561ba7b6009ea1f19ba31d7af25c983be0981a82

SHA512
3db095b968c59a6c1eb0c6856805706db721ab5f3b4dc1eeec6326bca2aaf967314646cc8f671ce9a85fdd71f4189333a32eb60d1ad0fc8b93ab2c53847dbea5

Download Submit
C:\Windows\System\xAQNCzh.exe

Filesize
1.8MB

MD5
7e956d10aa55550fc61ca9beb93d8ddc

SHA1
a9d51a4e08d2e351e5750da17457bc66e12453fa

SHA256
717df2794b5e057c5e096bdab70ec2628196b597db2cabcc48583eaf12355ab4

SHA512
4de883e1ac4a8d38b7eb1482f3a9c2b0c7fe208a9eb4dca7469ca83a175aa2b7ded6ba7d1bfa24784fa90cba0e4dd67f6117f33665a394a9e4c7f29f64cc76d7

Download Submit
C:\Windows\System\xsPGyPy.exe

Filesize
1.8MB

MD5
6f4245de55e7310a099fb3397f8b7bc9

SHA1
df17634cf2797986b1ce9bf74f58569e6ed59fb1

SHA256
14a230335fe293b8599c7a6792a3d5a79fe21c5ccd816ae7be11b380a2353856

SHA512
87b629a38ef9b871b5d24c4987ea3650d79f24c8d570dce6b299b56533bb0e0a1d494abae04d0c075dde34c4ac905794cfda0910635e788e2c4aba00ee259d5e

Download Submit
C:\Windows\System\yehpgcZ.exe

Filesize
1.8MB

MD5
17449c4a8eae1564c35168f8477e2380

SHA1
cf13843c13bc226573578233902cbf6459ab4ad7

SHA256
948b4dc9476b7309c845b0ba331cdb58dbcdb2998e026377e6de823e87f1ef18

SHA512
546d9c446490f89ab7aa1cdcb591f55cf8eea72ce6fd8f49724b03db89601ebb45580e78a1976b5acad5bdcac85493f2584faf3e87e97ca0257dfc22006ef69f

Download Submit
memory/4468-0-0x000002B5355E0000-0x000002B5355F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads