xmrig | 7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
Size

1.7MB
MD5

4d3a72c3da309d24c81f1e4f3ed2ce47
SHA1

ad3c3c66b37455dbc4cb1b9b27da9d12d2e0d8e0
SHA256

7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972
SHA512

4482fc1d90a2293303670ebe13dc7a91d2a3bc49cfa160eb2b5edff6f8305e9f3c2ae1f9986ad8b624cfd79b170f967e3e23a65897aa138b67f66399352f3e80
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQmnVwYFFA:GemTLkNdfE0pZya

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023bbd-5.dat	xmrig
behavioral2/files/0x0007000000023c91-10.dat	xmrig
behavioral2/files/0x0007000000023c92-15.dat	xmrig
behavioral2/files/0x0007000000023c93-20.dat	xmrig
behavioral2/files/0x0007000000023c94-24.dat	xmrig
behavioral2/files/0x0007000000023c95-29.dat	xmrig
behavioral2/files/0x0007000000023c96-32.dat	xmrig
behavioral2/files/0x0007000000023c97-39.dat	xmrig
behavioral2/files/0x0007000000023c98-44.dat	xmrig
behavioral2/files/0x0008000000023c8e-49.dat	xmrig
behavioral2/files/0x0007000000023c99-52.dat	xmrig
behavioral2/files/0x0007000000023c9a-59.dat	xmrig
behavioral2/files/0x0007000000023c9b-63.dat	xmrig
behavioral2/files/0x0007000000023c9c-69.dat	xmrig
behavioral2/files/0x0007000000023c9d-74.dat	xmrig
behavioral2/files/0x0007000000023c9e-77.dat	xmrig
behavioral2/files/0x0007000000023c9f-84.dat	xmrig
behavioral2/files/0x0007000000023ca0-88.dat	xmrig
behavioral2/files/0x0007000000023ca1-93.dat	xmrig
behavioral2/files/0x0007000000023ca2-99.dat	xmrig
behavioral2/files/0x0007000000023ca4-102.dat	xmrig
behavioral2/files/0x0007000000023ca5-110.dat	xmrig
behavioral2/files/0x0007000000023ca6-113.dat	xmrig
behavioral2/files/0x0007000000023ca7-119.dat	xmrig
behavioral2/files/0x0007000000023ca9-127.dat	xmrig
behavioral2/files/0x0007000000023ca8-128.dat	xmrig
behavioral2/files/0x0007000000023cac-140.dat	xmrig
behavioral2/files/0x0007000000023cab-142.dat	xmrig
behavioral2/files/0x0007000000023cad-147.dat	xmrig
behavioral2/files/0x0007000000023caa-141.dat	xmrig
behavioral2/files/0x0007000000023cae-155.dat	xmrig
behavioral2/files/0x0007000000023caf-160.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2088	idAvGWF.exe
3148	sVdHAhZ.exe
3260	kHgYGLr.exe
684	qYZNIBj.exe
3208	csvxdsx.exe
2780	nBXQAdS.exe
4584	vFZvZSm.exe
388	PzRhCMy.exe
4048	FjIhZgp.exe
1984	QxnlSfb.exe
4296	vnYOqdM.exe
720	pzafeNo.exe
1924	oeTgIJd.exe
2444	XNMFGMH.exe
4752	AhftJgB.exe
1452	XpHtmMo.exe
4000	cXLcdKy.exe
752	fexkpHM.exe
3960	LkOmfxo.exe
4060	fMFJbXo.exe
2420	NfjEewS.exe
2164	vlhYCvd.exe
4656	XPxwOwD.exe
4724	xTgKwoM.exe
1536	skRqgsm.exe
1712	WWGnnHH.exe
4536	wbSNTyH.exe
2060	oTtVaqb.exe
2152	HLhbEPE.exe
2104	nmKtjUX.exe
428	ESegUPa.exe
4768	fpcIWPD.exe
1812	rVOrAGQ.exe
448	dzpPbfM.exe
3048	aUbaUgu.exe
1220	KHBaNMf.exe
2160	gRfVeBR.exe
4184	LTHlfJU.exe
312	OsWpQSA.exe
3600	wohiUhE.exe
3592	SaSfQpe.exe
4884	erJHJWk.exe
4004	FwbrbHO.exe
4764	sLPUjwM.exe
2812	DAMYuEu.exe
3820	CLEVqRf.exe
3928	tNGbrzH.exe
2192	WwKGvyW.exe
1612	oxZkfti.exe
4436	cPtunYr.exe
680	DYTDYKj.exe
3888	ICjHKJC.exe
3940	dXqApZV.exe
2432	OtGQBuQ.exe
3632	BLgcRtm.exe
2448	vboZPfZ.exe
5068	fdCtCga.exe
3748	bHTnChu.exe
3436	NsSdPzz.exe
348	tuDTrwe.exe
1328	uqDNMQN.exe
3412	KlQzYXY.exe
100	cUPOesJ.exe
4612	ukslZhM.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GlSbtFR.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\rIAVCaK.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\QnNXVbG.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\MxDyYll.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\rpqkCtr.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\aljteZL.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\eTIzABP.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\gFLpxIa.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\WfSpkiN.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\wpjKpqc.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\yupdFHz.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\SvgJwnQ.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\gColVnd.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\AslvSGK.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\ceMnNmM.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\EiDGCbM.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\ZcBOBhS.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\cMGJXGQ.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\nCBcHMj.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\IXbVDJp.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\BnkRTnU.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\SQDouIg.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\HvuwBCs.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\dXqApZV.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\bENfYbH.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\onkIBCL.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\xogurQh.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\CbrnWhv.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\WPXAFHM.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\kBgAftY.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\qcZxofU.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\yKCNDhs.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\jJQonOI.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\vboZPfZ.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\jGKQzVF.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\dqwMPek.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\NsSdPzz.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\hYGoGdF.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\CBuorOB.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\pBTagMb.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\fKptOvY.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\GkIKSgD.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\KQIdzYq.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\LQrjyqt.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\YrkPiMA.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\ioaCunb.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\vQcWYZm.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\ODhPQsS.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\rGTTaIa.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\pbAcQCy.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\bRkZArF.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\zuEFMQQ.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\xFcPKAE.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\WKeGpmW.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\IzjUZAE.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\cPjFHQg.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\eVDqmCQ.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\ciOwyeG.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\inWYoMT.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\QteGTLl.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\FjIhZgp.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\ynQFgxm.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\KdKIGEB.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
File created	C:\Windows\System\fFdHYKG.exe	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17256	dwm.exe
Token: SeChangeNotifyPrivilege	17256	dwm.exe
Token: 33	17256	dwm.exe
Token: SeIncBasePriorityPrivilege	17256	dwm.exe
Token: SeShutdownPrivilege	17256	dwm.exe
Token: SeCreatePagefilePrivilege	17256	dwm.exe
Token: SeShutdownPrivilege	17256	dwm.exe
Token: SeCreatePagefilePrivilege	17256	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 2088	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	84
PID 4684 wrote to memory of 2088	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	84
PID 4684 wrote to memory of 3148	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	85
PID 4684 wrote to memory of 3148	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	85
PID 4684 wrote to memory of 3260	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	86
PID 4684 wrote to memory of 3260	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	86
PID 4684 wrote to memory of 684	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	87
PID 4684 wrote to memory of 684	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	87
PID 4684 wrote to memory of 3208	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	88
PID 4684 wrote to memory of 3208	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	88
PID 4684 wrote to memory of 2780	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	89
PID 4684 wrote to memory of 2780	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	89
PID 4684 wrote to memory of 4584	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	90
PID 4684 wrote to memory of 4584	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	90
PID 4684 wrote to memory of 388	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	91
PID 4684 wrote to memory of 388	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	91
PID 4684 wrote to memory of 4048	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	92
PID 4684 wrote to memory of 4048	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	92
PID 4684 wrote to memory of 1984	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	93
PID 4684 wrote to memory of 1984	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	93
PID 4684 wrote to memory of 4296	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	94
PID 4684 wrote to memory of 4296	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	94
PID 4684 wrote to memory of 720	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	95
PID 4684 wrote to memory of 720	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	95
PID 4684 wrote to memory of 1924	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	96
PID 4684 wrote to memory of 1924	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	96
PID 4684 wrote to memory of 2444	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	97
PID 4684 wrote to memory of 2444	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	97
PID 4684 wrote to memory of 4752	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	98
PID 4684 wrote to memory of 4752	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	98
PID 4684 wrote to memory of 1452	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	99
PID 4684 wrote to memory of 1452	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	99
PID 4684 wrote to memory of 4000	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	100
PID 4684 wrote to memory of 4000	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	100
PID 4684 wrote to memory of 752	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	101
PID 4684 wrote to memory of 752	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	101
PID 4684 wrote to memory of 3960	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	102
PID 4684 wrote to memory of 3960	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	102
PID 4684 wrote to memory of 4060	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	103
PID 4684 wrote to memory of 4060	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	103
PID 4684 wrote to memory of 2420	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	104
PID 4684 wrote to memory of 2420	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	104
PID 4684 wrote to memory of 2164	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	105
PID 4684 wrote to memory of 2164	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	105
PID 4684 wrote to memory of 4656	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	106
PID 4684 wrote to memory of 4656	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	106
PID 4684 wrote to memory of 4724	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	107
PID 4684 wrote to memory of 4724	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	107
PID 4684 wrote to memory of 1536	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	108
PID 4684 wrote to memory of 1536	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	108
PID 4684 wrote to memory of 1712	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	109
PID 4684 wrote to memory of 1712	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	109
PID 4684 wrote to memory of 2060	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	110
PID 4684 wrote to memory of 2060	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	110
PID 4684 wrote to memory of 4536	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	111
PID 4684 wrote to memory of 4536	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	111
PID 4684 wrote to memory of 2152	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	112
PID 4684 wrote to memory of 2152	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	112
PID 4684 wrote to memory of 2104	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	113
PID 4684 wrote to memory of 2104	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	113
PID 4684 wrote to memory of 428	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	114
PID 4684 wrote to memory of 428	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	114
PID 4684 wrote to memory of 4768	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	115
PID 4684 wrote to memory of 4768	4684	7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe	115

C:\Users\Admin\AppData\Local\Temp\7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe
"C:\Users\Admin\AppData\Local\Temp\7326084fc6700f4f59bd6b0dad5cad9c5201c467b2a933c6655fbbbc706b6972.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\System\idAvGWF.exe
  C:\Windows\System\idAvGWF.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\sVdHAhZ.exe
  C:\Windows\System\sVdHAhZ.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\kHgYGLr.exe
  C:\Windows\System\kHgYGLr.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\qYZNIBj.exe
  C:\Windows\System\qYZNIBj.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\csvxdsx.exe
  C:\Windows\System\csvxdsx.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\nBXQAdS.exe
  C:\Windows\System\nBXQAdS.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\vFZvZSm.exe
  C:\Windows\System\vFZvZSm.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\PzRhCMy.exe
  C:\Windows\System\PzRhCMy.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\FjIhZgp.exe
  C:\Windows\System\FjIhZgp.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\QxnlSfb.exe
  C:\Windows\System\QxnlSfb.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\vnYOqdM.exe
  C:\Windows\System\vnYOqdM.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\pzafeNo.exe
  C:\Windows\System\pzafeNo.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\oeTgIJd.exe
  C:\Windows\System\oeTgIJd.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\XNMFGMH.exe
  C:\Windows\System\XNMFGMH.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\AhftJgB.exe
  C:\Windows\System\AhftJgB.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\XpHtmMo.exe
  C:\Windows\System\XpHtmMo.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\cXLcdKy.exe
  C:\Windows\System\cXLcdKy.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\fexkpHM.exe
  C:\Windows\System\fexkpHM.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\LkOmfxo.exe
  C:\Windows\System\LkOmfxo.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\fMFJbXo.exe
  C:\Windows\System\fMFJbXo.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\NfjEewS.exe
  C:\Windows\System\NfjEewS.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\vlhYCvd.exe
  C:\Windows\System\vlhYCvd.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\XPxwOwD.exe
  C:\Windows\System\XPxwOwD.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\xTgKwoM.exe
  C:\Windows\System\xTgKwoM.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\skRqgsm.exe
  C:\Windows\System\skRqgsm.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\WWGnnHH.exe
  C:\Windows\System\WWGnnHH.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\oTtVaqb.exe
  C:\Windows\System\oTtVaqb.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\wbSNTyH.exe
  C:\Windows\System\wbSNTyH.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\HLhbEPE.exe
  C:\Windows\System\HLhbEPE.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\nmKtjUX.exe
  C:\Windows\System\nmKtjUX.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\ESegUPa.exe
  C:\Windows\System\ESegUPa.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\fpcIWPD.exe
  C:\Windows\System\fpcIWPD.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\rVOrAGQ.exe
  C:\Windows\System\rVOrAGQ.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\dzpPbfM.exe
  C:\Windows\System\dzpPbfM.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\aUbaUgu.exe
  C:\Windows\System\aUbaUgu.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\KHBaNMf.exe
  C:\Windows\System\KHBaNMf.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\gRfVeBR.exe
  C:\Windows\System\gRfVeBR.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\LTHlfJU.exe
  C:\Windows\System\LTHlfJU.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\OsWpQSA.exe
  C:\Windows\System\OsWpQSA.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\wohiUhE.exe
  C:\Windows\System\wohiUhE.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\SaSfQpe.exe
  C:\Windows\System\SaSfQpe.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\erJHJWk.exe
  C:\Windows\System\erJHJWk.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\FwbrbHO.exe
  C:\Windows\System\FwbrbHO.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\sLPUjwM.exe
  C:\Windows\System\sLPUjwM.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\DAMYuEu.exe
  C:\Windows\System\DAMYuEu.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\CLEVqRf.exe
  C:\Windows\System\CLEVqRf.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\tNGbrzH.exe
  C:\Windows\System\tNGbrzH.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\WwKGvyW.exe
  C:\Windows\System\WwKGvyW.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\oxZkfti.exe
  C:\Windows\System\oxZkfti.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\cPtunYr.exe
  C:\Windows\System\cPtunYr.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\DYTDYKj.exe
  C:\Windows\System\DYTDYKj.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\ICjHKJC.exe
  C:\Windows\System\ICjHKJC.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\dXqApZV.exe
  C:\Windows\System\dXqApZV.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\OtGQBuQ.exe
  C:\Windows\System\OtGQBuQ.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\BLgcRtm.exe
  C:\Windows\System\BLgcRtm.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\vboZPfZ.exe
  C:\Windows\System\vboZPfZ.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\fdCtCga.exe
  C:\Windows\System\fdCtCga.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\bHTnChu.exe
  C:\Windows\System\bHTnChu.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\NsSdPzz.exe
  C:\Windows\System\NsSdPzz.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\tuDTrwe.exe
  C:\Windows\System\tuDTrwe.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\uqDNMQN.exe
  C:\Windows\System\uqDNMQN.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\KlQzYXY.exe
  C:\Windows\System\KlQzYXY.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\cUPOesJ.exe
  C:\Windows\System\cUPOesJ.exe
  2⤵
  - Executes dropped EXE
  PID:100
- C:\Windows\System\ukslZhM.exe
  C:\Windows\System\ukslZhM.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\jGKQzVF.exe
  C:\Windows\System\jGKQzVF.exe
  2⤵
  PID:2784
- C:\Windows\System\cPjFHQg.exe
  C:\Windows\System\cPjFHQg.exe
  2⤵
  PID:656
- C:\Windows\System\yKBRCgZ.exe
  C:\Windows\System\yKBRCgZ.exe
  2⤵
  PID:216
- C:\Windows\System\ZvcgIEq.exe
  C:\Windows\System\ZvcgIEq.exe
  2⤵
  PID:3172
- C:\Windows\System\ZeASXkQ.exe
  C:\Windows\System\ZeASXkQ.exe
  2⤵
  PID:1120
- C:\Windows\System\WfSpkiN.exe
  C:\Windows\System\WfSpkiN.exe
  2⤵
  PID:1640
- C:\Windows\System\LUaKvqQ.exe
  C:\Windows\System\LUaKvqQ.exe
  2⤵
  PID:3336
- C:\Windows\System\mRZaoet.exe
  C:\Windows\System\mRZaoet.exe
  2⤵
  PID:3696
- C:\Windows\System\QegcCdX.exe
  C:\Windows\System\QegcCdX.exe
  2⤵
  PID:4432
- C:\Windows\System\HVCqyUq.exe
  C:\Windows\System\HVCqyUq.exe
  2⤵
  PID:4488
- C:\Windows\System\kOHVzKr.exe
  C:\Windows\System\kOHVzKr.exe
  2⤵
  PID:4912
- C:\Windows\System\WNfSarI.exe
  C:\Windows\System\WNfSarI.exe
  2⤵
  PID:2524
- C:\Windows\System\APjxRgj.exe
  C:\Windows\System\APjxRgj.exe
  2⤵
  PID:1392
- C:\Windows\System\qAIrUKC.exe
  C:\Windows\System\qAIrUKC.exe
  2⤵
  PID:1016
- C:\Windows\System\coEgkGW.exe
  C:\Windows\System\coEgkGW.exe
  2⤵
  PID:4316
- C:\Windows\System\IldiaUN.exe
  C:\Windows\System\IldiaUN.exe
  2⤵
  PID:2292
- C:\Windows\System\FHFOhEm.exe
  C:\Windows\System\FHFOhEm.exe
  2⤵
  PID:4892
- C:\Windows\System\CTOvGxk.exe
  C:\Windows\System\CTOvGxk.exe
  2⤵
  PID:3360
- C:\Windows\System\XANfTDq.exe
  C:\Windows\System\XANfTDq.exe
  2⤵
  PID:4572
- C:\Windows\System\WPXAFHM.exe
  C:\Windows\System\WPXAFHM.exe
  2⤵
  PID:4520
- C:\Windows\System\gyVWVOG.exe
  C:\Windows\System\gyVWVOG.exe
  2⤵
  PID:4448
- C:\Windows\System\yltitMs.exe
  C:\Windows\System\yltitMs.exe
  2⤵
  PID:2832
- C:\Windows\System\xxMOApR.exe
  C:\Windows\System\xxMOApR.exe
  2⤵
  PID:2416
- C:\Windows\System\HhHhIpQ.exe
  C:\Windows\System\HhHhIpQ.exe
  2⤵
  PID:3200
- C:\Windows\System\pLLHglQ.exe
  C:\Windows\System\pLLHglQ.exe
  2⤵
  PID:1216
- C:\Windows\System\tCNThRZ.exe
  C:\Windows\System\tCNThRZ.exe
  2⤵
  PID:4852
- C:\Windows\System\JLDThPk.exe
  C:\Windows\System\JLDThPk.exe
  2⤵
  PID:2296
- C:\Windows\System\GkIKSgD.exe
  C:\Windows\System\GkIKSgD.exe
  2⤵
  PID:1832
- C:\Windows\System\KxBvilU.exe
  C:\Windows\System\KxBvilU.exe
  2⤵
  PID:432
- C:\Windows\System\QwgJynD.exe
  C:\Windows\System\QwgJynD.exe
  2⤵
  PID:4716
- C:\Windows\System\ATINXXX.exe
  C:\Windows\System\ATINXXX.exe
  2⤵
  PID:1760
- C:\Windows\System\VMtqYBx.exe
  C:\Windows\System\VMtqYBx.exe
  2⤵
  PID:2112
- C:\Windows\System\rFbFRtZ.exe
  C:\Windows\System\rFbFRtZ.exe
  2⤵
  PID:3884
- C:\Windows\System\tdPjQXp.exe
  C:\Windows\System\tdPjQXp.exe
  2⤵
  PID:3672
- C:\Windows\System\ojKWyCp.exe
  C:\Windows\System\ojKWyCp.exe
  2⤵
  PID:4240
- C:\Windows\System\cAYDCCD.exe
  C:\Windows\System\cAYDCCD.exe
  2⤵
  PID:3564
- C:\Windows\System\AkWqwtI.exe
  C:\Windows\System\AkWqwtI.exe
  2⤵
  PID:4328
- C:\Windows\System\kQtjTKE.exe
  C:\Windows\System\kQtjTKE.exe
  2⤵
  PID:4592
- C:\Windows\System\zfYEYwZ.exe
  C:\Windows\System\zfYEYwZ.exe
  2⤵
  PID:2084
- C:\Windows\System\kOtuzcM.exe
  C:\Windows\System\kOtuzcM.exe
  2⤵
  PID:1648
- C:\Windows\System\ONftygK.exe
  C:\Windows\System\ONftygK.exe
  2⤵
  PID:3624
- C:\Windows\System\bFqocWb.exe
  C:\Windows\System\bFqocWb.exe
  2⤵
  PID:180
- C:\Windows\System\AZomuST.exe
  C:\Windows\System\AZomuST.exe
  2⤵
  PID:4120
- C:\Windows\System\COuaVwa.exe
  C:\Windows\System\COuaVwa.exe
  2⤵
  PID:1192
- C:\Windows\System\ODhPQsS.exe
  C:\Windows\System\ODhPQsS.exe
  2⤵
  PID:5128
- C:\Windows\System\zPlCeWZ.exe
  C:\Windows\System\zPlCeWZ.exe
  2⤵
  PID:5144
- C:\Windows\System\YOfUKMV.exe
  C:\Windows\System\YOfUKMV.exe
  2⤵
  PID:5172
- C:\Windows\System\ISgoThC.exe
  C:\Windows\System\ISgoThC.exe
  2⤵
  PID:5200
- C:\Windows\System\gETIjLa.exe
  C:\Windows\System\gETIjLa.exe
  2⤵
  PID:5220
- C:\Windows\System\HDGfhnJ.exe
  C:\Windows\System\HDGfhnJ.exe
  2⤵
  PID:5256
- C:\Windows\System\iELndRb.exe
  C:\Windows\System\iELndRb.exe
  2⤵
  PID:5284
- C:\Windows\System\xkNYghz.exe
  C:\Windows\System\xkNYghz.exe
  2⤵
  PID:5300
- C:\Windows\System\rwsHujJ.exe
  C:\Windows\System\rwsHujJ.exe
  2⤵
  PID:5332
- C:\Windows\System\IYFYBOr.exe
  C:\Windows\System\IYFYBOr.exe
  2⤵
  PID:5356
- C:\Windows\System\EaAqNQX.exe
  C:\Windows\System\EaAqNQX.exe
  2⤵
  PID:5384
- C:\Windows\System\ikIrsxv.exe
  C:\Windows\System\ikIrsxv.exe
  2⤵
  PID:5412
- C:\Windows\System\AcmZMnn.exe
  C:\Windows\System\AcmZMnn.exe
  2⤵
  PID:5440
- C:\Windows\System\AlhkMeQ.exe
  C:\Windows\System\AlhkMeQ.exe
  2⤵
  PID:5464
- C:\Windows\System\EVcTdvA.exe
  C:\Windows\System\EVcTdvA.exe
  2⤵
  PID:5504
- C:\Windows\System\YljHNgM.exe
  C:\Windows\System\YljHNgM.exe
  2⤵
  PID:5524
- C:\Windows\System\xRbbMHP.exe
  C:\Windows\System\xRbbMHP.exe
  2⤵
  PID:5552
- C:\Windows\System\xMnPoAf.exe
  C:\Windows\System\xMnPoAf.exe
  2⤵
  PID:5584
- C:\Windows\System\cglwpAq.exe
  C:\Windows\System\cglwpAq.exe
  2⤵
  PID:5620
- C:\Windows\System\ywzrVih.exe
  C:\Windows\System\ywzrVih.exe
  2⤵
  PID:5648
- C:\Windows\System\ixfwZPO.exe
  C:\Windows\System\ixfwZPO.exe
  2⤵
  PID:5668
- C:\Windows\System\YFpTBQa.exe
  C:\Windows\System\YFpTBQa.exe
  2⤵
  PID:5696
- C:\Windows\System\BuATRqy.exe
  C:\Windows\System\BuATRqy.exe
  2⤵
  PID:5728
- C:\Windows\System\nXvjdfy.exe
  C:\Windows\System\nXvjdfy.exe
  2⤵
  PID:5748
- C:\Windows\System\LDNLzmP.exe
  C:\Windows\System\LDNLzmP.exe
  2⤵
  PID:5780
- C:\Windows\System\fWMpsgx.exe
  C:\Windows\System\fWMpsgx.exe
  2⤵
  PID:5816
- C:\Windows\System\ZcmtNnz.exe
  C:\Windows\System\ZcmtNnz.exe
  2⤵
  PID:5844
- C:\Windows\System\WXmQZGK.exe
  C:\Windows\System\WXmQZGK.exe
  2⤵
  PID:5884
- C:\Windows\System\cDzpKCV.exe
  C:\Windows\System\cDzpKCV.exe
  2⤵
  PID:5920
- C:\Windows\System\qhaoIPR.exe
  C:\Windows\System\qhaoIPR.exe
  2⤵
  PID:5944
- C:\Windows\System\xpyUhgg.exe
  C:\Windows\System\xpyUhgg.exe
  2⤵
  PID:5984
- C:\Windows\System\phDrZuF.exe
  C:\Windows\System\phDrZuF.exe
  2⤵
  PID:6004
- C:\Windows\System\zSxvghN.exe
  C:\Windows\System\zSxvghN.exe
  2⤵
  PID:6036
- C:\Windows\System\sQjHfBP.exe
  C:\Windows\System\sQjHfBP.exe
  2⤵
  PID:6056
- C:\Windows\System\GksyoGA.exe
  C:\Windows\System\GksyoGA.exe
  2⤵
  PID:6084
- C:\Windows\System\EZtAdtI.exe
  C:\Windows\System\EZtAdtI.exe
  2⤵
  PID:6112
- C:\Windows\System\EwjwRFa.exe
  C:\Windows\System\EwjwRFa.exe
  2⤵
  PID:5104
- C:\Windows\System\JEvLOlY.exe
  C:\Windows\System\JEvLOlY.exe
  2⤵
  PID:5168
- C:\Windows\System\aYppBjH.exe
  C:\Windows\System\aYppBjH.exe
  2⤵
  PID:5272
- C:\Windows\System\GAZGLWm.exe
  C:\Windows\System\GAZGLWm.exe
  2⤵
  PID:5316
- C:\Windows\System\ElxZZfV.exe
  C:\Windows\System\ElxZZfV.exe
  2⤵
  PID:5372
- C:\Windows\System\fywAQYT.exe
  C:\Windows\System\fywAQYT.exe
  2⤵
  PID:5428
- C:\Windows\System\UhevStQ.exe
  C:\Windows\System\UhevStQ.exe
  2⤵
  PID:5476
- C:\Windows\System\WunSCUf.exe
  C:\Windows\System\WunSCUf.exe
  2⤵
  PID:5572
- C:\Windows\System\rfEPVmv.exe
  C:\Windows\System\rfEPVmv.exe
  2⤵
  PID:5632
- C:\Windows\System\waFIWgD.exe
  C:\Windows\System\waFIWgD.exe
  2⤵
  PID:5664
- C:\Windows\System\eVDqmCQ.exe
  C:\Windows\System\eVDqmCQ.exe
  2⤵
  PID:5764
- C:\Windows\System\nUiuWWZ.exe
  C:\Windows\System\nUiuWWZ.exe
  2⤵
  PID:5812
- C:\Windows\System\EcJeHOo.exe
  C:\Windows\System\EcJeHOo.exe
  2⤵
  PID:5908
- C:\Windows\System\LgNwYNw.exe
  C:\Windows\System\LgNwYNw.exe
  2⤵
  PID:5960
- C:\Windows\System\PupUBvQ.exe
  C:\Windows\System\PupUBvQ.exe
  2⤵
  PID:6020
- C:\Windows\System\wNndfZh.exe
  C:\Windows\System\wNndfZh.exe
  2⤵
  PID:6068
- C:\Windows\System\kKHmOzO.exe
  C:\Windows\System\kKHmOzO.exe
  2⤵
  PID:5156
- C:\Windows\System\lSmznoU.exe
  C:\Windows\System\lSmznoU.exe
  2⤵
  PID:5192
- C:\Windows\System\XaNWVdU.exe
  C:\Windows\System\XaNWVdU.exe
  2⤵
  PID:5460
- C:\Windows\System\NvaDHxg.exe
  C:\Windows\System\NvaDHxg.exe
  2⤵
  PID:5636
- C:\Windows\System\kqaUvpW.exe
  C:\Windows\System\kqaUvpW.exe
  2⤵
  PID:5684
- C:\Windows\System\YyzgPLR.exe
  C:\Windows\System\YyzgPLR.exe
  2⤵
  PID:5772
- C:\Windows\System\OgSRgjK.exe
  C:\Windows\System\OgSRgjK.exe
  2⤵
  PID:5940
- C:\Windows\System\wQDqZwz.exe
  C:\Windows\System\wQDqZwz.exe
  2⤵
  PID:5136
- C:\Windows\System\YzYyxmP.exe
  C:\Windows\System\YzYyxmP.exe
  2⤵
  PID:5592
- C:\Windows\System\oHEGKMd.exe
  C:\Windows\System\oHEGKMd.exe
  2⤵
  PID:2340
- C:\Windows\System\juqCoLA.exe
  C:\Windows\System\juqCoLA.exe
  2⤵
  PID:6000
- C:\Windows\System\OvLrfUO.exe
  C:\Windows\System\OvLrfUO.exe
  2⤵
  PID:5900
- C:\Windows\System\ebzbgRV.exe
  C:\Windows\System\ebzbgRV.exe
  2⤵
  PID:6148
- C:\Windows\System\qgySzCs.exe
  C:\Windows\System\qgySzCs.exe
  2⤵
  PID:6180
- C:\Windows\System\ZpDPZYc.exe
  C:\Windows\System\ZpDPZYc.exe
  2⤵
  PID:6204
- C:\Windows\System\jgqWxxd.exe
  C:\Windows\System\jgqWxxd.exe
  2⤵
  PID:6224
- C:\Windows\System\qzJCYcj.exe
  C:\Windows\System\qzJCYcj.exe
  2⤵
  PID:6260
- C:\Windows\System\OIRKRYj.exe
  C:\Windows\System\OIRKRYj.exe
  2⤵
  PID:6288
- C:\Windows\System\mgEnoKx.exe
  C:\Windows\System\mgEnoKx.exe
  2⤵
  PID:6316
- C:\Windows\System\EHyPqEl.exe
  C:\Windows\System\EHyPqEl.exe
  2⤵
  PID:6344
- C:\Windows\System\REKtqCM.exe
  C:\Windows\System\REKtqCM.exe
  2⤵
  PID:6372
- C:\Windows\System\sQAXYuX.exe
  C:\Windows\System\sQAXYuX.exe
  2⤵
  PID:6396
- C:\Windows\System\FuAiNGZ.exe
  C:\Windows\System\FuAiNGZ.exe
  2⤵
  PID:6428
- C:\Windows\System\pFtyIBs.exe
  C:\Windows\System\pFtyIBs.exe
  2⤵
  PID:6460
- C:\Windows\System\kBgAftY.exe
  C:\Windows\System\kBgAftY.exe
  2⤵
  PID:6496
- C:\Windows\System\SzHFoYd.exe
  C:\Windows\System\SzHFoYd.exe
  2⤵
  PID:6512
- C:\Windows\System\XdKatdj.exe
  C:\Windows\System\XdKatdj.exe
  2⤵
  PID:6544
- C:\Windows\System\etCvHsM.exe
  C:\Windows\System\etCvHsM.exe
  2⤵
  PID:6572
- C:\Windows\System\UHAhtVU.exe
  C:\Windows\System\UHAhtVU.exe
  2⤵
  PID:6608
- C:\Windows\System\ZwBZNAW.exe
  C:\Windows\System\ZwBZNAW.exe
  2⤵
  PID:6636
- C:\Windows\System\OtOFvvR.exe
  C:\Windows\System\OtOFvvR.exe
  2⤵
  PID:6660
- C:\Windows\System\vcweUld.exe
  C:\Windows\System\vcweUld.exe
  2⤵
  PID:6684
- C:\Windows\System\qVDeWJZ.exe
  C:\Windows\System\qVDeWJZ.exe
  2⤵
  PID:6708
- C:\Windows\System\waxFlCX.exe
  C:\Windows\System\waxFlCX.exe
  2⤵
  PID:6724
- C:\Windows\System\fckiOCq.exe
  C:\Windows\System\fckiOCq.exe
  2⤵
  PID:6756
- C:\Windows\System\rdUHPFk.exe
  C:\Windows\System\rdUHPFk.exe
  2⤵
  PID:6784
- C:\Windows\System\dvABKyV.exe
  C:\Windows\System\dvABKyV.exe
  2⤵
  PID:6820
- C:\Windows\System\lHtYYgC.exe
  C:\Windows\System\lHtYYgC.exe
  2⤵
  PID:6848
- C:\Windows\System\qFptTHT.exe
  C:\Windows\System\qFptTHT.exe
  2⤵
  PID:6876
- C:\Windows\System\CFsXYDX.exe
  C:\Windows\System\CFsXYDX.exe
  2⤵
  PID:6904
- C:\Windows\System\btVVXWR.exe
  C:\Windows\System\btVVXWR.exe
  2⤵
  PID:6944
- C:\Windows\System\ForjBwD.exe
  C:\Windows\System\ForjBwD.exe
  2⤵
  PID:6960
- C:\Windows\System\SQDouIg.exe
  C:\Windows\System\SQDouIg.exe
  2⤵
  PID:6988
- C:\Windows\System\SWqHRzQ.exe
  C:\Windows\System\SWqHRzQ.exe
  2⤵
  PID:7028
- C:\Windows\System\TNIFNUa.exe
  C:\Windows\System\TNIFNUa.exe
  2⤵
  PID:7056
- C:\Windows\System\EupuBek.exe
  C:\Windows\System\EupuBek.exe
  2⤵
  PID:7072
- C:\Windows\System\CVnOrfQ.exe
  C:\Windows\System\CVnOrfQ.exe
  2⤵
  PID:7100
- C:\Windows\System\BpGOKET.exe
  C:\Windows\System\BpGOKET.exe
  2⤵
  PID:7128
- C:\Windows\System\WKAkGCw.exe
  C:\Windows\System\WKAkGCw.exe
  2⤵
  PID:5724
- C:\Windows\System\goqQjvI.exe
  C:\Windows\System\goqQjvI.exe
  2⤵
  PID:6200
- C:\Windows\System\OwuIShz.exe
  C:\Windows\System\OwuIShz.exe
  2⤵
  PID:6276
- C:\Windows\System\EalmRhY.exe
  C:\Windows\System\EalmRhY.exe
  2⤵
  PID:6336
- C:\Windows\System\YzOEctk.exe
  C:\Windows\System\YzOEctk.exe
  2⤵
  PID:6388
- C:\Windows\System\ryNAHTA.exe
  C:\Windows\System\ryNAHTA.exe
  2⤵
  PID:6420
- C:\Windows\System\CaLzAtZ.exe
  C:\Windows\System\CaLzAtZ.exe
  2⤵
  PID:6504
- C:\Windows\System\dDZrykp.exe
  C:\Windows\System\dDZrykp.exe
  2⤵
  PID:6564
- C:\Windows\System\fIcmmaz.exe
  C:\Windows\System\fIcmmaz.exe
  2⤵
  PID:6624
- C:\Windows\System\ANvSZJo.exe
  C:\Windows\System\ANvSZJo.exe
  2⤵
  PID:6720
- C:\Windows\System\fARNSDQ.exe
  C:\Windows\System\fARNSDQ.exe
  2⤵
  PID:6740
- C:\Windows\System\CcvBycb.exe
  C:\Windows\System\CcvBycb.exe
  2⤵
  PID:6836
- C:\Windows\System\rGTTaIa.exe
  C:\Windows\System\rGTTaIa.exe
  2⤵
  PID:6888
- C:\Windows\System\dxdyDjm.exe
  C:\Windows\System\dxdyDjm.exe
  2⤵
  PID:6972
- C:\Windows\System\YSJqTqv.exe
  C:\Windows\System\YSJqTqv.exe
  2⤵
  PID:7040
- C:\Windows\System\DnjkcOw.exe
  C:\Windows\System\DnjkcOw.exe
  2⤵
  PID:7092
- C:\Windows\System\MxDyYll.exe
  C:\Windows\System\MxDyYll.exe
  2⤵
  PID:7152
- C:\Windows\System\hLeUEbD.exe
  C:\Windows\System\hLeUEbD.exe
  2⤵
  PID:6360
- C:\Windows\System\ZlqvDyC.exe
  C:\Windows\System\ZlqvDyC.exe
  2⤵
  PID:6384
- C:\Windows\System\wIXRgDG.exe
  C:\Windows\System\wIXRgDG.exe
  2⤵
  PID:6536
- C:\Windows\System\gVgLUQD.exe
  C:\Windows\System\gVgLUQD.exe
  2⤵
  PID:6672
- C:\Windows\System\qtfAsQm.exe
  C:\Windows\System\qtfAsQm.exe
  2⤵
  PID:6860
- C:\Windows\System\rXHNQQt.exe
  C:\Windows\System\rXHNQQt.exe
  2⤵
  PID:6928
- C:\Windows\System\YOpUNGd.exe
  C:\Windows\System\YOpUNGd.exe
  2⤵
  PID:7008
- C:\Windows\System\LdotcUe.exe
  C:\Windows\System\LdotcUe.exe
  2⤵
  PID:7112
- C:\Windows\System\GgUBNvH.exe
  C:\Windows\System\GgUBNvH.exe
  2⤵
  PID:6408
- C:\Windows\System\evOCoGE.exe
  C:\Windows\System\evOCoGE.exe
  2⤵
  PID:6832
- C:\Windows\System\Ztcetgf.exe
  C:\Windows\System\Ztcetgf.exe
  2⤵
  PID:6268
- C:\Windows\System\OOqIzFv.exe
  C:\Windows\System\OOqIzFv.exe
  2⤵
  PID:7196
- C:\Windows\System\bmycHCg.exe
  C:\Windows\System\bmycHCg.exe
  2⤵
  PID:7212
- C:\Windows\System\RtOFxhE.exe
  C:\Windows\System\RtOFxhE.exe
  2⤵
  PID:7252
- C:\Windows\System\yZKMYXL.exe
  C:\Windows\System\yZKMYXL.exe
  2⤵
  PID:7296
- C:\Windows\System\rNtUAph.exe
  C:\Windows\System\rNtUAph.exe
  2⤵
  PID:7320
- C:\Windows\System\pMshoOn.exe
  C:\Windows\System\pMshoOn.exe
  2⤵
  PID:7336
- C:\Windows\System\aclgKkf.exe
  C:\Windows\System\aclgKkf.exe
  2⤵
  PID:7364
- C:\Windows\System\KUWMkmI.exe
  C:\Windows\System\KUWMkmI.exe
  2⤵
  PID:7396
- C:\Windows\System\rhSNgvu.exe
  C:\Windows\System\rhSNgvu.exe
  2⤵
  PID:7420
- C:\Windows\System\niZUPRh.exe
  C:\Windows\System\niZUPRh.exe
  2⤵
  PID:7452
- C:\Windows\System\ocyhVwc.exe
  C:\Windows\System\ocyhVwc.exe
  2⤵
  PID:7488
- C:\Windows\System\cqPxJSI.exe
  C:\Windows\System\cqPxJSI.exe
  2⤵
  PID:7520
- C:\Windows\System\dvaKmvb.exe
  C:\Windows\System\dvaKmvb.exe
  2⤵
  PID:7544
- C:\Windows\System\nozjyMS.exe
  C:\Windows\System\nozjyMS.exe
  2⤵
  PID:7572
- C:\Windows\System\rdalUkm.exe
  C:\Windows\System\rdalUkm.exe
  2⤵
  PID:7608
- C:\Windows\System\uWdgFzZ.exe
  C:\Windows\System\uWdgFzZ.exe
  2⤵
  PID:7632
- C:\Windows\System\CtHoNbQ.exe
  C:\Windows\System\CtHoNbQ.exe
  2⤵
  PID:7668
- C:\Windows\System\jaDOVrv.exe
  C:\Windows\System\jaDOVrv.exe
  2⤵
  PID:7684
- C:\Windows\System\iMlsyKo.exe
  C:\Windows\System\iMlsyKo.exe
  2⤵
  PID:7712
- C:\Windows\System\cXmmwBs.exe
  C:\Windows\System\cXmmwBs.exe
  2⤵
  PID:7736
- C:\Windows\System\xXeDQnk.exe
  C:\Windows\System\xXeDQnk.exe
  2⤵
  PID:7768
- C:\Windows\System\VjSgPSQ.exe
  C:\Windows\System\VjSgPSQ.exe
  2⤵
  PID:7792
- C:\Windows\System\GLpNJoO.exe
  C:\Windows\System\GLpNJoO.exe
  2⤵
  PID:7824
- C:\Windows\System\ddVnASi.exe
  C:\Windows\System\ddVnASi.exe
  2⤵
  PID:7864
- C:\Windows\System\DDowePi.exe
  C:\Windows\System\DDowePi.exe
  2⤵
  PID:7880
- C:\Windows\System\ytJlJpR.exe
  C:\Windows\System\ytJlJpR.exe
  2⤵
  PID:7912
- C:\Windows\System\UpfRqbU.exe
  C:\Windows\System\UpfRqbU.exe
  2⤵
  PID:7940
- C:\Windows\System\yqjTtxe.exe
  C:\Windows\System\yqjTtxe.exe
  2⤵
  PID:7968
- C:\Windows\System\AsvTYyy.exe
  C:\Windows\System\AsvTYyy.exe
  2⤵
  PID:7992
- C:\Windows\System\xfpOnyU.exe
  C:\Windows\System\xfpOnyU.exe
  2⤵
  PID:8024
- C:\Windows\System\sOVwFac.exe
  C:\Windows\System\sOVwFac.exe
  2⤵
  PID:8060
- C:\Windows\System\qJxZJZX.exe
  C:\Windows\System\qJxZJZX.exe
  2⤵
  PID:8080
- C:\Windows\System\XEvwRQK.exe
  C:\Windows\System\XEvwRQK.exe
  2⤵
  PID:8108
- C:\Windows\System\ehzAckP.exe
  C:\Windows\System\ehzAckP.exe
  2⤵
  PID:8144
- C:\Windows\System\dxqVfWt.exe
  C:\Windows\System\dxqVfWt.exe
  2⤵
  PID:8160
- C:\Windows\System\mYtFVBB.exe
  C:\Windows\System\mYtFVBB.exe
  2⤵
  PID:8184
- C:\Windows\System\hKsGbfH.exe
  C:\Windows\System\hKsGbfH.exe
  2⤵
  PID:7180
- C:\Windows\System\jYiJPuu.exe
  C:\Windows\System\jYiJPuu.exe
  2⤵
  PID:7240
- C:\Windows\System\CXNLUci.exe
  C:\Windows\System\CXNLUci.exe
  2⤵
  PID:7280
- C:\Windows\System\ZSkNHYk.exe
  C:\Windows\System\ZSkNHYk.exe
  2⤵
  PID:7388
- C:\Windows\System\YJpApFZ.exe
  C:\Windows\System\YJpApFZ.exe
  2⤵
  PID:7432
- C:\Windows\System\szOXDPa.exe
  C:\Windows\System\szOXDPa.exe
  2⤵
  PID:7532
- C:\Windows\System\aljteZL.exe
  C:\Windows\System\aljteZL.exe
  2⤵
  PID:7560
- C:\Windows\System\onkIBCL.exe
  C:\Windows\System\onkIBCL.exe
  2⤵
  PID:7620
- C:\Windows\System\SnDvnyg.exe
  C:\Windows\System\SnDvnyg.exe
  2⤵
  PID:7700
- C:\Windows\System\fcxMKUX.exe
  C:\Windows\System\fcxMKUX.exe
  2⤵
  PID:7724
- C:\Windows\System\huLErtq.exe
  C:\Windows\System\huLErtq.exe
  2⤵
  PID:7784
- C:\Windows\System\HDneGRn.exe
  C:\Windows\System\HDneGRn.exe
  2⤵
  PID:7892
- C:\Windows\System\GQfEvDk.exe
  C:\Windows\System\GQfEvDk.exe
  2⤵
  PID:7976
- C:\Windows\System\MYwSpoZ.exe
  C:\Windows\System\MYwSpoZ.exe
  2⤵
  PID:8056
- C:\Windows\System\rYRjGhn.exe
  C:\Windows\System\rYRjGhn.exe
  2⤵
  PID:8128
- C:\Windows\System\OAPgsxT.exe
  C:\Windows\System\OAPgsxT.exe
  2⤵
  PID:7088
- C:\Windows\System\eqKgirR.exe
  C:\Windows\System\eqKgirR.exe
  2⤵
  PID:7204
- C:\Windows\System\CgzSjwB.exe
  C:\Windows\System\CgzSjwB.exe
  2⤵
  PID:7272
- C:\Windows\System\cnrwrFj.exe
  C:\Windows\System\cnrwrFj.exe
  2⤵
  PID:7504
- C:\Windows\System\pfDqyoF.exe
  C:\Windows\System\pfDqyoF.exe
  2⤵
  PID:7696
- C:\Windows\System\UnmSEQY.exe
  C:\Windows\System\UnmSEQY.exe
  2⤵
  PID:7896
- C:\Windows\System\OXnKkcO.exe
  C:\Windows\System\OXnKkcO.exe
  2⤵
  PID:8008
- C:\Windows\System\TnnAEaR.exe
  C:\Windows\System\TnnAEaR.exe
  2⤵
  PID:8044
- C:\Windows\System\cbJtDlG.exe
  C:\Windows\System\cbJtDlG.exe
  2⤵
  PID:6556
- C:\Windows\System\ZGifzid.exe
  C:\Windows\System\ZGifzid.exe
  2⤵
  PID:7460
- C:\Windows\System\fBJQTgU.exe
  C:\Windows\System\fBJQTgU.exe
  2⤵
  PID:7964
- C:\Windows\System\Cribavf.exe
  C:\Windows\System\Cribavf.exe
  2⤵
  PID:8116
- C:\Windows\System\RpYQnXh.exe
  C:\Windows\System\RpYQnXh.exe
  2⤵
  PID:6764
- C:\Windows\System\qlHdrqh.exe
  C:\Windows\System\qlHdrqh.exe
  2⤵
  PID:8208
- C:\Windows\System\ynQFgxm.exe
  C:\Windows\System\ynQFgxm.exe
  2⤵
  PID:8236
- C:\Windows\System\KgQNAYt.exe
  C:\Windows\System\KgQNAYt.exe
  2⤵
  PID:8264
- C:\Windows\System\VanPHGc.exe
  C:\Windows\System\VanPHGc.exe
  2⤵
  PID:8292
- C:\Windows\System\lYJEBlc.exe
  C:\Windows\System\lYJEBlc.exe
  2⤵
  PID:8320
- C:\Windows\System\FXpZAOH.exe
  C:\Windows\System\FXpZAOH.exe
  2⤵
  PID:8360
- C:\Windows\System\ZLACJsg.exe
  C:\Windows\System\ZLACJsg.exe
  2⤵
  PID:8388
- C:\Windows\System\pLxhOhU.exe
  C:\Windows\System\pLxhOhU.exe
  2⤵
  PID:8408
- C:\Windows\System\FtrxkVn.exe
  C:\Windows\System\FtrxkVn.exe
  2⤵
  PID:8440
- C:\Windows\System\nCBcHMj.exe
  C:\Windows\System\nCBcHMj.exe
  2⤵
  PID:8484
- C:\Windows\System\hYoSSZo.exe
  C:\Windows\System\hYoSSZo.exe
  2⤵
  PID:8512
- C:\Windows\System\ruKVNZn.exe
  C:\Windows\System\ruKVNZn.exe
  2⤵
  PID:8532
- C:\Windows\System\ZzSjBtW.exe
  C:\Windows\System\ZzSjBtW.exe
  2⤵
  PID:8564
- C:\Windows\System\NtAVelN.exe
  C:\Windows\System\NtAVelN.exe
  2⤵
  PID:8584
- C:\Windows\System\utTJAtw.exe
  C:\Windows\System\utTJAtw.exe
  2⤵
  PID:8612
- C:\Windows\System\AOXZzOQ.exe
  C:\Windows\System\AOXZzOQ.exe
  2⤵
  PID:8628
- C:\Windows\System\hHXYXYf.exe
  C:\Windows\System\hHXYXYf.exe
  2⤵
  PID:8680
- C:\Windows\System\EiDGCbM.exe
  C:\Windows\System\EiDGCbM.exe
  2⤵
  PID:8708
- C:\Windows\System\AYYaItV.exe
  C:\Windows\System\AYYaItV.exe
  2⤵
  PID:8736
- C:\Windows\System\NuFOfzu.exe
  C:\Windows\System\NuFOfzu.exe
  2⤵
  PID:8764
- C:\Windows\System\OmlGhkR.exe
  C:\Windows\System\OmlGhkR.exe
  2⤵
  PID:8792
- C:\Windows\System\pbfEfPz.exe
  C:\Windows\System\pbfEfPz.exe
  2⤵
  PID:8820
- C:\Windows\System\NxMVODw.exe
  C:\Windows\System\NxMVODw.exe
  2⤵
  PID:8848
- C:\Windows\System\lyRJRkO.exe
  C:\Windows\System\lyRJRkO.exe
  2⤵
  PID:8876
- C:\Windows\System\WvdXJaG.exe
  C:\Windows\System\WvdXJaG.exe
  2⤵
  PID:8904
- C:\Windows\System\OFcUdBs.exe
  C:\Windows\System\OFcUdBs.exe
  2⤵
  PID:8920
- C:\Windows\System\wOtvYeX.exe
  C:\Windows\System\wOtvYeX.exe
  2⤵
  PID:8944
- C:\Windows\System\mfsDsRx.exe
  C:\Windows\System\mfsDsRx.exe
  2⤵
  PID:8980
- C:\Windows\System\bePBtNE.exe
  C:\Windows\System\bePBtNE.exe
  2⤵
  PID:9000
- C:\Windows\System\kGIRUup.exe
  C:\Windows\System\kGIRUup.exe
  2⤵
  PID:9032
- C:\Windows\System\BMcWOFr.exe
  C:\Windows\System\BMcWOFr.exe
  2⤵
  PID:9064
- C:\Windows\System\HyCmqmD.exe
  C:\Windows\System\HyCmqmD.exe
  2⤵
  PID:9088
- C:\Windows\System\LTwQCSN.exe
  C:\Windows\System\LTwQCSN.exe
  2⤵
  PID:9128
- C:\Windows\System\SqHATZT.exe
  C:\Windows\System\SqHATZT.exe
  2⤵
  PID:9144
- C:\Windows\System\NOPfOGi.exe
  C:\Windows\System\NOPfOGi.exe
  2⤵
  PID:9160
- C:\Windows\System\jPsQKzi.exe
  C:\Windows\System\jPsQKzi.exe
  2⤵
  PID:9192
- C:\Windows\System\TUjMrPW.exe
  C:\Windows\System\TUjMrPW.exe
  2⤵
  PID:8200
- C:\Windows\System\mvIDIrD.exe
  C:\Windows\System\mvIDIrD.exe
  2⤵
  PID:8244
- C:\Windows\System\teYbtZQ.exe
  C:\Windows\System\teYbtZQ.exe
  2⤵
  PID:8332
- C:\Windows\System\LQrjyqt.exe
  C:\Windows\System\LQrjyqt.exe
  2⤵
  PID:8336
- C:\Windows\System\pbAcQCy.exe
  C:\Windows\System\pbAcQCy.exe
  2⤵
  PID:8424
- C:\Windows\System\QJSAGqR.exe
  C:\Windows\System\QJSAGqR.exe
  2⤵
  PID:8520
- C:\Windows\System\oNOFUMl.exe
  C:\Windows\System\oNOFUMl.exe
  2⤵
  PID:8600
- C:\Windows\System\zrvbNiD.exe
  C:\Windows\System\zrvbNiD.exe
  2⤵
  PID:8672
- C:\Windows\System\SwpTEhy.exe
  C:\Windows\System\SwpTEhy.exe
  2⤵
  PID:8720
- C:\Windows\System\nTFvlUq.exe
  C:\Windows\System\nTFvlUq.exe
  2⤵
  PID:8788
- C:\Windows\System\ngadLYb.exe
  C:\Windows\System\ngadLYb.exe
  2⤵
  PID:8864
- C:\Windows\System\Obzuyec.exe
  C:\Windows\System\Obzuyec.exe
  2⤵
  PID:8900
- C:\Windows\System\ZJnyStR.exe
  C:\Windows\System\ZJnyStR.exe
  2⤵
  PID:9016
- C:\Windows\System\WkWFICh.exe
  C:\Windows\System\WkWFICh.exe
  2⤵
  PID:9048
- C:\Windows\System\sTrWMTE.exe
  C:\Windows\System\sTrWMTE.exe
  2⤵
  PID:9124
- C:\Windows\System\JYFFtal.exe
  C:\Windows\System\JYFFtal.exe
  2⤵
  PID:9152
- C:\Windows\System\KQIdzYq.exe
  C:\Windows\System\KQIdzYq.exe
  2⤵
  PID:9184
- C:\Windows\System\aVukceS.exe
  C:\Windows\System\aVukceS.exe
  2⤵
  PID:8396
- C:\Windows\System\bRSPhVf.exe
  C:\Windows\System\bRSPhVf.exe
  2⤵
  PID:8572
- C:\Windows\System\IXbVDJp.exe
  C:\Windows\System\IXbVDJp.exe
  2⤵
  PID:8692
- C:\Windows\System\YIKpZBL.exe
  C:\Windows\System\YIKpZBL.exe
  2⤵
  PID:8832
- C:\Windows\System\weurpje.exe
  C:\Windows\System\weurpje.exe
  2⤵
  PID:8988
- C:\Windows\System\oxKhxra.exe
  C:\Windows\System\oxKhxra.exe
  2⤵
  PID:9140
- C:\Windows\System\cUSAPqf.exe
  C:\Windows\System\cUSAPqf.exe
  2⤵
  PID:8356
- C:\Windows\System\eYkMyjy.exe
  C:\Windows\System\eYkMyjy.exe
  2⤵
  PID:8624
- C:\Windows\System\xencmPj.exe
  C:\Windows\System\xencmPj.exe
  2⤵
  PID:8892
- C:\Windows\System\OecgCRG.exe
  C:\Windows\System\OecgCRG.exe
  2⤵
  PID:8304
- C:\Windows\System\obfsNyQ.exe
  C:\Windows\System\obfsNyQ.exe
  2⤵
  PID:9224
- C:\Windows\System\KbITmQW.exe
  C:\Windows\System\KbITmQW.exe
  2⤵
  PID:9252
- C:\Windows\System\vcypBII.exe
  C:\Windows\System\vcypBII.exe
  2⤵
  PID:9292
- C:\Windows\System\WnBIcYw.exe
  C:\Windows\System\WnBIcYw.exe
  2⤵
  PID:9320
- C:\Windows\System\cClbnfh.exe
  C:\Windows\System\cClbnfh.exe
  2⤵
  PID:9348
- C:\Windows\System\SonKWRV.exe
  C:\Windows\System\SonKWRV.exe
  2⤵
  PID:9380
- C:\Windows\System\oLrFXsC.exe
  C:\Windows\System\oLrFXsC.exe
  2⤵
  PID:9396
- C:\Windows\System\dqwMPek.exe
  C:\Windows\System\dqwMPek.exe
  2⤵
  PID:9412
- C:\Windows\System\TkzARnK.exe
  C:\Windows\System\TkzARnK.exe
  2⤵
  PID:9460
- C:\Windows\System\PUpCGiT.exe
  C:\Windows\System\PUpCGiT.exe
  2⤵
  PID:9484
- C:\Windows\System\STNvyfy.exe
  C:\Windows\System\STNvyfy.exe
  2⤵
  PID:9500
- C:\Windows\System\QhlKeyG.exe
  C:\Windows\System\QhlKeyG.exe
  2⤵
  PID:9536
- C:\Windows\System\OurSKdR.exe
  C:\Windows\System\OurSKdR.exe
  2⤵
  PID:9580
- C:\Windows\System\CxqyYOf.exe
  C:\Windows\System\CxqyYOf.exe
  2⤵
  PID:9608
- C:\Windows\System\qZmssUg.exe
  C:\Windows\System\qZmssUg.exe
  2⤵
  PID:9636
- C:\Windows\System\uVdSzrl.exe
  C:\Windows\System\uVdSzrl.exe
  2⤵
  PID:9664
- C:\Windows\System\RLDgFRP.exe
  C:\Windows\System\RLDgFRP.exe
  2⤵
  PID:9692
- C:\Windows\System\cQDETGd.exe
  C:\Windows\System\cQDETGd.exe
  2⤵
  PID:9708
- C:\Windows\System\nfnEXFP.exe
  C:\Windows\System\nfnEXFP.exe
  2⤵
  PID:9748
- C:\Windows\System\IbCXzvS.exe
  C:\Windows\System\IbCXzvS.exe
  2⤵
  PID:9764
- C:\Windows\System\esFDfub.exe
  C:\Windows\System\esFDfub.exe
  2⤵
  PID:9792
- C:\Windows\System\xzOtvhS.exe
  C:\Windows\System\xzOtvhS.exe
  2⤵
  PID:9812
- C:\Windows\System\ZceZhmG.exe
  C:\Windows\System\ZceZhmG.exe
  2⤵
  PID:9836
- C:\Windows\System\AfPBhwa.exe
  C:\Windows\System\AfPBhwa.exe
  2⤵
  PID:9860
- C:\Windows\System\PlUerZe.exe
  C:\Windows\System\PlUerZe.exe
  2⤵
  PID:9916
- C:\Windows\System\IrXTJGp.exe
  C:\Windows\System\IrXTJGp.exe
  2⤵
  PID:9932
- C:\Windows\System\bjjPKEZ.exe
  C:\Windows\System\bjjPKEZ.exe
  2⤵
  PID:9948
- C:\Windows\System\PoFvbdK.exe
  C:\Windows\System\PoFvbdK.exe
  2⤵
  PID:9988
- C:\Windows\System\eIJwFjT.exe
  C:\Windows\System\eIJwFjT.exe
  2⤵
  PID:10016
- C:\Windows\System\UpHcuAr.exe
  C:\Windows\System\UpHcuAr.exe
  2⤵
  PID:10056
- C:\Windows\System\UEgSKvM.exe
  C:\Windows\System\UEgSKvM.exe
  2⤵
  PID:10084
- C:\Windows\System\zZdXdKx.exe
  C:\Windows\System\zZdXdKx.exe
  2⤵
  PID:10112
- C:\Windows\System\nUvuuad.exe
  C:\Windows\System\nUvuuad.exe
  2⤵
  PID:10128
- C:\Windows\System\rpqkCtr.exe
  C:\Windows\System\rpqkCtr.exe
  2⤵
  PID:10168
- C:\Windows\System\UJLLqmk.exe
  C:\Windows\System\UJLLqmk.exe
  2⤵
  PID:10184
- C:\Windows\System\IEsbCNt.exe
  C:\Windows\System\IEsbCNt.exe
  2⤵
  PID:10212
- C:\Windows\System\AthgNPW.exe
  C:\Windows\System\AthgNPW.exe
  2⤵
  PID:9236
- C:\Windows\System\yYVHsXj.exe
  C:\Windows\System\yYVHsXj.exe
  2⤵
  PID:9284
- C:\Windows\System\CqKiIpY.exe
  C:\Windows\System\CqKiIpY.exe
  2⤵
  PID:8288
- C:\Windows\System\dFlQgvu.exe
  C:\Windows\System\dFlQgvu.exe
  2⤵
  PID:9360
- C:\Windows\System\QjJPsIL.exe
  C:\Windows\System\QjJPsIL.exe
  2⤵
  PID:9424
- C:\Windows\System\ZcBOBhS.exe
  C:\Windows\System\ZcBOBhS.exe
  2⤵
  PID:9492
- C:\Windows\System\KdKIGEB.exe
  C:\Windows\System\KdKIGEB.exe
  2⤵
  PID:9600
- C:\Windows\System\MrAprbl.exe
  C:\Windows\System\MrAprbl.exe
  2⤵
  PID:9652
- C:\Windows\System\raEmgfr.exe
  C:\Windows\System\raEmgfr.exe
  2⤵
  PID:9724
- C:\Windows\System\lquBFoh.exe
  C:\Windows\System\lquBFoh.exe
  2⤵
  PID:9732
- C:\Windows\System\fpVqSWp.exe
  C:\Windows\System\fpVqSWp.exe
  2⤵
  PID:9800
- C:\Windows\System\wpjKpqc.exe
  C:\Windows\System\wpjKpqc.exe
  2⤵
  PID:9928
- C:\Windows\System\zVxcbfV.exe
  C:\Windows\System\zVxcbfV.exe
  2⤵
  PID:10000
- C:\Windows\System\oOcwrzR.exe
  C:\Windows\System\oOcwrzR.exe
  2⤵
  PID:10044
- C:\Windows\System\iCvjHeO.exe
  C:\Windows\System\iCvjHeO.exe
  2⤵
  PID:10096
- C:\Windows\System\fYRgrBD.exe
  C:\Windows\System\fYRgrBD.exe
  2⤵
  PID:10180
- C:\Windows\System\wFzetEK.exe
  C:\Windows\System\wFzetEK.exe
  2⤵
  PID:8352
- C:\Windows\System\wsVNNJt.exe
  C:\Windows\System\wsVNNJt.exe
  2⤵
  PID:9344
- C:\Windows\System\LsJPjtD.exe
  C:\Windows\System\LsJPjtD.exe
  2⤵
  PID:9556
- C:\Windows\System\aWWtKPK.exe
  C:\Windows\System\aWWtKPK.exe
  2⤵
  PID:9576
- C:\Windows\System\FQxbpOe.exe
  C:\Windows\System\FQxbpOe.exe
  2⤵
  PID:9856
- C:\Windows\System\RWixJlm.exe
  C:\Windows\System\RWixJlm.exe
  2⤵
  PID:9996
- C:\Windows\System\xSMrdbL.exe
  C:\Windows\System\xSMrdbL.exe
  2⤵
  PID:10100
- C:\Windows\System\EUIRJgI.exe
  C:\Windows\System\EUIRJgI.exe
  2⤵
  PID:10228
- C:\Windows\System\tscbdpG.exe
  C:\Windows\System\tscbdpG.exe
  2⤵
  PID:9524
- C:\Windows\System\wIejVkr.exe
  C:\Windows\System\wIejVkr.exe
  2⤵
  PID:9960
- C:\Windows\System\yeiNofa.exe
  C:\Windows\System\yeiNofa.exe
  2⤵
  PID:9532
- C:\Windows\System\pBTagMb.exe
  C:\Windows\System\pBTagMb.exe
  2⤵
  PID:10252
- C:\Windows\System\Rytbowo.exe
  C:\Windows\System\Rytbowo.exe
  2⤵
  PID:10288
- C:\Windows\System\WdDeqVd.exe
  C:\Windows\System\WdDeqVd.exe
  2⤵
  PID:10312
- C:\Windows\System\yEgnqLY.exe
  C:\Windows\System\yEgnqLY.exe
  2⤵
  PID:10344
- C:\Windows\System\rxxxYDr.exe
  C:\Windows\System\rxxxYDr.exe
  2⤵
  PID:10364
- C:\Windows\System\fOEoBat.exe
  C:\Windows\System\fOEoBat.exe
  2⤵
  PID:10400
- C:\Windows\System\gmBPfBS.exe
  C:\Windows\System\gmBPfBS.exe
  2⤵
  PID:10424
- C:\Windows\System\YhxKnXw.exe
  C:\Windows\System\YhxKnXw.exe
  2⤵
  PID:10456
- C:\Windows\System\JUyfrNn.exe
  C:\Windows\System\JUyfrNn.exe
  2⤵
  PID:10484
- C:\Windows\System\XKsNMJQ.exe
  C:\Windows\System\XKsNMJQ.exe
  2⤵
  PID:10504
- C:\Windows\System\Kzojijb.exe
  C:\Windows\System\Kzojijb.exe
  2⤵
  PID:10568
- C:\Windows\System\LmEcutf.exe
  C:\Windows\System\LmEcutf.exe
  2⤵
  PID:10592
- C:\Windows\System\xwVZjHQ.exe
  C:\Windows\System\xwVZjHQ.exe
  2⤵
  PID:10620
- C:\Windows\System\qpIHuvi.exe
  C:\Windows\System\qpIHuvi.exe
  2⤵
  PID:10648
- C:\Windows\System\yQlYHLd.exe
  C:\Windows\System\yQlYHLd.exe
  2⤵
  PID:10668
- C:\Windows\System\EOycIpx.exe
  C:\Windows\System\EOycIpx.exe
  2⤵
  PID:10700
- C:\Windows\System\yYoTkrp.exe
  C:\Windows\System\yYoTkrp.exe
  2⤵
  PID:10720
- C:\Windows\System\HRTOrzf.exe
  C:\Windows\System\HRTOrzf.exe
  2⤵
  PID:10736
- C:\Windows\System\gpVoGJf.exe
  C:\Windows\System\gpVoGJf.exe
  2⤵
  PID:10764
- C:\Windows\System\cuqZIAD.exe
  C:\Windows\System\cuqZIAD.exe
  2⤵
  PID:10804
- C:\Windows\System\CyXSuRR.exe
  C:\Windows\System\CyXSuRR.exe
  2⤵
  PID:10844
- C:\Windows\System\nKXlKvk.exe
  C:\Windows\System\nKXlKvk.exe
  2⤵
  PID:10872
- C:\Windows\System\DGbqRCt.exe
  C:\Windows\System\DGbqRCt.exe
  2⤵
  PID:10888
- C:\Windows\System\KHziuXc.exe
  C:\Windows\System\KHziuXc.exe
  2⤵
  PID:10924
- C:\Windows\System\rwzeGXb.exe
  C:\Windows\System\rwzeGXb.exe
  2⤵
  PID:10944
- C:\Windows\System\fFyVohI.exe
  C:\Windows\System\fFyVohI.exe
  2⤵
  PID:10964
- C:\Windows\System\ayXsItX.exe
  C:\Windows\System\ayXsItX.exe
  2⤵
  PID:10992
- C:\Windows\System\WmsEPfD.exe
  C:\Windows\System\WmsEPfD.exe
  2⤵
  PID:11016
- C:\Windows\System\MlhLZsj.exe
  C:\Windows\System\MlhLZsj.exe
  2⤵
  PID:11056
- C:\Windows\System\nUkloXs.exe
  C:\Windows\System\nUkloXs.exe
  2⤵
  PID:11088
- C:\Windows\System\IZNvrXb.exe
  C:\Windows\System\IZNvrXb.exe
  2⤵
  PID:11124
- C:\Windows\System\kuWCbSO.exe
  C:\Windows\System\kuWCbSO.exe
  2⤵
  PID:11152
- C:\Windows\System\dOeynoV.exe
  C:\Windows\System\dOeynoV.exe
  2⤵
  PID:11180
- C:\Windows\System\hQrUCHQ.exe
  C:\Windows\System\hQrUCHQ.exe
  2⤵
  PID:11196
- C:\Windows\System\PjypUWI.exe
  C:\Windows\System\PjypUWI.exe
  2⤵
  PID:11232
- C:\Windows\System\hptJBeT.exe
  C:\Windows\System\hptJBeT.exe
  2⤵
  PID:11252
- C:\Windows\System\wFcqCIe.exe
  C:\Windows\System\wFcqCIe.exe
  2⤵
  PID:10164
- C:\Windows\System\RXahWIF.exe
  C:\Windows\System\RXahWIF.exe
  2⤵
  PID:10324
- C:\Windows\System\gpSatSB.exe
  C:\Windows\System\gpSatSB.exe
  2⤵
  PID:10360
- C:\Windows\System\WppJOpb.exe
  C:\Windows\System\WppJOpb.exe
  2⤵
  PID:10440
- C:\Windows\System\xTrpovG.exe
  C:\Windows\System\xTrpovG.exe
  2⤵
  PID:10496
- C:\Windows\System\bIGmrRC.exe
  C:\Windows\System\bIGmrRC.exe
  2⤵
  PID:10576
- C:\Windows\System\GlSbtFR.exe
  C:\Windows\System\GlSbtFR.exe
  2⤵
  PID:10640
- C:\Windows\System\uHEOCOq.exe
  C:\Windows\System\uHEOCOq.exe
  2⤵
  PID:10692
- C:\Windows\System\aXyfyei.exe
  C:\Windows\System\aXyfyei.exe
  2⤵
  PID:10748
- C:\Windows\System\uOmdteO.exe
  C:\Windows\System\uOmdteO.exe
  2⤵
  PID:10800
- C:\Windows\System\eujKeHq.exe
  C:\Windows\System\eujKeHq.exe
  2⤵
  PID:10884
- C:\Windows\System\LbTOeJa.exe
  C:\Windows\System\LbTOeJa.exe
  2⤵
  PID:10960
- C:\Windows\System\KyEnQtI.exe
  C:\Windows\System\KyEnQtI.exe
  2⤵
  PID:11044
- C:\Windows\System\TUehTDg.exe
  C:\Windows\System\TUehTDg.exe
  2⤵
  PID:11084
- C:\Windows\System\DHfzDUM.exe
  C:\Windows\System\DHfzDUM.exe
  2⤵
  PID:11164
- C:\Windows\System\smUnyvZ.exe
  C:\Windows\System\smUnyvZ.exe
  2⤵
  PID:11192
- C:\Windows\System\AeBlqfG.exe
  C:\Windows\System\AeBlqfG.exe
  2⤵
  PID:11248
- C:\Windows\System\zMXYvIG.exe
  C:\Windows\System\zMXYvIG.exe
  2⤵
  PID:10468
- C:\Windows\System\FtNPPlc.exe
  C:\Windows\System\FtNPPlc.exe
  2⤵
  PID:10732
- C:\Windows\System\TUCGsji.exe
  C:\Windows\System\TUCGsji.exe
  2⤵
  PID:10932
- C:\Windows\System\JgLZQSc.exe
  C:\Windows\System\JgLZQSc.exe
  2⤵
  PID:11136
- C:\Windows\System\pMbjuuU.exe
  C:\Windows\System\pMbjuuU.exe
  2⤵
  PID:11240
- C:\Windows\System\NngmbaI.exe
  C:\Windows\System\NngmbaI.exe
  2⤵
  PID:9472
- C:\Windows\System\HkBRuiZ.exe
  C:\Windows\System\HkBRuiZ.exe
  2⤵
  PID:10604
- C:\Windows\System\yRFAuAT.exe
  C:\Windows\System\yRFAuAT.exe
  2⤵
  PID:11120
- C:\Windows\System\VkILqRJ.exe
  C:\Windows\System\VkILqRJ.exe
  2⤵
  PID:10552
- C:\Windows\System\cFyIAxm.exe
  C:\Windows\System\cFyIAxm.exe
  2⤵
  PID:11280
- C:\Windows\System\IqiyIBI.exe
  C:\Windows\System\IqiyIBI.exe
  2⤵
  PID:11296
- C:\Windows\System\JgPJNGI.exe
  C:\Windows\System\JgPJNGI.exe
  2⤵
  PID:11324
- C:\Windows\System\gnXxOCJ.exe
  C:\Windows\System\gnXxOCJ.exe
  2⤵
  PID:11352
- C:\Windows\System\SGPlpio.exe
  C:\Windows\System\SGPlpio.exe
  2⤵
  PID:11368
- C:\Windows\System\kxggTJN.exe
  C:\Windows\System\kxggTJN.exe
  2⤵
  PID:11396
- C:\Windows\System\bolCclk.exe
  C:\Windows\System\bolCclk.exe
  2⤵
  PID:11436
- C:\Windows\System\yaolZuz.exe
  C:\Windows\System\yaolZuz.exe
  2⤵
  PID:11484
- C:\Windows\System\FOSLsUN.exe
  C:\Windows\System\FOSLsUN.exe
  2⤵
  PID:11508
- C:\Windows\System\nsxjWfh.exe
  C:\Windows\System\nsxjWfh.exe
  2⤵
  PID:11524
- C:\Windows\System\picSNpF.exe
  C:\Windows\System\picSNpF.exe
  2⤵
  PID:11552
- C:\Windows\System\BdNmmKU.exe
  C:\Windows\System\BdNmmKU.exe
  2⤵
  PID:11584
- C:\Windows\System\gColVnd.exe
  C:\Windows\System\gColVnd.exe
  2⤵
  PID:11608
- C:\Windows\System\GnCsiLN.exe
  C:\Windows\System\GnCsiLN.exe
  2⤵
  PID:11636
- C:\Windows\System\oAgGErn.exe
  C:\Windows\System\oAgGErn.exe
  2⤵
  PID:11656
- C:\Windows\System\tofdInz.exe
  C:\Windows\System\tofdInz.exe
  2⤵
  PID:11684
- C:\Windows\System\kdDYucM.exe
  C:\Windows\System\kdDYucM.exe
  2⤵
  PID:11700
- C:\Windows\System\qVqtTTC.exe
  C:\Windows\System\qVqtTTC.exe
  2⤵
  PID:11724
- C:\Windows\System\ejcFzRM.exe
  C:\Windows\System\ejcFzRM.exe
  2⤵
  PID:11748
- C:\Windows\System\jpOaaZd.exe
  C:\Windows\System\jpOaaZd.exe
  2⤵
  PID:11776
- C:\Windows\System\vtYOyjA.exe
  C:\Windows\System\vtYOyjA.exe
  2⤵
  PID:11800
- C:\Windows\System\PfsExek.exe
  C:\Windows\System\PfsExek.exe
  2⤵
  PID:11832
- C:\Windows\System\OYHIpHF.exe
  C:\Windows\System\OYHIpHF.exe
  2⤵
  PID:11852
- C:\Windows\System\AkdrPyv.exe
  C:\Windows\System\AkdrPyv.exe
  2⤵
  PID:11908
- C:\Windows\System\WGyFLGV.exe
  C:\Windows\System\WGyFLGV.exe
  2⤵
  PID:11936
- C:\Windows\System\LLUHExZ.exe
  C:\Windows\System\LLUHExZ.exe
  2⤵
  PID:11964
- C:\Windows\System\aZFAmHf.exe
  C:\Windows\System\aZFAmHf.exe
  2⤵
  PID:11996
- C:\Windows\System\CbrnWhv.exe
  C:\Windows\System\CbrnWhv.exe
  2⤵
  PID:12024
- C:\Windows\System\doPVRkg.exe
  C:\Windows\System\doPVRkg.exe
  2⤵
  PID:12048
- C:\Windows\System\szVTQSu.exe
  C:\Windows\System\szVTQSu.exe
  2⤵
  PID:12072
- C:\Windows\System\DHwxQiR.exe
  C:\Windows\System\DHwxQiR.exe
  2⤵
  PID:12112
- C:\Windows\System\PEwXWcg.exe
  C:\Windows\System\PEwXWcg.exe
  2⤵
  PID:12136
- C:\Windows\System\hUvwxKY.exe
  C:\Windows\System\hUvwxKY.exe
  2⤵
  PID:12180
- C:\Windows\System\cQtQmHk.exe
  C:\Windows\System\cQtQmHk.exe
  2⤵
  PID:12200
- C:\Windows\System\fvRJmwK.exe
  C:\Windows\System\fvRJmwK.exe
  2⤵
  PID:12224
- C:\Windows\System\liNJrOM.exe
  C:\Windows\System\liNJrOM.exe
  2⤵
  PID:12244
- C:\Windows\System\YYiqcBF.exe
  C:\Windows\System\YYiqcBF.exe
  2⤵
  PID:12268
- C:\Windows\System\TzzJEKC.exe
  C:\Windows\System\TzzJEKC.exe
  2⤵
  PID:11272
- C:\Windows\System\TiDQaWj.exe
  C:\Windows\System\TiDQaWj.exe
  2⤵
  PID:11360
- C:\Windows\System\iktayzz.exe
  C:\Windows\System\iktayzz.exe
  2⤵
  PID:11428
- C:\Windows\System\UjrjiVJ.exe
  C:\Windows\System\UjrjiVJ.exe
  2⤵
  PID:11496
- C:\Windows\System\tTqtqea.exe
  C:\Windows\System\tTqtqea.exe
  2⤵
  PID:11576
- C:\Windows\System\edmTPYK.exe
  C:\Windows\System\edmTPYK.exe
  2⤵
  PID:11668
- C:\Windows\System\ciOwyeG.exe
  C:\Windows\System\ciOwyeG.exe
  2⤵
  PID:11664
- C:\Windows\System\uSZamHH.exe
  C:\Windows\System\uSZamHH.exe
  2⤵
  PID:11792
- C:\Windows\System\AmpcyMk.exe
  C:\Windows\System\AmpcyMk.exe
  2⤵
  PID:11816
- C:\Windows\System\vYLzwgs.exe
  C:\Windows\System\vYLzwgs.exe
  2⤵
  PID:11960
- C:\Windows\System\qcZxofU.exe
  C:\Windows\System\qcZxofU.exe
  2⤵
  PID:12008
- C:\Windows\System\lEyuoVf.exe
  C:\Windows\System\lEyuoVf.exe
  2⤵
  PID:12056
- C:\Windows\System\TQyvfWS.exe
  C:\Windows\System\TQyvfWS.exe
  2⤵
  PID:12100
- C:\Windows\System\YXzZuNT.exe
  C:\Windows\System\YXzZuNT.exe
  2⤵
  PID:12156
- C:\Windows\System\wdjlUfN.exe
  C:\Windows\System\wdjlUfN.exe
  2⤵
  PID:12212
- C:\Windows\System\vDebcqy.exe
  C:\Windows\System\vDebcqy.exe
  2⤵
  PID:12232
- C:\Windows\System\IznpFHo.exe
  C:\Windows\System\IznpFHo.exe
  2⤵
  PID:11336
- C:\Windows\System\MHhEJom.exe
  C:\Windows\System\MHhEJom.exe
  2⤵
  PID:11648
- C:\Windows\System\SYUqLpl.exe
  C:\Windows\System\SYUqLpl.exe
  2⤵
  PID:11896
- C:\Windows\System\DEQwVVU.exe
  C:\Windows\System\DEQwVVU.exe
  2⤵
  PID:11992
- C:\Windows\System\wzsmIKN.exe
  C:\Windows\System\wzsmIKN.exe
  2⤵
  PID:12284
- C:\Windows\System\UcddQjy.exe
  C:\Windows\System\UcddQjy.exe
  2⤵
  PID:11716
- C:\Windows\System\yULLMyQ.exe
  C:\Windows\System\yULLMyQ.exe
  2⤵
  PID:12264
- C:\Windows\System\GzHgfkU.exe
  C:\Windows\System\GzHgfkU.exe
  2⤵
  PID:12316
- C:\Windows\System\YcpOrll.exe
  C:\Windows\System\YcpOrll.exe
  2⤵
  PID:12336
- C:\Windows\System\SsqRjQz.exe
  C:\Windows\System\SsqRjQz.exe
  2⤵
  PID:12364
- C:\Windows\System\OIUnYXf.exe
  C:\Windows\System\OIUnYXf.exe
  2⤵
  PID:12396
- C:\Windows\System\DQxtUde.exe
  C:\Windows\System\DQxtUde.exe
  2⤵
  PID:12424
- C:\Windows\System\GVvwKUB.exe
  C:\Windows\System\GVvwKUB.exe
  2⤵
  PID:12448
- C:\Windows\System\lDUwDZT.exe
  C:\Windows\System\lDUwDZT.exe
  2⤵
  PID:12504
- C:\Windows\System\llfJdkr.exe
  C:\Windows\System\llfJdkr.exe
  2⤵
  PID:12520
- C:\Windows\System\rIAVCaK.exe
  C:\Windows\System\rIAVCaK.exe
  2⤵
  PID:12556
- C:\Windows\System\PEHDwHy.exe
  C:\Windows\System\PEHDwHy.exe
  2⤵
  PID:12588
- C:\Windows\System\xknEoom.exe
  C:\Windows\System\xknEoom.exe
  2⤵
  PID:12616
- C:\Windows\System\VSJGsgF.exe
  C:\Windows\System\VSJGsgF.exe
  2⤵
  PID:12676
- C:\Windows\System\cUGGlXh.exe
  C:\Windows\System\cUGGlXh.exe
  2⤵
  PID:12712
- C:\Windows\System\bqzxviV.exe
  C:\Windows\System\bqzxviV.exe
  2⤵
  PID:12740
- C:\Windows\System\qcTfRQO.exe
  C:\Windows\System\qcTfRQO.exe
  2⤵
  PID:12772
- C:\Windows\System\ZHQVNrl.exe
  C:\Windows\System\ZHQVNrl.exe
  2⤵
  PID:12800
- C:\Windows\System\DFlMpHr.exe
  C:\Windows\System\DFlMpHr.exe
  2⤵
  PID:12832
- C:\Windows\System\jhruORT.exe
  C:\Windows\System\jhruORT.exe
  2⤵
  PID:12860
- C:\Windows\System\uOuWoLI.exe
  C:\Windows\System\uOuWoLI.exe
  2⤵
  PID:12880
- C:\Windows\System\xfqvcsu.exe
  C:\Windows\System\xfqvcsu.exe
  2⤵
  PID:12936
- C:\Windows\System\YrkPiMA.exe
  C:\Windows\System\YrkPiMA.exe
  2⤵
  PID:12964
- C:\Windows\System\cxHuvLS.exe
  C:\Windows\System\cxHuvLS.exe
  2⤵
  PID:12984
- C:\Windows\System\KtSkQNj.exe
  C:\Windows\System\KtSkQNj.exe
  2⤵
  PID:13008
- C:\Windows\System\GXdBJXQ.exe
  C:\Windows\System\GXdBJXQ.exe
  2⤵
  PID:13048
- C:\Windows\System\idIoluc.exe
  C:\Windows\System\idIoluc.exe
  2⤵
  PID:13068
- C:\Windows\System\wxRCGgW.exe
  C:\Windows\System\wxRCGgW.exe
  2⤵
  PID:13104
- C:\Windows\System\lHnkose.exe
  C:\Windows\System\lHnkose.exe
  2⤵
  PID:13120
- C:\Windows\System\NxtyOGG.exe
  C:\Windows\System\NxtyOGG.exe
  2⤵
  PID:13160
- C:\Windows\System\AslvSGK.exe
  C:\Windows\System\AslvSGK.exe
  2⤵
  PID:13192
- C:\Windows\System\jayyZlV.exe
  C:\Windows\System\jayyZlV.exe
  2⤵
  PID:13212
- C:\Windows\System\NuUmvpe.exe
  C:\Windows\System\NuUmvpe.exe
  2⤵
  PID:13228
- C:\Windows\System\KTEroJf.exe
  C:\Windows\System\KTEroJf.exe
  2⤵
  PID:13244
- C:\Windows\System\cvlHwGp.exe
  C:\Windows\System\cvlHwGp.exe
  2⤵
  PID:13260
- C:\Windows\System\DGFNNZe.exe
  C:\Windows\System\DGFNNZe.exe
  2⤵
  PID:13276
- C:\Windows\System\YGCRPEM.exe
  C:\Windows\System\YGCRPEM.exe
  2⤵
  PID:13292
- C:\Windows\System\AYJidKA.exe
  C:\Windows\System\AYJidKA.exe
  2⤵
  PID:12104
- C:\Windows\System\FEgXKUr.exe
  C:\Windows\System\FEgXKUr.exe
  2⤵
  PID:12408
- C:\Windows\System\kVMuvVZ.exe
  C:\Windows\System\kVMuvVZ.exe
  2⤵
  PID:12532
- C:\Windows\System\VzkAoqd.exe
  C:\Windows\System\VzkAoqd.exe
  2⤵
  PID:12728
- C:\Windows\System\rRbhTuk.exe
  C:\Windows\System\rRbhTuk.exe
  2⤵
  PID:12792
- C:\Windows\System\sNzMGNM.exe
  C:\Windows\System\sNzMGNM.exe
  2⤵
  PID:12876
- C:\Windows\System\gjsHnee.exe
  C:\Windows\System\gjsHnee.exe
  2⤵
  PID:12956
- C:\Windows\System\gSFIuwl.exe
  C:\Windows\System\gSFIuwl.exe
  2⤵
  PID:13000
- C:\Windows\System\AatwcQl.exe
  C:\Windows\System\AatwcQl.exe
  2⤵
  PID:13112
- C:\Windows\System\eQznoMh.exe
  C:\Windows\System\eQznoMh.exe
  2⤵
  PID:13188
- C:\Windows\System\RtAhkmY.exe
  C:\Windows\System\RtAhkmY.exe
  2⤵
  PID:13240
- C:\Windows\System\uLepEUJ.exe
  C:\Windows\System\uLepEUJ.exe
  2⤵
  PID:12296
- C:\Windows\System\zjBMFDf.exe
  C:\Windows\System\zjBMFDf.exe
  2⤵
  PID:13304
- C:\Windows\System\fKptOvY.exe
  C:\Windows\System\fKptOvY.exe
  2⤵
  PID:12544
- C:\Windows\System\sDyriNP.exe
  C:\Windows\System\sDyriNP.exe
  2⤵
  PID:12784
- C:\Windows\System\xfGaPmL.exe
  C:\Windows\System\xfGaPmL.exe
  2⤵
  PID:13092
- C:\Windows\System\uHlOhFx.exe
  C:\Windows\System\uHlOhFx.exe
  2⤵
  PID:13172
- C:\Windows\System\yXRkpzK.exe
  C:\Windows\System\yXRkpzK.exe
  2⤵
  PID:13288
- C:\Windows\System\nmWczBm.exe
  C:\Windows\System\nmWczBm.exe
  2⤵
  PID:12852
- C:\Windows\System\SPjAvbN.exe
  C:\Windows\System\SPjAvbN.exe
  2⤵
  PID:13268
- C:\Windows\System\QLzXAqS.exe
  C:\Windows\System\QLzXAqS.exe
  2⤵
  PID:13152
- C:\Windows\System\KjjXsGg.exe
  C:\Windows\System\KjjXsGg.exe
  2⤵
  PID:12656
- C:\Windows\System\WCaLlOJ.exe
  C:\Windows\System\WCaLlOJ.exe
  2⤵
  PID:13352
- C:\Windows\System\xZsmYFI.exe
  C:\Windows\System\xZsmYFI.exe
  2⤵
  PID:13380
- C:\Windows\System\CnaNlEz.exe
  C:\Windows\System\CnaNlEz.exe
  2⤵
  PID:13408
- C:\Windows\System\QBWrQxa.exe
  C:\Windows\System\QBWrQxa.exe
  2⤵
  PID:13436
- C:\Windows\System\luLjqOq.exe
  C:\Windows\System\luLjqOq.exe
  2⤵
  PID:13452
- C:\Windows\System\gZtdjOH.exe
  C:\Windows\System\gZtdjOH.exe
  2⤵
  PID:13480
- C:\Windows\System\anvdGyV.exe
  C:\Windows\System\anvdGyV.exe
  2⤵
  PID:13520
- C:\Windows\System\LjTypEo.exe
  C:\Windows\System\LjTypEo.exe
  2⤵
  PID:13548
- C:\Windows\System\bRkZArF.exe
  C:\Windows\System\bRkZArF.exe
  2⤵
  PID:13576
- C:\Windows\System\kkRFcMB.exe
  C:\Windows\System\kkRFcMB.exe
  2⤵
  PID:13596
- C:\Windows\System\KfaEJus.exe
  C:\Windows\System\KfaEJus.exe
  2⤵
  PID:13632
- C:\Windows\System\jZMgnVX.exe
  C:\Windows\System\jZMgnVX.exe
  2⤵
  PID:13660
- C:\Windows\System\xANCKBC.exe
  C:\Windows\System\xANCKBC.exe
  2⤵
  PID:13684
- C:\Windows\System\lheIkZe.exe
  C:\Windows\System\lheIkZe.exe
  2⤵
  PID:13708
- C:\Windows\System\ENqgXZf.exe
  C:\Windows\System\ENqgXZf.exe
  2⤵
  PID:13732
- C:\Windows\System\LlaFNXL.exe
  C:\Windows\System\LlaFNXL.exe
  2⤵
  PID:13760
- C:\Windows\System\NoqtZIB.exe
  C:\Windows\System\NoqtZIB.exe
  2⤵
  PID:13800
- C:\Windows\System\FDBSEJh.exe
  C:\Windows\System\FDBSEJh.exe
  2⤵
  PID:13828
- C:\Windows\System\RRMQJTi.exe
  C:\Windows\System\RRMQJTi.exe
  2⤵
  PID:13852
- C:\Windows\System\ZDVfKtS.exe
  C:\Windows\System\ZDVfKtS.exe
  2⤵
  PID:13884
- C:\Windows\System\HAlwHSB.exe
  C:\Windows\System\HAlwHSB.exe
  2⤵
  PID:13912
- C:\Windows\System\WdULPUa.exe
  C:\Windows\System\WdULPUa.exe
  2⤵
  PID:13928
- C:\Windows\System\bKvmwHm.exe
  C:\Windows\System\bKvmwHm.exe
  2⤵
  PID:13968
- C:\Windows\System\KXQjguc.exe
  C:\Windows\System\KXQjguc.exe
  2⤵
  PID:13984
- C:\Windows\System\mdfDyKH.exe
  C:\Windows\System\mdfDyKH.exe
  2⤵
  PID:14012
- C:\Windows\System\NWvABXq.exe
  C:\Windows\System\NWvABXq.exe
  2⤵
  PID:14032
- C:\Windows\System\QZvWWDR.exe
  C:\Windows\System\QZvWWDR.exe
  2⤵
  PID:14056
- C:\Windows\System\eThdxMh.exe
  C:\Windows\System\eThdxMh.exe
  2⤵
  PID:14088
- C:\Windows\System\qEmrGYd.exe
  C:\Windows\System\qEmrGYd.exe
  2⤵
  PID:14128
- C:\Windows\System\SjgjPuo.exe
  C:\Windows\System\SjgjPuo.exe
  2⤵
  PID:14152
- C:\Windows\System\LKqrzIj.exe
  C:\Windows\System\LKqrzIj.exe
  2⤵
  PID:14168
- C:\Windows\System\GxSuheK.exe
  C:\Windows\System\GxSuheK.exe
  2⤵
  PID:14204
- C:\Windows\System\vsZHkRC.exe
  C:\Windows\System\vsZHkRC.exe
  2⤵
  PID:14232
- C:\Windows\System\dghgrBI.exe
  C:\Windows\System\dghgrBI.exe
  2⤵
  PID:14260
- C:\Windows\System\fKhJXwU.exe
  C:\Windows\System\fKhJXwU.exe
  2⤵
  PID:14296
- C:\Windows\System\PEzskJA.exe
  C:\Windows\System\PEzskJA.exe
  2⤵
  PID:14332
- C:\Windows\System\cMGJXGQ.exe
  C:\Windows\System\cMGJXGQ.exe
  2⤵
  PID:13344
- C:\Windows\System\ZakFXwA.exe
  C:\Windows\System\ZakFXwA.exe
  2⤵
  PID:13400
- C:\Windows\System\BwPSuJI.exe
  C:\Windows\System\BwPSuJI.exe
  2⤵
  PID:13476
- C:\Windows\System\blHJJJg.exe
  C:\Windows\System\blHJJJg.exe
  2⤵
  PID:13540
- C:\Windows\System\dqYKCXb.exe
  C:\Windows\System\dqYKCXb.exe
  2⤵
  PID:13624
- C:\Windows\System\TfDkGtI.exe
  C:\Windows\System\TfDkGtI.exe
  2⤵
  PID:13668
- C:\Windows\System\hDLFfPm.exe
  C:\Windows\System\hDLFfPm.exe
  2⤵
  PID:13696
- C:\Windows\System\KJQyUNO.exe
  C:\Windows\System\KJQyUNO.exe
  2⤵
  PID:13776
- C:\Windows\System\MqZZmpR.exe
  C:\Windows\System\MqZZmpR.exe
  2⤵
  PID:13872
- C:\Windows\System\njRxjmL.exe
  C:\Windows\System\njRxjmL.exe
  2⤵
  PID:13900
- C:\Windows\System\fCozENT.exe
  C:\Windows\System\fCozENT.exe
  2⤵
  PID:13996
- C:\Windows\System\JOOnWnP.exe
  C:\Windows\System\JOOnWnP.exe
  2⤵
  PID:14048
- C:\Windows\System\fIENDlI.exe
  C:\Windows\System\fIENDlI.exe
  2⤵
  PID:14084
- C:\Windows\System\LLqvSyk.exe
  C:\Windows\System\LLqvSyk.exe
  2⤵
  PID:14180
- C:\Windows\System\JGebTOF.exe
  C:\Windows\System\JGebTOF.exe
  2⤵
  PID:14252
- C:\Windows\System\yupdFHz.exe
  C:\Windows\System\yupdFHz.exe
  2⤵
  PID:14284
- C:\Windows\System\dbqmsyt.exe
  C:\Windows\System\dbqmsyt.exe
  2⤵
  PID:13368
- C:\Windows\System\iQLtUhz.exe
  C:\Windows\System\iQLtUhz.exe
  2⤵
  PID:13536
- C:\Windows\System\EsjjsLy.exe
  C:\Windows\System\EsjjsLy.exe
  2⤵
  PID:13748
- C:\Windows\System\QimAoAp.exe
  C:\Windows\System\QimAoAp.exe
  2⤵
  PID:13896
- C:\Windows\System\iaOiWmw.exe
  C:\Windows\System\iaOiWmw.exe
  2⤵
  PID:13960
- C:\Windows\System\OLtYOjQ.exe
  C:\Windows\System\OLtYOjQ.exe
  2⤵
  PID:14160
- C:\Windows\System\VNnwEsp.exe
  C:\Windows\System\VNnwEsp.exe
  2⤵
  PID:14316
- C:\Windows\System\psndvhW.exe
  C:\Windows\System\psndvhW.exe
  2⤵
  PID:14000
- C:\Windows\System\DKTSMVo.exe
  C:\Windows\System\DKTSMVo.exe
  2⤵
  PID:14140
- C:\Windows\System\ErsMRXO.exe
  C:\Windows\System\ErsMRXO.exe
  2⤵
  PID:13844
- C:\Windows\System\eMGIpVk.exe
  C:\Windows\System\eMGIpVk.exe
  2⤵
  PID:14340
- C:\Windows\System\KfVERHo.exe
  C:\Windows\System\KfVERHo.exe
  2⤵
  PID:14368
- C:\Windows\System\eTIzABP.exe
  C:\Windows\System\eTIzABP.exe
  2⤵
  PID:14396
- C:\Windows\System\xsOuYOv.exe
  C:\Windows\System\xsOuYOv.exe
  2⤵
  PID:14420
- C:\Windows\System\teeJtBk.exe
  C:\Windows\System\teeJtBk.exe
  2⤵
  PID:14436
- C:\Windows\System\fPolGMh.exe
  C:\Windows\System\fPolGMh.exe
  2⤵
  PID:14452
- C:\Windows\System\mFfQZlL.exe
  C:\Windows\System\mFfQZlL.exe
  2⤵
  PID:14480
- C:\Windows\System\fFdHYKG.exe
  C:\Windows\System\fFdHYKG.exe
  2⤵
  PID:14520
- C:\Windows\System\AHGhMVG.exe
  C:\Windows\System\AHGhMVG.exe
  2⤵
  PID:14540
- C:\Windows\System\UXNttWo.exe
  C:\Windows\System\UXNttWo.exe
  2⤵
  PID:14592
- C:\Windows\System\zcDnVRf.exe
  C:\Windows\System\zcDnVRf.exe
  2⤵
  PID:14608
- C:\Windows\System\kGErtvo.exe
  C:\Windows\System\kGErtvo.exe
  2⤵
  PID:14628
- C:\Windows\System\zuEFMQQ.exe
  C:\Windows\System\zuEFMQQ.exe
  2⤵
  PID:14652
- C:\Windows\System\ubdJnMN.exe
  C:\Windows\System\ubdJnMN.exe
  2⤵
  PID:14668
- C:\Windows\System\zXZlMAJ.exe
  C:\Windows\System\zXZlMAJ.exe
  2⤵
  PID:14700
- C:\Windows\System\Wvtlvbo.exe
  C:\Windows\System\Wvtlvbo.exe
  2⤵
  PID:14752
- C:\Windows\System\xrpOmeQ.exe
  C:\Windows\System\xrpOmeQ.exe
  2⤵
  PID:14772
- C:\Windows\System\URRCjas.exe
  C:\Windows\System\URRCjas.exe
  2⤵
  PID:14804
- C:\Windows\System\dSLODBi.exe
  C:\Windows\System\dSLODBi.exe
  2⤵
  PID:14820
- C:\Windows\System\DHKadrV.exe
  C:\Windows\System\DHKadrV.exe
  2⤵
  PID:14844
- C:\Windows\System\JbPjzYm.exe
  C:\Windows\System\JbPjzYm.exe
  2⤵
  PID:14888
- C:\Windows\System\xwHmcQg.exe
  C:\Windows\System\xwHmcQg.exe
  2⤵
  PID:14904
- C:\Windows\System\vNMcYIP.exe
  C:\Windows\System\vNMcYIP.exe
  2⤵
  PID:14936
- C:\Windows\System\jaKtrGG.exe
  C:\Windows\System\jaKtrGG.exe
  2⤵
  PID:14956
- C:\Windows\System\Dydqzvh.exe
  C:\Windows\System\Dydqzvh.exe
  2⤵
  PID:15000
- C:\Windows\System\BMXvJeb.exe
  C:\Windows\System\BMXvJeb.exe
  2⤵
  PID:15024
- C:\Windows\System\UGyjqbg.exe
  C:\Windows\System\UGyjqbg.exe
  2⤵
  PID:15056
- C:\Windows\System\XTcmeCB.exe
  C:\Windows\System\XTcmeCB.exe
  2⤵
  PID:15100
- C:\Windows\System\IjVKLUn.exe
  C:\Windows\System\IjVKLUn.exe
  2⤵
  PID:15160
- C:\Windows\System\yNMhdrw.exe
  C:\Windows\System\yNMhdrw.exe
  2⤵
  PID:15188
- C:\Windows\System\haupTDf.exe
  C:\Windows\System\haupTDf.exe
  2⤵
  PID:15208
- C:\Windows\System\GpYuAAx.exe
  C:\Windows\System\GpYuAAx.exe
  2⤵
  PID:15236
- C:\Windows\System\FziLedc.exe
  C:\Windows\System\FziLedc.exe
  2⤵
  PID:15260
- C:\Windows\System\KpoaMcw.exe
  C:\Windows\System\KpoaMcw.exe
  2⤵
  PID:15300
- C:\Windows\System\gOluNaS.exe
  C:\Windows\System\gOluNaS.exe
  2⤵
  PID:15328
- C:\Windows\System\YuvNSJM.exe
  C:\Windows\System\YuvNSJM.exe
  2⤵
  PID:15356
- C:\Windows\System\hHPxvMZ.exe
  C:\Windows\System\hHPxvMZ.exe
  2⤵
  PID:14380
- C:\Windows\System\xFcPKAE.exe
  C:\Windows\System\xFcPKAE.exe
  2⤵
  PID:14444
- C:\Windows\System\BDmYIJn.exe
  C:\Windows\System\BDmYIJn.exe
  2⤵
  PID:14512
- C:\Windows\System\IiFVduh.exe
  C:\Windows\System\IiFVduh.exe
  2⤵
  PID:14580
- C:\Windows\System\inWYoMT.exe
  C:\Windows\System\inWYoMT.exe
  2⤵
  PID:14640
- C:\Windows\System\yWPUlxH.exe
  C:\Windows\System\yWPUlxH.exe
  2⤵
  PID:14680
- C:\Windows\System\dYCVXNy.exe
  C:\Windows\System\dYCVXNy.exe
  2⤵
  PID:14740
- C:\Windows\System\UKzitGF.exe
  C:\Windows\System\UKzitGF.exe
  2⤵
  PID:14828
- C:\Windows\System\yKCNDhs.exe
  C:\Windows\System\yKCNDhs.exe
  2⤵
  PID:14868
- C:\Windows\System\KETDJXj.exe
  C:\Windows\System\KETDJXj.exe
  2⤵
  PID:14976
- C:\Windows\System\tHbEcGz.exe
  C:\Windows\System\tHbEcGz.exe
  2⤵
  PID:14972
- C:\Windows\System\lnvtpjM.exe
  C:\Windows\System\lnvtpjM.exe
  2⤵
  PID:15128
- C:\Windows\System\eQBUxMO.exe
  C:\Windows\System\eQBUxMO.exe
  2⤵
  PID:15152
- C:\Windows\System\hKGnont.exe
  C:\Windows\System\hKGnont.exe
  2⤵
  PID:15252
- C:\Windows\System\onvNSQT.exe
  C:\Windows\System\onvNSQT.exe
  2⤵
  PID:15284
- C:\Windows\System\FazszDp.exe
  C:\Windows\System\FazszDp.exe
  2⤵
  PID:15348
- C:\Windows\System\DLselSh.exe
  C:\Windows\System\DLselSh.exe
  2⤵
  PID:14464
- C:\Windows\System\NBXeDht.exe
  C:\Windows\System\NBXeDht.exe
  2⤵
  PID:14644
- C:\Windows\System\hYGoGdF.exe
  C:\Windows\System\hYGoGdF.exe
  2⤵
  PID:14760
- C:\Windows\System\jpdYRbg.exe
  C:\Windows\System\jpdYRbg.exe
  2⤵
  PID:14948
- C:\Windows\System\QQAEvrR.exe
  C:\Windows\System\QQAEvrR.exe
  2⤵
  PID:15016
- C:\Windows\System\xVMUrDg.exe
  C:\Windows\System\xVMUrDg.exe
  2⤵
  PID:15232
- C:\Windows\System\TmMPSbp.exe
  C:\Windows\System\TmMPSbp.exe
  2⤵
  PID:14408
- C:\Windows\System\RWXxSUh.exe
  C:\Windows\System\RWXxSUh.exe
  2⤵
  PID:14696
- C:\Windows\System\VehaOyN.exe
  C:\Windows\System\VehaOyN.exe
  2⤵
  PID:15148
- C:\Windows\System\uzgtxar.exe
  C:\Windows\System\uzgtxar.exe
  2⤵
  PID:14964
- C:\Windows\System\nzqRsHK.exe
  C:\Windows\System\nzqRsHK.exe
  2⤵
  PID:13644
- C:\Windows\System\jqugJFW.exe
  C:\Windows\System\jqugJFW.exe
  2⤵
  PID:15384
- C:\Windows\System\aqcPCQE.exe
  C:\Windows\System\aqcPCQE.exe
  2⤵
  PID:15424
- C:\Windows\System\iagiNus.exe
  C:\Windows\System\iagiNus.exe
  2⤵
  PID:15444
- C:\Windows\System\xJFawUW.exe
  C:\Windows\System\xJFawUW.exe
  2⤵
  PID:15468
- C:\Windows\System\bRTVPaj.exe
  C:\Windows\System\bRTVPaj.exe
  2⤵
  PID:15492
- C:\Windows\System\lsepYXt.exe
  C:\Windows\System\lsepYXt.exe
  2⤵
  PID:15520
- C:\Windows\System\LvImNfB.exe
  C:\Windows\System\LvImNfB.exe
  2⤵
  PID:15560
- C:\Windows\System\PLUCTJT.exe
  C:\Windows\System\PLUCTJT.exe
  2⤵
  PID:15584
- C:\Windows\System\XIiELYd.exe
  C:\Windows\System\XIiELYd.exe
  2⤵
  PID:15620
- C:\Windows\System\sFkcmkF.exe
  C:\Windows\System\sFkcmkF.exe
  2⤵
  PID:15648
- C:\Windows\System\JCnooOS.exe
  C:\Windows\System\JCnooOS.exe
  2⤵
  PID:15668
- C:\Windows\System\GpwYHSK.exe
  C:\Windows\System\GpwYHSK.exe
  2⤵
  PID:15696
- C:\Windows\System\WWCBWCH.exe
  C:\Windows\System\WWCBWCH.exe
  2⤵
  PID:15732
- C:\Windows\System\MJcUxCP.exe
  C:\Windows\System\MJcUxCP.exe
  2⤵
  PID:15760
- C:\Windows\System\DnKaXcY.exe
  C:\Windows\System\DnKaXcY.exe
  2⤵
  PID:15788
- C:\Windows\System\FJBldgQ.exe
  C:\Windows\System\FJBldgQ.exe
  2⤵
  PID:15816
- C:\Windows\System\mkqOvnx.exe
  C:\Windows\System\mkqOvnx.exe
  2⤵
  PID:15848
- C:\Windows\System\Berqhbh.exe
  C:\Windows\System\Berqhbh.exe
  2⤵
  PID:15876
- C:\Windows\System\dtxYSGr.exe
  C:\Windows\System\dtxYSGr.exe
  2⤵
  PID:15900
- C:\Windows\System\POwdkaj.exe
  C:\Windows\System\POwdkaj.exe
  2⤵
  PID:15932
- C:\Windows\System\ooqJBsi.exe
  C:\Windows\System\ooqJBsi.exe
  2⤵
  PID:15960
- C:\Windows\System\kGkPMjK.exe
  C:\Windows\System\kGkPMjK.exe
  2⤵
  PID:15988
- C:\Windows\System\WmVpVJz.exe
  C:\Windows\System\WmVpVJz.exe
  2⤵
  PID:16016
- C:\Windows\System\HKJcfbh.exe
  C:\Windows\System\HKJcfbh.exe
  2⤵
  PID:16036
- C:\Windows\System\bfJPpZF.exe
  C:\Windows\System\bfJPpZF.exe
  2⤵
  PID:16072
- C:\Windows\System\qUyBPze.exe
  C:\Windows\System\qUyBPze.exe
  2⤵
  PID:16088
- C:\Windows\System\MVkIwYD.exe
  C:\Windows\System\MVkIwYD.exe
  2⤵
  PID:16120
- C:\Windows\System\DpkOazD.exe
  C:\Windows\System\DpkOazD.exe
  2⤵
  PID:16152
- C:\Windows\System\bqTRgBd.exe
  C:\Windows\System\bqTRgBd.exe
  2⤵
  PID:16184
- C:\Windows\System\gAwSxyw.exe
  C:\Windows\System\gAwSxyw.exe
  2⤵
  PID:16208
- C:\Windows\System\hgvwdCn.exe
  C:\Windows\System\hgvwdCn.exe
  2⤵
  PID:16236
- C:\Windows\System\PAPcmAx.exe
  C:\Windows\System\PAPcmAx.exe
  2⤵
  PID:16256
- C:\Windows\System\jaovcYh.exe
  C:\Windows\System\jaovcYh.exe
  2⤵
  PID:16296
- C:\Windows\System\WKeGpmW.exe
  C:\Windows\System\WKeGpmW.exe
  2⤵
  PID:16324
- C:\Windows\System\anspZgW.exe
  C:\Windows\System\anspZgW.exe
  2⤵
  PID:16352
- C:\Windows\System\YpjonfE.exe
  C:\Windows\System\YpjonfE.exe
  2⤵
  PID:16372
- C:\Windows\System\dGsGedw.exe
  C:\Windows\System\dGsGedw.exe
  2⤵
  PID:15368
- C:\Windows\System\OnqyERJ.exe
  C:\Windows\System\OnqyERJ.exe
  2⤵
  PID:15420
- C:\Windows\System\RoYZNjA.exe
  C:\Windows\System\RoYZNjA.exe
  2⤵
  PID:15488
- C:\Windows\System\jJQonOI.exe
  C:\Windows\System\jJQonOI.exe
  2⤵
  PID:15616
- C:\Windows\System\gFLpxIa.exe
  C:\Windows\System\gFLpxIa.exe
  2⤵
  PID:15664
- C:\Windows\System\JUfRvCi.exe
  C:\Windows\System\JUfRvCi.exe
  2⤵
  PID:15720
- C:\Windows\System\xLQkWHd.exe
  C:\Windows\System\xLQkWHd.exe
  2⤵
  PID:15800
- C:\Windows\System\PXjggKt.exe
  C:\Windows\System\PXjggKt.exe
  2⤵
  PID:15840
- C:\Windows\System\LibTIPn.exe
  C:\Windows\System\LibTIPn.exe
  2⤵
  PID:15908
- C:\Windows\System\XIWZtsp.exe
  C:\Windows\System\XIWZtsp.exe
  2⤵
  PID:15956
- C:\Windows\System\QteGTLl.exe
  C:\Windows\System\QteGTLl.exe
  2⤵
  PID:16012
- C:\Windows\System\lrSkfBq.exe
  C:\Windows\System\lrSkfBq.exe
  2⤵
  PID:16080
- C:\Windows\System\keiHNxN.exe
  C:\Windows\System\keiHNxN.exe
  2⤵
  PID:16180
- C:\Windows\System\KowIuum.exe
  C:\Windows\System\KowIuum.exe
  2⤵
  PID:16200
- C:\Windows\System\qKbrZoK.exe
  C:\Windows\System\qKbrZoK.exe
  2⤵
  PID:16320
- C:\Windows\System\znlzWDX.exe
  C:\Windows\System\znlzWDX.exe
  2⤵
  PID:4332
- C:\Windows\System\kOaorUf.exe
  C:\Windows\System\kOaorUf.exe
  2⤵
  PID:15464
- C:\Windows\System\RzXGZgk.exe
  C:\Windows\System\RzXGZgk.exe
  2⤵
  PID:15608
- C:\Windows\System\BCgywaN.exe
  C:\Windows\System\BCgywaN.exe
  2⤵
  PID:15860
- C:\Windows\System\dZjiDxc.exe
  C:\Windows\System\dZjiDxc.exe
  2⤵
  PID:15944
- C:\Windows\System\QRUNovo.exe
  C:\Windows\System\QRUNovo.exe
  2⤵
  PID:16044
- C:\Windows\System\lZZMWre.exe
  C:\Windows\System\lZZMWre.exe
  2⤵
  PID:16292
- C:\Windows\System\yIfBZQP.exe
  C:\Windows\System\yIfBZQP.exe
  2⤵
  PID:15544
- C:\Windows\System\NkuvjHQ.exe
  C:\Windows\System\NkuvjHQ.exe
  2⤵
  PID:15844
- C:\Windows\System\qVYMBRM.exe
  C:\Windows\System\qVYMBRM.exe
  2⤵
  PID:16224
- C:\Windows\System\tQVARxr.exe
  C:\Windows\System\tQVARxr.exe
  2⤵
  PID:15776
- C:\Windows\System\efYXqrV.exe
  C:\Windows\System\efYXqrV.exe
  2⤵
  PID:16400
- C:\Windows\System\IbNQOLL.exe
  C:\Windows\System\IbNQOLL.exe
  2⤵
  PID:16428
- C:\Windows\System\xNyoMox.exe
  C:\Windows\System\xNyoMox.exe
  2⤵
  PID:16456
- C:\Windows\System\sVlpjyM.exe
  C:\Windows\System\sVlpjyM.exe
  2⤵
  PID:16476
- C:\Windows\System\apccrPa.exe
  C:\Windows\System\apccrPa.exe
  2⤵
  PID:16500
- C:\Windows\System\ZxhXXnG.exe
  C:\Windows\System\ZxhXXnG.exe
  2⤵
  PID:16528
- C:\Windows\System\bAMLjCo.exe
  C:\Windows\System\bAMLjCo.exe
  2⤵
  PID:16556
- C:\Windows\System\xicmEzF.exe
  C:\Windows\System\xicmEzF.exe
  2⤵
  PID:16584
- C:\Windows\System\qNgpjtG.exe
  C:\Windows\System\qNgpjtG.exe
  2⤵
  PID:16608
- C:\Windows\System\QwjEDGu.exe
  C:\Windows\System\QwjEDGu.exe
  2⤵
  PID:16640
- C:\Windows\System\bENfYbH.exe
  C:\Windows\System\bENfYbH.exe
  2⤵
  PID:16668
- C:\Windows\System\akCylHF.exe
  C:\Windows\System\akCylHF.exe
  2⤵
  PID:16692
- C:\Windows\System\eNjcMfz.exe
  C:\Windows\System\eNjcMfz.exe
  2⤵
  PID:16708
- C:\Windows\System\bDVMEve.exe
  C:\Windows\System\bDVMEve.exe
  2⤵
  PID:16728
- C:\Windows\System\LbakTJE.exe
  C:\Windows\System\LbakTJE.exe
  2⤵
  PID:16772
- C:\Windows\System\NDJeYjt.exe
  C:\Windows\System\NDJeYjt.exe
  2⤵
  PID:16792
- C:\Windows\System\CBuorOB.exe
  C:\Windows\System\CBuorOB.exe
  2⤵
  PID:16812
- C:\Windows\System\YfnqrqB.exe
  C:\Windows\System\YfnqrqB.exe
  2⤵
  PID:16876
- C:\Windows\System\jVHMmxJ.exe
  C:\Windows\System\jVHMmxJ.exe
  2⤵
  PID:16892
- C:\Windows\System\SvgJwnQ.exe
  C:\Windows\System\SvgJwnQ.exe
  2⤵
  PID:16920
- C:\Windows\System\qhWakoS.exe
  C:\Windows\System\qhWakoS.exe
  2⤵
  PID:16960
- C:\Windows\System\DbYzeLN.exe
  C:\Windows\System\DbYzeLN.exe
  2⤵
  PID:16980
- C:\Windows\System\CzJmChA.exe
  C:\Windows\System\CzJmChA.exe
  2⤵
  PID:17004
- C:\Windows\System\kLifzvE.exe
  C:\Windows\System\kLifzvE.exe
  2⤵
  PID:17036
- C:\Windows\System\quhevvj.exe
  C:\Windows\System\quhevvj.exe
  2⤵
  PID:17060
- C:\Windows\System\wDuclYy.exe
  C:\Windows\System\wDuclYy.exe
  2⤵
  PID:17084
- C:\Windows\System\oPsNieS.exe
  C:\Windows\System\oPsNieS.exe
  2⤵
  PID:17128
- C:\Windows\System\ioaCunb.exe
  C:\Windows\System\ioaCunb.exe
  2⤵
  PID:17156
- C:\Windows\System\bKZBBoh.exe
  C:\Windows\System\bKZBBoh.exe
  2⤵
  PID:17172
- C:\Windows\System\xuSjDry.exe
  C:\Windows\System\xuSjDry.exe
  2⤵
  PID:17200
- C:\Windows\System\pTSMhvy.exe
  C:\Windows\System\pTSMhvy.exe
  2⤵
  PID:17228
- C:\Windows\System\chsfKms.exe
  C:\Windows\System\chsfKms.exe
  2⤵
  PID:17268
- C:\Windows\System\RlQVVgg.exe
  C:\Windows\System\RlQVVgg.exe
  2⤵
  PID:17284
- C:\Windows\System\uWJsLuV.exe
  C:\Windows\System\uWJsLuV.exe
  2⤵
  PID:17312
- C:\Windows\System\HvuwBCs.exe
  C:\Windows\System\HvuwBCs.exe
  2⤵
  PID:17336
- C:\Windows\System\dSlXMqJ.exe
  C:\Windows\System\dSlXMqJ.exe
  2⤵
  PID:17356
- C:\Windows\System\GeQWkJy.exe
  C:\Windows\System\GeQWkJy.exe
  2⤵
  PID:17380
- C:\Windows\System\mJtRdbi.exe
  C:\Windows\System\mJtRdbi.exe
  2⤵
  PID:16412
- C:\Windows\System\ozXViVu.exe
  C:\Windows\System\ozXViVu.exe
  2⤵
  PID:16464
- C:\Windows\System\sTGXYjw.exe
  C:\Windows\System\sTGXYjw.exe
  2⤵
  PID:16520
- C:\Windows\System\vQcWYZm.exe
  C:\Windows\System\vQcWYZm.exe
  2⤵
  PID:16592
- C:\Windows\System\YeLZAUt.exe
  C:\Windows\System\YeLZAUt.exe
  2⤵
  PID:16676

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AhftJgB.exe

Filesize
1.7MB

MD5
ae77a704227299511218d6f645487b59

SHA1
bafa1edefdac14012a4719723abe90905fff19d7

SHA256
b46564d699c5edd99952e7deeb58b11fedd78d575991e06d2df327e355a5db75

SHA512
6dc51e07ed8658bfca20a6ab92c90ab685f1a3191d87914b5fa08522964ea7830691bbb0f2e955cff2dca09a98ed069af108c184892a80feabcba480b7863013

Download Submit
C:\Windows\System\ESegUPa.exe

Filesize
1.7MB

MD5
ffc605f563eca48429671fa62ddb432a

SHA1
e87b1d01115589537c316ac7001a1c80d7a76836

SHA256
6b80ac1738b15a21df17d13d77488869e6763a545f2bd7e7c694d2f28c1dfa20

SHA512
cdc93562c59c1f0f09a905cae6e243ab9f6c7ba3b4f393c02aae17141a1cc6101e009ad8f1d8f28eb24384fea97ec71b45856c9c0a8974d35e2c1660819467a1

Download Submit
C:\Windows\System\FjIhZgp.exe

Filesize
1.7MB

MD5
d30ebed1e5ce352fea9dc74d58a99bce

SHA1
0b6be922f1fa6b26c38c58eeb90d27f4d8e45ee3

SHA256
d746a49d20eb800bef3219f94923cf3205dad338ab86a4a1b3d924f4b048e794

SHA512
a460d212c52c3dee2bd68f16206af057ac927d54315e357b50abe769b6efef443cb4950ecd242d2d6747f01327c836b9b6ca901440e294c7c6a5b1ecee5d9a3e

Download Submit
C:\Windows\System\HLhbEPE.exe

Filesize
1.7MB

MD5
79879462422b3eabf425a644694d7e5c

SHA1
0493b1579cb11892901e9e2f2e93a89108902f93

SHA256
54bbcf31e00c78bcccba1ed52364c4de35f064f69ed669f322a4739639335076

SHA512
e40fcb663f7db4171b9fd219d0bb1449f3f776172c09f7034ca4d9c6fb1b9589ac3b333ac2ccff973088495a683cf03d39e99f971203f0d6661811cf7e9cd7fc

Download Submit
C:\Windows\System\LkOmfxo.exe

Filesize
1.7MB

MD5
19d83fbe77b64504c9d3c65bccb3d4f4

SHA1
ff7b493ec877ea23bc84c27b0012c13873c19d61

SHA256
b8cb062a36f0b9fb72fb9f52cab5659dcfaa914911d4376acb47215b27248af7

SHA512
d8143bfe1475cf3d81269d6b3fbb0d07bb59f7424d3f041bbfb58c5ab58224c6c6bde76ecafb8472cd69e329a62a4b988ebd5959a7a1c1d2abaf26eff10b8a46

Download Submit
C:\Windows\System\NfjEewS.exe

Filesize
1.7MB

MD5
87f55c70433406abafc9ad30a5500625

SHA1
81ea1c5715a9a9874a8b205cf857281a9a1a3dde

SHA256
a54d4c90376072272fe4d1a45849949cba7ab663df524a02df436274d8d7caca

SHA512
aa3957c762748754e1a4a8d9717d0843d22c102221f708b4eebd38a5a4cd2802ad59793fad542e122d6bcef93614840dc66ddae7c237c8b904a0558484b06b36

Download Submit
C:\Windows\System\PzRhCMy.exe

Filesize
1.7MB

MD5
35ed75528e3168ad510543e0ff3e2deb

SHA1
dd84f1a26d08857eb66dbe63f2bd50e18f320930

SHA256
eea760862c82fbb8ec68154814f7c6ddceeb54b9411c85eb94a10bcef7f8fc90

SHA512
17063a1f469417c2d9e2c45f5351b718d1f32f56ea878502ba5aaed2358ff154d70cf1591d80316e5ce3fe216fb6456826577a0cb8fd1ddc25795acd2db4d3e5

Download Submit
C:\Windows\System\QxnlSfb.exe

Filesize
1.7MB

MD5
16980f86b1f57063d6f9687611ed8098

SHA1
723b8858b48a0eff3f066d4ffedec4bd076aeb2b

SHA256
527557d16f3d9938dbd10aa1879ad66e91ca65eb03081dcc9457285deba51569

SHA512
3642c674559efb0636b4b109d1f46a2d8d86305fc42b894c898170b4c5fa61a4435951e31c267c8c2dfdf2e068a91f7fb48a4b785991d8877810a884fd6ff77d

Download Submit
C:\Windows\System\WWGnnHH.exe

Filesize
1.7MB

MD5
991322480ebc0ed40558b5259249e15b

SHA1
fa5f59c5a28f11549c9e283f530189ac4fd474fc

SHA256
ff8d5e32059d6bb4d674045b90948ce84dc6835e0a8dec7dc8ec878fa9b19839

SHA512
20a6ffc654bb3e11b2a60dd5f5d7f6fc12ad3962af397dc992e20ff19d2d8b2b4365595e70bac9cdac846d889f724666ad2a4e35b285fd4120cd2aaca844adda

Download Submit
C:\Windows\System\XNMFGMH.exe

Filesize
1.7MB

MD5
6cca948e323641630b1b714ab6012aca

SHA1
c3e3b2e8027ca72701319b597e2bf61f2930b675

SHA256
964982aacfb3a8b0a5ac805eae4668af4647445372b20a158f4e28fda927de80

SHA512
33296a5a29689fa80e03c7db55fe838b82621de8eccc485b022dd012ab08f83267b5856a05e141e436d036537d7faf54eaa66d0ceb0d69d2b85baad1d5d0c627

Download Submit
C:\Windows\System\XPxwOwD.exe

Filesize
1.7MB

MD5
2ef3a711366cc80bf6cf97fd699d2ba4

SHA1
19b20c2996155ee69daf82eb2f4232d49dacdcc2

SHA256
b83120aab11c4ef798954549f29a2347462107aa181000ca9e0c150bd178f624

SHA512
e6eb936c415c93709ccb9c862bd3c9dea1cb96fa8eb7d581124451861824922daf76cac90b72dc5d2a0eda586e68f342bf85fa0075ce7ad89275af5aea203b42

Download Submit
C:\Windows\System\XpHtmMo.exe

Filesize
1.7MB

MD5
9493b22815e912991fe2335accd29478

SHA1
04aac0150c2ad11eea3f6000774724a723c69dbc

SHA256
81eeee002988f5645d8a775924fc1187c88ebd7390e2199cfe2d74dc0a07e107

SHA512
a1c6cacdb456db9592b9e62075c21d4aec803236ae1b7e8fa7596e66a3b8ef5bf724130feb80b3e9f72b3fd05b6a4f88cc55cd224187e1083954a7806ae51a5f

Download Submit
C:\Windows\System\cXLcdKy.exe

Filesize
1.7MB

MD5
c04accb03217cda26184d70694066a75

SHA1
b3406f89fada73ebd06105ac134da1282eb1ce24

SHA256
eb5da9e659ee007c12046da8fff80655f857288d3d371941676c8ef09c1c3d74

SHA512
3869ca9418b6fb0d3dfb2ccecff0e3f7abf4ae1b8ecd9425f08388c5395425e14b73dcf6849ecc13a2e792b936716a8892aa4d9f63bc047d69b76433eefbe4ea

Download Submit
C:\Windows\System\csvxdsx.exe

Filesize
1.7MB

MD5
5038cb6e01724a6679c137892ba194e4

SHA1
c3964b1895e5588f5272caa3b9951898da6724a0

SHA256
e252ba333a0a4f398b3c514d1f70836375e0530c4582f0759760f2b806dc6363

SHA512
9b72b71fb7347a6a99d59cb0581f8cd1b2df94d35338d0d0a8cb516bb3908c79652d785ad118f4ff4c7b1d732dce167895c6dbc44569d7abf763f88c5bb95149

Download Submit
C:\Windows\System\fMFJbXo.exe

Filesize
1.7MB

MD5
a4fdf0ea0233cdf44de2fa9312d65a0e

SHA1
f6a7b07eb45f0662c024d2ccf4f4b9808fe21784

SHA256
bb38e513aee30622e4d74bb063fa4c63ba97c1c5bea496e9585de2c21e7b32f7

SHA512
09eb4bb1a3ff7170a4ec1e6ce56c4279265bfa92f2250e6ca804d7553dfcfef79e3722ecbf9cde420a02f599b2c68b61df00fd176a7f557c874ca348dcf8a44e

Download Submit
C:\Windows\System\fexkpHM.exe

Filesize
1.7MB

MD5
099c62c4a69472bf683665ab8ccdf939

SHA1
2e529a4361ba78eb2ae0fc9ec61ec1d27d43dc3c

SHA256
c3ef989d7bec838e21ba3b2f8943720169d699acec56344ae593bcdf644cd003

SHA512
62b17a5f2661a6e6584cd372405092bc2560a5323ea816e55d96a14a741effbb44d6ca1474cf3d81fbec3691dfa5e47e87e96e1161a74ad8c48390db391bf426

Download Submit
C:\Windows\System\fpcIWPD.exe

Filesize
1.7MB

MD5
507cd0e9cf65b0ea5c27990d78c3aae0

SHA1
794102e256ccd5ca7d04d838dcb72dbbab933e31

SHA256
c52b45568562f95a238a6ce7a265922a1d2b4b884f5717f7aa3f92cdb1674149

SHA512
16296d0b5d7ccff6759a17aa2912cdf306500d37d65f0c04116363f8b772c87fe32f4e2830bb9ee70778af2b3606c8fdeb4dc5d80997938f1bf118ba51fb57e0

Download Submit
C:\Windows\System\idAvGWF.exe

Filesize
1.7MB

MD5
33e9575f1ba99becab8699803c18cdf5

SHA1
de49318cd7aa59035abdc6cb39d4def24649e1aa

SHA256
ec0528d1f3573626207a90b09b7b32e609bb3599342c3fceb6dee74d632567ef

SHA512
c51f70dc7b11d80618252239cdfda0ad1a92988022fa347b4d2a5ce69626d07173786288b2589a7a252345b5002e9a948f92cac2b93fe37a6fef3946055b0f33

Download Submit
C:\Windows\System\kHgYGLr.exe

Filesize
1.7MB

MD5
5a235970fe0fecc549c84517f0a0957b

SHA1
d2330e61de3ab600aa482662dc1f81334849d600

SHA256
e8a6739f6dc603236c3117b33e76f4ae992ba1c9a1b7da4ac21cc3308a9cd9e8

SHA512
21c779a960a5007f52747d0d50a07a6cd690e2e7477d8676b3a4800223db84304841d46f350de8756f8e9c9a3f8f64a9b22b95ab0f67548957542bd130e305bd

Download Submit
C:\Windows\System\nBXQAdS.exe

Filesize
1.7MB

MD5
98d66126bacfb2c09de0fc15bae4330b

SHA1
bb676b1e061e296a4e2e58afb05276a00735d3a3

SHA256
3d441fe85451c44c7f68f4cfa7b5f92fe27f3292dbb372feebe196c7cc837ee8

SHA512
f36c0f81abbceac4ef614b9194d42dd7b2386a3e856a8c22178203e155ee6d9311331b21b067da3d2c518a0459a787c37a535b36d0a0a1824e79220fb99d376f

Download Submit
C:\Windows\System\nmKtjUX.exe

Filesize
1.7MB

MD5
94347199ea22d259d8c2db0165818ba3

SHA1
ab2f88df6c93f888c194984e6690f83ac16e1404

SHA256
3aa7b86b9adff0c2767fe9d7655fa7a0c883da9a78390050f9ba4e9356ddb2f2

SHA512
4c4cfe429faa5f5b8bb5721b5e55c07e87bc795f8d2e10f1d33cfe3929b30a3c10298e6c94e258f467a01971ec0070759a7a6e9db7a22583ef15a4a2f82afd73

Download Submit
C:\Windows\System\oTtVaqb.exe

Filesize
1.7MB

MD5
d136ca1247aafc1522fe92ae658de3d9

SHA1
a496f15c46703e255e24fa23a21d7d7154bfcb2b

SHA256
15fda4952e8259c0ade715d0e86bffa5bde522e45f2072a831960cfb8e772a52

SHA512
c22752f3cbcc98ca5bfed89dd3d6693cdb7a97a23f6414da4fbfe86fecd4fecc50a018aef75af89b0aa707af1a7260e49b109ae2d1f9aca81e93f7ddf123fccf

Download Submit
C:\Windows\System\oeTgIJd.exe

Filesize
1.7MB

MD5
2f3e654b7d137fa5fac83585a9abe65e

SHA1
7bec61134d3ced5cf8a5f524ed7b459b0363f9b3

SHA256
1bb3c656692cecbcc9521dbecbe23dfb6814c4b4b99dd675800436ac7ce9e5e4

SHA512
b09dc17d94d7c763610d3f6940653b04325fbb4a49ba9d202704a99b428a02f54db7881bc57249eb49a29c998c9bcf2e8879950d9509ce23786fae2bab5409c9

Download Submit
C:\Windows\System\pzafeNo.exe

Filesize
1.7MB

MD5
8670cda8339c860e29eb175b78d2a86d

SHA1
c76b7088fe31112a57f73ed349beea3fde46c034

SHA256
24d907f293c71fabcfb515fbcbfb301ef63c927a96f650551cd1e3d3a2e9231b

SHA512
6ad7a413a10d97dc468b43b743e3b99b633b16baf3668643bb6751da6c7cd958d76982ef0354cd4a1cec3a2aba0d8a49eb743e06e5e2b0c8adea54504fa91fc1

Download Submit
C:\Windows\System\qYZNIBj.exe

Filesize
1.7MB

MD5
3acbda8203f628abb2a9c1905d7c389a

SHA1
683017d7ced923554ef29f0499c8bd62fb2a54b1

SHA256
20c5dc0df7be9247ee01190a8f879a2552953d0c4b860c289c4ddc089f8261ad

SHA512
4189e077e5f431e53b5719fa9d315ad46c62ea5e0ccd8ecb4b8d78e710c5e3c306cf5fa0c39a8092a2ffd10b90137d0b23fde81a862c7ba6d6289bc67653a346

Download Submit
C:\Windows\System\sVdHAhZ.exe

Filesize
1.7MB

MD5
a8f42db510606102686a8ce047d5682e

SHA1
e78d68bd70a7a1eb8de717cc33014a4034f952df

SHA256
a98a1f37bd94e998a236e271dacfd39a9a073cab7d1c10ecf7ab9f2ad28905b9

SHA512
ee7963cc63f64ef8e96327f43bc207ea04fef7ebdec66f840ae17cd8d3cd7f0a8bc77feeaf8314ac855a3c363e0c0507052f460597ffd357d510d808f2eb237b

Download Submit
C:\Windows\System\skRqgsm.exe

Filesize
1.7MB

MD5
471f150bd519f55b82b21d3b4ecf93e3

SHA1
142661c58335bf9ae53200fb018871ec5ec3962d

SHA256
5035b36987848ffda0de3551467255adad88be80b8faad722f8eb83a6ef757cf

SHA512
9f3c136def3e5b89561b407280cde2ffa6d92141acf607b40464cdde38487acebf2d50d804e07a2e500a9ff4c1a25ce0184da88fa315a1a066867b0f6f7f857f

Download Submit
C:\Windows\System\vFZvZSm.exe

Filesize
1.7MB

MD5
0f35288fe2febf8c9fcd197390c53fcf

SHA1
c47224ed173799babd470d1960749c36cd6c85fe

SHA256
cf19838a87d9f2ffe01ca8b189cf5d1bd32a97000ec87742fbe301d4eb804d9a

SHA512
0e3131957a76b52ee42e068f4e52a1d0895a422d0c81e9f5deeee2047221b11d43eb6122b36096cb523e342cfa56d530d83e95a2b024d12bdeae3e67134541d3

Download Submit
C:\Windows\System\vlhYCvd.exe

Filesize
1.7MB

MD5
a126c83ab039bc92348acd74d9e566ab

SHA1
000df353cf23f4973168acd8bad9db8dd3b5a58f

SHA256
95988700350b3a5a22d7b54cb3a87ad12d725660e9aebb4c37a695e472667909

SHA512
fd1f32c1c131f7ff7069219324a9222feadc7161f499af3028d21b3deb0a4544d7ece7a31561f73adb8e08e75438ee4aa1cfe1497a792b0f1d0a9116f6f2cf57

Download Submit
C:\Windows\System\vnYOqdM.exe

Filesize
1.7MB

MD5
6cc0474599290425ed45540a493cfcad

SHA1
b03062fe0305a748f6738d1c4c87565d6c3e0ccf

SHA256
fb154a251deb7efe378b7dd87a848f2d0cc0f08fe0170562861a9eeb209620fd

SHA512
36a9efa517a15630ecf1d3853c4166334751ee356f4e102530f35738e78833bea394f72f7ae889a3b65854d4f534fcbd714fc124205df8f34f629fff9bc8af4c

Download Submit
C:\Windows\System\wbSNTyH.exe

Filesize
1.7MB

MD5
fa4731a286a11a8defc8a48aed62b3fe

SHA1
6fd85f1c253aa0f9de4ddc1cee0f6f0d58ee63e5

SHA256
e2840c0edf5548ccf8e054ec2478a0be05dc5120928b8a89f1ab261569efb44b

SHA512
8fdaadcc8be19e9a67cdcb23a68d9ac6213c65b65b738723db691b9550090b031720a9200e016123b10502d33080be66a892491dc73265dc59c217438b5af46a

Download Submit
C:\Windows\System\xTgKwoM.exe

Filesize
1.7MB

MD5
87ec10d1f42c83c4fff669f4c3189465

SHA1
da906d0b9be66d6db124f38b18e6284333d0de91

SHA256
c25994f37689db7adb7890918e5a85c1c0079e6c8b1cd19dff6498c5c11afc16

SHA512
08b6da542009132274c47e1d5ea0f59c786bb96185fb11e1d27a32d18b6e71a10bdaeb8d900f22944344e7dd8f05896e5ace4b498b099a208f27a82514b6191e

Download Submit
memory/4684-0-0x000002BC633B0000-0x000002BC633C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads