xmrig | 4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
Size

1.4MB
MD5

8e67688ce6c69c1bc47403dca4a33c69
SHA1

d0f19434e4098ecfe7bb5cc7a6c17014bec0e724
SHA256

4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968
SHA512

b8ab6a9773867908b521ebc848fbd8a8a0b0c66db8e13061623ac15b0ad56972e4ff7d9630f6c1e526ca5cc825f0b92136eb34bae50d0027c7288271a04cdf9e
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcd:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5T

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023c80-4.dat	xmrig
behavioral2/files/0x0007000000023c84-9.dat	xmrig
behavioral2/files/0x0007000000023c86-18.dat	xmrig
behavioral2/files/0x0007000000023c88-25.dat	xmrig
behavioral2/files/0x0007000000023c85-27.dat	xmrig
behavioral2/files/0x0007000000023c89-34.dat	xmrig
behavioral2/files/0x0007000000023c8b-54.dat	xmrig
behavioral2/files/0x0007000000023c8e-60.dat	xmrig
behavioral2/files/0x0007000000023c8f-64.dat	xmrig
behavioral2/files/0x0007000000023c8d-58.dat	xmrig
behavioral2/files/0x0007000000023c8c-56.dat	xmrig
behavioral2/files/0x0007000000023c8a-43.dat	xmrig
behavioral2/files/0x0007000000023c87-39.dat	xmrig
behavioral2/files/0x0007000000023c90-69.dat	xmrig
behavioral2/files/0x0008000000023c81-73.dat	xmrig
behavioral2/files/0x0007000000023c91-77.dat	xmrig
behavioral2/files/0x0007000000023c93-83.dat	xmrig
behavioral2/files/0x0007000000023c92-87.dat	xmrig
behavioral2/files/0x0007000000023c95-97.dat	xmrig
behavioral2/files/0x0007000000023c94-99.dat	xmrig
behavioral2/files/0x0007000000023c97-106.dat	xmrig
behavioral2/files/0x0007000000023c96-107.dat	xmrig
behavioral2/files/0x0007000000023c99-113.dat	xmrig
behavioral2/files/0x0007000000023c98-120.dat	xmrig
behavioral2/files/0x0007000000023c9a-126.dat	xmrig
behavioral2/files/0x0007000000023c9c-133.dat	xmrig
behavioral2/files/0x0007000000023c9d-140.dat	xmrig
behavioral2/files/0x0007000000023c9b-131.dat	xmrig
behavioral2/files/0x0007000000023c9f-148.dat	xmrig
behavioral2/files/0x0007000000023ca1-161.dat	xmrig
behavioral2/files/0x0007000000023ca2-160.dat	xmrig
behavioral2/files/0x0007000000023ca0-156.dat	xmrig
behavioral2/files/0x0007000000023c9e-144.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
512	eBkZxoh.exe
3564	slcIvsU.exe
964	RZZKpdT.exe
4580	ZjfVEiH.exe
3724	yJhEzCs.exe
3396	KZrrmZq.exe
1840	xFsSijJ.exe
4500	JSAtHzu.exe
3280	MXQZVSp.exe
2068	MGIbHsK.exe
116	aPsPNLE.exe
4420	ucwkIiT.exe
3540	OaQfmWQ.exe
2604	bvqavwn.exe
2992	uybPLga.exe
3660	xORRGQk.exe
3600	omnWrwV.exe
1664	DEytaFm.exe
3176	PsKwDcR.exe
2356	iTGnKGh.exe
3788	BAsIbMy.exe
2372	MiphXEb.exe
2716	srGtsRO.exe
2804	ywCQQdF.exe
2584	yBkMGkq.exe
3672	yXfQHRM.exe
388	DfcRDlb.exe
1896	vKcnrUA.exe
3144	FXcbJHn.exe
3908	fxJMOJE.exe
1968	osqaUXs.exe
2952	tFedkoz.exe
5052	myPVvoU.exe
852	JamJfpX.exe
4004	hoOCfXb.exe
316	CwzyIWl.exe
1008	xROundX.exe
1416	wbOGXON.exe
2592	SIeXfHP.exe
2332	SrdYZKz.exe
1428	TqCDdjj.exe
1676	Lgdtajr.exe
3316	eOAZEDx.exe
1584	LnXACHe.exe
1672	SYaiEyz.exe
2376	auPeIFq.exe
4152	vUmvTbc.exe
2380	bVbzmlw.exe
4360	UBdywGV.exe
3524	MddGEPd.exe
4396	weEIUmu.exe
652	VpqiaVS.exe
3960	KbAZzSV.exe
4112	YrtxHxF.exe
2720	uGHpaSQ.exe
4804	JaIHUzE.exe
3336	ohWekym.exe
3704	tUCUHkE.exe
4516	yYnOask.exe
1880	DLkooVy.exe
2220	pSWaltq.exe
1564	mgIONrl.exe
1392	VMCZkDw.exe
5000	KLqOgTK.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pJXCYXX.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\ERejYZa.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\XPUSzQx.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\LMWHCjY.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\LjpjIbK.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\MmcBzuc.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\eqmhTCN.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\hKdWDgT.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\vcQUrUL.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\heAlXPX.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\aSgoOhW.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\VrCqKSC.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\CuAISem.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\iaEOXQf.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\UifkzZn.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\PefSKGf.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\YdNkRSc.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\UyWhXJd.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\FjlgeNZ.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\JLwrnkk.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\wTrMfyX.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\mmavZmk.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\YrtxHxF.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\vPxgdyp.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\lbrvUsx.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\VWmcCAY.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\qcUsOmO.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\JSAtHzu.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\cxIqyWV.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\DozcYgG.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\Uwrjswz.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\PCRVyGg.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\fZzCGlM.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\gjxWbhg.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\ueiFCCv.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\SmLQnau.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\obVqMzC.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\cTwoGij.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\jdVyzwv.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\XDKBNyl.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\osqaUXs.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\lJPSiyK.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\UpVhGTo.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\nAwJpRc.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\OCphUMe.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\zLHOpxr.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\ILbUBXI.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\WiFCdIj.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\XkVyxmi.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\FOjyKzF.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\pZlehMW.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\RLSVfCu.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\BbznZng.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\QfmqUHu.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\eYrfCFp.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\iKIkpKq.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\SwSEpRL.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\wAfDUKu.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\OaQfmWQ.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\RgnwvKH.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\yYnOask.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\NsJTxSJ.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\ieqKyXa.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
File created	C:\Windows\System\pqEjqmL.exe	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16956	dwm.exe
Token: SeChangeNotifyPrivilege	16956	dwm.exe
Token: 33	16956	dwm.exe
Token: SeIncBasePriorityPrivilege	16956	dwm.exe
Token: SeShutdownPrivilege	16956	dwm.exe
Token: SeCreatePagefilePrivilege	16956	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 512	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	84
PID 2244 wrote to memory of 512	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	84
PID 2244 wrote to memory of 3564	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	85
PID 2244 wrote to memory of 3564	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	85
PID 2244 wrote to memory of 964	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	86
PID 2244 wrote to memory of 964	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	86
PID 2244 wrote to memory of 4580	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	87
PID 2244 wrote to memory of 4580	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	87
PID 2244 wrote to memory of 3724	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	88
PID 2244 wrote to memory of 3724	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	88
PID 2244 wrote to memory of 3396	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	89
PID 2244 wrote to memory of 3396	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	89
PID 2244 wrote to memory of 1840	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	90
PID 2244 wrote to memory of 1840	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	90
PID 2244 wrote to memory of 4500	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	91
PID 2244 wrote to memory of 4500	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	91
PID 2244 wrote to memory of 3280	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	92
PID 2244 wrote to memory of 3280	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	92
PID 2244 wrote to memory of 2068	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	93
PID 2244 wrote to memory of 2068	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	93
PID 2244 wrote to memory of 116	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	94
PID 2244 wrote to memory of 116	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	94
PID 2244 wrote to memory of 4420	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	95
PID 2244 wrote to memory of 4420	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	95
PID 2244 wrote to memory of 3540	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	96
PID 2244 wrote to memory of 3540	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	96
PID 2244 wrote to memory of 2604	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	97
PID 2244 wrote to memory of 2604	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	97
PID 2244 wrote to memory of 2992	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	98
PID 2244 wrote to memory of 2992	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	98
PID 2244 wrote to memory of 3660	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	99
PID 2244 wrote to memory of 3660	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	99
PID 2244 wrote to memory of 1664	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	100
PID 2244 wrote to memory of 1664	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	100
PID 2244 wrote to memory of 3600	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	101
PID 2244 wrote to memory of 3600	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	101
PID 2244 wrote to memory of 3176	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	102
PID 2244 wrote to memory of 3176	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	102
PID 2244 wrote to memory of 2356	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	103
PID 2244 wrote to memory of 2356	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	103
PID 2244 wrote to memory of 3788	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	104
PID 2244 wrote to memory of 3788	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	104
PID 2244 wrote to memory of 2372	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	105
PID 2244 wrote to memory of 2372	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	105
PID 2244 wrote to memory of 2804	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	106
PID 2244 wrote to memory of 2804	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	106
PID 2244 wrote to memory of 2716	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	107
PID 2244 wrote to memory of 2716	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	107
PID 2244 wrote to memory of 388	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	108
PID 2244 wrote to memory of 388	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	108
PID 2244 wrote to memory of 2584	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	109
PID 2244 wrote to memory of 2584	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	109
PID 2244 wrote to memory of 3672	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	110
PID 2244 wrote to memory of 3672	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	110
PID 2244 wrote to memory of 1896	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	111
PID 2244 wrote to memory of 1896	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	111
PID 2244 wrote to memory of 3144	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	112
PID 2244 wrote to memory of 3144	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	112
PID 2244 wrote to memory of 3908	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	113
PID 2244 wrote to memory of 3908	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	113
PID 2244 wrote to memory of 1968	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	114
PID 2244 wrote to memory of 1968	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	114
PID 2244 wrote to memory of 2952	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	115
PID 2244 wrote to memory of 2952	2244	4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe	115

C:\Users\Admin\AppData\Local\Temp\4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe
"C:\Users\Admin\AppData\Local\Temp\4e2da00cd7aeee8abc797ae75a1f2ae0797cdb3b4aa9ea3cd443194e779e5968.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\System\eBkZxoh.exe
  C:\Windows\System\eBkZxoh.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\slcIvsU.exe
  C:\Windows\System\slcIvsU.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\RZZKpdT.exe
  C:\Windows\System\RZZKpdT.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\ZjfVEiH.exe
  C:\Windows\System\ZjfVEiH.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\yJhEzCs.exe
  C:\Windows\System\yJhEzCs.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\KZrrmZq.exe
  C:\Windows\System\KZrrmZq.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\xFsSijJ.exe
  C:\Windows\System\xFsSijJ.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\JSAtHzu.exe
  C:\Windows\System\JSAtHzu.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\MXQZVSp.exe
  C:\Windows\System\MXQZVSp.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\MGIbHsK.exe
  C:\Windows\System\MGIbHsK.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\aPsPNLE.exe
  C:\Windows\System\aPsPNLE.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\ucwkIiT.exe
  C:\Windows\System\ucwkIiT.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\OaQfmWQ.exe
  C:\Windows\System\OaQfmWQ.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\bvqavwn.exe
  C:\Windows\System\bvqavwn.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\uybPLga.exe
  C:\Windows\System\uybPLga.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\xORRGQk.exe
  C:\Windows\System\xORRGQk.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\DEytaFm.exe
  C:\Windows\System\DEytaFm.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\omnWrwV.exe
  C:\Windows\System\omnWrwV.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\PsKwDcR.exe
  C:\Windows\System\PsKwDcR.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\iTGnKGh.exe
  C:\Windows\System\iTGnKGh.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\BAsIbMy.exe
  C:\Windows\System\BAsIbMy.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\MiphXEb.exe
  C:\Windows\System\MiphXEb.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\ywCQQdF.exe
  C:\Windows\System\ywCQQdF.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\srGtsRO.exe
  C:\Windows\System\srGtsRO.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\DfcRDlb.exe
  C:\Windows\System\DfcRDlb.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\yBkMGkq.exe
  C:\Windows\System\yBkMGkq.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\yXfQHRM.exe
  C:\Windows\System\yXfQHRM.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\vKcnrUA.exe
  C:\Windows\System\vKcnrUA.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\FXcbJHn.exe
  C:\Windows\System\FXcbJHn.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\fxJMOJE.exe
  C:\Windows\System\fxJMOJE.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\osqaUXs.exe
  C:\Windows\System\osqaUXs.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\tFedkoz.exe
  C:\Windows\System\tFedkoz.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\myPVvoU.exe
  C:\Windows\System\myPVvoU.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\JamJfpX.exe
  C:\Windows\System\JamJfpX.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\hoOCfXb.exe
  C:\Windows\System\hoOCfXb.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\SIeXfHP.exe
  C:\Windows\System\SIeXfHP.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\CwzyIWl.exe
  C:\Windows\System\CwzyIWl.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\xROundX.exe
  C:\Windows\System\xROundX.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\wbOGXON.exe
  C:\Windows\System\wbOGXON.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\SrdYZKz.exe
  C:\Windows\System\SrdYZKz.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\TqCDdjj.exe
  C:\Windows\System\TqCDdjj.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\Lgdtajr.exe
  C:\Windows\System\Lgdtajr.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\eOAZEDx.exe
  C:\Windows\System\eOAZEDx.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\LnXACHe.exe
  C:\Windows\System\LnXACHe.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\SYaiEyz.exe
  C:\Windows\System\SYaiEyz.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\auPeIFq.exe
  C:\Windows\System\auPeIFq.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\vUmvTbc.exe
  C:\Windows\System\vUmvTbc.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\bVbzmlw.exe
  C:\Windows\System\bVbzmlw.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\UBdywGV.exe
  C:\Windows\System\UBdywGV.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\MddGEPd.exe
  C:\Windows\System\MddGEPd.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\weEIUmu.exe
  C:\Windows\System\weEIUmu.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\VpqiaVS.exe
  C:\Windows\System\VpqiaVS.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\KbAZzSV.exe
  C:\Windows\System\KbAZzSV.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\YrtxHxF.exe
  C:\Windows\System\YrtxHxF.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\uGHpaSQ.exe
  C:\Windows\System\uGHpaSQ.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\JaIHUzE.exe
  C:\Windows\System\JaIHUzE.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\ohWekym.exe
  C:\Windows\System\ohWekym.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\tUCUHkE.exe
  C:\Windows\System\tUCUHkE.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\DLkooVy.exe
  C:\Windows\System\DLkooVy.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\yYnOask.exe
  C:\Windows\System\yYnOask.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\pSWaltq.exe
  C:\Windows\System\pSWaltq.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\mgIONrl.exe
  C:\Windows\System\mgIONrl.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\KLqOgTK.exe
  C:\Windows\System\KLqOgTK.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\VMCZkDw.exe
  C:\Windows\System\VMCZkDw.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\fIfPiDb.exe
  C:\Windows\System\fIfPiDb.exe
  2⤵
  PID:2768
- C:\Windows\System\GHhGnzJ.exe
  C:\Windows\System\GHhGnzJ.exe
  2⤵
  PID:100
- C:\Windows\System\OfIdWYU.exe
  C:\Windows\System\OfIdWYU.exe
  2⤵
  PID:1748
- C:\Windows\System\NufeCTE.exe
  C:\Windows\System\NufeCTE.exe
  2⤵
  PID:4696
- C:\Windows\System\JJuTsfP.exe
  C:\Windows\System\JJuTsfP.exe
  2⤵
  PID:4752
- C:\Windows\System\XazrUMv.exe
  C:\Windows\System\XazrUMv.exe
  2⤵
  PID:2896
- C:\Windows\System\uNIjKNS.exe
  C:\Windows\System\uNIjKNS.exe
  2⤵
  PID:1716
- C:\Windows\System\GjngeVE.exe
  C:\Windows\System\GjngeVE.exe
  2⤵
  PID:1484
- C:\Windows\System\EwyACRf.exe
  C:\Windows\System\EwyACRf.exe
  2⤵
  PID:3272
- C:\Windows\System\rfJlfYH.exe
  C:\Windows\System\rfJlfYH.exe
  2⤵
  PID:4292
- C:\Windows\System\ZJMaeLT.exe
  C:\Windows\System\ZJMaeLT.exe
  2⤵
  PID:888
- C:\Windows\System\GZdJEvy.exe
  C:\Windows\System\GZdJEvy.exe
  2⤵
  PID:4660
- C:\Windows\System\PgNJfDc.exe
  C:\Windows\System\PgNJfDc.exe
  2⤵
  PID:4976
- C:\Windows\System\RDhxKiv.exe
  C:\Windows\System\RDhxKiv.exe
  2⤵
  PID:3300
- C:\Windows\System\ZqkbuoF.exe
  C:\Windows\System\ZqkbuoF.exe
  2⤵
  PID:4344
- C:\Windows\System\qwXJMND.exe
  C:\Windows\System\qwXJMND.exe
  2⤵
  PID:1500
- C:\Windows\System\IJndAQq.exe
  C:\Windows\System\IJndAQq.exe
  2⤵
  PID:1488
- C:\Windows\System\fdWZVWd.exe
  C:\Windows\System\fdWZVWd.exe
  2⤵
  PID:4540
- C:\Windows\System\jdVyzwv.exe
  C:\Windows\System\jdVyzwv.exe
  2⤵
  PID:2812
- C:\Windows\System\pyxsXGT.exe
  C:\Windows\System\pyxsXGT.exe
  2⤵
  PID:2596
- C:\Windows\System\cHyWIvn.exe
  C:\Windows\System\cHyWIvn.exe
  2⤵
  PID:2008
- C:\Windows\System\yubbXUK.exe
  C:\Windows\System\yubbXUK.exe
  2⤵
  PID:4320
- C:\Windows\System\uzhVqIt.exe
  C:\Windows\System\uzhVqIt.exe
  2⤵
  PID:5036
- C:\Windows\System\ywIslPH.exe
  C:\Windows\System\ywIslPH.exe
  2⤵
  PID:3236
- C:\Windows\System\wYpLbth.exe
  C:\Windows\System\wYpLbth.exe
  2⤵
  PID:5064
- C:\Windows\System\cEMPEUn.exe
  C:\Windows\System\cEMPEUn.exe
  2⤵
  PID:3376
- C:\Windows\System\cjLlTAC.exe
  C:\Windows\System\cjLlTAC.exe
  2⤵
  PID:5072
- C:\Windows\System\yPfcaGi.exe
  C:\Windows\System\yPfcaGi.exe
  2⤵
  PID:4576
- C:\Windows\System\zWMOgzy.exe
  C:\Windows\System\zWMOgzy.exe
  2⤵
  PID:4732
- C:\Windows\System\wTTTjgr.exe
  C:\Windows\System\wTTTjgr.exe
  2⤵
  PID:924
- C:\Windows\System\TjSYEvh.exe
  C:\Windows\System\TjSYEvh.exe
  2⤵
  PID:4868
- C:\Windows\System\frCsrPD.exe
  C:\Windows\System\frCsrPD.exe
  2⤵
  PID:2088
- C:\Windows\System\qzvuISQ.exe
  C:\Windows\System\qzvuISQ.exe
  2⤵
  PID:2040
- C:\Windows\System\XrBLIEk.exe
  C:\Windows\System\XrBLIEk.exe
  2⤵
  PID:4640
- C:\Windows\System\uecJFub.exe
  C:\Windows\System\uecJFub.exe
  2⤵
  PID:2312
- C:\Windows\System\NpEfKnr.exe
  C:\Windows\System\NpEfKnr.exe
  2⤵
  PID:4908
- C:\Windows\System\HIRewpu.exe
  C:\Windows\System\HIRewpu.exe
  2⤵
  PID:4356
- C:\Windows\System\BVscmvP.exe
  C:\Windows\System\BVscmvP.exe
  2⤵
  PID:1208
- C:\Windows\System\DGaAUdj.exe
  C:\Windows\System\DGaAUdj.exe
  2⤵
  PID:4144
- C:\Windows\System\oPHVFlV.exe
  C:\Windows\System\oPHVFlV.exe
  2⤵
  PID:5060
- C:\Windows\System\oAYzljx.exe
  C:\Windows\System\oAYzljx.exe
  2⤵
  PID:1976
- C:\Windows\System\ZjWdpVl.exe
  C:\Windows\System\ZjWdpVl.exe
  2⤵
  PID:916
- C:\Windows\System\wZdqZRC.exe
  C:\Windows\System\wZdqZRC.exe
  2⤵
  PID:5056
- C:\Windows\System\dQnqadO.exe
  C:\Windows\System\dQnqadO.exe
  2⤵
  PID:3976
- C:\Windows\System\bsCrXzz.exe
  C:\Windows\System\bsCrXzz.exe
  2⤵
  PID:2836
- C:\Windows\System\pZlehMW.exe
  C:\Windows\System\pZlehMW.exe
  2⤵
  PID:624
- C:\Windows\System\VrCqKSC.exe
  C:\Windows\System\VrCqKSC.exe
  2⤵
  PID:2960
- C:\Windows\System\TUKcYwg.exe
  C:\Windows\System\TUKcYwg.exe
  2⤵
  PID:1852
- C:\Windows\System\VAHpakY.exe
  C:\Windows\System\VAHpakY.exe
  2⤵
  PID:4812
- C:\Windows\System\sGKNsNY.exe
  C:\Windows\System\sGKNsNY.exe
  2⤵
  PID:1804
- C:\Windows\System\keqSFCs.exe
  C:\Windows\System\keqSFCs.exe
  2⤵
  PID:3860
- C:\Windows\System\nijSHAj.exe
  C:\Windows\System\nijSHAj.exe
  2⤵
  PID:3964
- C:\Windows\System\jPCRMrg.exe
  C:\Windows\System\jPCRMrg.exe
  2⤵
  PID:1096
- C:\Windows\System\dpFtIcX.exe
  C:\Windows\System\dpFtIcX.exe
  2⤵
  PID:5124
- C:\Windows\System\GdJKOSx.exe
  C:\Windows\System\GdJKOSx.exe
  2⤵
  PID:5152
- C:\Windows\System\jCBBaBp.exe
  C:\Windows\System\jCBBaBp.exe
  2⤵
  PID:5172
- C:\Windows\System\nGfwCjY.exe
  C:\Windows\System\nGfwCjY.exe
  2⤵
  PID:5196
- C:\Windows\System\ZsjVpaW.exe
  C:\Windows\System\ZsjVpaW.exe
  2⤵
  PID:5236
- C:\Windows\System\bnsfMfG.exe
  C:\Windows\System\bnsfMfG.exe
  2⤵
  PID:5252
- C:\Windows\System\uAWEAcv.exe
  C:\Windows\System\uAWEAcv.exe
  2⤵
  PID:5280
- C:\Windows\System\EHhcFJh.exe
  C:\Windows\System\EHhcFJh.exe
  2⤵
  PID:5300
- C:\Windows\System\YjJBRYZ.exe
  C:\Windows\System\YjJBRYZ.exe
  2⤵
  PID:5336
- C:\Windows\System\QjTnwrq.exe
  C:\Windows\System\QjTnwrq.exe
  2⤵
  PID:5364
- C:\Windows\System\hDfymkW.exe
  C:\Windows\System\hDfymkW.exe
  2⤵
  PID:5404
- C:\Windows\System\iaEOXQf.exe
  C:\Windows\System\iaEOXQf.exe
  2⤵
  PID:5432
- C:\Windows\System\IuvnKKN.exe
  C:\Windows\System\IuvnKKN.exe
  2⤵
  PID:5460
- C:\Windows\System\fEJApXB.exe
  C:\Windows\System\fEJApXB.exe
  2⤵
  PID:5508
- C:\Windows\System\QZeFxPc.exe
  C:\Windows\System\QZeFxPc.exe
  2⤵
  PID:5540
- C:\Windows\System\RGQtYIe.exe
  C:\Windows\System\RGQtYIe.exe
  2⤵
  PID:5568
- C:\Windows\System\aUKjAZh.exe
  C:\Windows\System\aUKjAZh.exe
  2⤵
  PID:5584
- C:\Windows\System\LwnZSBU.exe
  C:\Windows\System\LwnZSBU.exe
  2⤵
  PID:5620
- C:\Windows\System\byXpbkG.exe
  C:\Windows\System\byXpbkG.exe
  2⤵
  PID:5644
- C:\Windows\System\iKIkpKq.exe
  C:\Windows\System\iKIkpKq.exe
  2⤵
  PID:5680
- C:\Windows\System\zLHOpxr.exe
  C:\Windows\System\zLHOpxr.exe
  2⤵
  PID:5708
- C:\Windows\System\RdiorDV.exe
  C:\Windows\System\RdiorDV.exe
  2⤵
  PID:5728
- C:\Windows\System\qnBMWSv.exe
  C:\Windows\System\qnBMWSv.exe
  2⤵
  PID:5756
- C:\Windows\System\QwoSLMU.exe
  C:\Windows\System\QwoSLMU.exe
  2⤵
  PID:5788
- C:\Windows\System\uyzmyeU.exe
  C:\Windows\System\uyzmyeU.exe
  2⤵
  PID:5824
- C:\Windows\System\quuYZiy.exe
  C:\Windows\System\quuYZiy.exe
  2⤵
  PID:5852
- C:\Windows\System\lhPEBaM.exe
  C:\Windows\System\lhPEBaM.exe
  2⤵
  PID:5868
- C:\Windows\System\EOSreCE.exe
  C:\Windows\System\EOSreCE.exe
  2⤵
  PID:5900
- C:\Windows\System\bZaKNEE.exe
  C:\Windows\System\bZaKNEE.exe
  2⤵
  PID:5924
- C:\Windows\System\cUqXqUs.exe
  C:\Windows\System\cUqXqUs.exe
  2⤵
  PID:5952
- C:\Windows\System\GycbFYn.exe
  C:\Windows\System\GycbFYn.exe
  2⤵
  PID:5980
- C:\Windows\System\MwdcpCU.exe
  C:\Windows\System\MwdcpCU.exe
  2⤵
  PID:6012
- C:\Windows\System\dOlinNj.exe
  C:\Windows\System\dOlinNj.exe
  2⤵
  PID:6040
- C:\Windows\System\kdHOAlA.exe
  C:\Windows\System\kdHOAlA.exe
  2⤵
  PID:6068
- C:\Windows\System\AbvegUk.exe
  C:\Windows\System\AbvegUk.exe
  2⤵
  PID:6088
- C:\Windows\System\wEFKsgH.exe
  C:\Windows\System\wEFKsgH.exe
  2⤵
  PID:6120
- C:\Windows\System\aWdGNFv.exe
  C:\Windows\System\aWdGNFv.exe
  2⤵
  PID:60
- C:\Windows\System\qEMpGUx.exe
  C:\Windows\System\qEMpGUx.exe
  2⤵
  PID:5224
- C:\Windows\System\OguaiyK.exe
  C:\Windows\System\OguaiyK.exe
  2⤵
  PID:5216
- C:\Windows\System\uGpfpbw.exe
  C:\Windows\System\uGpfpbw.exe
  2⤵
  PID:5384
- C:\Windows\System\aicTFSU.exe
  C:\Windows\System\aicTFSU.exe
  2⤵
  PID:5456
- C:\Windows\System\ZZZzlOU.exe
  C:\Windows\System\ZZZzlOU.exe
  2⤵
  PID:5496
- C:\Windows\System\yqUnsnu.exe
  C:\Windows\System\yqUnsnu.exe
  2⤵
  PID:5564
- C:\Windows\System\hnHoKCf.exe
  C:\Windows\System\hnHoKCf.exe
  2⤵
  PID:5636
- C:\Windows\System\SKKLAPM.exe
  C:\Windows\System\SKKLAPM.exe
  2⤵
  PID:5720
- C:\Windows\System\gNzHhqM.exe
  C:\Windows\System\gNzHhqM.exe
  2⤵
  PID:5736
- C:\Windows\System\vPxgdyp.exe
  C:\Windows\System\vPxgdyp.exe
  2⤵
  PID:5864
- C:\Windows\System\ZTfOToH.exe
  C:\Windows\System\ZTfOToH.exe
  2⤵
  PID:5940
- C:\Windows\System\vNVwmXZ.exe
  C:\Windows\System\vNVwmXZ.exe
  2⤵
  PID:5968
- C:\Windows\System\tWBXHqK.exe
  C:\Windows\System\tWBXHqK.exe
  2⤵
  PID:5992
- C:\Windows\System\pJXCYXX.exe
  C:\Windows\System\pJXCYXX.exe
  2⤵
  PID:6036
- C:\Windows\System\AqVzqNq.exe
  C:\Windows\System\AqVzqNq.exe
  2⤵
  PID:5160
- C:\Windows\System\DsZzTXY.exe
  C:\Windows\System\DsZzTXY.exe
  2⤵
  PID:3356
- C:\Windows\System\qmYhQfa.exe
  C:\Windows\System\qmYhQfa.exe
  2⤵
  PID:5392
- C:\Windows\System\lWLtuBA.exe
  C:\Windows\System\lWLtuBA.exe
  2⤵
  PID:5536
- C:\Windows\System\RcbEgUL.exe
  C:\Windows\System\RcbEgUL.exe
  2⤵
  PID:5660
- C:\Windows\System\wBYbrZV.exe
  C:\Windows\System\wBYbrZV.exe
  2⤵
  PID:5860
- C:\Windows\System\xZFxiLN.exe
  C:\Windows\System\xZFxiLN.exe
  2⤵
  PID:6052
- C:\Windows\System\gaPlkLo.exe
  C:\Windows\System\gaPlkLo.exe
  2⤵
  PID:6140
- C:\Windows\System\gvcUwVk.exe
  C:\Windows\System\gvcUwVk.exe
  2⤵
  PID:5476
- C:\Windows\System\sZGaFPP.exe
  C:\Windows\System\sZGaFPP.exe
  2⤵
  PID:5612
- C:\Windows\System\dkqaJbV.exe
  C:\Windows\System\dkqaJbV.exe
  2⤵
  PID:6108
- C:\Windows\System\TIcHxty.exe
  C:\Windows\System\TIcHxty.exe
  2⤵
  PID:6156
- C:\Windows\System\JVHlQsz.exe
  C:\Windows\System\JVHlQsz.exe
  2⤵
  PID:6184
- C:\Windows\System\krYmRcj.exe
  C:\Windows\System\krYmRcj.exe
  2⤵
  PID:6216
- C:\Windows\System\dUwcrhs.exe
  C:\Windows\System\dUwcrhs.exe
  2⤵
  PID:6252
- C:\Windows\System\acjbriG.exe
  C:\Windows\System\acjbriG.exe
  2⤵
  PID:6276
- C:\Windows\System\ILbUBXI.exe
  C:\Windows\System\ILbUBXI.exe
  2⤵
  PID:6292
- C:\Windows\System\RaFallY.exe
  C:\Windows\System\RaFallY.exe
  2⤵
  PID:6324
- C:\Windows\System\HGToudi.exe
  C:\Windows\System\HGToudi.exe
  2⤵
  PID:6352
- C:\Windows\System\kZRimNw.exe
  C:\Windows\System\kZRimNw.exe
  2⤵
  PID:6384
- C:\Windows\System\uTsNElP.exe
  C:\Windows\System\uTsNElP.exe
  2⤵
  PID:6404
- C:\Windows\System\kOKBliv.exe
  C:\Windows\System\kOKBliv.exe
  2⤵
  PID:6432
- C:\Windows\System\OYUgJoU.exe
  C:\Windows\System\OYUgJoU.exe
  2⤵
  PID:6472
- C:\Windows\System\GMZfCSY.exe
  C:\Windows\System\GMZfCSY.exe
  2⤵
  PID:6500
- C:\Windows\System\wiOmtjw.exe
  C:\Windows\System\wiOmtjw.exe
  2⤵
  PID:6532
- C:\Windows\System\TcznPWA.exe
  C:\Windows\System\TcznPWA.exe
  2⤵
  PID:6548
- C:\Windows\System\hHTpTqR.exe
  C:\Windows\System\hHTpTqR.exe
  2⤵
  PID:6580
- C:\Windows\System\lVIQYkF.exe
  C:\Windows\System\lVIQYkF.exe
  2⤵
  PID:6608
- C:\Windows\System\ZGrKKdZ.exe
  C:\Windows\System\ZGrKKdZ.exe
  2⤵
  PID:6632
- C:\Windows\System\sKRdccG.exe
  C:\Windows\System\sKRdccG.exe
  2⤵
  PID:6672
- C:\Windows\System\BcCQLzl.exe
  C:\Windows\System\BcCQLzl.exe
  2⤵
  PID:6696
- C:\Windows\System\iLuNoiY.exe
  C:\Windows\System\iLuNoiY.exe
  2⤵
  PID:6720
- C:\Windows\System\PQhxAVo.exe
  C:\Windows\System\PQhxAVo.exe
  2⤵
  PID:6744
- C:\Windows\System\sdyKiJP.exe
  C:\Windows\System\sdyKiJP.exe
  2⤵
  PID:6776
- C:\Windows\System\GDqRFrU.exe
  C:\Windows\System\GDqRFrU.exe
  2⤵
  PID:6808
- C:\Windows\System\YtpssHp.exe
  C:\Windows\System\YtpssHp.exe
  2⤵
  PID:6840
- C:\Windows\System\GKEaxpL.exe
  C:\Windows\System\GKEaxpL.exe
  2⤵
  PID:6864
- C:\Windows\System\qqdjGwE.exe
  C:\Windows\System\qqdjGwE.exe
  2⤵
  PID:6888
- C:\Windows\System\ujGWlWY.exe
  C:\Windows\System\ujGWlWY.exe
  2⤵
  PID:6920
- C:\Windows\System\obVqMzC.exe
  C:\Windows\System\obVqMzC.exe
  2⤵
  PID:6956
- C:\Windows\System\OfyBJFE.exe
  C:\Windows\System\OfyBJFE.exe
  2⤵
  PID:6984
- C:\Windows\System\LjpjIbK.exe
  C:\Windows\System\LjpjIbK.exe
  2⤵
  PID:7012
- C:\Windows\System\BNRzDtq.exe
  C:\Windows\System\BNRzDtq.exe
  2⤵
  PID:7044
- C:\Windows\System\ilrWEgM.exe
  C:\Windows\System\ilrWEgM.exe
  2⤵
  PID:7068
- C:\Windows\System\ALuesJd.exe
  C:\Windows\System\ALuesJd.exe
  2⤵
  PID:7096
- C:\Windows\System\IGiqBVK.exe
  C:\Windows\System\IGiqBVK.exe
  2⤵
  PID:7128
- C:\Windows\System\oEttLpP.exe
  C:\Windows\System\oEttLpP.exe
  2⤵
  PID:7152
- C:\Windows\System\YJIvGmx.exe
  C:\Windows\System\YJIvGmx.exe
  2⤵
  PID:5768
- C:\Windows\System\fxVvJJU.exe
  C:\Windows\System\fxVvJJU.exe
  2⤵
  PID:6176
- C:\Windows\System\MVpwlhz.exe
  C:\Windows\System\MVpwlhz.exe
  2⤵
  PID:6172
- C:\Windows\System\ZczYQhT.exe
  C:\Windows\System\ZczYQhT.exe
  2⤵
  PID:6264
- C:\Windows\System\yFZNSto.exe
  C:\Windows\System\yFZNSto.exe
  2⤵
  PID:6312
- C:\Windows\System\xZLoVfn.exe
  C:\Windows\System\xZLoVfn.exe
  2⤵
  PID:6372
- C:\Windows\System\MxxkENb.exe
  C:\Windows\System\MxxkENb.exe
  2⤵
  PID:6440
- C:\Windows\System\mAEXWKh.exe
  C:\Windows\System\mAEXWKh.exe
  2⤵
  PID:6512
- C:\Windows\System\ZBnhwuO.exe
  C:\Windows\System\ZBnhwuO.exe
  2⤵
  PID:6600
- C:\Windows\System\eZqCkkz.exe
  C:\Windows\System\eZqCkkz.exe
  2⤵
  PID:6628
- C:\Windows\System\FfFfPOn.exe
  C:\Windows\System\FfFfPOn.exe
  2⤵
  PID:6704
- C:\Windows\System\OTQEEVQ.exe
  C:\Windows\System\OTQEEVQ.exe
  2⤵
  PID:6816
- C:\Windows\System\IIBCcOx.exe
  C:\Windows\System\IIBCcOx.exe
  2⤵
  PID:6872
- C:\Windows\System\ofURVHf.exe
  C:\Windows\System\ofURVHf.exe
  2⤵
  PID:6948
- C:\Windows\System\cFqYWBQ.exe
  C:\Windows\System\cFqYWBQ.exe
  2⤵
  PID:6968
- C:\Windows\System\tiAuSRf.exe
  C:\Windows\System\tiAuSRf.exe
  2⤵
  PID:7084
- C:\Windows\System\cxIqyWV.exe
  C:\Windows\System\cxIqyWV.exe
  2⤵
  PID:7112
- C:\Windows\System\acClPKA.exe
  C:\Windows\System\acClPKA.exe
  2⤵
  PID:6244
- C:\Windows\System\ijOZzKd.exe
  C:\Windows\System\ijOZzKd.exe
  2⤵
  PID:6348
- C:\Windows\System\VCksmNu.exe
  C:\Windows\System\VCksmNu.exe
  2⤵
  PID:6424
- C:\Windows\System\wYPOWjj.exe
  C:\Windows\System\wYPOWjj.exe
  2⤵
  PID:6684
- C:\Windows\System\ERejYZa.exe
  C:\Windows\System\ERejYZa.exe
  2⤵
  PID:6792
- C:\Windows\System\lJVKyAd.exe
  C:\Windows\System\lJVKyAd.exe
  2⤵
  PID:6880
- C:\Windows\System\BQPOqii.exe
  C:\Windows\System\BQPOqii.exe
  2⤵
  PID:7008
- C:\Windows\System\BtawKfT.exe
  C:\Windows\System\BtawKfT.exe
  2⤵
  PID:6200
- C:\Windows\System\eWeSgHD.exe
  C:\Windows\System\eWeSgHD.exe
  2⤵
  PID:6368
- C:\Windows\System\EHDqmmN.exe
  C:\Windows\System\EHDqmmN.exe
  2⤵
  PID:6208
- C:\Windows\System\DAbyMnC.exe
  C:\Windows\System\DAbyMnC.exe
  2⤵
  PID:7184
- C:\Windows\System\rOwdsAK.exe
  C:\Windows\System\rOwdsAK.exe
  2⤵
  PID:7220
- C:\Windows\System\EdFLith.exe
  C:\Windows\System\EdFLith.exe
  2⤵
  PID:7236
- C:\Windows\System\ORPZSLM.exe
  C:\Windows\System\ORPZSLM.exe
  2⤵
  PID:7264
- C:\Windows\System\zzBjoCd.exe
  C:\Windows\System\zzBjoCd.exe
  2⤵
  PID:7292
- C:\Windows\System\yxGPSQu.exe
  C:\Windows\System\yxGPSQu.exe
  2⤵
  PID:7316
- C:\Windows\System\AgrhBFd.exe
  C:\Windows\System\AgrhBFd.exe
  2⤵
  PID:7348
- C:\Windows\System\uzBFQfm.exe
  C:\Windows\System\uzBFQfm.exe
  2⤵
  PID:7376
- C:\Windows\System\ATPJDXW.exe
  C:\Windows\System\ATPJDXW.exe
  2⤵
  PID:7404
- C:\Windows\System\JSMmApz.exe
  C:\Windows\System\JSMmApz.exe
  2⤵
  PID:7436
- C:\Windows\System\OsuJNBu.exe
  C:\Windows\System\OsuJNBu.exe
  2⤵
  PID:7460
- C:\Windows\System\bVvPGHX.exe
  C:\Windows\System\bVvPGHX.exe
  2⤵
  PID:7484
- C:\Windows\System\yBUzLIM.exe
  C:\Windows\System\yBUzLIM.exe
  2⤵
  PID:7504
- C:\Windows\System\PLZiKzh.exe
  C:\Windows\System\PLZiKzh.exe
  2⤵
  PID:7528
- C:\Windows\System\stvkXcz.exe
  C:\Windows\System\stvkXcz.exe
  2⤵
  PID:7556
- C:\Windows\System\PUkCzJI.exe
  C:\Windows\System\PUkCzJI.exe
  2⤵
  PID:7596
- C:\Windows\System\UfbyfuN.exe
  C:\Windows\System\UfbyfuN.exe
  2⤵
  PID:7616
- C:\Windows\System\dxjZwAT.exe
  C:\Windows\System\dxjZwAT.exe
  2⤵
  PID:7648
- C:\Windows\System\ywtLzKz.exe
  C:\Windows\System\ywtLzKz.exe
  2⤵
  PID:7680
- C:\Windows\System\chMoxxb.exe
  C:\Windows\System\chMoxxb.exe
  2⤵
  PID:7704
- C:\Windows\System\XsNJcDv.exe
  C:\Windows\System\XsNJcDv.exe
  2⤵
  PID:7732
- C:\Windows\System\UyWhXJd.exe
  C:\Windows\System\UyWhXJd.exe
  2⤵
  PID:7756
- C:\Windows\System\mOWfESG.exe
  C:\Windows\System\mOWfESG.exe
  2⤵
  PID:7780
- C:\Windows\System\JFUdyKH.exe
  C:\Windows\System\JFUdyKH.exe
  2⤵
  PID:7808
- C:\Windows\System\onzqfbB.exe
  C:\Windows\System\onzqfbB.exe
  2⤵
  PID:7836
- C:\Windows\System\gfJAHeR.exe
  C:\Windows\System\gfJAHeR.exe
  2⤵
  PID:7864
- C:\Windows\System\RLSVfCu.exe
  C:\Windows\System\RLSVfCu.exe
  2⤵
  PID:7892
- C:\Windows\System\hiriTYw.exe
  C:\Windows\System\hiriTYw.exe
  2⤵
  PID:7908
- C:\Windows\System\hcLpaos.exe
  C:\Windows\System\hcLpaos.exe
  2⤵
  PID:7936
- C:\Windows\System\LYpbKpz.exe
  C:\Windows\System\LYpbKpz.exe
  2⤵
  PID:7960
- C:\Windows\System\LQFttrl.exe
  C:\Windows\System\LQFttrl.exe
  2⤵
  PID:7984
- C:\Windows\System\sEUDKVY.exe
  C:\Windows\System\sEUDKVY.exe
  2⤵
  PID:8016
- C:\Windows\System\KdpLPJT.exe
  C:\Windows\System\KdpLPJT.exe
  2⤵
  PID:8040
- C:\Windows\System\BJpfzGT.exe
  C:\Windows\System\BJpfzGT.exe
  2⤵
  PID:8072
- C:\Windows\System\JwVaitx.exe
  C:\Windows\System\JwVaitx.exe
  2⤵
  PID:8092
- C:\Windows\System\Bfrfina.exe
  C:\Windows\System\Bfrfina.exe
  2⤵
  PID:8124
- C:\Windows\System\PLPoTXB.exe
  C:\Windows\System\PLPoTXB.exe
  2⤵
  PID:8152
- C:\Windows\System\gVOszst.exe
  C:\Windows\System\gVOszst.exe
  2⤵
  PID:8176
- C:\Windows\System\UqZoHju.exe
  C:\Windows\System\UqZoHju.exe
  2⤵
  PID:7180
- C:\Windows\System\ADZxriK.exe
  C:\Windows\System\ADZxriK.exe
  2⤵
  PID:7216
- C:\Windows\System\VKcKUtN.exe
  C:\Windows\System\VKcKUtN.exe
  2⤵
  PID:7260
- C:\Windows\System\MmcBzuc.exe
  C:\Windows\System\MmcBzuc.exe
  2⤵
  PID:7400
- C:\Windows\System\tOvwQno.exe
  C:\Windows\System\tOvwQno.exe
  2⤵
  PID:7364
- C:\Windows\System\AwZmDzT.exe
  C:\Windows\System\AwZmDzT.exe
  2⤵
  PID:7388
- C:\Windows\System\hCKdIZX.exe
  C:\Windows\System\hCKdIZX.exe
  2⤵
  PID:7520
- C:\Windows\System\ddEivpd.exe
  C:\Windows\System\ddEivpd.exe
  2⤵
  PID:7604
- C:\Windows\System\aCJuDwY.exe
  C:\Windows\System\aCJuDwY.exe
  2⤵
  PID:7668
- C:\Windows\System\xKxNkym.exe
  C:\Windows\System\xKxNkym.exe
  2⤵
  PID:7580
- C:\Windows\System\dnbUids.exe
  C:\Windows\System\dnbUids.exe
  2⤵
  PID:7728
- C:\Windows\System\XeNxxhP.exe
  C:\Windows\System\XeNxxhP.exe
  2⤵
  PID:7776
- C:\Windows\System\DaCzpDT.exe
  C:\Windows\System\DaCzpDT.exe
  2⤵
  PID:7856
- C:\Windows\System\otvpkJx.exe
  C:\Windows\System\otvpkJx.exe
  2⤵
  PID:8000
- C:\Windows\System\cOCnqHy.exe
  C:\Windows\System\cOCnqHy.exe
  2⤵
  PID:8056
- C:\Windows\System\XUvZSJK.exe
  C:\Windows\System\XUvZSJK.exe
  2⤵
  PID:8116
- C:\Windows\System\TejghQH.exe
  C:\Windows\System\TejghQH.exe
  2⤵
  PID:7208
- C:\Windows\System\ZIouGpv.exe
  C:\Windows\System\ZIouGpv.exe
  2⤵
  PID:7248
- C:\Windows\System\dbDqvHR.exe
  C:\Windows\System\dbDqvHR.exe
  2⤵
  PID:7384
- C:\Windows\System\SeinjDM.exe
  C:\Windows\System\SeinjDM.exe
  2⤵
  PID:7884
- C:\Windows\System\TwPWaGd.exe
  C:\Windows\System\TwPWaGd.exe
  2⤵
  PID:7572
- C:\Windows\System\dtbxhtD.exe
  C:\Windows\System\dtbxhtD.exe
  2⤵
  PID:7924
- C:\Windows\System\zfVIAUF.exe
  C:\Windows\System\zfVIAUF.exe
  2⤵
  PID:8084
- C:\Windows\System\XLWXAeK.exe
  C:\Windows\System\XLWXAeK.exe
  2⤵
  PID:7792
- C:\Windows\System\GJSQgwz.exe
  C:\Windows\System\GJSQgwz.exe
  2⤵
  PID:7768
- C:\Windows\System\WiFCdIj.exe
  C:\Windows\System\WiFCdIj.exe
  2⤵
  PID:7956
- C:\Windows\System\lDStdcP.exe
  C:\Windows\System\lDStdcP.exe
  2⤵
  PID:7700
- C:\Windows\System\ZMhZoBo.exe
  C:\Windows\System\ZMhZoBo.exe
  2⤵
  PID:8212
- C:\Windows\System\YAUFHLr.exe
  C:\Windows\System\YAUFHLr.exe
  2⤵
  PID:8232
- C:\Windows\System\mntJlYr.exe
  C:\Windows\System\mntJlYr.exe
  2⤵
  PID:8264
- C:\Windows\System\UOffacP.exe
  C:\Windows\System\UOffacP.exe
  2⤵
  PID:8292
- C:\Windows\System\uUzPwSu.exe
  C:\Windows\System\uUzPwSu.exe
  2⤵
  PID:8320
- C:\Windows\System\mxrvtEI.exe
  C:\Windows\System\mxrvtEI.exe
  2⤵
  PID:8360
- C:\Windows\System\YZaoiib.exe
  C:\Windows\System\YZaoiib.exe
  2⤵
  PID:8392
- C:\Windows\System\CuAISem.exe
  C:\Windows\System\CuAISem.exe
  2⤵
  PID:8420
- C:\Windows\System\QjGXYHb.exe
  C:\Windows\System\QjGXYHb.exe
  2⤵
  PID:8448
- C:\Windows\System\mIxxphD.exe
  C:\Windows\System\mIxxphD.exe
  2⤵
  PID:8472
- C:\Windows\System\MQfOnOU.exe
  C:\Windows\System\MQfOnOU.exe
  2⤵
  PID:8504
- C:\Windows\System\MxxAZmh.exe
  C:\Windows\System\MxxAZmh.exe
  2⤵
  PID:8528
- C:\Windows\System\JRDsAZV.exe
  C:\Windows\System\JRDsAZV.exe
  2⤵
  PID:8544
- C:\Windows\System\TssGCnn.exe
  C:\Windows\System\TssGCnn.exe
  2⤵
  PID:8576
- C:\Windows\System\kujMuJv.exe
  C:\Windows\System\kujMuJv.exe
  2⤵
  PID:8604
- C:\Windows\System\zSJeytd.exe
  C:\Windows\System\zSJeytd.exe
  2⤵
  PID:8632
- C:\Windows\System\AdpiFCT.exe
  C:\Windows\System\AdpiFCT.exe
  2⤵
  PID:8660
- C:\Windows\System\XPUSzQx.exe
  C:\Windows\System\XPUSzQx.exe
  2⤵
  PID:8688
- C:\Windows\System\DLnEuhr.exe
  C:\Windows\System\DLnEuhr.exe
  2⤵
  PID:8720
- C:\Windows\System\XIoCOdm.exe
  C:\Windows\System\XIoCOdm.exe
  2⤵
  PID:8748
- C:\Windows\System\onHXwwa.exe
  C:\Windows\System\onHXwwa.exe
  2⤵
  PID:8776
- C:\Windows\System\wkKnAKH.exe
  C:\Windows\System\wkKnAKH.exe
  2⤵
  PID:8808
- C:\Windows\System\HTrjAzC.exe
  C:\Windows\System\HTrjAzC.exe
  2⤵
  PID:8840
- C:\Windows\System\CamBHAD.exe
  C:\Windows\System\CamBHAD.exe
  2⤵
  PID:8868
- C:\Windows\System\fhcOuTL.exe
  C:\Windows\System\fhcOuTL.exe
  2⤵
  PID:8892
- C:\Windows\System\gVlPGAl.exe
  C:\Windows\System\gVlPGAl.exe
  2⤵
  PID:8920
- C:\Windows\System\yWQWRTz.exe
  C:\Windows\System\yWQWRTz.exe
  2⤵
  PID:8948
- C:\Windows\System\WcTibhS.exe
  C:\Windows\System\WcTibhS.exe
  2⤵
  PID:8984
- C:\Windows\System\sXukvTf.exe
  C:\Windows\System\sXukvTf.exe
  2⤵
  PID:9004
- C:\Windows\System\HSjCRfA.exe
  C:\Windows\System\HSjCRfA.exe
  2⤵
  PID:9028
- C:\Windows\System\ieqKyXa.exe
  C:\Windows\System\ieqKyXa.exe
  2⤵
  PID:9068
- C:\Windows\System\pGPKear.exe
  C:\Windows\System\pGPKear.exe
  2⤵
  PID:9092
- C:\Windows\System\ytzVDyU.exe
  C:\Windows\System\ytzVDyU.exe
  2⤵
  PID:9120
- C:\Windows\System\HYOFmYd.exe
  C:\Windows\System\HYOFmYd.exe
  2⤵
  PID:9144
- C:\Windows\System\pnLuBek.exe
  C:\Windows\System\pnLuBek.exe
  2⤵
  PID:9168
- C:\Windows\System\hOclfjM.exe
  C:\Windows\System\hOclfjM.exe
  2⤵
  PID:9188
- C:\Windows\System\sDqniqN.exe
  C:\Windows\System\sDqniqN.exe
  2⤵
  PID:9212
- C:\Windows\System\wHAzqUm.exe
  C:\Windows\System\wHAzqUm.exe
  2⤵
  PID:8208
- C:\Windows\System\AawRsnV.exe
  C:\Windows\System\AawRsnV.exe
  2⤵
  PID:8200
- C:\Windows\System\lqLAyte.exe
  C:\Windows\System\lqLAyte.exe
  2⤵
  PID:8284
- C:\Windows\System\pHuGlYd.exe
  C:\Windows\System\pHuGlYd.exe
  2⤵
  PID:8340
- C:\Windows\System\uphHNUu.exe
  C:\Windows\System\uphHNUu.exe
  2⤵
  PID:8316
- C:\Windows\System\LjxBXTV.exe
  C:\Windows\System\LjxBXTV.exe
  2⤵
  PID:8524
- C:\Windows\System\bdcQueD.exe
  C:\Windows\System\bdcQueD.exe
  2⤵
  PID:8564
- C:\Windows\System\hDGWAFn.exe
  C:\Windows\System\hDGWAFn.exe
  2⤵
  PID:8540
- C:\Windows\System\MHzPeOw.exe
  C:\Windows\System\MHzPeOw.exe
  2⤵
  PID:8588
- C:\Windows\System\GvvDExN.exe
  C:\Windows\System\GvvDExN.exe
  2⤵
  PID:8736
- C:\Windows\System\htjIeMU.exe
  C:\Windows\System\htjIeMU.exe
  2⤵
  PID:8796
- C:\Windows\System\BwpVSWK.exe
  C:\Windows\System\BwpVSWK.exe
  2⤵
  PID:8860
- C:\Windows\System\zreUMqb.exe
  C:\Windows\System\zreUMqb.exe
  2⤵
  PID:8916
- C:\Windows\System\CWTctUv.exe
  C:\Windows\System\CWTctUv.exe
  2⤵
  PID:9020
- C:\Windows\System\NWBNCGn.exe
  C:\Windows\System\NWBNCGn.exe
  2⤵
  PID:9088
- C:\Windows\System\bozTpUD.exe
  C:\Windows\System\bozTpUD.exe
  2⤵
  PID:9196
- C:\Windows\System\iMLAUcx.exe
  C:\Windows\System\iMLAUcx.exe
  2⤵
  PID:9164
- C:\Windows\System\pnoWkMk.exe
  C:\Windows\System\pnoWkMk.exe
  2⤵
  PID:7472
- C:\Windows\System\xHaHaeN.exe
  C:\Windows\System\xHaHaeN.exe
  2⤵
  PID:9156
- C:\Windows\System\XkVyxmi.exe
  C:\Windows\System\XkVyxmi.exe
  2⤵
  PID:8700
- C:\Windows\System\OlJIbXz.exe
  C:\Windows\System\OlJIbXz.exe
  2⤵
  PID:8652
- C:\Windows\System\AVcaaJO.exe
  C:\Windows\System\AVcaaJO.exe
  2⤵
  PID:8728
- C:\Windows\System\jRTzNjB.exe
  C:\Windows\System\jRTzNjB.exe
  2⤵
  PID:9104
- C:\Windows\System\VTUdgSI.exe
  C:\Windows\System\VTUdgSI.exe
  2⤵
  PID:9180
- C:\Windows\System\VlXjoLh.exe
  C:\Windows\System\VlXjoLh.exe
  2⤵
  PID:8244
- C:\Windows\System\cgmsOjZ.exe
  C:\Windows\System\cgmsOjZ.exe
  2⤵
  PID:8936
- C:\Windows\System\nrfIZEn.exe
  C:\Windows\System\nrfIZEn.exe
  2⤵
  PID:9236
- C:\Windows\System\htgNMpf.exe
  C:\Windows\System\htgNMpf.exe
  2⤵
  PID:9264
- C:\Windows\System\ggRaHRh.exe
  C:\Windows\System\ggRaHRh.exe
  2⤵
  PID:9296
- C:\Windows\System\hyUaYHg.exe
  C:\Windows\System\hyUaYHg.exe
  2⤵
  PID:9328
- C:\Windows\System\vlAFRpP.exe
  C:\Windows\System\vlAFRpP.exe
  2⤵
  PID:9356
- C:\Windows\System\bZuSYkm.exe
  C:\Windows\System\bZuSYkm.exe
  2⤵
  PID:9380
- C:\Windows\System\ImuWuyZ.exe
  C:\Windows\System\ImuWuyZ.exe
  2⤵
  PID:9408
- C:\Windows\System\KOGeipU.exe
  C:\Windows\System\KOGeipU.exe
  2⤵
  PID:9444
- C:\Windows\System\lbrvUsx.exe
  C:\Windows\System\lbrvUsx.exe
  2⤵
  PID:9476
- C:\Windows\System\qpcAHvN.exe
  C:\Windows\System\qpcAHvN.exe
  2⤵
  PID:9512
- C:\Windows\System\TiNLUiA.exe
  C:\Windows\System\TiNLUiA.exe
  2⤵
  PID:9536
- C:\Windows\System\wnrdSbK.exe
  C:\Windows\System\wnrdSbK.exe
  2⤵
  PID:9560
- C:\Windows\System\JqwhMSX.exe
  C:\Windows\System\JqwhMSX.exe
  2⤵
  PID:9584
- C:\Windows\System\sseaEam.exe
  C:\Windows\System\sseaEam.exe
  2⤵
  PID:9608
- C:\Windows\System\lXgKyVJ.exe
  C:\Windows\System\lXgKyVJ.exe
  2⤵
  PID:9644
- C:\Windows\System\xrAunMh.exe
  C:\Windows\System\xrAunMh.exe
  2⤵
  PID:9672
- C:\Windows\System\GIwVolk.exe
  C:\Windows\System\GIwVolk.exe
  2⤵
  PID:9700
- C:\Windows\System\txWpuut.exe
  C:\Windows\System\txWpuut.exe
  2⤵
  PID:9720
- C:\Windows\System\SBUJtGq.exe
  C:\Windows\System\SBUJtGq.exe
  2⤵
  PID:9748
- C:\Windows\System\RtVdkKo.exe
  C:\Windows\System\RtVdkKo.exe
  2⤵
  PID:9776
- C:\Windows\System\qIitdSz.exe
  C:\Windows\System\qIitdSz.exe
  2⤵
  PID:9808
- C:\Windows\System\YyLJsPj.exe
  C:\Windows\System\YyLJsPj.exe
  2⤵
  PID:9836
- C:\Windows\System\VeufxPV.exe
  C:\Windows\System\VeufxPV.exe
  2⤵
  PID:9868
- C:\Windows\System\tocVlIZ.exe
  C:\Windows\System\tocVlIZ.exe
  2⤵
  PID:9892
- C:\Windows\System\kGLklsE.exe
  C:\Windows\System\kGLklsE.exe
  2⤵
  PID:9924
- C:\Windows\System\BzjKSzm.exe
  C:\Windows\System\BzjKSzm.exe
  2⤵
  PID:9952
- C:\Windows\System\MViIpJP.exe
  C:\Windows\System\MViIpJP.exe
  2⤵
  PID:9988
- C:\Windows\System\CGlXbjn.exe
  C:\Windows\System\CGlXbjn.exe
  2⤵
  PID:10008
- C:\Windows\System\CRvHVPt.exe
  C:\Windows\System\CRvHVPt.exe
  2⤵
  PID:10032
- C:\Windows\System\gIgHWgM.exe
  C:\Windows\System\gIgHWgM.exe
  2⤵
  PID:10064
- C:\Windows\System\FjlgeNZ.exe
  C:\Windows\System\FjlgeNZ.exe
  2⤵
  PID:10092
- C:\Windows\System\QftQNqs.exe
  C:\Windows\System\QftQNqs.exe
  2⤵
  PID:10116
- C:\Windows\System\AyLHXzr.exe
  C:\Windows\System\AyLHXzr.exe
  2⤵
  PID:10136
- C:\Windows\System\exIMzdm.exe
  C:\Windows\System\exIMzdm.exe
  2⤵
  PID:10172
- C:\Windows\System\xlMERos.exe
  C:\Windows\System\xlMERos.exe
  2⤵
  PID:10200
- C:\Windows\System\XTzBkgk.exe
  C:\Windows\System\XTzBkgk.exe
  2⤵
  PID:10232
- C:\Windows\System\hNxLUIQ.exe
  C:\Windows\System\hNxLUIQ.exe
  2⤵
  PID:8248
- C:\Windows\System\NDghkcB.exe
  C:\Windows\System\NDghkcB.exe
  2⤵
  PID:7340
- C:\Windows\System\OcTqVjE.exe
  C:\Windows\System\OcTqVjE.exe
  2⤵
  PID:9276
- C:\Windows\System\gUEpUAE.exe
  C:\Windows\System\gUEpUAE.exe
  2⤵
  PID:9396
- C:\Windows\System\iQfEEeH.exe
  C:\Windows\System\iQfEEeH.exe
  2⤵
  PID:9308
- C:\Windows\System\EAfZjdH.exe
  C:\Windows\System\EAfZjdH.exe
  2⤵
  PID:9496
- C:\Windows\System\fitNdcL.exe
  C:\Windows\System\fitNdcL.exe
  2⤵
  PID:9424
- C:\Windows\System\gjxWbhg.exe
  C:\Windows\System\gjxWbhg.exe
  2⤵
  PID:9624
- C:\Windows\System\gcCzVBN.exe
  C:\Windows\System\gcCzVBN.exe
  2⤵
  PID:9660
- C:\Windows\System\mUOFUVt.exe
  C:\Windows\System\mUOFUVt.exe
  2⤵
  PID:9736
- C:\Windows\System\VVNxCvx.exe
  C:\Windows\System\VVNxCvx.exe
  2⤵
  PID:9728
- C:\Windows\System\UifkzZn.exe
  C:\Windows\System\UifkzZn.exe
  2⤵
  PID:9824
- C:\Windows\System\BZZiVEj.exe
  C:\Windows\System\BZZiVEj.exe
  2⤵
  PID:9820
- C:\Windows\System\FSQSHxm.exe
  C:\Windows\System\FSQSHxm.exe
  2⤵
  PID:9948
- C:\Windows\System\DKXJGme.exe
  C:\Windows\System\DKXJGme.exe
  2⤵
  PID:10048
- C:\Windows\System\DWvcAoL.exe
  C:\Windows\System\DWvcAoL.exe
  2⤵
  PID:10156
- C:\Windows\System\JKSUrot.exe
  C:\Windows\System\JKSUrot.exe
  2⤵
  PID:10212
- C:\Windows\System\rWpxqfT.exe
  C:\Windows\System\rWpxqfT.exe
  2⤵
  PID:8536
- C:\Windows\System\xmPBfXn.exe
  C:\Windows\System\xmPBfXn.exe
  2⤵
  PID:8856
- C:\Windows\System\qFFVsfw.exe
  C:\Windows\System\qFFVsfw.exe
  2⤵
  PID:9568
- C:\Windows\System\OwczkQf.exe
  C:\Windows\System\OwczkQf.exe
  2⤵
  PID:9324
- C:\Windows\System\ibAaTmS.exe
  C:\Windows\System\ibAaTmS.exe
  2⤵
  PID:9572
- C:\Windows\System\vNpRTtV.exe
  C:\Windows\System\vNpRTtV.exe
  2⤵
  PID:9796
- C:\Windows\System\pqEjqmL.exe
  C:\Windows\System\pqEjqmL.exe
  2⤵
  PID:10020
- C:\Windows\System\KQhnolH.exe
  C:\Windows\System\KQhnolH.exe
  2⤵
  PID:10004
- C:\Windows\System\lJPSiyK.exe
  C:\Windows\System\lJPSiyK.exe
  2⤵
  PID:9376
- C:\Windows\System\nYnkVsE.exe
  C:\Windows\System\nYnkVsE.exe
  2⤵
  PID:9520
- C:\Windows\System\akkmXai.exe
  C:\Windows\System\akkmXai.exe
  2⤵
  PID:9364
- C:\Windows\System\eaKdQxj.exe
  C:\Windows\System\eaKdQxj.exe
  2⤵
  PID:10264
- C:\Windows\System\YInXwCs.exe
  C:\Windows\System\YInXwCs.exe
  2⤵
  PID:10296
- C:\Windows\System\wjsqxKu.exe
  C:\Windows\System\wjsqxKu.exe
  2⤵
  PID:10312
- C:\Windows\System\zgqIDgG.exe
  C:\Windows\System\zgqIDgG.exe
  2⤵
  PID:10344
- C:\Windows\System\NssvoEY.exe
  C:\Windows\System\NssvoEY.exe
  2⤵
  PID:10372
- C:\Windows\System\YcDoIOZ.exe
  C:\Windows\System\YcDoIOZ.exe
  2⤵
  PID:10396
- C:\Windows\System\XHMXTvf.exe
  C:\Windows\System\XHMXTvf.exe
  2⤵
  PID:10432
- C:\Windows\System\NRPiVMJ.exe
  C:\Windows\System\NRPiVMJ.exe
  2⤵
  PID:10456
- C:\Windows\System\geYdBjT.exe
  C:\Windows\System\geYdBjT.exe
  2⤵
  PID:10484
- C:\Windows\System\HmFPopc.exe
  C:\Windows\System\HmFPopc.exe
  2⤵
  PID:10516
- C:\Windows\System\BCsJxel.exe
  C:\Windows\System\BCsJxel.exe
  2⤵
  PID:10548
- C:\Windows\System\fCHWYun.exe
  C:\Windows\System\fCHWYun.exe
  2⤵
  PID:10604
- C:\Windows\System\JLwrnkk.exe
  C:\Windows\System\JLwrnkk.exe
  2⤵
  PID:10632
- C:\Windows\System\vynHggG.exe
  C:\Windows\System\vynHggG.exe
  2⤵
  PID:10664
- C:\Windows\System\dDAOORJ.exe
  C:\Windows\System\dDAOORJ.exe
  2⤵
  PID:10688
- C:\Windows\System\qdGSLAP.exe
  C:\Windows\System\qdGSLAP.exe
  2⤵
  PID:10712
- C:\Windows\System\bvtHAVf.exe
  C:\Windows\System\bvtHAVf.exe
  2⤵
  PID:10740
- C:\Windows\System\htDxkMh.exe
  C:\Windows\System\htDxkMh.exe
  2⤵
  PID:10768
- C:\Windows\System\wVbzejb.exe
  C:\Windows\System\wVbzejb.exe
  2⤵
  PID:10800
- C:\Windows\System\RgnwvKH.exe
  C:\Windows\System\RgnwvKH.exe
  2⤵
  PID:10828
- C:\Windows\System\DozcYgG.exe
  C:\Windows\System\DozcYgG.exe
  2⤵
  PID:10852
- C:\Windows\System\UsoCrqv.exe
  C:\Windows\System\UsoCrqv.exe
  2⤵
  PID:10884
- C:\Windows\System\BUqdjjg.exe
  C:\Windows\System\BUqdjjg.exe
  2⤵
  PID:10916
- C:\Windows\System\UyGyNhr.exe
  C:\Windows\System\UyGyNhr.exe
  2⤵
  PID:10940
- C:\Windows\System\TpZevBg.exe
  C:\Windows\System\TpZevBg.exe
  2⤵
  PID:10964
- C:\Windows\System\hKdWDgT.exe
  C:\Windows\System\hKdWDgT.exe
  2⤵
  PID:10988
- C:\Windows\System\hkVVafN.exe
  C:\Windows\System\hkVVafN.exe
  2⤵
  PID:11024
- C:\Windows\System\sHtFWip.exe
  C:\Windows\System\sHtFWip.exe
  2⤵
  PID:11044
- C:\Windows\System\kemOcQS.exe
  C:\Windows\System\kemOcQS.exe
  2⤵
  PID:11080
- C:\Windows\System\OHFSECA.exe
  C:\Windows\System\OHFSECA.exe
  2⤵
  PID:11104
- C:\Windows\System\yNDznBL.exe
  C:\Windows\System\yNDznBL.exe
  2⤵
  PID:11128
- C:\Windows\System\TOCuLNp.exe
  C:\Windows\System\TOCuLNp.exe
  2⤵
  PID:11160
- C:\Windows\System\vcQUrUL.exe
  C:\Windows\System\vcQUrUL.exe
  2⤵
  PID:11180
- C:\Windows\System\cxZgoBW.exe
  C:\Windows\System\cxZgoBW.exe
  2⤵
  PID:11204
- C:\Windows\System\wxbtOQn.exe
  C:\Windows\System\wxbtOQn.exe
  2⤵
  PID:11228
- C:\Windows\System\YQHKUwx.exe
  C:\Windows\System\YQHKUwx.exe
  2⤵
  PID:11248
- C:\Windows\System\NdCOdBK.exe
  C:\Windows\System\NdCOdBK.exe
  2⤵
  PID:10000
- C:\Windows\System\rxPnQyc.exe
  C:\Windows\System\rxPnQyc.exe
  2⤵
  PID:10260
- C:\Windows\System\rCCfpon.exe
  C:\Windows\System\rCCfpon.exe
  2⤵
  PID:9604
- C:\Windows\System\pouLapC.exe
  C:\Windows\System\pouLapC.exe
  2⤵
  PID:10364
- C:\Windows\System\DFkDAbf.exe
  C:\Windows\System\DFkDAbf.exe
  2⤵
  PID:10416
- C:\Windows\System\OqZUaYY.exe
  C:\Windows\System\OqZUaYY.exe
  2⤵
  PID:10452
- C:\Windows\System\tBqLgpU.exe
  C:\Windows\System\tBqLgpU.exe
  2⤵
  PID:10448
- C:\Windows\System\YmMLUlR.exe
  C:\Windows\System\YmMLUlR.exe
  2⤵
  PID:10528
- C:\Windows\System\vrnUVCM.exe
  C:\Windows\System\vrnUVCM.exe
  2⤵
  PID:10612
- C:\Windows\System\EycXDRb.exe
  C:\Windows\System\EycXDRb.exe
  2⤵
  PID:10708
- C:\Windows\System\haTtCSz.exe
  C:\Windows\System\haTtCSz.exe
  2⤵
  PID:10808
- C:\Windows\System\qAkooVJ.exe
  C:\Windows\System\qAkooVJ.exe
  2⤵
  PID:10820
- C:\Windows\System\dUBYnsp.exe
  C:\Windows\System\dUBYnsp.exe
  2⤵
  PID:10956
- C:\Windows\System\EoLdlew.exe
  C:\Windows\System\EoLdlew.exe
  2⤵
  PID:11000
- C:\Windows\System\tvWICid.exe
  C:\Windows\System\tvWICid.exe
  2⤵
  PID:11068
- C:\Windows\System\zbfBjvc.exe
  C:\Windows\System\zbfBjvc.exe
  2⤵
  PID:11120
- C:\Windows\System\cbgJVvY.exe
  C:\Windows\System\cbgJVvY.exe
  2⤵
  PID:11100
- C:\Windows\System\AbdJKuP.exe
  C:\Windows\System\AbdJKuP.exe
  2⤵
  PID:9768
- C:\Windows\System\ZoCrPPw.exe
  C:\Windows\System\ZoCrPPw.exe
  2⤵
  PID:9524
- C:\Windows\System\HMlzDiN.exe
  C:\Windows\System\HMlzDiN.exe
  2⤵
  PID:11240
- C:\Windows\System\EYjvlPS.exe
  C:\Windows\System\EYjvlPS.exe
  2⤵
  PID:10424
- C:\Windows\System\MxWaexw.exe
  C:\Windows\System\MxWaexw.exe
  2⤵
  PID:10564
- C:\Windows\System\UnWhdLL.exe
  C:\Windows\System\UnWhdLL.exe
  2⤵
  PID:10976
- C:\Windows\System\oGpyTOF.exe
  C:\Windows\System\oGpyTOF.exe
  2⤵
  PID:11056
- C:\Windows\System\UQqEPsP.exe
  C:\Windows\System\UQqEPsP.exe
  2⤵
  PID:11140
- C:\Windows\System\YBsafOI.exe
  C:\Windows\System\YBsafOI.exe
  2⤵
  PID:10500
- C:\Windows\System\TUeVjHx.exe
  C:\Windows\System\TUeVjHx.exe
  2⤵
  PID:10760
- C:\Windows\System\tezHOQr.exe
  C:\Windows\System\tezHOQr.exe
  2⤵
  PID:11284
- C:\Windows\System\OzWFlyD.exe
  C:\Windows\System\OzWFlyD.exe
  2⤵
  PID:11312
- C:\Windows\System\ueiFCCv.exe
  C:\Windows\System\ueiFCCv.exe
  2⤵
  PID:11344
- C:\Windows\System\qvZBukf.exe
  C:\Windows\System\qvZBukf.exe
  2⤵
  PID:11364
- C:\Windows\System\rDznfrC.exe
  C:\Windows\System\rDznfrC.exe
  2⤵
  PID:11404
- C:\Windows\System\todPkVv.exe
  C:\Windows\System\todPkVv.exe
  2⤵
  PID:11428
- C:\Windows\System\WltGpAA.exe
  C:\Windows\System\WltGpAA.exe
  2⤵
  PID:11452
- C:\Windows\System\SULAVNz.exe
  C:\Windows\System\SULAVNz.exe
  2⤵
  PID:11476
- C:\Windows\System\RqdDajF.exe
  C:\Windows\System\RqdDajF.exe
  2⤵
  PID:11504
- C:\Windows\System\bcDacdW.exe
  C:\Windows\System\bcDacdW.exe
  2⤵
  PID:11528
- C:\Windows\System\mbOctFB.exe
  C:\Windows\System\mbOctFB.exe
  2⤵
  PID:11564
- C:\Windows\System\TVHKpbG.exe
  C:\Windows\System\TVHKpbG.exe
  2⤵
  PID:11592
- C:\Windows\System\AeKEknJ.exe
  C:\Windows\System\AeKEknJ.exe
  2⤵
  PID:11628
- C:\Windows\System\AojLzEC.exe
  C:\Windows\System\AojLzEC.exe
  2⤵
  PID:11664
- C:\Windows\System\ThNnxKF.exe
  C:\Windows\System\ThNnxKF.exe
  2⤵
  PID:11696
- C:\Windows\System\wTrMfyX.exe
  C:\Windows\System\wTrMfyX.exe
  2⤵
  PID:11720
- C:\Windows\System\FaOyWUN.exe
  C:\Windows\System\FaOyWUN.exe
  2⤵
  PID:11752
- C:\Windows\System\kkfYbpy.exe
  C:\Windows\System\kkfYbpy.exe
  2⤵
  PID:11784
- C:\Windows\System\LVUmSsa.exe
  C:\Windows\System\LVUmSsa.exe
  2⤵
  PID:11816
- C:\Windows\System\EwqIeFs.exe
  C:\Windows\System\EwqIeFs.exe
  2⤵
  PID:11852
- C:\Windows\System\kHAzirb.exe
  C:\Windows\System\kHAzirb.exe
  2⤵
  PID:11876
- C:\Windows\System\rRURclf.exe
  C:\Windows\System\rRURclf.exe
  2⤵
  PID:11908
- C:\Windows\System\mYWCEdT.exe
  C:\Windows\System\mYWCEdT.exe
  2⤵
  PID:11932
- C:\Windows\System\nSZUFNC.exe
  C:\Windows\System\nSZUFNC.exe
  2⤵
  PID:11956
- C:\Windows\System\cnSyviN.exe
  C:\Windows\System\cnSyviN.exe
  2⤵
  PID:11980
- C:\Windows\System\LWVSbWI.exe
  C:\Windows\System\LWVSbWI.exe
  2⤵
  PID:12008
- C:\Windows\System\kUDTAgR.exe
  C:\Windows\System\kUDTAgR.exe
  2⤵
  PID:12040
- C:\Windows\System\yFBkNgG.exe
  C:\Windows\System\yFBkNgG.exe
  2⤵
  PID:12072
- C:\Windows\System\pbCFGGg.exe
  C:\Windows\System\pbCFGGg.exe
  2⤵
  PID:12104
- C:\Windows\System\tUJhLCU.exe
  C:\Windows\System\tUJhLCU.exe
  2⤵
  PID:12136
- C:\Windows\System\Uwrjswz.exe
  C:\Windows\System\Uwrjswz.exe
  2⤵
  PID:12164
- C:\Windows\System\meZLpvS.exe
  C:\Windows\System\meZLpvS.exe
  2⤵
  PID:12180
- C:\Windows\System\mXcmfUW.exe
  C:\Windows\System\mXcmfUW.exe
  2⤵
  PID:12208
- C:\Windows\System\onHYhxf.exe
  C:\Windows\System\onHYhxf.exe
  2⤵
  PID:12228
- C:\Windows\System\tlqqdAb.exe
  C:\Windows\System\tlqqdAb.exe
  2⤵
  PID:12260
- C:\Windows\System\wnkKnca.exe
  C:\Windows\System\wnkKnca.exe
  2⤵
  PID:10984
- C:\Windows\System\cFiHUPD.exe
  C:\Windows\System\cFiHUPD.exe
  2⤵
  PID:11220
- C:\Windows\System\OoGifji.exe
  C:\Windows\System\OoGifji.exe
  2⤵
  PID:10472
- C:\Windows\System\WhIgjsi.exe
  C:\Windows\System\WhIgjsi.exe
  2⤵
  PID:11296
- C:\Windows\System\PDItFEz.exe
  C:\Windows\System\PDItFEz.exe
  2⤵
  PID:11336
- C:\Windows\System\PCRVyGg.exe
  C:\Windows\System\PCRVyGg.exe
  2⤵
  PID:11444
- C:\Windows\System\JHIqCbf.exe
  C:\Windows\System\JHIqCbf.exe
  2⤵
  PID:11440
- C:\Windows\System\XDKBNyl.exe
  C:\Windows\System\XDKBNyl.exe
  2⤵
  PID:11524
- C:\Windows\System\vSkbhlI.exe
  C:\Windows\System\vSkbhlI.exe
  2⤵
  PID:11620
- C:\Windows\System\LFHKCPE.exe
  C:\Windows\System\LFHKCPE.exe
  2⤵
  PID:11604
- C:\Windows\System\oTwuKpR.exe
  C:\Windows\System\oTwuKpR.exe
  2⤵
  PID:11768
- C:\Windows\System\WbnlEJh.exe
  C:\Windows\System\WbnlEJh.exe
  2⤵
  PID:11740
- C:\Windows\System\XgNFAef.exe
  C:\Windows\System\XgNFAef.exe
  2⤵
  PID:11808
- C:\Windows\System\AXHnklT.exe
  C:\Windows\System\AXHnklT.exe
  2⤵
  PID:11928
- C:\Windows\System\jMqhroU.exe
  C:\Windows\System\jMqhroU.exe
  2⤵
  PID:11948
- C:\Windows\System\WvaoERY.exe
  C:\Windows\System\WvaoERY.exe
  2⤵
  PID:12132
- C:\Windows\System\aXXHJWE.exe
  C:\Windows\System\aXXHJWE.exe
  2⤵
  PID:12172
- C:\Windows\System\JQyXmbQ.exe
  C:\Windows\System\JQyXmbQ.exe
  2⤵
  PID:12204
- C:\Windows\System\RLpKDxB.exe
  C:\Windows\System\RLpKDxB.exe
  2⤵
  PID:12220
- C:\Windows\System\CKGlNpz.exe
  C:\Windows\System\CKGlNpz.exe
  2⤵
  PID:12272
- C:\Windows\System\ZflGgam.exe
  C:\Windows\System\ZflGgam.exe
  2⤵
  PID:11352
- C:\Windows\System\tmxNYFQ.exe
  C:\Windows\System\tmxNYFQ.exe
  2⤵
  PID:11552
- C:\Windows\System\eeUZUCI.exe
  C:\Windows\System\eeUZUCI.exe
  2⤵
  PID:11864
- C:\Windows\System\cTwoGij.exe
  C:\Windows\System\cTwoGij.exe
  2⤵
  PID:11896
- C:\Windows\System\VWmcCAY.exe
  C:\Windows\System\VWmcCAY.exe
  2⤵
  PID:11900
- C:\Windows\System\PrEGlUZ.exe
  C:\Windows\System\PrEGlUZ.exe
  2⤵
  PID:12176
- C:\Windows\System\szTeauQ.exe
  C:\Windows\System\szTeauQ.exe
  2⤵
  PID:12004
- C:\Windows\System\NXXFraB.exe
  C:\Windows\System\NXXFraB.exe
  2⤵
  PID:11420
- C:\Windows\System\SwSEpRL.exe
  C:\Windows\System\SwSEpRL.exe
  2⤵
  PID:12304
- C:\Windows\System\tCcXPXs.exe
  C:\Windows\System\tCcXPXs.exe
  2⤵
  PID:12332
- C:\Windows\System\vCDJtny.exe
  C:\Windows\System\vCDJtny.exe
  2⤵
  PID:12360
- C:\Windows\System\yophHMz.exe
  C:\Windows\System\yophHMz.exe
  2⤵
  PID:12384
- C:\Windows\System\TGvoJqL.exe
  C:\Windows\System\TGvoJqL.exe
  2⤵
  PID:12416
- C:\Windows\System\aeovoow.exe
  C:\Windows\System\aeovoow.exe
  2⤵
  PID:12444
- C:\Windows\System\cndDAVM.exe
  C:\Windows\System\cndDAVM.exe
  2⤵
  PID:12468
- C:\Windows\System\FAZiiaz.exe
  C:\Windows\System\FAZiiaz.exe
  2⤵
  PID:12488
- C:\Windows\System\rqJvUtQ.exe
  C:\Windows\System\rqJvUtQ.exe
  2⤵
  PID:12516
- C:\Windows\System\dBNaeGs.exe
  C:\Windows\System\dBNaeGs.exe
  2⤵
  PID:12540
- C:\Windows\System\gPjLGUg.exe
  C:\Windows\System\gPjLGUg.exe
  2⤵
  PID:12560
- C:\Windows\System\sxfxvTc.exe
  C:\Windows\System\sxfxvTc.exe
  2⤵
  PID:12592
- C:\Windows\System\RxZOQMO.exe
  C:\Windows\System\RxZOQMO.exe
  2⤵
  PID:12620
- C:\Windows\System\sFNjguI.exe
  C:\Windows\System\sFNjguI.exe
  2⤵
  PID:12644
- C:\Windows\System\BKxPEyZ.exe
  C:\Windows\System\BKxPEyZ.exe
  2⤵
  PID:12680
- C:\Windows\System\oneOKYt.exe
  C:\Windows\System\oneOKYt.exe
  2⤵
  PID:12708
- C:\Windows\System\GWzfpKR.exe
  C:\Windows\System\GWzfpKR.exe
  2⤵
  PID:12736
- C:\Windows\System\cwQtjQr.exe
  C:\Windows\System\cwQtjQr.exe
  2⤵
  PID:12764
- C:\Windows\System\SUvlYRs.exe
  C:\Windows\System\SUvlYRs.exe
  2⤵
  PID:12784
- C:\Windows\System\AJZwuWk.exe
  C:\Windows\System\AJZwuWk.exe
  2⤵
  PID:12816
- C:\Windows\System\IcMcUHh.exe
  C:\Windows\System\IcMcUHh.exe
  2⤵
  PID:12848
- C:\Windows\System\eKdvSfN.exe
  C:\Windows\System\eKdvSfN.exe
  2⤵
  PID:12876
- C:\Windows\System\apxLlwl.exe
  C:\Windows\System\apxLlwl.exe
  2⤵
  PID:12904
- C:\Windows\System\ItGVlFa.exe
  C:\Windows\System\ItGVlFa.exe
  2⤵
  PID:12932
- C:\Windows\System\TFIrocd.exe
  C:\Windows\System\TFIrocd.exe
  2⤵
  PID:12952
- C:\Windows\System\QNbUjfz.exe
  C:\Windows\System\QNbUjfz.exe
  2⤵
  PID:12976
- C:\Windows\System\ApvCpvg.exe
  C:\Windows\System\ApvCpvg.exe
  2⤵
  PID:13012
- C:\Windows\System\CjxGauV.exe
  C:\Windows\System\CjxGauV.exe
  2⤵
  PID:13040
- C:\Windows\System\IwLHnin.exe
  C:\Windows\System\IwLHnin.exe
  2⤵
  PID:13068
- C:\Windows\System\VQlFCxh.exe
  C:\Windows\System\VQlFCxh.exe
  2⤵
  PID:13100
- C:\Windows\System\ZZjKbrw.exe
  C:\Windows\System\ZZjKbrw.exe
  2⤵
  PID:13132
- C:\Windows\System\HviQAWG.exe
  C:\Windows\System\HviQAWG.exe
  2⤵
  PID:13160
- C:\Windows\System\AQOMYUo.exe
  C:\Windows\System\AQOMYUo.exe
  2⤵
  PID:13196
- C:\Windows\System\qCsOWnC.exe
  C:\Windows\System\qCsOWnC.exe
  2⤵
  PID:13216
- C:\Windows\System\YtjXrKS.exe
  C:\Windows\System\YtjXrKS.exe
  2⤵
  PID:13248
- C:\Windows\System\lavkYZi.exe
  C:\Windows\System\lavkYZi.exe
  2⤵
  PID:13288
- C:\Windows\System\AmfKZko.exe
  C:\Windows\System\AmfKZko.exe
  2⤵
  PID:12064
- C:\Windows\System\GSxaNLk.exe
  C:\Windows\System\GSxaNLk.exe
  2⤵
  PID:11372
- C:\Windows\System\LMWHCjY.exe
  C:\Windows\System\LMWHCjY.exe
  2⤵
  PID:12316
- C:\Windows\System\FDfQpqV.exe
  C:\Windows\System\FDfQpqV.exe
  2⤵
  PID:11868
- C:\Windows\System\xRGxqJG.exe
  C:\Windows\System\xRGxqJG.exe
  2⤵
  PID:12380
- C:\Windows\System\mvKlOPC.exe
  C:\Windows\System\mvKlOPC.exe
  2⤵
  PID:12412
- C:\Windows\System\UYhknoj.exe
  C:\Windows\System\UYhknoj.exe
  2⤵
  PID:12608
- C:\Windows\System\ipyrZll.exe
  C:\Windows\System\ipyrZll.exe
  2⤵
  PID:12668
- C:\Windows\System\SRdixew.exe
  C:\Windows\System\SRdixew.exe
  2⤵
  PID:12532
- C:\Windows\System\oNyFNEB.exe
  C:\Windows\System\oNyFNEB.exe
  2⤵
  PID:12672
- C:\Windows\System\heAlXPX.exe
  C:\Windows\System\heAlXPX.exe
  2⤵
  PID:12776
- C:\Windows\System\pucpUxW.exe
  C:\Windows\System\pucpUxW.exe
  2⤵
  PID:12832
- C:\Windows\System\EGtbeVt.exe
  C:\Windows\System\EGtbeVt.exe
  2⤵
  PID:12860
- C:\Windows\System\fZzCGlM.exe
  C:\Windows\System\fZzCGlM.exe
  2⤵
  PID:13028
- C:\Windows\System\lvRZOUa.exe
  C:\Windows\System\lvRZOUa.exe
  2⤵
  PID:13080
- C:\Windows\System\OpQhjXW.exe
  C:\Windows\System\OpQhjXW.exe
  2⤵
  PID:12968
- C:\Windows\System\RoJYmCW.exe
  C:\Windows\System\RoJYmCW.exe
  2⤵
  PID:13128
- C:\Windows\System\qBNyqqs.exe
  C:\Windows\System\qBNyqqs.exe
  2⤵
  PID:13228
- C:\Windows\System\RAdduJs.exe
  C:\Windows\System\RAdduJs.exe
  2⤵
  PID:13208
- C:\Windows\System\YPhgjMS.exe
  C:\Windows\System\YPhgjMS.exe
  2⤵
  PID:12252
- C:\Windows\System\jtMvJTG.exe
  C:\Windows\System\jtMvJTG.exe
  2⤵
  PID:11776
- C:\Windows\System\oVYpwgo.exe
  C:\Windows\System\oVYpwgo.exe
  2⤵
  PID:12428
- C:\Windows\System\BWmLyxq.exe
  C:\Windows\System\BWmLyxq.exe
  2⤵
  PID:12528
- C:\Windows\System\fWxACkA.exe
  C:\Windows\System\fWxACkA.exe
  2⤵
  PID:12600
- C:\Windows\System\vUWGyaZ.exe
  C:\Windows\System\vUWGyaZ.exe
  2⤵
  PID:12808
- C:\Windows\System\knITgkX.exe
  C:\Windows\System\knITgkX.exe
  2⤵
  PID:13184
- C:\Windows\System\PefSKGf.exe
  C:\Windows\System\PefSKGf.exe
  2⤵
  PID:12476
- C:\Windows\System\qcUsOmO.exe
  C:\Windows\System\qcUsOmO.exe
  2⤵
  PID:13260
- C:\Windows\System\UAVYssQ.exe
  C:\Windows\System\UAVYssQ.exe
  2⤵
  PID:12504
- C:\Windows\System\ekDufKA.exe
  C:\Windows\System\ekDufKA.exe
  2⤵
  PID:13348
- C:\Windows\System\ETjcXgV.exe
  C:\Windows\System\ETjcXgV.exe
  2⤵
  PID:13380
- C:\Windows\System\FOjyKzF.exe
  C:\Windows\System\FOjyKzF.exe
  2⤵
  PID:13400
- C:\Windows\System\iDGtnET.exe
  C:\Windows\System\iDGtnET.exe
  2⤵
  PID:13424
- C:\Windows\System\XVtdhQz.exe
  C:\Windows\System\XVtdhQz.exe
  2⤵
  PID:13464
- C:\Windows\System\mjgNtya.exe
  C:\Windows\System\mjgNtya.exe
  2⤵
  PID:13496
- C:\Windows\System\wOuiBNl.exe
  C:\Windows\System\wOuiBNl.exe
  2⤵
  PID:13520
- C:\Windows\System\CPaDrsr.exe
  C:\Windows\System\CPaDrsr.exe
  2⤵
  PID:13552
- C:\Windows\System\SSXwVKU.exe
  C:\Windows\System\SSXwVKU.exe
  2⤵
  PID:13580
- C:\Windows\System\BVJqWnR.exe
  C:\Windows\System\BVJqWnR.exe
  2⤵
  PID:13612
- C:\Windows\System\BbznZng.exe
  C:\Windows\System\BbznZng.exe
  2⤵
  PID:13644
- C:\Windows\System\VXERBhm.exe
  C:\Windows\System\VXERBhm.exe
  2⤵
  PID:13660
- C:\Windows\System\vxbURIV.exe
  C:\Windows\System\vxbURIV.exe
  2⤵
  PID:13684
- C:\Windows\System\VbshhnP.exe
  C:\Windows\System\VbshhnP.exe
  2⤵
  PID:13708
- C:\Windows\System\lHXkhjA.exe
  C:\Windows\System\lHXkhjA.exe
  2⤵
  PID:13732
- C:\Windows\System\CiBnjIq.exe
  C:\Windows\System\CiBnjIq.exe
  2⤵
  PID:13760
- C:\Windows\System\ntPPPoM.exe
  C:\Windows\System\ntPPPoM.exe
  2⤵
  PID:13784
- C:\Windows\System\cppQUpa.exe
  C:\Windows\System\cppQUpa.exe
  2⤵
  PID:13812
- C:\Windows\System\UGxjtPB.exe
  C:\Windows\System\UGxjtPB.exe
  2⤵
  PID:13836
- C:\Windows\System\pmvTNOd.exe
  C:\Windows\System\pmvTNOd.exe
  2⤵
  PID:13864
- C:\Windows\System\GNahzhp.exe
  C:\Windows\System\GNahzhp.exe
  2⤵
  PID:13896
- C:\Windows\System\TGGKaJY.exe
  C:\Windows\System\TGGKaJY.exe
  2⤵
  PID:13912
- C:\Windows\System\mBUArAF.exe
  C:\Windows\System\mBUArAF.exe
  2⤵
  PID:13932
- C:\Windows\System\jkGATaB.exe
  C:\Windows\System\jkGATaB.exe
  2⤵
  PID:13968
- C:\Windows\System\FuWanos.exe
  C:\Windows\System\FuWanos.exe
  2⤵
  PID:13996
- C:\Windows\System\VeiNOQY.exe
  C:\Windows\System\VeiNOQY.exe
  2⤵
  PID:14024
- C:\Windows\System\imSlRWD.exe
  C:\Windows\System\imSlRWD.exe
  2⤵
  PID:14044
- C:\Windows\System\PRXFgEs.exe
  C:\Windows\System\PRXFgEs.exe
  2⤵
  PID:14064
- C:\Windows\System\nJBfzmo.exe
  C:\Windows\System\nJBfzmo.exe
  2⤵
  PID:14092
- C:\Windows\System\jeWQgSO.exe
  C:\Windows\System\jeWQgSO.exe
  2⤵
  PID:14120
- C:\Windows\System\SRvYxAN.exe
  C:\Windows\System\SRvYxAN.exe
  2⤵
  PID:14144
- C:\Windows\System\lqWyfWb.exe
  C:\Windows\System\lqWyfWb.exe
  2⤵
  PID:14180
- C:\Windows\System\bkuojuW.exe
  C:\Windows\System\bkuojuW.exe
  2⤵
  PID:14208
- C:\Windows\System\iWRqyzw.exe
  C:\Windows\System\iWRqyzw.exe
  2⤵
  PID:14240
- C:\Windows\System\zGLULEz.exe
  C:\Windows\System\zGLULEz.exe
  2⤵
  PID:14268
- C:\Windows\System\ZscxzEe.exe
  C:\Windows\System\ZscxzEe.exe
  2⤵
  PID:14296
- C:\Windows\System\PTjaHGq.exe
  C:\Windows\System\PTjaHGq.exe
  2⤵
  PID:14332
- C:\Windows\System\dQxyJOT.exe
  C:\Windows\System\dQxyJOT.exe
  2⤵
  PID:12972
- C:\Windows\System\sQzLlRL.exe
  C:\Windows\System\sQzLlRL.exe
  2⤵
  PID:12572
- C:\Windows\System\OGjBkRG.exe
  C:\Windows\System\OGjBkRG.exe
  2⤵
  PID:12732
- C:\Windows\System\BhAlAhf.exe
  C:\Windows\System\BhAlAhf.exe
  2⤵
  PID:13324
- C:\Windows\System\vaPZPdy.exe
  C:\Windows\System\vaPZPdy.exe
  2⤵
  PID:13396
- C:\Windows\System\oDeimiO.exe
  C:\Windows\System\oDeimiO.exe
  2⤵
  PID:13456
- C:\Windows\System\KPbRMzM.exe
  C:\Windows\System\KPbRMzM.exe
  2⤵
  PID:13596
- C:\Windows\System\QBsqsib.exe
  C:\Windows\System\QBsqsib.exe
  2⤵
  PID:13652
- C:\Windows\System\kRwCQmD.exe
  C:\Windows\System\kRwCQmD.exe
  2⤵
  PID:13572
- C:\Windows\System\cvrpaFm.exe
  C:\Windows\System\cvrpaFm.exe
  2⤵
  PID:13716
- C:\Windows\System\jIGRwGE.exe
  C:\Windows\System\jIGRwGE.exe
  2⤵
  PID:13872
- C:\Windows\System\DVlrHJh.exe
  C:\Windows\System\DVlrHJh.exe
  2⤵
  PID:13752
- C:\Windows\System\DTGsrlP.exe
  C:\Windows\System\DTGsrlP.exe
  2⤵
  PID:14052
- C:\Windows\System\VkePHex.exe
  C:\Windows\System\VkePHex.exe
  2⤵
  PID:14088
- C:\Windows\System\cvRpius.exe
  C:\Windows\System\cvRpius.exe
  2⤵
  PID:13992
- C:\Windows\System\yuTiPXn.exe
  C:\Windows\System\yuTiPXn.exe
  2⤵
  PID:13904
- C:\Windows\System\MRagunp.exe
  C:\Windows\System\MRagunp.exe
  2⤵
  PID:14260
- C:\Windows\System\nimhTQZ.exe
  C:\Windows\System\nimhTQZ.exe
  2⤵
  PID:14200
- C:\Windows\System\HwWkDGH.exe
  C:\Windows\System\HwWkDGH.exe
  2⤵
  PID:14232
- C:\Windows\System\PXYpnUz.exe
  C:\Windows\System\PXYpnUz.exe
  2⤵
  PID:14292
- C:\Windows\System\ooKPqgj.exe
  C:\Windows\System\ooKPqgj.exe
  2⤵
  PID:12812
- C:\Windows\System\cZiYbNz.exe
  C:\Windows\System\cZiYbNz.exe
  2⤵
  PID:13024
- C:\Windows\System\SMpcswN.exe
  C:\Windows\System\SMpcswN.exe
  2⤵
  PID:13440
- C:\Windows\System\HYPFPeT.exe
  C:\Windows\System\HYPFPeT.exe
  2⤵
  PID:14140
- C:\Windows\System\Jujunos.exe
  C:\Windows\System\Jujunos.exe
  2⤵
  PID:13780
- C:\Windows\System\gqyJLKb.exe
  C:\Windows\System\gqyJLKb.exe
  2⤵
  PID:13700
- C:\Windows\System\oQDRcix.exe
  C:\Windows\System\oQDRcix.exe
  2⤵
  PID:14288
- C:\Windows\System\vhsYOas.exe
  C:\Windows\System\vhsYOas.exe
  2⤵
  PID:14352
- C:\Windows\System\maHJIyI.exe
  C:\Windows\System\maHJIyI.exe
  2⤵
  PID:14368
- C:\Windows\System\XNdsVBM.exe
  C:\Windows\System\XNdsVBM.exe
  2⤵
  PID:14392
- C:\Windows\System\lCgGYbX.exe
  C:\Windows\System\lCgGYbX.exe
  2⤵
  PID:14428
- C:\Windows\System\kghLnBg.exe
  C:\Windows\System\kghLnBg.exe
  2⤵
  PID:14460
- C:\Windows\System\SmLQnau.exe
  C:\Windows\System\SmLQnau.exe
  2⤵
  PID:14492
- C:\Windows\System\ERtwurH.exe
  C:\Windows\System\ERtwurH.exe
  2⤵
  PID:14520
- C:\Windows\System\wdbvnAQ.exe
  C:\Windows\System\wdbvnAQ.exe
  2⤵
  PID:14544
- C:\Windows\System\TmGtOZD.exe
  C:\Windows\System\TmGtOZD.exe
  2⤵
  PID:14564
- C:\Windows\System\uUgcSOz.exe
  C:\Windows\System\uUgcSOz.exe
  2⤵
  PID:14596
- C:\Windows\System\wAfDUKu.exe
  C:\Windows\System\wAfDUKu.exe
  2⤵
  PID:14620
- C:\Windows\System\NsJTxSJ.exe
  C:\Windows\System\NsJTxSJ.exe
  2⤵
  PID:14648
- C:\Windows\System\UpVhGTo.exe
  C:\Windows\System\UpVhGTo.exe
  2⤵
  PID:14684
- C:\Windows\System\bFqkjJq.exe
  C:\Windows\System\bFqkjJq.exe
  2⤵
  PID:14712
- C:\Windows\System\TRjxrtG.exe
  C:\Windows\System\TRjxrtG.exe
  2⤵
  PID:14740
- C:\Windows\System\hyQpOMk.exe
  C:\Windows\System\hyQpOMk.exe
  2⤵
  PID:14768
- C:\Windows\System\wUwkFQp.exe
  C:\Windows\System\wUwkFQp.exe
  2⤵
  PID:14788
- C:\Windows\System\bNIbzWr.exe
  C:\Windows\System\bNIbzWr.exe
  2⤵
  PID:14824
- C:\Windows\System\aSgoOhW.exe
  C:\Windows\System\aSgoOhW.exe
  2⤵
  PID:14864
- C:\Windows\System\qLcKgUE.exe
  C:\Windows\System\qLcKgUE.exe
  2⤵
  PID:14888
- C:\Windows\System\tkuwQtW.exe
  C:\Windows\System\tkuwQtW.exe
  2⤵
  PID:14916
- C:\Windows\System\jvSvMMu.exe
  C:\Windows\System\jvSvMMu.exe
  2⤵
  PID:14952
- C:\Windows\System\xbvVZck.exe
  C:\Windows\System\xbvVZck.exe
  2⤵
  PID:14976
- C:\Windows\System\AGELEjr.exe
  C:\Windows\System\AGELEjr.exe
  2⤵
  PID:15000
- C:\Windows\System\mtnExap.exe
  C:\Windows\System\mtnExap.exe
  2⤵
  PID:15044
- C:\Windows\System\vZPYCFX.exe
  C:\Windows\System\vZPYCFX.exe
  2⤵
  PID:15064
- C:\Windows\System\tQPOMAb.exe
  C:\Windows\System\tQPOMAb.exe
  2⤵
  PID:15096
- C:\Windows\System\KssaYGI.exe
  C:\Windows\System\KssaYGI.exe
  2⤵
  PID:15136
- C:\Windows\System\cBHRwFU.exe
  C:\Windows\System\cBHRwFU.exe
  2⤵
  PID:15156
- C:\Windows\System\MMbbVzt.exe
  C:\Windows\System\MMbbVzt.exe
  2⤵
  PID:15192
- C:\Windows\System\qMSzCTM.exe
  C:\Windows\System\qMSzCTM.exe
  2⤵
  PID:15220
- C:\Windows\System\wUnCfLv.exe
  C:\Windows\System\wUnCfLv.exe
  2⤵
  PID:15252
- C:\Windows\System\wDpejxe.exe
  C:\Windows\System\wDpejxe.exe
  2⤵
  PID:15268
- C:\Windows\System\EUFTlYX.exe
  C:\Windows\System\EUFTlYX.exe
  2⤵
  PID:15300
- C:\Windows\System\gLOgiRt.exe
  C:\Windows\System\gLOgiRt.exe
  2⤵
  PID:15332
- C:\Windows\System\SNynLQD.exe
  C:\Windows\System\SNynLQD.exe
  2⤵
  PID:14220
- C:\Windows\System\ScezNeu.exe
  C:\Windows\System\ScezNeu.exe
  2⤵
  PID:13516
- C:\Windows\System\rnEhxuk.exe
  C:\Windows\System\rnEhxuk.exe
  2⤵
  PID:14136
- C:\Windows\System\tqIxwjA.exe
  C:\Windows\System\tqIxwjA.exe
  2⤵
  PID:14344
- C:\Windows\System\KssGGyD.exe
  C:\Windows\System\KssGGyD.exe
  2⤵
  PID:14380
- C:\Windows\System\YdNkRSc.exe
  C:\Windows\System\YdNkRSc.exe
  2⤵
  PID:14276
- C:\Windows\System\bLbRKOB.exe
  C:\Windows\System\bLbRKOB.exe
  2⤵
  PID:14388
- C:\Windows\System\hICaXCF.exe
  C:\Windows\System\hICaXCF.exe
  2⤵
  PID:14676
- C:\Windows\System\ymCjlcL.exe
  C:\Windows\System\ymCjlcL.exe
  2⤵
  PID:14384
- C:\Windows\System\fxGkPLO.exe
  C:\Windows\System\fxGkPLO.exe
  2⤵
  PID:14784
- C:\Windows\System\JdQznYR.exe
  C:\Windows\System\JdQznYR.exe
  2⤵
  PID:14776
- C:\Windows\System\hGrsHaX.exe
  C:\Windows\System\hGrsHaX.exe
  2⤵
  PID:14664
- C:\Windows\System\eqmhTCN.exe
  C:\Windows\System\eqmhTCN.exe
  2⤵
  PID:15036
- C:\Windows\System\sXdQbJu.exe
  C:\Windows\System\sXdQbJu.exe
  2⤵
  PID:14852
- C:\Windows\System\rWQqHJl.exe
  C:\Windows\System\rWQqHJl.exe
  2⤵
  PID:14912
- C:\Windows\System\LKESckm.exe
  C:\Windows\System\LKESckm.exe
  2⤵
  PID:15032
- C:\Windows\System\ftTJFbl.exe
  C:\Windows\System\ftTJFbl.exe
  2⤵
  PID:15204
- C:\Windows\System\QLNnpLn.exe
  C:\Windows\System\QLNnpLn.exe
  2⤵
  PID:14984
- C:\Windows\System\hhyxyDH.exe
  C:\Windows\System\hhyxyDH.exe
  2⤵
  PID:15296
- C:\Windows\System\CHYmxgf.exe
  C:\Windows\System\CHYmxgf.exe
  2⤵
  PID:15208
- C:\Windows\System\ensLZXi.exe
  C:\Windows\System\ensLZXi.exe
  2⤵
  PID:15104
- C:\Windows\System\vfxnYrO.exe
  C:\Windows\System\vfxnYrO.exe
  2⤵
  PID:13984
- C:\Windows\System\odczCTc.exe
  C:\Windows\System\odczCTc.exe
  2⤵
  PID:14452
- C:\Windows\System\tcPBkcf.exe
  C:\Windows\System\tcPBkcf.exe
  2⤵
  PID:14724
- C:\Windows\System\WDhsoid.exe
  C:\Windows\System\WDhsoid.exe
  2⤵
  PID:14340
- C:\Windows\System\tVSQTGA.exe
  C:\Windows\System\tVSQTGA.exe
  2⤵
  PID:15056
- C:\Windows\System\tlfEZoG.exe
  C:\Windows\System\tlfEZoG.exe
  2⤵
  PID:13176
- C:\Windows\System\KvNaarz.exe
  C:\Windows\System\KvNaarz.exe
  2⤵
  PID:14992
- C:\Windows\System\boBfslJ.exe
  C:\Windows\System\boBfslJ.exe
  2⤵
  PID:14668
- C:\Windows\System\gTmCLdj.exe
  C:\Windows\System\gTmCLdj.exe
  2⤵
  PID:15388
- C:\Windows\System\QfmqUHu.exe
  C:\Windows\System\QfmqUHu.exe
  2⤵
  PID:15416
- C:\Windows\System\HMeUhmR.exe
  C:\Windows\System\HMeUhmR.exe
  2⤵
  PID:15436
- C:\Windows\System\BjHuHJz.exe
  C:\Windows\System\BjHuHJz.exe
  2⤵
  PID:15456
- C:\Windows\System\iTZnmVn.exe
  C:\Windows\System\iTZnmVn.exe
  2⤵
  PID:15484
- C:\Windows\System\xWisRbA.exe
  C:\Windows\System\xWisRbA.exe
  2⤵
  PID:15516
- C:\Windows\System\xnZeTWA.exe
  C:\Windows\System\xnZeTWA.exe
  2⤵
  PID:15544
- C:\Windows\System\VTENwHP.exe
  C:\Windows\System\VTENwHP.exe
  2⤵
  PID:15568
- C:\Windows\System\JHTmSFp.exe
  C:\Windows\System\JHTmSFp.exe
  2⤵
  PID:15592
- C:\Windows\System\NWdaLCP.exe
  C:\Windows\System\NWdaLCP.exe
  2⤵
  PID:15624
- C:\Windows\System\eiXXAra.exe
  C:\Windows\System\eiXXAra.exe
  2⤵
  PID:15652
- C:\Windows\System\xDfIDHE.exe
  C:\Windows\System\xDfIDHE.exe
  2⤵
  PID:15684
- C:\Windows\System\oljcEBh.exe
  C:\Windows\System\oljcEBh.exe
  2⤵
  PID:15712
- C:\Windows\System\UuPYaWe.exe
  C:\Windows\System\UuPYaWe.exe
  2⤵
  PID:15748
- C:\Windows\System\FBEejHg.exe
  C:\Windows\System\FBEejHg.exe
  2⤵
  PID:15772
- C:\Windows\System\mmavZmk.exe
  C:\Windows\System\mmavZmk.exe
  2⤵
  PID:15804
- C:\Windows\System\YVyUGdN.exe
  C:\Windows\System\YVyUGdN.exe
  2⤵
  PID:15836
- C:\Windows\System\ajlMomw.exe
  C:\Windows\System\ajlMomw.exe
  2⤵
  PID:15864
- C:\Windows\System\broBPyS.exe
  C:\Windows\System\broBPyS.exe
  2⤵
  PID:15888
- C:\Windows\System\wyevKqj.exe
  C:\Windows\System\wyevKqj.exe
  2⤵
  PID:15908
- C:\Windows\System\GvSQKDB.exe
  C:\Windows\System\GvSQKDB.exe
  2⤵
  PID:15936
- C:\Windows\System\WAFEWFF.exe
  C:\Windows\System\WAFEWFF.exe
  2⤵
  PID:15956
- C:\Windows\System\hAkRcQq.exe
  C:\Windows\System\hAkRcQq.exe
  2⤵
  PID:15984
- C:\Windows\System\FRWKQRf.exe
  C:\Windows\System\FRWKQRf.exe
  2⤵
  PID:16004
- C:\Windows\System\RCGExcZ.exe
  C:\Windows\System\RCGExcZ.exe
  2⤵
  PID:16032
- C:\Windows\System\JjBBRme.exe
  C:\Windows\System\JjBBRme.exe
  2⤵
  PID:16048
- C:\Windows\System\XXbcEYI.exe
  C:\Windows\System\XXbcEYI.exe
  2⤵
  PID:16068
- C:\Windows\System\WJTeqsY.exe
  C:\Windows\System\WJTeqsY.exe
  2⤵
  PID:16088
- C:\Windows\System\DKuNifG.exe
  C:\Windows\System\DKuNifG.exe
  2⤵
  PID:16120
- C:\Windows\System\IutAnSu.exe
  C:\Windows\System\IutAnSu.exe
  2⤵
  PID:16148
- C:\Windows\System\zmDxZhS.exe
  C:\Windows\System\zmDxZhS.exe
  2⤵
  PID:16180
- C:\Windows\System\TOrLEVq.exe
  C:\Windows\System\TOrLEVq.exe
  2⤵
  PID:16208
- C:\Windows\System\adKvyNF.exe
  C:\Windows\System\adKvyNF.exe
  2⤵
  PID:16232
- C:\Windows\System\TMCTaWJ.exe
  C:\Windows\System\TMCTaWJ.exe
  2⤵
  PID:16268
- C:\Windows\System\IYZKScx.exe
  C:\Windows\System\IYZKScx.exe
  2⤵
  PID:16300
- C:\Windows\System\tLONGBJ.exe
  C:\Windows\System\tLONGBJ.exe
  2⤵
  PID:16328
- C:\Windows\System\Upjpghn.exe
  C:\Windows\System\Upjpghn.exe
  2⤵
  PID:16356
- C:\Windows\System\LvvKidu.exe
  C:\Windows\System\LvvKidu.exe
  2⤵
  PID:15288
- C:\Windows\System\CTQeeSC.exe
  C:\Windows\System\CTQeeSC.exe
  2⤵
  PID:15216
- C:\Windows\System\oaZRpCe.exe
  C:\Windows\System\oaZRpCe.exe
  2⤵
  PID:15088
- C:\Windows\System\dgOqccc.exe
  C:\Windows\System\dgOqccc.exe
  2⤵
  PID:14444
- C:\Windows\System\Pyhgzsc.exe
  C:\Windows\System\Pyhgzsc.exe
  2⤵
  PID:14656
- C:\Windows\System\kumTpQh.exe
  C:\Windows\System\kumTpQh.exe
  2⤵
  PID:15432
- C:\Windows\System\XcMwdBK.exe
  C:\Windows\System\XcMwdBK.exe
  2⤵
  PID:15492
- C:\Windows\System\gZYLPNb.exe
  C:\Windows\System\gZYLPNb.exe
  2⤵
  PID:15564
- C:\Windows\System\mtXSKfc.exe
  C:\Windows\System\mtXSKfc.exe
  2⤵
  PID:15584
- C:\Windows\System\BnNSnqr.exe
  C:\Windows\System\BnNSnqr.exe
  2⤵
  PID:15636
- C:\Windows\System\SwCijzY.exe
  C:\Windows\System\SwCijzY.exe
  2⤵
  PID:15740
- C:\Windows\System\xjqIKWS.exe
  C:\Windows\System\xjqIKWS.exe
  2⤵
  PID:15884
- C:\Windows\System\urIHaeN.exe
  C:\Windows\System\urIHaeN.exe
  2⤵
  PID:15828
- C:\Windows\System\DtpyNHI.exe
  C:\Windows\System\DtpyNHI.exe
  2⤵
  PID:16132
- C:\Windows\System\AZewfXC.exe
  C:\Windows\System\AZewfXC.exe
  2⤵
  PID:16172
- C:\Windows\System\gcriDcF.exe
  C:\Windows\System\gcriDcF.exe
  2⤵
  PID:16204
- C:\Windows\System\FaRjylX.exe
  C:\Windows\System\FaRjylX.exe
  2⤵
  PID:16080
- C:\Windows\System\uGoCqLt.exe
  C:\Windows\System\uGoCqLt.exe
  2⤵
  PID:16312
- C:\Windows\System\kSerIXL.exe
  C:\Windows\System\kSerIXL.exe
  2⤵
  PID:14604
- C:\Windows\System\DhQJwLs.exe
  C:\Windows\System\DhQJwLs.exe
  2⤵
  PID:16376
- C:\Windows\System\hznWjGQ.exe
  C:\Windows\System\hznWjGQ.exe
  2⤵
  PID:16316
- C:\Windows\System\nrgcKut.exe
  C:\Windows\System\nrgcKut.exe
  2⤵
  PID:13544
- C:\Windows\System\KPywERJ.exe
  C:\Windows\System\KPywERJ.exe
  2⤵
  PID:15444
- C:\Windows\System\ueQIvgW.exe
  C:\Windows\System\ueQIvgW.exe
  2⤵
  PID:15760
- C:\Windows\System\UZKLneh.exe
  C:\Windows\System\UZKLneh.exe
  2⤵
  PID:15704
- C:\Windows\System\ZKSNxTD.exe
  C:\Windows\System\ZKSNxTD.exe
  2⤵
  PID:15976
- C:\Windows\System\kwbWNrq.exe
  C:\Windows\System\kwbWNrq.exe
  2⤵
  PID:16404
- C:\Windows\System\bEliLFe.exe
  C:\Windows\System\bEliLFe.exe
  2⤵
  PID:16432
- C:\Windows\System\XXCCatw.exe
  C:\Windows\System\XXCCatw.exe
  2⤵
  PID:16460
- C:\Windows\System\ivfslok.exe
  C:\Windows\System\ivfslok.exe
  2⤵
  PID:16476
- C:\Windows\System\dzDYVgp.exe
  C:\Windows\System\dzDYVgp.exe
  2⤵
  PID:16512
- C:\Windows\System\oCpHxHf.exe
  C:\Windows\System\oCpHxHf.exe
  2⤵
  PID:16536
- C:\Windows\System\WmdNETz.exe
  C:\Windows\System\WmdNETz.exe
  2⤵
  PID:16572
- C:\Windows\System\OLIPCRt.exe
  C:\Windows\System\OLIPCRt.exe
  2⤵
  PID:16596
- C:\Windows\System\BVdEpYH.exe
  C:\Windows\System\BVdEpYH.exe
  2⤵
  PID:16620
- C:\Windows\System\AXCxxkk.exe
  C:\Windows\System\AXCxxkk.exe
  2⤵
  PID:16644
- C:\Windows\System\DyojwdA.exe
  C:\Windows\System\DyojwdA.exe
  2⤵
  PID:16676
- C:\Windows\System\uwOtQVz.exe
  C:\Windows\System\uwOtQVz.exe
  2⤵
  PID:16704
- C:\Windows\System\zjbFgYn.exe
  C:\Windows\System\zjbFgYn.exe
  2⤵
  PID:16724
- C:\Windows\System\OtUPCdD.exe
  C:\Windows\System\OtUPCdD.exe
  2⤵
  PID:16760
- C:\Windows\System\nAwJpRc.exe
  C:\Windows\System\nAwJpRc.exe
  2⤵
  PID:16780
- C:\Windows\System\sXTBqyC.exe
  C:\Windows\System\sXTBqyC.exe
  2⤵
  PID:16812
- C:\Windows\System\mHjKxXW.exe
  C:\Windows\System\mHjKxXW.exe
  2⤵
  PID:16828
- C:\Windows\System\eYrfCFp.exe
  C:\Windows\System\eYrfCFp.exe
  2⤵
  PID:16856
- C:\Windows\System\PPLhAfF.exe
  C:\Windows\System\PPLhAfF.exe
  2⤵
  PID:16884
- C:\Windows\System\bUzwYJb.exe
  C:\Windows\System\bUzwYJb.exe
  2⤵
  PID:16908
- C:\Windows\System\ejGEbte.exe
  C:\Windows\System\ejGEbte.exe
  2⤵
  PID:16948
- C:\Windows\System\OCphUMe.exe
  C:\Windows\System\OCphUMe.exe
  2⤵
  PID:16968
- C:\Windows\System\TZdGFQh.exe
  C:\Windows\System\TZdGFQh.exe
  2⤵
  PID:16992
- C:\Windows\System\lCbVTvY.exe
  C:\Windows\System\lCbVTvY.exe
  2⤵
  PID:17012
- C:\Windows\System\EQoyKlp.exe
  C:\Windows\System\EQoyKlp.exe
  2⤵
  PID:17040
- C:\Windows\System\LdKLZpe.exe
  C:\Windows\System\LdKLZpe.exe
  2⤵
  PID:17068
- C:\Windows\System\MehCufY.exe
  C:\Windows\System\MehCufY.exe
  2⤵
  PID:17096
- C:\Windows\System\fPkPMGy.exe
  C:\Windows\System\fPkPMGy.exe
  2⤵
  PID:17120
- C:\Windows\System\oRtptFN.exe
  C:\Windows\System\oRtptFN.exe
  2⤵
  PID:17352
- C:\Windows\System\bXwVZUc.exe
  C:\Windows\System\bXwVZUc.exe
  2⤵
  PID:15476
- C:\Windows\System\BvdnGZg.exe
  C:\Windows\System\BvdnGZg.exe
  2⤵
  PID:16280
- C:\Windows\System\QowzWxB.exe
  C:\Windows\System\QowzWxB.exe
  2⤵
  PID:16400
- C:\Windows\System\NcRJFMP.exe
  C:\Windows\System\NcRJFMP.exe
  2⤵
  PID:16456

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BAsIbMy.exe

Filesize
1.4MB

MD5
feda9dbe5123fb1bddacf5db23537773

SHA1
516b48f12bbfa60c599a0d597acadf1702b86777

SHA256
ac362921598e6522c40cdbcc2f78a6db048885199c97e713cf7c24b820efe29c

SHA512
eac660db0d869c21b8d66e64816cfc01fe63e327a560c0add7e776b96a510a455b3b64b5d1ad9a6d7fdb85a41bb19fb977f6f54985d45a72d6d3c488ede84e1f

Download Submit
C:\Windows\System\DEytaFm.exe

Filesize
1.4MB

MD5
7f0da8469e7174d5f287a5fe92c71e1c

SHA1
69e30cc614154d03eaa8dc1613397e2e93d43475

SHA256
795d51e86a5cf83adc512f8025cd53ef0dd09fec74ec26e03c6cab161a89c36f

SHA512
6b4ff7d1784ea40ef23033d3e1c8ec6eba76775c08fb29e98beebbbf3c729128b07ca8df4c70df2a12a06e559a4d3038d36adbf067ca2c0877360fcd6159bded

Download Submit
C:\Windows\System\DfcRDlb.exe

Filesize
1.4MB

MD5
70cfdc425df2f6b1ea0f8f97edbfb6bb

SHA1
51e43ff134670225438e88b730838c52cd0105cd

SHA256
aca9b1c7feac10f27346af6ef79384c98b23dabbb3ec53637045e987e5a7f445

SHA512
4afe085ec71fa1a58380078a25d43b46c36a2d023d6412011f445fcef078ba3af91d4dd8dfbc779779d57e8b8a59b365e24a3baf380515f6e08eeaebe79ea37e

Download Submit
C:\Windows\System\FXcbJHn.exe

Filesize
1.4MB

MD5
03586cfb92aeb844b047cae340231d8d

SHA1
abdde246d315f1fdf5b2f61d59b9c7ccc723c9a3

SHA256
bb4c8510ffb7a8cbb0343698871143ce7f6719d3bbd6e2065c4c4f26592b6a94

SHA512
a675cd9a0323c52f042293918c1cd87b32df4e341a081f8fe948735b0d0df46d0485363fb40f55c28682fdef2faa26f1b8d3a963fcd2804a2b2d8e816f6401d2

Download Submit
C:\Windows\System\JSAtHzu.exe

Filesize
1.4MB

MD5
b944a1866d32508d8f3c54f3640dae53

SHA1
43708b28186665417a6ebb6c6a5c7afe697c05dc

SHA256
bd6e47c6c786fa912e3b57604767d1ebc1e394165f06812a4071bc90ded5b46a

SHA512
b6ce9eed1335d633b5addf88c8214a22b0d1c9ddc6a1132ac363a070a374a30d314e00aa609e94dd309a47d3619cc0acf166af9ede15091ec775a8b0476cb4a0

Download Submit
C:\Windows\System\KZrrmZq.exe

Filesize
1.4MB

MD5
7b7865cf91897137c72be6060b2da334

SHA1
bdbe6dc965c47731790a6f4311e26056814b4193

SHA256
cfcdd790bbd6d8afa2251febb8a7fbbca26757b94ecffc4572c371eb4b5bbe1e

SHA512
826cab77b0d1ecd9d6f40f1db74aa75fc401d3ddc02665eb9d11691e73ee6cee0b491b03a500c09e00dc405f8df6671377d93e61b7b1f89416d5d707354c5270

Download Submit
C:\Windows\System\MGIbHsK.exe

Filesize
1.4MB

MD5
4fa4dfd25954bc6884bbded560fd5795

SHA1
6f2fb454c526ae65f0c2055fae2a1b582b89a4a9

SHA256
db505e2a0ad75bec94059f167ba444ae31dfc8737bf92305f12b262965f6f5d1

SHA512
dfb2da7294f36c2b5cd04a9faf0df222ed632709f04fa844e05a1d4ff5350b5cdbe12246e4e01eb5ec1cc351e244ed337d90c6c3551e69ecdcbacb411eb9acd8

Download Submit
C:\Windows\System\MXQZVSp.exe

Filesize
1.4MB

MD5
7484dbb6d38ea9be6ed2942ffcaecc8e

SHA1
01cded35a18ce17af676cb180dd8cfbb52b0e3a4

SHA256
c88cfd5e7f40f4cb70cced9199dfb02b0fb524db1b9c3002d197f11f0a6468c8

SHA512
7d115b6f037fb82fae42117b25ce55e99b0918ed27551bd9afddb94d57a3443c5381fa1f3ef48b646f3a1df2b07d0ec88640b98ab43cf77c10698d4d6517ea5c

Download Submit
C:\Windows\System\MiphXEb.exe

Filesize
1.4MB

MD5
55384184a230c6ac9ee23c9d5c625028

SHA1
61c7f85492ef9b8e956e3f8cb728c4dc07d58c06

SHA256
15694a050702053fb1bbd22ac950976713a992b8e3b00a464fc7e609a5f04a4f

SHA512
147e112395ddc8a20af7442a555c82d884c4dd7128267a2002a32c188f9df72bdf8dee81f64e027938c05e4b47073c7cb2d08bf89463a0029d943b5989a8e688

Download Submit
C:\Windows\System\OaQfmWQ.exe

Filesize
1.4MB

MD5
fb5c52b96ec6d6d3827819755116b167

SHA1
25c3b1016edd635a92fddb359558259e3c55c244

SHA256
5773fdb204ab47d48bf975de9f0fc345caa3e8882a15486f2b612f4bc8ff6a21

SHA512
1fa955708443d83cc81cb6cfaff03bf4695ae68646b41fcfb27b53e6ecdf2d07c062adfe4b07ce3aa7fe315f3de85494552753e565279dab5ce7a5c457e90b21

Download Submit
C:\Windows\System\PsKwDcR.exe

Filesize
1.4MB

MD5
ae14f2fe1e15a97132a723d2f29e0dec

SHA1
fa6ff6140a38d6c41668e9085b75ea7c2d96bbe0

SHA256
43d501edad23e2fdf9bc23eb7bbc85f4511c3fddeb81eed195b50b7879f600da

SHA512
161ca494e51266bb4be9a385081c913b93b52f685a1adbddf73307fdb2e238423c0df2ea16319cd3cd3e04a84183eeff8502fa7980caf1286abb49a677014954

Download Submit
C:\Windows\System\RZZKpdT.exe

Filesize
1.4MB

MD5
e7e63560970419bfb7060e51b157db54

SHA1
3cf62a12e62e2f1c89b8835f6b489987e833c289

SHA256
2b588c8bf5c5bf245402d9126d50e5548d9dda0cd417815c04dc8a6ca7733ad0

SHA512
6149cbfc5e0c39a4174009ba9806e94e20e1ed24d35849592e47c2c80b8cf31605be0d6f328f984da5fda0902f3f9da7cfbb1646b598fc96ec461111a2650964

Download Submit
C:\Windows\System\ZjfVEiH.exe

Filesize
1.4MB

MD5
ae35d4ed73309a4ac2d46da4130ffda3

SHA1
5c1f7123716972d0292fb49e0aeded8700f1e888

SHA256
54012ad207699d39d51c56f7398027067721ab34406ba73542acf1c4b093eac8

SHA512
4b87b05e9018c07b31f13cbfe0f43b4684b882e1e51c874f4f503cb538253df57fb96c1a3ae82156bd59415be14dda03952fb2bc456ebcf85236323cbb888b4e

Download Submit
C:\Windows\System\aPsPNLE.exe

Filesize
1.4MB

MD5
c41b6994e82b5380c93744bfd86a9bbf

SHA1
0449199df9236230345b12a483d2fe6e0f78e1fc

SHA256
21c5f5c2ab30043e30326440f3b52ff7d0048c5cade08bc984eff9ea2007bd4e

SHA512
d1851d020a09e22ef252bea3a9af593cf36cc5a2f7d8fedfdbe894791d956f4cb527335e365c585fa288f940ce51794106804164a493c804c19099702705b7c7

Download Submit
C:\Windows\System\bvqavwn.exe

Filesize
1.4MB

MD5
19f7d439d944f4cacfc1bc414b58de28

SHA1
fb8e1dd01adecb5d6b13780cf7beb42fa68b3c74

SHA256
09abb477e669e8492e512f4f5985120ee7175f5e423b65339413d45d6873e06c

SHA512
614901e2096d0e1549c7d569988c98ebb7dff9b7180fad80ba7d800c3013c4632185af32557672bfd1926a043d692337572f7f0960f3127ff4191b5dff0e938b

Download Submit
C:\Windows\System\eBkZxoh.exe

Filesize
1.4MB

MD5
35f3275b27a180e4e0bd7f416eccc038

SHA1
ea904689368107ecc1f814c6721617bb484ceefe

SHA256
5d0fbb120572eac494b849bc940278b89d030ca40f8e81cf8e05cf64e624d0c7

SHA512
e1711e1af54d60606074c87eb9ee3b40402295eaf5626d0eb365bb1195a43f3d2d8153898883a19220f050ba73409deca8f357895b1006908f10950aa85ebc3b

Download Submit
C:\Windows\System\fxJMOJE.exe

Filesize
1.4MB

MD5
ceb25c2dc82f0e960d61bd472b0f9874

SHA1
8d1cee4f9d1a83b998853c7c44f7bd00d2f7187f

SHA256
50b784e129ecea7a5ff3c916507c2e088161249b5eaa3babcc9a3e2693ce70fe

SHA512
7f114dd13a6cc7b552e0232400dca97b0e11e2d106da8efc9cf4c6a647beb3f0e7f6dca38d2d51655da3840737d16ba8d63c7caac55c7858bb9871db22f5dea2

Download Submit
C:\Windows\System\iTGnKGh.exe

Filesize
1.4MB

MD5
f41933a4ee8a90f322af653c221f9943

SHA1
60690825196d189560670d1b5ee226099c59dfb9

SHA256
18f500dac21698ed5345e6d9c443b8938a2a3ca39f5eace2db5686a137cbf948

SHA512
26efabede68b4d3fa9101e85300a5042ab283ace41a712766817154f2ad20535f0be704ec8ba47d0a5167646c301ddd7da16dfd27406ce278f2953278a3302f0

Download Submit
C:\Windows\System\myPVvoU.exe

Filesize
1.4MB

MD5
37a373bfc6bbe1a4222ee0ea7d7dda49

SHA1
010b6778b6fbb590f58eba1f36724625a5459c6f

SHA256
447bca47f1a18f2be1bfee99c5cf052cfb90a52d7e17d9e310a4af0cb7a33cfe

SHA512
5e2f1d834d49eafb59cacd2b6c246030301e280b48875c79157b4f36fe172da6e28217f5db55fdc651cbe42cf4f4c5f9ac3a86cdff1c518e8cb7ecd38fdf0c4a

Download Submit
C:\Windows\System\omnWrwV.exe

Filesize
1.4MB

MD5
20777806f2fbed7748eb65b126dcdf83

SHA1
5ed6aecbade7fa459b2a72e5ec568f5e77631b15

SHA256
51524663960441af313dd447a40380596c9853cced7bd6cb49a5ee3269221cf8

SHA512
ab7947a01469b46dbbed4794484db3fdcd02958045429396ee21b890a37cc750e1b45f0249d87c28fa7d4972a37381e1913c39847ab316bbdf7ed526dfb308af

Download Submit
C:\Windows\System\osqaUXs.exe

Filesize
1.4MB

MD5
c1969d3eb7d608a5d370674fcadc6649

SHA1
920e3c15fd0da34dd11234a92001f5351b517a1d

SHA256
e4af298d5ed3422d2b501148fe4cfb49c723122d30877180f6ae5593c9f01271

SHA512
5955a8313f869c5267b2fd40380a0cb26a1e3358d4b20e9304cbc7950ad09e882db2c1bee4c40e7761398561e78a254e4c2d36de358315c40e50de4e1ba223cf

Download Submit
C:\Windows\System\slcIvsU.exe

Filesize
1.4MB

MD5
1180b03d561db6bf83a2750081cf1a88

SHA1
75b50a4a6e37bf2c5d05ae591ccc201d6672d277

SHA256
d8b9dd26e69b23248ecb3db1425058c626046cf5b4d6f6d528f2a70ece0abd68

SHA512
06109164e045334d42d99daa984345817f21c782bc7648db0d58999ac53451540158ae918fbcc6fd21a8626426a695e40d0472845d8c76e732addaa0209e5c7c

Download Submit
C:\Windows\System\srGtsRO.exe

Filesize
1.4MB

MD5
b86945fcb33f81ea190da1d7cee63327

SHA1
d9857ac67c81515b6eb30f6464ed7bb0f8bb3fac

SHA256
a8978b75097af05f43e2896a9a2d5d908bda14322763b1a6f50407b0ead8b49b

SHA512
59b0163546d5eb5cb9524153100956226ce61b8badebebc70f0f98ee9b3a4c3510c0cabf56f245f0afda547126bb4bbe0e7b97ed179fa856abde74172afc69f8

Download Submit
C:\Windows\System\tFedkoz.exe

Filesize
1.4MB

MD5
c96e4f83f3696ec3bb32badb69dbe435

SHA1
21c09bff7fb6dd90a1a8c18653fc53768eedefd0

SHA256
6f4ab7facb881e5aa77cd18da56e8653ecd52577e0677160262a9a3eb818fab9

SHA512
d0ea7052655665add57050a0f00644901e3648d1b2fc83ceb9ff0fd92854bb555215614480db442945374381f9f538d9112dc143d3efebbe2326eb499a018093

Download Submit
C:\Windows\System\ucwkIiT.exe

Filesize
1.4MB

MD5
f11eaf286499e733b108e25b70dfa4d2

SHA1
fd7e80074185a8481be3245182bea9cae7275e45

SHA256
d6053923433753484b2335b16fd934141de16f0b5937fb96d8221c1453f90b61

SHA512
06de944e0810fbd25c7c7dd1edf67302f4c513b518c9c54da71600ad695dee683fc4677f947649e7ac265209fc9fda92ddd48d0baca62e8b821329f88267adce

Download Submit
C:\Windows\System\uybPLga.exe

Filesize
1.4MB

MD5
0dcab301c31b450825033bc22abc98f1

SHA1
96fd6ee9b9b4e4d6ac2a33d8d9247a436ed0cbb8

SHA256
eded07e780f2df12015b713a527ff0ceea7adfada204096cc0ef12e2d9df35e9

SHA512
58d892c15115106a9e3427a65489576b14d2152f9dfc1b6d7299613277de3e1392c7b3b8545b0229ab5275e9a61f6afe9847e23ae3edee05c5c83d03ffa157ac

Download Submit
C:\Windows\System\vKcnrUA.exe

Filesize
1.4MB

MD5
dbb45e245c3a40eb66ae0aae7b195a6a

SHA1
0c88836735b6600e8d20d2303e54cf4bc04f55ac

SHA256
3c71779aecfb022ceaf84c22b4255d5671745559b510be53d14640186c55b887

SHA512
fdf0ea5691ba1356d2700bbcc7ec3b52b73a9289e16ea92aaae4e26965fc07edc8cb42fe84a86fd40fc918e5c3059cc3c8bd1d61f3cc8d086189398181da6dc4

Download Submit
C:\Windows\System\xFsSijJ.exe

Filesize
1.4MB

MD5
8a90e3ddf9aee6622cf7ef69aad6a590

SHA1
d0d215e4a378f1d3ba0047a196f0aad9adc2cecf

SHA256
75b5e6bf9d18a3ec647d318d6a81f2cd34306afaf246802eab5cc1466192ea76

SHA512
7780e5ad98f374a92dcfbcc6eef1bfdd93af091d87cd43a0531e47b954bcd396c3b8b61a5a0beaab9910276c103d49775d001bf18b395d4fe01b11dcb9d91ebd

Download Submit
C:\Windows\System\xORRGQk.exe

Filesize
1.4MB

MD5
ea6fa7875051170db883d907d2689166

SHA1
3bfa2c81df27ed9bcee30d2f69dc898dc5105fc0

SHA256
274937469111673fa14e8585486cb8d849874747f1af018aa591ed35a92685b4

SHA512
6ab6c67c08758bb275d26923c9117f705e970f36f420bd491f98535d092d99c238d212eeab321bc2b42a9501e30f14067232ad39d01fd99e50e291223c0a2ee3

Download Submit
C:\Windows\System\yBkMGkq.exe

Filesize
1.4MB

MD5
1e8252a648884c89647737304761c7ae

SHA1
b0389c2e0c26e3a53fbf60535969eb68996de2d2

SHA256
f75799ec5ff0d7d74e89668d28407a1da493b85590d9d54152f45035a19cf55f

SHA512
d47f60fc59ec705fd0d1683cbc1ac69d12d95e23a76332f984a369e6df574b5ee2a60b56928c6405594ec0b7b97b4c878d596c4d6855a2412eb65fed0524e7f0

Download Submit
C:\Windows\System\yJhEzCs.exe

Filesize
1.4MB

MD5
3008bc2e486dec21e7f3a82aa7fcc265

SHA1
a2731e306034a21c3ab5839b637995d72ab24cf8

SHA256
a7a8189afe89e2d2dc9207fdcca9d9e3236b01eb02a153fb6e12950f7061d11e

SHA512
5c8ab69a34ae649dea5df500ed3f7d9d6f49a814569c0c477128320927b9378d2f72044bd700504e2dfed7ede59ea04be27b6769df5176d8489d4e6cfffc5253

Download Submit
C:\Windows\System\yXfQHRM.exe

Filesize
1.4MB

MD5
6d91c37d9989628e7eb03199641c3a9c

SHA1
4a25498230c20cbc7b57e8c2832ce5e20c96c123

SHA256
65905d80e65364a69a97f4133148b91f5358fd7bc77a8248fc7ec3996a446a55

SHA512
458dc09eefee42954423011b5b0f211a31beba74e3dcb1cb187c4b7c084a67d859bf3c28bc3856faab78846d41821a528661d9bda183109a4c528099e9a79ff0

Download Submit
C:\Windows\System\ywCQQdF.exe

Filesize
1.4MB

MD5
a40432b8a38b93ea0d7ce6bf7d03b250

SHA1
c05ce5fecd76f3b49dbaadd6e1a1f20eb01dc926

SHA256
3ab07a33372941b554e48162ee7f04432ef54b18e70a540fb73f65cdd5d89cdd

SHA512
a703cb3e22d42bfac9fb0d99646b5322e182495b5c027aaf5873d3fc558373d4909cebc4bb41c58973886e515057d453af36f41446e04cb819d856873b2c92e5

Download Submit
memory/2244-0-0x0000029F02290000-0x0000029F022A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads