xmrig | 62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
Size

1.7MB
MD5

37e348af0ef30fb8def60400bcfe7f8c
SHA1

c54eb732eee958bb35c46ed7a7e2c21341c6f253
SHA256

62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935
SHA512

5f1549fb7487796310c10f16f6fde71b5eb271e092356b0a2389cc32fce6234b7379b82b444966e1bdd1cf2027bcaeb7096a561011f44098272836ebf1f9b8e9
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLjAu:GemTLkNdfE0pZy8

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023c6c-3.dat	xmrig
behavioral2/files/0x0007000000023c78-9.dat	xmrig
behavioral2/files/0x0007000000023c79-8.dat	xmrig
behavioral2/files/0x0007000000023c7c-30.dat	xmrig
behavioral2/files/0x0007000000023c7d-35.dat	xmrig
behavioral2/files/0x0007000000023c82-60.dat	xmrig
behavioral2/files/0x0007000000023c83-68.dat	xmrig
behavioral2/files/0x0007000000023c87-84.dat	xmrig
behavioral2/files/0x0007000000023c8f-128.dat	xmrig
behavioral2/files/0x0007000000023c93-148.dat	xmrig
behavioral2/files/0x0007000000023c97-162.dat	xmrig
behavioral2/files/0x0007000000023c96-159.dat	xmrig
behavioral2/files/0x0007000000023c95-157.dat	xmrig
behavioral2/files/0x0007000000023c94-153.dat	xmrig
behavioral2/files/0x0007000000023c92-142.dat	xmrig
behavioral2/files/0x0007000000023c91-138.dat	xmrig
behavioral2/files/0x0007000000023c90-132.dat	xmrig
behavioral2/files/0x0007000000023c8e-120.dat	xmrig
behavioral2/files/0x0007000000023c8d-118.dat	xmrig
behavioral2/files/0x0007000000023c8c-112.dat	xmrig
behavioral2/files/0x0007000000023c8b-108.dat	xmrig
behavioral2/files/0x0007000000023c8a-102.dat	xmrig
behavioral2/files/0x0007000000023c89-98.dat	xmrig
behavioral2/files/0x0007000000023c88-92.dat	xmrig
behavioral2/files/0x0007000000023c86-82.dat	xmrig
behavioral2/files/0x0007000000023c85-78.dat	xmrig
behavioral2/files/0x0007000000023c84-72.dat	xmrig
behavioral2/files/0x0007000000023c81-58.dat	xmrig
behavioral2/files/0x0007000000023c80-50.dat	xmrig
behavioral2/files/0x0007000000023c7f-45.dat	xmrig
behavioral2/files/0x0007000000023c7e-40.dat	xmrig
behavioral2/files/0x0007000000023c7b-25.dat	xmrig
behavioral2/files/0x0007000000023c7a-20.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3364	sDGdcJf.exe
2284	ksKBgDe.exe
3644	eQXWxwI.exe
2380	WapaPoe.exe
2808	eByIOJb.exe
2316	pFpwwvi.exe
4148	wNzGlvF.exe
3404	kWKCJhR.exe
3568	sZxTiZa.exe
4136	IWDncWA.exe
4288	xcIxDMp.exe
1512	pHTjcJP.exe
768	HuGeYMr.exe
4560	IfdGEth.exe
4244	PMFjEEX.exe
1992	DmRaAcN.exe
2432	oTJpLKs.exe
3664	votzAdk.exe
4972	ElxQsSy.exe
3496	nbXfBcO.exe
4072	LUtGMfL.exe
432	FxCNclz.exe
3164	RSveQrz.exe
1196	gYlbLCZ.exe
4756	yGEEIde.exe
4704	ihYEsyJ.exe
372	FUNnzZE.exe
5064	ZHqtEED.exe
4624	WjEbUYc.exe
2148	MsJGNOE.exe
1036	TNPlWZj.exe
1884	BvCxwFy.exe
1684	UkTYhqo.exe
760	siLicZR.exe
3640	xgnhvFC.exe
2996	rMrexKW.exe
3752	HTGtEUU.exe
1168	MNNofhl.exe
2300	AqjtVLD.exe
1852	thhKQtJ.exe
3244	rDetgKb.exe
4260	WVTfxWK.exe
5000	CqNQCgp.exe
2588	mkjjhFZ.exe
2624	BPmPRvN.exe
2392	HFFqApT.exe
100	xtTYLyy.exe
3488	LAhDiYM.exe
1008	vRAATCJ.exe
2456	OWyEWhg.exe
2368	DOKoUGO.exe
5112	RnUZTHD.exe
3140	aLJpXyJ.exe
3972	IuxpuXZ.exe
460	tkqlrBm.exe
2244	LfPEQIm.exe
4812	baanDeQ.exe
4324	MkzVmMy.exe
4760	YnlTPkj.exe
4408	UOYGZVv.exe
2468	DfzJztT.exe
2004	vXoyIkp.exe
2660	APbnROm.exe
2288	TOmEDky.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TaoHheL.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\eDHmEyq.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\tpxsLBX.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\dxnhHmQ.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\OWyEWhg.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\oJjveeH.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\gYlbLCZ.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\lmPoIJa.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\mvGRxdm.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\vazCuwY.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\YyrCFPy.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\Qcbtxni.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\MlcpcwZ.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\XucLCfc.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\YHSZqlE.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\dkNNdNM.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\zrvcpBI.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\CoFeDTa.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\BEQpqoW.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\QasvrWw.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\WKCRgun.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\ZddxCnb.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\FrvKVKr.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\iVqcYLR.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\XTgNLCV.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\TgRuciw.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\aLJpXyJ.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\eehKuYK.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\fWUGdsZ.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\UuUXNwk.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\UOYGZVv.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\QawBtkB.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\YlDOvDz.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\zADAvRj.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\mFMUJwV.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\ENSoDsc.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\HernHfh.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\xvsuThW.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\BKlKAoL.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\jccWxPk.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\xcIxDMp.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\ZlKKwtO.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\kadbCpb.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\wUrrqnn.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\IyTxLyr.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\UCGkesx.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\MEMpXay.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\RezMGTB.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\CZMHdgW.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\GUXcHVh.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\jfvoati.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\ysrgNml.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\vVnHtfT.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\VDxuxKG.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\WQIQOwb.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\iUvqHVq.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\KptmdaK.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\EMdtjAz.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\qbhMHxq.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\afsEocZ.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\rCUhdxQ.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\QRbYsQn.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\thhKQtJ.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
File created	C:\Windows\System\gllTZGi.exe	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17296	dwm.exe
Token: SeChangeNotifyPrivilege	17296	dwm.exe
Token: 33	17296	dwm.exe
Token: SeIncBasePriorityPrivilege	17296	dwm.exe
Token: SeShutdownPrivilege	17296	dwm.exe
Token: SeCreatePagefilePrivilege	17296	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 3364	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	83
PID 3708 wrote to memory of 3364	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	83
PID 3708 wrote to memory of 2284	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	84
PID 3708 wrote to memory of 2284	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	84
PID 3708 wrote to memory of 3644	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	85
PID 3708 wrote to memory of 3644	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	85
PID 3708 wrote to memory of 2380	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	86
PID 3708 wrote to memory of 2380	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	86
PID 3708 wrote to memory of 2808	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	87
PID 3708 wrote to memory of 2808	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	87
PID 3708 wrote to memory of 2316	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	88
PID 3708 wrote to memory of 2316	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	88
PID 3708 wrote to memory of 4148	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	89
PID 3708 wrote to memory of 4148	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	89
PID 3708 wrote to memory of 3404	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	90
PID 3708 wrote to memory of 3404	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	90
PID 3708 wrote to memory of 3568	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	91
PID 3708 wrote to memory of 3568	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	91
PID 3708 wrote to memory of 4136	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	92
PID 3708 wrote to memory of 4136	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	92
PID 3708 wrote to memory of 4288	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	93
PID 3708 wrote to memory of 4288	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	93
PID 3708 wrote to memory of 1512	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	94
PID 3708 wrote to memory of 1512	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	94
PID 3708 wrote to memory of 768	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	95
PID 3708 wrote to memory of 768	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	95
PID 3708 wrote to memory of 4560	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	96
PID 3708 wrote to memory of 4560	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	96
PID 3708 wrote to memory of 4244	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	97
PID 3708 wrote to memory of 4244	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	97
PID 3708 wrote to memory of 1992	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	98
PID 3708 wrote to memory of 1992	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	98
PID 3708 wrote to memory of 2432	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	99
PID 3708 wrote to memory of 2432	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	99
PID 3708 wrote to memory of 3664	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	100
PID 3708 wrote to memory of 3664	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	100
PID 3708 wrote to memory of 4972	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	101
PID 3708 wrote to memory of 4972	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	101
PID 3708 wrote to memory of 3496	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	102
PID 3708 wrote to memory of 3496	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	102
PID 3708 wrote to memory of 4072	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	103
PID 3708 wrote to memory of 4072	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	103
PID 3708 wrote to memory of 432	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	104
PID 3708 wrote to memory of 432	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	104
PID 3708 wrote to memory of 3164	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	105
PID 3708 wrote to memory of 3164	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	105
PID 3708 wrote to memory of 1196	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	106
PID 3708 wrote to memory of 1196	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	106
PID 3708 wrote to memory of 4756	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	107
PID 3708 wrote to memory of 4756	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	107
PID 3708 wrote to memory of 4704	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	108
PID 3708 wrote to memory of 4704	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	108
PID 3708 wrote to memory of 372	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	109
PID 3708 wrote to memory of 372	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	109
PID 3708 wrote to memory of 5064	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	110
PID 3708 wrote to memory of 5064	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	110
PID 3708 wrote to memory of 4624	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	111
PID 3708 wrote to memory of 4624	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	111
PID 3708 wrote to memory of 2148	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	112
PID 3708 wrote to memory of 2148	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	112
PID 3708 wrote to memory of 1036	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	113
PID 3708 wrote to memory of 1036	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	113
PID 3708 wrote to memory of 1884	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	114
PID 3708 wrote to memory of 1884	3708	62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe	114

C:\Users\Admin\AppData\Local\Temp\62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe
"C:\Users\Admin\AppData\Local\Temp\62cfd9ae486231a40f439846425963a6f1105b8adc9b473dc239f3cab8f92935.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\System\sDGdcJf.exe
  C:\Windows\System\sDGdcJf.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\ksKBgDe.exe
  C:\Windows\System\ksKBgDe.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\eQXWxwI.exe
  C:\Windows\System\eQXWxwI.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\WapaPoe.exe
  C:\Windows\System\WapaPoe.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\eByIOJb.exe
  C:\Windows\System\eByIOJb.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\pFpwwvi.exe
  C:\Windows\System\pFpwwvi.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\wNzGlvF.exe
  C:\Windows\System\wNzGlvF.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\kWKCJhR.exe
  C:\Windows\System\kWKCJhR.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\sZxTiZa.exe
  C:\Windows\System\sZxTiZa.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\IWDncWA.exe
  C:\Windows\System\IWDncWA.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\xcIxDMp.exe
  C:\Windows\System\xcIxDMp.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\pHTjcJP.exe
  C:\Windows\System\pHTjcJP.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\HuGeYMr.exe
  C:\Windows\System\HuGeYMr.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\IfdGEth.exe
  C:\Windows\System\IfdGEth.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\PMFjEEX.exe
  C:\Windows\System\PMFjEEX.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\DmRaAcN.exe
  C:\Windows\System\DmRaAcN.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\oTJpLKs.exe
  C:\Windows\System\oTJpLKs.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\votzAdk.exe
  C:\Windows\System\votzAdk.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\ElxQsSy.exe
  C:\Windows\System\ElxQsSy.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\nbXfBcO.exe
  C:\Windows\System\nbXfBcO.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\LUtGMfL.exe
  C:\Windows\System\LUtGMfL.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\FxCNclz.exe
  C:\Windows\System\FxCNclz.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\RSveQrz.exe
  C:\Windows\System\RSveQrz.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\gYlbLCZ.exe
  C:\Windows\System\gYlbLCZ.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\yGEEIde.exe
  C:\Windows\System\yGEEIde.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\ihYEsyJ.exe
  C:\Windows\System\ihYEsyJ.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\FUNnzZE.exe
  C:\Windows\System\FUNnzZE.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\ZHqtEED.exe
  C:\Windows\System\ZHqtEED.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\WjEbUYc.exe
  C:\Windows\System\WjEbUYc.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\MsJGNOE.exe
  C:\Windows\System\MsJGNOE.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\TNPlWZj.exe
  C:\Windows\System\TNPlWZj.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\BvCxwFy.exe
  C:\Windows\System\BvCxwFy.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\UkTYhqo.exe
  C:\Windows\System\UkTYhqo.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\siLicZR.exe
  C:\Windows\System\siLicZR.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\xgnhvFC.exe
  C:\Windows\System\xgnhvFC.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\rMrexKW.exe
  C:\Windows\System\rMrexKW.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\HTGtEUU.exe
  C:\Windows\System\HTGtEUU.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\MNNofhl.exe
  C:\Windows\System\MNNofhl.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\AqjtVLD.exe
  C:\Windows\System\AqjtVLD.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\thhKQtJ.exe
  C:\Windows\System\thhKQtJ.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\rDetgKb.exe
  C:\Windows\System\rDetgKb.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\WVTfxWK.exe
  C:\Windows\System\WVTfxWK.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\CqNQCgp.exe
  C:\Windows\System\CqNQCgp.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\mkjjhFZ.exe
  C:\Windows\System\mkjjhFZ.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\BPmPRvN.exe
  C:\Windows\System\BPmPRvN.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\HFFqApT.exe
  C:\Windows\System\HFFqApT.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\xtTYLyy.exe
  C:\Windows\System\xtTYLyy.exe
  2⤵
  - Executes dropped EXE
  PID:100
- C:\Windows\System\LAhDiYM.exe
  C:\Windows\System\LAhDiYM.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\vRAATCJ.exe
  C:\Windows\System\vRAATCJ.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\OWyEWhg.exe
  C:\Windows\System\OWyEWhg.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\DOKoUGO.exe
  C:\Windows\System\DOKoUGO.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\RnUZTHD.exe
  C:\Windows\System\RnUZTHD.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\aLJpXyJ.exe
  C:\Windows\System\aLJpXyJ.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\IuxpuXZ.exe
  C:\Windows\System\IuxpuXZ.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\tkqlrBm.exe
  C:\Windows\System\tkqlrBm.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\LfPEQIm.exe
  C:\Windows\System\LfPEQIm.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\baanDeQ.exe
  C:\Windows\System\baanDeQ.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\MkzVmMy.exe
  C:\Windows\System\MkzVmMy.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\YnlTPkj.exe
  C:\Windows\System\YnlTPkj.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\UOYGZVv.exe
  C:\Windows\System\UOYGZVv.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\DfzJztT.exe
  C:\Windows\System\DfzJztT.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\vXoyIkp.exe
  C:\Windows\System\vXoyIkp.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\APbnROm.exe
  C:\Windows\System\APbnROm.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\TOmEDky.exe
  C:\Windows\System\TOmEDky.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\XZmEAPi.exe
  C:\Windows\System\XZmEAPi.exe
  2⤵
  PID:2204
- C:\Windows\System\LtRtlhy.exe
  C:\Windows\System\LtRtlhy.exe
  2⤵
  PID:4888
- C:\Windows\System\iFvyRfz.exe
  C:\Windows\System\iFvyRfz.exe
  2⤵
  PID:1300
- C:\Windows\System\Eybdapn.exe
  C:\Windows\System\Eybdapn.exe
  2⤵
  PID:2520
- C:\Windows\System\aRCbdUE.exe
  C:\Windows\System\aRCbdUE.exe
  2⤵
  PID:2116
- C:\Windows\System\MlcpcwZ.exe
  C:\Windows\System\MlcpcwZ.exe
  2⤵
  PID:3908
- C:\Windows\System\XTgNLCV.exe
  C:\Windows\System\XTgNLCV.exe
  2⤵
  PID:3412
- C:\Windows\System\eehKuYK.exe
  C:\Windows\System\eehKuYK.exe
  2⤵
  PID:2700
- C:\Windows\System\vazCuwY.exe
  C:\Windows\System\vazCuwY.exe
  2⤵
  PID:4268
- C:\Windows\System\uBZiwUf.exe
  C:\Windows\System\uBZiwUf.exe
  2⤵
  PID:1672
- C:\Windows\System\pRmbdoX.exe
  C:\Windows\System\pRmbdoX.exe
  2⤵
  PID:3168
- C:\Windows\System\inBnatK.exe
  C:\Windows\System\inBnatK.exe
  2⤵
  PID:2328
- C:\Windows\System\udHKsvW.exe
  C:\Windows\System\udHKsvW.exe
  2⤵
  PID:2040
- C:\Windows\System\WeIyjKd.exe
  C:\Windows\System\WeIyjKd.exe
  2⤵
  PID:1668
- C:\Windows\System\cwlpkmU.exe
  C:\Windows\System\cwlpkmU.exe
  2⤵
  PID:3692
- C:\Windows\System\WfIvhOP.exe
  C:\Windows\System\WfIvhOP.exe
  2⤵
  PID:3012
- C:\Windows\System\QasvrWw.exe
  C:\Windows\System\QasvrWw.exe
  2⤵
  PID:3344
- C:\Windows\System\pzeSzhs.exe
  C:\Windows\System\pzeSzhs.exe
  2⤵
  PID:3288
- C:\Windows\System\WKCRgun.exe
  C:\Windows\System\WKCRgun.exe
  2⤵
  PID:4012
- C:\Windows\System\YRyrFZf.exe
  C:\Windows\System\YRyrFZf.exe
  2⤵
  PID:4404
- C:\Windows\System\qdZgMTj.exe
  C:\Windows\System\qdZgMTj.exe
  2⤵
  PID:4388
- C:\Windows\System\hDwlkUH.exe
  C:\Windows\System\hDwlkUH.exe
  2⤵
  PID:3116
- C:\Windows\System\xvsuThW.exe
  C:\Windows\System\xvsuThW.exe
  2⤵
  PID:1636
- C:\Windows\System\pThwGXa.exe
  C:\Windows\System\pThwGXa.exe
  2⤵
  PID:2924
- C:\Windows\System\zaFrcLm.exe
  C:\Windows\System\zaFrcLm.exe
  2⤵
  PID:2100
- C:\Windows\System\MHhgTbN.exe
  C:\Windows\System\MHhgTbN.exe
  2⤵
  PID:868
- C:\Windows\System\pQumEWP.exe
  C:\Windows\System\pQumEWP.exe
  2⤵
  PID:1100
- C:\Windows\System\UWJNCvY.exe
  C:\Windows\System\UWJNCvY.exe
  2⤵
  PID:5128
- C:\Windows\System\EHSzVWb.exe
  C:\Windows\System\EHSzVWb.exe
  2⤵
  PID:5160
- C:\Windows\System\AasiwPe.exe
  C:\Windows\System\AasiwPe.exe
  2⤵
  PID:5184
- C:\Windows\System\QiSWeFq.exe
  C:\Windows\System\QiSWeFq.exe
  2⤵
  PID:5216
- C:\Windows\System\yqxweAL.exe
  C:\Windows\System\yqxweAL.exe
  2⤵
  PID:5264
- C:\Windows\System\CXDuCGM.exe
  C:\Windows\System\CXDuCGM.exe
  2⤵
  PID:5280
- C:\Windows\System\IWcOrWS.exe
  C:\Windows\System\IWcOrWS.exe
  2⤵
  PID:5296
- C:\Windows\System\ODBmkUu.exe
  C:\Windows\System\ODBmkUu.exe
  2⤵
  PID:5320
- C:\Windows\System\dkNNdNM.exe
  C:\Windows\System\dkNNdNM.exe
  2⤵
  PID:5348
- C:\Windows\System\jgJfiAB.exe
  C:\Windows\System\jgJfiAB.exe
  2⤵
  PID:5376
- C:\Windows\System\PDYJYgR.exe
  C:\Windows\System\PDYJYgR.exe
  2⤵
  PID:5404
- C:\Windows\System\JECWLCL.exe
  C:\Windows\System\JECWLCL.exe
  2⤵
  PID:5436
- C:\Windows\System\bvdbvWE.exe
  C:\Windows\System\bvdbvWE.exe
  2⤵
  PID:5464
- C:\Windows\System\MYuKLpr.exe
  C:\Windows\System\MYuKLpr.exe
  2⤵
  PID:5492
- C:\Windows\System\WUQVMhF.exe
  C:\Windows\System\WUQVMhF.exe
  2⤵
  PID:5516
- C:\Windows\System\EHnVXCv.exe
  C:\Windows\System\EHnVXCv.exe
  2⤵
  PID:5544
- C:\Windows\System\hTBFZdf.exe
  C:\Windows\System\hTBFZdf.exe
  2⤵
  PID:5576
- C:\Windows\System\tQQAbBi.exe
  C:\Windows\System\tQQAbBi.exe
  2⤵
  PID:5600
- C:\Windows\System\zYOQVmO.exe
  C:\Windows\System\zYOQVmO.exe
  2⤵
  PID:5628
- C:\Windows\System\hunlIus.exe
  C:\Windows\System\hunlIus.exe
  2⤵
  PID:5660
- C:\Windows\System\wJrGPbj.exe
  C:\Windows\System\wJrGPbj.exe
  2⤵
  PID:5676
- C:\Windows\System\bNnSTNf.exe
  C:\Windows\System\bNnSTNf.exe
  2⤵
  PID:5704
- C:\Windows\System\scUwLtZ.exe
  C:\Windows\System\scUwLtZ.exe
  2⤵
  PID:5732
- C:\Windows\System\NqcbhlR.exe
  C:\Windows\System\NqcbhlR.exe
  2⤵
  PID:5760
- C:\Windows\System\FzoxInh.exe
  C:\Windows\System\FzoxInh.exe
  2⤵
  PID:5784
- C:\Windows\System\EBwamfF.exe
  C:\Windows\System\EBwamfF.exe
  2⤵
  PID:5816
- C:\Windows\System\UOTpCof.exe
  C:\Windows\System\UOTpCof.exe
  2⤵
  PID:5844
- C:\Windows\System\PUtuBjI.exe
  C:\Windows\System\PUtuBjI.exe
  2⤵
  PID:5872
- C:\Windows\System\NIsRtwF.exe
  C:\Windows\System\NIsRtwF.exe
  2⤵
  PID:5900
- C:\Windows\System\GtpsSdo.exe
  C:\Windows\System\GtpsSdo.exe
  2⤵
  PID:5928
- C:\Windows\System\hXioEbr.exe
  C:\Windows\System\hXioEbr.exe
  2⤵
  PID:5956
- C:\Windows\System\qDRRTGK.exe
  C:\Windows\System\qDRRTGK.exe
  2⤵
  PID:5984
- C:\Windows\System\NUhgSgH.exe
  C:\Windows\System\NUhgSgH.exe
  2⤵
  PID:6008
- C:\Windows\System\GyPtieQ.exe
  C:\Windows\System\GyPtieQ.exe
  2⤵
  PID:6036
- C:\Windows\System\gghUlNj.exe
  C:\Windows\System\gghUlNj.exe
  2⤵
  PID:6068
- C:\Windows\System\VKjjhdW.exe
  C:\Windows\System\VKjjhdW.exe
  2⤵
  PID:6096
- C:\Windows\System\jZEixdj.exe
  C:\Windows\System\jZEixdj.exe
  2⤵
  PID:6124
- C:\Windows\System\BdurmVX.exe
  C:\Windows\System\BdurmVX.exe
  2⤵
  PID:1736
- C:\Windows\System\LXPamNF.exe
  C:\Windows\System\LXPamNF.exe
  2⤵
  PID:2584
- C:\Windows\System\QjCQExt.exe
  C:\Windows\System\QjCQExt.exe
  2⤵
  PID:2504
- C:\Windows\System\RDNfSrK.exe
  C:\Windows\System\RDNfSrK.exe
  2⤵
  PID:3860
- C:\Windows\System\YiYQLZo.exe
  C:\Windows\System\YiYQLZo.exe
  2⤵
  PID:5080
- C:\Windows\System\aEGKOJS.exe
  C:\Windows\System\aEGKOJS.exe
  2⤵
  PID:4044
- C:\Windows\System\BwBEjVA.exe
  C:\Windows\System\BwBEjVA.exe
  2⤵
  PID:4396
- C:\Windows\System\ljOFioz.exe
  C:\Windows\System\ljOFioz.exe
  2⤵
  PID:5176
- C:\Windows\System\JCEULhw.exe
  C:\Windows\System\JCEULhw.exe
  2⤵
  PID:5228
- C:\Windows\System\qVxobMD.exe
  C:\Windows\System\qVxobMD.exe
  2⤵
  PID:5288
- C:\Windows\System\pajHuIN.exe
  C:\Windows\System\pajHuIN.exe
  2⤵
  PID:5344
- C:\Windows\System\zOlghib.exe
  C:\Windows\System\zOlghib.exe
  2⤵
  PID:5420
- C:\Windows\System\SQNkqdZ.exe
  C:\Windows\System\SQNkqdZ.exe
  2⤵
  PID:5476
- C:\Windows\System\obnazUA.exe
  C:\Windows\System\obnazUA.exe
  2⤵
  PID:5540
- C:\Windows\System\MnaqdKH.exe
  C:\Windows\System\MnaqdKH.exe
  2⤵
  PID:5620
- C:\Windows\System\SKpleaC.exe
  C:\Windows\System\SKpleaC.exe
  2⤵
  PID:5692
- C:\Windows\System\jIvwzGX.exe
  C:\Windows\System\jIvwzGX.exe
  2⤵
  PID:5752
- C:\Windows\System\wnpipcM.exe
  C:\Windows\System\wnpipcM.exe
  2⤵
  PID:5804
- C:\Windows\System\FwYNKhY.exe
  C:\Windows\System\FwYNKhY.exe
  2⤵
  PID:5860
- C:\Windows\System\sblafXp.exe
  C:\Windows\System\sblafXp.exe
  2⤵
  PID:5920
- C:\Windows\System\ifYTKiX.exe
  C:\Windows\System\ifYTKiX.exe
  2⤵
  PID:5976
- C:\Windows\System\YjmdhXR.exe
  C:\Windows\System\YjmdhXR.exe
  2⤵
  PID:6052
- C:\Windows\System\dDBMrfU.exe
  C:\Windows\System\dDBMrfU.exe
  2⤵
  PID:6116
- C:\Windows\System\PeotICr.exe
  C:\Windows\System\PeotICr.exe
  2⤵
  PID:1860
- C:\Windows\System\zIqOpHh.exe
  C:\Windows\System\zIqOpHh.exe
  2⤵
  PID:2892
- C:\Windows\System\YyrCFPy.exe
  C:\Windows\System\YyrCFPy.exe
  2⤵
  PID:884
- C:\Windows\System\akWCUZm.exe
  C:\Windows\System\akWCUZm.exe
  2⤵
  PID:5204
- C:\Windows\System\DHUBZvU.exe
  C:\Windows\System\DHUBZvU.exe
  2⤵
  PID:5336
- C:\Windows\System\jBCEGWm.exe
  C:\Windows\System\jBCEGWm.exe
  2⤵
  PID:5508
- C:\Windows\System\bmTWUMX.exe
  C:\Windows\System\bmTWUMX.exe
  2⤵
  PID:5668
- C:\Windows\System\lrSeSfa.exe
  C:\Windows\System\lrSeSfa.exe
  2⤵
  PID:5800
- C:\Windows\System\UhPhLqJ.exe
  C:\Windows\System\UhPhLqJ.exe
  2⤵
  PID:5916
- C:\Windows\System\cULtkuT.exe
  C:\Windows\System\cULtkuT.exe
  2⤵
  PID:6168
- C:\Windows\System\ceuslpE.exe
  C:\Windows\System\ceuslpE.exe
  2⤵
  PID:6196
- C:\Windows\System\QPBZIZn.exe
  C:\Windows\System\QPBZIZn.exe
  2⤵
  PID:6224
- C:\Windows\System\RTrLRRs.exe
  C:\Windows\System\RTrLRRs.exe
  2⤵
  PID:6252
- C:\Windows\System\PNqnnnu.exe
  C:\Windows\System\PNqnnnu.exe
  2⤵
  PID:6284
- C:\Windows\System\tfHtSfL.exe
  C:\Windows\System\tfHtSfL.exe
  2⤵
  PID:6308
- C:\Windows\System\EoOjlNR.exe
  C:\Windows\System\EoOjlNR.exe
  2⤵
  PID:6336
- C:\Windows\System\bGfLwKj.exe
  C:\Windows\System\bGfLwKj.exe
  2⤵
  PID:6364
- C:\Windows\System\zzFaqOm.exe
  C:\Windows\System\zzFaqOm.exe
  2⤵
  PID:6392
- C:\Windows\System\sIjKTeM.exe
  C:\Windows\System\sIjKTeM.exe
  2⤵
  PID:6420
- C:\Windows\System\zVLXkrt.exe
  C:\Windows\System\zVLXkrt.exe
  2⤵
  PID:6448
- C:\Windows\System\wFKvyaL.exe
  C:\Windows\System\wFKvyaL.exe
  2⤵
  PID:6476
- C:\Windows\System\phMHjSD.exe
  C:\Windows\System\phMHjSD.exe
  2⤵
  PID:6504
- C:\Windows\System\OgHmwMP.exe
  C:\Windows\System\OgHmwMP.exe
  2⤵
  PID:6532
- C:\Windows\System\JqgeCMh.exe
  C:\Windows\System\JqgeCMh.exe
  2⤵
  PID:6560
- C:\Windows\System\zkAPjwN.exe
  C:\Windows\System\zkAPjwN.exe
  2⤵
  PID:6588
- C:\Windows\System\BZnXoXv.exe
  C:\Windows\System\BZnXoXv.exe
  2⤵
  PID:6616
- C:\Windows\System\IKEJDTf.exe
  C:\Windows\System\IKEJDTf.exe
  2⤵
  PID:6644
- C:\Windows\System\UKrDCvw.exe
  C:\Windows\System\UKrDCvw.exe
  2⤵
  PID:6672
- C:\Windows\System\RezMGTB.exe
  C:\Windows\System\RezMGTB.exe
  2⤵
  PID:6700
- C:\Windows\System\XrRQwnd.exe
  C:\Windows\System\XrRQwnd.exe
  2⤵
  PID:6732
- C:\Windows\System\qbhMHxq.exe
  C:\Windows\System\qbhMHxq.exe
  2⤵
  PID:6756
- C:\Windows\System\IUQeAWB.exe
  C:\Windows\System\IUQeAWB.exe
  2⤵
  PID:6784
- C:\Windows\System\gxkgYnJ.exe
  C:\Windows\System\gxkgYnJ.exe
  2⤵
  PID:6812
- C:\Windows\System\rvtkmRR.exe
  C:\Windows\System\rvtkmRR.exe
  2⤵
  PID:6840
- C:\Windows\System\HGMNuEP.exe
  C:\Windows\System\HGMNuEP.exe
  2⤵
  PID:6868
- C:\Windows\System\NkwAOux.exe
  C:\Windows\System\NkwAOux.exe
  2⤵
  PID:6896
- C:\Windows\System\ZlKKwtO.exe
  C:\Windows\System\ZlKKwtO.exe
  2⤵
  PID:6928
- C:\Windows\System\NmMDEmZ.exe
  C:\Windows\System\NmMDEmZ.exe
  2⤵
  PID:6956
- C:\Windows\System\xXWtgCH.exe
  C:\Windows\System\xXWtgCH.exe
  2⤵
  PID:6984
- C:\Windows\System\JAKLKZg.exe
  C:\Windows\System\JAKLKZg.exe
  2⤵
  PID:7012
- C:\Windows\System\rJdhKEt.exe
  C:\Windows\System\rJdhKEt.exe
  2⤵
  PID:7040
- C:\Windows\System\jwilokf.exe
  C:\Windows\System\jwilokf.exe
  2⤵
  PID:7068
- C:\Windows\System\EKCIKHZ.exe
  C:\Windows\System\EKCIKHZ.exe
  2⤵
  PID:7096
- C:\Windows\System\WNvMiOY.exe
  C:\Windows\System\WNvMiOY.exe
  2⤵
  PID:7124
- C:\Windows\System\qgctzpf.exe
  C:\Windows\System\qgctzpf.exe
  2⤵
  PID:7152
- C:\Windows\System\vAcLEBR.exe
  C:\Windows\System\vAcLEBR.exe
  2⤵
  PID:220
- C:\Windows\System\rWOekyl.exe
  C:\Windows\System\rWOekyl.exe
  2⤵
  PID:3304
- C:\Windows\System\OkDuUpx.exe
  C:\Windows\System\OkDuUpx.exe
  2⤵
  PID:2056
- C:\Windows\System\tlFdNgp.exe
  C:\Windows\System\tlFdNgp.exe
  2⤵
  PID:5396
- C:\Windows\System\DFVvENS.exe
  C:\Windows\System\DFVvENS.exe
  2⤵
  PID:2292
- C:\Windows\System\yivrlfa.exe
  C:\Windows\System\yivrlfa.exe
  2⤵
  PID:6264
- C:\Windows\System\TYiNGmf.exe
  C:\Windows\System\TYiNGmf.exe
  2⤵
  PID:6324
- C:\Windows\System\PQELdrL.exe
  C:\Windows\System\PQELdrL.exe
  2⤵
  PID:6384
- C:\Windows\System\rUSHUNs.exe
  C:\Windows\System\rUSHUNs.exe
  2⤵
  PID:6468
- C:\Windows\System\gjqBAuA.exe
  C:\Windows\System\gjqBAuA.exe
  2⤵
  PID:6524
- C:\Windows\System\XkePvRp.exe
  C:\Windows\System\XkePvRp.exe
  2⤵
  PID:6552
- C:\Windows\System\XIwFJxJ.exe
  C:\Windows\System\XIwFJxJ.exe
  2⤵
  PID:6632
- C:\Windows\System\BAKZVUY.exe
  C:\Windows\System\BAKZVUY.exe
  2⤵
  PID:6660
- C:\Windows\System\IEKkzlb.exe
  C:\Windows\System\IEKkzlb.exe
  2⤵
  PID:6716
- C:\Windows\System\BPxWAul.exe
  C:\Windows\System\BPxWAul.exe
  2⤵
  PID:6796
- C:\Windows\System\LzFxRlG.exe
  C:\Windows\System\LzFxRlG.exe
  2⤵
  PID:6828
- C:\Windows\System\vWgQwAH.exe
  C:\Windows\System\vWgQwAH.exe
  2⤵
  PID:6856
- C:\Windows\System\SuMorrh.exe
  C:\Windows\System\SuMorrh.exe
  2⤵
  PID:6912
- C:\Windows\System\MmizAaz.exe
  C:\Windows\System\MmizAaz.exe
  2⤵
  PID:6968
- C:\Windows\System\HdZRdsJ.exe
  C:\Windows\System\HdZRdsJ.exe
  2⤵
  PID:7004
- C:\Windows\System\yBkgnXN.exe
  C:\Windows\System\yBkgnXN.exe
  2⤵
  PID:608
- C:\Windows\System\oicOCNW.exe
  C:\Windows\System\oicOCNW.exe
  2⤵
  PID:5092
- C:\Windows\System\sxbAmnJ.exe
  C:\Windows\System\sxbAmnJ.exe
  2⤵
  PID:4924
- C:\Windows\System\hUXlKcd.exe
  C:\Windows\System\hUXlKcd.exe
  2⤵
  PID:6032
- C:\Windows\System\XPpHqFR.exe
  C:\Windows\System\XPpHqFR.exe
  2⤵
  PID:3440
- C:\Windows\System\uommJdS.exe
  C:\Windows\System\uommJdS.exe
  2⤵
  PID:5276
- C:\Windows\System\pOZmEMJ.exe
  C:\Windows\System\pOZmEMJ.exe
  2⤵
  PID:1872
- C:\Windows\System\DBWnQrn.exe
  C:\Windows\System\DBWnQrn.exe
  2⤵
  PID:4576
- C:\Windows\System\BwTmjoP.exe
  C:\Windows\System\BwTmjoP.exe
  2⤵
  PID:1692
- C:\Windows\System\mnvXffK.exe
  C:\Windows\System\mnvXffK.exe
  2⤵
  PID:6184
- C:\Windows\System\vcrpYZg.exe
  C:\Windows\System\vcrpYZg.exe
  2⤵
  PID:6240
- C:\Windows\System\dVehfCa.exe
  C:\Windows\System\dVehfCa.exe
  2⤵
  PID:6464
- C:\Windows\System\NvJkIAf.exe
  C:\Windows\System\NvJkIAf.exe
  2⤵
  PID:6580
- C:\Windows\System\OluBtrj.exe
  C:\Windows\System\OluBtrj.exe
  2⤵
  PID:6712
- C:\Windows\System\SLlHgdV.exe
  C:\Windows\System\SLlHgdV.exe
  2⤵
  PID:6768
- C:\Windows\System\HybPJhv.exe
  C:\Windows\System\HybPJhv.exe
  2⤵
  PID:6948
- C:\Windows\System\aYhiibH.exe
  C:\Windows\System\aYhiibH.exe
  2⤵
  PID:7032
- C:\Windows\System\zVIQBmM.exe
  C:\Windows\System\zVIQBmM.exe
  2⤵
  PID:7108
- C:\Windows\System\HnlcIiL.exe
  C:\Windows\System\HnlcIiL.exe
  2⤵
  PID:3948
- C:\Windows\System\FqfNhYN.exe
  C:\Windows\System\FqfNhYN.exe
  2⤵
  PID:3104
- C:\Windows\System\SbGfzWA.exe
  C:\Windows\System\SbGfzWA.exe
  2⤵
  PID:2664
- C:\Windows\System\IoQXPni.exe
  C:\Windows\System\IoQXPni.exe
  2⤵
  PID:4316
- C:\Windows\System\zNBvFWv.exe
  C:\Windows\System\zNBvFWv.exe
  2⤵
  PID:6852
- C:\Windows\System\OPOuOkE.exe
  C:\Windows\System\OPOuOkE.exe
  2⤵
  PID:6976
- C:\Windows\System\LOOTOnt.exe
  C:\Windows\System\LOOTOnt.exe
  2⤵
  PID:6088
- C:\Windows\System\ZVCAqTl.exe
  C:\Windows\System\ZVCAqTl.exe
  2⤵
  PID:5072
- C:\Windows\System\JzFJFEv.exe
  C:\Windows\System\JzFJFEv.exe
  2⤵
  PID:4228
- C:\Windows\System\czvPVfa.exe
  C:\Windows\System\czvPVfa.exe
  2⤵
  PID:6460
- C:\Windows\System\LSFgJaF.exe
  C:\Windows\System\LSFgJaF.exe
  2⤵
  PID:2872
- C:\Windows\System\wUrrqnn.exe
  C:\Windows\System\wUrrqnn.exe
  2⤵
  PID:7192
- C:\Windows\System\cpwLXJv.exe
  C:\Windows\System\cpwLXJv.exe
  2⤵
  PID:7208
- C:\Windows\System\sjiUzMY.exe
  C:\Windows\System\sjiUzMY.exe
  2⤵
  PID:7228
- C:\Windows\System\MbscGZh.exe
  C:\Windows\System\MbscGZh.exe
  2⤵
  PID:7276
- C:\Windows\System\XucLCfc.exe
  C:\Windows\System\XucLCfc.exe
  2⤵
  PID:7292
- C:\Windows\System\FNUAhil.exe
  C:\Windows\System\FNUAhil.exe
  2⤵
  PID:7324
- C:\Windows\System\NEjbnqC.exe
  C:\Windows\System\NEjbnqC.exe
  2⤵
  PID:7348
- C:\Windows\System\eWEfKAS.exe
  C:\Windows\System\eWEfKAS.exe
  2⤵
  PID:7364
- C:\Windows\System\NtzbwMY.exe
  C:\Windows\System\NtzbwMY.exe
  2⤵
  PID:7380
- C:\Windows\System\psimotL.exe
  C:\Windows\System\psimotL.exe
  2⤵
  PID:7412
- C:\Windows\System\ZBUShGL.exe
  C:\Windows\System\ZBUShGL.exe
  2⤵
  PID:7468
- C:\Windows\System\fBCmUMw.exe
  C:\Windows\System\fBCmUMw.exe
  2⤵
  PID:7500
- C:\Windows\System\OdMQAEB.exe
  C:\Windows\System\OdMQAEB.exe
  2⤵
  PID:7520
- C:\Windows\System\agmlnBz.exe
  C:\Windows\System\agmlnBz.exe
  2⤵
  PID:7544
- C:\Windows\System\Zrqrlfm.exe
  C:\Windows\System\Zrqrlfm.exe
  2⤵
  PID:7572
- C:\Windows\System\beWDQfO.exe
  C:\Windows\System\beWDQfO.exe
  2⤵
  PID:7604
- C:\Windows\System\ASRGwgV.exe
  C:\Windows\System\ASRGwgV.exe
  2⤵
  PID:7632
- C:\Windows\System\iSwZGKk.exe
  C:\Windows\System\iSwZGKk.exe
  2⤵
  PID:7656
- C:\Windows\System\eDHmEyq.exe
  C:\Windows\System\eDHmEyq.exe
  2⤵
  PID:7688
- C:\Windows\System\vyvgTPy.exe
  C:\Windows\System\vyvgTPy.exe
  2⤵
  PID:7724
- C:\Windows\System\brHkGwe.exe
  C:\Windows\System\brHkGwe.exe
  2⤵
  PID:7752
- C:\Windows\System\deHEVnJ.exe
  C:\Windows\System\deHEVnJ.exe
  2⤵
  PID:7768
- C:\Windows\System\WwvnmJE.exe
  C:\Windows\System\WwvnmJE.exe
  2⤵
  PID:7796
- C:\Windows\System\NAidKkL.exe
  C:\Windows\System\NAidKkL.exe
  2⤵
  PID:7824
- C:\Windows\System\YmiMCpu.exe
  C:\Windows\System\YmiMCpu.exe
  2⤵
  PID:7856
- C:\Windows\System\JkTvGCg.exe
  C:\Windows\System\JkTvGCg.exe
  2⤵
  PID:7892
- C:\Windows\System\VEdrYPU.exe
  C:\Windows\System\VEdrYPU.exe
  2⤵
  PID:7908
- C:\Windows\System\anSuYVr.exe
  C:\Windows\System\anSuYVr.exe
  2⤵
  PID:7936
- C:\Windows\System\tpxsLBX.exe
  C:\Windows\System\tpxsLBX.exe
  2⤵
  PID:7964
- C:\Windows\System\KaPIlGm.exe
  C:\Windows\System\KaPIlGm.exe
  2⤵
  PID:8004
- C:\Windows\System\mFMUJwV.exe
  C:\Windows\System\mFMUJwV.exe
  2⤵
  PID:8032
- C:\Windows\System\xJLHpoj.exe
  C:\Windows\System\xJLHpoj.exe
  2⤵
  PID:8056
- C:\Windows\System\skevCTo.exe
  C:\Windows\System\skevCTo.exe
  2⤵
  PID:8080
- C:\Windows\System\JfElquR.exe
  C:\Windows\System\JfElquR.exe
  2⤵
  PID:8104
- C:\Windows\System\DtTiadK.exe
  C:\Windows\System\DtTiadK.exe
  2⤵
  PID:8144
- C:\Windows\System\gBhhXXs.exe
  C:\Windows\System\gBhhXXs.exe
  2⤵
  PID:8168
- C:\Windows\System\mGbbWGr.exe
  C:\Windows\System\mGbbWGr.exe
  2⤵
  PID:7180
- C:\Windows\System\WPbUMzA.exe
  C:\Windows\System\WPbUMzA.exe
  2⤵
  PID:4472
- C:\Windows\System\OGOcfdV.exe
  C:\Windows\System\OGOcfdV.exe
  2⤵
  PID:7312
- C:\Windows\System\tBtMBPp.exe
  C:\Windows\System\tBtMBPp.exe
  2⤵
  PID:7340
- C:\Windows\System\zqSNwvj.exe
  C:\Windows\System\zqSNwvj.exe
  2⤵
  PID:7400
- C:\Windows\System\Ufphyze.exe
  C:\Windows\System\Ufphyze.exe
  2⤵
  PID:7508
- C:\Windows\System\wOgnTeV.exe
  C:\Windows\System\wOgnTeV.exe
  2⤵
  PID:7536
- C:\Windows\System\ZLkoLyO.exe
  C:\Windows\System\ZLkoLyO.exe
  2⤵
  PID:7652
- C:\Windows\System\ENSoDsc.exe
  C:\Windows\System\ENSoDsc.exe
  2⤵
  PID:7712
- C:\Windows\System\HernHfh.exe
  C:\Windows\System\HernHfh.exe
  2⤵
  PID:7744
- C:\Windows\System\YFVfqDS.exe
  C:\Windows\System\YFVfqDS.exe
  2⤵
  PID:7808
- C:\Windows\System\bdGfrEw.exe
  C:\Windows\System\bdGfrEw.exe
  2⤵
  PID:7876
- C:\Windows\System\iLlNVfN.exe
  C:\Windows\System\iLlNVfN.exe
  2⤵
  PID:7952
- C:\Windows\System\ERYLZGT.exe
  C:\Windows\System\ERYLZGT.exe
  2⤵
  PID:8024
- C:\Windows\System\BaNCpSr.exe
  C:\Windows\System\BaNCpSr.exe
  2⤵
  PID:8068
- C:\Windows\System\AloWUFv.exe
  C:\Windows\System\AloWUFv.exe
  2⤵
  PID:8160
- C:\Windows\System\zffvmcA.exe
  C:\Windows\System\zffvmcA.exe
  2⤵
  PID:7200
- C:\Windows\System\JihRugx.exe
  C:\Windows\System\JihRugx.exe
  2⤵
  PID:7272
- C:\Windows\System\uBUaBPS.exe
  C:\Windows\System\uBUaBPS.exe
  2⤵
  PID:7332
- C:\Windows\System\BeGRhAR.exe
  C:\Windows\System\BeGRhAR.exe
  2⤵
  PID:7488
- C:\Windows\System\dmKwMOg.exe
  C:\Windows\System\dmKwMOg.exe
  2⤵
  PID:7716
- C:\Windows\System\tOpvlks.exe
  C:\Windows\System\tOpvlks.exe
  2⤵
  PID:7880
- C:\Windows\System\HzSrofX.exe
  C:\Windows\System\HzSrofX.exe
  2⤵
  PID:8136
- C:\Windows\System\HnNMGrd.exe
  C:\Windows\System\HnNMGrd.exe
  2⤵
  PID:7460
- C:\Windows\System\zJWQUqv.exe
  C:\Windows\System\zJWQUqv.exe
  2⤵
  PID:7620
- C:\Windows\System\TVYkfXm.exe
  C:\Windows\System\TVYkfXm.exe
  2⤵
  PID:7780
- C:\Windows\System\hTqxVUa.exe
  C:\Windows\System\hTqxVUa.exe
  2⤵
  PID:8176
- C:\Windows\System\USnFewN.exe
  C:\Windows\System\USnFewN.exe
  2⤵
  PID:7672
- C:\Windows\System\BPtGyOz.exe
  C:\Windows\System\BPtGyOz.exe
  2⤵
  PID:8216
- C:\Windows\System\HCzOMxc.exe
  C:\Windows\System\HCzOMxc.exe
  2⤵
  PID:8268
- C:\Windows\System\xBWqtsk.exe
  C:\Windows\System\xBWqtsk.exe
  2⤵
  PID:8300
- C:\Windows\System\IqEkQuL.exe
  C:\Windows\System\IqEkQuL.exe
  2⤵
  PID:8316
- C:\Windows\System\DfFTOyA.exe
  C:\Windows\System\DfFTOyA.exe
  2⤵
  PID:8336
- C:\Windows\System\TXXDyPQ.exe
  C:\Windows\System\TXXDyPQ.exe
  2⤵
  PID:8368
- C:\Windows\System\TSdVvfh.exe
  C:\Windows\System\TSdVvfh.exe
  2⤵
  PID:8424
- C:\Windows\System\YHSZqlE.exe
  C:\Windows\System\YHSZqlE.exe
  2⤵
  PID:8452
- C:\Windows\System\geNMBTB.exe
  C:\Windows\System\geNMBTB.exe
  2⤵
  PID:8472
- C:\Windows\System\PrGBfCm.exe
  C:\Windows\System\PrGBfCm.exe
  2⤵
  PID:8496
- C:\Windows\System\QqwFUSV.exe
  C:\Windows\System\QqwFUSV.exe
  2⤵
  PID:8512
- C:\Windows\System\uFbvREo.exe
  C:\Windows\System\uFbvREo.exe
  2⤵
  PID:8540
- C:\Windows\System\hJoKaYh.exe
  C:\Windows\System\hJoKaYh.exe
  2⤵
  PID:8568
- C:\Windows\System\TcMAvDi.exe
  C:\Windows\System\TcMAvDi.exe
  2⤵
  PID:8604
- C:\Windows\System\kURgBjP.exe
  C:\Windows\System\kURgBjP.exe
  2⤵
  PID:8636
- C:\Windows\System\pRqtXkI.exe
  C:\Windows\System\pRqtXkI.exe
  2⤵
  PID:8672
- C:\Windows\System\ApwyZzl.exe
  C:\Windows\System\ApwyZzl.exe
  2⤵
  PID:8692
- C:\Windows\System\lLOyhTh.exe
  C:\Windows\System\lLOyhTh.exe
  2⤵
  PID:8720
- C:\Windows\System\YJCOWmI.exe
  C:\Windows\System\YJCOWmI.exe
  2⤵
  PID:8744
- C:\Windows\System\bdNagJE.exe
  C:\Windows\System\bdNagJE.exe
  2⤵
  PID:8772
- C:\Windows\System\CBdOPca.exe
  C:\Windows\System\CBdOPca.exe
  2⤵
  PID:8816
- C:\Windows\System\dxnhHmQ.exe
  C:\Windows\System\dxnhHmQ.exe
  2⤵
  PID:8844
- C:\Windows\System\xifWQwn.exe
  C:\Windows\System\xifWQwn.exe
  2⤵
  PID:8872
- C:\Windows\System\oJjveeH.exe
  C:\Windows\System\oJjveeH.exe
  2⤵
  PID:8900
- C:\Windows\System\bnRzdNT.exe
  C:\Windows\System\bnRzdNT.exe
  2⤵
  PID:8916
- C:\Windows\System\PGovvDS.exe
  C:\Windows\System\PGovvDS.exe
  2⤵
  PID:8940
- C:\Windows\System\ckNqiHT.exe
  C:\Windows\System\ckNqiHT.exe
  2⤵
  PID:8972
- C:\Windows\System\ydtikEJ.exe
  C:\Windows\System\ydtikEJ.exe
  2⤵
  PID:9012
- C:\Windows\System\sEiVzgX.exe
  C:\Windows\System\sEiVzgX.exe
  2⤵
  PID:9028
- C:\Windows\System\QGschIL.exe
  C:\Windows\System\QGschIL.exe
  2⤵
  PID:9056
- C:\Windows\System\bPMWZIe.exe
  C:\Windows\System\bPMWZIe.exe
  2⤵
  PID:9080
- C:\Windows\System\FNobdOL.exe
  C:\Windows\System\FNobdOL.exe
  2⤵
  PID:9104
- C:\Windows\System\gAIpKIk.exe
  C:\Windows\System\gAIpKIk.exe
  2⤵
  PID:9144
- C:\Windows\System\GWWXRKs.exe
  C:\Windows\System\GWWXRKs.exe
  2⤵
  PID:9180
- C:\Windows\System\heUNBgI.exe
  C:\Windows\System\heUNBgI.exe
  2⤵
  PID:9204
- C:\Windows\System\STjbjhN.exe
  C:\Windows\System\STjbjhN.exe
  2⤵
  PID:8256
- C:\Windows\System\VXsdKuw.exe
  C:\Windows\System\VXsdKuw.exe
  2⤵
  PID:8204
- C:\Windows\System\jpRJCyE.exe
  C:\Windows\System\jpRJCyE.exe
  2⤵
  PID:8312
- C:\Windows\System\qMmPmbL.exe
  C:\Windows\System\qMmPmbL.exe
  2⤵
  PID:8360
- C:\Windows\System\rsgevLw.exe
  C:\Windows\System\rsgevLw.exe
  2⤵
  PID:8448
- C:\Windows\System\ruFrTGm.exe
  C:\Windows\System\ruFrTGm.exe
  2⤵
  PID:8524
- C:\Windows\System\qLVEWGt.exe
  C:\Windows\System\qLVEWGt.exe
  2⤵
  PID:8560
- C:\Windows\System\NvEFWgD.exe
  C:\Windows\System\NvEFWgD.exe
  2⤵
  PID:8628
- C:\Windows\System\wMcFEcH.exe
  C:\Windows\System\wMcFEcH.exe
  2⤵
  PID:8736
- C:\Windows\System\EbzfObe.exe
  C:\Windows\System\EbzfObe.exe
  2⤵
  PID:8764
- C:\Windows\System\RsBzMEn.exe
  C:\Windows\System\RsBzMEn.exe
  2⤵
  PID:8856
- C:\Windows\System\PEHkqgZ.exe
  C:\Windows\System\PEHkqgZ.exe
  2⤵
  PID:8908
- C:\Windows\System\ngqoeqB.exe
  C:\Windows\System\ngqoeqB.exe
  2⤵
  PID:8968
- C:\Windows\System\xntMjsl.exe
  C:\Windows\System\xntMjsl.exe
  2⤵
  PID:9024
- C:\Windows\System\hFczvIb.exe
  C:\Windows\System\hFczvIb.exe
  2⤵
  PID:9076
- C:\Windows\System\QLeGVuS.exe
  C:\Windows\System\QLeGVuS.exe
  2⤵
  PID:9192
- C:\Windows\System\WngVvrY.exe
  C:\Windows\System\WngVvrY.exe
  2⤵
  PID:7840
- C:\Windows\System\MNRUiKg.exe
  C:\Windows\System\MNRUiKg.exe
  2⤵
  PID:8288
- C:\Windows\System\vxsRoFU.exe
  C:\Windows\System\vxsRoFU.exe
  2⤵
  PID:8504
- C:\Windows\System\izavRWE.exe
  C:\Windows\System\izavRWE.exe
  2⤵
  PID:8576
- C:\Windows\System\RiUUjFn.exe
  C:\Windows\System\RiUUjFn.exe
  2⤵
  PID:8808
- C:\Windows\System\tiIFeGo.exe
  C:\Windows\System\tiIFeGo.exe
  2⤵
  PID:8928
- C:\Windows\System\KKiHuEy.exe
  C:\Windows\System\KKiHuEy.exe
  2⤵
  PID:9044
- C:\Windows\System\JPpBpNG.exe
  C:\Windows\System\JPpBpNG.exe
  2⤵
  PID:9196
- C:\Windows\System\vOdIicH.exe
  C:\Windows\System\vOdIicH.exe
  2⤵
  PID:8756
- C:\Windows\System\KBJyNYd.exe
  C:\Windows\System\KBJyNYd.exe
  2⤵
  PID:9072
- C:\Windows\System\NjGxJFJ.exe
  C:\Windows\System\NjGxJFJ.exe
  2⤵
  PID:8460
- C:\Windows\System\mpevqiY.exe
  C:\Windows\System\mpevqiY.exe
  2⤵
  PID:8884
- C:\Windows\System\OySgFQd.exe
  C:\Windows\System\OySgFQd.exe
  2⤵
  PID:9232
- C:\Windows\System\BJwEipA.exe
  C:\Windows\System\BJwEipA.exe
  2⤵
  PID:9264
- C:\Windows\System\yMDmiqO.exe
  C:\Windows\System\yMDmiqO.exe
  2⤵
  PID:9296
- C:\Windows\System\PgAyqyE.exe
  C:\Windows\System\PgAyqyE.exe
  2⤵
  PID:9324
- C:\Windows\System\zYvrLTS.exe
  C:\Windows\System\zYvrLTS.exe
  2⤵
  PID:9340
- C:\Windows\System\YMthFGh.exe
  C:\Windows\System\YMthFGh.exe
  2⤵
  PID:9380
- C:\Windows\System\WmwGbgf.exe
  C:\Windows\System\WmwGbgf.exe
  2⤵
  PID:9408
- C:\Windows\System\BjCFwlq.exe
  C:\Windows\System\BjCFwlq.exe
  2⤵
  PID:9424
- C:\Windows\System\jtFzWtZ.exe
  C:\Windows\System\jtFzWtZ.exe
  2⤵
  PID:9452
- C:\Windows\System\CtjYLmj.exe
  C:\Windows\System\CtjYLmj.exe
  2⤵
  PID:9480
- C:\Windows\System\FZKsDTq.exe
  C:\Windows\System\FZKsDTq.exe
  2⤵
  PID:9500
- C:\Windows\System\EAPaHWj.exe
  C:\Windows\System\EAPaHWj.exe
  2⤵
  PID:9536
- C:\Windows\System\JcDIapa.exe
  C:\Windows\System\JcDIapa.exe
  2⤵
  PID:9564
- C:\Windows\System\VuuyTnB.exe
  C:\Windows\System\VuuyTnB.exe
  2⤵
  PID:9604
- C:\Windows\System\pgbomra.exe
  C:\Windows\System\pgbomra.exe
  2⤵
  PID:9632
- C:\Windows\System\NAcRlzn.exe
  C:\Windows\System\NAcRlzn.exe
  2⤵
  PID:9656
- C:\Windows\System\vElcZkZ.exe
  C:\Windows\System\vElcZkZ.exe
  2⤵
  PID:9688
- C:\Windows\System\qevVLTC.exe
  C:\Windows\System\qevVLTC.exe
  2⤵
  PID:9704
- C:\Windows\System\zrvcpBI.exe
  C:\Windows\System\zrvcpBI.exe
  2⤵
  PID:9732
- C:\Windows\System\XdkvSNW.exe
  C:\Windows\System\XdkvSNW.exe
  2⤵
  PID:9748
- C:\Windows\System\FzCTpAx.exe
  C:\Windows\System\FzCTpAx.exe
  2⤵
  PID:9800
- C:\Windows\System\uHuqveh.exe
  C:\Windows\System\uHuqveh.exe
  2⤵
  PID:9828
- C:\Windows\System\CZMHdgW.exe
  C:\Windows\System\CZMHdgW.exe
  2⤵
  PID:9856
- C:\Windows\System\CUulgXZ.exe
  C:\Windows\System\CUulgXZ.exe
  2⤵
  PID:9884
- C:\Windows\System\AfKABiW.exe
  C:\Windows\System\AfKABiW.exe
  2⤵
  PID:9912
- C:\Windows\System\QXxxqJi.exe
  C:\Windows\System\QXxxqJi.exe
  2⤵
  PID:9940
- C:\Windows\System\bwFrNER.exe
  C:\Windows\System\bwFrNER.exe
  2⤵
  PID:9956
- C:\Windows\System\EIaPfyi.exe
  C:\Windows\System\EIaPfyi.exe
  2⤵
  PID:9984
- C:\Windows\System\WBFWJjI.exe
  C:\Windows\System\WBFWJjI.exe
  2⤵
  PID:10000
- C:\Windows\System\EOyEWtz.exe
  C:\Windows\System\EOyEWtz.exe
  2⤵
  PID:10024
- C:\Windows\System\HDLmoJA.exe
  C:\Windows\System\HDLmoJA.exe
  2⤵
  PID:10052
- C:\Windows\System\gzwcHwR.exe
  C:\Windows\System\gzwcHwR.exe
  2⤵
  PID:10112
- C:\Windows\System\GebpQUT.exe
  C:\Windows\System\GebpQUT.exe
  2⤵
  PID:10128
- C:\Windows\System\kbnrjlL.exe
  C:\Windows\System\kbnrjlL.exe
  2⤵
  PID:10144
- C:\Windows\System\aongOre.exe
  C:\Windows\System\aongOre.exe
  2⤵
  PID:10180
- C:\Windows\System\XIHVIie.exe
  C:\Windows\System\XIHVIie.exe
  2⤵
  PID:10224
- C:\Windows\System\qolgBCM.exe
  C:\Windows\System\qolgBCM.exe
  2⤵
  PID:8688
- C:\Windows\System\FNLSQEh.exe
  C:\Windows\System\FNLSQEh.exe
  2⤵
  PID:9260
- C:\Windows\System\gcsIGYT.exe
  C:\Windows\System\gcsIGYT.exe
  2⤵
  PID:9356
- C:\Windows\System\NIWitiT.exe
  C:\Windows\System\NIWitiT.exe
  2⤵
  PID:9400
- C:\Windows\System\TgRuciw.exe
  C:\Windows\System\TgRuciw.exe
  2⤵
  PID:9464
- C:\Windows\System\PAtKYxr.exe
  C:\Windows\System\PAtKYxr.exe
  2⤵
  PID:9512
- C:\Windows\System\bWxGrOP.exe
  C:\Windows\System\bWxGrOP.exe
  2⤵
  PID:9596
- C:\Windows\System\AJmkzMt.exe
  C:\Windows\System\AJmkzMt.exe
  2⤵
  PID:9648
- C:\Windows\System\CoFeDTa.exe
  C:\Windows\System\CoFeDTa.exe
  2⤵
  PID:9744
- C:\Windows\System\deqPZQw.exe
  C:\Windows\System\deqPZQw.exe
  2⤵
  PID:9812
- C:\Windows\System\XOmcxkk.exe
  C:\Windows\System\XOmcxkk.exe
  2⤵
  PID:9872
- C:\Windows\System\glWxvvt.exe
  C:\Windows\System\glWxvvt.exe
  2⤵
  PID:9932
- C:\Windows\System\wkfOwXb.exe
  C:\Windows\System\wkfOwXb.exe
  2⤵
  PID:9992
- C:\Windows\System\TaoHheL.exe
  C:\Windows\System\TaoHheL.exe
  2⤵
  PID:10080
- C:\Windows\System\dQoaRid.exe
  C:\Windows\System\dQoaRid.exe
  2⤵
  PID:10092
- C:\Windows\System\YpEAbYO.exe
  C:\Windows\System\YpEAbYO.exe
  2⤵
  PID:10172
- C:\Windows\System\alYYqmj.exe
  C:\Windows\System\alYYqmj.exe
  2⤵
  PID:10232
- C:\Windows\System\bboXFqv.exe
  C:\Windows\System\bboXFqv.exe
  2⤵
  PID:9396
- C:\Windows\System\mhQCxAO.exe
  C:\Windows\System\mhQCxAO.exe
  2⤵
  PID:9520
- C:\Windows\System\hIwXThp.exe
  C:\Windows\System\hIwXThp.exe
  2⤵
  PID:9716
- C:\Windows\System\NyNqkdZ.exe
  C:\Windows\System\NyNqkdZ.exe
  2⤵
  PID:9796
- C:\Windows\System\hihdJrh.exe
  C:\Windows\System\hihdJrh.exe
  2⤵
  PID:9976
- C:\Windows\System\iwbiwwD.exe
  C:\Windows\System\iwbiwwD.exe
  2⤵
  PID:10084
- C:\Windows\System\DAxIehV.exe
  C:\Windows\System\DAxIehV.exe
  2⤵
  PID:9292
- C:\Windows\System\ybMrQJk.exe
  C:\Windows\System\ybMrQJk.exe
  2⤵
  PID:9776
- C:\Windows\System\eqSmxFb.exe
  C:\Windows\System\eqSmxFb.exe
  2⤵
  PID:10036
- C:\Windows\System\luOXKpI.exe
  C:\Windows\System\luOXKpI.exe
  2⤵
  PID:9524
- C:\Windows\System\CTSpIVg.exe
  C:\Windows\System\CTSpIVg.exe
  2⤵
  PID:10212
- C:\Windows\System\dDQxkuV.exe
  C:\Windows\System\dDQxkuV.exe
  2⤵
  PID:10268
- C:\Windows\System\YZSqglQ.exe
  C:\Windows\System\YZSqglQ.exe
  2⤵
  PID:10296
- C:\Windows\System\QKDphff.exe
  C:\Windows\System\QKDphff.exe
  2⤵
  PID:10324
- C:\Windows\System\eYwvycA.exe
  C:\Windows\System\eYwvycA.exe
  2⤵
  PID:10340
- C:\Windows\System\xArKHGQ.exe
  C:\Windows\System\xArKHGQ.exe
  2⤵
  PID:10372
- C:\Windows\System\HiIsfaa.exe
  C:\Windows\System\HiIsfaa.exe
  2⤵
  PID:10408
- C:\Windows\System\BpHgnLv.exe
  C:\Windows\System\BpHgnLv.exe
  2⤵
  PID:10436
- C:\Windows\System\CiISegN.exe
  C:\Windows\System\CiISegN.exe
  2⤵
  PID:10460
- C:\Windows\System\nXPEtrf.exe
  C:\Windows\System\nXPEtrf.exe
  2⤵
  PID:10492
- C:\Windows\System\rPFsSNL.exe
  C:\Windows\System\rPFsSNL.exe
  2⤵
  PID:10520
- C:\Windows\System\ltOqRRs.exe
  C:\Windows\System\ltOqRRs.exe
  2⤵
  PID:10544
- C:\Windows\System\BGNoQnl.exe
  C:\Windows\System\BGNoQnl.exe
  2⤵
  PID:10564
- C:\Windows\System\TJAplLW.exe
  C:\Windows\System\TJAplLW.exe
  2⤵
  PID:10580
- C:\Windows\System\LzWTzkB.exe
  C:\Windows\System\LzWTzkB.exe
  2⤵
  PID:10604
- C:\Windows\System\chxaNCp.exe
  C:\Windows\System\chxaNCp.exe
  2⤵
  PID:10648
- C:\Windows\System\Szbujjh.exe
  C:\Windows\System\Szbujjh.exe
  2⤵
  PID:10680
- C:\Windows\System\DUhtSbS.exe
  C:\Windows\System\DUhtSbS.exe
  2⤵
  PID:10716
- C:\Windows\System\YyrIOPd.exe
  C:\Windows\System\YyrIOPd.exe
  2⤵
  PID:10744
- C:\Windows\System\BJFJHXd.exe
  C:\Windows\System\BJFJHXd.exe
  2⤵
  PID:10784
- C:\Windows\System\IVfJKLc.exe
  C:\Windows\System\IVfJKLc.exe
  2⤵
  PID:10812
- C:\Windows\System\PgkwHzL.exe
  C:\Windows\System\PgkwHzL.exe
  2⤵
  PID:10828
- C:\Windows\System\LipvNDl.exe
  C:\Windows\System\LipvNDl.exe
  2⤵
  PID:10856
- C:\Windows\System\MFQXqhZ.exe
  C:\Windows\System\MFQXqhZ.exe
  2⤵
  PID:10884
- C:\Windows\System\zMungfA.exe
  C:\Windows\System\zMungfA.exe
  2⤵
  PID:10912
- C:\Windows\System\hRgeoNK.exe
  C:\Windows\System\hRgeoNK.exe
  2⤵
  PID:10952
- C:\Windows\System\NWRjzOT.exe
  C:\Windows\System\NWRjzOT.exe
  2⤵
  PID:10980
- C:\Windows\System\bXuevWv.exe
  C:\Windows\System\bXuevWv.exe
  2⤵
  PID:11008
- C:\Windows\System\SCmNLzR.exe
  C:\Windows\System\SCmNLzR.exe
  2⤵
  PID:11032
- C:\Windows\System\MEMpXay.exe
  C:\Windows\System\MEMpXay.exe
  2⤵
  PID:11052
- C:\Windows\System\EFUlEoA.exe
  C:\Windows\System\EFUlEoA.exe
  2⤵
  PID:11080
- C:\Windows\System\YUYZiJe.exe
  C:\Windows\System\YUYZiJe.exe
  2⤵
  PID:11120
- C:\Windows\System\rJUGSpW.exe
  C:\Windows\System\rJUGSpW.exe
  2⤵
  PID:11148
- C:\Windows\System\zfkUiYI.exe
  C:\Windows\System\zfkUiYI.exe
  2⤵
  PID:11164
- C:\Windows\System\alZVRcY.exe
  C:\Windows\System\alZVRcY.exe
  2⤵
  PID:11196
- C:\Windows\System\iNtFYFu.exe
  C:\Windows\System\iNtFYFu.exe
  2⤵
  PID:11224
- C:\Windows\System\neFXZDU.exe
  C:\Windows\System\neFXZDU.exe
  2⤵
  PID:10140
- C:\Windows\System\GUXcHVh.exe
  C:\Windows\System\GUXcHVh.exe
  2⤵
  PID:10316
- C:\Windows\System\iPYQKNS.exe
  C:\Windows\System\iPYQKNS.exe
  2⤵
  PID:10308
- C:\Windows\System\eIaslwj.exe
  C:\Windows\System\eIaslwj.exe
  2⤵
  PID:10424
- C:\Windows\System\PiBICFl.exe
  C:\Windows\System\PiBICFl.exe
  2⤵
  PID:10420
- C:\Windows\System\jtkrwoX.exe
  C:\Windows\System\jtkrwoX.exe
  2⤵
  PID:10560
- C:\Windows\System\qGRbmGK.exe
  C:\Windows\System\qGRbmGK.exe
  2⤵
  PID:10624
- C:\Windows\System\ggJMhGC.exe
  C:\Windows\System\ggJMhGC.exe
  2⤵
  PID:10672
- C:\Windows\System\zLapwPH.exe
  C:\Windows\System\zLapwPH.exe
  2⤵
  PID:10704
- C:\Windows\System\bnxOmnT.exe
  C:\Windows\System\bnxOmnT.exe
  2⤵
  PID:10760
- C:\Windows\System\vVLJfxq.exe
  C:\Windows\System\vVLJfxq.exe
  2⤵
  PID:10800
- C:\Windows\System\fCcfFiB.exe
  C:\Windows\System\fCcfFiB.exe
  2⤵
  PID:10868
- C:\Windows\System\cOpthSY.exe
  C:\Windows\System\cOpthSY.exe
  2⤵
  PID:10996
- C:\Windows\System\iELCJfc.exe
  C:\Windows\System\iELCJfc.exe
  2⤵
  PID:11044
- C:\Windows\System\ZHwyhcn.exe
  C:\Windows\System\ZHwyhcn.exe
  2⤵
  PID:11108
- C:\Windows\System\QawBtkB.exe
  C:\Windows\System\QawBtkB.exe
  2⤵
  PID:11208
- C:\Windows\System\ZXVrwWS.exe
  C:\Windows\System\ZXVrwWS.exe
  2⤵
  PID:10248
- C:\Windows\System\RNwaXWl.exe
  C:\Windows\System\RNwaXWl.exe
  2⤵
  PID:10364
- C:\Windows\System\ijSPIUo.exe
  C:\Windows\System\ijSPIUo.exe
  2⤵
  PID:10556
- C:\Windows\System\XmzpCed.exe
  C:\Windows\System\XmzpCed.exe
  2⤵
  PID:10664
- C:\Windows\System\DjVzamD.exe
  C:\Windows\System\DjVzamD.exe
  2⤵
  PID:10820
- C:\Windows\System\DObkcrm.exe
  C:\Windows\System\DObkcrm.exe
  2⤵
  PID:11024
- C:\Windows\System\jjThFUh.exe
  C:\Windows\System\jjThFUh.exe
  2⤵
  PID:11256
- C:\Windows\System\FRcdfwW.exe
  C:\Windows\System\FRcdfwW.exe
  2⤵
  PID:10928
- C:\Windows\System\fWUGdsZ.exe
  C:\Windows\System\fWUGdsZ.exe
  2⤵
  PID:10896
- C:\Windows\System\MskCzjC.exe
  C:\Windows\System\MskCzjC.exe
  2⤵
  PID:11284
- C:\Windows\System\nwIPtYp.exe
  C:\Windows\System\nwIPtYp.exe
  2⤵
  PID:11304
- C:\Windows\System\Spscugc.exe
  C:\Windows\System\Spscugc.exe
  2⤵
  PID:11332
- C:\Windows\System\CeausQi.exe
  C:\Windows\System\CeausQi.exe
  2⤵
  PID:11376
- C:\Windows\System\dNcTmwe.exe
  C:\Windows\System\dNcTmwe.exe
  2⤵
  PID:11412
- C:\Windows\System\mQNrzmm.exe
  C:\Windows\System\mQNrzmm.exe
  2⤵
  PID:11448
- C:\Windows\System\oKXUNpq.exe
  C:\Windows\System\oKXUNpq.exe
  2⤵
  PID:11484
- C:\Windows\System\uNeRlrU.exe
  C:\Windows\System\uNeRlrU.exe
  2⤵
  PID:11508
- C:\Windows\System\eDnMskV.exe
  C:\Windows\System\eDnMskV.exe
  2⤵
  PID:11540
- C:\Windows\System\HMQZggP.exe
  C:\Windows\System\HMQZggP.exe
  2⤵
  PID:11572
- C:\Windows\System\KRcTSMz.exe
  C:\Windows\System\KRcTSMz.exe
  2⤵
  PID:11608
- C:\Windows\System\qMyKxrP.exe
  C:\Windows\System\qMyKxrP.exe
  2⤵
  PID:11636
- C:\Windows\System\sqzyOcN.exe
  C:\Windows\System\sqzyOcN.exe
  2⤵
  PID:11668
- C:\Windows\System\XIesbGh.exe
  C:\Windows\System\XIesbGh.exe
  2⤵
  PID:11696
- C:\Windows\System\hbmsbAI.exe
  C:\Windows\System\hbmsbAI.exe
  2⤵
  PID:11724
- C:\Windows\System\fNsPYof.exe
  C:\Windows\System\fNsPYof.exe
  2⤵
  PID:11740
- C:\Windows\System\wRlxOhg.exe
  C:\Windows\System\wRlxOhg.exe
  2⤵
  PID:11768
- C:\Windows\System\BQMWbEq.exe
  C:\Windows\System\BQMWbEq.exe
  2⤵
  PID:11788
- C:\Windows\System\Yfcujct.exe
  C:\Windows\System\Yfcujct.exe
  2⤵
  PID:11828
- C:\Windows\System\aNGGCVw.exe
  C:\Windows\System\aNGGCVw.exe
  2⤵
  PID:11852
- C:\Windows\System\XBIMDQI.exe
  C:\Windows\System\XBIMDQI.exe
  2⤵
  PID:11884
- C:\Windows\System\JZHCOva.exe
  C:\Windows\System\JZHCOva.exe
  2⤵
  PID:11908
- C:\Windows\System\dinCxSl.exe
  C:\Windows\System\dinCxSl.exe
  2⤵
  PID:11944
- C:\Windows\System\KpBhlsy.exe
  C:\Windows\System\KpBhlsy.exe
  2⤵
  PID:11964
- C:\Windows\System\AYqwbrI.exe
  C:\Windows\System\AYqwbrI.exe
  2⤵
  PID:12008
- C:\Windows\System\BJdHbzK.exe
  C:\Windows\System\BJdHbzK.exe
  2⤵
  PID:12036
- C:\Windows\System\PeZIdck.exe
  C:\Windows\System\PeZIdck.exe
  2⤵
  PID:12060
- C:\Windows\System\yqupKsO.exe
  C:\Windows\System\yqupKsO.exe
  2⤵
  PID:12076
- C:\Windows\System\Qcbtxni.exe
  C:\Windows\System\Qcbtxni.exe
  2⤵
  PID:12104
- C:\Windows\System\qLRdyYB.exe
  C:\Windows\System\qLRdyYB.exe
  2⤵
  PID:12128
- C:\Windows\System\ZuDNjhD.exe
  C:\Windows\System\ZuDNjhD.exe
  2⤵
  PID:12164
- C:\Windows\System\MEYdCPg.exe
  C:\Windows\System\MEYdCPg.exe
  2⤵
  PID:12200
- C:\Windows\System\OqYIHbV.exe
  C:\Windows\System\OqYIHbV.exe
  2⤵
  PID:12216
- C:\Windows\System\qFfbdvA.exe
  C:\Windows\System\qFfbdvA.exe
  2⤵
  PID:12236
- C:\Windows\System\ZuHaEjT.exe
  C:\Windows\System\ZuHaEjT.exe
  2⤵
  PID:11160
- C:\Windows\System\CiIDaCF.exe
  C:\Windows\System\CiIDaCF.exe
  2⤵
  PID:11280
- C:\Windows\System\aBLVTOs.exe
  C:\Windows\System\aBLVTOs.exe
  2⤵
  PID:11320
- C:\Windows\System\AFMuZPP.exe
  C:\Windows\System\AFMuZPP.exe
  2⤵
  PID:11408
- C:\Windows\System\YFnmCvU.exe
  C:\Windows\System\YFnmCvU.exe
  2⤵
  PID:11464
- C:\Windows\System\Apsyuuy.exe
  C:\Windows\System\Apsyuuy.exe
  2⤵
  PID:11524
- C:\Windows\System\RiZpHMw.exe
  C:\Windows\System\RiZpHMw.exe
  2⤵
  PID:11628
- C:\Windows\System\IBLTuov.exe
  C:\Windows\System\IBLTuov.exe
  2⤵
  PID:11692
- C:\Windows\System\WUXmIjX.exe
  C:\Windows\System\WUXmIjX.exe
  2⤵
  PID:11192
- C:\Windows\System\ZzteEIa.exe
  C:\Windows\System\ZzteEIa.exe
  2⤵
  PID:11784
- C:\Windows\System\BKlKAoL.exe
  C:\Windows\System\BKlKAoL.exe
  2⤵
  PID:11820
- C:\Windows\System\AlNdJeY.exe
  C:\Windows\System\AlNdJeY.exe
  2⤵
  PID:11928
- C:\Windows\System\HgpuIPH.exe
  C:\Windows\System\HgpuIPH.exe
  2⤵
  PID:11992
- C:\Windows\System\AuRLIJB.exe
  C:\Windows\System\AuRLIJB.exe
  2⤵
  PID:12072
- C:\Windows\System\EsOinsK.exe
  C:\Windows\System\EsOinsK.exe
  2⤵
  PID:12188
- C:\Windows\System\uJqpnwZ.exe
  C:\Windows\System\uJqpnwZ.exe
  2⤵
  PID:12224
- C:\Windows\System\UeVLpPf.exe
  C:\Windows\System\UeVLpPf.exe
  2⤵
  PID:11276
- C:\Windows\System\kckFAlh.exe
  C:\Windows\System\kckFAlh.exe
  2⤵
  PID:11324
- C:\Windows\System\RRQntVy.exe
  C:\Windows\System\RRQntVy.exe
  2⤵
  PID:11440
- C:\Windows\System\FbUMePy.exe
  C:\Windows\System\FbUMePy.exe
  2⤵
  PID:11392
- C:\Windows\System\uWoPCIE.exe
  C:\Windows\System\uWoPCIE.exe
  2⤵
  PID:11720
- C:\Windows\System\bqkctdC.exe
  C:\Windows\System\bqkctdC.exe
  2⤵
  PID:11876
- C:\Windows\System\McIQVqx.exe
  C:\Windows\System\McIQVqx.exe
  2⤵
  PID:12160
- C:\Windows\System\biOZlxo.exe
  C:\Windows\System\biOZlxo.exe
  2⤵
  PID:12208
- C:\Windows\System\JfXhZXo.exe
  C:\Windows\System\JfXhZXo.exe
  2⤵
  PID:10676
- C:\Windows\System\IRbXTSg.exe
  C:\Windows\System\IRbXTSg.exe
  2⤵
  PID:11752
- C:\Windows\System\nnENjcw.exe
  C:\Windows\System\nnENjcw.exe
  2⤵
  PID:11352
- C:\Windows\System\hAdwqSD.exe
  C:\Windows\System\hAdwqSD.exe
  2⤵
  PID:11920
- C:\Windows\System\QRmEABX.exe
  C:\Windows\System\QRmEABX.exe
  2⤵
  PID:12292
- C:\Windows\System\IERJkhg.exe
  C:\Windows\System\IERJkhg.exe
  2⤵
  PID:12320
- C:\Windows\System\JSkNvqH.exe
  C:\Windows\System\JSkNvqH.exe
  2⤵
  PID:12352
- C:\Windows\System\qmpGPtI.exe
  C:\Windows\System\qmpGPtI.exe
  2⤵
  PID:12368
- C:\Windows\System\wJdOdKz.exe
  C:\Windows\System\wJdOdKz.exe
  2⤵
  PID:12408
- C:\Windows\System\YhKvwrr.exe
  C:\Windows\System\YhKvwrr.exe
  2⤵
  PID:12436
- C:\Windows\System\THPXycX.exe
  C:\Windows\System\THPXycX.exe
  2⤵
  PID:12464
- C:\Windows\System\zRgVvvq.exe
  C:\Windows\System\zRgVvvq.exe
  2⤵
  PID:12488
- C:\Windows\System\YlDOvDz.exe
  C:\Windows\System\YlDOvDz.exe
  2⤵
  PID:12508
- C:\Windows\System\guKGMWY.exe
  C:\Windows\System\guKGMWY.exe
  2⤵
  PID:12540
- C:\Windows\System\iEAqbMb.exe
  C:\Windows\System\iEAqbMb.exe
  2⤵
  PID:12576
- C:\Windows\System\bjmDstt.exe
  C:\Windows\System\bjmDstt.exe
  2⤵
  PID:12604
- C:\Windows\System\QRbYsQn.exe
  C:\Windows\System\QRbYsQn.exe
  2⤵
  PID:12628
- C:\Windows\System\BEQpqoW.exe
  C:\Windows\System\BEQpqoW.exe
  2⤵
  PID:12648
- C:\Windows\System\CVyKLAz.exe
  C:\Windows\System\CVyKLAz.exe
  2⤵
  PID:12684
- C:\Windows\System\rbpvYDa.exe
  C:\Windows\System\rbpvYDa.exe
  2⤵
  PID:12704
- C:\Windows\System\IxCGPTn.exe
  C:\Windows\System\IxCGPTn.exe
  2⤵
  PID:12744
- C:\Windows\System\vAdNoTW.exe
  C:\Windows\System\vAdNoTW.exe
  2⤵
  PID:12760
- C:\Windows\System\QQadvsw.exe
  C:\Windows\System\QQadvsw.exe
  2⤵
  PID:12788
- C:\Windows\System\VDxuxKG.exe
  C:\Windows\System\VDxuxKG.exe
  2⤵
  PID:12820
- C:\Windows\System\iFOLvsE.exe
  C:\Windows\System\iFOLvsE.exe
  2⤵
  PID:12856
- C:\Windows\System\dlVWKvC.exe
  C:\Windows\System\dlVWKvC.exe
  2⤵
  PID:12872
- C:\Windows\System\pOoYbDi.exe
  C:\Windows\System\pOoYbDi.exe
  2⤵
  PID:12916
- C:\Windows\System\lmPoIJa.exe
  C:\Windows\System\lmPoIJa.exe
  2⤵
  PID:12944
- C:\Windows\System\xGlitey.exe
  C:\Windows\System\xGlitey.exe
  2⤵
  PID:12972
- C:\Windows\System\smhPnfI.exe
  C:\Windows\System\smhPnfI.exe
  2⤵
  PID:12988
- C:\Windows\System\kigkrkH.exe
  C:\Windows\System\kigkrkH.exe
  2⤵
  PID:13016
- C:\Windows\System\USkPESa.exe
  C:\Windows\System\USkPESa.exe
  2⤵
  PID:13048
- C:\Windows\System\EcpIEOm.exe
  C:\Windows\System\EcpIEOm.exe
  2⤵
  PID:13072
- C:\Windows\System\FLGeJZW.exe
  C:\Windows\System\FLGeJZW.exe
  2⤵
  PID:13100
- C:\Windows\System\TEtniTC.exe
  C:\Windows\System\TEtniTC.exe
  2⤵
  PID:13140
- C:\Windows\System\dHlymOD.exe
  C:\Windows\System\dHlymOD.exe
  2⤵
  PID:13156
- C:\Windows\System\HfEvott.exe
  C:\Windows\System\HfEvott.exe
  2⤵
  PID:13180
- C:\Windows\System\omgzkSo.exe
  C:\Windows\System\omgzkSo.exe
  2⤵
  PID:13212
- C:\Windows\System\nKkvXwL.exe
  C:\Windows\System\nKkvXwL.exe
  2⤵
  PID:13228
- C:\Windows\System\VaRaJYl.exe
  C:\Windows\System\VaRaJYl.exe
  2⤵
  PID:13280
- C:\Windows\System\gQoVscp.exe
  C:\Windows\System\gQoVscp.exe
  2⤵
  PID:13308
- C:\Windows\System\oykcjYz.exe
  C:\Windows\System\oykcjYz.exe
  2⤵
  PID:12332
- C:\Windows\System\afsEocZ.exe
  C:\Windows\System\afsEocZ.exe
  2⤵
  PID:12364
- C:\Windows\System\VIfTmGg.exe
  C:\Windows\System\VIfTmGg.exe
  2⤵
  PID:12424
- C:\Windows\System\RXpayWM.exe
  C:\Windows\System\RXpayWM.exe
  2⤵
  PID:12500
- C:\Windows\System\OclUqYw.exe
  C:\Windows\System\OclUqYw.exe
  2⤵
  PID:12560
- C:\Windows\System\rbLsksh.exe
  C:\Windows\System\rbLsksh.exe
  2⤵
  PID:12616
- C:\Windows\System\EFpVmCY.exe
  C:\Windows\System\EFpVmCY.exe
  2⤵
  PID:12660
- C:\Windows\System\SAZKWsL.exe
  C:\Windows\System\SAZKWsL.exe
  2⤵
  PID:12756
- C:\Windows\System\RrJorhU.exe
  C:\Windows\System\RrJorhU.exe
  2⤵
  PID:12840
- C:\Windows\System\YoFXenD.exe
  C:\Windows\System\YoFXenD.exe
  2⤵
  PID:12892
- C:\Windows\System\FgxSpDo.exe
  C:\Windows\System\FgxSpDo.exe
  2⤵
  PID:12984
- C:\Windows\System\GTBcIJP.exe
  C:\Windows\System\GTBcIJP.exe
  2⤵
  PID:13056
- C:\Windows\System\uOZsTZs.exe
  C:\Windows\System\uOZsTZs.exe
  2⤵
  PID:13088
- C:\Windows\System\nYjtNdL.exe
  C:\Windows\System\nYjtNdL.exe
  2⤵
  PID:13128
- C:\Windows\System\SWwObav.exe
  C:\Windows\System\SWwObav.exe
  2⤵
  PID:13196
- C:\Windows\System\aKkxXbV.exe
  C:\Windows\System\aKkxXbV.exe
  2⤵
  PID:13256
- C:\Windows\System\rCUhdxQ.exe
  C:\Windows\System\rCUhdxQ.exe
  2⤵
  PID:12316
- C:\Windows\System\WLAOIyv.exe
  C:\Windows\System\WLAOIyv.exe
  2⤵
  PID:12472
- C:\Windows\System\llEicXX.exe
  C:\Windows\System\llEicXX.exe
  2⤵
  PID:12600
- C:\Windows\System\bRcFNYt.exe
  C:\Windows\System\bRcFNYt.exe
  2⤵
  PID:12772
- C:\Windows\System\yeVbZIj.exe
  C:\Windows\System\yeVbZIj.exe
  2⤵
  PID:12844
- C:\Windows\System\yBomlHa.exe
  C:\Windows\System\yBomlHa.exe
  2⤵
  PID:13032
- C:\Windows\System\kXMhqBM.exe
  C:\Windows\System\kXMhqBM.exe
  2⤵
  PID:13152
- C:\Windows\System\IxGvPSn.exe
  C:\Windows\System\IxGvPSn.exe
  2⤵
  PID:12420
- C:\Windows\System\lZtXkEv.exe
  C:\Windows\System\lZtXkEv.exe
  2⤵
  PID:12564
- C:\Windows\System\DZnbiMG.exe
  C:\Windows\System\DZnbiMG.exe
  2⤵
  PID:12968
- C:\Windows\System\yHsXAUL.exe
  C:\Windows\System\yHsXAUL.exe
  2⤵
  PID:12780
- C:\Windows\System\lfrqRvK.exe
  C:\Windows\System\lfrqRvK.exe
  2⤵
  PID:13252
- C:\Windows\System\DDkFGBs.exe
  C:\Windows\System\DDkFGBs.exe
  2⤵
  PID:13316
- C:\Windows\System\yIYIkNS.exe
  C:\Windows\System\yIYIkNS.exe
  2⤵
  PID:13352
- C:\Windows\System\FhMfFqa.exe
  C:\Windows\System\FhMfFqa.exe
  2⤵
  PID:13376
- C:\Windows\System\IyTxLyr.exe
  C:\Windows\System\IyTxLyr.exe
  2⤵
  PID:13428
- C:\Windows\System\Giaoiwp.exe
  C:\Windows\System\Giaoiwp.exe
  2⤵
  PID:13452
- C:\Windows\System\NNzcqev.exe
  C:\Windows\System\NNzcqev.exe
  2⤵
  PID:13484
- C:\Windows\System\caXVIwQ.exe
  C:\Windows\System\caXVIwQ.exe
  2⤵
  PID:13512
- C:\Windows\System\DXjUdmu.exe
  C:\Windows\System\DXjUdmu.exe
  2⤵
  PID:13536
- C:\Windows\System\ibRkNbs.exe
  C:\Windows\System\ibRkNbs.exe
  2⤵
  PID:13572
- C:\Windows\System\WQIQOwb.exe
  C:\Windows\System\WQIQOwb.exe
  2⤵
  PID:13596
- C:\Windows\System\RLXDMQq.exe
  C:\Windows\System\RLXDMQq.exe
  2⤵
  PID:13636
- C:\Windows\System\PuQelfn.exe
  C:\Windows\System\PuQelfn.exe
  2⤵
  PID:13664
- C:\Windows\System\DgyJvMs.exe
  C:\Windows\System\DgyJvMs.exe
  2⤵
  PID:13680
- C:\Windows\System\qxygkeZ.exe
  C:\Windows\System\qxygkeZ.exe
  2⤵
  PID:13708
- C:\Windows\System\RVjCnwV.exe
  C:\Windows\System\RVjCnwV.exe
  2⤵
  PID:13748
- C:\Windows\System\LRDvkTs.exe
  C:\Windows\System\LRDvkTs.exe
  2⤵
  PID:13776
- C:\Windows\System\DwJouIM.exe
  C:\Windows\System\DwJouIM.exe
  2⤵
  PID:13792
- C:\Windows\System\zRfMhnf.exe
  C:\Windows\System\zRfMhnf.exe
  2⤵
  PID:13824
- C:\Windows\System\qmHIbTv.exe
  C:\Windows\System\qmHIbTv.exe
  2⤵
  PID:13860
- C:\Windows\System\AAquHrc.exe
  C:\Windows\System\AAquHrc.exe
  2⤵
  PID:13888
- C:\Windows\System\Egoujlq.exe
  C:\Windows\System\Egoujlq.exe
  2⤵
  PID:13916
- C:\Windows\System\IcnmNVn.exe
  C:\Windows\System\IcnmNVn.exe
  2⤵
  PID:13932
- C:\Windows\System\gOTCOTk.exe
  C:\Windows\System\gOTCOTk.exe
  2⤵
  PID:13972
- C:\Windows\System\UQbCqii.exe
  C:\Windows\System\UQbCqii.exe
  2⤵
  PID:14000
- C:\Windows\System\gwLnFZe.exe
  C:\Windows\System\gwLnFZe.exe
  2⤵
  PID:14016
- C:\Windows\System\srHnZJo.exe
  C:\Windows\System\srHnZJo.exe
  2⤵
  PID:14032
- C:\Windows\System\oWVitTW.exe
  C:\Windows\System\oWVitTW.exe
  2⤵
  PID:14060
- C:\Windows\System\xezkaWZ.exe
  C:\Windows\System\xezkaWZ.exe
  2⤵
  PID:14100
- C:\Windows\System\HbOQNnk.exe
  C:\Windows\System\HbOQNnk.exe
  2⤵
  PID:14128
- C:\Windows\System\IIVBuGW.exe
  C:\Windows\System\IIVBuGW.exe
  2⤵
  PID:14160
- C:\Windows\System\HVhzuJK.exe
  C:\Windows\System\HVhzuJK.exe
  2⤵
  PID:14176
- C:\Windows\System\QfiJmJN.exe
  C:\Windows\System\QfiJmJN.exe
  2⤵
  PID:14216
- C:\Windows\System\dlOzmbr.exe
  C:\Windows\System\dlOzmbr.exe
  2⤵
  PID:14248
- C:\Windows\System\LxwBJdn.exe
  C:\Windows\System\LxwBJdn.exe
  2⤵
  PID:14284
- C:\Windows\System\dbRQYzN.exe
  C:\Windows\System\dbRQYzN.exe
  2⤵
  PID:14312
- C:\Windows\System\QPktsQv.exe
  C:\Windows\System\QPktsQv.exe
  2⤵
  PID:14332
- C:\Windows\System\VIlcpby.exe
  C:\Windows\System\VIlcpby.exe
  2⤵
  PID:13328
- C:\Windows\System\IqjMXom.exe
  C:\Windows\System\IqjMXom.exe
  2⤵
  PID:13412
- C:\Windows\System\FGKwjOD.exe
  C:\Windows\System\FGKwjOD.exe
  2⤵
  PID:13496
- C:\Windows\System\iUvqHVq.exe
  C:\Windows\System\iUvqHVq.exe
  2⤵
  PID:13552
- C:\Windows\System\dkdCpYT.exe
  C:\Windows\System\dkdCpYT.exe
  2⤵
  PID:13580
- C:\Windows\System\UCGkesx.exe
  C:\Windows\System\UCGkesx.exe
  2⤵
  PID:13676
- C:\Windows\System\chUPxPi.exe
  C:\Windows\System\chUPxPi.exe
  2⤵
  PID:13772
- C:\Windows\System\kadbCpb.exe
  C:\Windows\System\kadbCpb.exe
  2⤵
  PID:13804
- C:\Windows\System\NCVNjWB.exe
  C:\Windows\System\NCVNjWB.exe
  2⤵
  PID:13856
- C:\Windows\System\UyaxAcL.exe
  C:\Windows\System\UyaxAcL.exe
  2⤵
  PID:13904
- C:\Windows\System\hBFHalZ.exe
  C:\Windows\System\hBFHalZ.exe
  2⤵
  PID:14012
- C:\Windows\System\TsaRCTd.exe
  C:\Windows\System\TsaRCTd.exe
  2⤵
  PID:14084
- C:\Windows\System\pqoVRMH.exe
  C:\Windows\System\pqoVRMH.exe
  2⤵
  PID:14116
- C:\Windows\System\GuktcOv.exe
  C:\Windows\System\GuktcOv.exe
  2⤵
  PID:14200
- C:\Windows\System\IznVrCO.exe
  C:\Windows\System\IznVrCO.exe
  2⤵
  PID:14272
- C:\Windows\System\hnNtwpK.exe
  C:\Windows\System\hnNtwpK.exe
  2⤵
  PID:14324
- C:\Windows\System\NSzIqul.exe
  C:\Windows\System\NSzIqul.exe
  2⤵
  PID:13388
- C:\Windows\System\HtiDGBN.exe
  C:\Windows\System\HtiDGBN.exe
  2⤵
  PID:13632
- C:\Windows\System\oDIfLTB.exe
  C:\Windows\System\oDIfLTB.exe
  2⤵
  PID:13816
- C:\Windows\System\XioDwYX.exe
  C:\Windows\System\XioDwYX.exe
  2⤵
  PID:13908
- C:\Windows\System\PGkPPpj.exe
  C:\Windows\System\PGkPPpj.exe
  2⤵
  PID:14008
- C:\Windows\System\qZRAhxa.exe
  C:\Windows\System\qZRAhxa.exe
  2⤵
  PID:14232
- C:\Windows\System\jccWxPk.exe
  C:\Windows\System\jccWxPk.exe
  2⤵
  PID:13348
- C:\Windows\System\gPjbNEq.exe
  C:\Windows\System\gPjbNEq.exe
  2⤵
  PID:13764
- C:\Windows\System\gVrayag.exe
  C:\Windows\System\gVrayag.exe
  2⤵
  PID:14112
- C:\Windows\System\kkwmnqE.exe
  C:\Windows\System\kkwmnqE.exe
  2⤵
  PID:13704
- C:\Windows\System\BtKSUfC.exe
  C:\Windows\System\BtKSUfC.exe
  2⤵
  PID:14344
- C:\Windows\System\dYRcoKr.exe
  C:\Windows\System\dYRcoKr.exe
  2⤵
  PID:14372
- C:\Windows\System\aSlrXEz.exe
  C:\Windows\System\aSlrXEz.exe
  2⤵
  PID:14388
- C:\Windows\System\BQgqylX.exe
  C:\Windows\System\BQgqylX.exe
  2⤵
  PID:14404
- C:\Windows\System\akFtqVF.exe
  C:\Windows\System\akFtqVF.exe
  2⤵
  PID:14436
- C:\Windows\System\wfnawdj.exe
  C:\Windows\System\wfnawdj.exe
  2⤵
  PID:14468
- C:\Windows\System\GWzopRS.exe
  C:\Windows\System\GWzopRS.exe
  2⤵
  PID:14488
- C:\Windows\System\BtlTeAg.exe
  C:\Windows\System\BtlTeAg.exe
  2⤵
  PID:14512
- C:\Windows\System\PQSqzXN.exe
  C:\Windows\System\PQSqzXN.exe
  2⤵
  PID:14540
- C:\Windows\System\FrvKVKr.exe
  C:\Windows\System\FrvKVKr.exe
  2⤵
  PID:14560
- C:\Windows\System\Omljqfh.exe
  C:\Windows\System\Omljqfh.exe
  2⤵
  PID:14580
- C:\Windows\System\grMRPhK.exe
  C:\Windows\System\grMRPhK.exe
  2⤵
  PID:14640
- C:\Windows\System\ULllCCf.exe
  C:\Windows\System\ULllCCf.exe
  2⤵
  PID:14660
- C:\Windows\System\Qsgapxb.exe
  C:\Windows\System\Qsgapxb.exe
  2⤵
  PID:14692
- C:\Windows\System\QNgMudv.exe
  C:\Windows\System\QNgMudv.exe
  2⤵
  PID:14720
- C:\Windows\System\nihjnKr.exe
  C:\Windows\System\nihjnKr.exe
  2⤵
  PID:14748
- C:\Windows\System\btZVKLZ.exe
  C:\Windows\System\btZVKLZ.exe
  2⤵
  PID:14772
- C:\Windows\System\AIHcGkT.exe
  C:\Windows\System\AIHcGkT.exe
  2⤵
  PID:14808
- C:\Windows\System\tVyQUdr.exe
  C:\Windows\System\tVyQUdr.exe
  2⤵
  PID:14848
- C:\Windows\System\FgArxvz.exe
  C:\Windows\System\FgArxvz.exe
  2⤵
  PID:14868
- C:\Windows\System\ktEAjuk.exe
  C:\Windows\System\ktEAjuk.exe
  2⤵
  PID:14896
- C:\Windows\System\MgICulw.exe
  C:\Windows\System\MgICulw.exe
  2⤵
  PID:14920
- C:\Windows\System\NxIhJUI.exe
  C:\Windows\System\NxIhJUI.exe
  2⤵
  PID:14944
- C:\Windows\System\wuISnGV.exe
  C:\Windows\System\wuISnGV.exe
  2⤵
  PID:14980
- C:\Windows\System\DcfDaxY.exe
  C:\Windows\System\DcfDaxY.exe
  2⤵
  PID:15004
- C:\Windows\System\OEyVHXE.exe
  C:\Windows\System\OEyVHXE.exe
  2⤵
  PID:15020
- C:\Windows\System\ZXHgVdN.exe
  C:\Windows\System\ZXHgVdN.exe
  2⤵
  PID:15060
- C:\Windows\System\mKVLUnn.exe
  C:\Windows\System\mKVLUnn.exe
  2⤵
  PID:15080
- C:\Windows\System\RooCkCb.exe
  C:\Windows\System\RooCkCb.exe
  2⤵
  PID:15128
- C:\Windows\System\MtjTzZd.exe
  C:\Windows\System\MtjTzZd.exe
  2⤵
  PID:15156
- C:\Windows\System\suWYyBg.exe
  C:\Windows\System\suWYyBg.exe
  2⤵
  PID:15184
- C:\Windows\System\mNXSFzW.exe
  C:\Windows\System\mNXSFzW.exe
  2⤵
  PID:15212
- C:\Windows\System\FKxccUP.exe
  C:\Windows\System\FKxccUP.exe
  2⤵
  PID:15228
- C:\Windows\System\gFrrmlE.exe
  C:\Windows\System\gFrrmlE.exe
  2⤵
  PID:15252
- C:\Windows\System\XpaEODP.exe
  C:\Windows\System\XpaEODP.exe
  2⤵
  PID:15272
- C:\Windows\System\mqwboHB.exe
  C:\Windows\System\mqwboHB.exe
  2⤵
  PID:15308
- C:\Windows\System\DFDfTWy.exe
  C:\Windows\System\DFDfTWy.exe
  2⤵
  PID:15340
- C:\Windows\System\NPRDbCs.exe
  C:\Windows\System\NPRDbCs.exe
  2⤵
  PID:15356
- C:\Windows\System\hVRkxuc.exe
  C:\Windows\System\hVRkxuc.exe
  2⤵
  PID:14356
- C:\Windows\System\OiJmOeP.exe
  C:\Windows\System\OiJmOeP.exe
  2⤵
  PID:14504
- C:\Windows\System\UqdQunJ.exe
  C:\Windows\System\UqdQunJ.exe
  2⤵
  PID:14532
- C:\Windows\System\mvGRxdm.exe
  C:\Windows\System\mvGRxdm.exe
  2⤵
  PID:14632
- C:\Windows\System\phbzzHt.exe
  C:\Windows\System\phbzzHt.exe
  2⤵
  PID:14684
- C:\Windows\System\owUfBJC.exe
  C:\Windows\System\owUfBJC.exe
  2⤵
  PID:14756
- C:\Windows\System\iFWovOL.exe
  C:\Windows\System\iFWovOL.exe
  2⤵
  PID:14800
- C:\Windows\System\XAYqSPT.exe
  C:\Windows\System\XAYqSPT.exe
  2⤵
  PID:14860
- C:\Windows\System\QvSpYLL.exe
  C:\Windows\System\QvSpYLL.exe
  2⤵
  PID:14908
- C:\Windows\System\FdaxpsE.exe
  C:\Windows\System\FdaxpsE.exe
  2⤵
  PID:14968
- C:\Windows\System\YdarwQd.exe
  C:\Windows\System\YdarwQd.exe
  2⤵
  PID:15016
- C:\Windows\System\UcDdQqF.exe
  C:\Windows\System\UcDdQqF.exe
  2⤵
  PID:15120
- C:\Windows\System\VTZdfyt.exe
  C:\Windows\System\VTZdfyt.exe
  2⤵
  PID:15200
- C:\Windows\System\MfyLwdY.exe
  C:\Windows\System\MfyLwdY.exe
  2⤵
  PID:15244
- C:\Windows\System\eVdRppJ.exe
  C:\Windows\System\eVdRppJ.exe
  2⤵
  PID:15288
- C:\Windows\System\FVESZWg.exe
  C:\Windows\System\FVESZWg.exe
  2⤵
  PID:15352
- C:\Windows\System\OFffBLI.exe
  C:\Windows\System\OFffBLI.exe
  2⤵
  PID:14480
- C:\Windows\System\iISdowb.exe
  C:\Windows\System\iISdowb.exe
  2⤵
  PID:14600
- C:\Windows\System\iyQpHci.exe
  C:\Windows\System\iyQpHci.exe
  2⤵
  PID:14700
- C:\Windows\System\DSoYcZg.exe
  C:\Windows\System\DSoYcZg.exe
  2⤵
  PID:14876
- C:\Windows\System\UTNttZE.exe
  C:\Windows\System\UTNttZE.exe
  2⤵
  PID:15036
- C:\Windows\System\GIFtKbo.exe
  C:\Windows\System\GIFtKbo.exe
  2⤵
  PID:15224
- C:\Windows\System\rKqBoYd.exe
  C:\Windows\System\rKqBoYd.exe
  2⤵
  PID:14380
- C:\Windows\System\VuOIGoV.exe
  C:\Windows\System\VuOIGoV.exe
  2⤵
  PID:14672
- C:\Windows\System\bKmAGpw.exe
  C:\Windows\System\bKmAGpw.exe
  2⤵
  PID:14832
- C:\Windows\System\XLPYMun.exe
  C:\Windows\System\XLPYMun.exe
  2⤵
  PID:14768
- C:\Windows\System\ElAggjW.exe
  C:\Windows\System\ElAggjW.exe
  2⤵
  PID:15260
- C:\Windows\System\dgKCIxT.exe
  C:\Windows\System\dgKCIxT.exe
  2⤵
  PID:15372
- C:\Windows\System\iGIvrtn.exe
  C:\Windows\System\iGIvrtn.exe
  2⤵
  PID:15400
- C:\Windows\System\UjwkiRq.exe
  C:\Windows\System\UjwkiRq.exe
  2⤵
  PID:15448
- C:\Windows\System\ssQJmiY.exe
  C:\Windows\System\ssQJmiY.exe
  2⤵
  PID:15468
- C:\Windows\System\CVSZIOX.exe
  C:\Windows\System\CVSZIOX.exe
  2⤵
  PID:15492
- C:\Windows\System\ysrgNml.exe
  C:\Windows\System\ysrgNml.exe
  2⤵
  PID:15524
- C:\Windows\System\iVqcYLR.exe
  C:\Windows\System\iVqcYLR.exe
  2⤵
  PID:15572
- C:\Windows\System\KeFimyH.exe
  C:\Windows\System\KeFimyH.exe
  2⤵
  PID:15588
- C:\Windows\System\vVnHtfT.exe
  C:\Windows\System\vVnHtfT.exe
  2⤵
  PID:15616
- C:\Windows\System\nlgRhJN.exe
  C:\Windows\System\nlgRhJN.exe
  2⤵
  PID:15640
- C:\Windows\System\KptmdaK.exe
  C:\Windows\System\KptmdaK.exe
  2⤵
  PID:15664
- C:\Windows\System\hgussHh.exe
  C:\Windows\System\hgussHh.exe
  2⤵
  PID:15692
- C:\Windows\System\BOdoZZj.exe
  C:\Windows\System\BOdoZZj.exe
  2⤵
  PID:15728
- C:\Windows\System\sSemCbZ.exe
  C:\Windows\System\sSemCbZ.exe
  2⤵
  PID:15752
- C:\Windows\System\szFzNKl.exe
  C:\Windows\System\szFzNKl.exe
  2⤵
  PID:15772
- C:\Windows\System\sYrzrVY.exe
  C:\Windows\System\sYrzrVY.exe
  2⤵
  PID:15812
- C:\Windows\System\MZwIVFH.exe
  C:\Windows\System\MZwIVFH.exe
  2⤵
  PID:15840
- C:\Windows\System\XmWGhwy.exe
  C:\Windows\System\XmWGhwy.exe
  2⤵
  PID:15856
- C:\Windows\System\qnZuhAu.exe
  C:\Windows\System\qnZuhAu.exe
  2⤵
  PID:15872
- C:\Windows\System\PCXRfpR.exe
  C:\Windows\System\PCXRfpR.exe
  2⤵
  PID:15912
- C:\Windows\System\tYgpElc.exe
  C:\Windows\System\tYgpElc.exe
  2⤵
  PID:15932
- C:\Windows\System\atnEgMp.exe
  C:\Windows\System\atnEgMp.exe
  2⤵
  PID:15964
- C:\Windows\System\BhDLcmD.exe
  C:\Windows\System\BhDLcmD.exe
  2⤵
  PID:15996
- C:\Windows\System\spzMjwl.exe
  C:\Windows\System\spzMjwl.exe
  2⤵
  PID:16012
- C:\Windows\System\XEQQesY.exe
  C:\Windows\System\XEQQesY.exe
  2⤵
  PID:16052
- C:\Windows\System\fWRGBof.exe
  C:\Windows\System\fWRGBof.exe
  2⤵
  PID:16080
- C:\Windows\System\kkQKgxU.exe
  C:\Windows\System\kkQKgxU.exe
  2⤵
  PID:16096
- C:\Windows\System\IKicOhP.exe
  C:\Windows\System\IKicOhP.exe
  2⤵
  PID:16132
- C:\Windows\System\nkVPYvk.exe
  C:\Windows\System\nkVPYvk.exe
  2⤵
  PID:16160
- C:\Windows\System\szGlkAH.exe
  C:\Windows\System\szGlkAH.exe
  2⤵
  PID:16192
- C:\Windows\System\NCXQzvG.exe
  C:\Windows\System\NCXQzvG.exe
  2⤵
  PID:16216
- C:\Windows\System\FemkgMn.exe
  C:\Windows\System\FemkgMn.exe
  2⤵
  PID:16244
- C:\Windows\System\UaNQCPs.exe
  C:\Windows\System\UaNQCPs.exe
  2⤵
  PID:16292
- C:\Windows\System\mdwieND.exe
  C:\Windows\System\mdwieND.exe
  2⤵
  PID:16320
- C:\Windows\System\MOFYsOh.exe
  C:\Windows\System\MOFYsOh.exe
  2⤵
  PID:16344
- C:\Windows\System\RXwIIyv.exe
  C:\Windows\System\RXwIIyv.exe
  2⤵
  PID:16360
- C:\Windows\System\rnpTZXi.exe
  C:\Windows\System\rnpTZXi.exe
  2⤵
  PID:15368
- C:\Windows\System\UlqolGQ.exe
  C:\Windows\System\UlqolGQ.exe
  2⤵
  PID:15504
- C:\Windows\System\lKpSAXA.exe
  C:\Windows\System\lKpSAXA.exe
  2⤵
  PID:15536
- C:\Windows\System\OhoYCgI.exe
  C:\Windows\System\OhoYCgI.exe
  2⤵
  PID:15580
- C:\Windows\System\kpwYNiZ.exe
  C:\Windows\System\kpwYNiZ.exe
  2⤵
  PID:15676
- C:\Windows\System\jymRgxw.exe
  C:\Windows\System\jymRgxw.exe
  2⤵
  PID:15748
- C:\Windows\System\nJvOpDO.exe
  C:\Windows\System\nJvOpDO.exe
  2⤵
  PID:15808
- C:\Windows\System\JLuOowd.exe
  C:\Windows\System\JLuOowd.exe
  2⤵
  PID:15824
- C:\Windows\System\rqVuZVD.exe
  C:\Windows\System\rqVuZVD.exe
  2⤵
  PID:15896
- C:\Windows\System\mCyuXuI.exe
  C:\Windows\System\mCyuXuI.exe
  2⤵
  PID:15988
- C:\Windows\System\AtXedfs.exe
  C:\Windows\System\AtXedfs.exe
  2⤵
  PID:16048
- C:\Windows\System\vHmTgzP.exe
  C:\Windows\System\vHmTgzP.exe
  2⤵
  PID:16088
- C:\Windows\System\wGDGApn.exe
  C:\Windows\System\wGDGApn.exe
  2⤵
  PID:16168
- C:\Windows\System\nZviXOw.exe
  C:\Windows\System\nZviXOw.exe
  2⤵
  PID:16212
- C:\Windows\System\RbbOVUo.exe
  C:\Windows\System\RbbOVUo.exe
  2⤵
  PID:16224
- C:\Windows\System\OEJjGac.exe
  C:\Windows\System\OEJjGac.exe
  2⤵
  PID:16356
- C:\Windows\System\LAxtcVS.exe
  C:\Windows\System\LAxtcVS.exe
  2⤵
  PID:15384
- C:\Windows\System\CyKGdOC.exe
  C:\Windows\System\CyKGdOC.exe
  2⤵
  PID:15632
- C:\Windows\System\lHItssV.exe
  C:\Windows\System\lHItssV.exe
  2⤵
  PID:15784
- C:\Windows\System\fJIFwup.exe
  C:\Windows\System\fJIFwup.exe
  2⤵
  PID:15832
- C:\Windows\System\ZddxCnb.exe
  C:\Windows\System\ZddxCnb.exe
  2⤵
  PID:15972
- C:\Windows\System\XAMcWPs.exe
  C:\Windows\System\XAMcWPs.exe
  2⤵
  PID:16184
- C:\Windows\System\BVaRxCN.exe
  C:\Windows\System\BVaRxCN.exe
  2⤵
  PID:16284
- C:\Windows\System\MQjyegi.exe
  C:\Windows\System\MQjyegi.exe
  2⤵
  PID:15724
- C:\Windows\System\TqLflDh.exe
  C:\Windows\System\TqLflDh.exe
  2⤵
  PID:16108
- C:\Windows\System\IDoezIB.exe
  C:\Windows\System\IDoezIB.exe
  2⤵
  PID:15108
- C:\Windows\System\ivwjMCl.exe
  C:\Windows\System\ivwjMCl.exe
  2⤵
  PID:15892
- C:\Windows\System\HIvGiTV.exe
  C:\Windows\System\HIvGiTV.exe
  2⤵
  PID:16252
- C:\Windows\System\UuUXNwk.exe
  C:\Windows\System\UuUXNwk.exe
  2⤵
  PID:16404
- C:\Windows\System\QHiBeVz.exe
  C:\Windows\System\QHiBeVz.exe
  2⤵
  PID:16424
- C:\Windows\System\KEthCuX.exe
  C:\Windows\System\KEthCuX.exe
  2⤵
  PID:16456
- C:\Windows\System\LJWaJuv.exe
  C:\Windows\System\LJWaJuv.exe
  2⤵
  PID:16492
- C:\Windows\System\QsLpwPj.exe
  C:\Windows\System\QsLpwPj.exe
  2⤵
  PID:16520
- C:\Windows\System\hhQTqBh.exe
  C:\Windows\System\hhQTqBh.exe
  2⤵
  PID:16548
- C:\Windows\System\gllTZGi.exe
  C:\Windows\System\gllTZGi.exe
  2⤵
  PID:16572
- C:\Windows\System\ESMdXqo.exe
  C:\Windows\System\ESMdXqo.exe
  2⤵
  PID:16596
- C:\Windows\System\DLIcLsE.exe
  C:\Windows\System\DLIcLsE.exe
  2⤵
  PID:16636
- C:\Windows\System\ZohsQiK.exe
  C:\Windows\System\ZohsQiK.exe
  2⤵
  PID:16664
- C:\Windows\System\XAdLnAB.exe
  C:\Windows\System\XAdLnAB.exe
  2⤵
  PID:16692
- C:\Windows\System\ChRlAaz.exe
  C:\Windows\System\ChRlAaz.exe
  2⤵
  PID:16716
- C:\Windows\System\ENprjvb.exe
  C:\Windows\System\ENprjvb.exe
  2⤵
  PID:16744
- C:\Windows\System\ohVUjCZ.exe
  C:\Windows\System\ohVUjCZ.exe
  2⤵
  PID:16776
- C:\Windows\System\nxsiHME.exe
  C:\Windows\System\nxsiHME.exe
  2⤵
  PID:16796
- C:\Windows\System\QqCZNBF.exe
  C:\Windows\System\QqCZNBF.exe
  2⤵
  PID:16824
- C:\Windows\System\wJNZlzn.exe
  C:\Windows\System\wJNZlzn.exe
  2⤵
  PID:16876

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BvCxwFy.exe

Filesize
1.7MB

MD5
bd2a992425c301d9eb4b93b4bc26d65e

SHA1
a2697539929bdce12505578591bf11a6af1ab3a2

SHA256
cd24697d6b2b6eadfcd8a64beccf7c54a9030eade005bae1ae8c413875a8b0ae

SHA512
3a2317e6be1d944e59a25d40eee325ce9b49858a9d241bec170e683e570f7bfb63a3477f34c5fe27381515e04cbb1218aee0559343446cbdfd9455a114c8bf7d

Download Submit
C:\Windows\System\DmRaAcN.exe

Filesize
1.7MB

MD5
7a68dfe5cda51c48dd9837cdc581f106

SHA1
41823a0ad370e1c4ab61093a20fda150886cab77

SHA256
7734b9819bf9bff9032eeadc036196aed7352e4783eea1089b8471de37496e8a

SHA512
5a4a5788f53e7b4f8db27f85cc2a1eee1081f0b2bc3e1289e5506f551c50aafc56e6f6420f85504212c0f2c4f7ba4fb54d24c73d5665603c3addb878698f1ba1

Download Submit
C:\Windows\System\ElxQsSy.exe

Filesize
1.7MB

MD5
b5759529144bd1c0bd802531829014b5

SHA1
4d391dec3e53dd8590dfb1c9bc300d20a6b8e0b2

SHA256
e4f9ef3362d4d85b1dd7308e6eccc87fc139a3607e5f04269cd7e270dc155416

SHA512
6bf66d902c6c1e1e4b361b28af6b3074b352f11e288d6ebb9182941c883af6142686e68c98d156ae0fe7d2fb740c6a4bfd38a86ad33c5857525f195f662f1842

Download Submit
C:\Windows\System\FUNnzZE.exe

Filesize
1.7MB

MD5
b899d34c918b22f43f15a3fedbd99e7a

SHA1
c75ec566e6658e8aa81322eee05dd84c0de5efc2

SHA256
73904e6c8c57ff0689ba75fd278a7ce7aecae9f9d4bbe8295f94fc9154590373

SHA512
74c05944c2e9cabe4a7ecd53237b61d82ae760231a43c9e464105339c6336ee68fcd695e41470bfa3aed23be75b9f9cd951b580e46655b6595ef4f1159db94d7

Download Submit
C:\Windows\System\FxCNclz.exe

Filesize
1.7MB

MD5
fda83e9724684eb031d4041c24a93921

SHA1
ed9d2aef3f12ad730549c72c0d9a899dd12fefc3

SHA256
7f170c634e8dfd432fa091aed49ec549646e00f0f1442f9ba8745d8475f78bc3

SHA512
093b7a72869a091378da926376dd9484c58c2f786f2b6894e0b86cfacfad2f5944dfa0c7bcea85c58fe1bb4b7a18c0e6922c32e43b089aef897e57e7b7d1806b

Download Submit
C:\Windows\System\HuGeYMr.exe

Filesize
1.7MB

MD5
eb067eed9401cb21f6f637eed2445529

SHA1
5650981c73b810f9f53df239b5f77bc4f085bba3

SHA256
633081a5591a3d33378bf1f822421d51e940b0c1792d9b5b088c33a9fafb9062

SHA512
2458c0cb5e89b012be9f5a35e5245cbeea982f7962da325ee956c53ec2b98239ba8eb166e7f7b46aed72f004b1572fe6f695fe05b9f7bbafd59f9e134054cec4

Download Submit
C:\Windows\System\IWDncWA.exe

Filesize
1.7MB

MD5
ecc11d4990f2149feba82a36c07bbb69

SHA1
5f03e64b13ff88102b8e53e6f4103aff67524037

SHA256
056a6d729745b56bde9a7b67c9cb57b61258dbe29b76382caddfbb89350357cf

SHA512
98e911a9dff76064a2822873f7ecc5050b0fc47b576d9871a00d0e73651b6c7f51ada8c69dff76b1d170bf67f6caa25dfcb8bb913429191bc7e921125708ce4a

Download Submit
C:\Windows\System\IfdGEth.exe

Filesize
1.7MB

MD5
da5545ad5ae29423b956f73e2fc87988

SHA1
3a696e2a2be5aec040fa138a47fc9bc23f4b8f59

SHA256
e14f129cdb2db1f9e38fc7435f9ec10892506286b9d0163395d1f838c9cef979

SHA512
3836241c12e1ff87919425585eabd0d7ac4c6fae696e8cf368e4918765053d616afc4dd736516a87528cf28044c30e89e558d1b14038d8376cf29ee45c6ec1bc

Download Submit
C:\Windows\System\LUtGMfL.exe

Filesize
1.7MB

MD5
89d10efe0a058671790a9b36563bc02f

SHA1
4a0171328384bb2eb0289e443e90c5305eaf9002

SHA256
ec7fad4edb2ce9e557d305267907312be59515686a94e3956aff15c5ea7dc21f

SHA512
db48be8de65cb33c85cd09e679bd272896e4188a81115b29b535a8a4283faf145569bea1c319c79e5e71e3801f32276e027625561e4e47eab8486487fe39a98b

Download Submit
C:\Windows\System\MsJGNOE.exe

Filesize
1.7MB

MD5
72db480af494fcd345b88dc99464dd6d

SHA1
6540f785c009ea33183272e942e33dda2df2e66f

SHA256
1e3b40be7e3334736cb981fc92d6d26265595c2265746276adf5ff0e4dccb5ff

SHA512
18f6328864f44dcf01dd20fcbf48c23ef505b12288999d272bf93f05442b6ed3202803a3395d02fa011fb5a0d8ab74d8d151728cc8f143a3d1de555db63a089a

Download Submit
C:\Windows\System\PMFjEEX.exe

Filesize
1.7MB

MD5
ca53222b881069e8197a3b2bc94bf33a

SHA1
cdf20c4f829ae27ec4cac0797791c472f68a884b

SHA256
7d7837b47e560897618cb1ccf2c99b64e6a55169ff030a90b6aa903d8eb3ec91

SHA512
e59af937f07bcbfe67df08aa71e14c2c1510d3619d091657b8dd76cf11064cd9d4556132f9f1cd20efd4d8411fdd79ca02420b0a48852f0d5db1043679361468

Download Submit
C:\Windows\System\RSveQrz.exe

Filesize
1.7MB

MD5
e032ba230ff0b681bb44eccf300cf57b

SHA1
a041d61be057a25c3ffc783d5c35c73a65617807

SHA256
d689545428651922c608434f81adc618a9d83adc383180d587b8fe4c7b801aef

SHA512
8a1dead12900a8075e7c68da1287be1b2ee79024478d8365e89849111f719558e3dc34074a4d7e03836f1c63839676ec5c50df612957955d123749ed0567acfa

Download Submit
C:\Windows\System\TNPlWZj.exe

Filesize
1.7MB

MD5
05b122a7ff8f6c6fcee2755608eb7c13

SHA1
751636bb8c9a150feb58c811aa3ea8224616a88d

SHA256
108cfb72de9557ea8bd94ae3bb4264f6e491405a04259085fb4330335691d8eb

SHA512
e97d0a7c9a7fabfba0cc03c191570cbef5314c5df7c81441bf83d82b53c3e6b4a1906b4cf81d5c02b749869de2ff6b3be28b4a78ddb01ea28baa4e50eb010071

Download Submit
C:\Windows\System\UkTYhqo.exe

Filesize
1.7MB

MD5
c18b2e1d41b173b8df9708799e9b4e39

SHA1
f7d4b148f59582a0afc760b2461b86e1bb3aacf2

SHA256
c3e3b69fa5411334c88db276c8a0fe5e66d566854bafd1be61948c2cb7e3cdc2

SHA512
5d95cd9d6b5b4656a3573d9ce200541aa3ac463a32752c4d134beae91011b39a4585eeb3ac5eeef3d3581e64dd79ebd3afbe31f1b91e6682ea316a240afb4570

Download Submit
C:\Windows\System\WapaPoe.exe

Filesize
1.7MB

MD5
26f0bec5ca60bc6eb660d60338db9ca0

SHA1
0adc21013ac458693fb39f34388d2d33ce876544

SHA256
84d9a9998ae937c72b197e24dca4570f9cf929e82f457c1bd770295d7b906004

SHA512
f8cb1f0fac74231ee9c42b5c51d79f04c0f593263d567a4b10759f1d9fa989e467b4c9b7deb41024fa78f9bd2f92a558a5657866ed286ebb8478a76de55535f5

Download Submit
C:\Windows\System\WjEbUYc.exe

Filesize
1.7MB

MD5
a010b8889975b2f0daa1e593817f5e26

SHA1
cf98d3eb88d7bb41dd66d581b352916cbf70aff0

SHA256
c969f7a361cdce745dc2930e996462ca3207cc4543c26ff3af09a608c59df8b1

SHA512
47804386cae5dc2ab8e02f0414d14fd395f02108c76573d1d172a3e320c9302351e076f273dff6379968e2cd7221eabee47c83a3510f407015fa45eecc3aca07

Download Submit
C:\Windows\System\ZHqtEED.exe

Filesize
1.7MB

MD5
6adf884f068561ac1de3092bfbf863a7

SHA1
be67ae2d04687959cd98c9e35a1e256b56b971ed

SHA256
72a02e200c814136b5d2f2e7ebab397dd575a4c068b2f91b764f5b88269d267a

SHA512
43d05fdacaa4cdc372e0f19afbdf1b8406407e6f542f7122c0b948231c6d02f196c0610679cae5ae3255cabdd5c7d3d440e67d5587ea1c51896efaff5f73f919

Download Submit
C:\Windows\System\eByIOJb.exe

Filesize
1.7MB

MD5
2512c73934797f3b14c3e3eace30f9f3

SHA1
f74398a060edee0a8a69bdd9efd5f4ed58b3a462

SHA256
b091f10a4087489203459e44be0ae986d0f19efe55868278c5d4bc6872f63e96

SHA512
c1d2f7ca411b670a57a5353a3778736dc46bd47cfbd94256bb782d5b1732a29fc9cc9d1dd7fc1c1bee2d5b2605b97198603031e1b04b4f693edab401614f5481

Download Submit
C:\Windows\System\eQXWxwI.exe

Filesize
1.7MB

MD5
7a94b884f38e56ed39365b219abb0b6e

SHA1
a89b9bebf205debdd5958b68327a2833cc8ea5d6

SHA256
ed152523dc1b4d7e7cad2fd4bb90e3f2646d3d47de0cf433beace0caec47e01a

SHA512
cab53c902f7d305a6ef12f258d1c15e120b4c2fdfacd5f98c3af9e535725598613d99a0a522cde26d47466c38bed77569d20806f1bd153ca7bd6bd1c4a500bcb

Download Submit
C:\Windows\System\gYlbLCZ.exe

Filesize
1.7MB

MD5
82fc200bb0e33cbc003ed3bea31470af

SHA1
a5b6dd81fe8334a06c1718fd0c02c2f5a8c790f8

SHA256
9d03ffcb835ba15ad0b236699a145fef570c5acf33ffb2953191bd75d8ce0182

SHA512
70b762f7e144cdf49cd3538e4821f6dcce451eef55050c65a19f84fb9c91bae84254fc0870ce18b51ed5d5f1a4b3f32ab4763e91ecaabd201d3e988ca47bf07c

Download Submit
C:\Windows\System\ihYEsyJ.exe

Filesize
1.7MB

MD5
dddf8b205c51f76a7e4e6767fd195701

SHA1
4f6799c6eaa3f681d01144dfe14dea0dac198f0b

SHA256
262ca36fdf97cf2ac671901dc9c9b4bf36dd7894553247acf50f18d7e5045ccc

SHA512
23d4f71387e5085c99f36218e263c50788e33142fd3a4e6b6afbb81a7839781b9992c9dcf6d63a63599d7fb2053024132df5cdce7746d69971c3c94e3c5921fd

Download Submit
C:\Windows\System\kWKCJhR.exe

Filesize
1.7MB

MD5
1aa8fb87959f70bb1f6e3fd80c23f0d9

SHA1
244808933ac69ea5634ed0ded4be0696d0e2496e

SHA256
e6087145d10e0c5ac30ad61ff78d72b59c075ed04964f1c0ce55921e58a46951

SHA512
1fd7323ff8488e197ca5b7d140e7ca1b5fba33c76878b086c33aa5754d1c4a6e6865a0908c50fd4ec4cb58abf7d0c65c883140450bf734010b4fd5f3b2d8110a

Download Submit
C:\Windows\System\ksKBgDe.exe

Filesize
1.7MB

MD5
3c2a2f774bbabfe1346873ed11f590b8

SHA1
f25ffdbc7acbb8408de52480149f345562fae515

SHA256
2293af72aa4416c062398f5f0bea370378a68e5bd9c6ad15aaa40132056f4533

SHA512
ba14dab6add79be7b0bf6efc5c94b01fbc75d77f4fa172b4badd36ca209e89139df94bcdb8815d958f52af249fe3775ca2b39feea652db5f9f387403a4181770

Download Submit
C:\Windows\System\nbXfBcO.exe

Filesize
1.7MB

MD5
2eac29a7d44f84d2290d6eb3448db590

SHA1
23294ace1d11d21a6ebe0293c35668933140c3b4

SHA256
ebe15f5ed9b5d748ef8a643a91daed984672bfcdaa9dcbc96171f2457d627291

SHA512
587e39e338797149ac7aac42aacb43287c2440ce491e3cc9f55e428bda6bf58bfd5db050b58c25ebae2dbf3c991dca53dfc681152910dc6d163f9f0f930c523a

Download Submit
C:\Windows\System\oTJpLKs.exe

Filesize
1.7MB

MD5
bf65b80d3ccd6ce6075a70d60ff09133

SHA1
f20c5240c5c1d4108aafd8732a4b7b5032a6aee1

SHA256
3bf1a36ce13ff4c578549912c69b8ae67c4f1bdfad3c7227b46d56d3a254b99d

SHA512
3884d66a5da49166c92c39c4d11d61550f04baa7c874e8ec7418b6bed7d585ef3b5402515bad98389d24bad11b79952fa36237de1c9a7165a612c462cbf553b0

Download Submit
C:\Windows\System\pFpwwvi.exe

Filesize
1.7MB

MD5
d1aeb4b211a4430554167e55efafd190

SHA1
1354cfbabd48218c3c9043f85cd71545f864b41b

SHA256
fad8921a407a35b863bdc50929317633b71ac0dad82bbc4229b95144351a600d

SHA512
a72cf5df7c754b8a6e25ad4790eb4e5a98d21f024f733c2adc534297d4099aba3b65888282d146b18bfca5e9d86e94c3c3bbab52fae472ef9a93275ad070b240

Download Submit
C:\Windows\System\pHTjcJP.exe

Filesize
1.7MB

MD5
80c9a34b47c68914ff6f998d51f1949d

SHA1
7dfee304df459c645eb2007b9766790cc2f0e504

SHA256
5819d08105fb85755f033d3d1098366d58a6b7977559bbec9f1b5cac6b9f100b

SHA512
a4e1ab240a6405cb24d18baee561836bb5485e830a4857823abf4d1a9335d4a04c5cee4337782a51bde5a6da74cd919b749e075fb0b22c973ea0a00378e40432

Download Submit
C:\Windows\System\sDGdcJf.exe

Filesize
1.7MB

MD5
dcf85f13cbd3a188ef56ea0d0e404597

SHA1
5108e19aa9bde898257f82f1fb2176a27e2e1554

SHA256
6ebf7e25ce380137dac36ed841a47558f404aef22aac8bd01692ec056f05de8b

SHA512
de2a05e5ba416d3febd8e3c3ca105f26453f60ae42a026d4270f01640cd4ef8c90cb50080f3bfd8a2960419494b88c3781efa18c46c9603e8f9d4c2cc7b2ed6e

Download Submit
C:\Windows\System\sZxTiZa.exe

Filesize
1.7MB

MD5
81cbd3b41038a6c887130bdc6d8fff1e

SHA1
b40b521a441b77e31ac4383e29c9193a3af84908

SHA256
b68dd0c14f3892271f21083184500daacd646b0badcacfa7b8af9f1e44dbd89c

SHA512
9f4e15bbb5f329d6e7c05ad70fc34b972a3eb05cf8e8ac1295a4eef126316d8428a87b584978d9f6b09632676b21a265c1adaf4aed4a30be179367a1d30e64e3

Download Submit
C:\Windows\System\votzAdk.exe

Filesize
1.7MB

MD5
263e762a28fc0f15a1d8f0ef751da1a8

SHA1
f6fd46c75178843bad361559ea3eff2633b077bf

SHA256
d4e5ba5e6e5d03b69bd7fa0c11997a1ee5c50c8f502a15b5511c364af5eb389c

SHA512
0e2b50ae31ff1f387ab9307a03acc9a7ff2d63a94105e4ea1fa89f01dfb0cefd9604b9b709439829db95ec0c6f62ee07c1cf7e586b4c5cd9e11187d3fde9f7d6

Download Submit
C:\Windows\System\wNzGlvF.exe

Filesize
1.7MB

MD5
66a88856a2d139808b168a07dd79658d

SHA1
8b7d220965e86a8ec75da5d5e07dfee800396101

SHA256
feabb01b1ea0d6017b61b69ceafd0f087ac6198feb7539fac8c393739ed76a2b

SHA512
568ee4937ee3ea715f8ce71b376779a0f58e9eb3b48e8926b39f1ca1c8ca8f1d02ef9c352f47c3a98055943b32cf001efa5adcbf1eb039448d24cfc34f402533

Download Submit
C:\Windows\System\xcIxDMp.exe

Filesize
1.7MB

MD5
c786ae5fa3ab73f72019466cce40312d

SHA1
8e5e601cfba1ce1067dbac3f9e586561ed40d893

SHA256
1fbc74d821a8559b20cc0854a4269e19e6e284195ba38068edbfb380d07f87b4

SHA512
6d23706b8a641f7e2e2bd40954abcb546c9389a74f0b8462df4a55a07821aba8e1417d36b599c84ff9bf47eafb38122f8fecbdd9e0031f6b15c392d5bc05d7e2

Download Submit
C:\Windows\System\yGEEIde.exe

Filesize
1.7MB

MD5
5c1022ade09fb6cc6290ddacba3760e2

SHA1
e4449236f2fc2a604719e49597b030eb07ad6be9

SHA256
d900c72370f552ff4fb8d5b99bf555e831d29e5ab0ae9f6d75dda7449f893440

SHA512
b2115cf3cb60642a42db8f1d5fc57886f62447f0824b4c0c36ea3c3fc456f75f104862050ffbf7afe3339da02bb1f7d6dd0bd43eabd4505ebd45408e25f43f4e

Download Submit
memory/3708-0-0x0000028EAB410000-0x0000028EAB420000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads