xmrig | 44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
Size

1.8MB
MD5

4b8aa7ad5cebc08fd076511c74b4f200
SHA1

73282aa1a41be4e174a61e04943e6e4b7798c826
SHA256

44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac
SHA512

a3da65f02bdbc1be48602e6acb086edcf1336ad201f06b3da040d19cefb30cb93dc1a19dafe79f449d2761a8852317b62ce2780b0da08df582e77f6a912bdb67
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbkWyTsf5Nd:GemTLkNdfE0pZy8

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023b83-7.dat	xmrig
behavioral2/files/0x000b000000023b7f-8.dat	xmrig
behavioral2/files/0x000a000000023b87-22.dat	xmrig
behavioral2/files/0x000a000000023b84-23.dat	xmrig
behavioral2/files/0x000a000000023b86-21.dat	xmrig
behavioral2/files/0x000a000000023b85-20.dat	xmrig
behavioral2/files/0x000a000000023b88-37.dat	xmrig
behavioral2/files/0x000a000000023b8c-52.dat	xmrig
behavioral2/files/0x000b000000023b8f-69.dat	xmrig
behavioral2/files/0x000a000000023b8e-67.dat	xmrig
behavioral2/files/0x000a000000023b8d-65.dat	xmrig
behavioral2/files/0x000a000000023b8b-61.dat	xmrig
behavioral2/files/0x000a000000023b8a-59.dat	xmrig
behavioral2/files/0x000a000000023b89-57.dat	xmrig
behavioral2/files/0x000a000000023b90-74.dat	xmrig
behavioral2/files/0x000a000000023b99-79.dat	xmrig
behavioral2/files/0x000b000000023b80-86.dat	xmrig
behavioral2/files/0x0008000000023ba9-95.dat	xmrig
behavioral2/files/0x0009000000023baf-121.dat	xmrig
behavioral2/files/0x0009000000023bbd-137.dat	xmrig
behavioral2/files/0x0008000000023bbb-147.dat	xmrig
behavioral2/files/0x0008000000023bed-157.dat	xmrig
behavioral2/files/0x0008000000023bef-164.dat	xmrig
behavioral2/files/0x0008000000023bee-163.dat	xmrig
behavioral2/files/0x0008000000023bec-153.dat	xmrig
behavioral2/files/0x0008000000023bbc-149.dat	xmrig
behavioral2/files/0x0008000000023bb6-145.dat	xmrig
behavioral2/files/0x0008000000023bb9-142.dat	xmrig
behavioral2/files/0x000e000000023bb4-139.dat	xmrig
behavioral2/files/0x0009000000023bb0-133.dat	xmrig
behavioral2/files/0x0008000000023bba-126.dat	xmrig
behavioral2/files/0x000b000000023b9b-107.dat	xmrig
behavioral2/files/0x0012000000023ba7-99.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4568	FbdrkyK.exe
2356	XQtcfcu.exe
4692	OeZHfZD.exe
1036	QjqSDcf.exe
2640	RYWwjhH.exe
3988	rQqeema.exe
5028	lVstEZV.exe
3660	zhTSMbN.exe
3840	FtiUxkb.exe
3476	NTTTbDf.exe
3136	jzCgpPQ.exe
2644	sAxSnub.exe
3168	ZIXXwPq.exe
4884	rqYPpDC.exe
3128	cNnQTZF.exe
4592	xgGCrqf.exe
1160	CDVxLqK.exe
1636	HRaNmSl.exe
700	hOpZveI.exe
1588	WkKPQxI.exe
4604	HVgVhPd.exe
3948	VGGwTXG.exe
1552	RPLorRB.exe
4200	xzgItEo.exe
4852	HkSkHFB.exe
4528	rKexite.exe
5040	ODHqHhp.exe
1788	eEaXQPi.exe
916	WVNYTvb.exe
2424	mAOrlSH.exe
1692	OuycPmZ.exe
2080	xJuITJc.exe
1676	tuvrtoG.exe
1832	SxfoQFw.exe
3904	NYILFSv.exe
1804	JXwYAhB.exe
4268	qOznLWY.exe
1540	sqyHMed.exe
2900	NVRNSkO.exe
3768	hAzqPRh.exe
3308	uHyKYGX.exe
3068	vYqQmPv.exe
1292	kXnQeBD.exe
5112	BhnsysI.exe
640	pivMfgU.exe
3224	mMrqPgz.exe
1916	zOQwGOi.exe
3468	VaNCRPZ.exe
4116	RlGnSZT.exe
880	lHGBIAD.exe
2956	brCtgxh.exe
4736	WlVwzhd.exe
4856	bxInBJE.exe
1844	QLYbLdT.exe
552	KHyfuar.exe
4024	zbSsztq.exe
4944	cLHXTLK.exe
2968	TunLsCx.exe
4212	JPfbmHV.exe
4264	ZuEWByt.exe
4540	TmDIUNx.exe
1224	hMvAnpN.exe
556	iqfysKE.exe
4224	xMoepLz.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lXjBHWl.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\RgbohxK.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\zsBjDUp.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\cTUrexp.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\KusELDH.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\UvqaDog.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\vFhkEMx.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\pivMfgU.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\PqaUdVf.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\OFZhZjM.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\uLQDHcN.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\LQhPAzs.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\MiSkspv.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\kBAyPlM.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\WlVwzhd.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\RkKYWjM.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\HhKOPlg.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\aZFrxSI.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\WqWwpSw.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\QYffjhq.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\JRICbxf.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\HVtrCEQ.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\osjkipA.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\DICwwxq.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\OeZHfZD.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\zOQwGOi.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\JFhuDhy.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\zboxFvE.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\zEACpfu.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\mAOrlSH.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\fsdjtRB.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\MNHpWCE.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\NSBNkAc.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\ZPruQSP.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\FtiUxkb.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\EBnyZuh.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\iRkpRxR.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\QWzStXU.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\lXaQPRz.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\ThHyhGW.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\OglleDJ.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\vuVHhYJ.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\uDMTrfp.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\RcIEMRH.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\uGtKkiX.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\ZPPeJLQ.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\agOScbq.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\ZccmEgv.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\lkmkaxv.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\sNOUfjt.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\cVXmSOy.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\KIQEoCQ.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\hOEMqHn.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\jzOtIgc.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\mbZzLbG.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\dojrqoT.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\WlYLVlP.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\zIfUEKV.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\wwnVaXQ.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\mUNCanQ.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\LToJAky.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\crgWgrq.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\ctmAjcm.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
File created	C:\Windows\System\qMiCKDd.exe	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16716	dwm.exe
Token: SeChangeNotifyPrivilege	16716	dwm.exe
Token: 33	16716	dwm.exe
Token: SeIncBasePriorityPrivilege	16716	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 4568	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	84
PID 464 wrote to memory of 4568	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	84
PID 464 wrote to memory of 2356	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	85
PID 464 wrote to memory of 2356	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	85
PID 464 wrote to memory of 4692	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	86
PID 464 wrote to memory of 4692	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	86
PID 464 wrote to memory of 1036	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	87
PID 464 wrote to memory of 1036	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	87
PID 464 wrote to memory of 2640	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	88
PID 464 wrote to memory of 2640	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	88
PID 464 wrote to memory of 3988	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	89
PID 464 wrote to memory of 3988	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	89
PID 464 wrote to memory of 5028	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	90
PID 464 wrote to memory of 5028	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	90
PID 464 wrote to memory of 3660	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	91
PID 464 wrote to memory of 3660	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	91
PID 464 wrote to memory of 3840	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	92
PID 464 wrote to memory of 3840	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	92
PID 464 wrote to memory of 3476	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	93
PID 464 wrote to memory of 3476	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	93
PID 464 wrote to memory of 3136	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	94
PID 464 wrote to memory of 3136	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	94
PID 464 wrote to memory of 2644	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	95
PID 464 wrote to memory of 2644	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	95
PID 464 wrote to memory of 3168	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	96
PID 464 wrote to memory of 3168	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	96
PID 464 wrote to memory of 4884	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	97
PID 464 wrote to memory of 4884	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	97
PID 464 wrote to memory of 3128	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	98
PID 464 wrote to memory of 3128	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	98
PID 464 wrote to memory of 4592	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	99
PID 464 wrote to memory of 4592	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	99
PID 464 wrote to memory of 1160	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	100
PID 464 wrote to memory of 1160	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	100
PID 464 wrote to memory of 1636	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	101
PID 464 wrote to memory of 1636	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	101
PID 464 wrote to memory of 700	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	102
PID 464 wrote to memory of 700	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	102
PID 464 wrote to memory of 1588	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	103
PID 464 wrote to memory of 1588	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	103
PID 464 wrote to memory of 4604	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	104
PID 464 wrote to memory of 4604	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	104
PID 464 wrote to memory of 3948	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	105
PID 464 wrote to memory of 3948	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	105
PID 464 wrote to memory of 1552	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	106
PID 464 wrote to memory of 1552	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	106
PID 464 wrote to memory of 4528	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	107
PID 464 wrote to memory of 4528	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	107
PID 464 wrote to memory of 4200	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	108
PID 464 wrote to memory of 4200	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	108
PID 464 wrote to memory of 4852	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	109
PID 464 wrote to memory of 4852	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	109
PID 464 wrote to memory of 5040	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	110
PID 464 wrote to memory of 5040	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	110
PID 464 wrote to memory of 1788	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	111
PID 464 wrote to memory of 1788	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	111
PID 464 wrote to memory of 916	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	112
PID 464 wrote to memory of 916	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	112
PID 464 wrote to memory of 2424	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	113
PID 464 wrote to memory of 2424	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	113
PID 464 wrote to memory of 1692	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	114
PID 464 wrote to memory of 1692	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	114
PID 464 wrote to memory of 2080	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	115
PID 464 wrote to memory of 2080	464	44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe	115

C:\Users\Admin\AppData\Local\Temp\44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe
"C:\Users\Admin\AppData\Local\Temp\44f248936d967514c9ba348f14a1cdaa80ebe5b7d07aaf9ee79b60c2bfe125ac.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\System\FbdrkyK.exe
  C:\Windows\System\FbdrkyK.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\XQtcfcu.exe
  C:\Windows\System\XQtcfcu.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\OeZHfZD.exe
  C:\Windows\System\OeZHfZD.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\QjqSDcf.exe
  C:\Windows\System\QjqSDcf.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\RYWwjhH.exe
  C:\Windows\System\RYWwjhH.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\rQqeema.exe
  C:\Windows\System\rQqeema.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\lVstEZV.exe
  C:\Windows\System\lVstEZV.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\zhTSMbN.exe
  C:\Windows\System\zhTSMbN.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\FtiUxkb.exe
  C:\Windows\System\FtiUxkb.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\NTTTbDf.exe
  C:\Windows\System\NTTTbDf.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\jzCgpPQ.exe
  C:\Windows\System\jzCgpPQ.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\sAxSnub.exe
  C:\Windows\System\sAxSnub.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\ZIXXwPq.exe
  C:\Windows\System\ZIXXwPq.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\rqYPpDC.exe
  C:\Windows\System\rqYPpDC.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\cNnQTZF.exe
  C:\Windows\System\cNnQTZF.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\xgGCrqf.exe
  C:\Windows\System\xgGCrqf.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\CDVxLqK.exe
  C:\Windows\System\CDVxLqK.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\HRaNmSl.exe
  C:\Windows\System\HRaNmSl.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\hOpZveI.exe
  C:\Windows\System\hOpZveI.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\WkKPQxI.exe
  C:\Windows\System\WkKPQxI.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\HVgVhPd.exe
  C:\Windows\System\HVgVhPd.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\VGGwTXG.exe
  C:\Windows\System\VGGwTXG.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\RPLorRB.exe
  C:\Windows\System\RPLorRB.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\rKexite.exe
  C:\Windows\System\rKexite.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\xzgItEo.exe
  C:\Windows\System\xzgItEo.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\HkSkHFB.exe
  C:\Windows\System\HkSkHFB.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\ODHqHhp.exe
  C:\Windows\System\ODHqHhp.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\eEaXQPi.exe
  C:\Windows\System\eEaXQPi.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\WVNYTvb.exe
  C:\Windows\System\WVNYTvb.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\mAOrlSH.exe
  C:\Windows\System\mAOrlSH.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\OuycPmZ.exe
  C:\Windows\System\OuycPmZ.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\xJuITJc.exe
  C:\Windows\System\xJuITJc.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\tuvrtoG.exe
  C:\Windows\System\tuvrtoG.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\SxfoQFw.exe
  C:\Windows\System\SxfoQFw.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\NYILFSv.exe
  C:\Windows\System\NYILFSv.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\JXwYAhB.exe
  C:\Windows\System\JXwYAhB.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\qOznLWY.exe
  C:\Windows\System\qOznLWY.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\sqyHMed.exe
  C:\Windows\System\sqyHMed.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\NVRNSkO.exe
  C:\Windows\System\NVRNSkO.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\hAzqPRh.exe
  C:\Windows\System\hAzqPRh.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\uHyKYGX.exe
  C:\Windows\System\uHyKYGX.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\vYqQmPv.exe
  C:\Windows\System\vYqQmPv.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\kXnQeBD.exe
  C:\Windows\System\kXnQeBD.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\BhnsysI.exe
  C:\Windows\System\BhnsysI.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\pivMfgU.exe
  C:\Windows\System\pivMfgU.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\mMrqPgz.exe
  C:\Windows\System\mMrqPgz.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\zOQwGOi.exe
  C:\Windows\System\zOQwGOi.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\VaNCRPZ.exe
  C:\Windows\System\VaNCRPZ.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\RlGnSZT.exe
  C:\Windows\System\RlGnSZT.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\lHGBIAD.exe
  C:\Windows\System\lHGBIAD.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\brCtgxh.exe
  C:\Windows\System\brCtgxh.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\WlVwzhd.exe
  C:\Windows\System\WlVwzhd.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\bxInBJE.exe
  C:\Windows\System\bxInBJE.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\QLYbLdT.exe
  C:\Windows\System\QLYbLdT.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\KHyfuar.exe
  C:\Windows\System\KHyfuar.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\zbSsztq.exe
  C:\Windows\System\zbSsztq.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\cLHXTLK.exe
  C:\Windows\System\cLHXTLK.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\TunLsCx.exe
  C:\Windows\System\TunLsCx.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\JPfbmHV.exe
  C:\Windows\System\JPfbmHV.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\ZuEWByt.exe
  C:\Windows\System\ZuEWByt.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\TmDIUNx.exe
  C:\Windows\System\TmDIUNx.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\hMvAnpN.exe
  C:\Windows\System\hMvAnpN.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\iqfysKE.exe
  C:\Windows\System\iqfysKE.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\xMoepLz.exe
  C:\Windows\System\xMoepLz.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\ysdobCh.exe
  C:\Windows\System\ysdobCh.exe
  2⤵
  PID:2072
- C:\Windows\System\CmSYuJW.exe
  C:\Windows\System\CmSYuJW.exe
  2⤵
  PID:788
- C:\Windows\System\RbmvYqD.exe
  C:\Windows\System\RbmvYqD.exe
  2⤵
  PID:2592
- C:\Windows\System\ifuLGHH.exe
  C:\Windows\System\ifuLGHH.exe
  2⤵
  PID:1720
- C:\Windows\System\fxUVTBB.exe
  C:\Windows\System\fxUVTBB.exe
  2⤵
  PID:4960
- C:\Windows\System\GvtprLw.exe
  C:\Windows\System\GvtprLw.exe
  2⤵
  PID:2016
- C:\Windows\System\SrFlVPD.exe
  C:\Windows\System\SrFlVPD.exe
  2⤵
  PID:968
- C:\Windows\System\BGorWex.exe
  C:\Windows\System\BGorWex.exe
  2⤵
  PID:644
- C:\Windows\System\EBnyZuh.exe
  C:\Windows\System\EBnyZuh.exe
  2⤵
  PID:1384
- C:\Windows\System\CLzRgVF.exe
  C:\Windows\System\CLzRgVF.exe
  2⤵
  PID:4936
- C:\Windows\System\wzUCKan.exe
  C:\Windows\System\wzUCKan.exe
  2⤵
  PID:1860
- C:\Windows\System\CnUHFro.exe
  C:\Windows\System\CnUHFro.exe
  2⤵
  PID:1608
- C:\Windows\System\pSckfgP.exe
  C:\Windows\System\pSckfgP.exe
  2⤵
  PID:4208
- C:\Windows\System\GRjyvmq.exe
  C:\Windows\System\GRjyvmq.exe
  2⤵
  PID:3044
- C:\Windows\System\gAjTUjR.exe
  C:\Windows\System\gAjTUjR.exe
  2⤵
  PID:1612
- C:\Windows\System\UmGjSAs.exe
  C:\Windows\System\UmGjSAs.exe
  2⤵
  PID:4356
- C:\Windows\System\ZrdwAAK.exe
  C:\Windows\System\ZrdwAAK.exe
  2⤵
  PID:2052
- C:\Windows\System\FFwhbzz.exe
  C:\Windows\System\FFwhbzz.exe
  2⤵
  PID:1796
- C:\Windows\System\DoGwQxY.exe
  C:\Windows\System\DoGwQxY.exe
  2⤵
  PID:3456
- C:\Windows\System\smycKxP.exe
  C:\Windows\System\smycKxP.exe
  2⤵
  PID:1952
- C:\Windows\System\RTuGfDo.exe
  C:\Windows\System\RTuGfDo.exe
  2⤵
  PID:4272
- C:\Windows\System\tlVhWuF.exe
  C:\Windows\System\tlVhWuF.exe
  2⤵
  PID:4340
- C:\Windows\System\QymbHeu.exe
  C:\Windows\System\QymbHeu.exe
  2⤵
  PID:3828
- C:\Windows\System\TWbWulL.exe
  C:\Windows\System\TWbWulL.exe
  2⤵
  PID:3384
- C:\Windows\System\yImpVug.exe
  C:\Windows\System\yImpVug.exe
  2⤵
  PID:1352
- C:\Windows\System\jkgsiBt.exe
  C:\Windows\System\jkgsiBt.exe
  2⤵
  PID:2552
- C:\Windows\System\qyIRvxj.exe
  C:\Windows\System\qyIRvxj.exe
  2⤵
  PID:4828
- C:\Windows\System\FkXjhnd.exe
  C:\Windows\System\FkXjhnd.exe
  2⤵
  PID:1704
- C:\Windows\System\fBnaQgh.exe
  C:\Windows\System\fBnaQgh.exe
  2⤵
  PID:468
- C:\Windows\System\bnidltu.exe
  C:\Windows\System\bnidltu.exe
  2⤵
  PID:4812
- C:\Windows\System\npnBtnS.exe
  C:\Windows\System\npnBtnS.exe
  2⤵
  PID:3968
- C:\Windows\System\tYhoPkW.exe
  C:\Windows\System\tYhoPkW.exe
  2⤵
  PID:3012
- C:\Windows\System\TQeauKp.exe
  C:\Windows\System\TQeauKp.exe
  2⤵
  PID:2884
- C:\Windows\System\fsdjtRB.exe
  C:\Windows\System\fsdjtRB.exe
  2⤵
  PID:4520
- C:\Windows\System\VEpudmI.exe
  C:\Windows\System\VEpudmI.exe
  2⤵
  PID:836
- C:\Windows\System\spgHlWZ.exe
  C:\Windows\System\spgHlWZ.exe
  2⤵
  PID:3628
- C:\Windows\System\nDHlwAC.exe
  C:\Windows\System\nDHlwAC.exe
  2⤵
  PID:1000
- C:\Windows\System\LXUgbBr.exe
  C:\Windows\System\LXUgbBr.exe
  2⤵
  PID:4464
- C:\Windows\System\hmsabmL.exe
  C:\Windows\System\hmsabmL.exe
  2⤵
  PID:2284
- C:\Windows\System\YYkusEe.exe
  C:\Windows\System\YYkusEe.exe
  2⤵
  PID:4920
- C:\Windows\System\HTUgFxz.exe
  C:\Windows\System\HTUgFxz.exe
  2⤵
  PID:2664
- C:\Windows\System\YllDnTZ.exe
  C:\Windows\System\YllDnTZ.exe
  2⤵
  PID:4324
- C:\Windows\System\NUcPLlu.exe
  C:\Windows\System\NUcPLlu.exe
  2⤵
  PID:5148
- C:\Windows\System\tgQewGT.exe
  C:\Windows\System\tgQewGT.exe
  2⤵
  PID:5176
- C:\Windows\System\OPdUQEK.exe
  C:\Windows\System\OPdUQEK.exe
  2⤵
  PID:5204
- C:\Windows\System\AhEcwTS.exe
  C:\Windows\System\AhEcwTS.exe
  2⤵
  PID:5220
- C:\Windows\System\crgWgrq.exe
  C:\Windows\System\crgWgrq.exe
  2⤵
  PID:5248
- C:\Windows\System\IkPcFvl.exe
  C:\Windows\System\IkPcFvl.exe
  2⤵
  PID:5268
- C:\Windows\System\UPWAxCn.exe
  C:\Windows\System\UPWAxCn.exe
  2⤵
  PID:5292
- C:\Windows\System\cuNccVf.exe
  C:\Windows\System\cuNccVf.exe
  2⤵
  PID:5324
- C:\Windows\System\rgnbMIW.exe
  C:\Windows\System\rgnbMIW.exe
  2⤵
  PID:5348
- C:\Windows\System\cYEzUXI.exe
  C:\Windows\System\cYEzUXI.exe
  2⤵
  PID:5380
- C:\Windows\System\NfgtnWC.exe
  C:\Windows\System\NfgtnWC.exe
  2⤵
  PID:5404
- C:\Windows\System\dcvufHO.exe
  C:\Windows\System\dcvufHO.exe
  2⤵
  PID:5440
- C:\Windows\System\QxuyVkJ.exe
  C:\Windows\System\QxuyVkJ.exe
  2⤵
  PID:5472
- C:\Windows\System\VGZRCxN.exe
  C:\Windows\System\VGZRCxN.exe
  2⤵
  PID:5492
- C:\Windows\System\vcfYzhp.exe
  C:\Windows\System\vcfYzhp.exe
  2⤵
  PID:5512
- C:\Windows\System\vuVHhYJ.exe
  C:\Windows\System\vuVHhYJ.exe
  2⤵
  PID:5552
- C:\Windows\System\mXWIvpi.exe
  C:\Windows\System\mXWIvpi.exe
  2⤵
  PID:5576
- C:\Windows\System\PCWqCLW.exe
  C:\Windows\System\PCWqCLW.exe
  2⤵
  PID:5596
- C:\Windows\System\mMxdcyc.exe
  C:\Windows\System\mMxdcyc.exe
  2⤵
  PID:5624
- C:\Windows\System\NjEqAci.exe
  C:\Windows\System\NjEqAci.exe
  2⤵
  PID:5652
- C:\Windows\System\lbXywph.exe
  C:\Windows\System\lbXywph.exe
  2⤵
  PID:5680
- C:\Windows\System\RkKYWjM.exe
  C:\Windows\System\RkKYWjM.exe
  2⤵
  PID:5700
- C:\Windows\System\xMvZpbV.exe
  C:\Windows\System\xMvZpbV.exe
  2⤵
  PID:5728
- C:\Windows\System\psUZioJ.exe
  C:\Windows\System\psUZioJ.exe
  2⤵
  PID:5756
- C:\Windows\System\eWkCbmq.exe
  C:\Windows\System\eWkCbmq.exe
  2⤵
  PID:5776
- C:\Windows\System\CqOkVjL.exe
  C:\Windows\System\CqOkVjL.exe
  2⤵
  PID:5800
- C:\Windows\System\cmJIdhG.exe
  C:\Windows\System\cmJIdhG.exe
  2⤵
  PID:5824
- C:\Windows\System\uaHQrhn.exe
  C:\Windows\System\uaHQrhn.exe
  2⤵
  PID:5852
- C:\Windows\System\MDJutFG.exe
  C:\Windows\System\MDJutFG.exe
  2⤵
  PID:5884
- C:\Windows\System\zZxjRIj.exe
  C:\Windows\System\zZxjRIj.exe
  2⤵
  PID:5904
- C:\Windows\System\MRiYSCH.exe
  C:\Windows\System\MRiYSCH.exe
  2⤵
  PID:5928
- C:\Windows\System\zsVpuHK.exe
  C:\Windows\System\zsVpuHK.exe
  2⤵
  PID:5956
- C:\Windows\System\pJbGwDd.exe
  C:\Windows\System\pJbGwDd.exe
  2⤵
  PID:5984
- C:\Windows\System\hKyELiF.exe
  C:\Windows\System\hKyELiF.exe
  2⤵
  PID:6004
- C:\Windows\System\ctmAjcm.exe
  C:\Windows\System\ctmAjcm.exe
  2⤵
  PID:6040
- C:\Windows\System\bOBpQmT.exe
  C:\Windows\System\bOBpQmT.exe
  2⤵
  PID:6068
- C:\Windows\System\eaDXoud.exe
  C:\Windows\System\eaDXoud.exe
  2⤵
  PID:6096
- C:\Windows\System\fJKqGOr.exe
  C:\Windows\System\fJKqGOr.exe
  2⤵
  PID:6124
- C:\Windows\System\VvkXhPj.exe
  C:\Windows\System\VvkXhPj.exe
  2⤵
  PID:5132
- C:\Windows\System\GacIhsU.exe
  C:\Windows\System\GacIhsU.exe
  2⤵
  PID:5188
- C:\Windows\System\VvHxosb.exe
  C:\Windows\System\VvHxosb.exe
  2⤵
  PID:5264
- C:\Windows\System\fDoRhlb.exe
  C:\Windows\System\fDoRhlb.exe
  2⤵
  PID:5280
- C:\Windows\System\vCsEOmy.exe
  C:\Windows\System\vCsEOmy.exe
  2⤵
  PID:5424
- C:\Windows\System\jcvGAPd.exe
  C:\Windows\System\jcvGAPd.exe
  2⤵
  PID:5468
- C:\Windows\System\dojrqoT.exe
  C:\Windows\System\dojrqoT.exe
  2⤵
  PID:5504
- C:\Windows\System\XjaunQQ.exe
  C:\Windows\System\XjaunQQ.exe
  2⤵
  PID:5612
- C:\Windows\System\UpXqEhN.exe
  C:\Windows\System\UpXqEhN.exe
  2⤵
  PID:5692
- C:\Windows\System\bIQBAVZ.exe
  C:\Windows\System\bIQBAVZ.exe
  2⤵
  PID:5748
- C:\Windows\System\uHdjBxr.exe
  C:\Windows\System\uHdjBxr.exe
  2⤵
  PID:5864
- C:\Windows\System\zbSTpZB.exe
  C:\Windows\System\zbSTpZB.exe
  2⤵
  PID:5796
- C:\Windows\System\EyGCbBm.exe
  C:\Windows\System\EyGCbBm.exe
  2⤵
  PID:5968
- C:\Windows\System\GFZPZYF.exe
  C:\Windows\System\GFZPZYF.exe
  2⤵
  PID:6060
- C:\Windows\System\PrzbcIb.exe
  C:\Windows\System\PrzbcIb.exe
  2⤵
  PID:6112
- C:\Windows\System\tYKytCu.exe
  C:\Windows\System\tYKytCu.exe
  2⤵
  PID:6108
- C:\Windows\System\HWQCqGI.exe
  C:\Windows\System\HWQCqGI.exe
  2⤵
  PID:5232
- C:\Windows\System\kGXoEku.exe
  C:\Windows\System\kGXoEku.exe
  2⤵
  PID:5508
- C:\Windows\System\dCkkfaN.exe
  C:\Windows\System\dCkkfaN.exe
  2⤵
  PID:5720
- C:\Windows\System\dCLqlta.exe
  C:\Windows\System\dCLqlta.exe
  2⤵
  PID:5712
- C:\Windows\System\slfZHUe.exe
  C:\Windows\System\slfZHUe.exe
  2⤵
  PID:5940
- C:\Windows\System\xAZttuu.exe
  C:\Windows\System\xAZttuu.exe
  2⤵
  PID:6084
- C:\Windows\System\XTVujBY.exe
  C:\Windows\System\XTVujBY.exe
  2⤵
  PID:6088
- C:\Windows\System\oxVBVCe.exe
  C:\Windows\System\oxVBVCe.exe
  2⤵
  PID:5868
- C:\Windows\System\HHRjluU.exe
  C:\Windows\System\HHRjluU.exe
  2⤵
  PID:6012
- C:\Windows\System\MCpICHp.exe
  C:\Windows\System\MCpICHp.exe
  2⤵
  PID:5488
- C:\Windows\System\uKJQyAH.exe
  C:\Windows\System\uKJQyAH.exe
  2⤵
  PID:6156
- C:\Windows\System\rifzGum.exe
  C:\Windows\System\rifzGum.exe
  2⤵
  PID:6180
- C:\Windows\System\XojXjXy.exe
  C:\Windows\System\XojXjXy.exe
  2⤵
  PID:6208
- C:\Windows\System\jmXDxoq.exe
  C:\Windows\System\jmXDxoq.exe
  2⤵
  PID:6240
- C:\Windows\System\jbTnTpT.exe
  C:\Windows\System\jbTnTpT.exe
  2⤵
  PID:6264
- C:\Windows\System\nEaEmLs.exe
  C:\Windows\System\nEaEmLs.exe
  2⤵
  PID:6296
- C:\Windows\System\NAQxbUM.exe
  C:\Windows\System\NAQxbUM.exe
  2⤵
  PID:6320
- C:\Windows\System\iRkpRxR.exe
  C:\Windows\System\iRkpRxR.exe
  2⤵
  PID:6352
- C:\Windows\System\qtojSGC.exe
  C:\Windows\System\qtojSGC.exe
  2⤵
  PID:6372
- C:\Windows\System\lLJWoWo.exe
  C:\Windows\System\lLJWoWo.exe
  2⤵
  PID:6400
- C:\Windows\System\nHggzvr.exe
  C:\Windows\System\nHggzvr.exe
  2⤵
  PID:6428
- C:\Windows\System\PQdhPGb.exe
  C:\Windows\System\PQdhPGb.exe
  2⤵
  PID:6456
- C:\Windows\System\AuROxyB.exe
  C:\Windows\System\AuROxyB.exe
  2⤵
  PID:6480
- C:\Windows\System\qVLoqnD.exe
  C:\Windows\System\qVLoqnD.exe
  2⤵
  PID:6500
- C:\Windows\System\pkutxVk.exe
  C:\Windows\System\pkutxVk.exe
  2⤵
  PID:6532
- C:\Windows\System\iLCRLBs.exe
  C:\Windows\System\iLCRLBs.exe
  2⤵
  PID:6564
- C:\Windows\System\dkxKxly.exe
  C:\Windows\System\dkxKxly.exe
  2⤵
  PID:6584
- C:\Windows\System\IFnbSWc.exe
  C:\Windows\System\IFnbSWc.exe
  2⤵
  PID:6620
- C:\Windows\System\VYooxGm.exe
  C:\Windows\System\VYooxGm.exe
  2⤵
  PID:6644
- C:\Windows\System\Phtwjgw.exe
  C:\Windows\System\Phtwjgw.exe
  2⤵
  PID:6664
- C:\Windows\System\ZDutslq.exe
  C:\Windows\System\ZDutslq.exe
  2⤵
  PID:6696
- C:\Windows\System\ppBHFXQ.exe
  C:\Windows\System\ppBHFXQ.exe
  2⤵
  PID:6724
- C:\Windows\System\BTAzrtN.exe
  C:\Windows\System\BTAzrtN.exe
  2⤵
  PID:6748
- C:\Windows\System\MQepnvf.exe
  C:\Windows\System\MQepnvf.exe
  2⤵
  PID:6772
- C:\Windows\System\gyXCUVA.exe
  C:\Windows\System\gyXCUVA.exe
  2⤵
  PID:6800
- C:\Windows\System\YRYdfdY.exe
  C:\Windows\System\YRYdfdY.exe
  2⤵
  PID:6828
- C:\Windows\System\EJERYfy.exe
  C:\Windows\System\EJERYfy.exe
  2⤵
  PID:6864
- C:\Windows\System\YsbHLwy.exe
  C:\Windows\System\YsbHLwy.exe
  2⤵
  PID:6888
- C:\Windows\System\cTUrexp.exe
  C:\Windows\System\cTUrexp.exe
  2⤵
  PID:6916
- C:\Windows\System\MNHpWCE.exe
  C:\Windows\System\MNHpWCE.exe
  2⤵
  PID:6940
- C:\Windows\System\mMoHJPb.exe
  C:\Windows\System\mMoHJPb.exe
  2⤵
  PID:6964
- C:\Windows\System\rnOTZLl.exe
  C:\Windows\System\rnOTZLl.exe
  2⤵
  PID:6992
- C:\Windows\System\mzGRYoZ.exe
  C:\Windows\System\mzGRYoZ.exe
  2⤵
  PID:7020
- C:\Windows\System\ZPruQSP.exe
  C:\Windows\System\ZPruQSP.exe
  2⤵
  PID:7048
- C:\Windows\System\HlwJVrj.exe
  C:\Windows\System\HlwJVrj.exe
  2⤵
  PID:7076
- C:\Windows\System\liFARQF.exe
  C:\Windows\System\liFARQF.exe
  2⤵
  PID:7104
- C:\Windows\System\KUcGYbi.exe
  C:\Windows\System\KUcGYbi.exe
  2⤵
  PID:7132
- C:\Windows\System\RpuDtzS.exe
  C:\Windows\System\RpuDtzS.exe
  2⤵
  PID:7164
- C:\Windows\System\TiuLJsw.exe
  C:\Windows\System\TiuLJsw.exe
  2⤵
  PID:6152
- C:\Windows\System\SALEdPM.exe
  C:\Windows\System\SALEdPM.exe
  2⤵
  PID:6172
- C:\Windows\System\vzAINmg.exe
  C:\Windows\System\vzAINmg.exe
  2⤵
  PID:6308
- C:\Windows\System\sXFuyrv.exe
  C:\Windows\System\sXFuyrv.exe
  2⤵
  PID:6344
- C:\Windows\System\dKmFTgu.exe
  C:\Windows\System\dKmFTgu.exe
  2⤵
  PID:6440
- C:\Windows\System\idsMmYq.exe
  C:\Windows\System\idsMmYq.exe
  2⤵
  PID:6472
- C:\Windows\System\oEQXtPY.exe
  C:\Windows\System\oEQXtPY.exe
  2⤵
  PID:6520
- C:\Windows\System\CxNxDqK.exe
  C:\Windows\System\CxNxDqK.exe
  2⤵
  PID:6636
- C:\Windows\System\BcHsvVK.exe
  C:\Windows\System\BcHsvVK.exe
  2⤵
  PID:6672
- C:\Windows\System\KusELDH.exe
  C:\Windows\System\KusELDH.exe
  2⤵
  PID:6768
- C:\Windows\System\agOScbq.exe
  C:\Windows\System\agOScbq.exe
  2⤵
  PID:6784
- C:\Windows\System\GqNgJNB.exe
  C:\Windows\System\GqNgJNB.exe
  2⤵
  PID:6844
- C:\Windows\System\dlNwjBh.exe
  C:\Windows\System\dlNwjBh.exe
  2⤵
  PID:6884
- C:\Windows\System\fuDVFJh.exe
  C:\Windows\System\fuDVFJh.exe
  2⤵
  PID:7016
- C:\Windows\System\ABxwqzR.exe
  C:\Windows\System\ABxwqzR.exe
  2⤵
  PID:7000
- C:\Windows\System\oyDzxCF.exe
  C:\Windows\System\oyDzxCF.exe
  2⤵
  PID:6200
- C:\Windows\System\sjMVuOt.exe
  C:\Windows\System\sjMVuOt.exe
  2⤵
  PID:7144
- C:\Windows\System\IomDQKl.exe
  C:\Windows\System\IomDQKl.exe
  2⤵
  PID:6388
- C:\Windows\System\MYeASQX.exe
  C:\Windows\System\MYeASQX.exe
  2⤵
  PID:6556
- C:\Windows\System\HWZdZBP.exe
  C:\Windows\System\HWZdZBP.exe
  2⤵
  PID:6468
- C:\Windows\System\MtUTLQp.exe
  C:\Windows\System\MtUTLQp.exe
  2⤵
  PID:6596
- C:\Windows\System\jXQaXcG.exe
  C:\Windows\System\jXQaXcG.exe
  2⤵
  PID:6904
- C:\Windows\System\qydXAxm.exe
  C:\Windows\System\qydXAxm.exe
  2⤵
  PID:7120
- C:\Windows\System\DEEutPB.exe
  C:\Windows\System\DEEutPB.exe
  2⤵
  PID:6292
- C:\Windows\System\HVQFkrK.exe
  C:\Windows\System\HVQFkrK.exe
  2⤵
  PID:5672
- C:\Windows\System\FqxnvBb.exe
  C:\Windows\System\FqxnvBb.exe
  2⤵
  PID:6688
- C:\Windows\System\OYXMPWX.exe
  C:\Windows\System\OYXMPWX.exe
  2⤵
  PID:7188
- C:\Windows\System\jvpBDuX.exe
  C:\Windows\System\jvpBDuX.exe
  2⤵
  PID:7216
- C:\Windows\System\cHZHoqB.exe
  C:\Windows\System\cHZHoqB.exe
  2⤵
  PID:7248
- C:\Windows\System\ZWEWWGS.exe
  C:\Windows\System\ZWEWWGS.exe
  2⤵
  PID:7276
- C:\Windows\System\LikFUck.exe
  C:\Windows\System\LikFUck.exe
  2⤵
  PID:7312
- C:\Windows\System\txROxlR.exe
  C:\Windows\System\txROxlR.exe
  2⤵
  PID:7348
- C:\Windows\System\QRdndTO.exe
  C:\Windows\System\QRdndTO.exe
  2⤵
  PID:7380
- C:\Windows\System\lVMVwLJ.exe
  C:\Windows\System\lVMVwLJ.exe
  2⤵
  PID:7416
- C:\Windows\System\SIXySzc.exe
  C:\Windows\System\SIXySzc.exe
  2⤵
  PID:7448
- C:\Windows\System\mxtVgrF.exe
  C:\Windows\System\mxtVgrF.exe
  2⤵
  PID:7492
- C:\Windows\System\ELBqtOL.exe
  C:\Windows\System\ELBqtOL.exe
  2⤵
  PID:7516
- C:\Windows\System\rHFVvSv.exe
  C:\Windows\System\rHFVvSv.exe
  2⤵
  PID:7548
- C:\Windows\System\paLikNp.exe
  C:\Windows\System\paLikNp.exe
  2⤵
  PID:7580
- C:\Windows\System\binlIxT.exe
  C:\Windows\System\binlIxT.exe
  2⤵
  PID:7608
- C:\Windows\System\kLDiICc.exe
  C:\Windows\System\kLDiICc.exe
  2⤵
  PID:7636
- C:\Windows\System\diFejJV.exe
  C:\Windows\System\diFejJV.exe
  2⤵
  PID:7664
- C:\Windows\System\hbtPWhc.exe
  C:\Windows\System\hbtPWhc.exe
  2⤵
  PID:7692
- C:\Windows\System\lXvbKGX.exe
  C:\Windows\System\lXvbKGX.exe
  2⤵
  PID:7720
- C:\Windows\System\MVsdkpn.exe
  C:\Windows\System\MVsdkpn.exe
  2⤵
  PID:7740
- C:\Windows\System\zFEmHVK.exe
  C:\Windows\System\zFEmHVK.exe
  2⤵
  PID:7776
- C:\Windows\System\LZcFkPJ.exe
  C:\Windows\System\LZcFkPJ.exe
  2⤵
  PID:7804
- C:\Windows\System\UfUlpJm.exe
  C:\Windows\System\UfUlpJm.exe
  2⤵
  PID:7836
- C:\Windows\System\whAsxlp.exe
  C:\Windows\System\whAsxlp.exe
  2⤵
  PID:7864
- C:\Windows\System\ShVbXxr.exe
  C:\Windows\System\ShVbXxr.exe
  2⤵
  PID:7892
- C:\Windows\System\dTeRWbc.exe
  C:\Windows\System\dTeRWbc.exe
  2⤵
  PID:7916
- C:\Windows\System\HGxaYbq.exe
  C:\Windows\System\HGxaYbq.exe
  2⤵
  PID:7944
- C:\Windows\System\BRrMhso.exe
  C:\Windows\System\BRrMhso.exe
  2⤵
  PID:7964
- C:\Windows\System\PdeazFy.exe
  C:\Windows\System\PdeazFy.exe
  2⤵
  PID:7988
- C:\Windows\System\eWRwdeF.exe
  C:\Windows\System\eWRwdeF.exe
  2⤵
  PID:8020
- C:\Windows\System\hCyQYWs.exe
  C:\Windows\System\hCyQYWs.exe
  2⤵
  PID:8044
- C:\Windows\System\qWFFtCj.exe
  C:\Windows\System\qWFFtCj.exe
  2⤵
  PID:8068
- C:\Windows\System\bDBHCnz.exe
  C:\Windows\System\bDBHCnz.exe
  2⤵
  PID:8088
- C:\Windows\System\HuCduEg.exe
  C:\Windows\System\HuCduEg.exe
  2⤵
  PID:8112
- C:\Windows\System\AoWrRPm.exe
  C:\Windows\System\AoWrRPm.exe
  2⤵
  PID:8136
- C:\Windows\System\FOLNUJE.exe
  C:\Windows\System\FOLNUJE.exe
  2⤵
  PID:8164
- C:\Windows\System\dWwLVir.exe
  C:\Windows\System\dWwLVir.exe
  2⤵
  PID:8188
- C:\Windows\System\btQCEdE.exe
  C:\Windows\System\btQCEdE.exe
  2⤵
  PID:6416
- C:\Windows\System\TiYawwq.exe
  C:\Windows\System\TiYawwq.exe
  2⤵
  PID:7176
- C:\Windows\System\HgGacZW.exe
  C:\Windows\System\HgGacZW.exe
  2⤵
  PID:7228
- C:\Windows\System\WHEjLyq.exe
  C:\Windows\System\WHEjLyq.exe
  2⤵
  PID:7296
- C:\Windows\System\URLZDXD.exe
  C:\Windows\System\URLZDXD.exe
  2⤵
  PID:7344
- C:\Windows\System\XHQjIiI.exe
  C:\Windows\System\XHQjIiI.exe
  2⤵
  PID:7440
- C:\Windows\System\GrmnRpB.exe
  C:\Windows\System\GrmnRpB.exe
  2⤵
  PID:7472
- C:\Windows\System\nSblLnL.exe
  C:\Windows\System\nSblLnL.exe
  2⤵
  PID:7512
- C:\Windows\System\QAfDQrr.exe
  C:\Windows\System\QAfDQrr.exe
  2⤵
  PID:7592
- C:\Windows\System\hAhtjYc.exe
  C:\Windows\System\hAhtjYc.exe
  2⤵
  PID:7652
- C:\Windows\System\rzJNBjQ.exe
  C:\Windows\System\rzJNBjQ.exe
  2⤵
  PID:7676
- C:\Windows\System\JRICbxf.exe
  C:\Windows\System\JRICbxf.exe
  2⤵
  PID:7788
- C:\Windows\System\pDEcZtk.exe
  C:\Windows\System\pDEcZtk.exe
  2⤵
  PID:7844
- C:\Windows\System\bLGFRhV.exe
  C:\Windows\System\bLGFRhV.exe
  2⤵
  PID:7900
- C:\Windows\System\ZolINbb.exe
  C:\Windows\System\ZolINbb.exe
  2⤵
  PID:7972
- C:\Windows\System\ZeQzoeW.exe
  C:\Windows\System\ZeQzoeW.exe
  2⤵
  PID:8084
- C:\Windows\System\nRCWfjc.exe
  C:\Windows\System\nRCWfjc.exe
  2⤵
  PID:8144
- C:\Windows\System\foQKqiW.exe
  C:\Windows\System\foQKqiW.exe
  2⤵
  PID:8160
- C:\Windows\System\vTnBlAy.exe
  C:\Windows\System\vTnBlAy.exe
  2⤵
  PID:6548
- C:\Windows\System\gXBIuXf.exe
  C:\Windows\System\gXBIuXf.exe
  2⤵
  PID:7260
- C:\Windows\System\TEWSfmp.exe
  C:\Windows\System\TEWSfmp.exe
  2⤵
  PID:7460
- C:\Windows\System\btpccqx.exe
  C:\Windows\System\btpccqx.exe
  2⤵
  PID:7340
- C:\Windows\System\oRtbJLP.exe
  C:\Windows\System\oRtbJLP.exe
  2⤵
  PID:7760
- C:\Windows\System\chnLUzz.exe
  C:\Windows\System\chnLUzz.exe
  2⤵
  PID:7976
- C:\Windows\System\mNXUXKo.exe
  C:\Windows\System\mNXUXKo.exe
  2⤵
  PID:8100
- C:\Windows\System\irjcCjC.exe
  C:\Windows\System\irjcCjC.exe
  2⤵
  PID:7952
- C:\Windows\System\aCqnPec.exe
  C:\Windows\System\aCqnPec.exe
  2⤵
  PID:8172
- C:\Windows\System\gqisdKs.exe
  C:\Windows\System\gqisdKs.exe
  2⤵
  PID:7320
- C:\Windows\System\LxNBBMt.exe
  C:\Windows\System\LxNBBMt.exe
  2⤵
  PID:8220
- C:\Windows\System\UvqaDog.exe
  C:\Windows\System\UvqaDog.exe
  2⤵
  PID:8252
- C:\Windows\System\ciRWqXD.exe
  C:\Windows\System\ciRWqXD.exe
  2⤵
  PID:8280
- C:\Windows\System\TRcpmtW.exe
  C:\Windows\System\TRcpmtW.exe
  2⤵
  PID:8308
- C:\Windows\System\RMjSCEp.exe
  C:\Windows\System\RMjSCEp.exe
  2⤵
  PID:8328
- C:\Windows\System\rzQmuPl.exe
  C:\Windows\System\rzQmuPl.exe
  2⤵
  PID:8356
- C:\Windows\System\slFRyrQ.exe
  C:\Windows\System\slFRyrQ.exe
  2⤵
  PID:8380
- C:\Windows\System\vfxuxud.exe
  C:\Windows\System\vfxuxud.exe
  2⤵
  PID:8408
- C:\Windows\System\twBmToJ.exe
  C:\Windows\System\twBmToJ.exe
  2⤵
  PID:8440
- C:\Windows\System\KaQkzQi.exe
  C:\Windows\System\KaQkzQi.exe
  2⤵
  PID:8464
- C:\Windows\System\RtDusBR.exe
  C:\Windows\System\RtDusBR.exe
  2⤵
  PID:8484
- C:\Windows\System\hOYkvfx.exe
  C:\Windows\System\hOYkvfx.exe
  2⤵
  PID:8508
- C:\Windows\System\UuvGead.exe
  C:\Windows\System\UuvGead.exe
  2⤵
  PID:8536
- C:\Windows\System\zIfUEKV.exe
  C:\Windows\System\zIfUEKV.exe
  2⤵
  PID:8560
- C:\Windows\System\lZGgGUU.exe
  C:\Windows\System\lZGgGUU.exe
  2⤵
  PID:8588
- C:\Windows\System\oRbFAoZ.exe
  C:\Windows\System\oRbFAoZ.exe
  2⤵
  PID:8612
- C:\Windows\System\EKtqPZx.exe
  C:\Windows\System\EKtqPZx.exe
  2⤵
  PID:8636
- C:\Windows\System\hQREaya.exe
  C:\Windows\System\hQREaya.exe
  2⤵
  PID:8664
- C:\Windows\System\ardBRjC.exe
  C:\Windows\System\ardBRjC.exe
  2⤵
  PID:8692
- C:\Windows\System\UlKciXt.exe
  C:\Windows\System\UlKciXt.exe
  2⤵
  PID:8712
- C:\Windows\System\iMMcrxk.exe
  C:\Windows\System\iMMcrxk.exe
  2⤵
  PID:8740
- C:\Windows\System\KOIVXvv.exe
  C:\Windows\System\KOIVXvv.exe
  2⤵
  PID:8764
- C:\Windows\System\bHequBW.exe
  C:\Windows\System\bHequBW.exe
  2⤵
  PID:8796
- C:\Windows\System\oLZgMpm.exe
  C:\Windows\System\oLZgMpm.exe
  2⤵
  PID:8828
- C:\Windows\System\ixumyAa.exe
  C:\Windows\System\ixumyAa.exe
  2⤵
  PID:8860
- C:\Windows\System\Avszijo.exe
  C:\Windows\System\Avszijo.exe
  2⤵
  PID:8880
- C:\Windows\System\kKPlMNJ.exe
  C:\Windows\System\kKPlMNJ.exe
  2⤵
  PID:8908
- C:\Windows\System\kBXKyyX.exe
  C:\Windows\System\kBXKyyX.exe
  2⤵
  PID:8936
- C:\Windows\System\KVdVFvG.exe
  C:\Windows\System\KVdVFvG.exe
  2⤵
  PID:8964
- C:\Windows\System\RwNmkiK.exe
  C:\Windows\System\RwNmkiK.exe
  2⤵
  PID:8992
- C:\Windows\System\DLEfsxb.exe
  C:\Windows\System\DLEfsxb.exe
  2⤵
  PID:9020
- C:\Windows\System\bXYhdqk.exe
  C:\Windows\System\bXYhdqk.exe
  2⤵
  PID:9048
- C:\Windows\System\zHzLRje.exe
  C:\Windows\System\zHzLRje.exe
  2⤵
  PID:9068
- C:\Windows\System\DYkJWtp.exe
  C:\Windows\System\DYkJWtp.exe
  2⤵
  PID:9088
- C:\Windows\System\PcOThKD.exe
  C:\Windows\System\PcOThKD.exe
  2⤵
  PID:9112
- C:\Windows\System\fZFONhi.exe
  C:\Windows\System\fZFONhi.exe
  2⤵
  PID:9140
- C:\Windows\System\ahLuTHK.exe
  C:\Windows\System\ahLuTHK.exe
  2⤵
  PID:9168
- C:\Windows\System\FhKfqfS.exe
  C:\Windows\System\FhKfqfS.exe
  2⤵
  PID:9192
- C:\Windows\System\Qlluoow.exe
  C:\Windows\System\Qlluoow.exe
  2⤵
  PID:7632
- C:\Windows\System\uzIAerq.exe
  C:\Windows\System\uzIAerq.exe
  2⤵
  PID:7620
- C:\Windows\System\wjCpLbu.exe
  C:\Windows\System\wjCpLbu.exe
  2⤵
  PID:6560
- C:\Windows\System\HtyxRmO.exe
  C:\Windows\System\HtyxRmO.exe
  2⤵
  PID:7688
- C:\Windows\System\DdxcpWL.exe
  C:\Windows\System\DdxcpWL.exe
  2⤵
  PID:8212
- C:\Windows\System\iSBapnp.exe
  C:\Windows\System\iSBapnp.exe
  2⤵
  PID:8268
- C:\Windows\System\uLQDHcN.exe
  C:\Windows\System\uLQDHcN.exe
  2⤵
  PID:8352
- C:\Windows\System\HVtrCEQ.exe
  C:\Windows\System\HVtrCEQ.exe
  2⤵
  PID:8496
- C:\Windows\System\iRebTJv.exe
  C:\Windows\System\iRebTJv.exe
  2⤵
  PID:8436
- C:\Windows\System\HZmauyC.exe
  C:\Windows\System\HZmauyC.exe
  2⤵
  PID:8532
- C:\Windows\System\YPPcghA.exe
  C:\Windows\System\YPPcghA.exe
  2⤵
  PID:8604
- C:\Windows\System\BcdxkyP.exe
  C:\Windows\System\BcdxkyP.exe
  2⤵
  PID:8660
- C:\Windows\System\JRSfcRY.exe
  C:\Windows\System\JRSfcRY.exe
  2⤵
  PID:8844
- C:\Windows\System\liLRnZj.exe
  C:\Windows\System\liLRnZj.exe
  2⤵
  PID:8752
- C:\Windows\System\LlNkAsb.exe
  C:\Windows\System\LlNkAsb.exe
  2⤵
  PID:8816
- C:\Windows\System\qUybder.exe
  C:\Windows\System\qUybder.exe
  2⤵
  PID:8976
- C:\Windows\System\oyxdQPj.exe
  C:\Windows\System\oyxdQPj.exe
  2⤵
  PID:8932
- C:\Windows\System\QshzKvX.exe
  C:\Windows\System\QshzKvX.exe
  2⤵
  PID:9212
- C:\Windows\System\qMiCKDd.exe
  C:\Windows\System\qMiCKDd.exe
  2⤵
  PID:8204
- C:\Windows\System\JsrsAJs.exe
  C:\Windows\System\JsrsAJs.exe
  2⤵
  PID:8244
- C:\Windows\System\EObaQJD.exe
  C:\Windows\System\EObaQJD.exe
  2⤵
  PID:9164
- C:\Windows\System\uvrdlLA.exe
  C:\Windows\System\uvrdlLA.exe
  2⤵
  PID:8156
- C:\Windows\System\MiJRvVb.exe
  C:\Windows\System\MiJRvVb.exe
  2⤵
  PID:9016
- C:\Windows\System\sQCNdqx.exe
  C:\Windows\System\sQCNdqx.exe
  2⤵
  PID:8900
- C:\Windows\System\WvHyyeX.exe
  C:\Windows\System\WvHyyeX.exe
  2⤵
  PID:8528
- C:\Windows\System\cXTLILg.exe
  C:\Windows\System\cXTLILg.exe
  2⤵
  PID:8644
- C:\Windows\System\ayoQhsm.exe
  C:\Windows\System\ayoQhsm.exe
  2⤵
  PID:9236
- C:\Windows\System\aTdwsyR.exe
  C:\Windows\System\aTdwsyR.exe
  2⤵
  PID:9264
- C:\Windows\System\YvsLaYr.exe
  C:\Windows\System\YvsLaYr.exe
  2⤵
  PID:9292
- C:\Windows\System\osjkipA.exe
  C:\Windows\System\osjkipA.exe
  2⤵
  PID:9320
- C:\Windows\System\dKJADuQ.exe
  C:\Windows\System\dKJADuQ.exe
  2⤵
  PID:9348
- C:\Windows\System\NSBNkAc.exe
  C:\Windows\System\NSBNkAc.exe
  2⤵
  PID:9380
- C:\Windows\System\CPfKAIO.exe
  C:\Windows\System\CPfKAIO.exe
  2⤵
  PID:9400
- C:\Windows\System\MWmanfD.exe
  C:\Windows\System\MWmanfD.exe
  2⤵
  PID:9432
- C:\Windows\System\fBldSEt.exe
  C:\Windows\System\fBldSEt.exe
  2⤵
  PID:9456
- C:\Windows\System\jeNsGzg.exe
  C:\Windows\System\jeNsGzg.exe
  2⤵
  PID:9488
- C:\Windows\System\CQBHlzu.exe
  C:\Windows\System\CQBHlzu.exe
  2⤵
  PID:9512
- C:\Windows\System\tDBEuSX.exe
  C:\Windows\System\tDBEuSX.exe
  2⤵
  PID:9536
- C:\Windows\System\BQWOlgb.exe
  C:\Windows\System\BQWOlgb.exe
  2⤵
  PID:9560
- C:\Windows\System\QrkCZqz.exe
  C:\Windows\System\QrkCZqz.exe
  2⤵
  PID:9584
- C:\Windows\System\ruFVgzh.exe
  C:\Windows\System\ruFVgzh.exe
  2⤵
  PID:9616
- C:\Windows\System\KyXtPKM.exe
  C:\Windows\System\KyXtPKM.exe
  2⤵
  PID:9640
- C:\Windows\System\SOKPPjF.exe
  C:\Windows\System\SOKPPjF.exe
  2⤵
  PID:9664
- C:\Windows\System\igitVUl.exe
  C:\Windows\System\igitVUl.exe
  2⤵
  PID:9692
- C:\Windows\System\QWWmblQ.exe
  C:\Windows\System\QWWmblQ.exe
  2⤵
  PID:9720
- C:\Windows\System\nUWaxno.exe
  C:\Windows\System\nUWaxno.exe
  2⤵
  PID:9744
- C:\Windows\System\YFfkKpf.exe
  C:\Windows\System\YFfkKpf.exe
  2⤵
  PID:9768
- C:\Windows\System\NvEPjrW.exe
  C:\Windows\System\NvEPjrW.exe
  2⤵
  PID:9784
- C:\Windows\System\BTbIfHc.exe
  C:\Windows\System\BTbIfHc.exe
  2⤵
  PID:9816
- C:\Windows\System\hayymJY.exe
  C:\Windows\System\hayymJY.exe
  2⤵
  PID:9840
- C:\Windows\System\CdHVbJQ.exe
  C:\Windows\System\CdHVbJQ.exe
  2⤵
  PID:9872
- C:\Windows\System\DjGdqgD.exe
  C:\Windows\System\DjGdqgD.exe
  2⤵
  PID:9896
- C:\Windows\System\kkrgkdk.exe
  C:\Windows\System\kkrgkdk.exe
  2⤵
  PID:9924
- C:\Windows\System\zYjJJBI.exe
  C:\Windows\System\zYjJJBI.exe
  2⤵
  PID:9956
- C:\Windows\System\Lmrmwbj.exe
  C:\Windows\System\Lmrmwbj.exe
  2⤵
  PID:9972
- C:\Windows\System\xbNuxxf.exe
  C:\Windows\System\xbNuxxf.exe
  2⤵
  PID:10004
- C:\Windows\System\izKiXlg.exe
  C:\Windows\System\izKiXlg.exe
  2⤵
  PID:10028
- C:\Windows\System\edAVaEj.exe
  C:\Windows\System\edAVaEj.exe
  2⤵
  PID:10052
- C:\Windows\System\ahAAmpy.exe
  C:\Windows\System\ahAAmpy.exe
  2⤵
  PID:10080
- C:\Windows\System\lnBDGoZ.exe
  C:\Windows\System\lnBDGoZ.exe
  2⤵
  PID:10104
- C:\Windows\System\RIrvUOY.exe
  C:\Windows\System\RIrvUOY.exe
  2⤵
  PID:10128
- C:\Windows\System\SaRlRGG.exe
  C:\Windows\System\SaRlRGG.exe
  2⤵
  PID:10152
- C:\Windows\System\mUNCanQ.exe
  C:\Windows\System\mUNCanQ.exe
  2⤵
  PID:10180
- C:\Windows\System\aZFrxSI.exe
  C:\Windows\System\aZFrxSI.exe
  2⤵
  PID:10208
- C:\Windows\System\GaPKKcj.exe
  C:\Windows\System\GaPKKcj.exe
  2⤵
  PID:10236
- C:\Windows\System\ZAyCnQO.exe
  C:\Windows\System\ZAyCnQO.exe
  2⤵
  PID:9224
- C:\Windows\System\NHJelWD.exe
  C:\Windows\System\NHJelWD.exe
  2⤵
  PID:8416
- C:\Windows\System\lHvyCHc.exe
  C:\Windows\System\lHvyCHc.exe
  2⤵
  PID:9260
- C:\Windows\System\XFanrVr.exe
  C:\Windows\System\XFanrVr.exe
  2⤵
  PID:9452
- C:\Windows\System\GJaItcY.exe
  C:\Windows\System\GJaItcY.exe
  2⤵
  PID:8576
- C:\Windows\System\ltQTZCV.exe
  C:\Windows\System\ltQTZCV.exe
  2⤵
  PID:9228
- C:\Windows\System\ZeeIqgu.exe
  C:\Windows\System\ZeeIqgu.exe
  2⤵
  PID:9496
- C:\Windows\System\PqaUdVf.exe
  C:\Windows\System\PqaUdVf.exe
  2⤵
  PID:9504
- C:\Windows\System\xWkMRiw.exe
  C:\Windows\System\xWkMRiw.exe
  2⤵
  PID:9740
- C:\Windows\System\rMjGghT.exe
  C:\Windows\System\rMjGghT.exe
  2⤵
  PID:9532
- C:\Windows\System\dsMmztd.exe
  C:\Windows\System\dsMmztd.exe
  2⤵
  PID:9556
- C:\Windows\System\BPnvpKn.exe
  C:\Windows\System\BPnvpKn.exe
  2⤵
  PID:9756
- C:\Windows\System\LRdzqFR.exe
  C:\Windows\System\LRdzqFR.exe
  2⤵
  PID:9892
- C:\Windows\System\NokqFvD.exe
  C:\Windows\System\NokqFvD.exe
  2⤵
  PID:3496
- C:\Windows\System\IRBuxMV.exe
  C:\Windows\System\IRBuxMV.exe
  2⤵
  PID:9964
- C:\Windows\System\eIZMvPB.exe
  C:\Windows\System\eIZMvPB.exe
  2⤵
  PID:9808
- C:\Windows\System\jRuEMPC.exe
  C:\Windows\System\jRuEMPC.exe
  2⤵
  PID:10192
- C:\Windows\System\kWvMmff.exe
  C:\Windows\System\kWvMmff.exe
  2⤵
  PID:10064
- C:\Windows\System\hVhHOcP.exe
  C:\Windows\System\hVhHOcP.exe
  2⤵
  PID:10140
- C:\Windows\System\LFaWFTx.exe
  C:\Windows\System\LFaWFTx.exe
  2⤵
  PID:9424
- C:\Windows\System\pAHOyAJ.exe
  C:\Windows\System\pAHOyAJ.exe
  2⤵
  PID:8804
- C:\Windows\System\AzcWSkf.exe
  C:\Windows\System\AzcWSkf.exe
  2⤵
  PID:9596
- C:\Windows\System\WuGEJVs.exe
  C:\Windows\System\WuGEJVs.exe
  2⤵
  PID:9776
- C:\Windows\System\rrCEdHz.exe
  C:\Windows\System\rrCEdHz.exe
  2⤵
  PID:9128
- C:\Windows\System\HCdoxbT.exe
  C:\Windows\System\HCdoxbT.exe
  2⤵
  PID:9800
- C:\Windows\System\SsYubsy.exe
  C:\Windows\System\SsYubsy.exe
  2⤵
  PID:8736
- C:\Windows\System\rpfOwab.exe
  C:\Windows\System\rpfOwab.exe
  2⤵
  PID:10256
- C:\Windows\System\DJROsci.exe
  C:\Windows\System\DJROsci.exe
  2⤵
  PID:10276
- C:\Windows\System\ChccNGi.exe
  C:\Windows\System\ChccNGi.exe
  2⤵
  PID:10304
- C:\Windows\System\mequvsL.exe
  C:\Windows\System\mequvsL.exe
  2⤵
  PID:10324
- C:\Windows\System\COmFIUF.exe
  C:\Windows\System\COmFIUF.exe
  2⤵
  PID:10352
- C:\Windows\System\xNgAQLu.exe
  C:\Windows\System\xNgAQLu.exe
  2⤵
  PID:10380
- C:\Windows\System\hOEMqHn.exe
  C:\Windows\System\hOEMqHn.exe
  2⤵
  PID:10400
- C:\Windows\System\tzJlPSj.exe
  C:\Windows\System\tzJlPSj.exe
  2⤵
  PID:10420
- C:\Windows\System\aBFgJCm.exe
  C:\Windows\System\aBFgJCm.exe
  2⤵
  PID:10440
- C:\Windows\System\ScwDrQR.exe
  C:\Windows\System\ScwDrQR.exe
  2⤵
  PID:10460
- C:\Windows\System\iTNrAFm.exe
  C:\Windows\System\iTNrAFm.exe
  2⤵
  PID:10484
- C:\Windows\System\vqXuifk.exe
  C:\Windows\System\vqXuifk.exe
  2⤵
  PID:10512
- C:\Windows\System\zbRdsBL.exe
  C:\Windows\System\zbRdsBL.exe
  2⤵
  PID:10536
- C:\Windows\System\nbWrFDP.exe
  C:\Windows\System\nbWrFDP.exe
  2⤵
  PID:10564
- C:\Windows\System\MIToEwx.exe
  C:\Windows\System\MIToEwx.exe
  2⤵
  PID:10592
- C:\Windows\System\ZccmEgv.exe
  C:\Windows\System\ZccmEgv.exe
  2⤵
  PID:10616
- C:\Windows\System\BfqygXG.exe
  C:\Windows\System\BfqygXG.exe
  2⤵
  PID:10640
- C:\Windows\System\difSPOp.exe
  C:\Windows\System\difSPOp.exe
  2⤵
  PID:10672
- C:\Windows\System\zSxtHfB.exe
  C:\Windows\System\zSxtHfB.exe
  2⤵
  PID:10696
- C:\Windows\System\KNkEdKn.exe
  C:\Windows\System\KNkEdKn.exe
  2⤵
  PID:10716
- C:\Windows\System\LQhPAzs.exe
  C:\Windows\System\LQhPAzs.exe
  2⤵
  PID:10748
- C:\Windows\System\MzfWwtX.exe
  C:\Windows\System\MzfWwtX.exe
  2⤵
  PID:10764
- C:\Windows\System\WazOigc.exe
  C:\Windows\System\WazOigc.exe
  2⤵
  PID:10788
- C:\Windows\System\iVYGqkL.exe
  C:\Windows\System\iVYGqkL.exe
  2⤵
  PID:10816
- C:\Windows\System\jqHbDyr.exe
  C:\Windows\System\jqHbDyr.exe
  2⤵
  PID:10836
- C:\Windows\System\XjUiqPu.exe
  C:\Windows\System\XjUiqPu.exe
  2⤵
  PID:10864
- C:\Windows\System\sKetQBq.exe
  C:\Windows\System\sKetQBq.exe
  2⤵
  PID:10884
- C:\Windows\System\RTcPjLV.exe
  C:\Windows\System\RTcPjLV.exe
  2⤵
  PID:10908
- C:\Windows\System\VfmwxPL.exe
  C:\Windows\System\VfmwxPL.exe
  2⤵
  PID:10936
- C:\Windows\System\yebtJfy.exe
  C:\Windows\System\yebtJfy.exe
  2⤵
  PID:10960
- C:\Windows\System\tskoUOZ.exe
  C:\Windows\System\tskoUOZ.exe
  2⤵
  PID:10984
- C:\Windows\System\VkiDouN.exe
  C:\Windows\System\VkiDouN.exe
  2⤵
  PID:11020
- C:\Windows\System\gRwdZwN.exe
  C:\Windows\System\gRwdZwN.exe
  2⤵
  PID:11048
- C:\Windows\System\ywXdluE.exe
  C:\Windows\System\ywXdluE.exe
  2⤵
  PID:11072
- C:\Windows\System\LToJAky.exe
  C:\Windows\System\LToJAky.exe
  2⤵
  PID:11100
- C:\Windows\System\sWhqMQk.exe
  C:\Windows\System\sWhqMQk.exe
  2⤵
  PID:11128
- C:\Windows\System\fdMgNbN.exe
  C:\Windows\System\fdMgNbN.exe
  2⤵
  PID:11152
- C:\Windows\System\jlfqpBL.exe
  C:\Windows\System\jlfqpBL.exe
  2⤵
  PID:11176
- C:\Windows\System\YvUjVAz.exe
  C:\Windows\System\YvUjVAz.exe
  2⤵
  PID:11212
- C:\Windows\System\xTySMYW.exe
  C:\Windows\System\xTySMYW.exe
  2⤵
  PID:11240
- C:\Windows\System\lkmkaxv.exe
  C:\Windows\System\lkmkaxv.exe
  2⤵
  PID:7756
- C:\Windows\System\DlzcigJ.exe
  C:\Windows\System\DlzcigJ.exe
  2⤵
  PID:9912
- C:\Windows\System\MnlKiKL.exe
  C:\Windows\System\MnlKiKL.exe
  2⤵
  PID:9948
- C:\Windows\System\ufTreyR.exe
  C:\Windows\System\ufTreyR.exe
  2⤵
  PID:9484
- C:\Windows\System\bpoazvM.exe
  C:\Windows\System\bpoazvM.exe
  2⤵
  PID:10244
- C:\Windows\System\uicSOaX.exe
  C:\Windows\System\uicSOaX.exe
  2⤵
  PID:10332
- C:\Windows\System\HpagDlF.exe
  C:\Windows\System\HpagDlF.exe
  2⤵
  PID:10164
- C:\Windows\System\hiDbqYJ.exe
  C:\Windows\System\hiDbqYJ.exe
  2⤵
  PID:10224
- C:\Windows\System\OSgneQf.exe
  C:\Windows\System\OSgneQf.exe
  2⤵
  PID:10044
- C:\Windows\System\wpxqEXN.exe
  C:\Windows\System\wpxqEXN.exe
  2⤵
  PID:10296
- C:\Windows\System\uGtKkiX.exe
  C:\Windows\System\uGtKkiX.exe
  2⤵
  PID:10504
- C:\Windows\System\MRAMpKU.exe
  C:\Windows\System\MRAMpKU.exe
  2⤵
  PID:10784
- C:\Windows\System\CnVTrZv.exe
  C:\Windows\System\CnVTrZv.exe
  2⤵
  PID:10652
- C:\Windows\System\eNcpOBQ.exe
  C:\Windows\System\eNcpOBQ.exe
  2⤵
  PID:10684
- C:\Windows\System\icfsuqH.exe
  C:\Windows\System\icfsuqH.exe
  2⤵
  PID:11120
- C:\Windows\System\eJgAwmg.exe
  C:\Windows\System\eJgAwmg.exe
  2⤵
  PID:10832
- C:\Windows\System\WlYLVlP.exe
  C:\Windows\System\WlYLVlP.exe
  2⤵
  PID:11248
- C:\Windows\System\OxRtYzn.exe
  C:\Windows\System\OxRtYzn.exe
  2⤵
  PID:9984
- C:\Windows\System\CAcUHHn.exe
  C:\Windows\System\CAcUHHn.exe
  2⤵
  PID:11288
- C:\Windows\System\ezjEYRD.exe
  C:\Windows\System\ezjEYRD.exe
  2⤵
  PID:11324
- C:\Windows\System\XILyzuJ.exe
  C:\Windows\System\XILyzuJ.exe
  2⤵
  PID:11348
- C:\Windows\System\eSwXPtD.exe
  C:\Windows\System\eSwXPtD.exe
  2⤵
  PID:11368
- C:\Windows\System\xdUwwVw.exe
  C:\Windows\System\xdUwwVw.exe
  2⤵
  PID:11400
- C:\Windows\System\VXgyqnk.exe
  C:\Windows\System\VXgyqnk.exe
  2⤵
  PID:11428
- C:\Windows\System\hXoknre.exe
  C:\Windows\System\hXoknre.exe
  2⤵
  PID:11460
- C:\Windows\System\HcCnHfT.exe
  C:\Windows\System\HcCnHfT.exe
  2⤵
  PID:11476
- C:\Windows\System\emIXQsY.exe
  C:\Windows\System\emIXQsY.exe
  2⤵
  PID:11500
- C:\Windows\System\FqOUooz.exe
  C:\Windows\System\FqOUooz.exe
  2⤵
  PID:11524
- C:\Windows\System\OfPgRbW.exe
  C:\Windows\System\OfPgRbW.exe
  2⤵
  PID:11544
- C:\Windows\System\bOYWxSa.exe
  C:\Windows\System\bOYWxSa.exe
  2⤵
  PID:11564
- C:\Windows\System\yXmMUOy.exe
  C:\Windows\System\yXmMUOy.exe
  2⤵
  PID:11596
- C:\Windows\System\nPlUhgU.exe
  C:\Windows\System\nPlUhgU.exe
  2⤵
  PID:11624
- C:\Windows\System\uDMTrfp.exe
  C:\Windows\System\uDMTrfp.exe
  2⤵
  PID:11644
- C:\Windows\System\ehHagUP.exe
  C:\Windows\System\ehHagUP.exe
  2⤵
  PID:11676
- C:\Windows\System\kbjzOGB.exe
  C:\Windows\System\kbjzOGB.exe
  2⤵
  PID:11708
- C:\Windows\System\XzbaMXr.exe
  C:\Windows\System\XzbaMXr.exe
  2⤵
  PID:11732
- C:\Windows\System\fALvkIR.exe
  C:\Windows\System\fALvkIR.exe
  2⤵
  PID:11760
- C:\Windows\System\VftFqBJ.exe
  C:\Windows\System\VftFqBJ.exe
  2⤵
  PID:11788
- C:\Windows\System\iSMNWER.exe
  C:\Windows\System\iSMNWER.exe
  2⤵
  PID:12144
- C:\Windows\System\DPzQudY.exe
  C:\Windows\System\DPzQudY.exe
  2⤵
  PID:12164
- C:\Windows\System\xuYDCcW.exe
  C:\Windows\System\xuYDCcW.exe
  2⤵
  PID:12180
- C:\Windows\System\yoGXNFw.exe
  C:\Windows\System\yoGXNFw.exe
  2⤵
  PID:12224
- C:\Windows\System\lIrjxpV.exe
  C:\Windows\System\lIrjxpV.exe
  2⤵
  PID:12268
- C:\Windows\System\jRQwrkE.exe
  C:\Windows\System\jRQwrkE.exe
  2⤵
  PID:10636
- C:\Windows\System\lXjBHWl.exe
  C:\Windows\System\lXjBHWl.exe
  2⤵
  PID:10968
- C:\Windows\System\wKBgUNO.exe
  C:\Windows\System\wKBgUNO.exe
  2⤵
  PID:11012
- C:\Windows\System\rfkNYDb.exe
  C:\Windows\System\rfkNYDb.exe
  2⤵
  PID:11040
- C:\Windows\System\KrJxDra.exe
  C:\Windows\System\KrJxDra.exe
  2⤵
  PID:10532
- C:\Windows\System\pkWwzJb.exe
  C:\Windows\System\pkWwzJb.exe
  2⤵
  PID:11116
- C:\Windows\System\GfyiixD.exe
  C:\Windows\System\GfyiixD.exe
  2⤵
  PID:10852
- C:\Windows\System\WUDJuKB.exe
  C:\Windows\System\WUDJuKB.exe
  2⤵
  PID:11228
- C:\Windows\System\OasYFsk.exe
  C:\Windows\System\OasYFsk.exe
  2⤵
  PID:10600
- C:\Windows\System\EJjkNYF.exe
  C:\Windows\System\EJjkNYF.exe
  2⤵
  PID:9828
- C:\Windows\System\wdewrqt.exe
  C:\Windows\System\wdewrqt.exe
  2⤵
  PID:9548
- C:\Windows\System\HtxRrGh.exe
  C:\Windows\System\HtxRrGh.exe
  2⤵
  PID:10124
- C:\Windows\System\gkJbcyn.exe
  C:\Windows\System\gkJbcyn.exe
  2⤵
  PID:11064
- C:\Windows\System\VOebdee.exe
  C:\Windows\System\VOebdee.exe
  2⤵
  PID:9408
- C:\Windows\System\HiZtGET.exe
  C:\Windows\System\HiZtGET.exe
  2⤵
  PID:11160
- C:\Windows\System\VLxoPHn.exe
  C:\Windows\System\VLxoPHn.exe
  2⤵
  PID:11652
- C:\Windows\System\IbcSeLY.exe
  C:\Windows\System\IbcSeLY.exe
  2⤵
  PID:10376
- C:\Windows\System\AjUIIIQ.exe
  C:\Windows\System\AjUIIIQ.exe
  2⤵
  PID:10268
- C:\Windows\System\VYKOjfb.exe
  C:\Windows\System\VYKOjfb.exe
  2⤵
  PID:10740
- C:\Windows\System\HunbCLU.exe
  C:\Windows\System\HunbCLU.exe
  2⤵
  PID:11280
- C:\Windows\System\cFncpuk.exe
  C:\Windows\System\cFncpuk.exe
  2⤵
  PID:11748
- C:\Windows\System\azoquNO.exe
  C:\Windows\System\azoquNO.exe
  2⤵
  PID:11456
- C:\Windows\System\nzNvHpX.exe
  C:\Windows\System\nzNvHpX.exe
  2⤵
  PID:11540
- C:\Windows\System\nojLWtq.exe
  C:\Windows\System\nojLWtq.exe
  2⤵
  PID:11756
- C:\Windows\System\hzkIQai.exe
  C:\Windows\System\hzkIQai.exe
  2⤵
  PID:11692
- C:\Windows\System\wIynCUQ.exe
  C:\Windows\System\wIynCUQ.exe
  2⤵
  PID:11488
- C:\Windows\System\XpxADwb.exe
  C:\Windows\System\XpxADwb.exe
  2⤵
  PID:11000
- C:\Windows\System\UcJSWXc.exe
  C:\Windows\System\UcJSWXc.exe
  2⤵
  PID:12136
- C:\Windows\System\TVwNBqB.exe
  C:\Windows\System\TVwNBqB.exe
  2⤵
  PID:12256
- C:\Windows\System\RcIEMRH.exe
  C:\Windows\System\RcIEMRH.exe
  2⤵
  PID:12152
- C:\Windows\System\vZoaFqR.exe
  C:\Windows\System\vZoaFqR.exe
  2⤵
  PID:11164
- C:\Windows\System\bngMSYS.exe
  C:\Windows\System\bngMSYS.exe
  2⤵
  PID:12216
- C:\Windows\System\lqQadup.exe
  C:\Windows\System\lqQadup.exe
  2⤵
  PID:12252
- C:\Windows\System\zudWvSL.exe
  C:\Windows\System\zudWvSL.exe
  2⤵
  PID:10232
- C:\Windows\System\TFlpMPk.exe
  C:\Windows\System\TFlpMPk.exe
  2⤵
  PID:11492
- C:\Windows\System\NYxWLvT.exe
  C:\Windows\System\NYxWLvT.exe
  2⤵
  PID:10520
- C:\Windows\System\nKyWvMY.exe
  C:\Windows\System\nKyWvMY.exe
  2⤵
  PID:10168
- C:\Windows\System\sVXnOyo.exe
  C:\Windows\System\sVXnOyo.exe
  2⤵
  PID:10956
- C:\Windows\System\FupZwun.exe
  C:\Windows\System\FupZwun.exe
  2⤵
  PID:11448
- C:\Windows\System\dfJWfOm.exe
  C:\Windows\System\dfJWfOm.exe
  2⤵
  PID:11412
- C:\Windows\System\pTMJaTo.exe
  C:\Windows\System\pTMJaTo.exe
  2⤵
  PID:12292
- C:\Windows\System\YkIpjbE.exe
  C:\Windows\System\YkIpjbE.exe
  2⤵
  PID:12316
- C:\Windows\System\bkROxgD.exe
  C:\Windows\System\bkROxgD.exe
  2⤵
  PID:12340
- C:\Windows\System\QWzStXU.exe
  C:\Windows\System\QWzStXU.exe
  2⤵
  PID:12372
- C:\Windows\System\bYVMvAN.exe
  C:\Windows\System\bYVMvAN.exe
  2⤵
  PID:12400
- C:\Windows\System\YsLmSph.exe
  C:\Windows\System\YsLmSph.exe
  2⤵
  PID:12428
- C:\Windows\System\BJAOQRD.exe
  C:\Windows\System\BJAOQRD.exe
  2⤵
  PID:12448
- C:\Windows\System\flHPXcH.exe
  C:\Windows\System\flHPXcH.exe
  2⤵
  PID:12480
- C:\Windows\System\KtAyoRz.exe
  C:\Windows\System\KtAyoRz.exe
  2⤵
  PID:12504
- C:\Windows\System\zVGxohk.exe
  C:\Windows\System\zVGxohk.exe
  2⤵
  PID:12528
- C:\Windows\System\laehZjm.exe
  C:\Windows\System\laehZjm.exe
  2⤵
  PID:12556
- C:\Windows\System\HhKOPlg.exe
  C:\Windows\System\HhKOPlg.exe
  2⤵
  PID:12580
- C:\Windows\System\ELmhVhP.exe
  C:\Windows\System\ELmhVhP.exe
  2⤵
  PID:12604
- C:\Windows\System\wNZXBdB.exe
  C:\Windows\System\wNZXBdB.exe
  2⤵
  PID:12624
- C:\Windows\System\ZPPeJLQ.exe
  C:\Windows\System\ZPPeJLQ.exe
  2⤵
  PID:12648
- C:\Windows\System\syZvAcZ.exe
  C:\Windows\System\syZvAcZ.exe
  2⤵
  PID:12680
- C:\Windows\System\NDCTtgq.exe
  C:\Windows\System\NDCTtgq.exe
  2⤵
  PID:12704
- C:\Windows\System\GyVzeFf.exe
  C:\Windows\System\GyVzeFf.exe
  2⤵
  PID:12748
- C:\Windows\System\MljrrDM.exe
  C:\Windows\System\MljrrDM.exe
  2⤵
  PID:12780
- C:\Windows\System\rOVNewb.exe
  C:\Windows\System\rOVNewb.exe
  2⤵
  PID:12804
- C:\Windows\System\IKWvngU.exe
  C:\Windows\System\IKWvngU.exe
  2⤵
  PID:12824
- C:\Windows\System\vTRYAVY.exe
  C:\Windows\System\vTRYAVY.exe
  2⤵
  PID:12856
- C:\Windows\System\TKBTIQu.exe
  C:\Windows\System\TKBTIQu.exe
  2⤵
  PID:12880
- C:\Windows\System\lwLinUX.exe
  C:\Windows\System\lwLinUX.exe
  2⤵
  PID:12904
- C:\Windows\System\tDTkhfN.exe
  C:\Windows\System\tDTkhfN.exe
  2⤵
  PID:12924
- C:\Windows\System\SaGOvsg.exe
  C:\Windows\System\SaGOvsg.exe
  2⤵
  PID:12956
- C:\Windows\System\mohqgyq.exe
  C:\Windows\System\mohqgyq.exe
  2⤵
  PID:12980
- C:\Windows\System\HeyKDQN.exe
  C:\Windows\System\HeyKDQN.exe
  2⤵
  PID:13008
- C:\Windows\System\VGwHxtX.exe
  C:\Windows\System\VGwHxtX.exe
  2⤵
  PID:13032
- C:\Windows\System\kBAyPlM.exe
  C:\Windows\System\kBAyPlM.exe
  2⤵
  PID:13056
- C:\Windows\System\gsErvuS.exe
  C:\Windows\System\gsErvuS.exe
  2⤵
  PID:13076
- C:\Windows\System\VgzwgwI.exe
  C:\Windows\System\VgzwgwI.exe
  2⤵
  PID:13100
- C:\Windows\System\MlymjCP.exe
  C:\Windows\System\MlymjCP.exe
  2⤵
  PID:13116
- C:\Windows\System\jPYvUQK.exe
  C:\Windows\System\jPYvUQK.exe
  2⤵
  PID:13140
- C:\Windows\System\kGMXAVo.exe
  C:\Windows\System\kGMXAVo.exe
  2⤵
  PID:13172
- C:\Windows\System\yajrppU.exe
  C:\Windows\System\yajrppU.exe
  2⤵
  PID:13196
- C:\Windows\System\zlYSOGn.exe
  C:\Windows\System\zlYSOGn.exe
  2⤵
  PID:13220
- C:\Windows\System\jzOtIgc.exe
  C:\Windows\System\jzOtIgc.exe
  2⤵
  PID:13240
- C:\Windows\System\cdXDiCR.exe
  C:\Windows\System\cdXDiCR.exe
  2⤵
  PID:13272
- C:\Windows\System\Kjtwljp.exe
  C:\Windows\System\Kjtwljp.exe
  2⤵
  PID:13296
- C:\Windows\System\GndmcOU.exe
  C:\Windows\System\GndmcOU.exe
  2⤵
  PID:11616
- C:\Windows\System\QCMWzIW.exe
  C:\Windows\System\QCMWzIW.exe
  2⤵
  PID:11468
- C:\Windows\System\IKvqdqo.exe
  C:\Windows\System\IKvqdqo.exe
  2⤵
  PID:12172
- C:\Windows\System\lXaQPRz.exe
  C:\Windows\System\lXaQPRz.exe
  2⤵
  PID:10876
- C:\Windows\System\jwcMYWV.exe
  C:\Windows\System\jwcMYWV.exe
  2⤵
  PID:10292
- C:\Windows\System\lCUUuhK.exe
  C:\Windows\System\lCUUuhK.exe
  2⤵
  PID:1532
- C:\Windows\System\StzBWSr.exe
  C:\Windows\System\StzBWSr.exe
  2⤵
  PID:10396
- C:\Windows\System\ogsFmWz.exe
  C:\Windows\System\ogsFmWz.exe
  2⤵
  PID:12524
- C:\Windows\System\dOwEJcP.exe
  C:\Windows\System\dOwEJcP.exe
  2⤵
  PID:12600
- C:\Windows\System\JFhuDhy.exe
  C:\Windows\System\JFhuDhy.exe
  2⤵
  PID:12332
- C:\Windows\System\lzxKTbA.exe
  C:\Windows\System\lzxKTbA.exe
  2⤵
  PID:12420
- C:\Windows\System\pxlGPIG.exe
  C:\Windows\System\pxlGPIG.exe
  2⤵
  PID:12476
- C:\Windows\System\YuFJPfc.exe
  C:\Windows\System\YuFJPfc.exe
  2⤵
  PID:11236
- C:\Windows\System\aKGliDX.exe
  C:\Windows\System\aKGliDX.exe
  2⤵
  PID:11396
- C:\Windows\System\xLjVHRh.exe
  C:\Windows\System\xLjVHRh.exe
  2⤵
  PID:12996
- C:\Windows\System\mbZzLbG.exe
  C:\Windows\System\mbZzLbG.exe
  2⤵
  PID:12736
- C:\Windows\System\wbqsJsi.exe
  C:\Windows\System\wbqsJsi.exe
  2⤵
  PID:12800
- C:\Windows\System\IDJsQBZ.exe
  C:\Windows\System\IDJsQBZ.exe
  2⤵
  PID:12840
- C:\Windows\System\OFZhZjM.exe
  C:\Windows\System\OFZhZjM.exe
  2⤵
  PID:13288
- C:\Windows\System\bZoFhIC.exe
  C:\Windows\System\bZoFhIC.exe
  2⤵
  PID:12968
- C:\Windows\System\QnNLEFb.exe
  C:\Windows\System\QnNLEFb.exe
  2⤵
  PID:11004
- C:\Windows\System\ooYDkhh.exe
  C:\Windows\System\ooYDkhh.exe
  2⤵
  PID:13044
- C:\Windows\System\TECUKla.exe
  C:\Windows\System\TECUKla.exe
  2⤵
  PID:13324
- C:\Windows\System\OZoQmrm.exe
  C:\Windows\System\OZoQmrm.exe
  2⤵
  PID:13352
- C:\Windows\System\mpjvQqq.exe
  C:\Windows\System\mpjvQqq.exe
  2⤵
  PID:13372
- C:\Windows\System\RiuKEfG.exe
  C:\Windows\System\RiuKEfG.exe
  2⤵
  PID:13400
- C:\Windows\System\OdUNKdB.exe
  C:\Windows\System\OdUNKdB.exe
  2⤵
  PID:13416
- C:\Windows\System\xMLBPcG.exe
  C:\Windows\System\xMLBPcG.exe
  2⤵
  PID:13432
- C:\Windows\System\OCqkihp.exe
  C:\Windows\System\OCqkihp.exe
  2⤵
  PID:13456
- C:\Windows\System\GvlUFUm.exe
  C:\Windows\System\GvlUFUm.exe
  2⤵
  PID:13660
- C:\Windows\System\gqWQeuK.exe
  C:\Windows\System\gqWQeuK.exe
  2⤵
  PID:13680
- C:\Windows\System\CEIHNwf.exe
  C:\Windows\System\CEIHNwf.exe
  2⤵
  PID:13696
- C:\Windows\System\UnMhDSA.exe
  C:\Windows\System\UnMhDSA.exe
  2⤵
  PID:13712
- C:\Windows\System\HdoEZTl.exe
  C:\Windows\System\HdoEZTl.exe
  2⤵
  PID:13728
- C:\Windows\System\ySuzMcg.exe
  C:\Windows\System\ySuzMcg.exe
  2⤵
  PID:13744
- C:\Windows\System\TUlXfjB.exe
  C:\Windows\System\TUlXfjB.exe
  2⤵
  PID:13772
- C:\Windows\System\pJwUmJR.exe
  C:\Windows\System\pJwUmJR.exe
  2⤵
  PID:13820
- C:\Windows\System\opJDScN.exe
  C:\Windows\System\opJDScN.exe
  2⤵
  PID:13864
- C:\Windows\System\IGUQlmX.exe
  C:\Windows\System\IGUQlmX.exe
  2⤵
  PID:13916
- C:\Windows\System\ygtTuba.exe
  C:\Windows\System\ygtTuba.exe
  2⤵
  PID:13952
- C:\Windows\System\UOjDumC.exe
  C:\Windows\System\UOjDumC.exe
  2⤵
  PID:13980
- C:\Windows\System\ZCdNiCy.exe
  C:\Windows\System\ZCdNiCy.exe
  2⤵
  PID:14008
- C:\Windows\System\pzcFfHM.exe
  C:\Windows\System\pzcFfHM.exe
  2⤵
  PID:14036
- C:\Windows\System\EkcyADU.exe
  C:\Windows\System\EkcyADU.exe
  2⤵
  PID:14052
- C:\Windows\System\dLFYxzW.exe
  C:\Windows\System\dLFYxzW.exe
  2⤵
  PID:14088
- C:\Windows\System\nkclSHu.exe
  C:\Windows\System\nkclSHu.exe
  2⤵
  PID:14112
- C:\Windows\System\vKwNVSm.exe
  C:\Windows\System\vKwNVSm.exe
  2⤵
  PID:14136
- C:\Windows\System\WAmpUvp.exe
  C:\Windows\System\WAmpUvp.exe
  2⤵
  PID:14176
- C:\Windows\System\EBsFWTv.exe
  C:\Windows\System\EBsFWTv.exe
  2⤵
  PID:14220
- C:\Windows\System\bXdgxle.exe
  C:\Windows\System\bXdgxle.exe
  2⤵
  PID:14252
- C:\Windows\System\KJJJokG.exe
  C:\Windows\System\KJJJokG.exe
  2⤵
  PID:14284
- C:\Windows\System\vFhkEMx.exe
  C:\Windows\System\vFhkEMx.exe
  2⤵
  PID:14304
- C:\Windows\System\AJTaVij.exe
  C:\Windows\System\AJTaVij.exe
  2⤵
  PID:13068
- C:\Windows\System\xdIUSuC.exe
  C:\Windows\System\xdIUSuC.exe
  2⤵
  PID:13096
- C:\Windows\System\CLjfWXI.exe
  C:\Windows\System\CLjfWXI.exe
  2⤵
  PID:13132
- C:\Windows\System\aANItDc.exe
  C:\Windows\System\aANItDc.exe
  2⤵
  PID:12360
- C:\Windows\System\nHvwluX.exe
  C:\Windows\System\nHvwluX.exe
  2⤵
  PID:13308
- C:\Windows\System\SjDLsXZ.exe
  C:\Windows\System\SjDLsXZ.exe
  2⤵
  PID:11516
- C:\Windows\System\prYGGav.exe
  C:\Windows\System\prYGGav.exe
  2⤵
  PID:12992
- C:\Windows\System\vEhkkAO.exe
  C:\Windows\System\vEhkkAO.exe
  2⤵
  PID:12248
- C:\Windows\System\hLgndEO.exe
  C:\Windows\System\hLgndEO.exe
  2⤵
  PID:13392
- C:\Windows\System\raxzSAi.exe
  C:\Windows\System\raxzSAi.exe
  2⤵
  PID:11344
- C:\Windows\System\sNOUfjt.exe
  C:\Windows\System\sNOUfjt.exe
  2⤵
  PID:13228
- C:\Windows\System\XpgUjkX.exe
  C:\Windows\System\XpgUjkX.exe
  2⤵
  PID:13028
- C:\Windows\System\tTlmVKR.exe
  C:\Windows\System\tTlmVKR.exe
  2⤵
  PID:13480
- C:\Windows\System\EiSmFbm.exe
  C:\Windows\System\EiSmFbm.exe
  2⤵
  PID:13784
- C:\Windows\System\uiXrSOt.exe
  C:\Windows\System\uiXrSOt.exe
  2⤵
  PID:13804
- C:\Windows\System\LlyPTWR.exe
  C:\Windows\System\LlyPTWR.exe
  2⤵
  PID:13840
- C:\Windows\System\WAuiMew.exe
  C:\Windows\System\WAuiMew.exe
  2⤵
  PID:13876
- C:\Windows\System\BZHqlDb.exe
  C:\Windows\System\BZHqlDb.exe
  2⤵
  PID:13320
- C:\Windows\System\JhacGex.exe
  C:\Windows\System\JhacGex.exe
  2⤵
  PID:13428
- C:\Windows\System\fovLtPA.exe
  C:\Windows\System\fovLtPA.exe
  2⤵
  PID:13948
- C:\Windows\System\vJPpVvV.exe
  C:\Windows\System\vJPpVvV.exe
  2⤵
  PID:14016
- C:\Windows\System\tPMPyxj.exe
  C:\Windows\System\tPMPyxj.exe
  2⤵
  PID:13500
- C:\Windows\System\QJTkLXe.exe
  C:\Windows\System\QJTkLXe.exe
  2⤵
  PID:13592
- C:\Windows\System\CnxkVMi.exe
  C:\Windows\System\CnxkVMi.exe
  2⤵
  PID:13616
- C:\Windows\System\FrfgpYS.exe
  C:\Windows\System\FrfgpYS.exe
  2⤵
  PID:14240
- C:\Windows\System\VubXcKz.exe
  C:\Windows\System\VubXcKz.exe
  2⤵
  PID:12756
- C:\Windows\System\cVXmSOy.exe
  C:\Windows\System\cVXmSOy.exe
  2⤵
  PID:14080
- C:\Windows\System\ymaiggu.exe
  C:\Windows\System\ymaiggu.exe
  2⤵
  PID:13924
- C:\Windows\System\FuXvwHl.exe
  C:\Windows\System\FuXvwHl.exe
  2⤵
  PID:13364
- C:\Windows\System\dsbnzsm.exe
  C:\Windows\System\dsbnzsm.exe
  2⤵
  PID:14316
- C:\Windows\System\jLMxjrY.exe
  C:\Windows\System\jLMxjrY.exe
  2⤵
  PID:14340
- C:\Windows\System\BTvzBMo.exe
  C:\Windows\System\BTvzBMo.exe
  2⤵
  PID:14372
- C:\Windows\System\FtIBnuQ.exe
  C:\Windows\System\FtIBnuQ.exe
  2⤵
  PID:14408
- C:\Windows\System\miEjRBf.exe
  C:\Windows\System\miEjRBf.exe
  2⤵
  PID:14424
- C:\Windows\System\lznFWPL.exe
  C:\Windows\System\lznFWPL.exe
  2⤵
  PID:14448
- C:\Windows\System\QGeKpFu.exe
  C:\Windows\System\QGeKpFu.exe
  2⤵
  PID:14480
- C:\Windows\System\oWmoyas.exe
  C:\Windows\System\oWmoyas.exe
  2⤵
  PID:14504
- C:\Windows\System\aMBibCn.exe
  C:\Windows\System\aMBibCn.exe
  2⤵
  PID:14528
- C:\Windows\System\OBWgfqD.exe
  C:\Windows\System\OBWgfqD.exe
  2⤵
  PID:14544
- C:\Windows\System\TzEfzsb.exe
  C:\Windows\System\TzEfzsb.exe
  2⤵
  PID:14560
- C:\Windows\System\QgcqGmX.exe
  C:\Windows\System\QgcqGmX.exe
  2⤵
  PID:14584
- C:\Windows\System\InBufYe.exe
  C:\Windows\System\InBufYe.exe
  2⤵
  PID:14600
- C:\Windows\System\mRxjSHg.exe
  C:\Windows\System\mRxjSHg.exe
  2⤵
  PID:14620
- C:\Windows\System\GSceLik.exe
  C:\Windows\System\GSceLik.exe
  2⤵
  PID:14644
- C:\Windows\System\gMInaRx.exe
  C:\Windows\System\gMInaRx.exe
  2⤵
  PID:14664
- C:\Windows\System\KaIBPvh.exe
  C:\Windows\System\KaIBPvh.exe
  2⤵
  PID:14816
- C:\Windows\System\AYqhvvR.exe
  C:\Windows\System\AYqhvvR.exe
  2⤵
  PID:14836
- C:\Windows\System\fAaxCfQ.exe
  C:\Windows\System\fAaxCfQ.exe
  2⤵
  PID:14864
- C:\Windows\System\mDrJSxi.exe
  C:\Windows\System\mDrJSxi.exe
  2⤵
  PID:14896
- C:\Windows\System\NhwLbQa.exe
  C:\Windows\System\NhwLbQa.exe
  2⤵
  PID:14944
- C:\Windows\System\HipVyDt.exe
  C:\Windows\System\HipVyDt.exe
  2⤵
  PID:14972
- C:\Windows\System\WBbTnrn.exe
  C:\Windows\System\WBbTnrn.exe
  2⤵
  PID:14996
- C:\Windows\System\gYDYmKG.exe
  C:\Windows\System\gYDYmKG.exe
  2⤵
  PID:15024
- C:\Windows\System\HOIZLVB.exe
  C:\Windows\System\HOIZLVB.exe
  2⤵
  PID:15048
- C:\Windows\System\XAYvjAc.exe
  C:\Windows\System\XAYvjAc.exe
  2⤵
  PID:15096
- C:\Windows\System\oKipDxQ.exe
  C:\Windows\System\oKipDxQ.exe
  2⤵
  PID:15148
- C:\Windows\System\SqqcYdv.exe
  C:\Windows\System\SqqcYdv.exe
  2⤵
  PID:15176
- C:\Windows\System\UImGrTF.exe
  C:\Windows\System\UImGrTF.exe
  2⤵
  PID:15204
- C:\Windows\System\bXsVjIN.exe
  C:\Windows\System\bXsVjIN.exe
  2⤵
  PID:15248
- C:\Windows\System\RyMTFMv.exe
  C:\Windows\System\RyMTFMv.exe
  2⤵
  PID:15280
- C:\Windows\System\ZmsZbgW.exe
  C:\Windows\System\ZmsZbgW.exe
  2⤵
  PID:15296
- C:\Windows\System\nRsNJuH.exe
  C:\Windows\System\nRsNJuH.exe
  2⤵
  PID:15320
- C:\Windows\System\sBTXTrn.exe
  C:\Windows\System\sBTXTrn.exe
  2⤵
  PID:15340
- C:\Windows\System\HCNtHor.exe
  C:\Windows\System\HCNtHor.exe
  2⤵
  PID:12796
- C:\Windows\System\HGiMqWh.exe
  C:\Windows\System\HGiMqWh.exe
  2⤵
  PID:12864
- C:\Windows\System\QljDpdg.exe
  C:\Windows\System\QljDpdg.exe
  2⤵
  PID:13384
- C:\Windows\System\MfuRiSF.exe
  C:\Windows\System\MfuRiSF.exe
  2⤵
  PID:14196
- C:\Windows\System\NDeReEM.exe
  C:\Windows\System\NDeReEM.exe
  2⤵
  PID:14232
- C:\Windows\System\wwnVaXQ.exe
  C:\Windows\System\wwnVaXQ.exe
  2⤵
  PID:13752
- C:\Windows\System\UoWSleU.exe
  C:\Windows\System\UoWSleU.exe
  2⤵
  PID:14268
- C:\Windows\System\QfDpKAk.exe
  C:\Windows\System\QfDpKAk.exe
  2⤵
  PID:12820
- C:\Windows\System\VgwXQiK.exe
  C:\Windows\System\VgwXQiK.exe
  2⤵
  PID:10924
- C:\Windows\System\WuMXiuP.exe
  C:\Windows\System\WuMXiuP.exe
  2⤵
  PID:13348
- C:\Windows\System\xhjigZp.exe
  C:\Windows\System\xhjigZp.exe
  2⤵
  PID:12616
- C:\Windows\System\ciNCujf.exe
  C:\Windows\System\ciNCujf.exe
  2⤵
  PID:13512
- C:\Windows\System\HiRXlau.exe
  C:\Windows\System\HiRXlau.exe
  2⤵
  PID:14552
- C:\Windows\System\dJgTmov.exe
  C:\Windows\System\dJgTmov.exe
  2⤵
  PID:13944
- C:\Windows\System\rDXgoJO.exe
  C:\Windows\System\rDXgoJO.exe
  2⤵
  PID:14628
- C:\Windows\System\AamDTUo.exe
  C:\Windows\System\AamDTUo.exe
  2⤵
  PID:13704
- C:\Windows\System\dgPJgbZ.exe
  C:\Windows\System\dgPJgbZ.exe
  2⤵
  PID:14536
- C:\Windows\System\wuBiudr.exe
  C:\Windows\System\wuBiudr.exe
  2⤵
  PID:14592
- C:\Windows\System\ryVksFU.exe
  C:\Windows\System\ryVksFU.exe
  2⤵
  PID:14384
- C:\Windows\System\zOOKAJr.exe
  C:\Windows\System\zOOKAJr.exe
  2⤵
  PID:14888
- C:\Windows\System\riJiEeV.exe
  C:\Windows\System\riJiEeV.exe
  2⤵
  PID:14960
- C:\Windows\System\zboxFvE.exe
  C:\Windows\System\zboxFvE.exe
  2⤵
  PID:14756
- C:\Windows\System\FiAaelL.exe
  C:\Windows\System\FiAaelL.exe
  2⤵
  PID:14792
- C:\Windows\System\qxbCzVJ.exe
  C:\Windows\System\qxbCzVJ.exe
  2⤵
  PID:15244
- C:\Windows\System\uFudhYl.exe
  C:\Windows\System\uFudhYl.exe
  2⤵
  PID:15044
- C:\Windows\System\mGNJeLu.exe
  C:\Windows\System\mGNJeLu.exe
  2⤵
  PID:13736
- C:\Windows\System\tFWEhWk.exe
  C:\Windows\System\tFWEhWk.exe
  2⤵
  PID:14824
- C:\Windows\System\doQVsjv.exe
  C:\Windows\System\doQVsjv.exe
  2⤵
  PID:14876
- C:\Windows\System\UottJxX.exe
  C:\Windows\System\UottJxX.exe
  2⤵
  PID:15268
- C:\Windows\System\HsGZHbA.exe
  C:\Windows\System\HsGZHbA.exe
  2⤵
  PID:15364
- C:\Windows\System\FGRpkem.exe
  C:\Windows\System\FGRpkem.exe
  2⤵
  PID:15384
- C:\Windows\System\JthqEJq.exe
  C:\Windows\System\JthqEJq.exe
  2⤵
  PID:15420
- C:\Windows\System\aOvHiQU.exe
  C:\Windows\System\aOvHiQU.exe
  2⤵
  PID:15448
- C:\Windows\System\JFsSrhD.exe
  C:\Windows\System\JFsSrhD.exe
  2⤵
  PID:15464
- C:\Windows\System\CbWvmyJ.exe
  C:\Windows\System\CbWvmyJ.exe
  2⤵
  PID:15484
- C:\Windows\System\uflsvwL.exe
  C:\Windows\System\uflsvwL.exe
  2⤵
  PID:15500
- C:\Windows\System\fqWgQUT.exe
  C:\Windows\System\fqWgQUT.exe
  2⤵
  PID:15520
- C:\Windows\System\InbejDT.exe
  C:\Windows\System\InbejDT.exe
  2⤵
  PID:15544
- C:\Windows\System\eXMnfAX.exe
  C:\Windows\System\eXMnfAX.exe
  2⤵
  PID:15564
- C:\Windows\System\DICwwxq.exe
  C:\Windows\System\DICwwxq.exe
  2⤵
  PID:15584
- C:\Windows\System\sLFrIEb.exe
  C:\Windows\System\sLFrIEb.exe
  2⤵
  PID:15620
- C:\Windows\System\dYfCjJE.exe
  C:\Windows\System\dYfCjJE.exe
  2⤵
  PID:15644
- C:\Windows\System\JNcNJeH.exe
  C:\Windows\System\JNcNJeH.exe
  2⤵
  PID:15680
- C:\Windows\System\rYddgCU.exe
  C:\Windows\System\rYddgCU.exe
  2⤵
  PID:15696
- C:\Windows\System\QnraRpt.exe
  C:\Windows\System\QnraRpt.exe
  2⤵
  PID:15720
- C:\Windows\System\xMGGxez.exe
  C:\Windows\System\xMGGxez.exe
  2⤵
  PID:15744
- C:\Windows\System\qnEgHfk.exe
  C:\Windows\System\qnEgHfk.exe
  2⤵
  PID:15768
- C:\Windows\System\HNsUWbI.exe
  C:\Windows\System\HNsUWbI.exe
  2⤵
  PID:15788
- C:\Windows\System\mqbiZbh.exe
  C:\Windows\System\mqbiZbh.exe
  2⤵
  PID:15808
- C:\Windows\System\SvqAKHe.exe
  C:\Windows\System\SvqAKHe.exe
  2⤵
  PID:15840
- C:\Windows\System\AAhAgSE.exe
  C:\Windows\System\AAhAgSE.exe
  2⤵
  PID:15868
- C:\Windows\System\FMXTAke.exe
  C:\Windows\System\FMXTAke.exe
  2⤵
  PID:15888
- C:\Windows\System\ntUPIcJ.exe
  C:\Windows\System\ntUPIcJ.exe
  2⤵
  PID:16160
- C:\Windows\System\fpmpeSP.exe
  C:\Windows\System\fpmpeSP.exe
  2⤵
  PID:16176
- C:\Windows\System\ZQhrCMy.exe
  C:\Windows\System\ZQhrCMy.exe
  2⤵
  PID:16192
- C:\Windows\System\bUeZPml.exe
  C:\Windows\System\bUeZPml.exe
  2⤵
  PID:16208
- C:\Windows\System\oZWnwqy.exe
  C:\Windows\System\oZWnwqy.exe
  2⤵
  PID:16224
- C:\Windows\System\ThHyhGW.exe
  C:\Windows\System\ThHyhGW.exe
  2⤵
  PID:16252
- C:\Windows\System\nLrwEkM.exe
  C:\Windows\System\nLrwEkM.exe
  2⤵
  PID:16292
- C:\Windows\System\GBJjrsf.exe
  C:\Windows\System\GBJjrsf.exe
  2⤵
  PID:16308
- C:\Windows\System\mUQKFaD.exe
  C:\Windows\System\mUQKFaD.exe
  2⤵
  PID:16324
- C:\Windows\System\ESLSMmF.exe
  C:\Windows\System\ESLSMmF.exe
  2⤵
  PID:16360
- C:\Windows\System\ngMXjZm.exe
  C:\Windows\System\ngMXjZm.exe
  2⤵
  PID:16376
- C:\Windows\System\rokSJwd.exe
  C:\Windows\System\rokSJwd.exe
  2⤵
  PID:14044
- C:\Windows\System\uAhFTvB.exe
  C:\Windows\System\uAhFTvB.exe
  2⤵
  PID:15328
- C:\Windows\System\RgbohxK.exe
  C:\Windows\System\RgbohxK.exe
  2⤵
  PID:13584
- C:\Windows\System\UUhdgAH.exe
  C:\Windows\System\UUhdgAH.exe
  2⤵
  PID:11420
- C:\Windows\System\BHeyEwQ.exe
  C:\Windows\System\BHeyEwQ.exe
  2⤵
  PID:14200
- C:\Windows\System\uZeBHdN.exe
  C:\Windows\System\uZeBHdN.exe
  2⤵
  PID:12972
- C:\Windows\System\zsBjDUp.exe
  C:\Windows\System\zsBjDUp.exe
  2⤵
  PID:13672
- C:\Windows\System\uOFTJro.exe
  C:\Windows\System\uOFTJro.exe
  2⤵
  PID:15404
- C:\Windows\System\UapIvcx.exe
  C:\Windows\System\UapIvcx.exe
  2⤵
  PID:15496
- C:\Windows\System\tBrMbDN.exe
  C:\Windows\System\tBrMbDN.exe
  2⤵
  PID:14744
- C:\Windows\System\UrNwtnk.exe
  C:\Windows\System\UrNwtnk.exe
  2⤵
  PID:14104
- C:\Windows\System\QOrEaTF.exe
  C:\Windows\System\QOrEaTF.exe
  2⤵
  PID:14616
- C:\Windows\System\LEFzXyN.exe
  C:\Windows\System\LEFzXyN.exe
  2⤵
  PID:15516
- C:\Windows\System\APhruFt.exe
  C:\Windows\System\APhruFt.exe
  2⤵
  PID:15572
- C:\Windows\System\DThPTny.exe
  C:\Windows\System\DThPTny.exe
  2⤵
  PID:15656
- C:\Windows\System\WqWwpSw.exe
  C:\Windows\System\WqWwpSw.exe
  2⤵
  PID:15688
- C:\Windows\System\lBTgYmG.exe
  C:\Windows\System\lBTgYmG.exe
  2⤵
  PID:15756
- C:\Windows\System\WMQgLOU.exe
  C:\Windows\System\WMQgLOU.exe
  2⤵
  PID:15432
- C:\Windows\System\PYQMGXH.exe
  C:\Windows\System\PYQMGXH.exe
  2⤵
  PID:15692
- C:\Windows\System\DiqWzFe.exe
  C:\Windows\System\DiqWzFe.exe
  2⤵
  PID:15804
- C:\Windows\System\dcahXHH.exe
  C:\Windows\System\dcahXHH.exe
  2⤵
  PID:16056
- C:\Windows\System\pMBETRU.exe
  C:\Windows\System\pMBETRU.exe
  2⤵
  PID:16184
- C:\Windows\System\cggahYj.exe
  C:\Windows\System\cggahYj.exe
  2⤵
  PID:16204
- C:\Windows\System\NvBvfvp.exe
  C:\Windows\System\NvBvfvp.exe
  2⤵
  PID:16172
- C:\Windows\System\dhfdeDM.exe
  C:\Windows\System\dhfdeDM.exe
  2⤵
  PID:15116
- C:\Windows\System\edwwfzi.exe
  C:\Windows\System\edwwfzi.exe
  2⤵
  PID:16316
- C:\Windows\System\mWpokGh.exe
  C:\Windows\System\mWpokGh.exe
  2⤵
  PID:16348
- C:\Windows\System\GsoOxPq.exe
  C:\Windows\System\GsoOxPq.exe
  2⤵
  PID:12948
- C:\Windows\System\PRRaabK.exe
  C:\Windows\System\PRRaabK.exe
  2⤵
  PID:14064
- C:\Windows\System\XeeQlgZ.exe
  C:\Windows\System\XeeQlgZ.exe
  2⤵
  PID:10412
- C:\Windows\System\yaQkGbL.exe
  C:\Windows\System\yaQkGbL.exe
  2⤵
  PID:16392
- C:\Windows\System\BqHFyLN.exe
  C:\Windows\System\BqHFyLN.exe
  2⤵
  PID:16424
- C:\Windows\System\VGdbEEU.exe
  C:\Windows\System\VGdbEEU.exe
  2⤵
  PID:16444
- C:\Windows\System\LezxyiK.exe
  C:\Windows\System\LezxyiK.exe
  2⤵
  PID:16464
- C:\Windows\System\VBJxJcu.exe
  C:\Windows\System\VBJxJcu.exe
  2⤵
  PID:16484
- C:\Windows\System\zvjcjYk.exe
  C:\Windows\System\zvjcjYk.exe
  2⤵
  PID:16508
- C:\Windows\System\zMTdmQJ.exe
  C:\Windows\System\zMTdmQJ.exe
  2⤵
  PID:16524
- C:\Windows\System\JqljvYA.exe
  C:\Windows\System\JqljvYA.exe
  2⤵
  PID:16640
- C:\Windows\System\qqOwbOK.exe
  C:\Windows\System\qqOwbOK.exe
  2⤵
  PID:16656
- C:\Windows\System\ZUEreFN.exe
  C:\Windows\System\ZUEreFN.exe
  2⤵
  PID:16672
- C:\Windows\System\nnZvIhJ.exe
  C:\Windows\System\nnZvIhJ.exe
  2⤵
  PID:16688
- C:\Windows\System\dkzGXWB.exe
  C:\Windows\System\dkzGXWB.exe
  2⤵
  PID:16708
- C:\Windows\System\mRaoXzb.exe
  C:\Windows\System\mRaoXzb.exe
  2⤵
  PID:16740
- C:\Windows\System\TCGMDUx.exe
  C:\Windows\System\TCGMDUx.exe
  2⤵
  PID:16756
- C:\Windows\System\tpZobtG.exe
  C:\Windows\System\tpZobtG.exe
  2⤵
  PID:16772
- C:\Windows\System\cXIPCsj.exe
  C:\Windows\System\cXIPCsj.exe
  2⤵
  PID:16792
- C:\Windows\System\IziswHK.exe
  C:\Windows\System\IziswHK.exe
  2⤵
  PID:16808
- C:\Windows\System\YytVxSp.exe
  C:\Windows\System\YytVxSp.exe
  2⤵
  PID:16824
- C:\Windows\System\xGITVYf.exe
  C:\Windows\System\xGITVYf.exe
  2⤵
  PID:16844
- C:\Windows\System\NtokLqS.exe
  C:\Windows\System\NtokLqS.exe
  2⤵
  PID:16864
- C:\Windows\System\KUFKdcM.exe
  C:\Windows\System\KUFKdcM.exe
  2⤵
  PID:16988
- C:\Windows\System\pqAwUEu.exe
  C:\Windows\System\pqAwUEu.exe
  2⤵
  PID:17004
- C:\Windows\System\bTSwUQZ.exe
  C:\Windows\System\bTSwUQZ.exe
  2⤵
  PID:17024
- C:\Windows\System\KIQEoCQ.exe
  C:\Windows\System\KIQEoCQ.exe
  2⤵
  PID:17048
- C:\Windows\System\fmPqOMB.exe
  C:\Windows\System\fmPqOMB.exe
  2⤵
  PID:17080
- C:\Windows\System\KLefKqy.exe
  C:\Windows\System\KLefKqy.exe
  2⤵
  PID:17128
- C:\Windows\System\tQqcmhu.exe
  C:\Windows\System\tQqcmhu.exe
  2⤵
  PID:17168
- C:\Windows\System\IqVHaen.exe
  C:\Windows\System\IqVHaen.exe
  2⤵
  PID:17224
- C:\Windows\System\rpkCsKB.exe
  C:\Windows\System\rpkCsKB.exe
  2⤵
  PID:17260
- C:\Windows\System\TJKGxlx.exe
  C:\Windows\System\TJKGxlx.exe
  2⤵
  PID:17288
- C:\Windows\System\yoaDRDz.exe
  C:\Windows\System\yoaDRDz.exe
  2⤵
  PID:14524
- C:\Windows\System\gZTahSS.exe
  C:\Windows\System\gZTahSS.exe
  2⤵
  PID:15912
- C:\Windows\System\lRUjkOR.exe
  C:\Windows\System\lRUjkOR.exe
  2⤵
  PID:15512
- C:\Windows\System\zMJcxEr.exe
  C:\Windows\System\zMJcxEr.exe
  2⤵
  PID:15016
- C:\Windows\System\PmTQcJj.exe
  C:\Windows\System\PmTQcJj.exe
  2⤵
  PID:15856
- C:\Windows\System\fHPPAVh.exe
  C:\Windows\System\fHPPAVh.exe
  2⤵
  PID:16388
- C:\Windows\System\pdYSxOG.exe
  C:\Windows\System\pdYSxOG.exe
  2⤵
  PID:16816
- C:\Windows\System\DMbnoaP.exe
  C:\Windows\System\DMbnoaP.exe
  2⤵
  PID:16648
- C:\Windows\System\maQzwga.exe
  C:\Windows\System\maQzwga.exe
  2⤵
  PID:16872
- C:\Windows\System\wMsWCbM.exe
  C:\Windows\System\wMsWCbM.exe
  2⤵
  PID:16700

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CDVxLqK.exe

Filesize
1.8MB

MD5
c92d9bade0560ac8035886a20365acb6

SHA1
285b8d471a3e9d8bae807f2d7434d5cc7ce5dfd2

SHA256
c8065085fa73cbd0b3e712089fb9e46d40d40ca05170323f7395cbe53283cf98

SHA512
2a876915c53e5d82b262a5bb8d0b4bb6bae3375c7714ab738bb76031591fa3ff0867477b030e20e46f0de2d3cb81c737f2f8dfe70c713e94960198492f5b3a26

Download Submit
C:\Windows\System\FbdrkyK.exe

Filesize
1.8MB

MD5
dd1e5b69af104b2d6b36dc46336b1eea

SHA1
2251650052faef65a741c7020b72d8bb6399c34a

SHA256
5b29aa18be418c7800d9d7d1948ee5da2c60b62ec80ace10aeb73e801326f93b

SHA512
06255b1022e602c2eacdc7fdf7606c8eecba6b484ff15b111f462a15a88802eacf3c3e3319865eb896b5611a8de72eca66c520c2a0d57c7c4e5635a4a3c367ff

Download Submit
C:\Windows\System\FtiUxkb.exe

Filesize
1.8MB

MD5
25e133370fdcdb2fbe3bcedec84e0475

SHA1
4329f8b6f6b002c6ca640492bf0f14666b9f42bb

SHA256
4f8c2dc0411a08a68bf0d186f09d270aa4e65584e0f26913a111e60c4b37c474

SHA512
ed04bbe9d40505a682261afe7f8e0cd1aff3a46bfecbe22fafd16ddd20de14258a338f17743e8ea10c5c7744a8f34e53cd539d8f0ade7ce954503684e35fb21b

Download Submit
C:\Windows\System\HRaNmSl.exe

Filesize
1.8MB

MD5
6cb2213d1be3dd8a0bbb5ba208d11541

SHA1
a90bda172cd82edcde08fde61948e940814d20e6

SHA256
0d077fceebbca09d5dfa521ad1ad9c9dee2446113515bb82e99e1b1e07fabc0b

SHA512
5a2a34bd97188e96a34bf82c556977ce62f0486d5084cba61b31b4f5d76a10d773f86357902b838b64e54a35527f9fffb1098c41659016ee4c26a8ae516fde2f

Download Submit
C:\Windows\System\HVgVhPd.exe

Filesize
1.8MB

MD5
72ab6e91ee1c0459b58378f61e27f59b

SHA1
9c69df5647a5d6c3e79f82adebe208609a4dcad0

SHA256
32c40b7153d1743b15380f9e1c04b6e5ea05432c9be631725583dc1a04b0bd11

SHA512
d53bab1a287e97510ebdbada0af84a0aee691636d99b063c4f5ad4a6f6d8d251964690db03fe78671d0d51a7cbd37f75f887664839d717682cf8af1f87e37565

Download Submit
C:\Windows\System\HkSkHFB.exe

Filesize
1.8MB

MD5
444691ca7ec93f84c1b011cf75799575

SHA1
7d2246261cfcf7358d6f16de1a9d57e52285a5ac

SHA256
31580799b8ff41f1e82cf00ce985e3ae9ebe3277eb342dfd33773a0412e2beff

SHA512
c80ad54ded28a58ac9edb2bc7a25d67690ed6261654a3e76896ec04672f33e7d07a7f06a07802540d63a14d595f3c1f92d2f92c922ed6051afb1e5edfa2215b6

Download Submit
C:\Windows\System\NTTTbDf.exe

Filesize
1.8MB

MD5
497706c5528b61feda128d7756e4f0c7

SHA1
7fa63a993071a35cd06cba5d22b8cc33831bdd4d

SHA256
0bb85cf49fea4e5ec0035c3264c664aa965f3e38a4278ed059ab36e97916dd6a

SHA512
817e57f816f42953f470aff70c28729c754c15ab3e66f483a247bdfaca6bbf80e3edc2f36b43bc6c961e73e9ebff925927e85dec0668f727063a8c590b6dfa46

Download Submit
C:\Windows\System\ODHqHhp.exe

Filesize
1.8MB

MD5
2fad476d7d45b785a26f249487f6cb00

SHA1
c7f272d6d75f7970603bcc5c2b60bd365ef28e29

SHA256
fc42406b011b6766d8c958c08d58222ff53d9b5e55e9399790c344e529c552a0

SHA512
d4009e0b54123eaaca2d2951f89e6b14ffa698e9dcdef739edf0825ca7332797a6e4bdd82375e3edb60bb71025930343631e2c01bf690b517224132118eea6c0

Download Submit
C:\Windows\System\OeZHfZD.exe

Filesize
1.8MB

MD5
1ec153d68010494ec9bc7837c96fb0cc

SHA1
f41bfbd994f84a3e42f7cd082a217528aecfe9ef

SHA256
6d47efc2338f4307030f5ff7fcc97b5c2353cdb58e1e4e3cb0331c8c1d96d3b2

SHA512
94cd11950e381d4ca0f9923360f493b69bb297324a51c3a0980ef4a579f338d85494bc04abf43941c35cf9f0820c3d83979faba4e224a2670a5b32c1cd627d65

Download Submit
C:\Windows\System\OuycPmZ.exe

Filesize
1.8MB

MD5
2ff966d49769804ad787e8976a8c957f

SHA1
5bc5ed434c587d99ed0ba13bd141d82b7a8b2d64

SHA256
2ec2ccae0d963ca1265455fbafee967ffad49d0fdee385bacfd2757969ddffd7

SHA512
e23da2ef682e4e93b7e7e99b339b0628d782ab8717e2fd9dd20f74086202a468e99d9e341e71e642ee085d518fe425a40d1e5e9858cab210a86c6ff86369ea3e

Download Submit
C:\Windows\System\QjqSDcf.exe

Filesize
1.8MB

MD5
22c97877195c6f820da58585c7f06168

SHA1
8876c9739416122517d624346341af1679caacd5

SHA256
710a6a78e3e281c69eb17a2e775428d02899272cd3c251fd83926b76b01461bb

SHA512
a8054b2e2c742b3077d8a95aa7a4d9e1f8b3a919012fcffdffce00727b5918e2cc6e438954d61649d1ff65f87ab1c9493a5f14c8b3ba7356a0516635a1df9164

Download Submit
C:\Windows\System\RPLorRB.exe

Filesize
1.8MB

MD5
bbc9e02cda7aaed541f3bbdb2825dfae

SHA1
baa9546bdef8d5e03e55c5532a0b59aa661f8be5

SHA256
11cc07e6302a601454c35e22270e946178696a8a622dc921d74920af0205312b

SHA512
46dab0093be9cf32335b18b325de74a4973ed60e77e7a512bce1dfc9b2b522b244b9fa438294bce45458249330d2d5f00c8f35800e374175c107c2b668b61905

Download Submit
C:\Windows\System\RYWwjhH.exe

Filesize
1.8MB

MD5
d2316213648d39c57dbe8a9f9cd1da77

SHA1
e27c021c6004a93c09654afc7c82c5f5e73eab1c

SHA256
eccf2c83061276fcefcf96fa7a2b5b9596ea5455a13bc6d14f973f5ce0e66d53

SHA512
f0a639f3094169d07e489894355046754de66cdb329186b72202bf815f114827f22aa86b5e92ed0e98afb7a9dac6280c529921b9f40fb98fbd114ce57cab4a98

Download Submit
C:\Windows\System\VGGwTXG.exe

Filesize
1.8MB

MD5
d6cd5a16e76c8ca2b758263d3f8ac07a

SHA1
fc5739b8f7148a5acee3377722cfaefae83ed160

SHA256
e3452b69adccde11cff71c3578913ad7444c6dd9c195d1d2a2e00a202a8ce24b

SHA512
d89bd7ca8d26fd3a1cdfe206a21f1fb869967361ee181485b7830bc19e284d82c2e5953da1cfe867134d6100efe1d4db2e491ba1c7d1b65d363e1c3af1f591ce

Download Submit
C:\Windows\System\WVNYTvb.exe

Filesize
1.8MB

MD5
3d7a93cb576d318b678251b2ff790ead

SHA1
38843814b368a73f416003a825be990a7fc10c6f

SHA256
fdd3c67ea922362721e8e097a86f569e654266bf46102829e9de839a41cd1c9b

SHA512
1ce8a36ee48d41fd84e70d5969d5732df151c68eee8813381e363dadc40ed0d4a5a6ea29ed2d5d81b949c3a6e9600d538e529555d83e760e290167251972124f

Download Submit
C:\Windows\System\WkKPQxI.exe

Filesize
1.8MB

MD5
9e337c0f4db8470cf67b6d27361854d5

SHA1
b8e01f9000dcbb171715dbca7fe64ac4e2df3153

SHA256
3bac113d719851caa71b3ecd48b4babd00ae927c1f5f14fd9ebe78638bd2ac7d

SHA512
85fa9a93f44611dc5e661d140fe77003974e5e5e001cd231cf8310064eb44444386eb3614844b03d34a313957934243384cd2a9e7382cf45508aa86bc64311de

Download Submit
C:\Windows\System\XQtcfcu.exe

Filesize
1.8MB

MD5
f2502d0160cbd6186519bb7580580326

SHA1
79ce3d64b8a9ad3e6763880c3ef0217b247f488b

SHA256
8453ca81db718397330381c3bf1a37c752c93245d8278d61e4cb3b443ca70f6e

SHA512
d4db927c60d802aa2a759c348d4d2eeea783f16d956338ab8522ab5009d06d954cdb410d538b3f083512c0924d1f8d0a2d29e0ac4dcc5326c5244c70ce573c96

Download Submit
C:\Windows\System\ZIXXwPq.exe

Filesize
1.8MB

MD5
a110bd1ff62e2ba54742858985f55683

SHA1
e53685b7cf478fb434c4aed441c6587e7042d459

SHA256
67cabc71fff294af1f6eb634d87a5c00c7cb929e2a842d8befb554da13ddd5a0

SHA512
517388b2ca3aca6ed87e6a18c21a2045f5928f54261fb9059b33317780111b3237adac84be9aa6fd17be797b5d2031c22ecf8d51f44631176a56eb78b8b02aad

Download Submit
C:\Windows\System\cNnQTZF.exe

Filesize
1.8MB

MD5
669da160a0652d745b36b4cea69ff83d

SHA1
c647d0df3c638959175fd008f8971f69f4bc10aa

SHA256
4c2ec9ad40f646860bb7ea3a3bb5c227d881ea51936b5fa48aac1e8ab562a05d

SHA512
216842df79b9d9c483794eb47ab49e6a45003a44b3d793dd2cd3a6fe2fab6cbae9ea990757d308ca061217cc61f9266a3c5d86f1b5bc2f2881bddaed6a13b732

Download Submit
C:\Windows\System\eEaXQPi.exe

Filesize
1.8MB

MD5
697a879affd8e56f8727474e865ff93e

SHA1
04c4a344d973bb54efb3ff8f56b77592c57adfee

SHA256
55486e2029929ecd393faff2dbd6adcd186c8d05dbe4909bbebd65f07b1faa36

SHA512
cd6e8a3e09285bca1880d9be3a0acde8b3682e82ab8e5853b87acecb05741bf33b2e8faa46e610bb48c651d6f43762325fde7cf49f53a01c012482bbd61be9bf

Download Submit
C:\Windows\System\hOpZveI.exe

Filesize
1.8MB

MD5
a9b433ef08d8dca82f0a8c939ab65f9a

SHA1
1f8792dcf6d1d78bef98d8e46712baf3ac6fd73f

SHA256
ecec2fa6990b9523464acabaa510b86a2869ccbba505b0856ba6f7a729f22591

SHA512
d3ea122bb99787ddcbace8377b21f01b397358841587e8c43513cbcfb57b0408e3840ed7d36929bc05ac6a81ee8ad22363e9c26c4436d12d0582cd1857193b39

Download Submit
C:\Windows\System\jzCgpPQ.exe

Filesize
1.8MB

MD5
f2b1cfcb718ee291d0584ef30b15df0d

SHA1
06b74f6f0cbf522f6b2c731bce8086f33df3f227

SHA256
57ee38715effe8a7b4c342fafff657f398666356ca8b61400ad8fcef485efc83

SHA512
1247e79cf9a0d6ef64971982d8eec59e14ff8fcfffbcb9d03f762cb3a0f359a5519c383c80634ea4d09f7e933f8f7ca51f9acb76ecced97a8904a9ed8468814c

Download Submit
C:\Windows\System\lVstEZV.exe

Filesize
1.8MB

MD5
dcc5af521e2ce9820e4982cb91a67891

SHA1
b9122fd525f05e5b36eaddb85041ffcbea1b33af

SHA256
e278cc13f4c466c986ff1146a6f3549ab7cf6608c2eac3738e4432e73d3bc509

SHA512
6a2318f651c0f4f31581a0b1c3362f0086ebf6932ae622892402e872479b73f2aa53f7a3b7debdd9d5bcbf5c50199b92ad19018bb233ae919ea4290bb048557f

Download Submit
C:\Windows\System\mAOrlSH.exe

Filesize
1.8MB

MD5
8dba9d5225b1a1473d3c075422e80a7e

SHA1
98277b62d0d2d493660799cb0218d61c11d01fa5

SHA256
5aba59f6cae1105947f7a00fcf1b4eac857e709de193a484ff132ebcf3c202c6

SHA512
59f0850822b1d2af77af053990779f8eea95070947eb883f34de04959b77d164e1d32c66891c92c552264a537e733e1ec909ffa20f99d74b780d0b479b488fb0

Download Submit
C:\Windows\System\rKexite.exe

Filesize
1.8MB

MD5
efbbb4c037ef644b2b6d9fa453dd9810

SHA1
1efbcd5b1261b066841074d6a48e96c49ff686c8

SHA256
6ebcbf3b66e4a860c3c0d994285d27608b5d81a5ef6243633b5fa88bd6a72c53

SHA512
2b74c57299b844d638d1b5c3b840dd428627f0488a507c769c6af63a05a42bce51ca2222c7eb70ca4e5ac77fb9337cf98c983859b49fa0add14cec072eb6b227

Download Submit
C:\Windows\System\rQqeema.exe

Filesize
1.8MB

MD5
2cfe8d9098d5cd48cca1db0f926e110e

SHA1
69a3b435df8deb216e44a40c7b26866110d6ba6e

SHA256
3d1f1fad051fdca118f1a5270e8dcdabae257e46b0ff37167f185d11fcb4fccd

SHA512
5622e920d0262ea72729993bf907484ca056ce0596b7623075b4a447e69e7ca5e2fe028191d0da01947489f412cf80374812ced9fb1f4d4616887741b6a425e7

Download Submit
C:\Windows\System\rqYPpDC.exe

Filesize
1.8MB

MD5
f8d4b806991a67633eb67115e87843ce

SHA1
13ebb5d74f13e3ec1c0624d0bb7212d4681cc44b

SHA256
696e96013a3889b29edbea3ef8b4bac4de24d13841fbba8879be0141eb4aefe1

SHA512
bcdb2a7e38aeda006ae8242fa23b60e6c2ccd0bae4f8078d17995249ce2ae8ce9d4575133058cde1075c661d2c3571987c06b93e18f531951e787019beb73052

Download Submit
C:\Windows\System\sAxSnub.exe

Filesize
1.8MB

MD5
39219bbd15b735b6f6cdd3c169ae0e90

SHA1
93f471838c8aed325ccc6e3afb61a293b6723838

SHA256
3eb6a6d52ac6a59307ac7cfb4009d5bca5d5b2d7c18b4a3859de704f2a7afc99

SHA512
40a48de15b70d5346a15a4ba75829e81b2c3265ce1346eeb8f86f379e571a18632412ee0a7cea8a7570e9eab3f6227357b42e48179ffd7698d9a86ba08cc5d59

Download Submit
C:\Windows\System\tuvrtoG.exe

Filesize
1.8MB

MD5
50ec214087c11d015b6d52bb460f48bb

SHA1
f48f43c70ca6c1add8929a467734c5ce44d4af95

SHA256
84b9af63815ed8807a2c248dfafeb81105f0b6c10f47701d891be29f1a2feba5

SHA512
8da63927bce47fa101a5d15dd50b30d72f5323aa92f2520d65a53cacf5b64438f032870074c5f0f9795ad55fc53d49237f24590b97b4eef1a4cd721f57c108a0

Download Submit
C:\Windows\System\xJuITJc.exe

Filesize
1.8MB

MD5
206933412c92cf1fa8b0e1902706c90b

SHA1
d5dfdba5803be234b96f25f0c39f43894cd69ef5

SHA256
0884c61543a0d36408c301e5553a765aa1f9eafe6af75fbcc258530c289df962

SHA512
1cb3ae593d53c12df093a74504e443c6e6f0eee42887ccae1651932a40a4d0bd94f486300fe429c1e89d8c5c7d6ffb703de46e074d7ddfe5d3d2c294bb4d0552

Download Submit
C:\Windows\System\xgGCrqf.exe

Filesize
1.8MB

MD5
8014b075380fc651aa5183cf0cead502

SHA1
19472b34ae4b4c56d2c0a17a885437899ebc7988

SHA256
cb01fd82a3943e83faa581c09fc068aadf790c51fca21cc2eb8c6acb0a815a38

SHA512
87a4847b3cac768fca1c164cf17d9c2ddd0c55e0a432d6008472dbb9dba25c33fd7918f8b8b33e92b5cb32c8af18f1c0ec9f394f93e97a394801dc51e61c0fb8

Download Submit
C:\Windows\System\xzgItEo.exe

Filesize
1.8MB

MD5
4b35cf38090d3155dfa7ba09e9265089

SHA1
1a5cec7d3faacc46339e53ad856196c95bbeb84c

SHA256
0fa53212e9d667a983e8e724e7717572970bb80347c3b83653f2ec43f8497987

SHA512
209685d41296761cad5fafde0d538af4300e17efe77a3579ecec04f154dbc1ababd7c2e95653e4bb887ba1ec2afac2f8d8643d277deb6bd0c095a0958d7e1a95

Download Submit
C:\Windows\System\zhTSMbN.exe

Filesize
1.8MB

MD5
cc3258cca15050b73b143f72860d5140

SHA1
3124d9974de817fc97cbe1283cb30082d0a51f79

SHA256
b88ceec0c7bcbb3b196e909e923ae885f5fffe2c71eddfb38558f23fa82d107b

SHA512
a9fc69ed5b91c8bdbb6a8ae89a17d5d58820164f4324c4b8f67790001472d61a2aa41c918f943b2f6372f22b6129b480588af650ff00f752198ebf5e94e12843

Download Submit
memory/464-0-0x00000207202A0000-0x00000207202B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads